{"text": "(* Title: JinjaThreads/Compiler/Execs.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\JVM Semantics for the delay bisimulation proof from intermediate language to byte code\\\n\ntheory Execs imports JVMTau begin\n\ndeclare match_ex_table_app [simp del]\n match_ex_table_eq_NoneI [simp del]\n compxE2_size_convs [simp del]\n compxE2_stack_xlift_convs [simp del]\n compxEs2_stack_xlift_convs [simp del]\n\ntype_synonym\n ('addr, 'heap) check_instr' = \n \"'addr instr \\ 'addr jvm_prog \\ 'heap \\ 'addr val list \\ 'addr val list \\ cname \\ mname \\ pc \\ 'addr frame list \\ bool\"\n\nprimrec check_instr' :: \"('addr, 'heap) check_instr'\"\nwhere \ncheck_instr'_Load:\n \"check_instr' (Load n) P h stk loc C M\\<^sub>0 pc frs =\n True\"\n\n| check_instr'_Store:\n \"check_instr' (Store n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_Push:\n \"check_instr' (Push v) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n True\"\n\n| check_instr'_New:\n \"check_instr' (New C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n True\"\n\n| check_instr'_NewArray:\n \"check_instr' (NewArray T) P h stk loc C0 M0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_ALoad:\n \"check_instr' ALoad P h stk loc C0 M0 pc frs =\n (1 < length stk)\"\n\n| check_instr'_AStore:\n \"check_instr' AStore P h stk loc C0 M0 pc frs =\n (2 < length stk)\"\n\n| check_instr'_ALength:\n \"check_instr' ALength P h stk loc C0 M0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_Getfield:\n \"check_instr' (Getfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk)\"\n\n| check_instr'_Putfield:\n \"check_instr' (Putfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (1 < length stk)\"\n\n| check_instr'_CAS:\n \"check_instr' (CAS F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (2 < length stk)\"\n\n| check_instr'_Checkcast:\n \"check_instr' (Checkcast T) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_Instanceof:\n \"check_instr' (Instanceof T) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_Invoke:\n \"check_instr' (Invoke M n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (n < length stk)\"\n\n| check_instr'_Return:\n \"check_instr' Return P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n \n| check_instr'_Pop:\n \"check_instr' Pop P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk)\"\n\n| check_instr'_Dup:\n \"check_instr' Dup P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk)\"\n\n| check_instr'_Swap:\n \"check_instr' Swap P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (1 < length stk)\"\n\n| check_instr'_BinOpInstr:\n \"check_instr' (BinOpInstr bop) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (1 < length stk)\"\n\n| check_instr'_IfFalse:\n \"check_instr' (IfFalse b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ 0 \\ int pc+b)\"\n\n| check_instr'_Goto:\n \"check_instr' (Goto b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 \\ int pc+b)\"\n\n| check_instr'_Throw:\n \"check_instr' ThrowExc P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_MEnter:\n \"check_instr' MEnter P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\n| check_instr'_MExit:\n \"check_instr' MExit P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk)\"\n\ndefinition ci_stk_offer :: \"('addr, 'heap) check_instr' \\ bool\"\nwhere\n \"ci_stk_offer ci =\n (\\ins P h stk stk' loc C M pc frs. ci ins P h stk loc C M pc frs \\ ci ins P h (stk @ stk') loc C M pc frs)\"\n\nlemma ci_stk_offerI:\n \"(\\ins P h stk stk' loc C M pc frs. ci ins P h stk loc C M pc frs \\ ci ins P h (stk @ stk') loc C M pc frs) \\ ci_stk_offer ci\"\nunfolding ci_stk_offer_def by blast\n\nlemma ci_stk_offerD:\n \"\\ ci_stk_offer ci; ci ins P h stk loc C M pc frs \\ \\ ci ins P h (stk @ stk') loc C M pc frs\"\nunfolding ci_stk_offer_def by blast\n\n\nlemma check_instr'_stk_offer:\n \"ci_stk_offer check_instr'\"\nproof(rule ci_stk_offerI)\n fix ins P h stk stk' loc C M pc frs\n assume \"check_instr' ins P h stk loc C M pc frs\"\n thus \"check_instr' ins P h (stk @ stk') loc C M pc frs\"\n by(cases ins) auto\nqed\n\ncontext JVM_heap_base begin\n\nlemma check_instr_imp_check_instr':\n \"check_instr ins P h stk loc C M pc frs \\ check_instr' ins P h stk loc C M pc frs\"\nby(cases ins) auto\n\nlemma check_instr_stk_offer:\n \"ci_stk_offer check_instr\"\nproof(rule ci_stk_offerI)\n fix ins P h stk stk' loc C M pc frs\n assume \"check_instr ins P h stk loc C M pc frs\"\n thus \"check_instr ins P h (stk @ stk') loc C M pc frs\"\n by(cases ins)(auto simp add: nth_append hd_append neq_Nil_conv tl_append split: list.split)\nqed\n\nend\n\n(* TODO: Combine ins_jump_ok and jump_ok *)\nprimrec jump_ok :: \"'addr instr list \\ nat \\ nat \\ bool\"\nwhere \"jump_ok [] n n' = True\"\n| \"jump_ok (x # xs) n n' = (jump_ok xs (Suc n) n' \\ \n (case x of IfFalse m \\ - int n \\ m \\ m \\ int (n' + length xs)\n | Goto m \\ - int n \\ m \\ m \\ int (n' + length xs)\n | _ \\ True))\"\n\nlemma jump_ok_append [simp]:\n \"jump_ok (xs @ xs') n n' \\ jump_ok xs n (n' + length xs') \\ jump_ok xs' (n + length xs) n'\"\napply(induct xs arbitrary: n)\n apply(simp)\napply(auto split: instr.split)\ndone\n\nlemma jump_ok_GotoD:\n \"\\ jump_ok ins n n'; ins ! pc = Goto m; pc < length ins \\ \\ - int (pc + n) \\ m \\ m < int (length ins - pc + n')\"\napply(induct ins arbitrary: n n' pc)\n apply(simp)\napply(clarsimp)\napply(case_tac pc)\napply(fastforce)+\ndone\n\nlemma jump_ok_IfFalseD:\n \"\\ jump_ok ins n n'; ins ! pc = IfFalse m; pc < length ins \\ \\ - int (pc + n) \\ m \\ m < int (length ins - pc + n')\"\napply(induct ins arbitrary: n n' pc)\n apply(simp)\napply(clarsimp)\napply(case_tac pc)\napply(fastforce)+\ndone\n\nlemma fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n shows compE2_jump_ok [intro!]: \"jump_ok (compE2 e) n (Suc n')\"\n and compEs2_jump_ok [intro!]: \"jump_ok (compEs2 es) n (Suc n')\"\napply(induct e and es arbitrary: n n' and n n' rule: compE2.induct compEs2.induct)\napply(auto split: bop.split)\ndone\n\nlemma fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n shows compE1_Goto_not_same: \"\\ compE2 e ! pc = Goto i; pc < length (compE2 e) \\ \\ nat (int pc + i) \\ pc\"\n and compEs2_Goto_not_same: \"\\ compEs2 es ! pc = Goto i; pc < length (compEs2 es) \\ \\ nat (int pc + i) \\ pc\"\napply(induct e and es arbitrary: pc i and pc i rule: compE2.induct compEs2.induct)\napply(auto simp add: nth_Cons nth_append split: if_split_asm bop.split_asm nat.splits)\napply fastforce+\ndone\n\nfun ins_jump_ok :: \"'addr instr \\ nat \\ bool\"\nwhere\n \"ins_jump_ok (Goto m) l = (- (int l) \\ m)\"\n| \"ins_jump_ok (IfFalse m) l = (- (int l) \\ m)\"\n| \"ins_jump_ok _ _ = True\"\n\ndefinition wf_ci :: \"('addr, 'heap) check_instr' \\ bool\"\nwhere\n \"wf_ci ci \\\n ci_stk_offer ci \\ ci \\ check_instr' \\\n (\\ins P h stk loc C M pc pc' frs. ci ins P h stk loc C M pc frs \\ ins_jump_ok ins pc' \\ ci ins P h stk loc C M pc' frs)\"\n\nlemma wf_ciI:\n \"\\ ci_stk_offer ci;\n \\ins P h stk loc C M pc frs. ci ins P h stk loc C M pc frs \\ check_instr' ins P h stk loc C M pc frs;\n \\ins P h stk loc C M pc pc' frs. \\ ci ins P h stk loc C M pc frs; ins_jump_ok ins pc' \\ \\ ci ins P h stk loc C M pc' frs \\\n \\ wf_ci ci\"\nunfolding wf_ci_def le_fun_def le_bool_def\nby blast\n\nlemma check_instr'_pc:\n \"\\ check_instr' ins P h stk loc C M pc frs; ins_jump_ok ins pc' \\ \\ check_instr' ins P h stk loc C M pc' frs\"\nby(cases ins) auto\n\nlemma wf_ci_check_instr' [iff]:\n \"wf_ci check_instr'\"\napply(rule wf_ciI)\n apply(rule check_instr'_stk_offer)\n apply(assumption)\napply(erule (1) check_instr'_pc)\ndone\n\nlemma jump_ok_ins_jump_ok:\n \"\\ jump_ok ins n n'; pc < length ins \\ \\ ins_jump_ok (ins ! pc) (pc + n)\"\napply(induct ins arbitrary: n n' pc)\napply(fastforce simp add: nth_Cons' gr0_conv_Suc split: instr.split_asm)+\ndone\n\ncontext JVM_heap_base begin\n\nlemma check_instr_pc:\n \"\\ check_instr ins P h stk loc C M pc frs; ins_jump_ok ins pc' \\ \\ check_instr ins P h stk loc C M pc' frs\"\nby(cases ins) auto\n\nlemma wf_ci_check_instr [iff]:\n \"wf_ci check_instr\"\napply(rule wf_ciI)\n apply(rule check_instr_stk_offer)\n apply(erule check_instr_imp_check_instr')\napply(erule (1) check_instr_pc)\ndone\n\nend\n\nlemma wf_ciD1: \"wf_ci ci \\ ci_stk_offer ci\"\nunfolding wf_ci_def by blast\n\nlemma wf_ciD2: \"\\ wf_ci ci; ci ins P h stk loc C M pc frs \\ \\ check_instr' ins P h stk loc C M pc frs\"\nunfolding wf_ci_def le_fun_def le_bool_def\nby blast\n\nlemma wf_ciD3: \"\\ wf_ci ci; ci ins P h stk loc C M pc frs; ins_jump_ok ins pc' \\ \\ ci ins P h stk loc C M pc' frs\"\nunfolding wf_ci_def by blast\n\nlemma check_instr'_ins_jump_ok: \"check_instr' ins P h stk loc C M pc frs \\ ins_jump_ok ins pc\"\nby(cases ins) auto\nlemma wf_ci_ins_jump_ok:\n assumes wf: \"wf_ci ci\"\n and ci: \"ci ins P h stk loc C M pc frs\"\n and pc': \"pc \\ pc'\"\n shows \"ins_jump_ok ins pc'\"\nproof -\n from wf ci have \"check_instr' ins P h stk loc C M pc frs\" by(rule wf_ciD2)\n with pc' have \"check_instr' ins P h stk loc C M pc' frs\" by(cases ins) auto\n thus ?thesis by(rule check_instr'_ins_jump_ok)\nqed\n\nlemma wf_ciD3': \"\\ wf_ci ci; ci ins P h stk loc C M pc frs; pc \\ pc' \\ \\ ci ins P h stk loc C M pc' frs\"\napply(frule (2) wf_ci_ins_jump_ok)\napply(erule (2) wf_ciD3)\ndone\n\ntypedef ('addr, 'heap) check_instr = \"Collect wf_ci :: ('addr, 'heap) check_instr' set\"\n morphisms ci_app Abs_check_instr\nby auto\n\nlemma ci_app_check_instr' [simp]: \"ci_app (Abs_check_instr check_instr') = check_instr'\"\nby(simp add: Abs_check_instr_inverse)\n\nlemma (in JVM_heap_base) ci_app_check_instr [simp]: \"ci_app (Abs_check_instr check_instr) = check_instr\"\nby(simp add: Abs_check_instr_inverse)\n\nlemma wf_ci_stk_offerD:\n \"ci_app ci ins P h stk loc C M pc frs \\ ci_app ci ins P h (stk @ stk') loc C M pc frs\"\napply(rule ci_stk_offerD[OF wf_ciD1]) back\nby(rule ci_app [simplified])\n\nlemma wf_ciD2_ci_app:\n \"ci_app ci ins P h stk loc C M pc frs \\ check_instr' ins P h stk loc C M pc frs\"\napply(cases ci)\napply(simp add: Abs_check_instr_inverse)\napply(erule (1) wf_ciD2)\ndone\n\nlemma wf_ciD3_ci_app:\n \"\\ ci_app ci ins P h stk loc C M pc frs; ins_jump_ok ins pc' \\ \\ ci_app ci ins P h stk loc C M pc' frs\"\napply(cases ci)\napply(simp add: Abs_check_instr_inverse)\napply(erule (2) wf_ciD3)\ndone\n\nlemma wf_ciD3'_ci_app: \"\\ ci_app ci ins P h stk loc C M pc frs; pc \\ pc' \\ \\ ci_app ci ins P h stk loc C M pc' frs\"\napply(cases ci)\napply(simp add: Abs_check_instr_inverse)\napply(erule (2) wf_ciD3')\ndone\n\ncontext JVM_heap_base begin\n\ninductive exec_meth ::\n \"('addr, 'heap) check_instr \\ 'addr jvm_prog \\ 'addr instr list \\ ex_table \\ 'thread_id\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ ('addr, 'thread_id, 'heap) jvm_thread_action\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nfor ci :: \"('addr, 'heap) check_instr\" and P :: \"'addr jvm_prog\" \nand ins :: \"'addr instr list\" and xt :: \"ex_table\" and t :: 'thread_id\nwhere\n exec_instr: \n \"\\ (ta, xcp, h', [(stk', loc', undefined, undefined, pc')]) \\ exec_instr (ins ! pc) P t h stk loc undefined undefined pc [];\n pc < length ins;\n ci_app ci (ins ! pc) P h stk loc undefined undefined pc [] \\\n \\ exec_meth ci P ins xt t h (stk, loc, pc, None) ta h' (stk', loc', pc', xcp)\"\n\n| exec_catch:\n \"\\ match_ex_table P (cname_of h xcp) pc xt = \\(pc', d)\\; d \\ length stk \\\n \\ exec_meth ci P ins xt t h (stk, loc, pc, \\xcp\\) \\ h (Addr xcp # drop (size stk - d) stk, loc, pc', None)\"\n\nlemma exec_meth_instr:\n \"exec_meth ci P ins xt t h (stk, loc, pc, None) ta h' (stk', loc', pc', xcp) \\\n (ta, xcp, h', [(stk', loc', undefined, undefined, pc')]) \\ exec_instr (ins ! pc) P t h stk loc undefined undefined pc [] \\ pc < length ins \\ ci_app ci (ins ! pc) P h stk loc undefined undefined pc []\"\nby(auto elim: exec_meth.cases intro: exec_instr)\n\nlemma exec_meth_xcpt:\n \"exec_meth ci P ins xt t h (stk, loc, pc, \\xcp\\) ta h (stk', loc', pc', xcp') \\\n (\\d. match_ex_table P (cname_of h xcp) pc xt = \\(pc', d)\\ \\ ta = \\ \\ stk' = (Addr xcp # drop (size stk - d) stk) \\ loc' = loc \\ xcp' = None \\ d \\ length stk)\"\nby(auto elim: exec_meth.cases intro: exec_catch)\n\nabbreviation exec_meth_a\nwhere \"exec_meth_a \\ exec_meth (Abs_check_instr check_instr')\"\n\nabbreviation exec_meth_d\nwhere \"exec_meth_d \\ exec_meth (Abs_check_instr check_instr)\"\n\nlemma exec_meth_length_compE2D [dest]:\n \"exec_meth ci P (compE2 e) (compxE2 e 0 d) t h (stk, loc, pc, xcp) ta h' s' \\ pc < length (compE2 e)\"\napply(erule exec_meth.cases)\napply(auto dest: match_ex_table_pc_length_compE2)\ndone\n\nlemma exec_meth_length_compEs2D [dest]:\n \"exec_meth ci P (compEs2 es) (compxEs2 es 0 0) t h (stk, loc, pc, xcp) ta h' s' \\ pc < length (compEs2 es)\"\napply(erule exec_meth.cases)\napply(auto dest: match_ex_table_pc_length_compEs2)\ndone\n\nlemma exec_instr_stk_offer:\n assumes check: \"check_instr' (ins ! pc) P h stk loc C M pc frs\"\n and exec: \"(ta', xcp', h', (stk', loc', C, M, pc') # frs) \\ exec_instr (ins ! pc) P t h stk loc C M pc frs\"\n shows \"(ta', xcp', h', (stk' @ stk'', loc', C, M, pc') # frs) \\ exec_instr (ins ! pc) P t h (stk @ stk'') loc C M pc frs\"\nusing assms\nproof(cases \"ins ! pc\")\n case (Invoke M n)\n thus ?thesis using exec check\n by(auto split: if_split_asm extCallRet.splits split del: if_split simp add: split_beta nth_append min_def extRet2JVM_def)\nqed(force simp add: nth_append is_Ref_def has_method_def nth_Cons split_beta hd_append tl_append neq_Nil_conv split: list.split if_split_asm nat.splits sum.split_asm)+\n\nlemma exec_meth_stk_offer:\n assumes exec: \"exec_meth ci P ins xt t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_meth ci P ins (stack_xlift (length stk'') xt) t h (stk @ stk'', loc, pc, xcp) ta h' (stk' @ stk'', loc', pc', xcp')\"\nusing exec\nproof(cases)\n case (exec_catch xcp d)\n from \\match_ex_table P (cname_of h xcp) pc xt = \\(pc', d)\\\\\n have \"match_ex_table P (cname_of h xcp) pc (stack_xlift (length stk'') xt) = \\(pc', length stk'' + d)\\\"\n by(simp add: match_ex_table_stack_xlift)\n moreover have \"length stk'' + d \\ length (stk @ stk'')\" using \\d \\ length stk\\ by simp\n ultimately have \"exec_meth ci P ins (stack_xlift (length stk'') xt) t h ((stk @ stk''), loc, pc, \\xcp\\) \\ h ((Addr xcp # drop (length (stk @ stk'') - (length stk'' + d)) (stk @ stk'')), loc, pc', None)\"\n by(rule exec_meth.exec_catch)\n with exec_catch show ?thesis by(simp)\nnext\n case exec_instr\n note ciins = \\ci_app ci (ins ! pc) P h stk loc undefined undefined pc []\\\n hence \"ci_app ci (ins ! pc) P h (stk @ stk'') loc undefined undefined pc []\"\n by(rule wf_ci_stk_offerD)\n moreover from ciins\n have \"check_instr' (ins ! pc) P h stk loc undefined undefined pc []\"\n by(rule wf_ciD2_ci_app)\n hence \"(ta, xcp', h', [(stk' @ stk'', loc', undefined, undefined, pc')]) \\ exec_instr (ins ! pc) P t h (stk @ stk'') loc undefined undefined pc []\"\n using \\(ta, xcp', h', [(stk', loc', undefined,undefined , pc')]) \\ exec_instr (ins ! pc) P t h stk loc undefined undefined pc []\\\n by(rule exec_instr_stk_offer)\n ultimately show ?thesis using exec_instr by(auto intro: exec_meth.exec_instr)\nqed\n \nlemma exec_meth_append_xt [intro]:\n \"exec_meth ci P ins xt t h s ta h' s'\n \\ exec_meth ci P (ins @ ins') (xt @ xt') t h s ta h' s'\"\napply(erule exec_meth.cases)\n apply(auto)\n apply(rule exec_instr)\n apply(clarsimp simp add: nth_append)\n apply(simp)\n apply(simp add: nth_append)\napply(rule exec_catch)\nby(simp)\n\nlemma exec_meth_append [intro]:\n \"exec_meth ci P ins xt t h s ta h' s' \\ exec_meth ci P (ins @ ins') xt t h s ta h' s'\"\nby(rule exec_meth_append_xt[where xt'=\"[]\", simplified])\n\nlemma append_exec_meth_xt:\n assumes exec: \"exec_meth ci P ins xt t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and jump: \"jump_ok ins 0 n\"\n and pcs: \"pcs xt' \\ {0..match_ex_table P (cname_of h xcp) pc xt = \\(pc', d)\\\\\n have \"match_ex_table P (cname_of h xcp) (length ins' + pc) (shift (length ins') xt) = \\(length ins' + pc', d)\\\"\n by(simp add: match_ex_table_shift)\n moreover from pcs have \"length ins' + pc \\ pcs xt'\" by(auto)\n ultimately have \"match_ex_table P (cname_of h xcp) (length ins' + pc) (xt' @ shift (length ins') xt) = \\(length ins' + pc', d)\\\"\n by(simp add: match_ex_table_append_not_pcs)\n with exec_catch show ?thesis by(auto dest: exec_meth.exec_catch)\nnext\n case exec_instr\n note exec = \\(ta, xcp', h', [(stk', loc', undefined, undefined, pc')]) \\ exec_instr (ins ! pc) P t h stk loc undefined undefined pc []\\\n hence \"(ta, xcp', h', [(stk', loc', undefined, undefined, length ins' + pc')]) \\ exec_instr (ins ! pc) P t h stk loc undefined undefined (length ins' + pc) []\"\n proof(cases \"ins ! pc\")\n case (Goto i)\n with jump \\pc < length ins\\ have \"- int pc \\ i\" \"i < int (length ins - pc + n)\"\n by(auto dest: jump_ok_GotoD)\n with exec Goto show ?thesis by(auto)\n next\n case (IfFalse i)\n with jump \\pc < length ins\\ have \"- int pc \\ i\" \"i < int (length ins - pc + n)\"\n by(auto dest: jump_ok_IfFalseD)\n with exec IfFalse show ?thesis by(auto)\n next\n case (Invoke M n)\n with exec show ?thesis \n by(auto split: if_split_asm extCallRet.splits split del: if_split simp add: split_beta nth_append min_def extRet2JVM_def)\n qed(auto simp add: split_beta split: if_split_asm sum.split_asm)\n moreover from \\ci_app ci (ins ! pc) P h stk loc undefined undefined pc []\\\n have \"ci_app ci (ins ! pc) P h stk loc undefined undefined (length ins' + pc) []\"\n by(rule wf_ciD3'_ci_app) simp\n ultimately have \"exec_meth ci P (ins' @ ins) (xt' @ shift (length ins') xt) t h (stk, loc, (length ins' + pc), None) ta h' (stk', loc', (length ins' + pc'), xcp')\"\n using \\pc < length ins\\ by -(rule exec_meth.exec_instr, simp_all)\n thus ?thesis using exec_instr by(auto)\nqed\n\nlemma append_exec_meth:\n assumes exec: \"exec_meth ci P ins xt t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and jump: \"jump_ok ins 0 n\"\n shows \"exec_meth ci P (ins' @ ins) (shift (length ins') xt) t h (stk, loc, (length ins' + pc), xcp) ta h' (stk', loc', (length ins' + pc'), xcp')\"\nusing assms by(rule append_exec_meth_xt [where xt'=\"[]\", simplified])\n\nlemma exec_meth_take_xt':\n \"\\ exec_meth ci P (ins @ ins') (xt' @ xt) t h (stk, loc, pc, xcp) ta h' s';\n pc < length ins; pc \\ pcs xt \\\n \\ exec_meth ci P ins xt' t h (stk, loc, pc, xcp) ta h' s'\"\napply(erule exec_meth.cases)\napply(auto intro: exec_meth.intros simp add: match_ex_table_append nth_append dest: match_ex_table_pcsD)\ndone\n\nlemma exec_meth_take_xt:\n \"\\ exec_meth ci P (ins @ ins') (xt' @ shift (length ins) xt) t h (stk, loc, pc, xcp) ta h' s';\n pc < length ins \\\n \\ exec_meth ci P ins xt' t h (stk, loc, pc, xcp) ta h' s'\"\nby(auto intro: exec_meth_take_xt')\n\nlemma exec_meth_take:\n \"\\ exec_meth ci P (ins @ ins') xt t h (stk, loc, pc, xcp) ta h' s';\n pc < length ins \\\n \\ exec_meth ci P ins xt t h (stk, loc, pc, xcp) ta h' s'\"\nby(auto intro: exec_meth_take_xt[where xt = \"[]\"])\n\n\nlemma exec_meth_drop_xt:\n assumes exec: \"exec_meth ci P (ins @ ins') (xt @ shift (length ins) xt') t h (stk, loc, (length ins + pc), xcp) ta h' (stk', loc', pc', xcp')\"\n and xt: \"pcs xt \\ {..xcp = None\\\n from \\?PC < length (ins @ ins')\\ have pc: \"pc < length ins'\" by simp\n moreover with \\(ta, xcp', h', [(stk', loc', undefined, undefined, pc')]) \\ exec_instr ((ins @ ins') ! ?PC) P t h stk loc undefined undefined ?PC []\\\n have \"(ta, xcp', h', [(stk', loc', undefined, undefined, pc' - length ins)]) \\ exec_instr (ins' ! pc) P t h stk loc undefined undefined pc []\"\n apply(cases \"ins' ! pc\")\n apply(simp_all add: split_beta split: if_split_asm sum.split_asm split del: if_split)\n apply(force split: extCallRet.splits simp add: min_def extRet2JVM_def)+\n done\n moreover from \\ci_app ci ((ins @ ins') ! ?PC) P h stk loc undefined undefined ?PC []\\ jump pc\n have \"ci_app ci (ins' ! pc) P h stk loc undefined undefined pc []\"\n by(fastforce elim: wf_ciD3_ci_app dest: jump_ok_ins_jump_ok)\n ultimately show ?thesis by(auto intro: exec_meth.intros)\nnext\n case (exec_catch XCP D)\n let ?PC = \"length ins + pc\"\n note [simp] = \\xcp = \\XCP\\\\\n \\ta = \\\\ \\h' = h\\ \\stk' = Addr XCP # drop (length stk - D) stk\\ \\loc' = loc\\ \\xcp' = None\\\n from \\match_ex_table P (cname_of h XCP) ?PC (xt @ shift (length ins) xt') = \\(pc', D)\\\\ xt\n have \"match_ex_table P (cname_of h XCP) pc xt' = \\(pc' - length ins, D)\\\"\n by(auto simp add: match_ex_table_append dest: match_ex_table_shift_pcD match_ex_table_pcsD)\n with \\D \\ length stk\\ show ?thesis by(auto intro: exec_meth.intros)\nqed\n\nlemma exec_meth_drop:\n \"\\ exec_meth ci P (ins @ ins') (shift (length ins) xt) t h (stk, loc, (length ins + pc), xcp) ta h' (stk', loc', pc', xcp');\n jump_ok ins' 0 b \\\n \\ exec_meth ci P ins' xt t h (stk, loc, pc, xcp) ta h' (stk', loc', (pc' - length ins), xcp')\"\nby(auto intro: exec_meth_drop_xt[where xt = \"[]\"])\n\nlemma exec_meth_drop_xt_pc:\n assumes exec: \"exec_meth ci P (ins @ ins') (xt @ shift (length ins) xt') t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and pc: \"pc \\ length ins\"\n and pcs: \"pcs xt \\ {.. length ins\"\nusing exec\nproof(cases rule: exec_meth.cases)\n case exec_instr thus ?thesis using jump pc\n apply(cases \"ins' ! (pc - length ins)\")\n apply(simp_all add: split_beta nth_append split: if_split_asm sum.split_asm)\n apply(force split: extCallRet.splits simp add: min_def extRet2JVM_def dest: jump_ok_GotoD jump_ok_IfFalseD)+\n done\nnext\n case exec_catch thus ?thesis using pcs pc\n by(auto dest: match_ex_table_pcsD match_ex_table_shift_pcD simp add: match_ex_table_append)\nqed\n\nlemmas exec_meth_drop_pc = exec_meth_drop_xt_pc[where xt=\"[]\", simplified]\n\ndefinition exec_move ::\n \"('addr, 'heap) check_instr \\ 'addr J1_prog \\ 'thread_id \\ 'addr expr1\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr, 'thread_id, 'heap) jvm_thread_action\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere \"exec_move ci P t e \\ exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t\"\n\ndefinition exec_moves :: \n \"('addr, 'heap) check_instr \\ 'addr J1_prog \\ 'thread_id \\ 'addr expr1 list\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr, 'thread_id, 'heap) jvm_thread_action\n \\ 'heap \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere \"exec_moves ci P t es \\ exec_meth ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t\"\n\nabbreviation exec_move_a\nwhere \"exec_move_a \\ exec_move (Abs_check_instr check_instr')\"\n\nabbreviation exec_move_d\nwhere \"exec_move_d \\ exec_move (Abs_check_instr check_instr)\"\n\nabbreviation exec_moves_a\nwhere \"exec_moves_a \\ exec_moves (Abs_check_instr check_instr')\"\n\nabbreviation exec_moves_d\nwhere \"exec_moves_d \\ exec_moves (Abs_check_instr check_instr)\"\n\nlemma exec_move_newArrayI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (newA T\\e\\) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_newArray:\n \"pc < length (compE2 e) \\ exec_move ci P t (newA T\\e\\) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_CastI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (Cast T e) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Cast:\n \"pc < length (compE2 e) \\ exec_move ci P t (Cast T e) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_InstanceOfI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e instanceof T) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_InstanceOf:\n \"pc < length (compE2 e) \\ exec_move ci P t (e instanceof T) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_BinOpI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e \\bop\\ e') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_BinOp1:\n \"pc < length (compE2 e) \\ exec_move ci P t (e \\bop\\ e') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def\nby(auto intro!: ext intro: exec_meth_take_xt simp add: compxE2_size_convs)\n\nlemma exec_move_BinOpI2:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1 \\bop\\ e2) h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\"] show ?thesis\n by(fastforce split: bop.splits intro: append_exec_meth_xt simp add: exec_move_def compxE2_size_convs compxE2_stack_xlift_convs)\nqed\n\nlemma exec_move_LAssI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (V := e) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_LAss:\n \"pc < length (compE2 e) \\ exec_move ci P t (V := e) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_AAccI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\e'\\) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_AAcc1:\n \"pc < length (compE2 e) \\ exec_move ci P t (e\\e'\\) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def\nby(auto intro!: ext intro: exec_meth_take_xt simp add: compxE2_size_convs)\n\nlemma exec_move_AAccI2:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\e2\\) h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\"] show ?thesis\n by(fastforce intro: append_exec_meth_xt simp add: exec_move_def compxE2_size_convs compxE2_stack_xlift_convs)\nqed\n\nlemma exec_move_AAssI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\e'\\ := e'') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_AAss1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (e\\e'\\ := e'') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n fix ta h' s' assume \"?rhs ta h' s'\"\n thus \"?lhs ta h' s'\" by(rule exec_move_AAssI1)\nnext\n fix ta h' s' assume \"?lhs ta h' s'\"\n hence \"exec_meth ci (compP2 P) (compE2 e @ compE2 e' @ compE2 e'' @ [AStore, Push Unit])\n (compxE2 e 0 0 @ shift (length (compE2 e)) (compxE2 e' 0 (Suc 0) @ compxE2 e'' (length (compE2 e')) (Suc (Suc 0)))) t\n h (stk, loc, pc, xcp) ta h' s'\" by(simp add: exec_move_def shift_compxE2 ac_simps)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed\n\nlemma exec_move_AAssI2:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\e2\\ := e3) h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\", simplified stack_xlift_compxE2, simplified]\n have \"exec_meth ci (compP2 P) (compE2 e2 @ compE2 e3 @ [AStore, Push Unit]) (compxE2 e2 0 (Suc 0) @ shift (length (compE2 e2)) (compxE2 e3 0 (Suc (Suc 0)))) t h (stk @ [v], loc, pc, xcp) ta h' (stk' @ [v], loc', pc', xcp')\"\n by(rule exec_meth_append_xt)\n hence \"exec_meth ci (compP2 P) (compE2 e1 @ compE2 e2 @ compE2 e3 @ [AStore, Push Unit]) (compxE2 e1 0 0 @ shift (length (compE2 e1)) (compxE2 e2 0 (Suc 0) @ shift (length (compE2 e2)) (compxE2 e3 0 (Suc (Suc 0))))) t h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(auto simp add: exec_move_def shift_compxE2 ac_simps)\nqed\n\nlemma exec_move_AAssI3:\n assumes exec: \"exec_move ci P t e3 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\e2\\ := e3) h (stk @ [v', v], loc, length (compE2 e1) + length (compE2 e2) + pc, xcp) ta h' (stk' @ [v', v], loc', length (compE2 e1) + length (compE2 e2) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e3) (compxE2 e3 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v', v]\", simplified stack_xlift_compxE2, simplified]\n have \"exec_meth ci (compP2 P) (compE2 e3 @ [AStore, Push Unit]) (compxE2 e3 0 (Suc (Suc 0))) t h (stk @ [v', v], loc, pc, xcp) ta h' (stk' @ [v', v], loc', pc', xcp')\"\n by(rule exec_meth_append)\n hence \"exec_meth ci (compP2 P) ((compE2 e1 @ compE2 e2) @ compE2 e3 @ [AStore, Push Unit]) \n ((compxE2 e1 0 0 @ compxE2 e2 (length (compE2 e1)) (Suc 0)) @ shift (length (compE2 e1 @ compE2 e2)) (compxE2 e3 0 (Suc (Suc 0)))) t h (stk @ [v', v], loc, length (compE2 e1 @ compE2 e2) + pc, xcp) ta h' (stk' @ [v', v], loc', length (compE2 e1 @ compE2 e2) + pc', xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(auto simp add: exec_move_def shift_compxE2 ac_simps)\nqed\n\nlemma exec_move_ALengthI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\length) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_ALength:\n \"pc < length (compE2 e) \\ exec_move ci P t (e\\length) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_FAccI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\F{D}) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_FAcc:\n \"pc < length (compE2 e) \\ exec_move ci P t (e\\F{D}) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\n\n\nlemma exec_move_FAss1:\n \"pc < length (compE2 e) \\ exec_move ci P t (e\\F{D} := e') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def\nby(auto intro!: ext intro: exec_meth_take_xt simp add: compxE2_size_convs)\n\nlemma exec_move_FAssI2:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\F{D} := e2) h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\"] show ?thesis\n by(fastforce intro: append_exec_meth_xt simp add: exec_move_def compxE2_size_convs compxE2_stack_xlift_convs)\nqed\n\nlemma exec_move_CASI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\compareAndSwap(D\\F, e', e'')) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_CAS1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (e\\compareAndSwap(D\\F, e', e'')) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n fix ta h' s' assume \"?rhs ta h' s'\"\n thus \"?lhs ta h' s'\" by(rule exec_move_CASI1)\nnext\n fix ta h' s' assume \"?lhs ta h' s'\"\n hence \"exec_meth ci (compP2 P) (compE2 e @ compE2 e' @ compE2 e'' @ [CAS F D])\n (compxE2 e 0 0 @ shift (length (compE2 e)) (compxE2 e' 0 (Suc 0) @ compxE2 e'' (length (compE2 e')) (Suc (Suc 0)))) t\n h (stk, loc, pc, xcp) ta h' s'\" by(simp add: exec_move_def shift_compxE2 ac_simps)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed\n\nlemma exec_move_CASI2:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\compareAndSwap(D\\F, e2, e3)) h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\", simplified stack_xlift_compxE2, simplified]\n have \"exec_meth ci (compP2 P) (compE2 e2 @ compE2 e3 @ [CAS F D]) (compxE2 e2 0 (Suc 0) @ shift (length (compE2 e2)) (compxE2 e3 0 (Suc (Suc 0)))) t h (stk @ [v], loc, pc, xcp) ta h' (stk' @ [v], loc', pc', xcp')\"\n by(rule exec_meth_append_xt)\n hence \"exec_meth ci (compP2 P) (compE2 e1 @ compE2 e2 @ compE2 e3 @ [CAS F D]) (compxE2 e1 0 0 @ shift (length (compE2 e1)) (compxE2 e2 0 (Suc 0) @ shift (length (compE2 e2)) (compxE2 e3 0 (Suc (Suc 0))))) t h (stk @ [v], loc, length (compE2 e1) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e1) + pc', xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(auto simp add: exec_move_def shift_compxE2 ac_simps)\nqed\n\nlemma exec_move_CASI3:\n assumes exec: \"exec_move ci P t e3 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e1\\compareAndSwap(D\\F, e2, e3)) h (stk @ [v', v], loc, length (compE2 e1) + length (compE2 e2) + pc, xcp) ta h' (stk' @ [v', v], loc', length (compE2 e1) + length (compE2 e2) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e3) (compxE2 e3 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_move_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v', v]\", simplified stack_xlift_compxE2, simplified]\n have \"exec_meth ci (compP2 P) (compE2 e3 @ [CAS F D]) (compxE2 e3 0 (Suc (Suc 0))) t h (stk @ [v', v], loc, pc, xcp) ta h' (stk' @ [v', v], loc', pc', xcp')\"\n by(rule exec_meth_append)\n hence \"exec_meth ci (compP2 P) ((compE2 e1 @ compE2 e2) @ compE2 e3 @ [CAS F D]) \n ((compxE2 e1 0 0 @ compxE2 e2 (length (compE2 e1)) (Suc 0)) @ shift (length (compE2 e1 @ compE2 e2)) (compxE2 e3 0 (Suc (Suc 0)))) t h (stk @ [v', v], loc, length (compE2 e1 @ compE2 e2) + pc, xcp) ta h' (stk' @ [v', v], loc', length (compE2 e1 @ compE2 e2) + pc', xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(auto simp add: exec_move_def shift_compxE2 ac_simps)\nqed\n\nlemma exec_move_CallI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e\\M(es)) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Call1:\n \"pc < length (compE2 e) \\ exec_move ci P t (e\\M(es)) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def\nby(auto intro!: ext intro: exec_meth_take_xt simp add: compxEs2_size_convs)\n\nlemma exec_move_CallI2:\n assumes exec: \"exec_moves ci P t es h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (e\\M(es)) h (stk @ [v], loc, length (compE2 e) + pc, xcp) ta h' (stk' @ [v], loc', length (compE2 e) + pc', xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_moves_def .\n from exec_meth_stk_offer[OF this, where stk''=\"[v]\"] show ?thesis\n by(fastforce intro: append_exec_meth_xt simp add: exec_move_def compxEs2_size_convs compxEs2_stack_xlift_convs)\nqed\n\nlemma exec_move_BlockNoneI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t {V:T=None; e} h s ta h' s'\"\nunfolding exec_move_def by simp\n\nlemma exec_move_BlockNone:\n \"exec_move ci P t {V:T=None; e} = exec_move ci P t e\"\nunfolding exec_move_def by(simp)\n\nlemma exec_move_BlockSomeI:\n assumes exec: \"exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t {V:T=\\v\\; e} h (stk, loc, Suc (Suc pc), xcp) ta h' (stk', loc', Suc (Suc pc'), xcp')\"\nproof -\n let ?ins = \"[Push v, Store V]\"\n from exec have \"exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) (?ins @ compE2 e) (shift (length ?ins) (compxE2 e 0 0)) t h (stk, loc, length ?ins + pc, xcp) ta h' (stk', loc', length ?ins + pc', xcp')\"\n by(rule append_exec_meth) auto\n thus ?thesis by(simp add: exec_move_def shift_compxE2)\nqed\n\nlemma exec_move_BlockSome:\n \"exec_move ci P t {V:T=\\v\\; e} h (stk, loc, Suc (Suc pc), xcp) ta h' (stk', loc', Suc (Suc pc'), xcp') =\n exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\" (is \"?lhs = ?rhs\")\nproof\n assume ?rhs thus ?lhs by(rule exec_move_BlockSomeI)\nnext\n let ?ins = \"[Push v, Store V]\"\n assume ?lhs\n hence \"exec_meth ci (compP2 P) (?ins @ compE2 e) (shift (length ?ins) (compxE2 e 0 0)) t h (stk, loc, length ?ins + pc, xcp) ta h' (stk', loc', length ?ins + pc', xcp')\"\n by(simp add: exec_move_def shift_compxE2)\n hence \"exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', length ?ins + pc' - length ?ins, xcp')\"\n by(rule exec_meth_drop) auto\n thus ?rhs by(simp add: exec_move_def)\nqed\n\nlemma exec_move_SyncI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (sync\\<^bsub>V\\<^esub> (e) e') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Sync1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (sync\\<^bsub>V\\<^esub> (e) e') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n fix ta h' s'\n assume \"?lhs ta h' s'\"\n hence \"exec_meth ci (compP2 P) (compE2 e @ Dup # Store V # MEnter # compE2 e' @ [Load V, MExit, Goto 4, Load V, MExit, ThrowExc])\n (compxE2 e 0 0 @ shift (length (compE2 e)) (compxE2 e' 3 0 @ [(3, 3 + length (compE2 e'), None, 6 + length (compE2 e'), 0)]))\n t h (stk, loc, pc, xcp) ta h' s'\"\n by(simp add: shift_compxE2 ac_simps exec_move_def)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed(rule exec_move_SyncI1)\n\nlemma exec_move_SyncI2:\n assumes exec: \"exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (sync\\<^bsub>V\\<^esub> (o') e) h (stk, loc, (Suc (Suc (Suc (length (compE2 o') + pc)))), xcp) ta h' (stk', loc', (Suc (Suc (Suc (length (compE2 o') + pc')))), xcp')\"\nproof -\n let ?e = \"compE2 o' @ [Dup, Store V, MEnter]\"\n let ?e' = \"[Load V, MExit, Goto 4, Load V, MExit, ThrowExc]\"\n from exec have \"exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) ((?e @ compE2 e) @ ?e') ((compxE2 o' 0 0 @ shift (length ?e) (compxE2 e 0 0)) @ [(length ?e, length ?e + length (compE2 e), None, length ?e + length (compE2 e) + 3, 0)]) t h (stk, loc, (length ?e + pc), xcp) ta h' (stk', loc', (length ?e + pc'), xcp')\"\n by(rule exec_meth_append_xt[OF append_exec_meth_xt]) auto\n thus ?thesis by(simp add: eval_nat_numeral shift_compxE2 exec_move_def)\nqed\n\nlemma exec_move_SeqI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (e;;e') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Seq1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (e;;e') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n fix ta h' s'\n assume \"?lhs ta h' s'\"\n hence \"exec_meth ci (compP2 P) (compE2 e @ Pop # compE2 e') (compxE2 e 0 0 @ shift (length (compE2 e)) (compxE2 e' (Suc 0) 0)) t h (stk, loc, pc, xcp) ta h' s'\"\n by(simp add: exec_move_def shift_compxE2)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed(rule exec_move_SeqI1)\n\nlemma exec_move_SeqI2:\n assumes exec: \"exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc' ,xcp')\"\n shows \"exec_move ci P t (e';;e) h (stk, loc, (Suc (length (compE2 e') + pc)), xcp) ta h' (stk', loc', (Suc (length (compE2 e') + pc')), xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) ((compE2 e' @ [Pop]) @ compE2 e) (compxE2 e' 0 0 @ shift (length (compE2 e' @ [Pop])) (compxE2 e 0 0)) t h (stk, loc, (length ((compE2 e') @ [Pop]) + pc), xcp) ta h' (stk', loc', (length ((compE2 e') @ [Pop]) + pc'), xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(simp add: shift_compxE2 exec_move_def)\nqed\n\nlemma exec_move_Seq2:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (e';;e) h (stk, loc, Suc (length (compE2 e') + pc), xcp) ta\n h' (stk', loc', Suc (length (compE2 e') + pc'), xcp') =\n exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n (is \"?lhs = ?rhs\")\nproof\n let ?E = \"compE2 e' @ [Pop]\"\n assume ?lhs\n hence \"exec_meth ci (compP2 P) (?E @ compE2 e) (compxE2 e' 0 0 @ shift (length ?E) (compxE2 e 0 0)) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by(simp add: exec_move_def shift_compxE2)\n from exec_meth_drop_xt[OF this] show ?rhs unfolding exec_move_def by fastforce\nqed(rule exec_move_SeqI2)\n\nlemma exec_move_CondI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (if (e) e1 else e2) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Cond1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (if (e) e1 else e2) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n let ?E = \"IfFalse (2 + int (length (compE2 e1))) # compE2 e1 @ Goto (1 + int (length (compE2 e2))) # compE2 e2\"\n let ?xt = \"compxE2 e1 (Suc 0) 0 @ compxE2 e2 (Suc (Suc (length (compE2 e1)))) 0\"\n fix ta h' s'\n assume \"?lhs ta h' s'\"\n hence \"exec_meth ci (compP2 P) (compE2 e @ ?E) (compxE2 e 0 0 @ shift (length (compE2 e)) ?xt) t h (stk, loc, pc, xcp) ta h' s'\"\n by(simp add: exec_move_def shift_compxE2 ac_simps)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed(rule exec_move_CondI1)\n\nlemma exec_move_CondI2:\n assumes exec: \"exec_move ci P t e1 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (if (e) e1 else e2) h (stk, loc, (Suc (length (compE2 e) + pc)), xcp) ta h' (stk', loc', (Suc (length (compE2 e) + pc')), xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compE2 e1) (compxE2 e1 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) (((compE2 e @ [IfFalse (2 + int (length (compE2 e1)))]) @ compE2 e1) @ Goto (1 + int (length (compE2 e2))) # compE2 e2) ((compxE2 e 0 0 @ shift (length (compE2 e @ [IfFalse (2 + int (length (compE2 e1)))])) (compxE2 e1 0 0)) @ (compxE2 e2 (Suc (Suc (length (compE2 e) + length (compE2 e1)))) 0)) t h (stk, loc, (length (compE2 e @ [IfFalse (2 + int (length (compE2 e1)))]) + pc), xcp) ta h' (stk', loc', (length (compE2 e @ [IfFalse (2 + int (length (compE2 e1)))]) + pc'), xcp')\"\n by -(rule exec_meth_append_xt, rule append_exec_meth_xt, auto)\n thus ?thesis by(simp add: shift_compxE2 exec_move_def)\nqed\n\n\n\nlemma exec_move_CondI3:\n assumes exec: \"exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (if (e) e1 else e2) h (stk, loc, Suc (Suc (length (compE2 e) + length (compE2 e1) + pc)), xcp) ta h' (stk', loc', Suc (Suc (length (compE2 e) + length (compE2 e1) + pc')), xcp')\"\nproof -\n let ?E = \"compE2 e @ IfFalse (2 + int (length (compE2 e1))) # compE2 e1 @ [Goto (1 + int (length (compE2 e2)))]\"\n let ?xt = \"compxE2 e 0 0 @ compxE2 e1 (Suc (length (compE2 e))) 0\"\n from exec have \"exec_meth ci (compP2 P) (compE2 e2) (compxE2 e2 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) (?E @ compE2 e2) (?xt @ shift (length ?E) (compxE2 e2 0 0)) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(simp add: shift_compxE2 exec_move_def)\nqed\n\nlemma exec_move_Cond3:\n \"exec_move ci P t (if (e) e1 else e2) h (stk, loc, Suc (Suc (length (compE2 e) + length (compE2 e1) + pc)), xcp) ta\n h' (stk', loc', Suc (Suc (length (compE2 e) + length (compE2 e1) + pc')), xcp') =\n exec_move ci P t e2 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n (is \"?lhs = ?rhs\")\nproof\n let ?E = \"compE2 e @ IfFalse (2 + int (length (compE2 e1))) # compE2 e1 @ [Goto (1 + int (length (compE2 e2)))]\"\n let ?xt = \"compxE2 e 0 0 @ compxE2 e1 (Suc (length (compE2 e))) 0\"\n assume ?lhs\n hence \"exec_meth ci (compP2 P) (?E @ compE2 e2) (?xt @ shift (length ?E) (compxE2 e2 0 0)) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by(simp add: shift_compxE2 exec_move_def)\n thus ?rhs unfolding exec_move_def by -(drule exec_meth_drop_xt, auto)\nqed(rule exec_move_CondI3)\n\nlemma exec_move_WhileI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (while (e) e') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma (in ab_group_add) uminus_minus_left_commute:\n \"- a - (b + c) = - b - (a + c)\"\n by (simp add: algebra_simps)\n\nlemma exec_move_While1:\n assumes pc: \"pc < length (compE2 e)\"\n shows \"exec_move ci P t (while (e) e') h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\n (is \"?lhs = ?rhs\")\nproof(rule ext iffI)+\n let ?E = \"IfFalse (3 + int (length (compE2 e'))) # compE2 e' @ [Pop, Goto (- int (length (compE2 e)) + (-2 - int (length (compE2 e')))), Push Unit]\"\n let ?xt = \"compxE2 e' (Suc 0) 0\"\n fix ta h' s'\n assume \"?lhs ta h' s'\"\n then have \"exec_meth ci (compP2 P) (compE2 e @ ?E) (compxE2 e 0 0 @ shift (length (compE2 e)) ?xt) t h (stk, loc, pc, xcp) ta h' s'\"\n by (simp add: exec_move_def shift_compxE2 algebra_simps uminus_minus_left_commute)\n thus \"?rhs ta h' s'\" unfolding exec_move_def using pc by(rule exec_meth_take_xt)\nqed(rule exec_move_WhileI1)\n\nlemma exec_move_WhileI2:\n assumes exec: \"exec_move ci P t e1 h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (while (e) e1) h (stk, loc, (Suc (length (compE2 e) + pc)), xcp) ta h' (stk', loc', (Suc (length (compE2 e) + pc')), xcp')\"\nproof -\n let ?E = \"compE2 e @ [IfFalse (3 + int (length (compE2 e1)))]\"\n let ?E' = \"[Pop, Goto (- int (length (compE2 e)) + (-2 - int (length (compE2 e1)))), Push Unit]\"\n from exec have \"exec_meth ci (compP2 P) (compE2 e1) (compxE2 e1 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) ((?E @ compE2 e1) @ ?E') (compxE2 e 0 0 @ shift (length ?E) (compxE2 e1 0 0)) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by -(rule exec_meth_append, rule append_exec_meth_xt, auto)\n thus ?thesis by (simp add: shift_compxE2 exec_move_def algebra_simps uminus_minus_left_commute)\nqed\n\nlemma exec_move_While2:\n assumes pc: \"pc < length (compE2 e')\"\n shows \"exec_move ci P t (while (e) e') h (stk, loc, (Suc (length (compE2 e) + pc)), xcp) ta\n h' (stk', loc', (Suc (length (compE2 e) + pc')), xcp') =\n exec_move ci P t e' h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n (is \"?lhs = ?rhs\")\nproof\n let ?E = \"compE2 e @ [IfFalse (3 + int (length (compE2 e')))]\"\n let ?E' = \"[Pop, Goto (- int (length (compE2 e)) + (-2 - int (length (compE2 e')))), Push Unit]\"\n assume ?lhs\n hence \"exec_meth ci (compP2 P) ((?E @ compE2 e') @ ?E') (compxE2 e 0 0 @ shift (length ?E) (compxE2 e' 0 0)) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by(simp add: exec_move_def shift_compxE2 algebra_simps uminus_minus_left_commute)\n thus ?rhs unfolding exec_move_def using pc\n by -(drule exec_meth_take, simp, drule exec_meth_drop_xt, auto)\nqed(rule exec_move_WhileI2)\n\nlemma exec_move_ThrowI:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (throw e) h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_Throw:\n \"pc < length (compE2 e) \\ exec_move ci P t (throw e) h (stk, loc, pc, xcp) = exec_move ci P t e h (stk, loc, pc, xcp)\"\nunfolding exec_move_def by(auto intro!: ext intro: exec_meth_take)\n\nlemma exec_move_TryI1:\n \"exec_move ci P t e h s ta h' s' \\ exec_move ci P t (try e catch(C V) e') h s ta h' s'\"\nunfolding exec_move_def by auto\n\nlemma exec_move_TryI2:\n assumes exec: \"exec_move ci P t e h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_move ci P t (try e' catch(C V) e) h (stk, loc, Suc (Suc (length (compE2 e') + pc)), xcp) ta h' (stk', loc', Suc (Suc (length (compE2 e') + pc')), xcp')\"\nproof -\n let ?e = \"compE2 e' @ [Goto (int(size (compE2 e))+2), Store V]\"\n from exec have \"exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: exec_move_def)\n hence \"exec_meth ci (compP2 P) ((?e @ compE2 e) @ []) ((compxE2 e' 0 0 @ shift (length ?e) (compxE2 e 0 0)) @ [(0, length (compE2 e'), \\C\\, Suc (length (compE2 e')), 0)]) t h (stk, loc, (length ?e + pc), xcp) ta h' (stk', loc', (length ?e + pc'), xcp')\"\n by(rule exec_meth_append_xt[OF append_exec_meth_xt]) auto\n thus ?thesis by(simp add: eval_nat_numeral shift_compxE2 exec_move_def)\nqed\n\nlemma exec_move_Try2:\n \"exec_move ci P t (try e catch(C V) e') h (stk, loc, Suc (Suc (length (compE2 e) + pc)), xcp) ta\n h' (stk', loc', Suc (Suc (length (compE2 e) + pc')), xcp') =\n exec_move ci P t e' h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n (is \"?lhs = ?rhs\")\nproof\n let ?E = \"compE2 e @ [Goto (int(size (compE2 e'))+2), Store V]\"\n let ?xt = \"[(0, length (compE2 e), \\C\\, Suc (length (compE2 e)), 0)]\"\n assume lhs: ?lhs\n hence pc: \"pc < length (compE2 e')\"\n by(fastforce elim!: exec_meth.cases simp add: exec_move_def match_ex_table_append match_ex_entry dest: match_ex_table_pcsD)\n from lhs have \"exec_meth ci (compP2 P) ((?E @ compE2 e') @ []) ((compxE2 e 0 0 @ shift (length ?E) (compxE2 e' 0 0)) @ ?xt) t h (stk, loc, length ?E + pc, xcp) ta h' (stk', loc', length ?E + pc', xcp')\"\n by(simp add: exec_move_def shift_compxE2 ac_simps)\n thus ?rhs unfolding exec_move_def using pc\n by-(drule exec_meth_drop_xt[OF exec_meth_take_xt'], auto)\nqed(rule exec_move_TryI2)\n\nlemma exec_move_raise_xcp_pcD:\n \"exec_move ci P t E h (stk, loc, pc, None) ta h' (stk', loc', pc', Some a) \\ pc' = pc\"\napply(cases \"compE2 E ! pc\")\napply(auto simp add: exec_move_def elim!: exec_meth.cases split: if_split_asm sum.split_asm)\napply(auto split: extCallRet.split_asm simp add: split_beta)\ndone\n\n\ndefinition \\exec_meth :: \n \"('addr, 'heap) check_instr \\ 'addr jvm_prog \\ 'addr instr list \\ ex_table \\ 'thread_id \\ 'heap\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere\n \"\\exec_meth ci P ins xt t h s s' \\ \n exec_meth ci P ins xt t h s \\ h s' \\ (snd (snd (snd s)) = None \\ \\instr P h (fst s) (ins ! fst (snd (snd s))))\"\n\nabbreviation \\exec_meth_a\nwhere \"\\exec_meth_a \\ \\exec_meth (Abs_check_instr check_instr')\"\n\nabbreviation \\exec_meth_d\nwhere \"\\exec_meth_d \\ \\exec_meth (Abs_check_instr check_instr)\"\n\nlemma \\exec_methI [intro]:\n \"\\ exec_meth ci P ins xt t h (stk, loc, pc, xcp) \\ h s'; xcp = None \\ \\instr P h stk (ins ! pc) \\\n \\ \\exec_meth ci P ins xt t h (stk, loc, pc, xcp) s'\"\nby(simp add: \\exec_meth_def)\n\nlemma \\exec_methE [elim]:\n assumes \"\\exec_meth ci P ins xt t h s s'\"\n obtains stk loc pc xcp\n where \"s = (stk, loc, pc, xcp)\"\n and \"exec_meth ci P ins xt t h (stk, loc, pc, xcp) \\ h s'\"\n and \"xcp = None \\ \\instr P h stk (ins ! pc)\"\nusing assms\nby(cases s)(auto simp add: \\exec_meth_def)\n\nabbreviation \\Exec_methr :: \n \"('addr, 'heap) check_instr \\ 'addr jvm_prog \\ 'addr instr list \\ ex_table \\ 'thread_id \\ 'heap \n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere\n \"\\Exec_methr ci P ins xt t h == (\\exec_meth ci P ins xt t h)^**\"\n\nabbreviation \\Exec_metht :: \n \"('addr, 'heap) check_instr \\ 'addr jvm_prog \\ 'addr instr list \\ ex_table \\ 'thread_id \\ 'heap\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere\n \"\\Exec_metht ci P ins xt t h == (\\exec_meth ci P ins xt t h)^++\"\n\nabbreviation \\Exec_methr_a\nwhere \"\\Exec_methr_a \\ \\Exec_methr (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_methr_d\nwhere \"\\Exec_methr_d \\ \\Exec_methr (Abs_check_instr check_instr)\"\n\nabbreviation \\Exec_metht_a\nwhere \"\\Exec_metht_a \\ \\Exec_metht (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_metht_d\nwhere \"\\Exec_metht_d \\ \\Exec_metht (Abs_check_instr check_instr)\"\n\nlemma \\Exec_methr_refl: \"\\Exec_methr ci P ins xt t h s s\" ..\n\nlemma \\Exec_methr_step':\n \"\\ \\Exec_methr ci P ins xt t h s (stk', loc', pc', xcp');\n \\exec_meth ci P ins xt t h (stk', loc', pc', xcp') s' \\\n \\ \\Exec_methr ci P ins xt t h s s'\"\nby(rule rtranclp.rtrancl_into_rtrancl)\n\nlemma \\Exec_methr_step:\n \"\\ \\Exec_methr ci P ins xt t h s (stk', loc', pc', xcp');\n exec_meth ci P ins xt t h (stk', loc', pc', xcp') \\ h s';\n xcp' = None \\ \\instr P h stk' (ins ! pc') \\\n \\ \\Exec_methr ci P ins xt t h s s'\"\nby(erule \\Exec_methr_step')(rule \\exec_methI)\n\nlemmas \\Exec_methr_intros = \\Exec_methr_refl \\Exec_methr_step\nlemmas \\Exec_methr1step = \\Exec_methr_step[OF \\Exec_methr_refl]\nlemmas \\Exec_methr2step = \\Exec_methr_step[OF \\Exec_methr_step, OF \\Exec_methr_refl]\nlemmas \\Exec_methr3step = \\Exec_methr_step[OF \\Exec_methr_step, OF \\Exec_methr_step, OF \\Exec_methr_refl]\n\nlemma \\Exec_methr_cases [consumes 1, case_names refl step]:\n assumes \"\\Exec_methr ci P ins xt t h s s'\"\n obtains \"s = s'\"\n | stk' loc' pc' xcp'\n where \"\\Exec_methr ci P ins xt t h s (stk', loc', pc', xcp')\"\n \"exec_meth ci P ins xt t h (stk', loc', pc', xcp') \\ h s'\"\n \"xcp' = None \\ \\instr P h stk' (ins ! pc')\"\nusing assms\nby(rule rtranclp.cases)(auto elim!: \\exec_methE)\n\nlemma \\Exec_methr_induct [consumes 1, case_names refl step]:\n \"\\ \\Exec_methr ci P ins xt t h s s';\n Q s;\n \\stk loc pc xcp s'. \\ \\Exec_methr ci P ins xt t h s (stk, loc, pc, xcp); exec_meth ci P ins xt t h (stk, loc, pc, xcp) \\ h s';\n xcp = None \\ \\instr P h stk (ins ! pc); Q (stk, loc, pc, xcp) \\ \\ Q s' \\\n \\ Q s'\"\nby(erule (1) rtranclp_induct)(blast elim: \\exec_methE)\n\nlemma \\Exec_methr_trans: \n \"\\ \\Exec_methr ci P ins xt t h s s'; \\Exec_methr ci P ins xt t h s' s'' \\ \\ \\Exec_methr ci P ins xt t h s s''\"\nby(rule rtranclp_trans)\n\nlemmas \\Exec_meth_induct_split = \\Exec_methr_induct[split_format (complete), consumes 1, case_names \\Exec_refl \\Exec_step]\n\nlemma \\Exec_methr_converse_cases [consumes 1, case_names refl step]:\n assumes \"\\Exec_methr ci P ins xt t h s s'\"\n obtains \"s = s'\"\n | stk loc pc xcp s''\n where \"s = (stk, loc, pc, xcp)\"\n \"exec_meth ci P ins xt t h (stk, loc, pc, xcp) \\ h s''\"\n \"xcp = None \\ \\instr P h stk (ins ! pc)\"\n \"\\Exec_methr ci P ins xt t h s'' s'\"\nusing assms\nby(erule converse_rtranclpE)(blast elim: \\exec_methE)\n\ndefinition \\exec_move :: \n \"('addr, 'heap) check_instr \\ 'addr J1_prog \\ 'thread_id \\ 'addr expr1 \\ 'heap\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere\n \"\\exec_move ci P t e h =\n (\\(stk, loc, pc, xcp) s'. exec_move ci P t e h (stk, loc, pc, xcp) \\ h s' \\ \\move2 P h stk e pc xcp)\"\n\ndefinition \\exec_moves :: \n \"('addr, 'heap) check_instr \\ 'addr J1_prog \\ 'thread_id \\ 'addr expr1 list \\ 'heap\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option)\n \\ ('addr val list \\ 'addr val list \\ pc \\ 'addr option) \\ bool\"\nwhere\n \"\\exec_moves ci P t es h =\n (\\(stk, loc, pc, xcp) s'. exec_moves ci P t es h (stk, loc, pc, xcp) \\ h s' \\ \\moves2 P h stk es pc xcp)\"\n\nlemma \\exec_moveI:\n \"\\ exec_move ci P t e h (stk, loc, pc, xcp) \\ h s'; \\move2 P h stk e pc xcp \\ \n \\ \\exec_move ci P t e h (stk, loc, pc, xcp) s'\"\nby(simp add: \\exec_move_def)\n\nlemma \\exec_moveE:\n assumes \"\\exec_move ci P t e h (stk, loc, pc, xcp) s'\"\n obtains \"exec_move ci P t e h (stk, loc, pc, xcp) \\ h s'\" \"\\move2 P h stk e pc xcp\"\nusing assms by(simp add: \\exec_move_def)\n\nlemma \\exec_movesI:\n \"\\ exec_moves ci P t es h (stk, loc, pc, xcp) \\ h s'; \\moves2 P h stk es pc xcp \\ \n \\ \\exec_moves ci P t es h (stk, loc, pc, xcp) s'\"\nby(simp add: \\exec_moves_def)\n\nlemma \\exec_movesE:\n assumes \"\\exec_moves ci P t es h (stk, loc, pc, xcp) s'\"\n obtains \"exec_moves ci P t es h (stk, loc, pc, xcp) \\ h s'\" \"\\moves2 P h stk es pc xcp\"\nusing assms by(simp add: \\exec_moves_def)\n\nlemma \\exec_move_conv_\\exec_meth:\n \"\\exec_move ci P t e = \\exec_meth ci (compP2 P) (compE2 e) (compxE2 e 0 0) t\"\nby(auto simp add: \\exec_move_def exec_move_def \\move2_iff compP2_def intro!: ext \\exec_methI elim!: \\exec_methE)\n\nlemma \\exec_moves_conv_\\exec_meth:\n \"\\exec_moves ci P t es = \\exec_meth ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t\"\nby(auto simp add: \\exec_moves_def exec_moves_def \\moves2_iff compP2_def intro!: ext \\exec_methI elim!: \\exec_methE)\n\nabbreviation \\Exec_mover\nwhere \"\\Exec_mover ci P t e h == (\\exec_move ci P t e h)^**\"\n\nabbreviation \\Exec_movet\nwhere \"\\Exec_movet ci P t e h == (\\exec_move ci P t e h)^++\"\n\nabbreviation \\Exec_mover_a\nwhere \"\\Exec_mover_a \\ \\Exec_mover (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_mover_d\nwhere \"\\Exec_mover_d \\ \\Exec_mover (Abs_check_instr check_instr)\"\n\nabbreviation \\Exec_movet_a\nwhere \"\\Exec_movet_a \\ \\Exec_movet (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_movet_d\nwhere \"\\Exec_movet_d \\ \\Exec_movet (Abs_check_instr check_instr)\"\n\nabbreviation \\Exec_movesr\nwhere \"\\Exec_movesr ci P t e h == (\\exec_moves ci P t e h)^**\"\n\nabbreviation \\Exec_movest\nwhere \"\\Exec_movest ci P t e h == (\\exec_moves ci P t e h)^++\"\n\nabbreviation \\Exec_movesr_a\nwhere \"\\Exec_movesr_a \\ \\Exec_movesr (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_movesr_d\nwhere \"\\Exec_movesr_d \\ \\Exec_movesr (Abs_check_instr check_instr)\"\n\nabbreviation \\Exec_movest_a\nwhere \"\\Exec_movest_a \\ \\Exec_movest (Abs_check_instr check_instr')\"\n\nabbreviation \\Exec_movest_d\nwhere \"\\Exec_movest_d \\ \\Exec_movest (Abs_check_instr check_instr)\"\n\n\n\nlemma \\Execsr_refl: \"\\Exec_movesr ci P t e h s s\"\nby(rule rtranclp.rtrancl_refl)\n\nlemma \\Execr_step: \n \"\\ \\Exec_mover ci P t e h s (stk', loc', pc', xcp');\n exec_move ci P t e h (stk', loc', pc', xcp') \\ h s';\n \\move2 P h stk' e pc' xcp' \\\n \\ \\Exec_mover ci P t e h s s'\"\nby(rule rtranclp.rtrancl_into_rtrancl)(auto elim: \\exec_moveI)\n\nlemma \\Execsr_step: \n \"\\ \\Exec_movesr ci P t es h s (stk', loc', pc', xcp');\n exec_moves ci P t es h (stk', loc', pc', xcp') \\ h s';\n \\moves2 P h stk' es pc' xcp' \\\n \\ \\Exec_movesr ci P t es h s s'\"\nby(rule rtranclp.rtrancl_into_rtrancl)(auto elim: \\exec_movesI)\n\nlemma \\Exect_step:\n \"\\ \\Exec_movet ci P t e h s (stk', loc', pc', xcp');\n exec_move ci P t e h (stk', loc', pc', xcp') \\ h s';\n \\move2 P h stk' e pc' xcp' \\\n \\ \\Exec_movet ci P t e h s s'\"\nby(rule tranclp.trancl_into_trancl)(auto intro: \\exec_moveI)\n\nlemma \\Execst_step:\n \"\\ \\Exec_movest ci P t es h s (stk', loc', pc', xcp');\n exec_moves ci P t es h (stk', loc', pc', xcp') \\ h s';\n \\moves2 P h stk' es pc' xcp' \\\n \\ \\Exec_movest ci P t es h s s'\"\nby(rule tranclp.trancl_into_trancl)(auto intro: \\exec_movesI)\n\nlemmas \\Execr1step = \\Execr_step[OF \\Execr_refl]\nlemmas \\Execr2step = \\Execr_step[OF \\Execr_step, OF \\Execr_refl]\nlemmas \\Execr3step = \\Execr_step[OF \\Execr_step, OF \\Execr_step, OF \\Execr_refl]\n\nlemmas \\Execsr1step = \\Execsr_step[OF \\Execsr_refl]\nlemmas \\Execsr2step = \\Execsr_step[OF \\Execsr_step, OF \\Execsr_refl]\nlemmas \\Execsr3step = \\Execsr_step[OF \\Execsr_step, OF \\Execsr_step, OF \\Execsr_refl]\n\nlemma \\Exect1step:\n \"\\ exec_move ci P t e h s \\ h s';\n \\move2 P h (fst s) e (fst (snd (snd s))) (snd (snd (snd s))) \\\n \\ \\Exec_movet ci P t e h s s'\"\nby(rule tranclp.r_into_trancl)(cases s, auto intro: \\exec_moveI)\n\nlemmas \\Exect2step = \\Exect_step[OF \\Exect1step]\nlemmas \\Exect3step = \\Exect_step[OF \\Exect_step, OF \\Exect1step]\n\nlemma \\Execst1step:\n \"\\ exec_moves ci P t es h s \\ h s';\n \\moves2 P h (fst s) es (fst (snd (snd s))) (snd (snd (snd s))) \\\n \\ \\Exec_movest ci P t es h s s'\"\nby(rule tranclp.r_into_trancl)(cases s, auto intro: \\exec_movesI)\n\nlemmas \\Execst2step = \\Execst_step[OF \\Execst1step]\nlemmas \\Execst3step = \\Execst_step[OF \\Execst_step, OF \\Execst1step]\n\nlemma \\Execr_induct [consumes 1, case_names refl step]:\n assumes major: \"\\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk'', loc'', pc'', xcp'')\"\n and refl: \"Q stk loc pc xcp\"\n and step: \"\\stk' loc' pc' xcp' stk'' loc'' pc'' xcp''.\n \\ \\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp');\n \\exec_move ci P t e h (stk', loc', pc', xcp') (stk'', loc'', pc'', xcp''); Q stk' loc' pc' xcp' \\\n \\ Q stk'' loc'' pc'' xcp''\"\n shows \"Q stk'' loc'' pc'' xcp''\"\nusing major refl\nby(rule rtranclp_induct4)(rule step)\n\nlemma \\Execsr_induct [consumes 1, case_names refl step]:\n assumes major: \"\\Exec_movesr ci P t es h (stk, loc, pc, xcp) (stk'', loc'', pc'', xcp'')\"\n and refl: \"Q stk loc pc xcp\"\n and step: \"\\stk' loc' pc' xcp' stk'' loc'' pc'' xcp''.\n \\ \\Exec_movesr ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp');\n \\exec_moves ci P t es h (stk', loc', pc', xcp') (stk'', loc'', pc'', xcp''); Q stk' loc' pc' xcp' \\\n \\ Q stk'' loc'' pc'' xcp''\"\n shows \"Q stk'' loc'' pc'' xcp''\"\nusing major refl\nby(rule rtranclp_induct4)(rule step)\n\nlemma \\Exect_induct [consumes 1, case_names base step]:\n assumes major: \"\\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk'', loc'', pc'', xcp'')\"\n and base: \"\\stk' loc' pc' xcp'. \\exec_move ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp') \\ Q stk' loc' pc' xcp'\"\n and step: \"\\stk' loc' pc' xcp' stk'' loc'' pc'' xcp''.\n \\ \\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp');\n \\exec_move ci P t e h (stk', loc', pc', xcp') (stk'', loc'', pc'', xcp''); Q stk' loc' pc' xcp' \\\n \\ Q stk'' loc'' pc'' xcp''\"\n shows \"Q stk'' loc'' pc'' xcp''\"\nusing major\nby(rule tranclp_induct4)(erule base step)+\n\nlemma \\Execst_induct [consumes 1, case_names base step]:\n assumes major: \"\\Exec_movest ci P t es h (stk, loc, pc, xcp) (stk'', loc'', pc'', xcp'')\"\n and base: \"\\stk' loc' pc' xcp'. \\exec_moves ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp') \\ Q stk' loc' pc' xcp'\"\n and step: \"\\stk' loc' pc' xcp' stk'' loc'' pc'' xcp''.\n \\ \\Exec_movest ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp');\n \\exec_moves ci P t es h (stk', loc', pc', xcp') (stk'', loc'', pc'', xcp''); Q stk' loc' pc' xcp' \\\n \\ Q stk'' loc'' pc'' xcp''\"\n shows \"Q stk'' loc'' pc'' xcp''\"\nusing major\nby(rule tranclp_induct4)(erule base step)+\n\nlemma \\Exec_mover_\\Exec_methr:\n \"\\Exec_mover ci P t e = \\Exec_methr ci (compP2 P) (compE2 e) (compxE2 e 0 0) t\"\nby(simp only: \\exec_move_conv_\\exec_meth)\n\nlemma \\Exec_movesr_\\Exec_methr:\n \"\\Exec_movesr ci P t es = \\Exec_methr ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t\"\nby(simp only: \\exec_moves_conv_\\exec_meth)\n\nlemma \\Exec_movet_\\Exec_metht:\n \"\\Exec_movet ci P t e = \\Exec_metht ci (compP2 P) (compE2 e) (compxE2 e 0 0) t\"\nby(simp only: \\exec_move_conv_\\exec_meth)\n\nlemma \\Exec_movest_\\Exec_metht:\n \"\\Exec_movest ci P t es = \\Exec_metht ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t\"\nby(simp only: \\exec_moves_conv_\\exec_meth)\n\nlemma \\Exec_mover_trans: \n \"\\ \\Exec_mover ci P t e h s s'; \\Exec_mover ci P t e h s' s'' \\ \\ \\Exec_mover ci P t e h s s''\"\nby(rule rtranclp_trans)\n\nlemma \\Exec_movesr_trans: \n \"\\ \\Exec_movesr ci P t es h s s'; \\Exec_movesr ci P t es h s' s'' \\ \\ \\Exec_movesr ci P t es h s s''\"\nby(rule rtranclp_trans)\n\nlemma \\Exec_movet_trans: \n \"\\ \\Exec_movet ci P t e h s s'; \\Exec_movet ci P t e h s' s'' \\ \\ \\Exec_movet ci P t e h s s''\"\nby(rule tranclp_trans)\n\nlemma \\Exec_movest_trans: \n \"\\ \\Exec_movest ci P t es h s s'; \\Exec_movest ci P t es h s' s'' \\ \\ \\Exec_movest ci P t es h s s''\"\nby(rule tranclp_trans)\n\nlemma \\exec_move_into_\\exec_moves:\n \"\\exec_move ci P t e h s s' \\ \\exec_moves ci P t (e # es) h s s'\"\nby(cases s)(auto elim!: \\exec_moveE intro!: \\exec_movesI simp add: exec_move_def exec_moves_def intro: \\moves2Hd)\n\nlemma \\Exec_mover_\\Exec_movesr:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_movesr ci P t (e # es) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl \\exec_move_into_\\exec_moves)+\n\nlemma \\Exec_movet_\\Exec_movest:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movest ci P t (e # es) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl \\exec_move_into_\\exec_moves)+\n\nlemma exec_moves_append: \"exec_moves ci P t es h s ta h' s' \\ exec_moves ci P t (es @ es') h s ta h' s'\"\nby(auto simp add: exec_moves_def)\n\nlemma \\exec_moves_append: \"\\exec_moves ci P t es h s s' \\ \\exec_moves ci P t (es @ es') h s s'\"\nby(cases s)(auto elim!: \\exec_movesE intro!: \\exec_movesI exec_moves_append)\n\nlemma \\Exec_movesr_append [intro]:\n \"\\Exec_movesr ci P t es h s s' \\ \\Exec_movesr ci P t (es @ es') h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl \\exec_moves_append)+\n\nlemma \\Exec_movest_append [intro]:\n \"\\Exec_movest ci P t es h s s' \\ \\Exec_movest ci P t (es @ es') h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl \\exec_moves_append)+\n\nlemma append_exec_moves:\n assumes len: \"length vs = length es'\"\n and exec: \"exec_moves ci P t es h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n shows \"exec_moves ci P t (es' @ es) h ((stk @ vs), loc, (length (compEs2 es') + pc), xcp) ta h' ((stk' @ vs), loc', (length (compEs2 es') + pc'), xcp')\"\nproof -\n from exec have \"exec_meth ci (compP2 P) (compEs2 es) (compxEs2 es 0 0) t h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n unfolding exec_moves_def .\n hence \"exec_meth ci (compP2 P) (compEs2 es) (stack_xlift (length vs) (compxEs2 es 0 0)) t h ((stk @ vs), loc, pc, xcp) ta h' ((stk' @ vs), loc', pc', xcp')\" by(rule exec_meth_stk_offer)\n hence \"exec_meth ci (compP2 P) (compEs2 es' @ compEs2 es) (compxEs2 es' 0 0 @ shift (length (compEs2 es')) (stack_xlift (length (vs)) (compxEs2 es 0 0))) t h ((stk @ vs), loc, (length (compEs2 es') + pc), xcp) ta h' ((stk' @ vs), loc', (length (compEs2 es') + pc'), xcp')\"\n by(rule append_exec_meth_xt) auto\n thus ?thesis by(simp add: exec_moves_def stack_xlift_compxEs2 shift_compxEs2 len)\nqed\n\n\nlemma append_\\exec_moves:\n \"\\ length vs = length es';\n \\exec_moves ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp') \\\n \\ \\exec_moves ci P t (es' @ es) h ((stk @ vs), loc, (length (compEs2 es') + pc), xcp) ((stk' @ vs), loc', (length (compEs2 es') + pc'), xcp')\"\nby(auto elim!: \\exec_movesE intro: \\exec_movesI append_exec_moves \\moves2_stk_append append_\\moves2)\n\nlemma append_\\Exec_movesr:\n assumes len: \"length vs = length es'\"\n shows \"\\Exec_movesr ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movesr ci P t (es' @ es) h ((stk @ vs), loc, (length (compEs2 es') + pc), xcp) ((stk' @ vs), loc', (length (compEs2 es') + pc'), xcp')\"\nby(induct rule: rtranclp_induct4)(blast intro: rtranclp.rtrancl_into_rtrancl append_\\exec_moves[OF len])+\n\nlemma append_\\Exec_movest:\n assumes len: \"length vs = length es'\"\n shows \"\\Exec_movest ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movest ci P t (es' @ es) h ((stk @ vs), loc, (length (compEs2 es') + pc), xcp) ((stk' @ vs), loc', (length (compEs2 es') + pc'), xcp')\"\nby(induct rule: tranclp_induct4)(blast intro: tranclp.trancl_into_trancl append_\\exec_moves[OF len])+\n\n\nlemma NewArray_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (newA T\\e\\) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_newArrayI)\n\nlemma Cast_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (Cast T e) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CastI)\n\nlemma InstanceOf_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e instanceof T) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_InstanceOfI)\n\nlemma BinOp_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e \\bop\\ e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_BinOpI1)\n\nlemma BinOp_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e \\bop\\ e') h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_BinOpI2 \\move2_stk_append)\n\nlemma LAss_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (V := e) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_LAssI)\n\nlemma AAcc_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\i\\) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_AAccI1)\n\nlemma AAcc_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\e'\\) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_AAccI2 \\move2_stk_append)\n\nlemma AAss_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\i\\ := e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_AAssI1)\n\nlemma AAss_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\e'\\ := e'') h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_AAssI2 \\move2_stk_append)\n\nlemma AAss_\\execI3:\n \"\\exec_move ci P t e'' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\e'\\ := e'') h ((stk @ [v, v']), loc, (length (compE2 e) + length (compE2 e') + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 e) + length (compE2 e') + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_AAssI3 \\move2_stk_append)\n\nlemma ALength_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\length) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_ALengthI)\n\nlemma FAcc_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\F{D}) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_FAccI)\n\nlemma FAss_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\F{D} := e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_FAssI1)\n\nlemma FAss_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\F{D} := e') h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_FAssI2 \\move2_stk_append)\n\nlemma CAS_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\compareAndSwap(D\\F, e', e'')) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CASI1)\n\nlemma CAS_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CASI2 \\move2_stk_append)\n\nlemma CAS_\\execI3:\n \"\\exec_move ci P t e'' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v, v']), loc, (length (compE2 e) + length (compE2 e') + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 e) + length (compE2 e') + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CASI3 \\move2_stk_append)\n\nlemma Call_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e\\M(es)) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CallI1)\n\nlemma Call_\\execI2:\n \"\\exec_moves ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e\\M(es)) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_movesE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CallI2 \\moves2_stk_append)\n\nlemma Block_\\execI_Some:\n \"\\exec_move ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t {V:T=\\v\\; e} h (stk, loc, Suc (Suc pc), xcp) (stk', loc', Suc (Suc pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_BlockSomeI)\n\nlemma Block_\\execI_None:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t {V:T=None; e} h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_BlockNoneI)\n\nlemma Sync_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (sync\\<^bsub>V\\<^esub> (e) e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_SyncI1)\n\nlemma Insync_\\execI:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (sync\\<^bsub>V\\<^esub> (e) e') h (stk, loc, Suc (Suc (Suc (length (compE2 e) + pc))), xcp) (stk', loc', Suc (Suc (Suc (length (compE2 e) + pc'))), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_SyncI2)\n\nlemma Seq_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (e;; e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_SeqI1)\n\nlemma Seq_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (e;; e') h (stk, loc, Suc (length (compE2 e) + pc), xcp) (stk', loc', Suc (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_SeqI2)\n\nlemma Cond_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (if (e) e' else e'') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CondI1)\n\nlemma Cond_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (if (e) e' else e'') h (stk, loc, Suc (length (compE2 e) + pc), xcp) (stk', loc', Suc (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CondI2)\n\nlemma Cond_\\execI3:\n \"\\exec_move ci P t e'' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (if (e) e' else e'') h (stk, loc, Suc (Suc (length (compE2 e) + length (compE2 e') + pc)), xcp) (stk', loc', Suc (Suc (length (compE2 e) + length (compE2 e') + pc')), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_CondI3)\n\nlemma While_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (while (e) e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_WhileI1)\n\nlemma While_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (while (e) e') h (stk, loc, Suc (length (compE2 e) + pc), xcp) (stk', loc', Suc (length (compE2 e) + pc'), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_WhileI2)\n\nlemma Throw_\\execI:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (throw e) h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_ThrowI)\n\nlemma Try_\\execI1:\n \"\\exec_move ci P t e h s s' \\ \\exec_move ci P t (try e catch(C V) e') h s s'\"\nby(cases s)(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_TryI1)\n\nlemma Try_\\execI2:\n \"\\exec_move ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\exec_move ci P t (try e catch(C V) e') h (stk, loc, Suc (Suc (length (compE2 e) + pc)), xcp) (stk', loc', Suc (Suc (length (compE2 e) + pc')), xcp')\"\nby(blast elim: \\exec_moveE intro: \\exec_moveI \\move2_\\moves2.intros exec_move_TryI2)\n\n\n\nlemma NewArray_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (newA T\\e\\) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl NewArray_\\execI)+\n\nlemma Cast_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (Cast T e) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Cast_\\execI)+\n\nlemma InstanceOf_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e instanceof T) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl InstanceOf_\\execI)+\n\n\n\nlemma BinOp_\\ExecrI2:\n \"\\Exec_mover ci P t e2 h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (e \\bop\\ e2) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl BinOp_\\execI2)+\n\nlemma LAss_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (V := e) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl LAss_\\execI)+\n\nlemma AAcc_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\i\\) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl AAcc_\\execI1)+\n\nlemma AAcc_\\ExecrI2:\n \"\\Exec_mover ci P t i h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (a\\i\\) h ((stk @ [v]), loc, (length (compE2 a) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 a) + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl AAcc_\\execI2)+\n\nlemma AAss_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\i\\ := e') h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl AAss_\\execI1)+\n\nlemma AAss_\\ExecrI2:\n \"\\Exec_mover ci P t i h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (a\\i\\ := e) h ((stk @ [v]), loc, (length (compE2 a) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 a) + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl AAss_\\execI2)+\n\nlemma AAss_\\ExecrI3:\n \"\\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (a\\i\\ := e) h ((stk @ [v, v']), loc, (length (compE2 a) + length (compE2 i) + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 a) + length (compE2 i) + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl AAss_\\execI3)+\n\nlemma ALength_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\length) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl ALength_\\execI)+\n\nlemma FAcc_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\F{D}) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl FAcc_\\execI)+\n\nlemma FAss_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\F{D} := e') h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl FAss_\\execI1)+\n\n\n\nlemma CAS_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e\\compareAndSwap(D\\F, e', e'')) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl CAS_\\execI1)+\n\nlemma CAS_\\ExecrI2:\n \"\\Exec_mover ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl CAS_\\execI2)+\n\nlemma CAS_\\ExecrI3:\n \"\\Exec_mover ci P t e'' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v, v']), loc, (length (compE2 e) + length (compE2 e') + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 e) + length (compE2 e') + pc'), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl CAS_\\execI3)+\n\nlemma Call_\\ExecrI1:\n \"\\Exec_mover ci P t obj h s s' \\ \\Exec_mover ci P t (obj\\M'(es)) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Call_\\execI1)+\n\nlemma Call_\\ExecrI2:\n \"\\Exec_movesr ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (obj\\M'(es)) h ((stk @ [v]), loc, (length (compE2 obj) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 obj) + pc'), xcp')\"\nby(induct rule: \\Execsr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Call_\\execI2)+\n\nlemma Block_\\ExecrI_Some:\n \"\\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t {V:T=\\v\\; e} h (stk, loc, (Suc (Suc pc)), xcp) (stk', loc', (Suc (Suc pc')), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Block_\\execI_Some)+\n\nlemma Block_\\ExecrI_None:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t {V:T=None; e} h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Block_\\execI_None)+\n\nlemma Sync_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (sync\\<^bsub>V\\<^esub> (e) e') h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Sync_\\execI)+\n\nlemma Insync_\\ExecrI:\n \"\\Exec_mover ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (sync\\<^bsub>V\\<^esub> (e) e') h (stk, loc, (Suc (Suc (Suc (length (compE2 e) + pc)))), xcp) (stk', loc', (Suc (Suc (Suc (length (compE2 e) + pc')))), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Insync_\\execI)+\n\nlemma Seq_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (e;;e') h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Seq_\\execI1)+\n\nlemma Seq_\\ExecrI2:\n \"\\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk', loc', pc' ,xcp') \\\n \\Exec_mover ci P t (e';;e) h (stk, loc, (Suc (length (compE2 e') + pc)), xcp) (stk', loc', (Suc (length (compE2 e') + pc')), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Seq_\\execI2)+\n\nlemma Cond_\\ExecrI1:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (if (e) e1 else e2) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Cond_\\execI1)+\n\nlemma Cond_\\ExecrI2:\n \"\\Exec_mover ci P t e1 h (stk, loc, pc, xcp) (stk', loc', pc', xcp') \\\n \\Exec_mover ci P t (if (e) e1 else e2) h (stk, loc, (Suc (length (compE2 e) + pc)), xcp) (stk', loc', (Suc (length (compE2 e) + pc')), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Cond_\\execI2)+\n\nlemma Cond_\\ExecrI3:\n \"\\Exec_mover ci P t e2 h (stk, loc ,pc, xcp) (stk', loc', pc', xcp') \\\n \\Exec_mover ci P t (if (e) e1 else e2) h (stk, loc, (Suc (Suc (length (compE2 e) + length (compE2 e1) + pc))), xcp) (stk', loc', (Suc (Suc (length (compE2 e) + length (compE2 e1) + pc'))), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Cond_\\execI3)+\n\nlemma While_\\ExecrI1:\n \"\\Exec_mover ci P t c h s s' \\ \\Exec_mover ci P t (while (c) e) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl While_\\execI1)+\n\nlemma While_\\ExecrI2:\n \"\\Exec_mover ci P t E h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (while (c) E) h (stk, loc ,(Suc (length (compE2 c) + pc)), xcp) (stk', loc', (Suc (length (compE2 c) + pc')), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl While_\\execI2)+\n\nlemma Throw_\\ExecrI:\n \"\\Exec_mover ci P t e h s s' \\ \\Exec_mover ci P t (throw e) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Throw_\\execI)+\n\nlemma Try_\\ExecrI1:\n \"\\Exec_mover ci P t E h s s' \\ \\Exec_mover ci P t (try E catch(C' V) e) h s s'\"\nby(induct rule: rtranclp_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Try_\\execI1)+\n\nlemma Try_\\ExecrI2:\n \"\\Exec_mover ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_mover ci P t (try E catch(C' V) e) h (stk, loc, (Suc (Suc (length (compE2 E) + pc))), xcp) (stk', loc', (Suc (Suc (length (compE2 E) + pc'))), xcp')\"\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl Try_\\execI2)+\n\n\nlemma NewArray_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (newA T\\e\\) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl NewArray_\\execI)+\n\nlemma Cast_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (Cast T e) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Cast_\\execI)+\n\nlemma InstanceOf_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e instanceof T) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl InstanceOf_\\execI)+\n\nlemma BinOp_\\ExectI1:\n \"\\Exec_movet ci P t e1 h s s' \\ \\Exec_movet ci P t (e1 \\bop\\ e2) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl BinOp_\\execI1)+\n\nlemma BinOp_\\ExectI2:\n \"\\Exec_movet ci P t e2 h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (e \\bop\\ e2) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl BinOp_\\execI2)+\n\nlemma LAss_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (V := e) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl LAss_\\execI)+\n\nlemma AAcc_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\i\\) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl AAcc_\\execI1)+\n\nlemma AAcc_\\ExectI2:\n \"\\Exec_movet ci P t i h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (a\\i\\) h ((stk @ [v]), loc, (length (compE2 a) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 a) + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl AAcc_\\execI2)+\n\nlemma AAss_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\i\\ := e') h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl AAss_\\execI1)+\n\nlemma AAss_\\ExectI2:\n \"\\Exec_movet ci P t i h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (a\\i\\ := e) h ((stk @ [v]), loc, (length (compE2 a) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 a) + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl AAss_\\execI2)+\n\nlemma AAss_\\ExectI3:\n \"\\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (a\\i\\ := e) h ((stk @ [v, v']), loc, (length (compE2 a) + length (compE2 i) + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 a) + length (compE2 i) + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl AAss_\\execI3)+\n\nlemma ALength_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\length) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl ALength_\\execI)+\n\nlemma FAcc_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\F{D}) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl FAcc_\\execI)+\n\nlemma FAss_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\F{D} := e') h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl FAss_\\execI1)+\n\n\n\nlemma CAS_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e\\compareAndSwap(D\\F, e', e'')) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl CAS_\\execI1)+\n\nlemma CAS_\\ExectI2:\n \"\\Exec_movet ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v]), loc, (length (compE2 e) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 e) + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl CAS_\\execI2)+\n\nlemma CAS_\\ExectI3:\n \"\\Exec_movet ci P t e'' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (e\\compareAndSwap(D\\F, e', e'')) h ((stk @ [v, v']), loc, (length (compE2 e) + length (compE2 e') + pc), xcp) ((stk' @ [v, v']), loc', (length (compE2 e) + length (compE2 e') + pc'), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl CAS_\\execI3)+\n\nlemma Call_\\ExectI1:\n \"\\Exec_movet ci P t obj h s s' \\ \\Exec_movet ci P t (obj\\M'(es)) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Call_\\execI1)+\n\nlemma Call_\\ExectI2:\n \"\\Exec_movest ci P t es h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (obj\\M'(es)) h ((stk @ [v]), loc, (length (compE2 obj) + pc), xcp) ((stk' @ [v]), loc', (length (compE2 obj) + pc'), xcp')\"\nby(induct rule: \\Execst_induct)(blast intro: tranclp.trancl_into_trancl Call_\\execI2)+\n\nlemma Block_\\ExectI_Some:\n \"\\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t {V:T=\\v\\; e} h (stk, loc, (Suc (Suc pc)), xcp) (stk', loc', (Suc (Suc pc')), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Block_\\execI_Some)+\n\nlemma Block_\\ExectI_None:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t {V:T=None; e} h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Block_\\execI_None)+\n\nlemma Sync_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (sync\\<^bsub>V\\<^esub> (e) e') h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Sync_\\execI)+\n\nlemma Insync_\\ExectI:\n \"\\Exec_movet ci P t e' h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (sync\\<^bsub>V\\<^esub> (e) e') h (stk, loc, (Suc (Suc (Suc (length (compE2 e) + pc)))), xcp) (stk', loc', (Suc (Suc (Suc (length (compE2 e) + pc')))), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Insync_\\execI)+\n\nlemma Seq_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (e;;e') h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Seq_\\execI1)+\n\nlemma Seq_\\ExectI2:\n \"\\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk', loc', pc' ,xcp') \\\n \\Exec_movet ci P t (e';;e) h (stk, loc, (Suc (length (compE2 e') + pc)), xcp) (stk', loc', (Suc (length (compE2 e') + pc')), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Seq_\\execI2)+\n\nlemma Cond_\\ExectI1:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (if (e) e1 else e2) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Cond_\\execI1)+\n\nlemma Cond_\\ExectI2:\n \"\\Exec_movet ci P t e1 h (stk, loc, pc, xcp) (stk', loc', pc', xcp') \\\n \\Exec_movet ci P t (if (e) e1 else e2) h (stk, loc, (Suc (length (compE2 e) + pc)), xcp) (stk', loc', (Suc (length (compE2 e) + pc')), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Cond_\\execI2)+\n\nlemma Cond_\\ExectI3:\n \"\\Exec_movet ci P t e2 h (stk, loc ,pc, xcp) (stk', loc', pc', xcp') \\\n \\Exec_movet ci P t (if (e) e1 else e2) h (stk, loc, (Suc (Suc (length (compE2 e) + length (compE2 e1) + pc))), xcp) (stk', loc', (Suc (Suc (length (compE2 e) + length (compE2 e1) + pc'))), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Cond_\\execI3)+\n\nlemma While_\\ExectI1:\n \"\\Exec_movet ci P t c h s s' \\ \\Exec_movet ci P t (while (c) e) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl While_\\execI1)+\n\nlemma While_\\ExectI2:\n \"\\Exec_movet ci P t E h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (while (c) E) h (stk, loc ,(Suc (length (compE2 c) + pc)), xcp) (stk', loc', (Suc (length (compE2 c) + pc')), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl While_\\execI2)+\n\nlemma Throw_\\ExectI:\n \"\\Exec_movet ci P t e h s s' \\ \\Exec_movet ci P t (throw e) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Throw_\\execI)+\n\nlemma Try_\\ExectI1:\n \"\\Exec_movet ci P t E h s s' \\ \\Exec_movet ci P t (try E catch(C' V) e) h s s'\"\nby(induct rule: tranclp_induct)(blast intro: tranclp.trancl_into_trancl Try_\\execI1)+\n\nlemma Try_\\ExectI2:\n \"\\Exec_movet ci P t e h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\n \\ \\Exec_movet ci P t (try E catch(C' V) e) h (stk, loc, (Suc (Suc (length (compE2 E) + pc))), xcp) (stk', loc', (Suc (Suc (length (compE2 E) + pc'))), xcp')\"\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl Try_\\execI2)+\n\nlemma \\Exec_movesr_map_Val:\n \"\\Exec_movesr_a P t (map Val vs) h ([], xs, 0, None) ((rev vs), xs, (length (compEs2 (map Val vs))), None)\"\nproof(induct vs arbitrary: pc stk Ts rule: rev_induct)\n case Nil thus ?case by(auto)\nnext\n case (snoc v vs')\n let ?E = \"compEs2 (map Val vs')\"\n from snoc have \"\\Exec_movesr_a P t (map Val (vs' @ [v])) h ([], xs, 0, None) ((rev vs'), xs, (length ?E), None)\"\n by auto\n also {\n have \"exec_meth_a (compP2 P) (?E @ [Push v]) (compxEs2 (map Val vs') 0 0 @ shift (length ?E) []) t h ((rev vs'), xs, (length ?E + 0), None) \\ h ((v # rev vs'), xs, (length ?E + Suc 0), None)\"\n by -(rule append_exec_meth_xt, auto simp add: exec_meth_instr)\n moreover have \"\\moves2 (compP2 P) h (rev vs') (map Val vs' @ [Val v]) (length (compEs2 (map Val vs')) + 0) None\"\n by(rule append_\\moves2 \\moves2Hd \\move2Val)+\n ultimately have \"\\Exec_movesr_a P t (map Val (vs' @ [v])) h ((rev vs'), xs, (length ?E), None) ((rev (vs' @ [v])), xs, (length (compEs2 (map Val (vs' @ [v])))), None)\"\n by -(rule \\Execsr1step, auto simp add: exec_moves_def compP2_def) }\n finally show ?case .\nqed\n\nlemma \\Exec_mover_blocks1 [simp]:\n \"\\Exec_mover ci P t (blocks1 n Ts body) h s s' = \\Exec_mover ci P t body h s s'\"\nby(simp add: \\exec_move_conv_\\exec_meth)\n\nlemma \\Exec_movet_blocks1 [simp]:\n \"\\Exec_movet ci P t (blocks1 n Ts body) h s s' = \\Exec_movet ci P t body h s s'\"\nby(simp add: \\exec_move_conv_\\exec_meth)\n\n\ndefinition \\exec_1 :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\n where \"\\exec_1 P t \\ \\' \\ exec_1 P t \\ \\ \\' \\ \\Move2 P \\\"\n\nlemma \\exec_1I [intro]:\n \"\\ exec_1 P t \\ \\ \\'; \\Move2 P \\ \\ \\ \\exec_1 P t \\ \\'\"\nby(simp add: \\exec_1_def)\n\nlemma \\exec_1E [elim]:\n assumes \"\\exec_1 P t \\ \\'\"\n obtains \"exec_1 P t \\ \\ \\'\" \"\\Move2 P \\\"\nusing assms by(auto simp add: \\exec_1_def)\n\nabbreviation \\Exec_1r :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\nwhere \"\\Exec_1r P t == (\\exec_1 P t)^**\"\n\nabbreviation \\Exec_1t :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\nwhere \"\\Exec_1t P t == (\\exec_1 P t)^++\"\n\ndefinition \\exec_1_d :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\nwhere \"\\exec_1_d P t \\ \\' \\ exec_1 P t \\ \\ \\' \\ \\Move2 P \\ \\ check P \\\"\n\nlemma \\exec_1_dI [intro]:\n \"\\ exec_1 P t \\ \\ \\'; check P \\; \\Move2 P \\ \\ \\ \\exec_1_d P t \\ \\'\"\nby(simp add: \\exec_1_d_def)\n\nlemma \\exec_1_dE [elim]:\n assumes \"\\exec_1_d P t \\ \\'\"\n obtains \"exec_1 P t \\ \\ \\'\" \"check P \\\" \"\\Move2 P \\\"\nusing assms by(auto simp add: \\exec_1_d_def)\n\nabbreviation \\Exec_1_dr :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\nwhere \"\\Exec_1_dr P t == (\\exec_1_d P t)^**\"\n\nabbreviation \\Exec_1_dt :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'heap) jvm_state \\ bool\"\nwhere \"\\Exec_1_dt P t == (\\exec_1_d P t)^++\"\n\ndeclare compxE2_size_convs[simp del] compxEs2_size_convs[simp del]\ndeclare compxE2_stack_xlift_convs[simp del] compxEs2_stack_xlift_convs[simp del]\n\nlemma exec_instr_frs_offer:\n \"(ta, xcp', h', (stk', loc', C, M, pc') # frs) \\ exec_instr ins P t h stk loc C M pc frs\n \\ (ta, xcp', h', (stk', loc', C, M, pc') # frs @ frs') \\ exec_instr ins P t h stk loc C M pc (frs @ frs')\"\napply(cases ins)\napply(simp_all add: nth_append split_beta split: if_split_asm sum.split_asm)\napply(force split: extCallRet.split_asm simp add: extRet2JVM_def)+\ndone\n\nlemma check_instr_frs_offer:\n \"\\ check_instr ins P h stk loc C M pc frs; ins \\ Return \\\n \\ check_instr ins P h stk loc C M pc (frs @ frs')\"\nby(cases ins)(simp_all split: if_split_asm)\n\nlemma exec_instr_CM_change:\n \"(ta, xcp', h', (stk', loc', C, M, pc') # frs) \\ exec_instr ins P t h stk loc C M pc frs\n \\ (ta, xcp', h', (stk', loc', C', M', pc') # frs) \\ exec_instr ins P t h stk loc C' M' pc frs\"\napply(cases ins)\napply(simp_all add: nth_append split_beta neq_Nil_conv split: if_split_asm sum.split_asm)\napply(force split: extCallRet.split_asm simp add: extRet2JVM_def)+\ndone\n\nlemma check_instr_CM_change:\n \"\\ check_instr ins P h stk loc C M pc frs; ins \\ Return \\\n \\ check_instr ins P h stk loc C' M' pc frs\"\nby(cases ins)(simp_all split: if_split_asm)\n\nlemma exec_move_exec_1:\n assumes exec: \"exec_move ci P t body h (stk, loc, pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and sees: \"P \\ C sees M : Ts\\T = \\body\\ in D\"\n shows \"exec_1 (compP2 P) t (xcp, h, (stk, loc, C, M, pc) # frs) ta (xcp', h', (stk', loc', C, M, pc') # frs)\"\nusing exec unfolding exec_move_def\nproof(cases)\n case exec_instr\n note [simp] = \\xcp = None\\\n and exec = \\(ta, xcp', h', [(stk', loc', undefined, undefined, pc')])\n \\ exec_instr (compE2 body ! pc) (compP2 P) t h stk loc undefined undefined pc []\\\n from exec have \"(ta, xcp', h', [(stk', loc', C, M, pc')])\n \\ exec_instr (compE2 body ! pc) (compP2 P) t h stk loc C M pc []\"\n by(rule exec_instr_CM_change)\n from exec_instr_frs_offer[OF this, of frs]\n have \"(ta, xcp', h', (stk', loc', C, M, pc') # frs)\n \\ exec_instr (compE2 body ! pc) (compP2 P) t h stk loc C M pc frs\" by simp\n with sees \\pc < length (compE2 body)\\ show ?thesis\n by(simp add: exec_1_iff compP2_def compMb2_def nth_append)\nnext\n case exec_catch\n thus ?thesis using sees_method_compP[OF sees, of \"\\C M Ts T. compMb2\"]\n by(simp add: exec_1_iff compMb2_def compP2_def)\nqed\n\nlemma \\exec_move_\\exec_1:\n assumes exec: \"\\exec_move ci P t body h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\"\n and sees: \"P \\ C sees M : Ts\\T = \\body\\ in D\"\n shows \"\\exec_1 (compP2 P) t (xcp, h, (stk, loc, C, M, pc) # frs) (xcp', h, (stk', loc', C, M, pc') # frs)\"\nproof(rule \\exec_1I)\n from exec obtain exec': \"exec_move ci P t body h (stk, loc, pc, xcp) \\ h (stk', loc', pc', xcp')\"\n and \\: \"\\move2 P h stk body pc xcp\" by(rule \\exec_moveE)\n have \"exec_1 (compP2 P) t (xcp, h, (stk, loc, C, M, pc) # frs) \\ (xcp', h, (stk', loc', C, M, pc') # frs)\"\n using exec' sees by(rule exec_move_exec_1)\n thus \"compP2 P,t \\ (xcp, h, (stk, loc, C, M, pc) # frs) -\\-jvm\\ (xcp', h, (stk', loc', C, M, pc') # frs)\" by auto\n { fix a\n assume [simp]: \"xcp = \\a\\\" \n from sees_method_compP[OF sees, of \"\\C M Ts T. compMb2\"]\n have \"ex_table_of (compP2 P) C M = compxE2 body 0 0\" by(simp add: compP2_def compMb2_def)\n hence \"match_ex_table (compP2 P) (cname_of h a) pc (ex_table_of (compP2 P) C M) \\ None\" \"pc < length (compE2 body)\"\n using exec' sees by(auto simp add: exec_move_def elim: exec_meth.cases) }\n with \\ sees sees_method_compP[OF sees, of \"\\C M Ts T. compMb2\"]\n show \"\\Move2 (compP2 P) (xcp, h, (stk, loc, C, M, pc) # frs)\" \n unfolding \\Move2_compP2[OF sees] by(fastforce simp add: compP2_def compMb2_def)\nqed\n\nlemma \\Exec_mover_\\Exec_1r:\n assumes move: \"\\Exec_mover ci P t body h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\"\n and sees: \"P \\ C sees M : Ts\\T = \\body\\ in D\"\n shows \"\\Exec_1r (compP2 P) t (xcp, h, (stk, loc, C, M, pc) # frs') (xcp', h, (stk', loc', C, M, pc') # frs')\"\nusing move\nby(induct rule: \\Execr_induct)(blast intro: rtranclp.rtrancl_into_rtrancl \\exec_move_\\exec_1[OF _ sees])+\n\nlemma \\Exec_movet_\\Exec_1t:\n assumes move: \"\\Exec_movet ci P t body h (stk, loc, pc, xcp) (stk', loc', pc', xcp')\"\n and sees: \"P \\ C sees M : Ts\\T = \\body\\ in D\"\n shows \"\\Exec_1t (compP2 P) t (xcp, h, (stk, loc, C, M, pc) # frs') (xcp', h, (stk', loc', C, M, pc') # frs')\"\nusing move\nby(induct rule: \\Exect_induct)(blast intro: tranclp.trancl_into_trancl \\exec_move_\\exec_1[OF _ sees])+\n\nlemma \\Exec_1r_rtranclpD:\n \"\\Exec_1r P t (xcp, h, frs) (xcp', h', frs')\n \\ (\\((xcp, frs), h) ((xcp', frs'), h'). exec_1 P t (xcp, h, frs) \\ (xcp', h', frs') \\ \\Move2 P (xcp, h, frs))^** ((xcp, frs), h) ((xcp', frs'), h')\"\nby(induct rule: rtranclp_induct3)(fastforce intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma \\Exec_1t_rtranclpD:\n \"\\Exec_1t P t (xcp, h, frs) (xcp', h', frs')\n \\ (\\((xcp, frs), h) ((xcp', frs'), h'). exec_1 P t (xcp, h, frs) \\ (xcp', h', frs') \\ \\Move2 P (xcp, h, frs))^++ ((xcp, frs), h) ((xcp', frs'), h')\"\nby(induct rule: tranclp_induct3)(fastforce intro: tranclp.trancl_into_trancl)+\n\nlemma exec_meth_length_compE2_stack_xliftD:\n \"exec_meth ci P (compE2 e) (stack_xlift d (compxE2 e 0 0)) t h (stk, loc, pc, xcp) ta h' s'\n \\ pc < length (compE2 e)\"\nby(cases s')(auto simp add: stack_xlift_compxE2)\n\nlemma exec_meth_length_pc_xt_Nil:\n \"exec_meth ci P ins [] t h (stk, loc, pc, xcp) ta h' s' \\ pc < length ins\"\napply(erule exec_meth.cases)\napply(auto dest: match_ex_table_pc_length_compE2)\ndone\n\nlemma BinOp_exec2D:\n assumes exec: \"exec_meth ci (compP2 P) (compE2 (e1 \\bop\\ e2)) (compxE2 (e1 \\bop\\ e2) 0 0) t h (stk @ [v1], loc, length (compE2 e1) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and pc: \"pc < length (compE2 e2)\"\n shows \"exec_meth ci (compP2 P) (compE2 e2) (stack_xlift (length [v1]) (compxE2 e2 0 0)) t h (stk @ [v1], loc, pc, xcp) ta h' (stk', loc', pc' - length (compE2 e1), xcp') \\ pc' \\ length (compE2 e1)\"\nproof\n from exec have \"exec_meth ci (compP2 P) ((compE2 e1 @ compE2 e2) @ [BinOpInstr bop])\n (compxE2 e1 0 0 @ shift (length (compE2 e1)) (stack_xlift (length [v1]) (compxE2 e2 0 0))) t h\n (stk @ [v1], loc, length (compE2 e1) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: compxE2_size_convs compxE2_stack_xlift_convs)\n hence exec': \"exec_meth ci (compP2 P) (compE2 e1 @ compE2 e2) (compxE2 e1 0 0 @ shift (length (compE2 e1)) (stack_xlift (length [v1]) (compxE2 e2 0 0))) t h\n (stk @ [v1], loc, length (compE2 e1) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(rule exec_meth_take) (simp add: pc)\n thus \"exec_meth ci (compP2 P) (compE2 e2) (stack_xlift (length [v1]) (compxE2 e2 0 0)) t h\n (stk @ [v1], loc, pc, xcp) ta h' (stk', loc', pc' - length (compE2 e1), xcp')\"\n by(rule exec_meth_drop_xt) auto\n from exec' show \"pc' \\ length (compE2 e1)\"\n by(rule exec_meth_drop_xt_pc)(auto)\nqed\n\nlemma Call_execParamD:\n assumes exec: \"exec_meth ci (compP2 P) (compE2 (obj\\M'(ps))) (compxE2 (obj\\M'(ps)) 0 0) t h (stk @ [v], loc, length (compE2 obj) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n and pc: \"pc < length (compEs2 ps)\"\n shows \"exec_meth ci (compP2 P) (compEs2 ps) (stack_xlift (length [v]) (compxEs2 ps 0 0)) t h (stk @ [v], loc, pc, xcp) ta h' (stk', loc', pc' - length (compE2 obj), xcp') \\ pc' \\ length (compE2 obj)\"\nproof\n from exec have \"exec_meth ci (compP2 P) ((compE2 obj @ compEs2 ps) @ [Invoke M' (length ps)])\n (compxE2 obj 0 0 @ shift (length (compE2 obj)) (stack_xlift (length [v]) (compxEs2 ps 0 0))) t h\n (stk @ [v], loc, length (compE2 obj) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(simp add: compxEs2_size_convs compxEs2_stack_xlift_convs)\n hence exec': \"exec_meth ci (compP2 P) (compE2 obj @ compEs2 ps) (compxE2 obj 0 0 @ shift (length (compE2 obj)) (stack_xlift (length [v]) (compxEs2 ps 0 0))) t h\n (stk @ [v], loc, length (compE2 obj) + pc, xcp) ta h' (stk', loc', pc', xcp')\"\n by(rule exec_meth_take)(simp add: pc)\n thus \"exec_meth ci (compP2 P) (compEs2 ps) (stack_xlift (length [v]) (compxEs2 ps 0 0)) t h (stk @ [v], loc, pc, xcp) ta h' (stk', loc', pc' - length (compE2 obj), xcp')\"\n by(rule exec_meth_drop_xt) auto\n from exec' show \"pc' \\ length (compE2 obj)\"\n by(rule exec_meth_drop_xt_pc)(auto)\nqed\n\nlemma exec_move_length_compE2D [dest]:\n \"exec_move ci P t e h (stk, loc, pc, xcp) ta h' s' \\ pc < length (compE2 e)\"\nby(cases s')(auto simp add: exec_move_def)\n\nlemma exec_moves_length_compEs2D [dest]:\n \"exec_moves ci P t es h (stk, loc, pc, xcp) ta h' s' \\ pc < length (compEs2 es)\"\nby(cases s')(auto simp add: exec_moves_def)\n\nlemma exec_meth_ci_appD:\n \"\\ exec_meth ci P ins xt t h (stk, loc, pc, None) ta h' fr' \\\n \\ ci_app ci (ins ! pc) P h stk loc undefined undefined pc []\"\nby(cases fr')(simp add: exec_meth_instr)\n\nlemma exec_move_ci_appD:\n \"exec_move ci P t E h (stk, loc, pc, None) ta h' fr'\n \\ ci_app ci (compE2 E ! pc) (compP2 P) h stk loc undefined undefined pc []\"\nunfolding exec_move_def by(rule exec_meth_ci_appD)\n\nlemma exec_moves_ci_appD:\n \"exec_moves ci P t Es h (stk, loc, pc, None) ta h' fr'\n \\ ci_app ci (compEs2 Es ! pc) (compP2 P) h stk loc undefined undefined pc []\"\nunfolding exec_moves_def by(rule exec_meth_ci_appD)\n\nlemma \\instr_stk_append_check:\n \"check_instr' i P h stk loc C M pc frs \\ \\instr P h (stk @ vs) i = \\instr P h stk i\"\nby(cases i)(simp_all add: nth_append)\n\nlemma \\instr_stk_drop_exec_move:\n \"exec_move ci P t e h (stk, loc, pc, None) ta h' fr'\n \\ \\instr (compP2 P) h (stk @ vs) (compE2 e ! pc) = \\instr (compP2 P) h stk (compE2 e ! pc)\"\napply(drule exec_move_ci_appD)\napply(drule wf_ciD2_ci_app)\napply(erule \\instr_stk_append_check)\ndone\n\nlemma \\instr_stk_drop_exec_moves:\n \"exec_moves ci P t es h (stk, loc, pc, None) ta h' fr'\n \\ \\instr (compP2 P) h (stk @ vs) (compEs2 es ! pc) = \\instr (compP2 P) h stk (compEs2 es ! pc)\"\napply(drule exec_moves_ci_appD)\napply(drule wf_ciD2_ci_app)\napply(erule \\instr_stk_append_check)\ndone\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Compiler/Execs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.36296921930155557, "lm_q1q2_score": 0.19985352561001243}} {"text": "theory Common_Primitive_toString\nimports Simple_Firewall.Primitives_toString\n Common_Primitive_Matcher\nbegin\n\n\nsection\\Firewall toString Functions\\\n\nfun ipt_ipv4range_toString :: \"32 ipt_iprange \\ string\" where\n \"ipt_ipv4range_toString (IpAddr ip) = ipv4addr_toString ip\" |\n \"ipt_ipv4range_toString (IpAddrNetmask ip n) = ipv4addr_toString ip@''/''@string_of_nat n\" |\n \"ipt_ipv4range_toString (IpAddrRange ip1 ip2) = ipv4addr_toString ip1@''-''@ipv4addr_toString ip2\"\n\nfun ipt_ipv6range_toString :: \"128 ipt_iprange \\ string\" where\n \"ipt_ipv6range_toString (IpAddr ip) = ipv6addr_toString ip\" |\n \"ipt_ipv6range_toString (IpAddrNetmask ip n) = ipv6addr_toString ip@''/''@string_of_nat n\" |\n \"ipt_ipv6range_toString (IpAddrRange ip1 ip2) = ipv6addr_toString ip1@''-''@ipv6addr_toString ip2\"\n\ndefinition ipv4addr_wordinterval_pretty_toString :: \"32 wordinterval \\ string\" where\n \"ipv4addr_wordinterval_pretty_toString wi = list_toString ipt_ipv4range_toString (wi_to_ipt_iprange wi)\"\n\nlemma \"ipv4addr_wordinterval_pretty_toString \n (RangeUnion (RangeUnion (WordInterval 0x7F000000 0x7FFFFFFF) (WordInterval 0x1020304 0x1020306))\n (WordInterval 0x8080808 0x8080808)) = ''[127.0.0.0/8, 1.2.3.4-1.2.3.6, 8.8.8.8]''\" by eval\n \n\n\nfun action_toString :: \"action \\ string\" where\n \"action_toString action.Accept = ''-j ACCEPT''\" |\n \"action_toString action.Drop = ''-j DROP''\" |\n \"action_toString action.Reject = ''-j REJECT''\" |\n \"action_toString (action.Call target) = ''-j ''@target@'' (call)''\" |\n \"action_toString (action.Goto target) = ''-g ''@target\" |\n \"action_toString action.Empty = ''''\" |\n \"action_toString action.Log = ''-j LOG''\" |\n \"action_toString action.Return = ''-j RETURN''\" |\n \"action_toString action.Unknown = ''!!!!!!!!!!! UNKNOWN !!!!!!!!!!!''\"\n\n\nfun common_primitive_toString :: \"('i::len word \\ string) \\ 'i common_primitive \\ string\" where\n \"common_primitive_toString ipToStr (Src (IpAddr ip)) = ''-s ''@ipToStr ip\" |\n \"common_primitive_toString ipToStr (Dst (IpAddr ip)) = ''-d ''@ipToStr ip\" |\n \"common_primitive_toString ipToStr (Src (IpAddrNetmask ip n)) = ''-s ''@ipToStr ip@''/''@string_of_nat n\" |\n \"common_primitive_toString ipToStr (Dst (IpAddrNetmask ip n)) = ''-d ''@ipToStr ip@''/''@string_of_nat n\" |\n \"common_primitive_toString ipToStr (Src (IpAddrRange ip1 ip2)) = ''-m iprange --src-range ''@ipToStr ip1@''-''@ipToStr ip2\" |\n \"common_primitive_toString ipToStr (Dst (IpAddrRange ip1 ip2)) = ''-m iprange --dst-range ''@ipToStr ip1@''-''@ipToStr ip2\" |\n \"common_primitive_toString _ (IIface ifce) = iface_toString ''-i '' ifce\" |\n \"common_primitive_toString _ (OIface ifce) = iface_toString ''-o '' ifce\" |\n \"common_primitive_toString _ (Prot prot) = ''-p ''@protocol_toString prot\" |\n \"common_primitive_toString _ (Src_Ports (L4Ports prot pts)) = ''-m ''@primitive_protocol_toString prot@'' --spts '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (Dst_Ports (L4Ports prot pts)) = ''-m ''@primitive_protocol_toString prot@'' --dpts '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (MultiportPorts (L4Ports prot pts)) = ''-p ''@primitive_protocol_toString prot@'' -m multiport --ports '' @ list_toString (ports_toString '''') pts\" |\n \"common_primitive_toString _ (CT_State S) = ''-m state --state ''@ctstate_set_toString S\" |\n \"common_primitive_toString _ (L4_Flags (TCP_Flags c m)) = ''--tcp-flags ''@ipt_tcp_flags_toString c@'' ''@ipt_tcp_flags_toString m\" |\n \"common_primitive_toString _ (Extra e) = ''~~''@e@''~~''\"\n\n\ndefinition common_primitive_ipv4_toString :: \"32 common_primitive \\ string\" where\n \"common_primitive_ipv4_toString \\ common_primitive_toString ipv4addr_toString\"\n\ndefinition common_primitive_ipv6_toString :: \"128 common_primitive \\ string\" where\n \"common_primitive_ipv6_toString \\ common_primitive_toString ipv6addr_toString\"\n\n\nfun common_primitive_match_expr_toString\n :: \"('i common_primitive \\ string) \\ 'i common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_toString toStr MatchAny = ''''\" |\n \"common_primitive_match_expr_toString toStr (Match m) = toStr m\" |\n \"common_primitive_match_expr_toString toStr (MatchAnd m1 m2) =\n common_primitive_match_expr_toString toStr m1 @'' '' @ common_primitive_match_expr_toString toStr m2\" |\n \"common_primitive_match_expr_toString toStr (MatchNot (Match m)) = ''! ''@toStr m\" |\n \"common_primitive_match_expr_toString toStr (MatchNot m) = ''NOT (''@common_primitive_match_expr_toString toStr m@'')''\"\n\ndefinition common_primitive_match_expr_ipv4_toString :: \"32 common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_ipv4_toString \\ common_primitive_match_expr_toString common_primitive_ipv4_toString\"\n\ndefinition common_primitive_match_expr_ipv6_toString :: \"128 common_primitive match_expr \\ string\" where\n \"common_primitive_match_expr_ipv6_toString \\ common_primitive_match_expr_toString common_primitive_ipv6_toString\"\n\nfun common_primitive_rule_toString :: \"32 common_primitive rule \\ string\" where\n \"common_primitive_rule_toString (Rule m a) = common_primitive_match_expr_ipv4_toString m @'' ''@action_toString a\"\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Primitive_Matchers/Common_Primitive_toString.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.550607350786733, "lm_q2_score": 0.3629692193015555, "lm_q1q2_score": 0.19985352025675818}} {"text": "subsection \\ Simulation Harness \\\n\ntheory ITree_Simulation\n imports Executable_Universe Channel_Type_Rep \"Interaction_Trees.ITree_Extraction\" \n keywords \"animate\" :: \"thy_defn\"\nbegin\n\ntext \\ The following additional constructor for partial functions allows us to request an\n value covered by @{typ uval}. \\\n\ndefinition pfun_of_ufun :: \"(uval \\\\<^sub>\\ 'e) \\ utyp \\ (uval \\ 'b) \\ 'e \\ 'b\" where\n\"pfun_of_ufun c t P = (\\ e\\{build\\<^bsub>c\\<^esub> v | v. v \\ uvals t} \\ P (the (match\\<^bsub>c\\<^esub> e)))\"\n\nlemma map_pfun_pfun_of_ufun [code]: \"map_pfun f (pfun_of_ufun c t P) = pfun_of_ufun c t (f \\ P)\"\n by (simp add: pfun_of_ufun_def pfun_eq_iff)\n\ndefinition itree_chf :: \"uname \\ ('inp::uvals \\ 'out::uvals \\\\<^sub>\\ 'e) \\ 'out \\ ('inp \\ ('e, 's) itree) \\ ('e, ('e, 's) itree) chf\" where\n\"itree_chf n c out P = ChanF undefined (n, to_uval out) UTYPE('inp) (P \\ from_uval)\"\n\n(* The conceptual type for the ITree structure we'd like is as below: *)\n\ntyp \\ ('inp::uvals \\ 'out::uvals \\\\<^sub>\\ 'e) \\ 'out \\ ('inp \\ ('e, 's) itree) \\\n\ncode_datatype pfun_of_alist pfun_of_map pfun_of_ufun pfun_of_chfuns pfun_entries\n\ncode_identifier\n code_module ITree_Simulation \\ (Haskell) Interaction_Trees\n| code_module Partial_Fun \\ (Haskell) Interaction_Trees\n| code_module Interaction_Trees \\ (Haskell) Interaction_Trees\n\ngenerate_file \\code/simulate/Simulate.hs\\ = \\\nmodule Simulate (simulate) where\nimport Interaction_Trees;\nimport Executable_Universe;\nimport Channel_Type_Rep;\nimport Prelude;\nimport System.IO;\nimport Data.Ratio;\n\n-- These library functions help us to trim the \"_C\" strings from pretty printed events\n\nisPrefixOf :: (Eq a) => [a] -> [a] -> Bool;\nisPrefixOf [] _ = True;\nisPrefixOf _ [] = False;\nisPrefixOf (x:xs) (y:ys)= x == y && isPrefixOf xs ys;\n\nremoveSubstr :: String -> String -> String;\nremoveSubstr w \"\" = \"\";\nremoveSubstr w s@(c:cs) = (if w `isPrefixOf` s then Prelude.drop (Prelude.length w) s else c : removeSubstr w cs);\n\ninstance Show Uval where\n show UnitV = \"()\"\n show (BoolV x) = show x\n show (IntV x) = show x\n show (RatV x) = show (fromRational x)\n show (StringV x) = show x\n show (EnumV _ x) = x\n show (PairV xy) = show xy\n show (ListV typ xs) = show xs\n\nmk_readUval :: Read a => (a -> Uval) -> String -> IO Uval\nmk_readUval f n = \n do { putStr (\"Input <\" ++ n ++ \"> value: \")\n ; e <- getLine\n ; return (f (read e)) }\n\nreadUtyp :: Utyp -> IO Uval\nreadUtyp BoolT = mk_readUval BoolV \"bool\"\nreadUtyp IntT = mk_readUval IntV \"int\"\nreadUtyp UnitT = return UnitV\n\nsimulate_cnt :: (Eq e, Prelude.Show e, Prelude.Show s) => Prelude.Int -> Itree e s -> Prelude.IO ();\nsimulate_cnt n (Ret x) = Prelude.putStrLn (\"Terminated: \" ++ Prelude.show x);\nsimulate_cnt n (Sil p) = \n do { if (n == 0) then Prelude.putStrLn \"Internal Activity...\" else return ();\n if (n >= 20) then do { Prelude.putStr \"Many steps (> 20); Continue? [Y/N]\"; q <- Prelude.getLine; \n if (q == \"Y\") then simulate_cnt 0 p else Prelude.putStrLn \"Ended early.\";\n }\n else simulate_cnt (n + 1) p\n };\nsimulate_cnt n (Vis (Pfun_of_alist [])) = Prelude.putStrLn \"Deadlocked.\";\nsimulate_cnt n t@(Vis (Pfun_of_alist m)) = \n do { Prelude.putStrLn (\"Events:\" ++ Prelude.concat (map (\\(n, e) -> \" (\" ++ Prelude.show n ++ \") \" ++ removeSubstr \"_C\" e ++ \";\") (zip [1..] (map (Prelude.show . fst) m))));\n e <- Prelude.getLine;\n if (e == \"q\" || e == \"Q\") then\n Prelude.putStrLn \"Simulation terminated\"\n else\n case (Prelude.reads e) of\n [] -> do { Prelude.putStrLn \"No parse\"; simulate_cnt n t }\n [(v, _)] -> if (v > Prelude.length m)\n then do { Prelude.putStrLn \"Rejected\"; simulate_cnt n t }\n else simulate_cnt 0 (snd (m !! (v - 1)))\n }; \nsimulate_cnt n t@(Vis (Pfun_of_ufun chan typ m)) = \n do { v <- readUtyp typ; \n simulate_cnt 0 (m v) }\nsimulate_cnt n (Vis (Pfun_of_chfuns [])) = Prelude.putStrLn \"Deadlocked.\";\nsimulate_cnt n t@(Vis (Pfun_of_chfuns m)) =\n do { Prelude.putStrLn (\"Events:\" ++ Prelude.concat (map (\\(i, ChanF c (n, p) _ _) -> \" (\" ++ show i ++ \") \" ++ n ++ \" \" ++ show p ++ \";\") (zip [1..] m)));\n e <- Prelude.getLine;\n if (e == \"q\" || e == \"Q\") then\n Prelude.putStrLn \"Simulation terminated\"\n else\n case (Prelude.reads e) of\n [] -> do { Prelude.putStrLn \"No parse\"; simulate_cnt n t }\n [(v, _)] -> if (v > Prelude.length m)\n then do { Prelude.putStrLn \"Rejected\"; simulate_cnt n t }\n else let (typ, p) = (\\(ChanF _ _ t p) -> (t, p)) (m!!(v - 1)) \n in do { val <- readUtyp typ\n ; simulate_cnt 0 (p val) } -- Ask for any inputs needed\n }; \n\nsimulate :: (Eq e, Prelude.Show e, Prelude.Show s) => Itree e s -> Prelude.IO ();\nsimulate p = do { hSetBuffering stdout NoBuffering; putStrLn \"\"; putStrLn \"Starting ITree Simulation...\"; simulate_cnt 0 p }\n\\\n\n(* The code below is the case for an opaque map function. It depends on there being a Read instance. *)\n\n(*\nsimulate_cnt n t@(Vis (Pfun_of_map f)) = \n do { Prelude.putStr (\"Enter an event:\");\n e <- Prelude.getLine;\n if (e == \"q\" || e == \"Q\") then\n Prelude.putStrLn \"Simulation terminated\"\n else\n case (Prelude.reads e) of\n [] -> do { Prelude.putStrLn \"No parse\"; simulate_cnt n t } \n [(v, _)] -> case f v of\n Nothing -> do { Prelude.putStrLn \"Rejected\"; simulate_cnt n t }\n Just t' -> simulate_cnt 0 t'\n }; \n*)\n\nML \\ \n\nstructure ITree_Simulator =\nstruct\n\nstructure ISim_Path = Theory_Data\n (type T = Path.T option\n val empty = NONE\n val extend = I\n val merge = fn (_, y) => y);\n\nfun simulator_setup thy = \n let open Isabelle_System; val tmp = Path.expand (create_tmp_path \"itree-simulate\" \"\")\n in case (ISim_Path.get thy) of NONE => () | SOME oldtmp => rm_tree oldtmp;\n make_directory tmp; (tmp, ISim_Path.put (SOME tmp) thy)\n end\n\nfun sim_files_cp ghc tmp = \n \"(fn path => let open Isabelle_System; val path' = Path.append path (Path.make [\\\"code\\\", \\\"simulate\\\"])\" ^\n \" in writeln \\\"Compiling animation...\\\"; bash (\\\"cd \\\" ^ Path.implode path' ^ \\\"; \" ^ ghc ^ \" Simulation >> /dev/null\\\") ; copy_dir path' (Path.explode \\\"\" ^ tmp ^ \"\\\") end)\";\n\nopen Named_Target\n\nfun firstLower s =\n case String.explode s of [] => \"\" | c :: cs => String.implode (Char.toLower c :: cs);\n\nfun simulation_file model thy =\n \"module Main where \\n\" ^\n \"import Simulate; \\n\" ^\n \"import \" ^ thy ^ \"; \\n\" ^\n \"main = simulate \" ^ firstLower model\n\nfun prep_simulation model thy ctx =\n let open Generated_Files; \n val (tmp, thy') = simulator_setup (Local_Theory.exit_global ctx);\n val ctx' = Named_Target.theory_init thy'\n val ghc = getenv \"ISABELLE_GHC\"\n val _ = if (ghc = \"\") then error \"GHC is not set up. Please set the environment variable ISABELLE_GHC.\" else ()\n in\n generate_file (Path.binding0 (Path.make [\"code\", \"simulate\", \"Simulation.hs\"]), (Input.string (simulation_file model thy))) ctx' |>\n (fn ctx' => \n let val _ = compile_generated_files \n ctx'\n [([], (Local_Theory.exit_global ctx')), ([Path.binding0 (Path.make [\"code\", \"simulate\", \"Simulate.hs\"])], @{theory})] \n [] [([Path.binding0 (Path.make [\"code\", \"simulate\", \"Simulation\"])], SOME true)]\n (Path.binding0 (Path.make []))\n (Input.string (sim_files_cp ghc (Path.implode tmp)))\n in ctx' end)\n end\n\nfun run_simulation thy =\n \n case ISim_Path.get thy of\n NONE => error \"No animation\" |\n SOME f => \n let val p = Path.append f (Path.make [\"simulate\"])\n in writeln (Active.run_system_shell_command (SOME (Path.implode p)) (\"./Simulation\") \"Start animation\") end\n\nfun simulate model thy =\n let val ctx = Named_Target.theory_init thy\n val ctx' =\n (Code_Target.export_code true [Code.read_const (Local_Theory.exit_global ctx) model] [(((\"Haskell\", \"\"), SOME ({physical = false}, (Path.explode \"simulate\", Position.none))), [])] ctx)\n |> prep_simulation model (Context.theory_name thy)\n in run_simulation (Local_Theory.exit_global ctx'); (Local_Theory.exit_global ctx')\n end \n\nend;\n\\\n\ndefinition show_channel :: \"String.literal \\ 'a::show \\ String.literal\" where\n\"show_channel c p = c + STR '' '' + show p\"\n\nML_file \\Show_Channel.ML\\\n\nML \\\n Outer_Syntax.command @{command_keyword animate} \"animate an ITree\"\n (Parse.name >> (fn model => Toplevel.theory (ITree_Simulator.simulate model)));\n\n\\\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/simulation/ITree_Simulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3960681662740417, "lm_q1q2_score": 0.19958119293562745}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__11_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__11_on_rules imports n_german_lemma_on_inv__11\nbegin\nsection{*All lemmas on causal relation between inv__11*}\nlemma lemma_inv__11_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__11) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__11_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3960681662740417, "lm_q1q2_score": 0.19958119293562745}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__112.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__112 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__112 and some rule r*}\nlemma n_NI_Local_Get_Put_HeadVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__112:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__112:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__112:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__112:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__112:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__112:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__112:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__112:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__112:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutVsinv__112:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_WbVsinv__112:\nassumes a1: \"(r=n_NI_Wb )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__112:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__112 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__112:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__112:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__112:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__112:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__112:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__112:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__112:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__112:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__112:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__112:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__112:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__112:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__112:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__112:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__112:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__112:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__112:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__112:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__112:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__112.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.37022540649291935, "lm_q1q2_score": 0.1995452819719607}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchKHeap_AI\nimports \"../KHeapPre_AI\"\nbegin\n\ncontext Arch begin global_naming ARM\n\nfun\n non_vspace_obj :: \"kernel_object \\ bool\"\nwhere\n \"non_vspace_obj (ArchObj _) = False\"\n| \"non_vspace_obj _ = True\"\n\n\n\nlemma valid_vspace_objs_lift:\n assumes x: \"\\P. \\\\s. P (vs_lookup s)\\ f \\\\_ s. P (vs_lookup s)\\\"\n assumes y: \"\\ako p. \\\\s. \\ ko_at (ArchObj ako) p s\\ f \\\\rv s. \\ ko_at (ArchObj ako) p s\\\"\n assumes z: \"\\p T. \\typ_at (AArch T) p\\ f \\\\rv. typ_at (AArch T) p\\\"\n shows \"\\valid_vspace_objs\\ f \\\\rv. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (rule hoare_vcg_all_lift, wp hoare_convert_imp[OF x]; (rule hoare_vcg_all_lift | assumption))\n apply (rule hoare_convert_imp[OF y])\n apply (rule valid_vspace_obj_typ[OF z])\n done\n\nlemma vspace_obj_imp: \"non_arch_obj ko \\ non_vspace_obj ko\"\n apply (cases ko; clarsimp)\n apply (rename_tac ako)\n apply (case_tac ako, auto simp: non_arch_obj_def)\n done\n\nlemma non_vspace_objs[intro]:\n \"non_vspace_obj (Endpoint ep)\"\n \"non_vspace_obj (CNode sz cnode_contents)\"\n \"non_vspace_obj (TCB tcb)\"\n \"non_vspace_obj (Notification notification)\"\n by (auto)\n\ndefinition vspace_obj_pred :: \"(kernel_object \\ bool) \\ bool\" where\n \"vspace_obj_pred P \\\n \\ko ko'. non_vspace_obj ko \\ non_vspace_obj ko' \\\n P ko = P ko'\"\n\nlemma vspace_obj_predE:\n \"\\vspace_obj_pred P; non_vspace_obj ko; non_vspace_obj ko'\\ \\ P ko = P ko'\"\n apply (unfold vspace_obj_pred_def)\n apply (erule allE[where ?x=\"ko\"])\n apply (erule allE[where ?x=\"ko'\"])\n by blast\n\nlemmas vspace_obj_pred_defs = non_vspace_objs vspace_obj_pred_def\n\nlemma vspace_pred_imp: \"vspace_obj_pred P \\ arch_obj_pred P\"\n apply (clarsimp simp: arch_obj_pred_def)\n apply (rule vspace_obj_predE)\n apply simp\n apply (rule vspace_obj_imp, assumption)+\n done\n\nlemma vspace_obj_pred_a_type[intro, simp]: \"vspace_obj_pred (\\ko. a_type ko = AArch T)\"\n by (auto simp add: vspace_obj_pred_defs a_type_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemma\n vspace_obj_pred_arch_obj_l[intro, simp]:\n \"vspace_obj_pred (\\ko. ArchObj ako = ko)\" and\n vspace_obj_pred_arch_obj_r[intro, simp]:\n \"vspace_obj_pred (\\ko. ko = ArchObj ako)\"\n apply (simp add: vspace_obj_pred_defs)\n apply (rule allI[OF impI[OF allI[OF impI]]])\n apply (auto simp add: vspace_obj_pred_defs\n split: kernel_object.splits arch_kernel_obj.splits)\ndone\n\nlemma vspace_obj_pred_fun_lift: \"vspace_obj_pred (\\ko. F (vspace_obj_fun_lift P N ko))\"\n by (auto simp: vspace_obj_pred_defs vspace_obj_fun_lift_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemmas vspace_obj_pred_fun_lift_id[simp]\n = vspace_obj_pred_fun_lift[where F=id, simplified]\n\nlemmas vspace_obj_pred_fun_lift_k[intro]\n = vspace_obj_pred_fun_lift[where F=\"K R\" for R, simplified]\n\nlemmas vspace_obj_pred_fun_lift_el[simp]\n = vspace_obj_pred_fun_lift[where F=\"\\ S. x \\ S\" for x, simplified]\n\nlemma vspace_obj_pred_const_conjI[intro]:\n \"vspace_obj_pred P \\\n vspace_obj_pred P' \\\n vspace_obj_pred (\\ko. P ko \\ P' ko)\"\n apply (simp only: vspace_obj_pred_def)\n apply blast\n done\n\nlemma vspace_obj_pred_fI:\n \"(\\x. vspace_obj_pred (P x)) \\ vspace_obj_pred (\\ko. f (\\x :: 'a :: type. P x ko))\"\n apply (simp only: vspace_obj_pred_def)\n apply (intro allI impI)\n apply (rule arg_cong[where f=f])\n by blast\n\ndeclare\n vspace_obj_pred_fI[where f=All, intro]\n vspace_obj_pred_fI[where f=Ex, intro]\n\nend\n\nlocale vspace_only_obj_pred = Arch +\n fixes P :: \"kernel_object \\ bool\"\n assumes vspace_only: \"vspace_obj_pred P\"\n\nsublocale vspace_only_obj_pred < arch_only_obj_pred\n using vspace_pred_imp[OF vspace_only] by unfold_locales\n\ncontext Arch begin global_naming ARM\n\nsublocale empty_table: vspace_only_obj_pred \"empty_table S\" for S\n by unfold_locales (clarsimp simp: vspace_obj_pred_def empty_table_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs: vspace_only_obj_pred \"\\ko. x \\ vs_refs ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs_pages: vspace_only_obj_pred \"\\ko. x \\ vs_refs_pages ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_pages_def\n split: arch_kernel_obj.split kernel_object.splits)\n\nlemma pspace_in_kernel_window_atyp_lift_strong:\n assumes atyp_inv: \"\\P p T. \\ \\s. P (typ_at T p s) \\ f \\ \\rv s. P (typ_at T p s) \\\"\n assumes arch_inv: \"\\P. \\\\s. P (arm_kernel_vspace (arch_state s))\\ f \\\\r s. P (arm_kernel_vspace (arch_state s))\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n apply (simp add: pspace_in_kernel_window_def)\n apply (rule hoare_lift_Pf[where f=\"\\s. arm_kernel_vspace (arch_state s)\", OF _ arch_inv])\n apply (rule hoare_vcg_all_lift)\n apply (simp add: obj_bits_T)\n apply (simp add: valid_def)\n apply clarsimp\n subgoal for _ x s _ _ ko\n apply (cases \"kheap s x\")\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. \\ x\" and T1=\"a_type ko\" and p1=x];\n simp add: obj_at_def a_type_def)\n\n subgoal for ko'\n apply (drule spec[of _ ko'])\n apply (simp add: obj_bits_T)\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. x\" and T1=\"a_type ko'\" and p1=x])\n by (simp add: obj_at_def a_type_def)+\n done\n done\n\nlemma pspace_in_kernel_window_atyp_lift:\n assumes atyp_inv: \"\\P p T. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n assumes arch_inv: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n by (rule pspace_in_kernel_window_atyp_lift_strong[OF atyp_inv arch_inv])\n\nlemma cap_refs_in_kernel_window_arch_update[simp]:\n \"arm_kernel_vspace (f (arch_state s)) = arm_kernel_vspace (arch_state s)\n \\ cap_refs_in_kernel_window (arch_state_update f s) = cap_refs_in_kernel_window s\"\n by (simp add: cap_refs_in_kernel_window_def)\n\nlemma\n ex_ko_at_def2:\n \"(\\ko. ko_at ko p s \\ P ko) = (obj_at P p s)\"\n by (simp add: obj_at_def)\n\nlemma in_user_frame_obj_pred_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n shows \"\\in_user_frame p\\ f \\\\_. in_user_frame p\\\"\n unfolding in_user_frame_def\n apply (wp hoare_vcg_ex_lift obj_at)\n apply (clarsimp simp: vspace_obj_pred_def)\n apply (auto simp: a_type_def aa_type_def split: kernel_object.splits arch_kernel_obj.splits)\n done\n\nlemma vs_lookup_arch_obj_at_lift:\n assumes obj_at: \"\\P P' p. arch_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup s)\\ f \\\\rv s. P (vs_lookup s)\\\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs.arch_only\n intro!: arch_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup s)\\ f \\\\rv s. P (vs_lookup s)\\\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_pages_arch_obj_at_lift:\n assumes obj_at: \"\\P P' p. arch_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup_pages s)\\ f \\\\rv s. P (vs_lookup_pages s)\\\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs_pages.arch_only\n intro!: arch_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_pages_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup_pages s)\\ f \\\\rv s. P (vs_lookup_pages s)\\\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs_pages.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma valid_vspace_objs_lift_weak:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\valid_vspace_objs\\ f \\\\_. valid_vspace_objs\\\"\n apply (rule valid_vspace_objs_lift)\n apply (rule vs_lookup_vspace_obj_at_lift)\n apply (rule obj_at arch_state vspace_pred_imp; simp)+\n done\n\nlemma set_object_neg_lookup:\n \"\\\\s. \\ (\\rs. (rs \\ p') s) \\ obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p s \\\n set_object p ko\n \\\\_ s. \\ (\\rs. (rs \\ p') s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule_tac x=rs in allE)\n apply (erule notE)\n apply (erule vs_lookup_stateI)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_vs_lookup:\n \"\\\\s. obj_at (\\ko'. vs_refs ko = vs_refs ko') p s \\ P (vs_lookup s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_pt_not_vs_lookup_pages:\n \"\\\\s. \\(ref \\ p') s\n \\ ((\\\\p) s \\ (\\x. case pte_ref_pages (pt x) of\n Some ptr \\\n obj_at (\\ko. vs_refs_pages ko = {}) ptr s \\\n ptr \\ p'\n | None \\ True))\\\n set_object p (ArchObj (PageTable pt))\n \\\\_ s. \\(ref \\ p') s\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (case_tac \"(\\\\p) s\")\n apply (erule notE)\n apply clarsimp\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (erule vs_lookup_pagesI)\n apply (erule converse_rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (erule_tac x=ab in allE)\n apply (drule_tac R=\"vs_lookup_pages1 s\" in rtranclD)\n apply clarsimp\n apply (drule tranclD)\n apply clarsimp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def vs_refs_pages_def)\n apply clarsimp\n apply (erule rtrancl_trans[OF r_into_rtrancl, rotated])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply clarsimp\n apply (erule notE)\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (rule vs_lookup_pagesI, assumption)\n apply (erule rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (erule_tac x=rs in allE)\n apply (clarsimp simp: vs_lookup_pages_def)\n apply (drule(1) ImageI, erule (1) notE)\n apply clarsimp\n apply (erule rtrancl_trans[OF _ r_into_rtrancl])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n done\n\n\nlemma set_object_vs_lookup_pages:\n \"\\\\s. obj_at (\\ko'. vs_refs_pages ko = vs_refs_pages ko') p s \\ P (vs_lookup_pages s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup_pages s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_typ_at:\n \"\\\\s. P (typ_at T p' s)\\\n set_object p obj\n \\\\rv s. P (typ_at T p' s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma set_object_vspace_objs:\n \"\\valid_vspace_objs and typ_at (a_type ko) p and\n obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p and\n (\\s. case ko of ArchObj ao \\\n (\\\\p)s \\ valid_vspace_obj ao s\n | _ \\ True)\\\n set_object p ko\n \\\\_. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift)\n apply (subst imp_conv_disj)\n apply (subst imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift set_object_neg_lookup set_object_neg_ko)\n apply (wp valid_vspace_obj_typ2 [where Q=\"typ_at (a_type ko) p\"] set_object_typ_at\n | simp)+\n apply (clarsimp simp: pred_neg_def obj_at_def)\n apply (case_tac ko; auto)\n done\n\nlemma set_object_valid_kernel_mappings:\n \"\\\\s. valid_kernel_mappings s\n \\ valid_kernel_mappings_if_pd\n (set (arm_global_pts (arch_state s)))\n ko\\\n set_object ptr ko\n \\\\rv. valid_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: valid_kernel_mappings_def\n elim!: ranE split: if_split_asm)\n apply fastforce\n done\n\nlemma valid_vs_lookup_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n shows \"\\valid_vs_lookup\\ f \\\\_. valid_vs_lookup\\\"\n unfolding valid_vs_lookup_def\n apply (rule hoare_lift_Pf [where f=vs_lookup_pages])\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (wp lookup cap)+\n done\n\n\nlemma valid_table_caps_lift:\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes pts: \"\\P. \\\\s. P (second_level_tables (arch_state s))\\ f \\\\_ s. P (second_level_tables (arch_state s))\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_table_caps\\ f \\\\_. valid_table_caps\\\"\n unfolding valid_table_caps_def\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (rule hoare_lift_Pf [where f=\"\\s. second_level_tables (arch_state s)\"])\n apply (wp cap pts hoare_vcg_all_lift hoare_vcg_const_imp_lift obj)+\n done\n\nlemma valid_arch_caps_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes pts: \"\\P. \\\\s. P (second_level_tables (arch_state s))\\ f \\\\_ s. P (second_level_tables (arch_state s))\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n unfolding valid_arch_caps_def\n apply (rule hoare_pre)\n apply (wp valid_vs_lookup_lift valid_table_caps_lift lookup cap pts obj)\n apply simp\n done\n\nlemma valid_global_objs_lift':\n assumes pts: \"\\P. \\\\s. P (arm_global_pts (arch_state s))\\ f \\\\_ s. P (arm_global_pts (arch_state s))\\\"\n assumes pd: \"\\P. \\\\s. P (arm_global_pd (arch_state s))\\ f \\\\_ s. P (arm_global_pd (arch_state s))\\\"\n assumes obj: \"\\p. \\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n assumes ko: \"\\ako p. \\ko_at (ArchObj ako) p\\ f \\\\_. ko_at (ArchObj ako) p\\\"\n assumes emp: \"\\pd S.\n \\\\s. (v \\ pd = arm_global_pd (arch_state s) \\ S = set (second_level_tables (arch_state s)) \\ P s)\n \\ obj_at (empty_table S) pd s\\\n f \\\\rv. obj_at (empty_table S) pd\\\"\n shows \"\\\\s. valid_global_objs s \\ (v \\ P s)\\ f \\\\rv. valid_global_objs\\\"\n unfolding valid_global_objs_def second_level_tables_def\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=\"\\s. arm_global_pts (arch_state s)\", OF pts])\n apply (rule hoare_use_eq [where f=\"\\s. arm_global_pd (arch_state s)\", OF pd])\n apply (wp obj ko emp hoare_vcg_const_Ball_lift hoare_ex_wp)\n apply (clarsimp simp: second_level_tables_def)\n done\n\nlemmas valid_global_objs_lift\n = valid_global_objs_lift' [where v=False, simplified]\n\ncontext\n fixes f :: \"'a::state_ext state \\ ('b \\ 'a state) set \\ bool\"\n assumes arch: \"\\P. \\\\s. P (arch_state s)\\ f \\\\_ s. P (arch_state s)\\\"\nbegin\n\ncontext\n assumes aobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n notes vspace_obj_fun_lift_expand[simp del]\nbegin\n\nlemma valid_global_vspace_mappings_lift:\n \"\\valid_global_vspace_mappings\\ f \\\\rv. valid_global_vspace_mappings\\\"\n apply (simp add: valid_global_vspace_mappings_def valid_pd_kernel_mappings_def\n del: valid_pd_kernel_mappings_arch_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (rule_tac f=\"valid_pd_kernel_mappings_arch (arm_kernel_vspace x)\" in hoare_lift_Pf)\n apply (rule aobj_at; simp)\n apply (subst valid_pd_kernel_mappings_arch_def valid_pde_kernel_mappings_def)+\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)\n apply (clarsimp intro!: iff_allI split: arch_kernel_obj.splits pde.splits)\n apply (safe; clarsimp simp add: valid_pt_kernel_mappings_def\n simp del: valid_pt_kernel_mappings_arch_def)\n apply (erule use_valid[OF _ aobj_at[where P=\"\\x. x\"]]; simp add:)+\n by (rule classical,\n drule use_valid[OF _ aobj_at[where P=\"\\x. \\x\", OF vspace_obj_pred_fun_lift_id]],\n simp+)+\n\nlemma valid_arch_caps_lift_weak:\n \"(\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\) \\\n \\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n apply (rule valid_arch_caps_lift[OF _ _ arch aobj_at])\n apply (rule vs_lookup_pages_vspace_obj_at_lift[OF aobj_at arch], assumption+)\n apply (rule empty_table.vspace_only)\n done\n\nlemma valid_global_objs_lift_weak:\n \"\\valid_global_objs\\ f \\\\rv. valid_global_objs\\\"\n apply (rule valid_global_objs_lift)\n apply (wp arch)+\n apply (simp add: valid_vso_at_def)\n apply (rule hoare_vcg_ex_lift)\n apply (rule hoare_vcg_conj_lift)\n apply (wp aobj_at valid_vspace_obj_typ | simp | rule empty_table.vspace_only)+\n done\n\nlemma valid_asid_map_lift:\n \"\\valid_asid_map\\ f \\\\rv. valid_asid_map\\\"\n apply (simp add: valid_asid_map_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (simp add: vspace_at_asid_def)\n by (rule vs_lookup_vspace_obj_at_lift[OF aobj_at arch])\n\nlemma valid_kernel_mappings_lift:\n \"\\valid_kernel_mappings\\ f \\\\rv. valid_kernel_mappings\\\"\n apply (simp add: valid_kernel_mappings_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (simp add: valid_kernel_mappings_if_pd_def ran_def\n del: valid_kernel_mappings_if_pd_arch_def)\n apply (rule hoare_vcg_all_lift)\n apply (case_tac \"\\ao. xa = ArchObj ao\")\n apply (rule hoare_convert_imp)\n apply clarsimp\n apply (rule hoare_vcg_all_lift)\n subgoal for ao a\n by (rule aobj_at[where P=Not and P'=\"\\x. x = ArchObj ao\", simplified obj_at_def, simplified])\n apply clarsimp\n apply (case_tac ao; simp add: hoare_vcg_prop)\n apply (clarsimp simp del: valid_kernel_mappings_if_pd_arch_def)\n apply (case_tac xa; simp add: hoare_vcg_prop)\n done\n\nend\n\ncontext\n assumes aobj_at:\n \"\\P P' pd. arch_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\nbegin\n\nlemma valid_global_pts_lift:\n \"\\valid_global_pts\\ f \\\\rv. valid_global_pts\\\"\n apply (simp add: valid_global_pts_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (rule hoare_vcg_ball_lift)\n apply (rule aobj_at)\n apply clarsimp\n done\n\nlemma valid_arch_state_lift_aobj_at:\n \"\\valid_arch_state\\ f \\\\rv. valid_arch_state\\\"\n apply (simp add: valid_arch_state_def valid_asid_table_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (wp hoare_vcg_conj_lift hoare_vcg_ball_lift valid_global_pts_lift | (rule aobj_at, clarsimp))+\n apply simp\n done\n\nend\nend\n\nlemma equal_kernel_mappings_lift:\n assumes aobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n shows \"\\equal_kernel_mappings\\ f \\\\rv. equal_kernel_mappings\\\"\n apply (simp add: equal_kernel_mappings_def)\n apply (rule hoare_vcg_all_lift)+\n apply (rule hoare_convert_imp)\n apply simp\n apply (rule hoare_convert_imp)\n apply (wp aobj_at[OF vspace_obj_pred_arch_obj_l])+\n done\n\nlemma valid_machine_state_lift:\n assumes memory: \"\\P. \\\\s. P (underlying_memory (machine_state s))\\ f \\\\_ s. P (underlying_memory (machine_state s))\\\"\n assumes aobj_at: \"\\P' pd. arch_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_machine_state\\ f \\\\_. valid_machine_state\\\"\n unfolding valid_machine_state_def\n apply (rule hoare_lift_Pf[where f=\"\\s. underlying_memory (machine_state s)\", OF _ memory])\n apply (rule hoare_vcg_all_lift)\n apply (rule hoare_vcg_disj_lift[OF _ hoare_vcg_prop])\n apply (rule in_user_frame_lift)\n apply (wp aobj_at; simp)\n done\n\nlemma valid_ao_at_lift:\n assumes z: \"\\P p T. \\\\s. P (typ_at (AArch T) p s)\\ f \\\\rv s. P (typ_at (AArch T) p s)\\\"\n and y: \"\\ao. \\\\s. ko_at (ArchObj ao) p s\\ f \\\\rv s. ko_at (ArchObj ao) p s\\\"\n shows \"\\valid_ao_at p\\ f \\\\rv. valid_ao_at p\\\"\n unfolding valid_ao_at_def\n by (wp hoare_vcg_ex_lift y valid_vspace_obj_typ z)\n\nlemma valid_ao_at_lift_aobj_at:\n assumes aobj_at: \"\\P' pd. arch_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_ao_at p\\ f \\\\rv. valid_ao_at p\\\"\n unfolding valid_ao_at_def\n by (wp hoare_vcg_ex_lift valid_vspace_obj_typ aobj_at | clarsimp)+\n\nlemma valid_vso_at_lift:\n assumes z: \"\\P p T. \\\\s. P (typ_at (AArch T) p s)\\ f \\\\rv s. P (typ_at (AArch T) p s)\\\"\n and y: \"\\ao. \\\\s. ko_at (ArchObj ao) p s\\ f \\\\rv s. ko_at (ArchObj ao) p s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n by (wpsimp wp: hoare_vcg_ex_lift y valid_vspace_obj_typ z)+\n\nlemma valid_vso_at_lift_aobj_at:\n assumes aobj_at: \"\\P' pd. vspace_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n apply (rule hoare_vcg_ex_lift)\n apply (rule hoare_vcg_conj_lift aobj_at)+\n apply (clarsimp simp: vspace_obj_pred_def)\n apply (rule iffI)\n apply ((case_tac ao; clarsimp)+)[2]\n apply (wpsimp wp: valid_vspace_obj_typ)\n apply (wpsimp wp: aobj_at)\n apply assumption\n done\n\nlemmas set_object_v_ker_map\n = set_object_valid_kernel_mappings\n [unfolded valid_kernel_mappings_if_pd_def]\n\nlemma set_object_asid_map:\n \"\\valid_asid_map and\n obj_at (\\ko'. vs_refs ko' \\ vs_refs ko) p\\\n set_object p ko\n \\\\_. valid_asid_map\\\"\n apply (simp add: valid_asid_map_def set_object_def get_object_def)\n apply wp\n apply (clarsimp simp: vspace_at_asid_def simp del: fun_upd_apply)\n apply (drule bspec, blast)\n apply clarsimp\n apply (rule vs_lookup_stateI, assumption)\n apply (clarsimp simp: obj_at_def)\n apply blast\n apply simp\n done\n\nlemma set_object_equal_mappings:\n \"\\\\s. equal_kernel_mappings s\n \\ (\\pd. ko = ArchObj (PageDirectory pd)\n \\ (\\x pd'. ko_at (ArchObj (PageDirectory pd')) x s\n \\ (\\w \\ kernel_mapping_slots. pd w = pd' w)))\\\n set_object p ko\n \\\\rv. equal_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def\n split del: if_split)\n apply (simp split: if_split_asm)\n done\n\nlemma valid_global_vspace_mappings_pres:\n \"\\ valid_global_vspace_mappings s;\n \\pd. ko_at (ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s\n \\ ko_at (ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s';\n \\pt p. \\ ko_at (ArchObj (PageTable pt)) p s;\n valid_global_objs s \\ p \\ set (arm_global_pts (arch_state s)) \\\n \\ ko_at (ArchObj (PageTable pt)) p s';\n arm_global_pd (arch_state s') = arm_global_pd (arch_state s);\n arm_kernel_vspace (arch_state s') = arm_kernel_vspace (arch_state s) \\\n \\ valid_global_vspace_mappings s'\"\n apply atomize\n apply (clarsimp simp: valid_global_vspace_mappings_def obj_at_def)\n apply (clarsimp simp: valid_pd_kernel_mappings_def\n split: kernel_object.split_asm arch_kernel_obj.split_asm)\n apply (drule_tac x=x in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def obj_at_def\n valid_pt_kernel_mappings_def pde_ref_def\n split: pde.split_asm)\n apply (simp split: kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply (drule spec, drule spec, drule(1) mp)\n apply (drule mp)\n apply (clarsimp simp: valid_global_objs_def obj_at_def empty_table_def)\n apply (drule_tac x=x in spec)\n apply (simp add: pde_ref_def second_level_tables_def)[1]\n apply clarsimp\n done\n\nlemma valid_global_vspace_mappings_arch_update[simp]:\n \"arm_global_pd (f (arch_state s)) = arm_global_pd (arch_state s)\n \\ arm_kernel_vspace (f (arch_state s)) = arm_kernel_vspace (arch_state s)\n \\ valid_global_vspace_mappings (arch_state_update f s) = valid_global_vspace_mappings s\"\n by (simp add: valid_global_vspace_mappings_def)\n\nlemma set_object_global_vspace_mappings:\n \"\\valid_global_vspace_mappings\n and (\\s. (page_directory_at p s \\ page_table_at p s)\n \\ valid_global_objs s \\ p \\ global_refs s)\\\n set_object p ko\n \\\\rv. valid_global_vspace_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule valid_global_vspace_mappings_pres)\n apply (clarsimp simp: obj_at_def a_type_def global_refs_def second_level_tables_def)+\n done\n\n\nlemma valid_table_caps_ptD:\n \"\\ (caps_of_state s) p = Some (ArchObjectCap (arch_cap.PageTableCap p' None));\n page_table_at p' s; valid_table_caps s \\ \\\n \\pt. ko_at (ArchObj (PageTable pt)) p' s \\ valid_vspace_obj (PageTable pt) s\"\n apply (clarsimp simp: valid_table_caps_def simp del: split_paired_All)\n apply (erule allE)+\n apply (erule (1) impE)\n apply (clarsimp simp add: is_pt_cap_def cap_asid_def)\n apply (erule impE, rule refl)\n apply (clarsimp simp: obj_at_def empty_table_def)\n done\n\nlemma store_pde_pred_tcb_at:\n \"\\pred_tcb_at proj P t\\ store_pde ptr val \\\\rv. pred_tcb_at proj P t\\\"\n apply (simp add: store_pde_def set_pd_def get_pd_def)\n apply (wpsimp wp: set_object_wp get_object_wp simp: a_type_def)\n apply (clarsimp simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma empty_table_lift:\n assumes S: \"\\P. \\\\s. P (S s)\\ f \\\\_ s. P (S s)\\\"\n assumes o: \"\\P. \\obj_at P p and Q\\ f \\\\_. obj_at P p\\\"\n shows \"\\\\s. obj_at (empty_table (S s)) p s \\ Q s\\\n f \\\\_ s. obj_at (empty_table (S s)) p s\\\"\n apply (rule hoare_lift_Pf2 [where f=\"S\"])\n apply (wp o S|simp)+\n done\n\nlemma in_user_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_user_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_user_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma user_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (user_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (user_mem s)\"\n by (clarsimp simp: user_mem_def in_user_frame_obj_upd dom_def)\n\nlemma in_device_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_device_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_device_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma device_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (device_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (device_mem s)\"\n by (clarsimp simp: device_mem_def in_device_frame_obj_upd dom_def)\n\nlemma pspace_respects_region_cong[cong]:\n \"\\kheap a = kheap b; device_state (machine_state a) = device_state (machine_state b)\\\n \\ pspace_respects_device_region a = pspace_respects_device_region b\"\n by (simp add: pspace_respects_device_region_def device_mem_def user_mem_def in_device_frame_def\n in_user_frame_def obj_at_def dom_def)\n\ndefinition \"obj_is_device tp dev \\\n case tp of Untyped \\ dev\n | _ \\(case (default_object tp dev 0) of (ArchObj (DataPage dev _)) \\ dev\n | _ \\ False)\"\n\nlemma cap_is_device_obj_is_device[simp]:\n \"cap_is_device (default_cap tp a sz dev) = obj_is_device tp dev\"\n by (simp add: default_cap_def arch_default_cap_def obj_is_device_def\n default_object_def default_arch_object_def\n split: apiobject_type.splits aobject_type.splits)\n\ncrunch device_state_inv: storeWord \"\\ms. P (device_state ms)\"\n (ignore_del: storeWord)\n\n(* some hyp_ref invariants *)\n\nlemma state_hyp_refs_of_ep_update: \"\\s ep val. typ_at AEndpoint ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Endpoint val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def ARM.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_ntfn_update: \"\\s ep val. typ_at ANTFN ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Notification val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def ARM.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_tcb_bound_ntfn_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_bound_notification := ntfn\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma state_hyp_refs_of_tcb_state_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_state := ts\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma arch_valid_obj_same_type:\n \"\\ arch_valid_obj ao s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ arch_valid_obj ao (s\\kheap := kheap s(p \\ k)\\)\"\n by (induction ao rule: arch_kernel_obj.induct;\n clarsimp simp: typ_at_same_type)\n\n\nlemma default_arch_object_not_live: \"\\ live (ArchObj (default_arch_object aty dev us))\"\n by (clarsimp simp: default_arch_object_def live_def hyp_live_def arch_live_def\n split: aobject_type.splits)\n\nlemma default_tcb_not_live: \"\\ live (TCB default_tcb)\"\n by (clarsimp simp: default_tcb_def default_arch_tcb_def live_def hyp_live_def)\n\nlemma valid_arch_tcb_same_type:\n \"\\ valid_arch_tcb t s; valid_obj p k s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ valid_arch_tcb t (s\\kheap := kheap s(p \\ k)\\)\"\n by (auto simp: valid_arch_tcb_def obj_at_def)\n\nlemma valid_ioports_lift:\n assumes x: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\rv s. P (caps_of_state s)\\\"\n assumes y: \"\\P. \\\\s. P (arch_state s)\\ f \\\\rv s. P (arch_state s)\\\"\n shows \"\\valid_ioports\\ f \\\\rv. valid_ioports\\\"\n apply (simp add: valid_ioports_def)\n apply (rule hoare_use_eq [where f=caps_of_state, OF x y])\n done\n\nlemma valid_arch_mdb_lift:\n assumes c: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\r s. P (caps_of_state s)\\\"\n assumes r: \"\\P. \\\\s. P (is_original_cap s)\\ f \\\\r s. P (is_original_cap s)\\\"\n shows \"\\\\s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\ f \\\\r s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\\"\n apply (clarsimp simp: valid_arch_mdb_def valid_def)\n done\n\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM/ArchKHeap_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.37022537869825406, "lm_q1q2_score": 0.1995452669911025}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__48_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__48_on_rules imports n_germanSimp_lemma_on_inv__48\nbegin\nsection{*All lemmas on causal relation between inv__48*}\nlemma lemma_inv__48_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__48 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__48) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__48_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3812195592260441, "lm_q1q2_score": 0.19953807471144766}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__59.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__59 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__59 and some rule r*}\nlemma n_RecvInvAckVsinv__59:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__59:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__59:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__59:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvAckVsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvAck i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__59:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__59.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5234203340678568, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.19953807272299748}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__109.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__109 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__109 and some rule r*}\nlemma n_PI_Remote_GetVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__109:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__109:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__109:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__109:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__109:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__109:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__109:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__109:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__109:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__109 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__109:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__109:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__109:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__109:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__109:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__109:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__109:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__109:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__109:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__109:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__109:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__109:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__109:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__109:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__109:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__109:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__109:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__109:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__109:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__109:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__109:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__109:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__109:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__109.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.3522017956470284, "lm_q1q2_score": 0.1993527444655677}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory TypHeap\nimports\n Vanilla32\n ArraysMemInstance\n HeapRawState\n MapExtraTrans\nbegin\n\n(* FIXME: move to word *)\nlemma minus_one_word:\n \"(-1 :: 'a :: len word) = 2 ^ len_of TYPE('a) - 1\"\n by (simp add: word_pow_0)\n\ndeclare map_add_assoc [simp del]\n\ndefinition wf_heap_val :: \"heap_state \\ bool\" where\n \"wf_heap_val s \\ \\x t n v. s (x,SIndexVal) \\ Some (STyp t) \\\n s (x,SIndexTyp n) \\ Some (SValue v)\"\n\ntype_synonym typ_slice_list = \"(typ_uinfo \\ typ_base) list\"\n\nprimrec\n typ_slice_t :: \"typ_uinfo \\ nat \\ typ_slice_list\" and\n typ_slice_struct :: \"typ_uinfo_struct \\ nat \\ typ_slice_list\" and\n typ_slice_list :: \"(typ_uinfo,field_name) dt_pair list \\ nat \\ typ_slice_list\" and\n typ_slice_pair :: \"(typ_uinfo,field_name) dt_pair \\ nat \\ typ_slice_list\"\nwhere\n tl0: \"typ_slice_t (TypDesc st nm) m = typ_slice_struct st m @\n [(if m = 0 then ((TypDesc st nm),True) else\n ((TypDesc st nm),False))]\"\n\n| tl1: \"typ_slice_struct (TypScalar n algn d) m = []\"\n| tl2: \"typ_slice_struct (TypAggregate xs) m = typ_slice_list xs m\"\n\n| tl3: \"typ_slice_list [] m = []\"\n| tl4: \"typ_slice_list (x#xs) m = (if m < size_td (dt_fst x) \\ xs = [] then\n typ_slice_pair x m else typ_slice_list xs (m - size_td (dt_fst x)))\"\n\n| tl5: \"typ_slice_pair (DTPair t n) m = typ_slice_t t m\"\n\ndefinition list_map :: \"'a list \\ (nat \\ 'a)\" where\n \"list_map xs \\ map_of (zip [0.. typ_uinfo \\ (addr \\ s_heap_index) set\"\nwhere\n \"s_footprint_untyped p t \\ {(p + of_nat x,k) | x k. x < size_td t \\\n (k=SIndexVal \\\n (\\n. k=SIndexTyp n \\ n < length (typ_slice_t t x)))}\"\n\ndefinition\n s_footprint :: \"'a::c_type ptr \\ (addr \\ s_heap_index) set\"\nwhere\n \"s_footprint p \\ s_footprint_untyped (ptr_val p) (typ_uinfo_t TYPE('a))\"\n\ndefinition empty_htd :: \"heap_typ_desc\" where\n \"empty_htd \\ \\x. (False,empty)\"\n\ndefinition dom_s :: \"heap_typ_desc \\ s_addr set\" where\n \"dom_s d \\ {(x,SIndexVal) | x. fst (d x)} \\\n {(x,SIndexTyp n) | x n. snd (d x) n \\ None}\"\n\ndefinition\n restrict_s :: \"heap_typ_desc \\ s_addr set \\ heap_typ_desc\"\nwhere\n \"restrict_s d X \\ \\x. ((x,SIndexVal) \\ X \\ fst (d x),\n (\\y. if (x,SIndexTyp y) \\ X then snd (d x) y else None))\"\n\n(* FIXME: can get rid of n now, since n = size_td t *)\ndefinition\n valid_footprint :: \"heap_typ_desc \\ addr \\ typ_uinfo \\ bool\"\nwhere\n \"valid_footprint d x t \\ let n = size_td t in 0 < n \\ (\\y. y < n \\\n list_map (typ_slice_t t y) \\\\<^sub>m snd (d (x + of_nat y)) \\\n fst (d (x + of_nat y)))\"\n\ntype_synonym 'a ptr_guard = \"'a ptr \\ bool\"\n\ndefinition\n h_t_valid :: \"heap_typ_desc \\ 'a ptr_guard \\ 'a::c_type ptr \\ bool\"\n (\"_,_ \\\\<^sub>t _\" [99,0,99] 100)\nwhere\n \"d,g \\\\<^sub>t p \\ valid_footprint d (ptr_val (p::'a ptr)) (typ_uinfo_t TYPE('a))\n \\ g p\"\n\n\ntype_synonym 'a typ_heap = \"'a ptr \\ 'a\"\n\ndefinition proj_h :: \"heap_state \\ heap_mem\" where\n \"proj_h s \\ \\x. case_option undefined (case_s_heap_value id undefined)\n (s (x,SIndexVal))\"\n\ndefinition lift_state :: \"heap_raw_state \\ heap_state\" where\n \"lift_state \\ \\(h,d) (x,y). case y of\n SIndexVal \\ if fst (d x)then Some (SValue (h x)) else None |\n SIndexTyp n \\ case_option None (Some \\ STyp) (snd (d x) n)\"\n\n\ndefinition fun2list :: \"(nat \\ 'a) \\ nat \\ 'a list\" where\n \"fun2list f n \\ if n=0 then [] else map f [0.. addr \\ nat \\ bool\" where\n \"null_d s x y \\ s (x,SIndexTyp y) = None\"\n\ndefinition max_d :: \"heap_state \\ addr \\ nat\" where\n \"max_d s x \\ 1 + (GREATEST y. \\ null_d s x y)\"\n\ndefinition proj_d :: \"heap_state \\ heap_typ_desc\" where\n \"proj_d s \\ \\x. (s (x,SIndexVal) \\ None,\n \\n. case_option None (Some \\ s_heap_tag) (s (x,SIndexTyp n)))\"\n\n(* XXX: precedences, s_valid can be fairly high,\n maybe lower than pointer plus, inner precedences can be low *)\n(* XXX: the comma separation should mean we don't actually need 100 *)\ndefinition\n s_valid :: \"heap_state \\ 'a ptr_guard \\ 'a::c_type ptr \\ bool\" (\"_,_ \\\\<^sub>s _\" [100,0,100] 100)\nwhere\n \"s,g \\\\<^sub>s p \\ proj_d s,g \\\\<^sub>t p\"\n\ndefinition\n heap_list_s :: \"heap_state \\ nat \\ addr \\ byte list\"\nwhere\n \"heap_list_s s n p \\ heap_list (proj_h s) n p\"\n\ndefinition\n lift_typ_heap :: \"'a ptr_guard \\ heap_state \\ 'a::c_type typ_heap\"\nwhere\n \"lift_typ_heap g s \\ (Some \\ from_bytes \\ (heap_list_s s (size_of TYPE('a)))\n \\ ptr_val) |` {p. s,g \\\\<^sub>s p}\"\n\ndefinition\n heap_update_s :: \"'a ptr \\ 'a::c_type \\ heap_state \\ heap_state\"\nwhere\n \"heap_update_s n p s \\ lift_state (heap_update n p (proj_h s), proj_d s)\"\n\ndefinition\n lift_t :: \"'a::c_type ptr_guard \\ heap_raw_state \\ 'a typ_heap\"\nwhere\n \"lift_t g \\ lift_typ_heap g \\ lift_state\"\n\ndefinition\n tag_disj :: \"'a typ_desc \\ 'a typ_desc \\ bool\" (\"_ \\\\<^sub>t _\" [90,90] 90)\nwhere\n \"f \\\\<^sub>t g \\ \\ (f \\ g \\ g \\ f)\"\n\ndefinition\n ladder_set :: \"typ_uinfo \\ nat \\ nat \\ (typ_uinfo \\ nat) set\"\nwhere\n \"ladder_set s n p \\ {(t,n+p) | t. \\k. (t,k) \\ set (typ_slice_t s n)}\"\n\n\n(* case where 'b is a field type of 'a *)\n\nprimrec\n field_names :: \"'a typ_info \\ typ_uinfo \\\n (qualified_field_name) list\" and\n field_names_struct :: \"'a field_desc typ_struct \\ typ_uinfo \\\n (qualified_field_name) list\" and\n field_names_list :: \"('a typ_info,field_name) dt_pair list \\ typ_uinfo \\\n (qualified_field_name) list\" and\n field_names_pair :: \"('a typ_info,field_name) dt_pair \\ typ_uinfo \\\n (qualified_field_name) list\"\nwhere\n tfs0: \"field_names (TypDesc st nm) t = (if t=export_uinfo (TypDesc st nm) then\n [[]] else field_names_struct st t)\"\n\n| tfs1: \"field_names_struct (TypScalar m algn d) t = []\"\n| tfs2: \"field_names_struct (TypAggregate xs) t = field_names_list xs t\"\n\n| tfs3: \"field_names_list [] t = []\"\n| tfs4: \"field_names_list (x#xs) t = field_names_pair x t@field_names_list xs t\"\n\n| tfs5: \"field_names_pair (DTPair s f) t = map (\\fs. f#fs) (field_names s t)\"\n\n\ndefinition\n fin :: \"typ_uinfo \\ typ_name \\ (('a typ_info \\ qualified_field_name list) \\ field_name) list \\\n ('a typ_info \\ qualified_field_name list)\"\nwhere\n \"fin r \\ \\tn ts. let t = TypDesc (TypAggregate (map (\\((t,fs),f). DTPair t f) ts)) tn in\n (t,if r = export_uinfo t then [[]] else concat (map (\\((t,fs),f). map (op # f) fs) ts))\"\n\ndefinition\n field_typ_untyped :: \"'a typ_desc \\ qualified_field_name \\ 'a typ_desc\"\nwhere\n \"field_typ_untyped t n \\ (fst (the (field_lookup t n 0)))\"\n\ndefinition\n field_typ :: \"'a::c_type itself \\ qualified_field_name \\ 'a typ_info\"\nwhere\n \"field_typ t n \\ field_typ_untyped (typ_info_t TYPE('a)) n\"\n\ndefinition\n fs_consistent :: \"qualified_field_name list \\ 'a::c_type itself \\ 'b::c_type itself \\ bool\"\nwhere\n \"fs_consistent fs a b \\ set fs \\ set (field_names (typ_info_t TYPE('a)) (typ_uinfo_t TYPE('b)))\"\n\ndefinition\n field_offset_footprint :: \"'a::c_type ptr \\ (qualified_field_name) list \\ 'b ptr set\"\nwhere\n \"field_offset_footprint p fs \\ {Ptr &(p\\k) | k. k \\ set fs}\"\n\n\ndefinition\n sub_typ :: \"'a::c_type itself \\ 'b::c_type itself \\ bool\" (\"_ \\\\<^sub>\\ _\" [51, 51] 50)\nwhere\n \"s \\\\<^sub>\\ t \\ typ_uinfo_t s \\ typ_uinfo_t t\"\n\ndefinition\n sub_typ_proper :: \"'a::c_type itself \\ 'b::c_type itself \\ bool\" (\"_ <\\<^sub>\\ _\" [51, 51] 50)\nwhere\n \"s <\\<^sub>\\ t \\ typ_uinfo_t s < typ_uinfo_t t\"\n\ndefinition\n peer_typ :: \"'a::c_type itself \\ 'b :: c_type itself \\ bool\"\nwhere\n \"peer_typ a b \\ typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE('b) \\\n typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b)\"\n\ndefinition\n guard_mono :: \"'a::c_type ptr_guard \\ 'b::c_type ptr_guard \\ bool\"\nwhere\n \"guard_mono g g' \\ \\n f p. g p \\\n field_lookup (typ_uinfo_t TYPE('a)) f 0 = Some (typ_uinfo_t TYPE('b),n) \\\n g' (Ptr (ptr_val p + of_nat n))\"\n\nprimrec\n sub_field_update_t :: \"(qualified_field_name) list \\ 'a ptr \\ 'a::c_type \\\n 'b::c_type typ_heap \\ 'b typ_heap\"\nwhere\n sft0: \"sub_field_update_t [] p v s = s\"\n| sft1: \"sub_field_update_t (f#fs) p (v::'a::c_type) s = (let s' = sub_field_update_t fs p (v::'a::c_type) s in\n s'(Ptr &(p\\f) \\ from_bytes (access_ti\\<^sub>0 (field_typ TYPE('a) f)\n v))) |` dom (s::'b::c_type typ_heap)\"\n\n(* case where 'b contains a field of type of 'a *)\n\nprimrec\n update_value_t :: \"(qualified_field_name) list \\ 'a::c_type \\ 'b \\ nat \\ 'b::c_type\"\nwhere\n uvt0: \"update_value_t [] v w x = w\"\n| uvt1: \"update_value_t (f#fs) v (w::'b) x = (if x=field_offset TYPE('b) f then\n field_update (field_desc (field_typ TYPE('b) f)) (to_bytes_p (v::'a::c_type)) (w::'b::c_type) else update_value_t fs v w x)\"\n\ndefinition\n super_field_update_t :: \"'a ptr \\ 'a::c_type \\ 'b::c_type typ_heap \\ 'b typ_heap\"\nwhere\n \"super_field_update_t p v s \\ \\q. if field_of_t p q then\n case_option None (\\w. Some (update_value_t\n (field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a))) v w\n (unat (ptr_val p - ptr_val q)))) (s q) else s q\"\n\ndefinition\n heap_footprint :: \"heap_typ_desc \\ typ_uinfo \\ addr set\"\nwhere\n \"heap_footprint d t \\ {x. \\y. valid_footprint d y t \\\n x \\ {y} \\ {y..+size_td t}}\"\n\ndefinition\n ptr_safe :: \"'a::c_type ptr \\ heap_typ_desc \\ bool\"\nwhere\n \"ptr_safe p d \\ s_footprint p \\ dom_s d\"\n\n(* Retyping *)\n\nprimrec\n htd_update_list :: \"addr \\ typ_slice list \\ heap_typ_desc \\ heap_typ_desc\"\nwhere\n hul0: \"htd_update_list p [] d = d\"\n| hul1: \"htd_update_list p (x#xs) d = htd_update_list (p+1) xs (d(p := (True,snd (d p) ++ x)))\"\n\ndefinition dom_tll :: \"addr \\ typ_slice list \\ s_addr set\" where\n \"dom_tll p xs \\ {(p + of_nat x,SIndexVal) | x. x < length xs} \\\n {(p + of_nat x,SIndexTyp n) | x n. x < length xs \\ (xs ! x) n \\ None}\"\n\ndefinition typ_slices :: \"'a::c_type itself \\ typ_slice list\" where\n \"typ_slices t \\ map (\\n. list_map (typ_slice_t (typ_uinfo_t TYPE('a)) n))\n [0.. heap_typ_desc \\ heap_typ_desc\"\nwhere\n \"ptr_retyp p \\ htd_update_list (ptr_val p) (typ_slices TYPE('a))\"\n\ndefinition\n field_fd :: \"'a::c_type itself \\ qualified_field_name \\ 'a field_desc\"\nwhere\n \"field_fd t n \\ field_desc (field_typ t n)\"\n\ndefinition\n tag_disj_typ :: \"'a::c_type itself \\ 'b::c_type itself \\ bool\" (\"_ \\\\<^sub>\\ _\")\nwhere\n \"s \\\\<^sub>\\ t \\ typ_uinfo_t s \\\\<^sub>t typ_uinfo_t t\"\n\ntext {* ---- *}\n\nlemma wf_heap_val_SIndexVal_STyp_simp [simp]:\n \"wf_heap_val s \\ s (x,SIndexVal) \\ Some (STyp t)\"\napply(clarsimp simp: wf_heap_val_def)\napply(drule_tac x=x in spec)\napply clarsimp\napply(case_tac t, simp)\napply fast\ndone\n\nlemma wf_heap_val_SIndexTyp_SValue_simp [simp]:\n \"wf_heap_val s \\ s (x,SIndexTyp n) \\ Some (SValue v)\"\napply(unfold wf_heap_val_def)\napply clarify\napply(drule_tac x=x in spec)\napply clarsimp\ndone\n\nlemma field_tag_sub:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t,n) \\\n {&(p\\f)..+size_td t} \\ {ptr_val (p::'a ptr)..+size_of TYPE('a)}\"\napply(clarsimp simp: field_ti_def split: option.splits)\napply(drule intvlD, clarsimp simp: field_lvalue_def field_offset_def)\napply(drule field_lookup_export_uinfo_Some)\napply(subst add.assoc)\napply(subst Abs_fnat_homs)\napply(rule intvlI)\napply(simp add: size_of_def typ_uinfo_t_def)\napply(drule td_set_field_lookupD)\napply(drule td_set_offset_size)\napply(simp)\ndone\n\nlemma typ_slice_t_not_empty [simp]:\n \"typ_slice_t t n \\ []\"\n by (case_tac t, simp)\n\nlemma list_map_typ_slice_t_not_empty [simp]:\n \"list_map (typ_slice_t t n) \\ empty\"\napply(simp add: list_map_def)\napply(case_tac \"typ_slice_t t n\")\napply(auto simp: )\napply(drule_tac x=0 in fun_cong)\napply simp\ndone\n\nlemma s_footprint:\n \"s_footprint (p::'a::c_type ptr) = {(ptr_val p + of_nat x,k) | x k. x < size_of TYPE('a) \\\n (k=SIndexVal \\\n (\\n. k=SIndexTyp n \\ n < length (typ_slice_t (typ_uinfo_t TYPE('a)) x)))}\"\napply(auto simp: s_footprint_def s_footprint_untyped_def size_of_def )\ndone\n\nlemma ptr_val_SIndexVal_in_s_footprint [simp]:\n \"(ptr_val p, SIndexVal) \\ s_footprint (p::'a::mem_type ptr)\"\napply(simp add: s_footprint)\napply(rule_tac x=0 in exI)\napply auto\ndone\n\nlemma s_footprintI:\n \"\\ n < length (typ_slice_t (typ_uinfo_t TYPE('a)) x); x < size_of TYPE('a) \\ \\\n (ptr_val p + of_nat x, SIndexTyp n) \\ s_footprint (p::'a::c_type ptr)\"\napply(simp add: s_footprint)\napply(rule_tac x=x in exI)\napply auto\ndone\n\nlemma s_footprintI2:\n \"x < size_of TYPE('a) \\\n (ptr_val p + of_nat x, SIndexVal) \\ s_footprint (p::'a::c_type ptr)\"\napply(simp add: s_footprint)\napply(rule_tac x=x in exI)\napply auto\ndone\n\nlemma s_footprintD:\n \"(x,k) \\ s_footprint p \\\n x \\ {ptr_val (p::'a::c_type ptr)..+size_of TYPE('a)}\"\napply(auto simp: s_footprint)\n apply(erule intvlI)\napply(erule intvlI)\ndone\n\nlemma s_footprintD2:\n \"(x,SIndexTyp n) \\ s_footprint (p::'a::mem_type ptr) \\\n n < length (typ_slice_t (typ_uinfo_t TYPE('a)) (unat (x - ptr_val p)))\"\napply(auto simp: s_footprint)\napply(subst word_unat.eq_norm)\napply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\napply simp\ndone\n\nlemma s_footprint_restrict:\n \"x \\ s_footprint p \\ (s |` s_footprint p) x = s x\"\napply(auto simp: s_footprint)\ndone\n\nlemma restrict_s_fst:\n \"fst (restrict_s d X x) \\ fst (d x)\"\n by (clarsimp simp: restrict_s_def)\n\nlemma restrict_s_map_le [simp]:\n \"snd (restrict_s d X x) \\\\<^sub>m snd (d x)\"\n by (auto simp: restrict_s_def map_le_def)\n\nlemma dom_list_map [simp]:\n \"dom (list_map xs) = {0.. list_map xs n = Some (xs ! n)\"\napply(auto simp: list_map_def set_zip)\napply(rule_tac x=n in exI)\napply auto\ndone\n\nlemma list_map_eq:\n \"list_map xs n = (if n < length xs then Some (xs ! n) else None)\"\napply(auto simp: list_map_def set_zip)\napply(rule_tac x=n in exI)\napply auto\ndone\n\n\nlemma valid_footprintI:\n \"\\ 0 < size_td t; \\y. y < size_td t \\ list_map (typ_slice_t t y) \\\\<^sub>m snd (d (x + of_nat y)) \\\n fst (d (x + of_nat y)) \\ \\\n valid_footprint d x t\"\n by (simp add: valid_footprint_def)\n\nlemma valid_footprintD:\n \"\\ valid_footprint d x t; y < size_td t \\ \\\n list_map (typ_slice_t t y) \\\\<^sub>m snd (d (x + of_nat y)) \\\n fst (d (x + of_nat y))\"\n by (simp add: valid_footprint_def Let_def)\n\nlemma h_t_valid_taut:\n \"d,g \\\\<^sub>t p \\ d,(\\x. True) \\\\<^sub>t p\"\n by (simp add: h_t_valid_def)\n\nlemma h_t_valid_restrict:\n \"restrict_s d (s_footprint p),g \\\\<^sub>t p = d,g \\\\<^sub>t p\"\napply(simp add: h_t_valid_def valid_footprint_def Let_def)\napply auto\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(erule map_le_trans)\n apply simp\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(erule restrict_s_fst)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def map_le_def)\n apply(erule notE)\n apply(rule s_footprintI)\n apply(simp)\n apply(simp add: size_of_def)\napply(clarsimp simp: restrict_s_def map_le_def)\napply(rule s_footprintI2)\napply(simp add: size_of_def)\ndone\n\nlemma h_t_valid_restrict2:\n \"\\ d,g \\\\<^sub>t p; restrict_s d (s_footprint p) = restrict_s d' (s_footprint p)\n \\ \\ d',g \\\\<^sub>t (p::'a::c_type ptr)\"\napply(auto simp: h_t_valid_def valid_footprint_def Let_def)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(clarsimp simp: map_le_def)\n apply(drule_tac x=\"(ptr_val p + of_nat y)\" in fun_cong)\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=a in fun_cong)\n apply(clarsimp split: split_if_asm)\n apply(erule notE)\n apply(rule s_footprintI)\n apply(simp)\n apply(simp add: size_of_def )\napply(drule_tac x=y in spec)\napply clarsimp\napply(drule_tac x=\"(ptr_val p + of_nat y)\" in fun_cong)\napply(clarsimp simp: restrict_s_def)\napply(auto)\n apply(erule notE)\n apply(rule s_footprintI2)\n apply(simp add: size_of_def)\napply(erule notE)\napply(rule s_footprintI2)\napply(simp add: size_of_def)\ndone\n\nlemma lift_state_wf_heap_val [simp]:\n \"wf_heap_val (lift_state (h,d))\"\napply(unfold wf_heap_val_def, clarify)\napply(auto simp: lift_state_def split: option.splits)\ndone\n\nlemma wf_hs_proj_d:\n \"fst (proj_d s x) \\ s (x,SIndexVal) \\ None\"\napply(auto simp: proj_d_def )\ndone\n\n\n\nlemma s_valid_g:\n \"s,g \\\\<^sub>s p \\ g p\"\n by (simp add: s_valid_def h_t_valid_def)\n\nlemma lift_typ_heap_if:\n \"lift_typ_heap g s = (\\(p::'a::c_type ptr). if s,g \\\\<^sub>s p then Some (from_bytes\n (heap_list_s s (size_of TYPE('a)) (ptr_val p))) else None)\"\n by (force simp: lift_typ_heap_def)\n\nlemma lift_typ_heap_s_valid:\n \"lift_typ_heap g s p = Some x \\ s,g \\\\<^sub>s p\"\n by (simp add: lift_typ_heap_if split: split_if_asm)\n\nlemma lift_typ_heap_g:\n \"lift_typ_heap g s p = Some x \\ g p\"\n by (fast dest: lift_typ_heap_s_valid s_valid_g)\n\nlemma lift_state_empty [simp]:\n \"lift_state (h,empty_htd) = empty\"\napply(rule ext)\napply(auto simp: lift_state_def empty_htd_def split: s_heap_index.splits)\ndone\n\nlemma lift_state_eqI:\n \"\\ h x = h' x; d x = d' x \\ \\ lift_state (h,d) (x,k) = lift_state (h',d') (x,k)\"\n by (clarsimp simp: lift_state_def split: s_heap_index.splits)\n\nlemma proj_h_lift_state:\n \"fst (d x) \\ proj_h (lift_state (h,d)) x = h x\"\n by (clarsimp simp: proj_h_def lift_state_def)\n\nlemma lift_state_proj_simp [simp]:\n \"lift_state (proj_h (lift_state (h, d)), d) = lift_state (h, d)\"\napply(rule ext)\napply(auto simp: lift_state_def proj_h_def split: s_heap_index.splits option.splits)\ndone\n\nlemma f2l_length [simp]:\n \"length (fun2list f n) = n\"\n by (simp add: fun2list_def)\n\nlemma GREATEST_lt [simp]:\n \"0 < n \\ (GREATEST x. x < n) = n - (1::nat)\"\napply(rule Greatest_equality)\n apply simp+\ndone\n\nlemma fun2list_nth [simp]:\n \"x < n \\ fun2list f n ! x = f x\"\n by (clarsimp simp: fun2list_def)\n\nlemma proj_d_lift_state:\n \"proj_d (lift_state (h,d)) = d\"\napply(rule ext)\napply(case_tac \"d x\")\napply(auto simp: proj_d_def lift_state_def Let_def split: option.splits)\ndone\n\nlemma lift_state_proj [simp]:\n \"wf_heap_val s \\ lift_state (proj_h s,proj_d s) = s\"\napply(auto simp: proj_h_def proj_d_def lift_state_def fun_eq_iff\n split: split_if_asm s_heap_index.splits option.splits)\n apply (metis s_heap_tag.simps s_heap_value.exhaust wf_heap_val_SIndexTyp_SValue_simp)\n apply (metis id_apply s_heap_value.exhaust s_heap_value.simps(5) wf_heap_val_SIndexVal_STyp_simp)\napply (metis s_heap_tag.simps s_heap_value.exhaust wf_heap_val_SIndexTyp_SValue_simp)\ndone\n\nlemma lift_state_Some:\n \"lift_state (h,d) (p,SIndexTyp n) = Some t \\ snd (d p) n = Some (s_heap_tag t)\"\napply (simp add: lift_state_def split: option.splits split: split_if_asm)\napply(case_tac t, simp+)\ndone\n\nlemma lift_state_Some2:\n \"snd (d p) n = Some t \\\n \\v. lift_state (h,d) (p,SIndexTyp n) = Some (STyp t)\"\n by (simp add: lift_state_def split: option.split)\n\nlemma h_t_s_valid:\n \"lift_state (h,d),g \\\\<^sub>s p = d,g \\\\<^sub>t p\"\n by (simp add: s_valid_def proj_d_lift_state)\n\nlemma lift_t:\n \"lift_typ_heap g (lift_state s) = lift_t g s\"\n by (simp add: lift_t_def)\n\nlemma lift_t_h_t_valid:\n \"lift_t g (h,d) p = Some x \\ d,g \\\\<^sub>t p\"\n by (force simp: lift_t_def h_t_s_valid dest: lift_typ_heap_s_valid)\n\nlemma lift_t_g:\n \"lift_t g s p = Some x \\ g p\"\n by (force simp: lift_t_def dest: lift_typ_heap_g)\n\nlemma lift_t_proj [simp]:\n \"wf_heap_val s \\ lift_t g (proj_h s, proj_d s) = lift_typ_heap g s\"\napply (simp add: lift_t_def)\ndone\n\nlemma valid_footprint_Some:\n assumes valid: \"valid_footprint d p t\" and size: \"x < size_td t\"\n shows \"fst (d (p + of_nat x))\"\nproof (cases \"of_nat x=(0::addr)\")\n case True\n with valid show ?thesis by (force simp add: valid_footprint_def Let_def)\nnext\n case False\n(* with size have \"p + of_nat x \\ {p + 1..+n - Suc 0}\"\n by (force intro: intvl_neq_start intvlI)*)\n with size valid show ?thesis by (force simp: valid_footprint_def Let_def)\nqed\n\nlemma h_t_valid_Some:\n \"\\ d,g \\\\<^sub>t (p::'a::c_type ptr); x < size_of TYPE('a) \\ \\\n fst (d (ptr_val p + of_nat x))\"\n by (force simp: h_t_valid_def size_of_def dest: valid_footprint_Some)\n\nlemma h_t_valid_ptr_safe:\n \"d,g \\\\<^sub>t (p::'a::c_type ptr) \\ ptr_safe p d\"\napply (auto simp: ptr_safe_def h_t_valid_def valid_footprint_def s_footprint_def s_footprint_untyped_def dom_s_def size_of_def Let_def )\napply(drule_tac x=x in spec)\napply(clarsimp simp: map_le_def)\napply(drule_tac x=n in bspec)\napply simp+\napply(drule sym)\napply(case_tac \"typ_slice_t (typ_uinfo_t TYPE('a)) x ! n\")\napply(simp add: typ_uinfo_t_def)\ndone\n\nlemma lift_t_ptr_safe:\n \"lift_t g (h,d) (p::'a::c_type ptr) = Some x \\ ptr_safe p d\"\n by (fast dest: lift_t_h_t_valid h_t_valid_ptr_safe)\n\nlemma s_valid_Some:\n \"\\ d,g \\\\<^sub>s (p::'a::c_type ptr); x < size_of TYPE('a) \\ \\\n d (ptr_val p + of_nat x,SIndexVal) \\ None\"\napply(auto simp: s_valid_def dest: h_t_valid_Some\n split: option.splits)\napply(drule h_t_valid_Some)\n apply fast\napply(drule wf_hs_proj_d)\napply clarsimp\ndone\n\nlemma heap_list_s_heap_list_dom:\n \"\\n. (\\x. (x,SIndexVal)) ` {n..+k} \\ dom_s d \\\n heap_list_s (lift_state (h,d)) k n = heap_list h k n\"\nproof (induct k)\n case 0 show ?case by (simp add: heap_list_s_def)\nnext\n case (Suc k)\n hence \"(\\x. (x,SIndexVal)) ` {n + 1..+k} \\ dom_s d\"\napply -\napply(rule subset_trans)\n prefer 2\n apply assumption\napply(clarsimp simp: image_def)\nby (force intro: intvl_plus_sub_Suc)\n with Suc have \"heap_list_s (lift_state (h, d)) k (n + 1) =\n heap_list h k (n + 1)\" by simp\n moreover with Suc have \"(n,SIndexVal) \\ dom_s d\"\napply -\napply(clarsimp simp: dom_s_def)\napply(drule subsetD)\n apply(clarsimp simp: image_def)\n apply(rule_tac x=n in bexI)\n apply fast\n apply (fast intro: intvl_self)\napply clarsimp\ndone\n ultimately show ?case\napply -\napply(auto simp add: heap_list_s_def proj_h_lift_state)\napply(subst proj_h_lift_state)\n apply(clarsimp simp: dom_s_def)\napply simp\ndone\nqed\n\nlemma heap_list_s_heap_list:\n \"d,(\\x. True) \\\\<^sub>t (p::'a::c_type ptr) \\\n heap_list_s (lift_state (h,d)) (size_of TYPE('a)) (ptr_val p)\n = heap_list h (size_of TYPE('a)) (ptr_val p)\"\napply(drule h_t_valid_ptr_safe)\napply(clarsimp simp: ptr_safe_def)\napply(subst heap_list_s_heap_list_dom)\n apply(clarsimp simp: dom_s_def)\n apply(drule_tac c=\"(x,SIndexVal)\" in subsetD)\n apply(clarsimp simp: intvl_def)\n apply(erule s_footprintI2)\n apply clarsimp+\ndone\nlemma lift_t_if:\n \"lift_t g (h,d) = (\\p. if d,g \\\\<^sub>t p then Some (h_val h (p::'a::c_type ptr)) else\n None)\"\n by (force simp: lift_t_def lift_typ_heap_if h_t_s_valid h_val_def\n heap_list_s_heap_list h_t_valid_taut)\n\nlemma lift_lift_t:\n \"d,g \\\\<^sub>t (p::'a::c_type ptr) \\ lift h p = the (lift_t g (h,d) p)\"\n by (simp add: lift_t_if lift_def)\n\nlemma lift_t_lift:\n \"lift_t g (h,d) (p::'a::c_type ptr) = Some v \\ lift h p = v\"\n by (simp add: lift_t_if lift_def split: split_if_asm)\n\ndeclare word_neq_0_conv [simp add]\n\nlemma heap_update_list_same:\n shows \"\\h p k. \\ 0 < k; k \\ addr_card - length v \\ \\\n (heap_update_list (p + of_nat k) v) h p = h p\"\nproof (induct v)\n case Nil show ?case by simp\nnext\n case (Cons x xs)\n have \"heap_update_list (p + of_nat k) (x # xs) h p =\n heap_update_list (p + of_nat (k + 1)) xs (h(p + of_nat k := x)) p\"\n by (simp add: ac_simps)\n also have \"\\ = (h(p + of_nat k := x)) p\"\n proof -\n from Cons have \"k + 1 \\ addr_card - length xs\" by simp\n with Cons show ?thesis by (simp only:)\n qed\n also have \"\\ = h p\"\n proof -\n from Cons have \"of_nat k \\ (0::addr)\"\n by - (erule of_nat_neq_0, simp add: addr_card)\n thus ?thesis by clarsimp\n qed\n finally show ?case .\nqed\n\nlemma heap_list_update:\n \"\\h p. length v \\ addr_card \\ heap_list (heap_update_list p v h)\n (length v) p = v\"\nproof (induct v)\n case Nil thus ?case by simp\nnext\n case (Cons x xs)\n hence \"heap_update_list (p + of_nat 1) xs (h(p := x)) p = (h(p := x)) p\"\n by - (rule heap_update_list_same, auto)\n with Cons show ?case by simp\nqed\n\nlemma heap_list_update_to_bytes:\n \"heap_list (heap_update_list p (to_bytes (v::'a::mem_type) (heap_list h (size_of TYPE('a)) p)) h)\n (size_of TYPE('a)) p = to_bytes v (heap_list h (size_of TYPE('a)) p)\"\napply(subgoal_tac\n \"heap_list (heap_update_list p (to_bytes (v::'a::mem_type) (heap_list h (size_of TYPE('a)) p)) h)\n (length (to_bytes v (heap_list h (size_of TYPE('a)) p))) p = to_bytes v (heap_list h (size_of TYPE('a)) p)\")\n apply simp\napply(rule heap_list_update)\napply(simp add: less_imp_le)\ndone\n\nlemma h_val_heap_update:\n \"h_val (heap_update p v h) p = (v::'a::mem_type)\"\n by (simp add: h_val_def heap_update_def heap_list_update_to_bytes)\n\nlemma heap_list_update_disjoint_same:\n shows \"\\q. {p..+length v} \\ {q..+k} = {} \\\n heap_list (heap_update_list p v h) k q = heap_list h k q\"\nproof (induct k)\n case 0 show ?case by simp\nnext\n case (Suc n)\n hence \"{p..+length v} \\ {q + 1..+n} = {}\"\n by (force intro: intvl_plus_sub_Suc)\n with Suc have \"heap_list (heap_update_list p v h) n (q + 1) =\n heap_list h n (q + 1)\" by simp\n moreover have \"heap_update_list (q + of_nat (unat (p - q))) v h q = h q\"\n proof (cases v)\n case Nil thus ?thesis by simp\n next\n case (Cons y ys)\n with Suc have \"0 < unat (p - q)\"\n by (case_tac \"p=q\")\n (simp add: intvl_start_inter unat_gt_0)+\n moreover have \"unat (p - q) \\ addr_card - length v\" (is ?G)\n proof (rule ccontr)\n assume \"\\ ?G\"\n moreover from Suc have \"q \\ {p..+length v}\"\n by (fast intro: intvl_self)\n ultimately show False\n by (simp only: linorder_not_le len_of_addr_card [symmetric])\n (frule_tac p=q in intvl_self_offset, force+)\n qed\n ultimately show ?thesis by (rule heap_update_list_same)\n qed\n ultimately show ?case by simp\nqed\n\nlemma heap_update_nmem_same:\n assumes nmem: \"q \\ {p..+length v}\"\n shows \"heap_update_list p v h q = h q\"\nproof -\n from nmem have \"heap_list (heap_update_list p v h) 1 q = heap_list h 1 q\"\n by - (rule heap_list_update_disjoint_same, force dest: intvl_Suc)\n thus ?thesis by simp\nqed\n\nlemma heap_update_mem_same [rule_format]:\n \"\\p h h'. q \\ {p..+length v} \\ length v < addr_card \\\n heap_update_list p v h q = heap_update_list p v h' q\"\napply(induct_tac v)\n apply simp\napply clarsimp\napply(case_tac \"p=q\")\n apply simp\n apply(subst heap_update_list_same [where k=1, simplified])\n apply simp\n apply(subst heap_update_list_same [where k=1, simplified])\n apply simp\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply(drule (1) intvl_neq_start)\n apply simp\napply simp\ndone\n\nlemma sub_tag_proper_TypScalar [simp]:\n \"\\ t < TypDesc (TypScalar n algn d) nm\"\n by (simp add: typ_tag_lt_def typ_tag_le_def)\n\nlemma tag_disj_com [simp]:\n \"f \\\\<^sub>t g = g \\\\<^sub>t f\"\n by (force simp: tag_disj_def)\n\nlemma typ_slice_set':\n \"\\m n. fst ` set (typ_slice_t s n) \\ fst ` td_set s m\"\n \"\\m n. fst ` set (typ_slice_struct st n) \\ fst ` td_set_struct st m\"\n \"\\m n. fst ` set (typ_slice_list xs n) \\ fst ` td_set_list xs m\"\n \"\\m n. fst ` set (typ_slice_pair x n) \\ fst ` td_set_pair x m\"\napply(induct s and st and xs and x)\napply(auto simp: ladder_set_def)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=0 in spec)\n apply force\napply(thin_tac \"All P\" for P)\napply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\napply(drule_tac x=\"n - size_td (dt_fst dt_pair)\" in spec)\napply(case_tac dt_pair)\napply force\ndone\n\nlemma typ_slice_set:\n \"fst ` set (typ_slice_t s n) \\ fst ` td_set s m\"\napply(insert typ_slice_set'(1) [of s])\napply clarsimp\ndone\n\nlemma typ_slice_struct_set:\n \"(s,t) \\ set (typ_slice_struct st n) \\ \\k. (s,k) \\ td_set_struct st m\"\napply(insert typ_slice_set'(2) [of st])\napply force\ndone\n\nlemma typ_slice_set_sub:\n \"typ_slice_t s m \\ typ_slice_t t n \\\n fst ` set (typ_slice_t s m) \\ fst ` set (typ_slice_t t n)\"\napply(clarsimp simp: image_def prefixeq_def less_eq_list_def)\napply force\ndone\n\nlemma ladder_set_self:\n \"s \\ fst ` set (typ_slice_t s n)\"\napply(case_tac s)\napply(auto simp: ladder_set_def)\ndone\n\nlemma typ_slice_sub:\n \"typ_slice_t s m \\ typ_slice_t t n \\ s \\ t\"\napply(drule typ_slice_set_sub)\napply(insert ladder_set_self [of s m])\napply(insert typ_slice_set [of t n 0])\napply(clarsimp simp: typ_tag_le_def)\napply force\ndone\n\nlemma typ_slice_self:\n \"(s,True) \\ set (typ_slice_t s 0)\"\napply(case_tac s)\napply simp\ndone\n\nlemma typ_slice_struct_nmem:\n \"(TypDesc st nm,n) \\ set (typ_slice_struct st k)\"\napply clarsimp\napply(drule typ_slice_struct_set)\napply clarsimp\napply(drule td_set_struct_size_lte)\napply simp\ndone\n\nlemma typ_slice_0_prefix:\n \"0 < n \\ \\ typ_slice_t t 0 \\ typ_slice_t t n \\\n \\ typ_slice_t t n \\ typ_slice_t t 0\"\napply auto\n apply(case_tac t)\n apply (clarsimp simp: less_eq_list_def)\n apply(drule set_mono_prefixeq)\n apply clarsimp\n apply(simp add: typ_slice_struct_nmem)\napply(case_tac t)\napply (clarsimp simp: less_eq_list_def)\napply(drule set_mono_prefixeq)\napply clarsimp\napply(simp add: typ_slice_struct_nmem)\ndone\n\nlemma map_prefix_same_cases_dom:\n \"\\ list_map xs \\\\<^sub>m f; list_map ys \\\\<^sub>m f \\ \\\n length xs \\ length ys \\ length ys \\ length xs\"\n by (auto simp: map_le_def prefixeq_def list_map_def)\n\nlemma prefix_eq_nth:\n \"xs \\ ys = ((\\i. i < length xs \\ xs ! i = ys ! i) \\ length xs \\ length ys)\"\napply(auto simp: less_eq_list_def prefixeq_def nth_append)\napply(rule_tac x=\"drop (length xs) ys\" in exI)\napply(subst list_eq_iff_nth_eq)\napply(simp add: nth_append)\ndone\n\nlemma map_prefix_same_cases:\n \"\\ list_map xs \\\\<^sub>m f; list_map ys \\\\<^sub>m f \\ \\ xs \\ ys \\ ys \\ xs\"\napply(frule (1) map_prefix_same_cases_dom [where xs=ys])\napply(erule disjE)\n apply(clarsimp simp: prefix_eq_nth)\n apply(clarsimp simp: map_le_def prefixeq_def)\n apply(drule_tac x=i in bspec, simp)+\n apply(force dest: sym)\napply(clarsimp simp: prefix_eq_nth)\napply(clarsimp simp: map_le_def prefixeq_def)\napply(drule_tac x=i in bspec, simp)+\napply(force dest: sym)\ndone\n\nlemma list_map_mono:\n \"xs \\ ys \\ list_map xs \\\\<^sub>m list_map ys\"\n by (auto simp: map_le_def prefixeq_def nth_append less_eq_list_def)\n\nlemma map_list_map_trans:\n \"\\ xs \\ ys; list_map ys \\\\<^sub>m f \\ \\ list_map xs \\\\<^sub>m f\"\napply(drule list_map_mono)\napply(erule (1) map_le_trans)\ndone\n\nlemma valid_footprint_le:\n \"valid_footprint d x t \\ size_td t \\ addr_card\"\napply(clarsimp simp: valid_footprint_def Let_def)\napply(rule ccontr)\napply(frule_tac x=addr_card in spec)\napply(drule_tac x=0 in spec)\napply clarsimp\napply(drule (1) map_prefix_same_cases)\napply(simp add: typ_slice_0_prefix addr_card)\ndone\n\nlemma typ_slice_True_set':\n \"\\s k m. (s,True) \\ set (typ_slice_t t k) \\ (s,k+m) \\ td_set t m\"\n \"\\s k m. (s,True) \\ set (typ_slice_struct st k) \\ (s,k+m) \\ td_set_struct st m\"\n \"\\s k m. (s,True) \\ set (typ_slice_list xs k) \\ (s,k+m) \\ td_set_list xs m\"\n \"\\s k m. (s,True) \\ set (typ_slice_pair x k) \\ (s,k+m) \\ td_set_pair x m\"\napply(induct t and st and xs and x)\n apply auto[4]\n apply clarsimp\n apply(case_tac dt_pair, clarsimp)\n apply(rename_tac a)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"k - size_td a\" in spec)\n apply clarsimp\n apply(drule_tac x=\"m + size_td a\" in spec)\n apply simp\napply auto\ndone\n\nlemma typ_slice_True_set:\n \"(s,True) \\ set (typ_slice_t t k) \\ (s,k+m) \\ td_set t m\"\n by (simp add: typ_slice_True_set')\n\nlemma typ_slice_True_prefix:\n \"typ_slice_t s 0 \\ typ_slice_t t k \\ (s,k) \\ td_set t 0\"\napply(insert typ_slice_self [of s])\napply(clarsimp simp: less_eq_list_def)\napply(drule set_mono_prefixeq)\napply(insert typ_slice_True_set [of s t k 0])\napply force\ndone\n\nlemma tag_sub_prefix [simp]:\n \"t < s \\ \\ typ_slice_t s m \\ typ_slice_t t n\"\napply clarsimp\napply(drule typ_slice_sub)\napply simp\ndone\n\nlemma tag_disj_prefix [simp]:\n \"s \\\\<^sub>t t \\ \\ typ_slice_t s m \\ typ_slice_t t n\"\napply (simp only: tag_disj_def typ_slice_sub)\napply auto\napply(drule typ_slice_sub)\napply simp\ndone\n\nlemma typ_slice_0_True':\n \"\\x. x \\ set (typ_slice_t t 0) \\ snd x = True\"\n \"\\x. x \\ set (typ_slice_struct st 0) \\ snd x = True\"\n \"\\x. x \\ set (typ_slice_list xs 0) \\ snd x = True\"\n \"\\x. x \\ set (typ_slice_pair y 0) \\ snd x = True\"\n by (induct t and st and xs and y) auto\n\nlemma typ_slice_0_True:\n \"x \\ set (typ_slice_t t 0) \\ snd x = True\"\n by (simp add: typ_slice_0_True')\n\nlemma typ_slice_False_self:\n \"k \\ 0 \\ (t,False) \\ set (typ_slice_t t k)\"\n by (cases t) simp\n\nlemma tag_prefix_True:\n \"typ_slice_t s k \\ typ_slice_t t 0 \\ k = 0\"\napply(clarsimp simp: less_eq_list_def)\napply(drule set_mono_prefixeq)\napply(rule ccontr)\napply(drule_tac t=s and k=k in typ_slice_False_self)\napply(insert typ_slice_0_True [of \"(s,False)\" t])\napply simp\napply fast\ndone\n\nlemma valid_footprint_neq_nmem:\n assumes valid_p: \"valid_footprint d p f\" and\n valid_q: \"valid_footprint d q g\" and neq: \"p \\ q\" and disj: \"f \\\\<^sub>t g \\ f=g\"\n shows \"p \\ {q..+size_td g}\" (is ?G)\nproof -\n from assms show ?thesis\napply -\napply(auto simp: valid_footprint_def intvl_def Let_def)\n apply(drule_tac x=0 in spec)\n apply(drule_tac x=k in spec)\n apply clarsimp\n apply(drule (1) map_prefix_same_cases)\n apply auto\napply(drule_tac x=0 in spec)\napply(drule_tac x=k in spec)\napply clarsimp\napply(drule (1) map_prefix_same_cases)\napply(subgoal_tac \"0 < k\")\n apply(drule_tac t=\"g\" and n=k in typ_slice_0_prefix)\n apply clarsimp\napply(rule ccontr)\napply clarsimp\ndone\nqed\n\nlemma valid_footprint_sub:\n assumes valid_p: \"valid_footprint d p s\"\n assumes valid_q: \"valid_footprint d q t\"\n assumes sub: \"\\ t < s\"\n shows \"p \\ {q..+size_td t} \\ field_of (p - q) (s) (t)\" (is ?G)\nproof -\n from assms show ?thesis\n apply clarsimp\n apply(insert valid_footprint_le[OF valid_q])\n apply(clarsimp simp: valid_footprint_def Let_def)\n apply(drule_tac x=0 in spec)\n apply clarsimp\n apply(drule intvlD)\n apply clarsimp\n apply(drule_tac x=k in spec)\n apply clarsimp\n apply(drule (1) map_prefix_same_cases)\n apply(erule disjE)\n prefer 2\n apply(frule typ_slice_sub)\n apply(subgoal_tac \"k = 0\")\n prefer 2\n apply(rule ccontr, simp)\n apply(drule order_le_imp_less_or_eq[where x=t])\n apply clarsimp\n apply(simp add: typ_slice_0_prefix)\n apply simp\n apply(drule order_le_imp_less_or_eq[where x=t])\n apply clarsimp\n (* given by the fd_tag_consistent condition *)\n apply(drule typ_slice_True_prefix)\n apply(clarsimp simp: field_of_def)\n apply(simp only: unat_simps)\n done\nqed\n\nlemma valid_footprint_sub2:\n \"\\ valid_footprint d p s; valid_footprint d q t; \\ t < s \\ \\\n q \\ {p..+size_td s} \\ p=q\"\napply(clarsimp simp: valid_footprint_def Let_def)\napply(drule intvlD)\napply clarsimp\napply(drule_tac x=k in spec)\napply clarsimp\napply(drule_tac x=0 in spec)\napply clarsimp\napply(drule (1) map_prefix_same_cases)\napply(case_tac \"k=0\")\n apply simp\napply(erule disjE)\n prefer 2\n apply(frule typ_slice_sub)\n apply(drule order_le_imp_less_or_eq[where x=t])\n apply clarsimp\n apply(simp add: typ_slice_0_prefix)\napply(drule tag_prefix_True)\napply simp\ndone\n\nlemma valid_footprint_neq_disjoint:\n \"\\ valid_footprint d p s; valid_footprint d q t; \\ t < s;\n \\ field_of (p - q) (s) (t) \\ \\ {p..+size_td s} \\ {q..+size_td t} = {}\"\napply (rule ccontr)\napply(drule intvl_inter)\napply(erule disjE)\n apply(drule (2) valid_footprint_sub)\n apply clarsimp\napply(frule (1) valid_footprint_sub2, assumption)\napply(frule (1) valid_footprint_sub2)\n apply simp\napply simp\napply(clarsimp simp: field_of_def)\napply(clarsimp simp: valid_footprint_def Let_def)\napply(drule_tac x=0 in spec)+\napply clarsimp\napply(drule (1) map_prefix_same_cases [where xs=\"typ_slice_t s 0\"])\napply(erule disjE)\n apply(drule typ_slice_True_prefix)\n apply simp\napply(drule typ_slice_sub)\napply(drule order_le_imp_less_or_eq)\napply simp\ndone\n\nlemma sub_typ_proper_not_same [simp]:\n \"\\ t <\\<^sub>\\ t\"\n by (simp add: sub_typ_proper_def)\n\nlemma sub_typ_proper_not_simple [simp]:\n \"\\ TYPE('a::c_type) <\\<^sub>\\ TYPE('b::simple_mem_type)\"\napply(cases \"typ_uinfo_t TYPE('b)\")\napply(rename_tac typ_struct xs)\napply(case_tac typ_struct, auto simp: sub_typ_proper_def)\ndone\n\nlemma field_of_sub:\n \"field_of p s t \\ s \\ t\"\napply(simp add: field_of_def typ_tag_lt_def typ_tag_le_def)\napply auto\ndone\n\nlemma h_t_valid_neq_disjoint:\n \"\\ d,g \\\\<^sub>t (p::'a::c_type ptr); d,g' \\\\<^sub>t (q::'b::c_type ptr);\n \\ TYPE('b) <\\<^sub>\\ TYPE('a); \\ field_of_t p q \\ \\ {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\napply(clarsimp simp add: size_of_def h_t_valid_def sub_typ_proper_def field_of_t_def)\napply(drule (3) valid_footprint_neq_disjoint)\napply(clarsimp simp: )\ndone\n\nlemma field_ti_sub_typ:\n \"\\ field_ti (TYPE('b::mem_type)) f = Some t; export_uinfo t = (typ_uinfo_t TYPE('a::c_type)) \\ \\\n TYPE('a) \\\\<^sub>\\ TYPE('b)\"\napply(auto simp: field_ti_def sub_typ_def split: option.splits)\napply(drule td_set_field_lookupD)\napply(simp add: typ_tag_le_def)\napply(drule td_set_export_uinfoD)\napply(auto simp: typ_uinfo_t_def)\ndone\n\nlemma h_t_valid_neq_disjoint_simple:\n \"\\ d,g \\\\<^sub>t (p::'a::simple_mem_type ptr); d,g' \\\\<^sub>t (q::'b::simple_mem_type ptr) \\\n \\ ptr_val p \\ ptr_val q \\ typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE('b)\"\napply(auto simp: h_t_valid_def valid_footprint_def Let_def)\napply(drule_tac x=0 in spec)+\napply auto\napply(drule (1) map_prefix_same_cases[where xs=\"typ_slice_t (typ_uinfo_t TYPE('a)) 0\"])\napply(erule disjE)\n apply(drule typ_slice_sub)\n apply(case_tac \"typ_info_t TYPE('b)\")\n apply(rename_tac typ_struct xs)\n apply(case_tac \"typ_struct\")\n apply clarsimp\n apply(simp add: typ_tag_le_def)\n apply clarsimp\n apply(simp add: typ_uinfo_t_def)\n apply simp\napply(drule typ_slice_sub)\napply(case_tac \"typ_info_t TYPE('a)\")\napply(rename_tac typ_struct xs)\napply(case_tac \"typ_struct\")\n apply clarsimp\n apply(simp add: typ_tag_le_def typ_uinfo_t_def)\napply simp\ndone\n\nlemma h_val_heap_same:\n fixes p::\"'a::mem_type ptr\" and q::\"'b::c_type ptr\"\n assumes val_p: \"d,g \\\\<^sub>t p\" and\n val_q: \"d,g' \\\\<^sub>t q\" and\n subt: \"\\ TYPE('a) <\\<^sub>\\ TYPE('b)\" and nf: \"\\ field_of_t q p\"\n shows \"h_val (heap_update p v h) q = h_val h q\"\nproof -\n from val_p val_q subt nf have \"{ptr_val p..+length (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p)))} \\\n {ptr_val q..+size_of TYPE('b)} = {}\"\n by (force dest: h_t_valid_neq_disjoint)\n hence \"heap_list (heap_update_list (ptr_val p) (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h)\n (size_of TYPE('b)) (ptr_val q) = heap_list h (size_of TYPE('b)) (ptr_val q)\"\n by - (erule heap_list_update_disjoint_same)\n thus ?thesis by (simp add: h_val_def heap_update_def)\nqed\n\nlemma peer_typI:\n \"typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b) \\ peer_typ (a::'a::c_type itself) (b::'b::c_type itself)\"\n by (simp add: peer_typ_def)\n\nlemma peer_typD:\n \"peer_typ TYPE('a::c_type) TYPE('b::c_type) \\ \\ TYPE('a) <\\<^sub>\\ TYPE('b)\"\n by (clarsimp simp: peer_typ_def tag_disj_def sub_typ_proper_def order_less_imp_le)\n\nlemma peer_typ_refl [simp]:\n \"peer_typ t t\"\n by (simp add: peer_typ_def)\n\nlemma peer_typ_simple [simp]:\n \"peer_typ TYPE('a::simple_mem_type) TYPE('b::simple_mem_type)\"\napply(clarsimp simp: peer_typ_def tag_disj_def typ_tag_le_def typ_uinfo_t_def)\napply(erule disjE)\n apply(case_tac \"typ_info_t TYPE('b)\", simp)\n apply(rename_tac typ_struct xs)\n apply(case_tac typ_struct, simp+)\napply(case_tac \"typ_info_t TYPE('a)\", simp)\napply(rename_tac typ_struct xs)\napply(case_tac typ_struct, simp+)\ndone\n\n(* FIXME: remove *)\nlemmas peer_typ_nlt = peer_typD\n\nlemma peer_typ_not_field_of:\n \"\\ peer_typ TYPE('a::c_type) TYPE('b::c_type); ptr_val p \\ ptr_val q \\ \\\n \\ field_of_t (q::'b ptr) (p::'a ptr)\"\napply(clarsimp simp: peer_typ_def )\napply(clarsimp simp: field_of_t_def field_of_def)\napply(erule disjE)\n apply clarsimp\n apply(drule td_set_size_lte)\n apply(subst (asm) unat_eq_zero)\n apply simp\napply(clarsimp simp: tag_disj_def)\napply(simp add: typ_tag_le_def)\ndone\n\nlemma h_val_heap_same_peer:\n \"\\ d,g \\\\<^sub>t (p::'a::mem_type ptr); d,g' \\\\<^sub>t (q::'b::c_type ptr);\n ptr_val p \\ ptr_val q; peer_typ TYPE('a) TYPE('b) \\ \\\n h_val (heap_update p v h) q = h_val h q\"\napply(erule (1) h_val_heap_same)\n apply(erule peer_typ_nlt)\napply(erule (1) peer_typ_not_field_of)\ndone\n\nlemma field_offset_footprint_cons_simp [simp]:\n \"field_offset_footprint p (x#xs) = {Ptr &(p\\x)} \\ field_offset_footprint p xs\"\napply(clarsimp simp: field_offset_footprint_def)\napply(case_tac x)\napply auto\ndone\n\nlemma heap_list_update_list [rule_format]:\n \"\\n x p h. n + x \\ length v \\ length v < addr_card \\\n heap_list (heap_update_list p v h) n (p + of_nat x) = take n (drop x v)\"\napply(induct_tac v)\n apply simp\napply(rename_tac a list)\napply clarsimp\napply(case_tac x)\n apply clarsimp\n apply(case_tac n)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply(subgoal_tac \"heap_update_list (p + of_nat 1) list (h(p := a)) p = a\")\n apply simp\n apply(subst heap_update_list_same)\n apply simp\n apply(simp add: addr_card)\n apply simp\n apply(drule_tac x=nat in spec)\n apply(drule_tac x=0 in spec)\n apply force\napply clarsimp\napply(drule_tac x=n in spec)\napply(drule_tac x=nat in spec)\napply clarsimp\napply(drule_tac x=\"p+1\" in spec)\napply(subgoal_tac \"p + 1 +of_nat nat = p + (of_nat nat + 1)\")\n apply (simp add: ac_simps)\napply unat_arith\ndone\n\n\nlemma typ_slice_td_set':\n \"\\s m n k. (s,m + n) \\ td_set t m \\ k < size_td s \\\n typ_slice_t s k \\ typ_slice_t t (n + k)\"\n \"\\s m n k. (s,m + n) \\ td_set_struct st m \\ k < size_td s \\\n typ_slice_t s k \\ typ_slice_struct st (n + k)\"\n \"\\s m n k. (s,m + n) \\ td_set_list ts m \\ k < size_td s \\\n typ_slice_t s k \\ typ_slice_list ts (n + k)\"\n \"\\s m n k. (s,m + n) \\ td_set_pair x m \\ k < size_td s \\\n typ_slice_t s k \\ typ_slice_pair x (n + k)\"\napply(induct t and st and ts and x)\n apply auto\n apply(drule_tac x=s in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=0 in spec)\n apply(drule_tac x=0 in spec)\n apply clarsimp\n apply(drule td_set_list_offset_le)\n apply simp\n apply(erule notE)\n apply(case_tac dt_pair, clarsimp)\n apply(rename_tac a)\n apply(subgoal_tac \"size_td s + n \\ size_td a\")\n apply simp\n apply(drule_tac td_set_offset_size_m)\n apply simp\napply(rotate_tac)\napply(drule_tac x=s in spec)\napply(case_tac dt_pair, clarsimp)\napply(rename_tac a)\napply(drule_tac x=\"m + size_td a\" in spec)\napply(drule_tac x=\"n - size_td a\" in spec)\napply(drule_tac x=\"k\" in spec)\napply clarsimp\napply(erule impE)\n apply(subgoal_tac \"m + size_td a + (n - size_td a) = m + n\")\n apply simp\n apply simp\n apply(drule td_set_list_offset_le)\n apply arith\napply(subgoal_tac \"n - size_td a + k = n + k - size_td a\")\n apply simp\napply(drule td_set_list_offset_le)\napply arith\ndone\n\nlemma typ_slice_td_set:\n \"\\ (s,n) \\ td_set t 0; k < size_td s \\ \\\n typ_slice_t s k \\ typ_slice_t t (n + k)\"\napply(insert typ_slice_td_set'(1) [of t])\napply(drule_tac x=s in spec)\napply(drule_tac x=0 in spec)\napply clarsimp\ndone\n\nlemma typ_slice_td_set_list:\n \"\\ (s,n) \\ td_set_list ts 0; k < size_td s \\ \\\n typ_slice_t s k \\ typ_slice_list ts (n + k)\"\napply(insert typ_slice_td_set'(3) [of ts])\napply(drule_tac x=s in spec)\napply(drule_tac x=0 in spec)\napply clarsimp\ndone\n\nlemma h_t_valid_sub:\n \"\\ d,g \\\\<^sub>t (p::'b::mem_type ptr);\n field_ti TYPE('b) f = Some t; export_uinfo t = (typ_uinfo_t TYPE('a)) \\ \\\n d,(\\x. True) \\\\<^sub>t ((Ptr &(p\\f))::'a::mem_type ptr)\"\napply(clarsimp simp: h_t_valid_def field_ti_def valid_footprint_def Let_def split: option.splits)\napply rule\n apply(simp add: typ_uinfo_t_def export_uinfo_def)\n apply(subst size_of_def [symmetric, where t=\"TYPE('a)\"])\n apply simp\napply clarsimp\napply(drule_tac x=\"field_offset TYPE('b) f + y\" in spec)\napply(erule impE)\n apply(simp add: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply(drule field_lookup_export_uinfo_Some)\n apply simp\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply(simp add: size_of_def)\napply clarsimp\napply(frule td_set_field_lookupD)\napply(clarsimp simp: field_lvalue_def ac_simps)\napply(drule td_set_export_uinfoD)\napply(drule_tac k=y in typ_slice_td_set)\n apply(simp add: size_of_def typ_uinfo_t_def)\napply(drule field_lookup_export_uinfo_Some)\napply(simp add: field_offset_def ac_simps field_offset_untyped_def typ_uinfo_t_def export_uinfo_def)\napply(erule (1) map_list_map_trans)\ndone\n\nlemma size_of_tag:\n \"size_td (typ_uinfo_t t) = size_of t\"\n by (simp add: size_of_def typ_uinfo_t_def)\n\nlemma size_of_neq_implies_typ_uinfo_t_neq [simp]:\n \"size_of TYPE('a::c_type) \\ size_of TYPE('b::c_type) \\ typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE('b)\"\n apply (metis size_of_tag)\n done\n\nlemma guard_mono_self [simp]:\n \"guard_mono g g\"\napply(clarsimp simp: guard_mono_def)\napply(frule td_set_field_lookupD)\napply(drule td_set_size_lte)\napply simp\ndone\n\nlemma field_lookup_offset_size:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t,n) \\\n size_td t + n \\ size_td (typ_info_t TYPE('a))\"\napply(drule td_set_field_lookupD)\napply(drule td_set_offset_size)\napply simp\ndone\n\nlemma sub_h_t_valid':\n \"\\ d,g \\\\<^sub>t (p::'a::mem_type ptr); field_lookup (typ_uinfo_t TYPE('a)) f 0\n = Some (typ_uinfo_t TYPE('b),n);\n guard_mono g (g'::'b::mem_type ptr_guard) \\ \\\n d,g' \\\\<^sub>t ((Ptr (ptr_val p + of_nat n))::'b::mem_type ptr)\"\napply(auto simp: h_t_valid_def guard_mono_def)\napply(clarsimp simp: valid_footprint_def Let_def size_of_tag)\napply(drule_tac x=\"n+y\" in spec, erule impE)\n prefer 2\n apply clarsimp\n apply(simp add: ac_simps)\n apply(drule td_set_field_lookupD)\n apply(drule typ_slice_td_set)\n apply(simp add: size_of_def typ_uinfo_t_def)\n apply(erule map_list_map_trans)\n apply(clarsimp simp: ac_simps)\napply(drule td_set_field_lookupD)\napply(drule td_set_offset_size)\napply(simp add: size_of_def typ_uinfo_t_def)\ndone\n\nlemma sub_h_t_valid:\n \"\\ d,g \\\\<^sub>t (p::'a::mem_type ptr); (typ_uinfo_t TYPE('b),n) \\\n td_set (typ_uinfo_t TYPE('a)) 0 (*; guard_mono g p g' *) \\ \\\n d,(\\x. True) \\\\<^sub>t ((Ptr (ptr_val p + of_nat n))::'b::mem_type ptr)\"\napply(subst (asm) td_set_field_lookup)\n apply(simp add: typ_uinfo_t_def export_uinfo_def wf_desc_map)\napply clarsimp\napply(rule sub_h_t_valid')\n apply assumption+\napply(clarsimp simp: guard_mono_def)\ndone\n\nlemma h_t_valid_mono:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b); guard_mono g g' \\ \\\n d,g \\\\<^sub>t (p::'a::mem_type ptr) \\ d,g' \\\\<^sub>t (Ptr (&(p\\f))::'b::mem_type ptr)\"\napply(clarsimp simp: field_lvalue_def)\napply(drule field_lookup_export_uinfo_Some)\napply(clarsimp simp: field_offset_def typ_uinfo_t_def field_offset_untyped_def)\napply(rule sub_h_t_valid')\n apply fast\n apply(clarsimp simp: typ_uinfo_t_def)\n apply fast\napply assumption\ndone\n\nlemma s_valid_mono:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b); guard_mono g g' \\ \\\n d,g \\\\<^sub>s (p::'a::mem_type ptr) \\ d,g' \\\\<^sub>s (Ptr (&(p\\f))::'b::mem_type ptr)\"\napply(unfold s_valid_def)\napply(erule (2) h_t_valid_mono)\ndone\n\nlemma take_heap_list_le [rule_format]:\n \"\\k x. k \\ n \\ take k (heap_list h n x) = heap_list h k x\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply(case_tac k)\n apply simp\napply clarsimp\ndone\n\nlemma drop_heap_list_le [rule_format]:\n \"\\k x. k \\ n \\ drop k (heap_list h n x) = heap_list h (n - k) (x + of_nat k)\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply(case_tac k)\n apply simp\napply(clarsimp simp: ac_simps)\ndone\n\nlemma h_val_field_from_bytes:\n \"\\ field_ti TYPE('a::{mem_type}) f = Some t;\n export_uinfo t = export_uinfo (typ_info_t TYPE('b::{mem_type})) \\ \\\n h_val (hrs_mem h) (Ptr &(pa\\f) :: 'b ptr) = from_bytes (access_ti\\<^sub>0 t (h_val (hrs_mem h) pa))\"\n apply (clarsimp simp: field_ti_def split: option.splits)\n apply (clarsimp simp: h_val_def)\n apply (frule field_lookup_export_uinfo_Some)\n apply (frule_tac bs=\"heap_list (hrs_mem h) (size_of TYPE('a)) (ptr_val pa)\" in fi_fa_consistentD)\n apply simp\n apply (clarsimp simp: field_lvalue_def field_offset_def\n field_offset_untyped_def typ_uinfo_t_def field_names_def\n access_ti\\<^sub>0_def)\n apply (subst drop_heap_list_le)\n apply(simp add: size_of_def)\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply simp\n apply(subst take_heap_list_le)\n apply(simp add: size_of_def)\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply simp\n apply (fold norm_bytes_def)\n apply (subgoal_tac \"size_td t = size_of TYPE('b)\")\n apply (clarsimp simp: norm)\n apply(clarsimp simp: size_of_def)\n apply(subst typ_uinfo_size [symmetric])\n apply(unfold typ_uinfo_t_def)\n apply(drule sym)\n apply simp\n done\n\nlemma lift_typ_heap_mono:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n lift_typ_heap g s (p::'a::mem_type ptr) = Some v;\n export_uinfo t = typ_uinfo_t TYPE('b); guard_mono g g'\n \\ \\\n lift_typ_heap g' s (Ptr (&(p\\f))::'b::mem_type ptr) = Some (from_bytes (access_ti\\<^sub>0 t v))\"\napply(auto simp: lift_typ_heap_if split: split_if_asm)\n prefer 2\n apply(drule (2) s_valid_mono)\n apply(erule impE)\n apply fast\n apply assumption\napply(clarsimp simp: heap_list_s_def)\napply(frule field_lookup_export_uinfo_Some)\napply(frule_tac bs=\"heap_list (proj_h s) (size_of TYPE('a)) (ptr_val p)\" in fi_fa_consistentD)\n apply simp\napply simp\n\napply(simp add: field_lvalue_def field_offset_def field_offset_untyped_def typ_uinfo_t_def field_names_def access_ti\\<^sub>0_def)\napply(subst drop_heap_list_le)\n apply(simp add: size_of_def)\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply simp\napply(subst take_heap_list_le)\n apply(simp add: size_of_def)\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply simp\napply(fold norm_bytes_def)\napply(subgoal_tac \"size_td t = size_of TYPE('b)\")\n apply(simp add: norm)\napply(clarsimp simp: size_of_def)\napply(subst typ_uinfo_size [symmetric])\napply(unfold typ_uinfo_t_def)\napply(drule sym)\napply simp\ndone\n\nlemma lift_t_mono:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n lift_t g s (p::'a::mem_type ptr) = Some v;\n export_uinfo t = typ_uinfo_t TYPE('b); guard_mono g g'\n \\ \\\n lift_t g' s (Ptr (&(p\\f))::'b::mem_type ptr) = Some (from_bytes (access_ti\\<^sub>0 t v))\"\napply(clarsimp simp: lift_t_def)\napply(drule_tac s=\"lift_state s\" in lift_typ_heap_mono)\napply auto\ndone\n\nlemma align_td_field_lookupD:\n \"field_lookup (t::'a typ_desc) f m = Some (s, n) \\ align_td s \\ align_td t\"\napply(simp add: align_td_field_lookup)\ndone\n\nlemma align_td_uinfo:\n \"align_td (typ_uinfo_t TYPE('a)) = align_td (typ_info_t TYPE('a::c_type))\"\n by (clarsimp simp: typ_uinfo_t_def)\n\nlemma align_field_uinfo:\n \"align_field (typ_uinfo_t TYPE('a)) = align_field (typ_info_t TYPE('a::c_type))\"\napply(auto simp: align_field_def)\n apply(drule field_lookup_export_uinfo_Some)\n apply(clarsimp simp: typ_uinfo_t_def)\n apply(force simp: align_td_uinfo)\napply(clarsimp simp: typ_uinfo_t_def)\napply(drule field_lookup_export_uinfo_Some_rev)\napply clarsimp\ndone\n\nlemma ptr_aligned_mono':\n \"\\ field_lookup (typ_uinfo_t TYPE('a)) f 0 = Some (typ_uinfo_t TYPE('b),n)\n \\ \\\n ptr_aligned (p::'a::mem_type ptr) \\ ptr_aligned (Ptr (&(p\\f))::'b::mem_type ptr)\"\napply(clarsimp simp: ptr_aligned_def align_of_def field_lvalue_def)\napply(subgoal_tac \"align_field (typ_uinfo_t (TYPE('a)))\")\n apply(subst (asm) align_field_def)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=\"typ_uinfo_t TYPE('b)\" in spec)\n apply(drule_tac x=n in spec)\n apply clarsimp\n apply(simp add: align_td_uinfo)\n apply(clarsimp simp: field_offset_def field_offset_untyped_def)\n apply(subst unat_word_ariths)\n apply(rule dvd_mod)\n apply(rule dvd_add)\n apply(subgoal_tac \"2^align_td (typ_info_t TYPE('b)) dvd (2::nat)^align_td (typ_info_t TYPE('a))\")\n apply(erule (1) dvd_trans)\n apply(rule power_le_dvd)\n apply(rule dvd_refl)\n apply(frule align_td_field_lookupD)\n apply(simp add: align_td_uinfo)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(frule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply(subst len_of_addr_card)\n apply(subgoal_tac \"n \\ size_of TYPE('a)\")\n apply(rule le_less_trans)\n apply fast\n apply simp\n apply(simp add: size_of_def)\n apply assumption\n apply(subst len_of_addr_card)\n apply(subgoal_tac \"align_of TYPE('b) dvd addr_card\")\n apply(subst (asm) align_of_def)\n apply simp\n apply simp\napply(subst align_field_uinfo)\napply(rule align_field)\ndone\n\nlemma ptr_aligned_mono:\n \"guard_mono (ptr_aligned::'a::mem_type ptr_guard) (ptr_aligned::'b::mem_type ptr_guard)\"\napply(auto simp: guard_mono_def)\napply(frule ptr_aligned_mono')\napply(erule impE)\n apply fast\napply(clarsimp simp: field_lvalue_def field_offset_def field_offset_untyped_def)\ndone\n\nlemma wf_desc_typ_tag [simp]:\n \"wf_desc (typ_uinfo_t TYPE('a::wf_type))\"\napply(simp add: typ_uinfo_t_def export_uinfo_def wf_desc_map)\ndone\n\nlemma sft1':\n \"sub_field_update_t (f#fs) p (v::'a::c_type) s = (let s' = sub_field_update_t fs p (v::'a::c_type) s in\n s'(Ptr &(p\\f) \\ from_bytes (access_ti\\<^sub>0 (field_typ TYPE('a) f)\n v))) |` dom (s::'b::c_type typ_heap)\"\napply(subst sft1)\napply(auto simp: Let_def size_of_def access_ti\\<^sub>0_def)\ndone\n\nlemma size_map_td:\n \"size (map_td f t) = size t\"\n \"size (map_td_struct f st) = size st\"\n \"size_list (size_dt_pair size (size_list size_char)) (map_td_list f ts) = size_list (size_dt_pair size (size_list size_char)) ts\"\n \"size_dt_pair size (size_list size_char) (map_td_pair f x) = size_dt_pair size (size_list size_char) x\"\napply(induct t and st and ts and x)\napply (auto simp: size_char_def)\ndone\n\n(* case where 'b is a field type of 'a *)\n\nlemma field_names_size':\n \"field_names t s \\ [] \\ size s \\ size (t::'a typ_info)\"\n \"field_names_struct st s \\ [] \\ size s \\ size (st::'a field_desc typ_struct)\"\n \"field_names_list ts s \\ [] \\ size s \\ size_list (size_dt_pair size (size_list size_char)) (ts::('a typ_info,field_name) dt_pair list)\"\n \"field_names_pair x s \\ [] \\ size s \\ size_dt_pair size (size_list size_char) (x::('a typ_info,field_name) dt_pair)\"\napply(induct t and st and ts and x)\n apply(auto simp: size_map_td size_char_def)\ndone\n\nlemma field_names_size:\n \"f \\ set (field_names t s) \\ size s \\ size (t::'a typ_info)\"\napply(case_tac \"field_names t s = []\")\n apply simp\napply(simp add: field_names_size')\ndone\n\nlemma field_names_size_struct:\n \"f \\ set (field_names_struct st s) \\ size s \\ size (st)\"\napply(case_tac \"field_names_struct st s = []\")\n apply simp\napply(simp add: field_names_size')\ndone\n\nlemma field_names_Some3:\n \"\\f m s n. field_lookup (t::'a typ_info) f m = Some (s,n) \\ f \\ set (field_names t (export_uinfo s))\"\n \"\\f m s n. field_lookup_struct (st::'a field_desc typ_struct) f m = Some (s,n) \\ f \\ set (field_names_struct st (export_uinfo s))\"\n \"\\f m s n. field_lookup_list (ts::('a typ_info,field_name) dt_pair list) f m = Some (s,n) \\ f \\ set (field_names_list ts (export_uinfo s))\"\n \"\\f m s n. field_lookup_pair (x::('a typ_info,field_name) dt_pair) f m = Some (s,n) \\ f \\ set (field_names_pair x (export_uinfo s))\"\napply(induct t and st and ts and x)\n apply clarsimp\n apply((erule allE)+, erule impE)\n apply fast\n apply simp\n apply(drule field_names_size_struct)\n apply(simp add: size_map_td)\n apply (auto split: option.splits)[4]\napply clarsimp\napply(case_tac f, fastforce+)\ndone\n\nlemma field_names_SomeD3:\n \"field_lookup (t::'a typ_info) f m = Some (s,n) \\\n f \\ set (field_names t (export_uinfo s))\"\napply(simp add: field_names_Some3)\ndone\n\nlemma empty_not_in_field_names [simp]:\n \"[] \\ set (field_names_pair x s)\"\napply(case_tac x, auto)\ndone\n\nlemma empty_not_in_field_names_list [simp]:\n \"[] \\ set (field_names_list ts s)\"\napply(induct_tac ts, auto)\ndone\n\nlemma empty_not_in_field_names_struct [simp]:\n \"[] \\ set (field_names_struct st s)\"\napply(case_tac st, auto)\ndone\n\nlemma field_names_Some:\n \"\\m f. f \\ set (field_names (t::'a typ_info) s) \\ (field_lookup t f m \\ None)\"\n \"\\m f. f \\ set (field_names_struct (st::'a field_desc typ_struct) s) \\ (field_lookup_struct st f m \\ None)\"\n \"\\m f. f \\ set (field_names_list (ts::('a typ_info,field_name) dt_pair list) s) \\ (field_lookup_list ts f m \\ None)\"\n \"\\m f. f \\ set (field_names_pair (x::('a typ_info,field_name) dt_pair) s) \\ (field_lookup_pair x f m \\ None)\"\napply(induct t and st and ts and x)\n apply auto\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply clarsimp\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=f in spec)\n apply clarsimp\n apply(clarsimp split: option.splits)\napply(case_tac f, simp+)\ndone\n\nlemma dt_snd_field_names_list_simp [simp]:\n \"\\f fs s. f \\ dt_snd ` set xs \\ \\ f#fs \\ set (field_names_list xs s)\"\napply(induct_tac xs, clarsimp)\napply(rename_tac a list)\napply(case_tac a, auto)\ndone\n\nlemma field_names_Some2:\n \"\\m f. wf_desc t \\ f \\ set (field_names (t::'a typ_info) s) \\ (\\n k. field_lookup t f m = Some (k,n) \\ export_uinfo k = s)\"\n \"\\m f. wf_desc_struct st \\ f \\ set (field_names_struct (st::'a field_desc typ_struct) s) \\ (\\n k. field_lookup_struct st f m = Some (k,n) \\ export_uinfo k = s)\"\n \"\\m f. wf_desc_list ts \\ f \\ set (field_names_list (ts::('a typ_info,field_name) dt_pair list) s) \\ (\\n k. field_lookup_list ts f m = Some (k,n) \\ export_uinfo k = s)\"\n \"\\m f. wf_desc_pair x \\ f \\ set (field_names_pair (x::('a typ_info,field_name) dt_pair) s) \\ (\\n k. field_lookup_pair x f m = Some (k,n) \\ export_uinfo k = s )\"\napply(induct t and st and ts and x)\n apply(auto simp: export_uinfo_def)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply(clarsimp simp: split: option.split)\n apply(clarsimp split: option.splits)\n apply(case_tac dt_pair, clarsimp split: split_if_asm)\n apply(case_tac f, clarsimp+)\napply(case_tac f, simp+)\ndone\n\nlemma field_names_SomeD2:\n \"\\ f \\ set (field_names (t::'a typ_info) s); wf_desc t \\ \\\n (\\n k. field_lookup t f m = Some (k,n) \\ export_uinfo k = s)\"\n by (simp add: field_names_Some2)\n\nlemma field_names_SomeD:\n \"f \\ set (field_names (t::'a typ_info) s) \\ (field_lookup t f m \\ None)\"\n by (simp add: field_names_Some)\n\nlemma lift_t_sub_field_update' [rule_format]:\n \"\\ d,g' \\\\<^sub>t p; \\ (TYPE('a) <\\<^sub>\\ TYPE('b)) \\ \\ fs_consistent fs TYPE('a) TYPE('b) \\\n (\\K. K = UNIV - (((field_offset_footprint p (field_names (typ_info_t TYPE('a)) (typ_uinfo_t TYPE('b))))) - (field_offset_footprint p fs)) \\\n lift_t g (heap_update p (v::'a::mem_type) h,d) |` K =\n sub_field_update_t fs p v ((lift_t g (h,d))::'b::mem_type typ_heap) |` K)\"\napply(induct_tac fs)\n apply clarsimp\n apply(rule ext)\n apply(clarsimp simp: lift_t_if restrict_map_def)\n apply(erule (2) h_val_heap_same)\n apply(clarsimp simp: field_of_t_def)\n apply(clarsimp simp: field_offset_footprint_def field_of_def)\n apply(case_tac x)\n apply(clarsimp simp: field_lvalue_def)\n apply(subst (asm) td_set_field_lookup)\n apply(simp add:)\n apply(clarsimp simp: field_offset_def field_offset_untyped_def)\n apply(drule_tac x=f in spec)\n apply clarsimp\n apply(simp add: typ_uinfo_t_def)\n apply(drule field_lookup_export_uinfo_Some_rev)\n apply clarsimp\n apply(drule field_names_SomeD3)\n apply simp\napply(rename_tac a list)\napply clarify\napply clarsimp\napply(erule impE)\n apply(clarsimp simp: fs_consistent_def)\napply (rule conjI)\n prefer 2\n apply clarsimp\n apply(rule ccontr, clarsimp)\n apply(erule notE, rule ext)\n apply(case_tac \"x \\ Ptr &(p\\a)\")\n apply(clarsimp simp: restrict_map_def)\n apply(drule_tac x=x in fun_cong)\n apply clarsimp\n apply(rule ccontr, clarsimp)\n apply(erule_tac P=\"x \\ dom (lift_t g (h, d))\" in impE)\n apply(clarsimp simp: lift_t_if h_t_valid_def split: split_if_asm)\n apply clarsimp\n apply clarsimp\n apply(clarsimp simp: restrict_map_def)\n apply(rule, clarsimp)\n apply(clarsimp simp: lift_t_if)\napply clarsimp\napply(rule ext)\napply(case_tac \"x \\ Ptr &(p\\a)\")\n apply(clarsimp simp: restrict_map_def)\n apply(drule_tac x=x in fun_cong)\n apply clarsimp\n apply(clarsimp simp: lift_t_if split: split_if_asm)\n apply(erule impE)\n apply clarsimp\n apply clarsimp\napply(clarsimp simp: lift_t_if)\napply rule\n apply clarsimp\n apply(clarsimp simp: h_val_def heap_update_def field_lvalue_def)\n apply(subst heap_list_update_list)\n apply simp\n apply(simp add: size_of_def)\n apply(clarsimp simp: fs_consistent_def)\n apply(subst typ_uinfo_size [symmetric])\n apply(subst typ_uinfo_size [symmetric])\n apply(drule_tac m=0 in field_names_SomeD2)\n apply clarsimp+\n apply(frule_tac m=0 in td_set_field_lookupD)\n apply(clarsimp simp: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply(drule field_lookup_export_uinfo_Some)\n apply simp\n apply(drule td_set_export_uinfoD)\n apply(simp add: export_uinfo_def)\n apply(drule td_set_offset_size)\n apply simp\n apply(clarsimp simp: fs_consistent_def)\n apply(drule_tac m=0 in field_names_SomeD2, clarsimp+)\n apply(frule_tac bs=\"to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))\" in fi_fa_consistentD)\n apply simp\n apply(simp add: size_of_def)\n apply(frule field_lookup_export_uinfo_Some)\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"size_td k = size_td (typ_info_t TYPE('b))\")\n prefer 2\n apply(subst export_uinfo_size [symmetric])\n apply simp\n apply simp\n apply(rule sym)\n apply(fold norm_bytes_def)\n apply(subst typ_uinfo_size [symmetric])\n apply(drule_tac t=\"Some (k,n)\" in sym)\n apply(simp only: typ_uinfo_t_def)\n apply(simp)\n apply(clarsimp simp: access_ti\\<^sub>0_def field_typ_def field_typ_untyped_def)\n apply(drule_tac s=\"Some (k,n)\" in sym)\n apply simp\n apply(rule norm)\n apply simp\n apply(simp add: size_of_def)\n apply(subst typ_uinfo_size [symmetric])+\n apply(drule td_set_field_lookupD, drule td_set_offset_size)\n apply(clarsimp simp: min_def split: split_if_asm)\n apply arith\napply(clarsimp split: split_if_asm)\ndone\n\nlemma lift_t_sub_field_update:\n \"\\ d,g' \\\\<^sub>t p; \\ (TYPE('a) <\\<^sub>\\ TYPE('b)) (*; guard_mono g' p g *)\\ \\\n lift_t g (heap_update p (v::'a::mem_type) h,d) =\n sub_field_update_t (field_names (typ_info_t TYPE('a)) (typ_uinfo_t TYPE('b))) p v\n ((lift_t g (h,d))::'b::mem_type typ_heap)\"\napply(drule_tac fs=\"(field_names (typ_info_t TYPE('a)) (typ_uinfo_t TYPE('b)))\" in lift_t_sub_field_update', assumption+)\n apply(clarsimp simp: fs_consistent_def)\n apply fast\napply(simp add: restrict_map_def)\ndone\n\n(* Bornat-style *)\n\n\nlemma intvl_disj_offset:\n \"{x + a..+c} \\ {x + b..+d} = {} = ({a..+c} \\ {b..+d} = {})\"\napply auto\n apply(subgoal_tac \"x + xa \\ {x + a..+c}\")\n apply(subgoal_tac \"x + xa \\ {x + b..+d}\")\n apply fast\n apply(clarsimp simp: intvl_def)\n apply(clarsimp simp: intvl_def)\napply(subgoal_tac \"x - xa \\ {a..+c}\")\n apply(subgoal_tac \"x - xa \\ {b..+d}\")\n apply fast\n apply(clarsimp simp: intvl_def)\n apply force\napply(clarsimp simp: intvl_def)\napply force\ndone\n\nlemma intvl_sub_offset:\n \"unat x+y \\ z \\ {k+x..+y} \\ {k..+z}\"\napply(clarsimp simp: intvl_def)\napply(rule_tac x=\"unat x + k\" in exI)\napply clarsimp\ndone\n\nlemma lift_t_field_ind:\n \"\\ d,g' \\\\<^sub>t (p::'b::mem_type ptr); d,ga \\\\<^sub>t (q::'b ptr);\n field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (a,ba);\n field_lookup (typ_info_t TYPE('b::mem_type)) z 0 = Some (c,da) ;\n size_td a = size_of TYPE('a); size_td c = size_of TYPE('c);\n \\ f \\ z; \\ z \\ f \\ \\\n lift_t g (heap_update (Ptr (&(p\\f))) (v::'a::mem_type) h,d) (Ptr (&(q\\z))) =\n ((lift_t g (h,d) (Ptr (&(q\\z))))::'c::c_type option)\"\napply(clarsimp simp: lift_t_if h_val_def heap_update_def)\napply(subgoal_tac \"(heap_list (heap_update_list &(p\\f) (to_bytes v (heap_list h (size_of TYPE('a)) &(p\\f))) h)\n (size_of TYPE('c)) &(q\\z)) =\n (heap_list h (size_of TYPE('c)) &(q\\z))\")\n apply(drule_tac f=from_bytes in arg_cong)\n apply simp\napply(rule heap_list_update_disjoint_same)\napply simp\napply(simp add: field_lvalue_def field_offset_def field_offset_untyped_def)\napply(simp add: typ_uinfo_t_def field_lookup_export_uinfo_Some)\napply(frule field_lookup_export_uinfo_Some[where s=c])\napply(case_tac \"ptr_val p = ptr_val q\")\n apply clarsimp\n apply(subst intvl_disj_offset)\n apply(drule fa_fu_lookup_disj_interD)\n apply fast\n apply(simp add: disj_fn_def)\n apply simp\n apply(subst size_of_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\n apply simp\napply clarsimp\napply(drule (1) h_t_valid_neq_disjoint)\n apply simp\n apply(rule peer_typ_not_field_of)\n apply simp\n apply clarsimp\napply(subgoal_tac \"{ptr_val p + of_nat ba..+size_td a} \\ {ptr_val p..+size_of TYPE('b)}\")\n apply(subgoal_tac \"{ptr_val q + of_nat da..+size_td c} \\ {ptr_val q..+size_of TYPE('b)}\")\n apply simp\n apply fast\n apply(rule intvl_sub_offset)\n apply(simp add: size_of_def)\n apply(drule td_set_field_lookupD[where k=\"(c,da)\"])\n apply(drule td_set_offset_size)\n apply(subst word_unat.eq_norm)\n apply(subst len_of_addr_card)\n apply(subst mod_less)\n apply(subgoal_tac \"size_td c + da < addr_card\")\n apply arith\n apply(erule le_less_trans)\n apply(subst size_of_def [symmetric, where t=\"TYPE ('b)\"])\n apply simp\n apply simp\napply(rule intvl_sub_offset)\napply(simp add: size_of_def)\napply(drule td_set_field_lookupD)\napply(drule td_set_offset_size)\napply(subst word_unat.eq_norm)\napply(subst len_of_addr_card)\napply(subst mod_less)\n apply(subgoal_tac \"size_td a + ba < addr_card\")\n apply arith\n apply(erule le_less_trans)\n apply(subst size_of_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\napply simp\ndone\n\n\n\n(* case where 'b contains a field of type of 'a *)\n\nlemma uvt1':\n \"update_value_t (f#fs) v (w::'b) x = (if x=field_offset TYPE('b) f then\n update_ti_t (field_typ TYPE('b) f) (to_bytes_p (v::'a::c_type)) (w::'b::c_type) else update_value_t fs v w x)\"\n by simp\n\nlemma field_typ_self [simp]:\n \"field_typ TYPE('a) [] = typ_info_t TYPE('a::c_type)\"\n by (simp add: field_typ_def field_typ_untyped_def)\n\nlemma field_of_t_less_size:\n \"field_of_t (p::'a::mem_type ptr) (x::'b::c_type ptr) \\\n unat (ptr_val p - ptr_val x) < size_of TYPE('b)\"\napply(simp add: field_of_t_def field_of_def)\napply(drule td_set_offset_size)\napply(subgoal_tac \"0 < size_td (typ_info_t TYPE('a)) \")\n apply(simp add: size_of_def)\napply(subst size_of_def [symmetric, where t=\"TYPE('a)\"])\napply simp\ndone\n\nlemma unat_minus:\n \"x \\ 0 \\ unat (- (x::addr)) = addr_card - unat x\"\napply(simp add: unat_def)\napply(subst uint_word_ariths)\napply(subst zmod_zminus1_eq_if)\napply(simp split: split_if_asm)\napply(rule, clarsimp)\n apply(drule word_uint.Rep_inverse')\n apply(subst (asm) word_uint.inverse_norm)\n apply simp\n apply(subst (asm) uint_0_iff)\n apply simp\napply clarsimp\napply(subst nat_diff_distrib)\n apply simp\n apply(rule order_less_imp_le)\n apply(rule pos_mod_bound)\n apply simp\napply(simp add: addr_card)\napply(subst mod_pos_pos_trivial)\n apply simp\n apply(rule order_less_le_trans)\n apply(rule uint_lt2p)\n apply simp\napply simp\ndone\n\nlemma field_of_t_nmem:\n \"\\ field_of_t p q; ptr_val p \\ ptr_val (q::'b::mem_type ptr) \\ \\\n ptr_val q \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)}\"\napply(simp add: field_of_t_def field_of_def)\napply(clarsimp simp: intvl_def)\napply(drule td_set_offset_size)\napply(subst (asm) unat_minus)\n apply simp\napply(simp add: size_of_def)\napply(subgoal_tac \"size_td (typ_info_t TYPE('b)) < addr_card\")\n apply(simp only: unat_simps)\n apply(subst (asm) mod_less)\n apply(subst (asm) size_of_def [symmetric, where t=\"TYPE('a)\"])\n apply(erule less_trans)\n apply simp\n apply simp\napply(subst size_of_def [symmetric, where t=\"TYPE('b)\"])\napply simp\ndone\n\nlemma field_of_t_init_neq_disjoint:\n \"field_of_t p (x::'b::mem_type ptr) \\\n {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n {ptr_val x..+unat (ptr_val p - ptr_val x)} = {}\"\napply(case_tac \"ptr_val p = ptr_val x\")\n apply simp\napply(rule ccontr)\napply(drule intvl_inter)\napply(erule disjE)\n apply(drule intvlD, clarsimp)\n apply(subgoal_tac \"k < 2 ^ len_of TYPE(32)\")\n apply(simp only: unat_simps)\n apply(rule less_trans)\n prefer 2\n apply(rule_tac x=\"(of_nat k)::addr\" in unat_lt2p)\n apply simp\napply(simp add: field_of_t_nmem)\ndone\n\nlemma field_of_t_final_neq_disjoint:\n \"field_of_t (p::'a ptr) (x::'b ptr) \\ {ptr_val p..+size_of TYPE('a::mem_type)} \\\n {ptr_val p + of_nat (size_of TYPE('a))..+size_of TYPE('b::mem_type) -\n (unat (ptr_val p - ptr_val x) + size_of TYPE('a))} = {}\"\napply(rule ccontr)\napply(drule intvl_inter)\napply(erule disjE)\n apply(subgoal_tac \"ptr_val p\n \\ {ptr_val p +\n of_nat\n (size_of\n TYPE('a))..+size_of TYPE('b) -\n (unat (ptr_val p - ptr_val x) + size_of TYPE('a))}\")\n apply simp\n apply(rule intvl_offset_nmem)\n apply(rule intvl_self)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(rule max_size)\n apply(rule sz_nzero)\n apply(subst len_of_addr_card)\n apply(thin_tac \"x \\ S\" for x S)\n apply(simp add: field_of_t_def field_of_def)\n apply(drule td_set_offset_size)\n apply(simp add: size_of_def)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst size_of_def [symmetric])\n apply(subst len_of_addr_card)\n apply(rule max_size)\n apply(subgoal_tac \"size_of TYPE('b) < addr_card\")\n apply(simp add: size_of_def)\n apply(rule max_size)\napply(drule intvlD, clarsimp)\napply(subst (asm) word_unat.norm_eq_iff [symmetric])\napply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(rule max_size)\napply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\napply simp\ndone\n\nlemma h_val_super_update_bs:\n \"field_of_t p x \\ h_val (heap_update p (v::'a::mem_type) h) (x::'b::mem_type ptr) =\n from_bytes (super_update_bs (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p)) ) (heap_list h (size_of TYPE('b)) (ptr_val x)) (unat (ptr_val p - ptr_val x)))\"\napply(simp add: h_val_def)\napply(rule_tac f=from_bytes in arg_cong)\napply(simp add: heap_update_def super_update_bs_def)\napply(subst heap_list_split [of \"unat (ptr_val p - ptr_val x)\" \"size_of TYPE('b)\"])\n apply(drule field_of_t_less_size)\n apply simp\napply simp\napply(subst heap_list_update_disjoint_same)\n apply(drule field_of_t_init_neq_disjoint)\n apply simp\napply(subst take_heap_list_le)\n apply(drule field_of_t_less_size)\n apply simp\napply simp\napply(subst heap_list_split [of \"size_of TYPE('a)\"\n \"size_of TYPE('b) - unat (ptr_val p - ptr_val x)\"])\n apply(frule field_of_t_less_size)\n apply(simp add: field_of_t_def field_of_def)\n apply(drule td_set_offset_size)\n apply(simp add: size_of_def)\napply clarsimp\napply rule\n apply(simp add: heap_list_update_to_bytes)\napply(subst heap_list_update_disjoint_same)\n apply(drule field_of_t_final_neq_disjoint)\n apply(simp)\napply(subst drop_heap_list_le)\n apply(simp add: field_of_t_def field_of_def)\n apply(drule td_set_offset_size)\n apply(simp add: size_of_def)\napply simp\ndone\n\nlemma update_field_update':\n \"n \\ (\\f. field_offset TYPE('b) f) ` set fs \\\n (\\f. update_value_t fs (v::'a::c_type) (v'::'b::c_type) n =\n field_update (field_desc (field_typ TYPE('b) f)) (to_bytes_p v) v' \\ f \\ set fs \\ n = field_offset TYPE('b) f)\"\n by (induct fs) auto\n\nlemma update_field_update:\n \"field_of_t (p::'a ptr) (x::'b ptr) \\\n \\f. update_value_t (field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a))) (v::'a::c_type)\n (v'::'b::mem_type) (unat (ptr_val p - ptr_val x)) =\n field_update (field_desc (field_typ TYPE('b) f)) (to_bytes_p v) v' \\\n f \\ set (field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a))) \\\n unat (ptr_val p - ptr_val x) = field_offset TYPE('b) f\"\napply(rule update_field_update')\napply(clarsimp simp: image_def field_offset_def field_of_t_def field_of_def field_offset_untyped_def)\napply(subst (asm) td_set_field_lookup)\n apply simp\napply clarsimp\napply(simp add: typ_uinfo_t_def)\napply(rule_tac x=\"f\" in bexI)\n apply simp+\napply(drule field_lookup_export_uinfo_Some_rev)\napply clarsimp\napply(drule field_names_SomeD3)\napply clarsimp\ndone\n\nlemma length_fa_ti:\n \"\\ wf_fd s; length bs = size_td s \\ \\\n length (access_ti s w bs) = size_td s\"\napply(drule wf_fd_consD)\napply(clarsimp simp: fd_cons_def fd_cons_length_def fd_cons_desc_def)\ndone\n\nlemma fa_fu_v:\n \"\\ wf_fd s; length bs = size_td s; length bs' = size_td s \\ \\\n access_ti s (update_ti_t s bs v) bs' = access_ti s (update_ti_t s bs w) bs'\"\napply(drule wf_fd_consD)\napply(clarsimp simp: fd_cons_def fd_cons_access_update_def fd_cons_desc_def)\ndone\n\nlemma fu_fa:\n \"\\ wf_fd s; length bs = size_td s \\ \\\n update_ti_t s (access_ti s v bs) v = v\"\napply(drule wf_fd_consD)\napply(clarsimp simp: fd_cons_def fd_cons_update_access_def fd_cons_desc_def)\ndone\n\nlemma fu_fu:\n \"\\ wf_fd s; length bs = length bs' \\ \\\n update_ti_t s bs (update_ti_t s bs' v) = update_ti_t s bs v\"\napply(drule wf_fd_consD)\napply(clarsimp simp: fd_cons_def fd_cons_double_update_def fd_cons_desc_def)\ndone\n\n\nlemma fu_fa'_rpbs:\n \"\\ export_uinfo s = export_uinfo t; length bs = size_td s; wf_fd s;\n wf_fd t \\ \\\n update_ti_t s (access_ti t v bs) w =\n update_ti_t s (access_ti\\<^sub>0 t v) w\"\napply(clarsimp simp: access_ti\\<^sub>0_def)\napply(subgoal_tac \"size_td s = size_td t\")\n prefer 2\n apply(drule_tac f=size_td in arg_cong)\n apply(simp add: export_uinfo_def)\napply(frule_tac f=typ_norm in arg_cong)\napply(drule_tac x=\"access_ti t v bs\" in fun_cong)\napply(frule_tac bs=\"access_ti t v bs\" in wf_fd_norm_tuD[where t=t])\n apply(subst length_fa_ti)\n apply assumption\n apply (simp+)[2]\napply(frule_tac bs=\"access_ti t v bs\" in wf_fd_norm_tuD)\n apply(subst length_fa_ti)\n apply assumption\n apply simp+\napply(clarsimp simp: access_ti\\<^sub>0_def)\napply(thin_tac \"norm_tu X Y = Z\" for X Y Z)+\napply(subst (asm) fa_fu_v [where w=v])\n apply fast\n apply(subst length_fa_ti)\n apply assumption\n apply (simp+)[3]\napply(subst (asm) fa_fu_v [where w=w])\n apply fast\n apply(subst length_fa_ti)\n apply assumption\n apply (simp+)[3]\napply(subst (asm) fu_fa)\n apply simp\n apply simp\napply(drule_tac f=\"update_ti_t s\" in arg_cong)\napply(drule_tac x=\"(update_ti_t s (access_ti t v bs) w)\" in fun_cong)\napply(subst (asm) fu_fa)\n apply simp\n apply simp\napply(subst (asm) fu_fu)\n apply simp+\n apply(subst length_fa_ti)\n apply assumption\n apply simp+\n apply(subst length_fa_ti)\n apply assumption\n apply simp\n apply simp\napply auto\ndone\n\nlemma lift_t_super_field_update:\n \"\\ d,g' \\\\<^sub>t p; TYPE('a) \\\\<^sub>\\ TYPE('b) \\ \\\n lift_t g (heap_update p (v::'a::mem_type) h,d) =\n super_field_update_t p v\n ((lift_t g (h,d))::'b::mem_type typ_heap)\"\napply(rule ext)\napply(clarsimp simp: super_field_update_t_def split: option.splits)\napply(rule, clarsimp)\n apply(simp add: lift_t_if split: split_if_asm)\napply clarsimp\napply(rule, clarsimp)\n apply(simp add: lift_t_if split: split_if_asm)\n apply(subst h_val_super_update_bs)\n apply simp\n apply(drule sym)\n apply (rename_tac x1 x2)\n apply(drule_tac v=v and v'=x2 in update_field_update)\n apply clarsimp\n apply(clarsimp simp: h_val_def)\n apply(frule_tac m=0 in field_names_SomeD)\n apply simp\n apply clarsimp\n apply(subgoal_tac \"export_uinfo a = typ_uinfo_t TYPE('a)\")\n prefer 2\n apply(drule_tac m=0 in field_names_SomeD2)\n apply simp\n apply clarsimp\n apply(simp add: from_bytes_def)\n apply(frule_tac bs=\"heap_list h (size_of TYPE('b)) (ptr_val x1)\" and v=\"to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))\" and w=undefined in fi_fu_consistentD)\n apply simp\n apply(simp add: size_of_def)\n apply(simp add: size_of_def)\n apply(clarsimp simp: sub_typ_def)\n apply(clarsimp simp: typ_tag_le_def)\n apply(subst export_uinfo_size [symmetric])+\n apply simp\n apply(simp add: field_offset_def field_offset_untyped_def typ_uinfo_t_def)\n apply(frule field_lookup_export_uinfo_Some)\n apply simp\n apply(simp add: to_bytes_def to_bytes_p_def)\n apply(subst fu_fa'_rpbs)\n apply fast\n apply simp\n apply(simp add: size_of_def)\n apply(subst export_uinfo_size [symmetric])+\n apply simp\n apply(rule wf_fd_field_lookupD)\n apply fast\n apply simp\n apply simp\n apply(unfold access_ti\\<^sub>0_def)\n apply(subst export_uinfo_size [symmetric])+\n apply simp\n apply(simp add: size_of_def access_ti\\<^sub>0_def)\n apply(simp add: field_typ_def field_typ_untyped_def)\napply clarsimp\napply(frule lift_t_h_t_valid)\napply(simp add: lift_t_if)\napply(case_tac \"typ_uinfo_t TYPE('a) = typ_uinfo_t TYPE('b)\")\n apply(subst h_val_heap_same_peer)\n apply assumption\n apply assumption\n apply(clarsimp simp: field_of_t_def)\n apply(simp add: peer_typ_def)\n apply assumption\napply(drule (1) h_t_valid_neq_disjoint)\n apply(simp add: sub_typ_proper_def)\n apply(rule order_less_not_sym)\n apply(simp add: sub_typ_def)\n apply assumption\napply(simp add: h_val_def heap_update_def)\napply(subst heap_list_update_disjoint_same)\n apply simp\napply simp\ndone\n\nlemma field_names_same:\n \"k = export_uinfo ti \\ field_names ti k = [[]]\"\n by (case_tac ti, clarsimp)\n\nlemma lift_t_heap_update:\n \"d,g \\\\<^sub>t p \\ lift_t g (heap_update p v h,d) =\n (lift_t g (h,d) (p \\ (v::'a::mem_type)))\"\napply(subst lift_t_sub_field_update)\n apply fast\n apply(simp add: sub_typ_proper_def)\napply(simp add: typ_uinfo_t_def Let_def)\napply(subgoal_tac \"access_ti\\<^sub>0 (typ_info_t TYPE('a)) = to_bytes_p\")\n apply(simp add: field_names_same)\n apply(clarsimp simp: Let_def to_bytes_p_def)\n apply(rule, clarsimp)\n apply(rule ext, clarsimp simp: restrict_self_UNIV)\n apply clarsimp\n apply(clarsimp simp: h_t_valid_def lift_t_if)\napply(rule ext)\napply(simp add: to_bytes_p_def to_bytes_def size_of_def access_ti\\<^sub>0_def)\ndone\n\nlemma field_names_disj:\n \"typ_uinfo_t TYPE('a::c_type) \\\\<^sub>t typ_uinfo_t TYPE('b::mem_type) \\ field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a)) = []\"\napply(rule ccontr)\napply(subgoal_tac \"(\\k. k \\ set (field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a))))\")\n apply clarsimp\n apply(frule_tac m=0 in field_names_SomeD2, clarsimp+)\n apply(drule field_lookup_export_uinfo_Some)\n apply(drule td_set_field_lookupD)\n apply(clarsimp simp: tag_disj_def typ_tag_le_def typ_uinfo_t_def)\n apply(case_tac \"field_names (typ_info_t TYPE('b)) (typ_uinfo_t TYPE('a))\")\n apply simp+\napply fast\ndone\n\nlemma lift_t_heap_update_same:\n \"\\ d,g' \\\\<^sub>t (p::'b::mem_type ptr); typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b) \\ \\\n lift_t g (heap_update p v h,d) = ((lift_t g (h,d))::'a::mem_type typ_heap)\"\napply(subst lift_t_sub_field_update)\n apply fast\n apply(simp add: sub_typ_proper_def)\n apply(clarsimp simp: tag_disj_def)\n apply(drule order_less_imp_le)\n apply fast\napply(simp add: field_names_disj)\ndone\n\nlemma lift_heap_update:\n \"\\ d,g \\\\<^sub>t (p::'a ptr); d,g' \\\\<^sub>t q \\ \\ lift (heap_update p v h) q =\n ((lift h)(p := (v::'a::mem_type))) q\"\n by (simp add: lift_def h_val_heap_update h_val_heap_same_peer)\n\nlemma lift_heap_update_p [simp]:\n \"lift (heap_update p v h) p = (v::'a::mem_type)\"\n by (simp add: lift_def heap_update_def h_val_def heap_list_update_to_bytes)\n\nlemma lift_heap_update_same:\n \"\\ ptr_val p \\ ptr_val q; d,g \\\\<^sub>t (p::'a::mem_type ptr);\n d,g' \\\\<^sub>t (q::'b::mem_type ptr); peer_typ TYPE('a) TYPE('b) \\ \\\n lift (heap_update p v h) q = lift h q\"\n by (simp add: lift_def h_val_heap_same_peer)\n\nlemma lift_heap_update_same_type:\n fixes p::\"'a::mem_type ptr\" and q::\"'b::mem_type ptr\"\n assumes valid: \"d,g \\\\<^sub>t p\" \"d,g' \\\\<^sub>t q\"\n assumes type: \"typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b)\"\n shows \"lift (heap_update p v h) q = lift h q\"\nproof -\n from valid type have \"ptr_val p \\ ptr_val q\"\napply(auto simp: h_t_valid_def)\napply(drule (1) valid_footprint_sub)\n apply(clarsimp simp add: tag_disj_def order_less_imp_le)\napply clarsimp\napply(simp add: field_of_def)\napply(clarsimp simp: tag_disj_def typ_tag_le_def)\napply(erule notE)\napply(rule intvl_self)\napply(subst size_of_def [symmetric, where t=\"TYPE('b)\"])\napply simp\ndone\n thus ?thesis using valid type\napply -\napply (erule (2) lift_heap_update_same)\napply (erule peer_typI)\ndone\nqed\n\nlemma lift_heap_update_same_ptr_coerce:\n \"\\ ptr_val q \\ ptr_val p;\n d,g \\\\<^sub>t (ptr_coerce (q::'b::mem_type ptr)::'c::mem_type ptr);\n d,g' \\\\<^sub>t (p::'a::mem_type ptr);\n size_of TYPE('b) = size_of TYPE('c); peer_typ TYPE('a) TYPE('c) \\ \\\n lift (heap_update q v h) p = lift h p\"\napply(auto simp: lift_def h_val_def heap_update_def size_of_def)\napply(subst heap_list_update_disjoint_same)\n apply(drule (1) h_t_valid_neq_disjoint)\n apply(erule peer_typD)\n apply(erule peer_typ_not_field_of)\n apply simp\n apply(simp add: size_of_def)\napply simp\ndone\n\nlemma heap_footprintI:\n \"\\ valid_footprint d y t; x \\ {y..+size_td t} \\ \\ x \\ heap_footprint d t\"\n by (force simp: heap_footprint_def)\n\nlemma valid_heap_footprint:\n \"valid_footprint d x t \\ x \\ heap_footprint d t\"\n by (force simp: heap_footprint_def)\n\nlemma heap_valid_footprint:\n \"x \\ heap_footprint d t \\ \\y. valid_footprint d y t \\\n x \\ {y} \\ {y..+size_td t}\"\n by (simp add: heap_footprint_def)\n\nlemma heap_footprint_Some:\n \"x \\ heap_footprint d t \\ d x \\ (False,empty)\"\n by (auto simp: heap_footprint_def intvl_def valid_footprint_def Let_def)\n\n\n(* Retyping *)\n\nlemma dom_tll_empty [simp]:\n \"dom_tll p [] = {}\"\n by (clarsimp simp: dom_tll_def)\n\nlemma dom_s_upd [simp]:\n \"dom_s (\\b. if b = p then (True,a) else d b) =\n (dom_s d - {(p,y) | y. True}) \\ {(p,SIndexVal)} \\\n {(p,SIndexTyp n) | n. a n \\ None}\"\napply(unfold dom_s_def)\napply(case_tac \"d p\")\napply(auto split: split_if_asm)\ndone\n\nlemma dom_tll_cons [simp]:\n \"dom_tll p (x#xs) = dom_tll (p + 1) xs \\ {(p,SIndexVal)} \\\n {(p,SIndexTyp n) | n. x n \\ None}\"\napply(unfold dom_tll_def)\napply auto\n apply(case_tac x, simp+)\n apply(case_tac xa, simp+)\n apply(case_tac xa, simp+)\n apply(case_tac xa, simp+)\n apply(case_tac xa, simp+)\n apply(rule_tac x=0 in exI, simp)\n apply(rule_tac x=\"1 + x\" in exI, simp)\n apply(drule_tac x=\"1 + xa\" in spec)\n apply clarsimp\n apply fast\napply(drule_tac x=0 in spec)\napply force\ndone\n\nlemma one_plus_x_zero:\n \"(1::addr) + of_nat x = 0 \\ x \\ addr_card - 1\"\napply(simp add: addr_card)\napply(subst (asm) of_nat_1 [symmetric])\napply(subst (asm) Abs_fnat_homs)\napply(subst (asm) Word.of_nat_0)\napply auto\napply(case_tac q)\n apply simp+\ndone\n\nlemma htd_update_list_dom [rule_format, simp]:\n \"length xs < addr_card \\\n (\\p d. dom_s (htd_update_list p xs d) =\n (dom_s d(* - {(p + of_nat x,y) | x y. x < length xs}*))\n \\ dom_tll p xs)\"\napply(induct_tac xs)\n apply simp\napply clarsimp\napply(auto split: split_if_asm)\n apply(erule notE)\n apply(clarsimp simp: dom_s_def)\napply(case_tac y)\n apply clarsimp+\napply(clarsimp simp: dom_s_def)\ndone\n\n(* FIXME: this is clag from heap_update_list_same - should be able to prove\n this once for these kinds of update functions *)\nlemma htd_update_list_same:\n shows \"\\h p k. \\ 0 < k; k \\ addr_card - length v \\ \\\n (htd_update_list (p + of_nat k) v) h p = h p\"\nproof (induct v)\n case Nil show ?case by simp\nnext\n case (Cons x xs)\n have \"htd_update_list (p + of_nat k) (x # xs) h p =\n htd_update_list (p + of_nat (k + 1)) xs (h(p + of_nat k := (True,snd (h (p + of_nat k)) ++ x))) p\"\n by (simp add: ac_simps)\n also have \"\\ = (h(p + of_nat k := (True,snd (h (p + of_nat k)) ++ x))) p\"\n proof -\n from Cons have \"k + 1 \\ addr_card - length xs\" by simp\n with Cons show ?thesis by (simp only:)\n qed\n also have \"\\ = h p\"\n proof -\n from Cons have \"of_nat k \\ (0::addr)\"\n by - (erule of_nat_neq_0, simp add: addr_card)\n thus ?thesis by clarsimp\n qed\n finally show ?case .\nqed\n\nlemma htd_update_list_index [rule_format]:\n \"\\p d. length xs < addr_card \\ x \\ {p..+length xs} \\\n htd_update_list p xs d x = (True, snd (d x) ++ (xs ! (unat (x - p))))\"\napply(induct_tac xs)\n apply simp\napply clarsimp\napply(case_tac \"p=x\")\n apply simp\n apply(subst of_nat_1 [symmetric])\n apply(subst htd_update_list_same)\n apply simp+\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply(drule intvl_neq_start)\n apply simp+\napply(subgoal_tac \"unat (x - p) = unat (x - (p + 1)) + 1\")\n apply simp\napply (clarsimp simp: unatSuc[symmetric] field_simps)\ndone\n\nlemma typ_slices_length [simp]:\n \"length (typ_slices TYPE('a::c_type)) = size_of TYPE('a)\"\n by (simp add: typ_slices_def)\n\nlemma typ_slices_index [simp]:\n \"n < size_of TYPE('a::c_type) \\ typ_slices TYPE('a) ! n =\n list_map (typ_slice_t (typ_uinfo_t TYPE('a)) n)\"\n by (simp add: typ_slices_def)\n\nlemma empty_not_in_typ_slices [simp]:\n \"empty \\ set (typ_slices TYPE('a::c_type))\"\napply(auto simp: typ_slices_def)\napply(drule sym, simp)\ndone\n\nlemma dom_tll_s_footprint [simp]:\n \"dom_tll (ptr_val p) (typ_slices TYPE('a)) = s_footprint (p::'a::c_type ptr)\"\napply(clarsimp simp: typ_slices_def s_footprint_def s_footprint_untyped_def dom_tll_def size_of_def)\napply auto\n apply(rule_tac x=x in exI)\n apply clarsimp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: split_if_asm)\napply(drule_tac x=x in spec)\napply clarsimp\napply(case_tac \"typ_slice_t (typ_uinfo_t TYPE('a)) x ! n\")\napply fast\ndone\n\nlemma ptr_retyp_dom [simp]:\n \"dom_s (ptr_retyp (p::'a::mem_type ptr) d) =\n (dom_s d (*-{(ptr_val p + of_nat x,y) | x y. x < size_of TYPE('a)} *)) \\ s_footprint p\"\napply (simp add: ptr_retyp_def)\ndone\n\nlemma dom_s_empty_htd [simp]:\n \"dom_s empty_htd = {}\"\n by (clarsimp simp: empty_htd_def dom_s_def)\n\nlemma dom_s_nempty:\n \"d x \\ (False,empty) \\ \\k. (x,k) \\ dom_s d\"\napply(clarsimp simp: dom_s_def)\napply(case_tac \"d x\")\napply clarsimp\napply(erule disjE, clarsimp)\n apply(rule_tac x=\"SIndexVal\" in exI)\n apply simp\napply(subgoal_tac \"\\y. b y \\ None\")\n apply clarsimp\n apply(rule_tac x=\"SIndexTyp y\" in exI)\n apply clarsimp\napply(rule ccontr)\napply clarsimp\napply(erule notE)\napply(rule ext)\napply(drule_tac x=xa in spec)\napply(case_tac \"b xa\")\n apply simp\napply fast\ndone\n\nlemma ptr_retyp_None:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n ptr_retyp (p::'a::mem_type ptr) empty_htd x = (False,empty)\"\napply(insert ptr_retyp_dom [of p empty_htd])\napply(simp only: dom_s_empty_htd)\napply(rule ccontr)\napply(drule dom_s_nempty)\napply auto\napply(drule s_footprintD)\napply fast\ndone\n\nlemma ptr_retyp_footprint:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n ptr_retyp (p::'a::mem_type ptr) d x = (True,snd (d x) ++ list_map ((typ_slice_t (typ_uinfo_t TYPE('a))\n (unat (x - ptr_val p)))))\"\napply(clarsimp simp: ptr_retyp_def)\napply(subst htd_update_list_index)\n apply simp+\napply(subst typ_slices_index)\n apply(drule intvlD, clarsimp)\n apply(subst unat_simps)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\n apply simp+\ndone\n\nlemma ptr_retyp_Some:\n \"ptr_retyp (p::'a::mem_type ptr) d (ptr_val p) = (True,snd (d (ptr_val p)) ++ list_map (typ_slice_t (typ_uinfo_t TYPE('a)) 0))\"\napply(subst ptr_retyp_footprint)\n apply simp+\ndone\n\nlemma ptr_retyp_Some2:\n \"x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n ptr_retyp p d x \\ (False,empty)\"\n by (auto simp: ptr_retyp_Some ptr_retyp_footprint dest: intvl_neq_start)\n\nlemma snd_empty_htd [simp]:\n \"snd (empty_htd x) = empty\"\napply(auto simp: empty_htd_def)\ndone\n\nlemma ptr_retyp_d_empty:\n \"x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n (\\d. fst (ptr_retyp p d x)) \\\n snd (ptr_retyp p d x) = snd (d x) ++ snd (ptr_retyp p empty_htd x)\"\napply(auto simp: ptr_retyp_Some ptr_retyp_footprint dest: intvl_neq_start)\ndone\n\n\nlemma unat_minus_abs:\n \"x \\ y \\ unat ((x::addr) - y) = addr_card - unat (y - x)\"\napply(auto simp: unat_sub_if_size)\n apply(subst diff_diff_right)\n apply(simp add: word_size)\n apply(rule le_trans)\n apply(rule less_imp_le)\n apply(rule unat_lt2p)\n apply simp\n apply(subst diff_diff_left [symmetric])\n apply(simp add: word_size addr_card)+\ndone\n\nlemma ptr_retyp_d:\n \"x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n ptr_retyp p d x = d x\"\napply(simp add: ptr_retyp_def)\napply(subgoal_tac \"\\k. ptr_val p = x + of_nat k \\ 0 < k \\ k \\ addr_card - size_of TYPE('a)\")\n apply clarsimp\n apply(subst htd_update_list_same)\n apply simp+\napply(rule_tac x=\"unat (ptr_val p - x)\" in exI)\napply clarsimp\n apply(case_tac \"ptr_val p = x\")\n apply simp\n apply(erule notE)\n apply(rule intvl_self)\n apply simp\napply rule\n apply(subst unat_gt_0)\n apply clarsimp\napply(rule ccontr)\napply(erule notE)\napply(clarsimp simp: intvl_def)\napply(rule_tac x=\"unat (x - ptr_val p)\" in exI)\napply simp\napply(subst (asm) unat_minus_abs)\n apply simp\napply simp\ndone\n\nlemma ptr_retyp_valid_footprint_disjoint:\n \"\\ valid_footprint d p s; {p..+size_td s} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ valid_footprint (ptr_retyp (q::'b::mem_type ptr) d) p s\"\napply(clarsimp simp: valid_footprint_def Let_def)\napply rule\n apply(subst ptr_retyp_d)\n apply clarsimp\n apply(subgoal_tac \"p + of_nat y \\ {p..+size_td s}\")\n apply fast\n apply(erule intvlI)\n apply clarsimp\napply(subst ptr_retyp_d)\n apply clarsimp\n apply(subgoal_tac \"p + of_nat y \\ {p..+size_td s}\")\n apply fast\n apply(erule intvlI)\napply fast\ndone\n\nlemma ptr_retyp_disjoint:\n \"\\ d,g \\\\<^sub>t (q::'b::mem_type ptr); {ptr_val p..+size_of TYPE('a)} \\\n {ptr_val q..+size_of TYPE('b)} = {} \\ \\\n ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q\"\napply(clarsimp simp: h_t_valid_def)\napply(erule ptr_retyp_valid_footprint_disjoint)\napply(simp add: size_of_def)\napply fast\ndone\n\nlemma ptr_retyp_d_fst:\n \"(x,SIndexVal) \\ s_footprint (p::'a::mem_type ptr) \\\n fst (ptr_retyp p d x) = fst (d x)\"\napply(simp add: ptr_retyp_def)\napply(subgoal_tac \"\\k. ptr_val p = x + of_nat k \\ 0 < k \\ k \\ addr_card - size_of TYPE('a)\")\n apply clarsimp\n apply(subst htd_update_list_same)\n apply simp+\napply(rule_tac x=\"unat (ptr_val p - x)\" in exI)\napply clarsimp\n apply(case_tac \"ptr_val p = x\")\n apply simp\n apply(erule notE)\n apply(drule sym, simp)\napply rule\n apply(subst unat_gt_0)\n apply clarsimp\napply(rule ccontr)\napply(erule notE)\napply(subst (asm) unat_minus_abs)\n apply simp+\napply(clarsimp simp: s_footprint_def s_footprint_untyped_def)\napply(rule_tac x=\"unat (x - ptr_val p)\" in exI)\napply simp\napply(simp add: size_of_def)\ndone\n\n\n\nlemma ptr_retyp_d_eq_fst:\n \"fst (ptr_retyp p d x) = (if x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)}\n then True (*ptr_retyp p empty_htd x *) else fst (d x))\"\napply(auto)\n apply(drule_tac d=d in ptr_retyp_d_empty)\n apply auto\n apply(drule_tac d=d in ptr_retyp_d)\n apply simp\napply(drule_tac d=d in ptr_retyp_d)\napply simp\ndone\n\nlemma ptr_retyp_d_eq_snd:\n \"snd (ptr_retyp p d x) = (if x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)}\n then snd (d x) ++ snd (ptr_retyp p empty_htd x) else snd (d x))\"\napply(auto)\n apply(drule_tac d=d in ptr_retyp_d_empty)\n apply auto\napply(drule_tac d=d in ptr_retyp_d)\napply simp\ndone\n\nlemma lift_state_ptr_retyp_d_empty:\n \"x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n lift_state (h,ptr_retyp p d) (x,k) = (lift_state (h,d) ++ lift_state (h,ptr_retyp p empty_htd)) (x,k)\"\napply(clarsimp simp: lift_state_def map_add_def split: s_heap_index.splits)\napply auto\n apply(subst ptr_retyp_d_empty, simp+)\n apply(subst ptr_retyp_d_empty, simp+)\n apply(subst (asm) ptr_retyp_d_empty, simp+)\napply(subst ptr_retyp_d_empty, simp+)\napply(auto split: option.splits)\ndone\n\nlemma lift_state_ptr_retyp_d:\n \"x \\ {ptr_val (p::'a::mem_type ptr)..+size_of TYPE('a)} \\\n lift_state (h,ptr_retyp p d) (x,k) = lift_state (h,d) (x,k)\"\napply(clarsimp simp: lift_state_def split: s_heap_index.splits)\napply auto\n apply(simp add: ptr_retyp_d)+\ndone\n\nlemma ptr_retyp_valid_footprint:\n \"valid_footprint (ptr_retyp p d) (ptr_val (p::'a::mem_type ptr))\n (typ_uinfo_t TYPE('a))\"\napply(clarsimp simp: valid_footprint_def Let_def)\napply(subst size_of_def [symmetric, where t=\"TYPE('a)\"])\napply clarsimp\napply(subst ptr_retyp_footprint)\n apply(rule intvlI)\n apply(simp add: size_of_def)\napply(subst ptr_retyp_footprint)\n apply(rule intvlI)\n apply(simp add: size_of_def)\napply clarsimp\napply(subst unat_of_nat)\napply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subst size_of_def [symmetric, where t=\"TYPE('a)\"])\n apply(rule max_size)\napply simp\ndone\n\nlemma ptr_retyp_h_t_valid:\n \"g p \\ ptr_retyp p d,g \\\\<^sub>t (p::'a::mem_type ptr)\"\n by (simp add: h_t_valid_def ptr_retyp_valid_footprint)\n\nlemma ptr_retyp_s_valid:\n \"g p \\ lift_state (h,ptr_retyp p d),g \\\\<^sub>s (p::'a::mem_type ptr)\"\n by (simp add: s_valid_def proj_d_lift_state ptr_retyp_h_t_valid)\n\nlemma lt_size_of_unat_simps:\n \"k < size_of TYPE('a) \\ unat ((of_nat k)::addr) < size_of TYPE('a::mem_type)\"\napply(subst unat_simps)\napply(subst mod_less)\n apply(erule less_trans)\n apply(subst len_of_addr_card)\n apply simp+\ndone\n\nlemma ptr_retyp_h_t_valid_same:\n \"\\ d,g \\\\<^sub>t (p::'a::mem_type ptr); x \\ {ptr_val p..+size_of TYPE('a)} \\ \\\n snd (ptr_retyp p d x) \\\\<^sub>m snd (d x)\"\napply(auto simp: h_t_valid_def valid_footprint_def Let_def)\napply(subst ptr_retyp_footprint)\n apply simp\napply clarsimp\napply(drule_tac x=\"unat (x - ptr_val p)\" in spec)\napply clarsimp\napply(erule impE)\n apply(simp only: size_of_def [symmetric, where t=\"TYPE('a)\"])\n apply(drule intvlD, clarsimp)\n apply(simp only: lt_size_of_unat_simps)\napply clarsimp\napply(rule map_add_le_mapI)\n apply simp+\ndone\n\nlemma ptr_retyp_ptr_safe [simp]:\n \"ptr_safe p (ptr_retyp (p::'a::mem_type ptr) d)\"\n by (force intro: h_t_valid_ptr_safe ptr_retyp_h_t_valid)\n\n\nlemma lift_state_ptr_retyp_restrict:\n \"(lift_state (h, ptr_retyp p d) |` {(x,k). x \\ {ptr_val p..+size_of TYPE('a)}}) =\n (lift_state (h,d) |` {(x,k). x \\ {ptr_val p..+size_of TYPE('a)}}) ++ lift_state (h, ptr_retyp (p::'a::mem_type ptr) empty_htd)\" (is \"?x = ?y\")\nproof (rule ext, cases)\n fix x::\"addr \\ s_heap_index\"\n assume \"fst x \\ {ptr_val p..+size_of TYPE('a)}\"\n thus \"?x x = ?y x\"\napply -\napply(cases x)\napply(auto simp: lift_state_def map_add_def split: s_heap_index.splits)\n apply(drule ptr_retyp_d_empty, fast)\n apply(frule_tac d=d in ptr_retyp_d_empty, clarsimp simp: map_add_def)\n apply(clarsimp simp: restrict_map_def split: option.splits)\n apply(drule ptr_retyp_d_empty, fast)\n apply(drule ptr_retyp_d_empty, fast)\napply(frule_tac d=d in ptr_retyp_d_empty, clarsimp simp: map_add_def)\napply(clarsimp simp: restrict_map_def split: option.splits)\ndone\nnext\n fix x::\"addr \\ s_heap_index\"\n assume \"fst x \\ {ptr_val p..+size_of TYPE('a)}\"\n thus \"?x x = ?y x\"\napply -\napply(cases x)\napply simp\napply(auto simp: lift_state_def ptr_retyp_None map_add_def split: s_heap_index.splits)\ndone\nqed\n\n(* Old set of simps, not all that useful in general, below specialised\n simp sets are given *)\nlemmas typ_simps = lift_t_heap_update lift_t_heap_update_same lift_heap_update\n lift_t_h_t_valid h_t_valid_ptr_safe lift_t_ptr_safe lift_lift_t lift_t_lift\n tag_disj_def typ_tag_le_def typ_uinfo_t_def\n\ndeclare field_desc_def [simp del]\n\nlemma field_fd:\n \"field_fd (t::'a::c_type itself) n = (case field_lookup (typ_info_t TYPE('a)) n 0 of None \\ field_desc (fst (the (None::('a typ_info \\ nat) option))) | Some x \\ field_desc (fst x))\"\napply(auto simp: field_fd_def field_typ_def field_typ_untyped_def split: option.splits)\ndone\n\ndeclare field_desc_def [simp add ]\n\nlemma super_field_update_lookup:\n assumes \"field_lookup (typ_info_t TYPE('b)) f 0 = Some (s,n)\"\n and \"typ_uinfo_t TYPE('a) = export_uinfo s\"\n and \"lift_t g h p = Some v' \"\n shows \"super_field_update_t (Ptr (&(p\\f))) (v::'a::mem_type) ((lift_t g h)::'b::mem_type typ_heap) =\n (lift_t g h)(p \\ field_update (field_desc s) (to_bytes_p v) v')\"\nproof -\n from assms have \"size_of TYPE('b) < addr_card\" by simp\n with assms have [simp]: \"unat (of_nat n :: 32 word) = n\"\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(drule td_set_field_lookupD)+\n apply(drule td_set_offset_size)+\n apply(subst len_of_addr_card)\n apply(subst (asm) size_of_def [symmetric, where t=\"TYPE('b)\"])+\n apply arith\n apply simp\n done\n from assms show ?thesis\n apply(clarsimp simp: super_field_update_t_def)\n apply(rule ext)\n apply(auto simp: field_lvalue_def split: option.splits)\n apply(frule_tac v=v and v'=v' in update_field_update)\n apply clarsimp\n apply(thin_tac \"P = update_ti_t x y z\" for P x y z)\n apply(clarsimp simp: field_of_t_def field_of_def typ_uinfo_t_def)\n apply(frule_tac m=0 in field_names_SomeD2)\n apply simp\n apply clarsimp\n apply(simp add: field_typ_def field_typ_untyped_def)\n apply(frule field_lookup_export_uinfo_Some)\n apply(frule_tac s=k in field_lookup_export_uinfo_Some)\n apply simp\n apply(drule (1) field_lookup_inject)\n apply(subst typ_uinfo_t_def [symmetric, where t=\"TYPE('b)\"])\n apply simp\n apply simp\n apply(drule field_of_t_mem)+\n apply(case_tac h)\n apply(clarsimp simp: lift_t_if split: split_if_asm)\n apply(drule (1) h_t_valid_neq_disjoint)\n apply simp\n apply(clarsimp simp: field_of_t_def field_of_def)\n apply(drule td_set_size_lte)\n apply clarsimp\n apply(subst (asm) unat_eq_zero)\n apply clarsimp\n apply fast\n apply(clarsimp simp: field_of_t_def field_of_def)\n apply(subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply(frule field_lookup_export_uinfo_Some)\n apply(simp add: typ_uinfo_t_def)\n apply(clarsimp simp: field_of_t_def field_of_def)\n apply(subst (asm) td_set_field_lookup)\n apply simp\n apply simp\n apply(frule field_lookup_export_uinfo_Some)\n apply(simp add: typ_uinfo_t_def)\n done\nqed\n\n\n(* Should use these in lift/heap_update reductions *)\nlemmas typ_rewrs =\n lift_lift_t\n lift_t_heap_update\n lift_t_heap_update_same\n lift_t_heap_update [OF lift_t_h_t_valid]\n lift_t_heap_update_same [OF lift_t_h_t_valid]\n lift_lift_t [OF lift_t_h_t_valid]\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/umm_heap/TypHeap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.3522017684487511, "lm_q1q2_score": 0.19935272907083862}} {"text": "(* Title: HOL/Auth/Recur.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection\\The Otway-Bull Recursive Authentication Protocol\\\n\ntheory Recur imports Public begin\n\ntext\\End marker for message bundles\\\nabbreviation\n END :: \"msg\" where\n \"END == Number 0\"\n\n(*Two session keys are distributed to each agent except for the initiator,\n who receives one.\n Perhaps the two session keys could be bundled into a single message.\n*)\ninductive_set (*Server's response to the nested message*)\n respond :: \"event list \\ (msg*msg*key)set\"\n for evs :: \"event list\"\n where\n One: \"Key KAB \\ used evs\n \\ (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\,\n \\Crypt (shrK A) \\Key KAB, Agent B, Nonce NA\\, END\\,\n KAB) \\ respond evs\"\n\n (*The most recent session key is passed up to the caller*)\n | Cons: \"\\(PA, RA, KAB) \\ respond evs;\n Key KBC \\ used evs; Key KBC \\ parts {RA};\n PA = Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, P\\\\\n \\ (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\,\n \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\,\n KBC)\n \\ respond evs\"\n\n\n(*Induction over \"respond\" can be difficult due to the complexity of the\n subgoals. Set \"responses\" captures the general form of certificates.\n*)\ninductive_set\n responses :: \"event list => msg set\"\n for evs :: \"event list\"\n where\n (*Server terminates lists*)\n Nil: \"END \\ responses evs\"\n\n | Cons: \"\\RA \\ responses evs; Key KAB \\ used evs\\\n \\ \\Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ responses evs\"\n\n\ninductive_set recur :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ recur\"\n\n (*The spy MAY say anything he CAN say. Common to\n all similar protocols.*)\n | Fake: \"\\evsf \\ recur; X \\ synth (analz (knows Spy evsf))\\\n \\ Says Spy B X # evsf \\ recur\"\n\n (*Alice initiates a protocol run.\n END is a placeholder to terminate the nesting.*)\n | RA1: \"\\evs1 \\ recur; Nonce NA \\ used evs1\\\n \\ Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\)\n # evs1 \\ recur\"\n\n (*Bob's response to Alice's message. C might be the Server.\n We omit PA = \\XA, Agent A, Agent B, Nonce NA, P\\ because\n it complicates proofs, so B may respond to any message at all!*)\n | RA2: \"\\evs2 \\ recur; Nonce NB \\ used evs2;\n Says A' B PA \\ set evs2\\\n \\ Says B C (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\)\n # evs2 \\ recur\"\n\n (*The Server receives Bob's message and prepares a response.*)\n | RA3: \"\\evs3 \\ recur; Says B' Server PB \\ set evs3;\n (PB,RB,K) \\ respond evs3\\\n \\ Says Server B RB # evs3 \\ recur\"\n\n (*Bob receives the returned message and compares the Nonces with\n those in the message he previously sent the Server.*)\n | RA4: \"\\evs4 \\ recur;\n Says B C \\XH, Agent B, Agent C, Nonce NB,\n XA, Agent A, Agent B, Nonce NA, P\\ \\ set evs4;\n Says C' B \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ set evs4\\\n \\ Says B A RA # evs4 \\ recur\"\n\n (*No \"oops\" message can easily be expressed. Each session key is\n associated--in two separate messages--with two nonces. This is\n one try, but it isn't that useful. Re domino attack, note that\n Recur.thy proves that each session key is secure provided the two\n peers are, even if there are compromised agents elsewhere in\n the chain. Oops cases proved using parts_cut, Key_in_keysFor_parts,\n etc.\n\n Oops: \"\\evso \\ recur; Says Server B RB \\ set evso;\n RB \\ responses evs'; Key K \\ parts {RB}\\\n \\ Notes Spy \\Key K, RB\\ # evso \\ recur\"\n *)\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\n(** Possibility properties: traces that reach the end\n ONE theorem would be more elegant and faster!\n By induction on a list of agents (no repetitions)\n**)\n\n\ntext\\Simplest case: Alice goes directly to the server\\\nlemma \"Key K \\ used [] \n \\ \\NA. \\evs \\ recur.\n Says Server A \\Crypt (shrK A) \\Key K, Agent Server, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] recur.Nil [THEN recur.RA1, \n THEN recur.RA3 [OF _ _ respond.One]])\napply (possibility, simp add: used_Cons) \ndone\n\n\ntext\\Case two: Alice, Bob and the server\\\nlemma \"\\Key K \\ used []; Key K' \\ used []; K \\ K';\n Nonce NA \\ used []; Nonce NB \\ used []; NA < NB\\\n \\ \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil\n [THEN recur.RA1 [of _ NA], \n THEN recur.RA2 [of _ NB],\n THEN recur.RA3 [OF _ _ respond.One \n [THEN respond.Cons [of _ _ K _ K']]],\n THEN recur.RA4], possibility)\napply (auto simp add: used_Cons)\ndone\n\n(*Case three: Alice, Bob, Charlie and the server Rather slow (5 seconds)*)\nlemma \"\\Key K \\ used []; Key K' \\ used []; \n Key K'' \\ used []; K \\ K'; K' \\ K''; K \\ K'';\n Nonce NA \\ used []; Nonce NB \\ used []; Nonce NC \\ used []; \n NA < NB; NB < NC\\\n \\ \\K. \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil [THEN recur.RA1, \n THEN recur.RA2, THEN recur.RA2,\n THEN recur.RA3 \n [OF _ _ respond.One \n [THEN respond.Cons, THEN respond.Cons]],\n THEN recur.RA4, THEN recur.RA4])\napply basic_possibility\napply (tactic \"DEPTH_SOLVE (swap_res_tac \\<^context> [refl, conjI, disjCI] 1)\")\ndone\n\n\nlemma respond_imp_not_used: \"(PA,RB,KAB) \\ respond evs \\ Key KAB \\ used evs\"\nby (erule respond.induct, simp_all)\n\nlemma Key_in_parts_respond [rule_format]:\n \"\\Key K \\ parts {RB}; (PB,RB,K') \\ respond evs\\ \\ Key K \\ used evs\"\napply (erule rev_mp, erule respond.induct)\napply (auto dest: Key_not_used respond_imp_not_used)\ndone\n\ntext\\Simple inductive reasoning about responses\\\nlemma respond_imp_responses:\n \"(PA,RB,KAB) \\ respond evs \\ RB \\ responses evs\"\napply (erule respond.induct)\napply (blast intro!: respond_imp_not_used responses.intros)+\ndone\n\n\n(** For reasoning about the encrypted portion of messages **)\n\nlemmas RA2_analz_spies = Says_imp_spies [THEN analz.Inj]\n\nlemma RA4_analz_spies:\n \"Says C' B \\Crypt K X, X', RA\\ \\ set evs \\ RA \\ analz (spies evs)\"\nby blast\n\n\n(*RA2_analz... and RA4_analz... let us treat those cases using the same\n argument as for the Fake case. This is possible for most, but not all,\n proofs: Fake does not invent new nonces (as in RA2), and of course Fake\n messages originate from the Spy. *)\n\nlemmas RA2_parts_spies = RA2_analz_spies [THEN analz_into_parts]\nlemmas RA4_parts_spies = RA4_analz_spies [THEN analz_into_parts]\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\n(** Spy never sees another agent's shared key! (unless it's bad at start) **)\n\nlemma Spy_see_shrK [simp]:\n \"evs \\ recur \\ (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\napply (erule recur.induct, auto)\ntxt\\RA3. It's ugly to call auto twice, but it seems necessary.\\\napply (auto dest: Key_in_parts_respond simp add: parts_insert_spies)\ndone\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ recur \\ (Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"\\Key (shrK A) \\ parts (knows Spy evs); evs \\ recur\\ \\ A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\n(*** Proofs involving analz ***)\n\n(** Session keys are not used to encrypt other session keys **)\n\n(*Version for \"responses\" relation. Handles case RA3 in the theorem below.\n Note that it holds for *any* set H (not just \"spies evs\")\n satisfying the inductive hypothesis.*)\nlemma resp_analz_image_freshK_lemma:\n \"\\RB \\ responses evs;\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ H)) =\n (K \\ KK | Key K \\ analz H)\\\n \\ \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (insert RB (Key`KK \\ H))) =\n (K \\ KK | Key K \\ analz (insert RB H))\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps, auto)\ndone \n\n\ntext\\Version for the protocol. Proof is easy, thanks to the lemma.\\\nlemma raw_analz_image_freshK:\n \"evs \\ recur \\\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ (spies evs))) =\n (K \\ KK | Key K \\ analz (spies evs))\"\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies, analz_freshK, spy_analz)\ntxt\\RA3\\\napply (simp_all add: resp_analz_image_freshK_lemma)\ndone\n\n\n(*Instance of the lemma with H replaced by (spies evs):\n \\RB \\ responses evs; evs \\ recur;\\\n \\ KK \\ - (range shrK) \\\n Key K \\ analz (insert RB (Key`KK \\ spies evs)) =\n (K \\ KK | Key K \\ analz (insert RB (spies evs)))\n*)\nlemmas resp_analz_image_freshK = \n resp_analz_image_freshK_lemma [OF _ raw_analz_image_freshK]\n\nlemma analz_insert_freshK:\n \"\\evs \\ recur; KAB \\ range shrK\\\n \\ (Key K \\ analz (insert (Key KAB) (spies evs))) =\n (K = KAB | Key K \\ analz (spies evs))\"\nby (simp del: image_insert\n add: analz_image_freshK_simps raw_analz_image_freshK)\n\n\ntext\\Everything that's hashed is already in past traffic.\\\nlemma Hash_imp_body:\n \"\\Hash \\Key(shrK A), X\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad\\ \\ X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [4] RA2_parts_spies)\ntxt\\RA3 requires a further induction\\\napply (erule_tac [5] responses.induct, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ndone\n\n\n(** The Nonce NA uniquely identifies A's message.\n This theorem applies to steps RA1 and RA2!\n\n Unicity is not used in other proofs but is desirable in its own right.\n**)\n\nlemma unique_NA:\n \"\\Hash \\Key(shrK A), Agent A, B, NA, P\\ \\ parts (spies evs);\n Hash \\Key(shrK A), Agent A, B',NA, P'\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad\\\n \\ B=B' \\ P=P'\"\napply (erule rev_mp, erule rev_mp)\napply (erule recur.induct,\n drule_tac [5] respond_imp_responses)\napply (force, simp_all)\ntxt\\Fake\\\napply blast\napply (erule_tac [3] responses.induct)\ntxt\\RA1,2: creation of new Nonce\\\napply simp_all\napply (blast dest!: Hash_imp_body)+\ndone\n\n\n(*** Lemmas concerning the Server's response\n (relations \"respond\" and \"responses\")\n***)\n\nlemma shrK_in_analz_respond [simp]:\n \"\\RB \\ responses evs; evs \\ recur\\\n \\ (Key (shrK B) \\ analz (insert RB (spies evs))) = (B\\bad)\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps resp_analz_image_freshK, auto) \ndone\n\n\nlemma resp_analz_insert_lemma:\n \"\\Key K \\ analz (insert RB H);\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ H)) =\n (K \\ KK | Key K \\ analz H);\n RB \\ responses evs\\\n \\ (Key K \\ parts{RB} | Key K \\ analz H)\"\napply (erule rev_mp, erule responses.induct)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps resp_analz_image_freshK_lemma)\ntxt\\Simplification using two distinct treatments of \"image\"\\\napply (simp add: parts_insert2, blast)\ndone\n\nlemmas resp_analz_insert =\n resp_analz_insert_lemma [OF _ raw_analz_image_freshK]\n\ntext\\The last key returned by respond indeed appears in a certificate\\\nlemma respond_certificate:\n \"(Hash[Key(shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\n \\ Crypt (shrK A) \\Key K, B, NA\\ \\ parts {RA}\"\napply (ind_cases \"(Hash[Key (shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\")\napply simp_all\ndone\n\n(*This unicity proof differs from all the others in the HOL/Auth directory.\n The conclusion isn't quite unicity but duplicity, in that there are two\n possibilities. Also, the presence of two different matching messages in\n the inductive step complicates the case analysis. Unusually for such proofs,\n the quantifiers appear to be necessary.*)\nlemma unique_lemma [rule_format]:\n \"(PB,RB,KXY) \\ respond evs \\\n \\A B N. Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB} \\\n (\\A' B' N'. Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB} \\\n (A'=A \\ B'=B) | (A'=B \\ B'=A))\"\napply (erule respond.induct)\napply (simp_all add: all_conj_distrib)\napply (blast dest: respond_certificate)\ndone\n\nlemma unique_session_keys:\n \"\\Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB};\n Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB};\n (PB,RB,KXY) \\ respond evs\\\n \\ (A'=A \\ B'=B) | (A'=B \\ B'=A)\"\nby (rule unique_lemma, auto)\n\n\n(** Crucial secrecy property: Spy does not see the keys sent in msg RA3\n Does not in itself guarantee security: an attack could violate\n the premises, e.g. by having A=Spy **)\n\nlemma respond_Spy_not_see_session_key [rule_format]:\n \"\\(PB,RB,KAB) \\ respond evs; evs \\ recur\\\n \\ \\A A' N. A \\ bad \\ A' \\ bad \\\n Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts{RB} \\\n Key K \\ analz (insert RB (spies evs))\"\napply (erule respond.induct)\napply (frule_tac [2] respond_imp_responses)\napply (frule_tac [2] respond_imp_not_used)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps split_ifs shrK_in_analz_respond\n resp_analz_image_freshK parts_insert2)\ntxt\\Base case of respond\\\napply blast\ntxt\\Inductive step of respond\\\napply (intro allI conjI impI, simp_all)\ntxt\\by unicity, either \\<^term>\\B=Aa\\ or \\<^term>\\B=A'\\, a contradiction\n if \\<^term>\\B \\ bad\\\\ \napply (blast dest: unique_session_keys respond_certificate)\napply (blast dest!: respond_certificate)\napply (blast dest!: resp_analz_insert)\ndone\n\n\nlemma Spy_not_see_session_key:\n \"\\Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts (spies evs);\n A \\ bad; A' \\ bad; evs \\ recur\\\n \\ Key K \\ analz (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n frule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies,\n simp_all add: split_ifs analz_insert_eq analz_insert_freshK)\ntxt\\Fake\\\napply spy_analz\ntxt\\RA2\\\napply blast \ntxt\\RA3\\\napply (simp add: parts_insert_spies)\napply (metis Key_in_parts_respond parts.Body parts.Fst resp_analz_insert \n respond_Spy_not_see_session_key usedI)\ntxt\\RA4\\\napply blast \ndone\n\n(**** Authenticity properties for Agents ****)\n\ntext\\The response never contains Hashes\\\nlemma Hash_in_parts_respond:\n \"\\Hash \\Key (shrK B), M\\ \\ parts (insert RB H);\n (PB,RB,K) \\ respond evs\\\n \\ Hash \\Key (shrK B), M\\ \\ parts H\"\napply (erule rev_mp)\napply (erule respond_imp_responses [THEN responses.induct], auto)\ndone\n\ntext\\Only RA1 or RA2 can have caused such a part of a message to appear.\n This result is of no use to B, who cannot verify the Hash. Moreover,\n it can say nothing about how recent A's message is. It might later be\n used to prove B's presence to A at the run's conclusion.\\\nlemma Hash_auth_sender [rule_format]:\n \"\\Hash \\Key(shrK A), Agent A, Agent B, NA, P\\ \\ parts(spies evs);\n A \\ bad; evs \\ recur\\\n \\ Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, NA, P\\) \\ set evs\"\nunfolding HPair_def\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [4] RA2_parts_spies,\n simp_all)\ntxt\\Fake, RA3\\\napply (blast dest: Hash_in_parts_respond)+\ndone\n\n(** These two results subsume (for all agents) the guarantees proved\n separately for A and B in the Otway-Rees protocol.\n**)\n\n\ntext\\Certificates can only originate with the Server.\\\nlemma Cert_imp_Server_msg:\n \"\\Crypt (shrK A) Y \\ parts (spies evs);\n A \\ bad; evs \\ recur\\\n \\ \\C RC. Says Server C RC \\ set evs \\\n Crypt (shrK A) Y \\ parts {RC}\"\napply (erule rev_mp, erule recur.induct, simp_all)\ntxt\\Fake\\\napply blast\ntxt\\RA1\\\napply blast\ntxt\\RA2: it cannot be a new Nonce, contradiction.\\\napply blast\ntxt\\RA3. Pity that the proof is so brittle: this step requires the rewriting,\n which however would break all other steps.\\\napply (simp add: parts_insert_spies, blast)\ntxt\\RA4\\\napply blast\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Recur.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.35936413143782797, "lm_q1q2_score": 0.1992568023398223}} {"text": "theory TopoS_Composition_Theory\nimports TopoS_Interface TopoS_Helper\nbegin\n\nsection{*Composition Theory*}\n\ntext{*Several invariants may apply to one policy. *}\n\ntext{*The security invariants are all collected in a list. \nThe list corresponds to the security requirements. \nThe list should have the type @{typ \"('v graph \\ bool) list\"}, i.e.\\ a list of predicates over the policy. \nWe need in instantiated security invariant, i.e.\\ get rid of @{typ \"'a\"} and @{typ \"'b\"}*}\n\n --{*An instance (configured) a security invariant I.e.\\ a concrete security requirement, in different terminology. *}\n record ('v) SecurityInvariant_configured =\n c_sinvar::\"('v) graph \\ bool\"\n c_offending_flows::\"('v) graph \\ ('v \\ 'v) set set\"\n c_isIFS::\"bool\"\n\n --{* First three parameters are the @{text \"SecurityInvariant\"}:\n @{text sinvar} @{text \"\\\"} @{text \"receiver_violation\"}\n\n Fourth parameter is the host attribute mapping @{text nP}\n\n \n TODO: probably check @{text \"verify_globals\"} and @{text \"valid_graph\"} here.\n *}\n fun new_configured_SecurityInvariant :: \"((('v::vertex) graph \\ ('v \\ 'a) \\ bool) \\ 'a \\ bool \\ ('v \\ 'a)) \\ ('v SecurityInvariant_configured) option\" where \n \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = \n ( \n if SecurityInvariant sinvar defbot receiver_violation then \n Some \\ \n c_sinvar = (\\G. sinvar G nP),\n c_offending_flows = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP),\n c_isIFS = receiver_violation\n \\\n else None\n )\"\n\n declare new_configured_SecurityInvariant.simps[simp del]\n\n lemma new_configured_TopoS_sinvar_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_sinvar (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = (\\G. sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n lemma new_configured_TopoS_offending_flows_correct:\n \"SecurityInvariant sinvar defbot receiver_violation \\ \n c_offending_flows (the (new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP))) = \n (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n by(simp add: Let_def new_configured_SecurityInvariant.simps)\n\n\ntext{* We now collect all the core properties of a security invariant, but without the @{typ \"'a\"} @{typ \"'b\"} \n types, so it is instantiated with a concrete configuration.*}\nlocale configured_SecurityInvariant =\n fixes m :: \"('v::vertex) SecurityInvariant_configured\"\n assumes\n --\"As in SecurityInvariant definition\"\n valid_c_offending_flows:\n \"c_offending_flows m G = {F. F \\ (edges G) \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\ (e1, e2) \\ F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\"\n and\n --\"A empty network can have no security violations\"\n defined_offending:\n \"\\ valid_graph \\ nodes = N, edges = {} \\ \\ \\ c_sinvar m \\ nodes = N, edges = {}\\\"\n and\n --\"prohibiting more does not decrease security\"\n mono_sinvar:\n \"\\ valid_graph \\ nodes = N, edges = E \\; E' \\ E; c_sinvar m \\ nodes = N, edges = E \\ \\ \\ \n c_sinvar m \\ nodes = N, edges = E' \\\"\n begin\n (*compatibility with other definitions*)\n lemma sinvar_monoI: \n \"SecurityInvariant_withOffendingFlows.sinvar_mono (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact mono_sinvar)\n\n text{* if the network where nobody communicates with anyone fulfilles its security requirement,\n the offending flows are always defined. *}\n lemma defined_offending': \n \"\\ valid_graph G; \\ c_sinvar m G \\ \\ c_offending_flows m G \\ {}\"\n proof -\n assume a1: \"valid_graph G\"\n and a2: \"\\ c_sinvar m G\"\n have subst_set_offending_flows: \n \"\\nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n by(simp add: valid_c_offending_flows fun_eq_iff \n SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n\n from a1 have validG_empty: \"valid_graph \\nodes = nodes G, edges = {}\\\" by(simp add:valid_graph_def)\n\n from a1 have \"\\nP. \\ c_sinvar m G \\ SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP \\ {}\"\n apply(frule_tac finite_distinct_list[OF valid_graph.finiteE])\n apply(erule_tac exE)\n apply(rename_tac list_edges)\n apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_monoI])\n by(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def delete_edges_simp2 defined_offending[OF validG_empty])\n \n thus ?thesis by(simp add: a2 subst_set_offending_flows)\n qed\n\n (* The offending flows definitions are equal, compatibility *)\n lemma subst_offending_flows: \"\\ nP. SecurityInvariant_withOffendingFlows.set_offending_flows (\\G nP. c_sinvar m G) G nP = c_offending_flows m G\"\n apply (unfold SecurityInvariant_withOffendingFlows.set_offending_flows_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n by(simp add: valid_c_offending_flows)\n\n text{* all the @{term SecurityInvariant_preliminaries} stuff must hold, for an arbitrary @{term nP} *}\n lemma SecurityInvariant_preliminariesD:\n \"SecurityInvariant_preliminaries (\\ (G::('v::vertex) graph) (nP::'v \\ 'a). c_sinvar m G)\"\n apply(unfold_locales)\n apply(simp add: subst_offending_flows)\n apply(fact defined_offending')\n apply(fact mono_sinvar)\n apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_monoI])\n done\n\n lemma negative_mono:\n \"\\ N E' E. valid_graph \\ nodes = N, edges = E \\ \\ \n E' \\ E \\ \\ c_sinvar m \\ nodes = N, edges = E' \\ \\ \\ c_sinvar m \\ nodes = N, edges = E \\\"\n apply(clarify)\n apply(drule(2) mono_sinvar)\n by(blast)\n\n \n subsection{*Reusing Lemmata*}\n lemmas mono_extend_set_offending_flows =\n SecurityInvariant_preliminaries.mono_extend_set_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm mono_extend_set_offending_flows [no_vars]}*}\n\n lemmas offending_flows_union_mono =\n SecurityInvariant_preliminaries.offending_flows_union_mono[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm offending_flows_union_mono [no_vars]}*}\n\n lemmas sinvar_valid_remove_flattened_offending_flows =\n SecurityInvariant_preliminaries.sinvar_valid_remove_flattened_offending_flows[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm sinvar_valid_remove_flattened_offending_flows [no_vars]}*}\n\n lemmas empty_offending_contra =\n SecurityInvariant_withOffendingFlows.empty_offending_contra[where sinvar=\"(\\G nP. c_sinvar m G)\", simplified subst_offending_flows]\n text{*@{thm empty_offending_contra [no_vars]}*}\n\n lemmas Un_set_offending_flows_bound_minus_subseteq = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm Un_set_offending_flows_bound_minus_subseteq [no_vars]}*}\n\n lemmas Un_set_offending_flows_bound_minus_subseteq' = \n SecurityInvariant_preliminaries.Un_set_offending_flows_bound_minus_subseteq'[OF SecurityInvariant_preliminariesD, simplified subst_offending_flows]\n text{*@{thm Un_set_offending_flows_bound_minus_subseteq' [no_vars]}*}\nend\n\nthm configured_SecurityInvariant_def\ntext{*@{thm configured_SecurityInvariant_def [no_vars]}*}\n\nthm configured_SecurityInvariant.mono_sinvar\ntext{*@{thm configured_SecurityInvariant.mono_sinvar [no_vars]}*}\n\n\n\ntext{* \n Naming convention:\n m :: network security requirement\n M :: network security requirement list\n*}\n\n text{* The function @{term new_configured_SecurityInvariant} takes some tuple and if it returns a result,\n the locale assumptions are automatically fulfilled. *}\n theorem new_configured_SecurityInvariant_sound: \n \"\\ new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m \\ \\\n configured_SecurityInvariant m\"\n proof -\n assume a: \"new_configured_SecurityInvariant (sinvar, defbot, receiver_violation, nP) = Some m\"\n hence NetModel: \"SecurityInvariant sinvar defbot receiver_violation\"\n by(simp add: new_configured_SecurityInvariant.simps split: split_if_asm)\n hence NetModel_p: \"SecurityInvariant_preliminaries sinvar\" by(simp add: SecurityInvariant_def)\n\n from a have c_eval: \"c_sinvar m = (\\G. sinvar G nP)\"\n and c_offending: \"c_offending_flows m = (\\G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar G nP)\"\n and \"c_isIFS m = receiver_violation\"\n by(auto simp add: new_configured_SecurityInvariant.simps NetModel split: split_if_asm)\n\n have monoI: \"SecurityInvariant_withOffendingFlows.sinvar_mono sinvar\"\n apply(simp add: SecurityInvariant_withOffendingFlows.sinvar_mono_def, clarify)\n by(fact SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n from SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows[OF monoI, symmetric]\n SecurityInvariant_preliminaries.defined_offending[OF NetModel_p]\n have eval_empty_graph: \"\\ N nP. valid_graph \\nodes = N, edges = {}\\ \\ sinvar \\nodes = N, edges = {}\\ nP\"\n by fastforce\n\n show ?thesis\n apply(unfold_locales)\n apply(simp add: c_eval c_offending SecurityInvariant_withOffendingFlows.set_offending_flows_def SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply(simp add: c_eval eval_empty_graph)\n apply(simp add: c_eval,drule(3) SecurityInvariant_preliminaries.mono_sinvar[OF NetModel_p])\n done\n qed\n\ntext{* All security invariants are valid according to the definition *}\ndefinition valid_reqs :: \"('v::vertex) SecurityInvariant_configured list \\ bool\" where\n \"valid_reqs M \\ \\ m \\ set M. configured_SecurityInvariant m\"\n\n subsection {*Algorithms*}\n text{*A (generic) security invariant corresponds to a type of security requirements (type: @{typ \"'v graph \\ ('v \\ 'a) \\ bool\"}).\n A configured security invariant is a security requirement in a scenario specific setting (type: @{typ \"'v graph \\ bool\"}).\n I.e., it is a security requirement as listed in the requirements document.\n All security requirements are fulfilled for a fixed policy @{term G} if all security requirements are fulfilled for @{term G}. *}\n\n\n text{*Get all possible offending flows from all security requirements *}\n definition get_offending_flows :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ (('v \\ 'v) set set)\" where\n \"get_offending_flows M G = (\\m\\set M. c_offending_flows m G)\" \n\n (*Note: only checks sinvar, not eval!! No 'a 'b type variables here*)\n definition all_security_requirements_fulfilled :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"all_security_requirements_fulfilled M G \\ \\m \\ set M. (c_sinvar m) G\"\n \n text{* Generate a valid topology from the security requirements *}\n (*constant G, remove after algorithm*)\n fun generate_valid_topology :: \"'v SecurityInvariant_configured list \\ 'v graph \\ 'v graph\" where\n \"generate_valid_topology [] G = G\" |\n \"generate_valid_topology (m#Ms) G = delete_edges (generate_valid_topology Ms G) (\\ (c_offending_flows m G))\"\n\n -- \"return all Access Control Strategy models from a list of models\"\n definition get_ACS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_ACS M \\ [m \\ M. \\ c_isIFS m]\"\n -- \"return all Information Flows Strategy models from a list of models\"\n definition get_IFS :: \"('v::vertex) SecurityInvariant_configured list \\ 'v SecurityInvariant_configured list\" where\n \"get_IFS M \\ [m \\ M. c_isIFS m]\"\n lemma get_ACS_union_get_IFS: \"set (get_ACS M) \\ set (get_IFS M) = set M\"\n by(auto simp add: get_ACS_def get_IFS_def)\n \n\n subsection{*Lemmata*}\n lemma valid_reqs1: \"valid_reqs (m # M) \\ configured_SecurityInvariant m\"\n by(simp add: valid_reqs_def)\n lemma valid_reqs2: \"valid_reqs (m # M) \\ valid_reqs M\"\n by(simp add: valid_reqs_def)\n lemma get_offending_flows_alt1: \"get_offending_flows M G = \\ {c_offending_flows m G | m. m \\ set M}\"\n apply(simp add: get_offending_flows_def)\n by fastforce\n lemma get_offending_flows_un: \"\\ get_offending_flows M G = (\\m\\set M. \\c_offending_flows m G)\"\n apply(simp add: get_offending_flows_def)\n by blast\n \n \n lemma all_security_requirements_fulfilled_mono:\n \"\\ valid_reqs M; E' \\ E; valid_graph \\ nodes = V, edges = E \\ \\ \\ \n all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ \\\n all_security_requirements_fulfilled M \\ nodes = V, edges = E' \\\"\n apply(induction M arbitrary: E' E)\n apply(simp_all add: all_security_requirements_fulfilled_def)\n apply(rename_tac m M E' E)\n apply(rule conjI)\n apply(erule(2) configured_SecurityInvariant.mono_sinvar[OF valid_reqs1])\n apply(simp_all)\n apply(drule valid_reqs2)\n apply blast\n done\n\n subsection{* generate valid topology *}\n (*\n lemma generate_valid_topology_def_delete_multiple: \n \"generate_valid_topology M G = delete_edges (generate_valid_topology M G) (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges (generate_valid_topology M G) - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n by blast\n qed*)\n lemma generate_valid_topology_nodes:\n \"nodes (generate_valid_topology M G) = (nodes G)\"\n apply(induction M arbitrary: G)\n by(simp_all add: graph_ops)\n\n lemma generate_valid_topology_def_alt:\n \"generate_valid_topology M G = delete_edges G (\\ (get_offending_flows M G))\"\n proof(induction M arbitrary: G)\n case Nil\n thus ?case by(simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons[simplified delete_edges_simp2 get_offending_flows_def] \n have \"edges (generate_valid_topology M G) = edges G - \\(\\m\\set M. c_offending_flows m G)\"\n by (metis graph.select_convs(2))\n thus ?case\n apply(simp add: get_offending_flows_def delete_edges_simp2)\n apply(rule)\n apply(simp add: generate_valid_topology_nodes)\n by blast\n qed\n \n lemma valid_graph_generate_valid_topology: \"valid_graph G \\ valid_graph (generate_valid_topology M G)\"\n apply(induction M arbitrary: G)\n by(simp_all)\n \n lemma generate_valid_topology_mono_models:\n \"edges (generate_valid_topology (m#M) \\ nodes = V, edges = E \\) \\ edges (generate_valid_topology M \\ nodes = V, edges = E \\)\"\n apply(induction M arbitrary: E m)\n apply(simp add: delete_edges_simp2)\n apply fastforce\n apply(simp add: delete_edges_simp2)\n by blast\n \n lemma generate_valid_topology_subseteq_edges:\n \"edges (generate_valid_topology M G) \\ (edges G)\"\n apply(induction M arbitrary: G)\n apply(simp_all)\n apply(simp add: delete_edges_simp2)\n by blast\n\n text{* @{term generate_valid_topology} generates a valid topology (Policy)! *}\n theorem generate_valid_topology_sound:\n \"\\ valid_reqs M; valid_graph \\nodes = V, edges = E\\ \\ \\ \n all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\"\n proof(induction M arbitrary: V E)\n case Nil\n thus ?case by(simp add: all_security_requirements_fulfilled_def)\n next\n case (Cons m M)\n from valid_reqs1[OF Cons(2)] have validReq: \"configured_SecurityInvariant m\" .\n\n from Cons(3) have valid_rmUnOff: \"valid_graph \\nodes = V, edges = E - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\"\n by(simp add: valid_graph_remove_edges)\n \n from configured_SecurityInvariant.sinvar_valid_remove_flattened_offending_flows[OF validReq Cons(3)]\n have valid_eval_rmUnOff: \"c_sinvar m \\nodes = V, edges = E - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n \n from generate_valid_topology_subseteq_edges have edges_gentopo_subseteq: \n \"(edges (generate_valid_topology M \\nodes = V, edges = E\\)) - (\\c_offending_flows m \\nodes = V, edges = E\\)\n \\\n E - (\\c_offending_flows m \\nodes = V, edges = E\\)\" by fastforce\n \n from configured_SecurityInvariant.mono_sinvar[OF validReq valid_rmUnOff edges_gentopo_subseteq valid_eval_rmUnOff]\n have \"c_sinvar m \\nodes = V, edges = (edges (generate_valid_topology M \\nodes = V, edges = E\\)) - (\\c_offending_flows m \\nodes = V, edges = E\\) \\\" .\n from this have goal1: \n \"c_sinvar m (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\))\"\n by(simp add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from valid_reqs2[OF Cons(2)] have \"valid_reqs M\" .\n from Cons.IH[OF `valid_reqs M` Cons(3)] have IH:\n \"all_security_requirements_fulfilled M (generate_valid_topology M \\nodes = V, edges = E\\)\" .\n\n have generate_valid_topology_EX_graph_record:\n \"\\ hypE. (generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = hypE\\ \"\n apply(induction M arbitrary: V E)\n by(simp_all add: delete_edges_simp2 generate_valid_topology_nodes)\n \n from generate_valid_topology_EX_graph_record obtain E_IH where E_IH_prop:\n \"(generate_valid_topology M \\nodes = V, edges = E\\) = \\nodes = V, edges = E_IH\\\" by blast\n \n from valid_graph_generate_valid_topology[OF Cons(3)] E_IH_prop\n have valid_G_E_IH: \"valid_graph \\nodes = V, edges = E_IH\\\" by metis\n \n -- \"@{thm IH[simplified E_IH_prop]}\"\n -- \"@{thm all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH IH[simplified E_IH_prop]]}\"\n \n from all_security_requirements_fulfilled_mono[OF `valid_reqs M` _ valid_G_E_IH IH[simplified E_IH_prop]] have mono_rule:\n \"\\ E'. E' \\ E_IH \\ all_security_requirements_fulfilled M \\nodes = V, edges = E'\\\" .\n \n have \"all_security_requirements_fulfilled M \n (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\))\"\n apply(subst E_IH_prop)\n apply(simp add: delete_edges_simp2)\n apply(rule mono_rule)\n by fast\n \n from this have goal2:\n \"(\\ma\\set M.\n c_sinvar ma (delete_edges (generate_valid_topology M \\nodes = V, edges = E\\) (\\c_offending_flows m \\nodes = V, edges = E\\)))\"\n by(simp add: all_security_requirements_fulfilled_def)\n \n from goal1 goal2 \n show \"all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \\nodes = V, edges = E\\)\" \n by (simp add: all_security_requirements_fulfilled_def)\n qed\n\n\n lemma generate_valid_topology_as_set: \n \"generate_valid_topology M G = delete_edges G (\\m \\ set M. (\\ (c_offending_flows m G)))\"\n apply(induction M arbitrary: G)\n apply(simp_all add: delete_edges_simp2 generate_valid_topology_nodes) by fastforce\n\n lemma c_offending_flows_subseteq_edges: \"configured_SecurityInvariant m \\ \\c_offending_flows m G \\ edges G\"\n apply(clarify)\n apply(simp only: configured_SecurityInvariant.valid_c_offending_flows)\n apply(thin_tac \"configured_SecurityInvariant ?x\")\n by auto\n\n\n text{*Does it also generate a maximum topology? It does, if the security invariants are in ENF-form. That means, if \n all security invariants can be expressed as a predicate over the edges, \n @{term \"\\P. \\G. c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1,v2))\"}*}\n definition max_topo :: \"('v::vertex) SecurityInvariant_configured list \\ 'v graph \\ bool\" where\n \"max_topo M G \\ all_security_requirements_fulfilled M G \\ (\n \\ (v1, v2) \\ (nodes G \\ nodes G) - (edges G). \\ all_security_requirements_fulfilled M (add_edge v1 v2 G))\"\n\n lemma unique_offending_obtain: \n assumes m: \"configured_SecurityInvariant m\" and unique: \"c_offending_flows m G = {F}\"\n obtains P where \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" and \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\" and \n \"(\\(v1,v2) \\ edges G - F. P (v1, v2))\"\n proof -\n assume EX: \"(\\P. F = {(v1, v2). (v1, v2) \\ edges G \\ \\ P (v1, v2)} \\ c_sinvar m G = (\\(v1, v2)\\edges G. P (v1, v2)) \\ \\(v1, v2)\\edges G - F. P (v1, v2) \\ thesis)\"\n\n from unique c_offending_flows_subseteq_edges[OF m] have \"F \\ edges G\" by force\n from this obtain P where \"F = {e \\ edges G. \\ P e}\" by (metis double_diff set_diff_eq subset_refl)\n hence 1: \"F = {(v1, v2) \\ edges G. \\ P (v1, v2)}\" by auto\n\n from configured_SecurityInvariant.valid_c_offending_flows[OF m] have \"c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ \n (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\" .\n\n from this unique have \"\\ c_sinvar m G\" and 2: \"c_sinvar m (delete_edges G F)\" and \n 3: \"(\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))\" by auto\n\n from this `F = {e \\ edges G. \\ P e}` have x3: \"\\ e \\ edges G - F. P e\" by (metis (lifting) mem_Collect_eq set_diff_eq)\n hence 4: \"\\(v1,v2) \\ edges G - F. P (v1, v2)\" by blast\n\n have \"F \\ {}\" by (metis assms(1) assms(2) configured_SecurityInvariant.empty_offending_contra insertCI)\n from this `F = {e \\ edges G. \\ P e}` `\\ c_sinvar m G` have 5: \"c_sinvar m G = (\\(v1,v2) \\ edges G. P (v1, v2))\"\n apply(simp add: graph_ops)\n by(blast)\n\n from EX[of P] unique 1 x3 5 show ?thesis by fast\n qed\n\n lemma enf_offending_flows:\n assumes vm: \"configured_SecurityInvariant m\" and enf: \"\\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n shows \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n proof -\n from vm configured_SecurityInvariant.valid_c_offending_flows have offending_formaldef: \"\\G.\n c_offending_flows m G =\n {F. F \\ edges G \\ \\ c_sinvar m G \\ c_sinvar m (delete_edges G F) \\ (\\(e1, e2)\\F. \\ c_sinvar m (add_edge e1 e2 (delete_edges G F)))}\"\n by auto\n\n show \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\"\n apply(rule allI)\n apply(case_tac \"c_sinvar m G\")\n apply(simp add: offending_formaldef) --{*@{term \"{}\"}*}\n apply(simp only: offending_formaldef graph_ops enf)\n apply(simp)\n apply(rule Set.equalityI)\n apply(blast)\n apply(blast)\n done \n qed\n\n theorem generate_valid_topology_max_topo: \"\\ valid_reqs M; valid_graph G;\n \\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\\ \\ \n max_topo M (generate_valid_topology M (fully_connected G))\"\n proof -\n let ?G=\"(fully_connected G)\"\n assume validRs: \"valid_reqs M\"\n and validG: \"valid_graph G\"\n and enf: \"\\m \\ set M. \\P. \\G. c_sinvar m G = (\\e \\ edges G. P e)\"\n\n obtain V E where VE_prop: \"\\ nodes = V, edges = E \\ = generate_valid_topology M ?G\" by (metis graph.cases)\n hence VE_prop_asset:\n \"\\ nodes = V, edges = E \\ = \\ nodes = V, edges = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\\\"\n by(simp add: fully_connected_def generate_valid_topology_as_set delete_edges_simp2)\n\n from VE_prop_asset have E_prop: \"E = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\" by fast\n from VE_prop have V_prop: \"nodes G = V\"\n apply(simp add: fully_connected_def) using generate_valid_topology_nodes by (metis graph.select_convs(1))\n from VE_prop have V_full_prop: \"nodes (generate_valid_topology M ?G) = V\" by (metis graph.select_convs(1))\n from VE_prop have E_full_prop: \"edges (generate_valid_topology M ?G) = E\" by (metis graph.select_convs(2))\n\n from VE_prop valid_graph_generate_valid_topology[OF fully_connected_valid[OF validG]]\n have validG_VE: \"valid_graph \\ nodes = V, edges = E \\\" by force\n\n from generate_valid_topology_sound[OF validRs validG_VE] fully_connected_valid[OF validG] have VE_all_valid: \n \"all_security_requirements_fulfilled M \\ nodes = V, edges = V \\ V - (\\m\\set M. \\c_offending_flows m ?G)\\\"\n by (metis VE_prop VE_prop_asset fully_connected_def generate_valid_topology_sound validRs)\n hence goal1: \"all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))\" by (metis VE_prop VE_prop_asset)\n\n from validRs have valid_mD:\"\\m. m \\ set M \\ configured_SecurityInvariant m \" \n by(simp add: valid_reqs_def)\n\n from c_offending_flows_subseteq_edges[where G=\"?G\"] have hlp1: \"(\\m\\set M. \\c_offending_flows m ?G) \\ V \\ V\"\n apply(simp add: fully_connected_def V_prop)\n by (metis (lifting, no_types) UN_least validRs valid_reqs_def)\n have \"\\A B. A - (A - B) = B \\ A\" by fast \n from this[of \"V \\ V\"] E_prop hlp1 have \"V \\ V - E = (\\m\\set M. \\c_offending_flows m ?G)\" by force\n\n\n have \"\\(v1, v2) \\ (\\m\\set M. \\c_offending_flows m ?G).\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\"\n unfolding all_security_requirements_fulfilled_def\n proof(simp, clarify, rename_tac m F a b)\n fix m F v1 v2\n assume \"m \\ set M\" and \"F \\ c_offending_flows m ?G\" and \"(v1, v2) \\ F\"\n from `m \\ set M` valid_mD have \"configured_SecurityInvariant m\" by simp\n\n from enf `m \\ set M` obtain P where enf_m: \"\\G. c_sinvar m G = (\\e\\edges G. P e)\" by blast\n \n from `(v1, v2) \\ F` have \"F \\ {}\" by auto\n\n from enf_offending_flows[OF `configured_SecurityInvariant m` `\\G. c_sinvar m G = (\\e\\edges G. P e)`] have\n offending: \"\\G. c_offending_flows m G = (if c_sinvar m G then {} else {{e \\ edges G. \\ P e}})\" by simp\n from `F \\ c_offending_flows m ?G` `F \\ {}` have \"F = {e \\ edges ?G. \\ P e}\"\n apply(subst(asm) offending)\n by (metis (full_types) empty_iff singleton_iff)\n from this `(v1, v2) \\ F` have \"\\ P (v1, v2)\" by simp\n\n from this enf_m have \"\\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" by(simp)\n thus \"\\m\\set M. \\ c_sinvar m \\nodes = V, edges = insert (v1, v2) E\\\" using `m \\ set M`\n apply(rule_tac x=\"m\" in bexI)\n by simp_all\n qed\n \n from this `V \\ V - E = (\\m\\set M. \\c_offending_flows m ?G)` have \"\\(v1, v2) \\ V \\ V - E.\n \\ all_security_requirements_fulfilled M \\ nodes = V, edges = E \\ {(v1, v2)}\\\" by simp\n hence goal2: \"(\\(v1, v2)\\nodes (generate_valid_topology M ?G) \\ nodes (generate_valid_topology M ?G) -\n edges (generate_valid_topology M ?G).\n \\ all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M ?G)))\"\n proof(unfold V_full_prop E_full_prop graph_ops)\n assume a: \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V, edges = E \\ {(v1, v2)}\\\"\n have \"\\(v1, v2)\\V \\ V - E. V \\ {v1, v2} = V\" by blast\n hence \"\\(v1, v2)\\V \\ V - E. \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\ = \\nodes = V, edges = E \\ {(v1, v2)}\\\" by blast\n from this a show \"\\(v1, v2)\\V \\ V - E. \\ all_security_requirements_fulfilled M \\nodes = V \\ {v1, v2}, edges = {(v1, v2)} \\ E\\\"\n --\"TODO: this should be trivial ...\"\n apply(simp)\n apply(rule ballI)\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply simp\n apply(erule_tac x=x and A=\"V \\ V - E\" in ballE)\n prefer 2 apply(simp)\n apply(clarify)\n by presburger\n qed\n \n from goal1 goal2 show ?thesis\n unfolding max_topo_def by presburger\n qed\n\n\n\n subsection{* More Lemmata *}\n lemma (in configured_SecurityInvariant) c_sinvar_valid_imp_no_offending_flows: \n \"c_sinvar m G \\ \\x\\c_offending_flows m G. x = {}\"\n by(simp add: valid_c_offending_flows)\n\n lemma all_security_requirements_fulfilled_imp_no_offending_flows:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ (\\m\\set M. \\c_offending_flows m G) = {}\"\n apply(induction M)\n apply(simp_all)\n apply(simp add: all_security_requirements_fulfilled_def)\n apply(clarify)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(drule(1) configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows)\n by simp\n\n corollary all_security_requirements_fulfilled_imp_get_offending_empty:\n \"valid_reqs M \\ all_security_requirements_fulfilled M G \\ get_offending_flows M G = {}\"\n apply(frule(1) all_security_requirements_fulfilled_imp_no_offending_flows)\n apply(simp add: get_offending_flows_def)\n apply(thin_tac \"all_security_requirements_fulfilled M G\")\n apply(simp add: valid_reqs_def)\n apply(clarify)\n using configured_SecurityInvariant.empty_offending_contra\n by fastforce\n \n corollary generate_valid_topology_does_nothing_if_valid:\n \"\\ valid_reqs M; all_security_requirements_fulfilled M G\\ \\ \n generate_valid_topology M G = G\"\n by(simp add: generate_valid_topology_as_set graph_ops all_security_requirements_fulfilled_imp_no_offending_flows)\n\n\n lemma mono_extend_get_offending_flows: \"\\ valid_reqs M;\n valid_graph \\nodes = V, edges = E\\;\n E' \\ E;\n F' \\ get_offending_flows M \\nodes = V, edges = E'\\ \\ \\\n \\F\\get_offending_flows M \\nodes = V, edges = E\\. F' \\ F\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(simp add: get_offending_flows_def)\n apply(erule disjE)\n apply(drule(3) configured_SecurityInvariant.mono_extend_set_offending_flows)\n apply(erule bexE, rename_tac F)\n apply(rule_tac x=\"F\" in bexI)\n apply(simp_all)\n apply blast\n done\n\n lemma get_offending_flows_subseteq_edges: \"valid_reqs M \\ F \\ get_offending_flows M \\nodes = V, edges = E\\ \\ F \\ E\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(simp add: configured_SecurityInvariant.valid_c_offending_flows)\n by blast\n\n thm configured_SecurityInvariant.offending_flows_union_mono\n lemma get_offending_flows_union_mono: \"\\valid_reqs M; \n valid_graph \\nodes = V, edges = E\\; E' \\ E \\ \\\n \\get_offending_flows M \\nodes = V, edges = E'\\ \\ \\get_offending_flows M \\nodes = V, edges = E\\\"\n apply(induction M)\n apply(simp add: get_offending_flows_def)\n apply(frule valid_reqs2, drule valid_reqs1)\n apply(drule(2) configured_SecurityInvariant.offending_flows_union_mono)\n apply(simp add: get_offending_flows_def)\n by blast\n\n thm configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'\n lemma Un_set_offending_flows_bound_minus_subseteq':\"\\valid_reqs M; \n valid_graph \\nodes = V, edges = E\\; E' \\ E;\n \\get_offending_flows M \\nodes = V, edges = E\\ \\ X \\ \\ \\get_offending_flows M \\nodes = V, edges = E - E'\\ \\ X - E'\"\n proof(induction M)\n case Nil thus ?case by (simp add: get_offending_flows_def)\n next\n case (Cons m M)\n from Cons.prems(1) valid_reqs2 have \"valid_reqs M\" by force\n from Cons.prems(1) valid_reqs1 have \"configured_SecurityInvariant m\" by force\n from Cons.prems(4) have \"\\get_offending_flows M \\nodes = V, edges = E\\ \\ X\" by(simp add: get_offending_flows_def)\n from Cons.IH[OF `valid_reqs M` Cons.prems(2) Cons.prems(3) `\\get_offending_flows M \\nodes = V, edges = E\\ \\ X`] have IH: \"\\get_offending_flows M \\nodes = V, edges = E - E'\\ \\ X - E'\" .\n from Cons.prems(4) have \"\\c_offending_flows m \\nodes = V, edges = E\\ \\ X\" by(simp add: get_offending_flows_def)\n from configured_SecurityInvariant.Un_set_offending_flows_bound_minus_subseteq'[OF `configured_SecurityInvariant m` Cons.prems(2) `\\c_offending_flows m \\nodes = V, edges = E\\ \\ X`] have \"\\c_offending_flows m \\nodes = V, edges = E - E'\\ \\ X - E'\" .\n from this IH show ?case by(simp add: get_offending_flows_def)\n qed\n\n \n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/TopoS_Composition_Theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.554470450236115, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.1992567993656383}} {"text": "theory Worklist_Subsumption_Impl\nimports \"../IICF/IICF\" Worklist_Subsumption\nbegin\n\n locale Worklist2_Defs = Worklist1_Defs +\n fixes A :: \"'a \\ 'ai \\ assn\"\n fixes succsi :: \"'ai \\ 'ai list Heap\"\n fixes a\\<^sub>0i :: \"'ai Heap\"\n fixes Fi :: \"'ai \\ bool Heap\"\n fixes Lei :: \"'ai \\ 'ai \\ bool Heap\"\n\n locale Worklist2 = Worklist2_Defs + Worklist1 +\n (* TODO: This is the easy variant: Operations cannot depend on additional heap. *)\n assumes [sepref_fr_rules]: \"(uncurry0 a\\<^sub>0i, uncurry0 (RETURN (PR_CONST a\\<^sub>0))) \\ unit_assn\\<^sup>k \\\\<^sub>a A\"\n assumes [sepref_fr_rules]: \"(Fi,RETURN o PR_CONST F) \\ A\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes [sepref_fr_rules]: \"(uncurry Lei,uncurry (RETURN oo PR_CONST (\\))) \\ A\\<^sup>k *\\<^sub>a A\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes [sepref_fr_rules]: \"(succsi,RETURN o PR_CONST succs) \\ A\\<^sup>k \\\\<^sub>a list_assn A\"\n begin\n sepref_register \"PR_CONST a\\<^sub>0\" \"PR_CONST F\" \"PR_CONST (\\)\" \"PR_CONST succs\"\n\n \n\n lemma [safe_constraint_rules]: \"CN_FALSE is_pure A \\ is_pure A\" by simp\n\n sepref_thm worklist_algo2 is \"uncurry0 worklist_algo1\" :: \"unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\n unfolding worklist_algo1_def add_succ1_def\n supply [[goals_limit = 1]]\n apply (rewrite in \"Let \\ _\" lso_fold_custom_empty)\n apply (rewrite in \"{#a\\<^sub>0#}\" lmso_fold_custom_empty)\n unfolding take_from_mset_as_mop_mset_pick fold_lso_bex\n by sepref\n\n end\n\n concrete_definition worklist_algo2 \n for Lei a\\<^sub>0i Fi succsi\n uses Worklist2.worklist_algo2.refine_raw is \"(uncurry0 ?f,_)\\_\"\n thm worklist_algo2_def\n\n context Worklist2 begin\n lemma Worklist2_this: \"Worklist2 E a\\<^sub>0 F (\\) succs A succsi a\\<^sub>0i Fi Lei\" \n by unfold_locales\n\n lemma hnr_F_reachable: \"(uncurry0 (worklist_algo2 Lei a\\<^sub>0i Fi succsi), uncurry0 (RETURN F_reachable)) \n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\n using worklist_algo2.refine[OF Worklist2_this, \n FCOMP worklist_algo1_ref[THEN nres_relI],\n FCOMP worklist_algo_correct[THEN Id_SPEC_refine, THEN nres_relI]]\n by (simp add: RETURN_def)\n\n end\n\n context Worklist1 begin\n sepref_decl_op F_reachable :: \"bool_rel\" .\n lemma [def_pat_rules]: \"F_reachable \\ op_F_reachable\" by simp\n\n\n lemma hnr_op_F_reachable:\n assumes \"GEN_ALGO a\\<^sub>0i (\\a\\<^sub>0i. (uncurry0 a\\<^sub>0i, uncurry0 (RETURN a\\<^sub>0)) \\ unit_assn\\<^sup>k \\\\<^sub>a A)\"\n assumes \"GEN_ALGO Fi (\\Fi. (Fi,RETURN o F) \\ A\\<^sup>k \\\\<^sub>a bool_assn)\"\n assumes \"GEN_ALGO Lei (\\Lei. (uncurry Lei,uncurry (RETURN oo (\\))) \\ A\\<^sup>k *\\<^sub>a A\\<^sup>k \\\\<^sub>a bool_assn)\"\n assumes \"GEN_ALGO succsi (\\succsi. (succsi,RETURN o succs) \\ A\\<^sup>k \\\\<^sub>a list_assn A)\"\n shows \"(uncurry0 (worklist_algo2 Lei a\\<^sub>0i Fi succsi), uncurry0 (RETURN (PR_CONST op_F_reachable))) \n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\n proof -\n from assms interpret Worklist2 E a\\<^sub>0 F \"(\\)\" succs A succsi a\\<^sub>0i Fi Lei \n by (unfold_locales; simp add: GEN_ALGO_def)\n \n from hnr_F_reachable show ?thesis by simp \n qed \n\n sepref_decl_impl hnr_op_F_reachable .\n end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Examples/Worklist_Subsumption_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.39233683016710835, "lm_q1q2_score": 0.19923329715255292}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__28_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__28_on_rules imports n_g2kAbsAfter_lemma_on_inv__28\nbegin\nsection{*All lemmas on causal relation between inv__28*}\nlemma lemma_inv__28_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__28 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__28) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__28_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.19908993984577011}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__14.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__14 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__14 and some rule r*}\nlemma n_SendInv__part__0Vsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const I))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv1) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__14:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv1) ''Cmd'')) (Const GntE)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__14:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__14:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_on_inv__14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.1990834329050347}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Andrew Boyton, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\nchapter \"A simplified version of the actual capDL specification.\"\n\ntheory Types_D\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\n(*\n * Objects are named by 32 bit words. \n * This name may correspond to the memory address of the object.\n *)\ntype_synonym cdl_object_id = \"32 word\"\n\ntype_synonym cdl_object_set = \"cdl_object_id set\"\n\n(* The type we use to represent object sizes. *)\ntype_synonym cdl_size_bits = nat\n\n(* An index into a CNode, TCB, or other kernel object that contains caps. *)\ntype_synonym cdl_cnode_index = nat\n\n(* A reference to a capability slot. *)\ntype_synonym cdl_cap_ref = \"cdl_object_id \\ cdl_cnode_index\"\n\n(* The possible access-control rights that exist in the system. *)\ndatatype cdl_right = AllowRead | AllowWrite | AllowGrant\n\n\n(*\n * Kernel capabilities.\n *\n * Such capabilities (or \"caps\") give the holder particular rights to\n * a kernel object or system hardware.\n *\n * Caps have attributes such as the object they point to, the rights\n * they give the holder, or how the holder is allowed to interact with\n * the target object.\n *\n * This is a simplified, cut-down version of this datatype for \n * demonstration purposes.\n *)\ndatatype cdl_cap =\n NullCap\n | EndpointCap cdl_object_id \"cdl_right set\"\n | CNodeCap cdl_object_id\n | TcbCap cdl_object_id\n\n(* A mapping from capability identifiers to capabilities. *)\ntype_synonym cdl_cap_map = \"cdl_cnode_index \\ cdl_cap option\"\n\ntranslations\n (type) \"cdl_cap_map\" <= (type) \"nat \\ cdl_cap option\"\n (type) \"cdl_cap_ref\" <= (type) \"cdl_object_id \\ nat\"\n\n(* A user cap pointer. *)\ntype_synonym cdl_cptr = \"32 word\"\n\n(* Kernel objects *)\nrecord cdl_tcb =\n cdl_tcb_caps :: cdl_cap_map\n cdl_tcb_fault_endpoint :: cdl_cptr\n\nrecord cdl_cnode =\n cdl_cnode_caps :: cdl_cap_map\n cdl_cnode_size_bits :: cdl_size_bits\n\n(*\n * Kernel objects.\n *\n * These are in-memory objects that may, over the course of the system\n * execution, be created or deleted by users.\n *\n * Again, a simplified version of the real datatype.\n *)\ndatatype cdl_object =\n Endpoint\n | Tcb cdl_tcb\n | CNode cdl_cnode\n\n(*\n * The current state of the system.\n *\n * The state record contains the following primary pieces of information:\n *\n * objects:\n * The objects that currently exist in the system.\n *\n * current_thread:\n * The currently running thread. Operations will always be performed\n * on behalf of this thread.\n *\n * ghost_state: (Used for separation logic)\n * Which fields are owned by an object.\n * In capDL this is all of the fields (or none of them).\n * In any concrete state, this will be all of the fields.\n *)\n\n\n(* The ghost state tracks which components (fields and slots) are owned by an object.\n * Fields + slots are encoded as None + Some nat.\n *)\ntype_synonym cdl_heap = \"cdl_object_id \\ cdl_object option\"\ntype_synonym cdl_component = \"nat option\"\ntype_synonym cdl_components = \"cdl_component set\"\ntype_synonym cdl_ghost_state = \"cdl_object_id \\ cdl_components\"\n\ntranslations\n (type) \"cdl_heap\" <= (type) \"cdl_object_id \\ cdl_object option\"\n (type) \"cdl_ghost_state\" <= (type) \"cdl_object_id \\ nat option set\"\n\nrecord cdl_state =\n cdl_objects :: \"cdl_heap\"\n cdl_current_thread :: \"cdl_object_id option\"\n cdl_ghost_state :: \"cdl_ghost_state\"\n\n\n(* Kernel objects types. *)\ndatatype cdl_object_type =\n EndpointType\n | TcbType\n | CNodeType\n\n(* Return the type of an object. *)\ndefinition\n object_type :: \"cdl_object \\ cdl_object_type\"\nwhere\n \"object_type x \\\n case x of\n Endpoint \\ EndpointType\n | Tcb _ \\ TcbType\n | CNode _ \\ CNodeType\"\n\n(*\n * Getters and setters for various data types.\n *)\n\n(* Capability getters / setters *)\n\ndefinition cap_objects :: \"cdl_cap \\ cdl_object_id set\"\nwhere\n \"cap_objects cap \\ \n case cap of\n TcbCap x \\ {x}\n | CNodeCap x \\ {x}\n | EndpointCap x _ \\ {x}\"\n\ndefinition cap_has_object :: \"cdl_cap \\ bool\"\nwhere\n \"cap_has_object cap \\ \n case cap of\n NullCap \\ False\n | _ \\ True\"\n\ndefinition cap_object :: \"cdl_cap \\ cdl_object_id\"\nwhere\n \"cap_object cap \\ \n if cap_has_object cap \n then THE obj_id. cap_objects cap = {obj_id}\n else undefined \"\n\nlemma cap_object_simps:\n \"cap_object (TcbCap x) = x\"\n \"cap_object (CNodeCap x) = x\"\n \"cap_object (EndpointCap x j) = x\"\n by (simp_all add:cap_object_def cap_objects_def cap_has_object_def)\n\ndefinition\n cap_rights :: \"cdl_cap \\ cdl_right set\"\nwhere\n \"cap_rights c \\ case c of\n EndpointCap _ x \\ x\n | _ \\ UNIV\"\n\ndefinition\n update_cap_rights :: \"cdl_right set \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_rights r c \\ case c of\n EndpointCap f1 _ \\ EndpointCap f1 r\n | _ \\ c\"\n\n(* Kernel object getters / setters *)\ndefinition\n object_slots :: \"cdl_object \\ cdl_cap_map\"\nwhere\n \"object_slots obj \\ case obj of\n CNode x \\ cdl_cnode_caps x\n | Tcb x \\ cdl_tcb_caps x\n | _ \\ empty\"\n\ndefinition\n update_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"update_slots new_val obj \\ case obj of\n CNode x \\ CNode (x\\cdl_cnode_caps := new_val\\)\n | Tcb x \\ Tcb (x\\cdl_tcb_caps := new_val\\)\n | _ \\ obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n add_to_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"add_to_slots new_val obj \\ update_slots (new_val ++ (object_slots obj)) obj\"\n\ndefinition\n slots_of :: \"cdl_heap \\ cdl_object_id \\ cdl_cap_map\"\nwhere\n \"slots_of h \\ \\obj_id. \n case h obj_id of \n None \\ empty \n | Some obj \\ object_slots obj\"\n\n\ndefinition\n has_slots :: \"cdl_object \\ bool\"\nwhere\n \"has_slots obj \\ case obj of\n CNode _ \\ True\n | Tcb _ \\ True\n | _ \\ False\"\n\ndefinition\n object_at :: \"(cdl_object \\ bool) \\ cdl_object_id \\ cdl_heap \\ bool\"\nwhere\n \"object_at P p s \\ \\object. s p = Some object \\ P object\"\n\nabbreviation\n \"ko_at k \\ object_at (op = k)\"\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/ex/capDL/Types_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.1990834329050347}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__30_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__30_on_rules imports n_german_lemma_on_inv__30\nbegin\nsection{*All lemmas on causal relation between inv__30*}\nlemma lemma_inv__30_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__30) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__30_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.19908343290503466}} {"text": "theory SimAsm\n imports \"../Soundness\" SimAsm_Exp\nbegin\n\ntext \\Instruction Reordering\\\ntext \\Only pattern match on first argument due to performance issues\\\nfun re\\<^sub>i :: \"('v,'g,'r) op \\ ('v,'g,'r) op \\ bool\" \n where\n \"re\\<^sub>i full_fence \\ = False\" |\n \"re\\<^sub>i (cmp b) \\ = (\\ \\ full_fence \\ wr \\ \\ locals \\ rd (cmp b) \\ wr \\ = {} \\ rd (cmp b) \\ rd \\ \\ locals)\" |\n \"re\\<^sub>i \\ \\ = (\\ \\ full_fence \\ wr \\ \\ wr \\ = {} \\ rd \\ \\ wr \\ = {} \\ rd \\ \\ rd \\ \\ locals)\"\n\nfun re\\<^sub>i' :: \"('v,'g,'r) op \\ ('v,'g,'r) op \\ bool\" where\n\"re\\<^sub>i' full_fence \\ = False\" |\n\"re\\<^sub>i' \\ full_fence = False\" |\n\"re\\<^sub>i' (cmp b) \\ = ((wr \\ \\ locals) \\ (wr \\ \\ rd (cmp b) = {}) \\ (rd (cmp b) \\ rd \\ \\ locals))\" |\n\"re\\<^sub>i' \\ \\ = ((wr \\ \\ wr \\ = {}) \\ (wr \\ \\ rd \\ = {}) \\ (rd \\ \\ rd \\ \\ locals))\"\n\nlemma \"re\\<^sub>i' \\ \\ = re\\<^sub>i \\ \\\"\nby (induction rule: re\\<^sub>i'.induct) auto\n\nfun fwd\\<^sub>i :: \"('v,'g,'r) op \\ ('v,'g,'r) op \\ ('v,'g,'r) op\" \n where \"fwd\\<^sub>i \\ (assign x e) = subst\\<^sub>i \\ x e\" | \"fwd\\<^sub>i \\ _ = \\\"\n\nsection \\Auxiliary State Updates\\\n\ntext \\\nWe wish to support auxiliary state to support more abstract reasoning about data structures\nand concurrency.\nThis is achieved by allowing arbitrary extensions to the state representation, which\ncan be updated atomically at any sub-operation.\nThis auxiliary state cannot influence real execution behaviour by definition.\n\\\ntype_synonym ('v,'g,'r,'a) auxop = \"('v,'g,'r) op \\ ('v,'g,'r,'a) auxfn\"\n\nfun beh\\<^sub>a :: \"('v,'g,'r,'a) auxop \\ ('v,'g,'r,'a) state rel\"\n where \"beh\\<^sub>a (\\,f) = beh\\<^sub>i \\ O {(m,m'). m' = m(aux: f)}\"\n\nfun re\\<^sub>a :: \"('v,'g,'r,'a) auxop \\ ('v,'g,'r,'a) auxop \\ bool\" \n where \"re\\<^sub>a (\\,_) (\\,_) = re\\<^sub>i \\ \\\"\n\nsection \\Instruction Specification Language\\\n\ntext \\\nTo instantiate the abstract theory, we must couple each sub-operation with its precondition\nand behaviour in a tuple\\\ntype_synonym ('v,'g,'r,'a) opbasic = \"(('v,'g,'r,'a) auxop, ('v,'g,'r,'a) state) basic\"\n\ntext \\Duplicate forwarding and reordering behaviour of underlying instruction\\\nfun fwd\\<^sub>s :: \"('v,'g,'r,'a) opbasic \\ ('v,'g,'r,'a) auxop \\ ('v,'g,'r,'a) opbasic\" \n where \n \"fwd\\<^sub>s ((\\,f),v,b) (assign x e,_) = (let p = (subst\\<^sub>i \\ x e, f) in (p,v, beh\\<^sub>a p))\" |\n \"fwd\\<^sub>s ((\\,f),v,b) (\\,_) = ((\\,f),v,beh\\<^sub>a (\\,f))\"\n\ntext \\Lift an operation with specification\\\ndefinition liftg :: \"('v,'g,'r,'a) pred \\ ('v,'g,'r) op \\ ('v,'g,'r,'a) auxfn \\ ('v,'g,'r,'a) opbasic\" \n (\"\\_,_,_\\\" 100)\n where \"liftg v \\ f \\ ((\\,f), v, beh\\<^sub>a (\\,f))\"\n\ntext \\Lift an operation without specification\\\ndefinition liftl :: \"('v,'g,'r) op \\ ('v,'g,'r,'a) opbasic\" \n (\"\\_\\\" 100)\n where \"liftl \\ \\ ((\\,state_rec.more), UNIV, beh\\<^sub>a (\\,state_rec.more))\"\n\nsection \\Language Definition\\\n\ndatatype ('v,'g,'r,'a) lang =\n Skip\n | Op \"('v,'g,'r,'a) pred\" \"('v,'g,'r) op\" \"('v,'g,'r,'a) auxfn\"\n | Seq \"('v,'g,'r,'a) lang\" \"('v,'g,'r,'a) lang\"\n | If \"('v,'g,'r) bexp\" \"('v,'g,'r,'a) lang\" \"('v,'g,'r,'a) lang\"\n | While \"('v,'g,'r) bexp\" \"('v,'g,'r,'a) pred\" \"('v,'g,'r,'a) lang\"\n | DoWhile \"('v,'g,'r,'a) pred\" \"('v,'g,'r,'a) lang\" \"('v,'g,'r) bexp\"\n\nend\n", "meta": {"author": "UQ-PAC", "repo": "wmm-rg", "sha": "7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2", "save_path": "github-repos/isabelle/UQ-PAC-wmm-rg", "path": "github-repos/isabelle/UQ-PAC-wmm-rg/wmm-rg-7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2/SimAsm/SimAsm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.542863297964157, "lm_q2_score": 0.36658975016245987, "lm_q1q2_score": 0.19900812077304933}} {"text": "(* Title: HOL/SET_Protocol/Merchant_Registration.thy\n Author: Giampaolo Bella\n Author: Fabio Massacci\n Author: Lawrence C Paulson\n*)\n\nsection\\The SET Merchant Registration Protocol\\\n\ntheory Merchant_Registration\nimports Public_SET\nbegin\n\ntext\\Copmpared with Cardholder Reigstration, \\KeyCryptKey\\ is not\n needed: no session key encrypts another. Instead we\n prove the \"key compromise\" theorems for sets KK that contain no private\n encryption keys (\\<^term>\\priEK C\\).\\\n\n\ninductive_set\n set_mr :: \"event list set\"\nwhere\n\n Nil: \\ \\Initial trace is empty\\\n \"[] \\ set_mr\"\n\n\n| Fake: \\ \\The spy MAY say anything he CAN say.\\\n \"[| evsf \\ set_mr; X \\ synth (analz (knows Spy evsf)) |]\n ==> Says Spy B X # evsf \\ set_mr\"\n \n\n| Reception: \\ \\If A sends a message X to B, then B might receive it\\\n \"[| evsr \\ set_mr; Says A B X \\ set evsr |]\n ==> Gets B X # evsr \\ set_mr\"\n\n\n| SET_MR1: \\ \\RegFormReq: M requires a registration form to a CA\\\n \"[| evs1 \\ set_mr; M = Merchant k; Nonce NM1 \\ used evs1 |]\n ==> Says M (CA i) \\Agent M, Nonce NM1\\ # evs1 \\ set_mr\"\n\n\n| SET_MR2: \\ \\RegFormRes: CA replies with the registration form and the \n certificates for her keys\\\n \"[| evs2 \\ set_mr; Nonce NCA \\ used evs2;\n Gets (CA i) \\Agent M, Nonce NM1\\ \\ set evs2 |]\n ==> Says (CA i) M \\sign (priSK (CA i)) \\Agent M, Nonce NM1, Nonce NCA\\,\n cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA),\n cert (CA i) (pubSK (CA i)) onlySig (priSK RCA) \\\n # evs2 \\ set_mr\"\n\n| SET_MR3:\n \\ \\CertReq: M submits the key pair to be certified. The Notes\n event allows KM1 to be lost if M is compromised. Piero remarks\n that the agent mentioned inside the signature is not verified to\n correspond to M. As in CR, each Merchant has fixed key pairs. M\n is only optionally required to send NCA back, so M doesn't do so\n in the model\\\n \"[| evs3 \\ set_mr; M = Merchant k; Nonce NM2 \\ used evs3;\n Key KM1 \\ used evs3; KM1 \\ symKeys;\n Gets M \\sign (invKey SKi) \\Agent X, Nonce NM1, Nonce NCA\\,\n cert (CA i) EKi onlyEnc (priSK RCA),\n cert (CA i) SKi onlySig (priSK RCA) \\\n \\ set evs3;\n Says M (CA i) \\Agent M, Nonce NM1\\ \\ set evs3 |]\n ==> Says M (CA i)\n \\Crypt KM1 (sign (priSK M) \\Agent M, Nonce NM2,\n Key (pubSK M), Key (pubEK M)\\),\n Crypt EKi (Key KM1)\\\n # Notes M \\Key KM1, Agent (CA i)\\\n # evs3 \\ set_mr\"\n\n| SET_MR4:\n \\ \\CertRes: CA issues the certificates for merSK and merEK,\n while checking never to have certified the m even\n separately. NOTE: In Cardholder Registration the\n corresponding rule (6) doesn't use the \"sign\" primitive. \"The\n CertRes shall be signed but not encrypted if the EE is a Merchant\n or Payment Gateway.\"-- Programmer's Guide, page 191.\\\n \"[| evs4 \\ set_mr; M = Merchant k;\n merSK \\ symKeys; merEK \\ symKeys;\n Notes (CA i) (Key merSK) \\ set evs4;\n Notes (CA i) (Key merEK) \\ set evs4;\n Gets (CA i) \\Crypt KM1 (sign (invKey merSK)\n \\Agent M, Nonce NM2, Key merSK, Key merEK\\),\n Crypt (pubEK (CA i)) (Key KM1) \\\n \\ set evs4 |]\n ==> Says (CA i) M \\sign (priSK(CA i)) \\Agent M, Nonce NM2, Agent(CA i)\\,\n cert M merSK onlySig (priSK (CA i)),\n cert M merEK onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\\\n # Notes (CA i) (Key merSK)\n # Notes (CA i) (Key merEK)\n # evs4 \\ set_mr\"\n\n\ntext\\Note possibility proofs are missing.\\\n\ndeclare Says_imp_knows_Spy [THEN parts.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\ntext\\General facts about message reception\\\nlemma Gets_imp_Says:\n \"[| Gets B X \\ set evs; evs \\ set_mr |] ==> \\A. Says A B X \\ set evs\"\napply (erule rev_mp)\napply (erule set_mr.induct, auto)\ndone\n\nlemma Gets_imp_knows_Spy:\n \"[| Gets B X \\ set evs; evs \\ set_mr |] ==> X \\ knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\n\ndeclare Gets_imp_knows_Spy [THEN parts.Inj, dest]\n\nsubsubsection\\Proofs on keys\\\n\ntext\\Spy never sees an agent's private keys! (unless it's bad at start)\\\nlemma Spy_see_private_Key [simp]:\n \"evs \\ set_mr\n ==> (Key(invKey (publicKey b A)) \\ parts(knows Spy evs)) = (A \\ bad)\"\napply (erule set_mr.induct)\napply (auto dest!: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\nlemma Spy_analz_private_Key [simp]:\n \"evs \\ set_mr ==>\n (Key(invKey (publicKey b A)) \\ analz(knows Spy evs)) = (A \\ bad)\"\nby auto\n\ndeclare Spy_see_private_Key [THEN [2] rev_iffD1, dest!]\ndeclare Spy_analz_private_Key [THEN [2] rev_iffD1, dest!]\n\n(*This is to state that the signed keys received in step 4\n are into parts - rather than installing sign_def each time.\n Needed in Spy_see_priSK_RCA, Spy_see_priEK and in Spy_see_priSK\nGoal \"[|Gets C \\Crypt KM1\n (sign K \\Agent M, Nonce NM2, Key merSK, Key merEK\\), X\\\n \\ set evs; evs \\ set_mr |]\n ==> Key merSK \\ parts (knows Spy evs) \\\n Key merEK \\ parts (knows Spy evs)\"\nby (fast_tac (claset() addss (simpset())) 1);\nqed \"signed_keys_in_parts\";\n???*)\n\ntext\\Proofs on certificates -\n they hold, as in CR, because RCA's keys are secure\\\n\nlemma Crypt_valid_pubEK:\n \"[| Crypt (priSK RCA) \\Agent (CA i), Key EKi, onlyEnc\\\n \\ parts (knows Spy evs);\n evs \\ set_mr |] ==> EKi = pubEK (CA i)\"\napply (erule rev_mp)\napply (erule set_mr.induct, auto)\ndone\n\nlemma certificate_valid_pubEK:\n \"[| cert (CA i) EKi onlyEnc (priSK RCA) \\ parts (knows Spy evs);\n evs \\ set_mr |]\n ==> EKi = pubEK (CA i)\"\napply (unfold cert_def signCert_def)\napply (blast dest!: Crypt_valid_pubEK)\ndone\n\nlemma Crypt_valid_pubSK:\n \"[| Crypt (priSK RCA) \\Agent (CA i), Key SKi, onlySig\\\n \\ parts (knows Spy evs);\n evs \\ set_mr |] ==> SKi = pubSK (CA i)\"\napply (erule rev_mp)\napply (erule set_mr.induct, auto)\ndone\n\nlemma certificate_valid_pubSK:\n \"[| cert (CA i) SKi onlySig (priSK RCA) \\ parts (knows Spy evs);\n evs \\ set_mr |] ==> SKi = pubSK (CA i)\"\napply (unfold cert_def signCert_def)\napply (blast dest!: Crypt_valid_pubSK)\ndone\n\nlemma Gets_certificate_valid:\n \"[| Gets A \\ X, cert (CA i) EKi onlyEnc (priSK RCA),\n cert (CA i) SKi onlySig (priSK RCA)\\ \\ set evs;\n evs \\ set_mr |]\n ==> EKi = pubEK (CA i) \\ SKi = pubSK (CA i)\"\nby (blast dest: certificate_valid_pubEK certificate_valid_pubSK)\n\n\ntext\\Nobody can have used non-existent keys!\\\nlemma new_keys_not_used [rule_format,simp]:\n \"evs \\ set_mr\n ==> Key K \\ used evs \\ K \\ symKeys \\\n K \\ keysFor (parts (knows Spy evs))\"\napply (erule set_mr.induct, simp_all)\napply (force dest!: usedI keysFor_parts_insert) \\ \\Fake\\\napply force \\ \\Message 2\\\napply (blast dest: Gets_certificate_valid) \\ \\Message 3\\\napply force \\ \\Message 4\\\ndone\n\n\nsubsubsection\\New Versions: As Above, but Generalized with the Kk Argument\\\n\nlemma gen_new_keys_not_used [rule_format]:\n \"evs \\ set_mr\n ==> Key K \\ used evs \\ K \\ symKeys \\\n K \\ keysFor (parts (Key`KK \\ knows Spy evs))\"\nby auto\n\nlemma gen_new_keys_not_analzd:\n \"[|Key K \\ used evs; K \\ symKeys; evs \\ set_mr |]\n ==> K \\ keysFor (analz (Key`KK \\ knows Spy evs))\"\nby (blast intro: keysFor_mono [THEN [2] rev_subsetD]\n dest: gen_new_keys_not_used)\n\nlemma analz_Key_image_insert_eq:\n \"[|Key K \\ used evs; K \\ symKeys; evs \\ set_mr |]\n ==> analz (Key ` (insert K KK) \\ knows Spy evs) =\n insert (Key K) (analz (Key ` KK \\ knows Spy evs))\"\nby (simp add: gen_new_keys_not_analzd)\n\n\nlemma Crypt_parts_imp_used:\n \"[|Crypt K X \\ parts (knows Spy evs);\n K \\ symKeys; evs \\ set_mr |] ==> Key K \\ used evs\"\napply (rule ccontr)\napply (force dest: new_keys_not_used Crypt_imp_invKey_keysFor)\ndone\n\nlemma Crypt_analz_imp_used:\n \"[|Crypt K X \\ analz (knows Spy evs);\n K \\ symKeys; evs \\ set_mr |] ==> Key K \\ used evs\"\nby (blast intro: Crypt_parts_imp_used)\n\ntext\\Rewriting rule for private encryption keys. Analogous rewriting rules\nfor other keys aren't needed.\\\n\nlemma parts_image_priEK:\n \"[|Key (priEK (CA i)) \\ parts (Key`KK \\ (knows Spy evs));\n evs \\ set_mr|] ==> priEK (CA i) \\ KK | CA i \\ bad\"\nby auto\n\ntext\\trivial proof because (priEK (CA i)) never appears even in (parts evs)\\\nlemma analz_image_priEK:\n \"evs \\ set_mr ==>\n (Key (priEK (CA i)) \\ analz (Key`KK \\ (knows Spy evs))) =\n (priEK (CA i) \\ KK | CA i \\ bad)\"\nby (blast dest!: parts_image_priEK intro: analz_mono [THEN [2] rev_subsetD])\n\n\nsubsection\\Secrecy of Session Keys\\\n\ntext\\This holds because if (priEK (CA i)) appears in any traffic then it must\n be known to the Spy, by \\Spy_see_private_Key\\\\\nlemma merK_neq_priEK:\n \"[|Key merK \\ analz (knows Spy evs);\n Key merK \\ parts (knows Spy evs);\n evs \\ set_mr|] ==> merK \\ priEK C\"\nby blast\n\ntext\\Lemma for message 4: either merK is compromised (when we don't care)\n or else merK hasn't been used to encrypt K.\\\nlemma msg4_priEK_disj:\n \"[|Gets B \\Crypt KM1\n (sign K \\Agent M, Nonce NM2, Key merSK, Key merEK\\),\n Y\\ \\ set evs;\n evs \\ set_mr|]\n ==> (Key merSK \\ analz (knows Spy evs) | merSK \\ range(\\C. priEK C))\n \\ (Key merEK \\ analz (knows Spy evs) | merEK \\ range(\\C. priEK C))\"\napply (unfold sign_def)\napply (blast dest: merK_neq_priEK)\ndone\n\n\nlemma Key_analz_image_Key_lemma:\n \"P \\ (Key K \\ analz (Key`KK \\ H)) \\ (K\\KK | Key K \\ analz H)\n ==>\n P \\ (Key K \\ analz (Key`KK \\ H)) = (K\\KK | Key K \\ analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\nlemma symKey_compromise:\n \"evs \\ set_mr ==>\n (\\SK KK. SK \\ symKeys \\ (\\K \\ KK. K \\ range(\\C. priEK C)) \\\n (Key SK \\ analz (Key`KK \\ (knows Spy evs))) =\n (SK \\ KK | Key SK \\ analz (knows Spy evs)))\"\napply (erule set_mr.induct)\napply (safe del: impI intro!: Key_analz_image_Key_lemma [THEN impI])\napply (drule_tac [7] msg4_priEK_disj)\napply (frule_tac [6] Gets_certificate_valid)\napply (safe del: impI)\napply (simp_all del: image_insert image_Un imp_disjL\n add: analz_image_keys_simps abbrev_simps analz_knows_absorb\n analz_knows_absorb2 analz_Key_image_insert_eq notin_image_iff\n Spy_analz_private_Key analz_image_priEK)\n \\ \\5 seconds on a 1.6GHz machine\\\napply spy_analz \\ \\Fake\\\napply auto \\ \\Message 3\\\ndone\n\nlemma symKey_secrecy [rule_format]:\n \"[|CA i \\ bad; K \\ symKeys; evs \\ set_mr|]\n ==> \\X m. Says (Merchant m) (CA i) X \\ set evs \\\n Key K \\ parts{X} \\\n Merchant m \\ bad \\\n Key K \\ analz (knows Spy evs)\"\napply (erule set_mr.induct)\napply (drule_tac [7] msg4_priEK_disj)\napply (frule_tac [6] Gets_certificate_valid)\napply (safe del: impI)\napply (simp_all del: image_insert image_Un imp_disjL\n add: analz_image_keys_simps abbrev_simps analz_knows_absorb\n analz_knows_absorb2 analz_Key_image_insert_eq\n symKey_compromise notin_image_iff Spy_analz_private_Key\n analz_image_priEK)\napply spy_analz \\ \\Fake\\\napply force \\ \\Message 1\\\napply (auto intro: analz_into_parts [THEN usedI] in_parts_Says_imp_used) \\ \\Message 3\\\ndone\n\nsubsection\\Unicity\\\n\nlemma msg4_Says_imp_Notes:\n \"[|Says (CA i) M \\sign (priSK (CA i)) \\Agent M, Nonce NM2, Agent (CA i)\\,\n cert M merSK onlySig (priSK (CA i)),\n cert M merEK onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\\ \\ set evs;\n evs \\ set_mr |]\n ==> Notes (CA i) (Key merSK) \\ set evs\n \\ Notes (CA i) (Key merEK) \\ set evs\"\napply (erule rev_mp)\napply (erule set_mr.induct)\napply (simp_all (no_asm_simp))\ndone\n\ntext\\Unicity of merSK wrt a given CA:\n merSK uniquely identifies the other components, including merEK\\\nlemma merSK_unicity:\n \"[|Says (CA i) M \\sign (priSK(CA i)) \\Agent M, Nonce NM2, Agent (CA i)\\,\n cert M merSK onlySig (priSK (CA i)),\n cert M merEK onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\\ \\ set evs;\n Says (CA i) M' \\sign (priSK(CA i)) \\Agent M', Nonce NM2', Agent (CA i)\\,\n cert M' merSK onlySig (priSK (CA i)),\n cert M' merEK' onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK(CA i)) onlySig (priSK RCA)\\ \\ set evs;\n evs \\ set_mr |] ==> M=M' \\ NM2=NM2' \\ merEK=merEK'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule set_mr.induct)\napply (simp_all (no_asm_simp))\napply (blast dest!: msg4_Says_imp_Notes)\ndone\n\ntext\\Unicity of merEK wrt a given CA:\n merEK uniquely identifies the other components, including merSK\\\nlemma merEK_unicity:\n \"[|Says (CA i) M \\sign (priSK(CA i)) \\Agent M, Nonce NM2, Agent (CA i)\\,\n cert M merSK onlySig (priSK (CA i)),\n cert M merEK onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\\ \\ set evs;\n Says (CA i) M' \\sign (priSK(CA i)) \\Agent M', Nonce NM2', Agent (CA i)\\,\n cert M' merSK' onlySig (priSK (CA i)),\n cert M' merEK onlyEnc (priSK (CA i)),\n cert (CA i) (pubSK(CA i)) onlySig (priSK RCA)\\ \\ set evs;\n evs \\ set_mr |] \n ==> M=M' \\ NM2=NM2' \\ merSK=merSK'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule set_mr.induct)\napply (simp_all (no_asm_simp))\napply (blast dest!: msg4_Says_imp_Notes)\ndone\n\n\ntext\\-No interest on secrecy of nonces: they appear to be used\n only for freshness.\n -No interest on secrecy of merSK or merEK, as in CR.\n -There's no equivalent of the PAN\\\n\n\nsubsection\\Primary Goals of Merchant Registration\\\n\nsubsubsection\\The merchant's certificates really were created by the CA,\nprovided the CA is uncompromised\\\n\ntext\\The assumption \\<^term>\\CA i \\ RCA\\ is required: step 2 uses \n certificates of the same form.\\\nlemma certificate_merSK_valid_lemma [intro]:\n \"[|Crypt (priSK (CA i)) \\Agent M, Key merSK, onlySig\\\n \\ parts (knows Spy evs);\n CA i \\ bad; CA i \\ RCA; evs \\ set_mr|]\n ==> \\X Y Z. Says (CA i) M\n \\X, cert M merSK onlySig (priSK (CA i)), Y, Z\\ \\ set evs\"\napply (erule rev_mp)\napply (erule set_mr.induct)\napply (simp_all (no_asm_simp))\napply auto\ndone\n\nlemma certificate_merSK_valid:\n \"[| cert M merSK onlySig (priSK (CA i)) \\ parts (knows Spy evs);\n CA i \\ bad; CA i \\ RCA; evs \\ set_mr|]\n ==> \\X Y Z. Says (CA i) M\n \\X, cert M merSK onlySig (priSK (CA i)), Y, Z\\ \\ set evs\"\nby auto\n\nlemma certificate_merEK_valid_lemma [intro]:\n \"[|Crypt (priSK (CA i)) \\Agent M, Key merEK, onlyEnc\\\n \\ parts (knows Spy evs);\n CA i \\ bad; CA i \\ RCA; evs \\ set_mr|]\n ==> \\X Y Z. Says (CA i) M\n \\X, Y, cert M merEK onlyEnc (priSK (CA i)), Z\\ \\ set evs\"\napply (erule rev_mp)\napply (erule set_mr.induct)\napply (simp_all (no_asm_simp))\napply auto\ndone\n\nlemma certificate_merEK_valid:\n \"[| cert M merEK onlyEnc (priSK (CA i)) \\ parts (knows Spy evs);\n CA i \\ bad; CA i \\ RCA; evs \\ set_mr|]\n ==> \\X Y Z. Says (CA i) M\n \\X, Y, cert M merEK onlyEnc (priSK (CA i)), Z\\ \\ set evs\"\nby auto\n\ntext\\The two certificates - for merSK and for merEK - cannot be proved to\n have originated together\\\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/SET_Protocol/Merchant_Registration.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.3665897501624599, "lm_q1q2_score": 0.1990081099281134}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: pfslvl3.thy (Isabelle/HOL 2016-1)\n ID: $Id: pfslvl3.thy 133183 2017-01-31 13:55:43Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Generic Level 3 protocol using ephemeral asymmetric keys to achieve \n forward secrecy.\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Key Transport Protocol with PFS (L3 locale)\\\n\ntheory pfslvl3\nimports pfslvl2 Implem_lemmas\nbegin\n\n\n(**************************************************************************************************)\nsubsection \\State and Events\\\n(**************************************************************************************************)\n\ntext \\Level 3 state\\\ntext \\(The types have to be defined outside the locale.)\\\n\nrecord l3_state = l1_state + \n bad :: \"agent set\"\n\ntype_synonym l3_obs = \"l3_state\"\n\ntype_synonym\n l3_pred = \"l3_state set\"\n\ntype_synonym\n l3_trans = \"(l3_state \\ l3_state) set\"\n\n\ntext \\attacker event\\\ndefinition\n l3_dy :: \"msg \\ l3_trans\"\nwhere\n \"l3_dy \\ ik_dy\"\n\n\n\ntext \\compromise events\\\ndefinition\n l3_lkr_others :: \"agent \\ l3_trans\"\nwhere\n \"l3_lkr_others A \\ {(s,s').\n \\ \\guards\\\n A \\ test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s,\n ik := keys_of A \\ ik s\\\n }\"\n\ndefinition\n l3_lkr_actor :: \"agent \\ l3_trans\"\nwhere\n \"l3_lkr_actor A \\ {(s,s').\n \\ \\guards\\\n A = test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s,\n ik := keys_of A \\ ik s\\\n }\"\n\ndefinition\n l3_lkr_after :: \"agent \\ l3_trans\"\nwhere\n \"l3_lkr_after A \\ {(s,s').\n \\ \\guards\\\n test_ended s \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s,\n ik := keys_of A \\ ik s\\\n }\"\n\ndefinition\n l3_skr :: \"rid_t \\ msg \\ l3_trans\"\nwhere\n \"l3_skr R K \\ {(s,s').\n \\ \\guards\\\n R \\ test \\ R \\ partners \\\n in_progress (progress s R) xsk \\\n guessed_frame R xsk = Some K \\\n \\ \\actions\\\n s' = s\\ik := {K} \\ ik s\\\n }\"\n\ntext \\New locale for the level 3 protocol\\\ntext \\This locale does not add new assumptions, it is only used to separate the level 3\nprotocol from the implementation locale.\\\nlocale pfslvl3 = valid_implem\nbegin\n\ntext \\protocol events\\\ndefinition\n l3_step1 :: \"rid_t \\ agent \\ agent \\ l3_trans\"\nwhere\n \"l3_step1 Ra A B \\ {(s, s').\n \\ \\guards:\\\n Ra \\ dom (progress s) \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n \\ \\actions:\\\n s' = s\\\n progress := (progress s)(Ra \\ {xpkE, xskE}),\n ik := {implAuth A B \\Number 0, epubKF (Ra$kE)\\} \\ (ik s)\n \\\n }\"\n\ndefinition\n l3_step2 :: \"rid_t \\ agent \\ agent \\ msg \\ l3_trans\"\nwhere\n \"l3_step2 Rb A B KE \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n Rb \\ dom (progress s) \\\n guessed_frame Rb xpkE = Some KE \\\n implAuth A B \\Number 0, KE\\ \\ ik s \\\n \\ \\actions:\\\n s' = s\\\n progress := (progress s)(Rb \\ {xpkE, xsk}),\n ik := {implAuth B A (Aenc (NonceF (Rb$sk)) KE)} \\ (ik s),\n signals := if can_signal s A B then\n addSignal (signals s) (Running A B \\KE, NonceF (Rb$sk)\\)\n else\n signals s,\n secret := {x. x = NonceF (Rb$sk) \\ Rb = test} \\ secret s\n \\\n }\" \n\n\ndefinition\n l3_step3 :: \"rid_t \\ agent \\ agent \\ msg \\ l3_trans\"\nwhere\n \"l3_step3 Ra A B K \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n progress s Ra = Some {xpkE, xskE} \\\n guessed_frame Ra xsk = Some K \\\n implAuth B A (Aenc K (epubKF (Ra$kE))) \\ ik s \\\n \\ \\actions:\\\n s' = s\\ progress := (progress s)(Ra \\ {xpkE, xskE, xsk}),\n signals := if can_signal s A B then\n addSignal (signals s) (Commit A B \\epubKF (Ra$kE), K\\)\n else\n signals s,\n secret := {x. x = K \\ Ra = test} \\ secret s\n \\\n }\"\n\n\n\ntext \\specification\\\n\ntext \\initial compromise\\\n\ndefinition\n ik_init :: \"msg set\"\nwhere\n \"ik_init \\ {priK C |C. C \\ bad_init} \\ {pubK A | A. True} \\ \n {shrK A B |A B. A \\ bad_init \\ B \\ bad_init} \\ Tags\"\n\ntext \\lemmas about @{term \"ik_init\"}\\\nlemma parts_ik_init [simp]: \"parts ik_init = ik_init\"\nby (auto elim!: parts.induct, auto simp add: ik_init_def)\n\nlemma analz_ik_init [simp]: \"analz ik_init = ik_init\"\nby (auto dest: analz_into_parts)\n\nlemma abs_ik_init [iff]: \"abs ik_init = {}\"\napply (auto elim!: absE)\napply (auto simp add: ik_init_def)\ndone\n\nlemma payloadSet_ik_init [iff]: \"ik_init \\ payload = {}\"\nby (auto simp add: ik_init_def)\n\nlemma validSet_ik_init [iff]: \"ik_init \\ valid = {}\"\nby (auto simp add: ik_init_def)\n\n\ndefinition \n l3_init :: \"l3_state set\"\nwhere\n \"l3_init \\ { \\\n ik = ik_init,\n secret = {},\n progress = Map.empty,\n signals = \\x. 0,\n bad = bad_init\n \\}\"\n\nlemmas l3_init_defs = l3_init_def ik_init_def\n\ndefinition \nl3_trans :: \"l3_trans\"\nwhere\n \"l3_trans \\ (\\m M KE Rb Ra A B K.\n l3_step1 Ra A B \\\n l3_step2 Rb A B KE \\\n l3_step3 Ra A B m \\\n l3_dy M \\\n l3_lkr_others A \\\n l3_lkr_after A \\\n l3_skr Ra K \\\n Id\n )\"\n\n\ndefinition \n l3 :: \"(l3_state, l3_obs) spec\" where\n \"l3 \\ \\\n init = l3_init,\n trans = l3_trans,\n obs = id\n \\\"\n\nlemmas l3_loc_defs = \n l3_step1_def l3_step2_def l3_step3_def\n l3_def l3_init_defs l3_trans_def\n l3_dy_def\n l3_lkr_others_def l3_lkr_after_def l3_skr_def\n\nlemmas l3_defs = l3_loc_defs ik_dy_def\nlemmas l3_nostep_defs = l3_def l3_init_def l3_trans_def\n\n\nlemma l3_obs_id [simp]: \"obs l3 = id\"\nby (simp add: l3_def)\n\n\n(**************************************************************************************************)\nsubsection \\Invariants\\\n(**************************************************************************************************)\nsubsubsection \\inv1: No long-term keys as message parts\\\n(**************************************************************************************************)\n\ndefinition\n l3_inv1 :: \"l3_state set\"\nwhere\n \"l3_inv1 \\ {s.\n parts (ik s) \\ range LtK \\ ik s\n }\"\n\nlemmas l3_inv1I = l3_inv1_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv1E [elim] = l3_inv1_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv1D = l3_inv1_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv1D' [dest]: \"\\ LtK K \\ parts (ik s); s \\ l3_inv1\\ \\ LtK K \\ ik s\"\nby (auto simp add: l3_inv1_def)\n\nlemma l3_inv1_init [iff]:\n \"init l3 \\ l3_inv1\"\nby (auto simp add: l3_def l3_init_def intro!:l3_inv1I)\n\nlemma l3_inv1_trans [iff]:\n \"{l3_inv1} trans l3 {> l3_inv1}\"\napply (auto simp add: PO_hoare_defs l3_nostep_defs intro!: l3_inv1I)\napply (auto simp add: l3_defs dy_fake_msg_def dy_fake_chan_def\n parts_insert [where H=\"ik _\"] parts_insert [where H=\"insert _ (ik _)\"]\n dest!: Fake_parts_insert)\napply (auto dest:analz_into_parts)\ndone\n\nlemma PO_l3_inv1 [iff]:\n \"reach l3 \\ l3_inv1\"\nby (rule inv_rule_basic) (auto)\n\n\n\nsubsubsection \\inv2: @{term \"bad s\"} indeed contains \"bad\" keys\\\n(**************************************************************************************************)\n\ndefinition\n l3_inv2 :: \"l3_state set\"\nwhere\n \"l3_inv2 \\ {s.\n Keys_bad (ik s) (bad s)\n }\"\n\nlemmas l3_inv2I = l3_inv2_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv2E [elim] = l3_inv2_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv2D = l3_inv2_def [THEN setc_def_to_dest, rule_format]\n\n\nlemma l3_inv2_init [simp,intro!]:\n \"init l3 \\ l3_inv2\"\nby (auto simp add: l3_def l3_init_defs intro!:l3_inv2I Keys_badI)\n\nlemma l3_inv2_trans [simp,intro!]:\n \"{l3_inv2 \\ l3_inv1} trans l3 {> l3_inv2}\"\napply (auto simp add: PO_hoare_defs l3_nostep_defs intro!: l3_inv2I)\napply (auto simp add: l3_defs dy_fake_msg_def dy_fake_chan_def)\ntext \\4 subgoals: dy, lkr*, skr\\\napply (auto intro: Keys_bad_insert_Fake Keys_bad_insert_keys_of)\napply (auto intro!: Keys_bad_insert_payload)\ndone\n\nlemma PO_l3_inv2 [iff]: \"reach l3 \\ l3_inv2\"\nby (rule_tac J=\"l3_inv1\" in inv_rule_incr) (auto)\n\n\n\nsubsubsection \\inv3\\\n(**************************************************************************************************)\n\ntext \\If a message can be analyzed from the intruder knowledge then it can\nbe derived (using synth/analz) from the sets of implementation, non-implementation, and\nlong-term key messages and the tags. That is, intermediate messages are not needed.\n\\\n\n\ndefinition\n l3_inv3 :: \"l3_state set\" \nwhere\n \"l3_inv3 \\ {s.\n analz (ik s) \\ \n synth (analz ((ik s \\ payload) \\ ((ik s) \\ valid) \\ (ik s \\ range LtK) \\ Tags))\n }\"\n\nlemmas l3_inv3I = l3_inv3_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv3E = l3_inv3_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv3D = l3_inv3_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv3_init [iff]:\n \"init l3 \\ l3_inv3\"\napply (auto simp add: l3_def l3_init_def intro!: l3_inv3I)\napply (auto simp add: ik_init_def intro!: synth_increasing [THEN [2] rev_subsetD])\ndone\n\ndeclare domIff [iff del]\n\ntext \\Most of the cases in this proof are simple and very similar.\nThe proof could probably be shortened.\\\nlemma l3_inv3_trans [simp,intro!]:\n \"{l3_inv3} trans l3 {> l3_inv3}\"\nproof (simp add: l3_nostep_defs, safe)\n fix Ra A B\n show \"{l3_inv3} l3_step1 Ra A B {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n apply (auto intro!: validI dest!: analz_insert_partition [THEN [2] rev_subsetD])\n done\nnext\n fix Rb A B KE\n show \"{l3_inv3} l3_step2 Rb A B KE {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n apply (auto intro!: validI dest!: analz_insert_partition [THEN [2] rev_subsetD])\n done\nnext\n fix Ra A B K\n show \"{l3_inv3} l3_step3 Ra A B K {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n done\nnext\n fix m \n show \"{l3_inv3} l3_dy m {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs dy_fake_chan_def dy_fake_msg_def\n intro!: l3_inv3I dest!: l3_inv3D)\n apply (drule synth_analz_insert)\n apply (blast intro: synth_analz_monotone dest: synth_monotone)\n done\nnext\n fix A\n show \"{l3_inv3} l3_lkr_others A {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n apply (drule analz_Un_partition [of _ \"keys_of A\"], auto)\n done\nnext\n fix A\n show \"{l3_inv3} l3_lkr_after A {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n apply (drule analz_Un_partition [of _ \"keys_of A\"], auto)\n done\nnext\n fix R K\n show \"{l3_inv3} l3_skr R K {> l3_inv3}\"\n apply (auto simp add: PO_hoare_def l3_defs intro!: l3_inv3I dest!: l3_inv3D)\n apply (auto dest!: analz_insert_partition [THEN [2] rev_subsetD])\n done\nqed\n\nlemma PO_l3_inv3 [iff]: \"reach l3 \\ l3_inv3\"\nby (rule inv_rule_basic) (auto)\n\n\n\nsubsubsection \\inv4: the intruder knows the tags\\\n(**************************************************************************************************)\n\ndefinition\n l3_inv4 :: \"l3_state set\"\nwhere\n \"l3_inv4 \\ {s.\n Tags \\ ik s\n }\"\n\nlemmas l3_inv4I = l3_inv4_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv4E [elim] = l3_inv4_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv4D = l3_inv4_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv4_init [simp,intro!]:\n \"init l3 \\ l3_inv4\"\nby (auto simp add: l3_def l3_init_def ik_init_def intro!:l3_inv4I)\n\nlemma l3_inv4_trans [simp,intro!]:\n \"{l3_inv4} trans l3 {> l3_inv4}\"\napply (auto simp add: PO_hoare_defs l3_nostep_defs intro!: l3_inv4I)\napply (auto simp add: l3_defs dy_fake_chan_def dy_fake_msg_def)\ndone\n\nlemma PO_l3_inv4 [simp,intro!]: \"reach l3 \\ l3_inv4\"\nby (rule inv_rule_basic) (auto)\n\n\ntext \\The remaining invariants are derived from the others.\nThey are not protocol dependent provided the previous invariants hold.\\\n\nsubsubsection \\inv5\\\n(**************************************************************************************************)\n\ntext \\The messages that the L3 DY intruder can derive from the intruder knowledge \n(using @{term \"synth\"}/@{term \"analz\"}), are either implementations or intermediate messages or\ncan also be derived by the L2 intruder from the set \n@{term \"extr (bad s) ((ik s) \\ payload) (abs (ik s))\"}, that is, given the \nnon-implementation messages and the abstractions of (implementation) messages\nin the intruder knowledge. \n\\\n\ndefinition\n l3_inv5 :: \"l3_state set\"\nwhere\n \"l3_inv5 \\ {s.\n synth (analz (ik s)) \\ \n dy_fake_msg (bad s) (ik s \\ payload) (abs (ik s)) \\ -payload\n }\"\n\nlemmas l3_inv5I = l3_inv5_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv5E = l3_inv5_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv5D = l3_inv5_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv5_derived: \"l3_inv2 \\ l3_inv3 \\ l3_inv5\"\nby (auto simp add: abs_validSet dy_fake_msg_def intro!: l3_inv5I\n dest!: l3_inv3D [THEN synth_mono, THEN [2] rev_subsetD]\n dest!: synth_analz_NI_I_K_synth_analz_NI_E [THEN [2] rev_subsetD])\n\nlemma PO_l3_inv5 [simp,intro!]: \"reach l3 \\ l3_inv5\"\nusing l3_inv5_derived PO_l3_inv2 PO_l3_inv3 \nby blast\n\nsubsubsection \\inv6\\\n(**************************************************************************************************)\n\ntext \\If the level 3 intruder can deduce a message implementing an insecure channel message, then:\n\\begin{itemize}\n \\item either the message is already in the intruder knowledge;\n \\item or the message is constructed, and the payload can also be deduced by the intruder.\n\\end{itemize}\n\\\n\ndefinition\n l3_inv6 :: \"l3_state set\"\nwhere\n \"l3_inv6 \\ {s. \\ A B M. \n (implInsec A B M \\ synth (analz (ik s)) \\ M \\ payload) \\ \n (implInsec A B M \\ ik s \\ M \\ synth (analz (ik s)))\n }\"\n\nlemmas l3_inv6I = l3_inv6_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv6E = l3_inv6_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv6D = l3_inv6_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv6_derived [simp,intro!]:\n \"l3_inv3 \\ l3_inv4 \\ l3_inv6\"\napply (auto intro!: l3_inv6I dest!: l3_inv3D)\ntext \\1 subgoal\\\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implInsec_synth_analz [rotated 1, where H=\"_ \\ _\"])\napply (auto dest!: synth_analz_monotone [of _ \"_ \\ _\" \"ik _\"])\ndone\n\nlemma PO_l3_inv6 [simp,intro!]: \"reach l3 \\ l3_inv6\"\nusing l3_inv6_derived PO_l3_inv3 PO_l3_inv4\nby (blast)\n\nsubsubsection \\inv7\\\n(**************************************************************************************************)\n\ntext \\If the level 3 intruder can deduce a message implementing a confidential channel message,\nthen:\n\\begin{itemize}\n \\item either the message is already in the intruder knowledge;\n \\item or the message is constructed, and the payload can also be deduced by the intruder.\n\\end{itemize}\n\\\n\ndefinition\n l3_inv7 :: \"l3_state set\"\nwhere\n \"l3_inv7 \\ {s. \\ A B M. \n (implConfid A B M \\ synth (analz (ik s)) \\ M \\ payload) \\ \n (implConfid A B M \\ ik s \\ M \\ synth (analz (ik s)))\n }\"\n\nlemmas l3_inv7I = l3_inv7_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv7E = l3_inv7_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv7D = l3_inv7_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv7_derived [simp,intro!]:\n \"l3_inv3 \\ l3_inv4 \\ l3_inv7\"\napply (auto intro!: l3_inv7I dest!: l3_inv3D)\ntext \\1 subgoal\\\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implConfid_synth_analz [rotated 1, where H=\"_ \\ _\"])\napply (auto dest!: synth_analz_monotone [of _ \"_ \\ _\" \"ik _\"])\ndone\n\nlemma PO_l3_inv7 [simp,intro!]: \"reach l3 \\ l3_inv7\"\nusing l3_inv7_derived PO_l3_inv3 PO_l3_inv4\nby (blast)\n\n\nsubsubsection \\inv8\\\n(**************************************************************************************************)\n\ntext \\If the level 3 intruder can deduce a message implementing an authentic channel message then:\n\\begin{itemize}\n \\item either the message is already in the intruder knowledge;\n \\item or the message is constructed, and in this case the payload can also be deduced\n by the intruder, and one of the agents is bad.\n\\end{itemize}\n\\\n\n\ndefinition\n l3_inv8 :: \"l3_state set\"\nwhere\n \"l3_inv8 \\ {s. \\ A B M. \n (implAuth A B M \\ synth (analz (ik s)) \\ M \\ payload) \\ \n (implAuth A B M \\ ik s \\ (M \\ synth (analz (ik s)) \\ (A \\ bad s \\ B \\ bad s)))\n }\"\n\nlemmas l3_inv8I = l3_inv8_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv8E = l3_inv8_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv8D = l3_inv8_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv8_derived [iff]:\n \"l3_inv2 \\ l3_inv3 \\ l3_inv4 \\ l3_inv8\"\napply (auto intro!: l3_inv8I dest!: l3_inv3D l3_inv2D)\ntext \\2 subgoals: M is deducible and the agents are bad\\\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implAuth_synth_analz [rotated 1, where H=\"_ \\ _\"] elim!: synth_analz_monotone)\n\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implAuth_synth_analz [rotated 1, where H=\"_ \\ _\"])\ndone\n\nlemma PO_l3_inv8 [iff]: \"reach l3 \\ l3_inv8\"\nusing l3_inv8_derived\n PO_l3_inv3 PO_l3_inv2 PO_l3_inv4\nby blast\n\n\nsubsubsection \\inv9\\\n(**************************************************************************************************)\n\ntext \\If the level 3 intruder can deduce a message implementing a secure channel message then:\n\\begin{itemize}\n \\item either the message is already in the intruder knowledge;\n \\item or the message is constructed, and in this case the payload can also be deduced \n by the intruder, and one of the agents is bad.\n\\end{itemize}\n\\\n\ndefinition\n l3_inv9 :: \"l3_state set\"\nwhere\n \"l3_inv9 \\ {s. \\ A B M. \n (implSecure A B M \\ synth (analz (ik s)) \\ M \\ payload) \\ \n (implSecure A B M \\ ik s \\ (M \\ synth (analz (ik s)) \\ (A \\ bad s \\ B \\ bad s)))\n }\"\n\nlemmas l3_inv9I = l3_inv9_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv9E = l3_inv9_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv9D = l3_inv9_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv9_derived [iff]:\n \"l3_inv2 \\ l3_inv3 \\ l3_inv4 \\ l3_inv9\"\napply (auto intro!: l3_inv9I dest!:l3_inv3D l3_inv2D)\ntext \\2 subgoals: M is deducible and the agents are bad\\\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implSecure_synth_analz [rotated 1, where H=\"_ \\ _\"] elim!: synth_analz_monotone)\n\napply (drule synth_mono, simp, drule subsetD, assumption)\napply (auto dest!: implSecure_synth_analz [rotated 1, where H=\"_ \\ _\"])\ndone\n\nlemma PO_l3_inv9 [iff]: \"reach l3 \\ l3_inv9\"\nusing l3_inv9_derived\n PO_l3_inv3 PO_l3_inv2 PO_l3_inv4\nby blast\n\n\n(**************************************************************************************************)\nsubsection \\Refinement\\\n(**************************************************************************************************)\n\ntext \\mediator function\\\ndefinition \n med23s :: \"l3_obs \\ l2_obs\"\nwhere\n \"med23s t \\ \\\n ik = ik t \\ payload,\n secret = secret t,\n progress = progress t,\n signals = signals t,\n chan = abs (ik t),\n bad = bad t\n \\\"\n\ntext \\relation between states\\\ndefinition\n R23s :: \"(l2_state * l3_state) set\"\nwhere\n \"R23s \\ {(s, s').\n s = med23s s'\n }\"\n\nlemmas R23s_defs = R23s_def med23s_def\n\n\nlemma R23sI: \n \"\\ ik s = ik t \\ payload; secret s = secret t; progress s = progress t; signals s = signals t;\n chan s = abs (ik t); l2_state.bad s = bad t \\ \n \\ (s, t) \\ R23s\"\nby (auto simp add: R23s_def med23s_def)\n\nlemma R23sD: \n \"(s, t) \\ R23s \\\n ik s = ik t \\ payload \\ secret s = secret t \\ progress s = progress t \\ signals s = signals t \\\n chan s = abs (ik t) \\ l2_state.bad s = bad t\"\nby (auto simp add: R23s_def med23s_def)\n\nlemma R23sE [elim]: \n \"\\ (s, t) \\ R23s;\n \\ ik s = ik t \\ payload; secret s = secret t; progress s = progress t; signals s = signals t;\n chan s = abs (ik t); l2_state.bad s = bad t \\ \\ P \\ \n \\ P\"\nby (auto simp add: R23s_def med23s_def)\n\nlemma can_signal_R23 [simp]:\n \"(s2, s3) \\ R23s \\\n can_signal s2 A B \\ can_signal s3 A B\"\nby (auto simp add: can_signal_def)\n\n\nsubsubsection \\Protocol events\\\n(**************************************************************************************************)\n\nlemma l3_step1_refines_step1:\n \"{R23s} l2_step1 Ra A B, l3_step1 Ra A B {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs)\napply (auto simp add: l3_defs l2_step1_def)\ndone\n\nlemma l3_step2_refines_step2:\n \"{R23s} l2_step2 Rb A B KE, l3_step2 Rb A B KE{>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs l2_step2_def)\napply (auto simp add: l3_step2_def)\ndone\n\nlemma l3_step3_refines_step3:\n \"{R23s} l2_step3 Ra A B K, l3_step3 Ra A B K {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs l2_step3_def)\napply (auto simp add: l3_step3_def)\ndone\n\n\nsubsubsection \\Intruder events\\\n(**************************************************************************************************)\n\nlemma l3_dy_payload_refines_dy_fake_msg:\n \"M \\ payload \\\n {R23s \\ UNIV \\ l3_inv5} l2_dy_fake_msg M, l3_dy M {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs)\napply (auto simp add: l3_defs l2_dy_fake_msg_def dest: l3_inv5D)\ndone\n\nlemma l3_dy_valid_refines_dy_fake_chan:\n \"\\ M \\ valid; M' \\ abs {M} \\ \\\n {R23s \\ UNIV \\ (l3_inv5 \\ l3_inv6 \\ l3_inv7 \\ l3_inv8 \\ l3_inv9)} \n l2_dy_fake_chan M', l3_dy M \n {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs, simp add: l2_dy_fake_chan_def)\napply (auto simp add: l3_defs)\ntext \\1 subgoal\\\napply (erule valid_cases, simp_all add: dy_fake_chan_def)\n text \\Insec\\\n apply (blast dest: l3_inv6D l3_inv5D)\n text \\Confid\\\n apply (blast dest: l3_inv7D l3_inv5D)\n text \\Auth\\\n apply (blast dest: l3_inv8D l3_inv5D)\n text \\Secure\\\n apply (blast dest: l3_inv9D l3_inv5D)\ndone\n\n\nlemma l3_dy_valid_refines_dy_fake_chan_Un:\n \"M \\ valid \\\n {R23s \\ UNIV \\ (l3_inv5 \\ l3_inv6 \\ l3_inv7 \\ l3_inv8 \\ l3_inv9)} \n \\M'. l2_dy_fake_chan M', l3_dy M \n {>R23s}\"\nby (auto dest: valid_abs intro: l3_dy_valid_refines_dy_fake_chan)\n\n\nlemma l3_dy_isLtKey_refines_skip:\n \"{R23s} Id, l3_dy (LtK ltk) {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs l3_defs)\napply (auto elim!: absE)\ndone\n\nlemma l3_dy_others_refines_skip:\n \"\\ M \\ range LtK; M \\ valid; M \\ payload \\ \\ \n {R23s} Id, l3_dy M {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs) (* auto SLOW *)\napply (auto simp add: l3_defs)\napply (auto elim!: absE intro: validI)\ndone\n\n\nlemma l3_dy_refines_dy_fake_msg_dy_fake_chan_skip:\n \"{R23s \\ UNIV \\ (l3_inv5 \\ l3_inv6 \\ l3_inv7 \\ l3_inv8 \\ l3_inv9)} \n l2_dy_fake_msg M \\ (\\M'. l2_dy_fake_chan M') \\ Id, l3_dy M \n {>R23s}\"\nby (cases \"M \\ payload \\ valid \\ range LtK\")\n (auto dest: l3_dy_payload_refines_dy_fake_msg l3_dy_valid_refines_dy_fake_chan_Un \n intro: l3_dy_isLtKey_refines_skip dest!: l3_dy_others_refines_skip)\n\n\nsubsubsection \\Compromise events\\\n(**************************************************************************************************)\n\nlemma l3_lkr_others_refines_lkr_others:\n \"{R23s} l2_lkr_others A, l3_lkr_others A {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs)\napply (auto simp add: l3_defs l2_lkr_others_def)\ndone\n\nlemma l3_lkr_after_refines_lkr_after:\n \"{R23s} l2_lkr_after A, l3_lkr_after A {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs)\napply (auto simp add: l3_defs l2_lkr_after_def)\ndone\n\nlemma l3_skr_refines_skr:\n \"{R23s} l2_skr R K, l3_skr R K {>R23s}\"\napply (auto simp add: PO_rhoare_defs R23s_defs)\napply (auto simp add: l3_defs l2_skr_def)\ndone\n\n\n\nlemmas l3_trans_refines_l2_trans = \n l3_step1_refines_step1 l3_step2_refines_step2 l3_step3_refines_step3\n l3_dy_refines_dy_fake_msg_dy_fake_chan_skip\n l3_lkr_others_refines_lkr_others l3_lkr_after_refines_lkr_after l3_skr_refines_skr\n\n\n\nlemma l3_refines_init_l2 [iff]:\n \"init l3 \\ R23s `` (init l2)\"\nby (auto simp add: R23s_defs l2_defs l3_def l3_init_def)\n\nlemma l3_refines_trans_l2 [iff]:\n \"{R23s \\ (UNIV \\ (l3_inv1 \\ l3_inv2 \\ l3_inv3 \\ l3_inv4))} trans l2, trans l3 {> R23s}\"\nproof -\n let ?pre' = \"R23s \\ (UNIV \\ (l3_inv5 \\ l3_inv6 \\ l3_inv7 \\ l3_inv8 \\ l3_inv9))\"\n show ?thesis (is \"{?pre} ?t1, ?t2 {>?post}\")\n proof (rule relhoare_conseq_left)\n show \"?pre \\ ?pre'\"\n using l3_inv5_derived l3_inv6_derived l3_inv7_derived l3_inv8_derived l3_inv9_derived by blast\n next \n show \"{?pre'} ?t1, ?t2 {> ?post}\" \n by (auto simp add: l2_def l3_def l2_trans_def l3_trans_def\n intro!: l3_trans_refines_l2_trans)\n qed\nqed \n\nlemma PO_obs_consistent_R23s [iff]: \n \"obs_consistent R23s med23s l2 l3\"\nby (auto simp add: obs_consistent_def R23s_def med23s_def l2_defs)\n\n\nlemma l3_refines_l2 [iff]:\n \"refines \n (R23s \\ \n (reach l2 \\ (l3_inv1 \\ l3_inv2 \\ l3_inv3 \\ l3_inv4)))\n med23s l2 l3\"\nby (rule Refinement_using_invariants, auto)\n\nlemma l3_implements_l2 [iff]:\n \"implements med23s l2 l3\"\nby (rule refinement_soundness) (auto)\n\n\n(**************************************************************************************************)\nsubsection \\Derived invariants\\\n(**************************************************************************************************)\n\nsubsubsection \\inv10: secrets contain no implementation material\\\n(**************************************************************************************************)\n\ndefinition\n l3_inv10 :: \"l3_state set\"\nwhere\n \"l3_inv10 \\ {s.\n secret s \\ payload\n }\"\n\nlemmas l3_inv10I = l3_inv10_def [THEN setc_def_to_intro, rule_format]\nlemmas l3_inv10E = l3_inv10_def [THEN setc_def_to_elim, rule_format]\nlemmas l3_inv10D = l3_inv10_def [THEN setc_def_to_dest, rule_format]\n\nlemma l3_inv10_init [iff]: \n \"init l3 \\ l3_inv10\"\nby (auto simp add: l3_def l3_init_def ik_init_def intro!:l3_inv10I)\n\nlemma l3_inv10_trans [iff]:\n \"{l3_inv10} trans l3 {> l3_inv10}\"\napply (auto simp add: PO_hoare_defs l3_nostep_defs)\napply (auto simp add: l3_defs l3_inv10_def)\ndone\n\nlemma PO_l3_inv10 [iff]: \"reach l3 \\ l3_inv10\"\nby (rule inv_rule_basic) (auto)\n\nlemma l3_obs_inv10 [iff]: \"oreach l3 \\ l3_inv10\"\nby (auto simp add: oreach_def)\n\n\n\nsubsubsection \\Partial secrecy\\\n(**************************************************************************************************)\n\ntext \\We want to prove @{term \"l3_secrecy\"}, ie\n @{term \"synth (analz (ik s)) \\ secret s = {}\"},\n but by refinement we only get @{term \"l3_partial_secrecy\"}: \n @{term \"dy_fake_msg (bad s) (payloadSet (ik s)) (abs (ik s)) \\ secret s = {}\"}.\n This is fine if secrets contain no implementation material.\n Then, by @{term \"inv5\"}, a message in @{term \"synth (analz (ik s))\"} is in\n @{term \"dy_fake_msg (bad s) (payloadSet (ik s)) (abs (ik s)) \\ -payload\"},\n and @{term \"l3_partial_secrecy\"} proves it is not a secret.\n\\\n\ndefinition\n l3_partial_secrecy :: \"('a l3_state_scheme) set\"\nwhere\n \"l3_partial_secrecy \\ {s. \n dy_fake_msg (bad s) (ik s \\ payload) (abs (ik s)) \\ secret s = {}\n }\"\n\n\nlemma l3_obs_partial_secrecy [iff]: \"oreach l3 \\ l3_partial_secrecy\"\napply (rule external_invariant_translation [OF l2_obs_secrecy _ l3_implements_l2])\napply (auto simp add: med23s_def l2_secrecy_def l3_partial_secrecy_def)\ndone\n\n\nsubsubsection \\Secrecy\\\n(**************************************************************************************************)\n\ndefinition \n l3_secrecy :: \"('a l3_state_scheme) set\"\nwhere\n \"l3_secrecy \\ l1_secrecy\"\n\n\n\nlemma l3_obs_secrecy [iff]: \"oreach l3 \\ l3_secrecy\"\napply (rule, frule l3_obs_inv5 [THEN [2] rev_subsetD], frule l3_obs_inv10 [THEN [2] rev_subsetD])\napply (auto simp add: med23s_def l2_secrecy_def l3_secrecy_def s0_secrecy_def l3_inv10_def)\nusing l3_partial_secrecy_def apply (blast dest!: l3_inv5D subsetD [OF l3_obs_partial_secrecy])\ndone\n\nlemma l3_secrecy [iff]: \"reach l3 \\ l3_secrecy\"\nby (rule external_to_internal_invariant [OF l3_obs_secrecy], auto)\n\n\nsubsubsection \\Injective agreement\\\n(**************************************************************************************************)\n\nabbreviation \"l3_iagreement \\ l1_iagreement\"\n\nlemma l3_obs_iagreement [iff]: \"oreach l3 \\ l3_iagreement\"\napply (rule external_invariant_translation [OF l2_obs_iagreement _ l3_implements_l2])\napply (auto simp add: med23s_def l1_iagreement_def)\ndone\n\nlemma l3_iagreement [iff]: \"reach l3 \\ l3_iagreement\"\nby (rule external_to_internal_invariant [OF l3_obs_iagreement], auto)\n\n\nend\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/pfslvl3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.1990081078371907}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__38_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__38_on_rules imports n_germanSimp_lemma_on_inv__38\nbegin\nsection{*All lemmas on causal relation between inv__38*}\nlemma lemma_inv__38_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__38) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__38_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.19886229715274964}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__21.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__21 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__21 and some rule r*}\nlemma n_SendInv__part__0Vsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__21 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__21:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__21.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.19886229715274964}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__8_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__8_on_rules imports n_german_lemma_on_inv__8\nbegin\nsection{*All lemmas on causal relation between inv__8*}\nlemma lemma_inv__8_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__8) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__8_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.3486451285660856, "lm_q1q2_score": 0.1986763509160136}} {"text": "(*<*)\ntheory Monitor_Code\n imports Monitor\n \"HOL-Library.Code_Target_Nat\"\n \"HOL.String\"\n Containers.Containers\nbegin\n (*>*)\n\nderive ccompare MFOTL.trm\nderive (eq) ceq MFOTL.trm\nderive (rbt) set_impl MFOTL.trm\n\nlemma image_these: \"f ` Option.these X = Option.these (map_option f ` X)\"\n by (force simp: in_these_eq Bex_def image_iff map_option_case split: option.splits)\n\nlemma meval_MPred: \"meval n t db (MPred e ts) = ([Option.these\n ((map_option (\\f. tabulate f 0 n) o match ts) ` (\\(e', x)\\db. if e = e' then {x} else {}))], MPred e ts)\"\n unfolding meval.simps image_these image_image o_def ..\n\nlemma meval_MPred': \"meval n t db (MPred e ts) = ([Option.these\n (\\(e', x)\\db. if e = e' then {map_option (\\f. tabulate f 0 n) (match ts x)} else {})], MPred e ts)\"\n unfolding meval_MPred image_UN split_beta if_distrib[of \"image _\"] image_insert image_empty o_apply\n ..\n\nlemma these_UNION: \"Option.these (\\ (B ` A)) = (\\ ((Option.these o B) ` A))\"\n by (auto simp: Option.these_def)\n\nlemma meval_MPred'': \"meval n t db (MPred e ts) = ([\n (\\(e', x)\\db. if e = e' then set_option (map_option (\\f. tabulate f 0 n) (match ts x)) else {})], MPred e ts)\"\n unfolding meval_MPred' these_UNION o_def prod.case_distrib[of Option.these]\n by (auto simp: Option.these_def map_option_case image_iff split: if_splits option.splits)\n\nlemmas meval_code[code] = meval.simps(1) meval_MPred'' meval.simps(3-9)\n\ndefinition db_code :: \"(char list \\ 'a list) list \\ (char list \\ 'a list) set\" where\n \"db_code = set\"\n\ndefinition verdict_code :: \"_ \\ (nat \\ 'a :: ccompare option list) list\" where\n \"verdict_code = RBT_Set2.keys\"\n\nexport_code HOL.equal Collection_Eq.ceq Collection_Order.ccompare Eq Lt Gt set_RBT set_impl phantom\n nat_of_integer integer_of_nat enat literal.explode db_code set interval RBT_set verdict_code\n MFOTL.Var MFOTL.Const\n MFOTL.Pred MFOTL.Eq MFOTL.Neg MFOTL.Or MFOTL.Exists\n MFOTL.Prev MFOTL.Next MFOTL.Since MFOTL.Until\n checking OCaml?\n\nexport_code HOL.equal Collection_Eq.ceq Collection_Order.ccompare Eq Lt Gt set_RBT set_impl phantom\n nat_of_integer integer_of_nat enat literal.explode db_code set interval RBT_set verdict_code\n MFOTL.Var MFOTL.Const\n MFOTL.Pred MFOTL.Eq MFOTL.Neg MFOTL.Or MFOTL.Exists\n MFOTL.Prev MFOTL.Next MFOTL.Since MFOTL.Until\n minit_safe mstep in OCaml module_name Monitor file_prefix \"verified\"\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/MFOTL_Monitor/Monitor_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.35577490717496246, "lm_q1q2_score": 0.19863872935362745}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ArchArraysMemInstance\nimports \"../ArraysMemInstance\"\nbegin\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass array_outer_max_size = mem_type +\n assumes array_outer_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 26\"\n\nclass array_max_count = finite +\n assumes array_max_count_ax: \"CARD ('a) <= 2 ^ 20\"\n\ninstance array :: (array_outer_max_size, array_max_count) mem_type\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ (addr_bitsize - 26) * 2 ^ 26\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 26\"])\n apply (rule mult_less_mono2)\n apply (rule array_outer_max_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule le_trans[where j = \"2 ^ 20\"])\n apply (rule array_max_count_ax)\n apply simp\n apply simp\napply (simp add: addr_card)\ndone\n\nclass array_inner_max_size = array_outer_max_size +\n assumes array_inner_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstance array :: (array_inner_max_size, array_max_count) array_outer_max_size\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule array_max_count_ax)\n apply (rule array_inner_max_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\ninstance word :: (len8) array_outer_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance word :: (len8) array_inner_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance ptr :: (c_type) array_outer_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\ninstance ptr :: (c_type) array_inner_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\nclass lt19 = finite +\n assumes lt19_ax: \"CARD ('a) < 2 ^ 19\"\nclass lt18 = lt19 +\n assumes lt18_ax: \"CARD ('a) < 2 ^ 18\"\nclass lt17 = lt18 +\n assumes lt17_ax: \"CARD ('a) < 2 ^ 17\"\nclass lt16 = lt17 +\n assumes lt16_ax: \"CARD ('a) < 2 ^ 16\"\nclass lt15 = lt16 +\n assumes lt15_ax: \"CARD ('a) < 2 ^ 15\"\nclass lt14 = lt15 +\n assumes lt14_ax: \"CARD ('a) < 2 ^ 14\"\nclass lt13 = lt14 +\n assumes lt13_ax: \"CARD ('a) < 2 ^ 13\"\nclass lt12 = lt13 +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 +\n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstance bit0 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance num1 :: lt1\n by (intro_classes, simp_all)\n\n(* don't understand why this also seems to be necessary *)\ninstance num1 :: array_max_count\n by (intro_classes, simp)\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n array_max_count *)\ndatatype array_max_count_ty = array_max_count_ty \"1048576\"\n\n(* ML c-parser code also needs to know at which array size to use this type *)\nML \\\n structure ArchArrayMaxCount = struct\n val array_max_count = 1048576\n end\n\\\n\nlemma univ_array_max_count_ty:\n \"(UNIV::array_max_count_ty set) = image array_max_count_ty (UNIV::1048576 set)\"\n apply (simp add: set_eq_iff image_iff)\n apply (rule_tac allI)\n apply (rule_tac array_max_count_ty.induct)\n apply simp\n done\n\ninstance \"array_max_count_ty\" :: finite\n apply intro_classes\n apply (simp add: univ_array_max_count_ty)\n done\n\nlemma card_array_max_count_ty[simp]: \"CARD(array_max_count_ty) = CARD(1048576)\"\n apply (simp add: univ_array_max_count_ty card_image inj_on_def)\n done\n\ninstance \"array_max_count_ty\" :: array_max_count\n by intro_classes simp\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/c-parser/umm_heap/X64/ArchArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.35577487985229844, "lm_q1q2_score": 0.19863871932796276}} {"text": "section \\Frame Inference\\\ntheory Sepref_Frame\nimports Sepref_Basic Sepref_Constraints\nbegin\n text \\ In this theory, we provide a specific frame inference tactic\n for Sepref.\n\n The first tactic, \\frame_tac\\, is a standard frame inference tactic, \n based on the assumption that only @{const hn_ctxt}-assertions need to be\n matched.\n\n The second tactic, \\merge_tac\\, resolves entailments of the form\n \\F1 \\\\<^sub>A F2 \\\\<^sub>t ?F\\\n that occur during translation of if and case statements.\n It synthesizes a new frame ?F, where refinements of variables \n with equal refinements in \\F1\\ and \\F2\\ are preserved,\n and the others are set to @{const hn_invalid}.\n \\\n\ndefinition mismatch_assn :: \"('a \\ 'c \\ assn) \\ ('a \\ 'c \\ assn) \\ 'a \\ 'c \\ assn\"\n where \"mismatch_assn R1 R2 x y \\ R1 x y \\\\<^sub>A R2 x y\"\n\nabbreviation \"hn_mismatch R1 R2 \\ hn_ctxt (mismatch_assn R1 R2)\"\n\nlemma recover_pure_aux: \"CONSTRAINT is_pure R \\ hn_invalid R x y \\\\<^sub>t hn_ctxt R x y\"\n by (auto simp: is_pure_conv invalid_pure_recover hn_ctxt_def)\n\n\n\nlemma frame_thms:\n \"P \\\\<^sub>t P\"\n \"P\\\\<^sub>tP' \\ F\\\\<^sub>tF' \\ F*P \\\\<^sub>t F'*P'\"\n \"hn_ctxt R x y \\\\<^sub>t hn_invalid R x y\"\n \"hn_ctxt R x y \\\\<^sub>t hn_ctxt (\\_ _. true) x y\"\n \"CONSTRAINT is_pure R \\ hn_invalid R x y \\\\<^sub>t hn_ctxt R x y\"\n apply -\n applyS simp\n applyS (rule entt_star_mono; assumption)\n subgoal\n apply (simp add: hn_ctxt_def)\n apply (rule enttI)\n apply (rule ent_trans[OF invalidate[of R]]) \n by (simp add: entt_refl') \n subgoal\n by (auto simp: hn_ctxt_def entailst_def) \n apply (erule recover_pure_aux)\n done\n\nnamed_theorems_rev sepref_frame_match_rules \\Sepref: Additional frame rules\\\n\ntext \\Rules to discharge unmatched stuff\\\n(*lemma frame_rem_thms:\n \"P \\\\<^sub>t P\"\n \"P \\\\<^sub>t emp\"\n by sep_auto+\n*)\nlemma frame_rem1: \"P\\\\<^sub>tP\" by simp\n\nlemma frame_rem2: \"F \\\\<^sub>t F' \\ F * hn_ctxt A x y \\\\<^sub>t F' * hn_ctxt A x y\"\n apply (rule entt_star_mono) by auto\n\nlemma frame_rem3: \"F \\\\<^sub>t F' \\ F * hn_ctxt A x y \\\\<^sub>t F'\"\n using frame_thms(2) by fastforce\n \nlemma frame_rem4: \"P \\\\<^sub>t emp\" by simp\n\nlemmas frame_rem_thms = frame_rem1 frame_rem2 frame_rem3 frame_rem4\n\nnamed_theorems_rev sepref_frame_rem_rules\n \\Sepref: Additional rules to resolve remainder of frame-pairing\\\n\nlemma ent_disj_star_mono:\n \"\\ A \\\\<^sub>A C \\\\<^sub>A E; B \\\\<^sub>A D \\\\<^sub>A F \\ \\ A*B \\\\<^sub>A C*D \\\\<^sub>A E*F\"\n by (metis ent_disjI1 ent_disjI2 ent_disjE ent_star_mono) \n\nlemma entt_disj_star_mono:\n \"\\ A \\\\<^sub>A C \\\\<^sub>t E; B \\\\<^sub>A D \\\\<^sub>t F \\ \\ A*B \\\\<^sub>A C*D \\\\<^sub>t E*F\"\nproof -\n assume a1: \"A \\\\<^sub>A C \\\\<^sub>t E\"\n assume \"B \\\\<^sub>A D \\\\<^sub>t F\"\n then have \"A * B \\\\<^sub>A C * D \\\\<^sub>A true * E * (true * F)\"\n using a1 by (simp add: assn_times_comm ent_disj_star_mono enttD) \n then show ?thesis\n by (metis (no_types) assn_times_comm enttI merge_true_star_ctx star_aci(3))\nqed\n \n\n\nlemma hn_merge1:\n (*\"emp \\\\<^sub>A emp \\\\<^sub>A emp\"*)\n \"F \\\\<^sub>A F \\\\<^sub>t F\"\n \"\\ hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt R x x'; Fl \\\\<^sub>A Fr \\\\<^sub>t F \\ \n \\ Fl * hn_ctxt R1 x x' \\\\<^sub>A Fr * hn_ctxt R2 x x' \\\\<^sub>t F * hn_ctxt R x x'\"\n subgoal by (simp add: ent_disjE enttI entt_refl') \n by (rule entt_disj_star_mono; simp)\n\nlemma hn_merge2:\n \"hn_invalid R x x' \\\\<^sub>A hn_ctxt R x x' \\\\<^sub>t hn_invalid R x x'\"\n \"hn_ctxt R x x' \\\\<^sub>A hn_invalid R x x' \\\\<^sub>t hn_invalid R x x'\"\n by (auto intro!: invalidate ent_disjE ent_imp_entt simp: hn_ctxt_def)+\n\nlemma invalid_assn_mono: \"hn_ctxt A x y \\\\<^sub>t hn_ctxt B x y \n \\ hn_invalid A x y \\\\<^sub>t hn_invalid B x y\"\n apply (clarsimp simp: invalid_assn_def entailst_def entails_def hn_ctxt_def)\n by (metis ent_iffI entails_def entails_pure entt_refl' move_back_pure)\n\n\nlemma entt_disjE: \"\\ A\\\\<^sub>tM; B\\\\<^sub>tM \\ \\ A\\\\<^sub>AB \\\\<^sub>t M\"\n using ent_disjE enttD enttI by blast \nlemma hn_merge3: (* Not used *)\n \"\\NO_MATCH (hn_invalid XX) R2; hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt Rm x x'\\ \\ hn_invalid R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_invalid Rm x x'\"\n \"\\NO_MATCH (hn_invalid XX) R1; hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt Rm x x'\\ \\ hn_ctxt R1 x x' \\\\<^sub>A hn_invalid R2 x x' \\\\<^sub>t hn_invalid Rm x x'\"\n apply (meson entt_disjD1 entt_disjD2 entt_disjE entt_trans frame_thms(3) invalid_assn_mono) \n apply (meson entt_disjD1 entt_disjD2 entt_disjE entt_trans frame_thms(3) invalid_assn_mono) \n done\n\nlemmas merge_thms = hn_merge1 hn_merge2 \n\nnamed_theorems sepref_frame_merge_rules \\Sepref: Additional merge rules\\\n\n\nlemma hn_merge_mismatch: \"hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_mismatch R1 R2 x x'\"\n by (auto simp: hn_ctxt_def mismatch_assn_def)\n\nlemma is_merge: \"P1\\\\<^sub>AP2\\\\<^sub>tP \\ P1\\\\<^sub>AP2\\\\<^sub>tP\" .\n\nlemma merge_mono: \"\\A\\\\<^sub>tA'; B\\\\<^sub>tB'; A'\\\\<^sub>AB' \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson entt_disjE entt_disjI1_direct entt_disjI2_direct entt_trans)\n \ntext \\Apply forward rule on left or right side of merge\\\nlemma gen_merge_cons1: \"\\A\\\\<^sub>tA'; A'\\\\<^sub>AB \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson merge_mono entt_refl)\n\nlemma gen_merge_cons2: \"\\B\\\\<^sub>tB'; A\\\\<^sub>AB' \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson merge_mono entt_refl)\n \nlemmas gen_merge_cons = gen_merge_cons1 gen_merge_cons2\n\n\ntext \\These rules are applied to recover pure values that have been destroyed by rule application\\\n\ndefinition \"RECOVER_PURE P Q \\ P \\\\<^sub>t Q\"\n\nlemma recover_pure:\n \"RECOVER_PURE emp emp\"\n \"\\RECOVER_PURE P2 Q2; RECOVER_PURE P1 Q1\\ \\ RECOVER_PURE (P1*P2) (Q1*Q2)\"\n \"CONSTRAINT is_pure R \\ RECOVER_PURE (hn_invalid R x y) (hn_ctxt R x y)\"\n \"RECOVER_PURE (hn_ctxt R x y) (hn_ctxt R x y)\"\n unfolding RECOVER_PURE_def\n subgoal by auto\n subgoal by (drule (1) entt_star_mono)\n subgoal by (rule recover_pure_aux)\n subgoal by auto\n done\n \nlemma recover_pure_triv: \n \"RECOVER_PURE P P\"\n unfolding RECOVER_PURE_def by auto\n\n\ntext \\Weakening the postcondition by converting @{const invalid_assn} to @{term \"\\_ _. true\"}\\\ndefinition \"WEAKEN_HNR_POST \\ \\' \\'' \\ (\\h. h\\\\) \\ (\\'' \\\\<^sub>t \\')\"\n\nlemma weaken_hnr_postI:\n assumes \"WEAKEN_HNR_POST \\ \\'' \\'\"\n assumes \"hn_refine \\ c \\' R a\"\n shows \"hn_refine \\ c \\'' R a\"\n apply (rule hn_refine_preI)\n apply (rule hn_refine_cons_post)\n apply (rule assms)\n using assms(1) unfolding WEAKEN_HNR_POST_def by blast\n\nlemma weaken_hnr_post_triv: \"WEAKEN_HNR_POST \\ P P\"\n unfolding WEAKEN_HNR_POST_def\n by auto\n\nlemma weaken_hnr_post:\n \"\\WEAKEN_HNR_POST \\ P P'; WEAKEN_HNR_POST \\' Q Q'\\ \\ WEAKEN_HNR_POST (\\*\\') (P*Q) (P'*Q')\"\n \"WEAKEN_HNR_POST (hn_ctxt R x y) (hn_ctxt R x y) (hn_ctxt R x y)\"\n \"WEAKEN_HNR_POST (hn_ctxt R x y) (hn_invalid R x y) (hn_ctxt (\\_ _. true) x y)\"\nproof (goal_cases)\n case 1 thus ?case\n unfolding WEAKEN_HNR_POST_def\n apply clarsimp\n apply (rule entt_star_mono) \n subgoal using entailsD' entails_def mod_false' by blast \n subgoal by (metis assn_times_comm entailsD' entails_def mod_false') \n done\nnext\n case 2 thus ?case by (rule weaken_hnr_post_triv)\nnext\n case 3 thus ?case \n unfolding WEAKEN_HNR_POST_def \n by (auto simp: invalid_assn_def hn_ctxt_def)\nqed\n\n\nlemma reorder_enttI:\n assumes \"A*true = C*true\"\n assumes \"B*true = D*true\"\n shows \"(A\\\\<^sub>tB) \\ (C\\\\<^sub>tD)\"\n apply (intro eq_reflection)\n unfolding entt_def_true\n by (simp add: assms)\n \n \n\nlemma merge_sat1: \"(A\\\\<^sub>AA' \\\\<^sub>t Am) \\ (A\\\\<^sub>AAm \\\\<^sub>t Am)\"\n using entt_disjD1 entt_disjE by blast\nlemma merge_sat2: \"(A\\\\<^sub>AA' \\\\<^sub>t Am) \\ (Am\\\\<^sub>AA' \\\\<^sub>t Am)\"\n using entt_disjD2 entt_disjE by blast\n\n\n\n\n\nML \\\nsignature SEPREF_FRAME = sig\n\n\n (* Check if subgoal is a frame obligation *)\n (*val is_frame : term -> bool *)\n (* Check if subgoal is a merge obligation *)\n val is_merge: term -> bool\n (* Perform frame inference *)\n val frame_tac: (Proof.context -> tactic') -> Proof.context -> tactic'\n (* Perform merging *)\n val merge_tac: (Proof.context -> tactic') -> Proof.context -> tactic'\n\n val frame_step_tac: (Proof.context -> tactic') -> bool -> Proof.context -> tactic'\n\n (* Reorder frame *)\n val prepare_frame_tac : Proof.context -> tactic'\n (* Solve a RECOVER_PURE goal, inserting constraints as necessary *)\n val recover_pure_tac: Proof.context -> tactic'\n\n (* Split precondition of hnr-goal into frame and arguments *)\n val align_goal_tac: Proof.context -> tactic'\n (* Normalize goal's precondition *)\n val norm_goal_pre_tac: Proof.context -> tactic'\n (* Rearrange precondition of hnr-term according to parameter order, normalize all relations *)\n val align_rl_conv: Proof.context -> conv\n\n (* Convert hn_invalid to \\_ _. true in postcondition of hnr-goal. Makes proving the goal easier.*)\n val weaken_post_tac: Proof.context -> tactic'\n\n val add_normrel_eq : thm -> Context.generic -> Context.generic\n val del_normrel_eq : thm -> Context.generic -> Context.generic\n val get_normrel_eqs : Proof.context -> thm list\n\n val cfg_debug: bool Config.T\n\n val setup: theory -> theory\nend\n\n\nstructure Sepref_Frame : SEPREF_FRAME = struct\n\n val cfg_debug = \n Attrib.setup_config_bool @{binding sepref_debug_frame} (K false)\n\n val DCONVERSION = Sepref_Debugging.DBG_CONVERSION cfg_debug\n val dbg_msg_tac = Sepref_Debugging.dbg_msg_tac cfg_debug\n\n\n structure normrel_eqs = Named_Thms (\n val name = @{binding sepref_frame_normrel_eqs}\n val description = \"Equations to normalize relations for frame matching\"\n )\n\n val add_normrel_eq = normrel_eqs.add_thm\n val del_normrel_eq = normrel_eqs.del_thm\n val get_normrel_eqs = normrel_eqs.get\n\n val mk_entailst = HOLogic.mk_binrel @{const_name \"entailst\"}\n\n\n local\n open Sepref_Basic Refine_Util Conv\n \n fun assn_ord p = case apply2 dest_hn_ctxt_opt p of\n (NONE,NONE) => EQUAL\n | (SOME _, NONE) => LESS\n | (NONE, SOME _) => GREATER\n | (SOME (_,a,_), SOME (_,a',_)) => Term_Ord.fast_term_ord (a,a')\n\n in\n fun reorder_ctxt_conv ctxt ct = let\n val cert = Thm.cterm_of ctxt\n\n val new_ct = Thm.term_of ct \n |> strip_star\n |> sort assn_ord\n |> list_star\n |> cert\n\n val thm = Goal.prove_internal ctxt [] (mk_cequals (ct,new_ct)) \n (fn _ => simp_tac \n (put_simpset HOL_basic_ss ctxt addsimps @{thms star_aci}) 1)\n\n in\n thm\n end\n \n fun prepare_fi_conv ctxt ct = case Thm.term_of ct of\n @{mpat \"?P \\\\<^sub>t ?Q\"} => let\n val cert = Thm.cterm_of ctxt\n \n (* Build table from abs-vars to ctxt *)\n val (Qm, Qum) = strip_star Q |> filter_out is_true |> List.partition is_hn_ctxt\n\n val Qtab = (\n Qm |> map (fn x => (#2 (dest_hn_ctxt x),(NONE,x))) \n |> Termtab.make\n ) handle\n e as (Termtab.DUP _) => (\n tracing (\"Dup heap: \" ^ @{make_string} ct); raise e)\n \n (* Go over entries in P and try to find a partner *)\n val (Qtab,Pum) = fold (fn a => fn (Qtab,Pum) => \n case dest_hn_ctxt_opt a of\n NONE => (Qtab,a::Pum)\n | SOME (_,p,_) => ( case Termtab.lookup Qtab p of\n SOME (NONE,tg) => (Termtab.update (p,(SOME a,tg)) Qtab, Pum)\n | _ => (Qtab,a::Pum)\n )\n ) (strip_star P) (Qtab,[])\n\n val Pum = filter_out is_true Pum\n\n (* Read out information from Qtab *)\n val (pairs,Qum2) = Termtab.dest Qtab |> map #2 \n |> List.partition (is_some o #1)\n |> apfst (map (apfst the))\n |> apsnd (map #2)\n \n (* Build reordered terms: P' = fst pairs * Pum, Q' = snd pairs * (Qum2*Qum) *)\n val P' = mk_star (list_star (map fst pairs), list_star Pum)\n val Q' = mk_star (list_star (map snd pairs), list_star (Qum2@Qum))\n \n val new_ct = mk_entailst (P', Q') |> cert\n \n val msg_tac = dbg_msg_tac (Sepref_Debugging.msg_allgoals \"Solving frame permutation\") ctxt 1\n val tac = msg_tac THEN ALLGOALS (resolve_tac ctxt @{thms reorder_enttI}) THEN star_permute_tac ctxt\n\n val thm = Goal.prove_internal ctxt [] (mk_cequals (ct,new_ct)) (fn _ => tac)\n \n in \n thm\n end\n | _ => no_conv ct\n \n end\n\n fun is_merge @{mpat \"Trueprop (_ \\\\<^sub>A _ \\\\<^sub>t _)\"} = true | is_merge _ = false\n fun is_gen_frame @{mpat \"Trueprop (_ \\\\<^sub>t _)\"} = true | is_gen_frame _ = false\n\n\n fun prepare_frame_tac ctxt = let\n open Refine_Util Conv\n val frame_ss = put_simpset HOL_basic_ss ctxt addsimps \n @{thms mult_1_right[where 'a=assn] mult_1_left[where 'a=assn]}\n in\n CONVERSION Thm.eta_conversion THEN'\n (*CONCL_COND' is_frame THEN'*)\n simp_tac frame_ss THEN'\n CONVERSION (HOL_concl_conv (fn _ => prepare_fi_conv ctxt) ctxt)\n end \n\n\n local\n fun wrap_side_tac side_tac dbg tac = tac THEN_ALL_NEW_FWD (\n CONCL_COND' is_gen_frame \n ORELSE' (if dbg then TRY_SOLVED' else SOLVED') side_tac\n )\n in \n fun frame_step_tac side_tac dbg ctxt = let\n open Refine_Util Conv\n\n (* Constraint solving is built-in *)\n val side_tac = Sepref_Constraints.constraint_tac ctxt ORELSE' side_tac ctxt\n\n val frame_thms = @{thms frame_thms} @\n Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_frame_match_rules} \n val merge_thms = @{thms merge_thms} @\n Named_Theorems.get ctxt @{named_theorems sepref_frame_merge_rules}\n val ss = put_simpset HOL_basic_ss ctxt addsimps normrel_eqs.get ctxt\n fun frame_thm_tac dbg = wrap_side_tac side_tac dbg (resolve_tac ctxt frame_thms)\n fun merge_thm_tac dbg = wrap_side_tac side_tac dbg (resolve_tac ctxt merge_thms)\n \n fun thm_tac dbg = CONCL_COND' is_merge THEN_ELSE' (merge_thm_tac dbg, frame_thm_tac dbg)\n in\n full_simp_tac ss THEN' thm_tac dbg\n end\n end \n\n fun frame_loop_tac side_tac ctxt = let\n\n in\n TRY o (\n REPEAT_ALL_NEW (DETERM o frame_step_tac side_tac false ctxt)\n )\n end\n\n\n fun frame_tac side_tac ctxt = let\n open Refine_Util Conv\n val frame_rem_thms = @{thms frame_rem_thms}\n @ Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_frame_rem_rules}\n val solve_remainder_tac = TRY o REPEAT_ALL_NEW (DETERM o resolve_tac ctxt frame_rem_thms)\n in\n (prepare_frame_tac ctxt\n THEN' resolve_tac ctxt @{thms ent_star_mono entt_star_mono})\n THEN_ALL_NEW_LIST [\n frame_loop_tac side_tac ctxt,\n solve_remainder_tac\n ] \n end\n\n fun merge_tac side_tac ctxt = let\n open Refine_Util Conv\n val merge_conv = arg1_conv (binop_conv (reorder_ctxt_conv ctxt))\n in\n CONVERSION Thm.eta_conversion THEN'\n CONCL_COND' is_merge THEN'\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms star_aci}) THEN'\n CONVERSION (HOL_concl_conv (fn _ => merge_conv) ctxt) THEN'\n frame_loop_tac side_tac ctxt\n end\n\n val setup = normrel_eqs.setup\n\n local\n open Sepref_Basic\n fun is_invalid @{mpat \"hn_invalid _ _ _ :: assn\"} = true | is_invalid _ = false\n fun contains_invalid @{mpat \"Trueprop (RECOVER_PURE ?Q _)\"} = exists is_invalid (strip_star Q)\n | contains_invalid _ = false\n\n in\n fun recover_pure_tac ctxt = \n CONCL_COND' contains_invalid THEN_ELSE' (\n REPEAT_ALL_NEW (DETERM o (resolve_tac ctxt @{thms recover_pure} ORELSE' Sepref_Constraints.constraint_tac ctxt)),\n resolve_tac ctxt @{thms recover_pure_triv}\n )\n end\n\n local\n open Sepref_Basic Refine_Util\n datatype cte = Other of term | Hn of term * term * term\n fun dest_ctxt_elem @{mpat \"hn_ctxt ?R ?a ?c\"} = Hn (R,a,c)\n | dest_ctxt_elem t = Other t\n\n fun mk_ctxt_elem (Other t) = t \n | mk_ctxt_elem (Hn (R,a,c)) = @{mk_term \"hn_ctxt ?R ?a ?c\"}\n\n fun match x (Hn (_,y,_)) = x aconv y\n | match _ _ = false\n\n fun dest_with_frame (*ctxt*) _ t = let\n val (P,c,Q,R,a) = dest_hn_refine t\n \n val (_,(_,args)) = dest_hnr_absfun a\n val pre_ctes = strip_star P |> map dest_ctxt_elem\n \n val (pre_args,frame) = \n (case split_matching match args pre_ctes of\n NONE => raise TERM(\"align_conv: Could not match all arguments\",[P,a])\n | SOME x => x)\n\n in\n ((frame,pre_args),c,Q,R,a)\n end\n \n fun align_goal_conv_aux ctxt t = let\n val ((frame,pre_args),c,Q,R,a) = dest_with_frame ctxt t\n val P' = apply2 (list_star o map mk_ctxt_elem) (frame,pre_args) |> mk_star\n val t' = mk_hn_refine (P',c,Q,R,a)\n in t' end \n\n fun align_rl_conv_aux ctxt t = let\n val ((frame,pre_args),c,Q,R,a) = dest_with_frame ctxt t\n\n val _ = frame = [] orelse raise TERM (\"align_rl_conv: Extra preconditions in rule\",[t,list_star (map mk_ctxt_elem frame)])\n\n val P' = list_star (map mk_ctxt_elem pre_args)\n val t' = mk_hn_refine (P',c,Q,R,a)\n in t' end \n\n\n fun normrel_conv ctxt = let\n val ss = put_simpset HOL_basic_ss ctxt addsimps normrel_eqs.get ctxt\n in\n Simplifier.rewrite ss\n end\n\n in\n fun align_goal_conv ctxt = f_tac_conv ctxt (align_goal_conv_aux ctxt) (star_permute_tac ctxt)\n\n fun norm_goal_pre_conv ctxt = let\n open Conv\n val nr_conv = normrel_conv ctxt\n in\n HOL_concl_conv (fn _ => hn_refine_conv nr_conv all_conv all_conv all_conv all_conv) ctxt\n end \n\n fun norm_goal_pre_tac ctxt = CONVERSION (norm_goal_pre_conv ctxt)\n\n fun align_rl_conv ctxt = let\n open Conv\n val nr_conv = normrel_conv ctxt\n in\n HOL_concl_conv (fn ctxt => f_tac_conv ctxt (align_rl_conv_aux ctxt) (star_permute_tac ctxt)) ctxt\n then_conv HOL_concl_conv (K (hn_refine_conv nr_conv all_conv nr_conv nr_conv all_conv)) ctxt\n end\n\n fun align_goal_tac ctxt = \n CONCL_COND' is_hn_refine_concl \n THEN' DCONVERSION ctxt (HOL_concl_conv align_goal_conv ctxt)\n end\n\n\n fun weaken_post_tac ctxt = TRADE (fn ctxt =>\n resolve_tac ctxt @{thms weaken_hnr_postI} \n THEN' SOLVED' (REPEAT_ALL_NEW (DETERM o resolve_tac ctxt @{thms weaken_hnr_post weaken_hnr_post_triv}))\n ) ctxt\n\nend\n\\\n\nsetup Sepref_Frame.setup\n\nmethod_setup weaken_hnr_post = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (Sepref_Frame.weaken_post_tac ctxt))\\\n \\Convert \"hn_invalid\" to \"hn_ctxt (\\_ _. true)\" in postcondition of hn_refine goal\\\n\n\n(* TODO: Improper, modifies all h\\_ premises that happen to be there. Use tagging to protect! *)\nmethod extract_hnr_invalids = (\n rule hn_refine_preI,\n ((drule mod_starD hn_invalidI | elim conjE exE)+)?\n) \\ \\Extract \\hn_invalid _ _ _ = true\\ preconditions from \\hn_refine\\ goal.\\\n \n\n\nlemmas [sepref_frame_normrel_eqs] = the_pure_pure pure_the_pure\n\nend\n\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Refine_Imperative_HOL/Sepref_Frame.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.3738758227716966, "lm_q1q2_score": 0.1986063470836285}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__38_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__38_on_rules imports n_german_lemma_on_inv__38\nbegin\nsection{*All lemmas on causal relation between inv__38*}\nlemma lemma_inv__38_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__38) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__38_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.37387582974820255, "lm_q1q2_score": 0.19860634524013582}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory PolicyExample\nimports Noninterference\nbegin\n\n(* This first example_auth_graphample shows how notifications and endpoints differ.\n Endpoints tend to spray information in all directions, while\n notifications are unidirectional.\n\n This example is a subset of the SAC example from access *)\ndatatype auth_graph_label = T | NTFN1 | NTFN2 | CTR | C | EP | RM\n\nabbreviation partition_label where\n \"partition_label x \\ OrdinaryLabel x\"\n\ndefinition example_auth_graph :: \"(auth_graph_label subject_label \\ auth \\ auth_graph_label subject_label) set\" where\n \"example_auth_graph \\ \n { (partition_label T,Notify,partition_label NTFN1),\n (partition_label CTR,Receive,partition_label NTFN1),\n (partition_label C,Read,partition_label CTR),\n (partition_label C,Write,partition_label CTR),\n (partition_label CTR,Read,partition_label C),\n (partition_label CTR,Write,partition_label C),\n (partition_label CTR,SyncSend,partition_label EP),\n (partition_label T,Notify,partition_label NTFN2),\n (partition_label RM,Receive,partition_label NTFN2),\n (partition_label RM,Receive,partition_label EP)\n } \\ {(a,b,c). a = c}\"\n\ndeclare example_auth_graph_def [simp]\n\nlemma subjectReads_T:\n \"subjectReads example_auth_graph (partition_label T) = {partition_label T}\"\n apply(auto simp: reads_lrefl elim: subjectReads.induct)\n done\n\nlemma CTR_in_subjectReads_NTFN1:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule read_sync_ep_read_receivers[where ep=\"partition_label NTFN1\"], auto intro: reads_lrefl)\n done\n\nlemma EP_in_subjectReads_NTFN1:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label CTR\" and a=\"partition_label EP\"], auto intro: CTR_in_subjectReads_NTFN1[simplified])\n done\n\nlemma C_in_subjectReads_NTFN1:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_thread_read_pages, auto intro: CTR_in_subjectReads_NTFN1[simplified])\n done\n\nlemma RM_in_subjectReads_NTFN1:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule read_sync_ep_read_receivers, auto intro: EP_in_subjectReads_NTFN1[simplified])\n done\n\nlemma NTFN2_in_subjectReads_NTFN1:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label RM\" and a=\"partition_label NTFN2\"], auto intro: RM_in_subjectReads_NTFN1[simplified])\n done\n\nlemmas subjectReads_NTFN1' = reads_lrefl[of \"partition_label NTFN1\"]\n CTR_in_subjectReads_NTFN1\n EP_in_subjectReads_NTFN1\n RM_in_subjectReads_NTFN1\n C_in_subjectReads_NTFN1\n NTFN2_in_subjectReads_NTFN1\n\nlemma subjectReads_NTFN1:\n \"subjectReads example_auth_graph (partition_label NTFN1) = {partition_label NTFN1, partition_label CTR, partition_label EP, partition_label C, partition_label RM, partition_label NTFN2}\"\n apply(rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (fastforce simp: subjectReads_NTFN1'[simplified])+\n done\n\nlemma RM_in_subjectReads_NTFN2:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule read_sync_ep_read_receivers[where ep=\"partition_label NTFN2\"], auto intro: reads_lrefl)\n done\n\nlemma EP_in_subjectReads_NTFN2:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label RM\" and a=\"partition_label EP\"], auto intro: RM_in_subjectReads_NTFN2[simplified])\n done\n\nlemma CTR_in_subjectReads_NTFN2:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule read_sync_ep_read_senders[where ep=\"partition_label EP\" and a=\"partition_label EP\"], auto intro: EP_in_subjectReads_NTFN2[simplified])\n done\n\nlemma C_in_subjectReads_NTFN2:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_thread_read_pages, auto intro: CTR_in_subjectReads_NTFN2[simplified])\n done\n\n\nlemma NTFN1_in_subjectReads_NTFN2:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label CTR\" and a=\"partition_label NTFN1\"], auto intro: CTR_in_subjectReads_NTFN2[simplified])\n done\n\nlemmas subjectReads_NTFN2' = reads_lrefl[of \"partition_label NTFN2\"]\n CTR_in_subjectReads_NTFN2\n EP_in_subjectReads_NTFN2\n RM_in_subjectReads_NTFN2\n C_in_subjectReads_NTFN2\n NTFN1_in_subjectReads_NTFN2\n\nlemma subjectReads_NTFN2:\n \"subjectReads example_auth_graph (partition_label NTFN2) = {partition_label NTFN2, partition_label NTFN1, partition_label C, partition_label CTR, partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (fastforce simp: subjectReads_NTFN2'[simplified])+\n done\n\n\nlemma EP_in_subjectReads_CTR:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac a=\"partition_label CTR\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_lrefl)\n done\n\nlemma RM_in_subjectReads_CTR:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(clarsimp)\n apply(rule_tac ep=\"partition_label EP\" and auth=\"SyncSend\" in read_sync_ep_read_receivers)\n apply blast\n apply blast\n apply(rule EP_in_subjectReads_CTR[simplified])\n apply fastforce\n done\n\nlemma C_in_subjectReads_CTR:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule reads_read, auto)\n done\n\nlemma NTFN1_in_subjectReads_CTR:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac t=\"partition_label CTR\" and auth=\"Receive\" and a=\"partition_label T\" and auth'=\"Notify\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_lrefl)\n done\n \nlemma NTFN2_in_subjectReads_CTR:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac t=\"partition_label RM\" and auth=\"Receive\" and a=\"partition_label T\" and auth'=\"Notify\" in reads_read_queued_thread_read_ep)\n apply (auto intro: RM_in_subjectReads_CTR[simplified])\n done\n\nlemmas subjectReads_CTR' = reads_lrefl[of \"partition_label CTR\"]\n NTFN2_in_subjectReads_CTR NTFN1_in_subjectReads_CTR\n C_in_subjectReads_CTR RM_in_subjectReads_CTR EP_in_subjectReads_CTR\n\nlemma subjectReads_CTR:\n \"subjectReads example_auth_graph (partition_label CTR) = {partition_label CTR,partition_label C,partition_label EP, partition_label RM, partition_label NTFN1, partition_label NTFN2}\"\n apply(clarsimp)\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct)\n apply(auto)[9]\n apply(auto simp: subjectReads_CTR'[simplified])\n done\n\nlemma NTFN1_in_subjectReads_C:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label T\" and ep=\"partition_label NTFN1\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_read)\n done\n\nlemma EP_in_subjectReads_C:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label CTR\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_read)\n done\n\nlemma RM_in_subjectReads_C:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label C)\"\n apply(clarsimp)\n apply(rule_tac a=\"partition_label CTR\" in read_sync_ep_read_receivers[OF _ _ EP_in_subjectReads_C[simplified]])\n apply simp+\n done\n\nlemma CTR_in_subjectReads_C:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule reads_read, auto)\n done\n\nlemma NTFN2_in_subjectReads_C:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label T\" and ep=\"partition_label NTFN2\" and t=\"partition_label RM\" in reads_read_queued_thread_read_ep)\n apply(fastforce simp: RM_in_subjectReads_C[simplified])+\n done\n\nlemmas subjectReads_C' = reads_lrefl[of \"partition_label C\"]\n NTFN2_in_subjectReads_C NTFN1_in_subjectReads_C\n RM_in_subjectReads_C EP_in_subjectReads_C CTR_in_subjectReads_C\n\n\nlemma subjectReads_C:\n \"subjectReads example_auth_graph (partition_label C) = {partition_label C,partition_label CTR,partition_label NTFN1, partition_label EP, partition_label RM, partition_label NTFN2}\"\n apply(clarsimp)\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct)\n apply(auto)[9]\n apply(auto simp: subjectReads_C'[simplified])\n done\n \n\nlemma CTR_in_subjectReads_EP:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(clarsimp)\n apply(rule_tac a=\"partition_label RM\" and ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply (simp add: reads_lrefl)+\n done\n\nlemma NTFN1_in_subjectReads_EP:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label NTFN1\", OF _ _ _ _ CTR_in_subjectReads_EP])\n apply(auto)\n done\n\nlemma C_in_subjectReads_EP:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_thread_read_pages[OF CTR_in_subjectReads_EP])\n apply(auto)\n done\n\nlemma RM_in_subjectReads_EP:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule read_sync_ep_read_receivers[OF _ _ reads_lrefl])\n apply(auto)\n done\n\nlemma NTFN2_in_subjectReads_EP:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label NTFN2\", OF _ _ _ _ RM_in_subjectReads_EP])\n apply(auto)\n done\n\nlemmas subjectReads_EP' = reads_lrefl[of \"partition_label EP\"]\n CTR_in_subjectReads_EP\n C_in_subjectReads_EP\n RM_in_subjectReads_EP\n NTFN2_in_subjectReads_EP\n NTFN1_in_subjectReads_EP\n\nlemma subjectReads_EP:\n \"subjectReads example_auth_graph (partition_label EP) = {partition_label EP,partition_label CTR,partition_label NTFN1, partition_label C, partition_label RM, partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct)\n apply(auto)[9]\n apply(auto simp: subjectReads_EP'[simplified])\n done\n\nlemma NTFN2_in_subjectReads_RM:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_ep, auto)\n done\n\nlemma EP_in_subjectReads_RM:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_ep, auto)\n done\n\nlemma CTR_in_subjectReads_RM:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule read_sync_ep_read_senders[where a=\"partition_label RM\" and ep=\"partition_label EP\", OF _ _ EP_in_subjectReads_RM], auto)\n done\n\nlemma C_in_subjectReads_RM:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_read_thread_read_pages[where t=\"partition_label CTR\", OF CTR_in_subjectReads_RM], auto)\n done\n\n\nlemma NTFN1_in_subjectReads_RM:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label T\" and t=\"partition_label CTR\", OF _ _ _ _ CTR_in_subjectReads_RM], auto)\n done\n\nlemmas subjectReads_RM' = reads_lrefl[of \"partition_label RM\"]\n CTR_in_subjectReads_RM\n C_in_subjectReads_RM\n EP_in_subjectReads_RM\n NTFN1_in_subjectReads_RM\n NTFN2_in_subjectReads_RM\n\nlemma subjectReads_RM:\n \"subjectReads example_auth_graph (partition_label RM) = {partition_label RM, partition_label NTFN2,partition_label EP,partition_label CTR, partition_label C, partition_label NTFN1}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct)\n apply(auto)[9]\n apply(auto simp: subjectReads_RM'[simplified])\n done\n\n\nlemma NTFN1_in_subjectAffects_T:\n \"partition_label NTFN1 \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(auto intro: affects_ep)\n done\n\nlemma NTFN2_in_subjectAffects_T:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(auto intro: affects_ep)\n done\n\nlemma C_in_subjectAffects_T:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma CTR_in_subjectAffects_T:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma RM_in_subjectAffects_T:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN2\"], auto)\n done\n \nlemma EP_in_subjectAffects_T:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label T)\"\n by (rule affects_ep_bound_trans, auto)\n\nlemmas subjectAffects_T' = affects_lrefl[of \"partition_label T\"]\n NTFN1_in_subjectAffects_T\n NTFN2_in_subjectAffects_T\n C_in_subjectAffects_T\n CTR_in_subjectAffects_T\n RM_in_subjectAffects_T\n EP_in_subjectAffects_T\n \n\n\nlemma subjectAffects_T:\n \"subjectAffects example_auth_graph (partition_label T) = {partition_label NTFN1,partition_label NTFN2,partition_label T,partition_label C, partition_label CTR, partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(fastforce+)[7]\n apply clarsimp\n apply (elim disjE conjE; simp)\n apply(auto simp: subjectAffects_T'[simplified])\n done\n\nlemma CTR_in_subjectAffects_NTFN1:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label NTFN1)\"\n apply(rule affects_send[where ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma C_in_subjectAffects_NTFN1:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label NTFN1)\"\n apply(rule affects_send[where ep=\"partition_label NTFN1\"], auto)\n done\n\nlemmas subjectAffects_NTFN1' = affects_lrefl[of \"partition_label NTFN1\"]\n C_in_subjectAffects_NTFN1\n CTR_in_subjectAffects_NTFN1\n\n\nlemma subjectAffects_NTFN1:\n \"subjectAffects example_auth_graph (partition_label NTFN1) = {partition_label NTFN1,partition_label CTR,partition_label C}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(auto)[7]\n apply(auto simp: subjectAffects_NTFN1'[simplified])\n done\n\nlemma RM_in_subjectAffects_NTFN2:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label NTFN2)\"\n apply(rule affects_send[where ep=\"partition_label NTFN2\"], auto)\n done\n \nlemma EP_in_subjectAffects_NTFN2:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label NTFN2)\"\n apply(rule affects_ep_bound_trans, auto)\n done\n\n\nlemmas subjectAffects_NTFN2' = affects_lrefl[of \"partition_label NTFN2\"]\n RM_in_subjectAffects_NTFN2\n EP_in_subjectAffects_NTFN2\n\n\nlemma subjectAffects_NTFN2:\n \"subjectAffects example_auth_graph (partition_label NTFN2) = {partition_label NTFN2,partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(auto)[7]\n apply clarsimp\n apply (elim disjE conjE; simp)\n apply(auto simp: subjectAffects_NTFN2'[simplified])\n done\n\nlemma C_in_subjectAffects_CTR:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_write[where auth=\"Write\"], auto)\n done\n\nlemma EP_in_subjectAffects_CTR:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_ep, auto)\n done\n \nlemma NTFN1_in_subjectAffects_CTR:\n \"partition_label NTFN1 \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_ep, auto)\n done\n\nlemma RM_in_subjectAffects_CTR:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_send, auto)\n done\n\nlemmas subjectAffects_CTR' = affects_lrefl[of \"partition_label CTR\"]\n NTFN1_in_subjectAffects_CTR\n C_in_subjectAffects_CTR\n EP_in_subjectAffects_CTR\n RM_in_subjectAffects_CTR\n\nlemma subjectAffects_CTR:\n \"subjectAffects example_auth_graph (partition_label CTR) = {partition_label CTR,partition_label C,partition_label EP,partition_label NTFN1, partition_label RM}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(fastforce+)[7]\n apply(auto simp: subjectAffects_CTR'[simplified])\n done\n\nlemma CTR_in_subjectAffects_C:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label C)\"\n apply(rule affects_write[where auth=Write], auto)\n done\n\nlemmas subjectAffects_C' = affects_lrefl[of \"partition_label C\"]\n CTR_in_subjectAffects_C\n\n\nlemma subjectAffects_C:\n \"subjectAffects example_auth_graph (partition_label C) = {partition_label C,partition_label CTR}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(auto)[7]\n apply(auto simp: subjectAffects_C'[simplified])\n done\n\nlemma RM_in_subjectAffects_EP:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_send, auto)\n done\n\nlemma CTR_in_subjectAffects_EP:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_recv, auto)\n done\n\nlemma C_in_subjectAffects_EP:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_reset[where ep=\"partition_label EP\" and l'=\"partition_label CTR\"], auto)\n done\n \nlemma NTFN2_in_subjectAffects_EP:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_ep_bound_trans, auto)\n done\n\n\nlemmas subjectAffects_EP' = affects_lrefl[of \"partition_label EP\"]\n CTR_in_subjectAffects_EP\n C_in_subjectAffects_EP\n RM_in_subjectAffects_EP\n NTFN2_in_subjectAffects_EP\n\n\nlemma subjectAffects_EP:\n \"subjectAffects example_auth_graph (partition_label EP) = {partition_label EP, partition_label RM, partition_label CTR, partition_label C, partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(fastforce+)[7]\n apply clarsimp\n apply (elim conjE disjE; simp)\n apply(auto simp: subjectAffects_EP'[simplified])\n done\n\nlemma EP_in_subjectAffects_RM:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_ep, auto)\n done\n\nlemma CTR_in_subjectAffects_RM:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_recv, auto)\n done\n\nlemma NTFN2_in_subjectAffects_RM:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_ep, auto)\n done\n\nlemmas subjectAffects_RM' = affects_lrefl[of \"partition_label RM\"]\n EP_in_subjectAffects_RM\n NTFN2_in_subjectAffects_RM\n CTR_in_subjectAffects_RM\n\n\nlemma subjectAffects_RM:\n \"subjectAffects example_auth_graph (partition_label RM) = {partition_label RM,partition_label EP,partition_label CTR,partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases)\n apply(auto)[7]\n apply(auto simp: subjectAffects_RM'[simplified])\n done\n\nlemmas subjectReads = subjectReads_T subjectReads_NTFN1 subjectReads_NTFN2 subjectReads_CTR\n subjectReads_EP subjectReads_RM subjectReads_C\n\ndeclare example_auth_graph_def [simp del]\n\nlemma partsSubjectAffects_T:\n \"partsSubjectAffects example_auth_graph T = {Partition T,Partition NTFN1, Partition NTFN2, Partition CTR, Partition C, Partition EP, Partition RM}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_T | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN1:\n \"partsSubjectAffects example_auth_graph NTFN1 = {Partition NTFN1, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_NTFN1 | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN2:\n \"partsSubjectAffects example_auth_graph NTFN2 = {Partition NTFN2, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_NTFN2 | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_CTR:\n \"partsSubjectAffects example_auth_graph CTR = {Partition NTFN1, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_CTR | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_C:\n \"partsSubjectAffects example_auth_graph C = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_C | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_EP:\n \"partsSubjectAffects example_auth_graph EP = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_EP | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_RM:\n \"partsSubjectAffects example_auth_graph RM = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2, Partition NTFN1}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_RM | rename_tac xa, case_tac xa)+\n done\n\nlemmas partsSubjectAffects = partsSubjectAffects_T partsSubjectAffects_NTFN1 \n partsSubjectAffects_NTFN2 partsSubjectAffects_CTR \n partsSubjectAffects_C partsSubjectAffects_RM partsSubjectAffects_EP\n\ndefinition example_policy :: \"(auth_graph_label partition \\ auth_graph_label partition) set\" where\n \"example_policy \\ {(PSched,d)|d. True} \\\n {(Partition l,Partition k)|l k. (k = T \\ l = T)}\"\n\n\nlemma \"example_policy = policyFlows example_auth_graph\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(clarsimp simp: example_policy_def)\n apply(elim disjE)\n apply(fastforce intro: policy_scheduler)\n apply clarsimp\n apply (rule policy_affects)\n apply (case_tac \"k = T\")\n apply (clarsimp simp: partsSubjectAffects)\n apply(case_tac l, (auto simp: partsSubjectAffects | case_tac k)+)[1]\n apply(rule subsetI)\n apply(clarsimp simp: example_policy_def)\n apply(erule policyFlows.cases)\n apply(case_tac l, auto simp: partsSubjectAffects)\n done\n\n\n(* This second example is a classic 'one way information flow'\n example, where information is allowed to flow from Low to High,\n but not the reverse. We consider a typical scenario where\n shared memory and an notification for notifications are used to\n implement a ring-buffer. *)\ndatatype auth_graph_label2 = High | Low | SharedPage | NTFN\n\ndefinition example_auth_graph2 :: \"(auth_graph_label2 subject_label \\ auth \\ auth_graph_label2 subject_label) set\" where\n \"example_auth_graph2 \\ \n { (partition_label Low,Write,partition_label SharedPage),\n (partition_label Low,Read,partition_label SharedPage),\n (partition_label High,Read,partition_label SharedPage),\n (partition_label Low,Notify,partition_label NTFN),\n (partition_label High,Receive,partition_label NTFN)\n } \\ {(x,a,y). x = y}\"\n\ndeclare example_auth_graph2_def [simp]\n\nlemma subjectReads_Low: \"subjectReads example_auth_graph2 (partition_label Low) = {partition_label Low,partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: reads_lrefl reads_read)\n done\n\nlemma subjectReads_SharedPage: \"subjectReads example_auth_graph2 (partition_label SharedPage) = {partition_label Low,partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: reads_lrefl reads_read_page_read_thread)\n done\n\nlemma High_in_subjectReads_NTFN:\n \"partition_label High \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule read_sync_ep_read_receivers)\n apply(auto intro: reads_lrefl)\n done\n\nlemma SharedPage_in_subjectReads_NTFN:\n \"partition_label SharedPage \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule reads_read_thread_read_pages[OF High_in_subjectReads_NTFN])\n apply(auto)\n done\n\nlemma Low_in_subjectReads_NTFN:\n \"partition_label Low \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule reads_read_page_read_thread[OF SharedPage_in_subjectReads_NTFN])\n apply(auto)\n done\n\nlemma subjectReads_NTFN: \"subjectReads example_auth_graph2 (partition_label NTFN) = {partition_label NTFN,partition_label High,partition_label SharedPage, partition_label Low}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: High_in_subjectReads_NTFN Low_in_subjectReads_NTFN SharedPage_in_subjectReads_NTFN simp del: example_auth_graph2_def intro: reads_lrefl)\n done\n\nlemma NTFN_in_subjectReads_High:\n \"partition_label NTFN \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_ep)\n done\n\nlemma SharedPage_in_subjectReads_High:\n \"partition_label SharedPage \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_read_thread_read_pages reads_lrefl)\n done\n\nlemma Low_in_subjectReads_High:\n \"partition_label Low \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_read_page_read_thread[OF SharedPage_in_subjectReads_High])\n done\n\nlemma subjectReads_High: \"subjectReads example_auth_graph2 (partition_label High) = {partition_label High,partition_label NTFN, partition_label SharedPage,partition_label Low}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply(auto intro: reads_lrefl NTFN_in_subjectReads_High SharedPage_in_subjectReads_High Low_in_subjectReads_High simp del: example_auth_graph2_def)\n done\n\nlemma SharedPage_in_subjectAffects_Low:\n \"partition_label SharedPage \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(fastforce intro: affects_write)\n done\n\nlemma NTFN_in_subjectAffects_Low:\n \"partition_label NTFN \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(fastforce intro: affects_ep)\n done\n\nlemma High_in_subjectAffects_Low:\n \"partition_label High \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(rule affects_send[where ep=\"partition_label NTFN\"])\n apply(auto)\n done\n\nlemma subjectAffects_Low: \"subjectAffects example_auth_graph2 (partition_label Low) = {partition_label Low,partition_label NTFN,partition_label SharedPage, partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl SharedPage_in_subjectAffects_Low NTFN_in_subjectAffects_Low High_in_subjectAffects_Low simp del: example_auth_graph2_def)\n done\n\nlemma subjectAffects_SharedPage: \"subjectAffects example_auth_graph2 (partition_label SharedPage) = {partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl)\n done\n\nlemma High_in_subjectAffects_NTFN:\n \"partition_label High \\ subjectAffects example_auth_graph2 (partition_label NTFN)\"\n apply(rule affects_send[where ep=\"partition_label NTFN\"])\n apply auto\n done\n \nlemma subjectAffects_NTFN: \"subjectAffects example_auth_graph2 (partition_label NTFN) = {partition_label NTFN,partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl High_in_subjectAffects_NTFN simp del: example_auth_graph2_def)\n done\n\nlemma NTFN_in_subjectAffects_High:\n \"partition_label NTFN \\ subjectAffects example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: affects_ep)\n done\n\nlemma subjectAffects_High: \"subjectAffects example_auth_graph2 (partition_label High) = {partition_label NTFN,partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl NTFN_in_subjectAffects_High simp del: example_auth_graph2_def)\n done\n\n\n\nlemmas subjectReads_2 = subjectReads_High subjectReads_Low subjectReads_NTFN subjectReads_SharedPage\n\ndeclare example_auth_graph2_def [simp del]\n\n\n\nlemma partsSubjectAffects_Low: \"partsSubjectAffects example_auth_graph2 Low = {Partition Low, Partition High, Partition SharedPage, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_Low | case_tac xa, rename_tac xa)+\n done\n\nlemma partsSubjectAffects_SharedPage: \"partsSubjectAffects example_auth_graph2 SharedPage = {Partition SharedPage, Partition High, Partition Low, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_SharedPage | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN: \"partsSubjectAffects example_auth_graph2 NTFN = {Partition NTFN, Partition High}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_NTFN | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_High: \"partsSubjectAffects example_auth_graph2 High = {Partition High, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_High | rename_tac xa, case_tac xa)+\n done\n\nlemmas partsSubjectAffects2 =\n partsSubjectAffects_High partsSubjectAffects_Low partsSubjectAffects_NTFN \n partsSubjectAffects_SharedPage\n\n\ndefinition example_policy2 where\n \"example_policy2 \\ {(PSched, d)|d. True} \\ \n {(d,e). d = e} \\ \n {(Partition Low, Partition NTFN), (Partition Low, Partition SharedPage), \n (Partition Low, Partition High)} \\ \n {(Partition SharedPage,Partition High), (Partition SharedPage, Partition Low),\n (Partition SharedPage,Partition NTFN)} \\\n {(Partition NTFN, Partition High)} \\\n {(Partition High, Partition NTFN)}\"\n\nlemma \"policyFlows example_auth_graph2 = example_policy2\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(clarsimp simp: example_policy2_def)\n apply(erule policyFlows.cases)\n apply(case_tac l, auto simp: partsSubjectAffects2)[1]\n apply assumption\n apply(rule subsetI)\n apply(clarsimp simp: example_policy2_def)\n apply(elim disjE)\n apply(fastforce simp: partsSubjectAffects2 intro: policy_affects)+\n apply(fastforce intro: policy_scheduler)\n apply(fastforce intro: policyFlows_refl refl_onD)\n done\n\n \nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/infoflow/PolicyExample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.34158249943831703, "lm_q1q2_score": 0.1985629626335031}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__34_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__34_on_rules imports n_germanSimp_lemma_on_inv__34\nbegin\nsection{*All lemmas on causal relation between inv__34*}\nlemma lemma_inv__34_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__34) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__34_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.384912151539776, "lm_q1q2_score": 0.19846837113770388}} {"text": "(* Title: HOL/Bali/State.thy\n Author: David von Oheimb\n*)\nsubsection \\State for evaluation of Java expressions and statements\\\n\ntheory State\nimports DeclConcepts\nbegin\n\ntext \\\ndesign issues:\n\\begin{itemize}\n\\item all kinds of objects (class instances, arrays, and class objects)\n are handeled via a general object abstraction\n\\item the heap and the map for class objects are combined into a single table\n \\(recall (loc, obj) table \\ (qtname, obj) table ~= (loc + qtname, obj) table)\\\n\\end{itemize}\n\\\n\nsubsubsection \"objects\"\n\ndatatype obj_tag = \\\\tag for generic object\\\n CInst qtname \\\\class instance\\\n | Arr ty int \\\\array with component type and length\\\n \\\\| CStat qtname the tag is irrelevant for a class object,\n i.e. the static fields of a class,\n since its type is given already by the reference to \n it (see below)\\\n\ntype_synonym vn = \"fspec + int\" \\\\variable name\\\nrecord obj = \n tag :: \"obj_tag\" \\\\generalized object\\\n \"values\" :: \"(vn, val) table\" \n\ntranslations \n (type) \"fspec\" <= (type) \"vname \\ qtname\" \n (type) \"vn\" <= (type) \"fspec + int\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option\\\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option,\\::'a\\\"\n\ndefinition\n the_Arr :: \"obj option \\ ty \\ int \\ (vn, val) table\"\n where \"the_Arr obj = (SOME (T,k,t). obj = Some \\tag=Arr T k,values=t\\)\"\n\nlemma the_Arr_Arr [simp]: \"the_Arr (Some \\tag=Arr T k,values=cs\\) = (T,k,cs)\"\napply (auto simp: the_Arr_def)\ndone\n\nlemma the_Arr_Arr1 [simp,intro,dest]:\n \"\\tag obj = Arr T k\\ \\ the_Arr (Some obj) = (T,k,values obj)\"\napply (auto simp add: the_Arr_def)\ndone\n\ndefinition\n upd_obj :: \"vn \\ val \\ obj \\ obj\"\n where \"upd_obj n v = (\\obj. obj \\values:=(values obj)(n\\v)\\)\"\n\nlemma upd_obj_def2 [simp]: \n \"upd_obj n v obj = obj \\values:=(values obj)(n\\v)\\\" \napply (auto simp: upd_obj_def)\ndone\n\ndefinition\n obj_ty :: \"obj \\ ty\" where\n \"obj_ty obj = (case tag obj of \n CInst C \\ Class C \n | Arr T k \\ T.[])\"\n\nlemma obj_ty_eq [intro!]: \"obj_ty \\tag=oi,values=x\\ = obj_ty \\tag=oi,values=y\\\" \nby (simp add: obj_ty_def)\n\n\nlemma obj_ty_eq1 [intro!,dest]: \n \"tag obj = tag obj' \\ obj_ty obj = obj_ty obj'\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_cong [simp]: \n \"obj_ty (obj \\values:=vs\\) = obj_ty obj\" \nby auto\n\nlemma obj_ty_CInst [simp]: \n \"obj_ty \\tag=CInst C,values=vs\\ = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_CInst1 [simp,intro!,dest]: \n \"\\tag obj = CInst C\\ \\ obj_ty obj = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr [simp]: \n \"obj_ty \\tag=Arr T i,values=vs\\ = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr1 [simp,intro!,dest]: \n \"\\tag obj = Arr T i\\ \\ obj_ty obj = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_widenD: \n \"G\\obj_ty obj\\RefT t \\ (\\C. tag obj = CInst C) \\ (\\T k. tag obj = Arr T k)\"\napply (unfold obj_ty_def)\napply (auto split: obj_tag.split_asm)\ndone\n\ndefinition\n obj_class :: \"obj \\ qtname\" where\n \"obj_class obj = (case tag obj of \n CInst C \\ C \n | Arr T k \\ Object)\"\n\n\nlemma obj_class_CInst [simp]: \"obj_class \\tag=CInst C,values=vs\\ = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_CInst1 [simp,intro!,dest]: \n \"tag obj = CInst C \\ obj_class obj = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr [simp]: \"obj_class \\tag=Arr T k,values=vs\\ = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr1 [simp,intro!,dest]: \n \"tag obj = Arr T k \\ obj_class obj = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_ty_obj_class: \"G\\obj_ty obj\\ Class statC = G\\obj_class obj \\\\<^sub>C statC\"\napply (case_tac \"tag obj\")\napply (auto simp add: obj_ty_def obj_class_def)\napply (case_tac \"statC = Object\")\napply (auto dest: widen_Array_Class)\ndone\n\nsubsubsection \"object references\"\n\ntype_synonym oref = \"loc + qtname\" \\\\generalized object reference\\\nsyntax\n Heap :: \"loc \\ oref\"\n Stat :: \"qtname \\ oref\"\n\ntranslations\n \"Heap\" => \"CONST Inl\"\n \"Stat\" => \"CONST Inr\"\n (type) \"oref\" <= (type) \"loc + qtname\"\n\ndefinition\n fields_table :: \"prog \\ qtname \\ (fspec \\ field \\ bool) \\ (fspec, ty) table\" where\n \"fields_table G C P =\n map_option type \\ table_of (filter (case_prod P) (DeclConcepts.fields G C))\"\n\nlemma fields_table_SomeI: \n\"\\table_of (DeclConcepts.fields G C) n = Some f; P n f\\ \n \\ fields_table G C P n = Some (type f)\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule map_of_filter_in)\napply assumption\napply simp\ndone\n\n(* unused *)\nlemma fields_table_SomeD': \"fields_table G C P fn = Some T \\ \n \\f. (fn,f)\\set(DeclConcepts.fields G C) \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (drule map_of_SomeD)\napply auto\ndone\n\nlemma fields_table_SomeD: \n\"\\fields_table G C P fn = Some T; unique (DeclConcepts.fields G C)\\ \\ \n \\f. table_of (DeclConcepts.fields G C) fn = Some f \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule table_of_filter_unique_SomeD)\napply assumption\napply simp\ndone\n\ndefinition\n in_bounds :: \"int \\ int \\ bool\" (\"(_/ in'_bounds _)\" [50, 51] 50)\n where \"i in_bounds k = (0 \\ i \\ i < k)\"\n\ndefinition\n arr_comps :: \"'a \\ int \\ int \\ 'a option\"\n where \"arr_comps T k = (\\i. if i in_bounds k then Some T else None)\"\n \ndefinition\n var_tys :: \"prog \\ obj_tag \\ oref \\ (vn, ty) table\" where\n \"var_tys G oi r =\n (case r of \n Heap a \\ (case oi of \n CInst C \\ fields_table G C (\\n f. \\static f) (+) empty\n | Arr T k \\ empty (+) arr_comps T k)\n | Stat C \\ fields_table G C (\\fn f. declclassf fn = C \\ static f) \n (+) empty)\"\n\nlemma var_tys_Some_eq: \n \"var_tys G oi r n = Some T \n = (case r of \n Inl a \\ (case oi of \n CInst C \\ (\\nt. n = Inl nt \\ fields_table G C (\\n f. \n \\static f) nt = Some T) \n | Arr t k \\ (\\ i. n = Inr i \\ i in_bounds k \\ t = T)) \n | Inr C \\ (\\nt. n = Inl nt \\ \n fields_table G C (\\fn f. declclassf fn = C \\ static f) nt \n = Some T))\"\napply (unfold var_tys_def arr_comps_def)\napply (force split: sum.split_asm sum.split obj_tag.split)\ndone\n\n\nsubsubsection \"stores\"\n\ntype_synonym globs \\\\global variables: heap and static variables\\\n = \"(oref , obj) table\"\ntype_synonym heap\n = \"(loc , obj) table\"\n(* type_synonym locals \n = \"(lname, val) table\" *) (* defined in Value.thy local variables *)\n\ntranslations\n (type) \"globs\" <= (type) \"(oref , obj) table\"\n (type) \"heap\" <= (type) \"(loc , obj) table\"\n(* (type) \"locals\" <= (type) \"(lname, val) table\" *)\n\ndatatype st = (* pure state, i.e. contents of all variables *)\n st globs locals\n\nsubsection \"access\"\n\ndefinition\n globs :: \"st \\ globs\"\n where \"globs = case_st (\\g l. g)\"\n \ndefinition\n locals :: \"st \\ locals\"\n where \"locals = case_st (\\g l. l)\"\n\ndefinition heap :: \"st \\ heap\" where\n \"heap s = globs s \\ Heap\"\n\n\nlemma globs_def2 [simp]: \" globs (st g l) = g\"\nby (simp add: globs_def)\n\nlemma locals_def2 [simp]: \"locals (st g l) = l\"\nby (simp add: locals_def)\n\nlemma heap_def2 [simp]: \"heap s a=globs s (Heap a)\"\nby (simp add: heap_def)\n\n\nabbreviation val_this :: \"st \\ val\"\n where \"val_this s == the (locals s This)\"\n\nabbreviation lookup_obj :: \"st \\ val \\ obj\"\n where \"lookup_obj s a' == the (heap s (the_Addr a'))\"\n\nsubsection \"memory allocation\"\n\ndefinition\n new_Addr :: \"heap \\ loc option\" where\n \"new_Addr h = (if (\\a. h a \\ None) then None else Some (SOME a. h a = None))\"\n\nlemma new_AddrD: \"new_Addr h = Some a \\ h a = None\"\napply (auto simp add: new_Addr_def)\napply (erule someI) \ndone\n\nlemma new_AddrD2: \"new_Addr h = Some a \\ \\b. h b \\ None \\ b \\ a\"\napply (drule new_AddrD)\napply auto\ndone\n\nlemma new_Addr_SomeI: \"h a = None \\ \\b. new_Addr h = Some b \\ h b = None\"\napply (simp add: new_Addr_def)\napply (fast intro: someI2)\ndone\n\n\nsubsection \"initialization\"\n\nabbreviation init_vals :: \"('a, ty) table \\ ('a, val) table\"\n where \"init_vals vs == map_option default_val \\ vs\"\n\nlemma init_arr_comps_base [simp]: \"init_vals (arr_comps T 0) = empty\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nlemma init_arr_comps_step [simp]: \n\"0 < j \\ init_vals (arr_comps T j ) = \n init_vals (arr_comps T (j - 1))(j - 1\\default_val T)\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nsubsection \"update\"\n\ndefinition\n gupd :: \"oref \\ obj \\ st \\ st\" (\"gupd'(_\\_')\" [10, 10] 1000)\n where \"gupd r obj = case_st (\\g l. st (g(r\\obj)) l)\"\n\ndefinition\n lupd :: \"lname \\ val \\ st \\ st\" (\"lupd'(_\\_')\" [10, 10] 1000)\n where \"lupd vn v = case_st (\\g l. st g (l(vn\\v)))\"\n\ndefinition\n upd_gobj :: \"oref \\ vn \\ val \\ st \\ st\"\n where \"upd_gobj r n v = case_st (\\g l. st (chg_map (upd_obj n v) r g) l)\"\n\ndefinition\n set_locals :: \"locals \\ st \\ st\"\n where \"set_locals l = case_st (\\g l'. st g l)\"\n\ndefinition\n init_obj :: \"prog \\ obj_tag \\ oref \\ st \\ st\"\n where \"init_obj G oi r = gupd(r\\\\tag=oi, values=init_vals (var_tys G oi r)\\)\"\n\nabbreviation\n init_class_obj :: \"prog \\ qtname \\ st \\ st\"\n where \"init_class_obj G C == init_obj G undefined (Inr C)\"\n\nlemma gupd_def2 [simp]: \"gupd(r\\obj) (st g l) = st (g(r\\obj)) l\"\napply (unfold gupd_def)\napply (simp (no_asm))\ndone\n\nlemma lupd_def2 [simp]: \"lupd(vn\\v) (st g l) = st g (l(vn\\v))\"\napply (unfold lupd_def)\napply (simp (no_asm))\ndone\n\nlemma globs_gupd [simp]: \"globs (gupd(r\\obj) s) = globs s(r\\obj)\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma globs_lupd [simp]: \"globs (lupd(vn\\v ) s) = globs s\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma locals_gupd [simp]: \"locals (gupd(r\\obj) s) = locals s\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma locals_lupd [simp]: \"locals (lupd(vn\\v ) s) = locals s(vn\\v )\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma globs_upd_gobj_new [rule_format (no_asm), simp]: \n \"globs s r = None \\ globs (upd_gobj r n v s) = globs s\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma globs_upd_gobj_upd [rule_format (no_asm), simp]: \n\"globs s r=Some obj\\ globs (upd_gobj r n v s) = globs s(r\\upd_obj n v obj)\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma locals_upd_gobj [simp]: \"locals (upd_gobj r n v s) = locals s\"\napply (induct \"s\")\nby (simp add: upd_gobj_def) \n\n\nlemma globs_init_obj [simp]: \"globs (init_obj G oi r s) t = \n (if t=r then Some \\tag=oi,values=init_vals (var_tys G oi r)\\ else globs s t)\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma locals_init_obj [simp]: \"locals (init_obj G oi r s) = locals s\"\nby (simp add: init_obj_def)\n \nlemma surjective_st [simp]: \"st (globs s) (locals s) = s\"\napply (induct \"s\")\nby auto\n\nlemma surjective_st_init_obj: \n \"st (globs (init_obj G oi r s)) (locals s) = init_obj G oi r s\"\napply (subst locals_init_obj [THEN sym])\napply (rule surjective_st)\ndone\n\nlemma heap_heap_upd [simp]: \n \"heap (st (g(Inl a\\obj)) l) = heap (st g l)(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_stat_upd [simp]: \"heap (st (g(Inr C\\obj)) l) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_local_upd [simp]: \"heap (st g (l(vn\\v))) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_gupd_Heap [simp]: \"heap (gupd(Heap a\\obj) s) = heap s(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_gupd_Stat [simp]: \"heap (gupd(Stat C\\obj) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_lupd [simp]: \"heap (lupd(vn\\v) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_upd_gobj_Stat [simp]: \"heap (upd_gobj (Stat C) n v s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\napply (case_tac \"globs s (Stat C)\")\napply auto\ndone\n\nlemma set_locals_def2 [simp]: \"set_locals l (st g l') = st g l\"\napply (unfold set_locals_def)\napply (simp (no_asm))\ndone\n\nlemma set_locals_id [simp]: \"set_locals (locals s) s = s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma set_set_locals [simp]: \"set_locals l (set_locals l' s) = set_locals l s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma locals_set_locals [simp]: \"locals (set_locals l s) = l\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma globs_set_locals [simp]: \"globs (set_locals l s) = globs s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma heap_set_locals [simp]: \"heap (set_locals l s) = heap s\"\napply (unfold heap_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\n\nsubsubsection \"abrupt completion\"\n\n\n\nprimrec the_Xcpt :: \"abrupt \\ xcpt\"\n where \"the_Xcpt (Xcpt x) = x\"\n\nprimrec the_Jump :: \"abrupt => jump\"\n where \"the_Jump (Jump j) = j\"\n\nprimrec the_Loc :: \"xcpt \\ loc\"\n where \"the_Loc (Loc a) = a\"\n\nprimrec the_Std :: \"xcpt \\ xname\"\n where \"the_Std (Std x) = x\"\n \n\ndefinition\n abrupt_if :: \"bool \\ abopt \\ abopt \\ abopt\"\n where \"abrupt_if c x' x = (if c \\ (x = None) then x' else x)\"\n\nlemma abrupt_if_True_None [simp]: \"abrupt_if True x None = x\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_True_not_None [simp]: \"x \\ None \\ abrupt_if True x y \\ None\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_False [simp]: \"abrupt_if False x y = y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_Some [simp]: \"abrupt_if c x (Some y) = Some y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_not_None [simp]: \"y \\ None \\ abrupt_if c x y = y\"\napply (simp add: abrupt_if_def)\nby auto\n\n\nlemma split_abrupt_if: \n\"P (abrupt_if c x' x) = \n ((c \\ x = None \\ P x') \\ (\\ (c \\ x = None) \\ P x))\"\napply (unfold abrupt_if_def)\napply (split if_split)\napply auto\ndone\n\nabbreviation raise_if :: \"bool \\ xname \\ abopt \\ abopt\"\n where \"raise_if c xn == abrupt_if c (Some (Xcpt (Std xn)))\"\n\nabbreviation np :: \"val \\ abopt \\ abopt\"\n where \"np v == raise_if (v = Null) NullPointer\"\n\nabbreviation check_neg :: \"val \\ abopt \\ abopt\"\n where \"check_neg i' == raise_if (the_Intg i'<0) NegArrSize\"\n\nabbreviation error_if :: \"bool \\ error \\ abopt \\ abopt\"\n where \"error_if c e == abrupt_if c (Some (Error e))\"\n\nlemma raise_if_None [simp]: \"(raise_if c x y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare raise_if_None [THEN iffD1, dest!]\n\nlemma if_raise_if_None [simp]: \n \"((if b then y else raise_if c x y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma raise_if_SomeD [dest!]:\n \"raise_if c x y = Some z \\ c \\ z=(Xcpt (Std x)) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_None [simp]: \"(error_if c e y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare error_if_None [THEN iffD1, dest!]\n\nlemma if_error_if_None [simp]: \n \"((if b then y else error_if c e y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_SomeD [dest!]:\n \"error_if c e y = Some z \\ c \\ z=(Error e) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\ndefinition\n absorb :: \"jump \\ abopt \\ abopt\"\n where \"absorb j a = (if a=Some (Jump j) then None else a)\"\n\nlemma absorb_SomeD [dest!]: \"absorb j a = Some x \\ a = Some x\"\nby (auto simp add: absorb_def)\n\nlemma absorb_same [simp]: \"absorb j (Some (Jump j)) = None\"\nby (auto simp add: absorb_def)\n\nlemma absorb_other [simp]: \"a \\ Some (Jump j) \\ absorb j a = a\"\nby (auto simp add: absorb_def)\n\nlemma absorb_Some_NoneD: \"absorb j (Some abr) = None \\ abr = Jump j\"\n by (simp add: absorb_def)\n\nlemma absorb_Some_JumpD: \"absorb j s = Some (Jump j') \\ j'\\j\"\n by (simp add: absorb_def)\n\n\nsubsubsection \"full program state\"\n\ntype_synonym\n state = \"abopt \\ st\" \\\\state including abruption information\\\n\ntranslations\n (type) \"abopt\" <= (type) \"abrupt option\"\n (type) \"state\" <= (type) \"abopt \\ st\"\n\nabbreviation\n Norm :: \"st \\ state\"\n where \"Norm s == (None, s)\"\n\nabbreviation (input)\n abrupt :: \"state \\ abopt\"\n where \"abrupt == fst\"\n\nabbreviation (input)\n store :: \"state \\ st\"\n where \"store == snd\"\n\nlemma single_stateE: \"\\Z. Z = (s::state) \\ False\"\napply (erule_tac x = \"(Some k,y)\" for k y in all_dupE)\napply (erule_tac x = \"(None,y)\" for y in allE)\napply clarify\ndone\n\nlemma state_not_single: \"All (op = (x::state)) \\ R\"\napply (drule_tac x = \"(if abrupt x = None then Some x' else None, y)\" for x' y in spec)\napply clarsimp\ndone\n\ndefinition\n normal :: \"state \\ bool\"\n where \"normal = (\\s. abrupt s = None)\"\n\nlemma normal_def2 [simp]: \"normal s = (abrupt s = None)\"\napply (unfold normal_def)\napply (simp (no_asm))\ndone\n\ndefinition\n heap_free :: \"nat \\ state \\ bool\"\n where \"heap_free n = (\\s. atleast_free (heap (store s)) n)\"\n\nlemma heap_free_def2 [simp]: \"heap_free n s = atleast_free (heap (store s)) n\"\napply (unfold heap_free_def)\napply simp\ndone\n\nsubsection \"update\"\n\ndefinition\n abupd :: \"(abopt \\ abopt) \\ state \\ state\"\n where \"abupd f = map_prod f id\"\n\ndefinition\n supd :: \"(st \\ st) \\ state \\ state\"\n where \"supd = map_prod id\"\n \nlemma abupd_def2 [simp]: \"abupd f (x,s) = (f x,s)\"\nby (simp add: abupd_def)\n\nlemma abupd_abrupt_if_False [simp]: \"\\ s. abupd (abrupt_if False xo) s = s\"\nby simp\n\nlemma supd_def2 [simp]: \"supd f (x,s) = (x,f s)\"\nby (simp add: supd_def)\n\nlemma supd_lupd [simp]: \n \"\\ s. supd (lupd vn v ) s = (abrupt s,lupd vn v (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\n\nlemma supd_gupd [simp]: \n \"\\ s. supd (gupd r obj) s = (abrupt s,gupd r obj (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma supd_init_obj [simp]: \n \"supd (init_obj G oi r) s = (abrupt s,init_obj G oi r (store s))\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma abupd_store_invariant [simp]: \"store (abupd f s) = store s\"\n by (cases s) simp\n\nlemma supd_abrupt_invariant [simp]: \"abrupt (supd f s) = abrupt s\"\n by (cases s) simp\n\nabbreviation set_lvars :: \"locals \\ state \\ state\"\n where \"set_lvars l == supd (set_locals l)\"\n\nabbreviation restore_lvars :: \"state \\ state \\ state\"\n where \"restore_lvars s' s == set_lvars (locals (store s')) s\"\n\nlemma set_set_lvars [simp]: \"\\ s. set_lvars l (set_lvars l' s) = set_lvars l s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma set_lvars_id [simp]: \"\\ s. set_lvars (locals (store s)) s = s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nsubsubsection \"initialisation test\"\n\ndefinition\n inited :: \"qtname \\ globs \\ bool\"\n where \"inited C g = (g (Stat C) \\ None)\"\n\ndefinition\n initd :: \"qtname \\ state \\ bool\"\n where \"initd C = inited C \\ globs \\ store\"\n\nlemma not_inited_empty [simp]: \"\\inited C empty\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma inited_gupdate [simp]: \"inited C (g(r\\obj)) = (inited C g \\ r = Stat C)\"\napply (unfold inited_def)\napply (auto split: st.split)\ndone\n\nlemma inited_init_class_obj [intro!]: \"inited C (globs (init_class_obj G C s))\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma not_initedD: \"\\ inited C g \\ g (Stat C) = None\"\napply (unfold inited_def)\napply (erule notnotD)\ndone\n\nlemma initedD: \"inited C g \\ \\ obj. g (Stat C) = Some obj\"\napply (unfold inited_def)\napply auto\ndone\n\nlemma initd_def2 [simp]: \"initd C s = inited C (globs (store s))\"\napply (unfold initd_def)\napply (simp (no_asm))\ndone\n\nsubsubsection \\\\error_free\\\\\n\ndefinition\n error_free :: \"state \\ bool\"\n where \"error_free s = (\\ (\\ err. abrupt s = Some (Error err)))\"\n\nlemma error_free_Norm [simp,intro]: \"error_free (Norm s)\"\nby (simp add: error_free_def)\n\nlemma error_free_normal [simp,intro]: \"normal s \\ error_free s\"\nby (simp add: error_free_def)\n\nlemma error_free_Xcpt [simp]: \"error_free (Some (Xcpt x),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Jump [simp,intro]: \"error_free (Some (Jump j),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Error [simp]: \"error_free (Some (Error e),s) = False\"\nby (simp add: error_free_def) \n\nlemma error_free_Some [simp,intro]: \n \"\\ (\\ err. x=Error err) \\ error_free ((Some x),s)\"\nby (auto simp add: error_free_def)\n\nlemma error_free_abupd_absorb [simp,intro]: \n \"error_free s \\ error_free (abupd (absorb j) s)\"\nby (cases s) \n (auto simp add: error_free_def absorb_def\n split: if_split_asm)\n\nlemma error_free_absorb [simp,intro]: \n \"error_free (a,s) \\ error_free (absorb j a, s)\"\nby (auto simp add: error_free_def absorb_def\n split: if_split_asm)\n\nlemma error_free_abrupt_if [simp,intro]:\n\"\\error_free s; \\ (\\ err. x=Error err)\\\n \\ error_free (abupd (abrupt_if p (Some x)) s)\"\nby (cases s)\n (auto simp add: abrupt_if_def\n split: if_split)\n\nlemma error_free_abrupt_if1 [simp,intro]:\n\"\\error_free (a,s); \\ (\\ err. x=Error err)\\\n \\ error_free (abrupt_if p (Some x) a, s)\"\nby (auto simp add: abrupt_if_def\n split: if_split)\n\nlemma error_free_abrupt_if_Xcpt [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Xcpt x))) s)\"\nby simp \n\nlemma error_free_abrupt_if_Xcpt1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Xcpt x)) a, s)\" \nby simp \n\nlemma error_free_abrupt_if_Jump [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Jump j))) s)\" \nby simp\n\nlemma error_free_abrupt_if_Jump1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Jump j)) a, s)\" \nby simp\n\nlemma error_free_raise_if [simp,intro]:\n \"error_free s \\ error_free (abupd (raise_if p x) s)\"\nby simp \n\nlemma error_free_raise_if1 [simp,intro]:\n \"error_free (a,s) \\ error_free ((raise_if p x a), s)\"\nby simp \n\nlemma error_free_supd [simp,intro]:\n \"error_free s \\ error_free (supd f s)\"\nby (cases s) (simp add: error_free_def)\n\nlemma error_free_supd1 [simp,intro]:\n \"error_free (a,s) \\ error_free (a,f s)\"\nby (simp add: error_free_def)\n\nlemma error_free_set_lvars [simp,intro]:\n\"error_free s \\ error_free ((set_lvars l) s)\"\nby (cases s) simp\n\nlemma error_free_set_locals [simp,intro]: \n\"error_free (x, s)\n \\ error_free (x, set_locals l s')\"\nby (simp add: error_free_def)\n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Bali/State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.38491214448393357, "lm_q1q2_score": 0.19846836749957103}} {"text": "(* Title: JinjaThreads/MM/SC.thy\n Author: David von Oheimb, Andreas Lochbihler\n\n Based on the Jinja theories Common/Objects.thy and Common/Conform by David von Oheimb\n*)\n\nsection \\Sequential consistency\\\n\ntheory SC\nimports \n \"../Common/Conform\"\n MM\nbegin\n\nsubsection\\Objects and Arrays\\\n\ntype_synonym \n fields = \"vname \\ cname \\ addr val\" \\ \\field name, defining class, value\\\n\ntype_synonym\n cells = \"addr val list\"\n\ndatatype heapobj\n = Obj cname fields\n \\ \\class instance with class name and fields\\\n\n | Arr ty fields cells\n \\ \\element type, fields (from object), and list of each cell's content\\\n\nlemma rec_heapobj [simp]: \"rec_heapobj = case_heapobj\"\nby(auto intro!: ext split: heapobj.split)\n\nprimrec obj_ty :: \"heapobj \\ htype\"\nwhere\n \"obj_ty (Obj C f) = Class_type C\"\n| \"obj_ty (Arr T fs cs) = Array_type T (length cs)\"\n\nfun is_Arr :: \"heapobj \\ bool\" where\n \"is_Arr (Obj C fs) = False\"\n| \"is_Arr (Arr T f el) = True\"\n\nlemma is_Arr_conv:\n \"is_Arr arrobj = (\\T f el. arrobj = Arr T f el)\"\nby(cases arrobj, auto)\n\nlemma is_ArrE:\n \"\\ is_Arr arrobj; \\T f el. arrobj = Arr T f el \\ thesis \\ \\ thesis\"\n \"\\ \\ is_Arr arrobj; \\C fs. arrobj = Obj C fs \\ thesis \\ \\ thesis\"\nby(cases arrobj, auto)+\n\ndefinition init_fields :: \"('field_name \\ (ty \\ fmod)) list \\ 'field_name \\ addr val\"\nwhere \"init_fields \\ map_of \\ map (\\(FD,(T, fm)). (FD,default_val T))\"\n\nprimrec\n \\ \\a new, blank object with default values in all fields:\\\n blank :: \"'m prog \\ htype \\ heapobj\"\nwhere\n \"blank P (Class_type C) = Obj C (init_fields (fields P C))\"\n| \"blank P (Array_type T n) = Arr T (init_fields (fields P Object)) (replicate n (default_val T))\"\n\nlemma obj_ty_blank [iff]: \n \"obj_ty (blank P hT) = hT\"\nby(cases hT)(simp_all)\n\n\nsubsection\\Heap\\\n\ntype_synonym heap = \"addr \\ heapobj\"\n\ntranslations\n (type) \"heap\" <= (type) \"nat \\ heapobj option\"\n\nabbreviation sc_empty :: heap\nwhere \"sc_empty \\ Map.empty\"\n\nfun the_obj :: \"heapobj \\ cname \\ fields\" where\n \"the_obj (Obj C fs) = (C, fs)\"\n\nfun the_arr :: \"heapobj \\ ty \\ fields \\ cells\" where\n \"the_arr (Arr T f el) = (T, f, el)\"\n\nabbreviation\n cname_of :: \"heap \\ addr \\ cname\" where\n \"cname_of hp a == fst (the_obj (the (hp a)))\"\n\ndefinition sc_allocate :: \"'m prog \\ heap \\ htype \\ (heap \\ addr) set\"\nwhere\n \"sc_allocate P h hT = \n (case new_Addr h of None \\ {}\n | Some a \\ {(h(a \\ blank P hT), a)})\"\n\ndefinition sc_typeof_addr :: \"heap \\ addr \\ htype option\"\nwhere \"sc_typeof_addr h a = map_option obj_ty (h a)\"\n\ninductive sc_heap_read :: \"heap \\ addr \\ addr_loc \\ addr val \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj: \"\\ h a = \\Obj C fs\\; fs (F, D) = \\v\\ \\ \\ sc_heap_read h a (CField D F) v\"\n| Arr: \"\\ h a = \\Arr T f el\\; n < length el \\ \\ sc_heap_read h a (ACell n) (el ! n)\"\n| ArrObj: \"\\ h a = \\Arr T f el\\; f (F, Object) = \\v\\ \\ \\ sc_heap_read h a (CField Object F) v\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_read_cases [elim!]:\n \"sc_heap_read h a (CField C F) v\"\n \"sc_heap_read h a (ACell n) v\"\n\ninductive sc_heap_write :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj: \"\\ h a = \\Obj C fs\\; h' = h(a \\ Obj C (fs((F, D) \\ v))) \\ \\ sc_heap_write h a (CField D F) v h'\"\n| Arr: \"\\ h a = \\Arr T f el\\; h' = h(a \\ Arr T f (el[n := v])) \\ \\ sc_heap_write h a (ACell n) v h'\"\n| ArrObj: \"\\ h a = \\Arr T f el\\; h' = h(a \\ Arr T (f((F, Object) \\ v)) el) \\ \\ sc_heap_write h a (CField Object F) v h'\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_write_cases [elim!]:\n \"sc_heap_write h a (CField C F) v h'\"\n \"sc_heap_write h a (ACell n) v h'\"\n\nconsts sc_spurious_wakeups :: bool\n\ninterpretation sc: \n heap_base\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n for P .\n\ntext \\Translate notation from \\heap_base\\\\\n\n(* FIXME! Why does sc.preallocated need the type token?? *)\nabbreviation sc_preallocated :: \"'m prog \\ heap \\ bool\"\nwhere \"sc_preallocated == sc.preallocated TYPE('m)\"\n\nabbreviation sc_start_tid :: \"'md prog \\ thread_id\"\nwhere \"sc_start_tid \\ sc.start_tid TYPE('md)\"\n\nabbreviation sc_start_heap_ok :: \"'m prog \\ bool\"\nwhere \"sc_start_heap_ok \\ sc.start_heap_ok TYPE('m)\"\n\nabbreviation sc_start_heap :: \"'m prog \\ heap\"\nwhere \"sc_start_heap \\ sc.start_heap TYPE('m)\"\n\nabbreviation sc_start_state :: \n \"(cname \\ mname \\ ty list \\ ty \\ 'm \\ addr val list \\ 'x)\n \\ 'm prog \\ cname \\ mname \\ addr val list \\ (addr, thread_id, 'x, heap, addr) state\"\nwhere\n \"sc_start_state f P \\ sc.start_state TYPE('m) P f P\"\n\nabbreviation sc_wf_start_state :: \"'m prog \\ cname \\ mname \\ addr val list \\ bool\"\nwhere \"sc_wf_start_state P \\ sc.wf_start_state TYPE('m) P P\"\n\nnotation sc.conf (\"_,_ \\sc _ :\\ _\" [51,51,51,51] 50)\nnotation sc.confs (\"_,_ \\sc _ [:\\] _\" [51,51,51,51] 50)\nnotation sc.hext (\"_ \\sc _\" [51,51] 50)\n\nlemma sc_start_heap_ok: \"sc_start_heap_ok P\"\napply(simp add: sc.start_heap_ok_def sc.start_heap_data_def initialization_list_def sc.create_initial_object_simps sc_allocate_def sys_xcpts_list_def case_option_conv_if new_Addr_SomeI del: blank.simps split del: option.split if_split)\ndone\n\nlemma sc_wf_start_state_iff:\n \"sc_wf_start_state P C M vs \\ (\\Ts T meth D. P \\ C sees M:Ts\\T = \\meth\\ in D \\ P,sc_start_heap P \\sc vs [:\\] Ts)\"\nby(simp add: sc.wf_start_state.simps sc_start_heap_ok)\n\nlemma sc_heap:\n \"heap addr2thread_id thread_id2addr (sc_allocate P) sc_typeof_addr sc_heap_write P\"\nproof\n fix h' a h hT\n assume \"(h', a) \\ sc_allocate P h hT\"\n thus \"sc_typeof_addr h' a = \\hT\\\"\n by(auto simp add: sc_allocate_def sc_typeof_addr_def dest: new_Addr_SomeD split: if_split_asm)\nnext\n fix h' h hT a\n assume \"(h', a) \\ sc_allocate P h hT\"\n from this[symmetric] show \"h \\sc h'\"\n by(fastforce simp add: sc_allocate_def sc_typeof_addr_def sc.hext_def dest: new_Addr_SomeD intro!: map_leI)\nnext\n fix h a al v h'\n assume \"sc_heap_write h a al v h'\"\n thus \"h \\sc h'\"\n by(cases al)(auto intro!: sc.hextI simp add: sc_typeof_addr_def)\nqed simp\n\ninterpretation sc: \n heap \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n for P by(rule sc_heap)\n\nlemma sc_hext_new:\n \"h a = None \\ h \\sc h(a \\ arrobj)\"\nby(rule sc.hextI)(auto simp add: sc_typeof_addr_def dest!: new_Addr_SomeD)\n\nlemma sc_hext_upd_obj: \"h a = Some (Obj C fs) \\ h \\sc h(a\\(Obj C fs'))\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def)\n\nlemma sc_hext_upd_arr: \"\\ h a = Some (Arr T f e); length e = length e' \\ \\ h \\sc h(a\\(Arr T f' e'))\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def)\n\nsubsection \\Conformance\\\n\ndefinition sc_fconf :: \"'m prog \\ cname \\ heap \\ fields \\ bool\" (\"_,_,_ \\sc _ \\\" [51,51,51,51] 50)\nwhere \"P,C,h \\sc fs \\ = (\\F D T fm. P \\ C has F:T (fm) in D \\ (\\v. fs(F,D) = Some v \\ P,h \\sc v :\\ T))\"\n\nprimrec sc_oconf :: \"'m prog \\ heap \\ heapobj \\ bool\" (\"_,_ \\sc _ \\\" [51,51,51] 50)\nwhere\n \"P,h \\sc Obj C fs \\ \\ is_class P C \\ P,C,h \\sc fs \\\"\n| \"P,h \\sc Arr T fs el \\ \\ is_type P (T\\\\) \\ P,Object,h \\sc fs \\ \\ (\\v \\ set el. P,h \\sc v :\\ T)\"\n\ndefinition sc_hconf :: \"'m prog \\ heap \\ bool\" (\"_ \\sc _ \\\" [51,51] 50)\nwhere \"P \\sc h \\ \\ (\\a obj. h a = Some obj \\ P,h \\sc obj \\)\"\n\ninterpretation sc: heap_conf_base \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P .\n\ndeclare sc.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nlemma sc_conf_upd_obj: \"h a = Some(Obj C fs) \\ (P,h(a\\(Obj C fs')) \\sc x :\\ T) = (P,h \\sc x :\\ T)\"\napply (unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply (auto simp add: sc_typeof_addr_def split: if_split_asm)\ndone\n\nlemma sc_conf_upd_arr: \"h a = Some(Arr T f el) \\ (P,h(a\\(Arr T f' el')) \\sc x :\\ T') = (P,h \\sc x :\\ T')\"\napply(unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply(auto simp add: sc_typeof_addr_def split: if_split_asm)\ndone\n\n\n\n\n\nlemma sc_oconf_init:\n \"is_htype P hT \\ P,h \\sc blank P hT \\\"\nby(cases hT)(auto simp add: sc_fconf_def has_field_def init_fields_def split_def o_def map_of_map[simplified split_def, where f=\"\\p. default_val (fst p)\"] dest: has_fields_fun)\n\nlemma sc_oconf_fupd [intro?]:\n \"\\ P \\ C has F:T (fm) in D; P,h \\sc v :\\ T; P,h \\sc (Obj C fs) \\ \\ \n \\ P,h \\sc (Obj C (fs((F,D)\\v))) \\\"\nunfolding has_field_def\nby(auto simp add: sc_fconf_def has_field_def dest: has_fields_fun)\n\nlemma sc_oconf_fupd_arr [intro?]:\n \"\\ P,h \\sc v :\\ T; P,h \\sc (Arr T f el) \\ \\\n \\ P,h \\sc (Arr T f (el[i := v])) \\\"\nby(auto dest: subsetD[OF set_update_subset_insert])\n\nlemma sc_oconf_fupd_arr_fields:\n \"\\ P \\ Object has F:T (fm) in Object; P,h \\sc v :\\ T; P,h \\sc (Arr T' f el) \\ \\\n \\ P,h \\sc (Arr T' (f((F, Object) \\ v)) el) \\\"\nby(auto dest: has_fields_fun simp add: sc_fconf_def has_field_def)\n\nlemma sc_oconf_new: \"\\ P,h \\sc obj \\; h a = None \\ \\ P,h(a \\ arrobj) \\sc obj \\\"\nby(erule sc_oconf_hext)(rule sc_hext_new)\n\nlemmas sc_oconf_upd_obj = sc_oconf_hext [OF _ sc_hext_upd_obj]\n\nlemma sc_oconf_upd_arr:\n assumes \"P,h \\sc obj \\\"\n and ha: \"h a = \\Arr T f el\\\"\n shows \"P,h(a \\ Arr T f' el') \\sc obj \\\"\nusing assms\nby(cases obj)(auto simp add: sc_conf_upd_arr[where h=h, OF ha] sc_fconf_def)\n\nlemma sc_hconfD: \"\\ P \\sc h \\; h a = Some obj \\ \\ P,h \\sc obj \\\"\nunfolding sc_hconf_def by blast\n\nlemmas sc_preallocated_new = sc.preallocated_hext[OF _ sc_hext_new]\nlemmas sc_preallocated_upd_obj = sc.preallocated_hext [OF _ sc_hext_upd_obj]\nlemmas sc_preallocated_upd_arr = sc.preallocated_hext [OF _ sc_hext_upd_arr]\n\nlemma sc_hconf_new: \"\\ P \\sc h \\; h a = None; P,h \\sc obj \\ \\ \\ P \\sc h(a\\obj) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_new)\n\nlemma sc_hconf_upd_obj: \"\\ P \\sc h \\; h a = Some (Obj C fs); P,h \\sc (Obj C fs') \\ \\ \\ P \\sc h(a\\(Obj C fs')) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_obj simp del: sc_oconf.simps)\n\nlemma sc_hconf_upd_arr: \"\\ P \\sc h \\; h a = Some(Arr T f el); P,h \\sc (Arr T f' el') \\ \\ \\ P \\sc h(a\\(Arr T f' el')) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_arr simp del: sc_oconf.simps)\n\nlemma sc_heap_conf: \n \"heap_conf addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_write (sc_hconf P) P\"\nproof\n show \"P \\sc sc_empty \\\" by(simp add: sc_hconf_def)\nnext\n fix h a hT\n assume \"sc_typeof_addr h a = \\hT\\\" \"P \\sc h \\\"\n thus \"is_htype P hT\"\n by(auto simp add: sc_typeof_addr_def sc_oconf_def dest!: sc_hconfD split: heapobj.split_asm)\nnext\n fix h h' hT a\n assume \"P \\sc h \\\" \"(h', a) \\ sc_allocate P h hT\" \"is_htype P hT\"\n thus \"P \\sc h' \\\"\n by(auto simp add: sc_allocate_def dest!: new_Addr_SomeD intro: sc_hconf_new sc_oconf_init split: if_split_asm)\nnext\n fix h a al T v h'\n assume \"P \\sc h \\\"\n and \"sc.addr_loc_type P h a al T\"\n and \"P,h \\sc v :\\ T\"\n and \"sc_heap_write h a al v h'\"\n thus \"P \\sc h' \\\"\n by(cases al)(fastforce elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def intro: sc_hconf_upd_obj sc_oconf_fupd sc_hconfD sc_hconf_upd_arr sc_oconf_fupd_arr sc_oconf_fupd_arr_fields)+\nqed\n\ninterpretation sc: heap_conf\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P \nby(rule sc_heap_conf)\n\nlemma sc_heap_progress:\n \"heap_progress addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al T\n assume hconf: \"P \\sc h \\\"\n and alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"h a = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n from alt show \"\\v. sc_heap_read h a al v \\ P,h \\sc v :\\ T\"\n proof(cases)\n case (addr_loc_type_field U F fm D) \n note [simp] = \\al = CField D F\\\n show ?thesis\n proof(cases \"arrobj\")\n case (Obj C' fs)\n with \\sc_typeof_addr h a = \\U\\\\ arrobj\n have [simp]: \"C' = class_type_of U\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Obj have \"P,h \\sc Obj (class_type_of U) fs \\\" by(auto dest: sc_hconfD)\n with \\P \\ class_type_of U has F:T (fm) in D\\ obtain v \n where \"fs (F, D) = \\v\\\" \"P,h \\sc v :\\ T\" by(fastforce simp add: sc_fconf_def)\n thus ?thesis using Obj arrobj by(auto intro: sc_heap_read.intros)\n next\n case (Arr T' f el)\n with \\sc_typeof_addr h a = \\U\\\\ arrobj\n have [simp]: \"U = Array_type T' (length el)\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Arr have \"P,h \\sc Arr T' f el \\\" by(auto dest: sc_hconfD)\n from \\P \\ class_type_of U has F:T (fm) in D\\ have [simp]: \"D = Object\"\n by(auto dest: has_field_decl_above)\n with \\P,h \\sc Arr T' f el \\\\ \\P \\ class_type_of U has F:T (fm) in D\\\n obtain v where \"f (F, Object) = \\v\\\" \"P,h \\sc v :\\ T\"\n by(fastforce simp add: sc_fconf_def)\n thus ?thesis using Arr arrobj by(auto intro: sc_heap_read.intros)\n qed\n next\n case (addr_loc_type_cell n' n)\n with arrobj obtain f el\n where [simp]: \"arrobj = Arr T f el\"\n by(cases arrobj)(auto simp add: sc_typeof_addr_def)\n from addr_loc_type_cell arrobj\n have [simp]: \"al = ACell n\" \"n < length el\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj have \"P,h \\sc Arr T f el \\\" by(auto dest: sc_hconfD)\n hence \"P,h \\sc el ! n :\\ T\" by(fastforce)\n thus ?thesis using arrobj by(fastforce intro: sc_heap_read.intros)\n qed\nnext\n fix h a al T v\n assume alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"h a = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n thus \"\\h'. sc_heap_write h a al v h'\" using alt\n by(cases arrobj)(fastforce intro: sc_heap_write.intros elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def dest: has_field_decl_above)+\nqed\n\ninterpretation sc: heap_progress\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P\nby(rule sc_heap_progress)\n\nlemma sc_heap_conf_read:\n \"heap_conf_read addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al v T\n assume read: \"sc_heap_read h a al v\"\n and alt: \"sc.addr_loc_type P h a al T\"\n and hconf: \"P \\sc h \\\"\n thus \"P,h \\sc v :\\ T\"\n by(auto elim!: sc_heap_read.cases sc.addr_loc_type.cases simp add: sc_typeof_addr_def)(fastforce dest!: sc_hconfD simp add: sc_fconf_def)+\nqed\n\ninterpretation sc: heap_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P\nby(rule sc_heap_conf_read)\n\nabbreviation sc_deterministic_heap_ops :: \"'m prog \\ bool\"\nwhere \"sc_deterministic_heap_ops \\ sc.deterministic_heap_ops TYPE('m)\"\n\nlemma sc_deterministic_heap_ops: \"\\ sc_spurious_wakeups \\ sc_deterministic_heap_ops P\"\nby(rule sc.deterministic_heap_opsI)(auto elim: sc_heap_read.cases sc_heap_write.cases simp add: sc_allocate_def)\n\nsubsection \\Code generation\\\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n sc_heap_read .\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ i \\ o \\ bool)\n sc_heap_write .\n\nlemma eval_sc_heap_read_i_i_i_o:\n \"Predicate.eval (sc_heap_read_i_i_i_o h ad al) = sc_heap_read h ad al\"\nby(auto elim: sc_heap_read_i_i_i_oE intro: sc_heap_read_i_i_i_oI intro!: ext)\n\nlemma eval_sc_heap_write_i_i_i_i_o:\n \"Predicate.eval (sc_heap_write_i_i_i_i_o h ad al v) = sc_heap_write h ad al v\"\nby(auto elim: sc_heap_write_i_i_i_i_oE intro: sc_heap_write_i_i_i_i_oI intro!: ext)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/MM/SC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.198468367499571}} {"text": "section \\HRB Slicing guarantees IFC Noninterference\\\n\ntheory NonInterferenceInter \n imports \"HRB-Slicing.FundamentalProperty\"\nbegin\n\nsubsection \\Assumptions of this Approach\\\n\ntext \\\nClassical IFC noninterference, a special case of a noninterference\ndefinition using partial equivalence relations (per)\n\\<^cite>\\\"SabelfeldS:01\"\\, partitions the variables (i.e.\\ locations) into\nsecurity levels. Usually, only levels for secret or high, written\n\\H\\, and public or low, written \\L\\, variables are\nused. Basically, a program that is noninterferent has to fulfil one\nbasic property: executing the program in two different initial states\nthat may differ in the values of their \\H\\-variables yields two\nfinal states that again only differ in the values of their \n\\H\\-variables; thus the values of the \\H\\-variables did not\ninfluence those of the \\L\\-variables.\n\nEvery per-based approach makes certain\nassumptions: (i) all \\mbox{\\H\\-variables} are defined at the\nbeginning of the program, (ii) all \\L\\-variables are observed (or\nused in our terms) at the end and (iii) every variable is either\n\\H\\ or \\L\\. This security label is fixed for a variable\nand can not be altered during a program run. Thus, we have to extend \nthe prerequisites of the slicing framework in \\<^cite>\\\"Wasserrab:09\"\\ accordingly\nin a new locale:\n\n\\\n\nlocale NonInterferenceInterGraph =\n SDG sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") \n and Def :: \"'node \\ 'var set\" and Use :: \"'node \\ 'var set\"\n and ParamDefs :: \"'node \\ 'var list\" and ParamUses :: \"'node \\ 'var set list\" +\n fixes H :: \"'var set\"\n fixes L :: \"'var set\"\n fixes High :: \"'node\" (\"'('_High'_')\")\n fixes Low :: \"'node\" (\"'('_Low'_')\")\n assumes Entry_edge_Exit_or_High:\n \"\\valid_edge a; sourcenode a = (_Entry_)\\ \n \\ targetnode a = (_Exit_) \\ targetnode a = (_High_)\"\n and High_target_Entry_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Entry_) \\ targetnode a = (_High_) \\\n kind a = (\\s. True)\\<^sub>\\\"\n and Entry_predecessor_of_High:\n \"\\valid_edge a; targetnode a = (_High_)\\ \\ sourcenode a = (_Entry_)\"\n and Exit_edge_Entry_or_Low: \"\\valid_edge a; targetnode a = (_Exit_)\\ \n \\ sourcenode a = (_Entry_) \\ sourcenode a = (_Low_)\"\n and Low_source_Exit_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Low_) \\ targetnode a = (_Exit_) \\ \n kind a = (\\s. True)\\<^sub>\\\"\n and Exit_successor_of_Low:\n \"\\valid_edge a; sourcenode a = (_Low_)\\ \\ targetnode a = (_Exit_)\"\n and DefHigh: \"Def (_High_) = H\" \n and UseHigh: \"Use (_High_) = H\"\n and UseLow: \"Use (_Low_) = L\"\n and HighLowDistinct: \"H \\ L = {}\"\n and HighLowUNIV: \"H \\ L = UNIV\"\n\nbegin\n\nlemma Low_neq_Exit: assumes \"L \\ {}\" shows \"(_Low_) \\ (_Exit_)\"\nproof\n assume \"(_Low_) = (_Exit_)\"\n have \"Use (_Exit_) = {}\" by fastforce\n with UseLow \\L \\ {}\\ \\(_Low_) = (_Exit_)\\ show False by simp\nqed\n\n\nlemma valid_node_High [simp]:\"valid_node (_High_)\"\n using High_target_Entry_edge by fastforce\n\nlemma valid_node_Low [simp]:\"valid_node (_Low_)\"\n using Low_source_Exit_edge by fastforce\n\n\nlemma get_proc_Low:\n \"get_proc (_Low_) = Main\"\nproof -\n from Low_source_Exit_edge obtain a where \"valid_edge a\"\n and \"sourcenode a = (_Low_)\" and \"targetnode a = (_Exit_)\"\n and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n with \\sourcenode a = (_Low_)\\ \\targetnode a = (_Exit_)\\ get_proc_Exit\n show ?thesis by simp\nqed\n\nlemma get_proc_High:\n \"get_proc (_High_) = Main\"\nproof -\n from High_target_Entry_edge obtain a where \"valid_edge a\"\n and \"sourcenode a = (_Entry_)\" and \"targetnode a = (_High_)\"\n and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n with \\sourcenode a = (_Entry_)\\ \\targetnode a = (_High_)\\ get_proc_Entry\n show ?thesis by simp\nqed\n\n\n\nlemma Entry_path_High_path:\n assumes \"(_Entry_) -as\\* n\" and \"inner_node n\"\n obtains a' as' where \"as = a'#as'\" and \"(_High_) -as'\\* n\" \n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from \\(_Entry_) -as\\* n\\ \\inner_node n\\\n show \"\\a' as'. as = a'#as' \\ (_High_) -as'\\* n \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct n'\\\"(_Entry_)\" as n rule:path.induct)\n case (Cons_path n'' as n' a)\n from \\n'' -as\\* n'\\ \\inner_node n'\\ have \"n'' \\ (_Exit_)\" \n by(fastforce simp:inner_node_def)\n with \\valid_edge a\\ \\sourcenode a = (_Entry_)\\ \\targetnode a = n''\\\n have \"n'' = (_High_)\" by -(drule Entry_edge_Exit_or_High,auto)\n from High_target_Entry_edge\n obtain a' where \"valid_edge a'\" and \"sourcenode a' = (_Entry_)\"\n and \"targetnode a' = (_High_)\" and \"kind a' = (\\s. True)\\<^sub>\\\"\n by blast\n with \\valid_edge a\\ \\sourcenode a = (_Entry_)\\ \\targetnode a = n''\\\n \\n'' = (_High_)\\\n have \"a = a'\" by(auto dest:edge_det)\n with \\n'' -as\\* n'\\ \\n'' = (_High_)\\ \\kind a' = (\\s. True)\\<^sub>\\\\ show ?case by blast\n qed fastforce\nqed\n\n\nlemma Exit_path_Low_path:\n assumes \"n -as\\* (_Exit_)\" and \"inner_node n\"\n obtains a' as' where \"as = as'@[a']\" and \"n -as'\\* (_Low_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from \\n -as\\* (_Exit_)\\\n show \"\\as' a'. as = as'@[a'] \\ n -as'\\* (_Low_) \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct as rule:rev_induct)\n case Nil\n with \\inner_node n\\ show ?case by fastforce\n next\n case (snoc a' as')\n from \\n -as'@[a']\\* (_Exit_)\\\n have \"n -as'\\* sourcenode a'\" and \"valid_edge a'\" and \"targetnode a' = (_Exit_)\"\n by(auto elim:path_split_snoc)\n { assume \"sourcenode a' = (_Entry_)\"\n with \\n -as'\\* sourcenode a'\\ have \"n = (_Entry_)\"\n by(blast intro!:path_Entry_target)\n with \\inner_node n\\ have False by(simp add:inner_node_def) }\n with \\valid_edge a'\\ \\targetnode a' = (_Exit_)\\ have \"sourcenode a' = (_Low_)\"\n by(blast dest!:Exit_edge_Entry_or_Low)\n from Low_source_Exit_edge\n obtain ax where \"valid_edge ax\" and \"sourcenode ax = (_Low_)\"\n and \"targetnode ax = (_Exit_)\" and \"kind ax = (\\s. True)\\<^sub>\\\"\n by blast\n with \\valid_edge a'\\ \\targetnode a' = (_Exit_)\\ \\sourcenode a' = (_Low_)\\\n have \"a' = ax\" by(fastforce intro:edge_det)\n with \\n -as'\\* sourcenode a'\\ \\sourcenode a' = (_Low_)\\ \\kind ax = (\\s. True)\\<^sub>\\\\\n show ?case by blast\n qed\nqed\n\n\nlemma not_Low_High: \"V \\ L \\ V \\ H\"\n using HighLowUNIV\n by fastforce\n\nlemma not_High_Low: \"V \\ H \\ V \\ L\"\n using HighLowUNIV\n by fastforce\n\n\nsubsection \\Low Equivalence\\\n\ntext \\\nIn classical noninterference, an external observer can only see public values,\nin our case the \\L\\-variables. If two states agree in the values of all \n\\L\\-variables, these states are indistinguishable for him. \n\\emph{Low equivalence} groups those states in an equivalence class using \nthe relation \\\\\\<^sub>L\\:\n\\\n\ndefinition lowEquivalence :: \"('var \\ 'val) list \\ ('var \\ 'val) list \\ bool\" \n(infixl \"\\\\<^sub>L\" 50)\n where \"s \\\\<^sub>L s' \\ \\V \\ L. hd s V = hd s' V\"\n\ntext \\The following lemmas connect low equivalent states with\nrelevant variables as necessary in the correctness proof for slicing.\\\n\nlemma relevant_vars_Entry:\n assumes \"V \\ rv S (CFG_node (_Entry_))\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n shows \"V \\ L\"\nproof -\n from \\V \\ rv S (CFG_node (_Entry_))\\ obtain as n' \n where \"(_Entry_) -as\\\\<^sub>\\* parent_node n'\" \n and \"n' \\ HRB_slice S\" and \"V \\ Use\\<^bsub>SDG\\<^esub> n'\"\n and \"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n from \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ have \"valid_node (parent_node n')\"\n by(fastforce intro:path_valid_node simp:intra_path_def)\n thus ?thesis\n proof(cases \"parent_node n'\" rule:valid_node_cases)\n case Entry\n with \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\ have False\n by -(drule SDG_Use_parent_Use,simp add:Entry_empty)\n thus ?thesis by simp\n next\n case Exit\n with \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\ have False\n by -(drule SDG_Use_parent_Use,simp add:Exit_empty)\n thus ?thesis by simp\n next\n case inner\n with \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ obtain a' as' where \"as = a'#as'\"\n and \"(_High_) -as'\\\\<^sub>\\* parent_node n'\"\n by(fastforce elim:Entry_path_High_path simp:intra_path_def)\n from \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ \\as = a'#as'\\\n have \"sourcenode a' = (_Entry_)\" by(fastforce elim:path.cases simp:intra_path_def)\n show ?thesis\n proof(cases \"as' = []\")\n case True\n with \\(_High_) -as'\\\\<^sub>\\* parent_node n'\\ have \"parent_node n' = (_High_)\"\n by(fastforce simp:intra_path_def)\n with \\n' \\ HRB_slice S\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have False \n by(fastforce dest:valid_SDG_node_in_slice_parent_node_in_slice \n simp:SDG_to_CFG_set_def)\n thus ?thesis by simp\n next\n case False\n with \\(_High_) -as'\\\\<^sub>\\* parent_node n'\\ have \"hd (sourcenodes as') = (_High_)\"\n by(fastforce intro:path_sourcenode simp:intra_path_def)\n from False have \"hd (sourcenodes as') \\ set (sourcenodes as')\"\n by(fastforce intro:hd_in_set simp:sourcenodes_def)\n with \\as = a'#as'\\ have \"hd (sourcenodes as') \\ set (sourcenodes as)\"\n by(simp add:sourcenodes_def)\n from \\hd (sourcenodes as') = (_High_)\\\n have \"valid_node (hd (sourcenodes as'))\" by simp\n have \"valid_SDG_node (CFG_node (_High_))\" by simp\n with \\hd (sourcenodes as') = (_High_)\\\n \\hd (sourcenodes as') \\ set (sourcenodes as)\\\n \\\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\\\n have \"V \\ Def (_High_)\"\n by(fastforce dest:CFG_Def_SDG_Def[OF \\valid_node (hd (sourcenodes as'))\\])\n hence \"V \\ H\" by(simp add:DefHigh)\n thus ?thesis by(rule not_High_Low)\n qed\n qed\nqed\n\n\n\nlemma lowEquivalence_relevant_nodes_Entry:\n assumes \"s \\\\<^sub>L s'\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n shows \"\\V \\ rv S (CFG_node (_Entry_)). hd s V = hd s' V\"\nproof\n fix V assume \"V \\ rv S (CFG_node (_Entry_))\"\n with \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ have \"V \\ L\" by -(rule relevant_vars_Entry)\n with \\s \\\\<^sub>L s'\\ show \"hd s V = hd s' V\" by(simp add:lowEquivalence_def)\nqed\n\n\nsubsection \\The Correctness Proofs\\\n\ntext \\\nIn the following, we present two correctness proofs that slicing\nguarantees IFC noninterference. In both theorems, \\CFG_node\n(_High_) \\ HRB_slice S\\, where \\CFG_node (_Low_) \\ S\\, makes\nsure that no high variable (which are all defined in \\(_High_)\\)\ncan influence a low variable (which are all used in \\(_Low_)\\).\n\n\nFirst, a theorem regarding \\(_Entry_) -as\\* (_Exit_)\\ paths in the \ncontrol flow graph (CFG), which agree to a complete program execution:\\\n\n\nlemma slpa_rv_Low_Use_Low:\n assumes \"CFG_node (_Low_) \\ S\"\n shows \"\\same_level_path_aux cs as; upd_cs cs as = []; same_level_path_aux cs as';\n \\c \\ set cs. valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\i < length cs. \\V \\ rv S (CFG_node (sourcenode (cs!i))). \n fst (s!Suc i) V = fst (s'!Suc i) V; \\i < Suc (length cs). snd (s!i) = snd (s'!i);\n \\V \\ rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs); length s' = Suc (length cs)\\\n \\ \\V \\ Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\"\nproof(induct arbitrary:m as' s s' rule:slpa_induct)\n case (slpa_empty cs)\n from \\m -[]\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n from \\m -[]\\* (_Low_)\\ have \"valid_node m\"\n by(rule path_valid_node)+\n { fix V assume \"V \\ Use (_Low_)\"\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ have \"(_Low_) -[]\\\\<^sub>\\* (_Low_)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ \\CFG_node (_Low_) \\ S\\\n have \"CFG_node (_Low_) \\ HRB_slice S\"\n by(fastforce intro:HRB_slice_refl)\n ultimately have \"V \\ rv S (CFG_node m)\" \n using \\m = (_Low_)\\\n by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n hence \"\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\" by simp\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n from \\m -as'\\* (_Low_)\\ \\m = (_Low_)\\ have \"as' = []\"\n proof(induct m as' m'\\\"(_Low_)\" rule:path.induct)\n case (Cons_path m'' as a m)\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\\n have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n with \\targetnode a = m''\\ \\m'' -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?case by simp\n qed simp\n with \\\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\\\n \\\\V \\ rv S (CFG_node m). state_val s V = state_val s' V\\ Nil\n show ?thesis by(auto simp:slice_kinds_def)\n qed\nnext\n case (slpa_intra cs a as)\n note IH = \\\\m as' s s'. \\upd_cs cs as = []; same_level_path_aux cs as'; \n \\a\\set cs. valid_edge a; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V; \n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs); length s' = Suc (length cs)\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\\\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\preds (slice_kinds S (a # as)) s\\\n obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \n obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n by(cases s')(auto simp:slice_kinds_def)\n have \"intra_kind (kind ax)\"\n proof(cases \"kind ax\" rule:edge_kind_cases)\n case (Call Q r p fs)\n have False\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\intra_kind (kind a)\\ have \"slice_kind S a = kind a\"\n by -(rule slice_intra_kind_in_slice)\n from \\valid_edge ax\\ \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have unique:\"\\!a'. valid_edge a' \\ sourcenode a' = sourcenode ax \\ \n intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n from \\valid_edge ax\\ \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain x \n where \"x \\ get_return_edges ax\" by(fastforce dest:get_return_edge_call)\n with \\valid_edge ax\\ obtain a' where \"valid_edge a'\" \n and \"sourcenode a' = sourcenode ax\" and \"kind a' = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n with \\valid_edge a\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n \\intra_kind (kind a)\\ unique\n have \"a' = a\" by(fastforce simp:intra_kind_def)\n with \\kind a' = (\\cf. False)\\<^sub>\\\\ \\slice_kind S a = kind a\\\n \\preds (slice_kinds S (a#as)) s\\\n have False by(cases s)(auto simp:slice_kinds_def)\n thus ?thesis by simp\n next\n case False\n with \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"slice_kind S ax = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce intro:slice_kind_Call)\n with \\as' = ax # asx\\ \\preds (slice_kinds S as') s'\\\n have False by(cases s')(auto simp:slice_kinds_def)\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n next\n case (Return Q p f)\n from \\valid_edge ax\\ \\kind ax = Q\\\\<^bsub>p\\<^esub>f\\ \\valid_edge a\\ \\intra_kind (kind a)\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have False by -(drule return_edges_only,auto simp:intra_kind_def)\n thus ?thesis by simp\n qed simp\n with \\same_level_path_aux cs as'\\ \\as' = ax#asx\\\n have \"same_level_path_aux cs asx\" by(fastforce simp:intra_kind_def)\n show ?thesis\n proof(cases \"targetnode a = targetnode ax\")\n case True\n with \\valid_edge a\\ \\valid_edge ax\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"a = ax\" by(fastforce intro:edge_det)\n with \\valid_edge a\\ \\intra_kind (kind a)\\ \\sourcenode a = m\\\n \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\preds (slice_kinds S (a # as)) s\\\n \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\\n have rv:\"\\V\\rv S (CFG_node (targetnode a)). \n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\"\n by -(rule rv_edge_slice_kinds,auto)\n from \\upd_cs cs (a # as) = []\\ \\intra_kind (kind a)\\\n have \"upd_cs cs as = []\" by(fastforce simp:intra_kind_def)\n from \\targetnode ax -asx\\* (_Low_)\\ \\a = ax\\\n have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n obtain cfx \n where cfx:\"transfer (slice_kind S a) s = cfx#cfs \\ snd cfx = snd cf\"\n apply(cases cf)\n apply(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\") apply auto\n apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n apply(auto simp:intra_kind_def)\n apply(drule slice_kind_Upd) apply auto \n by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n obtain cfx' \n where cfx':\"transfer (slice_kind S a) s' = cfx'#cfs' \\ snd cfx' = snd cf'\"\n apply(cases cf')\n apply(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\") apply auto\n apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n apply(auto simp:intra_kind_def)\n apply(drule slice_kind_Upd) apply auto \n by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n with cfx \\\\i < Suc (length cs). snd (s!i) = snd (s'!i)\\\n have snds:\"\\iiV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (transfer (slice_kind S a) s ! Suc i) V =\n fst (transfer (slice_kind S a) s' ! Suc i) V\"\n by fastforce\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \\a = ax\\\n have \"preds (slice_kinds S asx) (transfer (slice_kind S a) s')\" \n by(simp add:slice_kinds_def)\n moreover\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"length (transfer (slice_kind S a) s) = length s\"\n by(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n with \\length s = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s) = Suc (length cs)\"\n by simp\n moreover\n from \\a = ax\\ \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"length (transfer (slice_kind S a) s') = length s'\"\n by(cases \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n with \\length s' = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s') = Suc (length cs)\"\n by simp\n moreover\n from IH[OF \\upd_cs cs as = []\\ \\same_level_path_aux cs asx\\ \n \\\\c\\set cs. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv calculation]\n \\as' = ax # asx\\ \\a = ax\\\n show ?thesis by(simp add:slice_kinds_def)\n next\n case False\n from \\\\i < Suc(length cs). snd (s!i) = snd (s'!i)\\\n have \"snd (hd s) = snd (hd s')\" by(erule_tac x=\"0\" in allE) fastforce\n with \\valid_edge a\\ \\valid_edge ax\\ \\sourcenode a = m\\\n \\sourcenode ax = m\\ \\as' = ax # asx\\ False\n \\intra_kind (kind a)\\ \\intra_kind (kind ax)\\\n \\preds (slice_kinds S (a # as)) s\\\n \\preds (slice_kinds S as') s'\\\n \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\length s = Suc (length cs)\\ \\length s' = Suc (length cs)\\\n have False by(fastforce intro!:rv_branching_edges_slice_kinds_False[of a ax])\n thus ?thesis by simp\n qed\n qed\n qed\nnext\n case (slpa_Call cs a as Q r p fs)\n note IH = \\\\m as' s s'. \n \\upd_cs (a # cs) as = []; same_level_path_aux (a # cs) as';\n \\c\\set (a # cs). valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode ((a # cs) ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V;\n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length (a # cs)); length s' = Suc (length (a # cs))\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\\\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\\\c\\set cs. valid_edge c\\ \\valid_edge a\\\n have \"\\c\\set (a # cs). valid_edge c\" by simp\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\preds (slice_kinds S (a # as)) s\\\n obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \n obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n by(cases s')(auto simp:slice_kinds_def)\n have \"\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\"\n proof(cases \"kind ax\" rule:edge_kind_cases)\n case Intra\n have False\n proof(cases \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\intra_kind (kind ax)\\ \n have \"slice_kind S ax = kind ax\"\n by -(rule slice_intra_kind_in_slice)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have unique:\"\\!a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain x \n where \"x \\ get_return_edges a\" by(fastforce dest:get_return_edge_call)\n with \\valid_edge a\\ obtain a' where \"valid_edge a'\" \n and \"sourcenode a' = sourcenode a\" and \"kind a' = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n with \\valid_edge ax\\ \\sourcenode ax = m\\ \\sourcenode a = m\\\n \\intra_kind (kind ax)\\ unique\n have \"a' = ax\" by(fastforce simp:intra_kind_def)\n with \\kind a' = (\\cf. False)\\<^sub>\\\\ \n \\slice_kind S ax = kind ax\\ \\as' = ax # asx\\\n \\preds (slice_kinds S as') s'\\\n have False by(simp add:slice_kinds_def)\n thus ?thesis by simp\n next\n case False\n with \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode ax = m\\ \\sourcenode a = m\\\n have \"slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce intro:slice_kind_Call)\n with \\preds (slice_kinds S (a # as)) s\\\n have False by(simp add:slice_kinds_def)\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n next\n case (Return Q' p' f')\n from \\valid_edge ax\\ \\kind ax = Q'\\\\<^bsub>p'\\<^esub>f'\\ \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have False by -(drule return_edges_only,auto)\n thus ?thesis by simp\n qed simp\n have \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n proof(rule ccontr)\n assume \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n from this \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(rule slice_kind_Call)\n with \\preds (slice_kinds S (a # as)) s\\\n show False by(simp add:slice_kinds_def)\n qed\n with \\preds (slice_kinds S (a # as)) s\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"pred (kind a) s\" \n by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by simp\n with \\as' = ax # asx\\ \\preds (slice_kinds S as') s'\\ \n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"pred (kind ax) s'\"\n by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n { fix V assume \"V \\ Use (sourcenode a)\"\n from \\valid_edge a\\ have \"sourcenode a -[]\\\\<^sub>\\* sourcenode a\"\n by(fastforce intro:empty_path simp:intra_path_def)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\valid_edge a\\ \\V \\ Use (sourcenode a)\\\n have \"V \\ rv S (CFG_node (sourcenode a))\"\n by(auto intro!:rvI CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def) }\n with \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\sourcenode a = m\\\n have Use:\"\\V \\ Use (sourcenode a). state_val s V = state_val s' V\" by simp\n from \\\\i\n have \"snd (hd s) = snd (hd s')\" by fastforce\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\valid_edge ax\\\n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n \\pred (kind a) s\\ \\pred (kind ax) s'\\ Use \\length s = Suc (length cs)\\\n \\length s' = Suc (length cs)\\\n have [simp]:\"ax = a\" by(fastforce intro!:CFG_equal_Use_equal_call)\n from \\same_level_path_aux cs as'\\ \\as' = ax#asx\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"same_level_path_aux (a # cs) asx\" by simp\n from \\targetnode ax -asx\\* (_Low_)\\ have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\upd_cs cs (a # as) = []\\ \n have \"upd_cs (a # cs) as = []\" by simp\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have slice_kind:\"slice_kind S a = \n Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(rule slice_kind_Call_in_slice)\n from \\\\i slice_kind\n have snds:\"\\ivalid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain ins outs \n where \"(p,ins,outs) \\ set procs\" by(fastforce dest!:callee_in_procs)\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"length (ParamUses (sourcenode a)) = length ins\"\n by(fastforce intro:ParamUses_call_source_length)\n with \\valid_edge a\\\n have \"\\i < length ins. \\V \\ (ParamUses (sourcenode a))!i. V \\ Use (sourcenode a)\"\n by(fastforce intro:ParamUses_in_Use)\n with \\\\V \\ Use (sourcenode a). state_val s V = state_val s' V\\\n have \"\\i < length ins. \\V \\ (ParamUses (sourcenode a))!i. \n state_val s V = state_val s' V\"\n by fastforce\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\(p,ins,outs) \\ set procs\\\n \\pred (kind a) s\\ \\pred (kind ax) s'\\\n have \"\\i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\"\n by(fastforce intro!:CFG_call_edge_params)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\(p,ins,outs) \\ set procs\\\n have \"length fs = length ins\" by(rule CFG_call_edge_length)\n { fix i assume \"i < length fs\"\n with \\length fs = length ins\\ have \"i < length ins\" by simp\n from \\i < length fs\\ have \"(params fs (fst cf))!i = (fs!i) (fst cf)\"\n by(rule params_nth)\n moreover\n from \\i < length fs\\ have \"(params fs (fst cf'))!i = (fs!i) (fst cf')\"\n by(rule params_nth)\n ultimately have \"(fs!i) (fst (hd s)) = (fs!i) (fst (hd s'))\"\n using \\i < length ins\\\n \\\\i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\\\n by simp }\n hence \"\\i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n { fix i assume \"i < length fs\"\n with \\\\i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')\\\n have \"(fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n have \"((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf) =\n ((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf')\"\n proof(cases \"Formal_in(targetnode a,i + 0) \\ HRB_slice S\")\n case True\n with \\i < length fs\\ \n have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = fs!i\"\n by(rule csppa_Formal_in_in_slice)\n with \\(fs ! i) (fst cf) = (fs ! i) (fst cf')\\ show ?thesis by simp\n next\n case False\n with \\i < length fs\\ \n have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = Map.empty\"\n by(rule csppa_Formal_in_notin_slice)\n thus ?thesis by simp\n qed }\n hence eq:\"\\i < length fs.\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf) =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n by(simp add:cspp_def)\n { fix i assume \"i < length fs\"\n hence \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf))!i =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf)\"\n by(fastforce intro:params_nth)\n moreover\n from \\i < length fs\\\n have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf'))!i =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n by(fastforce intro:params_nth)\n ultimately \n have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf))!i =\n (params (cspp (targetnode a) (HRB_slice S) fs)(fst cf'))!i\"\n using eq \\i < length fs\\ by simp }\n hence \"params (cspp (targetnode a) (HRB_slice S) fs)(fst cf) =\n params (cspp (targetnode a) (HRB_slice S) fs)(fst cf')\"\n by(simp add:list_eq_iff_nth_eq)\n with slice_kind \\(p,ins,outs) \\ set procs\\\n obtain cfx where [simp]:\n \"transfer (slice_kind S a) (cf#cfs) = cfx#cf#cfs\"\n \"transfer (slice_kind S a) (cf'#cfs') = cfx#cf'#cfs'\"\n by auto\n hence rv:\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V = \n state_val (transfer (slice_kind S a) s') V\" by simp\n from rvs \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\ \n \\sourcenode a = m\\\n have rvs':\"\\iV\\rv S (CFG_node (sourcenode ((a # cs) ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by auto(case_tac i,auto)\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as)\n (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx)\n (transfer (slice_kind S a) s')\" by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s) = \n Suc (length (a # cs))\" by simp\n moreover\n from \\length s' = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s') = \n Suc (length (a # cs))\" by simp\n moreover\n from IH[OF \\upd_cs (a # cs) as = []\\ \\same_level_path_aux (a # cs) asx\\\n \\\\c\\set (a # cs). valid_edge c\\ \\targetnode a -as\\* (_Low_)\\\n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n qed\n qed\nnext\n case (slpa_Return cs a as Q p f c' cs')\n note IH = \\\\m as' s s'. \\upd_cs cs' as = []; same_level_path_aux cs' as'; \n \\c\\set cs'. valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V; \n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs'); length s' = Suc (length cs')\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\ \\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\\\c\\set cs. valid_edge c\\ \\cs = c' # cs'\\\n have \"valid_edge c'\" and \"\\c\\set cs'. valid_edge c\" by simp_all\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\valid_edge a\\ \\valid_edge ax\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"\\Q f. kind ax = Q\\\\<^bsub>p\\<^esub>f\" by(auto dest:return_edges_only)\n with \\same_level_path_aux cs as'\\ \\as' = ax#asx\\ \\cs = c' # cs'\\\n have \"ax \\ get_return_edges c'\" and \"same_level_path_aux cs' asx\" by auto\n from \\valid_edge c'\\ \\ax \\ get_return_edges c'\\ \\a \\ get_return_edges c'\\\n have [simp]:\"ax = a\" by(rule get_return_edges_unique)\n from \\targetnode ax -asx\\* (_Low_)\\ have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\upd_cs cs (a # as) = []\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\cs = c' # cs'\\\n \\a \\ get_return_edges c'\\\n have \"upd_cs cs' as = []\" by simp\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\\n obtain cf cfx cfs where \"s = cf#cfx#cfs\"\n by(cases s,auto,case_tac list,fastforce+)\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\\n obtain cf' cfx' cfs' where \"s' = cf'#cfx'#cfs'\"\n by(cases s',auto,case_tac list,fastforce+)\n from rvs \\cs = c' # cs'\\ \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have rvs1:\"\\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((cfx#cfs) ! Suc i) V = fst ((cfx'#cfs') ! Suc i) V\"\n and \"\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\"\n by auto\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n obtain Qx rx px fsx where \"kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\"\n by(fastforce dest!:only_call_get_return_edges)\n have \"\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\"\n proof\n fix V assume \"V \\ rv S (CFG_node (targetnode a))\"\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n obtain a' where edge:\"valid_edge a'\" \"sourcenode a' = sourcenode c'\"\n \"targetnode a' = targetnode a\" \"intra_kind (kind a')\"\n by -(drule call_return_node_edge,auto simp:intra_kind_def)\n from \\V \\ rv S (CFG_node (targetnode a))\\\n obtain as n' where \"targetnode a -as\\\\<^sub>\\* parent_node n'\"\n and \"n' \\ HRB_slice S\" and \"V \\ Use\\<^bsub>SDG\\<^esub> n'\"\n and all:\"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n from \\targetnode a -as\\\\<^sub>\\* parent_node n'\\ edge\n have \"sourcenode c' -a'#as\\\\<^sub>\\* parent_node n'\"\n by(fastforce intro:Cons_path simp:intra_path_def)\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\ have \"Def (sourcenode c') = {}\"\n by(rule call_source_Def_empty)\n hence \"\\n''. valid_SDG_node n'' \\ parent_node n'' = sourcenode c'\n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce dest:SDG_Def_parent_Def)\n with all \\sourcenode a' = sourcenode c'\\\n have \"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes (a'#as)) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce simp:sourcenodes_def)\n with \\sourcenode c' -a'#as\\\\<^sub>\\* parent_node n'\\ \n \\n' \\ HRB_slice S\\ \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\\n show \"V \\ rv S (CFG_node (sourcenode c'))\"\n by(fastforce intro:rvI)\n qed\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n have \"get_proc (targetnode c') = get_proc (sourcenode a)\"\n by -(drule intra_proc_additional_edge,\n auto dest:get_proc_intra simp:intra_kind_def)\n moreover\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\\n have \"get_proc (targetnode c') = px\" by(rule get_proc_call)\n moreover\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have \"get_proc (sourcenode a) = p\" by(rule get_proc_return)\n ultimately have [simp]:\"px = p\" by simp\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\\n obtain ins outs where \"(p,ins,outs) \\ set procs\"\n by(fastforce dest!:callee_in_procs)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have slice_kind:\"slice_kind S a = \n Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp (targetnode a) (HRB_slice S) outs cf' cf)\"\n by(rule slice_kind_Return_in_slice)\n with \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have sx:\"transfer (slice_kind S a) s = \n (rspp (targetnode a) (HRB_slice S) outs (fst cfx) (fst cf),\n snd cfx)#cfs\"\n and sx':\"transfer (slice_kind S a) s' = \n (rspp (targetnode a) (HRB_slice S) outs (fst cfx') (fst cf'),\n snd cfx')#cfs'\"\n by simp_all\n with rvs1 have rvs':\"\\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by fastforce\n from slice_kind \\\\i \\cs = c' # cs'\\\n \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have snds:\"\\iV\\rv S (CFG_node (targetnode a)).\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx) (fst cf)) V =\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx') (fst cf')) V\"\n proof\n fix V assume \"V \\ rv S (CFG_node (targetnode a))\"\n show \"(rspp (targetnode a) (HRB_slice S) outs \n (fst cfx) (fst cf)) V =\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx') (fst cf')) V\"\n proof(cases \"V \\ set (ParamDefs (targetnode a))\")\n case True\n then obtain i where \"i < length (ParamDefs (targetnode a))\"\n and \"(ParamDefs (targetnode a))!i = V\"\n by(fastforce simp:in_set_conv_nth)\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\(p,ins,outs) \\ set procs\\\n have \"length(ParamDefs (targetnode a)) = length outs\"\n by(fastforce intro:ParamDefs_return_target_length)\n show ?thesis\n proof(cases \"Actual_out(targetnode a,i) \\ HRB_slice S\")\n case True\n with \\i < length (ParamDefs (targetnode a))\\ \\valid_edge a\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have rspp_eq:\"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx) (fst cf)) V = \n (fst cf)(outs!i)\"\n \"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx') (fst cf')) V = \n (fst cf')(outs!i)\"\n by(auto intro:rspp_Actual_out_in_slice)\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\(p,ins,outs) \\ set procs\\\n have \"\\V \\ set outs. V \\ Use (sourcenode a)\" by(fastforce dest:outs_in_Use)\n have \"\\V \\ Use (sourcenode a). V \\ rv S (CFG_node m)\"\n proof\n fix V assume \"V \\ Use (sourcenode a)\"\n from \\valid_edge a\\ \\sourcenode a = m\\\n have \"parent_node (CFG_node m) -[]\\\\<^sub>\\* parent_node (CFG_node m)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \n \\V \\ Use (sourcenode a)\\ \\sourcenode a = m\\ \\valid_edge a\\\n show \"V \\ rv S (CFG_node m)\"\n by -(rule rvI,\n auto intro!:CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def)\n qed\n with \\\\V \\ set outs. V \\ Use (sourcenode a)\\\n have \"\\V \\ set outs. V \\ rv S (CFG_node m)\" by simp\n with \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have \"\\V \\ set outs. (fst cf) V = (fst cf') V\" by simp\n with \\i < length (ParamDefs (targetnode a))\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n have \"(fst cf)(outs!i) = (fst cf')(outs!i)\" by fastforce\n with rspp_eq show ?thesis by simp\n next\n case False\n with \\i < length (ParamDefs (targetnode a))\\ \\valid_edge a\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have rspp_eq:\"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx) (fst cf)) V = \n (fst cfx)((ParamDefs (targetnode a))!i)\"\n \"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx') (fst cf')) V = \n (fst cfx')((ParamDefs (targetnode a))!i)\"\n by(auto intro:rspp_Actual_out_notin_slice)\n from \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n \\V \\ rv S (CFG_node (targetnode a))\\\n \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have \"(fst cfx) (ParamDefs (targetnode a) ! i) =\n (fst cfx') (ParamDefs (targetnode a) ! i)\" by fastforce\n with rspp_eq show ?thesis by fastforce\n qed\n next\n case False\n with \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n \\V \\ rv S (CFG_node (targetnode a))\\\n \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n show ?thesis by(fastforce simp:rspp_def map_merge_def)\n qed\n qed\n with sx sx'\n have rv':\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\"\n by fastforce\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\"\n by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx) \n (transfer (slice_kind S a) s')\"\n by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\ sx\n have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n by(simp,simp add:\\s = cf#cfx#cfs\\)\n moreover\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\ sx'\n have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n by(simp,simp add:\\s' = cf'#cfx'#cfs'\\)\n moreover\n from IH[OF \\upd_cs cs' as = []\\ \\same_level_path_aux cs' asx\\ \n \\\\c\\set cs'. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv' calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n next\n case False\n from this \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have slice_kind:\"slice_kind S a = (\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')\"\n by(rule slice_kind_Return)\n with \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have [simp]:\"transfer (slice_kind S a) s = cfx#cfs\"\n \"transfer (slice_kind S a) s' = cfx'#cfs'\" by simp_all\n from slice_kind \\\\i \n \\cs = c' # cs'\\ \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have snds:\"\\iiV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by fastforce\n from \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n have rv':\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\" by simp\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\"\n by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx) \n (transfer (slice_kind S a) s')\"\n by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\\n have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n by(simp,simp add:\\s = cf#cfx#cfs\\)\n moreover\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\\n have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n by(simp,simp add:\\s' = cf'#cfx'#cfs'\\)\n moreover\n from IH[OF \\upd_cs cs' as = []\\ \\same_level_path_aux cs' asx\\ \n \\\\c\\set cs'. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv' calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n qed\n qed\n qed\nqed\n\n\nlemma rv_Low_Use_Low:\n assumes \"m -as\\\\<^sub>\\* (_Low_)\" and \"m -as'\\\\<^sub>\\* (_Low_)\" and \"get_proc m = Main\"\n and \"\\V \\ rv S (CFG_node m). cf V = cf' V\"\n and \"preds (slice_kinds S as) [(cf,undefined)]\"\n and \"preds (slice_kinds S as') [(cf',undefined)]\"\n and \"CFG_node (_Low_) \\ S\"\n shows \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S as) [(cf,undefined)]) V =\n state_val (transfers(slice_kinds S as') [(cf',undefined)]) V\"\nproof(cases as)\n case Nil\n with \\m -as\\\\<^sub>\\* (_Low_)\\ have \"valid_node m\" and \"m = (_Low_)\" \n by(auto intro:path_valid_node simp:vp_def)\n { fix V assume \"V \\ Use (_Low_)\"\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ have \"(_Low_) -[]\\\\<^sub>\\* (_Low_)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ \\CFG_node (_Low_) \\ S\\\n have \"CFG_node (_Low_) \\ HRB_slice S\"\n by(fastforce intro:HRB_slice_refl)\n ultimately have \"V \\ rv S (CFG_node m)\" using \\m = (_Low_)\\\n by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n hence \"\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\" by simp\n show ?thesis\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n from \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"m -as'\\* (_Low_)\" by(simp add:vp_def)\n from \\m -as'\\* (_Low_)\\ \\m = (_Low_)\\ have \"as' = []\"\n proof(induct m as' m'\\\"(_Low_)\" rule:path.induct)\n case (Cons_path m'' as a m)\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\\n have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n with \\targetnode a = m''\\ \\m'' -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?case by simp\n qed simp\n with Nil \\\\V \\ rv S (CFG_node m). cf V = cf' V\\\n \\\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\\\n show ?thesis by(fastforce simp:slice_kinds_def)\n qed\nnext\n case (Cons ax asx)\n with \\m -as\\\\<^sub>\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\"\n by(auto elim:path_split_Cons simp:vp_def)\n show ?thesis\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"m = (_Low_)\" by(fastforce simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = m\\ have \"targetnode ax = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge ax\\ \\sourcenode ax = m\\ \\m = (_Low_)\\ \n \\targetnode ax = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"ax = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind ax = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode ax = (_Exit_)\\ \\targetnode ax -asx\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax' asx')\n from \\m -as\\\\<^sub>\\* (_Low_)\\ have \"valid_path_aux [] as\" and \"m -as\\* (_Low_)\"\n by(simp_all add:vp_def valid_path_def)\n from this \\as = ax#asx\\ \\get_proc m = Main\\\n have \"same_level_path_aux [] as \\ upd_cs [] as = []\"\n by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n hence \"same_level_path_aux [] as\" and \"upd_cs [] as = []\" by simp_all\n from \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"valid_path_aux [] as'\" and \"m -as'\\* (_Low_)\"\n by(simp_all add:vp_def valid_path_def)\n from this \\as' = ax'#asx'\\ \\get_proc m = Main\\\n have \"same_level_path_aux [] as' \\ upd_cs [] as' = []\"\n by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n hence \"same_level_path_aux [] as'\" by simp\n from \\same_level_path_aux [] as\\ \\upd_cs [] as = []\\\n \\same_level_path_aux [] as'\\ \\m -as\\* (_Low_)\\ \\m -as'\\* (_Low_)\\\n \\\\V \\ rv S (CFG_node m). cf V = cf' V\\ \\CFG_node (_Low_) \\ S\\\n \\preds (slice_kinds S as) [(cf,undefined)]\\\n \\preds (slice_kinds S as') [(cf',undefined)]\\\n show ?thesis by -(erule slpa_rv_Low_Use_Low,auto)\n qed\n qed\nqed\n\n\n\nlemma nonInterference_path_to_Low:\n assumes \"[cf] \\\\<^sub>L [cf']\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"(_Entry_) -as\\\\<^sub>\\* (_Low_)\" and \"preds (kinds as) [(cf,undefined)]\"\n and \"(_Entry_) -as'\\\\<^sub>\\* (_Low_)\" and \"preds (kinds as') [(cf',undefined)]\"\n shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n from \\(_Entry_) -as\\\\<^sub>\\* (_Low_)\\ \\preds (kinds as) [(cf,undefined)]\\\n \\CFG_node (_Low_) \\ S\\\n obtain asx where \"preds (slice_kinds S asx) [(cf,undefined)]\"\n and \"\\V \\ Use (_Low_). \n state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n state_val (transfers (kinds as) [(cf,undefined)]) V\"\n and \"slice_edges S [] as = slice_edges S [] asx\"\n and \"transfers (kinds as) [(cf,undefined)] \\ []\"\n and \"(_Entry_) -asx\\\\<^sub>\\* (_Low_)\" \n by(erule fundamental_property_of_static_slicing)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds as') [(cf',undefined)]\\\n \\CFG_node (_Low_) \\ S\\\n obtain asx' where \"preds (slice_kinds S asx') [(cf',undefined)]\"\n and \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n state_val (transfers(kinds as') [(cf',undefined)]) V\"\n and \"slice_edges S [] as' = \n slice_edges S [] asx'\"\n and \"transfers (kinds as') [(cf',undefined)] \\ []\"\n and \"(_Entry_) -asx'\\\\<^sub>\\* (_Low_)\"\n by(erule fundamental_property_of_static_slicing)\n from \\[cf] \\\\<^sub>L [cf']\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"\\V \\ rv S (CFG_node (_Entry_)). cf V = cf' V\" \n by(fastforce dest:lowEquivalence_relevant_nodes_Entry)\n with \\(_Entry_) -asx \\\\<^sub>\\*(_Low_)\\ \\(_Entry_) -asx'\\\\<^sub>\\* (_Low_)\\\n \\CFG_node (_Low_) \\ S\\ \\preds (slice_kinds S asx) [(cf,undefined)]\\\n \\preds (slice_kinds S asx') [(cf',undefined)]\\\n have \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx) [(cf,undefined)]) V =\n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V\"\n by -(rule rv_Low_Use_Low,auto intro:get_proc_Entry)\n with \\\\V \\ Use (_Low_). \n state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n state_val (transfers (kinds as) [(cf,undefined)]) V\\\n \\\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n state_val (transfers(kinds as') [(cf',undefined)]) V\\\n \\transfers (kinds as) [(cf,undefined)] \\ []\\ \n \\transfers (kinds as') [(cf',undefined)] \\ []\\\n show ?thesis by(fastforce simp:lowEquivalence_def UseLow neq_Nil_conv)\nqed\n\n\ntheorem nonInterference_path:\n assumes \"[cf] \\\\<^sub>L [cf']\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"(_Entry_) -as\\\\<^sub>\\* (_Exit_)\" and \"preds (kinds as) [(cf,undefined)]\"\n and \"(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\" and \"preds (kinds as') [(cf',undefined)]\"\n shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n from \\(_Entry_) -as\\\\<^sub>\\* (_Exit_)\\ obtain x xs where \"as = x#xs\"\n and \"(_Entry_) = sourcenode x\" and \"valid_edge x\" \n and \"targetnode x -xs\\* (_Exit_)\"\n apply(cases \"as = []\")\n apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(fastforce elim:path_split_Cons simp:vp_def)\n from \\(_Entry_) -as\\\\<^sub>\\* (_Exit_)\\ have \"valid_path as\" by(simp add:vp_def)\n from \\valid_edge x\\ have \"valid_node (targetnode x)\" by simp\n hence \"inner_node (targetnode x)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with \\valid_edge x\\ have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with \\targetnode x -xs\\* (_Exit_)\\ have \"xs = []\"\n by -(drule path_Exit_source,auto)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from \\valid_edge x\\ \\valid_edge z\\ \\(_Entry_) = sourcenode x\\ \n \\sourcenode z = (_Entry_)\\ Exit \\targetnode z = (_Exit_)\\\n have \"x = z\" by(fastforce intro:edge_det)\n with \\preds (kinds as) [(cf,undefined)]\\ \\as = x#xs\\ \\xs = []\\\n \\kind z = (\\s. False)\\<^sub>\\\\ \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with \\targetnode x -xs\\* (_Exit_)\\ obtain x' xs' where \"xs = xs'@[x']\"\n and \"targetnode x -xs'\\* (_Low_)\" and \"kind x' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with \\(_Entry_) = sourcenode x\\ \\valid_edge x\\\n have \"(_Entry_) -x#xs'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from \\valid_path as\\ \\as = x#xs\\ \\xs = xs'@[x']\\\n have \"valid_path (x#xs')\"\n by(simp add:valid_path_def del:valid_path_aux.simps)\n (rule valid_path_aux_split,simp)\n with \\(_Entry_) -x#xs'\\* (_Low_)\\ have \"(_Entry_) -x#xs'\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def)\n from \\as = x#xs\\ \\xs = xs'@[x']\\ have \"as = (x#xs')@[x']\" by simp\n with \\preds (kinds as) [(cf,undefined)]\\ \n have \"preds (kinds (x#xs')) [(cf,undefined)]\"\n by(simp add:kinds_def preds_split)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\\ obtain y ys where \"as' = y#ys\"\n and \"(_Entry_) = sourcenode y\" and \"valid_edge y\" \n and \"targetnode y -ys\\* (_Exit_)\"\n apply(cases \"as' = []\")\n apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(fastforce elim:path_split_Cons simp:vp_def)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\\ have \"valid_path as'\" by(simp add:vp_def)\n from \\valid_edge y\\ have \"valid_node (targetnode y)\" by simp\n hence \"inner_node (targetnode y)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with \\valid_edge y\\ have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with \\targetnode y -ys\\* (_Exit_)\\ have \"ys = []\"\n by -(drule path_Exit_source,auto)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from \\valid_edge y\\ \\valid_edge z\\ \\(_Entry_) = sourcenode y\\ \n \\sourcenode z = (_Entry_)\\ Exit \\targetnode z = (_Exit_)\\\n have \"y = z\" by(fastforce intro:edge_det)\n with \\preds (kinds as') [(cf',undefined)]\\ \\as' = y#ys\\ \\ys = []\\\n \\kind z = (\\s. False)\\<^sub>\\\\ \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with \\targetnode y -ys\\* (_Exit_)\\ obtain y' ys' where \"ys = ys'@[y']\"\n and \"targetnode y -ys'\\* (_Low_)\" and \"kind y' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with \\(_Entry_) = sourcenode y\\ \\valid_edge y\\\n have \"(_Entry_) -y#ys'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from \\valid_path as'\\ \\as' = y#ys\\ \\ys = ys'@[y']\\\n have \"valid_path (y#ys')\"\n by(simp add:valid_path_def del:valid_path_aux.simps)\n (rule valid_path_aux_split,simp)\n with \\(_Entry_) -y#ys'\\* (_Low_)\\ have \"(_Entry_) -y#ys'\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def)\n from \\as' = y#ys\\ \\ys = ys'@[y']\\ have \"as' = (y#ys')@[y']\" by simp\n with \\preds (kinds as') [(cf',undefined)]\\ \n have \"preds (kinds (y#ys')) [(cf',undefined)]\"\n by(simp add:kinds_def preds_split)\n from \\[cf] \\\\<^sub>L [cf']\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\CFG_node (_Low_) \\ S\\\n \\(_Entry_) -x#xs'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds (x#xs')) [(cf,undefined)]\\\n \\(_Entry_) -y#ys'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds (y#ys')) [(cf',undefined)]\\\n have \"map fst (transfers (kinds (x#xs')) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds (y#ys')) [(cf',undefined)])\"\n by(rule nonInterference_path_to_Low)\n with \\as = x#xs\\ \\xs = xs'@[x']\\ \\kind x' = (\\s. True)\\<^sub>\\\\\n \\as' = y#ys\\ \\ys = ys'@[y']\\ \\kind y' = (\\s. True)\\<^sub>\\\\\n show ?thesis\n apply(cases \"transfers (map kind xs') (transfer (kind x) [(cf,undefined)])\")\n apply (auto simp add:kinds_def transfers_split)\n by((cases \"transfers (map kind ys') (transfer (kind y) [(cf',undefined)])\"),\n (auto simp add:kinds_def transfers_split))+\nqed\n\n\nend\n\ntext \\The second theorem assumes that we have a operational semantics,\nwhose evaluations are written \\\\c,s\\ \\ \\c',s'\\\\ and which conforms \nto the CFG. The correctness theorem then states that if no high variable\ninfluenced a low variable and the initial states were low equivalent, the\nreulting states are again low equivalent:\\\n\n\nlocale NonInterferenceInter = \n NonInterferenceInterGraph sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n H L High Low +\n SemanticsProperty sourcenode targetnode kind valid_edge Entry get_proc\n get_return_edges procs Main Exit Def Use ParamDefs ParamUses sem identifies\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") \n and Def :: \"'node \\ 'var set\" and Use :: \"'node \\ 'var set\"\n and ParamDefs :: \"'node \\ 'var list\" and ParamUses :: \"'node \\ 'var set list\"\n and sem :: \"'com \\ ('var \\ 'val) list \\ 'com \\ ('var \\ 'val) list \\ bool\" \n (\"((1\\_,/_\\) \\/ (1\\_,/_\\))\" [0,0,0,0] 81)\n and identifies :: \"'node \\ 'com \\ bool\" (\"_ \\ _\" [51,0] 80)\n and H :: \"'var set\" and L :: \"'var set\" \n and High :: \"'node\" (\"'('_High'_')\") and Low :: \"'node\" (\"'('_Low'_')\") +\n fixes final :: \"'com \\ bool\"\n assumes final_edge_Low: \"\\final c; n \\ c\\ \n \\ \\a. valid_edge a \\ sourcenode a = n \\ targetnode a = (_Low_) \\ kind a = \\id\"\nbegin\n\n\ntext\\The following theorem needs the explicit edge from \\(_High_)\\\n to \\n\\. An approach using a \\init\\ predicate for initial statements,\n being reachable from \\(_High_)\\ via a \\(\\s. True)\\<^sub>\\\\ edge,\n does not work as the same statement could be identified by several nodes, some\n initial, some not. E.g., in the program \\texttt{while (True) Skip;;Skip}\n two nodes identify this inital statement: the initial node and the node\n within the loop (because of loop unrolling).\\\n\ntheorem nonInterference:\n assumes \"[cf\\<^sub>1] \\\\<^sub>L [cf\\<^sub>2]\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"valid_edge a\" and \"sourcenode a = (_High_)\" and \"targetnode a = n\" \n and \"kind a = (\\s. True)\\<^sub>\\\" and \"n \\ c\" and \"final c'\"\n and \"\\c,[cf\\<^sub>1]\\ \\ \\c',s\\<^sub>1\\\" and \"\\c,[cf\\<^sub>2]\\ \\ \\c',s\\<^sub>2\\\"\n shows \"s\\<^sub>1 \\\\<^sub>L s\\<^sub>2\"\nproof -\n from High_target_Entry_edge obtain ax where \"valid_edge ax\"\n and \"sourcenode ax = (_Entry_)\" and \"targetnode ax = (_High_)\"\n and \"kind ax = (\\s. True)\\<^sub>\\\" by blast\n from \\n \\ c\\ \\\\c,[cf\\<^sub>1]\\ \\ \\c',s\\<^sub>1\\\\\n obtain n\\<^sub>1 as\\<^sub>1 cfs\\<^sub>1 where \"n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\" and \"n\\<^sub>1 \\ c'\"\n and \"preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]\" \n and \"transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1\" and \"map fst cfs\\<^sub>1 = s\\<^sub>1\"\n by(fastforce dest:fundamental_property)\n from \\n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ \\valid_edge a\\ \\sourcenode a = (_High_)\\ \\targetnode a = n\\\n \\kind a = (\\s. True)\\<^sub>\\\\\n have \"(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n from \\final c'\\ \\n\\<^sub>1 \\ c'\\\n obtain a\\<^sub>1 where \"valid_edge a\\<^sub>1\" and \"sourcenode a\\<^sub>1 = n\\<^sub>1\" \n and \"targetnode a\\<^sub>1 = (_Low_)\" and \"kind a\\<^sub>1 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>1 -[a\\<^sub>1]\\* (_Low_)\" by(fastforce intro:path_edge)\n with \\(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"(_High_) -(a#as\\<^sub>1)@[a\\<^sub>1]\\* (_Low_)\"\n by(fastforce intro!:path_Append simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = (_Entry_)\\ \\targetnode ax = (_High_)\\\n have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\* (_Low_)\" by -(rule Cons_path)\n moreover\n from \\(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"valid_path_aux [] (a#as\\<^sub>1)\"\n by(simp add:vp_def valid_path_def)\n with \\kind a\\<^sub>1 = \\id\\ have \"valid_path_aux [] ((a#as\\<^sub>1)@[a\\<^sub>1])\"\n by(fastforce intro:valid_path_aux_Append)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ have \"valid_path_aux [] (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))\"\n by simp\n ultimately have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def valid_path_def)\n from \\valid_edge a\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\sourcenode a = (_High_)\\\n \\targetnode a = n\\\n have \"get_proc n = get_proc (_High_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_High have \"get_proc n = Main\" by simp\n from \\valid_edge a\\<^sub>1\\ \\sourcenode a\\<^sub>1 = n\\<^sub>1\\ \\targetnode a\\<^sub>1 = (_Low_)\\ \\kind a\\<^sub>1 = \\id\\\n have \"get_proc n\\<^sub>1 = get_proc (_Low_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_Low have \"get_proc n\\<^sub>1 = Main\" by simp\n from \\n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"n -as\\<^sub>1\\\\<^bsub>sl\\<^esub>* n\\<^sub>1\"\n by(cases as\\<^sub>1)\n (auto dest!:vpa_Main_slpa intro:\\get_proc n\\<^sub>1 = Main\\ \\get_proc n = Main\\\n simp:vp_def valid_path_def valid_call_list_def slp_def \n same_level_path_def simp del:valid_path_aux.simps)\n then obtain cfx r where cfx:\"transfers (map kind as\\<^sub>1) [(cf\\<^sub>1,undefined)] = [(cfx,r)]\"\n by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n from \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \n \\preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]\\ \\kind a\\<^sub>1 = \\id\\ cfx \n have \"preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]\"\n by(auto simp:kinds_def preds_split)\n from \\n \\ c\\ \\\\c,[cf\\<^sub>2]\\ \\ \\c',s\\<^sub>2\\\\\n obtain n\\<^sub>2 as\\<^sub>2 cfs\\<^sub>2 where \"n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\" and \"n\\<^sub>2 \\ c'\"\n and \"preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]\" \n and \"transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2\" and \"map fst cfs\\<^sub>2 = s\\<^sub>2\"\n by(fastforce dest:fundamental_property)\n from \\n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ \\valid_edge a\\ \\sourcenode a = (_High_)\\ \\targetnode a = n\\\n \\kind a = (\\s. True)\\<^sub>\\\\\n have \"(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n from \\final c'\\ \\n\\<^sub>2 \\ c'\\\n obtain a\\<^sub>2 where \"valid_edge a\\<^sub>2\" and \"sourcenode a\\<^sub>2 = n\\<^sub>2\" \n and \"targetnode a\\<^sub>2 = (_Low_)\" and \"kind a\\<^sub>2 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>2 -[a\\<^sub>2]\\* (_Low_)\" by(fastforce intro:path_edge)\n with \\(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"(_High_) -(a#as\\<^sub>2)@[a\\<^sub>2]\\* (_Low_)\"\n by(fastforce intro!:path_Append simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = (_Entry_)\\ \\targetnode ax = (_High_)\\\n have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\* (_Low_)\" by -(rule Cons_path)\n moreover\n from \\(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"valid_path_aux [] (a#as\\<^sub>2)\"\n by(simp add:vp_def valid_path_def)\n with \\kind a\\<^sub>2 = \\id\\ have \"valid_path_aux [] ((a#as\\<^sub>2)@[a\\<^sub>2])\"\n by(fastforce intro:valid_path_aux_Append)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ have \"valid_path_aux [] (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))\"\n by simp\n ultimately have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def valid_path_def)\n from \\valid_edge a\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\sourcenode a = (_High_)\\\n \\targetnode a = n\\\n have \"get_proc n = get_proc (_High_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_High have \"get_proc n = Main\" by simp\n from \\valid_edge a\\<^sub>2\\ \\sourcenode a\\<^sub>2 = n\\<^sub>2\\ \\targetnode a\\<^sub>2 = (_Low_)\\ \\kind a\\<^sub>2 = \\id\\\n have \"get_proc n\\<^sub>2 = get_proc (_Low_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_Low have \"get_proc n\\<^sub>2 = Main\" by simp\n from \\n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"n -as\\<^sub>2\\\\<^bsub>sl\\<^esub>* n\\<^sub>2\"\n by(cases as\\<^sub>2)\n (auto dest!:vpa_Main_slpa intro:\\get_proc n\\<^sub>2 = Main\\ \\get_proc n = Main\\\n simp:vp_def valid_path_def valid_call_list_def slp_def \n same_level_path_def simp del:valid_path_aux.simps)\n then obtain cfx' r' \n where cfx':\"transfers (map kind as\\<^sub>2) [(cf\\<^sub>2,undefined)] = [(cfx',r')]\"\n by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n from \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \n \\preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]\\ \\kind a\\<^sub>2 = \\id\\ cfx' \n have \"preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]\"\n by(auto simp:kinds_def preds_split)\n from \\[cf\\<^sub>1] \\\\<^sub>L [cf\\<^sub>2]\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\CFG_node (_Low_) \\ S\\\n \\(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\\\<^sub>\\* (_Low_)\\ \n \\preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]\\\n \\(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\\\<^sub>\\* (_Low_)\\ \n \\preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]\\\n have \"map fst (transfers (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)])\"\n by(rule nonInterference_path_to_Low)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\kind a\\<^sub>1 = \\id\\ \\kind a\\<^sub>2 = \\id\\\n \\transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1\\ \\map fst cfs\\<^sub>1 = s\\<^sub>1\\\n \\transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2\\ \\map fst cfs\\<^sub>2 = s\\<^sub>2\\\n show ?thesis by(cases s\\<^sub>1)(cases s\\<^sub>2,(fastforce simp:kinds_def transfers_split)+)+\nqed\n\n\nend\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/InformationFlowSlicing_Inter/NonInterferenceInter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.198468367499571}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__31_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__31_on_rules imports n_german_lemma_on_inv__31\nbegin\nsection{*All lemmas on causal relation between inv__31*}\nlemma lemma_inv__31_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__31) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__31_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.36296920551961687, "lm_q1q2_score": 0.19844911801452156}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_on_inis imports n_g2kAbsAfter_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(f=inv__1 )\\\n (f=inv__2 )\\\n (f=inv__3 )\\\n (f=inv__4 )\\\n (f=inv__5 )\\\n (f=inv__6 )\\\n (f=inv__7 )\\\n (f=inv__8 )\\\n (f=inv__9 )\\\n (f=inv__10 )\\\n (f=inv__11 )\\\n (f=inv__12 )\\\n (f=inv__13 )\\\n (f=inv__14 )\\\n (f=inv__15 )\\\n (f=inv__16 )\\\n (f=inv__17 )\\\n (f=inv__18 )\\\n (f=inv__19 )\\\n (f=inv__20 )\\\n (f=inv__21 )\\\n (f=inv__22 )\\\n (f=inv__23 )\\\n (f=inv__24 )\\\n (f=inv__25 )\\\n (f=inv__26 )\\\n (f=inv__27 )\\\n (f=inv__28 )\\\n (f=inv__29 )\\\n (f=inv__30 )\\\n (f=inv__31 )\\\n (f=inv__32 )\\\n (f=inv__33 )\\\n (f=inv__34 )\\\n (f=inv__35 )\\\n (f=inv__36 )\\\n (f=inv__37 )\\\n (f=inv__38 )\\\n (f=inv__39 )\\\n (f=inv__40 )\\\n (f=inv__41 )\\\n (f=inv__42 )\\\n (f=inv__43 )\\\n (f=inv__44 )\\\n (f=inv__45 )\\\n (f=inv__46 )\\\n (f=inv__47 )\\\n (f=inv__48 )\\\n (f=inv__49 )\\\n (f=inv__50 )\\\n (f=inv__51 )\\\n (f=inv__52 )\\\n (f=inv__53 )\\\n (f=inv__54 )\\\n (f=inv__55 )\\\n (f=inv__56 )\\\n (f=inv__57 )\\\n (f=inv__58 )\\\n (f=inv__59 )\\\n (f=inv__60 )\\\n (f=inv__61 )\\\n (f=inv__62 )\\\n (f=inv__63 )\\\n (f=inv__64 )\\\n (f=inv__65 )\\\n (f=inv__66 )\\\n (f=inv__67 )\\\n (f=inv__68 )\\\n (f=inv__69 )\\\n (f=inv__70 )\\\n (f=inv__71 )\\\n (f=inv__72 )\\\n (f=inv__73 )\\\n (f=inv__74 )\\\n (f=inv__75 )\\\n (f=inv__76 )\\\n (f=inv__77 )\\\n (f=inv__78 )\\\n (f=inv__79 )\\\n (f=inv__80 )\\\n (f=inv__81 )\\\n (f=inv__82 )\\\n (f=inv__83 )\\\n (f=inv__84 )\\\n (f=inv__85 )\\\n (f=inv__86 )\\\n (f=inv__87 )\\\n (f=inv__88 )\\\n (f=inv__89 )\\\n (f=inv__90 )\\\n (f=inv__91 )\\\n (f=inv__92 )\\\n (f=inv__93 )\\\n (f=inv__94 )\\\n (f=inv__95 )\\\n (f=inv__96 )\\\n (f=inv__97 )\\\n (f=inv__98 )\\\n (f=inv__99 )\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(f=inv__1 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__2 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__3 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__4 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__5 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__6 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__7 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__8 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__9 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__10 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__11 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__12 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__13 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__14 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__15 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__16 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__17 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__18 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__19 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__20 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__21 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__22 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__23 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__24 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__25 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__26 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__27 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__28 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__29 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__30 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__31 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__32 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__33 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__34 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__35 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__36 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__37 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__38 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__39 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__40 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__41 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__42 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__43 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__44 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__45 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__46 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__47 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__48 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__49 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__50 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__51 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__52 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__53 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__53)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__54 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__54)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__55 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__55)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__56 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__56)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__57 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__57)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__58 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__58)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__59 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__59)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__60 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__60)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__61 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__61)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__62 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__62)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__63 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__63)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__64 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__64)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__65 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__65)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__66 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__66)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__67 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__67)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__68 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__68)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__69 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__69)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__70 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__70)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__71 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__71)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__72 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__72)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__73 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__73)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__74 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__74)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__75 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__75)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__76 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__76)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__77 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__77)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__78 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__78)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__79 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__79)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__80 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__80)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__81 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__81)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__82 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__82)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__83 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__83)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__84 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__84)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__85 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__85)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__86 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__86)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__87 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__87)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__88 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__88)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__89 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__89)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__90 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__90)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__91 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__91)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__92 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__92)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__93 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__93)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__94 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__94)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__95 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__95)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__96 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__96)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__97 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__97)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__98 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__98)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__99 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__99)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.32423541204073586, "lm_q1q2_score": 0.19823168602530722}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory VSpaceEntries_AI\nimports ArchSyscall_AI\nbegin\n\ndefinition valid_entries :: \" ('b \\ ('a::len) word \\ 'c set) \\ (('a::len) word \\ 'b) \\ bool\"\n where \"valid_entries \\ \\range fun. \\x y. x \\ y \\ range (fun x) x \\ range (fun y) y = {}\"\n\ndefinition entries_align :: \"('b \\ nat ) \\ (('a::len) word \\ 'b) \\ bool\"\n where \"entries_align \\ \\sz fun. \\x. is_aligned x (sz (fun x))\"\n\nlemma valid_entries_overwrite_0:\n assumes ve: \"valid_entries rg tab\"\n assumes disjoint: \"\\p. \\p \\ x\\ \\ rg v x \\ rg (tab p) p = {}\"\n shows \"valid_entries rg (tab (x := v))\"\n apply (subst valid_entries_def)\n apply clarsimp\n apply (intro allI impI conjI)\n apply clarsimp\n apply (rule disjoint)\n apply simp\n apply clarsimp\n apply (drule disjoint)\n apply blast\n using ve\n apply (clarsimp simp:valid_entries_def)\n done\n\nlemma vaid_entries_overwrite_0_weak:\n assumes ve: \"valid_entries rg tab\"\n assumes disjoint: \"rg v x \\ rg (tab x) x\"\n shows \"valid_entries rg (tab (x := v))\"\n using assms\n apply (subst valid_entries_def)\n apply clarsimp\n apply (intro allI impI conjI)\n apply (fastforce simp:valid_entries_def)+\n done\n\nlemma valid_entries_partial_copy:\n \"\\ valid_entries rg tab; valid_entries rg tab';\n \\v x. P x \\ (rg v x \\ S);\n \\v x. \\ P x \\ (rg v x \\ S) = {}\\\n \\ valid_entries rg (\\x. if P x then tab x else tab' x)\"\n apply (subst valid_entries_def, simp)\n apply (intro allI impI conjI)\n apply (fastforce simp:valid_entries_def)\n apply (drule_tac x = \"tab x\" in spec)\n apply (drule_tac x = x in spec)\n apply (drule_tac x = \"tab' y\" in spec)\n apply (drule_tac x = y in spec)\n apply clarsimp\n apply blast\n apply (fastforce simp:valid_entries_def)+\n done\n\nlemma valid_entries_overwrite_groups:\n \"\\valid_entries rg tab; valid_entries rg (\\_. v);\n \\v x. P x \\ rg v x \\ S;\n \\v x. \\ P x \\ rg v x \\ S = {}\\\n \\ valid_entries rg (\\x. if P x then v else tab x)\"\n by (rule valid_entries_partial_copy)\n\nlemmas valid_entries_overwrite_group\n = valid_entries_overwrite_groups[where S=\"{y}\" for y, simplified]\n\nlemma valid_entriesD:\n \"\\x \\ y; valid_entries rg fun\\ \\ rg (fun x) x \\ rg (fun y) y = {}\"\n by (simp add:valid_entries_def)\n\nlemma aligned_le_sharp:\n \"\\a \\ b;is_aligned a n\\ \\ a \\ b &&~~ mask n\"\n apply (simp add:is_aligned_mask)\n apply (drule neg_mask_mono_le[where n = n])\n apply (simp add:mask_out_sub_mask)\n done\n\nlemma ucast_neg_mask:\n \"len_of TYPE('a) \\ len_of TYPE ('b)\n \\ ((ucast ptr && ~~ mask n)::('a :: len) word) = ucast ((ptr::('b :: len) word) && ~~ mask n)\"\n apply (rule word_eqI)\n apply (auto simp:nth_ucast neg_mask_test_bit word_size)\n done\n\nlemma delete_objects_reduct:\n \"valid (\\s. P (kheap (s :: ('z::state_ext) state))) (modify (detype {ptr..ptr + 2 ^ bits - 1}))\n (\\_ s. P(kheap (s :: ('z::state_ext) state))) \\\n valid (\\s. P (kheap (s :: ('z::state_ext) state))) (delete_objects ptr bits) (\\_ s. P (kheap s))\"\n apply (clarsimp simp add: delete_objects_def do_machine_op_def split_def)\n apply wp\n apply (clarsimp simp add: valid_def simpler_modify_def)\n done\n\n(* FIXME: move *)\nlemma upto_0_to_n:\n \"0 < n \\ tl [0.. [0..v. ko_at (f v) p s \\ P v) \\ inj f) \\ (\\v. ko_at (f v) p s \\ P v)\"\n apply (clarsimp simp add: obj_at_def)\n apply (auto dest: inj_onD)\n done\n\nlemma set_cap_arch_obj_neg:\n \"\\\\s. \\ko_at (ArchObj ao) p s \\ cte_wp_at (\\_. True) p' s\\ set_cap cap p' \\\\_ s. \\ko_at (ArchObj ao) p s\\\"\n apply (simp add: set_cap_def split_def)\n apply (wp set_object_neg_ko get_object_wp| wpc)+\n apply (auto simp: pred_neg_def)\n done\n\nlemma mapME_x_Nil:\n \"mapME_x f [] = returnOk ()\"\n unfolding mapME_x_def sequenceE_x_def\n by simp\n\nlemma mapME_x_mapME:\n \"mapME_x m l = (mapME m l >>=E (%_. returnOk ()))\"\n apply (simp add: mapME_x_def sequenceE_x_def mapME_def sequenceE_def)\n apply (induct l, simp_all add: Let_def bindE_assoc)\n done\n\nlemma mapME_x_wp:\n assumes x: \"\\x. x \\ S \\ \\P\\ f x \\\\rv. P\\, \\E\\\"\n shows \"set xs \\ S \\ \\P\\ mapME_x f xs \\\\rv. P\\, \\E\\\"\n apply (subst mapME_x_mapME)\n apply wp\n apply (rule mapME_wp)\n apply (rule x)\n apply assumption+\n done\n\nlemmas mapME_x_wp' = mapME_x_wp [OF _ subset_refl]\n\nlemma hoare_vcg_all_liftE:\n \"\\ \\x. \\P x\\ f \\Q x\\,\\E\\ \\ \\ \\\\s. \\x. P x s\\ f \\\\rv s. \\x. Q x rv s\\,\\E\\\"\n by (fastforce simp: validE_def valid_def split: sum.splits)\n\nlemma hoare_vcg_const_Ball_liftE:\n \"\\ \\x. x \\ S \\ \\P x\\ f \\Q x\\,\\E\\; \\\\s. True\\ f \\\\r s. True\\, \\E\\ \\ \\ \\\\s. \\x\\S. P x s\\ f \\\\rv s. \\x\\S. Q x rv s\\,\\E\\\"\n by (fastforce simp: validE_def valid_def split: sum.splits)\n\nlemmas hoare_post_conjE = hoare_validE_pred_conj (* FIXME: eliminate *)\n\nlemma hoare_vcg_conj_liftE: (* FIXME: move *)\n assumes x: \"\\P\\ f \\Q\\,\\E\\\"\n assumes y: \"\\P'\\ f \\Q'\\,\\E\\\"\n shows \"\\\\s. P s \\ P' s\\ f \\\\rv s. Q rv s \\ Q' rv s\\,\\E\\\"\n apply (subst pred_conj_def[symmetric], subst pred_conj_def[symmetric], rule hoare_post_conjE)\n apply (rule hoare_vcg_precond_impE [OF x], simp)\n apply (rule hoare_vcg_precond_impE [OF y], simp)\n done\n\nlemma mapME_x_accumulate_checks:\n assumes P: \"\\x. x \\ set xs \\ \\Q\\ f x \\\\rv. P x\\, \\E\\\"\n and Q : \"\\x. x \\ set xs \\ \\Q\\ f x \\\\rv. Q\\, \\E\\\"\n and P': \"\\x y. y \\ x \\ \\P y\\ f x \\\\rv. P y\\, \\E\\\"\n and distinct: \"distinct xs\"\n shows \"\\Q \\ mapME_x f xs \\\\rv s. \\x \\ set xs. P x s\\, \\E\\\"\n using assms\n proof (induct xs)\n case Nil\n show ?case\n by (simp add: mapME_x_Nil, wp)\n next\n case (Cons y ys)\n show ?case\n apply (simp add: mapME_x_Cons)\n apply wp\n apply (rule hoare_vcg_conj_liftE)\n apply (wp mapME_x_wp' P P'\n hoare_vcg_const_Ball_liftE\n | simp add:Q\n | rule hoare_post_impErr[OF P])+\n using Cons.prems\n apply fastforce\n apply (wp Cons.hyps)\n apply (rule Cons.prems,simp)\n apply (wp Cons.prems(2);simp)\n apply (wp Cons.prems(3);simp)\n using Cons.prems\n apply fastforce\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_liftE)\n apply (wp Cons.prems| simp)+\n done\n qed\n\nlemma hoare_vcg_ex_liftE:\n \"\\ \\x. \\P x\\ f \\Q x\\,\\E\\ \\ \\ \\\\s. \\x. P x s\\ f \\\\rv s. \\x. Q x rv s\\,\\E\\\"\n by (fastforce simp: validE_def valid_def split: sum.splits)\n\nlemma mapME_singleton:\n \"mapME_x f [x] = f x\"\n by (simp add:mapME_x_def sequenceE_x_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/VSpaceEntries_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.3702253925955866, "lm_q1q2_score": 0.198107020325965}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__52_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__52_on_rules imports n_germanSimp_lemma_on_inv__52\nbegin\nsection{*All lemmas on causal relation between inv__52*}\nlemma lemma_inv__52_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__52) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__52_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3812195732862558, "lm_q1q2_score": 0.1980516966676884}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__23_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__23_on_rules imports n_germanSimp_lemma_on_inv__23\nbegin\nsection{*All lemmas on causal relation between inv__23*}\nlemma lemma_inv__23_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__23) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__23_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.19805169301539852}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__47_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__47_on_rules imports n_germanSimp_lemma_on_inv__47\nbegin\nsection{*All lemmas on causal relation between inv__47*}\nlemma lemma_inv__47_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__47 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__47) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__47_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.1980516930153985}} {"text": "(* Title: JinjaThreads/Framework/FWBisimulation.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Bisimulation relations for the multithreaded semantics\\\n\ntheory FWBisimulation\nimports\n FWLTS\n Bisimulation\nbegin\n\nsubsection \\Definitions for lifting bisimulation relations\\\n\nprimrec nta_bisim :: \"('t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim) \\ (('t,'x1,'m1) new_thread_action, ('t,'x2,'m2) new_thread_action) bisim\"\n where\n [code del]: \"nta_bisim bisim (NewThread t x m) ta = (\\x' m'. ta = NewThread t x' m' \\ bisim t (x, m) (x', m'))\"\n| \"nta_bisim bisim (ThreadExists t b) ta = (ta = ThreadExists t b)\"\n\nlemma nta_bisim_1_code [code]:\n \"nta_bisim bisim (NewThread t x m) ta = (case ta of NewThread t' x' m' \\ t = t' \\ bisim t (x, m) (x', m') | _ \\ False)\"\nby(auto split: new_thread_action.split)\n \nlemma nta_bisim_simps_sym [simp]:\n \"nta_bisim bisim ta (NewThread t x m) = (\\x' m'. ta = NewThread t x' m' \\ bisim t (x', m') (x, m))\"\n \"nta_bisim bisim ta (ThreadExists t b) = (ta = ThreadExists t b)\"\nby(cases ta, auto)+\n\ndefinition ta_bisim :: \"('t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim) \\ (('l,'t,'x1,'m1,'w,'o) thread_action, ('l,'t,'x2,'m2,'w,'o) thread_action) bisim\"\nwhere\n \"ta_bisim bisim ta1 ta2 \\\n \\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub> \\ \\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub> \\ \\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub> \\ \\ ta1 \\\\<^bsub>o\\<^esub> = \\ ta2 \\\\<^bsub>o\\<^esub> \\ \\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub> \\\n list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\"\n\nlemma ta_bisim_empty [iff]: \"ta_bisim bisim \\ \\\"\nby(auto simp add: ta_bisim_def)\n\n\n\nlemma nta_bisim_mono:\n assumes major: \"nta_bisim bisim ta ta'\"\n and mono: \"\\t s1 s2. bisim t s1 s2 \\ bisim' t s1 s2\"\n shows \"nta_bisim bisim' ta ta'\"\nusing major by(cases ta)(auto intro: mono)\n\nlemma ta_bisim_mono:\n assumes major: \"ta_bisim bisim ta1 ta2\"\n and mono: \"\\t s1 s2. bisim t s1 s2 \\ bisim' t s1 s2\"\n shows \"ta_bisim bisim' ta1 ta2\"\nusing major\nby(auto simp add: ta_bisim_def elim!: List.list_all2_mono nta_bisim_mono intro: mono)\n\nlemma nta_bisim_flip [flip_simps]:\n \"nta_bisim (\\t. flip (bisim t)) = flip (nta_bisim bisim)\"\nby(rule ext)(case_tac x, auto simp add: flip_simps)\n\nlemma ta_bisim_flip [flip_simps]:\n \"ta_bisim (\\t. flip (bisim t)) = flip (ta_bisim bisim)\"\nby(auto simp add: fun_eq_iff flip_simps ta_bisim_def)\n\nlocale FWbisimulation_base =\n r1: multithreaded_base final1 r1 convert_RA +\n r2: multithreaded_base final2 r2 convert_RA \n for final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w,'o) semantics\" (\"_ \\ _ -1-_\\ _\" [50, 0, 0, 50] 80)\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50, 0, 0, 50] 80) \n and convert_RA :: \"'l released_locks \\ 'o list\"\n +\n fixes bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60)\n and bisim_wait :: \"('x1, 'x2) bisim\" (\"_/ \\w _\" [50, 50] 60)\nbegin\n\nnotation r1.redT_syntax1 (\"_ -1-_\\_\\ _\" [50,0,0,50] 80)\nnotation r2.redT_syntax1 (\"_ -2-_\\_\\ _\" [50,0,0,50] 80)\n\nnotation r1.RedT (\"_ -1-\\_\\* _\" [50,0,50] 80)\nnotation r2.RedT (\"_ -2-\\_\\* _\" [50,0,50] 80)\n\nnotation r1.must_sync (\"_ \\ \\_,/ _\\/ \\1\" [50,0,0] 81)\nnotation r2.must_sync (\"_ \\ \\_,/ _\\/ \\2\" [50,0,0] 81)\n\nnotation r1.can_sync (\"_ \\ \\_,/ _\\/ _/ \\1\" [50,0,0,0] 81)\nnotation r2.can_sync (\"_ \\ \\_,/ _\\/ _/ \\2\" [50,0,0,0] 81)\n\nabbreviation ta_bisim_bisim_syntax (\"_/ \\m _\" [50, 50] 60)\nwhere \"ta1 \\m ta2 \\ ta_bisim bisim ta1 ta2\"\n\ndefinition tbisim :: \"bool \\ 't \\ ('x1 \\ 'l released_locks) option \\ 'm1 \\ ('x2 \\ 'l released_locks) option \\ 'm2 \\ bool\" where\n \"\\ln. tbisim nw t ts1 m1 ts2 m2 \\\n (case ts1 of None \\ ts2 = None\n | \\(x1, ln)\\ \\ (\\x2. ts2 = \\(x2, ln)\\ \\ t \\ (x1, m1) \\ (x2, m2) \\ (nw \\ x1 \\w x2)))\"\n\nlemma tbisim_NoneI: \"tbisim w t None m None m'\"\nby(simp add: tbisim_def)\n\nlemma tbisim_SomeI:\n \"\\ln. \\ t \\ (x, m) \\ (x', m'); nw \\ x \\w x' \\ \\ tbisim nw t (Some (x, ln)) m (Some (x', ln)) m'\"\nby(simp add: tbisim_def)\n\nlemma tbisim_cases[consumes 1, case_names None Some]:\n assumes major: \"tbisim nw t ts1 m1 ts2 m2\"\n and \"\\ ts1 = None; ts2 = None \\ \\ thesis\"\n and \"\\x ln x'. \\ ts1 = \\(x, ln)\\; ts2 = \\(x', ln)\\; t \\ (x, m1) \\ (x', m2); nw \\ x \\w x' \\ \\ thesis\"\n shows thesis\nusing assms\nby(auto simp add: tbisim_def)\n\ndefinition mbisim :: \"(('l,'t,'x1,'m1,'w) state, ('l,'t,'x2,'m2,'w) state) bisim\" (\"_ \\m _\" [50, 50] 60)\nwhere\n \"s1 \\m s2 \\ \n finite (dom (thr s1)) \\ locks s1 = locks s2 \\ wset s1 = wset s2 \\ wset_thread_ok (wset s1) (thr s1) \\\n interrupts s1 = interrupts s2 \\\n (\\t. tbisim (wset s2 t = None) t (thr s1 t) (shr s1) (thr s2 t) (shr s2))\"\n\nlemma mbisim_thrNone_eq: \"s1 \\m s2 \\ thr s1 t = None \\ thr s2 t = None\"\nunfolding mbisim_def tbisim_def\napply(clarify)\napply(erule allE[where x=t])\napply(clarsimp)\ndone\n\nlemma mbisim_thrD1:\n \"\\ln. \\ s1 \\m s2; thr s1 t = \\(x, ln)\\ \\\n \\ \\x'. thr s2 t = \\(x', ln)\\ \\ t \\ (x, shr s1) \\ (x', shr s2) \\ (wset s1 t = None \\ x \\w x')\"\nby(fastforce simp add: mbisim_def tbisim_def)\n\nlemma mbisim_thrD2:\n \"\\ln. \\ s1 \\m s2; thr s2 t = \\(x, ln)\\ \\\n \\ \\x'. thr s1 t = \\(x', ln)\\ \\ t \\ (x', shr s1) \\ (x, shr s2) \\ (wset s2 t = None \\ x' \\w x)\"\nby(frule mbisim_thrNone_eq[where t=t])(cases \"thr s1 t\",(fastforce simp add: mbisim_def tbisim_def)+)\n\nlemma mbisim_dom_eq: \"s1 \\m s2 \\ dom (thr s1) = dom (thr s2)\"\napply(clarsimp simp add: dom_def fun_eq_iff simp del: not_None_eq)\napply(rule Collect_cong)\napply(drule mbisim_thrNone_eq)\napply(simp del: not_None_eq)\ndone\n\nlemma mbisim_wset_thread_ok1:\n \"s1 \\m s2 \\ wset_thread_ok (wset s1) (thr s1)\"\nby(clarsimp simp add: mbisim_def)\n\nlemma mbisim_wset_thread_ok2:\n assumes \"s1 \\m s2\"\n shows \"wset_thread_ok (wset s2) (thr s2)\"\nusing assms\napply(clarsimp simp add: mbisim_def)\napply(auto intro!: wset_thread_okI simp add: mbisim_thrNone_eq[OF assms, THEN sym] dest: wset_thread_okD)\ndone\n\nlemma mbisimI:\n \"\\ finite (dom (thr s1)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; \n wset_thread_ok (wset s1) (thr s1);\n \\t. thr s1 t = None \\ thr s2 t = None;\n \\t x1 ln. thr s1 t = \\(x1, ln)\\ \\ \\x2. thr s2 t = \\(x2, ln)\\ \\ t \\ (x1, shr s1) \\ (x2, shr s2) \\ (wset s2 t = None \\ x1 \\w x2) \\\n \\ s1 \\m s2\"\nby(fastforce simp add: mbisim_def tbisim_def)\n\nlemma mbisimI2:\n \"\\ finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2;\n wset_thread_ok (wset s2) (thr s2);\n \\t. thr s2 t = None \\ thr s1 t = None;\n \\t x2 ln. thr s2 t = \\(x2, ln)\\ \\ \\x1. thr s1 t = \\(x1, ln)\\ \\ t \\ (x1, shr s1) \\ (x2, shr s2) \\ (wset s2 t = None \\ x1 \\w x2) \\\n \\ s1 \\m s2\"\napply(auto simp add: mbisim_def tbisim_def)\n prefer 2\n apply(rule wset_thread_okI)\n apply(case_tac \"thr s2 t\")\n apply(auto dest!: wset_thread_okD)[1]\n apply fastforce\n apply(erule back_subst[where P=finite])\n apply(clarsimp simp add: dom_def fun_eq_iff simp del: not_None_eq)\n defer\n apply(rename_tac t)\n apply(case_tac [!] \"thr s2 t\")\nby fastforce+\n\nlemma mbisim_finite1:\n \"s1 \\m s2 \\ finite (dom (thr s1))\"\nby(simp add: mbisim_def)\n\nlemma mbisim_finite2:\n \"s1 \\m s2 \\ finite (dom (thr s2))\"\nby(frule mbisim_finite1)(simp add: mbisim_dom_eq)\n\ndefinition mta_bisim :: \"('t \\ ('l,'t,'x1,'m1,'w,'o) thread_action,\n 't \\ ('l,'t,'x2,'m2,'w,'o) thread_action) bisim\"\n (\"_/ \\T _\" [50, 50] 60)\nwhere \"tta1 \\T tta2 \\ fst tta1 = fst tta2 \\ snd tta1 \\m snd tta2\"\n\nlemma mta_bisim_conv [simp]: \"(t, ta1) \\T (t', ta2) \\ t = t' \\ ta1 \\m ta2\"\nby(simp add: mta_bisim_def)\n\ndefinition bisim_inv :: \"bool\" where\n \"bisim_inv \\ (\\s1 ta1 s1' s2 t. t \\ s1 \\ s2 \\ t \\ s1 -1-ta1\\ s1' \\ (\\s2'. t \\ s1' \\ s2')) \\\n (\\s2 ta2 s2' s1 t. t \\ s1 \\ s2 \\ t \\ s2 -2-ta2\\ s2' \\ (\\s1'. t \\ s1' \\ s2'))\"\n\nlemma bisim_invI:\n \"\\ \\s1 ta1 s1' s2 t. \\ t \\ s1 \\ s2; t \\ s1 -1-ta1\\ s1' \\ \\ \\s2'. t \\ s1' \\ s2';\n \\s2 ta2 s2' s1 t. \\ t \\ s1 \\ s2; t \\ s2 -2-ta2\\ s2' \\ \\ \\s1'. t \\ s1' \\ s2' \\\n \\ bisim_inv\"\nby(auto simp add: bisim_inv_def)\n\nlemma bisim_invD1:\n \"\\ bisim_inv; t \\ s1 \\ s2; t \\ s1 -1-ta1\\ s1' \\ \\ \\s2'. t \\ s1' \\ s2'\"\nunfolding bisim_inv_def by blast\n\nlemma bisim_invD2:\n \"\\ bisim_inv; t \\ s1 \\ s2; t \\ s2 -2-ta2\\ s2' \\ \\ \\s1'. t \\ s1' \\ s2'\"\nunfolding bisim_inv_def by blast\n\nlemma thread_oks_bisim_inv:\n \"\\ \\t. ts1 t = None \\ ts2 t = None; list_all2 (nta_bisim bisim) tas1 tas2 \\\n \\ thread_oks ts1 tas1 \\ thread_oks ts2 tas2\"\nproof(induct tas2 arbitrary: tas1 ts1 ts2)\n case Nil thus ?case by(simp)\nnext\n case (Cons ta2 TAS2 tas1 TS1 TS2)\n note IH = \\\\ts1 tas1 ts2. \\ \\t. ts1 t = None \\ ts2 t = None; list_all2 (nta_bisim bisim) tas1 TAS2 \\\n \\ thread_oks ts1 tas1 \\ thread_oks ts2 TAS2\\\n note eqNone = \\\\t. TS1 t = None \\ TS2 t = None\\[rule_format]\n hence fti: \"free_thread_id TS1 = free_thread_id TS2\" by(auto simp add: free_thread_id_def)\n from \\list_all2 (nta_bisim bisim) tas1 (ta2 # TAS2)\\\n obtain ta1 TAS1 where \"tas1 = ta1 # TAS1\" \"nta_bisim bisim ta1 ta2\" \"list_all2 (nta_bisim bisim) TAS1 TAS2\"\n by(auto simp add: list_all2_Cons2)\n moreover\n { fix t\n from \\nta_bisim bisim ta1 ta2\\ have \"redT_updT' TS1 ta1 t = None \\ redT_updT' TS2 ta2 t = None\"\n by(cases ta1, auto split: if_split_asm simp add: eqNone) }\n ultimately have \"thread_oks (redT_updT' TS1 ta1) TAS1 \\ thread_oks (redT_updT' TS2 ta2) TAS2\"\n by -(rule IH, auto)\n moreover from \\nta_bisim bisim ta1 ta2\\ fti have \"thread_ok TS1 ta1 = thread_ok TS2 ta2\" by(cases ta1, auto)\n ultimately show ?case using \\tas1 = ta1 # TAS1\\ by auto\nqed\n\nlemma redT_updT_nta_bisim_inv:\n \"\\ nta_bisim bisim ta1 ta2; ts1 T = None \\ ts2 T = None \\ \\ redT_updT ts1 ta1 T = None \\ redT_updT ts2 ta2 T = None\"\nby(cases ta1, auto)\n\nlemma redT_updTs_nta_bisim_inv:\n \"\\ list_all2 (nta_bisim bisim) tas1 tas2; ts1 T = None \\ ts2 T = None \\\n \\ redT_updTs ts1 tas1 T = None \\ redT_updTs ts2 tas2 T = None\"\nproof(induct tas1 arbitrary: tas2 ts1 ts2)\n case Nil thus ?case by(simp)\nnext\n case (Cons TA1 TAS1 tas2 TS1 TS2)\n note IH = \\\\tas2 ts1 ts2. \\list_all2 (nta_bisim bisim) TAS1 tas2; (ts1 T = None) = (ts2 T = None)\\\n \\ (redT_updTs ts1 TAS1 T = None) = (redT_updTs ts2 tas2 T = None)\\\n from \\list_all2 (nta_bisim bisim) (TA1 # TAS1) tas2\\\n obtain TA2 TAS2 where \"tas2 = TA2 # TAS2\" \"nta_bisim bisim TA1 TA2\" \"list_all2 (nta_bisim bisim) TAS1 TAS2\"\n by(auto simp add: list_all2_Cons1)\n from \\nta_bisim bisim TA1 TA2\\ \\(TS1 T = None) = (TS2 T = None)\\\n have \"redT_updT TS1 TA1 T = None \\ redT_updT TS2 TA2 T = None\"\n by(rule redT_updT_nta_bisim_inv)\n with IH[OF \\list_all2 (nta_bisim bisim) TAS1 TAS2\\, of \"redT_updT TS1 TA1\" \"redT_updT TS2 TA2\"] \\tas2 = TA2 # TAS2\\\n show ?case by simp\nqed\n\nend\n\nlemma tbisim_flip [flip_simps]:\n \"FWbisimulation_base.tbisim (\\t. flip (bisim t)) (flip bisim_wait) w t ts2 m2 ts1 m1 =\n FWbisimulation_base.tbisim bisim bisim_wait w t ts1 m1 ts2 m2\"\nunfolding FWbisimulation_base.tbisim_def flip_simps by auto\n\nlemma mbisim_flip [flip_simps]:\n \"FWbisimulation_base.mbisim (\\t. flip (bisim t)) (flip bisim_wait) s2 s1 =\n FWbisimulation_base.mbisim bisim bisim_wait s1 s2\"\napply(rule iffI)\n apply(frule FWbisimulation_base.mbisim_dom_eq)\n apply(frule FWbisimulation_base.mbisim_wset_thread_ok2)\n apply(fastforce simp add: FWbisimulation_base.mbisim_def flip_simps)\napply(frule FWbisimulation_base.mbisim_dom_eq)\napply(frule FWbisimulation_base.mbisim_wset_thread_ok2)\napply(fastforce simp add: FWbisimulation_base.mbisim_def flip_simps)\ndone\n\nlemma mta_bisim_flip [flip_simps]:\n \"FWbisimulation_base.mta_bisim (\\t. flip (bisim t)) = flip (FWbisimulation_base.mta_bisim bisim)\"\nby(auto simp add: fun_eq_iff flip_simps FWbisimulation_base.mta_bisim_def)\n\nlemma flip_const [simp]: \"flip (\\a b. c) = (\\a b. c)\"\nby(rule flip_def)\n\nlemma mbisim_K_flip [flip_simps]:\n \"FWbisimulation_base.mbisim (\\t. flip (bisim t)) (\\x1 x2. c) s1 s2 = \n FWbisimulation_base.mbisim bisim (\\x1 x2. c) s2 s1\"\nusing mbisim_flip[of bisim \"\\x1 x2. c\" s1 s2]\nunfolding flip_const . \n\ncontext FWbisimulation_base begin\n\nlemma mbisim_actions_ok_bisim_no_join_12:\n assumes mbisim: \"mbisim s1 s2\"\n and \"collect_cond_actions \\ta1\\\\<^bsub>c\\<^esub> = {}\"\n and \"ta_bisim bisim ta1 ta2\"\n and \"r1.actions_ok s1 t ta1\"\n shows \"r2.actions_ok s2 t ta2\"\nusing assms mbisim_thrNone_eq[OF mbisim]\nby(auto simp add: ta_bisim_def mbisim_def intro: thread_oks_bisim_inv[THEN iffD1] r2.may_join_cond_action_oks)\n\nlemma mbisim_actions_ok_bisim_no_join_21:\n \"\\ mbisim s1 s2; collect_cond_actions \\ta2\\\\<^bsub>c\\<^esub> = {}; ta_bisim bisim ta1 ta2; r2.actions_ok s2 t ta2 \\\n \\ r1.actions_ok s1 t ta1\"\nusing FWbisimulation_base.mbisim_actions_ok_bisim_no_join_12[where bisim=\"\\t. flip (bisim t)\" and bisim_wait=\"flip bisim_wait\"]\nunfolding flip_simps .\n\nlemma mbisim_actions_ok_bisim_no_join:\n \"\\ mbisim s1 s2; collect_cond_actions \\ta1\\\\<^bsub>c\\<^esub> = {}; ta_bisim bisim ta1 ta2 \\ \n \\ r1.actions_ok s1 t ta1 = r2.actions_ok s2 t ta2\"\napply(rule iffI)\n apply(erule (3) mbisim_actions_ok_bisim_no_join_12)\napply(erule mbisim_actions_ok_bisim_no_join_21[where ?ta2.0 = ta2])\n apply(simp add: ta_bisim_def)\napply assumption+\ndone\n\nend\n\nlocale FWbisimulation_base_aux = FWbisimulation_base +\n r1: multithreaded final1 r1 convert_RA +\n r2: multithreaded final2 r2 convert_RA +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\nbegin\n\nlemma FWbisimulation_base_aux_flip:\n \"FWbisimulation_base_aux final2 r2 final1 r1\"\nby(unfold_locales)\n\nend\n\nlemma FWbisimulation_base_aux_flip_simps [flip_simps]:\n \"FWbisimulation_base_aux final2 r2 final1 r1 = FWbisimulation_base_aux final1 r1 final2 r2\"\nby(blast intro: FWbisimulation_base_aux.FWbisimulation_base_aux_flip)\n\nsublocale FWbisimulation_base_aux < mthr:\n bisimulation_final_base \n r1.redT\n r2.redT\n mbisim\n mta_bisim\n r1.mfinal\n r2.mfinal\n.\n\ndeclare split_paired_Ex [simp del]\n\nsubsection \\Lifting for delay bisimulations\\\n\nlocale FWdelay_bisimulation_base =\n FWbisimulation_base _ _ _ r2 convert_RA bisim bisim_wait +\n r1: \\multithreaded final1 r1 convert_RA \\move1 +\n r2: \\multithreaded final2 r2 convert_RA \\move2 \n for r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50,0,0,50] 80)\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60)\n and bisim_wait :: \"('x1, 'x2) bisim\" (\"_/ \\w _\" [50, 50] 60)\n and \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\"\nbegin\n\nabbreviation \\mred1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mred1 \\ r1.\\mredT\"\n\nabbreviation \\mred2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mred2 \\ r2.\\mredT\"\n\nabbreviation m\\move1 :: \"(('l,'t,'x1,'m1,'w) state, 't \\ ('l,'t,'x1,'m1,'w,'o) thread_action) trsys\"\nwhere \"m\\move1 \\ r1.m\\move\"\n\nabbreviation m\\move2 :: \"(('l,'t,'x2,'m2,'w) state, 't \\ ('l,'t,'x2,'m2,'w,'o) thread_action) trsys\"\nwhere \"m\\move2 \\ r2.m\\move\"\n\nabbreviation \\mRed1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mRed1 \\ \\mred1^**\"\n\nabbreviation \\mRed2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mRed2 \\ \\mred2^**\"\n\nabbreviation \\mtRed1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mtRed1 \\ \\mred1^++\"\n\nabbreviation \\mtRed2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mtRed2 \\ \\mred2^++\"\n\nlemma bisim_inv_\\s1_inv:\n assumes inv: \"bisim_inv\"\n and bisim: \"t \\ s1 \\ s2\"\n and red: \"r1.silent_moves t s1 s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n from red bisim show \"\\s2'. t \\ s1' \\ s2'\"\n by(induct rule: rtranclp_induct)(fastforce elim: bisim_invD1[OF inv])+\nqed\n\nlemma bisim_inv_\\s2_inv:\n assumes inv: \"bisim_inv\"\n and bisim: \"t \\ s1 \\ s2\"\n and red: \"r2.silent_moves t s2 s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n from red bisim show \"\\s1'. t \\ s1' \\ s2'\"\n by(induct rule: rtranclp_induct)(fastforce elim: bisim_invD2[OF inv])+\nqed\n\nprimrec activate_cond_action1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ \n 't conditional_action \\ ('l,'t,'x1,'m1,'w) state\"\nwhere\n \"activate_cond_action1 s1 s2 (Join t) =\n (case thr s1 t of None \\ s1\n | \\(x1, ln1)\\ \\ (case thr s2 t of None \\ s1\n | \\(x2, ln2)\\ \\ \n if final2 x2 \\ ln2 = no_wait_locks\n then redT_upd_\\ s1 t\n (SOME x1'. r1.silent_moves t (x1, shr s1) (x1', shr s1) \\ final1 x1' \\ \n t \\ (x1', shr s1) \\ (x2, shr s2))\n (shr s1)\n else s1))\"\n| \"activate_cond_action1 s1 s2 Yield = s1\"\n\nprimrec activate_cond_actions1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state\n \\ ('t conditional_action) list \\ ('l,'t,'x1,'m1,'w) state\"\nwhere\n \"activate_cond_actions1 s1 s2 [] = s1\"\n| \"activate_cond_actions1 s1 s2 (ct # cts) = activate_cond_actions1 (activate_cond_action1 s1 s2 ct) s2 cts\"\n\nprimrec activate_cond_action2 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ \n 't conditional_action \\ ('l,'t,'x2,'m2,'w) state\"\nwhere\n \"activate_cond_action2 s1 s2 (Join t) =\n (case thr s2 t of None \\ s2\n | \\(x2, ln2)\\ \\ (case thr s1 t of None \\ s2\n | \\(x1, ln1)\\ \\ \n if final1 x1 \\ ln1 = no_wait_locks\n then redT_upd_\\ s2 t\n (SOME x2'. r2.silent_moves t (x2, shr s2) (x2', shr s2) \\ final2 x2' \\\n t \\ (x1, shr s1) \\ (x2', shr s2))\n (shr s2)\n else s2))\"\n| \"activate_cond_action2 s1 s2 Yield = s2\"\n\nprimrec activate_cond_actions2 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\\n ('t conditional_action) list \\ ('l,'t,'x2,'m2,'w) state\"\nwhere\n \"activate_cond_actions2 s1 s2 [] = s2\"\n| \"activate_cond_actions2 s1 s2 (ct # cts) = activate_cond_actions2 s1 (activate_cond_action2 s1 s2 ct) cts\"\n\nend\n\nlemma activate_cond_action1_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_action1 final2 r2 final1 (\\t. flip (bisim t)) \\move2 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_action2 final1 final2 r2 bisim \\move2 s1 s2\"\napply(rule ext)\napply(case_tac x)\napply(simp_all only: FWdelay_bisimulation_base.activate_cond_action1.simps \n FWdelay_bisimulation_base.activate_cond_action2.simps flip_simps)\ndone\n\nlemma activate_cond_actions1_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_actions1 final2 r2 final1 (\\t. flip (bisim t)) \\move2 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_actions2 final1 final2 r2 bisim \\move2 s1 s2\"\n (is \"?lhs = ?rhs\")\nproof(rule ext)\n fix xs\n show \"?lhs xs = ?rhs xs\"\n by(induct xs arbitrary: s2)\n (simp_all only: FWdelay_bisimulation_base.activate_cond_actions1.simps\n FWdelay_bisimulation_base.activate_cond_actions2.simps flip_simps)\nqed\n\nlemma activate_cond_action2_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_action2 final2 final1 r1 (\\t. flip (bisim t)) \\move1 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_action1 final1 r1 final2 bisim \\move1 s1 s2\"\napply(rule ext)\napply(case_tac x)\napply(simp_all only: FWdelay_bisimulation_base.activate_cond_action1.simps \n FWdelay_bisimulation_base.activate_cond_action2.simps flip_simps)\ndone\n\nlemma activate_cond_actions2_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_actions2 final2 final1 r1 (\\t. flip (bisim t)) \\move1 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_actions1 final1 r1 final2 bisim \\move1 s1 s2\"\n (is \"?lhs = ?rhs\")\nproof(rule ext)\n fix xs\n show \"?lhs xs = ?rhs xs\"\n by(induct xs arbitrary: s1)\n (simp_all only: FWdelay_bisimulation_base.activate_cond_actions1.simps \n FWdelay_bisimulation_base.activate_cond_actions2.simps flip_simps)\nqed\n \ncontext FWdelay_bisimulation_base begin\n\n\n\nlemma shr_activate_cond_actions1 [simp]: \"shr (activate_cond_actions1 s1 s2 cts) = shr s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma shr_activate_cond_action2 [simp]: \"shr (activate_cond_action2 s1 s2 ct) = shr s2\"\nby(cases ct) simp_all\n\nlemma shr_activate_cond_actions2 [simp]: \"shr (activate_cond_actions2 s1 s2 cts) = shr s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma locks_activate_cond_action1 [simp]: \"locks (activate_cond_action1 s1 s2 ct) = locks s1\"\nby(cases ct) simp_all\n\nlemma locks_activate_cond_actions1 [simp]: \"locks (activate_cond_actions1 s1 s2 cts) = locks s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma locks_activate_cond_action2 [simp]: \"locks (activate_cond_action2 s1 s2 ct) = locks s2\"\nby(cases ct) simp_all\n\nlemma locks_activate_cond_actions2 [simp]: \"locks (activate_cond_actions2 s1 s2 cts) = locks s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma wset_activate_cond_action1 [simp]: \"wset (activate_cond_action1 s1 s2 ct) = wset s1\"\nby(cases ct) simp_all\n\nlemma wset_activate_cond_actions1 [simp]: \"wset (activate_cond_actions1 s1 s2 cts) = wset s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma wset_activate_cond_action2 [simp]: \"wset (activate_cond_action2 s1 s2 ct) = wset s2\"\nby(cases ct) simp_all\n\nlemma wset_activate_cond_actions2 [simp]: \"wset (activate_cond_actions2 s1 s2 cts) = wset s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma interrupts_activate_cond_action1 [simp]: \"interrupts (activate_cond_action1 s1 s2 ct) = interrupts s1\"\nby(cases ct) simp_all\n\nlemma interrupts_activate_cond_actions1 [simp]: \"interrupts (activate_cond_actions1 s1 s2 cts) = interrupts s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma interrupts_activate_cond_action2 [simp]: \"interrupts (activate_cond_action2 s1 s2 ct) = interrupts s2\"\nby(cases ct) simp_all\n\nlemma interrupts_activate_cond_actions2 [simp]: \"interrupts (activate_cond_actions2 s1 s2 cts) = interrupts s2\"\nby(induct cts arbitrary: s2) auto\n\nend\n\nlocale FWdelay_bisimulation_lift_aux =\n FWdelay_bisimulation_base _ _ _ _ _ _ _ \\move1 \\move2 +\n r1: \\multithreaded_wf final1 r1 convert_RA \\move1 +\n r2: \\multithreaded_wf final2 r2 convert_RA \\move2 \n for \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\"\nbegin\n\nlemma FWdelay_bisimulation_lift_aux_flip:\n \"FWdelay_bisimulation_lift_aux final2 r2 final1 r1 \\move2 \\move1\"\nby unfold_locales\n\nend\n\nlemma FWdelay_bisimulation_lift_aux_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_lift_aux final2 r2 final1 r1 \\move2 \\move1 =\n FWdelay_bisimulation_lift_aux final1 r1 final2 r2 \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_lift_aux.FWdelay_bisimulation_lift_aux_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_lift_aux begin\n\nlemma cond_actions_ok_\\mred1_inv:\n assumes red: \"\\mred1 s1 s1'\"\n and ct: \"r1.cond_action_ok s1 t ct\"\n shows \"r1.cond_action_ok s1' t ct\"\nusing ct\nproof(cases ct)\n case (Join t')\n show ?thesis using red ct\n proof(cases \"thr s1 t'\")\n case None with red ct Join show ?thesis\n by(fastforce elim!: r1.mthr.silent_move.cases r1.redT.cases r1.m\\move.cases rtrancl3p_cases \n dest: r1.silent_tl split: if_split_asm)\n next\n case (Some a) with red ct Join show ?thesis\n by(fastforce elim!: r1.mthr.silent_move.cases r1.redT.cases r1.m\\move.cases rtrancl3p_cases\n dest: r1.silent_tl r1.final_no_red split: if_split_asm simp add: redT_updWs_def)\n qed\nnext\n case Yield thus ?thesis by simp\nqed\n\nlemma cond_actions_ok_\\mred2_inv:\n \"\\ \\mred2 s2 s2'; r2.cond_action_ok s2 t ct \\ \\ r2.cond_action_ok s2' t ct\"\nusing FWdelay_bisimulation_lift_aux.cond_actions_ok_\\mred1_inv[OF FWdelay_bisimulation_lift_aux_flip] .\n\nlemma cond_actions_ok_\\mRed1_inv:\n \"\\ \\mRed1 s1 s1'; r1.cond_action_ok s1 t ct \\ \\ r1.cond_action_ok s1' t ct\"\nby(induct rule: rtranclp_induct)(blast intro: cond_actions_ok_\\mred1_inv)+\n\nlemma cond_actions_ok_\\mRed2_inv:\n \"\\ \\mRed2 s2 s2'; r2.cond_action_ok s2 t ct \\ \\ r2.cond_action_ok s2' t ct\"\nby(rule FWdelay_bisimulation_lift_aux.cond_actions_ok_\\mRed1_inv[OF FWdelay_bisimulation_lift_aux_flip])\n\nend\n\nlocale FWdelay_bisimulation_lift =\n FWdelay_bisimulation_lift_aux +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l, 't, 'x1, 'm1, 'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l, 't, 'x2, 'm2, 'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\n and \\move1 :: \"('l, 't, 'x1, 'm1, 'w, 'o) \\moves\" \n and \\move2 :: \"('l, 't, 'x2, 'm2, 'w, 'o) \\moves\"\n assumes \\inv_locale: \"\\inv (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n\nsublocale FWdelay_bisimulation_lift < \\inv \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule \\inv_locale)\n\ncontext FWdelay_bisimulation_lift begin\n\nlemma FWdelay_bisimulation_lift_flip:\n \"FWdelay_bisimulation_lift final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_lift.intro)\n apply(rule FWdelay_bisimulation_lift_aux_flip)\napply(rule FWdelay_bisimulation_lift_axioms.intro)\napply(unfold flip_simps)\napply(unfold_locales)\ndone\n\nend\n\nlemma FWdelay_bisimulation_lift_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_lift final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1 =\n FWdelay_bisimulation_lift final1 r1 final2 r2 bisim \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_lift.FWdelay_bisimulation_lift_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_lift begin\n\nlemma \\inv_lift: \"\\inv r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\"\nproof\n fix s1 s2 tl1 s1' tl2 s2'\n assume \"s1 \\m s2\" \"s1' \\m s2'\" \"tl1 \\T tl2\" \"r1.redT s1 tl1 s1'\" \"r2.redT s2 tl2 s2'\"\n moreover obtain t ta1 where tl1: \"tl1 = (t, ta1)\" by(cases tl1)\n moreover obtain t' ta2 where tl2: \"tl2 = (t', ta2)\" by(cases tl2)\n moreover obtain ls1 ts1 ws1 m1 is1 where s1: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n moreover obtain ls2 ts2 ws2 m2 is2 where s2: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n moreover obtain ls1' ts1' ws1' m1' is1' where s1': \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n moreover obtain ls2' ts2' ws2' m2' is2' where s2': \"s2' = (ls2', (ts2', m2'), ws2', is2')\" by(cases s2') fastforce\n ultimately have mbisim: \"(ls1, (ts1, m1), ws1, is1) \\m (ls2, (ts2, m2), ws2, is2)\"\n and mbisim': \"(ls1', (ts1', m1'), ws1', is1') \\m (ls2', (ts2', m2'), ws2', is2')\"\n and mred1: \"(ls1, (ts1, m1), ws1, is1) -1-t\\ta1\\ (ls1', (ts1', m1'), ws1', is1')\"\n and mred2: \"(ls2, (ts2, m2), ws2, is2) -2-t\\ta2\\ (ls2', (ts2', m2'), ws2', is2')\"\n and tasim: \"ta1 \\m ta2\" and tt': \"t' = t\" by simp_all\n from mbisim have ls: \"ls1 = ls2\" and ws: \"ws1 = ws2\" and \"is\": \"is1 = is2\"\n and tbisim: \"\\t. tbisim (ws2 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp_all add: mbisim_def)\n from mbisim' have ls': \"ls1' = ls2'\" and ws': \"ws1' = ws2'\" and is': \"is1' = is2'\"\n and tbisim': \"\\t. tbisim (ws2' t = None) t (ts1' t) m1' (ts2' t) m2'\" by(simp_all add: mbisim_def)\n from mred1 r1.redT_thread_not_disappear[OF mred1]\n obtain x1 ln1 x1' ln1' where tst1: \"ts1 t = \\(x1, ln1)\\\"\n and tst1': \"ts1' t = \\(x1', ln1')\\\"\n by(fastforce elim!: r1.redT.cases)\n from mred2 r2.redT_thread_not_disappear[OF mred2]\n obtain x2 ln2 x2' ln2' where tst2: \"ts2 t = \\(x2, ln2)\\\"\n and tst2': \"ts2' t = \\(x2', ln2')\\\" by(fastforce elim!: r2.redT.cases)\n from tbisim[of t] tst1 tst2 ws have bisim: \"t \\ (x1, m1) \\ (x2, m2)\"\n and ln: \"ln1 = ln2\" by(auto simp add: tbisim_def)\n from tbisim'[of t] tst1' tst2' have bisim': \"t \\ (x1', m1') \\ (x2', m2')\"\n and ln': \"ln1' = ln2'\" by(auto simp add: tbisim_def)\n show \"m\\move1 s1 tl1 s1' = m\\move2 s2 tl2 s2'\" unfolding s1 s2 s1' s2' tt' tl1 tl2\n proof -\n show \"m\\move1 (ls1, (ts1, m1), ws1, is1) (t, ta1) (ls1', (ts1', m1'), ws1', is1') =\n m\\move2 (ls2, (ts2, m2), ws2, is2) (t, ta2) (ls2', (ts2', m2'), ws2', is2')\"\n (is \"?lhs = ?rhs\")\n proof\n assume m\\: ?lhs\n with tst1 tst1' obtain \\1: \"\\move1 (x1, m1) ta1 (x1', m1')\" \n and ln1: \"ln1 = no_wait_locks\" by(fastforce elim!: r1.m\\move.cases)\n from \\1 have \"ta1 = \\\" by(rule r1.silent_tl)\n with mred1 \\1 tst1 tst1' ln1 have red1: \"t \\ (x1, m1) -1-ta1\\ (x1', m1')\"\n by(auto elim!: r1.redT.cases rtrancl3p_cases)\n from tasim \\ta1 = \\\\ have [simp]: \"ta2 = \\\" by(simp)\n with mred2 ln1 ln tst2 tst2' have red2: \"t \\ (x2, m2) -2-\\\\ (x2', m2')\"\n by(fastforce elim!: r2.redT.cases rtrancl3p_cases)\n from \\1 \\inv[OF bisim red1 red2] bisim' tasim\n have \\2: \"\\move2 (x2, m2) \\ (x2', m2')\" by simp\n with tst2 tst2' ln ln1 show ?rhs by -(rule r2.m\\move.intros, auto)\n next\n assume m\\: ?rhs\n with tst2 tst2' obtain \\2: \"\\move2 (x2, m2) ta2 (x2', m2')\" \n and ln2: \"ln2 = no_wait_locks\" by(fastforce elim!: r2.m\\move.cases)\n from \\2 have \"ta2 = \\\" by(rule r2.silent_tl)\n with mred2 \\2 tst2 tst2' ln2 have red2: \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n by(auto elim!: r2.redT.cases rtrancl3p_cases)\n from tasim \\ta2 = \\\\ have [simp]: \"ta1 = \\\" by simp\n with mred1 ln2 ln tst1 tst1' have red1: \"t \\ (x1, m1) -1-\\\\ (x1', m1')\"\n by(fastforce elim!: r1.redT.cases rtrancl3p_cases)\n from \\2 \\inv[OF bisim red1 red2] bisim' tasim\n have \\1: \"\\move1 (x1, m1) \\ (x1', m1')\" by auto\n with tst1 tst1' ln ln2 show ?lhs unfolding \\ta1 = \\\\\n by-(rule r1.m\\move.intros, auto)\n qed\n qed\nqed\n\nend\n\nsublocale FWdelay_bisimulation_lift < mthr: \\inv r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\nby(rule \\inv_lift)\n\nlocale FWdelay_bisimulation_final_base =\n FWdelay_bisimulation_lift_aux +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\n and \\move1 :: \"('l,'t,'x1,'m1,'w, 'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w, 'o) \\moves\"\n assumes delay_bisim_locale:\n \"delay_bisimulation_final_base (r1 t) (r2 t) (bisim t) \\move1 \\move2 (\\(x1, m). final1 x1) (\\(x2, m). final2 x2)\"\n\nsublocale FWdelay_bisimulation_final_base <\n delay_bisimulation_final_base \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2\n \"\\(x1, m). final1 x1\" \"\\(x2, m). final2 x2\" \n for t\nby(rule delay_bisim_locale)\n\ncontext FWdelay_bisimulation_final_base begin\n\nlemma FWdelay_bisimulation_final_base_flip:\n \"FWdelay_bisimulation_final_base final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_final_base.intro)\n apply(rule FWdelay_bisimulation_lift_aux_flip)\napply(rule FWdelay_bisimulation_final_base_axioms.intro)\napply(rule delay_bisimulation_final_base_flip)\ndone\n\nend\n\nlemma FWdelay_bisimulation_final_base_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_final_base final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1 =\n FWdelay_bisimulation_final_base final1 r1 final2 r2 bisim \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_final_base.FWdelay_bisimulation_final_base_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_final_base begin\n\nlemma cond_actions_ok_bisim_ex_\\1_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 ct\n defines \"s1' \\ activate_cond_action1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n assumes mbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r2.cond_action_ok (ls, (ts2, m2), ws, is) t ct\"\n shows \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_ok s1' t ct\"\n and \"thr s1' t = Some xln\"\nproof -\n have \"\\mRed1 (ls, (ts1, m1), ws, is) s1' \\\n (\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2) \\\n r1.cond_action_ok s1' t ct \\ thr s1' t = \\xln\\\"\n using ct\n proof(cases ct)\n case (Join t')\n show ?thesis \n proof(cases \"ts1 t'\")\n case None\n with mbisim ts1t have \"t \\ t'\" by auto\n moreover from None Join have \"s1' = (ls, (ts1, m1), ws, is)\" by(simp add: s1'_def)\n ultimately show ?thesis using mbisim Join ct None ts1t by(simp add: tbisim_def)\n next\n case (Some xln)\n moreover obtain x1 ln where \"xln = (x1, ln)\" by(cases xln)\n ultimately have ts1t': \"ts1 t' = \\(x1, ln)\\\" by simp\n from Join ct Some ts2t have tt': \"t' \\ t\" by auto\n from mbisim[OF tt'] ts1t' obtain x2 where ts2t': \"ts2 t' = \\(x2, ln)\\\" \n and bisim: \"t' \\ (x1, m1) \\ (x2, m2)\" by(auto simp add: tbisim_def)\n from ct Join ts2t' have final2: \"final2 x2\" and ln: \"ln = no_wait_locks\"\n and wst': \"ws t' = None\" by simp_all\n let ?x1' = \"SOME x. r1.silent_moves t' (x1, m1) (x, m1) \\ final1 x \\ t' \\ (x, m1) \\ (x2, m2)\"\n { from final2_simulation[OF bisim] final2 obtain x1' m1' \n where \"r1.silent_moves t' (x1, m1) (x1', m1')\" and \"t' \\ (x1', m1') \\ (x2, m2)\"\n and \"final1 x1'\" by auto\n moreover hence \"m1' = m1\" using bisim by(auto dest: r1.red_rtrancl_\\_heapD_inv)\n ultimately have \"\\x. r1.silent_moves t' (x1, m1) (x, m1) \\ final1 x \\ t' \\ (x, m1) \\ (x2, m2)\"\n by blast }\n from someI_ex[OF this] have red1: \"r1.silent_moves t' (x1, m1) (?x1', m1)\"\n and final1: \"final1 ?x1'\" and bisim': \"t' \\ (?x1', m1) \\ (x2, m2)\" by blast+\n let ?S1' = \"redT_upd_\\ (ls, (ts1, m1), ws, is) t' ?x1' m1\"\n from r1.silent_moves_into_RedT_\\_inv[where ?s=\"(ls, (ts1, m1), ws, is)\" and t=t', simplified, OF red1]\n bisim ts1t' ln wst'\n have Red1: \"\\mRed1 (ls, (ts1, m1), ws, is) ?S1'\" by auto\n moreover from Join ln ts1t' final1 wst' tt'\n have ct': \"r1.cond_action_ok ?S1' t ct\" by(auto intro: finfun_ext)\n { fix t''\n assume \"t \\ t''\"\n with Join mbisim[OF this[symmetric]] bisim' ts1t' ts2t' wst' s1'_def\n have \"tbisim (ws t'' = None) t'' (thr s1' t'') m1 (ts2 t'') m2\"\n by(auto simp add: tbisim_def redT_updLns_def o_def finfun_Diag_const2) }\n moreover from Join ts1t' ts2t' final2 ln have \"s1' = ?S1'\" by(simp add: s1'_def)\n ultimately show ?thesis using Red1 ct' ts1t' tt' ts1t by(auto)\n qed\n next\n case Yield thus ?thesis using mbisim ts1t by(simp add: s1'_def)\n qed\n thus \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_ok s1' t ct\"\n and \"thr s1' t = \\xln\\\" by blast+\nqed\n\nlemma cond_actions_oks_bisim_ex_\\1_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 cts\n defines \"s1' \\ activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts\"\n assumes tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\"\n shows \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\" \n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_oks s1' t cts\"\n and \"thr s1' t = Some xln\"\nusing tbisim ts1t ct unfolding s1'_def\nproof(induct cts arbitrary: ts1)\n case (Cons ct cts)\n note IH1 = \\\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ \\mred1\\<^sup>*\\<^sup>* (ls, (ts1, m1), ws, is) (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts)\\\n note IH2 = \\\\t' ts1. \\t' \\ t; \\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ tbisim (ws t' = None) t' (thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t') m1 (ts2 t') m2\\\n note IH3 = \\\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ r1.cond_action_oks (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t cts\\\n note IH4 = \\\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t = \\xln\\\\\n { fix ts1\n assume tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = \\xln\\\"\n and ct: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t (ct # cts)\"\n from ct have 1: \"r2.cond_action_ok (ls, (ts2, m2), ws, is) t ct\"\n and 2: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\" by auto\n let ?s1' = \"activate_cond_action1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n from cond_actions_ok_bisim_ex_\\1_inv[OF tbisim, OF _ ts1t ts2t 1]\n have tbisim': \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr ?s1' t') m1 (ts2 t') m2\"\n and red: \"\\mRed1 (ls, (ts1, m1), ws, is) ?s1'\" and ct': \"r1.cond_action_ok ?s1' t ct\" \n and ts1't: \"thr ?s1' t = \\xln\\\" by blast+\n let ?s1'' = \"activate_cond_actions1 ?s1' (ls, (ts2, m2), ws, is) cts\"\n have \"locks ?s1' = ls\" \"shr ?s1' = m1\" \"wset ?s1' = ws\" \"interrupts ?s1' = is\" by simp_all\n hence s1': \"(ls, (thr ?s1', m1), ws, is) = ?s1'\" by(cases \"?s1'\") auto\n from IH1[OF tbisim', OF _ ts1't 2] s1' have red': \"\\mRed1 ?s1' ?s1''\" by simp\n with red show \"\\mRed1 (ls, (ts1, m1), ws, is) (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts))\"\n by auto\n { fix t'\n assume t't: \"t' \\ t\"\n from IH2[OF t't tbisim', OF _ ts1't 2] s1'\n show \"tbisim (ws t' = None) t' (thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t') m1 (ts2 t') m2\"\n by auto }\n from red' ct' have \"r1.cond_action_ok ?s1'' t ct\" by(rule cond_actions_ok_\\mRed1_inv)\n with IH3[OF tbisim', OF _ ts1't 2] s1'\n show \"r1.cond_action_oks (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t (ct # cts)\"\n by auto\n from ts1't IH4[OF tbisim', OF _ ts1't 2] s1'\n show \"thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t = \\xln\\\" by auto }\nqed(auto)\n\nlemma cond_actions_ok_bisim_ex_\\2_inv:\n fixes ls ts1 m1 \"is\" ws ts2 m2 ct\n defines \"s2' \\ activate_cond_action2 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n assumes mbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r1.cond_action_ok (ls, (ts1, m1), ws, is) t ct\"\n shows \"\\mRed2 (ls, (ts2, m2), ws, is) s2'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (thr s2' t') m2\"\n and \"r2.cond_action_ok s2' t ct\"\n and \"thr s2' t = Some xln'\"\nunfolding s2'_def\nby(blast intro: FWdelay_bisimulation_final_base.cond_actions_ok_bisim_ex_\\1_inv[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\", unfolded flip_simps, OF mbisim _ _ ct, OF _ ts2t ts1t])+\n\nlemma cond_actions_oks_bisim_ex_\\2_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 cts\n defines \"s2' \\ activate_cond_actions2 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts\"\n assumes tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r1.cond_action_oks (ls, (ts1, m1), ws, is) t cts\"\n shows \"\\mRed2 (ls, (ts2, m2), ws, is) s2'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (thr s2' t') m2\"\n and \"r2.cond_action_oks s2' t cts\"\n and \"thr s2' t = Some xln'\"\nunfolding s2'_def\nby(blast intro: FWdelay_bisimulation_final_base.cond_actions_oks_bisim_ex_\\1_inv[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\", unfolded flip_simps, OF tbisim _ _ ct, OF _ ts2t ts1t])+\n\nlemma mfinal1_inv_simulation:\n assumes \"s1 \\m s2\" \n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1 \\m s2' \\ r1.final_threads s1 \\ r2.final_threads s2' \\ shr s2' = shr s2\"\nproof -\n from \\s1 \\m s2\\ have \"finite (dom (thr s1))\" by(auto dest: mbisim_finite1)\n moreover have \"r1.final_threads s1 \\ dom (thr s1)\" by(auto simp add: r1.final_thread_def)\n ultimately have \"finite (r1.final_threads s1)\" by(blast intro: finite_subset)\n thus ?thesis using \\s1 \\m s2\\\n proof(induct A\\\"r1.final_threads s1\" arbitrary: s1 s2 rule: finite_induct)\n case empty\n from \\{} = r1.final_threads s1\\[symmetric] have \"\\t. \\ r1.final_thread s1 t\" by(auto)\n with \\s1 \\m s2\\ show ?case by blast\n next\n case (insert t A)\n define s1' where \"s1' = (locks s1, ((thr s1)(t := None), shr s1), wset s1, interrupts s1)\"\n define s2' where \"s2' = (locks s2, ((thr s2)(t := None), shr s2), wset s2, interrupts s2)\"\n from \\t \\ A\\ \\insert t A = r1.final_threads s1\\ have \"A = r1.final_threads s1'\"\n unfolding s1'_def by(auto simp add: r1.final_thread_def r1.final_threads_def)\n moreover from \\insert t A = r1.final_threads s1\\ have \"r1.final_thread s1 t\" by auto\n hence \"wset s1 t = None\" by(auto simp add: r1.final_thread_def)\n with \\s1 \\m s2\\ have \"s1' \\m s2'\" unfolding s1'_def s2'_def\n by(auto simp add: mbisim_def intro: tbisim_NoneI intro!: wset_thread_okI dest: wset_thread_okD split: if_split_asm)\n ultimately have \"\\s2''. r2.mthr.silent_moves s2' s2'' \\ s1' \\m s2'' \\ r1.final_threads s1' \\ r2.final_threads s2'' \\ shr s2'' = shr s2'\" by(rule insert)\n then obtain s2'' where reds: \"r2.mthr.silent_moves s2' s2''\" \n and \"s1' \\m s2''\" and fin: \"\\t. r1.final_thread s1' t \\ r2.final_thread s2'' t\" and \"shr s2'' = shr s2'\" by blast\n have \"thr s2' t = None\" unfolding s2'_def by simp\n with \\r2.mthr.silent_moves s2' s2''\\\n have \"r2.mthr.silent_moves (locks s2', (thr s2'(t \\ the (thr s2 t)), shr s2'), wset s2', interrupts s2')\n (locks s2'', (thr s2''(t \\ the (thr s2 t)), shr s2''), wset s2'', interrupts s2'')\"\n by(rule r2.\\mRedT_add_thread_inv)\n also let ?s2'' = \"(locks s2, (thr s2''(t \\ the (thr s2 t)), shr s2), wset s2, interrupts s2)\"\n from \\shr s2'' = shr s2'\\ \\s1' \\m s2''\\ \\s1 \\m s2\\\n have \"(locks s2'', (thr s2''(t \\ the (thr s2 t)), shr s2''), wset s2'', interrupts s2'') = ?s2''\"\n unfolding s2'_def s1'_def by(simp add: mbisim_def)\n also (back_subst) from \\s1 \\m s2\\ have \"dom (thr s1) = dom (thr s2)\" by(rule mbisim_dom_eq)\n with \\r1.final_thread s1 t\\ have \"t \\ dom (thr s2)\" by(auto simp add: r1.final_thread_def)\n then obtain x2 ln where tst2: \"thr s2 t = \\(x2, ln)\\\" by auto\n hence \"(locks s2', (thr s2'(t \\ the (thr s2 t)), shr s2'), wset s2', interrupts s2') = s2\"\n unfolding s2'_def by(cases s2)(auto intro!: ext)\n also from \\s1 \\m s2\\ tst2 obtain x1\n where tst1: \"thr s1 t = \\(x1, ln)\\\"\n and bisim: \"t \\ (x1, shr s1) \\ (x2, shr s2)\" by(auto dest: mbisim_thrD2)\n from \\shr s2'' = shr s2'\\ have \"shr ?s2'' = shr s2\" by(simp add: s2'_def)\n from \\r1.final_thread s1 t\\ tst1\n have final: \"final1 x1\" \"ln = no_wait_locks\" \"wset s1 t = None\" by(auto simp add: r1.final_thread_def)\n with final1_simulation[OF bisim] \\shr ?s2'' = shr s2\\ obtain x2' m2'\n where red: \"r2.silent_moves t (x2, shr ?s2'') (x2', m2')\"\n and bisim': \"t \\ (x1, shr s1) \\ (x2', m2')\" and \"final2 x2'\" by auto\n from \\wset s1 t = None\\ \\s1 \\m s2\\ have \"wset s2 t = None\" by(simp add: mbisim_def) \n with bisim r2.silent_moves_into_RedT_\\_inv[OF red] tst2 \\ln = no_wait_locks\\\n have \"r2.mthr.silent_moves ?s2'' (redT_upd_\\ ?s2'' t x2' m2')\" unfolding s2'_def by auto\n also (rtranclp_trans)\n from bisim r2.red_rtrancl_\\_heapD_inv[OF red] have \"m2' = shr s2\" by auto\n hence \"s1 \\m (redT_upd_\\ ?s2'' t x2' m2')\"\n using \\s1' \\m s2''\\ \\s1 \\m s2\\ tst1 tst2 \\shr ?s2'' = shr s2\\ bisim' \\shr s2'' = shr s2'\\ \\wset s2 t = None\\\n unfolding s1'_def s2'_def by(auto simp add: mbisim_def redT_updLns_def split: if_split_asm intro: tbisim_SomeI)\n moreover { \n fix t'\n assume \"r1.final_thread s1 t'\"\n with fin[of t'] \\final2 x2'\\ tst2 \\ln = no_wait_locks\\ \\wset s2 t = None\\ \\s1' \\m s2''\\ \\s1 \\m s2\\\n have \"r2.final_thread (redT_upd_\\ ?s2'' t x2' m2') t'\" unfolding s1'_def\n by(fastforce split: if_split_asm simp add: r2.final_thread_def r1.final_thread_def redT_updLns_def finfun_Diag_const2 o_def mbisim_def)\n }\n moreover have \"shr (redT_upd_\\ ?s2'' t x2' m2') = shr s2\" using \\m2' = shr s2\\ by simp\n ultimately show ?case by blast\n qed\nqed\n\nlemma mfinal2_inv_simulation:\n \"s1 \\m s2 \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ s1' \\m s2 \\ r2.final_threads s2 \\ r1.final_threads s1' \\ shr s1' = shr s1\"\nusing FWdelay_bisimulation_final_base.mfinal1_inv_simulation[OF FWdelay_bisimulation_final_base_flip, where bisim_wait=\"flip bisim_wait\"]\nby(unfold flip_simps)\n\nlemma mfinal1_simulation:\n assumes \"s1 \\m s2\" and \"r1.mfinal s1\"\n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1 \\m s2' \\ r2.mfinal s2' \\ shr s2' = shr s2\"\nproof -\n from mfinal1_inv_simulation[OF \\s1 \\m s2\\]\n obtain s2' where 1: \"r2.mthr.silent_moves s2 s2'\" \"s1 \\m s2'\" \"shr s2' = shr s2\"\n and fin: \"\\t. r1.final_thread s1 t \\ r2.final_thread s2' t\" by blast\n have \"r2.mfinal s2'\"\n proof(rule r2.mfinalI)\n fix t x2 ln\n assume \"thr s2' t = \\(x2, ln)\\\"\n with \\s1 \\m s2'\\ obtain x1 where \"thr s1 t = \\(x1, ln)\\\" \"t \\ (x1, shr s1) \\ (x2, shr s2')\"\n by(auto dest: mbisim_thrD2)\n from \\thr s1 t = \\(x1, ln)\\\\ \\r1.mfinal s1\\ have \"r1.final_thread s1 t\"\n by(auto elim!: r1.mfinalE simp add: r1.final_thread_def)\n hence \"r2.final_thread s2' t\" by(rule fin)\n thus \"final2 x2 \\ ln = no_wait_locks \\ wset s2' t = None\"\n using \\thr s2' t = \\(x2, ln)\\\\ by(auto simp add: r2.final_thread_def)\n qed\n with 1 show ?thesis by blast\nqed\n \nlemma mfinal2_simulation:\n \"\\ s1 \\m s2; r2.mfinal s2 \\\n \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ s1' \\m s2 \\ r1.mfinal s1' \\ shr s1' = shr s1\"\nusing FWdelay_bisimulation_final_base.mfinal1_simulation[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\"]\nby(unfold flip_simps)\n\nend\n\nlocale FWdelay_bisimulation_obs =\n FWdelay_bisimulation_final_base _ _ _ _ _ _ _ \\move1 \\move2\n for \\move1 :: \"('l,'t,'x1,'m1,'w, 'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w, 'o) \\moves\" +\n assumes delay_bisimulation_obs_locale: \"delay_bisimulation_obs (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n and bisim_inv_red_other:\n \"\\ t' \\ (x, m1) \\ (xx, m2); t \\ (x1, m1) \\ (x2, m2); \n r1.silent_moves t (x1, m1) (x1', m1);\n t \\ (x1', m1) -1-ta1\\ (x1'', m1'); \\ \\move1 (x1', m1) ta1 (x1'', m1');\n r2.silent_moves t (x2, m2) (x2', m2);\n t \\ (x2', m2) -2-ta2\\ (x2'', m2'); \\ \\move2 (x2', m2) ta2 (x2'', m2');\n t \\ (x1'', m1') \\ (x2'', m2'); ta_bisim bisim ta1 ta2 \\\n \\ t' \\ (x, m1') \\ (xx, m2')\"\n and bisim_waitI:\n \"\\ t \\ (x1, m1) \\ (x2, m2); r1.silent_moves t (x1, m1) (x1', m1);\n t \\ (x1', m1) -1-ta1\\ (x1'', m1'); \\ \\move1 (x1', m1) ta1 (x1'', m1');\n r2.silent_moves t (x2, m2) (x2', m2);\n t \\ (x2', m2) -2-ta2\\ (x2'', m2'); \\ \\move2 (x2', m2) ta2 (x2'', m2');\n t \\ (x1'', m1') \\ (x2'', m2'); ta_bisim bisim ta1 ta2;\n Suspend w \\ set \\ta1\\\\<^bsub>w\\<^esub>; Suspend w \\ set \\ta2\\\\<^bsub>w\\<^esub> \\\n \\ x1'' \\w x2''\"\n and simulation_Wakeup1:\n \"\\ t \\ (x1, m1) \\ (x2, m2); x1 \\w x2; t \\ (x1, m1) -1-ta1\\ (x1', m1'); Notified \\ set \\ta1\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta1\\\\<^bsub>w\\<^esub> \\\n \\ \\ta2 x2' m2'. t \\ (x2, m2) -2-ta2\\ (x2', m2') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta_bisim bisim ta1 ta2\"\n and simulation_Wakeup2:\n \"\\ t \\ (x1, m1) \\ (x2, m2); x1 \\w x2; t \\ (x2, m2) -2-ta2\\ (x2', m2'); Notified \\ set \\ta2\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta2\\\\<^bsub>w\\<^esub> \\\n \\ \\ta1 x1' m1'. t \\ (x1, m1) -1-ta1\\ (x1', m1') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta_bisim bisim ta1 ta2\"\n and ex_final1_conv_ex_final2:\n \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\"\n\nsublocale FWdelay_bisimulation_obs <\n delay_bisimulation_obs \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule delay_bisimulation_obs_locale)\n\ncontext FWdelay_bisimulation_obs begin\n\nlemma FWdelay_bisimulation_obs_flip:\n \"FWdelay_bisimulation_obs final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_obs.intro)\n apply(rule FWdelay_bisimulation_final_base_flip)\napply(rule FWdelay_bisimulation_obs_axioms.intro)\n apply(unfold flip_simps)\n apply(rule delay_bisimulation_obs_axioms)\n apply(erule (9) bisim_inv_red_other)\n apply(erule (10) bisim_waitI)\n apply(erule (3) simulation_Wakeup2)\n apply(erule (3) simulation_Wakeup1)\napply(rule ex_final1_conv_ex_final2[symmetric])\ndone\n\nend\n\nlemma FWdelay_bisimulation_obs_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_obs final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1 = \n FWdelay_bisimulation_obs final1 r1 final2 r2 bisim bisim_wait \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_obs.FWdelay_bisimulation_obs_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_obs begin\n\nlemma mbisim_redT_upd:\n fixes s1 t ta1 x1' m1' s2 ta2 x2' m2' ln\n assumes s1': \"redT_upd s1 t ta1 x1' m1' s1'\"\n and s2': \"redT_upd s2 t ta2 x2' m2' s2'\"\n and [simp]: \"wset s1 = wset s2\" \"locks s1 = locks s2\" \n and wset: \"wset s1' = wset s2'\"\n and interrupts: \"interrupts s1' = interrupts s2'\"\n and fin1: \"finite (dom (thr s1))\"\n and wsts: \"wset_thread_ok (wset s1) (thr s1)\"\n and tst: \"thr s1 t = \\(x1, ln)\\\"\n and tst': \"thr s2 t = \\(x2, ln)\\\"\n and aoe1: \"r1.actions_ok s1 t ta1\"\n and aoe2: \"r2.actions_ok s2 t ta2\"\n and tasim: \"ta_bisim bisim ta1 ta2\"\n and bisim': \"t \\ (x1', m1') \\ (x2', m2')\"\n and bisimw: \"wset s1' t = None \\ x1' \\w x2'\"\n and \\red1: \"r1.silent_moves t (x1'', shr s1) (x1, shr s1)\"\n and red1: \"t \\ (x1, shr s1) -1-ta1\\ (x1', m1')\"\n and \\red2: \"r2.silent_moves t (x2'', shr s2) (x2, shr s2)\"\n and red2: \"t \\ (x2, shr s2) -2-ta2\\ (x2', m2')\"\n and bisim: \"t \\ (x1'', shr s1) \\ (x2'', shr s2)\"\n and \\1: \"\\ \\move1 (x1, shr s1) ta1 (x1', m1')\"\n and \\2: \"\\ \\move2 (x2, shr s2) ta2 (x2', m2')\"\n and tbisim: \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr s2 t') (shr s2)\"\n shows \"s1' \\m s2'\"\nproof(rule mbisimI)\n from fin1 s1' show \"finite (dom (thr s1'))\"\n by(auto simp add: redT_updTs_finite_dom_inv)\nnext\n from tasim s1' s2' show \"locks s1' = locks s2'\"\n by(auto simp add: redT_updLs_def o_def ta_bisim_def)\nnext\n from wset show \"wset s1' = wset s2'\" .\nnext\n from interrupts show \"interrupts s1' = interrupts s2'\" .\nnext\n from wsts s1' s2' wset show \"wset_thread_ok (wset s1') (thr s1')\"\n by(fastforce intro!: wset_thread_okI split: if_split_asm dest: redT_updTs_None wset_thread_okD redT_updWs_None_implies_None)\nnext\n fix T\n assume \"thr s1' T = None\"\n moreover with tst s1' have [simp]: \"t \\ T\" by auto\n from tbisim[OF this] have \"(thr s1 T = None) = (thr s2 T = None)\"\n by(auto simp add: tbisim_def)\n hence \"(redT_updTs (thr s1) \\ta1\\\\<^bsub>t\\<^esub> T = None) = (redT_updTs (thr s2) \\ta2\\\\<^bsub>t\\<^esub> T = None)\"\n using tasim by -(rule redT_updTs_nta_bisim_inv, simp_all add: ta_bisim_def)\n ultimately show \"thr s2' T = None\" using s2' s1' by(auto split: if_split_asm)\nnext\n fix T X1 LN\n assume tsT: \"thr s1' T = \\(X1, LN)\\\"\n show \"\\x2. thr s2' T = \\(x2, LN)\\ \\ T \\ (X1, shr s1') \\ (x2, shr s2') \\ (wset s2' T = None \\ X1 \\w x2)\"\n proof(cases \"thr s1 T\")\n case None\n with tst have \"t \\ T\" by auto\n with tbisim[OF this] None have tsT': \"thr s2 T = None\" by(simp add: tbisim_def)\n from None \\t \\ T\\ tsT aoe1 s1' obtain M1\n where ntset: \"NewThread T X1 M1 \\ set \\ta1\\\\<^bsub>t\\<^esub>\" and [simp]: \"LN = no_wait_locks\"\n by(auto dest!: redT_updTs_new_thread)\n from ntset obtain tas1 tas1' where \"\\ta1\\\\<^bsub>t\\<^esub> = tas1 @ NewThread T X1 M1 # tas1'\"\n by(auto simp add: in_set_conv_decomp)\n with tasim obtain tas2 X2 M2 tas2' where \"\\ta2\\\\<^bsub>t\\<^esub> = tas2 @ NewThread T X2 M2 # tas2'\"\n \"length tas2 = length tas2\" \"length tas1' = length tas2'\" and Bisim: \"T \\ (X1, M1) \\ (X2, M2)\"\n by(auto simp add: list_all2_append1 list_all2_Cons1 ta_bisim_def)\n hence ntset': \"NewThread T X2 M2 \\ set \\ta2\\\\<^bsub>t\\<^esub>\" by auto\n with tsT' \\t \\ T\\ aoe2 s2' have \"thr s2' T = \\(X2, no_wait_locks)\\\"\n by(auto intro: redT_updTs_new_thread_ts)\n moreover from ntset' red2 have \"m2' = M2\" by(auto dest: r2.new_thread_memory)\n moreover from ntset red1 have \"m1' = M1\"\n by(auto dest: r1.new_thread_memory)\n moreover from wsts None have \"wset s1 T = None\" by(rule wset_thread_okD)\n ultimately show ?thesis using Bisim \\t \\ T\\ s1' s2'\n by(auto simp add: redT_updWs_None_implies_None)\n next\n case (Some a)\n show ?thesis\n proof(cases \"t = T\")\n case True\n with tst tsT s1' have [simp]: \"X1 = x1'\" \"LN = redT_updLns (locks s1) t ln \\ta1\\\\<^bsub>l\\<^esub>\" by(auto)\n show ?thesis using True bisim' bisimw tasim tst tst' s1' s2' wset\n by(auto simp add: redT_updLns_def ta_bisim_def)\n next\n case False\n with Some aoe1 tsT s1' have \"thr s1 T = \\(X1, LN)\\\" by(auto dest: redT_updTs_Some)\n with tbisim[OF False] obtain X2 \n where tsT': \"thr s2 T = \\(X2, LN)\\\" and Bisim: \"T \\ (X1, shr s1) \\ (X2, shr s2)\"\n and bisimw: \"wset s1 T = None \\ X1 \\w X2\" by(auto simp add: tbisim_def)\n with aoe2 False s2' have tsT': \"thr s2' T = \\(X2, LN)\\\" by(auto simp add: redT_updTs_Some)\n moreover from Bisim bisim \\red1 red1 \\1 \\red2 red2 \\2 bisim' tasim\n have \"T \\ (X1, m1') \\ (X2, m2')\" by(rule bisim_inv_red_other)\n ultimately show ?thesis using False bisimw s1' s2'\n by(auto simp add: redT_updWs_None_implies_None)\n qed\n qed\nqed\n\ntheorem mbisim_simulation1:\n assumes mbisim: \"mbisim s1 s2\" and \"\\ m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\"\n shows \"\\s2' s2'' tl2. r2.mthr.silent_moves s2 s2' \\ r2.redT s2' tl2 s2'' \\\n \\ m\\move2 s2' tl2 s2'' \\ mbisim s1' s2'' \\ mta_bisim tl1 tl2\"\nproof -\n from assms obtain t ta1 where tl1 [simp]: \"tl1 = (t, ta1)\" and redT: \"s1 -1-t\\ta1\\ s1'\"\n and m\\: \"\\ m\\move1 s1 (t, ta1) s1'\" by(cases tl1) fastforce\n obtain ls1 ts1 m1 ws1 is1 where [simp]: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n obtain ls1' ts1' m1' ws1' is1' where [simp]: \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n obtain ls2 ts2 m2 ws2 is2 where [simp]: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n from mbisim have [simp]: \"ls2 = ls1\" \"ws2 = ws1\" \"is2 = is1\" \"finite (dom ts1)\" by(auto simp add: mbisim_def)\n from redT show ?thesis\n proof cases\n case (redT_normal x1 x1' M1')\n hence red: \"t \\ (x1, m1) -1-ta1\\ (x1', M1')\" \n and tst: \"ts1 t = \\(x1, no_wait_locks)\\\"\n and aoe: \"r1.actions_ok s1 t ta1\"\n and s1': \"redT_upd s1 t ta1 x1' M1' s1'\" by auto\n from mbisim tst obtain x2 where tst': \"ts2 t = \\(x2, no_wait_locks)\\\"\n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n from m\\ have \\: \"\\ \\move1 (x1, m1) ta1 (x1', M1')\"\n proof(rule contrapos_nn)\n assume \\: \"\\move1 (x1, m1) ta1 (x1', M1')\"\n moreover hence [simp]: \"ta1 = \\\" by(rule r1.silent_tl)\n moreover have [simp]: \"M1' = m1\" by(rule r1.\\move_heap[OF red \\, symmetric])\n ultimately show \"m\\move1 s1 (t, ta1) s1'\" using s1' tst s1'\n by(auto simp add: redT_updLs_def o_def intro: r1.m\\move.intros elim: rtrancl3p_cases)\n qed\n show ?thesis\n proof(cases \"ws1 t\")\n case None\n note wst = this\n from simulation1[OF bisim red \\] obtain x2' M2' x2'' M2'' ta2\n where red21: \"r2.silent_moves t (x2, m2) (x2', M2')\"\n and red22: \"t \\ (x2', M2') -2-ta2\\ (x2'', M2'')\" and \\2: \"\\ \\move2 (x2', M2') ta2 (x2'', M2'')\"\n and bisim': \"t \\ (x1', M1') \\ (x2'', M2'')\"\n and tasim: \"ta_bisim bisim ta1 ta2\" by auto\n let ?s2' = \"redT_upd_\\ s2 t x2' M2'\"\n let ?S2' = \"activate_cond_actions2 s1 ?s2' \\ta2\\\\<^bsub>c\\<^esub>\"\n let ?s2'' = \"(redT_updLs (locks ?S2') t \\ta2\\\\<^bsub>l\\<^esub>, ((redT_updTs (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>)(t \\ (x2'', redT_updLns (locks ?S2') t (snd (the (thr ?S2' t))) \\ta2\\\\<^bsub>l\\<^esub>)), M2''), wset s1', interrupts s1')\"\n from red21 tst' wst bisim have \"\\mRed2 s2 ?s2'\"\n by -(rule r2.silent_moves_into_RedT_\\_inv, auto)\n moreover from red21 bisim have [simp]: \"M2' = m2\" by(auto dest: r2.red_rtrancl_\\_heapD_inv)\n from tasim have [simp]: \"\\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub>\" \"\\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub>\" \"\\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub>\" \"\\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub>\"\n and nta: \"list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\" by(auto simp add: ta_bisim_def)\n from mbisim have tbisim: \"\\t. tbisim (ws1 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp add: mbisim_def)\n hence tbisim': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?s2' t') m2\" by(auto)\n from aoe have cao1: \"r1.cond_action_oks (ls1, (ts1, m1), ws1, is1) t \\ta2\\\\<^bsub>c\\<^esub>\" by auto\n from tst' have \"thr ?s2' t = \\(x2', no_wait_locks)\\\" by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n from cond_actions_oks_bisim_ex_\\2_inv[OF tbisim', OF _ tst this cao1]\n have red21': \"\\mRed2 ?s2' ?S2'\" and tbisim'': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?S2' t') m2\"\n and cao2: \"r2.cond_action_oks ?S2' t \\ta2\\\\<^bsub>c\\<^esub>\" and tst'': \"thr ?S2' t = \\(x2', no_wait_locks)\\\"\n by(auto simp del: fun_upd_apply)\n note red21' also (rtranclp_trans)\n from tbisim'' tst'' tst have \"\\t'. ts1 t' = None \\ thr ?S2' t' = None\" by(force simp add: tbisim_def)\n from aoe thread_oks_bisim_inv[OF this nta] have \"thread_oks (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>\" by simp\n with cao2 aoe have aoe': \"r2.actions_ok ?S2' t ta2\" by auto\n with red22 tst'' s1' have \"?S2' -2-t\\ta2\\ ?s2''\"\n by -(rule r2.redT.redT_normal, auto)\n moreover\n from \\2 have \"\\ m\\move2 ?S2' (t, ta2) ?s2''\"\n proof(rule contrapos_nn)\n assume m\\: \"m\\move2 ?S2' (t, ta2) ?s2''\"\n thus \"\\move2 (x2', M2') ta2 (x2'', M2'')\" using tst'' tst'\n by cases auto\n qed\n moreover\n { \n note s1'\n moreover have \"redT_upd ?S2' t ta2 x2'' M2'' ?s2''\" using s1' by auto\n moreover have \"wset s1 = wset ?S2'\" \"locks s1 = locks ?S2'\" by simp_all\n moreover have \"wset s1' = wset ?s2''\" by simp\n moreover have \"interrupts s1' = interrupts ?s2''\" by simp\n moreover have \"finite (dom (thr s1))\" by simp\n moreover from mbisim have \"wset_thread_ok (wset s1) (thr s1)\" by(simp add: mbisim_def) \n moreover from tst have \"thr s1 t = \\(x1, no_wait_locks)\\\" by simp\n moreover note tst'' aoe aoe' tasim bisim'\n moreover have \"wset s1' t = None \\ x1' \\w x2''\"\n proof(cases \"wset s1' t\")\n case None thus ?thesis ..\n next\n case (Some w)\n with wst s1' obtain w' where Suspend1: \"Suspend w' \\ set \\ta1\\\\<^bsub>w\\<^esub>\"\n by(auto dest: redT_updWs_None_SomeD)\n with tasim have Suspend2: \"Suspend w' \\ set \\ta2\\\\<^bsub>w\\<^esub>\" by(simp add: ta_bisim_def)\n from bisim_waitI[OF bisim rtranclp.rtrancl_refl red \\ _ _ _ bisim' tasim Suspend1 this, of x2'] red21 red22 \\2\n have \"x1' \\w x2''\" by auto\n thus ?thesis ..\n qed\n moreover note rtranclp.rtrancl_refl\n moreover from red have \"t \\ (x1, shr s1) -1-ta1\\ (x1', M1')\" by simp\n moreover from red21 have \"r2.silent_moves t (x2, shr ?S2') (x2', shr ?S2')\" by simp\n moreover from red22 have \"t \\ (x2', shr ?S2') -2-ta2\\ (x2'', M2'')\" by simp\n moreover from bisim have \"t \\ (x1, shr s1) \\ (x2, shr ?S2')\" by simp\n moreover from \\ have \"\\ \\move1 (x1, shr s1) ta1 (x1', M1')\" by simp\n moreover from \\2 have \"\\ \\move2 (x2', shr ?S2') ta2 (x2'', M2'')\" by simp\n moreover from tbisim'' \n have \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr ?S2' t') (shr ?S2')\" \n by simp\n ultimately have \"mbisim s1' ?s2''\" by(rule mbisim_redT_upd)\n }\n ultimately show ?thesis using tasim unfolding tl1 s1' by fastforce\n next\n case (Some w)\n with mbisim tst tst' have \"x1 \\w x2\"\n by(auto dest: mbisim_thrD1)\n from aoe Some have wakeup: \"Notified \\ set \\ta1\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta1\\\\<^bsub>w\\<^esub>\"\n by(auto simp add: wset_actions_ok_def split: if_split_asm)\n from simulation_Wakeup1[OF bisim \\x1 \\w x2\\ red this]\n obtain ta2 x2' m2' where red2: \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n and bisim': \"t \\ (x1', M1') \\ (x2', m2')\"\n and tasim: \"ta1 \\m ta2\" by auto\n\n let ?S2' = \"activate_cond_actions2 s1 s2 \\ta2\\\\<^bsub>c\\<^esub>\"\n\n let ?s2' = \"(redT_updLs (locks ?S2') t \\ta2\\\\<^bsub>l\\<^esub>, ((redT_updTs (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>)(t \\ (x2', redT_updLns (locks ?S2') t (snd (the (thr ?S2' t))) \\ta2\\\\<^bsub>l\\<^esub>)), m2'), wset s1', interrupts s1')\"\n\n from tasim have [simp]: \"\\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub>\" \"\\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub>\" \"\\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub>\" \"\\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub>\"\n and nta: \"list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\" by(auto simp add: ta_bisim_def)\n from mbisim have tbisim: \"\\t. tbisim (ws1 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp add: mbisim_def)\n hence tbisim': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr s2 t') m2\" by(auto)\n from aoe have cao1: \"r1.cond_action_oks (ls1, (ts1, m1), ws1, is1) t \\ta2\\\\<^bsub>c\\<^esub>\" by auto\n from tst' have \"thr s2 t = \\(x2, no_wait_locks)\\\"\n by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n from cond_actions_oks_bisim_ex_\\2_inv[OF tbisim', OF _ tst this cao1]\n have red21': \"\\mRed2 s2 ?S2'\" and tbisim'': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?S2' t') m2\"\n and cao2: \"r2.cond_action_oks ?S2' t \\ta2\\\\<^bsub>c\\<^esub>\" and tst'': \"thr ?S2' t = \\(x2, no_wait_locks)\\\"\n by(auto simp del: fun_upd_apply)\n note red21' moreover\n from tbisim'' tst'' tst have \"\\t'. ts1 t' = None \\ thr ?S2' t' = None\" by(force simp add: tbisim_def)\n from aoe thread_oks_bisim_inv[OF this nta] have \"thread_oks (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>\" by simp\n with cao2 aoe have aoe': \"r2.actions_ok ?S2' t ta2\" by auto\n with red2 tst'' s1' tasim have \"?S2' -2-t\\ta2\\ ?s2'\"\n by -(rule r2.redT_normal, auto simp add: ta_bisim_def)\n moreover from wakeup tasim\n have \\2: \"\\ \\move2 (x2, m2) ta2 (x2', m2')\" by(auto dest: r2.silent_tl)\n hence \"\\ m\\move2 ?S2' (t, ta2) ?s2'\"\n proof(rule contrapos_nn)\n assume m\\: \"m\\move2 ?S2' (t, ta2) ?s2'\"\n thus \"\\move2 (x2, m2) ta2 (x2', m2')\" using tst'' tst'\n by cases auto\n qed\n moreover {\n note s1'\n moreover have \"redT_upd ?S2' t ta2 x2' m2' ?s2'\" using s1' tasim by(auto simp add: ta_bisim_def)\n moreover have \"wset s1 = wset ?S2'\" \"locks s1 = locks ?S2'\" by simp_all\n moreover have \"wset s1' = wset ?s2'\" by simp\n moreover have \"interrupts s1' = interrupts ?s2'\" by simp\n moreover have \"finite (dom (thr s1))\" by simp\n moreover from mbisim have \"wset_thread_ok (wset s1) (thr s1)\" by(rule mbisim_wset_thread_ok1)\n moreover from tst have \"thr s1 t = \\(x1, no_wait_locks)\\\" by simp\n moreover from tst'' have \"thr ?S2' t = \\(x2, no_wait_locks)\\\" by simp\n moreover note aoe aoe' tasim bisim'\n moreover have \"wset s1' t = None \\ x1' \\w x2'\"\n proof(cases \"wset s1' t\")\n case None thus ?thesis ..\n next\n case (Some w')\n with redT_updWs_WokenUp_SuspendD[OF _ wakeup, of t \"wset s1\" \"wset s1'\" w'] s1'\n obtain w' where Suspend1: \"Suspend w' \\ set \\ta1\\\\<^bsub>w\\<^esub>\" by(auto)\n with tasim have Suspend2: \"Suspend w' \\ set \\ta2\\\\<^bsub>w\\<^esub>\" by(simp add: ta_bisim_def)\n with bisim rtranclp.rtrancl_refl red \\ rtranclp.rtrancl_refl red2 \\2 bisim' tasim Suspend1\n have \"x1' \\w x2'\" by(rule bisim_waitI)\n thus ?thesis ..\n qed\n moreover note rtranclp.rtrancl_refl\n moreover from red have \"t \\ (x1, shr s1) -1-ta1\\ (x1', M1')\" by simp\n moreover note rtranclp.rtrancl_refl\n moreover from red2 have \"t \\ (x2, shr ?S2') -2-ta2\\ (x2', m2')\" by simp\n moreover from bisim have \"t \\ (x1, shr s1) \\ (x2, shr ?S2')\" by simp\n moreover from \\ have \"\\ \\move1 (x1, shr s1) ta1 (x1', M1')\" by simp\n moreover from \\2 have \"\\ \\move2 (x2, shr ?S2') ta2 (x2', m2')\" by simp\n moreover from tbisim'' have \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr ?S2' t') (shr ?S2')\" by simp\n ultimately have \"s1' \\m ?s2'\" by(rule mbisim_redT_upd) }\n moreover from tasim have \"tl1 \\T (t, ta2)\" by simp\n ultimately show ?thesis unfolding s1' by blast\n qed\n next\n case (redT_acquire x1 n ln)\n hence [simp]: \"ta1 = (K$ [], [], [], [], [], convert_RA ln)\"\n and tst: \"thr s1 t = \\(x1, ln)\\\" and wst: \"\\ waiting (wset s1 t)\"\n and maa: \"may_acquire_all (locks s1) t ln\" and ln: \"0 < ln $ n\"\n and s1': \"s1' = (acquire_all ls1 t ln, (ts1(t \\ (x1, no_wait_locks)), m1), ws1, is1)\" by auto\n from tst mbisim obtain x2 where tst': \"ts2 t = \\(x2, ln)\\\" \n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n let ?s2' = \"(acquire_all ls1 t ln, (ts2(t \\ (x2, no_wait_locks)), m2), ws1, is1)\"\n from tst' wst maa ln have \"s2 -2-t\\(K$ [], [], [], [], [], convert_RA ln)\\ ?s2'\"\n by-(rule r2.redT.redT_acquire, auto)\n moreover from tst' ln have \"\\ m\\move2 s2 (t, (K$ [], [], [], [], [], convert_RA ln)) ?s2'\"\n by(auto simp add: acquire_all_def fun_eq_iff elim!: r2.m\\move.cases)\n moreover have \"mbisim s1' ?s2'\"\n proof(rule mbisimI)\n from s1' show \"locks s1' = locks ?s2'\" by auto\n next\n from s1' show \"wset s1' = wset ?s2'\" by auto\n next\n from s1' show \"interrupts s1' = interrupts ?s2'\" by auto\n next\n fix t' assume \"thr s1' t' = None\"\n with s1' have \"thr s1 t' = None\" by(auto split: if_split_asm)\n with mbisim_thrNone_eq[OF mbisim] have \"ts2 t' = None\" by simp\n with tst' show \"thr ?s2' t' = None\" by auto\n next\n fix t' X1 LN\n assume ts't: \"thr s1' t' = \\(X1, LN)\\\"\n show \"\\x2. thr ?s2' t' = \\(x2, LN)\\ \\ t' \\ (X1, shr s1') \\ (x2, shr ?s2') \\ (wset ?s2' t' = None \\ X1 \\w x2)\"\n proof(cases \"t' = t\")\n case True\n with s1' tst ts't have [simp]: \"X1 = x1\" \"LN = no_wait_locks\" by simp_all\n with mbisim_thrD1[OF mbisim tst] bisim tst tst' True s1' wst show ?thesis by(auto)\n next\n case False\n with ts't s1' have \"ts1 t' = \\(X1, LN)\\\" by auto\n with mbisim obtain X2 where \"ts2 t' = \\(X2, LN)\\\" \"t' \\ (X1, m1) \\ (X2, m2)\" \"wset ?s2' t' = None \\ X1 \\w X2\"\n by(auto dest: mbisim_thrD1)\n with False s1' show ?thesis by auto\n qed\n next\n from s1' show \"finite (dom (thr s1'))\" by auto\n next\n from mbisim_wset_thread_ok1[OF mbisim]\n show \"wset_thread_ok (wset s1') (thr s1')\" using s1' by(auto intro: wset_thread_ok_upd)\n qed\n moreover have \"(t, K$ [], [], [], [], [], convert_RA ln) \\T (t, K$ [], [], [], [], [], convert_RA ln)\"\n by(simp add: ta_bisim_def)\n ultimately show ?thesis by fastforce\n qed\nqed\n\ntheorem mbisim_simulation2:\n \"\\ mbisim s1 s2; r2.redT s2 tl2 s2'; \\ m\\move2 s2 tl2 s2' \\\n \\ \\s1' s1'' tl1. r1.mthr.silent_moves s1 s1' \\ r1.redT s1' tl1 s1'' \\ \\ m\\move1 s1' tl1 s1'' \\\n mbisim s1'' s2' \\ mta_bisim tl1 tl2\"\nusing FWdelay_bisimulation_obs.mbisim_simulation1[OF FWdelay_bisimulation_obs_flip]\nunfolding flip_simps .\n\nend\n\nlocale FWdelay_bisimulation_diverge =\n FWdelay_bisimulation_obs _ _ _ _ _ _ _ \\move1 \\move2\n for \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\" +\n assumes delay_bisimulation_diverge_locale: \"delay_bisimulation_diverge (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n\nsublocale FWdelay_bisimulation_diverge <\n delay_bisimulation_diverge \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule delay_bisimulation_diverge_locale)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma FWdelay_bisimulation_diverge_flip:\n \"FWdelay_bisimulation_diverge final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_diverge.intro)\n apply(rule FWdelay_bisimulation_obs_flip)\napply(rule FWdelay_bisimulation_diverge_axioms.intro)\napply(unfold flip_simps)\napply(rule delay_bisimulation_diverge_axioms)\ndone\n\nend\n\nlemma FWdelay_bisimulation_diverge_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_diverge final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1 = \n FWdelay_bisimulation_diverge final1 r1 final2 r2 bisim bisim_wait \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_diverge.FWdelay_bisimulation_diverge_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma bisim_inv1:\n assumes bisim: \"t \\ s1 \\ s2\"\n and red: \"t \\ s1 -1-ta1\\ s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n show \"\\s2'. t \\ s1' \\ s2'\"\n proof(cases \"\\move1 s1 ta1 s1'\")\n case True\n with red have \"r1.silent_move t s1 s1'\" by auto\n from simulation_silent1[OF bisim this]\n show ?thesis by auto\n next\n case False\n from simulation1[OF bisim red False] show ?thesis by auto\n qed\nqed\n\nlemma bisim_inv2:\n assumes \"t \\ s1 \\ s2\" \"t \\ s2 -2-ta2\\ s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nusing assms FWdelay_bisimulation_diverge.bisim_inv1[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps by blast\n\nlemma bisim_inv: \"bisim_inv\"\nby(blast intro!: bisim_invI elim: bisim_inv1 bisim_inv2)\n\nlemma bisim_inv_\\s1:\n assumes \"t \\ s1 \\ s2\" and \"r1.silent_moves t s1 s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nusing assms by(rule bisim_inv_\\s1_inv[OF bisim_inv])\n\nlemma bisim_inv_\\s2:\n assumes \"t \\ s1 \\ s2\" and \"r2.silent_moves t s2 s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nusing assms by(rule bisim_inv_\\s2_inv[OF bisim_inv])\n\nlemma red1_rtrancl_\\_into_RedT_\\:\n assumes \"r1.silent_moves t (x1, shr s1) (x1', m1')\" \"t \\ (x1, shr s1) \\ (x2, m2)\"\n and \"thr s1 t = \\(x1, no_wait_locks)\\\" \"wset s1 t = None\"\n shows \"\\mRed1 s1 (redT_upd_\\ s1 t x1' m1')\"\nusing assms by(blast intro: r1.silent_moves_into_RedT_\\_inv)\n\nlemma red2_rtrancl_\\_into_RedT_\\:\n assumes \"r2.silent_moves t (x2, shr s2) (x2', m2')\"\n and \"t \\ (x1, m1) \\ (x2, shr s2)\" \"thr s2 t = \\(x2, no_wait_locks)\\\" \"wset s2 t = None\"\n shows \"\\mRed2 s2 (redT_upd_\\ s2 t x2' m2')\"\nusing assms by(blast intro: r2.silent_moves_into_RedT_\\_inv)\n\nlemma red1_rtrancl_\\_heapD:\n \"\\ r1.silent_moves t s1 s1'; t \\ s1 \\ s2 \\ \\ snd s1' = snd s1\"\nby(blast intro: r1.red_rtrancl_\\_heapD_inv)\n\nlemma red2_rtrancl_\\_heapD:\n \"\\ r2.silent_moves t s2 s2'; t \\ s1 \\ s2 \\ \\ snd s2' = snd s2\"\nby(blast intro: r2.red_rtrancl_\\_heapD_inv)\n\nlemma mbisim_simulation_silent1:\n assumes m\\': \"r1.mthr.silent_move s1 s1'\" and mbisim: \"s1 \\m s2\"\n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1' \\m s2'\"\nproof -\n from m\\' obtain tl1 where m\\: \"m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\" by auto\n obtain ls1 ts1 m1 ws1 is1 where [simp]: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n obtain ls1' ts1' m1' ws1' is1' where [simp]: \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n obtain ls2 ts2 m2 ws2 is2 where [simp]: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n from m\\ obtain t where \"tl1 = (t, \\)\" by(auto elim!: r1.m\\move.cases dest: r1.silent_tl)\n with m\\ have m\\: \"m\\move1 s1 (t, \\) s1'\" and redT1: \"s1 -1-t\\\\\\ s1'\" by simp_all\n from m\\ obtain x x' ln' where tst: \"ts1 t = \\(x, no_wait_locks)\\\"\n and ts't: \"ts1' t = \\(x', ln')\\\" and \\: \"\\move1 (x, m1) \\ (x', m1')\"\n by(fastforce elim: r1.m\\move.cases)\n from mbisim have [simp]: \"ls2 = ls1\" \"ws2 = ws1\" \"is2 = is1\" \"finite (dom ts1)\" by(auto simp add: mbisim_def)\n from redT1 show ?thesis\n proof cases\n case (redT_normal x1 x1' M')\n with tst ts't have [simp]: \"x = x1\" \"x' = x1'\"\n and red: \"t \\ (x1, m1) -1-\\\\ (x1', M')\"\n and tst: \"thr s1 t = \\(x1, no_wait_locks)\\\"\n and wst: \"wset s1 t = None\"\n and s1': \"redT_upd s1 t \\ x1' M' s1'\" by(auto)\n from s1' tst have [simp]: \"ls1' = ls1\" \"ws1' = ws1\" \"is1' = is1\" \"M' = m1'\" \"ts1' = ts1(t \\ (x1', no_wait_locks))\"\n by(auto simp add: redT_updLs_def redT_updLns_def o_def redT_updWs_def elim!: rtrancl3p_cases)\n from mbisim tst obtain x2 where tst': \"ts2 t = \\(x2, no_wait_locks)\\\"\n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n from r1.\\move_heap[OF red] \\ have [simp]: \"m1 = M'\" by simp\n from red \\ have \"r1.silent_move t (x1, m1) (x1', M')\" by auto\n from simulation_silent1[OF bisim this]\n obtain x2' m2' where red: \"r2.silent_moves t (x2, m2) (x2', m2')\"\n and bisim': \"t \\ (x1', m1) \\ (x2', m2')\" by auto\n from red bisim have [simp]: \"m2' = m2\" \n by(auto dest: red2_rtrancl_\\_heapD)\n let ?s2' = \"redT_upd_\\ s2 t x2' m2'\"\n from red tst' wst bisim have \"\\mRed2 s2 ?s2'\"\n by -(rule red2_rtrancl_\\_into_RedT_\\, auto)\n moreover have \"mbisim s1' ?s2'\"\n proof(rule mbisimI)\n show \"locks s1' = locks ?s2'\" \"wset s1' = wset ?s2'\" \"interrupts s1' = interrupts ?s2'\" by auto\n next\n fix t'\n assume \"thr s1' t' = None\"\n hence \"ts1 t' = None\" by(auto split: if_split_asm)\n with mbisim_thrNone_eq[OF mbisim] have \"ts2 t' = None\" by simp\n with tst' show \"thr ?s2' t' = None\" by auto\n next\n fix t' X1 LN\n assume ts't': \"thr s1' t' = \\(X1, LN)\\\"\n show \"\\x2. thr ?s2' t' = \\(x2, LN)\\ \\ t' \\ (X1, shr s1') \\ (x2, shr ?s2') \\ (wset ?s2' t' = None \\ X1 \\w x2)\"\n proof(cases \"t' = t\")\n case True\n note this[simp]\n with s1' tst ts't' have [simp]: \"X1 = x1'\" \"LN = no_wait_locks\"\n by(simp_all)(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n with bisim' tst' wst show ?thesis by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n next\n case False\n with ts't' have \"ts1 t' = \\(X1, LN)\\\" by auto\n with mbisim obtain X2 where \"ts2 t' = \\(X2, LN)\\\" \"t' \\ (X1, m1) \\ (X2, m2)\" \"ws1 t' = None \\ X1 \\w X2\"\n by(auto dest: mbisim_thrD1)\n with False show ?thesis by auto\n qed\n next\n show \"finite (dom (thr s1'))\" by simp\n next\n from mbisim_wset_thread_ok1[OF mbisim]\n show \"wset_thread_ok (wset s1') (thr s1')\" by(auto intro: wset_thread_ok_upd)\n qed\n ultimately show ?thesis by(auto)\n next\n case redT_acquire\n with tst have False by auto\n thus ?thesis ..\n qed\nqed\n\nlemma mbisim_simulation_silent2:\n \"\\ mbisim s1 s2; r2.mthr.silent_move s2 s2' \\\n \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ mbisim s1' s2'\"\nusing FWdelay_bisimulation_diverge.mbisim_simulation_silent1[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps .\n\nlemma mbisim_simulation1':\n assumes mbisim: \"mbisim s1 s2\" and \"\\ m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\"\n shows \"\\s2' s2'' tl2. r2.mthr.silent_moves s2 s2' \\ r2.redT s2' tl2 s2'' \\\n \\ m\\move2 s2' tl2 s2'' \\ mbisim s1' s2'' \\ mta_bisim tl1 tl2\"\nusing mbisim_simulation1 assms .\n\nlemma mbisim_simulation2':\n \"\\ mbisim s1 s2; r2.redT s2 tl2 s2'; \\ m\\move2 s2 tl2 s2' \\\n \\ \\s1' s1'' tl1. r1.mthr.silent_moves s1 s1' \\ r1.redT s1' tl1 s1'' \\ \\ m\\move1 s1' tl1 s1'' \\\n mbisim s1'' s2' \\ mta_bisim tl1 tl2\"\nusing FWdelay_bisimulation_diverge.mbisim_simulation1'[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps .\n\nlemma m\\diverge_simulation1:\n assumes \"s1 \\m s2\"\n and \"r1.mthr.\\diverge s1\"\n shows \"r2.mthr.\\diverge s2\"\nproof -\n from \\s1 \\m s2\\ have \"finite (dom (thr s1))\"\n by(rule mbisim_finite1)+\n from r1.\\diverge_\\mredTD[OF \\r1.mthr.\\diverge s1\\ this]\n obtain t x where \"thr s1 t = \\(x, no_wait_locks)\\\" \"wset s1 t = None\" \"r1.\\diverge t (x, shr s1)\" by blast\n from \\s1 \\m s2\\ \\thr s1 t = \\(x, no_wait_locks)\\\\ obtain x'\n where \"thr s2 t = \\(x', no_wait_locks)\\\" \"t \\ (x, shr s1) \\ (x', shr s2)\"\n by(auto dest: mbisim_thrD1)\n from \\s1 \\m s2\\ \\wset s1 t = None\\ have \"wset s2 t = None\" by(simp add: mbisim_def)\n from \\t \\ (x, shr s1) \\ (x', shr s2)\\ \\r1.\\diverge t (x, shr s1)\\\n have \"r2.\\diverge t (x', shr s2)\" by(simp add: \\diverge_bisim_inv)\n thus ?thesis using \\thr s2 t = \\(x', no_wait_locks)\\\\ \\wset s2 t = None\\\n by(rule r2.\\diverge_into_\\mredT)\nqed\n\nlemma \\diverge_mbisim_inv:\n \"s1 \\m s2 \\ r1.mthr.\\diverge s1 \\ r2.mthr.\\diverge s2\"\napply(rule iffI)\n apply(erule (1) m\\diverge_simulation1)\nby(rule FWdelay_bisimulation_diverge.m\\diverge_simulation1[OF FWdelay_bisimulation_diverge_flip, unfolded flip_simps])\n\nlemma mbisim_delay_bisimulation:\n \"delay_bisimulation_diverge r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\"\napply(unfold_locales)\napply(rule mbisim_simulation1 mbisim_simulation2 mbisim_simulation_silent1 mbisim_simulation_silent2 \\diverge_mbisim_inv|assumption)+\ndone\n\ntheorem mdelay_bisimulation_final_base:\n \"delay_bisimulation_final_base r1.redT r2.redT mbisim m\\move1 m\\move2 r1.mfinal r2.mfinal\"\napply(unfold_locales)\napply(blast dest: mfinal1_simulation mfinal2_simulation)+\ndone\n\nend\n\nsublocale FWdelay_bisimulation_diverge < mthr: delay_bisimulation_diverge r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\nby(rule mbisim_delay_bisimulation)\n\nsublocale FWdelay_bisimulation_diverge <\n mthr: delay_bisimulation_final_base r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\nby(rule mdelay_bisimulation_final_base)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma mthr_delay_bisimulation_diverge_final:\n \"delay_bisimulation_diverge_final r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\"\nby(unfold_locales)\n\nend\n\nsublocale FWdelay_bisimulation_diverge <\n mthr: delay_bisimulation_diverge_final r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\nby(rule mthr_delay_bisimulation_diverge_final)\n\nsubsection \\Strong bisimulation as corollary\\\n\nlocale FWbisimulation = FWbisimulation_base _ _ _ r2 convert_RA bisim \"\\x1 x2. True\" +\n r1: multithreaded final1 r1 convert_RA +\n r2: multithreaded final2 r2 convert_RA\n for r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50,0,0,50] 80)\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60) +\n assumes bisimulation_locale: \"bisimulation (r1 t) (r2 t) (bisim t) (ta_bisim bisim)\"\n and bisim_final: \"t \\ (x1, m1) \\ (x2, m2) \\ final1 x1 \\ final2 x2\"\n and bisim_inv_red_other:\n \"\\ t' \\ (x, m1) \\ (xx, m2); t \\ (x1, m1) \\ (x2, m2); \n t \\ (x1, m1) -1-ta1\\ (x1', m1'); t \\ (x2, m2) -2-ta2\\ (x2', m2'); \n t \\ (x1', m1') \\ (x2', m2'); ta_bisim bisim ta1 ta2 \\\n \\ t' \\ (x, m1') \\ (xx, m2')\"\n and ex_final1_conv_ex_final2:\n \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\"\n\nsublocale FWbisimulation < bisim?: bisimulation \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" for t\nby(rule bisimulation_locale)\n\nsublocale FWbisimulation < bisim_diverge?:\n FWdelay_bisimulation_diverge final1 r1 final2 r2 convert_RA bisim \"\\x1 x2. True\" \"\\s ta s'. False\" \"\\s ta s'. False\"\nproof -\n interpret biw: bisimulation_into_delay \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \"\\s ta s'. False\" \"\\s ta s'. False\"\n for t\n by(unfold_locales) simp\n show \"FWdelay_bisimulation_diverge final1 r1 final2 r2 bisim (\\x1 x2. True) (\\s ta s'. False) (\\s ta s'. False)\"\n proof(unfold_locales)\n fix t' x m1 xx m2 x1 x2 t x1' ta1 x1'' m1' x2' ta2 x2'' m2'\n assume bisim: \"t' \\ (x, m1) \\ (xx, m2)\" and bisim12: \"t \\ (x1, m1) \\ (x2, m2)\"\n and \\1: \"\\trsys.silent_moves (r1 t) (\\s ta s'. False) (x1, m1) (x1', m1)\" \n and red1: \"t \\ (x1', m1) -1-ta1\\ (x1'', m1')\"\n and \\2: \"\\trsys.silent_moves (r2 t) (\\s ta s'. False) (x2, m2) (x2', m2)\"\n and red2: \"t \\ (x2', m2) -2-ta2\\ (x2'', m2')\"\n and bisim12': \"t \\ (x1'', m1') \\ (x2'', m2')\" and tasim: \"ta1 \\m ta2\"\n from \\1 \\2 have [simp]: \"x1' = x1\" \"x2' = x2\" by(simp_all add: rtranclp_False \\moves_False)\n from bisim12 bisim_inv_red_other[OF bisim _ red1 red2 bisim12' tasim]\n show \"t' \\ (x, m1') \\ (xx, m2')\" by simp\n next\n fix t x1 m1 x2 m2 ta1 x1' m1'\n assume \"t \\ (x1, m1) \\ (x2, m2)\" \"t \\ (x1, m1) -1-ta1\\ (x1', m1')\"\n from simulation1[OF this]\n show \"\\ta2 x2' m2'. t \\ (x2, m2) -2-ta2\\ (x2', m2') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta1 \\m ta2\"\n by auto\n next\n fix t x1 m1 x2 m2 ta2 x2' m2'\n assume \"t \\ (x1, m1) \\ (x2, m2)\" \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n from simulation2[OF this]\n show \"\\ta1 x1' m1'. t \\ (x1, m1) -1-ta1\\ (x1', m1') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta1 \\m ta2\"\n by auto\n next\n show \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\" by(rule ex_final1_conv_ex_final2)\n qed(fastforce simp add: bisim_final)+\nqed\n\ncontext FWbisimulation begin\n\nlemma FWbisimulation_flip: \"FWbisimulation final2 r2 final1 r1 (\\t. flip (bisim t))\"\napply(rule FWbisimulation.intro)\n apply(rule r2.multithreaded_axioms)\n apply(rule r1.multithreaded_axioms)\napply(rule FWbisimulation_axioms.intro)\n apply(unfold flip_simps)\n apply(rule bisimulation_axioms)\n apply(erule bisim_final[symmetric])\n apply(erule (5) bisim_inv_red_other)\napply(rule ex_final1_conv_ex_final2[symmetric])\ndone\n\nend\n\n\n\ncontext FWbisimulation begin\n\ntext \\\n The notation for mbisim is lost because @{term \"bisim_wait\"} is instantiated to @{term \"\\x1 x2. True\"}.\n This reintroduces the syntax, but it does not work for output mode. This would require a new abbreviation.\n\\\nnotation mbisim (\"_ \\m _\" [50, 50] 60)\n\ntheorem mbisim_bisimulation:\n \"bisimulation r1.redT r2.redT mbisim mta_bisim\"\nproof\n fix s1 s2 tta1 s1'\n assume mbisim: \"s1 \\m s2\" and \"r1.redT s1 tta1 s1'\"\n from mthr.simulation1[OF this]\n show \"\\s2' tta2. r2.redT s2 tta2 s2' \\ s1' \\m s2' \\ tta1 \\T tta2\"\n by(auto simp add: \\moves_False m\\move_False)\nnext\n fix s2 s1 tta2 s2'\n assume \"s1 \\m s2\" and \"r2.redT s2 tta2 s2'\"\n from mthr.simulation2[OF this]\n show \"\\s1' tta1. r1.redT s1 tta1 s1' \\ s1' \\m s2' \\ tta1 \\T tta2\"\n by(auto simp add: \\moves_False m\\move_False)\nqed\n\nlemma mbisim_wset_eq:\n \"s1 \\m s2 \\ wset s1 = wset s2\"\nby(simp add: mbisim_def)\n\nlemma mbisim_mfinal:\n \"s1 \\m s2 \\ r1.mfinal s1 \\ r2.mfinal s2\"\napply(auto intro!: r2.mfinalI r1.mfinalI dest: mbisim_thrD2 mbisim_thrD1 bisim_final elim: r1.mfinalE r2.mfinalE)\napply(frule (1) mbisim_thrD2, drule mbisim_wset_eq, auto elim: r1.mfinalE)\napply(frule (1) mbisim_thrD1, drule mbisim_wset_eq, auto elim: r2.mfinalE)\ndone\n\nend\n\nsublocale FWbisimulation < mthr: bisimulation r1.redT r2.redT mbisim mta_bisim\nby(rule mbisim_bisimulation)\n\nsublocale FWbisimulation < mthr: bisimulation_final r1.redT r2.redT mbisim mta_bisim r1.mfinal r2.mfinal\nby(unfold_locales)(rule mbisim_mfinal)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/FWBisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3812195662561499, "lm_q1q2_score": 0.19805169301539846}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__21_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__21_on_rules imports n_german_lemma_on_inv__21\nbegin\nsection{*All lemmas on causal relation between inv__21*}\nlemma lemma_inv__21_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__21) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__21_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.352201788847459, "lm_q1q2_score": 0.19799956925998322}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__9_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__9_on_rules imports n_german_lemma_on_inv__9\nbegin\nsection{*All lemmas on causal relation between inv__9*}\nlemma lemma_inv__9_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__9 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__9) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__9_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.35936415888237616, "lm_q1q2_score": 0.1978685527900127}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__49_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__49_on_rules imports n_german_lemma_on_inv__49\nbegin\nsection{*All lemmas on causal relation between inv__49*}\nlemma lemma_inv__49_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__49) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__49_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.35936413829896496, "lm_q1q2_score": 0.19786854145663482}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory HeapRawState\nimports CTypes\nbegin\n\ntype_synonym typ_base = bool\ndatatype s_heap_index = SIndexVal | SIndexTyp nat\ndatatype s_heap_value = SValue byte | STyp \"typ_uinfo \\ typ_base\"\n\nprimrec (nonexhaustive) s_heap_tag :: \"s_heap_value \\ typ_uinfo \\ typ_base\" where\n \"s_heap_tag (STyp t) = t\"\n\ntype_synonym typ_slice = \"nat \\ typ_uinfo \\ typ_base\"\n(* heap_typ_desc = \"addr \\ tag_ladder\"*)\ntype_synonym s_addr = \"addr \\ s_heap_index\"\ntype_synonym heap_state = \"s_addr \\ s_heap_value\"\ntype_synonym heap_typ_desc = \"addr \\ bool \\ typ_slice\"\ntype_synonym heap_raw_state = \"heap_mem \\ heap_typ_desc\"\n\n(* Used in the C parser to avoid loss of information about the relative\n ordering of heap_updates and ptr_tags, as this order conveys the intention\n of the type of a memory location that can be helpful when reducing over\n multiple updates of both the heap memory state and heap type description\n*)\n\ndefinition hrs_mem :: \"heap_raw_state \\ heap_mem\" where\n \"hrs_mem \\ fst\"\n\ndefinition hrs_mem_update :: \"(heap_mem \\ heap_mem) \\ heap_raw_state \\ heap_raw_state\" where\n \"hrs_mem_update f \\ \\(h,d). (f h,d)\"\n\ndefinition hrs_htd :: \"heap_raw_state \\ heap_typ_desc\" where\n \"hrs_htd \\ snd\"\n\ndefinition hrs_htd_update :: \"(heap_typ_desc \\ heap_typ_desc) \\ heap_raw_state \\ heap_raw_state\"\n where\n \"hrs_htd_update f \\ \\(h,d). (h,f d)\"\n\n\nlemma hrs_comm:\n \"hrs_htd_update d (hrs_mem_update h s) = hrs_mem_update h (hrs_htd_update d s)\"\n by (simp add: hrs_htd_update_def hrs_mem_update_def split_def)\n\nlemma hrs_htd_update_htd_update:\n \"(\\s. hrs_htd_update d (hrs_htd_update d' s)) = hrs_htd_update (d \\ d')\"\n by (simp add: hrs_htd_update_def split_def)\n\nlemma hrs_htd_mem_update [simp]:\n \"hrs_htd (hrs_mem_update f s) = hrs_htd s\"\n by (simp add: hrs_mem_update_def hrs_htd_def split_def)\n\nlemma hrs_mem_htd_update [simp]:\n \"hrs_mem (hrs_htd_update f s) = hrs_mem s\"\n by (simp add: hrs_htd_update_def hrs_mem_def split_def)\n\nlemma hrs_mem_update:\n \"hrs_mem (hrs_mem_update f s) = (f (hrs_mem s))\"\n by (simp add: hrs_mem_update_def hrs_mem_def split_def)\n\nlemma hrs_htd_update:\n \"hrs_htd (hrs_htd_update f s) = (f (hrs_htd s))\"\n by (simp add: hrs_htd_update_def hrs_htd_def split_def)\n\nlemmas hrs_update = hrs_mem_update hrs_htd_update\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/HeapRawState.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.3593641314378279, "lm_q1q2_score": 0.19786853767884227}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__50_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__50_on_rules imports n_g2kAbsAfter_lemma_on_inv__50\nbegin\nsection{*All lemmas on causal relation between inv__50*}\nlemma lemma_inv__50_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__50 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__50) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__50_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.33807711081162, "lm_q1q2_score": 0.1978093077455726}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Recycle_C\nimports Delete_C Retype_C\nbegin\n\ncontext kernel_m\nbegin\n\nlemma isArchPageCap_ArchObjectCap:\n \"isArchPageCap (ArchObjectCap acap)\n = isPageCap acap\"\n by (simp add: isArchPageCap_def isPageCap_def)\n\ndefinition\n \"replicateHider \\ replicate\"\n\nlemma collapse_foldl_replicate:\n \"replicate (length xs) v = xs \\\n foldl (@) [] (map (\\_. xs) ys)\n = replicateHider (length xs * length ys) v\"\n apply (induct ys rule: rev_induct)\n apply (simp add: replicateHider_def)\n apply (simp add: replicateHider_def)\n apply (subst add.commute, simp add: replicate_add)\n done\n\nlemma coerce_memset_to_heap_update_user_data:\n \"heap_update_list x (replicateHider 4096 0)\n = heap_update (Ptr x :: user_data_C ptr)\n (user_data_C (FCP (\\_. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps user_data_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps\n user_context_C_tag_def thread_state_C_tag_def seL4_Fault_C_tag_def\n lookup_fault_C_tag_def update_ti_t_ptr_0s\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n ti_typ_combine_empty_ti ti_typ_combine_td\n align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n align_td_array' size_td_array)\n apply (simp add: typ_info_array')\n apply (subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: typ_info_word typ_info_ptr word_rsplit_0)\n apply fastforce\n apply (simp add: collapse_foldl_replicate word_bits_def)\n done\n\nlemma clift_foldl_hrs_mem_update:\n \"\\ \\x \\ set xs. hrs_htd s \\\\<^sub>t f x;\n \\x s. hrs_htd s \\\\<^sub>t f x \\ clift (hrs_mem_update (heap_update (f x) v) s)\n = g (clift s :: ('a :: c_type) ptr \\ 'a) x \\\n \\\n clift (hrs_mem_update (\\s. foldl (\\s x. heap_update (f x) v s) s xs) s)\n = foldl g (clift s :: 'a ptr \\ 'a) xs\"\n using [[hypsubst_thin]]\n apply (cases s, clarsimp)\n apply (induct xs arbitrary: a b)\n apply (simp add: hrs_mem_update_def)\n apply (clarsimp simp add: hrs_mem_update_def split_def hrs_htd_def)\n done\n\nlemma map_to_user_data_aligned:\n \"\\ map_to_user_data (ksPSpace s) x = Some y; pspace_aligned' s \\\n \\ is_aligned x pageBits\"\n apply (clarsimp simp: map_comp_eq projectKOs split: option.split_asm)\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps)\n done\n\nlemma help_force_intvl_range_conv:\n \"\\ is_aligned (p::machine_word) n; v = 2 ^ n; n < word_bits \\\n \\ {p ..+ v} = {p .. p + 2 ^ n - 1}\"\n by (simp add: intvl_range_conv word_bits_def)\n\nlemma cmap_relation_If_upd:\n \"\\ cmap_relation f g ptrfun rel; rel v v'; ptrfun ` S = S'; inj ptrfun \\\n \\ cmap_relation (\\x. if x \\ S then Some v else f x)\n (\\y. if y \\ S' then Some v' else g y)\n ptrfun rel\"\n apply (simp add: cmap_relation_def dom_If_Some)\n apply (rule context_conjI)\n apply blast\n apply clarsimp\n apply (case_tac \"x \\ S\")\n apply simp\n apply clarsimp\n apply (subst if_not_P)\n apply (clarsimp simp: inj_eq)\n apply (drule bspec, erule domI)\n apply simp\n done\n\nlemma length_replicateHider [simp]:\n \"length (replicateHider n x) = n\"\n by (simp add: replicateHider_def)\n\nlemma coerce_heap_update_to_heap_updates':\n \"n = chunk * m \\\n heap_update_list x (replicateHider n 0)\n = (\\s. foldl (\\s x. heap_update_list x (replicateHider chunk 0) s) s\n (map (\\n. x + (of_nat n * of_nat chunk)) [0 ..< m]))\"\n using [[hypsubst_thin]]\n apply clarsimp\n apply (induct m arbitrary: x)\n apply (rule ext, simp)\n apply (simp add: replicateHider_def)\n apply (rule ext)\n apply (simp only: map_upt_unfold map_Suc_upt[symmetric])\n apply (simp add: replicate_add[folded replicateHider_def]\n heap_update_list_concat_unfold\n o_def field_simps\n length_replicate[folded replicateHider_def])\n done\n\nlemma h_t_valid_dom_s:\n \"\\ h_t_valid htd c_guard p; x = ptr_val (p :: ('a :: mem_type) ptr);\n n = size_of TYPE ('a) \\\n \\ {x ..+ n} \\ {SIndexVal, SIndexTyp 0} \\ dom_s htd\"\n apply (clarsimp simp: h_t_valid_def valid_footprint_def Let_def\n intvl_def)\n apply (drule_tac x=k in spec, simp add: size_of_def)\n apply (clarsimp simp: dom_s_def)\n apply (drule_tac x=0 in map_leD, simp_all)\n done\n\nlemma user_data_at_rf_sr_dom_s:\n \"\\ typ_at' UserDataT x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (drule rf_sr_heap_user_data_relation)\n apply (drule user_data_at_ko)\n apply (erule_tac x=x in cmap_relationE1)\n apply (simp only: heap_to_user_data_def Let_def ko_at_projectKO_opt)\n apply simp\n apply (drule h_t_valid_clift)\n apply (simp add: h_t_valid_dom_s pageBits_def)\n done\n\nlemma device_data_at_rf_sr_dom_s:\n \"\\ typ_at' UserDataDeviceT x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (drule rf_sr_heap_device_data_relation)\n apply (drule device_data_at_ko)\n apply (erule_tac x=x in cmap_relationE1)\n apply (simp only: heap_to_device_data_def Let_def ko_at_projectKO_opt)\n apply simp\n apply (drule h_t_valid_clift)\n apply (simp add: h_t_valid_dom_s pageBits_def)\n done\n\nlemma intvl_2_power_times_decomp:\n \"\\y < 2 ^ (n - m). {x + y * 2 ^ m ..+ 2 ^ m} \\ S \\ T\n \\ m \\ n \\ n < word_bits\n \\ {(x :: machine_word) ..+ 2 ^ n} \\ S \\ T\"\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"of_nat k >> m\" in spec)\n apply (drule mp)\n apply (rule shiftr_less_t2n)\n apply (rule word_of_nat_less)\n apply (simp add: word_of_nat_less)\n apply (erule subsetD)\n apply (clarsimp simp: shiftl_t2n[simplified mult.commute mult.left_commute, symmetric]\n shiftr_shiftl1)\n apply (rule_tac x=\"unat (of_nat k && mask m :: machine_word)\" in exI)\n apply (simp add: field_simps word_plus_and_or_coroll2)\n apply (simp add: word_bits_def unat_less_power and_mask_less')\n done\n\nlemma flex_user_data_at_rf_sr_dom_s:\n \"\\ (\\p<2 ^ (pageBitsForSize sz - pageBits).\n typ_at' UserDataT (x + p * 2 ^ pageBits) s); (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pageBitsForSize sz} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=pageBits in intvl_2_power_times_decomp,\n simp_all add: pbfs_atleast_pageBits pbfs_less_wb')\n apply (erule allEI, clarsimp)\n apply (drule(1) user_data_at_rf_sr_dom_s)\n apply (erule subsetD)\n apply simp\n done\n\nlemma hrs_mem_update_fold_eq:\n \"hrs_mem_update (fold f xs)\n = fold (hrs_mem_update o f) xs\"\n apply (rule sym, induct xs)\n apply (simp add: hrs_mem_update_def)\n apply (simp add: hrs_mem_update_def fun_eq_iff)\n done\n\nlemma power_user_page_foldl_zero_ranges:\n \" \\p<2 ^ (pageBitsForSize sz - pageBits).\n hrs_htd hrs \\\\<^sub>t (Ptr (ptr + of_nat p * 0x1000) :: user_data_C ptr)\n \\ zero_ranges_are_zero rngs hrs\n \\ zero_ranges_are_zero rngs\n (hrs_mem_update (\\s. foldl (\\s x. heap_update (Ptr x) (user_data_C (arr x)) s) s\n (map (\\n. ptr + of_nat n * 0x1000) [0..<2 ^ (pageBitsForSize sz - pageBits)]))\n hrs)\"\n apply (simp add: foldl_conv_fold hrs_mem_update_fold_eq)\n apply (rule conjunct1)\n apply (rule fold_invariant[where P=\"\\hrs'. zero_ranges_are_zero rngs hrs'\n \\ hrs_htd hrs' = hrs_htd hrs\"\n and xs=xs and Q=\"\\x. x \\ set xs\" for xs], simp_all)\n apply (subst zero_ranges_are_zero_update, simp_all)\n apply clarsimp\n done\n\nlemma heap_to_device_data_disj_mdf':\n \"\\is_aligned ptr (pageBitsForSize sz); ksPSpace \\ a = Some obj; objBitsKO obj = pageBits; pspace_aligned' \\;\n pspace_distinct' \\; pspace_no_overlap' ptr (pageBitsForSize sz) \\\\\n\\ heap_to_device_data (ksPSpace \\)\n (\\x. if x \\ {ptr..+2 ^ (pageBitsForSize sz)} then 0\n else underlying_memory (ksMachineState \\) x)\n a =\n heap_to_device_data (ksPSpace \\) (underlying_memory (ksMachineState \\)) a\"\n apply (cut_tac heap_to_device_data_disj_mdf[where ptr = ptr\n and gbits = \"pageBitsForSize sz - pageBits\" and n = 1\n and sz = \"pageBitsForSize sz\",simplified])\n apply (simp add: pbfs_atleast_pageBits pbfs_less_wb' field_simps| intro range_cover_full )+\n done\n\nlemma range_cover_nca_neg: \"\\x p (off :: 9 word).\n \\(x::machine_word) < 8; {p..+2 ^pageBits } \\ {ptr..ptr + (of_nat n * 2 ^ bits - 1)} = {};\n range_cover ptr sz bits n\\\n \\ p + ucast off * 8 + x \\ {ptr..+n * 2 ^ bits}\"\n apply (case_tac \"n = 0\")\n apply simp\n apply (subst range_cover_intvl,simp)\n apply simp\n apply (subgoal_tac \" p + ucast off * 8 + x \\ {p..+2 ^ pageBits}\")\n apply blast\n apply (clarsimp simp: intvl_def)\n apply (rule_tac x = \"unat off * 8 + unat x\" in exI)\n apply (simp add: ucast_nat_def)\n apply (rule nat_add_offset_less [where n = 3, simplified])\n apply (simp add: word_less_nat_alt)\n apply (rule unat_lt2p)\n apply (simp add: pageBits_def objBits_simps)\n done\n\nlemmas unat_of_nat32' = unat_of_nat_eq[where 'a=32]\n\nlemma unat_of_nat_pageBitsForSize_32 [simp]:\n \"unat (of_nat (pageBitsForSize x)::32 word) = pageBitsForSize x\"\n apply (subst unat_of_nat32')\n apply (rule order_le_less_trans, rule pageBitsForSize_le)\n apply (simp add: word_bits_def)\n apply simp\n done\n\nlemma clearMemory_PageCap_ccorres:\n \"ccorres dc xfdc (invs' and valid_cap' (ArchObjectCap (PageCap ptr undefined mt sz False None))\n and (\\s. 2 ^ pageBitsForSize sz \\ gsMaxObjectSize s)\n and K ({ptr .. ptr + 2 ^ (pageBitsForSize sz) - 1} \\ kernel_data_refs = {})\n )\n (UNIV \\ {s. bits_' s = of_nat (pageBitsForSize sz)}\n \\ {s. ptr___ptr_to_void_' s = Ptr ptr})\n []\n (doMachineOp (clearMemory ptr (2 ^ pageBitsForSize sz))) (Call clearMemory_'proc)\"\n (is \"ccorres dc xfdc ?P ?P' [] ?m ?c\")\n apply (cinit' lift: bits_' ptr___ptr_to_void_')\n apply (rule_tac P=\"capAligned (ArchObjectCap (PageCap ptr undefined mt sz False None))\"\n in ccorres_gen_asm)\n apply (rule ccorres_Guard)\n apply (simp add: clearMemory_def)\n apply (rule_tac P=\"?P\" in ccorres_from_vcg[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: valid_cap'_def capAligned_def bit_simps\n is_aligned_no_wrap'[OF _ word64_power_less_1])\n apply (subgoal_tac \"3 \\ pageBitsForSize sz\")\n prefer 2\n apply (simp add: pageBitsForSize_def split: vmpage_size.split)\n apply (clarsimp simp: bit_simps)\n apply (rule conjI)\n apply (erule is_aligned_weaken)\n apply (clarsimp simp: pageBitsForSize_def split: vmpage_size.splits)\n apply (rule conjI)\n apply (rule is_aligned_power2)\n apply (clarsimp simp: pageBitsForSize_def split: vmpage_size.splits)\n apply (clarsimp simp: ghost_assertion_size_logic[unfolded o_def])\n apply (simp add: flex_user_data_at_rf_sr_dom_s bit_simps)\n apply (clarsimp simp: field_simps word_size_def mapM_x_storeWord_step)\n apply (simp add: doMachineOp_def split_def exec_gets)\n apply (simp add: select_f_def simpler_modify_def bind_def)\n apply (fold replicateHider_def)[1]\n apply (subst coerce_heap_update_to_heap_updates'\n [where chunk=4096 and m=\"2 ^ (pageBitsForSize sz - pageBits)\"])\n apply (simp add: pageBitsForSize_def bit_simps split: vmpage_size.split)\n apply (subst coerce_memset_to_heap_update_user_data)\n apply (subgoal_tac \"\\p<2 ^ (pageBitsForSize sz - pageBits).\n x \\\\<^sub>c (Ptr (ptr + of_nat p * 0x1000) :: user_data_C ptr)\")\n prefer 2\n apply (erule allfEI[where f=of_nat])\n apply (clarsimp simp: bit_simps)\n apply (subst(asm) of_nat_power, assumption)\n apply simp\n apply (insert pageBitsForSize_32 [of sz])[1]\n apply (erule order_le_less_trans [rotated])\n apply simp\n apply (simp, drule ko_at_projectKO_opt[OF user_data_at_ko])\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def cpspace_relation_def)\n apply (erule cmap_relationE1, simp(no_asm) add: heap_to_user_data_def Let_def)\n apply fastforce\n subgoal by (simp add: pageBits_def typ_heap_simps)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps\n clift_foldl_hrs_mem_update foldl_id\n carch_state_relation_def fpu_null_state_relation_def\n cmachine_state_relation_def\n foldl_fun_upd_const[unfolded fun_upd_def]\n power_user_page_foldl_zero_ranges\n dom_heap_to_device_data)\n apply (rule conjI[rotated])\n apply (simp add:pageBitsForSize_mess_multi)\n apply (rule cmap_relationI)\n apply (clarsimp simp: dom_heap_to_device_data cmap_relation_def)\n apply (simp add:cuser_user_data_device_relation_def)\n apply (subst help_force_intvl_range_conv, assumption)\n subgoal by (simp add: pageBitsForSize_def bit_simps split: vmpage_size.split)\n apply assumption\n apply (subst heap_to_user_data_update_region)\n apply (drule map_to_user_data_aligned, clarsimp)\n apply (rule aligned_range_offset_mem[where m=pageBits], simp_all)[1]\n apply (rule pbfs_atleast_pageBits)\n apply (erule cmap_relation_If_upd)\n apply (clarsimp simp: cuser_user_data_relation_def order_less_le_trans[OF unat_lt2p])\n apply (fold word_rsplit_0, simp add: word_rcat_rsplit)[1]\n apply (rule image_cong[OF _ refl])\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp del: atLeastAtMost_iff)\n apply (drule map_to_user_data_aligned, clarsimp)\n apply (simp only: mask_in_range[symmetric])\n apply (rule_tac x=\"unat ((xa && mask (pageBitsForSize sz)) >> pageBits)\" in image_eqI)\n apply (simp add: subtract_mask(2)[symmetric])\n apply (cut_tac w=\"xa - ptr\" and n=pageBits in and_not_mask[symmetric])\n apply (simp add: shiftl_t2n field_simps pageBits_def)\n apply (subst is_aligned_neg_mask_eq, simp_all)[1]\n apply (erule aligned_sub_aligned, simp_all add: word_bits_def)[1]\n apply (erule is_aligned_weaken)\n apply (rule pbfs_atleast_pageBits[unfolded pageBits_def])\n apply simp\n apply (rule unat_less_power)\n apply (fold word_bits_def, simp)\n apply (rule shiftr_less_t2n)\n apply (simp add: pbfs_atleast_pageBits)\n apply (rule and_mask_less_size)\n apply (simp add: word_bits_def word_size)\n apply (rule IntI)\n apply (clarsimp simp del: atLeastAtMost_iff)\n apply (subst aligned_range_offset_mem, assumption, simp_all)[1]\n apply (rule order_le_less_trans[rotated], erule shiftl_less_t2n [OF of_nat_power],\n simp_all add: word_bits_def)[1]\n apply (insert pageBitsForSize_32 [of sz])[1]\n apply (erule order_le_less_trans [rotated])\n subgoal by simp\n subgoal by (simp add: pageBits_def shiftl_t2n field_simps)\n apply (clarsimp simp: image_iff)\n apply (rename_tac n)\n apply (drule_tac x=\"of_nat n\" in spec)\n apply (simp add: bit_simps)\n apply (simp add: of_nat_power[where 'a=64, folded word_bits_def])\n apply (simp add: pageBits_def ko_at_projectKO_opt[OF user_data_at_ko])\n apply (rule inj_Ptr)\n by (simp add: word_bits_def capAligned_def word_of_nat_less valid_cap'_def)\n\n\ndeclare replicate_numeral [simp]\n\nlemma coerce_memset_to_heap_update_pte:\n \"heap_update_list x (replicateHider 8 0)\n = heap_update (Ptr x :: pte_C ptr)\n (pte_C.pte_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pte_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: eval_nat_numeral)\n apply (simp add: replicateHider_def word_rsplit_0 word_bits_def)\n done\n\nlemma coerce_memset_to_heap_update_pde:\n \"heap_update_list x (replicateHider 8 0)\n = heap_update (Ptr x :: pde_C ptr)\n (pde_C.pde_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pde_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: numeral_nat word_rsplit_0)\n apply (simp add: replicateHider_def)\n done\n\nlemma coerce_memset_to_heap_update_pdpte:\n \"heap_update_list x (replicateHider 8 0)\n = heap_update (Ptr x :: pdpte_C ptr)\n (pdpte_C.pdpte_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pdpte_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: numeral_nat word_rsplit_0)\n apply (simp add: replicateHider_def)\n done\n\nlemma coerce_memset_to_heap_update_pml4e:\n \"heap_update_list x (replicateHider 8 0)\n = heap_update (Ptr x :: pml4e_C ptr)\n (pml4e_C.pml4e_C (FCP (\\x. 0)))\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps pml4e_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps align_td_array' size_td_array)\n apply (simp add: typ_info_array' typ_info_word word_rsplit_0)\n apply (simp add: eval_nat_numeral)\n apply (simp add: replicateHider_def word_rsplit_0 word_bits_def)\n done\n\nlemma objBits_eq_by_type:\n fixes x :: \"'a :: pspace_storable\" and y :: 'a\n shows \"objBits x = objBits y\"\n apply (simp add: objBits_def)\n apply (rule objBits_type)\n apply (simp add: koTypeOf_injectKO)\n done\n\nlemma mapM_x_store_memset_ccorres_assist:\n fixes val :: \"'a :: pspace_storable\"\n assumes nofail: \"\\ snd (mapM_x (\\slot. setObject slot val) slots \\)\"\n assumes slots1: \"\\n < length slots. slots ! n = hd slots + (of_nat n << objBits val)\"\n assumes slots2: \"n = length slots * (2 ^ objBits val)\"\n assumes ptr: \"ptr = hd slots\"\n assumes ko: \"\\ko :: 'a. updateObject ko = updateObject_default ko\"\n \"\\ko :: 'a. (1 :: machine_word) < 2 ^ objBits ko\"\n assumes restr: \"set slots \\ S\"\n assumes worker: \"\\ptr s s' (ko :: 'a). \\ (s, s') \\ rf_sr; ko_at' ko ptr s; ptr \\ S \\\n \\ (s \\ ksPSpace := ksPSpace s (ptr \\ injectKO val)\\,\n globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr\n (replicateHider (2 ^ objBits val) (ucast c))))) s') \\ rf_sr\"\n assumes rf_sr: \"(\\, s) \\ rf_sr\"\n shows\n \"\\(rv, \\') \\ fst (mapM_x (\\slot. setObject slot val) slots \\).\n (\\', globals_update (t_hrs_'_update (hrs_mem_update\n (heap_update_list ptr (replicateHider n c)))) s) \\ rf_sr\"\n unfolding slots2 ptr using rf_sr slots1 nofail restr\nproof (induct slots arbitrary: s \\)\n case Nil\n show ?case\n using Nil.prems\n apply (simp add: mapM_x_def sequence_x_def return_def replicateHider_def)\n apply (simp add: rf_sr_def hrs_mem_update_def cstate_relation_def Let_def\n carch_state_relation_def cmachine_state_relation_def\n h_t_valid_clift_Some_iff)\n done\nnext\n case (Cons x xs tPre sPre)\n\n note nofail_bind = Cons.prems(3)[unfolded mapM_x_Cons K_bind_def]\n\n have obj_at: \"obj_at' (\\x :: 'a. True) x sPre\"\n using not_snd_bindI1[OF nofail_bind]\n apply (subst(asm) setObject_obj_at_pre, simp_all add: ko snd_bind)\n apply (clarsimp simp: stateAssert_def exec_get return_def)\n apply (simp add: koTypeOf_injectKO typ_at_to_obj_at')\n done\n\n note in_setObject = setObject_eq[OF _ _ objBits_eq_by_type obj_at,\n where ko=val, simplified ko, simplified]\n\n note nofail_mapM = not_snd_bindI2[OF nofail_bind, OF in_setObject]\n\n have hd_xs: \"xs \\ [] \\ hd xs = x + (2 ^ objBits val)\"\n using Cons.prems(2)[rule_format, where n=1]\n by (simp add: hd_conv_nth)\n\n show ?case\n using obj_at_ko_at'[OF obj_at] Cons.prems(4)\n apply (clarsimp simp add: mapM_x_Cons bind_def split_def)\n apply (rule rev_bexI, rule in_setObject)\n apply (cut_tac Cons.hyps[OF _ _ nofail_mapM])\n defer\n apply (rule worker, rule Cons.prems, assumption+)\n apply clarsimp\n apply (case_tac \"xs = []\", simp_all)[1]\n apply (insert Cons.prems, simp)[1]\n apply (frule_tac x=\"Suc n\" in spec)\n apply (simp add: hd_xs shiftl_t2n field_simps)\n apply assumption\n apply clarsimp\n apply (rule rev_bexI, assumption)\n apply (simp add: o_def)\n apply (case_tac \"xs = []\")\n apply (simp add: hrs_mem_update_def split_def replicateHider_def)\n apply (subst(asm) heap_update_list_concat_fold_hrs_mem)\n apply (simp add: hd_xs replicateHider_def)\n apply (simp add: replicateHider_def replicate_add)\n done\nqed\n\nend\n\nlemma option_to_0_user_mem':\n \"option_to_0 \\ user_mem' as =(\\x. if x \\ {y. \\ pointerInUserData y as} then 0\n else underlying_memory (ksMachineState as) x) \"\n apply (rule ext)\n apply (simp add:user_mem'_def option_to_0_def split:if_splits)\n done\n\nlemma heap_to_user_data_in_user_mem'[simp]:\n \"\\pspace_aligned' as;pspace_distinct' as\\ \\ heap_to_user_data (ksPSpace as) (option_to_0 \\ user_mem' as) =\n heap_to_user_data (ksPSpace as)(underlying_memory (ksMachineState as))\"\n apply (rule ext)+\n apply (clarsimp simp: heap_to_user_data_def option_map_def\n split: option.splits)\n apply (subst option_to_0_user_mem')\n apply (subst map_option_byte_to_word_heap)\n apply (clarsimp simp: projectKO_opt_user_data map_comp_def\n split: option.split_asm kernel_object.split_asm)\n apply (frule(1) pspace_alignedD')\n apply (frule(1) pspace_distinctD')\n apply (subgoal_tac \"x + ucast off * 8 + xa && ~~ mask pageBits = x\" )\n apply (clarsimp simp: pointerInUserData_def typ_at'_def ko_wp_at'_def)\n apply (simp add: X64.pageBits_def)\n apply (subst mask_lower_twice2[where n = 3 and m = 12,simplified,symmetric])\n apply (subst is_aligned_add_helper[THEN conjunct2,where n1 = 3])\n apply (erule aligned_add_aligned)\n apply (simp add: is_aligned_mult_triv2[where n = 3,simplified])\n apply (clarsimp simp: objBits_simps X64.pageBits_def)\n apply simp\n apply (rule is_aligned_add_helper[THEN conjunct2])\n apply (simp add: X64.pageBits_def objBits_simps)\n apply (rule word_less_power_trans2[where k = 3,simplified])\n apply (rule less_le_trans[OF ucast_less])\n apply simp+\n done\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\ncrunch gsMaxObjectSize[wp]: deleteASIDPool \"\\s. P (gsMaxObjectSize s)\"\n (wp: crunch_wps getObject_inv loadObject_default_inv\n simp: crunch_simps)\nend\n\ncontext kernel_m begin\n\nlemma page_table_at_rf_sr_dom_s:\n \"\\ page_table_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ ptBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=3 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps bit_simps\n word_bits_def)\n apply (clarsimp simp: page_table_at'_def intvl_def bit_simps)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpte_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\nlemma page_directory_at_rf_sr_dom_s:\n \"\\ page_directory_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pdBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=3 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps bit_simps\n word_bits_def)\n apply (clarsimp simp: page_directory_at'_def intvl_def bit_simps)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpde_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\nlemma pd_pointer_table_at_rf_sr_dom_s:\n \"\\ pd_pointer_table_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pdptBits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=3 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps bit_simps\n word_bits_def)\n apply (clarsimp simp: pd_pointer_table_at'_def intvl_def bit_simps)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpdpte_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\nlemma page_map_l4_at_rf_sr_dom_s:\n \"\\ page_map_l4_at' x s; (s, s') \\ rf_sr \\\n \\ {x ..+ 2 ^ pml4Bits} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals s')))\"\n apply (rule_tac m=3 in intvl_2_power_times_decomp,\n simp_all add: shiftl_t2n field_simps bit_simps\n word_bits_def)\n apply (clarsimp simp: page_map_l4_at'_def intvl_def bit_simps)\n apply (drule spec, drule(1) mp)\n apply (simp add: typ_at_to_obj_at_arches)\n apply (drule obj_at_ko_at', clarsimp)\n apply (erule cmap_relationE1[OF rf_sr_cpml4e_relation])\n apply (erule ko_at_projectKO_opt)\n apply (drule h_t_valid_clift)\n apply (drule h_t_valid_dom_s[OF _ refl refl])\n apply (erule subsetD)\n apply (auto simp add: intvl_def shiftl_t2n)[1]\n done\n\n(* FIXME x64: copies needed for PDE, PDPTE etc *)\nlemma clearMemory_setObject_PTE_ccorres:\n \"ccorres dc xfdc (page_table_at' ptr\n and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\n and (\\_. is_aligned ptr ptBits \\ ptr \\ 0 \\ pstart = addrFromPPtr ptr))\n (UNIV \\ {s. ptr___ptr_to_void_' s = Ptr ptr} \\ {s. bits_' s = of_nat ptBits}) []\n (mapM_x (\\a. setObject a X64_H.InvalidPTE)\n [ptr , ptr + 2 ^ objBits X64_H.InvalidPTE .e. ptr + 2 ^ ptBits - 1])\n (Call clearMemory_'proc)\"\n apply (rule ccorres_gen_asm)+\n apply (cinit' lift: ptr___ptr_to_void_' bits_')\n apply (rule_tac P=\"page_table_at' ptr and (\\s. 2 ^ ptBits \\ gsMaxObjectSize s)\"\n in ccorres_from_vcg_nofail[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (subst ghost_assertion_size_logic[unfolded o_def])\n apply (simp add: bit_simps)\n apply simp\n apply (clarsimp simp: replicateHider_def[symmetric] bit_simps)\n apply (frule is_aligned_no_overflow', simp)\n apply (intro conjI)\n apply (erule is_aligned_weaken, simp)\n apply (clarsimp simp: is_aligned_def)\n apply (erule (1) page_table_at_rf_sr_dom_s[unfolded ptBits_def bit_simps, simplified])\n apply (clarsimp simp add: bit_simps\n cong: StateSpace.state.fold_congs globals.fold_congs)\n apply (simp add: upto_enum_step_def objBits_simps bit_simps add.commute[where b=ptr]\n linorder_not_less[symmetric] archObjSize_def\n upto_enum_word split_def)\n apply (erule mapM_x_store_memset_ccorres_assist\n [unfolded split_def, OF _ _ _ _ _ _ subset_refl],\n simp_all add: shiftl_t2n hd_map objBits_simps archObjSize_def bit_simps)[1]\n apply (rule cmap_relationE1, erule rf_sr_cpte_relation, erule ko_at_projectKO_opt)\n apply (subst coerce_memset_to_heap_update_pte)\n apply (clarsimp simp: rf_sr_def Let_def cstate_relation_def typ_heap_simps)\n apply (rule conjI)\n apply (simp add: cpspace_relation_def typ_heap_simps update_pte_map_tos\n update_pte_map_to_ptes carray_map_relation_upd_triv)\n apply (rule cmap_relation_updI, simp_all)[1]\n apply (simp add: cpte_relation_def Let_def pte_lift_def)\n apply (simp add: carch_state_relation_def cmachine_state_relation_def\n fpu_null_state_heap_update_tag_disj_simps\n global_ioport_bitmap_heap_update_tag_disj_simps\n update_pte_map_tos)\n apply simp\n done\n\nlemma ccorres_make_xfdc:\n \"ccorresG rf_sr \\ r xf P P' h a c \\ ccorresG rf_sr \\ dc xfdc P P' h a c\"\n apply (erule ccorres_rel_imp)\n apply simp\n done\n\nlemma ccorres_if_True_False_simps:\n \"ccorres r xf P P' hs a (IF True THEN c ELSE c' FI) = ccorres r xf P P' hs a c\"\n \"ccorres r xf P P' hs a (IF False THEN c ELSE c' FI) = ccorres r xf P P' hs a c'\"\n \"ccorres r xf P P' hs a (IF True THEN c ELSE c' FI ;; d) = ccorres r xf P P' hs a (c ;; d)\"\n \"ccorres r xf P P' hs a (IF False THEN c ELSE c' FI ;; d) = ccorres r xf P P' hs a (c' ;; d)\"\n by (simp_all add: ccorres_cond_iffs ccorres_seq_simps)\n\nlemmas cap_tag_values =\n cap_untyped_cap_def\n cap_endpoint_cap_def\n cap_notification_cap_def\n cap_reply_cap_def\n cap_cnode_cap_def\n cap_thread_cap_def\n cap_irq_handler_cap_def\n cap_null_cap_def\n cap_irq_control_cap_def\n cap_zombie_cap_def\n cap_frame_cap_def\n cap_page_table_cap_def\n cap_page_directory_cap_def\n cap_pml4_cap_def\n cap_pdpt_cap_def\n cap_asid_pool_cap_def\n\nlemma ccorres_return_C_seq:\n \"\\\\s f. xf (global_exn_var_'_update f (xfu (\\_. v s) s)) = v s; \\s f. globals (xfu f s) = globals s; wfhandlers hs\\\n \\ ccorres_underlying rf_sr \\ r rvxf arrel xf (\\_. True) {s. arrel rv (v s)} hs (return rv) (return_C xfu v ;; d)\"\n apply (rule ccorres_guard_imp)\n apply (rule ccorres_split_throws, rule ccorres_return_C, simp+)\n apply vcg\n apply simp_all\n done\n\n\nlemma ccap_relation_get_capZombiePtr_CL:\n \"\\ ccap_relation cap cap'; isZombie cap; capAligned cap \\\n \\ get_capZombiePtr_CL (cap_zombie_cap_lift cap') = capZombiePtr cap\"\n apply (simp only: cap_get_tag_isCap[symmetric])\n apply (drule(1) cap_get_tag_to_H)\n apply (clarsimp simp: get_capZombiePtr_CL_def get_capZombieBits_CL_def Let_def split: if_split)\n apply (subst less_mask_eq)\n apply (clarsimp simp add: capAligned_def objBits_simps word_bits_conv)\n apply unat_arith\n apply simp\n done\n\nlemma modify_gets_helper:\n \"do y \\ modify (ksPSpace_update (\\_. ps)); ps' \\ gets ksPSpace; f ps' od\n = do y \\ modify (ksPSpace_update (\\_. ps)); f ps od\"\n by (simp add: bind_def simpler_modify_def simpler_gets_def)\n\nlemma snd_lookupAround2_update:\n \"ps y \\ None \\\n snd (lookupAround2 x (ps (y \\ v'))) = snd (lookupAround2 x ps)\"\n apply (clarsimp simp: lookupAround2_def lookupAround_def Let_def\n dom_fun_upd2\n simp del: dom_fun_upd cong: if_cong option.case_cong)\n apply (clarsimp split: option.split if_split cong: if_cong)\n apply auto\n done\n\nlemma double_setEndpoint:\n \"do y \\ setEndpoint epptr v1; setEndpoint epptr v2 od\n = setEndpoint epptr v2\"\n apply (simp add: setEndpoint_def setObject_def bind_assoc split_def\n modify_gets_helper)\n apply (simp add: updateObject_default_def bind_assoc objBits_simps)\n apply (rule ext)\n apply (rule bind_apply_cong, rule refl)+\n apply (clarsimp simp add: in_monad projectKOs magnitudeCheck_assert\n snd_lookupAround2_update)\n apply (simp add: lookupAround2_known1 assert_opt_def projectKO_def projectKO_opt_ep\n alignCheck_assert)\n apply (simp add: bind_def simpler_modify_def)\n done\n\nlemma filterM_setEndpoint_adjustment:\n \"\\ \\v. do setEndpoint epptr IdleEP; body v od\n = do v' \\ body v; setEndpoint epptr IdleEP; return v' od \\\n \\\n (do q' \\ filterM body q; setEndpoint epptr (f q') od)\n = (do setEndpoint epptr IdleEP; q' \\ filterM body q; setEndpoint epptr (f q') od)\"\n apply (rule sym)\n apply (induct q arbitrary: f)\n apply (simp add: double_setEndpoint)\n apply (simp add: bind_assoc)\n apply (subst bind_assoc[symmetric], simp, simp add: bind_assoc)\n done\n\nlemma ccorres_inst_voodoo:\n \"\\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\n \\ \\x. ccorres r xf (P x) (P' x) hs (h x) (c x)\"\n by simp\n\nlemma cpspace_relation_ep_update_ep2:\n \"\\ ko_at' (ep :: endpoint) epptr s;\n cmap_relation (map_to_eps (ksPSpace s))\n (cslift t) ep_Ptr (cendpoint_relation (cslift t));\n cendpoint_relation (cslift t') ep' endpoint;\n (cslift t' :: tcb_C ptr \\ tcb_C) = cslift t \\\n \\ cmap_relation (map_to_eps (ksPSpace s(epptr \\ KOEndpoint ep')))\n (cslift t(ep_Ptr epptr \\ endpoint))\n ep_Ptr (cendpoint_relation (cslift t'))\"\n apply (rule cmap_relationE1, assumption, erule ko_at_projectKO_opt)\n apply (rule_tac P=\"\\a. cmap_relation a b c d\" for b c d in rsubst,\n erule cmap_relation_upd_relI, assumption+)\n apply simp+\n apply (rule ext, simp add: map_comp_def projectKO_opt_ep split: if_split)\n done\n\nend\n\ncontext kernel_m begin\n\nlemma ccorres_abstract_h_val:\n \"(\\rv. P rv \\ ccorres r xf G (G' rv) hs a c) \\\n ccorres r xf G ({s. P (h_val (hrs_mem (t_hrs_' (globals s))) p)\n \\ s \\ G' (h_val (hrs_mem (t_hrs_' (globals s)))\n p)}\n \\ {s. P (h_val (hrs_mem (t_hrs_' (globals s))) p)}) hs a c\"\n apply (rule ccorres_tmp_lift1 [where P = P])\n apply (clarsimp simp: Collect_conj_eq [symmetric])\n apply (fastforce intro: ccorres_guard_imp)\n done\n\nlemma ccorres_subst_basic_helper:\n \"\\ \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ f s' = f' s';\n \\s s'. \\ P s; s' \\ P'; (s, s') \\ rf_sr \\ \\ (s, f' s') \\ rf_sr;\n \\s'. xf' (f' s') = v; \\rv' t t'. ceqv \\ xf' rv' t t' c (c' rv');\n ccorres rrel xf Q Q' hs a (c' v) \\\n \\ ccorres rrel xf (P and Q) {s. s \\ P' \\ f' s \\ Q'} hs a (Basic f ;; c)\"\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_add_return)\n apply (rule ccorres_split_nothrow[where xf'=xf' and r'=\"\\rv rv'. rv' = v\"])\n apply (rule ccorres_from_vcg[where P=P and P'=P'])\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: return_def)\n apply assumption\n apply simp\n apply wp\n apply vcg\n apply clarsimp\n done\n\nlemma ctcb_relation_blocking_ipc_badge:\n \"\\ ctcb_relation tcb ctcb; isBlockedOnSend (tcbState tcb) \\ \\\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend\"\n \"\\ ctcb_relation tcb ctcb;\n tsType_CL (thread_state_lift (tcbState_C ctcb)) = scast ThreadState_BlockedOnSend \\\n \\ blockingIPCBadge (tcbState tcb)\n = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\"\n apply (clarsimp simp add: ctcb_relation_def)\n apply (simp add: isBlockedOnSend_def split: Structures_H.thread_state.split_asm)\n apply (clarsimp simp: cthread_state_relation_def)\n apply (clarsimp simp add: ctcb_relation_def cthread_state_relation_def)\n apply (cases \"tcbState tcb\", simp_all add: \"StrictC'_thread_state_defs\")\n done\n\nlemma cendpoint_relation_q_cong:\n \"\\ \\t rf. (t, rf) \\ ep_q_refs_of' ep \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t) \\\n \\ cendpoint_relation hp ep ep' = cendpoint_relation hp' ep ep'\"\n apply (cases ep, simp_all add: cendpoint_relation_def Let_def)\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n apply (rule conj_cong [OF refl])\n apply (rule tcb_queue_relation'_cong[OF refl refl refl])\n apply clarsimp\n done\n\nlemma cnotification_relation_q_cong:\n \"\\\\t rf. (t, rf) \\ ntfn_q_refs_of' (ntfnObj ntfn) \\ hp (tcb_ptr_to_ctcb_ptr t) = hp' (tcb_ptr_to_ctcb_ptr t)\\\n \\ cnotification_relation hp ntfn ntfn' = cnotification_relation hp' ntfn ntfn'\"\n apply (cases \"ntfnObj ntfn\", simp_all add: cnotification_relation_def Let_def)\n apply (auto intro: iffD1[OF tcb_queue_relation'_cong[OF refl refl refl]])\n done\n\nlemma tcbSchedEnqueue_ep_at:\n \"\\obj_at' (P :: endpoint \\ bool) ep\\\n tcbSchedEnqueue t\n \\\\rv. obj_at' P ep\\\"\n including no_pre\n apply (simp add: tcbSchedEnqueue_def unless_def null_def)\n apply (wp threadGet_wp, clarsimp, wp+)\n apply (clarsimp split: if_split, wp)\n done\n\nlemma ccorres_duplicate_guard:\n \"ccorres r xf (P and P) Q hs f f' \\ ccorres r xf P Q hs f f'\"\n by (erule ccorres_guard_imp, auto)\n\n\nlemma ep_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ep_q_refs_of' ep\"\n by (auto simp: ep_q_refs_of'_def split: endpoint.splits)\n\n\nlemma ntfn_q_refs'_no_NTFNBound[simp]:\n \"(x, NTFNBound) \\ ntfn_q_refs_of' ntfn\"\n by (auto simp: ntfn_q_refs_of'_def split: ntfn.splits)\n\nlemma cancelBadgedSends_ccorres:\n \"ccorres dc xfdc (invs' and ep_at' ptr)\n (UNIV \\ {s. epptr_' s = Ptr ptr} \\ {s. badge_' s = bdg}) []\n (cancelBadgedSends ptr bdg) (Call cancelBadgedSends_'proc)\"\n apply (cinit lift: epptr_' badge_' simp: whileAnno_def)\n apply (simp add: list_case_return\n cong: list.case_cong Structures_H.endpoint.case_cong call_ignore_cong\n del: Collect_const)\n apply (rule ccorres_pre_getEndpoint)\n apply (rule_tac R=\"ko_at' rv ptr\" and xf'=\"ret__unsigned_longlong_'\"\n and val=\"case rv of RecvEP q \\ scast EPState_Recv | IdleEP \\ scast EPState_Idle\n | SendEP q \\ scast EPState_Send\"\n in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV])\n apply vcg\n apply clarsimp\n apply (erule cmap_relationE1 [OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def\n split: Structures_H.endpoint.split_asm)\n apply ceqv\n apply wpc\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (simp add: dc_def[symmetric] ccorres_cond_iffs)\n apply (rule ccorres_return_Skip)\n apply (rename_tac list)\n apply (simp add: Collect_True Collect_False endpoint_state_defs\n ccorres_cond_iffs dc_def[symmetric]\n del: Collect_const cong: call_ignore_cong)\n apply (rule ccorres_rhs_assoc)+\n apply (csymbr, csymbr)\n apply (drule_tac s = rv in sym, simp only:)\n apply (rule_tac P=\"ko_at' rv ptr and invs'\" in ccorres_cross_over_guard)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2)\n apply (rule ccorres_split_nothrow[where r'=dc and xf'=xfdc, OF _ ceqv_refl])\n apply (rule_tac P=\"ko_at' rv ptr\"\n in ccorres_from_vcg[where P'=UNIV])\n apply (rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps setEndpoint_def)\n apply (rule rev_bexI)\n apply (rule setObject_eq; simp add: objBits_simps')[1]\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n carch_state_relation_def cmachine_state_relation_def\n packed_heap_update_collapse_hrs\n fpu_null_state_heap_update_tag_disj_simps)\n apply (clarsimp simp: cpspace_relation_def update_ep_map_tos typ_heap_simps')\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def endpoint_state_defs)\n subgoal by simp\n apply (rule ccorres_symb_exec_r)\n apply (rule_tac xs=list in filterM_voodoo)\n apply (rule_tac P=\"\\xs s. (\\x \\ set xs \\ set list.\n st_tcb_at' (\\st. isBlockedOnSend st \\ blockingObject st = ptr) x s)\n \\ distinct (xs @ list) \\ ko_at' IdleEP ptr s\n \\ (\\p. \\x \\ set (xs @ list). \\rf. (x, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s \\ pspace_canonical' s\n \\ sch_act_wf (ksSchedulerAction s) s \\ valid_objs' s\"\n and P'=\"\\xs. {s. ep_queue_relation' (cslift s) (xs @ list)\n (head_C (queue_' s)) (end_C (queue_' s))}\n \\ {s. thread_' s = (case list of [] \\ tcb_Ptr 0\n | x # xs \\ tcb_ptr_to_ctcb_ptr x)}\"\n in ccorres_inst_voodoo)\n apply (induct_tac list)\n apply (rule allI)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_tmp_lift2 [OF _ _ Int_lower1])\n apply ceqv\n apply (simp add: ccorres_cond_iffs)\n apply (rule ccorres_rhs_assoc2)\n apply (rule ccorres_duplicate_guard, rule ccorres_split_nothrow_novcg_dc)\n apply (rule ccorres_from_vcg, rule allI, rule conseqPre, vcg)\n apply clarsimp\n apply (drule obj_at_ko_at', clarsimp)\n apply (rule cmap_relationE1[OF cmap_relation_ep], assumption)\n apply (erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps tcb_queue_relation'_def)\n apply (case_tac x)\n apply (clarsimp simp: setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n packed_heap_update_collapse_hrs\n carch_state_relation_def\n fpu_null_state_heap_update_tag_disj_simps\n cmachine_state_relation_def)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n subgoal by (simp add: cendpoint_relation_def Let_def)\n subgoal by simp\n apply (clarsimp simp: tcb_at_not_NULL[OF pred_tcb_at']\n setEndpoint_def)\n apply (rule rev_bexI, rule setObject_eq,\n (simp add: objBits_simps')+)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n packed_heap_update_collapse_hrs\n carch_state_relation_def\n fpu_null_state_heap_update_tag_disj_simps\n cmachine_state_relation_def)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps'\n update_ep_map_tos)\n apply (erule(1) cpspace_relation_ep_update_ep2)\n apply (simp add: cendpoint_relation_def Let_def)\n apply (subgoal_tac \"tcb_at' (last (a # list)) \\ \\ tcb_at' a \\\")\n apply (clarsimp simp: is_aligned_neg_mask_eq[OF is_aligned_tcb_ptr_to_ctcb_ptr[where P=\\]])\n apply (simp add: tcb_queue_relation'_def EPState_Send_def mask_def)\n apply (drule (1) tcb_and_not_mask_canonical[where n=2])\n apply (simp (no_asm) add: tcbBlockSizeBits_def)\n subgoal by (simp add: mask_def)\n subgoal by (auto split: if_split)\n subgoal by simp\n apply (ctac add: rescheduleRequired_ccorres[unfolded dc_def])\n apply (rule hoare_pre, wp weak_sch_act_wf_lift_linear set_ep_valid_objs')\n apply (clarsimp simp: weak_sch_act_wf_def sch_act_wf_def)\n apply (fastforce simp: valid_ep'_def pred_tcb_at' split: list.splits)\n apply (simp add: guard_is_UNIV_def)\n apply (rule allI)\n apply (rename_tac a lista x)\n apply (rule iffD1 [OF ccorres_expand_while_iff_Seq])\n apply (rule ccorres_init_tmp_lift2, ceqv)\n apply (rule ccorres_guard_imp2)\n apply (simp add: bind_assoc dc_def[symmetric]\n del: Collect_const)\n apply (rule ccorres_cond_true)\n apply (rule ccorres_rhs_assoc)+\n apply (rule ccorres_pre_threadGet[where f=tcbState, folded getThreadState_def])\n apply (rule ccorres_move_c_guard_tcb)\n apply csymbr\n apply (rule ccorres_abstract_cleanup)\n apply csymbr\n apply (rule ccorres_move_c_guard_tcb)\n apply (rule_tac P=\\\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n and f'=\"\\s. s \\ next___ptr_to_struct_tcb_C_' := (case lista of [] \\ tcb_Ptr 0\n | v # vs \\ tcb_ptr_to_ctcb_ptr v) \\\"\n and xf'=\"next___ptr_to_struct_tcb_C_'\"\n in ccorres_subst_basic_helper)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule myvars.fold_congs, (rule refl)+)\n apply (clarsimp simp: tcb_queue_relation'_def use_tcb_queue_relation2\n tcb_queue_relation2_concat)\n apply (clarsimp simp: typ_heap_simps split: list.split)\n subgoal by (simp add: rf_sr_def)\n apply simp\n apply ceqv\n apply (rule_tac P=\"ret__unsigned_longlong=blockingIPCBadge rva\" in ccorres_gen_asm2)\n apply (rule ccorres_if_bind, rule ccorres_if_lhs)\n apply (simp add: bind_assoc dc_def[symmetric])\n apply (rule ccorres_rhs_assoc)+\n apply (ctac add: setThreadState_ccorres)\n apply (ctac add: tcbSchedEnqueue_ccorres)\n apply (rule_tac P=\"\\s. \\t \\ set (x @ a # lista). tcb_at' t s\"\n in ccorres_cross_over_guard)\n apply (rule ccorres_add_return, rule ccorres_split_nothrow[OF _ ceqv_refl])\n apply (rule_tac rrel=dc and xf=xfdc\n and P=\"\\s. (\\t \\ set (x @ a # lista). tcb_at' t s)\n \\ (\\p. \\t \\ set (x @ a # lista). \\rf. (t, rf) \\ {r \\ state_refs_of' s p. snd r \\ NTFNBound})\n \\ valid_queues s \\ distinct (x @ a # lista)\n \\ pspace_aligned' s \\ pspace_distinct' s\"\n and P'=\"{s. ep_queue_relation' (cslift s) (x @ a # lista)\n (head_C (queue_' s)) (end_C (queue_' s))}\"\n in ccorres_from_vcg)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: ball_Un)\n apply (rule exI, rule conjI)\n apply (rule exI, erule conjI)\n apply (intro conjI[rotated])\n apply (assumption)\n apply (fold_subgoals (prefix))[3]\n subgoal premises prems using prems by (fastforce intro: pred_tcb_at')+\n apply (clarsimp simp: return_def rf_sr_def cstate_relation_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def)\n apply (rule conjI, erule ctcb_relation_null_queue_ptrs)\n apply (rule null_ep_queue)\n subgoal by (simp add: o_def)\n apply (rule conjI)\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (rule cendpoint_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule(2) map_to_ko_atI)\n apply (drule ko_at_state_refs_ofD')\n apply clarsimp\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n\n apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply clarsimp\n apply (drule(2) map_to_ko_atI, drule ko_at_state_refs_ofD')\n\n apply (rule cnotification_relation_q_cong)\n apply (rule sym, erule restrict_map_eqI)\n apply (clarsimp simp: image_iff)\n apply (drule_tac x=p in spec)\n subgoal by fastforce\n apply (rule conjI)\n apply (erule cready_queues_relation_not_queue_ptrs,\n auto dest: null_ep_schedD[unfolded o_def] simp: o_def)[1]\n apply (clarsimp simp: carch_state_relation_def cmachine_state_relation_def\n elim!: fpu_null_state_typ_heap_preservation)\n apply (rule ccorres_symb_exec_r2)\n apply (erule spec)\n apply vcg\n apply (vcg spec=modifies)\n apply wp\n apply simp\n apply vcg\n apply (wp hoare_vcg_const_Ball_lift tcbSchedEnqueue_ep_at\n sch_act_wf_lift)\n apply simp\n apply (vcg exspec=tcbSchedEnqueue_cslift_spec)\n apply (wp hoare_vcg_const_Ball_lift sts_st_tcb_at'_cases\n sts_sch_act sts_valid_queues setThreadState_oa_queued)\n apply (vcg exspec=setThreadState_cslift_spec)\n apply (simp add: ccorres_cond_iffs dc_def[symmetric])\n apply (rule ccorres_symb_exec_r2)\n apply (drule_tac x=\"x @ [a]\" in spec, simp add: dc_def[symmetric])\n apply vcg\n apply (vcg spec=modifies)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: pred_tcb_at' ball_Un)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n subgoal by (fastforce simp: valid_tcb_state'_def valid_objs'_maxDomain\n valid_objs'_maxPriority dest: pred_tcb_at')\n apply (clarsimp simp: tcb_at_not_NULL [OF pred_tcb_at'])\n apply (clarsimp simp: typ_heap_simps st_tcb_at'_def)\n apply (drule(1) obj_at_cslift_tcb)\n apply (clarsimp simp: ctcb_relation_blocking_ipc_badge)\n apply (rule conjI, simp add: \"StrictC'_thread_state_defs\" mask_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule rf_sr_cscheduler_relation)\n apply (clarsimp simp: cscheduler_action_relation_def st_tcb_at'_def\n split: scheduler_action.split_asm)\n apply (rename_tac word)\n apply (frule_tac x=word in tcbSchedEnqueue_cslift_precond_discharge)\n apply simp\n subgoal by clarsimp\n subgoal by clarsimp\n subgoal by clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (frule(3) tcbSchedEnqueue_cslift_precond_discharge)\n subgoal by clarsimp\n apply clarsimp\n apply (rule context_conjI)\n apply (clarsimp simp: tcb_queue_relation'_def)\n apply (erule iffD2[OF ep_queue_relation_shift[rule_format], rotated -1])\n subgoal by simp\n apply (rule_tac x=\"x @ a # lista\" in exI)\n apply (clarsimp simp: ball_Un)\n apply (rule conjI, fastforce)\n subgoal by (clarsimp simp: remove1_append)\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp obj_at_setObject3[where 'a=endpoint, folded setEndpoint_def])\n apply (simp add: objBits_simps')+\n apply (wp set_ep_valid_objs')\n apply vcg\n apply vcg\n apply (rule conseqPre, vcg)\n apply clarsimp\n apply (clarsimp simp: guard_is_UNIV_def)\n apply (erule cmap_relationE1[OF cmap_relation_ep], erule ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps)\n apply (clarsimp simp: cendpoint_relation_def Let_def)\n subgoal by (clarsimp simp: tcb_queue_relation'_def neq_Nil_conv\n split: if_split_asm)\n apply clarsimp\n apply (frule ko_at_valid_objs', clarsimp)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_obj'_def valid_ep'_def)\n apply (frule sym_refs_ko_atD', clarsimp)\n apply (clarsimp simp: st_tcb_at_refs_of_rev')\n apply (rule conjI)\n subgoal by (auto simp: isBlockedOnSend_def elim!: pred_tcb'_weakenE)\n apply (rule conjI)\n apply (clarsimp split: if_split)\n apply (drule sym_refsD, clarsimp)\n apply (drule(1) bspec)+\n by (auto simp: obj_at'_def projectKOs state_refs_of'_def pred_tcb_at'_def tcb_bound_refs'_def\n dest!: symreftype_inverse')\n\n\nlemma tcb_ptr_to_ctcb_ptr_force_fold:\n \"x + 2 ^ ctcb_size_bits = ptr_val (tcb_ptr_to_ctcb_ptr x)\"\n by (simp add: tcb_ptr_to_ctcb_ptr_def ctcb_offset_def)\n\n\nlemma access_ti_list_word8_array:\n \"N \\ CARD('a::finite) \\\n access_ti_list (map (\\n. DTPair (adjust_ti (typ_info_t TYPE(8 word)) (\\x. x.[n])\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..x. 0))) (FCP (\\x. 0))))\n (thread_state_C (FCP (\\x. 0)))\n (NULL)\n (seL4_Fault_C (FCP (\\x. 0)))\n (lookup_fault_C (FCP (\\x. 0)))\n 0 0 0 0 0 0 NULL NULL NULL NULL)\"\n apply (intro ext, simp add: heap_update_def)\n apply (rule_tac f=\"\\xs. heap_update_list x xs a b\" for a b in arg_cong)\n apply (simp add: to_bytes_def size_of_def typ_info_simps tcb_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: typ_info_simps\n user_context_C_tag_def thread_state_C_tag_def seL4_Fault_C_tag_def\n lookup_fault_C_tag_def update_ti_t_ptr_0s arch_tcb_C_tag_def\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n ti_typ_combine_empty_ti ti_typ_combine_td\n align_of_def padup_def user_fpu_state_C_tag_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n align_td_array' size_td_array)\n apply (simp add: typ_info_array' access_ti_list_word8_array)\n apply (simp add: typ_info_word word_rsplit_0 upt_conv_Cons)\n apply (simp add: typ_info_word typ_info_ptr word_rsplit_0 word_bits_def\n replicateHider_def)\n done\n\nlemma isArchObjectCap_capBits:\n \"isArchObjectCap cap \\ capBits cap = acapBits (capCap cap)\"\n by (clarsimp simp: isCap_simps)\n\ndeclare Kernel_C.tcb_C_size [simp del]\n\nlemma cte_lift_ccte_relation:\n \"cte_lift cte' = Some ctel'\n \\ c_valid_cte cte'\n \\ ccte_relation (cte_to_H ctel') cte'\"\n by (simp add: ccte_relation_def)\n\nlemma updateFreeIndex_ccorres:\n \"\\s. \\ \\ ({s} \\ {s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'})\n c\n {t. \\cap. cap_untyped_cap_lift cap = (cap_untyped_cap_lift\n (cte_C.cap_C (the (cslift s (cte_Ptr srcSlot)))))\n \\ cap_untyped_cap_CL.capFreeIndex_CL := ((of_nat idx') >> 4) \\\n \\ cap_get_tag cap = scast cap_untyped_cap\n \\ t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr srcSlot)\n (cte_C.cap_C_update (\\_. cap) (the (cslift s (cte_Ptr srcSlot)))))\n (t_hrs_' (globals s))\n \\ t may_only_modify_globals s in [t_hrs]\n }\n \\ ccorres dc xfdc\n (valid_objs' and cte_wp_at' (\\cte. isUntypedCap (cteCap cte)\n \\ cap' = (cteCap cte)) srcSlot\n and untyped_ranges_zero'\n and (\\_. is_aligned (of_nat idx' :: machine_word) 4 \\ idx' \\ 2 ^ (capBlockSize cap')))\n {s. \\ capIsDevice cap'\n \\ region_actually_is_zero_bytes (capPtr cap' + of_nat idx') (capFreeIndex cap' - idx') s} hs\n (updateFreeIndex srcSlot idx') c\"\n (is \"_ \\ ccorres dc xfdc (valid_objs' and ?cte_wp_at' and _ and _) ?P' hs ?a c\")\n apply (rule ccorres_gen_asm)\n apply (simp add: updateFreeIndex_def getSlotCap_def updateCap_def)\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_split_noop_lhs, rule_tac cap'=cap' in updateTrackedFreeIndex_noop_ccorres)\n apply (rule ccorres_pre_getCTE)+\n apply (rename_tac cte cte2)\n apply (rule_tac P = \"\\s. ?cte_wp_at' s \\ cte2 = cte \\ cte_wp_at' ((=) cte) srcSlot s\"\n and P'=\"{s. \\cte cte'. cslift s (cte_Ptr srcSlot) = Some cte'\n \\ cteCap cte = cap' \\ ccte_relation cte cte'} \\ ?P'\" in ccorres_from_vcg)\n apply (rule allI, rule HoarePartial.conseq_exploit_pre, clarify)\n apply (drule_tac x=s in spec, rule conseqPre, erule conseqPost)\n defer\n apply clarsimp\n apply clarsimp\n apply (simp add: cte_wp_at_ctes_of)\n apply wp\n apply (clarsimp simp: isCap_simps cte_wp_at_ctes_of)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (frule(1) cte_lift_ccte_relation)\n apply (rule exI, intro conjI[rotated], assumption, simp_all)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule(1) rf_sr_ctes_of_cliftE)\n apply (frule(1) rf_sr_ctes_of_clift)\n apply clarsimp\n apply (subgoal_tac \"ccap_relation (capFreeIndex_update (\\_. idx')\n (cteCap (the (ctes_of \\ srcSlot)))) cap\")\n apply (rule fst_setCTE [OF ctes_of_cte_at], assumption)\n apply (erule bexI [rotated])\n apply (clarsimp simp add: rf_sr_def cstate_relation_def Let_def\n cvariable_array_map_const_add_map_option[where f=\"tcb_no_ctes_proj\"]\n isCap_simps)\n apply (simp add:cpspace_relation_def)\n apply (clarsimp simp:typ_heap_simps' modify_map_def mex_def meq_def)\n apply (rule conjI)\n apply (rule cpspace_cte_relation_upd_capI, assumption+)\n apply (rule conjI)\n apply (rule setCTE_tcb_case, assumption+)\n apply (case_tac s', clarsimp)\n subgoal by (simp add: carch_state_relation_def cmachine_state_relation_def\n fpu_null_state_heap_update_tag_disj_simps\n global_ioport_bitmap_heap_update_tag_disj_simps)\n\n apply (clarsimp simp: isCap_simps)\n apply (drule(1) cte_lift_ccte_relation,\n drule ccte_relation_ccap_relation)\n apply (simp add: cte_to_H_def)\n apply (frule cap_get_tag_isCap_unfolded_H_cap)\n apply (clarsimp simp: ccap_relation_def cap_lift_untyped_cap\n cap_to_H_simps cap_untyped_cap_lift_def\n is_aligned_shiftr_shiftl\n dest!: ccte_relation_ccap_relation)\n apply (rule unat_of_nat_eq unat_of_nat_eq[symmetric],\n erule order_le_less_trans,\n rule power_strict_increasing, simp_all)\n apply (rule unat_less_helper, rule order_le_less_trans[OF word_and_le1], simp add: mask_def)\n done\n\nend\n\n(* FIXME: Move *)\nlemma ccap_relation_isDeviceCap:\n \"\\ccap_relation cp cap; isUntypedCap cp\n \\ \\ to_bool (capIsDevice_CL (cap_untyped_cap_lift cap)) = (capIsDevice cp)\"\n apply (frule cap_get_tag_UntypedCap)\n apply (simp add:cap_get_tag_isCap )\n done\n\nlemma ccap_relation_isDeviceCap2:\n \"\\ccap_relation cp cap; isUntypedCap cp\n \\ \\ (capIsDevice_CL (cap_untyped_cap_lift cap) = 0) = (\\ (capIsDevice cp))\"\n apply (frule cap_get_tag_UntypedCap)\n apply (simp add:cap_get_tag_isCap to_bool_def)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/X64/Recycle_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.39233683016710835, "lm_q1q2_score": 0.19770094964702578}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n * Object predicates.\n *\n * This file contains the definitions of the state of the objects created\n * by the initialiser - when they are empty, initialised and the states in between.\n * It also contains the decompositions of these predicates.\n *)\n\ntheory ObjectInitialised_SI\nimports WellFormed_SI\nbegin\n\n(************************************************************\n * Definitions about the state of objects,\n * when an object is newly created, completely set up, etc.\n * Non-separation style definitions are labeled \"classical\".\n ************************************************************)\n\n(* Translates the object_ids in a cap for a given transformation.\n * If the object_id is not in the mapping, it is transformed to undefined.\n *)\ndefinition\n cap_transform :: \"(cdl_object_id \\ cdl_object_id) \\ cdl_cap \\ cdl_cap\"\nwhere\n \"cap_transform t cap \\\n let\n t' = \\ obj. case t obj of None \\ undefined | Some obj' \\ obj'\n in\n if is_untyped_cap cap\n then update_cap_objects (t' ` (cap_objects cap)) cap\n else update_cap_object (t' (cap_object cap)) cap\"\n\n(* Translates the object_ids in an object for a given transformation.\n * This does *not* translate the cdl_tcb_fault_endpoint.\n * The cdl_tcb_fault_endpoint specifies a cap pointer,\n * which should be the same in the spec and the kernel\n * (as both are looked up in the same way).\n *)\ndefinition\n spec2s :: \"(cdl_object_id \\ cdl_object_id) \\ cdl_object \\ cdl_object\"\nwhere\n \"spec2s t object \\ update_slots (cap_transform t \\\\<^sub>M object_slots object) object\"\n\n(* This is used to define object_empty, object_initialised (and others).\n * Since we pass in the spec object cap transformation, we can specify\n * objects with no caps, all their caps (or anything else).\n *)\ndefinition\n object_initialised_general :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object \\ cdl_object) \\ (cdl_object_id \\ cdl_object \\ sep_pred) \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"object_initialised_general spec t obj_trans arrow spec_object_id \\ \\s.\n let spec_objects = cdl_objects spec\n in\n \\kernel_object_id. \\spec_object.\n t spec_object_id = Some kernel_object_id \\\n (arrow kernel_object_id (obj_trans spec_object)) s \\\n spec_objects spec_object_id = Some spec_object\"\n\n(* The object is set up (as per the spec). *)\ndefinition\n object_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t) sep_map_o spec_object_id\"\n\n(* The object is created and in it's default state. *)\ndefinition\n object_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_empty spec t spec_object_id \\\n object_initialised_general spec t object_default_state sep_map_o spec_object_id\"\n\ndefinition\n objects_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id set \\ sep_pred\"\nwhere\n \"objects_initialised spec t obj_ids \\ \\* obj_id \\ obj_ids. object_initialised spec t obj_id\"\n\ndefinition\n objects_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id set \\ sep_pred\"\nwhere\n \"objects_empty spec t obj_ids \\ \\* obj_id \\ obj_ids. object_empty spec t obj_id\"\n\n(* The object's fields are set up (as per the spec). *)\ndefinition\n object_fields_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_fields_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t) sep_map_f spec_object_id\"\n\n(* The object's slots are set up (as per the spec). *)\ndefinition\n object_slots_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_slots_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t) sep_map_S spec_object_id\"\n\ndefinition\n object_empty_slots_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_empty_slots_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t) sep_map_E spec_object_id\"\n\n(* A particular slot of an object is set up (as per the spec). *)\ndefinition\n object_slot_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"object_slot_initialised spec t spec_object_id slot \\\n object_initialised_general spec t (spec2s t) (\\p. sep_map_s (p, slot)) spec_object_id\"\n\n(* The object's fields are in their default state. *)\ndefinition\n object_fields_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_fields_empty spec t spec_object_id \\\n object_initialised_general spec t object_default_state sep_map_f spec_object_id\"\n\n(* The object's slots are in their default state. *)\ndefinition\n object_slots_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_slots_empty spec t spec_object_id \\\n object_initialised_general spec t object_default_state sep_map_S spec_object_id\"\n\n(* A particular slot of an object is set up (as per the spec). *)\ndefinition\n object_slot_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"object_slot_empty spec t spec_object_id slot \\\n object_initialised_general spec t object_default_state (\\p. sep_map_s (p, slot)) spec_object_id\"\n\ndefinition\n object_empty_slots_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"object_empty_slots_empty spec t spec_object_id \\\n object_initialised_general spec t object_default_state sep_map_E spec_object_id\"\n\ndefinition slots_in_object_empty ::\n \"(cdl_cap \\ bool) \\ cdl_object_id \\ cdl_state \\\n (cdl_object_id \\ cdl_object_id option) \\ sep_pred\" where\n \"slots_in_object_empty P obj_id spec t \\\n sep_map_set_conj (object_empty spec t)\n {obj. \\slot. slot \\ dom (slots_of obj_id spec)\n \\ cap_at P (obj_id, slot) spec\n \\ obj = cap_ref_object (obj_id, slot) spec}\"\n\ndefinition slots_in_object_init ::\n \"(cdl_cap \\ bool) \\ cdl_object_id \\ cdl_state \\\n (cdl_object_id \\ cdl_object_id option) \\ sep_pred\" where\n \"slots_in_object_init P obj_id spec t \\\n sep_map_set_conj (object_initialised spec t)\n {obj. \\slot. slot \\ dom (slots_of obj_id spec)\n \\ cap_at P (obj_id, slot) spec\n \\ obj = cap_ref_object (obj_id, slot) spec}\"\n\n(**********************************************\n * Predicates about CNodes being initialised. *\n **********************************************)\n\n(* A cnode that has the original caps in it set to NullCap *)\ndefinition\n cnode_half :: \"cdl_state \\ cdl_object_id \\ cdl_object \\ cdl_object\"\nwhere\n \"cnode_half spec obj_id obj = update_slots (\\slot.\n if original_cap_at (obj_id,slot) spec \\ object_slots obj slot \\ None\n then Some NullCap else object_slots obj slot) obj\"\n\ndefinition\n cnode_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"cnode_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ cnode_half spec spec_object_id) sep_map_o spec_object_id\"\n\ndefinition\n cnodes_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id set \\ sep_pred\"\nwhere\n \"cnodes_half_initialised spec t obj_ids \\ \\* obj_id \\ obj_ids. cnode_half_initialised spec t obj_id\"\n\n(* The cnode's fields are half done (as per the spec). *)\ndefinition\n cnode_fields_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"cnode_fields_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ cnode_half spec spec_object_id) sep_map_f spec_object_id\"\n\n(* The cnode's slots are half done (as per the spec). *)\ndefinition\n cnode_slots_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"cnode_slots_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ cnode_half spec spec_object_id) sep_map_S spec_object_id\"\n\n(* A particular slot of an object is set up (as per the spec). *)\ndefinition\n cnode_slot_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"cnode_slot_half_initialised spec t spec_object_id slot \\\n object_initialised_general spec t (spec2s t \\ cnode_half spec spec_object_id) (\\p. sep_map_s (p, slot)) spec_object_id\"\n\ndefinition\n cnode_empty_slots_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"cnode_empty_slots_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ cnode_half spec spec_object_id) sep_map_E spec_object_id\"\n\n\n(**********************************************\n * Predicates about CNodes being initialised. *\n **********************************************)\n\n(* A TCB that isn't set to be schedulable. *)\ndefinition\n tcb_half :: \"cdl_state \\ cdl_object \\ cdl_object\"\nwhere\n \"tcb_half spec obj = update_slots (\\slot.\n if (slot = tcb_pending_op_slot \\ slot = tcb_replycap_slot \\ slot = tcb_boundntfn_slot) \\\n object_slots obj slot \\ None\n then Some NullCap else object_slots obj slot) obj\"\n\ndefinition\n tcb_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"tcb_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ tcb_half spec) sep_map_o spec_object_id\"\n\ndefinition\n tcbs_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id set \\ sep_pred\"\nwhere\n \"tcbs_half_initialised spec t obj_ids \\ \\* obj_id \\ obj_ids. tcb_half_initialised spec t obj_id\"\n\n(* The cnode's fields are half done (as per the spec). *)\ndefinition\n tcb_fields_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"tcb_fields_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ tcb_half spec) sep_map_f spec_object_id\"\n\n(* The cnode's slots are half done (as per the spec). *)\ndefinition\n tcb_slots_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"tcb_slots_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ tcb_half spec) sep_map_S spec_object_id\"\n\n(* A particular slot of an object is set up (as per the spec). *)\ndefinition\n tcb_slot_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"tcb_slot_half_initialised spec t spec_object_id slot \\\n object_initialised_general spec t (spec2s t \\ tcb_half spec) (\\p. sep_map_s (p, slot)) spec_object_id\"\n\ndefinition\n tcb_empty_slots_half_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_object_id \\ sep_pred\"\nwhere\n \"tcb_empty_slots_half_initialised spec t spec_object_id \\\n object_initialised_general spec t (spec2s t \\ tcb_half spec) sep_map_E spec_object_id\"\n\n(********************************************\n * Predicates about IRQs being initialised. *\n ********************************************)\n\ndefinition\n irq_initialised_general :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object \\ cdl_object) \\ (cdl_object_id \\ cdl_object \\ sep_pred) \\\n cdl_irq \\ sep_pred\"\nwhere\n \"irq_initialised_general spec t obj_trans arrow irq \\ \\s.\n \\kernel_irq_id spec_irq_node spec_irq_id.\n t spec_irq_id = Some kernel_irq_id \\\n (irq \\irq kernel_irq_id \\*\n arrow kernel_irq_id (obj_trans spec_irq_node)) s \\\n cdl_irq_node spec irq = spec_irq_id \\\n cdl_objects spec spec_irq_id = Some spec_irq_node\"\n\nlemma irq_initialised_general_def2:\n \"irq_initialised_general spec t obj_trans arrow irq s =\n (\\kernel_irq_id spec_irq_id.\n (object_initialised_general spec t obj_trans arrow spec_irq_id \\*\n irq \\irq kernel_irq_id) s \\\n cdl_irq_node spec irq = spec_irq_id \\\n t spec_irq_id = Some kernel_irq_id)\"\n by (fastforce simp: irq_initialised_general_def object_initialised_general_def\n sep_conj_exists sep_conj_ac)\n\n(* The irq is set up (as per the spec). *)\ndefinition\n irq_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_initialised spec t irq \\\n irq_initialised_general spec t (spec2s t) sep_map_o irq\"\n\n(* The irq is created and in it's default state. *)\ndefinition\n irq_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_empty spec t irq \\\n irq_initialised_general spec t object_default_state sep_map_o irq\"\n\ndefinition\n irqs_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq set \\ sep_pred\"\nwhere\n \"irqs_initialised spec t irqs \\ \\* irq \\ irqs. irq_initialised spec t irq\"\n\ndefinition\n irqs_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq set \\ sep_pred\"\nwhere\n \"irqs_empty spec t irqs \\ \\* irq \\ irqs. irq_empty spec t irq\"\n\n(* The object's fields are set up (as per the spec). *)\ndefinition\n irq_fields_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_fields_initialised spec t irq \\\n irq_initialised_general spec t (spec2s t) sep_map_f irq\"\n\n(* The object's slots are set up (as per the spec). *)\ndefinition\n irq_slots_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_slots_initialised spec t irq \\\n irq_initialised_general spec t (spec2s t) sep_map_S irq\"\n\ndefinition\n irq_slot_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"irq_slot_initialised spec t irq slot \\\n irq_initialised_general spec t (spec2s t) (\\p. sep_map_s (p, slot)) irq\"\n\ndefinition\n irq_empty_slots_initialised :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_empty_slots_initialised spec t irq \\\n irq_initialised_general spec t (spec2s t) sep_map_E irq\"\n\n(* The object's fields are set up (as per the spec). *)\ndefinition\n irq_fields_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_fields_empty spec t irq \\\n irq_initialised_general spec t object_default_state sep_map_f irq\"\n\n(* The object's slots are set up (as per the spec). *)\ndefinition\n irq_slots_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_slots_empty spec t irq \\\n irq_initialised_general spec t object_default_state sep_map_S irq\"\n\ndefinition\n irq_slot_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"irq_slot_empty spec t irq slot \\\n irq_initialised_general spec t object_default_state (\\p. sep_map_s (p, slot)) irq\"\n\ndefinition\n irq_empty_slots_empty :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_irq \\ sep_pred\"\nwhere\n \"irq_empty_slots_empty spec t irq \\\n irq_initialised_general spec t object_default_state sep_map_E irq\"\n\n(*********************************************************************\n * Introduction, destruction, and elimination rules for object_initialised. *\n *********************************************************************)\n\n\nlemma object_slot_initialisedI:\n \"\\t obj_id = Some kernel_object_id; cdl_objects spec obj_id = Some spec_object;\n ((kernel_object_id, slot) \\s (spec2s t spec_object)) s\\\n \\ object_slot_initialised spec t obj_id slot s\"\n by (fastforce simp: object_slot_initialised_def object_initialised_general_def)\n\nlemma object_slot_emptyI:\n \"\\well_formed spec; t obj_id = Some kernel_object_id;\n cdl_objects spec obj_id = Some spec_object;\n ((kernel_object_id, slot) \\s (object_default_state spec_object)) s\\\n \\ object_slot_empty spec t obj_id slot s\"\n apply (drule (1) well_formed_object_slots)\n apply (fastforce simp: object_slot_empty_def object_initialised_general_def)\n done\n\nlemma object_slot_initialisedD:\n \"object_slot_initialised spec t obj_id slot s \\\n \\kernel_object_id spec_object.\n t obj_id = Some kernel_object_id \\\n ((kernel_object_id, slot) \\s (spec2s t spec_object)) s \\\n cdl_objects spec obj_id = Some spec_object\"\n by (clarsimp simp: object_slot_initialised_def object_initialised_general_def)\n\nlemma object_slot_emptyD:\n \"object_slot_empty spec t obj_id slot s \\\n \\kernel_object_id kernel_object spec_object.\n t obj_id = Some kernel_object_id \\\n ((kernel_object_id, slot) \\s (object_default_state spec_object)) s \\\n cdl_objects spec obj_id = Some spec_object\"\n by (clarsimp simp: object_slot_empty_def object_initialised_general_def)\n\nlemma object_slot_initialisedE:\n \"\\object_slot_initialised spec t obj_id slot s;\n \\kernel_object_id spec_object.\n \\t obj_id = Some kernel_object_id \\\n ((kernel_object_id, slot) \\s (spec2s t spec_object)) s \\\n cdl_objects spec obj_id = Some spec_object\\ \\ X\\ \\ X\"\n by (fastforce simp: object_slot_initialised_def object_initialised_general_def)\n\nlemma object_slot_emptyE:\n \"\\object_slot_empty spec t obj_id slot s;\n \\kernel_object_id spec_object.\n \\t obj_id = Some kernel_object_id \\\n ((kernel_object_id, slot) \\s (object_default_state spec_object)) s \\\n cdl_objects spec obj_id = Some spec_object\\ \\ X\\ \\ X\"\n by (fastforce simp: object_slot_empty_def object_initialised_general_def)\n\n(********************************************\n * Decomposition of object_initialised into parts. *\n ********************************************)\n\nlemma spec2s_objects [simp]:\n \"spec2s t Untyped = Untyped\"\n \"spec2s t Endpoint = Endpoint\"\n \"spec2s t Notification = Notification\"\n \"spec2s t (Frame f) = Frame f\"\n by (clarsimp simp: spec2s_def update_slots_def)+\n\nlemma object_initialised_general_decomp:\n \"\\p v. ((arrowL p v) \\* (arrowR p v)) = (arrow p v)\n \\ object_initialised_general spec t obj_trans arrow spec_object_id\n = (object_initialised_general spec t obj_trans arrowL spec_object_id \\*\n object_initialised_general spec t obj_trans arrowR spec_object_id)\"\n by (fastforce simp: object_initialised_general_def sep_conj_exists)\n\n(* This is slightly different, as irq_initialised consumes ownership of the IRQ mapping. *)\nlemma irq_initialised_general_decomp:\n \"\\p v. ((arrowL p v) \\* (arrowR p v)) = (arrow p v)\n \\ irq_initialised_general spec t obj_trans arrow irq\n = (irq_initialised_general spec t obj_trans arrowL irq \\*\n object_initialised_general spec t obj_trans arrowR (cdl_irq_node spec irq))\"\n by (fastforce simp: irq_initialised_general_def object_initialised_general_def\n sep_conj_exists sep_conj_assoc)\n\nlemma cap_transform_nullcap [simp]:\n \"cap_transform t NullCap = NullCap\"\n by (clarsimp simp: cap_transform_def cap_has_object_def\n update_cap_object_def)\n\nlemma cap_transform_pt_simp [simp]:\n \"cap_transform t (PageTableCap x y z) = PageTableCap (the (t x)) y z\"\n by (clarsimp simp: option.the_def cap_transform_def update_cap_object_def cap_object_def\n split: option.splits)\n\nlemma cap_transform_frame [simp]:\n \"cap_transform t (FrameCap x ptr rights n y z) = FrameCap x (the (t ptr)) rights n y z\"\n by (clarsimp simp: option.the_def cap_transform_def update_cap_object_def cap_object_def\n split: option.splits)\n\nlemma cap_type_cap_transform [simp]:\n \"cap_type (cap_transform t cap) = cap_type cap\"\n by (clarsimp simp: cap_transform_def cap_has_object_def)\n\nlemma cap_has_object_cap_transform [simp]:\n \"cap_has_object (cap_transform t cap) = cap_has_object cap\"\n by (clarsimp simp: cap_transform_def)\n\nlemma well_formed_cap_cap_transform [simp]:\n \"well_formed_cap (cap_transform t cap) = well_formed_cap cap\"\n by (clarsimp simp: cap_transform_def)\n\nlemma is_default_cap_cap_transform [simp]:\n \"well_formed_cap cap \\ is_default_cap (cap_transform t cap) = is_default_cap cap\"\n apply (clarsimp simp: is_default_cap_def well_formed_cap_def cap_type_def default_cap_def\n cap_transform_def cap_has_object_def)\n apply (cases cap, simp_all add: update_cap_object_def cnode_cap_size_def)\n done\n\nlemma default_cap_cap_transform:\n \"\\is_default_cap cap; well_formed_cap cap; t (cap_object cap) = Some obj_id;\n cap_type cap = Some type; type \\ IRQNodeType\\\n \\ default_cap type {obj_id} (cnode_cap_size cap) (is_device_cap cap) = cap_transform t cap\"\n by (clarsimp simp: is_default_cap_def default_cap_def cap_transform_def cap_type_def\n well_formed_cap_def cap_has_object_def\n update_cap_object_def split: cdl_cap.splits)+\n\nlemma cap_transform_update_cap_object:\n \"\\t obj_id = Some k_obj_id; cap_object cap = obj_id; cap_type cap \\ Some UntypedType\\\n \\ cap_transform t cap = update_cap_object k_obj_id cap\"\n by (clarsimp simp: update_cap_object_def cap_transform_def\n cap_object_def cap_has_object_def\n split: cdl_cap.splits)\n\nlemma is_default_cap_def2:\n \"is_default_cap cap =\n ((\\type. cap_type cap = Some type \\ cap = default_cap type (cap_objects cap) (cnode_cap_size cap) (is_device_cap cap)) \\\n is_irqhandler_cap cap)\"\n apply (clarsimp simp:is_default_cap_def)\n apply (case_tac cap)\n apply (auto simp: default_cap_def cap_type_def)\n done\n\nlemma default_cap_update_cap_object:\n \"\\is_default_cap cap; cap_type cap = Some type; cnode_cap_size cap \\ 32;\n type \\ UntypedType; type \\ AsidPoolType; type \\ IRQNodeType\\\n \\ default_cap type {obj_id} (cnode_cap_size cap) (is_device_cap cap) = update_cap_object obj_id cap\"\n apply (subst default_cap_cap_transform, simp_all)\n apply (frule (1) default_cap_well_formed_cap2 [where obj_ids=\"cap_objects cap\"\n and sz = \"(cnode_cap_size cap)\" and dev = \"is_device_cap cap\"], simp+)\n apply (fastforce simp: is_default_cap_def2)\n apply (subst cap_transform_update_cap_object, simp_all)\n done\n\nlemma default_cap_update_cap_object_pd:\n \"\\is_pd_cap cap; \\ vm_cap_has_asid cap; \\ is_fake_vm_cap cap\\\n \\ default_cap PageDirectoryType {obj_id} (cnode_cap_size cap) dev = update_cap_object obj_id cap\"\n by (clarsimp simp: default_cap_def update_cap_object_def cap_type_def\n vm_cap_has_asid_def is_fake_vm_cap_def not_Some_eq_tuple\n split: cdl_cap.splits cdl_frame_cap_type.splits)\n\nlemma object_type_spec2s [simp]:\n \"object_type (spec2s t obj) = object_type obj\"\n by (clarsimp simp: spec2s_def)\n\nlemma dom_object_slots_spec2s [simp]:\n \"dom (object_slots (spec2s t spec_object)) = dom (object_slots spec_object)\"\n by (fastforce simp: spec2s_def update_slots_def object_slots_def\n split: cdl_object.splits option.splits)\n\nlemma object_slots_spec2s:\n \"\\has_slots obj; object_slots obj slot = Some cap;\n t (cap_object cap) = Some cap_object_id;\n cap_has_object cap; \\is_untyped_cap cap\\\n \\ object_slots (spec2s t obj) slot = Some (update_cap_object cap_object_id cap)\"\n apply (clarsimp simp: spec2s_def)\n apply (clarsimp simp: cap_transform_def)\n done\n\nlemma object_slots_spec2s':\n \"object_slots obj slot = Some spec_cap\n \\ object_slots (spec2s t obj) slot = Some (cap_transform t spec_cap)\"\n by (auto simp: spec2s_def object_slots_def update_slots_def\n split: cdl_object.splits)\n\nlemma object_slots_spec2s_NullCap [simp]:\n \"object_slots obj slot = Some NullCap\n \\ object_slots (spec2s t obj) slot = Some NullCap\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: spec2s_def)+\n done\n\nlemma update_cap_object_irqhandler_cap [simp]:\n \"is_irqhandler_cap cap \\ update_cap_object obj_id cap = cap\"\n by (clarsimp simp: update_cap_object_def cap_type_def split: cdl_cap.splits)\n\nlemma cap_transform_irqhandler_cap [simp]:\n \"is_irqhandler_cap cap \\ cap_transform t cap = cap\"\n by (clarsimp simp: cap_transform_def)\n\nlemma object_slots_spec2s_irqhandler_cap [simp]:\n \"\\object_slots obj slot = Some cap; is_irqhandler_cap cap\\\n \\ object_slots (spec2s t obj) slot = Some cap\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: spec2s_def)+\n done\n\nlemma update_slots_empty_spec2s [simp]:\n \"update_slots Map.empty (spec2s t obj)\n = update_slots Map.empty obj\"\n by (clarsimp simp: spec2s_def)\n\nlemma object_to_sep_state_fields_spec2s [simp]:\n \"object_to_sep_state obj_id (spec2s t obj) {Fields}\n = object_to_sep_state obj_id obj {Fields}\"\n apply (rule ext)\n apply (clarsimp simp: object_to_sep_state_def object_project_def object_clean_def\n asid_reset_def spec2s_def object_wipe_slots_def)\n done\n\nlemma sep_map_f_spec2s [simp]:\n \"obj_id \\f spec2s t obj = obj_id \\f obj\"\n by (auto simp: sep_map_f_def sep_map_general_def)\n\nlemma object_type_cnode_half [simp]:\n \"object_type (cnode_half spec obj_id obj) = object_type obj\"\n by (clarsimp simp: cnode_half_def)\n\nlemma object_type_tcb_half [simp]:\n \"object_type (tcb_half spec tcb) = object_type tcb\"\n by (simp add: tcb_half_def)\n\nlemma dom_object_slots_cnode_half [simp]:\n \"dom (object_slots (cnode_half spec obj_id obj)) = dom (object_slots obj)\"\n apply (clarsimp simp: cnode_half_def)\n apply (case_tac \"has_slots obj\")\n apply (auto simp: dom_def)\n done\n\nlemma dom_object_slots_tcb_half [simp]:\n \"dom (object_slots (tcb_half spec tcb)) =\n dom (object_slots tcb)\"\n apply (clarsimp simp: tcb_half_def)\n apply (case_tac \"has_slots tcb\")\n apply (auto simp: dom_def)\n done\n\nlemma object_slots_tcb_half:\n \"object_slots (tcb_half spec obj) =\n (\\slot. if (slot = tcb_pending_op_slot \\ slot = tcb_replycap_slot \\ slot = tcb_boundntfn_slot) \\ object_slots obj slot \\ None\n then Some NullCap else object_slots obj slot)\"\n by (case_tac \"has_slots obj\", auto simp: tcb_half_def split: if_split_asm)\n\nlemma intent_reset_object_type:\n \"intent_reset obj = intent_reset obj' \\ object_type obj = object_type obj'\"\n by (clarsimp simp: intent_reset_def object_type_def split: cdl_object.splits)\n\nlemma intent_reset_object_slots:\n \"intent_reset obj = intent_reset obj' \\ object_slots obj = object_slots obj'\"\n by (clarsimp simp: intent_reset_def object_slots_def cdl_tcb.splits split: cdl_object.splits)\n\nlemma intent_reset_object_size_bits:\n \"intent_reset obj = intent_reset obj' \\ object_size_bits obj = object_size_bits obj'\"\n by (clarsimp simp: intent_reset_def object_size_bits_def split: cdl_object.splits)\n\nlemma intent_reset_cnode:\n \"\\intent_reset obj = intent_reset obj'; object_type obj = CNodeType\\\n \\ obj = obj'\"\n by (clarsimp simp: intent_reset_def object_type_def split: cdl_object.splits)\n\nlemma intent_reset_object_slots_NullCap:\n \"\\intent_reset (object_default_state obj) = intent_reset obj';\n slot < 2 ^ object_size_bits obj; has_slots obj\\\n \\ object_slots obj' slot = Some NullCap\"\n apply (frule intent_reset_object_slots [THEN sym])\n apply (clarsimp simp: object_default_state_def2 object_type_def has_slots_def\n object_size_bits_def object_slots_def default_tcb_def\n empty_cnode_def empty_irq_node_def empty_cap_map_def pt_size_def pd_size_def\n split: cdl_object.splits)\n done\n\nlemma object_slots_object_default_state_NullCap':\n \"\\slot < 2 ^ object_size_bits obj; has_slots obj\\\n \\ object_slots (object_default_state obj) slot = Some NullCap\"\n by (clarsimp simp: object_default_state_def2 object_type_def has_slots_def\n object_size_bits_def object_slots_def default_tcb_def\n empty_cnode_def empty_irq_node_def empty_cap_map_def pt_size_def pd_size_def\n split: cdl_object.splits)\n\nlemma dom_range_upper:\n \"\\dom f = {0.. \\ x < n\"\n by fastforce\n\nlemma object_slots_object_default_state_NullCap:\n \"\\well_formed spec; \\tcb_at obj_id spec; opt_cap (obj_id, slot) spec = Some cap;\n cdl_objects spec obj_id = Some spec_object\\\n \\ object_slots (object_default_state spec_object) slot = Some NullCap\"\n apply (drule (1) well_formed_object_slots)\n apply (clarsimp simp: object_default_state_def2\n split: cdl_object.splits,\n (fastforce simp: object_at_def is_cnode_def object_size_bits_def object_slots_def\n empty_cnode_def empty_irq_node_def empty_cap_map_def\n opt_cap_def slots_of_def\n dest!: dom_range_upper)+)\n done\n\nlemma intent_reset_remove:\n \"obj = obj' \\ intent_reset obj = intent_reset obj'\"\n by (rule arg_cong)\n\nlemma sep_map_E_eq:\n \"\\object_type obj = object_type obj'; dom (object_slots obj) = dom (object_slots obj')\\\n \\ (p \\E obj) = (p \\E obj')\"\n apply (clarsimp simp: sep_map_E_def sep_map_S'_def sep_map_general_def)\n apply (rule ext)\n apply (subgoal_tac \"object_to_sep_state p obj (Slot ` (UNIV - dom (object_slots obj')))\n = object_to_sep_state p obj' (Slot ` (UNIV - dom (object_slots obj')))\")\n apply simp\n apply (fastforce simp: object_to_sep_state_def split_def\n object_project_def object_slots_object_clean\n split: option.splits)\n done\n\nlemma sep_map_E_object_default_state:\n \"dom (object_slots (object_default_state obj)) = dom (object_slots obj)\n \\ (p \\E object_default_state obj) = (p \\E obj)\"\n using sep_map_E_eq [where obj=\"object_default_state obj\" and obj'=obj]\n by simp\n\nlemma sep_map_E_intent_reset:\n \"\\intent_reset obj = intent_reset obj'\\\n \\ (p \\E obj) = (p \\E obj')\"\n apply (cut_tac obj=obj and obj'=obj' in sep_map_E_eq)\n apply (erule intent_reset_object_type)\n apply (drule intent_reset_object_slots, simp)\n apply simp\n done\n\nlemma sep_map_E_spec2s [simp]:\n \"(p \\E spec2s t obj) = (p \\E obj)\"\n apply (cut_tac obj=\"spec2s t obj\" and obj'=obj in sep_map_E_eq, simp)\n apply (clarsimp simp: spec2s_def)\n apply (case_tac \"has_slots obj\")\n apply simp+\n done\n\nlemma sep_map_E_tcb_half [simp]:\n \"obj_id \\E tcb_half spec tcb = obj_id \\E tcb\"\n by (rule sep_map_E_eq, simp+)\n\nlemma object_to_sep_state_fields_tcb_eq:\n \"\\cdl_tcb_fault_endpoint tcb = cdl_tcb_fault_endpoint tcb';\n cdl_tcb_has_fault tcb = cdl_tcb_has_fault tcb';\n cdl_tcb_domain tcb = cdl_tcb_domain tcb'\\\n \\ object_to_sep_state obj_id (Tcb tcb) {Fields}\n = object_to_sep_state obj_id (Tcb tcb') {Fields}\"\n apply (rule ext)\n apply (clarsimp simp: object_to_sep_state_def object_project_def object_clean_def\n asid_reset_def spec2s_def object_wipe_slots_def\n update_slots_def intent_reset_def cdl_tcb.splits)\n done\n\nlemma sep_map_f_eq_tcb:\n \"\\cdl_tcb_fault_endpoint tcb = cdl_tcb_fault_endpoint tcb';\n cdl_tcb_has_fault tcb = cdl_tcb_has_fault tcb';\n cdl_tcb_domain tcb = cdl_tcb_domain tcb'\\\n \\ obj_id \\f Tcb tcb = obj_id \\f Tcb tcb'\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def object_slots_def\n object_clean_def intent_reset_def asid_reset_def update_slots_def)\n apply (subst object_to_sep_state_fields_tcb_eq [where tcb'=tcb'], simp_all)\n done\n\nlemma sep_map_f_intent_reset_cnode:\n \"\\object_type obj = CNodeType; intent_reset obj = intent_reset obj'\\\n \\ obj_id \\f obj = obj_id \\f obj'\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\n apply (clarsimp simp: intent_reset_def object_type_def\n split: cdl_object.splits)\n done\n\nlemma sep_map_f_empty_cnode:\n \"obj_id \\f CNode (empty_cnode sz) =\n obj_id \\f CNode \\cdl_cnode_caps = Map.empty, cdl_cnode_size_bits = sz\\\"\n apply (rule ext, rename_tac s)\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (intro iffI ext |\n clarsimp simp: object_to_sep_state_def object_clean_def\n object_project_def object_slots_object_clean asid_reset_def\n intent_reset_def object_wipe_slots_def\n update_slots_def empty_cnode_def)+\n done\n\nlemma empty_cnode_object_size_bits:\n \"object_type obj = CNodeType \\ obj_id \\f CNode (empty_cnode (object_size_bits obj)) = obj_id \\f obj\"\n apply (subst sep_map_f_empty_cnode)\n apply (rule ext)\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\napply (intro iffI ext |\n clarsimp simp: object_type_def object_size_bits_def\n object_clean_def reset_cap_asid_def asid_reset_def\n object_to_sep_state_def object_project_def intent_reset_def\n object_wipe_slots_def update_slots_def cdl_cnode.splits\n split: cdl_object.splits)+\n done\n\nlemma sep_map_f_object_size_bits_cnode:\n \"\\object_type obj = CNodeType; object_type obj' = CNodeType;\n object_size_bits obj = object_size_bits obj'\\\n \\ obj_id \\f obj = obj_id \\f obj'\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\n apply (intro iffI ext |\n clarsimp simp: object_type_def object_size_bits_def\n object_to_sep_state_def object_project_def intent_reset_def\n object_wipe_slots_def update_slots_def\n cdl_cnode.splits object_clean_def asid_reset_def\n split: cdl_object.splits)+\n done\n\nlemma sep_map_f_object_size_bits_pt:\n \"\\object_type obj = PageTableType; object_type obj' = PageTableType\\\n \\ obj_id \\f obj = obj_id \\f obj'\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\n apply (intro iffI ext |\n clarsimp simp: object_type_def object_size_bits_def\n object_to_sep_state_def object_project_def intent_reset_def\n object_wipe_slots_def update_slots_def object_clean_def asid_reset_def\n split: cdl_object.splits)+\n done\n\nlemma sep_map_f_object_size_bits_pd:\n \"\\object_type obj = PageDirectoryType; object_type obj' = PageDirectoryType\\\n \\ obj_id \\f obj = obj_id \\f obj'\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\napply (intro iffI ext |\n clarsimp simp: object_type_def object_size_bits_def\n object_to_sep_state_def object_project_def intent_reset_def\n object_wipe_slots_def update_slots_def object_clean_def asid_reset_def\n split: cdl_object.splits)+\n done\n\n(********************************************************\n * Object done, and other such predicate decompositions *\n ********************************************************)\n\nlemma object_initialised_decomp:\n \"object_initialised spec t spec_object_id =\n (object_fields_initialised spec t spec_object_id \\*\n object_slots_initialised spec t spec_object_id)\"\n apply (clarsimp simp: object_initialised_def object_fields_initialised_def object_slots_initialised_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_o_decomp)\n done\n\nlemma object_empty_decomp:\n \"object_empty spec t spec_object_id =\n (object_fields_empty spec t spec_object_id \\*\n object_slots_empty spec t spec_object_id)\"\n apply (clarsimp simp: object_empty_def object_fields_empty_def object_slots_empty_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_o_decomp)\n done\n\nlemma cnode_half_initialised_decomp:\n \"cnode_half_initialised spec t spec_object_id =\n (cnode_fields_half_initialised spec t spec_object_id \\*\n cnode_slots_half_initialised spec t spec_object_id)\"\n apply (clarsimp simp: cnode_half_initialised_def cnode_fields_half_initialised_def cnode_slots_half_initialised_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_o_decomp)\n done\n\nlemma irq_initialised_decomp:\n \"irq_initialised spec t irq =\n (irq_slots_initialised spec t irq \\*\n object_fields_initialised spec t (cdl_irq_node spec irq))\"\n apply (clarsimp simp: irq_initialised_def object_fields_initialised_def irq_slots_initialised_def)\n apply (rule irq_initialised_general_decomp)\n apply (clarsimp simp: sep_map_o_decomp sep_conj_ac)\n done\n\nlemma irq_empty_decomp:\n \"irq_empty spec t irq =\n (irq_slots_empty spec t irq \\*\n object_fields_empty spec t (cdl_irq_node spec irq))\"\n apply (clarsimp simp: irq_empty_def object_fields_empty_def irq_slots_empty_def)\n apply (rule irq_initialised_general_decomp)\n apply (clarsimp simp: sep_map_o_decomp sep_conj_ac)\n done\n\n(************************************\n * object_slots_initialised rewrite rules. *\n ************************************)\n\nlemma object_slot_initialised_eq:\n \"\\t obj_id = Some kernel_object_id; cdl_objects spec obj_id = Some spec_object\\\n \\ object_slot_initialised spec t obj_id slot\n = (kernel_object_id, slot) \\s (spec2s t spec_object)\"\n apply (rule ext, rename_tac s)\n apply (fastforce simp: object_slot_initialised_def object_initialised_general_def)\n done\n\nlemma object_slot_empty_eq:\n \"\\well_formed spec; t obj_id = Some kernel_object_id;\n cdl_objects spec obj_id = Some spec_object\\\n \\ object_slot_empty spec t obj_id slot\n = (kernel_object_id, slot) \\s (object_default_state spec_object)\"\n apply (rule ext, rename_tac s)\n apply (drule (1) well_formed_object_slots)\n apply (fastforce simp: object_slot_empty_def object_initialised_general_def)\n done\n\n(****************************************************************************\n * Lemmas decomposing object_slots_initialised. *\n * These show that initialising an objects slots can be done slot by slot. *\n ****************************************************************************)\n\nlemma object_slots_initialised_decomp_helper:\n \"\\slots \\ {}; slots \\ UNIV\\\n \\ object_slots_initialised spec t obj_id =\n (object_initialised_general spec t (spec2s t) (\\obj_id. sep_map_S' (obj_id, slots)) obj_id \\*\n object_initialised_general spec t (spec2s t) (\\obj_id. sep_map_S' (obj_id, UNIV-slots)) obj_id)\"\n apply (clarsimp simp: object_slots_initialised_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_S_decomp')\n done\n\nlemma object_slots_empty_decomp_helper:\n \"\\slots \\ {}; slots \\ UNIV\\\n \\ object_slots_empty spec t obj_id =\n (object_initialised_general spec t object_default_state (\\obj_id. sep_map_S' (obj_id, slots)) obj_id \\*\n object_initialised_general spec t object_default_state (\\obj_id. sep_map_S' (obj_id, UNIV-slots)) obj_id)\"\n apply (clarsimp simp: object_slots_empty_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_S_decomp')\n done\n\nlemma cnode_slots_half_initialised_decomp_helper:\n \"\\slots \\ {}; slots \\ UNIV\\\n \\ cnode_slots_half_initialised spec t obj_id =\n (object_initialised_general spec t (spec2s t \\ cnode_half spec obj_id) (\\obj_id. sep_map_S' (obj_id, slots)) obj_id \\*\n object_initialised_general spec t (spec2s t \\ cnode_half spec obj_id) (\\obj_id. sep_map_S' (obj_id, UNIV-slots)) obj_id)\"\n apply (clarsimp simp: cnode_slots_half_initialised_def)\n apply (rule object_initialised_general_decomp)\n apply (clarsimp simp: sep_map_S_decomp')\n done\n\nlemma sep_map_exists_rewrite':\n \"\\((obj_id, slots) \\S' obj') s; intent_reset obj' = intent_reset obj\\\n \\ ((obj_id, slots) \\S' obj) s\"\n apply (clarsimp simp: intent_reset_def sep_map_S'_def sep_map_general_def\n split: cdl_object.splits)\n apply (rename_tac cdl_tcb cdl_tcb')\n apply (rule ext)\n apply (clarsimp simp: sep_map_S'_def sep_map_general_def intent_reset_def\n object_slots_object_clean object_to_sep_state_def object_project_def\n split: if_split_asm)\n apply (case_tac cdl_tcb,clarsimp)\n apply (case_tac cdl_tcb',clarsimp simp:object_slots_def)\n apply (intro conjI |\n clarsimp simp: object_slots_object_clean |\n clarsimp simp: object_slots_def)+\n done\n\nlemma sep_map_exists_rewrite:\n \"(\\s. \\obj'. ((obj_id, slots) \\S' obj') s \\ intent_reset obj = intent_reset obj') =\n (obj_id, slots) \\S' obj\"\n apply (rule ext)\n apply (rule iffI)\n apply clarsimp\n apply (erule sep_map_exists_rewrite', simp)\n apply fastforce\n done\n\nlemma object_slots_general_decomp_list:\n \"\\distinct slots; slots \\ []\\\n \\ (object_initialised_general spec t obj_trans (\\obj_id. sep_map_S' (obj_id, set slots)) obj_id) =\n (\\* map (\\slot. object_initialised_general spec t obj_trans (\\p. sep_map_s (p, slot)) obj_id) slots)\"\n apply (induct slots)\n apply clarsimp\n apply (atomize)\n apply (case_tac \"slots = []\")\n apply (clarsimp simp: object_initialised_general_def sep_map_S'_def sep_map_s_def)\n apply (clarsimp simp: object_initialised_general_def)\n apply (rule ext)\n apply (rule iffI)\n apply clarsimp\n apply (drule_tac obj_id=kernel_object_id and obj=\"obj_trans spec_object\" in sep_map_S'_decomp', simp)\n apply (fastforce simp: sep_conj_exists sep_conj_ac)\n apply (clarsimp simp: sep_conj_exists)\n apply (drule_tac obj_id=kernel_object_id and obj=\"obj_trans spec_object\" in sep_map_S'_decomp', simp)\n apply (fastforce simp: sep_conj_exists sep_conj_ac)\n done\n\nlemma object_slots_general_decomp_set:\n \"\\finite slots; slots \\ {}\\\n \\ (object_initialised_general spec t obj_trans (\\obj_id. sep_map_S' (obj_id, slots)) obj_id) =\n (\\* slot \\ slots. object_initialised_general spec t obj_trans (\\p. sep_map_s (p, slot)) obj_id)\"\n apply (drule sep_map_set_conj_sep_list_conj [where\n P=\"\\slot. object_initialised_general spec t obj_trans (\\p. sep_map_s (p, slot)) obj_id\"])\n apply (elim exE conjE)\n apply simp\n apply (subst object_slots_general_decomp_list [symmetric], clarsimp+)\n done\n\nlemma object_slots_initialised_decomp':\n \"\\finite slots; slots \\ {}\\\n \\ (object_initialised_general spec t (spec2s t) (\\obj_id. sep_map_S' (obj_id, slots)) obj_id) =\n (\\* slot \\ slots. object_slot_initialised spec t obj_id slot)\"\n apply (clarsimp simp: object_slot_initialised_def [abs_def])\n apply (erule (1) object_slots_general_decomp_set)\n done\n\nlemma object_slots_empty_decomp':\n \"\\finite slots; slots \\ {}\\\n \\ (object_initialised_general spec t object_default_state (\\obj_id. sep_map_S' (obj_id, slots)) obj_id) =\n (\\* slot \\ slots. object_slot_empty spec t obj_id slot)\"\n apply (clarsimp simp: object_slot_empty_def [abs_def])\n apply (erule (1) object_slots_general_decomp_set)\n done\n\nlemma cnode_slots_half_initialised_decomp':\n \"\\finite slots; slots \\ {}\\\n \\ (object_initialised_general spec t (spec2s t \\ cnode_half spec obj_id) (\\obj_id. sep_map_S' (obj_id, slots)) obj_id) =\n (\\* slot \\ slots. cnode_slot_half_initialised spec t obj_id slot)\"\n apply (clarsimp simp: cnode_slot_half_initialised_def [abs_def])\n apply (erule (1) object_slots_general_decomp_set)\n done\n\nlemma empty_slots_object_slots_initialised_object_empty_slots_initialised:\n \"dom (slots_of obj_id spec) = {} \\ object_empty_slots_initialised spec t obj_id = object_slots_initialised spec t obj_id\"\n apply (rule ext, rename_tac s)\n apply (clarsimp simp: object_slots_initialised_def object_empty_slots_initialised_def object_initialised_general_def)\n apply (rule iffI)\n apply clarsimp\n apply (clarsimp simp: sep_map_S_def sep_map_S'_def sep_map_E_def slots_of_def\n split: option.splits)\n apply (fastforce simp: intent_reset_def spec2s_def object_slots_def cdl_tcb.splits\n split: cdl_object.splits)\n apply clarsimp\n apply (clarsimp simp: sep_map_S_def sep_map_S'_def sep_map_E_def slots_of_def\n split: option.splits)\n apply (fastforce simp: intent_reset_def spec2s_def object_slots_def cdl_tcb.splits\n split: cdl_object.splits)\n done\n\nlemma object_empty_slots_initialised_def2:\n \"object_empty_slots_initialised spec t obj_id =\n object_initialised_general spec t (spec2s t) (\\obj_id'. sep_map_S' (obj_id', UNIV - dom (slots_of obj_id spec))) obj_id\"\n apply (clarsimp simp: object_empty_slots_initialised_def object_initialised_general_def sep_map_E_def)\n apply (fastforce simp: slots_of_def\n split: option.splits)\n done\n\nlemma object_slots_initialised_decomp:\n \"well_formed spec \\\n object_slots_initialised spec t obj_id =\n ((\\* slot \\ dom (slots_of obj_id spec). (object_slot_initialised spec t obj_id) slot) \\*\n object_empty_slots_initialised spec t obj_id)\"\n apply (drule well_formed_finite [where obj_id=obj_id])\n apply (case_tac \"dom (slots_of obj_id spec) = {}\")\n apply clarsimp\n apply (rule empty_slots_object_slots_initialised_object_empty_slots_initialised [THEN sym], simp)\n apply (subst object_slots_initialised_decomp_helper, assumption)\n apply clarsimp\n apply (clarsimp simp: object_empty_slots_initialised_def2)\n apply (drule_tac obj_id=obj_id and spec=spec and t=t in object_slots_initialised_decomp', simp)\n apply clarsimp\n done\n\nlemma object_initialised_decomp_total:\n \"\\well_formed spec\\\n \\ object_initialised spec t obj_id =\n (object_fields_initialised spec t obj_id \\*\n (\\* slot \\ dom (slots_of obj_id spec). object_slot_initialised spec t obj_id slot) \\*\n object_empty_slots_initialised spec t obj_id)\"\n by (clarsimp simp: object_initialised_decomp object_slots_initialised_decomp sep_conj_assoc)\n\nlemma object_slot_empty_initialised_NullCap:\n \"\\well_formed spec; \\tcb_at obj_id spec; opt_cap (obj_id, slot) spec = Some NullCap\\ \\\n object_slot_empty spec t obj_id slot = object_slot_initialised spec t obj_id slot\"\n apply (clarsimp simp: object_slot_empty_def object_slot_initialised_def object_initialised_general_def)\n apply (rule ext)\n apply (rule iffI)\n apply (clarsimp simp: sep_conj_exists)\n apply (cut_tac obj=\"object_default_state spec_object\" and obj_id=kernel_object_id and\n obj'=\"spec2s t spec_object\" and slot=slot\n in sep_map_s_object_slots_equal)\n apply (clarsimp simp: object_slots_opt_cap)\n apply (drule (3) object_slots_object_default_state_NullCap, simp)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: sep_conj_exists)\n apply (cut_tac obj=\"spec2s t spec_object\" and obj_id=kernel_object_id and\n obj'=\"object_default_state spec_object\" and slot=slot\n in sep_map_s_object_slots_equal)\n apply (drule (3) object_slots_object_default_state_NullCap)\n apply (clarsimp simp: object_slots_opt_cap)\n apply clarsimp\n apply clarsimp\n done\n\nlemma object_empty_slots_empty_initialised:\n \"well_formed spec\n \\ object_empty_slots_empty spec t spec_object_id =\n object_empty_slots_initialised spec t spec_object_id\"\n apply (clarsimp simp: object_empty_slots_initialised_def object_empty_slots_empty_def\n object_initialised_general_def)\n apply (rule ext)\n apply (rule iffI)\n apply clarsimp\n apply (frule (1) well_formed_object_slots)\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=spec_object_id in allE)\n apply (clarsimp simp: sep_map_E_object_default_state\n split: option.splits)\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=spec_object_id in allE)\n apply (clarsimp split: option.splits)\n apply (drule_tac obj=spec_object and p=kernel_object_id in sep_map_E_object_default_state, simp)\n done\n\nlemma cnode_empty_slots_half_initialised_object_empty_slots_initialised:\n \"cnode_empty_slots_half_initialised spec t spec_object_id =\n object_empty_slots_initialised spec t spec_object_id\"\n apply (clarsimp simp: object_empty_slots_initialised_def cnode_empty_slots_half_initialised_def\n object_initialised_general_def)\n apply (rule ext)\n apply (rule iffI)\n apply (clarsimp split: option.splits)\n apply (cut_tac p=kernel_object_id and obj=spec_object and\n obj'=\"cnode_half spec spec_object_id spec_object\" in\n sep_map_E_eq [OF sym], simp+)\n apply (clarsimp split: option.splits)\n apply (cut_tac p=kernel_object_id and obj=\"cnode_half spec spec_object_id spec_object\" and\n obj'=\"spec_object\" in\n sep_map_E_eq [OF sym], simp+)\n done\n\nlemma object_default_state_has_slots_not_empty:\n \"has_slots obj \\ dom (object_slots (object_default_state obj)) \\ {}\"\n apply (clarsimp simp: object_default_state_def2 has_slots_def object_slots_def\n default_tcb_def tcb_pending_op_slot_def\n empty_cnode_def empty_irq_node_def empty_cap_map_def\n split: cdl_object.splits)\n apply (clarsimp simp: fun_eq_iff, erule_tac x=0 in allE, simp)+\n done\n\nlemma well_formed_has_slots:\n \"\\well_formed spec; cdl_objects spec obj_id = Some obj; object_slots obj = Map.empty; has_slots obj \\ \\ False\"\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp split: option.splits)\n apply (drule object_default_state_has_slots_not_empty, simp)\n done\n\nlemma sep_map_S_object_default_state_no_slots:\n \"\\ has_slots obj \\ (obj_id \\S object_default_state obj) = (obj_id \\S obj)\"\n apply (clarsimp simp: sep_map_S_def sep_map_general_def)\n apply (intro ext conjI iffI |\n clarsimp simp: object_to_sep_state_def object_project_def\n update_slots_def empty_cnode_def\n object_slots_object_clean\n object_default_state_def default_object_def\n object_type_def has_slots_def\n split: cdl_component_id.splits option.splits cdl_object.splits)+\n done\n\nlemma sep_map_s_object_default_state_no_slots:\n \"\\ has_slots obj \\ (obj_id, slot) \\s object_default_state obj = (obj_id, slot) \\s obj\"\n apply (clarsimp simp: sep_map_s_def sep_map_general_def)\n apply (intro ext conjI iffI |\n clarsimp simp: object_to_sep_state_def object_project_def\n update_slots_def empty_cnode_def\n object_slots_object_clean\n object_default_state_def default_object_def\n object_type_def has_slots_def\n split: cdl_component_id.splits option.splits cdl_object.splits)+\n done\n\nlemma object_slots_empty_initialised_no_slots:\n \"\\well_formed spec; slots_of obj_id spec = Map.empty\\\n \\ object_slots_empty spec t obj_id = object_slots_initialised spec t obj_id\"\n apply (clarsimp simp: slots_of_def split: option.splits)\n apply (clarsimp simp: object_slots_empty_def object_slots_initialised_def object_initialised_general_def)\n apply (rename_tac obj)\n apply (case_tac \"has_slots obj\")\n apply (drule (3) well_formed_has_slots, simp)\n apply (frule (1) well_formed_object_slots)\n apply (clarsimp simp: object_slots_empty_def object_slots_initialised_def object_initialised_general_def)\n apply (rule ext, rule iffI)\n apply (clarsimp simp: spec2s_def)\n apply (drule_tac obj_id=kernel_object_id in sep_map_S_object_default_state_no_slots, simp)\n apply clarsimp\n apply (clarsimp simp: spec2s_def)\n apply (drule_tac obj_id=kernel_object_id in sep_map_S_object_default_state_no_slots, simp)\n done\n\nlemma object_empty_slots_empty_def2:\n \"well_formed spec\n \\ object_empty_slots_empty spec t obj_id =\n object_initialised_general spec t object_default_state (\\obj_id'. sep_map_S' (obj_id', UNIV - dom (slots_of obj_id spec))) obj_id\"\n apply (clarsimp simp: object_empty_slots_empty_def object_initialised_general_def sep_map_E_def)\n apply (rule ext)\n apply (rule iffI)\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp split: option.splits)\n apply (fastforce simp: slots_of_def split: option.splits)\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp split: option.splits)\n apply (fastforce simp: slots_of_def split: option.splits)\n done\n\nlemma cnode_empty_slots_half_initialised_def2:\n \"cnode_empty_slots_half_initialised spec t obj_id =\n object_initialised_general spec t (spec2s t \\ cnode_half spec obj_id)\n (\\obj_id'. sep_map_S' (obj_id', UNIV - dom (slots_of obj_id spec))) obj_id\"\n apply (clarsimp simp: object_empty_slots_initialised_def cnode_empty_slots_half_initialised_def\n object_initialised_general_def)\n apply (rule ext)\n apply (rule iffI)\n apply (clarsimp split: option.splits)\n apply (cut_tac p=kernel_object_id and\n obj=\"cnode_half spec obj_id spec_object\" and\n obj'=\"spec2s t (cnode_half spec obj_id spec_object)\" in\n sep_map_E_eq, simp, simp)\n apply (clarsimp simp: sep_map_E_def slots_of_def split: option.splits)\n apply clarsimp\n apply (cut_tac p=kernel_object_id and\n obj=\"spec2s t (cnode_half spec obj_id spec_object)\" and\n obj'=\"cnode_half spec obj_id spec_object\" in\n sep_map_E_eq, simp, simp)\n apply (clarsimp simp: sep_map_E_def slots_of_def)\n done\n\nlemma object_slots_empty_decomp:\n \"\\well_formed spec\\\n \\ object_slots_empty spec t obj_id =\n ((\\* slot \\ dom (slots_of obj_id spec). object_slot_empty spec t obj_id slot) \\*\n object_empty_slots_empty spec t obj_id)\"\n apply (frule well_formed_finite [where obj_id=obj_id])\n apply (case_tac \"dom (slots_of obj_id spec) = {}\")\n apply clarsimp\n apply (subst object_empty_slots_empty_initialised, simp)\n apply (subst empty_slots_object_slots_initialised_object_empty_slots_initialised, simp)\n apply (clarsimp simp: object_slots_empty_initialised_no_slots)\n apply (subst object_slots_empty_decomp_helper, assumption)\n apply clarsimp\n apply (clarsimp simp: object_empty_slots_empty_def2)\n apply (drule_tac obj_id=obj_id and spec=spec and t=t in object_slots_empty_decomp', simp)\n apply clarsimp\n done\n\nlemma well_formed_cnode_not_empty:\n \"\\well_formed spec; slots_of obj_id spec = Map.empty; cnode_at obj_id spec\\ \\ P\"\n apply (clarsimp simp: slots_of_def object_at_def\n split: option.splits)\n apply (rename_tac obj)\n apply (case_tac \"has_slots obj\")\n apply (drule (3) well_formed_has_slots, simp)\n apply (clarsimp simp: is_cnode_def has_slots_def split: cdl_object.splits)\n done\n\nlemma cnode_slots_half_initialised_decomp:\n \"\\well_formed spec; cnode_at obj_id spec\\\n \\ cnode_slots_half_initialised spec t obj_id =\n ((\\* slot \\ dom (slots_of obj_id spec). cnode_slot_half_initialised spec t obj_id slot) \\*\n cnode_empty_slots_half_initialised spec t obj_id)\"\n apply (frule well_formed_finite [where obj_id=obj_id])\n apply (case_tac \"dom (slots_of obj_id spec) = {}\")\n apply clarsimp\n apply (erule (2) well_formed_cnode_not_empty)\n apply (subst cnode_slots_half_initialised_decomp_helper, assumption)\n apply clarsimp\n apply (drule_tac obj_id=obj_id in well_formed_finite, clarsimp)\n apply (subst cnode_slots_half_initialised_decomp', simp+)\n apply (clarsimp simp: cnode_empty_slots_half_initialised_def2)\n done\n\n\n\nlemma distinct_singleton_set:\n \"\\distinct xs; set xs = {x}\\ \\ xs = [x]\"\n by (metis set_simps(2) distinct.simps(2) distinct_singleton\n insert_iff insert_not_empty list.exhaust set_empty2)\n\n\n\nlemma irq_slots_initialised_decomp_helper:\n \"well_formed spec\n \\ irq_slots_initialised spec t irq =\n ((\\* slot \\ dom (slots_of (cdl_irq_node spec irq) spec). irq_slot_initialised spec t irq slot) \\*\n object_empty_slots_initialised spec t (cdl_irq_node spec irq))\"\n apply (clarsimp simp: irq_slots_initialised_def irq_slot_initialised_def [abs_def]\n irq_initialised_general_def [abs_def]\n object_empty_slots_initialised_def object_initialised_general_def\n sep_conj_exists slots_of_def\n split: option.splits)\n apply (subst sep_map_S_decomp, simp+)\n apply (erule (1) well_formed_finite_object_slots)\n apply (subst well_formed_object_slots_irq_node, assumption+)+\n apply (fastforce simp: sep_conj_ac)\n done\n\nlemma irq_slots_empty_decomp_helper:\n \"well_formed spec\n \\ irq_slots_empty spec t irq =\n ((\\* slot \\ dom (slots_of (cdl_irq_node spec irq) spec). irq_slot_empty spec t irq slot) \\*\n object_empty_slots_empty spec t (cdl_irq_node spec irq))\"\n apply (clarsimp simp: irq_slots_empty_def irq_slot_empty_def [abs_def]\n irq_initialised_general_def [abs_def]\n object_empty_slots_empty_def object_initialised_general_def\n sep_conj_exists slots_of_def\n split: option.splits)\n apply (frule (1) well_formed_object_slots_default_irq_node)\n apply (subst sep_map_S_decomp, simp+)\n apply (subst well_formed_object_slots_irq_node, assumption+)+\n apply (fastforce simp: sep_conj_ac)\n done\n\n(* This rule uses object_empty_slots_initialised, to make it easier to cancel. *)\nlemma irq_slots_initialised_decomp:\n \"\\well_formed spec; irq \\ used_irqs spec\\\n \\ irq_slots_initialised spec t irq = (irq_slot_initialised spec t irq 0 \\* object_empty_slots_initialised spec t (cdl_irq_node spec irq))\"\n apply (subst irq_slots_initialised_decomp_helper, assumption)\n apply (subst well_formed_slots_of_used_irq_node, assumption+)\n apply clarsimp\n done\n\nlemma irq_slots_empty_decomp:\n \"\\well_formed spec; irq \\ used_irqs spec\\\n \\ irq_slots_empty spec t irq = (irq_slot_empty spec t irq 0 \\* object_empty_slots_initialised spec t (cdl_irq_node spec irq))\"\n apply (subst irq_slots_empty_decomp_helper, assumption)\n apply (subst well_formed_slots_of_used_irq_node, assumption+)\n apply (subst object_empty_slots_empty_initialised, assumption)\n apply clarsimp\n done\n\nlemma irq_initialised_decomp_total:\n \"\\well_formed spec; irq \\ used_irqs spec\\\n \\ irq_initialised spec t irq =\n (irq_slot_initialised spec t irq 0 \\*\n object_empty_slots_initialised spec t (cdl_irq_node spec irq) \\*\n object_fields_initialised spec t (cdl_irq_node spec irq))\"\n apply (subst irq_initialised_decomp)\n apply (subst irq_slots_initialised_decomp, assumption+)\n apply (clarsimp simp: sep_conj_assoc)\n done\n\nlemma irq_empty_decomp_total:\n \"\\well_formed spec; irq \\ used_irqs spec\\\n \\ irq_empty spec t irq =\n (irq_slot_empty spec t irq 0 \\*\n object_empty_slots_initialised spec t (cdl_irq_node spec irq) \\*\n object_fields_empty spec t (cdl_irq_node spec irq))\"\n apply (subst irq_empty_decomp)\n apply (subst irq_slots_empty_decomp, assumption+)\n apply (clarsimp simp: sep_conj_assoc)\n done\n\n(****************************************************************************\n * Lemmas proving equality between object_fields predicates. *\n * These show that the fields of a CNode are already initialised correctly. *\n ****************************************************************************)\n\nlemma sep_map_f_object_default_state_cnode [simp]:\n \"object_type obj = CNodeType \\ obj_id \\f object_default_state obj = obj_id \\f obj\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\n apply (clarsimp simp: object_type_def split: cdl_object.splits)\n apply (intro ext conjI iffI |\n clarsimp simp: object_to_sep_state_def object_project_def\n intent_reset_def object_wipe_slots_def\n object_default_state_def default_object_def\n asid_reset_def object_type_def update_slots_def\n empty_cnode_def object_size_bits_def object_clean_def)+\n done\n\nlemma sep_map_f_object_default_state_irq_node [simp]:\n \"object_type obj = IRQNodeType \\ obj_id \\f object_default_state obj = obj_id \\f obj\"\n apply (clarsimp simp: sep_map_f_def sep_map_general_def split: sep_state.splits)\n apply (rule ext)\n apply (clarsimp simp: object_type_def split: cdl_object.splits)\n apply (intro ext conjI iffI |\n clarsimp simp: object_to_sep_state_def object_project_def\n intent_reset_def object_wipe_slots_def\n object_default_state_def default_object_def\n asid_reset_def object_type_def update_slots_def\n empty_cnode_def object_size_bits_def object_clean_def)+\n done\n\nlemma object_to_sep_state_fields[simp]:\n \"object_to_sep_state obj_id (update_slots slot obj) {Fields} = object_to_sep_state obj_id obj {Fields}\"\n apply (rule ext)\n apply (case_tac obj,\n simp_all add:object_to_sep_state_def update_slots_def split_def\n object_project_def object_clean_def asid_reset_def\n object_wipe_slots_def intent_reset_def object_slots_def)\n done\n\nlemma sep_map_f_cnode_half [simp]:\n \"obj_id \\f cnode_half spec obj_id' obj = obj_id \\f obj \"\n apply (rule ext)\n apply (clarsimp simp: cnode_half_def sep_map_f_def sep_map_general_def)\n done\n\nlemma sep_map_f_tcb_half [simp]:\n \"obj_id \\f tcb_half spec tcb = obj_id \\f tcb\"\n by (clarsimp simp: tcb_half_def sep_map_f_def sep_map_general_def)\n\nlemma irq_node_fields_empty_initialised:\n \"irq_node_at obj_id spec\n \\ object_fields_empty spec spec2s_ids obj_id = object_fields_initialised spec spec2s_ids obj_id\"\n by (clarsimp simp: object_fields_empty_def object_fields_initialised_def\n object_initialised_general_def object_at_def object_type_is_object)\n\nlemma cnode_fields_empty_initialised:\n \"cnode_at obj_id spec\n \\ object_fields_empty spec t obj_id = object_fields_initialised spec t obj_id\"\n by (clarsimp simp: object_fields_empty_def object_fields_initialised_def\n object_initialised_general_def object_at_def object_type_is_object)\n\n\nlemma cnode_fields_half_initialised_object_fields_initialised:\n \"cnode_at obj_id spec\n \\ cnode_fields_half_initialised spec t obj_id = object_fields_initialised spec t obj_id\"\n by (clarsimp simp: cnode_fields_half_initialised_def object_fields_initialised_def object_initialised_general_def)\n\n\nlemma object_fields_empty_half_initialised:\n \"cnode_at obj_id spec\n \\ cnode_fields_half_initialised spec t obj_id = object_fields_empty spec t obj_id\"\n by (clarsimp simp: cnode_fields_half_initialised_object_fields_initialised cnode_fields_empty_initialised)\n\nlemma object_default_state_frame [simp]:\n \"is_frame object \\ object_default_state object = object\"\n by (clarsimp simp: object_default_state_def default_object_def\n object_type_is_object object_type_def\n split: cdl_object.splits)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/sys-init/ObjectInitialised_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.19761246859997844}} {"text": "theory Leadsto_Impl\n imports Leadsto_Map Unified_PW_Impl Liveness_Subsumption_Impl\nbegin\n\n(* XXX Move *)\ndefinition\n \"list_of_set S = SPEC (\\l. set l = S)\"\n\n(* XXX Move *)\nlemma lso_id_hnr:\n \"(return o id, list_of_set) \\ (lso_assn A)\\<^sup>d \\\\<^sub>a list_assn A\"\n unfolding list_of_set_def lso_assn_def hr_comp_def br_def by sepref_to_hoare sep_auto\n\nsepref_register hm.op_hms_empty\n\ncontext Worklist_Map2_Impl\nbegin\n\nsepref_thm pw_algo_map2_impl is\n \"uncurry0 (pw_algo_map2)\" ::\n \"unit_assn\\<^sup>k \\\\<^sub>a bool_assn \\\\<^sub>a (hm.hms_assn' K (lso_assn A))\"\n unfolding pw_algo_map2_def add_pw'_map2_alt_def PR_CONST_def TRACE'_def[symmetric]\n supply [[goals_limit = 1]]\n supply conv_to_is_Nil[simp]\n unfolding fold_lso_bex\n unfolding take_from_list_alt_def\n apply (rewrite in \"{a\\<^sub>0}\" lso_fold_custom_empty)\n unfolding hm.hms_fold_custom_empty\n apply (rewrite in \"[a\\<^sub>0]\" HOL_list.fold_custom_empty)\n apply (rewrite in \"{}\" lso_fold_custom_empty)\n unfolding F_split (* XXX Why? F only appears in the invariant *)\n by sepref\n\nend (* Worklist Map 2 Impl *)\n\n\nlocale Leadsto_Search_Space_Key_Impl =\n Leadsto_Search_Space_Key a\\<^sub>0 F _ empty _ E key F' P Q succs_Q succs1 +\n liveness: Liveness_Search_Space_Key_Impl a\\<^sub>0 F _ V succs_Q \"\\ x y. E x y \\ \\ empty y \\ Q y\"\n _ key A succsi a\\<^sub>0i Lei keyi copyi\n for key :: \"'v \\ 'k\"\n and a\\<^sub>0 F F' copyi P Q V empty succs_Q succs1 E A succsi a\\<^sub>0i Lei keyi +\n fixes succs1i and emptyi and Pi Qi and tracei\n assumes succs1_impl: \"(succs1i, (RETURN \\\\ PR_CONST) succs1) \\ A\\<^sup>k \\\\<^sub>a list_assn A\"\n and empty_impl:\n \"(emptyi,RETURN o PR_CONST empty) \\ A\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes [sepref_fr_rules]:\n \"(Pi,RETURN o PR_CONST P) \\ A\\<^sup>k \\\\<^sub>a bool_assn\" \"(Qi,RETURN o PR_CONST Q) \\ A\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes trace_impl:\n \"(uncurry tracei,uncurry (\\(_ :: string) _. RETURN ())) \\ id_assn\\<^sup>k *\\<^sub>a A\\<^sup>k \\\\<^sub>a id_assn\"\nbegin\n\nsublocale Worklist_Map2_Impl _ _ \"\\ _. False\" _ succs1 _ _ \"\\_. False\" _ succs1i _\n \"\\_. return False\" Lei\n apply standard\n unfolding A'.trace_def\n apply (rule liveness.refinements succs1_impl)\n subgoal\n by sepref_to_hoare sep_auto\n by (rule liveness.refinements succs1_impl empty_impl\n liveness.pure_K liveness.left_unique_K liveness.right_unique_K trace_impl)+\n\nsepref_register pw_algo_map2_copy\nsepref_register \"PR_CONST P\" \"PR_CONST Q\"\n\nlemmas [sepref_fr_rules] =\n lso_id_hnr\n ran_of_map_impl.refine[OF pure_K left_unique_K right_unique_K]\n\nlemma pw_algo_map2_copy_fold:\n \"PR_CONST pw_algo_map2_copy = A'.pw_algo_map2\"\n unfolding pw_algo_map2_copy_def by simp\n\nlemmas [sepref_fr_rules] = pw_algo_map2_impl.refine_raw[folded pw_algo_map2_copy_fold]\n\ndefinition \"has_cycle_map_copy \\ has_cycle_map\"\n\nlemma has_cycle_map_copy_fold:\n \"PR_CONST has_cycle_map_copy = has_cycle_map\"\n unfolding has_cycle_map_copy_def by simp\n\nsepref_register has_cycle_map_copy\n\nlemma has_cycle_map_fold:\n \"has_cycle_map = liveness.dfs_map'\"\n unfolding has_cycle_map_def liveness.dfs_map'_def\n by (subst Liveness_Search_Space_Key_Defs.dfs_map_alt_def) standard\n\nlemmas [sepref_fr_rules] =\n liveness.dfs_map'_impl.refine_raw[folded has_cycle_map_fold, folded has_cycle_map_copy_fold]\n\nsepref_thm leadsto_impl is\n \"uncurry0 leadsto_map4'\" :: \"unit_assn\\<^sup>k \\\\<^sub>a bool_assn\"\n unfolding leadsto_map4'_def\n apply (rewrite in P PR_CONST_def[symmetric])\n apply (rewrite in Q PR_CONST_def[symmetric])\n unfolding pw_algo_map2_copy_def[symmetric]\n unfolding has_cycle_map_copy_def[symmetric]\n unfolding hm.hms_fold_custom_empty\n unfolding list_of_set_def[symmetric]\n by sepref\n\nconcrete_definition (in -) leadsto_impl\n uses Leadsto_Search_Space_Key_Impl.leadsto_impl.refine_raw is \"(uncurry0 ?f,_)\\_\"\n\nlemma leadsto_impl_hnr:\n \"(uncurry0 (\n leadsto_impl copyi succsi a\\<^sub>0i Lei keyi succs1i emptyi Pi Qi tracei\n ),\n uncurry0 leadsto_spec_alt\n ) \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\" if \"V a\\<^sub>0\"\n unfolding leadsto_spec_alt_def\n using leadsto_impl.refine[\n OF Leadsto_Search_Space_Key_Impl_axioms,\n FCOMP leadsto_map4'_correct[unfolded leadsto_spec_alt_def, THEN Id_SPEC_refine, THEN nres_relI]\n ] .\n\nend (* Leadsto Search Space Key Impl *)\n\nend (* End of theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Worklist_Algorithms/Leadsto_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.1976124685999784}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__51_on_rules imports n_german_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.3665897432423099, "lm_q1q2_score": 0.19758572048381134}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__28.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__28 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__28 and some rule r*}\nlemma n_RecvReqSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__28 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__28:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__28:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__28:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__28:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_on_inv__28.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3886180267058489, "lm_q1q2_score": 0.1973448446340028}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__57.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__57 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__57 and some rule r*}\nlemma n_RecvReqSVsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__57:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__57:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvAckVsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvAck i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__57:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__57.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.34864514886966624, "lm_q1q2_score": 0.19733962157108043}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__41_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__41_on_rules imports n_german_lemma_on_inv__41\nbegin\nsection{*All lemmas on causal relation between inv__41*}\nlemma lemma_inv__41_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__41) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__41_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.35577489351363034, "lm_q1q2_score": 0.19726667586628976}} {"text": "theory javacap_operational\nimports\n Main\n javacap_syntax\n javacap_auxiliary\n javacap_static\n javacap_runtime_representation\nbegin \n\ndefinition no_exception_or_return :: \"State \\ bool\"\n where \"no_exception_or_return S \\ (except S = None) \\ (retval S = None)\"\n\ndefinition map_formalpar_to_args :: \"mdecl \\ var list \\ (var \\ var)\"\n where \"map_formalpar_to_args md args \\ map_of (zip (map fst (mpar md)) args)\"\n\nlemma map_formalpar_to_args_match:\n assumes \"length (mpar md) = length args\"\n assumes \"fst ((mpar md) ! i) = formalpar\"\n assumes \"args ! i = actualpar\"\n assumes unique_keys: \"unique_keys (mpar md)\"\n assumes \"i < length args\"\n shows \"(map_formalpar_to_args md args) formalpar = Some actualpar\"\n using assms unfolding map_formalpar_to_args_def unique_keys_def\n by (metis (no_types, lifting) comp_def length_map map_of_zip_nth nth_map) \n\ninductive op_expr :: \"prog \\ exp \\ State \\ v \\ State \\ bool\" (\"_ \\ \\_ | _\\ \\\\<^sub>e \\_ | _\\\" 50) and\n op_stmt :: \"prog \\ stmt \\ State \\ State \\ bool\" (\"_ \\ \\_ | _\\ \\\\<^sub>s \\_\\\" 50)\n for P :: \"prog\"\n(* datatype exp =\n ref \"var\" \n | new \"cname\" \n | calli \"var\" \"mname\" \"var list\" (* instance method call *)\n | calls \"cname\" \"mname\" \"var list\" (* static method call *)\n | cast \"\\\" \"exp\" \n | const \"k\"\n | fieldacci \"var\" \"fname\" (* instance field access *)\n | fieldaccs \"cname\" \"fname\" (* static field access *)\n | wrap \"iname\" \"exp\" *)\n where op_expr_ref: \"\\ v = the (stack S x) \\ \\ P \\ \\(ref x) | S\\ \\\\<^sub>e \\v | S\\\"\n (*Assumes new heap location l is always available *)\n | op_expr_new: \"\\ v = (href l); l \\ dom (heap S);\n S' = S\\heap := (heap S)(l\\(new_object P cname (lbl \\ (privs S))))\\\\ \\ P \\ \\(new lbl cname) | S\\ \\\\<^sub>e \\v | S'\\\"\n | op_expr_calli: \"\\ a = the (stack S x); l = the_href a;\n a \\ null; (* added, exception to be thrown otherwise *)\n obj = the (heap S l); (d,m) = the (cmethod P (HClass obj) mname); s = the (mstmt m); \n (* Compose S0 from S by mapping the formal parameter names to the actual parameter names. Add the 'this' parameter. *)\n S0 = S\\stack := ((stack S) \\\\<^sub>m map_formalpar_to_args (mdecl m) args)(This \\ a), retval := None, privs := (HLabel obj) \\;\n P \\ \\s | S0\\ \\\\<^sub>s \\S1\\;\n (* note: the updated heap, globals and any exceptions carry through.\n the stack and any return value do not. *)\n S' = S1\\stack := (stack S), retval := (retval S), privs := (privs S)\\;\n (except S1 = None \\ retval S1 \\ None); (* added, exception to be thrown otherwise *)\n v = the (retval S1)\n \\ \\ P \\ \\(calli x mname args) | S\\ \\\\<^sub>e \\v | S'\\\"\n | op_expr_calls: \"\\ (d,m) = the (cmethod P c mname); s = the (mstmt m);\n (* Compose S0 from S by mapping the formal parameter names (that is, the first component of (msig m)) to \n the actual parameter names as stored in args. *)\n S0 = S\\stack := ((stack S) \\\\<^sub>m map_formalpar_to_args (mdecl m) args), retval := None, privs := (privs S) \\ lbl\\;\n P \\ \\s | S0\\ \\\\<^sub>s \\S1\\;\n (* note: the updated heap, globals and any exceptions carry through.\n the stack and any return value does not. *)\n S' = S1\\stack := (stack S), retval := (retval S), privs := privs S\\;\n (except S1 = None \\ retval S1 \\ None); (* added, exception to be thrown otherwise *)\n v = the (retval S1) \\ \n \\ P \\ \\(calls c mname lbl args) | S\\ \\\\<^sub>e \\v | S'\\\"\n | op_expr_cast: \"\\ P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\;\n (case v of (href l) \\ (hobj = the (heap S' l)) \\ (P \\ (ClassT (HClass hobj)) <: t) \n | (num n) \\ t = ValT IntT ) \\\n \\ P \\ \\(cast t e) | S\\ \\\\<^sub>e \\v | S'\\\"\n | op_expr_const: \"\\ (case k of k.null \\ v = v.null | k.num n \\ v = v.num n) \\\n \\ P \\ \\(const k) | S\\ \\\\<^sub>e \\v | S\\\"\n (* PM: For now, we make execution infeasible if the address is null. *)\n | op_expr_fieldacci: \"\\ a = the (stack S x); a \\ null; l = the_href a; obj = the (heap S l); v = the ((HFields obj) f) \\\n \\ P \\ \\(fieldacci x f) | S\\ \\\\<^sub>e \\v | S\\\" \n | op_expr_fieldaccs: \"\\ classStatics = the (globals S c); v = the (classStatics f) \\\n \\ P \\ \\(fieldaccs c f) | S\\ \\\\<^sub>e \\v | S\\\"\n (* Wrapping does absolutely nothing at runtime *)\n | op_expr_wrap: \"\\ P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\ \\ \\ P \\ \\(wrap cbname e) | S\\ \\\\<^sub>e \\v | S'\\\"\n\n(* datatype stmt =\n assign \"var\" \"exp\" \n | assignfi \"var\" \"fname\" \"exp\" \n | assignfs \"cname\" \"fname\" \"exp\" \n | expr \"exp\"\n | ifelse \"var\" \"stmt\" \"stmt\" \n | letin \"\\\" \"var\" \"exp\" \"stmt\"\n | return \"exp\"\n | seq \"stmt\" \"stmt\" \n | throw \"exp\"\n | trycatch \"stmt\" \"(\\ \\ var \\ stmt) list\" *)\n (* if no exception *)\n | op_stmt_assign: \"\\ no_exception_or_return S; \n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\;\n S' = (if except S1 = None then S1\\stack := (stack S1)(x\\v)\\ else S1) \\\n \\ P \\ \\(assign x e) | S\\ \\\\<^sub>s \\S'\\\"\n (* PM: Currently assume no null reference.*)\n | op_stmt_assignfi: \"\\ no_exception_or_return S;\n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\; a = the (stack S1 x); a \\ null;\n l = the_href a; obj = the (heap S1 l);\n S' = (if except S1 = None then S1\\heap := (heap S1)(l\\(obj\\HFields := ((HFields obj)(f\\v))\\))\\ else S1) \\\n \\ P \\ \\(assignfi x f e) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_assignfs: \"\\ no_exception_or_return S;\n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\; classStatics = the ((globals S1) c);\n S' = (if except S1 = None then S1\\globals := (globals S1)(c\\(classStatics(f\\v)))\\ else S1) \\\n \\ P \\ \\(assignfs c f e) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_expr: \"\\ no_exception_or_return S;\n P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\ \\\n \\ P \\ \\(expr e) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_then: \"\\ no_exception_or_return S;\n v = the (stack S x); (the_num v) > 0;\n P \\ \\s1 | S\\ \\\\<^sub>s \\S1\\ \\ \\\n P \\ \\(ifelse x s1 s2) | S\\ \\\\<^sub>s \\S1\\\"\n | op_stmt_else: \"\\ no_exception_or_return S;\n v = the (stack S x); (the_num v) \\ 0; \n P \\ \\s2 | S\\ \\\\<^sub>s \\S2\\ \\ \\\n P \\ \\(ifelse x s1 s2) | S\\ \\\\<^sub>s \\S2\\\"\n | op_stmt_letin: \"\\ no_exception_or_return S; \n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\;\n S2 = (if except S1 = None then S1\\stack := (stack S1)(x\\v)\\ else S1);\n P \\ \\s | S2\\ \\\\<^sub>s \\S3\\;\n S' = S3\\stack := (stack S3)(x := (stack S x))\\\n \\ \\ P \\ \\(letin T x e s) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_return: \"\\ no_exception_or_return S; \n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\; \n S' = (if except S1 = None then S1\\retval := Some v\\ else S1) \\ \\ P \\ \\(return e) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_seq: \"\\ no_exception_or_return S;\n P \\ \\s1 | S\\ \\\\<^sub>s \\S1\\; \n P \\ \\s2 | S1\\ \\\\<^sub>s \\S2\\\\ \\\n P \\ \\(seq s1 s2) | S\\ \\\\<^sub>s \\S2\\\"\n | op_stmt_throw: \"\\ no_exception_or_return S; \n P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\; \n v \\ null; (* else a NullReferenceException should be thrown *)\n S' = (if except S1 = None then S1\\except := Some v\\ else S1) \\ \\ P \\ \\(throw e) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_trycatch_ok: \"\\ no_exception_or_return S;\n P \\ \\s | S\\ \\\\<^sub>s \\S1\\;\n except S1 = None;\n S' = S1 \\ \\ P \\ \\(trycatch s catchhandlers) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_trycatch_ex: \"\\ no_exception_or_return S;\n P \\ \\s | S\\ \\\\<^sub>s \\S1\\;\n except S1 = Some ex;\n a = the_href ex; exObj = the (heap S1 a);\n i = Min {j::nat. (j = length ch) \\ ((j < length ch) \\ (P \\ (ClassT (HClass exObj)) <: (chtype (ch !j)))) };\n if (i < length ch) \n then (h = (ch ! i)) \\\n var = (chvar h) \\\n S2 = S1\\except := None, stack := (stack S1)(var \\ ex)\\ \\\n (P \\ \\(chstmt h) | S2\\ \\\\<^sub>s \\S3\\) \\\n S' = S3\\stack:= (stack S3)(var := (stack S1 var))\\\n else S' = S1 \\\n \\ P \\ \\(trycatch s ch) | S\\ \\\\<^sub>s \\S'\\\"\n | op_stmt_exception_or_return: \"\\ \\no_exception_or_return S \\ \\ P \\ \\s | S\\ \\\\<^sub>s \\S\\\" (* skip over the statement *)\n\nlemma exception_or_return_skips:\n shows \"((P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\) \\ (True))\n \\ ((P \\ \\s | S\\ \\\\<^sub>s \\S'\\) \\ (\\no_exception_or_return S \\ S = S'))\"\nproof (induction S S' rule: op_expr_op_stmt.induct)\n case (op_expr_ref v S x)\n then show ?case by simp\nnext\n case (op_expr_new v l S S' cname lbl)\n then show ?case by simp\nnext\n case (op_expr_calli a S x l obj d m mname s S0 args S1 S' v)\n then show ?case by simp\nnext\n case (op_expr_calls d m c mname s S0 S lbl args S1 S' v)\n then show ?case by simp\nnext\n case (op_expr_cast e S v S' hobj t)\n then show ?case by simp\nnext\n case (op_expr_const k v S)\n then show ?case by simp\nnext\n case (op_expr_fieldacci a S x l obj v f)\n then show ?case by simp\nnext\n case (op_expr_fieldaccs classStatics S c v f)\n then show ?case by simp\nnext\n case (op_expr_wrap e S v S' cbname)\n then show ?case by simp\nnext\n case (op_stmt_assign S e v S1 S' x)\n then show ?case by simp\nnext\n case (op_stmt_assignfi S e v S1 a x l obj S' f)\n then show ?case by simp\nnext\n case (op_stmt_assignfs S e v S1 classStatics c S' f)\n then show ?case by simp\nnext\n case (op_stmt_expr S e v S')\n then show ?case by simp\nnext\n case (op_stmt_then S v x s1 S1 s2)\n then show ?case by simp\nnext\n case (op_stmt_else S v x s2 S2 s1)\n then show ?case by simp\nnext\n case (op_stmt_letin S e v S1 S2 x s S3 S' T)\n then show ?case by simp\nnext\n case (op_stmt_return S e v S1 S')\n then show ?case by simp\nnext\n case (op_stmt_seq S s1 S1 s2 S2)\n then show ?case by simp\nnext\n case (op_stmt_throw S e v S1 S')\n then show ?case by simp\nnext\n case (op_stmt_trycatch_ok S s S1 S' catchhandlers)\n then show ?case by simp\nnext\n case (op_stmt_trycatch_ex S s S1 ex a exObj i ch h var S2 S3 S')\n then show ?case by simp\nnext\n case (op_stmt_exception_or_return S s)\n then show ?case by simp\nqed\n\n\nlemma is_value_ok_subsumption:\n assumes wfp: \"wf_prog P\"\n assumes ok: \"is_value_ok P H T' v\"\n assumes t'_implements_t: \"subsumption P (ttype T') (ttype T)\"\n assumes label_same: \"tlabel T' = tlabel T\"\n shows \"is_value_ok P H T v\"\nproof (cases \"(P, H, T, v)\" rule: is_value_ok.cases)\n case (1 P H t v)\n then show ?thesis proof (cases \"is_cap_type P (ttype T)\")\n case True\n then show ?thesis using 1 ok t'_implements_t subtype_int_parity unfolding subsumption_def by simp\n next\n case False\n then have \"P \\ (ttype T') <: (ttype T)\"\n using 1 t'_implements_t unfolding subsumption_def by simp\n then show ?thesis using 1 ok subtype_int_parity by simp\n qed\nnext\n case a1: (2 P H T loc)\n then show ?thesis proof (cases \"is_cap_type P (ttype T)\")\n case True\n then have \"ttype T' = ttype T\" using t'_implements_t a1 unfolding subsumption_def by simp\n then show ?thesis using a1 ok label_same\n by (metis old.prod.inject prod.exhaust_sel) \n next\n case False\n obtain obj where a2: \"H loc = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ttype T')) \\ is_obj_label_ok P obj T'\" \n using a1 ok by auto\n moreover have a3: \"P \\ (ttype T') <: (ttype T)\" \n using a1 False t'_implements_t unfolding subsumption_def by simp\n ultimately have a4: \"P \\ (ClassT (HClass obj)) <: (ttype T)\" \n using subtype_trans by blast\n have \"\\is_cap_type P (ttype T')\"\n using False a1 wfp a3 subtype_is_not_cap_type by simp\n then have \"is_obj_label_ok P obj T\"\n using a1 a2 False label_same unfolding is_obj_label_ok_def by auto\n then have \"(is_value_ok P H T (href loc))\" \n using a2 a4 by simp\n then show ?thesis using a1 by simp\n qed\nnext\n case (3 P H t)\n then show ?thesis by simp\nqed\n\n\nlemma heap_access_ok:\n assumes wf: \"wf_prog P\"\n assumes ok: \"is_value_ok P (heap S) ((ClassT t0),\\) (href l)\"\n assumes field: \"field P t0 f = Some fd\"\n assumes nonstatic: \"\\fstatic fd\"\n assumes dynamic: \"obj = the (heap S l)\"\n assumes dynamicf: \"v = the ((HFields obj) f)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n shows \"is_value_ok P (heap S) (intersect_label (ftype fd) (HLabel obj)) v\"\nproof -\n have a1: \"heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ClassT t0)) \\ is_obj_label_ok P obj ((ClassT t0),\\)\"\n using ok dynamic by auto\n then have a2: \"field P (HClass obj) f = Some fd\"\n using field field_subtype wf by metis\n have \"l \\ dom(heap S) \\ obj = the (heap S l)\" \n using a1 by auto\n then have \"is_heapobj_ok P (heap S) obj\"\n using a1 corr corr_def unfolding is_heap_ok_def by blast\n then have \"(HFields obj) f = Some v \\ is_value_ok P (heap S) (intersect_label (ftype fd) (HLabel obj)) v\"\n using a2 dynamicf nonstatic unfolding is_heapobj_ok_def by fastforce \n then show ?thesis by simp\nqed\n\n\n(* Begin parts of preservation proof. *)\ndefinition is_expr_value_ok :: \"prog \\ State \\ \\ \\ v \\ bool\"\n where \"is_expr_value_ok P S T v \\ (except S = None) \\ (is_value_ok P (heap S) (intersect_label T (privs S)) v)\"\n\nlemma is_expr_value_ok_value:\n assumes \"is_value_ok P (heap S) (intersect_label T (privs S)) v\"\n shows \"is_expr_value_ok P S T v\"\n unfolding is_expr_value_ok_def using assms by blast\n\nlemma is_expr_value_ok_return:\n assumes \"except S = None \\ retval S \\ None\"\n assumes \"P M \\ \\<^bold>\\ S\"\n shows \"is_expr_value_ok P S (msreturn M) (the (retval S))\"\n using assms unfolding is_expr_value_ok_def corr_def is_retval_ok_def by simp\n\nlemma preservation_expr_ref: \n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ ref x : T\"\n assumes op: \"v = the (stack S x)\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S) \\ (transition_ok S S) \\ (is_expr_value_ok P S T v)\"\nproof -\n obtain T' where a2: \"(\\\\x\\\\<^sub>v = Some T') \\ (subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\"\n using wf_expr_ref_intro wf by (metis prod.collapse) \n then have \"is_value_ok P (heap S) (intersect_label T' (privs S)) v\" \n using stack_access_ok op corr by metis \n then have \"is_value_ok P (heap S) (intersect_label T (privs S)) v\" \n using wfp is_value_ok_subsumption a2 intersect_label_type intersect_label_label by simp\n then have \"is_expr_value_ok P S T v\"\n using is_expr_value_ok_value by simp\n then show ?thesis using corr transition_ok_self by simp\nqed\n\nlemma preservation_expr_new:\n assumes op1: \"v = href l\"\n assumes op2: \"l \\ dom (heap S)\"\n assumes op3: \"S' = S\\heap := (heap S)(l \\ new_object P cname (lbl \\ privs S))\\\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ new lbl cname : T\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S') \\ (transition_ok S S') \\ (is_expr_value_ok P S' T v)\"\nproof -\n obtain c where a1: \"(tlabel T = lbl) \\ class P cname = Some c\n \\ (creq c) \\ (msreq M) \\ (creq c) \\ (tlabel T)\n \\ (tlabel T) \\ the (grant P (mscname M)) \\ (the (grant P cname))\n \\ (subsumption P (ClassT cname) (ttype T))\"\n using wf wf_expr_new_intro by (metis prod.collapse)\n have \"creq (the (class P cname)) \\ (lbl \\ privs S)\"\n proof -\n have \"creq c \\ lbl\" using a1 by metis\n (* combine (creq c) \\ (msreq M) and corr: (msreq M) \\ (privs S) *)\n moreover have \"creq c \\ privs S\" using a1 corr unfolding corr_def by auto\n ultimately show ?thesis using a1 by simp\n qed\n moreover have \"(lbl \\ privs S) \\ the (grant P cname)\"\n using a1 corr unfolding corr_def by auto\n ultimately have \"is_value_ok P (heap S') (intersect_label ((ClassT cname),lbl) (privs S')) v\" \n using allocate_new_value_ok op1 op3 unfolding intersect_label_def by force \n then have \"is_value_ok P (heap S') (intersect_label T (privs S')) v\"\n using wfp is_value_ok_subsumption a1 intersect_label_type intersect_label_label by simp\n then have \"is_expr_value_ok P S' T v\" \n using a1 is_expr_value_ok_value by simp\n moreover have \"P M \\ \\<^bold>\\ S'\" \n using allocate_ok allocate_new_object_ok op2 op3 corr by metis\n moreover have \"transition_ok S S'\" \n using allocate_extends_heap op2 op3 unfolding transition_ok_def by simp\n ultimately show ?thesis by simp\nqed\n\nlemma call_params_typecorrect:\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes call_context: \"\\' = call_lenvs P md\"\n assumes mcompat: \"mdecl_compatible decl md\"\n assumes wf: \"wf_method_call P \\ decl args \\0 (t',(tlabel T))\"\n assumes wfm: \"wf_mdecl P md\"\n assumes lbls: \"(\\par\\(set (msig (mpar decl))). (tlabel par) \\ \\0 \\ (privs S) = (tlabel par) \\ privs')\"\n assumes op7: \"S0 = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args md args), retval:= None, privs := privs'\\\"\n assumes privs1: \"(msreq M0) \\ privs'\"\n assumes privs2: \"privs' \\ the (grant P (mscname M0))\"\n shows \"(P M0 \\' \\<^bold>\\ S0)\"\nproof -\n (* Show P \\' \\<^bold>\\ S0, by reasoning about parameters *)\n have \"\\x\\dom(map_of (mpar md)). var_corr P \\' S0 x\"\n proof\n fix formalpar\n (* Show that by definition of \\', formalpar is typed to t. *)\n assume b1: \"formalpar \\ dom (map_of (mpar md))\"\n then obtain T where b2: \"map_of (mpar md) formalpar = Some T\" by (meson domD)\n then have \"\\'\\formalpar\\\\<^sub>v = Some T\" using call_context call_lenvs_def by simp\n then obtain t \\ where b3: \"\\'\\formalpar\\\\<^sub>v = Some (t,\\) \\ (t,\\) = T\" by (metis prod.collapse)\n\n (* Get list index of this argument and obtain type, parameter name, argument information. *)\n obtain i where b4: \"(mpar md) ! i = (formalpar,T) \\ (i < length (mpar md))\"\n using b2 by (meson in_set_conv_nth map_of_SomeD) \n\n (* Show the type of the parameter in the runtime declaration and the\n static declaration are the same. *)\n moreover have b5: \"(msig (mpar decl)) ! i = T \\ (i < length (msig (mpar decl)))\" \n using mcompat b4 mdecl_compatible_def by auto\n moreover obtain actualpar where b6: \"(actualpar = args ! i) \\ (i < length args)\"\n using wf b5 wf_method_call_def by auto\n\n (* Show that due to static semantics, actualpar is type-correct to its declaration. *)\n ultimately have \"\\\\actualpar\\\\<^sub>v = Some (intersect_label T \\0)\" \n using wf unfolding wf_method_call_def by auto\n then have b7: \"\\\\actualpar\\\\<^sub>v = Some (t,\\ \\ \\0)\"\n using b3 unfolding intersect_label_def by (metis case_prod_conv)\n \n (* Prove using relationship between S0 formalpar and S actualpar *)\n have \"unique_keys (mpar md)\"\n using wfm unfolding wf_method_def wf_mdecl_def by simp\n moreover have \"length (mpar md) = length args\"\n using wf mcompat unfolding wf_method_call_def mdecl_compatible_def by (metis length_map) \n ultimately have \"(map_formalpar_to_args md args) formalpar = Some actualpar\"\n using map_formalpar_to_args_match b4 b6 by fastforce \n then have \"stack S0 formalpar = stack S actualpar\" \n using op7 by simp\n\n (* show formal par will be type-correct under the new environment *)\n moreover obtain v where \"stack S actualpar = Some v \\ is_value_ok P (heap S) (intersect_label (t,\\ \\ \\0) (privs S)) v\"\n using corr b7 unfolding corr_def var_corr_def by blast\n moreover have \"intersect_label (t,\\ \\ \\0) (privs S) = intersect_label T (privs S0)\"\n proof -\n have \"T \\ set (msig (mpar decl))\" using b5 by auto\n then have \"\\ \\ \\0 \\ (privs S) = \\ \\ (privs S0)\" using lbls b3 op7 unfolding intersect_label_def by fastforce \n then show ?thesis using b3 unfolding intersect_label_def by auto \n qed\n ultimately have \"stack S0 formalpar = Some v \\ is_value_ok P (heap S0) (intersect_label T (privs S0)) v\"\n using op7 by simp\n then show \"var_corr P \\' S0 formalpar\" \n using b3 unfolding var_corr_def call_lenvs_def by auto\n qed\n then have \"(\\x. var_corr P \\' S0 x)\" using call_context unfolding var_corr_def call_lenvs_def\n by (metis (mono_tags, lifting) domI id_apply) \n moreover have \"(is_heap_ok P (heap S0))\"\n using corr op7 unfolding corr_def by simp\n ultimately show \"P M0 \\' \\<^bold>\\ S0\" using corr op7 privs1 privs2 unfolding corr_def is_retval_ok_def\n by simp\nqed\n\n(* Used to show a method exists at runtime and that \n the statically-inferred method signature of an object matches the signature at runtime *)\nlemma method_correspondence:\n assumes wfp: \"wf_prog P\"\n assumes op: \"(d, m) = the (cmethod P (HClass obj) mname)\"\n assumes decl: \"methoddecl P t0 mname = Some decl\"\n assumes subtype: \"(P \\ (ClassT (HClass obj)) <: t0)\"\n shows \"cmethod P (HClass obj) mname = Some (d,m) \\ mdecl_compatible decl (mdecl m)\"\nproof -\n obtain rdecl where a1: \"methoddecl P (ClassT (HClass obj)) mname = Some rdecl \\ mdecl_compatible decl rdecl\" \n using methoddecl_subtype wfp decl subtype by metis\n then have a2: \"cmethoddecl P (HClass obj) mname = Some rdecl\" \n unfolding methoddecl_def by simp\n then have a3: \"cmethod P (HClass obj) mname = Some (d,m)\" \n using op unfolding cmethoddecl_def\n by (metis (no_types, lifting) map_comp_simps(1) option.collapse option.discI) \n then have \"(mdecl m) = rdecl\" \n using a2 unfolding cmethoddecl_def by auto \n then show ?thesis \n using a1 a3 by simp\nqed\n\n(* Shows an object exists at runtime, and its runtime type is a subtype of the static type. *)\nlemma object_correspondence:\n assumes static: \"\\\\x\\\\<^sub>v = Some T\" \n assumes object_type: \"(\\t. (ttype T) \\ (ValT t))\"\n assumes op1: \"a = the (stack S x)\"\n assumes op2: \"a \\ v.null\"\n assumes op3: \"l = the_href a\"\n assumes op4: \"obj = the (heap S l)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n shows \"a = (href l) \\ heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ttype T)) \\ is_obj_label_ok P obj (intersect_label T (privs S))\"\nproof -\n have a1: \"is_value_ok P (heap S) (intersect_label T (privs S)) a\" \n using stack_access_ok op1 corr static by (metis)\n moreover have a2: \"a = (href l)\" \n using op2 op3 object_type intersect_label_type a1 by (metis is_value_ok.elims(2) the_href.simps(1)) (* given t0 \\ IntT, a \\ null *)\n moreover have a3: \"heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ttype T))\" \n using a1 a2 op4 intersect_label_type by (metis is_value_ok_href option.sel)\n moreover have a4: \"is_obj_label_ok P obj (intersect_label T (privs S))\" \n using a1 a2 op4 intersect_label_label by (metis is_value_ok_href option.sel)\n ultimately show ?thesis by simp\nqed\n\n(*lemma no_retval_corr:\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n shows \"P M0 \\ \\<^bold>\\ (S\\retval := None\\)\"\nproof -\n have \"\\P H T. is_retval_ok P H T None\" \n unfolding is_retval_ok_def by simp\n then show ?thesis using corr unfolding corr_def by (simp add: var_corr_def) \nqed*)\nlemma mreq_less_than_object_label:\n assumes wfp: \"wf_prog P\"\n assumes method: \"cmethod P (HClass obj) mname = Some (d,m)\"\n assumes nonstatic: \"\\mstatic (mdecl m)\"\n assumes cls: \"is_class P (HClass obj)\"\n assumes olbl: \"is_obj_label_ok P obj T\"\n shows \"mreq m \\ (HLabel obj)\"\nproof -\n have \"((HClass obj),d)\\(subclass P)\"\n using method_declaring_class wfp cls method by simp\n then obtain cl dcl where a1: \"class P (HClass obj) = Some cl \\ class P d = Some dcl \\ creq dcl \\ creq cl\"\n using subclass_creq wfp cls by blast \n then have \"class P d = Some dcl \\ wf_method P (d,dcl) m\"\n using prog_wf_method wfp cls method by fastforce\n moreover have \"mstmt m \\ None\"\n using cls method prog_wf_mstmt_exists wfp by fastforce\n ultimately have a2: \"mreq m \\ creq dcl\"\n unfolding wf_method_def using nonstatic by auto\n then have \"mreq m \\ (HLabel obj)\"\n using olbl a1 unfolding is_obj_label_ok_def by auto\n then show ?thesis .\nqed\n\n\nlemma grant_more_than_object_label:\n assumes wfp: \"wf_prog P\"\n assumes method: \"cmethod P (HClass obj) mname = Some (d,m)\"\n assumes cls: \"is_class P (HClass obj)\"\n assumes olbl: \"is_obj_label_ok P obj T\"\n shows \"(HLabel obj) \\ the (grant P d)\"\nproof -\n have \"((HClass obj),d)\\(subclass P)\"\n using method_declaring_class wfp cls method by simp\n then have \"(the (grant P (HClass obj))) \\ (the (grant P d))\"\n using wfp grant_subclass_mono by simp\n moreover have \"(HLabel obj) \\ (the (grant P (HClass obj)))\"\n using olbl unfolding is_obj_label_ok_def by simp\n ultimately show ?thesis by auto\nqed\n\nlemma call_params_label_invariant:\n assumes ok: \"is_obj_label_ok P obj (intersect_label (t0,\\0) (privs S))\"\n assumes meth: \"methoddecl P t0 mname = Some decl\"\n shows \"(\\par\\(set (msig (mpar decl))). (tlabel par) \\ \\0 \\ (privs S) = (tlabel par) \\ (HLabel obj)) \\ \n (tlabel (mret decl)) \\ \\0 \\ (privs S) = (tlabel (mret decl)) \\ (HLabel obj)\"\nproof (cases \"is_cap_type P t0\")\n case True\n then obtain ifname where a1: \"t0 = (IfaceT ifname)\"\n using True by (metis \\.exhaust is_cap_type.simps(1) is_cap_type.simps(2)) \n have \"imethoddecl P ifname mname = Some decl\"\n using a1 meth unfolding methoddecl_def by simp\n then have \"sum_method_labels decl \\ cap_label P ifname\"\n unfolding cap_label_def by (metis (no_types, lifting) Sup_upper domI image_iff le_supI2 option.sel) \n then have \"(\\par\\(set (msig (mpar decl))). (tlabel par) \\ cap_label P ifname) \n \\ (tlabel (mret decl)) \\ cap_label P ifname\"\n unfolding sum_method_labels_def by auto\n (* from is_obj_label_ok *)\n(* moreover have \"cap_label P ifname = \\0 \\ (privs S) \\ cap_label P ifname \\ (HLabel obj)\"\n using a1 True ok intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by simp*)\n moreover have \"(cap_label P ifname) \\ (HLabel obj) = \\0 \\ (privs S)\"\n using a1 True ok intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by simp\n ultimately show \"(\\par\\(set (msig (mpar decl))). (tlabel par) \\ \\0 \\ (privs S) = (tlabel par) \\ (HLabel obj))\\ \n tlabel (mret decl) \\ \\0 \\ (privs S) = tlabel (mret decl) \\ (HLabel obj)\"\n by blast\nnext\n case False\n then have \"(HLabel obj) = \\0 \\ (privs S)\"\n using ok intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by simp\n then show ?thesis by blast\nqed\n\n(* Show that:\n - The initial stack, S0, is type-correct with respect to the environment of the method being called, and\n - The statement that is the method body is type-correct within the same context *)\nlemma calli_prems:\n assumes op1: \"a = the (stack S x)\"\n assumes op2: \"l = the_href a\"\n assumes op3: \"a \\ v.null\"\n assumes op4: \"obj = the (heap S l)\"\n assumes op5: \"(d, m) = the (cmethod P (HClass obj) mname)\"\n assumes op6: \"s = the (mstmt m)\"\n assumes op7: \"S0 = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args)(This \\ a), retval := None, privs := HLabel obj\\\"\n assumes wf: \"P M \\ \\ calli x mname args : T\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes call_contextm: \"M0 = call_menv d m\"\n assumes call_contextl: \"\\0 = call_lenvi P d (mdecl m)\"\n shows \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\"\nproof -\n obtain t0 \\0 decl t' where a1: \"(\\\\x\\\\<^sub>v = Some (t0,\\0)) \\ methoddecl P t0 mname = Some decl \\\n is_type P t0 \\ (\\t. t0 \\ (ValT t)) \\ \\mstatic decl \\\n wf_method_call P \\ decl args \\0 (t',(tlabel T)) \\ (subsumption P t' (ttype T))\"\n using wf wf_expr_calli_intro by (metis prod.collapse) \n \n (* Infer the the object pointed to by x exists, and has a runtime type compatible with the static type t0. *)\n have a2: \"a = (href l) \\ heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: t0) \\ is_obj_label_ok P obj (intersect_label (t0,\\0) (privs S))\"\n using object_correspondence a1 op1 op2 op3 op4 corr by (metis fst_conv) \n\n (* Infer the method exists at runtime and that its signature is compatible *)\n then have a6: \"cmethod P (HClass obj) mname = Some (d,m) \\ mdecl_compatible decl (mdecl m)\"\n using method_correspondence wfp op5 a1 by blast\n\n (* Show the statement that isthe method body is well-formed. *)\n have a8: \"is_class P (HClass obj)\" using subtype_exists a1 a2 is_type.simps by blast (* runtime type exists *)\n then obtain dcl where a9: \"class P d = Some dcl \\ wf_method P (d,dcl) m\" using prog_wf_method a6 wfp by blast\n moreover have \"mstmt m = Some s\" using prog_wf_mstmt_exists wfp op6 a8 a6 by fastforce (* body exists *)\n moreover have a10: \"\\mstatic (mdecl m)\" using a6 a1 unfolding mdecl_compatible_def by simp\n ultimately have a11: \"P M0 \\0 \\ s \\\" unfolding wf_method_def using call_contextm call_contextl by simp\n\n (* Show the initial stack for statement s is well-formed. *)\n moreover define S0' where \"S0' = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args), retval := None, privs := HLabel obj\\\"\n moreover define \\0' where \"\\0' = call_lenvs P (mdecl m)\"\n moreover have \"wf_mdecl P (mdecl m)\" using a9 unfolding wf_method_def by simp\n moreover have \"(\\par\\(set (msig (mpar decl))). (tlabel par) \\ \\0 \\ (privs S) = (tlabel par) \\ (HLabel obj))\" using call_params_label_invariant a1 a2 by metis\n moreover have \"(msreq M0) \\ HLabel obj\" using mreq_less_than_object_label call_contextm wfp a6 a8 a2 a10 unfolding call_menv_def by fastforce \n moreover have \"HLabel obj \\ the (grant P (mscname M0))\" using grant_more_than_object_label wfp a6 a8 a2 call_contextm unfolding call_menv_def by fastforce \n ultimately have a12: \"P M0 \\0' \\<^bold>\\ S0'\" using corr a6 a1 call_params_typecorrect by blast\n\n have \"(P \\ (ClassT (HClass obj)) <: (ClassT d))\" using method_declaring_class_subtype a6 a8 wfp by blast\n moreover have \"is_obj_label_ok P obj ((ClassT d),(privs S0))\" using op7 a2 unfolding is_obj_label_ok_def by simp\n ultimately have \"is_value_ok P (heap S0) (intersect_label ((ClassT d),UNIV) (privs S0)) a\" using a2 op7 unfolding intersect_label_def by auto\n then have \"P M0 \\0 \\<^bold>\\ S0\" using a12 S0'_def \\0'_def op7 call_contextl unfolding call_lenvi_def corr_def var_corr_def by simp\n then show ?thesis using a11 by simp\nqed\n\nlemma is_expr_value_ok_subsumption:\n assumes wfp: \"wf_prog P\"\n assumes ok: \"is_expr_value_ok P S' T' v\"\n assumes subsumption: \"subsumption P (ttype T') (ttype T)\"\n assumes label: \"tlabel T' = tlabel T\"\n shows \"is_expr_value_ok P S' T v\"\n using wfp ok subsumption label is_value_ok_subsumption intersect_label_type intersect_label_label\n unfolding is_expr_value_ok_def by metis\n\nlemma preservation_call_return:\n assumes wfp: \"wf_prog P\"\n assumes corr: \"P M0 \\0 \\<^bold>\\ S1\" (* after state of method correct w.r.t context *)\n assumes heap: \"heap S1 = heap S'\"\n assumes except: \"except S1 = except S'\" (* required relationship between stack after method body and final stack *)\n assumes M0_def: \"M0 = call_menv d rdecl\" (* context based on runtime method declaration *)\n assumes mcompat: \"mdecl_compatible decl (mdecl rdecl)\" (* runtime and compile-time method declaration compatible *)\n assumes T': \"T' = intersect_label (mret decl) \\0\" (* static type of method return *)\n assumes subsumption: \"subsumption P (ttype T') (ttype T)\" (* type of method return may be a subtype of the expression, due to subsumption *)\n assumes label: \"(tlabel T) = (tlabel T')\"\n assumes label_inv: \"(tlabel T') \\ (privs S') = (tlabel (mret decl)) \\ (privs S1)\"\n assumes retval_if_noexcept: \"except S1 = None \\ retval S1 \\ None\" \n assumes v: \"v = the (retval S1)\"\n shows \"is_expr_value_ok P S' T v\"\nproof -\n have \"is_expr_value_ok P S1 (msreturn M0) v\" (* inferred from type-correctness of final state *)\n using is_expr_value_ok_return retval_if_noexcept corr v by metis\n then have \"is_expr_value_ok P S1 (mret decl) v\" (* by method compatibility *)\n using call_menv_def fst_conv M0_def mcompat mdecl_compatible_def by simp\n moreover have \"(intersect_label (mret decl) (privs S1)) = (intersect_label T' (privs S'))\"\n using intersect_label_label intersect_label_type label_inv T' by (simp add: prod_eq_iff)\n ultimately have b1: \"is_expr_value_ok P S' T' v\" (* by label relations *)\n using heap except unfolding is_expr_value_ok_def by simp\n (* the return type of the expression (after subsumption) may be a supertype of the method return type *)\n then show ?thesis \n using b1 is_expr_value_ok_subsumption wfp subsumption intersect_label_type label by metis\nqed\n\n(* Shows type-correctness is maintained over the call to an instance method. We show that:\n The final state is consistent with the types of the environment.\n The heap in the state only extends itself.\n The return value is type-correct with the return type of the method (provided no exception was thrown.) *)\nlemma preservation_expr_calli:\n assumes op1: \"a = the (stack S x)\"\n assumes op2: \"l = the_href a\"\n assumes op3: \"a \\ v.null\"\n assumes op4: \"obj = the (heap S l)\"\n assumes op5: \"(d, m) = the (cmethod P (HClass obj) mname)\"\n assumes op6: \"s = the (mstmt m)\"\n assumes s0: \"S0 = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args)(This \\ a), retval := None, privs := (HLabel obj)\\\"\n assumes s': \"S' = S1\\stack := stack S, retval := retval S, privs := privs S\\\"\n assumes v: \"v = the (retval S1)\"\n assumes \"P \\ \\s | S0\\ \\\\<^sub>s \\S1\\\"\n (* induction hypothesis *)\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S0) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S0 S1\"\n assumes retval_if_noexcept: \"except S1 = None \\ retval S1 \\ None\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes wf: \"P M \\ \\ calli x mname args : T\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\nproof -\n define M0 where \"M0 = call_menv d m\"\n moreover define \\0 where \"\\0 = call_lenvi P d (mdecl m)\"\n ultimately have a1: \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\" using calli_prems assms by metis\n then have a2: \"(P M0 \\0 \\<^bold>\\ S1) \\ transition_ok S0 S1\" using hyp by metis\n then have a3: \"(P M \\ \\<^bold>\\ S')\" using heap_extends_corr s0 s' corr unfolding transition_ok_def by metis\n moreover have \"transition_ok S S'\" using a2 s0 s' unfolding heap_extends_def transition_ok_def by auto\n moreover have \"is_expr_value_ok P S' T v\"\n proof -\n (* infer what P M \\ \\ calli x mname args : T means\n t' is the actual method return type, (ttype T) is the subsumed type.\n it is given that T' = (intersect_label (mret decl) (tlabel T0)) *)\n obtain T0 decl T' where b2: \"(\\\\x\\\\<^sub>v = Some T0) \\ methoddecl P (ttype T0) mname = Some decl \\\n is_type P (ttype T0) \\ (\\t. ttype T0 \\ (ValT t)) \\ \\mstatic decl \\\n wf_method_call P \\ decl args (tlabel T0) T' \\ (subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\"\n using wf wf_expr_calli_intro by (metis fst_conv snd_conv prod.collapse)\n (* object exists and subtype of static type t0, label satisfies invariant *)\n have b3: \"(P \\ (ClassT (HClass obj)) <: (ttype T0)) \\ is_obj_label_ok P obj (intersect_label T0 (privs S))\"\n using object_correspondence b2 op1 op2 op3 op4 corr by blast\n (* method exists and compatible with static definition *)\n then have b4: \"mdecl_compatible decl (mdecl m)\"\n using method_correspondence wfp op5 b2 by metis\n moreover have \"T' = intersect_label (mret decl) (tlabel T0)\" using b2 unfolding wf_method_call_def by simp (* expanding static wellformedness defn *)\n moreover have \"heap S1 = heap S' \\ except S1 = except S'\" using s' by simp\n moreover have \"(subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\" using b2 by simp\n (* show labels are consistent *)\n moreover have \"(tlabel T') \\ (privs S') = (tlabel (mret decl)) \\ (privs S1)\"\n proof -\n have \"(tlabel (mret decl)) \\ (tlabel T0) \\ (privs S) = (tlabel (mret decl)) \\ (HLabel obj)\"\n using call_params_label_invariant b3 b2 by (metis prod.collapse) \n moreover have \"privs S = privs S'\" using s' by simp\n moreover have \"privs S0 = (HLabel obj)\" using s0 by simp\n moreover have \"privs S1 = privs S0\" using a2 unfolding transition_ok_def by simp\n moreover have \"tlabel T' = tlabel (mret decl) \\ (tlabel T0)\" using b2 intersect_label_label unfolding wf_method_call_def by simp\n ultimately show ?thesis by auto\n qed\n ultimately show ?thesis using wfp preservation_call_return a2 M0_def retval_if_noexcept v by metis\n qed\n ultimately show ?thesis by simp \nqed\n\n\n(* Show starting stack of a static method call, and the statement to be executed, are type-correct.*)\nlemma calls_prems:\n assumes op5: \"(d, m) = the (cmethod P c mname)\"\n assumes op6: \"s = the (mstmt m)\"\n assumes op7: \"S0 = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args), retval := None, privs := (privs S) \\ lbl\\\"\n assumes wf: \"P M \\ \\ calls c mname lbl args : T\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes call_contextm: \"M0 = call_menv d m\"\n assumes call_contextl: \"\\0 = call_lenvs P (mdecl m)\"\n shows \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\"\nproof -\n obtain t' where a1: \"is_class P c \\ cmethod P c mname = Some (d,m) \\ mstatic (mdecl m) \\\n wf_method_call P \\ (mdecl m) args lbl (t',(tlabel T)) \\ (mreq m) \\ (msreq M)\n \\ lbl \\ the (grant P (mscname M)) \\ the (grant P c)\n \\ (mreq m) \\ lbl \\ (subsumption P t' (ttype T))\"\n using wf wf_expr_calls_intro op7 by (metis (mono_tags, lifting) op5 option.sel prod.collapse snd_conv)\n \n (* Show the statement that is the method body is well-formed. *)\n obtain dCl where a10: \"class P d = Some dCl \\ wf_method P (d,dCl) m\" using prog_wf_method a1 wfp by blast\n moreover have \"mstmt m = Some s\" using prog_wf_mstmt_exists wfp op6 a1 by fastforce (* body exists *)\n moreover have \"mstatic (mdecl m)\" using a1 by simp\n ultimately have a11: \"P M0 \\0 \\ s \\\" unfolding wf_method_def using call_contextm call_contextl by simp\n\n (* Show the initial stack for statement s is well-formed. *)\n have \"wf_mdecl P (mdecl m)\" using a10 unfolding wf_method_def by simp\n moreover have \"(\\par\\(set (msig (mpar (mdecl m)))). (tlabel par) \\ lbl \\ (privs S) = (tlabel par) \\ ((privs S) \\ lbl))\" by blast\n (* for static methods, there is no difference between the signature we type-check against and the one we call, not even\n non-functional differences (method parameters) *)\n moreover have \"mdecl_compatible (mdecl m) (mdecl m)\" unfolding mdecl_compatible_def by simp\n moreover have \"msreq M0 \\ (privs S) \\ lbl\"\n proof -\n have \"msreq M0 \\ (msreq M) \\ lbl\" using a1 call_contextm call_menv_def by auto (* typing rules *)\n moreover have \"(msreq M) \\ (privs S)\" using corr unfolding corr_def by simp (* by invariant *)\n ultimately show ?thesis by auto\n qed\n moreover have \"((privs S) \\ lbl) \\ the (grant P (mscname M0))\"\n proof -\n have \"(c,d) \\ (subclass P)\"\n using wfp method_declaring_class a1 by metis\n then have \"the (grant P c) \\ the (grant P d)\"\n using wfp grant_subclass_mono by simp\n moreover have \"(privs S) \\ lbl \\ the (grant P c)\"\n using corr a1 unfolding corr_def by auto\n ultimately show ?thesis using call_contextm call_menv_def by auto\n qed\n ultimately have a12: \"P M0 \\0 \\<^bold>\\ S0\" using op7 corr a1 call_contextl call_params_typecorrect by metis\n then show ?thesis using a11 by simp\nqed\n\nlemma preservation_expr_calls:\n assumes op5: \"(d, m) = the (cmethod P c mname)\"\n assumes \"P \\ \\s | S0\\ \\\\<^sub>s \\S1\\\"\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S0) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S0 S1\"\n assumes \"s = the (mstmt m)\"\n assumes s0: \"S0 = S\\stack := stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args, retval := None, privs := (privs S) \\ lbl\\\"\n assumes s': \"S' = S1\\stack := stack S, retval := retval S, privs := privs S\\\"\n assumes retval_if_noexcept: \"except S1 = None \\ retval S1 \\ None\"\n assumes v: \"v = the (retval S1)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes wf: \"P M \\ \\ calls c mname lbl args : T\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\nproof -\n define M0 where \"M0 = call_menv d m\"\n moreover define \\0 where \"\\0 = call_lenvs P (mdecl m)\"\n ultimately have a1: \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\" using calls_prems assms by metis\n then have a2: \"(P M0 \\0 \\<^bold>\\ S1) \\ transition_ok S0 S1\" using hyp by metis\n then have a3: \"(P M \\ \\<^bold>\\ S')\" using heap_extends_corr s0 s' corr unfolding transition_ok_def by metis\n moreover have \"transition_ok S S'\" using a2 s0 s' unfolding transition_ok_def heap_extends_def by auto\n moreover have \"is_expr_value_ok P S' T v\"\n proof -\n (* infer what P M \\ \\ calls c mname lbl args : T means *)\n obtain T' where b2: \"is_class P c \\ cmethod P c mname = Some (d,m) \\ mstatic (mdecl m) \\\n wf_method_call P \\ (mdecl m) args lbl T' \\ (mreq m) \\ (msreq M)\n \\ (mreq m) \\ lbl \\ (subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\"\n using wf wf_expr_calls_intro by (metis (mono_tags, lifting) op5 option.sel prod.collapse fst_conv snd_conv)\n \n then have b3: \"mdecl_compatible (mdecl m) (mdecl m)\" (* static definition and runtime definition the same for static methods *)\n using mdecl_compatible_def by simp\n moreover have \"T' = intersect_label (mret (mdecl m)) lbl\" using b2 unfolding wf_method_call_def by simp (* expanding wellformedness defn *)\n moreover have \"heap S1 = heap S' \\ except S1 = except S'\" using s' by simp\n moreover have \"(subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\" using b2 by simp\n (* show labels are consistent *)\n moreover have \"(tlabel T') \\ (privs S') = (tlabel (mret (mdecl m))) \\ (privs S1)\"\n proof -\n have \"privs S1 = privs S0\" using a2 unfolding transition_ok_def by simp\n then have \"privs S1 = privs S' \\ lbl\" using s0 s' by simp\n moreover have \"tlabel T' = tlabel (mret (mdecl m)) \\ lbl\" using b2 intersect_label_label unfolding wf_method_call_def by simp\n ultimately show ?thesis by auto\n qed\n ultimately show ?thesis using wfp preservation_call_return a2 M0_def retval_if_noexcept v by metis\n qed\n ultimately show ?thesis by simp \nqed\n\nlemma preservation_expr_cast:\n assumes op1: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\n assumes op2: \"case v of href l \\ hobj = the (heap S' l) \\ (P \\ ClassT (HClass hobj) <: tcast) | (num n) \\ tcast = ValT IntT\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ cast tcast e : T\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\nproof -\n define Tcast where \"Tcast \\ (tcast, tlabel T)\"\n obtain T' where a1: \"(P M \\ \\ e : T') \\ \\is_cap_type P (ttype T') \n \\ \\is_cap_type P (ttype Tcast) \\ (subsumption P (ttype Tcast) (ttype T)) \\ (tlabel T' = tlabel T)\" \n using wf wf_expr_cast_intro Tcast_def by fastforce \n then have a2: \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T' v\"\n using hyp corr by metis \n (* show the value is type correct to Tcast *)\n have \"is_expr_value_ok P S' Tcast v\"\n proof (cases v)\n case b1: (href l)\n then have \"hobj = the (heap S' l) \\ (P \\ ClassT (HClass hobj) <: (ttype Tcast))\" using op2 Tcast_def by auto\n moreover have \"is_expr_value_ok P S' T' v\" using a2 by simp\n moreover have \"tlabel Tcast = tlabel T'\" using a1 Tcast_def by simp\n ultimately show ?thesis \n using is_value_ok_valid_object_cast a1 b1 a2 intersect_label_label intersect_label_type \n unfolding is_expr_value_ok_def by metis\n next\n case null\n then show ?thesis unfolding is_expr_value_ok_def by simp\n next\n case (num x3)\n then have \"(ttype Tcast) = (ValT IntT)\" using op2 Tcast_def by simp\n then show ?thesis unfolding is_expr_value_ok_def \n using num intersect_label_type by auto\n qed\n (* show the value is type-correct to the supertype T by subsumption *)\n then have \"is_expr_value_ok P S' T v\" \n using wfp a1 is_expr_value_ok_subsumption Tcast_def by simp\n then show ?thesis using a2 by simp\nqed\n\nlemma preservation_expr_const:\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ const k : T\"\n assumes op: \"case k of k.null \\ v = v.null | k.num n \\ v = v.num n\"\n shows \"(P M \\ \\<^bold>\\ S) \\ transition_ok S S \\ is_expr_value_ok P S T v\"\nproof -\n obtain t' where a1: \"(case k of k.null \\ (\\vt. t' \\ (ValT vt)) | k.num n \\ (t' = ValT IntT)) \\ (subsumption P t' (ttype T))\" \n using wf wf_expr_const_intro by (metis prod.collapse)\n have \"is_expr_value_ok P S T v\"\n proof (cases k)\n case null\n then have \"v = v.null \\ (\\vt. t' \\ (ValT vt))\" using op a1 by simp\n then show ?thesis unfolding is_expr_value_ok_def by simp (* null is always OK *)\n next\n case (num n)\n then have b1: \"v = v.num n \\ (t' = ValT IntT)\" using op a1 by simp \n moreover have \"ttype T = (ValT IntT)\"\n proof (cases \"is_cap_type P (ttype T)\")\n case True (* Not possible *)\n then show ?thesis using a1 b1 unfolding subsumption_def by simp \n next\n case False\n then show ?thesis using subtype_int_parity a1 b1 unfolding subsumption_def by auto\n qed \n ultimately show ?thesis using intersect_label_type unfolding is_expr_value_ok_def by simp\n qed\n then show ?thesis using corr transition_ok_self by auto\nqed\n\nlemma preservation_expr_fieldacci:\n assumes op1: \"a = the (stack S x)\"\n assumes op2: \"a \\ v.null\"\n assumes op3: \"l = the_href a\"\n assumes op4: \"obj = the (heap S l)\"\n assumes op5: \"v = the (HFields obj f)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ fieldacci x f : T\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S) \\ transition_ok S S \\ is_expr_value_ok P S T v\"\nproof -\n obtain T' where a1: \"(wf_fieldi_access P \\ x f T' \\ (subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T))\" \n using wf wf_expr_fieldacci_intro by (metis prod.collapse fst_conv snd_conv)\n then obtain c \\0 fdecl where a2: \"(\\\\x\\\\<^sub>v = Some ((ClassT c),\\0)) \\ field P c f = Some fdecl \\\n \\fstatic fdecl \\ T' = intersect_label (ftype fdecl) \\0\"\n unfolding wf_fieldi_access_def by blast\n have a3: \"a = (href l) \\ heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ClassT c)) \\ is_obj_label_ok P obj (intersect_label ((ClassT c),\\0) (privs S))\"\n using object_correspondence a2 op1 op2 op3 op4 corr by (metis \\.simps(5) fst_conv)\n then have \"is_value_ok P (heap S) ((ClassT c),\\0 \\ (privs S)) (href l)\" (* object ok *) \n using intersect_label_type intersect_label_label by (simp add: intersect_label_def) \n then have \"is_value_ok P (heap S) (intersect_label (ftype fdecl) (HLabel obj)) v\" (* field value ok *)\n using heap_access_ok wfp a2 op4 op5 corr by simp\n moreover have \"\\0 \\ (privs S) = (HLabel obj)\" (* We do not have to consider the label relationship in the capability case as fields can only be accessed on classes. *)\n using a3 unfolding is_obj_label_ok_def by (simp add: intersect_label_label intersect_label_type) \n ultimately have \"is_value_ok P (heap S) (intersect_label T' (privs S)) v\"\n using intersect_label_vary a2 a3 by metis\n then have \"is_value_ok P (heap S) (intersect_label T (privs S)) v\"\n using wfp is_value_ok_subsumption a1 intersect_label_label intersect_label_type by metis\n then have \"is_expr_value_ok P S T v\"\n unfolding is_expr_value_ok_def by simp\n then show ?thesis using corr transition_ok_self by auto\nqed\n\nlemma preservation_expr_fieldaccs:\n assumes op1: \"classStatics = the (globals S c)\"\n assumes op2: \"v = the (classStatics f)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ fieldaccs c f : T\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S) \\ transition_ok S S \\ is_expr_value_ok P S T v\"\nproof -\n obtain T' where a1: \"(wf_fields_access P M c f T') \\ (subsumption P (ttype T') (ttype T)) \\ (tlabel T' = tlabel T)\" \n using wf wf_expr_fieldaccs_intro by (metis prod.collapse fst_conv snd_conv)\n then obtain fdecl where a2: \"is_class P c \\ field P c f = Some fdecl \\ fstatic fdecl \\ \n (T' = (ftype fdecl) \\ (tlabel (ftype fdecl)) \\ (msreq M))\"\n unfolding wf_fields_access_def by blast\n then have \"is_value_ok P (heap S) T' v\"\n using globals_access_ok op1 op2 corr by metis \n then have \"is_value_ok P (heap S) T v\"\n using is_value_ok_subsumption a1 wfp by simp\n moreover have \"T = intersect_label T (privs S)\" \n proof -\n have \"tlabel T \\ (msreq M)\" using a1 a2 by simp\n moreover have \"(msreq M) \\ (privs S)\" using corr unfolding corr_def by simp\n ultimately show ?thesis using intersect_label_label intersect_label_type\n by (metis Int_absorb2 order_trans prod_eqI) \n qed\n ultimately have \"is_expr_value_ok P S T v\" \n unfolding is_expr_value_ok_def by simp\n then show ?thesis using corr transition_ok_self by simp\nqed\n\n\n\nlemma is_value_ok_wrap:\n assumes wfp: \"wf_prog P\"\n assumes ok: \"is_value_ok P H T' v\"\n assumes t'_implements_t: \"(P \\ (ttype T') <: (ttype T))\"\n assumes label: \"(tlabel T') \\ (cap_label P cbname) = (tlabel T)\"\n assumes reqs: \"\\is_cap_type P (ttype T') \\ (superinterface_set P cbname) \\ (tlabel T')\" (* in principle not requried if source type is a capability *)\n assumes cap: \"is_cap P cbname \\ (ttype T) = (IfaceT cbname)\"\n shows \"is_value_ok P H T v\"\nproof (cases \"(P, H, T, v)\" rule: is_value_ok.cases)\n case (1 P H t v)\n (* Case not actually possible, because T is a capability. *)\n then show ?thesis using 1 ok t'_implements_t subtype_int_parity by simp\nnext\n case a1: (2 P H T loc)\n obtain obj where a2: \"H loc = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ttype T')) \\ is_obj_label_ok P obj T'\" \n using a1 ok by auto\n moreover have a3: \"P \\ (ClassT (HClass obj)) <: (ttype T)\" \n using a1 a2 t'_implements_t subtype_trans by blast\n moreover have \"is_obj_label_ok P obj T\"\n proof (cases \"is_cap_type P (ttype T')\")\n case b1: True\n (* Helper lemmas; unfold is_obj_label_ok P obj T' *)\n then obtain cbname' where b2: \"(ttype T') = (IfaceT cbname')\"\n by (metis \\.exhaust is_cap_type.simps(1) is_cap_type.simps(2))\n then have b3: \"(tlabel T') = (cap_label P cbname') \\ (HLabel obj) \\ (superinterface_set P cbname') \\ (tlabel T')\"\n using b1 a2 unfolding is_obj_label_ok_def by auto\n (* Main proof *)\n have \"(tlabel T) = (cap_label P cbname) \\ (HLabel obj)\"\n proof -\n have \"(cap_label P cbname) \\ (cap_label P cbname')\"\n using cap_label_subtype_mono t'_implements_t b2 cap wfp a1 by auto\n then show ?thesis\n using a1 b3 label by blast\n qed\n moreover have \"(superinterface_set P cbname) \\ (tlabel T)\"\n proof -\n have \"(superinterface_set P cbname) \\ (superinterface_set P cbname')\"\n using superinterface_set_subtype_mono t'_implements_t b2 cap wfp a1 by auto\n then show ?thesis\n using a1 b3 label unfolding cap_label_def by auto\n qed\n ultimately show ?thesis using a2 a1 cap unfolding is_obj_label_ok_def by simp\n next\n case False\n then have b1: \"(tlabel T') = (HLabel obj)\"\n using a2 unfolding is_obj_label_ok_def by simp\n then have b2: \"(tlabel T) = (cap_label P cbname) \\ (HLabel obj)\"\n using a1 label by blast\n moreover have \"(superinterface_set P cbname) \\ (tlabel T)\"\n using b1 b2 reqs a1 False unfolding cap_label_def by auto\n ultimately show ?thesis using a2 a1 cap unfolding is_obj_label_ok_def by simp\n qed\n ultimately show ?thesis using a1 by simp\nnext\n case (3 P H t)\n then show ?thesis by simp\nqed\n\nlemma is_expr_value_ok_wrap:\n assumes wfp: \"wf_prog P\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes ok: \"is_expr_value_ok P S T' v\"\n assumes t'_implements_t: \"(P \\ (ttype T') <: (ttype T))\"\n assumes label: \"(tlabel T') \\ (cap_label P cbname) = (tlabel T)\"\n assumes reqs: \"\\is_cap_type P (ttype T') \\ (superinterface_set P cbname) \\ (msreq M) \\ (tlabel T')\"\n assumes cap: \"is_cap P cbname \\ (ttype T) = (IfaceT cbname)\"\n shows \"is_expr_value_ok P S T v\"\nproof (cases \"except S\")\n case None\n define T1' where \"T1' \\ (intersect_label T' (privs S))\"\n define T1 where \"T1 \\ (intersect_label T (privs S))\"\n have \"is_value_ok P (heap S) T1' v\"\n using None ok unfolding is_expr_value_ok_def T1'_def by simp\n moreover have \"(tlabel T1') \\ (cap_label P cbname) = (tlabel T1)\"\n using label T1'_def T1_def intersect_label_label by auto\n moreover have \"\\is_cap_type P (ttype T1') \\ (superinterface_set P cbname) \\ (tlabel T1')\" (* using msreq M \\ privs S *)\n using reqs T1'_def T1_def intersect_label_label intersect_label_type corr unfolding corr_def by auto\n moreover have \"(P \\ (ttype T1') <: (ttype T1))\"\n using T1'_def T1_def t'_implements_t intersect_label_type by auto\n moreover have \"is_cap P cbname \\ (ttype T1) = (IfaceT cbname)\"\n using T1'_def T1_def cap intersect_label_type by auto\n ultimately have \"is_value_ok P (heap S) T1 v\"\n using is_value_ok_wrap wfp by simp\n then show ?thesis \n using None unfolding T1_def is_expr_value_ok_def by simp\nnext\n case (Some a)\n then show ?thesis using ok unfolding is_expr_value_ok_def by simp\nqed\n\nlemma preservation_expr_wrap:\n assumes op1: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ wrap cbname e : T\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T v\"\nproof -\n obtain T' where a1: \"(P M \\ \\ e : T') \\ (P \\ (ttype T') <: (IfaceT cbname)) \\\n is_cap P cbname \\ (\\is_cap_type P (ttype T') \\ (superinterface_set P cbname) \\ (msreq M) \\ (tlabel T')) \\\n (IfaceT cbname) = (ttype T) \\ (tlabel T') \\ (cap_label P cbname) = (tlabel T)\"\n using wf wf_expr_wrap_intro by (metis prod.collapse fst_conv snd_conv)\n then have a2: \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S' \\ is_expr_value_ok P S' T' v\"\n using hyp corr by metis\n then show ?thesis \n using wfp a1 is_expr_value_ok_wrap by metis\nqed\n\nlemma preservation_stmt_assign_base:\n assumes op: \"S' = (if except S1 = None then S1\\stack := stack S1(x \\ v)\\ else S1)\"\n assumes hyp: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n (* If the expression did not throw an exception, the assignment will occur and the final\n state will be type correct to \\(x \\ T). If an exception did occur, the assignment\n will not occur and the final state will be type correct to the original \\. *)\n shows \"(except S' = None \\ (P M \\(x \\ T) \\<^bold>\\ S')) \\ \n (except S' \\ None \\ (P M \\ \\<^bold>\\ S')) \\ transition_ok S S'\"\nproof -\n show ?thesis proof (cases \"except S1\")\n case None\n (* There was no exception evaluating the expression, hence the return value will be \n valid and type-correct. *)\n have \"P M \\ \\<^bold>\\ S1\" using hyp by simp\n moreover have \"is_value_ok P (heap S1) (intersect_label T (privs S1)) v\" using hyp None unfolding is_expr_value_ok_def by simp \n moreover have b1: \"S' = S1\\stack := stack S1(x \\ v)\\\" using op None by simp\n ultimately have \"P M \\(x \\ T) \\<^bold>\\ S'\" using stack_update_ok by metis\n moreover have \"transition_ok S S'\"\n proof -\n have \"transition_ok S1 S'\"\n using b1 transition_ok_simple by simp\n then show ?thesis using hyp transition_ok_trans by metis\n qed\n moreover have \"except S' = None\" using None op by simp\n ultimately show ?thesis by metis\n next\n (* There was an exception evaluation the expression, no assignment to take place *)\n case (Some ex)\n then have \"S' = S1\" using op by simp\n then show ?thesis using hyp Some by simp\n qed\nqed\n\nlemma preservation_stmt_assign:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"S' = (if except S1 = None then S1\\stack := stack S1(x \\ v)\\ else S1)\"\n assumes op3: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ assign x e \\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n obtain T where a1: \"(\\\\x\\\\<^sub>v = Some T) \\ (P M \\ \\ e : T)\"\n using wf wf_stmt_assign_intro by blast\n then have a2: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using corr hyp by blast\n moreover have \"\\ = \\(x \\ T)\"\n using a1 by auto\n ultimately show ?thesis\n using preservation_stmt_assign_base op2 by metis\nqed\n\nlemma preservation_stmt_assignfi:\n assumes op1: \"no_exception_or_return S\" (* unused *)\n assumes op2: \"a = the (stack S1 x)\"\n assumes op3: \"a \\ v.null\"\n assumes op4: \"l = the_href a\"\n assumes op5: \"obj = the (heap S1 l)\"\n assumes op6: \"S' = (if except S1 = None then S1\\heap := heap S1(l \\ obj\\HFields := HFields obj(f \\ v)\\)\\ else S1)\"\n assumes op7: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\" (* unused *)\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ assignfi x f e \\\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n obtain T where a1: \"wf_fieldi_access P \\ x f T \\ (P M \\ \\ e : T)\"\n using wf wf_stmt_assignfi_intro by blast\n then obtain c \\0 fdecl where a2: \"(\\\\x\\\\<^sub>v = Some ((ClassT c),\\0)) \\ field P c f = Some fdecl \\\n \\fstatic fdecl \\ T = intersect_label (ftype fdecl) \\0\"\n unfolding wf_fieldi_access_def by blast\n have a3: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using a1 corr hyp by blast\n then show ?thesis proof (cases \"except S1\")\n case None\n have \"P M \\ \\<^bold>\\ S1\"\n using a3 by simp\n moreover have b1: \"heap S1 l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ClassT c)) \\ is_obj_label_ok P obj (intersect_label ((ClassT c),\\0) (privs S1))\" \n using object_correspondence a2 a3 op2 op3 op4 op5 by (metis \\.simps(5) fst_conv)\n moreover have \"is_value_ok P (heap S1) (intersect_label (ftype fdecl) (HLabel obj)) v\"\n proof - \n have \"is_value_ok P (heap S1) (intersect_label T (privs S1)) v\"\n using a3 None a2 unfolding is_expr_value_ok_def by simp\n moreover have \"(HLabel obj) = \\0 \\ (privs S1)\"\n using a2 b1 intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by auto\n ultimately show ?thesis using a2 intersect_label_vary by metis\n qed\n moreover have \"field P (HClass obj) f = Some fdecl\"\n using a2 b1 field_subtype wfp by metis\n moreover have b2: \"S' = S1\\heap := heap S1(l \\ obj\\HFields := HFields obj(f \\ v)\\)\\\" \n using op6 None by simp\n ultimately have b3: \"(P M \\ \\<^bold>\\ S') \\ heap_extends (heap S1) (heap S')\"\n using heap_update_ok heap_extends_consistent_heap_update obj_consistent_field_update by simp\n moreover have \"transition_ok S1 S'\" \n using b2 b3 unfolding transition_ok_def by simp\n ultimately show ?thesis using a3 transition_ok_trans by blast\n next\n case (Some a)\n then have \"S' = S1\" using op6 by simp\n then show ?thesis using a3 by simp\n qed\nqed\n\nlemma preservation_stmt_assignfs:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"classStatics = the (globals S1 c)\"\n assumes op3: \"S' = (if except S1 = None then S1\\globals := globals S1(c \\ classStatics(f \\ v))\\ else S1)\"\n assumes op4: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ assignfs c f e \\\"\n assumes wfp: \"wf_prog P\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n obtain T where a1: \"wf_fields_access P M c f T \\ (P M \\ \\ e : T)\"\n using wf wf_stmt_assignfs_intro by blast\n then obtain fdecl where a2: \"is_class P c \\ field P c f = Some fdecl \\ fstatic fdecl \\ \n (T = (ftype fdecl) \\ (tlabel (ftype fdecl)) \\ (msreq M))\"\n using wf_fields_access_def by auto\n have a3: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using a1 corr hyp by blast\n then show ?thesis proof (cases \"except S1\")\n case None\n then have \"is_value_ok P (heap S1) (intersect_label T (privs S1)) v\"\n using a2 a3 unfolding is_expr_value_ok_def by simp\n moreover have \"T = (intersect_label T (privs S1))\" \n proof -\n have \"tlabel T \\ (msreq M)\" using a2 by simp\n moreover have \"(msreq M) \\ (privs S1)\" using a3 unfolding corr_def by simp\n ultimately show ?thesis using intersect_label_label intersect_label_type\n by (metis Int_absorb2 order_trans prod_eqI) \n qed\n moreover have b1: \"S' = S1\\globals := globals S1(c \\ classStatics(f \\ v))\\\"\n using op3 None by simp\n ultimately have \"P M \\ \\<^bold>\\ S'\"\n using globals_update_ok a2 a3 op2 by simp\n moreover have \"transition_ok S1 S'\"\n using transition_ok_simple op3 by simp\n ultimately show ?thesis \n using b1 a3 transition_ok_trans by metis\n next\n case (Some a)\n then have \"S' = S1\" using op3 by simp\n then show ?thesis using a3 by simp\n qed\nqed\n\nlemma stack_variable_restore:\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes corr2: \"(P M \\' \\<^bold>\\ S2)\"\n assumes trans: \"transition_ok S S2\"\n assumes \\': \"\\' = \\(x := T)\"\n assumes op3: \"S' = S2\\stack := (stack S2)(x := (stack S x))\\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof - \n have \"(P M \\ \\<^bold>\\ S')\" proof (cases \"\\\\x\\\\<^sub>v\")\n case None\n then show ?thesis using corr2 op3 unfolding corr_def \\' var_corr_def by auto\n next\n case (Some T')\n then have b1: \"(stack S x) \\ None \\ is_value_ok P (heap S) (intersect_label T' (privs S)) (the (stack S x))\" \n using corr stack_access_ok by blast\n then have \"is_value_ok P (heap S2) (intersect_label T' (privs S2)) (the (stack S x))\" \n using trans is_value_ok_heap_extends unfolding transition_ok_def by metis\n moreover have \"\\ = \\'(x\\T')\" \n using Some \\' by auto\n moreover have \"S' = S2\\stack := (stack S2)(x \\ the(stack S x))\\\"\n using op3 b1 by simp\n ultimately show ?thesis using stack_update_ok corr2 op3 by simp\n qed\n moreover have \"transition_ok S S'\"\n using trans op3 unfolding transition_ok_def by simp\n ultimately show ?thesis by simp\nqed\n\nlemma preservation_stmt_letin:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes op3: \"S2 = (if except S1 = None then S1\\stack := stack S1(x \\ v)\\ else S1)\"\n assumes op4: \"P \\ \\s | S2\\ \\\\<^sub>s \\S3\\\"\n assumes op5: \"S' = S3\\stack := (stack S3)(x := stack S x)\\\"\n assumes hype: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes hyps: \"\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S3) \\ transition_ok S2 S3\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ letin T x e s \\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n have wfi: \"(P M \\ \\ e : T) \\ (P M \\(x\\T) \\ s \\)\"\n using wf wf_stmt_letin_intro by simp\n then have \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using corr hype by blast\n then have a1: \"(except S2 = None \\ (P M \\(x \\ T) \\<^bold>\\ S2)) \\ \n (except S2 \\ None \\ (P M \\ \\<^bold>\\ S2)) \\ transition_ok S S2\"\n using preservation_stmt_assign_base op3 by metis\n then show ?thesis proof (cases \"except S2\")\n case None\n then have \"(P M \\(x\\T) \\<^bold>\\ S2) \\ transition_ok S S2\" \n using a1 by simp\n then have b1: \"(P M \\(x\\T) \\<^bold>\\ S3) \\ transition_ok S S3\"\n using wfi hyps transition_ok_trans by metis\n then show \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\n using stack_variable_restore corr op5 by metis\n next\n case (Some ex) (* if there was an exception evaluating the expression, and the assignment\n does not go through, show that the statement is not executed in a\n type-incorrect state (i.e. the body is skipped.) *)\n then have \"(P M \\ \\<^bold>\\ S2) \\ transition_ok S S2\" \n using a1 by simp\n moreover have \"S2 = S3\"\n using exception_or_return_skips Some op4 unfolding no_exception_or_return_def by simp\n ultimately have \"(P M \\ \\<^bold>\\ S3) \\ transition_ok S S3\" \n by simp\n moreover have \"\\ = \\(x := \\\\x\\\\<^sub>v)\" \n by simp\n ultimately show \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\n using stack_variable_restore corr op5 by metis\n qed\nqed\n\nlemma preservation_stmt_return:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"S' = (if except S1 = None then S1\\retval := Some v\\ else S1)\"\n assumes op3: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\" (* unused *)\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ return e \\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n have \"P M \\ \\ e : (msreturn M)\"\n using wf wf_stmt_return_intro by simp\n then have a1: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 (msreturn M) v\"\n using hyp corr by simp\n have \"P M \\ \\<^bold>\\ S'\" proof (cases \"except S1\")\n case None\n then have \"is_value_ok P (heap S1) (intersect_label (msreturn M) (privs S1)) v\"\n using a1 unfolding is_expr_value_ok_def by simp\n moreover have \"S' = S1\\retval := Some v\\\"\n using op2 None by simp\n ultimately show \"P M \\ \\<^bold>\\ S'\" \n using retval_update_ok a1 by simp\n next\n case (Some a)\n then show ?thesis using op2 a1 by simp\n qed\n moreover have \"transition_ok S S'\"\n using a1 op2 unfolding transition_ok_def by simp\n ultimately show ?thesis by simp\nqed\n\nlemma preservation_stmt_throw:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"S' = (if except S1 = None then S1\\except := Some v\\ else S1)\"\n assumes op3: \" P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes op4: \"v \\ null\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ throw e \\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n have \"P M \\ \\ e : (ClassT Object,{})\"\n using wf wf_stmt_throw_intro by simp\n then have a1: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 ((ClassT Object),{}) v\"\n using corr hyp by metis\n show ?thesis proof (cases \"except S1\")\n case None\n then have \"is_value_ok P (heap S1) ((ClassT Object),{}) v\" \n using a1 unfolding is_expr_value_ok_def unfolding intersect_label_def by simp\n moreover have b1: \"S' = S1\\except := Some v\\\"\n using op2 None by simp\n ultimately have \"P M \\ \\<^bold>\\ S'\" \n using except_update_ok op4 a1 by simp\n moreover have \"transition_ok S S'\"\n using a1 b1 unfolding transition_ok_def by simp\n ultimately show ?thesis by simp\n next\n case (Some a)\n then show ?thesis \n using a1 op2 by simp\n qed\nqed\n\nlemma minimum_list_item:\n assumes \"i = Min {j. (j = length list) \\ ((j < length list) \\ P j)}\"\n assumes \"i < length list\"\n shows \"P i\"\nproof -\n have \"finite {j. (j = length list) \\ ((j < length list) \\ P j)}\"\n by simp\n then show ?thesis using assms\n by (metis (mono_tags, lifting) Min_in empty_iff mem_Collect_eq nat_neq_iff)\nqed\n\nlemma preservation_stmt_trycatch_ex_helper:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"except S1 = Some ex\"\n assumes op3: \"a = the_href ex\"\n assumes op4: \"exObj = the (heap S1 a)\"\n assumes op5: \"P \\ \\s | S\\ \\\\<^sub>s \\S1\\\"\n assumes op6: \"i = Min {j::nat. (j = length ch) \\ ((j < length ch) \\ (P \\ (ClassT (HClass exObj)) <: (chtype (ch !j)))) }\"\n assumes op7: \"if i < length ch\n then h = ch ! i \\\n var = chvar h \\\n S2 = S1\\except := None, stack := (stack S1)(var \\ ex)\\ \\\n ((P \\ \\chstmt h | S2\\ \\\\<^sub>s \\S3\\) \\ (\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ chstmt h \\)\n \\ (P M \\ \\<^bold>\\ S3) \\ transition_ok S2 S3)) \\ \n S' = S3\\stack := (stack S3)(var := stack S1 var)\\\n else S' = S1\"\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ trycatch s ch \\\"\n assumes intermediate: \"\\' = \\(var \\ ((chtype h),{}))\"\n shows \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\\n (i < length ch \\ (P M \\' \\<^bold>\\ S2) \\ (P M \\' \\ chstmt h \\) \\ transition_ok S1 S2 \\\n (P M \\' \\<^bold>\\ S3) \\ transition_ok S2 S3 \\ transition_ok S3 S') \\\n (P M \\ \\<^bold>\\ S') \\ transition_ok S1 S'\"\nproof -\n define TException where \"TException \\ ((ClassT Object),({}::(iname set)))\"\n have a1: \"(P M \\ \\ s \\) \\ (\\(t,x,s')\\(set ch). (P M \\(x\\(t,{})) \\ s' \\) \\ \\is_cap_type P t)\"\n using wf wf_stmt_trycatch_intro by simp\n then have a2: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1\"\n using corr hyp by metis\n then have a3: \"is_value_ok P (heap S1) TException ex \\ ex \\ null\"\n using op2 unfolding corr_def is_except_ok_def TException_def by simp\n show ?thesis proof (cases \"i < length ch\")\n case True\n define T where \"T \\ ((chtype h),({}::(iname set)))\"\n then have \\'_def: \"\\' \\ \\(var \\ (T))\" using intermediate by simp\n (* Show S2 (start of catch handler) to be type-correct *)\n have b1: \"(ttype T,var,chstmt h) \\ (set ch)\" \n using T_def op7 True by simp\n then have b2: \"P M \\' \\ chstmt h \\ \\ \\is_cap_type P (ttype T)\"\n using a1 b1 unfolding \\'_def T_def by auto\n have \"ex = (href a)\"\n using op3 a3 TException_def by (metis \\.simps(5) fst_conv is_value_ok_num the_href.simps(1) v.exhaust)\n moreover have \"(P \\ ClassT (HClass exObj) <: (ttype T))\" \n using minimum_list_item op6 op7 True unfolding T_def by fastforce \n moreover have \"(tlabel T = tlabel TException)\"\n unfolding TException_def T_def by fastforce \n moreover have \"\\is_cap_type P (ttype TException)\"\n unfolding TException_def T_def by fastforce \n ultimately have \"is_value_ok P (heap S1) T ex\"\n using is_value_ok_valid_object_cast a3 op4 b2 by simp \n then have \"is_value_ok P (heap S1) (intersect_label T (privs S1)) ex\"\n unfolding T_def intersect_label_def by simp\n then have \"P M \\' \\<^bold>\\ (S1\\ stack := (stack S1)(var \\ ex)\\)\"\n using a2 stack_update_ok \\'_def by simp\n then have b3: \"P M \\' \\<^bold>\\ S2\"\n using op7 True unfolding corr_def is_except_ok_def var_corr_def by simp\n (* apply induction hypothesis (for execution of catch handler) *)\n then have b4: \"(P M \\' \\<^bold>\\ S3) \\ transition_ok S2 S3\"\n using b2 op7 True by metis\n (* show restoring local variable var after execution of catch handler OK *)\n moreover have b5: \"transition_ok S1 S2\"\n using op7 True using transition_ok_simple by auto\n ultimately have \"transition_ok S1 S3\"\n using transition_ok_trans b4 by metis\n then have \"(P M \\ \\<^bold>\\ S')\"\n using stack_variable_restore a2 b4 \\'_def op7 True by metis\n moreover have \"transition_ok S3 S'\"\n using op7 True using transition_ok_simple by auto\n ultimately show ?thesis using True a2 b2 b3 b4 b5 transition_ok_trans by blast\n next\n case False\n then show ?thesis using a2 op7 transition_ok_self by simp\n qed\nqed\n\n\nlemma preservation_stmt_trycatch_ex:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"except S1 = Some ex\"\n assumes op3: \"a = the_href ex\"\n assumes op4: \"exObj = the (heap S1 a)\"\n assumes op5: \"P \\ \\s | S\\ \\\\<^sub>s \\S1\\\"\n assumes op6: \"i = Min {j::nat. (j = length ch) \\ ((j < length ch) \\ (P \\ (ClassT (HClass exObj)) <: (chtype (ch !j)))) }\"\n assumes op7: \"if i < length ch\n then h = ch ! i \\\n var = chvar h \\\n S2 = S1\\except := None, stack := (stack S1)(var \\ ex)\\ \\\n ((P \\ \\chstmt h | S2\\ \\\\<^sub>s \\S3\\) \\ (\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ chstmt h \\)\n \\ (P M \\ \\<^bold>\\ S3) \\ transition_ok S2 S3)) \\ \n S' = S3\\stack := (stack S3)(var := stack S1 var)\\\n else S' = S1\"\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ trycatch s ch \\\"\n shows \"(P M \\ \\<^bold>\\ S') \\ transition_ok S S'\"\nproof -\n define \\' where \"\\' = \\(var \\ ((chtype h),{}))\"\n then have a1: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\\n (i < length ch \\ (P M \\' \\<^bold>\\ S2) \\ transition_ok S1 S2 \\\n (P M \\' \\<^bold>\\ S3) \\ transition_ok S2 S3 \\ transition_ok S3 S') \\\n (P M \\ \\<^bold>\\ S') \\ transition_ok S1 S'\"\n using \\'_def preservation_stmt_trycatch_ex_helper assms by blast\n then show ?thesis using transition_ok_trans by blast\nqed\n\nlemma preservation:\n assumes wfp: \"wf_prog P\"\n shows \"((P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\) \\ (\\M \\ T. ((P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T)) \\ ((P M \\ \\<^bold>\\ S') \\ (transition_ok S S') \\ (is_expr_value_ok P S' T v))))\n \\ ((P \\ \\s | S\\ \\\\<^sub>s \\S'\\) \\ (\\M \\. ((P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\)) \\ ((P M \\ \\<^bold>\\ S') \\ (transition_ok S S'))))\"\nproof (induction S S' rule: op_expr_op_stmt.induct)\n case (op_expr_ref v S x)\n then show ?case using preservation_expr_ref wfp by blast \nnext\n case (op_expr_new v l S S' cname lname)\n then show ?case using preservation_expr_new wfp by metis\nnext\n case (op_expr_calli a S x l obj d m mname s S0 args S1 S' v)\n then show ?case using preservation_expr_calli assms by force\nnext\n case (op_expr_calls d m c mname s S0 S args S1 S' v)\n then show ?case using preservation_expr_calls assms by force\nnext\n case (op_expr_cast e S v S' hobj t)\n then show ?case using preservation_expr_cast wfp by blast\nnext\n case (op_expr_const k v S)\n then show ?case using preservation_expr_const by blast\nnext\n case (op_expr_fieldacci a S x l obj v f)\n then show ?case using preservation_expr_fieldacci assms by force\nnext\n case (op_expr_fieldaccs classStatics S c v f)\n then show ?case using preservation_expr_fieldaccs wfp by force\nnext\n case (op_expr_wrap e S v S' cbname)\n then show ?case using preservation_expr_wrap wfp by blast\nnext\n case (op_stmt_assign S e v S1 S' x)\n then show ?case using preservation_stmt_assign by blast\nnext\n case (op_stmt_assignfi S e v S1 a x l obj S' f)\n then show ?case using preservation_stmt_assignfi assms by blast\nnext\n case (op_stmt_assignfs S e v S1 classStatics c S' f)\n then show ?case using preservation_stmt_assignfs assms by blast\nnext\n case (op_stmt_expr S e v S')\n then show ?case using wf_stmt_expr_intro by blast\nnext\n case (op_stmt_then S v x s1 S1 s2)\n then show ?case using wf_stmt_ifelse_intro by blast\nnext\n case (op_stmt_else S v x s2 S2 s1)\n then show ?case using wf_stmt_ifelse_intro by blast\nnext \n case (op_stmt_letin S e v S1 S2 x s S3 S' T)\n then show ?case using preservation_stmt_letin by blast\nnext\n case (op_stmt_return S e v S1 S')\n then show ?case using preservation_stmt_return by blast\nnext\n case (op_stmt_seq S s1 S1 s2 S2)\n then show ?case using wf_stmt_seq_intro transition_ok_trans by blast\nnext\n case (op_stmt_throw S e v S1 S')\n then show ?case using preservation_stmt_throw by blast\nnext \n case (op_stmt_trycatch_ok S s S1 S' catchhandlers)\n then show ?case using wf_stmt_trycatch_intro by blast\nnext\n case (op_stmt_trycatch_ex S s S1 ex a exObj i ch h var S2 S3 S')\n then show ?case using preservation_stmt_trycatch_ex by blast\nnext\n case (op_stmt_exception_or_return S s)\n then show ?case using transition_ok_self by simp\nqed (* [where ?x1.0 = e and ?x3.0 = v and ?x5.0 = s] *)\n\nend", "meta": {"author": "patrickmeiring", "repo": "JavaCap", "sha": "43ded44673c45d596b6a399ef24292416591520b", "save_path": "github-repos/isabelle/patrickmeiring-JavaCap", "path": "github-repos/isabelle/patrickmeiring-JavaCap/JavaCap-43ded44673c45d596b6a399ef24292416591520b/javacap_operational.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.3242354120407358, "lm_q1q2_score": 0.19702591825274726}} {"text": "theory Seq \n\nimports \"../../Syntax/Gensyn\" \"../../Syntax/Gensyn_Descend\" \"../../Mergeable/Mergeable\"\n \"../../Mergeable/Mergeable_Instances\"\n \"../../Lifter/Lifter\" \"../../Lifter/Lifter_Instances\"\n \"../../Lifter/Auto_Lifter\" \"../../Lifter/Auto_Lifter_Proofs\" \n \"../../Semantics/Semantics\" \n \"../Utils\"\n\nbegin\n\n(*\n * Implementation of sequencing as a language component in Gazelle.\n *)\n\ndatatype syn =\n Sseq\n | Sskip\n\ntype_synonym 'x state' = \"'x gensyn list\"\n\ndefinition seq_sem :: \"syn \\ 'x state' \\ 'x state'\" where\n\"seq_sem x st =\n (case st of [] \\ []\n | (G s l)#t \\\n (case x of\n Sskip \\ t\n | Sseq \\ l@t))\"\n\ntype_synonym ('s, 'x) state = \n \"('s, 'x) control\"\n\n(* concrete state *)\ntype_synonym 's cstate = \"('s, unit option) state\"\n\n(* We define a lifting here to show how Seq overlaps with the standard control-flow\n * constructs\n *)\n\n(* TODO: the auto-lifter seems to sometimes struggle a bit when one of the types involved\n * is a type variable (e.g. 'x state'), but it works in this case. Should figure out\n * to what extent this is an issue or just a usability bug (or even just a matter\n * of terrible error messages making it hard to see what's going on) *)\n\ndefinition seq_sem_lifting_schem1 where\n \"seq_sem_lifting_schem1 = NC \"\n\ndefinition seq_sem_lifting_schem2 where\n\"seq_sem_lifting_schem2 = (SP (SPRI (SO NC)) NX)\"\n\nfun seq_prio :: \"syn \\ nat\" where\n\"seq_prio _ = 2\"\n\ndefinition seq_sem_lifting_gen :: \"(syn, 'x state', ('x, 'a :: Pordb) control) lifting\"\n where\n\"seq_sem_lifting_gen = schem_lift\n NC (SP (SPRC seq_prio (SO NC)) NX) \"\n\n(* alternate definition that doesn't rely on auto lifter *)\ndefinition seq_sem_lifting' :: \"(syn, 'x state', 'x state' md_triv option md_prio) lifting\"\n where\n\"seq_sem_lifting' =\n (prio_l (\\ _ . 0) (\\ _ z . 2 + z) (option_l (triv_l)))\"\n\nlemma fst_l_S_univ : \n \"(fst_l_S (\\ _ . UNIV)) = (\\ _ . UNIV)\"\n unfolding fst_l_S_def\n by(blast)\n\nlemma seq_sem_lifting_gen_valid :\n \"lifting_valid_base_ok (seq_sem_lifting_gen :: (syn, 'x state', ('x, _ :: Pordb) control) lifting) \n (schem_lift_S seq_sem_lifting_schem1 seq_sem_lifting_schem2)\" unfolding seq_sem_lifting_gen_def seq_sem_lifting_schem1_def seq_sem_lifting_schem2_def\n unfolding seq_sem_lifting'_def schem_lift_defs schem_lift_S_defs\n by(fastforce intro: lifting_valid_fast)\n\nlemma seq_sem_lifting_gen_valid' :\n \"lifting_valid_ok (seq_sem_lifting_gen :: (syn, 'x state', ('x, _ :: Pordb) control) lifting) \n (schem_lift_S seq_sem_lifting_schem1 seq_sem_lifting_schem2)\" unfolding seq_sem_lifting_gen_def seq_sem_lifting_schem1_def seq_sem_lifting_schem2_def\n unfolding seq_sem_lifting'_def schem_lift_defs schem_lift_S_defs\n by(fastforce intro: lifting_valid_fast)\n\ndefinition seq_sem_l_gen ::\n \"('s \\ syn) \\\n 's \\ (('x, 'y :: Pordb) control) \\ (('x, 'y :: Pordb) control)\" where\n\"seq_sem_l_gen lfts =\n lift_map_s lfts\n seq_sem_lifting_gen\n seq_sem\"\n\n\ndefinition seq_semx :: \n\"('s \\ syn) \\\n ('s, 'x, 'z :: Pordb) sem\" where\n\"seq_semx lfts \\ seq_sem_l_gen lfts\"\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Language_Components/Seq/Seq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.1969659356847176}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__4_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__4_on_rules imports n_german_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__4) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.3451052574867685, "lm_q1q2_score": 0.19665914095369985}} {"text": "theory func_cor_OSMboxAccept\n imports func_cor_lemma\nbegin\n\nlemma OSMboxAccept_pre_stable:\" stable (OSMboxAccept_pre t) (OSMboxAccept_rely t) \"\n by(simp add:OSMboxAccept_pre_def OSMboxAccept_rely_def stable_def gvars_conf_stable_def gvars_conf_def)\n\nlemma OSMboxAccept_pre_stable1:\" stable (OSMboxAccept_pre t \\ \\pevent \\ \\OSMailBoxs\\) (OSMboxAccept_rely t) \"\n by(simp add:OSMboxAccept_pre_def OSMboxAccept_rely_def stable_def gvars_conf_stable_def gvars_conf_def)\n\n\nlemma OSMboxAccept_post_stable:\" stable (OSMboxAccept_post t) (OSMboxAccept_rely t) \"\n by(simp add:OSMboxAccept_post_def OSMboxAccept_rely_def stable_def)\n\nlemma mylist_nhd_in_tl: \"dist_list l \\ hd l \\ set (tl l) \"\n by (meson dist_hd_nin_tl distinct_conv_nth)\n\nlemma mylist_hd_in_list: \"l \\ [] \\hd l \\ set l\"\n by auto\n\nlemma OSMboxAccept_satRG_h1:\"\n \\\\<^sub>I (W\\get_msg := \\get_msg(t := msgPtr (\\OSMailbox_info pevent));;\n \\OSMailbox_info := \\OSMailbox_info\n (pevent :=\n msgPtr_update Map.empty\n (\\OSMailbox_info\n pevent))) sat\\<^sub>p [OSMboxAccept_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\cur = Some t\\ \\\n {V}, {(x, y). x = y}, UNIV, \\\\(Pair V) \\ OSMboxAccept_guar t\\ \\ OSMboxAccept_post t]\"\n\napply(case_tac \"OSMboxAccept_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\cur = Some t\\ \\\n {V} = {}\")\n apply auto\n apply(simp add:Emptyprecond) \n apply(simp add:Emptyprecond) \n apply(simp add:Emptyprecond)\n\n apply(rule Seq[where mid = \"{V\\get_msg := (get_msg V)(t := msgPtr (OSMailbox_info V pevent))\\}\"])\n apply(rule Basic)\n apply auto \n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\n apply(simp add:OSMboxAccept_pre_def OSMboxAccept_guar_def gvars_conf_stable_def gvars_conf_def)\n apply auto\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto[1]\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxAccept_post_def inv_def inv_cur_def inv_thd_waitq_def OSMboxAccept_pre_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\n\n\nlemma OSMboxAccept_satRG: \"\\ (OSMboxAccept t pevent) \\ OSMboxAccept_RGCond t\"\n apply (simp add:Evt_sat_RG_def)\n apply (simp add:OSMboxAccept_def OSMboxAccept_RGCond_def)\n apply(simp add:body_def Pre\\<^sub>f_def Post\\<^sub>f_def guard_def\n Rely\\<^sub>f_def Guar\\<^sub>f_def getrgformula_def)\n apply(unfold stm_def)\n apply (rule BasicEvt)\n apply(simp add:body_def guard_def)\n apply(rule Await)\n apply(simp add:OSMboxAccept_pre_stable1)\n apply(simp add: OSMboxAccept_post_stable) \n apply auto\n apply(rule Await)\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply auto\napply(case_tac \"{V} \\ {Va}={}\")\n apply auto\n apply(simp add:Emptyprecond) (* satRG_h1*)\n apply(simp add:OSMboxAccept_satRG_h1)\n apply(simp add:OSMboxAccept_pre_stable)\n apply(simp add:OSMboxAccept_guar_def)\n done\n\nend", "meta": {"author": "zerrymore", "repo": "Verified-Mailbox", "sha": "778ac0f3b87f342e02dd4a6ad86abeb32be82d42", "save_path": "github-repos/isabelle/zerrymore-Verified-Mailbox", "path": "github-repos/isabelle/zerrymore-Verified-Mailbox/Verified-Mailbox-778ac0f3b87f342e02dd4a6ad86abeb32be82d42/PiCore-SIMP-mailbox/func_cor_OSMboxAccept.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.3522017956470284, "lm_q1q2_score": 0.19664376996312716}} {"text": "theory SmallStep\nimports\n \"~~/src/HOL/IMP/Star\"\n \"~~/src/HOL/Library/While_Combinator\"\n Stack CFG\nbegin\n \n definition lift :: \"(valuation \\ memory \\ memory) \\ state \\ state\"\n where \"lift f \\ \\(stk,\\,\\). do {\n let ev = comp_evs stk \\;\n \\ \\ f ev \\;\n return (stk,\\,\\)\n }\"\n\n definition lift' :: \"(valuation \\ memory \\ 'a) \\ state \\ 'a\" \n where \"lift' f \\ \\(stk,\\,\\). f (comp_evs stk \\) \\\"\n\n definition to_rval' :: \"state \\ res \\ val\" where\n \"to_rval' \\ \\(stk,\\,\\) r. to_rval \\ r\"\n\n definition to_bool_aux' :: \"state \\ val \\ bool\" where\n \"to_bool_aux' \\ \\(stk,\\,\\) r. to_bool_aux \\ r\"\n \n\n definition eval_exp' :: \"state \\ exp \\ res\" where\n \"eval_exp' \\ \\s e. lift' (\\ev \\. eval_exp ev \\ e) s\"\n\n lemma eval_exp'_alt: \"eval_exp' = (\\(stk,\\,\\) e. eval_exp (comp_evs stk \\) \\ e)\"\n by (auto simp: eval_exp'_def lift'_def)\n\n primrec basic_effect :: \"bcom \\ valuation \\ memory \\ memory\" where\n \"basic_effect (bcom.Assign l r) ev \\ = do {\n l \\ eval_exp ev \\ l;\n l \\ to_lval l;\n r \\ eval_exp ev \\ r;\n r \\ to_rval \\ r;\n \\ \\ eset (l_addr l) r \\;\n return \\\n }\"\n | \"basic_effect (bcom.Malloc e1 T e2) ev \\ = do {\n e1 \\ eval_exp ev \\ e1;\n e1 \\ to_lval e1;\n e2 \\ eval_exp ev \\ e2;\n e2 \\ to_int \\ e2;\n let e2 = sint e2;\n assert (e2\\0) overflow_error; (* Note: calloc asserts positive size *)\n (addr,\\) \\ calloc T False (nat e2) \\;\n \\ \\ eset (l_addr e1) (val.Addr addr) \\;\n return \\\n }\" \n | \"basic_effect (bcom.Free e) ev \\ = do {\n e \\ eval_exp ev \\ e;\n e \\ to_ptr \\ e;\n \\ \\ free False e \\;\n return \\\n }\" \n\n term eval_exp \n\n definition lookup_fun :: \"program \\ fname \\ fun_decl\" where\n \"lookup_fun p f \\ elookup (\\_. type_error) (mk_fun_map p) f\"\n\n definition eval_args :: \"exp list \\ valuation \\ memory \\ val list\" where\n \"eval_args args ev \\ \\ emap (eval_exp ev \\ #> to_rval \\) args\"\n\n abbreviation \"eval_args' args \\ lift' (eval_args args)\"\n\n\n primrec func_effect :: \"program \\ fcom \\ state \\ state\" where\n \"func_effect p (fcom.Return e) s = do {\n e \\ eval_exp' s e;\n op_return (Some e) s\n }\"\n | \"func_effect p (fcom.Returnv) s = do {\n op_return None s\n }\"\n | \"func_effect p (fcom.Callfun e f args) s = do {\n fd \\ lookup_fun p f;\n e \\ eval_exp' s e;\n e \\ to_lval e;\n args \\ eval_args' args s;\n op_call (Some e) fd args s\n }\" \n | \"func_effect p (fcom.Callfunv f args) s = do {\n fd \\ lookup_fun p f;\n args \\ eval_args' args s;\n op_call None fd args s\n }\" \n \n primrec effect :: \"program \\ effect \\ state \\ state\" where\n \"effect p (effect.Basic c) s = lift (basic_effect c) s\" \n | \"effect p (effect.Func c) s = func_effect p c s\" \n | \"effect p (effect.Skip) s = return s\"\n\n primrec eval_guard :: \"guard \\ state \\ bool\" where\n \"eval_guard (guard.Pos e) s = do {\n b \\ eval_exp' s e;\n b \\ (to_rval' s #> to_bool_aux' s) b;\n return b\n }\" \n | \"eval_guard (guard.Neg e) s = do {\n b \\ eval_exp' s e;\n b \\ (to_rval' s #> to_bool_aux' s) b;\n return (\\b)\n }\"\n \n fun com_of :: \"state \\ com option\" where\n \"com_of ((_,c,_,_)#_,_,_) = Some c\"\n | \"com_of _ = None\" \n\n fun upd_com :: \"com \\ state \\ state\" where\n \"upd_com c ((fd,_,l,r)#stk,\\,\\) = ((fd,c,l,r)#stk,\\,\\)\"\n | \"upd_com c ([],_,_) = undefined\" \n\n inductive small_step :: \"program \\ state \\ state ce \\ bool\" for p where\n ss_effect: \"\\ com_of s = Some c; cfg c (label.Effect e) c'; s' = effect p e (upd_com c' s) \\ \\ small_step p s s'\"\n | ss_guard: \"\\ com_of s = Some c; cfg c (label.Guard g) c'; eval_guard g s = return True \\ \\ small_step p s (return ((upd_com c' s)))\"\n | ss_failed_guard: \"\\ com_of s = Some c; cfg c (label.Guard g) c'; eval_guard g s = EAssert e \\ \\ small_step p s (EAssert e)\"\n | ss_return_void: \"\\ com_of s = Some com.Skip; s' = op_return None s \\ \\ small_step p s s'\"\n\n\n \n\n lemma [simp]: \"is_nonterm (eset (l1 o\\<^sub>l l2) b a) \\ is_nonterm (eget l1 a) \\ \n (\\y. is_res (eget l1 a) y \\ (is_nonterm (eset l2 b y) \\ (\\ya. is_res (eset l2 b y) ya \\\n is_nonterm (eset l1 ya a))))\" \n unfolding ecompose_def\n by auto\n\n \n lemma no_nonterm_espec_conv: \"\\is_nonterm m \\ e_spec (\\_. True) (\\_. True) False m\" \n by (simp add: pw_espec_iff)\n\n lemma [simp]: \"\\is_nonterm (eget (l_C1_lens isC theC C e) v)\"\n unfolding l_C1_lens_def by auto\n\n lemma [simp]: \"\\is_nonterm (eset (l_C1_lens isC theC C e) b a)\"\n unfolding l_C1_lens_def by auto\n\n lemma [simp]: \"\\is_nonterm (cnv_array_to_eptr \\ addr)\" \n by (auto simp: cnv_array_to_eptr_def split: prod.splits)\n\n lemma [simp]: \"\\is_nonterm (to_rval \\ v)\" by (cases v) (auto)\n\n lemma [simp]: \"\\is_nonterm (to_int_aux x)\"\n by (cases x) auto\n\n lemma [simp]: \"\\is_nonterm (to_bool_aux \\ x)\"\n by (cases x) auto\n\n lemma [simp]: \"\\is_nonterm (to_int \\ x)\" \n by (auto simp: to_int_def)\n\n lemma [simp]: \"\\is_nonterm (ref_op x)\" \n by (cases x) auto\n\n lemma [simp]: \"\\is_nonterm (elookup E m x)\"\n by (auto simp: elookup_def split: option.split) \n\n lemma [simp]: \"\\is_nonterm (memb_op \\ name r)\" \n by (cases \"(name,r)\" rule: memb_op.cases) \n (auto simp: memb_addr_def l_raw_mem_def l_nth_def \n memb_subpath_def Let_def)\n\n lemma [simp]: \"\\is_nonterm (to_ptr \\ v)\" \n by (auto simp: to_ptr_def split: val.splits)\n\n lemma [simp]: \"\\is_nonterm (deref_op ev y)\" \n by (auto simp: deref_op_def split: val.splits)\n\n lemma [simp]: \"\\is_nonterm (membp_op \\ name r)\" \n by (auto simp: memb_addr_def l_raw_mem_def l_nth_def \n memb_subpath_def Let_def membp_op_def)\n\n lemma [simp]: \"\\is_nonterm (eval1 ev op1 x1)\"\n apply (induction op1) \n apply (auto split: option.splits\n simp: un_arith_op_def iop_uminus_def iop_Not_def iop_BNot_def)\n done\n\n lemma [simp]: \"\\is_nonterm (index_addr \\ i addr)\" \n by (auto simp: index_addr_def l_raw_mem_def l_nth_def \n index_subpath_def resolve_subpath_array_def l_last_def l_butlast_def Let_def\n split: split_if_asm prod.splits)\n\n lemma [simp]: \"\\is_nonterm (plus_op \\ x1 x2)\" \n apply (cases \"(x1,x2)\" rule: plus_op.cases)\n apply (auto simp: iop_plus_def)\n done\n\n lemma [simp]: \"\\is_nonterm (minus_op \\ x1 x2)\" \n apply (cases \"(x1,x2)\" rule: minus_op.cases)\n apply (auto simp: l_raw_mem_def l_nth_def \n index_subpath_def resolve_subpath_array_def l_last_def l_butlast_def Let_def\n iop_minus_def diff_addr_def diff_subpath_def\n split: split_if_asm)\n done\n\n lemma [simp]: \"\\is_nonterm (index_op ev x1 x2)\" \n by (auto simp: index_op_def split: res.splits val.splits)\n\n lemma [simp]: \"\\is_nonterm (compare_addr \\ x1 x2)\" \n by (auto simp: compare_addr_def split: prod.splits list.splits subscript.splits)\n\n lemma [simp]: \"\\is_nonterm (less_op \\ x1 x2)\" \n apply (induction x1 x2 rule: less_op.induct)\n apply (auto simp: addr_less_def iop_less_def split: ptr_comp_res.splits)\n done\n\n lemma [simp]: \"\\is_nonterm (le_op \\ x1 x2)\" \n apply (induction x1 x2 rule: le_op.induct)\n apply (auto simp: addr_leq_def iop_le_def split: ptr_comp_res.splits)\n done\n\n lemma [simp]: \"\\is_nonterm (eq_op \\ x1 x2)\" \n apply (induction x1 x2 rule: eq_op.induct)\n apply (auto simp: iop_eq_def addr_eq_def split: split_if_asm ptr_comp_res.splits)\n done\n\n lemma [simp]: \"\\is_nonterm (eval2 ev op2 x1 x2)\"\n apply (induction op2) \n apply (auto split: option.splits \n simp: rvop2_def bin_arith_op_def\n simp: iop_mult_def iop_div_def iop_mod_def iop_less_def iop_le_def iop_eq_def\n iop_And_def iop_Or_def iop_BAnd_def iop_BOr_def iop_BXor_def)\n done\n\n\n lemma [simp]: \"\\is_nonterm (eval_exp ev \\ e)\"\n apply (induction e)\n apply auto\n done\n\n lemma [simp]: \"\\is_nonterm (to_lval x)\" \n by (cases x) (auto)\n\n lemma [simp]: \"\\is_nonterm (free allow_static addr \\)\" \n by (auto simp: Let_def free_def raw_free_def split: prod.splits)\n\n lemma [simp]: \"\\is_nonterm (alloc T static \\)\" \n by (auto simp: alloc_def raw_alloc_def)\n\n lemma [simp]: \"\\is_nonterm (calloc T static n \\)\" \n by (auto simp: calloc_def raw_alloc_def)\n\n lemma effect_term[simp]: \"\\is_nonterm (effect p e s)\"\n apply (cases e; simp)\n apply (rename_tac be; case_tac be; auto simp add: lift_def Let_def split: prod.splits)\n apply (rename_tac fe; case_tac fe; auto simp: eval_exp'_def \n simp: op_return_def lookup_fun_def Let_def assign_return_value_def\n simp: destroy_frame_def to_rval'_def op_call_def create_frame_def\n alloc_params_def cp_alloc_def raw_alloc_def alloc_vdecls_def lift'_def eval_args_def\n dest!: efold_nontermD emap_nontermD\n split: prod.splits option.splits)\n done \n \n fun is_empty_stack :: \"state \\ bool\" where\n \"is_empty_stack (stk,_) \\ stk=[]\"\n\n lemma eval_guard_conv: \"eval_guard (guard.Pos b) s = return bv \n \\ eval_guard (guard.Neg b) s = return (\\bv)\" \n apply (simp add: eval_guard_def)\n apply (simp split: Error_Monad.bind_split)\n done\n\n lemma small_step_stuck_empty_aux: \n \"\\s'. small_step p ((fd,c,l,r)#stk,\\,\\) s'\" (is \"\\_. small_step p ?s _\")\n proof (cases c rule: cfg_outgoing_cases[case_names Skip Effect Guard])\n case Skip thus ?thesis by (auto intro!: ss_return_void)\n next \n case (Effect e c')\n hence C: \"cfg c (label.Effect e) c'\"\n by (auto simp: cfg_outgoing_def)\n from ss_effect[OF _ C refl] show ?thesis by force\n next \n case (Guard b c1 c2)\n hence CP: \"cfg c (label.Guard (guard.Pos b)) c1\" and\n CN: \"cfg c (label.Guard (guard.Neg b)) c2\"\n by (auto simp: cfg_outgoing_def)\n \n show ?thesis proof (cases \"eval_guard (guard.Pos b) ?s\")\n case (return bv)\n show ?thesis proof (cases bv) \n case True \n from ss_guard[OF _ CP return[simplified True]]\n show ?thesis by auto\n next\n case False\n with return have \"eval_guard (guard.Neg b) ?s = return True\"\n by (simp add: eval_guard_conv del: eval_guard.simps)\n from ss_guard[OF _ CN this]\n show ?thesis by auto\n qed\n next \n case (EAssert e) \n from ss_failed_guard[OF _ CP this]\n show ?thesis by auto\n next \n case ENonterm hence \"is_nonterm (eval_guard (guard.Pos b) ?s)\" by simp\n hence False by (auto simp: eval_guard_def eval_exp'_alt to_rval'_def to_bool_aux'_def)\n thus ?thesis ..\n qed \n qed \n\n \n theorem ss_stuck_empty: \"\\(\\s'. small_step p s s') \\ is_empty_stack s\"\n -- \\Execution only gets stuck at empty stack\\\n apply (cases s rule: com_of.cases)\n apply (auto elim: small_step.cases simp: small_step_stuck_empty_aux)\n done\n\n corollary ss_imp_no_empty: \"small_step \\ s s' \\ \\is_empty_stack s\"\n using ss_stuck_empty[of \\ s] by auto\n\n\n definition ss_step :: \"program \\ state \\ state\" where\n \"ss_step p s \\ do {\n let c = the (com_of s);\n if c=com.Skip then\n op_return None s\n else\n case cfg_step c of \n edge.Effect e c' \\ do {\n let s = upd_com c' s;\n s \\ effect p e s;\n return s\n }\n | (edge.Cond b c1 c2) \\ do {\n b \\ eval_exp' s b;\n b \\ (to_rval' s #> to_bool_aux' s) b;\n if b then return (upd_com c1 s) else return (upd_com c2 s)\n }\n }\"\n\n lemma [simp]: \"eval_exp' s e \\ ENonterm\" \n by (simp add: pw_nt_iff eval_exp'_alt split: prod.splits)\n\n lemma [simp]: \"to_rval' s v \\ ENonterm\" \n by (simp add: pw_nt_iff to_rval'_def split: prod.splits)\n \n lemma [simp]: \"to_int_aux v \\ ENonterm\" \n by (simp add: pw_nt_iff split: prod.splits)\n\n lemma [simp]: \"to_bool_aux \\ v \\ ENonterm\" \n by (simp add: pw_nt_iff split: prod.splits)\n\n\n lemma small_step_iff_ss_step: \"\\is_empty_stack s \\ small_step p s s' \\ ss_step p s = s'\" \n apply (rule iffI)\n apply (auto elim!: cfg2step small_step.cases) []\n apply (auto simp: ss_step_def) []\n apply (simp add: ss_step_def pw_eq_iff; metis) []\n apply (simp add: ss_step_def pw_eq_iff; metis) []\n apply (simp add: ss_step_def pw_eq_iff; metis) []\n apply (simp add: ss_step_def pw_eq_iff; metis) []\n apply (auto simp: ss_step_def) []\n\n apply hypsubst\n apply (thin_tac \"s'=_\")\n apply (cases s rule: com_of.cases; simp)\n apply (clarsimp simp: ss_step_def\n simp del: cfg_step.simps\n split: edge.splits; safe)\n apply (auto simp del: cfg_step.simps intro: ss_return_void) []\n apply (auto simp del: cfg_step.simps intro: ss_effect step2cfg1) []\n apply (auto simp del: cfg_step.simps intro: ss_return_void) []\n\n apply (drule (1) step2cfg2; clarsimp) \n apply (auto simp: small_step.simps to_bool_aux'_def split: Error_Monad.bind_splits)\n done\n\n\n export_code ss_step checking SML\n\n\n subsection \\Executions\\\n context fixes p :: program begin\n\n text \\We lift our definition of small step to state option in order to be able to take\n more than one step in the semantics.\\\n inductive\n small_step' :: \"(state) ce \\ (state) ce \\ bool\"\n where\n \"small_step p s s' \\ small_step' (return s) s'\"\n \n abbreviation\n small_steps :: \"(state) ce \\ (state) ce \\ bool\"\n where \"small_steps x y == star small_step' x y\"\n\n\n text \\A state is considered final if the stack in that state is empty or if it's an error state.\\\n fun is_term :: \"state ce \\ bool\" where\n \"is_term (return s) = is_empty_stack s\"\n | \"is_term _ = True\"\n\n text \\Final states are exactly the states where the semantics is stuck\\\n lemma is_term_no_step: \"is_term s \\ \\(\\s'. small_step' s s')\"\n apply (cases s)\n using ss_stuck_empty[symmetric]\n apply (auto simp: small_step'.simps)\n done\n \n lemma not_is_term_conv: \"\\is_term ss \\ (\\s. ss=return s \\ \\is_empty_stack s)\"\n apply (cases ss) by auto \n\n definition yields :: \"state \\ state ce \\ bool\" \n -- \\Final state of execution from start state\\\n where\n \"yields s s' \\ small_steps (return s) s' \\ is_term s'\"\n\n definition terminates :: \"state \\ bool\" where\n \"terminates s \\ \\s'. yields s s'\"\n\n\n partial_function (error) interp where \"\n interp s = (\n if is_term (return s) then\n return s\n else do {\n s \\ ss_step p s;\n interp s\n }\n )\"\n\n lemmas [code] = interp.simps \n\n lemma [simp]: \"small_steps (EAssert e) s' \\ s'=EAssert e\"\n by (auto elim: star.cases simp: small_step'.simps)\n\n lemma [simp]: \"\\is_nonterm (op_return v s)\"\n by (auto simp: \n simp: op_return_def Let_def assign_return_value_def\n simp: destroy_frame_def to_rval'_def \n dest!: efold_nontermD \n split: prod.splits option.splits edge.splits)\n\n lemma [simp]: \"\\is_nonterm (ss_step p s)\"\n by (auto simp: ss_step_def eval_exp'_alt\n simp: lookup_fun_def Let_def \n simp: to_rval'_def op_call_def create_frame_def\n alloc_params_def cp_alloc_def raw_alloc_def alloc_vdecls_def\n to_bool_aux'_def\n split: prod.splits option.splits edge.splits)\n\n lemma [simp]: \"ss_step p s \\ ENonterm\"\n by (simp add: pw_nt_iff) \n\n lemma yields_interp_aux: \"yields s s' \\ interp s = s'\"\n proof - \n assume \"yields s s'\"\n hence \"small_steps (return s) s'\" \"is_term s'\" unfolding yields_def by auto\n thus \"interp s = s'\"\n apply (induction \"(return s)::_ ce\" s' arbitrary: s rule: star.induct)\n apply (subst interp.simps; simp)\n apply (subst interp.simps; auto simp: small_step'.simps)\n apply (meson is_empty_stack.simps is_term.simps(1) is_term_no_step small_step'.intros)\n apply (subst (asm) small_step_iff_ss_step; simp)\n apply (auto split: Error_Monad.bind_splits)\n done\n qed \n\n lemma yields_interp: \"terminates s \\ yields s s' \\ s' = interp s\"\n unfolding terminates_def\n by (auto dest: yields_interp_aux)\n \n\n lemma terminates_empty: \"is_empty_stack s \\ terminates s\" \n unfolding terminates_def yields_def\n by auto\n\n lemma terminates_step_err: \n \"\\\\ is_empty_stack s; ss_step p s = EAssert e\\ \n \\ terminates s\"\n unfolding terminates_def yields_def\n apply (auto simp: small_step_iff_ss_step[symmetric])\n using SmallStep.small_step'.intros is_term.simps(2) by blast\n \n lemma terminates_step_ret: \n \"\\\\ is_empty_stack s; ss_step p s = return s'; terminates s'\\ \n \\ terminates s\"\n unfolding terminates_def yields_def\n apply (auto simp: small_step_iff_ss_step[symmetric])\n by (meson small_step'.intros star.step)\n\n\n lemma nonterm_interp: \"\\terminates s \\ interp s = ENonterm\" \n proof (rule ccontr)\n {\n fix t\n assume \"interp s = ETerm t\"\n hence \"local.terminates s\"\n apply (rule interp.raw_induct[rotated])\n apply (auto \n split: split_if_asm Error_Monad.bind_splits\n simp: terminates_empty terminates_step_err terminates_step_ret)\n done\n } moreover assume \"\\ local.terminates s\" \"local.interp s \\ ENonterm\"\n ultimately show False by (cases \"local.interp s\") auto\n qed \n\n lemma small_steps_preserve_nonterm:\n assumes \"\\is_nonterm s\" \n assumes \"small_steps s s'\"\n shows \"\\is_nonterm s'\"\n using assms(2,1)\n apply (induction rule: star.induct)\n by (auto simp: small_step'.simps small_step.simps)\n\n lemma yields_no_nonterm: \"yields s s' \\ \\is_nonterm s'\" \n unfolding yields_def using small_steps_preserve_nonterm[of \"return s\" s']\n by auto \n\n lemma interp_nonterm: \"interp s = ENonterm \\ \\terminates s\"\n using yields_no_nonterm[of s]\n by (auto simp: terminates_def pw_nt_iff dest: yields_interp_aux)\n \n theorem interp_correct: \n \"interp s = ENonterm \\ \\terminates s\" \n \"interp s \\ ENonterm \\ yields s (interp s)\"\n using nonterm_interp[of s] interp_nonterm[of s] \n apply blast\n by (metis nonterm_interp yields_interp_aux yields_no_nonterm \n is_nonterm.simps(1) terminates_def)\n\nend\n\nexport_code interp checking SML\n\n\nend\n\n", "meta": {"author": "glimonta", "repo": "thesis", "sha": "1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed", "save_path": "github-repos/isabelle/glimonta-thesis", "path": "github-repos/isabelle/glimonta-thesis/thesis-1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed/src/Semantics/SmallStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.19664376754715787}} {"text": "subsection \\Graph Rewriting\\\n\ntheory\n Rewrites\nimports\n Stuttering\nbegin\n\nfun replace_usages :: \"ID \\ ID \\ IRGraph \\ IRGraph\" where\n \"replace_usages nid nid' g = replace_node nid (RefNode nid', stamp g nid') g\"\n\nlemma replace_usages_effect:\n assumes \"g' = replace_usages nid nid' g\"\n shows \"kind g' nid = RefNode nid'\"\n using assms replace_node_lookup replace_usages.simps\n by (metis IRNode.distinct(2755))\n\nlemma replace_usages_changeonly:\n assumes \"nid \\ ids g\"\n assumes \"g' = replace_usages nid nid' g\"\n shows \"changeonly {nid} g g'\"\n using assms unfolding replace_usages.simps\n by (metis add_changed add_node_def replace_node_def)\n\nlemma replace_usages_unchanged:\n assumes \"nid \\ ids g\"\n assumes \"g' = replace_usages nid nid' g\"\n shows \"unchanged (ids g - {nid}) g g'\"\n using assms unfolding replace_usages.simps\n using assms(2) disjoint_change replace_usages_changeonly by presburger\n\n\n\nfun nextNid :: \"IRGraph \\ ID\" where\n \"nextNid g = (Max (ids g)) + 1\"\n\nlemma max_plus_one:\n fixes c :: \"ID set\"\n shows \"\\finite c; c \\ {}\\ \\ (Max c) + 1 \\ c\"\n by (meson Max_gr_iff less_add_one less_irrefl)\n\nlemma ids_finite:\n \"finite (ids g)\"\n by simp\n\nlemma nextNidNotIn:\n \"ids g \\ {} \\ nextNid g \\ ids g\"\n unfolding nextNid.simps\n using ids_finite max_plus_one by blast\n\nfun bool_to_val_width1 :: \"bool \\ Value\" where\n \"bool_to_val_width1 True = (IntVal 1 1)\" |\n \"bool_to_val_width1 False = (IntVal 1 0)\"\n\nfun constantCondition :: \"bool \\ ID \\ IRNode \\ IRGraph \\ IRGraph\" where\n \"constantCondition val nid (IfNode cond t f) g = \n replace_node nid (IfNode (nextNid g) t f, stamp g nid) \n (add_node (nextNid g) ((ConstantNode (bool_to_val_width1 val)), constantAsStamp (bool_to_val_width1 val)) g)\" |\n \"constantCondition cond nid _ g = g\"\n\nlemma constantConditionTrue:\n assumes \"kind g ifcond = IfNode cond t f\"\n assumes \"g' = constantCondition True ifcond (kind g ifcond) g\"\n shows \"g', p \\ (ifcond, m, h) \\ (t, m, h)\"\nproof -\n have ifn: \"\\ c t f. IfNode c t f \\ NoNode\"\n by simp\n then have if': \"kind g' ifcond = IfNode (nextNid g) t f\"\n using assms(1) assms(2) constantCondition.simps(1) replace_node_lookup\n by presburger\n have truedef: \"bool_to_val True = (IntVal 32 1)\"\n by auto\n from ifn have \"ifcond \\ (nextNid g)\"\n by (metis assms(1) emptyE ids_some nextNidNotIn)\n moreover have \"\\ c. ConstantNode c \\ NoNode\" by simp\n ultimately have \"kind g' (nextNid g) = ConstantNode (bool_to_val_width1 True)\"\n using add_changed add_node_def assms(1) assms(2) constantCondition.simps(1) not_in_g other_node_unchanged replace_node_def replace_node_lookup singletonD\n by (smt (z3) find_new_kind replace_node_unchanged)\n then have c': \"kind g' (nextNid g) = ConstantNode (IntVal 1 1)\"\n using truedef by simp\n have \"valid_value (IntVal 1 1) (constantAsStamp (IntVal 1 1))\"\n unfolding constantAsStamp.simps valid_value.simps\n using nat_numeral by force \n then have \"[g', m, p] \\ nextNid g \\ IntVal 1 1\"\n using ConstantExpr ConstantNode Value.distinct(1) \\kind g' (nextNid g) = ConstantNode (bool_to_val_width1 True)\\ encodeeval_def truedef\n by (metis bool_to_val_width1.simps(1) wf_value_def)\n from if' c' show ?thesis using IfNode\n by (metis (no_types, opaque_lifting) val_to_bool.simps(1) \\[g',m,p] \\ nextNid g \\ IntVal 1 1\\ encodeeval_def zero_neq_one)\nqed\n\nlemma constantConditionFalse:\n assumes \"kind g ifcond = IfNode cond t f\"\n assumes \"g' = constantCondition False ifcond (kind g ifcond) g\"\n shows \"g', p \\ (ifcond, m, h) \\ (f, m, h)\"\nproof -\n have ifn: \"\\ c t f. IfNode c t f \\ NoNode\"\n by simp\n then have if': \"kind g' ifcond = IfNode (nextNid g) t f\"\n by (metis assms(1) assms(2) constantCondition.simps(1) replace_node_lookup)\n have falsedef: \"bool_to_val False = (IntVal 32 0)\"\n by auto\n from ifn have \"ifcond \\ (nextNid g)\"\n by (metis assms(1) equals0D ids_some nextNidNotIn)\n moreover have \"\\ c. ConstantNode c \\ NoNode\" by simp\n ultimately have \"kind g' (nextNid g) = ConstantNode (bool_to_val_width1 False)\"\n by (smt (z3) add_changed add_node_def assms(1) assms(2) constantCondition.simps(1) find_new_kind not_in_g other_node_unchanged replace_node_def singletonD)\n then have c': \"kind g' (nextNid g) = ConstantNode (IntVal 1 0)\"\n using falsedef by simp\n have \"valid_value (IntVal 1 0) (constantAsStamp (IntVal 1 0))\"\n unfolding constantAsStamp.simps valid_value.simps\n using nat_numeral by force\n then have \"[g', m, p] \\ nextNid g \\ IntVal 1 0\"\n by (meson ConstantExpr ConstantNode c' encodeeval_def wf_value_def)\n from if' c' show ?thesis using IfNode\n by (metis (no_types, opaque_lifting) val_to_bool.simps(1) \\[g',m,p] \\ nextNid g \\ IntVal 1 0\\ encodeeval_def)\nqed\n\nlemma diff_forall:\n assumes \"\\n\\ids g - {nid}. cond n\"\n shows \"\\n. n \\ ids g \\ n \\ {nid} \\ cond n\"\n by (meson Diff_iff assms)\n\nlemma replace_node_changeonly:\n assumes \"g' = replace_node nid node g\"\n shows \"changeonly {nid} g g'\"\n using assms replace_node_unchanged\n unfolding changeonly.simps using diff_forall\n by (metis add_changed add_node_def changeonly.simps replace_node_def)\n\nlemma add_node_changeonly:\n assumes \"g' = add_node nid node g\"\n shows \"changeonly {nid} g g'\"\n by (metis Rep_IRGraph_inverse add_node.rep_eq assms replace_node.rep_eq replace_node_changeonly)\n\nlemma constantConditionNoEffect:\n assumes \"\\(is_IfNode (kind g nid))\"\n shows \"g = constantCondition b nid (kind g nid) g\"\n using assms apply (cases \"kind g nid\")\n using constantCondition.simps \n apply presburger+\n apply (metis is_IfNode_def)\n using constantCondition.simps \n by presburger+\n\nlemma constantConditionIfNode:\n assumes \"kind g nid = IfNode cond t f\"\n shows \"constantCondition val nid (kind g nid) g = \n replace_node nid (IfNode (nextNid g) t f, stamp g nid) \n (add_node (nextNid g) ((ConstantNode (bool_to_val_width1 val)), constantAsStamp (bool_to_val_width1 val)) g)\"\n using constantCondition.simps\n by (simp add: assms)\n\nlemma constantCondition_changeonly:\n assumes \"nid \\ ids g\"\n assumes \"g' = constantCondition b nid (kind g nid) g\"\n shows \"changeonly {nid} g g'\"\nproof (cases \"is_IfNode (kind g nid)\")\n case True\n have \"nextNid g \\ ids g\"\n using nextNidNotIn by (metis emptyE)\n then show ?thesis using assms\n using replace_node_changeonly add_node_changeonly unfolding changeonly.simps\n using True constantCondition.simps(1) is_IfNode_def\n by (metis (no_types, lifting) insert_iff)\nnext\n case False\n have \"g = g'\"\n using constantConditionNoEffect\n using False assms(2) by blast\n then show ?thesis by simp\nqed\n \n\nlemma constantConditionNoIf:\n assumes \"\\cond t f. kind g ifcond \\ IfNode cond t f\"\n assumes \"g' = constantCondition val ifcond (kind g ifcond) g\"\n shows \"\\nid' .(g m p h \\ ifcond \\ nid') \\ (g' m p h \\ ifcond \\ nid')\"\nproof -\n have \"g' = g\"\n using assms(2) assms(1)\n using constantConditionNoEffect\n by (metis IRNode.collapse(11))\n then show ?thesis by simp\nqed\n\nlemma constantConditionValid:\n assumes \"kind g ifcond = IfNode cond t f\"\n assumes \"[g, m, p] \\ cond \\ v\"\n assumes \"const = val_to_bool v\"\n assumes \"g' = constantCondition const ifcond (kind g ifcond) g\"\n shows \"\\nid' .(g m p h \\ ifcond \\ nid') \\ (g' m p h \\ ifcond \\ nid')\"\nproof (cases \"const\")\n case True\n have ifstep: \"g, p \\ (ifcond, m, h) \\ (t, m, h)\"\n by (meson IfNode True assms(1) assms(2) assms(3) encodeeval_def)\n have ifstep': \"g', p \\ (ifcond, m, h) \\ (t, m, h)\"\n using constantConditionTrue\n using True assms(1) assms(4) by presburger\n from ifstep ifstep' show ?thesis\n using StutterStep by blast\nnext\n case False\n have ifstep: \"g, p \\ (ifcond, m, h) \\ (f, m, h)\"\n by (meson IfNode False assms(1) assms(2) assms(3) encodeeval_def)\n have ifstep': \"g', p \\ (ifcond, m, h) \\ (f, m, h)\"\n using constantConditionFalse\n using False assms(1) assms(4) by presburger\n from ifstep ifstep' show ?thesis\n using StutterStep by blast\nqed\n\nend", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Proofs/Rewrites.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.38121956625615, "lm_q1q2_score": 0.19656440062496067}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__25.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__25 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__25 and some rule r*}\nlemma n_SendInvEVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvE i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvE i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvSVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv3) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__25:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__25:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqESVsinv__25:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__25:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqVsinv__25:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReq N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__25:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__25:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__25.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.19656440062496064}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_on_inv__5.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx_lemma_on_inv__5 imports n_mutualEx_base\nbegin\nsection{*All lemmas on causal relation between inv__5 and some rule r*}\nlemma n_TryVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule Interp s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule Interp s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule Interp s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule Interp s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule Interp s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv3)) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv3)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule Interp s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule Interp s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule Interp s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule Interp s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "gsteProof", "sha": "3070d08e1f31a93be6fde85ab6b65d489c05f99e", "save_path": "github-repos/isabelle/lyj238Gmail-gsteProof", "path": "github-repos/isabelle/lyj238Gmail-gsteProof/gsteProof-3070d08e1f31a93be6fde85ab6b65d489c05f99e/mutualEx/n_mutualEx_lemma_on_inv__5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.38121955219593834, "lm_q1q2_score": 0.1965643933752355}} {"text": "(* Title: JinjaThreads/Framework/FWLockingThread.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Semantics of the thread action ReleaseAcquire for the thread state\\\n\ntheory FWLockingThread\nimports\n FWLocking\nbegin\n\nfun upd_threadR :: \"nat \\ 't lock \\ 't \\ lock_action \\ nat\"\nwhere\n \"upd_threadR n l t ReleaseAcquire = n + has_locks l t\"\n| \"upd_threadR n l t _ = n\"\n\nprimrec upd_threadRs :: \"nat \\ 't lock \\ 't \\ lock_action list \\ nat\"\nwhere\n \"upd_threadRs n l t [] = n\"\n| \"upd_threadRs n l t (la # las) = upd_threadRs (upd_threadR n l t la) (upd_lock l t la) t las\"\n\nlemma upd_threadRs_append [simp]:\n \"upd_threadRs n l t (las @ las') = upd_threadRs (upd_threadRs n l t las) (upd_locks l t las) t las'\"\nby(induct las arbitrary: n l, auto)\n\ndefinition redT_updLns :: \"('l,'t) locks \\ 't \\ ('l \\f nat) \\ 'l lock_actions \\ ('l \\f nat)\"\nwhere \"\\ln. redT_updLns ls t ln las = (\\(l, n, la). upd_threadRs n l t la) \\$ ($ls, ($ln, las$)$)\"\n\nlemma redT_updLns_iff [simp]:\n \"\\ln. redT_updLns ls t ln las $ l = upd_threadRs (ln $ l) (ls $ l) t (las $ l)\"\nby(simp add: redT_updLns_def)\n\nlemma upd_threadRs_comp_empty [simp]: \"(\\(l, n, las). upd_threadRs n l t las) \\$ ($ls, ($lns, K$ []$)$) = lns\"\nby(auto intro!: finfun_ext)\n\nlemma redT_updLs_empty [simp]: \"redT_updLs ls t (K$ []) = ls\"\nby(simp add: redT_updLs_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/FWLockingThread.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.35936413829896496, "lm_q1q2_score": 0.1964780848631193}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__8.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__8 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__8 and some rule r*}\nlemma n_SendInvEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvSVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__8:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqESVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReq N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__8:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.36658972248186006, "lm_q1q2_score": 0.19616158445070894}} {"text": "(* \n Title: Psi-calculi \n Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weaken_Transition\n imports Weakening\nbegin\n\ncontext weak\nbegin\n\ndefinition weakenTransition :: \"'b \\ ('a, 'b, 'c) psi \\ 'a action \\ ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\_ \\ _\" [80, 80, 80, 80] 80)\nwhere\n \"\\ \\ P \\\\ \\ P' \\ (\\P''' P''. \\ \\ P \\\\<^sup>^\\<^sub>\\ P''' \\ \\ \\ P''' \\\\ \\ P'' \\ \\ \\ P'' \\\\<^sup>^\\<^sub>\\ P') \\ (P = P' \\ \\ = \\)\"\n\nlemma weakenTransitionCases[consumes 1, case_names cBase cStep]:\n assumes \"\\ \\ P \\\\ \\ P'\"\n and \"Prop (\\) P\"\n and \"\\P''' P''. \\\\ \\ P \\\\<^sup>^\\<^sub>\\ P'''; \\ \\ P''' \\\\ \\ P''; \\ \\ P'' \\\\<^sup>^\\<^sub>\\ P'\\ \\ Prop \\ P'\"\n\n shows \"Prop \\ P'\"\nusing assms\nby(auto simp add: weakenTransition_def)\n\nlemma statImpTauChainDerivative:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n\n shows \"insertAssertion (extractFrame P) \\ \\\\<^sub>F insertAssertion (extractFrame P') \\\"\nusing assms\nby(induct rule: tauChainInduct) (auto intro: statImpTauDerivative dest: FrameStatImpTrans)\n\nlemma weakenTauChain:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and P' :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sup>^\\<^sub>\\ P'\"\n shows \"\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P'\"\nusing assms\nproof(induct rule: tauChainInduct)\n case(TauBase P)\n thus ?case by simp\nnext\n case(TauStep P P' P'')\n note `\\ \\ \\' \\ P \\\\<^sup>^\\<^sub>\\ P'`\n moreover from `\\ \\ P' \\\\ \\ P''` have \"\\ \\ \\' \\ P' \\\\ \\ P''\" by(rule weakenTransition)\n ultimately show ?case by(auto dest: tauActTauChain)\nqed\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Weaken_Transition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.36658972248186, "lm_q1q2_score": 0.1961615844507089}} {"text": "(* Title: HOL/Auth/n_mutualExFsm_lemma_on_inv__4.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_on_inv__4 imports n_mutualExFsm_base\nbegin\nsection{*All lemmas on causal relation between inv__4 and some rule r*}\nlemma n_fsmVsinv__4:\nassumes a1: \"(\\ i. i\\N\\r=n_fsm i)\" and\na2: \"(\\ p__Inv0. p__Inv0\\N\\f=inv__4 p__Inv0)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_fsm i\" apply fastforce done\nfrom a2 obtain p__Inv0 where a2:\"p__Inv0\\N\\f=inv__4 p__Inv0\" apply fastforce done\nhave \"(i=p__Inv0)\\(i~=p__Inv0)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)) s))\\((formEval (andForm (andForm (eqn (IVar (Ident ''x'')) (Const true)) (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Ident ''x'')) (Const true))) (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C)) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Ident ''x'')) (Const true)) (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Ident ''x'')) (Const true))) (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C)) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0)\"\n have \"((formEval (eqn (IVar (Para (Ident ''n'') i)) (Const I)) s))\\((formEval (andForm (andForm (eqn (IVar (Ident ''x'')) (Const true)) (eqn (IVar (Para (Ident ''n'') i)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Ident ''x'')) (Const true))) (eqn (IVar (Para (Ident ''n'') i)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''n'') i)) (Const C)) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''n'') i)) (Const C))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''n'') i)) (Const I)) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Ident ''x'')) (Const true)) (eqn (IVar (Para (Ident ''n'') i)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Ident ''x'')) (Const true))) (eqn (IVar (Para (Ident ''n'') i)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''n'') i)) (Const C)) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''n'') i)) (Const C))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const T))) (neg (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const T)))) (neg (eqn (IVar (Para (Ident ''n'') i)) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_on_inv__4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.36658972940200985, "lm_q1q2_score": 0.1961615827179751}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__22_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__22_on_rules imports n_german_lemma_on_inv__22\nbegin\nsection{*All lemmas on causal relation between inv__22*}\nlemma lemma_inv__22_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__22) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__22_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3775406758018019, "lm_q1q2_score": 0.1961404309832387}} {"text": "section \\Stamp Typing\\\n\ntheory Stamp\n imports Values\nbegin\n\ntext \\\nThe GraalVM compiler uses the Stamp class to store range and type information\nfor a given node in the IR graph.\nWe model the Stamp class as a datatype, Stamp, and provide a number of functions\non the datatype which correspond to the class methods within the compiler.\n\nStamp information is used in a variety of ways in optimizations, and so, we\nadditionally provide a number of lemmas which help to prove future optimizations.\n\\\n\ndatatype Stamp = \n VoidStamp\n | IntegerStamp (stp_bits: nat) (stpi_lower: int) (stpi_upper: int)\n (* | FloatStamp (stp_bits: nat) (stpf_lower: float) (stpf_upper: float) *)\n | KlassPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | MethodCountersPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | MethodPointersStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | ObjectStamp (stp_type: string) (stp_exactType: bool) (stp_nonNull: bool) (stp_alwaysNull: bool)\n | RawPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | IllegalStamp\n\n\nfun is_stamp_empty :: \"Stamp \\ bool\" where\n \"is_stamp_empty (IntegerStamp b lower upper) = (upper < lower)\" |\n (* \"is_stamp_empty (FloatStamp b lower upper) = (upper < lower)\" | *)\n \"is_stamp_empty x = False\"\n\n\ntext \\Just like the IntegerStamp class, we need to know that our lo/hi bounds\n fit into the given number of bits (either signed or unsigned).\n Our integer stamps have infinite lo/hi bounds, so if the lower\n bound is non-negative, we can assume that all values are positive,\n and the integer bits of a related value can be interpreted as unsigned.\n This is similar (but slightly more general) to what IntegerStamp.java\n does with its test: if (sameSignBounds()) in the unsignedUpperBound() method.\n\n Note that this is a bit different and more accurate than what\n StampFactory.forUnsignedInteger does (it widens large unsigned ranges to the\n max signed range to allow all bit patterns) because its lo/hi values are only 64-bit.\n\\\n(* TODO: should we have tight bounds for empty stamp, or just hi hi = fst (bit_bounds bits) \n *)\nfun valid_stamp :: \"Stamp \\ bool\" where\n \"valid_stamp (IntegerStamp bits lo hi) = \n (0 < bits \\ bits \\ 64 \\\n fst (bit_bounds bits) \\ lo \\ lo \\ snd (bit_bounds bits) \\\n fst (bit_bounds bits) \\ hi \\ hi \\ snd (bit_bounds bits))\" |\n \"valid_stamp s = True\"\n\n(* Note: we could support 32/64-bit unsigned values by relaxing this definition to:\n (is_stamp_empty (IntegerStamp bits lo hi)\n \\ lo < 0 \\ fst (bit_bounds bits) \\ lo \\ lo \\ hi \\ hi \\ snd (bit_bounds bits)\n \\ 0 \\ lo \\ lo \\ hi \\ hi < 2 ^ bits))\"\n*)\n\nexperiment begin\ncorollary \"bit_bounds 1 = (-1, 0)\" by simp (* this matches the compiler stamps. *)\nend\n\n\n\n(* NOTE: the FloatStamp has been commented out to allow use of code generation facilities *)\n(*\ndefinition pos_infinity :: \"float\" where\n \"pos_infinity = float_of (0 * 2 powr 255)\"\n\ndefinition neg_infinity :: \"float\" where\n \"neg_infinity = -pos_infinity\"\n*)\n\n\\ \\A stamp which includes the full range of the type\\\nfun unrestricted_stamp :: \"Stamp \\ Stamp\" where\n \"unrestricted_stamp VoidStamp = VoidStamp\" |\n \"unrestricted_stamp (IntegerStamp bits lower upper) = (IntegerStamp bits (fst (bit_bounds bits)) (snd (bit_bounds bits)))\" | \n (* \"unrestricted_stamp (FloatStamp bits lower upper) = (FloatStamp bits neg_infinity pos_infinity)\" | *)\n \"unrestricted_stamp (KlassPointerStamp nonNull alwaysNull) = (KlassPointerStamp False False)\" |\n \"unrestricted_stamp (MethodCountersPointerStamp nonNull alwaysNull) = (MethodCountersPointerStamp False False)\" |\n \"unrestricted_stamp (MethodPointersStamp nonNull alwaysNull) = (MethodPointersStamp False False)\" |\n \"unrestricted_stamp (ObjectStamp type exactType nonNull alwaysNull) = (ObjectStamp '''' False False False)\" |\n \"unrestricted_stamp _ = IllegalStamp\"\n\nfun is_stamp_unrestricted :: \"Stamp \\ bool\" where\n \"is_stamp_unrestricted s = (s = unrestricted_stamp s)\"\n\n\\ \\A stamp which provides type information but has an empty range of values\\\nfun empty_stamp :: \"Stamp \\ Stamp\" where\n \"empty_stamp VoidStamp = VoidStamp\" |\n \"empty_stamp (IntegerStamp bits lower upper) = (IntegerStamp bits (snd (bit_bounds bits)) (fst (bit_bounds bits)))\" |\n (* \"empty_stamp (FloatStamp bits lower upper) = (FloatStamp bits pos_infinity neg_infinity)\" | *)\n \"empty_stamp (KlassPointerStamp nonNull alwaysNull) = (KlassPointerStamp nonNull alwaysNull)\" |\n \"empty_stamp (MethodCountersPointerStamp nonNull alwaysNull) = (MethodCountersPointerStamp nonNull alwaysNull)\" |\n \"empty_stamp (MethodPointersStamp nonNull alwaysNull) = (MethodPointersStamp nonNull alwaysNull)\" |\n \"empty_stamp (ObjectStamp type exactType nonNull alwaysNull) = (ObjectStamp '''' True True False)\" |\n \"empty_stamp stamp = IllegalStamp\"\n\n\n\\ \\Calculate the meet stamp of two stamps\\\nfun meet :: \"Stamp \\ Stamp \\ Stamp\" where\n \"meet VoidStamp VoidStamp = VoidStamp\" |\n \"meet (IntegerStamp b1 l1 u1) (IntegerStamp b2 l2 u2) = (\n if b1 \\ b2 then IllegalStamp else \n (IntegerStamp b1 (min l1 l2) (max u1 u2))\n )\" |\n (* \"meet (FloatStamp b1 l1 u1) (FloatStamp b2 l2 u2) = (\n if b1 \\ b2 then IllegalStamp else \n (FloatStamp b1 (min l1 l2) (max u1 u2))\n )\" | *)\n \"meet (KlassPointerStamp nn1 an1) (KlassPointerStamp nn2 an2) = (\n KlassPointerStamp (nn1 \\ nn2) (an1 \\ an2)\n )\" |\n \"meet (MethodCountersPointerStamp nn1 an1) (MethodCountersPointerStamp nn2 an2) = (\n MethodCountersPointerStamp (nn1 \\ nn2) (an1 \\ an2)\n )\" |\n \"meet (MethodPointersStamp nn1 an1) (MethodPointersStamp nn2 an2) = (\n MethodPointersStamp (nn1 \\ nn2) (an1 \\ an2)\n )\" |\n \"meet s1 s2 = IllegalStamp\"\n\n\\ \\Calculate the join stamp of two stamps\\\nfun join :: \"Stamp \\ Stamp \\ Stamp\" where\n \"join VoidStamp VoidStamp = VoidStamp\" |\n \"join (IntegerStamp b1 l1 u1) (IntegerStamp b2 l2 u2) = (\n if b1 \\ b2 then IllegalStamp else \n (IntegerStamp b1 (max l1 l2) (min u1 u2))\n )\" |\n (* \"join (FloatStamp b1 l1 u1) (FloatStamp b2 l2 u2) = (\n if b1 \\ b2 then IllegalStamp else \n (FloatStamp b1 (max l1 l2) (min u1 u2))\n )\" | *)\n \"join (KlassPointerStamp nn1 an1) (KlassPointerStamp nn2 an2) = (\n if ((nn1 \\ nn2) \\ (an1 \\ an2)) \n then (empty_stamp (KlassPointerStamp nn1 an1))\n else (KlassPointerStamp (nn1 \\ nn2) (an1 \\ an2))\n )\" |\n \"join (MethodCountersPointerStamp nn1 an1) (MethodCountersPointerStamp nn2 an2) = (\n if ((nn1 \\ nn2) \\ (an1 \\ an2)) \n then (empty_stamp (MethodCountersPointerStamp nn1 an1))\n else (MethodCountersPointerStamp (nn1 \\ nn2) (an1 \\ an2))\n )\" |\n \"join (MethodPointersStamp nn1 an1) (MethodPointersStamp nn2 an2) = (\n if ((nn1 \\ nn2) \\ (an1 \\ an2)) \n then (empty_stamp (MethodPointersStamp nn1 an1))\n else (MethodPointersStamp (nn1 \\ nn2) (an1 \\ an2))\n )\" |\n \"join s1 s2 = IllegalStamp\"\n\n\\ \\\nIn certain circumstances a stamp provides enough information to evaluate a value as a stamp,\nthe asConstant function converts the stamp to a value where one can be inferred.\n\\\n(* NOTE: we could also add a 32-bit version of this if needed. *)\nfun asConstant :: \"Stamp \\ Value\" where\n \"asConstant (IntegerStamp b l h) = (if l = h then IntVal b (word_of_int l) else UndefVal)\" |\n \"asConstant _ = UndefVal\"\n\n\\ \\Determine if two stamps never have value overlaps i.e. their join is empty\\\nfun alwaysDistinct :: \"Stamp \\ Stamp \\ bool\" where\n \"alwaysDistinct stamp1 stamp2 = is_stamp_empty (join stamp1 stamp2)\"\n\n\\ \\Determine if two stamps must always be the same value i.e. two equal constants\\\nfun neverDistinct :: \"Stamp \\ Stamp \\ bool\" where\n \"neverDistinct stamp1 stamp2 = (asConstant stamp1 = asConstant stamp2 \\ asConstant stamp1 \\ UndefVal)\"\n\nfun constantAsStamp :: \"Value \\ Stamp\" where\n \"constantAsStamp (IntVal b v) = (IntegerStamp b (int_signed_value b v) (int_signed_value b v))\" |\n (* TODO: float *)\n \"constantAsStamp _ = IllegalStamp\"\n\n\\ \\Define when a runtime value is valid for a stamp.\n The stamp bounds must be valid, and val must be zero-extended.\\\nfun valid_value :: \"Value \\ Stamp \\ bool\" where\n \"valid_value (IntVal b1 val) (IntegerStamp b l h) =\n (if b1 = b then\n valid_stamp (IntegerStamp b l h) \\\n take_bit b val = val \\\n l \\ int_signed_value b val \\ int_signed_value b val \\ h\n else False)\" |\n (* \"valid_value (FloatStamp b1 l h) (FloatVal b2 v) = ((b1 = b2) \\ (v \\ l) \\ (v \\ h))\" | *)\n \"valid_value (ObjRef ref) (ObjectStamp klass exact nonNull alwaysNull) = \n ((alwaysNull \\ ref = None) \\ (ref=None \\ \\ nonNull))\" |\n \"valid_value stamp val = False\"\n(* NOTE: we could allow for unsigned interpretations too, like this:\n (if l < 0\n then (l \\ int_signed_value b val \\ int_signed_value b val \\ h)\n else (l \\ int_unsigned_value b val \\ int_unsigned_value b val \\ h))\n but that is only necessary for handling unsigned long, so we take the\n simpler always-signed approach here. In Java, the only unsigned stamps\n we see are for char, but they are 32-bit: IntegerStamp 32 0 65535.\n*)\n(* TODO: add the other stamps:\n | KlassPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | MethodCountersPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | MethodPointersStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n | RawPointerStamp (stp_nonNull: bool) (stp_alwaysNull: bool)\n*)\n\n(* A preferable wf_value definition\nfun wf_value :: \"Value \\ bool\" where\n \"wf_value (IntVal b v) = (0 < b \\ b \\ 64 \\ take_bit b v = v \n \\ sint v \\ snd (bit_bounds b)\n \\ fst (bit_bounds b) \\ sint v)\" |\n \"wf_value _ = False\"\n*)\n\ndefinition wf_value :: \"Value \\ bool\" where\n \"wf_value v = valid_value v (constantAsStamp v)\"\n\nlemma unfold_wf_value[simp]:\n \"wf_value v \\ valid_value v (constantAsStamp v)\"\n using wf_value_def by auto\n\nfun compatible :: \"Stamp \\ Stamp \\ bool\" where\n \"compatible (IntegerStamp b1 lo1 hi1) (IntegerStamp b2 lo2 hi2) =\n (b1 = b2 \\ valid_stamp (IntegerStamp b1 lo1 hi1) \\ valid_stamp (IntegerStamp b2 lo2 hi2))\" |\n \"compatible (VoidStamp) (VoidStamp) = True\" |\n \"compatible _ _ = False\"\n\nfun stamp_under :: \"Stamp \\ Stamp \\ bool\" where\n \"stamp_under (IntegerStamp b1 lo1 hi1) (IntegerStamp b2 lo2 hi2) = (hi1 < lo2)\" |\n \"stamp_under _ _ = False\"\n\n\\ \\\nThe most common type of stamp within the compiler (apart from the VoidStamp) is a 32 bit\ninteger stamp with an unrestricted range. We use @{text default_stamp} as it is a frequently used stamp.\n\\\ndefinition default_stamp :: \"Stamp\" where\n \"default_stamp = (unrestricted_stamp (IntegerStamp 32 0 0))\"\n\nvalue \"valid_value (IntVal 8 (255)) (IntegerStamp 8 (-128) 127)\"\nend\n", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Graph/Stamp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.37754067580180184, "lm_q1q2_score": 0.19614043098323866}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__18_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__18_on_rules imports n_german_lemma_on_inv__18\nbegin\nsection{*All lemmas on causal relation between inv__18*}\nlemma lemma_inv__18_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__18) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__18_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.37754067580180184, "lm_q1q2_score": 0.19614043098323866}} {"text": " (*-------------------------------------------------*\n | (a part of) ep2 |\n | September 2004 |\n | December 2004 (modified) |\n | November 2005 (modified) |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | CSP-Prover on Isabelle2009 |\n | June 2009 (modified) |\n | |\n | CSP-Prover on Isabelle2012 |\n | November 2012 (modified) |\n | |\n | CSP-Prover on Isabelle2016 |\n | May 2016 (modified) |\n | |\n | Markus Roggenbach (Univ of Wales Swansea, UK) |\n | Yoshinao Isobe (AIST, Japan) |\n *-------------------------------------------------*)\n\ntheory ep2_acl\nimports CSP_F\nbegin\n\n(*********************************************************\n automatic unfolding syntactic-sugar\n *********************************************************)\n\ndeclare csp_prefix_ss_def [simp]\n\n(*********************************************************\n data type passed on channels\n *********************************************************)\n\ntypedecl D_SI_Init_SessionStart\ntypedecl D_SI_Init_SessionEnd\ntypedecl D_SI_Init_ConfigDataRequest\ntypedecl D_SI_Init_ConfigDataResponse\ntypedecl D_SI_Init_ConfigDataNotification\ntypedecl D_SI_Init_ConfigDataAcknowledge\ntypedecl D_SI_Init_RemoveConfigDataNotification\ntypedecl D_SI_Init_RemoveConfigDataAcknowledge\ntypedecl D_SI_Init_ActivateConfigDataNotification\ntypedecl D_SI_Init_ActivateConfigDataAcknowledge\n\ndatatype D_SI_Init = \n SStart D_SI_Init_SessionStart\n | SEnd D_SI_Init_SessionEnd\n | CDReq D_SI_Init_ConfigDataRequest\n | CDRes D_SI_Init_ConfigDataResponse\n | CDN D_SI_Init_ConfigDataNotification\n | CDA D_SI_Init_ConfigDataAcknowledge\n | RCDN D_SI_Init_RemoveConfigDataNotification\n | RCDA D_SI_Init_RemoveConfigDataAcknowledge\n | ACDN D_SI_Init_ActivateConfigDataNotification\n | ACDA D_SI_Init_ActivateConfigDataAcknowledge\n\ntypedecl TerminalState\ntypedecl Trigger\ntypedecl Message\n\n(*********************************************************\n event (channel)\n *********************************************************)\n\ndatatype Event = C_SI_Init D_SI_Init\n | C_TerminalDisplay Message\n | PairTT \"TerminalState * Trigger\"\n\n(*********************************************************\n abstract component description level\n *********************************************************)\n\ndatatype ACName = TInit\n | TConfigurationManagement\n | AcquirerInit\n | ConfigurationManagement\n\nprimrec\n ACfun :: \"ACName => (ACName, Event) proc\"\nwhere\n \"ACfun (TInit) \n = C_SI_Init !? x: (range SStart)\n -> $(TConfigurationManagement)\"\n\n |\"ACfun (TConfigurationManagement)\n = C_SI_Init ? x ->\n IF (x:range CDReq)\n THEN (C_SI_Init !? y: (range CDRes)\n -> $(TConfigurationManagement))\n\n ELSE IF (x:range CDN)\n THEN (C_SI_Init !? y: (range CDA)\n -> $(TConfigurationManagement))\n\n ELSE IF (x:range RCDN)\n THEN (C_SI_Init !? y: (range RCDA)\n -> $(TConfigurationManagement))\n\n ELSE IF (x:range ACDN)\n THEN (C_SI_Init !? y: (range ACDA)\n -> $(TConfigurationManagement))\n\n ELSE IF (x:range SEnd)\n THEN SKIP\n ELSE STOP\"\n\n |\"ACfun (AcquirerInit)\n = C_SI_Init ? sessionStart: (range SStart)\n -> $(ConfigurationManagement)\"\n\n |\"ACfun (ConfigurationManagement)\n = C_SI_Init !? sessionEnd:(range SEnd) -> SKIP\n |~| C_SI_Init !? request:(range CDReq)\n -> C_SI_Init ? response:(range CDRes)\n -> $(ConfigurationManagement)\n |~| C_SI_Init !? notification:(range CDN)\n -> C_SI_Init ? acknowledge:(range CDA)\n -> $(ConfigurationManagement)\n |~| C_SI_Init !? notification:(range RCDN)\n -> C_SI_Init ? acknowledge:(range RCDA)\n -> $(ConfigurationManagement)\n |~| C_SI_Init !? notification:(range ACDN)\n -> C_SI_Init ? acknowledge:(range ACDA)\n -> $(ConfigurationManagement)\"\n(*\ndefs (overloaded)\n Set_ACfun_def [simp]: \"PNfun == ACfun\"\n*)\noverloading Set_ACfun == \n \"PNfun :: (ACName, Event) pnfun\"\nbegin\n definition \"PNfun == ACfun\"\nend\ndeclare Set_ACfun_def [simp]\n\ndefinition\n AC :: \"(ACName, Event) proc\"\n where\n AC_def: \"AC == ($TInit |[range C_SI_Init]| $AcquirerInit)\"\n\n(*********************************************************\n gProc lemmas (routine work)\n *********************************************************)\n\nlemma guarded_AC[simp]:\n \"guardedfun ACfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)+\n\n(*********************************************************\n abstract level (deadlock free)\n *********************************************************)\n\n\nabbreviation REQs :: \"D_SI_Init set\"\nwhere \"REQs == (range CDReq) Un (range CDN) Un \n (range RCDN) Un (range ACDN)\"\n\nabbreviation RESs :: \"D_SI_Init set\"\nwhere \"RESs == (range CDRes) Un (range CDA) Un \n (range RCDA) Un (range ACDA)\"\n\ndatatype AbsName = Abstract | Loop\n\nfun\n Absfun :: \"AbsName => (AbsName, Event) proc\"\nwhere\n \"Absfun (Abstract)\n = C_SI_Init !? init:(range SStart) -> $(Loop)\"\n\n| \"Absfun (Loop)\n = C_SI_Init !? exit:(range SEnd) -> SKIP\n |~| \n C_SI_Init !? request:REQs\n -> C_SI_Init !? response:RESs\n -> $(Loop)\"\n(*\ndefs (overloaded)\n Set_Absfun_def [simp]: \"PNfun == Absfun\"\n*)\n\n\noverloading Set_Absfun == \n \"PNfun :: (AbsName, Event) pnfun\"\nbegin\n definition \"PNfun == Absfun\"\nend\n \ndeclare Set_Absfun_def [simp]\n\ndefinition\n Abs :: \"(AbsName, Event) proc\"\n where\n Abs_def: \"Abs == $(Abstract)\"\n\n(*********************************************************\n gProc lemmas (routine work)\n *********************************************************)\n\nlemma guarded_Abs[simp]:\n \"guardedfun Absfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)+\n\n(*********************************************************\n relating function between AbsName and ACName\n *********************************************************)\n\nprimrec\n Abs_to_AC :: \"AbsName => (ACName,Event) proc\"\nwhere\n \"Abs_to_AC (Abstract)\n = ($TInit |[range C_SI_Init]| $AcquirerInit)\"\n\n |\"Abs_to_AC (Loop)\n = ($TConfigurationManagement |[range C_SI_Init]|\n $ConfigurationManagement)\"\n\n(*********************************************************\n a theorem for verifying Abs <=F AC\n (i.e. AC is deadlock-free)\n *********************************************************)\n\noverloading FPmode == \n \"FPmode :: fpmode\"\nbegin\n definition \"FPmode == CMSmode\"\nend\n\ndeclare FPmode_def [simp]\n(*\ndefs FPmode_def [simp]: \"FPmode == CMSmode\"\n*)\n\n(*** CMS-based approach ***)\n\ndeclare inj_on_def [simp]\n\n\ntheorem ep2_abs: \"Abs <=F AC\"\napply (simp add: Abs_def AC_def)\n\n (***** by fixed point induction *****)\napply (rule cspF_fp_induct_left[of _ \"Abs_to_AC\"])\n\n (***** check guarded and no hiding operators *****)\napply (simp_all)\napply (simp)\n\n (*** recursion ***)\napply (induct_tac p)\napply (simp_all)\n\n(*** initializing ***)\n\napply (cspF_unwind)\napply (cspF_dist)\n\napply (cspF_simp)\napply (auto)\napply (cspF_step)+\napply (rule cspF_decompo_subset)\n\napply (auto)\napply (cspF_simp)\n\n(*** main loop ***)\n\napply (cspF_unwind)\napply (cspF_dist)+\napply (auto)\n\n (*** skip ***)\napply (cspF_step)+\napply (rule cspF_Int_choice_left1)\napply (rule cspF_decompo_subset)\napply (auto)\napply (simp add: image_iff)\napply (cspF_step)+\n\n (*** C_SI_Init ? ***)\napply (rule cspF_Int_choice_left2)\napply (rule cspF_decompo_subset)\napply (auto)\napply (simp add: image_iff)\napply (cspF_simp)+\n\napply (cspF_dist)\napply (cspF_simp)\napply (rule cspF_decompo_subset)\napply (auto)\napply (cspF_step)+\napply (auto)\napply (cspF_simp)\n\n (*** CD req res ***)\napply (rule cspF_Int_choice_left2)\napply (cspF_step)+\napply (rule cspF_decompo_subset)\napply (auto)\napply (simp add: image_iff)\napply (cspF_simp)+\n\napply (cspF_dist)\napply (cspF_simp)\napply (rule cspF_decompo_subset)\napply (auto)\napply (cspF_step)+\napply (auto)\napply (cspF_simp)\n\n (*** RCD ***)\napply (rule cspF_Int_choice_left2)\napply (cspF_step)+\napply (rule cspF_decompo_subset)\napply (auto)\napply (simp add: image_iff)\napply (cspF_simp)+\n\napply (cspF_dist)\napply (cspF_simp)\napply (rule cspF_decompo_subset)\napply (auto)\napply (cspF_step)+\napply (auto)\napply (cspF_simp)\n\n (*** ACD ***)\napply (rule cspF_Int_choice_left2)\napply (cspF_step)+\napply (rule cspF_decompo_subset)\napply (auto)\napply (simp add: image_iff)\napply (cspF_simp)+\n\napply (cspF_dist)\napply (cspF_simp)\napply (rule cspF_decompo_subset)\napply (auto)\napply (cspF_step)+\napply (auto)\napply (cspF_simp)\ndone\n\ndeclare inj_on_def [simp del]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/ep2/ep2_acl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.1961404273446898}} {"text": "section \\Executable compilation chain\\\n\ntheory Compiler\nimports Composition\nbegin\n\ndefinition term_to_exp :: \"C_info \\ rule fset \\ term \\ exp\" where\n\"term_to_exp C_info rs t =\n cakeml.mk_con C_info (heads_of rs |\\| constructors.C C_info)\n (pterm_to_sterm (nterm_to_pterm (fresh_frun (term_to_nterm [] t) (heads_of rs |\\| constructors.C C_info))))\"\n\nlemma (in rules) \"Compiler.term_to_exp C_info rs = term_to_cake\"\n unfolding term_to_exp_def by (simp add: all_consts_def)\n\nprimrec compress_pterm :: \"pterm \\ pterm\" where\n\"compress_pterm (Pabs cs) = Pabs (fcompress (map_prod id compress_pterm |`| cs))\" |\n\"compress_pterm (Pconst name) = Pconst name\" |\n\"compress_pterm (Pvar name) = Pvar name\" |\n\"compress_pterm (t $\\<^sub>p u) = compress_pterm t $\\<^sub>p compress_pterm u\"\n\nlemma compress_pterm_eq[simp]: \"compress_pterm t = t\"\nby (induction t) (auto simp: subst_pabs_id fset_map_snd_id map_prod_def fmember.rep_eq)\n\ndefinition compress_crule_set :: \"crule_set \\ crule_set\" where\n\"compress_crule_set = fcompress \\ fimage (map_prod id fcompress)\"\n\ndefinition compress_irule_set :: \"irule_set \\ irule_set\" where\n\"compress_irule_set = fcompress \\ fimage (map_prod id (fcompress \\ fimage (map_prod id compress_pterm)))\"\n\ndefinition compress_prule_set :: \"prule fset \\ prule fset\" where\n\"compress_prule_set = fcompress \\ fimage (map_prod id compress_pterm)\"\n\nlemma compress_crule_set_eq[simp]: \"compress_crule_set rs = rs\"\nunfolding compress_crule_set_def by force\n\nlemma compress_irule_set_eq[simp]: \"compress_irule_set rs = rs\"\nunfolding compress_irule_set_def map_prod_def by simp\n\nlemma compress_prule_set[simp]: \"compress_prule_set rs = rs\"\nunfolding compress_prule_set_def by force\n\ndefinition transform_irule_set_iter :: \"irule_set \\ irule_set\" where\n\"transform_irule_set_iter rs = ((transform_irule_set \\ compress_irule_set) ^^ max_arity rs) rs\"\n\ndefinition as_sem_env :: \"C_info \\ srule list \\ v sem_env \\ v sem_env\" where\n\"as_sem_env C_info rs env =\n \\ sem_env.v =\n build_rec_env (cakeml.mk_letrec_body C_info (fset_of_list (map fst rs) |\\| constructors.C C_info) rs) env nsEmpty,\n sem_env.c =\n nsEmpty \\\"\n\ndefinition empty_sem_env :: \"C_info \\ v sem_env\" where\n\"empty_sem_env C_info = \\ sem_env.v = nsEmpty, sem_env.c = constructors.as_static_cenv C_info \\\"\n\ndefinition sem_env :: \"C_info \\ srule list \\ v sem_env\" where\n\"sem_env C_info rs = extend_dec_env (as_sem_env C_info rs (empty_sem_env C_info)) (empty_sem_env C_info)\"\n\ndefinition compile :: \"C_info \\ rule fset \\ Ast.prog\" where\n\"compile C_info =\n CakeML_Backend.compile' C_info \\\n Rewriting_Sterm.compile \\\n compress_prule_set \\\n Rewriting_Pterm.compile \\\n transform_irule_set_iter \\\n compress_irule_set \\\n Rewriting_Pterm_Elim.compile \\\n compress_crule_set \\\n Rewriting_Nterm.consts_of \\\n fcompress \\\n Rewriting_Nterm.compile' C_info \\\n fcompress\"\n\ndefinition compile_to_env :: \"C_info \\ rule fset \\ v sem_env\" where\n\"compile_to_env C_info =\n sem_env C_info \\\n Rewriting_Sterm.compile \\\n compress_prule_set \\\n Rewriting_Pterm.compile \\\n transform_irule_set_iter \\\n compress_irule_set \\\n Rewriting_Pterm_Elim.compile \\\n compress_crule_set \\\n Rewriting_Nterm.consts_of \\\n fcompress \\\n Rewriting_Nterm.compile' C_info \\\n fcompress\"\n\nlemma (in rules) \"Compiler.compile_to_env C_info rs = rules.cake_sem_env C_info rs\"\nunfolding Compiler.compile_to_env_def Compiler.sem_env_def Compiler.as_sem_env_def Compiler.empty_sem_env_def\nunfolding rules_as_nrules.crules_as_irules'.irules'_as_prules.prules_as_srules.sem_env_def\nunfolding rules_as_nrules.crules_as_irules'.irules'_as_prules.prules_as_srules.as_sem_env_def\nunfolding empty_sem_env_def\nby (auto simp:\n Compiler.compress_irule_set_eq[abs_def]\n Composition.transform_irule_set_iter_def[abs_def]\n Compiler.transform_irule_set_iter_def[abs_def] comp_def pre_constants.all_consts_def)\n\nexport_code\n term_to_exp compile compile_to_env\n checking Scala\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Compiler/Compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.3486451285660856, "lm_q1q2_score": 0.1960000984281612}} {"text": "(* Title: JinjaDCI/Compiler/Compiler.thy\n\n Author: Tobias Nipkow, Susannah Mansky\n Copyright TUM 2003, UIUC 2019-20\n\n Based on the Jinja theory Compiler/Compiler.thy by Tobias Nipkow\n*)\n\nsection \\ Combining Stages 1 and 2 \\\n\ntheory Compiler\nimports Correctness1 Correctness2\nbegin\n\ndefinition J2JVM :: \"J_prog \\ jvm_prog\"\nwhere \n \"J2JVM \\ compP\\<^sub>2 \\ compP\\<^sub>1\"\n\ntheorem comp_correct_NonStatic:\nassumes wf: \"wf_J_prog P\"\nand \"method\": \"P \\ C sees M,NonStatic:Ts\\T = (pns,body) in C\"\nand eval: \"P \\ \\body,(h,[this#pns [\\] vs],sh)\\ \\ \\e',(h',l',sh')\\\"\nand sizes: \"size vs = size pns + 1\" \"size rest = max_vars body\"\nshows \"J2JVM P \\ (None,h,[([],vs@rest,C,M,0,No_ics)],sh) -jvm\\ (exception e',h',[],sh')\"\n(*<*)\nproof -\n let ?P\\<^sub>1 = \"compP\\<^sub>1 P\"\n have nclinit: \"M \\ clinit\" using wf_sees_clinit1[OF wf] visible_method_exists[OF \"method\"]\n sees_method_idemp[OF \"method\"] by fastforce\n have wf\\<^sub>1: \"wf_J\\<^sub>1_prog ?P\\<^sub>1\" by(rule compP\\<^sub>1_pres_wf[OF wf])\n have fv: \"fv body \\ set (this#pns)\"\n using wf_prog_wwf_prog[OF wf] \"method\" by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)\n have init: \"[this#pns [\\] vs] \\\\<^sub>m [this#pns [\\] vs@rest]\"\n using sizes by simp\n have \"?P\\<^sub>1 \\ C sees M,NonStatic: Ts\\T = (compE\\<^sub>1 (this#pns) body) in C\"\n using sees_method_compP[OF \"method\", of \"\\b (pns,e). compE\\<^sub>1 (case b of NonStatic \\ this#pns | Static \\ pns) e\"]\n by(simp)\n moreover obtain ls' where\n \"?P\\<^sub>1 \\\\<^sub>1 \\compE\\<^sub>1 (this#pns) body, (h, vs@rest, sh)\\ \\ \\fin\\<^sub>1 e', (h',ls', sh')\\\"\n using eval\\<^sub>1_eval[OF wf_prog_wwf_prog[OF wf] eval fv init] sizes by auto\n ultimately show ?thesis using comp\\<^sub>2_correct[OF wf\\<^sub>1] eval_final[OF eval] nclinit\n by(fastforce simp add:J2JVM_def final_def)\nqed\n(*>*)\n\ntheorem comp_correct_Static:\nassumes wf: \"wf_J_prog P\"\nand \"method\": \"P \\ C sees M,Static:Ts\\T = (pns,body) in C\"\nand eval: \"P \\ \\body,(h,[pns [\\] vs],sh)\\ \\ \\e',(h',l',sh')\\\"\nand sizes: \"size vs = size pns\" \"size rest = max_vars body\"\nand nclinit: \"M \\ clinit\"\nshows \"J2JVM P \\ (None,h,[([],vs@rest,C,M,0,No_ics)],sh) -jvm\\ (exception e',h',[],sh')\"\n(*<*)\nproof -\n let ?P\\<^sub>1 = \"compP\\<^sub>1 P\"\n have wf\\<^sub>1: \"wf_J\\<^sub>1_prog ?P\\<^sub>1\" by(rule compP\\<^sub>1_pres_wf[OF wf])\n have fv: \"fv body \\ set pns\"\n using wf_prog_wwf_prog[OF wf] \"method\" by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)\n have init: \"[pns [\\] vs] \\\\<^sub>m [pns [\\] vs@rest]\"\n using sizes by simp\n have \"?P\\<^sub>1 \\ C sees M,Static: Ts\\T = (compE\\<^sub>1 pns body) in C\"\n using sees_method_compP[OF \"method\", of \"\\b (pns,e). compE\\<^sub>1 (case b of NonStatic \\ this#pns | Static \\ pns) e\"]\n by(simp)\n moreover obtain ls' where\n \"?P\\<^sub>1 \\\\<^sub>1 \\compE\\<^sub>1 pns body, (h, vs@rest, sh)\\ \\ \\fin\\<^sub>1 e', (h',ls', sh')\\\"\n using eval\\<^sub>1_eval[OF wf_prog_wwf_prog[OF wf] eval fv init] sizes by auto\n ultimately show ?thesis using comp\\<^sub>2_correct[OF wf\\<^sub>1] eval_final[OF eval] nclinit\n by(fastforce simp add:J2JVM_def final_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Compiler/Compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.3486451217982255, "lm_q1q2_score": 0.19600009462342932}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__26_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__26_on_rules imports n_german_lemma_on_inv__26\nbegin\nsection{*All lemmas on causal relation between inv__26*}\nlemma lemma_inv__26_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__26) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__26_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3738758227716966, "lm_q1q2_score": 0.1956942136140167}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__50_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__50_on_rules imports n_german_lemma_on_inv__50\nbegin\nsection{*All lemmas on causal relation between inv__50*}\nlemma lemma_inv__50_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__50) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__50_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.36296921930155557, "lm_q1q2_score": 0.19563431882964674}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory InfoFlow\nimports\n \"../access-control/Syscall_AC\"\n \"../../lib/EquivValid\"\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(* We take the authority graph from the access proofs. We identify each\n label in that graph with an information flow domain. Our goal is to\n construct an equivalence relation (R l) on states, for each label l of\n the authority graph, that tells us when those two states are equal for\n all state readable by label l -- i.e. all state that falls within l's\n information flow domain. The set of all such state, we denote\n subjectReads g l, where g is the authority graph. *) \n\n\n(* TODO: consider putting the current subject as a parameter and restricting\n the inductive rules to require that 'a' is the current subject *)\ninductive_set subjectReads :: \"'a auth_graph \\ 'a \\ 'a set\"\nfor g :: \"'a auth_graph\" and l :: \"'a\"\nwhere\n (* clearly, l can read from anything it has Read authority to *)\n reads_read: \"(l,Read,l') \\ g \\ l' \\ subjectReads g l\" |\n (* l can read from itself *)\n reads_lrefl: \"l \\ subjectReads g l\" |\n (* if l has SyncSend or Receive authority to an endpoint, l can read it *)\n reads_ep:\n \"\\(l,auth,ep) \\ g; auth \\ {SyncSend,Receive}\\ \\ \n ep \\ subjectReads g l\" |\n reads_read_queued_thread_read_ep:\n (* if someone can send on or reset an endpoint, and l can read from a thread t\n that can receive or send synchronously on that endpoint, then l needs to\n be able to read from the endpoint too. This is because the thread t might\n be blocked waiting to send or receive an that endpoint. When the other\n party completes the rendezvous,\n the affects caused to t depend of course on the state of the endpoint.\n Since t is in l's domain, the ep better be too. *)\n \"\\(a, auth', ep) \\ g; auth' \\ {Notify,SyncSend,Reset};\n (t, auth, ep) \\ g; auth \\ {SyncSend, Receive}; \n t \\ subjectReads g l\\\n \\ ep \\ subjectReads g l\" |\n (* if someone, t, can write to a page, and the page is in l's domain, that the\n writer better be too. This is needed for when the page is t's ipc buffer,\n and t is blocked on an IPC and the other party completes the operation.\n The affects caused to the page in question naturally depend on t's state,\n so if the page is part of l's domain, t better be too. *)\n reads_read_page_read_thread:\n \"\\b \\ subjectReads g l; (t,Write,b) \\ g\\ \\ \n t \\ subjectReads g l\" |\n (* This is the symmetric case for the rule reads_read_page_read_thread.\n Here now suppose t is a sender of an IPC and p is its IPC buffer, to which\n it necessarily has Read authority. Suppose t is blocked waiting to complete\n the send, and the receiver completes the rendezvous. \n IF t is in l's domain, then the IPC buffer had better be too, since it\n will clearly be read during the operation to send the IPC *)\n reads_read_thread_read_pages:\n \"\\t \\ subjectReads g l; (t,Read,p) \\ g\\ \\ \n p \\ subjectReads g l\" |\n (* This rule allows domain l to read from all senders to synchronous endpoints\n for all such endpoints in its domain. This is needed for when someone\n does a receive (for which a sender is already blocked) or reset on the ep.\n The affects on the ep here will depend on the state of any blocked\n senders. So if the ep is in l's domain, the senders better be too. *)\n read_sync_ep_read_senders_strong:\n \"\\ep \\ subjectReads g l; (b,SyncSend,ep) \\ g\\ \\\n b \\ subjectReads g l\" |\n (* This rule allows anyone who can read a synchronous endpoint, to also be\n able to read from its receivers. The intuition is that the state of the\n receivers can affect how the endpoint is affected. *)\n (* I'm not convinced that this rule is strictly necessary. I think that\n the specific state of the receiver doesn't affect the ep too much and\n that we could probably do away with this rule at the cost of some way more \n complex confidentiality proofs for send_ipc. We would have to prove that\n the affect on the ep is the same regardless of /who/ the reciever is\n (and which page their IPC buffer is etc.). This would involve some quite\n tedious equiv_valid_2 proofs for send_ipc and the functions it calls,\n which don't really seem worth it at the moment. *)\n (* If we removed this rule, all it would gain us I think would be the absence\n of direct edges from receiver \\ sender in the infoflow policy, but we\n would still have edges from receiver \\ ep \\ sender in either case. I\n cannot imagine a useful intransitive noninterference policy that permits\n the latter case but not the former, so the extra cost of doing away with\n this rule does not seem worth it IMO. *)\n read_sync_ep_read_receivers_strong:\n \"\\ep \\ subjectReads g l; (b,Receive,ep) \\ g\\ \\\n b \\ subjectReads g l\"\n\n\nlemma read_sync_ep_read_senders:\n \"\\(a,auth,ep) \\ g; auth \\ {Reset,Receive};\n ep \\ subjectReads g l; (b,SyncSend,ep) \\ g\\ \\\n b \\ subjectReads g l\"\n by (rule read_sync_ep_read_senders_strong)\n\nlemma read_sync_ep_read_receivers:\n \"\\(a,auth,ep) \\ g; auth \\ {SyncSend};\n ep \\ subjectReads g l; (b,Receive,ep) \\ g\\ \\\n b \\ subjectReads g l\"\n by (rule read_sync_ep_read_receivers_strong)\n \n\nabbreviation aag_can_read :: \"'a PAS \\ word32 \\ bool\"\nwhere\n\"aag_can_read aag x \\ (pasObjectAbs aag x) \\ subjectReads (pasPolicy aag) (pasSubject aag)\"\n\nabbreviation aag_can_read_irq :: \"'a PAS \\ 10 word \\ bool\"\nwhere\n\"aag_can_read_irq aag x \\ (pasIRQAbs aag x) \\ subjectReads (pasPolicy aag) (pasSubject aag)\"\n\nabbreviation aag_can_read_asid :: \"'a PAS \\ asid \\ bool\"\nwhere\n\"aag_can_read_asid aag x \\ (pasASIDAbs aag x) \\ subjectReads (pasPolicy aag) (pasSubject aag)\"\n\nabbreviation aag_can_read_domain :: \"'a PAS \\ domain \\ bool\"\nwhere\n\"aag_can_read_domain aag x \\ (pasDomainAbs aag x) \\ subjectReads (pasPolicy aag) (pasSubject aag)\"\n\nlemma aag_can_read_self:\n \"is_subject aag x \\ aag_can_read aag x\"\n apply(fastforce intro: reads_lrefl)\n done\n\nlemma aag_can_read_read:\n \"aag_has_auth_to aag Read x \\ aag_can_read aag x\"\n apply(fastforce intro: reads_read)\n done\n\nlemma aag_can_read_irq_self:\n \"is_subject_irq aag x \\ aag_can_read_irq aag x\"\n apply(fastforce intro: reads_lrefl)\n done\n\ndefinition equiv_for where\n \"equiv_for P f c c' \\ \\ x. P x \\ f c x = f c' x\"\n\nlemma equiv_forE:\n assumes e: \"equiv_for P f c c'\"\n assumes r: \"(\\ x. P x \\ f c x = f c' x) \\ R\"\n shows \"R\"\n apply(rule r)\n apply(erule e[simplified equiv_for_def, rule_format])\n done\n\nlemma equiv_forI:\n \"(\\ x. P x \\ f c x = f c' x) \\ equiv_for P f c c'\"\n by(simp add: equiv_for_def)\n\nlemma equiv_forD:\n \"equiv_for P f c c' \\ P x \\ f c x = f c' x\"\n apply(blast elim: equiv_forE)\n done\n\n\nabbreviation equiv_machine_state :: \"(word32 \\ bool) \\ 'a machine_state_scheme \\ 'a machine_state_scheme \\ bool\" where\n \"equiv_machine_state P s s' \\ equiv_for (\\ x. P x) underlying_memory s s' \\ equiv_for (\\ x. P x ) device_state s s'\"\n\ndefinition equiv_asid :: \"asid \\ det_ext state \\ det_ext state \\ bool\"\nwhere\n \"equiv_asid asid s s' \\ \n ((arm_asid_table (arch_state s) (asid_high_bits_of asid)) = \n (arm_asid_table (arch_state s') (asid_high_bits_of asid))) \\ \n (\\ pool_ptr. \n arm_asid_table (arch_state s) (asid_high_bits_of asid) = Some pool_ptr \\\n asid_pool_at pool_ptr s = asid_pool_at pool_ptr s' \\ \n (\\ asid_pool asid_pool'. \n kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \\ \n kheap s' pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \\ asid_pool (ucast asid) = asid_pool' (ucast asid)))\"\n\n\ndefinition equiv_asid' where\n \"equiv_asid' asid pool_ptr_opt pool_ptr_opt' kh kh' \\ \n (case pool_ptr_opt of None \\ pool_ptr_opt' = None\n | Some pool_ptr \\ \n (case pool_ptr_opt' of None \\ False \n | Some pool_ptr' \\\n (pool_ptr' = pool_ptr \\ \n ((\\ asid_pool. kh pool_ptr = Some (ArchObj (ASIDPool asid_pool))) = \n (\\ asid_pool'. kh' pool_ptr' = Some (ArchObj (ASIDPool asid_pool')))) \\ \n (\\ asid_pool asid_pool'. \n kh pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \\ \n kh' pool_ptr' = Some (ArchObj (ASIDPool asid_pool')) \\ asid_pool (ucast asid) = asid_pool' (ucast asid)))\n )\n )\"\n\nlemma asid_pool_at_kheap:\n \"asid_pool_at ptr s = (\\ asid_pool. kheap s ptr = Some (ArchObj (ASIDPool asid_pool)))\"\n apply(clarsimp simp: obj_at_def)\n apply(rule iffI)\n apply(erule exE, rename_tac ko, clarsimp) \n apply (clarsimp simp: a_type_simps)\n done\n\nlemma equiv_asid:\n \"equiv_asid asid s s' = equiv_asid' asid (arm_asid_table (arch_state s) (asid_high_bits_of asid)) (arm_asid_table (arch_state s') (asid_high_bits_of asid)) (kheap s) (kheap s')\"\n apply(auto simp: equiv_asid_def equiv_asid'_def split: option.splits simp: asid_pool_at_kheap)\n done\n\n\ndefinition equiv_asids :: \"(asid \\ bool) \\ det_ext state \\ det_ext state \\ bool\" where\n \"equiv_asids R s s' \\ \\ asid. asid \\ 0 \\ R asid \\ equiv_asid asid s s'\"\n\nlemma equiv_asids_refl:\n \"equiv_asids R s s\"\n apply(auto simp: equiv_asids_def equiv_asid_def)\n done\n\nlemma equiv_asids_sym:\n \"equiv_asids R s t \\ equiv_asids R t s\"\n apply(auto simp: equiv_asids_def equiv_asid_def)\n done\n\nlemma equiv_asids_trans:\n \"\\equiv_asids R s t; equiv_asids R t u\\ \\ equiv_asids R s u\"\n apply(fastforce simp: equiv_asids_def equiv_asid_def asid_pool_at_kheap)\n done\n\n\ndefinition non_asid_pool_kheap_update where\n \"non_asid_pool_kheap_update s kh \\ \n \\ x. (\\ asid_pool. kheap s x = Some (ArchObj (ASIDPool asid_pool)) \\ kh x = Some (ArchObj (ASIDPool asid_pool))) \\ kheap s x = kh x\"\n\ndefinition identical_updates where\n\"identical_updates k k' kh kh' \\ \\x. (kh x \\ kh' x \\ (k x = kh x \\ k' x = kh' x))\"\n\nabbreviation identical_kheap_updates where\n\"identical_kheap_updates s s' kh kh' \\ identical_updates (kheap s) (kheap s') kh kh'\"\n\nabbreviation identical_ekheap_updates where\n\"identical_ekheap_updates s s' kh kh' \\ identical_updates (ekheap s) (ekheap s') kh kh'\"\n\nlemmas identical_kheap_updates_def = identical_updates_def\nlemmas identical_ekheap_updates_def = identical_updates_def\n\nlemma equiv_asids_non_asid_pool_kheap_update:\n \"\\equiv_asids R s s'; \n non_asid_pool_kheap_update s kh; non_asid_pool_kheap_update s' kh'\\ \\\n equiv_asids R (s\\kheap := kh\\) (s'\\kheap := kh'\\)\"\n apply(clarsimp simp: equiv_asids_def equiv_asid non_asid_pool_kheap_update_def)\n apply(fastforce simp: equiv_asid'_def split: option.splits)\n done\n\nlemma equiv_asids_identical_kheap_updates:\n \"\\equiv_asids R s s'; \n identical_kheap_updates s s' kh kh'\\ \\\n equiv_asids R (s\\kheap := kh\\) (s'\\kheap := kh'\\)\"\n apply(clarsimp simp: equiv_asids_def identical_kheap_updates_def)\n apply(clarsimp simp: equiv_asid_def asid_pool_at_kheap)\n apply(case_tac \"kh pool_ptr = kh' pool_ptr\")\n apply fastforce\n apply fastforce\n done\n\nlemma equiv_asids_triv:\n \"\\equiv_asids R s s'; \n kheap t = kheap s; arm_asid_table (arch_state t) = arm_asid_table (arch_state s);\n kheap t' = kheap s'; arm_asid_table (arch_state t') = arm_asid_table (arch_state s')\\ \\\n equiv_asids R t t'\"\n apply(fastforce simp: equiv_asids_def equiv_asid equiv_asid'_def) \n done\n\n(* The parameter X here allows us to exclude a (state-dependant) portion of the\n underlying_memory from the equivalence realtions. This is used to exclude\n the contents of the globals_frame, which we include later in the overall\n equivalence relation only for the domain of the current thread. We want to\n easily exclude it for everyone else though, which is why this X parameter\n is included here. *)\n\n\ndefinition states_equiv_for :: \"(word32 \\ bool) \\ (10 word \\ bool) \\ (asid \\ bool) \\ (domain \\ bool) \\ det_state \\ det_state \\ bool\"\nwhere\n\"states_equiv_for P Q R S s s' \\\n equiv_for P kheap s s' \\\n equiv_machine_state P (machine_state s) (machine_state s') \\\n equiv_for (P \\ fst) cdt s s' \\\n equiv_for P ekheap s s' \\ \n equiv_for (P \\ fst) cdt_list s s' \\\n equiv_for (P \\ fst) is_original_cap s s' \\\n equiv_for Q interrupt_states s s' \\\n equiv_for Q interrupt_irq_node s s' \\ \n equiv_for S ready_queues s s' \\\n equiv_asids R s s'\"\n\nlemma equiv_for_comp:\n \"equiv_for P (f \\ g) s s' = equiv_for P f (g s) (g s')\"\n apply(simp add: equiv_for_def)\n done\n\nlemma states_equiv_forI:\n \"\\equiv_for P kheap s s';\n equiv_machine_state P (machine_state s) (machine_state s');\n equiv_for (P \\ fst) cdt s s';\n equiv_for P ekheap s s'; \n equiv_for (P \\ fst) cdt_list s s';\n equiv_for (P \\ fst) is_original_cap s s';\n equiv_for Q interrupt_states s s';\n equiv_for Q interrupt_irq_node s s';\n equiv_asids R s s';\n equiv_for S ready_queues s s'\\ \\\n states_equiv_for P Q R S s s'\"\n by(auto simp: states_equiv_for_def)\n\n\nlemma states_equiv_for_machine_state_update:\n \"\\states_equiv_for P Q R S s s'; equiv_machine_state P kh kh'\\ \\\n states_equiv_for P Q R S (s\\ machine_state := kh \\) (s'\\ machine_state := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI \n elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_non_asid_pool_kheap_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for P id kh kh';\n non_asid_pool_kheap_update s kh; non_asid_pool_kheap_update s' kh'\\ \\\n states_equiv_for P Q R S (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_non_asid_pool_kheap_update)\n done\n\nlemma states_equiv_for_identical_kheap_updates:\n \"\\states_equiv_for P Q R S s s';\n identical_kheap_updates s s' kh kh'\\ \\\n states_equiv_for P Q R S (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(clarsimp simp: states_equiv_for_def)\n apply(auto elim!: equiv_forE intro!: equiv_forI elim!: equiv_asids_identical_kheap_updates simp: identical_kheap_updates_def)\n done\n\nlemma states_equiv_for_cdt_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for (P \\ fst) id kh kh'\\ \\\n states_equiv_for P Q R S (s\\ cdt := kh \\) (s'\\ cdt := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\n\nlemma states_equiv_for_cdt_list_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for (P \\ fst) id (kh (cdt_list s)) (kh' (cdt_list s'))\\ \\\n states_equiv_for P Q R S (cdt_list_update kh s) (cdt_list_update kh' s')\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_identical_ekheap_updates:\n \"\\states_equiv_for P Q R S s s';\n identical_ekheap_updates s s' (kh (ekheap s)) (kh' (ekheap s'))\\ \\\n states_equiv_for P Q R S (ekheap_update kh s) (ekheap_update kh' s')\"\n apply (clarsimp simp add: identical_ekheap_updates_def equiv_for_def states_equiv_for_def equiv_asids_def equiv_asid_def)\n apply fastforce\n done\n\nlemma states_equiv_for_ekheap_update:\n \"\\states_equiv_for P Q R S s s';\n equiv_for P id (kh (ekheap s)) (kh' (ekheap s'))\\ \\\n states_equiv_for P Q R S (ekheap_update kh s) (ekheap_update kh' s')\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_is_original_cap_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for (P \\ fst) id kh kh'\\ \\\n states_equiv_for P Q R S (s\\ is_original_cap := kh \\) (s'\\ is_original_cap := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_interrupt_states_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for Q id kh kh'\\ \\\n states_equiv_for P Q R S (s\\ interrupt_states := kh \\) (s'\\ interrupt_states := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_interrupt_irq_node_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for Q id kh kh'\\ \\\n states_equiv_for P Q R S (s\\ interrupt_irq_node := kh \\) (s'\\ interrupt_irq_node := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_for_ready_queues_update:\n \"\\states_equiv_for P Q R S s s'; equiv_for S id kh kh'\\ \\\n states_equiv_for P Q R S (s\\ ready_queues := kh \\) (s'\\ ready_queues := kh' \\)\"\n apply(fastforce simp: states_equiv_for_def elim: equiv_forE intro: equiv_forI elim!: equiv_asids_triv)\n done\n\nlemma states_equiv_forE:\n assumes sef: \"states_equiv_for P Q R S s s'\"\n assumes e: \"\\equiv_machine_state P (machine_state s) (machine_state s');\n equiv_for P kheap s s';\n equiv_for (P \\ fst) cdt s s'; \n equiv_for (P \\ fst) cdt_list s s';\n equiv_for P ekheap s s';\n equiv_for (P \\ fst) is_original_cap s s';\n equiv_for Q interrupt_states s s'; equiv_for Q interrupt_irq_node s s';\n equiv_asids R s s';\n equiv_for S ready_queues s s'\\ \\ Z\"\n shows \"Z\"\n apply(rule e)\n using sef[simplified states_equiv_for_def] by auto\n\nlemma equiv_for_apply: \"equiv_for P g (f s) (f s') = equiv_for P (g o f) s s'\"\n apply (simp add: equiv_for_def)\n done\n\n\nlemma states_equiv_forE_kheap:\n \"\\states_equiv_for P Q R S s s'; (\\ x. P x \\ kheap s x = kheap s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_mem:\n \"\\states_equiv_for P Q R S s s';\n (\\ x. \\P x\\\n \\ (underlying_memory (machine_state s)) x = (underlying_memory (machine_state s')) x\n \\ (device_state (machine_state s)) x = (device_state (machine_state s')) x) \\ Z\\ \\ Z\"\n apply (clarsimp simp: states_equiv_for_def elim: equiv_forE)\n apply (elim equiv_forE)\n apply fastforce\n done\n\nlemma states_equiv_forE_cdt:\n \"\\states_equiv_for P Q R S s s'; (\\ x. P (fst x) \\ cdt s x = cdt s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_cdt_list:\n \"\\states_equiv_for P Q R S s s'; (\\ x. P (fst x) \\ cdt_list s x = cdt_list s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_ekheap:\n \"\\states_equiv_for P Q R S s s'; (\\ x. P x \\ ekheap s x = ekheap s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_is_original_cap:\n \"\\states_equiv_for P Q R S s s'; (\\ x. P (fst x) \\ is_original_cap s x = is_original_cap s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_interrupt_states:\n \"\\states_equiv_for P Q R S s s'; (\\ x. Q x \\ interrupt_states s x = interrupt_states s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_interrupt_irq_node:\n \"\\states_equiv_for P Q R S s s'; (\\ x. Q x \\ interrupt_irq_node s x = interrupt_irq_node s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma states_equiv_forE_ready_queues:\n \"\\states_equiv_for P Q R S s s'; (\\ x. S x \\ ready_queues s x = ready_queues s' x) \\ Z\\ \\ Z\"\n by(auto simp: states_equiv_for_def elim: equiv_forE)\n\nlemma equiv_for_refl:\n \"equiv_for P f s s\"\n by(auto simp: equiv_for_def)\n\nlemma equiv_for_sym:\n \"equiv_for P f s t \\ equiv_for P f t s\"\n by(auto simp: equiv_for_def)\n\nlemma equiv_for_trans:\n \"\\equiv_for P f s t; equiv_for P f t u\\ \\\n equiv_for P f s u\"\n by(auto simp: equiv_for_def)\n\n\nlemma states_equiv_for_refl:\n \"states_equiv_for P Q R S s s\"\n by(auto simp: states_equiv_for_def intro: equiv_for_refl equiv_asids_refl)\n\n\nlemma states_equiv_for_sym:\n \"states_equiv_for P Q R S s t \\ states_equiv_for P Q R S t s\"\n apply(auto simp: states_equiv_for_def intro: equiv_for_sym equiv_asids_sym simp: equiv_for_def)\n done\n\n\nlemma states_equiv_for_trans:\n \"\\states_equiv_for P Q R S s t; states_equiv_for P Q R S t u\\ \\\n states_equiv_for P Q R S s u\"\n apply(auto simp: states_equiv_for_def intro: equiv_for_trans equiv_asids_trans intro: equiv_forI elim: equiv_forE)\n done\n\n\nlemma or_comp_dist:\n \"(A or B) \\ f = (A \\ f or B \\ f)\"\n apply(simp add: pred_disj_def comp_def)\n done\n\nlemma equiv_for_or:\n \"equiv_for (A or B) f c c' = (equiv_for A f c c' \\ equiv_for B f c c')\"\n apply(fastforce simp: equiv_for_def)\n done\n\nlemma equiv_for_id_update:\n \"equiv_for P id c c' \\\n equiv_for P id (c(x := v)) (c'(x := v))\"\n apply(simp add: equiv_for_def)\n done\n\n(* globals_equiv should be maintained by everything except the scheduler, since\n nothing else touches the globals frame *)\n\ndefinition idle_equiv :: \"('z :: state_ext) state \\ ('z :: state_ext) state \\ bool\" where\n\"idle_equiv s s' \\ idle_thread s = idle_thread s' \\\n (\\tcb tcb'. kheap s (idle_thread s) = Some (TCB tcb) \\\n kheap s' (idle_thread s) = Some (TCB tcb') \\\n arch_tcb_context_get (tcb_arch tcb) = arch_tcb_context_get (tcb_arch tcb')) \\\n (tcb_at (idle_thread s) s \\ tcb_at (idle_thread s) s')\"\n\nlemma idle_equiv_refl: \"idle_equiv s s\"\n apply (simp add: idle_equiv_def)\n done\n\nlemma idle_equiv_sym: \"idle_equiv s s' \\ idle_equiv s' s\"\n apply (clarsimp simp add: idle_equiv_def)\n done\n\nlemma idle_equiv_trans: \"idle_equiv s s' \\ idle_equiv s' s'' \\ idle_equiv s s''\"\n apply (clarsimp simp add: idle_equiv_def tcb_at_def get_tcb_def split: option.splits\n kernel_object.splits)\n done\n\nabbreviation exclusive_state_equiv where\n \"exclusive_state_equiv s s' \\\n exclusive_state (machine_state s) = exclusive_state (machine_state s')\"\n\n(* cur_thread is included here also to enforce this being an equivalence relation *)\ndefinition globals_equiv :: \"('z :: state_ext) state \\ ('z :: state_ext) state \\ bool\" where\n \"globals_equiv s s' \\ \n arm_global_pd (arch_state s) = arm_global_pd (arch_state s') \\\n kheap s (arm_global_pd (arch_state s)) = kheap s' (arm_global_pd (arch_state s)) \\\n idle_equiv s s' \\ dom (device_state (machine_state s)) = dom (device_state (machine_state s')) \\\n cur_thread s = cur_thread s' \\\n (cur_thread s \\ idle_thread s \\ exclusive_state_equiv s s')\n \"\n\n(* Basically defines the domain of the current thread, excluding globals.\n This also includes the things that are in the scheduler's domain, which\n the current domain is always allowed to read. *)\ndefinition reads_equiv :: \"'a PAS \\ det_state \\ det_state \\ bool\" where\n\"reads_equiv aag s s' \\ \n ((\\ d\\subjectReads (pasPolicy aag) (pasSubject aag). \n states_equiv_for (\\x. pasObjectAbs aag x = d) (\\x. pasIRQAbs aag x = d) (\\x. pasASIDAbs aag x = d) (\\x. pasDomainAbs aag x = d) s s') \\\n cur_thread s = cur_thread s' \\ cur_domain s = cur_domain s' \\ scheduler_action s = scheduler_action s' \\ work_units_completed s = work_units_completed s' \\ irq_state (machine_state s) = irq_state (machine_state s'))\"\n\n(* this is the main equivalence we want to be maintained, since it defines\n everything the current thread can read from; however, we'll deal with\n reads_equiv in the reads_respects proofs, since globals_equiv is always preserved\n*)\n\ndefinition reads_equiv_g :: \"'a PAS \\ det_state \\ det_state \\ bool\" where\n\"reads_equiv_g aag s s' \\ \n reads_equiv aag s s' \\ globals_equiv s s'\"\n\nlemma reads_equiv_def2:\n \"reads_equiv aag s s' =\n (states_equiv_for (aag_can_read aag) (aag_can_read_irq aag) (aag_can_read_asid aag) (aag_can_read_domain aag) s s' \\ cur_thread s = cur_thread s' \\ cur_domain s = cur_domain s' \\ scheduler_action s = scheduler_action s' \\ work_units_completed s = work_units_completed s' \\ irq_state (machine_state s) = irq_state (machine_state s'))\"\n apply(rule iffI)\n apply(auto simp: reads_equiv_def equiv_for_def states_equiv_for_def intro: reads_lrefl simp: equiv_asids_def)\n done\n\nlemma reads_equivE:\n assumes sef: \"reads_equiv aag s s'\"\n assumes e: \"\\equiv_for (aag_can_read aag) kheap s s'; \n equiv_machine_state (aag_can_read aag) (machine_state s) (machine_state s');\n equiv_for ((aag_can_read aag) \\ fst) cdt s s';\n equiv_for ((aag_can_read aag) \\ fst) cdt_list s s';\n equiv_for (aag_can_read aag) ekheap s s';\n equiv_for ((aag_can_read aag) \\ fst) is_original_cap s s'; equiv_for (aag_can_read_irq aag) interrupt_states s s';\n equiv_for (aag_can_read_irq aag) interrupt_irq_node s s'; \n equiv_asids (aag_can_read_asid aag) s s'; \n equiv_for (aag_can_read_domain aag) ready_queues s s'; cur_thread s = cur_thread s'; cur_domain s = cur_domain s'; scheduler_action s = scheduler_action s'; work_units_completed s = work_units_completed s'; irq_state (machine_state s) = irq_state (machine_state s')\\ \\ R\"\n shows \"R\"\n apply(rule e)\n apply(insert sef)\n apply(auto simp: reads_equiv_def2 elim: states_equiv_forE)\n done\n\nlemma reads_equiv_machine_state_update:\n \"\\reads_equiv aag s s'; equiv_machine_state (aag_can_read aag) kh kh'; irq_state kh = irq_state kh'\\ \\\n reads_equiv aag (s\\ machine_state := kh \\) (s'\\ machine_state := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_machine_state_update)\n done\n\nlemma reads_equiv_non_asid_pool_kheap_update:\n \"\\reads_equiv aag s s'; equiv_for (aag_can_read aag) id kh kh';\n non_asid_pool_kheap_update s kh; non_asid_pool_kheap_update s' kh'\\ \\\n reads_equiv aag (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_non_asid_pool_kheap_update)\n done\n\nlemma reads_equiv_identical_kheap_updates:\n \"\\reads_equiv aag s s'; \n identical_kheap_updates s s' kh kh'\\ \\\n reads_equiv aag (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_identical_kheap_updates)\n done\n\n\nlemma reads_equiv_cdt_update:\n \"\\reads_equiv aag s s'; equiv_for ((aag_can_read aag) \\ fst) id kh kh'\\ \\\n reads_equiv aag (s\\ cdt := kh \\) (s'\\ cdt := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_cdt_update)\n done\n\n\nlemma reads_equiv_cdt_list_update:\n \"\\reads_equiv aag s s'; equiv_for ((aag_can_read aag) \\ fst) id (kh (cdt_list s)) (kh' (cdt_list s'))\\ \\\n reads_equiv aag (cdt_list_update kh s) (cdt_list_update kh' s')\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_cdt_list_update)\n done\n\nlemma reads_equiv_identical_ekheap_updates:\n \"\\reads_equiv aag s s'; identical_ekheap_updates s s' (kh (ekheap s)) (kh' (ekheap s'))\\ \\\n reads_equiv aag (ekheap_update kh s) (ekheap_update kh' s')\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_identical_ekheap_updates)\n done\n\nlemma reads_equiv_ekheap_updates:\n \"\\reads_equiv aag s s'; equiv_for (aag_can_read aag) id (kh (ekheap s)) (kh' (ekheap s')) \\ \\\n reads_equiv aag (ekheap_update kh s) (ekheap_update kh' s')\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_ekheap_update)\n done\n\nlemma reads_equiv_is_original_cap_update:\n \"\\reads_equiv aag s s'; equiv_for ((aag_can_read aag) \\ fst) id kh kh'\\ \\\n reads_equiv aag (s\\ is_original_cap := kh \\) (s'\\ is_original_cap := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_is_original_cap_update)\n done\n\nlemma reads_equiv_interrupt_states_update:\n \"\\reads_equiv aag s s'; equiv_for (aag_can_read_irq aag) id kh kh'\\ \\\n reads_equiv aag (s\\ interrupt_states := kh \\) (s'\\ interrupt_states := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_interrupt_states_update)\n done\n\nlemma reads_equiv_interrupt_irq_node_update:\n \"\\reads_equiv aag s s'; equiv_for (aag_can_read_irq aag) id kh kh'\\ \\\n reads_equiv aag (s\\ interrupt_irq_node := kh \\) (s'\\ interrupt_irq_node := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_interrupt_irq_node_update)\n done\n\nlemma reads_equiv_ready_queues_update:\n \"\\reads_equiv aag s s'; equiv_for (aag_can_read_domain aag) id kh kh'\\ \\\n reads_equiv aag (s\\ ready_queues := kh \\) (s'\\ ready_queues := kh' \\)\"\n apply(fastforce simp: reads_equiv_def2 intro: states_equiv_for_ready_queues_update)\n done\n\nlemma reads_equiv_scheduler_action_update:\n \"reads_equiv aag s s' \\\n reads_equiv aag (s\\ scheduler_action := kh \\) (s'\\ scheduler_action := kh \\)\"\n apply(fastforce simp: reads_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\nlemma reads_equiv_work_units_completed_update:\n \"reads_equiv aag s s' \\\n reads_equiv aag (s\\ work_units_completed := kh \\) (s'\\ work_units_completed := kh \\)\"\n apply(fastforce simp: reads_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\nlemma reads_equiv_work_units_completed_update':\n \"reads_equiv aag s s' \\\n reads_equiv aag (s\\ work_units_completed := (f (work_units_completed s)) \\) (s'\\ work_units_completed := (f (work_units_completed s')) \\)\"\n apply(fastforce simp: reads_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\ntext {*\n This defines the other labels of the authority graph that subject l can\n affect, i.e. if there is some part of the state that carries a label l', and\n through the actions of l, this state can be modified, then we say that the\n label l' can be affected by l. This is, of course, just a more coarse \n statement of the integrity property from the access proofs.\n\n The case in which @{thm tro_asidpool_clear} is covered when the graph is wellformed\n since, in this case, the subject has Control rights to the asid.\n*}\ninductive_set subjectAffects :: \"'a auth_graph \\ 'a \\ 'a set\"\nfor g :: \"'a auth_graph\" and l :: \"'a\" where\n affects_lrefl:\n \"l \\ subjectAffects g l\" |\n affects_write:\n \"\\(l,auth,l') \\ g; auth \\ {Control, Write}\\ \\\n l' \\ subjectAffects g l\" |\n affects_ep:\n \"\\(l,auth,l') \\ g; auth \\ {Receive, Notify, SyncSend, Reset}\\ \\\n l' \\ subjectAffects g l\" |\n (* ipc buffer is not necessary owned by thread *)\n affects_send:\n \"\\(l,auth,ep) \\ g; auth \\ {SyncSend, Notify}; (l',Receive,ep) \\ g;\n (l',Write,l'') \\ g\\ \\\n l'' \\ subjectAffects g l\" |\n (* synchronous sends provide a back-channel from receiver to sender *)\n affects_recv:\n \"\\(l,Receive,ep) \\ g; (l',SyncSend,ep) \\ g\\ \\\n l' \\ subjectAffects g l\" |\n (* integrity definitions allow resets to modify ipc buffer *)\n affects_reset:\n \"\\(l,Reset,ep) \\ g; (l',auth,ep) \\ g; auth \\ {SyncSend, Receive};\n (l',Write,l'') \\ g\\ \\\n l'' \\ subjectAffects g l\" |\n (* if you alter an asid mapping, you affect the domain who owns that asid *)\n affects_asidpool_map:\n \"(l,ASIDPoolMapsASID,l') \\ g \\ l' \\ subjectAffects g l\" |\n (* if you are sending to an ntfn, which is bound to a tcb that is\n receive blocked on an ep, then you can affect that ep *)\n affects_ep_bound_trans:\n \"\\\\tcb ntfn. (tcb, Receive, ntfn) \\ g \\ (tcb, Receive, ep) \\ g \\\n (l, Notify, ntfn) \\ g\\ \\\n ep \\ subjectAffects g l\"\n\n(* We define when the current subject can affect another domain whose label is\n l. This occurs when the current subject can affect some label d that is \n considered to be part of what domain l can read. *)\ndefinition aag_can_affect_label where\n \"aag_can_affect_label aag l \\ \\ d. d \\ subjectAffects (pasPolicy aag) (pasSubject aag) \\ d \\ subjectReads (pasPolicy aag) l\"\n\nlemma aag_can_affect_labelI[intro!]:\n \"\\d \\ subjectAffects (pasPolicy aag) (pasSubject aag); d \\ subjectReads (pasPolicy aag) l\\ \\ aag_can_affect_label aag l\"\n apply(auto simp: aag_can_affect_label_def)\n done\n\n(* Defines when two states are equivalent for some domain l that can be affected\n by the current subject. When the current subject cannot affect domain l,\n we relate all states. *)\ndefinition affects_equiv :: \"'a PAS \\ 'a \\ det_state \\ det_state \\ bool\"\nwhere\n\"affects_equiv aag l s s' \\ (if (aag_can_affect_label aag l) then (states_equiv_for (\\ x. pasObjectAbs aag x \\ subjectReads (pasPolicy aag) l) (\\x. pasIRQAbs aag x \\ subjectReads (pasPolicy aag) l) (\\ x. pasASIDAbs aag x \\ subjectReads (pasPolicy aag) l) (\\x. pasDomainAbs aag x \\ subjectReads (pasPolicy aag) l) s s') else True)\"\n\n\nlemma equiv_for_trivial:\n \"(\\ x. P x \\ False) \\ equiv_for P f c c'\"\n apply(auto simp: equiv_for_def)\n done\n\nlemma equiv_asids_trivial:\n \"(\\ x. P x \\ False) \\ equiv_asids P x y\"\n apply(auto simp: equiv_asids_def)\n done\n\nabbreviation aag_can_affect where\n \"aag_can_affect aag l \\ \\x. aag_can_affect_label aag l \\ pasObjectAbs aag x \\ subjectReads (pasPolicy aag) l\"\n\nabbreviation aag_can_affect_irq where\n \"aag_can_affect_irq aag l \\ \\x. aag_can_affect_label aag l \\ pasIRQAbs aag x \\ subjectReads (pasPolicy aag) l\"\n\nabbreviation aag_can_affect_asid where\n \"aag_can_affect_asid aag l \\ \\x. aag_can_affect_label aag l \\ pasASIDAbs aag x \\ subjectReads (pasPolicy aag) l\"\n\nabbreviation aag_can_affect_domain where\n \"aag_can_affect_domain aag l \\ \\x. aag_can_affect_label aag l \\ pasDomainAbs aag x \\ subjectReads (pasPolicy aag) l\"\n\n\nlemma affects_equiv_def2:\n \"affects_equiv aag l s s' = states_equiv_for (aag_can_affect aag l) (aag_can_affect_irq aag l) (aag_can_affect_asid aag l) (aag_can_affect_domain aag l) s s'\"\n apply(clarsimp simp: affects_equiv_def)\n apply(auto intro!: states_equiv_forI equiv_for_trivial equiv_asids_trivial elim: states_equiv_forE)\n done\n\nlemma affects_equivE:\n assumes sef: \"affects_equiv aag l s s'\"\n assumes e: \"\\equiv_for (aag_can_affect aag l) kheap s s'; \n equiv_machine_state (aag_can_affect aag l) (machine_state s) (machine_state s');\n equiv_for ((aag_can_affect aag l) \\ fst) cdt s s';\n equiv_for ((aag_can_affect aag l) \\ fst) cdt_list s s';\n equiv_for (aag_can_affect aag l) ekheap s s';\n equiv_for ((aag_can_affect aag l) \\ fst) is_original_cap s s'; equiv_for (aag_can_affect_irq aag l) interrupt_states s s'; equiv_for (aag_can_affect_irq aag l) interrupt_irq_node s s'; equiv_asids (aag_can_affect_asid aag l) s s'; equiv_for (aag_can_affect_domain aag l) ready_queues s s'\\ \\ Z\"\n shows \"Z\"\n apply(rule e)\n apply(insert sef)\n apply(auto simp: affects_equiv_def2 elim: states_equiv_forE)\n done\n\nlemma affects_equiv_machine_state_update:\n \"\\affects_equiv aag l s s'; equiv_machine_state (aag_can_affect aag l) kh kh'\\ \\\n affects_equiv aag l (s\\ machine_state := kh \\) (s'\\ machine_state := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_machine_state_update)\n done\n\nlemma affects_equiv_non_asid_pool_kheap_update:\n \"\\affects_equiv aag l s s'; equiv_for (aag_can_affect aag l) id kh kh';\n non_asid_pool_kheap_update s kh; non_asid_pool_kheap_update s' kh'\\ \\\n affects_equiv aag l (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_non_asid_pool_kheap_update)\n done\n \n\nlemma affects_equiv_identical_kheap_updates:\n \"\\affects_equiv aag l s s'; \n identical_kheap_updates s s' kh kh'\\ \\\n affects_equiv aag l (s\\ kheap := kh \\) (s'\\ kheap := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_identical_kheap_updates)\n done\n\nlemma affects_equiv_cdt_update:\n \"\\affects_equiv aag l s s'; equiv_for ((aag_can_affect aag l) \\ fst) id kh kh'\\ \\\n affects_equiv aag l (s\\ cdt := kh \\) (s'\\ cdt := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_cdt_update)\n done\n\nlemma affects_equiv_cdt_list_update:\n \"\\affects_equiv aag l s s'; equiv_for ((aag_can_affect aag l) \\ fst) id (kh (cdt_list s)) (kh' (cdt_list s'))\\ \\\n affects_equiv aag l (cdt_list_update kh s) (cdt_list_update kh' s')\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_cdt_list_update)\n done\n\nlemma affects_equiv_identical_ekheap_updates:\n \"\\affects_equiv aag l s s'; identical_ekheap_updates s s' (kh (ekheap s)) (kh' (ekheap s'))\\ \\\n affects_equiv aag l (ekheap_update kh s) (ekheap_update kh' s')\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_identical_ekheap_updates)\n done\n\nlemma affects_equiv_ekheap_update:\n \"\\affects_equiv aag l s s'; equiv_for (aag_can_affect aag l) id (kh (ekheap s)) (kh' (ekheap s')) \\ \\\n affects_equiv aag l (ekheap_update kh s) (ekheap_update kh' s')\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_ekheap_update)\n done\n\nlemma affects_equiv_is_original_cap_update:\n \"\\affects_equiv aag l s s'; equiv_for ((aag_can_affect aag l) \\ fst) id kh kh'\\ \\\n affects_equiv aag l (s\\ is_original_cap := kh \\) (s'\\ is_original_cap := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_is_original_cap_update)\n done\n\nlemma affects_equiv_interrupt_states_update:\n \"\\affects_equiv aag l s s'; equiv_for (aag_can_affect_irq aag l) id kh kh'\\ \\\n affects_equiv aag l (s\\ interrupt_states := kh \\) (s'\\ interrupt_states := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_interrupt_states_update)\n done\n\nlemma affects_equiv_interrupt_irq_node_update:\n \"\\affects_equiv aag l s s'; equiv_for (aag_can_affect_irq aag l) id kh kh'\\ \\\n affects_equiv aag l (s\\ interrupt_irq_node := kh \\) (s'\\ interrupt_irq_node := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_interrupt_irq_node_update)\n done\n\nlemma affects_equiv_ready_queues_update:\n \"\\affects_equiv aag l s s'; equiv_for (aag_can_affect_domain aag l) id kh kh'\\ \\\n affects_equiv aag l (s\\ ready_queues := kh \\) (s'\\ ready_queues := kh' \\)\"\n apply(fastforce simp: affects_equiv_def2 intro: states_equiv_for_ready_queues_update)\n done\n\nlemma affects_equiv_scheduler_action_update:\n \"affects_equiv aag l s s' \\\n affects_equiv aag l (s\\ scheduler_action := kh \\) (s'\\ scheduler_action := kh \\)\"\n apply(fastforce simp: affects_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\nlemma affects_equiv_work_units_completed_update:\n \"affects_equiv aag l s s' \\\n affects_equiv aag l (s\\ work_units_completed := kh \\) (s'\\ work_units_completed := kh \\)\"\n apply(fastforce simp: affects_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\nlemma affects_equiv_work_units_completed_update':\n \"affects_equiv aag l s s' \\\n affects_equiv aag l (s\\ work_units_completed := (f (work_units_completed s)) \\) (s'\\ work_units_completed := (f (work_units_completed s')) \\)\"\n apply(fastforce simp: affects_equiv_def2 states_equiv_for_def equiv_for_def elim!: equiv_asids_triv)\n done\n\n(* reads_equiv and affects_equiv want to be equivalence relations *)\nlemma reads_equiv_refl:\n \"reads_equiv aag s s\"\n by(auto simp: reads_equiv_def2 intro: states_equiv_for_refl equiv_asids_refl)\n\nlemma reads_equiv_sym:\n \"reads_equiv aag s t \\ reads_equiv aag t s\"\n by(auto simp: reads_equiv_def2 intro: states_equiv_for_sym equiv_asids_sym)\n\nlemma reads_equiv_trans:\n \"\\reads_equiv aag s t; reads_equiv aag t u\\ \\\n reads_equiv aag s u\"\n by(auto simp: reads_equiv_def2 intro: states_equiv_for_trans equiv_asids_trans)\n\nlemma affects_equiv_refl:\n \"affects_equiv aag l s s\"\n by(auto simp: affects_equiv_def intro: states_equiv_for_refl equiv_asids_refl)\n\nlemma affects_equiv_sym:\n \"affects_equiv aag l s t \\ affects_equiv aag l t s\"\n by(auto simp: affects_equiv_def2 intro: states_equiv_for_sym equiv_asids_sym)\n\nlemma affects_equiv_trans:\n \"\\affects_equiv aag l s t; affects_equiv aag l t u\\ \\\n affects_equiv aag l s u\"\n by(auto simp: affects_equiv_def2 intro: states_equiv_for_trans equiv_asids_trans)\n\nabbreviation\n reads_equiv_valid :: \"(det_state \\ det_state \\ bool) \\ (det_state \\ det_state \\ bool) \\ 'a PAS \\ (det_state \\ bool) \\ (det_state,'b) nondet_monad \\ bool\"\nwhere\n \"reads_equiv_valid A B aag P f \\ equiv_valid (reads_equiv aag) A B P f\"\n\nabbreviation\n reads_equiv_valid_inv where\n \"reads_equiv_valid_inv A aag P f \\ reads_equiv_valid A A aag P f\"\n\n\nabbreviation\n reads_spec_equiv_valid :: \"det_state \\ (det_state \\ det_state \\ bool) \\ (det_state \\ det_state \\ bool) \\ 'a PAS \\ (det_state \\ bool) \\ (det_state,'b) nondet_monad \\ bool\"\nwhere\n \"reads_spec_equiv_valid s A B aag P f \\ spec_equiv_valid s (reads_equiv aag) A B P f\"\n\nabbreviation reads_spec_equiv_valid_inv\nwhere\n \"reads_spec_equiv_valid_inv s A aag P f \\ reads_spec_equiv_valid s A A aag P f\"\n\n\n(* This property is essentially the confidentiality unwinding condition for\n noninterference. *)\nabbreviation reads_respects :: \"'a PAS \\ 'a \\ (det_state \\ bool) \\ (det_state,'b) nondet_monad \\ bool\"\nwhere\n\"reads_respects aag l P f \\\n reads_equiv_valid_inv (affects_equiv aag l) aag P f\"\n\nabbreviation\n spec_reads_respects :: \"det_state \\ 'a PAS \\ 'a \\ (det_state \\ bool) \\ (det_state,'b) nondet_monad \\ bool\"\nwhere\n \"spec_reads_respects s aag l P f \\ reads_spec_equiv_valid_inv s (affects_equiv aag l) aag P f\"\n\nabbreviation reads_respects_g :: \"'a PAS \\ 'a \\ (det_state \\ bool) \\ (det_state,'b) nondet_monad \\ bool\"\nwhere\n\"reads_respects_g aag l P f \\\n equiv_valid_inv (reads_equiv_g aag) (affects_equiv aag l) P f\"\n\ndefinition doesnt_touch_globals where\n \"doesnt_touch_globals P f \\ \n \\ s. P s \\ (\\(rv,s')\\fst (f s). globals_equiv s s')\"\n\nlemma globals_equivI:\n \"\\doesnt_touch_globals P f; P s; (rv,s')\\fst(f s)\\ \\ globals_equiv s s'\"\n by(fastforce simp: doesnt_touch_globals_def)\n\nlemma reads_equiv_gD:\n \"reads_equiv_g aag s s' \\ reads_equiv aag s s' \\ globals_equiv s s'\"\n by(simp add: reads_equiv_g_def)\n\nlemma reads_equiv_gI:\n \"\\reads_equiv aag s s'; globals_equiv s s'\\ \\ reads_equiv_g aag s s'\"\n by(simp add: reads_equiv_g_def)\n\nlemma globals_equiv_refl:\n \"globals_equiv s s\"\n by(simp add: globals_equiv_def idle_equiv_refl)\n\nlemma globals_equiv_sym:\n \"globals_equiv s t \\ globals_equiv t s\"\n by(auto simp: globals_equiv_def idle_equiv_def)\n\n\nlemma globals_equiv_trans:\n \"\\globals_equiv s t; globals_equiv t u\\ \\ globals_equiv s u\"\n apply (auto simp: globals_equiv_def)\n apply (metis idle_equiv_trans idle_equiv_def)+\n done\n\n(* since doesnt_touch_globals is true for all of the kernel except the scheduler,\n the following lemma shows that we can just prove reads_respects for it, and\n from there get the stronger reads_respects_g result that we need for the\n noninterference theorem *)\nlemma reads_respects_g:\n \"\\reads_respects aag l P f; doesnt_touch_globals Q f\\ \\\n reads_respects_g aag l (P and Q) f\"\n apply(clarsimp simp: equiv_valid_def2 equiv_valid_2_def)\n apply(drule reads_equiv_gD)\n apply(subgoal_tac \"globals_equiv b ba\", fastforce intro: reads_equiv_gI)\n apply(rule globals_equiv_trans)\n apply(rule globals_equiv_sym)\n apply(fastforce intro: globals_equivI)\n apply(rule globals_equiv_trans)\n apply(elim conjE, assumption)\n apply(fastforce intro: globals_equivI)\n done\n\n\n\n(* prove doesnt_touch_globals as an invariant *)\nlemma globals_equiv_invD:\n \"\\ globals_equiv st and P \\ f \\ \\_. globals_equiv st \\ \\\n \\ P and op = st \\ f \\ \\_. globals_equiv st \\\"\n apply(fastforce simp: valid_def intro: globals_equiv_refl)\n done\n\nlemma doesnt_touch_globalsI:\n assumes globals_equiv_inv: \n \"\\ st. \\ globals_equiv st and P \\ f \\ \\_. globals_equiv st \\\"\n shows \"doesnt_touch_globals P f\"\n apply(clarsimp simp: doesnt_touch_globals_def)\n apply(cut_tac st=s in globals_equiv_inv)\n apply(drule globals_equiv_invD)\n by(fastforce simp: valid_def)\n\n\n(* Slightly nicer to use version to lift up trivial cases*)\nlemma reads_respects_g_from_inv:\n \"\\reads_respects aag l P f; \\st. invariant f (globals_equiv st)\\ \\\n reads_respects_g aag l P f\"\n apply (rule equiv_valid_guard_imp)\n apply (erule reads_respects_g[where Q=\"\\s. True\"])\n apply (rule doesnt_touch_globalsI)\n apply simp+\n done\n\n\n(*Useful for chaining OFs so we don't have to re-state rules*)\nlemma reads_respects_g':\n assumes rev: \"reads_respects aag l P f\"\n assumes gev: \"\\st. \\\\ s. R (globals_equiv st s) s\\ f \\\\_. globals_equiv st\\\"\n assumes and_imp: \"\\ st s. Q st s \\ P s \\ R (globals_equiv st s) s\"\n assumes gev_imp: \"\\ st s. R (globals_equiv st s) s \\ globals_equiv st s\"\n shows\n \"reads_respects_g aag l (Q st) f\"\n apply (rule equiv_valid_guard_imp)\n apply (rule reads_respects_g[OF rev, where Q=\"\\s. R (globals_equiv st s) s\"])\n apply (rule doesnt_touch_globalsI)\n apply (rule hoare_pre)\n apply (rule gev)\n apply clarsimp\n apply (frule gev_imp)\n apply (simp add: and_imp)+\n done\n \n\nlemma equiv_for_guard_imp:\n \"\\equiv_for P f s s'; \\ x. Q x \\ P x\\ \\ equiv_for Q f s s'\"\n by(auto simp: equiv_for_def)\n\nlemma equiv_asids_guard_imp:\n \"\\equiv_asids R s s'; \\ x. Q x \\ R x\\ \\ equiv_asids Q s s'\"\n by(auto simp: equiv_asids_def)\n\nlemma states_equiv_for_guard_imp:\n \"\\states_equiv_for P Q R S s s'; \\ x. P' x \\ P x; \\ x. Q' x \\ Q x; \\ x. R' x \\ R x; \\ x. S' x \\ S x\\ \\ states_equiv_for P' Q' R' S' s s'\"\n by(auto simp: states_equiv_for_def intro: equiv_for_guard_imp equiv_asids_guard_imp)\n\nlemma cur_subject_reads_equiv_affects_equiv:\n \"pasSubject aag = l \\\n reads_equiv aag s s' \\ affects_equiv aag l s s'\"\n apply(clarsimp simp: reads_equiv_def2 affects_equiv_def simp: states_equiv_for_def)\n done\n\n(* This lemma says that, if we prove reads_respects above for all l, we will\n prove that information can flow into the domain only from what it is allowed\n to read. *)\nlemma reads_equiv_self_reads_respects:\n \"pasSubject aag = l \\\n reads_equiv_valid_inv \\\\ aag P f = reads_respects aag l P f\"\n unfolding equiv_valid_def2 equiv_valid_2_def\n apply(fastforce intro: cur_subject_reads_equiv_affects_equiv)\n done\n\nlemma requiv_get_tcb_eq[intro]:\n \"\\reads_equiv aag s t; is_subject aag thread\\ \\ get_tcb thread s = get_tcb thread t\"\n apply(auto simp: reads_equiv_def2 elim: states_equiv_forE_kheap dest!: aag_can_read_self simp: get_tcb_def split: option.split kernel_object.split)\n done\n\nlemma requiv_cur_thread_eq[intro]:\n \"reads_equiv aag s t \\ cur_thread s = cur_thread t\"\n apply (simp add: reads_equiv_def2)\n done\n\nlemma requiv_cur_domain_eq[intro]:\n \"reads_equiv aag s t \\ cur_domain s = cur_domain t\"\n apply (simp add: reads_equiv_def2)\n done\n\nlemma requiv_sched_act_eq[intro]:\n \"reads_equiv aag s t \\ scheduler_action s = scheduler_action t\"\n apply (simp add: reads_equiv_def2)\n done\n\nlemma requiv_wuc_eq[intro]:\n \"reads_equiv aag s t \\ work_units_completed s = work_units_completed t\"\n apply (simp add: reads_equiv_def2)\n done\n\nlemma set_object_reads_respects:\n \"reads_respects aag l \\ (set_object ptr obj)\"\n unfolding equiv_valid_def2 equiv_valid_2_def\n apply(clarsimp simp: set_object_def bind_def get_def put_def return_def)\n apply(fastforce intro: reads_equiv_identical_kheap_updates affects_equiv_identical_kheap_updates simp: identical_kheap_updates_def) \n done\n\nlemma update_object_noop:\n \"kheap s ptr = Some obj \\ s\\kheap := kheap s(ptr \\ obj)\\ = s\"\n apply(subgoal_tac \"kheap s(ptr \\ obj) = kheap s\")\n apply(simp)\n apply(blast intro: map_upd_triv)\n done\n\nlemma set_object_rev:\n \"reads_equiv_valid_inv A aag (\\ s. kheap s ptr = Some obj \\ is_subject aag ptr) (set_object ptr obj)\"\n unfolding equiv_valid_def2 equiv_valid_2_def\n apply(clarsimp simp: set_object_def bind_def get_def put_def return_def)\n apply(fastforce dest: update_object_noop)\n done\n\nlemma lookup_error_on_failure_rev:\n \"reads_equiv_valid_inv A aag P m \\\n reads_equiv_valid_inv A aag P (lookup_error_on_failure s m)\"\n unfolding lookup_error_on_failure_def\n apply(unfold handleE'_def)\n apply (wp | wpc | simp)+\n done\n\nabbreviation\n reads_equiv_valid_rv where\n \"reads_equiv_valid_rv A B aag R P f \\ equiv_valid_2 (reads_equiv aag) A B R P P f f\"\n\nabbreviation\n reads_equiv_valid_rv_inv where\n \"reads_equiv_valid_rv_inv A aag R P f \\ reads_equiv_valid_rv A A aag R P f\"\n\n\nlemma gets_kheap_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for (aag_can_read aag or aag_can_affect aag l) id) \\ (gets kheap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE affects_equivE)\n done\n\nlemma gets_kheap_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read aag) id) \\ (gets kheap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE)\n done\n\nabbreviation equiv_irq_state where\n \"equiv_irq_state ms ms' \\ irq_state ms = irq_state ms'\"\n\nlemma gets_machine_state_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_machine_state (aag_can_read aag or aag_can_affect aag l) And equiv_irq_state) \\ (gets machine_state)\"\n apply(simp add: gets_def get_def return_def bind_def)\n apply(clarsimp simp: equiv_valid_2_def)\n apply(fastforce intro: equiv_forI elim: reads_equivE affects_equivE equiv_forE)\n done\n\nlemma gets_machine_state_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_machine_state (aag_can_read aag) And equiv_irq_state) \\ (gets machine_state)\"\n apply(simp add: gets_def get_def return_def bind_def)\n apply(clarsimp simp: equiv_valid_2_def)\n apply(fastforce intro: equiv_forI elim: reads_equivE affects_equivE equiv_forE)\n done\n\nlemma gets_cdt_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for ((aag_can_read aag or aag_can_affect aag l) \\ fst) id) \\ (gets cdt)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE affects_equivE)\n done\n\n\nlemma gets_cdt_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read aag \\ fst) id) \\ (gets cdt)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE)\n done\n\nlemma internal_exst[simp]:\"cdt_list_internal o exst = cdt_list\"\n \"ekheap_internal o exst = ekheap\"\n apply (simp add: o_def)+\n done\n\nlemma gets_cdt_list_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for ((aag_can_read aag or aag_can_affect aag l) \\ fst) id) \\ (gets cdt_list)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE affects_equivE)\n done\n\n\nlemma gets_cdt_list_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read aag \\ fst) id) \\ (gets cdt_list)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE)\n done\n\nlemma gets_ekheap_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for (aag_can_read aag or aag_can_affect aag l) id) \\ (gets ekheap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE affects_equivE)\n done\n\nlemma gets_ekheap_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read aag) id) \\ (gets kheap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE)\n done\n\nlemma gets_is_original_cap_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for ((aag_can_read aag or aag_can_affect aag l) \\ fst) id) \\ (gets is_original_cap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE affects_equivE)\n done\n\nlemma gets_is_original_cap_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read aag \\ fst) id) \\ (gets is_original_cap)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist elim: reads_equivE)\n done\n\nlemma gets_ready_queues_revrv:\n \"reads_equiv_valid_rv_inv (affects_equiv aag l) aag (equiv_for (aag_can_read_domain aag or aag_can_affect_domain aag l) id) \\ (gets ready_queues)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist equiv_for_def elim: reads_equivE affects_equivE)\n done\n\n\nlemma gets_ready_queues_revrv':\n \"reads_equiv_valid_rv_inv A aag (equiv_for (aag_can_read_domain aag) id) \\ (gets ready_queues)\"\n apply(rule equiv_valid_rv_guard_imp)\n apply(rule gets_evrv)\n apply(fastforce simp: equiv_for_comp[symmetric] equiv_for_or or_comp_dist equiv_for_def elim: reads_equivE)\n done\n\n\n(* We want to prove this kind of thing for functions that don't modify the\n state *)\nlemma gets_cur_thread_ev:\n \"reads_equiv_valid_inv A aag \\ (gets cur_thread)\"\n apply (rule equiv_valid_guard_imp)\n apply wp\n apply (simp add: reads_equiv_def)\n done\n\nlemma as_user_rev:\n \"reads_equiv_valid_inv A aag (K (det f \\ (\\P. invariant f P) \\ is_subject aag thread)) (as_user thread f)\"\n unfolding as_user_def fun_app_def split_def\n apply (wp set_object_rev select_f_ev)\n apply (rule conjI, fastforce)\n apply (clarsimp split: option.split_asm kernel_object.split_asm simp: get_tcb_def)\n apply (drule state_unchanged[rotated,symmetric])\n apply simp_all\n done\n\nlemma as_user_reads_respects:\n \"reads_respects aag l (K (det f \\ is_subject aag thread)) (as_user thread f)\"\n apply (simp add: as_user_def split_def)\n apply (rule gen_asm_ev)\n apply (wp set_object_reads_respects select_f_ev gets_the_ev)\n apply fastforce\n done\n\nlemma get_message_info_rev:\n \"reads_equiv_valid_inv A aag (K (is_subject aag ptr)) (get_message_info ptr)\"\n apply (simp add: get_message_info_def)\n apply (wp as_user_rev | clarsimp simp: get_register_def)+\n done\n\nlemma syscall_rev:\n assumes reads_res_m_fault:\n \"reads_equiv_valid_inv A aag P m_fault\"\n assumes reads_res_m_error:\n \"\\ v. reads_equiv_valid_inv A aag (Q (Inr v)) (m_error v)\"\n assumes reads_res_h_fault:\n \"\\ v. reads_equiv_valid_inv A aag (Q (Inl v)) (h_fault v)\"\n assumes reads_res_m_finalise:\n \"\\ v. reads_equiv_valid_inv A aag (R (Inr v)) (m_finalise v)\"\n assumes reads_res_h_error:\n \"\\ v. reads_equiv_valid_inv A aag (R (Inl v)) (h_error v)\"\n assumes m_fault_hoare:\n \"\\ P \\ m_fault \\ Q \\\"\n assumes m_error_hoare:\n \"\\ v. \\ Q (Inr v) \\ m_error v \\ R \\\"\n shows \"reads_equiv_valid_inv A aag P (Syscall_A.syscall m_fault h_fault m_error h_error m_finalise)\"\n unfolding Syscall_A.syscall_def without_preemption_def fun_app_def\n apply (wp assms equiv_valid_guard_imp[OF liftE_bindE_ev]\n | rule hoare_strengthen_post[OF m_error_hoare]\n | rule hoare_strengthen_post[OF m_fault_hoare]\n | wpc\n | fastforce)+\n done\n\nlemma syscall_reads_respects_g:\n assumes reads_res_m_fault:\n \"reads_respects_g aag l P m_fault\"\n assumes reads_res_m_error:\n \"\\ v. reads_respects_g aag l (Q'' v) (m_error v)\"\n assumes reads_res_h_fault:\n \"\\ v. reads_respects_g aag l (Q' v) (h_fault v)\"\n assumes reads_res_m_finalise:\n \"\\ v. reads_respects_g aag l (R'' v) (m_finalise v)\"\n assumes reads_res_h_error:\n \"\\ v. reads_respects_g aag l (R' v) (h_error v)\"\n assumes m_fault_hoare:\n \"\\ P \\ m_fault \\ case_sum Q' Q'' \\\"\n assumes m_error_hoare:\n \"\\ v. \\ Q'' v \\ m_error v \\ case_sum R' R'' \\\"\n shows \"reads_respects_g aag l P (Syscall_A.syscall m_fault h_fault m_error h_error m_finalise)\"\n unfolding Syscall_A.syscall_def without_preemption_def fun_app_def\n apply (wp assms equiv_valid_guard_imp[OF liftE_bindE_ev]\n | rule hoare_strengthen_post[OF m_error_hoare]\n | rule hoare_strengthen_post[OF m_fault_hoare]\n | wpc\n | fastforce)+\n done\n \n\nlemma do_machine_op_spec_reads_respects':\n assumes equiv_dmo:\n \"equiv_valid_inv (equiv_machine_state (aag_can_read aag) And equiv_irq_state) (equiv_machine_state (aag_can_affect aag l) ) \\ f\"\n shows\n \"spec_reads_respects st aag l \\ (do_machine_op f)\"\n unfolding do_machine_op_def spec_equiv_valid_def\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"\\ rv rv'.\n equiv_machine_state (aag_can_read aag or aag_can_affect aag l) rv rv'\n \\ equiv_irq_state rv rv'\" and Q=\"\\ r s. st = s\" and Q'=\"\\\\\" and P=\"op = st\" and P'=\"\\\" in equiv_valid_2_bind)\n apply(rule_tac R'=\"\\ (r, ms') (r', ms''). r = r'\n \\ equiv_machine_state (aag_can_read aag) ms' ms''\n \\ equiv_machine_state (aag_can_affect aag l) ms' ms''\n \\ equiv_irq_state ms' ms''\" and Q=\"\\ r s. st = s\" and Q'=\"\\\\\" and P=\"\\\" and P'=\"\\\" in equiv_valid_2_bind_pre)\n apply(clarsimp simp: modify_def get_def put_def bind_def return_def equiv_valid_2_def)\n apply(fastforce intro: reads_equiv_machine_state_update affects_equiv_machine_state_update)\n apply(insert equiv_dmo)[1]\n apply(clarsimp simp: select_f_def equiv_valid_2_def equiv_valid_def2 equiv_for_or simp: split_def split: prod.splits simp: equiv_for_def)[1]\n apply(drule_tac x=rv in spec, drule_tac x=rv' in spec)\n apply(fastforce)\n apply(rule select_f_inv)\n apply(rule wp_post_taut)\n apply simp+\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n apply(fastforce elim: reads_equivE affects_equivE equiv_forE intro: equiv_forI)\n apply(wp | simp)+\n done\n\n(* most of the time (i.e. always except for getActiveIRQ) you'll want this rule *)\nlemma do_machine_op_spec_reads_respects:\n assumes equiv_dmo:\n \"equiv_valid_inv (equiv_machine_state (aag_can_read aag)) (equiv_machine_state (aag_can_affect aag l)) \\ f\"\n assumes irq_state_inv:\n \"\\P. \\\\ms. P (irq_state ms)\\ f \\\\_ ms. P (irq_state ms)\\\"\n shows\n \"spec_reads_respects st aag l \\ (do_machine_op f)\"\n apply(rule do_machine_op_spec_reads_respects')\n apply(clarsimp simp: equiv_valid_def2 equiv_valid_2_def)\n apply(subgoal_tac \"equiv_irq_state b ba\", simp)\n apply(insert equiv_dmo, fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n apply(insert irq_state_inv)\n apply(drule_tac x=\"\\ms. ms = irq_state s\" in meta_spec)\n apply(clarsimp simp: valid_def)\n apply(frule_tac x=s in spec)\n apply(erule (1) impE)\n apply(drule bspec, assumption, simp)\n apply(drule_tac x=t in spec, simp)\n apply(drule bspec, assumption)\n apply simp\n done\n \n\nlemma do_machine_op_spec_rev:\n assumes equiv_dmo:\n \"spec_equiv_valid_inv (machine_state st) (equiv_machine_state (aag_can_read aag)) \\\\ \\ f\"\n assumes mo_inv: \"\\ P. invariant f P\"\n shows\n \"reads_spec_equiv_valid_inv st A aag P (do_machine_op f)\"\n unfolding do_machine_op_def spec_equiv_valid_def\n apply(rule equiv_valid_2_guard_imp)\n apply(rule_tac R'=\"\\ rv rv'. equiv_machine_state (aag_can_read aag) rv rv' \\ equiv_irq_state rv rv'\" and Q=\"\\ r s. st = s \\ r = machine_state s\" and Q'=\"\\r s. r = machine_state s\" and P=\"op = st\" and P'=\"\\\" in equiv_valid_2_bind)\n apply(rule_tac R'=\"\\ (r, ms') (r', ms''). r = r' \\ equiv_machine_state (aag_can_read aag) ms' ms''\"\n and Q=\"\\ (r,ms') s. ms' = rv \\ rv = machine_state s \\ st = s\" \n and Q'=\"\\ (r,ms') s. ms' = rv' \\ rv' = machine_state s\" \n and P=\"\\ s. st = s \\ rv = machine_state s\" and P'=\"\\ s. rv' = machine_state s\"\n and S=\"\\ s. st = s \\ rv = machine_state s\" and S'=\"\\s. rv' = machine_state s\" in equiv_valid_2_bind_pre)\n\n apply(clarsimp simp: modify_def get_def put_def bind_def return_def equiv_valid_2_def)\n apply(clarsimp simp: select_f_def equiv_valid_2_def equiv_valid_def2 equiv_for_or simp: split_def split: prod.splits simp: equiv_for_def)[1]\n apply(insert equiv_dmo)[1]\n apply(clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply(drule_tac x=\"machine_state t\" in spec)\n apply(clarsimp simp: equiv_for_def)\n apply blast\n apply(wp select_f_inv)\n apply clarsimp\n apply(drule state_unchanged[OF mo_inv], simp)\n apply(wp select_f_inv)\n apply clarsimp\n apply(drule state_unchanged[OF mo_inv], simp)\n apply simp+\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n apply(fastforce intro: elim: equiv_forE reads_equivE)\n apply(wp | simp)+\n done\n\nlemma do_machine_op_rev:\n assumes equiv_dmo: \"equiv_valid_inv (equiv_machine_state (aag_can_read aag)) \\\\ \\ f\"\n assumes mo_inv: \"\\ P. invariant f P\"\n shows \"reads_equiv_valid_inv A aag \\ (do_machine_op f)\"\n unfolding do_machine_op_def equiv_valid_def2\n apply(rule_tac W=\"\\ rv rv'. equiv_machine_state (aag_can_read aag) rv rv' \\ equiv_irq_state rv rv'\" and Q=\"\\ rv s. rv = machine_state s \" in equiv_valid_rv_bind)\n apply(blast intro: equiv_valid_rv_guard_imp[OF gets_machine_state_revrv'[simplified bipred_conj_def]])\n apply(rule_tac R'=\"\\ (r, ms') (r', ms''). r = r' \\ equiv_machine_state (aag_can_read aag) ms' ms''\" and Q=\"\\ (r,ms') s. ms' = rv \\ rv = machine_state s \" and Q'=\"\\ (r',ms'') s. ms'' = rv' \\ rv' = machine_state s\" and P=\"\\\" and P'=\"\\\" in equiv_valid_2_bind_pre)\n apply(clarsimp simp: modify_def get_def put_def bind_def return_def equiv_valid_2_def)\n apply(clarsimp simp: select_f_def equiv_valid_2_def)\n apply(insert equiv_dmo, clarsimp simp: equiv_valid_def2 equiv_valid_2_def)[1]\n apply(blast)\n apply(wp select_f_inv)+\n apply(fastforce simp: select_f_def dest: state_unchanged[OF mo_inv])+\n done\n\ndefinition\n for_each_byte_of_word :: \"(word32 \\ bool) \\ word32 \\ bool\"\nwhere\n \"for_each_byte_of_word P w \\ \\ y\\{w..w + 3}. P y\"\n\nlemma spec_equiv_valid_hoist_guard:\n \"((P st) \\ spec_equiv_valid_inv st I A \\ f) \\ spec_equiv_valid_inv st I A P f\"\n apply(clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n done\n\nlemma dmo_loadWord_rev:\n \"reads_equiv_valid_inv A aag (K (for_each_byte_of_word (aag_can_read aag) p))\n (do_machine_op (loadWord p))\"\n apply(rule gen_asm_ev)\n apply(rule use_spec_ev)\n apply(rule spec_equiv_valid_hoist_guard)\n apply(rule do_machine_op_spec_rev)\n apply(simp add: loadWord_def equiv_valid_def2 spec_equiv_valid_def)\n apply(rule_tac R'=\"\\ rv rv'. for_each_byte_of_word (\\ y. rv y = rv' y) p\" and Q=\"\\\\\" and Q'=\"\\\\\" and P=\"\\\" and P'=\"\\\" in equiv_valid_2_bind_pre)\n apply(rule_tac R'=\"op =\" and Q=\"\\ r s. p && mask 2 = 0\" and Q'=\"\\ r s. p && mask 2 = 0\" and P=\"\\\" and P'=\"\\\" in equiv_valid_2_bind_pre)\n apply(rule return_ev2)\n apply(rule_tac f=\"word_rcat\" in arg_cong)\n apply(fastforce intro: is_aligned_no_wrap' word_plus_mono_right simp: is_aligned_mask for_each_byte_of_word_def) (* slow *)\n apply(rule assert_ev2[OF refl])\n apply(rule assert_wp)+\n apply simp+\n apply(clarsimp simp: equiv_valid_2_def in_monad for_each_byte_of_word_def)\n apply(erule equiv_forD)\n apply fastforce\n apply(clarsimp simp: ptr_range_def add.commute)\n apply (wp wp_post_taut loadWord_inv | simp)+\n done\n\nlemma for_each_byte_of_word_imp:\n \"(\\ x. P x \\ Q x) \\\n for_each_byte_of_word P p \\ for_each_byte_of_word Q p\"\n apply(fastforce simp: for_each_byte_of_word_def)\n done\n\nlemma load_word_offs_rev:\n \"\\for_each_byte_of_word (aag_can_read aag) (a + of_nat x * of_nat word_size)\\ \\\n reads_equiv_valid_inv A aag \\ (load_word_offs a x)\"\n unfolding load_word_offs_def fun_app_def\n apply(rule equiv_valid_guard_imp[OF dmo_loadWord_rev])\n apply(clarsimp)\n done\n\n(* FIXME: move *)\nlemma msg_max_length_less_msg_align_bits:\n \"msg_max_length < 2 ^ (msg_align_bits - 2)\"\n apply(rule nat_power_less_diff)\n apply(simp add: msg_align_bits_def)\n apply(simp add: cap_transfer_data_size_def msg_max_extra_caps_def)\n apply(rule_tac a=7 in LeastI2)\n apply(clarsimp simp: msg_max_length_def)\n apply simp\n done\n\n(* FIXME: move *)\nlemma less_2_pow_msg_align_bits_sub_2:\n \"x = msg_max_length \\ x < msg_max_length \\\n x < 2 ^ (msg_align_bits - 2)\"\n apply(erule disjE)\n apply(erule ssubst)\n apply(rule msg_max_length_less_msg_align_bits)\n apply(erule less_trans[OF _ msg_max_length_less_msg_align_bits])\n done\n\n(* generalises auth_ipc_buffers_mem_Write *)\nlemma auth_ipc_buffers_mem_Write':\n \"\\ x \\ auth_ipc_buffers s thread; pas_refined aag s; valid_objs s\\\n \\ (pasObjectAbs aag thread, Write, pasObjectAbs aag x) \\ pasPolicy aag\"\n apply (clarsimp simp add: auth_ipc_buffers_member_def)\n apply (drule (1) cap_auth_caps_of_state)\n apply simp\n apply (clarsimp simp: aag_cap_auth_def cap_auth_conferred_def\n vspace_cap_rights_to_auth_def vm_read_write_def\n is_page_cap_def\n split: if_split_asm)\n apply (auto dest: ipcframe_subset_page)\n done\n\n(* \n We define here some machinery for reasoning about updates that occur\n outside of what the current subject can read, and the domain l in\n reads_respects. Such updates cannot be \"observed\" by reads_respects, which\n allows the two code paths to potentially diverge from each other. This is\n important when, e.g. we look at notifications/signals. The actions taken\n during send_signal cannot depend on the state of the notification, so we\n could have the situation in which in one execution the ntfn has someone\n queued on it but in the other it doesn't. This will occur only if the party\n queued on the ntfn is not in the domains the current subject is allowed to\n read from plus domain l (otherwise being reads_equiv aag and affects_equiv\n aag l would (with the invariants) cause him to be on the queue in both\n scenarios). The update that happens to this party's threadstate in one\n execution but not the other, and the different effects that occur to the\n ntfn in each case, therefore, should not break reads_respects because they\n cannot be observed. We need to be able to reason about this, hence this\n machinery.\n*)\ndefinition equiv_but_for_labels where\n \"equiv_but_for_labels aag L s s' \\ states_equiv_for (\\ x. pasObjectAbs aag x \\ L) (\\ x. pasIRQAbs aag x \\ L) (\\ x. pasASIDAbs aag x \\ L) (\\ x. pasDomainAbs aag x \\ L) s s' \\ cur_thread s = cur_thread s' \\ cur_domain s = cur_domain s' \\ scheduler_action s = scheduler_action s' \\ work_units_completed s = work_units_completed s' \\ equiv_irq_state (machine_state s) (machine_state s')\"\n\ndefinition equiv_but_for_domain where\n \"equiv_but_for_domain aag l s s' \\ equiv_but_for_labels aag (subjectReads (pasPolicy aag) l) s s'\"\n\ndefinition \n \"modifies_at_most aag L P f \\ \\ s. P s \\ (\\ (rv,s')\\fst(f s). equiv_but_for_labels aag L s s')\"\n\nlemma modifies_at_mostD:\n \"\\modifies_at_most aag L P f; P s; (rv,s') \\ fst(f s)\\ \\\n equiv_but_for_labels aag L s s'\"\n by(auto simp: modifies_at_most_def)\n\nlemma modifies_at_mostI:\n assumes hoare: \"\\ st. \\ P and equiv_but_for_labels aag L st \\ f \\ \\_. equiv_but_for_labels aag L st \\\"\n shows \"modifies_at_most aag L P f\"\n apply(clarsimp simp: modifies_at_most_def)\n apply(erule use_valid)\n apply(rule hoare)\n apply(fastforce simp: equiv_but_for_labels_def states_equiv_for_refl)\n done\n\n(*FIXME: Move*)\nlemma invs_kernel_mappings:\n \"invs s \\ valid_kernel_mappings s\"\n by (auto simp: invs_def valid_state_def)\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/infoflow/InfoFlow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.19546295367409278}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n * CapDL Types\n *\n * This file introduces many of the high-level types used in this\n * specification.\n *)\n\ntheory Types_D\nimports\n \"ASpec.VMRights_A\"\n Intents_D\n \"Lib.Lib\"\n \"Lib.SplitRule\"\n \"HOL-Combinatorics.Transposition\" (* for Fun.swap *)\nbegin\n\n(* A hardware IRQ number. *)\ntype_synonym cdl_irq = \"10 word\"\n\n(*\n * How objects are named within the kernel.\n *\n * Objects are named by 32 bit words.\n * This name may correspond to the memory address of the object.\n *)\ntype_synonym cdl_object_id = word32\n\ntype_synonym cdl_object_set = \"(cdl_object_id set)\"\n\n(* The badge of an endpoint *)\ntype_synonym cdl_badge = word32\n\n(* The guard of a CNode cap, and the number of bits the guard uses. *)\ntype_synonym cdl_cap_guard = word32\ntype_synonym cdl_cap_guard_size = nat\n\n(* The type we use to represent object sizes. *)\ntype_synonym cdl_size_bits = nat\n\n(* A single IA32 IO port. *)\ntype_synonym cdl_io_port = nat\n\n(* The depth of a particular IA32 pagetable. *)\ntype_synonym cdl_io_pagetable_level = nat\n\n(* An index into a CNode, TCB, or other kernel object that contains caps. *)\ntype_synonym cdl_cnode_index = nat\n\n(* A reference to a capability slot. *)\ntype_synonym cdl_cap_ref = \"cdl_object_id \\ cdl_cnode_index\"\n\n(* A virtual ASID. *)\ntype_synonym cdl_asid = \"cdl_cnode_index \\ cdl_cnode_index\"\n\n(* mapped address *)\ntype_synonym cdl_mapped_addr = \"(cdl_asid \\ word32)\"\n\n(* Number of bits of a badge we can use. *)\ndefinition\n badge_bits :: nat\nwhere\n \"badge_bits \\ 28\"\n\n(* FrameCaps, PageTableCaps and PageDirectoryCaps can either be\n * \"real\" cap or \"fake\" cap. Real caps are installed in CNodes,\n * and fake caps represent a page table mapping.\n *)\ndatatype cdl_frame_cap_type = Real | Fake\n\n(*\n * Kernel capabilities.\n *\n * Such capabilities (or \"caps\") give the holder particular rights to\n * a kernel object or system hardware.\n *\n * Caps have attributes such as the object they point to, the rights\n * they give the holder, or how the holder is allowed to interact with\n * the target object.\n *)\n\ndatatype cdl_cap =\n NullCap\n\n (* Kernel object capabilities *)\n | UntypedCap bool cdl_object_set cdl_object_set\n | EndpointCap cdl_object_id cdl_badge \"cdl_right set\"\n | NotificationCap cdl_object_id cdl_badge \"cdl_right set\"\n | ReplyCap cdl_object_id \"cdl_right set\" (* The id of the tcb of the target thread *)\n | MasterReplyCap cdl_object_id\n | CNodeCap cdl_object_id cdl_cap_guard cdl_cap_guard_size cdl_size_bits\n | TcbCap cdl_object_id\n | DomainCap\n\n (*\n * Capabilities representing threads waiting in endpoint queues.\n *)\n (* thread, badge, is call, can grant, can grant reply, is fault ipc *)\n | PendingSyncSendCap cdl_object_id cdl_badge bool bool bool bool\n (* thread, is waiting for reply, can grant *)\n | PendingSyncRecvCap cdl_object_id bool bool\n | PendingNtfnRecvCap cdl_object_id\n\n (* Indicate that the thread is ready for Reschedule *)\n | RestartCap\n | RunningCap\n\n (* Interrupt capabilities *)\n | IrqControlCap\n | IrqHandlerCap cdl_irq\n\n (* Virtual memory capabilties *)\n | FrameCap bool cdl_object_id \"cdl_right set\" nat cdl_frame_cap_type \"cdl_mapped_addr option\"\n | PageTableCap cdl_object_id cdl_frame_cap_type \"cdl_mapped_addr option\"\n | PageDirectoryCap cdl_object_id cdl_frame_cap_type \"cdl_asid option\"\n | AsidControlCap\n | AsidPoolCap cdl_object_id \"cdl_cnode_index\"\n\n (* x86-specific capabilities *)\n | IOPortsCap cdl_object_id \"cdl_io_port set\"\n | IOSpaceMasterCap\n | IOSpaceCap cdl_object_id\n | IOPageTableCap cdl_object_id\n\n (* Zombie caps (representing objects mid-deletion) *)\n | ZombieCap cdl_object_id\n\n (* Bound NTFN caps signifying when a tcb is bound to an NTFN *)\n | BoundNotificationCap cdl_object_id\n\n(* A mapping from capability identifiers to capabilities. *)\n\ntype_synonym cdl_cap_map = \"cdl_cnode_index \\ cdl_cap option\"\n\n(*\n * The cap derivation tree (CDT).\n *\n * This tree records how certain caps are derived from others. This\n * information is important because it affects how caps are revoked; if an\n * entity revokes a particular cap, all of the cap's children (as\n * recorded in the CDT) are also revoked.\n *\n * At this point in time, we leave the definition of the CDT quite\n * abstract. This may be made more concrete in the future allowing us to\n * reason about revocation.\n *)\ntype_synonym cdl_cdt = \"cdl_cap_ref \\ cdl_cap_ref option\"\n\ntranslations\n (type) \"cdl_cap_map\" <=(type) \"nat \\ cdl_cap option\"\n (type) \"cdl_cap_ref\" <=(type) \"cdl_object_id \\ nat\"\n (type) \"cdl_cap_ref\" <=(type) \"word32 \\ nat\"\n (type) \"cdl_cdt\" <=(type) \"cdl_cap_ref \\ cdl_cap_ref option\"\n\n\n(* Kernel objects *)\nrecord cdl_tcb =\n cdl_tcb_caps :: cdl_cap_map\n cdl_tcb_fault_endpoint :: cdl_cptr\n cdl_tcb_intent :: cdl_full_intent\n cdl_tcb_has_fault :: bool\n cdl_tcb_domain :: word8\n\nrecord cdl_cnode =\n cdl_cnode_caps :: cdl_cap_map\n cdl_cnode_size_bits :: cdl_size_bits\n\nrecord cdl_asid_pool =\n cdl_asid_pool_caps :: cdl_cap_map\n\nrecord cdl_page_table =\n cdl_page_table_caps :: cdl_cap_map\n\nrecord cdl_page_directory =\n cdl_page_directory_caps :: cdl_cap_map\n\nrecord cdl_frame =\n cdl_frame_size_bits :: cdl_size_bits\n\nrecord cdl_irq_node =\n cdl_irq_node_caps :: cdl_cap_map\n\n(*\n * Kernel objects.\n *\n * These are in-memory objects that may, over the course of the system\n * execution, be created or deleted by users.\n *)\ndatatype cdl_object =\n Endpoint\n | Notification\n | Tcb cdl_tcb\n | CNode cdl_cnode\n | AsidPool cdl_asid_pool\n | PageTable cdl_page_table\n | PageDirectory cdl_page_directory\n | Frame cdl_frame\n | Untyped\n | IRQNode cdl_irq_node\n\n(* The architecture that we are modelling. *)\ndatatype cdl_arch = IA32 | ARM11\n\n(* The map of objects that are in the system. *)\ntype_synonym cdl_heap = \"cdl_object_id \\ cdl_object option\"\n\ntranslations\n (type) \"cdl_heap\" <=(type) \"32 word \\ cdl_object option\"\n\n(*\n * The current state of the system.\n *\n * The state record contains the following primary pieces of information:\n *\n * arch:\n * The architecture of the system. This affects what capabilities and\n * kernel objects could possibly be present. In the current kernel\n * arch will not change at runtime.\n *\n * objects:\n * The objects that currently exist in the system.\n *\n * cdt:\n * The cap derivation tree of the system.\n *\n * current_thread:\n * The currently running thread. Operations will always be performed\n * on behalf of this thread.\n *\n * irq_node:\n * Which IRQs are mapped to which notifications.\n *\n * asid_table:\n * The first level of the asid table, containing capabilities to all\n * of the ASIDPools.\n *\n * current_domain:\n * The currently running domain.\n *)\nrecord cdl_state =\n cdl_arch :: cdl_arch\n cdl_objects :: cdl_heap\n cdl_cdt :: cdl_cdt\n cdl_current_thread :: \"cdl_object_id option\"\n cdl_irq_node :: \"cdl_irq \\ cdl_object_id\"\n cdl_asid_table :: cdl_cap_map\n cdl_current_domain :: word8\n\n(* Return the type of an object. *)\ndefinition\n object_type :: \"cdl_object \\ cdl_object_type\"\nwhere\n \"object_type x \\\n case x of\n Untyped \\ UntypedType\n | Endpoint \\ EndpointType\n | Notification \\ NotificationType\n | Tcb _ \\ TcbType\n | CNode _ \\ CNodeType\n | IRQNode _ \\ IRQNodeType\n | AsidPool _ \\ AsidPoolType\n | PageTable _ \\ PageTableType\n | PageDirectory _ \\ PageDirectoryType\n | Frame f \\ FrameType (cdl_frame_size_bits f)\"\n\nlemmas object_type_simps = object_type_def[split_simps cdl_object.split]\n\ndefinition\n asid_high_bits :: nat where\n \"asid_high_bits \\ 7\"\ndefinition\n asid_low_bits :: nat where\n \"asid_low_bits \\ 10 :: nat\"\ndefinition\n asid_bits :: nat where\n \"asid_bits \\ 17 :: nat\"\n\n(*\n * Each TCB contains a number of cap slots, each with a specific\n * purpose. These constants define the purpose of each slot.\n *)\ndefinition \"tcb_cspace_slot = (0 :: cdl_cnode_index)\"\ndefinition \"tcb_vspace_slot = (1 :: cdl_cnode_index)\"\ndefinition \"tcb_replycap_slot = (2 :: cdl_cnode_index)\"\ndefinition \"tcb_caller_slot = (3 :: cdl_cnode_index)\"\ndefinition \"tcb_ipcbuffer_slot = (4 :: cdl_cnode_index)\"\ndefinition \"tcb_pending_op_slot = (5 :: cdl_cnode_index)\"\ndefinition \"tcb_boundntfn_slot = (6 :: cdl_cnode_index)\"\n\nlemmas tcb_slot_defs =\n tcb_cspace_slot_def\n tcb_vspace_slot_def\n tcb_replycap_slot_def\n tcb_caller_slot_def\n tcb_ipcbuffer_slot_def\n tcb_pending_op_slot_def\n tcb_boundntfn_slot_def\n\n(*\n * Getters and setters for various data types.\n *)\n\n(* Capability getters / setters *)\n\nprimrec (nonexhaustive)\n cap_objects :: \"cdl_cap \\ cdl_object_id set\"\nwhere\n \"cap_objects (IOPageTableCap x) = {x}\"\n | \"cap_objects (IOSpaceCap x) = {x}\"\n | \"cap_objects (IOPortsCap x _) = {x}\"\n | \"cap_objects (AsidPoolCap x _) = {x}\"\n | \"cap_objects (PageDirectoryCap x _ _) = {x}\"\n | \"cap_objects (PageTableCap x _ _) = {x}\"\n | \"cap_objects (FrameCap _ x _ _ _ _) = {x}\"\n | \"cap_objects (TcbCap x) = {x}\"\n | \"cap_objects (CNodeCap x _ _ _) = {x}\"\n | \"cap_objects (MasterReplyCap x) = {x}\"\n | \"cap_objects (ReplyCap x _) = {x}\"\n | \"cap_objects (NotificationCap x _ _) = {x}\"\n | \"cap_objects (EndpointCap x _ _) = {x}\"\n | \"cap_objects (UntypedCap _ x a) = x\"\n | \"cap_objects (ZombieCap x) = {x}\"\n | \"cap_objects (PendingSyncSendCap x _ _ _ _ _) = {x}\"\n | \"cap_objects (PendingSyncRecvCap x _ _) = {x}\"\n | \"cap_objects (PendingNtfnRecvCap x) = {x}\"\n | \"cap_objects (BoundNotificationCap x) = {x}\"\n\ndefinition\n cap_has_object :: \"cdl_cap \\ bool\"\nwhere\n \"cap_has_object cap \\ case cap of\n NullCap \\ False\n | IrqControlCap \\ False\n | IrqHandlerCap _ \\ False\n | AsidControlCap \\ False\n | IOSpaceMasterCap \\ False\n | RestartCap \\ False\n | RunningCap \\ False\n | DomainCap \\ False\n | _ \\ True\"\n\ndefinition\n cap_object :: \"cdl_cap \\ cdl_object_id\"\nwhere\n \"cap_object cap \\\n if cap_has_object cap\n then (THE c. c \\ cap_objects cap)\n else undefined\"\n\nlemma cap_object_simps[simp]:\n \"cap_object (IOPageTableCap x) = x\"\n \"cap_object (IOSpaceCap x) = x\"\n \"cap_object (IOPortsCap x a) = x\"\n \"cap_object (AsidPoolCap x b) = x\"\n \"cap_object (PageDirectoryCap x c d) = x\"\n \"cap_object (PageTableCap x e f) = x\"\n \"cap_object (FrameCap dev x g h i j) = x\"\n \"cap_object (TcbCap x) = x\"\n \"cap_object (CNodeCap x k l sz) = x\"\n \"cap_object (MasterReplyCap x) = x\"\n \"cap_object (ReplyCap x q) = x\"\n \"cap_object (NotificationCap x m n) = x\"\n \"cap_object (EndpointCap x p q) = x\"\n \"cap_object (ZombieCap x) = x\"\n \"cap_object (PendingSyncSendCap x s t u v w) = x\"\n \"cap_object (PendingSyncRecvCap x t u) = x\"\n \"cap_object (PendingNtfnRecvCap x) = x\"\n \"cap_object (BoundNotificationCap x) = x\"\n by (simp_all add:cap_object_def Nitpick.The_psimp cap_has_object_def)\n\nprimrec (nonexhaustive) cap_badge :: \"cdl_cap \\ cdl_badge\"\nwhere\n \"cap_badge (NotificationCap _ x _) = x\"\n | \"cap_badge (EndpointCap _ x _) = x\"\n\ndefinition\n update_cap_badge :: \"cdl_badge \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_badge x c \\ case c of\n NotificationCap f1 _ f3 \\ NotificationCap f1 x f3\n | EndpointCap f1 _ f3 \\ EndpointCap f1 x f3\n | _ \\ c\"\n\ndefinition all_cdl_rights :: \"cdl_right set\" where\n \"all_cdl_rights = {Read, Write, Grant, GrantReply}\"\n\ndefinition\n cap_rights :: \"cdl_cap \\ cdl_right set\"\nwhere\n \"cap_rights c \\ case c of\n FrameCap _ _ x _ _ _ \\ x\n | NotificationCap _ _ x \\ x\n | EndpointCap _ _ x \\ x\n | ReplyCap _ x \\ x\n | _ \\ all_cdl_rights\"\n\ndefinition\n update_cap_rights :: \"cdl_right set \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_rights r c \\ case c of\n FrameCap dev f1 _ f2 f3 f4 \\ FrameCap dev f1 (validate_vm_rights r) f2 f3 f4\n | NotificationCap f1 f2 _ \\ NotificationCap f1 f2 (r - {Grant, GrantReply})\n | EndpointCap f1 f2 _ \\ EndpointCap f1 f2 r\n | ReplyCap f1 _ \\ ReplyCap f1 (r - {Read, GrantReply} \\ {Write})\n | _ \\ c\"\n\ndefinition\n update_mapping_cap_status :: \"cdl_frame_cap_type \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_mapping_cap_status r c \\ case c of\n FrameCap dev f1 f2 f3 _ f4 \\ FrameCap dev f1 f2 f3 r f4\n | PageTableCap pt1 _ pt2 \\ PageTableCap pt1 r pt2\n | _ \\ c\"\n\nprimrec (nonexhaustive) cap_guard :: \"cdl_cap \\ cdl_cap_guard\"\nwhere\n \"cap_guard (CNodeCap _ x _ _) = x\"\n\ndefinition\n update_cap_guard :: \"cdl_cap_guard \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_guard x c \\ case c of\n CNodeCap f1 _ f3 f4 \\ CNodeCap f1 x f3 f4\n | _ \\ c\"\n\nprimrec (nonexhaustive) cap_guard_size :: \"cdl_cap \\ cdl_cap_guard_size\"\nwhere\n \"cap_guard_size (CNodeCap _ _ x _ ) = x\"\n\ndefinition\n cnode_cap_size :: \"cdl_cap \\ cdl_size_bits\"\nwhere\n \"cnode_cap_size cap \\ case cap of\n CNodeCap _ _ _ x \\ x\n | _ \\ 0\"\n\ndefinition\n update_cap_guard_size :: \"cdl_cap_guard_size \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_guard_size x c \\ case c of\n CNodeCap f1 f2 _ f3 \\ CNodeCap f1 f2 x f3\n | _ \\ c\"\n\n(* Kernel object getters / setters *)\ndefinition\n object_slots :: \"cdl_object \\ cdl_cap_map\"\nwhere\n \"object_slots obj \\ case obj of\n PageDirectory x \\ cdl_page_directory_caps x\n | PageTable x \\ cdl_page_table_caps x\n | AsidPool x \\ cdl_asid_pool_caps x\n | CNode x \\ cdl_cnode_caps x\n | Tcb x \\ cdl_tcb_caps x\n | IRQNode x \\ cdl_irq_node_caps x\n | _ \\ Map.empty\"\n\ndefinition\n update_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"update_slots new_val obj \\ case obj of\n PageDirectory x \\ PageDirectory (x\\cdl_page_directory_caps := new_val\\)\n | PageTable x \\ PageTable (x\\cdl_page_table_caps := new_val\\)\n | AsidPool x \\ AsidPool (x\\cdl_asid_pool_caps := new_val\\)\n | CNode x \\ CNode (x\\cdl_cnode_caps := new_val\\)\n | Tcb x \\ Tcb (x\\cdl_tcb_caps := new_val\\)\n | IRQNode x \\ IRQNode (x\\cdl_irq_node_caps := new_val\\)\n | _ \\ obj\"\n\ndefinition\n has_slots :: \"cdl_object \\ bool\"\nwhere\n \"has_slots obj \\ case obj of\n PageDirectory _ \\ True\n | PageTable _ \\ True\n | AsidPool _ \\ True\n | CNode _ \\ True\n | Tcb _ \\ True\n | IRQNode _ \\ True\n | _ \\ False\"\n\n\ndefinition\n cap_free_ids :: \"cdl_cap \\ cdl_object_id set\"\nwhere\n \"cap_free_ids cap \\ (case cap of\n UntypedCap _ _ free_ids \\ free_ids\n | _ \\ {})\"\n\ndefinition\n remove_free_ids :: \"cdl_cap \\ cdl_object_id set \\ cdl_cap\"\nwhere\n \"remove_free_ids cap obj_ids \\ case cap of\n UntypedCap dev c a \\ UntypedCap dev c (a - obj_ids)\n | _ \\ cap\"\n\ndefinition cap_irq :: \"cdl_cap \\ cdl_irq\"\nwhere\n \"cap_irq cap \\ case cap of\n IrqHandlerCap x \\ x\n | _ \\ undefined\"\n\n(*************\n * Cap types *\n *************)\n\n\n\n\ndefinition cap_type :: \"cdl_cap \\ cdl_object_type option\"\nwhere\n \"cap_type x \\ case x of\n UntypedCap _ _ _ \\ Some UntypedType\n | EndpointCap _ _ _ \\ Some EndpointType\n | NotificationCap _ _ _ \\ Some NotificationType\n | TcbCap _ \\ Some TcbType\n | CNodeCap _ _ _ _ \\ Some CNodeType\n | AsidPoolCap _ _ \\ Some AsidPoolType\n | PageTableCap _ _ _ \\ Some PageTableType\n | PageDirectoryCap _ _ _ \\ Some PageDirectoryType\n | FrameCap _ _ _ f _ _ \\ Some (FrameType f)\n | IrqHandlerCap _ \\ Some IRQNodeType\n | _ \\ None \"\n\nabbreviation \"is_untyped_cap cap \\ (cap_type cap = Some UntypedType)\"\nabbreviation \"is_ep_cap cap \\ (cap_type cap = Some EndpointType)\"\nabbreviation \"is_ntfn_cap cap \\ (cap_type cap = Some NotificationType)\"\nabbreviation \"is_tcb_cap cap \\ (cap_type cap = Some TcbType)\"\nabbreviation \"is_cnode_cap cap \\ (cap_type cap = Some CNodeType)\"\nabbreviation \"is_asidpool_cap cap \\ (cap_type cap = Some AsidPoolType)\"\nabbreviation \"is_pt_cap cap \\ (cap_type cap = Some PageTableType)\"\nabbreviation \"is_pd_cap cap \\ (cap_type cap = Some PageDirectoryType)\"\nabbreviation \"is_frame_cap cap \\ (\\sz. cap_type cap = Some (FrameType sz))\"\nabbreviation \"is_irqhandler_cap cap \\ (cap_type cap = Some IRQNodeType)\"\ndefinition \"is_irqcontrol_cap cap \\ (cap = IrqControlCap)\"\n\nlemma cap_type_simps [simp]:\n \"is_untyped_cap (UntypedCap dev a a')\"\n \"is_ep_cap (EndpointCap b c d)\"\n \"is_ntfn_cap (NotificationCap e f g)\"\n \"is_tcb_cap (TcbCap h)\"\n \"is_cnode_cap (CNodeCap j k l m)\"\n \"is_asidpool_cap (AsidPoolCap n p)\"\n \"is_pd_cap (PageDirectoryCap r s t)\"\n \"is_pt_cap (PageTableCap u v w)\"\n \"is_frame_cap (FrameCap dev a1 a2 a3 a4 a5)\"\n \"is_irqhandler_cap (IrqHandlerCap a6)\"\n \"cap_type (FrameCap dev obj_id rights sz rs asid) = Some (FrameType sz)\"\n by (clarsimp simp: cap_type_def)+\n\nabbreviation \"cap_has_type cap \\ (\\type. cap_type cap = Some type)\"\n\nlemma cap_type_update_cap_badge [simp]:\n \"cap_type (update_cap_badge x cap) = cap_type cap\"\n by (clarsimp simp: update_cap_badge_def cap_type_def split: cdl_cap.splits)\n\nlemma cap_type_update_cap_rights [simp]:\n \"cap_type (update_cap_rights x cap) = cap_type cap\"\n by (clarsimp simp: update_cap_rights_def cap_type_def split: cdl_cap.splits)\n\nlemma cap_type_update_mapping_cap_status [simp]:\n \"cap_type (update_mapping_cap_status x cap) = cap_type cap\"\n by (clarsimp simp: update_mapping_cap_status_def cap_type_def split: cdl_cap.splits)\n\nlemma cap_type_update_cap_guard [simp]:\n \"cap_type (update_cap_guard x cap) = cap_type cap\"\n by (clarsimp simp: update_cap_guard_def cap_type_def split: cdl_cap.splits)\n\nlemma update_cap_guard_size [simp]:\n \"cap_type (update_cap_guard_size x cap) = cap_type cap\"\n by (clarsimp simp: update_cap_guard_size_def cap_type_def split: cdl_cap.splits)\n\n\n\ndefinition is_pending_cap :: \"cdl_cap \\ bool\"\nwhere \"is_pending_cap c \\ case c of\n PendingSyncRecvCap _ _ _ \\ True\n | PendingNtfnRecvCap _ \\ True\n | PendingSyncSendCap _ _ _ _ _ _ \\ True\n | _ \\ False\"\n\n\n(*\n * Object constructors.\n *)\n\n(* Create a capability map that contains no caps. *)\ndefinition\n empty_cap_map :: \"nat \\ cdl_cap_map\"\nwhere\n \"empty_cap_map sz \\ (\\a. if a < 2^sz then (Some NullCap) else None)\"\n\n(* Create an empty CNode. *)\ndefinition\n empty_cnode :: \"nat \\ cdl_cnode\"\nwhere\n \"empty_cnode sz = \\ cdl_cnode_caps = empty_cap_map sz, cdl_cnode_size_bits = sz \\\"\n\ndefinition\n empty_irq_node :: cdl_irq_node\nwhere\n \"empty_irq_node \\ \\ cdl_irq_node_caps = empty_cap_map 0 \\\"\n\n(* Standard empty TCB object. *)\ndefinition\n default_tcb :: \"word8 \\ cdl_tcb\"\nwhere\n \"default_tcb current_domain = \\\n cdl_tcb_caps = \\n. if n \\ tcb_boundntfn_slot then Some NullCap else None,\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = \\\n cdl_intent_op = None,\n cdl_intent_error = False,\n cdl_intent_cap = 0,\n cdl_intent_extras = [],\n cdl_intent_recv_slot = None\n \\,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = current_domain\n \\\"\n\n(* Return a newly constructed object of the given type. *)\ndefinition\n default_object :: \"cdl_object_type \\ nat \\ word8 \\ cdl_object option\"\nwhere\n \"default_object x y current_domain \\\n case x of\n UntypedType \\ Some Untyped\n | EndpointType \\ Some Endpoint\n | NotificationType \\ Some Notification\n | TcbType \\ Some (Tcb (default_tcb current_domain))\n | CNodeType \\ Some (CNode (empty_cnode y))\n | AsidPoolType \\ Some (AsidPool \\ cdl_asid_pool_caps = empty_cap_map asid_low_bits \\)\n | PageTableType \\ Some (PageTable \\ cdl_page_table_caps = empty_cap_map 8 \\)\n | PageDirectoryType \\ Some (PageDirectory \\ cdl_page_directory_caps = empty_cap_map 12 \\)\n | FrameType sz \\ Some (Frame \\ cdl_frame_size_bits = sz \\)\n | IRQNodeType \\ Some (IRQNode empty_irq_node)\"\n\nabbreviation \"pick a \\ SOME x. x\\ a\"\n\n(* Construct a cap for a new object. *)\ndefinition\n default_cap :: \"cdl_object_type \\ cdl_object_id set \\ cdl_size_bits \\ bool \\ cdl_cap\"\nwhere\n \"default_cap t id_set sz dev \\\n case t of\n EndpointType \\ EndpointCap (pick id_set) 0 UNIV\n | NotificationType \\ NotificationCap (THE i. i \\ id_set) 0 {Read,Write}\n | TcbType \\ TcbCap (pick id_set)\n | CNodeType \\ CNodeCap (pick id_set) 0 0 sz\n | IRQNodeType \\ IrqHandlerCap undefined\n | UntypedType \\ UntypedCap dev id_set id_set\n | AsidPoolType \\ AsidPoolCap (pick id_set) 0\n | PageTableType \\ PageTableCap (pick id_set) Real None\n | PageDirectoryType \\ PageDirectoryCap (pick id_set) Real None\n | FrameType frame_size \\ FrameCap dev (pick id_set) {Read, Write} frame_size Real None\"\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/capDL/Types_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.19546295367409272}} {"text": "(* Title: Jinja/J/BigStep.thy\n\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Big Step Semantics} *}\n\ntheory BigStep imports Expr State begin\n\ninductive\n eval :: \"J_prog \\ expr \\ state \\ expr \\ state \\ bool\"\n (\"_ \\ ((1\\_,/_\\) \\/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n and evals :: \"J_prog \\ expr list \\ state \\ expr list \\ state \\ bool\"\n (\"_ \\ ((1\\_,/_\\) [\\]/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n for P :: J_prog\nwhere\n\n New:\n \"\\ new_Addr h = Some a; P \\ C has_fields FDTs; h' = h(a\\(C,init_fields FDTs)) \\\n \\ P \\ \\new C,(h,l)\\ \\ \\addr a,(h',l)\\\"\n\n| NewFail:\n \"new_Addr h = None \\\n P \\ \\new C, (h,l)\\ \\ \\THROW OutOfMemory,(h,l)\\\"\n\n| Cast:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(D,fs); P \\ D \\\\<^sup>* C \\\n \\ P \\ \\Cast C e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\\"\n\n| CastNull:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\ \\Cast C e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\\"\n\n| CastFail:\n \"\\ P \\ \\e,s\\<^sub>0\\\\ \\addr a,(h,l)\\; h a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\ \\Cast C e,s\\<^sub>0\\ \\ \\THROW ClassCast,(h,l)\\\"\n\n| CastThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\Cast C e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Val:\n \"P \\ \\Val v,s\\ \\ \\Val v,s\\\"\n\n| BinOp:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v\\<^sub>2,s\\<^sub>2\\; binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v \\\n \\ P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\\\\\Val v,s\\<^sub>2\\\"\n\n| BinOpThrow1:\n \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n\n| BinOpThrow2:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e,s\\<^sub>2\\ \\\n \\ P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>2\\\"\n\n| Var:\n \"l V = Some v \\\n P \\ \\Var V,(h,l)\\ \\ \\Val v,(h,l)\\\"\n\n| LAss:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\Val v,(h,l)\\; l' = l(V\\v) \\\n \\ P \\ \\V:=e,s\\<^sub>0\\ \\ \\unit,(h,l')\\\"\n\n| LAssThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\V:=e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAcc:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(C,fs); fs(F,D) = Some v \\\n \\ P \\ \\e\\F{D},s\\<^sub>0\\ \\ \\Val v,(h,l)\\\"\n\n| FAccNull:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\ \\e\\F{D},s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n\n| FAccThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\e\\F{D},s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAss:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); fs' = fs((F,D)\\v); h\\<^sub>2' = h\\<^sub>2(a\\(C,fs')) \\\n \\ P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h\\<^sub>2',l\\<^sub>2)\\\"\n\n| FAssNull:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,s\\<^sub>2\\ \\ \\\n P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n\n| FAssThrow1:\n \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAssThrow2:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\ \\\n \\ P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| CallObjThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\e\\M(ps),s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| CallParamsThrow:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\ \\es,s\\<^sub>1\\ [\\] \\map Val vs @ throw ex # es',s\\<^sub>2\\ \\\n \\ P \\ \\e\\M(es),s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n\n| CallNull:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\ \\ps,s\\<^sub>1\\ [\\] \\map Val vs,s\\<^sub>2\\ \\\n \\ P \\ \\e\\M(ps),s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n\n| Call:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\ \\ps,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,l\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C sees M:Ts\\T = (pns,body) in D;\n length vs = length pns; l\\<^sub>2' = [this\\Addr a, pns[\\]vs];\n P \\ \\body,(h\\<^sub>2,l\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,l\\<^sub>3)\\ \\\n \\ P \\ \\e\\M(ps),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,l\\<^sub>2)\\\"\n\n| Block:\n \"P \\ \\e\\<^sub>0,(h\\<^sub>0,l\\<^sub>0(V:=None))\\ \\ \\e\\<^sub>1,(h\\<^sub>1,l\\<^sub>1)\\ \\\n P \\ \\{V:T; e\\<^sub>0},(h\\<^sub>0,l\\<^sub>0)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,l\\<^sub>1(V:=l\\<^sub>0 V))\\\"\n\n| Seq:\n \"\\ P \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e\\<^sub>2,s\\<^sub>2\\ \\\n \\ P \\ \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n\n| SeqThrow:\n \"P \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\ \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\\\\\throw e,s\\<^sub>1\\\"\n\n| CondT:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\ \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n\n| CondF:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\; P \\ \\e\\<^sub>2,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n\n| CondThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| WhileF:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\ \\\n P \\ \\while (e) c,s\\<^sub>0\\ \\ \\unit,s\\<^sub>1\\\"\n\n| WhileT:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\ \\c,s\\<^sub>1\\ \\ \\Val v\\<^sub>1,s\\<^sub>2\\; P \\ \\while (e) c,s\\<^sub>2\\ \\ \\e\\<^sub>3,s\\<^sub>3\\ \\\n \\ P \\ \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>3,s\\<^sub>3\\\"\n\n| WhileCondThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\ throw e',s\\<^sub>1\\ \\\n P \\ \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| WhileBodyThrow:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\ \\c,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\\\\n \\ P \\ \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| Throw:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\ \\\n P \\ \\throw e,s\\<^sub>0\\ \\ \\Throw a,s\\<^sub>1\\\"\n\n| ThrowNull:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\ \\throw e,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n\n| ThrowThrow:\n \"P \\ \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\ \\throw e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Try:\n \"P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\ \\\n P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\\"\n\n| TryCatch:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,l\\<^sub>1)\\; h\\<^sub>1 a = Some(D,fs); P \\ D \\\\<^sup>* C;\n P \\ \\e\\<^sub>2,(h\\<^sub>1,l\\<^sub>1(V\\Addr a))\\ \\ \\e\\<^sub>2',(h\\<^sub>2,l\\<^sub>2)\\ \\\n \\ P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',(h\\<^sub>2,l\\<^sub>2(V:=l\\<^sub>1 V))\\\"\n\n| TryThrow:\n \"\\ P \\ \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,l\\<^sub>1)\\; h\\<^sub>1 a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,l\\<^sub>1)\\\"\n\n| Nil:\n \"P \\ \\[],s\\ [\\] \\[],s\\\"\n\n| Cons:\n \"\\ P \\ \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\ \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\ \\\n \\ P \\ \\e#es,s\\<^sub>0\\ [\\] \\Val v # es',s\\<^sub>2\\\"\n\n| ConsThrow:\n \"P \\ \\e, s\\<^sub>0\\ \\ \\throw e', s\\<^sub>1\\ \\\n P \\ \\e#es, s\\<^sub>0\\ [\\] \\throw e' # es, s\\<^sub>1\\\"\n\n(*<*)\nlemmas eval_evals_induct = eval_evals.induct [split_format (complete)]\n and eval_evals_inducts = eval_evals.inducts [split_format (complete)]\n\ninductive_cases eval_cases [cases set]:\n \"P \\ \\Cast C e,s\\ \\ \\e',s'\\\"\n \"P \\ \\Val v,s\\ \\ \\e',s'\\\"\n \"P \\ \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\ \\V:=e,s\\ \\ \\e',s'\\\"\n \"P \\ \\e\\F{D},s\\ \\ \\e',s'\\\"\n \"P \\ \\e\\<^sub>1\\F{D}:=e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\ \\e\\M{D}(es),s\\ \\ \\e',s'\\\"\n \"P \\ \\{V:T;e\\<^sub>1},s\\ \\ \\e',s'\\\"\n \"P \\ \\e\\<^sub>1;;e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\ \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \"P \\ \\while (b) c,s\\ \\ \\e',s'\\\"\n \"P \\ \\throw e,s\\ \\ \\e',s'\\\"\n \"P \\ \\try e\\<^sub>1 catch(C V) e\\<^sub>2,s\\ \\ \\e',s'\\\"\n \ninductive_cases evals_cases [cases set]:\n \"P \\ \\[],s\\ [\\] \\e',s'\\\"\n \"P \\ \\e#es,s\\ [\\] \\e',s'\\\"\n(*>*) \n\n\nsubsection\"Final expressions\"\n\ndefinition final :: \"'a exp \\ bool\"\nwhere\n \"final e \\ (\\v. e = Val v) \\ (\\a. e = Throw a)\"\n\ndefinition finals:: \"'a exp list \\ bool\"\nwhere\n \"finals es \\ (\\vs. es = map Val vs) \\ (\\vs a es'. es = map Val vs @ Throw a # es')\"\n\n\n\nlemma [simp]: \"final(throw e) = (\\a. e = addr a)\"\n(*<*)by(simp add:final_def)(*>*)\n\nlemma finalE: \"\\ final e; \\v. e = Val v \\ R; \\a. e = Throw a \\ R \\ \\ R\"\n(*<*)by(auto simp:final_def)(*>*)\n\n\n\nlemma [iff]: \"finals (Val v # es) = finals es\"\n(*<*)\napply(clarsimp simp add: finals_def)\napply(rule iffI)\n apply(erule disjE)\n apply simp\n apply(rule disjI2)\n apply clarsimp\n apply(case_tac vs)\n apply simp\n apply fastforce\napply(erule disjE)\n apply clarsimp\napply(rule disjI2)\napply clarsimp\napply(rule_tac x = \"v#vs\" in exI)\napply simp\ndone\n(*>*)\n\nlemma finals_app_map[iff]: \"finals (map Val vs @ es) = finals es\"\n(*<*)by(induct_tac vs, auto)(*>*)\n\nlemma [iff]: \"finals (map Val vs)\"\n(*<*)using finals_app_map[of vs \"[]\"]by(simp)(*>*)\n\nlemma [iff]: \"finals (throw e # es) = (\\a. e = addr a)\"\n(*<*)\napply(simp add:finals_def)\napply(rule iffI)\n apply clarsimp\n apply(case_tac vs)\n apply simp\n apply fastforce\napply clarsimp\napply(rule_tac x = \"[]\" in exI)\napply simp\ndone\n(*>*)\n\nlemma not_finals_ConsI: \"\\ final e \\ \\ finals(e#es)\"\n (*<*)\napply(clarsimp simp add:finals_def final_def)\napply(case_tac vs)\napply auto\ndone\n(*>*)\n\n\nlemma eval_final: \"P \\ \\e,s\\ \\ \\e',s'\\ \\ final e'\"\n and evals_final: \"P \\ \\es,s\\ [\\] \\es',s'\\ \\ finals es'\"\n(*<*)by(induct rule:eval_evals.inducts, simp_all)(*>*)\n\n\nlemma eval_lcl_incr: \"P \\ \\e,(h\\<^sub>0,l\\<^sub>0)\\ \\ \\e',(h\\<^sub>1,l\\<^sub>1)\\ \\ dom l\\<^sub>0 \\ dom l\\<^sub>1\"\n and evals_lcl_incr: \"P \\ \\es,(h\\<^sub>0,l\\<^sub>0)\\ [\\] \\es',(h\\<^sub>1,l\\<^sub>1)\\ \\ dom l\\<^sub>0 \\ dom l\\<^sub>1\"\n(*<*)\nproof (induct rule: eval_evals_inducts)\n case BinOp show ?case by(rule subset_trans)(rule BinOp.hyps)+\nnext\n case Call thus ?case\n by(simp del: fun_upd_apply) \nnext\n case Seq show ?case by(rule subset_trans)(rule Seq.hyps)+\nnext\n case CondT show ?case by(rule subset_trans)(rule CondT.hyps)+\nnext\n case CondF show ?case by(rule subset_trans)(rule CondF.hyps)+\nnext\n case WhileT thus ?case by(blast)\nnext\n case TryCatch thus ?case by(clarsimp simp:dom_def split:split_if_asm) blast\nnext\n case Cons show ?case by(rule subset_trans)(rule Cons.hyps)+\nnext\n case Block thus ?case by(auto simp del:fun_upd_apply)\nqed auto\n(*>*)\n\ntext{* Only used later, in the small to big translation, but is already a\ngood sanity check: *}\n\n\n\n\nlemma eval_finalsId:\nassumes finals: \"finals es\" shows \"P \\ \\es,s\\ [\\] \\es,s\\\"\n(*<*)\n using finals\nproof (induct es type: list)\n case Nil show ?case by (rule eval_evals.intros)\nnext\n case (Cons e es)\n have hyp: \"finals es \\ P \\ \\es,s\\ [\\] \\es,s\\\"\n and finals: \"finals (e # es)\" by fact+\n show \"P \\ \\e # es,s\\ [\\] \\e # es,s\\\"\n proof cases\n assume \"final e\"\n thus ?thesis\n proof (cases rule: finalE)\n fix v assume e: \"e = Val v\"\n have \"P \\ \\Val v,s\\ \\ \\Val v,s\\\" by (simp add: eval_finalId)\n moreover from finals e have \"P \\ \\es,s\\ [\\] \\es,s\\\" by(fast intro:hyp)\n ultimately have \"P \\ \\Val v#es,s\\ [\\] \\Val v#es,s\\\"\n by (rule eval_evals.intros)\n with e show ?thesis by simp\n next\n fix a assume e: \"e = Throw a\"\n have \"P \\ \\Throw a,s\\ \\ \\Throw a,s\\\" by (simp add: eval_finalId)\n hence \"P \\ \\Throw a#es,s\\ [\\] \\Throw a#es,s\\\" by (rule eval_evals.intros)\n with e show ?thesis by simp\n qed\n next\n assume \"\\ final e\"\n with not_finals_ConsI finals have False by blast\n thus ?thesis ..\n qed\nqed\n(*>*)\n\n\ntheorem eval_hext: \"P \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ h \\ h'\"\nand evals_hext: \"P \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ h \\ h'\"\n(*<*)\nproof (induct rule: eval_evals_inducts)\n case New thus ?case\n by(fastforce intro!: hext_new intro:LeastI simp:new_Addr_def\n split:split_if_asm simp del:fun_upd_apply)\nnext\n case BinOp thus ?case by (fast elim!:hext_trans)\nnext\n case BinOpThrow2 thus ?case by(fast elim!: hext_trans)\nnext\n case FAss thus ?case\n by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply\n elim!: hext_trans)\nnext\n case FAssNull thus ?case by (fast elim!:hext_trans)\nnext\n case FAssThrow2 thus ?case by (fast elim!:hext_trans)\nnext\n case CallParamsThrow thus ?case by(fast elim!: hext_trans)\nnext\n case CallNull thus ?case by(fast elim!: hext_trans)\nnext\n case Call thus ?case by(fast elim!: hext_trans)\nnext\n case Seq thus ?case by(fast elim!: hext_trans)\nnext\n case CondT thus ?case by(fast elim!: hext_trans)\nnext\n case CondF thus ?case by(fast elim!: hext_trans)\nnext\n case WhileT thus ?case by(fast elim!: hext_trans)\nnext\n case WhileBodyThrow thus ?case by (fast elim!: hext_trans)\nnext\n case TryCatch thus ?case by(fast elim!: hext_trans)\nnext\n case Cons thus ?case by (fast intro: hext_trans)\nqed auto\n(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/J/BigStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.32766829425520916, "lm_q1q2_score": 0.19543222697278087}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__30_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__30_on_rules imports n_german_lemma_on_inv__30\nbegin\nsection{*All lemmas on causal relation between inv__30*}\nlemma lemma_inv__30_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__30) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__30_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.3522017956470284, "lm_q1q2_score": 0.19528549339230525}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__18_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__18_on_rules imports n_german_lemma_on_inv__18\nbegin\nsection{*All lemmas on causal relation between inv__18*}\nlemma lemma_inv__18_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__18) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__18_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.19528548066605536}} {"text": "(* Title: HOL/MicroJava/BV/Typing_Framework_JVM.thy\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nsection {* The Typing Framework for the JVM \\label{sec:JVM} *}\n\ntheory Typing_Framework_JVM\nimports \"../DFA/Abstract_BV\" JVMType EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ exception_table \\ instr list \\ JVMType.state step_type\" where\n \"exec G maxs rT et bs == \n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc et) (\\pc. eff (bs!pc) G pc et)\"\n\ndefinition opt_states :: \"'c prog \\ nat \\ nat \\ (ty list \\ ty err list) option set\" where\n \"opt_states G maxs maxr \\ opt (\\{list n (types G) |n. n \\ maxs} \\ list maxr (err (types G)))\"\n\n\nsubsection {* Executability of @{term check_bounded} *}\n\nprimrec list_all'_rec :: \"('a \\ nat \\ bool) \\ nat \\ 'a list \\ bool\"\nwhere\n \"list_all'_rec P n [] = True\"\n| \"list_all'_rec P n (x#xs) = (P x n \\ list_all'_rec P (Suc n) xs)\"\n\ndefinition list_all' :: \"('a \\ nat \\ bool) \\ 'a list \\ bool\" where\n \"list_all' P xs \\ list_all'_rec P 0 xs\"\n\nlemma list_all'_rec:\n \"list_all'_rec P n xs = (\\p < size xs. P (xs!p) (p+n))\"\n apply (induct xs arbitrary: n)\n apply auto\n apply (case_tac p)\n apply auto\n done\n\nlemma list_all' [iff]:\n \"list_all' P xs = (\\n < size xs. P (xs!n) n)\"\n by (unfold list_all'_def) (simp add: list_all'_rec)\n\n\n\nsubsection {* Connecting JVM and Framework *}\n\nlemma check_bounded_is_bounded:\n \"check_bounded ins et \\ bounded (\\pc. eff (ins!pc) G pc et) (length ins)\" \n by (unfold bounded_def) (blast dest: check_boundedD)\n\nlemma special_ex_swap_\n\nlemmas [iff del] = not_None_eq\n\ntheorem exec_pres_type:\n \"wf_prog wf_mb S \\ \n pres_type (exec S maxs rT et bs) (size bs) (states S maxs maxr)\"\n apply (unfold exec_def JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: eff_def xcpt_eff_def norm_eff_def)\n apply (case_tac \"bs!p\")\n\n apply clarsimp\n apply (drule listE_nth_in, assumption)\n apply fastforce\n\n apply (fastforce simp add: not_None_eq)\n\n apply (fastforce simp add: not_None_eq typeof_empty_is_type)\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=\"1\" in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply (fastforce dest: field_fields fields_is_type)\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n defer \n\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (rule_tac x=\"n'+2\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (length ST)))\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (Suc (length ST))))\" in exI) \n apply simp\n\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n \n apply (erule disjE)\n apply clarsimp\n apply (drule method_wf_mdecl, assumption+)\n apply (clarsimp simp add: wf_mdecl_def wf_mhead_def)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n done\n\nlemmas [iff] = not_None_eq\n\nlemma sup_state_opt_unfold:\n \"sup_state_opt G \\ Opt.le (Product.le (Listn.le (subtype G)) (Listn.le (Err.le (subtype G))))\"\n by (simp add: sup_state_opt_def sup_state_def sup_loc_def sup_ty_opt_def)\n\n\nlemma app_mono:\n \"app_mono (sup_state_opt G) (\\pc. app (bs!pc) G maxs rT pc et) (length bs) (opt_states G maxs maxr)\"\n by (unfold app_mono_def lesub_def) (blast intro: EffectMono.app_mono)\n \n\nlemma list_appendI:\n \"\\a \\ list x A; b \\ list y A\\ \\ a @ b \\ list (x+y) A\"\n apply (unfold list_def)\n apply (simp (no_asm))\n apply blast\n done\n\nlemma list_map [simp]:\n \"(map f xs \\ list (length xs) A) = (f ` set xs \\ A)\"\n apply (unfold list_def)\n apply simp\n done\n\nlemma [iff]:\n \"(OK ` A \\ err B) = (A \\ B)\"\n apply (unfold err_def)\n apply blast\n done\n\nlemma [intro]:\n \"x \\ A \\ replicate n x \\ list n A\"\n by (induct n, auto)\n\nlemma lesubstep_type_simple:\n \"a <=[Product.le (op =) r] b \\ a <=|r| b\"\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n \n\nlemma eff_mono:\n \"\\p < length bs; s <=_(sup_state_opt G) t; app (bs!p) G maxs rT pc et t\\\n \\ eff (bs!p) G p et s <=|sup_state_opt G| eff (bs!p) G p et t\"\n apply (unfold eff_def)\n apply (rule lesubstep_type_simple)\n apply (rule le_list_appendI)\n apply (simp add: norm_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply (simp del: split_paired_All split_paired_Ex)\n apply (elim exE conjE)\n apply simp\n apply (drule eff'_mono, assumption)\n apply assumption\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply simp\n apply (case_tac t)\n apply simp\n apply (clarsimp simp add: sup_state_conv)\n done\n\nlemma order_sup_state_opt:\n \"ws_prog G \\ order (sup_state_opt G)\"\n by (unfold sup_state_opt_unfold) (blast dest: acyclic_subcls1 order_widen)\n\ntheorem exec_mono:\n \"ws_prog G \\ bounded (exec G maxs rT et bs) (size bs) \\\n mono (JVMType.le G maxs maxr) (exec G maxs rT et bs) (size bs) (states G maxs maxr)\" \n apply (unfold exec_def JVM_le_unfold JVM_states_unfold) \n apply (rule mono_lift)\n apply (fold sup_state_opt_unfold opt_states_def)\n apply (erule order_sup_state_opt)\n apply (rule app_mono)\n apply assumption\n apply clarify\n apply (rule eff_mono)\n apply assumption+\n done\n\ntheorem semilat_JVM_slI:\n \"ws_prog G \\ semilat (JVMType.sl G maxs maxr)\"\n apply (unfold JVMType.sl_def stk_esl_def reg_sl_def)\n apply (rule semilat_opt)\n apply (rule err_semilat_Product_esl)\n apply (rule err_semilat_upto_esl)\n apply (rule err_semilat_JType_esl, assumption+)\n apply (rule err_semilat_eslI)\n apply (rule Listn_sl)\n apply (rule err_semilat_JType_esl, assumption+)\n done\n\nlemma sl_triple_conv:\n \"JVMType.sl G maxs maxr == \n (states G maxs maxr, JVMType.le G maxs maxr, JVMType.sup G maxs maxr)\"\n by (simp (no_asm) add: states_def JVMType.le_def JVMType.sup_def)\n\nlemma is_type_pTs:\n \"\\ wf_prog wf_mb G; (C,S,fs,mdecls) \\ set G; ((mn,pTs),rT,code) \\ set mdecls \\\n \\ set pTs \\ types G\"\nproof \n assume \"wf_prog wf_mb G\" \n \"(C,S,fs,mdecls) \\ set G\"\n \"((mn,pTs),rT,code) \\ set mdecls\"\n hence \"wf_mdecl wf_mb G C ((mn,pTs),rT,code)\"\n by (rule wf_prog_wf_mdecl)\n hence \"\\t \\ set pTs. is_type G t\" \n by (unfold wf_mdecl_def wf_mhead_def) auto\n moreover\n fix t assume \"t \\ set pTs\"\n ultimately\n have \"is_type G t\" by blast\n thus \"t \\ types G\" ..\nqed\n\n\nlemma jvm_prog_lift: \n assumes wf: \n \"wf_prog (\\G C bd. P G C bd) G\"\n\n assumes rule:\n \"\\wf_mb C mn pTs C rT maxs maxl b et bd.\n wf_prog wf_mb G \\\n method (G,C) (mn,pTs) = Some (C,rT,maxs,maxl,b,et) \\\n is_class G C \\\n set pTs \\ types G \\\n bd = ((mn,pTs),rT,maxs,maxl,b,et) \\\n P G C bd \\\n Q G C bd\"\n \n shows \n \"wf_prog (\\G C bd. Q G C bd) G\"\n using wf\n apply (unfold wf_prog_def wf_cdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (unfold wf_cdecl_mdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (frule methd [OF wf [THEN wf_prog_ws_prog]], assumption+)\n apply (frule is_type_pTs [OF wf], assumption+)\n apply clarify\n apply (drule rule [OF wf], assumption+)\n apply (rule HOL.refl)\n apply assumption+\n done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/BV/Typing_Framework_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.33807711081162, "lm_q1q2_score": 0.19523796456912063}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__18_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__18_on_rules imports n_germanSimp_lemma_on_inv__18\nbegin\nsection{*All lemmas on causal relation between inv__18*}\nlemma lemma_inv__18_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__18) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__18_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.37022540649291935, "lm_q1q2_score": 0.19522597971895536}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory OstoreR\nimports\n \"../spec/OstoreS\"\n \"../spec/OstoreInvS\"\n \"../spec/TransS\"\n \"BilbyFsConsts.BilbyFs_Shallow_Desugar_Tuples\"\n \"../adt/BufferT\"\n \"../spec/SerialS\"\n \"HOL-Library.Sublist\"\n (* \"~~/src/HOL/Word/WordBitwise\" *)\n \"HOL-Library.Multiset\"\nbegin\n\nlemma take_list_update:\n \"i < length xs\n \\ take n (xs[i := x]) = (if i < n then (take n xs)[i := x] else take n xs)\"\n by (induct xs arbitrary: n i, simp_all add: take_Cons split: nat.split)\n\nlemma drop_list_update:\n \"i < length xs\n \\ drop n (xs[i := x]) = (if i < n then drop n xs else (drop n xs)[i - n := x])\"\n by (induct xs arbitrary: n i, simp_all add: drop_Cons split: nat.split)\n\nlemma is_set_0[simp]:\n \"\\is_set (0, x)\"\n \"\\is_set (ostoreWriteNone, x)\"\nby (simp add: ostoreWriteNone_def is_set_def)+\n\nlemma padding_to_eq_align32_simp:\n \"\\ no_summary\\<^sub>f mount_st \\ \n padding_to (mount_st, ostore_st, ostoreWriteNone) =\n align32 (used\\<^sub>f ostore_st, io_size\\<^sub>f (super\\<^sub>f mount_st))\"\nunfolding padding_to_def[unfolded tuple_simps sanitizers]\n by (simp add: ostoreWriteNone_def Let_def)\n\nlemma padding_to_ret:\n \"\\ P (if is_set(osw,ostoreWriteNewEb) then\n if no_summary\\<^sub>f mount_st \\ used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st) then\n eb_size\\<^sub>f (super\\<^sub>f mount_st)\n else\n eb_size\\<^sub>f (super\\<^sub>f mount_st) -\n serialise_size_summary_Obj_with_extra (summary\\<^sub>f ostore_st, 0)\n else align32 (used\\<^sub>f ostore_st, io_size\\<^sub>f (super\\<^sub>f mount_st))) \\ \\ \n P (padding_to (mount_st, ostore_st, osw))\"\n unfolding padding_to_def[unfolded sanitizers tuple_simps] \n by (fastforce simp: Let_def ostoreWriteNewEb_def) \n\nlemma word_le_diff:\n \"(a::U32) < a + b \\\n a + b \\ c \\\n a \\ c - b\"\n by (unat_arith)\n\nlemma os_sum_sz_simp:\n \"serialise_size_summary_Obj_with_extra (summary\\<^sub>f ostore_st, 0) = os_sum_sz ostore_st\"\nby (simp add: os_sum_sz_def serialise_size_summary_Obj_def\n serialise_size_summary_Obj_with_extra_def bilbyFsObjHeaderSize_def)\n\nlemma padding_to_eb_fullE:\n \"inv_ostore mount_st ostore_st \\\n inv_mount_st mount_st \\\n used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n (used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n P (eb_size\\<^sub>f (super\\<^sub>f mount_st)))\n \\ P (padding_to (mount_st, ostore_st, osw))\"\n apply (rule padding_to_ret)\n apply (case_tac \"is_set (osw, ostoreWriteNewEb)\")\n apply simp\n apply clarsimp\n apply (clarsimp simp:inv_mount_st_def Let_def)\n apply (simp add: align32_unchanged)\n done\n\nlemma sync_offs_le_padding_to:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n shows\n \"sync_offs\\<^sub>f ostore_st \\ padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n apply (case_tac \"used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st)\")\n apply (erule padding_to_eb_fullE[OF inv_ostore inv_mount_st])\n using inv_ostore apply (fastforce simp: inv_ostore_def)\n apply (simp add: padding_to_def)\n \n using inv_ostore_sync_offsD[OF inv_ostore] align32_le[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n inv_mount_st inv_ostore_used_no_overflowD[OF inv_ostore] apply (clarsimp simp: inv_mount_st_def Let_def)\n apply unat_arith+\n done\n\nlemma used_le_padding_to:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nassumes inv_mount_st: \"inv_mount_st mount_st\"\nshows\n\"used\\<^sub>f ostore_st \\ padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n apply (case_tac \"used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st)\")\n apply (erule padding_to_eb_fullE[OF inv_ostore inv_mount_st])\n apply (rule inv_ostore_usedD[OF inv_ostore])\n apply (simp add: padding_to_def)\n apply (rule align32_le)\n using inv_mount_st\n apply (fastforce simp: inv_mount_st_def Let_def)\n using inv_mount_st inv_ostore_used_no_overflowD[OF inv_ostore]\n apply (clarsimp simp add: inv_mount_st_def Let_def) \n done\n\nlemma padding_to_le_length_wbuf:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n shows\n \"unat (padding_to (mount_st, ostore_st, ostoreWriteNone)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n apply (simp add: padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def)\n using align32_upper_bound[where bound=\"eb_size\\<^sub>f (super\\<^sub>f mount_st)\" and v=\"used\\<^sub>f ostore_st\" and\n al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n using inv_mount_st[simplified inv_mount_st_def Let_def] apply clarsimp\n using inv_ostore_usedD[OF inv_ostore] apply simp\n using inv_ostore_used_no_overflowD[OF inv_ostore] apply simp\n using inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n apply unat_arith\n done\n\nlemma take_eq_strenghen:\n assumes \"take m xs = take m ys\"\n and \"n \\ m\"\nshows\n \"take n xs = take n ys\"\nusing assms by (metis min.absorb_iff2 min.commute take_take)\n\nlemma inv_ostore_bound_le_lenD:\n \"inv_ostore mount_st ostore_st \\\n unat (bound\\<^sub>f (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n apply (clarsimp simp: inv_ostore_def buf_simps wordarray_length_ret)\n using wordarray_length_ret[where arr=\"data\\<^sub>f (wbuf\\<^sub>f ostore_st)\"]\n apply simp\ndone\n\nlemma prepare_memset_get_obj_eq:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n\n\n shows\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj (ostore_st \\wbuf\\<^sub>f := buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte),\n used\\<^sub>f := pad_to\\) v = ostore_get_obj ostore_st v\"\n apply (clarsimp simp: ostore_get_obj_def)\n apply (rule_tac f=\"\\x. pObj x (ObjAddr.offs\\<^sub>f v)\" in arg_cong)\n apply (rule_tac m=\"unat $ used\\<^sub>f ostore_st\" in take_eq_strenghen)\n using wordarray_length_ret[where arr=\"data\\<^sub>f (wbuf\\<^sub>f ostore_st)\", symmetric]\n inv_ostore_wbuf_boundD[OF inv_ostore]\n inv_ostore_usedD[OF inv_ostore]\n inv_ostore_wbuf_lengthD[OF inv_ostore ]\n inv_mount_st[simplified inv_mount_st_def]\n unfolding is_valid_addr_def \n apply (subst buf_memset_eq[OF inv_ostore_bound_le_lenD[OF inv_ostore]])\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply (simp add: pad_to)\n apply (fastforce simp: buf_memset_eq word_le_nat_alt buf_simps wordarray_make\n is_valid_addr_def Let_def pad_to min_absorb1)\n apply (unat_arith)\n done\n\nlemma inv_ostore_index_padding_bytes:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nand inv_mount_st: \"inv_mount_st mount_st\"\nand pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\nshows\n\"inv_ostore_index mount_st\n (ostore_st \\wbuf\\<^sub>f := buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte),\n used\\<^sub>f := pad_to\\)\"\n (is \"inv_ostore_index mount_st ?ostore_st\")\nproof -\n have index_unchanged:\n \"index_st\\<^sub>f ?ostore_st = index_st\\<^sub>f ostore_st\" by simp\n also have inv_ostore_index:\n \"inv_ostore_index mount_st ostore_st\"\n using inv_ostore by (simp add: inv_ostore_def)\n moreover have pad_to_ge_used:\n \"used\\<^sub>f ostore_st \\ pad_to\"\n by (subst pad_to, rule used_le_padding_to[OF inv_ostore inv_mount_st])\n moreover have is_valid_addr:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n is_valid_addr mount_st ?ostore_st v\"\n apply (clarsimp simp: is_valid_addr_def pad_to)\n apply (case_tac \"used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st)\")\n apply (erule (1) padding_to_eb_fullE[OF inv_ostore inv_mount_st])\n apply (cut_tac used_le_padding_to[OF inv_ostore inv_mount_st])\n apply (unat_arith)\n done\n moreover have get_obj_eq:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj ?ostore_st v = ostore_get_obj ostore_st v\"\n using prepare_memset_get_obj_eq[OF inv_ostore inv_mount_st pad_to] .\n\n ultimately show ?thesis\n unfolding inv_ostore_index_def\n by (clarsimp simp: Let_def)\nqed\n\nlemma map_eq_iff_nth_eq:\n \"(map f xs = map g ys) = (length xs = length ys \\ (\\i\\{0.. {0, (sync_offs\\<^sub>f ostore_st)}\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n\nshows\n \"buf_slice (buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte))\n frm pad_to =\n buf_slice (wbuf\\<^sub>f ostore_st) frm (used\\<^sub>f ostore_st) @ padding (unat pad_to - unat (used\\<^sub>f ostore_st))\"\n using inv_ostore_sync_offsD[OF inv_ostore,simplified word_le_nat_alt]\n inv_ostore_buf_bound_eqD[OF inv_ostore]\n inv_ostore_used_len_wbufD[OF inv_ostore inv_mount_st]\n apply (subst buf_memset_eq[OF inv_ostore_bound_le_lenD[OF inv_ostore]])\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply (simp add: pad_to)\n apply (subgoal_tac \"unat (align32 (used\\<^sub>f ostore_st, io_size\\<^sub>f (super\\<^sub>f mount_st))) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\")\n apply (subgoal_tac \"0 < io_size\\<^sub>f (super\\<^sub>f mount_st)\")\n apply (case_tac \"frm = sync_offs\\<^sub>f ostore_st\")\n using inv_mount_st[simplified inv_mount_st_def Let_def] inv_ostore_used_no_overflowD[OF inv_ostore]\n apply (clarsimp simp add: pad_to' buf_simps wordarray_make unat_arith_simps(4-5)\n min_absorb1 min_absorb2 align32_le[simplified word_le_nat_alt] padding_def)\n using frm inv_mount_st[simplified inv_mount_st_def Let_def] inv_ostore_used_no_overflowD[OF inv_ostore]\n apply (clarsimp simp add: buf_memset_eq pad_to' buf_simps wordarray_make unat_arith_simps(4-5)\n min_absorb1 min_absorb2 align32_le[simplified word_le_nat_alt] padding_def)\n using frm inv_mount_st[simplified inv_mount_st_def Let_def]\n apply (clarsimp, unat_arith)\n using align32_upper_bound inv_ostore_eb_size_wbuf_eqD[OF inv_ostore, symmetric] inv_mount_st\n inv_ostore_used_no_overflowD[OF inv_ostore]\n apply (simp only: unat_arith_simps, fastforce simp add: inv_mount_st_def Let_def)\n done\n\n\nlemma inv_ostore_valid_list_trans_wbuf:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nassumes used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\nassumes sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\nshows\n \"valid_list_trans (buf_take (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))\"\n using inv_bufsD[OF inv_ostore, simplified used_gt_zero sync_lt_used]\n apply (clarsimp simp add: valid_list_trans_no_pad_def buf_slice_0_eq_buf_take)\n apply (simp add: buf_take_buf_slice_adjacent[OF order.strict_implies_order[OF sync_lt_used],symmetric])\n apply (erule (1) valid_list_trans_append)\n done\n\nlemma snd_list_trans_memset:\nnotes list_trans.simps[simp del]\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and frm: \"frm \\ {0, (sync_offs\\<^sub>f ostore_st)}\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n\nshows\n \"prod.snd (list_trans_no_pad\n (buf_slice (buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte))\n frm pad_to)) =\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) frm (used\\<^sub>f ostore_st)))\"\nproof -\n have sync_le_used: \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\" using sync_lt_used by unat_arith\nshow ?thesis\nusing buf_slice_buf_memset_is_append_padding[OF inv_ostore inv_mount_st pad_to, where frm=frm]\n apply simp\n apply (case_tac \"frm = 0\")\n using frm apply (simp add: buf_slice_0_eq_buf_take)\n apply (rule snd_list_trans_no_pad_padding_unchanged)\n apply (rule inv_ostore_valid_list_trans_wbuf[OF inv_ostore used_gt_zero sync_lt_used])\n using frm apply simp\n apply (rule snd_list_trans_no_pad_padding_unchanged)\n using inv_bufsD[OF inv_ostore, simplified sync_lt_used]\n apply (simp add: valid_list_trans_no_pad_def)\n done\nqed\n\nlemma ostore_log_objects_padding_bytes:\nnotes list_trans.simps [simp del]\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nassumes inv_mount_st: \"inv_mount_st mount_st\"\nassumes pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\nassumes padsz: \"padsz = unat (used\\<^sub>f ostore_st) - unat pad_to\"\nassumes used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\nassumes sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\nshows\n \"ostore_log_objects (list_eb_log_wbuf (ostore_st \\wbuf\\<^sub>f :=\n buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte), used\\<^sub>f := pad_to\\))\n =\n ostore_log_objects (list_eb_log_wbuf ostore_st)\"\n (is \"ostore_log_objects (list_eb_log_wbuf ?ostore_st) =\n ostore_log_objects (list_eb_log_wbuf ostore_st)\")\nproof -\n have len_eq: \"length (list_eb_log_wbuf ?ostore_st) = length (list_eb_log_wbuf ostore_st)\"\n by (simp add: list_eb_log_wbuf_def list_eb_log_def)\n have pad_to_gt_0: \"pad_to > 0\"\n using used_le_padding_to[OF inv_ostore inv_mount_st] pad_to used_gt_zero\n by unat_arith\n have pad_to': \"pad_to = align32 (used\\<^sub>f ostore_st, io_size\\<^sub>f (super\\<^sub>f mount_st))\"\n using pad_to by (simp add: padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def)\n have val_xs: \"valid_list_trans (buf_slice (wbuf\\<^sub>f ostore_st) 0 (sync_offs\\<^sub>f ostore_st))\"\n using inv_bufsD[OF inv_ostore] used_gt_zero\n by (clarsimp simp: buf_slice_0_eq_buf_take valid_list_trans_no_pad_def)\n have val_ys: \"valid_list_trans (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))\"\n using inv_bufsD[OF inv_ostore] sync_lt_used\n by (clarsimp simp: valid_list_trans_no_pad_def)\n\n have sync_le_used: \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\" using sync_lt_used by simp\n\n have valid_list_trans_till_used: \"valid_list_trans (buf_slice (wbuf\\<^sub>f ostore_st) 0 (used\\<^sub>f ostore_st))\"\n using inv_bufsD[OF inv_ostore] used_gt_zero sync_lt_used\n apply (clarsimp simp add: unat_arith_simps valid_list_trans_no_pad_def)\n using valid_list_trans_append[where xs=\"buf_take (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st)\" and\n ys=\"buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)\"]\n buf_take_buf_slice_adjacent[OF sync_le_used]\n apply (simp add: buf_simps Let_def)\n done\n\n have snd_list_trans_no_pad:\n \"prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) 0 (used\\<^sub>f ostore_st))) \\ []\"\n using inv_bufsD[OF inv_ostore] used_gt_zero sync_lt_used\n apply (clarsimp simp add: unat_arith_simps valid_list_trans_no_pad_def del: notI)\n apply (drule (1) list_trans_no_pad_append)\n apply (simp only: length_greater_0_conv[symmetric] buf_slice_0_eq_buf_take )\n using buf_take_buf_slice_adjacent[OF sync_le_used, where b=\"(wbuf\\<^sub>f ostore_st)\",symmetric]\n apply simp\n using list_trans_no_pad_append val_ys by fastforce\n\n have buf_slice_not_Nil: \"\\xs. buf_slice (wbuf\\<^sub>f ostore_st) 0 (used\\<^sub>f ostore_st)@ xs \\ []\"\n using inv_ostore_eb_size_wbuf_eqD[OF inv_ostore] inv_mount_st[simplified inv_mount_st_def Let_def] used_gt_zero\n by (clarsimp simp add: buf_slice_def slice_def unat_arith_simps)\n have prod_eq: \"\\x y z. x = (y,z) = (prod.fst x = y \\ prod.snd x = z)\" by auto\n have opt_eq: \"\\i. i < length (list_eb_log_wbuf ostore_st) \\ (list_eb_log_wbuf ?ostore_st ! i) = [] = ((list_eb_log_wbuf ostore_st ! i) = [])\"\n apply (simp add: list_eb_log_wbuf_def list_eb_log_def used_gt_zero \n buf_slice_buf_memset_is_append_padding[OF inv_ostore\n inv_mount_st pad_to, where frm=0, simplified])\n apply (case_tac \"i \\ unat (wbuf_eb\\<^sub>f ostore_st)- unat bilbyFsFirstLogEbNum\")\n using snd_list_trans_padding_unchanged[OF valid_list_trans_till_used, where n=\"(unat pad_to - unat (used\\<^sub>f ostore_st))\"]\n snd_list_trans_no_pad\n apply (simp add: list_trans_no_pad_def prod.case_eq_if)+\n done\n {\n fix i\n assume i_range: \"i < length (list_eb_log_wbuf ostore_st)\"\n and not_none: \"list_eb_log_wbuf ostore_st ! i \\ []\"\n have \"list_eb_log_wbuf ?ostore_st ! i = list_eb_log_wbuf ostore_st ! i\"\n proof -\n have \"list_eb_log_wbuf ?ostore_st ! i \\ []\"\n using opt_eq i_range not_none by simp\n thus ?thesis\n proof cases\n assume cur_eb: \"i = unat (wbuf_eb\\<^sub>f ostore_st) - unat bilbyFsFirstLogEbNum\"\n have i_in_range: \"i < length ((drop (unat bilbyFsFirstLogEbNum) (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))))\"\n using inv_ubi_volD[OF inv_ostore, simplified inv_ubi_vol_def] cur_eb\n inv_ostore[simplified inv_ostore_def] by unat_arith\n show ?thesis\n using i_in_range \n apply (simp add: list_eb_log_wbuf_def list_eb_log_def cur_eb)\n using buf_slice_buf_memset_is_append_padding[OF inv_ostore inv_mount_st pad_to, where frm=0, simplified]\n apply simp\n apply (rule snd_list_trans_no_pad_padding_unchanged[OF valid_list_trans_till_used])\n done\n next\n assume cur_eb: \"i \\ unat (wbuf_eb\\<^sub>f ostore_st) - unat bilbyFsFirstLogEbNum\"\n show ?thesis\n using cur_eb len_eq by - (clarsimp simp: buf_memset_eq wordarray_make list_eb_log_wbuf_def list_eb_log_def )\n qed\n qed\n } note list_eb_log_wbuf = this\n have \"list_eb_log_wbuf ?ostore_st = list_eb_log_wbuf ostore_st\"\n apply (simp add: list_eb_log_wbuf_def)\n using list_eb_log_wbuf\n apply (simp add: list_eb_log_wbuf_def)\n using snd_list_trans_memset[OF inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used, where frm=0, simplified ]\n apply (simp only:)\n done\n thus ?thesis\n unfolding ostore_log_objects_def by simp\nqed\n\nlemma inv_ostore_fsm_padding_bytes:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nassumes inv_mount_st: \"inv_mount_st mount_st\"\nassumes pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\nassumes used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\nassumes sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\nshows\n \"inv_ostore_fsm mount_st\n (ostore_st\n \\wbuf\\<^sub>f := buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte),\n used\\<^sub>f := pad_to\\)\"\n(is \"inv_ostore_fsm mount_st ?ostore_st\")\nproof -\n obtain padsz::nat where pad_sz: \"padsz = unat (used\\<^sub>f ostore_st) - unat pad_to\" by simp\n have inv_fsm:\"inv_ostore_fsm mount_st ostore_st\" using inv_ostore_fsmD[OF inv_ostore] .\n {\n fix oid :: ObjId and gimnode :: GimNode\\<^sub>T\n assume \"oid \\ dom (\\_fsm_gim (gim\\<^sub>f (fsm_st\\<^sub>f ?ostore_st)))\"\n and \"(\\_fsm_gim $ gim\\<^sub>f (fsm_st\\<^sub>f ?ostore_st)) oid = option.Some gimnode\"\n hence \"unat (GimNode.count\\<^sub>f gimnode) = (card {x \\ set (ostore_log_objects (list_eb_log_wbuf ostore_st)).\n oid_is_deleted_by (get_obj_oid x) oid}) = (unat (GimNode.count\\<^sub>f gimnode) =\n card {x \\ set (ostore_log_objects (list_eb_log_wbuf ?ostore_st)).\n oid_is_deleted_by (get_obj_oid x) oid})\n \"\n using ostore_log_objects_padding_bytes[OF inv_ostore inv_mount_st pad_to pad_sz used_gt_zero sync_lt_used] by simp\n } note gim_eq = this\n show ?thesis\n using inv_fsm unfolding inv_ostore_fsm_def by (fastforce simp: gim_eq dom_def)\nqed\n\nlemma prepare_wbuf_memset_\\_updates_eq:\n assumes inv: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and sync_not_eq_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n shows\n \"\\_updates (ostore_st\\wbuf\\<^sub>f := buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte), used\\<^sub>f := pad_to\\) = \\_updates ostore_st\"\n apply (simp add: \\_updates_def del: list_trans.simps)\n apply (rule arg_cong[where f=\"map ostore_update\"])\n using buf_slice_buf_memset_is_append_padding[OF inv inv_mount_st,folded bilbyFsPadByte_def, where frm=\"(sync_offs\\<^sub>f ostore_st)\",simplified]\n pad_to[unfolded tuple_simps sanitizers, simplified padding_to_def Let_def ostoreWriteNone_def]\n apply (simp add: padding_to_def Let_def ostoreWriteNone_def del: list_trans.simps)\n apply (drule meta_spec[where x=pad_to])\n apply (simp del: list_trans.simps)\n apply (rule snd_list_trans_no_pad_padding_unchanged)\n using inv_bufsD[OF inv] sync_not_eq_used\n apply (clarsimp simp add: valid_list_trans_no_pad_def)\n done\n\ndefinition\n buf_prepared :: \"OstoreState\\<^sub>T \\ U32 \\ U32 \\ Obj\\<^sub>T \\ U8 list\"\nwhere\n \"buf_prepared ostore_st pad_from pad_to pobj \\\n if pad_to - pad_from < bilbyFsObjHeaderSize then\n buf_memset' (wbuf\\<^sub>f ostore_st) pad_from (pad_to - pad_from) bilbyFsPadByte\n else\n buf_sub_slice (wbuf\\<^sub>f ostore_st) pad_from pad_to (sObj pobj)\"\n\nlemma buf_prepared_n_n:\n \"buf_prepared ostore_st n n pobj = (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st)\"\n by (simp add: buf_prepared_def bilbyFsObjHeaderSize_def buf_sub_slice_def buf_simps padding_def)\n\ndefinition\n prepared_pad_obj_no_crc :: \"OstoreState\\<^sub>T \\ U32 \\ Obj\\<^sub>T\"\nwhere\n \"prepared_pad_obj_no_crc ostore_st pad_to \\\n opad\\<^sub>f ostore_st\n \\Obj.sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st,\n Obj.len\\<^sub>f := pad_to - used\\<^sub>f ostore_st,\n trans\\<^sub>f := bilbyFsTransCommit \\\"\n\ndefinition\n prepared_pad_obj :: \"OstoreState\\<^sub>T \\ U32 \\ U32 \\ Obj\\<^sub>T\"\nwhere\n \"prepared_pad_obj ostore_st pad_to crc \\\n let opad = prepared_pad_obj_no_crc ostore_st pad_to\n in opad \\ crc\\<^sub>f := crc \\\"\n\nlemma padding_to_io_size_no_overflow:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n\n notes pad_simps = padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def\n\n shows\n \"padding_to (mount_st, ostore_st, ostoreWriteNone)\n < padding_to (mount_st, ostore_st, ostoreWriteNone) + io_size\\<^sub>f (super\\<^sub>f mount_st)\"\nproof -\n have pad_to_le_max_eb_sz: \"padding_to (mount_st, ostore_st, ostoreWriteNone) \\ bilbyFsMaxEbSize\"\n using align32_upper_bound[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\" and bound=\"eb_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n inv_mount_st[simplified inv_mount_st_def Let_def]\n inv_ostore_usedD[OF inv_ostore]\n inv_ostore_used_no_overflowD[OF inv_ostore]\n by (clarsimp simp: pad_simps) unat_arith\n\n have iosz_gt_0: \"0 < io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n and iosz_lt_max_eb_sz: \"io_size\\<^sub>f (super\\<^sub>f mount_st) \\ bilbyFsMaxEbSize\"\n using inv_mount_st[simplified inv_mount_st_def Let_def]\n by (clarsimp, unat_arith)+\n\n have \"bilbyFsMaxEbSize < bilbyFsMaxEbSize + io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n using iosz_lt_max_eb_sz and iosz_gt_0\n by (simp add: unat_arith_simps bilbyFsMaxEbSize_def)\n thus ?thesis\n using pad_to_le_max_eb_sz by (simp add: pad_simps) unat_arith\nqed\n\nlemma buf_memset_bound_eq:\n \"unat (buf_bound buf) \\ length (\\wa (data\\<^sub>f buf)) \\\n offs \\ offs + len \\ buf_bound (buf_memset (buf, offs, len, v)) = buf_bound buf\"\n apply (subst buf_memset_eq[OF])\napply (simp add: buf_bound_def)+\ndone\n\nlemma inv_ostore_padding_bytes_preserved:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nassumes inv_mount_st: \"inv_mount_st mount_st\"\nassumes pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\nassumes used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\nassumes sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\nshows \"inv_ostore mount_st (ostore_st \\wbuf\\<^sub>f :=buf_memset(wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte), used\\<^sub>f := pad_to\\)\"\n (is \"inv_ostore mount_st ?ostore_st\")\nproof -\n have pad_to': \"pad_to = align32 (used\\<^sub>f ostore_st, io_size\\<^sub>f (super\\<^sub>f mount_st))\"\n using pad_to by (simp add: padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def)\n have \"sync_offs\\<^sub>f ostore_st \\ padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n using sync_offs_le_padding_to[OF inv_ostore inv_mount_st ] .\n moreover have \"eb_size\\<^sub>f (super\\<^sub>f mount_st) = buf_length (wbuf\\<^sub>f ?ostore_st)\"\n apply (simp add: pad_to)\n apply (subst buf_memset_length_eq[OF inv_ostore_bound_le_lenD[OF inv_ostore]])\n apply simp\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply simp\n using inv_ostore by (fastforce simp: buf_memset_length_eq inv_ostore_def )\n moreover have \"inv_ostore_summary mount_st ?ostore_st\"\n by (simp add: inv_ostore_summary_def)\n moreover have \"inv_ostore_index mount_st ?ostore_st\"\n by (rule inv_ostore_index_padding_bytes[OF inv_ostore inv_mount_st pad_to])\n moreover have \"inv_ostore_index_gim_disjoint ?ostore_st\"\n using inv_ostore by (clarsimp simp: inv_ostore_def inv_ostore_index_gim_disjoint_def) \n moreover have \"inv_ostore_fsm mount_st ?ostore_st\" \n using inv_ostore_fsm_padding_bytes[OF inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used] .\n moreover hence \"buf_bound (wbuf\\<^sub>f ?ostore_st) = buf_length (wbuf\\<^sub>f ?ostore_st)\"\n apply (simp add: pad_to)\n apply (subst buf_memset_length_eq[OF inv_ostore_bound_le_lenD[OF inv_ostore], simplified ])\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply simp\n apply (subst buf_memset_bound_eq)\n using inv_ostore_bound_le_lenD[OF inv_ostore] apply (simp add: buf_simps)\n apply simp\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply simp\n\n\nusing inv_ostore\n by (fastforce simp add: inv_ostore_def buf_simps intro: )\n moreover have inv_bufs: \"inv_bufs mount_st ?ostore_st\" \n using inv_ostore apply (clarsimp simp: inv_ostore_def inv_bufs_def Let_def)\n apply (rule conjI)\n\n apply (subst buf_memset_eq)\n using inv_ostore_bound_le_lenD[OF inv_ostore] apply (simp add: buf_simps)\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply (simp add: pad_to)\n\n apply (simp add: buf_simps )\n using inv_ostore_sync_offsD[OF inv_ostore,simplified word_le_nat_alt]\n inv_ostore_buf_bound_eqD[OF inv_ostore]\n inv_ostore_used_len_wbufD[OF inv_ostore inv_mount_st]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n apply (simp add: min_absorb1 min_absorb2 inv_mount_st inv_mount_st_def\n Let_def wordarray_make)\n using buf_slice_buf_memset_is_append_padding[OF inv_ostore inv_mount_st pad_to, where frm=\"sync_offs\\<^sub>f ostore_st\"]\n using inv_ostore_bound_le_lenD[OF inv_ostore] apply (simp add: )\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply (simp add: pad_to )\n apply (rule padding_to_ret, simp add: ostoreWriteNone_def )\n using inv_mount_st[simplified Let_def inv_mount_st_def]\n apply clarsimp\n apply (drule align32_le[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\"])\n using inv_ostore_used_no_overflowD[OF inv_ostore] apply simp\n apply (rule conjI)\n apply (rule impI)\n apply (rule valid_list_trans_no_pad_append_padding)\n apply (erule (1) impE[OF _ sync_lt_used])\n apply (erule impE[OF _ used_gt_zero])\n apply (simp only: buf_slice_0_eq_buf_take[symmetric])\n apply (subst buf_slice_out_of_buf_memset)\n apply simp\n apply simp\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply fastforce\n using inv_ostore_usedD[OF inv_ostore]\n inv_ostore_wbuf_boundD[OF inv_ostore]\n apply (simp add: buf_simps)\n using inv_ostore_usedD[OF inv_ostore]\n inv_ostore_wbuf_boundD[OF inv_ostore]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n apply (fastforce simp add: buf_simps)\n apply simp\n apply (clarsimp simp: sync_lt_used valid_list_trans_no_pad_def)\n apply (simp add: snd_list_trans_no_pad_padding_unchanged)\n done\n moreover have get_obj_eq:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj ?ostore_st v = ostore_get_obj ostore_st v\"\n using prepare_memset_get_obj_eq[OF inv_ostore inv_mount_st pad_to] .\n\n hence runtime_eq: \"\\_ostore_runtime ?ostore_st = \\_ostore_runtime ostore_st\"\n using inv_ostore_indexD[OF inv_ostore]\n by (fastforce simp add: \\_ostore_runtime_def option.case_eq_if inv_ostore_index_def Let_def)\n\n have \\_updates_eq: \"\\_updates ?ostore_st = \\_updates ostore_st\"\n using prepare_wbuf_memset_\\_updates_eq[OF inv_ostore inv_mount_st pad_to sync_lt_used] .\n have \\_ostore_medium_eq: \"\\_ostore_medium ?ostore_st = \\_ostore_medium ostore_st\"\n by (simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def Let_def list_eb_log_def)\n then have uptodate_eq: \"\\_ostore_uptodate ?ostore_st = \\_ostore_uptodate ostore_st\"\n by (simp add: \\_ostore_medium_eq \\_updates_eq \\_ostore_uptodate_def)\n moreover have \"\\_ostore_runtime ?ostore_st = \\_ostore_uptodate ?ostore_st\"\n using inv_ostore\n by (simp add: runtime_eq uptodate_eq inv_ostore_def)\n moreover have \"pad_to \\ buf_length (wbuf\\<^sub>f ?ostore_st)\"\n using inv_mount_st[simplified inv_mount_st_def Let_def]\n inv_ostore[simplified inv_ostore_def]\n using align32_upper_bound[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\" and bound=\"eb_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n inv_ostore[simplified inv_ostore_def] inv_mount_st[simplified Let_def inv_mount_st_def]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n apply (simp add: pad_to')\n apply (subst buf_memset_length_eq)\n using inv_ostore_bound_le_lenD[OF inv_ostore] apply (simp add: buf_simps)\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply (simp add: pad_to' pad_to padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def)\n by (clarsimp simp: pad_to' buf_memset_length_eq)\n moreover have \"inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ?ostore_st))) (prod.snd (list_trans_no_pad\n (buf_slice (buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte)) (sync_offs\\<^sub>f ostore_st) pad_to)))\"\n using snd_list_trans_no_pad_padding_unchanged\n using snd_list_trans_memset[OF inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used, where frm=\"sync_offs\\<^sub>f ostore_st\",simplified]\n apply simp\n using inv_logD[OF inv_ostore, folded inv_log_def] by simp\n\n moreover have \"used\\<^sub>f ?ostore_st < used\\<^sub>f ?ostore_st + io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n using padding_to_io_size_no_overflow[OF inv_ostore inv_mount_st]\n by (clarsimp simp: inv_ostore_def pad_to)\n \n\n ultimately show ?thesis\n using inv_ostore by (clarsimp simp: pad_to inv_ostore_def inv_bufs inv_flash_def)\nqed\n\nlemma take_n_m_padding:\n \"m \\ n \\ n \\ length xs \\ \n take n (take m xs @ padding (n - m) @ ys) = take m xs @ padding (n - m)\"\n by (simp add: min_absorb1 min_absorb2 padding_def )\n \nlemma safe_add64:\n assumes err: \"a > a + b \\ P (Error ())\"\n and suc: \"a \\ a+b \\ P (Success (a+b))\"\n shows\n \"P (safe_add64 (a,b))\"\n unfolding safe_add64_def[unfolded tuple_simps sanitizers]\n apply (simp add: Let_def)\n apply safe\n apply (rule err, simp)\n apply (rule err)\n(* FIX Cogent code only one check is needed *)\n apply (unat_arith)\n apply (rule suc)\n apply unat_arith\n done\n\nlemmas ElemX_simps = ElemA.defs ElemAO.defs ElemB.defs\n\nlemma fsm_mark_ebnum_dirty:\n assumes inv_fsm_st: \"inv_fsm_st mount_st fsm_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and ebnum_range: \"ebnum \\ bilbyFsFirstLogEbNum \\ ebnum < nb_eb\\<^sub>f (super\\<^sub>f mount_st)\"\n and suc: \"P (fsm_st\n \\dirty_space\\<^sub>f :=\n WordArrayT.make\n ((\\wa (dirty_space\\<^sub>f fsm_st))[unat ebnum := \\wa (dirty_space\\<^sub>f fsm_st) ! unat ebnum + len])\\)\"\n shows\n \"P (fsm_mark_ebnum_dirty (fsm_st, ebnum, len))\"\n unfolding fsm_mark_ebnum_dirty_def[unfolded tuple_simps sanitizers]\n apply (simp add: )\n apply (rule wordarray_modify_ret)\n using inv_fsm_st[simplified inv_fsm_st_def] ebnum_range apply (clarsimp, unat_arith)\n apply (simp add: suc ArrA.make_def wordarray_make \n mark_dirty_modifier_def[unfolded tuple_simps sanitizers] ElemX_simps)\n done\n\nlemma fsm_mark_dirty_ret: (* This a specialise lemma for fsm_mark_diry when oid = nilObjId\n *)\n assumes inv_fsm_st: \"inv_fsm_st mount_st fsm_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and ebnum_range: \"ebnum\\<^sub>f oaddr \\ bilbyFsFirstLogEbNum \\ ebnum\\<^sub>f oaddr < nb_eb\\<^sub>f (super\\<^sub>f mount_st)\"\n and suc: \"\\ex. P(ex, fsm_st\n \\dirty_space\\<^sub>f :=\n WordArrayT.make\n ((\\wa (dirty_space\\<^sub>f fsm_st))\n [unat (ObjAddr.ebnum\\<^sub>f oaddr) :=\n \\wa (dirty_space\\<^sub>f fsm_st) ! unat (ObjAddr.ebnum\\<^sub>f oaddr) + ObjAddr.len\\<^sub>f oaddr])\\,\n gimpool)\"\n shows\n \"P (fsm_mark_dirty (ex, mount_st, fsm_st, gimpool, nilObjId, oaddr))\"\n unfolding fsm_mark_dirty_def[unfolded tuple_simps sanitizers]\n apply (simp add:)\n apply (rule fsm_mark_ebnum_dirty[OF inv_fsm_st inv_mount_st])\n using ebnum_range apply (simp)\n using ebnum_range apply (simp add: nilObjId_def Let_def suc[where ex=ex])\ndone\n\nlemma offs_pl_padding_to_le_eb_size:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and sync_neq_used: \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\"\n and var: \"var \\ {sync_offs\\<^sub>f ostore_st, used\\<^sub>f ostore_st}\"\n shows\n \"unat var + unat (padding_to (mount_st, ostore_st, ostoreWriteNone) - var)\n \\ unat (eb_size\\<^sub>f (super\\<^sub>f mount_st))\"\nproof -\n have pow_of_2: \"is_pow_of_2 (io_size\\<^sub>f (super\\<^sub>f mount_st))\"\n using inv_mount_st by (simp add: inv_mount_st_def Let_def)\n\n have not_0: \"0 < io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n using inv_mount_st by (simp add: inv_mount_st_def Let_def) unat_arith\n\n have iosize_dvd_ebsize: \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n using inv_mount_st by (simp add: inv_mount_st_def Let_def)\n show ?thesis\n using inv_ostore_usedD[OF inv_ostore] iosize_dvd_ebsize\n align32_ge[OF pow_of_2 , where v=\"used\\<^sub>f ostore_st\"]\n align32_upper_bound[OF _ pow_of_2, where v=\"used\\<^sub>f ostore_st\" and bound=\"eb_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n inv_ostore_sync_offsD[OF inv_ostore] inv_ostore_used_no_overflowD[OF inv_ostore]\n apply (case_tac \"var = sync_offs\\<^sub>f ostore_st\", simp_all add: var padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def)\n using var\n by unat_arith+\nqed\n\n\ndefinition\n prepared_fsm_padding_obj :: \"OstoreState\\<^sub>T \\ U32 \\ FsmState\\<^sub>T\"\nwhere\n \"prepared_fsm_padding_obj ostore_st pad_to \\\n if \\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize) then\n fsm_st\\<^sub>f ostore_st \\dirty_space\\<^sub>f :=\n WordArrayT.make ((\\wa (dirty_space\\<^sub>f (fsm_st\\<^sub>f ostore_st)))\n [unat (wbuf_eb\\<^sub>f ostore_st) := \\wa (dirty_space\\<^sub>f (fsm_st\\<^sub>f ostore_st)) ! unat (wbuf_eb\\<^sub>f ostore_st)\n + (pad_to - used\\<^sub>f ostore_st)])\\\n else fsm_st\\<^sub>f ostore_st\"\n\nlemma update_obj_pad_ret:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and oaddr_range: \"bilbyFsFirstLogEbNum \\ ObjAddr.ebnum\\<^sub>f oaddr \\ ObjAddr.ebnum\\<^sub>f oaddr < nb_eb\\<^sub>f (super\\<^sub>f mount_st)\"\n and suc: \"\\ex v. P (ex, ostore_st\n \\fsm_st\\<^sub>f := fsm_st\\<^sub>f ostore_st\n \\dirty_space\\<^sub>f :=\n WordArrayT.make\n ((\\wa (dirty_space\\<^sub>f (fsm_st\\<^sub>f ostore_st)))\n [unat (ebnum\\<^sub>f oaddr) := \\wa (dirty_space\\<^sub>f (fsm_st\\<^sub>f ostore_st)) ! unat (ebnum\\<^sub>f oaddr) +\n ObjAddr.len\\<^sub>f oaddr])\\,\n OstoreState.oaddr\\<^sub>f :=v\\)\"\n shows\n \"P (update_obj_pad (ex, mount_st, ostore_st, oaddr))\"\n unfolding update_obj_pad_def[unfolded tuple_simps sanitizers, folded nilObjId_def]\n apply (simp add:)\n apply (rule fsm_mark_dirty_ret[OF _ inv_mount_st])\n using inv_fsm_stD[OF inv_ostore] apply (simp add: inv_fsm_st_def)\n using inv_ostore[simplified inv_ostore_def] apply (simp)\n using oaddr_range apply simp\n apply simp\n apply (rule suc)\n done\n\nlemma ostore_get_obj_eq_padding_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, osw)\"\n shows\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj (ostore_st \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f := WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj'))\\,\n opad\\<^sub>f := obj', used\\<^sub>f := pad_to,\n OstoreState.next_sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st + 1,\n fsm_st\\<^sub>f := fsm_st, OstoreState.oaddr\\<^sub>f:= oaddr\\) v = ostore_get_obj ostore_st v\"\n apply (clarsimp simp: ostore_get_obj_def)\n apply (rule_tac f=\"\\x. pObj x (ObjAddr.offs\\<^sub>f v)\" in arg_cong)\n apply (rule_tac m=\"unat $ used\\<^sub>f ostore_st\" in take_eq_strenghen)\n using wordarray_length_ret[where arr=\"data\\<^sub>f (wbuf\\<^sub>f ostore_st)\", symmetric]\n inv_ostore_wbuf_boundD[OF inv_ostore]\n inv_ostore_usedD[OF inv_ostore]\n inv_ostore_wbuf_lengthD[OF inv_ostore ]\n inv_mount_st[simplified inv_mount_st_def]\n unfolding is_valid_addr_def\n apply (clarsimp simp: wordarray_make pad_to buf_length_def )\n apply (subst take_n_buf_sub_slice_n)\n apply unat_arith\n apply simp\n apply unat_arith\n done\n\nlemma inv_ostore_index_padding_obj:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nand inv_mount_st: \"inv_mount_st mount_st\"\nand pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\nshows\n\"inv_ostore_index mount_st\n (ostore_st \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f := WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj'))\\,\n opad\\<^sub>f := obj', used\\<^sub>f := pad_to,\n OstoreState.next_sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st + 1,\n fsm_st\\<^sub>f := fsm_st,\n OstoreState.oaddr\\<^sub>f := oaddr\\)\"\n (is \"inv_ostore_index mount_st ?ostore_st\")\nproof -\n have index_unchanged:\n \"index_st\\<^sub>f ?ostore_st = index_st\\<^sub>f ostore_st\" by simp\n also have inv_ostore_index:\n \"inv_ostore_index mount_st ostore_st\"\n using inv_ostore by (simp add: inv_ostore_def)\n moreover have pad_to_ge_used:\n \"used\\<^sub>f ostore_st \\ pad_to\"\n by (subst pad_to, rule used_le_padding_to[OF inv_ostore inv_mount_st])\n moreover have is_valid_addr:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n is_valid_addr mount_st ?ostore_st v\"\n apply (clarsimp simp: is_valid_addr_def pad_to)\n apply (case_tac \"used\\<^sub>f ostore_st = eb_size\\<^sub>f (super\\<^sub>f mount_st)\")\n apply (erule (1) padding_to_eb_fullE[OF inv_ostore inv_mount_st])\n apply (cut_tac used_le_padding_to[OF inv_ostore inv_mount_st])\n apply (unat_arith)\n done\n moreover have get_obj_eq:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj ?ostore_st v = ostore_get_obj ostore_st v\"\n using ostore_get_obj_eq_padding_obj[OF inv_ostore inv_mount_st pad_to,\n where fsm_st=fsm_st and oaddr=oaddr] by simp\n\n ultimately show ?thesis\n unfolding inv_ostore_index_def\n by (clarsimp simp: Let_def)\nqed\n\nlemmas ostore_update_padding_obj' = ostore_update_padding_obj_def[unfolded tuple_simps sanitizers]\n\nlemma snd_list_trans_sObj_eq_sObj:\n assumes valid_obj: \"valid_pad_obj obj\"\n notes Obj_inverse[where xs=Nil, simplified, simp]\n shows\n \"valid_list_trans (sObj obj) \\\n prod.snd (list_trans (sObj obj)) = [[obj]]\"\n using valid_obj apply (clarsimp simp: valid_pad_obj_def simp del: list_trans.simps)\n apply (erule valid_list_trans.elims)\n apply (clarsimp split: if_splits)\n apply (erule valid_trans.elims)\n apply (rename_tac x xs)\n apply (drule sym[where s=\"sObj obj\"], clarsimp simp add: Let_def is_valid_ObjTrans split:if_splits)\n using is_valid_ObjHeader_length_sObj[OF valid_obj]\n apply (drule_tac t=\"x#xs\" in sym, simp)\n apply (drule_tac t=\"x#xs\" in sym, simp)\n apply (frule is_valid_ObjHeader_length_sObj[OF valid_obj], simp)\n apply (erule valid_trans.elims, clarsimp simp add: is_valid_ObjTrans split: if_splits)\n apply (rename_tac x xs)\n apply (drule_tac t=\"x#xs\" in sym, simp)\n apply (frule is_valid_ObjHeader_length_sObj[OF valid_obj], simp)\n apply (rename_tac x xs)\n apply (drule_tac t=\"x#xs\" in sym, simp)\n apply (frule is_valid_ObjHeader_length_sObj[OF valid_obj], simp)\n done\n\n\nlemma valid_commit_pad_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n shows\n \"is_valid_ObjCommit obj (sObj obj)\"\n using obj\n apply (clarsimp simp: is_valid_ObjTrans)\n apply safe\n apply (erule ssubst)\n apply (simp add: is_valid_ObjHeader_def )\n\n using inv_opadD[OF inv_ostore]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore] inv_mount_st[simplified inv_mount_st_def Let_def] \n apply (clarsimp simp: ostore_update_padding_obj' buf_sub_slice_length bilbyFsTransCommit_def)\n apply (rule conjI)\n apply (subst length_sObj)\n using obj apply clarsimp\n apply (drule arg_cong[ where f=Obj.len\\<^sub>f, simplified ostore_update_padding_obj' Let_def prod.case_eq_if])\n using padding_obj\n apply (simp add: bilbyFsObjHeaderSize_def) \n using padding_obj\n apply (clarsimp simp add: bilbyFsObjHeaderSize_def)\n apply (simp add: is_valid_Obj_def)\n apply (simp)\n apply (simp add: is_len_and_type_ok_def otype_simps)\n using padding_obj apply (simp add: bilbyFsObjHeaderSize_def )\n using inv_opadD[OF inv_ostore]\n apply (subst Obj_inverse[where xs=Nil, simplified])\n apply (clarsimp simp: ostore_update_padding_obj'\n Obj_inverse[where xs=Nil, simplified] bilbyFsTransCommit_def is_valid_Obj_def)+\n done\n\nlemma snd_list_trans_no_pad_padding_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n and valid_list_trans_pad_obj: \"valid_list_trans (sObj obj)\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n shows\n \"prod.snd (list_trans_no_pad\n (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) @\n sObj obj)) =\n prod.snd (list_trans_no_pad\n (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n using obj length_sObj[where obj=obj] apply (simp add: ostore_update_padding_obj' )\n apply (erule meta_impE)\n apply (fold bilbyFsObjHeaderSize_def)\n using padding_obj apply clarsimp\n apply (drule arg_cong[where f=\"Obj.len\\<^sub>f\"], simp)\n apply (subst list_trans_no_pad_append[symmetric])\n using inv_bufsD[OF inv_ostore, simplified sync_lt_used] apply (simp add: valid_list_trans_no_pad_def)\n using valid_list_trans_pad_obj apply (simp add: obj ostore_update_padding_obj')\n using snd_list_trans_sObj_eq_sObj[OF _ valid_list_trans_pad_obj]\n inv_opadD[OF inv_ostore]\n inv_ostore_valid_pad_objD[OF inv_ostore] \n apply (simp add: obj ostore_update_padding_obj' list_trans_no_pad_def \n prod.case_eq_if valid_pad_obj_def is_valid_Obj_def\n del:list_trans.simps)\n apply clarsimp\n done\n\nlemma len_sObj:\n assumes valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n shows\n \"unat (pad_to - used\\<^sub>f ostore_st) = length (sObj obj)\"\n using is_valid_ObjHeader_len_facts[OF valid_hdr] valid_pad_obj apply (clarsimp simp: is_valid_ObjHeader_def valid_pad_obj_def length_sObj )\n using obj apply clarsimp\n apply (drule arg_cong[where f=\"Obj.len\\<^sub>f\"])\n apply (simp add: ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n done\n\nlemma len_sObj':\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n shows\n \"unat pad_to - unat (used\\<^sub>f ostore_st) = length (sObj obj)\"\n using len_sObj[OF valid_hdr obj valid_pad_obj] used_le_padding_to[OF inv_ostore inv_mount_st] pad_to\n by (clarsimp simp: valid_pad_obj_def) unat_arith\n\nlemma valid_list_trans_pad_obj: \n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n and invs_pad_to = inv_ostore inv_mount_st pad_to\n and padding_obj_unat = padding_obj[simplified word_less_nat_alt]\n and valid_commit_pad_obj = valid_commit_pad_obj[OF invs_pad_to obj padding_obj]\n and valid_hdr = valid_commit_pad_obj[OF invs_pad_to obj padding_obj, simplified is_valid_ObjTrans, THEN conjunct1]\n shows\n \"valid_list_trans (sObj obj)\"\n using obj\n apply clarify\n apply (drule sym[where s=obj], simp)\n apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n apply (simp add: ostore_update_padding_obj')\n apply (case_tac \"sObj obj\")\n using is_valid_ObjHeader_length_sObj[OF valid_pad_obj] valid_commit_pad_obj[simplified is_valid_ObjTrans]\n padding_obj_unat\n apply (clarsimp simp add: bilbyFsObjHeaderSize_def)\n apply simp\n apply (drule sym[where s=\"sObj obj\" ], simp)\n using is_valid_ObjCommit_trans_len[OF valid_pad_obj valid_commit_pad_obj]\n using is_valid_ObjHeader_length_sObj[OF valid_pad_obj valid_hdr] obj\n apply (clarsimp simp: ostore_update_padding_obj')\n apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n apply simp\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply (simp add: no_pad_Nil)\n apply (drule sym[where t=\"sObj obj\"])\n apply (simp only:)\n apply (subst valid_trans.simps)\n apply (drule sym[where s=\"sObj obj\"])\n using valid_pad_obj[simplified valid_pad_obj_def] valid_commit_pad_obj Obj_inverse[where xs=Nil, simplified, where obj=obj, symmetric]\n apply (simp add: is_valid_ObjTrans)\n done\n\nlemma valid_list_trans_buf_take_sync_offs:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n\n shows\n \"valid_list_trans (buf_take (wbuf\\<^sub>f ostore_st \\data\\<^sub>f := WordArrayT.make\n (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\)\n (sync_offs\\<^sub>f ostore_st))\"\n apply (simp add: buf_take_def wordarray_make)\n apply (subst take_n_buf_sub_slice_m)\n using inv_ostore_used_len_wbufD[OF inv_ostore inv_mount_st] apply simp\n using sync_lt_used apply simp\n using inv_bufsD[OF inv_ostore] used_gt_zero apply (simp add: valid_list_trans_no_pad_def buf_simps)\n done\n\nlemma padding_to_le_eb_size:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n shows\n \"padding_to (mount_st, ostore_st, ostoreWriteNone) \\ eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n apply (simp add: padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]])\n apply (rule align32_upper_bound)\n using inv_mount_st[simplified inv_mount_st_def Let_def]\n inv_ostore_usedD[OF inv_ostore]\n inv_ostore_used_no_overflowD[OF inv_ostore]\n apply simp+\n done\n\nlemma padding_to_le_len_wbuf:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n\n notes pad_simps = padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]\n\n shows\n \"unat pad_to \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n using padding_to_le_eb_size[OF assms(1,2), simplified pad_to pad_simps]\n using inv_mount_st apply (clarsimp simp: inv_mount_st_def Let_def pad_to pad_simps)\n using inv_ostore_eb_size_wbuf_eqD[OF inv_ostore] apply (unat_arith)\n done\n\nlemma valid_list_trans_buf_slice_sync_offs_pad_to:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n\n and valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n notes sync_le_used = order_less_imp_le[OF sync_lt_used]\n and invs = inv_ostore inv_mount_st\n shows\n \" valid_list_trans (buf_slice (wbuf\\<^sub>f ostore_st \\data\\<^sub>f :=\n WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\)\n (sync_offs\\<^sub>f ostore_st) pad_to)\"\n apply (simp add: buf_slice_def wordarray_make)\n apply (subst slice_buf_sub_slice[OF sync_le_used])\n using used_le_padding_to[OF invs] apply (simp add: pad_to)\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_to)\n using len_sObj[OF valid_hdr obj valid_pad_obj] apply simp\n apply (rule valid_list_trans_append)\n\n\n using inv_bufsD[OF inv_ostore] sync_lt_used\n apply (simp add: valid_list_trans_no_pad_def)\n\n using len_sObj'[OF invs pad_to valid_hdr obj valid_pad_obj]\n valid_list_trans_pad_obj[OF invs pad_to sync_lt_used obj valid_pad_obj padding_obj ]\n apply simp\n done\n\nlemma snd_list_trans_no_pad_padding_obj_sync_pad_to:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n and sync_le_used = order_less_imp_le[OF sync_lt_used]\n and invs = inv_ostore inv_mount_st\n and valid_list_trans_pad_obj = valid_list_trans_pad_obj[OF invs pad_to sync_lt_used obj valid_pad_obj padding_obj]\n and snd_list_trans_no_pad_padding_obj = snd_list_trans_no_pad_padding_obj[OF invs pad_to sync_lt_used obj padding_obj ]\n\n shows\n \"prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st \\data\\<^sub>f :=\n WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\)\n (sync_offs\\<^sub>f ostore_st) pad_to)) =\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n apply (simp add: buf_slice_def wordarray_make)\n apply (subst slice_buf_sub_slice[OF sync_le_used])\n using used_le_padding_to[OF invs] apply (simp add: pad_to)\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_to)\n using len_sObj[OF valid_hdr obj valid_pad_obj] apply simp\n using len_sObj'[OF invs pad_to valid_hdr obj valid_pad_obj] buf_slice_def\n using snd_list_trans_no_pad_padding_obj[OF valid_list_trans_pad_obj]\n by simp\n\n\nlemma snd_list_trans_no_pad_all_padding_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n and sync_le_used = order_less_imp_le[OF sync_lt_used]\n and invs = inv_ostore inv_mount_st\n and valid_list_trans_pad_obj = valid_list_trans_pad_obj[OF invs pad_to sync_lt_used obj valid_pad_obj padding_obj]\n and snd_list_trans_no_pad_padding_obj = snd_list_trans_no_pad_padding_obj[OF invs pad_to sync_lt_used obj padding_obj ]\n and invs_pad_offs = inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used \n\n shows\n \"prod.snd (list_trans_no_pad\n (buf_slice\n (wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\)\n 0 pad_to)) =\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) 0 (used\\<^sub>f ostore_st)))\"\n apply (simp add: buf_slice_0_eq_buf_take)\n apply (subst buf_take_buf_slice_adjacent[symmetric, where st=\"sync_offs\\<^sub>f ostore_st\" and ?end=\"used\\<^sub>f ostore_st\"])\n using sync_lt_used apply simp\n apply (subst buf_take_buf_slice_adjacent[symmetric, where st=\"sync_offs\\<^sub>f ostore_st\" and ?end=\"pad_to\"])\n using sync_offs_le_padding_to[OF invs] apply (simp add: pad_to)\n apply (subst list_trans_no_pad_append[symmetric])\n using valid_list_trans_buf_take_sync_offs[OF invs_pad_offs] apply (simp)\n using valid_list_trans_buf_slice_sync_offs_pad_to[OF invs_pad_offs valid_hdr obj valid_pad_obj padding_obj]\n apply simp\n apply (subst list_trans_no_pad_append[symmetric])\n using inv_bufsD[OF inv_ostore] used_gt_zero apply (simp add: valid_list_trans_no_pad_def)\n using inv_bufsD[OF inv_ostore] sync_lt_used apply (simp add: valid_list_trans_no_pad_def)\n apply (simp add: buf_slice_def wordarray_make)\n apply (subst slice_buf_sub_slice[OF sync_le_used])\n using used_le_padding_to[OF invs] apply (simp add: pad_to)\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_to)\n using len_sObj[OF valid_hdr obj valid_pad_obj] apply simp\n apply (subst buf_take_def, simp add: wordarray_make)\n apply (subst take_n_buf_sub_slice_m[OF _ sync_le_used])\n using inv_ostore_used_len_wbufD[OF inv_ostore inv_mount_st] apply simp\n apply (simp add: buf_take_def len_sObj')\n using len_sObj'[OF invs pad_to valid_hdr obj valid_pad_obj] snd_list_trans_no_pad_padding_obj [OF valid_list_trans_pad_obj ]\n apply (simp add: buf_slice_def)\n done\n\nlemma \\_updates_padding_objeq:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_eq_pad_to: \"used = pad_to\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and valid_hdr: \"is_valid_ObjHeader obj (sObj obj)\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n notes invs = inv_ostore inv_mount_st \n and sync_le_used = order_less_imp_le[OF sync_lt_used]\n and snd_list_trans_no_pad_padding_obj = snd_list_trans_no_pad_padding_obj[OF invs pad_to sync_lt_used obj padding_obj ]\n and valid_list_trans_pad_obj = valid_list_trans_pad_obj[OF invs pad_to sync_lt_used obj valid_pad_obj padding_obj]\n\n shows\n \"\\_updates (ostore_st \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f := WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\,\n opad\\<^sub>f := obj, used\\<^sub>f := used,\n OstoreState.next_sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st + 1,\n fsm_st\\<^sub>f := fsm_st,\n OstoreState.oaddr\\<^sub>f := oaddr\\) = \\_updates ostore_st\"\n apply (simp add: \\_updates_def)\n apply (rule arg_cong[where f=\"map ostore_update\"])\n apply (simp add: buf_slice_def wordarray_make)\n apply (simp add: used_eq_pad_to)\n apply (subst slice_buf_sub_slice[OF sync_le_used])\n using used_le_padding_to[OF invs] apply (simp add: pad_to)\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_to)\n using len_sObj[OF valid_hdr obj valid_pad_obj] apply simp\n\n using len_sObj'[OF invs pad_to valid_hdr obj valid_pad_obj] snd_list_trans_no_pad_padding_obj[OF valid_list_trans_pad_obj]\n apply (simp add: len_sObj' buf_slice_def)\n done\n\nlemmas Obj_ext_eq_expand = trans[OF _ Obj.ext_inject,\n OF arg_cong2[where f=\"(=)\"], OF refl Obj.surjective]\n\nlemma inv_ostore_preserved_padding_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n and used_eq_pad_to: \"used = pad_to\"\n and fsm_st: \"fsm_st \\ {fsm_st\\<^sub>f ostore_st, prepared_fsm_padding_obj ostore_st pad_to}\"\n\n notes pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n\n shows \"inv_ostore mount_st\n (ostore_st \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f := WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\,\n opad\\<^sub>f := obj, used\\<^sub>f := used,\n OstoreState.next_sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st + 1,\n fsm_st\\<^sub>f := fsm_st,\n OstoreState.oaddr\\<^sub>f := oaddr\\)\"\n (is \"inv_ostore mount_st ?ostore_st\")\nproof -\n note invs = inv_ostore inv_mount_st\n and invs_pad_to = inv_ostore inv_mount_st pad_to\n and invs_pad_offs = inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used \n and snd_list_trans_no_pad_padding_obj = snd_list_trans_no_pad_padding_obj[OF invs_pad_to sync_lt_used obj padding_obj ]\n note valid_hdr = valid_commit_pad_obj[OF invs_pad_to obj padding_obj, simplified is_valid_ObjTrans, THEN conjunct1]\n and valid_list_trans_pad_obj = valid_list_trans_pad_obj[OF invs_pad_to sync_lt_used obj valid_pad_obj padding_obj]\n note snd_list_trans_no_pad_all_padding_obj = snd_list_trans_no_pad_all_padding_obj[OF invs_pad_offs valid_hdr obj valid_pad_obj padding_obj]\n note snd_list_trans_no_pad_padding_obj_sync_pad_to = snd_list_trans_no_pad_padding_obj_sync_pad_to[OF invs_pad_offs valid_hdr obj valid_pad_obj padding_obj]\n note \\_updates_padding_objeq = \\_updates_padding_objeq[OF invs pad_to used_eq_pad_to sync_lt_used valid_hdr obj valid_pad_obj padding_obj]\n note valid_list_trans_buf_slice_sync_offs_pad_to = valid_list_trans_buf_slice_sync_offs_pad_to[OF invs_pad_offs valid_hdr obj valid_pad_obj padding_obj]\n and pad_simps = padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]\n note len_sObj' = len_sObj'[OF invs pad_to valid_hdr obj ]\n \n have sync_le_pad_to: \"sync_offs\\<^sub>f ostore_st \\ pad_to\"\n using sync_offs_le_padding_to[OF invs] by (simp add: pad_to)\n\n moreover have \"wordarray_length (data\\<^sub>f (wbuf\\<^sub>f ?ostore_st)) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n apply (simp)\n apply (subst word_unat.Rep_inject [symmetric])\n apply (subst wordarray_length_ret)\n apply (subst wordarray_make)\n apply (subst buf_sub_slice_length)\n using inv_ostore_eb_size_wbuf_eqD[OF inv_ostore] by simp\n\n moreover have get_obj_eq:\n \"\\v. is_valid_addr mount_st ostore_st v \\\n ostore_get_obj ?ostore_st v = ostore_get_obj ostore_st v\" \n using ostore_get_obj_eq_padding_obj[OF inv_ostore inv_mount_st pad_to] used_eq_pad_to by simp\n\n hence runtime_eq: \"\\_ostore_runtime ?ostore_st = \\_ostore_runtime ostore_st\"\n using inv_ostore_indexD[OF inv_ostore]\n by (fastforce simp add: \\_ostore_runtime_def option.case_eq_if inv_ostore_index_def Let_def)\n\n have sync_le_used: \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\" using sync_lt_used by simp\n\n have used_le_pad_to: \"used\\<^sub>f ostore_st \\ pad_to\"\n using used_le_padding_to[OF invs] by (simp add: pad_to)\n\n have len_sObj_ge_hdr_size: \"unat bilbyFsObjHeaderSize \\ length (sObj obj)\"\n using len_sObj\n using len_sObj[OF valid_hdr obj valid_pad_obj, symmetric] len_sObj' padding_obj by unat_arith\n\n have \\_ostore_medium_eq: \"\\_ostore_medium ?ostore_st = \\_ostore_medium ostore_st\"\n by (simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def Let_def list_eb_log_def)\n then have uptodate_eq: \"\\_ostore_uptodate ?ostore_st = \\_ostore_uptodate ostore_st\"\n by (simp add: \\_ostore_medium_eq \\_updates_padding_objeq \\_ostore_uptodate_def)\n\n moreover have \"\\_ostore_runtime ?ostore_st = \\_ostore_uptodate ?ostore_st\"\n using inv_ostore\n by (simp add: runtime_eq uptodate_eq inv_ostore_def)\n\n moreover have \"inv_ostore_summary mount_st ?ostore_st\"\n by (simp add: inv_ostore_summary_def)\n\n moreover have \"inv_ostore_index mount_st ?ostore_st\"\n using inv_ostore_index_padding_obj[OF inv_ostore inv_mount_st pad_to] used_eq_pad_to by simp\n moreover have \"inv_ostore_index_gim_disjoint ?ostore_st\"\n using inv_ostore fsm_st\n by (fastforce simp: prepared_fsm_padding_obj_def inv_ostore_def inv_ostore_index_gim_disjoint_def)\n \n moreover have inv_ostore_fsm: \"inv_ostore_fsm mount_st ?ostore_st\"\n apply (simp add: inv_ostore_fsm_def used_eq_pad_to)\n apply (rule conjI)\n using inv_ostore_fsmD[OF inv_ostore, simplified inv_ostore_fsm_def]\n padding_obj fsm_st\n apply (fastforce simp add: prepared_fsm_padding_obj_def)\n apply (rule conjI)\n using inv_ostore_fsmD[OF inv_ostore, simplified inv_ostore_fsm_def Let_def]\n apply (case_tac \"fsm_st = fsm_st\\<^sub>f ostore_st\", simp)\n using snd_list_trans_no_pad_all_padding_obj\n apply (simp add: list_eb_log_wbuf_def )\n using snd_list_trans_no_pad_all_padding_obj fsm_st\n apply (clarsimp simp add: padding_obj list_eb_log_wbuf_def prepared_fsm_padding_obj_def)\n using inv_ostore_fsmD[OF inv_ostore, simplified inv_ostore_fsm_def] fsm_st\n apply (fastforce simp add: padding_obj prepared_fsm_padding_obj_def)\n done\n\n moreover have \"inv_bufs mount_st ?ostore_st\"\n using inv_ostore_sync_offsD[OF inv_ostore] inv_ostore_used_len_wbufD[OF invs]\n sync_lt_used used_gt_zero\n apply (simp add: inv_bufs_def Let_def pad_to' buf_take_def wordarray_make take_n_buf_sub_slice_m used_eq_pad_to)\n apply safe\n apply (simp_all add: inv_ostore[simplified Let_def inv_ostore_def]inv_bufsD[OF inv_ostore, simplified buf_take_def])\n apply (simp add: valid_list_trans_no_pad_def) \n apply (rule conjI)\n using valid_list_trans_buf_slice_sync_offs_pad_to[simplified pad_to'] apply simp\n apply (simp add: buf_slice_def wordarray_make)\n apply (subst slice_buf_sub_slice[OF sync_le_used])\n using used_le_padding_to[OF invs] apply (simp add: padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]])\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_simps) \n using used_le_padding_to[OF inv_ostore inv_mount_st]\n apply (simp add: pad_to' pad_to pad_simps len_sObj'[OF valid_pad_obj, symmetric])\n apply unat_arith\n apply (subst list_trans_no_pad_append[symmetric])\n using inv_bufsD[OF inv_ostore] used_gt_zero len_sObj'[symmetric]\n apply (simp add: valid_list_trans_no_pad_def )\n using padding_obj len_sObj'[OF valid_pad_obj] pad_to' valid_list_trans_pad_obj apply simp\n using inv_bufsD[OF inv_ostore] sync_lt_used apply (simp add: valid_list_trans_no_pad_def)\n using inv_bufsD[OF inv_ostore] used_gt_zero apply (simp add: valid_list_trans_no_pad_def buf_take_def)\n apply (simp add: buf_slice_def wordarray_make)\n apply (subst slice_buf_sub_slice[OF sync_le_used used_le_pad_to[simplified pad_to']])\n using padding_to_le_length_wbuf[OF invs, simplified pad_simps] apply simp\n using len_sObj[OF valid_hdr obj valid_pad_obj, symmetric] apply (simp add: pad_to')\n using len_sObj'[OF valid_pad_obj] apply (simp add: pad_to')\n apply (subst slice_buf_sub_slice[OF sync_le_used used_le_pad_to[simplified pad_to']])\n using padding_to_le_length_wbuf[OF invs] apply (simp add: pad_simps)\n using len_sObj[OF valid_hdr obj valid_pad_obj] apply (simp add: pad_to')\n using snd_list_trans_no_pad_padding_obj[OF valid_list_trans_pad_obj] apply simp\n using inv_bufsD[OF inv_ostore] apply (clarsimp simp add: valid_list_trans_no_pad_def buf_take_def)\n done\n\n moreover have \"inv_fsm_st mount_st (fsm_st\\<^sub>f ?ostore_st)\"\n proof cases\n assume \"fsm_st = fsm_st\\<^sub>f ostore_st\"\n thus ?thesis\n using inv_fsm_stD[OF inv_ostore] by(simp add: inv_fsm_st_def)\n next\n assume \"fsm_st \\ fsm_st\\<^sub>f ostore_st\"\n hence \"fsm_st = prepared_fsm_padding_obj ostore_st pad_to\"\n using fsm_st by simp\n thus ?thesis\n using inv_fsm_stD[OF inv_ostore]\n by (simp add: padding_obj prepared_fsm_padding_obj_def\n inv_fsm_st_def wordarray_make)\n qed\n moreover have \"inv_flash (list_eb_log_wbuf ?ostore_st) \" by (simp add: inv_flash_def)\n moreover have \"inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))\n (prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ?ostore_st) (sync_offs\\<^sub>f ostore_st) (pad_to))))\"\n using snd_list_trans_no_pad_padding_obj_sync_pad_to\n inv_logD[OF inv_ostore, folded inv_log_def] \n by simp\n\n moreover have \"inv_opad obj\"\n using inv_opadD[OF inv_ostore] obj padding_obj\n by clarsimp (simp add: inv_opad_def ostore_update_padding_obj' bilbyFsTransCommit_def\n bilbyFsObjHeaderSize_def)\n\n ultimately show ?thesis\n using padding_to_io_size_no_overflow[OF inv_ostore inv_mount_st]\n inv_ostore inv_opadD[OF inv_ostore]\n padding_to_le_eb_size[OF invs]\n apply (clarsimp simp add: inv_ostore_def pad_to buf_simps used_eq_pad_to)\n done\nqed\n\nlemma opad_is_valid_ObjHeader:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and padding_obj: \"\\ pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n\n notes pad_simps = padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]\n notes pad_to' = pad_to[simplified pad_simps]\n and ostore_update_padding_obj' = ostore_update_padding_obj_def[unfolded tuple_simps sanitizers]\n\n shows\n \"is_valid_ObjHeader\n (ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize))\n (drop (unat (used\\<^sub>f ostore_st)) (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st))))\"\n using inv_opadD[OF inv_ostore] padding_obj inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n inv_ostore_usedD[OF inv_ostore] inv_mount_st[simplified inv_mount_st_def Let_def]\n used_le_padding_to[OF inv_ostore inv_mount_st]\n apply (clarsimp simp add: is_valid_ObjHeader_def bilbyFsTransCommit_def \n ostore_update_padding_obj' bilbyFsObjHeaderSize_def pad_to' word_le_nat_alt)\n apply (thin_tac _)+\n apply safe\n using padding_to_le_length_wbuf[OF inv_ostore inv_mount_st]\n inv_ostore_used_len_wbufD[OF inv_ostore inv_mount_st]\n used_le_padding_to[OF inv_ostore inv_mount_st]\n padding_obj\n apply (simp add: bilbyFsObjHeaderSize_def le_def pad_to pad_to'\n padding_to_def[unfolded tuple_simps sanitizers], unat_arith)\n using pad_to padding_obj apply (simp add: otype_simps is_len_and_type_ok_def\n bilbyFsObjHeaderSize_def padding_to_def[unfolded tuple_simps sanitizers])\n done\n\nlemma inv_step_padding_obj:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and obj: \"\\crc. obj = ostore_update_padding_obj\n (opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize)\n \\crc\\<^sub>f :=crc\\\"\n and valid_pad_obj: \"valid_pad_obj obj\"\n and padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n and used_eq_pad_to: \"used = pad_to\"\n and fsm_st: \"fsm_st \\ {fsm_st\\<^sub>f ostore_st, prepared_fsm_padding_obj ostore_st pad_to}\"\n and inv_step: \"inv_\\_ostore (\\_ostore_uptodate ostore_st)\"\n\n notes invs = inv_ostore inv_mount_st\n and pad_to' = pad_to[simplified padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]]\n and valid_hdr = valid_commit_pad_obj[OF invs pad_to obj padding_obj, simplified is_valid_ObjTrans, THEN conjunct1]\n\n shows \"inv_\\_ostore (\\_ostore_uptodate (ostore_st \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f := WordArrayT.make (buf_sub_slice (wbuf\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) pad_to (sObj obj))\\,\n opad\\<^sub>f := obj, used\\<^sub>f := used,\n OstoreState.next_sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st + 1,\n fsm_st\\<^sub>f := fsm_st,\n OstoreState.oaddr\\<^sub>f := oaddr\\))\"\n apply (clarsimp simp add: inv_\\_ostore_def \\_ostore_uptodate_def)\n apply (simp add: \\_updates_padding_objeq[OF inv_ostore inv_mount_st pad_to used_eq_pad_to sync_lt_used valid_hdr obj valid_pad_obj padding_obj])\n using inv_step apply (clarsimp simp add: inv_\\_ostore_def \\_ostore_uptodate_def)\n apply (rename_tac oid obj')\n apply (erule_tac x=oid in allE)\n apply (erule_tac x=obj' in allE)\n apply (simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def)\ndone\n\nlemma prepare_wbuf_ret:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and inv_step: \"inv_\\_ostore (\\_ostore_uptodate ostore_st)\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and err: \n \"\\ex'. P ((ex',ostore_st), Error eOverflow)\"\n and suc:\n \"\\ex' ostore_st'. \\\n inv_ostore mount_st ostore_st';\n inv_\\_ostore (\\_ostore_uptodate ostore_st');\n \\len sqnum crc oaddr nxtsqnum. ostore_st' =\n ostore_st\\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\\data\\<^sub>f:=WordArrayT.make $\n buf_prepared ostore_st (used\\<^sub>f ostore_st) pad_to (prepared_pad_obj ostore_st pad_to crc)\\,\n used\\<^sub>f := pad_to,\n fsm_st\\<^sub>f := prepared_fsm_padding_obj ostore_st pad_to,\n OstoreState.oaddr\\<^sub>f:= oaddr, \n OstoreState.next_sqnum\\<^sub>f:= nxtsqnum,\n opad\\<^sub>f:=opad\\<^sub>f ostore_st \\Obj.len\\<^sub>f:=len, Obj.sqnum\\<^sub>f := sqnum, Obj.crc\\<^sub>f := crc\\\\;\n OstoreState.next_sqnum\\<^sub>f ostore_st \\ OstoreState.next_sqnum\\<^sub>f ostore_st'\n \\\n \\ P ((ex',ostore_st'), Success ())\"\n notes pad_simps = padding_to_eq_align32_simp[OF inv_mount_st_no_summaryD[OF inv_mount_st]]\n notes pad_to' = pad_to[simplified pad_simps]\n and ostore_update_padding_obj' = ostore_update_padding_obj_def[unfolded tuple_simps sanitizers]\n shows \"P (prepare_wbuf (ex, mount_st, ostore_st, pad_to))\"\n proof cases\n assume no_padding_obj: \"pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize\"\n let ?wbuf = \"buf_memset (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, pad_to - used\\<^sub>f ostore_st, bilbyFsPadByte)\"\n let ?ostore_st = \"ostore_st\\wbuf\\<^sub>f := ?wbuf, used\\<^sub>f := pad_to\\\"\n have bound: \"unat (bound\\<^sub>f (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n using inv_ostore_bound_le_lenD[OF inv_ostore] by simp\n have index_unchanged: \"index_st\\<^sub>f ?ostore_st = index_st\\<^sub>f ostore_st\" by simp\n have list_eb_log_eq: \"list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ?ostore_st)) = list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\"\n by (simp add: list_eb_log_def)\n have pad_to_le: \"unat pad_to \\ length (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st)\"\n using align32_upper_bound[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\" and bound=\"eb_size\\<^sub>f (super\\<^sub>f mount_st)\"]\n inv_ostore[simplified inv_ostore_def] inv_mount_st[simplified Let_def inv_mount_st_def]\n inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n by (simp add : pad_to') unat_arith\n\n have used_le_pad_to: \"used\\<^sub>f ostore_st \\ pad_to\"\n using align32_le[where v=\"used\\<^sub>f ostore_st\" and al=\"io_size\\<^sub>f (super\\<^sub>f mount_st)\"] inv_mount_st[simplified inv_mount_st_def Let_def]\n pad_to' inv_ostore_used_no_overflowD[OF inv_ostore]\n by simp\n have unat_used_le_pad_to: \"unat (used\\<^sub>f ostore_st) \\ unat pad_to\" using used_le_pad_to by unat_arith\n have \\_updates_eq: \"\\_updates ?ostore_st = \\_updates ostore_st\"\n by (rule prepare_wbuf_memset_\\_updates_eq[OF inv_ostore inv_mount_st pad_to sync_lt_used])\n have \\_medium_eq: \"\\_ostore_medium ?ostore_st = \\_ostore_medium ostore_st\"\n by (simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def list_eb_log_eq)\n have inv_step': \"inv_\\_ostore (\\_ostore_uptodate ?ostore_st)\"\n using inv_step\n by (clarsimp simp add: \\_ostore_uptodate_def Let_def \\_medium_eq \\_updates_eq)\n have inv_ostore': \"inv_ostore mount_st ?ostore_st\"\n using inv_ostore_padding_bytes_preserved[OF inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used] .\n show ?thesis\n unfolding prepare_wbuf_def[unfolded tuple_simps sanitizers]\n apply (fold bilbyFsObjHeaderSize_def)\n using no_padding_obj apply (simp add: pad_to')\n apply (rule suc)\n apply (fold bilbyFsPadByte_def)\n using inv_ostore' apply (simp add: pad_to padding_to_def ostoreWriteNone_def)\n apply(fastforce intro: subst[where P=\\inv_ostore mount_st\\,rotated])\n using inv_step' apply (simp add: pad_to padding_to_def ostoreWriteNone_def)\n apply (fastforce intro: subst[where P=\\\\x. inv_\\_ostore (\\_ostore_uptodate x)\\,rotated])\n apply (rule_tac x=\"Obj.len\\<^sub>f (opad\\<^sub>f ?ostore_st)\" in exI)\n apply (rule_tac x=\"Obj.sqnum\\<^sub>f (opad\\<^sub>f ?ostore_st)\" in exI)\n apply (rule_tac x=\"Obj.crc\\<^sub>f (opad\\<^sub>f ?ostore_st)\" in exI)\n apply (rule_tac x=\"(OstoreState.oaddr\\<^sub>f ?ostore_st)\" in exI)\n apply (rule_tac x=\"(OstoreState.next_sqnum\\<^sub>f ?ostore_st)\" in exI)\n apply (subst buf_memset_eq)\n using bound apply simp\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply (simp add: pad_to' pad_simps)\n apply (fastforce simp add: pad_to padding_to_def \n ostoreWriteNone_def buf_prepared_def prepared_fsm_padding_obj_def)\n apply simp\n done\n\n next\n assume padding_obj: \"\\ (pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize)\"\n\n have pad_to_upd:\n \"used\\<^sub>f ostore_st +\n Obj.len\\<^sub>f (ostore_update_padding_obj(opad\\<^sub>f ostore_st, OstoreState.next_sqnum\\<^sub>f ostore_st,\n pad_to - used\\<^sub>f ostore_st - bilbyFsObjHeaderSize))\n = pad_to\"\n by (simp add: ostore_update_padding_obj' pad_to pad_simps bilbyFsObjHeaderSize_def)\n\n have dummy_upds: \"\\x. x = x\\fsm_st\\<^sub>f := fsm_st\\<^sub>f x, OstoreState.oaddr\\<^sub>f := OstoreState.oaddr\\<^sub>f x\\\"\n by simp\n\n have dummy_upds': \"\\x a b c d. x\\OstoreState.next_sqnum\\<^sub>f := a, used\\<^sub>f := b, opad\\<^sub>f := c, wbuf\\<^sub>f := d\\ = x\\wbuf\\<^sub>f := d, opad\\<^sub>f := c, used\\<^sub>f := b, OstoreState.next_sqnum\\<^sub>f := a, fsm_st\\<^sub>f := fsm_st\\<^sub>f x, OstoreState.oaddr\\<^sub>f := OstoreState.oaddr\\<^sub>f x\\\"\n by simp\n\n have ostore_upds_reorder: \"\\x a b c d e f. x\\OstoreState.next_sqnum\\<^sub>f := a, used\\<^sub>f := b, opad\\<^sub>f := c, wbuf\\<^sub>f := d, fsm_st\\<^sub>f := e, OstoreState.oaddr\\<^sub>f := f\\ = x\\wbuf\\<^sub>f := d, opad\\<^sub>f := c, used\\<^sub>f := b, OstoreState.next_sqnum\\<^sub>f := a, fsm_st\\<^sub>f := e, OstoreState.oaddr\\<^sub>f := f\\\" by simp\n\n have ostore_upds_reorder': \"\\x a b c d e f. x\\OstoreState.next_sqnum\\<^sub>f := a, used\\<^sub>f := b, opad\\<^sub>f := c, wbuf\\<^sub>f := d, fsm_st\\<^sub>f := e, OstoreState.oaddr\\<^sub>f := f\\ = x\\wbuf\\<^sub>f := d, used\\<^sub>f := b, fsm_st\\<^sub>f := e, OstoreState.oaddr\\<^sub>f := f, OstoreState.next_sqnum\\<^sub>f := a, opad\\<^sub>f := c\\\" by simp\n\n have obj_upds_reorder: \"\\x a b c. x \\trans\\<^sub>f := a, Obj.len\\<^sub>f := b, Obj.sqnum\\<^sub>f := c\\ = x \\Obj.sqnum\\<^sub>f := c, Obj.len\\<^sub>f := b, trans\\<^sub>f := a\\\" by simp\n\n from padding_obj show ?thesis\n unfolding prepare_wbuf_def[unfolded tuple_simps sanitizers, folded bilbyFsObjHeaderSize_def]\n apply (simp add: Let_def)\n apply (rule safe_add64)\n apply (simp add: Let_def, fold eOverflow_def )\n apply (simp add: err)\n apply (simp add: Let_def )\n apply (rule serialise_Obj_ret)\n apply (simp add: pad_to' bilbyFsObjHeaderSize_def ostore_update_padding_obj')\n using used_le_padding_to[OF inv_ostore inv_mount_st] apply (simp add: pad_simps) \n using opad_is_valid_ObjHeader[OF inv_ostore inv_mount_st padding_obj pad_to] apply simp\n using inv_opadD[OF inv_ostore] apply (clarsimp simp add: ostore_update_padding_obj' )\n using inv_opadD[OF inv_ostore] apply (clarsimp simp add: ostore_update_padding_obj' )\n using inv_ostore_eb_size_wbuf_eqD[OF inv_ostore]\n inv_ostore_wbuf_boundD[OF inv_ostore]\n padding_to_le_eb_size[OF inv_ostore inv_mount_st]\n apply (clarsimp simp add: pad_to buf_simps ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n apply (rename_tac buf')\n apply (simp add: prod.case_eq_if)\n apply (rule update_obj_pad_ret[OF _ inv_mount_st])\n apply (rule ssubst[OF dummy_upds'])\n apply (rule inv_ostore_preserved_padding_obj[OF inv_ostore inv_mount_st _ used_gt_zero sync_lt_used])\n using pad_to_upd apply (simp add: pad_to)\n apply (simp add: ostore_update_padding_obj' pad_to pad_simps bilbyFsObjHeaderSize_def)\n apply (rule_tac x=\"crc\\<^sub>f (opad\\<^sub>f ostore_st)\" in exI)\n apply simp\n\n using inv_ostore_valid_pad_objD[OF inv_ostore] apply (clarsimp simp:ostore_update_padding_obj' valid_pad_obj_def is_valid_Obj_def)\n apply (simp add: ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n using inv_opadD[OF inv_ostore] apply (clarsimp simp add: ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore]\n apply (simp add: ostore_update_padding_obj' pad_to pad_simps bilbyFsObjHeaderSize_def)\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore] apply simp\n\n apply (rule suc)\n apply simp\n apply(subst ostore_upds_reorder)\n apply (rule inv_ostore_preserved_padding_obj[OF inv_ostore \n inv_mount_st _ used_gt_zero sync_lt_used])\n using pad_to_upd apply (simp add: pad_to)\n apply (simp add: ostore_update_padding_obj' pad_to pad_simps bilbyFsObjHeaderSize_def)\n apply (rule_tac x=\"crc\\<^sub>f (opad\\<^sub>f ostore_st)\" in exI)\n apply simp\n apply (simp add: ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n using inv_ostore_valid_pad_objD[OF inv_ostore] apply (clarsimp simp:ostore_update_padding_obj' valid_pad_obj_def is_valid_Obj_def)\n using inv_opadD[OF inv_ostore] apply (clarsimp simp add: ostore_update_padding_obj' bilbyFsObjHeaderSize_def)\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore]\n apply (simp add: ostore_update_padding_obj' pad_to pad_simps bilbyFsObjHeaderSize_def)\n using padding_obj apply (simp add: prepared_fsm_padding_obj_def pad_simps bilbyFsObjHeaderSize_def pad_to' ostore_update_padding_obj')\n apply simp\n apply(subst ostore_upds_reorder)\n apply (rule inv_step_padding_obj[OF inv_ostore inv_mount_st _ used_gt_zero sync_lt_used ])\n using pad_to_upd apply (simp add: pad_to)\n apply (rule_tac x=\"crc\\<^sub>f (opad\\<^sub>f ostore_st)\" in exI)\n using pad_to_upd apply (clarsimp simp add: pad_to ostore_update_padding_obj_def Let\\<^sub>d\\<^sub>s_def)\n using inv_ostore_valid_pad_objD[OF inv_ostore] apply (clarsimp simp: valid_pad_obj_def ostore_update_padding_obj' is_valid_Obj_def)\n using pad_to_upd apply (clarsimp simp add: pad_to ostore_update_padding_obj')\n using pad_to_upd apply (clarsimp simp add: pad_to ostore_update_padding_obj')\n using pad_to_upd apply (clarsimp simp add: pad_to ostore_update_padding_obj' prepared_fsm_padding_obj_def)\n using inv_step apply simp\n apply simp\n using [[goals_limit=2]]\n apply (rule_tac x=\"pad_to - used\\<^sub>f ostore_st\" in exI)\n apply (rule_tac x=\"OstoreState.next_sqnum\\<^sub>f ostore_st\" in exI)\n apply (rule_tac x=\"crc\\<^sub>f (opad\\<^sub>f ostore_st)\" in exI)\n apply (rule_tac x=\"v\" in exI)\n apply (rule_tac x=\"OstoreState.next_sqnum\\<^sub>f ostore_st + 1\" in exI)\n apply simp\n apply (simp add: prepared_fsm_padding_obj_def buf_prepared_def padding_obj pad_to_upd)\n apply (simp add: ostore_update_padding_obj' prepared_pad_obj_def Let_def\n bilbyFsObjHeaderSize_def prepared_pad_obj_no_crc_def bilbyFsTransCommit_def )\n (* FIX Cogent code, currently it updates the otype field but shouldn't because\n the type of opad is part of the invariant *)\n using inv_opadD[OF inv_ostore] apply (clarsimp simp: bilbyFsTransCommit_def)\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore]\n apply (subst ostore_upds_reorder')\n apply (subst obj_upds_reorder)+\n apply (simp)+\n done\n qed\n\ndefinition\n sync_summary_serial :: \"OstoreState\\<^sub>T \\ (Obj\\<^sub>T \\ Buffer\\<^sub>T \\ U32)\"\nwhere\n \"sync_summary_serial ostore_st \\\n serialise_ObjSummary_crc\n (wbuf\\<^sub>f ostore_st, used\\<^sub>f ostore_st, sum_obj\\<^sub>f ostore_st\n \\Obj.sqnum\\<^sub>f := OstoreState.next_sqnum\\<^sub>f ostore_st, Obj.offs\\<^sub>f := used\\<^sub>f ostore_st,\n trans\\<^sub>f := bilbyFsTransCommit,\n Obj.len\\<^sub>f := serialise_size_summary_Obj_with_extra (summary\\<^sub>f ostore_st, 0)\\,\n summary\\<^sub>f ostore_st\\sum_offs\\<^sub>f := used\\<^sub>f ostore_st\\)\"\n\nlemma ostore_sync_summary_if_eb_new_ret:\n \"inv_ostore mount_st ostore_st \\\n inv_mount_st mount_st \\\n inv_\\_ostore (\\_ostore_uptodate ostore_st) \\\n (\\ex'. P ((ex', ostore_st), R.Success ())) \\\n P (ostore_sync_summary_if_eb_new (ex, mount_st, ostore_st, ostoreWriteNone))\"\n by (simp add: ostore_sync_summary_if_eb_new_def[unfolded tuple_simps sanitizers])\n\nlemma ostore_write_buf_inv_ostore_index:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and ubi_vol:\"\\wubi ubi_vol' = (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\n [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @\n buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st + nb_bytes)]\"\nshows\n \"inv_ostore_index mount_st (ostore_st\\OstoreState.ubi_vol\\<^sub>f := ubi_vol'\\)\"\n using inv_ostore inv_mount_st[unfolded inv_mount_st_def]\n apply (clarsimp simp: inv_ostore_def Let_def inv_ostore_index_def ostore_get_obj_def)\n apply (rename_tac oid addr)\n apply (erule_tac x=oid in ballE)\n apply (case_tac \"ObjAddr.ebnum\\<^sub>f addr \\ wbuf_eb\\<^sub>f ostore_st\")\n using ubi_vol apply (clarsimp simp: is_valid_addr_def)+\n done\n\nlemma map_list_trans_upd_eq:\n \"(map f (drop m (xs[n:=y''])))[n-m:=y] =\n (map f (drop m xs))[n-m:=y]\"\n apply (clarsimp simp: list_eq_iff_nth_eq )\n apply (rename_tac i, case_tac \"i = n-m\")\n apply (clarsimp simp del: list_trans.simps)+\n done\n\nlemma ostore_write_buf_inv_ostore_fsm:\n \" inv_ubi_vol mount_st ubi_vol' \\\n \\wubi ubi_vol' = (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\n [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @\n buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st + nb_bytes)] \\\n inv_ostore_fsm mount_st ostore_st \\\n inv_ostore_fsm mount_st (ostore_st\\OstoreState.ubi_vol\\<^sub>f := ubi_vol'\\)\"\n apply (subgoal_tac \"list_eb_log_wbuf (ostore_st\\OstoreState.ubi_vol\\<^sub>f := ubi_vol'\\) = list_eb_log_wbuf ostore_st\")\n apply (clarsimp simp add: inv_ostore_fsm_def list_eb_log_wbuf_def list_eb_log_def simp del:list_trans.simps)+\n apply (rule map_list_trans_upd_eq)\n done \n\nlemma word_not_0_gr_n:\n \"(\\ 0 < (n::'a::len0 word)) = (n = 0)\"\n by (unat_arith, simp add: unat_0_iff)\n\nlemma inv_ostore_sync_offs_agnostic:\n \"inv_ostore_summary mount_st (ostore_st\\sync_offs\\<^sub>f:=v\\) = inv_ostore_summary mount_st ostore_st\"\n \"inv_ostore_index mount_st (ostore_st\\sync_offs\\<^sub>f := v\\)= inv_ostore_index mount_st ostore_st\"\n \"inv_ostore_index_gim_disjoint (ostore_st\\sync_offs\\<^sub>f := v\\) = inv_ostore_index_gim_disjoint ostore_st\"\n \"inv_ostore_fsm mount_st (ostore_st\\sync_offs\\<^sub>f := v\\) = inv_ostore_fsm mount_st ostore_st\"\n \"inv_flash (list_eb_log_wbuf (ostore_st\\sync_offs\\<^sub>f := v\\)) = inv_flash (list_eb_log_wbuf ostore_st)\"\n apply (clarsimp simp: inv_ostore_summary_def room_for_summary_def\n inv_sum_consistent_def os_sum_sz_def)\n apply (simp add: inv_ostore_index_def Let_def is_valid_addr_def ostore_get_obj_def)\n apply (simp add: inv_ostore_index_gim_disjoint_def)\n apply (simp add: inv_ostore_fsm_def list_eb_log_wbuf_def list_eb_log_def del: list_trans.simps)\n apply (simp add: inv_flash_def)\n done\n\nlemma inv_ostore_medium_buf_prepared:\nshows\n \"\\_ostore_medium\n (ostore_st\n \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\,\n used\\<^sub>f := padding_to (mount_st, ostore_st, ostoreWriteNone) \\) =\n \\_ostore_medium ostore_st\"\nby (clarsimp simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def list_eb_log_def)\n\nlemma snd_list_trans_buf_prepared_eq:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n\n notes invs_pad_ofs = inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used\n shows\n \"prod.snd (list_trans_no_pad\n (buf_slice\n (wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st\n (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\)\n (sync_offs\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone)))) =\n prod.snd(list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st)\n (used\\<^sub>f ostore_st)))\"\n proof -\n show ?thesis\n proof cases\n assume pt: \"padding_to (mount_st, ostore_st, ostoreWriteNone) - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize\"\n have bound: \"unat (bound\\<^sub>f (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n using inv_ostore_bound_le_lenD[OF inv_ostore] by simp\n have used_of: \"used\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st + (pad_to - used\\<^sub>f ostore_st)\"\n apply (simp add: pad_to)\n using used_le_padding_to[OF inv_ostore inv_mount_st] by simp\n \n show ?thesis\n using pt\n using snd_list_trans_memset[OF invs_pad_ofs, where frm=\"sync_offs\\<^sub>f ostore_st\"]\n by (simp add: buf_prepared_def pad_to buf_memset_eq[where buf=\"wbuf\\<^sub>f ostore_st\", OF bound used_of, simplified pad_to])\n next\n assume \"\\ padding_to (mount_st, ostore_st, ostoreWriteNone) - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize\"\n thus ?thesis\n apply (simp add: buf_prepared_def pad_to)\n apply (rule snd_list_trans_no_pad_padding_obj_sync_pad_to[OF invs_pad_ofs, simplified pad_to])\n apply (simp add: prepared_pad_obj_def)\n apply (rule valid_commit_pad_obj[OF inv_ostore inv_mount_st pad_to, simplified is_valid_ObjTrans, THEN conjunct1])\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_def prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)+\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)\n using inv_ostore_valid_pad_objD[OF inv_ostore]\n apply (clarsimp simp add: prepared_pad_obj_no_crc_def valid_pad_obj_def prepared_pad_obj_def is_valid_Obj_def)\n apply simp\n done\n qed\nqed\n\nlemma valid_list_trans_buf_prepared_eq:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n\n notes invs_pad = inv_ostore inv_mount_st pad_to \n\n shows\n \"valid_list_trans\n (buf_slice\n (wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st) pad_to\n (prepared_pad_obj ostore_st pad_to crc))\\)\n (sync_offs\\<^sub>f ostore_st) pad_to)\"\nproof -\n have bound: \"unat (bound\\<^sub>f (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n using inv_ostore_bound_le_lenD[OF inv_ostore] by simp\n have used_of: \"used\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st + (pad_to - used\\<^sub>f ostore_st)\"\n apply (simp add: pad_to)\n using used_le_padding_to[OF inv_ostore inv_mount_st] by simp\n \nshow ?thesis\n\n apply (simp add: buf_prepared_def prepared_pad_obj_def)\n apply (case_tac \"pad_to - used\\<^sub>f ostore_st < bilbyFsObjHeaderSize\")\n apply simp\n using buf_slice_buf_memset_is_append_padding[OF invs_pad, where frm=\"sync_offs\\<^sub>f ostore_st\", simplified buf_memset_eq[OF bound used_of]]\n using inv_bufsD[OF inv_ostore] sync_lt_used\n apply (simp add: valid_list_trans_append_padding valid_list_trans_no_pad_imp_valid_list_trans)\n apply simp\n apply (rule valid_list_trans_buf_slice_sync_offs_pad_to[OF invs_pad used_gt_zero sync_lt_used])\n apply (rule valid_commit_pad_obj[OF inv_ostore inv_mount_st pad_to, simplified is_valid_ObjTrans, THEN conjunct1])\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_def prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)+\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_def prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)+\n using inv_ostore_valid_pad_objD[OF inv_ostore]\n apply (clarsimp simp add: prepared_pad_obj_no_crc_def valid_pad_obj_def prepared_pad_obj_def is_valid_Obj_def)\n apply simp\n done\nqed\n\nlemma list_trans_no_pad_slice_drop_append:\nnotes list_trans.simps[simp del]\nand pTrans.simps[simp del]\nassumes valid_slice: \"valid_list_trans (slice frm to xs)\"\nand valid_drop: \"valid_list_trans (drop to xs)\"\nand \"frm \\ to\"\nand \"to \\ length xs\"\nshows\n \"prod.snd (list_trans_no_pad (slice frm to xs)) @ prod.snd (list_trans_no_pad (drop to xs)) =\n prod.snd (list_trans_no_pad (drop frm xs))\"\n using list_trans_no_pad_append[where xs=\"slice frm to xs\" and ys=\"drop to xs\"]\n assms\n by (clarsimp simp: slice_drop)\n\nlemma map_ostore_update_append:\n \"map ostore_update xs @ map ostore_update ys = map ostore_update (xs @ ys)\"\n by simp\n\nlemma fold_id_append:\n \"fold id xs (fold id ys Map.empty) = fold id (ys @ xs) Map.empty\"\n by simp\n\n(* Taken from AFP containers *)\nlemma insort_key_append1:\n \"\\y \\ set ys. f x < f y \\ insort_key f x (xs @ ys) = insort_key f x xs @ ys\"\nproof(induct xs)\n case Nil\n thus ?case by(cases ys) auto\nqed simp\n\nlemma insort_key_append2:\n \"\\y \\ set xs. f x > f y \\ insort_key f x (xs @ ys) = xs @ insort_key f x ys\"\nby(induct xs) auto\n\nlemma sort_key_append[symmetric]:\n \"\\x\\set xs. \\y\\set ys. f x < f y \\ sort_key f (xs @ ys) = sort_key f xs @ sort_key f ys\"\nby(induct xs)(simp_all add: insort_key_append1)\n\n(* end of AFP containers *)\n\nlemma inj_on_filter_key_eq:\n \"inj_on s (insert k (set xs)) \\ [x\\xs . s k = s x] = filter ((=) k) xs\"\n apply (induct xs)\n apply simp\n apply (drule meta_mp, erule subset_inj_on)\n apply auto[1]\n apply (drule_tac x=k and y=a in inj_on_eq_iff, auto)\n done\n\nlemma filter_eq_replicate_count_multiset:\n \"filter ((=) k) xs = replicate (count (mset xs) k) k\"\n by (induct xs, auto)\n\nlemma sort_key_multiset_eq:\n assumes multiset: \"mset xs = mset ys\"\n and inj_on: \"inj_on f (set xs)\"\n shows \"sort_key f xs = sort_key f ys\"\nproof -\n from multiset have set:\n \"set xs = set ys\"\n by (rule mset_eq_setD)\n note filter = inj_on_filter_key_eq[OF subset_inj_on, OF inj_on]\n show ?thesis\n apply (rule properties_for_sort_key)\n apply (simp add: multiset)\n apply (simp add: filter set)\n apply (simp add: filter_eq_replicate_count_multiset multiset)\n apply simp\n done\nqed\n\nlemma sort_key_concat_map:\n assumes i: \"i < length xs\" \"i \\ n\"\n and f: \"f (xs!i@ys) = f (xs!i) @ f ys\"\n and s: \"inj_on s (set (concat (map f (drop n xs@[ys]))))\"\n shows \"sort_key s (concat (map f (drop n (xs[i:=xs!i@ys])))) =\n sort_key s (concat (map f ((drop n xs)@[ys])))\"\nproof -\n from i obtain xs1 xi xs2 where xs_split: \"xs = xs1 @ [xi] @ xs2\"\n and xi: \"xs ! i = xi\" and length_xs1[simp]: \"length xs1 = i\"\n apply (erule_tac x=\"take i xs\" in meta_allE)\n apply (erule_tac x=\"xs ! i\" in meta_allE)\n apply (erule_tac x=\"tl (drop i xs)\" in meta_allE)\n apply (cases \"drop i xs\", simp_all)\n apply (frule_tac f=hd in arg_cong, subst(asm) hd_drop_conv_nth, simp+)\n apply (cut_tac n=i and xs=xs in append_take_drop_id, simp)\n done\n\n from i have multiset: \"mset (concat (map f (drop n xs))) + mset (f ys) =\n mset (concat (map f (drop n (xs[i := xs ! i @ ys]))))\"\n\n apply (simp add: xs_split drop_list_update)\n apply (simp add: list_update_append nth_append f[simplified xi])\n done\n\n note set = arg_cong[where f=set_mset, OF multiset[symmetric], simplified]\n\n show ?thesis\n apply (rule sort_key_multiset_eq)\n apply (simp add: multiset)\n apply (rule subset_inj_on[OF s])\n apply (simp add: set)\n done\nqed\n\nlemma sort_key_concat_ignores_order:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n assumes trans_order:\n \"\\x\\set (concat $ list_eb_log (\\wubi $ OstoreState.ubi_vol\\<^sub>f ostore_st)).\n \\y\\set (prod.snd (list_trans_no_pad xs)).\n trans_order x < trans_order y\"\n assumes inj: \"inj_on trans_order\n (set (concat\n (map (prod.snd \\ list_trans_no_pad)\n (drop (unat bilbyFsFirstLogEbNum) (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)) @\n [xs]))))\"\n assumes used_gt_0: \"0 < used\\<^sub>f ostore_st\"\n assumes valid_xs: \"valid_list_trans xs\"\nshows\n\"sort_key trans_order\n (concat (map (prod.snd \\ list_trans_no_pad) (drop (unat bilbyFsFirstLogEbNum)\n ((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)) [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @ xs])))) =\nsort_key trans_order\n (concat (map (prod.snd \\ list_trans_no_pad) (drop (unat bilbyFsFirstLogEbNum)\n (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)) @ [xs])))\"\n apply (rule sort_key_concat_map)\n using inv_ostore apply (clarsimp simp: inv_ostore_def inv_bufs_def inv_ubi_vol_def, unat_arith)\n using inv_ostore apply (clarsimp simp: inv_ostore_def, unat_arith)\n apply (simp)\n apply (rule list_trans_no_pad_append[symmetric])\n using inv_bufsD[OF inv_ostore] used_gt_0\n apply (clarsimp)\n apply (drule sym[where t=\"buf_take (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) \"])\n apply (simp add: buf_simps valid_list_trans_no_pad_def)\n using valid_xs apply simp\n using inj apply simp\n done\n\nlemma inv_ostore_list_trans_wbuf_sorted[simplified Let_def]:\n \"inv_ostore mount_st ostore_st \\ \n (let sync_to_used = buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) in\n sort_key trans_order (prod.snd (list_trans_no_pad sync_to_used)) =\n prod.snd (list_trans_no_pad sync_to_used))\"\n by (drule inv_bufsD, clarsimp simp: Let_def)\n\nlemma ostore_sync_\\_ostore_uptodate:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and pad_to: \"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and wubi: \"list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st')) = \nlist_eb_log ((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\n [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @\n buf_slice\n (wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\)\n (sync_offs\\<^sub>f ostore_st) (padding_to (mount_st, ostore_st, ostoreWriteNone))])\"\n (is \"... = list_eb_log (?ubi[?wbuf_eb:=?old_ubi@?buf_prepared])\")\n and ostore_m: \"ostore_st'\\OstoreState.ubi_vol\\<^sub>f := v\\ = ostore_st\n \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\,\n used\\<^sub>f := padding_to (mount_st, ostore_st, ostoreWriteNone),\n fsm_st\\<^sub>f := prepared_fsm_padding_obj ostore_st (used\\<^sub>f ostore_st'), OstoreState.oaddr\\<^sub>f := oaddr,\n OstoreState.next_sqnum\\<^sub>f := nxtsqnum, opad\\<^sub>f := opad\\<^sub>f ostore_st\\Obj.len\\<^sub>f := len, Obj.sqnum\\<^sub>f := sqnum, crc\\<^sub>f := crc\\\\\" \n (is \"... = ?ostore_st\")\n\n notes invs_pad_offs = inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used\n\nshows\n \"\\_ostore_medium (ostore_st'\\sync_offs\\<^sub>f := used\\<^sub>f ostore_st'\\) = \\_ostore_uptodate ostore_st\"\n \nproof -\n\nhave sort_key_trans_key_eq: \"sort_key trans_order (concat (map (prod.snd \\ list_trans_no_pad)\n (drop (unat bilbyFsFirstLogEbNum) (?ubi\n [?wbuf_eb := ?ubi ! ?wbuf_eb @ ?buf_prepared])))) =\n sort_key trans_order (concat (map (prod.snd \\ list_trans_no_pad)\n (drop (unat bilbyFsFirstLogEbNum) ?ubi @ [?buf_prepared])))\"\n apply (subst sort_key_concat_ignores_order[OF inv_ostore _ _ used_gt_zero])\n using snd_list_trans_buf_prepared_eq[OF invs_pad_offs]\n apply (simp only: )\n using inv_logD[OF inv_ostore]\n apply clarsimp\n apply (simp only: map_append)\n using snd_list_trans_buf_prepared_eq[OF invs_pad_offs]\n inv_logD[OF inv_ostore]\n apply (fastforce simp: list_eb_log_def)\n using sync_lt_used inv_bufsD[OF inv_ostore] apply clarsimp\n using valid_list_trans_buf_prepared_eq[OF invs_pad_offs]\n apply (simp add: pad_to)+\n done\n\n have sort_trans_key_list_eb_log_eq_append_list_trans: \n \"sort_key trans_order (concat (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st')))) =\n sort_key trans_order (concat (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))) @\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))))\"\n apply (simp only: wubi)\n apply (simp add: ostore_m list_eb_log_def Let_def)\n apply (simp only: sort_key_trans_key_eq)\n apply simp\n apply (simp only: snd_list_trans_buf_prepared_eq[OF invs_pad_offs])\n done\n\n from inv_logD[OF inv_ostore] have trans_order':\n \"\\x\\set (concat $ list_eb_log $ \\wubi $ OstoreState.ubi_vol\\<^sub>f ostore_st).\n \\y\\set (prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st)\n (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))).\n trans_order x < trans_order y\"\n by (simp add: snd_list_trans_buf_prepared_eq[OF inv_ostore inv_mount_st])\n\nshow ?thesis\n apply (simp add: \\_ostore_uptodate_def \\_ostore_medium_def abstract_mount_\\_ostore_def\n wubi \\_updates_def del: list_trans.simps)\n apply (simp only: fold_id_append map_ostore_update_append)\n apply (rule arg_cong[where f=\"\\x. fold id x Map.empty\"])\n apply (rule arg_cong[where f=\"map ostore_update\"])\n apply (subst inv_ostore_list_trans_wbuf_sorted[OF inv_ostore, symmetric])\n using sort_key_append[OF trans_order'[unfolded fun_app_def] ]\n apply (simp add: sort_trans_key_list_eb_log_eq_append_list_trans[simplified wubi])\n done\nqed\n\nlemma inv_ostore_updated_ubi_preserved:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and nb_bytes_eq_pad_to_minus_sync: \"nb_bytes = padding_to (mount_st, ostore_st, ostoreWriteNone) - sync_offs\\<^sub>f ostore_st\"\n and nb_bytes: \"0 < nb_bytes\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and inv_ubi_vol: \"inv_ubi_vol mount_st ubi_vol'\"\n and wubi:\n \"\\wubi ubi_vol' = (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\n [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @\n buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st + nb_bytes)]\"\n and nb_bytes_eq: \"sync_offs\\<^sub>f ostore_st + nb_bytes = used\\<^sub>f ostore_st\"\n\n shows\n \"inv_ostore mount_st (ostore_st\\OstoreState.ubi_vol\\<^sub>f := ubi_vol', sync_offs\\<^sub>f := used\\<^sub>f ostore_st\\)\"\n (is \"inv_ostore mount_st ?ostore_st\")\n proof -\n have ostore_upt_Nil: \"\\_updates ?ostore_st = []\"\n using wubi by (simp add: \\_updates_def \\_ostore_uptodate_def buf_slice_n_n)\n have wubi_mod_ostore_get_obj_eq:\n \"\\addr. addr \\ ran (\\_index (index_st\\<^sub>f ostore_st)) \\ ostore_get_obj ?ostore_st addr = ostore_get_obj ostore_st addr\"\n using wubi by (simp add: ostore_get_obj_def)\n moreover have ostore_rt_eq: \"\\_ostore_runtime ?ostore_st = \\_ostore_runtime ostore_st\"\n apply (rule ext)\n apply (clarsimp simp: option.case_eq_if \\_ostore_runtime_def \\_ostore_medium_def)\n using wubi_mod_ostore_get_obj_eq[simplified ran_def] apply fastforce\n done\n(* copy-paste from proof above should unify them somehow*)\n from inv_logD[OF inv_ostore] have trans_order':\n \"\\x\\set (concat ( list_eb_log ( \\wubi ( OstoreState.ubi_vol\\<^sub>f ostore_st)))).\n \\y\\set (prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st)\n (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))).\n trans_order x < trans_order y\"\n by (simp add: snd_list_trans_buf_prepared_eq[OF inv_ostore inv_mount_st])\n\nhave sort_key_trans_key_eq:\n \"sort_key trans_order\n (concat (map (prod.snd \\ list_trans_no_pad)\n (drop (unat bilbyFsFirstLogEbNum)\n ((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\n [unat (wbuf_eb\\<^sub>f ostore_st) :=\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) @\n buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)])))) =\n sort_key trans_order\n (concat (map (prod.snd \\ list_trans_no_pad) (drop (unat bilbyFsFirstLogEbNum) (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))) @\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))))\"\n apply (subst sort_key_concat_ignores_order[OF inv_ostore _ _ used_gt_zero])\n apply (simp add: trans_order')\n using inv_logD[OF inv_ostore]\n apply (clarsimp simp: list_eb_log_def)\n using sync_lt_used inv_bufsD[OF inv_ostore] apply (clarsimp simp: valid_list_trans_no_pad_imp_valid_list_trans)\n using valid_list_trans_buf_prepared_eq[OF inv_ostore inv_mount_st, where pad_to=\"padding_to (mount_st, ostore_st, ostoreWriteNone)\"]\n apply (simp)+\n done\n\n have sort_trans_key_list_eb_log_eq_append_list_trans: \n \"sort_key trans_order (concat (list_eb_log (\\wubi ubi_vol'))) =\n sort_key trans_order (concat (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))) @\n prod.snd (list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))))\"\n apply (simp only: wubi nb_bytes_eq)\n apply (simp add: list_eb_log_def Let_def)\n apply (simp only: sort_key_trans_key_eq)\n done\n\n moreover have ostore_uptodate_eq_new_ostore_medium:\n \"\\_ostore_medium ?ostore_st = \\_ostore_uptodate ostore_st\"\n apply (simp add: \\_ostore_medium_def abstract_mount_\\_ostore_def wubi)\n apply (simp add: \\_ostore_uptodate_def nb_bytes_eq)\n apply (simp add: \\_ostore_uptodate_def \\_ostore_medium_def abstract_mount_\\_ostore_def\n wubi \\_updates_def del: list_trans.simps)\n apply (simp only: fold_id_append map_ostore_update_append)\n apply (rule arg_cong[where f=\"\\x. fold id x Map.empty\"])\n apply (rule arg_cong[where f=\"map ostore_update\"])\n apply (subst inv_ostore_list_trans_wbuf_sorted[OF inv_ostore, symmetric])\n apply (rule sym)\n apply (rule trans[OF sort_key_append[OF trans_order' ]])\n using sort_trans_key_list_eb_log_eq_append_list_trans[simplified wubi,symmetric]\n apply (simp add: nb_bytes_eq)\n done\n\n moreover have ostore_uptodate_eq:\n \"\\_ostore_uptodate ?ostore_st = \\_ostore_uptodate ostore_st\"\n using ostore_uptodate_eq_new_ostore_medium ostore_upt_Nil\n by (simp add: \\_ostore_uptodate_def)\n\n moreover have \"inv_fsm_st mount_st (fsm_st\\<^sub>f ?ostore_st)\"\n using inv_fsm_stD[OF inv_ostore] by(simp add: inv_fsm_st_def)\n\n moreover have list_eb_log_wbuf_eq:\n \"list_eb_log_wbuf ?ostore_st = list_eb_log_wbuf ostore_st\"\n apply (simp add: list_eb_log_wbuf_def wubi list_eb_log_def)\n apply (clarsimp simp add: list_eq_iff_nth_eq)\n apply (case_tac \"i = unat (wbuf_eb\\<^sub>f ostore_st) - unat bilbyFsFirstLogEbNum\")\n apply simp\n apply simp\n done\n\n moreover have \"inv_ostore_fsm mount_st ?ostore_st\"\n using list_eb_log_wbuf_eq inv_ostore[simplified inv_ostore_def] \n by (clarsimp simp add: inv_ostore_fsm_def wubi)\n\n moreover have \"inv_ostore_index mount_st ?ostore_st\"\n using inv_ostore_indexD[OF inv_ostore] wubi_mod_ostore_get_obj_eq[simplified ran_def]\n apply (clarsimp simp add: Let_def inv_ostore_index_def)\n apply (rename_tac oid oaddr, erule_tac x=oid in ballE)\n apply (simp add: is_valid_addr_def)\n apply fastforce+\n done\n\n moreover have \"inv_bufs mount_st ?ostore_st\"\n using inv_bufsD[OF inv_ostore] inv_ubi_vol apply (clarsimp simp: inv_bufs_def wubi Let_def nb_bytes_eq)\n apply (simp add: buf_slice_n_n)\n apply (simp add: used_gt_zero )\n apply (simp add: sync_lt_used buf_take_buf_slice_adjacent[OF order_less_imp_le[OF sync_lt_used]])\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore ] inv_ubi_vol\n apply (clarsimp simp add:inv_ubi_vol_def wubi)\n apply (rule conjI)\n apply (simp add: unat_arith_simps)\n using buf_take_buf_slice_adjacent[OF order_less_imp_le[OF sync_lt_used],symmetric]\n valid_list_trans_no_pad_append\n by fastforce\n\n moreover have \" inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ?ostore_st)))\n (prod.snd $ list_trans_no_pad (buf_slice (wbuf\\<^sub>f ?ostore_st) (sync_offs\\<^sub>f ?ostore_st) (used\\<^sub>f ?ostore_st)))\"\n using inv_logD[OF inv_ostore, THEN conjunct2]\n apply (simp add: wubi buf_slice_n_n inv_log_def nb_bytes_eq list_eb_log_def del: set_concat)\n using inv_ostore_wbuf_eb_rangeD[OF inv_ostore ] inv_ubi_vol\n apply (clarsimp simp add:word_less_nat_alt word_le_nat_alt inv_ubi_vol_def wubi simp del: set_concat)\n apply (simp add: drop_list_update)\n apply (erule subset_inj_on)\n apply (rule order_trans, rule UN_mono, rule set_update_subset_insert, rule subset_refl)\n apply simp\n apply (subst list_trans_no_pad_append[where xs=\"\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st)\"\n and ys=\" buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)\",symmetric])\n prefer 3\n apply (simp, simp add: subset_iff)\n apply (intro allI impI, rule disjI1, rule rev_bexI,\n rule_tac n=\"unat (wbuf_eb\\<^sub>f ostore_st) - unat bilbyFsFirstLogEbNum\" in nth_mem, simp)\n apply simp\n using inv_bufsD[OF inv_ostore] used_gt_zero apply (simp add: inv_ubi_vol_def valid_list_trans_no_pad_imp_valid_list_trans)\n using inv_bufsD[OF inv_ostore] sync_lt_used apply (simp add: inv_ubi_vol_def valid_list_trans_no_pad_imp_valid_list_trans)\n done\n\n moreover have \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd used\\<^sub>f ostore_st\"\n using nb_bytes_eq[symmetric] nb_bytes_eq_pad_to_minus_sync\n apply simp\n apply (thin_tac _)+\n (* Why do I need to do this thin_tac nonsense to get this goal? *)\n apply (simp add: padding_to_def[unfolded tuple_simps sanitizers])\n apply (rule al_dvd_align32)\n using inv_mount_st[simplified inv_mount_st_def Let_def] apply clarsimp\n using inv_ostore_used_no_overflowD[OF inv_ostore] apply simp\n done\n ultimately show ?thesis\n using inv_ostore apply (simp add: inv_ostore_def ostore_uptodate_eq_new_ostore_medium ostore_rt_eq wubi)\n apply (clarsimp simp: inv_ostore_simps Let_def )\n done\nqed\n\nlemma \\_updates_buf_prepare_eq:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nand inv_mount_st: \"inv_mount_st mount_st\"\nand sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\nshows\n \"\n OstoreState.next_sqnum\\<^sub>f ostore_st \\ next_sqnum \\\n inv_ostore mount_st\n (ostore_st\n \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\,\n used\\<^sub>f := padding_to (mount_st, ostore_st, ostoreWriteNone),\n fsm_st\\<^sub>f := prepared_fsm_padding_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)), OstoreState.oaddr\\<^sub>f := oaddr,\n OstoreState.next_sqnum\\<^sub>f := nxtsqnum, opad\\<^sub>f := opad\\<^sub>f ostore_st\\Obj.len\\<^sub>f := len, Obj.sqnum\\<^sub>f := sqnum, crc\\<^sub>f := crc\\\\) \\\n \\_updates\n (ostore_st\n \\wbuf\\<^sub>f := wbuf\\<^sub>f ostore_st\n \\data\\<^sub>f :=\n WordArrayT.make\n (buf_prepared ostore_st (used\\<^sub>f ostore_st)\n (padding_to (mount_st, ostore_st, ostoreWriteNone))\n (prepared_pad_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)) crc))\\,\n used\\<^sub>f := padding_to (mount_st, ostore_st, ostoreWriteNone),\n fsm_st\\<^sub>f := prepared_fsm_padding_obj ostore_st (padding_to (mount_st, ostore_st, ostoreWriteNone)), OstoreState.oaddr\\<^sub>f := oaddr,\n OstoreState.next_sqnum\\<^sub>f := nxtsqnum, opad\\<^sub>f := opad\\<^sub>f ostore_st\\Obj.len\\<^sub>f := len, Obj.sqnum\\<^sub>f := sqnum, crc\\<^sub>f := crc\\\n \\) = \\_updates ostore_st\"\n proof -\n obtain pad_to::U32 where pad_to:\"pad_to = padding_to (mount_st, ostore_st, ostoreWriteNone)\" by simp\n have used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n using sync_lt_used by unat_arith\n\n have bound: \"unat (bound\\<^sub>f (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\n using inv_ostore_bound_le_lenD[OF inv_ostore] by simp\n have used_of: \"used\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st + (pad_to - used\\<^sub>f ostore_st)\"\n apply (simp add: pad_to)\n using used_le_padding_to[OF inv_ostore inv_mount_st] by simp\n\n show ?thesis\n apply (simp add: buf_prepared_def)\n apply (case_tac \"padding_to (mount_st, ostore_st, ostoreWriteNone) - used\\<^sub>f ostore_st\n < bilbyFsObjHeaderSize\")\n\n apply (simp add: \\_updates_def)\n apply (rule arg_cong[where f=\"map ostore_update\"])\n using buf_slice_buf_memset_is_append_padding[OF inv_ostore inv_mount_st pad_to, where frm=\"sync_offs\\<^sub>f ostore_st\", simplified pad_to]\n using buf_memset_eq[OF bound used_of, simplified pad_to]\n apply (simp )\n apply (rule snd_list_trans_no_pad_padding_unchanged)\n using inv_bufsD[OF inv_ostore] sync_lt_used\n apply (simp add: valid_list_trans_no_pad_imp_valid_list_trans)\n apply (simp add: \\_updates_def)\n apply (rule arg_cong[where f=\"map ostore_update\"])\n apply (rule snd_list_trans_no_pad_padding_obj_sync_pad_to[OF inv_ostore inv_mount_st pad_to used_gt_zero sync_lt_used, simplified pad_to])\n apply (rule valid_commit_pad_obj[OF inv_ostore inv_mount_st pad_to, simplified is_valid_ObjTrans, THEN conjunct1])\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_def prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)+\n apply (rule_tac x=crc in exI)\n apply (simp add: prepared_pad_obj_def prepared_pad_obj_no_crc_def ostore_update_padding_obj' pad_to bilbyFsObjHeaderSize_def bilbyFsTransCommit_def)+\n using inv_ostore_valid_pad_objD[OF inv_ostore]\n apply (clarsimp simp add: prepared_pad_obj_no_crc_def valid_pad_obj_def prepared_pad_obj_def is_valid_Obj_def)\n apply simp\n done\nqed\n\nlemma ostore_write_buf_ret:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and inv_step: \"inv_\\_ostore (\\_ostore_uptodate ostore_st)\"\n and used_gt_zero: \"0 < used\\<^sub>f ostore_st\"\n and sync_lt_used: \"sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st\"\n and offs_ok: \"unat (sync_offs\\<^sub>f ostore_st) + unat nb_bytes \\ unat (eb_size\\<^sub>f (super\\<^sub>f mount_st))\"\n and nb_bytes_ok: \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd nb_bytes\"\n and sync_offs: \"sync_offs = sync_offs\\<^sub>f ostore_st\"\n and nb_bytes_eq: \"sync_offs\\<^sub>f ostore_st + nb_bytes = used\\<^sub>f ostore_st\"\n and nb_bytes_eq_pad_to_minus_sync: \"nb_bytes = padding_to (mount_st, ostore_st, ostoreWriteNone) - sync_offs\\<^sub>f ostore_st\"\n and err:\n \"\\ex'. P ((ex',ostore_st), Error eIO)\"\n and suc:\n \"\\ex' ostore_st'. \\\n inv_ostore mount_st (ostore_st' \\ sync_offs\\<^sub>f := used\\<^sub>f ostore_st\\);\n \\v. ostore_st'\\OstoreState.ubi_vol\\<^sub>f := v\\ = ostore_st;\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st') = (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))[(unat (wbuf_eb\\<^sub>f ostore_st)):=((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)!(unat (wbuf_eb\\<^sub>f ostore_st)))@buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st + nb_bytes))] \\ \\\n P ((ex', ostore_st'), Success ())\n \"\nshows\n\"P (ostore_write_buf(ex, mount_st, ostore_st, sync_offs, nb_bytes, ostoreWriteNone))\"\nunfolding ostore_write_buf_def[unfolded tuple_simps sanitizers, simplified take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def]\n apply (simp add: sync_offs)\n apply safe\n apply (rule wubi_leb_write_ret[where mount_st=mount_st])\n apply (rule length_ubi_buf_eq_sync_offsD[OF inv_ostore inv_mount_st])\n apply (rule inv_ostore_wbuf_lengthD[OF inv_ostore])\n apply (rule offs_ok)\n apply (rule nb_bytes_ok)\n using inv_bufsD[OF inv_ostore] apply clarsimp\n apply (simp add: err)\n apply simp\n apply (rule suc)\n apply (erule (2) inv_ostore_updated_ubi_preserved[OF inv_ostore inv_mount_st nb_bytes_eq_pad_to_minus_sync _ used_gt_zero sync_lt_used])\n apply (simp add: nb_bytes_eq)\n apply (rule_tac x=\"OstoreState.ubi_vol\\<^sub>f ostore_st\" in exI, fastforce)\n apply simp\n apply (rule suc)\n using sync_lt_used nb_bytes_eq inv_ostore apply (clarsimp simp: word_not_0_gr_n)+\n done\n\nlemma extra_padding_is_aligned:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and sync_neq_used: \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\"\n shows\n \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd padding_to (mount_st, ostore_st, ostoreWriteNone) - sync_offs\\<^sub>f ostore_st\"\nproof -\n have io_size_dvd_sync_offs: \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd sync_offs\\<^sub>f ostore_st\"\n using inv_ostore by (clarsimp simp: inv_ostore_def)\n show ?thesis\n using inv_mount_st[simplified inv_mount_st_def Let_def]\n apply clarsimp\n apply (drule al_dvd_align32[OF _ inv_ostore_used_no_overflowD[OF inv_ostore]])\n using sync_offs_le_padding_to[OF inv_ostore inv_mount_st ]\n io_size_dvd_sync_offs\n apply (simp add: padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def )\n apply (simp add: udvd_iff_dvd word_le_nat_alt unat_sub_if')\n done\nqed\n\nlemmas OstoreState_ext_eq_expand = trans[OF _ OstoreState.ext_inject,\n OF arg_cong2[where f=\"(=)\"], OF refl OstoreState.surjective]\n \nlemma ostore_sync_ret:\n assumes inv_ostore: \"inv_ostore mount_st ostore_st\"\n and inv_mount_st: \"inv_mount_st mount_st\"\n and inv_step: \"inv_\\_ostore (\\_ostore_uptodate ostore_st)\"\n and suc: \"\\ostore_st' ex'. \\ inv_ostore mount_st ostore_st';\n inv_\\_ostore (\\_ostore_uptodate ostore_st');\n \\_ostore_medium ostore_st' = \\_ostore_uptodate ostore_st;\n \\_updates ostore_st' = []\n \\ \\\n P ((ex', ostore_st'), Success ())\"\n and err: \"\\e ostore_st' ex' n. \\ inv_ostore mount_st ostore_st';\n inv_\\_ostore (\\_ostore_uptodate ostore_st');\n e \\ {eIO, eNoMem, eNoSpc,eOverflow};\n n < length (\\_updates ostore_st); \n \\_ostore_medium ostore_st' = apply_n_updates n (\\_ostore_medium ostore_st) (\\_updates ostore_st);\n \\_updates ostore_st' = (drop n $ \\_updates ostore_st)\n \\ \\\n P ((ex', ostore_st'), Error e)\"\n\n notes pad_simps = padding_to_def[unfolded tuple_simps sanitizers] ostoreWriteNone_def\n\n shows \"P (ostore_sync (ex, mount_st, ostore_st, ostoreWriteNone))\"\nusing [[goals_limit=2]]\n unfolding ostore_sync_def[unfolded tuple_simps sanitizers]\n apply (case_tac \"sync_offs\\<^sub>f ostore_st = used\\<^sub>f ostore_st\")\n apply (simp add: ostoreWriteNone_def Let_def ostoreWriteNewEb_def)\n apply (rule suc[OF inv_ostore inv_step])\n apply (simp add: \\_ostore_uptodate_def used_eq_sync_offs_means_no_update)\n apply ( simp add: \\_updates_def buf_simps )\n apply (simp add: Let_def)\n apply (rule prepare_wbuf_ret[OF inv_ostore inv_mount_st inv_step])\n apply (rule refl) \n using inv_ostore[simplified inv_ostore_def] apply clarsimp apply unat_arith\n using inv_ostore[simplified inv_ostore_def] apply clarsimp apply unat_arith\n apply (simp split: prod.split)\n apply (rule err[OF inv_ostore inv_step, where e=eOverflow and n=0, simplified])\n apply (erule used_neq_sync_offs_means_updates_not_Nil[OF inv_ostore])\n apply (simp)\n apply (rule ostore_sync_summary_if_eb_new_ret[OF _ inv_mount_st], simp_all)\n apply clarsimp\n(* apply (subgoal_tac \"used\\<^sub>f ostore_st' = padding_to (mount_st, ostore_st, ostoreWriteNone)\")\n apply (subgoal_tac \"sync_offs\\<^sub>f ostore_st' = sync_offs\\<^sub>f ostore_st\")*)\n apply (rule ostore_write_buf_ret[OF _ inv_mount_st])\n apply simp\n apply (fastforce)\n apply clarsimp\n using used_le_padding_to[OF inv_ostore inv_mount_st ]\n inv_ostore_sync_offsD[OF inv_ostore] apply unat_arith\n using used_le_padding_to[OF inv_ostore inv_mount_st]\n inv_ostore_sync_offsD[OF inv_ostore]\n apply (simp add: )\n apply (clarsimp simp add: OstoreState.splits OstoreState_ext_eq_expand offs_pl_padding_to_le_eb_size[OF inv_ostore inv_mount_st])\n apply (clarsimp simp: OstoreState.splits OstoreState_ext_eq_expand extra_padding_is_aligned[OF inv_ostore inv_mount_st])\n apply (clarsimp simp: OstoreState.splits OstoreState_ext_eq_expand)\n apply (clarsimp simp: OstoreState.splits OstoreState_ext_eq_expand)\n apply (clarsimp simp: OstoreState.splits OstoreState_ext_eq_expand)\n apply (simp add: pad_simps)\n apply (subst align32_idempotence)\n using inv_mount_st[simplified inv_mount_st_def] apply (clarsimp simp: Let_def)\n using inv_ostore_used_no_overflowD[OF inv_ostore] apply simp\n apply simp\n apply (clarsimp)\n apply (rule err[where e=eIO and n=0, simplified])\n apply simp\n apply simp\n using inv_ostore_sync_offsD[OF inv_ostore]\n \\_updates_buf_prepare_eq[OF inv_ostore inv_mount_st]\n used_neq_sync_offs_means_updates_not_Nil[OF inv_ostore]\n apply (fastforce) \n apply (fastforce simp add: \\_ostore_medium_def)\n using inv_ostore_sync_offsD[OF inv_ostore]\n \\_updates_buf_prepare_eq[OF inv_ostore inv_mount_st]\n used_neq_sync_offs_means_updates_not_Nil[OF inv_ostore]\n apply (fastforce)\n apply simp\n apply (rename_tac ex' ostore_st'')\n apply (subgoal_tac \"padding_to (mount_st, ostore_st, ostoreWriteNone) = used\\<^sub>f ostore_st''\")\n apply (rule suc)\n apply clarsimp\n apply clarsimp\n apply (cut_tac v=v and crc=crc and ostore_st'=ostore_st''\n and len=len and oaddr=oaddr and nxtsqnum=nxtsqnum\n and sqnum=sqnum in\n ostore_sync_\\_ostore_uptodate[OF inv_ostore inv_mount_st])\n apply (rule refl)\n using used_le_padding_to[OF inv_ostore inv_mount_st ]\n inv_ostore_sync_offsD[OF inv_ostore] apply unat_arith\n using [[goals_limit=1]]\n using inv_ostore_sync_offsD[OF inv_ostore] apply simp\n apply simp\n apply simp\n apply (rename_tac v)\n apply (drule_tac t=\" used\\<^sub>f ostore_st''\" in sym)\n using inv_step apply (simp add: \\_ostore_uptodate_def \\_updates_def buf_slice_n_n)\n apply clarsimp\n apply (rename_tac v)\n apply (cut_tac v=v and crc=crc and ostore_st'=ostore_st''\n and len=len and oaddr=oaddr and nxtsqnum=nxtsqnum\n and sqnum=sqnum in\n ostore_sync_\\_ostore_uptodate[OF inv_ostore inv_mount_st])\n apply (rule refl)\n using inv_ostore_sync_offsD[OF inv_ostore] apply unat_arith\n using inv_ostore_sync_offsD[OF inv_ostore] apply unat_arith\n using inv_bufsD[OF inv_ostore] apply simp\n apply simp\n apply (simp add: buf_slice_n_n \\_updates_def)\n apply (simp add: \\_updates_def buf_slice_n_n)\n apply (clarsimp, drule arg_cong[where f=used\\<^sub>f], simp)\n done\n\nlemma ostore_write_ret:\n \"\\P. \\ inv_ostore mount_st ostore_st;\n inv_\\_step_updates ostore_st;\n\n \\ex' ostore_st' objs' n. \\ inv_ostore mount_st ostore_st';\n inv_\\_step_updates ostore_st' ;\n \\_ostore_medium ostore_st' = apply_n_updates n (\\_ostore_medium ostore_st) (\\_updates ostore_st @ [ostore_update (trimNone $ \\a objs)]);\n \\_updates ostore_st' = drop n (\\_updates ostore_st @ [ostore_update (trimNone $ \\a objs)]);\n is_set (osw, ostoreWriteForceSync) \\ n = length (\\_updates ostore_st) + 1\n \\ \\\n P ((ex', ostore_st', objs'), Success ());\n\n \\e ex' ostore_st' objs' n. \\ inv_ostore mount_st ostore_st';\n inv_\\_step_updates ostore_st' ;\n e \\ {eIO, eNoMem, eNoSpc} ;\n \\_ostore_medium ostore_st' = apply_n_updates n (\\_ostore_medium ostore_st) (\\_updates ostore_st);\n \\_updates ostore_st' = drop n (\\_updates ostore_st)\n \\ \\\n P ((ex', ostore_st', objs'), Error e)\n \\ \\\n P (ostore_write (ex, mount_st, ostore_st, objs, osw))\"\noops\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/refine/OstoreR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3702253925955866, "lm_q1q2_score": 0.19522596689034008}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__48_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__48_on_rules imports n_german_lemma_on_inv__48\nbegin\nsection{*All lemmas on causal relation between inv__48*}\nlemma lemma_inv__48_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__48 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__48) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__48_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.37022539259558657, "lm_q1q2_score": 0.19522596689034008}} {"text": "theory LaunchburyUnBH\nimports LaunchburyStacked LaunchburyNoBH\nbegin\n\n\nlemma delete_append[simp]: \"delete x (al1@al2) = delete x al1 @ delete x al2\"\n by (simp add: AList.delete_eq)\n\nlemma forgetBH:\n assumes \"\\ : \\' \\ \\ : \\'\"\n assumes \"distinctVars (\\' @ \\)\"\n shows \"\\' @ \\ [\\] \\' @ \\\"\nusing assms\nproof (induct rule: reds_distinct_ind)\ncase (Lambda \\ x y e \\')\n show ?case\n unfolding append_Cons\n apply (rule LaunchburyNoBH.Lambda)\n done\nnext\ncase (Application n \\ \\' \\ \\' x e y \\ \\' z e')\n show ?case\n unfolding append_Cons\n proof(rule LaunchburyNoBH.Application)\n show \"atom n \\ (\\' @ \\, delete x ((x, App (Var n) y) # \\' @ \\), x, e, y, \\' @ \\, z)\"\n and \"atom z \\ (\\' @ \\, delete x ((x, App (Var n) y) # \\' @ \\), x, e, y, \\' @ \\)\"\n using Application\n by (auto simp add: fresh_Pair fresh_Cons fresh_append eqvt_fresh_cong2[where f = delete, OF delete_eqvt])\n show \"(n, e) # (x, App (Var n) y) # \\' @ \\ [\\] (n, Lam [z]. e') # (x, App (Var n) y) # \\' @ \\\"\n by (rule Application(9)[unfolded append_Cons])\n\n have \"x \\ heapVars (\\' @ \\)\"\n using Application(6)\n by (simp add: distinctVars_Cons)\n hence [simp]:\"delete x \\' = \\'\" \"delete x \\ = \\\"\n by (auto intro: delete_no_there)\n\n show \"(x, e'[z::=y]) # delete x ((x, App (Var n) y) # \\' @ \\) [\\] \\' @ \\\"\n using Application(11)\n by simp\n qed\nnext\ncase (Variable y e \\ x \\' z \\' \\)\n have [simp]:\"x \\ y\"\n using Variable(3)\n by (auto simp add: distinctVars_Cons)\n note this[symmetric,simp]\n\n have \"y \\ heapVars \\'\"\n using Variable(3)\n by (auto simp add: distinctVars_Cons)\n hence [simp]: \"delete y \\' = \\'\"\n by (rule delete_no_there)\n\n have \"x \\ heapVars \\'\"\n using Variable(4)\n by (auto simp add: distinctVars_Cons)\n hence [simp]: \"delete x \\' = \\'\"\n by (rule delete_no_there)\n\n have \"x \\ heapVars \\\"\n using Variable(4)\n by (auto simp add: distinctVars_Cons)\n hence [simp]: \"delete x \\ = \\\"\n by (rule delete_no_there)\n\n have \"((x, Var y) # \\') @ \\ [\\] (x, z) # delete x (((x, Var y) # \\') @ (y, z) # \\)\"\n unfolding append_Cons \n proof (rule LaunchburyNoBH.Variable)\n show \"(y, e) \\ set ((x, Var y) # \\' @ \\)\"\n using Variable(1) by simp\n show \"(y, e) # delete y ((x, Var y) # \\' @ \\) [\\] (y, z) # (((x, Var y) # \\') @ \\)\"\n using Variable(7) by simp\n \n show \"set ((x, Var y) # \\' @ (y, z) # \\) = set ((y, z) # ((x, Var y) # \\') @ \\)\"\n by auto\n qed\n thus ?case\n unfolding append_Cons\n by simp\nnext\ncase (Let as \\ x body \\' \\' \\)\n show ?case\n unfolding append_Cons\n proof (rule LaunchburyNoBH.Let)\n show \"set (bn as) \\* (\\' @ \\, x, Terms.Let as body)\"\n using Let(1) by (simp add: fresh_star_Pair fresh_star_append)\n show \"distinctVars (asToHeap as)\" by fact\n show \" (x, body) # \\' @ asToHeap as @ \\ [\\] \\' @ \\\"\n using Let(7) by simp\n show \"set (\\' @ asToHeap as @ \\) = set (asToHeap as @ \\' @ \\)\"\n by auto\nqed\n\n\nqed\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/LaunchburyUnBH.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.3702253995442529, "lm_q1q2_score": 0.1952259650541646}} {"text": "theory Common_Primitive_Syntax\nimports \"../Datatype_Selectors\"\n IpAddresses\n Simple_Firewall.Iface\n L4_Protocol_Flags Ports Tagged_Packet Conntrack_State\nbegin\n\nsection\\Primitive Matchers: Interfaces, IP Space, Layer 4 Ports Matcher\\\n\ntext\\Primitive Match Conditions which only support interfaces, IPv4 addresses, layer 4 protocols, and layer 4 ports.\n\\\n\n\ncontext\n notes [[typedef_overloaded]]\nbegin\n datatype 'i common_primitive =\n is_Src: Src (src_sel: \"'i::len ipt_iprange\") | \n is_Dst: Dst (dst_sel: \"'i::len ipt_iprange\") |\n is_Iiface: IIface (iiface_sel: iface) |\n is_Oiface: OIface (oiface_sel: iface) |\n is_Prot: Prot (prot_sel: protocol) | \n is_Src_Ports: Src_Ports (src_ports_sel: ipt_l4_ports) |\n is_Dst_Ports: Dst_Ports (dst_ports_sel: ipt_l4_ports) |\n is_MultiportPorts: MultiportPorts (multiportports_sel: ipt_l4_ports) |\n is_L4_Flags: L4_Flags (l4_flags_sel: ipt_tcp_flags) |\n is_CT_State: CT_State (ct_state_sel: \"ctstate set\") |\n is_Extra: Extra (extra_sel: string)\nend\n\n\nlemma wf_disc_sel_common_primitive: \n \"wf_disc_sel (is_Src_Ports, src_ports_sel) Src_Ports\"\n \"wf_disc_sel (is_Dst_Ports, dst_ports_sel) Dst_Ports\"\n \"wf_disc_sel (is_Src, src_sel) Src\"\n \"wf_disc_sel (is_Dst, dst_sel) Dst\"\n \"wf_disc_sel (is_Iiface, iiface_sel) IIface\"\n \"wf_disc_sel (is_Oiface, oiface_sel) OIface\"\n \"wf_disc_sel (is_Prot, prot_sel) Prot\"\n \"wf_disc_sel (is_L4_Flags, l4_flags_sel) L4_Flags\"\n \"wf_disc_sel (is_CT_State, ct_state_sel) CT_State\"\n \"wf_disc_sel (is_Extra, extra_sel) Extra\"\n \"wf_disc_sel (is_MultiportPorts, multiportports_sel) MultiportPorts\"\n by(simp_all add: wf_disc_sel.simps)\n\n\n \\ \\Example for a packet again:\\\n value \"\\p_iiface = ''eth0'', p_oiface = ''eth1'',\n p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (173,194,112,111),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {TCP_ACK},\n p_payload = ''GET / HTTP/1.0'',\n p_tag_ctstate = CT_Established\\ :: 32 tagged_packet\"\n\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Primitive_Matchers/Common_Primitive_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.35936415888237616, "lm_q1q2_score": 0.1950856071454125}} {"text": "theory Friend\n imports\n \"Friend_Value_Setup\"\n \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\Declassification bound\\\n\n\ncontext Friend\nbegin\n\nfun T :: \"(state,act,out) trans \\ bool\"\nwhere \"T trn = False\"\n\ntext \\The bound has the same ``while-or-last-before'' shape as the dynamic version of\nthe issuer bound for post confidentiality (Section~\\ref{sec:dynamic-post-issuer}),\nalternating between phases with open (\\BO\\) or closed (\\BC\\) access to the\nconfidential information.\n\nThe access window is initially open, because the two users are known not to exist when the system\nis initialized, so there cannot be friendship between them.\n\nThe bound also incorporates the static knowledge that the friendship status alternates between\n\\False\\ and \\True\\.\\\n\nfun alternatingFriends :: \"value list \\ bool \\ bool\" where\n \"alternatingFriends [] _ = True\"\n| \"alternatingFriends (FrVal st # vl) st' \\ st' = (\\st) \\ alternatingFriends vl st\"\n| \"alternatingFriends (OVal _ # vl) st = alternatingFriends vl st\"\n\ninductive BO :: \"value list \\ value list \\ bool\"\nand BC :: \"value list \\ value list \\ bool\"\nwhere\n BO_FrVal[simp,intro!]:\n \"BO (map FrVal fs) (map FrVal fs)\"\n|BO_BC[intro]:\n \"BC vl vl1 \\\n BO (map FrVal fs @ OVal False # vl) (map FrVal fs @ OVal False # vl1)\"\n(* *)\n|BC_FrVal[simp,intro!]:\n \"BC (map FrVal fs) (map FrVal fs1)\"\n|BC_BO[intro]:\n \"BO vl vl1 \\ (fs = [] \\ fs1 = []) \\ (fs \\ [] \\ last fs = last fs1) \\\n BC (map FrVal fs @ OVal True # vl)\n (map FrVal fs1 @ OVal True # vl1)\"\n\ndefinition \"B vl vl1 \\ BO vl vl1 \\ alternatingFriends vl1 False\"\n\n\nlemma BO_Nil_Nil: \"BO vl vl1 \\ vl = [] \\ vl1 = []\"\nby (cases rule: BO.cases) auto\n\nno_notation relcomp (infixr \"O\" 75)\n\nsublocale BD_Security_IO where\nistate = istate and step = step and\n\\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\ndone\n\n\nsubsection \\Unwinding proof\\\n\n(* helper *) lemma toggle_friends12_True:\nassumes rs: \"reach s\"\n and IDs: \"IDsOK s [UID1, UID2] [] [] []\"\n and nf12: \"\\friends12 s\"\nobtains al oul\nwhere \"sstep s al = (oul, createFriend s UID1 (pass s UID1) UID2)\"\n and \"al \\ []\" and \"eqButUID s (createFriend s UID1 (pass s UID1) UID2)\"\n and \"friends12 (createFriend s UID1 (pass s UID1) UID2)\"\n and \"O (traceOf s al) = []\" and \"V (traceOf s al) = [FrVal True]\"\nproof cases\n assume \"UID1 \\\\ pendingFReqs s UID2 \\ UID2 \\\\ pendingFReqs s UID1\"\n then show thesis proof\n assume pFR: \"UID1 \\\\ pendingFReqs s UID2\"\n let ?a = \"Cact (cFriend UID2 (pass s UID2) UID1)\"\n let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2\n unfolding createFriend_sym[of \"s\" \"UID1\" \"pass s UID1\" \"UID2\" \"pass s UID2\"]\n by (auto simp add: c_defs)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal True\" and \"friends12 ?s'\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Cact_cFriend_step_eqButUID)\n next\n assume pFR: \"UID2 \\\\ pendingFReqs s UID1\"\n let ?a = \"Cact (cFriend UID1 (pass s UID1) UID2)\"\n let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2 by (auto simp add: c_defs)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal True\" and \"friends12 ?s'\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Cact_cFriend_step_eqButUID)\n qed\nnext\n assume pFR: \"\\(UID1 \\\\ pendingFReqs s UID2 \\ UID2 \\\\ pendingFReqs s UID1)\"\n let ?a1 = \"Cact (cFriendReq UID2 (pass s UID2) UID1 emptyRequestInfo)\"\n let ?s1 = \"createFriendReq s UID2 (pass s UID2) UID1 emptyRequestInfo\"\n let ?trn1 = \"Trans s ?a1 outOK ?s1\"\n let ?a2 = \"Cact (cFriend UID1 (pass ?s1 UID1) UID2)\"\n let ?s2 = \"createFriend ?s1 UID1 (pass ?s1 UID1) UID2\"\n let ?trn2 = \"Trans ?s1 ?a2 outOK ?s2\"\n have eFR: \"e_createFriendReq s UID2 (pass s UID2) UID1 emptyRequestInfo\" using IDs pFR nf12\n using reach_friendIDs_symmetric[OF rs]\n by (auto simp add: c_defs friends12_def)\n then have step1: \"step s ?a1 = (outOK, ?s1)\" by auto\n moreover then have \"\\\\ ?trn1\" and \"\\\\ ?trn1\" using UID1_UID2_UIDs by auto\n moreover have \"eqButUID s ?s1\" by (intro Cact_cFriendReq_step_eqButUID[OF step1]) auto\n moreover have rs1: \"reach ?s1\" using step1 by (intro reach_PairI[OF rs])\n moreover have step2: \"step ?s1 ?a2 = (outOK, ?s2)\" using IDs by (auto simp: c_defs)\n moreover then have \"\\ ?trn2\" and \"f ?trn2 = FrVal True\" and \"friends12 ?s2\"\n by (auto simp: c_defs friends12_def)\n moreover have \"\\\\ ?trn2\" using UID1_UID2_UIDs by auto\n moreover have \"eqButUID ?s1 ?s2\" by (intro Cact_cFriend_step_eqButUID[OF step2 rs1]) auto\n moreover have \"?s2 = createFriend s UID1 (pass s UID1) UID2\"\n using eFR by (intro createFriendReq_createFriend_absorb)\n ultimately show thesis using nf12 rs\n by (intro that[of \"[?a1, ?a2]\" \"[outOK, outOK]\"]) (auto intro: eqButUID_trans)\nqed\n\n(* helper *) lemma toggle_friends12_False:\nassumes rs: \"reach s\"\n and IDs: \"IDsOK s [UID1, UID2] [] [] []\"\n and f12: \"friends12 s\"\nobtains al oul\nwhere \"sstep s al = (oul, deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"al \\ []\" and \"eqButUID s (deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"\\friends12 (deleteFriend s UID1 (pass s UID1) UID2)\"\n and \"O (traceOf s al) = []\" and \"V (traceOf s al) = [FrVal False]\"\nproof -\n let ?a = \"Dact (dFriend UID1 (pass s UID1) UID2)\"\n let ?s' = \"deleteFriend s UID1 (pass s UID1) UID2\"\n let ?trn = \"Trans s ?a outOK ?s'\"\n have step: \"step s ?a = (outOK, ?s')\" using IDs f12 UID1_UID2\n by (auto simp add: d_defs friends12_def)\n moreover then have \"\\ ?trn\" and \"f ?trn = FrVal False\" and \"\\friends12 ?s'\"\n using reach_friendIDs_symmetric[OF rs] by (auto simp: d_defs friends12_def)\n moreover have \"\\\\ ?trn\" using UID1_UID2_UIDs by auto\n ultimately show thesis using f12 rs\n by (intro that[of \"[?a]\" \"[outOK]\"]) (auto intro: Dact_dFriend_step_eqButUID)\nqed\n\n\ndefinition \\0 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\0 s vl s1 vl1 \\\n eqButUID s s1 \\ friendIDs s = friendIDs s1 \\ open s \\\n BO vl vl1 \\ alternatingFriends vl1 (friends12 s1)\"\n\ndefinition \\1 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\1 s vl s1 vl1 \\ (\\fs fs1.\n eqButUID s s1 \\ \\open s \\\n alternatingFriends vl1 (friends12 s1) \\\n vl = map FrVal fs \\ vl1 = map FrVal fs1)\"\n\ndefinition \\2 :: \"state \\ value list \\ state \\ value list \\ bool\" where\n\"\\2 s vl s1 vl1 \\ (\\fs fs1 vlr vlr1.\n eqButUID s s1 \\ \\open s \\ BO vlr vlr1 \\\n alternatingFriends vl1 (friends12 s1) \\\n (fs = [] \\ fs1 = []) \\\n (fs \\ [] \\ last fs = last fs1) \\\n (fs = [] \\ friendIDs s = friendIDs s1) \\\n vl = map FrVal fs @ OVal True # vlr \\\n vl1 = map FrVal fs1 @ OVal True # vlr1)\"\n\nlemma \\2_I:\nassumes \"eqButUID s s1\" \"\\open s\" \"BO vlr vlr1\" \"alternatingFriends vl1 (friends12 s1)\"\n \"fs = [] \\ fs1 = []\" \"fs \\ [] \\ last fs = last fs1\"\n \"fs = [] \\ friendIDs s = friendIDs s1\"\n \"vl = map FrVal fs @ OVal True # vlr\"\n \"vl1 = map FrVal fs1 @ OVal True # vlr1\"\nshows \"\\2 s vl s1 vl1\"\nusing assms unfolding \\2_def by blast\n\n\nlemma istate_\\0:\nassumes B: \"B vl vl1\"\nshows \"\\0 istate vl istate vl1\"\nusing assms unfolding \\0_def istate_def B_def open_def openByA_def openByF_def friends12_def\nby auto\n\nlemma unwind_cont_\\0: \"unwind_cont \\0 {\\0,\\1,\\2}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\0 s vl s1 vl1 \\\n \\1 s vl s1 vl1 \\\n \\2 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\0: \"\\0 s vl s1 vl1\"\n then have rs: \"reach s\" and ss1: \"eqButUID s s1\" and fIDs: \"friendIDs s = friendIDs s1\"\n and os: \"open s\" and BO: \"BO vl vl1\" and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n using reachNT_reach unfolding \\0_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof-\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n then have vl: \"vl = f ?trn # vl'\" using c by (auto simp: consume_def)\n from BO have ?match proof (cases \"f ?trn\")\n case (FrVal fv)\n with BO vl obtain vl1' where vl1': \"vl1 = f ?trn # vl1'\" and BO': \"BO vl' vl1'\"\n proof (cases rule: BO.cases)\n case (BO_BC vl'' vl1'' fs)\n moreover with vl FrVal obtain fs' where \"fs = fv # fs'\" by (cases fs) auto\n ultimately show ?thesis using FrVal BO_BC vl\n by (intro that[of \"map FrVal fs' @ OVal False # vl1''\"]) auto\n qed auto\n from fIDs have f12: \"friends12 s = friends12 s1\" unfolding friends12_def by auto\n show ?match using \\ step rs FrVal proof (cases rule: \\E)\n case (Friend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n using ss1 unfolding eqButUID_def by auto\n let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = createFriend s UID1 p UID2\"\n using Friend step by (auto simp: createFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Friend\n by (auto intro: Cact_cFriend_step_eqButUID)\n moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal True]\"\n and f12s1': \"friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Friend unfolding f12 by (auto elim: toggle_friends12_True)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Friend(6) f12 unfolding s'\n by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n ultimately have \"\\0 s' vl' ?s1' vl1'\"\n using ss1 BO' aF1 unfolding \\0_def vl1' Friend(3)\n by (auto intro: eqButUID_trans eqButUID_sym)\n then show ?match using tr1 vl1' Friend UID1_UID2_UIDs\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n next\n case (Unfriend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n using ss1 unfolding eqButUID_def by auto\n let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = deleteFriend s UID1 p UID2\"\n using Unfriend step by (auto simp: deleteFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Unfriend\n by (auto intro: Dact_dFriend_step_eqButUID)\n moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal False]\"\n and f12s1': \"\\friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Unfriend unfolding f12 by (auto elim: toggle_friends12_False)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: d_defs)\n ultimately have \"\\0 s' vl' ?s1' vl1'\"\n using ss1 BO' aF1 unfolding \\0_def vl1' Unfriend(3)\n by (auto intro: eqButUID_trans eqButUID_sym)\n then show ?match using tr1 vl1' Unfriend UID1_UID2_UIDs\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n qed auto\n next\n case (OVal ov)\n with BO vl obtain vl1' where vl1': \"vl1 = OVal False # vl1'\"\n and vl': \"vl = OVal False # vl'\"\n and BC: \"BC vl' vl1'\"\n proof (cases rule: BO.cases)\n case (BO_BC vl'' vl1'' fs)\n moreover then have \"fs = []\" using vl unfolding OVal by (cases fs) auto\n ultimately show thesis using vl by (intro that[of vl1'']) auto\n qed auto\n then have \"f ?trn = OVal False\" using vl by auto\n with \\ step rs show ?match proof (cases rule: \\E)\n case (CloseF uid p uid')\n let ?s1' = \"deleteFriend s1 uid p uid'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = deleteFriend s uid p uid'\" using CloseF step by auto\n have step1: \"step s1 a = (outOK, ?s1')\"\n using CloseF step ss1 fIDs unfolding eqButUID_def by (auto simp: d_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"\\open s'\" using CloseF os unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: d_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n using CloseF(2) UID1_UID2_UIDs unfolding friends12_def d_defs by auto\n from BC have \"\\1 s' vl' ?s1' vl1' \\ \\2 s' vl' ?s1' vl1'\"\n proof (cases rule: BC.cases)\n case (BC_FrVal fs fs1)\n then show ?thesis using aF1 os' fIDs' f12s1 s's1' unfolding \\1_def vl1' by auto\n next\n case (BC_BO vlr vlr1 fs fs1)\n then have \"\\2 s' vl' ?s1' vl1'\" using s's1' os' aF1 f12s1 fIDs' unfolding vl1'\n by (intro \\2_I[of _ _ _ _ _ fs fs1]) auto\n then show ?thesis ..\n qed\n moreover have \"open s1\" \"\\open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding CloseF by auto\n ultimately show ?match using step1 vl1' CloseF UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n next\n case (CloseA uid p uid' p')\n let ?s1' = \"createUser s1 uid p uid' p'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = createUser s uid p uid' p'\" using CloseA step by auto\n have step1: \"step s1 a = (outOK, ?s1')\"\n using CloseA step ss1 unfolding eqButUID_def by (auto simp: c_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"\\open s'\" using CloseA os unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: c_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n unfolding friends12_def by (auto simp: c_defs)\n from BC have \"\\1 s' vl' ?s1' vl1' \\ \\2 s' vl' ?s1' vl1'\"\n proof (cases rule: BC.cases)\n case (BC_FrVal fs fs1)\n then show ?thesis using aF1 os' fIDs' f12s1 s's1' unfolding \\1_def vl1' by auto\n next\n case (BC_BO vlr vlr1 fs fs1)\n then have \"\\2 s' vl' ?s1' vl1'\" using s's1' os' aF1 f12s1 fIDs' unfolding vl1'\n by (intro \\2_I[of _ _ _ _ _ fs fs1]) auto\n then show ?thesis ..\n qed\n moreover have \"open s1\" \"\\open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding CloseA by auto\n ultimately show ?match using step1 vl1' CloseA UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n qed auto\n qed\n then show \"?match \\ ?ignore\" ..\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n have fIDs': \"friendIDs s' = friendIDs s1'\"\n using eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 True fIDs] .\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n then have \"\\0 s' vl' s1' vl1\" using os fIDs' aF1 BO\n unfolding \\0_def os' f12s1' vl' by auto\n then have ?match\n using step1 n\\' fIDs eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using \\0 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis using BO BO_Nil_Nil by auto\n qed\nqed\n\nlemma unwind_cont_\\1: \"unwind_cont \\1 {\\1, \\0}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\1 s vl s1 vl1 \\ \\0 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 1: \"\\1 s vl s1 vl1\"\n from rsT have rs: \"reach s\" by (intro reachNT_reach)\n from 1 obtain fs fs1\n where ss1: \"eqButUID s s1\" and os: \"\\open s\"\n and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n and vl: \"vl = map FrVal fs\" and vl1: \"vl1 = map FrVal fs1\"\n unfolding \\1_def by auto\n from os have IDs: \"IDsOK s [UID1, UID2] [] [] []\" unfolding open_defs by auto\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\" using ss1 unfolding eqButUID_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof cases\n assume fs1: \"fs1 = []\"\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n with vl c obtain fv fs' where vl': \"vl' = map FrVal fs'\" and fv: \"f ?trn = FrVal fv\"\n by (cases fs) (auto simp: consume_def)\n from \\ step rs fv have ss': \"eqButUID s s'\"\n by (elim \\E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n then have \"\\open s'\" using os by (auto simp: eqButUID_open_eq)\n moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have \"\\1 s' vl' s1 vl1\" using aF1 unfolding \\1_def vl' vl1 by auto\n moreover have \"\\\\ ?trn\" using \\ step rs fv UID1_UID2_UIDs by (elim \\E) auto\n ultimately have ?ignore by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n then have \"\\1 s' vl' s1' vl1\" using os aF1 vl vl1\n unfolding \\1_def os' vl' f12s1' by auto\n then have ?match\n using step1 n\\' os eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using 1 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis using fs1 unfolding vl1 by auto\n next\n assume \"fs1 \\ []\"\n then obtain fs1' where fs1: \"fs1 = (\\friends12 s1) # fs1'\"\n and aF1': \"alternatingFriends (map FrVal fs1') (\\friends12 s1)\"\n using aF1 unfolding vl1 by (cases fs1) auto\n obtain al oul s1' where \"sstep s1 al = (oul, s1')\" \"al \\ []\" \"eqButUID s1 s1'\"\n \"friends12 s1' = (\\friends12 s1)\"\n \"O (traceOf s1 al) = []\" \"V (traceOf s1 al) = [FrVal (\\friends12 s1)]\"\n using rs1 IDs1\n by (cases \"friends12 s1\") (auto intro: toggle_friends12_True toggle_friends12_False)\n moreover then have \"\\1 s vl s1' (map FrVal fs1')\"\n using os aF1' vl ss1 unfolding \\1_def by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have ?iact using vl1 unfolding fs1\n by (intro iactionI_ms[of s1 al oul s1'])\n (auto simp: consumeList_def O_Nil_never list_ex_iff_length_V)\n then show ?thesis ..\n qed\nqed\n\nlemma unwind_cont_\\2: \"unwind_cont \\2 {\\2,\\0}\"\nproof(rule, simp)\n let ?\\ = \"\\s vl s1 vl1. \\2 s vl s1 vl1 \\ \\0 s vl s1 vl1\"\n fix s s1 :: state and vl vl1 :: \"value list\"\n assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 2: \"\\2 s vl s1 vl1\"\n from rsT have rs: \"reach s\" by (intro reachNT_reach)\n obtain fs fs1 vlr vlr1\n where ss1: \"eqButUID s s1\" and os: \"\\open s\" and BO: \"BO vlr vlr1\"\n and aF1: \"alternatingFriends vl1 (friends12 s1)\"\n and vl: \"vl = map FrVal fs @ OVal True # vlr\"\n and vl1: \"vl1 = map FrVal fs1 @ OVal True # vlr1\"\n and fs_fs1: \"fs = [] \\ fs1 = []\"\n and last_fs: \"fs \\ [] \\ last fs = last fs1\"\n and fs_fIDs: \"fs = [] \\ friendIDs s = friendIDs s1\"\n using 2 unfolding \\2_def by auto\n from os have IDs: \"IDsOK s [UID1, UID2] [] [] []\" unfolding open_defs by auto\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\" using ss1 unfolding eqButUID_def by auto\n show \"iaction ?\\ s vl s1 vl1 \\\n ((vl = [] \\ vl1 = []) \\ reaction ?\\ s vl s1 vl1)\" (is \"?iact \\ (_ \\ ?react)\")\n proof cases\n assume \"length fs1 > 1\"\n then obtain fs1'\n where fs1: \"fs1 = (\\friends12 s1) # fs1'\" and fs1': \"fs1' \\ []\"\n and last_fs': \"last fs1 = last fs1'\"\n and aF1': \"alternatingFriends (map FrVal fs1' @ OVal True # vlr1) (\\friends12 s1)\"\n using vl1 aF1 by (cases fs1) auto\n obtain al oul s1' where \"sstep s1 al = (oul, s1')\" \"al \\ []\" \"eqButUID s1 s1'\"\n \"friends12 s1' = (\\friends12 s1)\"\n \"O (traceOf s1 al) = []\" \"V (traceOf s1 al) = [FrVal (\\friends12 s1)]\"\n using rs1 IDs1\n by (cases \"friends12 s1\") (auto intro: toggle_friends12_True toggle_friends12_False)\n moreover then have \"\\2 s vl s1' (map FrVal fs1' @ OVal True # vlr1)\"\n using os aF1' vl ss1 fs1' last_fs' fs_fs1 last_fs BO unfolding fs1\n by (intro \\2_I[of _ _ vlr vlr1 _ fs fs1'])\n (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have ?iact using vl1 unfolding fs1\n by (intro iactionI_ms[of s1 al oul s1'])\n (auto simp: consumeList_def O_Nil_never list_ex_iff_length_V)\n then show ?thesis ..\n next\n assume len1_leq_1: \"\\ length fs1 > 1\"\n have ?react proof\n fix a :: act and ou :: out and s' :: state and vl'\n let ?trn = \"Trans s a ou s'\" let ?trn1 = \"Trans s1 a ou s'\"\n assume step: \"step s a = (ou, s')\" and T: \"\\ T ?trn\" and c: \"consume ?trn vl vl'\"\n show \"match ?\\ s s1 vl1 a ou s' vl' \\ ignore ?\\ s s1 vl1 a ou s' vl'\" (is \"?match \\ ?ignore\")\n proof cases\n assume \\: \"\\ ?trn\"\n show ?thesis proof cases\n assume \"length fs > 1\"\n then obtain fv fs'\n where fs1: \"fs = fv # fs'\" and fs1': \"fs' \\ []\"\n and last_fs': \"last fs = last fs'\"\n using vl by (cases fs) auto\n with \\ c have fv: \"f ?trn = FrVal fv\" and vl': \"vl' = map FrVal fs' @ OVal True # vlr\"\n unfolding vl consume_def by auto\n from \\ step rs fv have ss': \"eqButUID s s'\"\n by (elim \\E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n then have \"\\open s'\" using os by (auto simp: eqButUID_open_eq)\n moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n ultimately have \"\\2 s' vl' s1 vl1\"\n using aF1 vl' fs1' fs_fs1 last_fs BO unfolding fs1 vl1\n by (intro \\2_I[of _ _ vlr vlr1 _ fs' fs1])\n (auto intro: eqButUID_sym eqButUID_trans)\n moreover have \"\\\\ ?trn\" using \\ step rs fv UID1_UID2_UIDs by (elim \\E) auto\n ultimately have ?ignore by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n next\n assume len_leq_1: \"\\ length fs > 1\"\n show ?thesis proof cases\n assume fs: \"fs = []\"\n then have fs1: \"fs1 = []\" and fIDs: \"friendIDs s = friendIDs s1\"\n using fs_fs1 fs_fIDs by auto\n from fs \\ c have ov: \"f ?trn = OVal True\" and vl': \"vl' = vlr\"\n unfolding vl consume_def by auto\n with \\ step rs have ?match proof (cases rule: \\E)\n case (OpenF uid p uid')\n let ?s1' = \"createFriend s1 uid p uid'\"\n let ?trn1 = \"Trans s1 a outOK ?s1'\"\n have s': \"s' = createFriend s uid p uid'\" using OpenF step by auto\n have \"eqButUIDf (pendingFReqs s) (pendingFReqs s1)\"\n using ss1 unfolding eqButUID_def by auto\n then have \"uid' \\\\ pendingFReqs s uid \\ uid' \\\\ pendingFReqs s1 uid\"\n using OpenF by (intro eqButUIDf_not_UID') auto\n then have step1: \"step s1 a = (outOK, ?s1')\"\n using OpenF step ss1 fIDs unfolding eqButUID_def by (auto simp: c_defs)\n have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have os': \"open s'\" using OpenF unfolding open_def by auto\n moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n using fIDs unfolding s' by (auto simp: c_defs)\n moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n using OpenF(2) UID1_UID2_UIDs unfolding friends12_def c_defs by auto\n ultimately have \"\\0 s' vl' ?s1' vlr1\"\n using BO aF1 unfolding \\0_def vl' vl1 fs1 by auto\n moreover have \"\\open s1\" \"open ?s1'\"\n using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n moreover then have \"\\ ?trn1\" unfolding OpenF by auto\n ultimately show ?match using step1 vl1 fs1 OpenF UID1_UID2 UID1_UID2_UIDs\n by (intro matchI[of s1 a outOK ?s1' vl1 vlr1]) (auto simp: consume_def)\n qed auto\n then show ?thesis ..\n next\n assume \"fs \\ []\"\n then obtain fv where fs: \"fs = [fv]\" using len_leq_1 by (cases fs) auto\n then have fs1: \"fs1 = [fv]\" using len1_leq_1 fs_fs1 last_fs by (cases fs1) auto\n with aF1 have f12s1: \"friends12 s1 = (\\fv)\" unfolding vl1 by auto\n have fv: \"f ?trn = FrVal fv\" and vl': \"vl' = OVal True # vlr\"\n using c \\ unfolding vl fs by (auto simp: consume_def)\n with \\ step rs have ?match proof (cases rule: \\E)\n case (Friend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n using ss1 unfolding eqButUID_def by auto\n have fv: \"fv = True\" using fv Friend by auto\n let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = createFriend s UID1 p UID2\"\n using Friend step by (auto simp: createFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Friend\n by (auto intro: Cact_cFriend_step_eqButUID)\n moreover then have os': \"\\open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal True]\"\n and f12s1': \"friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Friend f12s1 unfolding fv by (auto elim: toggle_friends12_True)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Friend(6) f12s1 unfolding s' fv\n by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n ultimately have \"\\2 s' vl' ?s1' (OVal True # vlr1)\"\n using BO ss1 aF1 unfolding vl' vl1 fs1 f12s1 fv\n by (intro \\2_I[of _ _ _ _ _ \"[]\" \"[]\"])\n (auto intro: eqButUID_trans eqButUID_sym)\n then show ?match using tr1 vl1 Friend UID1_UID2_UIDs unfolding fs1 fv\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n next\n case (Unfriend uid p uid')\n then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n using ss1 unfolding eqButUID_def by auto\n have fv: \"fv = False\" using fv Unfriend by auto\n let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n have s': \"s' = deleteFriend s UID1 p UID2\"\n using Unfriend step by (auto simp: deleteFriend_sym)\n have ss': \"eqButUID s s'\" using rs step Unfriend\n by (auto intro: Dact_dFriend_step_eqButUID)\n moreover then have os': \"\\open s'\" using os eqButUID_open_eq by auto\n moreover obtain al oul where al: \"sstep s1 al = (oul, ?s1')\" \"al \\ []\"\n and tr1: \"O (traceOf s1 al) = []\"\n \"V (traceOf s1 al) = [FrVal False]\"\n and f12s1': \"\\friends12 ?s1'\"\n and s1s1': \"eqButUID s1 ?s1'\"\n using rs1 IDs1 Unfriend f12s1 unfolding fv by (auto elim: toggle_friends12_False)\n moreover have \"friendIDs s' = friendIDs ?s1'\"\n using Unfriend(6) f12s1 unfolding s' fv\n by (intro eqButUID_deleteFriend12_friendIDs_eq[OF ss1 rs rs1])\n ultimately have \"\\2 s' vl' ?s1' (OVal True # vlr1)\"\n using BO ss1 aF1 unfolding vl' vl1 fs1 f12s1 fv\n by (intro \\2_I[of _ _ _ _ _ \"[]\" \"[]\"])\n (auto intro: eqButUID_trans eqButUID_sym)\n then show ?match using tr1 vl1 Unfriend UID1_UID2_UIDs unfolding fs1 fv\n by (intro matchI_ms[OF al]) (auto simp: consumeList_def)\n qed auto\n then show ?thesis ..\n qed\n qed\n next\n assume n\\: \"\\\\ ?trn\"\n then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n using step_open_\\[OF step] step_friends12_\\[OF step] by auto\n have vl': \"vl' = vl\" using n\\ c by (auto simp: consume_def)\n show ?thesis proof (cases \"a \\ Cact (cFriend UID1 (pass s UID1) UID2) \\\n a \\ Cact (cFriend UID2 (pass s UID2) UID1) \\\n a \\ Dact (dFriend UID1 (pass s UID1) UID2) \\\n a \\ Dact (dFriend UID2 (pass s UID2) UID1)\")\n case True\n obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n let ?trn1 = \"Trans s1 a ou1 s1'\"\n from True n\\ have n\\': \"\\\\ ?trn1\" using eqButUID_step_\\[OF ss1 rs rs1 step step1] by auto\n then have f12s1': \"friends12 s1 = friends12 s1'\"\n using step_friends12_\\[OF step1] by auto\n have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n moreover have \"friendIDs s = friendIDs s1 \\ friendIDs s' = friendIDs s1'\"\n using eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 True] ..\n ultimately have \"\\2 s' vl' s1' vl1\"\n using os' os aF1 BO fs_fs1 last_fs fs_fIDs unfolding f12s1' vl' vl vl1\n by (intro \\2_I) auto\n then have ?match\n using step1 n\\' os eqButUID_step_\\_out[OF ss1 step step1]\n by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n then show \"?match \\ ?ignore\" ..\n next\n case False\n with n\\ have \"ou \\ outOK\" by auto\n then have \"s' = s\" using step False by auto\n then have ?ignore using 2 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n then show \"?match \\ ?ignore\" ..\n qed\n qed\n qed\n then show ?thesis unfolding vl by auto\n qed\nqed\n\n\ndefinition Gr where\n\"Gr =\n {\n (\\0, {\\0,\\1,\\2}),\n (\\1, {\\1,\\0}),\n (\\2, {\\2,\\0})\n }\"\n\n\ntheorem secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing\nistate_\\0 unwind_cont_\\0 unwind_cont_\\1 unwind_cont_\\2\nunfolding Gr_def by (auto intro: unwind_cont_mono)\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Friend_Confidentiality/Friend.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.19508559969609368}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\nchapter \"Restricted capabilities in the Separation Kernel Abstract Specification\"\n\ntheory Separation\nimports\n \"ASepSpec.Syscall_SA\"\n \"AInvs.AInvs\"\n \"Lib.Bisim_UL\"\n \"Lib.LemmaBucket\"\nbegin\n\ntext \\\n The seL4 kernel, when appropriately restricted, is a separation kernel. Any\n two processes in separate domains should behave the same as if they were\n processes running on two physically separated machines. They should not be\n aware of each other's existence and should not be able to communicate with\n each other except through well-defined channels. Importantly, it must be\n possible to show that there are no back channels through which one process\n can determine whether another process exists or what it is doing.\n\n In seL4 we achieve this by restricting the capabilities that a thread may\n possess. The restrictions are summarised in the predicate @{text\n separate_state} below (which indirectly depends on further predicates @{text\n separate_cnode_cap}, @{text separate_cap}, etc).\n\n a) A thread may only possess \\emph{notification capabilities}\n (@{text NotificationCap}).\n\n b) Threads do not have caller capabilities. (A caller capability is a\n capability, placed in a special slot in the TCB, to allow replies. Since the\n @{text Reply} capability is disallowed so is the caller capability.)\n\n c) Pointers to other capability tables are disallowed meaning that the\n capability tree is flat. i.e. of depth 1\n\n Initialising the kernel so that these restrictions hold is not covered in\n the bisimulation proof, but can be achieved using the capDL initialiser.\n\n Note that this proof does not preclude threads from communicating via shared\n memory if the threads have been set up accordingly, which again can be done\n via the capDL initialiser.\n\n The proof does show that the kernel API after reaching a state that\n satisifies @{text separate_state} is that of a static separation kernel,\n that is, it only provides system calls for sending and receiving on\n notification objects and otherwise exhibits no dynamic behaviour.\n\n Systems with such a setup satisfy the preconditions of our separate\n non-intereference proof, which shows that information travels only along\n these authorised channels.\n\\\n\ndefinition\n separate_cap :: \"cap \\ bool\"\nwhere\n \"separate_cap cap \\ case cap of\n NotificationCap ptr badge rights \\ rights \\ {AllowRecv, AllowSend}\n | NullCap \\ True\n | _ \\ False\"\n\n\nlemma separate_capE:\n \"\\ separate_cap cap; cap = NullCap \\ R; \\ptr badge rights. \\ cap = NotificationCap ptr badge rights \\ \\ R \\ \\ R\"\n unfolding separate_cap_def\n by (fastforce split: cap.splits)\n\ndefinition\n \"separate_cnode_cap cs cap \\ case cap of\n CNodeCap p bits guard \\ (bits + length guard = word_bits) \\\n (\\off. case_option True separate_cap (cs (p, off)))\n | NullCap \\ True\n | _ \\ False\"\n\ndefinition\n \"separate_tcb p cs \\ case_option True (separate_cnode_cap cs) (cs (p, tcb_cnode_index 0))\n \\ cs (p, tcb_cnode_index 3) = Some NullCap\" \\ \\ctable and caller cap\\\n\nlemma separate_cnode_cap_rab:\n \"\\ separate_cnode_cap cs cap; length cref = word_bits \\ \\\n resolve_address_bits (cap, cref) = (case cap of\n CNodeCap p bits guard \\ if guard \\ cref then\n returnOk ((p, drop (length guard) cref), [])\n else\n (throwError (GuardMismatch (length cref) guard))\n | _ \\ throwError InvalidRoot)\"\n unfolding separate_cnode_cap_def resolve_address_bits_def\n by (auto simp: word_bits_def resolve_address_bits'.simps split: cap.split_asm)\n\ndefinition\n \"separate_state s \\ \\p. tcb_at p s \\ separate_tcb p (caps_of_state s)\"\n\n\nlemma separate_cnode_capE:\n \"\\ separate_cnode_cap cs cap;\n cap = NullCap \\ R;\n \\p bits guard. \\ cap = CNodeCap p bits guard; bits + length guard = word_bits;\n (\\off cap'. cs (p, off) = Some cap' \\ separate_cap cap') \\ \\ R \\\n \\ R\"\n unfolding separate_cnode_cap_def\n by (auto split: cap.splits option.splits)\n\nlemma valid_sep_cap_not_cnode:\n \"\\ s \\ cap; \\off cap'. caps_of_state s (p, off) = Some cap' \\ separate_cap cap'; cap = CNodeCap p bits guard; bits \\ length cref - length guard \\\n \\ \\cap'. caps_of_state s (p, take bits (drop (length guard) cref)) = Some cap' \\ \\ is_cnode_cap cap'\"\n apply (clarsimp simp: valid_cap_simps not_less in_monad)\n apply (drule_tac offset = \"take bits (drop (length guard) cref)\" in cap_table_at_cte_at)\n apply simp\n apply (fastforce simp: cte_wp_at_caps_of_state separate_cap_def is_cap_simps)\n done\n\nlemma bisim_gen_asm_r:\n assumes bs: \"F \\ bisim_underlying sr r P P' a b\"\n shows \"bisim_underlying sr r P (P' and K F) a b\"\n using bs\n by (fastforce intro!: bisim_underlyingI elim: bisim_underlyingE1 bisim_underlyingE2)\n\nlemma bisim_separate_cap_cases:\n assumes nc: \"cap = NullCap \\ bisim R Pn Pn' m m'\"\n and ac: \"\\ptr badge rights. \\ cap = NotificationCap ptr badge rights \\\n \\ bisim R (Pa ptr badge rights) (Pa' ptr badge rights) m m'\"\n shows \"bisim R (\\s. (cap = NullCap \\ Pn s)\n \\ (\\ptr badge rights. cap = NotificationCap ptr badge rights \\ Pa ptr badge rights s))\n ((\\s. (cap = NullCap \\ Pn' s)\n \\ (\\ptr badge rights. cap = NotificationCap ptr badge rights \\ Pa' ptr badge rights s))\n and K (separate_cap cap)) m m'\"\n using assms\n apply -\n apply (rule bisim_gen_asm_r)\n apply (erule separate_capE, simp_all)\n done\n\nlemma caps_of_state_tcb:\n \"\\ get_tcb p s = Some tcb; option_map fst (tcb_cap_cases idx) = Some getF \\ \\ caps_of_state s (p, idx) = Some (getF tcb)\"\n apply (drule get_tcb_SomeD)\n apply clarsimp\n apply (drule (1) cte_wp_at_tcbI [where t = \"(p, idx)\" and P = \"(=) (getF tcb)\", simplified])\n apply simp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\nlemma caps_of_state_tcb_cap_cases:\n \"\\ get_tcb p s = Some tcb; idx \\ dom tcb_cap_cases \\ \\ caps_of_state s (p, idx) = Some ((the (option_map fst (tcb_cap_cases idx))) tcb)\"\n apply (clarsimp simp: dom_def)\n apply (erule caps_of_state_tcb)\n apply simp\n done\n\nlemma separate_state_get_tcbD:\n \"\\separate_state s; get_tcb p s = Some tcb \\ \\\n separate_cnode_cap (caps_of_state s) (tcb_ctable tcb) \\ tcb_caller tcb = NullCap\"\n unfolding separate_state_def\n apply (drule spec [where x = p])\n apply (simp add: tcb_at_def separate_tcb_def caps_of_state_tcb_cap_cases dom_tcb_cap_cases)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/bisim/Separation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3593641451601019, "lm_q1q2_score": 0.19508559969609365}} {"text": "(* Title: JinjaThreads/MM/JMM_Framework.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Combination of locales for heap operations and interleaving} *}\n\ntheory JMM_Framework\nimports\n JMM_Heap\n \"../Framework/FWInitFinLift\"\n \"../Common/WellForm\"\nbegin\n\nlemma enat_plus_eq_enat_conv: -- {* Move to Extended\\_Nat *}\n \"enat m + n = enat k \\ k \\ m \\ n = enat (k - m)\"\nby(cases n) auto\n\ndeclare convert_new_thread_action_id [simp]\n\ncontext heap begin\n\nlemma init_fin_lift_state_start_state:\n \"init_fin_lift_state s (start_state f P C M vs) = start_state (\\C M Ts T meth vs. (s, f C M Ts T meth vs)) P C M vs\"\nby(simp add: start_state_def init_fin_lift_state_def split_beta fun_eq_iff)\n\nlemma non_speculative_start_heap_obs:\n \"non_speculative P vs (llist_of (map snd (lift_start_obs start_tid start_heap_obs)))\"\napply(rule non_speculative_nthI)\nusing start_heap_obs_not_Read\nby(clarsimp simp add: lift_start_obs_def lnth_LCons o_def eSuc_enat[symmetric] in_set_conv_nth split: nat.split_asm)\n\nlemma ta_seq_consist_start_heap_obs:\n \"ta_seq_consist P empty (llist_of (map snd (lift_start_obs start_tid start_heap_obs)))\"\nusing start_heap_obs_not_Read\nby(auto intro: ta_seq_consist_nthI simp add: lift_start_obs_def o_def lnth_LCons in_set_conv_nth split: nat.split_asm)\n\nend\n\ncontext allocated_heap begin\n\nlemma w_addrs_lift_start_heap_obs:\n \"w_addrs (w_values P vs (map snd (lift_start_obs start_tid start_heap_obs))) \\ w_addrs vs\"\nby(simp add: lift_start_obs_def o_def w_addrs_start_heap_obs)\n\nend\n\ncontext heap begin\n\nlemma w_values_start_heap_obs_typeable:\n assumes wf: \"wf_syscls P\"\n and mrws: \"v \\ w_values P (\\_. {}) (map snd (lift_start_obs start_tid start_heap_obs)) (ad, al)\"\n shows \"\\T. P,start_heap \\ ad@al : T \\ P,start_heap \\ v :\\ T\"\nproof -\n from in_w_valuesD[OF mrws]\n obtain obs' wa obs'' \n where eq: \"map snd (lift_start_obs start_tid start_heap_obs) = obs' @ wa # obs''\"\n and \"is_write_action wa\"\n and adal: \"(ad, al) \\ action_loc_aux P wa\"\n and vwa: \"value_written_aux P wa al = v\"\n by blast\n from `is_write_action wa` show ?thesis\n proof cases\n case (WriteMem ad' al' v')\n with vwa adal eq have \"WriteMem ad al v \\ set start_heap_obs\"\n by(auto simp add: map_eq_append_conv Cons_eq_append_conv lift_start_obs_def)\n thus ?thesis by(rule start_heap_write_typeable)\n next\n case (NewHeapElem ad' hT)\n with vwa adal eq have \"NewHeapElem ad hT \\ set start_heap_obs\"\n by(auto simp add: map_eq_append_conv Cons_eq_append_conv lift_start_obs_def)\n hence \"typeof_addr start_heap ad = \\hT\\\"\n by(rule NewHeapElem_start_heap_obsD[OF wf])\n thus ?thesis using adal vwa NewHeapElem\n apply(cases hT)\n apply(auto intro!: addr_loc_type.intros dest: has_field_decl_above)\n apply(frule has_field_decl_above)\n apply(auto intro!: addr_loc_type.intros dest: has_field_decl_above)\n done\n qed\nqed\n\nlemma start_state_vs_conf:\n \"wf_syscls P \\ vs_conf P start_heap (w_values P (\\_. {}) (map snd (lift_start_obs start_tid start_heap_obs)))\"\nby(rule vs_confI)(rule w_values_start_heap_obs_typeable)\n\nend\n\n\nsection {* JMM traces for Jinja semantics *}\n\ncontext multithreaded_base begin\n\ninductive_set \\ :: \"('l,'t,'x,'m,'w) state \\ ('t \\ 'o) llist set\"\n for \\ :: \"('l,'t,'x,'m,'w) state\"\nwhere\n \"mthr.Runs \\ E'\n \\ lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') \\ \\ \\\"\n\nlemma actions_\\E_aux:\n fixes \\ E'\n defines \"E == lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n assumes mthr: \"mthr.Runs \\ E'\"\n and a: \"enat a < llength E\"\n obtains m n t ta\n where \"lnth E a = (t, \\ta\\\\<^bsub>o\\<^esub> ! n)\"\n and \"n < length \\ta\\\\<^bsub>o\\<^esub>\" and \"enat m < llength E'\"\n and \"a = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + n\"\n and \"lnth E' m = (t, ta)\"\nproof -\n from lnth_lconcat_conv[OF a[unfolded E_def], folded E_def]\n obtain m n\n where \"lnth E a = lnth (lnth (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') m) n\"\n and \"enat n < llength (lnth (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') m)\"\n and \"enat m < llength (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \"enat a = (\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) + enat n\"\n by blast\n moreover\n obtain t ta where \"lnth E' m = (t, ta)\" by(cases \"lnth E' m\")\n ultimately have E_a: \"lnth E a = (t, \\ta\\\\<^bsub>o\\<^esub> ! n)\"\n and n: \"n < length \\ta\\\\<^bsub>o\\<^esub>\"\n and m: \"enat m < llength E'\"\n and a: \"enat a = (\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) + enat n\"\n by(simp_all add: lnth_llist_of)\n note a\n also have \"(\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) = \n setsum (enat \\ (\\i. length \\snd (lnth E' i)\\\\<^bsub>o\\<^esub>)) {.. = enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n by(subst setsum_hom)(simp_all add: zero_enat_def)\n finally have a: \"a = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + n\" by simp\n with E_a n m show thesis using `lnth E' m = (t, ta)` by(rule that)\nqed\n\nlemma actions_\\E:\n assumes E: \"E \\ \\ \\\"\n and a: \"enat a < llength E\"\n obtains E' m n t ta\n where \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \"mthr.Runs \\ E'\"\n and \"lnth E a = (t, \\ta\\\\<^bsub>o\\<^esub> ! n)\"\n and \"n < length \\ta\\\\<^bsub>o\\<^esub>\" and \"enat m < llength E'\"\n and \"a = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + n\"\n and \"lnth E' m = (t, ta)\"\nproof -\n from E obtain E' ws\n where E: \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \"mthr.Runs \\ E'\" by(rule \\.cases) blast\n from `mthr.Runs \\ E'` a[unfolded E]\n show ?thesis\n by(rule actions_\\E_aux)(fold E, rule that[OF E `mthr.Runs \\ E'`])\nqed\n\nend\n\ncontext \\multithreaded_wf begin\n\ntext {* Alternative characterisation for @{term \"\\\"} *}\nlemma \\_conv_Runs:\n \"\\ \\ = lconcat ` lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ` llist_of_tllist ` {E. mthr.\\Runs \\ E}\"\n (is \"?lhs = ?rhs\")\nproof(intro equalityI subsetI)\n fix E\n assume \"E \\ ?rhs\"\n then obtain E' where E: \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (llist_of_tllist E'))\"\n and \\Runs: \"mthr.\\Runs \\ E'\" by(blast)\n obtain E'' where E': \"E' = tmap (\\(tls, s', tl, s''). tl) (case_sum (\\(tls, s'). \\s'\\) Map.empty) E''\"\n and \\Runs': \"mthr.\\Runs_table2 \\ E''\"\n using \\Runs by(rule mthr.\\Runs_into_\\Runs_table2)\n have \"mthr.Runs \\ (lconcat (lappend (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist E'')) \n (LCons (case terminal E'' of Inl (tls, s') \\ llist_of tls | Inr tls \\ tls) LNil)))\"\n (is \"mthr.Runs _ ?E'''\")\n using \\Runs' by(rule mthr.\\Runs_table2_into_Runs)\n moreover \n let ?tail = \"\\E''. case terminal E'' of Inl (tls, s') \\ llist_of tls | Inr tls \\ tls\"\n {\n have \"E = lconcat (lfilter (\\xs. \\ lnull xs) (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (llist_of_tllist E')))\"\n unfolding E by(simp add: lconcat_lfilter_neq_LNil)\n also have \"\\ = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (lmap (\\(tls, s', tta, s''). tta) (lfilter (\\(tls, s', (t, ta), s''). \\ta\\\\<^bsub>o\\<^esub> \\ []) (llist_of_tllist E''))))\"\n by(simp add: E' lfilter_lmap llist.map_comp o_def split_def)\n also\n from `mthr.\\Runs_table2 \\ E''`\n have \"lmap (\\(tls, s', tta, s''). tta) (lfilter (\\(tls, s', (t, ta), s''). \\ta\\\\<^bsub>o\\<^esub> \\ []) (llist_of_tllist E'')) = \n lfilter (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub> \\ []) (lconcat (lappend (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist E'')) (LCons (?tail E'') LNil)))\"\n (is \"?lhs \\ E'' = ?rhs \\ E''\")\n proof(coinduction arbitrary: \\ E'' rule: llist.coinduct_strong)\n case (Eq_llist \\ E'')\n have ?lnull\n by(cases \"lfinite (llist_of_tllist E'')\")(fastforce split: sum.split_asm simp add: split_beta lset_lconcat_lfinite lappend_inf mthr.silent_move2_def dest: mthr.\\Runs_table2_silentsD[OF Eq_llist] mthr.\\Runs_table2_terminal_silentsD[OF Eq_llist] mthr.\\Runs_table2_terminal_inf_stepD[OF Eq_llist] m\\move_silentD inf_step_silentD silent_moves2_silentD split: sum.split_asm)+\n moreover\n have ?LCons\n proof(intro impI conjI)\n assume lhs': \"\\ lnull (lmap (\\(tls, s', tta, s''). tta) (lfilter (\\(tls, s', (t, ta), s''). \\ta\\\\<^bsub>o\\<^esub> \\ []) (llist_of_tllist E'')))\"\n (is \"\\ lnull ?lhs'\")\n and \"\\ lnull (lfilter (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub> \\ []) (lconcat (lappend (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist E'')) (LCons (case terminal E'' of Inl (tls, s') \\ llist_of tls | Inr tls \\ tls) LNil))))\"\n (is \"\\ lnull ?rhs'\")\n\n note \\Runs' = `mthr.\\Runs_table2 \\ E''`\n from lhs' obtain tl tls' where \"?lhs \\ E'' = LCons tl tls'\"\n by(auto simp only: not_lnull_conv)\n then obtain tls s' s'' tlsstlss'\n where tls': \"tls' = lmap (\\(tls, s', tta, s''). tta) tlsstlss'\"\n and filter: \"lfilter (\\(tls, s', (t, ta), s''). obs_a ta \\ []) (llist_of_tllist E'') = LCons (tls, s', tl, s'') tlsstlss'\"\n using lhs' by(fastforce simp add: lmap_eq_LCons_conv)\n from lfilter_eq_LConsD[OF filter]\n obtain us vs where eq: \"llist_of_tllist E'' = lappend us (LCons (tls, s', tl, s'') vs)\"\n and fin: \"lfinite us\"\n and empty: \"\\(tls, s', (t, ta), s'')\\lset us. obs_a ta = []\"\n and neq_empty: \"obs_a (snd tl) \\ []\"\n and tlsstlss': \"tlsstlss' = lfilter (\\(tls, s', (t, ta), s''). obs_a ta \\ []) vs\"\n by(auto simp add: split_beta)\n from eq obtain E''' where E'': \"E'' = lappendt us E'''\" \n and eq': \"llist_of_tllist E''' = LCons (tls, s', tl, s'') vs\"\n and terminal: \"terminal E''' = terminal E''\"\n unfolding llist_of_tllist_eq_lappend_conv by auto\n from \\Runs' fin E'' obtain \\' where \\Runs'': \"mthr.\\Runs_table2 \\' E'''\"\n by(auto dest: mthr.\\Runs_table2_lappendtD)\n then obtain \\'' E'''' where \"mthr.\\Runs_table2 \\'' E''''\" \"E''' = TCons (tls, s', tl, s'') E''''\"\n using eq' by cases auto\n moreover from \\Runs' E'' fin\n have \"\\(tls, s, tl, s')\\lset us. \\(t, ta)\\set tls. ta = \\\"\n by(fastforce dest: mthr.\\Runs_table2_silentsD m\\move_silentD simp add: mthr.silent_move2_def)\n hence \"lfilter (\\(t, ta). obs_a ta \\ []) (lconcat (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) us)) = LNil\"\n using empty by(auto simp add: lfilter_empty_conv lset_lconcat_lfinite split_beta)\n moreover from \\Runs'' eq' have \"snd ` set tls \\ {\\}\"\n by(cases)(fastforce dest: silent_moves2_silentD)+\n hence \"[(t, ta)\\tls . obs_a ta \\ []] = []\"\n by(auto simp add: filter_empty_conv split_beta)\n ultimately \n show \"lhd ?lhs' = lhd ?rhs'\"\n and \"(\\\\ E''. ltl ?lhs' = lmap (\\(tls, s', tta, s''). tta) (lfilter (\\(tls, s', (t, ta), s''). \\ta\\\\<^bsub>o\\<^esub> \\ []) (llist_of_tllist E'')) \\\n ltl ?rhs' = lfilter (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub> \\ []) (lconcat (lappend (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist E'')) (LCons (case terminal E'' of Inl (tls, s') \\ llist_of tls | Inr tls \\ tls) LNil))) \\\n \\trsys.\\Runs_table2 redT m\\move \\ E'') \\\n ltl ?lhs' = ltl ?rhs'\"\n using lhs' E'' fin tls' tlsstlss' filter eq' neq_empty\n by(auto simp add: lmap_lappend_distrib lappend_assoc split_beta filter_empty_conv simp del: split_paired_Ex)\n qed\n ultimately show ?case ..\n qed\n also have \"lmap (\\(t, ta). llist_of (map (Pair t) (obs_a ta))) \\ = lfilter (\\obs. \\ lnull obs) (lmap (\\(t, ta). llist_of (map (Pair t) (obs_a ta))) (lconcat (lappend (lmap (\\(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist E'')) (LCons (?tail E'') LNil))))\"\n unfolding lfilter_lmap by(simp add: o_def split_def llist_of_eq_LNil_conv)\n finally have \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?E''')\"\n by(simp add: lconcat_lfilter_neq_LNil) }\n ultimately show \"E \\ ?lhs\" by(blast intro: \\.intros)\nnext\n fix E\n assume \"E \\ ?lhs\"\n then obtain E' where E: \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) (obs_a ta))) E')\"\n and Runs: \"mthr.Runs \\ E'\" by(blast elim: \\.cases)\n from Runs obtain E'' where E': \"E' = lmap (\\(s, tl, s'). tl) E''\"\n and Runs': \"mthr.Runs_table \\ E''\" by(rule mthr.Runs_into_Runs_table)\n have \"mthr.\\Runs \\ (tmap (\\(s, tl, s'). tl) id (tfilter None (\\(s, tl, s'). \\ m\\move s tl s') (tllist_of_llist (Some (llast (LCons \\ (lmap (\\(s, tl, s'). s') E'')))) E'')))\"\n (is \"mthr.\\Runs _ ?E'''\")\n using Runs' by(rule mthr.Runs_table_into_\\Runs)\n moreover\n have \"(\\(s, (t, ta), s'). obs_a ta \\ []) = (\\(s, (t, ta), s'). obs_a ta \\ [] \\ \\ m\\move s (t, ta) s')\"\n by(rule ext)(auto dest: m\\move_silentD)\n hence \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) (obs_a ta))) (llist_of_tllist ?E'''))\"\n unfolding E E'\n by(subst (1 2) lconcat_lfilter_neq_LNil[symmetric])(simp add: lfilter_lmap lfilter_lfilter o_def split_def)\n ultimately show \"E \\ ?rhs\" by(blast)\nqed\n\nend\n\ntext {* Running threads have been started before *}\n\ndefinition Status_no_wait_locks :: \"('l,'t,status \\ 'x) thread_info \\ bool\"\nwhere\n \"Status_no_wait_locks ts \\ \n (\\t status x ln. ts t = \\((status, x), ln)\\ \\ status \\ Running \\ ln = no_wait_locks)\"\n\nlemma Status_no_wait_locks_PreStartD:\n \"\\ Status_no_wait_locks ts; ts t = \\((PreStart, x), ln)\\ \\ \\ ln = no_wait_locks\"\nunfolding Status_no_wait_locks_def by blast\n\nlemma Status_no_wait_locks_FinishedD:\n \"\\ Status_no_wait_locks ts; ts t = \\((Finished, x), ln)\\ \\ \\ ln = no_wait_locks\"\nunfolding Status_no_wait_locks_def by blast\n\nlemma Status_no_wait_locksI:\n \"(\\t status x ln. \\ ts t = \\((status, x), ln)\\; status = PreStart \\ status = Finished \\ \\ ln = no_wait_locks)\n \\ Status_no_wait_locks ts\"\nunfolding Status_no_wait_locks_def \napply clarify\napply(case_tac status)\napply auto\ndone\n\ncontext heap_base begin\n\nlemma Status_no_wait_locks_start_state:\n \"Status_no_wait_locks (thr (init_fin_lift_state status (start_state f P C M vs)))\"\nby(clarsimp simp add: Status_no_wait_locks_def init_fin_lift_state_def start_state_def split_beta)\n\nend\n\ncontext multithreaded_base begin\n\nlemma init_fin_preserve_Status_no_wait_locks:\n assumes ok: \"Status_no_wait_locks (thr s)\"\n and redT: \"multithreaded_base.redT init_fin_final init_fin (map NormalAction \\ convert_RA) s tta s'\"\n shows \"Status_no_wait_locks (thr s')\"\nusing redT\nproof(cases rule: multithreaded_base.redT.cases[consumes 1, case_names redT_normal redT_acquire])\n case redT_acquire\n with ok show ?thesis\n by(auto intro!: Status_no_wait_locksI dest: Status_no_wait_locks_PreStartD Status_no_wait_locks_FinishedD split: split_if_asm)\nnext\n case redT_normal\n show ?thesis\n proof(rule Status_no_wait_locksI)\n fix t' status' x' ln'\n assume tst': \"thr s' t' = \\((status', x'), ln')\\\"\n and status: \"status' = PreStart \\ status' = Finished\"\n show \"ln' = no_wait_locks\"\n proof(cases \"thr s t'\")\n case None\n with redT_normal tst' show ?thesis\n by(fastforce elim!: init_fin.cases dest: redT_updTs_new_thread simp add: final_thread.actions_ok_iff split: split_if_asm)\n next\n case (Some sxln)\n obtain status'' x'' ln'' \n where [simp]: \"sxln = ((status'', x''), ln'')\" by(cases sxln) auto\n show ?thesis\n proof(cases \"fst tta = t'\")\n case True\n with redT_normal tst' status show ?thesis by(auto simp add: expand_finfun_eq fun_eq_iff)\n next\n case False\n with tst' redT_normal Some status have \"status'' = status'\" \"ln'' = ln'\" \n by(force dest: redT_updTs_Some simp add: final_thread.actions_ok_iff)+\n with ok Some status show ?thesis\n by(auto dest: Status_no_wait_locks_PreStartD Status_no_wait_locks_FinishedD)\n qed\n qed\n qed\nqed\n\nlemma init_fin_Running_InitialThreadAction:\n assumes redT: \"multithreaded_base.redT init_fin_final init_fin (map NormalAction \\ convert_RA) s tta s'\"\n and not_running: \"\\x ln. thr s t \\ \\((Running, x), ln)\\\"\n and running: \"thr s' t = \\((Running, x'), ln')\\\"\n shows \"tta = (t, \\InitialThreadAction\\)\"\nusing redT\nproof(cases rule: multithreaded_base.redT.cases[consumes 1, case_names redT_normal redT_acquire])\n case redT_acquire\n with running not_running show ?thesis by(auto split: split_if_asm)\nnext\n case redT_normal\n show ?thesis\n proof(cases \"thr s t\")\n case None\n with redT_normal running not_running show ?thesis\n by(fastforce simp add: final_thread.actions_ok_iff elim: init_fin.cases dest: redT_updTs_new_thread split: split_if_asm)\n next\n case (Some a)\n with redT_normal running not_running show ?thesis\n apply(cases a)\n apply(auto simp add: final_thread.actions_ok_iff split: split_if_asm elim: init_fin.cases)\n apply((drule (1) redT_updTs_Some)?, fastforce)+\n done\n qed\nqed\n\nend\n\ncontext if_multithreaded begin\n\nlemma init_fin_Trsys_preserve_Status_no_wait_locks:\n assumes ok: \"Status_no_wait_locks (thr s)\"\n and Trsys: \"if.mthr.Trsys s ttas s'\"\n shows \"Status_no_wait_locks (thr s')\"\nusing Trsys ok\nby(induct)(blast dest: init_fin_preserve_Status_no_wait_locks)+\n\nlemma init_fin_Trsys_Running_InitialThreadAction:\n assumes redT: \"if.mthr.Trsys s ttas s'\"\n and not_running: \"\\x ln. thr s t \\ \\((Running, x), ln)\\\"\n and running: \"thr s' t = \\((Running, x'), ln')\\\"\n shows \"(t, \\InitialThreadAction\\) \\ set ttas\"\nusing redT not_running running\nproof(induct arbitrary: x' ln')\n case rtrancl3p_refl thus ?case by(fastforce)\nnext\n case (rtrancl3p_step s ttas s' tta s'') thus ?case\n by(cases \"\\x ln. thr s' t = \\((Running, x), ln)\\\")(fastforce dest: init_fin_Running_InitialThreadAction)+\nqed\n\nend\n\nlocale heap_multithreaded_base =\n heap_base\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n +\n mthr!: multithreaded_base final r convert_RA\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and convert_RA :: \"'addr released_locks \\ ('addr, 'thread_id) obs_event list\"\n\nsublocale heap_multithreaded_base < mthr!: if_multithreaded_base final r convert_RA\n.\n\ncontext heap_multithreaded_base begin\n\nabbreviation \\_start ::\n \"(cname \\ mname \\ ty list \\ ty \\ 'md \\ 'addr val list \\ 'x) \n \\ 'md prog \\ cname \\ mname \\ 'addr val list \\ status \n \\ ('thread_id \\ ('addr, 'thread_id) obs_event action) llist set\"\nwhere\n \"\\_start f P C M vs status \\ \n lappend (llist_of (lift_start_obs start_tid start_heap_obs)) ` \n mthr.if.\\ (init_fin_lift_state status (start_state f P C M vs))\"\n\nend\n\nlocale heap_multithreaded =\n heap_multithreaded_base \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n final r convert_RA\n +\n heap\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n P \n + \n mthr!: multithreaded final r convert_RA\n\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and convert_RA :: \"'addr released_locks \\ ('addr, 'thread_id) obs_event list\" \n and P :: \"'md prog\"\n\nsublocale heap_multithreaded < mthr!: if_multithreaded final r convert_RA\nby(unfold_locales)\n\nsublocale heap_multithreaded < \"if\"!: jmm_multithreaded\n mthr.init_fin_final mthr.init_fin \"map NormalAction \\ convert_RA\" P\n.\n\ncontext heap_multithreaded begin\n\nlemma thread_start_actions_ok_init_fin_RedT:\n assumes Red: \"mthr.if.RedT (init_fin_lift_state status (start_state f P C M vs)) ttas s'\"\n (is \"mthr.if.RedT ?start_state _ _\")\n shows \"thread_start_actions_ok (llist_of (lift_start_obs start_tid start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n (is \"thread_start_actions_ok (llist_of (?obs_prefix @ ?E'))\")\nproof(rule thread_start_actions_okI)\n let ?E = \"llist_of (?obs_prefix @ ?E')\"\n fix a\n assume a: \"a \\ actions ?E\"\n and new: \"\\ is_new_action (action_obs ?E a)\"\n show \"\\i \\ a. action_obs ?E i = InitialThreadAction \\ action_tid ?E i = action_tid ?E a\"\n proof(cases \"action_tid ?E a = start_tid\")\n case True thus ?thesis\n by(auto simp add: lift_start_obs_def action_tid_def action_obs_def)\n next\n case False\n let ?a = \"a - length ?obs_prefix\"\n\n from False have a_len: \"a \\ length ?obs_prefix\"\n by(rule contrapos_np)(auto simp add: lift_start_obs_def action_tid_def lnth_LCons nth_append split: nat.split)\n hence [simp]: \"action_tid ?E a = action_tid (llist_of ?E') ?a\" \"action_obs ?E a = action_obs (llist_of ?E') ?a\"\n by(simp_all add: action_tid_def nth_append action_obs_def)\n\n from False have not_running: \"\\x ln. thr ?start_state (action_tid (llist_of ?E') ?a) \\ \\((Running, x), ln)\\\"\n by(auto simp add: start_state_def split_beta init_fin_lift_state_def split: split_if_asm)\n \n from a a_len have \"?a < length ?E'\" by(simp add: actions_def)\n from nth_concat_conv[OF this]\n obtain m n where E'_a: \"?E' ! ?a = (\\(t, ta). (t, \\ta\\\\<^bsub>o\\<^esub> ! n)) (ttas ! m)\"\n and n: \"n < length \\snd (ttas ! m)\\\\<^bsub>o\\<^esub>\"\n and m: \"m < length ttas\"\n and a_conv: \"?a = (\\i(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas ! i)) + n\"\n by(clarsimp simp add: split_def)\n\n from Red obtain s'' s''' where Red1: \"mthr.if.RedT ?start_state (take m ttas) s''\"\n and red: \"mthr.if.redT s'' (ttas ! m) s'''\"\n and Red2: \"mthr.if.RedT s''' (drop (Suc m) ttas) s'\"\n unfolding mthr.if.RedT_def\n by(subst (asm) (4) id_take_nth_drop[OF m])(blast elim: rtrancl3p_appendE rtrancl3p_converseE)\n\n from E'_a m n have [simp]: \"action_tid (llist_of ?E') ?a = fst (ttas ! m)\"\n by(simp add: action_tid_def split_def)\n \n from red obtain status x ln where tst: \"thr s'' (fst (ttas ! m)) = \\((status, x), ln)\\\" by cases auto\n show ?thesis\n proof(cases \"status = PreStart \\ status = Finished\")\n case True\n from Red1 have \"Status_no_wait_locks (thr s'')\"\n unfolding mthr.if.RedT_def\n by(rule mthr.init_fin_Trsys_preserve_Status_no_wait_locks[OF Status_no_wait_locks_start_state])\n with True tst have \"ln = no_wait_locks\"\n by(auto dest: Status_no_wait_locks_PreStartD Status_no_wait_locks_FinishedD)\n with red tst True have \"\\snd (ttas ! m)\\\\<^bsub>o\\<^esub> = [InitialThreadAction]\" by(cases) auto\n hence \"action_obs ?E a = InitialThreadAction\" using a_conv n a_len E'_a\n by(simp add: action_obs_def nth_append split_beta)\n thus ?thesis by(auto)\n next\n case False\n hence \"status = Running\" by(cases status) auto\n with tst mthr.init_fin_Trsys_Running_InitialThreadAction[OF Red1[unfolded mthr.if.RedT_def] not_running]\n have \"(fst (ttas ! m), \\InitialThreadAction\\) \\ set (take m ttas)\"\n using E'_a by(auto simp add: action_tid_def split_beta)\n then obtain i where i: \"i < m\" \n and nth_i: \"ttas ! i = (fst (ttas ! m), \\InitialThreadAction\\)\"\n unfolding in_set_conv_nth by auto\n\n let ?i' = \"length (concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (take i ttas)))\"\n let ?i = \"length ?obs_prefix + ?i'\"\n\n from i m nth_i\n have \"?i' < length (concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (take m ttas)))\"\n apply(simp add: length_concat o_def split_beta)\n apply(subst (6) id_take_nth_drop[where i=i])\n apply(simp_all add: take_map[symmetric] min_def)\n done\n also from m have \"\\ \\ ?a\" unfolding a_conv\n by(simp add: length_concat listsum_setsum_nth min_def split_def atLeast0LessThan)\n finally have \"?i < a\" using a_len by simp\n moreover\n from i m nth_i have \"?i' < length ?E'\"\n apply(simp add: length_concat o_def split_def)\n apply(subst (7) id_take_nth_drop[where i=i])\n apply(simp_all add: take_map[symmetric])\n done\n from nth_i i E'_a a_conv m\n have \"lnth ?E ?i = (fst (ttas ! m), InitialThreadAction)\"\n by(simp add: lift_start_obs_def nth_append length_concat o_def split_def)(rule nth_concat_eqI[where k=0 and i=i], simp_all add: take_map o_def split_def)\n ultimately show ?thesis using E'_a\n by(cases \"ttas ! m\")(auto simp add: action_obs_def action_tid_def nth_append intro!: exI[where x=\"?i\"])\n qed\n qed\nqed\n\n(* TODO: use previous lemma for proof *)\n\nlemma thread_start_actions_ok_init_fin:\n assumes E: \"E \\ mthr.if.\\ (init_fin_lift_state status (start_state f P C M vs))\"\n shows \"thread_start_actions_ok (lappend (llist_of (lift_start_obs start_tid start_heap_obs)) E)\"\n (is \"thread_start_actions_ok ?E\")\nproof(rule thread_start_actions_okI)\n let ?start_heap_obs = \"lift_start_obs start_tid start_heap_obs\"\n let ?start_state = \"init_fin_lift_state status (start_state f P C M vs)\"\n fix a\n assume a: \"a \\ actions ?E\"\n and a_new: \"\\ is_new_action (action_obs ?E a)\"\n show \"\\i. i \\ a \\ action_obs ?E i = InitialThreadAction \\ action_tid ?E i = action_tid ?E a\"\n proof(cases \"action_tid ?E a = start_tid\")\n case True thus ?thesis\n by(auto simp add: lift_start_obs_def action_tid_def action_obs_def)\n next\n case False\n\n let ?a = \"a - length ?start_heap_obs\"\n\n from False have \"a \\ length ?start_heap_obs\"\n by(rule contrapos_np)(auto simp add: lift_start_obs_def action_tid_def lnth_LCons lnth_lappend1 split: nat.split)\n hence [simp]: \"action_tid ?E a = action_tid E ?a\" \"action_obs ?E a = action_obs E ?a\"\n by(simp_all add: action_tid_def lnth_lappend2 action_obs_def)\n\n from False have not_running: \"\\x ln. thr ?start_state (action_tid E ?a) \\ \\((Running, x), ln)\\\"\n by(auto simp add: start_state_def split_beta init_fin_lift_state_def split: split_if_asm)\n \n from E obtain E' where E': \"E = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \\Runs: \"mthr.if.mthr.Runs ?start_state E'\" by(rule mthr.if.\\.cases)\n from a E' `a \\ length ?start_heap_obs`\n have enat_a: \"enat ?a < llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E'))\"\n by(cases \"llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E'))\")(auto simp add: actions_def)\n with \\Runs obtain m n t ta\n where a_obs: \"lnth (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')) (a - length ?start_heap_obs) = (t, \\ta\\\\<^bsub>o\\<^esub> ! n)\"\n and n: \"n < length \\ta\\\\<^bsub>o\\<^esub>\" \n and m: \"enat m < llength E'\"\n and a_conv: \"?a = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + n\"\n and E'_m: \"lnth E' m = (t, ta)\"\n by(rule mthr.if.actions_\\E_aux)\n from a_obs have [simp]: \"action_tid E ?a = t\" \"action_obs E ?a = \\ta\\\\<^bsub>o\\<^esub> ! n\"\n by(simp_all add: E' action_tid_def action_obs_def)\n\n let ?E' = \"ldropn (Suc m) E'\"\n let ?m_E' = \"ltake (enat m) E'\"\n have E'_unfold: \"E' = lappend (ltake (enat m) E') (LCons (lnth E' m) ?E')\"\n unfolding ldropn_Suc_conv_ldropn[OF m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend ?m_E' (LCons (lnth E' m) ?E'))\"\n using \\Runs by simp\n then obtain \\' where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of ?m_E') \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' m) ?E')\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\''' where red_a: \"mthr.if.redT \\' (t, ta) \\'''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\''' ?E'\"\n unfolding E'_m by cases\n from red_a obtain status x ln where tst: \"thr \\' t = \\((status, x), ln)\\\" by cases auto\n show ?thesis\n proof(cases \"status = PreStart \\ status = Finished\")\n case True\n have \"Status_no_wait_locks (thr \\')\"\n by(rule mthr.init_fin_Trsys_preserve_Status_no_wait_locks[OF _ \\_\\'])(rule Status_no_wait_locks_start_state)\n with True tst have \"ln = no_wait_locks\"\n by(auto dest: Status_no_wait_locks_PreStartD Status_no_wait_locks_FinishedD)\n with red_a tst True have \"\\ta\\\\<^bsub>o\\<^esub> = [InitialThreadAction]\" by(cases) auto\n hence \"action_obs E ?a = InitialThreadAction\" using a_obs n unfolding E'\n by(simp add: action_obs_def)\n thus ?thesis by(auto)\n next\n case False\n hence \"status = Running\" by(cases status) auto\n with tst mthr.init_fin_Trsys_Running_InitialThreadAction[OF \\_\\' not_running]\n have \"(action_tid E ?a, \\InitialThreadAction\\) \\ set (list_of (ltake (enat m) E'))\"\n using a_obs E' by(auto simp add: action_tid_def)\n then obtain i where \"i < m\" \"enat i < llength E'\" \n and nth_i: \"lnth E' i = (action_tid E ?a, \\InitialThreadAction\\)\"\n unfolding in_set_conv_nth \n by(cases \"llength E'\")(auto simp add: length_list_of_conv_the_enat lnth_ltake)\n\n let ?i' = \"\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>\"\n let ?i = \"length ?start_heap_obs + ?i'\"\n\n from `i < m` have \"(\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = ?i' + (\\i=i..snd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n unfolding atLeast0LessThan[symmetric] by(subst setsum_add_nat_ivl) simp_all\n hence \"?i' \\ ?a\" unfolding a_conv by simp\n hence \"?i \\ a\" using `a \\ length ?start_heap_obs` by arith\n\n\n from `?i' \\ ?a` have \"enat ?i' < llength E\" using enat_a E'\n by(simp add: le_less_trans[where y=\"enat ?a\"])\n from lnth_lconcat_conv[OF this[unfolded E'], folded E']\n obtain k l \n where nth_i': \"lnth E ?i' = lnth (lnth (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') k) l\"\n and l: \"l < length \\snd (lnth E' k)\\\\<^bsub>o\\<^esub>\"\n and k: \"enat k < llength E'\"\n and i_conv: \"enat ?i' = (\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) + enat l\"\n by(fastforce simp add: split_beta)\n\n have \"(\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) =\n (\\i (\\i. length \\snd (lnth E' i)\\\\<^bsub>o\\<^esub>)) i)\"\n by(rule setsum.cong)(simp_all add: less_trans[where y=\"enat k\"] split_beta k)\n also have \"\\ = enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n by(rule setsum_hom)(simp_all add: zero_enat_def)\n finally have i_conv: \"?i' = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + l\" using i_conv by simp\n\n have [simp]: \"i = k\"\n proof(rule ccontr)\n assume \"i \\ k\"\n thus False unfolding neq_iff\n proof\n assume \"i < k\"\n hence \"(\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = \n (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + (\\i=i..snd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n unfolding atLeast0LessThan[symmetric] by(subst setsum_add_nat_ivl) simp_all\n with i_conv have \"(\\i=i..snd (lnth E' i)\\\\<^bsub>o\\<^esub>) = l\" \"l = 0\" by simp_all\n moreover have \"(\\i=i..snd (lnth E' i)\\\\<^bsub>o\\<^esub>) \\ length \\snd (lnth E' i)\\\\<^bsub>o\\<^esub>\"\n by(subst setsum_head_upt_Suc[OF `i < k`]) simp\n ultimately show False using nth_i by simp\n next\n assume \"k < i\"\n hence \"?i' = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + (\\i=k..snd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n unfolding atLeast0LessThan[symmetric] by(subst setsum_add_nat_ivl) simp_all\n with i_conv have \"(\\i=k..snd (lnth E' i)\\\\<^bsub>o\\<^esub>) = l\" by simp\n moreover have \"(\\i=k..snd (lnth E' i)\\\\<^bsub>o\\<^esub>) \\ length \\snd (lnth E' k)\\\\<^bsub>o\\<^esub>\"\n by(subst setsum_head_upt_Suc[OF `k < i`]) simp\n ultimately show False using l by simp\n qed\n qed\n with l nth_i have [simp]: \"l = 0\" by simp\n \n hence \"lnth E ?i' = (action_tid E ?a, InitialThreadAction)\"\n using nth_i nth_i' k by simp\n with `?i \\ a` show ?thesis\n by(auto simp add: action_tid_def action_obs_def lnth_lappend2)\n qed\n qed\nqed\n\n\n\nend\n\ntext {* In the subsequent locales, @{text \"convert_RA\"} refers to @{term \"convert_RA\"} and is no longer a parameter! *}\n\nlemma convert_RA_not_write:\n \"ob \\ set (convert_RA ln) \\ \\ is_write_action (NormalAction ob)\"\nby(auto simp add: convert_RA_def)\n\nlemma ta_seq_consist_convert_RA:\n \"ta_seq_consist P vs (llist_of ((map NormalAction \\ convert_RA) ln))\"\nproof(rule ta_seq_consist_nthI)\n fix i ad al v\n assume \"enat i < llength (llist_of ((map NormalAction \\ convert_RA) ln :: ('b, 'c) obs_event action list))\"\n and \"lnth (llist_of ((map NormalAction \\ convert_RA) ln :: ('b, 'c) obs_event action list)) i = NormalAction (ReadMem ad al v)\"\n hence \"ReadMem ad al v \\ set (convert_RA ln :: ('b, 'c) obs_event list)\"\n by(auto simp add: in_set_conv_nth)\n hence False by(auto simp add: convert_RA_def)\n thus \"\\b. mrw_values P vs (list_of (ltake (enat i) (llist_of ((map NormalAction \\ convert_RA) ln)))) (ad, al) = \\(v, b)\\\" ..\nqed\n\nlemma ta_hb_consistent_convert_RA:\n \"ta_hb_consistent P E (llist_of (map (Pair t) ((map NormalAction \\ convert_RA) ln)))\"\nby(rule ta_hb_consistent_not_ReadI)(auto simp add: convert_RA_def)\n\nlocale allocated_multithreaded =\n allocated_heap\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n allocated\n P \n + \n mthr!: multithreaded final r convert_RA\n\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and allocated :: \"'heap \\ 'addr set\"\n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and P :: \"'md prog\"\n +\n assumes red_allocated_mono: \"t \\ (x, m) -ta\\ (x', m') \\ allocated m \\ allocated m'\"\n and red_New_allocatedD:\n \"\\ t \\ (x, m) -ta\\ (x', m'); NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub> \\\n \\ ad \\ allocated m' \\ ad \\ allocated m\"\n and red_allocated_NewD:\n \"\\ t \\ (x, m) -ta\\ (x', m'); ad \\ allocated m'; ad \\ allocated m \\\n \\ \\CTn. NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n and red_New_same_addr_same:\n \"\\ t \\ (x, m) -ta\\ (x', m'); \n \\ta\\\\<^bsub>o\\<^esub> ! i = NewHeapElem a CTn; i < length \\ta\\\\<^bsub>o\\<^esub>;\n \\ta\\\\<^bsub>o\\<^esub> ! j = NewHeapElem a CTn'; j < length \\ta\\\\<^bsub>o\\<^esub> \\\n \\ i = j\"\n\n\nsublocale allocated_multithreaded < heap_multithreaded\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n final r convert_RA P\nby(unfold_locales)\n\ncontext allocated_multithreaded begin\n\nlemma redT_allocated_mono:\n assumes \"mthr.redT \\ (t, ta) \\'\"\n shows \"allocated (shr \\) \\ allocated (shr \\')\"\nusing assms\nby cases(auto dest: red_allocated_mono del: subsetI)\n\nlemma RedT_allocated_mono:\n assumes \"mthr.RedT \\ ttas \\'\"\n shows \"allocated (shr \\) \\ allocated (shr \\')\"\nusing assms unfolding mthr.RedT_def\nby induct(auto dest!: redT_allocated_mono intro: subset_trans del: subsetI)\n\nlemma init_fin_allocated_mono:\n \"t \\ (x, m) -ta\\i (x', m') \\ allocated m \\ allocated m'\"\nby(cases rule: mthr.init_fin.cases)(auto dest: red_allocated_mono)\n\nlemma init_fin_redT_allocated_mono:\n assumes \"mthr.if.redT \\ (t, ta) \\'\"\n shows \"allocated (shr \\) \\ allocated (shr \\')\"\nusing assms\nby cases(auto dest: init_fin_allocated_mono del: subsetI)\n\nlemma init_fin_RedT_allocated_mono:\n assumes \"mthr.if.RedT \\ ttas \\'\"\n shows \"allocated (shr \\) \\ allocated (shr \\')\"\nusing assms unfolding mthr.if.RedT_def\nby induct(auto dest!: init_fin_redT_allocated_mono intro: subset_trans del: subsetI)\n\nlemma init_fin_red_New_allocatedD:\n assumes \"t \\ (x, m) -ta\\i (x', m')\" \"NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"ad \\ allocated m' \\ ad \\ allocated m\"\nusing assms\nby cases(auto dest: red_New_allocatedD)\n\nlemma init_fin_red_allocated_NewD:\n assumes \"t \\ (x, m) -ta\\i (x', m')\" \"ad \\ allocated m'\" \"ad \\ allocated m\"\n shows \"\\CTn. NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\nusing assms\nby(cases)(auto dest!: red_allocated_NewD)\n\nlemma init_fin_red_New_same_addr_same:\n assumes \"t \\ (x, m) -ta\\i (x', m')\"\n and \"\\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (NewHeapElem a CTn)\" \"i < length \\ta\\\\<^bsub>o\\<^esub>\"\n and \"\\ta\\\\<^bsub>o\\<^esub> ! j = NormalAction (NewHeapElem a CTn')\" \"j < length \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"i = j\"\nusing assms\nby cases(auto dest: red_New_same_addr_same)\n\nlemma init_fin_redT_allocated_NewHeapElemD:\n assumes \"mthr.if.redT s (t, ta) s'\"\n and \"ad \\ allocated (shr s')\"\n and \"ad \\ allocated (shr s)\"\n shows \"\\CTn. NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\nusing assms\nby(cases)(auto dest: init_fin_red_allocated_NewD)\n\nlemma init_fin_RedT_allocated_NewHeapElemD:\n assumes \"mthr.if.RedT s ttas s'\"\n and \"ad \\ allocated (shr s')\"\n and \"ad \\ allocated (shr s)\"\n shows \"\\t ta CTn. (t, ta) \\ set ttas \\ NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\nusing assms\nproof(induct rule: mthr.if.RedT_induct')\n case refl thus ?case by simp\nnext\n case (step ttas s' t ta s'') thus ?case\n by(cases \"ad \\ allocated (shr s')\")(fastforce simp del: split_paired_Ex dest: init_fin_redT_allocated_NewHeapElemD)+\nqed\n\nlemma \\_new_actions_for_unique:\n assumes E: \"E \\ \\_start f P C M vs status\"\n and a: \"a \\ new_actions_for P E adal\"\n and a': \"a' \\ new_actions_for P E adal\"\n shows \"a = a'\"\nusing a a'\nproof(induct a a' rule: wlog_linorder_le)\n case symmetry thus ?case by simp\nnext\n case (le a a')\n note a = `a \\ new_actions_for P E adal`\n and a' = `a' \\ new_actions_for P E adal`\n and a_a' = `a \\ a'`\n obtain ad al where adal: \"adal = (ad, al)\" by(cases adal)\n \n let ?init_obs = \"lift_start_obs start_tid start_heap_obs\"\n let ?start_state = \"init_fin_lift_state status (start_state f P C M vs)\"\n\n have distinct: \"distinct (filter (\\obs. \\a CTn. obs = NormalAction (NewHeapElem a CTn)) (map snd ?init_obs))\"\n unfolding start_heap_obs_def\n by(fastforce intro: inj_onI intro!: distinct_filter simp add: distinct_map distinct_zipI1 distinct_initialization_list)\n\n from start_addrs_allocated\n have dom_start_state: \"{a. \\CTn. NormalAction (NewHeapElem a CTn) \\ snd ` set ?init_obs} \\ allocated (shr ?start_state)\"\n by(fastforce simp add: init_fin_lift_state_conv_simps shr_start_state dest: NewHeapElem_start_heap_obs_start_addrsD subsetD)\n \n show ?case\n proof(cases \"a' < length ?init_obs\")\n case True\n with a' adal E obtain t_a' CTn_a'\n where CTn_a': \"?init_obs ! a' = (t_a', NormalAction (NewHeapElem ad CTn_a'))\"\n by(cases \"?init_obs ! a'\")(fastforce elim!: is_new_action.cases action_loc_aux_cases simp add: action_obs_def lnth_lappend1 new_actions_for_def )+\n from True a_a' have len_a: \"a < length ?init_obs\" by simp\n with a adal E obtain t_a CTn_a\n where CTn_a: \"?init_obs ! a = (t_a, NormalAction (NewHeapElem ad CTn_a))\"\n by(cases \"?init_obs ! a\")(fastforce elim!: is_new_action.cases action_loc_aux_cases simp add: action_obs_def lnth_lappend1 new_actions_for_def )+\n from CTn_a CTn_a' True len_a\n have \"NormalAction (NewHeapElem ad CTn_a') \\ snd ` set ?init_obs\"\n and \"NormalAction (NewHeapElem ad CTn_a) \\ snd ` set ?init_obs\" unfolding set_conv_nth\n by(fastforce intro: rev_image_eqI)+\n hence [simp]: \"CTn_a' = CTn_a\" using distinct_start_addrs'\n by(auto simp add: in_set_conv_nth distinct_conv_nth start_heap_obs_def start_addrs_def) blast\n from distinct_filterD[OF distinct, of a' a \"NormalAction (NewHeapElem ad CTn_a)\"] len_a True CTn_a CTn_a'\n show \"a = a'\" by simp\n next\n case False\n obtain n where n: \"length ?init_obs = n\" by blast\n with False have \"n \\ a'\" by simp\n \n from E obtain E'' where E: \"E = lappend (llist_of ?init_obs) E''\"\n and E'': \"E'' \\ mthr.if.\\ ?start_state\" by auto\n from E'' obtain E' where E': \"E'' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \\Runs: \"mthr.if.mthr.Runs ?start_state E'\" by(rule mthr.if.\\.cases)\n \n from E E'' a' n `n \\ a'` adal have a': \"a' - n \\ new_actions_for P E'' adal\"\n by(auto simp add: new_actions_for_def lnth_lappend2 action_obs_def actions_lappend elim: actionsE)\n \n from a' have \"a' - n \\ actions E''\" by(auto elim: new_actionsE)\n hence \"enat (a' - n) < llength E''\" by(rule actionsE)\n with \\Runs obtain a'_m a'_n t_a' ta_a'\n where E_a': \"lnth E'' (a' - n) = (t_a', \\ta_a'\\\\<^bsub>o\\<^esub> ! a'_n)\"\n and a'_n: \"a'_n < length \\ta_a'\\\\<^bsub>o\\<^esub>\" and a'_m: \"enat a'_m < llength E'\"\n and a'_conv: \"a' - n = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + a'_n\"\n and E'_a'_m: \"lnth E' a'_m = (t_a', ta_a')\"\n unfolding E' by(rule mthr.if.actions_\\E_aux)\n \n from a' have \"is_new_action (action_obs E'' (a' - n))\"\n and \"(ad, al) \\ action_loc P E'' (a' - n)\"\n unfolding adal by(auto elim: new_actionsE)\n then obtain CTn'\n where \"action_obs E'' (a' - n) = NormalAction (NewHeapElem ad CTn')\"\n by cases(fastforce)+\n hence New_ta_a': \"\\ta_a'\\\\<^bsub>o\\<^esub> ! a'_n = NormalAction (NewHeapElem ad CTn')\"\n using E_a' a'_n unfolding action_obs_def by simp\n\n show ?thesis\n proof(cases \"a < n\")\n case True\n with a adal E n obtain t_a CTn_a where \"?init_obs ! a = (t_a, NormalAction (NewHeapElem ad CTn_a))\"\n by(cases \"?init_obs ! a\")(fastforce elim!: is_new_action.cases simp add: action_obs_def lnth_lappend1 new_actions_for_def)+\n\n with subsetD[OF dom_start_state, of ad] n True\n have a_shr_\\: \"ad \\ allocated (shr ?start_state)\"\n by(fastforce simp add: set_conv_nth intro: rev_image_eqI)\n \n have E'_unfold': \"E' = lappend (ltake (enat a'_m) E') (LCons (lnth E' a'_m) (ldropn (Suc a'_m) E'))\"\n unfolding ldropn_Suc_conv_ldropn[OF a'_m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend (ltake (enat a'_m) E') (LCons (lnth E' a'_m) (ldropn (Suc a'_m) E')))\"\n using \\Runs by simp\n\n then obtain \\'\n where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of (ltake (enat a'_m) E')) \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' a'_m) (ldropn (Suc a'_m) E'))\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\''\n where red_a': \"mthr.if.redT \\' (t_a', ta_a') \\''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\'' (ldropn (Suc a'_m) E')\"\n unfolding E'_a'_m by cases\n from New_ta_a' a'_n have \"NormalAction (NewHeapElem ad CTn') \\ set \\ta_a'\\\\<^bsub>o\\<^esub>\"\n unfolding in_set_conv_nth by blast\n with red_a' obtain x_a' x'_a' m'_a' \n where red'_a': \"mthr.init_fin t_a' (x_a', shr \\') ta_a' (x'_a', m'_a')\"\n and \\''': \"redT_upd \\' t_a' ta_a' x'_a' m'_a' \\''\"\n and ts_t_a': \"thr \\' t_a' = \\(x_a', no_wait_locks)\\\"\n by cases auto\n from red'_a' `NormalAction (NewHeapElem ad CTn') \\ set \\ta_a'\\\\<^bsub>o\\<^esub>`\n obtain ta'_a' X_a' X'_a'\n where x_a': \"x_a' = (Running, X_a')\"\n and x'_a': \"x'_a' = (Running, X'_a')\"\n and ta_a': \"ta_a' = convert_TA_initial (convert_obs_initial ta'_a')\"\n and red''_a': \"t_a' \\ \\X_a', shr \\'\\ -ta'_a'\\ \\X'_a', m'_a'\\\"\n by cases fastforce+\n \n from ta_a' New_ta_a' a'_n have New_ta'_a': \"\\ta'_a'\\\\<^bsub>o\\<^esub> ! a'_n = NewHeapElem ad CTn'\"\n and a'_n': \"a'_n < length \\ta'_a'\\\\<^bsub>o\\<^esub>\" by auto\n hence \"NewHeapElem ad CTn' \\ set \\ta'_a'\\\\<^bsub>o\\<^esub>\" unfolding in_set_conv_nth by blast\n with red''_a' have allocated_ad': \"ad \\ allocated (shr \\')\"\n by(auto dest: red_New_allocatedD)\n \n have \"allocated (shr ?start_state) \\ allocated (shr \\')\"\n using \\_\\' unfolding mthr.if.RedT_def[symmetric] by(rule init_fin_RedT_allocated_mono)\n hence False using allocated_ad' a_shr_\\ by blast\n thus ?thesis ..\n next\n case False\n hence \"n \\ a\" by simp\n\n from E E'' a n `n \\ a` adal have a: \"a - n \\ new_actions_for P E'' adal\"\n by(auto simp add: new_actions_for_def lnth_lappend2 action_obs_def actions_lappend elim: actionsE)\n\n from a have \"a - n \\ actions E''\" by(auto elim: new_actionsE)\n hence \"enat (a - n) < llength E''\" by(rule actionsE)\n\n with \\Runs obtain a_m a_n t_a ta_a \n where E_a: \"lnth E'' (a - n) = (t_a, \\ta_a\\\\<^bsub>o\\<^esub> ! a_n)\"\n and a_n: \"a_n < length \\ta_a\\\\<^bsub>o\\<^esub>\" and a_m: \"enat a_m < llength E'\"\n and a_conv: \"a - n = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + a_n\"\n and E'_a_m: \"lnth E' a_m = (t_a, ta_a)\"\n unfolding E' by(rule mthr.if.actions_\\E_aux)\n \n from a have \"is_new_action (action_obs E'' (a - n))\" \n and \"(ad, al) \\ action_loc P E'' (a - n)\" \n unfolding adal by(auto elim: new_actionsE)\n then obtain CTn where \"action_obs E'' (a - n) = NormalAction (NewHeapElem ad CTn)\"\n by cases(fastforce)+\n hence New_ta_a: \" \\ta_a\\\\<^bsub>o\\<^esub> ! a_n = NormalAction (NewHeapElem ad CTn)\"\n using E_a a_n unfolding action_obs_def by simp\n \n let ?E' = \"ldropn (Suc a_m) E'\"\n \n have E'_unfold: \"E' = lappend (ltake (enat a_m) E') (LCons (lnth E' a_m) ?E')\"\n unfolding ldropn_Suc_conv_ldropn[OF a_m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend (ltake (enat a_m) E') (LCons (lnth E' a_m) ?E'))\"\n using \\Runs by simp\n then obtain \\' where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of (ltake (enat a_m) E')) \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' a_m) ?E')\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\''\n where red_a: \"mthr.if.redT \\' (t_a, ta_a) \\''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\'' ?E'\"\n unfolding E'_a_m by cases\n from New_ta_a a_n have \"NormalAction (NewHeapElem ad CTn) \\ set \\ta_a\\\\<^bsub>o\\<^esub>\"\n unfolding in_set_conv_nth by blast\n with red_a obtain x_a x'_a m'_a \n where red'_a: \"mthr.init_fin t_a (x_a, shr \\') ta_a (x'_a, m'_a)\"\n and \\''': \"redT_upd \\' t_a ta_a x'_a m'_a \\''\"\n and ts_t_a: \"thr \\' t_a = \\(x_a, no_wait_locks)\\\"\n by cases auto\n from red'_a `NormalAction (NewHeapElem ad CTn) \\ set \\ta_a\\\\<^bsub>o\\<^esub>`\n obtain ta'_a X_a X'_a\n where x_a: \"x_a = (Running, X_a)\"\n and x'_a: \"x'_a = (Running, X'_a)\"\n and ta_a: \"ta_a = convert_TA_initial (convert_obs_initial ta'_a)\"\n and red''_a: \"t_a \\ (X_a, shr \\') -ta'_a\\ (X'_a, m'_a)\"\n by cases fastforce+\n from ta_a New_ta_a a_n have New_ta'_a: \"\\ta'_a\\\\<^bsub>o\\<^esub> ! a_n = NewHeapElem ad CTn\"\n and a_n': \"a_n < length \\ta'_a\\\\<^bsub>o\\<^esub>\" by auto\n hence \"NewHeapElem ad CTn \\ set \\ta'_a\\\\<^bsub>o\\<^esub>\" unfolding in_set_conv_nth by blast\n with red''_a have allocated_m'_a_ad: \"ad \\ allocated m'_a\"\n by(auto dest: red_New_allocatedD)\n \n have \"a_m \\ a'_m\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n hence \"a'_m < a_m\" by simp\n hence \"(\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + (\\i = a'_m..snd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n by(simp add: setsum_upto_add_nat)\n hence \"a' - n < a - n\" using `a'_m < a_m` a'_n E'_a'_m unfolding a_conv a'_conv\n by(subst (asm) setsum_head_upt_Suc) simp_all\n with a_a' show False by simp\n qed\n \n have a'_less: \"a' - n < (a - n) - a_n + length \\ta_a\\\\<^bsub>o\\<^esub>\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n hence a'_greater: \"(a - n) - a_n + length \\ta_a\\\\<^bsub>o\\<^esub> \\ a' - n\" by simp\n \n have \"a_m < a'_m\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n with `a_m \\ a'_m` have \"a_m = a'_m\" by simp\n with a'_greater a_n a'_n E'_a'_m E'_a_m show False\n unfolding a_conv a'_conv by simp\n qed\n hence a'_m_a_m: \"enat (a'_m - Suc a_m) < llength ?E'\" using a'_m\n by(cases \"llength E'\") simp_all\n from `a_m < a'_m` a'_m E'_a'_m\n have E'_a'_m': \"lnth ?E' (a'_m - Suc a_m) = (t_a', ta_a')\" by simp\n \n have E'_unfold': \"?E' = lappend (ltake (enat (a'_m - Suc a_m)) ?E') (LCons (lnth ?E' (a'_m - Suc a_m)) (ldropn (Suc (a'_m - Suc a_m)) ?E'))\"\n unfolding ldropn_Suc_conv_ldropn[OF a'_m_a_m] lappend_ltake_enat_ldropn ..\n hence \"mthr.if.mthr.Runs \\'' (lappend (ltake (enat (a'_m - Suc a_m)) ?E') (LCons (lnth ?E' (a'_m - Suc a_m)) (ldropn (Suc (a'_m - Suc a_m)) ?E')))\"\n using \\Runs'' by simp\n then obtain \\'''\n where \\''_\\''': \"mthr.if.mthr.Trsys \\'' (list_of (ltake (enat (a'_m - Suc a_m)) ?E')) \\'''\"\n and \\Runs''': \"mthr.if.mthr.Runs \\''' (LCons (lnth ?E' (a'_m - Suc a_m)) (ldropn (Suc (a'_m - Suc a_m)) ?E'))\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs''' obtain \\''''\n where red_a': \"mthr.if.redT \\''' (t_a', ta_a') \\''''\"\n and \\Runs'''': \"mthr.if.mthr.Runs \\'''' (ldropn (Suc (a'_m - Suc a_m)) ?E')\"\n unfolding E'_a'_m' by cases\n from New_ta_a' a'_n have \"NormalAction (NewHeapElem ad CTn') \\ set \\ta_a'\\\\<^bsub>o\\<^esub>\"\n unfolding in_set_conv_nth by blast\n with red_a' obtain x_a' x'_a' m'_a' \n where red'_a': \"mthr.init_fin t_a' (x_a', shr \\''') ta_a' (x'_a', m'_a')\"\n and \\'''''': \"redT_upd \\''' t_a' ta_a' x'_a' m'_a' \\''''\"\n and ts_t_a': \"thr \\''' t_a' = \\(x_a', no_wait_locks)\\\"\n by cases auto\n from red'_a' `NormalAction (NewHeapElem ad CTn') \\ set \\ta_a'\\\\<^bsub>o\\<^esub>`\n obtain ta'_a' X_a' X'_a' \n where x_a': \"x_a' = (Running, X_a')\"\n and x'_a': \"x'_a' = (Running, X'_a')\"\n and ta_a': \"ta_a' = convert_TA_initial (convert_obs_initial ta'_a')\"\n and red''_a': \"t_a' \\ (X_a', shr \\''') -ta'_a'\\ (X'_a', m'_a')\"\n by cases fastforce+\n from ta_a' New_ta_a' a'_n have New_ta'_a': \"\\ta'_a'\\\\<^bsub>o\\<^esub> ! a'_n = NewHeapElem ad CTn'\"\n and a'_n': \"a'_n < length \\ta'_a'\\\\<^bsub>o\\<^esub>\" by auto\n hence \"NewHeapElem ad CTn' \\ set \\ta'_a'\\\\<^bsub>o\\<^esub>\" unfolding in_set_conv_nth by blast\n with red''_a' have allocated_ad': \"ad \\ allocated (shr \\''')\"\n by(auto dest: red_New_allocatedD)\n \n have \"allocated m'_a = allocated (shr \\'')\" using \\''' by auto\n also have \"\\ \\ allocated (shr \\''')\"\n using \\''_\\''' unfolding mthr.if.RedT_def[symmetric] by(rule init_fin_RedT_allocated_mono)\n finally have \"ad \\ allocated (shr \\''')\" using allocated_m'_a_ad by blast\n with allocated_ad' show False by contradiction\n qed\n \n from `a_m \\ a'_m` have [simp]: \"a_m = a'_m\"\n proof(rule le_antisym)\n show \"a'_m \\ a_m\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n hence \"a_m < a'_m\" by simp\n hence \"(\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + (\\i = a_m..snd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n by(simp add: setsum_upto_add_nat)\n with a'_less `a_m < a'_m` E'_a_m a_n a'_n show False\n unfolding a'_conv a_conv by(subst (asm) setsum_head_upt_Suc) simp_all\n qed\n qed\n with E'_a_m E'_a'_m have [simp]: \"t_a' = t_a\" \"ta_a' = ta_a\" by simp_all\n from New_ta_a' a'_n ta_a have a'_n': \"a'_n < length \\ta'_a\\\\<^bsub>o\\<^esub>\"\n and New_ta'_a': \"\\ta'_a\\\\<^bsub>o\\<^esub> ! a'_n = NewHeapElem ad CTn'\" by auto\n with red''_a New_ta'_a a_n' have \"a'_n = a_n\"\n by(auto dest: red_New_same_addr_same)\n with `a_m = a'_m` have \"a - n = a' - n\" unfolding a_conv a'_conv by simp\n thus ?thesis using `n \\ a` `n \\ a'` by simp\n qed\n qed\nqed\n\nend\n\n\ntext {* Knowledge of addresses of a multithreaded state *}\n\nfun ka_Val :: \"'addr val \\ 'addr set\"\nwhere\n \"ka_Val (Addr a) = {a}\"\n| \"ka_Val _ = {}\"\n\nfun new_obs_addr :: \"('addr, 'thread_id) obs_event \\ 'addr set\"\nwhere\n \"new_obs_addr (ReadMem ad al (Addr ad')) = {ad'}\"\n| \"new_obs_addr (NewHeapElem ad hT) = {ad}\"\n| \"new_obs_addr _ = {}\"\n\nlemma new_obs_addr_cases[consumes 1, case_names ReadMem NewHeapElem, cases set]:\n assumes \"ad \\ new_obs_addr ob\"\n obtains ad' al where \"ob = ReadMem ad' al (Addr ad)\"\n | CTn where \"ob = NewHeapElem ad CTn\"\nusing assms\nby(cases ob rule: new_obs_addr.cases) auto\n\ndefinition new_obs_addrs :: \"('addr, 'thread_id) obs_event list \\ 'addr set\"\nwhere\n \"new_obs_addrs obs = \\(new_obs_addr ` set obs)\"\n\nfun new_obs_addr_if :: \"('addr, 'thread_id) obs_event action \\ 'addr set\"\nwhere\n \"new_obs_addr_if (NormalAction a) = new_obs_addr a\"\n| \"new_obs_addr_if _ = {}\"\n\ndefinition new_obs_addrs_if :: \"('addr, 'thread_id) obs_event action list \\ 'addr set\"\nwhere \n \"new_obs_addrs_if obs = \\(new_obs_addr_if ` set obs)\"\n\nlemma ka_Val_subset_new_obs_Addr_ReadMem:\n \"ka_Val v \\ new_obs_addr (ReadMem ad al v)\"\nby(cases v) simp_all\n\nlemma typeof_ka: \"typeof v \\ None \\ ka_Val v = {}\"\nby(cases v) simp_all\n\nlemma ka_Val_undefined_value [simp]:\n \"ka_Val undefined_value = {}\"\napply(cases \"undefined_value :: 'a val\")\napply(bestsimp simp add: undefined_value_not_Addr dest: subst)+\ndone\n\nlocale known_addrs_base =\n fixes known_addrs :: \"'t \\ 'x \\ 'addr set\"\nbegin\n\ndefinition known_addrs_thr :: \"('l, 't, 'x) thread_info \\ 'addr set\"\nwhere \"known_addrs_thr ts = (\\t \\ dom ts. known_addrs t (fst (the (ts t))))\"\n\ndefinition known_addrs_state :: \"('l,'t,'x,'m,'w) state \\ 'addr set\"\nwhere \"known_addrs_state s = known_addrs_thr (thr s)\"\n\nlemma known_addrs_state_simps [simp]:\n \"known_addrs_state (ls, (ts, m), ws) = known_addrs_thr ts\"\nby(simp add: known_addrs_state_def)\n\nlemma known_addrs_thr_cases[consumes 1, case_names known_addrs, cases set: known_addrs_thr]:\n assumes \"ad \\ known_addrs_thr ts\"\n obtains t x ln where \"ts t = \\(x, ln)\\\" \"ad \\ known_addrs t x\"\nusing assms\nby(auto simp add: known_addrs_thr_def ran_def)\n\nlemma known_addrs_stateI:\n \"\\ ad \\ known_addrs t x; thr s t = \\(x, ln)\\ \\ \\ ad \\ known_addrs_state s\"\nby(fastforce simp add: known_addrs_state_def known_addrs_thr_def intro: rev_bexI)\n\nfun known_addrs_if :: \"'t \\ status \\ 'x \\ 'addr set\"\nwhere \"known_addrs_if t (s, x) = known_addrs t x\"\n\nend\n\nlocale if_known_addrs_base = \n known_addrs_base known_addrs \n +\n multithreaded_base final r convert_RA\n for known_addrs :: \"'t \\ 'x \\ 'addr set\"\n and final :: \"'x \\ bool\"\n and r :: \"('addr, 't, 'x, 'heap, 'addr, 'obs) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80)\n and convert_RA :: \"'addr released_locks \\ 'obs list\"\n\nsublocale if_known_addrs_base < \"if\"!: known_addrs_base known_addrs_if .\n\nlocale known_addrs =\n allocated_multithreaded (* Check why all the heap operations are necessary in this locale! *)\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n allocated\n final r\n P \n +\n if_known_addrs_base known_addrs final r convert_RA\n\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and allocated :: \"'heap \\ 'addr set\"\n and known_addrs :: \"'thread_id \\ 'x \\ 'addr set\"\n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and P :: \"'md prog\"\n +\n assumes red_known_addrs_new:\n \"t \\ \\x, m\\ -ta\\ \\x', m'\\\n \\ known_addrs t x' \\ known_addrs t x \\ new_obs_addrs \\ta\\\\<^bsub>o\\<^esub>\"\n and red_known_addrs_new_thread:\n \"\\ t \\ \\x, m\\ -ta\\ \\x', m'\\; NewThread t' x'' m'' \\ set \\ta\\\\<^bsub>t\\<^esub> \\\n \\ known_addrs t' x'' \\ known_addrs t x\"\n and red_read_knows_addr:\n \"\\ t \\ \\x, m\\ -ta\\ \\x', m'\\; ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\\n \\ ad \\ known_addrs t x\"\n and red_write_knows_addr:\n \"\\ t \\ \\x, m\\ -ta\\ \\x', m'\\; \\ta\\\\<^bsub>o\\<^esub> ! n = WriteMem ad al (Addr ad'); n < length \\ta\\\\<^bsub>o\\<^esub> \\\n \\ ad' \\ known_addrs t x \\ ad' \\ new_obs_addrs (take n \\ta\\\\<^bsub>o\\<^esub>)\"\n -- \"second possibility necessary for @{term heap_clone}\"\nbegin\n\nnotation mthr.redT_syntax1 (\"_ -_\\_\\ _\" [50,0,0,50] 80)\n\nlemma if_red_known_addrs_new: \n assumes \"t \\ (x, m) -ta\\i (x', m')\"\n shows \"known_addrs_if t x' \\ known_addrs_if t x \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\"\nusing assms\nby cases(auto dest!: red_known_addrs_new simp add: new_obs_addrs_if_def new_obs_addrs_def)\n\nlemma if_red_known_addrs_new_thread:\n assumes \"t \\ (x, m) -ta\\i (x', m')\" \"NewThread t' x'' m'' \\ set \\ta\\\\<^bsub>t\\<^esub>\"\n shows \"known_addrs_if t' x'' \\ known_addrs_if t x\"\nusing assms\nby cases(fastforce dest: red_known_addrs_new_thread)+\n\nlemma if_red_read_knows_addr:\n assumes \"t \\ (x, m) -ta\\i (x', m')\" \"NormalAction (ReadMem ad al v) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"ad \\ known_addrs_if t x\"\nusing assms\nby cases(fastforce dest: red_read_knows_addr)+\n\nlemma if_red_write_knows_addr:\n assumes \"t \\ (x, m) -ta\\i (x', m')\"\n and \"\\ta\\\\<^bsub>o\\<^esub> ! n = NormalAction (WriteMem ad al (Addr ad'))\" \"n < length \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"ad' \\ known_addrs_if t x \\ ad' \\ new_obs_addrs_if (take n \\ta\\\\<^bsub>o\\<^esub>)\"\nusing assms\nby cases(auto dest: red_write_knows_addr simp add: new_obs_addrs_if_def new_obs_addrs_def take_map)\n\nlemma if_redT_known_addrs_new:\n assumes redT: \"mthr.if.redT s (t, ta) s'\"\n shows \"if.known_addrs_state s' \\ if.known_addrs_state s \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\"\nusing redT\nproof(cases)\n case redT_acquire thus ?thesis\n by(cases s)(fastforce simp add: if.known_addrs_thr_def split: split_if_asm intro: rev_bexI)\nnext\n case (redT_normal x x' m)\n note red = `t \\ (x, shr s) -ta\\i (x', m)`\n show ?thesis\n proof\n fix ad\n assume \"ad \\ if.known_addrs_state s'\"\n hence \"ad \\ if.known_addrs_thr (thr s')\" by(simp add: if.known_addrs_state_def)\n then obtain t' x'' ln'' where ts't': \"thr s' t' = \\(x'', ln'')\\\" \n and ad: \"ad \\ known_addrs_if t' x''\"\n by(rule if.known_addrs_thr_cases)\n show \"ad \\ if.known_addrs_state s \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\"\n proof(cases \"thr s t'\")\n case None\n with redT_normal `thr s' t' = \\(x'', ln'')\\`\n obtain m'' where \"NewThread t' x'' m'' \\ set \\ta\\\\<^bsub>t\\<^esub>\"\n by(fastforce dest: redT_updTs_new_thread split: split_if_asm)\n with red have \"known_addrs_if t' x'' \\ known_addrs_if t x\" by(rule if_red_known_addrs_new_thread)\n also have \"\\ \\ known_addrs_if t x \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\" by simp\n finally have \"ad \\ known_addrs_if t x \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\" using ad by blast\n thus ?thesis using `thr s t = \\(x, no_wait_locks)\\` by(blast intro: if.known_addrs_stateI)\n next\n case (Some xln)\n show ?thesis\n proof(cases \"t = t'\")\n case True\n with redT_normal ts't' if_red_known_addrs_new[OF red] ad\n have \"ad \\ known_addrs_if t x \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\" by auto\n thus ?thesis using `thr s t = \\(x, no_wait_locks)\\` by(blast intro: if.known_addrs_stateI)\n next\n case False\n with ts't' redT_normal ad Some show ?thesis\n by(fastforce dest: redT_updTs_Some[where ts=\"thr s\" and t=t'] intro: if.known_addrs_stateI)\n qed\n qed\n qed\nqed\n\nlemma if_redT_read_knows_addr:\n assumes redT: \"mthr.if.redT s (t, ta) s'\"\n and read: \"NormalAction (ReadMem ad al v) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"ad \\ if.known_addrs_state s\"\nusing redT\nproof(cases)\n case redT_acquire thus ?thesis using read by auto\nnext\n case (redT_normal x x' m')\n with if_red_read_knows_addr[OF `t \\ (x, shr s) -ta\\i (x', m')` read]\n show ?thesis\n by(auto simp add: if.known_addrs_state_def if.known_addrs_thr_def intro: bexI[where x=t])\nqed\n\nlemma init_fin_redT_known_addrs_subset:\n assumes \"mthr.if.redT s (t, ta) s'\"\n shows \"if.known_addrs_state s' \\ if.known_addrs_state s \\ known_addrs_if t (fst (the (thr s' t)))\"\nusing assms\napply(cases)\n apply(rule subsetI)\n apply(clarsimp simp add: if.known_addrs_thr_def split: split_if_asm)\n apply(rename_tac status x status' x' m' a ws' t'' status'' x'' ln'')\n apply(case_tac \"thr s t''\")\n apply(drule (2) redT_updTs_new_thread)\n apply clarsimp\n apply(drule (1) if_red_known_addrs_new_thread)\n apply simp\n apply(drule (1) subsetD)\n apply(rule_tac x=\"(status, x)\" in if.known_addrs_stateI)\n apply(simp)\n apply simp\n apply(frule_tac t=\"t''\" in redT_updTs_Some, assumption)\n apply clarsimp\n apply(rule_tac x=\"(status'', x'')\" in if.known_addrs_stateI)\n apply simp\n apply simp\napply(auto simp add: if.known_addrs_state_def if.known_addrs_thr_def split: split_if_asm)\ndone\n\nlemma w_values_no_write_unchanged:\n assumes no_write: \"\\w. \\ w \\ set obs; is_write_action w; adal \\ action_loc_aux P w \\ \\ False\"\n shows \"w_values P vs obs adal = vs adal\"\nusing assms\nproof(induct obs arbitrary: vs)\n case Nil show ?case by simp\nnext\n case (Cons ob obs)\n from Cons.prems[of ob]\n have \"w_value P vs ob adal = vs adal\"\n by(cases adal)(cases ob rule: w_value_cases, auto simp add: addr_locs_def split: htype.split_asm, blast+)\n moreover\n have \"w_values P (w_value P vs ob) obs adal = w_value P vs ob adal\"\n proof(rule Cons.hyps)\n fix w\n assume \"w \\ set obs\" \"is_write_action w\" \"adal \\ action_loc_aux P w\"\n with Cons.prems[of w] `w_value P vs ob adal = vs adal`\n show \"False\" by simp\n qed\n ultimately show ?case by simp\nqed\n\nlemma redT_non_speculative_known_addrs_allocated:\n assumes red: \"mthr.if.redT s (t, ta) s'\"\n and tasc: \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and ka: \"if.known_addrs_state s \\ allocated (shr s)\"\n and vs: \"w_addrs vs \\ allocated (shr s)\"\n shows \"if.known_addrs_state s' \\ allocated (shr s')\" (is \"?thesis1\")\n and \"w_addrs (w_values P vs \\ta\\\\<^bsub>o\\<^esub>) \\ allocated (shr s')\" (is \"?thesis2\")\nproof -\n have \"?thesis1 \\ ?thesis2\" using red\n proof(cases)\n case (redT_acquire x ln n)\n hence \"if.known_addrs_state s' = if.known_addrs_state s\"\n by(auto 4 4 simp add: if.known_addrs_state_def if.known_addrs_thr_def split: split_if_asm dest: bspec)\n also note ka \n also from redT_acquire have \"shr s = shr s'\" by simp\n finally have \"if.known_addrs_state s' \\ allocated (shr s')\" .\n moreover have \"w_values P vs \\ta\\\\<^bsub>o\\<^esub> = vs\" using redT_acquire\n by(fastforce intro!: w_values_no_write_unchanged del: equalityI dest: convert_RA_not_write)\n ultimately show ?thesis using vs by(simp add: `shr s = shr s'`)\n next\n case (redT_normal x x' m')\n note red = `t \\ (x, shr s) -ta\\i (x', m')`\n and tst = `thr s t = \\(x, no_wait_locks)\\`\n have allocated_subset: \"allocated (shr s) \\ allocated (shr s')\"\n using `mthr.if.redT s (t, ta) s'` by(rule init_fin_redT_allocated_mono)\n with vs have vs': \"w_addrs vs \\ allocated (shr s')\" by blast\n { fix obs obs'\n assume \"\\ta\\\\<^bsub>o\\<^esub> = obs @ obs'\"\n moreover with tasc have \"non_speculative P vs (llist_of obs)\"\n by(simp add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n ultimately have \"w_addrs (w_values P vs obs) \\ new_obs_addrs_if obs \\ allocated (shr s')\" \n (is \"?concl obs\")\n proof(induct obs arbitrary: obs' rule: rev_induct)\n case Nil thus ?case using vs' by(simp add: new_obs_addrs_if_def)\n next\n case (snoc ob obs)\n note ta = `\\ta\\\\<^bsub>o\\<^esub> = (obs @ [ob]) @ obs'`\n note tasc = `non_speculative P vs (llist_of (obs @ [ob]))`\n from snoc have IH: \"?concl obs\"\n by(simp add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n hence \"?concl (obs @ [ob])\"\n proof(cases \"ob\" rule: mrw_value_cases)\n case (1 ad' al v)\n note ob = `ob = NormalAction (WriteMem ad' al v)`\n with ta have Write: \"\\ta\\\\<^bsub>o\\<^esub> ! length obs = NormalAction (WriteMem ad' al v)\" by simp\n show ?thesis\n proof\n fix ad''\n assume \"ad'' \\ w_addrs (w_values P vs (obs @ [ob])) \\ new_obs_addrs_if (obs @ [ob])\"\n hence \"ad'' \\ w_addrs (w_values P vs obs) \\ new_obs_addrs_if obs \\ v = Addr ad''\"\n by(auto simp add: ob w_addrs_def ran_def new_obs_addrs_if_def split: split_if_asm)\n thus \"ad'' \\ allocated (shr s')\"\n proof\n assume \"ad'' \\ w_addrs (w_values P vs obs) \\ new_obs_addrs_if obs\"\n also note IH finally show ?thesis .\n next\n assume v: \"v = Addr ad''\"\n with Write have \"\\ta\\\\<^bsub>o\\<^esub> ! length obs = NormalAction (WriteMem ad' al (Addr ad''))\" by simp\n with red have \"ad'' \\ known_addrs_if t x \\ ad'' \\ new_obs_addrs_if (take (length obs) \\ta\\\\<^bsub>o\\<^esub>)\"\n by(rule if_red_write_knows_addr)(simp add: ta)\n thus ?thesis\n proof\n assume \"ad'' \\ known_addrs_if t x\"\n hence \"ad'' \\ if.known_addrs_state s\" using tst by(rule if.known_addrs_stateI)\n with ka allocated_subset show ?thesis by blast\n next\n assume \"ad'' \\ new_obs_addrs_if (take (length obs) \\ta\\\\<^bsub>o\\<^esub>)\"\n with ta have \"ad'' \\ new_obs_addrs_if obs\" by simp\n with IH show ?thesis by blast\n qed\n qed\n qed\n next\n case (2 ad hT)\n\n hence ob: \"ob = NormalAction (NewHeapElem ad hT)\" by simp\n hence \"w_addrs (w_values P vs (obs @ [ob])) \\ w_addrs (w_values P vs obs)\"\n by(cases hT)(auto simp add: w_addrs_def default_val_not_Addr Addr_not_default_val)\n moreover from ob ta have \"NormalAction (NewHeapElem ad hT) \\ set \\ta\\\\<^bsub>o\\<^esub>\" by simp\n from init_fin_red_New_allocatedD[OF red this] have \"ad \\ allocated m'\" ..\n with redT_normal have \"ad \\ allocated (shr s')\" by auto\n ultimately show ?thesis using IH ob by(auto simp add: new_obs_addrs_if_def)\n next\n case (4 ad al v)\n note ob = `ob = NormalAction (ReadMem ad al v)`\n { fix ad'\n assume v: \"v = Addr ad'\"\n with tasc ob have mrw: \"Addr ad' \\ w_values P vs obs (ad, al)\"\n by(auto simp add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend simp del: lappend_llist_of_llist_of)\n hence \"ad' \\ w_addrs (w_values P vs obs)\"\n by(auto simp add: w_addrs_def)\n with IH have \"ad' \\ allocated (shr s')\" by blast }\n with ob IH show ?thesis by(cases v)(simp_all add: new_obs_addrs_if_def)\n qed(simp_all add: new_obs_addrs_if_def)\n thus ?case by simp\n qed }\n note this[of \"\\ta\\\\<^bsub>o\\<^esub>\" \"[]\"]\n moreover have \"if.known_addrs_state s' \\ if.known_addrs_state s \\ new_obs_addrs_if \\ta\\\\<^bsub>o\\<^esub>\"\n using `mthr.if.redT s (t, ta) s'` by(rule if_redT_known_addrs_new)\n ultimately show ?thesis using ka allocated_subset by blast\n qed\n thus ?thesis1 ?thesis2 by simp_all\nqed\n\n\nlemma RedT_non_speculative_known_addrs_allocated:\n assumes red: \"mthr.if.RedT s ttas s'\"\n and tasc: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and ka: \"if.known_addrs_state s \\ allocated (shr s)\"\n and vs: \"w_addrs vs \\ allocated (shr s)\"\n shows \"if.known_addrs_state s' \\ allocated (shr s')\" (is \"?thesis1 s'\")\n and \"w_addrs (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) \\ allocated (shr s')\" (is \"?thesis2 s' ttas\")\nproof -\n from red tasc have \"?thesis1 s' \\ ?thesis2 s' ttas\"\n proof(induct rule: mthr.if.RedT_induct')\n case refl thus ?case using ka vs by simp\n next\n case (step ttas s' t ta s'')\n hence \"non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and \"?thesis1 s'\" \"?thesis2 s' ttas\"\n by(simp_all add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n from redT_non_speculative_known_addrs_allocated[OF `mthr.if.redT s' (t, ta) s''` this]\n show ?case by simp\n qed\n thus \"?thesis1 s'\" \"?thesis2 s' ttas\" by simp_all\nqed\n\nlemma read_ex_NewHeapElem [consumes 5, case_names start Red]:\n assumes RedT: \"mthr.if.RedT (init_fin_lift_state status (start_state f P C M vs)) ttas s\"\n and red: \"mthr.if.redT s (t, ta) s'\"\n and read: \"NormalAction (ReadMem ad al v) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n and sc: \"non_speculative P (\\_. {}) (llist_of (map snd (lift_start_obs start_tid start_heap_obs) @ concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and known: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n obtains (start) CTn where \"NewHeapElem ad CTn \\ set start_heap_obs\"\n | (Red) ttas' s'' t' ta' s''' ttas'' CTn\n where \"mthr.if.RedT (init_fin_lift_state status (start_state f P C M vs)) ttas' s''\"\n and \"mthr.if.redT s'' (t', ta') s'''\"\n and \"mthr.if.RedT s''' ttas'' s\"\n and \"ttas = ttas' @ (t', ta') # ttas''\"\n and \"NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>\"\nproof -\n let ?start_state = \"init_fin_lift_state status (start_state f P C M vs)\"\n let ?obs_prefix = \"lift_start_obs start_tid start_heap_obs\"\n let ?vs_start = \"w_values P (\\_. {}) (map snd ?obs_prefix)\"\n\n from sc have \"non_speculative P (w_values P (\\_. {}) (map snd (lift_start_obs start_tid start_heap_obs))) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n by(simp add: non_speculative_lappend lappend_llist_of_llist_of[symmetric] del: lappend_llist_of_llist_of)\n with RedT have \"if.known_addrs_state s \\ allocated (shr s)\"\n proof(rule RedT_non_speculative_known_addrs_allocated)\n show \"if.known_addrs_state ?start_state \\ allocated (shr ?start_state)\"\n using known\n by(auto simp add: if.known_addrs_state_def if.known_addrs_thr_def start_state_def init_fin_lift_state_def split_beta split: split_if_asm)\n \n have \"w_addrs ?vs_start \\ w_addrs (\\_. {})\" by(rule w_addrs_lift_start_heap_obs)\n thus \"w_addrs ?vs_start \\ allocated (shr ?start_state)\" by simp\n qed\n also from red read obtain x_ra x'_ra m'_ra \n where red'_ra: \"t \\ (x_ra, shr s) -ta\\i (x'_ra, m'_ra)\"\n and s': \"redT_upd s t ta x'_ra m'_ra s'\"\n and ts_t: \"thr s t = \\(x_ra, no_wait_locks)\\\"\n by cases auto\n from red'_ra read\n have \"ad \\ known_addrs_if t x_ra\" by(rule if_red_read_knows_addr)\n hence \"ad \\ if.known_addrs_state s\" using ts_t by(rule if.known_addrs_stateI)\n finally have \"ad \\ allocated (shr s)\" .\n\n show ?thesis\n proof(cases \"ad \\ allocated start_heap\")\n case True\n then obtain CTn where \"NewHeapElem ad CTn \\ set start_heap_obs\"\n unfolding start_addrs_allocated by(blast dest: start_addrs_NewHeapElem_start_heap_obsD)\n thus ?thesis by(rule start)\n next\n case False\n hence \"ad \\ allocated (shr ?start_state)\" by(simp add: start_state_def split_beta shr_init_fin_lift_state)\n with RedT `ad \\ allocated (shr s)` obtain t' ta' CTn\n where tta: \"(t', ta') \\ set ttas\"\n and new: \"NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>\"\n by(blast dest: init_fin_RedT_allocated_NewHeapElemD)\n from tta obtain ttas' ttas'' where ttas: \"ttas = ttas' @ (t', ta') # ttas''\" by(auto dest: split_list)\n with RedT obtain s'' s''' \n where \"mthr.if.RedT ?start_state ttas' s''\"\n and \"mthr.if.redT s'' (t', ta') s'''\"\n and \"mthr.if.RedT s''' ttas'' s\"\n unfolding mthr.if.RedT_def by(auto elim!: rtrancl3p_appendE dest!: converse_rtrancl3p_step)\n thus thesis using ttas new by(rule Red)\n qed\nqed\n\nend\n\nlocale known_addrs_typing =\n known_addrs\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n allocated known_addrs\n final r P\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and allocated :: \"'heap \\ 'addr set\"\n and known_addrs :: \"'thread_id \\ 'x \\ 'addr set\"\n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and wfx :: \"'thread_id \\ 'x \\ 'heap \\ bool\"\n and P :: \"'md prog\"\n +\n assumes wfs_non_speculative_invar:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m;\n vs_conf P m vs; non_speculative P vs (llist_of (map NormalAction \\ta\\\\<^bsub>o\\<^esub>)) \\\n \\ wfx t x' m'\"\n and wfs_non_speculative_spawn:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m;\n vs_conf P m vs; non_speculative P vs (llist_of (map NormalAction \\ta\\\\<^bsub>o\\<^esub>));\n NewThread t'' x'' m'' \\ set \\ta\\\\<^bsub>t\\<^esub> \\\n \\ wfx t'' x'' m''\"\n and wfs_non_speculative_other:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m;\n vs_conf P m vs; non_speculative P vs (llist_of (map NormalAction \\ta\\\\<^bsub>o\\<^esub>));\n wfx t'' x'' m \\\n \\ wfx t'' x'' m'\"\n and wfs_non_speculative_vs_conf:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m;\n vs_conf P m vs; non_speculative P vs (llist_of (take n (map NormalAction \\ta\\\\<^bsub>o\\<^esub>))) \\\n \\ vs_conf P m' (w_values P vs (take n (map NormalAction \\ta\\\\<^bsub>o\\<^esub>)))\"\n and red_read_typeable:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m; ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\ \n \\ \\T. P,m \\ ad@al : T\"\n and red_NewHeapElemD:\n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m; NewHeapElem ad hT \\ set \\ta\\\\<^bsub>o\\<^esub> \\\n \\ typeof_addr m' ad = \\hT\\\"\n and red_hext_incr: \n \"\\ t \\ (x, m) -ta\\ (x', m'); wfx t x m; \n vs_conf P m vs; non_speculative P vs (llist_of (map NormalAction \\ta\\\\<^bsub>o\\<^esub>)) \\\n \\ m \\ m'\"\nbegin\n\nlemma redT_wfs_non_speculative_invar:\n assumes redT: \"mthr.redT s (t, ta) s'\"\n and wfx: \"ts_ok wfx (thr s) (shr s)\"\n and vs: \"vs_conf P (shr s) vs\"\n and ns: \"non_speculative P vs (llist_of (map NormalAction \\ta\\\\<^bsub>o\\<^esub>))\"\n shows \"ts_ok wfx (thr s') (shr s')\"\nusing redT\nproof(cases)\n case (redT_normal x x' m')\n with vs wfx ns show ?thesis\n apply(clarsimp intro!: ts_okI split: split_if_asm)\n apply(erule wfs_non_speculative_invar, auto dest: ts_okD)\n apply(rename_tac t' x' ln ws')\n apply(case_tac \"thr s t'\")\n apply(frule (2) redT_updTs_new_thread, clarify)\n apply(frule (1) mthr.new_thread_memory)\n apply(auto intro: wfs_non_speculative_other wfs_non_speculative_spawn dest: ts_okD simp add: redT_updTs_Some)\n done\nnext\n case (redT_acquire x ln n)\n thus ?thesis using wfx by(auto intro!: ts_okI dest: ts_okD split: split_if_asm)\nqed\n\nlemma redT_wfs_non_speculative_vs_conf:\n assumes redT: \"mthr.redT s (t, ta) s'\"\n and wfx: \"ts_ok wfx (thr s) (shr s)\"\n and conf: \"vs_conf P (shr s) vs\"\n and ns: \"non_speculative P vs (llist_of (take n (map NormalAction \\ta\\\\<^bsub>o\\<^esub>)))\"\n shows \"vs_conf P (shr s') (w_values P vs (take n (map NormalAction \\ta\\\\<^bsub>o\\<^esub>)))\"\nusing redT\nproof(cases)\n case (redT_normal x x' m')\n thus ?thesis using ns conf wfx by(auto dest: wfs_non_speculative_vs_conf ts_okD)\nnext\n case (redT_acquire x ln l)\n have \"w_values P vs (take n (map NormalAction (convert_RA ln :: ('addr, 'thread_id) obs_event list))) = vs\"\n by(fastforce dest: in_set_takeD simp add: convert_RA_not_write intro!: w_values_no_write_unchanged del: equalityI)\n thus ?thesis using conf redT_acquire by(auto)\nqed\n\nlemma if_redT_non_speculative_invar:\n assumes red: \"mthr.if.redT s (t, ta) s'\"\n and ts_ok: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and sc: \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\" \n and vs: \"vs_conf P (shr s) vs\"\n shows \"ts_ok (init_fin_lift wfx) (thr s') (shr s')\"\nproof -\n let ?s = \"\\s. (locks s, (\\t. map_option (\\((status, x), ln). (x, ln)) (thr s t), shr s), wset s, interrupts s)\"\n \n from ts_ok have ts_ok': \"ts_ok wfx (thr (?s s)) (shr (?s s))\" by(auto intro!: ts_okI dest: ts_okD)\n from vs have vs': \"vs_conf P (shr (?s s)) vs\" by simp\n\n from red show ?thesis\n proof(cases)\n case (redT_normal x x' m)\n note tst = `thr s t = \\(x, no_wait_locks)\\`\n from `t \\ (x, shr s) -ta\\i (x', m)`\n show ?thesis \n proof(cases)\n case (NormalAction X TA X')\n from `ta = convert_TA_initial (convert_obs_initial TA)` `mthr.if.actions_ok s t ta`\n have \"mthr.actions_ok (?s s) t TA\"\n by(auto elim: rev_iffD1[OF _ thread_oks_ts_change] cond_action_oks_final_change)\n\n with tst NormalAction `redT_upd s t ta x' m s'` have \"mthr.redT (?s s) (t, TA) (?s s')\"\n using map_redT_updTs[of snd \"thr s\" \"\\ta\\\\<^bsub>t\\<^esub>\"]\n by(auto intro!: mthr.redT.intros simp add: split_def map_prod_def o_def fun_eq_iff)\n moreover note ts_ok' vs'\n moreover from `ta = convert_TA_initial (convert_obs_initial TA)` have \"\\ta\\\\<^bsub>o\\<^esub> = map NormalAction \\TA\\\\<^bsub>o\\<^esub>\" by(auto)\n with sc have \"non_speculative P vs (llist_of (map NormalAction \\TA\\\\<^bsub>o\\<^esub>))\" by simp\n ultimately have \"ts_ok wfx (thr (?s s')) (shr (?s s'))\"\n by(auto dest: redT_wfs_non_speculative_invar)\n thus ?thesis using `\\ta\\\\<^bsub>o\\<^esub> = map NormalAction \\TA\\\\<^bsub>o\\<^esub>` by(auto intro!: ts_okI dest: ts_okD)\n next\n case InitialThreadAction\n with redT_normal ts_ok' vs show ?thesis\n by(auto 4 3 intro!: ts_okI dest: ts_okD split: split_if_asm)\n next\n case ThreadFinishAction\n with redT_normal ts_ok' vs show ?thesis\n by(auto 4 3 intro!: ts_okI dest: ts_okD split: split_if_asm)\n qed\n next\n case (redT_acquire x ln l)\n thus ?thesis using vs ts_ok by(auto 4 3 intro!: ts_okI dest: ts_okD split: split_if_asm)\n qed\nqed\n\nlemma if_redT_non_speculative_vs_conf:\n assumes red: \"mthr.if.redT s (t, ta) s'\"\n and ts_ok: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and sc: \"non_speculative P vs (llist_of (take n \\ta\\\\<^bsub>o\\<^esub>))\"\n and vs: \"vs_conf P (shr s) vs\"\n shows \"vs_conf P (shr s') (w_values P vs (take n \\ta\\\\<^bsub>o\\<^esub>))\"\nproof -\n let ?s = \"\\s. (locks s, (\\t. map_option (\\((status, x), ln). (x, ln)) (thr s t), shr s), wset s, interrupts s)\"\n \n from ts_ok have ts_ok': \"ts_ok wfx (thr (?s s)) (shr (?s s))\" by(auto intro!: ts_okI dest: ts_okD)\n from vs have vs': \"vs_conf P (shr (?s s)) vs\" by simp\n\n from red show ?thesis\n proof(cases)\n case (redT_normal x x' m)\n note tst = `thr s t = \\(x, no_wait_locks)\\`\n from `t \\ (x, shr s) -ta\\i (x', m)`\n show ?thesis \n proof(cases)\n case (NormalAction X TA X')\n from `ta = convert_TA_initial (convert_obs_initial TA)` `mthr.if.actions_ok s t ta`\n have \"mthr.actions_ok (?s s) t TA\"\n by(auto elim: rev_iffD1[OF _ thread_oks_ts_change] cond_action_oks_final_change)\n\n with tst NormalAction `redT_upd s t ta x' m s'` have \"mthr.redT (?s s) (t, TA) (?s s')\"\n using map_redT_updTs[of snd \"thr s\" \"\\ta\\\\<^bsub>t\\<^esub>\"]\n by(auto intro!: mthr.redT.intros simp add: split_def map_prod_def o_def fun_eq_iff)\n moreover note ts_ok' vs'\n moreover from `ta = convert_TA_initial (convert_obs_initial TA)` have \"\\ta\\\\<^bsub>o\\<^esub> = map NormalAction \\TA\\\\<^bsub>o\\<^esub>\" by(auto)\n with sc have \"non_speculative P vs (llist_of (take n (map NormalAction \\TA\\\\<^bsub>o\\<^esub>)))\" by simp\n ultimately have \"vs_conf P (shr (?s s')) (w_values P vs (take n (map NormalAction \\TA\\\\<^bsub>o\\<^esub>)))\"\n by(auto dest: redT_wfs_non_speculative_vs_conf)\n thus ?thesis using `\\ta\\\\<^bsub>o\\<^esub> = map NormalAction \\TA\\\\<^bsub>o\\<^esub>` by(auto)\n next\n case InitialThreadAction\n with redT_normal vs show ?thesis by(auto simp add: take_Cons')\n next\n case ThreadFinishAction\n with redT_normal vs show ?thesis by(auto simp add: take_Cons')\n qed\n next\n case (redT_acquire x ln l)\n have \"w_values P vs (take n (map NormalAction (convert_RA ln :: ('addr, 'thread_id) obs_event list))) = vs\"\n by(fastforce simp add: convert_RA_not_write take_Cons' dest: in_set_takeD intro!: w_values_no_write_unchanged del: equalityI)\n thus ?thesis using vs redT_acquire by auto \n qed\nqed\n\nlemma if_RedT_non_speculative_invar:\n assumes red: \"mthr.if.RedT s ttas s'\"\n and tsok: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and sc: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and vs: \"vs_conf P (shr s) vs\"\n shows \"ts_ok (init_fin_lift wfx) (thr s') (shr s')\" (is ?thesis1)\n and \"vs_conf P (shr s') (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\" (is ?thesis2)\nusing red tsok sc vs unfolding mthr.if.RedT_def\nproof(induct arbitrary: vs rule: rtrancl3p_converse_induct')\n case refl\n case 1 thus ?case by -\n case 2 thus ?case by simp\nnext\n case (step s tta s' ttas)\n obtain t ta where tta: \"tta = (t, ta)\" by(cases tta)\n\n case 1\n hence sc1: \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and sc2: \"non_speculative P (w_values P vs \\ta\\\\<^bsub>o\\<^esub>) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n unfolding lconcat_llist_of[symmetric] lmap_llist_of[symmetric] llist.map_comp o_def llist_of.simps llist.map(2) lconcat_LCons tta\n by(simp_all add: non_speculative_lappend list_of_lconcat o_def)\n from if_redT_non_speculative_invar[OF step(2)[unfolded tta] _ sc1] if_redT_non_speculative_vs_conf[OF step(2)[unfolded tta], where vs = vs and n=\"length \\ta\\\\<^bsub>o\\<^esub>\"] 1 step.hyps(3)[of \"w_values P vs \\ta\\\\<^bsub>o\\<^esub>\"] sc2 sc1\n show ?case by simp\n\n case 2\n hence sc1: \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and sc2: \"non_speculative P (w_values P vs \\ta\\\\<^bsub>o\\<^esub>) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n unfolding lconcat_llist_of[symmetric] lmap_llist_of[symmetric] llist.map_comp o_def llist_of.simps llist.map(2) lconcat_LCons tta\n by(simp_all add: non_speculative_lappend list_of_lconcat o_def)\n from if_redT_non_speculative_invar[OF step(2)[unfolded tta] _ sc1] if_redT_non_speculative_vs_conf[OF step(2)[unfolded tta], where vs = vs and n=\"length \\ta\\\\<^bsub>o\\<^esub>\"] 2 step.hyps(4)[of \"w_values P vs \\ta\\\\<^bsub>o\\<^esub>\"] sc2 sc1\n show ?case by(simp add: tta o_def)\nqed\n\nlemma init_fin_hext_incr:\n assumes \"t \\ (x, m) -ta\\i (x', m')\"\n and \"init_fin_lift wfx t x m\"\n and \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and \"vs_conf P m vs\"\n shows \"m \\ m'\"\nusing assms\nby(cases)(auto intro: red_hext_incr)\n\nlemma init_fin_redT_hext_incr:\n assumes \"mthr.if.redT s (t, ta) s'\"\n and \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and \"non_speculative P vs (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n and \"vs_conf P (shr s) vs\"\n shows \"shr s \\ shr s'\"\nusing assms\nby(cases)(auto dest: init_fin_hext_incr ts_okD)\n\nlemma init_fin_RedT_hext_incr:\n assumes \"mthr.if.RedT s ttas s'\"\n and \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and sc: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and vs: \"vs_conf P (shr s) vs\"\n shows \"shr s \\ shr s'\"\nusing assms\nproof(induction rule: mthr.if.RedT_induct')\n case refl thus ?case by simp\nnext\n case (step ttas s' t ta s'')\n note ts_ok = `ts_ok (init_fin_lift wfx) (thr s) (shr s)`\n from `non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (ttas @ [(t, ta)]))))`\n have ns: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and ns': \"non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of \\ta\\\\<^bsub>o\\<^esub>)\"\n by(simp_all add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n from ts_ok ns have \"shr s \\ shr s'\" \n using `vs_conf P (shr s) vs` by(rule step.IH)\n also have \"ts_ok (init_fin_lift wfx) (thr s') (shr s')\"\n using `mthr.if.RedT s ttas s'` ts_ok ns `vs_conf P (shr s) vs`\n by(rule if_RedT_non_speculative_invar)\n with `mthr.if.redT s' (t, ta) s''` \n have \"\\ \\ shr s''\" using ns'\n proof(rule init_fin_redT_hext_incr)\n from `mthr.if.RedT s ttas s'` ts_ok ns `vs_conf P (shr s) vs`\n show \"vs_conf P (shr s') (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n by(rule if_RedT_non_speculative_invar)\n qed\n finally show ?case .\nqed\n\nlemma init_fin_red_read_typeable:\n assumes \"t \\ (x, m) -ta\\i (x', m')\"\n and \"init_fin_lift wfx t x m\" \"NormalAction (ReadMem ad al v) \\ set \\ta\\\\<^bsub>o\\<^esub>\"\n shows \"\\T. P,m \\ ad@al : T\"\nusing assms\nby cases(auto dest: red_read_typeable)\n\nlemma Ex_new_action_for:\n assumes wf: \"wf_syscls P\"\n and wfx_start: \"ts_ok wfx (thr (start_state f P C M vs)) start_heap\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n and E: \"E \\ \\_start f P C M vs status\"\n and read: \"ra \\ read_actions E\"\n and aloc: \"adal \\ action_loc P E ra\"\n and sc: \"non_speculative P (\\_. {}) (ltake (enat ra) (lmap snd E))\"\n shows \"\\wa. wa \\ new_actions_for P E adal \\ wa < ra\"\nproof -\n let ?obs_prefix = \"lift_start_obs start_tid start_heap_obs\"\n let ?start_state = \"init_fin_lift_state status (start_state f P C M vs)\"\n\n from start_state_vs_conf[OF wf]\n have vs_conf_start: \"vs_conf P start_heap (w_values P (\\_. {}) (map NormalAction start_heap_obs))\" \n by(simp add: lift_start_obs_def o_def)\n\n obtain ad al where adal: \"adal = (ad, al)\" by(cases adal)\n with read aloc obtain v where ra: \"action_obs E ra = NormalAction (ReadMem ad al v)\"\n and ra_len: \"enat ra < llength E\"\n by(cases \"lnth E ra\")(auto elim!: read_actions.cases actionsE)\n\n from E obtain E'' where E: \"E = lappend (llist_of ?obs_prefix) E''\"\n and E'': \"E'' \\ mthr.if.\\ ?start_state\" by(auto)\n from E'' obtain E' where E': \"E'' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \\Runs: \"mthr.if.mthr.Runs ?start_state E'\" by(rule mthr.if.\\.cases)\n\n have ra_len': \"length ?obs_prefix \\ ra\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n hence \"ra < length ?obs_prefix\" by simp\n moreover with ra ra_len E obtain ra' ad al v \n where \"start_heap_obs ! ra' = ReadMem ad al v\" \"ra' < length start_heap_obs\"\n by(cases ra)(auto simp add: lnth_LCons lnth_lappend1 action_obs_def lift_start_obs_def)\n ultimately have \"ReadMem ad al v \\ set start_heap_obs\" unfolding in_set_conv_nth by blast\n thus False by(simp add: start_heap_obs_not_Read)\n qed\n let ?n = \"length ?obs_prefix\"\n from ra ra_len ra_len' E have \"enat (ra - ?n) < llength E''\"\n and ra_obs: \"action_obs E'' (ra - ?n) = NormalAction (ReadMem ad al v)\"\n by(cases \"llength E''\", auto simp add: action_obs_def lnth_lappend2)\n \n from \\Runs `enat (ra - ?n) < llength E''` obtain ra_m ra_n t_ra ta_ra \n where E_ra: \"lnth E'' (ra - ?n) = (t_ra, \\ta_ra\\\\<^bsub>o\\<^esub> ! ra_n)\"\n and ra_n: \"ra_n < length \\ta_ra\\\\<^bsub>o\\<^esub>\" and ra_m: \"enat ra_m < llength E'\"\n and ra_conv: \"ra - ?n = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + ra_n\"\n and E'_ra_m: \"lnth E' ra_m = (t_ra, ta_ra)\"\n unfolding E' by(rule mthr.if.actions_\\E_aux)\n \n let ?E' = \"ldropn (Suc ra_m) E'\"\n \n have E'_unfold: \"E' = lappend (ltake (enat ra_m) E') (LCons (lnth E' ra_m) ?E')\"\n unfolding ldropn_Suc_conv_ldropn[OF ra_m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend (ltake (enat ra_m) E') (LCons (lnth E' ra_m) ?E'))\"\n using \\Runs by simp\n then obtain \\' where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of (ltake (enat ra_m) E')) \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' ra_m) ?E')\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\'' where red_ra: \"mthr.if.redT \\' (t_ra, ta_ra) \\''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\'' ?E'\"\n unfolding E'_ra_m by cases\n\n from E_ra ra_n ra_obs have \"NormalAction (ReadMem ad al v) \\ set \\ta_ra\\\\<^bsub>o\\<^esub>\"\n by(auto simp add: action_obs_def in_set_conv_nth)\n with red_ra obtain x_ra x'_ra m'_ra \n where red'_ra: \"mthr.init_fin t_ra (x_ra, shr \\') ta_ra (x'_ra, m'_ra)\"\n and \\'': \"redT_upd \\' t_ra ta_ra x'_ra m'_ra \\''\"\n and ts_t_a: \"thr \\' t_ra = \\(x_ra, no_wait_locks)\\\"\n by cases auto\n from red'_ra `NormalAction (ReadMem ad al v) \\ set \\ta_ra\\\\<^bsub>o\\<^esub>`\n obtain ta'_ra X_ra X'_ra\n where x_ra: \"x_ra = (Running, X_ra)\"\n and x'_ra: \"x'_ra = (Running, X'_ra)\"\n and ta_ra: \"ta_ra = convert_TA_initial (convert_obs_initial ta'_ra)\"\n and red''_ra: \"t_ra \\ (X_ra, shr \\') -ta'_ra\\ (X'_ra, m'_ra)\"\n by cases fastforce+\n\n from `NormalAction (ReadMem ad al v) \\ set \\ta_ra\\\\<^bsub>o\\<^esub>` ta_ra \n have \"ReadMem ad al v \\ set \\ta'_ra\\\\<^bsub>o\\<^esub>\" by auto\n\n from wfx_start have wfx_start: \"ts_ok (init_fin_lift wfx) (thr ?start_state) (shr ?start_state)\"\n by(simp add: start_state_def split_beta)\n\n from sc ra_len'\n have \"non_speculative P (w_values P (\\_. {}) (map snd ?obs_prefix))\n (lmap snd (ltake (enat (ra - ?n)) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E'))))\"\n unfolding E E' by(simp add: ltake_lappend2 lmap_lappend_distrib non_speculative_lappend)\n also note ra_conv also note plus_enat_simps(1)[symmetric]\n also have \"enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>))\"\n by(subst setsum_hom[symmetric])(simp_all add: zero_enat_def)\n also have \"\\ = (\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i))\"\n using ra_m by-(rule setsum.cong[OF refl], simp add: le_less_trans[where y=\"enat ra_m\"] split_beta)\n also note ltake_plus_conv_lappend also note lconcat_ltake[symmetric]\n also note lmap_lappend_distrib\n also note non_speculative_lappend\n finally have \"non_speculative P (w_values P (\\_. {}) (map snd ?obs_prefix)) (lmap snd (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (llist_of (list_of (ltake (enat ra_m) E'))))))\"\n by(simp add: split_def)\n hence sc': \"non_speculative P (w_values P (\\_. {}) (map snd ?obs_prefix)) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat ra_m) E')))))\"\n unfolding lmap_lconcat llist.map_comp o_def lconcat_llist_of[symmetric] lmap_llist_of[symmetric]\n by(simp add: split_beta o_def)\n\n from vs_conf_start have vs_conf_start: \"vs_conf P (shr ?start_state) (w_values P (\\_. {}) (map snd ?obs_prefix))\"\n by(simp add:init_fin_lift_state_conv_simps start_state_def split_beta lift_start_obs_def o_def)\n with \\_\\' wfx_start sc' have \"ts_ok (init_fin_lift wfx) (thr \\') (shr \\')\"\n unfolding mthr.if.RedT_def[symmetric] by(rule if_RedT_non_speculative_invar)\n with ts_t_a have \"wfx t_ra X_ra (shr \\')\" unfolding x_ra by(auto dest: ts_okD)\n\n with red''_ra `ReadMem ad al v \\ set \\ta'_ra\\\\<^bsub>o\\<^esub>`\n obtain T' where type_adal: \"P,shr \\' \\ ad@al : T'\" by(auto dest: red_read_typeable)\n\n from sc ra_len' have \"non_speculative P (\\_. {}) (llist_of (map snd ?obs_prefix))\"\n unfolding E by(simp add: ltake_lappend2 lmap_lappend_distrib non_speculative_lappend)\n with sc' have sc'': \"non_speculative P (\\_. {}) (llist_of (map snd (lift_start_obs start_tid start_heap_obs) @ concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat ra_m) E')))))\"\n by(simp add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n\n from \\_\\' red_ra `NormalAction (ReadMem ad al v) \\ set \\ta_ra\\\\<^bsub>o\\<^esub>` sc'' ka\n show \"\\wa. wa \\ new_actions_for P E adal \\ wa < ra\"\n unfolding mthr.if.RedT_def[symmetric]\n proof(cases rule: read_ex_NewHeapElem)\n case (start CTn)\n then obtain n where n: \"start_heap_obs ! n = NewHeapElem ad CTn\" \n and len: \"n < length start_heap_obs\"\n unfolding in_set_conv_nth by blast\n from len have \"Suc n \\ actions E\" unfolding E by(simp add: actions_def enat_less_enat_plusI)\n moreover\n from \\_\\' have hext: \"start_heap \\ shr \\'\" unfolding mthr.if.RedT_def[symmetric]\n using wfx_start sc' vs_conf_start\n by(auto dest!: init_fin_RedT_hext_incr simp add: start_state_def split_beta init_fin_lift_state_conv_simps)\n \n from start have \"typeof_addr start_heap ad = \\CTn\\\"\n by(auto dest: NewHeapElem_start_heap_obsD[OF wf])\n with hext have \"typeof_addr (shr \\') ad = \\CTn\\\" by(rule typeof_addr_hext_mono)\n with type_adal have \"adal \\ action_loc P E (Suc n)\" using n len unfolding E adal\n by cases(auto simp add: action_obs_def lnth_lappend1 lift_start_obs_def)\n moreover have \"is_new_action (action_obs E (Suc n))\" using n len unfolding E\n by(simp add: action_obs_def lnth_lappend1 lift_start_obs_def)\n ultimately have \"Suc n \\ new_actions_for P E adal\" by(rule new_actionsI)\n moreover have \"Suc n < ra\" using ra_len' len by(simp)\n ultimately show ?thesis by blast\n next\n case (Red ttas' s'' t' ta' s''' ttas'' CTn)\n \n from `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>`\n obtain obs obs' where obs: \"\\ta'\\\\<^bsub>o\\<^esub> = obs @ NormalAction (NewHeapElem ad CTn) # obs'\"\n by(auto dest: split_list)\n \n let ?wa = \"?n + length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs\"\n have \"enat (length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs) < enat (length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (ttas' @ [(t', ta')]))))\"\n using obs by simp\n also have \"\\ = llength (lconcat (lmap llist_of (lmap (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (llist_of (ttas' @ [(t', ta')])))))\"\n by(simp del: map_map map_append add: lconcat_llist_of)\n also have \"\\ \\ llength (lconcat (lmap (\\(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) (llist_of (ttas' @ (t', ta') # ttas''))))\"\n by(auto simp add: o_def split_def intro: lprefix_llist_ofI intro!: lprefix_lconcatI lprefix_llength_le)\n also note len_less = calculation\n have \"\\ \\ (\\i(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) E') i))\"\n unfolding `list_of (ltake (enat ra_m) E') = ttas' @ (t', ta') # ttas''`[symmetric]\n by(simp add: ltake_lmap[symmetric] lconcat_ltake del: ltake_lmap)\n also have \"\\ = enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)\" using ra_m\n by(subst setsum_hom[symmetric, where f=\"enat\"])(auto intro: setsum.cong simp add: zero_enat_def less_trans[where y=\"enat ra_m\"] split_beta)\n also have \"\\ \\ enat (ra - ?n)\" unfolding ra_conv by simp\n finally have wa_ra: \"?wa < ra\" by simp\n with ra_len have \"?wa \\ actions E\" by(cases \"llength E\")(simp_all add: actions_def)\n moreover\n from `mthr.if.redT s'' (t', ta') s'''` `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>`\n obtain x_wa x_wa' where ts''t': \"thr s'' t' = \\(x_wa, no_wait_locks)\\\"\n and red_wa: \"mthr.init_fin t' (x_wa, shr s'') ta' (x_wa', shr s''')\"\n by(cases) fastforce+\n\n from sc'\n have ns: \"non_speculative P (w_values P (\\_. {}) (map snd ?obs_prefix)) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')))\"\n and ns': \"non_speculative P (w_values P (w_values P (\\_. {}) (map snd ?obs_prefix)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) (llist_of \\ta'\\\\<^bsub>o\\<^esub>)\"\n and ns'': \"non_speculative P (w_values P (w_values P (w_values P (\\_. {}) (map snd ?obs_prefix)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) \\ta'\\\\<^bsub>o\\<^esub>) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'')))\"\n unfolding `list_of (ltake (enat ra_m) E') = ttas' @ (t', ta') # ttas''`\n by(simp_all add: lappend_llist_of_llist_of[symmetric] lmap_lappend_distrib non_speculative_lappend del: lappend_llist_of_llist_of)\n from `mthr.if.RedT ?start_state ttas' s''` wfx_start ns\n have ts_ok'': \"ts_ok (init_fin_lift wfx) (thr s'') (shr s'')\"\n using vs_conf_start by(rule if_RedT_non_speculative_invar)\n with ts''t' have wfxt': \"wfx t' (snd x_wa) (shr s'')\" by(cases x_wa)(auto dest: ts_okD)\n\n {\n have \"action_obs E ?wa = \n snd (lnth (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')) (length (concat (map (\\(t, y). \\y\\\\<^bsub>o\\<^esub>) ttas')) + length obs))\"\n unfolding E E' by(simp add: action_obs_def lnth_lappend2)\n also from `enat (length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs) < enat (ra - length (lift_start_obs start_tid start_heap_obs))` `enat (ra - ?n) < llength E''`\n have \"\\ = lnth (lconcat (lmap (\\(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) E')) (length (concat (map (\\(t, y). \\y\\\\<^bsub>o\\<^esub>) ttas')) + length obs)\"\n unfolding E'\n by(subst lnth_lmap[symmetric, where f=snd])(erule (1) less_trans, simp add: lmap_lconcat llist.map_comp split_def o_def)\n also from len_less\n have \"enat (length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs) < llength (lconcat (ltake (enat ra_m) (lmap (\\(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) E')))\"\n unfolding `list_of (ltake (enat ra_m) E') = ttas' @ (t', ta') # ttas''`[symmetric]\n by(simp add: ltake_lmap[symmetric] del: ltake_lmap)\n note lnth_lconcat_ltake[OF this, symmetric]\n also note ltake_lmap\n also have \"ltake (enat ra_m) E' = llist_of (list_of (ltake (enat ra_m) E'))\" by(simp)\n also note `list_of (ltake (enat ra_m) E') = ttas' @ (t', ta') # ttas''`\n also note lmap_llist_of also have \"(\\(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) = llist_of \\ (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>)\"\n by(simp add: o_def split_def)\n also note map_map[symmetric] also note lconcat_llist_of\n also note lnth_llist_of \n also have \"concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (ttas' @ (t', ta') # ttas'')) ! (length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs) = NormalAction (NewHeapElem ad CTn)\"\n by(simp add: nth_append obs)\n finally have \"action_obs E ?wa = NormalAction (NewHeapElem ad CTn)\" .\n }\n note wa_obs = this\n \n from `mthr.if.RedT ?start_state ttas' s''` wfx_start ns vs_conf_start\n have vs'': \"vs_conf P (shr s'') (w_values P (w_values P (\\_. {}) (map snd ?obs_prefix)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')))\"\n by(rule if_RedT_non_speculative_invar)\n from if_redT_non_speculative_vs_conf[OF `mthr.if.redT s'' (t', ta') s'''` ts_ok'' _ vs'', of \"length \\ta'\\\\<^bsub>o\\<^esub>\"] ns'\n have vs''': \"vs_conf P (shr s''') (w_values P (w_values P (w_values P (\\_. {}) (map snd ?obs_prefix)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) \\ta'\\\\<^bsub>o\\<^esub>)\"\n by simp\n \n from `mthr.if.redT s'' (t', ta') s'''` ts_ok'' ns' vs''\n have \"ts_ok (init_fin_lift wfx) (thr s''') (shr s''')\"\n by(rule if_redT_non_speculative_invar)\n with `mthr.if.RedT s''' ttas'' \\'`\n have hext: \"shr s''' \\ shr \\'\" using ns'' vs'''\n by(rule init_fin_RedT_hext_incr)\n\n from red_wa have \"typeof_addr (shr s''') ad = \\CTn\\\"\n using wfxt' `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>` by cases(auto dest: red_NewHeapElemD)\n with hext have \"typeof_addr (shr \\') ad = \\CTn\\\" by(rule typeof_addr_hext_mono)\n with type_adal have \"adal \\ action_loc P E ?wa\" using wa_obs unfolding E adal\n by cases (auto simp add: action_obs_def lnth_lappend1 lift_start_obs_def)\n moreover have \"is_new_action (action_obs E ?wa)\" using wa_obs by simp\n ultimately have \"?wa \\ new_actions_for P E adal\" by(rule new_actionsI)\n thus ?thesis using wa_ra by blast\n qed\nqed\n\nlemma executions_sc_hb:\n assumes \"wf_syscls P\"\n and \"ts_ok wfx (thr (start_state f P C M vs)) start_heap\"\n and \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n shows\n \"executions_sc_hb (\\_start f P C M vs status) P\"\n (is \"executions_sc_hb ?E P\")\nproof\n fix E a adal a'\n assume \"E \\ ?E\" \"a \\ new_actions_for P E adal\" \"a' \\ new_actions_for P E adal\"\n thus \"a = a'\" by(rule \\_new_actions_for_unique)\nnext\n fix E ra adal\n assume \"E \\ ?E\" \"ra \\ read_actions E\" \"adal \\ action_loc P E ra\" \n and \"non_speculative P (\\_. {}) (ltake (enat ra) (lmap snd E))\"\n with assms show \"\\wa. wa \\ new_actions_for P E adal \\ wa < ra\"\n by(rule Ex_new_action_for)\nqed\n\nlemma executions_aux:\n assumes wf: \"wf_syscls P\"\n and wfx_start: \"ts_ok wfx (thr (start_state f P C M vs)) start_heap\" (is \"ts_ok wfx (thr ?start_state) _\")\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n shows \"executions_aux (\\_start f P C M vs status) P\"\n (is \"executions_aux ?\\ P\")\nproof\n fix E a adal a'\n assume \"E \\ ?\\\" \"a \\ new_actions_for P E adal\" \"a' \\ new_actions_for P E adal\"\n thus \"a = a'\" by(rule \\_new_actions_for_unique)\nnext\n fix E ws r adal\n assume E: \"E \\ ?\\\"\n and wf_exec: \"P \\ (E, ws) \\\" \n and read: \"r \\ read_actions E\" \"adal \\ action_loc P E r\"\n and sc: \"\\a. \\a < r; a \\ read_actions E\\ \\ P,E \\ a \\mrw ws a\"\n\n interpret jmm!: executions_sc_hb ?\\ P\n using wf wfx_start ka by(rule executions_sc_hb)\n\n from E wf_exec sc\n have \"ta_seq_consist P empty (ltake (enat r) (lmap snd E))\"\n unfolding ltake_lmap by(rule jmm.ta_seq_consist_mrwI) simp\n hence \"non_speculative P (\\_. {}) (ltake (enat r) (lmap snd E))\"\n by(rule ta_seq_consist_into_non_speculative) simp\n with wf wfx_start ka E read\n have \"\\i. i \\ new_actions_for P E adal \\ i < r\"\n by(rule Ex_new_action_for)\n thus \"\\i new_actions_for P E adal\" by blast\nqed\n\nlemma drf:\n assumes cut_and_update:\n \"if.cut_and_update\n (init_fin_lift_state status (start_state f P C M vs))\n (mrw_values P empty (map snd (lift_start_obs start_tid start_heap_obs)))\"\n (is \"if.cut_and_update ?start_state (mrw_values _ _ (map _ ?start_heap_obs))\")\n and wf: \"wf_syscls P\"\n and wfx_start: \"ts_ok wfx (thr (start_state f P C M vs)) start_heap\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n shows \"drf (\\_start f P C M vs status) P\" (is \"drf ?\\ _\")\nproof -\n interpret jmm!: executions_sc_hb \"?\\\" P\n using wf wfx_start ka by(rule executions_sc_hb)\n\n let ?n = \"length ?start_heap_obs\"\n let ?\\' = \"lappend (llist_of ?start_heap_obs) ` mthr.if.\\ ?start_state\"\n\n show ?thesis \n proof\n fix E ws r\n assume E: \"E \\ ?\\'\"\n and wf: \"P \\ (E, ws) \\\"\n and mrw: \"\\a. \\ a < r; a \\ read_actions E \\ \\ P,E \\ a \\mrw ws a\"\n show \"\\E'\\?\\'. \\ws'. P \\ (E', ws') \\ \\ ltake (enat r) E = ltake (enat r) E' \\\n sequentially_consistent P (E', ws') \\\n action_tid E r = action_tid E' r \\ action_obs E r \\ action_obs E' r \\\n (r \\ actions E \\ r \\ actions E')\"\n proof(cases \"\\r'. r' \\ read_actions E \\ r \\ r'\")\n case False\n have \"sequentially_consistent P (E, ws)\"\n proof(rule sequentially_consistentI)\n fix a\n assume \"a \\ read_actions E\"\n with False have \"a < r\" by auto\n thus \"P,E \\ a \\mrw ws a\" using `a \\ read_actions E` by(rule mrw)\n qed\n moreover have \"action_obs E r \\ action_obs E r\" by(rule sim_action_refl)\n ultimately show ?thesis using wf E by blast\n next\n case True\n let ?P = \"\\r'. r' \\ read_actions E \\ r \\ r'\"\n let ?r = \"Least ?P\"\n from True obtain r' where r': \"?P r'\" by blast\n hence r: \"?P ?r\" by(rule LeastI)\n {\n fix a\n assume \"a < ?r\" \"a \\ read_actions E\"\n have \"P,E \\ a \\mrw ws a\"\n proof(cases \"a < r\")\n case True\n thus ?thesis using `a \\ read_actions E` by(rule mrw)\n next\n case False\n with `a \\ read_actions E` have \"?P a\" by simp\n hence \"?r \\ a\" by(rule Least_le)\n with `a < ?r` have False by simp\n thus ?thesis ..\n qed }\n note mrw' = this\n\n from E obtain E'' where E: \"E = lappend (llist_of ?start_heap_obs) E''\"\n and E'': \"E'' \\ mthr.if.\\ ?start_state\" by auto\n\n from E'' obtain E' where E': \"E'' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \\Runs: \"mthr.if.mthr.Runs ?start_state E'\"\n by(rule mthr.if.\\.cases)\n\n have r_len: \"length ?start_heap_obs \\ ?r\"\n proof(rule ccontr)\n assume \"\\ ?thesis\"\n hence \"?r < length ?start_heap_obs\" by simp\n moreover with r E obtain t ad al v where \"?start_heap_obs ! ?r = (t, NormalAction (ReadMem ad al v))\"\n by(cases \"?start_heap_obs ! ?r\")(fastforce elim!: read_actions.cases simp add: actions_def action_obs_def lnth_lappend1)\n ultimately have \"(t, NormalAction (ReadMem ad al v)) \\ set ?start_heap_obs\" unfolding in_set_conv_nth by blast\n thus False by(auto simp add: start_heap_obs_not_Read)\n qed\n let ?n = \"length ?start_heap_obs\"\n from r r_len E have r: \"?r - ?n \\ read_actions E''\"\n by(fastforce elim!: read_actions.cases simp add: actions_lappend action_obs_def lnth_lappend2 elim: actionsE intro: read_actions.intros)\n \n from r have \"?r - ?n \\ actions E''\" by(auto)\n hence \"enat (?r - ?n) < llength E''\" by(rule actionsE)\n with \\Runs obtain r_m r_n t_r ta_r \n where E_r: \"lnth E'' (?r - ?n) = (t_r, \\ta_r\\\\<^bsub>o\\<^esub> ! r_n)\"\n and r_n: \"r_n < length \\ta_r\\\\<^bsub>o\\<^esub>\" and r_m: \"enat r_m < llength E'\"\n and r_conv: \"?r - ?n = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + r_n\"\n and E'_r_m: \"lnth E' r_m = (t_r, ta_r)\"\n unfolding E' by(rule mthr.if.actions_\\E_aux)\n\n let ?E' = \"ldropn (Suc r_m) E'\"\n let ?r_m_E' = \"ltake (enat r_m) E'\"\n have E'_unfold: \"E' = lappend (ltake (enat r_m) E') (LCons (lnth E' r_m) ?E')\"\n unfolding ldropn_Suc_conv_ldropn[OF r_m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend ?r_m_E' (LCons (lnth E' r_m) ?E'))\"\n using \\Runs by simp\n then obtain \\' where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of ?r_m_E') \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' r_m) ?E')\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\''' where red_ra: \"mthr.if.redT \\' (t_r, ta_r) \\'''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\''' ?E'\"\n unfolding E'_r_m by cases\n\n let ?vs = \"mrw_values P empty (map snd ?start_heap_obs)\"\n { fix a\n assume \"enat a < enat ?r\"\n and \"a \\ read_actions E\"\n have \"a < r\"\n proof(rule ccontr)\n assume \"\\ a < r\"\n with `a \\ read_actions E` have \"?P a\" by simp\n hence \"?r \\ a\" by(rule Least_le)\n with `enat a < enat ?r` show False by simp\n qed\n hence \"P,E \\ a \\mrw ws a\" using `a \\ read_actions E` by(rule mrw) }\n with `E \\ ?\\'` wf have \"ta_seq_consist P empty (lmap snd (ltake (enat ?r) E))\"\n by(rule jmm.ta_seq_consist_mrwI)\n\n hence start_sc: \"ta_seq_consist P empty (llist_of (map snd ?start_heap_obs))\"\n and \"ta_seq_consist P ?vs (lmap snd (ltake (enat (?r - ?n)) E''))\"\n using `?n \\ ?r` unfolding E ltake_lappend lmap_lappend_distrib\n by(simp_all add: ta_seq_consist_lappend o_def)\n\n note this(2) also from r_m\n have r_m_sum_len_eq: \"(\\i(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E') i)) = enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)\"\n by(subst setsum_hom[symmetric, where f=enat])(auto simp add: zero_enat_def split_def less_trans[where y=\"enat r_m\"] intro: setsum.cong)\n hence \"ltake (enat (?r - ?n)) E'' = \n lappend (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?r_m_E')) \n (ltake (enat r_n) (ldrop (enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)) E''))\"\n unfolding ltake_lmap[symmetric] lconcat_ltake r_conv plus_enat_simps(1)[symmetric] ltake_plus_conv_lappend\n unfolding E' by simp\n finally have \"ta_seq_consist P ?vs (lmap snd (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?r_m_E')))\"\n and sc_ta_r: \"ta_seq_consist P (mrw_values P ?vs (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?r_m_E'))))) (lmap snd (ltake (enat r_n) (ldropn (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) E'')))\"\n unfolding lmap_lappend_distrib by(simp_all add: ta_seq_consist_lappend split_def ldrop_enat)\n note this(1) also\n have \"lmap snd (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (ltake (enat r_m) E')))\n = llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?r_m_E')))\"\n unfolding lmap_lconcat llist.map_comp o_def split_def lconcat_llist_of[symmetric] map_map lmap_llist_of[symmetric]\n by simp\n finally have \"ta_seq_consist P ?vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?r_m_E'))))\" .\n from if.sequential_completion[OF cut_and_update ta_seq_consist_convert_RA \\_\\'[folded mthr.if.RedT_def] this red_ra]\n obtain ta' ttas' \n where \"mthr.if.mthr.Runs \\' (LCons (t_r, ta') ttas')\"\n and sc: \"ta_seq_consist P (mrw_values P empty (map snd ?start_heap_obs)) \n (lconcat (lmap (\\(t, ta). llist_of \\ta\\\\<^bsub>o\\<^esub>) (lappend (llist_of (list_of ?r_m_E')) (LCons (t_r, ta') ttas'))))\"\n and eq_ta: \"eq_upto_seq_inconsist P \\ta_r\\\\<^bsub>o\\<^esub> \\ta'\\\\<^bsub>o\\<^esub> (mrw_values P ?vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?r_m_E'))))\"\n by blast\n\n let ?E_sc' = \"lappend (llist_of (list_of ?r_m_E')) (LCons (t_r, ta') ttas')\"\n let ?E_sc'' = \"lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?E_sc')\"\n let ?E_sc = \"lappend (llist_of ?start_heap_obs) ?E_sc''\"\n\n from \\_\\' `mthr.if.mthr.Runs \\' (LCons (t_r, ta') ttas')`\n have \"mthr.if.mthr.Runs ?start_state ?E_sc'\" by(rule mthr.if.mthr.Trsys_into_Runs)\n hence \"?E_sc'' \\ mthr.if.\\ ?start_state\" by(rule mthr.if.\\.intros)\n hence \"?E_sc \\ ?\\\" by(rule imageI)\n moreover from `?E_sc'' \\ mthr.if.\\ ?start_state`\n have tsa_ok: \"thread_start_actions_ok ?E_sc\" by(rule thread_start_actions_ok_init_fin) \n \n from sc have \"ta_seq_consist P empty (lmap snd ?E_sc)\"\n by(simp add: lmap_lappend_distrib o_def lmap_lconcat llist.map_comp split_def ta_seq_consist_lappend start_sc)\n from ta_seq_consist_imp_sequentially_consistent[OF tsa_ok jmm.\\_new_actions_for_fun[OF `?E_sc \\ ?\\`] this]\n obtain ws_sc where \"sequentially_consistent P (?E_sc, ws_sc)\"\n and \"P \\ (?E_sc, ws_sc) \\\" unfolding start_heap_obs_def[symmetric] by iprover\n moreover {\n have enat_sum_r_m_eq: \"enat (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) = llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?r_m_E'))\"\n by(auto intro: setsum.cong simp add: less_trans[OF _ r_m] lnth_ltake llength_lconcat_lfinite_conv_sum setsum_hom[symmetric, where f=enat] zero_enat_def[symmetric] split_beta)\n also have \"\\ \\ llength E''\" unfolding E'\n by(blast intro: lprefix_llength_le lprefix_lconcatI lmap_lprefix)\n finally have r_m_E: \"ltake (enat (?n + (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>))) E = ltake (enat (?n + (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>))) ?E_sc\"\n by(simp add: ltake_lappend lappend_eq_lappend_conv lmap_lappend_distrib r_m_sum_len_eq ltake_lmap[symmetric] min_def zero_enat_def[symmetric] E E' lconcat_ltake ltake_all del: ltake_lmap)\n\n have drop_r_m_E: \"ldropn (?n + (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)) E = lappend (llist_of (map (Pair t_r) \\ta_r\\\\<^bsub>o\\<^esub>)) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (ldropn (Suc r_m) E')))\"\n (is \"_ = ?drop_r_m_E\") using E'_r_m unfolding E E'\n by(subst (2) E'_unfold)(simp add: ldropn_lappend2 lmap_lappend_distrib enat_sum_r_m_eq[symmetric])\n\n have drop_r_m_E_sc: \"ldropn (?n + (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)) ?E_sc =\n lappend (llist_of (map (Pair t_r) \\ta'\\\\<^bsub>o\\<^esub>)) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas'))\"\n by(simp add: ldropn_lappend2 lmap_lappend_distrib enat_sum_r_m_eq[symmetric])\n\n let ?vs_r_m = \"mrw_values P ?vs (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?r_m_E'))))\"\n note sc_ta_r also\n from drop_r_m_E have \"ldropn (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) E'' = ?drop_r_m_E\"\n unfolding E by(simp add: ldropn_lappend2)\n also have \"lmap snd (ltake (enat r_n) \\) = llist_of (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)\" using r_n\n by(simp add: ltake_lappend lmap_lappend_distrib ltake_lmap[symmetric] take_map o_def zero_enat_def[symmetric] del: ltake_lmap)\n finally have sc_ta_r: \"ta_seq_consist P ?vs_r_m (llist_of (take r_n \\ta_r\\\\<^bsub>o\\<^esub>))\" .\n note eq_ta\n also have \"\\ta_r\\\\<^bsub>o\\<^esub> = take r_n \\ta_r\\\\<^bsub>o\\<^esub> @ drop r_n \\ta_r\\\\<^bsub>o\\<^esub>\" by simp\n finally have \"eq_upto_seq_inconsist P (take r_n \\ta_r\\\\<^bsub>o\\<^esub> @ drop r_n \\ta_r\\\\<^bsub>o\\<^esub>) \\ta'\\\\<^bsub>o\\<^esub> ?vs_r_m\"\n by(simp add: list_of_lconcat split_def o_def map_concat)\n from eq_upto_seq_inconsist_appendD[OF this sc_ta_r]\n have r_n': \"r_n \\ length \\ta'\\\\<^bsub>o\\<^esub>\"\n and take_r_n_eq: \"take r_n \\ta'\\\\<^bsub>o\\<^esub> = take r_n \\ta_r\\\\<^bsub>o\\<^esub>\"\n and eq_r_n: \"eq_upto_seq_inconsist P (drop r_n \\ta_r\\\\<^bsub>o\\<^esub>) (drop r_n \\ta'\\\\<^bsub>o\\<^esub>) (mrw_values P ?vs_r_m (take r_n \\ta_r\\\\<^bsub>o\\<^esub>))\"\n using r_n by(simp_all add: min_def)\n from r_conv `?n \\ ?r` have r_conv': \"?r = (?n + (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>)) + r_n\" by simp\n from r_n' r_n take_r_n_eq r_m_E drop_r_m_E drop_r_m_E_sc\n have take_r'_eq: \"ltake (enat ?r) E = ltake (enat ?r) ?E_sc\" unfolding r_conv'\n apply(subst (1 2) plus_enat_simps(1)[symmetric])\n apply(subst (1 2) ltake_plus_conv_lappend)\n apply(simp add: lappend_eq_lappend_conv ltake_lappend1 ldrop_enat take_map)\n done\n hence take_r_eq: \"ltake (enat r) E = ltake (enat r) ?E_sc\"\n by(rule ltake_eq_ltake_antimono)(simp add: `?P ?r`)\n \n from eq_r_n Cons_nth_drop_Suc[OF r_n, symmetric]\n have \"drop r_n \\ta'\\\\<^bsub>o\\<^esub> \\ []\" by(auto simp add: eq_upto_seq_inconsist_simps)\n hence r_n': \"r_n < length \\ta'\\\\<^bsub>o\\<^esub>\" by simp\n hence eq_r_n: \"\\ta_r\\\\<^bsub>o\\<^esub> ! r_n \\ \\ta'\\\\<^bsub>o\\<^esub> ! r_n\"\n using eq_r_n Cons_nth_drop_Suc[OF r_n, symmetric] Cons_nth_drop_Suc[OF r_n', symmetric]\n by(simp add: eq_upto_seq_inconsist_simps split: action.split_asm obs_event.split_asm split_if_asm)\n obtain tid_eq: \"action_tid E r = action_tid ?E_sc r\" \n and obs_eq: \"action_obs E r \\ action_obs ?E_sc r\"\n proof(cases \"r < ?r\")\n case True\n { from True have \"action_tid E r = action_tid (ltake (enat ?r) E) r\"\n by(simp add: action_tid_def lnth_ltake)\n also note take_r'_eq\n also have \"action_tid (ltake (enat ?r) ?E_sc) r = action_tid ?E_sc r\"\n using True by(simp add: action_tid_def lnth_ltake)\n finally have \"action_tid E r = action_tid ?E_sc r\" . }\n moreover\n { from True have \"action_obs E r = action_obs (ltake (enat ?r) E) r\"\n by(simp add: action_obs_def lnth_ltake)\n also note take_r'_eq\n also have \"action_obs (ltake (enat ?r) ?E_sc) r = action_obs ?E_sc r\"\n using True by(simp add: action_obs_def lnth_ltake)\n finally have \"action_obs E r \\ action_obs ?E_sc r\" by simp }\n ultimately show thesis by(rule that)\n next\n case False\n with `?P ?r` have r_eq: \"r = ?r\" by simp\n hence \"lnth E r = (t_r, \\ta_r\\\\<^bsub>o\\<^esub> ! r_n)\" using E_r r_conv' E by(simp add: lnth_lappend2)\n moreover have \"lnth ?E_sc r = (t_r, \\ta'\\\\<^bsub>o\\<^esub> ! r_n)\" using `?n \\ ?r` r_n'\n by(subst r_eq)(simp add: r_conv lnth_lappend2 lmap_lappend_distrib enat_sum_r_m_eq[symmetric] lnth_lappend1 del: length_lift_start_obs)\n ultimately have \"action_tid E r = action_tid ?E_sc r\" \"action_obs E r \\ action_obs ?E_sc r\"\n using eq_r_n by(simp_all add: action_tid_def action_obs_def)\n thus thesis by(rule that)\n qed\n \n have \"enat r < enat ?n + llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (lappend ?r_m_E' (LCons (t_r, ta') LNil))))\"\n using `?P ?r` r_n' unfolding lmap_lappend_distrib\n by(simp add: enat_sum_r_m_eq[symmetric] r_conv')\n also have \"llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (lappend ?r_m_E' (LCons (t_r, ta') LNil)))) \\ llength ?E_sc''\"\n by(rule lprefix_llength_le[OF lprefix_lconcatI])(simp add: lmap_lprefix)\n finally have \"r \\ actions ?E_sc\" by(simp add: actions_def add_left_mono)\n note this tid_eq obs_eq take_r_eq }\n ultimately show ?thesis by blast\n qed\n qed(rule \\_new_actions_for_unique)\nqed\n\nlemma sc_legal:\n assumes hb_completion:\n \"if.hb_completion (init_fin_lift_state status (start_state f P C M vs)) (lift_start_obs start_tid start_heap_obs)\"\n (is \"if.hb_completion ?start_state ?start_heap_obs\")\n and wf: \"wf_syscls P\"\n and wfx_start: \"ts_ok wfx (thr (start_state f P C M vs)) start_heap\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) vs) \\ allocated start_heap\"\n shows \"sc_legal (\\_start f P C M vs status) P\"\n (is \"sc_legal ?\\ P\")\nproof -\n interpret jmm!: executions_sc_hb ?\\ P\n using wf wfx_start ka by(rule executions_sc_hb)\n\n interpret jmm!: executions_aux ?\\ P\n using wf wfx_start ka by(rule executions_aux)\n\n show ?thesis\n proof\n fix E ws r\n assume E: \"E \\ ?\\\" and wf_exec: \"P \\ (E, ws) \\\"\n and mrw: \"\\a. \\a < r; a \\ read_actions E\\ \\ P,E \\ a \\mrw ws a\"\n\n\n from E obtain E'' where E: \"E = lappend (llist_of ?start_heap_obs) E''\"\n and E'': \"E'' \\ mthr.if.\\ ?start_state\" by auto\n \n from E'' obtain E' where E': \"E'' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E')\"\n and \\Runs: \"mthr.if.mthr.Runs ?start_state E'\"\n by(rule mthr.if.\\.cases)\n \n show \"\\E'\\?\\. \\ws'. P \\ (E', ws') \\ \\ ltake (enat r) E = ltake (enat r) E' \\\n (\\a\\read_actions E'. if a < r then ws' a = ws a else P,E' \\ ws' a \\hb a) \\\n action_tid E' r = action_tid E r \\\n (if r \\ read_actions E then sim_action else op =) (action_obs E' r) (action_obs E r) \\\n (r \\ actions E \\ r \\ actions E')\"\n (is \"\\E'\\?\\. \\ws'. _ \\ ?same E' \\ ?read E' ws' \\ ?tid E' \\ ?obs E' \\ ?actions E'\")\n proof(cases \"r < length ?start_heap_obs\")\n case True\n\n from if.hb_completion_Runs[OF hb_completion ta_hb_consistent_convert_RA]\n obtain ttas where Runs: \"mthr.if.mthr.Runs ?start_state ttas\"\n and hb: \"ta_hb_consistent P ?start_heap_obs (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas))\"\n by blast\n\n from Runs have \\: \"lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas) \\ mthr.if.\\ ?start_state\"\n by(rule mthr.if.\\.intros)\n \n let ?E = \"lappend (llist_of ?start_heap_obs) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas))\"\n from \\ have E': \"?E \\ ?\\\" by blast\n\n from \\ have tsa: \"thread_start_actions_ok ?E\" by(rule thread_start_actions_ok_init_fin)\n\n from start_heap_obs_not_Read\n have ws: \"is_write_seen P (llist_of (lift_start_obs start_tid start_heap_obs)) ws\"\n by(unfold in_set_conv_nth)(rule is_write_seenI, auto simp add: action_obs_def actions_def lift_start_obs_def lnth_LCons elim!: read_actions.cases split: nat.split_asm)\n\n with hb tsa\n have \"\\ws'. P \\ (?E, ws') \\ \\\n (\\n. n \\ read_actions ?E \\ length ?start_heap_obs \\ n \\ P,?E \\ ws' n \\hb n) \\\n (\\n_new_actions_for_fun[OF E'])\n then obtain ws' where wf_exec': \"P \\ (?E, ws') \\\" \n and read_hb: \"\\n. \\ n \\ read_actions ?E; length ?start_heap_obs \\ n \\ \\ P,?E \\ ws' n \\hb n\"\n and same: \"\\n. n ws' n = ws n\" by blast\n\n from True have \"?same ?E\" unfolding E by(simp add: ltake_lappend1)\n moreover {\n fix a\n assume a: \"a \\ read_actions ?E\"\n have \"if a < r then ws' a = ws a else P,?E \\ ws' a \\hb a\"\n proof(cases \"a < length ?start_heap_obs\")\n case True\n with a have False using start_heap_obs_not_Read\n by cases(auto simp add: action_obs_def actions_def lnth_lappend1 lift_start_obs_def lnth_LCons in_set_conv_nth split: nat.split_asm)\n thus ?thesis ..\n next\n case False\n with read_hb[of a] True a show ?thesis by auto\n qed }\n hence \"?read ?E ws'\" by blast\n moreover from True E have \"?tid ?E\" by(simp add: action_tid_def lnth_lappend1)\n moreover from True E have \"?obs ?E\" by(simp add: action_obs_def lnth_lappend1)\n moreover from True have \"?actions ?E\" by(simp add: actions_def enat_less_enat_plusI)\n ultimately show ?thesis using E' wf_exec' by blast\n next\n case False\n hence r: \"length ?start_heap_obs \\ r\" by simp\n\n show ?thesis\n proof(cases \"enat r < llength E\")\n case False\n then obtain \"?same E\" \"?read E ws\" \"?tid E\" \"?obs E\" \"?actions E\"\n by(cases \"llength E\")(fastforce elim!: read_actions.cases simp add: actions_def split: split_if_asm)+\n with wf_exec `E \\ ?\\` show ?thesis by blast\n next\n case True\n note r' = this\n\n let ?r = \"r - length ?start_heap_obs\"\n from E r r' have \"enat ?r < llength E''\" by(cases \"llength E''\")(auto)\n with \\Runs obtain r_m r_n t_r ta_r \n where E_r: \"lnth E'' ?r = (t_r, \\ta_r\\\\<^bsub>o\\<^esub> ! r_n)\"\n and r_n: \"r_n < length \\ta_r\\\\<^bsub>o\\<^esub>\" and r_m: \"enat r_m < llength E'\"\n and r_conv: \"?r = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + r_n\"\n and E'_r_m: \"lnth E' r_m = (t_r, ta_r)\"\n unfolding E' by(rule mthr.if.actions_\\E_aux)\n\n let ?E' = \"ldropn (Suc r_m) E'\"\n let ?r_m_E' = \"ltake (enat r_m) E'\"\n have E'_unfold: \"E' = lappend (ltake (enat r_m) E') (LCons (lnth E' r_m) ?E')\"\n unfolding ldropn_Suc_conv_ldropn[OF r_m] by simp\n hence \"mthr.if.mthr.Runs ?start_state (lappend ?r_m_E' (LCons (lnth E' r_m) ?E'))\"\n using \\Runs by simp\n then obtain \\' where \\_\\': \"mthr.if.mthr.Trsys ?start_state (list_of ?r_m_E') \\'\"\n and \\Runs': \"mthr.if.mthr.Runs \\' (LCons (lnth E' r_m) ?E')\"\n by(rule mthr.if.mthr.Runs_lappendE) simp\n from \\Runs' obtain \\''' where red_ra: \"mthr.if.redT \\' (t_r, ta_r) \\'''\"\n and \\Runs'': \"mthr.if.mthr.Runs \\''' ?E'\"\n unfolding E'_r_m by cases\n\n let ?vs = \"mrw_values P empty (map snd ?start_heap_obs)\"\n from `E \\ ?\\` wf_exec have \"ta_seq_consist P empty (lmap snd (ltake (enat r) E))\"\n by(rule jmm.ta_seq_consist_mrwI)(simp add: mrw)\n hence ns: \"non_speculative P (\\_. {}) (lmap snd (ltake (enat r) E))\"\n by(rule ta_seq_consist_into_non_speculative) simp\n also note E also note ltake_lappend2 also note E'\n also note E'_unfold also note lmap_lappend_distrib also note lmap_lappend_distrib \n also note lconcat_lappend also note llist.map(2) also note E'_r_m also note prod.simps(2)\n also note ltake_lappend2 also note lconcat_LCons also note ltake_lappend1\n also note non_speculative_lappend also note lmap_lappend_distrib also note non_speculative_lappend\n also have \"lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (ltake (enat r_m) E')) = \n llist_of (concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))))\"\n by(simp add: lconcat_llist_of[symmetric] lmap_llist_of[symmetric] llist.map_comp o_def split_def del: lmap_llist_of)\n ultimately\n have \"non_speculative P (\\_. {}) (lmap snd (llist_of ?start_heap_obs))\"\n and \"non_speculative P (w_values P (\\_. {}) (map snd ?start_heap_obs)) \n (lmap snd (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (ltake (enat r_m) E'))))\"\n and ns': \"non_speculative P (w_values P (w_values P (\\_. {}) (map snd ?start_heap_obs)) (map snd (concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))))))\n (lmap snd (ltake (enat r_n) (llist_of (map (Pair t_r) \\ta_r\\\\<^bsub>o\\<^esub>))))\"\n using r r_conv r_m r_n\n by(simp_all add: length_concat o_def split_def listsum_setsum_nth length_list_of_conv_the_enat less_min_eq1 atLeast0LessThan lnth_ltake split: split_if_asm cong: setsum.strong_cong)\n hence ns: \"non_speculative P (w_values P (\\_. {}) (map snd ?start_heap_obs)) \n (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E')))))\"\n unfolding lconcat_llist_of[symmetric] lmap_lconcat lmap_llist_of[symmetric] llist.map_comp o_def split_def\n by(simp)\n\n from ns'\n have ns': \"non_speculative P (w_values P (w_values P (\\_. {}) (map snd ?start_heap_obs)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))))) (llist_of (take r_n \\ta_r\\\\<^bsub>o\\<^esub>))\"\n unfolding map_concat map_map by(simp add: take_map[symmetric] o_def split_def)\n\n let ?hb = \"\\ta'_r :: ('addr, 'thread_id, status \\ 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event action) thread_action. \n ta_hb_consistent P (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)) (llist_of (map (Pair t_r) (drop r_n \\ta'_r\\\\<^bsub>o\\<^esub>)))\"\n let ?sim = \"\\ta'_r. (if \\ad al v. \\ta_r\\\\<^bsub>o\\<^esub> ! r_n = NormalAction (ReadMem ad al v) then sim_action else op =) (\\ta_r\\\\<^bsub>o\\<^esub> ! r_n) (\\ta'_r\\\\<^bsub>o\\<^esub> ! r_n)\"\n\n from red_ra obtain ta'_r \\''''\n where red_ra': \"mthr.if.redT \\' (t_r, ta'_r) \\''''\"\n and eq: \"take r_n \\ta'_r\\\\<^bsub>o\\<^esub> = take r_n \\ta_r\\\\<^bsub>o\\<^esub>\"\n and hb: \"?hb ta'_r\"\n and r_n': \"r_n < length \\ta'_r\\\\<^bsub>o\\<^esub>\"\n and sim: \"?sim ta'_r\"\n proof(cases)\n case (redT_normal x x' m')\n note tst = `thr \\' t_r = \\(x, no_wait_locks)\\`\n and red = `t_r \\ (x, shr \\') -ta_r\\i (x', m')`\n and aok = `mthr.if.actions_ok \\' t_r ta_r`\n and \\''' = `redT_upd \\' t_r ta_r x' m' \\'''`\n from if.hb_completionD[OF hb_completion \\_\\'[folded mthr.if.RedT_def] ns tst red aok ns'] r_n\n obtain ta'_r x'' m''\n where red': \"t_r \\ (x, shr \\') -ta'_r\\i (x'', m'')\"\n and aok': \"mthr.if.actions_ok \\' t_r ta'_r\"\n and eq': \"take r_n \\ta'_r\\\\<^bsub>o\\<^esub> = take r_n \\ta_r\\\\<^bsub>o\\<^esub>\"\n and hb: \"?hb ta'_r\" \n and r_n': \"r_n < length \\ta'_r\\\\<^bsub>o\\<^esub>\"\n and sim: \"?sim ta'_r\" by blast\n from redT_updWs_total[of t_r \"wset \\'\" \"\\ta'_r\\\\<^bsub>w\\<^esub>\"]\n obtain \\'''' where \"redT_upd \\' t_r ta'_r x'' m'' \\''''\" by fastforce\n with red' tst aok' have \"mthr.if.redT \\' (t_r, ta'_r) \\''''\" ..\n thus thesis using eq' hb r_n' sim by(rule that)\n next\n case (redT_acquire x ln n)\n hence \"?hb ta_r\" using set_convert_RA_not_Read[where ln=ln]\n by -(rule ta_hb_consistent_not_ReadI, fastforce simp del: set_convert_RA_not_Read dest!: in_set_dropD)\n with red_ra r_n show ?thesis by(auto intro: that)\n qed\n from hb\n have \"non_speculative P (w_values P (\\_. {}) (map snd (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)))) (lmap snd (llist_of (map (Pair t_r) (drop r_n \\ta'_r\\\\<^bsub>o\\<^esub>))))\"\n by(rule ta_hb_consistent_into_non_speculative)\n with ns' eq[symmetric] have \"non_speculative P (w_values P (\\_. {}) (map snd (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E')))))) (llist_of (map snd (map (Pair t_r) \\ta'_r\\\\<^bsub>o\\<^esub>)))\"\n by(subst append_take_drop_id[where xs=\"\\ta'_r\\\\<^bsub>o\\<^esub>\" and n=r_n, symmetric])(simp add: o_def map_concat split_def lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: append_take_drop_id lappend_llist_of_llist_of)\n with ns have ns'': \"non_speculative P (w_values P (\\_. {}) (map snd ?start_heap_obs)) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E') @ [(t_r, ta'_r)]))))\"\n unfolding lconcat_llist_of[symmetric] map_append lappend_llist_of_llist_of[symmetric] lmap_llist_of[symmetric] llist.map_comp\n by(simp add: o_def split_def non_speculative_lappend list_of_lconcat map_concat)\n from \\_\\' red_ra' have \"mthr.if.RedT ?start_state (list_of ?r_m_E' @ [(t_r, ta'_r)]) \\''''\"\n unfolding mthr.if.RedT_def ..\n with hb_completion\n have hb_completion': \"if.hb_completion \\'''' (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E') @ [(t_r, ta'_r)])))\"\n using ns'' by(rule if.hb_completion_shift)\n from if.hb_completion_Runs[OF hb_completion' ta_hb_consistent_convert_RA]\n obtain ttas' where Runs': \"mthr.if.mthr.Runs \\'''' ttas'\"\n and hb': \"ta_hb_consistent P (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E') @ [(t_r, ta'_r)]))) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas'))\"\n by blast\n\n let ?E = \"lappend (llist_of ?start_heap_obs) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (lappend (ltake (enat r_m) E') (LCons (t_r, ta'_r) ttas'))))\"\n\n have \\: \"lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) (lappend (ltake (enat r_m) E') (LCons (t_r, ta'_r) ttas'))) \\ mthr.if.\\ ?start_state\"\n by(subst (4) llist_of_list_of[symmetric])(simp, blast intro: mthr.if.\\.intros mthr.if.mthr.Trsys_into_Runs \\_\\' mthr.if.mthr.Runs.Step red_ra' Runs')\n hence \\': \"?E \\ ?\\\" by blast\n\n from \\ have tsa: \"thread_start_actions_ok ?E\" by(rule thread_start_actions_ok_init_fin)\n also let ?E' = \"lappend (llist_of (lift_start_obs start_tid start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>))) (lappend (llist_of (map (Pair t_r) (drop r_n \\ta'_r\\\\<^bsub>o\\<^esub>))) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas')))\"\n have \"?E = ?E'\"\n using eq[symmetric]\n by(simp add: lmap_lappend_distrib lappend_assoc lappend_llist_of_llist_of[symmetric] lconcat_llist_of[symmetric] lmap_llist_of[symmetric] llist.map_comp o_def split_def del: lmap_llist_of)(simp add: lappend_assoc[symmetric] lmap_lappend_distrib[symmetric] map_append[symmetric] lappend_llist_of_llist_of del: map_append)\n finally have tsa': \"thread_start_actions_ok ?E'\" .\n\n from hb hb' eq[symmetric]\n have HB: \"ta_hb_consistent P (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)) (lappend (llist_of (map (Pair t_r) (drop r_n \\ta'_r\\\\<^bsub>o\\<^esub>))) (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ttas')))\"\n by -(rule ta_hb_consistent_lappendI, simp_all add: take_map[symmetric] drop_map[symmetric])\n \n def EE \\ \"llist_of (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>))\"\n\n from r r_conv have r_conv': \"r = (\\isnd (lnth E' i)\\\\<^bsub>o\\<^esub>) + r_n + length ?start_heap_obs\" by auto\n hence len_EE: \"llength EE = enat r\" using r_m r_n\n by(auto simp add: EE_def length_concat listsum_setsum_nth atLeast0LessThan lnth_ltake less_min_eq1 split_def min_def length_list_of_conv_the_enat cong: setsum.strong_cong)\n \n from r_conv r_m\n have r_conv3: \"llength (lconcat (lmap (\\x. llist_of (map (Pair (fst x)) \\snd x\\\\<^bsub>o\\<^esub>)) (ltake (enat r_m) E'))) = enat (r - Suc (length start_heap_obs) - r_n)\" \n apply(simp add: llength_lconcat_lfinite_conv_sum lnth_ltake cong: setsum.strong_cong conj_cong)\n apply(auto simp add: setsum_hom[where f=enat, symmetric] zero_enat_def less_trans[where y=\"enat r_m\"] intro: setsum.cong)\n done \n\n have is_ws: \"is_write_seen P EE ws\"\n proof(rule is_write_seenI)\n fix a ad al v\n assume a: \"a \\ read_actions EE\"\n and a_obs: \"action_obs EE a = NormalAction (ReadMem ad al v)\"\n from a have a_r: \"a < r\" by cases(simp add: len_EE actions_def)\n\n from r E'_r_m r_m r_n r_conv3\n have eq: \"ltake (enat r) EE = ltake (enat r) E\"\n unfolding E E' EE_def\n apply(subst (2) E'_unfold)\n apply(simp add: ltake_lappend2 lappend_llist_of_llist_of[symmetric] lappend_eq_lappend_conv lmap_lappend_distrib lconcat_llist_of[symmetric] o_def split_def lmap_llist_of[symmetric] del: lappend_llist_of_llist_of lmap_llist_of)\n apply(subst ltake_lappend1)\n defer\n apply(simp add: ltake_lmap[symmetric] take_map[symmetric] ltake_llist_of[symmetric] del: ltake_lmap ltake_llist_of)\n apply(auto simp add: min_def)\n done\n hence sim: \"ltake (enat r) EE [\\] ltake (enat r) E\" by(rule eq_into_sim_actions)\n \n from a sim have a': \"a \\ read_actions E\"\n by(rule read_actions_change_prefix)(simp add: a_r)\n from action_obs_change_prefix_eq[OF eq, of a] a_r a_obs\n have a_obs': \"action_obs E a = NormalAction (ReadMem ad al v)\" by simp\n \n have a_mrw: \"P,E \\ a \\mrw ws a\" using a_r a' by(rule mrw)\n with `E \\ ?\\` wf_exec have ws_a_a: \"ws a < a\"\n by(rule jmm.mrw_before)(auto intro: a_r less_trans mrw)\n hence [simp]: \"ws a < r\" using a_r by simp\n\n from wf_exec have ws: \"is_write_seen P E ws\" by(rule wf_exec_is_write_seenD)\n from is_write_seenD[OF this a' a_obs']\n have \"ws a \\ write_actions E\"\n and \"(ad, al) \\ action_loc P E (ws a)\"\n and \"value_written P E (ws a) (ad, al) = v\"\n and \"\\ P,E \\ a \\hb ws a\"\n and \"is_volatile P al \\ \\ P,E \\ a \\so ws a\"\n and between: \"\\a'. \\ a' \\ write_actions E; (ad, al) \\ action_loc P E a'; \n P,E \\ ws a \\hb a' \\ P,E \\ a' \\hb a \\ is_volatile P al \\ P,E \\ ws a \\so a' \\ P,E \\ a' \\so a \\\n \\ a' = ws a\" by simp_all\n\n from `ws a \\ write_actions E` sim[symmetric]\n show \"ws a \\ write_actions EE\" by(rule write_actions_change_prefix) simp\n \n from action_loc_change_prefix[OF sim, of \"ws a\" P] `(ad, al) \\ action_loc P E (ws a)`\n show \"(ad, al) \\ action_loc P EE (ws a)\" by(simp)\n\n from value_written_change_prefix[OF eq, of \"ws a\" P] `value_written P E (ws a) (ad, al) = v`\n show \"value_written P EE (ws a) (ad, al) = v\" by simp\n \n from wf_exec have tsa_E: \"thread_start_actions_ok E\"\n by(rule wf_exec_thread_start_actions_okD)\n\n from `\\ P,E \\ a \\hb ws a` show \"\\ P,EE \\ a \\hb ws a\"\n proof(rule contrapos_nn)\n assume \"P,EE \\ a \\hb ws a\"\n thus \"P,E \\ a \\hb ws a\" using tsa_E sim\n by(rule happens_before_change_prefix)(simp_all add: a_r)\n qed\n\n { assume \"is_volatile P al\"\n hence \"\\ P,E \\ a \\so ws a\" by fact\n thus \"\\ P,EE \\ a \\so ws a\"\n by(rule contrapos_nn)(rule sync_order_change_prefix[OF _ sim], simp_all add: a_r) }\n \n fix a'\n assume \"a' \\ write_actions EE\" \"(ad, al) \\ action_loc P EE a'\"\n moreover\n hence [simp]: \"a' < r\" by cases(simp add: actions_def len_EE)\n ultimately have a': \"a' \\ write_actions E\" \"(ad, al) \\ action_loc P E a'\"\n using sim action_loc_change_prefix[OF sim, of a' P]\n by(auto intro: write_actions_change_prefix)\n { assume \"P,EE \\ ws a \\hb a'\" \"P,EE \\ a' \\hb a\"\n hence \"P,E \\ ws a \\hb a'\" \"P,E \\ a' \\hb a\"\n using tsa_E sim a_r by(auto elim!: happens_before_change_prefix)\n with between[OF a'] show \"a' = ws a\" by simp }\n { assume \"is_volatile P al \" \"P,EE \\ ws a \\so a'\" \"P,EE \\ a' \\so a\"\n with sim a_r between[OF a'] show \"a' = ws a\"\n by(fastforce elim: sync_order_change_prefix intro!: disjI2 del: disjCI) }\n qed\n\n with HB tsa'\n have \"\\ws'. P \\ (?E', ws') \\ \\\n (\\n. n \\ read_actions ?E' \\ length (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)) \\ n \\ P,?E' \\ ws' n \\hb n) \\\n (\\n(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)). ws' n = ws n)\"\n unfolding EE_def\n by(rule ta_hb_consistent_Read_hb)(rule jmm.\\_new_actions_for_fun[OF \\'[unfolded `?E = ?E'`]])\n also have r_conv'': \"length (?start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (list_of (ltake (enat r_m) E'))) @ map (Pair t_r) (take r_n \\ta_r\\\\<^bsub>o\\<^esub>)) = r\"\n using r_n r_m unfolding r_conv'\n by(auto simp add: length_concat listsum_setsum_nth atLeast0LessThan lnth_ltake split_def o_def less_min_eq1 min_def length_list_of_conv_the_enat cong: setsum.strong_cong)\n finally obtain ws' where wf_exec': \"P \\ (?E', ws') \\\" \n and read_hb: \"\\n. \\ n \\ read_actions ?E'; r \\ n \\ \\ P,?E' \\ ws' n \\hb n\"\n and read_same: \"\\n. n < r \\ ws' n = ws n\" by blast\n\n have \"?same ?E'\"\n apply(subst ltake_lappend1, simp add: r_conv''[symmetric] length_list_of_conv_the_enat)\n unfolding E E' lappend_llist_of_llist_of[symmetric]\n apply(subst (1 2) ltake_lappend2, simp add: r[simplified])\n apply(subst lappend_eq_lappend_conv, simp)\n apply safe\n apply(subst E'_unfold)\n unfolding lmap_lappend_distrib \n apply(subst lconcat_lappend, simp)\n apply(subst lconcat_llist_of[symmetric])\n apply(subst (3) lmap_llist_of[symmetric])\n apply(subst (3) lmap_llist_of[symmetric])\n apply(subst llist.map_comp)\n apply(simp only: split_def o_def)\n apply(subst llist_of_list_of, simp)\n apply(subst (1 2) ltake_lappend2, simp add: r_conv3)\n apply(subst lappend_eq_lappend_conv, simp)\n apply safe\n unfolding llist.map(2) lconcat_LCons E'_r_m snd_conv fst_conv take_map\n apply(subst ltake_lappend1)\n defer\n apply(subst append_take_drop_id[where xs=\"\\ta_r\\\\<^bsub>o\\<^esub>\" and n=r_n, symmetric])\n unfolding map_append lappend_llist_of_llist_of[symmetric]\n apply(subst ltake_lappend1)\n using r_n\n apply(simp add: min_def r_conv3)\n apply(rule refl)\n apply(simp add: r_conv3)\n using r_n by arith\n\n moreover {\n fix a\n assume \"a \\ read_actions ?E'\"\n with read_hb[of a] read_same[of a]\n have \"if a < r then ws' a = ws a else P,?E' \\ ws' a \\hb a\" by simp }\n hence \"?read ?E' ws'\" by blast\n moreover from r_m r_n r_n'\n have E'_r: \"lnth ?E' r = (t_r, \\ta'_r\\\\<^bsub>o\\<^esub> ! r_n)\" unfolding r_conv'\n by(auto simp add: lnth_lappend nth_append length_concat listsum_setsum_nth atLeast0LessThan split_beta lnth_ltake less_min_eq1 length_list_of_conv_the_enat cong: setsum.strong_cong)\n from E_r r have E_r: \"lnth E r = (t_r, \\ta_r\\\\<^bsub>o\\<^esub> ! r_n)\"\n unfolding E by(simp add: lnth_lappend)\n have \"r \\ read_actions E \\ (\\ad al v. \\ta_r\\\\<^bsub>o\\<^esub> ! r_n = NormalAction (ReadMem ad al v))\" using True\n by(auto elim!: read_actions.cases simp add: action_obs_def E_r actions_def intro!: read_actions.intros)\n with sim E'_r E_r have \"?tid ?E'\" \"?obs ?E'\"\n by(auto simp add: action_tid_def action_obs_def)\n moreover have \"?actions ?E'\" using r_n r_m r_n' unfolding r_conv'\n by(cases \"llength ?E'\")(auto simp add: actions_def less_min_eq2 length_concat listsum_setsum_nth atLeast0LessThan split_beta lnth_ltake less_min_eq1 length_list_of_conv_the_enat enat_plus_eq_enat_conv cong: setsum.strong_cong)\n ultimately show ?thesis using wf_exec' \\'\n unfolding `?E = ?E'` by blast\n qed\n qed\n qed\nqed\n\nend\n\nlemma w_value_mrw_value_conf:\n assumes \"set_option (vs' adal) \\ vs adal \\ UNIV\"\n shows \"set_option (mrw_value P vs' ob adal) \\ w_value P vs ob adal \\ UNIV\"\nusing assms by(cases adal)(cases ob rule: w_value_cases, auto)\n\nlemma w_values_mrw_values_conf:\n assumes \"set_option (vs' adal) \\ vs adal \\ UNIV\"\n shows \"set_option (mrw_values P vs' obs adal) \\ w_values P vs obs adal \\ UNIV\"\nusing assms\nby(induct obs arbitrary: vs' vs)(auto del: subsetI intro: w_value_mrw_value_conf)\n\nlemma w_value_mrw_value_dom_eq_preserve:\n assumes \"dom vs' = {adal. vs adal \\ {}}\"\n shows \"dom (mrw_value P vs' ob) = {adal. w_value P vs ob adal \\ {}}\"\nusing assms\napply(cases ob rule: w_value_cases)\napply(simp_all add: dom_def split_beta del: not_None_eq)\napply(blast elim: equalityE dest: subsetD)+\ndone\n\nlemma w_values_mrw_values_dom_eq_preserve:\n assumes \"dom vs' = {adal. vs adal \\ {}}\"\n shows \"dom (mrw_values P vs' obs) = {adal. w_values P vs obs adal \\ {}}\"\nusing assms\nby(induct obs arbitrary: vs vs')(auto del: equalityI intro: w_value_mrw_value_dom_eq_preserve)\n\ncontext jmm_multithreaded begin\n\ndefinition non_speculative_read :: \n \"('l, 'thread_id, 'x, 'm, 'w) state \\ ('addr \\ addr_loc \\ 'addr val set) \\ bool\"\nwhere\n \"non_speculative_read s vs \\\n (\\ttas s' t x ta x' m' i ad al v v'.\n s -\\ttas\\* s' \\ non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) \\\n thr s' t = \\(x, no_wait_locks)\\ \\ t \\ (x, shr s') -ta\\ (x', m') \\ actions_ok s' t ta \\ \n i < length \\ta\\\\<^bsub>o\\<^esub> \\ \n non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>)) \\\n \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) \\ \n v' \\ w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas) @ take i \\ta\\\\<^bsub>o\\<^esub>) (ad, al) \\\n (\\ta' x'' m''. t \\ (x, shr s') -ta'\\ (x'', m'') \\ actions_ok s' t ta' \\\n i < length \\ta'\\\\<^bsub>o\\<^esub> \\ take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub> \\ \\ta'\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v') \\\n length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>))\"\n\nlemma non_speculative_readI [intro?]:\n \"(\\ttas s' t x ta x' m' i ad al v v'. \n \\ s -\\ttas\\* s'; non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)));\n thr s' t = \\(x, no_wait_locks)\\; t \\ (x, shr s') -ta\\ (x', m'); actions_ok s' t ta;\n i < length \\ta\\\\<^bsub>o\\<^esub>; non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>));\n \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v);\n v' \\ w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas) @ take i \\ta\\\\<^bsub>o\\<^esub>) (ad, al) \\\n \\ \\ta' x'' m''. t \\ (x, shr s') -ta'\\ (x'', m'') \\ actions_ok s' t ta' \\\n i < length \\ta'\\\\<^bsub>o\\<^esub> \\ take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub> \\ \\ta'\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v') \\\n length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>)\n \\ non_speculative_read s vs\"\nunfolding non_speculative_read_def by blast\n\nlemma non_speculative_readD:\n \"\\ non_speculative_read s vs; s -\\ttas\\* s'; non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)));\n thr s' t = \\(x, no_wait_locks)\\; t \\ (x, shr s') -ta\\ (x', m'); actions_ok s' t ta;\n i < length \\ta\\\\<^bsub>o\\<^esub>; non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>)); \n \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v);\n v' \\ w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas) @ take i \\ta\\\\<^bsub>o\\<^esub>) (ad, al) \\\n \\ \\ta' x'' m''. t \\ (x, shr s') -ta'\\ (x'', m'') \\ actions_ok s' t ta' \\\n i < length \\ta'\\\\<^bsub>o\\<^esub> \\ take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub> \\ \\ta'\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v') \\\n length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>\"\nunfolding non_speculative_read_def by blast\n\nend\n\nsubsection {* @{term \"non_speculative\"} generalises @{term \"cut_and_update\"} and @{term \"ta_hb_consistent\"} *}\n\ncontext known_addrs_typing begin\n\nlemma read_non_speculative_new_actions_for:\n fixes status f C M params E\n defines \"E \\ lift_start_obs start_tid start_heap_obs\"\n and \"vs \\ w_values P (\\_. {}) (map snd E)\"\n and \"s \\ init_fin_lift_state status (start_state f P C M params)\"\n assumes wf: \"wf_syscls P\"\n and RedT: \"mthr.if.RedT s ttas s'\"\n and redT: \"mthr.if.redT s' (t, ta') s''\"\n and read: \"NormalAction (ReadMem ad al v) \\ set \\ta'\\\\<^bsub>o\\<^esub>\"\n and ns: \"non_speculative P (\\_. {}) (llist_of (map snd E @ concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) params) \\ allocated start_heap\"\n and wt: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and type_adal: \"P,shr s' \\ ad@al : T\"\n shows \"\\w. w \\ new_actions_for P (llist_of (E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas))) (ad, al)\"\n (is \"\\w. ?new_w w\")\nusing RedT redT read ns[unfolded E_def] ka unfolding s_def\nproof(cases rule: read_ex_NewHeapElem)\n case (start CTn)\n then obtain n where n: \"start_heap_obs ! n = NewHeapElem ad CTn\"\n and len: \"n < length start_heap_obs\"\n unfolding in_set_conv_nth by blast\n from ns have \"non_speculative P (w_values P (\\_. {}) (map snd E)) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n unfolding lappend_llist_of_llist_of[symmetric]\n by(simp add: non_speculative_lappend del: lappend_llist_of_llist_of)\n with RedT wt have hext: \"start_heap \\ shr s'\"\n unfolding s_def E_def using start_state_vs_conf[OF wf]\n by(auto dest!: init_fin_RedT_hext_incr simp add: start_state_def split_beta init_fin_lift_state_conv_simps)\n \n from start have \"typeof_addr start_heap ad = \\CTn\\\"\n by(auto dest: NewHeapElem_start_heap_obsD[OF wf])\n with hext have \"typeof_addr (shr s') ad = \\CTn\\\" by(rule typeof_addr_hext_mono)\n with type_adal have \"(ad, al) \\ action_loc_aux P (NormalAction (NewHeapElem ad CTn))\" using n len \n by cases (auto simp add: action_obs_def lnth_lappend1 lift_start_obs_def)\n with n len have \"?new_w (Suc n)\"\n by(simp add: new_actions_for_def actions_def E_def action_obs_def lift_start_obs_def nth_append)\n thus ?thesis ..\nnext\n case (Red ttas' s'' t' ta' s''' ttas'' CTn)\n note ttas = `ttas = ttas' @ (t', ta') # ttas''`\n \n from `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>`\n obtain obs obs' where obs: \"\\ta'\\\\<^bsub>o\\<^esub> = obs @ NormalAction (NewHeapElem ad CTn) # obs'\"\n by(auto dest: split_list)\n \n let ?n = \"length (lift_start_obs start_tid start_heap_obs)\"\n let ?wa = \"?n + length (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs\"\n \n have \"?wa = ?n + length (concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas')) + length obs\"\n by(simp add: length_concat o_def split_def)\n also have \"\\ < length (E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas))\"\n using obs ttas by(simp add: E_def)\n also\n from ttas obs\n have \"(E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas)) ! ?wa = (t', NormalAction (NewHeapElem ad CTn))\"\n by(auto simp add: E_def lift_start_obs_def nth_append o_def split_def length_concat)\n moreover\n from `mthr.if.redT s'' (t', ta') s'''` `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>`\n obtain x_wa x_wa' where ts''t': \"thr s'' t' = \\(x_wa, no_wait_locks)\\\"\n and red_wa: \"mthr.init_fin t' (x_wa, shr s'') ta' (x_wa', shr s''')\"\n by(cases) fastforce+\n\n from start_state_vs_conf[OF wf]\n have vs: \"vs_conf P (shr s) vs\" unfolding vs_def E_def s_def\n by(simp add: init_fin_lift_state_conv_simps start_state_def split_def)\n \n from ns\n have ns: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')))\"\n and ns': \"non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) (llist_of \\ta'\\\\<^bsub>o\\<^esub>)\"\n and ns'': \"non_speculative P (w_values P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) \\ta'\\\\<^bsub>o\\<^esub>) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'')))\"\n unfolding ttas vs_def\n by(simp_all add: lappend_llist_of_llist_of[symmetric] non_speculative_lappend del: lappend_llist_of_llist_of)\n from `mthr.if.RedT (init_fin_lift_state status (start_state f P C M params)) ttas' s''` wt ns\n have ts_ok'': \"ts_ok (init_fin_lift wfx) (thr s'') (shr s'')\" using vs unfolding vs_def s_def\n by(rule if_RedT_non_speculative_invar)\n with ts''t' have wfxt': \"wfx t' (snd x_wa) (shr s'')\" by(cases x_wa)(auto dest: ts_okD)\n\n from `mthr.if.RedT (init_fin_lift_state status (start_state f P C M params)) ttas' s''` wt ns\n have vs'': \"vs_conf P (shr s'') (w_values P (w_values P (\\_. {}) (map snd E)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas')))\"\n unfolding s_def E_def vs_def\n by(rule if_RedT_non_speculative_invar)(simp add: start_state_def split_beta init_fin_lift_state_conv_simps start_state_vs_conf[OF wf])\n from if_redT_non_speculative_vs_conf[OF `mthr.if.redT s'' (t', ta') s'''` ts_ok'' _ vs'', of \"length \\ta'\\\\<^bsub>o\\<^esub>\"] ns'\n have vs''': \"vs_conf P (shr s''') (w_values P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas'))) \\ta'\\\\<^bsub>o\\<^esub>)\"\n by(simp add: vs_def)\n\n from `mthr.if.redT s'' (t', ta') s'''` ts_ok'' ns' vs''\n have \"ts_ok (init_fin_lift wfx) (thr s''') (shr s''')\" \n unfolding vs_def by(rule if_redT_non_speculative_invar)\n with `mthr.if.RedT s''' ttas'' s'`\n have hext: \"shr s''' \\ shr s'\" using ns'' vs'''\n by(rule init_fin_RedT_hext_incr)\n \n from red_wa have \"typeof_addr (shr s''') ad = \\CTn\\\"\n using wfxt' `NormalAction (NewHeapElem ad CTn) \\ set \\ta'\\\\<^bsub>o\\<^esub>` by cases(auto dest: red_NewHeapElemD)\n with hext have \"typeof_addr (shr s') ad = \\CTn\\\" by(rule typeof_addr_hext_mono)\n with type_adal have \"(ad, al) \\ action_loc_aux P (NormalAction (NewHeapElem ad CTn))\" by cases auto\n ultimately have \"?new_w ?wa\"\n by(simp add: new_actions_for_def actions_def action_obs_def)\n thus ?thesis ..\nqed\n\nlemma non_speculative_read_into_cut_and_update:\n fixes status f C M params E\n defines \"E \\ lift_start_obs start_tid start_heap_obs\"\n and \"vs \\ w_values P (\\_. {}) (map snd E)\"\n and \"s \\ init_fin_lift_state status (start_state f P C M params)\"\n and \"vs' \\ mrw_values P empty (map snd E)\"\n assumes wf: \"wf_syscls P\"\n and nsr: \"if.non_speculative_read s vs\"\n and wt: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) params) \\ allocated start_heap\"\n shows \"if.cut_and_update s vs'\"\nproof(rule if.cut_and_updateI)\n fix ttas s' t x ta x' m'\n assume Red: \"mthr.if.RedT s ttas s'\"\n and sc: \"ta_seq_consist P vs' (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and tst: \"thr s' t = \\(x, no_wait_locks)\\\"\n and red: \"t \\ (x, shr s') -ta\\i (x', m')\"\n and aok: \"mthr.if.actions_ok s' t ta\"\n let ?vs = \"w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))\"\n let ?vs' = \"mrw_values P vs' (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))\"\n\n from start_state_vs_conf[OF wf]\n have vs: \"vs_conf P (shr s) vs\" unfolding vs_def E_def s_def\n by(simp add: init_fin_lift_state_conv_simps start_state_def split_def)\n\n from sc have ns: \"non_speculative P vs (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n by(rule ta_seq_consist_into_non_speculative)(auto simp add: vs'_def vs_def del: subsetI intro: w_values_mrw_values_conf)\n\n from ns have ns': \"non_speculative P (\\_. {}) (llist_of (map snd (lift_start_obs start_tid start_heap_obs) @ concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n unfolding lappend_llist_of_llist_of[symmetric] vs_def\n by(simp add: non_speculative_lappend E_def non_speculative_start_heap_obs del: lappend_llist_of_llist_of)\n\n have vs_vs'': \"\\adal. set_option (?vs' adal) \\ ?vs adal \\ UNIV\"\n by(rule w_values_mrw_values_conf)(auto simp add: vs'_def vs_def del: subsetI intro: w_values_mrw_values_conf)\n from Red wt ns vs\n have wt': \"ts_ok (init_fin_lift wfx) (thr s') (shr s')\"\n by(rule if_RedT_non_speculative_invar)\n hence wtt: \"init_fin_lift wfx t x (shr s')\" using tst by(rule ts_okD)\n\n { fix i\n have \"\\ta' x'' m''. t \\ (x, shr s') -ta'\\i (x'', m'') \\ mthr.if.actions_ok s' t ta' \\ length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub> \\\n ta_seq_consist P ?vs' (llist_of (take i \\ta'\\\\<^bsub>o\\<^esub>)) \\\n eq_upto_seq_inconsist P (take i \\ta\\\\<^bsub>o\\<^esub>) (take i \\ta'\\\\<^bsub>o\\<^esub>) ?vs' \\\n (ta_seq_consist P ?vs' (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>)) \\ ta' = ta)\"\n proof(induct i)\n case 0 \n show ?case using red aok\n by(auto simp del: split_paired_Ex simp add: eq_upto_seq_inconsist_simps)\n next\n case (Suc i)\n then obtain ta' x'' m''\n where red': \"t \\ (x, shr s') -ta'\\i (x'', m'')\"\n and aok': \"mthr.if.actions_ok s' t ta'\"\n and len: \"length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>\"\n and sc': \"ta_seq_consist P ?vs' (llist_of (take i \\ta'\\\\<^bsub>o\\<^esub>))\"\n and eusi: \"eq_upto_seq_inconsist P (take i \\ta\\\\<^bsub>o\\<^esub>) (take i \\ta'\\\\<^bsub>o\\<^esub>) ?vs'\" \n and ta'_ta: \"ta_seq_consist P ?vs' (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>)) \\ ta' = ta\"\n by blast\n let ?vs'' = \"mrw_values P ?vs' (take i \\ta'\\\\<^bsub>o\\<^esub>)\"\n show ?case\n proof(cases \"i < length \\ta'\\\\<^bsub>o\\<^esub> \\ \\ ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta'\\\\<^bsub>o\\<^esub>)) \\ \\ ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>))\")\n case True\n hence i: \"i < length \\ta'\\\\<^bsub>o\\<^esub>\" and \"\\ ta_seq_consist P ?vs'' (LCons (\\ta'\\\\<^bsub>o\\<^esub> ! i) LNil)\" using sc'\n by(auto simp add: take_Suc_conv_app_nth lappend_llist_of_llist_of[symmetric] ta_seq_consist_lappend simp del: lappend_llist_of_llist_of)\n then obtain ad al v where ta'_i: \"\\ta'\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v)\"\n by(auto split: action.split_asm obs_event.split_asm)\n from ta'_i True have read: \"NormalAction (ReadMem ad al v) \\ set \\ta'\\\\<^bsub>o\\<^esub>\" by(auto simp add: in_set_conv_nth)\n with red' have \"ad \\ known_addrs_if t x\" by(rule if_red_read_knows_addr)\n hence \"ad \\ if.known_addrs_state s'\" using tst by(rule if.known_addrs_stateI)\n moreover from init_fin_red_read_typeable[OF red' wtt read]\n obtain T where type_adal: \"P,shr s' \\ ad@al : T\" ..\n\n from redT_updWs_total[of t \"wset s'\" \"\\ta'\\\\<^bsub>w\\<^esub>\"] red' tst aok'\n obtain s'' where redT': \"mthr.if.redT s' (t, ta') s''\" by(auto dest!: mthr.if.redT.redT_normal)\n with wf Red\n have \"\\w. w \\ new_actions_for P (llist_of (E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas))) (ad, al)\"\n (is \"\\w. ?new_w w\")\n using read ns' ka wt type_adal unfolding s_def E_def by(rule read_non_speculative_new_actions_for)\n then obtain w where w: \"?new_w w\" ..\n have \"(ad, al) \\ dom ?vs'\"\n proof(cases \"w < length E\")\n case True\n with w have \"(ad, al) \\ dom vs'\" unfolding vs'_def new_actions_for_def\n by(clarsimp)(erule mrw_values_new_actionD[rotated 1], auto simp del: split_paired_Ex simp add: set_conv_nth action_obs_def nth_append intro!: exI[where x=w])\n also have \"dom vs' \\ dom ?vs'\" by(rule mrw_values_dom_mono)\n finally show ?thesis .\n next\n case False\n with w show ?thesis unfolding new_actions_for_def\n apply(clarsimp)\n apply(erule mrw_values_new_actionD[rotated 1])\n apply(simp_all add: set_conv_nth action_obs_def nth_append actions_def)\n apply(rule exI[where x=\"w - length E\"])\n apply(subst nth_map[where f=snd, symmetric])\n apply(simp_all add: length_concat o_def split_def map_concat)\n done\n qed\n hence \"(ad, al) \\ dom (mrw_values P ?vs' (take i \\ta'\\\\<^bsub>o\\<^esub>))\"\n by(rule subsetD[OF mrw_values_dom_mono])\n then obtain v' b where v': \"mrw_values P ?vs' (take i \\ta'\\\\<^bsub>o\\<^esub>) (ad, al) = \\(v', b)\\\" by auto\n moreover from vs_vs''[of \"(ad, al)\"]\n have \"set_option (mrw_values P ?vs' (take i \\ta'\\\\<^bsub>o\\<^esub>) (ad, al)) \\ w_values P ?vs (take i \\ta'\\\\<^bsub>o\\<^esub>) (ad, al) \\ UNIV\"\n by(rule w_values_mrw_values_conf)\n ultimately have \"v' \\ w_values P ?vs (take i \\ta'\\\\<^bsub>o\\<^esub>) (ad, al)\" by simp\n moreover from sc'\n have \"non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\ta'\\\\<^bsub>o\\<^esub>))\"\n by(blast intro: ta_seq_consist_into_non_speculative vs_vs'' del: subsetI)\n ultimately obtain ta'' x'' m''\n where red'': \"t \\ (x, shr s') -ta''\\i (x'', m'')\"\n and aok'': \"mthr.if.actions_ok s' t ta''\"\n and i': \"i < length \\ta''\\\\<^bsub>o\\<^esub>\"\n and eq: \"take i \\ta''\\\\<^bsub>o\\<^esub> = take i \\ta'\\\\<^bsub>o\\<^esub>\"\n and ta''_i: \"\\ta''\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v')\"\n and len': \"length \\ta''\\\\<^bsub>o\\<^esub> \\ length \\ta'\\\\<^bsub>o\\<^esub>\"\n using if.non_speculative_readD[OF nsr Red ns tst red' aok' i _ ta'_i, of v'] by auto\n from len' len have \"length \\ta''\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>\" by simp\n moreover have \"ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta''\\\\<^bsub>o\\<^esub>))\"\n using eq sc' i' ta''_i v'\n by(simp add: take_Suc_conv_app_nth lappend_llist_of_llist_of[symmetric] ta_seq_consist_lappend del: lappend_llist_of_llist_of)\n moreover have eusi': \"eq_upto_seq_inconsist P (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>) (take (Suc i) \\ta''\\\\<^bsub>o\\<^esub>) ?vs'\"\n using i' i len eq eusi ta'_i ta''_i v'\n by(auto simp add: take_Suc_conv_app_nth ta'_ta eq_upto_seq_inconsist_simps intro: eq_upto_seq_inconsist_appendI)\n moreover {\n assume \"ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>))\"\n with True have \"ta'' = ta\" by simp }\n ultimately show ?thesis using red'' aok'' True by blast\n next\n case False\n hence \"ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>)) \\ \n length \\ta'\\\\<^bsub>o\\<^esub> \\ i \\ \n ta_seq_consist P ?vs' (llist_of (take (Suc i) \\ta'\\\\<^bsub>o\\<^esub>))\" \n (is \"?case1 \\ ?case2 \\ ?case3\") by auto\n thus ?thesis\n proof(elim disjCE)\n assume \"?case1\"\n moreover\n hence \"eq_upto_seq_inconsist P (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>) (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>) ?vs'\"\n by(rule ta_seq_consist_imp_eq_upto_seq_inconsist_refl)\n ultimately show ?thesis using red aok by blast\n next\n assume \"?case2\" and \"\\ ?case1\"\n have \"eq_upto_seq_inconsist P (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>) (take (Suc i) \\ta'\\\\<^bsub>o\\<^esub>) ?vs'\"\n proof(cases \"i < length \\ta\\\\<^bsub>o\\<^esub>\")\n case True\n from `?case2` `\\ ?case1` have \"\\ ta_seq_consist P ?vs' (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>))\" by(auto simp add: ta'_ta)\n hence \"eq_upto_seq_inconsist P (take i \\ta\\\\<^bsub>o\\<^esub> @ [\\ta\\\\<^bsub>o\\<^esub> ! i]) (take i \\ta'\\\\<^bsub>o\\<^esub> @ []) ?vs'\"\n by(blast intro: eq_upto_seq_inconsist_appendI[OF eusi])\n thus ?thesis using True `?case2` by(simp add: take_Suc_conv_app_nth)\n next\n case False with len eusi show ?thesis by(simp)\n qed\n with red' aok' len sc' eusi `?case2` `\\ ?case1`show ?thesis\n by (fastforce simp add: take_all simp del: split_paired_Ex)\n next\n assume \"?case3\" and \"\\ ?case1\" and \"\\ ?case2\"\n with len eusi ta'_ta\n have \"eq_upto_seq_inconsist P (take (Suc i) \\ta\\\\<^bsub>o\\<^esub>) (take (Suc i) \\ta'\\\\<^bsub>o\\<^esub>) ?vs'\"\n by(auto simp add: take_Suc_conv_app_nth lappend_llist_of_llist_of[symmetric] ta_seq_consist_lappend intro: eq_upto_seq_inconsist_appendI cong: action.case_cong obs_event.case_cong)\n with red' aok' `?case3` len `\\ ?case1` show ?thesis by blast\n qed\n qed\n qed }\n from this[of \"length \\ta\\\\<^bsub>o\\<^esub>\"]\n show \"\\ta' x'' m''. t \\ (x, shr s') -ta'\\i (x'', m'') \\ mthr.if.actions_ok s' t ta' \\ ta_seq_consist P ?vs' (llist_of \\ta'\\\\<^bsub>o\\<^esub>) \\ eq_upto_seq_inconsist P \\ta\\\\<^bsub>o\\<^esub> \\ta'\\\\<^bsub>o\\<^esub> ?vs'\"\n by(auto simp del: split_paired_Ex cong: conj_cong)\nqed\n\nlemma non_speculative_read_into_hb_completion:\n fixes status f C M params E\n defines \"E \\ lift_start_obs start_tid start_heap_obs\"\n and \"vs \\ w_values P (\\_. {}) (map snd E)\"\n and \"s \\ init_fin_lift_state status (start_state f P C M params)\"\n assumes wf: \"wf_syscls P\"\n and nsr: \"if.non_speculative_read s vs\"\n and wt: \"ts_ok (init_fin_lift wfx) (thr s) (shr s)\"\n and ka: \"known_addrs start_tid (f (fst (method P C M)) M (fst (snd (method P C M))) (fst (snd (snd (method P C M)))) (the (snd (snd (snd (method P C M))))) params) \\ allocated start_heap\"\n shows \"if.hb_completion s E\"\nproof\n fix ttas s' t x ta x' m' i\n assume Red: \"mthr.if.RedT s ttas s'\"\n and ns: \"non_speculative P (w_values P (\\_. {}) (map snd E)) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n and tst: \"thr s' t = \\(x, no_wait_locks)\\\"\n and red: \"t \\ (x, shr s') -ta\\i (x', m')\"\n and aok: \"mthr.if.actions_ok s' t ta\"\n and nsi: \"non_speculative P (w_values P (w_values P (\\_. {}) (map snd E)) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\ta\\\\<^bsub>o\\<^esub>))\"\n\n let ?E = \"E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas) @ map (Pair t) (take i \\ta\\\\<^bsub>o\\<^esub>)\"\n let ?vs = \"w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))\"\n\n from ns have ns': \"non_speculative P (\\_. {}) (llist_of (map snd (lift_start_obs start_tid start_heap_obs) @ concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas)))\"\n unfolding lappend_llist_of_llist_of[symmetric]\n by(simp add: non_speculative_lappend E_def non_speculative_start_heap_obs del: lappend_llist_of_llist_of)\n\n from start_state_vs_conf[OF wf]\n have vs: \"vs_conf P (shr s) vs\" unfolding vs_def E_def s_def\n by(simp add: init_fin_lift_state_conv_simps start_state_def split_def)\n\n from Red wt ns vs\n have wt': \"ts_ok (init_fin_lift wfx) (thr s') (shr s')\"\n unfolding vs_def by(rule if_RedT_non_speculative_invar)\n hence wtt: \"init_fin_lift wfx t x (shr s')\" using tst by(rule ts_okD)\n\n { fix j\n have \"\\ta' x'' m''. t \\ (x, shr s') -ta'\\i (x'', m'') \\ mthr.if.actions_ok s' t ta' \\ length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub> \\\n take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub> \\ \n ta_hb_consistent P ?E (llist_of (map (Pair t) (take j (drop i \\ta'\\\\<^bsub>o\\<^esub>)))) \\\n (i < length \\ta\\\\<^bsub>o\\<^esub> \\ i < length \\ta'\\\\<^bsub>o\\<^esub>) \\\n (if \\ad al v. \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\ta\\\\<^bsub>o\\<^esub> ! i) (\\ta'\\\\<^bsub>o\\<^esub> ! i)\"\n proof(induct j)\n case 0 from red aok show ?case by(auto simp del: split_paired_Ex)\n next\n case (Suc j)\n then obtain ta' x'' m''\n where red': \"t \\ (x, shr s') -ta'\\i (x'', m'')\"\n and aok': \"mthr.if.actions_ok s' t ta'\"\n and len: \"length \\ta'\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>\"\n and eq: \"take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub>\"\n and hb: \"ta_hb_consistent P ?E (llist_of (map (Pair t) (take j (drop i \\ta'\\\\<^bsub>o\\<^esub>))))\"\n and len_i: \"i < length \\ta\\\\<^bsub>o\\<^esub> \\ i < length \\ta'\\\\<^bsub>o\\<^esub>\"\n and sim_i: \"(if \\ad al v. \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\ta\\\\<^bsub>o\\<^esub> ! i) (\\ta'\\\\<^bsub>o\\<^esub> ! i)\"\n by blast\n show ?case\n proof(cases \"i + j < length \\ta'\\\\<^bsub>o\\<^esub>\")\n case False\n with red' aok' len eq hb len_i sim_i show ?thesis by(fastforce simp del: split_paired_Ex)\n next\n case True\n note j = this\n show ?thesis\n proof(cases \"\\ad al v. \\ta'\\\\<^bsub>o\\<^esub> ! (i + j) = NormalAction (ReadMem ad al v)\")\n case True\n then obtain ad al v where ta'_j: \"\\ta'\\\\<^bsub>o\\<^esub> ! (i + j) = NormalAction (ReadMem ad al v)\" by blast\n hence read: \"NormalAction (ReadMem ad al v) \\ set \\ta'\\\\<^bsub>o\\<^esub>\" using j by(auto simp add: in_set_conv_nth)\n with red' have \"ad \\ known_addrs_if t x\" by(rule if_red_read_knows_addr)\n hence \"ad \\ if.known_addrs_state s'\" using tst by(rule if.known_addrs_stateI)\n from init_fin_red_read_typeable[OF red' wtt read] obtain T \n where type_adal: \"P,shr s' \\ ad@al : T\" ..\n\n from redT_updWs_total[of t \"wset s'\" \"\\ta'\\\\<^bsub>w\\<^esub>\"] red' tst aok'\n obtain s'' where redT': \"mthr.if.redT s' (t, ta') s''\" by(auto dest!: mthr.if.redT.redT_normal)\n with wf Red\n have \"\\w. w \\ new_actions_for P (llist_of (E @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) ttas))) (ad, al)\"\n (is \"\\w. ?new_w w\")\n using read ns' ka wt type_adal unfolding s_def E_def\n by(rule read_non_speculative_new_actions_for)\n then obtain w where w: \"?new_w w\" ..\n\n def E'' \\ \"?E @ map (Pair t) (take (Suc j) (drop i \\ta'\\\\<^bsub>o\\<^esub>))\"\n\n from Red redT' have \"mthr.if.RedT s (ttas @ [(t, ta')]) s''\" unfolding mthr.if.RedT_def ..\n hence tsa: \"thread_start_actions_ok (llist_of (lift_start_obs start_tid start_heap_obs @ concat (map (\\(t, ta). map (Pair t) \\ta\\\\<^bsub>o\\<^esub>) (ttas @ [(t, ta')]))))\"\n unfolding s_def by(rule thread_start_actions_ok_init_fin_RedT)\n hence \"thread_start_actions_ok (llist_of E'')\" unfolding E_def[symmetric] E''_def\n by(rule thread_start_actions_ok_prefix)(rule lprefix_llist_ofI, simp, metis append_take_drop_id eq map_append)\n moreover from w have \"w \\ actions (llist_of E'')\"\n unfolding E''_def by(auto simp add: new_actions_for_def actions_def)\n moreover have \"length ?E + j \\ actions (llist_of E'')\" using j by(auto simp add: E''_def actions_def)\n moreover from w have \"is_new_action (action_obs (llist_of E'') w)\"\n by(auto simp add: new_actions_for_def action_obs_def actions_def nth_append E''_def)\n moreover have \"\\ is_new_action (action_obs (llist_of E'') (length ?E + j))\"\n using j ta'_j by(auto simp add: action_obs_def nth_append min_def E''_def)(subst (asm) nth_map, simp_all)\n ultimately have hb_w: \"P,llist_of E'' \\ w \\hb length ?E + j\"\n by(rule happens_before_new_not_new)\n \n def writes == \n \"{w. P,llist_of E'' \\ w \\hb length ?E + j \\ w \\ write_actions (llist_of E'') \\ \n (ad, al) \\ action_loc P (llist_of E'') w}\"\n\n def w' \\ \"Max_torder (action_order (llist_of E'')) writes\"\n\n have writes_actions: \"writes \\ actions (llist_of E'')\" unfolding writes_def actions_def\n by(auto dest!: happens_before_into_action_order elim!: action_orderE simp add: actions_def)\n also have \"finite \\\" by(simp add: actions_def)\n finally (finite_subset) have \"finite writes\" .\n moreover from hb_w w have w_writes: \"w \\ writes\"\n by(auto 4 3 simp add: writes_def new_actions_for_def action_obs_def actions_def nth_append E''_def intro!: write_actions.intros elim!: is_new_action.cases)\n hence \"writes \\ {}\" by auto\n\n with torder_action_order `finite writes` \n have w'_writes: \"w' \\ writes\" using writes_actions unfolding w'_def by(rule Max_torder_in_set)\n moreover\n { fix w''\n assume \"w'' \\ writes\"\n with torder_action_order `finite writes`\n have \"llist_of E'' \\ w'' \\a w'\" using writes_actions unfolding w'_def by(rule Max_torder_above) }\n note w'_maximal = this\n\n def v' \\ \"value_written P (llist_of E'') w' (ad, al)\"\n\n from nsi ta_hb_consistent_into_non_speculative[OF hb]\n have nsi': \"non_speculative P (w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas))) (llist_of (take (i + j) \\ta'\\\\<^bsub>o\\<^esub>))\"\n unfolding take_add lappend_llist_of_llist_of[symmetric] non_speculative_lappend vs_def eq\n by(simp add: non_speculative_lappend o_def map_concat split_def del: lappend_llist_of_llist_of)\n \n from w'_writes have adal_w': \"(ad, al) \\ action_loc P (llist_of E'') w'\" by(simp add: writes_def)\n from w'_writes have \"w' \\ write_actions (llist_of E'')\"\n unfolding writes_def by blast\n then obtain \"is_write_action (action_obs (llist_of E'') w')\" \n and w'_actions: \"w' \\ actions (llist_of E'')\" by cases\n hence \"v' \\ w_values P (\\_. {}) (map snd E'') (ad, al)\"\n proof cases\n case (NewHeapElem ad' CTn)\n hence \"NormalAction (NewHeapElem ad' CTn) \\ set (map snd E'')\"\n using w'_actions unfolding in_set_conv_nth\n by(auto simp add: actions_def action_obs_def cong: conj_cong)\n moreover have \"ad' = ad\" \n and \"(ad, al) \\ action_loc_aux P (NormalAction (NewHeapElem ad CTn))\"\n using adal_w' NewHeapElem by auto\n ultimately show ?thesis using NewHeapElem unfolding v'_def\n by(simp add: value_written.simps w_values_new_actionD)\n next\n case (WriteMem ad' al' v'')\n hence \"NormalAction (WriteMem ad' al' v'') \\ set (map snd E'')\"\n using w'_actions unfolding in_set_conv_nth\n by(auto simp add: actions_def action_obs_def cong: conj_cong)\n moreover have \"ad' = ad\" \"al' = al\" using adal_w' WriteMem by auto\n ultimately show ?thesis using WriteMem unfolding v'_def\n by(simp add: value_written.simps w_values_WriteMemD)\n qed\n hence \"v' \\ w_values P vs (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) ttas) @ take (i + j) \\ta'\\\\<^bsub>o\\<^esub>) (ad, al)\"\n using j ta'_j eq unfolding E''_def vs_def\n by(simp add: o_def split_def map_concat take_add take_Suc_conv_app_nth)\n from if.non_speculative_readD[OF nsr Red ns[folded vs_def] tst red' aok' j nsi' ta'_j this]\n obtain ta'' x'' m'' \n where red'': \"t \\ (x, shr s') -ta''\\i (x'', m'')\"\n and aok'': \"mthr.if.actions_ok s' t ta''\"\n and j': \"i + j < length \\ta''\\\\<^bsub>o\\<^esub>\"\n and eq': \"take (i + j) \\ta''\\\\<^bsub>o\\<^esub> = take (i + j) \\ta'\\\\<^bsub>o\\<^esub>\"\n and ta''_j: \"\\ta''\\\\<^bsub>o\\<^esub> ! (i + j) = NormalAction (ReadMem ad al v')\"\n and len': \"length \\ta''\\\\<^bsub>o\\<^esub> \\ length \\ta'\\\\<^bsub>o\\<^esub>\" by blast\n\n def EE \\ \"?E @ map (Pair t) (take j (drop i \\ta''\\\\<^bsub>o\\<^esub>))\"\n def E' \\ \"?E @ map (Pair t) (take j (drop i \\ta''\\\\<^bsub>o\\<^esub>)) @ [(t, NormalAction (ReadMem ad al v'))]\"\n\n from len' len have \"length \\ta''\\\\<^bsub>o\\<^esub> \\ length \\ta\\\\<^bsub>o\\<^esub>\" by simp\n moreover with eq' eq j j' have \"take i \\ta''\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub>\"\n by(auto simp add: take_add min_def)\n moreover {\n note hb\n also have eq'': \"take j (drop i \\ta'\\\\<^bsub>o\\<^esub>) = take j (drop i \\ta''\\\\<^bsub>o\\<^esub>)\"\n using eq' j j' by(simp add: take_add min_def)\n also have \"ta_hb_consistent P (?E @ list_of (llist_of (map (Pair t) (take j (drop i \\ta''\\\\<^bsub>o\\<^esub>))))) (llist_of [(t, \\ta''\\\\<^bsub>o\\<^esub> ! (i + j))])\"\n unfolding llist_of.simps ta_hb_consistent_LCons ta_hb_consistent_LNil ta''_j prod.simps action.simps obs_event.simps list_of_llist_of append_assoc E'_def[symmetric, unfolded append_assoc]\n unfolding EE_def[symmetric, unfolded append_assoc]\n proof(intro conjI TrueI exI[where x=w'] strip)\n have \"llist_of E'' [\\] llist_of E'\" using j len eq'' ta'_j unfolding E''_def E'_def\n by(auto simp add: sim_actions_def list_all2_append List.list_all2_refl split_beta take_Suc_conv_app_nth take_map[symmetric])\n moreover have \"length E'' = length E'\" using j j' by(simp add: E''_def E'_def)\n ultimately have sim: \"ltake (enat (length E')) (llist_of E'') [\\] ltake (enat (length E')) (llist_of E')\" by simp\n\n from w'_actions `length E'' = length E'`\n have w'_len: \"w' < length E'\" by(simp add: actions_def)\n\n from `w' \\ write_actions (llist_of E'')` sim\n show \"w' \\ write_actions (llist_of E')\" by(rule write_actions_change_prefix)(simp add: w'_len)\n from adal_w' action_loc_change_prefix[OF sim, of w' P]\n show \"(ad, al) \\ action_loc P (llist_of E') w'\" by(simp add: w'_len)\n\n from ta'_j j have \"length ?E + j \\ read_actions (llist_of E'')\"\n by(auto intro!: read_actions.intros simp add: action_obs_def actions_def E''_def min_def nth_append)(auto)\n hence \"w' \\ length ?E + j\" using `w' \\ write_actions (llist_of E'')`\n by(auto dest: read_actions_not_write_actions)\n with w'_len have \"w' < length ?E + j\" by(simp add: E'_def)\n from j j' len' eq''\n have \"ltake (enat (length ?E + j)) (llist_of E'') = ltake (enat (length ?E + j)) (llist_of E')\"\n by(auto simp add: E''_def E'_def min_def take_Suc_conv_app_nth)\n from value_written_change_prefix[OF this, of w' P] `w' < length ?E + j`\n show \"value_written P (llist_of E') w' (ad, al) = v'\" unfolding v'_def by simp\n\n from `thread_start_actions_ok (llist_of E'')` `llist_of E'' [\\] llist_of E'`\n have tsa'': \"thread_start_actions_ok (llist_of E')\"\n by(rule thread_start_actions_ok_change)\n \n from w'_writes j j' len len' have \"P,llist_of E'' \\ w' \\hb length EE\"\n by(auto simp add: EE_def writes_def min_def ac_simps)\n thus \"P,llist_of E' \\ w' \\hb length EE\" using tsa'' sim\n by(rule happens_before_change_prefix)(simp add: w'_len, simp add: EE_def E'_def)\n \n fix w''\n assume w'': \"w'' \\ write_actions (llist_of E')\"\n and adal_w'': \"(ad, al) \\ action_loc P (llist_of E') w''\"\n\n from w'' have w''_len: \"w'' < length E'\" by(cases)(simp add: actions_def)\n \n from w'' sim[symmetric] have w'': \"w'' \\ write_actions (llist_of E'')\"\n by(rule write_actions_change_prefix)(simp add: w''_len)\n from adal_w'' action_loc_change_prefix[OF sim[symmetric], of w'' P] w''_len\n have adal_w'': \"(ad, al) \\ action_loc P (llist_of E'') w''\" by simp\n {\n presume w'_w'': \"llist_of E' \\ w' \\a w''\"\n and w''_hb: \"P,llist_of E' \\ w'' \\hb length EE\"\n from w''_hb `thread_start_actions_ok (llist_of E'')` sim[symmetric]\n have \"P,llist_of E'' \\ w'' \\hb length EE\"\n by(rule happens_before_change_prefix)(simp add: w''_len, simp add: E'_def EE_def)\n with w'' adal_w'' j j' len len' have \"w'' \\ writes\"\n by(auto simp add: writes_def EE_def min_def ac_simps split: split_if_asm)\n hence \"llist_of E'' \\ w'' \\a w'\" by(rule w'_maximal)\n hence \"llist_of E' \\ w'' \\a w'\" using sim\n by(rule action_order_change_prefix)(simp_all add: w'_len w''_len)\n thus \"w'' = w'\" \"w'' = w'\" using w'_w'' by(rule antisymPD[OF antisym_action_order])+ \n }\n\n { assume \"P,llist_of E' \\ w' \\hb w'' \\ P,llist_of E' \\ w'' \\hb length EE\"\n thus \"llist_of E' \\ w' \\a w''\" \"P,llist_of E' \\ w'' \\hb length EE\"\n by(blast dest: happens_before_into_action_order)+ }\n { assume \"is_volatile P al \\ P,llist_of E' \\ w' \\so w'' \\ P,llist_of E' \\ w'' \\so length EE\"\n then obtain vol: \"is_volatile P al\"\n and so: \"P,llist_of E' \\ w' \\so w''\" \n and so': \"P,llist_of E' \\ w'' \\so length EE\" by blast\n from so show \"llist_of E' \\ w' \\a w''\" by(blast elim: sync_orderE)\n\n show \"P,llist_of E' \\ w'' \\hb length EE\"\n proof(cases \"is_new_action (action_obs (llist_of E') w'')\")\n case True\n with `w'' \\ write_actions (llist_of E')` ta''_j show ?thesis\n by cases(rule happens_before_new_not_new[OF tsa''], auto simp add: actions_def EE_def E'_def action_obs_def min_def nth_append)\n next\n case False\n with `w'' \\ write_actions (llist_of E')` `(ad, al) \\ action_loc P (llist_of E') w''`\n obtain v'' where \"action_obs (llist_of E') w'' = NormalAction (WriteMem ad al v'')\"\n by cases(auto elim: is_write_action.cases)\n with ta''_j w'' j j' len len'\n have \"P \\ (action_tid (llist_of E') w'', action_obs (llist_of E') w'') \\sw (action_tid (llist_of E') (length EE), action_obs (llist_of E') (length EE))\"\n by(auto simp add: E'_def EE_def action_obs_def min_def nth_append Volatile)\n with so' have \"P,llist_of E' \\ w'' \\sw length EE\" by(rule sync_withI)\n thus ?thesis unfolding po_sw_def [abs_def] by(blast intro: tranclp.r_into_trancl)\n qed }\n qed\n ultimately have \"ta_hb_consistent P ?E (lappend (llist_of (map (Pair t) (take j (drop i \\ta''\\\\<^bsub>o\\<^esub>)))) (llist_of ([(t, \\ta''\\\\<^bsub>o\\<^esub> ! (i + j))])))\"\n by(rule ta_hb_consistent_lappendI) simp\n hence \"ta_hb_consistent P ?E (llist_of (map (Pair t) (take (Suc j) (drop i \\ta''\\\\<^bsub>o\\<^esub>))))\"\n using j' unfolding lappend_llist_of_llist_of by(simp add: take_Suc_conv_app_nth) }\n moreover from len_i have \"i < length \\ta\\\\<^bsub>o\\<^esub> \\ i < length \\ta''\\\\<^bsub>o\\<^esub>\" using eq' j' by auto\n moreover from sim_i eq' ta''_j ta'_j\n have \"(if \\ad al v. \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\ta\\\\<^bsub>o\\<^esub> ! i) (\\ta''\\\\<^bsub>o\\<^esub> ! i)\"\n by(cases \"j = 0\")(auto split: split_if_asm, (metis add_strict_left_mono comm_semiring_1_class.normalizing_semiring_rules(6) nth_take)+)\n ultimately show ?thesis using red'' aok'' by blast\n next\n case False\n hence \"ta_hb_consistent P (?E @ list_of (llist_of (map (Pair t) (take j (drop i \\ta'\\\\<^bsub>o\\<^esub>))))) (llist_of [(t, \\ta'\\\\<^bsub>o\\<^esub> ! (i + j))])\"\n by(simp add: ta_hb_consistent_LCons split: action.split obs_event.split)\n with hb\n have \"ta_hb_consistent P ?E (lappend (llist_of (map (Pair t) (take j (drop i \\ta'\\\\<^bsub>o\\<^esub>)))) (llist_of ([(t, \\ta'\\\\<^bsub>o\\<^esub> ! (i + j))])))\"\n by(rule ta_hb_consistent_lappendI) simp\n hence \"ta_hb_consistent P ?E (llist_of (map (Pair t) (take (Suc j) (drop i \\ta'\\\\<^bsub>o\\<^esub>))))\"\n using j unfolding lappend_llist_of_llist_of by(simp add: take_Suc_conv_app_nth)\n with red' aok' len eq len_i sim_i show ?thesis by blast\n qed\n qed\n qed }\n from this[of \"length \\ta\\\\<^bsub>o\\<^esub>\"]\n show \"\\ta' x'' m''. t \\ (x, shr s') -ta'\\i (x'', m'') \\ mthr.if.actions_ok s' t ta' \\ \n take i \\ta'\\\\<^bsub>o\\<^esub> = take i \\ta\\\\<^bsub>o\\<^esub> \\ \n ta_hb_consistent P ?E (llist_of (map (Pair t) (drop i \\ta'\\\\<^bsub>o\\<^esub>))) \\ \n (i < length \\ta\\\\<^bsub>o\\<^esub> \\ i < length \\ta'\\\\<^bsub>o\\<^esub>) \\\n (if \\ad al v. \\ta\\\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\ta\\\\<^bsub>o\\<^esub> ! i) (\\ta'\\\\<^bsub>o\\<^esub> ! i)\"\n by(simp del: split_paired_Ex cong: conj_cong split del: split_if) blast\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_Framework.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891307678319, "lm_q2_score": 0.3311197396289915, "lm_q1q2_score": 0.1949928156501876}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nResults about CNode Invocations, particularly the\nrecursive revoke and delete operations.\n*)\n\ntheory CNodeInv_AI\nimports \"./$L4V_ARCH/ArchIpc_AI\"\nbegin\n\n\ncontext begin interpretation Arch .\nrequalify_facts\n set_cap_arch\n cte_at_length_limit\n arch_derive_cap_untyped\n valid_arch_mdb_cap_swap\nend\n\ndeclare set_cap_arch[wp]\n\n\nprimrec\n valid_cnode_inv :: \"cnode_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_cnode_inv (InsertCall cap ptr ptr') =\n (valid_cap cap and real_cte_at ptr and real_cte_at ptr' and\n (\\s. cte_wp_at (is_derived (cdt s) ptr cap) ptr s) and\n cte_wp_at (\\c. c = NullCap) ptr' and\n ex_cte_cap_wp_to is_cnode_cap ptr' and K (ptr \\ ptr') and\n (\\s. \\r\\obj_refs cap. \\p'.\n ptr' \\ p' \\ cte_wp_at (\\cap'. r \\ obj_refs cap') p' s \\\n cte_wp_at (Not \\ is_zombie) p' s \\ \\ is_zombie cap))\"\n| \"valid_cnode_inv (MoveCall cap ptr ptr') =\n (valid_cap cap and cte_wp_at ((=) cap.NullCap) ptr' and\n cte_wp_at ((\\) NullCap) ptr and cte_wp_at (weak_derived cap) ptr and\n cte_wp_at (\\c. is_untyped_cap c \\ c = cap) ptr and\n ex_cte_cap_wp_to is_cnode_cap ptr' and\n real_cte_at ptr and real_cte_at ptr')\"\n| \"valid_cnode_inv (RevokeCall ptr) = cte_at ptr\"\n| \"valid_cnode_inv (DeleteCall ptr) = real_cte_at ptr\"\n| \"valid_cnode_inv (RotateCall s_cap p_cap src pivot dest) =\n (valid_cap s_cap and valid_cap p_cap and\n real_cte_at src and real_cte_at dest and real_cte_at pivot and\n cte_wp_at (weak_derived s_cap) src and\n cte_wp_at (\\c. is_untyped_cap c \\ c = s_cap) src and\n cte_wp_at ((\\) NullCap) src and\n cte_wp_at (weak_derived p_cap) pivot and\n cte_wp_at (\\c. is_untyped_cap c \\ c = p_cap) pivot and\n cte_wp_at ((\\) NullCap) pivot and K (src \\ pivot \\ pivot \\ dest) and\n (\\s. src \\ dest \\ cte_wp_at (\\c. c = NullCap) dest s) and\n ex_cte_cap_wp_to is_cnode_cap pivot and ex_cte_cap_wp_to is_cnode_cap dest)\"\n| \"valid_cnode_inv (SaveCall ptr) =\n (ex_cte_cap_wp_to is_cnode_cap ptr and\n cte_wp_at (\\c. c = NullCap) ptr and real_cte_at ptr)\"\n| \"valid_cnode_inv (CancelBadgedSendsCall cap) =\n (valid_cap cap and K (has_cancel_send_rights cap))\"\n\n\nprimrec\n valid_rec_del_call :: \"rec_del_call \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_rec_del_call (CTEDeleteCall slot _) = \\\"\n| \"valid_rec_del_call (FinaliseSlotCall slot _) = \\\"\n| \"valid_rec_del_call (ReduceZombieCall cap slot _) =\n (cte_wp_at ((=) cap) slot and is_final_cap' cap\n and K (is_zombie cap))\"\n\n\nlocale CNodeInv_AI =\n fixes state_ext_t :: \"'state_ext::state_ext itself\"\n assumes derive_cap_objrefs:\n \"\\P cap slot.\n \\\\s::'state_ext state. P (obj_refs cap)\\\n derive_cap slot cap\n \\\\rv s. rv \\ NullCap \\ P (obj_refs rv)\\,-\"\n assumes derive_cap_zobjrefs:\n \"\\P cap slot.\n \\\\s::'state_ext state. P (zobj_refs cap)\\\n derive_cap slot cap\n \\\\rv s. rv \\ NullCap \\ P (zobj_refs rv)\\,-\"\n assumes update_cap_objrefs:\n \"\\P dt cap. \\ update_cap_data P dt cap \\ NullCap \\ \\\n obj_refs (update_cap_data P dt cap) = obj_refs cap\"\n assumes update_cap_zobjrefs:\n \"\\P dt cap. \\ update_cap_data P dt cap \\ cap.NullCap \\ \\\n zobj_refs (update_cap_data P dt cap) = zobj_refs cap\"\n assumes copy_mask [simp]:\n \"\\R c. copy_of (mask_cap R c) = copy_of c\"\n assumes update_cap_data_mask_Null [simp]:\n \"\\P x m c. (update_cap_data P x (mask_cap m c) = NullCap) = (update_cap_data P x c = NullCap)\"\n assumes cap_master_update_cap_data:\n \"\\P x c. \\ update_cap_data P x c \\ NullCap \\ \\\n cap_master_cap (update_cap_data P x c) = cap_master_cap c\"\n assumes same_object_as_cap_master:\n \"\\cap cap'. same_object_as cap cap' \\ cap_master_cap cap = cap_master_cap cap'\"\n assumes cap_asid_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\ cap_asid (update_cap_data P x c) = cap_asid c\"\n assumes cap_vptr_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\ cap_vptr (update_cap_data P x c) = cap_vptr c\"\n assumes cap_asid_base_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\\n cap_asid_base (update_cap_data P x c) = cap_asid_base c\"\n assumes same_object_as_update_cap_data:\n \"\\P x c c'. \\ update_cap_data P x c \\ NullCap; same_object_as c' c \\ \\\n same_object_as c' (update_cap_data P x c)\"\n assumes weak_derived_update_cap_data:\n \"\\P x c c'. \\update_cap_data P x c \\ NullCap; weak_derived c c'\\ \\\n weak_derived (update_cap_data P x c) c'\"\n assumes cap_badge_update_cap_data:\n \"\\x c bdg. update_cap_data False x c \\ NullCap \\ (bdg, cap_badge c) \\ capBadge_ordering False\n \\ (bdg, cap_badge (update_cap_data False x c)) \\ capBadge_ordering False\"\n assumes cap_vptr_rights_update[simp]:\n \"\\f c. cap_vptr (cap_rights_update f c) = cap_vptr c\"\n assumes cap_vptr_mask[simp]:\n \"\\m c. cap_vptr (mask_cap m c) = cap_vptr c\"\n assumes cap_asid_base_rights [simp]:\n \"\\R c. cap_asid_base (cap_rights_update R c) = cap_asid_base c\"\n assumes cap_asid_base_mask[simp]:\n \"\\m c. cap_asid_base (mask_cap m c) = cap_asid_base c\"\n assumes weak_derived_mask:\n \"\\c c' m. \\ weak_derived c c'; cap_aligned c \\ \\ weak_derived (mask_cap m c) c'\"\n assumes vs_cap_ref_update_cap_data[simp]:\n \"\\P d cap. vs_cap_ref (update_cap_data P d cap) = vs_cap_ref cap\"\n assumes weak_derived_cap_is_device:\n \"\\c c'. \\weak_derived c' c\\ \\ cap_is_device c = cap_is_device c'\"\n assumes in_preempt[simp,intro]:\n \"\\rv s' (s::'state_ext state).\n (Inr rv, s') \\ fst (preemption_point s) \\\n (\\f es. s' = s \\ machine_state := machine_state s\n \\ irq_state := f (irq_state (machine_state s)) \\, exst := es\\)\"\n assumes invs_irq_state_independent[intro!, simp]:\n \"\\(s::'state_ext state) f.\n invs (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = invs s\"\n assumes cte_at_nat_to_cref_zbits:\n \"\\(s::'state_ext state) oref zb n m.\n \\ s \\ Zombie oref zb n; m < n \\ \\ cte_at (oref, nat_to_cref (zombie_cte_bits zb) m) s\"\n assumes copy_of_cap_range:\n \"\\cap cap'. copy_of cap cap' \\ cap_range cap = cap_range cap'\"\n assumes copy_of_zobj_refs:\n \"\\cap cap'. copy_of cap cap' \\ zobj_refs cap = zobj_refs cap'\"\n assumes vs_cap_ref_master:\n \"\\ cap cap'.\n \\ cap_master_cap cap = cap_master_cap cap';\n cap_asid cap = cap_asid cap';\n cap_asid_base cap = cap_asid_base cap';\n cap_vptr cap = cap_vptr cap' \\\n \\ vs_cap_ref cap = vs_cap_ref cap'\"\n assumes weak_derived_vs_cap_ref:\n \"\\c c'. weak_derived c c' \\ vs_cap_ref c = vs_cap_ref c'\"\n assumes weak_derived_table_cap_ref:\n \"\\c c'. weak_derived c c' \\ table_cap_ref c = table_cap_ref c'\"\n assumes swap_of_caps_valid_arch_caps:\n \"\\c a c' b.\n \\valid_arch_caps and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n do\n y \\ set_cap c b;\n set_cap c' a\n od\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n assumes cap_swap_asid_map[wp]:\n \"\\c a c' b.\n \\valid_asid_map and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. valid_asid_map :: 'state_ext state \\ bool\\\"\n assumes cap_swap_cap_refs_in_kernel_window[wp]:\n \"\\c a c' b.\n \\cap_refs_in_kernel_window and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. cap_refs_in_kernel_window :: 'state_ext state \\ bool\\\"\n assumes cap_swap_ioports[wp]:\n \"\\valid_ioports and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv (s::'state_ext state). valid_ioports s\\\"\n assumes cap_swap_vms[wp]:\n \"\\c a c' b.\n \\valid_machine_state :: 'state_ext state \\ bool\\\n cap_swap c a c' b\n \\\\rv. valid_machine_state\\\"\n assumes unat_of_bl_nat_to_cref:\n \"\\n ln. \\ n < 2 ^ ln; ln < word_bits \\\n \\ unat (of_bl (nat_to_cref ln n) :: machine_word) = n\"\n assumes zombie_is_cap_toE_pre:\n \"\\(s::'state_ext state) ptr zbits n m irqn.\n \\ s \\ Zombie ptr zbits n; invs s; m < n \\\n \\ (ptr, nat_to_cref (zombie_cte_bits zbits) m) \\ cte_refs (Zombie ptr zbits n) irqn\"\n assumes finalise_cap_emptyable[wp]:\n \"\\sl c f.\n \\emptyable sl and (invs and valid_mdb)\\\n finalise_cap c f\n \\\\_. emptyable sl :: 'state_ext state \\ bool\\\"\n assumes deleting_irq_handler_emptyable[wp]:\n \"\\sl irq.\n \\emptyable sl and invs :: 'state_ext state \\ bool\\\n deleting_irq_handler irq\n \\\\_. emptyable sl\\\"\n assumes arch_finalise_cap_emptyable[wp]:\n \"\\sl c f.\n \\emptyable sl :: 'state_ext state \\ bool\\\n arch_finalise_cap c f\n \\\\_. emptyable sl\\\"\n assumes finalise_cap_not_reply_master_unlifted:\n \"\\rv s' cap sl (s::'state_ext state).\n (rv, s') \\ fst (finalise_cap cap sl s) \\\n \\ is_master_reply_cap (fst rv)\"\n assumes nat_to_cref_0_replicate:\n \"\\n. n < word_bits \\ nat_to_cref n 0 = replicate n False\"\n assumes prepare_thread_delete_thread_cap:\n \"\\x p t. \\\\(s::'state_ext state). caps_of_state s x = Some (cap.ThreadCap p)\\\n prepare_thread_delete t\n \\\\rv s. caps_of_state s x = Some (cap.ThreadCap p)\\\"\n\nlocale CNodeInv_AI_2 = CNodeInv_AI state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes rec_del_invs':\n \"\\(s::'state_ext state) call.\n s \\ \\\\x. invs x \\ valid_rec_del_call call x \\\n (\\ exposed_rdcall call \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall call) x) \\\n emptyable (slot_rdcall call) x \\\n (case call of ReduceZombieCall cap sl ex \\ \\ cap_removeable cap sl \\\n (\\t\\obj_refs cap. halted_if_tcb t x)\n | _ \\ True)\\\n rec_del call\n \\\\rv s. invs s \\\n (case call of CTEDeleteCall _ bool \\ True\n | FinaliseSlotCall sl x \\ (fst rv \\ x \\ cte_wp_at (replaceable s sl NullCap) sl s) \\\n (snd rv \\ NullCap \\ post_cap_delete_pre (snd rv) ((caps_of_state s) (sl \\ cap.NullCap)))\n | ReduceZombieCall cap sl x \\ \\ x \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) sl s) \\\n emptyable (slot_rdcall call) s\\,\n \\\\rv. invs\\\"\n\n\nlemma mask_cap_all:\n \"mask_cap (all_rights \\ r) c = mask_cap r c\"\n unfolding all_rights_def by simp\n\n\nlemma decode_cnode_cases2:\n assumes mvins: \"\\index bits src_index src_depth args' src_root_cap exs'.\n \\ args = index # bits # src_index # src_depth # args';\n exs = src_root_cap # exs';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label \\ {CNodeRevoke, CNodeDelete,\n CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \\ \\ P\"\n assumes rvk: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeRevoke \\ \\ P\"\n assumes dlt: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeDelete \\ \\ P\"\n assumes svc: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeSaveCaller \\ \\ P\"\n assumes rcy: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeCancelBadgedSends \\ \\ P\"\n assumes rot: \"\\index bits pivot_new_data pivot_index pivot_depth src_new_data\n src_index src_depth args' pivot_root_cap src_root_cap exs'.\n \\ args = index # bits # pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args';\n exs = pivot_root_cap # src_root_cap # exs';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeRotate \\ \\ P\"\n assumes errs:\n \"\\ gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller] \\\n args = [] \\ (\\x. args = [x]) \\ (\\index bits args'. args = index # bits # args' \\\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller] \\\n (gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate]\n \\ gen_invocation_type label \\ {CNodeRevoke, CNodeDelete,\n CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\n \\ (case (args', exs) of (src_index # src_depth # args'',\n src_root_cap # exs') \\ False | _ \\ True) \\\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate] \\\n gen_invocation_type label = CNodeRotate \\ (case (args', exs) of\n (pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args'',\n pivot_root_cap # src_root_cap # exs') \\ False\n | _ \\ True))) \\ \\ P\"\n shows \"P\"\nproof -\n have simps: \"[CNodeRevoke .e. CNodeSaveCaller]\n = [CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeCopy, CNodeMint,\n CNodeMove, CNodeMutate, CNodeRotate, CNodeSaveCaller]\"\n \"[CNodeCopy .e. CNodeMutate] = [CNodeCopy, CNodeMint,\n CNodeMove, CNodeMutate]\"\n by (simp_all add: upto_enum_def fromEnum_def toEnum_def enum_invocation_label enum_gen_invocation_labels)\n show ?thesis\n apply (cases args)\n apply (simp add: errs)\n apply (case_tac list)\n apply (simp add: errs)\n apply (case_tac \"gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate]\")\n apply (case_tac \"case (lista, exs) of (src_index # src_depth # args'',\n src_root_cap # exs'') \\ False | _ \\ True\")\n apply (rule errs)\n apply (simp add: simps)\n apply (rule disjI2)\n apply auto[1]\n apply (simp split: prod.split_asm list.split_asm)\n apply (erule(2) mvins, auto simp: simps)[1]\n apply (case_tac \"gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller]\")\n apply (simp_all add: errs)\n apply (insert rvk dlt svc rcy rot)\n apply (simp add: simps)\n apply atomize\n apply (elim disjE, simp_all)\n apply (case_tac \"case (lista, exs) of\n (pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args'',\n pivot_root_cap # src_root_cap # exs') \\ False\n | _ \\ True\")\n apply (rule errs)\n apply (simp add: simps)\n apply (simp split: prod.split_asm list.split_asm)\n done\nqed\n\n\nlemma Suc_length_not_empty:\n \"length xs = length xs' \\ Suc 0 \\ length xs' = (xs \\ [])\"\n by (fastforce simp: le_simps)\n\n\nlemma update_cap_hoare_helper:\n \"\\P\\ f \\\\rv s. valid_cap (C rv s) s\\ \\\n \\P\\ f \\\\rv s. valid_cap (update_cap_data prs n (C rv s)) s\\\"\n apply (erule hoare_strengthen_post)\n apply (erule update_cap_data_validI)\n done\n\n\nlemma mask_cap_hoare_helper:\n \"\\P\\ f \\\\rv s. valid_cap (C rv s) s\\ \\\n \\P\\ f \\\\rv s. valid_cap (mask_cap (M rv s) (C rv s)) s\\\"\n by (fastforce simp add: valid_def)\n\nlemma derive_cap_untyped:\n \"\\\\s. P (untyped_range cap)\\ derive_cap slot cap \\\\rv s. rv \\ cap.NullCap \\ P (untyped_range rv)\\,-\"\n unfolding derive_cap_def is_zombie_def\n by (cases cap; (wp ensure_no_children_inv arch_derive_cap_untyped | simp add: o_def)+)\n\nlemma zombies_final_helper:\n \"\\ cte_wp_at (\\c. c = cap) p s; \\ is_zombie cap; zombies_final s \\\n \\ (\\r\\obj_refs cap. \\a b.\n cte_wp_at (\\cap'. r \\ obj_refs cap') (a, b) s \\ cte_wp_at (Not \\ is_zombie) (a, b) s)\"\n apply (clarsimp simp: cte_wp_at_def)\n apply (case_tac \"p = (a, b)\")\n apply simp\n apply (drule(2) zombies_finalD2)\n apply clarsimp\n apply blast\n apply simp\n done\n\nlemma cap_asid_mask[simp]:\n \"cap_asid (mask_cap m c) = cap_asid c\"\n by (simp add: mask_cap_def)\n\n\nlemma cap_master_mask[simp]:\n \"cap_master_cap (mask_cap rs cap) = cap_master_cap cap\"\n by (simp add: mask_cap_def)\n\n\nlemma cap_badge_mask[simp]:\n \"cap_badge (mask_cap rs cap) = cap_badge cap\"\n by (simp add: mask_cap_def)\n\n\nlemma ensure_empty_cte_wp_at:\n \"\\\\\\ ensure_empty c \\\\rv s. cte_wp_at ((=) cap.NullCap) c s\\, -\"\n unfolding ensure_empty_def\n apply (wp whenE_throwError_wp get_cap_wp)\n apply simp\n done\n\n\nlemmas get_cap_cte_caps_to_no_wp[wp]\n = get_cap_cte_caps_to[where P=\"\\\", simplified]\n\n\nlemma lookup_cap_ex[wp]:\n \"\\\\\\ lookup_cap t c \\\\rv s. \\r\\cte_refs rv (interrupt_irq_node s). ex_cte_cap_to r s\\, -\"\n by (simp add: split_def lookup_cap_def) wp\n\n\nlemmas cap_aligned_valid[elim!] = valid_cap_aligned\n\n\nlemma cap_derive_not_null_helper2:\n \"\\P\\ derive_cap slot cap \\\\rv s. rv \\ cap.NullCap \\ Q rv s\\, -\n \\\n \\\\s. cap \\ cap.NullCap \\ \\ is_zombie cap \\ cap \\ cap.IRQControlCap \\ P s\\\n derive_cap slot cap\n \\\\rv s. rv \\ cap.NullCap \\ Q rv s\\, -\"\n apply (drule cap_derive_not_null_helper)\n apply (erule hoare_post_imp_R)\n apply simp\n done\n\nlemma has_cancel_send_rights_ep_cap:\n \"has_cancel_send_rights cap \\ is_ep_cap cap\"\n by (clarsimp simp: has_cancel_send_rights_def split: cap.splits)\n\n\nlemma is_untyped_update_cap_data[intro]:\n \"is_untyped_cap r \\ update_cap_data c x r = r\"\n by (cases r; clarsimp simp: update_cap_data_def is_arch_cap_def)\n\ncontext CNodeInv_AI begin\n\nlemma decode_cnode_inv_wf[wp]:\n \"\\cap.\n \\invs and valid_cap cap\n and (\\s. \\r\\zobj_refs cap. ex_nonz_cap_to r s)\n and (\\s. is_cnode_cap cap \\ (\\r\\cte_refs cap (interrupt_irq_node s).\n ex_cte_cap_wp_to is_cnode_cap r s))\n and (\\s. \\cap \\ set cs. s \\ cap)\n and (\\s. \\cap \\ set cs. is_cnode_cap cap \\\n (\\r\\cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \\\n decode_cnode_invocation mi args cap cs\n \\valid_cnode_inv\\,-\"\n apply (rule decode_cnode_cases2[where args=args and exs=cs and label=mi])\n \\ \\Move/Insert\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE\n split del: if_split)\n apply (wp lsfco_cte_at ensure_no_children_wp whenE_throwError_wp\n | simp add: split_beta split del: if_split\n | (fold validE_R_def)[1])+\n apply (rule cap_derive_not_null_helper2)\n apply (simp only: imp_conjR)\n apply ((wp derive_cap_is_derived\n derive_cap_valid_cap\n derive_cap_zobjrefs derive_cap_objrefs_iszombie\n | wp (once) hoare_drop_imps)+ )[1]\n apply (wp whenE_throwError_wp | wpcw)+\n apply simp\n apply (rule_tac Q=\"\\src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x\n and zombies_final and valid_objs\n and real_cte_at src_slot and real_cte_at x\n and cte_wp_at (\\c. c = src_cap) src_slot\n and cte_wp_at ((=) cap.NullCap) x\"\n in hoare_post_imp)\n apply (clarsimp simp: cte_wp_at_caps_of_state all_rights_def)\n apply (simp add: cap_master_update_cap_data weak_derived_update_cap_data\n cap_asid_update_cap_data\n update_cap_data_validI update_cap_objrefs)\n apply (strengthen cap_badge_update_cap_data)\n apply simp\n apply (frule (1) caps_of_state_valid_cap)\n apply (case_tac \"is_zombie r\")\n apply (clarsimp simp add: valid_cap_def2 update_cap_data_def\n is_cap_simps\n split: if_split_asm)\n apply (frule(2) zombies_final_helper [OF caps_of_state_cteD[simplified cte_wp_at_eq_simp]])\n apply (clarsimp simp: valid_cap_def2 cte_wp_at_caps_of_state)\n apply (rule conjI, clarsimp+)+\n\n apply (fastforce simp: is_untyped_update_cap_data\n weak_derived_update_cap_data[OF _ weak_derived_refl])\n apply (wp get_cap_cte_wp_at ensure_empty_cte_wp_at)+\n apply simp\n apply (clarsimp simp: invs_def valid_state_def valid_pspace_def)\n \\ \\Revoke\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp\n | simp add: split_beta validE_R_def[symmetric])+\n apply clarsimp\n \\ \\Delete\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp\n | simp add: split_beta validE_R_def[symmetric])+\n apply clarsimp\n \\ \\Save\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (rule hoare_pre)\n apply (wp ensure_empty_stronger whenE_throwError_wp\n lsfco_cte_at lookup_slot_for_cnode_op_cap_to\n hoare_vcg_const_imp_lift\n | simp add: split_beta\n | wp (once) hoare_drop_imps)+\n apply clarsimp\n \\ \\CancelBadgedSends\\\n apply (simp add: decode_cnode_invocation_def\n unlessE_def whenE_def\n split del: if_split)\n apply (wp get_cap_wp hoare_vcg_all_lift_R | simp add: )+\n apply (rule_tac Q'=\"\\rv. invs and cte_wp_at (\\_. True) rv\" in hoare_post_imp_R)\n apply (wp lsfco_cte_at)\n apply (clarsimp simp: cte_wp_valid_cap invs_valid_objs has_cancel_send_rights_ep_cap)+\n \\ \\Rotate\\\n apply (simp add: decode_cnode_invocation_def split_def\n whenE_def unlessE_def)\n apply (rule hoare_pre)\n apply (wp get_cap_wp ensure_empty_stronger | simp)+\n apply (rule_tac Q'=\"\\rv s. real_cte_at rv s \\ real_cte_at x s\n \\ real_cte_at src_slot s\n \\ ex_cte_cap_wp_to is_cnode_cap rv s\n \\ ex_cte_cap_wp_to is_cnode_cap x s\n \\ invs s\" in hoare_post_imp_R)\n apply wp+\n apply (clarsimp simp: cte_wp_at_caps_of_state\n dest!: real_cte_at_cte del: impI)\n apply (frule invs_valid_objs)\n apply (simp add: update_cap_data_validI weak_derived_update_cap_data\n caps_of_state_valid_cap)\n subgoal by (auto,(clarsimp simp:is_cap_simps update_cap_data_def)+)[1](* Bad practise *)\n apply wp+\n apply clarsimp\n apply (elim disjE exE conjE,\n simp_all add: decode_cnode_invocation_def validE_R_def\n split_def unlessE_whenE\n split: list.split_asm\n split del: if_split)\n apply (wp | simp)+\n done\n\nend\n\n\nlemma decode_cnode_inv_inv[wp]:\n \"\\P\\ decode_cnode_invocation mi args cap cs \\\\rv. P\\\"\n unfolding decode_cnode_invocation_def\n apply (simp add: split_def unlessE_def whenE_def\n cong: if_cong split del: if_split)\n apply (rule hoare_pre)\n apply (wp hoare_drop_imps | simp | wpcw)+\n done\n\n\ndefinition\n not_recursive_cspaces :: \"'z::state_ext state \\ cslot_ptr set\"\nwhere\n \"not_recursive_cspaces s \\ {ptr. cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s}\"\n\ndefinition\n state_cte_ptrs :: \"'z::state_ext state \\ cslot_ptr set\"\nwhere\n \"state_cte_ptrs s \\ {ptr. cte_at ptr s}\"\n\nlemma fixed_length_finite:\n \"finite (UNIV :: 'a set) \\ finite {x :: 'a list. length x = n}\"\n apply (induct n)\n apply simp\n apply (subgoal_tac \"{x :: 'a list. length x = Suc n} = image (split Cons) (UNIV \\ {x. length x = n})\")\n apply clarsimp\n apply safe\n apply (case_tac x, simp_all add: image_def)\n done\n\nlemma state_cte_ptrs_finite:\n \"finite (state_cte_ptrs s)\"\n apply (clarsimp simp add: state_cte_ptrs_def cte_at_cases Collect_disj_eq\n Collect_conj_eq set_pair_UN tcb_cap_cases_def)\n apply (clarsimp simp: well_formed_cnode_n_def fixed_length_finite)\n done\n\nlemma cte_wp_at_set_finite:\n \"finite {p. cte_wp_at (P p) p s}\"\n apply (rule finite_subset [OF _ state_cte_ptrs_finite[where s=s]])\n apply (clarsimp simp: state_cte_ptrs_def elim!: cte_wp_at_weakenE)\n done\n\n\nlemma not_recursive_cspaces_finite:\n \"finite (not_recursive_cspaces s)\"\n unfolding not_recursive_cspaces_def\n by (rule cte_wp_at_set_finite)\n\n\nlemma set_cdt_not_recursive[wp]:\n \"\\\\s. P (not_recursive_cspaces s)\\ set_cdt f \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: set_cdt_def, wp)\n apply (simp add: not_recursive_cspaces_def)\n done\n\n\nlemma not_recursive_mdb[simp]:\n \"not_recursive_cspaces (is_original_cap_update f s) =\n not_recursive_cspaces s\"\n \"not_recursive_cspaces (cdt_update f' s) =\n not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)+\n\n\nlemma set_cap_no_new_recursive:\n \"\\\\s. x \\ not_recursive_cspaces s\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\\\n set_cap cap ptr\n \\\\rv s. x \\ not_recursive_cspaces s\\\"\n apply (simp add: not_recursive_cspaces_def)\n apply (wp set_cap_cte_wp_at_neg)\n apply (clarsimp simp: cte_wp_at_neg split: if_split)\n done\n\n\nlemma not_recursive_set_cap_shrinks:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\n \\ ptr \\ fst_cte_ptrs cap\\\n set_cap cap ptr\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (rule shrinks_proof[where x=ptr])\n apply (rule not_recursive_cspaces_finite)\n apply (wp set_cap_no_new_recursive)\n apply simp\n apply (simp add: not_recursive_cspaces_def)\n apply (wp set_cap_cte_wp_at_neg)\n apply (clarsimp elim!: cte_wp_at_weakenE)\n apply (simp add: not_recursive_cspaces_def)\n done\n\n\nlemma not_recursive_set_cap_doesn't_grow:\n \"\\\\s. card (not_recursive_cspaces s) < n\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\\\n set_cap cap ptr\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (rule doesn't_grow_proof)\n apply (rule not_recursive_cspaces_finite)\n apply (rule set_cap_no_new_recursive)\n done\n\n\nlemma final_cap_duplicate_obj_ref:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ obj_refs cap1; p1 \\ p2 \\ \\ x \\ obj_refs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\n\nlemma final_cap_duplicate_irq:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ cap_irqs cap1; p1 \\ p2 \\ \\ x \\ cap_irqs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\nlemma final_cap_duplicate_arch_refs:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ arch_gen_refs cap1; p1 \\ p2 \\ \\ x \\ arch_gen_refs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\n\nlemma fst_cte_ptrs_link_obj_refs:\n \"x \\ fst_cte_ptrs cap \\ fst x \\ obj_refs cap\"\n by (case_tac cap, simp_all add: fst_cte_ptrs_def)\n\n\nlemma final_cap_duplicate_cte_ptr:\n \"\\ fst (get_cap p s) = {(cap, s)}; fst (get_cap p' s) = {(cap', s)}; is_final_cap' cap s;\n x \\ fst_cte_ptrs cap; p \\ p' \\ \\ x \\ fst_cte_ptrs cap'\"\n apply (drule(2) final_cap_duplicate_obj_ref)\n apply (erule fst_cte_ptrs_link_obj_refs)\n apply assumption\n apply (clarsimp simp: fst_cte_ptrs_link_obj_refs)\n done\n\nlemma not_recursive_cspaces_more_update[iff]:\n \"not_recursive_cspaces (trans_state f s) = not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)\n\nlemma cap_swap_not_recursive:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. is_final_cap' cap s\n \\ p1 \\ fst_cte_ptrs cap) p2 s\n \\ cte_wp_at ((=) c1) p1 s\n \\ cte_wp_at ((=) c2) p2 s\n \\ p1 \\ p2\\\n cap_swap c1 p1 c2 p2\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (cases \"p1 = p2\", simp_all)\n apply (simp add: cap_swap_def set_cdt_def when_def)\n apply (rule hoare_vcg_precond_imp)\n apply (wp | simp)+\n apply (rule not_recursive_set_cap_doesn't_grow)\n apply (wp not_recursive_set_cap_shrinks set_cap_cte_wp_at' get_cap_wp hoare_vcg_disj_lift)\n apply (clarsimp simp: cte_wp_at_def)\n apply (frule(3) final_cap_duplicate_cte_ptr)\n apply simp\n apply (case_tac c2, simp_all add: fst_cte_ptrs_def)\n done\n\n\nlemma cap_swap_fd_not_recursive:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. is_final_cap' cap s\n \\ p1 \\ fst_cte_ptrs cap) p2 s\n \\ p1 \\ p2\\\n cap_swap_for_delete p1 p2\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n unfolding cap_swap_for_delete_def\n by (wpsimp wp: cap_swap_not_recursive get_cap_wp)\n\n\nlemma set_mrs_typ_at [wp]:\n \"\\\\s. P (typ_at T p s)\\ set_mrs p' b m \\\\rv s. P (typ_at T p s)\\\"\n apply (simp add: set_mrs_def bind_assoc set_object_def get_object_def)\n apply (cases b)\n apply simp\n apply wp\n apply clarsimp\n apply (drule get_tcb_SomeD)\n apply (clarsimp simp: obj_at_def)\n apply (clarsimp simp: zipWithM_x_mapM split_def\n split del: if_split)\n apply (wp mapM_wp')\n apply clarsimp\n apply (drule get_tcb_SomeD)\n apply (clarsimp simp: obj_at_def)\n done\n\n\nlemma cte_wp_and:\n \"cte_wp_at (P and Q) c s = (cte_wp_at P c s \\ cte_wp_at Q c s)\"\n by (auto simp: cte_wp_at_def)\n\n\ncrunch cte_wp_at[wp]: get_mrs \"cte_wp_at P c\"\n (wp: crunch_wps simp: crunch_simps)\n\n\nlemmas cte_wp_and' = cte_wp_and [unfolded pred_conj_def]\n\n\nlemma in_pspace_typ_at:\n \"r \\ dom (kheap s) = (\\T. \\ typ_at T r s)\"\n apply (simp add: dom_def)\n apply (subst simp_thms(2)[symmetric])\n apply (fastforce simp: obj_at_def)\n done\n\nlemma prepare_thread_delete_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n prepare_thread_delete t\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp prepare_thread_delete_caps_of_state)\n done\n\n\nlemma suspend_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n IpcCancel_A.suspend t\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp suspend_caps_of_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rsubst[where P=P])\n apply (intro set_eqI iffI)\n apply (clarsimp simp: fst_cte_ptrs_def)\n apply clarsimp\n apply (clarsimp simp: fst_cte_ptrs_def can_fast_finalise_def\n split: cap.split_asm)\n done\n\n\nlemma unbind_notification_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n unbind_notification tcb\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp unbind_notification_caps_of_state)\n done\n\n\nlemma get_cap_det2:\n \"(r, s') \\ fst (get_cap p s) \\ get_cap p s = ({(r, s)}, False) \\ s' = s\"\n apply (rule conjI)\n apply (erule get_cap_det)\n apply (erule use_valid [OF _ get_cap_inv])\n apply simp\n done\n\n\nlemma set_zombie_not_recursive:\n \"\\\\s. cte_wp_at (\\c. fst_cte_ptrs c = fst_cte_ptrs (cap.Zombie p zb n)) slot s\n \\ P (not_recursive_cspaces s)\\\n set_cap (cap.Zombie p zb n) slot\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def)\n apply (rule set_preserved_proof[where P=P])\n apply simp_all\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift set_cap_cte_wp_at)\n apply (fastforce simp: cte_wp_at_def fst_cte_ptrs_def)\n apply (simp only: cte_wp_at_neg imp_conv_disj de_Morgan_conj simp_thms)\n apply (wp hoare_vcg_ex_lift valid_cte_at_neg_typ[OF set_cap_typ_at]\n hoare_vcg_disj_lift set_cap_cte_wp_at)\n apply (fastforce simp: fst_cte_ptrs_def cte_wp_at_def)\n done\n\ndefinition\n rdcall_finalise_ord_lift :: \"((cslot_ptr \\ 'z state) \\ (cslot_ptr \\ 'z state)) set\n \\ ((rec_del_call \\ 'z state) \\ (rec_del_call \\ 'z state)) set\"\nwhere\n \"rdcall_finalise_ord_lift S \\\n (\\(x, s). case x of CTEDeleteCall a b \\ 3 | FinaliseSlotCall a b \\ 2\n | ReduceZombieCall cap a b \\ 1)\n <*mlex*>\n ((map_prod (\\(x, s). (FinaliseSlotCall x True, s)) (\\(x, s). (FinaliseSlotCall x True, s)) ` S)\n \\ (map_prod (\\(x, s). (FinaliseSlotCall x False, s)) (\\(x, s). (FinaliseSlotCall x False, s)) ` S))\"\n\n\nlemma wf_rdcall_finalise_ord_lift:\n \"wf S \\ wf (rdcall_finalise_ord_lift S)\"\n unfolding rdcall_finalise_ord_lift_def\n by (auto intro!: wf_mlex wf_Un wf_map_prod_image inj_onI)\n\n\ndefinition\n rec_del_recset :: \"((rec_del_call \\ 'z::state_ext state) \\ (rec_del_call \\ 'z::state_ext state)) set\"\nwhere\n \"rec_del_recset \\\n wf_sum (exposed_rdcall \\ fst)\n (rdcall_finalise_ord_lift (inv_image\n (less_than <*lex*> less_than)\n (\\(x, s). case caps_of_state s x of\n Some cap.NullCap \\ (0, 0)\n | Some (cap.Zombie p zb n) \\\n (if fst_cte_ptrs (cap.Zombie p zb n) = {x} then 1 else 2, n)\n | _ \\ (3, 0))))\n (rdcall_finalise_ord_lift (measure (\\(x, s). card (not_recursive_cspaces s))))\"\n\n\nlemma rec_del_recset_wf: \"wf rec_del_recset\"\n unfolding rec_del_recset_def\n by (intro wf_sum_wf wf_rdcall_finalise_ord_lift wf_measure\n wf_inv_image wf_lex_prod wf_less_than)\n\n\nlemma in_get_cap_cte_wp_at:\n \"(rv, s') \\ fst (get_cap p s) = (s = s' \\ cte_wp_at ((=) rv) p s)\"\n apply (rule iffI)\n apply (clarsimp dest!: get_cap_det2 simp: cte_wp_at_def)\n apply (clarsimp simp: cte_wp_at_def)\n done\n\n\nlemma fst_cte_ptrs_first_cte_of:\n \"fst_cte_ptrs (cap.Zombie ptr zb n) = {first_cslot_of (cap.Zombie ptr zb n)}\"\n by (simp add: fst_cte_ptrs_def tcb_cnode_index_def)\n\n\nlemma final_cap_still_at:\n \"\\\\s. cte_wp_at (\\c. gen_obj_refs cap = gen_obj_refs c\n \\ P cap (is_final_cap' c s)) ptr s\\\n set_cap cap ptr\n \\\\rv s. cte_wp_at (\\c. P c (is_final_cap' c s)) ptr s\\\"\n apply (simp add: is_final_cap'_def2 cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp elim!: rsubst[where P=\"P cap\"])\n apply (intro ext arg_cong[where f=Ex] arg_cong[where f=All])\n apply (case_tac \"(aa, ba) = ptr\", simp_all add: gen_obj_refs_def)\n done\n\n\nlemma suspend_thread_cap:\n \"\\\\s. caps_of_state s x = Some (cap.ThreadCap p)\\\n IpcCancel_A.suspend t\n \\\\rv s. caps_of_state s x = Some (cap.ThreadCap p)\\\"\n apply (rule hoare_chain)\n apply (rule suspend_cte_wp_at_preserved\n [where p=x and P=\"(=) (cap.ThreadCap p)\"])\n apply (clarsimp simp add: can_fast_finalise_def)\n apply (simp add: cte_wp_at_caps_of_state)+\n done\n\n\nlemma emptyable_irq_state_independent[intro!, simp]:\n \"emptyable x (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = emptyable x s\"\n by (auto simp: emptyable_def)\n\nlemma not_recursive_cspaces_irq_state_independent[intro!, simp]:\n \"not_recursive_cspaces (s \\ machine_state := machine_state s \\ irq_state := f (irq_state (machine_state s)) \\ \\)\n = not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)\n\ncontext CNodeInv_AI begin\n\nlemma rec_del_termination:\n \"All (rec_del_dom :: rec_del_call \\ 'state_ext state \\ bool)\"\n apply (rule rec_del.termination,\n rule rec_del_recset_wf,\n simp_all add: rec_del_recset_def wf_sum_def\n in_monad is_final_cap_def\n is_zombie_def rdcall_finalise_ord_lift_def\n mlex_prod_def,\n drule in_preempt)\n apply (case_tac exposed, simp_all)\n apply (rule disjI1, rule map_prod_split_imageI)\n apply (simp only: trans_state_update'[symmetric])\n apply (clarsimp)\n apply (case_tac aa, simp_all add: fail_def rec_del.psimps)[1]\n apply (rename_tac word option nat)\n apply (case_tac nat, simp_all)[1]\n apply (clarsimp simp: in_monad rec_del.psimps)\n apply (clarsimp simp: in_monad in_get_cap_cte_wp_at\n cte_wp_at_caps_of_state rec_del.psimps\n split: if_split_asm)\n apply (erule use_valid [OF _ set_cap_caps_of_state])+\n apply (simp add: fst_cte_ptrs_first_cte_of cong: if_cong)\n apply (case_tac rv, simp_all)[1]\n apply (clarsimp simp: in_monad fst_cte_ptrs_first_cte_of)\n apply (case_tac new_cap, simp_all add: is_cap_simps)[1]\n apply (case_tac rv, simp_all)[1]\n apply (clarsimp simp: fst_cte_ptrs_first_cte_of)\n apply (case_tac rv, simp_all)[1]\n apply (clarsimp simp: fst_cte_ptrs_first_cte_of in_monad)\n apply (rule disjI2, rule map_prod_split_imageI)\n apply clarsimp\n apply (case_tac aa, simp_all add: fail_def rec_del.psimps)[1]\n apply (rename_tac word option nat)\n apply (case_tac nat, simp_all)\n apply (simp only: trans_state_update'[symmetric] not_recursive_cspaces_more_update)\n apply (clarsimp simp: in_monad prod_eqI rec_del.psimps)\n apply (erule use_valid [OF _ cap_swap_fd_not_recursive])\n apply (frule use_valid [OF _ get_cap_cte_wp_at], simp)\n apply (drule in_inv_by_hoareD [OF get_cap_inv])\n apply clarsimp\n apply (erule use_valid [OF _ hoare_vcg_conj_lift [OF set_zombie_not_recursive\n final_cap_still_at]])\n apply (frule use_valid [OF _ finalise_cap_cases])\n apply (fastforce simp add: cte_wp_at_eq_simp)\n apply clarsimp\n apply (case_tac rv, simp_all add: fst_cte_ptrs_def)\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state\n fst_cte_ptrs_def\n split: if_split_asm)\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state\n fst_cte_ptrs_def\n split: if_split_asm)\n apply (frule(1) use_valid [OF _ unbind_notification_caps_of_state],\n frule(1) use_valid [OF _ suspend_thread_cap],\n frule(1) use_valid [OF _ prepare_thread_delete_thread_cap])\n apply clarsimp\n apply (erule use_valid [OF _ prepare_thread_delete_not_recursive])\n apply (erule use_valid [OF _ suspend_not_recursive])\n apply (erule use_valid [OF _ unbind_notification_not_recursive])\n apply simp\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state\n fst_cte_ptrs_def zombie_cte_bits_def\n tcb_cnode_index_def\n split: option.split_asm)\n done\n\nlemma rec_del_dom: \"\\ (p :: rec_del_call \\ 'state_ext state). rec_del_dom p\"\n using rec_del_termination by blast\n\nlemmas rec_del_simps = rec_del.psimps[OF rec_del_dom]\n\nlemmas rec_del_simps_ext =\n rec_del_simps [THEN ext[where f=\"rec_del args\" for args]]\n\nlemmas rec_del_fails = spec_validE_fail rec_del_simps_ext(5-)\n\ndeclare assertE_wp[wp]\ndeclare unlessE_wp[wp_split]\n\nlemma without_preemption_wp [wp_split]:\n \"\\P\\ f \\Q\\ \\ \\P\\ without_preemption f \\Q\\,\\E\\\"\n by simp\n\nlemmas rec_del_induct = rec_del.pinduct[OF rec_del_dom]\n\nlemma rec_del_preservation':\n fixes s :: \"'state_ext state\"\n fixes P :: \"'state_ext state \\ bool\"\n assumes wp:\n \"\\sl1 sl2. \\P\\ cap_swap_for_delete sl1 sl2 \\\\rv. P\\\"\n \"\\sl cap. \\P\\ set_cap sl cap \\\\rv. P\\\"\n \"\\sl opt. \\P\\ empty_slot sl opt \\\\rv. P\\\"\n \"\\cap fin. \\P\\ finalise_cap cap fin \\\\rv. P\\\"\n \"\\cap fin. \\P\\ preemption_point \\\\rv. P\\\"\n shows\n \"s \\ \\P\\ rec_del call \\\\_. P\\, \\\\_. P\\\"\nproof (induct rule: rec_del_induct)\n case (1 slot exposed s)\n show ?case\n apply (subst rec_del_simps)\n apply (simp only: split_def)\n apply wp\n apply (wp wp)[1]\n apply (rule spec_strengthen_postE)\n apply (rule \"1.hyps\")\n apply simp\n done\nnext\n case (2 slot exposed s)\n show ?case\n apply (subst rec_del_simps)\n apply (simp only: split_def)\n apply (wp wp \"2.hyps\")\n apply (wp wp)[1]\n apply (simp only: simp_thms)\n apply (rule \"2.hyps\", assumption+)\n apply (wp wp hoare_drop_imps | simp add: is_final_cap_def)+\n done\nnext\n case 3\n show ?case\n apply (simp add: rec_del_simps | wp wp)+\n done\nnext\n case (4 ptr bits n slot s)\n show ?case\n apply (subst rec_del_simps)\n apply (wp wp)\n apply (wp hoare_drop_imps)[1]\n apply (simp only: simp_thms)\n apply (rule \"4.hyps\", assumption+)\n apply wp\n done\nqed (auto simp: rec_del_dom rec_del_fails)\n\nlemmas rec_del_preservation[crunch_rules] =\n validE_valid [OF use_spec(2) [OF rec_del_preservation']]\n\nend\n\n\ncrunch typ_at: cap_swap_for_delete \"\\s. P (typ_at T p s)\"\n\nlemma cap_swap_valid_cap:\n \"\\valid_cap c\\ cap_swap_for_delete x y \\\\_. valid_cap c\\\"\n apply(simp add: cap_swap_for_delete_def)\n apply(wp cap_swap_valid_cap)\n apply(simp)\n done\n\n\nlemma cap_swap_cte_at:\n \"\\cte_at p\\ cap_swap_for_delete x y \\\\_. cte_at p\\\"\n apply(simp add: cap_swap_for_delete_def)\n apply(wp cap_swap_cte_at)\n apply(simp)\n done\n\n\ncontext CNodeInv_AI begin\n\ncrunch typ_at: rec_del \"\\s::'state_ext state. P (typ_at T p s)\"\n (ignore: preemption_point wp: preemption_point_inv)\n\nlemma rec_del_cte_at:\n \"\\c call. \\cte_at c :: 'state_ext state \\ bool\\ rec_del call \\\\_. cte_at c\\\"\n by (wp valid_cte_at_typ rec_del_typ_at)\n\nend\n\n\nlemma dom_valid_cap[wp]:\n \"\\valid_cap c\\ do_machine_op f \\\\_. valid_cap c\\\"\n apply (simp add: do_machine_op_def split_def)\n apply (wp select_wp)\n apply simp\n done\n\n\nlemma dom_cte_at:\n \"\\cte_at c\\ do_machine_op f \\\\_. cte_at c\\\"\n apply (simp add: do_machine_op_def split_def)\n apply (wp select_wp)\n apply (simp add: cte_at_cases)\n done\n\n\nlemma cnode_to_zombie_valid:\n \"\\ s \\ cap.CNodeCap oref bits guard \\\n \\ s \\ cap.Zombie oref (Some bits) (2 ^ bits)\"\n by (clarsimp simp: valid_cap_def cap_table_at_cte_at\n word_unat_power cap_aligned_def)\n\n\nlemma tcb_to_zombie_valid:\n \"\\ s \\ cap.ThreadCap t \\\n \\ s \\ cap.Zombie t None 5\"\n apply (simp add: valid_cap_def)\n apply (simp add: cap_aligned_def)\n done\n\n\nlemmas do_machine_op_cte_at [wp] = dom_cte_at\n\n\ndeclare set_cap_cte_at[wp]\n set_cap_valid_cap [wp]\n\n\nlemma set_original_valid_pspace:\n \"\\valid_pspace\\ set_original p v \\\\rv. valid_pspace\\\"\n apply wp\n apply (erule valid_pspace_eqI)\n apply simp\n done\n\n\nlocale mdb_swap_abs_invs = mdb_swap_abs +\n fixes cs cs' cap cap' scap dcap\n defines \"cs \\ caps_of_state s\"\n defines \"cs' \\ cs (src \\ dcap, dest \\ scap)\"\n\n assumes cap: \"cs src = Some cap\"\n assumes cap': \"cs dest = Some cap'\"\n\n assumes sder: \"weak_derived scap cap\"\n assumes dder: \"weak_derived dcap cap'\"\n\n\nlemma obj_ref_untyped_empty [simp]:\n \"obj_refs c \\ untyped_range c = {}\"\n by (cases c, auto)\n\nlemma weak_derived_Reply_eq:\n \"\\ weak_derived c c'; c = ReplyCap t m R \\ \\ (\\ R'. (c' = cap.ReplyCap t m R'))\"\n \"\\ weak_derived c c'; c' = ReplyCap t m R\\ \\ (\\ R'. (c = cap.ReplyCap t m R' ))\"\n by (auto simp: weak_derived_def copy_of_def\n same_object_as_def is_cap_simps\n split: if_split_asm cap.split_asm)\n\n\ncontext mdb_swap_abs_invs begin\n\nlemmas src_ranges [simp] = weak_derived_ranges [OF sder]\nlemmas dest_ranges [simp] = weak_derived_ranges [OF dder]\n\n\nlemma no_mloop_n:\n \"no_mloop n\"\n by (simp add: no_mloop_def parency)\n\n\nlemma mdb_cte_n:\n \"mdb_cte_at (\\p. \\c. cs' p = Some c \\ cap.NullCap \\ c) n\"\nproof -\n from valid_mdb\n have \"mdb_cte_at (\\p. \\c. cs p = Some c \\ cap.NullCap \\ c) m\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap' sder dder\n apply (clarsimp simp add: mdb_cte_at_def)\n apply (cases src, cases dest)\n apply (simp add: n_def n'_def cs'_def split: if_split_asm)\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n done\nqed\n\n\nlemma descendants_no_loop [simp]:\n \"x \\ descendants_of x m\"\n by (simp add: descendants_of_def)\n\n\nlemma untyped_mdb_n:\n \"untyped_mdb n cs'\"\nproof -\n from valid_mdb\n have \"untyped_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap'\n by (simp add: untyped_mdb_def cs'_def descendants_of_def parency\n s_d_swap_def\n del: split_paired_All)\nqed\n\n\nlemma descendants_inc_n:\n shows \"descendants_inc n cs'\"\nproof -\n from valid_mdb\n have \"descendants_inc m cs\"\n by (simp add:cs_def m valid_mdb_def2)\n thus ?thesis using cap cap' sder dder\n apply (simp add:descendants_inc_def descendants_of_def del: split_paired_All)\n apply (intro impI allI)\n apply (simp add:parency cs'_def del:split_paired_All)\n apply (drule spec)+\n apply (erule(1) impE)\n apply (simp add: weak_derived_cap_range)\n apply (intro conjI impI)\n apply (simp add:s_d_swap_other)+\n done\n qed\n\n\nlemma untyped_inc_n:\n assumes untyped_eq:\"(is_untyped_cap cap \\ scap = cap)\" \"(is_untyped_cap cap' \\ dcap = cap')\"\n shows \"untyped_inc n cs'\"\nproof -\n from valid_mdb\n have \"untyped_inc m cs\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap'\n apply (simp add: untyped_inc_def cs'_def descendants_of_def parency s_d_swap_def\n del: split_paired_All)\n apply (intro allI)\n apply (intro conjI)\n apply (intro impI allI)\n apply (intro conjI)\n apply (drule_tac x = p in spec)\n apply (drule_tac x = p' in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI allI)\n apply (drule_tac x = p' in spec)\n apply (drule_tac x = dest in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI)\n apply (intro conjI)\n apply (intro impI allI)\n apply (drule_tac x = src in spec)\n apply (intro conjI)\n apply (drule_tac x = dest in spec)\n apply (clarsimp simp:untyped_eq)\n apply (drule_tac x = p' in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI allI)\n apply (intro conjI)\n apply (drule_tac x = dest in spec)\n apply (drule_tac x = p in spec)\n apply (clarsimp simp:untyped_eq)\n apply (drule_tac x = src in spec)\n apply (drule_tac x = p in spec)\n apply (clarsimp simp:untyped_eq)\n done\nqed\n\n\nlemmas src_replies[simp] = weak_derived_replies [OF sder]\n\nlemmas dest_replies[simp] = weak_derived_replies [OF dder]\n\n\nlemma reply_caps_mdb_n:\n \"reply_caps_mdb n cs'\"\nproof -\n from valid_mdb\n have \"reply_caps_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2 reply_mdb_def)\n thus ?thesis using cap cap' unfolding reply_caps_mdb_def cs'_def n_def n'_def\n apply (intro allI impI)\n apply (simp split: if_split_asm del: split_paired_All split_paired_Ex)\n apply (elim allE)\n apply (drule weak_derived_Reply_eq(1) [OF sder], simp del: split_paired_Ex)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF dder])\n apply (erule exEI, clarsimp)\n apply (elim allE)\n apply (drule weak_derived_Reply_eq(1) [OF dder], simp del: split_paired_Ex)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF sder])\n apply (erule exEI, clarsimp)\n apply (erule_tac x=ptr in allE, erule_tac x=t in allE)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF dder])\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF sder])\n apply fastforce\n done\nqed\n\n\nlemma reply_masters_mdb_n:\n \"reply_masters_mdb n cs'\"\nproof -\n from valid_mdb\n have r: \"reply_masters_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2 reply_mdb_def)\n have n_None:\n \"\\t R. scap = cap.ReplyCap t True R \\ n dest = None\"\n \"\\t R. dcap = cap.ReplyCap t True R \\ n src = None\"\n using r cap cap' unfolding reply_masters_mdb_def n_def\n by (drule_tac weak_derived_Reply_eq(1) [OF sder]\n weak_derived_Reply_eq(1) [OF dder],\n fastforce simp: n'_def simp del: split_paired_All)+\n show ?thesis unfolding reply_masters_mdb_def cs'_def using cap cap' r\n apply (intro allI impI)\n apply (simp add: n_None descendants s_d_swap_def\n split: if_split_asm del: split_paired_All)\n apply (unfold reply_masters_mdb_def)[1]\n apply (drule weak_derived_Reply_eq(1) [OF sder], simp del: split_paired_All)\n apply (elim allE, erule impE, fastforce, elim conjE)\n apply (intro impI conjI)\n apply (drule(1) bspec)\n apply clarsimp\n apply (rule weak_derived_Reply_eq(2) [OF dder])\n apply simp\n apply fastforce\n apply fastforce\n apply (unfold reply_masters_mdb_def)[1]\n apply (drule weak_derived_Reply_eq(1) [OF dder], simp del: split_paired_All)\n apply (elim allE, erule impE, fastforce, elim conjE)\n apply (intro impI conjI)\n apply (drule(1) bspec, clarsimp, rule weak_derived_Reply_eq(2) [OF sder], simp)\n apply fastforce+\n apply (unfold reply_masters_mdb_def)[1]\n apply (erule_tac x=ptr in allE, erule_tac x=t in allE)\n apply (elim allE impE, fastforce)\n apply (erule conjE, simp add: n_def n'_def)\n apply (fastforce intro:weak_derived_Reply_eq(2)[OF dder] weak_derived_Reply_eq(2)[OF sder])+\n done\nqed\n\n\nlemma reply_mdb_n:\n \"reply_mdb n cs'\"\n by (simp add: reply_mdb_def reply_masters_mdb_n reply_caps_mdb_n)\n\nend\n\n\ndefinition\n \"swap_mdb m src dest \\\n let n' = (\\n. if m n = Some src then Some dest\n else if m n = Some dest then Some src\n else m n) in\n n' (src := n' dest, dest := n' src)\"\n\nlemma cap_swap_mdb [wp]:\n \"\\valid_mdb and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c) a and\n cte_wp_at (weak_derived c') b and K (a \\ b) and cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c') b\\\n cap_swap c a c' b\n \\\\_. valid_mdb\\\"\n apply (simp add: valid_mdb_def2 cap_swap_def set_cdt_def bind_assoc set_original_def)\n apply (wp | simp del: fun_upd_apply split del: if_split)+\n apply (fold swap_mdb_def [simplified Let_def])\n apply (wp set_cap_caps_of_state2 get_cap_wp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state simp del: fun_upd_apply)\n apply (subgoal_tac \"mdb_swap_abs_invs (cdt s) a b s cap capb c c'\")\n prefer 2\n apply (rule mdb_swap_abs_invs.intro)\n apply (rule mdb_swap_abs.intro)\n apply (simp add: valid_mdb_def2)\n apply (fastforce simp: cte_wp_at_caps_of_state)\n apply (fastforce simp: cte_wp_at_caps_of_state)\n apply (rule refl)\n apply assumption\n apply (erule (3) mdb_swap_abs_invs_axioms.intro)\n apply (unfold swap_mdb_def Let_def)\n apply (simp add: mdb_swap_abs_invs.no_mloop_n\n mdb_swap_abs_invs.untyped_mdb_n\n mdb_swap_abs_invs.mdb_cte_n\n mdb_swap_abs_invs.reply_mdb_n\n del: fun_upd_apply\n split del: if_split)\n apply (rule conjI)\n apply (erule mdb_swap_abs_invs.descendants_inc_n)\n apply (rule conjI)\n apply (erule mdb_swap_abs_invs.untyped_inc_n)\n apply (clarsimp simp:cte_wp_at_caps_of_state)+\n apply (rule conjI)\n apply (simp add: ut_revocable_def weak_derived_ranges del: split_paired_All)\n apply (rule conjI)\n apply (simp add: irq_revocable_def del: split_paired_All)\n apply (intro conjI impI allI)\n apply (simp del: split_paired_All)\n apply (simp del: split_paired_All)\n apply (simp add: reply_master_revocable_def weak_derived_replies\n del: split_paired_All)\n apply (clarsimp simp: valid_arch_mdb_cap_swap)\n done\n\n\nlemma set_cdt_valid_objs[wp]:\n \"\\valid_objs\\ set_cdt m \\\\rv. valid_objs\\\"\n by (simp add: set_cdt_def | wp)+\n\n\nlemma cap_swap_valid_objs[wp]:\n \"\\valid_objs and valid_cap c and valid_cap c'\n and tcb_cap_valid c b and tcb_cap_valid c' a\\\n cap_swap c a c' b\n \\\\rv. valid_objs\\\"\n apply (simp add: cap_swap_def)\n apply (wp set_cap_valid_objs\n | simp split del: if_split)+\n done\n\n\ncrunch aligned[wp]: cap_swap \"pspace_aligned\"\n\ncrunch disctinct[wp]: cap_swap \"pspace_distinct\"\n\n\nlemma cap_swap_iflive[wp]:\n \"\\if_live_then_nonz_cap and cte_wp_at (\\x. zobj_refs x = zobj_refs c) a\n and cte_wp_at (\\x. zobj_refs x = zobj_refs c') b\\\n cap_swap c a c' b\n \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: cap_swap_def)\n apply (wp | simp split del: if_split)+\n apply (rule hoare_post_imp)\n apply (simp only: if_live_then_nonz_cap_def ex_nonz_cap_to_def\n cte_wp_at_caps_of_state imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_ex_lift\n get_cap_wp)+\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (frule(1) if_live_then_nonz_capD)\n apply assumption\n apply (clarsimp simp: ex_nonz_cap_to_def cte_wp_at_caps_of_state)\n apply (subst split_paired_Ex[symmetric])\n apply (rule_tac x=\"if (aa, ba) = a then b else if (aa, ba) = b then a else (aa, ba)\"\n in exI)\n apply (clarsimp | rule conjI)+\n done\n\n\nlemma cap_swap_fd_iflive[wp]:\n \"\\if_live_then_nonz_cap\\\n cap_swap_for_delete a b\n \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma set_cdt_caps_of[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_cdt m \\\\rv s. P (caps_of_state s)\\\"\n by wp\n\n\nlemma cap_swap_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\n and cte_wp_at (\\x. cte_refs x = cte_refs c\n \\ ((\\y. cte_refs x y \\ {}) \\ P x = P c)) a\n and cte_wp_at (\\x. cte_refs x = cte_refs c'\n \\ ((\\y. cte_refs x y \\ {}) \\ P x = P c')) b\\\n cap_swap c a c' b\n \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: cap_swap_def ex_cte_cap_wp_to_def\n cte_wp_at_caps_of_state\n del: split_paired_Ex)\n apply (wp get_cap_wp | simp split del: if_split del: split_paired_Ex)+\n apply (simp del: split_paired_Ex | intro allI impI | erule conjE)+\n apply (erule exfEI [where f=\"id ( a := b, b := a )\"])\n apply (clarsimp simp: cte_wp_at_caps_of_state | rule conjI)+\n done\n\n\nlemma cap_swap_fd_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ cap_swap_for_delete a b \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma cap_swap_caps_of_state[wp]:\n \"\\\\s. P ((caps_of_state s) ( a := Some c', b := Some c ))\\\n cap_swap c a c' b\n \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: cap_swap_def)\n apply (wp get_cap_wp | simp del: fun_upd_apply split del: if_split)+\n done\n\n\nlemma cap_swap_fd_caps_of_state[wp]:\n \"\\\\s. P ((caps_of_state s) \\ (id ( a := b, b := a )))\\\n cap_swap_for_delete a b\n \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (cases \"a = b\")\n apply (simp add: fun_upd_def id_def[symmetric] cong: if_cong)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rsubst[where P=P])\n apply (clarsimp intro!: ext)\n done\n\n\nlemma cap_irqs_appropriateness:\n \"cap_irqs cap = cap_irqs cap'\n \\ \\cp. appropriate_cte_cap cp cap = appropriate_cte_cap cp cap'\"\n by (simp add: appropriate_cte_cap_irqs)\n\n\nlemma cap_swap_ifunsafe[wp]:\n \"\\if_unsafe_then_cap\n and ex_cte_cap_wp_to (appropriate_cte_cap c') a\n and ex_cte_cap_wp_to (appropriate_cte_cap c) b\n and cte_wp_at (\\x. cte_refs x = cte_refs c\n \\ ((\\y. cte_refs x y \\ {}) \\ cap_irqs x = cap_irqs c)) a\n and cte_wp_at (\\x. cte_refs x = cte_refs c'\n \\ ((\\y. cte_refs x y \\ {}) \\ cap_irqs x = cap_irqs c')) b\\\n cap_swap c a c' b\n \\\\rv s. if_unsafe_then_cap s\\\"\n apply (simp only: if_unsafe_then_cap_def cte_wp_at_caps_of_state\n imp_conv_disj not_ex)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift)\n apply (clarsimp split del: if_split del: disjCI intro!: disjCI2)\n apply (intro conjI)\n apply (clarsimp split: if_split_asm)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (erule ex_cte_cap_wp_to_weakenE)\n apply clarsimp\n apply (auto dest!: cap_irqs_appropriateness elim!: cte_wp_at_weakenE)\n done\n\n\nlemma cap_irqs_appropriate_strengthen:\n \"ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) x s\n \\ ex_cte_cap_wp_to (appropriate_cte_cap cap) x s\"\n by (auto simp: appropriate_cte_cap_def\n elim!: ex_cte_cap_wp_to_weakenE\n split: cap.split)\n\n\nlemma cap_swap_fd_ifunsafe[wp]:\n \"\\if_unsafe_then_cap\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) a\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) b\\\n cap_swap_for_delete a b\n \\\\rv s. if_unsafe_then_cap s\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state\n | strengthen cap_irqs_appropriate_strengthen)+\n done\n\nlemma cap_swap_zombies[wp]:\n \"\\zombies_final and cte_wp_at (\\x. is_zombie x = is_zombie c\n \\ gen_obj_refs x = gen_obj_refs c) a\n and cte_wp_at (\\x. is_zombie x = is_zombie c' \\ gen_obj_refs x = gen_obj_refs c') b\\\n cap_swap c a c' b\n \\\\rv. zombies_final\\\"\n apply (simp only: zombies_final_def final_cap_at_eq\n cte_wp_at_caps_of_state simp_thms pred_conj_def)\n apply wp\n apply (elim conjE)\n apply (erule allfEI[where f=\"id ( a := b, b := a )\"])\n apply (intro impI)\n apply (drule mp)\n apply (clarsimp split: if_split_asm)\n apply (elim exE conjE, simp only: simp_thms option.simps)\n apply (rule conjI)\n apply (clarsimp simp: is_cap_simps gen_obj_refs_def)\n apply (erule allfEI[where f=\"id ( a := b, b := a )\"])\n apply (intro impI, elim exE conjE, simp only: simp_thms option.simps gen_obj_refs_eq)\n apply (clarsimp simp: gen_obj_refs_Int split: if_split_asm)\n done\n\n\nlemma cap_swap_fd_zombies[wp]:\n \"\\zombies_final\\\n cap_swap_for_delete p p'\n \\\\rv. zombies_final\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma cap_swap_pred_tcb_at[wp]:\n \"\\pred_tcb_at proj P t\\ cap_swap c sl c' sl' \\\\rv. pred_tcb_at proj P t\\\"\n unfolding cap_swap_def by (wp | simp)+\n\n\nlemma unique_reply_caps_cap_swap:\n assumes u: \"unique_reply_caps cs\"\n and c: \"cs p = Some cap\"\n and c': \"cs p' = Some cap'\"\n and wd: \"weak_derived c cap\"\n and wd': \"weak_derived c' cap'\"\n and pneq: \"p \\ p'\"\n shows \"unique_reply_caps (cs (p \\ c', p' \\ c))\"\nproof -\n have new_cap_is_unique[elim]:\n \"\\ p'' t R R'.\\p'' \\ p; p'' \\ p'; cs p'' = Some (ReplyCap t False R);\n c = ReplyCap t False R' \\ c' = ReplyCap t False R' \\\n \\ False\"\n using u unfolding unique_reply_caps_def\n apply (erule_tac disjE)\n apply simp\n apply (frule weak_derived_Reply_eq[OF wd])\n apply (fastforce simp add:c)\n apply simp\n apply (frule weak_derived_Reply_eq[OF wd'])\n apply (fastforce simp add:c' is_cap_simps)\n done\n\n have old_caps_differ:\n \"\\t R R'.\n \\ cap= ReplyCap t False R; cap' = ReplyCap t False R' \\\n \\ False\"\n using u c c' is_cap_simps pneq unfolding unique_reply_caps_def by fastforce\n\n have new_cap_objs_differ[elim]:\n \"\\t R R'. \\ c= ReplyCap t False R; c' = ReplyCap t False R'\\ \\ False\"\n apply (drule weak_derived_Reply_eq [OF wd])\n apply (drule weak_derived_Reply_eq [OF wd'])\n using old_caps_differ by fastforce\n\n show ?thesis\n using u unfolding unique_reply_caps_def\n apply (intro allI impI)\n apply (simp split: if_split_asm del: split_paired_All)\n apply fastforce+\n done\nqed\n\n\nlemma cap_swap_no_reply_caps:\n assumes cap: \"cs p = Some cap\"\n and cap': \"cs p' = Some cap'\"\n and wd: \"weak_derived c cap\"\n and wd': \"weak_derived c' cap'\"\n and nr: \"\\sl R. cs sl \\ Some (cap.ReplyCap t False R)\"\n shows \"\\sl R. (cs(p \\ c', p' \\ c)) sl \\ Some (cap.ReplyCap t False R)\"\nproof -\n have\n \"\\ R. cap \\ cap.ReplyCap t False R\"\n \"\\ R. cap' \\ cap.ReplyCap t False R\"\n using cap cap' nr by clarsimp+\n hence\n \"\\ R. c \\ cap.ReplyCap t False R\"\n \"\\ R. c' \\ cap.ReplyCap t False R\"\n by (clarsimp,drule_tac weak_derived_Reply_eq [OF wd]\n weak_derived_Reply_eq [OF wd'],fastforce)+\n thus ?thesis\n using nr unfolding fun_upd_def\n by (clarsimp split: if_split_asm)\nqed\n\n\nlemma cap_swap_has_reply_cap_neg:\n \"\\\\s. \\ has_reply_cap t s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at (weak_derived c') p' s \\\n p \\ p'\\\n cap_swap c p c' p' \\\\rv s. \\ has_reply_cap t s\\\"\n apply (simp add: has_reply_cap_def is_reply_cap_to_def cte_wp_at_caps_of_state\n del: split_paired_All split_paired_Ex)\n apply (wp cap_swap_caps_of_state)\n apply (elim conjE exE)\n apply (drule(3) cap_swap_no_reply_caps[where cs=\"caps_of_state _\"])\n apply fastforce+\n done\n\n\nlemma cap_swap_replies:\n \"\\\\s. valid_reply_caps s\n \\ cte_wp_at (weak_derived c) p s\n \\ cte_wp_at (weak_derived c') p' s\n \\ p \\ p'\\\n cap_swap c p c' p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: valid_reply_caps_def)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_swap_has_reply_cap_neg)\n apply (clarsimp simp: fun_upd_def cte_wp_at_caps_of_state\n unique_reply_caps_cap_swap [simplified fun_upd_def])\n done\n\n\nlemma cap_swap_fd_replies[wp]:\n \"\\\\s. valid_reply_caps s\\\n cap_swap_for_delete p p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp cap_swap_replies get_cap_wp)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\nlemma cap_swap_reply_masters:\n \"\\valid_reply_masters and K(\\ is_master_reply_cap c \\ \\ is_master_reply_cap c')\\\n cap_swap c p c' p' \\\\_. valid_reply_masters\\\"\n apply (simp add: valid_reply_masters_def is_master_reply_cap_to_def cte_wp_at_caps_of_state)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_swap_caps_of_state\n cap_swap_typ_at tcb_at_typ_at)\n apply (simp add: is_cap_simps)\n apply fastforce\n done\n\n\nlemma cap_swap_fd_reply_masters[wp]:\n \"\\valid_reply_masters and\n cte_wp_at (\\c. \\ is_master_reply_cap c) p and\n cte_wp_at (\\c. \\ is_master_reply_cap c) p'\\\n cap_swap_for_delete p p'\n \\\\rv. valid_reply_masters\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp cap_swap_reply_masters get_cap_wp)\n apply (clarsimp simp: cte_wp_at_def)\n done\n\n\ncrunch refs_of[wp]: cap_swap \"\\s. P (state_refs_of s)\"\n (ignore: set_cap simp: state_refs_of_pspaceI)\n\ncrunch hyp_refs_of[wp]: cap_swap \"\\s. P (state_hyp_refs_of s)\"\n (ignore: set_cap simp: state_refs_of_pspaceI)\n\ncrunch cur_tcb[wp]: cap_swap \"cur_tcb\"\n\n\nlemma copy_of_cte_refs:\n \"copy_of cap cap' \\ cte_refs cap = cte_refs cap'\"\n apply (rule ext, clarsimp simp: copy_of_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n apply (clarsimp simp: is_cap_simps bits_of_def\n split: cap.split_asm)+\n done\n\n\nlemma copy_of_is_zombie:\n \"copy_of cap cap' \\ is_zombie cap = is_zombie cap'\"\n apply (clarsimp simp: copy_of_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n apply (clarsimp simp: is_cap_simps bits_of_def\n split: cap.split_asm)+\n done\n\n\nlemma copy_of_reply_cap:\n \"copy_of (ReplyCap t False R) cap \\ \\ R'. cap = ReplyCap t False R'\"\n apply (clarsimp simp: copy_of_def is_cap_simps)\n by (cases cap, simp_all add: same_object_as_def)\n\n\nlemma copy_of_cap_irqs:\n \"copy_of cap cap' \\ cap_irqs cap = cap_irqs cap'\"\n apply (clarsimp simp: copy_of_def cap_irqs_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n by (clarsimp simp: is_cap_simps bits_of_def cap_range_def\n split: cap.split_asm)+\n\nlemma copy_of_arch_gen_obj_refs:\n \"copy_of cap cap' \\ arch_gen_refs cap = arch_gen_refs cap'\"\n apply (clarsimp simp: copy_of_def split: if_split_asm)\n by (cases cap'; clarsimp simp: same_object_as_def is_cap_simps same_aobject_same_arch_gen_refs\n split: cap.split_asm)\n\nlemma cap_swap_valid_idle[wp]:\n \"\\valid_idle\\\n cap_swap c a c' b \\\\_. valid_idle\\\"\n apply (simp add: cap_swap_def set_cdt_def)\n apply (wp set_cap_idle set_cap_it|simp)+\n done\n\n\nlemma cap_swap_global_refs[wp]:\n \"\\valid_global_refs and\n (\\s. global_refs s \\ cap_range c = {}) and\n (\\s. global_refs s \\ cap_range c' = {})\\\n cap_swap c a c' b \\\\_. valid_global_refs\\\"\n apply (simp add: cap_swap_def set_cdt_def)\n apply (wp set_cap_globals | simp)+\n done\n\n\ncrunch arch[wp]: cap_swap \"\\s. P (arch_state s)\"\n\ncrunch irq_node[wp]: cap_swap \"\\s. P (interrupt_irq_node s)\"\n\n\nlemma valid_reply_caps_of_stateD:\n \"\\p t s R. \\ valid_reply_caps s; caps_of_state s p = Some (cap.ReplyCap t False R) \\\n \\ st_tcb_at awaiting_reply t s\"\n by (fastforce simp: valid_reply_caps_def has_reply_cap_def\n is_reply_cap_to_def cte_wp_at_caps_of_state)\n\nlemma valid_reply_caps_of_stateD':\n \"\\p t s R. \\ valid_reply_caps s; cte_wp_at (is_reply_cap_to t) p s \\\n \\ st_tcb_at awaiting_reply t s\"\n by (fastforce simp: valid_reply_caps_def has_reply_cap_def\n is_reply_cap_to_def cte_wp_at_caps_of_state)\n\ncrunch interrupt_states[wp]: cap_swap \"\\s. P (interrupt_states s)\"\n\n\nlemma weak_derived_cap_irqs:\n \"weak_derived c c' \\ cap_irqs c = cap_irqs c'\"\n by (auto simp add: weak_derived_def copy_of_cap_irqs)\n\n\nlemma cap_swap_irq_handlers[wp]:\n \"\\valid_irq_handlers and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b \\\\rv. valid_irq_handlers\\\"\n apply (simp add: valid_irq_handlers_def irq_issued_def)\n apply (rule hoare_pre)\n apply (wp hoare_use_eq [where f=interrupt_states,\n OF cap_swap_interrupt_states cap_swap_caps_of_state])\n apply (clarsimp simp: cte_wp_at_caps_of_state\n elim!: ranE split: if_split_asm\n dest!: weak_derived_cap_irqs)\n apply auto\n done\n\n\ncrunch vspace_objs [wp]: cap_swap \"valid_vspace_objs\"\n\ncrunch valid_global_objs [wp]: cap_swap \"valid_global_objs\"\n\ncrunch valid_global_vspace_mappings [wp]: cap_swap \"valid_global_vspace_mappings\"\n\ncontext CNodeInv_AI begin\n\nlemma cap_swap_valid_arch_caps[wp]:\n \"\\c a c' b.\n \\valid_arch_caps and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_swap_def)\n apply (rule hoare_pre)\n apply (subst bind_assoc[symmetric],\n rule hoare_seq_ext [rotated],\n rule swap_of_caps_valid_arch_caps)\n apply (wp | simp split del: if_split)+\n done\n\nend\n\n\ncrunch v_ker_map[wp]: cap_swap \"valid_kernel_mappings\"\n\ncrunch eq_ker_map[wp]: cap_swap \"equal_kernel_mappings\"\n\ncrunch only_idle [wp]: cap_swap only_idle\n\ncrunch pspace_in_kernel_window[wp]: cap_swap \"pspace_in_kernel_window\"\n\n\nlemma cap_swap_valid_ioc[wp]:\n \"\\\\s. valid_ioc s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at (weak_derived c') p' s\\\n cap_swap c p c' p'\n \\\\_ s. valid_ioc s\\\"\n apply (simp add: cap_swap_def valid_ioc_def cte_wp_at_caps_of_state)\n apply (wp set_cdt_cos_ioc set_cap_caps_of_state2 | simp split del: if_split)+\n apply (cases p, cases p')\n apply fastforce\n done\n\n\ncrunch machine_state[wp]: cap_swap \"\\s. P(machine_state s)\"\n\ncrunch valid_irq_states[wp]: cap_swap \"valid_irq_states\"\n\ncrunch pspace_respects_device_region[wp]: cap_swap pspace_respects_device_region\n\nlemma cap_refs_respects_device_region_original_cap[wp]:\n \"cap_refs_respects_device_region\n (s\\is_original_cap := ocp\\) = cap_refs_respects_device_region s\"\n by (simp add:cap_refs_respects_device_region_def)\n\ncontext CNodeInv_AI begin\nlemma cap_swap_cap_refs_respects_device_region[wp]:\n \"\\cap_refs_respects_device_region and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b \\\\rv. cap_refs_respects_device_region\\\"\n apply (simp add:cap_swap_def)\n apply wp\n apply (simp add: cap_refs_respects_device_region_def)\n apply (rule hoare_strengthen_post[OF CSpace_AI.set_cdt_cap_refs_respects_device_region])\n apply simp\n apply wp+\n apply (clarsimp simp add: cap_refs_respects_device_region_def cte_wp_at_caps_of_state\n cap_range_respects_device_region_def\n simp del: split_paired_All split_paired_Ex\n | (wp hoare_vcg_all_lift hoare_vcg_imp_lift)+)+\n apply (frule_tac x = a in spec)\n apply (frule_tac x = b in spec)\n apply (clarsimp simp: weak_derived_cap_range)\n apply (intro conjI impI allI)\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (rule disjI2)\n apply (intro conjI impI)\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (rule disjI2)\n apply (rule ccontr)\n apply (clarsimp simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply fastforce\n done\n\nlemma cap_swap_aobj_at:\n \"arch_obj_pred P' \\\n \\\\s. P (obj_at P' pd s)\\ cap_swap c (a, b) c' (aa, ba) \\\\r s. P (obj_at P' pd s)\\\"\n unfolding cap_swap_def set_cdt_def by (wpsimp wp: set_cap.aobj_at)\n\nlemma cap_swap_invs[wp]:\n \"\\c' a c b.\n \\invs and ex_cte_cap_wp_to (appropriate_cte_cap c') a\n and ex_cte_cap_wp_to (appropriate_cte_cap c) b and\n valid_cap c and valid_cap c' and\n tcb_cap_valid c b and tcb_cap_valid c' a and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c) a and\n cte_wp_at (weak_derived c') b and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c') b and\n K (a \\ b \\ \\ is_master_reply_cap c \\ \\ is_master_reply_cap c')\\\n cap_swap c a c' b \\\\rv. invs :: 'state_ext state \\ bool\\\"\n unfolding invs_def valid_state_def valid_pspace_def\n apply (wp cap_swap_replies cap_swap_reply_masters valid_arch_state_lift_aobj_at\n cap_swap_typ_at valid_irq_node_typ cap_swap_aobj_at\n | simp\n | erule disjE\n | clarsimp simp: cte_wp_at_caps_of_state copy_of_cte_refs weak_derived_def\n copy_obj_refs copy_of_zobj_refs copy_of_is_zombie\n copy_of_cap_irqs gen_obj_refs_eq copy_of_arch_gen_obj_refs\n | clarsimp simp: valid_global_refs_def valid_refs_def copy_of_cap_range\n cte_wp_at_caps_of_state\n simp del: split_paired_Ex split_paired_All\n | rule conjI\n | clarsimp dest!: valid_reply_caps_of_stateD)+\n done\n\nlemma cap_swap_fd_invs[wp]:\n \"\\a b.\n \\invs and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) a\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) b\n and (\\s. \\c. tcb_cap_valid c a s)\n and (\\s. \\c. tcb_cap_valid c b s)\n and cte_wp_at (\\c. \\ is_master_reply_cap c) a\n and cte_wp_at (\\c. \\ is_master_reply_cap c) b\\\n cap_swap_for_delete a b \\\\rv. invs :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp)\n apply (strengthen cap_irqs_appropriate_strengthen, simp)\n apply (rule conjI, fastforce dest: cte_wp_at_valid_objs_valid_cap)\n apply (rule conjI, fastforce dest: cte_wp_at_valid_objs_valid_cap)\n apply (clarsimp simp: cte_wp_at_caps_of_state weak_derived_def)\n done\n\nend\n\n\nlemma final_cap_unchanged:\n assumes x: \"\\P p. \\cte_wp_at P p\\ f \\\\rv. cte_wp_at P p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\is_final_cap' cap\\ f \\\\rv. is_final_cap' cap\\\"\n apply (simp only: is_final_cap'_def3 imp_conv_disj de_Morgan_conj)\n apply (wp hoare_vcg_ex_lift hoare_vcg_all_lift x hoare_vcg_disj_lift\n valid_cte_at_neg_typ [OF y])\n done\n\n\nlemmas set_cap_cte_wp_at_cases = set_cap_cte_wp_at[simplified if_bool_eq_conj pred_conj_def conj_comms]\n\n\nlemma cyclic_zombieD[dest!]:\n \"cap_cyclic_zombie cap sl\n \\ \\p zb n. cap = cap.Zombie p zb n\n \\ sl = (p, replicate (zombie_cte_bits zb) False)\"\n by (cases cap, simp_all add: cap_cyclic_zombie_def)\n\n\ncontext CNodeInv_AI begin\n\nlemma rec_del_abort_cases:\n \"\\args (s::'state_ext state).\n case args of FinaliseSlotCall sl ex \\ s \\ \\\\\\\n rec_del (FinaliseSlotCall sl ex)\n \\\\rv s. (fst rv) \\ (\\ ex \\ cte_wp_at (\\c. is_zombie c \\ sl \\ fst_cte_ptrs c) sl s)\\,\\\\\\\\\n | _ \\ True\"\n subgoal for args s\n proof (induct rule: rec_del_induct)\n case (2 slot exposed)\n note wp = \"2.hyps\"[simplified rec_del_call.simps]\n show ?case\n apply (subst rec_del_simps_ext)\n apply (simp only: rec_del_call.simps split_def)\n apply wp\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wp wp)+\n apply (wp irq_state_independent_AI | simp)+\n apply (rule hoare_strengthen_post)\n apply (rule finalise_cap_cases[where slot=slot])\n apply clarsimp\n apply (fastforce simp: fst_cte_ptrs_def)\n apply (simp add: is_final_cap_def | wp get_cap_wp)+\n done\n qed (simp_all add: rec_del_fails)\n done\n\n\nlemma rec_del_delete_cases:\n \"\\sl ex.\n \\\\ :: 'state_ext state \\ bool\\\n rec_del (CTEDeleteCall sl ex)\n \\\\rv s. cte_wp_at (\\c. c = cap.NullCap \\ \\ ex \\ is_zombie c \\ sl \\ fst_cte_ptrs c) sl s\\,-\"\n subgoal for sl ex\n using rec_del_abort_cases [where args=\"FinaliseSlotCall sl ex\"]\n apply (subst rec_del_simps_ext, simp add: split_def)\n apply wp\n apply (rule hoare_strengthen_post [OF empty_slot_deletes])\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (rule use_spec, rule spec_strengthen_postE, assumption)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply assumption\n done\n done\n\n\nlemma cap_delete_deletes:\n notes hoare_pre [wp_pre del]\n shows\n \"\\p.\n \\\\ :: 'state_ext state \\ bool\\\n cap_delete p\n \\\\rv. cte_wp_at (\\c. c = cap.NullCap) p\\,-\"\n subgoal for p\n unfolding cap_delete_def\n using rec_del_delete_cases[where sl=p and ex=True]\n apply (simp add: validE_R_def)\n apply wp\n apply simp\n done\n done\n\nend\n\n\nlemma final_cap_same_objrefs:\n \"\\is_final_cap' cap and\n cte_wp_at (\\c. obj_refs cap \\ obj_refs c \\ {}\n \\ cap_irqs cap \\ cap_irqs c \\ {}\n \\ arch_gen_refs cap \\\n arch_gen_refs c \\ {}) ptr\\\n set_cap cap ptr \\\\rv. is_final_cap' cap\\\"\n apply (simp only: is_final_cap'_def3 pred_conj_def\n cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp simp del: split_paired_Ex split_paired_All)\n apply (rule_tac x=ptr in exI)\n apply (subgoal_tac \"(a, b) = ptr\")\n apply clarsimp\n apply (erule_tac x=\"ptr\" in allE)\n apply (fastforce simp: gen_obj_refs_Int)\n done\n\n\nlemma cte_wp_at_weakenE_customised:\n \"\\cte_wp_at P t s; \\c. \\ P c; cte_wp_at ((=) c) t s \\ \\ P' c\\ \\ cte_wp_at P' t s\"\n by (clarsimp simp: cte_wp_at_def)\n\n\nlemma final_cap_at_same_objrefs:\n \"\\\\s. cte_wp_at (\\c. obj_refs c \\ {} \\ is_final_cap' c s) p s\n \\ cte_wp_at (\\c. gen_obj_refs cap = gen_obj_refs c) ptr s \\ p \\ ptr\\\n set_cap cap ptr \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\n apply (simp only: final_cap_at_eq cte_wp_at_conj)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp simp del: split_paired_All split_paired_Ex\n simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n apply fastforce\n done\n\n\nlemma cap_swap_fd_final_cap_at_one_case:\n \"\\\\s. p \\ p'' \\ ((p = p') \\ cte_wp_at (\\c. is_final_cap' c s) p'' s)\n \\ ((p \\ p') \\ cte_wp_at (\\c. is_final_cap' c s) p s)\\\n cap_swap_for_delete p' p''\n \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\n apply (simp only: final_cap_at_eq cte_wp_at_conj)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply (cases \"p = p'\")\n apply (cases p', clarsimp)\n apply clarsimp\n apply (cases p', cases p'', clarsimp)\n done\n\n\nlemma cap_swap_fd_cte_wp_at_one_case:\n \"\\\\s. p \\ p'' \\ ((p = p') \\ cte_wp_at P p'' s) \\ ((p \\ p') \\ cte_wp_at P p s)\\\n cap_swap_for_delete p' p''\n \\\\rv s. cte_wp_at P p s\\\"\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply clarsimp\n done\n\n\nlemma valid_cte_wp_at_prop:\n assumes x: \"\\P p. \\cte_wp_at P p\\ f \\\\rv. cte_wp_at P p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\\\s. P' (cte_wp_at P p s)\\ f \\\\rv s. P' (cte_wp_at P p s)\\\"\nproof -\n have cte_wp_at_neg2:\n \"\\P p s. (\\ cte_wp_at P p s) = (\\ cte_at p s \\ cte_wp_at (\\c. \\ P c) p s)\"\n by (fastforce simp: cte_wp_at_def)\n have rev_iffI:\n \"\\P Q. \\ P \\ Q; \\ P \\ \\ Q \\ \\ P = Q\"\n by fastforce\n show ?thesis\n apply (clarsimp simp: valid_def elim!: rsubst[where P=P'])\n apply (rule rev_iffI)\n apply (erule(1) use_valid [OF _ x])\n apply (subst cte_wp_at_neg2)\n apply (erule use_valid)\n apply (wp hoare_vcg_disj_lift x y valid_cte_at_neg_typ)\n apply (simp only: cte_wp_at_neg2[symmetric] simp_thms)\n done\nqed\n\n\nlemma final_cap_at_unchanged:\n assumes x: \"\\P p. \\cte_wp_at (\\c. P (gen_obj_refs c)) p\\ f\n \\\\rv. cte_wp_at (\\c. P (gen_obj_refs c)) p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\\\s. cte_wp_at (\\c. is_final_cap' c s) p s\\ f\n \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\nproof -\n have final_cap_at_eq':\n \"\\p s. cte_wp_at (\\c. is_final_cap' c s) p s =\n (\\cp. cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cp) p s\n \\ (obj_refs cp \\ {} \\ cap_irqs cp \\ {} \\ arch_gen_refs cp \\ {})\n \\ (\\p'. (cte_at p' s \\ p' \\ p) \\\n cte_wp_at (\\c. gen_obj_refs cp \\ gen_obj_refs c = {}) p' s))\"\n apply (simp add: final_cap_at_eq cte_wp_at_def)\n apply (rule iffI)\n apply (clarsimp simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n apply (rule exI, rule conjI, rule refl)\n apply clarsimp\n apply (clarsimp simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n done\n show ?thesis\n apply (simp only: final_cap_at_eq' imp_conv_disj de_Morgan_conj)\n apply (wp hoare_vcg_ex_lift hoare_vcg_all_lift x hoare_vcg_disj_lift\n valid_cte_at_neg_typ y)\n done\nqed\n\nlemma zombie_has_objrefs:\n \"is_zombie c \\ obj_refs c \\ {}\"\n by (case_tac c, simp_all add: is_zombie_def)\n\nlemma word_same_bl_memo_unify_word_type:\n \"\\ of_bl xs = (of_bl ys :: ('a :: len) word); length xs = length ys;\n length xs \\ len_of TYPE('a) \\ \\ xs = ys\"\n apply (subst same_append_eq[symmetric])\n apply (rule word_bl.Abs_eqD)\n apply (subst of_bl_rep_False)+\n apply simp\n apply simp\n apply (erule le_add_diff_inverse2)\n apply simp\n done\n\n\nlemma word_and_bl_proof:\n \"\\ invs s; kheap s x = Some (CNode sz cs);\n unat (of_bl y :: machine_word) = 0; unat (of_bl z :: machine_word) = 0;\n y \\ dom cs; z \\ dom cs \\ \\ y = z\"\n apply (simp add: unat_eq_0)\n apply (frule invs_valid_objs, erule(1) valid_objsE)\n apply (clarsimp simp: valid_obj_def valid_cs_def\n valid_cs_size_def well_formed_cnode_n_def)\n apply (rule word_same_bl_memo_unify_word_type[where 'a=machine_word_len])\n apply simp\n apply simp\n apply (simp add: word_bits_def)\n done\n\n\nlemma final_zombie_not_live:\n \"\\ is_final_cap' (cap.Zombie ptr b n) s; cte_wp_at ((=) (cap.Zombie ptr b n)) p s;\n if_live_then_nonz_cap s \\\n \\ \\ obj_at live ptr s\"\n apply clarsimp\n apply (drule(1) if_live_then_nonz_capD, simp)\n apply (clarsimp simp: ex_nonz_cap_to_def zobj_refs_to_obj_refs)\n apply (subgoal_tac \"(a, ba) \\ p\")\n apply (clarsimp simp: is_final_cap'_def)\n apply (erule(1) obvious)\n apply (clarsimp simp: cte_wp_at_def is_zombie_def gen_obj_refs_Int)+\n done\n\n\nlemma suspend_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ IpcCancel_A.suspend t \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state\n del: split_paired_Ex)\n apply (wp hoare_use_eq_irq_node [OF suspend_irq_node suspend_caps_of_state])\n apply (simp del: split_paired_Ex split_paired_All)\n apply (intro allI impI, erule exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp: can_fast_finalise_def\n split: cap.split_asm)\n done\n\n\nlemma of_bl_eq_0:\n \"\\ of_bl xs = (0 :: ('a :: len) word); length xs \\ len_of TYPE('a) \\\n \\ \\n. xs = replicate n False\"\n apply (rule exI)\n apply (rule word_same_bl_memo_unify_word_type[where 'a='a]; simp)\n done\n\n\ncontext CNodeInv_AI begin\n\nlemma zombie_is_cap_toE:\n \"\\ptr zbits n p (s::'state_ext state) m P.\n \\ cte_wp_at ((=) (Zombie ptr zbits n)) p s; invs s; m < n; P (Zombie ptr zbits n) \\\n \\ ex_cte_cap_wp_to P (ptr, nat_to_cref (zombie_cte_bits zbits) m) s\"\n unfolding ex_cte_cap_wp_to_def\n apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp)\n apply (intro exI, erule cte_wp_at_weakenE)\n apply clarsimp\n apply (drule(2) zombie_is_cap_toE_pre, simp)\n done\n\nend\n\nlemma zombie_is_cap_toE2:\n \"\\ cte_wp_at ((=) (cap.Zombie ptr zbits n)) p s; 0 < n;\n P (cap.Zombie ptr zbits n) \\\n \\ ex_cte_cap_wp_to P (ptr, replicate (zombie_cte_bits zbits) False) s\"\n unfolding ex_cte_cap_wp_to_def\n apply (rule exI, erule cte_wp_at_weakenE)\n apply clarsimp\n done\n\n\nlemma set_cap_emptyable[wp]:\n \"\\ is_master_reply_cap cap \\\n \\emptyable sl and cte_at p\\ set_cap cap p \\\\rv. emptyable sl\\\"\n apply (simp add: emptyable_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cap_typ_at set_cap_cte_wp_at\n | simp add: tcb_at_typ)+\n done\n\n\nlemma set_cap_halted_if_tcb[wp]:\n \"\\halted_if_tcb t\\ set_cap cap p \\\\rv. halted_if_tcb t\\\"\n apply (simp add: halted_if_tcb_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cap_typ_at | simp add: tcb_at_typ)+\n done\n\n\nlemma valid_Zombie_n_less_cte_bits:\n \"s \\ cap.Zombie p zb n \\ n \\ 2 ^ zombie_cte_bits zb\"\n by (clarsimp simp: valid_cap_def split: option.split_asm)\n\n\nlemma zombie_cte_bits_less:\n \"s \\ cap.Zombie p zb m \\ zombie_cte_bits zb < word_bits\"\n by (clarsimp simp: valid_cap_def cap_aligned_def\n split: option.split_asm)\n\n\ncontext CNodeInv_AI begin\n\nlemma nat_to_cref_replicate_Zombie:\n \"\\zb n (s::'state_ext state) p m.\n \\ nat_to_cref (zombie_cte_bits zb) n = replicate (zombie_cte_bits zb) False;\n s \\ cap.Zombie p zb m; n < m \\\n \\ n = 0\"\n apply (subgoal_tac \"unat (of_bl (nat_to_cref (zombie_cte_bits zb) n)) = 0\")\n apply (subst(asm) unat_of_bl_nat_to_cref)\n apply (drule valid_Zombie_n_less_cte_bits, simp)\n apply (erule zombie_cte_bits_less)\n apply simp\n apply simp\n done\n\nend\n\n\nlemma replicate_False_tcb_valid[simp]:\n \"tcb_cap_valid cap (p, replicate n False) s\"\n apply (clarsimp simp: tcb_cap_valid_def st_tcb_def2 tcb_at_def)\n apply (rule conjI)\n apply (clarsimp split: option.split)\n apply (frule tcb_cap_cases_length[OF domI])\n apply (clarsimp simp add: tcb_cap_cases_def tcb_cnode_index_def to_bl_1)\n apply (cases n, simp_all add: tcb_cnode_index_def)\n done\n\n\nlemma tcb_valid_nonspecial_cap:\n \"\\ caps_of_state s p = Some cap; valid_objs s;\n \\ptr st. \\(getF, setF, restr) \\ ran tcb_cap_cases.\n \\ restr ptr st cap \\ (\\cap. restr ptr st cap);\n \\ptr. (is_nondevice_page_cap cap \\ cap = cap.NullCap) \\\n valid_ipc_buffer_cap cap ptr\n \\ valid_ipc_buffer_cap cap' ptr \\\n \\ tcb_cap_valid cap' p s\"\n apply (drule cte_wp_tcb_cap_valid[rotated])\n apply (erule caps_of_state_cteD)\n apply (clarsimp simp: tcb_cap_valid_def st_tcb_def2)\n apply (clarsimp split: option.split_asm)\n apply (rule conjI)\n apply (drule spec, drule spec, drule bspec, erule ranI)\n apply fastforce\n apply (clarsimp simp: eq_commute)\n done\n\n\nlemma suspend_makes_halted[wp]:\n \"\\valid_objs\\ IpcCancel_A.suspend thread \\\\_. st_tcb_at halted thread\\\"\n unfolding IpcCancel_A.suspend_def\n by (wp hoare_strengthen_post [OF sts_st_tcb_at]\n | clarsimp elim!: pred_tcb_weakenE)+\n\n\nlemma empty_slot_emptyable[wp]:\n \"\\emptyable sl and cte_at slot'\\ empty_slot slot' opt \\\\rv. emptyable sl\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_weaken_pre)\n apply (simp add: emptyable_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift | simp add: tcb_at_typ)+\n apply (simp add: is_cap_simps emptyable_def tcb_at_typ)\n done\n\n\ncrunch emptyable[wp]: blocked_cancel_ipc \"emptyable sl\"\n (ignore: set_thread_state wp: emptyable_lift sts_st_tcb_at_cases static_imp_wp)\n\ncrunch emptyable[wp]: cancel_signal \"emptyable sl\"\n (ignore: set_thread_state wp: emptyable_lift sts_st_tcb_at_cases static_imp_wp)\n\n\nlemma cap_delete_one_emptyable[wp]:\n \"\\invs and emptyable sl and cte_at sl'\\ cap_delete_one sl' \\\\_. emptyable sl\\\"\n apply (simp add: cap_delete_one_def unless_def is_final_cap_def)\n apply (wpsimp wp: get_cap_wp)\n done\n\n\nlemmas tcb_at_cte_at_2 = tcb_at_cte_at [where ref=\"tcb_cnode_index 2\",\n simplified dom_tcb_cap_cases]\n\n\ndeclare thread_set_Pmdb [wp]\n\n\nlemma reply_cancel_ipc_emptyable[wp]:\n \"\\invs and emptyable sl and valid_mdb\\ reply_cancel_ipc ptr \\\\_. emptyable sl\\\"\n apply (simp add: reply_cancel_ipc_def)\n apply (wp select_wp select_inv hoare_drop_imps | simp add: Ball_def)+\n apply (wp hoare_vcg_all_lift hoare_convert_imp thread_set_Pmdb\n thread_set_invs_trivial thread_set_emptyable thread_set_cte_at\n | simp add: tcb_cap_cases_def descendants_of_cte_at)+\n done\n\ncrunch emptyable[wp]: cancel_ipc \"emptyable sl\"\n\ncrunch emptyable[wp]: update_restart_pc \"emptyable sl\"\n (rule: emptyable_lift)\n\nlemma suspend_emptyable[wp]:\n \"\\invs and emptyable sl and valid_mdb\\ suspend l \\\\_. emptyable sl\\\"\n apply (simp add: IpcCancel_A.suspend_def)\n apply (wp|simp)+\n apply (wp emptyable_lift sts_st_tcb_at_cases)+\n apply (wpsimp wp: set_thread_state_cte_wp_at)+\n done\n\ncrunch emptyable[wp]: do_machine_op \"emptyable sl\"\n (rule: emptyable_lift)\n\ncrunch emptyable[wp]: set_irq_state \"emptyable sl\"\n (rule: emptyable_lift)\n\n\ndeclare get_irq_slot_real_cte [wp]\n\n\nlemma cap_swap_for_delete_emptyable[wp]:\n \"\\emptyable sl and emptyable sl'\\ cap_swap_for_delete sl' sl \\\\rv. emptyable sl\\\"\n apply (simp add: emptyable_def cap_swap_for_delete_def cap_swap_def tcb_at_typ)\n apply (rule hoare_pre)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cdt_typ_at set_cap_typ_at | simp split del: if_split)+\n done\n\n\ncontext CNodeInv_AI begin\n\nlemma finalise_cap_not_reply_master:\n \"\\rv s' cap sl (s::'state_ext state).\n (Inr rv, s') \\ fst (liftE (finalise_cap cap sl) s) \\ \\ is_master_reply_cap (fst rv)\"\n by (simp add: Inr_in_liftE_simp finalise_cap_not_reply_master_unlifted)\n\nend\n\n\ncrunch cte_at_pres[wp]: empty_slot \"cte_at sl\"\n\n\nlemma cte_wp_at_emptyableD:\n \"\\P. \\ cte_wp_at (\\c. c = cap) p s; valid_objs s; \\cap. P cap \\ \\ is_master_reply_cap cap \\ \\\n P cap \\ emptyable p s\"\n apply (simp add: emptyable_def)\n apply (clarsimp simp add: obj_at_def is_tcb)\n apply (erule(1) valid_objsE)\n apply (clarsimp simp: cte_wp_at_cases valid_obj_def valid_tcb_def\n tcb_cap_cases_def pred_tcb_at_def obj_at_def\n split: Structures_A.thread_state.splits)\n done\n\n\nlemma cte_wp_at_not_reply_master:\n \"\\a b s. \\ tcb_at a s \\ b \\ tcb_cnode_index 2; cte_at (a, b) s;\n valid_objs s; valid_reply_masters s \\\n \\ cte_wp_at (\\c. \\ is_master_reply_cap c) (a, b) s\"\n by (fastforce simp: valid_reply_masters_def cte_wp_at_caps_of_state\n is_cap_simps valid_cap_def is_master_reply_cap_to_def\n dest: caps_of_state_valid_cap)\n\n\ndeclare finalise_cap_cte_cap_to [wp]\n\n\nlemma appropriate_Zombie:\n \"\\ptr zbits n. appropriate_cte_cap (cap.Zombie ptr zbits n)\n = (\\cap. cap_irqs cap = {})\"\n by (rule ext, simp add: appropriate_cte_cap_def)\n\n\nlemma no_cap_to_obj_with_diff_ref_eqE:\n \"\\ no_cap_to_obj_with_diff_ref cap S s;\n obj_refs cap' = obj_refs cap; table_cap_ref cap' = table_cap_ref cap;\n S \\ S' \\\n \\ no_cap_to_obj_with_diff_ref cap' S' s\"\n by (auto simp add: no_cap_to_obj_with_diff_ref_def Ball_def)\n\n\nlemma context_conjI': \"\\P; P \\ Q\\ \\ Q \\ P\"\n apply simp\ndone\n\n\nlemma real_cte_at_not_tcb:\n \"real_cte_at sl s \\ \\ tcb_at (fst sl) s\"\n apply (simp add: tcb_at_typ obj_at_def)\n apply (clarsimp simp: is_cap_table_def)\n done\n\n\ncontext CNodeInv_AI_2 begin\n\nlemma rec_del_invs:\n \"\\args.\n \\invs and valid_rec_del_call args\n and (\\s. \\ exposed_rdcall args\n \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall args) s)\n and emptyable (slot_rdcall args)\n and (\\s. case args of ReduceZombieCall cap sl ex \\\n \\ cap_removeable cap sl\n \\ (\\t\\obj_refs cap. halted_if_tcb t s)\n | _ \\ True)\\\n rec_del args\n \\\\rv. invs :: 'state_ext state \\ bool\\\"\n apply (rule validE_valid)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\nlemma cap_delete_invs[wp]:\n \"\\ptr.\n \\invs and emptyable ptr :: 'state_ext state \\ bool\\\n cap_delete ptr\n \\\\rv. invs\\\"\n unfolding cap_delete_def\n apply (rule hoare_pre, wp rec_del_invs)\n apply simp\n done\n\nlemma cap_delete_tcb[wp]:\n \"\\t ptr. \\tcb_at t :: 'state_ext state \\ bool\\ cap_delete ptr \\\\rv. tcb_at t\\\"\n unfolding cap_delete_def\n by (simp add: tcb_at_typ | wp rec_del_typ_at)+\n\nlemma cap_delete_valid_cap:\n \"\\c p. \\valid_cap c :: 'state_ext state \\ bool\\ cap_delete p \\\\_. valid_cap c\\\"\n unfolding cap_delete_def\n by (wp valid_cap_typ rec_del_typ_at | simp)+\n\nlemma cap_delete_cte_at:\n \"\\c p. \\cte_at c :: 'state_ext state \\ bool\\ cap_delete p \\\\_. cte_at c\\\"\n unfolding cap_delete_def by (wp rec_del_cte_at | simp)+\n\nlemma cap_delete_typ_at:\n \"\\P T p cref. \\\\s::'state_ext state. P (typ_at T p s)\\ cap_delete cref \\\\rv s. P (typ_at T p s)\\\"\n unfolding cap_delete_def by (wp rec_del_typ_at | simp)+\n\nend\n\n\nlemma cap_swap_fd_st_tcb_at[wp]:\n \"\\pred_tcb_at proj P t\\ cap_swap_for_delete sl sl' \\\\rv. pred_tcb_at proj P t\\\"\n unfolding cap_swap_for_delete_def\n by (wp, simp)\n\n\ndeclare if_cong[cong]\n\n\nlemma cases2 [case_names pos_pos neg_pos pos_neg neg_neg]:\n \"\\ \\p; q\\ \\ R; \\\\ p; q\\ \\ R; \\p; \\ q\\ \\ R; \\\\ p; \\ q\\ \\ R \\ \\ R\"\n by auto\n\n\ndefinition\n rpo_measure :: \"'a \\ ('a option \\ nat) option \\ nat\"\nwhere\n \"rpo_measure x v \\ case v of Some (y, n) \\ (if y = Some x then n - 1 else n)\"\n\n\nlemma rpo_measure_simps[simp]:\n \"rpo_measure x (Some (y, n)) = (if y = Some x then n - 1 else n)\"\n by (simp add: rpo_measure_def)\n\ndefinition\n revoke_progress_ord :: \"('a \\ 'a option \\ nat) \\ ('a \\ 'a option \\ nat) \\ bool\"\nwhere\n \"revoke_progress_ord mapa mapb \\ (mapa = mapb)\n \\ (mapb, mapa) \\ measure (\\mp. \\x\\dom mp. rpo_measure x (mp x))\"\n\nlemma rpo_trans:\n \"\\ revoke_progress_ord mapa mapb; revoke_progress_ord mapb mapc \\\n \\ revoke_progress_ord mapa mapc\"\n apply (simp add: revoke_progress_ord_def)\n apply (elim disjE, simp_all)\n done\n\n\ninterpretation mult_is_add: comm_monoid_mult \"(+)\" \"0::'a::comm_monoid_add\"\n by (unfold_locales) (auto simp: field_simps)\n\n\nlemma fold_Int_sub:\n assumes \"finite S\" \"finite T\"\n shows \"(\\x \\ (S \\ T). (f x :: nat)) = (\\x \\ T. f x) - (\\x \\ (T - S). f x)\"\nproof -\n from assms sum.union_disjoint[where A=\"S \\ T\" and B=\"T - S\" and g=f]\n show ?thesis\n apply simp\n apply (drule meta_mp)\n apply blast\n apply (subgoal_tac \"S \\ T \\ (T - S) = T\")\n apply simp\n apply blast\n done\nqed\n\n\nlemma rpo_delta:\n assumes x: \"\\x. x \\ S \\ mapa x = mapb x\"\n assumes F: \"finite S\" \"finite (dom mapa)\" \"finite (dom mapb)\"\n assumes y:\n \"(mapb, mapa) \\ measure (\\mp. \\x \\ S \\ dom mp. rpo_measure x (mp x))\"\n shows \"revoke_progress_ord mapa mapb\"\nproof -\n have P: \"(dom mapa - S) = (dom mapb - S)\"\n by (fastforce simp: x)\n have Q: \"(\\x \\ dom mapa - S. rpo_measure x (mapa x))\n = (\\x \\ dom mapb - S. rpo_measure x (mapb x))\"\n apply (rule sum.cong)\n apply (simp add: P)\n apply (simp add: x)\n done\n show ?thesis using y\n apply (simp add: revoke_progress_ord_def)\n apply (rule disjI2)\n apply (fastforce simp: fold_Int_sub F Q)\n done\nqed\n\n\ndefinition\n cap_to_rpo :: \"cap \\ cslot_ptr option \\ nat\"\nwhere\n \"cap_to_rpo cap \\ case cap of\n cap.NullCap \\ (None, 0)\n | cap.Zombie p zb n \\ (Some (p, replicate (zombie_cte_bits zb) False), 2)\n | _ \\ (None, 3)\"\n\n\nlemmas caps_of_state_set_finite'\n = cte_wp_at_set_finite[simplified cte_wp_at_caps_of_state]\n\n\nlemmas caps_of_state_set_finite\n = caps_of_state_set_finite'\n caps_of_state_set_finite'[where P=\"\\\\\", simplified]\n\n\nlemma empty_slot_rvk_prog:\n \"\\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\n empty_slot sl opt\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\"\n apply (simp add: empty_slot_def)\n apply (rule hoare_pre)\n apply (wp opt_return_pres_lift | simp split del: if_split)+\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{sl}\"],\n simp_all add: dom_def caps_of_state_set_finite exception_set_finite)\n apply (case_tac cap, simp_all add: cap_to_rpo_def)\n done\n\n\nlemma rvk_prog_update_strg:\n \"revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ cte_wp_at (\\cp. cap_to_rpo cp = cap_to_rpo cap\n \\ rpo_measure p (Some (cap_to_rpo cp))\n > rpo_measure p (Some (cap_to_rpo cap))) p s\n \\ revoke_progress_ord m (option_map cap_to_rpo \\ ((caps_of_state s) (p \\ cap)))\"\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule disjE)\n apply (erule rsubst[where P=\"\\mp. revoke_progress_ord m mp\"])\n apply (rule ext, simp)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{p}\"],\n simp_all add: dom_def caps_of_state_set_finite)\n apply (rule exception_set_finite)\n apply (rule finite_subset [OF _ caps_of_state_set_finite(2)[where s=s]])\n apply clarsimp\n done\n\n\nlemma cap_swap_fd_rvk_prog:\n \"\\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ cte_wp_at (\\cp. cap_to_rpo cp = (Some p1, 2) \\ is_final_cap' cp s) p2 s\\\n cap_swap_for_delete p1 p2\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\"\n apply (simp add: cap_swap_for_delete_def cap_swap_def)\n apply (wp get_cap_wp | simp split del: if_split)+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{p1, p2}\"],\n simp_all add: caps_of_state_set_finite exception_set_finite\n dom_def)\n apply (clarsimp simp: is_final_cap'_def2)\n apply (frule spec[where x=\"fst p1\"], drule spec[where x=\"snd p1\"])\n apply (drule spec[where x=\"fst p2\"], drule spec[where x=\"snd p2\"])\n apply (clarsimp simp: cap_to_rpo_def split: cap.split_asm)\n apply (simp split: cap.split)\n apply (clarsimp simp: cte_wp_at_caps_of_state gen_obj_refs_empty)\n apply (drule iffD1)\n apply (simp add: gen_obj_refs_Int)\n apply (simp only:)\n apply simp\n done\n\n\nlemmas empty_slot_rvk_prog' = empty_slot_rvk_prog[unfolded o_def]\n\n\ncrunch rvk_prog: cancel_ipc \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def tcb_cap_cases_def\n wp: hoare_drop_imps empty_slot_rvk_prog' select_wp\n thread_set_caps_of_state_trivial)\n\ncrunch rvk_prog: cancel_all_ipc \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\ncrunch rvk_prog: cancel_all_signals \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\ncrunch rvk_prog: suspend \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\ncrunch rvk_prog: deleting_irq_handler \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\nlocale CNodeInv_AI_3 = CNodeInv_AI_2 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes finalise_cap_rvk_prog:\n \"\\a b.\n \\\\s::'state_ext state. revoke_progress_ord m (\\x. map_option cap_to_rpo (caps_of_state s x))\\\n finalise_cap a b\n \\\\_ s. revoke_progress_ord m (\\x. map_option cap_to_rpo (caps_of_state s x))\\\"\n assumes rec_del_rvk_prog:\n \"\\(st::'state_ext state) args.\n st \\ \\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ (case args of ReduceZombieCall cap sl ex \\\n cte_wp_at (\\c. c = cap) sl s \\ is_final_cap' cap s\n | _ \\ True)\\\n rec_del args\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\,\\\\\\\\\"\n\n\nlemmas rdcall_simps = rec_del_call.simps exposed_rdcall.simps slot_rdcall.simps\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma cap_delete_rvk_prog:\n \"\\m ptr.\n \\\\s::'state_ext state. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\n cap_delete ptr\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\,-\"\n unfolding cap_delete_def validE_R_def\n apply wpsimp\n apply (unfold validE_R_def)\n apply (rule use_spec)\n apply (rule rec_del_rvk_prog rec_del_rvk_prog[unfolded o_def])\n apply (simp add: o_def)\n done\n\nend\n\n\nlemma get_object_some: \"kheap s ptr = Some ko \\ get_object ptr s = ({(ko, s)}, False)\"\n by (clarsimp simp: get_object_def gets_def get_def bind_def assert_def return_def)\n\nlemma set_cap_id:\n \"cte_wp_at ((=) c) p s \\ set_cap c p s = ({((),s)}, False)\"\n apply (clarsimp simp: cte_wp_at_cases)\n apply (cases p)\n apply (erule disjE)\n apply clarsimp\n apply (simp add: set_cap_def get_object_def bind_assoc exec_gets)\n apply (rule conjI)\n apply (clarsimp simp: set_object_def)\n apply (frule get_object_some)\n apply (drule_tac t=\"fun\" in map_upd_triv)\n apply (clarsimp simp: bind_def get_def return_def put_def a_type_def)\n apply (cases s)\n apply simp\n apply (rule ext, simp)\n apply (clarsimp simp: get_object_def gets_def get_def bind_def assert_def return_def)\n apply clarsimp\n apply (simp add: set_cap_def get_object_def bind_assoc\n exec_gets set_object_def exec_get put_def)\n apply (clarsimp simp: tcb_cap_cases_def\n split: if_split_asm,\n simp_all add: map_upd_triv)\n done\n\n\ndeclare Inr_in_liftE_simp[simp]\n\n\nlemma get_cap_fail_or_not:\n \"fst (get_cap slot s) \\ {} \\ snd (get_cap slot s) = False\"\n by (clarsimp elim!: nonemptyE dest!: get_cap_det)\n\n\nfunction(sequential) red_zombie_will_fail :: \"cap \\ bool\"\n where\n \"red_zombie_will_fail (cap.Zombie ptr zb 0) = True\"\n| \"red_zombie_will_fail (cap.Zombie ptr zb (Suc n)) = False\"\n| \"red_zombie_will_fail cap = True\"\n apply simp_all\n apply (case_tac x)\n prefer 11\n apply (rename_tac nat)\n apply (case_tac nat, simp_all)[1]\n apply fastforce+\n done\n\n\ntermination red_zombie_will_fail\n by (rule red_zombie_will_fail.termination [OF Wellfounded.wf_empty])\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma rec_del_emptyable:\n \"\\args.\n \\invs and valid_rec_del_call args\n and (\\s. \\ exposed_rdcall args\n \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall args) s)\n and emptyable (slot_rdcall args)\n and (\\s. case args of ReduceZombieCall cap sl ex \\\n \\ cap_removeable cap sl\n \\ (\\t\\obj_refs cap. halted_if_tcb t s)\n | _ \\ True)\\\n rec_del args\n \\\\rv. emptyable (slot_rdcall args) :: 'state_ext state \\ bool\\, -\"\n apply (rule validE_validE_R)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\n\nlemma reduce_zombie_cap_to:\n \"\\cap slot exp.\n \\invs and valid_rec_del_call (ReduceZombieCall cap slot exp) and\n emptyable slot and\n (\\s. \\ exp \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s) and\n K (\\ cap_removeable cap slot) and\n (\\s. \\t\\obj_refs cap. halted_if_tcb t s)\\\n rec_del (ReduceZombieCall cap slot exp)\n \\\\rv (s::'state_ext state). \\ exp \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s\\, -\"\n apply (rule validE_validE_R)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\n\nlemma cte_at_replicate_zbits:\n \"\\(s::'state_ext state) oref zb n.\n \\ s \\ cap.Zombie oref zb n \\ \\ cte_at (oref, replicate (zombie_cte_bits zb) False) s\"\n apply (clarsimp simp: valid_cap_def obj_at_def is_tcb is_cap_table\n split: option.split_asm)\n apply (rule cte_wp_at_tcbI, simp)\n apply (fastforce simp add: tcb_cap_cases_def tcb_cnode_index_def to_bl_1)\n apply simp\n apply (subgoal_tac \"replicate x2 False \\ dom cs\")\n apply safe[1]\n apply (rule cte_wp_at_cteI, fastforce)\n apply (simp add: well_formed_cnode_n_def length_set_helper)\n apply simp\n apply simp\n apply (clarsimp simp: well_formed_cnode_n_def)\n done\n\n\nlemma reduce_zombie_cap_somewhere:\n \"\\exp cap slot.\n \\\\s::'state_ext state. \\ exp \\ (\\oref cref. cte_wp_at P (oref, cref) s)\\\n rec_del (ReduceZombieCall cap slot exp)\n \\\\rv s. \\ exp \\ (\\oref cref. cte_wp_at P (oref, cref) s)\\\"\n subgoal for exp cap slot\n apply (cases exp, simp_all, wp)\n apply (cases cap, simp_all add: rec_del_fails)\n apply (rename_tac word option nat)\n apply (case_tac nat, simp_all add: rec_del_simps_ext)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply safe\n apply (rule_tac x=\"fst ((id ((word, replicate (zombie_cte_bits option) False) := slot,\n slot := (word, replicate (zombie_cte_bits option) False))) (oref, cref))\"\n in exI)\n apply (rule_tac x=\"snd ((id ((word, replicate (zombie_cte_bits option) False) := slot,\n slot := (word, replicate (zombie_cte_bits option) False))) (oref, cref))\"\n in exI)\n apply fastforce\n done\n done\n\nend\n\n\nlemma set_cap_cap_somewhere:\n \"\\\\s. cte_wp_at (\\cp. P (fst slot) (snd slot) cp \\ P (fst slot) (snd slot) cap) slot s\n \\ (\\oref cref. cte_wp_at (P oref cref) (oref, cref) s)\\\n set_cap cap slot\n \\\\rv s. \\oref cref. cte_wp_at (P oref cref) (oref, cref) s\\\"\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply clarsimp\n apply (rule_tac x=oref in exI)\n apply (rule_tac x=cref in exI)\n apply fastforce\n done\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma rec_del_ReduceZombie_emptyable:\n \"\\cap slot ex.\n \\invs and (cte_wp_at ((=) cap) slot and is_final_cap' cap\n and (\\y. is_zombie cap))\n and (\\s. \\ ex \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s)\n and emptyable slot\n and (\\s. \\ cap_removeable cap slot \\ (\\t\\obj_refs cap. halted_if_tcb t s))\\\n rec_del (ReduceZombieCall cap slot ex)\n \\\\rv. emptyable slot :: 'state_ext state \\ bool\\, -\"\n subgoal for cap slot ex\n by (rule rec_del_emptyable [where args=\"ReduceZombieCall cap slot ex\", simplified])\n done\n\nend\n\n\ntext \\The revoke function and its properties are\n slightly easier to deal with than the delete\n function. However, its termination argument\n is complex, requiring that the delete function\n reduces the number of non-null capabilities.\\\ndefinition\n cap_revoke_recset :: \"((cslot_ptr \\ 'z::state_ext state) \\ (cslot_ptr \\ 'z::state_ext state)) set\"\nwhere\n \"cap_revoke_recset \\ measure (\\(sl, s). (\\mp. \\x \\ dom mp. rpo_measure x (mp x))\n (option_map cap_to_rpo \\ caps_of_state s))\"\n\n\nlemma wf_cap_revoke_recset:\n \"wf cap_revoke_recset\"\n by (simp add: cap_revoke_recset_def)\n\n\nlemma rpo_sym:\n \"revoke_progress_ord m m\"\n by (simp add: revoke_progress_ord_def)\n\n\nlemma in_select_ext_weak: \"(a,b) \\ fst (select_ext f S s) \\\n (a,b) \\ fst (select S s)\"\n apply (drule_tac Q=\"\\r s'. r \\ S \\ s' =s\" in use_valid[OF _ select_ext_weak_wp])\n apply (simp add: select_def)+\n done\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma cap_revoke_termination:\n \"All (cap_revoke_dom :: (machine_word \\ bool list) \\ 'state_ext state \\ bool)\"\n apply (rule cap_revoke.termination)\n apply (rule wf_cap_revoke_recset)\n apply (clarsimp simp add: cap_revoke_recset_def in_monad select_def\n dest!: iffD1[OF in_get_cap_cte_wp_at] in_select_ext_weak)\n apply (frule use_validE_R [OF _ cap_delete_rvk_prog])\n apply (rule rpo_sym)\n apply (frule use_validE_R [OF _ cap_delete_deletes])\n apply simp\n apply (simp add: revoke_progress_ord_def)\n apply (erule disjE)\n apply (drule_tac f=\"\\f. f (aa, ba)\" in arg_cong)\n apply (clarsimp simp: cte_wp_at_caps_of_state cap_to_rpo_def)\n apply (simp split: cap.split_asm)\n apply (drule in_preempt, clarsimp simp: trans_state_update'[symmetric])\n done\n\nlemma cap_revoke_dom: \"\\ (p :: (machine_word \\ bool list) \\ 'state_ext state). cap_revoke_dom p\"\n using cap_revoke_termination by blast\n\nlemmas cap_revoke_simps = cap_revoke.psimps[OF cap_revoke_dom]\n\nlemmas cap_revoke_induct = cap_revoke.pinduct[OF cap_revoke_dom]\n\nlemma cap_revoke_preservation':\n fixes P and s :: \"'state_ext state\" and ptr\n assumes x: \"\\p. \\P\\ cap_delete p \\\\rv. P\\\"\n assumes p: \"\\P\\ preemption_point \\\\rv. P\\\"\n shows \"s \\ \\P\\ cap_revoke ptr \\\\rv. P\\, \\\\rv. P\\\"\nproof (induct rule: cap_revoke_induct)\n case (1 slot)\n show ?case\n apply (subst cap_revoke_simps)\n apply (wp \"1.hyps\")\n apply (wp x p hoare_drop_imps select_wp)+\n apply simp_all\n done\nqed\n\nlemmas cap_revoke_preservation = use_spec(2) [OF cap_revoke_preservation']\n\nlemmas cap_revoke_preservation2 = cap_revoke_preservation[THEN validE_valid]\n\nlemma ball_subset: \"\\x\\A. Q x \\ B \\ A \\ \\x\\B. Q x\"\n apply blast\n done\n\nlemma cap_revoke_preservation_desc_of':\n fixes P Q and s :: \"'state_ext state\"\n assumes x: \"\\p. \\P and Q p\\ cap_delete p \\\\rv. P\\\"\n and y: \"\\sl s. P s \\ \\sl' \\ descendants_of sl (cdt s). Q sl' s\"\n assumes p: \"\\P\\ preemption_point \\\\rv. P\\\"\n shows \"s \\ \\P\\ cap_revoke ptr \\\\rv. P\\, \\\\rv. P\\\"\nproof (induct rule: cap_revoke_induct)\n case (1 slot)\n show ?case\n apply (subst cap_revoke_simps)\n apply (wp \"1.hyps\")\n apply (wp x p hoare_drop_imps select_wp)+\n apply (simp_all add: y)\n done\nqed\n\nlemmas cap_revoke_preservation_desc_of =\n use_spec(2) [OF cap_revoke_preservation_desc_of']\n\nlemma cap_revoke_typ_at:\n \"\\P T p. \\\\s::'state_ext state. P (typ_at T p s)\\ cap_revoke ptr \\\\rv s. P (typ_at T p s)\\\"\n by (wp cap_delete_typ_at cap_revoke_preservation irq_state_independent_AI preemption_point_inv, simp+)\n\nlemma cap_revoke_invs:\n \"\\ptr. \\\\s::'state_ext state. invs s\\ cap_revoke ptr \\\\rv. invs\\\"\n apply (wp cap_revoke_preservation_desc_of)\n apply (fastforce simp: emptyable_def dest: reply_slot_not_descendant)\n apply (wp preemption_point_inv)\n apply simp+\n done\n\nend\n\n\nlemma descendants_of_cdt_parent:\n \"\\ p' \\ descendants_of p (cdt s) \\ \\ \\p''. cdt s \\ p'' \\ p'\"\n apply (simp add: descendants_of_def del: split_paired_Ex)\n apply (erule tranclE)\n apply (erule exI)\n apply (erule exI)\n done\n\n\nlemma cap_revoke_mdb_stuff3:\n \"\\ p' \\ descendants_of p (cdt s); valid_mdb s \\\n \\ cte_wp_at ((\\) cap.NullCap) p' s\"\n apply (clarsimp simp add: valid_mdb_def\n dest!: descendants_of_cdt_parent)\n apply (simp add: cdt_parent_of_def)\n apply (drule(1) mdb_cte_atD)\n apply simp\n done\n\ncrunch typ_at[wp]: cancel_badged_sends \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps simp: crunch_simps filterM_mapM unless_def\n ignore: without_preemption filterM set_object clearMemory)\n\nlocale CNodeInv_AI_4 = CNodeInv_AI_3 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes finalise_slot_typ_at [wp]:\n \"\\P T p. \\\\s::'state_ext state. P (typ_at T p s)\\ finalise_slot a b \\\\_ s. P (typ_at T p s)\\\"\n assumes weak_derived_appropriate:\n \"\\cap cap'. weak_derived cap cap' \\ appropriate_cte_cap cap = appropriate_cte_cap cap'\"\n\ncontext CNodeInv_AI_4 begin\n\nlemma inv_cnode_typ_at:\n \"\\P T p ci. \\\\s::'state_ext state. P (typ_at T p s)\\ invoke_cnode ci \\\\rv s. P (typ_at T p s)\\\"\n apply (case_tac ci, simp_all add: invoke_cnode_def split del: if_split)\n apply (wp cap_insert_typ_at cap_move_typ_at cap_swap_typ_at hoare_drop_imps\n cap_delete_typ_at cap_revoke_typ_at hoare_vcg_all_lift | wpc |\n simp | rule conjI impI | rule hoare_pre)+\n done\n\nlemma invoke_cnode_tcb[wp]:\n \"\\tptr ci. \\tcb_at tptr::'state_ext state \\ bool\\ invoke_cnode ci \\\\rv. tcb_at tptr\\\"\n by (simp add: tcb_at_typ, wp inv_cnode_typ_at)\n\nend\n\n\nlemma duplicate_creation:\n \"\\cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cap) p\n and cte_at p' and K (p \\ p')\\\n set_cap cap p'\n \\\\rv s. cte_wp_at (\\cap. \\ is_final_cap' cap s) p s\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_post_imp [where Q=\"\\rv. cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cap) p\n and cte_wp_at ((=) cap) p'\"])\n apply (clarsimp simp: cte_wp_at_def)\n apply (case_tac \"\\x. x \\ obj_refs cap \\ x \\ obj_refs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_obj_ref)\n apply simp\n apply (case_tac \"\\x. x \\ cap_irqs cap \\ x \\ cap_irqs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_irq, simp)\n apply (case_tac \"\\x. x \\ arch_gen_refs cap \\ x \\ arch_gen_refs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_arch_refs, simp)\n apply (simp add: is_final_cap'_def gen_obj_refs_eq gen_obj_refs_Int)\n apply (wp set_cap_cte_wp_at)\n apply simp_all\n done\n\n\ndefinition\n zombies_final_caps :: \"(cslot_ptr \\ cap) \\ bool\"\nwhere\n \"zombies_final_caps \\ \\cps. \\p p' cap cap'.\n cps p = Some cap \\ cps p' = Some cap'\n \\ obj_refs cap \\ obj_refs cap' \\ {} \\ p \\ p'\n \\ \\ is_zombie cap \\ \\ is_zombie cap'\"\n\n\nlemma zombies_final_caps_of_state:\n \"zombies_final = zombies_final_caps \\ caps_of_state\"\n by (rule ext,\n simp add: zombies_final_def2 zombies_final_caps_def\n cte_wp_at_caps_of_state)\n\n\nlemma zombies_final_injective:\n \"\\ zombies_final_caps (caps_of_state s); inj f \\\n \\ zombies_final_caps (caps_of_state s \\ f)\"\n apply (simp only: zombies_final_caps_def o_def)\n apply (intro allI impI)\n apply (elim conjE allE, erule mp)\n apply (erule conjI)+\n apply (simp add: inj_eq)\n done\n\n\nlemma set_cdt_caps_of_state[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_cdt p \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: set_cdt_def)\n apply wp\n apply (simp add: caps_of_state_cte_wp_at)\n done\n\n\nlemma cap_move_caps_of_state:\n notes fun_upd_apply [simp del]\n shows \"\\\\s. P ((caps_of_state s) (ptr' \\ cap, ptr \\ cap.NullCap ))\\\n cap_move cap ptr ptr'\n \\\\rv s. P (caps_of_state s)\\\"\n by (wpsimp simp: cap_move_def)\n\n\nlemma zombies_duplicate_creation:\n \"\\\\s. zombies_final s \\ \\ is_zombie cap\n \\ (\\p'. cte_wp_at (\\c. obj_refs c = obj_refs cap \\ \\ is_zombie c) p' s)\n \\ cte_wp_at ((=) cap.NullCap) p s\\\n set_cap cap p\n \\\\rv. zombies_final\\\"\n apply (wp set_cap_zombies)\n apply (clarsimp simp: cte_wp_at_def)\n apply (thin_tac \"x \\ y\" for x y)\n apply (case_tac \"(a, b) = (aa, ba)\")\n apply clarsimp\n apply (drule(3) zombies_finalD2)\n apply blast\n apply simp\n done\n\n\nlemma state_refs_of_rvk[simp]:\n \"state_refs_of (is_original_cap_update f s) = state_refs_of s\"\n by (simp add: state_refs_of_def)\n\n\nlemma weak_derived_is_zombie:\n \"weak_derived cap cap' \\ is_zombie cap = is_zombie cap'\"\n by (auto simp: weak_derived_def copy_of_def is_cap_simps same_object_as_def\n split: if_split_asm cap.splits)\n\n\nlemma cap_move_zombies_final[wp]:\n \"\\zombies_final and cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\\\n cap_move cap ptr ptr'\n \\\\rv. zombies_final\\\"\n unfolding cap_move_def zombies_final_caps_of_state o_def set_cdt_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n apply (simp add: cte_wp_at_caps_of_state zombies_final_caps_def del: split_paired_All)\n apply (elim conjE exE)\n apply (intro impI allI)\n apply (simp add: weak_derived_obj_refs weak_derived_is_zombie del: split_paired_All)\n apply blast\n done\n\n\nlemma cap_move_if_live[wp]:\n \"\\cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\n and if_live_then_nonz_cap\\\n cap_move cap ptr ptr'\n \\\\rv s. if_live_then_nonz_cap s\\\"\n unfolding cap_move_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n apply (rule hoare_post_imp, simp only: if_live_then_nonz_cap_def)\n apply (simp only: ex_nonz_cap_to_def cte_wp_at_caps_of_state\n imp_conv_disj)\n apply (wp hoare_vcg_disj_lift hoare_vcg_all_lift)+\n apply (clarsimp simp: if_live_then_nonz_cap_def\n ex_nonz_cap_to_def cte_wp_at_caps_of_state\n del: allI\n simp del: split_paired_Ex)\n apply (erule allEI, rule impI, drule(1) mp)\n apply (erule exfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (clarsimp simp: weak_derived_obj_refs zobj_refs_to_obj_refs)\n apply (rule conjI)\n apply (clarsimp simp: weak_derived_is_zombie)\n apply clarsimp\n done\n\n\nlemma weak_derived_cte_refs':\n \"weak_derived cap cap' \\ cte_refs cap = cte_refs cap'\"\n by (fastforce simp: copy_of_cte_refs weak_derived_def)\n\n\nlemma appropriate_cte_master:\n \"appropriate_cte_cap (cap_master_cap cap) = appropriate_cte_cap cap\"\n apply (rule ext)\n apply (simp add: cap_master_cap_def appropriate_cte_cap_def\n split: cap.split)\n done\n\n\ncontext CNodeInv_AI_4 begin\n\nlemma cap_move_if_unsafe [wp]:\n \"\\ptr' cap ptr.\n \\cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\n and if_unsafe_then_cap\n and ex_cte_cap_wp_to (appropriate_cte_cap cap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. if_unsafe_then_cap :: 'state_ext state \\ bool\\\"\n subgoal for ptr' cap ptr\n apply (simp add: cap_move_def)\n apply (wp | simp)+\n apply (rule hoare_post_imp, simp only: if_unsafe_then_cap_def)\n apply (simp only: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state)\n apply wp+\n apply (clarsimp simp: if_unsafe_then_cap_def\n ex_cte_cap_wp_to_def cte_wp_at_caps_of_state\n simp del: split_paired_All split_paired_Ex\n del: allI\n split del: if_split)\n apply (frule weak_derived_Null)\n apply (frule weak_derived_cte_refs')\n apply (frule cap_irqs_appropriateness [OF weak_derived_cap_irqs])\n apply (frule weak_derived_appropriate)\n apply (erule allfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (case_tac \"cref = ptr'\")\n apply (intro allI impI,\n rule_tac x=\"(id (ptr := ptr', ptr' := ptr)) (a, b)\" in exI)\n apply fastforce\n apply (clarsimp split: if_split_asm split del: if_split del: exE\n simp del: split_paired_All split_paired_Ex)\n apply (erule exfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (clarsimp split: if_split_asm)\n apply fastforce\n done\n done\n\nend\n\n\ncrunch arch[wp]: cap_move \"\\s. P (arch_state s)\"\n\ncrunch irq_node[wp]: cap_move \"\\s. P (interrupt_irq_node s)\"\n\nlemma cap_range_NullCap:\n \"cap_range cap.NullCap = {}\"\n by (simp add: cap_range_def)\n\ncrunch interrupt_states[wp]: cap_move \"\\s. P (interrupt_states s)\"\n\n\nlemma cap_move_irq_handlers[wp]:\n \"\\valid_irq_handlers and cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\\\n cap_move cap ptr ptr'\n \\\\rv. valid_irq_handlers\\\"\n apply (simp add: valid_irq_handlers_def irq_issued_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=interrupt_states, OF cap_move_interrupt_states])\n apply (simp add: cap_move_def set_cdt_def)\n apply (wp | simp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state\n elim!: ranE split: if_split_asm\n dest!: weak_derived_cap_irqs)\n apply auto\n done\n\n\nlemma cap_move_has_reply_cap_neg:\n \"\\\\s. \\ has_reply_cap t s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at ((=) cap.NullCap) p' s \\\n p \\ p'\\\n cap_move c p p' \\\\rv s. \\ has_reply_cap t s\\\"\n apply (simp add: has_reply_cap_def is_reply_cap_to_def cte_wp_at_caps_of_state\n del: split_paired_All split_paired_Ex)\n apply (wp cap_move_caps_of_state)\n apply (elim conjE exE)\n apply (drule(1) cap_swap_no_reply_caps[where cs=\"caps_of_state _\"])\n apply fastforce+\n done\n\n\nlemma cap_move_replies:\n \"\\\\s. valid_reply_caps s\n \\ cte_wp_at (weak_derived c) p s\n \\ cte_wp_at ((=) cap.NullCap) p' s\n \\ p \\ p'\\\n cap_move c p p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: valid_reply_caps_def)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_move_has_reply_cap_neg)\n apply (simp add: cap_move_def, (wp|simp)+)\n apply (rule cap_move_caps_of_state)\n apply (clarsimp simp: fun_upd_def cte_wp_at_caps_of_state\n unique_reply_caps_cap_swap [simplified fun_upd_def])\n done\n\n\nlemma copy_of_reply_master:\n \"copy_of cap cap' \\ is_master_reply_cap cap = is_master_reply_cap cap'\"\n apply (clarsimp simp: copy_of_def is_cap_simps)\n apply (clarsimp simp: same_object_as_def split: cap.splits)\n done\n\n\ncontext CNodeInv_AI_4 begin\n\nlemma cap_move_valid_arch_caps[wp]:\n \"\\cap ptr.\n \\valid_arch_caps\n and cte_wp_at (weak_derived cap) ptr\n and cte_wp_at ((=) cap.NullCap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_move_def)\n apply (rule hoare_pre)\n apply (subst bind_assoc[symmetric],\n rule hoare_seq_ext [rotated],\n rule swap_of_caps_valid_arch_caps)\n apply (wp | simp)+\n apply (clarsimp elim!: cte_wp_at_weakenE)\n done\n\nend\n\n\n\nlemma cap_move_valid_ioc[wp]:\n \"\\valid_ioc and\n cte_wp_at (weak_derived cap) ptr and cte_wp_at ((=) cap.NullCap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. valid_ioc\\\"\n apply (simp add: cap_move_def valid_ioc_def[abs_def] cte_wp_at_caps_of_state\n pred_conj_def)\n apply (wp set_cdt_cos_ioc set_cap_caps_of_state2 | simp)+\n apply (cases ptr, clarsimp simp add: cte_wp_at_caps_of_state valid_ioc_def)\n apply (drule spec, drule spec, erule impE, assumption)\n apply clarsimp\n done\n\ndeclare cdt_update.state_refs_update [simp]\n\nlocale CNodeInv_AI_5 = CNodeInv_AI_4 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes cap_move_invs[wp]:\n \"\\cap ptr' ptr.\n \\invs and valid_cap cap and cte_wp_at ((=) cap.NullCap) ptr'\n and tcb_cap_valid cap ptr'\n and cte_wp_at (weak_derived cap) ptr\n and cte_wp_at (\\c. c \\ cap.NullCap) ptr\n and ex_cte_cap_wp_to (appropriate_cte_cap cap) ptr' and K (ptr \\ ptr')\n and K (\\ is_master_reply_cap cap)\\\n cap_move cap ptr ptr'\n \\\\rv. invs::'state_ext state \\ bool\\\"\n\nlemma cte_wp_at_use2:\n \"\\cte_wp_at P p s; cte_wp_at P' p s; \\c. \\cte_wp_at ((=) c) p s; P c; P' c\\ \\ Q \\ \\ Q\"\n by (auto simp: cte_wp_at_caps_of_state)\n\nlemma cte_wp_at_use3:\n \"\\cte_wp_at P p s; cte_wp_at P' p s; cte_wp_at P'' p s; \\c. \\cte_wp_at ((=) c) p s; P c; P' c; P'' c\\ \\ Q \\ \\ Q\"\n by (auto simp: cte_wp_at_caps_of_state)\n\nlemma cap_move_valid_cap[wp]:\n \"\\\\s. s \\ cap'\\ cap_move cap p p' \\\\_ s. s \\ cap'\\\"\n unfolding cap_move_def\n by (wp set_cdt_valid_cap | simp)+\n\nlemma weak_derived_cte_refs_abs:\n \"weak_derived c c' \\ cte_refs c' = cte_refs c\"\n apply (clarsimp simp: weak_derived_def copy_of_def)\n apply (auto simp: same_object_as_def is_cap_simps bits_of_def\n split: if_split_asm cap.splits)\n done\n\nlemma cap_move_ex_cap_cte:\n \"\\ex_cte_cap_wp_to P ptr and\n cte_wp_at (weak_derived cap) p and\n cte_wp_at ((=) cap.NullCap) p' and\n K (p \\ p') and K (\\cap'. weak_derived cap cap' \\ P cap = P cap')\\\n cap_move cap p p'\n \\\\_. ex_cte_cap_wp_to P ptr\\\"\n unfolding cap_move_def ex_cte_cap_wp_to_def cte_wp_at_caps_of_state set_cdt_def\n apply (rule hoare_pre)\n apply wp\n apply (simp del: split_paired_Ex)\n apply (wp set_cap_caps_of_state | simp del: split_paired_Ex add: cte_wp_at_caps_of_state)+\n apply (elim conjE exE)\n apply (case_tac \"cref = p\")\n apply (rule_tac x=p' in exI)\n apply clarsimp\n apply (drule weak_derived_cte_refs_abs)\n apply simp\n apply (rule_tac x=cref in exI)\n apply clarsimp\n done\n\nlemma cap_move_src_slot_Null:\n \"\\cte_at src and K(src \\ dest)\\ cap_move cap src dest \\\\_ s. cte_wp_at ((=) cap.NullCap) src s\\\"\n unfolding cap_move_def\n by (wp set_cdt_cte_wp_at set_cap_cte_wp_at' | simp)+\n\n\ncrunch pred_tcb_at[wp]: cap_move \"pred_tcb_at proj P t\"\n\nlemmas (in CNodeInv_AI_5) cap_revoke_cap_table[wp]\n = cap_table_at_lift_valid [OF cap_revoke_typ_at]\n\nlemmas appropriate_cte_cap_simps = appropriate_cte_cap_def [split_simps cap.split]\n\ncontext CNodeInv_AI_5 begin\n\ncrunch inv [wp]: is_final_cap \"P\"\n\nlemma is_final_cap_is_final[wp]:\n \"\\\\\\ is_final_cap cap \\\\rv s. rv = is_final_cap' cap s\\\"\n unfolding is_final_cap_def\n by wp simp\n\nend\n\nlemma real_cte_not_reply_masterD:\n \"\\P ptr.\n \\ real_cte_at ptr s; valid_reply_masters s; valid_objs s \\ \\\n cte_wp_at (\\cap. \\ is_master_reply_cap cap) ptr s\"\n apply clarsimp\n apply (subgoal_tac \"\\ tcb_at a s\")\n apply (clarsimp simp: cap_table_at_cte_at cte_wp_at_not_reply_master)\n apply (clarsimp simp: obj_at_def is_tcb is_cap_table)\n done\n\nlemma real_cte_weak_derived_not_reply_masterD:\n \"\\cap ptr.\n \\ cte_wp_at (weak_derived cap) ptr s; real_cte_at ptr s;\n valid_reply_masters s; valid_objs s \\ \\\n \\ is_master_reply_cap cap\"\n by (fastforce simp: cte_wp_at_caps_of_state weak_derived_replies\n dest!: real_cte_not_reply_masterD)\n\nlemma real_cte_is_derived_not_replyD:\n \"\\m p cap ptr.\n \\ cte_wp_at (is_derived m p cap) ptr s; real_cte_at ptr s;\n valid_reply_masters s; valid_objs s \\ \\\n \\ is_reply_cap cap\"\n by (fastforce simp: cte_wp_at_caps_of_state is_derived_def\n dest!: real_cte_not_reply_masterD)\n\n\nlemma cap_irqs_is_derived:\n \"is_derived m ptr cap cap' \\ cap_irqs cap = cap_irqs cap'\"\n by (clarsimp simp: is_derived_def cap_master_cap_irqs split: if_split_asm)\n\n\nlemma tcb_cap_valid_mdb[simp]:\n \"tcb_cap_valid cap p (cdt_update mfn s) = tcb_cap_valid cap p s\"\n by (simp add: tcb_cap_valid_def)\n\n\nlemma tcb_cap_valid_is_original_cap[simp]:\n \"tcb_cap_valid cap p (is_original_cap_update mfn s) = tcb_cap_valid cap p s\"\n by (simp add: tcb_cap_valid_def)\n\n\ncrunch tcb_cap_valid[wp]: cap_move \"tcb_cap_valid cap p\"\n\n\ncontext CNodeInv_AI_5 begin\n\nlemma invoke_cnode_invs[wp]:\n fixes i shows\n \"\\invs and valid_cnode_inv i\\ invoke_cnode i \\\\rv. invs::'state_ext state \\ bool\\\"\n unfolding invoke_cnode_def\n apply (cases i)\n apply simp\n apply wp\n apply (simp add: ex_cte_cap_to_cnode_always_appropriate_strg\n real_cte_tcb_valid)\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_caps_of_state dest!: cap_irqs_is_derived)\n apply (rule conjI)\n apply (elim conjE)\n apply (drule real_cte_is_derived_not_replyD)\n apply (simp add:invs_valid_objs invs_valid_reply_masters)+\n apply (clarsimp simp:is_cap_simps)\n apply (elim conjE)\n apply (drule real_cte_not_reply_masterD)\n apply (simp add:invs_valid_objs invs_valid_reply_masters)+\n apply (clarsimp simp: cte_wp_at_caps_of_state is_derived_def)\n apply simp\n apply wp\n apply (fastforce simp: real_cte_tcb_valid cte_wp_at_caps_of_state\n ex_cte_cap_to_cnode_always_appropriate_strg\n dest: real_cte_weak_derived_not_reply_masterD)\n apply simp\n apply (wp cap_revoke_invs)\n apply simp\n apply simp\n apply wp\n apply (clarsimp simp: emptyable_def obj_at_def is_tcb is_cap_table)\n apply simp\n apply (rule conjI)\n apply (rule impI)\n apply wp\n apply (fastforce simp: real_cte_tcb_valid\n ex_cte_cap_to_cnode_always_appropriate_strg\n dest: real_cte_weak_derived_not_reply_masterD)\n apply (rule impI)\n apply (rule hoare_pre)\n apply wp\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wp cap_move_caps_of_state cap_move_ex_cap_cte)\n apply (simp add: pred_conj_def)\n apply (elim conjE exE)\n apply (simp add: real_cte_tcb_valid ex_cte_cap_to_cnode_always_appropriate_strg\n cap_irqs_appropriateness [OF weak_derived_cap_irqs])\n apply (intro conjI,\n (fastforce simp: cte_wp_at_caps_of_state\n dest: real_cte_weak_derived_not_reply_masterD)+)[1]\n apply (wpsimp wp: hoare_drop_imps get_cap_wp)+\n apply (rule conjI)\n apply (clarsimp elim!: cte_wp_valid_cap)\n apply (clarsimp simp: real_cte_tcb_valid cte_wp_at_caps_of_state\n is_cap_simps ex_cte_cap_to_cnode_always_appropriate_strg)\n apply (wpsimp)\n done\n\nend\n\ncrunch pred_tcb_at[wp]: cap_move \"pred_tcb_at proj P t\"\n\n\n(* FIXME: rename, move *)\nlemma omgwtfbbq[simp]:\n \"(\\x. y \\ x) = False\"\n by clarsimp\n\n\nlemma corres_underlying_lift_ex1:\n assumes c: \"\\v. corres_underlying sr nf nf' r (P v and Q) P' a c\"\n shows \"corres_underlying sr nf nf' r ((\\s. \\v. P v s) and Q) P' a c\"\n unfolding corres_underlying_def\n apply clarsimp\n apply (cut_tac v = v in c)\n apply (auto simp: corres_underlying_def)\n done\n\n\nlemmas corres_underlying_lift_ex1' = corres_underlying_lift_ex1 [where Q = \\, simplified]\n\n\nlemma corres_underlying_lift_ex2:\n assumes c: \"\\v. corres_underlying sr nf nf' r P (P' v and Q) a c\"\n shows \"corres_underlying sr nf nf' r P ((\\s. \\v. P' v s) and Q) a c\"\n unfolding corres_underlying_def\n apply clarsimp\n apply (cut_tac v = v in c)\n apply (auto simp: corres_underlying_def)\n done\n\n\nlemmas corres_underlying_lift_ex2' = corres_underlying_lift_ex2 [where Q = \\, simplified]\n\n\nlemma real_cte_halted_if_tcb[simp]:\n \"real_cte_at (a, b) s \\ halted_if_tcb a s\"\n by (clarsimp simp: halted_if_tcb_def obj_at_def is_cap_table is_tcb)\n\nlemma descendants_of_empty:\n \"x \\ descendants_of cref Map.empty\"\n by (simp add: descendants_of_def cdt_parent_rel_def is_cdt_parent_def)\n\nlemma has_parent_cte_at:\"valid_mdb s \\ (cdt s) c = Some p \\ cte_at c s\"\n apply (rule cte_wp_cte_at)\n apply (simp add: valid_mdb_def mdb_cte_at_def del: split_paired_All)\n apply blast\n done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/CNodeInv_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.33111972642778714, "lm_q1q2_score": 0.19499280309801523}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Christoph Sprenger, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze, Christoph Sprenger\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection\\Concrete Parametrized Model\\\ntext\\This is the refinement of the intermediate dataplane model. \nThis model is parametric, and requires instantiation of the hop validation function, \n(and other parameters). We do so in the @{text \"Parametrized_Dataplane_3_directed\"} and\n@{text \"Parametrized_Dataplane_3_undirected\"} models.\nNevertheless, this model contains the complete refinement proof, albeit the hard case, the refinement\nof the attacker event, is assumed to hold. The crux of the refinement proof is thus shown in these \ndirected/undirected instance models.\nThe definitions to be given by the instance are those of the locales @{text \"dataplane_2_defs\"} \n(which contains the basic definitions needed for the protocol, such as the verification of a hop field, \ncalled @{text \"hf_valid_generic\"}), and @{text \"dataplane_2_ik_defs\"} (containing the definition of \ncomponents of the intruder knowledge).\nThe proof obligations are those in the locale @{text \"dataplane_2\"}.\\\n\ntheory Parametrized_Dataplane_2\n imports\n \"Parametrized_Dataplane_1\" \"Network_Model\"\nbegin\n\nrecord ('aahi, 'uhi) HF =\n AHI :: \"'aahi ahi_scheme\"\n UHI :: \"'uhi\"\n HVF :: msgterm \n\nrecord ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 =\n AInfo :: 'ainfo\n UInfo :: \"'uinfo\"\n past :: \"('aahi, 'uhi) HF list\"\n future :: \"('aahi, 'uhi) HF list\"\n history :: \"'aahi ahi_scheme list\"\n\ntext\\We use pkt2 instead of pkt, but otherwise the state remains unmodified in this model.\\\nrecord ('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state = \n chan2 :: \"(as \\ ifs \\ as \\ ifs) \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 set\"\n loc2 :: \"as \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 set\"\n\ndatatype ('aahi, 'uinfo, 'uhi, 'ainfo) evt2 = \n evt_dispatch_int2 as \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" \n | evt_recv2 as ifs \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" \n | evt_send2 as ifs \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" \n | evt_deliver2 as \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\"\n | evt_dispatch_ext2 as ifs \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" \n | evt_observe2 \"('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state\"\n | evt_skip2\n\ndefinition soup2 where \"soup2 m s \\ \\x. m \\ (loc2 s) x \\ (\\x. m \\ (chan2 s) x)\" \n\ndeclare soup2_def [simp]\n\nfun fwd_pkt :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" where\n \"fwd_pkt \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1#fut, history = hist \\ \n = \\ AInfo = ainfo, UInfo = uinfo, past = hf1#pas, future = fut, history = (AHI hf1)#hist \\\"\n\n(******************************************************************************)\nsubsection \\Hop validation check, authorized segments, and path extraction.\\\n(******************************************************************************)\ntext\\First we define a locale that requires a number of functions. We will later extend this\nto a locale @{text \"dataplane_2\"}, which makes assumptions on how these functions operate. We separate the \nassumptions in order to make use of some auxiliary definitions defined in this locale. \\\nlocale dataplane_2_defs = network_model _ auth_seg0\n for auth_seg0 :: \"('ainfo \\ 'aahi ahi_scheme list) set\" +\n\\ \\@{text \"hf_valid_generic\"} is the check that every hop performs. Besides the hop's own field, \nthe check may require access to its neighboring hop fields as well as on @{text \"ainfo\"}, \n@{text \"uinfo\"} and the entire sequence of hop fields. \nNote that this check should include checking the validity of the info fields. Depending on the \ndirected vs. undirected setting, this check may only have access to specific fields.\\\n fixes hf_valid_generic :: \"'ainfo \\ 'uinfo\n \\ ('aahi, 'uhi) HF list\n \\ ('aahi, 'uhi) HF option \n \\ ('aahi, 'uhi) HF\n \\ ('aahi, 'uhi) HF option \\ bool\"\n\\ \\@{text \"hfs_valid_prefix_generic\"} is the longest prefix of a given future path, such that \n@{text \"hf_valid_generic\"} passes for each hop field on the prefix.\\\n and hfs_valid_prefix_generic ::\n \"'ainfo \\ 'uinfo\n \\ ('aahi, 'uhi) HF list\n \\ ('aahi, 'uhi) HF option\n \\ ('aahi, 'uhi) HF list\n \\ ('aahi, 'uhi) HF option \\ ('aahi, 'uhi) HF list\"\n\\ \\We need @{text \"auth_restrict\"} to further restrict the set of authorized segments. For instance,\n we need it for the empty segment (ainfo, []) since according to the definition any such\n ainfo will be contained in the intruder knowledge. With @{text \"auth_restrict\"} we can restrict this.\\\n and auth_restrict :: \"'ainfo \\ 'uinfo \\ ('aahi, 'uhi) HF list \\ bool\"\n\\ \\@{text \"extr\"} extracts from a given hop validation field (@{text \"HVF hf\"}) the entire authenticated future path that \nis embedded in the HVF.\\\n and extr :: \"msgterm \\ 'aahi ahi_scheme list\"\n\\ \\@{text \"extr_ainfo\"} extracts the authenticated info field (ainfo) from a given hop validation field.\\\n and extr_ainfo :: \"msgterm \\ 'ainfo\"\n\\ \\@{text \"term_ainfo\"} extracts what msgterms the intruder can learn from analyzing a given \nauthenticated info field.\\\n and term_ainfo :: \"'ainfo \\ msgterm\"\n\\ \\@{text \"terms_hf\"} extracts what msgterms the intruder can learn from analyzing a given hop field; for instance,\nthe hop validation field HVF hf and the segment identifier UHI hf.\\\n and terms_hf :: \"('aahi, 'uhi) HF \\ msgterm set\"\n\\ \\@{text \"terms_uinfo\"} extracts what msgterms the intruder can learn from analyzing a given uinfo field.\\\n and terms_uinfo :: \"'uinfo \\ msgterm set\"\n\\ \\@{text \"upd_uinfo\"} takes a uinfo field an a hop field and returns the updated uinfo field.\\\n and upd_uinfo :: \"'uinfo \\ ('aahi, 'uhi) HF \\ 'uinfo\"\n\\ \\As @{text \"ik_oracle\"} (defined below) gives the attacker direct access to hop validation fields \nthat could be used to break the property, we have to either restrict the scope of the property, or \nrestrict the attacker such that he cannot use the oracle-obtained hop validation fields in packets \nwhose path origin matches the path origin of the oracle query. We choose the latter approach and \nfix a predicate @{text \"no_oracle\"} that tells us if the oracle has not been queried for a path \norigin (ainfo, uinfo combination). This is a prophecy variable.\\\n and no_oracle :: \"'ainfo \\ 'uinfo \\ bool\"\n\nbegin\n\n(******************************************************************************)\nsubsubsection \\Auxiliary definitions and lemmas\\\n(******************************************************************************)\n\ntext\\Define uinfo field updates.\\\nfun upd_uinfo_pkt :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ 'uinfo\" where\n \"upd_uinfo_pkt \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1#fut, history = hist \\ \n = upd_uinfo uinfo hf1\"\n| \"upd_uinfo_pkt \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = [], history = hist \\ = uinfo\"\n\ndefinition upd_pkt :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2\" where\n \"upd_pkt pkt = pkt\\UInfo := upd_uinfo_pkt pkt\\\"\n\ntext \\This function maps hop fields of the dp2 format to hop fields of dp0 format.\\\ndefinition AHIS :: \"('aahi, 'uhi) HF list \\ 'aahi ahi_scheme list\" where\n \"AHIS hfs \\ map AHI hfs\"\n\ndeclare AHIS_def[simp]\n\nfun extr_from_hd :: \"('aahi, 'uhi) HF list \\ 'aahi ahi_scheme list\" where\n \"extr_from_hd (hf#xs) = extr (HVF hf)\"\n | \"extr_from_hd _ = []\"\n\nfun extr_ainfoHd where\n \"extr_ainfoHd (hf#xs) = Some (extr_ainfo (HVF hf))\"\n | \"extr_ainfoHd _ = None\"\n\n\nlemma prefix_AHIS:\n \"prefix x1 x2 \\ prefix (AHIS x1) (AHIS x2)\"\n by (induction x1 arbitrary: x2 rule: list.induct) \n (auto simp add: prefix_def)\n\nlemma AHIS_set: \"hf \\ set (AHIS l) \\ \\hfc . hfc \\ set l \\ hf = AHI hfc\"\n by(induction l) auto\n\nlemma AHIS_set_rev: \"\\AHI = ahi, UHI = uhi, HVF = x\\ \\ set hfs \\ ahi \\ set (AHIS hfs)\"\n by(induction hfs, auto)\n\nfun pkt2to1loc :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ ('aahi, 'ainfo) pkt1\" where\n \"pkt2to1loc \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = fut, history = hist \\ = \n \\ pkt0.AInfo = ainfo, \n past = AHIS pas, \n future = AHIS (hfs_valid_prefix_generic ainfo uinfo pas (head pas) fut None), \n history = hist\\\"\n\nfun pkt2to1chan :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ ('aahi, 'ainfo) pkt1\" where\n \"pkt2to1chan \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = fut, history = hist \\ = \n \\ pkt0.AInfo = ainfo, \n past = AHIS pas, \n future = AHIS (hfs_valid_prefix_generic ainfo \n (upd_uinfo_pkt \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = fut, history = hist \\) \n pas (head pas) fut None), \n history = hist\\\"\n\nabbreviation AHIo :: \"('aahi, 'uhi) HF option \\ 'aahi ahi_scheme option\" where\n \"AHIo \\ map_option AHI\"\n\n(******************************************************************************)\nsubsubsection \\Authorized segments\\\n(******************************************************************************)\n\ntext \\Main definition of authorized up-segments. Makes sure that:\n\\begin{itemize}\n\\item the segment is rooted\n\\item the segment is terminated\n\\item the segment has matching interfaces\n\\item the projection to AS owners is an authorized segment in the abstract model. \n\\end{itemize}\\\ndefinition auth_seg2 :: \"'uinfo \\ ('ainfo \\ ('aahi, 'uhi) HF list) set\" where\n \"auth_seg2 uinfo \\ ({(ainfo, l) | ainfo l . hfs_valid_prefix_generic ainfo uinfo [] None l None = l \n \\ auth_restrict ainfo uinfo l\n \\ no_oracle ainfo uinfo\n \\ (ainfo, AHIS l) \\ auth_seg0})\"\n\nlemma auth_seg20:\n \"(x, y) \\ auth_seg2 uinfo \\ (x, AHIS y) \\ auth_seg0\" by(auto simp add: auth_seg2_def)\n\nlemma pfragment_auth_seg20:\n \"pfragment ainfo l (auth_seg2 uinfo) \\ pfragment ainfo (AHIS l) auth_seg0\" \n by (auto 3 4 simp add: pfragment_def map_append dest: auth_seg20)\n\nlemma pfragment_auth_seg20':\n \"\\pfragment ainfo l (auth_seg2 uinfo); l' = AHIS l\\ \\ pfragment ainfo l' auth_seg0\" \n using pfragment_auth_seg20 by blast\n\ntext \\This is a shortcut to denote adding a message to a local channel. \\\ndefinition\n dp2_add_loc2 :: \n \"('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ \n ('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ as \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ bool\"\nwhere \n \"dp2_add_loc2 s s' asid pkt \\ s' = s\\loc2 := (loc2 s)(asid := loc2 s asid \\ {pkt})\\\"\n\ntext \\This is a shortcut to denote adding a message to an inter-AS channel. Note that it requires \nthe link to exist.\\\ndefinition\n dp2_add_chan2 :: \n \"('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ ('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme\n \\ as \\ ifs \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ bool\"\nwhere \n \"dp2_add_chan2 s s' a1 i1 pkt \\ \n \\a2 i2 . rev_link a1 i1 = (Some a2, Some i2) \\\n s' = s\\chan2 := (chan2 s)((a1, i1, a2, i2) := chan2 s (a1, i1, a2, i2) \\ {pkt})\\\"\n\ntext \\This is a shortcut to denote receiving a message from an inter-AS channel. Note that it requires \nthe link to exist.\\\ndefinition\n dp2_in_chan2 :: \"('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ as \\ ifs \\ ('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ bool\"\nwhere \n \"dp2_in_chan2 s a1 i1 pkt \\ \n \\a2 i2 . rev_link a1 i1 = (Some a2, Some i2) \\\n pkt \\ (chan2 s)(a2, i2, a1, i1)\"\n\nlemmas dp2_msgs = dp2_add_loc2_def dp2_add_chan2_def dp2_in_chan2_def\n\n\nend\n(******************************************************************************)\nsubsection \\Intruder Knowledge definition\\\n(******************************************************************************)\nprint_locale dataplane_2_defs\nlocale dataplane_2_ik_defs = dataplane_2_defs _ _ _ _ hf_valid_generic _ _ _ _ _ _ _ upd_uinfo\n for hf_valid_generic :: \"'ainfo \\ 'uinfo\n \\ ('aahi, 'uhi) HF list \n \\ ('aahi, 'uhi) HF option \n \\ ('aahi, 'uhi) HF\n \\ ('aahi, 'uhi) HF option \\ bool\"\n and upd_uinfo :: \"'uinfo \\ ('aahi, 'uhi) HF \\ 'uinfo\" +\n\\ \\@{text \"ik_add\"} is Additional Intruder Knowledge, such as hop authenticators in EPIC L1.\\\nfixes ik_add :: \"msgterm set\"\n\\ \\@{text \"ik_oracle\"} is another type of additional Intruder Knowledge. We use it to model the attacker's\nability to brute-force individual hop validation fields and segment identifiers.\\\n and ik_oracle :: \"msgterm set\"\nbegin\n\ntext\\This set should contain all terms that can be learned from analyzing a hop field, in particular\nthe content of the HVF and UHI fields but not the uinfo field (see below).\\\ndefinition ik_hfs :: \"msgterm set\" where\n \"ik_hfs = {t | t hf hfs ainfo uinfo. t \\ terms_hf hf \\ hf \\ set hfs \\ (ainfo, hfs) \\ (auth_seg2 uinfo)}\"\n\ntext\\This set should contain all terms that can be learned from analyzing the uinfo field.\\\ndefinition ik_uinfo :: \"msgterm set\" where\n \"ik_uinfo = {t | ainfo hfs uinfo t. t \\ terms_uinfo uinfo \\ (ainfo, hfs) \\ (auth_seg2 uinfo)}\"\n\ndeclare ik_hfs_def[simp] ik_uinfo_def[simp] (*undeclared later, useful to prevent unfolding*)\n\ndefinition ik :: \"msgterm set\" where\n \"ik = ik_hfs\n \\ {term_ainfo ainfo | ainfo hfs uinfo. (ainfo, hfs) \\ (auth_seg2 uinfo)}\n \\ ik_uinfo\n \\ Key`(macK`bad)\n \\ ik_add\n \\ ik_oracle\"\n\ndefinition terms_pkt :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ msgterm set\" where \n \"terms_pkt m \\ {t | t hf. t \\ terms_hf hf \\ hf \\ set (past m) \\ set (future m)}\n \\ {term_ainfo ainfo | ainfo . ainfo = AInfo m}\n \\ \\{terms_uinfo uinfo | uinfo . uinfo = UInfo m}\"\n\ntext \\Intruder knowledge. We make a simplifying assumption about the attacker's passive capabilities:\n In contrast to his ability to insert messages (which is restricted to the locality of ASes\n that are compromised, i.e. in the set 'bad', the attacker has global eavesdropping abilities.\n This simplifies modelling and does not make the proofs more difficult, while providing stronger\n guarantees.\n We will later prove that the Dolev-Yao closure of @{term \"ik_dyn\"} remains constant, i.e., \n the attacker does not learn anything new by observing messages on the network \n (see @{text \"Inv_inv_ik_dyn\"}).\\\ndefinition ik_dyn :: \"('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ msgterm set\" where\n \"ik_dyn s \\ ik \\ (\\{terms_pkt m | m x . m \\ loc2 s x}) \\ (\\{terms_pkt m | m x . m \\ chan2 s x})\"\n\ntext\\Different way of presenting the intruder knowledge\\\ndefinition ik_dynamic :: \"('aahi, 'uinfo, 'uhi, 'ainfo, 'more) dp2_state_scheme \\ msgterm set\" where\n \"ik_dynamic s \\ ik \\ (\\{terms_pkt m | m . soup2 m s})\"\n\nlemma \"ik_dynamic s = ik_dyn s\" \n apply(auto simp add: ik_dyn_def ik_dynamic_def) \n by metis+\n\nlemma ik_dyn_mono: \"\\x \\ ik_dyn s; \\m . soup2 m s \\ soup2 m s'\\ \\ x \\ ik_dyn s'\"\n by (auto simp add: ik_dyn_def) metis+\n\nlemma ik_info[elim]:\n \"(ainfo, hfs) \\ (auth_seg2 uinfo) \\ term_ainfo ainfo \\ synth (analz ik)\"\n by(auto simp add: ik_def)blast\n\nlemma ik_ik_hfs: \"t \\ ik_hfs \\ t \\ ik\" by(auto simp add: ik_def)\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext\\This is an attacker event.\\\ntext\\The attacker is allowed to send any message that he can derive from his intruder knowledge,\nexcept for messages whose path origin he has queried the oracle for.\\\ndefinition\n dp2_dispatch_int\nwhere\n \"dp2_dispatch_int s m ainfo uinfo asid pas fut hist s' \\\n m = \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = fut, history = hist \\ \\\n hist = [] \\\n terms_pkt m \\ synth (analz (ik_dyn s)) \\\n no_oracle ainfo uinfo \\\n \\ \\action: Update the state to include m\\\n dp2_add_loc2 s s' asid m\"\n\ndefinition\n dp2_recv\nwhere\n \"dp2_recv s m asid ainfo uinfo hf1 downif pas fut hist s' \\\n \\ \\guard: a packet with valid interfaces and valid validation fields is in the incoming channel.\\\n m = \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1#fut, history = hist \\ \\\n dp2_in_chan2 s (ASID (AHI hf1)) downif m \\\n DownIF (AHI hf1) = Some downif \\\n ASID (AHI hf1) = asid \\\n hf_valid_generic ainfo (upd_uinfo uinfo hf1) (rev(pas)@hf1#fut) (head pas) hf1 (head fut) \\\n\n \\ \\action: Update local state to include message\\\n dp2_add_loc2 s s' asid (upd_pkt m)\"\n\ndefinition\n dp2_send\nwhere\n \"dp2_send s m asid ainfo uinfo hf1 upif pas fut hist s' \\\n \\ \\guard: forward the packet on the external channel and advance the path by one hop.\\\n m = \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1#fut, history = hist \\ \\\n m \\ (loc2 s) asid \\\n UpIF (AHI hf1) = Some upif \\\n ASID (AHI hf1) = asid \\\n hf_valid_generic ainfo uinfo (rev(pas)@hf1#fut) (head pas) hf1 (head fut) \\\n\n \\ \\action: Update state to include modified message\\\n dp2_add_chan2 s s' asid upif \\\n AInfo = ainfo,\n UInfo = uinfo,\n past = hf1 # pas,\n future = fut,\n history = AHI hf1 # hist\n \\\"\n\ndefinition\n dp2_deliver\nwhere\n \"dp2_deliver s m asid ainfo uinfo hf1 pas fut hist s' \\\n m = \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1#fut, history = hist \\ \\\n m \\ (loc2 s) asid \\\n ASID (AHI hf1) = asid \\\n fut = [] \\\n hf_valid_generic ainfo uinfo (rev(pas)@hf1#fut) (head pas) hf1 (head fut) \\\n\n \\ \\action: Update state to include modified message\\\n dp2_add_loc2 s s' asid \n \\\n AInfo = ainfo,\n UInfo = uinfo,\n past = hf1 # pas,\n future = [],\n history = (AHI hf1) # hist\n \\\"\n\ntext\\This is an attacker event.\\\ntext\\The attacker is allowed to send any message that he can derive from his intruder knowledge,\nexcept for messages whose path origin he has queried the oracle for.\\\ndefinition\n dp2_dispatch_ext\nwhere\n \"dp2_dispatch_ext s m asid ainfo uinfo upif pas fut hist s' \\\n m = \\ AInfo = ainfo, UInfo = uinfo, past = pas, future = fut, history = hist \\ \\\n asid \\ bad \\\n hist = [] \\\n terms_pkt m \\ synth (analz (ik_dyn s)) \\\n no_oracle ainfo uinfo \\\n\n \\ \\action\\\n dp2_add_chan2 s s' asid upif m\"\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\nfun dp2_trans where\n \"dp2_trans s (evt_dispatch_int2 asid m) s' \\ \n (\\ainfo uinfo pas fut hist . dp2_dispatch_int s m ainfo uinfo asid pas fut hist s')\" |\n \"dp2_trans s (evt_recv2 asid downif m) s' \\ \n (\\ainfo uinfo hf1 pas fut hist . dp2_recv s m asid ainfo uinfo hf1 downif pas fut hist s')\" |\n \"dp2_trans s (evt_send2 asid upif m) s' \\ \n (\\ainfo uinfo hf1 pas fut hist. dp2_send s m asid ainfo uinfo hf1 upif pas fut hist s')\" |\n \"dp2_trans s (evt_deliver2 asid m) s' \\ \n (\\ainfo uinfo hf1 pas fut hist. dp2_deliver s m asid ainfo uinfo hf1 pas fut hist s')\" |\n \"dp2_trans s (evt_dispatch_ext2 asid upif m) s' \\ \n (\\ainfo uinfo pas fut hist . dp2_dispatch_ext s m asid ainfo uinfo upif pas fut hist s')\" |\n \"dp2_trans s (evt_observe2 s'') s' \\ s = s' \\ s = s''\" |\n \"dp2_trans s evt_skip2 s' \\ s = s'\"\n\ndefinition dp2_init :: \"('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state\" where\n \"dp2_init \\ \\chan2 = (\\_. {}), loc2 = (\\_. {})\\\"\n\ndefinition dp2 :: \"(('aahi, 'uinfo, 'uhi, 'ainfo) evt2, ('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state) ES\" where\n \"dp2 \\ \\\n init = (=) dp2_init,\n trans = dp2_trans\n \\\"\n\nlemmas dp2_trans_defs = dp2_dispatch_int_def dp2_recv_def dp2_send_def dp2_deliver_def dp2_dispatch_ext_def\nlemmas dp2_defs = dp2_def dp2_init_def dp2_trans_defs\n\nend\n\n(******************************************************************************)\nsubsection \\Assumptions of the parametrized model\\\n(******************************************************************************)\ntext\\We now list the assumptions of this parametrized model. \\\n\nprint_locale dataplane_2_ik_defs\nlocale dataplane_2 = dataplane_2_ik_defs _ _ _ _ _ _ _ _ _ _ _ _ hf_valid_generic upd_uinfo _ _\n for hf_valid_generic :: \"'ainfo \\ 'uinfo\n \\ ('aahi, 'uhi) HF list \n \\ ('aahi, 'uhi) HF option \n \\ ('aahi, 'uhi) HF\n \\ ('aahi, 'uhi) HF option \\ bool\"\n and upd_uinfo :: \"'uinfo \\ ('aahi, 'uhi) HF \\ 'uinfo\" + \n(*\nremoved\n\\hf . hf \\ set hfs \\ terms_hf hf \\ synth (analz ik); term_ainfo ainfo \\ synth (analz ik);*)\nassumes ik_seg_is_auth:\n \"\\terms_pkt m \\ synth (analz ik); \n future m = hfs; AInfo m = ainfo;\n nxt = None; no_oracle ainfo uinfo\\\n \\ pfragment ainfo\n (ifs_valid_prefix prev'\n (AHIS (hfs_valid_prefix_generic ainfo uinfo pas pre hfs nxt))\n None)\n auth_seg0\" (*prev' vs prev?*)\nand upd_uinfo_ik: \n \"\\terms_uinfo uinfo \\ synth (analz ik); terms_hf hf \\ synth (analz ik)\\ \n \\ terms_uinfo (upd_uinfo uinfo hf) \\ synth (analz ik)\"\n(*\"terms_uinfo (UInfo m) \\ synth (analz ik) \\ terms_uinfo (upd_uinfo_pkt m) \\ synth (analz ik)\"*)\nand upd_uinfo_no_oracle: \"no_oracle ainfo uinfo \\ no_oracle ainfo (upd_uinfo uinfo fld)\"\n\n\\ \\We require that @{text \"hfs_valid_prefix_generic\"} behaves as expected, i.e., that it implements\nthe check mentioned above.\\\nand prefix_hfs_valid_prefix_generic: \n \"prefix (hfs_valid_prefix_generic ainfo uinfo pas pre fut nxt) fut\"\nand cons_hfs_valid_prefix_generic: \n \"\\hf_valid_generic ainfo uinfo hfs (head pas) hf1 (head fut); hfs = (rev pas)@hf1 #fut;\n m = \\AInfo = ainfo, UInfo = uinfo, past = pas, future = hf1 # fut, history = hist\\\\\n\\ hfs_valid_prefix_generic ainfo uinfo pas (head pas) (hf1 # fut) None = \n hf1 # (hfs_valid_prefix_generic ainfo (upd_uinfo_pkt (fwd_pkt m)) (hf1#pas) (Some hf1) fut None)\"\nbegin\n\n(******************************************************************************)\nsubsection \\Mapping dp2 state to dp1 state\\\n(******************************************************************************)\n\ndefinition R21 :: \"('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state \\ ('aahi, 'ainfo) dp1_state\" where\n \"R21 s = \\chan = \\x . pkt2to1chan ` ((chan2 s) x), \n loc = \\x . pkt2to1loc ` ((loc2 s) x)\\\"\n\nlemma auth_seg2_pfragment: \n \"\\pfragment ainfo (hf # fut) (auth_seg2 uinfo); AHIS (hf # fut) = x # xs\\\n \\ pfragment ainfo (x # xs) auth_seg0\"\n by(auto simp add: map_append auth_seg2_def pfragment_def)\n\nlemma dp2_in_chan2_to_0E[elim]:\n \"\\dp2_in_chan2 s1 a1 i1 pkt2; pkt2to1chan pkt2 = pkt0; s0 = R21 s1\\ \\ \n dp0_in_chan s0 a1 i1 pkt0\"\n by(auto simp add: R21_def dp2_in_chan2_def dp0_in_chan_def)\n\nlemma dp2_in_loc2_to_0E[elim]:\n \"\\pkt2 \\ (loc2 s1) asid; pkt2to1loc pkt2 = pkt0; P = pkt2to1loc ` loc2 s1 asid\\ \\ \n pkt0 \\ P\"\n by blast\n\nlemma dp2_add_loc20E:\n \"\\dp2_add_loc2 s1 s1' asid p1; p0 = pkt2to1loc p1; s0 = R21 s1; s0' = R21 s1'\\\n \\ dp0_add_loc s0 s0' asid p0\"\n by(auto simp add: R21_def dp2_add_loc2_def dp0_add_loc_def intro!: ext)\n\nlemma dp2_add_chan20E:\n \"\\dp2_add_chan2 s1 s1' a1 i1 p1; p0 = pkt2to1chan p1; s0 = R21 s1; s0' = R21 s1'\\\n \\ dp0_add_chan s0 s0' a1 i1 p0\"\n by(fastforce simp add: R21_def dp2_add_chan2_def dp0_add_chan_def)\n\n\n(******************************************************************************)\nsubsection\\Invariant: Derivable Intruder Knowledge is constant under @{text \"dp2_trans\"}\\\n(******************************************************************************)\n\ntext \\Derivable Intruder Knowledge stays constant throughout all reachable states\\\ndefinition inv_ik_dyn :: \"('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state \\ bool\" where\n \"inv_ik_dyn s \\ ik_dyn s \\ synth (analz ik)\"\n\nlemma inv_ik_dynI: \n assumes \"\\t m x . \\t \\ terms_pkt m; m \\ loc2 s x\\ \\ t \\ synth (analz ik)\"\n and \"\\t m x . \\t \\ terms_pkt m; m \\ chan2 s x\\ \\ t \\ synth (analz ik)\"\nshows \"inv_ik_dyn s\"\n using assms by(auto simp add: ik_dyn_def inv_ik_dyn_def)\n\nlemma inv_ik_dynD: \n assumes \"inv_ik_dyn s\"\n shows \"\\t m x . \\m \\ chan2 s x; t \\ terms_pkt m\\ \\ t \\ synth (analz ik)\"\n \"\\t m x . \\m \\ loc2 s x; t \\ terms_pkt m\\ \\ t \\ synth (analz ik)\"\n using assms \n by(auto simp add: ik_dyn_def inv_ik_dyn_def Union_eq dest!: subsetD intro!: exI) (*takes a few sec*)\n\nlemmas inv_ik_dynE = inv_ik_dynD[elim_format]\n\nlemma inv_ik_dyn_add_loc2[elim!]: \n \"\\dp2_add_loc2 s s' asid m; inv_ik_dyn s; terms_pkt m \\ synth (analz ik)\\\n \\ inv_ik_dyn s'\"\n by(auto simp add: dp2_add_loc2_def intro!: inv_ik_dynI elim: inv_ik_dynE)\n\nlemma inv_ik_dyn_add_chan2[elim!]: \n \"\\dp2_add_chan2 s s' a1 i1 m; inv_ik_dyn s; terms_pkt m \\ synth (analz ik)\\\n \\ inv_ik_dyn s'\"\n by(auto simp add: dp2_add_chan2_def intro!: inv_ik_dynI elim: inv_ik_dynE)\n \nlemma inv_ik_dyn_ik_dyn_ik[simp]: \n assumes \"inv_ik_dyn s\" shows \"synth (analz (ik_dyn s)) = synth (analz ik)\" \nproof-\n from assms have \"ik_dyn s \\ synth (analz ik)\" by(auto simp add: ik_dyn_def inv_ik_dyn_def)\n moreover have \"ik \\ ik_dyn s\" by(auto simp add: ik_dyn_def)\n ultimately show ?thesis using analz_idem analz_synth order_class.order.antisym sup.absorb2 \n synth_analz_mono synth_idem synth_increasing by metis\nqed\n\nlemma terms_pkt_upd: \n \"\\x \\ terms_pkt (upd_pkt p); \\x. x \\ terms_pkt p \\ x \\ synth (analz ik)\\ \\ x \\ synth (analz ik)\"\n apply(cases p) \n subgoal for AInfo UInfo past future history \n by(cases future) \n (auto simp add: upd_pkt_def terms_pkt_def elim!: upd_uinfo_ik[THEN subsetD, rotated 2])\n done\n\nlemma Inv_inv_ik_dyn: \"reach dp2 s \\ inv_ik_dyn s\"\nproof(induction s rule: reach.induct)\n case (reach_init s)\n then show ?case\n by (auto simp add: inv_ik_dyn_def dp2_defs ik_dyn_def)\nnext\n case (reach_trans s e s')\n then show ?case\n(* proof(auto simp add: dp2_def elim!: dp2_trans.elims)\n apply(simp add: dp2_def) \n apply(elim dp2_trans.elims exE sym[of s, elim_format] sym[of s', elim_format])\n apply(simp_all)\n*)\n proof(simp add: dp2_def, elim dp2_trans.elims exE sym[of s, elim_format] sym[of s', elim_format],\n simp_all)\n fix m ainfo uinfo asid pas fut hist\n assume \"inv_ik_dyn s\" \"dp2_dispatch_int s m ainfo uinfo asid pas fut hist s'\"\n then show \"inv_ik_dyn s'\"\n by(auto simp add: dp2_defs)\n next\n fix m asid ainfo uinfo hf1 downif pas fut hist\n assume \"inv_ik_dyn s\" \"dp2_recv s m asid ainfo uinfo hf1 downif pas fut hist s'\"\n then show \"inv_ik_dyn s'\" \n by(auto simp add: dp2_defs dp2_in_chan2_def elim: terms_pkt_upd dest: inv_ik_dynD(1))\n next\n fix m asid ainfo uinfo upif pas fut hist\n assume \"inv_ik_dyn s\" \"dp2_dispatch_ext s m asid ainfo uinfo upif pas fut hist s'\"\n then show \"inv_ik_dyn s'\"\n by(auto simp add: dp2_defs)\n qed(auto simp add: dp2_defs terms_pkt_def elim!: inv_ik_dynE)\nqed\n\n\n(******************************************************************************)\nsubsubsection\\Attacker dispatch events also capture honest dispatchers\\\n(******************************************************************************)\n\ntext\\This lemma shows that our definition of @{text \"dp2_dispatch_int\"} also works for honest senders.\nAll packets than an honest sender would send are authorized. According to the definition of the intruder \nknowledge, they are then also derivable from the intruder knowledge. Hence, an honest sender can\nsend packets with authorized segments. However, the restriction on @{text \"no_oracle\"} remains.\\\n\nlemma dp2_dispatch_int_also_works_for_honest:\n assumes \"pfragment ainfo fut (auth_seg2 uinfo)\" \"past m = []\" \"AInfo m = ainfo\" \"UInfo m = uinfo\"\n \"future m = fut\"\n shows \"terms_pkt m \\ synth (analz (ik_dyn s))\"\nproof-\n from assms have \"terms_pkt m \\ ik\"\n by (cases m)\n (auto 3 4 simp add: terms_pkt_def ik_def)\n then show ?thesis by (auto simp add: ik_dyn_def)\nqed\n\n\n(******************************************************************************)\nsubsection\\Refinement proof\\\n(******************************************************************************)\n\nfun \\\\<^sub>2 :: \"('aahi, 'uinfo, 'uhi, 'ainfo) evt2 \\ ('aahi, 'ainfo) evt0\" where \n \"\\\\<^sub>2 (evt_dispatch_int2 asid m) = evt_dispatch_int0 asid (pkt2to1loc m)\"\n| \"\\\\<^sub>2 (evt_recv2 asid downif m) = evt_recv0 asid downif (pkt2to1chan m)\"\n| \"\\\\<^sub>2 (evt_send2 asid upif m) = evt_send0 asid upif (pkt2to1loc m)\"\n| \"\\\\<^sub>2 (evt_deliver2 asid m) = evt_deliver0 asid (pkt2to1loc m)\"\n| \"\\\\<^sub>2 (evt_dispatch_ext2 asid upif m) = evt_dispatch_ext0 asid upif (pkt2to1chan m)\"\n| \"\\\\<^sub>2 (evt_observe2 s) = evt_observe0 (R21 s)\"\n| \"\\\\<^sub>2 evt_skip2 = evt_skip0\"\n\nlemma dp2_refines_dp1: \"dp2 \\\\<^sub>\\\\<^sub>2 dp1\"\nproof(rule simulate_ES_fun_with_invariant[where ?I = inv_ik_dyn, where ?h = R21])\n fix s0\n assume \"init dp2 s0\"\n then show \"init dp1 (R21 s0)\"\n by(auto simp add: R21_def dp1_defs dp2_defs) \nnext\n fix s e s'\n assume \"dp2: s\\e\\ s'\" and \"inv_ik_dyn s\"\n then show \"dp1: R21 s\\\\\\<^sub>2 e\\ R21 s'\"\n proof(auto simp add: dp2_def elim!: dp2_trans.elims)\n fix m ainfo uinfo asid hf pas fut hist\n assume \"dp2_dispatch_int s m ainfo uinfo asid pas fut hist s'\"\n then show \"dp1: R21 s\\evt_dispatch_int0 asid (pkt2to1loc m)\\ R21 s'\"\n by(auto simp add: dp1_defs dp2_defs \\inv_ik_dyn s\\ simp del: AHIS_def\n intro!: ik_seg_is_auth elim!: dp2_add_loc20E)\n next\n fix m asid ainfo uinfo hf1 downif pas fut hist\n assume \"dp2_recv s m asid ainfo uinfo hf1 downif pas fut hist s'\"\n then show \"dp1: R21 s\\evt_recv0 asid downif (pkt2to1chan m)\\ R21 s'\"\n apply(auto simp add: TW.takeW_split_tail dp1_defs dp2_defs terms_pkt_def\n elim!: dp2_in_chan2_to_0E dp2_add_loc20E intro: head.cases[where ?x=fut] \n intro!: exI[of _ \"AHI hf1\"])\n apply(rule exI[of _ \"AHIS (hfs_valid_prefix_generic ainfo (upd_uinfo_pkt (fwd_pkt (upd_pkt m))) (hf1#pas) (Some hf1) fut None)\"])\n apply auto\n subgoal \n thm cons_hfs_valid_prefix_generic[where ?uinfo =\"upd_uinfo _ _\", where ?hist = hist]\n apply(frule cons_hfs_valid_prefix_generic[where ?uinfo =\"upd_uinfo _ _\", where ?hist = hist]) \n by (auto simp add: upd_pkt_def) \n apply(auto simp add: TW.takeW_split_tail dp1_defs dp2_defs terms_pkt_def\n elim!: dp2_in_chan2_to_0E dp2_add_loc20E intro: head.cases[where ?x=fut])\n apply(frule cons_hfs_valid_prefix_generic[where ?uinfo =\"upd_uinfo _ _\", where ?hist = hist]) \n by (auto simp add: upd_pkt_def) \n next\n fix m asid ainfo uinfo hf1 upif pas fut hist\n assume \"dp2_send s m asid ainfo uinfo hf1 upif pas fut hist s'\"\n then show \"dp1: R21 s\\evt_send0 asid upif (pkt2to1loc m)\\ R21 s'\"\n using cons_hfs_valid_prefix_generic \n by(auto simp add: dp1_defs dp2_defs TW.takeW_split_tail R21_def elim!: dp2_add_chan20E)\n next\n fix m asid ainfo uinfo hf1 pas fut hist\n assume asm: \"dp2_deliver s m asid ainfo uinfo hf1 pas fut hist s'\"\n then show \"dp1: R21 s\\evt_deliver0 asid (pkt2to1loc m)\\ R21 s'\"\n apply(auto simp add: R21_def TW.takeW.simps TW.takeW_split_tail dp1_defs dp2_defs \n elim!: dp2_add_loc20E intro: head.cases[where ?x=fut] intro!: exI[of _ \"AHI hf1\"])\n using prefix_hfs_valid_prefix_generic cons_hfs_valid_prefix_generic head.simps(1) prefix_Nil\n proof -\n assume a1: \"hf_valid_generic ainfo uinfo (rev pas @ [hf1]) (head pas) hf1 None\"\n have \"hfs_valid_prefix_generic ainfo (upd_uinfo_pkt (fwd_pkt m)) (hf1 # pas) (Some hf1) [] None = []\"\n by (meson prefix_Nil prefix_hfs_valid_prefix_generic)\n then show \"map AHI (hfs_valid_prefix_generic ainfo uinfo pas (head pas) [hf1] None) = [AHI hf1]\"\n using a1 asm by (simp add: cons_hfs_valid_prefix_generic dp2_defs)\n qed blast\n next\n fix m asid ainfo uinfo upif pas fut hist\n assume \"dp2_dispatch_ext s m asid ainfo uinfo upif pas fut hist s'\"\n then show \"dp1: R21 s\\evt_dispatch_ext0 asid upif (pkt2to1chan m)\\ R21 s'\"\n apply(auto simp add: dp1_defs dp2_defs \\inv_ik_dyn s\\ upd_uinfo_no_oracle simp del: AHIS_def\n intro!: ik_seg_is_auth elim!: dp2_add_chan20E)\n apply(cases fut)\n by(auto simp add: upd_uinfo_no_oracle)\n qed(auto simp add: R21_def dp2_defs dp1_defs)\nnext\n fix s\n show \"reach dp2 s \\ inv_ik_dyn s\" using Inv_inv_ik_dyn by blast\nqed\n\nsubsection\\Property preservation\\\n\ntext\\The following property is weaker than @{text \"TR_auth\"} in that it does not include the\nfuture path. However, this is inconsequential, since we only included the future path in order for\nthe original invariant to be inductive. The actual path authorization property only requires the\nhistory to be authorized.\nWe remove the future path for clarity, as including it would require us to also restrict it using\nthe interface- and cryptographic valid-prefix functions.\\\n\ndefinition auth_path2 :: \"('aahi, 'uinfo, 'uhi, 'ainfo) pkt2 \\ bool\" where\n \"auth_path2 m \\ pfragment (AInfo m) (rev (history m)) auth_seg0\"\n\nabbreviation TR_auth2_hist :: \"('aahi, 'uinfo, 'uhi, 'ainfo) evt2 list set\" where \"TR_auth2_hist \\ \n {\\ | \\ . \\s m . evt_observe2 s \\ set \\ \\ soup2 m s \\ auth_path2 m}\"\n\nlemma evt_observe2_0:\n \"evt_observe2 s \\ set \\ \\ evt_observe0 (R10 (R21 s)) \\ (\\x. \\\\<^sub>1 (\\\\<^sub>2 x)) ` set \\\"\n by force\n\ndeclare soup2_def [simp del]\ndeclare soup_def [simp del]\n\nlemma loc2to0: \"\\mc \\ loc2 sc x; sa = R10 (R21 sc); ma = pkt1to0loc (pkt2to1loc mc)\\ \\ ma \\ loc sa x\"\n using R10_def R21_def by simp\n\nlemma chan2to0: \"\\mc \\ chan2 sc (a1, i1, a2, i2); sa = R10 (R21 sc); ma = pkt1to0chan a1 i1 (pkt2to1chan mc)\\ \n \\ ma \\ chan sa (a1, i1, a2, i2)\"\n using R10_def R21_def by simp\n\nlemma loc2to0_auth: \n \"\\mc \\ loc2 sc x; sa = R10 (R21 sc); ma = pkt1to0loc (pkt2to1loc mc); auth_path ma\\ \\ auth_path2 mc\"\n apply(auto simp add: R10_def R21_def auth_path_def auth_path2_def elim!: pfragmentE) \n subgoal for zs1 zs2\n by(cases mc)\n (auto intro!: pfragmentI[of _ zs1 _ \"pkt0.future (pkt1to0loc (pkt2to1loc mc)) @ zs2\"])\n done\n\nlemma chan2to0_auth: \n \"\\mc \\ chan2 sc (a1, i1, a2, i2); sa = R10 (R21 sc); ma = pkt1to0chan a1 i1 (pkt2to1chan mc); auth_path ma\\ \\ auth_path2 mc\"\n apply(auto simp add: R10_def R21_def auth_path_def auth_path2_def elim!: pfragmentE) \n subgoal for zs1 zs2\n by(cases mc)\n (auto intro!: pfragmentI[of _ zs1 _ \"pkt0.future (pkt1to0chan a1 i1 (pkt2to1chan mc)) @ zs2\"])\n done\n\nlemma tr2_satisfies_pathauthorization: \"dp2 \\\\<^sub>E\\<^sub>S TR_auth2_hist\"\n apply(rule property_preservation[where \\=\"\\\\<^sub>1 o \\\\<^sub>2\", where E=dp2, where F=dp0, where P=TR_auth])\n using dp2_refines_dp1 dp1_refines_dp0 sim_ES_trans apply blast\n using tr0_satisfies_pathauthorization apply blast\n apply (auto simp del: soup2_def)\n subgoal for \\ s m\n apply(auto elim!: allE[of _ \"R10 (R21 s)\"]) apply force\n apply(auto simp add: soup2_def)\n subgoal\n apply(frule loc2to0_auth) using loc2to0 \n by(auto simp add: soup_def inv_auth_def elim!: allE)\n subgoal\n apply(frule chan2to0_auth) using chan2to0 \n by(fastforce simp add: soup_def inv_auth_def elim!: allE)+\n done\n done\n\n\ndefinition inv_detect2 :: \"('aahi, 'uinfo, 'uhi, 'ainfo) dp2_state \\ bool\" where\n \"inv_detect2 s \\ \\m . soup2 m s \\ prefix (history m) (AHIS (past m))\"\n\nabbreviation TR_detect2 where \"TR_detect2 \\ {\\ | \\ . \\ s . evt_observe2 s \\ set \\ \\ inv_detect2 s}\"\n\nlemma tr2_satisfies_detectability: \"dp2 \\\\<^sub>E\\<^sub>S TR_detect2\"\n apply(rule property_preservation[where \\=\"\\\\<^sub>1 o \\\\<^sub>2\", where E=dp2, where F=dp0, where P=TR_detect])\n using dp2_refines_dp1 dp1_refines_dp0 sim_ES_trans apply blast\n using tr0_satisfies_detectability apply blast\n apply (auto simp add: inv_detect2_def)\n subgoal for \\ s m\n apply(auto simp add: soup2_def inv_detect_def)\n apply(auto elim!: allE[of _ \"R10 (R21 s)\"]) \n subgoal using evt_observe2_0 by blast\n subgoal\n apply(auto elim!: allE[of _ \"(pkt1to0loc (pkt2to1loc m))\"])\n using loc2to0 soup_def apply blast\n apply(cases m) \n by auto\n subgoal using evt_observe2_0 by blast\n subgoal for a1 i1\n apply(auto elim!: allE[of _ \"(pkt1to0chan a1 i1 (pkt2to1chan m))\"])\n using chan2to0 soup_def apply blast\n apply(cases m) \n by auto\n done\n done\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/Parametrized_Dataplane_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.36658975016245987, "lm_q1q2_score": 0.19473591691037223}} {"text": "(*<*)\ntheory Monitor_Impl\n imports Monitor\n Optimized_Agg_Temporal\n Optimized_Agg\n Optimized_MTL\n \"HOL-Library.Code_Target_Nat\"\n Containers.Containers\n \"Generic_Join_Devel.Proj_Code\"\nbegin\n(*>*)\n\nsection \\Instantiation of the generic algorithm and code setup\\\n\n(*\n The following snippet (context \\ end) is taken from HOL-Library.Code_Cardinality.\n We do not include the entire theory because the remaining code setup is superseded\n by Containers.\n*)\ncontext\nbegin\n\nqualified definition card_UNIV' :: \"'a card_UNIV\"\nwhere [code del]: \"card_UNIV' = Phantom('a) CARD('a)\"\n\nlemma CARD_code [code_unfold]:\n \"CARD('a) = of_phantom (card_UNIV' :: 'a card_UNIV)\"\nby(simp add: card_UNIV'_def)\n\nlemma card_UNIV'_code [code]:\n \"card_UNIV' = card_UNIV\"\nby(simp add: card_UNIV card_UNIV'_def)\n\nend\n\ninstantiation enat :: set_impl begin\ndefinition set_impl_enat :: \"(enat, set_impl) phantom\" where\n \"set_impl_enat = phantom set_RBT\"\n\ninstance ..\nend\n\nderive ccompare Formula.trm\nderive (eq) ceq Formula.trm\nderive (rbt) set_impl Formula.trm\nderive (eq) ceq Monitor.mregex\nderive ccompare Monitor.mregex\nderive (rbt) set_impl Monitor.mregex\nderive (rbt) mapping_impl Monitor.mregex\nderive (no) cenum Monitor.mregex\nderive (rbt) set_impl string8\nderive (rbt) mapping_impl string8\nderive (rbt) set_impl event_data\nderive (rbt) mapping_impl event_data\n\ntype_synonym 'a vmsaux = \"nat \\ (nat \\ 'a table) list\"\n\ndefinition valid_vmsaux :: \"args \\ nat \\ event_data vmsaux \\\n (nat \\ event_data table) list \\ bool\" where\n \"valid_vmsaux = (\\_ cur (t, aux) auxlist. t = cur \\ aux = auxlist)\"\n\ndefinition init_vmsaux :: \"args \\ event_data vmsaux\" where\n \"init_vmsaux = (\\_. (0, []))\"\n\ndefinition add_new_ts_vmsaux :: \"args \\ nat \\ event_data vmsaux \\ event_data vmsaux\" where\n \"add_new_ts_vmsaux = (\\args nt (t, auxlist). (nt, filter (\\(t, rel).\n memR (args_ivl args) (nt - t)) auxlist))\"\n\ndefinition join_vmsaux :: \"args \\ event_data table \\ event_data vmsaux \\ event_data vmsaux\" where\n \"join_vmsaux = (\\args rel1 (t, auxlist). (t, map (\\(t, rel).\n (t, join rel (args_pos args) rel1)) auxlist))\"\n\ndefinition add_new_table_vmsaux :: \"args \\ event_data table \\ event_data vmsaux \\\n event_data vmsaux\" where\n \"add_new_table_vmsaux = (\\args rel2 (cur, auxlist). (cur, (case auxlist of\n [] => [(cur, rel2)]\n | ((t, y) # ts) \\ if t = cur then (t, y \\ rel2) # ts else (cur, rel2) # auxlist)))\"\n\ndefinition result_vmsaux :: \"args \\ event_data vmsaux \\ event_data table\" where\n \"result_vmsaux = (\\args (cur, auxlist). eval_args_agg args\n (foldr (\\) [rel. (t, rel) \\ auxlist, memL (args_ivl args) (cur - t)] {}))\"\n\ntype_synonym 'a vmuaux = \"nat \\ (nat \\ 'a table \\ 'a table) list\"\n\ndefinition valid_vmuaux :: \"args \\ nat \\ event_data vmuaux \\\n (nat \\ event_data table \\ event_data table) list \\ bool\" where\n \"valid_vmuaux = (\\_ cur (t, aux) auxlist. t = cur \\ aux = auxlist)\"\n\ndefinition init_vmuaux :: \"args \\ event_data vmuaux\" where\n \"init_vmuaux = (\\_. (0, []))\"\n\ndefinition add_new_vmuaux :: \"args \\ event_data table \\ event_data table \\ nat \\\n event_data vmuaux \\ event_data vmuaux\" where\n \"add_new_vmuaux = (\\args rel1 rel2 nt (t, auxlist). (nt, update_until args rel1 rel2 nt auxlist))\"\n\ndefinition length_vmuaux :: \"args \\ event_data vmuaux \\ nat\" where\n \"length_vmuaux = (\\_ (_, auxlist). length auxlist)\"\n\ndefinition eval_vmuaux :: \"args \\ nat \\ event_data vmuaux \\\n event_data table list \\ event_data vmuaux\" where\n \"eval_vmuaux = (\\args nt (t, auxlist).\n (let (res, auxlist') = eval_until (args_ivl args) nt auxlist in (map (eval_args_agg args) res, (t, auxlist'))))\"\n\nglobal_interpretation verimon_maux: maux valid_vmsaux init_vmsaux add_new_ts_vmsaux join_vmsaux\n add_new_table_vmsaux result_vmsaux valid_vmuaux init_vmuaux add_new_vmuaux length_vmuaux\n eval_vmuaux\n defines vminit0 = \"maux.minit0 (init_vmsaux :: _ \\ event_data vmsaux) (init_vmuaux :: _ \\ event_data vmuaux) :: _ \\ Formula.formula \\ _\"\n and vminit = \"maux.minit (init_vmsaux :: _ \\ event_data vmsaux) (init_vmuaux :: _ \\ event_data vmuaux) :: Formula.formula \\ _\"\n and vminit_since = \"verimon_maux.init_since\"\n and vminit_until = \"verimon_maux.init_until\"\n and vminit_safe = \"maux.minit_safe (init_vmsaux :: _ \\ event_data vmsaux) (init_vmuaux :: _ \\ event_data vmuaux) :: Formula.formula \\ _\"\n and vmupdate_since = \"maux.update_since add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ event_data table)\"\n and vmeval = \"maux.meval add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ _) add_new_vmuaux (eval_vmuaux :: _ \\ _ \\ event_data vmuaux \\ _)\"\n and vmstep = \"maux.mstep add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ _) add_new_vmuaux (eval_vmuaux :: _ \\ _ \\ event_data vmuaux \\ _)\"\n and vmsteps0_stateless = \"maux.msteps0_stateless add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ _) add_new_vmuaux (eval_vmuaux :: _ \\ _ \\ event_data vmuaux \\ _)\"\n and vmsteps_stateless = \"maux.msteps_stateless add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ _) add_new_vmuaux (eval_vmuaux :: _ \\ _ \\ event_data vmuaux \\ _)\"\n and vmonitor = \"maux.monitor init_vmsaux add_new_ts_vmsaux join_vmsaux add_new_table_vmsaux (result_vmsaux :: _ \\ event_data vmsaux \\ _) init_vmuaux add_new_vmuaux (eval_vmuaux :: _ \\ _ \\ event_data vmuaux \\ _)\"\n unfolding valid_vmsaux_def init_vmsaux_def add_new_ts_vmsaux_def join_vmsaux_def\n add_new_table_vmsaux_def result_vmsaux_def valid_vmuaux_def init_vmuaux_def add_new_vmuaux_def\n length_vmuaux_def eval_vmuaux_def\n by unfold_locales auto\n\nglobal_interpretation default_maux: maux valid_mmasaux \"init_mmasaux :: _ \\ mmasaux\" add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux\n valid_mmauaux \"init_mmauaux :: _ \\ mmauaux\" add_new_mmauaux length_mmauaux eval_mmauaux'\n defines minit0 = \"maux.minit0 (init_mmasaux :: _ \\ mmasaux) (init_mmauaux :: _ \\ mmauaux) :: _ \\ Formula.formula \\ _\"\n and minit = \"maux.minit (init_mmasaux :: _ \\ mmasaux) (init_mmauaux :: _ \\ mmauaux) :: Formula.formula \\ _\"\n and minit_since = \"default_maux.init_since\"\n and minit_until = \"default_maux.init_until\"\n and minit_safe = \"maux.minit_safe (init_mmasaux :: _ \\ mmasaux) (init_mmauaux :: _ \\ mmauaux) :: Formula.formula \\ _\"\n and mupdate_since = \"maux.update_since add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux\"\n and meval = \"maux.meval add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux add_new_mmauaux eval_mmauaux'\"\n and mstep = \"maux.mstep add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux add_new_mmauaux eval_mmauaux'\"\n and msteps0_stateless = \"maux.msteps0_stateless add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux add_new_mmauaux eval_mmauaux'\"\n and msteps_stateless = \"maux.msteps_stateless add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux add_new_mmauaux eval_mmauaux'\"\n and monitor = \"maux.monitor init_mmasaux add_new_ts_mmasaux gc_join_mmasaux add_new_table_mmasaux result_mmasaux init_mmauaux add_new_mmauaux eval_mmauaux'\"\n by unfold_locales\n\nlemma image_these: \"f ` Option.these X = Option.these (map_option f ` X)\"\n by (force simp: in_these_eq Bex_def image_iff map_option_case split: option.splits)\n\nthm default_maux.meval.simps(2)\n\nlemma meval_MPred: \"meval n ts db (MPred e tms) =\n (case Mapping.lookup db e of None \\ replicate (length ts) {} | Some Xs \\ map (\\X. \\v \\ X.\n (set_option (map_option (\\f. Table.tabulate f 0 n) (match tms v)))) Xs, MPred e tms)\"\n by (force split: option.splits simp: Option.these_def image_iff)\n\nlemmas meval_code[code] = default_maux.meval.simps(1) meval_MPred default_maux.meval.simps(3-)\n\ndefinition mk_db :: \"(Formula.name \\ event_data list set) list \\ _\" where\n \"mk_db t = Monitor.mk_db (\\n \\ set (map fst t). (\\v. (n, v)) ` the (map_of t n))\"\n\ndefinition rbt_fold :: \"_ \\ event_data tuple set_rbt \\ _ \\ _\" where\n \"rbt_fold = RBT_Set2.fold\"\n\ndefinition rbt_empty :: \"event_data list set_rbt\" where\n \"rbt_empty = RBT_Set2.empty\"\n\ndefinition rbt_insert :: \"_ \\ _ \\ event_data list set_rbt\" where\n \"rbt_insert = RBT_Set2.insert\"\n\nlemma saturate_commute:\n assumes \"\\s. r \\ g s\" \"\\s. g (Set.insert r s) = g s\" \"\\s. r \\ s \\ h s = g s\"\n and terminates: \"mono g\" \"\\X. X \\ C \\ g X \\ C\" \"finite C\"\nshows \"saturate g {} = saturate h {r}\"\nproof (cases \"g {} = {r}\")\n case True\n with assms have \"g {r} = {r}\" \"h {r} = {r}\" by auto\n with True show ?thesis\n by (subst (1 2) saturate_code; subst saturate_code) (simp add: Let_def)\nnext\n case False\n then show ?thesis\n unfolding saturate_def while_def\n using while_option_finite_subset_Some[OF terminates] assms(1-3)\n by (subst while_option_commute_invariant[of \"\\S. S = {} \\ r \\ S\" \"\\S. g S \\ S\" g \"\\S. h S \\ S\" \"Set.insert r\" h \"{}\", symmetric])\n (auto 4 4 dest: while_option_stop[of \"\\S. g S \\ S\" g \"{}\"])\nqed\n\ndefinition \"RPDs_aux = saturate (\\S. S \\ \\ (RPD ` S))\"\n\nlemma RPDs_aux_code[code]:\n \"RPDs_aux S = (let S' = S \\ Set.bind S RPD in if S' \\ S then S else RPDs_aux S')\"\n unfolding RPDs_aux_def bind_UNION\n by (subst saturate_code) auto\n\ndeclare RPDs_code[code del]\nlemma RPDs_code[code]: \"RPDs r = RPDs_aux {r}\"\n unfolding RPDs_aux_def RPDs_code\n by (rule saturate_commute[where C=\"RPDs r\"])\n (auto 0 3 simp: mono_def subset_singleton_iff RPDs_refl RPDs_trans finite_RPDs)\n\ndefinition \"LPDs_aux = saturate (\\S. S \\ \\ (LPD ` S))\"\n\nlemma LPDs_aux_code[code]:\n \"LPDs_aux S = (let S' = S \\ Set.bind S LPD in if S' \\ S then S else LPDs_aux S')\"\n unfolding LPDs_aux_def bind_UNION\n by (subst saturate_code) auto\n\ndeclare LPDs_code[code del]\nlemma LPDs_code[code]: \"LPDs r = LPDs_aux {r}\"\n unfolding LPDs_aux_def LPDs_code\n by (rule saturate_commute[where C=\"LPDs r\"])\n (auto 0 3 simp: mono_def subset_singleton_iff LPDs_refl LPDs_trans finite_LPDs)\n\nlemma is_empty_table_unfold [code_unfold]:\n \"X = empty_table \\ Set.is_empty X\"\n \"empty_table = X \\ Set.is_empty X\"\n \"set_eq X empty_table \\ Set.is_empty X\"\n \"set_eq empty_table X \\ Set.is_empty X\"\n \"X = (set_empty impl) \\ Set.is_empty X\"\n \"(set_empty impl) = X \\ Set.is_empty X\"\n \"set_eq X (set_empty impl) \\ Set.is_empty X\"\n \"set_eq (set_empty impl) X \\ Set.is_empty X\"\n unfolding set_eq_def set_empty_def empty_table_def Set.is_empty_def by auto\n\nlemma tabulate_rbt_code[code]: \"Monitor.mrtabulate (xs :: mregex list) f =\n (case ID CCOMPARE(mregex) of None \\ Code.abort (STR ''tabulate RBT_Mapping: ccompare = None'') (\\_. Monitor.mrtabulate (xs :: mregex list) f)\n | _ \\ RBT_Mapping (RBT_Mapping2.bulkload (List.map_filter (\\k. let fk = f k in if fk = empty_table then None else Some (k, fk)) xs)))\"\n unfolding mrtabulate.abs_eq RBT_Mapping_def\n by (auto split: option.splits)\n\nlemma combine_Mapping[code]:\n fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n \"Mapping.combine f (RBT_Mapping t) (RBT_Mapping u) = \n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''combine RBT_Mapping: ccompare = None'') (\\_. Mapping.combine f (RBT_Mapping t) (RBT_Mapping u))\n | Some _ \\ RBT_Mapping (RBT_Mapping2.join (\\_. f) t u))\"\n by (auto simp add: Mapping.combine.abs_eq Mapping_inject lookup_join split: option.split)\n\nlemma upd_set_empty[simp]: \"upd_set m f {} = m\"\n by transfer auto\n\nlemma upd_set_insert[simp]: \"upd_set m f (Set.insert x A) = Mapping.update x (f x) (upd_set m f A)\"\n by (rule mapping_eqI) (auto simp: Mapping_lookup_upd_set Mapping.lookup_update')\n\nlemma upd_set_fold:\n assumes \"finite A\"\n shows \"upd_set m f A = Finite_Set.fold (\\a. Mapping.update a (f a)) m A\"\nproof -\n interpret comp_fun_idem \"\\a. Mapping.update a (f a)\"\n by unfold_locales (transfer; auto simp: fun_eq_iff)+\n from assms show ?thesis\n by (induct A arbitrary: m rule: finite.induct) auto\nqed\n\nlift_definition upd_cfi :: \"('a \\ 'b) \\ ('a, ('a, 'b) mapping) comp_fun_idem\"\n is \"\\f a m. Mapping.update a (f a) m\"\n by unfold_locales (transfer; auto simp: fun_eq_iff)+\n\nlemma upd_set_code[code]:\n \"upd_set m f A = (if finite A then set_fold_cfi (upd_cfi f) m A else Code.abort (STR ''upd_set: infinite'') (\\_. upd_set m f A))\"\n by (transfer fixing: m) (auto simp: upd_set_fold)\n\nlemma lexordp_eq_code[code]: \"lexordp_eq xs ys \\ (case xs of [] \\ True\n | x # xs \\ (case ys of [] \\ False\n | y # ys \\ if x < y then True else if x > y then False else lexordp_eq xs ys))\"\n by (subst lexordp_eq.simps) (auto split: list.split)\n\ndefinition \"filter_set m X t = Mapping.filter (filter_cond X m t) m\"\n\ndeclare [[code drop: shift_end]]\ndeclare shift_end.simps[folded filter_set_def, code]\n\nlemma upd_set'_empty[simp]: \"upd_set' m d f {} = m\"\n by (rule mapping_eqI) (auto simp add: upd_set'_lookup)\n\nlemma upd_set'_insert: \"d = f d \\ (\\x. f (f x) = f x) \\ upd_set' m d f (Set.insert x A) =\n (let m' = (upd_set' m d f A) in case Mapping.lookup m' x of None \\ Mapping.update x d m'\n | Some v \\ Mapping.update x (f v) m')\"\n by (rule mapping_eqI) (auto simp: upd_set'_lookup Mapping.lookup_update' split: option.splits)\n\nlemma upd_set'_aux1: \"upd_set' Mapping.empty d f {b. b = k \\ (a, b) \\ A} =\n Mapping.update k d (upd_set' Mapping.empty d f {b. (a, b) \\ A})\"\n by (rule mapping_eqI) (auto simp add: Let_def upd_set'_lookup Mapping.lookup_update'\n Mapping.lookup_empty split: option.splits)\n\nlemma upd_set'_aux2: \"Mapping.lookup m k = None \\ upd_set' m d f {b. b = k \\ (a, b) \\ A} =\n Mapping.update k d (upd_set' m d f {b. (a, b) \\ A})\"\n by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' split: option.splits)\n\nlemma upd_set'_aux3: \"Mapping.lookup m k = Some v \\ upd_set' m d f {b. b = k \\ (a, b) \\ A} =\n Mapping.update k (f v) (upd_set' m d f {b. (a, b) \\ A})\"\n by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' split: option.splits)\n\nlemma upd_set'_aux4: \"k \\ fst ` A \\ upd_set' Mapping.empty d f {b. (k, b) \\ A} = Mapping.empty\"\n by (rule mapping_eqI) (auto simp add: upd_set'_lookup Mapping.lookup_update' Domain.DomainI fst_eq_Domain\n split: option.splits)\n\nlemma upd_nested_empty[simp]: \"upd_nested m d f {} = m\"\n by (rule mapping_eqI) (auto simp add: upd_nested_lookup split: option.splits)\n\ndefinition upd_nested_step :: \"'c \\ ('c \\ 'c) \\ 'a \\ 'b \\ ('a, ('b, 'c) mapping) mapping \\\n ('a, ('b, 'c) mapping) mapping\" where\n \"upd_nested_step d f x m = (case x of (k, k') \\\n (case Mapping.lookup m k of Some m' \\\n (case Mapping.lookup m' k' of Some v \\ Mapping.update k (Mapping.update k' (f v) m') m\n | None \\ Mapping.update k (Mapping.update k' d m') m)\n | None \\ Mapping.update k (Mapping.update k' d Mapping.empty) m))\"\n\nlemma upd_nested_insert:\n \"d = f d \\ (\\x. f (f x) = f x) \\ upd_nested m d f (Set.insert x A) =\n upd_nested_step d f x (upd_nested m d f A)\"\n unfolding upd_nested_step_def\n using upd_set'_aux1[of d f _ _ A] upd_set'_aux2[of _ _ d f _ A] upd_set'_aux3[of _ _ _ d f _ A]\n upd_set'_aux4[of _ A d f]\n by (auto simp add: Let_def upd_nested_lookup upd_set'_lookup Mapping.lookup_update'\n Mapping.lookup_empty split: option.splits prod.splits if_splits intro!: mapping_eqI)\n\ndefinition upd_nested_max_tstp where\n \"upd_nested_max_tstp m d X = upd_nested m d (max_tstp d) X\"\n\nlemma upd_nested_max_tstp_fold:\n assumes \"finite X\"\n shows \"upd_nested_max_tstp m d X = Finite_Set.fold (upd_nested_step d (max_tstp d)) m X\"\nproof -\n interpret comp_fun_idem \"upd_nested_step d (max_tstp d)\"\n by (unfold_locales; rule ext)\n (auto simp add: comp_def upd_nested_step_def Mapping.lookup_update' Mapping.lookup_empty\n update_update max_tstp_d_d max_tstp_idem' split: option.splits)\n note upd_nested_insert' = upd_nested_insert[of d \"max_tstp d\",\n OF max_tstp_d_d[symmetric] max_tstp_idem']\n show ?thesis\n using assms\n by (induct X arbitrary: m rule: finite.induct)\n (auto simp add: upd_nested_max_tstp_def upd_nested_insert')\nqed\n\nlift_definition upd_nested_max_tstp_cfi ::\n \"ts + tp \\ ('a \\ 'b, ('a, ('b, ts + tp) mapping) mapping) comp_fun_idem\"\n is \"\\d. upd_nested_step d (max_tstp d)\"\n by (unfold_locales; rule ext)\n (auto simp add: comp_def upd_nested_step_def Mapping.lookup_update' Mapping.lookup_empty\n update_update max_tstp_d_d max_tstp_idem' split: option.splits)\n\nlemma upd_nested_max_tstp_code[code]:\n \"upd_nested_max_tstp m d X = (if finite X then set_fold_cfi (upd_nested_max_tstp_cfi d) m X\n else Code.abort (STR ''upd_nested_max_tstp: infinite'') (\\_. upd_nested_max_tstp m d X))\"\n by transfer (auto simp add: upd_nested_max_tstp_fold)\n\nlemma filter_set_empty[simp]: \"filter_set m {} t = m\"\n unfolding filter_set_def\n by transfer (auto simp: fun_eq_iff split: option.splits)\n\nlemma filter_set_insert[simp]: \"filter_set m (Set.insert x A) t = (let m' = filter_set m A t in\n case Mapping.lookup m' x of Some u \\ if t = u then Mapping.delete x m' else m' | _ \\ m')\"\n unfolding filter_set_def\n by transfer (auto simp: fun_eq_iff Let_def Map_To_Mapping.map_apply_def split: option.splits)\n\nlemma filter_set_fold:\n assumes \"finite A\"\n shows \"filter_set m A t = Finite_Set.fold (\\a m.\n case Mapping.lookup m a of Some u \\ if t = u then Mapping.delete a m else m | _ \\ m) m A\"\nproof -\n interpret comp_fun_idem \"\\a m.\n case Mapping.lookup m a of Some u \\ if t = u then Mapping.delete a m else m | _ \\ m\"\n by unfold_locales\n (transfer; auto simp: fun_eq_iff Map_To_Mapping.map_apply_def split: option.splits)+\n from assms show ?thesis\n by (induct A arbitrary: m rule: finite.induct) (auto simp: Let_def)\nqed\n\nlift_definition filter_cfi :: \"'b \\ ('a, ('a, 'b) mapping) comp_fun_idem\"\n is \"\\t a m.\n case Mapping.lookup m a of Some u \\ if t = u then Mapping.delete a m else m | _ \\ m\"\n by unfold_locales\n (transfer; auto simp: fun_eq_iff Map_To_Mapping.map_apply_def split: option.splits)+\n\nlemma filter_set_code[code]:\n \"filter_set m A t = (if finite A then set_fold_cfi (filter_cfi t) m A else Code.abort (STR ''upd_set: infinite'') (\\_. filter_set m A t))\"\n by (transfer fixing: m) (auto simp: filter_set_fold)\n\nlemma filter_Mapping[code]:\n fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n \"Mapping.filter P (RBT_Mapping t) = \n (case ID CCOMPARE('a) of None \\ Code.abort (STR ''filter RBT_Mapping: ccompare = None'') (\\_. Mapping.filter P (RBT_Mapping t))\n | Some _ \\ RBT_Mapping (RBT_Mapping2.filter (case_prod P) t))\"\n by (auto simp add: Mapping.filter.abs_eq Mapping_inject split: option.split)\n\ndefinition \"filter_join pos X m = Mapping.filter (join_filter_cond pos X) m\"\n\ndeclare [[code drop: join_mmsaux]]\ndeclare join_mmsaux.simps[folded filter_join_def, code]\n\nlemma filter_join_False_empty: \"filter_join False {} m = m\"\n unfolding filter_join_def\n by transfer (auto split: option.splits)\n\nlemma filter_join_False_insert: \"filter_join False (Set.insert a A) m =\n filter_join False A (Mapping.delete a m)\"\nproof -\n {\n fix x\n have \"Mapping.lookup (filter_join False (Set.insert a A) m) x =\n Mapping.lookup (filter_join False A (Mapping.delete a m)) x\"\n by (auto simp add: filter_join_def Mapping.lookup_filter Mapping_lookup_delete\n split: option.splits)\n }\n then show ?thesis\n by (simp add: mapping_eqI)\nqed\n\nlemma filter_join_False:\n assumes \"finite A\"\n shows \"filter_join False A m = Finite_Set.fold Mapping.delete m A\"\nproof -\n interpret comp_fun_idem \"Mapping.delete\"\n by (unfold_locales; transfer) (fastforce simp add: comp_def)+\n from assms show ?thesis\n by (induction A arbitrary: m rule: finite.induct)\n (auto simp add: filter_join_False_empty filter_join_False_insert fold_fun_left_comm)\nqed\n\nlift_definition filter_not_in_cfi :: \"('a, ('a, 'b) mapping) comp_fun_idem\" is \"Mapping.delete\"\n by (unfold_locales; transfer) (fastforce simp add: comp_def)+\n\nlemma filter_join_code[code]:\n \"filter_join pos A m =\n (if \\pos \\ finite A then set_fold_cfi filter_not_in_cfi m A\n else Mapping.filter (join_filter_cond pos A) m)\"\n unfolding filter_join_def\n by (transfer fixing: m) (use filter_join_False in \\auto simp add: filter_join_def\\)\n\ndefinition set_minus :: \"'a set \\ 'a set \\ 'a set\" where\n \"set_minus X Y = X - Y\"\n\nlift_definition remove_cfi :: \"('a, 'a set) comp_fun_idem\"\n is \"\\b a. a - {b}\"\n by unfold_locales auto\n\nlemma set_minus_finite:\n assumes fin: \"finite Y\"\n shows \"set_minus X Y = Finite_Set.fold (\\a X. X - {a}) X Y\"\nproof -\n interpret comp_fun_idem \"\\a X. X - {a}\"\n by unfold_locales auto\n from assms show ?thesis\n by (induction Y arbitrary: X rule: finite.induct) (auto simp add: set_minus_def)\nqed\n\nlemma set_minus_code[code]: \"set_minus X Y =\n (if finite Y \\ card Y < card X then set_fold_cfi remove_cfi X Y else X - Y)\"\n by transfer (use set_minus_finite in \\auto simp add: set_minus_def\\)\n\ndeclare [[code drop: bin_join]]\ndeclare bin_join.simps[folded set_minus_def, code]\n\ndefinition remove_Union where\n \"remove_Union A X B = A - (\\x \\ X. B x)\"\n\nlemma remove_Union_finite: \n assumes \"finite X\"\n shows \"remove_Union A X B = Finite_Set.fold (\\x A. A - B x) A X\"\nproof -\n interpret comp_fun_idem \"\\x A. A - B x\"\n by unfold_locales auto\n from assms show ?thesis\n by (induct X arbitrary: A rule: finite_induct) (auto simp: remove_Union_def)\nqed\n\nlift_definition remove_Union_cfi :: \"('a \\ 'b set) \\ ('a, 'b set) comp_fun_idem\" is \"\\B x A. A - B x\"\n by unfold_locales auto\n\nlemma remove_Union_code[code]: \"remove_Union A X B =\n (if finite X then set_fold_cfi (remove_Union_cfi B) A X else A - (\\x \\ X. B x))\"\n by (transfer fixing: A X B) (use remove_Union_finite[of X A B] in \\auto simp add: remove_Union_def\\)\n\nlemma tabulate_remdups: \"Mapping.tabulate xs f = Mapping.tabulate (remdups xs) f\"\n by (transfer fixing: xs f) (auto simp: map_of_map_restrict)\n\nlift_definition clearjunk :: \"(string8 \\ event_data list set) list \\ (string8, event_data list set list) alist\" is\n \"\\t. List.map_filter (\\(p, X). if X = {} then None else Some (p, [X])) (AList.clearjunk t)\"\n unfolding map_filter_def o_def list.map_comp\n by (subst map_cong[OF refl, of _ _ fst]) (auto simp: map_filter_def distinct_map_fst_filter split: if_splits)\n\nlemma map_filter_snd_map_filter: \"List.map_filter (\\(a, b). if P b then None else Some (f a b)) xs =\n map (\\(a, b). f a b) (filter (\\x. \\ P (snd x)) xs)\"\n by (simp add: map_filter_def prod.case_eq_if)\n\nlemma mk_db_code_alist:\n \"mk_db t = Assoc_List_Mapping (clearjunk t)\"\n unfolding mk_db_def Assoc_List_Mapping_def\n by (transfer' fixing: t)\n (auto simp: map_filter_snd_map_filter fun_eq_iff map_of_map image_iff map_of_clearjunk\n map_of_filter_apply dest: weak_map_of_SomeI intro!: bexI[rotated, OF map_of_SomeD]\n split: if_splits option.splits)\n\nlemma mk_db_code[code]:\n \"mk_db t = Mapping.of_alist (List.map_filter (\\(p, X). if X = {} then None else Some (p, [X])) (AList.clearjunk t))\"\n unfolding mk_db_def\n by (transfer' fixing: t) (auto simp: map_filter_snd_map_filter fun_eq_iff map_of_map image_iff\n map_of_clearjunk map_of_filter_apply dest: weak_map_of_SomeI intro!: bexI[rotated, OF map_of_SomeD]\n split: if_splits option.splits)\n\ndeclare [[code drop: New_max_getIJ_genericJoin New_max_getIJ_wrapperGenericJoin]]\ndeclare New_max.genericJoin_code[folded remove_Union_def, code]\ndeclare New_max.wrapperGenericJoin.simps[folded remove_Union_def, code]\n\nlift_definition delete_cnt_cfc::\"aggargs \\ (event_data tuple, (bool \\ nat agg_map)) comp_fun_commute\" is\n \"\\args. delete_cnt args\" using delete_cnt_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (delete_cnt args) (v, m) data = set_fold_cfc (delete_cnt_cfc args) (v, m) data\"\n by(transfer) auto\n\nlift_definition delete_sum_cfc::\"aggargs \\ (event_data tuple, (bool \\ ((nat \\ integer) agg_map))) comp_fun_commute\" is\n \"\\args. delete_sum args\" using delete_sum_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (delete_sum args) (v, m) data = set_fold_cfc (delete_sum_cfc args) (v, m) data\"\n by(transfer) auto\n\nlift_definition delete_rank_cfc::\"aggargs \\ type \\ (event_data tuple, bool \\ list_aux agg_map) comp_fun_commute\" is\n \"\\args. delete_rank args\" using delete_rank_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (delete_rank args type) (v, m) data = set_fold_cfc (delete_rank_cfc args type) (v, m) data\"\n by(transfer) auto\n\nlift_definition insert_cnt_cfc::\"aggargs \\ (event_data tuple, (bool \\ nat agg_map)) comp_fun_commute\" is\n \"\\args. insert_cnt args\" using insert_cnt_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (insert_cnt args) (v, m) data = set_fold_cfc (insert_cnt_cfc args) (v, m) data\"\n by(transfer) auto\n\nlift_definition insert_sum_cfc::\"aggargs \\ (event_data tuple, (bool \\ ((nat \\ integer) agg_map))) comp_fun_commute\" is\n \"\\args. insert_sum args\" using insert_sum_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (insert_sum args) (v, m) data = set_fold_cfc (insert_sum_cfc args) (v, m) data\"\n by(transfer) auto\n\nlift_definition insert_rank_cfc::\"aggargs \\ type \\ (event_data tuple, bool \\ list_aux agg_map) comp_fun_commute\" is\n \"\\args. insert_rank args\" using insert_rank_comm by unfold_locales auto\n\nlemma [code_unfold]: \"Finite_Set.fold (insert_rank args type) (v, m) data = set_fold_cfc (insert_rank_cfc args type) (v, m) data\"\n by(transfer) auto\n\ndefinition finite' :: \"'a set \\ bool\" where\n \"finite' = finite\"\n\ndeclare insert_maggaux'.simps [code del]\ndeclare insert_maggaux'.simps [folded finite'_def, code]\n\n\nlemma [code_unfold]: \"X - Mapping.keys tuple_in = Set.filter (\\k. Mapping.lookup tuple_in k = None) X\"\n by(transfer) (auto simp: Map_To_Mapping.map_apply_def) \n\ndefinition \"filter_join' pos X m = (Mapping.filter (join_filter_cond pos X) m, Mapping.keys m - Mapping.keys (Mapping.filter (join_filter_cond pos X) m))\"\n\ndeclare [[code drop: join_mmasaux]]\ndeclare join_mmasaux.simps[folded filter_join'_def filter_join_def, code]\n\nlemma filter_join'_False_empty: \"filter_join' False {} m = (m, {})\"\n unfolding filter_join'_def\n by transfer (auto split: option.splits)\n\nlemma filter_join'_False_insert: \n \"filter_join' False (Set.insert a A) m = (case filter_join' False A m of\n (m', X) \\ (Mapping.delete a m', case Mapping.lookup m' a of Some _ \\ Set.insert a X |\n _ \\ X))\"\n unfolding filter_join'_def\n by(transfer) (auto simp: Map_To_Mapping.map_apply_def split: option.splits if_splits)\n\nfun filter_join'_fold_fun where\n \"filter_join'_fold_fun x (m, X) = (Mapping.delete x m, case Mapping.lookup m x of Some _ \\ Set.insert x X |\n None \\ X)\"\n\nlemma filter_join'_False:\n assumes \"finite A\"\n shows \"filter_join' False A m = \n Finite_Set.fold filter_join'_fold_fun (m, {}) A\"\nproof -\n interpret comp_fun_idem \"filter_join'_fold_fun\"\n by(unfold_locales; simp add:fun_eq_iff; transfer) (auto simp: Map_To_Mapping.map_apply_def split:option.splits if_splits)\n from assms show ?thesis\n proof (induction A arbitrary: m)\n case empty\n then show ?case using filter_join'_False_empty by auto\n next\n case (insert a A)\n then show ?case using filter_join'_False_insert[of a A m]\n by(simp only:fold_insert[OF insert(1-2)] split:option.splits prod.splits; simp)\n qed \nqed\n\nlift_definition filter_not_in_cfi' :: \"('a, ('a, 'b) mapping \\ 'a set) comp_fun_idem\" is \n \"filter_join'_fold_fun\"\n by(unfold_locales; simp add:fun_eq_iff; transfer) (auto simp: Map_To_Mapping.map_apply_def split:option.splits if_splits)\n\nlemma filter_join'_code[code]:\n \"filter_join' pos A m =\n (if \\pos \\ finite A then set_fold_cfi filter_not_in_cfi' (m, {}) A\n else (Mapping.filter (join_filter_cond pos A) m, Mapping.keys m - Mapping.keys (Mapping.filter (join_filter_cond pos A) m)))\"\n unfolding filter_join'_def\n by (transfer fixing: m) (use filter_join'_False in \\auto simp add: filter_join'_def\\)\n\ndefinition \"filter_set' m X t = (Mapping.filter (filter_cond X m t) m, Mapping.keys m - Mapping.keys (Mapping.filter (filter_cond X m t) m))\"\n\ndeclare [[code drop: shift_end_mmasaux]]\ndeclare shift_end_mmasaux.simps[folded filter_set'_def, code]\n\nlemma filter_set'_empty: \"filter_set' m {} t = (m, {})\"\n unfolding filter_set'_def\n by transfer (auto simp: fun_eq_iff split: option.splits)\n\nlemma filter_set'_insert: \"filter_set' m (Set.insert x A) t = (let (m', X) = filter_set' m A t in\n case Mapping.lookup m' x of Some u \\ if t = u then (Mapping.delete x m', Set.insert x X) else (m', X) | _ \\ (m', X))\"\n unfolding filter_set'_def\n by transfer (auto simp: Map_To_Mapping.map_apply_def split: option.splits if_splits)\n\nfun filter_set'_fold_fun where\n \"filter_set'_fold_fun t a (m, X) = (case Mapping.lookup m a of \n Some u \\ if t = u then (Mapping.delete a m, Set.insert a X) else (m, X) | \n _ \\ (m, X))\"\n\nlemma filter_set'_fold:\n assumes \"finite A\"\n shows \"filter_set' m A t = Finite_Set.fold (filter_set'_fold_fun t) (m, {}) A\"\nproof -\n interpret comp_fun_idem \"filter_set'_fold_fun t\"\n by(unfold_locales; simp add:fun_eq_iff split:option.splits; transfer) (auto simp: Map_To_Mapping.map_apply_def)\n from assms show ?thesis\n proof (induction A arbitrary: m)\n case empty\n then show ?case using filter_set'_empty by auto\n next\n case (insert a A)\n then show ?case using filter_set'_insert[of m a A t]\n by(simp only:fold_insert[OF insert(1-2)] Let_def split:option.splits prod.splits; simp)\n qed \nqed\n\nlift_definition filter'_cfi :: \"'b \\ ('a, ('a, 'b) mapping \\ 'a set) comp_fun_idem\" is \n \"\\t. filter_set'_fold_fun t\"\n by(unfold_locales; simp add:fun_eq_iff split:option.splits; transfer) (auto simp: Map_To_Mapping.map_apply_def split:option.splits if_splits)\n\nlemma filter_set'_code[code]:\n \"filter_set' m A t = (if finite A then set_fold_cfi (filter'_cfi t) (m, {}) A else Code.abort (STR ''upd_set: infinite'') (\\_. filter_set' m A t))\"\n by (transfer fixing: m) (auto simp: filter_set'_fold)\n\nlemma mapping_delete_set_empty: \"mapping_delete_set m {} = m\"\n unfolding mapping_delete_set_def by (simp add: Mapping.lookup.rep_eq rep_inverse)\n\nlemma mapping_delete_set_insert: \"mapping_delete_set m (Set.insert a X) = Mapping.delete a (mapping_delete_set m X)\"\nproof(rule mapping_eqI)\n fix x\n show \"Mapping.lookup (mapping_delete_set m (Set.insert a X)) x =\n Mapping.lookup (Mapping.delete a (mapping_delete_set m X)) x\"\n unfolding Optimized_MTL.Mapping_lookup_delete mapping_delete_set_def\n by(auto simp: Mapping.lookup.rep_eq Mapping_inverse)\nqed\n\nlemma mapping_delete_fold:\n assumes \"finite A\"\n shows \"mapping_delete_set m A = Finite_Set.fold Mapping.delete m A\"\nproof -\n interpret comp_fun_idem \"Mapping.delete\" by(unfold_locales; transfer; simp add: fun_eq_iff) \n from assms show ?thesis\n proof (induction A arbitrary: m)\n case empty\n then show ?case using mapping_delete_set_empty by auto\n next\n case (insert a A)\n then show ?case using mapping_delete_set_insert[of m a A] fold_insert[OF insert(1-2), of m] by(simp)\n qed \nqed\n\nlift_definition mapping_delete_set_cfi :: \"('a, ('a, 'b) mapping) comp_fun_idem\" is \n Mapping.delete by(unfold_locales; transfer; simp add:fun_eq_iff)\n\nlemma mapping_delete_set_code[code]:\n \"mapping_delete_set m A = (if finite A then set_fold_cfi mapping_delete_set_cfi m A else Code.abort (STR ''mapping_delete_set: infinite'') (\\_. mapping_delete_set m A))\"\n using mapping_delete_fold[of A m] by (simp add: mapping_delete_set_cfi.rep_eq set_fold_cfi.rep_eq)\n\ninstantiation treelist :: (equal) equal begin\nlift_definition equal_treelist :: \"'a treelist \\ 'a treelist \\ bool\" is \"(=)\" .\ninstance by (standard; transfer; auto)\nend\n\ninstantiation wf_wbt :: (linorder) equal begin\nlift_definition equal_wf_wbt :: \"'a wf_wbt \\ 'a wf_wbt \\ bool\" is \"(=)\" .\ninstance by(standard; transfer; auto)\nend\n\nlemma eq_treelist_code[code]: \"equal_class.equal (Collapse y1) (Collapse y2) = (if y2 = empty_tree then (y1 = empty_tree) else (tree_inorder y1 = tree_inorder y2))\"\n apply(transfer) using Tree2.inorder.elims by auto\n\ndefinition to_add_set where\n \"to_add_set a m tmp = {b. (a, b) \\ tmp \\ Mapping.lookup m b = None}\"\n\ndefinition to_add_set_fun :: \"'b \\ ('a, 'c) mapping \\ 'b \\ 'a \\ 'a set \\ 'a set\" where\n \"to_add_set_fun a m elem s = (if a = fst elem \\ Mapping.lookup m (snd elem) = None then Set.insert (snd elem) s else s)\"\n\nlemma to_add_set_empty: \"to_add_set a m {} = {}\"\n unfolding to_add_set_def by auto\n\nlemma to_add_set_insert: \"to_add_set a m (Set.insert x X) = to_add_set_fun a m x (to_add_set a m X) \"\n unfolding to_add_set_def to_add_set_fun_def\n by transfer (auto simp: Map_To_Mapping.map_apply_def)\n\nlemma to_add_set_fold:\n assumes \"finite tmp\"\n shows \"to_add_set a m tmp = Finite_Set.fold (to_add_set_fun a m) {} tmp\"\nproof -\n interpret comp_fun_idem \"to_add_set_fun a m\"\n by(unfold_locales) (auto simp:to_add_set_fun_def comp_def split:if_splits)\n from assms show ?thesis\n proof (induction tmp)\n case empty\n then show ?case using to_add_set_empty[of a m] by simp\n next\n case (insert a A)\n show ?case unfolding fold_insert[OF insert(1-2)] insert(3)[symmetric] unfolding to_add_set_def to_add_set_fun_def\n by transfer auto\n qed \n qed\n\nlift_definition to_add_set_cfi :: \"'b \\ ('a, 'c) mapping \\ (('b \\ 'a), 'a set) comp_fun_idem\" is \n \"\\a m. to_add_set_fun a m\" by(unfold_locales) (auto simp:to_add_set_fun_def comp_def split:if_splits)\n\n\n\nlemma [code]: \n \"add_new_mmuaux args rel1 rel2 nt aux =\n (let (tp, tss, tables, len, maskL, maskR, a1_map, a2_map, tstp_map, done, done_length) =\n shift_mmuaux args nt aux;\n I = args_ivl args; pos = args_pos args;\n new_tstp = (if memL I 0 then Inr tp else Inl nt);\n tstp_map = Mapping.update tp nt tstp_map;\n tmp = \\((\\as. case Mapping.lookup a1_map (proj_tuple maskL as) of None \\\n (if \\pos then {(tp - len, as)} else {})\n | Some tp' \\ if pos then {(max (tp - len) tp', as)}\n else {(max (tp - len) (tp' + 1), as)}) ` rel2) \\ (if memL I 0 then {tp} \\ rel2 else {});\n tmp = Set.filter (\\(tp, as). case Mapping.lookup tstp_map tp of Some ts \\ memL I (nt - ts)) tmp;\n table = snd ` tmp;\n tables = append_queue (table, if memL I 0 then Inr tp else Inl nt) tables;\n a2_map = Mapping.update (tp + 1) Mapping.empty\n (upd_nested_max_tstp a2_map new_tstp tmp);\n a1_map = (if pos then Mapping.filter (\\as _. as \\ rel1)\n (upd_set a1_map (\\_. tp) (rel1 - Mapping.keys a1_map)) else upd_set a1_map (\\_. tp) rel1);\n tss = append_queue nt tss in\n (tp + 1, tss, tables, len + 1, maskL, maskR, a1_map, a2_map, tstp_map, done, done_length))\" \n by(auto simp: upd_nested_max_tstp_def split:option.splits prod.splits)\n\nlemma [code]:\n \"add_new_mmauaux args rel1 rel2 nt (mmuaux, aggaux) =\n (case args_agg args of \n None \\ let (tp, tss, tables, len, maskL, maskR, a1_map, a2_map, tstp_map, done, done_length) = add_new_mmuaux args rel1 rel2 nt mmuaux in\n ((tp, tss, tables, len, maskL, maskR, a1_map, a2_map, tstp_map, done, done_length), aggaux) |\n Some aggargs \\\n (let ((tp, tss, tables, len, maskL, maskR, a1_map, a2_map, tstp_map, done, done_length), aggaux) = shift_mmauaux args nt (mmuaux, aggaux);\n I = args_ivl args; pos = args_pos args;\n new_tstp = (if memL I 0 then Inr tp else Inl nt);\n tstp_map = Mapping.update tp nt tstp_map;\n m = case Mapping.lookup a2_map (tp - len) of Some m \\ m;\n tmp = \\((\\as. case Mapping.lookup a1_map (proj_tuple maskL as) of None \\\n (if \\pos then {(tp - len, as)} else {})\n | Some tp' \\ if pos then {(max (tp - len) tp', as)}\n else {(max (tp - len) (tp' + 1), as)}) ` rel2) \\ (if memL I 0 then {tp} \\ rel2 else {});\n tmp = Set.filter (\\(tp, as). case Mapping.lookup tstp_map tp of Some ts \\ memL I (nt - ts)) tmp;\n table = snd ` tmp;\n tables = append_queue (table, if memL I 0 then Inr tp else Inl nt) tables;\n a2_map' = Mapping.update (tp + 1) Mapping.empty\n (upd_nested_max_tstp a2_map new_tstp tmp);\n a1_map = (if pos then Mapping.filter (\\as _. as \\ rel1)\n (upd_set a1_map (\\_. tp) (rel1 - Mapping.keys a1_map)) else upd_set a1_map (\\_. tp) rel1);\n to_add = to_add_set (tp - len) m tmp;\n aggaux = insert_maggaux' aggargs to_add aggaux;\n tss = append_queue nt tss in\n ((tp + 1, tss, tables, len + 1, maskL, maskR, a1_map, a2_map', tstp_map, done, done_length), aggaux)))\"\n by(auto simp del: add_new_mmuaux.simps simp add: to_add_set_def upd_nested_max_tstp_def split:option.splits prod.splits)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "EmanueleFWM", "repo": "verimon-optimized-aggregations", "sha": "62096c661eb0ccf422139da229c34bc2dc735e5b", "save_path": "github-repos/isabelle/EmanueleFWM-verimon-optimized-aggregations", "path": "github-repos/isabelle/EmanueleFWM-verimon-optimized-aggregations/verimon-optimized-aggregations-62096c661eb0ccf422139da229c34bc2dc735e5b/thys/MFODL_Monitor_Devel/Monitor_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.36658972248186006, "lm_q1q2_score": 0.1947358967648481}} {"text": "theory Concrete_Security \nimports \n Observe_Failure\n Construction_Utility\nbegin\n\nsection \\Concrete security definition\\\n\nlocale constructive_security_aux_obsf =\n fixes real_resource :: \"('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"('c + 'e, 'd + 'f) resource\"\n and sim :: \"('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"('a, 'b) \\\"\n and \\_ideal :: \"('c, 'd) \\\"\n and \\_common :: \"('e, 'f) \\\"\n and adv :: real\n assumes WT_real [WT_intro]: \"\\_real \\\\<^sub>\\ \\_common \\res real_resource \\\"\n and WT_ideal [WT_intro]: \"\\_ideal \\\\<^sub>\\ \\_common \\res ideal_resource \\\"\n and WT_sim [WT_intro]: \"\\_real, \\_ideal \\\\<^sub>C sim \\\"\n and pfinite_sim [pfinite_intro]: \"pfinite_converter \\_real \\_ideal sim\"\n and adv_nonneg: \"0 \\ adv\"\n\nlocale constructive_security_sim_obsf =\n fixes real_resource :: \"('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"('c + 'e, 'd + 'f) resource\"\n and sim :: \"('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"('a, 'b) \\\"\n and \\_common :: \"('e, 'f) \\\"\n and \\ :: \"('a + 'e, 'b + 'f) distinguisher_obsf\"\n and adv :: real\n assumes adv: \"\\ exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\g \\ \\ \\\n \\ advantage \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource (real_resource)) \\ adv\"\n\nlocale constructive_security_obsf = constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common adv\n + constructive_security_sim_obsf real_resource ideal_resource sim \\_real \\_common \\ adv\n for real_resource :: \"('a + 'e, 'b + 'f) resource\"\n and ideal_resource :: \"('c + 'e, 'd + 'f) resource\"\n and sim :: \"('a, 'b, 'c, 'd) converter\"\n and \\_real :: \"('a, 'b) \\\"\n and \\_ideal :: \"('c, 'd) \\\"\n and \\_common :: \"('e, 'f) \\\"\n and \\ :: \"('a + 'e, 'b + 'f) distinguisher_obsf\"\n and adv :: real\nbegin\n\nlemma constructive_security_aux_obsf: \"constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common adv\" ..\nlemma constructive_security_sim_obsf: \"constructive_security_sim_obsf real_resource ideal_resource sim \\_real \\_common \\ adv\" ..\n\nend\n\ncontext constructive_security_aux_obsf begin\n\nlemma constructive_security_obsf_refl:\n \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common \\\n (advantage \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource (real_resource)))\"\n by unfold_locales(simp_all add: advantage_def WT_intro pfinite_intro)\n\nend\n\nlemma constructive_security_obsf_absorb_cong:\n assumes sec: \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common (absorb \\ cnv) adv\"\n and [WT_intro]: \"exception_\\ \\, exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\\\<^sub>C cnv \\\" \"exception_\\ \\, exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\\\<^sub>C cnv' \\\" \"exception_\\ \\ \\g \\ \\\"\n and cong: \"exception_\\ \\, exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\\\<^sub>C cnv \\ cnv'\"\n shows \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common (absorb \\ cnv') adv\"\nproof -\n interpret constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common \"absorb \\ cnv\" adv by fact\n show ?thesis\n proof\n have \"connect_obsf \\ (cnv' \\ obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) = connect_obsf \\ (cnv \\ obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource))\"\n \"connect_obsf \\ (cnv' \\ obsf_resource real_resource) = connect_obsf \\ (cnv \\ obsf_resource real_resource)\"\n by(rule connect_eq_resource_cong eq_\\_attach_on' WT_intro cong[symmetric] order_refl)+\n then have \"advantage (absorb \\ cnv') (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource) =\n advantage (absorb \\ cnv) (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource)\"\n unfolding advantage_def distinguish_attach[symmetric] by simp\n also have \"\\ \\ adv\" by(rule adv)(rule WT_intro)+\n finally show \"advantage (absorb \\ cnv') (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource) \\ adv\" .\n qed\nqed\n\nlemma constructive_security_obsf_sim_cong:\n assumes sec: \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common \\ adv\"\n and cong: \"\\_real, \\_ideal \\\\<^sub>C sim \\ sim'\"\n and pfinite [pfinite_intro]: \"pfinite_converter \\_real \\_ideal sim'\" (* This could probably be derived from cong and sec.pfinite_sim *)\n shows \"constructive_security_obsf real_resource ideal_resource sim' \\_real \\_ideal \\_common \\ adv\"\nproof\n interpret constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common \\ adv by fact\n show \"\\_real \\\\<^sub>\\ \\_common \\res real_resource \\\" \"\\_ideal \\\\<^sub>\\ \\_common \\res ideal_resource \\\" by(rule WT_intro)+\n from cong show [WT_intro]: \"\\_real, \\_ideal \\\\<^sub>C sim' \\\" by(rule eq_\\_converterD_WT1)(rule WT_intro)\n show \"pfinite_converter \\_real \\_ideal sim'\" by fact\n show \"0 \\ adv\" by(rule adv_nonneg)\n\n assume WT [WT_intro]: \"exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\g \\ \\\"\n have \"connect_obsf \\ (obsf_resource (sim' |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) = connect_obsf \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource))\"\n by(rule connect_eq_resource_cong WT_intro obsf_resource_eq_\\_cong eq_\\_attach_on' parallel_converter2_eq_\\_cong cong[symmetric] eq_\\_converter_reflI | simp)+\n with adv[OF WT]\n show \"advantage \\ (obsf_resource (sim' |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource) \\ adv\"\n unfolding advantage_def by simp\nqed\n\nlemma constructive_security_obsfI_core_rest [locale_witness]:\n assumes \"constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal (\\_common_core \\\\<^sub>\\ \\_common_rest) adv\"\n and adv: \"\\ exception_\\ (\\_real \\\\<^sub>\\ (\\_common_core \\\\<^sub>\\ \\_common_rest)) \\g \\ \\ \\\n \\ advantage \\ (obsf_resource (sim |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ ideal_resource)) (obsf_resource (real_resource)) \\ adv\"\n shows \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal (\\_common_core \\\\<^sub>\\ \\_common_rest) \\ adv\"\nproof -\n interpret constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \"\\_common_core \\\\<^sub>\\ \\_common_rest\" by fact\n show ?thesis\n proof\n assume A [WT_intro]: \"exception_\\ (\\_real \\\\<^sub>\\ (\\_common_core \\\\<^sub>\\ \\_common_rest)) \\g \\ \\\"\n hence outs: \"outs_gpv (exception_\\ (\\_real \\\\<^sub>\\ (\\_common_core \\\\<^sub>\\ \\_common_rest))) \\ \\ outs_\\ (\\_real \\\\<^sub>\\ (\\_common_core \\\\<^sub>\\ \\_common_rest))\"\n unfolding WT_gpv_iff_outs_gpv by simp\n have \"connect_obsf \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) = connect_obsf \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ ideal_resource))\"\n by(rule connect_cong_trace trace_eq_obsf_resourceI eq_resource_on_imp_trace_eq eq_\\_attach_on')+\n (rule WT_intro parallel_converter2_eq_\\_cong eq_\\_converter_reflI parallel_converter2_id_id[symmetric] order_refl outs)+\n then show \"advantage \\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource) \\ adv\" \n using adv[OF A] by(simp add: advantage_def)\n qed\nqed\n\nsubsection \\Composition theorems\\\n\ntheorem constructive_security_obsf_composability:\n fixes real\n assumes \"constructive_security_obsf middle ideal sim_inner \\_middle \\_inner \\_common (absorb \\ (obsf_converter (sim_outer |\\<^sub>= 1\\<^sub>C))) adv1\"\n assumes \"constructive_security_obsf real middle sim_outer \\_real \\_middle \\_common \\ adv2\"\n shows \"constructive_security_obsf real ideal (sim_outer \\ sim_inner) \\_real \\_inner \\_common \\ (adv1 + adv2)\"\nproof\n let ?\\ = \"absorb \\ (obsf_converter (sim_outer |\\<^sub>= 1\\<^sub>C))\"\n interpret inner: constructive_security_obsf middle ideal sim_inner \\_middle \\_inner \\_common ?\\ adv1 by fact\n interpret outer: constructive_security_obsf real middle sim_outer \\_real \\_middle \\_common \\ adv2 by fact\n\n show \"\\_real \\\\<^sub>\\ \\_common \\res real \\\"\n and \"\\_inner \\\\<^sub>\\ \\_common \\res ideal \\\"\n and \"\\_real, \\_inner \\\\<^sub>C sim_outer \\ sim_inner \\\" by(rule WT_intro)+\n show \"pfinite_converter \\_real \\_inner (sim_outer \\ sim_inner)\" by(rule pfinite_intro WT_intro)+\n show \"0 \\ adv1 + adv2\" using inner.adv_nonneg outer.adv_nonneg by simp\n\n assume WT_adv[WT_intro]: \"exception_\\ (\\_real \\\\<^sub>\\ \\_common) \\g \\ \\\"\n have eq1: \"connect_obsf (absorb \\ (obsf_converter (sim_outer |\\<^sub>= 1\\<^sub>C))) (obsf_resource (sim_inner |\\<^sub>= 1\\<^sub>C \\ ideal)) = \n connect_obsf \\ (obsf_resource (sim_outer \\ sim_inner |\\<^sub>= 1\\<^sub>C \\ ideal))\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\ add: parallel_converter2_comp1_out attach_compose)\n apply(rule obsf_attach)\n apply(rule pfinite_intro WT_intro)+\n done\n have eq2: \"connect_obsf (absorb \\ (obsf_converter (sim_outer |\\<^sub>= 1\\<^sub>C))) (obsf_resource middle) =\n connect_obsf \\ (obsf_resource (sim_outer |\\<^sub>= 1\\<^sub>C \\ middle))\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\ add: parallel_converter2_comp1_out attach_compose)\n apply(rule obsf_attach)\n apply(rule pfinite_intro WT_intro)+\n done\n\n have \"advantage ?\\ (obsf_resource (sim_inner |\\<^sub>= 1\\<^sub>C \\ ideal)) (obsf_resource middle) \\ adv1\"\n by(rule inner.adv)(rule WT_intro)+\n moreover have \"advantage \\ (obsf_resource (sim_outer |\\<^sub>= 1\\<^sub>C \\ middle)) (obsf_resource real) \\ adv2\"\n by(rule outer.adv)(rule WT_intro)+\n ultimately\n show \"advantage \\ (obsf_resource (sim_outer \\ sim_inner |\\<^sub>= 1\\<^sub>C \\ ideal)) (obsf_resource real) \\ adv1 + adv2\"\n by(auto simp add: advantage_def eq1 eq2 abs_diff_triangle_ineq2)\nqed\n\ntheorem constructive_security_obsf_lifting:\n assumes sec: \"constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common adv\"\n and sec2: \"exception_\\ (\\_real' \\\\<^sub>\\ \\_common') \\g \\ \\ \n \\ constructive_security_sim_obsf real_resource ideal_resource sim \\_real \\_common (absorb \\ (obsf_converter (w_adv_real |\\<^sub>= w_usr))) adv\"\n (is \"_ \\ constructive_security_sim_obsf _ _ _ _ _ ?\\ _\")\n assumes WT_usr [WT_intro]: \"\\_common', \\_common \\\\<^sub>C w_usr \\\"\n and pfinite [pfinite_intro]: \"pfinite_converter \\_common' \\_common w_usr\"\n and WT_adv_real [WT_intro]: \"\\_real', \\_real \\\\<^sub>C w_adv_real \\\"\n and WT_w_adv_ideal [WT_intro]: \"\\_ideal', \\_ideal \\\\<^sub>C w_adv_ideal \\\"\n and WT_adv_ideal_inv [WT_intro]: \"\\_ideal, \\_ideal' \\\\<^sub>C w_adv_ideal_inv \\\"\n and ideal_inverse: \"\\_ideal, \\_ideal \\\\<^sub>C w_adv_ideal_inv \\ w_adv_ideal \\ 1\\<^sub>C\"\n and pfinite_real [pfinite_intro]: \"pfinite_converter \\_real' \\_real w_adv_real\"\n and pfinite_ideal [pfinite_intro]: \"pfinite_converter \\_ideal \\_ideal' w_adv_ideal_inv\"\n shows \"constructive_security_obsf (w_adv_real |\\<^sub>= w_usr \\ real_resource) (w_adv_ideal |\\<^sub>= w_usr \\ ideal_resource) (w_adv_real \\ sim \\ w_adv_ideal_inv) \\_real' \\_ideal' \\_common' \\ adv\"\n (is \"constructive_security_obsf ?real ?ideal ?sim ?\\_real ?\\_ideal _ _ _\")\nproof\n interpret constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common by fact\n show \"\\_real' \\\\<^sub>\\ \\_common' \\res ?real \\\"\n and \"\\_ideal' \\\\<^sub>\\ \\_common' \\res ?ideal \\\"\n and \"\\_real', \\_ideal' \\\\<^sub>C ?sim \\\" by(rule WT_intro)+\n show \"pfinite_converter \\_real' \\_ideal' ?sim\" by(rule pfinite_intro WT_intro)+\n show \"0 \\ adv\" by(rule adv_nonneg)\n\n assume WT_adv [WT_intro]: \"exception_\\ (\\_real' \\\\<^sub>\\ \\_common') \\g \\ \\\"\n then interpret constructive_security_sim_obsf real_resource ideal_resource sim \\_real \\_common ?\\ adv by(rule sec2)\n\n have *: \"advantage ?\\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) (obsf_resource real_resource) \\ adv\"\n by(rule adv)(rule WT_intro)+\n\n have ideal: \"connect_obsf ?\\ (obsf_resource (sim |\\<^sub>= 1\\<^sub>C \\ ideal_resource)) =\n connect_obsf \\ (obsf_resource (?sim |\\<^sub>= 1\\<^sub>C \\ ?ideal))\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule eq_resource_on_trans[OF obsf_attach])\n apply(rule pfinite_intro WT_intro)+\n apply(rule obsf_resource_eq_\\_cong)\n apply(fold attach_compose)\n apply(unfold comp_converter_parallel2)\n apply(rule eq_\\_attach_on')\n apply(rule WT_intro)\n apply(rule parallel_converter2_eq_\\_cong)\n apply(unfold comp_converter_assoc)\n apply(rule eq_\\_comp_cong)\n apply(rule eq_\\_converter_reflI; rule WT_intro)\n apply(rule eq_\\_converter_trans[rotated])\n apply(rule eq_\\_comp_cong)\n apply(rule eq_\\_converter_reflI; rule WT_intro)\n apply(rule ideal_inverse[symmetric])\n apply(unfold comp_converter_id_right comp_converter_id_left)\n apply(rule eq_\\_converter_reflI; rule WT_intro)+\n apply simp\n apply(rule WT_intro)+\n done\n have real: \"connect_obsf ?\\ (obsf_resource real_resource) = connect_obsf \\ (obsf_resource ?real)\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule obsf_attach)\n apply(rule pfinite_intro WT_intro)+\n done\n show \"advantage \\ (obsf_resource ((?sim |\\<^sub>= 1\\<^sub>C) \\ ?ideal)) (obsf_resource ?real) \\ adv\" using *\n unfolding advantage_def ideal[symmetric] real[symmetric] .\nqed\n\ncorollary constructive_security_obsf_lifting_:\n assumes sec: \"constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common (absorb \\ (obsf_converter (w_adv_real |\\<^sub>= w_usr))) adv\"\n assumes WT_usr [WT_intro]: \"\\_common', \\_common \\\\<^sub>C w_usr \\\"\n and pfinite [pfinite_intro]: \"pfinite_converter \\_common' \\_common w_usr\"\n and WT_adv_real [WT_intro]: \"\\_real', \\_real \\\\<^sub>C w_adv_real \\\"\n and WT_w_adv_ideal [WT_intro]: \"\\_ideal', \\_ideal \\\\<^sub>C w_adv_ideal \\\"\n and WT_adv_ideal_inv [WT_intro]: \"\\_ideal, \\_ideal' \\\\<^sub>C w_adv_ideal_inv \\\"\n and ideal_inverse: \"\\_ideal, \\_ideal \\\\<^sub>C w_adv_ideal_inv \\ w_adv_ideal \\ 1\\<^sub>C\"\n and pfinite_real [pfinite_intro]: \"pfinite_converter \\_real' \\_real w_adv_real\"\n and pfinite_ideal [pfinite_intro]: \"pfinite_converter \\_ideal \\_ideal' w_adv_ideal_inv\"\n shows \"constructive_security_obsf (w_adv_real |\\<^sub>= w_usr \\ real_resource) (w_adv_ideal |\\<^sub>= w_usr \\ ideal_resource) (w_adv_real \\ sim \\ w_adv_ideal_inv) \\_real' \\_ideal' \\_common' \\ adv\"\nproof -\n interpret constructive_security_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common \"absorb \\ (obsf_converter (w_adv_real |\\<^sub>= w_usr))\" adv by fact\n from constructive_security_aux_obsf constructive_security_sim_obsf assms(2-)\n show ?thesis by(rule constructive_security_obsf_lifting)\nqed\n\ntheorem constructive_security_obsf_lifting_usr:\n assumes sec: \"constructive_security_aux_obsf real_resource ideal_resource sim \\_real \\_ideal \\_common adv\"\n and sec2: \"exception_\\ (\\_real \\\\<^sub>\\ \\_common') \\g \\ \\ \n \\ constructive_security_sim_obsf real_resource ideal_resource sim \\_real \\_common (absorb \\ (obsf_converter (1\\<^sub>C |\\<^sub>= conv))) adv\"\n and WT_conv [WT_intro]: \"\\_common', \\_common \\\\<^sub>C conv \\\"\n and pfinite [pfinite_intro]: \"pfinite_converter \\_common' \\_common conv\"\n shows \"constructive_security_obsf (1\\<^sub>C |\\<^sub>= conv \\ real_resource) (1\\<^sub>C |\\<^sub>= conv \\ ideal_resource) sim \\_real \\_ideal \\_common' \\ adv\"\n by(rule constructive_security_obsf_lifting[OF sec sec2, where ?w_adv_ideal=\"1\\<^sub>C\" and ?w_adv_ideal_inv=\"1\\<^sub>C\", simplified comp_converter_id_left comp_converter_id_right])\n (rule WT_intro pfinite_intro id_converter_eq_self order_refl | assumption)+\n\ntheorem constructive_security_obsf_lifting2:\n assumes sec: \"constructive_security_aux_obsf real_resource ideal_resource sim (\\_real1 \\\\<^sub>\\ \\_real2) (\\_ideal1 \\\\<^sub>\\ \\_ideal2) \\_common adv\"\n and sec2: \"exception_\\ ((\\_real1 \\\\<^sub>\\ \\_real2) \\\\<^sub>\\ \\_common') \\g \\ \\ \n \\ constructive_security_sim_obsf real_resource ideal_resource sim (\\_real1 \\\\<^sub>\\ \\_real2) \\_common (absorb \\ (obsf_converter ((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= conv))) adv\"\n assumes WT_conv [WT_intro]: \"\\_common', \\_common \\\\<^sub>C conv \\\"\n and pfinite [pfinite_intro]: \"pfinite_converter \\_common' \\_common conv\"\n shows \"constructive_security_obsf ((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= conv \\ real_resource) ((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= conv \\ ideal_resource) sim (\\_real1 \\\\<^sub>\\ \\_real2) (\\_ideal1 \\\\<^sub>\\ \\_ideal2) \\_common' \\ adv\"\n (is \"constructive_security_obsf ?real ?ideal _ ?\\_real ?\\_ideal _ _ _\")\nproof -\n interpret constructive_security_aux_obsf real_resource ideal_resource sim \"\\_real1 \\\\<^sub>\\ \\_real2\" \"\\_ideal1 \\\\<^sub>\\ \\_ideal2\" \\_common adv by fact\n have sim [unfolded comp_converter_id_left]: \"\\_real1 \\\\<^sub>\\ \\_real2,\\_ideal1 \\\\<^sub>\\ \\_ideal2 \\\\<^sub>C (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ sim \\ 1\\<^sub>C \\ sim\"\n by(rule eq_\\_comp_cong)(rule parallel_converter2_id_id eq_\\_converter_reflI WT_intro)+\n show ?thesis\n apply(rule constructive_security_obsf_sim_cong)\n apply(rule constructive_security_obsf_lifting[OF sec sec2, where ?w_adv_ideal=\"1\\<^sub>C |\\<^sub>= 1\\<^sub>C\" and ?w_adv_ideal_inv=\"1\\<^sub>C\", unfolded comp_converter_id_left comp_converter_id_right])\n apply(assumption|rule WT_intro sim pfinite_intro parallel_converter2_id_id)+\n done\nqed\n\ntheorem constructive_security_obsf_trivial:\n fixes res\n assumes [WT_intro]: \"\\ \\\\<^sub>\\ \\_common \\res res \\\"\n shows \"constructive_security_obsf res res 1\\<^sub>C \\ \\ \\_common \\ 0\"\nproof\n show \"\\ \\\\<^sub>\\ \\_common \\res res \\\" and \"\\, \\ \\\\<^sub>C 1\\<^sub>C \\\" by(rule WT_intro)+\n show \"pfinite_converter \\ \\ 1\\<^sub>C\" by(rule pfinite_intro)\n\n assume WT [WT_intro]: \"exception_\\ (\\ \\\\<^sub>\\ \\_common) \\g \\ \\\"\n have \"connect_obsf \\ (obsf_resource (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res)) = connect_obsf \\ (obsf_resource (1\\<^sub>C \\ res))\"\n by(rule connect_eq_resource_cong[OF WT])(fastforce intro: WT_intro eq_\\_attach_on' obsf_resource_eq_\\_cong parallel_converter2_id_id)+\n then show \"advantage \\ (obsf_resource (1\\<^sub>C |\\<^sub>= 1\\<^sub>C \\ res)) (obsf_resource res) \\ 0\"\n unfolding advantage_def by simp\nqed simp\n\nlemma parallel_constructive_security_aux_obsf [locale_witness]:\n assumes \"constructive_security_aux_obsf real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 adv1\"\n assumes \"constructive_security_aux_obsf real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 adv2\"\n shows \"constructive_security_aux_obsf (parallel_wiring \\ real1 \\ real2) (parallel_wiring \\ ideal1 \\ ideal2) (sim1 |\\<^sub>= sim2) \n (\\_real1 \\\\<^sub>\\ \\_real2) (\\_inner1 \\\\<^sub>\\ \\_inner2) (\\_common1 \\\\<^sub>\\ \\_common2)\n (adv1 + adv2)\"\nproof\n interpret sec1: constructive_security_aux_obsf real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 adv1 by fact\n interpret sec2: constructive_security_aux_obsf real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 adv2 by fact\n\n show \"(\\_real1 \\\\<^sub>\\ \\_real2) \\\\<^sub>\\ (\\_common1 \\\\<^sub>\\ \\_common2) \\res parallel_wiring \\ real1 \\ real2 \\\"\n and \"(\\_inner1 \\\\<^sub>\\ \\_inner2) \\\\<^sub>\\ (\\_common1 \\\\<^sub>\\ \\_common2) \\res parallel_wiring \\ ideal1 \\ ideal2 \\\"\n and \"\\_real1 \\\\<^sub>\\ \\_real2, \\_inner1 \\\\<^sub>\\ \\_inner2 \\\\<^sub>C sim1 |\\<^sub>= sim2 \\\" by(rule WT_intro)+\n show \"pfinite_converter (\\_real1 \\\\<^sub>\\ \\_real2) (\\_inner1 \\\\<^sub>\\ \\_inner2) (sim1 |\\<^sub>= sim2)\" by(rule pfinite_intro)+\n show \"0 \\ adv1 + adv2\" using sec1.adv_nonneg sec2.adv_nonneg by simp\nqed\n\ntheorem parallel_constructive_security_obsf:\n assumes \"constructive_security_obsf real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 (absorb \\ (obsf_converter (parallel_wiring \\ parallel_converter 1\\<^sub>C (converter_of_resource (sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2))))) adv1\"\n (is \"constructive_security_obsf _ _ _ _ _ _ ?\\1 _\")\n assumes \"constructive_security_obsf real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 (absorb \\ (obsf_converter (parallel_wiring \\ parallel_converter (converter_of_resource real1) 1\\<^sub>C))) adv2\"\n (is \"constructive_security_obsf _ _ _ _ _ _ ?\\2 _\")\n shows \"constructive_security_obsf (parallel_wiring \\ real1 \\ real2) (parallel_wiring \\ ideal1 \\ ideal2) (sim1 |\\<^sub>= sim2) \n (\\_real1 \\\\<^sub>\\ \\_real2) (\\_inner1 \\\\<^sub>\\ \\_inner2) (\\_common1 \\\\<^sub>\\ \\_common2)\n \\ (adv1 + adv2)\"\nproof -\n interpret sec1: constructive_security_obsf real1 ideal1 sim1 \\_real1 \\_inner1 \\_common1 ?\\1 adv1 by fact\n interpret sec2: constructive_security_obsf real2 ideal2 sim2 \\_real2 \\_inner2 \\_common2 ?\\2 adv2 by fact\n\n show ?thesis\n proof\n assume WT [WT_intro]: \"exception_\\ ((\\_real1 \\\\<^sub>\\ \\_real2) \\\\<^sub>\\ (\\_common1 \\\\<^sub>\\ \\_common2)) \\g \\ \\\"\n\n have **: \"outs_\\ ((\\_real1 \\\\<^sub>\\ \\_real2) \\\\<^sub>\\ (\\_common1 \\\\<^sub>\\ \\_common2)) \\\\<^sub>R\n ((1\\<^sub>C |\\<^sub>= sim2) |\\<^sub>= 1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ ideal2 \\\n parallel_wiring \\ (converter_of_resource real1 |\\<^sub>\\ 1\\<^sub>C) \\ sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2\"\n unfolding comp_parallel_wiring\n by(rule eq_resource_on_trans, rule eq_\\_attach_on[where conv'=\"parallel_wiring \\ (1\\<^sub>C |\\<^sub>= sim2 |\\<^sub>= 1\\<^sub>C)\"]\n , (rule WT_intro)+, rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def attach_compose attach_parallel2 attach_converter_of_resource_conv_parallel_resource\n intro: WT_intro parallel_converter2_eq_\\_cong parallel_converter2_id_id eq_\\_converter_reflI)\n\n have ideal2:\n \"connect_obsf ?\\2 (obsf_resource (sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2)) =\n connect_obsf \\ (obsf_resource ((1\\<^sub>C |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ ideal2))\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule eq_resource_on_trans[OF obsf_attach])\n apply(rule pfinite_intro WT_intro)+\n apply(rule obsf_resource_eq_\\_cong)\n apply(rule eq_resource_on_sym)\n apply(subst attach_compose[symmetric])\n apply(rule **)\n apply(rule WT_intro)+\n done\n\n have real2: \"connect_obsf ?\\2 (obsf_resource real2) = connect_obsf \\ (obsf_resource (parallel_wiring \\ real1 \\ real2))\"\n unfolding distinguish_attach[symmetric]\n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule eq_resource_on_trans[OF obsf_attach])\n apply(rule pfinite_intro WT_intro)+\n apply(rule obsf_resource_eq_\\_cong)\n apply(rule eq_resource_on_sym)\n by(simp add: attach_compose attach_converter_of_resource_conv_parallel_resource)(rule WT_intro)+\n\n have adv2: \"advantage \\\n (obsf_resource ((1\\<^sub>C |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ ideal2))\n (obsf_resource (parallel_wiring \\ real1 \\ real2)) \\ adv2\"\n unfolding advantage_def ideal2[symmetric] real2[symmetric] by(rule sec2.adv[unfolded advantage_def])(rule WT_intro)+\n\n have ideal1: \n \"connect_obsf ?\\1 (obsf_resource (sim1 |\\<^sub>= 1\\<^sub>C \\ ideal1)) = \n connect_obsf \\ (obsf_resource ((sim1 |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ideal1 \\ ideal2))\"\n proof -\n have *:\"((outs_\\ \\_real1 <+> outs_\\ \\_real2) <+> outs_\\ \\_common1 <+> outs_\\ \\_common2) \\\\<^sub>R\n (sim1 |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ideal1 \\ ideal2 \\\n parallel_wiring \\ (1\\<^sub>C |\\<^sub>\\ converter_of_resource (sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2)) \\ sim1 |\\<^sub>= 1\\<^sub>C \\ ideal1\"\n by(auto simp add: le_\\_def comp_parallel_wiring' attach_compose attach_parallel2 attach_converter_of_resource_conv_parallel_resource2 intro: WT_intro)\n show ?thesis\n unfolding distinguish_attach[symmetric] \n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule eq_resource_on_trans[OF obsf_attach])\n apply(rule pfinite_intro WT_intro)+\n apply(rule obsf_resource_eq_\\_cong)\n apply(rule eq_resource_on_sym)\n by(simp add: *, (rule WT_intro)+)\n qed\n\n have real1: \"connect_obsf ?\\1 (obsf_resource real1) = connect_obsf \\ (obsf_resource ((1\\<^sub>C |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ ideal2))\"\n proof -\n have *: \"outs_\\ ((\\_real1 \\\\<^sub>\\ \\_real2) \\\\<^sub>\\ (\\_common1 \\\\<^sub>\\ \\_common2)) \\\\<^sub>R\n parallel_wiring \\ ((1\\<^sub>C |\\<^sub>= 1\\<^sub>C) |\\<^sub>= sim2 |\\<^sub>= 1\\<^sub>C) \\ real1 \\ ideal2 \\\n parallel_wiring \\ (1\\<^sub>C |\\<^sub>\\ converter_of_resource (sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2 )) \\ real1\"\n by(rule eq_resource_on_trans, rule eq_\\_attach_on[where conv'=\"parallel_wiring \\ (1\\<^sub>C |\\<^sub>= sim2 |\\<^sub>= 1\\<^sub>C)\"]\n , (rule WT_intro)+, rule eq_\\_comp_cong, rule eq_\\_converter_mono)\n (auto simp add: le_\\_def attach_compose attach_converter_of_resource_conv_parallel_resource2 attach_parallel2 \n intro: WT_intro parallel_converter2_eq_\\_cong parallel_converter2_id_id eq_\\_converter_reflI)\n\n show ?thesis\n unfolding distinguish_attach[symmetric] \n apply(rule connect_eq_resource_cong)\n apply(rule WT_intro)\n apply(simp del: outs_plus_\\)\n apply(rule eq_resource_on_trans[OF obsf_attach])\n apply(rule pfinite_intro WT_intro)+\n apply(rule obsf_resource_eq_\\_cong)\n apply(rule eq_resource_on_sym)\n apply(fold attach_compose)\n apply(subst comp_parallel_wiring)\n apply(rule *)\n apply(rule WT_intro)+\n done\n qed\n\n have adv1: \"advantage \\ \n (obsf_resource ((sim1 |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ideal1 \\ ideal2))\n (obsf_resource ((1\\<^sub>C |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ real1 \\ ideal2)) \\ adv1\"\n unfolding advantage_def ideal1[symmetric] real1[symmetric] by(rule sec1.adv[unfolded advantage_def])(rule WT_intro)+\n\n from adv1 adv2 show \"advantage \\ (obsf_resource ((sim1 |\\<^sub>= sim2) |\\<^sub>= (1\\<^sub>C |\\<^sub>= 1\\<^sub>C) \\ parallel_wiring \\ ideal1 \\ ideal2))\n (obsf_resource (parallel_wiring \\ real1 \\ real2)) \\ adv1 + adv2\"\n by(auto simp add: advantage_def)\n qed\nqed\n\ntheorem parallel_constructive_security_obsf_fuse:\n assumes 1: \"constructive_security_obsf real1 ideal1 sim1 (\\_real1_core \\\\<^sub>\\ \\_real1_rest) (\\_ideal1_core \\\\<^sub>\\ \\_ideal1_rest) (\\_common1_core \\\\<^sub>\\ \\_common1_rest) (absorb \\ (obsf_converter (fused_wiring \\ parallel_converter 1\\<^sub>C (converter_of_resource (sim2 |\\<^sub>= 1\\<^sub>C \\ ideal2))))) adv1\"\n (is \"constructive_security_obsf _ _ _ ?\\_real1 ?\\_ideal1 ?\\_common1 ?\\1 _\")\n assumes 2: \"constructive_security_obsf real2 ideal2 sim2 (\\_real2_core \\\\<^sub>\\ \\_real2_rest) (\\_ideal2_core \\\\<^sub>\\ \\_ideal2_rest) (\\_common2_core \\\\<^sub>\\ \\_common2_rest) (absorb \\ (obsf_converter (fused_wiring \\ parallel_converter (converter_of_resource real1) 1\\<^sub>C))) adv2\"\n (is \"constructive_security_obsf _ _ _ ?\\_real2 ?\\_ideal2 ?\\_common2 ?\\2 _\")\n shows \"constructive_security_obsf (fused_wiring \\ real1 \\ real2) (fused_wiring \\ ideal1 \\ ideal2) \n (parallel_wiring \\ (sim1 |\\<^sub>= sim2) \\ parallel_wiring)\n ((\\_real1_core \\\\<^sub>\\ \\_real2_core) \\\\<^sub>\\ (\\_real1_rest \\\\<^sub>\\ \\_real2_rest)) \n ((\\_ideal1_core \\\\<^sub>\\ \\_ideal2_core) \\\\<^sub>\\ (\\_ideal1_rest \\\\<^sub>\\ \\_ideal2_rest))\n ((\\_common1_core \\\\<^sub>\\ \\_common2_core) \\\\<^sub>\\ (\\_common1_rest \\\\<^sub>\\ \\_common2_rest))\n \\ (adv1 + adv2)\"\nproof -\n interpret sec1: constructive_security_obsf real1 ideal1 sim1 ?\\_real1 ?\\_ideal1 ?\\_common1 ?\\1 adv1 by fact\n interpret sec2: constructive_security_obsf real2 ideal2 sim2 ?\\_real2 ?\\_ideal2 ?\\_common2 ?\\2 adv2 by fact\n\n have aux1: \"constructive_security_aux_obsf real1 ideal1 sim1 ?\\_real1 ?\\_ideal1 ?\\_common1 adv1\" ..\n have aux2: \"constructive_security_aux_obsf real2 ideal2 sim2 ?\\_real2 ?\\_ideal2 ?\\_common2 adv2\" ..\n\n have sim: \"constructive_security_sim_obsf (parallel_wiring \\ real1 \\ real2) (parallel_wiring \\ ideal1 \\ ideal2) (sim1 |\\<^sub>= sim2)\n (?\\_real1 \\\\<^sub>\\ ?\\_real2) (?\\_common1 \\\\<^sub>\\ ?\\_common2)\n (absorb \\ (obsf_converter (parallel_wiring |\\<^sub>= parallel_wiring)))\n (adv1 + adv2)\"\n if [WT_intro]: \"exception_\\ (((\\_real1_core \\\\<^sub>\\ \\_real2_core) \\\\<^sub>\\ (\\_real1_rest \\\\<^sub>\\ \\_real2_rest)) \\\\<^sub>\\ ((\\_common1_core \\\\<^sub>\\ \\_common2_core) \\\\<^sub>\\ (\\_common1_rest \\\\<^sub>\\ \\_common2_rest))) \\g \\ \\\"\n proof -\n interpret constructive_security_obsf \n \"parallel_wiring \\ real1 \\ real2\"\n \"parallel_wiring \\ ideal1 \\ ideal2\"\n \"sim1 |\\<^sub>= sim2\"\n \"?\\_real1 \\\\<^sub>\\ ?\\_real2\" \"?\\_ideal1 \\\\<^sub>\\ ?\\_ideal2\" \"?\\_common1 \\\\<^sub>\\ ?\\_common2\"\n \"absorb \\ (obsf_converter (parallel_wiring |\\<^sub>= parallel_wiring))\"\n \"adv1 + adv2\"\n apply(rule parallel_constructive_security_obsf)\n apply(fold absorb_comp_converter)\n apply(rule constructive_security_obsf_absorb_cong[OF 1])\n apply(rule WT_intro)+\n apply(unfold fused_wiring_def comp_converter_assoc)\n apply(rule obsf_comp_converter)\n apply(rule WT_intro pfinite_intro)+\n apply(rule constructive_security_obsf_absorb_cong[OF 2])\n apply(rule WT_intro)+\n apply(subst fused_wiring_def) \n apply(unfold comp_converter_assoc)\n apply(rule obsf_comp_converter)\n apply(rule WT_intro pfinite_intro wiring_intro parallel_wiring_inverse)+\n done\n show ?thesis ..\n qed\n show ?thesis\n unfolding fused_wiring_def attach_compose\n apply(rule constructive_security_obsf_lifting[where w_adv_ideal_inv=parallel_wiring])\n apply(rule parallel_constructive_security_aux_obsf[OF aux1 aux2])\n apply(erule sim)\n apply(rule WT_intro pfinite_intro parallel_wiring_inverse)+\n done\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Concrete_Security.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.3073580295544412, "lm_q1q2_score": 0.19468373054357999}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ExecConcrete\nimports CorresXF\nbegin\n\ndefinition \"exec_transformed (sr :: ('s \\ 't) set) (M :: ('t, 'r) nondet_monad) \\\n \\s. (\\ ((\\(r', t'). {(r, t). r = r' \\ (t, t') \\ sr}) ` (\\ (fst ` M ` {s'. (s, s') \\ sr}))),\n True \\ snd ` M ` {s'. (s, s') \\ sr})\"\n\nlemma in_exec_transformed:\n \"((r, s') \\ fst (exec_transformed sr A s)) = (\\t t'. (s, t) \\ sr \\ (s', t') \\ sr \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_transformed_def)\n apply force\n done\n\nlemma snd_exec_transformed:\n \"snd (exec_transformed sr M s) = (\\x. (s, x) \\ sr \\ snd (M x))\"\n by (clarsimp simp: exec_transformed_def)\n\nlemma exec_transformed_Id [simp]:\n \"exec_transformed Id M = M\"\n apply (auto simp: exec_transformed_def)\n done\n\nlemma exec_transformed_valid_def:\n \"\\ P \\ exec_transformed sr M \\ Q \\ = \\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\\"\n apply (rule iffI [rotated])\n apply (clarsimp simp: image_def split_def valid_def in_exec_transformed)\n apply force\n apply (clarsimp simp: image_def split_def valid_def exec_transformed_def)\n apply (erule allE, erule (1) impE)\n apply (case_tac \"M s\")\n apply (erule_tac allE, erule impE)\n by (auto intro!: exI) fastforce\n\nlemma exec_transformed_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\ \\ \\ P \\ exec_transformed sr M \\ Q \\\"\n apply (subst exec_transformed_valid_def)\n apply simp\n done\n\nlemma exec_transformedE_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\,\\ \\r s. \\s'. (s', s) \\ sr \\ E r s' \\\n \\ \\ P \\ exec_transformed sr M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_transformed_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_transformed_no_fail [wp]:\n \"no_fail (\\s. \\s'. (s', s) \\ sr \\ P s') M \\ no_fail P (exec_transformed sr M)\"\n apply (clarsimp simp: no_fail_def snd_exec_transformed)\n apply force\n done\n\nlemmas exec_transformed_wp_nf [wp] =\n validNF [OF exec_transformed_wp exec_transformed_no_fail]\n\nlemma exec_transformed_return_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (return a) \\ P \\\"\n including no_pre\n apply wp\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_returnOk_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (returnOk a) \\ P \\,\\ E \\\"\n including no_pre\n apply wp\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_fail_wp_nf [wp]:\n \"\\ \\s. \\ (\\s'. (s, s') \\ sr) \\ exec_transformed sr fail \\ P \\!\"\n apply wp\n apply (clarsimp simp: fail_def no_fail_def)\n apply force\n done\n\nlemma exec_transformed_fail_wp [wp]:\n \"\\ \\_. True \\ exec_transformed st fail \\ P \\\" \n including no_pre by wp\n\n(*\n * Execute the given monad with a concrete state.\n *\n * In particular, we non-determinstically select a concrete state that maps\n * to the current abstract state, execute @{term M}, and then map the resulting\n * states back into the abstract universe.\n *)\ndefinition \"exec_concrete (st :: 't \\ 's) (M :: ('t, 'r) nondet_monad) \\\n \\s. ({(r, t). \\s' t'. s = st s' \\ t = st t' \\ (r, t') \\ fst (M s')},\n \\s'. s = st s' \\ snd (M s'))\"\n\nlemma \"exec_concrete st M = exec_transformed {(s, t). st t = s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_concrete_def exec_transformed_def)\n apply force\n done\n\nlemma in_exec_concrete [monad_eq]:\n \"((r, s') \\ fst (exec_concrete st A s)) = (\\t t'. st t = s \\ st t' = s' \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_concrete_def split_def image_def)\n apply force\n done\n\nlemma snd_exec_concrete [monad_eq]:\n \"snd (exec_concrete st M s) = (\\x. st x = s \\ snd (M x))\"\n by (fastforce simp: exec_concrete_def)\n\nlemma exec_concrete_id [simp]:\n \"exec_concrete id M = M\"\n \"exec_concrete (\\a. a) M = M\"\n apply (auto simp: exec_concrete_def)\n done\n\nlemma exec_concrete_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\ \\ \\ P \\ exec_concrete st M \\ Q \\\"\n apply (clarsimp simp: image_def split_def valid_def in_exec_concrete)\n apply force\n done\n\nlemma exec_concreteE_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\,\\ \\r s. E r (st s) \\\n \\ \\ P \\ exec_concrete st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_concrete_wp)\n apply simp\n done\n\nlemma exec_concrete_no_fail [wp]:\n \"no_fail (\\s. P (st s)) M \\ no_fail P (exec_concrete st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_concrete)\n done\n\nlemma exec_concrete_wp_nf [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\! \\ \\ P \\ exec_concrete st M \\ Q \\!\"\n apply rule\n apply (rule exec_concrete_wp)\n apply (erule validNF_valid)\n including no_pre\n apply wp\n apply (erule validNF_no_fail)\n done\n\nlemma exec_concrete_return_wp [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\\"\n by wp\n\nlemma exec_concrete_returnOk_wp [wp]:\n \"\\ P a \\ exec_concrete st (returnOk a) \\ P \\,\\ E \\\"\n by wp\n\nlemma exec_concrete_return_wp_nf [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_concrete st fail \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp [wp]:\n \"\\ \\_. True \\ exec_concrete st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_concrete:\n \"corresXF_simple st (\\r s. r) P (exec_concrete st M) M\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_concrete in_exec_concrete)\n apply force\n done\n\nlemma corresXF_exec_concrete_self:\n \"corresXF st (\\r s. r) (\\r s. r) P (exec_concrete st M) M\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_concrete)\n done\n\nlemma corresXF_exec_concrete [intro?]:\n \"corresXF id ret_xf ex_xf P A C \\ corresXF st ret_xf ex_xf P (exec_concrete st A) C\"\n apply (clarsimp simp: corresXF_def exec_concrete_def split: sum.splits)\n apply safe\n apply (clarsimp simp: image_def split_def)\n apply force\n apply (clarsimp simp: image_def split_def)\n apply force\n done\n\nlemma exec_concrete_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_concrete st M)\"\n apply (subst empty_fail_def)\n apply (clarsimp simp: exec_concrete_def)\n apply (metis empty_failD2 surjective_pairing)\n done\n\n(*\n * Execute the given monad in a modified state.\n *)\ndefinition \"exec_abstract st M \\ \n \\s'. ({(r', t'). \\t. t = st t' \\ (r', t) \\ fst (M (st s'))},\n \\s. s = st s' \\ snd (M (st s')))\"\n\nlemma exec_abstract_transformed:\n \"exec_abstract st M = exec_transformed {(s, t). t = st s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_transformed_def exec_abstract_def)\n apply blast\n done\n\nlemma in_exec_abstract [monad_eq]:\n \"((r, t) \\ fst (exec_abstract st A s)) = (\\t'. st t = t' \\ (r, t') \\ fst (A (st s)))\"\n by (clarsimp simp: exec_abstract_def split_def image_def)\n\nlemma snd_exec_abstract [monad_eq]:\n \"snd (exec_abstract st M s) = (snd (M (st s)))\"\n by (clarsimp simp: exec_abstract_def)\n\nlemma exec_abstract_id [simp]:\n \"exec_abstract id M = M\"\n \"exec_abstract (\\a. a) M = M\"\n apply (auto simp: exec_abstract_def)\n done\n\nlemma exec_abstract_valid_def:\n \"\\ P \\ exec_abstract st M \\ Q \\ = \\ \\s. \\s'. st s' = s \\ P s' \\ M \\ \\r s. \\t. st t = s \\ Q r t \\\"\n apply (subst exec_abstract_transformed)\n apply (subst exec_transformed_valid_def)\n apply (fastforce simp: valid_def)\n done\n\nlemma exec_abstract_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\\"\n apply (subst exec_abstract_valid_def)\n apply (clarsimp simp: valid_def)\n apply force\n done\n\nlemma exec_abstractE_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\,\\ \\r s. \\t. st t = s \\ E r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_abstract_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_abstract_no_fail [wp]:\n \"no_fail (\\s. \\t. st t = s \\ P t) M \\ no_fail P (exec_abstract st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_abstract)\n apply force\n done\n\nlemma exec_abstract_wp_nf [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\! \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\!\"\n apply rule\n apply (rule exec_abstract_wp)\n apply (erule validNF_valid)\n apply (rule exec_abstract_no_fail)\n apply (rule validNF_no_fail)\n apply (erule validNF_weaken_pre)\n apply force\n done\n\nlemma exec_abstract_return_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_returnOk_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (returnOk a) \\ P \\,\\ E \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_return_wp_nf [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\!\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_abstract st fail \\ P \\!\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_fail_wp [wp]:\n \"\\ \\_. True \\ exec_abstract st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_abstract:\n \"corresXF_simple st (\\r s. r) P M (exec_abstract st M)\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_abstract in_exec_abstract)\n done\n\nlemma corresXF_exec_abstract_self:\n \"corresXF st (\\r s. r) (\\r s. r) P M (exec_abstract st M)\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_abstract)\n done\n\nlemma corresXF_exec_abstract [intro?]:\n \"corresXF st ret_xf ex_xf P A C \\ corresXF id ret_xf ex_xf P (exec_abstract st A) C\"\n apply (clarsimp simp: corresXF_def exec_abstract_def split: sum.splits)\n done\n\nlemma exec_abstract_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_abstract st M)\"\n apply (clarsimp simp: empty_fail_def exec_abstract_def)\n apply (metis nonemptyE surjective_pairing)\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/autocorres/ExecConcrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.19466748782771068}} {"text": "theory TopoS_Interface_impl\nimports \"Lib/FiniteGraph\" \"Lib/FiniteListGraph\" TopoS_Interface TopoS_Helper\nbegin\n\nsection{*Executable Implementation with Lists*}\n text {*Correspondence List Implementation and set Specification*}\n \n subsection{*Abstraction from list implementation to set specification*}\n text{*Nomenclature: @{text \"_spec\"} is the specification, @{text \"_impl\"} the corresponding implementation.*}\n\n text{*@{text \"_spec\"} and @{text \"_impl\"} only need to comply for @{const valid_graph}s. \n We will always require the stricter @{const valid_list_graph}, which implies @{const valid_graph}.\n *}\n lemma \"valid_list_graph G \\ valid_graph (list_graph_to_graph G)\"\n by %invisible (metis valid_list_graph_def valid_list_graph_iff_valid_graph)\n\n locale TopoS_List_Impl = \n fixes default_node_properties :: \"'a\" (\"\\\") \n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\"\n and sinvar_impl::\"('v::vertex) list_graph \\ ('v::vertex \\ 'a) \\ bool\"\n and verify_globals_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ 'b \\ bool\"\n and verify_globals_impl::\"('v::vertex) list_graph \\ ('v::vertex \\ 'a) \\ 'b \\ bool\"\n and receiver_violation :: \"bool\"\n and offending_flows_impl::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n and node_props_impl::\"('v::vertex, 'a, 'b) TopoS_Params \\ ('v \\ 'a)\"\n and eval_impl::\"('v::vertex) list_graph \\ ('v, 'a, 'b)TopoS_Params \\ bool\"\n assumes\n spec: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\" --\"specification is valid\"\n and\n sinvar_spec_impl: \"valid_list_graph G \\ \n (sinvar_spec (list_graph_to_graph G) nP) = (sinvar_impl G nP)\"\n and\n verify_globals_spec_impl: \"valid_list_graph G \\ \n (verify_globals_spec (list_graph_to_graph G) nP gP) = (verify_globals_impl G nP gP)\"\n and\n offending_flows_spec_impl: \"valid_list_graph G \\ \n (SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP) = \n set`set (offending_flows_impl G nP)\"\n and \n node_props_spec_impl: \n \"SecurityInvariant.node_props_formaldef default_node_properties P = node_props_impl P\"\n and\n eval_spec_impl:\n \"(distinct (nodesL G) \\ distinct (edgesL G) \\ \n SecurityInvariant.eval sinvar_spec verify_globals_spec default_node_properties (list_graph_to_graph G) P ) = \n (eval_impl G P)\"\n\n subsection {* Security Invariants Packed*}\n\n text {* We pack all necessary functions and properties of a security invariant in a struct-like data structure.*}\n record ('v::vertex, 'a, 'b) TopoS_packed =\n nm_name :: \"string\"\n nm_receiver_violation :: \"bool\"\n nm_default :: \"'a\"\n nm_sinvar::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ bool\"\n nm_verify_globals::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ 'b \\ bool\"\n nm_offending_flows::\"('v::vertex) list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\"\n nm_node_props::\"('v::vertex, 'a, 'b) TopoS_Params \\ ('v \\ 'a)\" \n nm_eval::\"('v::vertex) list_graph \\ ('v, 'a, 'b)TopoS_Params \\ bool\"\n \n\n\n text{*The packed list implementation must comply with the formal definition. *}\n locale TopoS_modelLibrary =\n fixes m :: \"('v::vertex, 'a, 'b) TopoS_packed\" -- \"concrete model implementation\"\n and sinvar_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ bool\" --\"specification\"\n and verify_globals_spec::\"('v::vertex) graph \\ ('v::vertex \\ 'a) \\ 'b \\ bool\" --\"specification\"\n assumes\n name_not_empty: \"length (nm_name m) > 0\"\n and\n impl_spec: \"TopoS_List_Impl \n (nm_default m)\n sinvar_spec\n (nm_sinvar m)\n verify_globals_spec\n (nm_verify_globals m)\n (nm_receiver_violation m)\n (nm_offending_flows m)\n (nm_node_props m)\n (nm_eval m)\"\n\n\n\n subsection{*Helpful Lemmata*}\n\n text{*show that @{term \"sinvar\"} complies*}\n lemma TopoS_eval_impl_proofrule: \n assumes inst: \"SecurityInvariant sinvar_spec default_node_properties receiver_violation\"\n assumes ev: \"\\nP. valid_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n assumes ver: \"\\ nP gP. valid_list_graph G \\ verify_globals_spec (list_graph_to_graph G) nP gP = verify_globals_impl G nP gP\"\n shows \"\n (distinct (nodesL G) \\ distinct (edgesL G) \\ SecurityInvariant.eval sinvar_spec verify_globals_spec default_node_properties (list_graph_to_graph G) P) =\n (valid_list_graph G \\ verify_globals_impl G (SecurityInvariant.node_props default_node_properties P) (model_global_properties P) \\\n sinvar_impl G (SecurityInvariant.node_props default_node_properties P))\"\n proof (cases \"valid_list_graph G\")\n case True\n hence \"(verify_globals_spec (list_graph_to_graph G) (SecurityInvariant.node_props default_node_properties P) (model_global_properties P) \\\n sinvar_spec (list_graph_to_graph G) (SecurityInvariant.node_props default_node_properties P)) =\n (verify_globals_impl G (SecurityInvariant.node_props default_node_properties P) (model_global_properties P) \\\n sinvar_impl G (SecurityInvariant.node_props default_node_properties P))\"\n using ev ver by blast\n\n with inst show ?thesis\n unfolding valid_list_graph_def \n by (simp add: valid_list_graph_iff_valid_graph SecurityInvariant.eval_def)\n next\n case False\n hence \"(distinct (nodesL G) \\ distinct (edgesL G) \\ valid_list_graph_axioms G) = False\"\n unfolding valid_list_graph_def by blast\n with False show ?thesis\n unfolding SecurityInvariant.eval_def[OF inst]\n by (fastforce simp: valid_list_graph_iff_valid_graph)\n qed\n\n\nsubsection {*Helper lemmata*}\n\n text{* Provide @{term sinvar} function and get back a function that computes the list of offending flows\n \n Exponential time!\n *}\n definition Generic_offending_list:: \"('v list_graph \\ ('v \\ 'a) \\ bool )\\ 'v list_graph \\ ('v \\ 'a) \\ ('v \\ 'v) list list\" where\n \"Generic_offending_list sinvar G nP = [f \\ (sublists (edgesL G)). \n (\\ sinvar G nP \\ sinvar (FiniteListGraph.delete_edges G f) nP) \\ \n (\\(e1, e2)\\set f. \\ sinvar (add_edge e1 e2 (FiniteListGraph.delete_edges G f)) nP)]\"\n \n \n text{*proof rule: if @{term sinvar} complies, @{const Generic_offending_list} complies *}\n lemma Generic_offending_list_correct: \n assumes valid: \"valid_list_graph G\"\n assumes spec_impl: \"\\G nP. valid_list_graph G \\ sinvar_spec (list_graph_to_graph G) nP = sinvar_impl G nP\"\n shows \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec (list_graph_to_graph G) nP = \n set`set( Generic_offending_list sinvar_impl G nP )\"\n proof -\n have \"\\ P G. set ` {x \\ set (sublists (edgesL G)). P G (set x)} = {x \\ set ` set (sublists (edgesL G)). P G (x)}\"\n by fastforce\n hence subset_sublists_filter: \"\\ G P. {f. f \\ edges (list_graph_to_graph G) \\ P G f} \n = set ` set [f\\sublists (edgesL G) . P G (set f)]\"\n unfolding list_graph_to_graph_def\n by (auto simp: sublists_powset)\n\n from valid delete_edges_valid have \"\\f. valid_list_graph(FiniteListGraph.delete_edges G f)\" by fast\n with spec_impl[symmetric] FiniteListGraph.delete_edges_correct[of \"G\"] have impl_spec_delete:\n \"\\f. sinvar_impl (FiniteListGraph.delete_edges G f) nP = \n sinvar_spec (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)) nP\" by simp\n\n from spec_impl[OF valid, symmetric] have impl_spec_not:\n \"(\\ sinvar_impl G nP) = (\\ sinvar_spec (list_graph_to_graph G) nP)\" by auto\n\n from spec_impl[symmetric, OF FiniteListGraph.add_edge_valid[OF FiniteListGraph.delete_edges_valid[OF valid]]] have impl_spec_allE:\n \"\\ e1 e2 E. sinvar_impl (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E)) nP =\n sinvar_spec (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G E))) nP\" by simp\n\n have list_graph: \"\\ e1 e2 G f. (list_graph_to_graph (FiniteListGraph.add_edge e1 e2 (FiniteListGraph.delete_edges G f))) = \n (FiniteGraph.add_edge e1 e2 (FiniteGraph.delete_edges (list_graph_to_graph G) (set f)))\"\n by(simp add: FiniteListGraph.add_edge_correct FiniteListGraph.delete_edges_correct)\n \n show ?thesis \n unfolding SecurityInvariant_withOffendingFlows.set_offending_flows_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def \n SecurityInvariant_withOffendingFlows.is_offending_flows_def\n Generic_offending_list_def\n apply(subst impl_spec_delete)\n apply(subst impl_spec_not)\n apply(subst impl_spec_allE)\n apply(subst list_graph)\n apply(rule subset_sublists_filter)\n done\n qed\n\n lemma all_edges_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\(e1, e2)\\ (edges (list_graph_to_graph G)). P (list_graph_to_graph G) e1 e2) = (\\(e1, e2)\\set (edgesL G). Pl G e1 e2)\"\n unfolding list_graph_to_graph_def\n by simp\n\n lemma all_nodes_list_I: \"P (list_graph_to_graph G) = Pl G \\ \n (\\n \\ (nodes (list_graph_to_graph G)). P (list_graph_to_graph G) n) = (\\ n \\set (nodesL G). Pl G n)\"\n unfolding list_graph_to_graph_def\n by simp\n\n\n\n\n(*TODO: this should be a header of TopoS_Libary. The header should be printed BEFORE the imports are processed. *)\nsection{*Security Invariant Library*}\n(*The SINVAR_* theory files all use the \"subsection\" command. Here is the top-section.*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/TopoS_Interface_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.19465799562517183}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__49.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__49 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__49 and some rule r*}\nlemma n_SendInvAckVsinv__49:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv0) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__49:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__49:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__49:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__49:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__49.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.19451571527133654}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__46_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__46_on_rules imports n_german_lemma_on_inv__46\nbegin\nsection{*All lemmas on causal relation between inv__46*}\nlemma lemma_inv__46_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__46 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__46) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__46_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.35577489351363034, "lm_q1q2_score": 0.1945157130573009}} {"text": "(* Title: JinjaThreads/BV/EffectMono.thy\n Author: Gerwin Klein, Andreas Lochbihler\n*)\n\nsection \\Monotonicity of eff and app\\\n\ntheory EffectMono\nimports\n Effect\nbegin\n\ndeclare not_Err_eq [iff]\n\ndeclare widens_trans[trans]\n\nlemma app\\<^sub>i_mono: \n assumes wf: \"wf_prog p P\"\n assumes less: \"P \\ \\ \\\\<^sub>i \\'\"\n shows \"app\\<^sub>i (i,P,mxs,mpc,rT,\\') \\ app\\<^sub>i (i,P,mxs,mpc,rT,\\)\"\nproof -\n assume app: \"app\\<^sub>i (i,P,mxs,mpc,rT,\\')\"\n \n obtain ST LT ST' LT' where\n [simp]: \"\\ = (ST,LT)\" and\n [simp]: \"\\' = (ST',LT')\" \n by (cases \\, cases \\')\n\n from less have [simp]: \"size ST = size ST'\" and [simp]: \"size LT = size LT'\"\n by (auto dest: list_all2_lengthD)\n\n note [iff] = list_all2_Cons2 widen_Class \n note [simp] = fun_of_def \n\n from app less show \"app\\<^sub>i (i,P,mxs,mpc,rT,\\)\"\n proof (cases i)\n case Load\n with app less show ?thesis by (auto dest!: list_all2_nthD)\n next\n case (Invoke M n)\n with app have n: \"n < size ST'\" by simp\n \n { assume \"ST!n = NT\" hence ?thesis using n app Invoke by simp }\n moreover {\n assume \"ST'!n = NT\"\n moreover with n less have \"ST!n = NT\" \n by (auto dest: list_all2_nthD)\n ultimately have ?thesis using n app Invoke by simp }\n moreover {\n assume ST: \"ST!n \\ NT\" and ST': \"ST'!n \\ NT\" \n\n from ST' app Invoke\n obtain D Ts T m C'\n where D: \"class_type_of' (ST' ! n) = \\D\\\"\n and Ts: \"P \\ rev (take n ST') [\\] Ts\"\n and D_M: \"P \\ D sees M: Ts\\T = m in C'\"\n by fastforce\n\n from less have \"P \\ ST!n \\ ST'!n\"\n by(auto dest: list_all2_nthD2[OF _ n])\n with D obtain D' where D': \"class_type_of' (ST ! n) = \\D'\\\" \n and DsubC: \"P \\ D' \\\\<^sup>* D\"\n using ST by(rule widen_is_class_type_of)\n from wf D_M DsubC obtain Ts' T' m' C'' where\n D'_M: \"P \\ D' sees M: Ts'\\T' = m' in C''\" and\n Ts': \"P \\ Ts [\\] Ts'\"\n by (blast dest: sees_method_mono)\n from less have \"P \\ rev (take n ST) [\\] rev (take n ST')\" by simp\n also note Ts also note Ts' \n finally have \"P \\ rev (take n ST) [\\] Ts'\" .\n with D'_M D' app less Invoke D have ?thesis by(auto)\n }\n ultimately show ?thesis by blast\n next \n case Getfield\n with app less show ?thesis\n by(fastforce simp add: sees_field_def widen_Array dest: has_fields_fun)\n next\n case Putfield\n with app less show ?thesis\n by (fastforce intro: widen_trans rtrancl_trans simp add: sees_field_def widen_Array dest: has_fields_fun)\n next\n case CAS\n with app less show ?thesis\n by (fastforce intro: widen_trans rtrancl_trans simp add: sees_field_def widen_Array dest: has_fields_fun)\n next\n case Return\n with app less show ?thesis by (fastforce intro: widen_trans)\n next\n case ALoad\n with app less show ?thesis by(auto simp add: widen_Array)\n next\n case AStore\n with app less show ?thesis by(auto simp add: widen_Array)\n next\n case ALength\n with app less show ?thesis by(auto simp add: widen_Array)\n next\n case (Checkcast T)\n with app less show ?thesis\n by(auto elim!: refTE simp: widen_Array)\n next\n case (Instanceof T)\n with app less show ?thesis\n by(auto elim!: refTE simp: widen_Array)\n next\n case ThrowExc\n with app less show ?thesis\n by(auto elim!: refTE simp: widen_Array)\n next\n case MEnter\n with app less show ?thesis\n by(auto elim!: refTE simp: widen_Array)\n next\n case MExit\n with app less show ?thesis\n by(auto elim!: refTE simp: widen_Array)\n next\n case (BinOpInstr bop)\n with app less show ?thesis by(force dest: WTrt_binop_widen_mono)\n next\n case Dup\n with app less show ?thesis\n by(auto dest: list_all2_lengthD)\n next\n case Swap\n with app less show ?thesis\n by(auto dest: list_all2_lengthD)\n qed (auto elim!: refTE not_refTE)\nqed\n\nlemma succs_mono:\n assumes wf: \"wf_prog p P\" and app\\<^sub>i: \"app\\<^sub>i (i,P,mxs,mpc,rT,\\')\"\n shows \"P \\ \\ \\\\<^sub>i \\' \\ set (succs i \\ pc) \\ set (succs i \\' pc)\"\nproof (cases i)\n case (Invoke M n)\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i Invoke have \"n < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!n \\ ST'!n\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with Invoke show ?thesis by auto \nnext\n case ALoad\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i ALoad have \"1 < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!1 \\ ST'!1\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with ALoad show ?thesis by auto\nnext \n case AStore\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i AStore have \"2 < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!2 \\ ST'!2\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with AStore show ?thesis by auto\nnext\n case ALength\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i ALength have \"0 < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!0 \\ ST'!0\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with ALength show ?thesis by auto\nnext\n case MEnter\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i MEnter have \"0 < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!0 \\ ST'!0\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with MEnter show ?thesis by auto\nnext\n case MExit\n obtain ST LT ST' LT' where \n [simp]: \"\\ = (ST,LT)\" and [simp]: \"\\' = (ST',LT')\" by (cases \\, cases \\') \n assume \"P \\ \\ \\\\<^sub>i \\'\"\n moreover\n with app\\<^sub>i MExit have \"0 < size ST\" by (auto dest: list_all2_lengthD)\n ultimately\n have \"P \\ ST!0 \\ ST'!0\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n with MExit show ?thesis by auto\nqed auto\n\nlemma app_mono: \n assumes wf: \"wf_prog p P\"\n assumes less': \"P \\ \\ \\' \\'\"\n shows \"app i P m rT pc mpc xt \\' \\ app i P m rT pc mpc xt \\\"\nproof (cases \\)\n case None thus ?thesis by simp\nnext\n case (Some \\\\<^sub>1) \n moreover\n with less' obtain \\\\<^sub>2 where \\\\<^sub>2: \"\\' = Some \\\\<^sub>2\" by (cases \\') auto\n ultimately have less: \"P \\ \\\\<^sub>1 \\\\<^sub>i \\\\<^sub>2\" using less' by simp\n \n assume \"app i P m rT pc mpc xt \\'\"\n with Some \\\\<^sub>2 obtain\n app\\<^sub>i: \"app\\<^sub>i (i, P, pc, m, rT, \\\\<^sub>2)\" and\n xcpt: \"xcpt_app i P pc m xt \\\\<^sub>2\" and\n succs: \"\\(pc',s')\\set (eff i P pc xt (Some \\\\<^sub>2)). pc' < mpc\"\n by (auto simp add: app_def)\n \n from wf less app\\<^sub>i have \"app\\<^sub>i (i, P, pc, m, rT, \\\\<^sub>1)\" by (rule app\\<^sub>i_mono)\n moreover\n from less have \"size (fst \\\\<^sub>1) = size (fst \\\\<^sub>2)\" \n by (cases \\\\<^sub>1, cases \\\\<^sub>2) (auto dest: list_all2_lengthD)\n with xcpt have \"xcpt_app i P pc m xt \\\\<^sub>1\" by (simp add: xcpt_app_def)\n moreover\n from wf app\\<^sub>i less have \"\\pc. set (succs i \\\\<^sub>1 pc) \\ set (succs i \\\\<^sub>2 pc)\"\n by (blast dest: succs_mono)\n with succs\n have \"\\(pc',s')\\set (eff i P pc xt (Some \\\\<^sub>1)). pc' < mpc\"\n by (cases \\\\<^sub>1, cases \\\\<^sub>2)\n (auto simp add: eff_def norm_eff_def xcpt_eff_def dest: bspec)\n ultimately\n show ?thesis using Some by (simp add: app_def)\nqed\n\nlemma eff\\<^sub>i_mono:\n assumes wf: \"wf_prog p P\"\n assumes less: \"P \\ \\ \\\\<^sub>i \\'\"\n assumes app\\<^sub>i: \"app i P m rT pc mpc xt (Some \\')\"\n assumes succs: \"succs i \\ pc \\ []\" \"succs i \\' pc \\ []\"\n shows \"P \\ eff\\<^sub>i (i,P,\\) \\\\<^sub>i eff\\<^sub>i (i,P,\\')\"\nproof -\n obtain ST LT ST' LT' where\n [simp]: \"\\ = (ST,LT)\" and\n [simp]: \"\\' = (ST',LT')\" \n by (cases \\, cases \\')\n \n note [simp] = eff_def app_def fun_of_def \n\n from less have \"P \\ (Some \\) \\' (Some \\')\" by simp\n from wf this app\\<^sub>i \n have app: \"app i P m rT pc mpc xt (Some \\)\" by (rule app_mono)\n\n from less app app\\<^sub>i show ?thesis\n proof (cases i)\n case ThrowExc with succs have False by simp\n thus ?thesis ..\n next\n case Return with succs have False by simp\n thus ?thesis ..\n next\n case (Load i)\n from Load app obtain y where\n y: \"i < size LT\" \"LT!i = OK y\" by clarsimp\n from Load app\\<^sub>i obtain y' where\n y': \"i < size LT'\" \"LT'!i = OK y'\" by clarsimp\n\n from less have \"P \\ LT [\\\\<^sub>\\] LT'\" by simp\n with y y' have \"P \\ y \\ y'\" by (auto dest: list_all2_nthD) \n with Load less y y' app app\\<^sub>i\n show ?thesis by auto\n next\n case Store with less app app\\<^sub>i\n show ?thesis by (auto simp add: list_all2_update_cong) \n next\n case (Invoke M n) \n with app\\<^sub>i have n: \"n < size ST'\" by simp\n from less have [simp]: \"size ST = size ST'\" \n by (auto dest: list_all2_lengthD)\n\n from Invoke succs have ST: \"ST!n \\ NT\" and ST': \"ST'!n \\ NT\" by (auto)\n \n from ST' app\\<^sub>i Invoke obtain D Ts T m C'\n where D: \"class_type_of' (ST' ! n) = \\D\\\"\n and Ts: \"P \\ rev (take n ST') [\\] Ts\"\n and D_M: \"P \\ D sees M: Ts\\T = m in C'\"\n by fastforce\n\n from less have \"P \\ ST!n \\ ST'!n\" by(auto dest: list_all2_nthD2[OF _ n])\n with D obtain D' where D': \"class_type_of' (ST ! n) = \\D'\\\" \n and DsubC: \"P \\ D' \\\\<^sup>* D\"\n using ST by(rule widen_is_class_type_of)\n\n from wf D_M DsubC obtain Ts' T' m' C'' where\n D'_M: \"P \\ D' sees M: Ts'\\T' = m' in C''\" and\n Ts': \"P \\ Ts [\\] Ts'\" and \"P \\ T' \\ T\" by (blast dest: sees_method_mono)\n\n show ?thesis using Invoke n D D' D_M less D'_M Ts' \\P \\ T' \\ T\\\n by(auto intro: list_all2_dropI)\n next\n case ALoad with less app app\\<^sub>i succs\n show ?thesis by(auto split: if_split_asm dest: Array_Array_widen)\n next\n case AStore with less app app\\<^sub>i succs\n show ?thesis by(auto split: if_split_asm dest: Array_Array_widen)\n next\n case (BinOpInstr bop)\n with less app app\\<^sub>i succs show ?thesis\n by auto(force dest: WTrt_binop_widen_mono WTrt_binop_fun)\n qed auto\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/BV/EffectMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.1945157055881293}} {"text": "theory flash64Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_InvVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_1VsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by(cut_tac a1 a2 a3 a4, auto) \n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto \n qed\n lemma NI_InvAck_1_HomeVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_InvAck_2VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_GetX_GetXVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ( eqn ( IVar ( Global ''Dir_Pending'') ) ( Const false )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_GetVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_Local_Get_Nak1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put2VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_Get_Put3VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Local_PutVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Nak_ClearVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_Nak_HomeVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 a3 a4 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ( eqn ( IVar ( Para ''CacheState'' iInv1) ) ( Const CACHE_E )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P3 s\"\n\n \n apply( cut_tac a1 a2 b1 , simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule1) ) ( Const CACHE_E )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) ) ( Const UNI_PutX )) ) ) \" in exI,auto)\n \n \n done\n\n \n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv64: \n (*Rule2VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iInv1 \\ N\" and a4:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1\\(iRule2~=iInv1 )) \\((iRule1~=iInv1 )\\iRule2=iInv1) \\((iRule1~=iInv1 )\\(iRule2~=iInv1 )) \" \n\t by( cut_tac a1 a2 a3 a4 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1\\(iRule2~=iInv1 ))\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\iRule2=iInv1)\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 )\\(iRule2~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 a3 a4 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_Remote_PutXVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma NI_ReplaceVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ReplaceHomeVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_ReplaceShrVldVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma NI_ShWbVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma NI_WbVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_Get_GetVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_PutXVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Local_ReplaceVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n lemma PI_Remote_GetVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_GetXVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have allCases:\"(iRule1=iInv1) \\((iRule1~=iInv1 )) \" \n\t by( cut_tac a1 a2 , auto) \nmoreover\n {assume b1:\"(iRule1=iInv1)\"\n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 b1 , auto)\n\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\nmoreover\n {assume b1:\"((iRule1~=iInv1 ))\"\n\n have \"?P2 s\"\n\n \n apply(cut_tac a1 a2 b1 , auto intro!:forallVars1 simp add :invHoldForRule2'_def varsOfVar_def)\n \n done\n\n then have \"?P1 s\\ ?P2 s \\ ?P3 s\"\n\n by blast\n\n \n\n\t }\n ultimately show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n\t by metis\n\n \n\n\n qed\nlemma PI_Remote_PutXVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma PI_Remote_ReplaceVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreVsInv64: \n (*Rule1VsPInv1*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 a2 , auto)\n lemma StoreHomeVsInv64: \n (*Rule0VsPInv1*)\n assumes a1:\"iInv1 \\ N\" \n\n shows \"invHoldForRule' s (inv64 iInv1 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n by (cut_tac a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash64Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3738758367247085, "lm_q1q2_score": 0.19423646894116542}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__31_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__31_on_rules imports n_german_lemma_on_inv__31\nbegin\nsection{*All lemmas on causal relation between inv__31*}\nlemma lemma_inv__31_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__31 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__31) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__31_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3738758227716966, "lm_q1q2_score": 0.19423646169227823}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__105.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__105 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__105 and some rule r*}\nlemma n_PI_Remote_GetVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__105:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__105:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__105:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__105:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__105:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__105:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__105:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__105:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__105:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__105:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__105:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__105:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__105:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__105 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__105:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__105:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__105:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__105:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__105:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__105:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__105:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__105:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__105:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__105:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__105:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__105:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__105:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__105:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__105:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__105:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__105.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.19422425151339656}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__5.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__5 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__5 and some rule r*}\nlemma n_SendInvAckVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv1) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__5:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv1 p__Inv2 where a2:\"p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv1)\\(i~=p__Inv1\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv1) ''State'')) (Const I))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv1) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv1\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__5:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__5:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__5 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_on_inv__5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3849121444839335, "lm_q1q2_score": 0.19395960471703508}} {"text": "theory RepeatCorres\n imports\n RepeatUpdate\n CorresHelper\n CogentTypingHelper\n \"build/Generated_CorresSetup\"\nbegin\n\ncontext update_sem_init begin\n\ndefinition crepeat\n where\n\"crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1 a \\\n do r <- select UNIV;\n (i :: 64 word) <- gets (\\_. 0);\n a0 <- select UNIV;\n a0 <- gets (\\_. a1U (\\_. a0C a) a0);\n a0 <- gets (\\_. o1U (\\_. o0C a) a0);\n i <- gets (\\_. 0);\n doE a0 <-\n doE x <-\n doE _ <- liftE (guard (\\s. True));\n whileLoopE (\\(ret, a0, i) s. i < ((nC a) :: 64 word))\n (\\(ret, a0, i).\n doE x <-\n doE retval <- liftE (do ret' <- d0 ((stopC a) :: 32 signed word) a0;\n gets (\\_. ret')\n od);\n _ <- doE _ <- liftE (guard (\\s. True));\n condition (\\s. boolean_C retval \\ 0)\n (doE global_exn_var <- liftE (gets (\\_. Break));\n throwError (global_exn_var, ret, a0)\n odE)\n (liftE (gets (\\_. ())))\n odE;\n liftE (do retval <- do ret' <- d1 ((stepC a) :: 32 signed word) a0;\n gets (\\_. ret')\n od;\n a0 <- gets (\\_. a1U (\\_. retval) a0);\n i <- gets (\\_. i + 1);\n gets (\\_. (retval, a0, i))\n od)\n odE;\n liftE\n (case x of\n (ret, a0, i) \\\n do _ <- guard (\\_. True);\n gets (\\_. (ret, a0, i))\n od)\n odE)\n (r, a0, i)\n odE;\n liftE (case x of (ret, a0, i) \\ gets (\\_. a0))\n odE \n (\\(global_exn_var, ret, a0). doE _ <- doE _ <- liftE (guard (\\s. True));\n condition (\\s. global_exn_var = Break)\n (liftE (gets (\\_. ())))\n (throwError ret)\n odE;\n liftE (gets (\\_. a0))\n odE);\n ret <- liftE (gets (\\_. a1C a0));\n global_exn_var <- liftE (gets (\\_. Return));\n throwError ret\n odE \n (\\ret. do _ <- gets (\\_. ());\n gets (\\_. ret)\n od)\n od\"\n\ndefinition repeat_inv\n where\n\"repeat_inv srel \\' (i :: 64 word) fstop fstep \\ \\a \\o acc obsv s cn cacc cobsv \\\n val_rel obsv cobsv \\ i \\ cn \\\n (\\\\' y. urepeat_bod \\' (unat i) (uvalfun_to_expr fstop) (uvalfun_to_expr fstep) \\ \\' \\a acc \\o obsv y \\\n (\\', s) \\ srel \\ val_rel y cacc)\"\n\ndefinition repeat_measure\n where\n\"repeat_measure i n = unat n - unat i\"\n\ndefinition repeat_pre_step\n where\n\"repeat_pre_step srel \\' i j fstop fstep \\ \\a \\o acc obsv s cn cacc cobsv \\ \n val_rel obsv cobsv \\ i < cn \\ i = j \\ \n (\\\\' y. urepeat_bod \\' (unat i) (uvalfun_to_expr fstop) (uvalfun_to_expr fstep) \\ \\' \\a acc \\o obsv y \\\n (\\', s) \\ srel \\ val_rel y cacc \\\n (\\', [URecord [(y, type_repr (bang \\a)), (obsv, type_repr \\o)] None]\n \\ (\\', App (uvalfun_to_expr fstop) (Var 0)) \\! (\\', UPrim (LBool False))))\"\n\nlemma step_wp:\n assumes \\wellformed: \"proc_ctx_wellformed \\'\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrelc: \"\\x x'. val_rel x (x' :: ('c :: cogent_C_val)) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and d1corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and srel: \"(\\, s) \\ state_rel\"\n and acctyp: \"\\', \\ \\ acc :u \\a \\ra, wa\\\"\n and obsvtyp: \"\\', \\ \\ obsv :u \\o \\ro, {}\\\"\n and disjoint: \"wa \\ ro = {}\"\n and valrelacc: \"val_rel acc (a0C v')\"\n and valrelobsv: \"val_rel obsv (o0C v')\"\n shows \"\\arg j i.\n \\\\sa. repeat_pre_step state_rel \\' i j fstop fstep \\ \\a \\o acc obsv sa (nC v') (a1C arg) (o1C arg)\\\n d1 (stepC v') arg \n \\\\ret sb.\n repeat_inv state_rel \\' (j + 1) fstop fstep \\ \\a \\o acc obsv sb (nC v') (a1C (a1U (\\_. ret) arg))\n (o1C (a1U (\\_. ret) arg)) \\\n repeat_measure (j+1) (nC v') < repeat_measure i (nC v')\\!\"\n apply (clarsimp simp: validNF_def valid_def no_fail_def)\n apply (subst all_imp_conj_distrib[symmetric]; clarsimp)\n apply (clarsimp simp: repeat_pre_step_def repeat_inv_def repeat_measure_def)\n apply (rename_tac s \\' y)\n apply (insert d1corres)\n apply (drule_tac x = \"URecord [(y, type_repr \\a), (obsv, type_repr \\o)] None\" and\n y = arg in meta_spec2)\n apply (drule_tac x = \\' and y = s in meta_spec2)\n apply (erule meta_impE)\n apply (simp add: valrelc)\n apply (clarsimp simp: corres_def \\wellformed \\'matchesu)\n apply (erule impE) \n apply (drule urepeat_bod_preservation[OF \\wellformed \\'matchesu acctyp obsvtyp\n disjoint[simplified Int_commute] _\n fsteptype[simplified \\fdef]])\n apply clarsimp\n apply (rename_tac r' w')\n apply (rule_tac x = \"r' \\ ro\" in exI)\n apply (rule_tac x = w' in exI)\n apply (clarsimp simp: \\fdef)\n apply (intro matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified]\n matches_ptrs_empty[where \\s = \"[]\", simplified]\n u_t_struct\n u_t_r_cons1[where w' = \"{}\", simplified]\n u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_t_r_empty; simp?)\n apply (erule uval_typing_frame(1); simp add: obsvtyp disjoint[simplified Int_commute])\n apply (drule frame_noalias_uval_typing'(2)[OF _ obsvtyp disjoint[simplified Int_commute]]; blast)\n apply (simp add:matches_ptrs.matches_ptrs_empty)\n apply clarsimp\n apply (rename_tac a b)\n apply (elim allE impE, assumption)\n apply (clarsimp simp: inc_le)\n apply (simp only: less_is_non_zero_p1[THEN unatSuc2] word_less_nat_alt)\n apply (frule urepeat_bod_step_determ[OF _ _ _ determ]; (simp del: urepeat_bod.simps)?)\n apply (intro conjI exI; assumption?; (simp del: urepeat_bod.simps add: o1C_a1U a1C_a1U)?)\n done\n\nlemma stop_wp:\n assumes \\wellformed: \"proc_ctx_wellformed \\'\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrelc: \"\\x x'. val_rel x (x' :: ('c :: cogent_C_val)) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and d0corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and srel: \"(\\, s) \\ state_rel\"\n and acctyp: \"\\', \\ \\ acc :u \\a \\ra, wa\\\"\n and obsvtyp: \"\\', \\ \\ obsv :u \\o \\ro, {}\\\"\n and disjoint: \"wa \\ ro = {}\"\n and valrelacc: \"val_rel acc (a0C v')\"\n and valrelobsv: \"val_rel obsv (o0C v')\"\n shows \"\\j arg j'.\n \\\\sa. (\\\\' y n. (\\', sa) \\ state_rel \\ val_rel y (a1C arg) \\ val_rel obsv (o1C arg) \\\n j = j' \\ j < nC v' \\\n urepeat_bod \\' n (uvalfun_to_expr fstop) (uvalfun_to_expr fstep) \\ \\'\n \\a acc \\o obsv y \\\n ((\\' , [URecord [(y, type_repr (bang \\a)), (obsv, type_repr \\o)] None]\n \\ (\\', App (uvalfun_to_expr fstop) (Var 0)) \\! (\\', UPrim (LBool True)))\n \\ n \\ unat j \\ n < unat (nC v')) \\\n ((\\' , [URecord [(y, type_repr (bang \\a)), (obsv, type_repr \\o)] None]\n \\ (\\', App (uvalfun_to_expr fstop) (Var 0)) \\! (\\', UPrim (LBool False)))\n \\ n = unat j))\\\n d0 (stopC v') arg \n \\\\ret sb.\n (boolean_C ret \\ 0 \\\n (\\\\' y.\n urepeat_bod \\' (unat (nC v')) (uvalfun_to_expr fstop) (uvalfun_to_expr fstep) \\ \\' \\a acc \\o obsv y \\\n (\\', sb) \\ state_rel \\ val_rel y (a1C arg))) \\\n (boolean_C ret = 0 \\\n repeat_pre_step state_rel \\' j j' fstop fstep \\ \\a \\o acc obsv sb (nC v') (a1C arg) (o1C arg))\\!\"\n apply (clarsimp simp: validNF_def valid_def no_fail_def)\n apply (subst all_imp_conj_distrib[symmetric]; clarsimp)\n apply (clarsimp simp: repeat_pre_step_def)\n apply (rename_tac s \\' y n)\n apply (insert d0corres)\n apply (drule_tac x = \"URecord [(y, type_repr (bang \\a)), (obsv, type_repr \\o)] None\" and\n y = arg in meta_spec2)\n apply (drule_tac x = \\' and y = s in meta_spec2)\n apply (erule meta_impE)\n apply (simp add: valrelc)\n apply (clarsimp simp: corres_def \\wellformed \\'matchesu)\n apply (frule urepeat_bod_preservation[OF \\wellformed \\'matchesu acctyp obsvtyp\n disjoint[simplified Int_commute] _\n fsteptype[simplified \\fdef]])\n apply clarsimp\n apply (rename_tac r' w')\n apply (erule impE, rule_tac x = \"(r' \\ w') \\ ro\" in exI, rule_tac x = \"{}\" in exI) \n apply (clarsimp simp: \\fdef)\n apply (intro matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified]\n matches_ptrs_empty[where \\s = \"[]\", simplified]\n u_t_struct\n u_t_r_cons1[where w' = \"{}\", simplified]\n u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_t_r_empty; simp?)\n apply (rule uval_typing_bang(1); simp)\n apply (rule uval_typing_bang(1)[where w = \"{}\" ,simplified])\n apply (erule uval_typing_frame(1); simp add: obsvtyp disjoint[simplified Int_commute])\n apply (rule wellformed_imp_bang_type_repr[OF uval_typing_to_wellformed(1)[OF obsvtyp]])\n apply (simp add:matches_ptrs.matches_ptrs_empty)\n apply clarsimp\n apply (rename_tac a b)\n apply (elim allE, erule impE, assumption)\n apply clarsimp \n apply (frule_tac r = \"(r' \\ w') \\ ro\" and w = \"{}\" \n in preservation(1)[where K = \"[]\" and \\s = \"[]\", simplified,\n OF subst_wellformed_nothing \\wellformed _ \n \\'matchesu _ fstoptype, simplified, rotated 1])\n apply (clarsimp simp: \\fdef)\n apply (intro matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified]\n matches_ptrs_empty[where \\s = \"[]\", simplified]\n u_t_struct\n u_t_r_cons1[where w' = \"{}\", simplified]\n u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_t_r_empty; simp?)\n apply (rule uval_typing_bang(1); simp)\n apply (rule uval_typing_bang(1)[where w = \"{}\" ,simplified])\n apply (erule uval_typing_frame(1); simp add: obsvtyp disjoint[simplified Int_commute])\n apply (rule wellformed_imp_bang_type_repr[OF uval_typing_to_wellformed(1)[OF obsvtyp]])\n apply (simp add:matches_ptrs.matches_ptrs_empty)\n apply (clarsimp simp: val_rel_bool_t_C_def)\n apply (erule u_t_primE; clarsimp)\n apply (drule frame_empty; clarsimp)\n apply (rule conjI; clarsimp)\n apply (intro exI conjI; assumption?)\n apply (erule (2) urepeat_bod_early_termination)\n apply (intro exI conjI; assumption?)\n done\n\nlemma crepeat_corres_base:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [],{}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\i: \"\\ ! i = \n URecord [(UPrim (LU64 n), RPrim (Num U64)), \n (fstop, RFun), (fstep, RFun), \n (acc, type_repr \\a), (obsv, type_repr \\o)] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and d0corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and valrela: \"\\x x'. val_rel x (x' :: 'a) \\\n \\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x')\"\n and valrelc: \"\\x x'. val_rel x (x' :: 'c) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\nproof (rule absfun_corres[OF _ \\len valrel])\n show \"abs_fun_rel \\' state_rel name \\'' cfun \\ s (\\ ! i) v'\"\n apply (subst abs_fun_rel_def')\n apply (clarsimp simp: \\name \\def \\''name cfundef urepeat_def bang\\o \\i fsteptype[simplified \\fdef])\n apply (insert fstoptype; simp add: \\fdef bang\\o)\n apply (thin_tac \"_, _, _, _, _ \\ _ : _\")\n apply (erule u_t_recE; clarsimp)\n apply (erule u_t_r_consE; simp)+\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (frule tprim_no_pointers(1); clarsimp)\n apply (drule tprim_no_pointers(2); clarsimp)\n apply (frule tfun_no_pointers(1); clarsimp)\n apply (frule tfun_no_pointers(2); clarsimp)\n apply (drule uval_typing_uvalfun; simp)\n apply (frule tfun_no_pointers(1); clarsimp)\n apply (frule tfun_no_pointers(2); clarsimp)\n apply (drule uval_typing_uvalfun; simp)\n apply (erule u_t_r_emptyE; clarsimp)\n apply (rename_tac ra wa ro wo)\n apply (cut_tac \\' = \\' and \\ = \\ and v = obsv and \\ = \\o and r = ro and w = wo\n in bang_not_writable(1); simp add: bang\\o)\n apply (clarsimp simp: crepeat_def valrela val_rel_word val_rel_fun_tag)\n apply (wp; (clarsimp split: prod.splits)?)\n apply (rule_tac \n I = \"\\(a, b, j) s. repeat_inv state_rel \\' j fstop fstep \\ \\a \\o acc obsv s (nC v') (a1C b) (o1C b)\" and\n M = \"\\((_,_, j), _). repeat_measure j (nC v')\" in whileLoopE_add_invI)\n apply (wp; clarsimp split: prod.splits)\n using d1corres o1C_a1U a1C_a1U\n apply (wp step_wp[OF _ \\'matchesu determ \\fdef fsteptype valrelc]; simp?)\n apply (wp; clarsimp)\n apply (wp; clarsimp)\n using d0corres\n apply (wp stop_wp[OF _ \\'matchesu determ \\fdef fstoptype fsteptype valrelc]; simp?)\n apply clarsimp\n apply (clarsimp simp: repeat_inv_def)\n apply (intro exI conjI; assumption?)\n apply (clarsimp simp: unat_mono)\n apply clarsimp\n apply (clarsimp simp: repeat_inv_def)\n apply wp\n apply (rule validNF_select_UNIV)+\n apply (clarsimp simp: repeat_inv_def o1C_o1U a1C_o1U a1C_a1U)\n done\nnext\n show \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n using \\i by simp\nqed\n\nsection \"Corres rules which are easier to use\"\n\nlemma crepeat_corres:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and d0corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and valrela: \"\\x x'. val_rel x (x' :: 'a) \\\n \\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x')\"\n and valrelc: \"\\x x'. val_rel x (x' :: 'c) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (insert \\i valrel; clarsimp simp: valrela val_rel_word corres_def)\n apply (frule matches_ptrs_length)\n apply (frule_tac matches_ptrs_proj_single'[OF _ _ \\i[simplified \\name \\def]]; simp?)\n apply (cut_tac \\len; linarith)\n apply clarsimp\n apply (erule u_t_recE; clarsimp)\n apply (erule u_t_r_consE; simp)+\n apply (erule u_t_r_emptyE; simp)\n apply (elim conjE)\n apply (drule_tac t = \"type_repr _\" in sym)\n apply clarsimp\n apply (thin_tac \"_ \\ _ = {}\")+\n apply (thin_tac \"_ \\ _\")+\n apply (thin_tac \"_, _ \\ _ :u _ \\_, _\\\")+\n apply (cut_tac state_rel = state_rel and \\ = \\ and s = s and \\'' = \\'' in \n crepeat_corres_base[OF \\len valrel _ _ \\def \\fdef bang\\o _ \\'matchesu determ _ fstoptype\n fsteptype _ _ valrela valrelc a1C_a1U _ _ _ cfundef]; simp?)\n using \\i apply simp\n using \\name apply simp\n using \\''name apply simp\n using d0corres apply simp\n using d1corres apply simp\n using a1C_o1U apply simp\n using o1C_o1U apply simp\n using o1C_a1U apply simp\n apply (clarsimp simp: corres_def)\n done\n\nlemma crepeat_corres_rel_leq:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and leq: \"rel_leq \\' \\''\"\n and determ: \"determ \\''\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and d0corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and valrela: \"\\x x'. val_rel x (x' :: 'a) \\\n \\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x')\"\n and valrelc: \"\\x x'. val_rel x (x' :: 'c) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (clarsimp simp: corres_def)\n apply (cut_tac state_rel = state_rel and \\ = \\ and s = s and \\'' = \\'' in \n crepeat_corres[OF \\len valrel _ _ \\def \\fdef bang\\o _ rel_leq_matchesuD[OF leq]\n determ_rel_leqD[OF leq determ] \\i fstoptype fsteptype _ _ valrela\n valrelc a1C_a1U _ _ _ cfundef]; simp?)\n using \\i apply simp\n using \\name apply simp\n using \\''name apply simp\n using d0corres apply simp\n using d1corres apply simp\n using a1C_o1U apply simp\n using o1C_o1U apply simp\n using o1C_a1U apply simp\n apply (clarsimp simp: corres_def)\n done\n\nlemma crepeat_corres_bang:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun \\f (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\a: \"bang \\a = \\a\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and leq: \"rel_leq \\' \\''\"\n and determ: \"determ \\''\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and d0corres: \"\\x x' \\ s. val_rel x (x' :: ('c :: cogent_C_val)) \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and valrela: \"\\x x'. val_rel x (x' :: 'a) \\\n \\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x')\"\n and valrelc: \"\\x x'. val_rel x (x' :: 'c) \\\n \\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x')\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (rule_tac state_rel = state_rel and \\ = \\ and s = s in \n crepeat_corres_rel_leq[OF \\len valrel _ _ _ \\fdef bang\\o _ leq\n determ \\i _ fsteptype _ _ valrela\n valrelc a1C_a1U _ _ _ cfundef]; simp?)\n using \\i apply simp\n using \\name \\def \\fdef bang\\a bang\\o apply simp\n using \\''name apply simp\n using \\fdef bang\\a bang\\o fstoptype apply simp\n using d0corres apply simp\n using d1corres apply simp\n using a1C_o1U apply simp\n using o1C_o1U apply simp\n using o1C_a1U apply simp\n done\n\nlemmas crepeat_corres_bang_fun_fun = crepeat_corres_bang\n [where fstop = \"UFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_bang_fun_afun = crepeat_corres_bang\n [where fstop = \"UFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_absfun]\nlemmas crepeat_corres_bang_afun_fun = crepeat_corres_bang\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_bang_afun_afun = crepeat_corres_bang\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_absfun]\n\nlemmas crepeat_corres_fun_fun = crepeat_corres_rel_leq\n [where fstop = \"UFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_fun_afun = crepeat_corres_rel_leq\n [where fstop = \"UFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_absfun]\nlemmas crepeat_corres_afun_fun = crepeat_corres_rel_leq\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_afun_afun = crepeat_corres_rel_leq\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_absfun]\n\n\nsection \"Alternate corres rules\"\n\nlemma crepeat_corres_base_all:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\i: \"\\ ! i = URecord [(UPrim (LU64 n), RPrim (Num U64)), (fstop, RFun), (fstep, RFun), (acc, type_repr \\a), (obsv, type_repr \\o)] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrela: \"\\x (x' :: ('a :: cogent_C_val)). val_rel x x' =\n (\\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None\\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x'))\"\n and valrelc: \"\\x (x' :: ('c :: cogent_C_val)). val_rel x x' =\n (\\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x'))\"\n and d0corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (rule crepeat_corres_base[where o1C = o1C, \n OF \\len valrel _ _ \\def \\fdef bang\\o _ \\'matchesu determ \\i fstoptype fsteptype, rotated -1, OF cfundef];\n (simp add: \\i \\name \\''name valrela valrelc a1C_a1U a1C_o1U o1C_o1U o1C_a1U d0corres[simplified] d1corres[simplified])?)\n done\n\nlemma crepeat_corres_all:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and \\'matchesu: \"\\' matches-u \\'\"\n and determ: \"determ \\'\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrela: \"\\x (x' :: ('a :: cogent_C_val)). val_rel x x' =\n (\\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x'))\"\n and valrelc: \"\\x (x' :: ('c :: cogent_C_val)). val_rel x x' =\n (\\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x'))\"\n and d0corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (rule crepeat_corres[where o1C = o1C, \n OF \\len valrel _ _ \\def \\fdef bang\\o _ \\'matchesu determ \\i fstoptype fsteptype, rotated -1, OF cfundef];\n (simp add: \\i \\name \\''name valrela valrelc a1C_a1U a1C_o1U o1C_o1U o1C_a1U d0corres[simplified] d1corres[simplified])?)\n done\n\nlemma crepeat_corres_rel_leq_all:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (bang \\f) (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and leq: \"rel_leq \\' \\''\"\n and determ: \"determ \\''\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some (bang \\f)] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrela: \"\\x (x' :: ('a :: cogent_C_val)). val_rel x x' =\n (\\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x'))\"\n and valrelc: \"\\x (x' :: ('c :: cogent_C_val)). val_rel x x' =\n (\\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x'))\"\n and d0corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (rule crepeat_corres_rel_leq[where o1C = o1C, \n OF \\len valrel _ _ \\def \\fdef bang\\o _ leq determ \\i fstoptype fsteptype, rotated -1, OF cfundef];\n (simp add: \\i \\name \\''name valrela valrelc a1C_a1U a1C_o1U o1C_o1U o1C_a1U d0corres[simplified] d1corres[simplified])?)\n done\n\nlemma crepeat_corres_bang_all:\n assumes \\len: \"i < length \\\"\n and valrel: \"val_rel (\\ ! i) (v' :: ('a :: cogent_C_val))\"\n and \\i: \"\\ ! i = Some (fst (snd (snd (snd (\\' name)))))\"\n and \\name: \"\\' name = (0, [], {}, \\, \\a)\"\n and \\def: \"\\ = TRecord [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun \\f (TPrim Bool), Present),\n (''step'', TFun \\f \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and \\fdef: \"\\f = TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed\"\n and bang\\a: \"bang \\a = \\a\"\n and bang\\o: \"bang \\o = \\o\"\n and \\''name: \"\\'' name = urepeat \\' \\' \\a \\o\"\n and leq: \"rel_leq \\' \\''\"\n and determ: \"determ \\''\"\n and \\i: \"\\n acc obsv a b. \\ ! i = URecord [n, (fstop, a), (fstep, b), acc, obsv] None\"\n and fstoptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstop) (Var 0) : TPrim Bool\"\n and fsteptype: \"\\', 0, [], {}, [Some \\f] \\ App (uvalfun_to_expr fstep) (Var 0) : \\a\"\n and valrela: \"\\x (x' :: ('a :: cogent_C_val)). val_rel x x' =\n (\\n f g acc obsv. x = URecord [n, f, g, acc, obsv] None \\\n val_rel (fst n) (nC x') \\ val_rel (fst f) (stopC x') \\\n val_rel (fst g) (stepC x') \\ val_rel (fst acc) (a0C x') \\\n val_rel (fst obsv) (o0C x'))\"\n and valrelc: \"\\x (x' :: ('c :: cogent_C_val)). val_rel x x' =\n (\\acc obsv. x = URecord [acc, obsv] None \\ val_rel (fst acc) (a1C x') \\\n val_rel (fst obsv) (o1C x'))\"\n and d0corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstop) (Var 0))\n (do ret <- d0 (stopC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some (bang \\f)] \\ s\"\n and d1corres: \"\\x x' \\ s. val_rel x x' \\\n corres state_rel (App (uvalfun_to_expr fstep) (Var 0))\n (do ret <- d1 (stepC v') x'; gets (\\s. ret) od)\n \\' [x] \\' [option.Some \\f] \\ s\"\n and a1C_a1U: \"\\x y. a1C (a1U (\\_. y) x) = y\"\n and a1C_o1U: \"\\x y. a1C (o1U y x) = a1C x\"\n and o1C_o1U: \"\\x y. o1C (o1U (\\_. y) x) = y\"\n and o1C_a1U: \"\\x y. o1C (a1U y x) = o1C x\"\n and cfundef: \"cfun = crepeat nC stopC stepC a0C o0C a1C a1U o1U d0 d1\"\nshows\n \"corres state_rel (App (AFun name [] []) (Var i))\n (do x <- cfun v'; gets (\\s. x) od)\n \\'' \\ \\' \\ \\ s\"\n apply (rule crepeat_corres_bang[where o1C = o1C, \n OF \\len valrel _ _ \\def \\fdef bang\\a bang\\o _ leq determ \\i fstoptype fsteptype, rotated -1, OF cfundef];\n (simp add: \\i \\name \\''name valrela valrelc a1C_a1U a1C_o1U o1C_o1U o1C_a1U d0corres[simplified] d1corres[simplified])?)\n done\n\nlemmas crepeat_corres_bang_fun_funall = crepeat_corres_bang_all\n [where fstop = \"UFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_bang_fun_afun_all = crepeat_corres_bang_all\n [where fstop = \"UFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_absfun]\nlemmas crepeat_corres_bang_afun_fun_all = crepeat_corres_bang_all\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_bang_afun_afun_all = crepeat_corres_bang_all\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_absfun]\n\nlemmas crepeat_corres_fun_fun_all = crepeat_corres_rel_leq_all\n [where fstop = \"UFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_fun_afun_all = crepeat_corres_rel_leq_all\n [where fstop = \"UFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_fun typing_mono_app_cogent_absfun]\nlemmas crepeat_corres_afun_fun_all = crepeat_corres_rel_leq_all\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_fun]\nlemmas crepeat_corres_afun_afun_all = crepeat_corres_rel_leq_all\n [where fstop = \"UAFunction _ _ _\" and fstep = \"UAFunction _ _ _\", simplified,\n OF _ _ _ _ _ _ _ _ _ _ _ typing_mono_app_cogent_absfun typing_mono_app_cogent_absfun]\n\nend (* of context *)\n\nend\n", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/RepeatCorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.38491214448393346, "lm_q1q2_score": 0.19395960471703505}} {"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory KBPsAuto\nimports\n Extra\n KBPs\nbegin\n(*>*)\n\nsection\\Automata Synthesis\\\n\ntext\\\n\n\\label{sec:kbps-automata-synthesis}\n\nOur attention now shifts to showing how we can synthesise standard\nautomata that \\emph{implement} a JKBP under certain conditions. We\nproceed by defining \\emph{incremental views} following\n\\<^cite>\\\"Ron:1996\"\\, which provide the interface between the system and\nthese automata. The algorithm itself is presented in\n\\S\\ref{sec:kbps-alg}.\n\n\\\n\nsubsection\\Incremental views\\\n\ntext\\\n\n\\label{sec:kbps-environments}\n\nIntuitively an agent instantaneously observes the system state, and so\nmust maintain her view of the system \\emph{incrementally}: her new\nview must be a function of her current view and some new\nobservation. We allow this observation to be an arbitrary projection\n@{term \"envObs a\"} of the system state for each agent @{term \"a\"}:\n\n\\\n\nlocale Environment =\n PreEnvironment jkbp envInit envAction envTrans envVal\n for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n and envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n+ fixes envObs :: \"'a \\ 's \\ 'obs\"\n\ntext\\\n\nAn incremental view therefore consists of two functions with these\ntypes:\n\n\\\n\ntype_synonym ('a, 'obs, 'tv) InitialIncrJointView = \"'a \\ 'obs \\ 'tv\"\ntype_synonym ('a, 'obs, 'tv) IncrJointView = \"'a \\ 'obs \\ 'tv \\ 'tv\"\n\ntext\\\n\nThese functions are required to commute with their corresponding\ntrace-based joint view in the obvious way:\n\n\\\n\nlocale IncrEnvironment =\n Environment jkbp envInit envAction envTrans envVal envObs\n+ PreEnvironmentJView jkbp envInit envAction envTrans envVal jview\n for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n and envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n and jview :: \"('a, 's, 'tv) JointView\"\n and envObs :: \"'a \\ 's \\ 'obs\"\n+ fixes jviewInit :: \"('a, 'obs, 'tv) InitialIncrJointView\"\n fixes jviewIncr :: \"('a, 'obs, 'tv) IncrJointView\"\n assumes jviewInit: \"\\a s. jviewInit a (envObs a s) = jview a (tInit s)\"\n assumes jviewIncr: \"\\a t s. jview a (t \\ s)\n = jviewIncr a (envObs a s) (jview a t)\"\n\ntext\\\n\nArmed with these definitions, the following sections show that there\nare automata that implement a JKBP in a given environment.\n\n\\\n\nsubsection\\Automata\\\n\ntext\\\n\nOur implementations of JKBPs take the form of deterministic Moore\nautomata, where transitions are labelled by observation and states\nwith the action to be performed. We will use the term \\emph{protocols}\ninterchangeably with automata, following the KBP literature, and adopt\n\\emph{joint protocols} for the assignment of one such to each agent:\n\n\\\n\nrecord ('obs, 'aAct, 'ps) Protocol =\n pInit :: \"'obs \\ 'ps\"\n pTrans :: \"'obs \\ 'ps \\ 'ps\"\n pAct :: \"'ps \\ 'aAct list\"\n\ntype_synonym ('a, 'obs, 'aAct, 'ps) JointProtocol\n = \"'a \\ ('obs, 'aAct, 'ps) Protocol\"\n\ncontext IncrEnvironment\nbegin\n\ntext\\\n\nTo ease composition with the system we adopt the function @{term\n\"pInit\"} which maps the initial observation to an initial automaton\nstate.\n\n\\<^citet>\\\"Ron:1996\"\\ shows that even non-deterministic JKBPs can be\nimplemented with deterministic transition functions; intuitively all\nrelevant uncertainty the agent has about the system must be encoded\ninto each automaton state, so there is no benefit to doing this\nnon-deterministically. In contrast we model the non-deterministic\nchoice of action by making @{term \"pAct\"} a relation.\n\nRunning a protocol on a trace is entirely standard, as is running a\njoint protocol, and determining their actions:\n\n\\\n\nfun runJP :: \"('a, 'obs, 'aAct, 'ps) JointProtocol\n \\ 's Trace \\ 'a \\ 'ps\"\nwhere\n \"runJP jp (tInit s) a = pInit (jp a) (envObs a s)\"\n| \"runJP jp (t \\ s) a = pTrans (jp a) (envObs a s) (runJP jp t a)\"\n\nabbreviation actJP :: \"('a, 'obs, 'aAct, 'ps) JointProtocol\n \\ 's Trace \\ 'a \\ 'aAct list\" where\n \"actJP jp \\ \\t a. pAct (jp a) (runJP jp t a)\"\n\ntext \\\n\nSimilarly to \\S\\ref{sec:kbps-canonical-kripke} we will reason about\nthe set of traces generated by a joint protocol in a fixed\nenvironment:\n\n\\\n\ninductive_set\n jpTraces :: \"('a, 'obs, 'aAct, 'ps) JointProtocol \\ 's Trace set\"\n for jp :: \"('a, 'obs, 'aAct, 'ps) JointProtocol\"\nwhere\n \"s \\ set envInit \\ tInit s \\ jpTraces jp\"\n| \"\\ t \\ jpTraces jp; eact \\ set (envAction (tLast t));\n \\a. aact a \\ set (actJP jp t a); s = envTrans eact aact (tLast t) \\\n \\ t \\ s \\ jpTraces jp\"\n(*<*)\n\ndeclare jpTraces.intros[intro]\n\nlemma jpTraces_init_inv[dest]:\n \"tInit s \\ jpTraces jp \\ s \\ set envInit\"\n by (cases rule: jpTraces.cases) auto\n\nlemma jpTraces_step_inv[dest]:\n \"t \\ s \\ jpTraces jp\n \\ t \\ jpTraces jp\n \\ (\\eact \\ set (envAction (tLast t)).\n (\\aact. (\\a. aact a \\ set (actJP jp t a))\n \\ s = envTrans eact aact (tLast t)))\"\n by (cases rule: jpTraces.cases) auto\n\nlemma jpTraces_init_length_inv:\n \"t \\ jpTraces jp \\ (tLength t = 0) \\ (\\s. s \\ set envInit \\ t = tInit s)\"\n by (induct t) (auto elim: jpTraces.cases)\n\nlemma jpTraces_step_length_inv_aux:\n \"t \\ { t \\ jpTraces jp . tLength t = Suc n }\n \\ \\t' s. t = t' \\ s\n \\ t' \\ jpTraces jp\n \\ tLength t' = n\n \\ (\\eact \\ set (envAction (tLast t')).\n (\\aact. (\\a. aact a \\ set (actJP jp t' a))\n \\ s = envTrans eact aact (tLast t')))\"\n by (induct t arbitrary: n) auto\n\nlemma jpTraces_step_length_inv:\n \"{ t \\ jpTraces jp . tLength t = Suc n }\n = { t \\ s |eact aact t s. t \\ { t \\ jpTraces jp . tLength t = n }\n \\ eact \\ set (envAction (tLast t))\n \\ (\\a. aact a \\ set (actJP jp t a))\n \\ s = envTrans eact aact (tLast t) }\"\n apply (rule set_eqI)\n apply rule\n apply (drule jpTraces_step_length_inv_aux)\n apply auto\n done\n(*>*)\n\nend (* context IncrEnvironment *)\n\nsubsection\\The Implementation Relation\\\n\ntext\\\n\n\\label{sec:kbps-implementation}\n\nWith this machinery in hand, we now relate automata with JKBPs. We say\na joint protocol @{term \"jp\"} \\emph{implements} a JKBP when they\nperform the same actions on the canonical of traces. Note that the\nbehaviour of @{term \"jp\"} on other traces is arbitrary.\n\n\\\n\ncontext IncrEnvironment\nbegin\n\ndefinition\n implements :: \"('a, 'obs, 'aAct, 'ps) JointProtocol \\ bool\"\nwhere\n \"implements jp \\ (\\t \\ jkbpC. set \\ actJP jp t = set \\ jAction MC t)\"\n\ntext\\\n\nClearly there are environments where the canonical trace set @{term\n\"jkbpC\"} can be generated by actions that differ from those prescribed\nby the JKBP. We can show that the \\emph{implements} relation is a\nstronger requirement than the mere trace-inclusion required by the\n\\emph{represents} relation of \\S\\ref{sec:kbps-canonical-kripke}.\n\n\\\n(*<*)\n\nlemma implementsI[intro]:\n \"(\\t. t \\ jkbpC \\ set \\ actJP jp t = set \\ jAction MC t)\n \\ implements jp\"\n unfolding implements_def by simp\n\nlemma implementsE[elim]:\n assumes impl: \"implements jp\"\n and tC: \"t \\ jkbpC\"\n shows \"set \\ actJP jp t = set \\ jAction MC t\"\n using assms unfolding implements_def by simp\n\nlemma implements_actJP_jAction:\n assumes impl: \"implements jp\"\n and tCn: \"t \\ jkbpCn n\"\n shows \"set (actJP jp t a) = set (jAction (MCn n) t a)\" (is \"?lhs = ?rhs\")\nproof -\n from tCn have tC: \"t \\ jkbpC\" by blast\n hence \"?lhs = (set \\ jAction MC t) a\"\n using implementsE[OF impl, symmetric] by auto\n also have \"... = set (jAction (MCn n) t a)\"\n by (simp add: jkbpC_jkbpCn_jAction_eq[OF tCn])\n finally show ?thesis .\nqed\n\n(*>*)\nlemma implements_represents:\n assumes impl: \"implements jp\"\n shows \"represents (jpTraces jp)\"\n(*<*)\nproof -\n { fix n\n have \"{ t \\ jpTraces jp . tLength t = n }\n = { t \\ jkbpC . tLength t = n }\"\n proof(induct n)\n case 0 thus ?case\n by (auto dest: jpTraces_init_length_inv iff: jkbpC_traces_of_length)\n next\n case (Suc n)\n hence indhyp: \"{t \\ jpTraces jp . tLength t = n} = jkbpCn n\"\n by (simp add: jkbpC_traces_of_length)\n\n have \"{t \\ jpTraces jp. tLength t = Suc n}\n = {t \\ s |eact aact t s. t \\ jkbpCn n\n \\ eact \\ set (envAction (tLast t))\n \\ (\\a. aact a \\ set (actJP jp t a))\n \\ s = envTrans eact aact (tLast t) }\"\n using indhyp by (simp add: jpTraces_step_length_inv)\n also have \"... = jkbpCn (Suc n)\"\n apply (auto iff: Let_def)\n apply (auto iff: implements_actJP_jAction[OF impl, symmetric])\n done\n finally show ?case by (auto iff: jkbpC_traces_of_length)\n qed }\n hence R: \"jpTraces jp = jkbpC\" by auto\n from R jkbpC_represents\n show \"represents (jpTraces jp)\" by simp\nqed\n\nlemma implements_ind_jkbpC:\n assumes acts: \"\\a n t.\n \\ {t \\ jpTraces jp. tLength t = n} = jkbpCn n; t \\ jkbpCn n \\\n \\ actJP jp t a = jAction MC t a\"\n shows \"implements jp\"\nproof -\n let ?T = \"jpTraces jp\"\n\n from acts have acts':\n \"\\n t. \\ {t \\ jpTraces jp. tLength t = n} = jkbpCn n; t \\ jkbpCn n \\\n \\ actJP jp t = jAction (MCn n) t\"\n by (simp only: jkbpC_jkbpCn_jAction_eq)\n\n from acts have acts':\n \"\\n t. \\ {t \\ jpTraces jp. tLength t = n} = jkbpCn n; t \\ jkbpCn n \\\n \\ actJP jp t = jAction (MCn n) t\"\n apply -\n apply (rule ext)\n apply simp\n using jkbpC_jkbpCn_jAction_eq\n apply simp\n done\n\n { fix n\n have \"{ t \\ ?T . tLength t = n } = { t \\ jkbpC . tLength t = n }\"\n proof(induct n)\n case 0 thus ?case\n by (auto dest: jpTraces_init_length_inv iff: jkbpC_traces_of_length)\n next\n case (Suc n)\n hence indhyp: \"{t \\ ?T. tLength t = n} = jkbpCn n\"\n by (simp add: jkbpC_traces_of_length)\n\n have \"{t \\ jpTraces jp. tLength t = Suc n}\n = {t \\ s |eact aact t s. t \\ jkbpCn n\n \\ eact \\ set (envAction (tLast t))\n \\ (\\a. aact a \\ set (actJP jp t a))\n \\ s = envTrans eact aact (tLast t) }\"\n using indhyp by (simp add: jpTraces_step_length_inv)\n also have \"... = jkbpCn (Suc n)\"\n apply (auto iff: Let_def)\n apply (drule acts'[OF indhyp, symmetric])\n apply auto[1]\n apply (drule acts'[OF indhyp, symmetric])\n apply auto[1]\n done\n finally show ?case\n apply (auto iff: jkbpC_traces_of_length)\n done\n qed\n hence \"\\t\\jkbpCn n. actJP jp t = jAction (MCn n) t\"\n apply clarsimp\n apply (rule acts')\n apply (auto iff: jkbpC_traces_of_length)\n done\n hence \"\\t\\jkbpCn n. actJP jp t = jAction MC t\"\n apply clarsimp\n by ( rule sync_jview_jAction_eq[where n=\"n\"]\n , auto iff: jkbpC_traces_of_length)\n }\n thus ?thesis\n unfolding implements_def jkbpC_def\n apply clarsimp\n done\nqed\n\n(*>*)\ntext\\\n\nThe proof is by a straightfoward induction over the lengths of traces\ngenerated by the joint protocol.\n\nOur final piece of technical machinery allows us to refine automata\ndefinitions: we say that two joint protocols are \\emph{behaviourally\nequivalent} if the actions they propose coincide for each canonical\ntrace. The implementation relation is preserved by this relation.\n\n\\\n\ndefinition\n behaviourally_equiv :: \"('a, 'obs, 'aAct, 'ps) JointProtocol\n \\ ('a, 'obs, 'aAct, 'ps') JointProtocol\n \\ bool\"\nwhere\n \"behaviourally_equiv jp jp' \\ \\t \\ jkbpC. set \\ actJP jp t = set \\ actJP jp' t\"\n\n(*<*)\nlemma behaviourally_equivI[intro]:\n \"(\\t. t \\ jkbpC \\ set \\ actJP jp t = set \\ actJP jp' t)\n \\ behaviourally_equiv jp jp'\"\n unfolding behaviourally_equiv_def by simp\n(*>*)\n\nlemma behaviourally_equiv_implements:\n assumes \"behaviourally_equiv jp jp'\"\n shows \"implements jp \\ implements jp'\"\n(*<*)\n using assms unfolding behaviourally_equiv_def implements_def by simp\n(*>*)\ntext\\\\\n\nend (* context IncrEnvironment *)\n\n(* **************************************** *)\n\nsubsection\\Automata using Equivalence Classes\\\n\ntext\\\n\nWe now show that there is an implementation of every JKBP with respect\nto every incremental synchronous view. Intuitively the states of the\nautomaton for agent @{term \"a\"} represent the equivalence classes of\ntraces that @{term \"a\"} considers possible, and the transitions update\nthese sets according to her KBP.\n\n\\\n\ncontext IncrEnvironment\nbegin\n\ndefinition\n mkAutoEC :: \"('a, 'obs, 'aAct, 's Trace set) JointProtocol\"\nwhere\n \"mkAutoEC \\ \\a.\n \\ pInit = \\obs. { t \\ jkbpC . jviewInit a obs = jview a t },\n pTrans = \\obs ps. { t |t t'. t \\ jkbpC \\ t' \\ ps\n \\ jview a t = jviewIncr a obs (jview a t') },\n pAct = \\ps. jAction MC (SOME t. t \\ ps) a \\\"\n\ntext\\\n\nThe function \\SOME\\ is Hilbert's indefinite description\noperator @{term \"\\\"}, used here to choose an arbitrary trace from the\nprotocol state.\n\nThat this automaton maintains the correct equivalence class on a trace\n@{term \"t\"} follows from an easy induction over @{term \"t\"}.\n\n\\\n\nlemma mkAutoEC_ec:\n assumes \"t \\ jkbpC\"\n shows \"runJP mkAutoEC t a = { t' \\ jkbpC . jview a t' = jview a t }\"\n(*<*)\n using assms\n apply (induct t)\n apply (auto simp add: mkAutoEC_def jviewInit)[1]\n apply simp\n apply (subst mkAutoEC_def)\n apply (auto iff: Let_def jviewIncr)\n done\n(*>*)\n\ntext\\\n\nWe can show that the construction yields an implementation by\nappealing to the previous lemma and showing that the @{term \"pAct\"}\nfunctions coincide.\n\n\\\n\nlemma mkAutoEC_implements: \"implements mkAutoEC\"\n(*<*)\n apply (rule implements_ind_jkbpC)\n apply (subst mkAutoEC_def)\n apply simp\n apply (subgoal_tac \"t \\ jkbpC\")\n using mkAutoEC_ec\n apply simp\n apply (rule S5n_jAction_eq)\n apply simp_all\n apply (rule_tac a=t in someI2)\n apply simp_all\n unfolding mkM_def\n apply auto\n done\n(*>*)\n\ntext\\\n\nThis definition leans on the canonical trace set jkbpC, and is indeed\neffective: we can enumerate all canonical traces and are sure to find\none that has the view we expect. Then it is sufficient to consider\nother traces of the same length due to synchrony. We would need to do\nthis computation dynamically, as the automaton will (in general) have\nan infinite state space.\n\n\\\n\nend (* context IncrEnvironment *)\n\n(* **************************************** *)\n\nsubsection\\Simulations\\\n\ntext\\\n\\label{sec:kbps-theory-automata-env-sims}\n\nOur goal now is to reduce the space required by the automaton\nconstructed by @{term \"mkAutoEC\"} by \\emph{simulating} the equivalence\nclasses (\\S\\ref{sec:kripke-theory-simulations}).\n\nThe following locale captures the framework of \\<^citet>\\\"Ron:1996\"\\:\n\n\\\n\nlocale SimIncrEnvironment =\n IncrEnvironment jkbp envInit envAction envTrans envVal jview envObs\n jviewInit jviewIncr\n for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n\n and envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n and jview :: \"('a, 's, 'tv) JointView\"\n and envObs :: \"'a \\ 's \\ 'obs\"\n and jviewInit :: \"('a, 'obs, 'tv) InitialIncrJointView\"\n and jviewIncr :: \"('a, 'obs, 'tv) IncrJointView\"\n+ fixes simf :: \"'s Trace \\ 'ss\"\n fixes simRels :: \"'a \\ 'ss Relation\"\n fixes simVal :: \"'ss \\ 'p \\ bool\"\n assumes simf: \"sim MC (mkKripke (simf ` jkbpC) simRels simVal) simf\"\n\ncontext SimIncrEnvironment\nbegin\n\ntext\\\n\nNote that the back tick \\`\\ is Isabelle/HOL's relational image\noperator. In context it says that @{term \"simf\"} must be a simulation\nfrom @{term \"jkbpC\"} to its image under @{term \"simf\"}.\n\nFirstly we lift our familiar canonical trace sets and Kripke\nstructures through the simulation.\n\n\\\n\nabbreviation jkbpCSn :: \"nat \\ 'ss set\"(*<*)(\"jkbpCS\\<^bsub>_\\<^esub>\")(*>*) where\n \"jkbpCS\\<^bsub>n\\<^esub> \\ simf ` jkbpC\\<^bsub>n\\<^esub>\"\n\nabbreviation jkbpCS :: \"'ss set\" where\n \"jkbpCS \\ simf ` jkbpC\"\n\nabbreviation MCSn :: \"nat \\ ('a, 'p, 'ss) KripkeStructure\"(*<*)(\"MCS\\<^bsub>_\\<^esub>\")(*>*) where\n \"MCS\\<^bsub>n\\<^esub> \\ mkKripke jkbpCS\\<^bsub>n\\<^esub> simRels simVal\"\n\nabbreviation MCS :: \"('a, 'p, 'ss) KripkeStructure\" where\n \"MCS \\ mkKripke jkbpCS simRels simVal\"\n(*<*)\nlemma jkbpCSn_jkbpCS_subset:\n \"jkbpCSn n \\ jkbpCS\"\n by (rule image_mono[OF jkbpCn_jkbpC_subset])\n\n(*>*)\ntext\\\n\nWe will be often be concerned with the equivalence class of traces\ngenerated by agent @{term \"a\"}'s view:\n\n\\\n\nabbreviation sim_equiv_class :: \"'a \\ 's Trace \\ 'ss set\" where\n \"sim_equiv_class a t \\ simf ` { t' \\ jkbpC . jview a t' = jview a t }\"\n\nabbreviation jkbpSEC :: \"'ss set set\" where\n \"jkbpSEC \\ \\a. sim_equiv_class a ` jkbpC\"\n\ntext\\\n\nWith some effort we can show that the temporal slice of the simulated\nstructure is adequate for determining the actions of the JKBP. The\nproof is tedious and routine, exploiting the sub-model property\n(\\S\\ref{sec:generated_models}).\n\n\\\n(*<*)\n\nlemma sim_submodel_aux:\n assumes s: \"s \\ worlds (MCSn n)\"\n shows \"gen_model MCS s = gen_model (MCSn n) s\"\nproof(rule gen_model_subset[where T=\"jkbpCSn n\"])\n from s show \"s \\ worlds MCS\"\n by (simp add: subsetD[OF jkbpCSn_jkbpCS_subset])\n from s show \"s \\ worlds (MCSn n)\" by assumption\nnext\n fix a\n show \"relations MCS a \\ jkbpCSn n \\ jkbpCSn n\n = relations (MCSn n) a \\ jkbpCSn n \\ jkbpCSn n\"\n by (simp add: Int_ac Int_absorb1\n relation_mono[OF jkbpCSn_jkbpCS_subset jkbpCSn_jkbpCS_subset])\nnext\n from s\n show \"(\\a. relations (MCSn n) a)\\<^sup>* `` {s} \\ jkbpCSn n\"\n apply (clarsimp simp del: mkKripke_simps)\n apply (erule kripke_rels_trc_worlds)\n apply auto\n done\nnext\n from s obtain t\n where st: \"s = simf t\"\n and tCn: \"t \\ jkbpCn n\"\n by fastforce\n from tCn have tC: \"t \\ jkbpC\" by blast\n { fix t'\n assume tt': \"(t, t') \\ (\\a. relations MC a)\\<^sup>*\"\n from tC tt' have t'C: \"t' \\ jkbpC\"\n by - (erule kripke_rels_trc_worlds, simp_all)\n from tCn tt' have t'Len: \"tLength t' = n\"\n by (auto dest: sync_tLength_eq_trc[where as=UNIV])\n from t'C t'Len have \"t' \\ jkbpCn n\"\n by - (erule jkbpC_tLength_inv) }\n hence \"(\\a. relations MC a)\\<^sup>* `` {t} \\ jkbpCn n\"\n by clarsimp\n hence \"simf ` ((\\a. relations MC a)\\<^sup>* `` {t}) \\ jkbpCSn n\"\n by (rule image_mono)\n with st tC\n show \"(\\a. relations MCS a)\\<^sup>* `` {s} \\ jkbpCSn n\"\n using sim_trc_commute[OF _ simf, where t=t]\n by simp\nqed simp_all\n(*>*)\n\nlemma jkbpC_jkbpCSn_jAction_eq:\n assumes tCn: \"t \\ jkbpCn n\"\n shows \"jAction MC t = jAction (MCSn n) (simf t)\"\n(*<*) (is \"?lhs = ?rhs\")\nproof -\n have \"?lhs = jAction MCS (simf t)\"\n by (simp add: simulation_jAction_eq simf jkbpCn_jkbpC_inc[OF tCn])\n also have \"... = ?rhs\"\n using tCn\n by - ( rule gen_model_jAction_eq[OF sim_submodel_aux, where w=\"simf t\"]\n , auto intro: gen_model_world_refl )\n finally show ?thesis .\nqed\n(*>*)\n\nend (* context SimIncrEnvironment *)\n\ntext\\\n\nIt can be shown that a suitable simulation into a finite structure is\nadequate to establish the existence of finite-state implementations\n\\<^citep>\\\\Theorem~2\\ in \"Ron:1996\"\\: essentially we apply the simulation to\nthe states of @{term \"mkAutoEC\"}. However this result does not make it\nclear how the transition function can be incrementally\nconstructed. One approach is to maintain @{term \"jkbpC\"} while\nextending the automaton, which is quite space inefficient.\n\nIntuitively we would like to compute the possible @{term\n\"sim_equiv_class\"} successors of a given @{term \"sim_equiv_class\"}\nwithout reference to @{term \"jkbpC\"}, and this should be possible as\nthe reachable simulated worlds must contain enough information to\ndifferentiate themselves from every other simulated world (reachable\nor not) that represents a trace that is observationally distinct to\ntheir own.\n\nThis leads us to asking for some extra functionality of our\nsimulation, which we do in the following section.\n\n\\\n\nsubsection\\Automata using simulations\\\n\ntext_raw\\\n\\label{sec:kbps-automata-synthesis-alg}\n\n\\begin{figure}[hp]\n\\begin{isabellebody}%\n\\\nlocale AlgSimIncrEnvironment =\n SimIncrEnvironment jkbp envInit envAction envTrans envVal\n jview envObs jviewInit jviewIncr simf simRels simVal\n for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n and envInit :: \"'s list\"\n and envAction :: \"'s \\ 'eAct list\"\n and envTrans :: \"'eAct \\ ('a \\ 'aAct) \\ 's \\ 's\"\n and envVal :: \"'s \\ 'p \\ bool\"\n\n and jview :: \"('a, 's, 'tv) JointView\"\n and envObs :: \"'a \\ 's \\ 'obs\"\n and jviewInit :: \"('a, 'obs, 'tv) InitialIncrJointView\"\n and jviewIncr :: \"('a, 'obs, 'tv) IncrJointView\"\n\n and simf :: \"'s Trace \\ 'ss\"\n and simRels :: \"'a \\ 'ss Relation\"\n and simVal :: \"'ss \\ 'p \\ bool\"\n\n+ fixes simAbs :: \"'rep \\ 'ss set\"\n\n and simObs :: \"'a \\ 'rep \\ 'obs\"\n and simInit :: \"'a \\ 'obs \\ 'rep\"\n and simTrans :: \"'a \\ 'rep \\ 'rep list\"\n and simAction :: \"'a \\ 'rep \\ 'aAct list\"\n\n assumes simInit:\n \"\\a iobs. iobs \\ envObs a ` set envInit\n \\ simAbs (simInit a iobs)\n = simf ` { t' \\ jkbpC. jview a t' = jviewInit a iobs }\"\n and simObs:\n \"\\a ec t. t \\ jkbpC \\ simAbs ec = sim_equiv_class a t\n \\ simObs a ec = envObs a (tLast t)\"\n and simAction:\n \"\\a ec t. t \\ jkbpC \\ simAbs ec = sim_equiv_class a t\n \\ set (simAction a ec) = set (jAction MC t a)\"\n and simTrans:\n \"\\a ec t. t \\ jkbpC \\ simAbs ec = sim_equiv_class a t\n \\ simAbs ` set (simTrans a ec)\n = { sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ jkbpC \\ jview a t' = jview a t }\"\ntext_raw\\\n\\end{isabellebody}%\n\\begin{isamarkuptext}%\n\\caption{The \\SimEnvironment\\ locale extends the @{term\n\"Environment\"} locale with simulation and algorithmic operations. The\nbacktick \\`\\ is Isabelle/HOL's image-of-a-set-under-a-function\noperator.}\n\\label{fig:kbps-theory-auto-SimEnvironment}\n\\end{isamarkuptext}%\n\\end{figure}\n\\\n\ntext\\\n\nThe locale in Figure~\\ref{fig:kbps-theory-auto-SimEnvironment} captures\nour extra requirements of a simulation.\n\nFirstly we relate the concrete representation @{typ \"'rep\"} of\nequivalence classes under simulation to differ from the abstract\nrepresentation @{typ \"'ss set\"} using the abstraction function @{term\n\"simAbs\"} \\<^citep>\\\"EdR:cup98\"\\; there is no one-size-fits-all concrete\nrepresentation, as we will see.\n\nSecondly we ask for a function @{term \"simInit a iobs\"} that\nfaithfully generates a representation of the equivalence class of\nsimulated initial states that are possible for agent @{term \"a\"} given\nthe valid initial observation @{term \"iobs\"}.\n\nThirdly the @{term \"simObs\"} function allows us to partition the\nresults of @{term \"simTrans\"} according to the recurrent observation\nthat agent @{term \"a\"} makes of the equivalence class.\n\nFourthly, the function @{term \"simAction\"} computes a list of actions\nenabled by the JKBP on a state that concretely represents a canonical\nequivalence class.\n\nFinally we expect to compute the list of represented @{term\n\"sim_equiv_class\"} successors of a given @{term \"sim_equiv_class\"}\nusing @{term \"simTrans\"}.\n\nNote that these definitions are stated relative to the environment and\nthe JKBP, allowing us to treat specialised cases such as broadcast\n(\\S\\ref{sec:kbps-theory-spr-deterministic-protocols} and\n\\S\\ref{sec:kbps-theory-spr-non-deterministic-protocols}).\n\nWith these functions in hand, we can define our desired automaton:\n\n\\\n\ndefinition (in AlgSimIncrEnvironment)\n mkAutoSim :: \"('a, 'obs, 'aAct, 'rep) JointProtocol\"\nwhere\n \"mkAutoSim \\ \\a.\n \\ pInit = simInit a,\n pTrans = \\obs ec. (SOME ec'. ec' \\ set (simTrans a ec)\n \\ simObs a ec' = obs),\n pAct = simAction a \\\"\n(*<*)\n\ncontext AlgSimIncrEnvironment\nbegin\n\nlemma jAction_simAbs_cong:\n assumes tC: \"t \\ jkbpC\"\n and ec: \"simAbs ec = sim_equiv_class a t\"\n and ec': \"simAbs ec = simAbs ec'\"\n shows \"set (simAction a ec) = set (simAction a ec')\"\n using assms simAction[rule_format, where a=a and t=t] tC by simp\n\nlemma simTrans_simAbs_cong:\n assumes tC: \"t \\ jkbpC\"\n and ec: \"simAbs ec = sim_equiv_class a t\"\n and ec': \"simAbs ec = simAbs ec'\"\n shows \"simAbs ` set (simTrans a ec) = simAbs ` set (simTrans a ec')\"\n using assms simTrans[rule_format, where a=a and t=t] tC by simp\n\nlemma mkAutoSim_simps[simp]:\n \"pInit (mkAutoSim a) = simInit a\"\n \"pTrans (mkAutoSim a) = (\\obs ec. (SOME ec'. ec' \\ set (simTrans a ec) \\ simObs a ec' = obs))\"\n \"pAct (mkAutoSim a) = simAction a\"\n unfolding mkAutoSim_def by simp_all\n\nend (* context AlgSimIncrEnvironment *)\n\n(*>*)\ntext\\\n\nThe automaton faithfully constructs the simulated equivalence class of\nthe given trace:\n\n\\\n\nlemma (in AlgSimIncrEnvironment) mkAutoSim_ec:\n assumes tC: \"t \\ jkbpC\"\n shows \"simAbs (runJP mkAutoSim t a) = sim_equiv_class a t\"\n(*<*)\nusing tC\nproof(induct t)\n case (tInit s) thus ?case\n by (simp add: jviewInit[rule_format, symmetric] simInit)\nnext\n case (tStep t s)\n hence tC: \"t \\ jkbpC\" by blast\n\n from tC tStep\n have F: \"simAbs ` set (simTrans a (runJP mkAutoSim t a))\n = { sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ jkbpC \\ jview a t' = jview a t}\"\n using simTrans[rule_format, where a=a and t=t and ec=\"runJP mkAutoSim t a\"]\n apply clarsimp\n done\n\n from tStep\n have G: \"sim_equiv_class a (t \\ s)\n \\ { sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ jkbpC \\ jview a t' = jview a t}\"\n by auto\n\n from F G\n have H: \"sim_equiv_class a (t \\ s) \\ simAbs ` set (simTrans a (runJP mkAutoSim t a))\"\n by simp\n\n then obtain r\n where R: \"r \\ set (simTrans a (runJP mkAutoSim t a))\"\n and S: \"simAbs r = sim_equiv_class a (t \\ s)\"\n by auto\n\n show ?case\n proof(simp, rule someI2)\n from R S tStep tC\n show \"r \\ set (simTrans a (runJP mkAutoSim t a)) \\ simObs a r = envObs a s\"\n using simObs[rule_format, where t=\"t\\s\" and a=a]\n apply clarsimp\n done\n next\n fix x assume x: \"x \\ set (simTrans a (runJP mkAutoSim t a)) \\ simObs a x = envObs a s\"\n\n from x\n have A: \"simObs a x = envObs a s\" by simp\n\n from x\n have \"simAbs x \\ simAbs ` set (simTrans a (runJP mkAutoSim t a))\" by simp\n with tStep tC\n have \"simAbs x \\ { sim_equiv_class a (t' \\ s)\n |t' s. t' \\ s \\ jkbpC \\ jview a t' = jview a t}\"\n using simTrans[rule_format, where a=a and t=t] by simp\n then obtain t' s'\n where X: \"simAbs x = sim_equiv_class a (t' \\ s')\"\n and Y: \"t' \\ s' \\ jkbpC\"\n and Z: \"jview a t' = jview a t\"\n by auto\n\n from A X Y Z\n show \"simAbs x = sim_equiv_class a (t \\ s)\"\n using simObs[rule_format, where a=a and t=\"t'\\s'\", symmetric]\n by (simp add: jviewIncr)\n qed\nqed\n\n(*>*)\ntext\\\n\nThis follows from a simple induction on @{term \"t\"}.\n\nThe following is a version of the Theorem 2 of \\<^citet>\\\"Ron:1996\"\\.\n\n\\\n\ntheorem (in AlgSimIncrEnvironment) mkAutoSim_implements:\n \"implements mkAutoSim\"\n(*<*)\n apply rule\n apply rule\n apply (auto dest: jkbpCn_jkbpC_inc iff: mkAutoSim_ec simAction)\n done\n(*>*)\n\ntext\\\n\nThe reader may care to contrast these structures with the\n\\emph{progression structures} of \\<^citet>\\\"Ron:1997\"\\, where states\ncontain entire Kripke structures, and expanding the automaton is\nalternated with bisimulation reduction to ensure termination when a\nfinite-state implementation exists (see \\S\\ref{sec:kbps-alg-auto-min})\nWe also use simulations in Appendix~\\ref{ch:complexity} to show the\ncomplexity of some related model checking problems.\n\nWe now review a simple \\emph{depth-first search} (DFS) theory, and an\nabstraction of finite maps, before presenting the algorithm for KBP\nsynthesis.\n\n\\FloatBarrier\n\n\\\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/KBPs/KBPsAuto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.38491214448393346, "lm_q1q2_score": 0.19395960471703505}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Schedule_DR\nimports Finalise_DR\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(* getActiveTCBs returns a subset of CapDL's all_active_tcbs. *)\nlemma getActiveTCBs_subset:\n \"\\ getActiveTCB x s' = Some y; invs s'; valid_etcbs s' \\ \\\n x \\ all_active_tcbs (transform s')\"\n supply option.case_cong[cong]\n apply (clarsimp simp: all_active_tcbs_def getActiveTCB_def)\n apply (clarsimp simp: transform_def transform_objects_def map_add_def domIff)\n apply (clarsimp dest!: get_tcb_SomeD split: option.splits if_split_asm)\n apply (rule context_conjI)\n apply (clarsimp simp: restrict_map_def)\n apply (frule invs_valid_idle)\n apply (clarsimp simp: valid_idle_def pred_tcb_def2 get_tcb_def)\n apply (clarsimp simp: restrict_map_def split: if_split_asm)\n apply (clarsimp simp: transform_object_def transform_tcb_def)\n apply (clarsimp simp: infer_tcb_pending_op_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (case_tac \"tcb_state y\", auto simp: tcb_pending_op_slot_def tcb_boundntfn_slot_def)\n done\n\n\n(* allActiveTCBs should be a subset of those allowed in CapDL. *)\ndefinition\n allActiveTCBs_relation :: \"cdl_object_id set \\ word32 set \\ bool\"\nwhere\n \"allActiveTCBs_relation a b \\ b \\ a\"\n\n(* allActiveTCBs correspond *)\nlemma allActiveTCBs_corres:\n \"dcorres allActiveTCBs_relation \\ (invs and valid_etcbs) (gets all_active_tcbs) allActiveTCBs\"\n apply (clarsimp simp: allActiveTCBs_def gets_def)\n apply (clarsimp simp: corres_underlying_def)\n apply (clarsimp simp: exec_get split_def return_def)\n apply (clarsimp simp: allActiveTCBs_relation_def)\n apply (auto simp: getActiveTCBs_subset)\n done\n\ncrunch idle_thread[wp]: switch_to_idle_thread \"\\s. P (idle_thread s)\"\n\nlemma dcorres_arch_switch_to_idle_thread_return: \"dcorres dc \\ \\ (return ()) arch_switch_to_idle_thread\"\n apply (clarsimp simp: arch_switch_to_idle_thread_def)\n apply (rule corres_guard_imp)\n apply (rule dcorres_gets_all_param)\n apply (rule dcorres_set_vm_root)\n by simp+\n\nlemma change_current_domain_same: \"\\(=) s\\ change_current_domain \\\\\\r. (=) s\\\"\n apply (clarsimp simp: change_current_domain_def exs_valid_def bind_def return_def gets_def modify_def put_def fst_def snd_def get_def select_def)\n apply (rule_tac x=\"cdl_current_domain s\" in exI)\n apply clarsimp\n done\n\nlemma switch_to_idle_thread_dcorres:\n \"dcorres dc \\ (invs and valid_etcbs) (Schedule_D.switch_to_thread None) switch_to_idle_thread\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def switch_to_idle_thread_def)\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split_noop_rhs)\n apply (rule dcorres_arch_switch_to_idle_thread_return)\n apply (clarsimp simp: corres_underlying_def gets_def modify_def get_def put_def do_machine_op_def select_f_def split_def bind_def in_return)\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply assumption\n apply (wp | simp)+\n done\n\n(* Switching to the idle thread and switching to \"None\" are equivalent. *)\nlemma change_current_domain_and_switch_to_idle_thread_dcorres:\n \"dcorres dc \\ (invs and valid_etcbs)\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n switch_to_idle_thread\"\n including no_pre\n apply (clarsimp simp: Schedule_D.switch_to_thread_def switch_to_idle_thread_def)\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_l)\n apply (rule_tac R=\\ in corres_split_noop_rhs)\n apply (rule dcorres_arch_switch_to_idle_thread_return)\n apply (clarsimp simp: corres_underlying_def gets_def modify_def get_def put_def do_machine_op_def select_f_def split_def bind_def in_return)\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply assumption\n apply (wp change_current_domain_same | simp)+\n done\n\nlemma arch_switch_to_thread_dcorres:\n \"dcorres dc \\ (invs and (\\s. idle_thread s \\ t) and valid_etcbs)\n (return ())\n (arch_switch_to_thread t)\"\n apply (clarsimp simp: arch_switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF dcorres_set_vm_root])\n apply simp\n apply (rule dcorres_machine_op_noop)\n apply (simp add: ARM.clearExMonitor_def, wp)[1]\n apply (wp|simp)+\n done\n\ncrunch idle_thread [wp]: arch_switch_to_thread \"\\s. P (idle_thread s)\"\n (simp: crunch_simps wp: crunch_wps ignore: ARM.clearExMonitor)\n\n(*\n * Setting the current thread.\n *)\nlemma switch_to_thread_corres:\n \"dcorres dc \\ (invs and (\\s. idle_thread s \\ x) and valid_etcbs)\n (Schedule_D.switch_to_thread (Some x)) (Schedule_A.switch_to_thread x)\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def Schedule_A.switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_symb_exec_r)\n apply (rule corres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF arch_switch_to_thread_dcorres])\n apply simp\n apply (rule dcorres_rhs_noop_above[OF tcb_sched_action_dcorres])\n apply (rule corres_modify [where P=\\ and P'=\"\\s. idle_thread s \\ x\"])\n apply (clarsimp simp: transform_def)\n apply (simp add: transform_current_thread_def transform_asid_table_def)\n apply (wp+)[4]\n apply simp\n apply assumption\n apply (clarsimp|wp)+\n done\n\nlemma corrupt_intents_current_thread:\n \"cdl_current_thread (corrupt_intents x p s) = cdl_current_thread s\"\n by (simp add: corrupt_intents_def)\n\ncrunch cdl_cur: corrupt_frame \"\\s. cdl_current_thread s = x\"\n (wp: select_wp simp: corrupt_intents_current_thread)\n\n(* Switching to the active thread has no effect. *)\nlemma switch_to_thread_idempotent_corres:\n \"dcorres dc (\\s. cdl_current_thread s = x) \\ (Schedule_D.switch_to_thread x) (return ())\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def)\n apply (clarsimp simp: modify_def)\n apply (clarsimp simp: corres_underlying_def)\n apply (clarsimp simp: transform_def transform_current_thread_def)\n apply (clarsimp simp: in_return)\n apply (auto simp: in_return get_def put_def split_def bind_def)[1]\n done\n\n(* getActiveTCB on the idle thread always returns None. *)\nlemma getActiveTCB_idle: \"invs s \\ getActiveTCB (idle_thread s) s = None\"\n apply (frule invs_valid_idle)\n apply (clarsimp simp: valid_idle_def getActiveTCB_def)\n apply (clarsimp simp: pred_tcb_at_def get_tcb_def get_obj_def obj_at_def)\n done\n\nlemma switch_to_thread_same_corres:\n \"dcorres dc (\\s. x = y) (invs and (\\s. idle_thread s \\ x) and valid_etcbs)\n (Schedule_D.switch_to_thread (Some y)) (Schedule_A.switch_to_thread x)\"\n supply if_cong[cong]\n apply (clarsimp simp: Schedule_D.switch_to_thread_def\n Schedule_A.switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_symb_exec_r)\n apply (rule corres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF arch_switch_to_thread_dcorres])\n apply simp\n apply (rule dcorres_rhs_noop_above[OF tcb_sched_action_dcorres])\n apply (rule corres_modify [where P'=\"\\s. idle_thread s \\ x\"])\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply (simp add: transform_current_thread_def transform_asid_table_def)\n apply (wp+)[4]\n apply simp\n apply assumption\n apply (clarsimp|wp)+\n done\n\nlemma set_scheduler_action_dcorres:\n \"dcorres dc \\ \\ (return ()) (set_scheduler_action sa)\"\n by (clarsimp simp: corres_underlying_def set_scheduler_action_def modify_def get_def put_def bind_def return_def)\n\nlemma switch_to_thread_None_dcorres_L:\n \"dcorres dc (\\s. cdl_current_thread s = None) \\\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n (return ())\"\n apply (auto simp: Schedule_D.switch_to_thread_def modify_def corres_underlying_def get_def put_def bind_def return_def\n change_current_domain_def gets_def select_def transform_def)\n done\n\n\nlemma switch_to_thread_None_dcorres:\n \"dcorres dc \\ (\\s. cur_thread s = idle_thread s)\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n (return ())\"\n apply (rule_tac Q=\"\\s. cdl_current_thread s = None\" and Q'=\"\\\" in stronger_corres_guard_imp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (clarsimp simp: transform_def transform_current_thread_def)+\n done\n\nlemma schedule_resume_cur_thread_dcorres_L:\n \"\\cur cur_ts. dcorres dc ((\\s. \\t tcb. cdl_current_thread s = Some t \\\n (\\d. s = s \\cdl_current_domain := d\\) \\\n t \\ active_tcbs_in_domain (cdl_current_domain s) s)\n or (\\s. cdl_current_thread s = None)) \\\n Schedule_D.schedule\n (do idle_t \\ gets idle_thread;\n assert (runnable cur_ts \\ cur = idle_t)\n od)\"\n unfolding Schedule_D.schedule_def\n apply (rule corres_either_alternate2)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (clarsimp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule dcorres_symb_exec_r)\n apply (clarsimp simp: assert_def)\n apply (rule conjI, clarsimp)\n apply (fold dc_def)\n apply (rule switch_to_thread_idempotent_corres)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_idempotent_corres)\n apply (clarsimp simp: corres_underlying_def fail_def)\n apply (wp | simp)+\n apply (fastforce simp: select_def gets_def active_tcbs_in_domain_def bind_def return_def domIff\n get_def fst_def modify_def put_def change_current_domain_def)\n apply simp\n apply (rule corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (clarsimp simp: assert_def)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (clarsimp simp: corres_underlying_def fail_def)\n apply (wp | simp | fastforce)+\n done\n\n\nlemma schedule_resume_cur_thread_dcorres:\n \"\\cur cur_ts. dcorres dc \\ (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s \\ invs s \\ scheduler_action s = resume_cur_thread)\n Schedule_D.schedule\n (do idle_t \\ gets idle_thread;\n assert (runnable cur_ts \\ cur = idle_t)\n od)\"\n apply (rule stronger_corres_guard_imp)\n apply (rule schedule_resume_cur_thread_dcorres_L)\n apply (case_tac \"cur \\ idle_thread s'\")\n apply (clarsimp simp: valid_sched_def valid_sched_action_def is_activatable_def invs_def valid_state_def\n pred_tcb_at_def obj_at_def ct_in_cur_domain_def in_cur_domain_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def tcb_boundntfn_slot_def tcb_pending_op_slot_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def st_tcb_def2 get_tcb_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)[1]\n (* cur = idle_thread s' *)\n apply (subgoal_tac \"cdl_current_thread s = None\")\n apply (clarsimp simp: transform_def transform_current_thread_def)+\n done\n\nlemma schedule_switch_thread_helper:\n \"\\ valid_etcbs s;\n valid_sched s;\n invs s;\n scheduler_action s = switch_thread t\n \\\n \\ t \\ active_tcbs_in_domain (cur_domain s) (transform s)\"\n apply (clarsimp simp: valid_sched_def valid_sched_action_def weak_valid_sched_action_def is_activatable_def invs_def\n valid_state_def pred_tcb_at_def obj_at_def switch_in_cur_domain_def in_cur_domain_def only_idle_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (clarsimp simp: valid_idle_def pred_tcb_at_def)\n apply (drule_tac s=\"idle_thread s\" in sym)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def pred_tcb_at_def get_tcb_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)\n done\n\nlemma schedule_choose_new_thread_helper:\n \"\\ ready_queues s (cur_domain s) prio \\ [];\n t = hd (ready_queues s (cur_domain s) prio);\n valid_sched_except_blocked s;\n invs s;\n scheduler_action s = choose_new_thread\n \\\n \\ (\\y. cdl_objects (transform s) t = Some y) \\ t \\ active_tcbs_in_domain (cur_domain s) (transform s)\"\n apply (clarsimp simp: valid_sched_def valid_sched_action_def is_activatable_def invs_def\n valid_state_def pred_tcb_at_def obj_at_def DetSchedInvs_AI.valid_queues_def\n max_non_empty_queue_def only_idle_def)\n apply (erule_tac x=\"cur_domain s\" in allE)\n apply (erule_tac x=\"prio\" in allE)\n apply clarsimp\n apply (erule_tac x=\"hd (ready_queues s (cur_domain s) prio)\" in ballE)\n apply (clarsimp simp: valid_idle_def pred_tcb_at_def)\n apply (drule_tac s=\"idle_thread s\" in sym)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def\n is_etcb_at_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def st_tcb_def2 get_tcb_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)\n done\n\nlemma idle_thread_not_in_queue:\n \"\\ valid_idle s; DetSchedInvs_AI.valid_queues s; ready_queues s d p \\ [] \\ \\ idle_thread s \\ hd (ready_queues s d p)\"\n apply (clarsimp simp: valid_idle_def DetSchedInvs_AI.valid_queues_def pred_tcb_at_def obj_at_def)\n apply (erule_tac x=\"d\" in allE)\n apply (erule_tac x=\"p\" in allE)\n apply clarsimp\n apply (erule_tac x=\"idle_thread s\" in ballE)\n apply clarsimp\n apply (frule hd_in_set)\n apply clarsimp\n done\n\nlemma change_current_domain_dcorres: \"dcorres dc \\ \\ change_current_domain next_domain\"\n by (auto simp: corres_underlying_def change_current_domain_def next_domain_def bind_def return_def modify_def Let_def put_def select_def\n get_def transform_def trans_state_def transform_objects_def transform_cdt_def transform_current_thread_def\n transform_asid_table_def)\n\nlemma max_set_not_empty:\n \"\\x::'a::{linorder,finite}. f x \\ [] \\ f (Max {x. f x \\ []}) \\ []\"\n apply (rule_tac S=\"{x. f x \\ []}\" in Max_prop)\n apply auto\n done\n\nlemma next_domain_valid_sched_except_blocked[wp]:\n \"\\ valid_sched_except_blocked and (\\s. scheduler_action s = choose_new_thread)\\ next_domain \\ \\_. valid_sched_except_blocked \\\"\n apply (simp add: next_domain_def Let_def)\n apply (wp, simp add: valid_sched_def valid_sched_action_2_def ct_not_in_q_2_def)\n done\n\n\nlemma schedule_def_2:\n \"Schedule_D.schedule \\ do\n change_current_domain;\n (do\n next_domain \\ gets cdl_current_domain;\n threads \\ gets (active_tcbs_in_domain next_domain);\n next_thread \\ select threads;\n Schedule_D.switch_to_thread (Some next_thread)\n od \\ Schedule_D.switch_to_thread None)\n od\"\n unfolding Schedule_D.schedule_def\n apply (subst alternative_bind_distrib_2, simp)\n done\n\nlemma schedule_choose_new_thread_dcorres:\n \"dcorres dc \\\n (\\s. valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread)\n Schedule_D.schedule\n schedule_choose_new_thread\"\n unfolding schedule_choose_new_thread_def guarded_switch_to_def bind_assoc\n choose_thread_def max_non_empty_queue_def\n supply if_cong[cong]\n apply (rule dcorres_symb_exec_r, rename_tac dom_t)\n apply (case_tac \"dom_t \\ 0\")\n apply (clarsimp)\n apply (rule dcorres_symb_exec_r, rename_tac cur_dom)\n apply (rule dcorres_symb_exec_r, rename_tac rq)\n apply (rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n (* No threads in ready_queues *)\n apply (rule corres_guard_imp)\n apply (rule corres_if_rhs)\n apply (clarsimp simp: Schedule_D.schedule_def)\n apply (rule corres_alternate2)\n apply (rule change_current_domain_and_switch_to_idle_thread_dcorres)\n (* Threads in ready_queues *)\n apply (simp only: Schedule_D.schedule_def)\n apply (rule corres_alternate1)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule_tac P'=\"\\s. ready_queues s (cur_domain s) = rq \\ valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\"\n in stronger_corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (clarsimp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply clarsimp\n apply (frule_tac prio=\"(Max {prio. ready_queues s' (cur_domain s') prio \\ []})\" in schedule_choose_new_thread_helper,simp,simp,simp,simp,simp)\n apply (clarsimp simp: valid_sched_def DetSchedInvs_AI.valid_queues_def max_non_empty_queue_def)\n apply (auto simp: select_def gets_def get_def bind_def return_def active_tcbs_in_domain_def\n invs_def valid_state_def valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def tcb_at_def)[1]\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def max_non_empty_queue_def)\n apply (frule_tac p=\"Max {prio. ready_queues s' (cur_domain s') prio \\ []}\" in idle_thread_not_in_queue,simp,simp)\n apply (clarsimp)\n apply (wp hoare_drop_imp| simp | clarsimp simp: valid_sched_def)+\n apply (frule max_set_not_empty, fastforce)\n apply (wp hoare_drop_imp| simp)+\n (* dom_t = 0 *)\n apply (simp only: schedule_def_2)\n apply (rule corres_guard_imp)\n apply (rule_tac P=\\ and P'=\\ and R=\"\\_. \\\" and R'=\"\\_ s. valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\"\n in corres_split)\n apply (rule change_current_domain_dcorres)\n apply (clarsimp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r, rename_tac rq)\n apply (fold dc_def, rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n apply (rule corres_guard_imp)\n apply (rule corres_if_rhs)\n (* No threads in ready queues *)\n apply (rule corres_alternate2)\n apply (rule switch_to_idle_thread_dcorres)\n (* threads in ready queues *)\n apply (rule corres_alternate1)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule_tac P'=\"\\s. ready_queues s (cur_domain s) = rq \\ valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\"\n in stronger_corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply clarsimp\n apply (frule_tac prio=\"(Max {prio. ready_queues s' (cur_domain s') prio \\ []})\" in schedule_choose_new_thread_helper,simp,simp,simp,simp,simp)\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def)\n apply (auto simp: select_def gets_def get_def bind_def return_def active_tcbs_in_domain_def\n invs_def valid_state_def valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def tcb_at_def)[1]\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def max_non_empty_queue_def)\n apply (frule_tac p=\"Max {prio. ready_queues s' (cur_domain s') prio \\ []}\" in idle_thread_not_in_queue,simp,simp)\n apply (clarsimp)\n apply (wp hoare_drop_imp | clarsimp)+\n apply (frule max_set_not_empty, fastforce)\n apply (wp hoare_drop_imp | clarsimp)+\n apply simp\n apply (wp | clarsimp)+\n unfolding dc_def\n apply (wp next_domain_valid_etcbs | simp)+\n apply (wp tcb_sched_action_transform | clarsimp simp: valid_sched_def)+\n done\n\nlemma schedule_choose_new_thread_dcorres_fragment:\n \"\\cur_ts cur. dcorres dc \\\n (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s \\ invs s \\ scheduler_action s = choose_new_thread)\n Schedule_D.schedule\n (do y \\ when (runnable cur_ts) (tcb_sched_action tcb_sched_enqueue cur);\n schedule_choose_new_thread\n od)\"\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp tcb_sched_action_transform| simp add: valid_sched_def st_tcb_at_def obj_at_def not_cur_thread_def| clarsimp simp: transform_def)+\n done\n\nlemma dcorres_If_both:\n \"\\ dcorres r P P' h m ;\n dcorres r P Q' h n \\\n \\ dcorres r P (\\s. if b then P' s else Q' s) h (if b then m else n)\"\n by (case_tac b; simp)\n\nlemma set_scheduler_action_transform:\n \"\\\\ps. transform ps = cs\\ set_scheduler_action a \\\\r s. transform s = cs\\\"\n by (clarsimp simp: set_scheduler_action_def etcb_at_def| wp )+\n\ncrunch valid_idle_etcb[wp]: set_scheduler_action valid_idle_etcb\n\n(* RHS copy-pasted from schedule_dcorres switch_thread case *)\nlemma schedule_switch_thread_dcorres:\n \"dcorres dc \\\n (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s\n \\ invs s \\ scheduler_action s = switch_thread target)\n Schedule_D.schedule\n (do y <- when (runnable cur_ts) (tcb_sched_action tcb_sched_enqueue cur);\n it <- gets idle_thread;\n target_prio <- ethread_get tcb_priority target;\n ct_prio <- ethread_get_when (cur \\ it) tcb_priority cur;\n fastfail <- schedule_switch_thread_fastfail cur it ct_prio target_prio;\n cur_dom <- gets cur_domain;\n highest <- gets (is_highest_prio cur_dom target_prio);\n if fastfail \\ \\ highest then do y <- tcb_sched_action tcb_sched_enqueue target;\n y <- set_scheduler_action choose_new_thread;\n schedule_choose_new_thread\n od\n else if runnable cur_ts \\ ct_prio = target_prio\n then do y <- tcb_sched_action tcb_sched_append target;\n y <- set_scheduler_action choose_new_thread;\n schedule_choose_new_thread\n od\n else do y <- guarded_switch_to target;\n set_scheduler_action resume_cur_thread\n od\n od)\" (is \"dcorres _ _ (\\s. ?PRE s) _ _\")\n supply ethread_get_wp[wp del]\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_If_both)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply simp\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp set_scheduler_action_transform tcb_sched_action_transform)+\n apply (rule dcorres_If_both)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply simp\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp set_scheduler_action_transform tcb_sched_action_transform)+\n apply (simp add: Schedule_D.schedule_def guarded_switch_to_def bind_assoc)\n apply (rule corres_alternate1)\n apply (rule_tac P=\\ and P'=\"?PRE\" in stronger_corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply (wpsimp wp: gts_wp hoare_drop_imp)+\n apply (frule schedule_switch_thread_helper, simp,simp,simp)\n apply (fastforce simp: select_def gets_def get_def bind_def return_def\n active_tcbs_in_domain_def invs_def valid_state_def\n valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def\n tcb_at_def)\n apply (clarsimp)\n apply (frule invs_valid_idle)\n apply (fastforce simp: pred_tcb_at_def obj_at_def valid_idle_def valid_sched_def\n valid_sched_action_def weak_valid_sched_action_def)\n apply (wp tcb_sched_action_transform\n hoare_drop_imp[where f=\"ethread_get tcb_priority x\" for x]\n hoare_drop_imp[where f=\"ethread_get_when b tcb_priority t\" for b t]\n hoare_drop_imp[where f=\"gets cur_domain\"]\n | clarsimp simp add: schedule_switch_thread_fastfail_def\n split del: if_split\n | split if_split)+\n apply (fastforce elim: st_tcb_weakenE\n simp: valid_sched_def valid_blocked_def valid_blocked_except_def\n not_cur_thread_def valid_sched_action_def weak_valid_sched_action_def)\n apply (wp tcb_sched_action_transform, clarsimp)\n done\n\n\n(*\n * The schedulers correspond.\n *\n * Most of the difficulties in this proof arise from needing to dance\n * around differences in switching to the idle thread: The CapDL spec\n * switches to \"None\", while the abstract spec switches to an actual\n * thread.\n *)\n\nlemma schedule_dcorres:\n \"dcorres dc \\ (invs and valid_sched and valid_etcbs) Schedule_D.schedule Schedule_A.schedule\"\n supply if_cong[cong]\n apply (clarsimp simp: Schedule_A.schedule_def)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac cur)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac cur_ts)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac \"sa\", case_tac \"sa\")\n (* sa = resume_cur_thread *)\n apply clarsimp\n apply (rule schedule_resume_cur_thread_dcorres)\n (* sa = switch_thread *)\n apply clarsimp\n apply (rule schedule_switch_thread_dcorres)\n (* sa = choose_new_thread *)\n apply clarsimp\n apply (rule schedule_choose_new_thread_dcorres_fragment)\n apply (wp gts_st_tcb | simp )+\n done\n\n(*\n * The next few lemmas show that updating the register NextIP in the\n * tcb context of a thread does affect the state translation to capDL\n *)\nlemma get_tcb_message_info_nextPC [simp]:\n \"get_tcb_message_info (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_tcb_message_info tcb\"\n by (simp add: get_tcb_message_info_def\n arch_tcb_context_get_def\n msg_info_register_def\n ARM.msgInfoRegister_def)\n\nlemma map_msg_registers_nextPC [simp]:\n \"map ((tcb_context tcb)(NextIP := pc)) msg_registers =\n map (tcb_context tcb) msg_registers\"\n by (simp add: msg_registers_def ARM.msgRegisters_def\n upto_enum_red fromEnum_def toEnum_def enum_register)\n\nlemma get_ipc_buffer_words_nextPC [simp]:\n \"get_ipc_buffer_words m (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_ipc_buffer_words m tcb\"\n by (rule ext) (simp add: get_ipc_buffer_words_def)\n\nlemma get_tcb_mrs_nextPC [simp]:\n \"get_tcb_mrs m (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_tcb_mrs m tcb\"\n by (simp add: get_tcb_mrs_def Let_def arch_tcb_context_get_def)\n\nlemma transform_tcb_NextIP:\n \"transform_tcb m t (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP:= pc))) tcb)\n = transform_tcb m t tcb\"\n by (auto simp add: transform_tcb_def transform_full_intent_def Let_def\n cap_register_def ARM.capRegister_def\n arch_tcb_context_get_def)\n\n(*\n * setNextPC in the tcb context is not observable on the capDL level.\n *)\nlemma as_user_setNextPC_corres:\n \"dcorres dc \\ \\ (return x) (as_user t (setNextPC pc))\"\n supply option.case_cong[cong]\n apply (clarsimp simp: corres_underlying_def gets_the_def\n as_user_def setNextPC_def get_tcb_def\n setRegister_def simpler_modify_def\n select_f_def return_def in_monad\n set_object_def get_object_def\n split: option.splits Structures_A.kernel_object.splits)\n apply (subst tcb_context_update_aux)\n apply (simp add: transform_def transform_current_thread_def)\n apply (clarsimp simp: transform_objects_update_kheap_same_caps\n transform_tcb_NextIP transform_objects_update_same\n arch_tcb_update_aux3)\n done\n\ncrunch transform_inv[wp]: set_thread_state_ext \"\\s. transform s = cs\"\n\nlemma dcorres_dummy_set_thread_state_runnable:\n \"dcorres dc \\\n (not_idle_thread ptr and st_tcb_at (\\t. (infer_tcb_pending_op ptr t) = (infer_tcb_pending_op ptr st)) ptr)\n (return ())\n (set_thread_state ptr st)\"\n supply option.case_cong[cong] if_cong[cong]\n apply (rule wp_to_dcorres)\n apply (clarsimp simp:set_thread_state_def not_idle_thread_def set_object_def get_object_def | wp)+\n apply (clarsimp simp:transform_def transform_current_thread_def st_tcb_at_def obj_at_def\n | rule ext)+\n apply (clarsimp simp:transform_objects_def not_idle_thread_def dest!:get_tcb_SomeD)\n apply (case_tac \"x = ptr\")\n apply (clarsimp simp:transform_tcb_def)\n apply (clarsimp simp:restrict_map_def Map.map_add_def)\n done\n\n(*\n * Activating threads is not observable on the capDL level.\n *)\nlemma activate_thread_corres:\n \"dcorres dc \\ (ct_in_state activatable and invs and valid_etcbs)\n (do t \\ gets cdl_current_thread;\n case t of Some thread \\ do\n restart \\ has_restart_cap thread;\n when restart $ KHeap_D.set_cap (thread,tcb_pending_op_slot) RunningCap\n od | None \\ return ()\n od)\n activate_thread\"\n apply (simp add: activate_thread_def has_restart_cap_def gets_def bind_assoc)\n apply (rule dcorres_absorb_get_r)\n apply (rule dcorres_absorb_get_l)\n apply (simp add:get_thread_state_def bind_assoc thread_get_def)\n apply (rule dcorres_absorb_gets_the)\n apply (case_tac \"cdl_current_thread (transform s'a) = None\")\n apply (clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def\n cdl_current_thread transform_current_thread_def valid_idle_def\n arch_activate_idle_thread_def\n split : if_splits dest!:get_tcb_SomeD invs_valid_idle)\n apply clarsimp\n apply (subgoal_tac \"not_idle_thread (cur_thread s'b) s'b\")\n prefer 2\n apply (clarsimp simp:transform_def transform_current_thread_def)\n apply (clarsimp simp:not_idle_thread_def)+\n apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp)\n apply (frule opt_object_tcb)\n apply simp\n apply simp\n apply (clarsimp simp:transform_tcb_def gets_def gets_the_def has_restart_cap_def\n get_thread_def bind_assoc cdl_current_thread transform_current_thread_def)\n apply (rule dcorres_absorb_get_l)\n apply (simp add:assert_opt_def when_def)\n apply (case_tac \"tcb_state obj'\")\n apply (clarsimp simp:infer_tcb_pending_op_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n when_def pred_tcb_at_def ct_in_state_def obj_at_def\n dest!:get_tcb_SomeD)+\n apply (rule corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule set_thread_state_corres[unfolded tcb_pending_op_slot_def])\n apply simp\n apply (wpsimp wp: dcorres_to_wp[OF as_user_setNextPC_corres,simplified])+\n apply (simp add:invs_mdb pred_tcb_at_def obj_at_def invs_valid_idle\n generates_pending_def not_idle_thread_def)\n apply (clarsimp simp:infer_tcb_pending_op_def arch_activate_idle_thread_def\n when_def pred_tcb_at_def ct_in_state_def obj_at_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n dest!:get_tcb_SomeD)+\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/drefine/Schedule_DR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.19394754235252773}} {"text": "section \\Static backward slice\\\n\ntheory Slice imports SCDObservable Distance begin\n\ncontext SDG begin\n\nsubsection \\Preliminary definitions on the parameter nodes for defining\n sliced call and return edges\\\n\nfun csppa :: \"'node \\ 'node SDG_node set \\ nat \\ \n ((('var \\ 'val) \\ 'val option) list) \\ ((('var \\ 'val) \\ 'val option) list)\"\n where \"csppa m S x [] = []\"\n | \"csppa m S x (f#fs) = \n (if Formal_in(m,x) \\ S then Map.empty else f)#csppa m S (Suc x) fs\"\n\ndefinition cspp :: \"'node \\ 'node SDG_node set \\ \n ((('var \\ 'val) \\ 'val option) list) \\ ((('var \\ 'val) \\ 'val option) list)\"\n where \"cspp m S fs \\ csppa m S 0 fs\"\n\n\n\nlemma [simp]: \"length (cspp m S fs) = length fs\"\nby(simp add:cspp_def)\n\nlemma csppa_Formal_in_notin_slice: \n \"\\x < length fs; Formal_in(m,x + i) \\ S\\\n \\ (csppa m S i fs)!x = Map.empty\"\nby(induct fs arbitrary:i x,auto simp:nth_Cons')\n\nlemma csppa_Formal_in_in_slice: \n \"\\x < length fs; Formal_in(m,x + i) \\ S\\\n \\ (csppa m S i fs)!x = fs!x\"\nby(induct fs arbitrary:i x,auto simp:nth_Cons')\n\n\ndefinition map_merge :: \"('var \\ 'val) \\ ('var \\ 'val) \\ (nat \\ bool) \\ \n 'var list \\ ('var \\ 'val)\"\nwhere \"map_merge f g Q xs \\ (\\V. if (\\i. i < length xs \\ xs!i = V \\ Q i) then g V \n else f V)\"\n\n\ndefinition rspp :: \"'node \\ 'node SDG_node set \\ 'var list \\ \n ('var \\ 'val) \\ ('var \\ 'val) \\ ('var \\ 'val)\"\nwhere \"rspp m S xs f g \\ map_merge f (Map.empty(ParamDefs m [:=] map g xs))\n (\\i. Actual_out(m,i) \\ S) (ParamDefs m)\"\n\n\nlemma rspp_Actual_out_in_slice:\n assumes \"x < length (ParamDefs (targetnode a))\" and \"valid_edge a\"\n and \"length (ParamDefs (targetnode a)) = length xs\" \n and \"Actual_out (targetnode a,x) \\ S\"\n shows \"(rspp (targetnode a) S xs f g) ((ParamDefs (targetnode a))!x) = g(xs!x)\"\nproof -\n from \\valid_edge a\\ have \"distinct(ParamDefs (targetnode a))\"\n by(rule distinct_ParamDefs)\n from \\x < length (ParamDefs (targetnode a))\\ \n \\length (ParamDefs (targetnode a)) = length xs\\\n \\distinct(ParamDefs (targetnode a))\\\n have \"(Map.empty(ParamDefs (targetnode a) [:=] map g xs))\n ((ParamDefs (targetnode a))!x) = (map g xs)!x\"\n by(fastforce intro:fun_upds_nth)\n with \\Actual_out(targetnode a,x) \\ S\\ \\x < length (ParamDefs (targetnode a))\\\n \\length (ParamDefs (targetnode a)) = length xs\\ show ?thesis\n by(fastforce simp:rspp_def map_merge_def)\nqed\n\nlemma rspp_Actual_out_notin_slice:\n assumes \"x < length (ParamDefs (targetnode a))\" and \"valid_edge a\"\n and \"length (ParamDefs (targetnode a)) = length xs\" \n and \"Actual_out((targetnode a),x) \\ S\"\n shows \"(rspp (targetnode a) S xs f g) ((ParamDefs (targetnode a))!x) = \n f((ParamDefs (targetnode a))!x)\"\nproof -\n from \\valid_edge a\\ have \"distinct(ParamDefs (targetnode a))\"\n by(rule distinct_ParamDefs)\n from \\x < length (ParamDefs (targetnode a))\\ \n \\length (ParamDefs (targetnode a)) = length xs\\\n \\distinct(ParamDefs (targetnode a))\\\n have \"(Map.empty(ParamDefs (targetnode a) [:=] map g xs))\n ((ParamDefs (targetnode a))!x) = (map g xs)!x\"\n by(fastforce intro:fun_upds_nth)\n with \\Actual_out((targetnode a),x) \\ S\\ \\distinct(ParamDefs (targetnode a))\\ \n \\x < length (ParamDefs (targetnode a))\\\n show ?thesis by(fastforce simp:rspp_def map_merge_def nth_eq_iff_index_eq)\nqed\n\n\nsubsection \\Defining the sliced edge kinds\\\n\nprimrec slice_kind_aux :: \"'node \\ 'node \\ 'node SDG_node set \\ \n ('var,'val,'ret,'pname) edge_kind \\ ('var,'val,'ret,'pname) edge_kind\"\nwhere \"slice_kind_aux m m' S \\f = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then \\f else \\id)\"\n | \"slice_kind_aux m m' S (Q)\\<^sub>\\ = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then (Q)\\<^sub>\\ else\n (if obs_intra m \\S\\\\<^bsub>CFG\\<^esub> = {} then \n (let mex = (THE mex. method_exit mex \\ get_proc m = get_proc mex) in\n (if (\\x. distance m' mex x \\ distance m mex (x + 1) \\\n (m' = (SOME mx'. \\a'. m = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) \n then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\))\n else (let mx = THE mx. mx \\ obs_intra m \\S\\\\<^bsub>CFG\\<^esub> in \n (if (\\x. distance m' mx x \\ distance m mx (x + 1) \\\n (m' = (SOME mx'. \\a'. m = sourcenode a' \\ \n distance (targetnode a') mx x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) \n then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\))))\"\n | \"slice_kind_aux m m' S (Q:r\\\\<^bsub>p\\<^esub>fs) = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then (Q:r\\\\<^bsub>p\\<^esub>(cspp m' S fs))\n else ((\\cf. False):r\\\\<^bsub>p\\<^esub>fs))\"\n | \"slice_kind_aux m m' S (Q\\\\<^bsub>p\\<^esub>f) = (if m \\ \\S\\\\<^bsub>CFG\\<^esub> then \n (let outs = THE outs. \\ins. (p,ins,outs) \\ set procs in\n (Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp m' S outs cf' cf)))\n else ((\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')))\"\n\ndefinition slice_kind :: \"'node SDG_node set \\ 'edge \\ \n ('var,'val,'ret,'pname) edge_kind\"\n where \"slice_kind S a \\ \n slice_kind_aux (sourcenode a) (targetnode a) (HRB_slice S) (kind a)\"\n\ndefinition slice_kinds :: \"'node SDG_node set \\ 'edge list \\ \n ('var,'val,'ret,'pname) edge_kind list\"\n where \"slice_kinds S as \\ map (slice_kind S) as\"\n\n\n\nlemma slice_intra_kind_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; intra_kind (kind a)\\ \n \\ slice_kind S a = kind a\"\nby(fastforce simp:intra_kind_def slice_kind_def)\n\n\nlemma slice_kind_Upd:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = \\f\\ \\ slice_kind S a = \\id\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Pred_empty_obs_nearer_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and \"distance (targetnode a) mex x\" and \"distance (sourcenode a) mex (x + 1)\"\n and \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\ \n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\\\n have \"slice_kind S a = \n (if (\\x. distance (targetnode a) mex x \\ distance (sourcenode a) mex (x + 1) \\\n (targetnode a = (SOME mx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\ valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\)\"\n by(simp add:slice_kind_def Let_def)\n with \\distance (targetnode a) mex x\\ \\distance (sourcenode a) mex (x + 1)\\\n \\targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\\\n show ?thesis by fastforce\nqed\n\n\nlemma slice_kind_Pred_empty_obs_nearer_not_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and \"distance (targetnode a) mex x\" and \"distance (sourcenode a) mex (x + 1)\"\n and \"targetnode a \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\ \n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\\\n have \"slice_kind S a = \n (if (\\x. distance (targetnode a) mex x \\ distance (sourcenode a) mex (x + 1) \\\n (targetnode a = (SOME mx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\ valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = mx'))) then (\\cf. True)\\<^sub>\\ else (\\cf. False)\\<^sub>\\)\"\n by(simp add:slice_kind_def Let_def)\n with \\distance (targetnode a) mex x\\ \\distance (sourcenode a) mex (x + 1)\\\n \\targetnode a \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\\\n show ?thesis by(auto dest:distance_det)\nqed\n\n\nlemma slice_kind_Pred_empty_obs_not_nearer:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\"\n and \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\" \n and \"method_exit mex\" and \"get_proc (sourcenode a) = get_proc mex\"\n and dist:\"distance (sourcenode a) mex (x + 1)\" \"\\ distance (targetnode a) mex x\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n moreover\n from dist have \"\\ (\\x. distance (targetnode a) mex x \\ \n distance (sourcenode a) mex (x + 1))\"\n by(fastforce dest:distance_det)\n ultimately show ?thesis using assms by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_nearer_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n and \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = n')\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n with assms show ?thesis by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_nearer_not_SOME:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n and \"targetnode a \\ (SOME nx'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = nx')\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"m = (THE m. m \\ obs_intra (sourcenode a) (\\HRB_slice S\\\\<^bsub>CFG\\<^esub>))\"\n by(rule obs_intra_the_element[THEN sym])\n with assms show ?thesis by(auto dest:distance_det simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_not_nearer:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = (Q)\\<^sub>\\\" \n and in_obs:\"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and dist:\"distance (sourcenode a) m (x + 1)\" \n \"\\ distance (targetnode a) m x\"\n shows \"slice_kind S a = (\\s. False)\\<^sub>\\\"\nproof -\n from in_obs have the:\"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n from dist have \"\\ (\\x. distance (targetnode a) m x \\ \n distance (sourcenode a) m (x + 1))\"\n by(fastforce dest:distance_det)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\ in_obs the show ?thesis\n by(auto simp:slice_kind_def Let_def)\nqed\n\n\nlemma kind_Predicate_notin_slice_slice_kind_Predicate:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"valid_edge a\" and \"kind a = (Q)\\<^sub>\\\"\n obtains Q' where \"slice_kind S a = (Q')\\<^sub>\\\" and \"Q' = (\\s. False) \\ Q' = (\\s. True)\"\nproof(atomize_elim)\n show \"\\Q'. slice_kind S a = (Q')\\<^sub>\\ \\ (Q' = (\\s. False) \\ Q' = (\\s. True))\"\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n from \\valid_edge a\\ have \"valid_node (sourcenode a)\" by simp\n then obtain as where \"sourcenode a -as\\\\<^sub>\\* (_Exit_)\" by(fastforce dest:Exit_path)\n then obtain as' mex where \"sourcenode a -as'\\\\<^sub>\\* mex\" and \"method_exit mex\" \n by -(erule valid_Exit_path_intra_path)\n from \\sourcenode a -as'\\\\<^sub>\\* mex\\ have \"get_proc (sourcenode a) = get_proc mex\"\n by(rule intra_path_get_procs)\n show ?thesis\n proof(cases \"\\x. distance (targetnode a) mex x \\ \n distance (sourcenode a) mex (x + 1)\")\n case True\n then obtain x where \"distance (targetnode a) mex x\" \n and \"distance (sourcenode a) mex (x + 1)\" by blast\n show ?thesis\n proof(cases \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\")\n case True\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\\n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\\\n \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n \\distance (targetnode a) mex x\\ \\distance (sourcenode a) mex (x + 1)\\\n have \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n by(rule slice_kind_Pred_empty_obs_nearer_SOME)\n thus ?thesis by simp\n next\n case False\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\\n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\\\n \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n \\distance (targetnode a) mex x\\ \\distance (sourcenode a) mex (x + 1)\\\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_Pred_empty_obs_nearer_not_SOME)\n thus ?thesis by simp\n qed\n next\n case False\n from \\method_exit mex\\ \\get_proc (sourcenode a) = get_proc mex\\\n have \"mex = (THE mex. method_exit mex \\ get_proc (sourcenode a) = get_proc mex)\"\n by(auto intro!:the_equality[THEN sym] intro:method_exit_unique)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\\n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\\ False\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(auto simp:slice_kind_def Let_def)\n thus ?thesis by simp\n qed\n next\n case False\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by blast\n show ?thesis\n proof(cases \"\\x. distance (targetnode a) m x \\ \n distance (sourcenode a) m (x + 1)\")\n case True\n then obtain x where \"distance (targetnode a) m x\" \n and \"distance (sourcenode a) m (x + 1)\" by blast\n show ?thesis\n proof(cases \"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\")\n case True\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\\n \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\distance (targetnode a) m x\\ \\distance (sourcenode a) m (x + 1)\\\n have \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n by(rule slice_kind_Pred_obs_nearer_SOME)\n thus ?thesis by simp\n next\n case False\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\\n \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\distance (targetnode a) m x\\ \\distance (sourcenode a) m (x + 1)\\\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_Pred_obs_nearer_not_SOME)\n thus ?thesis by simp\n qed\n next\n case False\n from \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(rule obs_intra_the_element[THEN sym])\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = (Q)\\<^sub>\\\\ False\n \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(auto simp:slice_kind_def Let_def)\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma slice_kind_Call:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \n \\ slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Call_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \n \\ slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Call_in_slice_Formal_in_not:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\" \n shows \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>replicate (length fs) Map.empty\"\nproof -\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(simp add:slice_kind_def)\n from \\\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\\\n have \"cspp (targetnode a) (HRB_slice S) fs = replicate (length fs) Map.empty\"\n by(fastforce intro:nth_equalityI csppa_Formal_in_notin_slice simp:cspp_def)\n with \\slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\\\n show ?thesis by simp\nqed\n\n\nlemma slice_kind_Call_in_slice_Formal_in_also:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\" \n shows \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>fs\"\nproof -\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(simp add:slice_kind_def)\n from \\\\x < length fs. Formal_in(targetnode a,x) \\ HRB_slice S\\\n have \"cspp (targetnode a) (HRB_slice S) fs = fs\"\n by(fastforce intro:nth_equalityI csppa_Formal_in_in_slice simp:cspp_def)\n with \\slice_kind S a = Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\\\n show ?thesis by simp\nqed\n\n\nlemma slice_kind_Call_intra_notin_slice:\n assumes \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" and \"valid_edge a\" \n and \"intra_kind (kind a)\" and \"valid_edge a'\" and \"kind a' = Q:r\\\\<^bsub>p\\<^esub>fs\"\n and \"sourcenode a' = sourcenode a\"\n shows \"slice_kind S a = (\\s. True)\\<^sub>\\\"\nproof -\n from \\valid_edge a'\\ \\kind a' = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain a'' \n where \"a'' \\ get_return_edges a'\"\n by(fastforce dest:get_return_edge_call)\n with \\valid_edge a'\\ obtain ax where \"valid_edge ax\" \n and \"sourcenode ax = sourcenode a'\" and \" targetnode ax = targetnode a''\"\n and \"kind ax = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n from \\valid_edge a'\\ \\kind a' = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"\\!a''. valid_edge a'' \\ sourcenode a'' = sourcenode a' \\ \n intra_kind(kind a'')\"\n by(rule call_only_one_intra_edge)\n with \\valid_edge a\\ \\sourcenode a' = sourcenode a\\ \\intra_kind (kind a)\\\n have all:\"\\a''. valid_edge a'' \\ sourcenode a'' = sourcenode a' \\ \n intra_kind(kind a'') \\ a'' = a\" by fastforce\n with \\valid_edge ax\\ \\sourcenode ax = sourcenode a'\\ \\kind ax = (\\cf. False)\\<^sub>\\\\\n have [simp]:\"ax = a\" by(fastforce simp:intra_kind_def)\n show ?thesis\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n from \\valid_edge a\\ have \"valid_node (sourcenode a)\" by simp\n then obtain asx where \"sourcenode a -asx\\\\<^sub>\\* (_Exit_)\" by(fastforce dest:Exit_path)\n then obtain as pex where \"sourcenode a-as\\\\<^sub>\\* pex\" and \"method_exit pex\"\n by -(erule valid_Exit_path_intra_path)\n from \\sourcenode a-as\\\\<^sub>\\* pex\\ have \"get_proc (sourcenode a) = get_proc pex\"\n by(rule intra_path_get_procs)\n from \\sourcenode a-as\\\\<^sub>\\* pex\\ obtain x where \"distance (sourcenode a) pex x\"\n and \"x \\ length as\" by(erule every_path_distance)\n from \\method_exit pex\\ have \"sourcenode a \\ pex\"\n proof(rule method_exit_cases)\n assume \"pex = (_Exit_)\"\n show ?thesis\n proof\n assume \"sourcenode a = pex\"\n with \\pex = (_Exit_)\\ have \"sourcenode a = (_Exit_)\" by simp\n with \\valid_edge a\\ show False by(rule Exit_source)\n qed\n next\n fix ax Qx px fx \n assume \"pex = sourcenode ax\" and \"valid_edge ax\" and \"kind ax = Qx\\\\<^bsub>px\\<^esub>fx\"\n hence \"\\a'. valid_edge a' \\ sourcenode a' = sourcenode ax \\ \n (\\Qx' fx'. kind a' = Qx'\\\\<^bsub>px\\<^esub>fx')\" by -(rule return_edges_only)\n with \\valid_edge a\\ \\intra_kind (kind a)\\ \\pex = sourcenode ax\\\n show ?thesis by(fastforce simp:intra_kind_def)\n qed\n have \"x \\ 0\"\n proof\n assume \"x = 0\"\n with \\distance (sourcenode a) pex x\\ have \"sourcenode a = pex\"\n by(fastforce elim:distance.cases simp:intra_path_def)\n with \\sourcenode a \\ pex\\ show False by simp\n qed\n with \\distance (sourcenode a) pex x\\ obtain ax' where \"valid_edge ax'\"\n and \"sourcenode a = sourcenode ax'\" and \"intra_kind(kind ax')\"\n and \"distance (targetnode ax') pex (x - 1)\"\n and Some:\"targetnode ax' = (SOME nx. \\a'. sourcenode ax' = sourcenode a' \\ \n distance (targetnode a') pex (x - 1) \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = nx)\"\n by(erule distance_successor_distance)\n from \\valid_edge ax'\\ \\sourcenode a = sourcenode ax'\\ \\intra_kind(kind ax')\\\n \\sourcenode a' = sourcenode a\\ all\n have [simp]:\"ax' = a\" by fastforce\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind ax = (\\cf. False)\\<^sub>\\\\\n True \\method_exit pex\\ \\get_proc (sourcenode a) = get_proc pex\\ \\x \\ 0\\\n \\distance (targetnode ax') pex (x - 1)\\ \\distance (sourcenode a) pex x\\ Some\n show ?thesis by(fastforce elim:slice_kind_Pred_empty_obs_nearer_SOME)\n next\n case False\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by fastforce\n then obtain as where \"sourcenode a-as\\\\<^sub>\\* m\" and \"m \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n by -(erule obs_intraE)\n from \\sourcenode a-as\\\\<^sub>\\* m\\ obtain x where \"distance (sourcenode a) m x\"\n and \"x \\ length as\" by(erule every_path_distance)\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\m \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"sourcenode a \\ m\" by fastforce\n have \"x \\ 0\"\n proof\n assume \"x = 0\"\n with \\distance (sourcenode a) m x\\ have \"sourcenode a = m\"\n by(fastforce elim:distance.cases simp:intra_path_def)\n with \\sourcenode a \\ m\\ show False by simp\n qed\n with \\distance (sourcenode a) m x\\ obtain ax' where \"valid_edge ax'\"\n and \"sourcenode a = sourcenode ax'\" and \"intra_kind(kind ax')\"\n and \"distance (targetnode ax') m (x - 1)\"\n and Some:\"targetnode ax' = (SOME nx. \\a'. sourcenode ax' = sourcenode a' \\ \n distance (targetnode a') m (x - 1) \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = nx)\"\n by(erule distance_successor_distance)\n from \\valid_edge ax'\\ \\sourcenode a = sourcenode ax'\\ \\intra_kind(kind ax')\\\n \\sourcenode a' = sourcenode a\\ all\n have [simp]:\"ax' = a\" by fastforce\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind ax = (\\cf. False)\\<^sub>\\\\\n \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\x \\ 0\\\n \\distance (targetnode ax') m (x - 1)\\ \\distance (sourcenode a) m x\\ Some\n show ?thesis by(fastforce elim:slice_kind_Pred_obs_nearer_SOME)\n qed\nqed\n\n\nlemma slice_kind_Return:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; kind a = Q\\\\<^bsub>p\\<^esub>f\\\n \\ slice_kind S a = (\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Return_in_slice:\n \"\\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>; valid_edge a; kind a = Q\\\\<^bsub>p\\<^esub>f; \n (p,ins,outs) \\ set procs\\\n \\ slice_kind S a = Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp (targetnode a) (HRB_slice S) outs cf' cf)\"\nby(simp add:slice_kind_def,unfold formal_out_THE,simp)\n\n\nlemma length_transfer_kind_slice_kind:\n assumes \"valid_edge a\" and \"length s\\<^sub>1 = length s\\<^sub>2\"\n and \"transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\" and \"transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\"\n shows \"length s\\<^sub>1' = length s\\<^sub>2'\"\nproof(cases \"kind a\" rule:edge_kind_cases)\n case Intra\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with Intra assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_intra_kind_in_slice simp:intra_kind_def)+\n next\n case False\n with Intra assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Upd \n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)+\n qed\nnext\n case (Call Q r p fs)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with Call assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Call_in_slice)+\n next\n case False\n with Call assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Call)+\n qed\nnext\n case (Return Q p f)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n from Return \\valid_edge a\\ obtain a' Q' r fs \n where \"valid_edge a'\" and \"kind a' = Q':r\\\\<^bsub>p\\<^esub>fs\"\n by -(drule return_needs_call,auto)\n then obtain ins outs where \"(p,ins,outs) \\ set procs\"\n by(fastforce dest!:callee_in_procs)\n with True \\valid_edge a\\ Return assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Return_in_slice split:list.split)+\n next \n case False\n with Return assms show ?thesis\n by(cases s\\<^sub>1)(cases s\\<^sub>2,auto dest:slice_kind_Return split:list.split)+\n qed\nqed\n\n\nsubsection \\The sliced graph of a deterministic CFG is still deterministic\\ \n\nlemma only_one_SOME_edge:\n assumes \"valid_edge a\" and \"intra_kind(kind a)\" and \"distance (targetnode a) mex x\"\n shows \"\\!a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\nproof(rule ex_ex1I)\n show \"\\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n proof -\n have \"(\\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')) =\n (\\n'. \\a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\ targetnode a' = n')\"\n apply(unfold some_eq_ex[of \"\\n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n'\"])\n by simp\n also have \"\\\" \n using \\valid_edge a\\ \\intra_kind(kind a)\\ \\distance (targetnode a) mex x\\ \n by blast\n finally show ?thesis .\n qed\nnext\n fix a' ax\n assume \"sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n and \"sourcenode a = sourcenode ax \\ distance (targetnode ax) mex x \\\n valid_edge ax \\ intra_kind(kind ax) \\\n targetnode ax = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n thus \"a' = ax\" by(fastforce intro!:edge_det)\nqed\n\n\nlemma slice_kind_only_one_True_edge:\n assumes \"sourcenode a = sourcenode a'\" and \"targetnode a \\ targetnode a'\" \n and \"valid_edge a\" and \"valid_edge a'\" and \"intra_kind (kind a)\" \n and \"intra_kind (kind a')\" and \"slice_kind S a = (\\s. True)\\<^sub>\\\"\n shows \"slice_kind S a' = (\\s. False)\\<^sub>\\\"\nproof -\n from assms obtain Q Q' where \"kind a = (Q)\\<^sub>\\\"\n and \"kind a' = (Q')\\<^sub>\\\" and det:\"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\n by(auto dest:deterministic)\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\slice_kind S a = (\\s. True)\\<^sub>\\\\ \\kind a = (Q)\\<^sub>\\\\ have \"Q = (\\s. True)\"\n by(simp add:slice_kind_def Let_def)\n with det have \"Q' = (\\s. False)\" by(simp add:fun_eq_iff)\n with True \\kind a' = (Q')\\<^sub>\\\\ \\sourcenode a = sourcenode a'\\ show ?thesis\n by(simp add:slice_kind_def Let_def)\n next\n case False\n hence \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by simp\n thus ?thesis\n proof(cases \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> = {}\")\n case True\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\slice_kind S a = (\\s. True)\\<^sub>\\\\\n \\kind a = (Q)\\<^sub>\\\\\n obtain mex x where mex:\"mex = (THE mex. method_exit mex \\ \n get_proc (sourcenode a) = get_proc mex)\"\n and dist:\"distance (targetnode a) mex x\" \"distance (sourcenode a) mex (x + 1)\"\n and target:\"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(auto simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n from \\valid_edge a\\ \\intra_kind (kind a)\\ \\distance (targetnode a) mex x\\\n have ex1:\"\\!a'. sourcenode a = sourcenode a' \\ distance (targetnode a') mex x \\ \n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(rule only_one_SOME_edge)\n have \"targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n proof(rule ccontr)\n assume \"\\ targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n hence \"targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') mex x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by simp\n with ex1 target \\sourcenode a = sourcenode a'\\ \\valid_edge a\\ \\valid_edge a'\\\n \\intra_kind(kind a)\\ \\intra_kind(kind a')\\ \\distance (targetnode a) mex x\\\n have \"a = a'\" by fastforce\n with \\targetnode a \\ targetnode a'\\ show False by simp\n qed\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ True \\kind a' = (Q')\\<^sub>\\\\\n \\sourcenode a = sourcenode a'\\ mex dist\n show ?thesis by(auto dest:distance_det \n simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n next\n case False\n hence \"obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> \\ {}\" .\n then obtain m where \"m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by auto\n hence \"m = (THE m. m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>)\"\n by(auto dest:obs_intra_the_element)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \n \\obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub> \\ {}\\ \n \\slice_kind S a = (\\s. True)\\<^sub>\\\\ \\kind a = (Q)\\<^sub>\\\\\n obtain x x' where \"distance (targetnode a) m x\" \n \"distance (sourcenode a) m (x + 1)\"\n and target:\"targetnode a = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by(auto simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n show ?thesis\n proof(cases \"distance (targetnode a') m x\")\n case False\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a' = (Q')\\<^sub>\\\\\n \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\distance (targetnode a) m x\\ \\distance (sourcenode a) m (x + 1)\\\n \\sourcenode a = sourcenode a'\\ show ?thesis\n by(fastforce intro:slice_kind_Pred_obs_not_nearer)\n next\n case True\n from \\valid_edge a\\ \\intra_kind(kind a)\\ \\distance (targetnode a) m x\\\n \\distance (sourcenode a) m (x + 1)\\\n have ex1:\"\\!a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\ valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = (SOME nx. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = nx)\"\n by -(rule only_one_SOME_dist_edge)\n have \"targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\ \n targetnode a' = n')\"\n proof(rule ccontr)\n assume \"\\ targetnode a' \\ (SOME n'. \\a'. sourcenode a = sourcenode a' \\ \n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n hence \"targetnode a' = (SOME n'. \\a'. sourcenode a = sourcenode a' \\\n distance (targetnode a') m x \\\n valid_edge a' \\ intra_kind(kind a') \\\n targetnode a' = n')\"\n by simp\n with ex1 target \\sourcenode a = sourcenode a'\\ \n \\valid_edge a\\ \\valid_edge a'\\ \\intra_kind(kind a)\\ \\intra_kind(kind a')\\\n \\distance (targetnode a) m x\\ \\distance (sourcenode a) m (x + 1)\\\n have \"a = a'\" by auto\n with \\targetnode a \\ targetnode a'\\ show False by simp\n qed\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \n \\kind a' = (Q')\\<^sub>\\\\ \\m \\ obs_intra (sourcenode a) \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\distance (targetnode a) m x\\ \\distance (sourcenode a) m (x + 1)\\\n True \\sourcenode a = sourcenode a'\\ show ?thesis\n by(fastforce intro:slice_kind_Pred_obs_nearer_not_SOME)\n qed\n qed\n qed\nqed\n\n\nlemma slice_deterministic:\n assumes \"valid_edge a\" and \"valid_edge a'\"\n and \"intra_kind (kind a)\" and \"intra_kind (kind a')\"\n and \"sourcenode a = sourcenode a'\" and \"targetnode a \\ targetnode a'\"\n obtains Q Q' where \"slice_kind S a = (Q)\\<^sub>\\\" and \"slice_kind S a' = (Q')\\<^sub>\\\"\n and \"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\nproof(atomize_elim)\n from assms obtain Q Q' \n where \"kind a = (Q)\\<^sub>\\\" and \"kind a' = (Q')\\<^sub>\\\" \n and det:\"\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s)\"\n by(auto dest:deterministic)\n show \"\\Q Q'. slice_kind S a = (Q)\\<^sub>\\ \\ slice_kind S a' = (Q')\\<^sub>\\ \\ \n (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\kind a = (Q)\\<^sub>\\\\ have \"slice_kind S a = (Q)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n from True \\kind a' = (Q')\\<^sub>\\\\ \\sourcenode a = sourcenode a'\\\n have \"slice_kind S a' = (Q')\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n with \\slice_kind S a = (Q)\\<^sub>\\\\ det show ?thesis by blast\n next\n case False\n with \\kind a = (Q)\\<^sub>\\\\ \n have \"slice_kind S a = (\\s. True)\\<^sub>\\ \\ slice_kind S a = (\\s. False)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n thus ?thesis\n proof\n assume true:\"slice_kind S a = (\\s. True)\\<^sub>\\\"\n with \\sourcenode a = sourcenode a'\\ \\targetnode a \\ targetnode a'\\\n \\valid_edge a\\ \\valid_edge a'\\ \\intra_kind (kind a)\\ \\intra_kind (kind a')\\\n have \"slice_kind S a' = (\\s. False)\\<^sub>\\\"\n by(rule slice_kind_only_one_True_edge)\n with true show ?thesis by simp\n next\n assume false:\"slice_kind S a = (\\s. False)\\<^sub>\\\"\n from False \\kind a' = (Q')\\<^sub>\\\\ \\sourcenode a = sourcenode a'\\\n have \"slice_kind S a' = (\\s. True)\\<^sub>\\ \\ slice_kind S a' = (\\s. False)\\<^sub>\\\"\n by(simp add:slice_kind_def Let_def)\n with false show ?thesis by auto\n qed\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/StaticInter/Slice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.37022539259558657, "lm_q1q2_score": 0.19378350417746948}} {"text": "(*******************************************************************************\n \n Project: IsaNet\n\n Author: Tobias Klenze, ETH Zurich \n Christoph Sprenger, ETH Zurich \n Version: JCSPaper.1.0\n Isabelle Version: Isabelle2021-1\n\n Copyright (c) 2022 Tobias Klenze, Christoph Sprenger\n Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection\\Abstract Model\\\ntheory Parametrized_Dataplane_0\n imports\n \"Network_Model\"\n \"infrastructure/Event_Systems\"\nbegin\n\ntext\\A packet consists of an authenticated info field (e.g., the timestamp of the control plane level\nbeacon creating the segment), as well as past and future paths. Furthermore, there is a history \nvariable @{term \"history\"} that accurately records the actual path -- this is only used for the\npurpose of expressing the desired security property (\"Detectability\", see below).\\\n\nrecord ('aahi, 'ainfo) pkt0 =\n AInfo :: 'ainfo\n past :: \"'aahi ahi_scheme list\"\n future :: \"'aahi ahi_scheme list\"\n history :: \"'aahi ahi_scheme list\"\n\ntext\\In this model, the state consists of channel state and local state, each containing sets of \npackets (which we occasionally also call messages).\\\nrecord ('aahi, 'ainfo) dp0_state = \n chan :: \"(as \\ ifs \\ as \\ ifs) \\ ('aahi, 'ainfo) pkt0 set\"\n loc :: \"as \\ ('aahi, 'ainfo) pkt0 set\"\n\ntext\\We now define the events type; it will be explained below.\\\ndatatype ('aahi, 'ainfo) evt0 = \n evt_dispatch_int0 as \"('aahi, 'ainfo) pkt0\" \n | evt_recv0 as ifs \"('aahi, 'ainfo) pkt0\" \n | evt_send0 as ifs \"('aahi, 'ainfo) pkt0\" \n | evt_deliver0 as \"('aahi, 'ainfo) pkt0\"\n | evt_dispatch_ext0 as ifs \"('aahi, 'ainfo) pkt0\" \n | evt_observe0 \"('aahi, 'ainfo) dp0_state\"\n | evt_skip0\n\ncontext network_model\nbegin\n\ntext\\We define shortcuts denoting that from a state s, a packet pkt is added to either a local state\nor a channel, yielding state s'. No other part of the state is modified.\\\ndefinition dp0_add_loc :: \"('aahi, 'ainfo) dp0_state \\ ('aahi, 'ainfo) dp0_state \n \\ as \\ ('aahi, 'ainfo) pkt0 \\ bool\"\nwhere \n \"dp0_add_loc s s' asid pkt \\ s' = s\\loc := (loc s)(asid := loc s asid \\ {pkt})\\\"\n\ntext \\This is a shortcut to denote adding a message to an inter-AS channel. Note that it requires \nthe link to exist.\\\ndefinition dp0_add_chan :: \"('aahi, 'ainfo) dp0_state \\ ('aahi, 'ainfo) dp0_state\n \\ as \\ ifs \\ ('aahi, 'ainfo) pkt0 \\ bool\" where \n \"dp0_add_chan s s' a1 i1 pkt \\ \n \\a2 i2 . rev_link a1 i1 = (Some a2, Some i2) \\\n s' = s\\chan := (chan s)((a1, i1, a2, i2) := chan s (a1, i1, a2, i2) \\ {pkt})\\\"\n\ntext\\Predicate that returns true if a given packet is contained in a given channel.\\\ndefinition dp0_in_chan :: \"('aahi, 'ainfo) dp0_state \\ as \\ ifs \\ ('aahi, 'ainfo) pkt0 \\ bool\" where \n \"dp0_in_chan s a1 i1 pkt \\ \n \\a2 i2 . rev_link a1 i1 = (Some a2, Some i2) \\ pkt \\ (chan s)(a2, i2, a1, i1)\"\n\nlemmas dp0_msgs = dp0_add_loc_def dp0_add_chan_def dp0_in_chan_def\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ntext\\A typical sequence of events is the following:\n\\begin{itemize}\n\\item An AS creates a new packet using @{term \"evt_dispatch_int0\"} event and puts the packet into its local\nstate.\n\\item The AS forwards the packet to the next AS with the @{term \"evt_send0\"} event, which \nputs the message into an inter-AS channel. \n\\item The next AS takes the packet from the channel and puts it in the local state in \n@{term \"evt_recv0\"}.\n\\item The last two steps are repeated as the packet gets forwarded from hop to hop through the network,\nuntil it reaches the final AS.\n\\item The final AS delivers the packet internally to the intended destination with the event\n@{term \"evt_deliver0\"}.\n\\end{itemize}\\\n\ndefinition\n dp0_dispatch_int\nwhere\n \"dp0_dispatch_int s m ainfo asid pas fut hist s' \\\n \\ \\guard: check that the future path is a fragment of an authorized segment. In reality,\n honest agents will always choose a path that is a prefix of an authorized segment, but for\n our models this difference is not significant.\\\n m = \\ AInfo = ainfo, past = pas, future = fut, history = hist \\ \\\n hist = [] \\\n pfragment ainfo fut auth_seg0 \\\n \\ \\action: Update the state to include m\\\n dp0_add_loc s s' asid m\"\n\ndefinition\n dp0_recv\nwhere\n \"dp0_recv s m asid ainfo hf1 downif pas fut hist s' \\\n \\ \\guard: there are at least two hop fields left, which means we can advance the packet by one\n hop.\\\n m = \\ AInfo = ainfo, past = pas, future = hf1 # fut, history = hist \\ \\\n dp0_in_chan s asid downif m \\ \n \n ASID hf1 = asid \\\n\n \\ \\action: Update state to include message\\\n dp0_add_loc s s' asid \\\n AInfo = ainfo,\n past = pas,\n future = hf1 # fut,\n history = hist\n \\\"\n\ndefinition\n dp0_send\nwhere\n \"dp0_send s m asid ainfo hf1 upif pas fut hist s' \\\n \\ \\guard: there are at least two hop fields left, which means we can advance the packet by one\n hop. \\\n m = \\ AInfo = ainfo, past = pas, future = hf1#fut, history = hist \\ \\\n m \\ (loc s) asid \\\n UpIF hf1 = Some upif \\\n ASID hf1 = asid \\\n\n \\ \\action: Update state to include modified message\\\n dp0_add_chan s s' asid upif \\\n AInfo = ainfo,\n past = hf1 # pas,\n future = fut,\n history = hf1 # hist\n \\\"\n\ntext \\This event represents the destination receiving the packet. Our properties are not expressed\nover what happens when an end hosts receives a packet (but rather what happens with a packet while\nit traverses the network).\nWe only need this event to push the last hop field from the future path into the past path, as the\ndetectability property is expressed over the past path.\\\ndefinition\n dp0_deliver\nwhere\n \"dp0_deliver s m asid ainfo hf1 pas fut hist s' \\\n m = \\ AInfo = ainfo, past = pas, future = hf1#fut, history = hist \\ \\\n ASID hf1 = asid \\\n m \\ (loc s) asid \\\n fut = [] \\\n\n \\ \\action: Update state to include modified message\\\n dp0_add_loc s s' asid \n \\\n AInfo = ainfo,\n past = hf1 # pas,\n future = [],\n history = hf1 # hist\n \\\"\n\n\\ \\Direct dispatch event. A node with asid sends a packet on its outgoing interface upif.\n\nNote that the attacker is NOT part of the real past path. However,\ndetectability is still achieved in practice, since hf (the hop field of the next AS) points with\nits downif towards the attacker node. \\\ndefinition\n dp0_dispatch_ext\nwhere\n \"dp0_dispatch_ext s m asid ainfo upif pas fut hist s' \\\n m = \\ AInfo = ainfo, past = pas, future = fut, history = hist \\ \\\n hist = [] \\\n\n pfragment ainfo fut auth_seg0 \\\n\n \\ \\action: Update state to include attacker message\\\n dp0_add_chan s s' asid upif m\"\n\n(******************************************************************************)\nsubsection \\Transition system\\\n(******************************************************************************)\n\nfun dp0_trans where\n \"dp0_trans s (evt_dispatch_int0 asid m) s' \\ \n (\\ainfo pas fut hist. dp0_dispatch_int s m ainfo asid pas fut hist s')\" |\n \"dp0_trans s (evt_recv0 asid downif m) s' \\ \n (\\ainfo hf1 pas fut hist. dp0_recv s m asid ainfo hf1 downif pas fut hist s')\" |\n \"dp0_trans s (evt_send0 asid upif m) s' \\ \n (\\ainfo hf1 pas fut hist. dp0_send s m asid ainfo hf1 upif pas fut hist s')\" |\n \"dp0_trans s (evt_deliver0 asid m) s' \\ \n (\\ainfo hf1 pas fut hist. dp0_deliver s m asid ainfo hf1 pas fut hist s')\" |\n \"dp0_trans s (evt_dispatch_ext0 asid upif m) s' \\ \n (\\ainfo pas fut hist. dp0_dispatch_ext s m asid ainfo upif pas fut hist s')\" |\n \"dp0_trans s (evt_observe0 s'') s' \\ s = s' \\ s = s''\" |\n \"dp0_trans s evt_skip0 s' \\ s = s'\"\n\ndefinition dp0_init :: \"('aahi, 'ainfo) dp0_state\" where\n \"dp0_init \\ \\chan = (\\_. {}), loc = (\\_. {})\\\"\n\ndefinition dp0 :: \"(('aahi, 'ainfo) evt0, ('aahi, 'ainfo) dp0_state) ES\" where\n \"dp0 \\ \\\n init = (=) dp0_init,\n trans = dp0_trans\n \\\"\n\nlemmas dp0_trans_defs = dp0_dispatch_int_def dp0_recv_def dp0_send_def dp0_deliver_def dp0_dispatch_ext_def\nlemmas dp0_defs = dp0_def dp0_init_def dp0_trans_defs\n\ntext\\@{text \"soup\"} is a predicate that is true for a packet m and a state s, if m is contained\nanywhere in the system (either in the local state or channels).\\\ndefinition soup where \"soup m s \\ \\x. m \\ (loc s) x \\ (\\x. m \\ (chan s) x)\" \n\ndeclare soup_def [simp]\ndeclare if_split_asm [split]\n\nlemma dp0_add_chan_msgs:\n assumes \"dp0_add_chan s s' asid upif m\" and \"soup n s'\" and \"n \\ m\"\n shows \"soup n s\"\n using assms by (auto simp add: dp0_add_chan_def)\n\n(******************************************************************************)\nsubsection \\Path authorization property\\\n(******************************************************************************)\n\ntext\\Path authorization is defined as:\nFor all messages in the system: the future path is a fragment of an authorized path. \nWe strengthen this property by including the real past path (the recorded history that can not be\nfaked by the attacker). The concatenation of these path remains invariant during forwarding, makes \nthis invariant inductive. Note that the history path is in reverse order.\\\ndefinition auth_path :: \"('aahi, 'ainfo) pkt0 \\ bool\" where\n \"auth_path m \\ pfragment (AInfo m) (rev (history m) @ future m) auth_seg0\"\n\ndefinition inv_auth :: \"('aahi, 'ainfo) dp0_state \\ bool\" where\n \"inv_auth s \\ \\m . soup m s \\ auth_path m\"\n\nlemma inv_authI: \n assumes \"\\m . soup m s \\ pfragment (AInfo m) (rev (history m) @ future m) auth_seg0\"\n shows \"inv_auth s\"\n apply(auto simp add: inv_auth_def auth_path_def)\n using assms soup_def by blast+\n\nlemma inv_authD: \n assumes \"inv_auth s\" \"soup m s\"\n shows \"pfragment (AInfo m) (rev (history m) @ future m) auth_seg0\"\n using assms by(auto simp add: inv_auth_def auth_path_def) blast\n\nlemma inv_auth_add_chan[elim!]:\n assumes \"dp0_add_chan s s' asid upif m\" and \"inv_auth s\"\n and \"pfragment (AInfo m) (rev (history m) @ future m) auth_seg0\"\n shows \"inv_auth s'\"\nproof(rule inv_authI)\n fix n\n assume \"soup n s'\"\n then show \"pfragment (AInfo n) (rev (history n) @ future n) auth_seg0\"\n using assms by(cases \"m=n\", auto dest!: dp0_add_chan_msgs dest: inv_authD)\nqed\n\nlemma inv_auth_add_loc[elim!]:\n assumes \"dp0_add_loc s s' asid m\" and \"inv_auth s\"\n and \"pfragment (AInfo m) (rev (history m) @ future m) auth_seg0\"\n shows \"inv_auth s'\"\nproof(rule inv_authI)\n fix n\n assume \"soup n s'\"\n then show \"pfragment (AInfo n) (rev (history n) @ future n) auth_seg0\"\n using assms apply(cases \"m=n\", auto 3 4 simp add: dp0_add_loc_def dest: inv_authD)\n by (meson auth_path_def inv_auth_def soup_def)\nqed\n\nlemma Inv_inv_auth: \"Inv dp0 inv_auth\"\nproof(rule Invariant_rule)\n fix s0\n show \"init dp0 s0 \\ inv_auth s0\"\n by (auto simp add: dp0_def dp0_init_def intro!: inv_authI)\nnext\n fix s e s'\n show \"\\dp0: s\\e\\ s'; inv_auth s\\ \\ inv_auth s'\"\n proof (auto simp add: dp0_def elim!: dp0_trans.elims)\n fix m asid ainfo hf1 downif pas fut hist\n assume \"inv_auth s\" \"dp0_recv s m asid ainfo hf1 downif pas fut hist s'\" \n then show \"inv_auth s'\"\n by(auto simp add: dp0_defs dp0_add_loc_def pfragment_def intro!: inv_authI dest!: inv_authD)\n (auto simp add: dp0_in_chan_def)\n qed(auto simp add: dp0_defs, auto intro: pfragment_prefix dest!: inv_authD)\nqed\n\n\nabbreviation TR_auth where \"TR_auth \\ \n {\\ | \\ . \\ s . evt_observe0 s \\ set \\ \\ inv_auth s}\"\n\nlemma tr0_satisfies_pathauthorization: \"dp0 \\\\<^sub>E\\<^sub>S TR_auth\"\n using Inv_inv_auth \n apply(intro trace_property_rule[where ?I=\"\\\\ s. \\ \\ TR_auth\"])\n apply (auto elim!: InvE simp add: inv_auth_def)\n by(auto simp add: dp0_defs elim!: dp0_trans.elims)blast+\n\ntext\\Easier to read\\\ndefinition inv_authorized :: \"('aahi, 'ainfo) dp0_state \\ bool\" where\n \"inv_authorized s \\ \\m . soup m s \\ \n (\\timestamp auth_path. (timestamp, auth_path) \\ auth_seg0 \\\n (\\pre post. auth_path = pre @ (rev (history m)) @ post ))\"\n\nlemma \"inv_auth s \\ inv_authorized s\"\n apply (auto simp add: inv_authorized_def inv_auth_def) \n by (metis auth_path_def pfragment_def pfragment_prefix)+\n\n(******************************************************************************)\nsubsection \\Detectability property\\\n(******************************************************************************)\n\ntext\\The attacker sending a packet to another AS is not part of the real path.\nHowever, the next hop's interface will point to the attacker AS (if the hop field is valid), thus\nthe attacker remains identifiable.\\\n\ntext\\Detectability, the first property: the past real path is a prefix of the past path\\\ndefinition inv_detect :: \"('aahi, 'ainfo) dp0_state \\ bool\" where\n \"inv_detect s \\ \\m . soup m s \\ prefix (history m) (past m)\"\n\nlemma inv_detectI: \n assumes \"\\m x . soup m s \\ prefix (history m) (past m)\" \n shows \"inv_detect s\"\n using assms by(auto simp add: inv_detect_def)\n\nlemma inv_detectD: \n assumes \"inv_detect s\"\n shows \"\\m x .m \\ (loc s) x \\ prefix (history m) (past m)\" \n and \"\\m x .m \\ (chan s) x \\ prefix (history m) (past m)\"\n using assms by(auto simp add: inv_detect_def) blast\n\nlemma inv_detect_add_chan[elim!]:\n assumes \"dp0_add_chan s s' asid upif m\" \"inv_detect s\" \"prefix (history m) (past m)\"\n shows \"inv_detect s'\"\nproof(rule inv_detectI)\n fix n\n assume \"soup n s'\"\n then show \"prefix (history n) (past n)\"\n using assms by(cases \"m=n\", auto dest!: dp0_add_chan_msgs dest: inv_detectD)\nqed\n\nlemma inv_detect_add_loc[elim!]:\n assumes \"dp0_add_loc s s' asid m\" \"inv_detect s\" \"prefix (history m) (past m)\"\n shows \"inv_detect s'\"\nproof(rule inv_detectI)\n fix n\n assume \"soup n s'\"\n then show \"prefix (history n) (past n)\"\n using assms by(cases \"m=n\", auto 3 4 simp add: dp0_add_loc_def dest: inv_detectD)\nqed\n\nlemma Inv_inv_detect: \"Inv dp0 inv_detect\"\nproof (rule InvI, erule reach.induct)\n fix s0\n show \"init dp0 s0 \\ inv_detect s0\"\n by (auto simp add: dp0_def dp0_init_def intro!: inv_detectI)\n next\n fix s e s'\n show \"\\dp0: s\\e\\ s'; inv_detect s\\ \\ inv_detect s'\"\n by(auto simp add: dp0_defs elim!: dp0_trans.elims)\n (fastforce simp add: dp0_in_chan_def dest: inv_detectD)+\nqed\n\nabbreviation TR_detect where \"TR_detect \\ {\\ | \\ . \\ s . evt_observe0 s \\ set \\ \\ inv_detect s}\"\n\nlemma tr0_satisfies_detectability: \"dp0 \\\\<^sub>E\\<^sub>S TR_detect\"\n using Inv_inv_detect \n by(intro trace_property_rule[where ?I=\"\\\\ s. \\ \\ TR_detect\"])\n (fastforce simp add: dp0_defs dp0_in_chan_def elim!: dp0_trans.elims dest: inv_detectD)+\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/Parametrized_Dataplane_0.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3702253786982541, "lm_q1q2_score": 0.1937834969033229}} {"text": "(* Title: JinjaThreads/Execute/JVM_Execute.thy\n Author: Andreas Lochbihler\n*)\n\ntheory JVM_Execute\nimports\n SC_Schedulers\n JVMExec_Execute\n \"../BV/BVProgressThreaded\"\nbegin\n\nabbreviation sc_heap_read_cset :: \"heap \\ addr \\ addr_loc \\ addr val set\"\nwhere \"sc_heap_read_cset h ad al \\ set_of_pred (sc_heap_read_i_i_i_o h ad al)\"\n\nabbreviation sc_heap_write_cset :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap set\"\nwhere \"sc_heap_write_cset h ad al v \\ set_of_pred (sc_heap_write_i_i_i_i_o h ad al v)\"\n\ninterpretation sc!: \n JVM_heap_execute\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read_cset\"\n \"sc_heap_write_cset\"\n for P\n where \"\\h ad al v. v \\ sc_heap_read_cset h ad al \\ sc_heap_read h ad al v\"\n and \"\\h ad al v h'. h' \\ sc_heap_write_cset h ad al v \\ sc_heap_write h ad al v h'\"\napply(simp_all add: eval_sc_heap_read_i_i_i_o eval_sc_heap_write_i_i_i_i_o)\ndone\n\ninterpretation sc_execute!: \n JVM_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n for P\nby(unfold_locales)\n\nfun sc_mexec :: \n \"addr jvm_prog \\ thread_id \\ (addr jvm_thread_state \\ heap) \n \\ ((addr, thread_id, heap) jvm_thread_action \\ addr jvm_thread_state \\ heap) Predicate.pred\"\nwhere \n \"sc_mexec P t ((xcp, frs), h) =\n sc.exec_1 (TYPE(addr jvm_method)) P P t (xcp, h, frs) \\= (\\(ta, xcp, h, frs). Predicate.single (ta, (xcp, frs), h))\"\n\nabbreviation sc_jvm_start_state_refine :: \n \"addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (addr, thread_id, heap, (thread_id, (addr jvm_thread_state) \\ addr released_locks) rm, (thread_id, addr wait_set_status) rm, thread_id rs) state_refine\"\nwhere\n \"sc_jvm_start_state_refine \\ \n sc_start_state_refine (rm_empty ()) rm_update (rm_empty ()) (rs_empty ()) (\\C M Ts T (mxs, mxl0, b) vs. (None, [([], Null # vs @ replicate mxl0 undefined_value, C, M, 0)]))\"\n\nabbreviation sc_jvm_state_invar :: \"addr jvm_prog \\ ty\\<^sub>P \\ (addr,thread_id,addr jvm_thread_state,heap,addr) state set\"\nwhere \"sc_jvm_state_invar P \\ \\ {s. sc_execute.correct_state_ts P \\ (thr s) (shr s)}\"\n\nlemma eval_sc_mexec:\n \"(\\t xm ta x'm'. Predicate.eval (sc_mexec P t xm) (ta, x'm')) = \n (\\t ((xcp, frs), h) ta ((xcp', frs'), h'). sc.execute.exec_1 (TYPE(addr jvm_method)) P P t (xcp, h, frs) ta (xcp', h', frs'))\"\nby(rule ext)+(fastforce intro!: SUP1_I simp add: sc.exec_1_eq')\n\nlemma sc_jvm_start_state_invar: \n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n and \"sc_wf_start_state P C M vs\"\n shows \"sc_state_\\ (sc_jvm_start_state_refine P C M vs) \\ sc_jvm_state_invar P \\\"\nusing sc_execute.correct_jvm_state_initial[OF assms]\nby(simp add: sc_execute.correct_jvm_state_def)\n\nsubsection {* Round-robin scheduler *}\n\ninterpretation JVM_rr!: \n sc_round_robin_base\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rr_JVM_start_state :: \"nat \\ 'm prog \\ thread_id fifo round_robin\"\nwhere \"sc_rr_JVM_start_state n0 P = JVM_rr.round_robin_start n0 (sc_start_tid P)\"\n\ndefinition exec_JVM_rr ::\n \"nat \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list, \n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state \\ addr released_locks) rm \\ heap) \\\n (thread_id, addr wait_set_status) rm \\ thread_id rs) tllist\"\nwhere\n \"exec_JVM_rr n0 P C M vs = JVM_rr.exec P n0 (sc_rr_JVM_start_state n0 P) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rr!:\n sc_round_robin \n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rr:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows\n \"sc_scheduler \n JVM_final (sc_mexec P) convert_RA\n (JVM_rr.round_robin P n0) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) JVM_rr.round_robin_invar\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rr.round_robin_scheduler)\napply(unfold eval_sc_mexec)\napply(rule sc_execute.mexec_deterministic[OF assms sc_deterministic_heap_ops])\napply(simp add: sc_spurious_wakeups)\ndone\n\nsubsection {* Random scheduler *}\n\ninterpretation JVM_rnd!: \n sc_random_scheduler_base\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rnd_JVM_start_state :: \"Random.seed \\ random_scheduler\"\nwhere \"sc_rnd_JVM_start_state seed = seed\"\n\ndefinition exec_JVM_rnd ::\n \"Random.seed \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list,\n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state \\ addr released_locks) rm \\ heap) \\\n (thread_id, addr wait_set_status) rm \\ thread_id rs) tllist\"\nwhere \"exec_JVM_rnd seed P C M vs = JVM_rnd.exec P (sc_rnd_JVM_start_state seed) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rnd!:\n sc_random_scheduler\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rnd:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows \n \"sc_scheduler\n JVM_final (sc_mexec P) convert_RA\n (JVM_rnd.random_scheduler P) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) (\\_ _. True)\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rnd.random_scheduler_scheduler)\napply(unfold eval_sc_mexec)\napply(rule sc_execute.mexec_deterministic[OF assms sc_deterministic_heap_ops])\napply(simp add: sc_spurious_wakeups)\ndone\n\nML_val {* @{code exec_JVM_rr} *}\n\nML_val {* @{code exec_JVM_rnd} *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Execute/JVM_Execute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.3040416686603661, "lm_q1q2_score": 0.19368390155157078}} {"text": "(* Title: HOL/Auth/n_germanish_lemma_on_inv__1.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanish Protocol Case Study*} \n\ntheory n_germanish_lemma_on_inv__1 imports n_germanish_base\nbegin\nsection{*All lemmas on causal relation between inv__1 and some rule r*}\nlemma n_t3Vsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_t3 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t3 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t4Vsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_t4 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t4 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t5Vsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_t5 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t5 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t6Vsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_t6 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t6 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''cache'') p__Inv0)) (Const exclusive)) (eqn (IVar (Ident ''home_exclusive_granted'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''cache'') p__Inv2)) (Const exclusive)) (eqn (IVar (Ident ''home_exclusive_granted'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t2Vsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_t2 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_t1Vsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_t1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/germanish/n_germanish_lemma_on_inv__1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.38121956625614994, "lm_q1q2_score": 0.1935878186402452}} {"text": "theory Example_Forte14\nimports \"../TopoS_Impl\"\nbegin\n\n\n\ndefinition policy :: \"string list_graph\" where\n \"policy \\ \\ nodesL = [''CC'', ''C1'', ''C2'', ''IFEsrv'', ''IFE1'', ''IFE2'', ''SAT'', ''Wifi'', ''P1'', ''P2'' ],\n edgesL = [(''CC'', ''C1''), (''CC'', ''C2''), (''CC'', ''IFEsrv''), (''C1'', ''CC''), \n (''C1'', ''C2''), (''C2'', ''CC''), (''C2'', ''C1''), \n (''IFEsrv'', ''IFE1''), (''IFEsrv'', ''IFE2''), (''IFEsrv'', ''SAT''), (''IFEsrv'', ''Wifi''),\n (''IFE1'', ''IFEsrv''), (''IFE2'', ''IFEsrv''), \n (''Wifi'', ''IFEsrv''), (''Wifi'', ''SAT''), (''Wifi'', ''P1''),\n (''Wifi'', ''P2''), (''P1'', ''Wifi''), (''P1'', ''P2''), (''P2'', ''Wifi''), (''P2'', ''P1'')\n ] \\\"\n\nlemma \"wf_list_graph policy\" by eval\n\n(*21 rules*)\nlemma \"length (edgesL policy) = 21\" by eval\n\n\ndefinition DomainHierarchy_m::\"(string SecurityInvariant)\" where\n \"DomainHierarchy_m \\ new_configured_list_SecurityInvariant SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\ \n node_properties = [\n ''CC'' \\ DN (''aircraft''--''crew''--Leaf, 1),\n ''C1'' \\ DN (''aircraft''--''crew''--Leaf, 0),\n ''C2'' \\ DN (''aircraft''--''crew''--Leaf, 0),\n ''IFEsrv'' \\ DN (''aircraft''--''entertain''--Leaf, 0),\n ''IFE1'' \\ DN (''aircraft''--''entertain''--Leaf, 0),\n ''IFE2'' \\ DN (''aircraft''--''entertain''--Leaf, 0),\n ''SAT'' \\ DN (''aircraft''--''entertain''--''INET''--Leaf, 0),\n ''Wifi'' \\ DN (''aircraft''--''entertain''--''POD''--Leaf, 1),\n ''P1'' \\ DN (''aircraft''--''entertain''--''POD''--Leaf, 0),\n ''P2'' \\ DN (''aircraft''--''entertain''--''POD''--Leaf, 0)\n ]\n \\ ''Device Hierarchy''\"\n text\\sanity check that the host attributes correspond to the desired hierarchy\\\n lemma \"DomainHierarchyNG_sanity_check_config\n (map snd [\n (''CC'', DN (''aircraft''--''crew''--Leaf, 1)),\n (''C1'', DN (''aircraft''--''crew''--Leaf, 0)),\n (''C2'', DN (''aircraft''--''crew''--Leaf, 0)),\n (''IFEsrv'', DN (''aircraft''--''entertain''--Leaf, 0)),\n (''IFE1'', DN (''aircraft''--''entertain''--Leaf, 0)),\n (''IFE2'', DN (''aircraft''--''entertain''--Leaf, 0)),\n (''SAT'', DN (''aircraft''--''entertain''--''INET''--Leaf, 0)),\n (''Wifi'', DN (''aircraft''--''entertain''--''POD''--Leaf, 1)),\n (''P1'', DN (''aircraft''--''entertain''--''POD''--Leaf, 0)),\n (''P2'', DN (''aircraft''--''entertain''--''POD''--Leaf, 0))\n ])\n (\n Department ''aircraft'' [\n Department ''entertain'' [\n Department ''POD'' [], Department ''INET'' []\n ],\n Department ''crew'' []\n ])\" by eval\n\ndefinition PolEnforcePoint_m::\"(string SecurityInvariant)\" where\n \"PolEnforcePoint_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_PolEnforcePointExtended \\ \n node_properties = [''IFEsrv'' \\ SINVAR_SecGwExt.PolEnforcePointIN,\n ''IFE1'' \\ SINVAR_SecGwExt.DomainMember,\n ''IFE2'' \\ SINVAR_SecGwExt.DomainMember]\n \\ ''IFEsrc mediates access of its thin clients''\"\n\n\n(*\n0 - unclassified\n1 - confidential\n2 - secret\n3 - topsecret\n*)\ndefinition BLP_m::\"(string SecurityInvariant)\" where\n \"BLP_m \\ new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\ \n node_properties = [''CC'' \\ \\ security_level = 2, trusted = False \\,\n ''C1'' \\ \\ security_level = 2, trusted = False \\,\n ''C2'' \\ \\ security_level = 2, trusted = False \\,\n ''IFE1'' \\ \\ security_level = 1, trusted = False \\,\n ''IFE2'' \\ \\ security_level = 1, trusted = False \\,\n ''IFEsrv'' \\ \\ security_level = 0, trusted = True \\]\n \\ ''Confidential data''\"\n\ndefinition \"security_invariants = [ DomainHierarchy_m, PolEnforcePoint_m, BLP_m]\"\n\nlemma \"all_security_requirements_fulfilled security_invariants policy\" by eval\n\nlemma \"implc_get_offending_flows security_invariants policy = []\" by eval\n\n\ntext\\\nVisualization with a violation.\n\\\nML\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"policy\\edgesL := (''P1'', ''CC'')#edgesL policy\\\"};\n\\\n\n\n\n\n\n\ndefinition \"max_policy = generate_valid_topology security_invariants \\nodesL = nodesL policy, edgesL = List.product (nodesL policy) (nodesL policy) \\\"\n\n\ntext\\calculating the maximum policy\\\nvalue \"max_policy\"\n\n\ntext\\\nThe diff to the maximum policy. It adds reflexive flows and the IFEsrv may send to the PODs.\n\\\nML_val\\\nvisualize_edges @{context} @{term \"edgesL policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"[e \\ edgesL max_policy. e \\ set (edgesL policy)]\"})] \"\"; \n\\\n\n\ntext\\\nVisualizing the maximum policy.\n\\\nML\\\nvisualize_graph @{context} @{term \"security_invariants\"} @{term \"max_policy\"};\n\\\n\nlemma \"all_security_requirements_fulfilled security_invariants policy\" by eval\nlemma \"all_security_requirements_fulfilled security_invariants max_policy\" by eval\n\n\nsubsection\\A stateful implementation\\\ndefinition \"stateful_policy = generate_valid_stateful_policy_IFSACS policy security_invariants\"\nvalue \"stateful_policy\"\n\nML_val\\\nvisualize_edges @{context} @{term \"flows_fixL stateful_policy\"} \n [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL stateful_policy\"})] \"\"; \n\\\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Examples/Example_Forte14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.32423540551084407, "lm_q1q2_score": 0.19338474303921938}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_on_inv__30.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_on_inv__30 imports n_germanSymIndex_base\nbegin\nsection{*All lemmas on causal relation between inv__30 and some rule r*}\nlemma n_SendInv__part__0Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Ident ''ExGntd'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__30:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_on_inv__30.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.193313430294804}} {"text": "theory Outer_Friend_Issuer_Openness\n imports Outer_Friend_Issuer_State_Indistinguishability\nbegin\n\nsubsubsection \\Dynamic declassification trigger\\\n\ncontext OuterFriendIssuer\nbegin\n\ntext \\The dynamic declassification trigger condition holds, i.e.~the access window to the\nconfidential information is open, while an observer is a local friend of the user \\UID\\.\\\n\ndefinition \"open\" :: \"state \\ bool\"\nwhere \"open s \\ \\uid \\ UIDs AID. uid \\\\ friendIDs s UID\"\n\nlemma open_step_cases:\nassumes \"open s \\ open s'\"\nand \"step s a = (ou, s')\"\nobtains\n (OpenF) uid p uid' where \"a = Cact (cFriend uid p uid')\" \"ou = outOK\" \"p = pass s uid\"\n \"uid \\ UIDs AID \\ uid' = UID \\ uid = UID \\ uid' \\ UIDs AID\"\n \"open s'\" \"\\open s\"\n| (CloseF) uid p uid' where \"a = Dact (dFriend uid p uid')\" \"ou = outOK\" \"p = pass s uid\"\n \"uid \\ UIDs AID \\ uid' = UID \\ uid = UID \\ uid' \\ UIDs AID\"\n \"open s\" \"\\open s'\"\nusing assms proof (cases a)\n case (Uact ua) then show ?thesis using assms by (cases ua) (auto simp: u_defs open_def) next\n case (COMact ca) then show ?thesis using assms by (cases ca) (auto simp: com_defs open_def) next\n case (Sact sa)\n then show ?thesis using assms by (cases sa) (auto simp: s_defs open_def)\nnext\n case (Cact ca)\n then show ?thesis using assms proof (cases ca)\n case (cFriend uid p uid')\n then show ?thesis using Cact assms by (intro OpenF) (auto simp: c_defs open_def)\n qed (auto simp: c_defs open_def)\nnext\n case (Dact da)\n then show ?thesis using assms proof (cases da)\n case (dFriend uid p uid')\n then show ?thesis using Dact assms by (intro CloseF) (auto simp: d_defs open_def)\n qed\nqed auto\n\nlemma COMact_open:\nassumes \"step s a = (ou, s')\"\nand \"a = COMact ca\"\nshows \"open s = open s'\"\nby (rule ccontr, insert assms, elim open_step_cases, auto)\n\nlemma eqButUID_open_eq: \"eqButUID s s1 \\ open s = open s1\"\nusing open_def eqButUID_def by auto\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Outer_Friend_Confidentiality/Issuer/Outer_Friend_Issuer_Openness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.3486451217982255, "lm_q1q2_score": 0.19331342792320652}} {"text": "section \\Frame Inference\\\ntheory Sepref_Frame\nimports Sepref_Basic Sepref_Constraints\nbegin\n text \\ In this theory, we provide a specific frame inference tactic\n for Sepref.\n\n The first tactic, \\frame_tac\\, is a standard frame inference tactic, \n based on the assumption that only @{const hn_ctxt}-assertions need to be\n matched.\n\n The second tactic, \\merge_tac\\, resolves entailments of the form\n \\F1 \\\\<^sub>A F2 \\\\<^sub>t ?F\\\n that occur during translation of if and case statements.\n It synthesizes a new frame ?F, where refinements of variables \n with equal refinements in \\F1\\ and \\F2\\ are preserved,\n and the others are set to @{const hn_invalid}.\n \\\n\ndefinition mismatch_assn :: \"('a \\ 'c \\ assn) \\ ('a \\ 'c \\ assn) \\ 'a \\ 'c \\ assn\"\n where \"mismatch_assn R1 R2 x y \\ R1 x y \\\\<^sub>A R2 x y\"\n\nabbreviation \"hn_mismatch R1 R2 \\ hn_ctxt (mismatch_assn R1 R2)\"\n\nlemma recover_pure_aux: \"CONSTRAINT is_pure R \\ hn_invalid R x y \\\\<^sub>t hn_ctxt R x y\"\n by (auto simp: is_pure_conv invalid_pure_recover hn_ctxt_def)\n\n\n\nlemma frame_thms:\n \"P \\\\<^sub>t P\"\n \"P\\\\<^sub>tP' \\ F\\\\<^sub>tF' \\ F*P \\\\<^sub>t F'*P'\"\n \"hn_ctxt R x y \\\\<^sub>t hn_invalid R x y\"\n \"hn_ctxt R x y \\\\<^sub>t hn_ctxt (\\_ _. true) x y\"\n \"CONSTRAINT is_pure R \\ hn_invalid R x y \\\\<^sub>t hn_ctxt R x y\"\n apply -\n applyS simp\n applyS (rule entt_star_mono; assumption)\n subgoal\n apply (simp add: hn_ctxt_def)\n apply (rule enttI)\n apply (rule ent_trans[OF invalidate[of R]])\n by solve_entails\n applyS (sep_auto simp: hn_ctxt_def) \n applyS (erule recover_pure_aux)\n done\n\nnamed_theorems_rev sepref_frame_match_rules \\Sepref: Additional frame rules\\\n\ntext \\Rules to discharge unmatched stuff\\\n(*lemma frame_rem_thms:\n \"P \\\\<^sub>t P\"\n \"P \\\\<^sub>t emp\"\n by sep_auto+\n*)\nlemma frame_rem1: \"P\\\\<^sub>tP\" by simp\n\nlemma frame_rem2: \"F \\\\<^sub>t F' \\ F * hn_ctxt A x y \\\\<^sub>t F' * hn_ctxt A x y\"\n apply (rule entt_star_mono) by auto\n\nlemma frame_rem3: \"F \\\\<^sub>t F' \\ F * hn_ctxt A x y \\\\<^sub>t F'\"\n using frame_thms(2) by fastforce\n \nlemma frame_rem4: \"P \\\\<^sub>t emp\" by simp\n\nlemmas frame_rem_thms = frame_rem1 frame_rem2 frame_rem3 frame_rem4\n\nnamed_theorems_rev sepref_frame_rem_rules\n \\Sepref: Additional rules to resolve remainder of frame-pairing\\\n\nlemma ent_disj_star_mono:\n \"\\ A \\\\<^sub>A C \\\\<^sub>A E; B \\\\<^sub>A D \\\\<^sub>A F \\ \\ A*B \\\\<^sub>A C*D \\\\<^sub>A E*F\"\n by (metis ent_disjI1 ent_disjI2 ent_disjE ent_star_mono) \n\nlemma entt_disj_star_mono:\n \"\\ A \\\\<^sub>A C \\\\<^sub>t E; B \\\\<^sub>A D \\\\<^sub>t F \\ \\ A*B \\\\<^sub>A C*D \\\\<^sub>t E*F\"\nproof -\n assume a1: \"A \\\\<^sub>A C \\\\<^sub>t E\"\n assume \"B \\\\<^sub>A D \\\\<^sub>t F\"\n then have \"A * B \\\\<^sub>A C * D \\\\<^sub>A true * E * (true * F)\"\n using a1 by (simp add: ent_disj_star_mono enttD)\n then show ?thesis\n by (metis (no_types) assn_times_comm enttI merge_true_star_ctx star_aci(3))\nqed\n \n\n\nlemma hn_merge1:\n (*\"emp \\\\<^sub>A emp \\\\<^sub>A emp\"*)\n \"F \\\\<^sub>A F \\\\<^sub>t F\"\n \"\\ hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt R x x'; Fl \\\\<^sub>A Fr \\\\<^sub>t F \\ \n \\ Fl * hn_ctxt R1 x x' \\\\<^sub>A Fr * hn_ctxt R2 x x' \\\\<^sub>t F * hn_ctxt R x x'\"\n apply simp\n by (rule entt_disj_star_mono; simp)\n\nlemma hn_merge2:\n \"hn_invalid R x x' \\\\<^sub>A hn_ctxt R x x' \\\\<^sub>t hn_invalid R x x'\"\n \"hn_ctxt R x x' \\\\<^sub>A hn_invalid R x x' \\\\<^sub>t hn_invalid R x x'\"\n by (sep_auto eintros: invalidate ent_disjE intro!: ent_imp_entt simp: hn_ctxt_def)+\n\nlemma invalid_assn_mono: \"hn_ctxt A x y \\\\<^sub>t hn_ctxt B x y \n \\ hn_invalid A x y \\\\<^sub>t hn_invalid B x y\"\n by (clarsimp simp: invalid_assn_def entailst_def entails_def hn_ctxt_def)\n (force simp: mod_star_conv)\n\nlemma hn_merge3: (* Not used *)\n \"\\NO_MATCH (hn_invalid XX) R2; hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt Rm x x'\\ \\ hn_invalid R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_invalid Rm x x'\"\n \"\\NO_MATCH (hn_invalid XX) R1; hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_ctxt Rm x x'\\ \\ hn_ctxt R1 x x' \\\\<^sub>A hn_invalid R2 x x' \\\\<^sub>t hn_invalid Rm x x'\"\n apply (meson entt_disjD1 entt_disjD2 entt_disjE entt_trans frame_thms(3) invalid_assn_mono) \n apply (meson entt_disjD1 entt_disjD2 entt_disjE entt_trans frame_thms(3) invalid_assn_mono) \n done\n\nlemmas merge_thms = hn_merge1 hn_merge2 \n\nnamed_theorems sepref_frame_merge_rules \\Sepref: Additional merge rules\\\n\n\nlemma hn_merge_mismatch: \"hn_ctxt R1 x x' \\\\<^sub>A hn_ctxt R2 x x' \\\\<^sub>t hn_mismatch R1 R2 x x'\"\n by (sep_auto simp: hn_ctxt_def mismatch_assn_def)\n\nlemma is_merge: \"P1\\\\<^sub>AP2\\\\<^sub>tP \\ P1\\\\<^sub>AP2\\\\<^sub>tP\" .\n\nlemma merge_mono: \"\\A\\\\<^sub>tA'; B\\\\<^sub>tB'; A'\\\\<^sub>AB' \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson entt_disjE entt_disjI1_direct entt_disjI2_direct entt_trans)\n \ntext \\Apply forward rule on left or right side of merge\\\nlemma gen_merge_cons1: \"\\A\\\\<^sub>tA'; A'\\\\<^sub>AB \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson merge_mono entt_refl)\n\nlemma gen_merge_cons2: \"\\B\\\\<^sub>tB'; A\\\\<^sub>AB' \\\\<^sub>t C\\ \\ A\\\\<^sub>AB \\\\<^sub>t C\"\n by (meson merge_mono entt_refl)\n \nlemmas gen_merge_cons = gen_merge_cons1 gen_merge_cons2\n\n\ntext \\These rules are applied to recover pure values that have been destroyed by rule application\\\n\ndefinition \"RECOVER_PURE P Q \\ P \\\\<^sub>t Q\"\n\nlemma recover_pure:\n \"RECOVER_PURE emp emp\"\n \"\\RECOVER_PURE P2 Q2; RECOVER_PURE P1 Q1\\ \\ RECOVER_PURE (P1*P2) (Q1*Q2)\"\n \"CONSTRAINT is_pure R \\ RECOVER_PURE (hn_invalid R x y) (hn_ctxt R x y)\"\n \"RECOVER_PURE (hn_ctxt R x y) (hn_ctxt R x y)\"\n unfolding RECOVER_PURE_def\n subgoal by sep_auto\n subgoal by (drule (1) entt_star_mono)\n subgoal by (rule recover_pure_aux)\n subgoal by sep_auto\n done\n \nlemma recover_pure_triv: \n \"RECOVER_PURE P P\"\n unfolding RECOVER_PURE_def by sep_auto\n\n\ntext \\Weakening the postcondition by converting @{const invalid_assn} to @{term \"\\_ _. true\"}\\\ndefinition \"WEAKEN_HNR_POST \\ \\' \\'' \\ (\\h. h\\\\) \\ (\\'' \\\\<^sub>t \\')\"\n\nlemma weaken_hnr_postI:\n assumes \"WEAKEN_HNR_POST \\ \\'' \\'\"\n assumes \"hn_refine \\ c \\' R a\"\n shows \"hn_refine \\ c \\'' R a\"\n apply (rule hn_refine_preI)\n apply (rule hn_refine_cons_post)\n apply (rule assms)\n using assms(1) unfolding WEAKEN_HNR_POST_def by blast\n\nlemma weaken_hnr_post_triv: \"WEAKEN_HNR_POST \\ P P\"\n unfolding WEAKEN_HNR_POST_def\n by sep_auto\n\nlemma weaken_hnr_post:\n \"\\WEAKEN_HNR_POST \\ P P'; WEAKEN_HNR_POST \\' Q Q'\\ \\ WEAKEN_HNR_POST (\\*\\') (P*Q) (P'*Q')\"\n \"WEAKEN_HNR_POST (hn_ctxt R x y) (hn_ctxt R x y) (hn_ctxt R x y)\"\n \"WEAKEN_HNR_POST (hn_ctxt R x y) (hn_invalid R x y) (hn_ctxt (\\_ _. true) x y)\"\nproof (goal_cases)\n case 1 thus ?case\n unfolding WEAKEN_HNR_POST_def\n apply clarsimp\n apply (rule entt_star_mono) \n by (auto simp: mod_star_conv)\nnext\n case 2 thus ?case by (rule weaken_hnr_post_triv)\nnext\n case 3 thus ?case \n unfolding WEAKEN_HNR_POST_def \n by (sep_auto simp: invalid_assn_def hn_ctxt_def)\nqed\n\n\n\nlemma reorder_enttI:\n assumes \"A*true = C*true\"\n assumes \"B*true = D*true\"\n shows \"(A\\\\<^sub>tB) \\ (C\\\\<^sub>tD)\"\n apply (intro eq_reflection)\n unfolding entt_def_true\n by (simp add: assms)\n \n \n\nlemma merge_sat1: \"(A\\\\<^sub>AA' \\\\<^sub>t Am) \\ (A\\\\<^sub>AAm \\\\<^sub>t Am)\"\n using entt_disjD1 entt_disjE by blast\nlemma merge_sat2: \"(A\\\\<^sub>AA' \\\\<^sub>t Am) \\ (Am\\\\<^sub>AA' \\\\<^sub>t Am)\"\n using entt_disjD2 entt_disjE by blast\n\n\n\n\n\nML \\\nsignature SEPREF_FRAME = sig\n\n\n (* Check if subgoal is a frame obligation *)\n (*val is_frame : term -> bool *)\n (* Check if subgoal is a merge obligation *)\n val is_merge: term -> bool\n (* Perform frame inference *)\n val frame_tac: (Proof.context -> tactic') -> Proof.context -> tactic'\n (* Perform merging *)\n val merge_tac: (Proof.context -> tactic') -> Proof.context -> tactic'\n\n val frame_step_tac: (Proof.context -> tactic') -> bool -> Proof.context -> tactic'\n\n (* Reorder frame *)\n val prepare_frame_tac : Proof.context -> tactic'\n (* Solve a RECOVER_PURE goal, inserting constraints as necessary *)\n val recover_pure_tac: Proof.context -> tactic'\n\n (* Split precondition of hnr-goal into frame and arguments *)\n val align_goal_tac: Proof.context -> tactic'\n (* Normalize goal's precondition *)\n val norm_goal_pre_tac: Proof.context -> tactic'\n (* Rearrange precondition of hnr-term according to parameter order, normalize all relations *)\n val align_rl_conv: Proof.context -> conv\n\n (* Convert hn_invalid to \\_ _. true in postcondition of hnr-goal. Makes proving the goal easier.*)\n val weaken_post_tac: Proof.context -> tactic'\n\n val add_normrel_eq : thm -> Context.generic -> Context.generic\n val del_normrel_eq : thm -> Context.generic -> Context.generic\n val get_normrel_eqs : Proof.context -> thm list\n\n val cfg_debug: bool Config.T\n\n val setup: theory -> theory\nend\n\n\nstructure Sepref_Frame : SEPREF_FRAME = struct\n\n val cfg_debug = \n Attrib.setup_config_bool @{binding sepref_debug_frame} (K false)\n\n val DCONVERSION = Sepref_Debugging.DBG_CONVERSION cfg_debug\n val dbg_msg_tac = Sepref_Debugging.dbg_msg_tac cfg_debug\n\n\n structure normrel_eqs = Named_Thms (\n val name = @{binding sepref_frame_normrel_eqs}\n val description = \"Equations to normalize relations for frame matching\"\n )\n\n val add_normrel_eq = normrel_eqs.add_thm\n val del_normrel_eq = normrel_eqs.del_thm\n val get_normrel_eqs = normrel_eqs.get\n\n val mk_entailst = HOLogic.mk_binrel @{const_name \"entailst\"}\n\n\n local\n open Sepref_Basic Refine_Util Conv\n \n fun assn_ord p = case apply2 dest_hn_ctxt_opt p of\n (NONE,NONE) => EQUAL\n | (SOME _, NONE) => LESS\n | (NONE, SOME _) => GREATER\n | (SOME (_,a,_), SOME (_,a',_)) => Term_Ord.fast_term_ord (a,a')\n\n in\n fun reorder_ctxt_conv ctxt ct = let\n val cert = Thm.cterm_of ctxt\n\n val new_ct = Thm.term_of ct \n |> strip_star\n |> sort assn_ord\n |> list_star\n |> cert\n\n val thm = Goal.prove_internal ctxt [] (mk_cequals (ct,new_ct)) \n (fn _ => simp_tac \n (put_simpset HOL_basic_ss ctxt addsimps @{thms star_aci}) 1)\n\n in\n thm\n end\n \n fun prepare_fi_conv ctxt ct = case Thm.term_of ct of\n @{mpat \"?P \\\\<^sub>t ?Q\"} => let\n val cert = Thm.cterm_of ctxt\n \n (* Build table from abs-vars to ctxt *)\n val (Qm, Qum) = strip_star Q |> filter_out is_true |> List.partition is_hn_ctxt\n\n val Qtab = (\n Qm |> map (fn x => (#2 (dest_hn_ctxt x),(NONE,x))) \n |> Termtab.make\n ) handle\n e as (Termtab.DUP _) => (\n tracing (\"Dup heap: \" ^ @{make_string} ct); raise e)\n \n (* Go over entries in P and try to find a partner *)\n val (Qtab,Pum) = fold (fn a => fn (Qtab,Pum) => \n case dest_hn_ctxt_opt a of\n NONE => (Qtab,a::Pum)\n | SOME (_,p,_) => ( case Termtab.lookup Qtab p of\n SOME (NONE,tg) => (Termtab.update (p,(SOME a,tg)) Qtab, Pum)\n | _ => (Qtab,a::Pum)\n )\n ) (strip_star P) (Qtab,[])\n\n val Pum = filter_out is_true Pum\n\n (* Read out information from Qtab *)\n val (pairs,Qum2) = Termtab.dest Qtab |> map #2 \n |> List.partition (is_some o #1)\n |> apfst (map (apfst the))\n |> apsnd (map #2)\n \n (* Build reordered terms: P' = fst pairs * Pum, Q' = snd pairs * (Qum2*Qum) *)\n val P' = mk_star (list_star (map fst pairs), list_star Pum)\n val Q' = mk_star (list_star (map snd pairs), list_star (Qum2@Qum))\n \n val new_ct = mk_entailst (P', Q') |> cert\n \n val msg_tac = dbg_msg_tac (Sepref_Debugging.msg_allgoals \"Solving frame permutation\") ctxt 1\n val tac = msg_tac THEN ALLGOALS (resolve_tac ctxt @{thms reorder_enttI}) THEN star_permute_tac ctxt\n\n val thm = Goal.prove_internal ctxt [] (mk_cequals (ct,new_ct)) (fn _ => tac)\n \n in \n thm\n end\n | _ => no_conv ct\n \n end\n\n fun is_merge @{mpat \"Trueprop (_ \\\\<^sub>A _ \\\\<^sub>t _)\"} = true | is_merge _ = false\n fun is_gen_frame @{mpat \"Trueprop (_ \\\\<^sub>t _)\"} = true | is_gen_frame _ = false\n\n\n fun prepare_frame_tac ctxt = let\n open Refine_Util Conv\n val frame_ss = put_simpset HOL_basic_ss ctxt addsimps \n @{thms mult_1_right[where 'a=assn] mult_1_left[where 'a=assn]}\n in\n CONVERSION Thm.eta_conversion THEN'\n (*CONCL_COND' is_frame THEN'*)\n simp_tac frame_ss THEN'\n CONVERSION (HOL_concl_conv (fn _ => prepare_fi_conv ctxt) ctxt)\n end \n\n\n local\n fun wrap_side_tac side_tac dbg tac = tac THEN_ALL_NEW_FWD (\n CONCL_COND' is_gen_frame \n ORELSE' (if dbg then TRY_SOLVED' else SOLVED') side_tac\n )\n in \n fun frame_step_tac side_tac dbg ctxt = let\n open Refine_Util Conv\n\n (* Constraint solving is built-in *)\n val side_tac = Sepref_Constraints.constraint_tac ctxt ORELSE' side_tac ctxt\n\n val frame_thms = @{thms frame_thms} @\n Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_frame_match_rules} \n val merge_thms = @{thms merge_thms} @\n Named_Theorems.get ctxt @{named_theorems sepref_frame_merge_rules}\n val ss = put_simpset HOL_basic_ss ctxt addsimps normrel_eqs.get ctxt\n fun frame_thm_tac dbg = wrap_side_tac side_tac dbg (resolve_tac ctxt frame_thms)\n fun merge_thm_tac dbg = wrap_side_tac side_tac dbg (resolve_tac ctxt merge_thms)\n \n fun thm_tac dbg = CONCL_COND' is_merge THEN_ELSE' (merge_thm_tac dbg, frame_thm_tac dbg)\n in\n full_simp_tac ss THEN' thm_tac dbg\n end\n end \n\n fun frame_loop_tac side_tac ctxt = let\n\n in\n TRY o (\n REPEAT_ALL_NEW (DETERM o frame_step_tac side_tac false ctxt)\n )\n end\n\n\n fun frame_tac side_tac ctxt = let\n open Refine_Util Conv\n val frame_rem_thms = @{thms frame_rem_thms}\n @ Named_Theorems_Rev.get ctxt @{named_theorems_rev sepref_frame_rem_rules}\n val solve_remainder_tac = TRY o REPEAT_ALL_NEW (DETERM o resolve_tac ctxt frame_rem_thms)\n in\n (prepare_frame_tac ctxt\n THEN' resolve_tac ctxt @{thms ent_star_mono entt_star_mono})\n THEN_ALL_NEW_LIST [\n frame_loop_tac side_tac ctxt,\n solve_remainder_tac\n ] \n end\n\n fun merge_tac side_tac ctxt = let\n open Refine_Util Conv\n val merge_conv = arg1_conv (binop_conv (reorder_ctxt_conv ctxt))\n in\n CONVERSION Thm.eta_conversion THEN'\n CONCL_COND' is_merge THEN'\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms star_aci}) THEN'\n CONVERSION (HOL_concl_conv (fn _ => merge_conv) ctxt) THEN'\n frame_loop_tac side_tac ctxt\n end\n\n val setup = normrel_eqs.setup\n\n local\n open Sepref_Basic\n fun is_invalid @{mpat \"hn_invalid _ _ _ :: assn\"} = true | is_invalid _ = false\n fun contains_invalid @{mpat \"Trueprop (RECOVER_PURE ?Q _)\"} = exists is_invalid (strip_star Q)\n | contains_invalid _ = false\n\n in\n fun recover_pure_tac ctxt = \n CONCL_COND' contains_invalid THEN_ELSE' (\n REPEAT_ALL_NEW (DETERM o (resolve_tac ctxt @{thms recover_pure} ORELSE' Sepref_Constraints.constraint_tac ctxt)),\n resolve_tac ctxt @{thms recover_pure_triv}\n )\n end\n\n local\n open Sepref_Basic Refine_Util\n datatype cte = Other of term | Hn of term * term * term\n fun dest_ctxt_elem @{mpat \"hn_ctxt ?R ?a ?c\"} = Hn (R,a,c)\n | dest_ctxt_elem t = Other t\n\n fun mk_ctxt_elem (Other t) = t \n | mk_ctxt_elem (Hn (R,a,c)) = @{mk_term \"hn_ctxt ?R ?a ?c\"}\n\n fun match x (Hn (_,y,_)) = x aconv y\n | match _ _ = false\n\n fun dest_with_frame (*ctxt*) _ t = let\n val (P,c,Q,R,a) = dest_hn_refine t\n \n val (_,(_,args)) = dest_hnr_absfun a\n val pre_ctes = strip_star P |> map dest_ctxt_elem\n \n val (pre_args,frame) = \n (case split_matching match args pre_ctes of\n NONE => raise TERM(\"align_conv: Could not match all arguments\",[P,a])\n | SOME x => x)\n\n in\n ((frame,pre_args),c,Q,R,a)\n end\n \n fun align_goal_conv_aux ctxt t = let\n val ((frame,pre_args),c,Q,R,a) = dest_with_frame ctxt t\n val P' = apply2 (list_star o map mk_ctxt_elem) (frame,pre_args) |> mk_star\n val t' = mk_hn_refine (P',c,Q,R,a)\n in t' end \n\n fun align_rl_conv_aux ctxt t = let\n val ((frame,pre_args),c,Q,R,a) = dest_with_frame ctxt t\n\n val _ = frame = [] orelse raise TERM (\"align_rl_conv: Extra preconditions in rule\",[t,list_star (map mk_ctxt_elem frame)])\n\n val P' = list_star (map mk_ctxt_elem pre_args)\n val t' = mk_hn_refine (P',c,Q,R,a)\n in t' end \n\n\n fun normrel_conv ctxt = let\n val ss = put_simpset HOL_basic_ss ctxt addsimps normrel_eqs.get ctxt\n in\n Simplifier.rewrite ss\n end\n\n in\n fun align_goal_conv ctxt = f_tac_conv ctxt (align_goal_conv_aux ctxt) (star_permute_tac ctxt)\n\n fun norm_goal_pre_conv ctxt = let\n open Conv\n val nr_conv = normrel_conv ctxt\n in\n HOL_concl_conv (fn _ => hn_refine_conv nr_conv all_conv all_conv all_conv all_conv) ctxt\n end \n\n fun norm_goal_pre_tac ctxt = CONVERSION (norm_goal_pre_conv ctxt)\n\n fun align_rl_conv ctxt = let\n open Conv\n val nr_conv = normrel_conv ctxt\n in\n HOL_concl_conv (fn ctxt => f_tac_conv ctxt (align_rl_conv_aux ctxt) (star_permute_tac ctxt)) ctxt\n then_conv HOL_concl_conv (K (hn_refine_conv nr_conv all_conv nr_conv nr_conv all_conv)) ctxt\n end\n\n fun align_goal_tac ctxt = \n CONCL_COND' is_hn_refine_concl \n THEN' DCONVERSION ctxt (HOL_concl_conv align_goal_conv ctxt)\n end\n\n\n fun weaken_post_tac ctxt = TRADE (fn ctxt =>\n resolve_tac ctxt @{thms weaken_hnr_postI} \n THEN' SOLVED' (REPEAT_ALL_NEW (DETERM o resolve_tac ctxt @{thms weaken_hnr_post weaken_hnr_post_triv}))\n ) ctxt\n\nend\n\\\n\nsetup Sepref_Frame.setup\n\nmethod_setup weaken_hnr_post = \\Scan.succeed (fn ctxt => SIMPLE_METHOD' (Sepref_Frame.weaken_post_tac ctxt))\\\n \\Convert \"hn_invalid\" to \"hn_ctxt (\\_ _. true)\" in postcondition of hn_refine goal\\\n\n(* TODO: Improper, modifies all h\\_ premises that happen to be there. Use tagging to protect! *)\nmethod extract_hnr_invalids = (\n rule hn_refine_preI,\n ((drule mod_starD hn_invalidI | elim conjE exE)+)?\n) \\ \\Extract \\hn_invalid _ _ _ = true\\ preconditions from \\hn_refine\\ goal.\\\n \n\n\nlemmas [sepref_frame_normrel_eqs] = the_pure_pure pure_the_pure\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Sepref_Frame.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.36658975016245987, "lm_q1q2_score": 0.19330883800856077}} {"text": "(* Title: Jinja/Compiler/J1.thy\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nchapter \\Compilation \\label{cha:comp}\\\n\nsection \\An Intermediate Language\\\n\ntheory J1 imports \"../J/BigStep\" begin\n\ntype_synonym expr\\<^sub>1 = \"nat exp\"\ntype_synonym J\\<^sub>1_prog = \"expr\\<^sub>1 prog\"\ntype_synonym state\\<^sub>1 = \"heap \\ (val list)\"\n\nprimrec\n max_vars :: \"'a exp \\ nat\"\n and max_varss :: \"'a exp list \\ nat\"\nwhere\n \"max_vars(new C) = 0\"\n| \"max_vars(Cast C e) = max_vars e\"\n| \"max_vars(Val v) = 0\"\n| \"max_vars(e\\<^sub>1 \\bop\\ e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(Var V) = 0\"\n| \"max_vars(V:=e) = max_vars e\"\n| \"max_vars(e\\F{D}) = max_vars e\"\n| \"max_vars(FAss e\\<^sub>1 F D e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(e\\M(es)) = max (max_vars e) (max_varss es)\"\n| \"max_vars({V:T; e}) = max_vars e + 1\"\n| \"max_vars(e\\<^sub>1;;e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(if (e) e\\<^sub>1 else e\\<^sub>2) =\n max (max_vars e) (max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2))\"\n| \"max_vars(while (b) e) = max (max_vars b) (max_vars e)\"\n| \"max_vars(throw e) = max_vars e\"\n| \"max_vars(try e\\<^sub>1 catch(C V) e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2 + 1)\"\n\n| \"max_varss [] = 0\"\n| \"max_varss (e#es) = max (max_vars e) (max_varss es)\"\n\ninductive\n eval\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) \\/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n and evals\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) [\\]/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n for P :: J\\<^sub>1_prog\nwhere\n\n New\\<^sub>1:\n \"\\ new_Addr h = Some a; P \\ C has_fields FDTs; h' = h(a\\(C,init_fields FDTs)) \\\n \\ P \\\\<^sub>1 \\new C,(h,l)\\ \\ \\addr a,(h',l)\\\"\n| NewFail\\<^sub>1:\n \"new_Addr h = None \\\n P \\\\<^sub>1 \\new C, (h,l)\\ \\ \\THROW OutOfMemory,(h,l)\\\"\n\n| Cast\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(D,fs); P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\\"\n| CastNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\\"\n| CastFail\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\THROW ClassCast,(h,l)\\\"\n| CastThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Val\\<^sub>1:\n \"P \\\\<^sub>1 \\Val v,s\\ \\ \\Val v,s\\\"\n\n| BinOp\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v\\<^sub>2,s\\<^sub>2\\; binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>2\\\"\n| BinOpThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n| BinOpThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>2\\\"\n\n| Var\\<^sub>1:\n \"\\ ls!i = v; i < size ls \\ \\\n P \\\\<^sub>1 \\Var i,(h,ls)\\ \\ \\Val v,(h,ls)\\\"\n\n| LAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,(h,ls)\\; i < size ls; ls' = ls[i := v] \\\n \\ P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\unit,(h,ls')\\\"\n| LAssThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAcc\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,ls)\\; h a = Some(C,fs); fs(F,D) = Some v \\\n \\ P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\Val v,(h,ls)\\\"\n| FAccNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| FAccThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); fs' = fs((F,D)\\v); h\\<^sub>2' = h\\<^sub>2(a\\(C,fs')) \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h\\<^sub>2',l\\<^sub>2)\\\"\n| FAssNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| FAssThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| FAssThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| CallObjThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| CallNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| Call\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C sees M:Ts\\T = body in D;\n size vs = size Ts; ls\\<^sub>2' = (Addr a) # vs @ replicate (max_vars body) undefined;\n P \\\\<^sub>1 \\body,(h\\<^sub>2,ls\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>3)\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>2)\\\"\n| CallParamsThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\;\n es' = map Val vs @ throw ex # es\\<^sub>2 \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n\n| Block\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\ \\ P \\\\<^sub>1 \\Block i T e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\\"\n\n| Seq\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e\\<^sub>2,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n| SeqThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n\n| CondT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondF\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| WhileF\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\unit,s\\<^sub>1\\\"\n| WhileT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\Val v\\<^sub>1,s\\<^sub>2\\;\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>2\\ \\ \\e\\<^sub>3,s\\<^sub>3\\ \\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>3,s\\<^sub>3\\\"\n| WhileCondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| WhileBodyThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\\\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| Throw\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\Throw a,s\\<^sub>1\\\"\n| ThrowNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| ThrowThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Try\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\\"\n| TryCatch\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\;\n h\\<^sub>1 a = Some(D,fs); P \\ D \\\\<^sup>* C; i < length ls\\<^sub>1;\n P \\\\<^sub>1 \\e\\<^sub>2,(h\\<^sub>1,ls\\<^sub>1[i:=Addr a])\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2)\\ \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2)\\\"\n| TryThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\; h\\<^sub>1 a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\\"\n\n| Nil\\<^sub>1:\n \"P \\\\<^sub>1 \\[],s\\ [\\] \\[],s\\\"\n\n| Cons\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\Val v # es',s\\<^sub>2\\\"\n| ConsThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\throw e' # es, s\\<^sub>1\\\"\n\n(*<*)\nlemmas eval\\<^sub>1_evals\\<^sub>1_induct = eval\\<^sub>1_evals\\<^sub>1.induct [split_format (complete)]\n and eval\\<^sub>1_evals\\<^sub>1_inducts = eval\\<^sub>1_evals\\<^sub>1.inducts [split_format (complete)]\n(*>*)\n\nlemma eval\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\e\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\nand evals\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\es\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0)\\ [\\] \\es\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\n(*<*)by (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts, simp_all)(*>*)\n\n\nlemma evals\\<^sub>1_preserves_elen:\n \"\\es' s s'. P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ length es = length es'\"\n(*<*)\napply(induct es type:list)\napply (auto elim:evals\\<^sub>1.cases)\ndone\n(*>*)\n\n\nlemma eval\\<^sub>1_final: \"P \\\\<^sub>1 \\e,s\\ \\ \\e',s'\\ \\ final e'\"\n and evals\\<^sub>1_final: \"P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ finals es'\"\n(*<*)by(induct rule:eval\\<^sub>1_evals\\<^sub>1.inducts, simp_all)(*>*)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Compiler/J1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.19330882526403356}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_on_inv__33.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_on_inv__33 imports n_germanSymIndex_base\nbegin\nsection{*All lemmas on causal relation between inv__33 and some rule r*}\nlemma n_RecvReqSVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__33:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_on_inv__33.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.36658974324230986, "lm_q1q2_score": 0.19330882346683478}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__24_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__24_on_rules imports n_german_lemma_on_inv__24\nbegin\nsection{*All lemmas on causal relation between inv__24*}\nlemma lemma_inv__24_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__24 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__24) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__24_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.19330881981772544}} {"text": "theory \"Thorn_Calculus-Core_Bisimilarities\"\n imports \"Thorn_Calculus-Semantics-Synchronous\"\nbegin\n\nnamed_theorems thorn_simps\n(*FIXME: Don't name this \\<^theory_text>\\thorn_simps\\, as \\<^theory_text>\\simps\\ alsways stands for equalities. *)\n\nlemma receive_scope_extension [thorn_simps]:\n shows \"A \\ x. \\ b. \\

x b \\\\<^sub>s \\ b. A \\ x. \\

x b\"\nproof (coinduction rule: synchronous.up_to_rule [where \\ = \"[\\\\<^sub>s]\"])\n case (forward_simulation \\ S)\n then show ?case\n proof cases\n case (receiving n X)\n have \"\n A \\ tail \\ x. \\ (\\

x)\n \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ remove n\\\n post_receive n (X \\ remove n) (\\x. \\ (\\

x))\"\n using synchronous_transition.receiving .\n moreover\n have \"A \\ tail \\ x. \\ (\\

x) = \\ (\\b. A \\ x. \\

x b)\"\n unfolding tail_def\n by transfer simp\n moreover\n have \"post_receive n (X \\ remove n) (\\x. \\ (\\

x)) = \\\\<^bsub>n\\<^esub> (\\b. post_receive n X (\\x. \\

x b))\"\n unfolding post_receive_def\n by transfer (simp add: sdrop_shift)\n ultimately\n have \"\\ b. A \\ x. \\

x b \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ \\ b. post_receive n X (\\x. \\

x b)\"\n by (simp only: new_channel_io)\n moreover\n have \"\\ b. post_receive n X (\\x. \\

x b) = post_receive n X (\\x. \\ b. \\

x b)\"\n unfolding post_receive_def\n by transfer simp\n ultimately show ?thesis\n unfolding \\\\ = A \\ \\\\<^bsup>n\\<^esup> X\\ and \\S = post_receive n X (\\x. \\ b. \\

x b)\\\n by (intro exI conjI, use in assumption) simp\n qed\nnext\n case (backward_simulation \\ S)\n then show ?case\n proof cases\n case scope_opening\n from scope_opening(4) show ?thesis\n by cases\n next\n case (new_channel_io \\ A' n X \\)\n from new_channel_io(3) have \"\\ = Receiving\"\n by cases\n from new_channel_io(3) have \"A' = A\"\n by cases simp\n have \"\\ = (\\b. post_receive n X (\\x. \\

x b))\"\n proof -\n from new_channel_io(3)\n have \"\\\\<^bsub>n\\<^esub> \\ = post_receive n (X \\ remove n) (\\x. \\ (\\

x))\"\n by cases\n then have \"\\\\<^bsub>n\\<^esub> (\\\\<^bsub>n\\<^esub> \\) = \\\\<^bsub>n\\<^esub> (post_receive n (X \\ remove n) (\\x. \\ (\\

x)))\"\n by simp\n then show ?thesis\n unfolding post_receive_def\n by\n transfer\n (simp\n del: sdrop.simps(2)\n add: stake_shift sdrop_shift sdrop.simps(2) [where n = 0] stake_sdrop\n )\n qed\n have \"A \\ x. \\ b. \\

x b \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ post_receive n X (\\x. \\ b. \\

x b)\"\n using receiving .\n moreover\n have \"post_receive n X (\\x. \\ b. \\

x b) = \\ b. post_receive n X (\\x. \\

x b)\"\n unfolding post_receive_def\n by transfer simp\n ultimately show ?thesis\n unfolding\n \\\\ = IO \\ A' n X\\ and \\\\ = Receiving\\ and \\A' = A\\\n and\n \\S = \\ b. \\ b\\ and \\\\ = (\\b. post_receive n X (\\x. \\

x b))\\\n by (intro exI conjI, use in assumption) simp\n next\n case new_channel_communication\n from new_channel_communication(3) show ?thesis\n by cases\n qed\nqed respectful\n\nlemma tagged_receive_scope_extension [thorn_simps]:\n shows \"A \\ x. \\t\\ \\ b. \\

x b \\\\<^sub>s \\t\\ \\ b. A \\ x. \\

x b\"\n unfolding tagged_new_channel_def\n using receive_scope_extension .\n\nlemma new_channel_scope_extension [thorn_simps]:\n shows \"\\ a. \\ b. \\

a b \\\\<^sub>s \\ b. \\ a. \\

a b\"\nproof (coinduction arbitrary: \\

rule: synchronous.symmetric_up_to_rule [where \\ = \"[\\\\<^sub>s] \\ id\"])\n case (simulation \\ S \\

)\n then show ?case\n proof cases\n case (scope_opening i n X A)\n from \\\\ b. \\ (\\a. \\

a b) \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ move n i\\ S \\ move n i\\ show ?thesis\n proof cases\n case (scope_opening j m)\n from scope_opening(4) have \"\n \\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1\n \\\\<^sub>s\\A \\ tail \\ tail \\ move 0 1 \\ \\\\<^bsup>m\\<^esup> X \\ move (Suc m) i \\ move m j \\ on_suffix m (move 0 1)\\\n S \\ move (Suc m) i \\ move m j \\ on_suffix m (move 0 1)\"\n unfolding \\n = Suc m\\\n by (fact adapted_io_transition)\n moreover\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 = \\ (\\a. \\ (\\b. \\

a b))\"\n by transfer (simp add: comp_def)\n moreover\n have \"A \\ tail \\ tail \\ move 0 1 = A \\ tail \\ tail\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n moreover\n obtain i' and j'\n where\n \"i' \\ Suc m\"\n and\n \"j' \\ m\"\n and\n moves_rewriting: \"move (Suc m) i \\ move m j \\ move m (Suc m) = move (Suc m) i' \\ move m j'\"\n proof (cases \"i \\ j\")\n case True\n have \"\n (move (Suc m) i \\ move m j) \\ move m (Suc m)\n =\n (move (Suc m) (Suc j) \\ move (Suc m) i) \\ move m (Suc m)\"\n using \\j \\ m\\ and \\i \\ j\\\n by (simp only: outer_move_towards_front_after_move)\n also have \"\\ = move (Suc m) (Suc j) \\ (move (Suc m) i \\ move m (Suc m))\"\n by (simp only: adaptation_composition_associativity)\n also have \"\\ = move (Suc m) (Suc j) \\ move m i\"\n by (simp only: composition_as_move)\n finally show ?thesis\n using \\j \\ m\\ and \\i \\ j\\ and that [where i' = \"Suc j\" and j' = i]\n by simp\n next\n case False\n then obtain j' where \"i = Suc j'\" and \"j \\ j'\"\n by (cases i) simp_all\n have \"j' \\ m\"\n using \\i \\ n\\\n unfolding \\n = Suc m\\ and \\i = Suc j'\\\n by simp\n have \"\n move (Suc m) (Suc j') \\ move m j \\ move m (Suc m)\n =\n move (Suc m) (Suc j') \\ move m j \\ move (Suc m) m\"\n by (simp only: neighbor_commutation)\n also have \"\\ = move (Suc m) (Suc j') \\ (move m j \\ move (Suc m) m)\"\n by (simp only: adaptation_composition_associativity)\n also have \"\\ = move (Suc m) (Suc j') \\ move (Suc m) j\"\n by (simp only: composition_as_move)\n also have \"\\ = move (Suc m) j \\ move m j'\"\n using \\j' \\ m\\ and \\j \\ j'\\\n by (simp only: outer_move_towards_front_after_move)\n finally show ?thesis\n using \\j \\ m\\ and \\j' \\ m\\ and that [where i' = j and j' = j']\n unfolding \\i = Suc j'\\\n by simp\n qed\n from moves_rewriting have\n \"X \\ move (Suc m) i \\ move m j \\ on_suffix m (move 0 1) = X \\ move (Suc m) i' \\ move m j'\"\n and\n \"S \\ move (Suc m) i \\ move m j \\ on_suffix m (move 0 1) = S \\ move (Suc m) i' \\ move m j'\"\n by (simp_all add: composition_adapted [symmetric] on_suffix_move)\n moreover\n have \"dependent_on_chan_at i X \\ dependent_on_chan_at j' (X \\ move (Suc m) i')\"\n proof -\n have \"dependent_on_chan_at i X \\ dependent_on_chan_at (Suc m) (X \\ move (Suc m) i)\"\n using dependent_on_chan_at_after_source_anchored_move_adapted [symmetric] .\n also have \"\\ \\ dependent_on_chan_at (Suc m) (X \\ move (Suc m) i \\ move m j)\"\n using \\j \\ m\\\n by\n (simp\n del: dependent_on_chan_at_def\n add: dependent_on_chan_at_after_move_within_prefix_adapted\n )\n also have \"\\ \\ dependent_on_chan_at m (X \\ move (Suc m) i \\ move m j \\ move m (Suc m))\"\n using dependent_on_chan_at_after_source_anchored_move_adapted [symmetric] .\n also have \"\\ \\ dependent_on_chan_at m (X \\ move (Suc m) i' \\ move m j')\"\n using moves_rewriting\n by\n (simp only:\n composition_adapted [symmetric]\n adaptation_composition_associativity [symmetric]\n )\n also have \"\\ \\ dependent_on_chan_at j' (X \\ move (Suc m) i')\"\n using dependent_on_chan_at_after_source_anchored_move_adapted .\n finally show ?thesis .\n qed\n moreover\n have \"dependent_on_chan_at j (X \\ move (Suc m) i) \\ dependent_on_chan_at i' X\"\n proof -\n have \"\n dependent_on_chan_at j (X \\ move (Suc m) i)\n \\\n dependent_on_chan_at m (X \\ move (Suc m) i \\ move m j)\"\n using dependent_on_chan_at_after_source_anchored_move_adapted [symmetric] .\n also have \"\\ \\\n dependent_on_chan_at (Suc m) (X \\ move (Suc m) i \\ move m j \\ move (Suc m) m)\"\n using dependent_on_chan_at_after_source_anchored_move_adapted [symmetric] .\n also have \"\\ \\\n dependent_on_chan_at (Suc m) (X \\ move (Suc m) i \\ move m j \\ move m (Suc m))\"\n by (simp only: neighbor_commutation)\n also have \"\\ \\ dependent_on_chan_at (Suc m) (X \\ move (Suc m) i' \\ move m j')\"\n using moves_rewriting\n by\n (simp only:\n composition_adapted [symmetric]\n adaptation_composition_associativity [symmetric]\n )\n also have \"\\ \\ dependent_on_chan_at (Suc m) (X \\ move (Suc m) i')\"\n using \\j' \\ m\\\n by\n (simp\n del: dependent_on_chan_at_def\n add: dependent_on_chan_at_after_move_within_prefix_adapted\n )\n also have \"\\ \\ dependent_on_chan_at i' X\"\n using dependent_on_chan_at_after_source_anchored_move_adapted .\n finally show ?thesis .\n qed\n ultimately have \"\\ b. \\ a. \\

a b \\\\<^sub>s\\A \\ \\\\<^bsup>Suc (Suc m)\\<^esup> X\\ S\"\n using \\dependent_on_chan_at i X\\ and \\dependent_on_chan_at j (X \\ move n i)\\\n unfolding \\n = Suc m\\\n using \\i' \\ Suc m\\ and \\j' \\ m\\\n by (simp only: synchronous_transition.scope_opening family_uncurry_after_new_channel)\n then show ?thesis\n unfolding \\\\ = A \\ \\\\<^bsup>Suc n\\<^esup> X\\ and \\n = Suc m\\\n by (intro exI conjI, assumption) simp\n next\n case (new_channel_io \\)\n have \"S = \\ b. \\ b \\ move i n\"\n proof -\n have \"S = S \\ move n i \\ move i n\"\n by (simp only: composition_adapted [symmetric] back_and_forth_moves identity_adapted)\n also have \"\\ = (\\ b. \\ b) \\ move i n\"\n unfolding \\S \\ move n i = \\ b. \\ b\\\n using refl .\n also have \"\\ = \\ b. \\ b \\ move i n\"\n using adapted_after_new_channel .\n finally show ?thesis .\n qed\n have \"dependent_on_chan_at i X \\ dependent_on_chan_at i (X \\ remove (Suc n))\"\n proof -\n have \"dependent_on_chan_at i X \\ dependent_on_chan_at i (X \\ on_suffix (Suc n) (remove 0))\"\n using \\i \\ n\\\n by (simp only: dependent_on_chan_at_after_on_suffix_adapted)\n also have \"\\ \\ dependent_on_chan_at i (X \\ remove (Suc n))\"\n by (simp add: on_suffix_remove)\n finally show ?thesis .\n qed\n moreover\n from new_channel_io(2)\n have \"\n \\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1\n \\\\<^sub>s\\A \\ tail \\ tail \\ move 0 1 \\ \\\\<^bsup>n\\<^esup> X \\ move n i \\ remove n \\ on_suffix n (move 0 1)\\\n \\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1)\"\n by (fact adapted_io_transition)\n moreover\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 = \\ (\\a. \\ (\\b. \\

a b))\"\n by transfer (simp add: comp_def)\n moreover\n have \"A \\ tail \\ tail \\ move 0 1 = A \\ tail \\ tail\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n moreover\n have \"X \\ move n i \\ remove n \\ on_suffix n (move 0 1) = X \\ remove (Suc n) \\ move n i\"\n proof -\n have \"\n X \\ move n i \\ remove n \\ on_suffix n (move 0 1)\n =\n X \\ move n i \\ remove n \\ move (Suc n) n\"\n by (simp add: on_suffix_move neighbor_commutation)\n also have \"\\ = X \\ move n i \\ remove (Suc n)\"\n by\n (simp only:\n composition_adapted [symmetric]\n adaptation_composition_associativity\n remove_after_move\n )\n also have \"\\ = X \\ remove (Suc n) \\ move n i\"\n using \\i \\ n\\\n by (simp only: composition_adapted [symmetric] move_after_backyard_remove)\n finally show ?thesis .\n qed\n moreover\n have \"\\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1) = \\\\<^bsub>Suc n\\<^esub> (\\b. \\ b \\ move i n) \\ move n i\"\n proof -\n have \"\\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1) = \\\\<^bsub>n\\<^esub> \\ \\ move (Suc n) n\"\n by (simp add: on_suffix_move neighbor_commutation)\n also have \"\\ = \\\\<^bsub>Suc n\\<^esub> \\\"\n by (simp only: move_adapted_after_source_uncurry)\n also have \"\\ = \\\\<^bsub>Suc n\\<^esub> (\\b. \\ b \\ move i n \\ move n i)\"\n by (simp only: composition_adapted [symmetric] back_and_forth_moves identity_adapted)\n also have \"\\ = \\\\<^bsub>Suc n\\<^esub> (\\b. \\ b \\ move i n) \\ move n i\"\n using \\i \\ n\\\n by (simp only: move_adapted_after_deeper_uncurry)\n finally show ?thesis .\n qed\n ultimately have \"\\ b. \\ a. \\

a b \\\\<^sub>s\\A \\ \\\\<^bsup>Suc n\\<^esup> X\\ \\ b. \\ b \\ move i n\"\n using \\i \\ n\\ and \\dependent_on_chan_at i X\\\n by\n (simp only:\n synchronous_transition.scope_opening\n family_uncurry_after_new_channel\n synchronous_transition.new_channel_io\n )\n then show ?thesis\n unfolding \\\\ = A \\ \\\\<^bsup>Suc n\\<^esup> X\\ and \\S = \\ b. \\ b \\ move i n\\\n by (intro exI conjI, use in assumption) simp\n qed\n next\n case (new_channel_io \\ A n X \\)\n from \\\\ b. \\ (\\a. \\

a b) \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\\\ show ?thesis\n proof cases\n case (scope_opening i m)\n have \"dependent_on_chan_at i (X \\ remove (Suc m)) \\ dependent_on_chan_at i X\"\n proof -\n have \"\n dependent_on_chan_at i (X \\ remove (Suc m))\n \\\n dependent_on_chan_at i (X \\ on_suffix (Suc m) (remove 0))\"\n by (simp add: on_suffix_remove)\n also have \"\\ \\ dependent_on_chan_at i X\"\n using \\i \\ m\\\n by (simp only: dependent_on_chan_at_after_on_suffix_adapted)\n finally show ?thesis .\n qed\n moreover\n from scope_opening(5) have \"\n \\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1\n \\\\<^sub>s\\A \\ tail \\ tail \\ move 0 1 \\ \\\\<^bsup>m\\<^esup> X \\ remove (Suc m) \\ move m i \\ on_suffix m (move 0 1)\\\n \\\\<^bsub>Suc m\\<^esub> \\ \\ move m i \\ on_suffix m (move 0 1)\"\n unfolding \\n = Suc m\\\n by (fact adapted_io_transition)\n moreover\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 = \\ (\\a. \\ (\\b. \\

a b))\"\n by transfer (simp add: comp_def)\n moreover\n have \"A \\ tail \\ tail \\ move 0 1 = A \\ tail \\ tail\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n moreover\n have \"X \\ remove (Suc m) \\ move m i \\ on_suffix m (move 0 1) = X \\ move m i \\ remove m\"\n proof -\n have \"\n X \\ remove (Suc m) \\ move m i \\ on_suffix m (move 0 1)\n =\n X \\ move m i \\ remove (Suc m) \\ on_suffix m (move 0 1)\"\n using \\i \\ m\\\n by (simp only: composition_adapted [symmetric] move_after_backyard_remove)\n also have \"\\ = X \\ move m i \\ remove (Suc m) \\ move m (Suc m)\"\n by (simp add: on_suffix_move)\n also have \"\\ = X \\ move m i \\ remove m\"\n by\n (simp only:\n composition_adapted [symmetric]\n adaptation_composition_associativity\n remove_after_move\n )\n finally show ?thesis .\n qed\n moreover\n have \"\\\\<^bsub>Suc m\\<^esub> \\ \\ move m i \\ on_suffix m (move 0 1) = \\\\<^bsub>m\\<^esub> (\\a. \\ a \\ move m i)\"\n proof -\n have \"\n \\\\<^bsub>Suc m\\<^esub> \\ \\ move m i \\ on_suffix m (move 0 1)\n =\n \\\\<^bsub>Suc m\\<^esub> (\\a. \\ a \\ move m i) \\ on_suffix m (move 0 1)\"\n using \\i \\ m\\\n by (simp only: move_adapted_after_deeper_uncurry)\n also have \"\\ = \\\\<^bsub>Suc m\\<^esub> (\\a. \\ a \\ move m i) \\ move m (Suc m)\"\n by (simp add: on_suffix_move)\n also have \"\\ = \\\\<^bsub>m\\<^esub> (\\a. \\ a \\ move m i)\"\n by (simp only: move_adapted_after_source_uncurry)\n finally show ?thesis .\n qed\n ultimately have \"\\ b. \\ a. \\

a b \\\\<^sub>s\\A \\ \\\\<^bsup>Suc m\\<^esup> X\\ \\ a. \\ a\"\n using \\i \\ m\\ and \\dependent_on_chan_at i (X \\ remove n)\\\n unfolding \\n = Suc m\\\n by\n (simp only:\n synchronous_transition.new_channel_io\n family_uncurry_after_new_channel\n adapted_after_new_channel\n synchronous_transition.scope_opening\n )\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = \\ a. \\ a\\ and \\\\ = Sending\\ and \\n = Suc m\\\n by (intro exI conjI, use in assumption) simp\n next\n case (new_channel_io \\)\n have \"\\ = (\\a. \\ b. \\\\<^bsub>n\\<^esub> (\\ b) a)\"\n proof -\n have \"\\ = \\\\<^bsub>n\\<^esub> (\\\\<^bsub>n\\<^esub> \\)\"\n by (simp only: deep_curry_after_deep_uncurry pointfree_idE)\n also have \"\\ = \\\\<^bsub>n\\<^esub> (\\ b. \\ b)\"\n unfolding \\\\\\<^bsub>n\\<^esub> \\ = \\ b. \\ b\\\n using refl .\n also have \"\\ = (\\a. \\ b. \\\\<^bsub>n\\<^esub> (\\ b) a)\"\n by simp\n finally show ?thesis .\n qed\n from new_channel_io(2) have \"\n \\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1\n \\\\<^sub>s\\IO \\ (A \\ tail \\ tail \\ move 0 1) n (X \\ remove n \\ remove n \\ on_suffix n (move 0 1))\\\n \\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1)\"\n by (fact adapted_io_transition)\n moreover\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 = \\ (\\a. \\ (\\b. \\

a b))\"\n by transfer (simp add: comp_def)\n moreover\n have \"A \\ tail \\ tail \\ move 0 1 = A \\ tail \\ tail\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n moreover\n have \"X \\ remove n \\ remove n \\ on_suffix n (move 0 1) = X \\ remove n \\ remove n\"\n proof -\n have \"\n X \\ remove n \\ remove n \\ on_suffix n (move 0 1)\n =\n X \\ remove n \\ remove n \\ move (Suc n) n\"\n by (simp add: on_suffix_move neighbor_commutation)\n also have \"\\ = X \\ remove n \\ remove (Suc n)\"\n by\n (simp only:\n composition_adapted [symmetric]\n adaptation_composition_associativity\n remove_after_move\n )\n also have \"\\ = X \\ remove n \\ remove n\"\n by\n transfer\n (simp\n del: stake.simps(2) sdrop.simps(2)\n add: comp_def stake_shift sdrop_shift take_stake min_absorb1\n )\n finally show ?thesis .\n qed\n moreover\n have \"\\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1) = \\\\<^bsub>n\\<^esub> (\\a. \\\\<^bsub>n\\<^esub> (\\b. \\\\<^bsub>n\\<^esub> (\\ b) a))\"\n proof -\n have \"\\\\<^bsub>n\\<^esub> \\ \\ on_suffix n (move 0 1) = \\\\<^bsub>n\\<^esub> \\ \\ move (Suc n) n\"\n by (simp add: on_suffix_move neighbor_commutation)\n also have \"\\ = \\\\<^bsub>Suc n\\<^esub> \\\"\n by (simp only: move_adapted_after_source_uncurry)\n also have \"\\ = \\\\<^bsub>Suc n\\<^esub> (\\b. \\\\<^bsub>n\\<^esub> (\\\\<^bsub>n\\<^esub> (\\ b)))\"\n by (simp only: deep_uncurry_after_deep_curry pointfree_idE)\n also have \"\\ = \\\\<^bsub>n\\<^esub> (\\a. \\\\<^bsub>n\\<^esub> (\\b. \\\\<^bsub>n\\<^esub> (\\ b) a))\"\n by (simp only: deep_uncurry_reordering)\n finally show ?thesis .\n qed\n ultimately have \"\\ b. \\ a. \\

a b \\\\<^sub>s\\IO \\ A n X\\ \\ b. \\ a. \\\\<^bsub>n\\<^esub> (\\ b) a\"\n by\n (simp only:\n synchronous_transition.new_channel_io\n family_uncurry_after_new_channel\n deep_uncurry_after_new_channel\n )\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\ b. \\\\<^bsub>n\\<^esub> (\\ b) a)\\\n by (intro exI conjI, use in assumption) auto\n qed\n next\n case (new_channel_communication \\)\n from \\\\ b. \\ (\\a. \\

a b) \\\\<^sub>s\\\\\\ \\ \\\\ show ?thesis\n proof cases\n case (new_channel_communication \\)\n have \"\\ = (\\a. \\ b. \\ (\\ b) a)\"\n proof -\n have \"\\ = \\ (\\ \\)\"\n by simp\n also have \"\\ = \\ (\\ b. \\ b)\"\n unfolding \\\\ \\ = \\ b. \\ b\\\n using refl .\n also have \"\\ = (\\a. \\ b. \\ (\\ b) a)\"\n by simp\n finally show ?thesis .\n qed\n from new_channel_communication(2)\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 \\\\<^sub>s\\\\\\ \\ \\ \\ move 0 1\"\n by (fact adapted_communication_transition)\n moreover\n have \"\\ (\\b. \\ (\\a. \\

a b)) \\ move 0 1 = \\ (\\a. \\ (\\b. \\

a b))\"\n by transfer (simp add: comp_def)\n moreover\n have \"\\ \\ \\ move 0 1 = \\ (\\a. \\ (\\b. \\ (\\ b) a))\"\n by transfer (simp add: comp_def)\n ultimately have \"\\ b. \\ a. \\

a b \\\\<^sub>s\\\\\\ \\ b. \\ a. \\ (\\ b) a\"\n by\n (simp only:\n synchronous_transition.new_channel_communication\n family_uncurry_after_new_channel\n )\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\ b. \\ (\\ b) a)\\\n by (intro exI conjI, use in assumption) auto\n qed\n qed\nqed (respectful, iprover)\n\nlemma guarded_tagged_new_channel_scope_extension [thorn_simps]:\n assumes \"t < s\"\n shows \"\\t\\ \\ a. \\s\\ \\ b. \\

a b \\\\<^sub>s \\s\\ \\ b. \\t\\ \\ a. \\

a b\"\n unfolding tagged_new_channel_def\n using new_channel_scope_extension .\n\ncontext begin\n\nprivate lemma create_channel_power_after_neighbor_commutation_adapted:\n assumes \"Suc i < n\"\n shows \"\\\\<^bsup>n\\<^esup> (P \\ move i (Suc i)) \\\\<^sub>s \\\\<^bsup>n\\<^esup> P\"\nproof -\n have \"\\ (\\ (\\\\<^bsup>i\\<^esup> (P \\ move i (Suc i)))) = \\ (\\ (\\\\<^bsup>i\\<^esup> (P \\ on_suffix i (move 0 1))))\"\n by (simp add: on_suffix_move)\n also have \"\\ = \\ (\\ (\\\\<^bsup>i\\<^esup> P \\ move 0 1))\"\n by (simp only: adapted_after_create_channel_power)\n also have \"\\ \\\\<^sub>s \\ (\\ (\\\\<^bsup>i\\<^esup> P))\"\n using new_channel_scope_extension\n by transfer simp\n finally have \"\\\\<^bsup>Suc (Suc i)\\<^esup> (P \\ move i (Suc i)) \\\\<^sub>s \\\\<^bsup>Suc (Suc i)\\<^esup> P\"\n by simp\n with \\Suc i < n\\ show ?thesis\n by\n (auto\n dest:\n synchronous.create_channel_power_is_compatible_with_bisimilarity\n [where n = \"n - Suc (Suc i)\"]\n simp only:\n funpow_add [symmetric, THEN fun_cong, unfolded comp_def]\n Suc_leI\n le_add_diff_inverse\n add.commute\n )\nqed\n\nprivate lemma create_channel_power_after_move_away_from_front_adapted:\n assumes \"i \\ j\" and \"j < n\"\n shows \"\\\\<^bsup>n\\<^esup> (P \\ move i j) \\\\<^sub>s \\\\<^bsup>n\\<^esup> P\"\nusing \\i \\ j\\ proof (induction rule: inc_induct)\n case base\n then show ?case\n by (simp add: identity_as_move [symmetric] identity_adapted)\nnext\n case (step k)\n have \"\\\\<^bsup>n\\<^esup> (P \\ move k j) = \\\\<^bsup>n\\<^esup> (P \\ move (Suc k) j \\ move k (Suc k))\"\n by (simp only: composition_adapted [symmetric] composition_as_move)\n also have \"\\ \\\\<^sub>s \\\\<^bsup>n\\<^esup> (P \\ move (Suc k) j)\"\n using \\k < j\\ and \\j < n\\\n by (simp only: create_channel_power_after_neighbor_commutation_adapted)\n also have \"\\ \\\\<^sub>s \\\\<^bsup>n\\<^esup> P\"\n using step.IH .\n finally show ?case .\nqed\n\nlemma create_channel_power_after_move_adapted:\n assumes \"i < n\" and \"j < n\"\n shows \"\\\\<^bsup>n\\<^esup> (P \\ move i j) \\\\<^sub>s \\\\<^bsup>n\\<^esup> P\"\nproof (cases \"i \\ j\")\n case True\n with \\j < n\\ show ?thesis\n by (intro create_channel_power_after_move_away_from_front_adapted)\nnext\n case False\n have \"\\\\<^bsup>n\\<^esup> (P \\ move i j) \\\\<^sub>s \\\\<^bsup>n\\<^esup> (P \\ move i j \\ move j i)\"\n using \\i < n\\ and \\\\ i \\ j\\\n by\n (simp only:\n create_channel_power_after_move_away_from_front_adapted\n [THEN synchronous.bisimilarity_symmetry_rule]\n )\n also have \"\\ = \\\\<^bsup>n\\<^esup> P\"\n by (simp only: composition_adapted [symmetric] back_and_forth_moves identity_adapted)\n finally show ?thesis .\nqed\n\nend\n\ncontext begin\n\nprivate lemma independent_value_adjustment:\n shows\"\\\\<^bsup>n\\<^esup> (\\ a. (\\\\<^bsub>n\\<^esub> P' a \\ Q')) \\\\<^sub>s \\\\<^bsup>Suc n\\<^esup> (P' \\ Q' \\ remove n)\"\nproof -\n have \"\\\\<^bsup>n\\<^esup> (\\ a. (\\\\<^bsub>n\\<^esub> P' a \\ Q')) = \\\\<^bsup>n\\<^esup> (\\ a. (\\ (P' \\ move 0 n) a \\ Q'))\"\n by (simp only: family_curry_as_deep_curry source_curry_after_move_adapted)\n also have \"\\ = \\\\<^bsup>Suc n\\<^esup> (P' \\ move 0 n \\ Q' \\ remove 0)\"\n unfolding funpow_Suc_right\n by transfer simp\n also have \"\\ = \\\\<^bsup>Suc n\\<^esup> ((P' \\ Q' \\ remove n) \\ move 0 n)\"\n by (simp only: adapted_after_parallel composition_adapted [symmetric] remove_after_move)\n also have \"\\ \\\\<^sub>s \\\\<^bsup>Suc n\\<^esup> (P' \\ Q' \\ remove n)\"\n by (simp only: create_channel_power_after_move_adapted)\n finally show ?thesis .\nqed\n\nlemma parallel_left_scope_extension [thorn_simps]:\n shows \"\\ a. \\

a \\ Q \\\\<^sub>s \\ a. (\\

a \\ Q)\"\nproof (coinduction arbitrary: \\

Q rule: synchronous.up_to_rule [where \\ = \"[\\\\<^sub>s] \\ (\\ \\ [\\\\<^sub>s])\"])\n case (forward_simulation \\ S \\

Q)\n then show ?case\n proof cases\n case (communication \\ \\ A n X R Q')\n from \\\\ a. \\

a \\\\<^sub>s\\IO \\ A n X\\ R\\ show ?thesis\n proof cases\n case (scope_opening i m)\n from \\\\ \\ \\\\ and \\\\ = Sending\\ have \"\\ = Receiving\"\n by (cases \\) simp\n from \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\ and \\i \\ m\\ have \"Q \\\\<^sub>s\\A \\ \\\\<^bsup>Suc m\\<^esup> X \\ move m i\\ Q' \\ move m i\"\n unfolding \\\\ = Receiving\\ and \\n = Suc m\\\n by (simp only: receiving_transition_with_move_adapted_target_part)\n then have \"Q \\ remove 0 \\\\<^sub>s\\A \\ remove 0 \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ Q' \\ move m i\"\n by\n (simp add:\n receiving_transition_with_remove_adapted_source_part\n identity_as_move [symmetric]\n identity_adapted\n )\n then have \"Q \\ tail \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ Q' \\ move m i\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n with \\\\ \\

\\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ R \\ move m i\\\n have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\\\\\ \\\\<^bsup>m\\<^esup> (R \\ move m i \\ Q' \\ move m i)\"\n by (blast intro: synchronous_transition.communication)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\\\\\ \\\\<^bsup>m\\<^esup> ((R \\ Q') \\ move m i)\"\n unfolding tail_def and adapted_after_parallel\n by transfer simp\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\\\\\ \\\\<^bsup>Suc m\\<^esup> ((R \\ Q') \\ move m i)\"\n unfolding funpow.simps(2) and create_channel_def and comp_def\n by (intro new_channel_communication) simp\n moreover\n from \\i \\ m\\ have \"\\\\<^bsup>Suc m\\<^esup> (R \\ Q') \\\\<^sub>s \\\\<^bsup>Suc m\\<^esup> ((R \\ Q') \\ move m i)\"\n by\n (simp only:\n create_channel_power_after_move_adapted [THEN synchronous.bisimilarity_symmetry_rule]\n )\n ultimately show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\\\<^bsup>n\\<^esup> (R \\ Q')\\ and \\n = Suc m\\\n by (intro exI conjI, use in assumption) simp\n next\n case (new_channel_io \\

')\n from \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\\n have \"Q \\ remove 0 \\\\<^sub>s\\IO \\ (A \\ remove 0) n (X \\ remove n)\\ Q' \\ remove n\"\n using adapted_io_transition [where \\ = \"remove 0\"]\n by (simp add: on_suffix_remove)\n then have \"Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ Q' \\ remove n\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n with \\\\ \\ \\\\ and \\\\ \\

\\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\

'\\\n have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (\\\\<^bsub>n\\<^esub> \\

' \\ Q' \\ remove n)\"\n by (fact synchronous_transition.communication)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (\\\\<^bsub>n\\<^esub> (\\a. \\

' a \\ Q'))\"\n unfolding tail_def\n by transfer simp\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\\\\\ \\\\<^bsup>Suc n\\<^esup> (\\\\<^bsub>n\\<^esub> (\\a. \\

' a \\ Q'))\"\n unfolding funpow.simps(2) and create_channel_def and comp_def\n by (intro new_channel_communication) simp\n moreover\n have \"\\\\<^bsup>n\\<^esup> (\\ a. (\\

' a \\ Q')) \\\\<^sub>s \\\\<^bsup>Suc n\\<^esup> (\\\\<^bsub>n\\<^esub> (\\a. \\

' a \\ Q'))\"\n proof -\n have \"\\\\<^bsup>n\\<^esup> (\\ a. (\\

' a \\ Q')) = \\\\<^bsup>Suc n\\<^esup> (\\ (\\a. \\

' a \\ Q'))\"\n unfolding funpow_Suc_right\n by simp\n also have \"\\ \\\\<^sub>s \\\\<^bsup>Suc n\\<^esup> (\\ (\\a. \\

' a \\ Q') \\ move n 0)\"\n by (simp only: create_channel_power_after_move_adapted [symmetric])\n also have \"\\ = \\\\<^bsup>Suc n\\<^esup> (\\\\<^bsub>n\\<^esub> (\\a. \\

' a \\ Q'))\"\n by (simp only: family_uncurry_as_deep_uncurry move_adapted_after_source_uncurry)\n finally show ?thesis .\n qed\n ultimately show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\\\<^bsup>n\\<^esup> (R \\ Q')\\ and \\R = \\ a. \\

' a\\\n using power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) force\n qed\n next\n case (parallel_left_io \\ A n X R)\n from \\\\ a. \\

a \\\\<^sub>s\\IO \\ A n X\\ R\\ show ?thesis\n proof cases\n case (scope_opening i m)\n from \\\\ \\

\\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ R \\ move m i\\\n have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ R \\ move m i \\ Q \\ tail \\ suffix m\"\n by (fact synchronous_transition.parallel_left_io)\n with \\i \\ m\\\n have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>m\\<^esup> X \\ move m i\\ (R \\ Q \\ suffix (Suc m)) \\ move m i\"\n unfolding tail_def\n by\n (simp only: adapted_after_parallel composition_adapted [symmetric] suffix_after_move)\n (transfer, simp)\n with \\i \\ m\\ and \\dependent_on_chan_at i X\\\n have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\A \\ \\\\<^bsup>Suc m\\<^esup> X\\ R \\ Q \\ suffix (Suc m)\"\n by (fact synchronous_transition.scope_opening)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = R \\ Q \\ suffix n\\ and \\\\ = Sending\\ and \\n = Suc m\\\n by (intro exI conjI, use in assumption) simp\n next\n case (new_channel_io \\

')\n from \\\\ \\

\\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\

'\\\n have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\

' \\ Q \\ tail \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> (\\a. \\

' a \\ Q \\ suffix n)\"\n unfolding tail_def\n by transfer (simp add: sdrop_shift)\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\IO \\ A n X\\ \\ a. (\\

' a \\ Q \\ suffix n)\"\n by (fact synchronous_transition.new_channel_io)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = R \\ Q \\ suffix n\\ and \\R = \\ a. \\

' a\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n qed\n next\n case (parallel_left_communication R)\n from \\\\ a. \\

a \\\\<^sub>s\\\\\\ R\\ show ?thesis\n proof cases\n case (new_channel_communication \\

')\n from \\\\ \\

\\\\<^sub>s\\\\\\ \\ \\

'\\ have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\\\\\ \\ \\

' \\ Q \\ tail\"\n by (fact synchronous_transition.parallel_left_communication)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\\\\\ \\ (\\a. \\

' a \\ Q)\"\n unfolding tail_def\n by transfer simp\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\\\\\ \\ a. (\\

' a \\ Q)\"\n by (fact synchronous_transition.new_channel_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = R \\ Q\\ and \\R = \\ a. \\

' a\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n qed\n next\n case (parallel_right_io \\ A n X Q')\n from \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\\n have \"Q \\ remove 0 \\\\<^sub>s\\IO \\ (A \\ remove 0) n (X \\ remove n)\\ Q' \\ remove n\"\n using adapted_io_transition [where \\ = \"remove 0\"]\n by (simp add: on_suffix_remove)\n then have \"Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ Q' \\ remove n\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n then have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\ \\

\\ suffix n \\ Q' \\ remove n\"\n by (fact synchronous_transition.parallel_right_io)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> (\\a. \\

a \\ suffix n \\ Q')\"\n unfolding tail_def\n by transfer (simp add: sdrop_shift)\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\IO \\ A n X\\ \\ a. (\\

a \\ suffix n \\ Q')\"\n by (fact new_channel_io)\n then show ?thesis\n unfolding\n \\\\ = IO \\ A n X\\\n and\n \\S = (\\ a. \\

a) \\ suffix n \\ Q'\\ [unfolded adapted_after_new_channel]\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n next\n case (parallel_right_communication Q')\n from \\Q \\\\<^sub>s\\\\\\ Q'\\ have \"Q \\ tail \\\\<^sub>s\\\\\\ Q' \\ tail\"\n by (fact adapted_communication_transition)\n then have \"\\ \\

\\ Q \\ tail \\\\<^sub>s\\\\\\ \\ \\

\\ Q' \\ tail\"\n by (fact synchronous_transition.parallel_right_communication)\n then have \"\\ (\\a. \\

a \\ Q) \\\\<^sub>s\\\\\\ \\ (\\a. \\

a \\ Q')\"\n unfolding tail_def\n by transfer simp\n then have \"\\ a. (\\

a \\ Q) \\\\<^sub>s\\\\\\ \\ a. (\\

a \\ Q')\"\n by (fact new_channel_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\ a. \\

a \\ Q'\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n qed\nnext\n case (backward_simulation \\ S \\

Q)\n then show ?case\n proof cases\n case (scope_opening i n X A)\n from \\\\ \\

\\ Q \\ tail \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ move n i\\ S \\ move n i\\ show ?thesis\n proof cases\n case (parallel_left_io P')\n have \"S = P' \\ move i n \\ Q \\ suffix (Suc n)\"\n proof -\n have \"S = S \\ move n i \\ move i n\"\n by (simp only: composition_adapted [symmetric] back_and_forth_moves identity_adapted)\n also have \"\\ = (P' \\ Q \\ suffix (Suc n)) \\ move i n\"\n unfolding \\S \\ move n i = P' \\ Q \\ tail \\ suffix n\\ and tail_def\n by transfer simp\n also have \"\\ = P' \\ move i n \\ Q \\ suffix (Suc n)\"\n using \\i \\ n\\\n by (simp only: adapted_after_parallel composition_adapted [symmetric] suffix_after_move)\n finally show ?thesis .\n qed\n from \\i \\ n\\ and \\dependent_on_chan_at i X\\ and \\\\ \\

\\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ move n i\\ P'\\\n have \"\\ a. \\

a \\\\<^sub>s\\A \\ \\\\<^bsup>Suc n\\<^esup> X\\ P' \\ move i n\"\n by\n (simp only:\n synchronous_transition.scope_opening\n composition_adapted [symmetric]\n back_and_forth_moves identity_adapted\n )\n then have \"\\ a. \\

a \\ Q \\\\<^sub>s\\A \\ \\\\<^bsup>Suc n\\<^esup> X\\ P' \\ move i n \\ Q \\ suffix (Suc n)\"\n by (fact synchronous_transition.parallel_left_io)\n then show ?thesis\n unfolding \\\\ = A \\ \\\\<^bsup>Suc n\\<^esup> X\\ and \\S = P' \\ move i n \\ Q \\ suffix (Suc n)\\\n by (intro exI conjI, use in assumption) simp\n next\n case (parallel_right_io R)\n from \\Q \\ tail \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ move n i\\ R\\\n obtain Y where \"X \\ move n i = Y \\ on_suffix n tail\"\n by (elim sending_transition_from_adapted)\n have \"X = Y \\ remove i\"\n proof -\n have \"X = X \\ move n i \\ move i n\"\n by (simp only: composition_adapted [symmetric] back_and_forth_moves identity_adapted)\n also have \"\\ = Y \\ remove n \\ move i n\"\n unfolding \\X \\ move n i = Y \\ on_suffix n tail\\ and tail_def\n by transfer (simp add: comp_def)\n also have \"\\ = Y \\ remove i\"\n by (simp only: composition_adapted [symmetric] remove_after_move)\n finally show ?thesis .\n qed\n with \\dependent_on_chan_at i X\\ have False\n by transfer (simp add: stake_shift sdrop_shift)\n then show ?thesis\n by (fact FalseE)\n qed\n next\n case (new_channel_io \\ A n X \\)\n from \\\\ \\

\\ Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\\\ show ?thesis\n proof cases\n case (parallel_left_io P')\n have \"\\ = (\\a. \\\\<^bsub>n\\<^esub> P' a \\ Q \\ suffix n)\"\n proof -\n have \"\\ = \\\\<^bsub>n\\<^esub> (\\\\<^bsub>n\\<^esub> \\)\"\n by (simp only: deep_curry_after_deep_uncurry pointfree_idE)\n also have \"\\ = \\\\<^bsub>n\\<^esub> (P' \\ Q \\ suffix (Suc n))\"\n unfolding \\\\\\<^bsub>n\\<^esub> \\ = P' \\ Q \\ tail \\ suffix n\\ and tail_def\n by transfer simp\n also have \"\\ = (\\a. \\\\<^bsub>n\\<^esub> P' a \\ Q \\ suffix n)\"\n by transfer (simp del: shift_simps(2), unfold sdrop_stl, simp add: sdrop_shift)\n finally show ?thesis .\n qed\n from \\\\ \\

\\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ P'\\\n have \"\\ a. \\

a \\\\<^sub>s\\IO \\ A n X\\ \\ a. \\\\<^bsub>n\\<^esub> P' a\"\n by\n (simp only:\n deep_uncurry_after_deep_curry\n pointfree_idE\n synchronous_transition.new_channel_io\n )\n then have \"\\ a. \\

a \\ Q \\\\<^sub>s\\IO \\ A n X\\ \\ a. \\\\<^bsub>n\\<^esub> P' a \\ Q \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\\\<^bsub>n\\<^esub> P' a \\ Q \\ suffix n)\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n next\n case (parallel_right_io U)\n have \"\\ = (\\a. \\

a \\ suffix n \\ \\\\<^bsub>n\\<^esub> U a)\"\n proof -\n have \"\\ = \\\\<^bsub>n\\<^esub> (\\\\<^bsub>n\\<^esub> \\)\"\n by (simp only: deep_curry_after_deep_uncurry pointfree_idE)\n also have \"\\ = \\\\<^bsub>n\\<^esub> (\\ \\

\\ suffix n \\ U)\"\n unfolding \\\\\\<^bsub>n\\<^esub> \\ = \\ \\

\\ suffix n \\ U\\\n using refl .\n also have \"\\ = (\\a. \\

a \\ suffix n \\ \\\\<^bsub>n\\<^esub> U a)\"\n by transfer (simp del: shift_simps(2), unfold sdrop_stl, simp add: sdrop_shift)\n finally show ?thesis .\n qed\n from \\Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ U\\\n have \"Q \\ tail \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ on_suffix n tail)\\ U\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n then obtain Q' where \"U = Q' \\ on_suffix n tail\" and \"Q \\\\<^sub>s\\IO \\ A n X\\ Q'\"\n by\n (cases \\)\n (\n blast elim: sending_transition_from_adapted,\n blast elim: adapted_receiving_transition_from_adapted\n )\n from \\U = Q' \\ on_suffix n tail\\ have \"U = Q' \\ remove n\"\n unfolding tail_def\n by transfer (simp add: comp_def)\n then have \"\\ = (\\a. \\

a \\ suffix n \\ Q')\"\n unfolding \\\\ = (\\a. \\

a \\ suffix n \\ \\\\<^bsub>n\\<^esub> U a)\\\n by transfer (simp del: shift_simps(2) add: stake_shift sdrop_shift stake_sdrop)\n from \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\ have \"\\ a. \\

a \\ Q \\\\<^sub>s\\IO \\ A n X\\ (\\ a. \\

a) \\ suffix n \\ Q'\"\n by (fact synchronous_transition.parallel_right_io)\n then show ?thesis\n unfolding\n adapted_after_new_channel\n and\n \\\\ = IO \\ A n X\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\

a \\ suffix n \\ Q')\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n qed\n next\n case (new_channel_communication \\)\n from \\\\ \\

\\ Q \\ tail \\\\<^sub>s\\\\\\ \\ \\\\ show ?thesis\n proof cases\n case (communication \\ \\ A' n X' P' U)\n show ?thesis\n proof (cases \\)\n case Sending\n from \\\\ \\ \\\\ and \\\\ = Sending\\ have \"\\ = Receiving\"\n by (cases \\) simp\n from \\Q \\ tail \\\\<^sub>s\\IO \\ A' n X'\\ U\\ obtain A\n where \"A' = A \\ tail\" and \"Q \\ remove 0 \\\\<^sub>s\\A \\ remove 0 \\ \\\\<^bsup>n\\<^esup> X'\\ U\"\n unfolding tail_def and \\\\ = Receiving\\\n by (elim receiving_transition_from_adapted, transfer, simp add: comp_def)\n show ?thesis\n proof (cases \"dependent_on_chan_at n X'\")\n case True\n from \\\\ \\

\\\\<^sub>s\\IO \\ A' n X'\\ P'\\ have \"\\ \\

\\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X' \\ move n n\\ P' \\ move n n\"\n unfolding \\\\ = Sending\\ and \\A' = A \\ tail\\\n by (simp only: identity_as_move [symmetric] identity_adapted)\n with \\dependent_on_chan_at n X'\\ have \"\\ a. \\

a \\\\<^sub>s\\A \\ \\\\<^bsup>Suc n\\<^esup> X'\\ P'\"\n by (simp only: scope_opening [where i = n])\n moreover\n from \\Q \\ remove 0 \\\\<^sub>s\\A \\ remove 0 \\ \\\\<^bsup>n\\<^esup> X'\\ U\\ have \"Q \\\\<^sub>s\\A \\ \\\\<^bsup>Suc n\\<^esup> X'\\ U\"\n by\n (simp add:\n receiving_transition_with_remove_adapted_source_part\n identity_as_move [symmetric]\n identity_adapted\n )\n ultimately have \"\\ a. \\

a \\ Q \\\\<^sub>s\\\\\\ \\\\<^bsup>Suc n\\<^esup> (P' \\ U)\"\n by (blast intro: synchronous_transition.communication)\n then show ?thesis\n unfolding\n funpow.simps(2) and new_channel_as_create_channel and comp_def\n and\n \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ \\ = \\\\<^bsup>n\\<^esup> (P' \\ U)\\\n by (intro exI conjI, use in assumption) simp\n next\n case False\n then obtain X where \"X' = X \\ remove n\"\n by (erule not_dependent_on_chan_at)\n from \\\\ \\

\\\\<^sub>s\\IO \\ A' n X'\\ P'\\\n have left_transition: \"\\ a. \\

a \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ \\ a. \\\\<^bsub>n\\<^esub> P' a\"\n unfolding \\\\ = Sending\\ and \\A' = A \\ tail\\ and \\X' = X \\ remove n\\\n by (simp only: new_channel_io deep_uncurry_after_deep_curry pointfree_idE)\n from \\Q \\ remove 0 \\\\<^sub>s\\A \\ remove 0 \\ \\\\<^bsup>n\\<^esup> X'\\ U\\\n have \"Q \\ remove 0 \\\\<^sub>s\\A \\ remove 0 \\ \\\\<^bsup>n\\<^esup> X \\ on_suffix n (remove 0)\\ U\"\n unfolding \\X' = X \\ remove n\\\n by (simp add: on_suffix_remove)\n then obtain Q'\n where \"U = Q' \\ on_suffix n (remove 0)\" and right_transition: \"Q \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ Q'\"\n by (erule adapted_receiving_transition_from_adapted)\n from \\U = Q' \\ on_suffix n (remove 0)\\ have \"U = Q' \\ remove n\"\n by (simp add: on_suffix_remove)\n from left_transition and right_transition\n have \"\\ a. \\

a \\ Q \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (\\ a. \\\\<^bsub>n\\<^esub> P' a \\ Q')\"\n by (blast intro: synchronous_transition.communication)\n then show ?thesis\n unfolding\n new_channel_as_create_channel and comp_def\n and\n \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ \\ = \\\\<^bsup>n\\<^esup> (P' \\ U)\\ and \\U = Q' \\ remove n\\\n using\n independent_value_adjustment [where n = n and P' = P' and Q' = Q']\n and\n power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) force\n qed\n next\n case Receiving\n from \\\\ \\ \\\\ and \\\\ = Receiving\\ have \"\\ = Sending\"\n by (cases \\) simp_all\n from \\Q \\ tail \\\\<^sub>s\\IO \\ A' n X'\\ U\\\n obtain A and X and Q'\n where\n \"A' = A \\ tail\"\n and\n \"X' = X \\ on_suffix n tail\"\n and\n \"U = Q' \\ on_suffix n tail\"\n and\n \"Q \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ Q'\"\n unfolding \\\\ = Sending\\\n by (erule sending_transition_from_adapted)\n from \\X' = X \\ on_suffix n tail\\ and \\U = Q' \\ on_suffix n tail\\\n have \"X' = X \\ remove n\" and \"U = Q' \\ remove n\"\n unfolding tail_def\n by (transfer, simp add: comp_def)+\n from \\\\ \\

\\\\<^sub>s\\IO \\ A' n X'\\ P'\\ have \"\\ a. \\

a \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ \\ a. \\\\<^bsub>n\\<^esub> P' a\"\n unfolding \\\\ = Receiving\\ and \\A' = A \\ tail\\ and \\X' = X \\ remove n\\\n by (simp only: new_channel_io deep_uncurry_after_deep_curry pointfree_idE)\n with \\Q \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ Q'\\ have \"\\ a. \\

a \\ Q \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (\\ a. \\\\<^bsub>n\\<^esub> P' a \\ Q')\"\n by (blast intro: synchronous_transition.communication)\n then show ?thesis\n unfolding\n new_channel_as_create_channel and comp_def\n and\n \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ \\ = \\\\<^bsup>n\\<^esup> (P' \\ U)\\ and \\U = Q' \\ remove n\\\n using\n independent_value_adjustment [where n = n and P' = P' and Q' = Q']\n and\n power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) force\n qed\n next\n case (parallel_left_communication P')\n have \"\\ = (\\a. \\ P' a \\ Q)\"\n proof -\n have \"\\ = \\ (\\ \\)\"\n by simp\n also have \"\\ = \\ (P' \\ Q \\ tail)\"\n unfolding \\\\ \\ = P' \\ Q \\ tail\\\n using refl .\n also have \"\\ = (\\a. \\ P' a \\ Q)\"\n unfolding tail_def\n by transfer simp\n finally show ?thesis .\n qed\n from \\\\ \\

\\\\<^sub>s\\\\\\ P'\\ have \"\\ a. \\

a \\\\<^sub>s\\\\\\ \\ a. \\ P' a\"\n by (intro synchronous_transition.new_channel_communication) simp\n then have \"\\ a. \\

a \\ Q \\\\<^sub>s\\\\\\ \\ a. \\ P' a \\ Q\"\n by (fact synchronous_transition.parallel_left_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\ P' a \\ Q)\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n next\n case (parallel_right_communication U)\n have \"\\ = (\\a. \\

a \\ \\ U a)\"\n proof -\n have \"\\ = \\ (\\ \\)\"\n by simp\n also have \"\\ = \\ (\\ \\

\\ U)\"\n unfolding \\\\ \\ = \\ \\

\\ U\\\n using refl .\n also have \"\\ = (\\a. \\

a \\ \\ U a)\"\n by simp\n finally show ?thesis .\n qed\n from \\Q \\ tail \\\\<^sub>s\\\\\\ U\\ obtain Q' where \"U = Q' \\ tail\" and \"Q \\\\<^sub>s\\\\\\ Q'\"\n by (erule communication_transition_from_adapted)\n have \"\\ = (\\a. \\

a \\ Q')\"\n unfolding \\\\ = (\\a. \\

a \\ \\ U a)\\ and \\U = Q' \\ tail\\ and tail_def\n by transfer simp\n from \\Q \\\\<^sub>s\\\\\\ Q'\\ have \"\\ a. \\

a \\ Q \\\\<^sub>s\\\\\\ \\ a. \\

a \\ Q'\"\n by (fact synchronous_transition.parallel_right_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\ a. \\ a\\ and \\\\ = (\\a. \\

a \\ Q')\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) force\n qed\n qed\nqed respectful\n\nend\n\nlemma tagged_parallel_left_scope_extension [thorn_simps]:\n shows \"\\t\\ \\ a. \\

a \\ Q \\\\<^sub>s \\t\\ \\ a. (\\

a \\ Q)\"\n unfolding tagged_new_channel_def\n using parallel_left_scope_extension .\n\nlemma parallel_right_scope_extension [thorn_simps]:\n shows \"P \\ \\ a. \\ a \\\\<^sub>s \\ a. (P \\ \\ a)\"\nproof -\n have \"P \\ \\ a. \\ a \\\\<^sub>s \\ a. \\ a \\ P\"\n using parallel_commutativity .\n also have \"\\ \\\\<^sub>s \\ a. (\\ a \\ P)\"\n using parallel_left_scope_extension .\n also have \"\\ \\\\<^sub>s \\ a. (P \\ \\ a)\"\n using parallel_commutativity\n by process_family_equivalence\n finally show ?thesis .\nqed\n\nlemma tagged_parallel_right_scope_extension [thorn_simps]:\n shows \"P \\ \\t\\ \\ a. \\ a \\\\<^sub>s \\t\\ \\ a. (P \\ \\ a)\"\n unfolding tagged_new_channel_def\n using parallel_right_scope_extension .\n\ncontext begin\n\nprivate lemma communication_with_rightmost_adjustment:\n shows \"\\\\<^bsup>n\\<^esup> (Q \\ suffix n \\ T) \\\\<^sub>s Q \\ \\\\<^bsup>n\\<^esup> T\"\nproof (induction n arbitrary: T)\n case 0\n show ?case\n by transfer simp\nnext\n case (Suc n)\n have \"\\\\<^bsup>Suc n\\<^esup> (Q \\ suffix (Suc n) \\ T) \\\\<^sub>s \\\\<^bsup>n\\<^esup> (\\ a. (Q \\ suffix n \\ \\ T a))\"\n unfolding funpow_Suc_right\n by transfer simp\n also have \"\\ \\\\<^sub>s \\\\<^bsup>n\\<^esup> (Q \\ suffix n \\ \\ a. \\ T a)\"\n by\n (blast intro:\n parallel_right_scope_extension\n synchronous.bisimilarity_symmetry_rule\n synchronous.create_channel_power_is_compatible_with_bisimilarity\n )\n also have \"\\ \\\\<^sub>s Q \\ \\\\<^bsup>n\\<^esup> (\\ a. \\ T a)\"\n using Suc.IH .\n also have \"\\ \\\\<^sub>s Q \\ \\\\<^bsup>Suc n\\<^esup> T\"\n unfolding funpow_Suc_right\n by simp\n finally show ?case .\nqed\n\nlemma parallel_left_commutativity [thorn_simps]:\n shows \"P \\ (Q \\ R) \\\\<^sub>s Q \\ (P \\ R)\"\nproof (coinduction arbitrary: P Q R rule: synchronous.symmetric_up_to_rule [where \\ = \"[\\\\<^sub>s] \\ \\ \\ [\\\\<^sub>s]\"])\n case (simulation \\ S P Q R)\n then show ?case\n proof cases\n case (communication \\ \\ A n X P' U)\n from \\Q \\ R \\\\<^sub>s\\IO \\ A n X\\ U\\ show ?thesis\n proof cases\n case (parallel_left_io Q')\n from \\P \\\\<^sub>s\\IO \\ A n X\\ P'\\ have \"P \\ R \\\\<^sub>s\\IO \\ A n X\\ P' \\ R \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n with \\\\ \\ \\\\ and \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\ have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (Q' \\ (P' \\ R \\ suffix n))\"\n by (intro synchronous_transition.communication [where \\ = \\ and \\ = \\]) simp\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\\\<^bsup>n\\<^esup> (P' \\ U)\\ and \\U = Q' \\ R \\ suffix n\\\n using power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io R')\n from \\\\ \\ \\\\ and \\P \\\\<^sub>s\\IO \\ A n X\\ P'\\ and \\R \\\\<^sub>s\\IO \\ A n X\\ R'\\\n have \"P \\ R \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (P' \\ R')\"\n by (fact synchronous_transition.communication)\n then have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ Q \\ \\\\<^bsup>n\\<^esup> (P' \\ R')\"\n by (fact parallel_right_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\\\<^bsup>n\\<^esup> (P' \\ U)\\ and \\U = Q \\ suffix n \\ R'\\\n using\n communication_with_rightmost_adjustment\n and\n power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed\n next\n case (parallel_left_io \\ A n X P')\n from \\P \\\\<^sub>s\\IO \\ A n X\\ P'\\ have \"P \\ R \\\\<^sub>s\\IO \\ A n X\\ P' \\ R \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then have \"Q \\ (P \\ R) \\\\<^sub>s\\IO \\ A n X\\ Q \\ suffix n \\ (P' \\ R \\ suffix n)\"\n by (fact parallel_right_io)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = P' \\ (Q \\ R) \\ suffix n\\ [unfolded adapted_after_parallel]\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_left_communication P')\n from \\P \\\\<^sub>s\\\\\\ P'\\ have \"P \\ R \\\\<^sub>s\\\\\\ P' \\ R\"\n by (fact synchronous_transition.parallel_left_communication)\n then have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ Q \\ (P' \\ R)\"\n by (fact parallel_right_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = P' \\ (Q \\ R)\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io \\ A n X U)\n from \\Q \\ R \\\\<^sub>s\\IO \\ A n X\\ U\\ show ?thesis\n proof cases\n case (parallel_left_io Q')\n from \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\ have \"Q \\ (P \\ R) \\\\<^sub>s\\IO \\ A n X\\ Q' \\ (P \\ R) \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then show ?thesis\n unfolding\n adapted_after_parallel\n and\n \\\\ = IO \\ A n X\\ and \\S = P \\ suffix n \\ U\\ and \\U = Q' \\ R \\ suffix n\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io R')\n from \\R \\\\<^sub>s\\IO \\ A n X\\ R'\\ have \"P \\ R \\\\<^sub>s\\IO \\ A n X\\ P \\ suffix n \\ R'\"\n by (fact synchronous_transition.parallel_right_io)\n then have \"Q \\ (P \\ R) \\\\<^sub>s\\IO \\ A n X\\ Q \\ suffix n \\ (P \\ suffix n \\ R')\"\n by (fact synchronous_transition.parallel_right_io)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = P \\ suffix n \\ U\\ and \\U = Q \\ suffix n \\ R'\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed\n next\n case (parallel_right_communication U)\n from \\Q \\ R \\\\<^sub>s\\\\\\ U\\ show ?thesis\n proof cases\n case (communication \\ \\ A n X Q' R')\n from \\R \\\\<^sub>s\\IO \\ A n X\\ R'\\ have \"P \\ R \\\\<^sub>s\\IO \\ A n X\\ P \\ suffix n \\ R'\"\n by (fact parallel_right_io)\n with \\\\ \\ \\\\ and \\Q \\\\<^sub>s\\IO \\ A n X\\ Q'\\ have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ \\\\<^bsup>n\\<^esup> (Q' \\ (P \\ suffix n \\ R'))\"\n by (fact synchronous_transition.communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = P \\ U\\ and \\U = \\\\<^bsup>n\\<^esup> (Q' \\ R')\\\n using\n communication_with_rightmost_adjustment [THEN synchronous.bisimilarity_symmetry_rule]\n and\n power_in_universe [OF create_channel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_left_communication Q')\n from \\Q \\\\<^sub>s\\\\\\ Q'\\ have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ Q' \\ (P \\ R)\"\n by (fact synchronous_transition.parallel_left_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = P \\ U\\ and \\U = Q' \\ R\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_communication R')\n from \\R \\\\<^sub>s\\\\\\ R'\\ have \"P \\ R \\\\<^sub>s\\\\\\ P \\ R'\"\n by (fact synchronous_transition.parallel_right_communication)\n then have \"Q \\ (P \\ R) \\\\<^sub>s\\\\\\ Q \\ (P \\ R')\"\n by (fact synchronous_transition.parallel_right_communication)\n then show ?thesis\n unfolding \\\\ = \\\\ and \\S = P \\ U\\ and \\U = Q \\ R'\\\n using equality_in_universe\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed\n qed\nqed (respectful, iprover)\n\nend\n\ndeclare parallel_commutativity [thorn_simps]\n\n(*FIXME: Maybe reprove commutativity of parallel composition. *)\n\nlemma parallel_associativity [thorn_simps]:\n shows \"(P \\ Q) \\ R \\\\<^sub>s P \\ (Q \\ R)\"\nproof -\n have \"(P \\ Q) \\ R \\\\<^sub>s R \\ (P \\ Q)\"\n using parallel_commutativity .\n also have \"\\ \\\\<^sub>s P \\ (R \\ Q)\"\n using parallel_left_commutativity .\n also have \"\\ \\\\<^sub>s P \\ (Q \\ R)\"\n using parallel_commutativity\n by equivalence\n finally show ?thesis .\nqed\n\nlemma parallel_left_identity [thorn_simps]:\n shows \"\\ \\ P \\\\<^sub>s P\"\nproof (coinduction arbitrary: P rule: synchronous.up_to_rule [where \\ = id])\n case (forward_simulation \\ S P)\n then show ?case\n proof cases\n case (communication \\ \\ A n X U P')\n from \\\\ \\\\<^sub>s\\IO \\ A n X\\ U\\ show ?thesis\n by cases\n next\n case (parallel_left_io \\ A n X U)\n from \\\\ \\\\<^sub>s\\IO \\ A n X\\ U\\ show ?thesis\n by cases\n next\n case (parallel_left_communication U)\n from \\\\ \\\\<^sub>s\\\\\\ U\\ show ?thesis\n by cases\n next\n case (parallel_right_io \\ A n X P')\n from \\P \\\\<^sub>s\\IO \\ A n X\\ P'\\ show ?thesis\n unfolding \\\\ = IO \\ A n X\\ and \\S = \\ \\ suffix n \\ P'\\ [unfolded adapted_after_stop]\n by (intro exI conjI, use in assumption) simp\n next\n case (parallel_right_communication P')\n from \\P \\\\<^sub>s\\\\\\ P'\\ show ?thesis\n unfolding \\\\ = \\\\ and \\S = \\ \\ P'\\\n by (intro exI conjI, use in assumption) simp\n qed\nnext\n case (backward_simulation \\ P' P)\n have \"\\ \\ P \\\\<^sub>s\\\\\\ \\ \\ P'\"\n proof (cases \\)\n case (IO \\ A n X)\n from \\P \\\\<^sub>s\\\\\\ P'\\ have \"\\ \\ P \\\\<^sub>s\\IO \\ A n X\\ \\ \\ suffix n \\ P'\"\n unfolding \\\\ = IO \\ A n X\\\n by (fact parallel_right_io)\n then show ?thesis\n unfolding \\\\ = IO \\ A n X\\\n by (simp only: adapted_after_stop)\n next\n case Communication\n from \\P \\\\<^sub>s\\\\\\ P'\\ show ?thesis\n unfolding \\\\ = \\\\\n by (fact parallel_right_communication)\n qed\n then show ?case\n by (intro exI conjI, use in assumption) simp\nqed respectful\n\nlemma parallel_right_identity [thorn_simps]:\n shows \"P \\ \\ \\\\<^sub>s P\"\nproof -\n have \"P \\ \\ \\\\<^sub>s \\ \\ P\"\n using parallel_commutativity\n by equivalence\n also have \"\\ \\\\<^sub>s P\"\n using parallel_left_identity .\n finally show ?thesis .\nqed\n\ncontext begin\n\nprivate lemma stop_scope_redundancy:\n shows \"\\ _. \\ \\\\<^sub>s \\\"\nproof (coinduction rule: synchronous.up_to_rule [where \\ = \\])\n case (forward_simulation \\ S)\n from \\\\ _. \\ \\\\<^sub>s\\\\\\ S\\ show ?case\n proof cases\n case (scope_opening i n X A)\n from \\\\ \\\\<^sub>s\\A \\ tail \\ \\\\<^bsup>n\\<^esup> X \\ move n i\\ S \\ move n i\\ show ?thesis\n by cases\n next\n case (new_channel_io \\ A n X \\)\n from \\\\ \\\\<^sub>s\\IO \\ (A \\ tail) n (X \\ remove n)\\ \\\\<^bsub>n\\<^esub> \\\\ show ?thesis\n by cases\n next\n case (new_channel_communication \\)\n from \\\\ \\\\<^sub>s\\\\\\ \\ \\\\ show ?thesis\n by cases\n qed\nnext\n case (backward_simulation \\ S)\n from \\\\ \\\\<^sub>s\\\\\\ S\\ show ?case\n by cases\nqed respectful\n\nlemma scope_redundancy [thorn_simps]:\n shows \"\\ _. P \\\\<^sub>s P\"\nproof -\n have \"\\ _. P \\\\<^sub>s \\ _. (\\ \\ P)\"\n using parallel_left_identity\n by process_family_equivalence\n also have \"\\ \\\\<^sub>s \\ _. \\ \\ P\"\n using parallel_left_scope_extension\n by process_family_equivalence\n also have \"\\ \\\\<^sub>s \\ \\ P\"\n using stop_scope_redundancy\n by process_family_equivalence\n also have \"\\ \\\\<^sub>s P\"\n using parallel_left_identity .\n finally show ?thesis .\nqed\n\nend\n\ntext \\\n We extend \\<^theory_text>\\thorn_simps\\ with rules for eliminating duplicates of \\\\\\<^sup>\\\\-processes, which are\n based on the observation that \\<^const>\\repeated_receive\\ is idempotent.\n\n Incidentally, duplicate removal based on idempotence plays rather well with associativity and\n commutativity rules. The reason is the simplifier's handling of permutative rules, like\n commutativity: these rules are applied only when they lead to a smaller term, where ``smaller'' by\n default means ``lexicographically smaller'' (see Subsection~9.3.3 of the Isabelle/Isar Reference\n Manual). A result of this behavior is that equal processes in a chain of parallel compositions\n will sooner or later stand next to each other. If then a pair of equal processes stands at the end\n of the chain, it can be collapsed by applying an idempotency rule; if it does not stand at the\n end, it can be collapsed by a ``nested'' variant of an idempotency rule, analogous to the\n ``nested'' variant of commutativity.\n\\\n(* FIXME:\n Add a proper reference to the reference manual.\n*)\n(*FIXME:\n Don't say ``nested'' but use terminology analogous to the new terminology used for ``nested''\n commutativity rules.\n*)\n\ncontext begin\n\nprivate lemma left_amended_double_suffix_adapted:\n shows \"(R \\ P \\ suffix n) \\ Q \\ suffix n \\\\<^sub>s R \\ (P \\ Q) \\ suffix n\"\n unfolding adapted_after_parallel\n using parallel_associativity .\n\nprivate lemma right_amended_double_suffix_adapted:\n shows \"P \\ suffix n \\ (R \\ Q \\ suffix n) \\\\<^sub>s R \\ (P \\ Q) \\ suffix n\"\n unfolding adapted_after_parallel\n using parallel_left_commutativity .\n\nlemma repeated_receive_idempotency [thorn_simps]:\n shows \"A \\\\<^sup>\\ x. \\

x \\ A \\\\<^sup>\\ x. \\

x \\\\<^sub>s A \\\\<^sup>\\ x. \\

x\"\nproof (coinduction rule: synchronous.up_to_rule [where \\ = \"[\\\\<^sub>s] \\ \\\"])\n case (forward_simulation \\ S)\n then show ?case\n proof cases\n case (parallel_left_io \\ A' n X Q)\n from \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ Q\\ obtain T where \"Q = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (fast elim: transition_from_repeated_receive)\n with \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ Q\\\n have \"A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (simp only:)\n then show ?thesis\n unfolding\n \\\\ = IO \\ A' n X\\ and \\S = Q \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n and\n \\Q = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n using\n left_amended_double_suffix_adapted\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io \\ A' n X Q)\n from \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ Q\\ obtain T where \"Q = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (fast elim: transition_from_repeated_receive)\n with \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ Q\\\n have \"A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (simp only:)\n then show ?thesis\n unfolding\n \\\\ = IO \\ A' n X\\ and \\S = (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ Q\\\n and\n \\Q = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n using\n right_amended_double_suffix_adapted\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed (blast elim: transition_from_repeated_receive)+\nnext\n case (backward_simulation \\ S)\n from \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\\\\\ S\\\n obtain n and X where \"\\ = A \\ \\\\<^bsup>n\\<^esup> X\" and \"S = post_receive n X \\

\\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (erule transition_from_repeated_receive)\n with \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\\\\\ S\\\n have \"A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\ post_receive n X \\

\\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (simp only:)\n then have \"\n A \\\\<^sup>\\ x. \\

x \\ A \\\\<^sup>\\ x. \\

x\n \\\\<^sub>s\\A \\ \\\\<^bsup>n\\<^esup> X\\\n (post_receive n X \\

\\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n) \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (fact parallel_left_io)\n then show ?case\n unfolding\n \\\\ = A \\ \\\\<^bsup>n\\<^esup> X\\ and \\S = post_receive n X \\

\\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n using\n left_amended_double_suffix_adapted\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\nqed respectful\n\nlemma repeated_receive_nested_idempotency [thorn_simps]:\n shows \"A \\\\<^sup>\\ x. \\

x \\ (A \\\\<^sup>\\ x. \\

x \\ Q) \\\\<^sub>s A \\\\<^sup>\\ x. \\

x \\ Q\"\nproof -\n have \"A \\\\<^sup>\\ x. \\

x \\ (A \\\\<^sup>\\ x. \\

x \\ Q) \\\\<^sub>s (A \\\\<^sup>\\ x. \\

x \\ A \\\\<^sup>\\ x. \\

x) \\ Q\"\n using parallel_associativity\n by equivalence\n also have \"\\ \\\\<^sub>s A \\\\<^sup>\\ x. \\

x \\ Q\"\n using repeated_receive_idempotency\n by equivalence\n finally show ?thesis .\nqed\n\nprivate lemma with_inner_repeated_receive_post_right_receive:\n shows \"\n (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\\n (((A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ post_receive n X \\) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n)\n \\\\<^sub>s\n post_receive n X \\ \\ (A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n (is \"?S \\\\<^sub>s ?T\")\nproof -\n have \"?S \\\\<^sub>s\n (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ post_receive n X \\ \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n unfolding adapted_after_repeated_receive\n using repeated_receive_nested_idempotency and parallel_associativity\n by equivalence\n also have \"\\ \\\\<^sub>s ?T\"\n unfolding adapted_after_parallel\n using parallel_left_commutativity .\n finally show ?thesis .\nqed\n\nprivate lemma without_inner_repeated_receive_post_right_receive:\n shows \"\n (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ (post_receive n X \\ \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n)\n \\\\<^sub>s\n post_receive n X \\ \\ (A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. \\ y) \\ suffix n\"\n unfolding adapted_after_parallel\n using parallel_left_commutativity .\n\nlemma inner_repeated_receive_redundancy:\n shows \"A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y) \\\\<^sub>s A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. \\ y\"\nproof (coinduction rule: synchronous.up_to_rule [where \\ = \"[\\\\<^sub>s] \\ \\ \\ [\\\\<^sub>s]\"])\n case (forward_simulation \\ S)\n then show ?case\n proof cases\n case (parallel_left_io \\ A' n X R)\n from \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ R\\ obtain T where \"R = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (fast elim: transition_from_repeated_receive)\n with \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ R\\\n have \"A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (simp only:)\n then have \"\n A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. \\ y\n \\\\<^sub>s\\IO \\ A' n X\\\n (T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n) \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then show ?thesis\n unfolding\n \\\\ = IO \\ A' n X\\ and \\S = R \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\\\n and\n \\R = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n using\n left_amended_double_suffix_adapted\n and\n left_amended_double_suffix_adapted [symmetric]\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io \\ B' n Y R)\n from \\B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y) \\\\<^sub>s\\IO \\ B' n Y\\ R\\\n have\n \"\\ = Receiving\"\n and\n \"B' = B\"\n and\n \"R = post_receive n Y (\\y. A \\\\<^sup>\\ x. \\

x \\ \\ y) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n by (auto elim: transition_from_repeated_receive)\n have \"B \\\\<^sup>\\ y. \\ y \\\\<^sub>s\\B \\ \\\\<^bsup>n\\<^esup> Y\\ post_receive n Y \\ \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\"\n using repeated_receive_transition .\n then have \"\n A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. \\ y\n \\\\<^sub>s\\B \\ \\\\<^bsup>n\\<^esup> Y\\\n (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ post_receive n Y \\ \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\"\n by (fact synchronous_transition.parallel_right_io)\n then show ?thesis\n unfolding\n post_receive_after_parallel\n and\n \\\\ = IO \\ B' n Y\\ and \\S = (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ R\\\n and\n \\\\ = Receiving\\\n and\n \\B' = B\\\n and\n \\R = post_receive n Y (\\y. A \\\\<^sup>\\ x. \\

x \\ \\ y) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\\\n using\n with_inner_repeated_receive_post_right_receive\n and\n without_inner_repeated_receive_post_right_receive [symmetric]\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed (blast elim: transition_from_repeated_receive)+\nnext\n case (backward_simulation \\ S)\n then show ?case\n proof cases\n case (parallel_left_io \\ A' n X R)\n from \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ R\\ obtain T where \"R = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (fast elim: transition_from_repeated_receive)\n with \\A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ R\\\n have \"A \\\\<^sup>\\ x. \\

x \\\\<^sub>s\\IO \\ A' n X\\ T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\"\n by (simp only:)\n then have \"\n A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)\n \\\\<^sub>s\\IO \\ A' n X\\\n (T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n by (fact synchronous_transition.parallel_left_io)\n then show ?thesis\n unfolding\n \\\\ = IO \\ A' n X\\ and \\S = R \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\\\n and\n \\R = T \\ (A \\\\<^sup>\\ x. \\

x) \\ suffix n\\\n using\n left_amended_double_suffix_adapted\n and\n left_amended_double_suffix_adapted [symmetric]\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n next\n case (parallel_right_io \\ B' n Y R)\n from \\B \\\\<^sup>\\ y. \\ y \\\\<^sub>s\\IO \\ B' n Y\\ R\\\n have\n \"\\ = Receiving\"\n and\n \"B' = B\"\n and\n \"R = post_receive n Y \\ \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\"\n by (auto elim: transition_from_repeated_receive)\n have \"\n B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)\n \\\\<^sub>s\\B \\ \\\\<^bsup>n\\<^esup> Y\\\n post_receive n Y (\\y. A \\\\<^sup>\\ x. \\

x \\ \\ y) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n using repeated_receive_transition .\n then have \"\n A \\\\<^sup>\\ x. \\

x \\ B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)\n \\\\<^sub>s\\B \\ \\\\<^bsup>n\\<^esup> Y\\\n (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\\n post_receive n Y (\\y. A \\\\<^sup>\\ x. \\

x \\ \\ y) \\ (B \\\\<^sup>\\ y. (A \\\\<^sup>\\ x. \\

x \\ \\ y)) \\ suffix n\"\n by (fact synchronous_transition.parallel_right_io)\n then show ?thesis\n unfolding\n post_receive_after_parallel\n and\n \\\\ = IO \\ B' n Y\\ and \\S = (A \\\\<^sup>\\ x. \\

x) \\ suffix n \\ R\\\n and\n \\\\ = Receiving\\ and \\B' = B\\ and \\R = post_receive n Y \\ \\ (B \\\\<^sup>\\ y. \\ y) \\ suffix n\\\n using\n with_inner_repeated_receive_post_right_receive\n and\n without_inner_repeated_receive_post_right_receive [symmetric]\n and\n composition_in_universe\n [OF suffix_adapted_mutation_in_universe parallel_mutation_in_universe]\n by (intro exI conjI, use in assumption) (fastforce intro: rev_bexI)\n qed (blast elim: transition_from_repeated_receive)+\nqed respectful\n\nend\n\n(*FIXME:\n Simplify the proof of the following lemma once #231 is resolved.\n\n In particular, do the following:\n\n \\<^item> Turn the detailed proofs that involve\n \\<^theory_text>\\repeated_receive_is_quasi_compatible_with_synchronous_bisimilarity\\ into single-step proofs\n that use the \\<^theory_text>\\bisimilarity\\ proof method.\n\n \\<^item> Merge the resulting proofs with adjacent proofs if \\<^theory_text>\\bisimilarity\\ can solve the whole step.\n\n \\<^item> Merge applications of \\<^theory_text>\\parallel_commutativity\\ and \\<^theory_text>\\parallel_associativity\\ when possible.\n\n \\<^item> Get rid of applications of compatibility rules whenever \\<^theory_text>\\bisimilarity\\ can be used instead.\n*)\nlemma inner_general_parallel_redundancy:\n assumes \"\\x \\. \\

x \\ A \\\\<^sup>\\ y. (\\

x \\ \\ y) \\\\<^sub>s \\

x \\ A \\\\<^sup>\\ y. \\ y\"\n shows \"\\x \\ xs. \\

x \\ A \\\\<^sup>\\ y. (\\x \\ xs. \\

x \\ \\ y) \\\\<^sub>s \\x \\ xs. \\

x \\ A \\\\<^sup>\\ y. \\ y\"\nproof (induction xs arbitrary: \\)\n case Nil\n have \"post_receive n X (\\x. \\ \\ \\ x) \\\\<^sub>s post_receive n X \\\" for n and X\n proof -\n have \"(\\e. ((\\ \\ \\ (X e)) \\ suffix n) e) = (\\e. (\\ \\ suffix n \\ \\ (X e) \\ suffix n) e)\"\n by (simp only: adapted_after_parallel)\n also have \"\\ = \\ \\ suffix n \\ (\\e. (\\ (X e) \\ suffix n) e)\"\n by (subst environment_dependent_parallel) (fact refl)\n also have \"\\ \\\\<^sub>s (\\e. (\\ (X e) \\ suffix n) e)\"\n unfolding adapted_after_stop\n using parallel_left_identity .\n finally show ?thesis\n unfolding post_receive_def .\n qed\n then show ?case\n unfolding general_parallel.simps(1)\n by\n (intro\n synchronous.parallel_is_right_compatible_with_bisimilarity\n synchronous.repeated_receive_is_quasi_compatible_with_bisimilarity\n )\n simp\nnext\n case (Cons x xs \\)\n have \"\n post_receive n X (\\y. (\\

x \\ \\x \\ xs. \\

x) \\ \\ y)\n \\\\<^sub>s\n post_receive n X (\\y. \\x \\ xs. \\

x \\ (\\

x \\ \\ y))\"\n for n and X\n proof -\n have \"\n (\\e. (((\\

x \\ \\x \\ xs. \\

x) \\ \\ (X e)) \\ suffix n) e)\n =\n (\\e. ((\\

x \\ suffix n \\ (\\x \\ xs. \\

x) \\ suffix n) \\ \\ (X e) \\ suffix n) e)\"\n by (simp only: adapted_after_parallel)\n also have \"\\ = (\\

x \\ suffix n \\ (\\x \\ xs. \\

x) \\ suffix n) \\ (\\e. (\\ (X e) \\ suffix n) e)\"\n by (subst environment_dependent_parallel) (fact refl)\n also have \"\\ \\\\<^sub>s ((\\x \\ xs. \\

x) \\ suffix n \\ \\

x \\ suffix n) \\ (\\e. (\\ (X e) \\ suffix n) e)\"\n by (intro synchronous.parallel_is_left_compatible_with_bisimilarity parallel_commutativity)\n also have \"\\ \\\\<^sub>s (\\x \\ xs. \\

x) \\ suffix n \\ (\\

x \\ suffix n \\ (\\e. (\\ (X e) \\ suffix n) e))\"\n using parallel_associativity .\n also have \"\\ = (\\e. ((\\x \\ xs. \\

x) \\ suffix n \\ (\\

x \\ suffix n \\ \\ (X e) \\ suffix n)) e)\"\n by\n (subst (3) environment_dependent_parallel, subst (4) environment_dependent_parallel)\n (fact refl)\n also have \"\\ = (\\e. ((\\x \\ xs. \\

x \\ (\\

x \\ \\ (X e))) \\ suffix n) e)\"\n by (simp only: adapted_after_parallel)\n finally show ?thesis\n unfolding post_receive_def .\n qed\n then have \"\n (\\

x \\ \\x \\ xs. \\

x) \\ A \\\\<^sup>\\ y. ((\\

x \\ \\x \\ xs. \\

x) \\ \\ y)\n \\\\<^sub>s\n (\\

x \\ \\x \\ xs. \\

x) \\ A \\\\<^sup>\\ y. (\\x \\ xs. \\

x \\ (\\

x \\ \\ y))\"\n by\n (intro\n synchronous.parallel_is_right_compatible_with_bisimilarity\n synchronous.repeated_receive_is_quasi_compatible_with_bisimilarity\n )\n simp\n also have \"\\ \\\\<^sub>s \\

x \\ (\\x \\ xs. \\

x \\ A \\\\<^sup>\\ y. (\\x \\ xs. \\

x \\ (\\

x \\ \\ y)))\"\n using parallel_associativity .\n also have \"\\ \\\\<^sub>s \\

x \\ (\\x \\ xs. \\

x \\ A \\\\<^sup>\\ y. (\\

x \\ \\ y))\"\n using Cons.IH\n by (rule synchronous.parallel_is_right_compatible_with_bisimilarity)\n also have \"\\ \\\\<^sub>s \\x \\ xs. \\

x \\ (\\

x \\ A \\\\<^sup>\\ y. (\\

x \\ \\ y))\"\n using parallel_left_commutativity .\n also have \"\\ \\\\<^sub>s \\x \\ xs. \\

x \\ (\\

x \\ A \\\\<^sup>\\ y. \\ y)\"\n using assms\n by (rule synchronous.parallel_is_right_compatible_with_bisimilarity)\n also have \"\\ \\\\<^sub>s (\\

x \\ \\x \\ xs. \\

x) \\ A \\\\<^sup>\\ y. \\ y\"\n using thorn_simps\n by equivalence\n finally show ?case\n unfolding general_parallel.simps(2) .\nqed\n\n(*FIXME:\n \\<^item> Change the variable names in the statement of \\<^theory_text>\\communication_with_rightmost_adjustment\\.\n\n \\<^item> Make \\<^theory_text>\\communication_with_rightmost_adjustment\\ public.\n\n \\<^item> Make \\<^theory_text>\\communication_with_rightmost_adjustment\\ conform with \\<^theory_text>\\parallel_left_scope_extension\\.\n\n \\<^item> Prove a right variant and use it in the proof of \\<^theory_text>\\parallel_left_commutativity\\ (swap the use\n and non-use of \\<^theory_text>\\THEN synchronous.bisimilarity_symmetry_rule\\.\n*)\n\n(* FIXME:\n \\<^item> The preservation lemmas should be separated from the \\<^theory_text>\\lift_definition\\ declarations, and such\n lemmas for \\<^theory_text>\\injectively_adapted\\ should be added (such lemmas for \\<^theory_text>\\remove_adapted\\ are already\n present.\n\n \\<^item> If we need an extra proof method for invoking \\<^theory_text>\\new_channel_scope_extension\\, we should not\n have tagged versions of other facts involving \\\\\\ and perhaps not even the \\<^method>\\equivalence\\\n setup for tagged \\\\\\.\n\n \\<^item> Regarding rules formerly labeled ``homogenous'':\n\n \\<^item> Add analogs of \\<^theory_text>\\homogeneous_process_family_uncurry(1-3)\\ that work with \\<^theory_text>\\deep_uncurry\\.\n\n \\<^item> Check that these analogs yield to proper behavior for channel and value arguments.\n\n \\<^item> Add a configurable list of facts that is supposed to contain analogous rules for derived\n constructs like \\\\\\.\n\n \\<^item> Possibly add \\<^theory_text>\\homogeneous_process_family_uncurry(1-3)\\ to make \\\\\\-elimination also work for\n processes that contain the respective constructions.\n\n Then we must make the transfer rules also work with types other than \\process\\. We might want to\n declare these rules only locally as transfer rules.\n\n \\<^item> Implement \\<^theory_text>\\bisimilarity\\ such that \\remove\\s are pushed inwards in the conclusion after the\n rules have been applied (or concurrently, by adding the ``pushing inwards'' rules as additional\n rewrite rules for \\<^theory_text>\\equivalence\\)\n\n \\<^item> This should allow \\<^theory_text>\\bisimilarity\\ to work with the parallel scope extension rules and rules\n that are not universally quantified over process families or process family functions (like\n the rules of \\<^theory_text>\\Communication\\)\n\n \\<^item> Check if we still need specialized versions of the parallel scope extension rules for the\n case with less dependencies\n\n \\<^item> Add a method \\<^theory_text>\\scope_redundancy\\ that does not push \\remove\\s inwards but pulls them outwards in\n the conclusion after the actual \\<^theory_text>\\scope_redundancy\\ rules has been applied.\n\n \\<^item> To prevent our transferring from accidentally transferring to the quotient type, thus preventing\n relaxation in \\<^theory_text>\\equivalence\\, we could perhaps temporarily wrap the bisimilarity relation.\n*)\n\nend\n", "meta": {"author": "input-output-hk", "repo": "thorn-calculus", "sha": "6d175995a7551b7a50aef0cc654c85230447c7a5", "save_path": "github-repos/isabelle/input-output-hk-thorn-calculus", "path": "github-repos/isabelle/input-output-hk-thorn-calculus/thorn-calculus-6d175995a7551b7a50aef0cc654c85230447c7a5/src/Thorn_Calculus-Core_Bisimilarities.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.36658972248186, "lm_q1q2_score": 0.19330881796581476}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__21_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__21_on_rules imports n_g2kAbsAfter_lemma_on_inv__21\nbegin\nsection{*All lemmas on causal relation between inv__21*}\nlemma lemma_inv__21_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__21 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__21) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__21_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.3345894478883556, "lm_q1q2_score": 0.1932238602616075}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__11.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__11 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__11 and some rule r*}\nlemma n_StoreVsinv__11:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\\(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv1)) (Const false)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false))) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__11:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__11 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__11:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__11.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.3345894478883556, "lm_q1q2_score": 0.19322385539560505}} {"text": "(* Title: HOL/Bali/State.thy\n Author: David von Oheimb\n*)\nsubsection {* State for evaluation of Java expressions and statements *}\n\ntheory State\nimports DeclConcepts\nbegin\n\ntext {*\ndesign issues:\n\\begin{itemize}\n\\item all kinds of objects (class instances, arrays, and class objects)\n are handeled via a general object abstraction\n\\item the heap and the map for class objects are combined into a single table\n @{text \"(recall (loc, obj) table \\ (qtname, obj) table ~= (loc + qtname, obj) table)\"}\n\\end{itemize}\n*}\n\nsubsubsection \"objects\"\n\ndatatype obj_tag = --{* tag for generic object *}\n CInst qtname --{* class instance *}\n | Arr ty int --{* array with component type and length *}\n --{* | CStat qtname the tag is irrelevant for a class object,\n i.e. the static fields of a class,\n since its type is given already by the reference to \n it (see below) *}\n\ntype_synonym vn = \"fspec + int\" --{* variable name *}\nrecord obj = \n tag :: \"obj_tag\" --{* generalized object *}\n \"values\" :: \"(vn, val) table\" \n\ntranslations \n (type) \"fspec\" <= (type) \"vname \\ qtname\" \n (type) \"vn\" <= (type) \"fspec + int\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option\\\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option,\\::'a\\\"\n\ndefinition\n the_Arr :: \"obj option \\ ty \\ int \\ (vn, val) table\"\n where \"the_Arr obj = (SOME (T,k,t). obj = Some \\tag=Arr T k,values=t\\)\"\n\nlemma the_Arr_Arr [simp]: \"the_Arr (Some \\tag=Arr T k,values=cs\\) = (T,k,cs)\"\napply (auto simp: the_Arr_def)\ndone\n\nlemma the_Arr_Arr1 [simp,intro,dest]:\n \"\\tag obj = Arr T k\\ \\ the_Arr (Some obj) = (T,k,values obj)\"\napply (auto simp add: the_Arr_def)\ndone\n\ndefinition\n upd_obj :: \"vn \\ val \\ obj \\ obj\"\n where \"upd_obj n v = (\\obj. obj \\values:=(values obj)(n\\v)\\)\"\n\nlemma upd_obj_def2 [simp]: \n \"upd_obj n v obj = obj \\values:=(values obj)(n\\v)\\\" \napply (auto simp: upd_obj_def)\ndone\n\ndefinition\n obj_ty :: \"obj \\ ty\" where\n \"obj_ty obj = (case tag obj of \n CInst C \\ Class C \n | Arr T k \\ T.[])\"\n\nlemma obj_ty_eq [intro!]: \"obj_ty \\tag=oi,values=x\\ = obj_ty \\tag=oi,values=y\\\" \nby (simp add: obj_ty_def)\n\n\nlemma obj_ty_eq1 [intro!,dest]: \n \"tag obj = tag obj' \\ obj_ty obj = obj_ty obj'\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_cong [simp]: \n \"obj_ty (obj \\values:=vs\\) = obj_ty obj\" \nby auto\n\nlemma obj_ty_CInst [simp]: \n \"obj_ty \\tag=CInst C,values=vs\\ = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_CInst1 [simp,intro!,dest]: \n \"\\tag obj = CInst C\\ \\ obj_ty obj = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr [simp]: \n \"obj_ty \\tag=Arr T i,values=vs\\ = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr1 [simp,intro!,dest]: \n \"\\tag obj = Arr T i\\ \\ obj_ty obj = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_widenD: \n \"G\\obj_ty obj\\RefT t \\ (\\C. tag obj = CInst C) \\ (\\T k. tag obj = Arr T k)\"\napply (unfold obj_ty_def)\napply (auto split add: obj_tag.split_asm)\ndone\n\ndefinition\n obj_class :: \"obj \\ qtname\" where\n \"obj_class obj = (case tag obj of \n CInst C \\ C \n | Arr T k \\ Object)\"\n\n\nlemma obj_class_CInst [simp]: \"obj_class \\tag=CInst C,values=vs\\ = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_CInst1 [simp,intro!,dest]: \n \"tag obj = CInst C \\ obj_class obj = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr [simp]: \"obj_class \\tag=Arr T k,values=vs\\ = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr1 [simp,intro!,dest]: \n \"tag obj = Arr T k \\ obj_class obj = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_ty_obj_class: \"G\\obj_ty obj\\ Class statC = G\\obj_class obj \\\\<^sub>C statC\"\napply (case_tac \"tag obj\")\napply (auto simp add: obj_ty_def obj_class_def)\napply (case_tac \"statC = Object\")\napply (auto dest: widen_Array_Class)\ndone\n\nsubsubsection \"object references\"\n\ntype_synonym oref = \"loc + qtname\" --{* generalized object reference *}\nsyntax\n Heap :: \"loc \\ oref\"\n Stat :: \"qtname \\ oref\"\n\ntranslations\n \"Heap\" => \"CONST Inl\"\n \"Stat\" => \"CONST Inr\"\n (type) \"oref\" <= (type) \"loc + qtname\"\n\ndefinition\n fields_table :: \"prog \\ qtname \\ (fspec \\ field \\ bool) \\ (fspec, ty) table\" where\n \"fields_table G C P =\n map_option type \\ table_of (filter (split P) (DeclConcepts.fields G C))\"\n\nlemma fields_table_SomeI: \n\"\\table_of (DeclConcepts.fields G C) n = Some f; P n f\\ \n \\ fields_table G C P n = Some (type f)\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule map_of_filter_in)\napply assumption\napply simp\ndone\n\n(* unused *)\nlemma fields_table_SomeD': \"fields_table G C P fn = Some T \\ \n \\f. (fn,f)\\set(DeclConcepts.fields G C) \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (drule map_of_SomeD)\napply auto\ndone\n\nlemma fields_table_SomeD: \n\"\\fields_table G C P fn = Some T; unique (DeclConcepts.fields G C)\\ \\ \n \\f. table_of (DeclConcepts.fields G C) fn = Some f \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule table_of_filter_unique_SomeD)\napply assumption\napply simp\ndone\n\ndefinition\n in_bounds :: \"int \\ int \\ bool\" (\"(_/ in'_bounds _)\" [50, 51] 50)\n where \"i in_bounds k = (0 \\ i \\ i < k)\"\n\ndefinition\n arr_comps :: \"'a \\ int \\ int \\ 'a option\"\n where \"arr_comps T k = (\\i. if i in_bounds k then Some T else None)\"\n \ndefinition\n var_tys :: \"prog \\ obj_tag \\ oref \\ (vn, ty) table\" where\n \"var_tys G oi r =\n (case r of \n Heap a \\ (case oi of \n CInst C \\ fields_table G C (\\n f. \\static f) (+) empty\n | Arr T k \\ empty (+) arr_comps T k)\n | Stat C \\ fields_table G C (\\fn f. declclassf fn = C \\ static f) \n (+) empty)\"\n\nlemma var_tys_Some_eq: \n \"var_tys G oi r n = Some T \n = (case r of \n Inl a \\ (case oi of \n CInst C \\ (\\nt. n = Inl nt \\ fields_table G C (\\n f. \n \\static f) nt = Some T) \n | Arr t k \\ (\\ i. n = Inr i \\ i in_bounds k \\ t = T)) \n | Inr C \\ (\\nt. n = Inl nt \\ \n fields_table G C (\\fn f. declclassf fn = C \\ static f) nt \n = Some T))\"\napply (unfold var_tys_def arr_comps_def)\napply (force split add: sum.split_asm sum.split obj_tag.split)\ndone\n\n\nsubsubsection \"stores\"\n\ntype_synonym globs --{* global variables: heap and static variables *}\n = \"(oref , obj) table\"\ntype_synonym heap\n = \"(loc , obj) table\"\n(* type_synonym locals \n = \"(lname, val) table\" *) (* defined in Value.thy local variables *)\n\ntranslations\n (type) \"globs\" <= (type) \"(oref , obj) table\"\n (type) \"heap\" <= (type) \"(loc , obj) table\"\n(* (type) \"locals\" <= (type) \"(lname, val) table\" *)\n\ndatatype st = (* pure state, i.e. contents of all variables *)\n st globs locals\n\nsubsection \"access\"\n\ndefinition\n globs :: \"st \\ globs\"\n where \"globs = case_st (\\g l. g)\"\n \ndefinition\n locals :: \"st \\ locals\"\n where \"locals = case_st (\\g l. l)\"\n\ndefinition heap :: \"st \\ heap\" where\n \"heap s = globs s \\ Heap\"\n\n\nlemma globs_def2 [simp]: \" globs (st g l) = g\"\nby (simp add: globs_def)\n\nlemma locals_def2 [simp]: \"locals (st g l) = l\"\nby (simp add: locals_def)\n\nlemma heap_def2 [simp]: \"heap s a=globs s (Heap a)\"\nby (simp add: heap_def)\n\n\nabbreviation val_this :: \"st \\ val\"\n where \"val_this s == the (locals s This)\"\n\nabbreviation lookup_obj :: \"st \\ val \\ obj\"\n where \"lookup_obj s a' == the (heap s (the_Addr a'))\"\n\nsubsection \"memory allocation\"\n\ndefinition\n new_Addr :: \"heap \\ loc option\" where\n \"new_Addr h = (if (\\a. h a \\ None) then None else Some (SOME a. h a = None))\"\n\nlemma new_AddrD: \"new_Addr h = Some a \\ h a = None\"\napply (auto simp add: new_Addr_def)\napply (erule someI) \ndone\n\nlemma new_AddrD2: \"new_Addr h = Some a \\ \\b. h b \\ None \\ b \\ a\"\napply (drule new_AddrD)\napply auto\ndone\n\nlemma new_Addr_SomeI: \"h a = None \\ \\b. new_Addr h = Some b \\ h b = None\"\napply (simp add: new_Addr_def)\napply (fast intro: someI2)\ndone\n\n\nsubsection \"initialization\"\n\nabbreviation init_vals :: \"('a, ty) table \\ ('a, val) table\"\n where \"init_vals vs == map_option default_val \\ vs\"\n\nlemma init_arr_comps_base [simp]: \"init_vals (arr_comps T 0) = empty\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nlemma init_arr_comps_step [simp]: \n\"0 < j \\ init_vals (arr_comps T j ) = \n init_vals (arr_comps T (j - 1))(j - 1\\default_val T)\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nsubsection \"update\"\n\ndefinition\n gupd :: \"oref \\ obj \\ st \\ st\" (\"gupd'(_\\_')\" [10, 10] 1000)\n where \"gupd r obj = case_st (\\g l. st (g(r\\obj)) l)\"\n\ndefinition\n lupd :: \"lname \\ val \\ st \\ st\" (\"lupd'(_\\_')\" [10, 10] 1000)\n where \"lupd vn v = case_st (\\g l. st g (l(vn\\v)))\"\n\ndefinition\n upd_gobj :: \"oref \\ vn \\ val \\ st \\ st\"\n where \"upd_gobj r n v = case_st (\\g l. st (chg_map (upd_obj n v) r g) l)\"\n\ndefinition\n set_locals :: \"locals \\ st \\ st\"\n where \"set_locals l = case_st (\\g l'. st g l)\"\n\ndefinition\n init_obj :: \"prog \\ obj_tag \\ oref \\ st \\ st\"\n where \"init_obj G oi r = gupd(r\\\\tag=oi, values=init_vals (var_tys G oi r)\\)\"\n\nabbreviation\n init_class_obj :: \"prog \\ qtname \\ st \\ st\"\n where \"init_class_obj G C == init_obj G undefined (Inr C)\"\n\nlemma gupd_def2 [simp]: \"gupd(r\\obj) (st g l) = st (g(r\\obj)) l\"\napply (unfold gupd_def)\napply (simp (no_asm))\ndone\n\nlemma lupd_def2 [simp]: \"lupd(vn\\v) (st g l) = st g (l(vn\\v))\"\napply (unfold lupd_def)\napply (simp (no_asm))\ndone\n\nlemma globs_gupd [simp]: \"globs (gupd(r\\obj) s) = globs s(r\\obj)\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma globs_lupd [simp]: \"globs (lupd(vn\\v ) s) = globs s\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma locals_gupd [simp]: \"locals (gupd(r\\obj) s) = locals s\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma locals_lupd [simp]: \"locals (lupd(vn\\v ) s) = locals s(vn\\v )\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma globs_upd_gobj_new [rule_format (no_asm), simp]: \n \"globs s r = None \\ globs (upd_gobj r n v s) = globs s\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma globs_upd_gobj_upd [rule_format (no_asm), simp]: \n\"globs s r=Some obj\\ globs (upd_gobj r n v s) = globs s(r\\upd_obj n v obj)\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma locals_upd_gobj [simp]: \"locals (upd_gobj r n v s) = locals s\"\napply (induct \"s\")\nby (simp add: upd_gobj_def) \n\n\nlemma globs_init_obj [simp]: \"globs (init_obj G oi r s) t = \n (if t=r then Some \\tag=oi,values=init_vals (var_tys G oi r)\\ else globs s t)\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma locals_init_obj [simp]: \"locals (init_obj G oi r s) = locals s\"\nby (simp add: init_obj_def)\n \nlemma surjective_st [simp]: \"st (globs s) (locals s) = s\"\napply (induct \"s\")\nby auto\n\nlemma surjective_st_init_obj: \n \"st (globs (init_obj G oi r s)) (locals s) = init_obj G oi r s\"\napply (subst locals_init_obj [THEN sym])\napply (rule surjective_st)\ndone\n\nlemma heap_heap_upd [simp]: \n \"heap (st (g(Inl a\\obj)) l) = heap (st g l)(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_stat_upd [simp]: \"heap (st (g(Inr C\\obj)) l) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_local_upd [simp]: \"heap (st g (l(vn\\v))) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_gupd_Heap [simp]: \"heap (gupd(Heap a\\obj) s) = heap s(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_gupd_Stat [simp]: \"heap (gupd(Stat C\\obj) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_lupd [simp]: \"heap (lupd(vn\\v) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_upd_gobj_Stat [simp]: \"heap (upd_gobj (Stat C) n v s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\napply (case_tac \"globs s (Stat C)\")\napply auto\ndone\n\nlemma set_locals_def2 [simp]: \"set_locals l (st g l') = st g l\"\napply (unfold set_locals_def)\napply (simp (no_asm))\ndone\n\nlemma set_locals_id [simp]: \"set_locals (locals s) s = s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma set_set_locals [simp]: \"set_locals l (set_locals l' s) = set_locals l s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma locals_set_locals [simp]: \"locals (set_locals l s) = l\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma globs_set_locals [simp]: \"globs (set_locals l s) = globs s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma heap_set_locals [simp]: \"heap (set_locals l s) = heap s\"\napply (unfold heap_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\n\nsubsubsection \"abrupt completion\"\n\n\n\nprimrec the_Xcpt :: \"abrupt \\ xcpt\"\n where \"the_Xcpt (Xcpt x) = x\"\n\nprimrec the_Jump :: \"abrupt => jump\"\n where \"the_Jump (Jump j) = j\"\n\nprimrec the_Loc :: \"xcpt \\ loc\"\n where \"the_Loc (Loc a) = a\"\n\nprimrec the_Std :: \"xcpt \\ xname\"\n where \"the_Std (Std x) = x\"\n \n\ndefinition\n abrupt_if :: \"bool \\ abopt \\ abopt \\ abopt\"\n where \"abrupt_if c x' x = (if c \\ (x = None) then x' else x)\"\n\nlemma abrupt_if_True_None [simp]: \"abrupt_if True x None = x\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_True_not_None [simp]: \"x \\ None \\ abrupt_if True x y \\ None\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_False [simp]: \"abrupt_if False x y = y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_Some [simp]: \"abrupt_if c x (Some y) = Some y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_not_None [simp]: \"y \\ None \\ abrupt_if c x y = y\"\napply (simp add: abrupt_if_def)\nby auto\n\n\nlemma split_abrupt_if: \n\"P (abrupt_if c x' x) = \n ((c \\ x = None \\ P x') \\ (\\ (c \\ x = None) \\ P x))\"\napply (unfold abrupt_if_def)\napply (split split_if)\napply auto\ndone\n\nabbreviation raise_if :: \"bool \\ xname \\ abopt \\ abopt\"\n where \"raise_if c xn == abrupt_if c (Some (Xcpt (Std xn)))\"\n\nabbreviation np :: \"val \\ abopt \\ abopt\"\n where \"np v == raise_if (v = Null) NullPointer\"\n\nabbreviation check_neg :: \"val \\ abopt \\ abopt\"\n where \"check_neg i' == raise_if (the_Intg i'<0) NegArrSize\"\n\nabbreviation error_if :: \"bool \\ error \\ abopt \\ abopt\"\n where \"error_if c e == abrupt_if c (Some (Error e))\"\n\nlemma raise_if_None [simp]: \"(raise_if c x y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare raise_if_None [THEN iffD1, dest!]\n\nlemma if_raise_if_None [simp]: \n \"((if b then y else raise_if c x y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma raise_if_SomeD [dest!]:\n \"raise_if c x y = Some z \\ c \\ z=(Xcpt (Std x)) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_None [simp]: \"(error_if c e y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare error_if_None [THEN iffD1, dest!]\n\nlemma if_error_if_None [simp]: \n \"((if b then y else error_if c e y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_SomeD [dest!]:\n \"error_if c e y = Some z \\ c \\ z=(Error e) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\ndefinition\n absorb :: \"jump \\ abopt \\ abopt\"\n where \"absorb j a = (if a=Some (Jump j) then None else a)\"\n\nlemma absorb_SomeD [dest!]: \"absorb j a = Some x \\ a = Some x\"\nby (auto simp add: absorb_def)\n\nlemma absorb_same [simp]: \"absorb j (Some (Jump j)) = None\"\nby (auto simp add: absorb_def)\n\nlemma absorb_other [simp]: \"a \\ Some (Jump j) \\ absorb j a = a\"\nby (auto simp add: absorb_def)\n\nlemma absorb_Some_NoneD: \"absorb j (Some abr) = None \\ abr = Jump j\"\n by (simp add: absorb_def)\n\nlemma absorb_Some_JumpD: \"absorb j s = Some (Jump j') \\ j'\\j\"\n by (simp add: absorb_def)\n\n\nsubsubsection \"full program state\"\n\ntype_synonym\n state = \"abopt \\ st\" --{* state including abruption information *}\n\ntranslations\n (type) \"abopt\" <= (type) \"abrupt option\"\n (type) \"state\" <= (type) \"abopt \\ st\"\n\nabbreviation\n Norm :: \"st \\ state\"\n where \"Norm s == (None, s)\"\n\nabbreviation (input)\n abrupt :: \"state \\ abopt\"\n where \"abrupt == fst\"\n\nabbreviation (input)\n store :: \"state \\ st\"\n where \"store == snd\"\n\nlemma single_stateE: \"\\Z. Z = (s::state) \\ False\"\napply (erule_tac x = \"(Some k,y)\" in all_dupE)\napply (erule_tac x = \"(None,y)\" in allE)\napply clarify\ndone\n\nlemma state_not_single: \"All (op = (x::state)) \\ R\"\napply (drule_tac x = \"(if abrupt x = None then Some ?x else None,?y)\" in spec)\napply clarsimp\ndone\n\ndefinition\n normal :: \"state \\ bool\"\n where \"normal = (\\s. abrupt s = None)\"\n\nlemma normal_def2 [simp]: \"normal s = (abrupt s = None)\"\napply (unfold normal_def)\napply (simp (no_asm))\ndone\n\ndefinition\n heap_free :: \"nat \\ state \\ bool\"\n where \"heap_free n = (\\s. atleast_free (heap (store s)) n)\"\n\nlemma heap_free_def2 [simp]: \"heap_free n s = atleast_free (heap (store s)) n\"\napply (unfold heap_free_def)\napply simp\ndone\n\nsubsection \"update\"\n\ndefinition\n abupd :: \"(abopt \\ abopt) \\ state \\ state\"\n where \"abupd f = map_prod f id\"\n\ndefinition\n supd :: \"(st \\ st) \\ state \\ state\"\n where \"supd = map_prod id\"\n \nlemma abupd_def2 [simp]: \"abupd f (x,s) = (f x,s)\"\nby (simp add: abupd_def)\n\nlemma abupd_abrupt_if_False [simp]: \"\\ s. abupd (abrupt_if False xo) s = s\"\nby simp\n\nlemma supd_def2 [simp]: \"supd f (x,s) = (x,f s)\"\nby (simp add: supd_def)\n\nlemma supd_lupd [simp]: \n \"\\ s. supd (lupd vn v ) s = (abrupt s,lupd vn v (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\n\nlemma supd_gupd [simp]: \n \"\\ s. supd (gupd r obj) s = (abrupt s,gupd r obj (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma supd_init_obj [simp]: \n \"supd (init_obj G oi r) s = (abrupt s,init_obj G oi r (store s))\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma abupd_store_invariant [simp]: \"store (abupd f s) = store s\"\n by (cases s) simp\n\nlemma supd_abrupt_invariant [simp]: \"abrupt (supd f s) = abrupt s\"\n by (cases s) simp\n\nabbreviation set_lvars :: \"locals \\ state \\ state\"\n where \"set_lvars l == supd (set_locals l)\"\n\nabbreviation restore_lvars :: \"state \\ state \\ state\"\n where \"restore_lvars s' s == set_lvars (locals (store s')) s\"\n\nlemma set_set_lvars [simp]: \"\\ s. set_lvars l (set_lvars l' s) = set_lvars l s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma set_lvars_id [simp]: \"\\ s. set_lvars (locals (store s)) s = s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nsubsubsection \"initialisation test\"\n\ndefinition\n inited :: \"qtname \\ globs \\ bool\"\n where \"inited C g = (g (Stat C) \\ None)\"\n\ndefinition\n initd :: \"qtname \\ state \\ bool\"\n where \"initd C = inited C \\ globs \\ store\"\n\nlemma not_inited_empty [simp]: \"\\inited C empty\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma inited_gupdate [simp]: \"inited C (g(r\\obj)) = (inited C g \\ r = Stat C)\"\napply (unfold inited_def)\napply (auto split add: st.split)\ndone\n\nlemma inited_init_class_obj [intro!]: \"inited C (globs (init_class_obj G C s))\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma not_initedD: \"\\ inited C g \\ g (Stat C) = None\"\napply (unfold inited_def)\napply (erule notnotD)\ndone\n\nlemma initedD: \"inited C g \\ \\ obj. g (Stat C) = Some obj\"\napply (unfold inited_def)\napply auto\ndone\n\nlemma initd_def2 [simp]: \"initd C s = inited C (globs (store s))\"\napply (unfold initd_def)\napply (simp (no_asm))\ndone\n\nsubsubsection {* @{text error_free} *}\n\ndefinition\n error_free :: \"state \\ bool\"\n where \"error_free s = (\\ (\\ err. abrupt s = Some (Error err)))\"\n\nlemma error_free_Norm [simp,intro]: \"error_free (Norm s)\"\nby (simp add: error_free_def)\n\nlemma error_free_normal [simp,intro]: \"normal s \\ error_free s\"\nby (simp add: error_free_def)\n\nlemma error_free_Xcpt [simp]: \"error_free (Some (Xcpt x),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Jump [simp,intro]: \"error_free (Some (Jump j),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Error [simp]: \"error_free (Some (Error e),s) = False\"\nby (simp add: error_free_def) \n\nlemma error_free_Some [simp,intro]: \n \"\\ (\\ err. x=Error err) \\ error_free ((Some x),s)\"\nby (auto simp add: error_free_def)\n\nlemma error_free_abupd_absorb [simp,intro]: \n \"error_free s \\ error_free (abupd (absorb j) s)\"\nby (cases s) \n (auto simp add: error_free_def absorb_def\n split: split_if_asm)\n\nlemma error_free_absorb [simp,intro]: \n \"error_free (a,s) \\ error_free (absorb j a, s)\"\nby (auto simp add: error_free_def absorb_def\n split: split_if_asm)\n\nlemma error_free_abrupt_if [simp,intro]:\n\"\\error_free s; \\ (\\ err. x=Error err)\\\n \\ error_free (abupd (abrupt_if p (Some x)) s)\"\nby (cases s)\n (auto simp add: abrupt_if_def\n split: split_if)\n\nlemma error_free_abrupt_if1 [simp,intro]:\n\"\\error_free (a,s); \\ (\\ err. x=Error err)\\\n \\ error_free (abrupt_if p (Some x) a, s)\"\nby (auto simp add: abrupt_if_def\n split: split_if)\n\nlemma error_free_abrupt_if_Xcpt [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Xcpt x))) s)\"\nby simp \n\nlemma error_free_abrupt_if_Xcpt1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Xcpt x)) a, s)\" \nby simp \n\nlemma error_free_abrupt_if_Jump [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Jump j))) s)\" \nby simp\n\nlemma error_free_abrupt_if_Jump1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Jump j)) a, s)\" \nby simp\n\nlemma error_free_raise_if [simp,intro]:\n \"error_free s \\ error_free (abupd (raise_if p x) s)\"\nby simp \n\nlemma error_free_raise_if1 [simp,intro]:\n \"error_free (a,s) \\ error_free ((raise_if p x a), s)\"\nby simp \n\nlemma error_free_supd [simp,intro]:\n \"error_free s \\ error_free (supd f s)\"\nby (cases s) (simp add: error_free_def)\n\nlemma error_free_supd1 [simp,intro]:\n \"error_free (a,s) \\ error_free (a,f s)\"\nby (simp add: error_free_def)\n\nlemma error_free_set_lvars [simp,intro]:\n\"error_free s \\ error_free ((set_lvars l) s)\"\nby (cases s) simp\n\nlemma error_free_set_locals [simp,intro]: \n\"error_free (x, s)\n \\ error_free (x, set_locals l s')\"\nby (simp add: error_free_def)\n\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.19319383479783198}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__19_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__19_on_rules imports n_german_lemma_on_inv__19\nbegin\nsection{*All lemmas on causal relation between inv__19*}\nlemma lemma_inv__19_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__19 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__19) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__19_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.19319382917512679}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__14_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__14_on_rules imports n_german_lemma_on_inv__14\nbegin\nsection{*All lemmas on causal relation between inv__14*}\nlemma lemma_inv__14_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__14) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__14_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.19313713417939343}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__28_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__28_on_rules imports n_german_lemma_on_inv__28\nbegin\nsection{*All lemmas on causal relation between inv__28*}\nlemma lemma_inv__28_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__28) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__28_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.19313711934692226}} {"text": "(* Title: HOL/Auth/n_germanSimp_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_on_inis imports n_germanSimp_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__2 p__Inv3 p__Inv4)\\\n (f=inv__3 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__6 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__7 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__9 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__10 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__12 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__27 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__31 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__40 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__41 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__42 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__44 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__47 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__48 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__53 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__54 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__55 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__56 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__57 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__58 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__60 p__Inv3 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__2 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__3 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__6 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__7 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__9 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__10 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__12 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__27 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__31 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__40 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__41 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__42 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__44 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__47 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__48 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__53 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__53)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__54 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__54)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__55 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__55)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__56 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__56)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__57 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__57)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__58 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__58)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__59)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__60 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__60)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.32766830738621877, "lm_q1q2_score": 0.19296030471683717}} {"text": "theory RepeatCorrespondence\n imports RepeatUpdate RepeatValue CorrespondenceHelper\nbegin\n\ncontext correspondence begin\n\nsection \"Mono-correspondence\"\n\nlemma uvrepeat_bod_monocorrespondence:\n \"\\proc_ctx_wellformed \\';\n \\u \\ \\v matches-u-v \\';\n \\', \\ \\ uacc \\ vacc : \\a \\ra, wa\\;\n \\', \\ \\ uobsv \\ vobsv : \\o \\ro, {}\\;\n ro \\ wa = {};\n urepeat_bod \\u n f g \\ \\' \\a uacc \\o uobsv uret;\n vrepeat_bod \\v n f g vacc vobsv vret;\n \\', 0, [], {}, [option.Some (TRecord [(''acc'', bang \\a, Present), (''obsv'', \\o, Present)] Unboxed)] \\ (App f (Var 0)) : TPrim Bool;\n \\', 0, [], {}, [option.Some (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed)] \\ (App g (Var 0)) : \\a\\\n \\\\r' w'. \\', \\' \\ uret \\ vret : \\a \\r', w'\\ \\ r' \\ (ra \\ ro) \\ frame \\ wa \\' w'\"\n apply (induct n arbitrary: \\ uacc ra wa vacc)\n apply clarsimp\n apply (intro exI conjI; simp?)\n apply blast\n apply (rule upd.frame_id)\n apply clarsimp\n apply (rename_tac n \\ uacc ra wa vacc b ba)\n apply (case_tac b; clarsimp)\n apply (drule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp) \n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (erule u_v_primE; clarsimp)\n apply (intro exI conjI; simp?)\n apply blast\n apply (rule upd.frame_id)\n apply (drule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp)\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (erule u_v_primE; clarsimp)\n apply (drule_tac r = \"ra \\ ro\" and w = wa and \n \\ = \"[URecord [(uacc, type_repr \\a), (uobsv, type_repr \\o)] None]\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply blast\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (rename_tac r' w')\n apply (thin_tac \"frame _ {} _ {}\")\n apply (frule_tac u = uobsv and v = vobsv in upd_val_rel_frame(1)[rotated 3]; simp?; clarsimp?)\n apply (frule_tac v = uobsv and v' = vobsv in frame_noalias_upd_val_rel'(2); simp?)\n apply (elim meta_allE meta_impE, assumption, assumption, assumption, assumption, assumption)\n apply clarsimp\n apply (intro exI conjI, assumption, blast)\n apply (erule upd.frame_trans; assumption)\n done\n\nsection \"Upward propagation\"\n\nlemma uvrepeat_bod_upward_propagation:\n \"\\proc_ctx_wellformed \\';\n \\u \\ \\v matches-u-v \\';\n \\', \\ \\ uacc \\ vacc : \\a \\ra, wa\\;\n \\', \\ \\ uobsv \\ vobsv : \\o \\ro, {}\\;\n ro \\ wa = {};\n urepeat_bod \\u n f g \\ \\' \\a uacc \\o uobsv uret;\n \\', 0, [], {}, [option.Some (TRecord [(''acc'', bang \\a, Present), (''obsv'', \\o, Present)] Unboxed)] \\ (App f (Var 0)) : TPrim Bool;\n \\', 0, [], {}, [option.Some (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed)] \\ (App g (Var 0)) : \\a\\\n \\ \\vret. vrepeat_bod \\v n f g vacc vobsv vret\"\n apply (induct n arbitrary: \\ uacc ra wa vacc)\n apply clarsimp\n apply (intro exI; simp)\n apply clarsimp\n apply (rename_tac n \\ uacc ra wa vacc b)\n apply (case_tac b; clarsimp)\n apply (rule_tac x = vacc in exI)\n apply clarsimp\n apply (rule_tac x = b in exI)\n apply clarsimp\n apply (frule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" and\n \\' = \"[VRecord [vacc, vobsv]]\" in val_executes_from_upd_executes(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp)\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (frule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp)\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (erule u_v_uprimE; simp)\n apply (frule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" and\n \\' = \"[VRecord [vacc, vobsv]]\" in val_executes_from_upd_executes(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp)\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (frule_tac r = \"(ra \\ wa) \\ ro\" and w = \"{}\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply (rule upd_val_rel_bang(1); simp)\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (erule u_v_uprimE; clarsimp)\n apply (thin_tac \"frame _ {} _ {}\")\n apply (frule_tac r = \"ra \\ ro\" and w = wa and\n \\' = \"[VRecord [vacc, vobsv]]\" and\n e = \"App g (Var 0)\" in val_executes_from_upd_executes(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply blast\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (frule_tac r = \"ra \\ ro\" and w = wa and\n \\' = \"[VRecord [vacc, vobsv]]\" and\n e = \"App g (Var 0)\" in mono_correspondence(1)[rotated 3]; simp?)\n apply (intro u_v_matches_some[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_matches_empty[where \\s = \"[]\", simplified]\n u_v_struct\n u_v_r_cons1[where w' = \"{}\", simplified]\n u_v_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]\n u_v_r_empty; simp?)\n apply blast\n apply (simp add: u_v_matches.u_v_matches_empty)\n apply clarsimp\n apply (frule_tac u = uobsv and v = vobsv in upd_val_rel_frame(1)[rotated 3]; simp?; clarsimp?)\n apply (drule_tac v = uobsv and v' = vobsv in frame_noalias_upd_val_rel'(2)[rotated 1]; simp?)\n apply (elim meta_allE meta_impE, assumption, assumption, assumption, assumption)\n apply clarsimp\n apply (rename_tac ret)\n apply (rule_tac x = ret in exI)\n apply clarsimp\n apply (rule_tac x = b in exI)\n apply clarsimp\n apply (intro exI conjI; assumption)\n done\n\nsection \"Mono-correspondence and upward propagation\"\n\nlemma uvrepeat_monocorrespond_upward_propagation:\n \"\\\\ \\' au av v v' r w.\n \\proc_ctx_wellformed \\';\n \\u \\ \\v matches-u-v \\';\n \\', \\ \\ au \\ av : TRecord\n [(''n'', TPrim (Num U64), Present),\n (''stop'', TFun (TRecord [(''acc'', bang \\a, Present), (''obsv'', \\o, Present)] Unboxed) (TPrim Bool), Present),\n (''step'', TFun (TRecord [(''acc'', \\a, Present), (''obsv'', \\o, Present)] Unboxed) \\a, Present),\n (''acc'', \\a, Present), (''obsv'', \\o, Present)]\n Unboxed \\r, w\\;\n urepeat \\' \\u \\a \\o (\\, au) (\\', v)\\\n \\ (val.vrepeat \\' \\v \\a \\o av v' \\\n (\\r' w'. \\', \\' \\ v \\ v' : \\a \\r', w'\\ \\ r' \\ r \\ frame \\ w \\' w')) \\\n (\\v'. val.vrepeat \\' \\v \\a \\o av v')\"\n unfolding urepeat_def val.vrepeat_def\n apply clarsimp\n apply (erule u_v_urecE; clarsimp)\n apply (erule u_v_r_consE'; clarsimp)+\n apply (erule u_v_uprimE)\n apply (erule u_v_r_uemptyE)\n apply clarsimp\n apply (frule u_v_tfun_no_pointers)\n apply (frule u_v_tfun_no_pointers(2))\n apply clarsimp\n apply (rename_tac \\ \\' v v' n f f' g g' rg wg acc acc' ra wa obsv obsv' ro wo)\n apply (frule_tac u = g in u_v_tfun_no_pointers(1))\n apply (frule_tac u = g in u_v_tfun_no_pointers(2))\n apply clarsimp\n apply (cut_tac \\' = \\' and \\ = \\ and \\ = \\o and u = obsv and r = ro and w = wo in u_v_bang_not_writable(1); simp?)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (drule uvrepeat_bod_monocorrespondence[rotated 5]; simp?)\n apply (erule u_v_tfunE; clarsimp)+\n apply blast\n apply blast\n apply blast\n apply (drule_tac vacc = acc' and vobsv = obsv' and ra = ra and wa = wa\n in uvrepeat_bod_upward_propagation[rotated 5]; simp?)\n apply blast\n apply (erule u_v_tfunE; clarsimp)+\n apply (intro conjI exI upd_val_rel_to_vval_typing(1); assumption)+\n apply (erule u_v_tfunE; clarsimp)+\n apply (intro conjI exI upd_val_rel_to_vval_typing(1); assumption)+\n done\n\nend (* of context *)\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/loops/RepeatCorrespondence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.36296920551961687, "lm_q1q2_score": 0.1928126442180458}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__25_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__25_on_rules imports n_german_lemma_on_inv__25\nbegin\nsection{*All lemmas on causal relation between inv__25*}\nlemma lemma_inv__25_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__25 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__25) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__25_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.37387582974820255, "lm_q1q2_score": 0.1927778238256407}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__47_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__47_on_rules imports n_german_lemma_on_inv__47\nbegin\nsection{*All lemmas on causal relation between inv__47*}\nlemma lemma_inv__47_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__47 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__47) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__47_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.37387581579519075, "lm_q1q2_score": 0.19277781663118995}} {"text": "(*<*)\ntheory AOT_syntax\n imports AOT_commands\n keywords \"AOT_register_variable_names\" :: thy_decl\n and \"AOT_register_metavariable_names\" :: thy_decl\n and \"AOT_register_premise_set_names\" :: thy_decl\n and \"AOT_register_type_constraints\" :: thy_decl\n abbrevs \"actually\" = \"\\<^bold>\\\"\n and \"neccessarily\" = \"\\\"\n and \"possibly\" = \"\\\"\n and \"the\" = \"\\<^bold>\\\"\n and \"lambda\" = \"[\\\u0007]\"\n and \"being such that\" = \"[\\ \u0007]\"\n and \"forall\" = \"\\\"\n and \"exists\" = \"\\\"\n and \"equivalent\" = \"\\\"\n and \"not\" = \"\\\"\n and \"implies\" = \"\\\"\n and \"equal\" = \"=\"\n and \"by definition\" = \"\\<^sub>d\\<^sub>f\"\n and \"df\" = \"\\<^sub>d\\<^sub>f\"\n and \"denotes\" = \"\\\"\nbegin\n(*>*)\n\nsection\\Approximation of the Syntax of PLM\\\n\nlocale AOT_meta_syntax\nbegin\nnotation AOT_model_valid_in (\"\\<^bold>[_ \\<^bold>\\ _\\<^bold>]\")\nnotation AOT_model_axiom (\"\\<^bold>\\\\<^bold>[_\\<^bold>]\")\nnotation AOT_model_act_axiom (\"\\<^bold>\\\\<^bold>[_\\<^bold>]\")\nend\nlocale AOT_no_meta_syntax\nbegin\nno_notation AOT_model_valid_in (\"\\<^bold>[_ \\<^bold>\\ _\\<^bold>]\")\nno_notation AOT_model_axiom (\"\\<^bold>\\\\<^bold>[_\\<^bold>]\")\nno_notation AOT_model_act_axiom (\"\\<^bold>\\\\<^bold>[_\\<^bold>]\")\nend\n\nconsts AOT_denotes :: \\'a::AOT_Term \\ \\\\\n AOT_imp :: \\[\\, \\] \\ \\\\\n AOT_not :: \\\\ \\ \\\\\n AOT_box :: \\\\ \\ \\\\\n AOT_act :: \\\\ \\ \\\\\n AOT_forall :: \\('a::AOT_Term \\ \\) \\ \\\\\n AOT_eq :: \\'a::AOT_Term \\ 'a::AOT_Term \\ \\\\\n AOT_desc :: \\('a::AOT_UnaryIndividualTerm \\ \\) \\ 'a\\\n AOT_exe :: \\<'a::AOT_IndividualTerm> \\ 'a \\ \\\\\n AOT_lambda :: \\('a::AOT_IndividualTerm \\ \\) \\ <'a>\\\n AOT_lambda0 :: \\\\ \\ \\\\\n AOT_concrete :: \\<'a::AOT_UnaryIndividualTerm> AOT_var\\\n\nnonterminal \\\\<^sub>s and \\ and \\0 and \\ and exe_arg and exe_args\n and lambda_args and desc and free_var and free_vars\n and AOT_props and AOT_premises and AOT_world_relative_prop\n\nsyntax \"_AOT_process_frees\" :: \\\\ \\ \\'\\ (\"_\")\n \"_AOT_verbatim\" :: \\any \\ \\\\ (\\\\_\\\\)\n \"_AOT_verbatim\" :: \\any \\ \\\\ (\\\\_\\\\)\n \"_AOT_quoted\" :: \\\\' \\ any\\ (\\\\_\\\\)\n \"_AOT_quoted\" :: \\\\' \\ any\\ (\\\\_\\\\)\n \"\" :: \\\\ \\ \\\\ (\\'(_')\\)\n \"_AOT_process_frees\" :: \\\\ \\ \\'\\ (\"_\")\n \"\" :: \\\\\\<^sub>s \\ \\\\ (\"_\")\n \"\" :: \\\\ \\ \\\\ (\"_\")\n \"\" :: \\\\ \\ \\\\ (\"'(_')\")\n \"_AOT_term_var\" :: \\id_position \\ \\\\ (\"_\")\n \"_AOT_term_var\" :: \\id_position \\ \\\\ (\"_\")\n \"_AOT_exe_vars\" :: \\id_position \\ exe_arg\\ (\"_\")\n \"_AOT_lambda_vars\" :: \\id_position \\ lambda_args\\ (\"_\")\n \"_AOT_var\" :: \\id_position \\ \\\\ (\"_\")\n \"_AOT_vars\" :: \\id_position \\ any\\\n \"_AOT_verbatim\" :: \\any \\ \\\\ (\\\\_\\\\)\n \"_AOT_valid\" :: \\w \\ \\' \\ bool\\ (\\[_ \\ _]\\)\n \"_AOT_denotes\" :: \\\\ \\ \\\\ (\\_\\\\)\n \"_AOT_imp\" :: \\[\\, \\] \\ \\\\ (infixl \\\\\\ 25)\n \"_AOT_not\" :: \\\\ \\ \\\\ (\\~_\\ [50] 50)\n \"_AOT_not\" :: \\\\ \\ \\\\ (\\\\_\\ [50] 50)\n \"_AOT_box\" :: \\\\ \\ \\\\ (\\\\_\\ [49] 54)\n \"_AOT_act\" :: \\\\ \\ \\\\ (\\\\<^bold>\\_\\ [49] 54)\n \"_AOT_all\" :: \\\\ \\ \\ \\ \\\\ (\\\\_ _\\ [1,40])\nsyntax (input)\n \"_AOT_all_ellipse\"\n :: \\id_position \\ id_position \\ \\ \\ \\\\ (\\\\_...\\_ _\\ [1,40])\nsyntax (output)\n \"_AOT_all_ellipse\"\n :: \\id_position \\ id_position \\ \\ \\ \\\\ (\\\\_...\\_'(_')\\ [1,40])\nsyntax\n \"_AOT_eq\" :: \\[\\, \\] \\ \\\\ (infixl \\=\\ 50)\n \"_AOT_desc\" :: \\\\ \\ \\ \\ desc\\ (\"\\<^bold>\\__\" [1,1000])\n \"\" :: \\desc \\ \\\\<^sub>s\\ (\"_\")\n \"_AOT_lambda\" :: \\lambda_args \\ \\ \\ \\\\ (\\[\\_ _]\\)\n \"_explicitRelation\" :: \\\\ \\ \\\\ (\"[_]\")\n \"\" :: \\\\\\<^sub>s \\ exe_arg\\ (\"_\")\n \"\" :: \\exe_arg \\ exe_args\\ (\"_\")\n \"_AOT_exe_args\" :: \\exe_arg \\ exe_args \\ exe_args\\ (\"__\")\n \"_AOT_exe_arg_ellipse\" :: \\id_position \\ id_position \\ exe_arg\\ (\"_..._\")\n \"_AOT_lambda_arg_ellipse\"\n :: \\id_position \\ id_position \\ lambda_args\\ (\"_..._\")\n \"_AOT_term_ellipse\" :: \\id_position \\ id_position \\ \\\\ (\"_..._\")\n \"_AOT_exe\" :: \\\\ \\ exe_args \\ \\\\ (\\__\\)\n \"_AOT_enc\" :: \\exe_args \\ \\ \\ \\\\ (\\__\\)\n \"_AOT_lambda0\" :: \\\\ \\ \\0\\ (\\[\\ _]\\)\n \"\" :: \\\\0 \\ \\\\ (\"_\")\n \"\" :: \\\\0 \\ \\\\ (\"_\")\n \"_AOT_concrete\" :: \\\\\\ (\\E!\\)\n \"\" :: \\any \\ exe_arg\\ (\"\\_\\\")\n \"\" :: \\desc \\ free_var\\ (\"_\")\n \"\" :: \\\\ \\ free_var\\ (\"_\")\n \"_AOT_appl\" :: \\id_position \\ free_vars \\ \\\\ (\"_'{_'}\")\n \"_AOT_appl\" :: \\id_position \\ free_vars \\ \\\\ (\"_'{_'}\")\n \"_AOT_appl\" :: \\id_position \\ free_vars \\ free_vars\\ (\"_'{_'}\")\n \"_AOT_appl\" :: \\id_position \\ free_vars \\ free_vars\\ (\"_'{_'}\")\n \"_AOT_term_var\" :: \\id_position \\ free_var\\ (\"_\")\n \"\" :: \\any \\ free_var\\ (\"\\_\\\")\n \"\" :: \\free_var \\ free_vars\\ (\"_\")\n \"_AOT_args\" :: \\free_var \\ free_vars \\ free_vars\\ (\"_,_\")\n \"_AOT_free_var_ellipse\" :: \\id_position \\ id_position \\ free_var\\ (\"_..._\")\nsyntax \"_AOT_premises\"\n :: \\AOT_world_relative_prop \\ AOT_premises \\ AOT_premises\\ (infixr \\,\\ 3)\n \"_AOT_world_relative_prop\" :: \"\\ \\ AOT_world_relative_prop\" (\"_\")\n \"\" :: \"AOT_world_relative_prop \\ AOT_premises\" (\"_\")\n \"_AOT_prop\" :: \\AOT_world_relative_prop \\ AOT_prop\\ (\\_\\)\n \"\" :: \\AOT_prop \\ AOT_props\\ (\\_\\)\n \"_AOT_derivable\" :: \"AOT_premises \\ \\' \\ AOT_prop\" (infixl \\\\<^bold>\\\\ 2)\n \"_AOT_nec_derivable\" :: \"AOT_premises \\ \\' \\ AOT_prop\" (infixl \\\\<^bold>\\\\<^sub>\\\\ 2)\n \"_AOT_theorem\" :: \"\\' \\ AOT_prop\" (\\\\<^bold>\\ _\\)\n \"_AOT_nec_theorem\" :: \"\\' \\ AOT_prop\" (\\\\<^bold>\\\\<^sub>\\ _\\)\n \"_AOT_equiv_def\" :: \\\\ \\ \\ \\ AOT_prop\\ (infixl \\\\\\<^sub>d\\<^sub>f\\ 3)\n \"_AOT_axiom\" :: \"\\' \\ AOT_axiom\" (\\_\\)\n \"_AOT_act_axiom\" :: \"\\' \\ AOT_act_axiom\" (\\_\\)\n \"_AOT_axiom\" :: \"\\' \\ AOT_prop\" (\\_ \\ \\\\<^sub>\\\\)\n \"_AOT_act_axiom\" :: \"\\' \\ AOT_prop\" (\\_ \\ \\\\)\n \"_AOT_id_def\" :: \\\\ \\ \\ \\ AOT_prop\\ (infixl \\=\\<^sub>d\\<^sub>f\\ 3)\n \"_AOT_for_arbitrary\"\n :: \\id_position \\ AOT_prop \\ AOT_prop\\ (\\for arbitrary _: _\\ [1000,1] 1)\nsyntax (output) \"_lambda_args\" :: \\any \\ patterns \\ patterns\\ (\"__\")\n\ntranslations\n \"[w \\ \\]\" => \"CONST AOT_model_valid_in w \\\"\n\nAOT_syntax_print_translations\n \"[w \\ \\]\" <= \"CONST AOT_model_valid_in w \\\"\n\nML_file AOT_syntax.ML\n\nAOT_register_type_constraints\n Individual: \\_::AOT_UnaryIndividualTerm\\ \\_::AOT_IndividualTerm\\ and\n Proposition: \\ and\n Relation: \\<_::AOT_IndividualTerm>\\ and\n Term: \\_::AOT_Term\\\n\nAOT_register_variable_names\n Individual: x y z \\ \\ a b c d and\n Proposition: p q r s and\n Relation: F G H P Q R S and\n Term: \\ \\ \\ \\\n\nAOT_register_metavariable_names\n Individual: \\ and\n Proposition: \\ \\ \\ \\ \\ \\ \\ and\n Relation: \\ and\n Term: \\ \\\n\nAOT_register_premise_set_names \\ \\ \\\n\nparse_ast_translation\\[\n (\\<^syntax_const>\\_AOT_var\\, K AOT_check_var),\n (\\<^syntax_const>\\_AOT_exe_vars\\, K AOT_split_exe_vars),\n (\\<^syntax_const>\\_AOT_lambda_vars\\, K AOT_split_lambda_args)\n]\\\n\ntranslations\n \"_AOT_denotes \\\" => \"CONST AOT_denotes \\\"\n \"_AOT_imp \\ \\\" => \"CONST AOT_imp \\ \\\"\n \"_AOT_not \\\" => \"CONST AOT_not \\\"\n \"_AOT_box \\\" => \"CONST AOT_box \\\"\n \"_AOT_act \\\" => \"CONST AOT_act \\\"\n \"_AOT_eq \\ \\'\" => \"CONST AOT_eq \\ \\'\"\n \"_AOT_lambda0 \\\" => \"CONST AOT_lambda0 \\\"\n \"_AOT_concrete\" => \"CONST AOT_term_of_var (CONST AOT_concrete)\"\n \"_AOT_lambda \\ \\\" => \"CONST AOT_lambda (_abs \\ \\)\"\n \"_explicitRelation \\\" => \"\\\"\n\nAOT_syntax_print_translations\n \"_AOT_lambda (_lambda_args x y) \\\" <= \"CONST AOT_lambda (_abs (_pattern x y) \\)\"\n \"_AOT_lambda (_lambda_args x y) \\\" <= \"CONST AOT_lambda (_abs (_patterns x y) \\)\"\n \"_AOT_lambda x \\\" <= \"CONST AOT_lambda (_abs x \\)\"\n \"_lambda_args x (_lambda_args y z)\" <= \"_lambda_args x (_patterns y z)\"\n \"_lambda_args (x y z)\" <= \"_lambda_args (_tuple x (_tuple_arg (_tuple y z)))\"\n\n\nAOT_syntax_print_translations\n \"_AOT_imp \\ \\\" <= \"CONST AOT_imp \\ \\\"\n \"_AOT_not \\\" <= \"CONST AOT_not \\\"\n \"_AOT_box \\\" <= \"CONST AOT_box \\\"\n \"_AOT_act \\\" <= \"CONST AOT_act \\\"\n \"_AOT_all \\ \\\" <= \"CONST AOT_forall (_abs \\ \\)\"\n \"_AOT_all \\ \\\" <= \"CONST AOT_forall (\\\\. \\)\"\n \"_AOT_eq \\ \\'\" <= \"CONST AOT_eq \\ \\'\"\n \"_AOT_desc x \\\" <= \"CONST AOT_desc (_abs x \\)\"\n \"_AOT_desc x \\\" <= \"CONST AOT_desc (\\x. \\)\"\n \"_AOT_lambda0 \\\" <= \"CONST AOT_lambda0 \\\"\n \"_AOT_concrete\" <= \"CONST AOT_term_of_var (CONST AOT_concrete)\"\n\ntranslations\n \"_AOT_appl \\ (_AOT_args a b)\" => \"_AOT_appl (\\ a) b\"\n \"_AOT_appl \\ a\" => \"\\ a\"\n\n\nparse_translation\\\n[\n (\\<^syntax_const>\\_AOT_var\\, parseVar true),\n (\\<^syntax_const>\\_AOT_vars\\, parseVar false),\n (\\<^syntax_const>\\_AOT_valid\\, fn ctxt => fn [w,x] =>\n \\<^const>\\AOT_model_valid_in\\ $ w $ x),\n (\\<^syntax_const>\\_AOT_quoted\\, fn ctxt => fn [x] => x),\n (\\<^syntax_const>\\_AOT_process_frees\\, fn ctxt => fn [x] => processFrees ctxt x),\n (\\<^syntax_const>\\_AOT_world_relative_prop\\, fn ctxt => fn [x] => let\n val (x, premises) = processFreesAndPremises ctxt x\n val (world::formulas) = Variable.variant_frees ctxt [x]\n ((\"v\", dummyT)::(map (fn _ => (\"\\\", dummyT)) premises))\n val term = HOLogic.mk_Trueprop\n (@{const AOT_model_valid_in} $ Free world $ processFrees ctxt x)\n val term = fold (fn (premise,form) => fn trm =>\n @{const \"Pure.imp\"} $\n HOLogic.mk_Trueprop\n (Const (\\<^const_name>\\Set.member\\, dummyT) $ Free form $ premise) $\n (Term.absfree (Term.dest_Free (dropConstraints premise)) trm $ Free form)\n ) (ListPair.zipEq (premises,formulas)) term\n val term = fold (fn (form) => fn trm =>\n Const (\\<^const_name>\\Pure.all\\, dummyT) $\n (Term.absfree form trm)\n ) formulas term\n val term = Term.absfree world term\n in term end),\n (\\<^syntax_const>\\_AOT_prop\\, fn ctxt => fn [x] => let\n val world = case (AOT_ProofData.get ctxt) of SOME w => w\n | _ => raise Fail \"Expected world to be stored in the proof state.\"\n in x $ world end),\n (\\<^syntax_const>\\_AOT_theorem\\, fn ctxt => fn [x] =>\n HOLogic.mk_Trueprop (@{const AOT_model_valid_in} $ @{const w\\<^sub>0} $ x)),\n (\\<^syntax_const>\\_AOT_axiom\\, fn ctxt => fn [x] =>\n HOLogic.mk_Trueprop (@{const AOT_model_axiom} $ x)),\n (\\<^syntax_const>\\_AOT_act_axiom\\, fn ctxt => fn [x] =>\n HOLogic.mk_Trueprop (@{const AOT_model_act_axiom} $ x)),\n (\\<^syntax_const>\\_AOT_nec_theorem\\, fn ctxt => fn [trm] => let\n val world = singleton (Variable.variant_frees ctxt [trm]) (\"v\", @{typ w})\n val trm = HOLogic.mk_Trueprop (@{const AOT_model_valid_in} $ Free world $ trm)\n val trm = Term.absfree world trm\n val trm = Const (\\<^const_name>\\Pure.all\\, dummyT) $ trm\n in trm end),\n (\\<^syntax_const>\\_AOT_derivable\\, fn ctxt => fn [x,y] => let\n val world = case (AOT_ProofData.get ctxt) of SOME w => w\n | _ => raise Fail \"Expected world to be stored in the proof state.\"\n in foldPremises world x y end),\n (\\<^syntax_const>\\_AOT_nec_derivable\\, fn ctxt => fn [x,y] => let\n in Const (\\<^const_name>\\Pure.all\\, dummyT) $\n Abs (\"v\", dummyT, foldPremises (Bound 0) x y) end),\n (\\<^syntax_const>\\_AOT_for_arbitrary\\, fn ctxt => fn [_ $ var $ pos,trm] => let\n val trm = Const (\\<^const_name>\\Pure.all\\, dummyT) $\n (Const (\"_constrainAbs\", dummyT) $ Term.absfree (Term.dest_Free var) trm $ pos)\n in trm end),\n (\\<^syntax_const>\\_AOT_equiv_def\\, parseEquivDef),\n (\\<^syntax_const>\\_AOT_exe\\, parseExe),\n (\\<^syntax_const>\\_AOT_enc\\, parseEnc)\n]\n\\\n\nparse_ast_translation\\\n[\n (\\<^syntax_const>\\_AOT_exe_arg_ellipse\\, parseEllipseList \"_AOT_term_vars\"),\n (\\<^syntax_const>\\_AOT_lambda_arg_ellipse\\, parseEllipseList \"_AOT_vars\"),\n (\\<^syntax_const>\\_AOT_free_var_ellipse\\, parseEllipseList \"_AOT_term_vars\"),\n (\\<^syntax_const>\\_AOT_term_ellipse\\, parseEllipseList \"_AOT_term_vars\"),\n (\\<^syntax_const>\\_AOT_all_ellipse\\, fn ctx => fn [a,b,c] =>\n Ast.mk_appl (Ast.Constant \\<^const_name>\\AOT_forall\\) [\n Ast.mk_appl (Ast.Constant \"_abs\") [parseEllipseList \"_AOT_vars\" ctx [a,b],c]\n ])\n]\n\\\n\nsyntax (output)\n \"_AOT_individual_term\" :: \\'a \\ tuple_args\\ (\"_\")\n \"_AOT_individual_terms\" :: \\tuple_args \\ tuple_args \\ tuple_args\\ (\"__\")\n \"_AOT_relation_term\" :: \\'a \\ \\\\\n \"_AOT_any_term\" :: \\'a \\ \\\\\n\n\nprint_ast_translation\\AOT_syntax_print_ast_translations[\n (\\<^syntax_const>\\_AOT_individual_term\\, AOT_print_individual_term),\n (\\<^syntax_const>\\_AOT_relation_term\\, AOT_print_relation_term),\n (\\<^syntax_const>\\_AOT_any_term\\, AOT_print_generic_term)\n]\\\n\nAOT_syntax_print_translations\n \"_AOT_individual_terms (_AOT_individual_term x) (_AOT_individual_terms (_tuple y z))\"\n <= \"_AOT_individual_terms (_tuple x (_tuple_args y z))\"\n \"_AOT_individual_terms (_AOT_individual_term x) (_AOT_individual_term y)\"\n <= \"_AOT_individual_terms (_tuple x (_tuple_arg y))\"\n \"_AOT_individual_terms (_tuple x y)\" <= \"_AOT_individual_term (_tuple x y)\"\n \"_AOT_exe (_AOT_relation_term \\) (_AOT_individual_term \\)\" <= \"CONST AOT_exe \\ \\\"\n \"_AOT_denotes (_AOT_any_term \\)\" <= \"CONST AOT_denotes \\\"\n\nAOT_define AOT_conj :: \\[\\, \\] \\ \\\\ (infixl \\&\\ 35) \\\\ & \\ \\\\<^sub>d\\<^sub>f \\(\\ \\ \\\\)\\\ndeclare \"AOT_conj\"[AOT del, AOT_defs del]\nAOT_define AOT_disj :: \\[\\, \\] \\ \\\\ (infixl \\\\\\ 35) \\\\ \\ \\ \\\\<^sub>d\\<^sub>f \\\\ \\ \\\\\ndeclare \"AOT_disj\"[AOT del, AOT_defs del]\nAOT_define AOT_equiv :: \\[\\, \\] \\ \\\\ (infix \\\\\\ 20) \\\\ \\ \\ \\\\<^sub>d\\<^sub>f (\\ \\ \\) & (\\ \\ \\)\\\ndeclare \"AOT_equiv\"[AOT del, AOT_defs del]\nAOT_define AOT_dia :: \\\\ \\ \\\\ (\\\\_\\ [49] 54) \\\\\\ \\\\<^sub>d\\<^sub>f \\\\\\\\\\\ndeclare \"AOT_dia\"[AOT del, AOT_defs del]\n\ncontext AOT_meta_syntax\nbegin\nnotation AOT_dia (\"\\<^bold>\\_\" [49] 54)\nnotation AOT_conj (infixl \\\\<^bold>&\\ 35)\nnotation AOT_disj (infixl \\\\<^bold>\\\\ 35)\nnotation AOT_equiv (infixl \\\\<^bold>\\\\ 20)\nend\ncontext AOT_no_meta_syntax\nbegin\nno_notation AOT_dia (\"\\<^bold>\\_\" [49] 54)\nno_notation AOT_conj (infixl \\\\<^bold>&\\ 35)\nno_notation AOT_disj (infixl \\\\<^bold>\\\\ 35)\nno_notation AOT_equiv (infixl \\\\<^bold>\\\\ 20)\nend\n\n\nprint_translation \\\nAOT_syntax_print_translations\n [\n AOT_preserve_binder_abs_tr'\n \\<^const_syntax>\\AOT_forall\\\n \\<^syntax_const>\\_AOT_all\\\n (\\<^syntax_const>\\_AOT_all_ellipse\\, true)\n \\<^const_name>\\AOT_imp\\,\n AOT_binder_trans @{theory} @{binding \"AOT_forall_binder\"} \\<^syntax_const>\\_AOT_all\\,\n Syntax_Trans.preserve_binder_abs_tr'\n \\<^const_syntax>\\AOT_desc\\\n \\<^syntax_const>\\_AOT_desc\\,\n AOT_binder_trans @{theory} @{binding \"AOT_desc_binder\"} \\<^syntax_const>\\_AOT_desc\\,\n AOT_preserve_binder_abs_tr'\n \\<^const_syntax>\\AOT_lambda\\\n \\<^syntax_const>\\_AOT_lambda\\\n (\\<^syntax_const>\\_AOT_lambda_arg_ellipse\\, false)\n \\<^const_name>\\undefined\\,\n AOT_binder_trans\n @{theory}\n @{binding \"AOT_lambda_binder\"}\n \\<^syntax_const>\\_AOT_lambda\\\n ]\n\\\n\nparse_translation\\\n[(\\<^syntax_const>\\_AOT_id_def\\, parseIdDef)]\n\\\n\nparse_ast_translation\\[\n (\\<^syntax_const>\\_AOT_all\\,\n AOT_restricted_binder \\<^const_name>\\AOT_forall\\ \\<^const_name>\\AOT_imp\\),\n (\\<^syntax_const>\\_AOT_desc\\,\n AOT_restricted_binder \\<^const_name>\\AOT_desc\\ \\<^const_name>\\AOT_conj\\)\n]\\\n\nAOT_define AOT_exists :: \\\\ \\ \\ \\ \\\\ \\\\AOT_exists \\\\ \\\\<^sub>d\\<^sub>f \\\\\\ \\\\{\\}\\\ndeclare AOT_exists[AOT del, AOT_defs del]\nsyntax \"_AOT_exists\" :: \\\\ \\ \\ \\ \\\\ (\"\\_ _\" [1,40])\n\nAOT_syntax_print_translations\n \"_AOT_exists \\ \\\" <= \"CONST AOT_exists (_abs \\ \\)\"\n \"_AOT_exists \\ \\\" <= \"CONST AOT_exists (\\\\. \\)\"\n\nparse_ast_translation\\ \n[(\\<^syntax_const>\\_AOT_exists\\,\n AOT_restricted_binder \\<^const_name>\\AOT_exists\\ \\<^const_name>\\AOT_conj\\)]\n\\\n\ncontext AOT_meta_syntax\nbegin\nnotation AOT_exists (binder \"\\<^bold>\\\" 8)\nend\ncontext AOT_no_meta_syntax\nbegin\nno_notation AOT_exists (binder \"\\<^bold>\\\" 8)\nend\n\n\nsyntax (input)\n \"_AOT_exists_ellipse\" :: \\id_position \\ id_position \\ \\ \\ \\\\ (\\\\_...\\_ _\\ [1,40])\nsyntax (output)\n \"_AOT_exists_ellipse\" :: \\id_position \\ id_position \\ \\ \\ \\\\ (\\\\_...\\_ '(_')\\ [1,40])\nparse_ast_translation\\[(\\<^syntax_const>\\_AOT_exists_ellipse\\, fn ctx => fn [a,b,c] =>\n Ast.mk_appl (Ast.Constant \"AOT_exists\")\n [Ast.mk_appl (Ast.Constant \"_abs\") [parseEllipseList \"_AOT_vars\" ctx [a,b],c]])]\\\nprint_translation\\AOT_syntax_print_translations [\n AOT_preserve_binder_abs_tr'\n \\<^const_syntax>\\AOT_exists\\\n \\<^syntax_const>\\_AOT_exists\\\n (\\<^syntax_const>\\_AOT_exists_ellipse\\,true) \\<^const_name>\\AOT_conj\\,\n AOT_binder_trans\n @{theory}\n @{binding \"AOT_exists_binder\"}\n \\<^syntax_const>\\_AOT_exists\\\n]\\\n\n\n\nsyntax \"_AOT_DDDOT\" :: \"\\\" (\"...\")\nsyntax \"_AOT_DDDOT\" :: \"\\\" (\"\\\")\nparse_translation\\[(\\<^syntax_const>\\_AOT_DDDOT\\, parseDDOT)]\\\n\nprint_translation\\AOT_syntax_print_translations\n[(\\<^const_syntax>\\Pure.all\\, fn ctxt => fn [Abs (_, _,\n Const (\\<^const_syntax>\\HOL.Trueprop\\, _) $\n (Const (\\<^const_syntax>\\AOT_model_valid_in\\, _) $ Bound 0 $ y))] => let\n val y = (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y)\n in (Const (\\<^syntax_const>\\_AOT_nec_theorem\\, dummyT) $ y) end\n| [p as Abs (name, _,\n Const (\\<^const_syntax>\\HOL.Trueprop\\, _) $\n (Const (\\<^const_syntax>\\AOT_model_valid_in\\, _) $ w $ y))]\n=> (Const (\\<^syntax_const>\\_AOT_for_arbitrary\\, dummyT) $\n (Const (\"_bound\", dummyT) $ Free (name, dummyT)) $\n (Term.betapply (p, (Const (\"_bound\", dummyT) $ Free (name, dummyT)))))\n),\n\n (\\<^const_syntax>\\AOT_model_valid_in\\, fn ctxt =>\n fn [w as (Const (\"_free\", _) $ Free (v, _)), y] => let\n val is_world = (case (AOT_ProofData.get ctxt)\n of SOME (Free (w, _)) => Name.clean w = Name.clean v | _ => false)\n val y = (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y)\n in if is_world then y else Const (\\<^syntax_const>\\_AOT_valid\\, dummyT) $ w $ y end\n | [Const (\\<^const_syntax>\\w\\<^sub>0\\, _), y] => let\n val y = (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y)\n in case (AOT_ProofData.get ctxt) of SOME (Const (\\<^const_name>\\w\\<^sub>0\\, _)) => y |\n _ => Const (\\<^syntax_const>\\_AOT_theorem\\, dummyT) $ y end\n | [Const (\"_var\", _) $ _, y] => let\n val y = (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y)\n in Const (\\<^syntax_const>\\_AOT_nec_theorem\\, dummyT) $ y end\n ),\n (\\<^const_syntax>\\AOT_model_axiom\\, fn ctxt => fn [trm] =>\n Const (\\<^syntax_const>\\_AOT_axiom\\, dummyT) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ trm)),\n (\\<^const_syntax>\\AOT_model_act_axiom\\, fn ctxt => fn [trm] =>\n Const (\\<^syntax_const>\\_AOT_axiom\\, dummyT) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ trm)),\n(\\<^syntax_const>\\_AOT_process_frees\\, fn _ => fn [t] => let\n fun mapAppls (x as Const (\"_free\", _) $\n Free (_, Type (\"_ignore_type\", [Type (\"fun\", _)])))\n = (Const (\"_AOT_raw_appl\", dummyT) $ x)\n | mapAppls (x as Const (\"_free\", _) $ Free (_, Type (\"fun\", _)))\n = (Const (\"_AOT_raw_appl\", dummyT) $ x)\n | mapAppls (x as Const (\"_var\", _) $\n Var (_, Type (\"_ignore_type\", [Type (\"fun\", _)])))\n = (Const (\"_AOT_raw_appl\", dummyT) $ x)\n | mapAppls (x as Const (\"_var\", _) $ Var (_, Type (\"fun\", _)))\n = (Const (\"_AOT_raw_appl\", dummyT) $ x)\n | mapAppls (x $ y) = mapAppls x $ mapAppls y\n | mapAppls (Abs (x,y,z)) = Abs (x,y, mapAppls z)\n | mapAppls x = x\n in mapAppls t end\n)\n]\n\\\n\nprint_ast_translation\\AOT_syntax_print_ast_translations\nlet\nfun handleTermOfVar x kind name = (\nlet\nval _ = case kind of \"_free\" => () | \"_var\" => () | \"_bound\" => () | _ => raise Match\nin\n case printVarKind name\n of (SingleVariable name) => Ast.Appl [Ast.Constant kind, Ast.Variable name]\n | (Ellipses (s, e)) => Ast.Appl [Ast.Constant \"_AOT_free_var_ellipse\",\n Ast.Appl [Ast.Constant kind, Ast.Variable s],\n Ast.Appl [Ast.Constant kind, Ast.Variable e]\n ]\n | Verbatim name => Ast.mk_appl (Ast.Constant \"_AOT_quoted\")\n [Ast.mk_appl (Ast.Constant \"_AOT_term_of_var\") [x]]\nend\n)\nfun termOfVar ctxt (Ast.Appl [Ast.Constant \"_constrain\",\n x as Ast.Appl [Ast.Constant kind, Ast.Variable name], _]) = termOfVar ctxt x\n | termOfVar ctxt (x as Ast.Appl [Ast.Constant kind, Ast.Variable name])\n = handleTermOfVar x kind name\n | termOfVar ctxt (x as Ast.Appl [Ast.Constant rep, y]) = (\nlet\nval (restr,_) = Local_Theory.raw_theory_result (fn thy => (\nlet\nval restrs = Symtab.dest (AOT_Restriction.get thy)\nval restr = List.find (fn (n,(_,Const (c,t))) => (\n c = rep orelse c = Lexicon.unmark_const rep) | _ => false) restrs\nin\n(restr,thy)\nend\n)) ctxt\nin\n case restr of SOME r => Ast.Appl [Ast.Constant (\\<^const_syntax>\\AOT_term_of_var\\), y]\n | _ => raise Match\nend)\n\nin\n[(\\<^const_syntax>\\AOT_term_of_var\\, fn ctxt => fn [x] => termOfVar ctxt x),\n(\"_AOT_raw_appl\", fn ctxt => fn t::a::args => let\nfun applyTermOfVar (t as Ast.Appl (Ast.Constant \\<^const_syntax>\\AOT_term_of_var\\::[x]))\n = (case try (termOfVar ctxt) x of SOME y => y | _ => t)\n | applyTermOfVar y = (case try (termOfVar ctxt) y of SOME x => x | _ => y)\nval ts = fold (fn a => fn b => Ast.mk_appl (Ast.Constant \\<^syntax_const>\\_AOT_args\\)\n [b,applyTermOfVar a]) args (applyTermOfVar a)\nin Ast.mk_appl (Ast.Constant \\<^syntax_const>\\_AOT_appl\\) [t,ts] end)]\nend\n\\\n\ncontext AOT_meta_syntax\nbegin\nnotation AOT_denotes (\"_\\<^bold>\\\")\nnotation AOT_imp (infixl \"\\<^bold>\\\" 25)\nnotation AOT_not (\"\\<^bold>\\_\" [50] 50)\nnotation AOT_box (\"\\<^bold>\\_\" [49] 54)\nnotation AOT_act (\"\\<^bold>\\_\" [49] 54)\nnotation AOT_forall (binder \"\\<^bold>\\\" 8)\nnotation AOT_eq (infixl \"\\<^bold>=\" 50)\nnotation AOT_desc (binder \"\\<^bold>\\\" 100)\nnotation AOT_lambda (binder \"\\<^bold>\\\" 100)\nnotation AOT_lambda0 (\"\\<^bold>[\\<^bold>\\ _\\<^bold>]\")\nnotation AOT_exe (\"\\<^bold>\\_,_\\<^bold>\\\")\nnotation AOT_model_equiv_def (infixl \"\\<^bold>\\\\<^sub>d\\<^sub>f\" 10)\nnotation AOT_model_id_def (infixl \"\\<^bold>=\\<^sub>d\\<^sub>f\" 10)\nnotation AOT_term_of_var (\"\\<^bold>\\_\\<^bold>\\\")\nnotation AOT_concrete (\"\\<^bold>E\\<^bold>!\")\nend\ncontext AOT_no_meta_syntax\nbegin\nno_notation AOT_denotes (\"_\\<^bold>\\\")\nno_notation AOT_imp (infixl \"\\<^bold>\\\" 25)\nno_notation AOT_not (\"\\<^bold>\\_\" [50] 50)\nno_notation AOT_box (\"\\<^bold>\\_\" [49] 54)\nno_notation AOT_act (\"\\<^bold>\\_\" [49] 54)\nno_notation AOT_forall (binder \"\\<^bold>\\\" 8)\nno_notation AOT_eq (infixl \"\\<^bold>=\" 50)\nno_notation AOT_desc (binder \"\\<^bold>\\\" 100)\nno_notation AOT_lambda (binder \"\\<^bold>\\\" 100)\nno_notation AOT_lambda0 (\"\\<^bold>[\\<^bold>\\ _\\<^bold>]\")\nno_notation AOT_exe (\"\\<^bold>\\_,_\\<^bold>\\\")\nno_notation AOT_model_equiv_def (infixl \"\\<^bold>\\\\<^sub>d\\<^sub>f\" 10)\nno_notation AOT_model_id_def (infixl \"\\<^bold>=\\<^sub>d\\<^sub>f\" 10)\nno_notation AOT_term_of_var (\"\\<^bold>\\_\\<^bold>\\\")\nno_notation AOT_concrete (\"\\<^bold>E\\<^bold>!\")\nend\n\nbundle AOT_syntax\nbegin\ndeclare[[show_AOT_syntax=true, show_question_marks=false, eta_contract=false]]\nend\n\nbundle AOT_no_syntax\nbegin\ndeclare[[show_AOT_syntax=false, show_question_marks=true]]\nend\n\nparse_translation\\\n[(\"_AOT_restriction\", fn ctxt => fn [Const (name,_)] =>\nlet\nval (restr, ctxt) = ctxt |> Local_Theory.raw_theory_result\n (fn thy => (Option.map fst (Symtab.lookup (AOT_Restriction.get thy) name), thy))\nval restr = case restr of SOME x => x\n | _ => raise Fail (\"Unknown restricted type: \" ^ name)\nin restr end\n)]\n\\\n\nprint_translation\\\nAOT_syntax_print_translations\n[\n (\\<^const_syntax>\\AOT_model_equiv_def\\, fn ctxt => fn [x,y] =>\n Const (\\<^syntax_const>\\_AOT_equiv_def\\, dummyT) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ x) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y))\n]\n\\\n\nprint_translation\\\nAOT_syntax_print_translations [\n(\\<^const_syntax>\\AOT_model_id_def\\, fn ctxt =>\n fn [lhs as Abs (lhsName, lhsTy, lhsTrm), rhs as Abs (rhsName, rhsTy, rhsTrm)] =>\n let\n val (name,_) = Name.variant lhsName\n (Term.declare_term_names rhsTrm (Term.declare_term_names lhsTrm Name.context));\n val lhs = Term.betapply (lhs, Const (\"_bound\", dummyT) $ Free (name, lhsTy))\n val rhs = Term.betapply (rhs, Const (\"_bound\", dummyT) $ Free (name, rhsTy))\n in\n Const (\\<^const_syntax>\\AOT_model_id_def\\, dummyT) $ lhs $ rhs\n end\n | [Const (\\<^const_syntax>\\case_prod\\, _) $ lhs,\n Const (\\<^const_syntax>\\case_prod\\, _) $ rhs] =>\n Const (\\<^const_syntax>\\AOT_model_id_def\\, dummyT) $ lhs $ rhs\n | [Const (\\<^const_syntax>\\case_unit\\, _) $ lhs,\n Const (\\<^const_syntax>\\case_unit\\, _) $ rhs] =>\n Const (\\<^const_syntax>\\AOT_model_id_def\\, dummyT) $ lhs $ rhs\n | [x, y] =>\n Const (\\<^syntax_const>\\_AOT_id_def\\, dummyT) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ x) $\n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ y)\n)]\\\n\ntext\\Special marker for printing propositions as theorems\n and for pretty-printing AOT terms.\\\ndefinition print_as_theorem :: \\\\ \\ bool\\ where\n \\print_as_theorem \\ \\ \\ . \\v . [v \\ \\]\\\nlemma print_as_theoremI:\n assumes \\\\ v . [v \\ \\]\\\n shows \\print_as_theorem \\\\\n using assms by (simp add: print_as_theorem_def)\nattribute_setup print_as_theorem =\n \\Scan.succeed (Thm.rule_attribute []\n (K (fn thm => thm RS @{thm print_as_theoremI})))\\\n \"Print as theorem.\"\nprint_translation\\AOT_syntax_print_translations [\n (\\<^const_syntax>\\print_as_theorem\\, fn ctxt => fn [x] => \n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ x))\n]\\\n\ndefinition print_term :: \\'a \\ 'a\\ where \\print_term \\ \\ x . x\\\nsyntax \"_AOT_print_term\" :: \\\\ \\ 'a\\ (\\AOT'_TERM[_]\\)\ntranslations\n \"_AOT_print_term \\\" => \"CONST print_term (_AOT_process_frees \\)\"\nprint_translation\\AOT_syntax_print_translations [\n (\\<^const_syntax>\\print_term\\, fn ctxt => fn [x] => \n (Const (\\<^syntax_const>\\_AOT_process_frees\\, dummyT) $ x))\n]\\\n\n\n(* To enable meta syntax: *)\n(* interpretation AOT_meta_syntax. *)\n(* To disable meta syntax: *)\ninterpretation AOT_no_meta_syntax.\n\n(* To enable AOT syntax (takes precedence over meta syntax;\n can be done locally using \"including\" or \"include\"): *)\nunbundle AOT_syntax\n(* To disable AOT syntax (restoring meta syntax or no syntax;\n can be done locally using \"including\" or \"include\"): *)\n(* unbundle AOT_no_syntax *)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "ekpyron", "repo": "AOT", "sha": "3f66d0dc05933b01a70936ee63228dac8e3a118a", "save_path": "github-repos/isabelle/ekpyron-AOT", "path": "github-repos/isabelle/ekpyron-AOT/AOT-3f66d0dc05933b01a70936ee63228dac8e3a118a/AOT_syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.3522017820478896, "lm_q1q2_score": 0.1925621514425509}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepCode\nimports\n Separation\n \"CSimpl.VcgSeq\"\nbegin\n\ndefinition\n singleton_t :: \"'a::c_type ptr \\ 'a \\ heap_state\"\nwhere\n \"singleton_t p v \\ lift_state (heap_update p v (\\x. 0), (ptr_retyp p empty_htd))\"\n\ndefinition\n tagd :: \"'a ptr_guard \\ 'a::c_type ptr \\ heap_assert\" (infix \"\\\\<^sub>s\" 100)\nwhere\n \"g \\\\<^sub>s p \\ \\s. s,g \\\\<^sub>s p \\ dom s = s_footprint p\"\n\ndefinition\n field_footprint :: \"'a::c_type ptr \\ qualified_field_name \\ (addr \\ s_heap_index) set\"\nwhere\n \"field_footprint p f \\\n s_footprint_untyped (ptr_val p + of_nat (field_offset TYPE('a) f))\n (export_uinfo (field_typ TYPE('a) f))\"\n\ndefinition\n fs_footprint :: \"'a::c_type ptr \\ qualified_field_name set \\ (addr \\ s_heap_index) set\"\nwhere\n \"fs_footprint p F \\ \\{field_footprint p f | f. f \\ F}\"\n\ndefinition fields :: \"'a::c_type itself \\ qualified_field_name set\" where\n \"fields t \\ {f. field_lookup (typ_info_t TYPE('a)) f 0 \\ None}\"\n\ndefinition\n mfs_sep_map :: \"'a::c_type ptr \\ 'a ptr_guard \\ qualified_field_name set \\ 'a \\ heap_assert\"\n (\"_ \\\\<^bsub>_\\<^esub>\\<^bsup>_\\<^esup> _\" [56,0,0,51] 56)\nwhere\n \"p \\\\<^bsub>g\\<^esub>\\<^bsup>F\\<^esup> v \\ \\s. lift_typ_heap g (singleton_t p v ++ s) p = Some v \\\n F \\ fields TYPE('a) \\\n dom s = s_footprint p - fs_footprint p F \\ wf_heap_val s\"\n\nnotation (input)\n mfs_sep_map (\"_ \\\\<^sub>_\\<^sup>_ _\" [56,0,1000,51] 56)\n\ndefinition\n disjoint_fn :: \"qualified_field_name \\ qualified_field_name set \\ bool\"\nwhere\n \"disjoint_fn f F \\ \\f'\\F. \\ f \\ f' \\ \\ f' \\ f\"\n\ndefinition\n sep_cut' :: \"addr \\ nat \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut' p n \\ \\s. dom s = {(x,y). x \\ {p..+n}}\"\n\ndefinition\n sep_cut :: \"addr \\ addr_bitsize word \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut x y \\ sep_cut' x (unat y)\"\n\ntext \\----\\\n\n(* FIXME MOVE *)\nlemma heap_list_h_eq:\n \"\\ x \\ {p..+q}; q < addr_card; heap_list h q p = heap_list h' q p \\ \\ h x = h' x\"\nproof (induct q arbitrary: p)\n case 0 thus ?case by simp\nnext\n case (Suc n) thus ?case by (force dest: intvl_neq_start)\nqed\n\nlemma s_footprint_intvl:\n \"(a, SIndexVal) \\ s_footprint p = (a \\ {ptr_val (p::'a::c_type ptr)..+size_of TYPE('a)})\"\n apply(clarsimp simp: s_footprint_def s_footprint_untyped_def)\n apply(rule iffI, clarsimp)\n apply(rule intvlI)\n apply(simp add: size_of_def)\n apply(drule intvlD, clarsimp)\n apply(simp add: size_of_def)\n apply fast\n done\n\nlemma singleton_t_dom [simp]:\n \"dom (singleton_t p (v::'a::mem_type)) = s_footprint p\"\n apply(rule equalityI; clarsimp simp: singleton_t_def lift_state_def s_footprint_intvl\n split: s_heap_index.splits if_split_asm option.splits)\n apply(rule ccontr)\n apply(simp add: ptr_retyp_None)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint list_map_eq split: if_split_asm)\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI)\n apply(subst (asm) word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\n apply(simp add: map_le_def)\n apply assumption\n apply(simp add: ptr_retyp_None)\n apply(rule conjI; clarsimp)\n apply (simp add: ptr_retyp_d_empty s_footprintD)\n apply(frule s_footprintD2)\n apply(frule s_footprintD)\n apply(simp add: ptr_retyp_footprint)\n done\n\nlemma heap_update_merge:\n assumes val: \"d,g \\\\<^sub>t p\"\n shows \"lift_state ((heap_update p (v::'a::mem_type) h),d)\n = lift_state (h,d) ++ singleton p v h d\" (is \"?x = ?y\")\nproof (rule ext, cases)\n fix x\n assume c: \"x \\ dom (singleton p v h d)\"\n with val\n have \"lift_state (heap_update_list (ptr_val p)\n (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h,\n d) x =\n singleton p v h d x\"\n by (auto simp: heap_list_update_to_bytes singleton_def lift_state_def heap_update_def\n singleton_dom\n split: option.splits s_heap_index.splits)\n with c show \"?x x = ?y x\" by (force simp: heap_update_def dest: domD)\nnext\n fix x\n assume nc: \"x \\ dom (singleton p v h d)\"\n with val show \"?x x = ?y x\"\n apply(cases x)\n apply(clarsimp simp: lift_state_def heap_update_def map_add_def\n split: option.splits s_heap_index.splits)\n apply(safe; clarsimp)\n by (metis heap_list_length heap_update_nmem_same len nc s_footprint_intvl singleton_dom)\nqed\n\nlemma tagd_dom_exc:\n \"(g \\\\<^sub>s p) s \\ dom s = s_footprint p\"\n by (clarsimp simp: tagd_def)\n\nlemma tagd_dom_p_exc:\n \"(g \\\\<^sub>s p) s \\ (ptr_val (p::'a::mem_type ptr),SIndexVal) \\ dom s\"\n by (drule tagd_dom_exc) clarsimp\n\nlemma tagd_g_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* P) s \\ g p\"\n by (drule sep_conjD, force simp: tagd_def elim: s_valid_g)\n\nlemma sep_map_tagd_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) s \\ (g \\\\<^sub>s p) s\"\n by (clarsimp simp: sep_map_def tagd_def lift_typ_heap_s_valid)\n\nlemma sep_map_any_tagd_exc:\n \"(p \\\\<^sub>g -) s \\ (g \\\\<^sub>s (p::'a::mem_type ptr)) s\"\n by (clarsimp dest!: sep_map_anyD_exc, erule sep_map_tagd_exc)\n\nlemma ptr_retyp_tagd_exc:\n \"g (p::'a::mem_type ptr) \\\n (g \\\\<^sub>s p) (lift_state (h, ptr_retyp p empty_htd))\"\n apply(simp add: tagd_def ptr_retyp_s_valid lift_state_dom)\n apply(rule equalityI;\n clarsimp simp: lift_state_def split: s_heap_index.splits if_split_asm option.splits)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI2, simp)\n apply(subst (asm) ptr_retyp_None; simp)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: if_split_asm)\n apply(erule (1) s_footprintI)\n apply(simp add: ptr_retyp_None)\n apply(rule conjI; clarsimp)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(drule s_footprintD)\n apply simp\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: if_split_asm)\n apply(drule s_footprintD2)\n apply simp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans, simp)\n apply simp\n apply(fastforce dest: s_footprintD)\n done\n\nlemma singleton_dom_proj_d [simp]:\n \"(g \\\\<^sub>s p) s \\ dom (singleton p (v::'a::mem_type) h (proj_d s)) = dom s\"\n by (clarsimp simp: tagd_def singleton_dom s_valid_def)\n\nlemma singleton_d_restrict_eq:\n \"restrict_s d (s_footprint p) = restrict_s d' (s_footprint p)\n \\ singleton p v h d = singleton p (v::'a::mem_type) h d'\"\n apply(clarsimp simp: singleton_def)\n apply(rule ext, rename_tac x)\n apply(case_tac \"x \\ s_footprint p\"; simp)\n apply(case_tac x, clarsimp, rename_tac a b)\n apply(drule_tac x=a in fun_cong)\n apply(clarsimp simp: s_footprint_restrict lift_state_def\n split: s_heap_index.splits if_split_asm option.splits)\n apply(rule conjI, clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(rename_tac x')\n apply(drule_tac x=\"x'\" in fun_cong)\n apply auto\n done\n\n\nlemma sep_heap_update'_exc:\n assumes sep: \"(g \\\\<^sub>s p \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d))\"\n shows \"P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\nproof -\n from sep obtain s\\<^sub>0 s\\<^sub>1 where disj: \"s\\<^sub>0 \\ s\\<^sub>1\" and\n merge: \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n l: \"(g \\\\<^sub>s p) s\\<^sub>0\" and r: \"(p \\\\<^sub>g v \\\\<^sup>* P) s\\<^sub>1\" by (force dest: sep_conjD)\n moreover from this have \"s\\<^sub>1 \\ singleton p v h (proj_d s\\<^sub>0)\"\n by (fastforce simp: map_disj_def)\n moreover from l have \"g p\" by (force simp: tagd_def elim: s_valid_g)\n moreover from merge l have \"lift_state (h,d),g \\\\<^sub>s p\"\n by (force simp: tagd_def intro: s_valid_heap_merge_right)\n hence \"d,g \\\\<^sub>t p\" by (simp add: h_t_s_valid)\n moreover from l have \"s\\<^sub>0 ++ singleton p v h (proj_d s\\<^sub>0) = singleton p v h (proj_d s\\<^sub>0)\"\n by (force simp: map_add_dom_eq singleton_dom dest: tagd_dom_exc)\n moreover from l merge have \"s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0) = s\\<^sub>1 ++ s\\<^sub>0 ++ singleton p v h d\"\n apply(clarsimp simp: tagd_def)\n apply(rule ext, rename_tac x)\n apply(case_tac x, clarsimp simp: restrict_map_def)\n apply(rename_tac a b)\n apply(simp add: s_valid_def)\n apply(drule_tac v=v and h=h in singleton_dom)\n apply(drule_tac x=\"(a,b)\" in fun_cong)\n apply(case_tac \"(a,b) \\ s_footprint p\")\n apply(subgoal_tac \"(s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0)) (a, b) = singleton p v h d (a, b)\")\n apply(clarsimp simp: map_add_def s_valid_def split: option.splits)\n apply force\n apply (fastforce intro: sym)\n apply(force simp: lift_state_def map_add_def singleton_def proj_d_def\n split: option.splits s_heap_index.splits if_split_asm)\n apply(auto simp: map_add_def singleton_def split: option.splits)\n done\n ultimately show ?thesis\n by (fastforce dest: sep_implD simp: sep_map_singleton tagd_def s_valid_def heap_update_merge)\nqed\n\nlemma sep_heap_update_exc:\n \"\\ (p \\\\<^sub>g - \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d)) \\ \\\n P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (force intro: sep_heap_update'_exc dest: sep_map_anyD_exc sep_map_tagd_exc\n elim: sep_conj_impl)\n\nlemma sep_heap_update_global'_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (rule sep_heap_update'_exc, erule sep_conj_sep_conj_sep_impl_sep_conj)\n\nlemma sep_heap_update_global_exc:\n \"(p \\\\<^sub>g - \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fast intro: sep_heap_update_global'_exc sep_conj_impl sep_map_any_tagd_exc)\n\nlemma sep_heap_update_global_exc2:\n \"(p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fastforce intro: sep_heap_update_global_exc simp: sep_map_any_def sep_conj_exists)\n\nlemma heap_update_mem_same_point:\n \"\\ q \\ {p..+length v}; length v < addr_card \\ \\\n heap_update_list p v h q = v ! unat (q - p)\"\n apply(induct v arbitrary: p h; clarsimp)\n apply(case_tac \"p=q\")\n apply (simp add: heap_update_list_same [where k=1, simplified])\n apply(drule_tac x=\"p+1\" in meta_spec)\n apply(drule meta_spec, drule meta_mp)\n apply(fastforce dest: intvl_neq_start)\n apply(subgoal_tac \"unat (q - p) = unat (1::addr) + unat (q - (p + 1))\", simp)\n apply(subgoal_tac \"q - (p + 1) = (q-p) - 1\")\n apply(simp only:)\n apply(simp add: unat_minus_one)\n apply(subgoal_tac \"unat (q - p) \\ 0\"; clarsimp)\n apply(subst unat_gt_0; simp)\n apply simp\n done\n\nlemma heap_update_list_value:\n \"length v < addr_card \\\n heap_update_list p v h q = (if q \\ {p..+length v} then v!unat (q-p) else h q)\"\n by (auto simp: heap_update_nmem_same heap_update_mem_same_point\n split: if_split)\n\nlemma heap_update_list_value':\n \"length xs < addr_card \\\n heap_update_list ptr xs hp x = (if unat (x - ptr) < length xs then xs ! unat (x - ptr) else hp x)\"\n apply (simp only: heap_update_list_value addr_card_def card_word)\n apply (rule if_cong; simp)\n apply (rule iffI)\n apply (drule intvlD, clarsimp simp add: unat_of_nat)\n apply (simp add: intvl_def unat_arith_simps(4) unat_of_nat split: if_split_asm)\n apply (rule_tac x=\"unat x - unat ptr\" in exI, simp)\n apply (rule_tac x=\"unat x + 2^addr_bitsize - unat ptr\" in exI)\n apply (cut_tac x=ptr in unat_lt2p)\n apply (simp add: unat_arith_simps unat_of_nat)\n done\n\nlemma heap_list_h_eq2:\n \"(\\x. x \\ {p..+n} \\ h x = h' x) \\ heap_list h n p = heap_list h' n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce intro: intvl_self)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma map_td_f_eq':\n \"(f=g) \\ (map_td f t = map_td g t)\"\n \"(f=g) \\ (map_td_struct f st = map_td_struct g st)\"\n \"(f=g) \\ (map_td_list f ts = map_td_list g ts)\"\n \"(f=g) \\ (map_td_pair f x = map_td_pair g x)\"\n by (induct t and st and ts and x) auto\n\nlemma map_td_f_eq:\n \"f=g \\ map_td f t = map_td g t\"\n by (erule arg_cong)\n\nlemma sep_map'_lift_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ CTypesDefs.lift h p = v\"\n by (frule sep_map'_lift_typ_heapD, simp add: lift_t lift_t_lift)\n\nlemma sep_map_lift_wp_exc:\n \"\\v. (p \\\\<^sub>g v \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P v)) (lift_state (h,d))\n \\ P (CTypesDefs.lift h (p::'a::mem_type ptr)) (lift_state (h,d))\"\n apply clarsimp\n apply(subst sep_map'_lift_exc)\n apply(fastforce simp: sep_map'_def elim: sep_conj_impl)\n apply(rule_tac P=\"p \\\\<^sub>g v\" and Q=\"P v\" in sep_conj_impl_same)\n apply(erule (2) sep_conj_impl)\n done\n\n\nlemma sep_map_lift_exc:\n \"((p::'a::mem_type ptr) \\\\<^sub>g -) (lift_state (h,d)) \\\n (p \\\\<^sub>g CTypesDefs.lift h p) (lift_state (h,d))\"\n by (clarsimp simp: sep_map_any_def)\n (frule sep_map_sep_map'_exc, drule sep_map'_lift_exc, simp)\n\nlemma sep_map'_lift_rev_exc:\n \"\\ CTypesDefs.lift h p = (v::'a::mem_type); (p \\\\<^sub>g -) (lift_state (h,d)) \\ \\\n (p \\\\<^sub>g v) (lift_state (h,d))\"\n by (clarsimp simp: sep_map'_any_def)\n (frule sep_map'_lift_exc, simp)\n\n(* FIXME: can be made more flexible when generalised separation conjunction\n is added *)\nlemma sep_lift_exists_exc:\n fixes p :: \"'a::mem_type ptr\"\n assumes ex: \"((\\s. \\v. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q) (lift_state (h,d))\"\n shows \"(P (CTypesDefs.lift h p) \\\\<^sup>* Q) (lift_state (h,d))\"\nproof -\n from ex obtain v where \"((\\s. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q)\n (lift_state (h,d))\"\n by (subst (asm) sep_conj_exists, clarsimp)\n thus ?thesis\n by (force simp: sep_map'_lift_exc sep_conj_ac\n dest: sep_map'_conjE2_exc dest!: sep_conj_conj)\nqed\n\nlemma merge_dom:\n \"x \\ dom s \\ (t ++ s) x = s x\"\n by (force simp: map_add_def)\n\nlemma merge_dom2:\n \"x \\ dom s \\ (t ++ s) x = t x\"\n by (force simp: map_add_def split: option.splits)\n\nlemma fs_footprint_empty [simp]:\n \"fs_footprint p {} = {}\"\n by (auto simp: fs_footprint_def)\n\nlemma fs_footprint_un:\n \"fs_footprint p (insert f F) = fs_footprint p {f} \\ fs_footprint p F\"\n by (auto simp: fs_footprint_def)\n\nlemma proj_d_restrict_map_le:\n \"snd (proj_d (s |` X) x) \\\\<^sub>m snd (proj_d s x)\"\n by(clarsimp simp: map_le_def proj_d_def restrict_map_def\n split: option.splits if_split_asm)\n\nlemma SIndexVal_conj_setcomp_simp [simp]:\n \"{x. snd x = SIndexVal \\ x \\ s_footprint_untyped p t}\n = {(x,SIndexVal) | x. x \\ {p..+size_td t}}\"\n by (force dest: intvlD intro: intvlI simp: s_footprint_untyped_def)\n\nlemma heap_list_s_restrict_same:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ X \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\n apply(induct n arbitrary: p; clarsimp simp: heap_list_s_def)\n apply(rule conjI)\n apply(fastforce intro: intvl_self simp: proj_h_def restrict_map_def)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_s_restrict_fs_footprint:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t,n) \\\n heap_list_s (s |` fs_footprint p {f}) (size_td t) &(p\\f)\n = heap_list_s s (size_td t) &((p::'a ptr)\\f)\"\n apply(simp add: fs_footprint_def field_footprint_def field_offset_def)\n apply(subst heap_list_s_restrict_same)\n apply(fastforce simp: s_footprint_untyped_def field_size_def field_lvalue_def field_offset_def\n field_ti_def field_typ_def field_typ_untyped_def dest: intvlD)\n apply simp\n done\n\nlemma heap_list_proj_h_disj [rule_format]:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 = {} \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>0) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce simp: proj_h_def intro: intvl_self split: option.splits)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_proj_h_sub [rule_format]:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>1) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI, fastforce simp: proj_h_def intro: intvl_self split: option.splits)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\", fast)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\n\nlemma heap_list_s_map_add_super_update_bs:\n \"\\ {x. (x,SIndexVal) \\ dom s\\<^sub>1} = {p+of_nat k..+z}; k + z \\ n; n < addr_card \\\n \\ heap_list_s (s\\<^sub>0 ++ s\\<^sub>1) n p =\n super_update_bs (heap_list_s s\\<^sub>1 z (p+of_nat k)) (heap_list_s s\\<^sub>0 n p) k\"\n apply(clarsimp simp: super_update_bs_def heap_list_s_def)\n apply(subgoal_tac \"heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) (k + z + (n - (k+z))) p =\n take k (heap_list (proj_h s\\<^sub>0) n p) @\n heap_list (proj_h s\\<^sub>1) z (p + of_nat k) @\n drop (k + z) (heap_list (proj_h s\\<^sub>0) n p)\")\n apply simp\n apply(subst heap_list_split2)\n apply(subst heap_list_split2)\n apply simp\n apply(rule conjI)\n apply(subst take_heap_list_le, simp)\n apply(subst heap_list_proj_h_disj)\n using init_intvl_disj [of k z p]\n apply fastforce\n apply simp\n apply(rule conjI)\n apply(subst heap_list_proj_h_sub; fast)\n apply(simp add: drop_heap_list_le)\n apply(subst heap_list_proj_h_disj)\n using final_intvl_disj [of k z n p]\n apply fast\n apply simp\n done\n\nlemma s_footprint_untyped_dom_SIndexVal:\n \"dom s = s_footprint_untyped p t \\\n {x. (x,SIndexVal) \\ dom s} = {p..+size_td t}\"\n by (auto simp: s_footprint_untyped_def intro: intvlI dest: intvlD)\n\nlemma field_ti_s_sub:\n \"field_lookup (export_uinfo (typ_info_t TYPE('b::mem_type))) f 0 = Some (a,b) \\\n s_footprint_untyped &(p\\f) a \\ s_footprint (p::'b ptr)\"\n apply(clarsimp simp: field_ti_def s_footprint_def s_footprint_untyped_def split: option.splits)\n apply(simp add: field_lvalue_def field_offset_def typ_uinfo_t_def)\n apply(rule_tac x=\"b+x\" in exI)\n apply simp\n apply(simp add: field_offset_untyped_def)\n apply(drule td_set_field_lookupD)\n apply(frule td_set_offset_size)\n apply(drule_tac k=x in typ_slice_td_set)\n apply simp\n apply(auto simp: prefix_def less_eq_list_def)\n done\n\nlemma wf_heap_val_map_add [simp]:\n \"\\ wf_heap_val s\\<^sub>0; wf_heap_val s\\<^sub>1 \\ \\ wf_heap_val (s\\<^sub>0 ++ s\\<^sub>1)\"\n unfolding wf_heap_val_def by auto\n\nlemma of_nat_lt_size_of:\n \"\\ (of_nat x::addr) = of_nat y + of_nat z; x < size_of TYPE('a::mem_type);\n y + z < size_of TYPE('a) \\ \\ x = y+z\"\n by (metis (mono_tags) len_of_addr_card less_trans max_size mod_less of_nat_add unat_of_nat)\n\nlemma proj_d_map_add:\n \"snd (proj_d s\\<^sub>1 p) n = Some k \\ snd (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p) n = Some k\"\n by (auto simp: proj_d_def split: option.splits)\n\nlemma proj_d_map_add2:\n \"fst (proj_d s\\<^sub>1 p) \\ fst (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p)\"\n by (auto simp: proj_d_def split: option.splits)\n\nlemma heap_list_s_restrict_disj_same:\n \"dom s \\ (UNIV - X) = {} \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\n apply(induct n arbitrary: p; clarsimp simp: heap_list_s_def)\n apply(fastforce simp: proj_h_def restrict_map_def split: option.splits)\n done\n\nlemma UNIV_minus_inter:\n \"(X - Y) \\ (X \\ (X - Y) - Z) = X - (Y \\ Z)\"\n by fast\n\nlemma sep_map_mfs_sep_map_empty:\n \"(p \\\\<^sub>g (v::'a::mem_type)) = (p \\\\<^sub>g\\<^sup>({}) v)\"\n by (auto simp: sep_map_def mfs_sep_map_def map_add_dom_eq)\n\nlemma fd_cons_double_update:\n \"\\ fd_cons t; length bs = length bs' \\ \\\n update_ti_t t bs (update_ti_t t bs' v) = update_ti_t t bs v\"\n by (simp add: fd_cons_def Let_def fd_cons_double_update_def fd_cons_desc_def)\n\nlemma fd_cons_update_access:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t (access_ti t v bs) v = v\"\n by (simp add: fd_cons_def Let_def fd_cons_update_access_def fd_cons_desc_def)\n\nlemma fd_cons_length:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n length (access_ti t v bs) = size_td t\"\n by (simp add: fd_cons_def Let_def fd_cons_desc_def fd_cons_length_def access_ti\\<^sub>0_def)\n\nlemma fd_cons_length_p:\n \"fd_cons t \\ length (access_ti\\<^sub>0 t v) = size_td t\"\n by (simp add: fd_cons_length access_ti\\<^sub>0_def)\n\nlemma fd_cons_update_normalise:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t ((norm_desc (field_desc t) (size_td t)) bs) v = update_ti_t t bs v\"\n by (fastforce simp: fd_cons_def Let_def fd_cons_desc_def fd_cons_update_normalise_def\n dest: fd_cons_update_normalise)\n\nlemma field_footprint_SIndexVal:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t, n) \\\n {x. (x, SIndexVal) \\ field_footprint (p::'a ptr) f} =\n {ptr_val p + of_nat n..+size_td t}\"\n by (auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def\n intro: intvlI dest: intvlD)\n\nlemma fs_footprint_subset:\n \"F \\ fields TYPE('a::mem_type) \\ fs_footprint (p::'a ptr) F \\ s_footprint p\"\n unfolding fs_footprint_def field_footprint_def\n apply(clarsimp simp: fields_def)\n apply(drule (1) subsetD, clarsimp)\n apply(frule field_lookup_export_uinfo_Some)\n apply(drule field_ti_s_sub)\n apply(unfold field_lvalue_def)[1]\n apply(subst (asm) field_lookup_offset_eq, assumption)\n apply(fastforce simp: field_typ_def field_typ_untyped_def)\n done\n\nlemma length_heap_list_s [simp]:\n \"length (heap_list_s s n p) = n\"\n by (clarsimp simp: heap_list_s_def)\n\nlemma heap_list_proj_h_restrict:\n \"{p..+n} \\ {x. (x,SIndexVal) \\ X} \\ heap_list (proj_h (s |` X)) n p = heap_list (proj_h s) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce simp: proj_h_restrict intro: intvl_self)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_proj_h_lift_state:\n \"{p..+n} \\ {x. fst (d x)} \\ heap_list (proj_h (lift_state (h,d))) n p = heap_list h n p\"\n by (fastforce intro: heap_list_h_eq2 simp: proj_h_lift_state)\n\nlemma heap_list_rpbs:\n \"heap_list (\\x. 0) n p = replicate n 0\"\n by (induct n arbitrary: p) auto\n\nlemma field_access_take_drop:\n \"\\s m n f. field_lookup t f m = Some (s,n) \\ wf_fd t \\\n take (size_td s) (drop (n - m) (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_struct st f m = Some (s,n) \\ wf_fd_struct st \\\n take (size_td s) (drop (n - m) (access_ti_struct st v (replicate (size_td_struct st) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_list ts f m = Some (s,n) \\ wf_fd_list ts \\\n take (size_td s) (drop (n - m) (access_ti_list ts v (replicate (size_td_list ts) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_pair x f m = Some (s,n) \\ wf_fd_pair x \\\n take (size_td s) (drop (n - m) (access_ti_pair x v (replicate (size_td_pair x) 0))) =\n access_ti\\<^sub>0 s v\"\n apply(induct t and st and ts and x, all \\clarsimp simp: access_ti\\<^sub>0_def\\)\n apply(fastforce dest: wf_fd_cons_structD\n simp: fd_cons_struct_def fd_cons_desc_def fd_cons_length_def)\n apply(clarsimp simp: min_def)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(clarsimp split: option.splits)\n apply(subst drop_all)\n apply(fastforce dest: field_lookup_offset_le simp: fd_cons_length_def split_DTPair_all)\n apply simp\n apply(rotate_tac -3)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(erule impE, fast)\n apply(drule sym, clarsimp)\n apply(subgoal_tac \"(size_td_pair dt_pair - (n - m)) = 0\")\n apply (fastforce simp: split_DTPair_all)\n apply (fastforce simp: split_DTPair_all dest: field_lookup_offset_le)\n apply(subgoal_tac \"(size_td s - (size_td_pair dt_pair - (n - m))) = 0\")\n apply fastforce\n apply(fastforce dest: td_set_pair_field_lookup_pairD td_set_pair_offset_size_m)\n apply fastforce\n done\n\nlemma field_access_take_dropD:\n \"\\ field_lookup t f 0 = Some (s,n); wf_lf (lf_set t []); wf_desc t \\ \\\n take (size_td s) (drop n (access_ti\\<^sub>0 t v)) = access_ti\\<^sub>0 s v\"\n using field_access_take_drop(1) [of t v] by (fastforce dest: wf_fdp_fdD wf_lf_fdp)\n\nlemma singleton_t_field:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t, n) \\\n heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t) (ptr_val p + of_nat n) =\n access_ti\\<^sub>0 t v\"\n apply(clarsimp simp: heap_list_s_def singleton_def singleton_t_def)\n apply(subst heap_list_proj_h_restrict)\n apply(fastforce simp: fields_def fs_footprint_def\n intro!: fs_footprint_subset\n dest: field_footprint_SIndexVal)\n apply(subst heap_list_proj_h_lift_state)\n apply(frule_tac p=p in field_tag_sub)\n apply(fastforce simp: field_lvalue_def dest: ptr_retyp_footprint[where d=empty_htd])\n apply(clarsimp simp: access_ti\\<^sub>0_def heap_update_def)\n apply(subst heap_list_update_list; simp?)\n apply(simp add: size_of_def)\n apply(erule field_lookup_offset_size)\n apply(fastforce simp: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def\n dest: field_access_take_dropD\n elim: field_lookup_offset_size)\n done\n\nlemma field_lookup_fd_consD:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t,n) \\ fd_cons t\"\n by (erule fd_consistentD) simp\n\nlemma s_valid_map_add:\n \"\\ s,g \\\\<^sub>s p; t,g' \\\\<^sub>s p \\ \\ (s ++ t |` X),g \\\\<^sub>s p\"\n by (clarsimp simp: map_le_def s_valid_def h_t_valid_def valid_footprint_def Let_def\n proj_d_map_add_snd proj_d_restrict_map_snd proj_d_map_add_fst\n proj_d_restrict_map_fst)\n\nlemma singleton_t_s_valid:\n \"g p \\ singleton_t p (v::'a::mem_type),g \\\\<^sub>s p\"\n by (fastforce simp: singleton_t_def h_t_s_valid elim: ptr_retyp_h_t_valid)\n\nlemma sep_map_mfs_sep_map:\n \"\\ (p \\\\<^sub>g\\<^sup>F v) s; field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type)) (s |` (dom s - fs_footprint p {f}))\"\n apply(clarsimp simp: mfs_sep_map_def)\n apply(rule conjI)\n prefer 2\n apply(fastforce simp: fs_footprint_un[where F=F] fields_def)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, clarsimp)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(subst heap_list_s_map_add_super_update_bs)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(subgoal_tac \"{x. (x, SIndexVal) \\ fs_footprint p {f}} =\n {ptr_val p + of_nat n..+size_td t}\")\n apply fast\n apply(clarsimp simp: fs_footprint_def)\n apply(erule field_footprint_SIndexVal)\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: size_of_def)\n apply(subst ac_simps)\n apply(rule td_set_offset_size)\n apply(erule td_set_field_lookupD)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p v ++ s) (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp)\n apply(simp add: size_of_def)\n apply(simp add: singleton_t_field)\n apply(fastforce simp: access_ti\\<^sub>0_def fd_cons_update_access dest!: field_lookup_fd_consD)\n apply(simp add: map_add_restrict_sub)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply(fastforce intro: s_valid_map_add singleton_t_s_valid ptr_retyp_h_t_valid)\n apply(simp add: map_add_restrict_sub)\n done\n\nlemma disjoint_fn_disjoint:\n \"\\ disjoint_fn f F; F \\ fields TYPE('a::mem_type);\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n fs_footprint (p::'a ptr) F \\ field_footprint p f = {}\"\n apply(clarsimp simp: fs_footprint_def field_footprint_def s_footprint_untyped_def field_typ_def\n field_typ_untyped_def fields_def)\n apply(safe;\n (drule (1) subsetD, clarsimp,\n drule (1) fa_fu_lookup_disj_interD;\n force intro: intvlI simp: max_size[unfolded size_of_def] disj_fn_def disjoint_fn_def))\n done\n\nlemma sep_map_mfs_sep_map2:\n \"\\field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo s = typ_uinfo_t TYPE('b); ((p::'a ptr) \\\\<^sub>g\\<^sup>F v) x\\\n \\ (Ptr &(p\\f) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 s v))::'b::mem_type))\n (x |` field_footprint p f)\"\n apply(clarsimp simp: mfs_sep_map_def sep_map_def)\n apply(rule conjI)\n apply(subgoal_tac \"field_footprint p f = s_footprint ((Ptr &(p\\f))::'b ptr)\")\n prefer 2\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def typ_uinfo_t_def\n field_typ_def field_typ_untyped_def)\n apply simp\n apply(frule lift_typ_heap_mono, assumption+)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, fastforce simp: heap_list_s_heap_merge_right[where p=\"&(p\\f)\"])\n apply(erule s_valid_heap_merge_right2)\n apply simp\n apply(frule (2) disjoint_fn_disjoint[where p=p])\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(fastforce simp: fs_footprint_def)\n apply(rule fs_footprint_subset)\n apply(fastforce simp: fields_def)\n apply(clarsimp simp: field_footprint_def field_lvalue_def s_footprint_def field_typ_def\n field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule fs_footprint_subset[where F=\"{f}\" and p=p])\n apply(rotate_tac -1)\n apply(subst (asm) fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"fs_footprint p F \\\n s_footprint_untyped (ptr_val p + of_nat n) (typ_uinfo_t TYPE('b)) = {}\")\n apply blast\n apply(drule_tac p=p in disjoint_fn_disjoint, assumption+)\n apply(simp add: field_footprint_def field_typ_def field_typ_untyped_def)\n apply(clarsimp simp: fields_def)\n done\n\nlemma export_size_of:\n \"export_uinfo t = typ_uinfo_t TYPE('a) \\ size_of TYPE('a::c_type) = size_td t\"\n by (fastforce simp: size_of_def simp flip: typ_uinfo_size dest: sym)\n\nlemma sep_map_field_unfold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F v) = (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type) \\\\<^sup>*\n Ptr (&(p\\f)) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 t v))::'b::mem_type))\"\n apply(rule ext)\n apply(rule iffI)\n apply(rule_tac s\\<^sub>0=\"x |` (dom x - fs_footprint p {f})\" and\n s\\<^sub>1=\"x |` fs_footprint p {f}\" in sep_conjI)\n apply(erule (1) sep_map_mfs_sep_map)\n apply(clarsimp simp: fs_footprint_def)\n apply(erule (4) sep_map_mfs_sep_map2)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply clarsimp\n apply(drule sep_conjD, clarsimp)\n apply(clarsimp simp: mfs_sep_map_def sep_map_def)\n apply(rule conjI)\n apply(subst map_ac_simps)\n apply(subst map_add_com, solves \\simp add: map_ac_simps\\)\n apply(subst map_add_assoc)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, clarsimp)\n apply(subst heap_list_s_map_add_super_update_bs)\n apply(subst s_footprint_untyped_dom_SIndexVal)\n apply(fastforce simp: s_footprint_def)\n apply(fastforce simp: field_lvalue_def)\n apply(drule field_lookup_offset_size)\n apply(drule export_size_of)\n apply(simp add: size_of_def)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s s\\<^sub>1 (size_td (typ_info_t TYPE('b))) (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p v ++ s\\<^sub>0) (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp)\n apply(simp add: size_of_def)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subst fd_cons_update_normalise [symmetric])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(simp add: norm_desc_def)\n apply(drule_tac f=\"access_ti\\<^sub>0 (typ_info_t TYPE('b))\" in arg_cong)\n apply(drule_tac f=\"\\bs. update_ti_t t bs v\" in arg_cong)\n apply(subst (asm) wf_fd_norm_tuD [symmetric]; simp?)\n apply(simp add: size_of_def)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subgoal_tac \"export_uinfo (typ_info_t TYPE('b)) = typ_uinfo_t TYPE('b)\")\n prefer 2\n apply(simp add: typ_uinfo_t_def)\n apply simp\n apply(drule sym, simp)\n apply(subst (asm) wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply simp\n apply(drule sym, drule export_size_of)\n apply(simp add: size_of_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(simp add: size_of_def)\n apply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length; simp?)\n apply(erule field_lookup_fd_consD)\n apply(subgoal_tac \"update_ti_t t (norm_desc (field_desc t) (size_td t)\n (access_ti t v (replicate (size_td t) 0))) v = v\")\n apply(simp add: norm_desc_def access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_normalise)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length; simp?)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_update_access; simp?)\n apply(erule field_lookup_fd_consD)\n prefer 2\n apply(subst fs_footprint_un)\n apply(subst fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def)\n apply(drule_tac p=p in disjoint_fn_disjoint; assumption?)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(clarsimp simp: s_footprint_def)\n apply(fastforce simp: fs_footprint_def field_footprint_def s_footprint_def\n field_typ_def field_typ_untyped_def field_lvalue_def)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\n apply(rule, clarsimp simp: map_le_def) thm proj_d_map_add_snd\n apply(subst proj_d_map_add_snd[where s=\"a ++ b\" for a b])\n apply(clarsimp split: if_split_asm)\n apply(frule s_footprintD2)\n apply(drule s_footprintD)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(drule intvlD, clarsimp simp: field_lvalue_def)\n apply(drule_tac x=k in spec)\n apply(clarsimp simp add: size_of_def)\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply simp\n apply(simp add: ac_simps)\n apply(rotate_tac -1)\n apply(drule sym)\n apply simp\n apply(drule sym[where s=\"Some s\" for s])\n apply simp\n apply(drule field_lookup_export_uinfo_Some)\n apply(drule td_set_field_lookupD)\n apply(frule_tac k=k in typ_slice_td_set)\n apply simp\n apply simp\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"y=n+k\")\n apply(simp add: strict_prefix_def)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply (clarsimp simp: prefix_eq_nth)\n apply(drule_tac f=unat in arg_cong)\n apply(rotate_tac -1)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply(subst (asm) Abs_fnat_hom_add)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(drule td_set_offset_size)\n apply(rule_tac y=\"size_td (typ_info_t TYPE('a))\" in le_less_trans, simp)\n apply(simp add: max_size[unfolded size_of_def])\n apply simp\n apply(subst proj_d_map_add_fst)\n apply(fastforce simp: size_of_def field_lvalue_def ac_simps\n dest: intvlD s_footprintD)\n done\n\nlemma disjoint_fn_empty [simp]:\n \"disjoint_fn f {}\"\n by (simp add: disjoint_fn_def)\n\nlemma sep_map_field_map':\n \"\\ ((p::'a::mem_type ptr) \\\\<^sub>g v) s;\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (d,n); export_uinfo d = typ_uinfo_t TYPE('b);\n guard_mono g g' \\ \\\n ((Ptr (&(p\\f))::'b::mem_type ptr) \\\\<^sub>g' from_bytes (access_ti\\<^sub>0 d v)) s\"\n by (fastforce dest: sep_map_g elim: sep_conj_impl\n simp: sep_map_mfs_sep_map_empty sep_map_field_unfold sep_map'_def sep_conj_ac)\n\nlemma fd_cons_access_update_p:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n access_ti\\<^sub>0 t (update_ti_t t bs v) = access_ti\\<^sub>0 t (update_ti_t t bs w)\"\n by (simp add: fd_cons_def Let_def fd_cons_access_update_def fd_cons_desc_def access_ti\\<^sub>0_def)\n\nlemma length_to_bytes_p [simp]:\n \"length (to_bytes_p (v::'a)) = size_of TYPE('a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma inv_p [simp]:\n \"from_bytes (to_bytes_p v) = (v::'a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma singleton_SIndexVal:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n singleton_t p (v::'a::mem_type) (x,SIndexVal) = Some (SValue (to_bytes_p v ! unat (x - ptr_val p)))\"\n by (clarsimp simp: singleton_def singleton_t_def lift_state_def heap_update_def\n heap_update_mem_same_point to_bytes_p_def heap_list_rpbs ptr_retyp_d_eq_fst)\n\nlemma access_ti\\<^sub>0:\n \"access_ti s v (replicate (size_td s) 0) = access_ti\\<^sub>0 s v\"\n by (simp add: access_ti\\<^sub>0_def)\n\nlemma fd_cons_mem_type [simp]:\n \"fd_cons (typ_info_t TYPE('a::mem_type))\"\n by (rule wf_fd_consD) simp\n\nlemma norm_tu_rpbs:\n \"wf_fd t \\ norm_tu (export_uinfo t) (access_ti\\<^sub>0 t v) = access_ti\\<^sub>0 t v\"\n apply(frule wf_fd_consD)\n apply(simp add: wf_fd_norm_tuD fd_cons_length_p)\n apply(subst fd_cons_access_update_p [where w=v]; (simp add: fd_cons_length_p)?)\n apply(fastforce simp: access_ti\\<^sub>0_def fd_cons_update_access)\n done\n\nlemma heap_list_s_singleton_t_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v)) (size_td s)\n (ptr_val (p::'a::mem_type ptr) + of_nat n) =\n to_bytes_p (w::'b::mem_type)\"\n apply(clarsimp simp: singleton_t_def singleton_def)\n apply(subst heap_list_s_heap_list_dom)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\n apply(simp add: heap_update_def)\n apply(subst heap_list_update_list; simp?)\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\n apply(frule_tac v=\"(update_ti_t s (to_bytes_p w) v)\" in field_access_take_dropD; simp?)\n apply(simp add: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def to_bytes_p_def)\n apply(simp add: access_ti\\<^sub>0)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(fastforce simp: fd_cons_length_p size_of_def dest: export_size_of)\n apply(simp add: typ_uinfo_t_def norm_tu_rpbs)\n done\n\nlemma field_access_update_nth_disj:\n \"\\m f s n x bs bs'. field_lookup t f m = Some (s,n) \\ x < size_td t \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd t \\ length bs = size_td s \\ length bs' = size_td t \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_struct st f m = Some (s,n) \\ x < size_td_struct st \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_struct st \\length bs = size_td s \\ length bs' = size_td_struct st \\\n access_ti_struct st (update_ti_t s bs v) bs' ! x\n = access_ti_struct st v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_list ts f m = Some (s,n) \\ x < size_td_list ts \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_list ts \\length bs = size_td s \\ length bs' = size_td_list ts \\\n access_ti_list ts (update_ti_t s bs v) bs' ! x\n = access_ti_list ts v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_pair y f m = Some (s,n) \\ x < size_td_pair y \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_pair y \\length bs = size_td s \\ length bs' = size_td_pair y \\\n access_ti_pair y (update_ti_t s bs v) bs' ! x\n = access_ti_pair y v bs' ! x\"\n apply(induct t and st and ts and y)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply clarsimp\n prefer 2\n apply clarsimp\n apply clarify\n apply(clarsimp split: if_split_asm)\n apply(clarsimp split: option.splits)\n\n apply(rotate_tac -3)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=n in spec)\n\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"x - size_td_pair dt_pair\" in spec)\n apply(frule field_lookup_fa_fu_rhs_listD)\n apply simp\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"access_ti_pair dt_pair (update_ti_t s bs v) (take (size_td_pair dt_pair) bs') =\n access_ti_pair dt_pair v (take (size_td_pair dt_pair) bs')\")\n prefer 2\n apply (fastforce simp: min_def)\n apply(clarsimp simp: nth_append)\n apply(subgoal_tac \"length\n (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply simp\n prefer 2\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(erule impE)\n apply simp\n apply(case_tac dt_pair, simp+)\n apply(rename_tac a b)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"drop (size_td a) bs'\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_offset_size_m)\n apply clarsimp\n apply(erule disjE)\n apply arith\n apply arith\n apply(frule field_lookup_fa_fu_rhs_pairD, simp)\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"length (access_ti_pair dt_pair (update_ti_t s bs v)\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(subgoal_tac \"length (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(clarsimp simp: nth_append)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=n in spec)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply clarsimp\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(clarsimp simp: min_def split: if_split_asm)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n done\n\nlemma field_access_update_nth_disjD:\n \"\\ field_lookup t f m = Some (s,n); x < size_td t;\n (x < n - m \\ x \\ (n - m) + size_td s); wf_fd t;\n length bs = size_td s; length bs' = size_td t \\ \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n by (simp add: field_access_update_nth_disj)\n\nlemma intvl_cut:\n \"\\ (x::addr) \\ {p..+m}; x \\ {p+of_nat k..+n}; m < addr_card \\ \\\n unat (x - p) < k \\ k + n \\ unat (x - p)\"\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat, subst mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\n apply(subst (asm) unat_of_nat, subst (asm) mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\n apply(rule ccontr)\n apply(subgoal_tac \"\\z. ka = k + z\")\n apply(force simp flip: add.assoc intro: intvlI)\n apply arith\n done\n\nlemma singleton_t_mask_out:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n K = (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) \\ \\\n singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a)) |` K =\n singleton_t p v |` K\"\n supply max_size[unfolded size_of_def, simp]\n apply(rule ext)\n apply(clarsimp simp: restrict_map_def singleton_t_def singleton_def lift_state_def\n heap_update_def to_bytes_def access_ti\\<^sub>0 heap_list_rpbs size_of_def\n split: s_heap_index.splits)\n apply(subst heap_update_mem_same_point)\n apply(fastforce simp: fd_cons_length_p ptr_retyp_None size_of_def intro: ccontr)\n apply(simp add: fd_cons_length_p)\n apply(subst heap_update_mem_same_point)\n apply(fastforce simp: fd_cons_length_p ptr_retyp_None size_of_def intro: ccontr)\n apply(simp add: fd_cons_length_p)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(rule field_access_update_nth_disjD; simp?)\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: if_split_asm)\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(simp add: size_of_def)\n apply(clarsimp simp: empty_htd_def ptr_retyp_d_eq_fst split: if_split_asm)\n apply(drule_tac k=\"of_nat n\" and n=\"size_td s\" in intvl_cut; simp?)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def s_footprint_untyped_def field_lvalue_def)\n apply(drule export_size_of, simp add: size_of_def)\n done\n\nlemma singleton_t_SIndexTyp:\n \"singleton_t p v (x,SIndexTyp n) = singleton_t p undefined (x,SIndexTyp n)\"\n by (auto simp: singleton_t_def singleton_def restrict_map_def lift_state_def)\n\n\nlemma proj_d_singleton_t:\n \"proj_d (singleton_t p (v::'a::mem_type) ++ x) = proj_d (singleton_t p undefined ++ x)\"\n apply(rule ext)\n apply(clarsimp simp: proj_d_def)\n apply(safe)\n apply(subgoal_tac \"dom (singleton_t p undefined) = dom (singleton_t p v)\", blast, simp)+\n apply(rule ext)\n apply(clarsimp split: option.splits)\n apply(safe; clarsimp?)\n apply(subgoal_tac \"dom (singleton_t p undefined) = dom (singleton_t p v)\", blast, simp)+\n apply(subst (asm) singleton_t_SIndexTyp)\n apply simp\n done\n\nlemma from_bytes_heap_list_s_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b::mem_type);\n dom x = s_footprint p - fs_footprint p F; f \\ F \\ \\\n from_bytes (heap_list_s (singleton_t p (update_ti_t s (to_bytes_p (w::'b)) (v::'a)) ++ x)\n (size_of TYPE('a)) (ptr_val p)) =\n update_ti_t s (to_bytes_p w)\n (from_bytes (heap_list_s (singleton_t p v ++ x) (size_of TYPE('a)) (ptr_val p)))\"\n apply(subst map_add_restrict_UNIV [where X=\"s_footprint_untyped (&(p\\f)) (export_uinfo s)\" and\n h=\"singleton_t p v\"])\n apply(force simp: fs_footprint_def field_footprint_def field_lvalue_def\n field_typ_def field_typ_untyped_def )\n apply simp\n apply(subst heap_list_s_map_add_super_update_bs [where k=n and z=\"size_td s\"]; simp?)\n apply(rule equalityI)\n apply(fastforce dest: s_footprintD export_size_of intro: intvlI\n simp: s_footprint_untyped_def field_lvalue_def size_of_def)\n apply clarsimp\n apply(rule conjI)\n apply(frule field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(fastforce elim: s_footprintI2 dest: intvlD)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def s_footprint_untyped_def field_lvalue_def)\n apply(fastforce dest: field_lookup_offset_size simp: size_of_def)\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n s_footprint_untyped &(p\\f) (export_uinfo s))\n (size_td s) (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) ++\n singleton_t p v |`\n s_footprint_untyped &(p\\f) (typ_uinfo_t TYPE('b)) ++ x)\n (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp add: size_of_def)\n apply(subst heap_list_s_restrict)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def field_lvalue_def s_footprint_untyped_def)\n apply(simp add: heap_list_s_singleton_t_field_update)\n apply(subst singleton_t_mask_out; assumption?)\n apply simp\n apply(subst map_add_restrict_comp_left)\n apply simp\n done\n\nlemma mfs_sep_map_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n); f \\ F;\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (w::'b::mem_type)) v) =\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (u::'b::mem_type)) (v::'a::mem_type))\"\n apply(rule ext)\n apply(clarsimp simp: mfs_sep_map_def lift_typ_heap_if s_valid_def)\n apply safe\n apply(simp add: from_bytes_heap_list_s_update)\n apply(drule_tac f=\"update_ti_t s (to_bytes_p u)\" in arg_cong)\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(simp add: from_bytes_heap_list_s_update)\n apply(drule_tac f=\"update_ti_t s (to_bytes_p w)\" in arg_cong)\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\n done\n\nlemma mfs_sep_map_field_update_v:\n \"\\field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n); f \\ F;\n disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n p \\\\<^sub>g\\<^sup>F update_ti_t t (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type) = p \\\\<^sub>g\\<^sup>F v\"\n apply(subst mfs_sep_map_field_update [where u=\"from_bytes (access_ti\\<^sub>0 t v)\"]; simp?)\n apply(simp add: to_bytes_p_def to_bytes_def from_bytes_def access_ti\\<^sub>0 size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric], simp)\n apply(fastforce dest: fd_cons_length_p export_size_of field_lookup_fd_consD simp: size_of_def)\n apply(rotate_tac -1)\n apply(drule sym)\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(clarsimp simp: norm_bytes_def\n wf_fd_norm_tuD wf_fd_field_lookupD fd_cons_length_p field_lookup_fd_consD)\n apply(subst fd_cons_access_update_p [where w=v])\n apply(erule field_lookup_fd_consD)\n apply(simp add: fd_cons_length_p field_lookup_fd_consD)\n apply(simp add: access_ti\\<^sub>0_def fd_cons_update_access field_lookup_fd_consD)\n done\n\nlemma sep_map_field_fold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n f \\ F; disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F (v::'a::mem_type) \\\\<^sup>*\n Ptr &(p\\f) \\\\<^bsub>g'\\<^esub> (w::'b::mem_type))\n = p \\\\<^sub>g\\<^sup>(F - {f}) (update_ti_t t (to_bytes_p w) v)\"\n apply(simp add: sep_map_field_unfold)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(fastforce dest: export_size_of simp: size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(simp add: wf_fd_field_lookupD)\n apply(fastforce dest: export_size_of simp: size_of_def)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n apply(simp add: sep_conj_ac norm mfs_sep_map_field_update_v insert_absorb)\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n done\n\nlemma norm_bytes:\n \"length bs = size_of TYPE('a) \\\n to_bytes_p ((from_bytes bs)::'a) = norm_bytes TYPE('a::mem_type) bs\"\n by (simp add: norm_bytes_def wf_fd_norm_tuD size_of_def to_bytes_p_def from_bytes_def\n to_bytes_def access_ti\\<^sub>0_def)\n\nlemma sep_heap_update_global_super_fl:\n \"\\ (p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d));\n field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (t,n);\n export_uinfo t = (typ_uinfo_t TYPE('a)) \\ \\\n ((p \\\\<^sub>g update_ti_t t (to_bytes_p v) u) \\\\<^sup>* R)\n (lift_state (heap_update (Ptr &(p\\f)) (v::'a::mem_type) h,d))\"\n apply(subst sep_map_mfs_sep_map_empty)\n apply(simp add: sep_map_field_unfold [where g'=\"\\x. True\"] guard_mono_def)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(simp add: export_size_of)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD, simp)\n apply(simp add: export_size_of)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('a)) = norm_bytes TYPE('a)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(simp add: norm sep_conj_ac)\n apply(subst sep_conj_com)\n apply(simp add: sep_conj_assoc)\n apply(rule sep_heap_update_global_exc2 [where u=\"from_bytes (access_ti\\<^sub>0 t u)\"])\n apply(simp add: sep_conj_ac)\n apply(subst sep_conj_com)\n apply(simp add: sep_map_field_fold guard_mono_def)\n apply(subst sep_map_mfs_sep_map_empty [symmetric])\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(simp add: norm_bytes fd_cons_length_p field_lookup_fd_consD export_size_of)\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(rotate_tac -1)\n apply(drule sym)\n apply(simp add: wf_fd_norm_tuD wf_fd_field_lookupD fd_cons_length_p field_lookup_fd_consD)\n apply(subst fd_cons_access_update_p [where w=u])\n apply(erule field_lookup_fd_consD)\n apply(simp add: fd_cons_length_p field_lookup_fd_consD)\n apply(simp add: access_ti\\<^sub>0_def fd_cons_update_access field_lookup_fd_consD sep_conj_com)\n done\n\nlemma sep_cut'_dom:\n \"sep_cut' x y s \\ dom s = {(a,b). a \\ {x..+y}}\"\n by (simp add: sep_cut'_def)\n\nlemma dom_exact_sep_cut':\n \"dom_exact (sep_cut' x y)\"\n by (force intro!: dom_exactI dest!: sep_cut'_dom)\n\nlemma dom_lift_state_dom_s [simp]:\n \"dom (lift_state (h,d)) = dom_s d\"\n by (force simp: lift_state_def dom_s_def split: s_heap_index.splits if_split_asm option.splits)\n\nlemma dom_ptr_retyp_empty_htd [simp]:\n \"dom (lift_state (h,ptr_retyp (p::'a::mem_type ptr) empty_htd)) = s_footprint p\"\n by simp\n\nlemma ptr_retyp_sep_cut'_exc:\n fixes p::\"'a::mem_type ptr\"\n assumes sc: \"(sep_cut' (ptr_val p) (size_of TYPE('a)) \\\\<^sup>* P) (lift_state (h,d))\" and \"g p\"\n shows \"(g \\\\<^sub>s p \\\\<^sup>* sep_true \\\\<^sup>* P) (lift_state (h,(ptr_retyp p d)))\"\nproof -\n from sc\n obtain s\\<^sub>0 and s\\<^sub>1 where \"s\\<^sub>0 \\ s\\<^sub>1\" and \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n \"P s\\<^sub>1\" and d: \"dom s\\<^sub>0 = {(a,b). a \\ {ptr_val p..+size_of TYPE('a)}}\"\n by (fast dest: sep_conjD sep_cut'_dom)\n moreover from this\n have \"lift_state (h, ptr_retyp p d) = s\\<^sub>1 ++ lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0\"\n apply -\n apply(rule ext, rename_tac x)\n apply (case_tac \"x \\ dom s\\<^sub>0\")\n apply(case_tac \"x \\ dom s\\<^sub>1\")\n apply(fastforce simp: map_disj_def)\n apply(subst map_add_com)\n apply(fastforce simp: map_disj_def)\n apply(clarsimp simp: map_add_def split: option.splits)\n apply(case_tac x, clarsimp)\n apply(clarsimp simp: lift_state_ptr_retyp_d merge_dom2)\n done\n moreover have \"g p\" by fact\n with d have \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0)\"\n apply(clarsimp simp: lift_state_ptr_retyp_restrict sep_conj_ac intro: ptr_retyp_tagd_exc)\n apply(rule_tac s\\<^sub>0=\"lift_state (h,d) |` ({(a, b). a \\ {ptr_val p..+size_of TYPE('a)}} - s_footprint p)\" in sep_conjI)\n apply (simp add: sep_conj_ac)\n apply(erule_tac h=h in ptr_retyp_tagd_exc)\n apply(fastforce simp: map_disj_def)\n apply(subst map_add_com[where h\\<^sub>0=\"lift_state (h, ptr_retyp p empty_htd)\"])\n apply (simp add: map_disj_def)\n apply fast\n apply(rule ext)\n apply(clarsimp simp: map_add_def split: option.splits)\n by (metis (mono_tags) Diff_iff dom_ptr_retyp_empty_htd non_dom_eval_eq restrict_in_dom restrict_out)\n ultimately\n show ?thesis\n by (subst sep_conj_assoc [symmetric])\n (rule_tac s\\<^sub>0=\"(lift_state (h,ptr_retyp p d))|`dom s\\<^sub>0\" and s\\<^sub>1=s\\<^sub>1 in sep_conjI,\n auto simp: map_disj_def)\nqed\n\nlemma sep_cut_dom:\n \"sep_cut x y s \\ dom s = {(a,b). a \\ {x..+unat y}}\"\n by (force simp: sep_cut_def dest: sep_cut'_dom)\n\nlemma sep_cut_0 [simp]:\n \"sep_cut p 0 = \\\"\n by (auto simp: sep_cut'_def sep_cut_def sep_emp_def None_com split_def)\n\nlemma heap_merge_restrict_dom_un:\n \"dom s = P \\ Q \\ (s|`P) ++ (s|`Q) = s\"\n by (force simp: map_add_def restrict_map_def split: option.splits)\n\nlemma sep_cut_split:\n assumes sc: \"sep_cut p y s\" and le: \"x \\ y\"\n shows \"(sep_cut p x \\\\<^sup>* sep_cut (p + x) (y - x)) s\"\nproof (rule_tac s\\<^sub>0=\"s|`{(a,b). a \\ {p..+unat x}}\" and\n s\\<^sub>1=\"s|`({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\" in sep_conjI)\n from sc le show \"sep_cut p x (s |` {(a,b). a \\ {p..+unat x}})\"\n by (force simp: sep_cut_def sep_cut'_def word_le_nat_alt\n dest: intvl_start_le)\nnext\n from sc le\n show \"sep_cut (p + x) (y - x) (s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}))\"\n by (force simp: sep_cut_def sep_cut'_def intvl_sub_eq)\nnext\n show \"s |` {(a,b). a \\ {p..+unat x}} \\ s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n by (force simp: map_disj_def)\nnext\n from sc le\n show \"s = s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}) ++ s |` {(a,b). a \\ {p..+unat x}}\"\n by (simp add: sep_cut_def sep_cut'_def, subst heap_merge_restrict_dom_un)\n (auto simp: word_le_nat_alt dest: intvl_start_le)\nqed\n\nlemma tagd_ptr_safe_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h,d)) \\ ptr_safe p d\"\n apply(clarsimp simp: ptr_safe_def sep_conj_ac sep_conj_def, drule tagd_dom_exc)\n apply(drule_tac x=\"(a,b)\" in fun_cong)\n apply(force simp: map_ac_simps lift_state_def sep_conj_ac dom_s_def merge_dom\n split: option.splits s_heap_index.splits if_split_asm)\n\n done\n\nlemma sep_map'_ptr_safe_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ ptr_safe p d\"\n by (force simp: sep_map'_def intro: sep_conj_impl tagd_ptr_safe_exc\n dest: sep_map_tagd_exc)\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/SepCode.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.3208213073183839, "lm_q1q2_score": 0.1925532140551348}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__22_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__22_on_rules imports n_g2kAbsAfter_lemma_on_inv__22\nbegin\nsection{*All lemmas on causal relation between inv__22*}\nlemma lemma_inv__22_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__22 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__22) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__22) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__22_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.3311197330283893, "lm_q1q2_score": 0.1924809241827226}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Andrew Boyton, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\nchapter \"A simplified version of the actual capDL specification.\"\n\ntheory Types_D\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\n(*\n * Objects are named by 32 bit words.\n * This name may correspond to the memory address of the object.\n *)\ntype_synonym cdl_object_id = \"32 word\"\n\ntype_synonym cdl_object_set = \"cdl_object_id set\"\n\n(* The type we use to represent object sizes. *)\ntype_synonym cdl_size_bits = nat\n\n(* An index into a CNode, TCB, or other kernel object that contains caps. *)\ntype_synonym cdl_cnode_index = nat\n\n(* A reference to a capability slot. *)\ntype_synonym cdl_cap_ref = \"cdl_object_id \\ cdl_cnode_index\"\n\n(* The possible access-control rights that exist in the system. *)\ndatatype cdl_right = AllowRead | AllowWrite | AllowGrant\n\n\n(*\n * Kernel capabilities.\n *\n * Such capabilities (or \"caps\") give the holder particular rights to\n * a kernel object or system hardware.\n *\n * Caps have attributes such as the object they point to, the rights\n * they give the holder, or how the holder is allowed to interact with\n * the target object.\n *\n * This is a simplified, cut-down version of this datatype for\n * demonstration purposes.\n *)\ndatatype cdl_cap =\n NullCap\n | EndpointCap cdl_object_id \"cdl_right set\"\n | CNodeCap cdl_object_id\n | TcbCap cdl_object_id\n\n(* A mapping from capability identifiers to capabilities. *)\ntype_synonym cdl_cap_map = \"cdl_cnode_index \\ cdl_cap option\"\n\ntranslations\n (type) \"cdl_cap_map\" <= (type) \"nat \\ cdl_cap option\"\n (type) \"cdl_cap_ref\" <= (type) \"cdl_object_id \\ nat\"\n\n(* A user cap pointer. *)\ntype_synonym cdl_cptr = \"32 word\"\n\n(* Kernel objects *)\nrecord cdl_tcb =\n cdl_tcb_caps :: cdl_cap_map\n cdl_tcb_fault_endpoint :: cdl_cptr\n\nrecord cdl_cnode =\n cdl_cnode_caps :: cdl_cap_map\n cdl_cnode_size_bits :: cdl_size_bits\n\n(*\n * Kernel objects.\n *\n * These are in-memory objects that may, over the course of the system\n * execution, be created or deleted by users.\n *\n * Again, a simplified version of the real datatype.\n *)\ndatatype cdl_object =\n Endpoint\n | Tcb cdl_tcb\n | CNode cdl_cnode\n\n(*\n * The current state of the system.\n *\n * The state record contains the following primary pieces of information:\n *\n * objects:\n * The objects that currently exist in the system.\n *\n * current_thread:\n * The currently running thread. Operations will always be performed\n * on behalf of this thread.\n *\n * ghost_state: (Used for separation logic)\n * Which fields are owned by an object.\n * In capDL this is all of the fields (or none of them).\n * In any concrete state, this will be all of the fields.\n *)\n\n\n(* The ghost state tracks which components (fields and slots) are owned by an object.\n * Fields + slots are encoded as None + Some nat.\n *)\ntype_synonym cdl_heap = \"cdl_object_id \\ cdl_object option\"\ntype_synonym cdl_component = \"nat option\"\ntype_synonym cdl_components = \"cdl_component set\"\ntype_synonym cdl_ghost_state = \"cdl_object_id \\ cdl_components\"\n\ntranslations\n (type) \"cdl_heap\" <= (type) \"cdl_object_id \\ cdl_object option\"\n (type) \"cdl_ghost_state\" <= (type) \"cdl_object_id \\ nat option set\"\n\nrecord cdl_state =\n cdl_objects :: \"cdl_heap\"\n cdl_current_thread :: \"cdl_object_id option\"\n cdl_ghost_state :: \"cdl_ghost_state\"\n\n\n(* Kernel objects types. *)\ndatatype cdl_object_type =\n EndpointType\n | TcbType\n | CNodeType\n\n(* Return the type of an object. *)\ndefinition\n object_type :: \"cdl_object \\ cdl_object_type\"\nwhere\n \"object_type x \\\n case x of\n Endpoint \\ EndpointType\n | Tcb _ \\ TcbType\n | CNode _ \\ CNodeType\"\n\n(*\n * Getters and setters for various data types.\n *)\n\n(* Capability getters / setters *)\n\ndefinition cap_objects :: \"cdl_cap \\ cdl_object_id set\"\nwhere\n \"cap_objects cap \\\n case cap of\n TcbCap x \\ {x}\n | CNodeCap x \\ {x}\n | EndpointCap x _ \\ {x}\"\n\ndefinition cap_has_object :: \"cdl_cap \\ bool\"\nwhere\n \"cap_has_object cap \\\n case cap of\n NullCap \\ False\n | _ \\ True\"\n\ndefinition cap_object :: \"cdl_cap \\ cdl_object_id\"\nwhere\n \"cap_object cap \\\n if cap_has_object cap\n then THE obj_id. cap_objects cap = {obj_id}\n else undefined \"\n\nlemma cap_object_simps:\n \"cap_object (TcbCap x) = x\"\n \"cap_object (CNodeCap x) = x\"\n \"cap_object (EndpointCap x j) = x\"\n by (simp_all add:cap_object_def cap_objects_def cap_has_object_def)\n\ndefinition\n cap_rights :: \"cdl_cap \\ cdl_right set\"\nwhere\n \"cap_rights c \\ case c of\n EndpointCap _ x \\ x\n | _ \\ UNIV\"\n\ndefinition\n update_cap_rights :: \"cdl_right set \\ cdl_cap \\ cdl_cap\"\nwhere\n \"update_cap_rights r c \\ case c of\n EndpointCap f1 _ \\ EndpointCap f1 r\n | _ \\ c\"\n\n(* Kernel object getters / setters *)\ndefinition\n object_slots :: \"cdl_object \\ cdl_cap_map\"\nwhere\n \"object_slots obj \\ case obj of\n CNode x \\ cdl_cnode_caps x\n | Tcb x \\ cdl_tcb_caps x\n | _ \\ empty\"\n\ndefinition\n update_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"update_slots new_val obj \\ case obj of\n CNode x \\ CNode (x\\cdl_cnode_caps := new_val\\)\n | Tcb x \\ Tcb (x\\cdl_tcb_caps := new_val\\)\n | _ \\ obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n add_to_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"add_to_slots new_val obj \\ update_slots (new_val ++ (object_slots obj)) obj\"\n\ndefinition\n slots_of :: \"cdl_heap \\ cdl_object_id \\ cdl_cap_map\"\nwhere\n \"slots_of h \\ \\obj_id.\n case h obj_id of\n None \\ empty\n | Some obj \\ object_slots obj\"\n\n\ndefinition\n has_slots :: \"cdl_object \\ bool\"\nwhere\n \"has_slots obj \\ case obj of\n CNode _ \\ True\n | Tcb _ \\ True\n | _ \\ False\"\n\ndefinition\n object_at :: \"(cdl_object \\ bool) \\ cdl_object_id \\ cdl_heap \\ bool\"\nwhere\n \"object_at P p s \\ \\object. s p = Some object \\ P object\"\n\nabbreviation\n \"ko_at k \\ object_at (op = k)\"\n\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/sep_algebra/ex/capDL/Types_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3702253925955866, "lm_q1q2_score": 0.19233998538149175}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__46_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__46_on_rules imports n_germanSimp_lemma_on_inv__46\nbegin\nsection{*All lemmas on causal relation between inv__46*}\nlemma lemma_inv__46_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__46) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__46_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521307073646, "lm_q2_score": 0.3702253856469203, "lm_q1q2_score": 0.19233997626313268}} {"text": "(* Title: HOL/Bali/AxSound.thy\n Author: David von Oheimb and Norbert Schirmer\n*)\nsubsection {* Soundness proof for Axiomatic semantics of Java expressions and \n statements\n *}\n\ntheory AxSound imports AxSem begin\n\nsubsubsection \"validity\"\n\ndefinition\n triple_valid2 :: \"prog \\ nat \\ 'a triple \\ bool\" (\"_\\_\\_\"[61,0, 58] 57)\n where\n \"G\\n\\t =\n (case t of {P} t\\ {Q} \\\n \\Y s Z. P Y s Z \\ (\\L. s\\\\(G,L)\n \\ (\\T C A. (normal s \\ (\\prg=G,cls=C,lcl=L\\\\t\\T \\\n \\prg=G,cls=C,lcl=L\\\\dom (locals (store s))\\t\\A)) \\\n (\\Y' s'. G\\s \\t\\\\n\\ (Y',s') \\ Q Y' s' Z \\ s'\\\\(G,L)))))\"\n\ntext {* This definition differs from the ordinary @{text triple_valid_def} \nmanly in the conclusion: We also ensures conformance of the result state. So\nwe don't have to apply the type soundness lemma all the time during\ninduction. This definition is only introduced for the soundness\nproof of the axiomatic semantics, in the end we will conclude to \nthe ordinary definition.\n*}\n\ndefinition\n ax_valids2 :: \"prog \\ 'a triples \\ 'a triples \\ bool\" (\"_,_|\\\\_\" [61,58,58] 57)\n where \"G,A|\\\\ts = (\\n. (\\t\\A. G\\n\\t) \\ (\\t\\ts. G\\n\\t))\"\n\nlemma triple_valid2_def2: \"G\\n\\{P} t\\ {Q} = \n (\\Y s Z. P Y s Z \\ (\\Y' s'. G\\s \\t\\\\n\\ (Y',s')\\ \n (\\L. s\\\\(G,L) \\ (\\T C A. (normal s \\ (\\prg=G,cls=C,lcl=L\\\\t\\T \\ \n \\prg=G,cls=C,lcl=L\\\\dom (locals (store s))\\t\\A)) \\\n Q Y' s' Z \\ s'\\\\(G,L)))))\"\napply (unfold triple_valid2_def)\napply (simp (no_asm) add: split_paired_All)\napply blast\ndone\n\nlemma triple_valid2_eq [rule_format (no_asm)]: \n \"wf_prog G ==> triple_valid2 G = triple_valid G\"\napply (rule ext)\napply (rule ext)\napply (rule triple.induct)\napply (simp (no_asm) add: triple_valid_def2 triple_valid2_def2)\napply (rule iffI)\napply fast\napply clarify\napply (tactic \"smp_tac @{context} 3 1\")\napply (case_tac \"normal s\")\napply clarsimp\napply (elim conjE impE)\napply blast\n\napply (tactic \"smp_tac @{context} 2 1\")\napply (drule evaln_eval)\napply (drule (1) eval_type_sound [THEN conjunct1],simp, assumption+)\napply simp\n\napply clarsimp\ndone\n\n\nlemma ax_valids2_eq: \"wf_prog G \\ G,A|\\\\ts = G,A|\\ts\"\napply (unfold ax_valids_def ax_valids2_def)\napply (force simp add: triple_valid2_eq)\ndone\n\nlemma triple_valid2_Suc [rule_format (no_asm)]: \"G\\Suc n\\t \\ G\\n\\t\"\napply (induct_tac \"t\")\napply (subst triple_valid2_def2)\napply (subst triple_valid2_def2)\napply (fast intro: evaln_nonstrict_Suc)\ndone\n\nlemma Methd_triple_valid2_0: \"G\\0\\{Normal P} Methd C sig-\\ {Q}\"\nby (auto elim!: evaln_elim_cases simp add: triple_valid2_def2)\n\nlemma Methd_triple_valid2_SucI: \n\"\\G\\n\\{Normal P} body G C sig-\\{Q}\\ \n \\ G\\Suc n\\{Normal P} Methd C sig-\\ {Q}\"\napply (simp (no_asm_use) add: triple_valid2_def2)\napply (intro strip, tactic \"smp_tac @{context} 3 1\", clarify)\napply (erule wt_elim_cases, erule da_elim_cases, erule evaln_elim_cases)\napply (unfold body_def Let_def)\napply (clarsimp simp add: inj_term_simps)\napply blast\ndone\n\nlemma triples_valid2_Suc: \n \"Ball ts (triple_valid2 G (Suc n)) \\ Ball ts (triple_valid2 G n)\"\napply (fast intro: triple_valid2_Suc)\ndone\n\nlemma \"G|\\n:insert t A = (G\\n:t \\ G|\\n:A)\"\noops\n\n\nsubsubsection \"soundness\"\n\nlemma Methd_sound: \n assumes recursive: \"G,A\\ {{P} Methd-\\ {Q} | ms}|\\\\{{P} body G-\\ {Q} | ms}\"\n shows \"G,A|\\\\{{P} Methd-\\ {Q} | ms}\"\nproof -\n {\n fix n\n assume recursive: \"\\ n. \\t\\(A \\ {{P} Methd-\\ {Q} | ms}). G\\n\\t\n \\ \\t\\{{P} body G-\\ {Q} | ms}. G\\n\\t\"\n have \"\\t\\A. G\\n\\t \\ \\t\\{{P} Methd-\\ {Q} | ms}. G\\n\\t\"\n proof (induct n)\n case 0\n show \"\\t\\{{P} Methd-\\ {Q} | ms}. G\\0\\t\"\n proof -\n {\n fix C sig\n assume \"(C,sig) \\ ms\" \n have \"G\\0\\{Normal (P C sig)} Methd C sig-\\ {Q C sig}\"\n by (rule Methd_triple_valid2_0)\n }\n thus ?thesis\n by (simp add: mtriples_def split_def)\n qed\n next\n case (Suc m)\n note hyp = `\\t\\A. G\\m\\t \\ \\t\\{{P} Methd-\\ {Q} | ms}. G\\m\\t`\n note prem = `\\t\\A. G\\Suc m\\t`\n show \"\\t\\{{P} Methd-\\ {Q} | ms}. G\\Suc m\\t\"\n proof -\n {\n fix C sig\n assume m: \"(C,sig) \\ ms\" \n have \"G\\Suc m\\{Normal (P C sig)} Methd C sig-\\ {Q C sig}\"\n proof -\n from prem have prem_m: \"\\t\\A. G\\m\\t\"\n by (rule triples_valid2_Suc)\n hence \"\\t\\{{P} Methd-\\ {Q} | ms}. G\\m\\t\"\n by (rule hyp)\n with prem_m\n have \"\\t\\(A \\ {{P} Methd-\\ {Q} | ms}). G\\m\\t\"\n by (simp add: ball_Un)\n hence \"\\t\\{{P} body G-\\ {Q} | ms}. G\\m\\t\"\n by (rule recursive)\n with m have \"G\\m\\{Normal (P C sig)} body G C sig-\\ {Q C sig}\"\n by (auto simp add: mtriples_def split_def)\n thus ?thesis\n by (rule Methd_triple_valid2_SucI)\n qed\n }\n thus ?thesis\n by (simp add: mtriples_def split_def)\n qed\n qed\n }\n with recursive show ?thesis\n by (unfold ax_valids2_def) blast\nqed\n\n\nlemma valids2_inductI: \"\\s t n Y' s'. G\\s\\t\\\\n\\ (Y',s') \\ t = c \\ \n Ball A (triple_valid2 G n) \\ (\\Y Z. P Y s Z \\ \n (\\L. s\\\\(G,L) \\ \n (\\T C A. (normal s \\ (\\prg=G,cls=C,lcl=L\\\\t\\T) \\ \n \\prg=G,cls=C,lcl=L\\\\dom (locals (store s))\\t\\A) \\\n Q Y' s' Z \\ s'\\\\(G, L)))) \\ \n G,A|\\\\{ {P} c\\ {Q}}\"\napply (simp (no_asm) add: ax_valids2_def triple_valid2_def2)\napply clarsimp\ndone\n\nlemma da_good_approx_evalnE [consumes 4]:\n assumes evaln: \"G\\s0 \\t\\\\n\\ (v, s1)\"\n and wt: \"\\prg=G,cls=C,lcl=L\\\\t\\T\"\n and da: \"\\prg=G,cls=C,lcl=L\\\\ dom (locals (store s0)) \\t\\ A\"\n and wf: \"wf_prog G\"\n and elim: \"\\normal s1 \\ nrm A \\ dom (locals (store s1));\n \\ l. \\abrupt s1 = Some (Jump (Break l)); normal s0\\\n \\ brk A l \\ dom (locals (store s1));\n \\abrupt s1 = Some (Jump Ret);normal s0\\\n \\Result \\ dom (locals (store s1))\n \\ \\ P\"\n shows \"P\"\nproof -\n from evaln have \"G\\s0 \\t\\\\ (v, s1)\"\n by (rule evaln_eval)\n from this wt da wf elim show P\n by (rule da_good_approxE') iprover+\nqed\n\nlemma validI: \n assumes I: \"\\ n s0 L accC T C v s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); \n normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\t\\T;\n normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\t\\C;\n G\\s0 \\t\\\\n\\ (v,s1); P Y s0 Z\\ \\ Q v s1 Z \\ s1\\\\(G,L)\" \n shows \"G,A|\\\\{ {P} t\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (case_tac \"normal s\")\napply clarsimp \napply (rule I,(assumption|simp)+)\n\napply (rule I,auto)\ndone\n \n\ndeclare [[simproc add: wt_expr wt_var wt_exprs wt_stmt]]\n\nlemma valid_stmtI: \n assumes I: \"\\ n s0 L accC C s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); \n normal s0\\ \\prg=G,cls=accC,lcl=L\\\\c\\\\;\n normal s0\\\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\c\\\\<^sub>s\\C;\n G\\s0 \\c\\n\\ s1; P Y s0 Z\\ \\ Q \\ s1 Z \\ s1\\\\(G,L)\" \n shows \"G,A|\\\\{ {P} \\c\\\\<^sub>s\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (case_tac \"normal s\")\napply clarsimp \napply (rule I,(assumption|simp)+)\n\napply (rule I,auto)\ndone\n\nlemma valid_stmt_NormalI: \n assumes I: \"\\ n s0 L accC C s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); normal s0; \\prg=G,cls=accC,lcl=L\\\\c\\\\;\n \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\c\\\\<^sub>s\\C;\n G\\s0 \\c\\n\\ s1; (Normal P) Y s0 Z\\ \\ Q \\ s1 Z \\ s1\\\\(G,L)\" \n shows \"G,A|\\\\{ {Normal P} \\c\\\\<^sub>s\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (elim exE conjE)\napply (rule I)\nby auto\n\nlemma valid_var_NormalI: \n assumes I: \"\\ n s0 L accC T C vf s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); normal s0; \n \\prg=G,cls=accC,lcl=L\\\\t\\=T;\n \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\t\\\\<^sub>v\\C;\n G\\s0 \\t=\\vf\\n\\ s1; (Normal P) Y s0 Z\\ \n \\ Q (In2 vf) s1 Z \\ s1\\\\(G,L)\"\n shows \"G,A|\\\\{ {Normal P} \\t\\\\<^sub>v\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (elim exE conjE)\napply simp\napply (rule I)\nby auto\n\nlemma valid_expr_NormalI: \n assumes I: \"\\ n s0 L accC T C v s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); normal s0; \n \\prg=G,cls=accC,lcl=L\\\\t\\-T;\n \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\t\\\\<^sub>e\\C;\n G\\s0 \\t-\\v\\n\\ s1; (Normal P) Y s0 Z\\ \n \\ Q (In1 v) s1 Z \\ s1\\\\(G,L)\"\n shows \"G,A|\\\\{ {Normal P} \\t\\\\<^sub>e\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (elim exE conjE)\napply simp\napply (rule I)\nby auto\n\nlemma valid_expr_list_NormalI: \n assumes I: \"\\ n s0 L accC T C vs s1 Y Z.\n \\\\t\\A. G\\n\\t; s0\\\\(G,L); normal s0; \n \\prg=G,cls=accC,lcl=L\\\\t\\\\T;\n \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\t\\\\<^sub>l\\C;\n G\\s0 \\t\\\\vs\\n\\ s1; (Normal P) Y s0 Z\\ \n \\ Q (In3 vs) s1 Z \\ s1\\\\(G,L)\"\n shows \"G,A|\\\\{ {Normal P} \\t\\\\<^sub>l\\ {Q} }\"\napply (simp add: ax_valids2_def triple_valid2_def2)\napply (intro allI impI)\napply (elim exE conjE)\napply simp\napply (rule I)\nby auto\n\nlemma validE [consumes 5]: \n assumes valid: \"G,A|\\\\{ {P} t\\ {Q} }\"\n and P: \"P Y s0 Z\"\n and valid_A: \"\\t\\A. G\\n\\t\"\n and conf: \"s0\\\\(G,L)\"\n and eval: \"G\\s0 \\t\\\\n\\ (v,s1)\"\n and wt: \"normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\t\\T\"\n and da: \"normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\t\\C\"\n and elim: \"\\Q v s1 Z; s1\\\\(G,L)\\ \\ concl\" \n shows concl\nusing assms\nby (simp add: ax_valids2_def triple_valid2_def2) fast\n(* why consumes 5?. If I want to apply this lemma in a context wgere\n \\ normal s0 holds,\n I can chain \"\\ normal s0\" as fact number 6 and apply the rule with\n cases. Auto will then solve premise 6 and 7.\n*)\n\nlemma all_empty: \"(!x. P) = P\"\nby simp\n\ncorollary evaln_type_sound:\n assumes evaln: \"G\\s0 \\t\\\\n\\ (v,s1)\" and\n wt: \"\\prg=G,cls=accC,lcl=L\\\\t\\T\" and\n da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\t\\ A\" and\n conf_s0: \"s0\\\\(G,L)\" and\n wf: \"wf_prog G\" \n shows \"s1\\\\(G,L) \\ (normal s1 \\ G,L,store s1\\t\\v\\\\T) \\ \n (error_free s0 = error_free s1)\"\nproof -\n from evaln have \"G\\s0 \\t\\\\ (v,s1)\"\n by (rule evaln_eval)\n from this wt da wf conf_s0 show ?thesis\n by (rule eval_type_sound)\nqed\n\ncorollary dom_locals_evaln_mono_elim [consumes 1]: \n assumes \n evaln: \"G\\ s0 \\t\\\\n\\ (v,s1)\" and\n hyps: \"\\dom (locals (store s0)) \\ dom (locals (store s1));\n \\ vv s val. \\v=In2 vv; normal s1\\ \n \\ dom (locals (store s)) \n \\ dom (locals (store ((snd vv) val s)))\\ \\ P\"\n shows \"P\"\nproof -\n from evaln have \"G\\ s0 \\t\\\\ (v,s1)\" by (rule evaln_eval)\n from this hyps show ?thesis\n by (rule dom_locals_eval_mono_elim) iprover+\nqed\n\n\n\nlemma evaln_no_abrupt: \n \"\\s s'. \\G\\s \\t\\\\n\\ (w,s'); normal s'\\ \\ normal s\"\nby (erule evaln_cases,auto)\n\ndeclare inj_term_simps [simp]\nlemma ax_sound2: \n assumes wf: \"wf_prog G\" \n and deriv: \"G,A|\\ts\"\n shows \"G,A|\\\\ts\"\nusing deriv\nproof (induct)\n case (empty A)\n show ?case\n by (simp add: ax_valids2_def triple_valid2_def2)\nnext\n case (insert A t ts)\n note valid_t = `G,A|\\\\{t}`\n moreover\n note valid_ts = `G,A|\\\\ts`\n {\n fix n assume valid_A: \"\\t\\A. G\\n\\t\"\n have \"G\\n\\t\" and \"\\t\\ts. G\\n\\t\"\n proof -\n from valid_A valid_t show \"G\\n\\t\"\n by (simp add: ax_valids2_def)\n next\n from valid_A valid_ts show \"\\t\\ts. G\\n\\t\"\n by (unfold ax_valids2_def) blast\n qed\n hence \"\\t'\\insert t ts. G\\n\\t'\"\n by simp\n }\n thus ?case\n by (unfold ax_valids2_def) blast\nnext\n case (asm ts A)\n from `ts \\ A`\n show \"G,A|\\\\ts\"\n by (auto simp add: ax_valids2_def triple_valid2_def)\nnext\n case (weaken A ts' ts)\n note `G,A|\\\\ts'`\n moreover note `ts \\ ts'`\n ultimately show \"G,A|\\\\ts\"\n by (unfold ax_valids2_def triple_valid2_def) blast\nnext\n case (conseq P A t Q)\n note con = `\\Y s Z. P Y s Z \\ \n (\\P' Q'.\n (G,A\\{P'} t\\ {Q'} \\ G,A|\\\\{ {P'} t\\ {Q'} }) \\\n (\\Y' s'. (\\Y Z'. P' Y s Z' \\ Q' Y' s' Z') \\ Q Y' s' Z))`\n show \"G,A|\\\\{ {P} t\\ {Q} }\"\n proof (rule validI)\n fix n s0 L accC T C v s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\" \n assume conf: \"s0\\\\(G,L)\"\n assume wt: \"normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\t\\T\"\n assume da: \"normal s0 \n \\ \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\t\\ C\"\n assume eval: \"G\\s0 \\t\\\\n\\ (v, s1)\"\n assume P: \"P Y s0 Z\"\n show \"Q v s1 Z \\ s1\\\\(G, L)\"\n proof -\n from valid_A conf wt da eval P con\n have \"Q v s1 Z\"\n apply (simp add: ax_valids2_def triple_valid2_def2)\n apply (tactic \"smp_tac @{context} 3 1\")\n apply clarify\n apply (tactic \"smp_tac @{context} 1 1\")\n apply (erule allE,erule allE, erule mp)\n apply (intro strip)\n apply (tactic \"smp_tac @{context} 3 1\")\n apply (tactic \"smp_tac @{context} 2 1\")\n apply (tactic \"smp_tac @{context} 1 1\")\n by blast\n moreover have \"s1\\\\(G, L)\"\n proof (cases \"normal s0\")\n case True\n from eval wt [OF True] da [OF True] conf wf \n show ?thesis\n by (rule evaln_type_sound [elim_format]) simp\n next\n case False\n with eval have \"s1=s0\"\n by auto\n with conf show ?thesis by simp\n qed\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (hazard A P t Q)\n show \"G,A|\\\\{ {P \\. Not \\ type_ok G t} t\\ {Q} }\"\n by (simp add: ax_valids2_def triple_valid2_def2 type_ok_def) fast\nnext\n case (Abrupt A P t)\n show \"G,A|\\\\{ {P\\undefined3 t \\. Not \\ normal} t\\ {P} }\"\n proof (rule validI)\n fix n s0 L accC T C v s1 Y Z \n assume conf_s0: \"s0\\\\(G, L)\"\n assume eval: \"G\\s0 \\t\\\\n\\ (v, s1)\"\n assume \"(P\\undefined3 t \\. Not \\ normal) Y s0 Z\"\n then obtain P: \"P (undefined3 t) s0 Z\" and abrupt_s0: \"\\ normal s0\"\n by simp\n from eval abrupt_s0 obtain \"s1=s0\" and \"v=undefined3 t\"\n by auto\n with P conf_s0\n show \"P v s1 Z \\ s1\\\\(G, L)\"\n by simp\n qed\nnext\n case (LVar A P vn)\n show \"G,A|\\\\{ {Normal (\\s.. P\\In2 (lvar vn s))} LVar vn=\\ {P} }\"\n proof (rule valid_var_NormalI)\n fix n s0 L accC T C vf s1 Y Z\n assume conf_s0: \"s0\\\\(G, L)\"\n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg = G, cls = accC, lcl = L\\\\LVar vn\\=T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\LVar vn\\\\<^sub>v\\ C\"\n assume eval: \"G\\s0 \\LVar vn=\\vf\\n\\ s1\" \n assume P: \"(Normal (\\s.. P\\In2 (lvar vn s))) Y s0 Z\"\n show \"P (In2 vf) s1 Z \\ s1\\\\(G, L)\"\n proof \n from eval normal_s0 obtain \"s1=s0\" \"vf=lvar vn (store s0)\"\n by (fastforce elim: evaln_elim_cases)\n with P show \"P (In2 vf) s1 Z\"\n by simp\n next\n from eval wt da conf_s0 wf\n show \"s1\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n qed\n qed\nnext\n case (FVar A P statDeclC Q e stat fn R accC)\n note valid_init = `G,A|\\\\{ {Normal P} .Init statDeclC. {Q} }`\n note valid_e = `G,A|\\\\{ {Q} e-\\ {\\Val:a:. fvar statDeclC stat fn a ..; R} }`\n show \"G,A|\\\\{ {Normal P} {accC,statDeclC,stat}e..fn=\\ {R} }\"\n proof (rule valid_var_NormalI)\n fix n s0 L accC' T V vf s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC',lcl=L\\\\{accC,statDeclC,stat}e..fn\\=T\"\n assume da: \"\\prg=G,cls=accC',lcl=L\\\n \\ dom (locals (store s0)) \\\\{accC,statDeclC,stat}e..fn\\\\<^sub>v\\ V\"\n assume eval: \"G\\s0 \\{accC,statDeclC,stat}e..fn=\\vf\\n\\ s3\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\vf\\\\<^sub>v s3 Z \\ s3\\\\(G, L)\"\n proof -\n from wt obtain statC f where\n wt_e: \"\\prg=G, cls=accC, lcl=L\\\\e\\-Class statC\" and\n accfield: \"accfield G accC statC fn = Some (statDeclC,f)\" and\n eq_accC: \"accC=accC'\" and\n stat: \"stat=is_static f\" and\n T: \"T=(type f)\"\n by (cases) (auto simp add: member_is_static_simp)\n from da eq_accC\n have da_e: \"\\prg=G, cls=accC, lcl=L\\\\dom (locals (store s0))\\\\e\\\\<^sub>e\\ V\"\n by cases simp\n from eval obtain a s1 s2 s2' where\n eval_init: \"G\\s0 \\Init statDeclC\\n\\ s1\" and \n eval_e: \"G\\s1 \\e-\\a\\n\\ s2\" and \n fvar: \"(vf,s2')=fvar statDeclC stat fn a s2\" and\n s3: \"s3 = check_field_access G accC statDeclC fn stat a s2'\"\n using normal_s0 by (fastforce elim: evaln_elim_cases) \n have wt_init: \"\\prg=G, cls=accC, lcl=L\\\\(Init statDeclC)\\\\\"\n proof -\n from wf wt_e \n have iscls_statC: \"is_class G statC\"\n by (auto dest: ty_expr_is_type type_is_class)\n with wf accfield \n have iscls_statDeclC: \"is_class G statDeclC\"\n by (auto dest!: accfield_fields dest: fields_declC)\n thus ?thesis by simp\n qed\n obtain I where \n da_init: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\Init statDeclC\\\\<^sub>s\\ I\"\n by (auto intro: da_Init [simplified] assigned.select_convs)\n from valid_init P valid_A conf_s0 eval_init wt_init da_init\n obtain Q: \"Q \\ s1 Z\" and conf_s1: \"s1\\\\(G, L)\"\n by (rule validE)\n obtain \n R: \"R \\vf\\\\<^sub>v s2' Z\" and \n conf_s2: \"s2\\\\(G, L)\" and\n conf_a: \"normal s2 \\ G,store s2\\a\\\\Class statC\"\n proof (cases \"normal s1\")\n case True\n obtain V' where \n da_e':\n \"\\prg=G,cls=accC,lcl=L\\ \\dom (locals (store s1))\\\\e\\\\<^sub>e\\ V'\"\n proof -\n from eval_init \n have \"(dom (locals (store s0))) \\ (dom (locals (store s1)))\"\n by (rule dom_locals_evaln_mono_elim)\n with da_e show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_e Q valid_A conf_s1 eval_e wt_e\n obtain \"R \\vf\\\\<^sub>v s2' Z\" and \"s2\\\\(G, L)\"\n by (rule validE) (simp add: fvar [symmetric])\n moreover\n from eval_e wt_e da_e' conf_s1 wf\n have \"normal s2 \\ G,store s2\\a\\\\Class statC\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n next\n case False\n with valid_e Q valid_A conf_s1 eval_e\n obtain \"R \\vf\\\\<^sub>v s2' Z\" and \"s2\\\\(G, L)\"\n by (cases rule: validE) (simp add: fvar [symmetric])+\n moreover from False eval_e have \"\\ normal s2\"\n by auto\n hence \"normal s2 \\ G,store s2\\a\\\\Class statC\"\n by auto\n ultimately show ?thesis ..\n qed\n from accfield wt_e eval_init eval_e conf_s2 conf_a fvar stat s3 wf\n have eq_s3_s2': \"s3=s2'\" \n using normal_s0 by (auto dest!: error_free_field_access evaln_eval)\n moreover\n from eval wt da conf_s0 wf\n have \"s3\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis using Q R by simp\n qed\n qed\nnext\n case (AVar A P e1 Q e2 R)\n note valid_e1 = `G,A|\\\\{ {Normal P} e1-\\ {Q} }`\n have valid_e2: \"\\ a. G,A|\\\\{ {Q\\In1 a} e2-\\ {\\Val:i:. avar G i a ..; R} }\"\n using AVar.hyps by simp\n show \"G,A|\\\\{ {Normal P} e1.[e2]=\\ {R} }\"\n proof (rule valid_var_NormalI)\n fix n s0 L accC T V vf s2' Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\e1.[e2]\\=T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\e1.[e2]\\\\<^sub>v\\ V\"\n assume eval: \"G\\s0 \\e1.[e2]=\\vf\\n\\ s2'\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\vf\\\\<^sub>v s2' Z \\ s2'\\\\(G, L)\"\n proof -\n from wt obtain \n wt_e1: \"\\prg=G,cls=accC,lcl=L\\\\e1\\-T.[]\" and\n wt_e2: \"\\prg=G,cls=accC,lcl=L\\\\e2\\-PrimT Integer\" \n by (rule wt_elim_cases) simp\n from da obtain E1 where\n da_e1: \"\\prg=G,cls=accC,lcl=L\\ \\dom (locals (store s0))\\\\e1\\\\<^sub>e\\ E1\" and\n da_e2: \"\\prg=G,cls=accC,lcl=L\\\\ nrm E1 \\\\e2\\\\<^sub>e\\ V\"\n by (rule da_elim_cases) simp\n from eval obtain s1 a i s2 where\n eval_e1: \"G\\s0 \\e1-\\a\\n\\ s1\" and\n eval_e2: \"G\\s1 \\e2-\\i\\n\\ s2\" and\n avar: \"avar G i a s2 =(vf, s2')\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e1 P valid_A conf_s0 eval_e1 wt_e1 da_e1\n obtain Q: \"Q \\a\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G, L)\"\n by (rule validE)\n from Q have Q': \"\\ v. (Q\\In1 a) v s1 Z\"\n by simp\n have \"R \\vf\\\\<^sub>v s2' Z\"\n proof (cases \"normal s1\")\n case True\n obtain V' where \n \"\\prg=G,cls=accC,lcl=L\\ \\dom (locals (store s1))\\\\e2\\\\<^sub>e\\ V'\"\n proof -\n from eval_e1 wt_e1 da_e1 wf True\n have \"nrm E1 \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_e2 show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_e2 Q' valid_A conf_s1 eval_e2 wt_e2 \n show ?thesis\n by (rule validE) (simp add: avar)\n next\n case False\n with valid_e2 Q' valid_A conf_s1 eval_e2\n show ?thesis\n by (cases rule: validE) (simp add: avar)+\n qed\n moreover\n from eval wt da conf_s0 wf\n have \"s2'\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (NewC A P C Q)\n note valid_init = `G,A|\\\\{ {Normal P} .Init C. {Alloc G (CInst C) Q} }`\n show \"G,A|\\\\{ {Normal P} NewC C-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\NewC C\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\NewC C\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\NewC C-\\v\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain is_cls_C: \"is_class G C\" \n by (rule wt_elim_cases) (auto dest: is_acc_classD)\n hence wt_init: \"\\prg=G, cls=accC, lcl=L\\\\Init C\\\\\" \n by auto\n obtain I where \n da_init: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\Init C\\\\<^sub>s\\ I\"\n by (auto intro: da_Init [simplified] assigned.select_convs)\n from eval obtain s1 a where\n eval_init: \"G\\s0 \\Init C\\n\\ s1\" and \n alloc: \"G\\s1 \\halloc CInst C\\a\\ s2\" and\n v: \"v=Addr a\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_init P valid_A conf_s0 eval_init wt_init da_init\n obtain \"(Alloc G (CInst C) Q) \\ s1 Z\" \n by (rule validE)\n with alloc v have \"Q \\v\\\\<^sub>e s2 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (NewA A P T Q e R)\n note valid_init = `G,A|\\\\{ {Normal P} .init_comp_ty T. {Q} }`\n note valid_e = `G,A|\\\\{ {Q} e-\\ {\\Val:i:. abupd (check_neg i) .; \n Alloc G (Arr T (the_Intg i)) R}}`\n show \"G,A|\\\\{ {Normal P} New T[e]-\\ {R} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC arrT E v s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\New T[e]\\-arrT\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\New T[e]\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\New T[e]-\\v\\n\\ s3\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\v\\\\<^sub>e s3 Z \\ s3\\\\(G, L)\"\n proof -\n from wt obtain\n wt_init: \"\\prg=G,cls=accC,lcl=L\\\\init_comp_ty T\\\\\" and \n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-PrimT Integer\" \n by (rule wt_elim_cases) (auto intro: wt_init_comp_ty )\n from da obtain\n da_e:\"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp\n from eval obtain s1 i s2 a where\n eval_init: \"G\\s0 \\init_comp_ty T\\n\\ s1\" and \n eval_e: \"G\\s1 \\e-\\i\\n\\ s2\" and\n alloc: \"G\\abupd (check_neg i) s2 \\halloc Arr T (the_Intg i)\\a\\ s3\" and\n v: \"v=Addr a\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n obtain I where\n da_init:\n \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\init_comp_ty T\\\\<^sub>s\\ I\"\n proof (cases \"\\C. T = Class C\")\n case True\n thus ?thesis\n by - (rule that, (auto intro: da_Init [simplified] \n assigned.select_convs\n simp add: init_comp_ty_def))\n (* simplified: to rewrite \\Init C\\ to In1r (Init C) *)\n next\n case False\n thus ?thesis\n by - (rule that, (auto intro: da_Skip [simplified] \n assigned.select_convs\n simp add: init_comp_ty_def))\n (* simplified: to rewrite \\Skip\\ to In1r (Skip) *)\n qed\n with valid_init P valid_A conf_s0 eval_init wt_init \n obtain Q: \"Q \\ s1 Z\" and conf_s1: \"s1\\\\(G, L)\"\n by (rule validE)\n obtain E' where\n \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\e\\\\<^sub>e\\ E'\"\n proof -\n from eval_init \n have \"dom (locals (store s0)) \\ dom (locals (store s1))\"\n by (rule dom_locals_evaln_mono_elim)\n with da_e show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_e Q valid_A conf_s1 eval_e wt_e\n have \"(\\Val:i:. abupd (check_neg i) .; \n Alloc G (Arr T (the_Intg i)) R) \\i\\\\<^sub>e s2 Z\"\n by (rule validE)\n with alloc v have \"R \\v\\\\<^sub>e s3 Z\"\n by simp\n moreover \n from eval wt da conf_s0 wf\n have \"s3\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Cast A P e T Q)\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ \n {\\Val:v:. \\s.. abupd (raise_if (\\ G,s\\v fits T) ClassCast) .;\n Q\\In1 v} }`\n show \"G,A|\\\\{ {Normal P} Cast T e-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC castT E v s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Cast T e\\-castT\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\Cast T e\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\Cast T e-\\v\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain eT where \n wt_e: \"\\prg = G, cls = accC, lcl = L\\\\e\\-eT\" \n by cases simp\n from da obtain\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp\n from eval obtain s1 where\n eval_e: \"G\\s0 \\e-\\v\\n\\ s1\" and\n s2: \"s2 = abupd (raise_if (\\ G,snd s1\\v fits T) ClassCast) s1\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e\n have \"(\\Val:v:. \\s.. abupd (raise_if (\\ G,s\\v fits T) ClassCast) .;\n Q\\In1 v) \\v\\\\<^sub>e s1 Z\"\n by (rule validE)\n with s2 have \"Q \\v\\\\<^sub>e s2 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Inst A P e Q T)\n assume valid_e: \"G,A|\\\\{ {Normal P} e-\\\n {\\Val:v:. \\s.. Q\\In1 (Bool (v \\ Null \\ G,s\\v fits RefT T))} }\"\n show \"G,A|\\\\{ {Normal P} e InstOf T-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC instT E v s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\e InstOf T\\-instT\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\e InstOf T\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\e InstOf T-\\v\\n\\ s1\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"\n proof -\n from wt obtain eT where \n wt_e: \"\\prg = G, cls = accC, lcl = L\\\\e\\-eT\" \n by cases simp\n from da obtain\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp\n from eval obtain a where\n eval_e: \"G\\s0 \\e-\\a\\n\\ s1\" and\n v: \"v = Bool (a \\ Null \\ G,store s1\\a fits RefT T)\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e\n have \"(\\Val:v:. \\s.. Q\\In1 (Bool (v \\ Null \\ G,s\\v fits RefT T))) \n \\a\\\\<^sub>e s1 Z\"\n by (rule validE)\n with v have \"Q \\v\\\\<^sub>e s1 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s1\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Lit A P v)\n show \"G,A|\\\\{ {Normal (P\\In1 v)} Lit v-\\ {P} }\"\n proof (rule valid_expr_NormalI)\n fix n L s0 s1 v' Y Z\n assume conf_s0: \"s0\\\\(G, L)\"\n assume normal_s0: \" normal s0\"\n assume eval: \"G\\s0 \\Lit v-\\v'\\n\\ s1\"\n assume P: \"(Normal (P\\In1 v)) Y s0 Z\"\n show \"P \\v'\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"\n proof -\n from eval have \"s1=s0\" and \"v'=v\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n with P conf_s0 show ?thesis by simp\n qed\n qed\nnext\n case (UnOp A P e Q unop)\n assume valid_e: \"G,A|\\\\{ {Normal P}e-\\{\\Val:v:. Q\\In1 (eval_unop unop v)} }\"\n show \"G,A|\\\\{ {Normal P} UnOp unop e-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\UnOp unop e\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\UnOp unop e\\\\<^sub>e\\E\"\n assume eval: \"G\\s0 \\UnOp unop e-\\v\\n\\ s1\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"\n proof -\n from wt obtain eT where \n wt_e: \"\\prg = G, cls = accC, lcl = L\\\\e\\-eT\" \n by cases simp\n from da obtain\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp\n from eval obtain ve where\n eval_e: \"G\\s0 \\e-\\ve\\n\\ s1\" and\n v: \"v = eval_unop unop ve\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e\n have \"(\\Val:v:. Q\\In1 (eval_unop unop v)) \\ve\\\\<^sub>e s1 Z\"\n by (rule validE)\n with v have \"Q \\v\\\\<^sub>e s1 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s1\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (BinOp A P e1 Q binop e2 R)\n assume valid_e1: \"G,A|\\\\{ {Normal P} e1-\\ {Q} }\" \n have valid_e2: \"\\ v1. G,A|\\\\{ {Q\\In1 v1}\n (if need_second_arg binop v1 then In1l e2 else In1r Skip)\\\n {\\Val:v2:. R\\In1 (eval_binop binop v1 v2)} }\"\n using BinOp.hyps by simp\n show \"G,A|\\\\{ {Normal P} BinOp binop e1 e2-\\ {R} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\BinOp binop e1 e2\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0)) \\\\BinOp binop e1 e2\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\BinOp binop e1 e2-\\v\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\v\\\\<^sub>e s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain e1T e2T where\n wt_e1: \"\\prg=G,cls=accC,lcl=L\\\\e1\\-e1T\" and\n wt_e2: \"\\prg=G,cls=accC,lcl=L\\\\e2\\-e2T\" and\n wt_binop: \"wt_binop G binop e1T e2T\" \n by cases simp\n have wt_Skip: \"\\prg = G, cls = accC, lcl = L\\\\Skip\\\\\"\n by simp\n (*\n obtain S where\n daSkip: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s1)) \\In1r Skip\\ S\"\n by (auto intro: da_Skip [simplified] assigned.select_convs) *)\n from da obtain E1 where\n da_e1: \"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\e1\\\\<^sub>e\\ E1\"\n by cases simp+\n from eval obtain v1 s1 v2 where\n eval_e1: \"G\\s0 \\e1-\\v1\\n\\ s1\" and\n eval_e2: \"G\\s1 \\(if need_second_arg binop v1 then \\e2\\\\<^sub>e else \\Skip\\\\<^sub>s)\n \\\\n\\ (\\v2\\\\<^sub>e, s2)\" and\n v: \"v=eval_binop binop v1 v2\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e1 P valid_A conf_s0 eval_e1 wt_e1 da_e1\n obtain Q: \"Q \\v1\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n from Q have Q': \"\\ v. (Q\\In1 v1) v s1 Z\"\n by simp\n have \"(\\Val:v2:. R\\In1 (eval_binop binop v1 v2)) \\v2\\\\<^sub>e s2 Z\"\n proof (cases \"normal s1\")\n case True\n from eval_e1 wt_e1 da_e1 conf_s0 wf\n have conf_v1: \"G,store s1\\v1\\\\e1T\" \n by (rule evaln_type_sound [elim_format]) (insert True,simp)\n from eval_e1 \n have \"G\\s0 \\e1-\\v1\\ s1\"\n by (rule evaln_eval)\n from da wt_e1 wt_e2 wt_binop conf_s0 True this conf_v1 wf\n obtain E2 where\n da_e2: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \n \\(if need_second_arg binop v1 then \\e2\\\\<^sub>e else \\Skip\\\\<^sub>s)\\ E2\"\n by (rule da_e2_BinOp [elim_format]) iprover\n from wt_e2 wt_Skip obtain T2 \n where \"\\prg=G,cls=accC,lcl=L\\\n \\(if need_second_arg binop v1 then \\e2\\\\<^sub>e else \\Skip\\\\<^sub>s)\\T2\"\n by (cases \"need_second_arg binop v1\") auto\n note ve=validE [OF valid_e2,OF Q' valid_A conf_s1 eval_e2 this da_e2]\n (* chaining Q', without extra OF causes unification error *)\n thus ?thesis\n by (rule ve)\n next\n case False\n note ve=validE [OF valid_e2,OF Q' valid_A conf_s1 eval_e2]\n with False show ?thesis\n by iprover\n qed\n with v have \"R \\v\\\\<^sub>e s2 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Super A P)\n show \"G,A|\\\\{ {Normal (\\s.. P\\In1 (val_this s))} Super-\\ {P} }\"\n proof (rule valid_expr_NormalI)\n fix n L s0 s1 v Y Z\n assume conf_s0: \"s0\\\\(G, L)\"\n assume normal_s0: \" normal s0\"\n assume eval: \"G\\s0 \\Super-\\v\\n\\ s1\"\n assume P: \"(Normal (\\s.. P\\In1 (val_this s))) Y s0 Z\"\n show \"P \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"\n proof -\n from eval have \"s1=s0\" and \"v=val_this (store s0)\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n with P conf_s0 show ?thesis by simp\n qed\n qed\nnext\n case (Acc A P var Q)\n note valid_var = `G,A|\\\\{ {Normal P} var=\\ {\\Var:(v, f):. Q\\In1 v} }`\n show \"G,A|\\\\{ {Normal P} Acc var-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Acc var\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\Acc var\\\\<^sub>e\\E\"\n assume eval: \"G\\s0 \\Acc var-\\v\\n\\ s1\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"\n proof -\n from wt obtain \n wt_var: \"\\prg=G,cls=accC,lcl=L\\\\var\\=T\" \n by cases simp\n from da obtain V where \n da_var: \"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\var\\\\<^sub>v\\ V\"\n by (cases \"\\ n. var=LVar n\") (insert da.LVar,auto elim!: da_elim_cases)\n from eval obtain upd where\n eval_var: \"G\\s0 \\var=\\(v, upd)\\n\\ s1\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_var P valid_A conf_s0 eval_var wt_var da_var\n have \"(\\Var:(v, f):. Q\\In1 v) \\(v, upd)\\\\<^sub>v s1 Z\"\n by (rule validE)\n then have \"Q \\v\\\\<^sub>e s1 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s1\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Ass A P var Q e R)\n note valid_var = `G,A|\\\\{ {Normal P} var=\\ {Q} }`\n have valid_e: \"\\ vf. \n G,A|\\\\{ {Q\\In2 vf} e-\\ {\\Val:v:. assign (snd vf) v .; R} }\"\n using Ass.hyps by simp\n show \"G,A|\\\\{ {Normal P} var:=e-\\ {R} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\var:=e\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\var:=e\\\\<^sub>e\\E\"\n assume eval: \"G\\s0 \\var:=e-\\v\\n\\ s3\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\v\\\\<^sub>e s3 Z \\ s3\\\\(G, L)\"\n proof -\n from wt obtain varT where\n wt_var: \"\\prg=G,cls=accC,lcl=L\\\\var\\=varT\" and\n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-T\" \n by cases simp\n from eval obtain w upd s1 s2 where\n eval_var: \"G\\s0 \\var=\\(w, upd)\\n\\ s1\" and\n eval_e: \"G\\s1 \\e-\\v\\n\\ s2\" and\n s3: \"s3=assign upd v s2\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n have \"R \\v\\\\<^sub>e s3 Z\"\n proof (cases \"\\ vn. var = LVar vn\")\n case False\n with da obtain V where\n da_var: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\var\\\\<^sub>v\\ V\" and\n da_e: \"\\prg=G,cls=accC,lcl=L\\ \\ nrm V \\\\e\\\\<^sub>e\\ E\"\n by cases simp+\n from valid_var P valid_A conf_s0 eval_var wt_var da_var\n obtain Q: \"Q \\(w,upd)\\\\<^sub>v s1 Z\" and conf_s1: \"s1\\\\(G,L)\" \n by (rule validE) \n hence Q': \"\\ v. (Q\\In2 (w,upd)) v s1 Z\"\n by simp\n have \"(\\Val:v:. assign (snd (w,upd)) v .; R) \\v\\\\<^sub>e s2 Z\"\n proof (cases \"normal s1\")\n case True\n obtain E' where \n da_e': \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\e\\\\<^sub>e\\ E'\"\n proof -\n from eval_var wt_var da_var wf True\n have \"nrm V \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_e show thesis\n by (rule da_weakenE) (rule that)\n qed\n note ve=validE [OF valid_e,OF Q' valid_A conf_s1 eval_e wt_e da_e']\n show ?thesis\n by (rule ve)\n next\n case False\n note ve=validE [OF valid_e,OF Q' valid_A conf_s1 eval_e]\n with False show ?thesis\n by iprover\n qed\n with s3 show \"R \\v\\\\<^sub>e s3 Z\"\n by simp\n next\n case True\n then obtain vn where \n vn: \"var = LVar vn\" \n by auto\n with da obtain E where\n da_e: \"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp+\n from da.LVar vn obtain V where\n da_var: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\var\\\\<^sub>v\\ V\"\n by auto\n from valid_var P valid_A conf_s0 eval_var wt_var da_var\n obtain Q: \"Q \\(w,upd)\\\\<^sub>v s1 Z\" and conf_s1: \"s1\\\\(G,L)\" \n by (rule validE) \n hence Q': \"\\ v. (Q\\In2 (w,upd)) v s1 Z\"\n by simp\n have \"(\\Val:v:. assign (snd (w,upd)) v .; R) \\v\\\\<^sub>e s2 Z\"\n proof (cases \"normal s1\")\n case True\n obtain E' where\n da_e': \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s1)) \\\\e\\\\<^sub>e\\ E'\"\n proof -\n from eval_var\n have \"dom (locals (store s0)) \\ dom (locals (store (s1)))\"\n by (rule dom_locals_evaln_mono_elim)\n with da_e show thesis\n by (rule da_weakenE) (rule that)\n qed\n note ve=validE [OF valid_e,OF Q' valid_A conf_s1 eval_e wt_e da_e']\n show ?thesis\n by (rule ve)\n next\n case False\n note ve=validE [OF valid_e,OF Q' valid_A conf_s1 eval_e]\n with False show ?thesis\n by iprover\n qed\n with s3 show \"R \\v\\\\<^sub>e s3 Z\"\n by simp\n qed\n moreover\n from eval wt da conf_s0 wf\n have \"s3\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Cond A P e0 P' e1 e2 Q)\n note valid_e0 = `G,A|\\\\{ {Normal P} e0-\\ {P'} }`\n have valid_then_else:\"\\ b. G,A|\\\\{ {P'\\=b} (if b then e1 else e2)-\\ {Q} }\"\n using Cond.hyps by simp\n show \"G,A|\\\\{ {Normal P} e0 ? e1 : e2-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\e0 ? e1 : e2\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\e0 ? e1:e2\\\\<^sub>e\\E\"\n assume eval: \"G\\s0 \\e0 ? e1 : e2-\\v\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\v\\\\<^sub>e s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain T1 T2 where\n wt_e0: \"\\prg=G,cls=accC,lcl=L\\\\e0\\-PrimT Boolean\" and\n wt_e1: \"\\prg=G,cls=accC,lcl=L\\\\e1\\-T1\" and\n wt_e2: \"\\prg=G,cls=accC,lcl=L\\\\e2\\-T2\" \n by cases simp\n from da obtain E0 E1 E2 where\n da_e0: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e0\\\\<^sub>e\\ E0\" and\n da_e1: \"\\prg=G,cls=accC,lcl=L\\\n \\(dom (locals (store s0)) \\ assigns_if True e0)\\\\e1\\\\<^sub>e\\ E1\" and\n da_e2: \"\\prg=G,cls=accC,lcl=L\\\n \\(dom (locals (store s0)) \\ assigns_if False e0)\\\\e2\\\\<^sub>e\\ E2\"\n by cases simp+\n from eval obtain b s1 where\n eval_e0: \"G\\s0 \\e0-\\b\\n\\ s1\" and\n eval_then_else: \"G\\s1 \\(if the_Bool b then e1 else e2)-\\v\\n\\ s2\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e0 P valid_A conf_s0 eval_e0 wt_e0 da_e0\n obtain \"P' \\b\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G,L)\" \n by (rule validE)\n hence P': \"\\ v. (P'\\=(the_Bool b)) v s1 Z\"\n by (cases \"normal s1\") auto\n have \"Q \\v\\\\<^sub>e s2 Z\"\n proof (cases \"normal s1\")\n case True\n note normal_s1=this\n from wt_e1 wt_e2 obtain T' where\n wt_then_else: \n \"\\prg=G,cls=accC,lcl=L\\\\(if the_Bool b then e1 else e2)\\-T'\"\n by (cases \"the_Bool b\") simp+\n have s0_s1: \"dom (locals (store s0)) \n \\ assigns_if (the_Bool b) e0 \\ dom (locals (store s1))\"\n proof -\n from eval_e0 \n have eval_e0': \"G\\s0 \\e0-\\b\\ s1\"\n by (rule evaln_eval)\n hence\n \"dom (locals (store s0)) \\ dom (locals (store s1))\"\n by (rule dom_locals_eval_mono_elim)\n moreover\n from eval_e0' True wt_e0 \n have \"assigns_if (the_Bool b) e0 \\ dom (locals (store s1))\"\n by (rule assigns_if_good_approx') \n ultimately show ?thesis by (rule Un_least)\n qed\n obtain E' where\n da_then_else:\n \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s1))\\\\if the_Bool b then e1 else e2\\\\<^sub>e\\ E'\"\n proof (cases \"the_Bool b\")\n case True\n with that da_e1 s0_s1 show ?thesis\n by simp (erule da_weakenE,auto)\n next\n case False\n with that da_e2 s0_s1 show ?thesis\n by simp (erule da_weakenE,auto)\n qed\n with valid_then_else P' valid_A conf_s1 eval_then_else wt_then_else\n show ?thesis\n by (rule validE)\n next\n case False\n with valid_then_else P' valid_A conf_s1 eval_then_else\n show ?thesis\n by (cases rule: validE) iprover+\n qed\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Call A P e Q args R mode statT mn pTs' S accC')\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ {Q} }`\n have valid_args: \"\\ a. G,A|\\\\{ {Q\\In1 a} args\\\\ {R a} }\"\n using Call.hyps by simp\n have valid_methd: \"\\ a vs invC declC l.\n G,A|\\\\{ {R a\\In3 vs \\.\n (\\s. declC =\n invocation_declclass G mode (store s) a statT\n \\name = mn, parTs = pTs'\\ \\\n invC = invocation_class mode (store s) a statT \\\n l = locals (store s)) ;.\n init_lvars G declC \\name = mn, parTs = pTs'\\ mode a vs \\.\n (\\s. normal s \\ G\\mode\\invC\\statT)}\n Methd declC \\name=mn,parTs=pTs'\\-\\ {set_lvars l .; S} }\"\n using Call.hyps by simp\n show \"G,A|\\\\{ {Normal P} {accC',statT,mode}e\\mn( {pTs'}args)-\\ {S} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s5 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\{accC',statT,mode}e\\mn( {pTs'}args)\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\n \\\\{accC',statT,mode}e\\mn( {pTs'}args)\\\\<^sub>e\\ E\"\n assume eval: \"G\\s0 \\{accC',statT,mode}e\\mn( {pTs'}args)-\\v\\n\\ s5\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"S \\v\\\\<^sub>e s5 Z \\ s5\\\\(G, L)\"\n proof -\n from wt obtain pTs statDeclT statM where\n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-RefT statT\" and\n wt_args: \"\\prg=G,cls=accC,lcl=L\\\\args\\\\pTs\" and\n statM: \"max_spec G accC statT \\name=mn,parTs=pTs\\ \n = {((statDeclT,statM),pTs')}\" and\n mode: \"mode = invmode statM e\" and\n T: \"T =(resTy statM)\" and\n eq_accC_accC': \"accC=accC'\"\n by cases fastforce+\n from da obtain C where\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ (dom (locals (store s0)))\\\\e\\\\<^sub>e\\ C\" and\n da_args: \"\\prg=G,cls=accC,lcl=L\\\\ nrm C \\\\args\\\\<^sub>l\\ E\" \n by cases simp\n from eval eq_accC_accC' obtain a s1 vs s2 s3 s3' s4 invDeclC where\n evaln_e: \"G\\s0 \\e-\\a\\n\\ s1\" and\n evaln_args: \"G\\s1 \\args\\\\vs\\n\\ s2\" and\n invDeclC: \"invDeclC = invocation_declclass \n G mode (store s2) a statT \\name=mn,parTs=pTs'\\\" and\n s3: \"s3 = init_lvars G invDeclC \\name=mn,parTs=pTs'\\ mode a vs s2\" and\n check: \"s3' = check_method_access G \n accC' statT mode \\name = mn, parTs = pTs'\\ a s3\" and\n evaln_methd:\n \"G\\s3' \\Methd invDeclC \\name=mn,parTs=pTs'\\-\\v\\n\\ s4\" and\n s5: \"s5=(set_lvars (locals (store s2))) s4\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n\n from evaln_e\n have eval_e: \"G\\s0 \\e-\\a\\ s1\"\n by (rule evaln_eval)\n \n from eval_e _ wt_e wf\n have s1_no_return: \"abrupt s1 \\ Some (Jump Ret)\"\n by (rule eval_expression_no_jump \n [where ?Env=\"\\prg=G,cls=accC,lcl=L\\\",simplified])\n (insert normal_s0,auto)\n\n from valid_e P valid_A conf_s0 evaln_e wt_e da_e\n obtain \"Q \\a\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n hence Q: \"\\ v. (Q\\In1 a) v s1 Z\"\n by simp\n obtain \n R: \"(R a) \\vs\\\\<^sub>l s2 Z\" and \n conf_s2: \"s2\\\\(G,L)\" and \n s2_no_return: \"abrupt s2 \\ Some (Jump Ret)\"\n proof (cases \"normal s1\")\n case True\n obtain E' where \n da_args':\n \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\args\\\\<^sub>l\\ E'\"\n proof -\n from evaln_e wt_e da_e wf True\n have \"nrm C \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_args show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_args Q valid_A conf_s1 evaln_args wt_args \n obtain \"(R a) \\vs\\\\<^sub>l s2 Z\" \"s2\\\\(G,L)\" \n by (rule validE)\n moreover\n from evaln_args\n have e: \"G\\s1 \\args\\\\vs\\ s2\"\n by (rule evaln_eval)\n from this s1_no_return wt_args wf\n have \"abrupt s2 \\ Some (Jump Ret)\"\n by (rule eval_expression_list_no_jump \n [where ?Env=\"\\prg=G,cls=accC,lcl=L\\\",simplified])\n ultimately show ?thesis ..\n next\n case False\n with valid_args Q valid_A conf_s1 evaln_args\n obtain \"(R a) \\vs\\\\<^sub>l s2 Z\" \"s2\\\\(G,L)\" \n by (cases rule: validE) iprover+\n moreover\n from False evaln_args have \"s2=s1\"\n by auto\n with s1_no_return have \"abrupt s2 \\ Some (Jump Ret)\"\n by simp\n ultimately show ?thesis ..\n qed\n\n obtain invC where\n invC: \"invC = invocation_class mode (store s2) a statT\"\n by simp\n with s3\n have invC': \"invC = (invocation_class mode (store s3) a statT)\"\n by (cases s2,cases mode) (auto simp add: init_lvars_def2 )\n obtain l where\n l: \"l = locals (store s2)\"\n by simp\n\n from eval wt da conf_s0 wf\n have conf_s5: \"s5\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n let \"PROP ?R\" = \"\\ v.\n (R a\\In3 vs \\.\n (\\s. invDeclC = invocation_declclass G mode (store s) a statT\n \\name = mn, parTs = pTs'\\ \\\n invC = invocation_class mode (store s) a statT \\\n l = locals (store s)) ;.\n init_lvars G invDeclC \\name = mn, parTs = pTs'\\ mode a vs \\.\n (\\s. normal s \\ G\\mode\\invC\\statT)\n ) v s3' Z\"\n {\n assume abrupt_s3: \"\\ normal s3\"\n have \"S \\v\\\\<^sub>e s5 Z\"\n proof -\n from abrupt_s3 check have eq_s3'_s3: \"s3'=s3\"\n by (auto simp add: check_method_access_def Let_def)\n with R s3 invDeclC invC l abrupt_s3\n have R': \"PROP ?R\"\n by auto\n have conf_s3': \"s3'\\\\(G, empty)\"\n (* we need an arbirary environment (here empty) that s2' conforms to\n to apply validE *)\n proof -\n from s2_no_return s3\n have \"abrupt s3 \\ Some (Jump Ret)\"\n by (cases s2) (auto simp add: init_lvars_def2 split: split_if_asm)\n moreover\n obtain abr2 str2 where s2: \"s2=(abr2,str2)\"\n by (cases s2)\n from s3 s2 conf_s2 have \"(abrupt s3,str2)\\\\(G, L)\"\n by (auto simp add: init_lvars_def2 split: split_if_asm)\n ultimately show ?thesis\n using s3 s2 eq_s3'_s3\n apply (simp add: init_lvars_def2)\n apply (rule conforms_set_locals [OF _ wlconf_empty])\n by auto\n qed\n from valid_methd R' valid_A conf_s3' evaln_methd abrupt_s3 eq_s3'_s3\n have \"(set_lvars l .; S) \\v\\\\<^sub>e s4 Z\"\n by (cases rule: validE) simp+\n with s5 l show ?thesis\n by simp\n qed\n } note abrupt_s3_lemma = this\n\n have \"S \\v\\\\<^sub>e s5 Z\"\n proof (cases \"normal s2\")\n case False\n with s3 have abrupt_s3: \"\\ normal s3\"\n by (cases s2) (simp add: init_lvars_def2)\n thus ?thesis\n by (rule abrupt_s3_lemma)\n next\n case True\n note normal_s2 = this\n with evaln_args \n have normal_s1: \"normal s1\"\n by (rule evaln_no_abrupt)\n obtain E' where \n da_args':\n \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\args\\\\<^sub>l\\ E'\"\n proof -\n from evaln_e wt_e da_e wf normal_s1\n have \"nrm C \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_args show thesis\n by (rule da_weakenE) (rule that)\n qed\n from evaln_args\n have eval_args: \"G\\s1 \\args\\\\vs\\ s2\"\n by (rule evaln_eval)\n from evaln_e wt_e da_e conf_s0 wf\n have conf_a: \"G, store s1\\a\\\\RefT statT\"\n by (rule evaln_type_sound [elim_format]) (insert normal_s1,simp)\n with normal_s1 normal_s2 eval_args \n have conf_a_s2: \"G, store s2\\a\\\\RefT statT\"\n by (auto dest: eval_gext)\n from evaln_args wt_args da_args' conf_s1 wf\n have conf_args: \"list_all2 (conf G (store s2)) vs pTs\"\n by (rule evaln_type_sound [elim_format]) (insert normal_s2,simp)\n from statM \n obtain\n statM': \"(statDeclT,statM)\\mheads G accC statT \\name=mn,parTs=pTs'\\\" \n and\n pTs_widen: \"G\\pTs[\\]pTs'\"\n by (blast dest: max_spec2mheads)\n show ?thesis\n proof (cases \"normal s3\")\n case False\n thus ?thesis\n by (rule abrupt_s3_lemma)\n next\n case True\n note normal_s3 = this\n with s3 have notNull: \"mode = IntVir \\ a \\ Null\"\n by (cases s2) (auto simp add: init_lvars_def2)\n from conf_s2 conf_a_s2 wf notNull invC\n have dynT_prop: \"G\\mode\\invC\\statT\"\n by (cases s2) (auto intro: DynT_propI)\n\n with wt_e statM' invC mode wf \n obtain dynM where \n dynM: \"dynlookup G statT invC \\name=mn,parTs=pTs'\\ = Some dynM\" and\n acc_dynM: \"G \\Methd \\name=mn,parTs=pTs'\\ dynM \n in invC dyn_accessible_from accC\"\n by (force dest!: call_access_ok)\n with invC' check eq_accC_accC'\n have eq_s3'_s3: \"s3'=s3\"\n by (auto simp add: check_method_access_def Let_def)\n \n with dynT_prop R s3 invDeclC invC l \n have R': \"PROP ?R\"\n by auto\n\n from dynT_prop wf wt_e statM' mode invC invDeclC dynM\n obtain \n dynM: \"dynlookup G statT invC \\name=mn,parTs=pTs'\\ = Some dynM\" and\n wf_dynM: \"wf_mdecl G invDeclC (\\name=mn,parTs=pTs'\\,mthd dynM)\" and\n dynM': \"methd G invDeclC \\name=mn,parTs=pTs'\\ = Some dynM\" and\n iscls_invDeclC: \"is_class G invDeclC\" and\n invDeclC': \"invDeclC = declclass dynM\" and\n invC_widen: \"G\\invC\\\\<^sub>C invDeclC\" and\n resTy_widen: \"G\\resTy dynM\\resTy statM\" and\n is_static_eq: \"is_static dynM = is_static statM\" and\n involved_classes_prop:\n \"(if invmode statM e = IntVir\n then \\statC. statT = ClassT statC \\ G\\invC\\\\<^sub>C statC\n else ((\\statC. statT = ClassT statC \\ G\\statC\\\\<^sub>C invDeclC) \\\n (\\statC. statT \\ ClassT statC \\ invDeclC = Object)) \\\n statDeclT = ClassT invDeclC)\"\n by (cases rule: DynT_mheadsE) simp\n obtain L' where \n L':\"L'=(\\ k. \n (case k of\n EName e\n \\ (case e of \n VNam v \n \\(table_of (lcls (mbody (mthd dynM)))\n (pars (mthd dynM)[\\]pTs')) v\n | Res \\ Some (resTy dynM))\n | This \\ if is_static statM \n then None else Some (Class invDeclC)))\"\n by simp\n from wf_dynM [THEN wf_mdeclD1, THEN conjunct1] normal_s2 conf_s2 wt_e\n wf eval_args conf_a mode notNull wf_dynM involved_classes_prop\n have conf_s3: \"s3\\\\(G,L')\"\n apply - \n (* FIXME confomrs_init_lvars should be \n adjusted to be more directy applicable *)\n apply (drule conforms_init_lvars [of G invDeclC \n \"\\name=mn,parTs=pTs'\\\" dynM \"store s2\" vs pTs \"abrupt s2\" \n L statT invC a \"(statDeclT,statM)\" e])\n apply (rule wf)\n apply (rule conf_args)\n apply (simp add: pTs_widen)\n apply (cases s2,simp)\n apply (rule dynM')\n apply (force dest: ty_expr_is_type)\n apply (rule invC_widen)\n apply (force dest: eval_gext)\n apply simp\n apply simp\n apply (simp add: invC)\n apply (simp add: invDeclC)\n apply (simp add: normal_s2)\n apply (cases s2, simp add: L' init_lvars_def2 s3\n cong add: lname.case_cong ename.case_cong)\n done\n with eq_s3'_s3 have conf_s3': \"s3'\\\\(G,L')\" by simp\n from is_static_eq wf_dynM L'\n obtain mthdT where\n \"\\prg=G,cls=invDeclC,lcl=L'\\\n \\Body invDeclC (stmt (mbody (mthd dynM)))\\-mthdT\" and\n mthdT_widen: \"G\\mthdT\\resTy dynM\"\n by - (drule wf_mdecl_bodyD,\n auto simp add: callee_lcl_def \n cong add: lname.case_cong ename.case_cong)\n with dynM' iscls_invDeclC invDeclC'\n have\n wt_methd:\n \"\\prg=G,cls=invDeclC,lcl=L'\\\n \\(Methd invDeclC \\name = mn, parTs = pTs'\\)\\-mthdT\"\n by (auto intro: wt.Methd)\n obtain M where \n da_methd:\n \"\\prg=G,cls=invDeclC,lcl=L'\\ \n \\ dom (locals (store s3')) \n \\\\Methd invDeclC \\name=mn,parTs=pTs'\\\\\\<^sub>e\\ M\"\n proof -\n from wf_dynM\n obtain M' where\n da_body: \n \"\\prg=G, cls=invDeclC\n ,lcl=callee_lcl invDeclC \\name = mn, parTs = pTs'\\ (mthd dynM)\n \\ \\ parameters (mthd dynM) \\\\stmt (mbody (mthd dynM))\\\\ M'\" and\n res: \"Result \\ nrm M'\"\n by (rule wf_mdeclE) iprover\n from da_body is_static_eq L' have\n \"\\prg=G, cls=invDeclC,lcl=L'\\ \n \\ parameters (mthd dynM) \\\\stmt (mbody (mthd dynM))\\\\ M'\"\n by (simp add: callee_lcl_def \n cong add: lname.case_cong ename.case_cong)\n moreover have \"parameters (mthd dynM) \\ dom (locals (store s3'))\"\n proof -\n from is_static_eq \n have \"(invmode (mthd dynM) e) = (invmode statM e)\"\n by (simp add: invmode_def)\n moreover\n have \"length (pars (mthd dynM)) = length vs\" \n proof -\n from normal_s2 conf_args\n have \"length vs = length pTs\"\n by (simp add: list_all2_iff)\n also from pTs_widen\n have \"\\ = length pTs'\"\n by (simp add: widens_def list_all2_iff)\n also from wf_dynM\n have \"\\ = length (pars (mthd dynM))\"\n by (simp add: wf_mdecl_def wf_mhead_def)\n finally show ?thesis ..\n qed\n moreover note s3 dynM' is_static_eq normal_s2 mode \n ultimately\n have \"parameters (mthd dynM) = dom (locals (store s3))\"\n using dom_locals_init_lvars \n [of \"mthd dynM\" G invDeclC \"\\name=mn,parTs=pTs'\\\" vs e a s2]\n by simp\n thus ?thesis using eq_s3'_s3 by simp\n qed\n ultimately obtain M2 where\n da:\n \"\\prg=G, cls=invDeclC,lcl=L'\\ \n \\ dom (locals (store s3')) \\\\stmt (mbody (mthd dynM))\\\\ M2\" and\n M2: \"nrm M' \\ nrm M2\"\n by (rule da_weakenE)\n from res M2 have \"Result \\ nrm M2\"\n by blast\n moreover from wf_dynM\n have \"jumpNestingOkS {Ret} (stmt (mbody (mthd dynM)))\"\n by (rule wf_mdeclE)\n ultimately\n obtain M3 where\n \"\\prg=G, cls=invDeclC,lcl=L'\\ \\ dom (locals (store s3')) \n \\\\Body (declclass dynM) (stmt (mbody (mthd dynM)))\\\\ M3\"\n using da\n by (iprover intro: da.Body assigned.select_convs)\n from _ this [simplified]\n show thesis\n by (rule da.Methd [simplified,elim_format])\n (auto intro: dynM' that)\n qed\n from valid_methd R' valid_A conf_s3' evaln_methd wt_methd da_methd\n have \"(set_lvars l .; S) \\v\\\\<^sub>e s4 Z\"\n by (cases rule: validE) iprover+\n with s5 l show ?thesis\n by simp\n qed\n qed\n with conf_s5 show ?thesis by iprover\n qed\n qed\nnext\n case (Methd A P Q ms)\n note valid_body = `G,A \\ {{P} Methd-\\ {Q} | ms}|\\\\{{P} body G-\\ {Q} | ms}`\n show \"G,A|\\\\{{P} Methd-\\ {Q} | ms}\"\n by (rule Methd_sound) (rule Methd.hyps)\nnext\n case (Body A P D Q c R)\n note valid_init = `G,A|\\\\{ {Normal P} .Init D. {Q} }`\n note valid_c = `G,A|\\\\{ {Q} .c.\n {\\s.. abupd (absorb Ret) .; R\\In1 (the (locals s Result))} }`\n show \"G,A|\\\\{ {Normal P} Body D c-\\ {R} }\"\n proof (rule valid_expr_NormalI)\n fix n s0 L accC T E v s4 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Body D c\\-T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\Body D c\\\\<^sub>e\\E\"\n assume eval: \"G\\s0 \\Body D c-\\v\\n\\ s4\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\v\\\\<^sub>e s4 Z \\ s4\\\\(G, L)\"\n proof -\n from wt obtain \n iscls_D: \"is_class G D\" and\n wt_init: \"\\prg=G,cls=accC,lcl=L\\\\Init D\\\\\" and\n wt_c: \"\\prg=G,cls=accC,lcl=L\\\\c\\\\\" \n by cases auto\n obtain I where \n da_init:\"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\Init D\\\\<^sub>s\\ I\"\n by (auto intro: da_Init [simplified] assigned.select_convs)\n from da obtain C where\n da_c: \"\\prg=G,cls=accC,lcl=L\\\\ (dom (locals (store s0)))\\\\c\\\\<^sub>s\\ C\" and\n jmpOk: \"jumpNestingOkS {Ret} c\" \n by cases simp\n from eval obtain s1 s2 s3 where\n eval_init: \"G\\s0 \\Init D\\n\\ s1\" and\n eval_c: \"G\\s1 \\c\\n\\ s2\" and\n v: \"v = the (locals (store s2) Result)\" and\n s3: \"s3 =(if \\l. abrupt s2 = Some (Jump (Break l)) \\ \n abrupt s2 = Some (Jump (Cont l))\n then abupd (\\x. Some (Error CrossMethodJump)) s2 else s2)\"and\n s4: \"s4 = abupd (absorb Ret) s3\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n obtain C' where \n da_c': \"\\prg=G,cls=accC,lcl=L\\\\ (dom (locals (store s1)))\\\\c\\\\<^sub>s\\ C'\"\n proof -\n from eval_init \n have \"(dom (locals (store s0))) \\ (dom (locals (store s1)))\"\n by (rule dom_locals_evaln_mono_elim)\n with da_c show thesis by (rule da_weakenE) (rule that)\n qed\n from valid_init P valid_A conf_s0 eval_init wt_init da_init\n obtain Q: \"Q \\ s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n from valid_c Q valid_A conf_s1 eval_c wt_c da_c' \n have R: \"(\\s.. abupd (absorb Ret) .; R\\In1 (the (locals s Result))) \n \\ s2 Z\"\n by (rule validE)\n have \"s3=s2\"\n proof -\n from eval_init [THEN evaln_eval] wf\n have s1_no_jmp: \"\\ j. abrupt s1 \\ Some (Jump j)\"\n by - (rule eval_statement_no_jump [OF _ _ _ wt_init],\n insert normal_s0,auto)\n from eval_c [THEN evaln_eval] _ wt_c wf\n have \"\\ j. abrupt s2 = Some (Jump j) \\ j=Ret\"\n by (rule jumpNestingOk_evalE) (auto intro: jmpOk simp add: s1_no_jmp)\n moreover note s3\n ultimately show ?thesis \n by (force split: split_if)\n qed\n with R v s4 \n have \"R \\v\\\\<^sub>e s4 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s4\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Nil A P)\n show \"G,A|\\\\{ {Normal (P\\\\[]\\\\<^sub>l)} []\\\\ {P} }\"\n proof (rule valid_expr_list_NormalI)\n fix s0 s1 vs n L Y Z\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume eval: \"G\\s0 \\[]\\\\vs\\n\\ s1\"\n assume P: \"(Normal (P\\\\[]\\\\<^sub>l)) Y s0 Z\"\n show \"P \\vs\\\\<^sub>l s1 Z \\ s1\\\\(G, L)\"\n proof -\n from eval obtain \"vs=[]\" \"s1=s0\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n with P conf_s0 show ?thesis\n by simp\n qed\n qed\nnext\n case (Cons A P e Q es R)\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ {Q} }`\n have valid_es: \"\\ v. G,A|\\\\{ {Q\\\\v\\\\<^sub>e} es\\\\ {\\Vals:vs:. R\\\\(v # vs)\\\\<^sub>l} }\"\n using Cons.hyps by simp\n show \"G,A|\\\\{ {Normal P} e # es\\\\ {R} }\"\n proof (rule valid_expr_list_NormalI)\n fix n s0 L accC T E v s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\e # es\\\\T\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\e # es\\\\<^sub>l\\ E\"\n assume eval: \"G\\s0 \\e # es\\\\v\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\v\\\\<^sub>l s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain eT esT where\n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-eT\" and\n wt_es: \"\\prg=G,cls=accC,lcl=L\\\\es\\\\esT\"\n by cases simp\n from da obtain E1 where\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ (dom (locals (store s0)))\\\\e\\\\<^sub>e\\ E1\" and\n da_es: \"\\prg=G,cls=accC,lcl=L\\\\ nrm E1 \\\\es\\\\<^sub>l\\ E\" \n by cases simp\n from eval obtain s1 ve vs where\n eval_e: \"G\\s0 \\e-\\ve\\n\\ s1\" and\n eval_es: \"G\\s1 \\es\\\\vs\\n\\ s2\" and\n v: \"v=ve#vs\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e \n obtain Q: \"Q \\ve\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n from Q have Q': \"\\ v. (Q\\\\ve\\\\<^sub>e) v s1 Z\"\n by simp\n have \"(\\Vals:vs:. R\\\\(ve # vs)\\\\<^sub>l) \\vs\\\\<^sub>l s2 Z\"\n proof (cases \"normal s1\")\n case True\n obtain E' where \n da_es': \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\es\\\\<^sub>l\\ E'\"\n proof -\n from eval_e wt_e da_e wf True\n have \"nrm E1 \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_es show thesis\n by (rule da_weakenE) (rule that)\n qed\n from valid_es Q' valid_A conf_s1 eval_es wt_es da_es'\n show ?thesis\n by (rule validE)\n next\n case False\n with valid_es Q' valid_A conf_s1 eval_es \n show ?thesis\n by (cases rule: validE) iprover+\n qed\n with v have \"R \\v\\\\<^sub>l s2 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Skip A P)\n show \"G,A|\\\\{ {Normal (P\\\\)} .Skip. {P} }\"\n proof (rule valid_stmt_NormalI)\n fix s0 s1 n L Y Z\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume eval: \"G\\s0 \\Skip\\n\\ s1\"\n assume P: \"(Normal (P\\\\)) Y s0 Z\"\n show \"P \\ s1 Z \\ s1\\\\(G, L)\"\n proof -\n from eval obtain \"s1=s0\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n with P conf_s0 show ?thesis\n by simp\n qed\n qed\nnext\n case (Expr A P e Q)\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ {Q\\\\} }`\n show \"G,A|\\\\{ {Normal P} .Expr e. {Q} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Expr e\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\Expr e\\\\<^sub>s\\ C\"\n assume eval: \"G\\s0 \\Expr e\\n\\ s1\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\ s1 Z \\ s1\\\\(G, L)\"\n proof -\n from wt obtain eT where \n wt_e: \"\\prg = G, cls = accC, lcl = L\\\\e\\-eT\"\n by cases simp\n from da obtain E where\n da_e: \"\\prg=G,cls=accC, lcl=L\\\\dom (locals (store s0))\\\\e\\\\<^sub>e\\E\"\n by cases simp\n from eval obtain v where\n eval_e: \"G\\s0 \\e-\\v\\n\\ s1\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e\n obtain Q: \"(Q\\\\) \\v\\\\<^sub>e s1 Z\" and \"s1\\\\(G,L)\"\n by (rule validE)\n thus ?thesis by simp\n qed\n qed\nnext\n case (Lab A P c l Q)\n note valid_c = `G,A|\\\\{ {Normal P} .c. {abupd (absorb l) .; Q} }`\n show \"G,A|\\\\{ {Normal P} .l\\ c. {Q} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\l\\ c\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0)) \\\\l\\ c\\\\<^sub>s\\ C\"\n assume eval: \"G\\s0 \\l\\ c\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\ s2 Z \\ s2\\\\(G, L)\"\n proof -\n from wt obtain \n wt_c: \"\\prg = G, cls = accC, lcl = L\\\\c\\\\\"\n by cases simp\n from da obtain E where\n da_c: \"\\prg=G,cls=accC, lcl=L\\\\dom (locals (store s0))\\\\c\\\\<^sub>s\\E\"\n by cases simp\n from eval obtain s1 where\n eval_c: \"G\\s0 \\c\\n\\ s1\" and\n s2: \"s2 = abupd (absorb l) s1\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from valid_c P valid_A conf_s0 eval_c wt_c da_c\n obtain Q: \"(abupd (absorb l) .; Q) \\ s1 Z\" \n by (rule validE)\n with s2 have \"Q \\ s2 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Comp A P c1 Q c2 R)\n note valid_c1 = `G,A|\\\\{ {Normal P} .c1. {Q} }`\n note valid_c2 = `G,A|\\\\{ {Q} .c2. {R} }`\n show \"G,A|\\\\{ {Normal P} .c1;; c2. {R} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\(c1;; c2)\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\\dom (locals (store s0))\\\\c1;;c2\\\\<^sub>s\\C\"\n assume eval: \"G\\s0 \\c1;; c2\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\ s2 Z \\ s2\\\\(G,L)\"\n proof -\n from eval obtain s1 where\n eval_c1: \"G\\s0 \\c1 \\n\\ s1\" and\n eval_c2: \"G\\s1 \\c2 \\n\\ s2\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from wt obtain \n wt_c1: \"\\prg = G, cls = accC, lcl = L\\\\c1\\\\\" and\n wt_c2: \"\\prg = G, cls = accC, lcl = L\\\\c2\\\\\"\n by cases simp\n from da obtain C1 C2 where \n da_c1: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\c1\\\\<^sub>s\\ C1\" and \n da_c2: \"\\prg=G,cls=accC,lcl=L\\\\nrm C1 \\\\c2\\\\<^sub>s\\ C2\" \n by cases simp\n from valid_c1 P valid_A conf_s0 eval_c1 wt_c1 da_c1 \n obtain Q: \"Q \\ s1 Z\" and conf_s1: \"s1\\\\(G,L)\" \n by (rule validE) \n have \"R \\ s2 Z\"\n proof (cases \"normal s1\")\n case True\n obtain C2' where \n \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s1)) \\\\c2\\\\<^sub>s\\ C2'\"\n proof -\n from eval_c1 wt_c1 da_c1 wf True\n have \"nrm C1 \\ dom (locals (store s1))\"\n by (cases rule: da_good_approx_evalnE) iprover\n with da_c2 show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_c2 Q valid_A conf_s1 eval_c2 wt_c2 \n show ?thesis\n by (rule validE)\n next\n case False\n from valid_c2 Q valid_A conf_s1 eval_c2 False\n show ?thesis\n by (cases rule: validE) iprover+\n qed\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (If A P e P' c1 c2 Q)\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ {P'} }`\n have valid_then_else: \"\\ b. G,A|\\\\{ {P'\\=b} .(if b then c1 else c2). {Q} }\"\n using If.hyps by simp\n show \"G,A|\\\\{ {Normal P} .If(e) c1 Else c2. {Q} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\If(e) c1 Else c2\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0))\\\\If(e) c1 Else c2\\\\<^sub>s\\C\"\n assume eval: \"G\\s0 \\If(e) c1 Else c2\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\ s2 Z \\ s2\\\\(G,L)\"\n proof -\n from eval obtain b s1 where\n eval_e: \"G\\s0 \\e-\\b\\n\\ s1\" and\n eval_then_else: \"G\\s1 \\(if the_Bool b then c1 else c2)\\n\\ s2\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n from wt obtain \n wt_e: \"\\prg=G, cls=accC, lcl=L\\\\e\\-PrimT Boolean\" and\n wt_then_else: \"\\prg=G,cls=accC,lcl=L\\\\(if the_Bool b then c1 else c2)\\\\\"\n by cases (simp split: split_if)\n from da obtain E S where\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\" and\n da_then_else: \n \"\\prg=G,cls=accC,lcl=L\\\\ \n (dom (locals (store s0)) \\ assigns_if (the_Bool b) e)\n \\\\if the_Bool b then c1 else c2\\\\<^sub>s\\ S\"\n by cases (cases \"the_Bool b\",auto)\n from valid_e P valid_A conf_s0 eval_e wt_e da_e\n obtain \"P' \\b\\\\<^sub>e s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n hence P': \"\\v. (P'\\=the_Bool b) v s1 Z\"\n by (cases \"normal s1\") auto\n have \"Q \\ s2 Z\"\n proof (cases \"normal s1\")\n case True\n have s0_s1: \"dom (locals (store s0)) \n \\ assigns_if (the_Bool b) e \\ dom (locals (store s1))\"\n proof -\n from eval_e \n have eval_e': \"G\\s0 \\e-\\b\\ s1\"\n by (rule evaln_eval)\n hence\n \"dom (locals (store s0)) \\ dom (locals (store s1))\"\n by (rule dom_locals_eval_mono_elim)\n moreover\n from eval_e' True wt_e\n have \"assigns_if (the_Bool b) e \\ dom (locals (store s1))\"\n by (rule assigns_if_good_approx') \n ultimately show ?thesis by (rule Un_least)\n qed\n with da_then_else\n obtain S' where\n \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s1))\\\\if the_Bool b then c1 else c2\\\\<^sub>s\\ S'\"\n by (rule da_weakenE)\n with valid_then_else P' valid_A conf_s1 eval_then_else wt_then_else\n show ?thesis\n by (rule validE)\n next\n case False\n with valid_then_else P' valid_A conf_s1 eval_then_else\n show ?thesis\n by (cases rule: validE) iprover+\n qed\n moreover\n from eval wt da conf_s0 wf\n have \"s2\\\\(G, L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Loop A P e P' c l)\n note valid_e = `G,A|\\\\{ {P} e-\\ {P'} }`\n note valid_c = `G,A|\\\\{ {Normal (P'\\=True)}\n .c. \n {abupd (absorb (Cont l)) .; P} }`\n show \"G,A|\\\\{ {P} .l\\ While(e) c. {P'\\=False\\=\\} }\"\n proof (rule valid_stmtI)\n fix n s0 L accC C s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume wt: \"normal s0 \\ \\prg=G,cls=accC,lcl=L\\\\l\\ While(e) c\\\\\"\n assume da: \"normal s0 \\ \\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store s0)) \\\\l\\ While(e) c\\\\<^sub>s\\ C\"\n assume eval: \"G\\s0 \\l\\ While(e) c\\n\\ s3\"\n assume P: \"P Y s0 Z\"\n show \"(P'\\=False\\=\\) \\ s3 Z \\ s3\\\\(G,L)\"\n proof -\n --{* From the given hypothesises @{text valid_e} and @{text valid_c} \n we can only reach the state after unfolding the loop once, i.e. \n @{term \"P \\ s2 Z\"}, where @{term s2} is the state after executing\n @{term c}. To gain validity of the further execution of while, to\n finally get @{term \"(P'\\=False\\=\\) \\ s3 Z\"} we have to get \n a hypothesis about the subsequent unfoldings (the whole loop again),\n too. We can achieve this, by performing induction on the \n evaluation relation, with all\n the necessary preconditions to apply @{text valid_e} and \n @{text valid_c} in the goal.\n *}\n {\n fix t s s' v \n assume \"G\\s \\t\\\\n\\ (v, s')\"\n hence \"\\ Y' T E. \n \\t = \\l\\ While(e) c\\\\<^sub>s; \\t\\A. G\\n\\t; P Y' s Z; s\\\\(G, L);\n normal s \\ \\prg=G,cls=accC,lcl=L\\\\t\\T; \n normal s \\ \\prg=G,cls=accC,lcl=L\\\\dom (locals (store s))\\t\\E\n \\\\ (P'\\=False\\=\\) v s' Z\"\n (is \"PROP ?Hyp n t s v s'\")\n proof (induct)\n case (Loop s0' e' b n' s1' c' s2' l' s3' Y' T E)\n note while = `(\\l'\\ While(e') c'\\\\<^sub>s::term) = \\l\\ While(e) c\\\\<^sub>s`\n hence eqs: \"l'=l\" \"e'=e\" \"c'=c\" by simp_all\n note valid_A = `\\t\\A. G\\n'\\t`\n note P = `P Y' (Norm s0') Z`\n note conf_s0' = `Norm s0'\\\\(G, L)`\n have wt: \"\\prg=G,cls=accC,lcl=L\\\\\\l\\ While(e) c\\\\<^sub>s\\T\"\n using Loop.prems eqs by simp\n have da: \"\\prg=G,cls=accC,lcl=L\\\\\n dom (locals (store ((Norm s0')::state)))\\\\l\\ While(e) c\\\\<^sub>s\\E\"\n using Loop.prems eqs by simp\n have evaln_e: \"G\\Norm s0' \\e-\\b\\n'\\ s1'\" \n using Loop.hyps eqs by simp\n show \"(P'\\=False\\=\\) \\ s3' Z\"\n proof -\n from wt obtain \n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-PrimT Boolean\" and\n wt_c: \"\\prg=G,cls=accC,lcl=L\\\\c\\\\\"\n by cases (simp add: eqs)\n from da obtain E S where\n da_e: \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store ((Norm s0')::state))) \\\\e\\\\<^sub>e\\ E\" and\n da_c: \"\\prg=G,cls=accC,lcl=L\\\n \\ (dom (locals (store ((Norm s0')::state))) \n \\ assigns_if True e) \\\\c\\\\<^sub>s\\ S\"\n by cases (simp add: eqs)\n from evaln_e \n have eval_e: \"G\\Norm s0' \\e-\\b\\ s1'\"\n by (rule evaln_eval)\n from valid_e P valid_A conf_s0' evaln_e wt_e da_e\n obtain P': \"P' \\b\\\\<^sub>e s1' Z\" and conf_s1': \"s1'\\\\(G,L)\"\n by (rule validE)\n show \"(P'\\=False\\=\\) \\ s3' Z\"\n proof (cases \"normal s1'\")\n case True\n note normal_s1'=this\n show ?thesis\n proof (cases \"the_Bool b\")\n case True\n with P' normal_s1' have P'': \"(Normal (P'\\=True)) \\b\\\\<^sub>e s1' Z\"\n by auto\n from True Loop.hyps obtain\n eval_c: \"G\\s1' \\c\\n'\\ s2'\" and \n eval_while: \n \"G\\abupd (absorb (Cont l)) s2' \\l\\ While(e) c\\n'\\ s3'\"\n by (simp add: eqs)\n from True Loop.hyps have\n hyp: \"PROP ?Hyp n' \\l\\ While(e) c\\\\<^sub>s \n (abupd (absorb (Cont l')) s2') \\ s3'\"\n apply (simp only: True if_True eqs)\n apply (elim conjE)\n apply (tactic \"smp_tac @{context} 3 1\")\n apply fast\n done\n from eval_e\n have s0'_s1': \"dom (locals (store ((Norm s0')::state))) \n \\ dom (locals (store s1'))\"\n by (rule dom_locals_eval_mono_elim)\n obtain S' where\n da_c':\n \"\\prg=G,cls=accC,lcl=L\\\\(dom (locals (store s1')))\\\\c\\\\<^sub>s\\ S'\" \n proof -\n note s0'_s1'\n moreover\n from eval_e normal_s1' wt_e \n have \"assigns_if True e \\ dom (locals (store s1'))\"\n by (rule assigns_if_good_approx' [elim_format]) \n (simp add: True)\n ultimately \n have \"dom (locals (store ((Norm s0')::state)))\n \\ assigns_if True e \\ dom (locals (store s1'))\"\n by (rule Un_least)\n with da_c show thesis\n by (rule da_weakenE) (rule that)\n qed\n with valid_c P'' valid_A conf_s1' eval_c wt_c\n obtain \"(abupd (absorb (Cont l)) .; P) \\ s2' Z\" and \n conf_s2': \"s2'\\\\(G,L)\"\n by (rule validE)\n hence P_s2': \"P \\ (abupd (absorb (Cont l)) s2') Z\"\n by simp\n from conf_s2'\n have conf_absorb: \"abupd (absorb (Cont l)) s2' \\\\(G, L)\"\n by (cases s2') (auto intro: conforms_absorb)\n moreover\n obtain E' where \n da_while':\n \"\\prg=G,cls=accC,lcl=L\\\\ \n dom (locals(store (abupd (absorb (Cont l)) s2')))\n \\\\l\\ While(e) c\\\\<^sub>s\\ E'\"\n proof -\n note s0'_s1'\n also \n from eval_c \n have \"G\\s1' \\c\\ s2'\"\n by (rule evaln_eval)\n hence \"dom (locals (store s1')) \\ dom (locals (store s2'))\"\n by (rule dom_locals_eval_mono_elim)\n also \n have \"\\\\dom (locals (store (abupd (absorb (Cont l)) s2')))\"\n by simp\n finally\n have \"dom (locals (store ((Norm s0')::state))) \\ \\\" .\n with da show thesis\n by (rule da_weakenE) (rule that)\n qed\n from valid_A P_s2' conf_absorb wt da_while'\n show \"(P'\\=False\\=\\) \\ s3' Z\" \n using hyp by (simp add: eqs)\n next\n case False\n with Loop.hyps obtain \"s3'=s1'\"\n by simp\n with P' False show ?thesis\n by auto\n qed \n next\n case False\n note abnormal_s1'=this\n have \"s3'=s1'\"\n proof -\n from False obtain abr where abr: \"abrupt s1' = Some abr\"\n by (cases s1') auto\n from eval_e _ wt_e wf\n have no_jmp: \"\\ j. abrupt s1' \\ Some (Jump j)\"\n by (rule eval_expression_no_jump \n [where ?Env=\"\\prg=G,cls=accC,lcl=L\\\",simplified])\n simp\n show ?thesis\n proof (cases \"the_Bool b\")\n case True \n with Loop.hyps obtain\n eval_c: \"G\\s1' \\c\\n'\\ s2'\" and \n eval_while: \n \"G\\abupd (absorb (Cont l)) s2' \\l\\ While(e) c\\n'\\ s3'\"\n by (simp add: eqs)\n from eval_c abr have \"s2'=s1'\" by auto\n moreover from calculation no_jmp \n have \"abupd (absorb (Cont l)) s2'=s2'\"\n by (cases s1') (simp add: absorb_def)\n ultimately show ?thesis\n using eval_while abr\n by auto\n next\n case False\n with Loop.hyps show ?thesis by simp\n qed\n qed\n with P' False show ?thesis\n by auto\n qed\n qed\n next\n case (Abrupt abr s t' n' Y' T E)\n note t' = `t' = \\l\\ While(e) c\\\\<^sub>s`\n note conf = `(Some abr, s)\\\\(G, L)`\n note P = `P Y' (Some abr, s) Z`\n note valid_A = `\\t\\A. G\\n'\\t`\n show \"(P'\\=False\\=\\) (undefined3 t') (Some abr, s) Z\"\n proof -\n have eval_e: \n \"G\\(Some abr,s) \\\\e\\\\<^sub>e\\\\n'\\ (undefined3 \\e\\\\<^sub>e,(Some abr,s))\"\n by auto\n from valid_e P valid_A conf eval_e \n have \"P' (undefined3 \\e\\\\<^sub>e) (Some abr,s) Z\"\n by (cases rule: validE [where ?P=\"P\"]) simp+\n with t' show ?thesis\n by auto\n qed\n qed simp_all\n } note generalized=this\n from eval _ valid_A P conf_s0 wt da\n have \"(P'\\=False\\=\\) \\ s3 Z\"\n by (rule generalized) simp_all\n moreover\n have \"s3\\\\(G, L)\"\n proof (cases \"normal s0\")\n case True\n from eval wt [OF True] da [OF True] conf_s0 wf\n show ?thesis\n by (rule evaln_type_sound [elim_format]) simp\n next\n case False\n with eval have \"s3=s0\"\n by auto\n with conf_s0 show ?thesis \n by simp\n qed\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Jmp A j P)\n show \"G,A|\\\\{ {Normal (abupd (\\a. Some (Jump j)) .; P\\\\)} .Jmp j. {P} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s1 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Jmp j\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0))\\\\Jmp j\\\\<^sub>s\\C\"\n assume eval: \"G\\s0 \\Jmp j\\n\\ s1\"\n assume P: \"(Normal (abupd (\\a. Some (Jump j)) .; P\\\\)) Y s0 Z\"\n show \"P \\ s1 Z \\ s1\\\\(G,L)\"\n proof -\n from eval obtain s where \n s: \"s0=Norm s\" \"s1=(Some (Jump j), s)\" \n using normal_s0 by (auto elim: evaln_elim_cases)\n with P have \"P \\ s1 Z\"\n by simp\n moreover \n from eval wt da conf_s0 wf\n have \"s1\\\\(G,L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Throw A P e Q)\n note valid_e = `G,A|\\\\{ {Normal P} e-\\ {\\Val:a:. abupd (throw a) .; Q\\\\} }`\n show \"G,A|\\\\{ {Normal P} .Throw e. {Q} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC C s2 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Throw e\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0))\\\\Throw e\\\\<^sub>s\\C\"\n assume eval: \"G\\s0 \\Throw e\\n\\ s2\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"Q \\ s2 Z \\ s2\\\\(G,L)\"\n proof -\n from eval obtain s1 a where\n eval_e: \"G\\s0 \\e-\\a\\n\\ s1\" and\n s2: \"s2 = abupd (throw a) s1\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n from wt obtain T where\n wt_e: \"\\prg=G,cls=accC,lcl=L\\\\e\\-T\"\n by cases simp\n from da obtain E where\n da_e: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\e\\\\<^sub>e\\ E\"\n by cases simp\n from valid_e P valid_A conf_s0 eval_e wt_e da_e \n obtain \"(\\Val:a:. abupd (throw a) .; Q\\\\) \\a\\\\<^sub>e s1 Z\"\n by (rule validE)\n with s2 have \"Q \\ s2 Z\"\n by simp\n moreover \n from eval wt da conf_s0 wf\n have \"s2\\\\(G,L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Try A P c1 Q C vn c2 R)\n note valid_c1 = `G,A|\\\\{ {Normal P} .c1. {SXAlloc G Q} }`\n note valid_c2 = `G,A|\\\\{ {Q \\. (\\s. G,s\\catch C) ;. new_xcpt_var vn} \n .c2. \n {R} }`\n note Q_R = `(Q \\. (\\s. \\ G,s\\catch C)) \\ R`\n show \"G,A|\\\\{ {Normal P} .Try c1 Catch(C vn) c2. {R} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC E s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Try c1 Catch(C vn) c2\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0)) \\\\Try c1 Catch(C vn) c2\\\\<^sub>s\\ E\"\n assume eval: \"G\\s0 \\Try c1 Catch(C vn) c2\\n\\ s3\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\ s3 Z \\ s3\\\\(G,L)\"\n proof -\n from eval obtain s1 s2 where\n eval_c1: \"G\\s0 \\c1\\n\\ s1\" and\n sxalloc: \"G\\s1 \\sxalloc\\ s2\" and\n s3: \"if G,s2\\catch C \n then G\\new_xcpt_var vn s2 \\c2\\n\\ s3 \n else s3 = s2\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from wt obtain\n wt_c1: \"\\prg=G,cls=accC,lcl=L\\\\c1\\\\\" and\n wt_c2: \"\\prg=G,cls=accC,lcl=L(VName vn\\Class C)\\\\c2\\\\\"\n by cases simp\n from da obtain C1 C2 where\n da_c1: \"\\prg=G,cls=accC,lcl=L\\\\ dom (locals (store s0)) \\\\c1\\\\<^sub>s\\ C1\" and\n da_c2: \"\\prg=G,cls=accC,lcl=L(VName vn\\Class C)\\\n \\ (dom (locals (store s0)) \\ {VName vn}) \\\\c2\\\\<^sub>s\\ C2\"\n by cases simp\n from valid_c1 P valid_A conf_s0 eval_c1 wt_c1 da_c1\n obtain sxQ: \"(SXAlloc G Q) \\ s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n from sxalloc sxQ\n have Q: \"Q \\ s2 Z\"\n by auto\n have \"R \\ s3 Z\"\n proof (cases \"\\ x. abrupt s1 = Some (Xcpt x)\")\n case False\n from sxalloc wf\n have \"s2=s1\"\n by (rule sxalloc_type_sound [elim_format])\n (insert False, auto split: option.splits abrupt.splits )\n with False \n have no_catch: \"\\ G,s2\\catch C\"\n by (simp add: catch_def)\n moreover\n from no_catch s3\n have \"s3=s2\"\n by simp\n ultimately show ?thesis\n using Q Q_R by simp\n next\n case True\n note exception_s1 = this\n show ?thesis\n proof (cases \"G,s2\\catch C\") \n case False\n with s3\n have \"s3=s2\"\n by simp\n with False Q Q_R show ?thesis\n by simp\n next\n case True\n with s3 have eval_c2: \"G\\new_xcpt_var vn s2 \\c2\\n\\ s3\"\n by simp\n from conf_s1 sxalloc wf \n have conf_s2: \"s2\\\\(G, L)\" \n by (auto dest: sxalloc_type_sound \n split: option.splits abrupt.splits)\n from exception_s1 sxalloc wf\n obtain a \n where xcpt_s2: \"abrupt s2 = Some (Xcpt (Loc a))\"\n by (auto dest!: sxalloc_type_sound \n split: option.splits abrupt.splits)\n with True\n have \"G\\obj_ty (the (globs (store s2) (Heap a)))\\Class C\"\n by (cases s2) simp\n with xcpt_s2 conf_s2 wf\n have conf_new_xcpt: \"new_xcpt_var vn s2 \\\\(G, L(VName vn\\Class C))\"\n by (auto dest: Try_lemma)\n obtain C2' where\n da_c2':\n \"\\prg=G,cls=accC,lcl=L(VName vn\\Class C)\\\n \\ (dom (locals (store (new_xcpt_var vn s2)))) \\\\c2\\\\<^sub>s\\ C2'\"\n proof -\n have \"(dom (locals (store s0)) \\ {VName vn}) \n \\ dom (locals (store (new_xcpt_var vn s2)))\"\n proof -\n from eval_c1 \n have \"dom (locals (store s0)) \n \\ dom (locals (store s1))\"\n by (rule dom_locals_evaln_mono_elim)\n also\n from sxalloc\n have \"\\ \\ dom (locals (store s2))\"\n by (rule dom_locals_sxalloc_mono)\n also \n have \"\\ \\ dom (locals (store (new_xcpt_var vn s2)))\" \n by (cases s2) (simp add: new_xcpt_var_def, blast) \n also\n have \"{VName vn} \\ \\\"\n by (cases s2) simp\n ultimately show ?thesis\n by (rule Un_least)\n qed\n with da_c2 show thesis\n by (rule da_weakenE) (rule that)\n qed\n from Q eval_c2 True \n have \"(Q \\. (\\s. G,s\\catch C) ;. new_xcpt_var vn) \n \\ (new_xcpt_var vn s2) Z\"\n by auto\n from valid_c2 this valid_A conf_new_xcpt eval_c2 wt_c2 da_c2'\n show \"R \\ s3 Z\"\n by (rule validE)\n qed\n qed\n moreover \n from eval wt da conf_s0 wf\n have \"s3\\\\(G,L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Fin A P c1 Q c2 R)\n note valid_c1 = `G,A|\\\\{ {Normal P} .c1. {Q} }`\n have valid_c2: \"\\ abr. G,A|\\\\{ {Q \\. (\\s. abr = fst s) ;. abupd (\\x. None)} \n .c2.\n {abupd (abrupt_if (abr \\ None) abr) .; R} }\"\n using Fin.hyps by simp\n show \"G,A|\\\\{ {Normal P} .c1 Finally c2. {R} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC E s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\c1 Finally c2\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0)) \\\\c1 Finally c2\\\\<^sub>s\\ E\"\n assume eval: \"G\\s0 \\c1 Finally c2\\n\\ s3\"\n assume P: \"(Normal P) Y s0 Z\"\n show \"R \\ s3 Z \\ s3\\\\(G,L)\"\n proof -\n from eval obtain s1 abr1 s2 where\n eval_c1: \"G\\s0 \\c1\\n\\ (abr1, s1)\" and\n eval_c2: \"G\\Norm s1 \\c2\\n\\ s2\" and\n s3: \"s3 = (if \\err. abr1 = Some (Error err) \n then (abr1, s1)\n else abupd (abrupt_if (abr1 \\ None) abr1) s2)\"\n using normal_s0 by (fastforce elim: evaln_elim_cases)\n from wt obtain\n wt_c1: \"\\prg=G,cls=accC,lcl=L\\\\c1\\\\\" and\n wt_c2: \"\\prg=G,cls=accC,lcl=L\\\\c2\\\\\"\n by cases simp\n from da obtain C1 C2 where\n da_c1: \"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\c1\\\\<^sub>s\\ C1\" and\n da_c2: \"\\prg=G,cls=accC,lcl=L\\ \\ dom (locals (store s0)) \\\\c2\\\\<^sub>s\\ C2\"\n by cases simp\n from valid_c1 P valid_A conf_s0 eval_c1 wt_c1 da_c1\n obtain Q: \"Q \\ (abr1,s1) Z\" and conf_s1: \"(abr1,s1)\\\\(G,L)\" \n by (rule validE)\n from Q \n have Q': \"(Q \\. (\\s. abr1 = fst s) ;. abupd (\\x. None)) \\ (Norm s1) Z\"\n by auto\n from eval_c1 wt_c1 da_c1 conf_s0 wf\n have \"error_free (abr1,s1)\"\n by (rule evaln_type_sound [elim_format]) (insert normal_s0,simp)\n with s3 have s3': \"s3 = abupd (abrupt_if (abr1 \\ None) abr1) s2\"\n by (simp add: error_free_def)\n from conf_s1 \n have conf_Norm_s1: \"Norm s1\\\\(G,L)\"\n by (rule conforms_NormI)\n obtain C2' where \n da_c2': \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store ((Norm s1)::state))) \\\\c2\\\\<^sub>s\\ C2'\"\n proof -\n from eval_c1 \n have \"dom (locals (store s0)) \\ dom (locals (store (abr1,s1)))\"\n by (rule dom_locals_evaln_mono_elim)\n hence \"dom (locals (store s0)) \n \\ dom (locals (store ((Norm s1)::state)))\"\n by simp\n with da_c2 show thesis\n by (rule da_weakenE) (rule that)\n qed\n from valid_c2 Q' valid_A conf_Norm_s1 eval_c2 wt_c2 da_c2'\n have \"(abupd (abrupt_if (abr1 \\ None) abr1) .; R) \\ s2 Z\"\n by (rule validE)\n with s3' have \"R \\ s3 Z\"\n by simp\n moreover\n from eval wt da conf_s0 wf\n have \"s3\\\\(G,L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (Done A P C)\n show \"G,A|\\\\{ {Normal (P\\\\ \\. initd C)} .Init C. {P} }\" \n proof (rule valid_stmt_NormalI)\n fix n s0 L accC E s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Init C\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0)) \\\\Init C\\\\<^sub>s\\ E\"\n assume eval: \"G\\s0 \\Init C\\n\\ s3\"\n assume P: \"(Normal (P\\\\ \\. initd C)) Y s0 Z\"\n show \"P \\ s3 Z \\ s3\\\\(G,L)\"\n proof -\n from P have inited: \"inited C (globs (store s0))\"\n by simp\n with eval have \"s3=s0\"\n using normal_s0 by (auto elim: evaln_elim_cases)\n with P conf_s0 show ?thesis\n by simp\n qed\n qed\nnext\n case (Init C c A P Q R)\n note c = `the (class G C) = c`\n note valid_super =\n `G,A|\\\\{ {Normal (P \\. Not \\ initd C ;. supd (init_class_obj G C))}\n .(if C = Object then Skip else Init (super c)). \n {Q} }`\n have valid_init: \n \"\\ l. G,A|\\\\{ {Q \\. (\\s. l = locals (snd s)) ;. set_lvars empty} \n .init c.\n {set_lvars l .; R} }\"\n using Init.hyps by simp\n show \"G,A|\\\\{ {Normal (P \\. Not \\ initd C)} .Init C. {R} }\"\n proof (rule valid_stmt_NormalI)\n fix n s0 L accC E s3 Y Z\n assume valid_A: \"\\t\\A. G\\n\\t\"\n assume conf_s0: \"s0\\\\(G,L)\" \n assume normal_s0: \"normal s0\"\n assume wt: \"\\prg=G,cls=accC,lcl=L\\\\Init C\\\\\"\n assume da: \"\\prg=G,cls=accC,lcl=L\\\n \\dom (locals (store s0)) \\\\Init C\\\\<^sub>s\\ E\"\n assume eval: \"G\\s0 \\Init C\\n\\ s3\"\n assume P: \"(Normal (P \\. Not \\ initd C)) Y s0 Z\"\n show \"R \\ s3 Z \\ s3\\\\(G,L)\"\n proof -\n from P have not_inited: \"\\ inited C (globs (store s0))\" by simp\n with eval c obtain s1 s2 where\n eval_super: \n \"G\\Norm ((init_class_obj G C) (store s0)) \n \\(if C = Object then Skip else Init (super c))\\n\\ s1\" and\n eval_init: \"G\\(set_lvars empty) s1 \\init c\\n\\ s2\" and\n s3: \"s3 = (set_lvars (locals (store s1))) s2\"\n using normal_s0 by (auto elim!: evaln_elim_cases)\n from wt c have\n cls_C: \"class G C = Some c\"\n by cases auto\n from wf cls_C have\n wt_super: \"\\prg=G,cls=accC,lcl=L\\\n \\(if C = Object then Skip else Init (super c))\\\\\"\n by (cases \"C=Object\")\n (auto dest: wf_prog_cdecl wf_cdecl_supD is_acc_classD)\n obtain S where\n da_super:\n \"\\prg=G,cls=accC,lcl=L\\\n \\ dom (locals (store ((Norm \n ((init_class_obj G C) (store s0)))::state))) \n \\\\if C = Object then Skip else Init (super c)\\\\<^sub>s\\ S\"\n proof (cases \"C=Object\")\n case True \n with da_Skip show ?thesis\n using that by (auto intro: assigned.select_convs)\n next\n case False \n with da_Init show ?thesis\n by - (rule that, auto intro: assigned.select_convs)\n qed\n from normal_s0 conf_s0 wf cls_C not_inited\n have conf_init_cls: \"(Norm ((init_class_obj G C) (store s0)))\\\\(G, L)\"\n by (auto intro: conforms_init_class_obj) \n from P \n have P': \"(Normal (P \\. Not \\ initd C ;. supd (init_class_obj G C)))\n Y (Norm ((init_class_obj G C) (store s0))) Z\"\n by auto\n\n from valid_super P' valid_A conf_init_cls eval_super wt_super da_super\n obtain Q: \"Q \\ s1 Z\" and conf_s1: \"s1\\\\(G,L)\"\n by (rule validE)\n \n from cls_C wf have wt_init: \"\\prg=G, cls=C,lcl=empty\\\\(init c)\\\\\"\n by (rule wf_prog_cdecl [THEN wf_cdecl_wt_init])\n from cls_C wf obtain I where \n \"\\prg=G,cls=C,lcl=empty\\\\ {} \\\\init c\\\\<^sub>s\\ I\"\n by (rule wf_prog_cdecl [THEN wf_cdeclE,simplified]) blast\n (* simplified: to rewrite \\init c\\ to In1r (init c) *) \n then obtain I' where\n da_init:\n \"\\prg=G,cls=C,lcl=empty\\\\dom (locals (store ((set_lvars empty) s1))) \n \\\\init c\\\\<^sub>s\\ I'\"\n by (rule da_weakenE) simp\n have conf_s1_empty: \"(set_lvars empty) s1\\\\(G, empty)\"\n proof -\n from eval_super have\n \"G\\Norm ((init_class_obj G C) (store s0)) \n \\(if C = Object then Skip else Init (super c))\\ s1\"\n by (rule evaln_eval)\n from this wt_super wf\n have s1_no_ret: \"\\ j. abrupt s1 \\ Some (Jump j)\"\n by - (rule eval_statement_no_jump \n [where ?Env=\"\\prg=G,cls=accC,lcl=L\\\"], auto split: split_if)\n with conf_s1\n show ?thesis\n by (cases s1) (auto intro: conforms_set_locals)\n qed\n \n obtain l where l: \"l = locals (store s1)\"\n by simp\n with Q \n have Q': \"(Q \\. (\\s. l = locals (snd s)) ;. set_lvars empty)\n \\ ((set_lvars empty) s1) Z\"\n by auto\n from valid_init Q' valid_A conf_s1_empty eval_init wt_init da_init\n have \"(set_lvars l .; R) \\ s2 Z\"\n by (rule validE)\n with s3 l have \"R \\ s3 Z\"\n by simp\n moreover \n from eval wt da conf_s0 wf\n have \"s3\\\\(G,L)\"\n by (rule evaln_type_sound [elim_format]) simp\n ultimately show ?thesis ..\n qed\n qed\nnext\n case (InsInitV A P c v Q)\n show \"G,A|\\\\{ {Normal P} InsInitV c v=\\ {Q} }\"\n proof (rule valid_var_NormalI)\n fix s0 vf n s1 L Z\n assume \"normal s0\"\n moreover\n assume \"G\\s0 \\InsInitV c v=\\vf\\n\\ s1\"\n ultimately have \"False\" \n by (cases s0) (simp add: evaln_InsInitV) \n thus \"Q \\vf\\\\<^sub>v s1 Z \\ s1\\\\(G, L)\"..\n qed\nnext\n case (InsInitE A P c e Q)\n show \"G,A|\\\\{ {Normal P} InsInitE c e-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix s0 v n s1 L Z\n assume \"normal s0\"\n moreover\n assume \"G\\s0 \\InsInitE c e-\\v\\n\\ s1\"\n ultimately have \"False\" \n by (cases s0) (simp add: evaln_InsInitE) \n thus \"Q \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"..\n qed\nnext\n case (Callee A P l e Q)\n show \"G,A|\\\\{ {Normal P} Callee l e-\\ {Q} }\"\n proof (rule valid_expr_NormalI)\n fix s0 v n s1 L Z\n assume \"normal s0\"\n moreover\n assume \"G\\s0 \\Callee l e-\\v\\n\\ s1\"\n ultimately have \"False\" \n by (cases s0) (simp add: evaln_Callee) \n thus \"Q \\v\\\\<^sub>e s1 Z \\ s1\\\\(G, L)\"..\n qed\nnext\n case (FinA A P a c Q)\n show \"G,A|\\\\{ {Normal P} .FinA a c. {Q} }\"\n proof (rule valid_stmt_NormalI)\n fix s0 v n s1 L Z\n assume \"normal s0\"\n moreover\n assume \"G\\s0 \\FinA a c\\n\\ s1\"\n ultimately have \"False\" \n by (cases s0) (simp add: evaln_FinA) \n thus \"Q \\ s1 Z \\ s1\\\\(G, L)\"..\n qed\nqed\ndeclare inj_term_simps [simp del]\n \ntheorem ax_sound: \n \"wf_prog G \\ G,(A::'a triple set)|\\(ts::'a triple set) \\ G,A|\\ts\"\napply (subst ax_valids2_eq [symmetric])\napply assumption\napply (erule (1) ax_sound2)\ndone\n\nlemma sound_valid2_lemma: \n\"\\\\v n. Ball A (triple_valid2 G n) \\ P v n; Ball A (triple_valid2 G n)\\\n \\P v n\"\nby blast\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/AxSound.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.35936415202123906, "lm_q1q2_score": 0.19229519305129975}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory CTypes\nimports\n CTypesDefs \"HOL-Eisbach.Eisbach_Tools\"\nbegin\n\n\nlemma fu_commutes:\n \"fu_commutes f g \\ f bs (g bs' v) = g bs' (f bs v)\"\n by (simp add: fu_commutes_def)\n\n\nlemma size_td_list_append [simp]:\n \"size_td_list (xs@ys) = size_td_list xs + size_td_list ys\"\n by (induct_tac xs, auto)\n\n\nlemma access_ti_append:\n \"\\bs. length bs = size_td_list (xs@ys) \\\n access_ti_list (xs@ys) t bs =\n access_ti_list xs t (take (size_td_list xs) bs) @\n access_ti_list ys t (drop (size_td_list xs) bs)\"\nproof (induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: min_def ac_simps drop_take)\nqed\n\nlemma update_ti_append [simp]:\n \"\\bs. update_ti_list (xs@ys) bs v =\n update_ti_list xs (take (size_td_list xs) bs)\n (update_ti_list ys (drop (size_td_list xs) bs) v)\"\nproof (induct xs)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case by (simp add: drop_take ac_simps min_def)\nqed\n\nlemma update_ti_struct_t_typscalar [simp]:\n \"update_ti_struct_t (TypScalar n algn d) =\n (\\bs. if length bs = n then field_update d bs else id)\"\n by (rule ext, simp add: update_ti_struct_t_def)\n\nlemma update_ti_list_t_empty [simp]:\n \"update_ti_list_t [] = (\\x. id)\"\n by (rule ext, simp add: update_ti_list_t_def)\n\nlemma update_ti_list_t_cons [simp]:\n \"update_ti_list_t (x#xs) = (\\bs v.\n if length bs = size_td_pair x + size_td_list xs then\n update_ti_pair_t x (take (size_td_pair x) bs)\n (update_ti_list_t xs (drop (size_td_pair x) bs) v) else\n v)\"\n by (force simp: update_ti_list_t_def update_ti_pair_t_def min_def)\n\nlemma update_ti_append_s [simp]:\n \"\\bs. update_ti_list_t (xs@ys) bs v = (\n if length bs = size_td_list xs + size_td_list ys then\n update_ti_list_t xs (take (size_td_list xs) bs)\n (update_ti_list_t ys (drop (size_td_list xs) bs) v) else\n v)\"\nproof (induct xs)\n case Nil show ?case by (simp add: update_ti_list_t_def)\nnext\n case (Cons x xs) thus ?case by (simp add: min_def drop_take ac_simps)\nqed\n\nlemma update_ti_pair_t_dtpair [simp]:\n \"update_ti_pair_t (DTPair t f) = update_ti_t t\"\n by (rule ext, simp add: update_ti_pair_t_def update_ti_t_def)\n\ntext \\---------------------------------------------------------------\\\n\nlemma field_desc_empty [simp]:\n \"field_desc (TypDesc (TypAggregate []) nm) =\n \\ field_access = \\x bs. [],\n field_update = \\x. id \\\"\n by (force simp: update_ti_t_def)\n\n\nlemma export_uinfo_typdesc_simp [simp]:\n \"export_uinfo (TypDesc st nm) = map_td field_norm (TypDesc st nm)\"\n by (simp add: export_uinfo_def)\n\nlemma map_td_list_append [simp]:\n \"map_td_list f (xs@ys) = map_td_list f xs @ map_td_list f ys\"\n by (induct_tac xs) auto\n\n\nlemma dt_snd_map_td_list:\n \"dt_snd ` set (map_td_list f ts) = dt_snd ` set ts\"\nproof (induct ts)\n case (Cons x xs) thus ?case by (cases x) auto\nqed simp\n\nlemma wf_desc_map:\n shows \"wf_desc (map_td f t) = wf_desc t\" and\n \"wf_desc_struct (map_td_struct f st) = wf_desc_struct st\" and\n \"wf_desc_list (map_td_list f ts) = wf_desc_list ts\" and\n \"wf_desc_pair (map_td_pair f x) = wf_desc_pair x\"\nproof (induct t and st and ts and x)\n case (Cons_typ_desc x xs) thus ?case\n by (cases x, auto simp: dt_snd_map_td_list)\nqed auto\n\nlemma wf_desc_list_append [simp]:\n \"wf_desc_list (xs@ys) =\n (wf_desc_list xs \\ wf_desc_list ys \\ dt_snd ` set xs \\ dt_snd ` set ys = {})\"\n by (induct_tac xs, auto)\n\nlemma wf_size_desc_list_append [simp]:\n \"wf_size_desc_list (xs@ys) = (wf_size_desc_list xs \\ wf_size_desc_list ys)\"\n by (induct_tac xs, auto)\n\nlemma norm_tu_list_append [simp]:\n \"norm_tu_list (xs@ys) bs =\n norm_tu_list xs (take (size_td_list xs) bs) @ norm_tu_list ys (drop (size_td_list xs) bs)\"\n by (induct xs arbitrary: bs, auto simp: min_def ac_simps drop_take)\n\nlemma wf_size_desc_gt:\n shows \"wf_size_desc (t::'a typ_desc) \\ 0 < size_td t\" and\n \"wf_size_desc_struct st \\ 0 < size_td_struct (st::'a typ_struct)\" and\n \"\\ ts \\ []; wf_size_desc_list ts \\ \\ 0 < size_td_list (ts::'a typ_pair list)\" and\n \"wf_size_desc_pair x \\ 0 < size_td_pair (x::'a typ_pair)\"\n by (induct t and st and ts and x rule: typ_desc_typ_struct_inducts, auto)\n\nlemma field_lookup_empty [simp]:\n \"field_lookup t [] n = Some (t,n)\"\n by (case_tac t, clarsimp)\n\n\nlemma field_lookup_pair_empty [simp]:\n \"field_lookup_pair x [] n = None\"\n by (case_tac x, clarsimp)\n\nlemma field_lookup_list_empty [simp]:\n \"field_lookup_list ts [] n = None\"\n by (induct ts arbitrary: n, auto)\n\nlemma field_lookup_struct_empty [simp]:\n \"field_lookup_struct st [] n = None\"\n by (case_tac st, auto)\n\nlemma field_lookup_list_append [rule_format]:\n \"field_lookup_list (xs@ys) f n = (case field_lookup_list xs f n of\n None \\ field_lookup_list ys f (n + size_td_list xs)\n | Some y \\ Some y)\"\nproof (induct xs arbitrary: n)\n case Nil show ?case by simp\nnext\n case (Cons x xs) thus ?case\n by (cases x) (auto simp: ac_simps split: option.splits)\nqed\n\nlemma field_lookup_list_None:\n \"f \\ dt_snd ` set ts \\ field_lookup_list ts (f#fs) m = None\"\nproof (induct ts arbitrary: f fs m)\n case (Cons x _) thus ?case by (cases x) auto\nqed simp\n\nlemma field_lookup_list_Some:\n \"f \\ dt_snd ` set ts \\ field_lookup_list ts [f] m \\ None\"\nproof (induct ts arbitrary: f m)\n case (Cons x _) thus ?case by (cases x) auto\nqed simp\n\nlemma field_lookup_offset_le:\n shows \"\\s m n f. field_lookup t f m = Some ((s::'a typ_desc),n) \\ m \\ n\" and\n \"\\s m n f. field_lookup_struct st f m = Some ((s::'a typ_desc),n) \\ m \\ n\" and\n \"\\s m n f. field_lookup_list ts f m = Some ((s::'a typ_desc),n) \\ m \\ n\" and\n \"\\s m n f. field_lookup_pair x f m = Some ((s::'a typ_desc),n) \\ m \\ n\"\nproof (induct t and st and ts and x)\n case (Cons_typ_desc x xs) thus ?case by (fastforce split: option.splits)\nqed (auto split: if_split_asm)\n\nlemma field_lookup_offset':\n shows \"\\f m m' n t'. (field_lookup t f m = Some ((t'::'a typ_desc),m + n)) =\n (field_lookup t f m' = Some (t',m' + n))\" and\n \"\\f m m' n t'. (field_lookup_struct st f m = Some ((t'::'a typ_desc),m + n)) =\n (field_lookup_struct st f m' = Some (t',m' + n))\" and\n \"\\f m m' n t'. (field_lookup_list ts f m = Some ((t'::'a typ_desc),m + n)) =\n (field_lookup_list ts f m' = Some (t',m' + n))\" and\n \"\\f m m' n t'. (field_lookup_pair x f m = Some ((t'::'a typ_desc),m + n)) =\n (field_lookup_pair x f m' = Some (t',m' + n))\"\nproof (induct t and st and ts and x)\n case (Cons_typ_desc x xs)\n show ?case\n proof\n assume ls: \"field_lookup_list (x # xs) f m = Some (t', m + n)\"\n show \"field_lookup_list (x # xs) f m' = Some (t', m' + n)\" (is \"?X\")\n proof cases\n assume ps: \"field_lookup_pair x f m = None\"\n moreover from this ls have \"\\k. n = size_td (dt_fst x) + k\"\n by (clarsimp dest!: field_lookup_offset_le, arith)\n moreover from ps have \"field_lookup_pair x f m' = None\"\n by -\n (rule ccontr, clarsimp, subgoal_tac \"\\k. b = m' + k\",\n clarsimp simp: Cons_typ_desc [where m'=m],\n clarsimp dest!: field_lookup_offset_le, arith)\n ultimately show \"?X\" using ls\n by (clarsimp simp: add.assoc [symmetric])\n (subst (asm) Cons_typ_desc [where m'=\"m' + size_td (dt_fst x)\"], fast)\n next\n assume nps: \"field_lookup_pair x f m \\ None\"\n moreover from this have \"field_lookup_pair x f m' \\ None\"\n by (clarsimp, subgoal_tac \"\\k. b = m + k\", clarsimp)\n (subst (asm) Cons_typ_desc [where m'=m'], fast,\n clarsimp dest!: field_lookup_offset_le, arith)\n ultimately show \"?X\" using ls\n by (clarsimp, subst (asm) Cons_typ_desc [where m'=m'], simp)\n qed\n next\n assume ls: \"field_lookup_list (x # xs) f m' = Some (t', m' + n)\"\n show \"field_lookup_list (x # xs) f m = Some (t', m + n)\" (is \"?X\")\n proof cases\n assume ps: \"field_lookup_pair x f m' = None\"\n moreover from this ls have \"\\k. n = size_td (dt_fst x) + k\"\n by (clarsimp dest!: field_lookup_offset_le, arith)\n moreover from ps have \"field_lookup_pair x f m = None\"\n by -\n (rule ccontr, clarsimp, subgoal_tac \"\\k. b = m + k\",\n clarsimp simp: Cons_typ_desc [where m'=m'],\n clarsimp dest!: field_lookup_offset_le, arith)\n ultimately show \"?X\" using ls\n by (clarsimp simp: add.assoc [symmetric])\n (subst (asm) Cons_typ_desc [where m'=\"m + size_td (dt_fst x)\"], fast)\n next\n assume nps: \"field_lookup_pair x f m' \\ None\"\n moreover from this have \"field_lookup_pair x f m \\ None\"\n by (clarsimp, subgoal_tac \"\\k. b = m' + k\", clarsimp)\n (subst (asm) Cons_typ_desc [where m'=m], fast,\n clarsimp dest!: field_lookup_offset_le, arith)\n ultimately show \"?X\" using ls\n by (clarsimp, subst (asm) Cons_typ_desc [where m'=m], simp)\n qed\n qed\nqed auto\n\nlemma field_lookup_offset:\n \"(field_lookup t f m = Some (t',m + n)) = (field_lookup t f 0 = Some (t',n))\"\n by (simp add: field_lookup_offset' [where m'=0])\n\nlemma field_lookup_offset2:\n \"field_lookup t f m = Some (t',n) \\ field_lookup t f 0 = Some (t',n - m)\"\n by (simp add: field_lookup_offset_le\n flip: field_lookup_offset [where m=m])\n\nlemma field_lookup_list_offset:\n \"(field_lookup_list ts f m = Some (t',m + n)) = (field_lookup_list ts f 0 = Some (t',n))\"\n by (simp add: field_lookup_offset' [where m'=0])\n\nlemma field_lookup_list_offset2:\n \"field_lookup_list ts f m = Some (t',n) \\ field_lookup_list ts f 0 = Some (t',n - m)\"\n by (simp add: field_lookup_offset_le\n flip: field_lookup_list_offset [where m=m])\n\nlemma field_lookup_list_offset3:\n \"field_lookup_list ts f 0 = Some (t',n) \\ field_lookup_list ts f m = Some (t',m + n)\"\n by (simp add: field_lookup_list_offset)\n\nlemma field_lookup_list_offsetD:\n \"\\ field_lookup_list ts f 0 = Some (s,k);\n field_lookup_list ts f m = Some (t,n) \\ \\ s=t \\ n=m+k\"\n by (subgoal_tac \"\\k. n = m + k\", clarsimp simp: field_lookup_list_offset)\n (clarsimp dest!: field_lookup_offset_le, arith)\n\nlemma field_lookup_offset_None:\n \"(field_lookup t f m = None) = (field_lookup t f 0 = None)\"\n by (auto simp: field_lookup_offset2 field_lookup_offset [where m=m,symmetric]\n intro: ccontr)\n\nlemma field_lookup_list_offset_None:\n \"(field_lookup_list ts f m = None) = (field_lookup_list ts f 0 = None)\"\n by (auto simp: field_lookup_list_offset2 field_lookup_list_offset [where m=m,symmetric]\n intro: ccontr)\n\nlemma map_td_size [simp]:\n shows \"size_td (map_td f t) = size_td t\" and\n \"size_td_struct (map_td_struct f st) = size_td_struct st\" and\n \"size_td_list (map_td_list f ts) = size_td_list ts\" and\n \"size_td_pair (map_td_pair f x) = size_td_pair x\"\n by (induct t and st and ts and x, auto)\n\nlemma export_uinfo_size [simp]:\n \"size_td (export_uinfo t) = size_td (t::'a typ_info)\"\n by (simp add: export_uinfo_def)\n\nlemma typ_uinfo_size [simp]:\n \"size_td (typ_uinfo_t TYPE('a)) = size_td (typ_info_t TYPE('a::c_type))\"\n by (simp add: typ_uinfo_t_def export_uinfo_def)\n\nlemma wf_size_desc_map:\n shows \"wf_size_desc (map_td f t) = wf_size_desc t\" and\n \"wf_size_desc_struct (map_td_struct f st) = wf_size_desc_struct st\" and\n \"wf_size_desc_list (map_td_list f ts) = wf_size_desc_list ts\" and\n \"wf_size_desc_pair (map_td_pair f x) = wf_size_desc_pair x\"\n by (induct t and st and ts and x)\n (all \\simp\\, (case_tac list; simp))\n\nlemma map_td_flr_Some [simp]:\n \"map_td_flr f (Some (t,n)) = Some (map_td f t,n)\"\n by (clarsimp simp: map_td_flr_def)\n\nlemma map_td_flr_None [simp]:\n \"map_td_flr f None = None\"\n by (clarsimp simp: map_td_flr_def)\n\nlemma field_lookup_map:\n shows \"\\f m s. field_lookup t f m = s \\\n field_lookup (map_td fupd t) f m = map_td_flr fupd s\" and\n \"\\f m s. field_lookup_struct st f m = s \\\n field_lookup_struct (map_td_struct fupd st) f m = map_td_flr fupd s\" and\n \"\\f m s. field_lookup_list ts f m = s \\\n field_lookup_list (map_td_list fupd ts) f m = map_td_flr fupd s\" and\n \"\\f m s. field_lookup_pair x f m = s \\\n field_lookup_pair (map_td_pair fupd x) f m = map_td_flr fupd s\"\nproof (induct t and st and ts and x)\n case (Cons_typ_desc x xs) thus ?case\n by (clarsimp, cases x, auto simp: map_td_flr_def split: option.splits)\nqed auto\n\nlemma field_lookup_export_uinfo_Some:\n \"field_lookup (t::'a typ_info) f m = Some (s,n) \\\n field_lookup (export_uinfo t) f m = Some (export_uinfo s,n)\"\n by (simp add: export_uinfo_def field_lookup_map)\n\nlemma field_lookup_struct_export_Some:\n \"field_lookup_struct (st::'a typ_struct) f m = Some (s,n) \\\n field_lookup_struct (map_td_struct fupd st) f m = Some (map_td fupd s,n)\"\n by (simp add: field_lookup_map)\n\nlemma field_lookup_struct_export_None:\n \"field_lookup_struct (st::'a typ_struct) f m = None \\\n field_lookup_struct (map_td_struct fupd st) f m = None\"\n by (simp add: field_lookup_map)\n\nlemma field_lookup_list_export_Some:\n \"field_lookup_list (ts::'a typ_pair list) f m = Some (s,n) \\\n field_lookup_list (map_td_list fupd ts) f m = Some (map_td fupd s,n)\"\n by (simp add: field_lookup_map)\n\nlemma field_lookup_list_export_None:\n \"field_lookup_list (ts::'a typ_pair list) f m = None \\\n field_lookup_list (map_td_list fupd ts) f m = None\"\n by (simp add: field_lookup_map)\n\nlemma field_lookup_pair_export_Some:\n \"field_lookup_pair (x::'a typ_pair) f m = Some (s,n) \\\n field_lookup_pair (map_td_pair fupd x) f m = Some (map_td fupd s,n)\"\n by (simp add: field_lookup_map)\n\nlemma field_lookup_pair_export_None:\n \"field_lookup_pair (x::'a typ_pair) f m = None \\\n field_lookup_pair (map_td_pair fupd x) f m = None\"\n by (simp add: field_lookup_map)\n\nlemma import_flr_Some [simp]:\n \"import_flr f (Some (map_td f t,n)) (Some (t,n))\"\n by (clarsimp simp: import_flr_def)\n\nlemma import_flr_None [simp]:\n \"import_flr f None None\"\n by (clarsimp simp: import_flr_def)\n\nlemma field_lookup_export_uinfo_rev'':\n \"\\f m s. field_lookup (map_td fupd t) f m = s \\\n import_flr fupd s ((field_lookup t f m)::'a flr)\"\n \"\\f m s. field_lookup_struct (map_td_struct fupd st) f m = s \\\n import_flr fupd s ((field_lookup_struct st f m)::'a flr)\"\n \"\\f m s. field_lookup_list (map_td_list fupd ts) f m = s \\\n import_flr fupd s ((field_lookup_list ts f m)::'a flr)\"\n \"\\f m s. field_lookup_pair (map_td_pair fupd x) f m = s \\\n import_flr fupd s ((field_lookup_pair x f m)::'a flr)\"\n apply(induct t and st and ts and x)\n apply(all \\clarsimp\\)\n apply(clarsimp simp: import_flr_def export_uinfo_def)\n apply(clarsimp split: option.splits)\n apply(case_tac f, clarsimp+)\n apply(rule conjI, clarsimp)\n apply(rule conjI, clarsimp)\n apply(case_tac dt_pair, simp)\n apply clarsimp\n apply(drule_tac fupd=fupd in field_lookup_pair_export_Some)\n apply simp\n apply clarsimp\n apply(rule conjI; clarsimp)\n apply(drule_tac fupd=fupd in field_lookup_pair_export_None)\n apply simp\n apply metis\n done\n\nlemma field_lookup_export_uinfo_rev':\n \"(\\f m s. field_lookup (map_td fupd t) f m = s \\\n import_flr fupd s ((field_lookup t f m)::'a flr)) \\\n (\\f m s. field_lookup_struct (map_td_struct fupd st) f m = s \\\n import_flr fupd s ((field_lookup_struct st f m)::'a flr)) \\\n (\\f m s. field_lookup_list (map_td_list fupd ts) f m = s \\\n import_flr fupd s ((field_lookup_list ts f m)::'a flr)) \\\n (\\f m s. field_lookup_pair (map_td_pair fupd x) f m = s \\\n import_flr fupd s ((field_lookup_pair x f m)::'a flr))\"\n by (auto simp: field_lookup_export_uinfo_rev'')\n\n\nlemma field_lookup_export_uinfo_Some_rev:\n \"field_lookup (export_uinfo (t::'a typ_info)) f m = Some (s,n) \\\n \\k. field_lookup t f m = Some (k,n) \\ export_uinfo k = s\"\n apply(insert field_lookup_export_uinfo_rev' [of field_norm t undefined undefined undefined])\n apply clarsimp\n apply(drule_tac x=f in spec)\n apply(drule_tac x=m in spec)\n apply(clarsimp simp: import_flr_def export_uinfo_def split: option.splits)\n done\n\nlemma field_lookup_offset_untyped_eq [simp]:\n \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (s,n) \\\n field_offset_untyped (typ_uinfo_t TYPE('a::c_type)) f = n\"\n apply(simp add: field_offset_untyped_def typ_uinfo_t_def)\n apply(drule field_lookup_export_uinfo_Some)\n apply(simp add: typ_uinfo_t_def export_uinfo_def)\n done\n\nlemma field_lookup_offset_eq [simp]:\n \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (s,n) \\\n field_offset TYPE('a::c_type) f = n\"\n by(simp add: field_offset_def)\n\nlemma field_offset_self [simp]:\n \"field_offset t [] = 0\"\n by (simp add: field_offset_def field_offset_untyped_def)\n\nlemma field_ti_self [simp]:\n \"field_ti TYPE('a) [] = Some (typ_info_t TYPE('a::c_type))\"\n by (simp add: field_ti_def)\n\nlemma field_size_self [simp]:\n \"field_size TYPE('a) [] = size_td (typ_info_t TYPE('a::c_type))\"\n by (simp add: field_size_def)\n\n\nlemma field_lookup_prefix_None'':\n \"(\\f g m. field_lookup (t::'a typ_desc) f m = None \\ field_lookup t (f@g) m = None)\"\n \"(\\f g m. field_lookup_struct (st::'a typ_struct) f m = None \\ f \\ [] \\\n field_lookup_struct st (f@g) m = None)\"\n \"(\\f g m. field_lookup_list (ts::'a typ_pair list) f m = None \\ f \\ [] \\\n field_lookup_list ts (f@g) m = None)\"\n \"(\\f g m. field_lookup_pair (x::'a typ_pair) f m = None \\ f \\ [] \\\n field_lookup_pair x (f@g) m = None)\"\n by (induct t and st and ts and x)\n (clarsimp split: option.splits)+\n\nlemma field_lookup_prefix_None' [rule_format]:\n \"(\\f g m. field_lookup (t::'a typ_desc) f m = None \\ field_lookup t (f@g) m = None) \\\n (\\f g m. field_lookup_struct (st::'a typ_struct) f m = None \\ f \\ [] \\\n field_lookup_struct st (f@g) m = None) \\\n (\\f g m. field_lookup_list (ts::'a typ_pair list) f m = None \\ f \\ [] \\\n field_lookup_list ts (f@g) m = None) \\\n (\\f g m. field_lookup_pair (x::'a typ_pair) f m = None \\ f \\ [] \\\n field_lookup_pair x (f@g) m = None)\"\n by (auto simp: field_lookup_prefix_None'')\n\n\nlemma field_lookup_prefix_Some'':\n \"(\\f g t' m n. field_lookup t f m = Some ((t'::'a typ_desc),n) \\ wf_desc t \\\n field_lookup t (f@g) m = field_lookup t' g n)\"\n \"(\\f g t' m n. field_lookup_struct st f m = Some ((t'::'a typ_desc),n) \\ wf_desc_struct st \\\n field_lookup_struct st (f@g) m = field_lookup t' g n)\"\n \"(\\f g t' m n. field_lookup_list ts f m = Some ((t'::'a typ_desc),n) \\ wf_desc_list ts \\\n field_lookup_list ts (f@g) m = field_lookup t' g n)\"\n \"(\\f g t' m n. field_lookup_pair x f m = Some ((t'::'a typ_desc),n) \\ wf_desc_pair x \\\n field_lookup_pair x (f@g) m = field_lookup t' g n)\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(clarsimp split: option.splits)\n apply(subst (asm) field_lookup_prefix_None', assumption; clarsimp)\n apply(case_tac dt_pair)\n apply(case_tac f, clarsimp)\n by (clarsimp simp: field_lookup_list_None split: if_split_asm)\n\nlemma field_lookup_prefix_Some' [rule_format]:\n \"(\\f g t' m n. field_lookup t f m = Some ((t'::'a typ_desc),n) \\ wf_desc t \\\n field_lookup t (f@g) m = field_lookup t' g n) \\\n (\\f g t' m n. field_lookup_struct st f m = Some ((t'::'a typ_desc),n) \\ wf_desc_struct st \\\n field_lookup_struct st (f@g) m = field_lookup t' g n) \\\n (\\f g t' m n. field_lookup_list ts f m = Some ((t'::'a typ_desc),n) \\ wf_desc_list ts \\\n field_lookup_list ts (f@g) m = field_lookup t' g n) \\\n (\\f g t' m n. field_lookup_pair x f m = Some ((t'::'a typ_desc),n) \\ wf_desc_pair x \\\n field_lookup_pair x (f@g) m = field_lookup t' g n)\"\n by (auto simp: field_lookup_prefix_Some'')\n\nlemma field_lvalue_empty_simp [simp]:\n \"Ptr &(p\\[]) = p\"\n by (simp add: field_lvalue_def field_offset_def field_offset_untyped_def)\n\nlemma map_td_align [simp]:\n \"align_td (map_td f t) = align_td (t::'a typ_desc)\"\n \"align_td_struct (map_td_struct f st) = align_td_struct (st::'a typ_struct)\"\n \"align_td_list (map_td_list f ts) = align_td_list (ts::'a typ_pair list)\"\n \"align_td_pair (map_td_pair f x) = align_td_pair (x::'a typ_pair)\"\n by (induct t and st and ts and x) auto\n\nlemma typ_uinfo_align [simp]:\n \"align_td (export_uinfo t) = align_td (t::'a typ_info)\"\n by (simp add: export_uinfo_def)\n\nlemma ptr_aligned_Ptr_0 [simp]:\n \"ptr_aligned NULL\"\n by (simp add: ptr_aligned_def)\n\nlemma td_set_self [simp]:\n \"(t,m) \\ td_set t m\"\n by (case_tac t, simp)\n\nlemma td_set_wf_size_desc [rule_format]:\n \"(\\s m n. wf_size_desc t \\ ((s::'a typ_desc),m) \\ td_set t n \\ wf_size_desc s)\"\n \"(\\s m n. wf_size_desc_struct st \\ ((s::'a typ_desc),m) \\ td_set_struct st n \\ wf_size_desc s)\"\n \"(\\s m n. wf_size_desc_list ts \\ ((s::'a typ_desc),m) \\ td_set_list ts n \\ wf_size_desc s)\"\n \"(\\s m n. wf_size_desc_pair x \\ ((s::'a typ_desc),m) \\ td_set_pair x n \\ wf_size_desc s)\"\n by (induct t and st and ts and x) force+\n\nlemma td_set_size_lte':\n \"(\\s k m. ((s::'a typ_desc),k) \\ td_set t m \\ size s = size t \\ s=t \\ k=m \\ size s < size t)\"\n \"(\\s k m. ((s::'a typ_desc),k) \\ td_set_struct st m \\ size s < size st)\"\n \"(\\s k m. ((s::'a typ_desc),k) \\ td_set_list xs m \\ size s < size_list (size_dt_pair size (\\_. 0)) xs)\"\n \"(\\s k m. ((s::'a typ_desc),k) \\ td_set_pair x m \\ size s < size_dt_pair size (\\_. 0) x)\"\n by (induct t and st and xs and x) force+\n\nlemma td_set_size_lte:\n \"(s,k) \\ td_set t m \\ size s = size t \\ s=t \\ k=m \\\n size s < size t\"\n by (simp add: td_set_size_lte')\n\nlemma td_set_struct_size_lte:\n \"(s,k) \\ td_set_struct st m \\ size s < size st\"\n by (simp add: td_set_size_lte')\n\nlemma td_set_list_size_lte:\n \"(s,k) \\ td_set_list ts m \\ size s < size_list (size_dt_pair size (\\_. 0)) ts\"\n by (simp add: td_set_size_lte')\n\nlemma td_aggregate_not_in_td_set_list [simp]:\n \"\\ (TypDesc (TypAggregate xs) tn,k) \\ td_set_list xs m\"\n by (fastforce dest: td_set_list_size_lte simp: size_char_def)\n\nlemma sub_size_td:\n \"(s::'a typ_desc) \\ t \\ size s \\ size t\"\n by (fastforce dest: td_set_size_lte simp: typ_tag_le_def)\n\nlemma sub_tag_antisym:\n \"\\ (s::'a typ_desc) \\ t; t \\ s \\ \\ s=t\"\n apply(frule sub_size_td)\n apply(frule sub_size_td [where t=s])\n apply(clarsimp simp: typ_tag_le_def)\n apply(drule td_set_size_lte)\n apply clarsimp\n done\n\nlemma sub_tag_refl:\n \"(s::'a typ_desc) \\ s\"\n unfolding typ_tag_le_def by (cases s, fastforce)\n\nlemma sub_tag_sub':\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set t m \\ td_set s n \\ td_set t m\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_struct ts m \\ td_set s n \\ td_set_struct ts m\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_list xs m \\ td_set s n \\ td_set_list xs m\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_pair x m \\ td_set s n \\ td_set_pair x m\"\n by (induct t and ts and xs and x) fastforce+\n\nlemma sub_tag_sub:\n \"(s,n) \\ td_set t m \\ td_set s n \\ td_set t m\"\n by (simp add: sub_tag_sub')\n\nlemma td_set_fst:\n \"\\m n. fst ` td_set (s::'a typ_desc) m = fst ` td_set s n\"\n \"\\m n. fst ` td_set_struct (st::'a typ_struct) m = fst ` td_set_struct st n\"\n \"\\m n. fst ` td_set_list (xs::'a typ_pair list) m = fst ` td_set_list xs n\"\n \"\\m n. fst ` td_set_pair (x::'a typ_pair) m = fst ` td_set_pair x n\"\n by (induct s and st and xs and x) (all \\clarsimp\\, fast, fast)\n\nlemma sub_tag_trans:\n \"\\ (s::'a typ_desc) \\ t; t \\ u \\ \\ s \\ u\"\n apply(clarsimp simp: typ_tag_le_def)\n apply(rename_tac n n')\n apply(subgoal_tac \"s \\ fst ` td_set t 0\")\n apply(subgoal_tac \"s \\ fst ` td_set t n'\")\n apply(drule_tac n=n' in sub_tag_sub)\n apply force\n apply(subgoal_tac \"fst ` td_set t 0 = fst ` td_set t n'\")\n apply fast\n apply(simp add: td_set_fst)\n apply force\n done\n\n(*FIXME: move*)\ninstantiation typ_desc :: (type) order\nbegin\ninstance\n apply intro_classes\n apply(fastforce simp: typ_tag_lt_def typ_tag_le_def dest: td_set_size_lte)\n apply(rule sub_tag_refl)\n apply(erule (1) sub_tag_trans)\n apply(erule (1) sub_tag_antisym)\n done\nend\n\nlemma td_set_offset_size'':\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set t m \\ size_td s + (n - m) \\ size_td t\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_struct st m \\ size_td s + (n - m) \\ size_td_struct st\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_list ts m \\ size_td s + (n - m) \\ size_td_list ts\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_pair x m \\ size_td s + (n - m) \\ size_td_pair x\"\n by (induct t and st and ts and x, all \\clarsimp\\)\n (case_tac dt_pair, fastforce)\n\nlemma td_set_offset_size':\n \"(\\s m n. ((s::'a typ_desc),n) \\ td_set t m \\ size_td s + (n - m) \\ size_td t) \\\n (\\s m n. ((s::'a typ_desc),n) \\ td_set_struct st m \\ size_td s + (n - m) \\ size_td_struct st) \\\n (\\s m n. ((s::'a typ_desc),n) \\ td_set_list ts m \\ size_td s + (n - m) \\ size_td_list ts) \\\n (\\s m n. ((s::'a typ_desc),n) \\ td_set_pair x m \\ size_td s + (n - m) \\ size_td_pair x)\"\n by (auto simp: td_set_offset_size'')\n\nlemma td_set_offset_size:\n \"(s,n) \\ td_set t 0 \\ size_td s + n \\ size_td t\"\n using td_set_offset_size' [of t undefined undefined undefined] by fastforce\n\nlemma td_set_struct_offset_size:\n \"(s,n) \\ td_set_struct st m \\ size_td s + (n - m) \\ size_td_struct st\"\n using td_set_offset_size' [of undefined st undefined undefined] by clarsimp\n\nlemma td_set_list_offset_size:\n \"(s,n) \\ td_set_list ts 0 \\ size_td s + n \\ size_td_list ts\"\n using td_set_offset_size' [of undefined undefined ts undefined]\n by fastforce\n\nlemma td_set_offset_size_m:\n \"(s,n) \\ td_set t m \\ size_td s + (n - m) \\ size_td t\"\n using insert td_set_offset_size' [of t undefined undefined undefined]\n by clarsimp\n\nlemma td_set_list_offset_size_m:\n \"(s,n) \\ td_set_list t m \\ size_td s + (n - m) \\ size_td_list t\"\n using insert td_set_offset_size' [of undefined undefined t undefined]\n by clarsimp\n\nlemma td_set_pair_offset_size_m:\n \"(s,n) \\ td_set_pair t m \\ size_td s + (n - m) \\ size_td_pair t\"\n using td_set_offset_size' [of undefined undefined undefined t]\n by clarsimp\n\nlemma td_set_offset_le':\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set t m \\ m \\ n\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_struct st m \\ m \\ n\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_list ts m \\ m \\ n\"\n \"\\s m n. ((s::'a typ_desc),n) \\ td_set_pair x m \\ m \\ n\"\n by (induct t and st and ts and x) fastforce+\n\nlemma td_set_list_offset_le:\n \"(s,n) \\ td_set_list ts m \\ m \\ n\"\n by (simp add: td_set_offset_le')\n\nlemma td_set_pair_offset_le:\n \"(s,n) \\ td_set_pair ts m \\ m \\ n\"\n by (simp add: td_set_offset_le')\n\nlemma field_of_self [simp]:\n \"field_of 0 t t\"\n by (simp add: field_of_def)\n\nlemma td_set_export_uinfo':\n \"\\f m n s. ((s::'a typ_info),n) \\ td_set t m \\\n (export_uinfo s,n) \\ td_set (export_uinfo t) m\"\n \"\\f m n s. ((s::'a typ_info),n) \\ td_set_struct st m \\\n (export_uinfo s,n) \\ td_set_struct (map_td_struct field_norm st) m\"\n \"\\f m n s. ((s::'a typ_info),n) \\ td_set_list ts m \\\n (export_uinfo s,n) \\ td_set_list (map_td_list field_norm ts) m\"\n \"\\f m n s. ((s::'a typ_info),n) \\ td_set_pair x m \\\n (export_uinfo s,n) \\ td_set_pair (map_td_pair field_norm x) m\"\n apply(induct t and st and ts and x)\n apply (all \\clarsimp\\)\n apply(case_tac dt_pair, simp add: export_uinfo_def)\n apply(simp add: export_uinfo_def)\n done\n\nlemma td_set_export_uinfo:\n \"(\\f m n s. ((s::'a typ_info),n) \\ td_set t m \\\n (export_uinfo s,n) \\ td_set (export_uinfo t) m) \\\n (\\f m n s. ((s::'a typ_info),n) \\ td_set_struct st m \\\n (export_uinfo s,n) \\ td_set_struct (map_td_struct field_norm st) m) \\\n (\\f m n s. ((s::'a typ_info),n) \\ td_set_list ts m \\\n (export_uinfo s,n) \\ td_set_list (map_td_list field_norm ts) m) \\\n (\\f m n s. ((s::'a typ_info),n) \\ td_set_pair x m \\\n (export_uinfo s,n) \\ td_set_pair (map_td_pair field_norm x) m)\"\n by (auto simp: td_set_export_uinfo')\n\n\nlemma td_set_export_uinfoD:\n \"(s,n) \\ td_set t m \\ (export_uinfo s,n) \\ td_set (export_uinfo t) m\"\n using td_set_export_uinfo [of t undefined undefined undefined] by clarsimp\n\nlemma td_set_field_lookup'':\n \"\\s m n. wf_desc t \\ (((s::'a typ_desc),m + n) \\ td_set t m \\\n (\\f. field_lookup t f m = Some (s,m+n)))\"\n \"\\s m n. wf_desc_struct st \\ (((s::'a typ_desc),m + n) \\ td_set_struct st m \\\n (\\f. field_lookup_struct st f m = Some (s,m+n)))\"\n \"\\s m n. wf_desc_list ts \\ (((s::'a typ_desc),m + n) \\ td_set_list ts m \\\n (\\f. field_lookup_list ts f m = Some (s,m+n)))\"\n \"\\s m n. wf_desc_pair x \\ (((s::'a typ_desc),m + n) \\ td_set_pair x m \\\n (\\f. field_lookup_pair x f m = Some (s,m+n)))\"\n apply(induct t and st and ts and x)\n apply clarsimp\n apply(case_tac s, clarsimp)\n apply (rule conjI)\n apply clarsimp\n apply(rule_tac x=\"[]\" in exI)\n apply clarsimp+\n apply((erule allE)+, erule (1) impE)\n apply clarsimp\n apply(case_tac f, clarsimp+)\n apply(rename_tac x xs)\n apply(rule_tac x=\"x#xs\" in exI)\n apply clarsimp\n apply clarsimp+\n apply(rule conjI, clarsimp)\n apply((erule allE)+, erule (1) impE)\n apply(clarsimp, case_tac f, clarsimp+)\n apply(rename_tac x xs)\n apply(rule_tac x=\"x#xs\" in exI)\n apply(clarsimp)\n apply clarsimp\n apply(thin_tac \"\\s. P s\" for P)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=\"n - size_td (dt_fst dt_pair)\" in spec)\n apply(frule td_set_list_offset_le)\n apply clarsimp\n apply(rule_tac x=f in exI)\n apply(clarsimp split: option.splits)\n apply(case_tac dt_pair, clarsimp split: if_split_asm)\n apply(case_tac f, clarsimp+)\n apply(simp add: field_lookup_list_None)\n apply clarsimp\n apply((erule allE)+, erule (1) impE)\n apply clarsimp\n apply(rule_tac x=\"list#f\" in exI)\n apply clarsimp\n done\n\nlemma td_set_field_lookup':\n \"(\\s m n. wf_desc t \\ (((s::'a typ_desc),m + n) \\ td_set t m \\\n (\\f. field_lookup t f m = Some (s,m+n)))) \\\n (\\s m n. wf_desc_struct st \\ (((s::'a typ_desc),m + n) \\ td_set_struct st m \\\n (\\f. field_lookup_struct st f m = Some (s,m+n)))) \\\n (\\s m n. wf_desc_list ts \\ (((s::'a typ_desc),m + n) \\ td_set_list ts m \\\n (\\f. field_lookup_list ts f m = Some (s,m+n)))) \\\n (\\s m n. wf_desc_pair x \\ (((s::'a typ_desc),m + n) \\ td_set_pair x m \\\n (\\f. field_lookup_pair x f m = Some (s,m+n))))\"\n by (auto simp: td_set_field_lookup'')\n\n\nlemma td_set_field_lookup_rev'':\n \"\\s m n. (\\f. field_lookup t f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set t m\"\n \"\\s m n. (\\f. field_lookup_struct st f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_struct st m\"\n \"\\s m n. (\\f. field_lookup_list ts f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_list ts m\"\n \"\\s m n. (\\f. field_lookup_pair x f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_pair x m\"\n apply(induct t and st and ts and x)\n apply clarsimp\n apply(case_tac f, clarsimp)\n apply clarsimp\n apply((erule allE)+, erule impE, fast)\n apply fast\n apply clarsimp+\n apply(clarsimp split: option.splits)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=\"n - size_td (dt_fst dt_pair)\" in spec)\n apply(erule impE)\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply fast\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply((erule allE)+, erule impE, fast)\n apply assumption\n apply clarsimp\n apply(case_tac f, clarsimp+)\n apply((erule allE)+, erule impE, fast)\n apply assumption\n done\n\nlemma td_set_field_lookup_rev':\n \"(\\s m n. (\\f. field_lookup t f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set t m) \\\n (\\s m n. (\\f. field_lookup_struct st f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_struct st m) \\\n (\\s m n. (\\f. field_lookup_list ts f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_list ts m) \\\n (\\s m n. (\\f. field_lookup_pair x f m = Some (s,m+n)) \\\n ((s::'a typ_desc),m + n) \\ td_set_pair x m)\"\n by (auto simp: td_set_field_lookup_rev'')\n\nlemma td_set_field_lookup:\n \"wf_desc t \\ k \\ td_set t 0 = (\\f. field_lookup t f 0 = Some k)\"\n using td_set_field_lookup' [of t undefined undefined undefined]\n td_set_field_lookup_rev' [of t undefined undefined undefined]\n apply clarsimp\n apply(case_tac k, clarsimp)\n apply (rule iffI)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=0 in spec)\n apply fastforce\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=0 in spec)\n by fastforce\n\nlemma td_set_field_lookupD:\n \"field_lookup t f m = Some k \\ k \\ td_set t m\"\n using td_set_field_lookup_rev' [of t undefined undefined undefined]\n apply(case_tac k, clarsimp)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=\"b - m\" in spec)\n apply(frule field_lookup_offset_le)\n apply clarsimp\n done\n\nlemma td_set_struct_field_lookup_structD:\n \"field_lookup_struct st f m = Some k \\ k \\ td_set_struct st m\"\n using td_set_field_lookup_rev' [of undefined st undefined undefined]\n apply(case_tac k, clarsimp)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=\"b - m\" in spec)\n apply(frule field_lookup_offset_le)\n apply clarsimp\n done\n\nlemma field_lookup_struct_td_simp [simp]:\n \"field_lookup_struct ts f m \\ Some (TypDesc ts nm, m)\"\n by (fastforce dest: td_set_struct_field_lookup_structD td_set_struct_size_lte)\n\n\nlemma td_set_list_field_lookup_listD:\n \"field_lookup_list xs f m = Some k \\ k \\ td_set_list xs m\"\n using td_set_field_lookup_rev' [of undefined undefined xs undefined]\n apply(case_tac k, clarsimp)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=\"b - m\" in spec)\n apply(frule field_lookup_offset_le)\n apply clarsimp\n done\n\nlemma td_set_pair_field_lookup_pairD:\n \"field_lookup_pair x f m = Some k \\ k \\ td_set_pair x m\"\n using td_set_field_lookup_rev' [of undefined undefined undefined x]\n apply(case_tac k, clarsimp)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=a in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=\"b - m\" in spec)\n apply(frule field_lookup_offset_le)\n apply clarsimp\n done\n\n\nlemma field_lookup_wf_size_desc_gt:\n \"\\ field_lookup t f n = Some (a,b); wf_size_desc t \\ \\ 0 < size_td a\"\n by (fastforce simp: td_set_wf_size_desc wf_size_desc_gt dest!: td_set_field_lookupD)\n\nlemma field_lookup_inject'':\n \"\\f g m s. wf_size_desc t \\ field_lookup (t::'a typ_desc) f m = Some s \\ field_lookup t g m = Some s \\ f=g\"\n \"\\f g m s. wf_size_desc_struct st \\ field_lookup_struct (st::'a typ_struct) f m = Some s \\ field_lookup_struct st g m = Some s \\ f=g\"\n \"\\f g m s. wf_size_desc_list ts \\ field_lookup_list (ts::'a typ_pair list) f m = Some s \\ field_lookup_list ts g m = Some s \\ f=g\"\n \"\\f g m s. wf_size_desc_pair x \\ field_lookup_pair (x::'a typ_pair) f m = Some s \\ field_lookup_pair x g m = Some s \\ f=g\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply fast\n apply(clarsimp split: option.splits)\n apply fast\n apply(frule td_set_pair_field_lookup_pairD)\n apply(drule field_lookup_offset_le)\n apply(drule td_set_pair_offset_size_m)\n apply(thin_tac \"\\f g. P f g\" for P)+\n apply(case_tac dt_pair, simp)\n apply(subgoal_tac \"0 < size_td a\", simp)\n apply(clarsimp split: if_split_asm; drule (2) field_lookup_wf_size_desc_gt)\n apply(frule td_set_pair_field_lookup_pairD)\n apply(drule field_lookup_offset_le)\n apply(drule td_set_pair_offset_size_m)\n apply(thin_tac \"\\f g. P f g\" for P)+\n apply(case_tac dt_pair, simp )\n apply(subgoal_tac \"0 < size_td a\", simp)\n apply(clarsimp split: if_split_asm; drule (2) field_lookup_wf_size_desc_gt)+\n apply best\n apply(drule_tac x=\"tl f\" in spec)\n apply(drule_tac x=\"tl g\" in spec)\n apply(case_tac f; simp)\n apply(case_tac g; simp)\n apply fastforce\n done\n\nlemma field_lookup_inject':\n \"(\\f g m s. wf_size_desc t \\ field_lookup (t::'a typ_desc) f m = Some s \\ field_lookup t g m = Some s \\ f=g) \\\n (\\f g m s. wf_size_desc_struct st \\ field_lookup_struct (st::'a typ_struct) f m = Some s \\ field_lookup_struct st g m = Some s \\ f=g) \\\n (\\f g m s. wf_size_desc_list ts \\ field_lookup_list (ts::'a typ_pair list) f m = Some s \\ field_lookup_list ts g m = Some s \\ f=g) \\\n (\\f g m s. wf_size_desc_pair x \\ field_lookup_pair (x::'a typ_pair) f m = Some s \\ field_lookup_pair x g m = Some s \\ f=g)\"\n by (auto simp: field_lookup_inject'')\n\n\nlemma field_lookup_inject:\n \"\\ field_lookup (t::'a typ_desc) f m = Some s;\n field_lookup t g m = Some s; wf_size_desc t \\ \\ f=g\"\n using field_lookup_inject' [of t undefined undefined undefined]\n apply(cases s)\n apply clarsimp\n apply(drule_tac x=f in spec)\n apply(drule_tac x=g in spec)\n apply fast\n done\n\nlemma fd_cons_update_normalise:\n \"\\ fd_cons_update_access d n; fd_cons_access_update d n;\n fd_cons_double_update d; fd_cons_length d n \\ \\\n fd_cons_update_normalise d n\"\n apply(clarsimp simp: fd_cons_update_access_def fd_cons_update_normalise_def norm_desc_def)\n apply(drule_tac x=\"field_update d bs v\" in spec)\n apply(drule_tac x=\"replicate (length bs) 0\" in spec)\n apply clarsimp\n apply(clarsimp simp: fd_cons_access_update_def)\n apply(drule_tac x=bs in spec)\n apply clarsimp\n apply(drule_tac x=\"replicate (length bs) 0\" in spec)\n apply clarsimp\n apply(drule_tac x=v in spec)\n apply(drule_tac x=undefined in spec)\n apply clarsimp\n apply(clarsimp simp: fd_cons_double_update_def)\n apply(drule_tac x=\"v\" in spec)\n apply(drule_tac x=\"field_access d (field_update d bs undefined)\n (replicate (length bs) 0)\" in spec)\n apply(drule_tac x=bs in spec)\n apply clarsimp\n apply(erule impE)\n apply(clarsimp simp: fd_cons_length_def)\n apply clarsimp\n done\n\nlemma update_ti_t_update_ti_struct_t [simp]:\n \"update_ti_t (TypDesc st tn) = update_ti_struct_t st\"\n by (auto simp: update_ti_t_def update_ti_struct_t_def)\n\nlemma fd_cons_fd_cons_struct [simp]:\n \"fd_cons (TypDesc st tn) = fd_cons_struct st\"\n by (clarsimp simp: fd_cons_def fd_cons_struct_def)\n\nlemma update_ti_struct_t_update_ti_list_t [simp]:\n \"update_ti_struct_t (TypAggregate ts) = update_ti_list_t ts\"\n by (auto simp: update_ti_struct_t_def update_ti_list_t_def)\n\nlemma fd_cons_struct_fd_cons_list [simp]:\n \"fd_cons_struct (TypAggregate ts) = fd_cons_list ts\"\n by (clarsimp simp: fd_cons_struct_def fd_cons_list_def)\n\nlemma fd_cons_list_empty [simp]:\n \"fd_cons_list []\"\n by (clarsimp simp: fd_cons_list_def fd_cons_double_update_def\n fd_cons_update_access_def fd_cons_access_update_def fd_cons_length_def\n fd_cons_update_normalise_def update_ti_list_t_def fd_cons_desc_def)\n\nlemma fd_cons_double_update_list_append:\n \"\\ fd_cons_double_update (field_desc_list xs);\n fd_cons_double_update (field_desc_list ys);\n fu_commutes (field_update (field_desc_list xs)) (field_update (field_desc_list ys)) \\ \\\n fd_cons_double_update (field_desc_list (xs@ys))\"\n by (auto simp: fd_cons_double_update_def fu_commutes_def)\n\nlemma fd_cons_update_access_list_append:\n \"\\ fd_cons_update_access (field_desc_list xs) (size_td_list xs);\n fd_cons_update_access (field_desc_list ys) (size_td_list ys);\n fd_cons_length (field_desc_list xs) (size_td_list xs);\n fd_cons_length (field_desc_list ys) (size_td_list ys) \\ \\\n fd_cons_update_access (field_desc_list (xs@ys)) (size_td_list (xs@ys))\"\n by (auto simp: fd_cons_update_access_def fd_cons_length_def access_ti_append)\n\n(* FIXME MOVE *)\nlemma min_ll:\n \"min (x + y) x = (x::nat)\"\n by simp\n\nlemma fd_cons_access_update_list_append:\n \"\\ fd_cons_access_update (field_desc_list xs) (size_td_list xs);\n fd_cons_access_update (field_desc_list ys) (size_td_list ys);\n fu_commutes (field_update (field_desc_list xs)) (field_update (field_desc_list ys)) \\ \\\n fd_cons_access_update (field_desc_list (xs@ys)) (size_td_list (xs@ys))\"\n apply(clarsimp simp: fd_cons_access_update_def)\n apply(drule_tac x=\"take (size_td_list xs) bs\" in spec)\n apply clarsimp\n apply(simp add: access_ti_append)\n apply(drule_tac x=\"drop (size_td_list xs) bs\" in spec)\n apply clarsimp\n apply(drule_tac x=\"take (size_td_list xs) bs'\" in spec)\n apply(simp add: min_ll)\n apply(drule_tac x=\"update_ti_list_t ys (drop (size_td_list xs) bs) v\" in spec)\n apply(drule_tac x=\"update_ti_list_t ys (drop (size_td_list xs) bs) v'\" in spec)\n apply simp\n apply(frule_tac bs=\"take (size_td_list xs) bs\" and\n bs'=\"drop (size_td_list xs) bs\" and v=v in fu_commutes)\n apply clarsimp\n apply(frule_tac bs=\"take (size_td_list xs) bs\" and\n bs'=\"drop (size_td_list xs) bs\" and v=v' in fu_commutes)\n apply clarsimp\n done\n\nlemma fd_cons_length_list_append:\n \"\\ fd_cons_length (field_desc_list xs) (size_td_list xs);\n fd_cons_length (field_desc_list ys) (size_td_list ys) \\ \\\n fd_cons_length (field_desc_list (xs@ys)) (size_td_list (xs@ys))\"\n by (auto simp: fd_cons_length_def access_ti_append)\n\nlemma wf_fdp_insert:\n \"wf_fdp (insert x xs) \\ wf_fdp {x} \\ wf_fdp xs\"\n by (auto simp: wf_fdp_def)\n\nlemma wf_fdp_fd_cons:\n \"\\ wf_fdp X; (t,m) \\ X \\ \\ fd_cons t\"\n by (auto simp: wf_fdp_def)\n\nlemma wf_fdp_fu_commutes:\n \"\\ wf_fdp X; (s,m) \\ X; (t,n) \\ X; \\ m \\ n; \\ n \\ m \\ \\\n fu_commutes (field_update (field_desc s)) (field_update (field_desc t))\"\n by (auto simp: wf_fdp_def)\n\nlemma wf_fdp_fa_fu_ind:\n \"\\ wf_fdp X; (s,m) \\ X; (t,n) \\ X; \\ m \\ n; \\ n \\ m \\ \\\n fa_fu_ind (field_desc s) (field_desc t) (size_td t) (size_td s)\"\n by (auto simp: wf_fdp_def)\n\nlemma wf_fdp_mono:\n \"\\ wf_fdp Y; X \\ Y \\ \\ wf_fdp X\"\n by (fastforce simp: wf_fdp_def)\n\nlemma tf0 [simp]:\n \"tf_set (TypDesc st nm) = {(TypDesc st nm,[])} \\ tf_set_struct st\"\n by (auto simp: tf_set_def tf_set_struct_def)\n\nlemma tf1 [simp]: \"tf_set_struct (TypScalar m algn d) = {}\"\n by (clarsimp simp: tf_set_struct_def)\n\nlemma tf2 [simp]: \"tf_set_struct (TypAggregate xs) = tf_set_list xs\"\n by (auto simp: tf_set_struct_def tf_set_list_def)\n\nlemma tf3 [simp]: \"tf_set_list [] = {}\"\n by (simp add: tf_set_list_def)\n\nlemma tf4: \"tf_set_list (x#xs) = tf_set_pair x \\ {t. t \\ tf_set_list xs \\ snd t \\ snd ` tf_set_pair x}\"\n apply(clarsimp simp: tf_set_list_def tf_set_pair_def)\n apply(cases x)\n apply clarsimp\n apply(rename_tac a b)\n apply(rule equalityI; clarsimp)\n apply(rename_tac a' b')\n apply(case_tac b'; clarsimp)\n apply(erule disjE; clarsimp?)\n apply(fastforce dest: field_lookup_list_offset2 split: option.splits)[1]\n apply (rule conjI; clarsimp)\n apply(rename_tac ys n)\n apply(case_tac ys; clarsimp split: option.splits)\n apply(rule conjI; clarsimp simp: image_def)\n apply(drule_tac m=\"size_td a\" in field_lookup_list_offset3)\n apply fast\n apply(drule_tac m=\"size_td a\" in field_lookup_list_offset3)\n apply fast\n done\n\nlemma tf4D:\n \"t \\ tf_set_list (x#xs) \\ t \\ (tf_set_pair x \\ tf_set_list xs)\"\n by (clarsimp simp: tf4)\n\nlemma tf4' [simp]: \"wf_desc_list (x#xs) \\\n tf_set_list (x#xs) = tf_set_pair x \\ tf_set_list xs\"\n apply(simp add: tf4)\n apply(rule equalityI; clarsimp)\n apply(rename_tac ys)\n apply(clarsimp simp: tf_set_pair_def tf_set_list_def)\n apply(case_tac x, simp)\n apply(clarsimp split: if_split_asm)\n apply(case_tac ys; simp)\n apply(drule_tac fs=list and m=0 in field_lookup_list_None)\n apply fastforce\n done\n\nlemma tf5 [simp]: \"tf_set_pair (DTPair t m) = {(a,m#b) | a b. (a,b) \\ tf_set t}\"\n apply(clarsimp simp: tf_set_pair_def tf_set_def)\n apply(rule equalityI; clarsimp)\n apply(rename_tac xs n)\n apply(case_tac xs; clarsimp)\n done\n\nlemma tf_set_self [simp]:\n \"(t,[]) \\ tf_set t\"\n by (clarsimp simp: tf_set_def)\n\n\nlemma tf_set_list_mem [rule_format]:\n \"\\t n. wf_desc_list ts \\ DTPair t n \\ set ts \\ (t,[n]) \\ tf_set_list ts\"\n by (induct_tac ts) auto\n\nlemma tf_set_list_append [rule_format]:\n \"\\ys. wf_desc_list (xs@ys) \\ tf_set_list (xs@ys) = tf_set_list xs \\ tf_set_list ys\"\n apply(induct_tac xs; clarsimp)\n apply(subst tf4'; fastforce)\n done\n\nlemma lf_set_list_append [simp]:\n \"lf_set_list (xs@ys) fn = lf_set_list xs fn \\ lf_set_list ys fn\"\n by (induct_tac xs) auto\n\nlemma ti_ind_sym:\n \"ti_ind X Y \\ ti_ind Y X\"\n by (auto simp: ti_ind_def fu_commutes_def)\n\nlemma ti_ind_sym2:\n \"ti_ind X Y = ti_ind Y X\"\n by (blast dest: ti_ind_sym)\n\nlemma ti_ind_list [simp]:\n \"ti_ind (X \\ Y) Z = (ti_ind X Z \\ ti_ind Y Z)\"\n unfolding ti_ind_def by auto\n\nlemma ti_empty [simp]:\n \"ti_ind {} X\"\n by (simp add: ti_ind_def)\n\nlemma wf_lf_list:\n \"lf_fn ` X \\ lf_fn ` Y = {} \\\n wf_lf (X \\ Y) = (wf_lf X \\ wf_lf Y \\ ti_ind X Y)\"\n unfolding wf_lf_def ti_ind_def field_desc_def fu_commutes_def\n apply (rule iffI; clarsimp)\n apply(frule_tac x=x in spec)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(drule_tac x=y in spec)\n apply(drule_tac x=x in spec)\n apply clarsimp\n apply fastforce\n apply fast\n done\n\nlemma wf_lf_listD:\n \"wf_lf (X \\ Y) \\ wf_lf X \\ wf_lf Y\"\n unfolding wf_lf_def ti_ind_def field_desc_def fu_commutes_def by clarsimp\n\nlemma ti_ind_fn:\n \"\\fn. ti_ind (lf_set t fn) Y = ti_ind (lf_set t []) Y\"\n \"\\fn. ti_ind (lf_set_struct st fn) Y = ti_ind (lf_set_struct st []) Y\"\n \"\\fn. ti_ind (lf_set_list ts fn) Y = ti_ind (lf_set_list ts []) Y\"\n \"\\fn. ti_ind (lf_set_pair x fn) Y = ti_ind (lf_set_pair x []) Y\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply (fastforce simp: ti_ind_def)\n apply auto\n done\n\nlemma ti_ind_ld_td':\n \"ti_ind (lf_set t []) Y \\ ti_ind {t2d (t,[])} Y\"\n \"ti_ind (lf_set_struct st []) Y \\ ti_ind {\\ lf_fd = field_desc_struct st, lf_sz = size_td_struct st, lf_fn = [] \\} Y\"\n \"ti_ind (lf_set_list ts []) Y \\ ti_ind {\\ lf_fd = field_desc_list ts, lf_sz = size_td_list ts, lf_fn = [] \\} Y\"\n \"ti_ind (lf_set_pair x []) Y \\ ti_ind {\\ lf_fd = field_desc_pair x, lf_sz = size_td_pair x, lf_fn = [] \\} Y\"\n apply(induct t and st and ts and x, all \\clarsimp simp: t2d_def\\)\n apply((clarsimp simp: ti_ind_def fu_commutes_def fa_fu_ind_def)+)[3]\n apply(subst (asm) ti_ind_fn)\n apply simp\n done\n\nlemma ti_ind_ld_td_struct:\n \"ti_ind (lf_set_struct st fn) Y \\\n ti_ind {\\ lf_fd = field_desc_struct st, lf_sz = size_td_struct st, lf_fn = [] \\} Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld_td')\n\nlemma ti_ind_ld_td_list:\n \"ti_ind (lf_set_list ts fn) Y \\\n ti_ind {\\ lf_fd = field_desc_list ts, lf_sz = size_td_list ts, lf_fn = [] \\} Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld_td')\n\nlemma ti_ind_ld_td_pair:\n \"ti_ind (lf_set_pair x fn) Y \\\n ti_ind {\\ lf_fd = field_desc_pair x, lf_sz = size_td_pair x, lf_fn = [] \\} Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld_td')\n\nlemma ti_ind_ld':\n \"ti_ind (lf_set t []) Y \\ ti_ind (t2d ` (tf_set t)) Y\"\n \"ti_ind (lf_set_struct st []) Y \\ ti_ind (t2d ` (tf_set_struct st)) Y\"\n \"ti_ind (lf_set_list ts []) Y \\ ti_ind (t2d ` (tf_set_list ts)) Y\"\n \"ti_ind (lf_set_pair x []) Y \\ ti_ind (t2d ` (tf_set_pair x)) Y\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(frule ti_ind_ld_td_struct)\n apply(subst insert_def)\n apply(subst ti_ind_list)\n apply(clarsimp simp: ti_ind_def t2d_def)\n apply(clarsimp simp: ti_ind_def t2d_def)\n apply(drule tf4D)\n apply clarsimp\n apply(erule disjE)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=\"t2d (a,b)\" in spec)\n apply(thin_tac \"\\x y. P x y\" for P)\n apply(drule_tac x=\"y\" in spec)\n apply(fastforce simp: t2d_def image_def)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=\"t2d (a,b)\" in spec)\n apply(drule_tac x=\"y\" in spec)\n apply(fastforce simp: t2d_def image_def)\n apply(rotate_tac)\n apply(subst (asm) ti_ind_fn)\n apply(simp add: t2d_def)\n apply(clarsimp simp: ti_ind_def)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=\"t2d (aa,ba)\" in spec)\n apply(drule_tac x=y in spec)\n apply(fastforce simp: t2d_def image_def)\n done\n\nlemma ti_ind_ld:\n \"ti_ind (lf_set t fn) Y \\ ti_ind (t2d ` (tf_set t)) Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld')\n\nlemma ti_ind_ld_struct:\n \"ti_ind (lf_set_struct t fn) Y \\ ti_ind (t2d ` (tf_set_struct t)) Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld')\n\nlemma ti_ind_ld_list:\n \"ti_ind (lf_set_list t fn) Y \\ ti_ind (t2d ` (tf_set_list t)) Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld')\n\nlemma ti_ind_ld_pair:\n \"ti_ind (lf_set_pair t fn) Y \\ ti_ind (t2d ` (tf_set_pair t)) Y\"\n by (subst (asm) ti_ind_fn) (simp only: ti_ind_ld')\n\nlemma lf_set_fn':\n \"\\s fn. s \\ lf_set (t::'a typ_info) fn \\ fn \\ lf_fn s\"\n \"\\s fn. s \\ lf_set_struct (st::'a typ_info_struct) fn \\ fn \\ lf_fn s\"\n \"\\s fn. s \\ lf_set_list (ts::'a typ_info_pair list) fn \\ fn \\ lf_fn s\"\n \"\\s fn. s \\ lf_set_pair (x::'a typ_info_pair) fn \\ fn \\ lf_fn s\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"fn @ [list]\" in spec)\n apply(clarsimp simp: prefix_def less_eq_list_def)\n done\n\nlemma lf_set_fn:\n \"s \\ lf_set (t::'a typ_info) fn \\ fn \\ lf_fn s\"\n by (clarsimp simp: lf_set_fn')\n\nlemma ln_fn_disj [rule_format]:\n \"\\x. dt_snd x \\ dt_snd ` set xs \\ lf_fn ` lf_set_pair x fn \\ lf_fn ` lf_set_list xs fn = {}\"\n apply (induct_tac xs; clarsimp)\n apply (rule set_eqI, clarsimp)\n apply (erule disjE)\n apply (clarsimp dest!: lf_set_fn simp: split_DTPair_all prefix_def less_eq_list_def)\n apply fastforce\n done\n\nlemma wf_lf_fn:\n \"\\fn. wf_desc t \\ wf_lf (lf_set (t::'a typ_info) fn) = wf_lf (lf_set t [])\"\n \"\\fn. wf_desc_struct st \\ wf_lf (lf_set_struct (st::'a typ_info_struct) fn) = wf_lf (lf_set_struct st [])\"\n \"\\fn. wf_desc_list ts \\ wf_lf (lf_set_list (ts::'a typ_info_pair list) fn) = wf_lf (lf_set_list ts [])\"\n \"\\fn. wf_desc_pair x \\ wf_lf (lf_set_pair (x::'a typ_info_pair) fn) = wf_lf (lf_set_pair x [])\"\n apply(induct t and st and ts and x)\n apply clarify\n apply(drule_tac x=fn in spec)\n apply clarsimp\n apply clarsimp\n apply(clarsimp simp: wf_lf_def)\n apply clarify\n apply(drule_tac x=fn in spec)\n apply clarsimp\n apply(clarsimp simp: wf_lf_def)\n apply clarify\n apply(drule_tac x=fn in spec)+\n apply clarsimp\n apply(subst wf_lf_list)\n apply(erule ln_fn_disj)\n apply(subst wf_lf_list)\n apply(erule ln_fn_disj)\n apply clarsimp\n apply(subst ti_ind_fn)\n apply(subst ti_ind_sym2)\n apply(subst ti_ind_fn)\n apply(subst ti_ind_sym2)\n apply(clarsimp)\n apply clarify\n apply(frule_tac x=\"[list]\" in spec)\n apply(drule_tac x=\"fn@[list]\" in spec)\n apply clarsimp\n done\n\nlemma wf_lf_fd_cons':\n \"\\m. wf_lf (lf_set (t::'a typ_info) []) \\ wf_desc t \\ fd_cons t\"\n \"\\m. wf_lf (lf_set_struct (st::'a typ_info_struct) []) \\ wf_desc_struct st \\ fd_cons_struct st\"\n \"\\m. wf_lf (lf_set_list (ts::'a typ_info_pair list) []) \\ wf_desc_list ts \\ fd_cons_list ts\"\n \"\\m. wf_lf (lf_set_pair (x::'a typ_info_pair) []) \\ wf_desc_pair x \\ fd_cons_pair x\"\n apply(induct t and st and ts and x)\n apply clarsimp\n apply(clarsimp simp: wf_lf_def fd_cons_struct_def fd_cons_def)\n apply(clarsimp simp: fd_cons_desc_def fd_cons_double_update_def fd_cons_update_access_def\n fd_cons_access_update_def fd_cons_length_def)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply(subst (asm) wf_lf_list)\n apply(erule ln_fn_disj)\n apply clarsimp\n apply(drule ti_ind_ld_td_pair)\n apply(drule ti_ind_sym)\n apply(drule ti_ind_ld_td_list)\n apply(drule ti_ind_sym)\n apply(clarsimp simp: ti_ind_def)\n apply(clarsimp simp: fd_cons_list_def fd_cons_desc_def)\n apply(rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_double_update_def fd_cons_desc_def)\n apply(simp add: fu_commutes_def)\n apply(rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_update_access_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_length_def)\n apply(rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_access_update_def)\n apply(simp add: fu_commutes_def)\n apply(clarsimp simp: fa_fu_ind_def)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(thin_tac \"All P\" for P)\n apply(rotate_tac -4)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs\" in spec)\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(simp add: min_ll)\n apply(drule_tac x=v in spec)\n apply(drule_tac x=v' in spec)\n apply simp\n apply(clarsimp simp: fd_cons_length_def fd_cons_pair_def fd_cons_desc_def)\n apply clarsimp\n apply(rotate_tac)\n apply(subst (asm) wf_lf_fn, assumption)\n apply(clarsimp simp: fd_cons_def fd_cons_pair_def export_uinfo_def)\n done\n\nlemma wf_lf_fd_cons:\n \"\\ wf_lf (lf_set t fn); wf_desc t \\ \\ fd_cons t\"\n by (subst (asm) wf_lf_fn; simp only: wf_lf_fd_cons')\n\nlemma wf_lf_fd_cons_struct:\n \"\\ wf_lf (lf_set_struct t fn); wf_desc_struct t \\ \\ fd_cons_struct t\"\n by (subst (asm) wf_lf_fn; simp only: wf_lf_fd_cons')\n\nlemma wf_lf_fd_cons_list:\n \"\\ wf_lf (lf_set_list t fn); wf_desc_list t \\ \\ fd_cons_list t\"\n by (subst (asm) wf_lf_fn; simp only: wf_lf_fd_cons')\n\nlemma wf_lf_fd_cons_pair:\n \"\\ wf_lf (lf_set_pair t fn); wf_desc_pair t \\ \\ fd_cons_pair t\"\n by (subst (asm) wf_lf_fn; simp only: wf_lf_fd_cons')\n\nlemma wf_lf_fdp':\n \"\\m. wf_lf (lf_set (t::'a typ_info) []) \\ wf_desc t \\ wf_fdp (tf_set t)\"\n \"\\m. wf_lf (lf_set_struct (st::'a typ_info_struct) []) \\ wf_desc_struct st \\ wf_fdp (tf_set_struct st)\"\n \"\\m. wf_lf (lf_set_list (ts::'a typ_info_pair list) []) \\ wf_desc_list ts \\ wf_fdp (tf_set_list ts)\"\n \"\\m. wf_lf (lf_set_pair (x::'a typ_info_pair) []) \\ wf_desc_pair x \\ wf_fdp (tf_set_pair x)\"\n apply(induct t and st and ts and x, all \\clarsimp simp: wf_fdp_def\\)\n apply (fastforce elim: wf_lf_fd_cons_struct)\n apply(subst (asm) wf_lf_list)\n apply(erule ln_fn_disj)\n apply clarsimp\n apply(drule ti_ind_ld_pair)\n apply(drule ti_ind_sym)\n apply(drule ti_ind_ld_list)\n apply(drule ti_ind_sym)\n apply(rule conjI, clarsimp)\n apply(erule disjE, fast)\n apply(clarsimp simp: ti_ind_def t2d_def)\n apply(drule_tac x=\"t2d (x,m)\" in spec)\n apply(drule_tac x=\"t2d (y,n)\" in spec)\n apply(clarsimp simp: t2d_def image_def)\n apply(erule impE)\n apply(rule conjI)\n apply(rule_tac x=\"(x,m)\" in bexI)\n apply clarsimp\n apply assumption\n apply(rule_tac x=\"(y,n)\" in bexI)\n apply clarsimp\n apply assumption\n apply clarsimp\n apply clarsimp\n apply(erule disjE)\n apply(clarsimp simp: ti_ind_def t2d_def)\n apply(drule_tac x=\"t2d (y,n)\" in spec)\n apply(drule_tac x=\"t2d (x,m)\" in spec)\n apply(clarsimp simp: t2d_def image_def)\n apply(erule impE)\n apply(rule)\n apply(rule_tac x=\"(y,n)\" in bexI)\n apply clarsimp\n apply assumption\n apply(rule_tac x=\"(x,m)\" in bexI)\n apply clarsimp\n apply assumption\n apply clarsimp\n apply(clarsimp simp: fu_commutes_def)\n apply fast\n apply(rotate_tac)\n apply(subst (asm) wf_lf_fn, assumption)\n apply(clarsimp simp: wf_fdp_def)\n apply fast\n done\n\nlemma wf_lf_fdp:\n \"\\ wf_lf (lf_set t []); wf_desc t \\ \\ wf_fdp (tf_set t)\"\n by (simp only: wf_lf_fdp')\n\nlemma wf_fd_field_lookup [rule_format]:\n \"\\f m n s. wf_fd (t::'a typ_info) \\ field_lookup t f m = Some (s,n) \\ wf_fd s\"\n \"\\f m n s. wf_fd_struct (st::'a typ_info_struct) \\ field_lookup_struct st f m = Some (s,n) \\ wf_fd s\"\n \"\\f m n s. wf_fd_list (ts::'a typ_info_pair list) \\ field_lookup_list ts f m = Some (s,n) \\ wf_fd s\"\n \"\\f m n s. wf_fd_pair (x::'a typ_info_pair) \\ field_lookup_pair x f m = Some (s,n) \\ wf_fd s\"\n by (induct t and st and ts and x) (clarsimp split: option.splits)+\n\nlemma wf_fd_field_lookupD:\n \"\\ field_lookup t f m = Some (s,n); wf_fd t \\ \\ wf_fd s\"\n by (rule wf_fd_field_lookup)\n\nlemma wf_fd_tf_set:\n \"\\ wf_fd t; ((s::'a typ_info),m) \\ tf_set t \\ \\ wf_fd s\"\n by (fastforce simp: tf_set_def wf_fd_field_lookupD)\n\nlemma tf_set_field_lookupD:\n \"field_lookup t f m = Some (s,n) \\ (s,f) \\ tf_set t\"\n unfolding tf_set_def\n by (clarsimp simp flip: field_lookup_offset[where m=m] dest!: field_lookup_offset_le) arith\n\nlemma fu_commutes_ts [rule_format]:\n \"(\\t. t \\ dt_fst ` set ts \\ fu_commutes d (update_ti_t t)) \\\n fu_commutes d (update_ti_list_t ts)\"\n by (induct ts; clarsimp simp: fu_commutes_def) (clarsimp simp: split_DTPair_all)\n\nlemma fa_fu_ind_ts [rule_format]:\n \"(\\t. t \\ dt_fst ` set ts \\ fa_fu_ind d (field_desc t) (size_td t) n) \\\n fa_fu_ind d \\ field_access = access_ti_list ts,\n field_update = update_ti_list_t ts\\\n (size_td_list ts) n\"\n by (induct ts; clarsimp simp: fa_fu_ind_def) (clarsimp simp: split_DTPair_all)\n\nlemma fa_fu_ind_ts2 [rule_format]:\n \"(\\t. t \\ dt_fst ` set ts \\ fa_fu_ind (field_desc t) d n (size_td t)) \\\n fa_fu_ind \\ field_access = access_ti_list ts,\n field_update = update_ti_list_t ts\\ d\n n (size_td_list ts)\"\n by (induct ts; clarsimp simp: fa_fu_ind_def) (clarsimp simp: split_DTPair_all)\n\nlemma wf_fdp_fd [rule_format]:\n \"\\m. wf_fdp (tf_set t) \\ wf_desc t \\ wf_fd (t::'a typ_info)\"\n \"\\m. (case st of TypScalar sz algn d \\ fd_cons_struct (TypScalar sz algn d)\n | _ \\ wf_fdp (tf_set_struct st)) \\ wf_desc_struct st \\ wf_fd_struct (st::'a typ_info_struct)\"\n \"\\m. wf_fdp (tf_set_list ts) \\ wf_desc_list ts \\ wf_fd_list (ts::'a typ_info_pair list)\"\n \"\\m. wf_fdp (tf_set_pair x) \\ wf_desc_pair x \\ wf_fd_pair (x::'a typ_info_pair)\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(clarsimp split: typ_struct.split_asm)\n apply(clarsimp simp: wf_fdp_def fd_cons_def fd_cons_struct_def)\n apply (fastforce dest: wf_fdp_mono)\n apply (rename_tac dt_pair xs)\n apply (rule conjI, fastforce dest: wf_fdp_mono)\n apply (rule conjI)\n apply(subgoal_tac \"wf_fdp (tf_set_list xs)\", simp)\n apply (fastforce elim: wf_fdp_mono)\n apply(clarsimp simp: wf_fdp_def)\n apply(case_tac dt_pair, clarsimp)\n apply(rename_tac a b)\n apply(frule_tac x=a in spec)\n apply(drule_tac x=\"[b]\" in spec)\n apply clarsimp\n apply (rule conjI)\n apply(rule fu_commutes_ts)\n apply clarsimp\n apply(rename_tac x)\n apply(drule_tac x=\"dt_fst x\" in spec, erule impE, rule_tac x=\"[dt_snd x]\" in exI)\n apply(fastforce simp: image_iff tf_set_list_mem)\n apply simp\n apply(rule conjI)\n apply(rule fa_fu_ind_ts)\n apply clarsimp\n apply(rename_tac x)\n apply(drule_tac x=\"dt_fst x\" in spec, erule impE, rule_tac x=\"[dt_snd x]\" in exI)\n apply(fastforce simp: image_iff tf_set_list_mem)\n apply simp\n apply(rule fa_fu_ind_ts2)\n apply(drule_tac x=t in spec)\n apply clarsimp\n apply(case_tac x, clarsimp)\n apply(rename_tac aa ba)\n apply(drule_tac x=\"[ba]\" in spec)\n apply clarsimp\n apply(simp add: tf_set_list_mem)\n apply clarsimp\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=a in spec)\n apply (erule impE, rule_tac x=\"[b]\" in exI)\n apply simp\n apply(rule, clarsimp)\n apply(clarsimp simp: image_def)\n apply(drule_tac x=\"DTPair aa b\" in bspec, simp+)[1]\n apply(clarsimp simp: image_def)\n apply(drule_tac x=\"DTPair aa ba\" in bspec, simp+)[1]\n apply simp\n apply(clarsimp simp: wf_fdp_def)\n apply(drule_tac x=x in spec)\n apply(drule_tac x=\"list#m\" in spec)\n apply clarsimp\n apply(drule_tac x=y in spec)\n apply auto\n done\n\nlemma wf_fdp_fdD:\n \"\\ wf_fdp (tf_set t); wf_desc t \\ \\ wf_fd (t::'a typ_info)\"\n by (rule wf_fdp_fd)\n\nlemma wf_fdp_fd_listD:\n \"\\ wf_fdp (tf_set_list t); wf_desc_list t \\ \\ wf_fd_list t\"\n by (rule wf_fdp_fd)\n\nlemma fd_consistentD:\n \"\\ field_lookup t f 0 = Some (s,n); fd_consistent t \\\n \\ fd_cons s\"\n by (fastforce simp: fd_consistent_def)\n\nlemma wf_fd_cons_access_update' [rule_format]:\n \"wf_fd (t::'a typ_info) \\ fd_cons_access_update (field_desc t) (size_td t)\"\n \"wf_fd_struct (st::'a typ_info_struct) \\ fd_cons_access_update (field_desc_struct st) (size_td_struct st)\"\n \"wf_fd_list (ts::'a typ_info_pair list) \\ fd_cons_access_update (field_desc_list ts) (size_td_list ts)\"\n \"wf_fd_pair (x::'a typ_info_pair) \\ fd_cons_access_update (field_desc_pair x) (size_td_pair x)\"\n apply(induct t and st and ts and x, all \\clarsimp split: typ_struct.splits\\)\n apply(clarsimp simp: fd_cons_access_update_def fd_cons_struct_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_access_update_def)\n apply(clarsimp simp: fd_cons_access_update_def)\n apply(simp add: fu_commutes_def)\n apply(clarsimp simp: fa_fu_ind_def)\n apply(drule_tac x=\"(take (size_td_pair dt_pair) bs)\" in spec)\n apply(erule impE)\n apply(clarsimp simp: min_def split: if_split_asm)\n apply(rotate_tac -1)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(simp add: min_ll)\n apply(rotate_tac -1)\n apply(drule_tac x=v in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=v' in spec)\n apply simp\n done\n\n\nlemma wf_fd_cons_access_updateD:\n \"wf_fd t \\ fd_cons_access_update (field_desc t) (size_td t)\"\n by (rule wf_fd_cons_access_update')\n\nlemma wf_fd_cons_access_update_structD:\n \"wf_fd_struct t \\ fd_cons_access_update (field_desc_struct t) (size_td_struct t)\"\n by (rule wf_fd_cons_access_update')\n\nlemma wf_fd_cons_access_update_listD:\n \"wf_fd_list t \\ fd_cons_access_update (field_desc_list t) (size_td_list t)\"\n by (rule wf_fd_cons_access_update')\n\nlemma wf_fd_cons_access_update_pairD:\n \"wf_fd_pair t \\ fd_cons_access_update (field_desc_pair t) (size_td_pair t)\"\n by (rule wf_fd_cons_access_update')\n\nlemma wf_fd_norm_tu:\n \"\\bs. wf_fd t \\ length bs = size_td t \\ norm_tu (export_uinfo (t::'a typ_info)) bs = (access_ti t (update_ti_t t bs undefined) (replicate (size_td t) 0))\"\n \"\\bs. wf_fd_struct st \\ length bs = size_td_struct st \\ norm_tu_struct (map_td_struct field_norm (st::'a typ_info_struct)) bs = (access_ti_struct st (update_ti_struct_t st bs undefined) (replicate (size_td_struct st) 0))\"\n \"\\bs. wf_fd_list ts \\ length bs = size_td_list ts \\ norm_tu_list (map_td_list field_norm (ts::'a typ_info_pair list)) bs = (access_ti_list ts (update_ti_list_t ts bs undefined) (replicate (size_td_list ts) 0))\"\n \"\\bs. wf_fd_pair x \\ length bs = size_td_pair x \\ norm_tu_pair (map_td_pair field_norm (x::'a typ_info_pair)) bs = (access_ti_pair x (update_ti_pair_t x bs undefined) (replicate (size_td_pair x) 0))\"\n apply(induct t and st and ts and x, all \\clarsimp simp: export_uinfo_def\\)\n apply(simp add: field_norm_def)\n apply(simp add: fu_commutes_def)\n apply(simp add: fa_fu_ind_def)\n apply(drule wf_fd_cons_access_update_listD)\n apply(clarsimp simp: fd_cons_access_update_def export_uinfo_def min_def)\n done\n\nlemma wf_fd_norm_tuD:\n \"\\ wf_fd t; length bs = size_td t \\ \\ norm_tu (export_uinfo t) bs =\n (access_ti\\<^sub>0 t (update_ti_t t bs undefined))\"\n using wf_fd_norm_tu(1) [of t] by (clarsimp simp: access_ti\\<^sub>0_def)\n\nlemma wf_fd_norm_tu_structD:\n \"\\ wf_fd_struct t; length bs = size_td_struct t \\ \\ norm_tu_struct (map_td_struct field_norm t) bs =\n (access_ti_struct t (update_ti_struct_t t bs undefined) (replicate (size_td_struct t) 0))\"\n using wf_fd_norm_tu(2) [of t] by clarsimp\n\nlemma wf_fd_norm_tu_listD:\n \"\\ wf_fd_list t; length bs = size_td_list t \\ \\ norm_tu_list (map_td_list field_norm t) bs =\n (access_ti_list t (update_ti_list_t t bs undefined) (replicate (size_td_list t) 0))\"\n using wf_fd_norm_tu(3) [of t] by clarsimp\n\nlemma wf_fd_norm_tu_pairD:\n \"\\ wf_fd_pair t; length bs = size_td_pair t \\ \\ norm_tu_pair (map_td_pair field_norm t) bs =\n (access_ti_pair t (update_ti_pair_t t bs undefined) (replicate (size_td_pair t) 0))\"\n using wf_fd_norm_tu(4) [of t] by clarsimp\n\nlemma wf_fd_cons [rule_format]:\n \"wf_fd t \\ fd_cons (t::'a typ_info)\"\n \"wf_fd_struct st \\ fd_cons_struct (st::'a typ_info_struct)\"\n \"wf_fd_list ts \\ fd_cons_list (ts::'a typ_info_pair list)\"\n \"wf_fd_pair x \\ fd_cons_pair (x::'a typ_info_pair)\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(clarsimp simp: fd_cons_list_def fd_cons_desc_def)\n apply (rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_double_update_def fd_cons_desc_def)\n apply(simp add: fu_commutes_def)\n apply (rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_update_access_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_length_def)\n apply (rule conjI)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_access_update_def fu_commutes_def fa_fu_ind_def)\n apply(rotate_tac -4)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs\" in spec)\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(simp add: min_ll)\n apply(rotate_tac -1)\n apply(drule_tac x=v in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=v' in spec)\n apply simp\n apply(clarsimp simp: fd_cons_length_def fd_cons_pair_def fd_cons_desc_def)\n apply(clarsimp simp: fd_cons_def fd_cons_pair_def export_uinfo_def)\n done\n\nlemma wf_fd_consD:\n \"wf_fd t \\ fd_cons t\"\n by (rule wf_fd_cons)\n\nlemma wf_fd_cons_structD:\n \"wf_fd_struct t \\ fd_cons_struct t\"\n by (rule wf_fd_cons)\n\nlemma wf_fd_cons_listD:\n \"wf_fd_list t \\ fd_cons_list t\"\n by (rule wf_fd_cons)\n\nlemma wf_fd_cons_pairD:\n \"wf_fd_pair t \\ fd_cons_pair t\"\n by (rule wf_fd_cons)\n\nlemma fd_cons_list_append:\n \"\\ wf_fd_list xs; wf_fd_list ys; fu_commutes\n (field_update (field_desc_list xs)) (field_update (field_desc_list ys)) \\ \\\n fd_cons_list (xs@ys)\"\n apply(frule wf_fd_cons_listD)\n apply(frule wf_fd_cons_listD [where t=ys])\n apply(unfold fd_cons_list_def fd_cons_desc_def)\n apply(fastforce intro: fd_cons_double_update_list_append fd_cons_update_access_list_append\n fd_cons_access_update_list_append fd_cons_length_list_append)\n done\n\n\nlemma wf_fd [simp]:\n \"wf_fd (typ_info_t TYPE('a::wf_type))\"\n by (fastforce intro: wf_fdp_fdD wf_lf_fdp wf_lf)\n\nlemma fd_cons [simp]:\n \"fd_consistent (typ_info_t TYPE('a::wf_type))\"\n unfolding fd_consistent_def by (fastforce intro: wf_fd_consD wf_fd_field_lookupD)\n\nlemma field_lvalue_append [simp]:\n \"\\ field_ti TYPE('b::wf_type) f = Some t;\n export_uinfo t = typ_uinfo_t TYPE('a::c_type);\n field_ti TYPE('a) g = Some k \\ \\\n &(((Ptr &((p::'b ptr)\\f))::'a ptr)\\g) = &(p\\f@g)\"\n apply(clarsimp simp: field_lvalue_def field_ti_def field_offset_def\n field_offset_untyped_def typ_uinfo_t_def\n split: option.splits)\n apply(subst field_lookup_prefix_Some')\n apply(fastforce dest: field_lookup_export_uinfo_Some)\n apply(simp add: export_uinfo_def wf_desc_map)\n apply(drule field_lookup_export_uinfo_Some)\n apply(simp add: export_uinfo_def)\n apply(drule field_lookup_export_uinfo_Some)\n apply(simp add: export_uinfo_def)\n apply(rename_tac m n)\n apply(subgoal_tac \"field_lookup (typ_uinfo_t TYPE('a)) g m = Some (export_uinfo k, m + n)\")\n apply(simp add: typ_uinfo_t_def export_uinfo_def)\n apply(simp add: typ_uinfo_t_def field_lookup_offset export_uinfo_def)\n done\n\nlemma field_access_update_take_drop [rule_format]:\n \"\\f s m n bs bs' v. field_lookup t f m = Some (s,m+n) \\\n length bs = size_td t \\ length bs' = size_td s \\ wf_fd t \\\n field_access (field_desc s) (field_update (field_desc t) bs v) bs'\n = field_access (field_desc s) (field_update (field_desc s)\n (take (size_td (s::'a typ_info)) (drop n bs)) undefined) bs'\"\n \"\\f s m n bs bs' v. field_lookup_struct st f m = Some (s,m+n) \\\n length bs = size_td_struct st \\ length bs' = size_td s \\ wf_fd_struct st \\\n field_access (field_desc s) (field_update (field_desc_struct st) bs v) bs'\n = field_access (field_desc s) (field_update (field_desc s)\n (take (size_td (s::'a typ_info)) (drop n bs)) undefined) bs'\"\n \"\\f s m n bs bs' v. field_lookup_list ts f m = Some (s,m+n) \\\n length bs = size_td_list ts \\ length bs' = size_td s \\ wf_fd_list ts \\\n field_access (field_desc s) (field_update (field_desc_list ts) bs v) bs'\n = field_access (field_desc s) (field_update (field_desc s)\n (take (size_td (s::'a typ_info)) (drop n bs)) undefined) bs'\"\n \"\\f s m n bs bs' v. field_lookup_pair x f m = Some (s,m+n) \\\n length bs = size_td_pair x \\ length bs' = size_td s \\ wf_fd_pair x \\\n field_access (field_desc s) (field_update (field_desc_pair x) bs v) bs'\n = field_access (field_desc s) (field_update (field_desc s)\n (take (size_td (s::'a typ_info)) (drop n bs)) undefined) bs'\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(fastforce dest!: wf_fd_cons_structD\n simp: fd_cons_struct_def fd_cons_desc_def fd_cons_access_update_def)\n apply(clarsimp simp: fd_cons_desc_def split: option.splits)\n apply(case_tac f; clarsimp)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=\"a#lista\" in spec)\n apply(drule_tac x=\"s\" in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=\"n - size_td (dt_fst dt_pair)\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply simp\n apply(case_tac dt_pair, clarsimp simp: fu_commutes_def)\n apply(case_tac f; clarsimp)\n apply(drule_tac x=\"a#lista\" in spec)\n apply(drule_tac x=\"s\" in spec)\n apply(drule_tac x=\"m\" in spec)\n apply(drule_tac x=\"n\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply simp\n apply(case_tac dt_pair, clarsimp)\n apply(clarsimp split: if_split_asm)\n by(fastforce dest: td_set_field_lookupD td_set_offset_size_m simp: ac_simps drop_take min_def)\n\nlemma field_access_update_take_dropD:\n \"\\ field_lookup t f m = Some (s,m+n); length bs = size_td t;\n length bs' = size_td s; wf_fd t \\ \\\n field_access (field_desc s) (field_update (field_desc t) bs v) bs'\n = field_access (field_desc s) (field_update (field_desc s)\n (take (size_td (s::'a typ_info)) (drop n bs)) undefined) bs'\"\n by (rule field_access_update_take_drop)\n\nlemma fi_fa_consistentD:\n \"\\ field_lookup (typ_info_t TYPE('a::wf_type)) f 0 = Some (d,n);\n length bs = size_of TYPE('a) \\ \\\n field_access (field_desc d) (from_bytes bs) (replicate (size_td d) 0) =\n norm_tu (export_uinfo d) (take (size_td d) (drop n bs))\"\n apply(clarsimp simp: field_offset_def from_bytes_def size_of_def)\n apply(frule field_lookup_export_uinfo_Some)\n apply(subst wf_fd_norm_tuD)\n apply(fastforce intro: wf_fd_field_lookupD)\n apply(clarsimp simp: min_def split: if_split_asm)\n apply(drule td_set_field_lookupD)\n apply(drule td_set_offset_size)\n apply simp\n apply(frule field_access_update_take_dropD[where v=undefined and m=0 and\n bs'=\"replicate (size_td d) 0\",simplified]; simp?)\n apply(simp add: min_def access_ti\\<^sub>0_def)\n done\n\nlemma length_super_update_bs [simp]:\n \"n + length v \\ length bs \\ length (super_update_bs v bs n) = length bs\"\n unfolding super_update_bs_def by simp\n\nlemma drop_super_update_bs:\n \"\\ k \\ n; n \\ length bs \\ \\ drop k (super_update_bs v bs n) = super_update_bs v (drop k bs) (n - k)\"\n by (simp add: super_update_bs_def take_drop)\n\nlemma drop_super_update_bs2:\n \"\\ n \\ length bs; n + length v \\ k \\ \\\n drop k (super_update_bs v bs n) = drop k bs\"\n by (clarsimp simp: super_update_bs_def min_def split: if_split_asm)\n\nlemma take_super_update_bs:\n \"\\ k \\ n; n \\ length bs \\ \\ take k (super_update_bs v bs n) = take k bs\"\n by (clarsimp simp: super_update_bs_def min_def split: if_split_asm)\n\nlemma take_super_update_bs2:\n \"\\ n \\ length bs; n + length v \\ k \\ \\\n take k (super_update_bs v bs n) = super_update_bs v (take k bs) n\"\n apply (clarsimp simp: super_update_bs_def min_def split: if_split_asm)\n apply (case_tac \"n=k\"; simp add: drop_take)\n done\n\nlemma fi_fu_consistent [rule_format]:\n \"\\f m n s bs v w. field_lookup t f m = Some (s,n + m) \\ wf_fd t \\\n length bs = size_td t \\ length v = size_td (s::'a typ_info) \\\n field_update (field_desc t) (super_update_bs v bs n) w =\n field_update (field_desc s) v (field_update (field_desc t) bs w)\"\n \"\\f m n s bs v w. field_lookup_struct st f m = Some (s,n + m) \\ wf_fd_struct st \\\n length bs = size_td_struct st \\ length v = size_td (s::'a typ_info) \\\n field_update (field_desc_struct st) (super_update_bs v bs n) w =\n field_update (field_desc s) v (field_update (field_desc_struct st) bs w)\"\n \"\\f m n s bs v w. field_lookup_list ts f m = Some (s,n + m) \\ wf_fd_list ts \\\n length bs = size_td_list ts \\ length v = size_td (s::'a typ_info) \\\n field_update (field_desc_list ts) (super_update_bs v bs n) w =\n field_update (field_desc s) v (field_update (field_desc_list ts) bs w)\"\n \"\\f m n s bs v w. field_lookup_pair x f m = Some (s,n + m) \\ wf_fd_pair x \\\n length bs = size_td_pair x \\ length v = size_td (s::'a typ_info) \\\n field_update (field_desc_pair x) (super_update_bs v bs n) w =\n field_update (field_desc s) v (field_update (field_desc_pair x) bs w)\"\n apply(induct t and st and ts and x, all \\clarsimp\\)\n apply(drule wf_fd_cons_structD)\n apply(clarsimp simp: fd_cons_struct_def fd_cons_double_update_def super_update_bs_def\n fd_cons_desc_def)\n apply(case_tac f; clarsimp)\n apply(clarsimp simp: fd_cons_desc_def split: option.splits)\n apply(clarsimp simp: fu_commutes_def)\n apply(rotate_tac -3)\n apply(drule_tac x=\"a#lista\" in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=\"n - size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=s in spec)\n apply(frule field_lookup_offset_le)\n apply simp\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_offset_size_m)\n apply(clarsimp simp: split_DTPair_all drop_super_update_bs take_super_update_bs)\n apply(simp add: fu_commutes_def)\n apply(drule_tac x=w in spec)\n apply(frule_tac x=\"take (size_td_pair dt_pair) (super_update_bs v bs n)\" in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=\"drop (size_td_pair dt_pair) (super_update_bs v bs n)\" in spec)\n apply(rotate_tac -1)\n apply(drule sym)\n apply simp\n apply(drule_tac x=\"a#lista\" in spec)\n apply(drule_tac x=\"m\" in spec)\n apply(drule_tac x=\"n\" in spec)\n apply(drule_tac x=\"s\" in spec)\n apply clarsimp\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs\" in spec, erule impE)\n apply(clarsimp simp: min_def split: if_split_asm)\n apply(rotate_tac -1)\n apply(drule_tac x=v in spec)\n apply clarsimp\n apply(drule_tac x=\"update_ti_list_t list (drop (size_td_pair dt_pair)\n (super_update_bs v bs n)) w\" in spec)\n apply(clarsimp simp: split_DTPair_all split: if_split_asm)\n apply(frule td_set_field_lookupD)\n apply(drule td_set_offset_size_m)\n apply(simp add: take_super_update_bs2 drop_super_update_bs2)\n done\n\nlemma fi_fu_consistentD:\n \"\\ field_lookup t f 0 = Some (s,n); wf_fd t; length bs = size_td t;\n length v = size_td s \\ \\\n field_update (field_desc t) (super_update_bs v bs n) w =\n field_update (field_desc s) v (field_update (field_desc t) bs w)\"\n using fi_fu_consistent(1) [of t f 0] by clarsimp\n\nlemma norm:\n \"length bs = size_of TYPE('a) \\\n from_bytes (norm_bytes TYPE('a::wf_type) bs) = ((from_bytes bs)::'a)\"\n apply(simp add: from_bytes_def norm_bytes_def)\n apply(subgoal_tac \"wf_fd (typ_info_t TYPE('a))\")\n apply(drule wf_fd_consD)\n apply(clarsimp simp: fd_cons_def fd_cons_desc_def)\n apply(drule (3) fd_cons_update_normalise)\n apply(fastforce simp: fd_cons_update_normalise_def size_of_def wf_fd_norm_tuD norm_desc_def\n access_ti\\<^sub>0_def)\n apply simp\n done\n\nlemma len:\n \"length bs = size_of TYPE('a) \\\n length (to_bytes (x::'a::wf_type) bs) = size_of TYPE('a)\"\n apply(simp add: size_of_def to_bytes_def)\n apply(subgoal_tac \"wf_fd (typ_info_t TYPE('a))\")\n apply(drule wf_fd_consD)\n apply(clarsimp simp: fd_cons_def fd_cons_length_def fd_cons_desc_def)\n apply simp\n done\n\nlemma sz_nzero:\n \"0 < size_of (TYPE('a::wf_type))\"\n unfolding size_of_def\n apply(subgoal_tac \"wf_size_desc (typ_info_t TYPE('a))\")\n apply(simp add: wf_size_desc_gt)\n apply simp\n done\n\nlemma not_disj_fn_empty1 [simp]:\n \"\\ disj_fn [] s\"\n by (simp add: disj_fn_def)\n\nlemma fd_path_cons [simp]:\n \"f \\ fs_path (x#xs) = (disj_fn f x \\ f \\ fs_path xs)\"\n by (auto simp: fs_path_def disj_fn_def)\n\nlemma fu_commutes_lookup_disjD:\n \"\\ field_lookup t f m = Some (d,n); field_lookup t f' m' = Some (d',n');\n disj_fn f f'; wf_fdp (tf_set t) \\ \\\n fu_commutes (field_update (field_desc (d::'a typ_info)))\n (field_update (field_desc d'))\"\n by (auto simp: disj_fn_def wf_fdp_def dest!: tf_set_field_lookupD)\n\nlemma field_lookup_fa_fu_lhs:\n \"\\f m n s d k. field_lookup t f m = Some (s,n) \\ fa_fu_ind (field_desc t) d k (size_td t)\n \\ wf_fd t \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s)\"\n \"\\f m n s d k. field_lookup_struct st f m = Some (s,n) \\ fa_fu_ind (field_desc_struct st) d k (size_td_struct st)\n \\ wf_fd_struct st \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s)\"\n \"\\f m n s d k. field_lookup_list ts f m = Some (s,n) \\ fa_fu_ind (field_desc_list ts) d k (size_td_list ts)\n \\ wf_fd_list ts \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s)\"\n \"\\f m n s d k. field_lookup_pair x f m = Some (s,n) \\ fa_fu_ind (field_desc_pair x) d k (size_td_pair x)\n \\ wf_fd_pair x \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s)\"\n apply(induct t and st and ts and x, all \\clarsimp simp: fa_fu_ind_def\\)\n apply(rename_tac dt_pair list f m n s d v bs bs')\n apply(clarsimp split: option.splits)\n apply(rotate_tac -3)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(drule_tac x=s in spec)\n apply clarsimp\n apply(drule_tac x=d in spec)\n apply(drule_tac x=\"length bs\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(rename_tac v ys ys')\n apply(drule_tac x=v in spec)\n apply(drule_tac x=ys in spec)\n apply clarsimp\n apply(drule_tac x=\"replicate (size_td_pair dt_pair) 0 @ ys'\" in spec)\n apply clarsimp\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_length_def fd_cons_desc_def)\n apply clarsimp\n apply(drule_tac x=f in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=n in spec)\n apply(drule_tac x=s in spec)\n apply clarsimp\n apply(drule_tac x=d in spec)\n apply(drule_tac x=\"length bs\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(rename_tac v ys ys')\n apply(drule_tac x=v in spec)\n apply(drule_tac x=ys in spec)\n apply clarsimp\n apply(drule_tac x=\"ys'@replicate (size_td_list list) 0\" in spec)\n apply clarsimp\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_length_def fd_cons_desc_def)\n apply clarsimp\n done\n\nlemma field_lookup_fa_fu_lhs_listD:\n \"\\ field_lookup_list ts f m = Some (s,n); fa_fu_ind (field_desc_list ts) d k (size_td_list ts);\n wf_fd_list ts \\ \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s) \"\n using field_lookup_fa_fu_lhs(3) [of ts] by clarsimp\n\nlemma field_lookup_fa_fu_lhs_pairD:\n \"\\ field_lookup_pair x f m = Some (s,n); fa_fu_ind (field_desc_pair x) d k (size_td_pair x);\n wf_fd_pair x \\ \\ fa_fu_ind (field_desc (s::'a typ_info)) d k (size_td s)\"\n using field_lookup_fa_fu_lhs(4) [of x] by clarsimp\n\nlemma field_lookup_fa_fu_rhs:\n \"\\f m n s d k . field_lookup t f m = Some (s,n) \\ fa_fu_ind d (field_desc t) (size_td t) k\n \\ wf_fd t \\ fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n \"\\f m n s d k. field_lookup_struct st f m = Some (s,n) \\ fa_fu_ind d (field_desc_struct st) (size_td_struct st) k\n \\ wf_fd_struct st \\ fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n \"\\f m n s d k. field_lookup_list ts f m = Some (s,n) \\ fa_fu_ind d (field_desc_list ts) (size_td_list ts) k\n \\ wf_fd_list ts \\ fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n \"\\f m n s d k. field_lookup_pair x f m = Some (s,n) \\ fa_fu_ind d (field_desc_pair x) (size_td_pair x) k\n \\ wf_fd_pair x \\ fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n apply(induct t and st and ts and x, all \\clarsimp simp: fa_fu_ind_def\\)\n apply(rename_tac dt_pair list f m n s d v bs bs')\n apply(clarsimp split: option.splits)\n apply(rotate_tac -3)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(drule_tac x=s in spec)\n apply clarsimp\n apply(drule_tac x=d in spec)\n apply(drule_tac x=\"length bs'\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(rename_tac v ys ys')\n apply(drule_tac x=v in spec)\n apply(drule_tac x=\"access_ti_pair dt_pair v (replicate (size_td_pair dt_pair) 0)@ys\" in spec)\n apply clarsimp\n apply(erule impE)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_length_def fd_cons_desc_def)\n apply(drule_tac x=\"ys'\" in spec)\n apply clarsimp\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_length_def fd_cons_update_access_def fd_cons_desc_def)\n apply(clarsimp simp: fu_commutes_def)\n apply clarsimp\n apply(drule_tac x=f in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=n in spec)\n apply(drule_tac x=s in spec)\n apply clarsimp\n apply(drule_tac x=d in spec)\n apply(drule_tac x=\"length bs'\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(rename_tac v ys ys')\n apply(drule_tac x=v in spec)\n apply(drule_tac x=\"ys@access_ti_list list v (replicate (size_td_list list) 0)\" in spec)\n apply(drule wf_fd_cons_pairD)\n apply(drule wf_fd_cons_listD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_list_def fd_cons_length_def\n fd_cons_update_access_def fd_cons_desc_def)\n apply fastforce\n done\n\nlemma field_lookup_fa_fu_rhs_listD:\n \"\\ field_lookup_list ts f m = Some (s,n);\n fa_fu_ind d (field_desc_list ts) (size_td_list ts) k; wf_fd_list ts \\ \\\n fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n using field_lookup_fa_fu_rhs(3) [of ts] by simp\n\nlemma field_lookup_fa_fu_rhs_pairD:\n \"\\ field_lookup_pair x f m = Some (s,n);\n fa_fu_ind d (field_desc_pair x) (size_td_pair x) k; wf_fd_pair x \\ \\\n fa_fu_ind d (field_desc (s::'a typ_info)) (size_td s) k\"\n using field_lookup_fa_fu_rhs(4) [of x] by simp\n\nlemma fa_fu_lookup_ind_list_pair:\n \"\\ field_lookup_pair x f m = Some (d',n); wf_fd_pair x;\n field_lookup_list ts f' m' = Some (d,n'); wf_fd_list ts;\n fa_fu_ind (field_desc_list ts) (field_desc_pair x) (size_td_pair x) (size_td_list ts) \\\n \\ fa_fu_ind (field_desc d) (field_desc d') (size_td d') (size_td d)\"\n apply(drule (2) field_lookup_fa_fu_lhs_listD)\n apply(drule (3) field_lookup_fa_fu_rhs_pairD)\n done\n\nlemma fa_fu_lookup_ind_pair_list:\n \"\\ field_lookup_pair x f m = Some (d,n); wf_fd_pair x;\n field_lookup_list ts f' m' = Some (d',n'); wf_fd_list ts;\n fa_fu_ind (field_desc_pair x) (field_desc_list ts) (size_td_list ts) (size_td_pair x) \\\n \\ fa_fu_ind (field_desc d) (field_desc d') (size_td d') (size_td d)\"\n apply(drule (2) field_lookup_fa_fu_lhs_pairD)\n apply(drule (3) field_lookup_fa_fu_rhs_listD)\n done\n\nlemma fa_fu_lookup_disj:\n \"\\f m d n f' m' d' n'. field_lookup t f m = Some (d,n) \\\n field_lookup t f' m' = Some (d',n') \\ disj_fn f f' \\\n wf_fd t \\ fa_fu_ind (field_desc (d::'a typ_info)) (field_desc d') (size_td d') (size_td d)\"\n \"\\f m d n f' m' d' n'. field_lookup_struct st f m = Some (d,n) \\\n field_lookup_struct st f' m' = Some (d',n') \\ disj_fn f f' \\\n wf_fd_struct st \\ fa_fu_ind (field_desc (d::'a typ_info)) (field_desc d') (size_td d') (size_td d)\"\n \"\\f m d n f' m' d' n'. field_lookup_list ts f m = Some (d,n) \\\n field_lookup_list ts f' m' = Some (d',n') \\ disj_fn f f' \\\n wf_fd_list ts \\ fa_fu_ind (field_desc (d::'a typ_info)) (field_desc d') (size_td d') (size_td d)\"\n \"\\f m d n f' m' d' n'. field_lookup_pair x f m = Some (d,n) \\\n field_lookup_pair x f' m' = Some (d',n') \\ disj_fn f f' \\\n wf_fd_pair x \\ fa_fu_ind (field_desc (d::'a typ_info)) (field_desc d') (size_td d') (size_td d)\"\n apply(induct t and st and ts and x, all \\clarsimp simp: disj_fn_def\\)\n apply(rename_tac dt_pair list f m d n f' m' d' n')\n apply(clarsimp simp: split: option.splits)\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=d in spec)\n apply clarsimp\n apply(drule_tac x=f' in spec)\n apply(drule_tac x=\"m' + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=d' in spec)\n apply clarsimp\n apply(drule (3) fa_fu_lookup_ind_list_pair; simp)\n apply(drule (3) fa_fu_lookup_ind_pair_list; simp)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=d in spec)\n apply clarsimp\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=f' in spec)\n apply(drule_tac x=m' in spec)\n apply(drule_tac x=d' in spec)\n apply clarsimp\n apply(rename_tac typ_desc f m d n f' m' d' n')\n apply(drule_tac x=\"tl f\" in spec)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=d in spec)\n apply clarsimp\n apply(drule_tac x=\"tl f'\" in spec)\n apply(drule_tac x=m' in spec)\n apply(drule_tac x=d' in spec)\n apply clarsimp\n apply(case_tac f; clarsimp)\n apply(case_tac f'; clarsimp)\n done\n\nlemma fa_fu_lookup_disjD:\n \"\\ field_lookup t f m = Some (d,n); field_lookup t f' m' = Some (d',n');\n disj_fn f f'; wf_fd t \\ \\\n fa_fu_ind (field_desc (d::'a typ_info)) (field_desc d') (size_td d') (size_td d)\"\n using fa_fu_lookup_disj(1) [of t] by fastforce\n\nlemma field_access_update_disj:\n \"\\ field_lookup t f m = Some (d,n); field_lookup t f' m' = Some (d',n');\n disj_fn f f'; length bs = size_td d'; length bs' = size_td d; wf_fd t \\ \\\n access_ti d (update_ti_t d' bs v) bs' = access_ti d v bs'\"\n by (fastforce dest: fa_fu_lookup_disjD simp: fa_fu_ind_def)\n\nlemma td_set_list_intvl_sub:\n \"(d,n) \\ td_set_list t m \\ {of_nat n..+size_td d} \\ {of_nat m..+size_td_list t}\"\n apply(frule td_set_list_offset_le)\n apply(drule td_set_list_offset_size_m)\n apply clarsimp\n apply(drule intvlD, clarsimp)\n apply(clarsimp simp: intvl_def)\n apply(rule_tac x=\"k + n - m\" in exI)\n apply simp\n done\n\nlemma td_set_pair_intvl_sub:\n \"(d,n) \\ td_set_pair t m \\ {of_nat n..+size_td d} \\ {of_nat m..+size_td_pair t}\"\n apply(frule td_set_pair_offset_le)\n apply(drule td_set_pair_offset_size_m)\n apply clarsimp\n apply(drule intvlD, clarsimp)\n apply(clarsimp simp: intvl_def)\n apply(rule_tac x=\"k + n - m\" in exI)\n apply simp\n done\n\nlemma intvl_inter_le:\n assumes inter: \"a + of_nat k = c + of_nat ka\" and lt_d: \"ka < d\" and lt_ka: \"k \\ ka\"\n shows \"a \\ {c..+d}\"\nproof -\n from lt_ka inter have \"a = c + of_nat (ka - k)\" by (simp add: field_simps)\n moreover from lt_d have \"ka - k < d\" by simp\n ultimately show ?thesis by (force simp: intvl_def)\nqed\n\nlemma intvl_inter:\n assumes nondisj: \"{a..+b} \\ {c..+d} \\ {}\"\n shows \"a \\ {c..+d} \\ c \\ {a..+b}\"\nproof -\n from nondisj obtain k ka where \"a + of_nat k = c + of_nat ka\"\n and \"k < b\" and \"ka < d\" by (force simp: intvl_def)\n thus ?thesis by (force intro: intvl_inter_le)\nqed\n\nlemma init_intvl_disj:\n \"k + z < addr_card \\ {(p::addr)+of_nat k..+z} \\ {p..+k} = {}\"\n apply(case_tac \"k \\ 0\"; simp)\n apply(rule ccontr)\n apply(drule intvl_inter)\n apply(erule disjE)\n apply(drule intvlD, clarsimp)\n apply(metis add_lessD1 len_of_addr_card less_trans mod_less order_less_irrefl unat_of_nat)\n apply(drule intvlD, clarsimp)\n apply(subst (asm) Abs_fnat_homs)\n apply(subst (asm) Word.of_nat_0)\n apply(subst (asm) len_of_addr_card)\n apply clarsimp\n apply(case_tac q; simp)\n done\n\nlemma final_intvl_disj:\n \"\\ k + z \\ n; n < addr_card \\ \\\n {(p::addr)+of_nat k..+z} \\ {p+(of_nat k + of_nat z)..+n - (k+z)} = {}\"\n apply(case_tac \"z \\ 0\"; simp)\n apply(rule ccontr)\n apply(drule intvl_inter)\n apply(erule disjE)\n apply(drule intvlD, clarsimp)\n apply(subst (asm) Abs_fnat_homs)\n apply(subst (asm) Word.of_nat_0)\n apply(subst (asm) len_of_addr_card)\n apply clarsimp\n apply(case_tac q; simp)\n apply(drule intvlD, clarsimp)\n by (metis add.commute add_leD1 len_of_addr_card less_trans nat_less_le of_nat_inverse)\n\nlemma fa_fu_lookup_disj_inter:\n \"\\f m d n f' d' n'. field_lookup t f m = Some (d,n) \\\n field_lookup t f' m = Some (d',n') \\ disj_fn f f' \\\n wf_fd t \\ size_td t < addr_card \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\ {of_nat n'..+size_td d'} = {}\"\n \"\\f m d n f' m d' n'. field_lookup_struct st f m = Some (d,n) \\\n field_lookup_struct st f' m = Some (d',n') \\ disj_fn f f' \\\n wf_fd_struct st \\ size_td_struct st < addr_card \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\ {of_nat n'..+size_td d'} = {}\"\n \"\\f m d n f' m d' n'. field_lookup_list ts f m = Some (d,n) \\\n field_lookup_list ts f' m = Some (d',n') \\ disj_fn f f' \\\n wf_fd_list ts \\ size_td_list ts < addr_card \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\ {of_nat n'..+size_td d'} = {}\"\n \"\\f m d n f' m d' n'. field_lookup_pair x f m = Some (d,n) \\\n field_lookup_pair x f' m = Some (d',n') \\ disj_fn f f' \\\n wf_fd_pair x \\ size_td_pair x < addr_card \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\ {of_nat n'..+size_td d'} = {}\"\n apply(induct t and st and ts and x, all \\clarsimp simp: disj_fn_def\\)\n apply(rule set_eqI)\n apply(clarsimp split: option.splits)\n apply fastforce\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_intvl_sub)\n apply(drule td_set_pair_field_lookup_pairD)\n apply(drule td_set_pair_intvl_sub)\n apply(fastforce dest: init_intvl_disj simp: split_DTPair_all)\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_intvl_sub)\n apply(drule td_set_pair_field_lookup_pairD)\n apply(drule td_set_pair_intvl_sub)\n apply(fastforce dest: init_intvl_disj simp: split_DTPair_all)\n apply fastforce\n apply(rule set_eqI, clarsimp)\n apply(case_tac f; clarsimp)\n apply(case_tac f'; clarsimp)\n apply(fastforce simp: disj_fn_def)\n done\n\nlemma fa_fu_lookup_disj_interD:\n \"\\ field_lookup t f m = Some (d,n); field_lookup t f' m = Some (d',n');\n disj_fn f f'; wf_fd t; size_td t < addr_card \\ \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\ {of_nat n'..+size_td d'} = {}\"\n using fa_fu_lookup_disj_inter(1) [of t] by clarsimp\n\nlemma fa_fu_lookup_disj_inter_listD:\n \"\\ field_lookup_list ts f m = Some (d,n);\n field_lookup_list ts f' m = Some (d',n'); disj_fn f f';\n wf_fd_list ts; size_td_list ts < addr_card \\ \\\n {(of_nat n)::addr..+size_td (d::'a typ_info)} \\\n {of_nat n'..+size_td d'} = {}\"\n using fa_fu_lookup_disj_inter(3) [of ts] by clarsimp\n\nlemma upd_rf:\n \"length bs = size_of TYPE('a) \\\n update_ti_t (typ_info_t TYPE('a::mem_type_sans_size)) bs v\n = update_ti_t (typ_info_t TYPE('a)) bs w\"\n by (simp add: upd)\n\nlemma inv:\n \"length bs = size_of TYPE('a) \\\n from_bytes (to_bytes (x::'a::mem_type_sans_size) bs) = x\"\n unfolding from_bytes_def to_bytes_def\n apply(subgoal_tac \"wf_fd (typ_info_t TYPE('a))\")\n apply(drule wf_fd_consD)\n apply(clarsimp simp: fd_cons_def fd_cons_update_access_def fd_cons_desc_def)\n apply(drule_tac x=x in spec)\n apply(insert upd [where v=x and w=undefined and bs=\"access_ti (typ_info_t TYPE('a)) x bs\"])\n apply(clarsimp simp: update_ti_t_def fd_cons_length_def size_of_def split: if_split_asm )\n apply simp\n done\n\nlemma align:\n \"align_of (TYPE('a::mem_type)) dvd addr_card\"\n apply(clarsimp simp: dvd_def align_of_def)\n apply(subgoal_tac \"align_of TYPE('a) < addr_card\")\n apply(subst (asm) align_of_def)\n apply(rule_tac x=\"2^(len_of TYPE(addr_bitsize) - align_td (typ_info_t TYPE('a)))\" in exI)\n apply clarsimp\n apply(subgoal_tac \"align_td (typ_info_t TYPE('a)) < addr_bitsize\")\n apply(simp add: addr_card flip: power_add)\n apply(rule_tac a=\"2\" in power_less_imp_less_exp; simp add: addr_card)\n apply (metis align_size_of dvd_imp_le less_trans max_size nat_less_le sz_nzero)\n done\n\nlemma to_bytes_inj:\n \"to_bytes (v::'a::mem_type) = to_bytes (v'::'a) \\ v=v'\"\n apply (drule_tac x=\"replicate (size_of TYPE('a)) 0\" in fun_cong)\n apply (drule_tac f=\"from_bytes::byte list \\ 'a\" in arg_cong)\n apply (simp add: inv)\n done\n\nlemmas unat_simps = unat_simps' max_size\n\nlemmas mem_type_simps [simp] = inv len sz_nzero max_size align\n\nlemma ptr_aligned_plus:\n assumes aligned: \"ptr_aligned (p::'a::mem_type ptr) \"\n shows \"ptr_aligned (p +\\<^sub>p i)\"\nproof -\n have \"int (align_of TYPE('a)) dvd (i * int (size_of TYPE('a)))\"\n by (simp add: align_size_of)\n with aligned show ?thesis\n apply (case_tac p, simp add: ptr_aligned_def ptr_add_def)\n apply (simp only: unat_simps len_signed)\n apply (metis align align_size_of dvd_add dvd_mod dvd_mult2 mult.commute)\n done\nqed\n\n\nlemma mem_type_self [simp]:\n \"ptr_val (p::'a::mem_type ptr) \\ {ptr_val p..+size_of TYPE('a)}\"\n by (rule intvl_self, rule sz_nzero)\n\nlemma intvl_Suc_nmem [simp]:\n \"(p::addr) \\ {p + 1..+size_of TYPE('a::mem_type) - Suc 0}\"\n by (rule intvl_Suc_nmem', subst len_of_addr_card, rule max_size)\n\nlemma wf_size_desc_typ_uinfo_t_simp [simp]:\n \"wf_size_desc (typ_uinfo_t TYPE('a::mem_type))\"\n by (simp add: typ_uinfo_t_def export_uinfo_def wf_size_desc_map)\n\n\nlemma aggregate_map [simp]:\n \"aggregate (map_td f t) = aggregate t\"\n apply(case_tac t)\n apply(rename_tac st n)\n apply(case_tac st; simp)\n done\n\n\nlemma simple_tag_not_aggregate2 [simp]:\n \"typ_uinfo_t TYPE('a::simple_mem_type) \\ TypDesc (TypAggregate ts) tn\"\n by (metis aggregate.simps aggregate_map aggregate_struct.simps(2) export_uinfo_def simple_tag\n typ_uinfo_t_def)\n\nlemma simple_tag_not_aggregate3 [simp]:\n \"typ_info_t TYPE('a::simple_mem_type) \\ TypDesc (TypAggregate ts) tn\"\n by (metis aggregate.simps aggregate_struct.simps(2) simple_tag)\n\nlemma field_of_t_mem:\n \"field_of_t (p::'b::mem_type ptr) (q::'a::mem_type ptr) \\\n ptr_val p \\ {ptr_val q..+size_of TYPE('a)}\"\n apply(clarsimp simp: field_of_t_def field_of_def intvl_def)\n apply(rule_tac x=\"unat (ptr_val p - ptr_val q)\" in exI)\n apply simp\n apply(drule td_set_offset_size)\n apply(clarsimp simp: size_of_def)\n by (metis add.commute add.right_neutral add_mono_thms_linordered_field(4) mem_type_simps(3)\n not_less size_of_def)\n\nlemma map_td_map:\n \"map_td f (map_td g t) = map_td (\\n algn. f n algn o g n algn) t\"\n \"map_td_struct f (map_td_struct g st) = map_td_struct (\\n algn. f n algn o g n algn) st\"\n \"map_td_list f (map_td_list g ts) = map_td_list (\\n algn. f n algn o g n algn) ts\"\n \"map_td_pair f (map_td_pair g x) = map_td_pair (\\n algn. f n algn o g n algn) x\"\n by (induct t and st and ts and x) auto\n\nlemma field_of_t_simple:\n \"field_of_t p (x::'a::simple_mem_type ptr) \\ ptr_val p = ptr_val x\"\n apply(clarsimp simp: field_of_t_def)\n apply(cases \"typ_uinfo_t TYPE('a)\")\n apply(rename_tac st n)\n apply(case_tac st; clarsimp)\n apply(clarsimp simp: field_of_def unat_eq_zero)\n done\n\n\nlemma fold_td'_unfold:\n \"fold_td' t =\n (let (f,s) = t in\n case s of TypDesc st nm \\\n (case st of\n TypScalar n algn d \\ d\n | TypAggregate ts \\ f nm (map (\\x. case x of DTPair t n \\ (fold_td' (f,t),n)) ts)))\"\n by (cases t, simp) (case_tac b, simp)\n\n\n\nlemma fold_td_alt_def':\n \"fold_td f t = (case t of\n TypDesc st nm \\\n (case st of\n TypScalar n algn d \\ d\n | TypAggregate ts \\ f nm (map (\\x. (fold_td f (dt_fst x),dt_snd x)) ts)))\"\n apply(case_tac t)\n apply(clarsimp split: typ_desc.split typ_struct.splits dt_pair.splits)\n by (metis (no_types, lifting) dt_pair.case dt_pair_collapse)\n\nlemma fold_td_alt_def:\n \"fold_td f t \\ (case t of\n TypDesc st nm \\\n (case st of\n TypScalar n algn d \\ d\n | TypAggregate ts \\ f nm (map (\\x. (fold_td f (dt_fst x),dt_snd x)) ts)))\"\n by (fastforce simp: fold_td_alt_def' simp del: fold_td_def)\n\n\nlemma map_td'_map':\n \"map_td f t = (map_td' (f,t))\"\n \"TypDesc (map_td_struct f st) (typ_name t) = (map_td' (f,TypDesc st (typ_name t)))\"\n \"TypDesc (TypAggregate (map_td_list f ts)) (typ_name t) = map_td' (f,TypDesc (TypAggregate ts) (typ_name t))\"\n \"map_td_pair f x = DTPair (map_td' (f,dt_fst x)) (dt_snd x)\"\n by (induct t and st and ts and x) (auto simp: split_DTPair_all)\n\nlemma map_td'_map:\n \"map_td f t = (case t of TypDesc st nm \\ TypDesc (case st of\n TypScalar n algn d \\ TypScalar n algn (f n algn d) |\n TypAggregate ts \\ TypAggregate (map (\\x. DTPair (map_td f (dt_fst x)) (dt_snd x)) ts)) nm)\"\n apply(subst map_td'_map')\n apply(subst map_td'_map')\n apply(case_tac t, simp add: typ_struct.splits)\n apply(auto simp: split_DTPair_all)\n done\n\nlemma map_td_alt_def:\n \"map_td f t \\ (case t of TypDesc st nm \\ TypDesc (case st of\n TypScalar n algn d \\ TypScalar n algn (f n algn d) |\n TypAggregate ts \\ TypAggregate (map (\\x. DTPair (map_td f (dt_fst x)) (dt_snd x)) ts)) nm)\"\n by (simp add: map_td'_map)\n\nlemma size_td_fm':\n \"size_td (t::'a typ_desc) = fold_td tnSum (map_td (\\n x d. n) t)\"\n \"size_td_struct (st::'a typ_struct) = fold_td_struct (typ_name t) tnSum (map_td_struct (\\n x d. n) st)\"\n \"size_td_list (ts::'a typ_pair list) = fold_td_list (typ_name t) tnSum (map_td_list (\\n x d. n) ts)\"\n \"size_td_pair (x::'a typ_pair) = fold_td_pair tnSum (map_td_pair (\\n x d. n) x)\"\n by (induct t and st and ts and x) (auto simp: tnSum_def split: dt_pair.splits)\n\nlemma size_td_fm:\n \"size_td (t::'a typ_desc) \\ fold_td tnSum (map_td (\\n algn d. n) t)\"\n using size_td_fm'(1) [of t] by clarsimp\n\nlemma align_td_fm':\n \"align_td (t::'a typ_desc) = fold_td tnMax (map_td (\\n x d. x) t)\"\n \"align_td_struct (st::'a typ_struct) = fold_td_struct (typ_name t) tnMax (map_td_struct (\\n x d. x) st)\"\n \"align_td_list (ts::'a typ_pair list) = fold_td_list (typ_name t) tnMax (map_td_list (\\n x d. x) ts)\"\n \"align_td_pair (x::'a typ_pair) = fold_td_pair tnMax (map_td_pair (\\n x d. x) x)\"\n by (induct t and st and ts and x) (auto simp: tnMax_def split: dt_pair.splits)\n\nlemma align_td_fm:\n \"align_td (t::'a typ_desc) \\ fold_td tnMax (map_td (\\n algn d. algn) t)\"\n using align_td_fm'(1) [of t] by clarsimp\n\nlemma case_dt_pair:\n \"snd ` case_dt_pair (\\t. Pair (f t)) ` X = dt_snd ` X\"\n by (force simp: image_iff split_DTPair_all split: dt_pair.splits)\n\nlemma map_DTPair_dt_snd:\n \"map_td_pair f x = DTPair a b \\ b = dt_snd x\"\n by (metis dt_pair.inject map_td'_map'(4))\n\nlemma wf_desc_fm':\n \"wf_desc (t::'a typ_desc) = fold_td wfd (map_td (\\n x d. True) t)\"\n \"wf_desc_struct (st::'a typ_struct) = fold_td_struct (typ_name t) wfd (map_td_struct (\\n x d. True) st)\"\n \"wf_desc_list (ts::'a typ_pair list) = fold_td_list (typ_name t) wfd (map_td_list (\\n x d. True) ts)\"\n \"wf_desc_pair (x::'a typ_pair) = fold_td_pair wfd (map_td_pair (\\n x d. True) x)\"\n supply split_DTPair_all[simp] dt_pair.splits[split]\n apply (induct t and st and ts and x, all \\clarsimp simp: wfd_def image_comp[symmetric]\\)\n apply (rule iffI; clarsimp)\n apply (metis (no_types) dt_snd.simps dt_snd_map_td_list imageI)\n by (metis (mono_tags) case_dt_pair dt_snd.simps dt_snd_map_td_list image_eqI)\n\nlemma wf_desc_fm:\n \"wf_desc (t::'a typ_desc) \\ fold_td wfd (map_td (\\n algn d. True) t)\"\n using wf_desc_fm'(1) [of t] by auto\n\nlemma update_tag_list_empty [simp]:\n \"(map_td_list f xs = []) = (xs = [])\"\n by (case_tac xs, auto)\n\nlemma wf_size_desc_fm':\n \"wf_size_desc (t::'a typ_desc) = fold_td wfsd (map_td (\\n x d. 0 < n) t)\"\n \"wf_size_desc_struct (st::'a typ_struct) = fold_td_struct (typ_name t) wfsd (map_td_struct (\\n x d. 0 < n) st)\"\n \"ts \\ [] \\ wf_size_desc_list (ts::'a typ_pair list) = fold_td_list (typ_name t) wfsd (map_td_list (\\n x d. 0 < n) ts)\"\n \"wf_size_desc_pair (x::'a typ_pair) = fold_td_pair wfsd (map_td_pair (\\n x d. 0 < n) x)\"\n by (induct t and st and ts and x) (auto simp: wfsd_def split: dt_pair.splits)\n\nlemma wf_size_desc_fm:\n \"wf_size_desc (t::'a typ_desc) \\ fold_td wfsd (map_td (\\n algn d. 0 < n) t)\"\n using wf_size_desc_fm'(1) [of t] by auto\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/CTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.3812195662561499, "lm_q1q2_score": 0.1920988917628936}} {"text": "theory heap_scratch\n\nimports examples_total_correctness\n\nbegin\n\nlemma swap_test_manual:\n assumes \"weak_lens x\" and \"weak_lens y\" and \"weak_lens z\"\n and \"x \\ y\" and \"x \\ z\" and \"y \\ z\"\n shows \"\\&x =\\<^sub>u \\a\\ \\ &y =\\<^sub>u \\b\\\\\n z \\ &x;;\n x \\ &y;;\n y \\ &z\n \\&x =\\<^sub>u \\b\\ \\ &y =\\<^sub>u \\a\\\\\\<^sub>D\"\n\noops\nterm \"\\s\\\"\nterm \"\\s\\\\<^sub><\"\nterm \"\\\\id\\\\<^sub>s heap\\\\<^sub><\"\nterm \"\\id\\\\<^sub>s (heap:: ('d, 'e) rel \\ ('a, 'b) cp)\"\nterm \"\\\\id\\\\<^sub>s (heap:: ('d, 'e) rel \\ ('a, 'b) cp)\\\\<^sub>e t\"\nterm \"z \\ &x;; heap :== \\s\\ ;; \\s :== h\\\\<^sub>C\\<^sub>>\"\nterm \"(\\ (s, s') (t, t'). \\\\id\\\\<^sub>s (heap:: ('d, 'e) rel \\ ('a, 'b) cp)\\\\<^sub>e t ;; ss)\"\nterm \"block (II) (II) restore return\"\n\nterm \"z \\ &x;; heap :== ( \\ sheap ;;s :== h;; s' :== h'\\) ;; heap :== &heap\"\nterm \"z \\ &x;; heap :== \\s;\\<^sub>Ls'\\ ;; \\s :== h\\\\<^sub>C\\<^sub>>\"\nterm \" heap :== \\s\\ ;; \\s :== h\\\\<^sub>>\"\nalphabet cp_heap = \"'f cp_vars\" +\n heap :: \"nat \\ int\"\nterm \" heap :== \\s \\ ;; \\s :== h\\\\<^sub>C\\<^sub>>\"\n\nterm \"\\s :== h\\\\<^sub>C\\<^sub>>\"\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/orca/examples/heap_scratch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3812195662561499, "lm_q1q2_score": 0.19209889176289358}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n * The layout of the capability space and other parts of the system-initialiser.\n *)\ntheory RootTask_SI\nimports WellFormed_SI SysInit_SI\nbegin\n\n(******************************************************************\n * Definition of the CSpace of the root task. *\n * This requires a default cap to all of the objects created, *\n * and a copy of caps to all of the CNodes (for installing caps). *\n ******************************************************************)\n\nconsts\n si_cnode_id :: cdl_object_id\n si_asidpool_id :: cdl_object_id\n si_asidpool_base :: nat\n\ndefinition\n si_cnode_size :: cdl_size_bits\nwhere\n \"si_cnode_size = 12\"\n\n(* If we axioimise this size, we need it to be smaller than the word size.\n * We need this to prove that:\n - word_bits - si_cnode_size + si_cnode_size = word_bits.\n - offset (of_nat slot) si_cnode_size = slot\n *)\nlemma si_cnode_size_less_than_word_size [simp]:\n \"si_cnode_size < word_bits\"\n by (clarsimp simp: si_cnode_size_def word_bits_def)\n\nlemma si_cnode_size_less_than_eq_word_size [simp]:\n \"si_cnode_size \\ word_bits\"\n by (rule less_imp_le_nat, simp)\n\nlemma si_cnode_size_greater_than_1 [simp]:\n \"1 < si_cnode_size\"\n by (clarsimp simp: si_cnode_size_def)\n\nlemma si_cnode_size_greater_than_2 [simp]:\n \"2 < si_cnode_size\"\n by (clarsimp simp: si_cnode_size_def)\n\nlemma unat_less_2_si_cnode_size:\n \"unat (cptr::32 word) < 2 ^ si_cnode_size\n \\ cptr < 2 ^ si_cnode_size\"\n by (metis si_cnode_size_less_than_word_size unat_power_lower32 word_less_nat_alt)\n\nlemma unat_less_2_si_cnode_size':\n \"(cptr::32 word) < 2 ^ si_cnode_size\n \\ unat cptr < 2 ^ si_cnode_size\"\n by (metis unat_less_helper word_unat_power)\n\n(* This is stored in the root TCB. *)\ndefinition\n si_cspace_cap :: cdl_cap\nwhere\n \"si_cspace_cap = CNodeCap si_cnode_id 0 (word_bits - si_cnode_size) si_cnode_size\"\n\n(* This is the cap the root TCB has to its own root cnode (stored in its root CNode). *)\ndefinition\n si_cnode_cap :: cdl_cap\nwhere\n \"si_cnode_cap = CNodeCap si_cnode_id 0 (word_bits - si_cnode_size) si_cnode_size\"\n\ndefinition\n root_tcb :: cdl_object\nwhere\n \"root_tcb = update_slots [tcb_cspace_slot \\ si_cspace_cap,\n tcb_vspace_slot \\ undefined,\n tcb_replycap_slot \\ undefined,\n tcb_caller_slot \\ undefined,\n tcb_ipcbuffer_slot \\ undefined,\n tcb_pending_op_slot \\ undefined] (Tcb (default_tcb minBound))\"\n\ndefinition\n empty_asid :: cdl_asid_pool\nwhere\n \"empty_asid = \\cdl_asid_pool_caps = empty_cap_map asid_low_bits\\\"\n\ndefinition\n si_asid :: \"sep_state \\ bool\"\nwhere\n \"si_asid \\\n (si_cnode_id, unat seL4_CapInitThreadASIDPool) \\c AsidPoolCap si_asidpool_id si_asidpool_base \\*\n si_asidpool_id \\f AsidPool empty_asid \\*\n (\\* offset\\{offset. offset < 2 ^ asid_low_bits}.\n (si_asidpool_id, offset) \\c -)\"\n\nabbreviation \"si_tcb_id \\ root_tcb_id\"\n\ndefinition si_objects :: \"sep_state \\ bool\"\nwhere\n \"si_objects \\\n si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, unat seL4_CapInitThreadCNode) \\c si_cnode_cap \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid\"\n\ndefinition\n si_objects_extra_caps' :: \"cdl_object_id set \\ cdl_cptr list \\ cdl_cptr list \\ sep_state \\ bool\"\nwhere\n \"si_objects_extra_caps' obj_ids free_cptrs untyped_cptrs \\ \\s.\n \\untyped_caps all_available_ids.\n ((\\* (cptr, cap) \\ set (zip untyped_cptrs untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set (drop (card obj_ids) free_cptrs). (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\all_available_ids. obj_id \\o Untyped)) s\"\n\ndefinition\n si_objects_extra_caps :: \"cdl_object_id set \\ cdl_cptr list \\ cdl_cptr list\n \\ cdl_state \\ sep_state \\ bool\"\nwhere\n \"si_objects_extra_caps obj_ids free_cptrs untyped_cptrs spec \\ \\s.\n \\untyped_caps all_available_ids.\n ((\\* (cptr, cap) \\ set (zip untyped_cptrs untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set (drop (card obj_ids + card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec}) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\all_available_ids. obj_id \\o Untyped)) s\"\n\n\nlemma distinct_take_drop_append:\n \"distinct xs \\ set (take b (drop a xs)) \\ set (drop (a + b) xs) = {}\"\n by (metis distinct_append distinct_drop take_drop_append)\n\nlemma si_objects_extra_caps'_si_objects_extra_caps:\n \"distinct free_slots \\\n si_objects_extra_caps' obj_ids free_slots untyped_cptrs =\n (si_objects_extra_caps obj_ids free_slots untyped_cptrs spec \\*\n (\\* cptr \\ set (take (card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec})\n (drop (card obj_ids) free_slots)).\n (si_cnode_id, unat cptr) \\c NullCap))\"\n apply (rule ext)\n apply (clarsimp simp: si_objects_extra_caps'_def si_objects_extra_caps_def sep_conj_exists)\n apply (rule ex_eqI)+\n apply (subst take_drop_append [where a=\"card obj_ids\" and\n b=\"card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec}\"])\n apply clarsimp\n apply (subst sep.prod.union_disjoint, (simp add: distinct_take_drop_append)+)+\n apply (clarsimp simp: sep_conj_ac)\n done\n\ndefinition\n si_irq_nodes :: \"cdl_state \\ sep_state \\ bool\"\nwhere\n \"si_irq_nodes spec \\\n (\\s. \\k_irq_table. (\\* irq\\used_irqs spec. irq \\irq k_irq_table irq \\*\n k_irq_table irq \\o IRQNode empty_irq_node) s)\"\n\n\n(***************************************\n * Lemmas about the root task objects. *\n ***************************************)\n\nlemma is_cnode_cap_si_cspace_cap [simp]:\n \"is_cnode_cap si_cspace_cap\"\n by (clarsimp simp: si_cspace_cap_def)\n\nlemma is_cnode_cap_si_cnode_cap [simp]:\n \"is_cnode_cap si_cnode_cap\"\n by (clarsimp simp: si_cnode_cap_def)\n\nlemma is_tcb_root_tcb [simp]:\n \"is_tcb root_tcb\"\n by (clarsimp simp: root_tcb_def)\n\nlemma cap_guard_size_si_cnode_cap_plus_si_cnode_size [simp]:\n \"cap_guard_size si_cnode_cap + si_cnode_size = word_bits\"\n by (clarsimp simp: si_cnode_cap_def)\n\nlemma cap_object_si_cspace_cap [simp]:\n \"cap_object si_cspace_cap = si_cnode_id\"\n by (clarsimp simp: cap_object_def cap_has_object_def si_cspace_cap_def)\n\nlemma cap_object_si_cnode_cap [simp]:\n \"cap_object si_cnode_cap = si_cnode_id\"\n by (clarsimp simp: cap_object_def cap_has_object_def si_cnode_cap_def)\n\n\nlemma offset_slot_si_cnode_size:\n \"slot < 2^si_cnode_size \\ offset (of_nat slot) si_cnode_size = slot\"\n by (clarsimp simp: offset_slot)\n\nlemma offset_slot_si_cnode_size':\n \"slot < 2^si_cnode_size \\ offset slot si_cnode_size = unat slot\"\n by (clarsimp simp: offset_slot')\n\nlemma guard_equal_si_cspace_cap:\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cspace_cap src_index 32\"\n apply (clarsimp simp: si_cspace_cap_def guard_equal_def Let_unfold)\n apply (subst and_mask_eq_iff_shiftr_0 [THEN iffD1])\n apply (clarsimp simp: word_bits_def)\n apply (erule less_mask_eq)\n apply (clarsimp simp: mask_def)\n done\n\nlemma guard_equal_si_cspace_cap':\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cspace_cap src_index word_bits\"\n by (drule guard_equal_si_cspace_cap, simp add: word_bits_def)\n\nlemma guard_equal_si_cnode_cap:\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cnode_cap src_index 32\"\n apply (clarsimp simp: si_cnode_cap_def guard_equal_def Let_unfold)\n apply (subst and_mask_eq_iff_shiftr_0 [THEN iffD1])\n apply (clarsimp simp: word_bits_def)\n apply (erule less_mask_eq)\n apply (clarsimp simp: mask_def)\n done\n\nlemma seL4_CapInitThreadASIDPool_si_cnode_size [simp]:\n \"seL4_CapInitThreadASIDPool < 2 ^ si_cnode_size\"\n by (clarsimp simp: seL4_CapInitThreadASIDPool_def si_cnode_size_def)\n\nlemma guard_equal_si_cspace_cap_seL4_CapInitThreadASIDPool [simp]:\n \"guard_equal si_cspace_cap seL4_CapInitThreadASIDPool word_bits\"\n by (rule guard_equal_si_cspace_cap', simp)\n\nlemma si_cspace_cap_guard_equal:\n \"guard_equal si_cnode_cap src_index 32 \\ src_index < 2 ^ si_cnode_size\"\n apply (clarsimp simp: si_cnode_cap_def guard_equal_def\n Let_unfold si_cnode_size_def)\n apply (subst (asm) shiftr_mask_eq')\n apply (simp add: word_bits_size word_bits_def)\n apply (subst (asm) le_mask_iff [symmetric])\n apply (clarsimp simp: mask_def)\n apply (insert word32_less_sub_le [where x=src_index and n=12])\n apply (clarsimp simp: word_bits_def)\n done\n\nlemma one_lvl_lookup_si_cspace_cap [simp]:\n \"one_lvl_lookup si_cspace_cap word_bits si_cnode_size\"\n by (clarsimp simp: one_lvl_lookup_def si_cspace_cap_def)\n\nlemmas one_lvl_lookup_si_cspace_cap' [simp] =\n one_lvl_lookup_si_cspace_cap [simplified word_bits_def, simplified]\n\nlemma one_lvl_lookup_si_cnode_cap [simp]:\n \"one_lvl_lookup si_cnode_cap word_bits si_cnode_size\"\n by (clarsimp simp: one_lvl_lookup_def si_cnode_cap_def)\n\nlemmas one_lvl_lookup_si_cnode_cap' [simp] =\n one_lvl_lookup_si_cnode_cap [simplified word_bits_def, simplified]\n\nlemma obj_tcb_root_tcb [simp]:\n \"Tcb (obj_tcb root_tcb) = root_tcb\"\n by (clarsimp simp: obj_tcb_def root_tcb_def update_slots_def)\n\n(***************************\n * Lemmas about word size. *\n ***************************)\nlemma seL4_CapInitThreadCNode_less_than_si_cnode_size [simp]:\n \"seL4_CapInitThreadCNode < 2 ^ si_cnode_size\"\n apply (insert si_cnode_size_greater_than_1)\n apply (insert power_strict_increasing [where n=1 and a=\"(2::nat)\" and N=si_cnode_size, simplified])\n apply (clarsimp)\n apply (drule of_nat_less_pow_32)\n apply (clarsimp simp: seL4_CapInitThreadCNode_def)+\n done\n\nlemma offset_seL4_CapInitThreadCNode [simp]:\n \"offset seL4_CapInitThreadCNode si_cnode_size = unat seL4_CapInitThreadCNode\"\n by (rule offset_slot', simp)\n\nlemma seL4_CapIRQControl_less_than_si_cnode_size [simp]:\n \"seL4_CapIRQControl < 2 ^ si_cnode_size\"\n apply (simp add: seL4_CapIRQControl_def)\n apply (insert si_cnode_size_greater_than_2)\n apply (insert power_strict_increasing [where n=2 and a=\"(2::nat)\" and N=si_cnode_size, simplified])\n apply (drule of_nat_less_pow_32, simp_all)\n done\n\nlemma offset_seL4_CapIRQControl [simp]:\n \"offset seL4_CapIRQControl si_cnode_size = unat seL4_CapIRQControl\"\n by (rule offset_slot', simp)\n\n(* There is a cap in the root cnode that points to the obj_id specified.\n * This cap should be the default cap to that object.\n *\n * This predicate can be used for spec objects, or the duplicated cnode caps.\n *)\ndefinition si_cap_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_cap_at t si_caps spec dev obj_id \\ \\s.\n \\cap_ptr slot obj kobj_id.\n ((si_cnode_id, slot) \\c default_cap (object_type obj) {kobj_id} (object_size_bits obj) dev) s \\\n si_caps obj_id = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size \\\n cdl_objects spec obj_id = Some obj \\\n t obj_id = Some kobj_id\"\n\ndefinition si_irq_cap_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq \\ sep_pred\"\nwhere\n \"si_irq_cap_at si_irq_caps spec irq \\ \\s.\n \\cap_ptr slot.\n ((si_cnode_id, slot) \\c IrqHandlerCap irq) s \\\n si_irq_caps irq = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size\"\n\ndefinition si_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_caps_at t si_caps spec dev obj_ids \\\n \\* obj_id \\ obj_ids. (si_cap_at t si_caps spec) dev obj_id\"\n\ndefinition si_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq set \\ sep_pred\"\nwhere\n \"si_irq_caps_at si_irq_caps spec irqs \\\n \\* irq \\ irqs. si_irq_cap_at si_irq_caps spec irq\"\n\ndefinition\n si_obj_cap_at' :: \" (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_obj_cap_at' t si_caps spec dev obj_id slot \\ \\s. \\ spec_cap.\n si_cap_at t si_caps spec dev (cap_object spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_obj_cap_at where\n \"si_obj_cap_at t si_caps spec dev obj_id slot \\\n if original_cap_at (obj_id, slot) spec \\ cap_at cap_has_object (obj_id, slot) spec\n then si_obj_cap_at' t si_caps spec dev obj_id slot\n else \\\"\n\ndefinition\n si_obj_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_obj_caps_at t si_caps spec dev obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_obj_cap_at t si_caps spec dev obj_id slot\"\n\ndefinition\n si_objs_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_objs_caps_at t si_caps spec dev obj_ids \\\n \\* obj_id \\ obj_ids. (si_obj_caps_at t si_caps spec) dev obj_id\"\n\ndefinition\n si_spec_irq_cap_at' :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_irq_cap_at' si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_irq_cap_at si_irq_caps spec (cap_irq spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_spec_irq_cap_at where\n \"si_spec_irq_cap_at si_irq_caps spec obj_id slot \\\n if irqhandler_cap_at (obj_id, slot) spec\n then si_spec_irq_cap_at' si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_irq_caps_at si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_irq_cap_at si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_irqs_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_irqs_caps_at si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_irq_caps_at si_irq_caps spec obj_id\"\n\ndefinition\n \"si_null_cap_at t si_irq_caps spec obj_id \\\n \\s. \\cap_ptr slot obj kobj_id.\n ((si_cnode_id, slot) \\c NullCap) s \\\n si_irq_caps obj_id = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size \\\n cdl_objects spec obj_id = Some obj \\ t obj_id = Some kobj_id\"\n\ndefinition\n \"si_null_irq_cap_at si_irq_caps spec irq \\\n \\s. \\cap_ptr slot.\n ((si_cnode_id, slot) \\c NullCap) s \\\n si_irq_caps irq = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size\"\n\ndefinition\n si_spec_obj_null_cap_at' :: \" (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_obj_null_cap_at' t si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_null_cap_at t si_irq_caps spec (cap_object spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_spec_obj_null_cap_at where\n \"si_spec_obj_null_cap_at t si_irq_caps spec obj_id slot \\\n if original_cap_at (obj_id, slot) spec \\ cap_at cap_has_object (obj_id, slot) spec\n then si_spec_obj_null_cap_at' t si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_obj_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_obj_null_caps_at t si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_obj_null_cap_at t si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_objs_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_objs_null_caps_at t si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_obj_null_caps_at t si_irq_caps spec obj_id\"\n\ndefinition\n si_spec_irq_null_cap_at' :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_irq_null_cap_at' si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_null_irq_cap_at si_irq_caps spec (cap_irq spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\ \\is_untyped_cap spec_cap\"\n\ndefinition si_spec_irq_null_cap_at where\n \"si_spec_irq_null_cap_at si_irq_caps spec obj_id slot \\\n if irqhandler_cap_at (obj_id, slot) spec\n then si_spec_irq_null_cap_at' si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_irq_null_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_irq_null_caps_at si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_irq_null_cap_at si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_irqs_null_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_irqs_null_caps_at si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_irq_null_caps_at si_irq_caps spec obj_id\"\n\ndefinition si_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_null_caps_at t si_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_null_cap_at t si_caps spec obj_id\"\n\n\nlemma si_cap_at_less_si_cnode_size:\n \"\\\\si_cap_at t opt_sel4_cap spec dev obj_id \\* R\\ s;\n Some cap_ptr = opt_sel4_cap obj_id\\\n \\ cap_ptr < 2 ^ si_cnode_size\"\n by (clarsimp simp: si_cap_at_def sep_conj_exists)\n\nlemma si_irq_cap_at_less_si_cnode_size:\n \"\\\\si_irq_cap_at opt_sel4_cap spec obj_id \\* R\\ s;\n Some cap_ptr = opt_sel4_cap obj_id\\\n \\ cap_ptr < 2 ^ si_cnode_size\"\n by (clarsimp simp: si_irq_cap_at_def sep_conj_exists)\n\nlemma si_cap_at_has_k_obj_id:\n \"\\\\si_cap_at t opt_sel4_cap spec dev obj_id \\* R\\ s\\\n \\ \\cap_object_id. t obj_id = Some cap_object_id\"\n by (clarsimp simp: si_cap_at_def sep_conj_exists)\n\n(******************************************************\n * Using just si_cap_at when you have si_caps_at. *\n ******************************************************)\n\nlemma valid_si_caps_at_si_cap_at:\n \"\\finite obj_ids; obj_id \\ obj_ids;\n (\\R. \\\\si_cap_at t orig_caps spec dev obj_id \\* P \\* R\\\\\n f\n \\\\_.\\si_cap_at t orig_caps spec dev obj_id \\* Q \\* R\\\\)\\\n \\\n \\\\si_caps_at t orig_caps spec dev obj_ids \\* P \\* R\\\\\n f\n \\\\_.\\si_caps_at t orig_caps spec dev obj_ids \\* Q \\* R\\\\\"\n apply (clarsimp simp: si_caps_at_def)\n apply (drule sep_set_conj_map_singleton_wp [where f=f and\n I=\"si_cap_at t orig_caps spec dev\" and P=P and Q=Q and R=R, rotated])\n apply (clarsimp simp: sep_conj_ac)+\n done\n\n(*******************************************************\n * Frames have been duplicated. *\n *******************************************************)\n\nabbreviation (input)\n \"cap_object_from_slot obj_id slot P s \\ \\cap. opt_cap (obj_id, slot) s = Some cap\n \\ cap \\ NullCap\n \\ P (cap_object cap) s\"\nabbreviation \"get_obj obj_id slot spec \\ (cap_object o the) (opt_cap (obj_id, slot) spec)\"\nabbreviation \"ref_obj spec obj_id slot \\ cap_ref_object (obj_id, slot) spec\"\nabbreviation \"real_frame_cap_of dev ptr rights n t \\ FrameCap dev ((the o t) ptr) rights n Real None\"\nabbreviation (input) \"the_cap spec pt_id pt_slot \\ the (opt_cap (pt_id, pt_slot) spec)\"\n\ndefinition conjure_real_frame_cap ::\n \"cdl_cap \\ (cdl_object_id \\ cdl_object_id option) \\ cdl_cap\"\n where\n \"conjure_real_frame_cap cap t \\\n case cap of FrameCap _ ptr _ n _ _ \\ real_frame_cap_of False ptr vm_read_write n t | _ \\ cap\"\n\ndefinition frame_duplicates_empty ::\n \"(cdl_object_id \\ nat \\ word32) \\ cdl_object_id \\ cdl_state \\ (sep_state \\ bool)\"\n where\n \"frame_duplicates_empty cptr_map pd_id spec \\\n sep_map_set_conj\n (\\x. let pt_id = get_obj pd_id x spec in\n sep_map_set_conj (\\y. (si_cnode_id, unat $ cptr_map (pt_id, y)) \\c NullCap)\n {slot \\ dom (slots_of pt_id spec). cap_at ((\\) NullCap) (pt_id, slot) spec})\n {slot \\ dom (slots_of pd_id spec). cap_at (\\cap. cap \\ NullCap \\ pt_at (cap_object cap) spec)\n (pd_id, slot) spec} \\*\n sep_map_set_conj\n (\\x. let frame_id = get_obj pd_id x spec in\n (si_cnode_id, unat $ cptr_map (pd_id, x)) \\c NullCap)\n {slot \\ dom (slots_of pd_id spec). cap_at (\\cap. cap \\ NullCap \\ frame_at (cap_object cap) spec)\n (pd_id, slot) spec}\"\n\ndefinition frame_duplicates_copied ::\n \"(cdl_object_id \\ nat \\ word32) \\ cdl_object_id \\ cdl_state\n \\ (cdl_object_id \\ cdl_object_id option) \\ (sep_state \\ bool)\"\n where\n \"frame_duplicates_copied cptr_map pd_id spec t \\\n sep_map_set_conj\n (\\x. let pt_id = get_obj pd_id x spec in\n sep_map_set_conj (\\y. (si_cnode_id, unat $ cptr_map (pt_id, y)) \\c\n conjure_real_frame_cap (the_cap spec pt_id y) t)\n {slot \\ dom (slots_of pt_id spec). cap_at ((\\) NullCap) (pt_id, slot) spec})\n {slot \\ dom (slots_of pd_id spec). cap_at (\\cap. cap \\ NullCap \\ pt_at (cap_object cap) spec)\n (pd_id, slot) spec} \\*\n sep_map_set_conj\n (\\x. let frame_id = get_obj pd_id x spec in\n (si_cnode_id, unat $ cptr_map (pd_id, x)) \\c\n conjure_real_frame_cap (the_cap spec pd_id x) t)\n {slot \\ dom (slots_of pd_id spec). cap_at (\\cap. cap \\ NullCap \\ frame_at (cap_object cap) spec)\n (pd_id, slot) spec}\"\n\n(**********************************************************\n * The pre and post conditions of the system initialiser. *\n **********************************************************)\n\n(* That the boot info is valid, and that there are enough free slots to initialise a system. *)\ndefinition\n valid_boot_info\nwhere\n \"valid_boot_info bootinfo spec \\ \\s.\n \\untyped_caps fstart fend ustart uend obj_ids.\n ((\\*(cptr, cap) \\ set (zip [ustart .e. uend - 1] untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set [fstart .e. fend - 1]. (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\(\\cap\\set untyped_caps. cap_free_ids cap). obj_id \\o Untyped) \\*\n (SETSEPCONJ pd_id | pd_at pd_id spec.\n frame_duplicates_empty (make_frame_cap_map obj_ids\n (drop (card (dom (cdl_objects spec))) [fstart .e. fend - 1]) spec)\n pd_id spec) \\*\n si_objects \\*\n si_irq_nodes spec) s \\\n obj_ids = sorted_list_of_set (dom (cdl_objects spec)) \\\n card (dom (cdl_objects spec)) +\n card {obj_id. cnode_or_tcb_at obj_id spec} +\n card (\\(set ` get_frame_caps spec ` {obj. pd_at obj spec})) \\ unat fend - unat fstart \\\n length untyped_caps = unat uend - unat ustart \\\n distinct_sets (map cap_free_ids untyped_caps) \\\n list_all is_full_untyped_cap untyped_caps \\\n list_all well_formed_untyped_cap untyped_caps \\\n list_all (\\c. \\ is_device_cap c) untyped_caps \\\n bi_untypes bootinfo = (ustart, uend) \\\n bi_free_slots bootinfo = (fstart, fend) \\\n ustart < 2 ^ si_cnode_size \\\n (uend - 1) < 2 ^ si_cnode_size \\\n fstart < 2 ^ si_cnode_size \\\n (fend - 1) < 2 ^ si_cnode_size \\\n uend \\ 0 \\ fend \\ 0\"\n\ndefinition\n si_final_objects :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ sep_pred\"\nwhere\n \"si_final_objects spec t \\ \\s.\n \\dup_caps (untyped_cptrs::32 word list) (free_cptrs::32 word list) untyped_caps all_available_ids.\n ((\\* cptr \\ set (take (card (dom (cdl_objects spec))) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* cptr \\ set (drop (card (dom (cdl_objects spec)) +\n card ({obj_id. cnode_or_tcb_at obj_id spec})) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* (cptr, untyped_cap) \\ set (zip untyped_cptrs untyped_caps).\n (si_cnode_id, unat cptr) \\c untyped_cap) \\*\n (\\* obj_id \\ all_available_ids. obj_id \\o Untyped) \\*\n (\\* obj_id \\ {obj_id. cnode_or_tcb_at obj_id spec}. (si_cap_at t dup_caps spec False obj_id)) \\*\n si_objects) s\"\n\n(********************************************************\n * Conversion of si_objs_caps_at to si_caps_at *\n ********************************************************)\n\nlemma orig_cap_rewrite:\n \"Set.filter (\\cap_ref. original_cap_at cap_ref spec \\ cap_at cap_has_object cap_ref spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}.\n dom (slots_of obj_id spec)) =\n {cap_ref. original_cap_at cap_ref spec \\ object_cap_ref cap_ref spec}\"\n by (auto simp: object_cap_ref_def opt_cap_def object_at_def cap_at_def real_object_at_def\n split: option.splits)\n\nlemma slots_tcb:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap;\n cdl_objects spec obj_id = Some obj; obj = Tcb tcb\\ \\\n slot = 0 \\\n slot = 1 \\\n slot = 2 \\\n slot = 3 \\\n slot = 4 \\\n slot = 5 \\\n slot = 6\"\n apply (frule (1) well_formed_object_slots)\n apply (drule (1) well_formed_well_formed_tcb)\n apply (clarsimp simp: well_formed_tcb_def opt_cap_def slots_of_def)\n apply (drule (1) dom_eqD)\n apply (clarsimp simp: object_default_state_def2 dom_object_slots_default_tcb\n tcb_pending_op_slot_def tcb_boundntfn_slot_def)\n done\n\nlemma object_at_dom_cdl_objects:\n \"object_at P obj_id s \\ obj_id \\ dom (cdl_objects s)\"\n by (clarsimp simp: object_at_def)\n\nlemma foo:\n \"\\well_formed spec; irq_node_at obj_id spec\\\n \\ obj_id \\ irq_nodes spec\"\n by (metis irq_nodes_def mem_Collect_eq)\n\nlemma well_formed_irqhandler_cap_in_cnode:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap;\n is_irqhandler_cap cap; cdl_objects spec obj_id = Some obj\\\n \\ is_cnode obj\"\n apply (case_tac obj)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def\n is_cnode_def object_at_def is_asidpool_def)+\n apply (frule (3) slots_tcb)\n apply (drule (1) well_formed_well_formed_tcb)\n apply (clarsimp simp: well_formed_tcb_def opt_cap_def slots_of_def)\n apply (erule allE [where x=slot])\n apply (simp add: tcb_slot_defs cap_type_def split: cdl_cap.splits)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def\n is_cnode_def object_at_def is_asidpool_def)\n apply (frule_tac obj_id=obj_id in well_formed_asidpool_at, simp add: object_at_def)\n apply (frule (1) well_formed_pt, simp add: object_at_def, simp+)\n apply (frule (1) well_formed_pd, simp add: object_at_def, simp+)\n apply (clarsimp simp: is_fake_pt_cap_def split: cdl_cap.splits)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def\n is_cnode_def object_at_def is_asidpool_def)+\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (fastforce simp: well_formed_irq_node_def opt_cap_def slots_of_def\n object_at_def irq_nodes_def is_irq_node_def)\n done\n\nlemma well_formed_irqhandler_cap_in_cnode_at:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap; is_irqhandler_cap cap\\\n \\ cnode_at obj_id spec\"\n apply (frule opt_cap_cdl_objects, clarsimp)\n apply (drule (3) well_formed_irqhandler_cap_in_cnode)\n apply (clarsimp simp: object_at_def)\n done\n\nlemma irqhandler_cap_rewrite:\n \"well_formed spec \\\n Set.filter (\\irq. irqhandler_cap_at irq spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}.\n dom (slots_of obj_id spec)) =\n {cap_ref. irqhandler_cap_at cap_ref spec}\"\n apply (clarsimp simp: object_cap_ref_def object_at_def cap_at_def\n split: option.splits)\n apply rule\n apply clarsimp\n apply clarsimp\n apply (frule opt_cap_dom_cdl_objects)\n apply (frule opt_cap_dom_slots_of, clarsimp)\n apply (frule (3) well_formed_irqhandler_cap_in_cnode)\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (clarsimp simp: well_formed_irq_node_def object_at_def\n opt_cap_def slots_of_def dom_def)\n done\n\nlemma well_formed_object_cap_real:\n \"well_formed spec\n \\ object_cap_ref cap_ref spec =\n (cap_at_to_real_object cap_ref spec \\\n cnode_at (fst cap_ref) spec)\"\n apply (clarsimp simp: cap_at_def cap_at_to_real_object_def object_cap_ref_def)\n apply (rule iffI)\n apply clarsimp\n apply (drule (1) well_formed_well_formed_cap_to_real_object', simp)\n apply (clarsimp simp: well_formed_cap_to_real_object_def real_object_at_def)\n apply (clarsimp simp: real_object_at_def opt_cap_dom_cdl_objects)\n done\n\n(* This lemma converts between the two represenatations of the fact that the\n * root task has orig caps to each of the objects.\n *\n * This can be specified either:\n * - on the objects themselves.\n * - on the cap slots of CNodes that have a orig cap in them.\n *\n * This relies on the bijection between orig capabilities and objects in the spec.\n *)\n\nlemma si_caps_at_conversion:\n \"\\well_formed spec;\n real_ids = {obj_id. real_object_at obj_id spec};\n cnode_ids = {obj_id. cnode_at obj_id spec}\\\n \\ si_objs_caps_at t si_caps spec dev cnode_ids =\n si_caps_at t si_caps spec dev real_ids\"\n apply (clarsimp simp: si_objs_caps_at_def si_obj_caps_at_def [abs_def]\n si_obj_cap_at_def [abs_def] si_caps_at_def)\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst orig_cap_rewrite)\n apply (frule well_formed_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_object cap_ref spec\", symmetric])\n apply (subst well_formed_object_cap_real, simp+)\n apply (simp add: real_objects_def real_object_at_def)\n apply (subst well_formed_object_cap_real, simp+)\n apply (clarsimp simp: cap_ref_object_def object_cap_ref_def si_obj_cap_at'_def)\n done\n\n\nlemma si_null_caps_at_conversion:\n \"\\well_formed spec;\n real_ids = {obj_id. real_object_at obj_id spec};\n cnode_ids = {obj_id. cnode_at obj_id spec}\\\n \\ si_spec_objs_null_caps_at t si_caps spec cnode_ids =\n si_null_caps_at t si_caps spec real_ids\"\n apply (clarsimp simp: si_spec_objs_null_caps_at_def si_spec_obj_null_caps_at_def [abs_def]\n si_spec_obj_null_cap_at_def [abs_def] si_null_caps_at_def)\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst orig_cap_rewrite)\n apply (frule well_formed_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_object cap_ref spec\"\n and h=\"(si_null_cap_at t si_caps spec)\"\n and B=\"{obj_id. real_object_at obj_id spec}\", symmetric])\n apply (subst well_formed_object_cap_real, simp+)\n apply (simp add: real_objects_def real_object_at_def)\n apply (subst well_formed_object_cap_real, simp+)\n apply (clarsimp simp: cap_ref_object_def object_cap_ref_def si_spec_obj_null_cap_at'_def)\n done\n\nlemma si_null_caps_at_reindex:\n \"\\distinct (obj_ids::32 word list); distinct (free_cptrs);\n orig_caps = map_of (zip obj_ids free_cptrs);\n length obj_ids \\ length free_cptrs\\\n \\ (\\* obj_id\\set obj_ids.\n (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n orig_caps obj_id = Some cap_ptr))\n = (\\* cptr\\set (take (length obj_ids) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap)\"\n apply (rule sep_map_set_conj_reindex_cong [symmetric, where\n f=\"\\obj_id. the (orig_caps obj_id)\"\n and h=\"\\cptr. (si_cnode_id, unat cptr) \\c NullCap\"\n and B=\"set (take (length obj_ids) free_cptrs)\"])\n apply clarsimp\n apply (erule (2) map_of_zip_inj')\n apply clarsimp\n apply (subst zip_take_length[symmetric])\n apply (subst map_of_zip_range)\n apply (clarsimp simp: min_def)\n apply assumption\n apply simp\n apply clarsimp\n apply (rule ext)\n apply rule\n apply clarsimp\n apply (rule_tac x=\"the (map_of (zip obj_ids free_cptrs) a)\" in exI)\n apply clarsimp\n apply (frule_tac x=a in map_of_zip_is_Some', clarsimp)\n done\n\nlemma si_null_caps_at_simplified_helper:\n \"\\(si_null_caps_at t orig_caps spec obj_ids) s\\ \\\n (\\* obj_id \\ obj_ids. (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n orig_caps obj_id = Some cap_ptr)) s\"\n apply (clarsimp simp: si_null_caps_at_def si_null_cap_at_def [abs_def])\n apply (erule sep_map_set_conj_impl)\n apply blast\n apply clarsimp\n done\n\nlemma si_null_caps_at_simplified:\n \"\\(si_spec_objs_null_caps_at t si_caps spec cnode_ids) s;\n well_formed spec;\n cnode_ids = {obj_id. cnode_at obj_id spec};\n real_ids = {obj_id. real_object_at obj_id spec};\n real_ids = set obj_ids;\n distinct obj_ids; distinct free_cptrs;\n si_caps = map_of (zip obj_ids free_cptrs);\n length obj_ids \\ length free_cptrs\\ \\\n (\\* cptr \\ set (take (length obj_ids) free_cptrs). ((si_cnode_id, unat cptr) \\c NullCap)) s\"\n apply (subst (asm) si_null_caps_at_conversion, assumption+)\n apply (drule si_null_caps_at_simplified_helper)\n apply (subst si_null_caps_at_reindex [symmetric], simp+)\n done\n\nlemma map_of_zip_range':\n \"\\length xs = length ys; distinct xs; set xs = X\\\n \\ (\\x. (the (map_of (zip xs ys) x))) ` X = set ys\"\n by (metis map_of_zip_range)\n\n\n\n\nlemma si_irq_caps_at_conversion:\n \"\\well_formed spec;\n cnode_ids = {obj_id. cnode_at obj_id spec};\n irqs = used_irqs spec\\\n \\ si_spec_irqs_caps_at irq_caps spec cnode_ids =\n si_irq_caps_at irq_caps spec irqs\"\n apply (clarsimp simp: si_spec_irqs_caps_at_def si_irq_caps_at_def\n si_spec_irq_caps_at_def [abs_def]\n si_spec_irq_cap_at_def [abs_def])\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst irqhandler_cap_rewrite, assumption)\n apply (frule well_formed_irqhandler_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_irq cap_ref spec\", symmetric], simp+)\n apply (clarsimp simp: si_spec_irq_cap_at'_def cap_ref_irq_def cap_at_def)\n done\n\ndefinition si_null_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq set \\ sep_pred\"\nwhere\n \"si_null_irq_caps_at si_irq_caps spec irqs \\\n \\* irq \\ irqs. si_null_irq_cap_at si_irq_caps spec irq\"\n\nlemma si_null_irq_caps_at_simplified_helper:\n \"\\(si_null_irq_caps_at si_irq_caps spec irqs) s\\ \\\n (\\* irq \\ irqs. (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n si_irq_caps irq = Some cap_ptr)) s\"\n apply (clarsimp simp: si_null_irq_caps_at_def si_null_irq_cap_at_def)\n apply (erule sep_map_set_conj_impl)\n apply blast\n apply clarsimp\n done\n\nlemma map_of_zip_inj2:\n \"\\distinct xs; distinct ys; length xs \\ length ys; set xs = X\\\n \\ inj_on (\\x. the (map_of (zip xs ys) x)) X\"\n by (metis map_of_zip_inj')\n\nlemma opt_cap_has_slots:\n \"\\opt_cap (obj_id, slot) spec = Some cap\\\n \\ object_at has_slots obj_id spec\"\n by (auto simp: object_at_def has_slots_def opt_cap_def slots_of_def object_slots_def\n split: option.splits cdl_object.splits)\n\nlemma well_formed_non_ntfn_in_real_object:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap; \\is_ntfn_cap cap; cap \\ NullCap\\\n \\ real_object_at obj_id spec\"\n apply (frule opt_cap_cdl_objects, clarsimp)\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (clarsimp simp: well_formed_irq_node_def real_object_at_def\n opt_cap_def slots_of_def opt_cap_dom_cdl_objects)\n done\n\n\nlemma irqhandler_cap_at_simp:\n \"well_formed spec \\\n {(obj_id, slot). cnode_at obj_id spec \\ irqhandler_cap_at (obj_id, slot) spec} =\n {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec}\"\n apply (safe)\n apply (clarsimp simp: cap_at_def)\n apply (frule (2) well_formed_irqhandler_cap_in_cnode_at)\n apply (frule (1) well_formed_non_ntfn_in_real_object, simp+)\n done\n\nlemma orig_cap_rewrite_v2:\n \"(SIGMA obj_id:{obj_id. cnode_at obj_id spec}. dom (slots_of obj_id spec)) =\n {(obj_id, slot). cnode_at obj_id spec \\ slots_of obj_id spec slot \\ None}\"\n by auto\n\nlemma rewrite_irqhandler_cap_at:\n \"well_formed spec \\\n Set.filter (\\cap_ref. irqhandler_cap_at cap_ref spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}. dom (slots_of obj_id spec)) =\n {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec}\"\n apply (subst irqhandler_cap_at_simp [symmetric])\n by (auto simp: opt_cap_def cap_at_def)\n\nlemma well_formed_used_irqs_rewrite:\n \"well_formed spec \\\n (\\cap_ref. cap_ref_irq cap_ref spec) ` {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec} =\n used_irqs spec\"\n apply (drule well_formed_irqhandler_bij)\n apply (auto simp: bij_betw_def)\n done\n\n\nlemma si_irq_null_caps_at_simplified:\n \"\\(si_spec_irqs_null_caps_at irq_caps spec {obj_id. cnode_at obj_id spec}) s;\n well_formed spec;\n distinct irqs; distinct free_cptrs;\n set irqs = used_irqs spec;\n irq_caps = map_of (zip irqs free_cptrs);\n length irqs \\ length free_cptrs\\ \\\n (\\* cptr \\ set (take (length irqs) free_cptrs). ((si_cnode_id, unat cptr) \\c NullCap)) s\"\n apply (clarsimp simp: si_spec_irqs_null_caps_at_def si_spec_irq_null_caps_at_def\n si_spec_irq_null_cap_at_def si_spec_irqs_caps_at_def)\n apply (subst (asm) sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst (asm) sep_map_set_conj_restrict_predicate, rule finite_SigmaI, clarsimp+)\n apply (subst (asm) rewrite_irqhandler_cap_at, simp)\n apply (subst (asm) sep_map_set_conj_reindex_cong [where\n f = \"\\cap_ref. cap_ref_irq cap_ref spec\"\n and h = \"si_null_irq_cap_at (map_of (zip irqs free_cptrs)) spec\", symmetric])\n apply (drule well_formed_irqhandler_bij)\n apply (clarsimp simp: bij_betw_def cond_case_prod_eta)\n apply simp\n apply (clarsimp simp: si_spec_irq_null_cap_at'_def cap_at_def cap_ref_irq_def)\n apply clarsimp\n apply (drule si_null_irq_caps_at_simplified_helper [simplified si_null_irq_caps_at_def])\n apply (subst (asm) sep_map_set_conj_reindex_cong [symmetric, where\n f = \"\\irq. the ( map_of (zip irqs free_cptrs) irq)\"\n and h = \"\\cptr. (si_cnode_id, unat cptr) \\c NullCap\"\n and B = \"set (take (length irqs) free_cptrs)\"])\n apply (subst well_formed_used_irqs_rewrite, assumption)\n apply (metis map_of_zip_inj')\n apply (subst well_formed_used_irqs_rewrite, assumption)\n apply (subst zip_take_length[symmetric], subst map_of_zip_range', simp+)\n apply (rule ext)\n apply rule\n apply clarsimp\n apply (rule_tac x=\"the (map_of (zip irqs free_cptrs) a)\" in exI)\n apply clarsimp\n apply (frule_tac x1=\"(cap_irq (the (opt_cap (aa, b) spec)))\" in map_of_zip_is_Some'[THEN iffD1], clarsimp)\n apply (fastforce simp: cap_at_def used_irqs_def all_caps_def)\n apply (clarsimp simp: cap_ref_irq_def)\n apply simp\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/sys-init/RootTask_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.33458945452352534, "lm_q1q2_score": 0.19194675029897013}} {"text": "(* Title: HOL/MicroJava/Comp/Index.thy\n Author: Martin Strecker\n*)\n\n(* Index of variable in list of parameter names and local variables *)\n\ntheory Index\nimports AuxLemmas DefsComp\nbegin\n\n(*indexing a variable name among all variable declarations in a method body*)\ndefinition index :: \"java_mb => vname => nat\" where\n \"index == \\ (pn,lv,blk,res) v.\n if v = This\n then 0 \n else Suc (length (takeWhile (\\ z. z~=v) (pn @ map fst lv)))\"\n\n\nlemma index_length_pns: \"\n \\ i = index (pns,lvars,blk,res) vn;\n wf_java_mdecl G C ((mn,pTs),rT, (pns,lvars,blk,res)); \n vn \\ set pns\\ \n \\ 0 < i \\ i < Suc (length pns)\"\napply (simp add: wf_java_mdecl_def index_def)\napply (subgoal_tac \"vn \\ This\")\napply (auto intro: length_takeWhile)\ndone\n\nlemma index_length_lvars: \"\n \\ i = index (pns,lvars,blk,res) vn;\n wf_java_mdecl G C ((mn,pTs),rT, (pns,lvars,blk,res)); \n vn \\ set (map fst lvars)\\ \n \\ (length pns) < i \\ i < Suc((length pns) + (length lvars))\"\napply (simp add: wf_java_mdecl_def index_def)\napply (subgoal_tac \"vn \\ This\")\napply simp\napply (subgoal_tac \"\\ x \\ set pns. (\\z. z \\ vn) x\")\napply simp\napply (subgoal_tac \"length (takeWhile (\\z. z \\ vn) (map fst lvars)) < length (map fst lvars)\")\napply simp\napply (rule length_takeWhile)\napply simp\napply (simp add: map_of_in_set)\napply (intro strip notI) apply simp apply blast\ndone\n\n\n(*** index ***)\n\nlemma select_at_index : \n \"x \\ set (gjmb_plns (gmb G C S)) \\ x = This \n \\ (the (loc This) # glvs (gmb G C S) loc) ! (index (gmb G C S) x) = \n the (loc x)\"\napply (simp only: index_def gjmb_plns_def)\napply (case_tac \"gmb G C S\" rule: prod.exhaust)\napply (simp add: galldefs del: set_append map_append)\napply (rename_tac a b)\napply (case_tac b, simp add: gmb_def gjmb_lvs_def del: set_append map_append)\napply (intro strip)\napply (simp del: set_append map_append)\napply (frule length_takeWhile)\napply (frule_tac f = \"(the \\ loc)\" in nth_map)\napply simp\ndone\n\nlemma lift_if: \"(f (if b then t else e)) = (if b then (f t) else (f e))\"\napply auto\ndone\n\nlemma update_at_index: \"\n \\ distinct (gjmb_plns (gmb G C S)); \n x \\ set (gjmb_plns (gmb G C S)); x \\ This \\ \\ \n locvars_xstate G C S (Norm (h, l))[index (gmb G C S) x := val] =\n locvars_xstate G C S (Norm (h, l(x\\val)))\"\napply (simp only: locvars_xstate_def locvars_locals_def index_def)\napply (case_tac \"gmb G C S\" rule: prod.exhaust, simp)\napply (rename_tac a b)\napply (case_tac b, simp)\napply (rule conjI)\napply (simp add: gl_def)\napply (simp add: galldefs del: set_append map_append)\ndone\n\n\n(* !!!! incomprehensible: why can't List.takeWhile_append2 be applied the same \n way in the second case as in the first case ? *)\nlemma index_of_var: \"\\ xvar \\ set pns; xvar \\ set (map fst zs); xvar \\ This \\\n \\ index (pns, zs @ ((xvar, xval) # xys), blk, res) xvar = Suc (length pns + length zs)\"\napply (simp add: index_def)\napply (subgoal_tac \"(\\x. ((x \\ (set pns)) \\ ((\\z. (z \\ xvar))x)))\")\napply simp\napply (subgoal_tac \"(takeWhile (\\z. z \\ xvar) (map fst zs @ xvar # map fst xys)) = map fst zs @ (takeWhile (\\z. z \\ xvar) (xvar # map fst xys))\")\napply simp\napply (rule List.takeWhile_append2)\napply auto\ndone\n\n\n\n\n(* The following def should replace the conditions in WellType.thy / wf_java_mdecl\n*)\ndefinition disjoint_varnames :: \"[vname list, (vname \\ ty) list] \\ bool\" where\n(* This corresponds to the original def in wf_java_mdecl:\n \"disjoint_varnames pns lvars \\ \n nodups pns \\ unique lvars \\ This \\ set pns \\ This \\ set (map fst lvars) \\ \n (\\pn\\set pns. map_of lvars pn = None)\"\n*)\n\n \"disjoint_varnames pns lvars \\ \n distinct pns \\ unique lvars \\ This \\ set pns \\ This \\ set (map fst lvars) \\ \n (\\pn\\set pns. pn \\ set (map fst lvars))\"\n\n\nlemma index_of_var2: \"\n disjoint_varnames pns (lvars_pre @ (vn, ty) # lvars_post)\n \\ index (pns, lvars_pre @ (vn, ty) # lvars_post, blk, res) vn =\n Suc (length pns + length lvars_pre)\"\napply (simp add: disjoint_varnames_def index_def unique_def)\napply (subgoal_tac \"vn \\ This\", simp)\napply (subgoal_tac\n \"takeWhile (\\z. z \\ vn) (map fst lvars_pre @ vn # map fst lvars_post) =\n map fst lvars_pre @ takeWhile (\\z. z \\ vn) (vn # map fst lvars_post)\")\napply simp \napply (rule List.takeWhile_append2)\napply auto\ndone\n\nlemma wf_java_mdecl_disjoint_varnames: \n \"wf_java_mdecl G C (S,rT,(pns,lvars,blk,res)) \n \\ disjoint_varnames pns lvars\"\napply (cases S)\napply (simp add: wf_java_mdecl_def disjoint_varnames_def map_of_in_set)\ndone\n\nlemma wf_java_mdecl_length_pTs_pns: \n \"wf_java_mdecl G C ((mn, pTs), rT, pns, lvars, blk, res)\n \\ length pTs = length pns\"\nby (simp add: wf_java_mdecl_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/Comp/Index.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.19194673400209927}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__48_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__48_on_rules imports n_german_lemma_on_inv__48\nbegin\nsection{*All lemmas on causal relation between inv__48*}\nlemma lemma_inv__48_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__48) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__48_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3665897294020099, "lm_q1q2_score": 0.19188052408007264}} {"text": "theory WordArray_Update\n imports WordArray_Abstractions\n\nbegin\n\ncontext WordArray begin\n\ntype_synonym ('f, 'a, 'l) ufoldmapdef = \"(funtyp, abstyp, ptrtyp) uabsfuns \\ ('f, 'a, 'l) store \\\n ptrtyp \\ 32 word \\ 32 word \\ 'f expr \\ \n ('f, 'a, 'l) uval \\ ('f, 'a, 'l) uval \\ ptrtyp set\\\n (('f, 'a, 'l) store \\ ('f, 'a, 'l) uval) \\ bool\"\n\nsection wordarray_length\n\ndefinition upd_wa_length_0\n where\n \"upd_wa_length_0 x y =\n (let (x1, x2) = x;\n (y1, y2) = y\n in x1 = y1 \\ (\\p t len arr. x2 = UPtr p (RCon ''WordArray'' [RPrim (Num t)]) \\\n x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\ y2 = UPrim (LU32 len)))\"\n\nlemma upd_wa_length_preservation:\n \"\\upd.uval_typing \\' \\ v (TCon ''WordArray'' [t] (Boxed ReadOnly ptrl)) r w;\n upd_wa_length_0 (\\, v) (\\', v')\\\n \\ \\r' w'. upd.uval_typing \\' \\' v' (TPrim (Num U32)) r' w' \\ r' \\ r \\ frame \\ w \\' w'\"\n apply (clarsimp simp: upd_wa_length_0_def)\n apply (erule upd.u_t_p_absE; clarsimp)\n apply (rule_tac x = \"{}\" in exI)+\n apply (clarsimp simp: frame_def intro!: upd.u_t_prim')\n done\n\nsection wordarray_get\n\ndefinition upd_wa_get_0\n where\n \"upd_wa_get_0 x y =\n (let (x1, x2) = x;\n (y1, y2) = y\n in x1 = y1 \\ (\\p idx t len arr. x2 = URecord [\n (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n (UPrim (LU32 idx), RPrim (Num U32))] \\ x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\\n (idx < len \\ x1 (arr + size_of_num_type t * idx) = option.Some y2) \\\n (\\ idx < len \\ y2 = UPrim (zero_num_lit t))))\"\n\nlemma upd_wa_get_preservation:\n \"\\upd.uval_typing \\' \\ v (TRecord [(a, TCon ''WordArray'' [t] (Boxed ReadOnly ptrl), Present),\n (b, TPrim (Num U32), Present)] Unboxed) r w; upd_wa_get_0 (\\, v) (\\', v')\\\n \\ \\r' w'. upd.uval_typing \\' \\' v' t r' w' \\ r' \\ r \\ frame \\ w \\' w'\"\n apply (clarsimp simp: upd_wa_get_0_def)\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; clarsimp)\n apply (erule upd.u_t_p_absE[where s = \"Boxed ReadOnly _\", simplified])\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (erule upd.u_t_primE; subst (asm) lit_type.simps; clarsimp)+\n apply (rule_tac x = \"{}\" in exI)+\n apply (frule wa_abs_typing_u_elims(1))\n apply (frule wa_abs_typing_u_elims(5))\n apply (clarsimp simp: upd.frame_id)\n apply (erule_tac x = idx in allE)\n apply (case_tac \"idx < len\"; clarsimp)\n apply (rule upd.u_t_prim'; clarsimp)+\n apply (case_tac ta; clarsimp intro!: upd.u_t_prim')\n done\n\nsection wordarray_put2\n\ndefinition upd_wa_put2_0\n where\n \"upd_wa_put2_0 x y =\n (let (x1, x2) = x;\n (y1, y2) = y\n in (\\p idx val t len arr. x2 = URecord [\n (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n (UPrim (LU32 idx), RPrim (Num U32)), (val, RPrim (Num t))] \\\n x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\\n y2 = UPtr p (RCon ''WordArray'' [RPrim (Num t)]) \\\n (if idx < len \n then y1 = x1((arr + size_of_num_type t * idx) \\ val)\n else y1 = x1)))\"\n\nlemma upd_wa_put2_preservation:\n \"\\upd.uval_typing \\' \\ v (TRecord [(a, TCon ''WordArray'' [t] (Boxed Writable ptrl), Present),\n (b, TPrim (Num U32), Present), (c, t, Present)] Unboxed) r w; upd_wa_put2_0 (\\, v) (\\', v')\\\n \\ \\r' w'. upd.uval_typing \\' \\' v' (TCon ''WordArray'' [t] (Boxed Writable ptrl)) r' w' \\\n r' \\ r \\ frame \\ w \\' w'\"\n apply (clarsimp simp: upd_wa_put2_0_def)\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; clarsimp)\n apply (erule upd.u_t_p_absE[where s = \"Boxed Writable _\", simplified])\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (subst (asm) type_repr.simps[symmetric])+\n apply clarsimp\n apply (erule upd.u_t_r_consE; simp)\n apply (erule conjE)+\n apply (subst (asm) type_repr.simps[symmetric])+\n apply clarsimp\n apply (erule upd.u_t_r_emptyE)\n apply (erule upd.u_t_primE)+\n apply (subst (asm) lit_type.simps)+\n apply clarsimp\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply (erule type_repr.elims[where y = \"RPrim _\", simplified]; clarsimp)\n apply (frule upd.tprim_no_pointers(1); clarsimp)\n apply (frule upd.tprim_no_pointers(2); clarsimp)\n apply (rule_tac x = r in exI)\n apply (rule_tac x = \"insert p wa\" in exI)\n apply (erule u_t_primtE; clarsimp)\n apply (drule_tac t = \"lit_type _\" in sym)\n apply (rule conjI)\n apply (rule_tac ptrl = ptrl and a = \"UWA (TPrim (Num ta)) len arr\" \n in upd.u_t_p_abs_w[where ts = \"[TPrim _]\", simplified]; simp?)\n apply (clarsimp split: if_split_asm)\n apply (rule wa_abs_typing_u_update; simp)\n apply (frule wa_abs_typing_u_elims(3); clarsimp split: if_splits)\n apply (clarsimp split: if_splits simp: upd.frame_id)\n apply (frule wa_abs_typing_u_elims(3); clarsimp)\n apply (clarsimp simp: frame_def)\n apply (rule conjI; clarsimp)\n apply (rule conjI, clarsimp)\n apply (erule_tac x = idx in allE; clarsimp)+\n apply (rule conjI; clarsimp)\n apply (rule conjI; clarsimp)\n done\n\nsection wordarray_fold_no_break\n\nfunction upd_wa_foldnb_bod :: \"(char list, atyp, 32 word) ufoldmapdef\"\n where\n \"upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s res = (\\t len arr. \n \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\ \n (\\iv. \\ (arr + size_of_num_type t * i) = option.Some v) \\\n (if frm < min to len then (\\v acc' \\' w1 w2. \\ (arr + size_of_num_type t * frm) = option.Some v \\ \n (\\\\<^sub>u, [(URecord [(v, upd.uval_repr v), (acc, upd.uval_repr acc), \n (obsv, upd.uval_repr obsv)])] \\ (\\, App f (Var 0)) \\! (\\', acc')) \\\n frame \\ w1 \\' w2 \\ ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {} \\\n upd_wa_foldnb_bod \\\\<^sub>u \\' p (frm + 1) to f acc' obsv s res) \n else (\\, acc) = res))\"\n by pat_completeness auto\ntermination\n apply (relation \"measure (\\(_, _, _, frm, to, _, _, _, _, _). unat to - unat frm)\"; clarsimp)\n apply (clarsimp simp: word_less_nat_alt)\n apply (cut_tac n = frm in unat_Suc2; clarsimp)\n apply (cut_tac y = to in word_not_simps(3); clarsimp simp: word_less_nat_alt)\n apply linarith\n done\n\ndeclare upd_wa_foldnb_bod.simps[simp del]\n\nlemma upd_wa_foldnb_bod_to_geq_len:\n \"\\upd_wa_foldnb_bod \\\\<^sub>u \\ p frm len f acc obsv s (\\', r); \\ p = option.Some (UAbstract (UWA t len arr));\n to \\ len\\ \\ upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_foldnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"])\n apply clarsimp\n apply (drule_tac x = len in meta_spec)\n apply (subst (asm) upd_wa_foldnb_bod.simps)\n apply (clarsimp split: if_splits)\n apply (erule disjE; clarsimp)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (clarsimp simp: frame_def)\n apply (erule_tac x = p in allE; clarsimp)\n apply (rule FalseE)\n apply auto[1]\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply clarsimp\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (erule meta_mp)\n apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp)\n done\n\nlemma upd_wa_foldnb_bod_to_geq_lenD:\n \"\\upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r); \\ p = option.Some (UAbstract (UWA t len arr));\n to \\ len\\ \\ upd_wa_foldnb_bod \\\\<^sub>u \\ p frm len f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_foldnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"])\n apply clarsimp\n apply (drule_tac x = len in meta_spec)\n apply (subst (asm) upd_wa_foldnb_bod.simps)\n apply (clarsimp split: if_splits)\n apply (erule disjE; clarsimp)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n apply (erule meta_impE; simp)\n apply (case_tac \"frm < to\")\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply clarsimp\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n apply (erule meta_impE; simp)\n apply clarsimp\n apply (subgoal_tac \"\\ frm < len\")\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply auto\n done\n\nlemma upd_wa_foldnb_bod_step:\n \"\\upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r); \n \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)); frm \\ to; to < len; \n \\ (arr + size_of_num_type t * to) = option.Some v; frame \\' w1 \\'' w2; \n ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {};\n \\\\<^sub>u, [URecord [(v, upd.uval_repr v), (r, upd.uval_repr r), (obsv, upd.uval_repr obsv)]] \\ (\\', App f (Var 0))\\! (\\'', r')\\ \n \\ upd_wa_foldnb_bod \\\\<^sub>u \\ p frm (to + 1) f acc obsv s (\\'', r')\"\n apply (induct arbitrary: r \\'\n rule: upd_wa_foldnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"])\n apply clarsimp\n apply (drule_tac x = len in meta_spec)\n apply (erule upd_wa_foldnb_bod.elims)\n apply (clarsimp split: if_splits)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'''' in meta_spec)\n apply (drule_tac x = b in meta_spec)\n apply (drule_tac x = a in meta_spec)\n apply clarsimp\n apply (subst upd_wa_foldnb_bod.simps)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\'''' in exI)\n apply clarsimp\n apply (rule_tac x = w1a in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (case_tac \"frma + 1 \\ toa\")\n apply clarsimp\n apply (frule_tac p = pa and w = w1a in valid_ptr_not_in_frame_same; simp?)\n apply (frule_tac p = \"arr + size_of_num_type t * toa\" and w = w1a in valid_ptr_not_in_frame_same; simp?)\n apply blast\n apply clarsimp\n apply (clarsimp simp: not_le)\n apply (drule_tac i = frma and m = toa in inc_le)\n apply (rule FalseE)\n apply simp\n apply (clarsimp simp: not_less)\n apply (rule FalseE)\n apply (simp add: less_is_non_zero_p1 plus_one_helper2 word_le_not_less)\n apply (erule disjE)\n apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n apply (rule conjI; clarsimp)\n apply (rule_tac x = r' in exI)\n apply (rule_tac x = \\'' in exI)\n apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = w2 in exI; clarsimp)\n apply (rule_tac x = t in exI)\n apply (rule_tac x = len in exI)\n apply (rule_tac x = arr in exI)\n apply (rule conjI)\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n apply clarsimp\n apply (erule_tac x = i in allE; clarsimp)\n apply (rule_tac x = va in exI)\n apply (drule_tac p = \"arr + size_of_num_type t * i\" in valid_ptr_not_in_frame_same; simp?)\n apply blast\n apply (clarsimp simp: not_less)\n apply (meson less_is_non_zero_p1 word_le_not_less word_overflow)\n apply (clarsimp simp: not_less)\n by auto\n\nlemma upd_wa_foldnb_bod_back_step':\n \"\\upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r); \n \\ p = option.Some (UAbstract (UWA t len arr)); len < to\\\n \\ upd_wa_foldnb_bod \\\\<^sub>u \\ p frm (to - 1) f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_foldnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"]; clarsimp)\n apply (drule_tac x = len in meta_spec)\n apply (erule upd_wa_foldnb_bod.elims) \n apply (subst upd_wa_foldnb_bod.simps)\n apply (clarsimp split: if_split_asm)\n apply (rule_tac x = ta in exI)\n apply (rule conjI; clarsimp)\n apply (cut_tac x = frma and n = \"toa - 1\" in plus_one_helper2; simp)\n apply auto[1]\n apply clarsimp\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'' in meta_spec)\n apply clarsimp\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\'' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI; clarsimp)\n apply (erule meta_mp)\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n apply (rule FalseE)\n by (metis (no_types, hide_lams) less_1_simp word_le_less_eq word_not_le)\n\nlemma upd_wa_foldnb_bod_back_step:\n \"\\upd_wa_foldnb_bod \\\\<^sub>u \\ p frm (1 + to) f acc obsv s (\\', r); 1 + to \\ len; frm < 1 + to; \n \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr))\\\n \\ \\\\'' r'' w1 w2 v. upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\'', r'') \\ \n \\ (arr + size_of_num_type t * to) = option.Some v \\\n (\\\\<^sub>u, [URecord [(v, upd.uval_repr v), (r'', upd.uval_repr r''), \n (obsv, upd.uval_repr obsv)]] \\ (\\'', App f (Var 0))\\! (\\', r)) \\\n frame \\'' w1 \\' w2 \\ ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {}\"\n apply (induct arbitrary: \\' r\n rule: upd_wa_foldnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"]; clarsimp)\n apply (erule upd_wa_foldnb_bod.elims) \n apply (clarsimp split: if_split_asm)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\''' in meta_spec)\n apply (drule_tac x = a in meta_spec)\n apply (drule_tac x = b in meta_spec)\n apply clarsimp\n apply (case_tac \"frma < to\"; clarsimp)\n apply (drule meta_mp)\n apply (metis (no_types, hide_lams) add.commute inc_le plus_le_left_cancel_wrap word_le_less_eq word_le_not_less word_plus_strict_mono_right)\n apply (drule meta_mp)\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n apply clarsimp\n apply (rule_tac x = \\'''' in exI)\n apply (rule_tac x = r'' in exI)\n apply (rule conjI)\n apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\''' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule_tac x = x in exI)\n apply clarsimp\n apply (rule_tac x = w1a in exI)\n apply (rule_tac x = w2 in exI)\n apply (erule_tac x = to in allE; clarsimp)\n apply (erule impE)\n apply (metis (no_types, hide_lams) add.commute less_is_non_zero_p1 plus_one_helper plus_one_helper2 word_neq_0_conv word_not_le)\n apply (rule_tac x = va in exI)\n apply clarsimp\n apply (drule_tac p = \"arr + size_of_num_type t * to\" in valid_ptr_not_in_frame_same; simp; clarsimp)\n apply (drule_tac x = \"arr + size_of_num_type t * to\" in orthD1; simp)\n apply (rule disjI2)\n apply (rule_tac x = to in exI)\n apply clarsimp\n apply (metis (no_types, hide_lams) add.commute plus_one_helper2 word_not_le word_not_simps(1))\n apply (subgoal_tac \"frma = to\")\n apply clarsimp\n apply (subst upd_wa_foldnb_bod.simps; clarsimp simp: add.commute)\n apply (erule upd_wa_foldnb_bod.elims; clarsimp simp: add.commute)\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule_tac x = x in exI)\n apply clarsimp\n apply (metis add.commute le_step)\n apply (rule FalseE)\n by auto\n\nlemma upd_wa_foldnb_bod_preservation:\n \"\\proc_ctx_wellformed \\'; upd.proc_env_matches_ptrs \\\\<^sub>u \\';\n upd_wa_foldnb_bod \\\\<^sub>u \\ p frm to f acc obsv (rb \\ rc) (\\', res);\n \\ p = option.Some (UAbstract (UWA t len arr)); \n wa_abs_typing_u (UWA t len arr) ''WordArray'' [t] (Boxed ReadOnly ptrl) ra wa \\;\n upd.uval_typing \\' \\ acc u rb wb; upd.uval_typing \\' \\ obsv v rc {}; wb \\ rc = {};\n \\', [], [option.Some (TRecord [\n (b0, t, Present), (b1, u, Present), (b2, v, Present)] Unboxed)] \\ (App f (Var 0)) : u;\n distinct [b0, b1, b2]\\\n \\ \\r' w'. upd.uval_typing \\' \\' res u r' w' \\ r' \\ ({p} \\ ra \\ rb \\ rc) \\ frame \\ wb \\' w'\"\n apply (induct to arbitrary: \\' res)\n apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n apply (rule_tac x = rb in exI)\n apply (rule_tac x = wb in exI)\n apply (clarsimp simp: upd.frame_id)\n apply (case_tac \"len < 1 + to\")\n apply (drule upd_wa_foldnb_bod_back_step'; simp?)\n apply (case_tac \"1 + to \\ frm\")\n apply (frule_tac y = \"1 + to\" and x = frm in leD)\n apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n apply (rule_tac x = rb in exI)\n apply (rule_tac x = wb in exI)\n apply (clarsimp simp: upd.frame_id)\n apply (frule wa_abs_typing_u_elims(1); clarsimp)\n apply (drule upd_wa_foldnb_bod_back_step; simp?)\n apply clarsimp\n apply (drule_tac x = \\'' in meta_spec)\n apply (drule_tac x = r'' in meta_spec)\n apply clarsimp\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = to in allE; clarsimp)+\n apply (erule impE)\n apply (cut_tac x = to in word_overflow)\n apply (erule disjE; clarsimp simp: add.commute)\n apply auto[1]\n apply clarsimp\n apply (drule_tac ?\\ = \"[option.Some (TRecord [(b0, TPrim (Num ta), Present), (b1, u, Present),\n (b2, v, Present)] Unboxed)]\" and r = \"r' \\ rc\" and w = w' and \\ = u in upd.preservation_mono(1); simp?)\n apply (rule upd.matches_ptrs_some[where ts = \"[]\" and r' = \"{}\" and w' = \"{}\", simplified])\n apply (rule upd.u_t_struct; simp?)\n apply (rule upd.u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified])\n apply (rule upd.u_t_prim'; clarsimp)\n apply (rule upd.u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.uval_typing_frame(1); simp?)\n apply blast\n apply (rule upd.u_t_r_empty)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp)\n apply (rule disjointI)\n apply (thin_tac \"frame _ _ _ _\")\n apply (clarsimp simp: frame_def)\n apply (erule_tac x = y in allE; clarsimp)+\n apply (drule_tac x = y in orthD2; simp)\n apply (drule_tac u = obsv and p = y in upd.uval_typing_valid(1)[rotated 1]; simp)\n apply (drule_tac v = r'' in upd.type_repr_uval_repr(1); simp)\n apply clarsimp\n apply (rule upd.matches_ptrs_empty[where \\s = \"[]\", simplified])\n apply clarsimp\n apply (thin_tac \"frame _ _ _ _\")\n apply (rule_tac x = r'a in exI)\n apply (rule_tac x = w'a in exI)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule upd.frame_trans; simp)\n done\n\ndefinition upd_wa_foldnb\n where\n \"upd_wa_foldnb \\' \\\\<^sub>u \\ y z = \n (let (y1, y2) = y\n in (\\p frm to func acc obsv t u v a0 a1 a2 ra wa rb.\n y2 = URecord [(UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n (UPrim (LU32 frm), RPrim (Num U32)), (UPrim (LU32 to), RPrim (Num U32)),\n (func, RFun), (acc, upd.uval_repr acc), (obsv, upd.uval_repr obsv)] \\\n (\\len arr. y1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\ \n (\\ix. y1 (arr + size_of_num_type t * i) = option.Some (UPrim x) \\ lit_type x = Num t)) \\\n is_uval_fun func \\ upd.uval_typing \\' y1 acc u ra wa \\ upd.uval_typing \\' y1 obsv v rb {} \\\n \\ = TRecord [(a0, TPrim (Num t), Present), (a1, u, Present), (a2, v, Present)] Unboxed \\\n distinct [a0, a1, a2] \\ (\\', [], [option.Some \\] \\ (App (uvalfun_to_exprfun func) (Var 0)) : u) \\\n upd_wa_foldnb_bod \\\\<^sub>u y1 p frm to (uvalfun_to_exprfun func) acc obsv (ra \\ rb) z))\"\n\nsection wordarray_map_no_break\n\nfunction upd_wa_mapAccumnb_bod :: \"(char list, atyp, ptrtyp) ufoldmapdef\"\n where\n \"upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s res = (\\t len arr. \n \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\ \n (\\iv. \\ (arr + size_of_num_type t * i) = option.Some v) \\\n (\\i (arr + size_of_num_type t * i)) \\\n (if frm < min to len then \n (\\v v' acc' \\' w1 w2. \\ (arr + size_of_num_type t * frm) = option.Some v \\\n (\\\\<^sub>u, [(URecord [(v, upd.uval_repr v), (acc, upd.uval_repr acc), (obsv, upd.uval_repr obsv)])]\n \\ (\\, App f (Var 0)) \\! (\\', URecord [ (v', upd.uval_repr v'), (acc', upd.uval_repr acc')])) \\\n frame \\ w1 \\' w2 \\ ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {} \\\n upd_wa_mapAccumnb_bod \\\\<^sub>u (\\'((arr + size_of_num_type t * frm) \\ v')) p (frm + 1) to f \n acc' obsv s res) \n else res = (\\, URecord [\n (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])), \n (acc, upd.uval_repr acc)])))\"\n by pat_completeness auto\ntermination\n apply (relation \"measure (\\(_, _, _, frm, to, _, _, _, _, _). unat to - unat frm)\"; clarsimp)\n apply (clarsimp simp: word_less_nat_alt)\n apply (cut_tac n = frm in unat_Suc2; clarsimp)\n apply (cut_tac y = to in word_not_simps(3); clarsimp simp: word_less_nat_alt)\n apply linarith\n done\n\ndeclare upd_wa_mapAccumnb_bod.simps[simp del]\n\nlemma upd_wa_mapAccumnb_bod_to_geq_len:\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm len f acc obsv s (\\', r); \\ p = option.Some (UAbstract (UWA t len arr));\n to \\ len\\ \\ upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"])\n apply clarsimp\n apply (case_tac \"frm \\ len\")\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp split: if_splits)\n apply (drule_tac x = frma in leD; clarsimp)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (erule upd_wa_mapAccumnb_bod.elims)\n apply (clarsimp split: if_split_asm)\n apply (drule_tac x = frma in not_le_imp_less; clarsimp)\n apply (drule_tac x = ta in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (drule_tac x = v' in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'' in meta_spec)\n apply clarsimp\n apply (drule meta_mp)\n apply (drule_tac c = to in order.strict_trans2; simp)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (frule_tac c = to in order.strict_trans2; simp)\n apply (rule_tac x = v' in exI)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\'' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI)\n apply clarsimp\n apply (erule meta_impE; simp?)\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n done\n\nlemma upd_wa_mapAccumnb_bod_to_geq_lenD:\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r); \\ p = option.Some (UAbstract (UWA t len arr));\n to \\ len\\ \\ upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm len f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"])\n apply clarsimp\n apply (case_tac \"frm \\ len\")\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp split: if_splits)\n apply (drule_tac x = frma in leD; clarsimp)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (erule upd_wa_mapAccumnb_bod.elims)\n apply (clarsimp split: if_split_asm)\n apply (drule_tac x = frma in not_le_imp_less; clarsimp)\n apply (frule_tac c = toa in order.strict_trans2; clarsimp)\n apply (drule_tac x = ta in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (drule_tac x = v' in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'' in meta_spec)\n apply clarsimp\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule_tac x = v' in exI)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\'' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = x in exI)\n apply clarsimp\n apply (erule meta_impE; simp?)\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n done\n\nlemma upd_wa_mapAccumnb_bod_preservation':\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s r; \\ p = option.Some (UAbstract (UWA t len arr))\\\n \\ \\\\' racc. r = (\\', URecord [\n (UPtr p (RCon ''WordArray'' [type_repr t]), RPtr (RCon ''WordArray'' [type_repr t])),\n (racc, upd.uval_repr racc)])\"\n apply (induct rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s r])\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp split: if_splits)\n apply (erule disjE; clarsimp)\n apply (drule_tac x = ta in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (drule_tac x = v' in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'' in meta_spec)\n apply clarsimp\n apply (drule_tac p = pa in valid_ptr_not_in_frame_same; simp?)\n apply clarsimp\n done\n\nlemma upd_wa_mapAccumnb_bod_step:\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', URecord [rp, (r, repr)]); \n \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)); frm \\ to; to < len;\n unat (size_of_num_type t) * unat len \\ unat (max_word :: ptrtyp);\n \\' (arr + size_of_num_type t * to) = option.Some v; frame \\' w1 \\'' w2; \n ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {};\n \\\\<^sub>u, [URecord [(v, upd.uval_repr v), (r, upd.uval_repr r), (obsv, upd.uval_repr obsv)]] \\ \n (\\', App f (Var 0))\\! (\\'', URecord [ (v', upd.uval_repr v'), (r', upd.uval_repr r')])\\ \n \\ upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm (to + 1) f acc obsv s \n (\\''((arr + size_of_num_type t * to) \\ v'), URecord [rp, (r', upd.uval_repr r')])\"\n apply (induct arbitrary: r \\'\n rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', URecord [rp, (r, upd.uval_repr r)])\"])\n apply clarsimp\n apply (drule_tac x = t in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp split: if_splits)\n apply (rename_tac \\\\<^sub>u \\ p frm to f acc obsv s \\' va v'a acc' \\a w1a w2a)\n apply (drule_tac x = v'a in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\a in meta_spec)\n apply (drule_tac x = r in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule conjI; clarsimp)\n apply (rule_tac x = v'a in exI)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\a in exI)\n apply clarsimp\n apply (rule_tac x = w1a in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = w2a in exI)\n apply clarsimp\n apply (drule meta_mp)\n apply (drule_tac p = p and w = w1a in valid_ptr_not_in_frame_same; simp)\n apply (drule meta_mp)\n apply (simp add: inc_le)\n apply simp\n apply (rule FalseE)\n apply (simp add: less_is_non_zero_p1 plus_one_helper2)\n apply (rename_tac \\\\<^sub>u \\ p frm to f acc obsv s)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule conjI; clarsimp)\n apply (rule_tac x = v' in exI)\n apply (rule_tac x = r' in exI)\n apply (rule_tac x = \\'' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x = w2 in exI)\n apply clarsimp\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule_tac x = len in exI)\n apply (rule_tac x = arr in exI)\n apply clarsimp\n apply (rule conjI)\n apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp)\n apply clarsimp\n apply (erule_tac x = i in allE)\n apply clarsimp\n apply (rule_tac x = va in exI)\n apply (drule_tac p = \"arr + size_of_num_type t * i\" in valid_ptr_not_in_frame_same; simp?)\n apply blast\n apply (erule impE)\n apply (metis (no_types, hide_lams) add.commute dual_order.strict_trans less_le max_word_max word_Suc_le word_le_less_eq word_not_le)\n apply (rule FalseE)\n apply clarsimp\n by auto\n\nlemma upd_wa_mapAccumnb_bod_back_step':\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\', r); \n \\ p = option.Some (UAbstract (UWA t len arr)); len < to\\\n \\ upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm (to - 1) f acc obsv s (\\', r)\"\n apply (induct rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', r)\"]; clarsimp)\n apply (erule upd_wa_mapAccumnb_bod.elims)\n apply (subst upd_wa_mapAccumnb_bod.simps)\n apply (clarsimp split: if_split_asm)\n apply (rule_tac x = ta in exI)\n apply (drule_tac x = ta in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (rule conjI; clarsimp)\n apply (cut_tac x = frma and n = \"toa - 1\" in plus_one_helper2; simp)\n apply auto[1]\n apply clarsimp\n apply (drule_tac x = v' in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\'' in meta_spec)\n apply (frule_tac p = pa in valid_ptr_not_in_frame_same; simp)\n apply clarsimp\n apply (rule_tac x = v' in exI)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\'' in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule_tac x = x in exI; clarsimp)\n apply (rule FalseE)\n apply (metis (no_types, hide_lams) not_less_iff_gr_or_eq word_less_cases)\n done\n\nlemma upd_wa_mapAccumnb_bod_back_step:\n \"\\upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm (1 + to) f acc obsv s (\\', URecord [rp, (r, upd.uval_repr r)]);\n unat (size_of_num_type t) * unat len \\ unat (max_word :: ptrtyp);\n 1 + to \\ len; frm < 1 + to; \\ p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr))\\\n \\ \\\\a \\b r'' w1 w2 v v'.\n upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv s (\\a, URecord [rp, (r'', upd.uval_repr r'')]) \\\n \\ (arr + size_of_num_type t * to) = option.Some v \\\n (\\\\<^sub>u, [URecord [(v, upd.uval_repr v), (r'', upd.uval_repr r''), (obsv, upd.uval_repr obsv)]] \n \\ (\\a, App f (Var 0))\\! (\\b, URecord [(v', upd.uval_repr v'), (r, upd.uval_repr r)])) \\ \n \\' = \\b((arr + size_of_num_type t * to) \\ v') \\ frame \\a w1 \\b w2 \\ \n ({p} \\ s \\ {arr + size_of_num_type t * i | i. i < len}) \\ w1 = {}\"\n apply (induct arbitrary: \\' r\n rule: upd_wa_mapAccumnb_bod.induct[of _ \\\\<^sub>u \\ p frm to f acc obsv s \"(\\', URecord [rp, (r, upd.uval_repr r)])\"]; clarsimp)\n apply (erule upd_wa_mapAccumnb_bod.elims)\n apply (drule_tac x = t in meta_spec)\n apply (drule_tac x = len in meta_spec)\n apply (drule_tac x = arr in meta_spec)\n apply (clarsimp split: if_split_asm)\n apply (rename_tac \\\\<^sub>u \\ p frm f acc obsv s \\' v v' acc' \\1 w1 w2)\n apply (drule_tac x = v' in meta_spec)\n apply (drule_tac x = acc' in meta_spec)\n apply (drule_tac x = \\1 in meta_spec)\n apply (drule_tac x = \\' in meta_spec)\n apply (drule_tac x = r in meta_spec)\n apply clarsimp\n apply (case_tac \"frm < to\"; clarsimp)\n apply (drule meta_mp)\n apply (metis (no_types, hide_lams) add.commute inc_le plus_le_left_cancel_wrap word_le_less_eq word_le_not_less word_plus_strict_mono_right)\n apply (drule meta_mp)\n apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp)\n apply clarsimp\n apply (rule_tac x = \\a in exI)\n apply (rule_tac x = \\b in exI)\n apply (rule_tac x = r'' in exI)\n apply (rule conjI)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (rule_tac x = v' in exI)\n apply (rule_tac x = acc' in exI)\n apply (rule_tac x = \\1 in exI)\n apply clarsimp\n apply (rule_tac x = w1 in exI)\n apply clarsimp\n apply (rule_tac x = w2 in exI)\n apply clarsimp\n apply (rule_tac x = w1a in exI)\n apply (rule_tac x = w2a in exI)\n apply (rule_tac x = va in exI)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp split: if_splits)\n apply (drule_tac a = frm and b = to in word_mult_cancel_left_bounded[rotated 2]; simp?)\n apply (metis (no_types, hide_lams) add.commute less_imp_le plus_one_helper2 word_not_le word_not_simps(1))\n apply (erule disjE)\n apply (case_tac t; clarsimp)\n apply (rule FalseE)\n apply blast\n apply (erule_tac x = to in allE)\n apply (erule impE)\n apply (metis (no_types) add.commute plus_one_helper2 word_not_le word_not_simps(1))\n apply clarsimp\n apply (drule_tac p = \"arr + size_of_num_type t * to\" and w = w1 in valid_ptr_not_in_frame_same; simp)\n apply (drule_tac x = \"arr + size_of_num_type t * to\" and S' = w1 in orthD1; simp)\n apply (rule disjI2)\n apply (rule_tac x = to in exI)\n apply clarsimp\n apply (metis (no_types) add.commute plus_one_helper2 word_not_le word_not_simps(1))\n apply clarsimp\n apply (rule_tac x = v'a in exI)\n apply clarsimp\n apply (rule_tac x = \\ in exI)\n apply (rule_tac x = \\1 in exI)\n apply (rule_tac x = acc in exI)\n apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n apply (frule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n apply (rule conjI)\n apply (frule_tac t = \"(TPrim (Num t))\" and len = len and arr = arr \n in upd_wa_mapAccumnb_bod_preservation'; simp?)\n apply (rule_tac x = w1 in exI)\n apply (rule_tac x = w2 in exI)\n apply (rule_tac x = v in exI)\n apply clarsimp\n apply (rule conjI)\n apply (drule linorder_class.antisym_conv1)\n apply (cut_tac x = frm and n = to in plus_one_helper; simp add: add.commute)\n apply (rule_tac x = v' in exI)\n apply (subgoal_tac \"frm = to\")\n apply (erule upd_wa_mapAccumnb_bod.elims)\n apply (clarsimp simp: add.commute)\n apply (metis (mono_tags, hide_lams) add.commute not_less_iff_gr_or_eq plus_one_helper word_le_not_less)\n apply (rule FalseE)\n by auto\n\nlemma upd_wa_mapAccumnb_bod_preservation:\n \"\\proc_ctx_wellformed \\'; upd.proc_env_matches_ptrs \\\\<^sub>u \\'; (wa \\ wb) \\ rc = {}; \n wa \\ wb = {}; wa \\ rb = {}; p \\ wa \\ rb \\ wb \\ rc; \\ p = option.Some (UAbstract (UWA t len arr));\n upd_wa_mapAccumnb_bod \\\\<^sub>u \\ p frm to f acc obsv (rb \\ rc) (\\', res); \n wa_abs_typing_u (UWA t len arr) ''WordArray'' [t] (Boxed Writable ptrl) ra wa \\;\n upd.uval_typing \\' \\ acc u rb wb; upd.uval_typing \\' \\ obsv v rc {};\n \\', [], [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)] \n \\ (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n distinct [a0, a1, a2]; distinct [b0, b1]\\\n \\ \\r' w'. \n upd.uval_typing \\' \\' res (TRecord [(b0, (TCon ''WordArray'' [t] (Boxed Writable ptrl), Present)),\n (b1, (u, Present))] Unboxed) r' (insert p w') \\ r' \\ (ra \\ rb \\ rc) \\ frame \\ (wa \\ wb) \\' w'\"\n apply (induct to arbitrary: \\' res)\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n apply (rule_tac x = \"ra \\ rb\" in exI)\n apply (rule_tac x = \"wa \\ wb\" in exI)\n apply (clarsimp simp: upd.frame_id)\n apply (rule upd.u_t_struct; simp?)\n apply (subst Set.Un_insert_left[symmetric])\n apply (rule upd.u_t_r_cons1[where r' = rb and w' = wb, simplified]; simp?)\n apply (rule_tac ptrl = ptrl and\n a = \"UWA (TPrim (Num ta)) len arr\"\n in upd.u_t_p_abs_w[where ts = \"[TPrim _]\", simplified]; simp?)\n apply (drule_tac wa_abs_typing_u_elims(3); simp)\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_empty)\n apply (drule upd.type_repr_uval_repr(1); simp)\n apply (drule_tac wa_abs_typing_u_elims(3); simp)\n apply (case_tac \"len < 1 + to\")\n apply (drule upd_wa_mapAccumnb_bod_back_step'; simp?)\n apply (case_tac \"1 + to \\ frm\")\n apply (frule_tac y = \"1 + to\" and x = frm in leD)\n apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n apply (rule_tac x = \"ra \\ rb\" in exI)\n apply (rule_tac x = \"wa \\ wb\" in exI)\n apply (clarsimp simp: upd.frame_id)\n apply (rule upd.u_t_struct; simp?)\n apply (subst Set.Un_insert_left[symmetric])\n apply (rule upd.u_t_r_cons1[where r' = rb and w' = wb, simplified]; simp?)\n apply (rule_tac ptrl = ptrl and\n a = \"UWA (TPrim (Num ta)) len arr\"\n in upd.u_t_p_abs_w[where ts = \"[TPrim _]\", simplified]; simp?)\n apply (drule_tac wa_abs_typing_u_elims(3); simp)\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_empty)\n apply (drule upd.type_repr_uval_repr(1); simp)\n apply (drule_tac wa_abs_typing_u_elims(3); simp)\n apply (subgoal_tac \"to < len\")\n apply (frule_tac wa_abs_typing_u_elims(1); clarsimp)\n apply (frule upd_wa_mapAccumnb_bod_preservation'; simp?)\n apply clarsimp\n apply (drule upd_wa_mapAccumnb_bod_back_step; simp?)\n apply (drule wa_abs_typing_u_elims(6); simp)\n apply clarsimp\n apply (drule_tac x = \\a in meta_spec)\n apply (drule_tac x = \"URecord [\n (UPtr p (RCon ''WordArray'' [RPrim (Num ta)]), RPtr (RCon ''WordArray'' [RPrim (Num ta)])),\n (r'', upd.uval_repr r'')]\" in meta_spec)\n apply clarsimp\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; simp?)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; simp?)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (drule_tac r = \"raa \\ rc\" and \n w = waa and\n ?\\ = \"[option.Some (TRecord [(a0, TPrim (Num ta), Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\" and\n \\ = \"TRecord [(b0, TPrim (Num ta), Present), (b1, u, Present)] Unboxed\" \n in upd.preservation_mono(1); simp?)\n apply (rule upd.matches_ptrs_some[where ts = \"[]\" and r' = \"{}\" and w' = \"{}\", simplified])\n apply (rule upd.u_t_struct; simp?)\n apply (rule upd.u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified])\n apply (drule wa_abs_typing_u_elims(5))\n apply (erule_tac x = to in allE)\n apply clarsimp\n apply (rule upd.u_t_prim'; clarsimp)\n apply (rule upd.u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (rule upd.uval_typing_frame(1); simp?)\n apply blast\n apply (rule upd.u_t_r_empty)\n apply (drule_tac v = obsv in upd.type_repr_uval_repr(1); simp)\n apply (rule disjointI)\n apply (frule_tac p = y and u = obsv in upd.uval_typing_valid(1)[rotated 1]; simp)\n apply clarsimp\n apply (drule_tac x = y in orthD2; simp)\n apply clarsimp\n apply (drule_tac p = y and \\ = \\ in readonly_not_in_frame; simp?)\n apply (subgoal_tac \"y \\ w \\ waa\")\n apply blast\n apply (drule_tac t = \"w \\ waa\" in sym)\n apply simp\n apply blast\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = to in allE)\n apply clarsimp\n apply (rule upd.matches_ptrs_empty[where \\s = \"[]\", simplified])\n apply clarsimp\n apply (thin_tac \"frame _ _ _ _\")\n apply (cut_tac v = v' and l = \"arr + size_of_num_type ta * to\" and \\ = \\b in upd.frame_single_update)\n apply (rule_tac x = r' in exI)\n apply (rule_tac x = \"{arr + size_of_num_type ta * i |i. i < len} \\ w'a\" in exI)\n apply clarsimp\n apply (erule upd.u_t_recE; clarsimp)\n apply (erule upd.u_t_r_consE; simp?)\n apply (erule conjE)+\n apply (drule_tac t = \"type_repr _\" in sym)+\n apply clarsimp\n apply (erule upd.u_t_r_consE; simp?)\n apply (erule conjE)+\n apply clarsimp\n apply (erule upd.u_t_r_emptyE; clarsimp)\n apply (erule u_t_primtE; clarsimp)\n apply (erule upd.u_t_p_absE[where s = \"Boxed Writable _\", simplified])\n apply (drule_tac s = \"RCon _ _\" in sym)\n apply (drule_tac t = \"lit_type _\" in sym; clarsimp)\n apply (frule_tac p = p and \\ = \\ in valid_ptr_not_in_frame_same; simp?)\n apply clarsimp\n apply (rule conjI)\n apply (rule upd.u_t_struct; simp?)\n apply (rule_tac upd.u_t_r_cons1[where r = \"{}\" and w = \"insert _ _\", simplified]; simp?)\n apply (rule_tac ptrl = ptrl and\n a = \"UWA (TPrim (Num ta)) len arr\"\n in upd.u_t_p_abs_w[where ts = \"[TPrim _]\", simplified]; simp?)\n apply (frule_tac \\ = \\a in wa_abs_typing_u_elims(3); clarsimp)\n apply (drule_tac \\ = \\a and \\' = \\b in upd.abs_typing_frame; simp?)\n apply (rule wa_abs_typing_u_update; simp?)\n apply (rule conjI; clarsimp)\n apply (frule wa_abs_typing_u_elims(5))\n apply (erule_tac x = to in allE)\n apply clarsimp\n apply (drule_tac p = p and \\ = \\a in valid_ptr_not_in_frame_same; simp?)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule upd.u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n apply (drule_tac u = xb and r = rca and w = wc and \\ = \\b in upd.uval_typing_frame(1); simp?)\n apply (frule_tac p = \"arr + size_of_num_type ta * to\" in upd.abs_typing_valid; simp?)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; simp)\n apply clarsimp\n apply (frule_tac w = wba in wa_abs_typing_u_elims(5))\n apply (erule_tac x = to in allE; clarsimp)\n apply (drule_tac p = \"arr + size_of_num_type ta * to\" and \\ = \\a in readonly_not_in_frame; simp?)\n apply (drule_tac x = \"arr + size_of_num_type ta * to\" and S = wba in orthD1; simp?)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; simp)\n apply (drule_tac x = \"arr + size_of_num_type ta * to\" and S = wba and S' = raa in orthD1; simp?)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; simp)\n apply (drule_tac x = \"arr + size_of_num_type ta * to\" and S' = rc in orthD1; simp?)\n apply (rule disjI1)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; clarsimp)\n apply clarsimp\n apply (drule_tac A = rca and B = \"raa \\ rc\" and x = \"arr + size_of_num_type ta * to\" in in_mono)\n apply blast\n apply (rule upd.u_t_r_empty)\n apply (frule_tac p = p and \\ = \\a in readonly_not_in_frame; simp?)\n apply (rule disjointI)\n apply (frule_tac p = \"xa\" in upd.abs_typing_valid; simp?)\n apply clarsimp\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply clarsimp\n apply (frule_tac \\ = \\a in wa_abs_typing_u_elims(5))\n apply (erule_tac x = i in allE; clarsimp)\n apply (drule_tac p = \"arr + size_of_num_type ta * i\" and \\ = \\a in readonly_not_in_frame; simp?)\n apply (drule_tac x = \"arr + size_of_num_type ta * i\" and S = wba in orthD1; simp?)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = i in exI; simp)\n apply (rule conjI)\n apply (drule_tac A = rca and B = \"raa \\ rc\" and x = p in in_mono; clarsimp)\n apply (rule disjointI)\n apply (drule_tac A = rca and B = \"raa \\ rc\" and x = xa in in_mono; clarsimp)\n apply (erule disjE)\n apply (drule_tac x = \"arr + size_of_num_type ta * i\" and S' = raa in orthD1; simp?)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = i in exI; simp)\n apply (drule_tac x = \"arr + size_of_num_type ta * i\" and S' = rc in orthD1; simp?)\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = i in exI; simp)\n apply (rule conjI)\n apply (drule_tac A = rca and B = \"raa \\ rc\" and C = \"ra \\ rb \\ rc\" in subset_trans; simp?)\n apply (frule_tac p = p and \\ = \\ in readonly_not_in_frame; simp?)\n apply (frule_tac A = \"w'\" and x = p and B = \"wba \\ waa\" in insert_ident; simp?)\n apply (drule_tac \\ = \\a and s = wba in frame_expand(2))\n apply (frule_tac w = wba in wa_abs_typing_u_elims(5); clarsimp)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (thin_tac \"\\i. p = arr + size_of_num_type ta * i \\ \\ i < len\")\n apply (erule_tac x = i in allE; clarsimp)\n apply (drule_tac \\ = \\ and \\' = \\a and \\'' = \\b in upd.frame_trans; simp?)\n apply (drule_tac \\ = \\ in upd.frame_app; simp?)\n apply clarsimp\n apply (subst (asm) insert_absorb[where A = \"_ \\ wb\"])\n apply clarsimp\n apply (drule wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; simp)\n apply (subst (asm) insert_absorb[where A = \"_ \\ _\"])\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (rule_tac x = to in exI; simp)\n apply (drule_tac w = wba in wa_abs_typing_u_elims(3); clarsimp)\n apply (clarsimp simp: frame_def)\n apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n done\n\ndefinition upd_wa_mapAccumnb\n where\n \"upd_wa_mapAccumnb \\' \\\\<^sub>u \\i \\o y z = \n (let (y1, y2) = y\n in (\\p frm to func acc obsv t u v a0 a1 a2 b0 b1 ra wa rb.\n y2 = URecord [(UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n (UPrim (LU32 frm), RPrim (Num U32)), (UPrim (LU32 to), RPrim (Num U32)),\n (func, RFun), (acc, upd.uval_repr acc), (obsv, upd.uval_repr obsv)] \\ \n (\\len arr. y1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\ \n (\\ix. y1 (arr + size_of_num_type t * i) = option.Some (UPrim x) \\ lit_type x = Num t)) \\ \n is_uval_fun func \\ upd.uval_typing \\' y1 acc u ra wa \\ upd.uval_typing \\' y1 obsv v rb {} \\\n \\i = TRecord [(a0, TPrim (Num t), Present), (a1, u, Present), (a2, v, Present)] Unboxed \\\n \\o = TRecord [(b0, TPrim (Num t), Present), (b1, u, Present)] Unboxed \\\n distinct [a0, a1, a2] \\ distinct [b0, b1] \\\n (\\', [], [option.Some \\i] \\ (App (uvalfun_to_exprfun func) (Var 0)) : \\o) \\ \n upd_wa_mapAccumnb_bod \\\\<^sub>u y1 p frm to (uvalfun_to_exprfun func) acc obsv (ra \\ rb) z))\"\n\nend (* of context *)\n\nend", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/seedtrick/seedmanual/WordArray_Update.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.19175670530902317}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__35.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__35 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__35 and some rule r*}\nlemma n_SendInvAckVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__35:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__35.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3557748935136304, "lm_q1q2_score": 0.19175669794579436}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__2_on_rules imports n_german_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832354982645, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.1917566958517981}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: Payloads.thy (Isabelle/HOL 2016-1)\n ID: $Id: Payloads.thy 132885 2016-12-23 18:41:32Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Payload messages are messages that contain no implementation material,\n i.e. neither long-term keys nor channel tags; also:\n - auxiliary definitions: Keys_bad, broken, Enc_keys_clean \n - lemmas for moving message sets out of 'analz'\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Payloads and Support for Channel Message Implementations\\ \n\ntext \\Definitions and lemmas that do not require the implementations.\\\n\ntheory Payloads\nimports Message_derivation\nbegin\n\nsubsection \\Payload messages\\\n(**************************************************************************************************)\n\ntext \\Payload messages contain no implementation material ie no long term keys or tags.\\\n\ntext \\Define set of payloads for basic messages.\\\ninductive_set cpayload :: \"cmsg set\" where\n \"cAgent A \\ cpayload\"\n| \"cNumber T \\ cpayload\"\n| \"cNonce N \\ cpayload\"\n| \"cEphK K \\ cpayload\"\n| \"X \\ cpayload \\ cHash X \\ cpayload\"\n| \"\\ X \\ cpayload; Y \\ cpayload \\ \\ cPair X Y \\ cpayload\"\n| \"\\ X \\ cpayload; Y \\ cpayload \\ \\ cEnc X Y \\ cpayload\"\n| \"\\ X \\ cpayload; Y \\ cpayload \\ \\ cAenc X Y \\ cpayload\"\n| \"\\ X \\ cpayload; Y \\ cpayload \\ \\ cSign X Y \\ cpayload\"\n| \"\\ X \\ cpayload; Y \\ cpayload \\ \\ cExp X Y \\ cpayload\"\n\ntext \\Lift @{term cpayload} to the quotiented message type.\\\nlift_definition payload :: \"msg set\" is cpayload by -\n\ntext \\Lemmas used to prove the intro and inversion rules for @{term payload}.\\\nlemma eq_rep_abs: \"eq x (Re (Ab x))\"\nby (simp add: Quotient3_msg rep_abs_rsp)\n\n\nlemma eq_cpayload:\n assumes \"eq x y\" and \"x \\ cpayload\"\n shows \"y \\ cpayload\"\nusing assms by (induction x y rule: eq.induct, auto intro: cpayload.intros elim: cpayload.cases)\n\nlemma abs_payload: \"Ab x \\ payload \\ x \\ cpayload\"\nby (auto simp add: payload_def msg.abs_eq_iff eq_cpayload eq_sym cpayload.intros \n elim: cpayload.cases)\n\nlemma abs_cpayload_rep: \"x \\ Ab` cpayload \\ Re x \\ cpayload\"\napply (auto elim: eq_cpayload [OF eq_rep_abs])\napply (subgoal_tac \"x = Ab (Re x)\", auto)\nusing Quotient3_abs_rep Quotient3_msg by fastforce\n\nlemma payload_rep_cpayload: \"Re x \\ cpayload \\ x \\ payload\"\nby (auto simp add: payload_def abs_cpayload_rep)\n\ntext \\Manual proof of payload introduction rules. Transfer does not work for these\\\n\ndeclare cpayload.intros [intro]\nlemma payload_AgentI: \"Agent A \\ payload\"\n by (auto simp add: msg_defs abs_payload)\nlemma payload_NonceI: \"Nonce N \\ payload\"\n by (auto simp add: msg_defs abs_payload)\nlemma payload_NumberI: \"Number N \\ payload\"\n by (auto simp add: msg_defs abs_payload)\nlemma payload_EphKI: \"EphK X \\ payload\"\n by (auto simp add: msg_defs abs_payload)\nlemma payload_HashI: \"x \\ payload \\ Hash x \\ payload\"\n by (auto simp add: msg_defs payload_rep_cpayload abs_payload)\nlemma payload_PairI: \"x \\ payload \\ y \\ payload \\ Pair x y \\ payload\"\n by (auto simp add: msg_defs payload_rep_cpayload abs_payload)\nlemma payload_EncI: \"x \\ payload \\ y \\ payload \\ Enc x y \\ payload\"\n by (auto simp add: msg_defs payload_rep_cpayload abs_payload)\nlemma payload_AencI: \"x \\ payload \\ y \\ payload \\ Aenc x y \\ payload\"\n by (auto simp add: msg_defs payload_rep_cpayload abs_payload)\nlemma payload_SignI: \"x \\ payload \\ y \\ payload \\ Sign x y \\ payload\"\n by (auto simp add: msg_defs payload_rep_cpayload abs_payload)\nlemma payload_ExpI: \"x \\ payload \\ y \\ payload \\ Exp x y \\ payload\"\nby (auto simp add: msg_defs payload_rep_cpayload abs_payload)\n\nlemmas payload_intros [simp, intro] =\n payload_AgentI payload_NonceI payload_NumberI payload_EphKI payload_HashI\n payload_PairI payload_EncI payload_AencI payload_SignI payload_ExpI\n\ntext \\Manual proof of payload inversion rules, transfer does not work for these.\\\n\ndeclare cpayload.cases[elim]\nlemma payload_Tag: \"Tag X \\ payload \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\n\nlemma payload_LtK: \"LtK X \\ payload \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Hash: \"Hash X \\ payload \\ (X \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Pair: \"Pair X Y \\ payload \\ (X \\ payload \\ Y \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Enc: \"Enc X Y \\ payload \\ (X \\ payload \\ Y \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Aenc: \"Aenc X Y \\ payload \\ (X \\ payload \\ Y \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Sign: \"Sign X Y \\ payload \\ (X \\ payload \\ Y \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def msg_defs msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\nlemma payload_Exp: \"Exp X Y \\ payload \\ (X \\ payload \\ Y \\ payload \\ P) \\ P\"\napply (auto simp add: payload_def Exp_def msg.abs_eq_iff eq_sym)\napply (auto dest!: eq_cpayload simp add: abs_cpayload_rep)\ndone\n\ndeclare cpayload.intros[rule del]\ndeclare cpayload.cases[rule del]\n\nlemmas payload_inductive_cases =\n payload_Tag payload_LtK payload_Hash\n payload_Pair payload_Enc payload_Aenc payload_Sign payload_Exp\n\nlemma eq_exhaust:\n\"(\\x. eq y (cAgent x) \\ P) \\\n (\\x. eq y (cNumber x) \\ P) \\\n (\\x. eq y (cNonce x) \\ P) \\\n (\\x. eq y (cLtK x) \\ P) \\\n (\\x. eq y (cEphK x) \\ P) \\\n (\\x x'. eq y (cPair x x') \\ P) \\\n (\\x x'. eq y (cEnc x x') \\ P) \\\n (\\x x'. eq y (cAenc x x') \\ P) \\\n (\\x x'. eq y (cSign x x') \\ P) \\\n (\\x. eq y (cHash x) \\ P) \\\n (\\x. eq y (cTag x) \\ P) \\\n (\\x x'. eq y (cExp x x') \\ P) \\\n P\"\napply (cases y)\napply (meson Messages.eq_refl)+\ndone\n\nlemma msg_exhaust:\n\"(\\x. y = Agent x \\ P) \\\n (\\x. y = Number x \\ P) \\\n (\\x. y = Nonce x \\ P) \\\n (\\x. y = LtK x \\ P) \\\n (\\x. y = EphK x \\ P) \\\n (\\x x'. y = Pair x x' \\ P) \\\n (\\x x'. y = Enc x x' \\ P) \\\n (\\x x'. y = Aenc x x' \\ P) \\\n (\\x x'. y = Sign x x' \\ P) \\\n (\\x. y = Hash x \\ P) \\\n (\\x. y = Tag x \\ P) \\\n (\\x x'. y = Exp x x' \\ P) \\\n P\"\napply transfer\napply (erule eq_exhaust, auto)\ndone\n\nlemma payload_cases: \n\"a \\ payload \\\n(\\A. a = Agent A \\ P) \\\n(\\T. a = Number T \\ P) \\\n(\\N. a = Nonce N \\ P) \\\n(\\K. a = EphK K \\ P) \\\n(\\X. a = Hash X \\ X \\ payload \\ P) \\\n(\\X Y. a = Pair X Y \\ X \\ payload \\ Y \\ payload \\ P) \\\n(\\X Y. a = Enc X Y \\ X \\ payload \\ Y \\ payload \\ P) \\\n(\\X Y. a = Aenc X Y \\ X \\ payload \\ Y \\ payload \\ P) \\\n(\\X Y. a = Sign X Y \\ X \\ payload \\ Y \\ payload \\ P) \\\n(\\X Y. a = Exp X Y \\ X \\ payload \\ Y \\ payload \\ P) \\\n P\"\nby (erule msg_exhaust [of a], auto elim: payload_inductive_cases)\n\ndeclare payload_cases [elim]\ndeclare payload_inductive_cases [elim]\n\ntext \\Properties of payload; messages constructed from payload messages are also payloads.\\\n\nlemma payload_parts [simp, dest]:\n \"\\ X \\ parts S; S \\ payload \\ \\ X \\ payload\" \nby (erule parts.induct) (auto)\n\n\n\nlemma payload_analz [simp, dest]:\n \"\\ X \\ analz S; S \\ payload \\ \\ X \\ payload\" \nby (auto dest: analz_into_parts)\n\nlemma payload_synth_analz: \n \"\\ X \\ synth (analz S); S \\ payload \\ \\ X \\ payload\" \nby (erule synth.induct) (auto intro: payload_analz)\n\ntext \\Important lemma: using messages with implementation material one can only \nsynthesise more such messages.\\\n\nlemma synth_payload: \n \"Y \\ payload = {} \\ synth (X \\ Y) \\ synth X \\ -payload\"\nby (rule, erule synth.induct) (auto) \n\nlemma synth_payload2:\n \"Y \\ payload = {} \\ synth (Y \\ X) \\ synth X \\ -payload\"\nby (rule, erule synth.induct) (auto) \n\ntext \\Lemma: in the case of the previous lemma, @{term synth} can be applied on the \nleft with no consequence.\\\n\nlemma synth_idem_payload:\n \"X \\ synth Y \\ -payload \\ synth X \\ synth Y \\ -payload\"\nby (auto dest: synth_mono subset_trans [OF _ synth_payload])\n\n\nsubsection \\\\isLtKey\\: is a long term key\\\n(**************************************************************************************************)\n\nlemma LtKeys_payload [dest]: \"NI \\ payload \\ NI \\ range LtK = {}\"\nby (auto)\n\nlemma LtKeys_parts_payload [dest]: \"NI \\ payload \\ parts NI \\ range LtK = {}\"\nby (auto)\n\nlemma LtKeys_parts_payload_singleton [elim]: \"X \\ payload \\ LtK Y \\ parts {X} \\ False\"\nby (auto)\n\nlemma parts_of_LtKeys [simp]: \"K \\ range LtK \\ parts K = K\"\nby (rule, rule, erule parts.induct, auto) \n\n\nsubsection\\\\keys_of\\: the long term keys of an agent\\\n(**************************************************************************************************)\n\ndefinition\n keys_of :: \"agent \\ msg set\"\nwhere\n \"keys_of A \\ insert (priK A) {shrK B C | B C. B = A \\ C = A}\"\n\nlemma keys_of_Ltk [intro!]: \"keys_of A \\ range LtK\"\nby (auto simp add: keys_of_def)\n\nlemma priK_keys_of [intro!]:\n \"priK A \\ keys_of A\"\nby (simp add: keys_of_def)\n\nlemma shrK_keys_of_1 [intro!]:\n \"shrK A B \\ keys_of A\"\nby (simp add: keys_of_def)\n\nlemma shrK_keys_of_2 [intro!]:\n \"shrK B A \\ keys_of A\"\nby (simp add: keys_of_def)\nlemma priK_keys_of_eq [dest]:\n \"priK B \\ keys_of A \\ A = B\"\nby (simp add: keys_of_def)\n\nlemma shrK_keys_of_eq [dest]:\n \"shrK A B \\ keys_of C \\ A = C \\ B = C\"\nby (simp add: keys_of_def)\n\nlemma def_keys_of [dest]:\n \"K \\ keys_of A \\ K = priK A \\ (\\ B. K = shrK A B \\ K = shrK B A)\"\nby (auto simp add: keys_of_def)\n\nlemma parts_keys_of [simp]: \"parts (keys_of A) = keys_of A\"\nby (auto intro!: parts_of_LtKeys)\n\n\nlemma analz_keys_of [simp]: \"analz (keys_of A) = keys_of A\"\nby (rule, rule, erule analz.induct, auto)\n\nsubsection \\\\Keys_bad\\: bounds on the attacker's knowledge of long-term keys.\\\n(**************************************************************************************************)\n\ntext \\A set of keys contains all public long term keys, and only the private/shared keys \nof bad agents.\\\n\ndefinition\n Keys_bad :: \"msg set \\ agent set \\ bool\"\nwhere\n \"Keys_bad IK Bad \\ \n IK \\ range LtK \\ range pubK \\ \\ (keys_of ` Bad)\n \\ range pubK \\ IK\"\n\n\\ \\basic lemmas\\\n\nlemma Keys_badI:\n \"\\ IK \\ range LtK \\ range pubK \\ priK`Bad \\ {shrK A B | A B. A \\ Bad \\ B \\ Bad}; \n range pubK \\ IK \\\n \\ Keys_bad IK Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_badE [elim]: \n \"\\ Keys_bad IK Bad;\n \\ range pubK \\ IK; \n IK \\ range LtK \\ range pubK \\ \\ (keys_of ` Bad)\\\n \\ P \\ \n \\ P\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_Ltk [simp]:\n \"Keys_bad (IK \\ range LtK) Bad \\ Keys_bad IK Bad\"\nby (auto simp add: Keys_bad_def)\n\n\nlemma Keys_bad_priK_D: \"\\ priK A \\ IK; Keys_bad IK Bad \\ \\ A \\ Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_shrK_D: \"\\ shrK A B \\ IK; Keys_bad IK Bad \\ \\ A \\ Bad \\ B \\ Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemmas Keys_bad_dests [dest] = Keys_bad_priK_D Keys_bad_shrK_D\n\n\ntext \\interaction with @{term insert}.\\\n\nlemma Keys_bad_insert_non_LtK: \n \"X \\ range LtK \\ Keys_bad (insert X IK) Bad \\ Keys_bad IK Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_insert_pubK: \n \"\\ Keys_bad IK Bad \\ \\ Keys_bad (insert (pubK A) IK) Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_insert_priK_bad: \n \"\\ Keys_bad IK Bad; A \\ Bad \\ \\ Keys_bad (insert (priK A) IK) Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_insert_shrK_bad: \n \"\\ Keys_bad IK Bad; A \\ Bad \\ B \\ Bad \\ \\ Keys_bad (insert (shrK A B) IK) Bad\"\nby (auto simp add: Keys_bad_def)\n\nlemmas Keys_bad_insert_lemmas [simp] = \n Keys_bad_insert_non_LtK Keys_bad_insert_pubK \n Keys_bad_insert_priK_bad Keys_bad_insert_shrK_bad\n\n\nlemma Keys_bad_insert_Fake:\nassumes \"Keys_bad IK Bad\" \n and \"parts IK \\ range LtK \\ IK\"\n and \"X \\ synth (analz IK)\"\nshows \"Keys_bad (insert X IK) Bad\"\nproof cases\n assume \"X \\ range LtK\"\n then obtain ltk where \"X = LtK ltk\" by blast\n thus ?thesis using assms\n by (auto simp add: insert_absorb dest: analz_into_parts)\nnext \n assume \"X \\ range LtK\"\n thus ?thesis using assms(1) by simp\nqed\n\n\nlemma Keys_bad_insert_keys_of:\n \"Keys_bad Ik Bad \\\n Keys_bad (keys_of A \\ Ik) (insert A Bad)\"\nby (auto simp add: Keys_bad_def)\n\nlemma Keys_bad_insert_payload:\n \"Keys_bad Ik Bad \\\n x \\ payload \\\n Keys_bad (insert x Ik) Bad\"\nby (auto simp add: Keys_bad_def)\n\n\nsubsection \\\\broken K\\: pairs of agents where at least one is compromised.\\\n(**************************************************************************************************)\n\ntext \\Set of pairs (A,B) such that the priK of A or B, or their shared key, is in K\\\n\ndefinition\n broken :: \"msg set \\ (agent * agent) set\"\nwhere\n \"broken K \\ {(A,B) | A B. priK A \\ K \\ priK B \\ K \\ shrK A B \\ K \\ shrK B A \\ K}\"\n\nlemma brokenD [dest!]:\n \"(A, B) \\ broken K \\ priK A \\ K \\ priK B \\ K \\ shrK A B \\ K \\ shrK B A \\ K\"\nby (simp add: broken_def)\n\nlemma brokenI [intro!]:\n \"priK A \\ K \\ priK B \\ K \\ shrK A B \\ K \\ shrK B A \\ K \\ (A, B) \\ broken K\"\nby (auto simp add: broken_def)\n\n\nsubsection \\\\Enc_keys_clean S\\: messages with ``clean'' symmetric encryptions.\\\n(**************************************************************************************************)\n\ntext \\All terms used as symmetric keys in S are either long term keys or messages without \nimplementation material.\\\n\ndefinition\n Enc_keys_clean :: \"msg set \\ bool\"\nwhere\n \"Enc_keys_clean S \\ \\X Y. Enc X Y \\ parts S \\ Y \\ range LtK \\ payload\"\n\nlemma Enc_keys_cleanI:\n \"\\X Y. Enc X Y \\ parts S \\ Y \\ range LtK \\ payload \\ Enc_keys_clean S\"\nby (simp add: Enc_keys_clean_def)\n\n\\ \\general lemmas about \\Enc_keys_clean\\\\\nlemma Enc_keys_clean_mono: \n \"Enc_keys_clean H \\ G \\ H \\ Enc_keys_clean G\" \\ \\anti-tone\\\nby (auto simp add: Enc_keys_clean_def dest!: parts_monotone [where G=G])\n\nlemma Enc_keys_clean_Un [simp]: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean G \\ Enc_keys_clean H\" \nby (auto simp add: Enc_keys_clean_def)\n\n\n\\ \\from \\Enc_keys_clean S\\, the property on \\parts S\\ also holds for \\analz S\\\\\nlemma Enc_keys_clean_analz:\n \"Enc X K \\ analz S \\ Enc_keys_clean S \\ K \\ range LtK \\ payload\"\nby (auto simp add: Enc_keys_clean_def dest: analz_into_parts)\n\n\n\\ \\\\Enc_keys_clean\\ and different types of messages\\\nlemma Enc_keys_clean_Tags [simp,intro]: \"Enc_keys_clean Tags\"\nby (auto simp add: Enc_keys_clean_def)\n\nlemma Enc_keys_clean_LtKeys [simp,intro]: \"K \\ range LtK \\ Enc_keys_clean K\"\nby (auto simp add: Enc_keys_clean_def)\n\nlemma Enc_keys_clean_payload [simp,intro]: \"NI \\ payload \\ Enc_keys_clean NI\"\nby (auto simp add: Enc_keys_clean_def)\n\n\nsubsection \\Sets of messages with particular constructors\\\n(**************************************************************************************************)\n\ntext \\Sets of all pairs, ciphertexts, and signatures constructed from a set of messages.\\\n(*\n FIX: These should probably be turned into definitions, since they may create automation problems \n*)\nabbreviation AgentSet :: \"msg set\"\nwhere \"AgentSet \\ range Agent\"\n\nabbreviation PairSet :: \"msg set \\ msg set \\ msg set\"\nwhere \"PairSet G H \\ {Pair X Y | X Y. X \\ G \\ Y \\ H}\"\n\nabbreviation EncSet :: \"msg set \\ msg set \\ msg set\"\nwhere \"EncSet G K \\ {Enc X Y | X Y. X \\ G \\ Y \\ K}\"\n\nabbreviation AencSet :: \"msg set \\ msg set \\ msg set\"\nwhere \"AencSet G K \\ {Aenc X Y | X Y. X \\ G \\ Y \\ K}\"\n\nabbreviation SignSet :: \"msg set \\ msg set \\ msg set\"\nwhere \"SignSet G K \\ {Sign X Y | X Y. X \\ G \\ Y \\ K}\"\n\nabbreviation HashSet :: \"msg set \\ msg set\"\nwhere \"HashSet G \\ {Hash X | X. X \\ G}\"\n\n\ntext \\Move @{term Enc}, @{term Aenc}, @{term Sign}, and @{term Pair} sets out of @{term parts}. \n\\\n\nlemma parts_PairSet:\n \"parts (PairSet G H) \\ PairSet G H \\ parts G \\ parts H\"\nby (rule, erule parts.induct, auto)\n\nlemma parts_EncSet:\n \"parts (EncSet G K) \\ EncSet G K \\ PairSet (range Agent) G \\ range Agent \\ parts G\"\nby (rule, erule parts.induct, auto)\n\nlemma parts_AencSet:\n \"parts (AencSet G K) \\ AencSet G K \\ PairSet (range Agent) G \\ range Agent \\ parts G\"\nby (rule, erule parts.induct, auto)\n\nlemma parts_SignSet:\n \"parts (SignSet G K) \\ SignSet G K \\ PairSet (range Agent) G \\ range Agent \\ parts G\"\nby (rule, erule parts.induct, auto)\n\nlemma parts_HashSet:\n \"parts (HashSet G) \\ HashSet G\"\nby (rule, erule parts.induct, auto)\n\nlemmas parts_msgSet = parts_PairSet parts_EncSet parts_AencSet parts_SignSet parts_HashSet\nlemmas parts_msgSetD = parts_msgSet [THEN [2] rev_subsetD]\n\ntext \\\nRemove the message sets from under the @{term \"Enc_keys_clean\"} predicate.\nOnly when the first part is a set of agents or tags for @{term Pair}, this is sufficient.\\\n\nlemma Enc_keys_clean_PairSet_Agent_Un: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean (PairSet (Agent`X) G \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemma Enc_keys_clean_PairSet_Tag_Un: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean (PairSet Tags G \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemma Enc_keys_clean_AencSet_Un: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean (AencSet G K \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemma Enc_keys_clean_EncSet_Un: \n \"K \\ range LtK \\ Enc_keys_clean (G \\ H) \\ Enc_keys_clean (EncSet G K \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemma Enc_keys_clean_SignSet_Un: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean (SignSet G K \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemma Enc_keys_clean_HashSet_Un: \n \"Enc_keys_clean (G \\ H) \\ Enc_keys_clean (HashSet G \\ H)\"\nby (auto simp add: Enc_keys_clean_def dest!: parts_msgSetD)\n\nlemmas Enc_keys_clean_msgSet_Un =\n Enc_keys_clean_PairSet_Tag_Un Enc_keys_clean_PairSet_Agent_Un\n Enc_keys_clean_EncSet_Un Enc_keys_clean_AencSet_Un\n Enc_keys_clean_SignSet_Un Enc_keys_clean_HashSet_Un\n\n\nsubsubsection \\Lemmas for moving message sets out of @{term \"analz\"}\\\n(**************************************************************************************************)\n\ntext \\Pull @{term EncSet} out of @{term analz}.\\\n\nlemma analz_Un_EncSet:\nassumes \"K \\ range LtK\" and \"Enc_keys_clean (G \\ H)\" \nshows \"analz (EncSet G K \\ H) \\ EncSet G K \\ analz (G \\ H)\"\nproof \n fix X\n assume \"X \\ analz (EncSet G K \\ H)\"\n thus \"X \\ EncSet G K \\ analz (G \\ H)\"\n proof (induction X rule: analz.induct)\n case (Dec Y K') \n from Dec.IH(1) show ?case\n proof\n assume \"Enc Y K' \\ analz (G \\ H)\"\n have \"K' \\ synth (analz (G \\ H))\"\n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz (G \\ H)\\ assms(2)\n by (blast dest: Enc_keys_clean_analz)\n moreover\n have \"K' \\ synth (EncSet G K \\ analz (G \\ H))\" using Dec.IH(2)\n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz (G \\ H)) \\ -payload\" using assms(1) \n by (blast dest!: synth_payload2 [THEN [2] rev_subsetD])\n ultimately show ?thesis by auto\n qed \n thus ?case using \\Enc Y K' \\ analz (G \\ H)\\ by auto\n qed auto\n next\n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed (auto)\nqed \n\ntext \\Pull @{term EncSet} out of @{term analz}, 2nd case: the keys are unknown.\\\n\nlemma analz_Un_EncSet2:\nassumes \"Enc_keys_clean H\" and \"K \\ range LtK\" and \"K \\ synth (analz H) = {}\"\nshows \"analz (EncSet G K \\ H) \\ EncSet G K \\ analz H\"\nproof \n fix X\n assume \"X \\ analz (EncSet G K \\ H)\"\n thus \"X \\ EncSet G K \\ analz H\"\n proof (induction X rule: analz.induct)\n case (Dec Y K')\n from Dec.IH(1) show ?case \n proof\n assume \"Enc Y K' \\ analz H\"\n moreover have \"K' \\ synth (analz H)\"\n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz H\\ assms(1)\n by (auto dest: Enc_keys_clean_analz)\n moreover\n from Dec.IH(2) have H: \"K' \\ synth (EncSet G K \\ analz H)\" \n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz H) \\ -payload\" \n proof (rule synth_payload2 [THEN [2] rev_subsetD], auto elim!: payload_Enc)\n fix X Y\n assume \"Y \\ K\" \"Y \\ payload\"\n with \\K \\ range LtK\\ obtain KK where \"Y = LtK KK\" by auto\n with \\Y \\ payload\\ show False by auto\n qed\n ultimately \n show ?thesis by auto\n qed\n ultimately show ?case by auto\n next\n assume \"Enc Y K' \\ EncSet G K\"\n moreover hence \"K' \\ K\" by auto\n moreover with \\K \\ range LtK\\ obtain KK where \"K' = LtK KK\" by auto\n moreover with Dec.IH(2) have \"K' \\ analz H\" \n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n ultimately show ?case using \\K \\ synth (analz H) = {}\\ by auto\n qed\n next \n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed (insert assms(2), auto)\nqed\n\n\ntext \\Pull @{term AencSet} out of the @{term analz}.\\\n\nlemma analz_Un_AencSet:\nassumes \"K \\ range LtK\" and \"Enc_keys_clean (G \\ H)\" \nshows \"analz (AencSet G K \\ H) \\ AencSet G K \\ analz (G \\ H)\"\nproof \n fix X\n assume \"X \\ analz (AencSet G K \\ H)\"\n thus \"X \\ AencSet G K \\ analz (G \\ H)\"\n proof (induction X rule: analz.induct)\n case (Dec Y K') \n from Dec.IH(1) have \"Enc Y K' \\ analz (G \\ H)\" by auto\n moreover have \"K' \\ synth (analz (G \\ H))\" \n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz (G \\ H)\\ assms(2) \n by (blast dest: Enc_keys_clean_analz)\n moreover\n have \"K' \\ synth (AencSet G K \\ analz (G \\ H))\" using Dec.IH(2)\n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz (G \\ H)) \\ -payload\" using assms(1) \n by (blast dest!: synth_payload2 [THEN [2] rev_subsetD])\n ultimately \n show ?thesis by auto \n qed\n ultimately show ?case by auto\n next \n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed auto\nqed\n\ntext \\Pull @{term AencSet} out of @{term analz}, 2nd case: the keys are unknown.\\\n\nlemma analz_Un_AencSet2:\nassumes \"Enc_keys_clean H\" and \"priK`Ag \\ synth (analz H) = {}\"\nshows \"analz (AencSet G (pubK`Ag) \\ H) \\ AencSet G (pubK`Ag) \\ analz H\"\nproof \n fix X\n assume \"X \\ analz (AencSet G (pubK` Ag) \\ H)\"\n thus \"X \\ AencSet G (pubK` Ag) \\ analz H\"\n proof (induction X rule: analz.induct)\n case (Dec Y K') \n from Dec.IH(1) have \"Enc Y K' \\ analz H\" by auto\n moreover have \"K' \\ synth (analz H)\"\n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz H\\ assms(1)\n by (auto dest: Enc_keys_clean_analz)\n moreover\n from Dec.IH(2) have H: \"K' \\ synth (AencSet G (pubK`Ag) \\ analz H)\" \n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz H) \\ -payload\" \n by (auto dest: synth_payload2 [THEN [2] rev_subsetD])\n ultimately \n show ?thesis by auto\n qed\n ultimately show ?case by auto\n next \n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed (insert assms(2), auto)\nqed\n\ntext \\Pull @{term PairSet} out of @{term analz}.\\\nlemma analz_Un_PairSet:\n \"analz (PairSet G G' \\ H) \\ PairSet G G' \\ analz (G \\ G' \\ H)\"\nproof \n fix X\n assume \"X \\ analz (PairSet G G' \\ H)\"\n thus \"X \\ PairSet G G' \\ analz (G \\ G' \\ H)\"\n proof (induct X rule: analz.induct)\n case (Dec Y K) \n from Dec.hyps(2) have \"Enc Y K \\ analz (G \\ G' \\ H)\" by auto\n moreover\n from Dec.hyps(3) have \"K \\ synth (PairSet G G' \\ analz (G \\ G' \\ H))\"\n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n then have \"K \\ synth (analz (G \\ G' \\ H))\"\n by (elim synth_trans) auto\n ultimately\n show ?case by auto\n next \n case (Adec_eph Y K) \n thus ?case by (auto dest!: EpriK_synth)\n qed auto\nqed\n\n\\ \\move the \\SignSet\\ out of the \\analz\\\\\nlemma analz_Un_SignSet:\nassumes \"K \\ range LtK\" and \"Enc_keys_clean (G \\ H)\"\nshows \"analz (SignSet G K \\ H) \\ SignSet G K \\ analz (G \\ H)\"\nproof \n fix X\n assume \"X \\ analz (SignSet G K \\ H)\"\n thus \"X \\ SignSet G K \\ analz (G \\ H)\"\n proof (induct X rule: analz.induct)\n case (Dec Y K') \n from Dec.hyps(2) have \"Enc Y K' \\ analz (G \\ H)\" by auto\n moreover have \"K' \\ synth (analz (G \\ H))\"\n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz (G \\ H)\\ assms(2) \n by (blast dest: Enc_keys_clean_analz)\n moreover\n from Dec.hyps(3) have \"K' \\ synth (SignSet G K \\ analz (G \\ H)) \"\n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz (G \\ H)) \\ -payload\" using assms(1) \n by (blast dest!: synth_payload2 [THEN [2] rev_subsetD])\n ultimately \n show ?thesis by auto\n qed\n ultimately show ?case by auto\n next \n case (Adec_eph Y K) \n thus ?case by (auto dest!: EpriK_synth)\n qed auto\nqed\n\ntext \\Pull @{term Tags} out of @{term analz}.\\\n\nlemma analz_Un_Tag:\nassumes \"Enc_keys_clean H\"\nshows \"analz (Tags \\ H) \\ Tags \\ analz H\"\nproof \n fix X\n assume \"X \\ analz (Tags \\ H)\"\n thus \"X \\ Tags \\ analz H\"\n proof (induction X rule: analz.induct)\n case (Dec Y K') \n have \"Enc Y K' \\ analz H\" using Dec.IH(1) by auto\n moreover have \"K' \\ synth (analz H)\" \n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz H\\ assms \n by (auto dest: Enc_keys_clean_analz)\n moreover\n from Dec.IH(2) have \"K' \\ synth (Tags \\ analz H)\" \n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n moreover\n hence \"K' \\ synth (analz H) \\ -payload\" \n by (auto dest: synth_payload2 [THEN [2] rev_subsetD]) \n ultimately show ?thesis by auto\n qed\n ultimately show ?case by (auto)\n next\n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed auto\nqed \n\ntext \\Pull the @{term AgentSet} out of the @{term analz}.\\\n\n\n\ntext \\Pull @{term HashSet} out of @{term analz}.\\\nlemma analz_Un_HashSet:\nassumes \"Enc_keys_clean H\" and \"G \\ - payload\" \nshows \"analz (HashSet G \\ H) \\ HashSet G \\ analz H\"\nproof \n fix X\n assume \"X \\ analz (HashSet G \\ H)\"\n thus \"X \\ HashSet G \\ analz H\"\n proof (induction X rule: analz.induct)\n case (Dec Y K')\n from Dec.IH(1) have \"Enc Y K' \\ analz H\" by auto\n moreover have \"K' \\ synth (analz H)\"\n proof -\n have \"K' \\ range LtK \\ payload\" using \\Enc Y K' \\ analz H\\ assms(1)\n by (auto dest: Enc_keys_clean_analz)\n thus ?thesis\n proof\n assume \"K' \\ range LtK\"\n then obtain KK where \"K' = LtK KK\" by auto\n moreover\n with Dec.IH(2) show ?thesis\n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n next\n assume \"K' \\ payload\" \n moreover\n from assms have \"HashSet G \\ payload = {}\" by auto\n moreover from Dec.IH(2) have \"K' \\ synth (HashSet G \\ analz H)\" \n by (auto simp add: Collect_disj_eq dest: synth_Int2)\n ultimately\n have \"K' \\ synth (analz H) \\ -payload\" \n by (auto dest: synth_payload2 [THEN [2] rev_subsetD])\n with \\K' \\ payload\\ show ?thesis by auto \n qed\n qed\n ultimately show ?case by auto\n next \n case (Adec_eph Y K') \n thus ?case by (auto dest!: EpriK_synth)\n qed (insert assms(2), auto)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Payloads.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.19171963086360388}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Arch specific lemmas that should be moved into theory files before CRefine *)\n\ntheory ArchMove_C\nimports Move_C\nbegin\n\nlemma ps_clear_is_aligned_ksPSpace_None:\n \"\\ps_clear p n s; is_aligned p n; 0 mask n\\\n \\ ksPSpace s (p + d) = None\"\n apply (simp add: ps_clear_def add_diff_eq[symmetric] mask_2pm1[symmetric])\n apply (drule equals0D[where a=\"p + d\"])\n apply (simp add: dom_def word_gt_0)\n apply (drule mp)\n apply (rule word_plus_mono_right)\n apply simp\n apply (simp add: mask_2pm1)\n apply (erule is_aligned_no_overflow')\n apply (drule mp)\n apply (case_tac \"(0::machine_word)<2^n\")\n apply (frule le_m1_iff_lt[of \"(2::machine_word)^n\" d, THEN iffD1])\n apply (simp add: mask_2pm1[symmetric])\n apply (erule (1) is_aligned_no_wrap')\n apply (simp add: is_aligned_mask mask_2pm1 not_less word_bits_def\n power_overflow)\n by assumption\n\nlemma ps_clear_is_aligned_ctes_None:\n assumes \"ps_clear p tcbBlockSizeBits s\"\n and \"is_aligned p tcbBlockSizeBits\"\n shows \"ksPSpace s (p + 2*2^cteSizeBits) = None\"\n and \"ksPSpace s (p + 3*2^cteSizeBits) = None\"\n and \"ksPSpace s (p + 4*2^cteSizeBits) = None\"\n by (auto intro: assms ps_clear_is_aligned_ksPSpace_None\n simp: objBits_defs mask_def)+\n\n(* FIXME X64: use earlier or replace with earlier def? *)\ndefinition\n port_mask :: \"16 word \\ 16 word \\ machine_word\"\nwhere\n \"port_mask start end =\n mask (unat (end && mask wordRadix)) && ~~ mask (unat (start && mask wordRadix))\"\n\nlemma unat_ucast_prio_L1_cmask_simp:\n \"unat (ucast (p::priority) && 0x3F :: machine_word) = unat (p && 0x3F)\"\n using unat_ucast_prio_mask_simp[where m=6]\n by (simp add: mask_def)\n\nlemma ucast_shiftl_6_absorb:\n fixes f l :: \"16 word\"\n assumes \"f \\ l\"\n assumes \"f >> 6 < l >> 6\"\n shows \"UCAST(16\\32 signed) ((f >> 6) + 1) << 6 = UCAST(16 \\ 32 signed) (((f >> 6) + 1) << 6)\"\n using assms\n by (word_bitwise, auto)\n\nlemma prio_ucast_shiftr_wordRadix_helper: (* FIXME generalise *)\n \"(ucast (p::priority) >> wordRadix :: machine_word) < 4\"\n unfolding maxPriority_def numPriorities_def wordRadix_def\n using unat_lt2p[where x=p]\n apply (clarsimp simp add: word_less_nat_alt shiftr_div_2n' unat_ucast_upcast is_up word_le_nat_alt)\n apply arith\n done\n\nlemma prio_ucast_shiftr_wordRadix_helper': (* FIXME generalise *)\n \"(ucast (p::priority) >> wordRadix :: machine_word) \\ 3\"\n unfolding maxPriority_def numPriorities_def wordRadix_def\n using unat_lt2p[where x=p]\n apply (clarsimp simp add: word_less_nat_alt shiftr_div_2n' unat_ucast_upcast is_up word_le_nat_alt)\n apply arith\n done\n\nlemma prio_unat_shiftr_wordRadix_helper': (* FIXME generalise *)\n \"unat ((p::priority) >> wordRadix) \\ 3\"\n unfolding maxPriority_def numPriorities_def wordRadix_def\n using unat_lt2p[where x=p]\n apply (clarsimp simp add: word_less_nat_alt shiftr_div_2n' unat_ucast_upcast is_up word_le_nat_alt)\n apply arith\n done\n\nlemma prio_ucast_shiftr_wordRadix_helper2: (* FIXME possibly unused *)\n \"(ucast (p::priority) >> wordRadix :: machine_word) < 0x20\"\n by (rule order_less_trans[OF prio_ucast_shiftr_wordRadix_helper]; simp)\n\nlemma prio_ucast_shiftr_wordRadix_helper3:\n \"(ucast (p::priority) >> wordRadix :: machine_word) < 0x40\"\n by (rule order_less_trans[OF prio_ucast_shiftr_wordRadix_helper]; simp)\n\nlemmas setEndpoint_obj_at_tcb' = setEndpoint_obj_at'_tcb\n\n(* FIXME: Move to Schedule_R.thy. Make Arch_switchToThread_obj_at a specialisation of this *)\nlemma Arch_switchToThread_obj_at_pre:\n \"\\obj_at' (Not \\ tcbQueued) t\\\n Arch.switchToThread t\n \\\\rv. obj_at' (Not \\ tcbQueued) t\\\"\n apply (simp add: X64_H.switchToThread_def)\n apply (wp asUser_obj_at_notQ doMachineOp_obj_at hoare_drop_imps|wpc)+\n done\n\ncrunch pspace_canonical'[wp]: setThreadState pspace_canonical'\n\nlemma word_shift_by_3:\n \"x * 8 = (x::'a::len word) << 3\"\n by (simp add: shiftl_t2n)\n\ndefinition\n user_word_at :: \"machine_word \\ machine_word \\ kernel_state \\ bool\"\nwhere\n \"user_word_at x p \\ \\s. is_aligned p 3\n \\ pointerInUserData p s\n \\ x = word_rcat (map (underlying_memory (ksMachineState s))\n [p + 7, p + 6, p + 5, p + 4, p + 3, p + 2, p + 1, p])\"\n\ndefinition\n device_word_at :: \"machine_word \\ machine_word \\ kernel_state \\ bool\"\nwhere\n \"device_word_at x p \\ \\s. is_aligned p 3\n \\ pointerInDeviceData p s\n \\ x = word_rcat (map (underlying_memory (ksMachineState s))\n [p + 7, p + 6, p + 5, p + 4, p + 3, p + 2, p + 1, p])\"\n\nlemma getMessageInfo_less_4:\n \"\\\\\\ getMessageInfo t \\\\rv s. msgExtraCaps rv < 4\\\"\n including no_pre\n apply (simp add: getMessageInfo_def)\n apply wp\n apply (rule hoare_strengthen_post, rule hoare_vcg_prop)\n apply (simp add: messageInfoFromWord_def Let_def\n Types_H.msgExtraCapBits_def)\n apply (rule word_leq_minus_one_le, simp)\n apply simp\n apply (rule word_and_le1)\n done\n\nlemma getMessageInfo_msgLength':\n \"\\\\\\ getMessageInfo t \\\\rv s. msgLength rv \\ 0x78\\\"\n including no_pre\n apply (simp add: getMessageInfo_def)\n apply wp\n apply (rule hoare_strengthen_post, rule hoare_vcg_prop)\n apply (simp add: messageInfoFromWord_def Let_def msgMaxLength_def not_less\n Types_H.msgExtraCapBits_def split: if_split )\n done\n\nlemma ucast_le_ucast_8_32:\n \"(ucast x \\ (ucast y :: word32)) = (x \\ (y :: word8))\"\n by (simp add: word_le_nat_alt is_up_8_32 unat_ucast_upcast)\n\nlemma asid_shiftr_low_bits_less:\n \"(asid :: machine_word) \\ mask asid_bits \\ asid >> asid_low_bits < 0x8\"\n apply (rule_tac y=\"2 ^ 3\" in order_less_le_trans)\n apply (rule shiftr_less_t2n)\n apply (simp add: le_mask_iff_lt_2n[THEN iffD1] asid_bits_def asid_low_bits_def)\n apply simp\n done\n\nlemma addToBitmap_sets_L1Bitmap_same_dom:\n \"\\\\s. p \\ maxPriority \\ d' = d \\ addToBitmap d' p\n \\\\rv s. ksReadyQueuesL1Bitmap s d \\ 0 \\\"\n unfolding addToBitmap_def bitmap_fun_defs\n apply wpsimp\n apply (clarsimp simp: maxPriority_def numPriorities_def word_or_zero le_def\n prioToL1Index_max[simplified wordRadix_def, simplified])\n done\n\ncontext begin interpretation Arch .\n\nlemma vmsz_aligned_aligned_pageBits:\n \"vmsz_aligned ptr sz \\ is_aligned ptr pageBits\"\n apply (simp add: vmsz_aligned_def)\n apply (erule is_aligned_weaken)\n apply (simp add: pageBits_def pageBitsForSize_def\n split: vmpage_size.split)\n done\n\nlemma empty_fail_findVSpaceForASID[iff]:\n \"empty_fail (findVSpaceForASID asid)\"\n unfolding findVSpaceForASID_def checkPML4At_def\n by (wpsimp wp: empty_fail_getObject)\n\ncrunch inv'[wp]: archThreadGet P\n\n(* FIXME MOVE near thm tg_sp' *)\nlemma atg_sp':\n \"\\P\\ archThreadGet f p \\\\t. obj_at' (\\t'. f (tcbArch t') = t) p and P\\\"\n including no_pre\n apply (simp add: archThreadGet_def)\n apply wp\n apply (rule hoare_strengthen_post)\n apply (rule getObject_tcb_sp)\n apply clarsimp\n apply (erule obj_at'_weakenE)\n apply simp\n done\n\n(* FIXME: MOVE to EmptyFail *)\nlemma empty_fail_archThreadGet [intro!, wp, simp]:\n \"empty_fail (archThreadGet f p)\"\n by (fastforce simp: archThreadGet_def getObject_def split_def)\n\nlemma more_pageBits_inner_beauty:\n fixes x :: \"9 word\"\n fixes p :: machine_word\n assumes x: \"x \\ ucast (p && mask pageBits >> 3)\"\n shows \"(p && ~~ mask pageBits) + (ucast x * 8) \\ p\"\n apply clarsimp\n apply (simp add: word_shift_by_3)\n apply (subst (asm) word_plus_and_or_coroll)\n apply (word_eqI_solve dest: test_bit_size simp: pageBits_def)\n apply (insert x)\n apply (erule notE)\n apply word_eqI\n apply (erule_tac x=\"3+n\" in allE)\n apply (clarsimp simp: word_size pageBits_def)\n done\n\n(* FIXME x64: figure out where these are needed and adjust appropriately *)\nlemma mask_pageBits_inner_beauty:\n \"is_aligned p 3 \\\n (p && ~~ mask pageBits) + (ucast ((ucast (p && mask pageBits >> 3)):: 9 word) * 8) = (p::machine_word)\"\n apply (simp add: is_aligned_nth word_shift_by_3)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_ops_nth_size nth_ucast nth_shiftr nth_shiftl)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_ops_nth_size nth_ucast nth_shiftr nth_shiftl\n pageBits_def)\n apply (rule iffI)\n apply (erule disjE)\n apply clarsimp\n apply clarsimp\n apply simp\n apply clarsimp\n apply (rule context_conjI)\n apply (rule leI)\n apply clarsimp\n apply simp\n apply arith\n done\n\n(* FIXME: move to ainvs? *)\nlemma sign_extend_canonical_address:\n \"(x = sign_extend 47 x) = canonical_address x\"\n by (fastforce simp: sign_extended_iff_sign_extend canonical_address_sign_extended)\n\ncrunches Arch.switchToThread\n for valid_queues'[wp]: valid_queues'\n (simp: crunch_simps)\ncrunches switchToIdleThread\n for ksCurDomain[wp]: \"\\s. P (ksCurDomain s)\"\ncrunches switchToIdleThread, switchToThread\n for valid_pspace'[wp]: valid_pspace'\n (simp: whenE_def crunch_simps)\n\nlemma setCurrentUserCR3_valid_arch_state'[wp]:\n \"\\valid_arch_state' and K (valid_cr3' c)\\ setCurrentUserCR3 c \\\\_. valid_arch_state'\\\"\n by (wpsimp simp: setCurrentUserCR3_def valid_arch_state'_def)\n\nlemma setVMRoot_valid_arch_state':\n \"\\valid_arch_state'\\ setVMRoot t \\\\_. valid_arch_state'\\\"\n apply (simp add: setVMRoot_def getThreadVSpaceRoot_def setCurrentUserVSpaceRoot_def)\n apply (wp whenE_wp getCurrentUserCR3_wp findVSpaceForASID_vs_at_wp\n | wpcw\n | clarsimp simp: if_apply_def2 asid_wf_0\n | strengthen valid_cr3'_makeCR3)+\n done\n\ncrunch valid_arch_state'[wp]: switchToThread valid_arch_state'\n (wp: crunch_wps simp: crunch_simps)\n\nlemma mab_gt_2 [simp]:\n \"2 \\ msg_align_bits\" by (simp add: msg_align_bits)\n\nlemma loadWordUser_submonad_fn:\n \"loadWordUser p = submonad_fn ksMachineState (ksMachineState_update \\ K)\n (pointerInUserData p) (loadWord p)\"\n by (simp add: loadWordUser_def submonad_doMachineOp.fn_is_sm submonad_fn_def)\n\nlemma storeWordUser_submonad_fn:\n \"storeWordUser p v = submonad_fn ksMachineState (ksMachineState_update \\ K)\n (pointerInUserData p) (storeWord p v)\"\n by (simp add: storeWordUser_def submonad_doMachineOp.fn_is_sm submonad_fn_def)\n\nlemma threadGet_tcbFault_loadWordUser_comm:\n \"do x \\ threadGet tcbFault t; y \\ loadWordUser p; n x y od =\n do y \\ loadWordUser p; x \\ threadGet tcbFault t; n x y od\"\n apply (rule submonad_comm [OF tcbFault_submonad_args _\n threadGet_tcbFault_submonad_fn\n loadWordUser_submonad_fn])\n apply (simp add: submonad_args_def pointerInUserData_def)\n apply (simp add: thread_replace_def Let_def)\n apply simp\n apply (clarsimp simp: thread_replace_def Let_def typ_at'_def ko_wp_at'_def\n ps_clear_upd ps_clear_upd_None pointerInUserData_def\n split: option.split kernel_object.split)\n apply (simp add: get_def empty_fail_def)\n apply (simp add: ef_loadWord)\n done\n\nlemma threadGet_tcbFault_storeWordUser_comm:\n \"do x \\ threadGet tcbFault t; y \\ storeWordUser p v; n x y od =\n do y \\ storeWordUser p v; x \\ threadGet tcbFault t; n x y od\"\n apply (rule submonad_comm [OF tcbFault_submonad_args _\n threadGet_tcbFault_submonad_fn\n storeWordUser_submonad_fn])\n apply (simp add: submonad_args_def pointerInUserData_def)\n apply (simp add: thread_replace_def Let_def)\n apply simp\n apply (clarsimp simp: thread_replace_def Let_def typ_at'_def ko_wp_at'_def\n ps_clear_upd ps_clear_upd_None pointerInUserData_def\n split: option.split kernel_object.split)\n apply (simp add: get_def empty_fail_def)\n apply (simp add: ef_storeWord)\n done\n\nlemma asUser_getRegister_discarded:\n \"(asUser t (getRegister r)) >>= (\\_. n) =\n stateAssert (tcb_at' t) [] >>= (\\_. n)\"\n apply (rule ext)\n apply (clarsimp simp: submonad_asUser.fn_is_sm submonad_fn_def\n submonad_asUser.args assert_def select_f_def\n gets_def get_def modify_def put_def\n getRegister_def bind_def split_def\n return_def fail_def stateAssert_def)\n done\n\n(* FIXME x64: check *)\nlemma addrFromPPtr_mask:\n \"n \\ 39\n \\ addrFromPPtr ptr && mask n = ptr && mask n\"\n apply (simp add: addrFromPPtr_def X64.pptrBase_def)\n apply word_bitwise\n apply simp\n done\n\nlemma asUser_get_registers:\n \"\\tcb_at' target\\\n asUser target (mapM getRegister xs)\n \\\\rv s. obj_at' (\\tcb. map ((user_regs o atcbContextGet o tcbArch) tcb) xs = rv) target s\\\"\n apply (induct xs)\n apply (simp add: mapM_empty asUser_return)\n apply wp\n apply simp\n apply (simp add: mapM_Cons asUser_bind_distrib asUser_return empty_fail_cond)\n apply wp\n apply simp\n apply (rule hoare_strengthen_post)\n apply (erule hoare_vcg_conj_lift)\n apply (rule asUser_inv)\n apply (simp add: getRegister_def)\n apply (wp mapM_wp')\n apply clarsimp\n apply (erule(1) obj_at_conj')\n apply (wp)\n apply (simp add: asUser_def split_def threadGet_def)\n apply (wp getObject_tcb_wp)\n apply (clarsimp simp: getRegister_def simpler_gets_def\n obj_at'_def)\n done\n\n(* FIXME: move to where is_aligned_ptrFromPAddr is *)\nlemma is_aligned_ptrFromPAddr_pageBitsForSize:\n \"is_aligned p (pageBitsForSize sz) \\ is_aligned (ptrFromPAddr p) (pageBitsForSize sz)\"\n by (cases sz ; simp add: is_aligned_ptrFromPAddr_n bit_simps)\n\nlemma is_aligned_pageBitsForSize_minimum:\n \"\\ is_aligned p (pageBitsForSize sz) ; n \\ pageBits \\ \\ is_aligned p n\"\n apply (cases sz; clarsimp simp: pageBits_def)\n apply (erule is_aligned_weaken, simp)+\n done\n\nlemma valid_objs_valid_pte': \"\\ valid_objs' s ; ko_at' (ko :: pte) p s \\ \\ valid_pte' ko s\"\n by (fastforce simp add: obj_at'_def ran_def valid_obj'_def projectKOs valid_objs'_def)\n\nlemma obj_at_kernel_mappings':\n \"\\pspace_in_kernel_mappings' s; obj_at' P p s\\ \\\n p \\ kernel_mappings\"\n by (clarsimp simp: pspace_in_kernel_mappings'_def obj_at'_def dom_def)\n\n(* FIXME: move to Wellformed, turn valid_asid_pool' into an abbreviation >>>*)\nprimrec\n wf_asid_pool' :: \"asidpool \\ bool\"\nwhere\n \"wf_asid_pool' (ASIDPool pool) =\n (dom pool \\ {0 .. 2^asid_low_bits - 1} \\\n 0 \\ ran pool \\ (\\x \\ ran pool. is_aligned x pml4_bits))\"\n\nlemma valid_eq_wf_asid_pool'[simp]:\n \"valid_asid_pool' pool = (\\s. wf_asid_pool' pool)\"\n by (case_tac pool) simp\n\ndeclare valid_asid_pool'.simps[simp del]\n(*<<<*)\n\n(* FIXME: change the original to be predicated! *)\ncrunch pred_tcb_at'2[wp]: doMachineOp \"\\s. P (pred_tcb_at' a b p s)\"\n (simp: crunch_simps)\n\nlemma valid_untyped':\n notes usableUntypedRange.simps[simp del]\n assumes pspace_distinct': \"pspace_distinct' s\" and\n pspace_aligned': \"pspace_aligned' s\" and\n al: \"is_aligned ptr bits\"\n shows \"valid_untyped' d ptr bits idx s =\n (\\p ko. ksPSpace s p = Some ko \\\n obj_range' p ko \\ {ptr..ptr + 2 ^ bits - 1} \\ {} \\\n obj_range' p ko \\ {ptr..ptr + 2 ^ bits - 1} \\\n obj_range' p ko \\\n usableUntypedRange (UntypedCap d ptr bits idx) = {})\"\n apply (simp add: valid_untyped'_def)\n apply (simp add: ko_wp_at'_def)\n apply (rule arg_cong[where f=All])\n apply (rule ext)\n apply (rule arg_cong[where f=All])\n apply (rule ext)\n apply (case_tac \"ksPSpace s ptr' = Some ko\", simp_all)\n apply (frule pspace_alignedD'[OF _ pspace_aligned'])\n apply (frule pspace_distinctD'[OF _ pspace_distinct'])\n apply simp\n apply (frule aligned_ranges_subset_or_disjoint[OF al])\n apply (fold obj_range'_def)\n apply (rule iffI)\n apply auto[1]\n apply (rule conjI)\n apply (rule ccontr, simp)\n apply (simp add: Set.psubset_eq)\n apply (erule conjE)\n apply (case_tac \"obj_range' ptr' ko \\ {ptr..ptr + 2 ^ bits - 1} \\ {}\", simp)\n apply (cut_tac is_aligned_no_overflow[OF al])\n apply (auto simp add: obj_range'_def)[1]\n apply (clarsimp simp add: usableUntypedRange.simps Int_commute)\n apply (case_tac \"obj_range' ptr' ko \\ {ptr..ptr + 2 ^ bits - 1} \\ {}\", simp+)\n apply (cut_tac is_aligned_no_overflow[OF al])\n apply (clarsimp simp add: obj_range'_def)\n apply (frule is_aligned_no_overflow)\n by (metis al intvl_range_conv' le_m1_iff_lt less_is_non_zero_p1\n nat_le_linear power_overflow sub_wrap add_0\n add_0_right word_add_increasing word_less_1 word_less_sub_1)\n\n(* We don't have access to n_msgRegisters from C here, but the number of msg registers in C should\n be equivalent to what we have in the abstract/design specs. We want a number for this definition\n that automatically updates if the number of registers changes, and we sanity check it later\n in msgRegisters_size_sanity *)\ndefinition size_msgRegisters :: nat where\n size_msgRegisters_pre_def: \"size_msgRegisters \\ size (X64.msgRegisters)\"\n\nschematic_goal size_msgRegisters_def:\n \"size_msgRegisters = numeral ?x\"\n unfolding size_msgRegisters_pre_def X64.msgRegisters_def\n by (simp add: upto_enum_red fromEnum_def enum_register del: Suc_eq_numeral)\n (simp only: Suc_eq_plus1_left, simp del: One_nat_def)\n\nlemma length_msgRegisters[simplified size_msgRegisters_def]:\n \"length X64_H.msgRegisters = size_msgRegisters\"\n by (simp add: size_msgRegisters_pre_def X64_H.msgRegisters_def)\n\nlemma empty_fail_loadWordUser[intro!, simp]:\n \"empty_fail (loadWordUser x)\"\n by (fastforce simp: loadWordUser_def ef_loadWord ef_dmo')\n\nlemma empty_fail_getMRs[iff]:\n \"empty_fail (getMRs t buf mi)\"\n by (auto simp add: getMRs_def split: option.split)\n\nlemma empty_fail_getReceiveSlots:\n \"empty_fail (getReceiveSlots r rbuf)\"\nproof -\n note\n empty_fail_resolveAddressBits[wp]\n empty_fail_rethrowFailure[wp]\n empty_fail_rethrowFailure[wp]\n show ?thesis\n unfolding getReceiveSlots_def loadCapTransfer_def lookupCap_def lookupCapAndSlot_def\n by (wpsimp simp: emptyOnFailure_def unifyFailure_def lookupSlotForThread_def\n capTransferFromWords_def getThreadCSpaceRoot_def locateSlot_conv bindE_assoc\n lookupSlotForCNodeOp_def lookupErrorOnFailure_def rangeCheck_def)\nqed\n\nlemma user_getreg_rv:\n \"\\obj_at' (\\tcb. P ((user_regs o atcbContextGet o tcbArch) tcb r)) t\\\n asUser t (getRegister r)\n \\\\rv s. P rv\\\"\n apply (simp add: asUser_def split_def)\n apply (wp threadGet_wp)\n apply (clarsimp simp: obj_at'_def getRegister_def in_monad atcbContextGet_def)\n done\n\ncrunches insertNewCap, Arch_createNewCaps, threadSet, Arch.createObject, setThreadState,\n updateFreeIndex, preemptionPoint\n for gsCNodes[wp]: \"\\s. P (gsCNodes s)\"\n (wp: crunch_wps setObject_ksPSpace_only\n simp: unless_def updateObject_default_def crunch_simps\n ignore_del: preemptionPoint)\n\nlemma cap_case_isPML4Cap:\n \"(case cap of ArchObjectCap (PML4Cap pm (Some asid)) \\ fn pm asid | _ => g)\n = (if (if isArchObjectCap cap then if isPML4Cap (capCap cap) then capPML4MappedASID (capCap cap) \\ None else False else False)\n then fn (capPML4BasePtr (capCap cap)) (the (capPML4MappedASID (capCap cap))) else g)\"\n apply (cases cap; simp add: isArchObjectCap_def)\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability, simp_all add: isPML4Cap_def)\n apply (rename_tac option)\n apply (case_tac option; simp)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/X64/ArchMove_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.36296921930155557, "lm_q1q2_score": 0.19139966681589196}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n Example C structure instantiation and related lemmas\n*)\n\ntheory CompoundCTypesEx\nimports CompoundCTypes\nbegin\n\nrecord x_struct_ex =\n x_example :: \"32 word\"\n y_example :: \"8 word\"\n\ndefinition x_struct_ex_tag :: \"'a x_struct_ex_scheme typ_info\" where\n \"x_struct_ex_tag \\ (\n final_pad \\\n (ti_typ_pad_combine TYPE(8 word) y_example (y_example_update \\ (\\x _. x)) ''y_example'') \\\n (ti_typ_pad_combine TYPE(32 word) x_example (x_example_update \\ (\\x _. x)) ''x_example''))\n (empty_typ_info ''x_struct_ex'')\"\n\ninstantiation x_struct_ex_ext :: (type) c_type\nbegin\ninstance ..\nend\n\noverloading x_struct_ex_typ_tag \\ typ_info_t begin\ndefinition\nx_struct_ex_typ_tag: \"x_struct_ex_typ_tag (t::'a x_struct_ex_ext itself) \\\n (x_struct_ex_tag::'a x_struct_ex_scheme typ_info)\"\nend\n\n\nlemma aggregate_x_struct_ex_tag [simp]:\n \"aggregate x_struct_ex_tag\"\n by (simp add: x_struct_ex_tag_def final_pad_def Let_def)\n\nlemma\n \"upd_local (x_example_update \\ (\\x _. x))\"\napply(auto simp: upd_local_def )\napply(tactic \\Record.split_tac @{context} 1\\ )\napply simp\ndone\n\ninstantiation x_struct_ex_ext :: (unit_class) mem_type\nbegin\ninstance\napply intro_classes\n\napply(auto simp: x_struct_ex_typ_tag x_struct_ex_tag_def)\n\n(* wf_desc *)\napply(fastforce intro: wf_desc_final_pad wf_desc_ti_typ_pad_combine)\n\n(* wf_size_desc *)\napply(fastforce intro: wf_size_desc_ti_typ_pad_combine wf_size_desc_final_pad)\n\n(* wf_lf *)\napply(fastforce intro: wf_lf_final_pad wf_lf_ti_typ_pad_combine\n wf_desc_final_pad wf_desc_ti_typ_pad_combine\n g_ind_ti_typ_pad_combine f_ind_ti_typ_pad_combine\n fa_ind_ti_typ_pad_combine)\n\n(* fu_eq_mask *)\napply(rule fu_eq_mask)\n apply(simp add: size_of_def x_struct_ex_typ_tag x_struct_ex_tag_def)\napply(rule fu_eq_mask_final_pad)\napply(rule fu_eq_mask_ti_typ_pad_combine)+\napply(rule fu_eq_mask_empty_typ_info)\napply(simp add: there_is_only_one)\napply(fastforce simp: fg_cons_def intro: fc_ti_typ_pad_combine)+\n\n(* align_of dvd size_of *)\napply(simp add: align_of_def size_of_def x_struct_ex_typ_tag\n x_struct_ex_tag_def)\n\n(* align_field *)\napply(simp add: align_field_final_pad align_field_ti_typ_pad_combine)\n\n(* max_size *)\napply(simp add: size_of_def x_struct_ex_typ_tag x_struct_ex_tag_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine\n size_td_lt_ti_typ_combine size_td_lt_ti_pad_combine padup_def\n addr_card align_of_final_pad align_of_def)\ndone\nend\n\ndeclare x_struct_ex_typ_tag [simp add]\ndeclare x_struct_ex_tag_def [simp add]\n\nlemma x_struct_ex_fnl [simp]:\n \"field_names_list (x_struct_ex_tag::'a x_struct_ex_scheme typ_info) =\n [''x_example'',''y_example''] @\n padding_fields (x_struct_ex_tag::'a x_struct_ex_scheme typ_info)\"\napply(clarsimp simp: field_names_list_def)\ndone\n\n\nrecord y_struct_ex =\n x2_example :: \"32 word ptr\"\n(*\n x3_example :: \"32 word ptr\"\n x4_example :: \"32 word ptr\"\n x5_example :: \"32 word ptr\"\n x6_example :: \"32 word ptr\"\n x7_example :: \"32 word ptr\"\n\n x12_example :: \"32 word ptr\"\n x13_example :: \"32 word ptr\"\n x14_example :: \"32 word ptr\"\n x15_example :: \"32 word ptr\"\n x16_example :: \"32 word ptr\"\n x17_example :: \"32 word ptr\"*)\n y2_example :: \"x_struct_ex\"\n\ndefinition y_struct_ex_tag :: \"'a y_struct_ex_scheme typ_info\" where\n \"y_struct_ex_tag \\ (\n final_pad \\\n (ti_typ_pad_combine TYPE(x_struct_ex) y2_example (y2_example_update \\ (\\x _. x)) ''y2_example'') \\\n (ti_typ_pad_combine TYPE(32 word ptr) x2_example (x2_example_update \\ (\\x _. x)) ''x2_example'')\n )\n (empty_typ_info ''y_struct_ex'')\"\n\ninstantiation y_struct_ex_ext :: (type) c_type\nbegin\ninstance ..\nend\n\noverloading y_struct_ex_typ_tag \\ typ_info_t\nbegin\ndefinition\ny_struct_ex_typ_tag: \"y_struct_ex_typ_tag (t::'a y_struct_ex_ext itself) \\\n (y_struct_ex_tag::'a y_struct_ex_scheme typ_info)\"\nend\n\ninstantiation y_struct_ex_ext :: (unit_class) mem_type\nbegin\n\ninstance\napply intro_classes\n\napply(auto simp: y_struct_ex_typ_tag y_struct_ex_tag_def align_of_def size_of_def)\n\n(* wf_desc *)\napply(fastforce intro: wf_desc_final_pad wf_desc_ti_typ_pad_combine)\n\n(* wf_size_desc *)\napply(fastforce intro: wf_size_desc_ti_typ_pad_combine wf_size_desc_final_pad)\n\n(* wf_lf *)\napply(force intro: wf_lf_final_pad wf_lf_ti_typ_pad_combine\n wf_desc_final_pad wf_desc_ti_typ_pad_combine\n g_ind_ti_typ_pad_combine f_ind_ti_typ_pad_combine\n fa_ind_ti_typ_pad_combine)\n\n(* fu_eq_mask *)\napply(rule fu_eq_mask)\n apply(simp add: size_of_def y_struct_ex_typ_tag y_struct_ex_tag_def)\napply(rule fu_eq_mask_final_pad)\napply(rule fu_eq_mask_ti_typ_pad_combine)+\napply(rule fu_eq_mask_empty_typ_info)\napply(simp add: there_is_only_one)\napply(fastforce simp: fg_cons_def intro: fc_ti_typ_pad_combine)+\n\n(* align_field *)\napply(simp add: align_field_final_pad align_field_ti_typ_pad_combine)\n\n(* max_size *)\napply(simp add: size_td_simps_1)\napply(simp add: size_td_simps_2 addr_card )\ndone\n\nend\n\ndeclare y_struct_ex_typ_tag [simp add]\ndeclare y_struct_ex_tag_def [simp add]\n\nlemma y_struct_ex_fnl [simp]:\n \"field_names_list (y_struct_ex_tag::'a y_struct_ex_scheme typ_info) =\n [''x2_example'',''y2_example''] @\n padding_fields (y_struct_ex_tag::'a y_struct_ex_scheme typ_info)\"\napply(clarsimp simp: field_names_list_def)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/CompoundCTypesEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.33807713081919877, "lm_q1q2_score": 0.19135792236958368}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference\nimports \"Noninterference_Base\"\n \"Noninterference_Base_Alternatives\"\n \"Scheduler_IF\"\n \"ADT_IF\"\n \"Access.ADT_AC\"\nbegin\n\ntext \\\n\nThe top-level information flow theorems. (There are also theories for\nexample systems, which go on top of this one.)\n\nWe will instantiate the various unwinding systems, defined in\nNoninterference_Base(_Alternative), with the actual kernel automaton\nfrom ADT_IF. Then we consider the @{term noninterference_system.Nonleakage}\nand @{term noninterference_system.Noninterference} properties over\nour kernel big steps.\n\nAt the end of this file, we show the top-level Nonleakage theorem.\nThe Noninterference property does not hold on the kernel and is not\nproven despite the name of the file, but a partial integrity result\nholds in integrity_part.\n\n\\\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nsection \\sameFor : unwinding relation\\\n\ndatatype 'a partition = Partition 'a | PSched\n\n\nfun scheduler_modes where\n \"scheduler_modes KernelPreempted = True\" |\n \"scheduler_modes (KernelEntry Interrupt) = True\" |\n \"scheduler_modes (KernelSchedule b) = b\" |\n \"scheduler_modes _ = False\"\n\n(*Modes where thread context is valid*)\nfun user_modes where\n \"user_modes KernelExit = False\" |\n \"user_modes _ = True\"\n\ndefinition sameFor_subject\n :: \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ 'a \\ (observable_if \\ observable_if) set\"\nwhere\n \"sameFor_subject g ab irqab asidab domainab l \\\n {(os,os') | os os' s s'.\n s = internal_state_if os \\\n s' = internal_state_if os' \\\n states_equiv_for\n (\\x. ab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. irqab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. asidab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. domainab x \\ subjectReads g (OrdinaryLabel l) \\ {})\n s s' \\\n ((domainab (cur_domain s) \\ subjectReads g (OrdinaryLabel l) \\ {} \\\n domainab (cur_domain s') \\ subjectReads g (OrdinaryLabel l) \\ {}) \\\n (cur_domain s = cur_domain s' \\ globals_equiv s s' \\\n scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\\n user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\\n equiv_for (\\ x. ab x = SilcLabel) kheap s s'))}\"\n\ndefinition sameFor_scheduler\n :: \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ (observable_if \\ observable_if) set\"\nwhere\n \"sameFor_scheduler g ab irqab asidab domainab \\\n {(os,os') | os os' s s'.\n s = internal_state_if os \\\n s' = internal_state_if os' \\\n domain_fields_equiv s s' \\\n idle_thread s = idle_thread s' \\\n globals_equiv_scheduler s s' \\\n equiv_for (\\ x. ab x = SilcLabel) kheap s s' \\\n irq_state_of_state s = irq_state_of_state s' \\\n scheduler_modes (sys_mode_of os) = scheduler_modes (sys_mode_of os') \\\n interrupted_modes (sys_mode_of os) = interrupted_modes (sys_mode_of os')}\"\n\ntext \\\n From the graph we define an equivalence relation on states for each partition.\n\n This is the unwinding relation of domain d with the right parameters (cf uwr later in this file)\n\\\ndefinition sameFor\n :: \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ 'a partition \\ (observable_if \\ observable_if) set\"\nwhere\n \"sameFor g ab irqab asidab domainab d \\\n case d of Partition l \\ sameFor_subject g ab irqab asidab domainab l |\n PSched \\ sameFor_scheduler g ab irqab asidab domainab\"\n\nabbreviation same_for\nwhere\n \"same_for aag d \\ sameFor (pasPolicy aag) (pasObjectAbs aag) (pasIRQAbs aag)\n (pasASIDAbs aag) (pasDomainAbs aag) d\"\n\ntext \\\n We want @{term sameFor} to be an equivalence relation always.\n\\\nlemma sameFor_refl: \"refl (sameFor g ab irqab asidab domainab d)\"\n by(auto intro!: refl_onI equiv_for_refl\n simp: sameFor_def sameFor_subject_def sameFor_scheduler_def domain_fields_equiv_def\n split: partition.splits\n intro: states_equiv_for_refl globals_equiv_refl globals_equiv_scheduler_refl)\n\nlemma domain_fields_equiv_sym:\n \"domain_fields_equiv s t \\ domain_fields_equiv t s\"\n by (clarsimp simp: domain_fields_equiv_def)\n\nlemma sameFor_sym:\n \"sym (sameFor g ab irqab asidab domainab d)\"\n by (fastforce intro: symI\n simp: sameFor_def sameFor_subject_def sameFor_scheduler_def\n split: partition.splits\n intro: states_equiv_for_sym globals_equiv_sym equiv_for_sym domain_fields_equiv_sym)\n\nlemma domain_fields_equiv_trans:\n \"domain_fields_equiv s t \\ domain_fields_equiv t u \\ domain_fields_equiv s u\"\n by(clarsimp simp: domain_fields_equiv_def)\n\nlemma sameFor_trans: \"trans (sameFor g ab irqab asidab domainab d)\"\n apply (rule transI)\n apply (auto simp: sameFor_def sameFor_subject_def sameFor_scheduler_def\n split: partition.splits\n intro: states_equiv_for_trans globals_equiv_trans equiv_for_trans\n domain_fields_equiv_trans)\n done\n\nfun label_of where\n \"label_of (OrdinaryLabel l) = l\"\n\nlemma is_label [simp]: \"\\x \\ SilcLabel\\ \\ OrdinaryLabel (label_of x) = x\"\n by(case_tac x, auto)\n\nlemma pasSubject_not_SilcLabel:\n \"silc_inv aag s s' \\ pasSubject aag \\ SilcLabel\"\n by(auto simp: silc_inv_def)\n\n(* needs silc_inv to ensure pasSubject is not SilcLabel *)\nlemma sameFor_reads_equiv_f_g:\n \"pasSubject aag \\ pasDomainAbs aag (cur_domain s) \\\n pasSubject aag \\ pasDomainAbs aag (cur_domain s') \\\n silc_inv aag st' st'' \\\n reads_equiv_f_g aag s s' \\\n (((uc,s),mode),((uc,s'),mode)) \\ same_for aag (Partition (label_of (pasSubject aag)))\"\n apply (clarsimp simp: reads_equiv_f_g_def reads_equiv_def2 sameFor_def silc_dom_equiv_def)\n apply (simp add: sameFor_subject_def)\n apply (frule pasSubject_not_SilcLabel)\n apply (clarsimp)\n done\n\nlemma sameFor_reads_equiv_f_g':\n \"\\pas_cur_domain aag s \\ pas_cur_domain aag s';\n silc_inv aag st s;\n (((uc,s),mode),((uc',s'),mode')) \\ same_for aag (Partition (label_of (pasSubject aag)))\\ \\\n reads_equiv_f_g aag s s'\"\n apply (frule pasSubject_not_SilcLabel)\n apply (simp add: reads_equiv_f_g_def reads_equiv_def2 sameFor_def sameFor_subject_def\n silc_dom_equiv_def globals_equiv_def)\n apply auto\n done\n\nlemma sameFor_scheduler_equiv:\n \"(s,s') \\ same_for aag PSched \\\n scheduler_equiv aag (internal_state_if s) (internal_state_if s')\"\n by(clarsimp simp: scheduler_equiv_def sameFor_def sameFor_scheduler_def silc_dom_equiv_def)\n\n\ndefinition label_can_affect_partition where\n \"label_can_affect_partition g k l \\ \\ d. d \\ subjectAffects g k \\ d \\ subjectReads g l\"\n\ndefinition partsSubjectAffects where\n \"partsSubjectAffects g l \\\n Partition ` {x. label_can_affect_partition g (OrdinaryLabel l) (OrdinaryLabel x)}\"\n\n\nlemma reads_g_affects_equiv_sameFor:\n \"\\reads_equiv_f_g aag s s' \\ affects_equiv aag (OrdinaryLabel l) s s';\n pas_cur_domain aag s;\n silc_inv aag st' st'';\n Partition l \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag))\\ \\\n (((uc,s),mode),((uc,s'),mode)) \\ same_for aag (Partition l)\"\n apply(clarsimp simp: partsSubjectAffects_def)\n apply(simp add: affects_equiv_def2 sameFor_def sameFor_subject_def)\n apply (frule pasSubject_not_SilcLabel)\n apply(simp add: reads_equiv_f_g_def reads_equiv_def2 silc_dom_equiv_def)\n apply(erule states_equiv_for_guard_imp)\n apply(simp add: aag_can_affect_label_def label_can_affect_partition_def)+\n done\n\n\nlemma schedule_reads_affects_equiv_sameFor_PSched:\n \"\\scheduler_equiv aag s s'; scheduler_modes mode = scheduler_modes mode';\n interrupted_modes mode = interrupted_modes mode'\\ \\\n (((uc,s),mode),((uc',s'),mode')) \\ same_for aag PSched\"\n by (simp add: sameFor_def sameFor_scheduler_def scheduler_equiv_def silc_dom_equiv_def)\n\nlemma schedule_reads_affects_equiv_sameFor_PSched':\n \"\\scheduler_equiv aag (internal_state_if s) (internal_state_if s');\n scheduler_modes (sys_mode_of s) = scheduler_modes (sys_mode_of s');\n interrupted_modes (sys_mode_of s) = interrupted_modes (sys_mode_of s')\\ \\\n (s,s') \\ same_for aag PSched\"\n apply (case_tac s)\n apply (case_tac a)\n apply (case_tac s')\n apply (case_tac ab)\n apply clarsimp\n apply (rule schedule_reads_affects_equiv_sameFor_PSched)\n apply simp+\n done\n\nlemma observable_if_cases:\n \"P (s::observable_if) \\ P (((user_context_of s),(internal_state_if s)),sys_mode_of s)\"\n by(case_tac s, case_tac \"fst s\", simp)\n\nlemma sameFor_reads_f_g_affects_equiv:\n \"\\pas_cur_domain aag (internal_state_if s);\n silc_inv aag st (internal_state_if s);\n (s,s') \\ same_for aag (Partition (label_of (pasSubject aag)));\n Partition l \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag));\n (s,s') \\ same_for aag (Partition l)\\ \\\n reads_equiv_f_g aag (internal_state_if s) (internal_state_if s') \\\n affects_equiv aag (OrdinaryLabel l) (internal_state_if s) (internal_state_if s')\"\n apply(rule conjI)\n apply(rule sameFor_reads_equiv_f_g')\n apply blast\n apply blast\n apply(rule_tac s=s in observable_if_cases)\n apply(erule_tac s=s' in observable_if_cases)\n apply (simp add: partsSubjectAffects_def)\n apply (frule pasSubject_not_SilcLabel)\n apply clarsimp\n apply(clarsimp simp: affects_equiv_def2 sameFor_def)\n apply(clarsimp simp: sameFor_subject_def[where l=l])\n apply(blast intro: states_equiv_for_guard_imp)\n done\n\n\nlemma schedule_reads_affects_equiv_sameFor:\n \"\\scheduler_equiv aag s s' \\ scheduler_affects_equiv aag (OrdinaryLabel l) s s';\n user_modes mode \\ uc = uc'\\ \\\n (((uc,s),mode),((uc',s'),mode)) \\ same_for aag (Partition l)\"\n by (auto simp: scheduler_equiv_def scheduler_affects_equiv_def sameFor_def sameFor_subject_def\n silc_dom_equiv_def reads_scheduler_def domain_fields_equiv_def\n disjoint_iff_not_equal Bex_def\n intro: globals_equiv_from_scheduler)\n\n\nlemma globals_equiv_to_scheduler_globals_frame_equiv:\n \"globals_equiv s t \\ invs s \\ invs t\\ scheduler_globals_frame_equiv s t\"\n by (simp add: globals_equiv_def scheduler_globals_frame_equiv_def)\n\nlemma globals_equiv_to_cur_thread_eq:\n \"globals_equiv s t \\ cur_thread s = cur_thread t\"\n by(simp add: globals_equiv_def)\n\nlemma globals_equiv_to_exclusive_state_equiv:\n \"globals_equiv s t \\ cur_thread s \\ idle_thread t \\ exclusive_state_equiv s t\"\n by(simp add: globals_equiv_def idle_equiv_def)\n\nlemma sameFor_scheduler_affects_equiv:\n \"\\(s,s') \\ same_for aag PSched;\n (s,s') \\ same_for aag (Partition l);\n invs (internal_state_if s);invs (internal_state_if s')\\ \\\n scheduler_equiv aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv aag (OrdinaryLabel l) (internal_state_if s) (internal_state_if s')\"\n apply (rule conjI)\n apply (blast intro: sameFor_scheduler_equiv)\n apply (clarsimp simp: scheduler_affects_equiv_def sameFor_def silc_dom_equiv_def\n reads_scheduler_def sameFor_scheduler_def\n globals_equiv_to_exclusive_state_equiv)\n (* simplifying using sameFor_subject_def in assumptions causes simp to loop *)\n apply (simp (no_asm_use) add: sameFor_subject_def disjoint_iff_not_equal Bex_def)\n apply (blast intro: globals_equiv_to_scheduler_globals_frame_equiv\n globals_equiv_to_exclusive_state_equiv globals_equiv_to_cur_thread_eq)\n done\n\n\nlemma no_subject_affects_PSched:\n \"PSched \\ partsSubjectAffects g l\"\n by(auto simp: partsSubjectAffects_def elim: subjectAffects.cases)\n\nsection \\InfoFlow policy and partition integrity\\\n\ntext \\\n We derive a noninterference policy from the authority graph\n We exclude the silc label from the noninterference policy\n since it exists in the authority graph solely to ensure that no actual subject's\n label covers the inter label caps.\n\\\n\ninductive_set policyFlows :: \"'a subject_label auth_graph \\ ('a partition \\ 'a partition) set\"\n for g :: \"'a subject_label auth_graph\"\nwhere\n policy_affects: \"d \\ partsSubjectAffects g l \\ (Partition l, d) \\ policyFlows g\" |\n policy_scheduler: \"(PSched,d) \\ policyFlows g\"\n\n\nlemma no_partition_flows_to_PSched:\n \"(Partition l, PSched) \\ policyFlows g\"\n apply(rule notI)\n apply(erule policyFlows.cases)\n apply(simp_all add: no_subject_affects_PSched)\n done\n\n\n\nlemma partsSubjectAffects_bounds_those_subject_not_allowed_to_affect:\n \"(Partition l,d) \\ policyFlows g \\ d \\ partsSubjectAffects g l\"\n apply(clarify)\n apply(drule policy_affects)\n apply(blast)\n done\n\n\n\nlemma PSched_flows_to_all:\n \"(PSched,d) \\ policyFlows g\"\n by (rule policyFlows.intros)\n\n\nlemma policyFlows_refl:\n \"refl (policyFlows g)\"\n apply(rule refl_onI)\n apply simp\n apply(case_tac x)\n apply simp\n apply(rule policy_affects)\n apply(simp add: partsSubjectAffects_def image_def)\n apply(simp add: label_can_affect_partition_def)\n apply(blast intro: affects_lrefl)\n apply(blast intro: PSched_flows_to_all)\n done\n\n\n\n(* a more constrained integrity property for non-PSched transitions\n TODO: can we constrain this further? *)\ndefinition partitionIntegrity :: \"'a subject_label PAS \\ det_ext state \\ det_ext state \\ bool\"\nwhere\n \"partitionIntegrity aag s s' \\\n integrity (aag\\ pasMayActivate := False, pasMayEditReadyQueues := False\\)\n (scheduler_affects_globals_frame s) s s' \\\n domain_fields_equiv s s' \\ idle_thread s = idle_thread s' \\\n globals_equiv_scheduler s s' \\ silc_dom_equiv aag s s'\"\n\n\n\nlemma integrity_irq_state_independent:\n \"irq_state_independent\n (\\sa. integrity aag X st (s\\machine_state := sa\\))\"\n by (auto simp: irq_state_independent_def integrity_def)\n\nlemma pas_refined_irq_state_independent:\n \"irq_state_independent\n (\\sa. pas_refined aag s)\"\n by (auto simp: irq_state_independent_def)\n\nlemma irq_update_pspace_respects_device_region[simp]:\n \"pspace_respects_device_region (s\\machine_state := irq_state_update f sa\\)\n = pspace_respects_device_region (s\\machine_state := sa\\)\"\n by (clarsimp simp: pspace_respects_device_region_def user_mem_def device_mem_def)\n\nlemma irq_update_cap_refs_respects_device_region[simp]:\n \"cap_refs_respects_device_region (s\\machine_state := irq_state_update f sa\\)\n = cap_refs_respects_device_region (s\\machine_state := sa\\)\"\n by (clarsimp simp: cap_refs_respects_device_region_def user_mem_def\n device_mem_def cap_range_respects_device_region_def)\n\nlemma invs_irq_state_independent:\n \"irq_state_independent\n (\\sa. invs (s\\machine_state := sa\\))\"\n by(auto simp: irq_state_independent_def invs_def valid_state_def\n valid_machine_state_def cur_tcb_def valid_irq_states_def)\n\nlemma thread_set_tcb_context_update_ct_active[wp]:\n \"\\\\s. P (ct_active s)\\\n thread_set (tcb_arch_update (arch_tcb_context_set f)) t\n \\\\rv s. P (ct_active s)\\\"\n apply(simp add: thread_set_def ct_in_state_def | wp set_object_wp)+\n apply(clarsimp simp: st_tcb_at_def obj_at_def get_tcb_def\n split: option.splits kernel_object.splits)\n done\n\nlemma prop_of_two_valid:\n assumes f: \"\\P. \\\\s. P (f s)\\ m \\\\_ s. P (f s)\\\"\n assumes g: \"\\P. \\\\s. P (g s)\\ m \\\\_ s. P (g s)\\\"\n shows\n \"\\\\s. P (f s) (g s)\\ m \\\\_ s. P (f s) (g s)\\\"\n by (rule hoare_pre, wps f g, wp, simp)\n\nlemma integrity_update_reference_state:\n \"is_subject aag t \\ integrity aag X st s \\\n st = st'\\ kheap := kheap st'( t \\ blah)\\ \\\n integrity aag X st' s\"\n apply(erule integrity_trans[rotated])\n apply (clarsimp simp: integrity_def)\n done\n\nlemma thread_set_tcb_context_update_wp:\n \"\\\\s. P (s\\kheap := kheap s(t \\\n TCB (tcb_arch_update (arch_tcb_context_set tc) (the (get_tcb t s))))\\)\\\n thread_set (tcb_arch_update (arch_tcb_context_set tc)) t\n \\\\_. P\\\"\n apply(simp add: thread_set_def)\n apply (wp set_object_wp)\n apply simp\n done\n\n(* lots of ugly hackery because handle_event_integrity wants the reference state to\n be identical to the initial one, but it isn't because we first update the\n context of cur_thread *)\nlemma kernel_entry_if_integrity:\n shows\n \"\\ einvs and schact_is_rct and pas_refined aag and is_subject aag \\ cur_thread and\n domain_sep_inv (pasMaySendIrqs aag) st' and guarded_pas_domain aag and\n (\\ s. e \\ Interrupt \\ ct_active s) and (=) st\\\n kernel_entry_if e tc\n \\ \\_. integrity aag X st \\\"\n unfolding kernel_entry_if_def\n apply wp\n apply(rule valid_validE)\n apply(rule_tac Q=\n \"\\_ s. integrity aag X\n (st\\kheap := (kheap st)\n (cur_thread st \\ TCB (tcb_arch_update (arch_tcb_context_set tc)\n (the (get_tcb (cur_thread st) st))))\\) s\n \\ is_subject aag (cur_thread s)\n \\ cur_thread s = cur_thread st\"\n in hoare_strengthen_post)\n apply(wp handle_event_integrity handle_event_cur_thread | simp)+\n apply(fastforce intro: integrity_update_reference_state)\n apply(wp thread_set_integrity_autarch thread_set_pas_refined\n guarded_pas_domain_lift thread_set_invs_trivial thread_set_not_state_valid_sched\n | simp add: tcb_cap_cases_def schact_is_rct_def arch_tcb_update_aux2 tcb_arch_ref_def)+\n apply(wp (once) prop_of_two_valid[where f=\"ct_active\" and g=\"cur_thread\"])\n apply (wp | simp)+\n apply(wp thread_set_tcb_context_update_wp)+\n apply(clarsimp simp: schact_is_rct_def)\n apply(rule conjI)\n apply(erule integrity_update_reference_state[where blah=\"the (kheap st (cur_thread st))\",\n OF _ integrity_refl])\n apply simp\n apply(subgoal_tac \"kheap st (cur_thread st) \\ None\")\n apply clarsimp\n apply(drule tcb_at_invs, clarsimp simp: tcb_at_def get_tcb_def\n split: kernel_object.splits option.splits)\n apply(rule conjI)\n apply assumption\n apply(rule state.equality, simp_all)\n apply(rule ext, simp_all)\n done\n\nlemma dmo_device_update_respects_Write:\n \"\\integrity aag X st and K (\\p \\ dom um'. aag_has_auth_to aag Write p)\\\n do_machine_op (device_memory_update um')\n \\\\a. integrity aag X st\\\"\n apply (simp add: device_memory_update_def)\n apply (rule hoare_pre)\n apply (wp dmo_wp)\n apply clarsimp\n apply (simp cong: abstract_state.fold_congs)\n apply (rule integrity_device_state_update)\n apply simp\n apply clarify\n apply (drule(1) bspec)\n apply simp\n apply fastforce\n done\n\n(* clagged straight from ADT_AC.do_user_op_respects *)\nlemma do_user_op_if_integrity:\n \"\\ invs and integrity aag X st and is_subject aag \\ cur_thread and pas_refined aag \\\n do_user_op_if uop tc\n \\\\rv. integrity aag X st\\\"\n apply (simp add: do_user_op_if_def)\n apply (wp dmo_user_memory_update_respects_Write dmo_device_update_respects_Write\n hoare_vcg_all_lift hoare_vcg_imp_lift\n | wpc | clarsimp)+\n apply (rule hoare_pre_cont)\n apply (wp select_wp | wpc | clarsimp)+\n apply (rule conjI)\n apply clarsimp\n apply (simp add: restrict_map_def ptable_lift_s_def ptable_rights_s_def split: if_splits)\n apply (drule_tac auth=Write in user_op_access')\n apply (simp add: vspace_cap_rights_to_auth_def)+\n apply clarsimp\n apply (simp add: restrict_map_def ptable_lift_s_def ptable_rights_s_def split: if_splits)\n apply (drule_tac auth=Write in user_op_access')\n apply (simp add: vspace_cap_rights_to_auth_def)+\n done\n\nlemma check_active_irq_if_integrity:\n \"\\ integrity aag X st \\\n check_active_irq_if tc\n \\\\rv. integrity aag X st\\\"\n apply(wp check_active_irq_if_wp)\n apply(simp add: integrity_subjects_def)\n done\n\n\nlemma silc_dom_equiv_from_silc_inv_valid':\n assumes \"\\ st. \\P and silc_inv aag st\\ f \\\\_. silc_inv aag st\\\"\n shows \"\\P and silc_inv aag st and silc_dom_equiv aag sta\\ f \\\\_. silc_dom_equiv aag sta\\\"\n apply (rule hoare_pre)\n apply (rule hoare_strengthen_post)\n apply (rule assms)\n apply (fastforce simp: silc_inv_def)\n (* we can't use clarsimp below because it splits pairs unconditionally *)\n apply (simp add: silc_inv_def silc_dom_equiv_def del: split_paired_All)\n apply (elim conjE)\n apply (intro allI impI notI)\n apply (drule(1) equiv_forD)+\n apply (frule(1) cte_wp_at_pspace'[THEN iffD1])\n apply (drule spec, drule(1) mp, erule notE, erule(1) cte_wp_at_pspace'[THEN iffD2])\n done\n\nlemma ct_running_not_idle: \"ct_running s \\ valid_idle s \\ cur_thread s \\ idle_thread s\"\n by (clarsimp simp add: ct_in_state_def pred_tcb_at_def obj_at_def valid_idle_def)\n\nlemma kernel_entry_if_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and\n (valid_ko_at_arm and invs and (\\s. param_a \\ Interrupt \\ ct_active s)\n and (\\s. ct_idle s \\ param_b = idle_context s))\\\n kernel_entry_if param_a param_b\n \\\\_. globals_equiv_scheduler st\\\"\n apply(wp globals_equiv_scheduler_inv' kernel_entry_if_globals_equiv)\n apply(clarsimp)\n apply assumption\n apply clarsimp\n done\n\nlemma domain_fields_equiv_lift:\n assumes a: \"\\P. \\domain_fields P and Q\\ f \\\\_. domain_fields P\\\"\n assumes b: \"\\P. \\(\\s. P (cur_domain s)) and R\\ f \\\\_ s. P (cur_domain s)\\\"\n shows \"\\domain_fields_equiv st and Q and R\\ f \\\\_. domain_fields_equiv st\\\"\n apply(clarsimp simp: valid_def domain_fields_equiv_def)\n apply(erule use_valid, wp a b)\n apply simp\n done\n\nlemma kernel_entry_if_partitionIntegrity:\n \"\\silc_inv aag st and pas_refined aag and einvs and schact_is_rct and\n is_subject aag \\ cur_thread and domain_sep_inv (pasMaySendIrqs aag) st' and\n guarded_pas_domain aag and (\\s. ev \\ Interrupt \\ ct_active s) and (=) st\\\n kernel_entry_if ev tc\n \\\\ rv. partitionIntegrity aag st\\\"\n apply(rule_tac Q=\"\\rv s. (\\ X. integrity (aag\\ pasMayActivate := False,\n pasMayEditReadyQueues := False \\) X st s) \\\n domain_fields_equiv st s \\\n globals_equiv_scheduler st s \\\n idle_thread s = idle_thread st \\\n silc_dom_equiv aag st s\" in hoare_strengthen_post)\n apply(wp hoare_vcg_conj_lift)\n apply(rule hoare_vcg_all_lift[OF kernel_entry_if_integrity[where st'=st']])\n apply(wp kernel_entry_if_cur_thread kernel_entry_if_globals_equiv_scheduler\n kernel_entry_if_cur_domain domain_fields_equiv_lift[where R=\"\\\"]\n kernel_entry_if_domain_fields\n | simp)+\n apply(rule_tac P=\"pas_refined aag and einvs and schact_is_rct and\n is_subject aag \\ cur_thread and domain_sep_inv (pasMaySendIrqs aag) st' and\n (\\ s. ev \\ Interrupt \\ ct_active s)\"\n in silc_dom_equiv_from_silc_inv_valid')\n apply(wp kernel_entry_silc_inv[where st'=st'], simp add: schact_is_rct_simple)\n apply(fastforce simp: pas_refined_pasMayActivate_update pas_refined_pasMayEditReadyQueues_update\n globals_equiv_scheduler_refl silc_dom_equiv_def equiv_for_refl\n invs_valid_ko_at_arm domain_fields_equiv_def ct_active_not_idle')\n apply(fastforce simp: partitionIntegrity_def)\n done\n\nlemma check_active_irq_if_partitionIntegrity:\n \"\\partitionIntegrity aag st\\\n check_active_irq_if tc \\\\ rv. partitionIntegrity aag st\\\"\n apply(simp add: check_active_irq_if_def)\n apply(wp dmo_getActiveIRQ_wp)\n apply(simp add: partitionIntegrity_def integrity_subjects_def)\n apply(simp add: silc_dom_equiv_def equiv_for_def globals_equiv_scheduler_def)\n apply(fastforce simp: domain_fields_equiv_def)\n done\n\n\nlemma do_machine_op_globals_equiv_scheduler:\n \"(\\ s sa. \\P sa; globals_equiv_scheduler s sa\\ \\\n \\x\\fst (f (machine_state sa)).\n globals_equiv_scheduler s (sa\\machine_state := snd x\\)) \\\n \\ globals_equiv_scheduler s and P \\\n do_machine_op f\n \\ \\_. globals_equiv_scheduler s \\\"\n unfolding do_machine_op_def\n apply (wp | simp add: split_def)+\n done\n\nlemma dmo_user_memory_update_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and (invs and (\\s. pl = ptable_lift t s |` {x. pr x \\ {}} \\\n pr = ptable_rights t s))\\\n do_machine_op\n (user_memory_update\n ((ba |`\n {y. \\x. pl x = Some y \\\n AllowWrite \\ pr x} \\\n addrFromPPtr) |` S))\n \\\\y. globals_equiv_scheduler st\\\"\n apply(rule do_machine_op_globals_equiv_scheduler)\n apply clarsimp\n apply(erule use_valid)\n apply(simp add: user_memory_update_def)\n apply(wp modify_wp)\n apply(clarsimp simp: globals_equiv_scheduler_def split: option.splits)\n done\n\nlemma dmo_device_memory_update_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and (\\s. device_region s = S)\\\n do_machine_op\n (device_memory_update\n ((ba |`\n {y. \\x. pl x = Some y \\\n AllowWrite \\ pr x} \\\n addrFromPPtr) |` S))\n \\\\y. globals_equiv_scheduler st\\\"\n apply(rule do_machine_op_globals_equiv_scheduler)\n apply clarsimp\n apply(simp add: device_memory_update_def simpler_modify_def)\n apply(clarsimp simp: globals_equiv_scheduler_def split: option.splits)\n apply blast\n done\n\n\nlemma globals_equiv_scheduler_exclusive_state_update[simp]:\n \"globals_equiv_scheduler st (s\\machine_state := machine_state s\\exclusive_state := es\\\\) =\n globals_equiv_scheduler st s\"\n by (simp add: globals_equiv_scheduler_def)\n\nlemma do_user_op_if_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and invs\\\n do_user_op_if tc uop\n \\\\_. globals_equiv_scheduler st\\\"\n apply(simp add: do_user_op_if_def)\n apply (wp dmo_user_memory_update_globals_equiv_scheduler\n dmo_device_memory_update_globals_equiv_scheduler select_wp | wpc | simp)+\n apply (auto simp: ptable_lift_s_def ptable_rights_s_def)\n done\n\nlemma silc_dom_equiv_exclusive_state_update[simp]:\n \"silc_dom_equiv aag st (s\\machine_state := machine_state s\\exclusive_state := es\\\\) =\n silc_dom_equiv aag st s\"\n by (simp add: silc_dom_equiv_def equiv_for_def)\n\ncrunch silc_dom_equiv[wp]: do_user_op_if \"silc_dom_equiv aag st\"\n (ignore: do_machine_op user_memory_update wp: crunch_wps select_wp)\n\nlemma pas_refined_pasMayActivate_update[simp]:\n \"pas_refined (aag\\pasMayActivate := x, pasMayEditReadyQueues := x\\) s = pas_refined aag s\"\n apply(simp add: pas_refined_def irq_map_wellformed_aux_def tcb_domain_map_wellformed_aux_def)\n apply(simp add: state_asids_to_policy_pasMayActivate_update\n state_irqs_to_policy_pasMayActivate_update\n state_asids_to_policy_pasMayEditReadyQueues_update\n state_irqs_to_policy_pasMayEditReadyQueues_update)\n done\n\n\nlemma do_user_op_if_partitionIntegrity:\n \"\\partitionIntegrity aag st and pas_refined aag and invs and is_subject aag \\ cur_thread\\\n do_user_op_if tc uop\n \\\\ rv. partitionIntegrity aag st\\\"\n apply(rule_tac Q=\"\\rv s. integrity (aag\\ pasMayActivate := False, pasMayEditReadyQueues := False \\)\n (scheduler_affects_globals_frame st) st s \\\n domain_fields_equiv st s \\ idle_thread s = idle_thread st \\\n globals_equiv_scheduler st s \\ silc_dom_equiv aag st s\"\n in hoare_strengthen_post)\n apply(wp hoare_vcg_conj_lift do_user_op_if_integrity do_user_op_if_globals_equiv_scheduler\n hoare_vcg_all_lift domain_fields_equiv_lift[where Q=\"\\\" and R=\"\\\"]\n | simp)+\n apply(clarsimp simp: partitionIntegrity_def)+\n done\n\n\nlemma activate_thread_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and valid_ko_at_arm and valid_idle\\\n activate_thread\n \\\\_. globals_equiv_scheduler st\\\"\n apply(wp globals_equiv_scheduler_inv' activate_thread_globals_equiv | force | fastforce)+\n done\n\nlemma schedule_cur_domain:\n \"\\\\s. P (cur_domain s) \\ domain_time s \\ 0\\\n schedule\n \\\\ r s. P (cur_domain s)\\\" (is \"\\?PRE\\ _ \\_\\\")\n supply ethread_get_wp[wp del] hoare_pre_cont[where a=next_domain, wp add]\n supply if_split[split del]\n apply (simp add: schedule_def schedule_choose_new_thread_def | wp | wpc)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (clarsimp split: if_split)\n done\n\nlemma schedule_domain_fields:\n \"\\domain_fields P and (\\s. domain_time s \\ 0)\\\n schedule\n \\\\ r. domain_fields P\\\" (is \"\\?PRE\\ _ \\_\\\")\n supply ethread_get_wp[wp del] hoare_pre_cont[where a=next_domain, wp add]\n supply if_split[split del]\n apply (simp add: schedule_def schedule_choose_new_thread_def | wp | wpc)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (clarsimp split: if_split)\n done\n\nlemma schedule_if_partitionIntegrity:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"\\partitionIntegrity aag st and guarded_pas_domain aag and pas_cur_domain aag and\n (\\s. domain_time s \\ 0) and silc_inv aag st and einvs and pas_refined aag\\\n schedule_if tc\n \\\\ rv. partitionIntegrity aag st\\\"\n apply(simp add: schedule_if_def)\n apply(rule_tac Q=\"\\rv s. integrity (aag\\ pasMayActivate := False, pasMayEditReadyQueues := False \\)\n (scheduler_affects_globals_frame st) st s \\\n domain_fields_equiv st s \\ idle_thread s = idle_thread st \\\n globals_equiv_scheduler st s \\ silc_dom_equiv aag st s\"\n in hoare_strengthen_post)\n apply (wp activate_thread_integrity activate_thread_globals_equiv_scheduler\n silc_dom_equiv_from_silc_inv_valid'[where P=\"\\\"] schedule_integrity\n hoare_vcg_all_lift domain_fields_equiv_lift[where Q=\"\\\" and R=\"\\\"]\n | simp)+\n apply(rule_tac Q=\"\\ r s. guarded_pas_domain aag s \\ pas_cur_domain aag s \\\n domain_fields_equiv st s \\\n idle_thread s = idle_thread st \\\n globals_equiv_scheduler st s \\\n silc_inv aag st s \\ silc_dom_equiv aag st s \\\n invs s\" in hoare_strengthen_post)\n apply (wp schedule_guarded_pas_domain schedule_cur_domain\n silc_dom_equiv_from_silc_inv_valid'[where P=\"\\\" and st=st]\n domain_fields_equiv_lift schedule_cur_domain schedule_domain_fields\n | simp\n | simp add: silc_inv_def partitionIntegrity_def guarded_pas_domain_def\n invs_valid_idle invs_valid_ko_at_arm silc_dom_equiv_def)+\n apply(fastforce simp: equiv_for_refl dest: domains_distinct[THEN pas_domains_distinct_inj])\n apply(fastforce simp: partitionIntegrity_def globals_equiv_scheduler_def)+\n done\n\n\nlemma partitionIntegrity_integrity:\n \"partitionIntegrity aag s s' \\\n integrity (aag\\ pasMayActivate := False, pasMayEditReadyQueues := False \\)\n (scheduler_affects_globals_frame s) s s'\"\n by (clarsimp simp: partitionIntegrity_def)\n\nlemma receive_blocked_on_eq:\n \"\\receive_blocked_on ep ts; receive_blocked_on ep' ts\\ \\\n ep = ep'\"\n by (case_tac ts; simp)\n\nlemma receive_blocked_on_eq':\n \"\\receive_blocked_on ep ts; blocked_on ep' ts\\ \\\n ep = ep'\"\n by (case_tac ts; simp)\n\nlemma receive_blocked_on_contradiction:\n \"\\receive_blocked_on ep ts; send_blocked_on ep' ts\\ \\\n False\"\n by (case_tac ts; simp)\n\nlemma pas_refined_tcb_st_to_auth:\n \"\\pas_refined aag s; (ep, auth) \\ tcb_st_to_auth (tcb_state tcb);\n kheap s p = Some (TCB tcb)\\ \\\n (pasObjectAbs aag p, auth, pasObjectAbs aag ep) \\ pasPolicy aag\"\n apply (rule pas_refined_mem)\n apply (rule_tac s=s in sta_ts)\n apply (simp add: thread_states_def tcb_states_of_state_def get_tcb_def)\n apply assumption\n done\n\n\n\n\n(* FIXME DO _state abreviation for all elements and use them to write rule explicitely *)\nlemmas integrity_subjects_obj =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct1]\n\nlemmas integrity_subjects_eobj =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_mem =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_device =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_cdt =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_cdt_list =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_interrupts =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_asids =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_ready_queues =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2]\n\nlemma pas_wellformed_pasSubject_update_Control:\n \"\\ pas_wellformed (aag\\pasSubject := pasObjectAbs aag p\\);\n (pasObjectAbs aag p, Control, pasObjectAbs aag p') \\ pasPolicy aag \\ \\\n pasObjectAbs aag p = pasObjectAbs aag p'\"\n apply(fastforce simp: policy_wellformed_def)\n done\n\nlemma pas_wellformed_noninterference_policy_refl:\n \"\\ pas_wellformed_noninterference aag; pasObjectAbs aag x \\ SilcLabel \\ \\\n (pasObjectAbs aag x, auth, pasObjectAbs aag x) \\ pasPolicy aag\"\n unfolding pas_wellformed_noninterference_def\n by (fastforce intro!:aag_wellformed_refl)\n\nlemma pas_wellformed_noninterference_control_to_eq:\n \"\\ pas_wellformed_noninterference aag;\n (pasObjectAbs aag x, Control, l) \\ pasPolicy aag;\n pasObjectAbs aag x \\ SilcLabel \\ \\\n pasObjectAbs aag x = l\"\n unfolding pas_wellformed_noninterference_def\n by (erule aag_wellformed_Control; fastforce)\n\nlemma owns_mapping_owns_asidpool:\n \"\\kheap s p = Some (ArchObj (ASIDPool pool)); pool r = Some p';\n pas_refined aag s; is_subject aag p';\n pas_wellformed (aag\\ pasSubject := (pasObjectAbs aag p) \\)\\ \\\n is_subject aag p\"\n apply(frule asid_pool_into_aag)\n apply assumption+\n apply(drule pas_wellformed_pasSubject_update_Control)\n apply assumption\n apply simp\n done\n\n(* FIXME: MOVE *)\nlemma fun_noteqD:\n \"f \\ g \\ \\ a. f a \\ g a\"\n by blast\n\ntext \\\n This a very important theorem that ensures that @{const subjectAffects} is\n coherent with @{const integrity_obj}\n\\\nlemma partitionIntegrity_subjectAffects_obj:\n assumes par_inte: \"partitionIntegrity aag s s'\"\n assumes pas_ref: \"pas_refined aag s\"\n assumes invs: \"invs s\"\n assumes pwni: \"pas_wellformed_noninterference aag\"\n assumes silc_inv: \"silc_inv aag st s\"\n assumes kh_diff: \"kheap s x \\ kheap s' x\"\n notes inte_obj = par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_obj,\n THEN spec[where x=x], simplified integrity_obj_def, simplified]\n shows\n \"pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n using inte_obj\n proof (induct \"kheap s x\" rule: converse_rtranclp_induct)\n case base\n thus ?case using kh_diff by force\n next\n case (step z)\n note troa = step.hyps(1)\n show ?case\n proof (cases \"z = kheap s x\")\n case True\n thus ?thesis using step.hyps by blast\n next\n case False\n note hyps = this pwni pas_ref invs silc_inv kh_diff\n hence sym_helper: \"\\ auth tcb. kheap s x = Some (TCB tcb) \\\n (pasObjectAbs aag x, auth, pasObjectAbs aag x) \\ pasPolicy aag\"\n by (fastforce elim!: pas_wellformed_noninterference_policy_refl\n silc_inv_cnode_onlyE obj_atE\n simp: is_cap_table_def)\n show ?thesis\n using troa\n proof (cases rule: integrity_obj_atomic.cases)\n case troa_lrefl\n thus ?thesis by (fastforce intro: subjectAffects.intros)\n next\n case (troa_ntfn ntfn ntfn' auth s)\n thus ?thesis by (fastforce intro: affects_ep)\n next\n case (troa_ep ep ep' auth s)\n thus ?thesis by (fastforce intro: affects_ep)\n next\n case (troa_ep_unblock ep ep' tcb ntfn)\n thus ?thesis by (fastforce intro: affects_ep_bound_trans)\n next\n case (troa_tcb_send tcb tcb' ctxt' ep)\n thus ?thesis using hyps\n apply (clarsimp simp: direct_send_def indirect_send_def)\n apply (erule disjE)\n apply (clarsimp simp: receive_blocked_on_def2)\n apply (frule(2) pas_refined_tcb_st_to_auth)\n apply (fastforce intro!: affects_send sym_helper)\n apply (fastforce intro!: affects_send bound_tcb_at_implies_receive\n pred_tcb_atI sym_helper)\n done\n next\n case (troa_tcb_call tcb tcb' caller R ctxt' ep)\n thus ?thesis using hyps\n apply (clarsimp simp add: direct_call_def ep_recv_blocked_def)\n apply (rule affects_send[rotated 2])\n apply (erule(1) pas_refined_tcb_st_to_auth[rotated 2]; force)\n apply (fastforce intro: sym_helper)\n apply assumption\n apply blast\n done\n next\n case (troa_tcb_reply tcb tcb' new_st ctxt')\n thus ?thesis using hyps\n apply clarsimp\n apply (erule affects_reply)\n by (rule sym_helper)\n next\n case (troa_tcb_receive tcb tcb' new_st ep)\n thus ?thesis using hyps\n by (auto intro: affects_recv pas_refined_tcb_st_to_auth simp: send_blocked_on_def2)\n next\n case (troa_tcb_restart tcb tcb' ep)\n thus ?thesis using hyps\n by (fastforce intro: affects_reset[where auth=Receive] affects_reset[where auth=SyncSend]\n elim: blocked_on.elims pas_refined_tcb_st_to_auth[rotated 2]\n intro!: sym_helper)\n next\n case (troa_tcb_unbind tcb tcb')\n thus ?thesis using hyps\n apply -\n by (cases \"tcb_bound_notification tcb\" ;\n fastforce intro: affects_reset[where auth=Receive] bound_tcb_at_implies_receive\n pred_tcb_atI sym_helper)\n next\n case (troa_tcb_empty_ctable tcb tcb' cap')\n thus ?thesis using hyps\n apply (clarsimp simp:reply_cap_deletion_integrity_def; elim disjE; clarsimp)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule cap_auth_caps_of_state[rotated,where p =\"(x,tcb_cnode_index 0)\"],\n force simp: caps_of_state_def')\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def\n reply_cap_rights_to_auth_def\n split: if_splits)\n next\n case (troa_tcb_empty_caller tcb tcb' cap')\n thus ?thesis using hyps\n apply (clarsimp simp:reply_cap_deletion_integrity_def)\n apply (elim disjE; clarsimp)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule cap_auth_caps_of_state[rotated,where p =\"(x,tcb_cnode_index 3)\"],\n force simp: caps_of_state_def')\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def\n reply_cap_rights_to_auth_def\n split: if_splits)\n next\n case (troa_tcb_activate tcb tcb')\n thus ?thesis by blast\n next\n case (troa_asidpool_clear pool pool')\n thus ?thesis (* TODO cleanup that one *)\n using hyps unfolding asid_pool_integrity_def\n apply clarsimp\n apply (drule fun_noteqD)\n apply (erule exE, rename_tac r)\n apply (drule_tac x=r in spec)\n apply (clarsimp dest!:not_sym[where t=None])\n apply (subgoal_tac \"is_subject aag x\", force intro:affects_lrefl)\n apply (frule(1) aag_Control_into_owns)\n apply (frule(2) asid_pool_into_aag)\n apply simp\n apply (frule(1) pas_wellformed_noninterference_control_to_eq)\n by (fastforce elim!: silc_inv_cnode_onlyE obj_atE\n simp: is_cap_table_def)\n next\n case (troa_cnode n content content')\n thus ?thesis\n using hyps unfolding cnode_integrity_def\n apply clarsimp\n apply (drule fun_noteqD)\n apply (erule exE, rename_tac l)\n apply (drule_tac x=l in spec)\n apply (clarsimp dest!:not_sym[where t=None])\n apply (clarsimp simp:reply_cap_deletion_integrity_def)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule_tac p=\"(x,l)\" in cap_auth_caps_of_state[rotated])\n apply (force simp: caps_of_state_def' intro:well_formed_cnode_invsI)\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def\n reply_cap_rights_to_auth_def\n split: if_splits)\n qed\n qed\n qed\n\nlemma kheap_ep_tcb_states_of_state_eq:\n \"kheap s x = kheap s' x \\ tcb_states_of_state s x = tcb_states_of_state s' x\"\n unfolding tcb_states_of_state_def get_tcb_def by simp\n\nlemma partitionIntegrity_subjectAffects_mem:\n assumes par_inte: \"partitionIntegrity aag s s'\"\n assumes pas_ref: \"pas_refined aag s\"\n assumes invs: \"invs s\"\n assumes um_diff:\n \"underlying_memory (machine_state s) x \\ underlying_memory (machine_state s') x\"\n notes inte_mem = par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_mem, THEN spec[where x=x]]\n shows\n \"pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n using inte_mem\n proof (cases rule: integrity_mem.cases)\n case trm_lrefl\n thus ?thesis by(fastforce intro: affects_lrefl)\n next\n case trm_orefl\n thus ?thesis using um_diff by blast\n next\n case trm_write\n thus ?thesis by (fastforce intro: affects_write)\n next\n case trm_globals\n thus ?thesis by blast\n next\n case (trm_ipc p) note trm_ipc_hyps = this\n then obtain tcbst where \"tcb_states_of_state s p = Some tcbst\" \"can_receive_ipc tcbst\"\n by (force split:option.splits)\n note hyps = this trm_ipc_hyps(2-)[simplified] pas_ref invs um_diff\n from par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_obj,\n THEN spec[where x=p], THEN tro_tro_alt]\n show ?thesis\n proof (cases rule: integrity_obj_alt.cases)\n case (tro_alt_tcb_send tcb tcb' ccap' cap' ntfn' ep)\n thus ?thesis using hyps\n apply (clarsimp simp: direct_send_def indirect_send_def)\n apply (erule disjE)\n apply (clarsimp simp: receive_blocked_on_def2)\n apply (frule(2) pas_refined_tcb_st_to_auth)\n apply (fastforce intro!: affects_send auth_ipc_buffers_mem_Write')\n apply clarsimp\n apply (rule affects_send[rotated 2])\n apply (fastforce intro!: affects_send bound_tcb_at_implies_receive pred_tcb_atI\n dest: sym)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n apply assumption\n apply blast\n done\n next\n case (tro_alt_tcb_call tcb tcb' ccap' cap' ntfn' caller R ep)\n thus ?thesis using hyps\n apply (clarsimp simp add: direct_call_def ep_recv_blocked_def)\n apply (rule affects_send[rotated 2])\n apply (erule(1) pas_refined_tcb_st_to_auth[rotated 2]; force)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n apply assumption\n apply blast\n done\n next\n case (tro_alt_tcb_reply tcb tcb' ccap' cap' ntfn' new_st)\n thus ?thesis using hyps\n apply (clarsimp simp:direct_reply_def)\n apply (erule affects_reply)\n by (force intro: auth_ipc_buffers_mem_Write')\n next\n case (tro_alt_tcb_receive tcb tcb' ccap' cap' ntfn' new_st ep)\n thus ?thesis using hyps\n apply (clarsimp elim!: tcb_states_of_state_kheapE send_blocked_on.elims\n can_receive_ipc.elims)\n apply (frule(1) pas_refined_tcb_st_to_auth[rotated 2,where auth=Call and ep =ep])\n apply force\n apply (rule affects_reply)\n apply (erule(1) aag_wellformed_reply, force)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n done\n next\n case (tro_alt_tcb_restart tcb tcb' ccap' cap' ntfn' ep)\n thus ?thesis using hyps\n by (fastforce intro: affects_reset[where auth=Receive] affects_reset[where auth=SyncSend]\n elim: blocked_on.elims pas_refined_tcb_st_to_auth[rotated 2]\n intro!: auth_ipc_buffers_mem_Write')\n qed (insert hyps, force elim:tcb_states_of_state_kheapE)+\n qed\n\nlemma blocked_onD:\n \"blocked_on ref ts \\ receive_blocked_on ref ts \\ send_blocked_on ref ts\"\n apply(case_tac ts)\n apply(simp_all)\n done\n\n(* FIXME: cleanup *)\nlemma partitionIntegrity_subjectAffects_cdt:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_mdb s; valid_objs s;\n cdt s (x,y) \\ cdt s' (x,y)\\ \\\n pasObjectAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(drule integrity_subjects_cdt)\n apply(drule_tac x=\"(x,y)\" in spec)\n apply(clarsimp simp: integrity_cdt_def)\n apply (rule affects_delete_derived)\n apply (frule(3) cdt_change_allowed_delete_derived)\n by simp\n\nlemma partitionIntegrity_subjectAffects_cdt_list:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; pas_refined aag s';\n valid_list s; valid_list s'; silc_inv aag st s; silc_inv aag st' s';\n pas_wellformed_noninterference aag;\n invs s; invs s';\n cdt_list s (x,y) \\ cdt_list s' (x,y)\\ \\\n pasObjectAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(drule integrity_subjects_cdt_list)\n apply (simp add: integrity_cdt_list_def)\n apply (drule_tac x=\"x\" in spec)\n apply (drule_tac x=\"y\" in spec)\n apply (elim disjE)\n apply (drule(1) neq_filtered_ex)\n apply (elim bexE)\n apply (case_tac \"pasObjectAbs aag x = SilcLabel\")\n apply (subgoal_tac \"pasObjectAbs aag (fst xa) = SilcLabel\")\n apply simp\n apply (rule affects_delete_derived)\n apply (frule(3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n apply force\n subgoal by (fastforce simp add: silc_inv_def valid_list_2_def all_children_def\n simp del: split_paired_All)\n apply (rule affects_delete_derived2)\n apply (frule(3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n apply assumption\n subgoal by (fastforce dest!: aag_cdt_link_DeleteDerived\n simp add: valid_list_2_def\n simp del: split_paired_All)\n apply (rule affects_delete_derived)\n apply (frule(3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n by simp\n\nlemma partitionIntegrity_subjectAffects_is_original_cap:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_mdb s; valid_objs s;\n is_original_cap s (x,y) \\ is_original_cap s' (x,y)\\ \\\n pasObjectAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_cdt)\n apply (drule_tac x=\"(x,y)\" in spec)\n apply (clarsimp simp: integrity_cdt_def)\n apply (rule affects_delete_derived)\n apply (frule(3) cdt_change_allowed_delete_derived)\n by simp\n\nlemma partitionIntegrity_subjectAffects_interrupt_states:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_objs s;\n interrupt_states s x \\ interrupt_states s' x\\ \\\n pasIRQAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(drule integrity_subjects_interrupts)\n apply(drule_tac x=x in spec)\n apply(clarsimp simp: integrity_interrupts_def)\n apply(rule affects_lrefl)\n done\n\nlemma partitionIntegrity_subjectAffects_interrupt_irq_node:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_objs s;\n interrupt_irq_node s x \\ interrupt_irq_node s' x\\ \\\n pasIRQAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(drule integrity_subjects_interrupts)\n apply(drule_tac x=x in spec)\n apply(clarsimp simp: integrity_interrupts_def)\n apply(rule affects_lrefl)\n done\n\n\nlemma pas_wellformed_pasSubject_update:\n \"\\pas_wellformed_noninterference aag; silc_inv aag st s; invs s;\n (kheap s x = Some (TCB t) \\ kheap s x = Some (ArchObj (ASIDPool a)))\\ \\\n pas_wellformed (aag\\pasSubject := pasObjectAbs aag x\\)\"\n apply(simp add: pas_wellformed_noninterference_def)\n apply(elim conjE)\n apply(erule bspec)\n apply(clarsimp simp: silc_inv_def obj_at_def split: kernel_object.splits)\n apply(drule spec, erule (1) impE)\n apply(fastforce simp: is_cap_table_def)\n done\n\nlemma partitionIntegrity_subjectAffects_eobj:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_objs s;\n einvs s; einvs s';\n pas_wellformed_noninterference aag; silc_inv aag st s;\n silc_inv aag st' s';\n ekheap s x \\ ekheap s' x\\ \\\n pasObjectAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(drule integrity_subjects_eobj)\n apply (drule_tac x=x in spec)\n apply (erule integrity_eobj.cases)\n apply simp\n apply (rule subjectAffects.affects_lrefl)\n apply simp\n done\n\n(*FIXME: Move*)\nlemma prefix_helper:\n \"\\a @ l = l'; distinct l; distinct l'\\ \\ set a \\ set l = {} \\ set a \\ set l'\"\n apply (induct l)\n apply simp+\n by (metis append_Cons disjoint_iff_not_equal distinct.simps(2) distinct_append\n distinct_length_2_or_more subset_code(1))\n\n(*FIXME: Move*)\nlemma valid_queuesE: \"valid_queues s \\ t \\ set (ready_queues s d p) \\\n (\\is_etcb_at t s; etcb_at (\\t. tcb_priority t = p \\ tcb_domain t = d) t s;\n st_tcb_at runnable t s; distinct (ready_queues s d p)\\ \\ R) \\ R\"\n by (clarsimp simp: valid_queues_def)\n\n\nlemma valid_blocked_imp: \"valid_blocked s \\ tcb_at t s \\ not_queued t s \\\n t \\ cur_thread s \\ scheduler_action s \\ switch_thread t \\\n st_tcb_at (\\s. \\ runnable s) t s\"\n apply (fastforce simp: valid_blocked_def st_tcb_at_def\n tcb_at_st_tcb_at runnable_eq_active\n obj_at_def)\n done\n\nlemma valid_queues_not_in_place:\n \"\\valid_queues s; t \\ set (ready_queues s d a);\n etcb_at (\\t. tcb_priority t = a \\ tcb_domain t = d) t s; is_etcb_at t s\\\n \\ not_queued t s\"\n by (clarsimp simp: valid_queues_def not_queued_def etcb_at_def\n is_etcb_at_def\n split: option.splits)\n\nlemma ready_queues_alters_kheap:\n assumes a: \"valid_queues s\"\n assumes b: \"valid_blocked s\"\n assumes c: \"valid_idle s'\"\n shows\n \"\\ready_queues s d a \\ ready_queues s' d a;\n threads @ ready_queues s d a = ready_queues s' d a;\n valid_queues s'; valid_etcbs s; valid_etcbs s';\n t \\ set threads; ekheap s t = ekheap s' t;\n (t \\ idle_thread s \\ (t \\ cur_thread s \\ t \\ cur_thread s'));\n scheduler_action s \\ switch_thread t; idle_thread s = idle_thread s'\\\n \\ kheap s t \\ kheap s' t\"\n apply (frule prefix_helper)\n using a\n apply ((simp add: valid_queues_def)+)[2]\n apply clarsimp\n apply (drule(1) set_mp)\n apply (drule(1) orthD1)\n apply (erule(1) valid_queuesE)\n apply (subgoal_tac \"tcb_at t s\")\n apply (frule valid_blocked_imp[OF b])\n apply (rule valid_queues_not_in_place[OF a],assumption)\n apply (simp add: etcb_at_def)\n apply (simp add: is_etcb_at_def)\n using c\n apply (clarsimp simp: pred_tcb_at_def tcb_at_st_tcb_at\n obj_at_def valid_idle_def)+\n done\n\nlemma valid_sched_valid_blocked: \"valid_sched s \\ valid_blocked s\"\n by (simp add: valid_sched_def)\n\nlemma partitionIntegrity_subjectAffects_ready_queues:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_objs s;\n einvs s; einvs s'; pas_refined aag s'; pas_cur_domain aag s;\n pas_wellformed_noninterference aag; silc_inv aag st s;\n silc_inv aag st' s'; cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s);\n cur_thread s' \\ idle_thread s' \\ is_subject aag (cur_thread s');\n ready_queues s d \\ ready_queues s' d\\ \\\n pasDomainAbs aag d \\ subjectAffects (pasPolicy aag) (pasSubject aag) \\ {}\"\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply (frule valid_sched_valid_blocked[where s=s])\n apply (case_tac \"pasSubject aag \\ pasDomainAbs aag d\")\n apply (metis affects_lrefl)\n apply (drule fun_noteqD,clarsimp)\n apply (clarsimp simp add: partitionIntegrity_def)\n apply (frule_tac d=d and p=a in integrity_subjects_ready_queues[rule_format])\n apply (clarsimp simp: integrity_ready_queues_def)\n apply (case_tac \"threads = []\")\n apply simp\n apply (erule not_NilE)\n apply (frule_tac x=x and d=d and p=a and s=s' in tcb_with_domain_at[OF valid_sched_valid_queues])\n apply (drule_tac t=\"ready_queues s' d a\" in sym)\n apply simp\n apply clarsimp\n apply (frule(1) tcb_domain_wellformed)\n apply (rename_tac tcb_ptr tcbs tcb)\n apply (rule_tac x = \"pasObjectAbs aag tcb_ptr\" in bexI)\n apply (case_tac \"scheduler_action s = switch_thread tcb_ptr\")\n apply (drule switch_within_domain)\n apply simp\n apply simp\n apply (fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n\n apply (case_tac \"ekheap s tcb_ptr \\ ekheap s' tcb_ptr\")\n apply (rule_tac s=s and s'=s' in partitionIntegrity_subjectAffects_eobj)\n apply (simp add: partitionIntegrity_def)+\n apply (subgoal_tac \"kheap s tcb_ptr \\ kheap s' tcb_ptr\")\n apply (rule partitionIntegrity_subjectAffects_obj)\n apply (fastforce simp add: partitionIntegrity_def valid_sched_def)+\n apply (rule_tac threads=\"tcb_ptr # tcbs\" in ready_queues_alters_kheap)\n apply (fastforce simp add: partitionIntegrity_def valid_sched_def)+\n done\n\nlemma partitionIntegrity_subjectAffects_asid:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_objs s; valid_arch_state s;\n valid_arch_state s';\n pas_wellformed_noninterference aag; silc_inv aag st s'; invs s';\n \\ equiv_asids (\\x. pasASIDAbs aag x = a) s s'\\ \\\n a \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (clarsimp simp: equiv_asids_def equiv_asid_def asid_pool_at_kheap)\n apply (case_tac \"arm_asid_table (arch_state s) (asid_high_bits_of asid) =\n arm_asid_table (arch_state s') (asid_high_bits_of asid)\")\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (drule_tac x=pool_ptr in bspec)\n apply blast\n apply (drule_tac x=pool_ptr in bspec)\n apply blast\n apply (clarsimp simp: asid_pool_at_kheap)\n apply (rule affects_asidpool_map)\n apply (rule pas_refined_asid_mem)\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_obj)\n apply (drule_tac x=\"pool_ptr\" in spec)+\n apply (drule tro_tro_alt, erule integrity_obj_alt.cases;simp )\n apply (drule_tac t=\"pasSubject aag\" in sym)\n apply simp\n apply (rule sata_asidpool)\n apply assumption\n apply assumption\n apply (simp add: asid_pool_integrity_def)\n apply (drule_tac x=\"ucast asid\" in spec)+\n apply clarsimp\n apply (drule owns_mapping_owns_asidpool)\n apply ((simp\n | blast intro: pas_refined_Control[THEN sym]\n | fastforce intro: pas_wellformed_pasSubject_update[simplified])+)[4]\n apply (drule_tac t=\"pasSubject aag\" in sym)+\n apply simp\n apply (rule sata_asidpool)\n apply assumption\n apply assumption\n apply assumption\n apply clarsimp\n apply (drule partitionIntegrity_integrity)\n apply (clarsimp simp: integrity_def)\n apply (drule_tac x=asid in spec)+\n apply (clarsimp simp: integrity_asids_def)\n apply (fastforce intro: affects_lrefl)\n done\n\nlemma sameFor_subject_def2:\n \"sameFor_subject g ab irqab asidab domainab l =\n {(os,os')|os os' s s'. s = internal_state_if os \\ s' = internal_state_if os' \\\n (\\ d \\ subjectReads g (OrdinaryLabel l).\n states_equiv_for (\\x. ab x = d) (\\x. irqab x = d) (\\x. asidab x = d)\n (\\x. d \\ domainab x) s s') \\\n ((domainab (cur_domain s) \\ subjectReads g (OrdinaryLabel l) \\ {} \\\n domainab (cur_domain s') \\ subjectReads g (OrdinaryLabel l) \\ {}) \\\n cur_domain s = cur_domain s' \\ globals_equiv s s' \\\n scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\ user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\\n equiv_for (\\ x. ab x = SilcLabel) kheap s s')}\"\n apply(clarsimp simp: sameFor_subject_def)\n apply(rule equalityI)\n apply(rule subsetI)\n apply(drule CollectD)\n apply(rule CollectI)\n apply(clarify)\n apply(rule exI)+\n apply(rule conjI, rule refl)\n apply(rule conjI)\n apply(rule ballI)\n apply(erule states_equiv_for_guard_imp)\n apply(blast+)[4]\n apply(fastforce simp: globals_equiv_def)\n apply(rule subsetI)\n apply(drule CollectD)\n apply(rule CollectI)\n apply(clarify)\n apply(rule exI)+\n apply(rule conjI, rule refl)\n apply(rule conjI)\n apply(rule states_equiv_forI)\n apply((fastforce intro: equiv_forI elim: states_equiv_forE equiv_forD)+)[5]\n apply(fastforce intro: equiv_forI elim: states_equiv_forE_is_original_cap)\n apply((fastforce intro: equiv_forI elim: states_equiv_forE equiv_forD)+)[2]\n apply(solves \\clarsimp simp: equiv_asids_def equiv_asid_def states_equiv_for_def\\)\n apply(fastforce intro: equiv_forI elim: states_equiv_forE_ready_queues)\n apply fastforce\n done\n\ntext \\\n This lemma says that everything the current subject can affect, according to the\n integrity property, is included in @{term partsSubjectAffects}.\n\\\n\nlemma subject_can_affect_its_own_partition:\n \"d\\partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag)) \\\n d \\ Partition (label_of (pasSubject aag))\"\n apply(erule contrapos_nn)\n apply(simp add: partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply(blast intro: affects_lrefl)\n done\n\n(* FIXME: cleanup this wonderful proof *)\nlemma partitionIntegrity_subjectAffects_device:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; invs s;\n invs s';\n device_state (machine_state s) x \\ device_state (machine_state s') x;\n x \\ range_of_arm_globals_frame s \\ x \\ range_of_arm_globals_frame s'\\\n \\ pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply(drule partitionIntegrity_integrity)\n apply(frule integrity_subjects_device)\n apply(drule_tac x=x in spec)\n apply(erule integrity_device.cases)\n apply(fastforce intro: affects_lrefl)\n apply blast\n apply(fastforce intro: affects_write)\n done\n\n\n\n(* a hack to prevent safe etc. below from taking apart the implication *)\ndefinition guarded_is_subject_cur_thread\nwhere\n \"guarded_is_subject_cur_thread aag s \\\n cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)\"\n\nlemma partsSubjectAffects_bounds_subjects_affects:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"\\partitionIntegrity aag s s'; pas_refined aag s; pas_refined aag s'; valid_objs s;\n valid_arch_state s'; einvs s; einvs s'; silc_inv aag st s; silc_inv aag st' s';\n pas_wellformed_noninterference aag; pas_cur_domain aag s;\n guarded_is_subject_cur_thread aag s; guarded_is_subject_cur_thread aag s';\n d \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag));\n d \\ PSched\\ \\\n (((uc,s),mode),((uc',s'),mode')) \\ same_for aag d\"\n apply (frule pasSubject_not_SilcLabel)\n apply(erule contrapos_np)\n apply(cases d)\n prefer 2\n apply simp\n apply(clarsimp simp: sameFor_def sameFor_subject_def2 states_equiv_for_def equiv_for_def\n partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply (safe del: iffI notI)\n apply(fastforce dest: partitionIntegrity_subjectAffects_obj)\n apply ((auto dest: partitionIntegrity_subjectAffects_obj\n partitionIntegrity_subjectAffects_eobj\n partitionIntegrity_subjectAffects_mem\n partitionIntegrity_subjectAffects_device\n partitionIntegrity_subjectAffects_cdt\n partitionIntegrity_subjectAffects_cdt_list\n partitionIntegrity_subjectAffects_is_original_cap\n partitionIntegrity_subjectAffects_interrupt_states\n partitionIntegrity_subjectAffects_interrupt_irq_node\n partitionIntegrity_subjectAffects_asid\n partitionIntegrity_subjectAffects_ready_queues\n [folded guarded_is_subject_cur_thread_def, OF domains_distinct]\n domains_distinct[THEN pas_domains_distinct_inj]\n | fastforce simp: partitionIntegrity_def silc_dom_equiv_def equiv_for_def)+)[11]\n apply ((fastforce intro: affects_lrefl simp: partitionIntegrity_def domain_fields_equiv_def\n dest: domains_distinct[THEN pas_domains_distinct_inj])+)[16]\n done\n\nlemma cur_thread_not_SilcLabel:\n \"\\silc_inv aag st s; invs s\\ \\\n pasObjectAbs aag (cur_thread s) \\ SilcLabel\"\n apply(rule notI)\n apply(simp add: silc_inv_def)\n apply(drule tcb_at_invs)\n apply clarify\n apply(drule_tac x=\"cur_thread s\" in spec, erule (1) impE)\n apply(auto simp: obj_at_def is_tcb_def is_cap_table_def)\n apply(case_tac ko, simp_all)\n done\n\n\n\n\n\nlemma ev_add_pre: \"equiv_valid_inv I A P f \\ equiv_valid_inv I A (P and Q) f\"\n apply (rule equiv_valid_guard_imp)\n apply assumption\n apply simp\n done\n\ncrunch invs[wp]: check_active_irq_if \"einvs\"\n (wp: dmo_getActiveIRQ_wp ignore: do_machine_op)\n\ndefinition partition :: \"'a subject_label agent_domain_map \\ det_state \\ 'a\"\nwhere\n \"partition ab s \\ label_of (the_elem (ab (cur_domain s)))\"\n\n\ncrunch schact_is_rct[wp]: thread_set \"schact_is_rct\"\n (wp: get_object_wp simp: schact_is_rct_def)\n\nend\n\nsection \\Valid initial state is complete unwinding system\\\n\ncontext valid_initial_state begin\n\ntext\\current running partition\\\ndefinition part\nwhere\n \"part s \\ if scheduler_modes (sys_mode_of s) then PSched\n else Partition (partition (pasDomainAbs initial_aag) (internal_state_if s))\"\n\ntext\\unwinding relation\\\ndefinition uwr\nwhere\n \"uwr \\ same_for initial_aag\"\n\nend\n\ntext \\Here we are basically that the big step ADT of the kernel is a\n valid complete unwinding system on the policyFlow policy\n\n For those unfamiliar with the local subtleties, we are importing the all the facts\n of the complete_unwinding_system locale in the valid_initial_state locale under namespace ni.\n\\\nsublocale valid_initial_state \\\n ni?: complete_unwinding_system\n \"big_step_ADT_A_if utf\" (* the ADT that we prove infoflow for *)\n s0 (* initial state *)\n \"\\e s. part s\" (* dom function *)\n \"uwr\" (* uwr *)\n \"policyFlows (pasPolicy initial_aag)\" (* policy *)\n \"undefined\" (* out -- unused *)\n PSched (* scheduler partition name *)\n apply(simp add: complete_unwinding_system_def big_step_ADT_A_if_enabled_Step_system\n unwinding_system_def complete_unwinding_system_axioms_def)\n apply(rule conjI)\n apply(unfold_locales)\n apply (clarsimp simp: equiv_def uwr_def, safe)[1]\n apply(simp add: sameFor_refl)\n apply(simp add: sameFor_sym)\n apply(simp add: sameFor_trans)\n apply(clarsimp simp: uwr_def sameFor_def sameFor_scheduler_def part_def\n domain_fields_equiv_def partition_def)\n apply(rule PSched_flows_to_all)\n apply(case_tac x)\n apply(fastforce simp: no_partition_flows_to_PSched)\n apply simp\n apply(simp add: refl_onD[OF policyFlows_refl])\n done\n\nlemma Fin_big_step_adt:\n \"Fin (big_step_adt A R evmap) = Fin A\"\n apply (simp add: big_step_adt_def)\n done\n\ncontext valid_initial_state begin\n\ninterpretation Arch . (*FIXME: arch_split*)\n\n\n\nlemma small_step_reachable:\n \"ni.reachable s \\ system.reachable (ADT_A_if utf) s0 s\"\n apply(rule reachable_big_step_adt)\n apply(simp add: big_step_ADT_A_if_def)\n done\n\nlemma reachable_invs_if:\n \"ni.reachable s \\ invs_if s\"\n apply(rule ADT_A_if_reachable_invs_if)\n apply(erule small_step_reachable)\n done\n\nabbreviation pas_refined_if\nwhere\n \"pas_refined_if s \\ pas_refined (current_aag (internal_state_if s)) (internal_state_if s)\"\n\nabbreviation guarded_pas_domain_if\nwhere\n \"guarded_pas_domain_if s \\\n guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s)\"\n\nlemma pas_refined_if:\n \"ni.reachable s \\ pas_refined_if s\"\n apply(drule reachable_invs_if)\n apply(simp add: invs_if_def Invs_def)\n done\n\nlemma guarded_pas_domain_if:\n \"ni.reachable s \\ guarded_pas_domain_if s\"\n apply(drule reachable_invs_if)\n apply(simp add: invs_if_def Invs_def)\n done\n\nlemma current_aag_eqI:\n \"cur_domain s = cur_domain t \\\n current_aag s = current_aag t\"\n apply(simp add: current_aag_def)\n done\n\nlemma pas_refined_current_aag':\n \"\\reachable t; current_aag (internal_state_if s) = current_aag (internal_state_if t)\\ \\\n pas_refined (current_aag (internal_state_if s)) (internal_state_if t)\"\n apply(fastforce intro: pas_refined_if)\n done\n\nlemma guarded_pas_domain_current_aag':\n \"\\reachable t; current_aag (internal_state_if s) = current_aag (internal_state_if t)\\ \\\n guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if t)\"\n apply(fastforce intro: guarded_pas_domain_if)\n done\n\nabbreviation partition_if\nwhere\n \"partition_if s \\ partition (pasDomainAbs initial_aag) (internal_state_if s)\"\n\nlemma pasDomainAbs_not_SilcLabel[simp]:\n \"SilcLabel \\ pasDomainAbs initial_aag x\"\n apply(rule pas_wellformed_noninterference_silc)\n apply(rule policy_wellformed)\n done\n\nlemma domain_in_ordinary_label[simp]:\n \"OrdinaryLabel (label_of (the_elem (pasDomainAbs initial_aag (cur_domain s)))) =\n the_elem (pasDomainAbs initial_aag (cur_domain s))\"\n apply (case_tac \"the_elem (pasDomainAbs initial_aag (cur_domain s))\")\n apply simp\n apply (metis the_label_of_domain_exists pasDomainAbs_not_SilcLabel)\n done\n\nlemma uwr_partition_if:\n \"\\(os,os') \\ uwr (Partition (partition_if os));\n s = internal_state_if os; s' = internal_state_if os'\\ \\\n states_equiv_for\n (\\x. pasObjectAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag) (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasIRQAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag) (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasASIDAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag) (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasDomainAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag) (OrdinaryLabel (partition (pasDomainAbs initial_aag) s))\n \\ {})\n s s' \\\n cur_thread s = cur_thread s' \\ cur_domain s = cur_domain s' \\\n globals_equiv s s' \\ scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\ user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\\n equiv_for (\\x. pasObjectAbs initial_aag x = SilcLabel) kheap s s'\"\n apply(simp add: uwr_def sameFor_def sameFor_subject_def)\n apply(clarify | simp (no_asm_use) add: partition_def)+\n apply (subst (asm) the_subject_of_aag_domain, rule subject_current_aag)+\n apply (simp add: current_aag_def)\n apply (erule impE)\n using reads_lrefl subject_current_aag apply fastforce\n apply (fastforce simp: globals_equiv_def)\n done\n\n\nlemma schact_is_rct_eqI:\n \"\\(s,t) \\ uwr(Partition (partition_if s))\\ \\\n schact_is_rct (internal_state_if s) = schact_is_rct (internal_state_if t)\"\n apply(drule uwr_partition_if[OF _ refl refl])\n apply(simp add: schact_is_rct_def)\n done\n\n(*FIXME move*)\nlemma handle_ev[wp]:\n assumes ok:\n \"equiv_valid I AA AA P f\"\n assumes err:\n \"\\ e. equiv_valid I AA AA (E e) (handler e)\"\n assumes hoare:\n \"\\ P \\ f -, \\ E \\\"\n shows\n \"equiv_valid I AA AA P (f handler)\"\n apply(simp add: handleE_def handleE'_def)\n apply (wp err ok | wpc | simp)+\n apply(insert hoare[simplified validE_E_def validE_def])[1]\n apply(simp split: sum.splits)\n by simp\n\n(*\nlemma Step[simp]:\n \"ni.Step = system.Step (big_step_ADT_A_if utf)\"\n apply(rule ext)\n apply(simp add: system.Step_def execution_def big_step_ADT_A_if_def big_step_adt_def steps_def)\n done\n*)\n\n\nlemma pas_refined_initial_aag_reachable:\n \"system.reachable (big_step_ADT_A_if utf) s0 s \\\n pas_refined initial_aag (internal_state_if s)\"\n apply(simp add: initial_aag_bak[where s=\"internal_state_if s\"])\n apply(rule pas_refined_pasSubject_update[OF pas_refined_if pas_wellformed_cur])\n apply assumption\n apply (clarsimp simp: current_aag_def)\n apply blast\n done\n\nlemma silc_inv_initial_aag_reachable:\n \"system.reachable (big_step_ADT_A_if utf) s0 s \\\n silc_inv initial_aag s0_internal (internal_state_if s)\"\n apply(simp add: silc_inv_cur[symmetric])\n apply(fastforce dest: reachable_invs_if simp: invs_if_def Invs_def)\n done\n\nlemma uwr_def_cur:\n \"uwr \\ same_for (current_aag (internal_state_if s))\"\n apply(simp add: uwr_def current_aag_def)\n done\n\nlemma Step_big_step_ADT_A_if:\n \"data_type.Step (big_step_ADT_A_if utf) = big_steps (ADT_A_if utf) big_step_R big_step_evmap\"\n apply(simp add: big_step_ADT_A_if_def big_step_adt_def)\n done\n\nlemma partitionIntegrity_refl:\n \"partitionIntegrity aag s s\"\n apply(fastforce simp: partitionIntegrity_def intro: integrity_refl globals_equiv_scheduler_refl\n simp: silc_dom_equiv_def domain_fields_equiv_def intro: equiv_for_refl)\n done\n\nlemma partitionIntegrity_trans:\n \"partitionIntegrity aag s t \\ partitionIntegrity aag t u \\ partitionIntegrity aag s u\"\n apply(clarsimp simp: partitionIntegrity_def)\n apply(rule conjI)\n apply(blast intro: integrity_trans)\n apply(fastforce intro: domain_fields_equiv_trans\n simp: silc_dom_equiv_def)\n done\n\nlemma check_active_irq_A_if_partitionIntegrity:\n \"((a, b), x, aa, ba) \\ check_active_irq_A_if\n \\ partitionIntegrity (current_aag b) b ba\"\n apply(simp add: check_active_irq_A_if_def)\n apply(erule use_valid)\n apply(wp check_active_irq_if_partitionIntegrity)\n apply(rule partitionIntegrity_refl)\n done\n\nlemma check_active_irq_A_if_result_state:\n \"((a, b), x, aa, ba) \\ check_active_irq_A_if \\\n ba = (b\\machine_state := machine_state b\n \\irq_state := irq_state_of_state b + 1\\\\)\"\n apply(simp add: check_active_irq_A_if_def check_active_irq_if_def)\n apply(erule use_valid)\n apply(wp dmo_getActiveIRQ_wp)\n apply(simp)\n done\n\nlemma ct_running_not_ct_idle:\n \"valid_idle s \\ ct_running s \\ \\ ct_idle s\"\n apply(simp add: ct_in_state_def valid_idle_def)\n apply(simp add: st_tcb_at_def obj_at_def)\n apply auto\n done\n\nlemma do_user_op_A_if_partitionIntegrity:\n \"((a, b), x, aa, ba) \\ do_user_op_A_if uop \\ ct_running b \\ Invs b\n \\ partitionIntegrity (current_aag b) b ba\"\n apply(simp add: do_user_op_A_if_def)\n apply(erule use_valid)\n apply(wp do_user_op_if_partitionIntegrity)\n apply(simp add: partitionIntegrity_refl)\n apply(simp add: Invs_def)\n apply(clarsimp simp: guarded_pas_domain_def current_aag_def)\n apply(erule impE)\n apply(erule ct_running_not_idle)\n apply (simp add: invs_valid_idle)\n apply (simp add: the_subject_of_aag_domain)\n done\n\nlemma partitionIntegrity_current_aag_eq:\n \"partitionIntegrity (current_aag ( s)) ( s)\n ( s') \\\n current_aag ( s') = current_aag ( s)\"\n apply(simp add: current_aag_def partitionIntegrity_def domain_fields_equiv_def)\n done\n\nlemma partitionIntegrity_trans':\n \"\\partitionIntegrity (current_aag ( s)) ( s)\n ( s');\n partitionIntegrity (current_aag ( s')) ( s')\n ( t)\\ \\\n partitionIntegrity (current_aag ( s)) ( s)\n ( t)\"\n apply(rule partitionIntegrity_trans, assumption)\n apply(simp add: partitionIntegrity_current_aag_eq)\n done\n\n\nlemma user_small_Step_partitionIntegrity:\n \"\\((a, b), x, aa, ba) \\ check_active_irq_A_if; ct_running b; Invs b;\n ((aa, ba), y, ab, bb) \\ do_user_op_A_if utf\\\n \\ partitionIntegrity (current_aag b) b bb\"\n apply(rule partitionIntegrity_trans'[rotated])\n apply(rule do_user_op_A_if_partitionIntegrity)\n apply assumption\n apply(drule check_active_irq_A_if_result_state)\n apply simp\n apply(drule check_active_irq_A_if_result_state)\n apply(simp add: Invs_def current_aag_def)\n apply(rule check_active_irq_A_if_partitionIntegrity)\n apply assumption\n done\n\nlemma silc_inv_refl:\n \"silc_inv aag st s \\ silc_inv aag s s\"\n by (fastforce simp: silc_inv_def silc_dom_equiv_def equiv_for_refl\n intro!: silc_inv_no_transferableD')\n\nlemma ct_active_cur_thread_not_idle_thread:\n \"valid_idle s \\ ct_active s \\ cur_thread s \\ idle_thread s\"\n apply(simp add: ct_in_state_def valid_idle_def)\n apply(simp add: pred_tcb_at_def obj_at_def)\n apply auto\n done\n\nlemma kernel_call_A_if_partitionIntegrity:\n \"\\((a, b), x, aa, ba) \\ kernel_call_A_if e; e \\ Interrupt; ct_active b; Invs b;\n scheduler_action b = resume_cur_thread\\\n \\ partitionIntegrity (current_aag b) b ba\"\n apply(clarsimp simp: kernel_call_A_if_def)\n apply(erule use_valid)\n apply(wp kernel_entry_if_partitionIntegrity)\n apply(clarsimp simp: partitionIntegrity_refl Invs_def silc_inv_refl)\n apply(simp add: guarded_pas_domain_def current_aag_def active_from_running schact_is_rct_def)\n apply(erule impE)\n apply(rule ct_active_cur_thread_not_idle_thread, simp add: invs_valid_idle)\n apply simp\n apply (simp add: the_subject_of_aag_domain)\n done\n\nlemma not_schedule_modes_KernelEntry:\n \"(\\ scheduler_modes (KernelEntry event)) = (event \\ Interrupt)\"\n apply(case_tac event, simp_all)\n done\n\nlemma Step_ADT_A_if'':\n \"(s, t) \\ data_type.Step (ADT_A_if utf) () \\\n system.reachable (ADT_A_if utf) s0 s \\\n (s,t) \\ system.Step (ADT_A_if utf) ()\"\n apply (simp add: system.reachable_def)\n apply (clarsimp)\n apply (frule execution_invs)\n apply (frule invs_if_full_invs_if)\n apply (frule execution_restrict)\n apply(simp add: system.Step_def execution_def steps_def ADT_A_if_def)\n done\n\nlemma small_Step_partitionIntegrity:\n notes active_from_running[simp]\n assumes step: \"(s, t) \\ data_type.Step (ADT_A_if utf) ()\"\n and reachable: \"system.reachable (ADT_A_if utf) s0 s\"\n and sched: \"part s \\ PSched\"\n shows\n \"partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if t)\"\nproof (cases \"sys_mode_of s\")\n case InUserMode\n with assms show ?thesis\n apply (fastforce dest: ADT_A_if_reachable_invs_if\n simp: invs_if_def part_def\n Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n intro: user_small_Step_partitionIntegrity\n check_active_irq_A_if_partitionIntegrity)\n done\n next case InIdleMode\n with assms show ?thesis\n apply (fastforce simp: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n intro: check_active_irq_A_if_partitionIntegrity)\n done\n next case KernelEntry\n with assms show ?thesis\n apply (fastforce dest: ADT_A_if_reachable_invs_if\n simp: invs_if_def part_def\n Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n not_schedule_modes_KernelEntry\n intro: kernel_call_A_if_partitionIntegrity)\n done\n next case KernelExit\n with assms show ?thesis\n apply (clarsimp simp: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n kernel_exit_A_if_def)\n apply (safe; simp)\n apply (erule use_valid)\n apply wp\n apply (rule partitionIntegrity_refl)\n done\n next case KernelPreempted\n with assms show ?thesis\n apply (simp add: part_def)\n done\n next case KernelSchedule\n with assms show ?thesis\n apply (clarsimp simp: part_def\n Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n kernel_schedule_if_def)\n apply (safe; simp)\n apply (erule use_valid)\n apply (wp schedule_if_partitionIntegrity[OF current_domains_distinct])\n apply (clarsimp simp: partitionIntegrity_refl)\n apply (drule ADT_A_if_reachable_invs_if)\n apply (clarsimp simp: invs_if_def Invs_def silc_inv_refl current_aag_def)\n done\nqed\n\nlemma sub_big_steps_reachable:\n \"\\(s', evlist') \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n system.reachable (ADT_A_if utf) s0 s\\\n \\ system.reachable (ADT_A_if utf) s0 s'\"\n apply (rule_tac s=s and js=evlist' in Step_system.reachable_execution[OF ADT_A_if_Step_system])\n apply assumption\n apply (drule sub_big_steps_Run)\n apply (clarsimp simp: execution_def image_def)\n apply (subst Bex_def)\n apply (simp only: steps_eq_Run)\n apply (rule_tac x=\"s'\" in exI)\n apply (rule conjI)\n apply (rule_tac x=s in exI)\n apply (clarsimp simp: system.reachable_def)\n apply (frule execution_invs)\n apply (frule invs_if_full_invs_if)\n apply (frule execution_restrict)\n apply (simp add: ADT_A_if_def)\n apply (simp add: ADT_A_if_def)\n done\n\nlemma Step2[simp]:\n \"system.Step (ADT_A_if utf) = Simulation.Step (ADT_A_if utf)\"\n apply(rule ext)\n apply(simp add: system.Step_def execution_def ADT_A_if_def steps_def Image_def)\n oops\n\nlemma Step2:\n \"(s,s') \\ system.Step (ADT_A_if utf) u \\ (s,s') \\ Simulation.Step (ADT_A_if utf) u\"\n apply(simp add: system.Step_def execution_def ADT_A_if_def steps_def)\n apply blast\n done\n\n\nlemma sub_big_steps_not_PSched:\n \"\\(s', blah) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n big_step_R\\<^sup>*\\<^sup>* s0 s; part s \\ PSched\\ \\\n part s' \\ PSched\"\n apply(drule tranclp_s0)\n apply(induct s' blah rule: sub_big_steps.induct)\n apply simp\n apply simp\n apply(simp add: part_def split: if_splits)\n apply(case_tac \"sys_mode_of s\", simp_all add: sys_mode_of_def)\n apply(case_tac \"sys_mode_of s'\", simp_all add: sys_mode_of_def)\n apply(case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def big_step_R_def split: if_splits)\n apply(rename_tac event)\n apply(case_tac event, simp_all)\n apply((fastforce simp: ADT_A_if_def global_automaton_if_def)+)[2]\n apply(case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def big_step_R_def split: if_splits)\n apply(fastforce simp: ADT_A_if_def global_automaton_if_def)+\n apply(case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def)\n apply(clarsimp simp: ADT_A_if_def global_automaton_if_def kernel_exit_A_if_def split: if_splits)+\n done\n\nlemma sub_big_steps_partitionIntegrity:\n \"\\(t, as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n big_step_R\\<^sup>*\\<^sup>* s0 s;\n system.reachable (ADT_A_if utf) s0 s; part s \\ PSched\\ \\\n partitionIntegrity (current_aag (internal_state_if s)) (internal_state_if s)\n (internal_state_if t)\"\n apply(induct t as rule: sub_big_steps.induct)\n apply(simp add: partitionIntegrity_def globals_equiv_scheduler_refl silc_dom_equiv_def\n equiv_for_refl domain_fields_equiv_def)\n apply simp\n apply(erule partitionIntegrity_trans')\n apply(erule small_Step_partitionIntegrity)\n apply(blast intro: sub_big_steps_reachable)\n apply(rule sub_big_steps_not_PSched, simp+)\n done\n\nlemma Fin_ADT_A_if:\n \"Fin (ADT_A_if uop) = id\"\n by (simp add: ADT_A_if_def)\n\nlemma Step_partitionIntegrity':\n \"\\(s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ()\\ \\\n system.reachable (big_step_ADT_A_if utf) s0 s \\\n part s \\ PSched \\\n partitionIntegrity (current_aag (internal_state_if s)) (internal_state_if s) (internal_state_if s')\"\n apply(simp add: Step_big_step_ADT_A_if)\n apply(erule big_steps.induct)\n apply(simp add: big_step_evmap_def)\n apply(intro impI | elim conjE)+\n apply(rule partitionIntegrity_trans')\n apply(erule sub_big_steps_partitionIntegrity)\n apply(simp add: reachable_def execution_def)\n apply(clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_A_if steps_eq_Run)\n apply(rule Run_big_steps_tranclp)\n apply(simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n apply(blast intro: small_step_reachable)\n apply assumption\n apply(erule small_Step_partitionIntegrity)\n apply(erule(1) sub_big_steps_reachable[OF _ small_step_reachable])\n apply(rule sub_big_steps_not_PSched, simp+)\n apply(simp add: reachable_def execution_def)\n apply(clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_A_if steps_eq_Run)\n apply(rule Run_big_steps_tranclp)\n apply(simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n by simp\n\nlemma Step_partitionIntegrity:\n \"\\system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) (); part s \\ PSched\\ \\\n partitionIntegrity (current_aag (internal_state_if s)) (internal_state_if s) (internal_state_if s')\"\n apply(blast dest: Step_partitionIntegrity')\n done\n\nlemma Step_cur_domain_unchanged:\n \"\\system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n part s \\ PSched\\ \\\n cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\"\n apply(fastforce dest: Step_partitionIntegrity\n simp: partitionIntegrity_def domain_fields_equiv_def)\n done\n\nlemma Step_current_aag_unchanged:\n \"\\system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n part s \\ PSched\\ \\\n current_aag (internal_state_if s') = current_aag (internal_state_if s)\"\n apply(simp add: current_aag_def)\n apply(metis Step_cur_domain_unchanged)\n done\n\nlemma reachable_Step':\n \"\\system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ data_type.Step (big_step_ADT_A_if utf) a\\\n \\ system.reachable (big_step_ADT_A_if utf) s0 s'\"\n apply (rule reachable_Step, assumption)\n apply (drule small_step_reachable)\n apply (frule ADT_A_if_reachable_full_invs_if)\n apply (drule ADT_A_if_reachable_step_restrict)\n apply (clarsimp simp: system.Step_def execution_def big_step_ADT_A_if_def Fin_big_step_adt\n Fin_ADT_A_if steps_eq_Run)\n apply (simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n apply (cases s)\n apply (case_tac a)\n apply blast\n done\n\n(* TOPLEVEL *)\nlemma integrity_part:\n \"\\system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag); u \\ PSched; part s \\ PSched\\ \\\n (s,s') \\ uwr u\"\n supply [[simp_depth_limit=0]] \\ \\speedup\\\n apply(simp add: uwr_def_cur[where s=s])\n apply(case_tac s, case_tac s', simp)\n apply(case_tac a, case_tac aa, simp)\n apply(rule partsSubjectAffects_bounds_subjects_affects)\n apply(rule current_domains_distinct)\n apply(fastforce dest: Step_partitionIntegrity)\n apply(fastforce dest: pas_refined_initial_aag_reachable simp: pas_refined_cur)\n apply(frule(2) pas_refined_current_aag'[OF _ Step_current_aag_unchanged[symmetric],\n OF reachable_Step']; force)\n apply(fastforce dest!: reachable_invs_if simp: invs_if_def Invs_def)\n apply(fastforce dest!: reachable_invs_if[OF reachable_Step'] simp: invs_if_def Invs_def)\n apply(fastforce dest!: reachable_invs_if simp: invs_if_def Invs_def)\n apply(fastforce dest!: reachable_invs_if[OF reachable_Step'] simp: invs_if_def Invs_def)\n apply(fastforce dest: silc_inv_initial_aag_reachable simp: silc_inv_cur)\n apply(frule Step_current_aag_unchanged[symmetric];simp)\n apply(fastforce dest: silc_inv_initial_aag_reachable[OF reachable_Step'] simp: silc_inv_cur)\n apply(rule pas_wellformed_cur)\n apply(simp add: current_aag_def)\n supply [[simp_depth_limit=0]] \\ \\speeds up the rest of the proof\\\n apply(fastforce dest!: reachable_invs_if domains_distinct[THEN pas_domains_distinct_inj]\n simp: invs_if_def Invs_def guarded_pas_domain_def\n guarded_is_subject_cur_thread_def current_aag_def)\n apply(frule Step_current_aag_unchanged[symmetric];simp)\n apply(fastforce dest!:reachable_invs_if[OF reachable_Step']\n domains_distinct[THEN pas_domains_distinct_inj]\n simp: invs_if_def Invs_def guarded_pas_domain_def\n guarded_is_subject_cur_thread_def current_aag_def)\n apply(rule partsSubjectAffects_bounds_those_subject_not_allowed_to_affect,\n simp add: part_def split: if_split_asm add: partition_def current_aag_def)\n apply assumption\n done\n\nlemma not_PSched:\n \"\\(x, u) \\ policyFlows (pasPolicy initial_aag); u \\ PSched\\ \\\n x \\ PSched\"\n apply(erule contrapos_nn)\n apply simp\n apply(rule schedFlowsToAll)\n done\n\nlemma part_equiv: \"(s,t) \\ uwr PSched \\ part s = part t\"\n by (clarsimp simp: uwr_def sameFor_def\n sameFor_scheduler_def part_def\n Noninterference.partition_def\n domain_fields_equiv_def\n split: partition.splits)\n\nlemma not_PSched_big_step_R:\n \"\\part s \\ PSched; big_step_R s t\\\n \\ sys_mode_of s = KernelExit \\ interrupted_modes (sys_mode_of t)\"\n apply(clarsimp simp: part_def big_step_R_def sys_mode_of_def split: if_split_asm)\n apply(cases s, simp, case_tac b; simp)\n done\n\nlemma sub_big_steps_Nil:\n \"(s',[]) \\ sub_big_steps A R s \\ s' = s \\ \\ R s s\"\n by(erule sub_big_steps.cases; simp)\n\nlemma sub_big_steps_App:\n \"(s',as @ [a]) \\ sub_big_steps A R s \\ \\s'a. (s'a, as) \\ sub_big_steps A R s \\\n (s'a, s') \\ data_type.Step A a \\ \\ R s s'\"\n by(erule sub_big_steps.cases; fastforce)\n\n(* FIXME: move to ADT_IF.thy *)\nlemma relation_preserved_across_sub_big_steps:\n \"\\(s', as) \\ sub_big_steps A R s;\n (t', as') \\ sub_big_steps A R t; X s t; as' = as;\n \\ sa ta sa' ta'. X sa ta \\\n (\\bs. (sa,bs) \\ sub_big_steps A R s \\ (sa',bs @ [()]) \\ sub_big_steps A R s) \\\n (\\cs. (ta,cs) \\ sub_big_steps A R t \\ (sa',cs @ [()]) \\ sub_big_steps A R s) \\\n (sa,sa') \\ data_type.Step A () \\ (ta,ta') \\ data_type.Step A () \\\n X sa' ta'\\ \\\n X s' t'\"\n apply hypsubst_thin\n apply(induct as arbitrary: s t s' t' rule: rev_induct)\n apply(drule sub_big_steps_Nil)+\n apply simp\n apply(frule_tac s=s in sub_big_steps_App)\n apply(frule_tac s=t in sub_big_steps_App)\n apply clarify\n apply(drule_tac x=s in meta_spec)\n apply(drule_tac x=t in meta_spec)\n apply(drule_tac x=s'a in meta_spec)\n apply(drule_tac x=s'aa in meta_spec)\n apply simp\n apply blast\n done\n\n(* FIXME: move these next lemmas culminating in reads_respects_g\n for activate_thread and schedule into Schedule_IF or similar *)\nlemma set_thread_state_runnable_reads_respects_g:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l (valid_ko_at_arm and K (runnable ts)) (set_thread_state t ts)\"\n apply(rule gen_asm_ev)\n apply(rule equiv_valid_guard_imp)\n apply(rule reads_respects_g[OF set_thread_state_runnable_reads_respects[OF domains_distinct]])\n apply assumption\n apply(rule doesnt_touch_globalsI)\n apply(wp set_thread_state_globals_equiv | simp)+\n done\n\nlemma globals_equiv_idle_thread_ptr:\n \"globals_equiv s t \\ idle_thread s= idle_thread t\"\n apply(simp add: globals_equiv_def idle_equiv_def)\n done\n\nlemma get_thread_state_reads_respects_g:\n \"reads_respects_g aag l (valid_idle and (\\s. is_subject aag t \\ t = idle_thread s))\n (get_thread_state t)\"\n apply(rule use_spec_ev)\n apply(case_tac \"t = idle_thread st\")\n apply(clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply(drule_tac Q=\"\\rv s. s = st \\ idle rv\" in use_valid[OF _ gts_wp])\n apply(simp add: valid_idle_def)\n apply(clarsimp simp: pred_tcb_at_def obj_at_def)\n apply(drule_tac Q=\"\\rv s. s = ta \\ idle rv\" in use_valid[OF _ gts_wp])\n apply(simp add: valid_idle_def)\n apply(fastforce simp: pred_tcb_at_def obj_at_def reads_equiv_g_def globals_equiv_idle_thread_ptr)\n apply (simp add: pred_tcb_at_def obj_at_def)\n apply(clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply(frule aag_can_read_self)\n apply(frule get_thread_state_reads_respects_g\n [simplified equiv_valid_def2 equiv_valid_2_def,\n rule_format, OF conjI, simplified];\n fastforce)\n done\n\n\nlemma activate_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l ((\\s. cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s))\n and invs) activate_thread\"\n apply(simp add: activate_thread_def)\n apply(wp set_thread_state_runnable_reads_respects_g as_user_reads_respects_g\n get_thread_state_reads_respects_g gts_wp\n | wpc\n | simp add: det_setNextPC arch_activate_idle_thread_def)+\n apply clarsimp\n apply(rule conjI)\n apply(blast intro: requiv_g_cur_thread_eq)\n apply(frule invs_valid_idle)\n apply(simp add: invs_valid_ko_at_arm)\n apply(rule conjI)\n apply blast\n apply(rule impI)\n apply(clarsimp simp: pred_tcb_at_def obj_at_def valid_idle_def)\n apply(fastforce simp: invs_valid_ko_at_arm det_getRestartPC)\n done\n\nlemmas set_scheduler_action_reads_respects_g =\n reads_respects_g[OF set_scheduler_action_reads_respects,\n OF doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF set_scheduler_action_globals_equiv]\n\nlemma cur_thread_update_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag) (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (affects_equiv aag l) \\\n (modify (cur_thread_update (\\_. t)))\"\n apply(simp add: equiv_valid_def2)\n apply(rule modify_ev2)\n apply(clarsimp simp: reads_equiv_g_def reads_equiv_def2 affects_equiv_def2 globals_equiv_def\n idle_equiv_def)\n apply(fastforce intro: states_equiv_for_sym)\n done\n\n(* clagged mostly from Scheduler_IF.dmo_storeWord_reads_respects_scheduler *)\nlemma dmo_storeWord_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (do_machine_op (storeWord ptr w))\"\n apply (clarsimp simp add: do_machine_op_def bind_def gets_def get_def\n return_def select_f_def storeWord_def\n assert_def simpler_modify_def fail_def)\n apply (fold simpler_modify_def)\n apply (intro impI conjI)\n apply (rule ev_modify)\n apply(rule conjI)\n apply (fastforce simp: reads_equiv_g_def globals_equiv_def reads_equiv_def2 states_equiv_for_def\n equiv_for_def equiv_asids_def equiv_asid_def silc_dom_equiv_def)\n apply(rule affects_equiv_machine_state_update, assumption)\n apply(fastforce simp: equiv_for_def affects_equiv_def states_equiv_for_def)\n apply (simp add: equiv_valid_def2 equiv_valid_2_def)\n done\n\n\nlemmas thread_get_reads_respects_g =\n reads_respects_g[OF thread_get_rev,\n OF doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF thread_get_inv]\n\nlemmas set_vm_root_reads_respects_g[wp] =\n reads_respects_g[OF set_vm_root_reads_respects,\n OF doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF set_vm_root_globals_equiv]\n\n\nlemma dmo_clearExMonitor_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag) (affects_equiv aag l)\n (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s') \\\n (do_machine_op clearExMonitor)\"\n apply (simp add: clearExMonitor_def)\n apply (wp dmo_ev ev_modify)\n apply (simp add: reads_equiv_g_def reads_equiv_def2 affects_equiv_def2 globals_equiv_def\n idle_equiv_def states_equiv_for_def equiv_for_def equiv_asids_def\n equiv_asid_def)\n apply metis\n done\n\nlemma arch_switch_to_thread_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag) (affects_equiv aag l)\n (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (\\s. is_subject aag t)\n (arch_switch_to_thread t)\"\n apply(simp add: arch_switch_to_thread_def)\n apply (rule equiv_valid_guard_imp)\n apply (wp bind_ev_general dmo_clearExMonitor_reads_respects_g' thread_get_reads_respects_g\n | simp)+\n done\n\nlemmas tcb_sched_action_reads_respects_g =\n reads_respects_g[OF tcb_sched_action_reads_respects,\n OF _ doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF _ tcb_sched_action_extended.globals_equiv]\n\n\nlemma set_tcb_queue_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag) (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s') \\\n (set_tcb_queue d prio queu)\"\n unfolding equiv_valid_def2 equiv_valid_2_def\n apply (clarsimp simp: set_tcb_queue_def bind_def modify_def put_def get_def)\n apply ((rule conjI\n | rule affects_equiv_ready_queues_update reads_equiv_ready_queues_update, assumption\n | clarsimp simp: reads_equiv_g_def\n | fastforce elim!: affects_equivE reads_equivE\n simp: equiv_for_def globals_equiv_def idle_equiv_def)+)\n done\n\n(* consider rewriting the return-value assumption using equiv_valid_rv_inv *)\nlemma ev2_invisible':\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"\\labels_are_invisible aag l L;\n labels_are_invisible aag l L';\n modifies_at_most aag L Q f;\n modifies_at_most aag L' Q' g;\n doesnt_touch_globals Q f;\n doesnt_touch_globals Q' g;\n \\P. \\\\s. P (exclusive_state (machine_state s))\\ f \\\\_ s. P (exclusive_state (machine_state s))\\;\n \\P. \\\\s. P (exclusive_state (machine_state s))\\ g \\\\_ s. P (exclusive_state (machine_state s))\\;\n \\ s t. P s \\ P' t \\ (\\(rva,s') \\ fst (f s). \\(rvb,t') \\ fst (g t). W rva rvb)\\\n \\\n equiv_valid_2 (reads_equiv_g aag) (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n W (P and Q) (P' and Q') f g\"\n apply(clarsimp simp: equiv_valid_2_def)\n apply(rule conjI)\n apply blast\n apply(drule_tac s=s in modifies_at_mostD, assumption+)\n apply(drule_tac s=t in modifies_at_mostD, assumption+)\n apply(drule_tac s=s in globals_equivI, assumption+)\n apply(drule_tac s=t in globals_equivI, assumption+)\n apply(frule (1) equiv_but_for_reads_equiv[OF domains_distinct])\n apply(frule_tac s=t in equiv_but_for_reads_equiv[OF domains_distinct], assumption)\n apply(drule (1) equiv_but_for_affects_equiv[OF domains_distinct])\n apply(drule_tac s=t in equiv_but_for_affects_equiv[OF domains_distinct], assumption)\n apply(clarsimp simp: reads_equiv_g_def)\n apply(simp only: conj_assoc[symmetric])\n apply (rule conjI)\n apply(blast intro: reads_equiv_trans reads_equiv_sym affects_equiv_trans affects_equiv_sym\n globals_equiv_trans globals_equiv_sym)\n apply atomize\n apply (erule_tac x=\"(=) (exclusive_state (machine_state s))\" in allE)\n apply (erule_tac x=\"(=) (exclusive_state (machine_state t))\" in allE)\n apply(clarsimp simp: valid_def)\n apply (thin_tac \"\\x y. P x y\" for P)\n apply (erule_tac x=s in allE)\n apply (erule_tac x=t in allE)\n apply fastforce\n done\n\nlemma set_tcb_queue_globals_equiv[wp]:\n \"\\globals_equiv st\\ set_tcb_queue d prio queue \\\\_. globals_equiv st\\\"\n apply (simp add: set_tcb_queue_def modify_def | wp)+\n done\n\nlemma tcb_sched_action_reads_respects_g':\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"equiv_valid (reads_equiv_g aag) (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (\\s s'. affects_equiv aag l s s' \\ exclusive_state_equiv s s')\n (pas_refined aag) (tcb_sched_action action thread)\"\n apply (simp add: tcb_sched_action_def get_tcb_queue_def)\n apply (subst gets_apply)\n apply (case_tac \"aag_can_read aag thread \\ aag_can_affect aag l thread\")\n apply (simp add: ethread_get_def)\n apply (wp set_tcb_queue_reads_respects_g')\n apply (rule_tac Q=\"\\s. pasObjectAbs aag thread \\ pasDomainAbs aag (tcb_domain rv)\"\n in equiv_valid_guard_imp)\n apply (wp gets_apply_ev')\n apply (clarsimp simp: reads_equiv_g_def)\n apply (elim reads_equivE affects_equivE equiv_forE)\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply metis (* only one that works *)\n apply (wp | simp)+\n apply (intro conjI impI allI\n | fastforce simp: get_etcb_def reads_equiv_g_def\n elim: reads_equivE affects_equivE equiv_forE)+\n apply (clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def split: option.splits)\n apply (erule_tac x=\"(thread, tcb_domain y)\" in ballE, force)\n apply (force intro: domtcbs simp: get_etcb_def)\n\n apply (simp add: equiv_valid_def2 ethread_get_def)\n apply (rule equiv_valid_rv_bind)\n apply (wp equiv_valid_rv_trivial', simp)\n apply (rule equiv_valid_2_bind)\n prefer 2\n apply (wp equiv_valid_rv_trivial, simp)\n apply (rule equiv_valid_2_bind)\n apply (rule_tac P=\"\\\" and P'=\"\\\" and L=\"{pasObjectAbs aag thread}\" and\n L'=\"{pasObjectAbs aag thread}\"\n in ev2_invisible')\n apply (blast | simp add: labels_are_invisible_def)+\n apply (rule set_tcb_queue_modifies_at_most)\n apply (rule set_tcb_queue_modifies_at_most)\n apply (rule doesnt_touch_globalsI | simp | wp)+\n apply (clarsimp simp: equiv_valid_2_def gets_apply_def get_def bind_def return_def\n labels_are_invisible_def)\n apply wp+\n apply clarsimp\n apply (clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def)\n apply (erule_tac x=\"(thread, tcb_domain y)\" in ballE)\n apply force\n apply (force intro: domtcbs simp: get_etcb_def)\n done\n\nlemma switch_to_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l (pas_refined aag and (\\s. is_subject aag t)) (switch_to_thread t)\"\n apply(simp add: switch_to_thread_def)\n apply(subst bind_assoc[symmetric])\n apply(rule equiv_valid_guard_imp)\n apply(rule bind_ev)\n apply (wp bind_ev_general cur_thread_update_reads_respects_g'\n tcb_sched_action_reads_respects_g' arch_switch_to_thread_reads_respects_g')\n apply(simp add: equiv_valid_def2)\n apply(rule_tac R'=\"\\\\\" in equiv_valid_2_bind)\n apply(rule assert_ev2 | simp)+\n apply(rule equiv_valid_rv_trivial, wp+)\n apply fastforce\n done\n\nlemma guarded_switch_to_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l (pas_refined aag and valid_idle and (\\s. is_subject aag t))\n (guarded_switch_to t)\"\n apply(simp add: guarded_switch_to_def)\n apply (wp switch_to_thread_reads_respects_g get_thread_state_reads_respects_g gts_wp)\n apply fastforce\n done\n\nlemma arch_switch_to_idle_thread_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (arch_switch_to_idle_thread)\"\n apply(simp add: arch_switch_to_idle_thread_def)\n apply wp\n apply (clarsimp simp: reads_equiv_g_def globals_equiv_idle_thread_ptr)\n done\n\nlemma cur_thread_update_idle_reads_respects_g':\n \"reads_respects_g aag l (\\s. t = idle_thread s) (modify (cur_thread_update (\\_. t)))\"\n apply(simp add: equiv_valid_def2)\n apply(rule modify_ev2)\n apply(clarsimp simp: reads_equiv_g_def reads_equiv_def2 affects_equiv_def2 globals_equiv_def\n idle_equiv_def)\n apply(fastforce intro: states_equiv_for_sym)\n done\n\nlemma switch_to_idle_thread_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (switch_to_idle_thread)\"\n apply(simp add: switch_to_idle_thread_def)\n apply (wp cur_thread_update_idle_reads_respects_g')\n apply(fastforce simp: reads_equiv_g_def globals_equiv_idle_thread_ptr)\n done\n\nlemma choose_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l ((\\s. cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)) and\n einvs and valid_queues and pas_cur_domain aag and pas_refined aag)\n choose_thread\"\n apply(simp add: choose_thread_def)\n apply (wp guarded_switch_to_reads_respects_g)\n apply(rule conjI)\n apply(fastforce simp: reads_equiv_g_def reads_equiv_def)\n apply(rule conjI)\n apply (clarsimp simp: reads_equiv_g_def reads_equiv_def2 states_equiv_for_def equiv_for_def\n disjoint_iff_not_equal)\n apply (metis reads_lrefl)\n apply (simp add: invs_valid_idle)\n (* everything from here clagged from Syscall_AC.choose_thread_respects *)\n apply (clarsimp simp: pas_refined_def)\n apply (clarsimp simp: tcb_domain_map_wellformed_aux_def)\n apply (erule_tac x=\"(hd (max_non_empty_queue (ready_queues s (cur_domain s))), cur_domain s)\"\n in ballE)\n apply (fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n apply (clarsimp simp: valid_queues_def is_etcb_at_def)\n apply (erule_tac x=\"cur_domain s\" in allE)\n apply (erule_tac x=\"Max {prio. ready_queues s (cur_domain s) prio \\ []}\" in allE)\n apply clarsimp\n apply (erule_tac x=\"hd (max_non_empty_queue (ready_queues s (cur_domain s)))\" in ballE)\n apply (clarsimp)\n apply (erule notE, rule domtcbs)\n apply force\n apply (simp add: etcb_at_def)\n apply (simp add: max_non_empty_queue_def)\n apply (erule_tac P=\"hd A \\ B\" for A B in notE)\n apply (rule Max_prop)\n apply force+\n done\n\nlemma scheduler_action_switch_thread_is_subject:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"\\valid_sched s;\n pas_cur_domain aag s;\n pas_refined aag s\\\n \\ \\x. scheduler_action s = switch_thread x \\\n is_subject aag x\"\n apply(clarsimp simp: valid_sched_def valid_sched_action_2_def switch_in_cur_domain_2_def\n in_cur_domain_def)\n apply(clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def)\n apply(drule_tac x=\"(x,cur_domain s)\" in bspec)\n apply(clarsimp simp: etcb_at_def)\n apply(clarsimp simp: weak_valid_sched_action_2_def)\n apply(clarsimp simp: valid_etcbs_def)\n apply(drule_tac x=x in spec)\n apply(simp add: st_tcb_weakenE)\n apply(simp add: is_etcb_at_def split: option.splits)\n apply(fastforce elim: domains_of_state_aux.intros)\n apply(fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma gets_app_rewrite:\n \"(gets y >>= (\\x. g (f x))) = (gets (\\s. f (y s)) >>= g)\"\n apply(rule ext)\n apply(simp add: gets_def bind_def get_def return_def)\n done\n\nlemma gets_domain_time_zero_ev:\n \"equiv_valid_inv I A (\\s. domain_time s > 0) (gets (\\s. domain_time s = 0))\"\n apply(rule gets_ev'')\n apply simp\n done\n\nlemma reads_equiv_valid_g_inv_schedule_switch_thread_fastfail:\n \"reads_equiv_valid_g_inv (affects_equiv aag l) aag\n ((\\s. ct \\ it \\ is_subject aag (ct)))\n (schedule_switch_thread_fastfail ct it ct_prio target_prio)\"\n unfolding schedule_switch_thread_fastfail_def\n by (wpsimp wp: reads_respects_g_from_inv[OF reads_respects_ethread_get])\n\nlemma gets_apply_ready_queues_reads_respects':\n \"reads_respects aag l (\\_. pasSubject aag \\ pasDomainAbs aag d) (gets_apply ready_queues d)\"\n apply (rule gets_apply_ready_queues_reads_respects)\n done\n\nlemma gets_ev_blah:\n \"\\ s t. I s t \\ A s t \\ P s \\ P t \\ g (f s) = g (f t) \\\n equiv_valid I A A P (gets (\\s. g (f s)))\"\n apply(simp add: gets_def get_def bind_def return_def)\n apply(clarsimp simp: equiv_valid_def2 equiv_valid_2_def)\n done\n\nlemma reads_respects_gets_ready_queues:\n \"reads_respects aag l (\\s. pasSubject aag \\ pasDomainAbs aag d)\n (gets (\\s. f (ready_queues s d)))\"\n apply (wp gets_ev_blah)\n apply (force elim: reads_equivE simp: equiv_for_def)\n done\n\nlemma reads_respects_is_highest_prio:\n \"reads_respects aag l (\\s. pasSubject aag \\ pasDomainAbs aag d)\n (gets (\\s. is_highest_prio d p s))\"\n by (fastforce simp: is_highest_prio_def intro: reads_respects_gets_ready_queues)\n\nlemma schedule_choose_new_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l\n ((\\s. domain_time s \\ 0) and einvs\n and pas_cur_domain aag and pas_refined aag\n and (\\s. (cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s))))\n schedule_choose_new_thread\"\n apply (simp add: schedule_choose_new_thread_def )\n apply (subst gets_app_rewrite[where y=domain_time and f=\"\\x. x = 0\"])+\n apply (wp gets_domain_time_zero_ev set_scheduler_action_reads_respects_g\n choose_thread_reads_respects_g when_ev\n equiv_valid_vacuous[where f=next_domain]\n hoare_pre_cont[where a=next_domain])\n apply (clarsimp simp: valid_sched_def)\n done\n\nlemma reads_respects_ethread_get_when:\n \"reads_respects aag l (\\_. b \\ is_subject aag thread) (ethread_get_when b f thread)\"\n apply (simp add: ethread_get_when_def)\n apply (rule conjI; clarsimp)\n apply (rule reads_respects_ethread_get)\n apply wp\n done\n\ntext \\strengthening of @{thm Syscall_AC.valid_sched_action_switch_subject_thread}\\\nlemma valid_sched_action_switch_is_subject:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows\n \"\\ scheduler_action s = switch_thread t ; valid_sched_action s ;\n valid_etcbs s ; pas_refined aag s ; pas_cur_domain aag s \\\n \\ is_subject aag t\"\n apply (fastforce dest: valid_sched_action_switch_subject_thread\n domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma schedule_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l\n ((\\s. cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)) and einvs\n and pas_cur_domain aag and (\\s. domain_time s \\ 0) and pas_refined aag) schedule\"\n supply ethread_get_wp[wp del]\n supply set_scheduler_action_wp[wp del]\n supply conj_cong[cong del] (* knowing the scheduler action messes with valid_sched_2 *)\n apply (simp add: schedule_def)\n apply wp\n apply wpc\n (* resume current thread *)\n apply wp[1]\n prefer 2\n (* choose new thread *)\n apply ((wp set_scheduler_action_reads_respects_g\n schedule_choose_new_thread_reads_respects_g when_ev\n tcb_sched_action_reads_respects_g\n | wpc | simp)+)[1]\n\n (* now switch_thread case *)\n apply (wpsimp wp: schedule_choose_new_thread_reads_respects_g enqueue_thread_queued\n set_scheduler_action_reads_respects_g tcb_sched_action_reads_respects_g\n set_scheduler_action_cnt_valid_sched)+\n (* tcb_sched_action tcb_sched_append *)\n apply (wp append_thread_queued\n set_scheduler_action_reads_respects_g\n guarded_switch_to_reads_respects_g\n reads_respects_g_from_inv[OF reads_respects_is_highest_prio]\n reads_equiv_valid_g_inv_schedule_switch_thread_fastfail)+\n (* fastfail calculation *)\n apply (wpsimp wp: reads_respects_g_from_inv[OF reads_respects_ethread_get]\n reads_respects_g_from_inv[OF reads_respects_ethread_get_when]\n when_ev gts_wp\n tcb_sched_action_reads_respects_g\n tcb_sched_action_enqueue_valid_blocked_except\n get_thread_state_reads_respects_g\n | wp (once) hoare_drop_imp)+\n\n apply (clarsimp simp: invs_valid_idle)\n apply (intro allI conjI impI ; (elim conjE)?\n ; (solves \\clarsimp simp: valid_sched_def valid_sched_action_switch_is_subject[OF domains_distinct]\n dest!: reads_equiv_gD intro!: globals_equiv_idle_thread_ptr\\)?)\n apply (tactic \\distinct_subgoals_tac\\)\n apply (all \\(erule requiv_g_cur_thread_eq)?\\)\n apply (simp_all add: requiv_sched_act_eq[OF reads_equiv_gD[THEN conjunct1]])\n apply (simp_all add: requiv_cur_domain_eq[OF reads_equiv_gD[THEN conjunct1]])\n apply (all \\(solves \\clarsimp elim!: st_tcb_weakenE\\)?\\)\n apply (all \\(solves \\clarsimp simp: not_cur_thread_def\\)?\\)\n apply (clarsimp simp: valid_sched_def valid_sched_action_def weak_valid_sched_action_def)+\n done\n\nlemma schedule_if_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l (einvs and pas_cur_domain aag and guarded_pas_domain aag and\n (\\s. domain_time s > 0) and pas_refined aag)\n (schedule_if tc)\"\n apply(simp add: schedule_if_def)\n apply(wp schedule_reads_respects_g activate_thread_reads_respects_g)\n apply(rule_tac Q=\"\\rv s. guarded_pas_domain aag s \\ invs s \\ pas_cur_domain aag s\"\n in hoare_strengthen_post)\n apply (wp schedule_guarded_pas_domain schedule_cur_domain\n | simp add: guarded_pas_domain_def\n | fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])+\n done\n\nlemma do_user_op_if_reads_respects_g:\n \"reads_respects_g aag l (pas_refined aag and valid_pdpt_objs and einvs and\n is_subject aag \\ cur_thread and det_inv InUserMode tc and ct_running)\n (do_user_op_if utf tc)\"\n apply (rule equiv_valid_guard_imp)\n apply (rule UserOp_IF.do_user_op_reads_respects_g[where P=\"\\tc. einvs and\n det_inv InUserMode tc and ct_running\"])\n using utf_det\n apply fastforce\n apply simp\n apply (rule ct_running_not_idle)\n apply simp\n apply (simp add: invs_valid_idle)\n done\n\nlemma sameFor_current_partition_sys_mode_of_eq:\n \"\\ (s, t) \\ sameFor_subject\n (pasPolicy initial_aag) (pasObjectAbs initial_aag)\n (pasIRQAbs initial_aag) (pasASIDAbs initial_aag)\n (pasDomainAbs initial_aag) a;\n label_of (the_elem (pasDomainAbs initial_aag (cur_domain (internal_state_if t)))) = a;\n OrdinaryLabel a \\ pasDomainAbs initial_aag (cur_domain (internal_state_if s)) \\\n \\ sys_mode_of s = sys_mode_of t\"\n apply(simp add: sameFor_subject_def2)\n apply clarify\n apply(erule impE)\n apply(fastforce)\n apply simp\n done\n\nlemma uwr_part_sys_mode_of_eq:\n \"\\(s,t) \\ uwr (part s); part t = part s; part s \\ PSched\\ \\ sys_mode_of s = sys_mode_of t\"\n apply(simp add: part_def split: if_split_asm)\n apply(simp add: partition_def)\n apply(cut_tac pas_wellformed_noninterference_silc[OF policy_wellformed, where d=\"cur_domain (internal_state_if s)\"])\n apply(case_tac \"the_elem (pasDomainAbs initial_aag (cur_domain (internal_state_if s)))\")\n apply(simp add: uwr_def sameFor_def)\n apply (erule (1) sameFor_current_partition_sys_mode_of_eq)\n apply (metis the_subject_of_aag_domain subject_current_aag)\n apply (metis the_label_of_domain_exists)\n done\n\n\nlemma flow_then_affect:\n \"(Partition x, Partition l) \\ policyFlows (pasPolicy initial_aag)\n \\ Partition l\n \\ partsSubjectAffects (pasPolicy initial_aag) x\"\n apply(erule policyFlows.cases, simp_all add: partsSubjectAffects_def)\n done\n\nlemma uwr_reads_equiv_f_g_affects_equiv:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr (Partition l);\n invs_if s; invs_if t;\n (part s, Partition l) \\ policyFlows (pasPolicy initial_aag); part s \\ PSched\\ \\\n reads_equiv_f_g (current_aag (internal_state_if s)) (internal_state_if s) (internal_state_if t) \\\n affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel l) (internal_state_if s)\n (internal_state_if t)\"\n apply(rule sameFor_reads_f_g_affects_equiv)\n apply(simp add: current_aag_def)\n apply(simp add: invs_if_def Invs_def)\n apply blast\n apply(clarsimp simp: uwr_def part_def current_aag_def partition_def split: if_splits)\n apply(simp add: part_def split: if_splits add: partition_def current_aag_def flow_then_affect)\n apply(clarsimp simp: uwr_def part_def current_aag_def partition_def split: if_splits)\n done\n\nlemma check_active_irq_if_reads_respects_g:\n \"reads_respects_g aag l (invs and only_timer_irq_inv irq st) (check_active_irq_if tc)\"\n apply(simp add: check_active_irq_if_def)\n apply(wp dmo_getActiveIRQ_reads_respects_g| blast)+\n done\n\nlemma check_active_irq_if_reads_respects_f_g:\n \"reads_respects_f_g aag l (silc_inv aag st and invs and only_timer_irq_inv irq st') (check_active_irq_if tc)\"\n apply(rule equiv_valid_guard_imp)\n apply(rule reads_respects_f_g'[where Q=\"\\\", OF check_active_irq_if_reads_respects_g])\n apply(wp check_active_irq_if_wp)\n apply fastforce+\n done\n\nlemma partitionIntegrity_cur_domain:\n \"partitionIntegrity aag s s' \\ cur_domain s = cur_domain s'\"\n apply(clarsimp simp: partitionIntegrity_def domain_fields_equiv_def)\n done\n\nlemma globals_equiv_globals_equiv_scheduler[elim]:\n \"globals_equiv s t \\ globals_equiv_scheduler s t\"\n apply(clarsimp simp: globals_equiv_def globals_equiv_scheduler_def)\n done\n\nlemma reads_equiv_f_g_affects_equiv_uwr:\n \"\\reads_equiv_f_g (current_aag (internal_state_if s)) (internal_state_if s')\n (internal_state_if t');\n affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel a)\n (internal_state_if s') (internal_state_if t');\n (part s, Partition a) \\ policyFlows (pasPolicy initial_aag); part s \\ PSched;\n silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s');\n (s,t) \\ uwr PSched;\n partitionIntegrity (current_aag (internal_state_if s)) (internal_state_if s)\n (internal_state_if s');\n partitionIntegrity (current_aag (internal_state_if t)) (internal_state_if t)\n (internal_state_if t');\n sys_mode_of s' = sys_mode_of t'; user_context_of s' = user_context_of t'\\\n \\ (s', t') \\ uwr (Partition a) \\\n (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(frule_tac s=\"internal_state_if s\" in partitionIntegrity_cur_domain)\n apply(subgoal_tac \"current_aag (internal_state_if s) = current_aag (internal_state_if s')\")\n apply(case_tac s', case_tac t')\n apply(case_tac aa, case_tac aaa)\n apply(rule conjI)\n apply simp\n apply(drule (1) reads_g_affects_equiv_sameFor[OF conjI])\n apply(simp add: current_aag_def)\n apply(fastforce)\n apply(simp add: current_aag_def)\n apply(rule flow_then_affect)\n apply(simp add: part_def partition_def split: if_splits)\n apply(clarsimp simp: uwr_def current_aag_def)\n apply assumption\n apply(rule conjI)\n apply(clarsimp simp: uwr_def sameFor_def sameFor_scheduler_def)\n apply(clarsimp simp: reads_equiv_f_g_def silc_dom_equiv_def current_aag_def globals_equiv_idle_thread_ptr globals_equiv_globals_equiv_scheduler reads_equiv_def)\n apply(fastforce simp: domain_fields_equiv_def partitionIntegrity_def)\n apply(drule sameFor_reads_equiv_f_g[rotated, rotated])\n apply(fastforce simp: current_aag_def)\n apply(fastforce simp: invs_if_def Invs_def)\n apply(simp add: uwr_def part_def partition_def current_aag_def split: if_splits)\n apply(simp add: current_aag_def)\n done\n\nlemma use_ev:\n \"\\equiv_valid I A B P f; (rv,s') \\ fst (f s); (rv',t') \\ fst (f t);\n P s; P t; I s t; A s t\\ \\\n rv' = rv \\ I s' t' \\ B s' t'\"\n apply(fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n done\n\nlemma uwr_part_sys_mode_of_user_context_of_eq:\n \"\\(s,t) \\ uwr (part s); part s \\ PSched\\ \\\n sys_mode_of s = sys_mode_of t \\ (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of t)\"\n apply(clarsimp simp: part_def split: if_splits)\n apply(simp add: uwr_partition_if)\n done\n\nlemma uwr_PSched_cur_domain:\n \"(s,t) \\ uwr PSched \\ cur_domain (internal_state_if s) = cur_domain (internal_state_if t)\"\n apply(fastforce simp: uwr_def sameFor_def sameFor_scheduler_def domain_fields_equiv_def)\n done\n\nlemma uwr_PSched_cur_domain':\n \"(((sx, s), sm), ((tx, t), tm)) \\ uwr PSched \\ cur_domain s = cur_domain t\"\n by (fastforce dest: uwr_PSched_cur_domain)\n\nlemma check_active_irq_A_if_confidentiality_helper:\n notes\n reads_respects_irq =\n use_ev[OF check_active_irq_if_reads_respects_f_g[\n where st=s0_internal and st'=s0_internal and irq=timer_irq]]\n shows\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s');\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if;\n ((fst t),y,(fst t')) \\ check_active_irq_A_if\n \\ \\\n x = y \\\n (snd s' = f x \\ snd t' = f y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s))\"\n apply(frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply(clarsimp simp: check_active_irq_A_if_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac u, simp_all)\n apply(frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (match premises in \"s = ((_, p), _)\" and \"t = ((_, q), _)\" and\n H: \"(_, _) \\ fst (check_active_irq_if _ p)\"\n for p q \\\n \\rule revcut_rl[OF reads_respects_irq[where s=p and t=q, OF H]]\\)\n apply assumption\n apply(simp add: invs_if_def Invs_def)\n apply(elim conjE)\n apply assumption\n apply(simp add: invs_if_def Invs_def)\n apply(simp only: current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply simp\n apply fastforce\n apply simp\n apply(rule impI)\n apply(rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply(erule use_valid[OF _ check_active_irq_if_partitionIntegrity])\n apply(rule partitionIntegrity_refl)\n apply simp\n apply(erule use_valid[OF _ check_active_irq_if_partitionIntegrity])\n apply(rule partitionIntegrity_refl)\n apply(simp add: sys_mode_of_def)\n apply(simp add: user_context_of_def)\n done\n\nlemma check_active_irq_A_if_confidentiality:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if;\n ((fst t),y,(fst t')) \\ check_active_irq_A_if\n \\ \\\n x = y \\\n (snd s' = f x \\ snd t' = f y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s))\"\n apply(subgoal_tac \"silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s')\")\n apply(blast dest!: check_active_irq_A_if_confidentiality_helper)\n apply(case_tac s', simp)\n apply(case_tac a, simp)\n apply(clarsimp simp: check_active_irq_A_if_def)\n apply(erule use_valid)\n apply(wp check_active_irq_if_wp)\n apply(fastforce simp: invs_if_def Invs_def current_aag_def)\n done\n\nlemma check_active_irq_A_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if;\n ((fst t),y,(fst t')) \\ check_active_irq_A_if;\n snd s' = (case x of None \\ InUserMode | Some xx \\ KernelEntry Interrupt);\n snd t' = (case y of None \\ InUserMode | Some yy \\ KernelEntry Interrupt)\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(blast dest: check_active_irq_A_if_confidentiality)\n done\n\nlemma check_active_irq_A_if_confidentiality'':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if;\n ((fst t),y,(fst t')) \\ check_active_irq_A_if;\n snd s' = (case x of None \\ InIdleMode | Some xx \\ KernelEntry Interrupt);\n snd t' = (case y of None \\ InIdleMode | Some yy \\ KernelEntry Interrupt)\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(blast dest: check_active_irq_A_if_confidentiality)\n done\n\nlemma check_active_irq_A_if_retval_eq:\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,s') \\ check_active_irq_A_if;\n ((fst t),y,t') \\ check_active_irq_A_if\\ \\\n x = y\"\n apply simp\n apply(drule_tac s'=\"(s',undefined)\" and t'=\"(t',undefined)\" and u=u\n in check_active_irq_A_if_confidentiality, simp+)\n apply(elim conjE, assumption)\n done\n\nlemmas do_user_op_if_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified, OF do_user_op_if_reads_respects_g,\n OF do_user_op_silc_inv]\n\n\nlemma partitionIntegrity_irq_state_update[simp]:\n \"partitionIntegrity aag y\n (y\\machine_state := machine_state y\n \\irq_state := X\\\\)\"\n apply(cut_tac s=y and aag=aag in partitionIntegrity_refl)\n apply(clarsimp simp: partitionIntegrity_def integrity_subjects_def domain_fields_equiv_def\n globals_equiv_scheduler_def silc_dom_equiv_def equiv_for_def)\n done\n\nlemma invs_if_Invs:\n \"invs_if s\n \\ Invs (internal_state_if s)\n \\ det_inv (sys_mode_of s) (cur_thread_context_of s) (internal_state_if s)\"\n by (simp add: invs_if_def)\n\nlemma do_user_op_A_if_confidentiality:\n notes\n read_respects_irq =\n use_ev[OF check_active_irq_if_reads_respects_f_g[\n where st=s0_internal and st'=s0_internal and irq=timer_irq\n and aag=\"current_aag (internal_state_if s)\"]] and\n read_respects_user_op =\n use_ev[OF do_user_op_if_reads_respects_f_g[\n where aag=\"current_aag (internal_state_if s)\" and st=\"s0_internal\"]]\n shows\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode;\n ((fst s),None,s_aux) \\ check_active_irq_A_if;\n ((fst t),None,t_aux) \\ check_active_irq_A_if;\n (s_aux,xx,fst s') \\ do_user_op_A_if utf;\n (t_aux,yy,fst t') \\ do_user_op_A_if utf; snd s' = f xx; snd t' = f yy\\ \\\n xx = yy \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n including no_pre\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply(frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply(clarsimp simp: check_active_irq_A_if_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac u, simp_all)\n apply(frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (match premises in \"s = ((_,p),_)\" and \"t = ((_,q),_)\" and\n H: \"(_,_) \\ fst (check_active_irq_if _ p)\"\n for p q \\ \\rule revcut_rl[OF read_respects_irq[where t=q, OF H]]\\)\n apply assumption\n apply (clarsimp dest!: invs_if_Invs simp: Invs_def)\n apply (drule uwr_PSched_cur_domain)\n apply (clarsimp dest!: invs_if_Invs simp: Invs_def)\n subgoal by(clarsimp simp: current_aag_def)\n apply simp\n apply fastforce\n apply(simp add: do_user_op_A_if_def | elim exE conjE)+\n apply (match premises in \"s_aux = (_,p)\" and \"t_aux = (_,q)\" and\n H: \"(_,_) \\ fst (do_user_op_if _ _ p)\"\n for p q \\ \\rule revcut_rl[OF read_respects_user_op[where t=q, OF H]]\\)\n apply assumption\n apply (match premises in \"s = ((_,p),_)\" and H: \"(_,_) \\ fst (check_active_irq_if _ p)\"\n for p \\ \\rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\\)\n apply (simp(no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def)\n apply metis\n apply simp\n apply (erule use_valid)\n apply (wp check_active_irq_if_wp)\n apply (clarsimp simp: invs_if_def Invs_def)\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply (match premises in \"t_aux = (_,q)\" and H: \"(_,q) \\ fst (check_active_irq_if _ _)\"\n for q \\ \\rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\\)\n apply (simp(no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def)\n apply metis\n apply simp\n apply (erule_tac s'=yc in use_valid)\n apply (wp check_active_irq_if_wp)\n apply (clarsimp simp: invs_if_def Invs_def current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply (match premises in \"t = ((_,q),_)\" and H: \"invs q\" for q \\\n \\rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\\)\n apply assumption\n apply (match premises in \"t = ((_,q),_)\" for q \\\n \\rule revcut_rl[OF current_aag_def[where t=q]]\\)\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply simp\n apply simp\n apply simp\n apply(rule reads_equiv_f_g_affects_equiv_uwr)\n apply ((clarsimp simp: Invs_def dest!: invs_if_Invs; rule TrueI)+)\n apply (simp add: invs_if_def Invs_def)\n apply (simp add: invs_if_def Invs_def)\n apply(erule use_valid[OF _ do_user_op_if_partitionIntegrity])\n apply(erule use_valid[OF _ check_active_irq_if_wp])\n apply clarsimp\n apply(frule (1) ct_running_not_idle[OF _ invs_valid_idle])\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply simp\n apply(erule_tac s'=s'aa in use_valid[OF _ do_user_op_if_partitionIntegrity])\n apply(erule_tac s'=yc in use_valid[OF _ check_active_irq_if_wp])\n apply(clarsimp simp: invs_if_def Invs_def)\n apply (match premises in \"t = ((_,q),_)\" and H: \"invs q\" for q \\\n \\rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\\)\n apply assumption\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply(simp add: sys_mode_of_def)\n apply(simp add: user_context_of_def)\n done\n\nlemma do_user_op_A_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode;\n ((fst s),None,s_aux) \\ check_active_irq_A_if;\n ((fst t),None,t_aux) \\ check_active_irq_A_if;\n (s_aux,xx,fst s') \\ do_user_op_A_if utf;\n (t_aux,yy,fst t') \\ do_user_op_A_if utf;\n snd s' = (case xx of None \\ InUserMode | Some xxx \\ KernelEntry xxx);\n snd t' = (case yy of None \\ InUserMode | Some yyy \\ KernelEntry yyy)\\ \\\n xx = yy \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(rule do_user_op_A_if_confidentiality, simp+)\n done\n\nlemmas schedule_if_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified, OF schedule_if_reads_respects_g,\n OF _ schedule_if_silc_inv]\n\nlemma part_not_PSched_sys_mode_of_not_KernelSchedule_True:\n \"part s \\ PSched \\ sys_mode_of s \\ KernelSchedule True\"\n apply(erule contrapos_nn)\n apply(simp add: part_def)\n done\n\nlemma kernel_schedule_if_confidentiality:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),(),(fst s')) \\ kernel_schedule_if;\n ((fst t),(),(fst t')) \\ kernel_schedule_if;\n snd s' = snd t'\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=1]] \\ \\speedup\\\n apply(frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply(frule part_not_PSched_sys_mode_of_not_KernelSchedule_True)\n apply(clarsimp simp: kernel_schedule_if_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac u, simp_all)\n apply(frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply(simp split: prod.splits)\n apply(case_tac s', case_tac t')\n apply(simp add: split_paired_all)\n apply(frule_tac s=x2 and t=x2a and s2=x2\n in use_ev[OF schedule_if_reads_respects_f_g\n [where st=s0_internal, OF current_domains_distinct]])\n apply assumption\n apply(clarsimp simp: invs_if_def Invs_def current_aag_def)\n apply(clarsimp simp: invs_if_def Invs_def)\n apply(drule uwr_PSched_cur_domain)\n apply(clarsimp simp: current_aag_def)\n apply simp\n apply fastforce\n apply simp\n apply(rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply(fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply(erule use_valid[OF _ schedule_if_partitionIntegrity[OF current_domains_distinct]])\n apply(clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def silc_inv_refl)\n apply simp\n apply(erule use_valid[OF _ schedule_if_partitionIntegrity[OF current_domains_distinct]])\n apply(clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def silc_inv_refl)\n apply(simp add: sys_mode_of_def)\n apply(simp add: user_context_of_def)\n done\n\nlemma kernel_schedule_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),(),(fst s')) \\ kernel_schedule_if;\n ((fst t),(),(fst t')) \\ kernel_schedule_if;\n snd s' = snd t'\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(blast dest: kernel_schedule_if_confidentiality)\n done\n\nlemma thread_set_tcb_context_update_runnable_globals_equiv:\n \"\\globals_equiv st and st_tcb_at runnable t and invs\\\n thread_set (tcb_arch_update (arch_tcb_context_set uc)) t\n \\\\_. globals_equiv st\\\"\n apply(rule hoare_pre)\n apply(rule thread_set_context_globals_equiv)\n apply clarsimp\n apply(frule invs_valid_idle)\n apply(fastforce simp: valid_idle_def pred_tcb_at_def obj_at_def)\n done\n\nlemma thread_set_tcb_context_update_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_g aag l (st_tcb_at runnable t and invs)\n (thread_set (tcb_arch_update (arch_tcb_context_set uc)) t)\"\n apply(rule equiv_valid_guard_imp)\n apply(rule reads_respects_g)\n apply(rule thread_set_reads_respects[OF domains_distinct])\n apply(rule doesnt_touch_globalsI)\n apply(wp thread_set_tcb_context_update_runnable_globals_equiv)\n apply simp+\n done\n\nlemma thread_set_tcb_context_update_silc_inv:\n \"\\silc_inv aag st\\\n thread_set (tcb_arch_update (arch_tcb_context_set f)) t\n \\\\_. silc_inv aag st\\\"\n apply(rule thread_set_silc_inv_trivial)\n apply(simp add: tcb_cap_cases_def)\n done\n\nlemmas thread_set_tcb_context_update_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified,\n OF thread_set_tcb_context_update_reads_respects_g,\n OF _ thread_set_tcb_context_update_silc_inv]\n\nlemma kernel_entry_if_reads_respects_f_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_f_g aag l (ct_active and silc_inv aag st\n and einvs\n and only_timer_irq_inv irq st'\n and schact_is_rct\n and pas_refined aag\n and pas_cur_domain aag\n and guarded_pas_domain aag\n and K (ev \\ Interrupt \\ \\ pasMaySendIrqs aag))\n (kernel_entry_if ev tc)\"\n apply(simp add: kernel_entry_if_def)\n apply (wp handle_event_reads_respects_f_g\n thread_set_tcb_context_update_reads_respects_f_g\n thread_set_tcb_context_update_silc_inv\n only_timer_irq_inv_pres[where P=\"\\\" and Q=\"\\\"]\n thread_set_invs_trivial\n thread_set_not_state_valid_sched\n thread_set_pas_refined\n | simp add: tcb_cap_cases_def arch_tcb_update_aux2 tcb_arch_ref_def)+\n apply(elim conjE)\n apply(frule (1) ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n apply(clarsimp simp: ct_in_state_def runnable_eq_active)\n apply(rule conjI)\n apply(fastforce dest: requiv_g_cur_thread_eq simp: reads_equiv_f_g_def)\n apply(clarsimp simp: guarded_pas_domain_def)\n apply(fastforce simp: only_timer_irq_inv_def invs_valid_idle\n dest: domains_distinct[THEN pas_domains_distinct_inj])\n done\n\n\nlemma kernel_call_A_if_confidentiality:\n notes active_from_running[simp]\n shows\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_call_A_if e;\n ((fst t),y,(fst t')) \\ kernel_call_A_if e;\n e \\ Interrupt;\n sys_mode_of s = KernelEntry e; sys_mode_of t = KernelEntry e;\n snd s' = f x; snd t' = f y\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=3]] \\ \\speedup\\\n apply(frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply(frule part_not_PSched_sys_mode_of_not_KernelSchedule_True)\n apply(clarsimp simp: kernel_call_A_if_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac u, simp_all)\n apply(frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply(frule_tac s=b and t=ba and s2=b\n in use_ev[OF kernel_entry_if_reads_respects_f_g\n [where st=s0_internal, OF current_domains_distinct]])\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def schact_is_rct_def current_aag_def)\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def schact_is_rct_def\n current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply (simp add: current_aag_def)\n apply simp\n apply fastforce\n apply simp\n apply(rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply(fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply(erule use_valid[OF _ kernel_entry_if_partitionIntegrity])\n apply(clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def\n silc_inv_refl schact_is_rct_def guarded_pas_domain_def\n ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n (* XXX: the conjI is needed here -- metis won't instantiate a schematic var *)\n apply(rule conjI)\n apply (metis the_subject_of_aag_domain)\n apply assumption\n apply simp\n apply(erule use_valid[OF _ kernel_entry_if_partitionIntegrity])\n apply(clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def\n silc_inv_refl schact_is_rct_def guarded_pas_domain_def\n ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n (* XXX: and here *)\n apply(rule conjI)\n apply (metis the_subject_of_aag_domain)\n apply assumption\n apply(simp add: sys_mode_of_def)\n apply(simp add: user_context_of_def)\n done\n\nlemma kernel_call_A_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_call_A_if e;\n ((fst t),y,(fst t')) \\ kernel_call_A_if e;\n e \\ Interrupt;\n sys_mode_of s = KernelEntry e; sys_mode_of t = KernelEntry e;\n snd s' = (case x of True \\ KernelPreempted | _ \\ KernelSchedule False);\n snd t' = (case y of True \\ KernelPreempted | _ \\ KernelSchedule False)\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(blast dest: kernel_call_A_if_confidentiality)\n done\n\nlemma thread_get_tcb_context_reads_respects_g_helper:\n \"equiv_valid_rv_inv (reads_equiv_g aag)\n (affects_equiv aag l)\n (\\rv rv'. arch_tcb_context_get (tcb_arch rv) = arch_tcb_context_get (tcb_arch rv'))\n (\\s. t = idle_thread s \\ is_subject aag t)\n (gets (get_tcb t) >>= assert_opt)\"\n apply(clarsimp simp: equiv_valid_2_def in_monad)\n apply(clarsimp simp: reads_equiv_g_def)\n apply(erule disjE)\n apply(frule globals_equiv_idle_thread_ptr)\n apply(simp)\n apply(simp add: get_tcb_def split: kernel_object.splits option.splits)\n apply(fastforce simp: globals_equiv_def idle_equiv_def)\n apply simp\n apply(fastforce dest: requiv_get_tcb_eq)\n done\n\nlemma thread_get_tcb_context_reads_respects_g:\n \"reads_respects_g aag l\n (\\s. t = idle_thread s \\ is_subject aag t) (thread_get (arch_tcb_context_get o tcb_arch) t)\"\n apply(simp add: thread_get_def gets_the_def)\n apply(simp add: equiv_valid_def2)\n apply(rule_tac W=\"\\ rv rv'. arch_tcb_context_get (tcb_arch rv) = arch_tcb_context_get (tcb_arch rv')\"\n and Q=\"\\\\\"\n in equiv_valid_rv_bind)\n apply(rule thread_get_tcb_context_reads_respects_g_helper)\n apply(rule return_ev2, simp)\n apply(rule hoare_post_taut)\n done\n\n\n(* this is a little more complicated because the context isn't\n guaranteed to be equal when called, so we need an equiv_valid_2\n*)\nlemma kernel_exit_if_reads_respects_g_2:\n \"equiv_valid_2 (reads_equiv_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s))\n (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s))\n (kernel_exit_if tc) (kernel_exit_if tc')\"\n apply(simp add: kernel_exit_if_def)\n apply(fold equiv_valid_def2)\n apply(wp thread_get_tcb_context_reads_respects_g)\n apply(fastforce dest: requiv_g_cur_thread_eq)\n done\n\nlemma reads_respects_f_g_2':\n \"\\equiv_valid_2 (reads_equiv_g aag) (affects_equiv aag l) (affects_equiv aag l) (=) P P' f f';\n \\silc_inv aag st and Q\\ f \\\\_. silc_inv aag st\\;\n \\silc_inv aag st and Q'\\ f' \\\\_. silc_inv aag st\\\\ \\\n equiv_valid_2 (reads_equiv_f_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (silc_inv aag st and P and Q) (silc_inv aag st and P' and Q') f f'\"\n apply(clarsimp simp: equiv_valid_def2 equiv_valid_2_def reads_equiv_f_g_def reads_equiv_g_def)\n apply(rule conjI, fastforce)\n apply(rule conjI, fastforce)\n apply(rule conjI, fastforce)\n apply(subst conj_commute, rule conjI, fastforce)\n apply(rule silc_dom_equiv_trans)\n apply(rule silc_dom_equiv_sym)\n apply(rule silc_inv_silc_dom_equiv)\n apply(erule (1) use_valid, fastforce)\n apply(rule silc_inv_silc_dom_equiv)\n apply(erule (1) use_valid, fastforce)\n done\n\nlemma kernel_exit_if_reads_respects_f_g_2:\n \"equiv_valid_2 (reads_equiv_f_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (silc_inv aag st and (\\s. cur_thread s = idle_thread s\n \\ is_subject aag (cur_thread s)))\n (silc_inv aag st and (\\s. cur_thread s = idle_thread s\n \\ is_subject aag (cur_thread s)))\n (kernel_exit_if tc) (kernel_exit_if tc')\"\n apply(rule equiv_valid_2_guard_imp)\n apply(rule reads_respects_f_g_2'[where Q=\"\\\" and Q'=\"\\\", OF kernel_exit_if_reads_respects_g_2])\n apply(wp | simp | blast)+\n done\n\nlemma use_ev2:\n \"\\equiv_valid_2 I A B R P P' f f'; (rv,s') \\ fst (f s); (rv',t') \\ fst (f' t);\n P s; P' t; I s t; A s t\\ \\\n R rv rv' \\ I s' t' \\ B s' t'\"\n apply(fastforce simp: equiv_valid_2_def)\n done\n\nlemma reads_equiv_f_g_reads_equiv_g:\n \"reads_equiv_f_g aag s t \\ reads_equiv_g aag s t\"\n apply(fastforce simp: reads_equiv_f_g_def reads_equiv_g_def)\n done\n\nlemma reads_equiv_g_ct_running_eq:\n \"\\reads_equiv_g (current_aag bb) bd be; Invs bd; Invs be;\n current_aag bb = current_aag bd\\ \\ ct_running bd = ct_running be\"\n apply(clarsimp simp: reads_equiv_f_g_def)\n apply(clarsimp simp: reads_equiv_g_def)\n apply(frule globals_equiv_idle_thread_ptr)\n apply(frule requiv_cur_thread_eq)\n apply(case_tac \"cur_thread bd = idle_thread bd\")\n apply(simp add: Invs_def)\n apply(elim conjE)\n apply(drule invs_valid_idle)+\n apply(clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def valid_idle_def)\n apply(clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def)\n apply(fastforce simp: Invs_def guarded_pas_domain_def simp: current_aag_def\n dest: is_subject_kheap_eq domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma kernel_exit_A_if_confidentiality:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_exit_A_if;\n ((fst t),y,(fst t')) \\ kernel_exit_A_if;\n sys_mode_of s = KernelExit; sys_mode_of t = KernelExit;\n snd s' = f x; snd t' = f y\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply(clarsimp simp: kernel_exit_A_if_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac u, simp_all)\n apply(frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply(simp split: prod.splits)\n apply(case_tac \"fst s'\", simp)\n apply(case_tac \"fst t'\", simp)\n apply(frule_tac s=x2 and t=x2a and aag1=\"current_aag x2\" in use_ev2[OF kernel_exit_if_reads_respects_f_g_2[where st=s0_internal]])\n apply assumption\n apply(clarsimp simp: invs_if_def Invs_def current_aag_def guarded_pas_domain_def)\n apply(metis the_subject_of_aag_domain)\n apply(clarsimp simp: invs_if_def Invs_def)\n apply(drule uwr_PSched_cur_domain)\n apply(clarsimp simp: current_aag_def guarded_pas_domain_def)\n apply(metis the_subject_of_aag_domain)\n apply simp\n apply fastforce\n apply simp\n apply(elim conjE)\n apply(drule state_unchanged[OF kernel_exit_if_inv])+\n apply(subgoal_tac \"ct_running bb = ct_running bc\")\n apply simp\n apply(rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply (fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply(rule partitionIntegrity_refl)\n apply simp\n apply(rule partitionIntegrity_refl)\n apply(simp add: sys_mode_of_def)\n apply(simp add: user_context_of_def)\n apply(frule_tac bd=bb in reads_equiv_g_ct_running_eq[OF reads_equiv_f_g_reads_equiv_g])\n apply(fastforce simp: invs_if_def)\n apply(fastforce simp: invs_if_def)\n apply(fastforce simp: reads_equiv_f_g_def reads_equiv_def current_aag_def)\n apply simp\n done\n\n\nlemma kernel_exit_A_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_exit_A_if;\n ((fst t),y,(fst t')) \\ kernel_exit_A_if;\n sys_mode_of s = KernelExit; sys_mode_of t = KernelExit;\n snd s' = f x; snd t' = f y\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(blast dest: kernel_exit_A_if_confidentiality)\n done\n\nlemma small_Step_confidentiality_part_not_PSched:\n shows\n \"\\(s, s') \\ Simulation.Step (ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (ADT_A_if utf) ();\n (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (ADT_A_if utf) s0 s;\n system.reachable (ADT_A_if utf) s0 t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply(frule part_equiv)\n apply(frule uwr_part_sys_mode_of_eq, simp+)\n apply(frule_tac s=s in ADT_A_if_reachable_invs_if)\n apply(frule_tac s=t in ADT_A_if_reachable_invs_if)\n apply(frule(2) Step_system.reachable_Step[where s=s, OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply(frule(2) Step_system.reachable_Step[where s=t, OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply(frule_tac s=s' in ADT_A_if_reachable_invs_if)\n apply(frule_tac s=t' in ADT_A_if_reachable_invs_if)\n apply(case_tac \"sys_mode_of s\")\n (* InUserMode *)\n apply((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply(drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u],simp+)\n apply blast\n apply(drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply(drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(ad,bd)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply(drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(ad,bd)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply(drule check_active_irq_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n (* InIdleMode *)\n apply((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply(drule check_active_irq_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\" in check_active_irq_A_if_retval_eq,\n simp+)\n apply(drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\" in check_active_irq_A_if_retval_eq,\n simp+)\n apply(drule check_active_irq_A_if_confidentiality''[\n where s=s and t=t and s'=s' and t'=t' and u=u],simp+)\n (* KernelEntry event -- where event \\ Interrupt *)\n apply(rename_tac event)\n apply(subgoal_tac \"event \\ Interrupt\")\n prefer 2\n apply(case_tac t, simp)\n apply(case_tac event, (fastforce simp: part_def split: if_splits)+)[1]\n apply((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply(drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply(drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply(drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply(drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n (* KernelPreempted *)\n apply(simp add: part_def)\n (* KernelSchedule bool -- where \\ bool *)\n apply((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply(drule kernel_schedule_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n (* KernelExit *)\n apply((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply(drule kernel_exit_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n done\n\nlemma unit_list_as_replicate:\n \"(as::unit list) = replicate (length as) ()\"\n apply(induct as, auto)\n done\n\nlemma unit_lists_unequal:\n \"(as::unit list) \\ (as'::unit list) \\ as < as' \\ as' < as\"\n apply(simp add: less_list_def' strict_prefix_def)\n apply(case_tac \"length as \\ length as'\")\n apply(rule disjI2)\n apply(subst unit_list_as_replicate[where as=as])\n apply(subst unit_list_as_replicate[where as=as'])\n apply (clarsimp simp: prefix_def)\n apply (rule_tac x=\"replicate (length as - length as') ()\" in exI)\n apply(subst replicate_add[symmetric])\n apply simp\n apply(rule disjI1)\n apply(subst unit_list_as_replicate[where as=as])\n apply(subst unit_list_as_replicate[where as=as'])\n apply (clarsimp simp: prefix_def)\n apply(rule_tac x=\"replicate (length as' - length as) ()\" in exI)\n apply(subst replicate_add[symmetric])\n apply simp\n done\n\nlemma partitionIntegrity_part_unchanged:\n \"\\partitionIntegrity aag (internal_state_if s) (internal_state_if s'); part s \\ PSched;\n part s' \\ PSched\\ \\ part s' = part s\"\n apply(simp add: part_def split: if_splits\n add: partition_def partitionIntegrity_def domain_fields_equiv_def)\n done\n\nlemma big_step_R_rtranclp:\n \"system.reachable (big_step_ADT_A_if utf) s0 s\n \\ big_step_R\\<^sup>*\\<^sup>* s0 s\"\n apply(simp add: reachable_def execution_def)\n apply(clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_A_if steps_eq_Run)\n apply(rule Run_big_steps_tranclp)\n apply(simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n done\n\nlemma sub_big_steps_not_PSched_confidentiality_part:\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (t', as) \\ sub_big_steps (ADT_A_if utf) big_step_R t;\n (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n u \\ PSched; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 t; part s \\ PSched\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s) \\\n part s' = part s\"\n apply(frule_tac s=s and t=t and X=\"\\s t. part s \\ PSched \\ ((s, t) \\ uwr PSched \\\n (s, t) \\ uwr (part s) \\ (s, t) \\ uwr u \\\n system.reachable (ADT_A_if utf) s0 s \\\n system.reachable (ADT_A_if utf) s0 t)\"\n in relation_preserved_across_sub_big_steps)\n apply (simp add: small_step_reachable del: split_paired_All)+\n apply(intro impI allI | elim conjE)+\n apply(rename_tac sx tx sx' tx')\n apply(subgoal_tac \"part sx = part s \\ part sx' = part s\")\n apply(frule_tac u=u and s=sx and t=tx in small_Step_confidentiality_part_not_PSched)\n apply(simp add: small_step_reachable)+\n apply(fastforce intro: Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if'',\n rotated])\n apply(elim exE conjE)\n apply(frule part_equiv)\n apply(frule_tac s'=sx in partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply(blast intro: big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply assumption\n apply assumption\n apply assumption\n apply(rule conjI, assumption)\n apply(rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply assumption\n apply(blast intro: big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply assumption\n apply assumption\n apply(rule sub_big_steps_not_PSched)\n apply assumption\n apply(blast intro: big_step_R_rtranclp)\n apply assumption\n apply(frule_tac s'=s' in partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply(blast intro: big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply assumption\n apply assumption\n apply blast\n apply simp\n done\n\n\nlemma sub_big_steps_strict_prefix:\n \"(s', as @ bs) \\ sub_big_steps A R s \\\n \\ t. (t, as) \\ sub_big_steps A R s\"\n apply(induct bs arbitrary: s s' rule: rev_induct)\n apply fastforce\n apply(subst (asm) append_assoc[symmetric])\n apply(drule sub_big_steps_App)\n apply blast\n done\n\nlemma app_Cons:\n \"xs @ (a # b) = (xs @ [a]) @ b\"\n apply simp\n done\n\nlemma uwr_part_sys_mode_of_eq':\n \"\\(s,t) \\ uwr (part x); part s = part x; part t = part x; part x \\ PSched\\\n \\ sys_mode_of s = sys_mode_of t\"\n apply(fastforce intro: uwr_part_sys_mode_of_eq)\n done\n\nlemma sys_mode_of_eq_big_step_R_contradiction:\n \"\\sys_mode_of s = sys_mode_of t; sys_mode_of s' = sys_mode_of t'; big_step_R s s';\n \\ big_step_R t t'\\ \\ False\"\n apply(simp add: big_step_R_def)\n apply(case_tac s, case_tac t, simp_all)\n apply(case_tac s', case_tac t', simp_all)\n apply auto\n done\n\nlemma strict_prefixE'[elim?]:\n assumes \"xs < ys\"\n obtains z zs where \"ys = xs @ z # zs\"\nproof -\n from \\xs < ys\\ obtain us where \"ys = xs @ us\" and \"xs \\ ys\"\n apply(simp add: less_list_def' strict_prefix_def prefix_def)\n apply blast\n done\n with that show ?thesis by (auto simp add: neq_Nil_conv)\nqed\n\nlemma non_PSched_steps_run_in_lock_step':\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (s', t) \\ data_type.Step (ADT_A_if utf) (); big_step_R s t;\n (s'a, asa) \\ sub_big_steps (ADT_A_if utf) big_step_R sa;\n (s'a, ta) \\ data_type.Step (ADT_A_if utf) (); big_step_R sa ta;\n (s, sa) \\ uwr PSched; (s, sa) \\ uwr (part s);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 sa; part s \\ PSched;\n asa < as\\ \\ False\"\n apply(erule strict_prefixE')\n apply(simp, subst (asm) app_Cons)\n apply(drule sub_big_steps_strict_prefix)\n apply(erule exE, rename_tac s'ab)\n apply(frule sub_big_steps_App)\n apply(erule exE, rename_tac s'aa)\n (* s'ab and ta need to be equivalent with respect to part s, which means their\n modes must be equal. The modes between sa and s are equal too,\n which means that big_step_R sa ta and \\ big_step_R s s'ab is a contradiction *)\n apply(elim conjE)\n apply(frule_tac s=sa in sub_big_steps_reachable, simp add: small_step_reachable)\n apply(frule_tac s=s and s'=s'aa in sub_big_steps_reachable, simp add: small_step_reachable)\n apply(frule_tac s=sa and t=s and u=\"part s\" in sub_big_steps_not_PSched_confidentiality_part)\n apply((fastforce simp: uwr_sym dest: part_equiv\n simp: refl_onD[OF policyFlows_refl, simplified])+)[9]\n apply(elim conjE)\n (*apply(simp del: split_paired_All)*)\n apply(frule_tac s=s'aa and t=s'a and u=\"part sa\" in small_Step_confidentiality_part_not_PSched)\n apply((fastforce simp: uwr_sym dest: part_equiv\n simp: refl_onD[OF policyFlows_refl, simplified])+)[9] (* slowish *)\n apply(elim conjE)\n apply(subgoal_tac \"part ta = part s\")\n apply(drule part_equiv)+\n apply(rule_tac s=sa and t=s in sys_mode_of_eq_big_step_R_contradiction)\n apply(fastforce intro: uwr_part_sys_mode_of_eq'[symmetric])\n prefer 2\n apply assumption\n prefer 2\n apply assumption\n apply(fastforce intro: uwr_part_sys_mode_of_eq'[symmetric])\n apply(rule sym)\n apply(rule trans[rotated])\n apply(erule part_equiv)\n apply(rule sym, rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply assumption\n apply(erule big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply simp+\n apply(rule sub_big_steps_not_PSched, assumption)\n apply(erule big_step_R_rtranclp)\n apply simp\n done\n\nlemma non_PSched_steps_run_in_lock_step:\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (s', t) \\ data_type.Step (ADT_A_if utf) (); big_step_R s t;\n (s'a, asa) \\ sub_big_steps (ADT_A_if utf) big_step_R sa;\n (s'a, ta) \\ data_type.Step (ADT_A_if utf) (); big_step_R sa ta;\n (s, sa) \\ uwr PSched; (s, sa) \\ uwr (part s);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 sa;\n part s \\ PSched\\\n \\ asa = as\"\n apply(case_tac \"asa = as\", assumption)\n apply(drule unit_lists_unequal)\n apply(erule disjE)\n apply(drule non_PSched_steps_run_in_lock_step', simp+)\n apply(frule part_equiv[symmetric])\n apply(drule_tac as=asa and asa=as in non_PSched_steps_run_in_lock_step', (simp add: uwr_sym)+)\n done\n\nlemma confidentiality_part_not_PSched:\n \"\\(s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ()\\ \\\n (s, t) \\ uwr PSched \\ (s, t) \\ uwr (part s) \\ (s, t) \\ uwr u \\\n system.reachable (big_step_ADT_A_if utf) s0 s \\\n system.reachable (big_step_ADT_A_if utf) s0 t \\\n (part s, u) \\ policyFlows (pasPolicy initial_aag) \\\n part s \\ PSched \\ u \\ PSched \\\n (s', t') \\ uwr u\"\n apply(simp add: Step_big_step_ADT_A_if)\n apply(erule big_steps.induct)+\n apply(intro impI | elim conjE)+\n apply(subgoal_tac \"asa = as\")\n apply(drule_tac X=\"\\s t. (s, t) \\ uwr PSched \\ (s, t) \\ uwr (part s) \\\n (s, t) \\ uwr u \\\n system.reachable (ADT_A_if utf) s0 s \\\n system.reachable (ADT_A_if utf) s0 t \\\n (part s, u) \\ policyFlows (pasPolicy initial_aag) \\\n part s \\ PSched\" in relation_preserved_across_sub_big_steps)\n apply assumption\n apply(fastforce simp: small_step_reachable)\n apply assumption\n apply(simp del: split_paired_All)\n apply(thin_tac \"(x,y) \\ data_type.Step A b\" for x y A b\n | thin_tac \"big_step_R a b\" for a b)+\n apply(intro allI impI | elim conjE)+\n apply(rename_tac x_s x_t x_s' x_t')\n apply(subgoal_tac \"part x_s' = part x_s\")\n apply(simp del: split_paired_All)\n apply(frule_tac u=u and s=x_s and t=x_t in small_Step_confidentiality_part_not_PSched)\n apply(simp add: small_step_reachable)+\n apply(fastforce intro: Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if'',\n rotated])\n apply(elim exE)\n apply(rule trans)\n apply(rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply blast\n apply(erule big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply simp+\n apply(rule sub_big_steps_not_PSched)\n apply blast\n apply(erule big_step_R_rtranclp)\n apply simp\n apply(rule sym)\n apply(rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply blast\n apply(erule big_step_R_rtranclp)\n apply(erule small_step_reachable)\n apply(simp+)[3]\n apply(elim conjE)\n apply simp\n apply(drule_tac s=s' and t=s'a and u=u in small_Step_confidentiality_part_not_PSched)\n apply (simp+)[10]\n apply(fastforce dest: non_PSched_steps_run_in_lock_step)\n done\n\nlemma getActiveIRQ_ret_no_dmo[wp]:\n \"\\\\_. True\\ getActiveIRQ in_kernel \\\\rv s. \\x. rv = Some x \\ x \\ maxIRQ\\\"\n apply (simp add: getActiveIRQ_def)\n apply(rule hoare_pre)\n apply (insert irq_oracle_max_irq)\n apply (wp alternative_wp select_wp dmo_getActiveIRQ_irq_masks)\n apply clarsimp\n done\n\n\nlemma try_some_magic: \"(\\x. y = Some x \\ P x) = ((\\x. y = Some x) \\ P (the y))\"\nby auto\n\nlemma thread_set_as_user2:\n \"thread_set (tcb_arch_update (arch_tcb_context_set uc)) t\n = as_user t (modify (\\_. uc))\"\nproof -\n have P: \"\\f. det (modify f)\"\n by (simp add: modify_def)\n thus ?thesis\n apply (simp add: as_user_def P thread_set_def)\n apply (clarsimp simp add: select_f_def\n simpler_modify_def\n bind_def image_def\n arch_tcb_update_aux3)\n done\nqed\n\n\nlemma preemption_interrupt_scheduler_invisible:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"equiv_valid_2 (scheduler_equiv aag) (scheduler_affects_equiv aag l)\n (scheduler_affects_equiv aag l) (\\r r'. r = uc \\ snd r' = uc')\n (einvs and pas_refined aag and guarded_pas_domain aag and domain_sep_inv False st and\n silc_inv aag st' and (\\s. irq_masks_of_state st = irq_masks_of_state s) and\n (\\s. ct_idle s \\ uc = idle_context s) and (\\s. \\ reads_scheduler_cur_domain aag l s) and\n guarded_pas_domain aag)\n (einvs and pas_refined aag and guarded_pas_domain aag and domain_sep_inv False st and\n silc_inv aag st' and (\\s. irq_masks_of_state st = irq_masks_of_state s) and\n (\\s. ct_idle s \\ uc' = idle_context s) and (\\s. \\ reads_scheduler_cur_domain aag l s) and\n guarded_pas_domain aag)\n (handle_preemption_if uc)\n (kernel_entry_if Interrupt uc')\"\n apply (simp add: kernel_entry_if_def handle_preemption_if_def)\n apply (rule equiv_valid_2_bind_right)\n apply (rule equiv_valid_2_bind_right)\n apply (simp add: liftE_def bind_assoc)\n apply (simp only: option.case_eq_if)\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (simp add: when_def split del: if_split)\n apply (subst if_swap)\n apply (simp split del: if_split)\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\" and Q=\"\\\\\" and Q'=\"\\\\\"])\n apply (rule return_ev2)\n apply simp\n apply (rule equiv_valid_2)\n apply (wp handle_interrupt_reads_respects_scheduler[where st=st] | simp)+\n apply (rule equiv_valid_2)\n apply (rule dmo_getActive_IRQ_reads_respect_scheduler)\n apply (wp dmo_getActiveIRQ_return_axiom[simplified try_some_magic]\n | simp add: imp_conjR arch_tcb_update_aux2\n | elim conjE\n | intro conjI\n | wp (once) hoare_drop_imps)+\n apply (subst thread_set_as_user2)\n apply (wp guarded_pas_domain_lift)\n apply ((simp add: arch_tcb_update_aux2 | wp | force)+)[7]\n apply (fastforce simp: silc_inv_not_cur_thread cur_thread_idle guarded_pas_domain_def)+\n done\n\n\nlemma handle_preemption_agnostic_tc:\n \"\\P Q uc uc'. \\P\\ handle_preemption_if uc \\\\_. Q\\ \\ \\P\\ handle_preemption_if uc' \\\\_.Q\\\"\n apply (clarsimp simp add: handle_preemption_if_def bind_assoc[symmetric])\n apply (erule bind_return_ign)\n done\n\nlemma handle_preemption_agnostic_ret:\n \"\\\\\\ handle_preemption_if uc' \\\\r s. r = uc'\\\"\n apply (clarsimp simp add: handle_preemption_if_def)\n apply (wp | simp)+\n done\n\n\nlemma handle_preemption_reads_respects_scheduler:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_scheduler aag l (einvs and pas_refined aag and guarded_pas_domain aag and\n domain_sep_inv False st and silc_inv aag st' and\n (\\s. irq_masks_of_state st = irq_masks_of_state s))\n (handle_preemption_if uc)\"\n apply (simp add: handle_preemption_if_def)\n apply (wp when_ev handle_interrupt_reads_respects_scheduler\n dmo_getActiveIRQ_return_axiom[simplified try_some_magic]\n dmo_getActive_IRQ_reads_respect_scheduler | simp add: imp_conjR| wp (once) hoare_drop_imps)+\n apply force\n done\n\nlemmas handle_preemption_reads_respects_scheduler_2 =\n agnostic_to_ev2[OF handle_preemption_agnostic_tc handle_preemption_agnostic_ret\n handle_preemption_reads_respects_scheduler]\n\n\nlemma kernel_entry_scheduler_equiv_2:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"equiv_valid_2 (scheduler_equiv aag) (scheduler_affects_equiv aag l)\n (scheduler_affects_equiv aag l) (\\r r'. snd r = uc \\ snd r' = uc')\n (einvs and pas_refined aag and guarded_pas_domain aag and domain_sep_inv False st and\n silc_inv aag st' and (\\s. irq_masks_of_state st = irq_masks_of_state s) and\n (\\s. ct_idle s \\ uc = idle_context s) and\n (\\s. reads_scheduler_cur_domain aag l s \\ uc = uc'))\n (einvs and pas_refined aag and guarded_pas_domain aag and domain_sep_inv False st and\n silc_inv aag st' and (\\s. irq_masks_of_state st = irq_masks_of_state s) and\n (\\s. ct_idle s \\ uc' = idle_context s) and\n (\\s. reads_scheduler_cur_domain aag l s \\ uc = uc'))\n (kernel_entry_if Interrupt uc) (kernel_entry_if Interrupt uc')\"\n apply (simp add: kernel_entry_if_def)\n apply (simp add: bind_assoc[symmetric])\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (rule_tac P=\"\\\" and P'=\"\\\" in return_ev2)\n apply simp\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (rule equiv_valid_2)\n apply simp\n apply (wp del: no_irq add: handle_interrupt_reads_respects_scheduler[where st=st]\n dmo_getActive_IRQ_reads_respect_scheduler\n | wpc\n | simp add: imp_conjR all_conj_distrib arch_tcb_update_aux2\n | wp (once) hoare_drop_imps)+\n apply (rule context_update_cur_thread_snippit)\n apply (wp thread_set_invs_trivial guarded_pas_domain_lift\n thread_set_pas_refined thread_set_not_state_valid_sched\n | simp add: tcb_cap_cases_def arch_tcb_update_aux2)+\n apply (fastforce simp: silc_inv_not_cur_thread cur_thread_idle)+\n done\n\n(*Probably not needed*)\nlemma kernel_entry_if_reads_respects_scheduler:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"valid_exclusive_state\n \\ reads_respects_scheduler aag l (einvs and pas_refined aag and guarded_pas_domain aag and\n domain_sep_inv False st and silc_inv aag st' and\n (\\s. irq_masks_of_state st = irq_masks_of_state s) and\n (\\s. ct_idle s \\ uc = idle_context s)) (kernel_entry_if Interrupt uc)\"\n apply (simp add: kernel_entry_if_def)\n apply (simp add: bind_assoc[symmetric])\n apply (rule bind_ev_pre)\n apply wp\n apply (rule bind_ev_pre)\n apply ((wp del: no_irq\n add: when_ev handle_interrupt_reads_respects_scheduler[where st=st]\n dmo_getActive_IRQ_reads_respect_scheduler liftE_ev\n | simp add: imp_conjR all_conj_distrib\n | wpc\n | wp (once) hoare_drop_imps)+)[1]\n apply (rule reads_respects_scheduler_cases')\n prefer 3\n apply (rule reads_respects_scheduler_unobservable'')\n apply (( wp thread_set_scheduler_equiv\n | simp add: arch_tcb_update_aux2\n | elim conjE)+)[3]\n apply ((wp | simp add: arch_tcb_update_aux2 | elim conjE)+)[2]\n apply (clarsimp simp: guarded_pas_domain_def disjoint_iff_not_equal)\n apply (( wp thread_set_invs_trivial guarded_pas_domain_lift hoare_vcg_all_lift\n thread_set_pas_refined thread_set_not_state_valid_sched\n | simp add: tcb_cap_cases_def arch_tcb_update_aux2)+)\n apply (clarsimp simp: cur_thread_idle cur_thread_not_SilcLabel)\n apply force\n done\n\nlemma interrupt_step:\n assumes interrupt:\n \"\\r. (r,internal_state_if s')\n \\ fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s))\n \\ sys_mode_of s = KernelEntry Interrupt \\ (sys_mode_of s' = KernelSchedule True)\n \\ snd r = user_context_of s \\ snd r = user_context_of s'\n \\ cur_domain (internal_state_if s') = cur_domain (internal_state_if s) \\ P\"\n assumes preemption:\n \"\\r. (r,internal_state_if s')\n \\ fst (handle_preemption_if (user_context_of s) (internal_state_if s))\n \\ sys_mode_of s = KernelPreempted \\ sys_mode_of s' = KernelSchedule True\n \\ r = user_context_of s \\ r = user_context_of s'\n \\ cur_domain (internal_state_if s') = cur_domain (internal_state_if s) \\ P\"\n shows \"interrupted_modes (sys_mode_of s) \\ (s,s') \\ data_type.Step (ADT_A_if utf) () \\ P\"\n apply (insert interrupt preemption)\n apply atomize\n apply(case_tac s, clarsimp)\n apply(rename_tac uc i_s mode)\n apply(case_tac mode ; clarsimp)\n subgoal for uc i_s\n apply (clarsimp simp: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_call_A_if_def\n kernel_handle_preemption_if_def del: notI)\n apply (frule use_valid[OF _ kernel_entry_context] ; clarsimp)\n apply (frule_tac P1=\"\\x. x = cur_domain i_s\" in use_valid[OF _ kernel_entry_if_cur_domain]\n ; clarsimp)\n done\n subgoal for uc i_s\n apply (clarsimp simp: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_call_A_if_def\n kernel_handle_preemption_if_def del: notI)\n apply (frule use_valid[OF _ handle_preemption_context] ; clarsimp)\n apply (frule_tac P1=\"\\x. x = cur_domain i_s\" in use_valid[OF _ handle_preemption_if_cur_domain]\n ; clarsimp)\n done\n done\n\nlemma irq_masks_constant': \"\\system.reachable (ADT_A_if utf) s0 s1;\n i_s1 = internal_state_if s1\\ \\\n irq_masks_of_state i_s1 = irq_masks_of_state (internal_state_if s0)\"\n apply simp\n\n apply (rule Step_system.reachable_induct[OF ADT_A_if_Step_system,rotated,rotated], rule refl)\n apply (rule trans)\n prefer 2\n apply assumption\n apply (rule ADT_A_if_Step_irq_masks, simp add: Step2)\n apply (rule ADT_A_if_reachable_invs_if,assumption)\n apply simp\n done\n\nlemmas irq_masks_constant = irq_masks_constant'[OF small_step_reachable]\n\nlemma internal_state_s0: \"internal_state_if s0 = s0_internal\"\n apply (simp add: s0_def)\n done\n\n(* FIXME: clarify the following comment *)\n(*Lets pretend PSched is labeled with SilcLabel*)\nfun label_for_partition where\n \"label_for_partition (Partition a) = (OrdinaryLabel a)\"\n | \"label_for_partition PSched = SilcLabel\"\n\nlemma uwr_scheduler_affects_equiv:\n \"\\(s,s') \\ uwr PSched; (s,s') \\ uwr u; invs_if s; invs_if s'\\ \\\n scheduler_equiv initial_aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s)\n (internal_state_if s')\"\n apply (simp add: uwr_def)\n apply (case_tac u)\n apply simp\n apply (rule sameFor_scheduler_affects_equiv)\n apply (simp add: invs_if_def Invs_def)+\n apply (rule context_conjI)\n apply (rule sameFor_scheduler_equiv,simp+)\n apply (rule SilcLabel_affects_scheduler_equiv)\n apply (rule sameFor_scheduler_equiv,simp)\n done\n\nlemma scheduler_affects_equiv_uwr:\n assumes schedeq:\n \"scheduler_equiv initial_aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s)\n (internal_state_if s')\"\n assumes imodes: \"interrupted_modes (sys_mode_of s) = interrupted_modes (sys_mode_of s')\"\n assumes smodes: \"scheduler_modes (sys_mode_of s) = scheduler_modes (sys_mode_of s')\"\n assumes dom_context:\"\n (reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \\\n (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of s') \\\n sys_mode_of s = sys_mode_of s')\"\n shows \"(s,s') \\ uwr u\"\n apply (case_tac u)\n prefer 2\n apply simp\n apply (simp add: uwr_def)\n apply (rule schedule_reads_affects_equiv_sameFor_PSched')\n apply (simp add: schedeq imodes smodes)+\n apply (insert schedeq dom_context)\n apply (case_tac \"reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\")\n apply simp\n apply (frule_tac s=\"internal_state_if s\" and mode=\"sys_mode_of s\" and uc=\"user_context_of s\"\n and uc'=\"user_context_of s'\" and aag=\"initial_aag\"\n in schedule_reads_affects_equiv_sameFor,\n simp)\n apply (simp add: uwr_def user_context_of_def sys_mode_of_def)\n apply (case_tac s)\n apply fastforce\n apply simp\n apply (clarsimp simp: scheduler_equiv_def scheduler_affects_equiv_def sameFor_def\n sameFor_subject_def uwr_def silc_dom_equiv_def reads_scheduler_def\n domain_fields_equiv_def\n intro: globals_equiv_from_scheduler\n split: if_split_asm)\n apply (case_tac s)\n apply clarsimp\n apply (case_tac s')\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply metis\n done\n\n\nlemma cur_domain_reads:\n \"(s,s') \\ uwr u \\\n reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \\\n (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of s') \\\n sys_mode_of s = sys_mode_of s'\"\n apply (case_tac u)\n apply (auto simp: reads_scheduler_def uwr_def sameFor_def sameFor_subject_def)\n done\n\nlemmas domain_can_read_context = cur_domain_reads[THEN conjunct1]\nlemmas domain_can_read_context' = cur_domain_reads[OF uwr_sym, THEN conjunct1]\n\nlemmas domain_can_read_sys_mode = cur_domain_reads[THEN conjunct2]\nlemmas domain_can_read_sys_mode' = cur_domain_reads[OF uwr_sym, THEN conjunct2]\n\nlemma scheduler_step_1_confidentiality:\n notes blob = invs_if_def Invs_def sys_mode_of_def\n silc_inv_cur pas_refined_cur guarded_pas_domain_cur internal_state_s0\n domain_can_read_context domain_can_read_context'\n domain_can_read_sys_mode'[simplified sys_mode_of_def]\n domain_can_read_sys_mode[simplified sys_mode_of_def]\n\n assumes uwr: \"(s,t) \\ uwr PSched\" \"(s,t) \\ uwr u\"\n assumes step_s: \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes step_t: \"(t,t') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes reach_s: \"system.reachable (ADT_A_if utf) s0 s\"\n assumes reach_t: \"system.reachable (ADT_A_if utf) s0 t\"\n shows \"\\interrupted_modes (sys_mode_of s)\\ \\\n (s',t') \\ uwr u\"\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply (insert uwr step_s step_t)\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_s])\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_t])\n apply (cut_tac irq_masks_constant'[OF reach_s, OF refl])\n apply (cut_tac irq_masks_constant'[OF reach_t, OF refl])\n apply (subgoal_tac \"interrupted_modes (sys_mode_of t)\")\n apply (rule_tac s=s and s'=s' in interrupt_step,simp_all)\n apply (rule_tac s=t and s'=t' in interrupt_step,simp_all)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF kernel_entry_scheduler_equiv_2[\n where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and l=\"label_for_partition u\",\n OF domains_distinct]],\n assumption,assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule\n equiv_valid_2E[\n where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF ev2_sym[\n where R'=\"\\r r'. r' = user_context_of t \\ snd r = user_context_of s\",\n OF _ _ _ _\n preemption_interrupt_scheduler_invisible[\n where aag=\"initial_aag\" and st=\"s0_internal\" and st'=\"s0_internal\" and\n uc=\"user_context_of t\" and uc'=\"user_context_of s\" and\n l=\"label_for_partition u\",\n OF domains_distinct],\n OF scheduler_equiv_sym scheduler_affects_equiv_sym scheduler_affects_equiv_sym,\n simplified]])\n apply (fastforce+)[2]\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n (* FIXME: manual frule *)\n apply (clarsimp simp: blob)\n (* this restores normal form for reads_scheduler_cur_domain *)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context[where u = u])\n apply (frule domain_can_read_context'[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def])\n apply force\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context'[where u = u])\n apply (frule domain_can_read_context[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def])\n apply force\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule_tac s=t and s'=t' in interrupt_step,simp_all)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF preemption_interrupt_scheduler_invisible\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and uc=\"user_context_of s\"\n and l=\"label_for_partition u\",\n OF domains_distinct]],\n assumption,assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n (* FIXME: also clean up here *)\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context[where u = u])\n apply (frule domain_can_read_context'[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def])\n apply force\n (* FIXME: and here *)\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context'[where u = u])\n apply (frule domain_can_read_context[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def])\n apply force\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF handle_preemption_reads_respects_scheduler_2\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and l=\"label_for_partition u\",\n OF domains_distinct]],\n assumption,assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (clarsimp simp add: sameFor_def sameFor_scheduler_def uwr_def)\n done\n\nlemma schedule_if_context: \"\\\\\\ schedule_if tc \\\\r s. r = tc\\\"\n apply (simp add: schedule_if_def)\n apply (wp | simp)+\n done\n\n\n\n\nlemma schedule_step:\n assumes schedule:\n \"\\r. (r,internal_state_if s') \\ fst (schedule_if (user_context_of s) (internal_state_if s))\n \\ (sys_mode_of s' = KernelExit) \\ r = user_context_of s \\ r = user_context_of s' \\ P\"\n shows \"(sys_mode_of s) = KernelSchedule True \\ (s,s') \\ data_type.Step (ADT_A_if utf) () \\ P\"\n apply (insert schedule)\n apply atomize\n apply(case_tac s, clarsimp)\n apply(rename_tac uc i_s)\n apply (simp_all add: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_schedule_if_def\n | safe |clarsimp)+\n apply (frule use_valid[OF _ schedule_if_context],simp+)+\n done\n\n\n\nlemma schedule_if_reads_respects_scheduler:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"reads_respects_scheduler aag l\n (einvs and pas_refined aag and silc_inv aag st and guarded_pas_domain aag and\n tick_done)\n (schedule_if uc)\"\n apply (simp add: schedule_if_def)\n apply (wp schedule_reads_respects_scheduler\n schedule_guarded_pas_domain)\n apply fastforce\n done\n\nlemma schedule_if_agnostic_tc:\n \"\\P Q uc uc'. \\P\\ schedule_if uc \\\\_. Q\\ \\ \\P\\ schedule_if uc' \\\\_.Q\\\"\n apply (clarsimp simp add: schedule_if_def bind_assoc[symmetric])\n apply (erule bind_return_ign)\n done\n\n\nlemmas schedule_if_reads_respects_scheduler_2 =\n agnostic_to_ev2[OF schedule_if_agnostic_tc schedule_if_context\n schedule_if_reads_respects_scheduler]\n\n\n\nlemma scheduler_step_2_confidentiality:\n notes blob = invs_if_def Invs_def sys_mode_of_def silc_inv_cur pas_refined_cur\n guarded_pas_domain_cur internal_state_s0 tick_done_def\n assumes uwr: \"(s,t) \\ uwr PSched\" \"(s,t) \\ uwr u\"\n assumes step_s: \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes step_t: \"(t,t') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes reach_s: \"system.reachable (ADT_A_if utf) s0 s\"\n assumes reach_t: \"system.reachable (ADT_A_if utf) s0 t\"\n shows \"\\ (sys_mode_of s) = KernelSchedule True;\n (sys_mode_of t) = KernelSchedule True\\ \\\n (s',t') \\ uwr u\"\n apply (insert uwr step_s step_t)\n apply (rule_tac s=s and s'=s' in schedule_step,simp_all)\n apply (rule_tac s=t and s'=t' in schedule_step,simp_all)\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_s])\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_t])\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF schedule_if_reads_respects_scheduler_2\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and l=\"label_for_partition u\",\n OF domains_distinct]],\n assumption,assumption)\n apply (rule uwr_scheduler_affects_equiv,simp+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n done\n\nlemma step_from_interrupt_to_schedule:\n \"\\(s', evs) \\ sub_big_steps (ADT_A_if utf) big_step_R s; evs \\ [];\n interrupted_modes (sys_mode_of s)\\ \\\n (s,s') \\ data_type.Step (ADT_A_if utf) () \\ (sys_mode_of s') = KernelSchedule True\"\n apply (induct rule: sub_big_steps.induct)\n apply simp\n apply (case_tac \"evlist'\")\n apply simp\n apply (erule sub_big_steps.cases)\n apply simp\n apply (erule interrupt_step[rotated,rotated],assumption)\n apply ((simp add: big_step_R_def sys_mode_of_def)+)[2]\n apply simp\n apply simp\n apply (elim conjE)\n apply (erule schedule_step[rotated],assumption)\n apply (simp add: big_step_R_def sys_mode_of_def)\n done\n\n\nlemma scheduler_steps:\n assumes big_step: \"(s,s'') \\ data_type.Step (big_step_ADT_A_if utf) ()\"\n assumes interrupted: \"part s = PSched\"\n obtains s' where \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n \"sys_mode_of s' = KernelSchedule True\"\n \"(s',s'') \\ data_type.Step (ADT_A_if utf) ()\"\n apply (insert big_step interrupted)\n apply (simp add: Step_big_step_ADT_A_if)\n apply (simp add: big_steps.simps)\n apply clarsimp\n apply (subgoal_tac \"interrupted_modes (sys_mode_of s)\")\n prefer 2\n apply (clarsimp simp add: big_step_R_def part_def sys_mode_of_def split: if_split_asm)\n apply (case_tac \"snd s\",simp_all)\n apply (case_tac \"as = []\")\n\n apply (erule sub_big_steps.cases)\n apply simp\n apply (erule interrupt_step[rotated,rotated],assumption)\n apply ((simp add: big_step_R_def sys_mode_of_def)+)[3]\n apply (frule step_from_interrupt_to_schedule)\n by clarsimp+\n\n\nlemma reachable_tranclp_R:\n assumes b:\"system.reachable (big_step_ADT_A_if utf) s0 s\"\n shows \"big_step_R\\<^sup>*\\<^sup>* s0 s\"\n (* repeated lemma *)\n by (rule big_step_R_rtranclp[OF b])\n\nlemma PSched_reachable_interrupted: \"part s = PSched \\\n system.reachable (big_step_ADT_A_if utf) s0 s \\\n interrupted_modes (sys_mode_of s)\"\n apply (drule reachable_tranclp_R)\n apply (drule tranclp_s0)\n apply (clarsimp simp add: part_def sys_mode_of_def split: if_split_asm)\n done\n\nlemma confidentiality_part_sched_transition:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s = PSched\\ \\\n (s', t') \\ uwr u\"\n apply (frule part_equiv)\n apply (case_tac \"part s = PSched\")\n apply simp\n apply (erule scheduler_steps,assumption+)\n apply (erule scheduler_steps,simp)\n apply (frule(3) scheduler_step_1_confidentiality[where u=PSched])\n apply (erule small_step_reachable)+\n apply (rule PSched_reachable_interrupted,simp+)\n apply (frule(3) scheduler_step_1_confidentiality[where u=u])\n apply (erule small_step_reachable)+\n apply (rule PSched_reachable_interrupted,simp+)\n apply (frule_tac s=\"s'a\" and t=\"s'aa\" and u=u in scheduler_step_2_confidentiality,\n assumption,assumption,assumption)\n apply (rule Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (erule small_step_reachable,simp)\n apply (erule small_step_reachable)\n apply (rule Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (erule small_step_reachable,simp)\n apply (erule small_step_reachable)\n apply simp+\n done\n\n\n(*If we're starting a non_schedule partition then we must have just\n exited*)\nlemma reachable_nonsched_exit: \"system.reachable (big_step_ADT_A_if utf) s0 s \\\n part s \\ PSched \\ (snd s) = KernelExit\"\n apply (drule reachable_tranclp_R)\n apply (drule tranclp_s0)\n apply (clarsimp simp add: part_def split: if_split_asm)\n apply (case_tac s)\n apply simp\n apply (simp add: sys_mode_of_def)\n apply (case_tac b)\n apply simp+\n done\n\n\n\nlemma silc_dom_equiv_current_aag:\n \"silc_dom_equiv (current_aag s) st s' = silc_dom_equiv initial_aag st s'\"\n apply (simp add: silc_dom_equiv_def pasObjectAbs_current_aag)\n done\n\n\n\nlemma confidentiality_for_sched:\n \"\\(s, t) \\ uwr PSched;\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n part s \\ PSched\\ \\\n (s', t') \\ uwr PSched\"\n apply (frule part_equiv)\n apply (frule_tac s=s in reachable_nonsched_exit,assumption)\n apply (frule_tac s=t in reachable_nonsched_exit,simp)\n apply (frule_tac s=s and s'=s' in Step_partitionIntegrity,simp+)\n apply (frule_tac s=t and s'=t' in Step_partitionIntegrity,simp+)\n apply (simp add: uwr_def sameFor_def)\n apply (simp add: sameFor_scheduler_def)\n apply clarsimp\n apply (case_tac s')\n apply clarsimp\n apply (case_tac t')\n apply clarsimp\n apply (clarsimp simp add: partitionIntegrity_def)\n apply (rule conjI)\n apply (metis domain_fields_equiv_sym domain_fields_equiv_trans)\n apply (rule conjI)\n apply (metis globals_equiv_scheduler_sym globals_equiv_scheduler_trans)\n apply (rule conjI)\n apply (fold silc_dom_equiv_def)\n apply (simp add: silc_dom_equiv_current_aag)\n apply (metis silc_dom_equiv_sym silc_dom_equiv_trans)\n apply (rule conjI)\n apply (rule trans)\n apply (rule sym)\n apply (rule_tac ?s1.0=\"((a, b), KernelExit)\" in big_step_irq_state_next_irq)\n apply (simp add: reachable_invs_if)\n apply (simp add: big_step_R_rtranclp)\n apply simp+\n apply (subgoal_tac \"irq_masks_of_state b = irq_masks_of_state bb\")\n apply simp\n apply (rule_tac ?s1.0=\"((aa, bb), KernelExit)\" in big_step_irq_state_next_irq)\n apply (simp add: reachable_invs_if)\n apply (simp add: big_step_R_rtranclp)\n apply simp+\n apply (rule trans)\n apply (rule irq_masks_constant,assumption,fastforce)\n apply (rule sym)\n apply (rule irq_masks_constant,assumption,fastforce)\n apply (simp add: Step_big_step_ADT_A_if)\n apply (erule big_stepsE)\n apply (erule big_stepsE)\n apply (simp add: big_step_R_def)\n apply (case_tac baa,simp_all)\n apply (case_tac bca,simp_all)\n apply (case_tac bca,simp_all)\n done\n\n\n\nlemma confidentiality_part:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n u = PSched \\ part s = PSched\\ \\\n (s', t') \\ uwr u\"\n apply (frule part_equiv)\n apply (case_tac \"part s = PSched\")\n apply(fastforce intro: confidentiality_part_sched_transition)\n apply(fastforce intro: confidentiality_part_not_PSched[rule_format])\n done\n\nlemma big_Step2:\n \"(s,s') \\ system.Step (big_step_ADT_A_if utf) u \\\n (s,s') \\ Simulation.Step (big_step_ADT_A_if utf) u\"\n apply(simp add: system.Step_def execution_def big_step_ADT_A_if_def big_step_adt_def\n ADT_A_if_def steps_def)\n apply blast\n done\n\nlemma confidentiality_u:\n notes split_paired_All[simp del]\n shows\n \"ni.confidentiality_u\"\n apply(simp add: ni.confidentiality_u_def | intro allI impI | elim conjE)+\n apply(case_tac \"(part s, u) \\ policyFlows (pasPolicy initial_aag)\")\n apply(simp)\n apply(fastforce intro: confidentiality_part schedNotGlobalChannel simp: big_Step2)\n apply(case_tac \"u = PSched\")\n apply(subgoal_tac \"part s \\ PSched\")\n apply(blast intro: confidentiality_for_sched big_Step2)\n apply(fastforce intro: policyFlows_refl[THEN refl_onD])\n apply(metis integrity_part ni.uwr_sym ni.uwr_trans ni.schedIncludesCurrentDom not_PSched big_Step2)\n done\n\n(* TOPLEVEL *)\nlemma nonleakage:\n \"ni.Nonleakage_gen\"\n apply(rule Nonleakage_gen[OF confidentiality_u])\n done\n\n\n(* TOPLEVEL *)\nlemma xnonleakage:\n \"ni.xNonleakage_gen\"\n apply(rule xNonleakage_gen[OF confidentiality_u])\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/infoflow/Noninterference.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.34510528442897664, "lm_q1q2_score": 0.19135068751763518}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_on_inv__6.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_on_inv__6 imports n_germanSymIndex_base\nbegin\nsection{*All lemmas on causal relation between inv__6 and some rule r*}\nlemma n_SendInv__part__0Vsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const I))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv0) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__6:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv0) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__6:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__6:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_on_inv__6.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3738758227716966, "lm_q1q2_score": 0.19131846660970886}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__35_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__35_on_rules imports n_germanSimp_lemma_on_inv__35\nbegin\nsection{*All lemmas on causal relation between inv__35*}\nlemma lemma_inv__35_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__35) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__35_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.37387582277169656, "lm_q1q2_score": 0.19131846660970883}} {"text": "theory Unreachability_Misc\n imports\n Simulation_Graphs_Certification\n Worklist_Algorithms.Leadsto_Impl\n TA_Library.Printing\n TA_Library.Imperative_Loops\n TA_Library.Trace_Timing\nbegin\n\nparagraph \\Misc\\\n\ntheorem (in -) arg_max_nat_lemma2:\n fixes f :: \"'a \\ nat\"\n assumes \"P k\"\n and \"finite (Collect P)\"\n shows \"P (arg_max f P) \\ (\\y. P y \\ f y \\ f (arg_max f P))\"\nproof -\n let ?b = \"Max (f ` Collect P) + 1\"\n from assms(2) have \"\\y. P y \\ f y < ?b\"\n by (auto intro: Max_ge le_imp_less_Suc)\n with assms(1) show ?thesis\n by (rule arg_max_nat_lemma)\nqed\n\nparagraph \\Misc \\heap\\\\\n\nlemma hoare_triple_success:\n assumes \"

c \" and \"(h, as) \\ P\"\n shows \"success c h\"\n using assms unfolding hoare_triple_def Let_def success_def\n by (cases \"execute c h\") (force simp: run.simps)+\n\nlemma run_return: \"run (return x) (Some h) (Some h) x\" for h\n by (auto simp: execute_simps intro: run.regular)\n\nlemma return_htD:\n assumes \" return x \"\n shows \"Q x \\\\<^sub>A PP x\"\n using assms unfolding hoare_triple_def Let_def by (force intro: run_return entailsI)\n\ndefinition run_heap :: \"'a Heap \\ 'a\" where\n \"run_heap h = fst (the (execute h Heap.empty))\"\n\ncode_printing constant run_heap \\ (SML) \"(fn f => f ()) _\"\ncode_printing constant run_heap \\ (OCaml) \"(fun f -> f ()) _\"\n\ndefinition run_map_heap :: \"('a \\ 'b Heap) \\ 'a list \\ 'b list\" where\n \"run_map_heap f xs = map (run_heap o f) xs\"\n\nlemma hoare_triple_executeD:\n assumes \" c <\\r. \\(P r)>\\<^sub>t\"\n shows \"P (fst (the (execute c h)))\"\nproof -\n have \"(h, {}) \\ emp\"\n by simp\n with assms(1) have \"success c h\"\n by (rule hoare_triple_success)\n then obtain r h' where \"execute c h = Some (r, h')\"\n unfolding success_def by auto\n then have \"run c (Some h) (Some h') r\"\n by (intro regular) auto\n with \\execute c h = _\\ show ?thesis\n using assms unfolding hoare_triple_def by (force intro: mod_emp_simp)\nqed\n\nlemma hoare_triple_run_heapD:\n assumes \" c <\\r. \\(P r)>\\<^sub>t\"\n shows \"P (run_heap c)\"\n using hoare_triple_executeD[OF assms] unfolding run_heap_def .\n\nlemma list_all2_conjI:\n assumes \"list_all2 P as bs\" \"list_all2 Q as bs\"\n shows \"list_all2 (\\a b. P a b \\ Q a b) as bs\"\n using assms unfolding list_all2_conv_all_nth by auto\n\nlemma hoare_triple_run_map_heapD:\n assumes \"list_all (\\x. c x <\\r. \\(P x r)>\\<^sub>t) xs\"\n shows \"list_all2 P xs (run_map_heap c xs)\"\n using assms unfolding run_map_heap_def list_all2_map2 list.pred_rel\n by (elim list_all2_mono) (auto simp: eq_onp_def intro: hoare_triple_run_heapD)\n\nlemma hoare_triple_run_map_heapD':\n assumes \"list_all2 (\\x xi. c xi <\\r. \\(P x r)>\\<^sub>t) xs xsi\"\n shows \"list_all2 P xs (run_map_heap c xsi)\"\n using assms unfolding run_map_heap_def list_all2_map2 list.pred_rel\n by (elim list_all2_mono) (auto simp: eq_onp_def intro: hoare_triple_run_heapD)\n\ndefinition\n \"parallel_fold_map = Heap_Monad.fold_map\"\n\n\n(* definition\n \"ht_refine \\ c \\' R m \\ nofail m \\ (\\h. success \\ <\\> c <\\r. \\' * (\\\\<^sub>Ax. R x r * \\ (RETURN x \\ m))>\\<^sub>t\" *)\n\n\n\nparagraph \\Misc \\nres\\\\\n\nlemma SUCCEED_lt_RES_iff[simp]:\n \"SUCCEED < RES S \\ S \\ {}\"\n unfolding bot_nres_def by (subst less_nres.simps) auto\n\nlemma SUCCEED_lt_RETURN[intro, simp]:\n \"SUCCEED < RETURN x\"\n unfolding RETURN_def by simp\n\nlemma SUCCEED_lt_FAIL[intro, simp]:\n \"SUCCEED < FAIL\"\n unfolding bot_nres_def top_nres_def by (subst less_nres.simps) auto\n\nlemma bind_RES_gt_SUCCEED_I:\n assumes \"\\s. f s > SUCCEED\" \"S \\ {}\"\n shows \"do {x \\ RES S; f x} > SUCCEED\"\n by (metis RES_bind_choose assms(1) assms(2) le_less preorder_class.less_le_not_le set_notEmptyE)\n\n\nparagraph \\Monadic \\list_all\\ and \\list_ex\\\\\n\ndefinition\n \"monadic_list_all P xs \\ nfoldli xs id (\\x _. P x) True\"\n\ntext \\Debug version\\\ndefinition\n \"monadic_list_all_fail P xs \\\n nfoldli xs (\\x. x = None) (\\x _. do {b \\ P x; RETURN (if b then None else Some x)}) None\"\n\nlemma monadic_list_all_fail_alt_def:\n \"monadic_list_all_fail P xs =\n nfoldli xs (\\x. x = None) (\\x _. do {\n b \\ P (COPY x); if b then RETURN None else RETURN (Some x)}) None\"\n unfolding monadic_list_all_fail_def\n apply (intro arg_cong2[where f = \"nfoldli xs (\\x. x = None)\"] ext)\napply simp\n apply (rule bind_cong)\n apply auto\n done\n\ndefinition\n \"monadic_list_all_fail' P xs \\\n nfoldli xs (\\x. x = None) (\\x _. do {\n r \\ P x; RETURN (case r of None \\ None | Some r \\ Some r)})\n None\"\n\nlemma monadic_list_all_fail'_alt_def:\n \"monadic_list_all_fail' P xs =\n nfoldli xs (\\x. x = None) (\\x _. do {\n r \\ P x; case r of None \\ RETURN None | Some r \\ RETURN (Some r)})\n None\"\n unfolding monadic_list_all_fail'_def\n apply (intro arg_cong2[where f = \"nfoldli xs (\\x. x = None)\"] ext)\n apply simp\n apply (rule bind_cong)\n apply (auto split: option.splits)\n done\n\nlemma monadic_list_all_fail_monadic_list_all_fail':\n \"monadic_list_all_fail P xs =\n monadic_list_all_fail' (\\x. do {b \\ P x; RETURN (if b then None else Some x)}) xs\"\n unfolding monadic_list_all_fail_def monadic_list_all_fail'_def\n apply (intro arg_cong2[where f = \"nfoldli xs (\\x. x = None)\"] ext)\n apply simp\n apply (rule bind_cong)\n apply auto\n done\n\nlemma monadic_list_all_rule:\n assumes \"\\x. Pi x \\ SPEC (\\r. r = P x)\"\n shows \"monadic_list_all Pi xs \\ SPEC (\\r. r \\ list_all P xs)\"\n using assms unfolding monadic_list_all_def\n by (intro nfoldli_rule[where I = \"\\as bs b. b = list_all P as \\ set (as @ bs) = set xs\"]) auto\n\ndefinition\n \"monadic_list_ex P xs \\ nfoldli xs Not (\\x _. P x) False\"\n\nlemma monadic_list_ex_rule:\n assumes \"\\x. Pi x \\ SPEC (\\r. r = P x)\"\n shows \"monadic_list_ex Pi xs \\ SPEC (\\r. r \\ list_ex P xs)\"\n using assms unfolding monadic_list_ex_def\n by (intro nfoldli_rule[where I = \"\\as bs b. b = list_ex P as \\ set (as @ bs) = set xs\"]) auto\n\nlemma monadic_list_ex_empty[simp]:\n \"monadic_list_ex P [] = RETURN False\"\n unfolding monadic_list_ex_def by simp\n\nlemma monadic_list_all_empty[simp]:\n \"monadic_list_all P [] = RETURN True\"\n unfolding monadic_list_all_def by simp\n\nlemma monadic_list_all_False: \"monadic_list_all (\\x. RETURN False) xs = RETURN (xs = [])\"\n by (cases xs) (auto simp: monadic_list_all_def)\n\nlemma monadic_list_all_RETURN:\n \"monadic_list_all (\\x. RETURN (P x)) xs = RETURN (list_all P xs)\"\nproof (induction xs)\n case Nil\n then show ?case\n by auto\nnext\n case (Cons x xs)\n then show ?case\n by (cases \"P x\") (auto simp: monadic_list_all_def)\nqed\n\nlemma monadic_list_ex_RETURN:\n \"monadic_list_ex (\\x. RETURN (P x)) xs = RETURN (list_ex P xs)\"\nproof (induction xs)\n case Nil\n then show ?case\n by auto\nnext\n case (Cons x xs)\n then show ?case\n by (cases \"P x\") (auto simp: monadic_list_ex_def)\nqed\n\nlemma monadic_list_ex_RETURN_mono:\n assumes \"set xs = set ys\"\n shows \"monadic_list_ex (\\s. RETURN (P s)) xs \\ monadic_list_ex (\\s. RETURN (P s)) ys\"\n using assms by (simp add: monadic_list_ex_RETURN list_ex_iff)\n\ncontext\n fixes xs and g :: \"_ \\ bool nres\"\n assumes g_gt_SUCCEED: \"\\x. x \\ set xs \\ g x > SUCCEED\"\nbegin\n\nprivate lemma nfoldli_gt_SUCCEED: \"nfoldli xs c (\\x _. g x) a > SUCCEED\" for a c\n using g_gt_SUCCEED\nproof (induction xs arbitrary: a)\n case (Cons x xs)\n then show ?case\n by (cases \"g x\"; force intro: bind_RES_gt_SUCCEED_I simp: monadic_list_all_def)\nqed simp\n\nlemma monadic_list_all_gt_SUCCEED:\n \"monadic_list_all g xs > SUCCEED\"\n using nfoldli_gt_SUCCEED unfolding monadic_list_all_def .\n\nlemma monadic_list_ex_gt_SUCCEED:\n \"monadic_list_ex g xs > SUCCEED\"\n using nfoldli_gt_SUCCEED unfolding monadic_list_ex_def .\n\nend (* Anonymous context *)\n\nlemma monadic_list_ex_is_RETURN:\n \"\\ r. monadic_list_ex (\\x. RETURN (P x)) xs = RETURN r\"\nproof (induction xs)\n case Nil\n then show ?case\n by auto\nnext\n case (Cons x xs)\n then show ?case\n by (cases \"P x\") (auto simp: monadic_list_ex_def)\nqed\n\nlemma monadic_list_all_list_ex_is_RETURN:\n \"\\r. monadic_list_all (\\x. monadic_list_ex (\\y. RETURN (P x y)) ys) xs = RETURN r\"\nproof -\n let ?f = \"\\x. SOME r. monadic_list_ex (\\y. RETURN (P x y)) ys = RETURN r\"\n have \"monadic_list_all (\\x. monadic_list_ex (\\y. RETURN (P x y)) ys) xs\n = monadic_list_all (\\x. RETURN (?f x)) xs\"\n by (fo_rule arg_cong2; intro HOL.refl monadic_list_ex_is_RETURN ext someI_ex)\n then show ?thesis\n by (simp add: monadic_list_all_RETURN)\nqed\n\nlemma monadic_list_all_mono[refine_mono]:\n \"monadic_list_all P xs \\ monadic_list_all Q xs\" if \"\\ x \\ set xs. P x \\ Q x\"\nproof -\n have \"nfoldli xs id (\\x _. P x) a \\ nfoldli xs id (\\x _. Q x) a\" for a\n using that by (induction xs arbitrary: a; clarsimp; refine_mono)\n then show ?thesis\n unfolding monadic_list_all_def .\nqed\n\nlemma monadic_list_ex_mono[refine_mono]:\n \"monadic_list_ex P xs \\ monadic_list_ex Q xs\" if \"\\ x \\ set xs. P x \\ Q x\"\nproof -\n have \"nfoldli xs Not (\\x _. P x) a \\ nfoldli xs Not (\\x _. Q x) a\" for a\n using that by (induction xs arbitrary: a; clarsimp; refine_mono)\n then show ?thesis\n unfolding monadic_list_ex_def .\nqed\n\n\nparagraph \\Abstract \\nres\\ algorithm\\\n\ncontext Reachability_Invariant_paired_defs\nbegin\n\ncontext\n fixes P :: \"('l \\ 's) \\ bool\"\nbegin\n\ndefinition \"check_prop \\\ndo {\n xs \\ SPEC (\\xs. set xs = PR_CONST L);\n monadic_list_all (\\l. do {\n xs \\ SPEC (\\xs. set xs = PR_CONST M l);\n monadic_list_all (\\s. RETURN (PR_CONST P (l, s))) xs\n }\n ) xs\n}\"\n\nlemma check_prop_correct:\n \"check_prop \\ SPEC (\\r. r \\ (\\l \\ L. \\s \\ M l. P (l, s)))\"\n unfolding check_prop_def\n by (refine_vcg monadic_list_all_rule monadic_list_ex_rule) (auto simp: list_all_iff)\n\nend\n\nend\n\n\nlocale Reachability_Impl_base =\n Unreachability_Invariant_paired_pre_defs where E = E for E :: \"'l \\ 's \\ _\" +\n fixes succs :: \"'l \\ 's set \\ ('l \\ 's set) list\"\n assumes succs_correct:\n \"\\l. \\s \\ xs. P (l, s)\n \\ {(l', s')| l' ys s'. (l', ys) \\ set (succs l xs) \\ s' \\ ys}\n = (\\ s \\ xs. Collect (E (l, s)))\"\n\nlocale Reachability_Impl_invariant =\n Reachability_Impl_base where E = E +\n Unreachability_Invariant_paired_defs where E = E for E :: \"'l \\ 's \\ _\"\nbegin\n\ndefinition \"check_invariant L' \\\ndo {\n monadic_list_all (\\l.\n do {\n let as = M l;\n let succs = succs l as;\n monadic_list_all (\\(l', xs).\n do {\n xs \\ SPEC (\\xs'. set xs' = xs);\n if xs = [] then RETURN True else do {\n b1 \\ RETURN (l' \\ L);\n ys \\ SPEC (\\xs. set xs = M l');\n b2 \\ monadic_list_all (\\x.\n monadic_list_ex (\\y. RETURN (x \\ y)) ys\n ) xs;\n RETURN (b1 \\ b2)\n }\n }\n ) succs\n }\n ) L'\n}\n\"\n\ndefinition\n \"check_invariant_spec L' \\\n \\ l \\ L'. \\ s \\ M l. \\l' s'. E (l, s) (l', s') \\ l' \\ L \\ (\\ s'' \\ M l'. s' \\ s'')\"\n\nlemma check_invariant_correct:\n \"check_invariant L' \\ SPEC (\\r. r \\ check_invariant_spec (set L'))\"\n (is \"_ \\ ?rhs\")\n if assms: \"\\l \\ L. \\s \\ M l. P (l, s)\" \"set L' \\ L\"\nproof -\n have *: \"(\\ (l',ys) \\ set (succs l xs). \\ s' \\ ys. l' \\ L \\ (\\ s'' \\ M l'. s' \\ s'')) =\n (\\s\\M l.\n \\l' s'.\n E (l, s) (l', s') \\ l' \\ L \\ (\\s''\\M l'. s' \\ s''))\"\n if \"xs = M l\" \"l \\ L\"\n for l xs\n using succs_correct[of xs l] assms(1) that\n apply clarsimp\n apply safe\n apply clarsimp_all\n apply fastforce\n apply fastforce\n (* or: apply force *)\n subgoal premises prems for a b s'\n proof -\n from prems have \"\\s\\xs. P (l, s)\"\n by auto\n from succs_correct[OF this] prems(3,6,7) obtain s where \"s \\ M l\" \"E (l, s) (a, s')\"\n by fastforce\n with prems show ?thesis\n by auto\n qed\n apply fastforce\n done\n have **: \"\n (\\ l \\ set L'. (\\ (l',ys) \\ set (succs l (M l)). \\ s' \\ ys. l' \\ L \\ (\\ s'' \\ M l'. s' \\ s'')))\n = (\\ l \\ set L'. \\s\\M l. \\l' s'. E (l, s) (l', s') \\ l' \\ L \\ (\\s''\\M l'. s' \\ s''))\"\n by (simp add: * assms(2)[THEN subsetD])\n have \"check_invariant L' \\ SPEC (\\r. r \\\n (\\ l \\ set L'. (\\ (l',ys) \\ set (succs l (M l)). (\\ s' \\ ys. l' \\ L \\ (\\ s'' \\ M l'. s' \\ s'')))))\"\n unfolding check_invariant_def\n by (refine_vcg monadic_list_all_rule monadic_list_ex_rule) (auto simp: list_all_iff list_ex_iff)\n also have \"\\ \\ ?rhs\"\n unfolding check_invariant_spec_def by (auto; smt ** case_prodI2 case_prod_conv)\n finally show ?thesis .\nqed\n\nend (* Reachability Impl Invariant *)\n\n\nlocale Reachability_Impl_base2 =\n Reachability_Impl_base where E = E +\n Unreachability_Invariant_paired_pre_defs where E = E\n for E :: \"'l \\ 's \\ _\" +\n fixes P' and F\n assumes P'_P: \"\\ l s. P' (l, s) \\ P (l, s)\"\n assumes F_mono: \"\\a b. P a \\ F a \\ (\\(l, s) (l', s'). l' = l \\ s \\ s') a b \\ P b \\ F b\"\n\n\n\\<^cancel>\\locale Reachability_Impl_base2 =\n Reachability_Impl_base where E = E +\n Unreachability_Invariant_paired_pre where E = E\n for E :: \"'l \\ 's \\ _\" +\n fixes P' and F\n assumes P'_P: \"\\ l s. P' (l, s) \\ P (l, s)\"\n assumes F_mono: \"\\a b. P a \\ F a \\ (\\(l, s) (l', s'). l' = l \\ s \\ s') a b \\ P b \\ F b\"\\\n\n\\<^cancel>\\locale Reachability_Impl_pre =\n Reachability_Impl_invariant where E = E +\n Reachability_Impl_base2 where E = E for E :: \"'l \\ 's \\ _\"\nbegin\\\n\nlocale Reachability_Impl_pre =\n Reachability_Impl_invariant where E = E +\n Reachability_Impl_base2 where E = E for E :: \"'l \\ 's \\ _\"\nbegin\n\ndefinition\n \"check_final \\ do {\n l \\ SPEC (\\xs. set xs = L);\n monadic_list_all (\\l. do {\n xs \\ SPEC (\\xs. set xs = M l);\n monadic_list_all (\\s.\n RETURN (\\ F (l, s))\n ) xs\n }\n ) l\n }\n\"\n\ndefinition\n \"check_final_spec = (\\s'\\{(l, s) |l s. l \\ L \\ s \\ M l}. \\ F s')\"\n\nlemma check_final_correct:\n \"check_final \\ SPEC (\\r. r \\ check_final_spec)\"\n unfolding check_final_def check_final_spec_def\n by (refine_vcg monadic_list_all_rule) (auto simp: list_all_iff list_ex_iff)\n\ndefinition\n \"check_init l\\<^sub>0 s\\<^sub>0 \\ do {\n b1 \\ RETURN (l\\<^sub>0 \\ L);\n b2 \\ RETURN (P' (l\\<^sub>0, s\\<^sub>0));\n xs \\ SPEC (\\xs. set xs = M l\\<^sub>0);\n b3 \\ monadic_list_ex (\\s. RETURN (s\\<^sub>0 \\ s)) xs;\n RETURN (b1 \\ b2 \\ b3)\n }\"\n\ndefinition check_all_pre_alt_def:\n \"check_all_pre l\\<^sub>0 s\\<^sub>0 \\ do {\n b1 \\ check_init l\\<^sub>0 s\\<^sub>0;\n b2 \\ check_prop P';\n RETURN (b1 \\ b2)\n }\"\n\nlemma check_all_pre_def:\n \"check_all_pre l\\<^sub>0 s\\<^sub>0 = do {\n b1 \\ RETURN (l\\<^sub>0 \\ L);\n b2 \\ RETURN (P' (l\\<^sub>0, s\\<^sub>0));\n xs \\ SPEC (\\xs. set xs = M l\\<^sub>0);\n b3 \\ monadic_list_ex (\\s. RETURN (s\\<^sub>0 \\ s)) xs;\n b4 \\ check_prop P';\n RETURN (b1 \\ b2 \\ b3 \\ b4)\n }\"\n unfolding check_all_pre_alt_def check_init_def by simp\n\ndefinition\n \"check_init_spec l\\<^sub>0 s\\<^sub>0 \\ l\\<^sub>0 \\ L \\ (\\ s' \\ M l\\<^sub>0. s\\<^sub>0 \\ s') \\ P' (l\\<^sub>0, s\\<^sub>0)\"\n\ndefinition\n \"check_all_pre_spec l\\<^sub>0 s\\<^sub>0 \\\n (\\l \\ L. \\s \\ M l. P' (l, s)) \\ l\\<^sub>0 \\ L \\ (\\ s' \\ M l\\<^sub>0. s\\<^sub>0 \\ s') \\ P' (l\\<^sub>0, s\\<^sub>0)\"\n\nlemma check_all_pre_correct:\n \"check_all_pre l\\<^sub>0 s\\<^sub>0 \\ RETURN (check_all_pre_spec l\\<^sub>0 s\\<^sub>0)\"\n unfolding check_all_pre_def check_all_pre_spec_def\n by (refine_vcg check_prop_correct monadic_list_ex_rule; standard; auto simp: list_ex_iff)\n\nlemma check_init_correct:\n \"check_init l\\<^sub>0 s\\<^sub>0 \\ RETURN (check_init_spec l\\<^sub>0 s\\<^sub>0)\"\n unfolding check_init_def check_init_spec_def\n by (refine_vcg monadic_list_ex_rule; standard; auto simp: list_ex_iff)\n\nend\n\n\nlocale Reachability_Impl_pre_start =\n Reachability_Impl_pre where E = E for E :: \"'l \\ 's \\ _\" +\n fixes l\\<^sub>0 :: 'l and s\\<^sub>0 :: 's\nbegin\n\ndefinition\n \"check_all \\ do {\n b \\ check_all_pre l\\<^sub>0 s\\<^sub>0;\n if b then RETURN (check_invariant_spec L) else RETURN False\n }\"\n\ndefinition\n \"certify_unreachable = do {\n b1 \\ check_all;\n b2 \\ check_final;\n RETURN (b1 \\ b2)\n }\"\n\nlemma certify_unreachable_alt_def:\n \"certify_unreachable = do {\n b1 \\ check_all_pre l\\<^sub>0 s\\<^sub>0;\n b2 \\ RETURN (check_invariant_spec L);\n b3 \\ check_final;\n RETURN (b1 \\ b2 \\ b3)\n }\"\n unfolding certify_unreachable_def check_all_def by simp (fo_rule arg_cong2, auto)\n\ndefinition\n \"check_all_spec \\ check_all_pre_spec l\\<^sub>0 s\\<^sub>0 \\ check_invariant_spec L\"\n\nlemma check_all_correct:\n \"check_all \\ SPEC (\\r. r \\ check_all_spec)\"\n unfolding check_all_def check_all_spec_def check_all_pre_def check_all_pre_spec_def\n by (refine_vcg check_prop_correct check_invariant_correct monadic_list_ex_rule)\n (auto simp: list_ex_iff dest: P'_P)\n\nend\n\n\nlocale Reachability_Impl_correct =\n Reachability_Impl_pre_start where E = E +\n Unreachability_Invariant_paired_pre where E = E for E :: \"'l \\ 's \\ _\"\nbegin\n\nlemma Unreachability_Invariant_pairedI[rule_format]:\n \"check_all_spec\n \\ Unreachability_Invariant_paired (\\) (\\) M L E P l\\<^sub>0 s\\<^sub>0 (\\(l, u) (l', u'). l' = l \\ u \\ u')\"\n unfolding check_all_spec_def check_all_pre_spec_def check_invariant_spec_def\n by clarsimp (standard, auto dest: P'_P)\n\nlemma check_all_correct':\n \"check_all \\ SPEC (\\r. r \\\n Unreachability_Invariant_paired (\\) (\\) M L E P l\\<^sub>0 s\\<^sub>0 (\\(l, u) (l', u'). l' = l \\ u \\ u'))\"\n by (refine_vcg Unreachability_Invariant_pairedI check_all_correct) fast\n\nlemma certify_unreachableI:\n \"check_all_spec \\ check_final_spec \\ (\\s'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, s\\<^sub>0) s' \\ F s')\"\n by (rule impI Unreachability_Invariant_paired.final_unreachable Unreachability_Invariant_pairedI)+\n (auto intro: F_mono simp: check_final_spec_def)\n\nlemma certify_unreachable_correct:\n \"certify_unreachable \\ SPEC (\\r. r \\ check_all_spec \\ check_final_spec)\"\n unfolding certify_unreachable_def by (refine_vcg check_all_correct check_final_correct; fast)\n\nlemma certify_unreachable_correct':\n \"certify_unreachable \\ SPEC (\\r. r \\ (\\s'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, s\\<^sub>0) s' \\ F s'))\"\n by (refine_vcg certify_unreachableI[rule_format] certify_unreachable_correct; fast)\n\nend\n\n\nlocale Buechi_Impl_invariant =\n Reachability_Impl_base where E = E for E :: \"'l \\ 's \\ _\" +\n fixes L :: \"'l set\" and M :: \"'l \\ ('s \\ nat) set\"\nbegin\n\ndefinition \"check_invariant_buechi R L' \\\n monadic_list_all (\\l.\n do {\n let as = M l;\n as \\ SPEC (\\xs'. set xs' = as);\n monadic_list_all (\\(x, i). do {\n let succs = succs l {x};\n monadic_list_all (\\(l', xs). do {\n xs \\ SPEC (\\xs'. set xs' = xs);\n b1 \\ RETURN (l' \\ L);\n if xs = [] then RETURN True else do {\n ys \\ SPEC (\\xs. set xs = M l');\n b2 \\ monadic_list_all (\\y.\n monadic_list_ex (\\(z, j). RETURN (R l l' i j x y z)) ys\n ) xs;\n RETURN (b1 \\ b2)\n }\n }) succs\n }) as\n }) L'\"\n\ndefinition\n \"check_invariant_buechi_spec R L' \\\n \\l \\ L'. \\(s, i) \\ M l. \\l' s'.\n E (l, s) (l', s') \\ l' \\ L \\ (\\(s'', j) \\ M l'. R l l' i j s s' s'')\"\n\nlemma check_invariant_buechi_correct:\n \"check_invariant_buechi R L' \\ SPEC (\\r. r \\ check_invariant_buechi_spec R (set L'))\"\n (is \"_ \\ ?rhs\")\n if assms: \"\\l \\ L. \\(s, _) \\ M l. P (l, s)\" \"set L' \\ L\"\nproof -\n have *: \"\n (case x of (s, i) \\ \\x\\set (succs l {s}). case x of (l', ys) \\\n \\s' \\ ys. l' \\ L \\ (\\(s'', j) \\ M l'. R l l' i j s s' s'')) =\n (case x of (s, i) \\\n \\l' s'. E (l, s) (l', s') \\ l' \\ L \\ (\\(s'', j) \\ M l'. R l l' i j s s' s''))\"\n if \"x \\ M l\" \"l \\ L\" for x l using succs_correct[of \"{fst x}\" l] assms(1) that by fastforce\n let ?R = \"\\l s i l' s'. (\\(s'', j) \\ M l'. R l l' i j s s' s'')\"\n let ?Q = \"\\l s i. \\(l',ys). (\\s' \\ ys. l' \\ L \\ ?R l s i l' s')\"\n let ?P = \"\\l (s, i). \\(l',ys) \\ set (succs l {s}). ?Q l s i (l', ys)\"\n have \"check_invariant_buechi R L' \\ SPEC (\\r. r \\\n (\\l \\ set L'. \\(s, i) \\ M l. \\(l',ys) \\ set (succs l {s}). (\\s' \\ ys. l' \\ L \\\n (\\(s'', j) \\ M l'. R l l' i j s s' s''))))\"\n unfolding check_invariant_buechi_def\n apply (rule monadic_list_all_rule[unfolded list_all_iff])\n apply refine_vcg\n subgoal for l xs\n apply (refine_vcg monadic_list_all_rule[unfolded list_all_iff, where P = \"?P l\"])\n subgoal for _ s i\n apply (refine_vcg monadic_list_all_rule[unfolded list_all_iff, where P = \"?Q l s i\"])\n apply (auto; fail)\n subgoal for _ l'\n apply (refine_vcg monadic_list_all_rule[unfolded list_all_iff, where P = \"?R l s i l'\"])\n subgoal for s'\n apply (refine_vcg monadic_list_ex_rule[unfolded list_ex_iff])\n by auto\n by auto\n by auto\n by auto\n done\n also have \"\\ \\ ?rhs\"\n unfolding check_invariant_buechi_spec_def by (auto simp: * assms(2)[THEN subsetD])\n finally show ?thesis .\nqed\n\nend\n\n\nlocale Buechi_Impl_pre =\n Buechi_Impl_invariant where M = M +\n Reachability_Impl_base2 for M :: \"'l \\ ('s \\ nat) set\" +\n assumes finite: \"finite L\" \"\\l \\ L. finite (M l)\"\nbegin\n\ndefinition\n \"buechi_prop l l' i j s s' s'' \\ l' \\ L \\ s' \\ s'' \\\n (if F (l, s) then i < j else i \\ j)\"\n\ntext \\\nOld alternative definition.\nSlightly easier to work with but subsumptions are not deterministic.\\\n\\ \\definition\n \"SE \\ \\(l, s) (l', s').\n l' = l \\ (\\j. is_arg_max (\\(s, i). i) (\\(s', j). s \\ s' \\ (s', j) \\ M l) (s', j))\"\\\n\ndefinition\n \"has_SE \\ \\s l. \\s' j. s \\ s' \\ (s', j) \\ M l\"\n\ndefinition\n \"SE \\ \\(l, s) (l', s'). l' = l \\ l \\ L \\ has_SE s l \\\n (\\j. (s', j) = arg_max (\\(s, i). i) (\\(s', j). s \\ s' \\ (s', j) \\ M l))\"\n\nlemma\n assumes \"SE (l, s) (l', s')\"\n shows SE_same_loc: \"l' = l\" and SE_subsumes: \"s \\ s'\"\n and SE_is_arg_max: \"\\j. is_arg_max (\\(s, i). i) (\\(s', j). s \\ s' \\ (s', j) \\ M l) (s', j)\"\n (is \"\\j. is_arg_max ?f ?P (s', j)\")\nproof -\n from assms have \"has_SE s l'\" \"l' \\ L\" and [simp]: \"l' = l\"\n unfolding SE_def by auto\n then obtain s1 j where \"?P (s1, j)\"\n unfolding has_SE_def by auto\n moreover have \"finite (Collect ?P)\"\n using finite \\l' \\ L\\ by (auto intro: finite_subset)\n moreover note arg_max_rule = arg_max_nat_lemma2[of ?P, OF calculation, of \"\\(s, i). i\"]\n then show \"l' = l\" \"s \\ s'\" \"\\j. is_arg_max ?f ?P (s', j)\"\n using assms unfolding is_arg_max_linorder SE_def is_arg_max_linorder by auto\nqed\n\nlemma SE_deterministic:\n assumes \"\\s. s1 \\ s \\ s2 \\ s\"\n assumes \"SE (l, s1) (l', s1')\" \"SE (l, s2) (l', s2')\"\n shows \"s2' = s1'\"\n using assms(2,3) unfolding SE_def by (clarsimp simp: assms(1)) (metis prod.inject)\n\nlemma SE_I:\n assumes \"(s'', j) \\ M l'\" \"buechi_prop l l' i j s s' s''\"\n shows \"\\(s'', j) \\ M l'. SE (l', s') (l', s'')\"\nproof -\n let ?P = \"\\(s1, j). s' \\ s1 \\ (s1, j) \\ M l'\"\n let ?f = \"\\(s, i). i\"\n from assms have \"?P (s'', j)\" \"l' \\ L\"\n unfolding buechi_prop_def by auto\n have \"finite (Collect ?P)\"\n using finite \\l' \\ L\\ by (auto intro: finite_subset)\n from arg_max_nat_lemma2[OF \\?P (s'', j) \\ this, of ?f] \\l' \\ L\\ show ?thesis\n unfolding has_SE_def SE_def is_arg_max_linorder by (auto 4 3)\nqed\n\ndefinition\n \"check_all_pre_spec1 inits \\\n (\\l \\ L. \\s \\ fst ` M l. P' (l, s)) \\\n (\\(l\\<^sub>0, s\\<^sub>0) \\ inits. l\\<^sub>0 \\ L \\ (\\ (s', _) \\ M l\\<^sub>0. s\\<^sub>0 \\ s') \\ P' (l\\<^sub>0, s\\<^sub>0))\"\n\ndefinition\n \"check_buechi inits \\ do {\n b \\ SPEC (\\r. r \\ check_all_pre_spec1 inits);\n if b then do {\n ASSERT (check_all_pre_spec1 inits);\n SPEC (\\r. r \\ check_invariant_buechi_spec (buechi_prop ) L)\n } else RETURN False\n }\"\n\ndefinition\n \"check_buechi_spec inits \\\n check_all_pre_spec1 inits\n \\ (\\l \\ L. \\(s, i) \\ M l. \\l' s'. E (l, s) (l', s')\n \\ (\\(s'', j) \\ M l'. buechi_prop l l' i j s s' s''))\"\n\ndefinition\n \"check_buechi_spec' inits \\\n (\\(l\\<^sub>0, s\\<^sub>0) \\ inits. Unreachability_Invariant_paired (\\) (\\) (\\l. fst ` M l) L E P l\\<^sub>0 s\\<^sub>0 SE)\n \\ (\\l \\ L. \\(s, i) \\ M l. \\l' s'. E (l, s) (l', s')\n \\ (\\(s'', j) \\ M l'. buechi_prop l l' i j s s' s''))\"\n\nlemma check_buechi_correct:\n \"check_buechi inits \\ SPEC (\\r. r \\ check_buechi_spec inits)\"\n unfolding check_buechi_def check_invariant_buechi_spec_def check_buechi_spec_def\n by (refine_vcg; blast)\n\nend\n\n\nlocale Buechi_Impl_correct =\n Buechi_Impl_pre where M = M and E = E+\n Unreachability_Invariant_paired_pre where E = E for E and M :: \"'l \\ ('s \\ nat) set\"\nbegin\n\nlemma check_buechi_correct':\n \"check_buechi inits \\ SPEC (\\r. r \\ check_buechi_spec' inits)\"\nproof -\n have \"Unreachability_Invariant_paired (\\) (\\) (\\l. fst ` M l) L E P l\\<^sub>0 s\\<^sub>0 SE\"\n if \"(l\\<^sub>0, s\\<^sub>0) \\ inits\" \"check_all_pre_spec1 inits\" \"check_invariant_buechi_spec (buechi_prop ) L\"\n for l\\<^sub>0 s\\<^sub>0\n using that unfolding check_invariant_buechi_spec_def check_all_pre_spec1_def\n apply -\n apply standard\n apply (use SE_I SE_same_loc SE_subsumes in\n \\auto 4 3 dest!: P'_P simp: list_ex_iff Ball_def_raw Bex_def_raw\\)\n apply (smt case_prodE fst_conv)\n done\n then show ?thesis\n unfolding check_buechi_def check_invariant_buechi_spec_def check_buechi_spec'_def\n by (refine_vcg; blast)\nqed\n\ndefinition f where\n \"f \\ \\(l, s). Max {i. (s, i) \\ M l}\"\n\nlemma\n assumes \"l \\ L\" \"(s, i) \\ M l\"\n shows f_in: \"(s, f (l, s)) \\ M l\" (is \"?P1\")\n and f_ge: \"\\j. (s, j) \\ M l \\ j \\ f (l, s)\" (is \"?P2\")\nproof -\n have \"finite {i. (s, i) \\ M l}\"\n using finite \\l \\ L\\ [[simproc add: finite_Collect]] by auto\n with assms(2) show ?P1 ?P2\n unfolding f_def by (auto intro: Max_ge dest: Max_in)\nqed\n\nlemma f_topo:\n fixes l :: \\'l\\ and s :: \\'s\\ and l1 :: \\'l\\ and s1 :: \\'s\\ and l2 :: \\'l\\ and s2 :: \\'s\\\n assumes \n \"check_buechi_spec' inits\"\n \\l \\ L\\ and\n \\s \\ fst ` M l\\ and\n \\l2 \\ L\\ and\n \\s2 \\ fst ` M l2\\ and\n \\E (l, s) (l1, s1)\\ and\n \\SE (l1, s1) (l2, s2)\\\n shows \\if F (l, s) then f (l, s) < f (l2, s2) else f (l, s) \\ f (l2, s2)\\\nproof -\n let ?P = \"\\s l' (s', j). s \\ s' \\ (s', j) \\ M l'\"\n let ?f = \"\\(s, i). i\"\n let ?le = \"\\l s i j. if F(l, s) then i < j else i \\ j\"\n from \\SE _ _\\ obtain j where \"(s2, j) \\ M l2\" and [simp]: \"l2 = l1\"\n and is_max: \"is_arg_max ?f (?P s1 l1) (s2, j)\"\n using SE_is_arg_max SE_same_loc SE_subsumes by atomize_elim (fastforce simp: is_arg_max_def)\n from f_in assms have \"(s, f (l, s)) \\ M l\"\n by auto\n with assms obtain s' i where \"(s', i) \\ M l2\" \"buechi_prop l l2 (f (l, s)) i s s1 s'\"\n unfolding check_buechi_spec'_def by fastforce\n then have \"(s', i) \\ M l2\" \"s1 \\ s'\" \"?le l s (f (l, s)) i\"\n unfolding buechi_prop_def by auto\n from is_max \\(s', i) \\ _\\ \\s1 \\ s'\\ have \"i \\ j\"\n unfolding is_arg_max_linorder by simp\n also from f_ge \\(s2, j) \\ M l2\\ have \"j \\ f (l2, s2)\"\n using assms by auto\n finally show ?thesis\n using \\?le l s _ _\\ by auto\nqed\n\nlemma no_buechi_run:\n assumes check: \"check_buechi_spec' inits\"\n assumes accepting_run:\n \"(l\\<^sub>0, s\\<^sub>0) \\ inits\" \"Graph_Defs.run E ((l\\<^sub>0, s\\<^sub>0) ## xs)\" \"alw (ev (holds F)) ((l\\<^sub>0, s\\<^sub>0) ## xs)\"\n shows False\nproof -\n interpret Unreachability_Invariant_paired \"(\\)\" \"(\\)\" \"\\l. fst ` M l\" L E P l\\<^sub>0 s\\<^sub>0 SE\n using check \\_ \\ inits\\ unfolding check_buechi_spec'_def by blast\n show ?thesis\n apply (rule no_buechi_run[where F = F and f = f])\n apply (rule F_mono; assumption)\n using finite apply blast+\n apply (rule f_topo, rule check, assumption+)\n apply (rule accepting_run)+\n done\nqed\n\nend (* Buechi Impl pre *)\n\n\nlocale Reachability_Impl_common =\n Reachability_Impl_pre where less_eq = less_eq and M = \"\\x. case M x of None \\ {} | Some S \\ S\"\n for less_eq :: \"'b \\ 'b \\ bool\" (infix \"\\\" 50) and M :: \"'k \\ 'b set option\" +\n assumes L_finite: \"finite L\"\n and M_ran_finite: \"\\S \\ ran M. finite S\"\n and succs_finite: \"\\l S. \\(l', S') \\ set (succs l S). finite S \\ finite S'\"\n and succs_empty: \"\\l. succs l {} = []\"\n (* This could be weakened to state that \\succs l {}\\ only contains empty sets *)\nbegin\n\nlemma M_listD:\n assumes \"M l = Some S\"\n shows \"\\ xs. set xs = S\"\n using M_ran_finite assms unfolding ran_def by (auto intro: finite_list)\n\nlemma L_listD:\n shows \"\\ xs. set xs = L\"\n using L_finite by (rule finite_list)\n\nlemma check_prop_gt_SUCCEED:\n \"check_prop P' > SUCCEED\"\n unfolding check_prop_def using L_listD\n by (fastforce split: option.split dest: M_listD\n intro: monadic_list_all_gt_SUCCEED bind_RES_gt_SUCCEED_I\n )\n\ndefinition\n \"check_final' L' M' = do {\n l \\ SPEC (\\xs. set xs = L');\n monadic_list_all (\\l. do {\n let S = op_map_lookup l M';\n case S of None \\ RETURN True | Some S \\ do {\n xs \\ SPEC (\\xs. set xs = S);\n monadic_list_all (\\s.\n RETURN (\\ PR_CONST F (l, s))\n ) xs\n }\n }\n ) l\n }\"\n\nlemma check_final_alt_def:\n \"check_final' L M = check_final\"\n unfolding check_final'_def check_final_def\n by (fo_rule arg_cong2, simp, fo_rule arg_cong) (auto split: option.split simp: bind_RES)\n\ndefinition check_prop' where\n \"check_prop' L' M' = do {\n l \\ SPEC (\\xs. set xs = L');\n monadic_list_all (\\l. do {\n let S = op_map_lookup l M';\n case S of None \\ RETURN True | Some S \\ do {\n xs \\ SPEC (\\xs. set xs = S);\n r \\ monadic_list_all (\\s.\n RETURN (PR_CONST P' (l, s))\n ) xs;\n RETURN r\n }\n }\n ) l\n }\"\n\nlemma check_prop_alt_def:\n \"check_prop' L M = check_prop P'\"\n unfolding check_prop_def check_prop'_def\n by (fo_rule arg_cong2, simp, fo_rule arg_cong) (auto split: option.split simp: bind_RES)\n\nlemma check_prop'_alt_def:\n \"check_prop' L' M' = do {\n l \\ SPEC (\\xs. set xs = L');\n monadic_list_all (\\l. do {\n let (S, M) = op_map_extract l M';\n case S of None \\ RETURN True | Some S \\ do {\n xs \\ SPEC (\\xs. set xs = S);\n r \\ monadic_list_all (\\s.\n RETURN (PR_CONST P' (l, s))\n ) xs;\n RETURN r\n }\n }\n ) l\n }\"\n unfolding check_prop'_def\n by (fo_rule arg_cong2, simp, fo_rule arg_cong) (auto split: option.split simp: bind_RES)\n\nend\n\n\nlocale Certification_Impl_base = Reachability_Impl_base2 where less = less\n for less :: \"'s \\ 's \\ bool\" (infix \"\\\" 50) +\n fixes A :: \"'s \\ ('si :: heap) \\ assn\"\n and K :: \"'k \\ ('ki :: {hashable,heap}) \\ assn\"\n and Fi and keyi and Pi and copyi and Lei and succsi\n assumes [sepref_fr_rules]: \"(keyi,RETURN o PR_CONST fst) \\ (prod_assn K A)\\<^sup>k \\\\<^sub>a K\"\n assumes copyi[sepref_fr_rules]: \"(copyi, RETURN o COPY) \\ A\\<^sup>k \\\\<^sub>a A\"\n assumes Pi_P'[sepref_fr_rules]: \"(Pi,RETURN o PR_CONST P') \\ (prod_assn K A)\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes Fi_F[sepref_fr_rules]: \"(Fi,RETURN o PR_CONST F) \\ (prod_assn K A)\\<^sup>d \\\\<^sub>a bool_assn\"\n assumes succsi[sepref_fr_rules]:\n \"(uncurry succsi,uncurry (RETURN oo PR_CONST succs))\n \\ K\\<^sup>k *\\<^sub>a (lso_assn A)\\<^sup>d \\\\<^sub>a list_assn (K \\\\<^sub>a lso_assn A)\"\n assumes Lei[sepref_fr_rules]:\n \"(uncurry Lei,uncurry (RETURN oo PR_CONST less_eq)) \\ A\\<^sup>k *\\<^sub>a A\\<^sup>k \\\\<^sub>a bool_assn\"\n assumes pure_K: \"is_pure K\"\n assumes left_unique_K: \"IS_LEFT_UNIQUE (the_pure K)\"\n assumes right_unique_K: \"IS_RIGHT_UNIQUE (the_pure K)\"\n\nlocale Reachability_Impl =\n Reachability_Impl_common where M = M +\n Certification_Impl_base where K = K and A = A +\n Reachability_Impl_correct where M = \"\\x. case M x of None \\ {} | Some S \\ S\"\n for M :: \"'k \\ 'a set option\"\n and K :: \"'k \\ 'ki :: {hashable,heap} \\ assn\" and A :: \"'a \\ 'ai :: heap \\ assn\" +\n fixes l\\<^sub>0i :: \"'ki Heap\" and s\\<^sub>0i :: \"'ai Heap\"\n assumes l\\<^sub>0i_l\\<^sub>0[sepref_fr_rules]:\n \"(uncurry0 l\\<^sub>0i, uncurry0 (RETURN (PR_CONST l\\<^sub>0))) \\ unit_assn\\<^sup>k \\\\<^sub>a K\"\n assumes s\\<^sub>0i_s\\<^sub>0[sepref_fr_rules]:\n \"(uncurry0 s\\<^sub>0i, uncurry0 (RETURN (PR_CONST s\\<^sub>0))) \\ unit_assn\\<^sup>k \\\\<^sub>a A\"\n\n\n\ndefinition\n \"print_check s b = println (s + STR '': '' + (if b then STR ''passed'' else STR ''failed''))\"\n\ndefinition\n \"PRINT_CHECK = RETURN oo print_check\"\n\nlemma [sepref_import_param]:\n \"(print_check, print_check) \\ Id \\ Id \\ Id\"\n by simp\n\nsepref_definition print_check_impl is\n \"uncurry PRINT_CHECK\" :: \"id_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\\\<^sub>a id_assn\"\n unfolding PRINT_CHECK_def by sepref\n\nsepref_register PRINT_CHECK\n\nlemmas [sepref_fr_rules] = print_check_impl.refine\n\n\nparagraph \\Misc implementation\\\n\nsepref_decl_op map_lookup_copy: \"\\k (m :: _ \\ _). (m k, m)\"\n :: \"K \\ \\K,V\\map_rel \\ \\V\\option_rel \\\\<^sub>r \\K,V\\map_rel\"\n where \"single_valued K\" \"single_valued (K\\)\"\n apply (rule fref_ncI)\n apply parametricity\n unfolding map_rel_def\n apply (elim IntE)\n apply parametricity\n done\n\ndefinition\n \"heap_map copy xs \\ do {\n xs \\ imp_nfoldli xs (\\_. return True) (\\x xs. do {x \\ copy x; return (x # xs)}) [];\n return (rev xs)\n }\"\n\ndefinition\n \"monadic_map copy xs \\ do {\n xs \\ monadic_nfoldli xs (\\_. RETURN True) (\\x xs. do {x \\ copy x; RETURN (x # xs)}) [];\n RETURN (rev xs)\n }\"\n\ncontext\nbegin\n\nprivate lemma monadic_nfoldli_rev:\n \"monadic_nfoldli x (\\_. RETURN True) (\\x xs. RETURN (x # xs)) [] \\ SPEC (\\r. r = rev x)\"\n unfolding nfoldli_to_monadic[where c = \"\\_.True\", symmetric]\n by (rule nfoldli_rule[where I = \"\\ xs ys zs. rev zs @ ys = x\"]) auto\n\nprivate lemma frame2:\n \"hn_ctxt (list_assn A) x xi * hn_invalid (list_assn A) [] [] * hn_ctxt (list_assn A) xa x'\n \\\\<^sub>t hn_ctxt (list_assn A) x xi * hn_ctxt (list_assn A) xa x'\"\n by (simp add: frame_rem2 frame_rem3)\n\nprivate lemma frame3:\n \"hn_ctxt (list_assn A) x xi * hn_invalid (list_assn A) [] []\n \\\\<^sub>t hn_ctxt (list_assn A) x xi * hn_ctxt (pure UNIV) xa x'\"\n by (simp add: frame_rem2 frame_rem3 pure_def entt_fr_drop hn_ctxt_def)\n\n(* XXX Copy *)\nlemma list_rev_aux: \"list_assn A a c \\\\<^sub>A list_assn A (rev a) (rev c)\"\n apply (subst list_assn_aux_len, clarsimp)\n apply (induction rule: list_induct2)\n apply (sep_auto; fail)\n apply (sep_auto, erule ent_frame_fwd, frame_inference, sep_auto)\n done\n\ntheorem copy_list_refine:\n assumes\n copy: \"(copy, RETURN o COPY) \\ A\\<^sup>k \\\\<^sub>a A\"\n shows\n \"hn_refine\n (hn_ctxt (list_assn A) x xi)\n (heap_map copy $ xi)\n (hn_ctxt (list_assn A) x xi)\n (list_assn A)\n (monadic_map (RETURN \\ COPY) $ x)\"\n unfolding monadic_map_def heap_map_def\n apply sep_auto\n apply (rule hnr_bind)\n apply (rule monadic_nfoldli_refine_aux'[\n where S = \"set x\" and Rs = \"list_assn A\" and Rl = A and Rl' = A and Rl'' = A and \\ = emp,\n THEN hn_refine_cons_pre[rotated]])\n apply sep_auto\n subgoal\n by standard (sep_auto simp: pure_def)\n subgoal\n supply [sep_heap_rules] = copy[to_hnr, unfolded hn_refine_def, simplified]\n apply standard\n apply sep_auto\n (* Frame *)\n by (smt assn_times_comm ent_refl ent_star_mono hn_ctxt_def invalidate_clone star_aci(3))\n\n apply (sep_auto; fail)\n apply (sep_auto simp: pure_def; fail)\n prefer 2\n apply (rule frame3; fail)\n apply standard\n apply sep_auto\n apply (drule order_trans, rule monadic_nfoldli_rev)\n apply (rule ent_true_drop(2))\n apply (rule ent_star_mono)\n apply sep_auto\n unfolding hn_ctxt_def\n apply (rule list_rev_aux)\n done\n\nend\n\nlemma monadic_map_refine':\n \"(heap_map copy, monadic_map (RETURN o COPY)) \\ (list_assn A)\\<^sup>k \\\\<^sub>a list_assn A\"\n if \"(copy, RETURN o COPY) \\ A\\<^sup>k \\\\<^sub>a A\"\n using that by (rule copy_list_refine[to_hfref])\n\nlemma copy_list_COPY:\n \"monadic_map (RETURN o COPY) = RETURN o COPY\"\nproof (rule ext, goal_cases)\n case (1 xs)\n then have *: \"monadic_nfoldli xs (\\_. RETURN True)\n (\\x xs. (RETURN \\ (\\x. x)) x \\ (\\x. RETURN (x # xs)))\n as = RETURN (rev xs @ as)\" for as\n by (induction xs arbitrary: as) auto\n show ?case\n unfolding monadic_map_def COPY_def by (subst *) simp\nqed\n\nlemma copy_list_lso_assn_refine:\n \"(heap_map copy, RETURN o COPY) \\ (lso_assn A)\\<^sup>k \\\\<^sub>a lso_assn A\"\n if \"(copy, RETURN o COPY) \\ A\\<^sup>k \\\\<^sub>a A\"\n supply [sep_heap_rules] =\n monadic_map_refine'[OF that, to_hnr, unfolded copy_list_COPY hn_refine_def hn_ctxt_def, simplified]\n unfolding lso_assn_def hr_comp_def by sepref_to_hoare sep_auto\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Certification/Unreachability_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725053, "lm_q2_score": 0.3522017684487511, "lm_q1q2_score": 0.19119740835925153}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__51_on_rules imports n_g2kAbsAfter_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.1909386984246721}} {"text": "(* Title: HOL/Auth/n_deadlock_lemma_on_inv__3.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_on_inv__3 imports n_deadlock_base\nbegin\nsection{*All lemmas on causal relation between inv__3 and some rule r*}\nlemma n_TryVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const E)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv3)) (Const C))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_on_inv__3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.37022539954425293, "lm_q1q2_score": 0.1908955893115275}} {"text": "header {* Code Generation for SCC-Computation \\label{sec:scc_code}*}\ntheory Gabow_SCC_Code\nimports \n Gabow_SCC \n Gabow_Skeleton_Code\n \"../CAVA_Automata/CAVA_Base/CAVA_Code_Target\"\nbegin\n\nsection {* Automatic Refinement to Efficient Data Structures *}\ncontext fr_graph_impl_loc\nbegin\n schematic_lemma last_seg_code_aux: \n \"(?c,last_seg_impl)\\GSi_rel \\ \\\\node_rel\\list_set_rel\\nres_rel\"\n unfolding last_seg_impl_def_opt[abs_def] \n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal,trace))\n done\n concrete_definition (in -) last_seg_code \n uses fr_graph_impl_loc.last_seg_code_aux\n lemmas [autoref_rules] = last_seg_code.refine[OF locale_this]\n\n context begin interpretation autoref_syn .\n\n \n\n schematic_lemma compute_SCC_code_aux:\n \"(?c,compute_SCC_impl) \\ \\\\\\node_rel\\list_set_rel\\list_rel\\nres_rel\"\n unfolding compute_SCC_impl_def[abs_def] initial_impl_def GS_initial_impl_def\n unfolding path_is_empty_impl_def is_on_stack_impl_def is_done_impl_def \n is_done_oimpl_def\n unfolding GS.is_on_stack_impl_def GS.is_done_impl_def\n using [[autoref_trace_failed_id]]\n apply (autoref (keep_goal,trace))\n done\n\n concrete_definition (in -) compute_SCC_code \n uses fr_graph_impl_loc.compute_SCC_code_aux\n lemmas [autoref_rules] = compute_SCC_code.refine[OF locale_this] \n\n schematic_lemma last_seg_tr_aux: \"RETURN ?c \\ last_seg_code s\"\n unfolding last_seg_code_def by refine_transfer\n concrete_definition (in -) last_seg_tr uses fr_graph_impl_loc.last_seg_tr_aux\n lemmas [refine_transfer] = last_seg_tr.refine[OF locale_this]\n\n schematic_lemma compute_SCC_tr_aux: \"RETURN ?c \\ compute_SCC_code g\"\n unfolding compute_SCC_code_def by refine_transfer\n concrete_definition (in -) compute_SCC_tr \n uses fr_graph_impl_loc.compute_SCC_tr_aux\n lemmas [refine_transfer] = compute_SCC_tr.refine[OF locale_this]\nend\n\nexport_code compute_SCC_tr checking SML\n\nsection {* Correctness Theorem *}\n\ntheorem compute_SCC_tr_correct:\n -- \"Correctness theorem for the constant we extracted to SML\"\n fixes G :: \"('a::hashable,'more) fr_graph_rec_scheme\"\n assumes A: \"(G_impl,G)\\\\Re,Id\\frg_impl_rel_ext\"\n assumes C: \"fr_graph G\"\n shows \"RETURN (compute_SCC_tr G_impl) \n \\ \\(\\\\Id\\list_set_rel\\list_rel) (fr_graph.compute_SCC_spec G)\"\nproof -\n from C interpret fr_graph G .\n have I: \"fr_graph_impl_loc Re G_impl G\"\n apply unfold_locales using A .\n then interpret fr_graph_impl_loc Re G_impl G .\n\n note compute_SCC_tr.refine[OF I]\n also note compute_SCC_code.refine[OF I, THEN nres_relD]\n also note compute_SCC_impl_refine\n also note compute_SCC_correct\n finally show ?thesis using A by simp\nqed\n\nsection {* Extraction of Benchmark Code *}\n\nschematic_lemma list_set_of_list_aux: \n \"(?c,set)\\\\nat_rel\\list_rel \\ \\nat_rel\\list_set_rel\"\n by autoref\nconcrete_definition list_set_of_list uses list_set_of_list_aux\n\nterm compute_SCC_tr\n\ndefinition compute_SCC_tr_nat :: \"_ \\ nat list list\"\n where \"compute_SCC_tr_nat \\ compute_SCC_tr\"\n\n(*export_code \n compute_SCC_tr_nat\n succ_of_list_impl\n nat_of_integer\n integer_of_nat\n list_set_of_list\n in SML module_name CSCC_Gabow\n file \"Gabow_Benchmark/cscc_gabow.sml\"\n*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Gabow_SCC/Gabow_SCC_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199306096343, "lm_q2_score": 0.37022537869825406, "lm_q1q2_score": 0.19089558407431934}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__31_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__31_on_rules imports n_g2kAbsAfter_lemma_on_inv__31\nbegin\nsection{*All lemmas on causal relation between inv__31*}\nlemma lemma_inv__31_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__31 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__31) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__31) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__31_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.19083695355872704}} {"text": "(* @LICENSE(NICTA_CORE) *)\n\n(* Author: Rafal Kolanski, NICTA & UNSW \n\n The seL4 page table on ARMv6. See ASSUMPTIONS.\n*)\n\ntheory PageTable_seL4\nimports\n PageTable\n MachineARM\n Heaps\n MapExtra\n Misc\nbegin\n\ndeclare map_add_assoc [simp del] (* required for MapExtra *)\n\ntext \\\n The base of the page table is one physical root. \n This page table structure is the part after the ASID table lookup.\n one for the user side\\\ntype_synonym ptable_base = paddr\n\ntext \\\n ASSUMPTIONS:\n\n Things I think are always the case in seL4:\n - subpage AP bits disabled (ARMv6 page table format, subpages disabled)\n - don't use extended physical addresses (40-bit address space)\n - don't use domains (domain is always 0)\n\n\\\n\ntext \\\n Conventions:\n A Page Directory is the first level of a two-level page table.\n A Page Table is the second level of a two-level page table.\n Entries are called PDEs for the former and PTEs for the latter.\n\n Both PDEs and PTEs are the size of a machine word (32 bits)\n\n The offset is the index into the structure we resolve to when looking up,\n i.e. page index for pages, section index for sections\n\\\n\ntext \\Supported page types\\\n\ndatatype page_type =\n ArmSmallPage\n | ArmSection\n\n\nprimrec\n page_bits :: \"page_type \\ nat\"\nwhere\n \"page_bits ArmSmallPage = 12\" |\n \"page_bits ArmSection = 20\" \n\ndefinition\n page_size :: \"page_type \\ nat\" where\n \"page_size page_type \\ 2 ^ (page_bits page_type)\"\n\n\ntext \\Offset calculation common to all sizes\\\n\ndefinition\n vaddr_offset :: \"page_type \\ machine_word \\ machine_word\" where\n \"vaddr_offset p w \\ w AND mask (page_bits p)\"\n\ndefinition\n \"page_aligned page_type p = (vaddr_offset page_type p = 0)\"\n\nlemma \"map (\\p. vaddr_offset p 0xFEDCBAAA) [ArmSmallPage, ArmSection] = [0xAAA, 0xCBAAA]\"\n by (clarsimp simp: vaddr_offset_def mask_def)\n\ntext \\Get the non-offset part of an address for a given page size\\\ndefinition\n addr_base :: \"page_type \\ machine_word \\ machine_word\" where\n \"addr_base sz w \\ w AND (NOT mask (page_bits sz))\"\n\nlemma \"addr_base ArmSmallPage 0xFFFFFFFF = 0xFFFFF000\" (* sanity check *)\n unfolding addr_base_def mask_def by simp\n\n\ntext \\\n Permissions bits as per the reference manual. These are not translated into\n anything more abstract, because currently they aren't used in the logic.\n I suppose the best way to go about this is to add another \"guard\", like a\n permissions guard, rather than fiddling around with a set of flags, since\n on the ARM the permissions decoding is not so straightforward.\n\\\n\nrecord arm_perm_bits =\n arm_p_APX :: \"1 word\"\n arm_p_AP :: \"2 word\"\n arm_p_TEX :: \"3 word\"\n arm_p_S :: \"1 word\"\n arm_p_XN :: \"1 word\"\n arm_p_C :: \"1 word\"\n arm_p_B :: \"1 word\"\n arm_p_nG :: \"1 word\"\n\n\n\nsection \\Page Directory Entry (PDE) Decoding\\\n\ndatatype pde =\n InvalidPDE\n | ReservedPDE\n \\ \\the paddr is address of a page table\\ \n | PageTablePDE paddr\n \\ \\the paddr is base address of section\\\n | SectionPDE paddr arm_perm_bits\n\n\ndefinition\n perm_bits_pde_sections :: \"machine_word \\ arm_perm_bits\" where\n \"perm_bits_pde_sections w \\ \n \\ arm_p_APX = ucast ((w >> 15) AND 0x1),\n arm_p_AP = ucast ((w >> 10) AND 0x3),\n arm_p_TEX = ucast ((w >> 12) AND 0x7),\n arm_p_S = ucast ((w >> 16) AND 0x1),\n arm_p_XN = ucast ((w >> 4) AND 0x1),\n arm_p_C = ucast ((w >> 3) AND 0x1),\n arm_p_B = ucast ((w >> 2) AND 0x1),\n arm_p_nG = ucast ((w >> 17) AND 0x1) \\\"\n\ndefinition\n \"decode_pde_section w \\ SectionPDE (Addr (addr_base ArmSection w))\n (perm_bits_pde_sections w)\"\n\n\ndefinition\n pt_base_mask :: machine_word where\n \"pt_base_mask \\ NOT (mask 9)\" (* FIXME TODO: check *again* that this is right *)\ndefinition\n \"decode_pde_pt w \\ PageTablePDE (Addr (w AND pt_base_mask))\"\n\nlemma (* sanity check *)\n \"pt_base_mask \\ 0xFFFFFE00\" unfolding pt_base_mask_def mask_def by simp\n\ndefinition\n decode_pde :: \"machine_word \\ pde\" where\n \"decode_pde w \\ let pde_type = w AND 0x3\n in\n if pde_type = 1 then (decode_pde_pt w)\n else if pde_type = 2 then decode_pde_section w\n else if pde_type = 3 then ReservedPDE\n else InvalidPDE\"\n\n(* update form Hira: changed Option.map to map_option *)\ndefinition\n decode_heap_pde :: \"heap \\ paddr \\ pde\" where\n \"decode_heap_pde h p \\ \n map_option decode_pde (load_machine_word h p)\"\n\n\n\nsection \\Page Table Entry (PTE) Decoding\\\n\ndatatype pte =\n InvalidPTE\n \\ \\the paddr is the page base address\\\n | SmallPagePTE paddr arm_perm_bits\n\ndefinition\n perm_bits_pte_small :: \"machine_word \\ arm_perm_bits\" where\n \"perm_bits_pte_small w =\n \\ arm_p_APX = ucast ((w >> 9) AND 0x1),\n arm_p_AP = ucast ((w >> 4) AND 0x3),\n arm_p_TEX = ucast ((w >> 6) AND 0x7),\n arm_p_S = ucast ((w >> 10) AND 0x1),\n arm_p_XN = ucast (w AND 0x1),\n arm_p_C = ucast ((w >> 3) AND 0x1),\n arm_p_B = ucast ((w >> 2) AND 0x1),\n arm_p_nG = ucast ((w >> 11) AND 0x1) \\\"\n\ndefinition\n \"decode_pte_small w \\ SmallPagePTE (Addr (addr_base ArmSmallPage w))\n (perm_bits_pte_small w)\"\n\n\n\ndefinition\n large_base_mask :: \"32 word\" where\n \"large_base_mask \\ NOT (mask 16)\"\n\n\nlemma (* sanity check *)\n \"large_base_mask \\ 0xFFFF0000\" by (simp add: large_base_mask_def mask_def)\n\ndefinition\n decode_pte :: \"machine_word \\ pte\" where\n \"decode_pte w \\ if w AND 3 = 0 \n then InvalidPTE\n else decode_pte_small w\"\n\n(* update form Hira: changed Option.map to map_option *)\ndefinition\n decode_heap_pte :: \"heap \\ paddr \\ pte\" where\n \"decode_heap_pte h p \\ map_option decode_pte (load_machine_word h p)\"\n\n\nsection \\Performing a Lookup\\\n\ntext \\\n Bits 20-31 of virtual addresses represent an index into the page directory.\\\ndefinition\n vaddr_pd_index :: \"machine_word \\ machine_word\" where\n \"vaddr_pd_index w \\ (w >> 20) AND mask 12\"\n\nlemma vaddr_pd_index_simp: \"((w::machine_word) >> 20) AND mask 12 = w >> 20\"\n by (clarsimp simp: and_mask_eq_iff_shiftr_0 shiftr_shiftr \n le_mask_iff[symmetric])\n (unfold mask_def, rule order_trans, rule word_n1_ge, simp)\n\ntext \\\n Bits 12-19 of virtual addresses represent an index into the page table.\\\ndefinition\n vaddr_pt_index :: \"machine_word \\ machine_word\" where\n \"vaddr_pt_index w \\ (w >> 12) AND mask 8\"\n\n\nsubsection \\Get Frame\\\n\ntext \\\n Decode the correct page directory entry from the page directory at some\n physical location given a virtual address to look up.\n\\\ndefinition\n get_pde :: \"heap \\ paddr \\ vaddr \\ pde\" where\n \"get_pde h root vp \\\n let \n pd_idx_offset = ((vaddr_pd_index (addr_val vp)) << 2)\n in\n decode_heap_pde h (root r+ pd_idx_offset)\"\n\ntext \\\n Decode the correct page table entry from a page table at some\n physical location given a virtual address to look up.\n\\\ndefinition\n get_pte :: \"heap \\ paddr \\ vaddr \\ pte\" where\n \"get_pte h pt_base vp \\ \n let \n pt_idx_offset = ((vaddr_pt_index (addr_val vp)) << 2) \n in\n decode_heap_pte h (pt_base r+ pt_idx_offset)\"\n\ntext \\\n The basic lookup mechanism we perform is figuring out the size of the page\n a virtual address is on, then figuring out where in physical memory that\n page maps to.\n\\\n\ndefinition\n lookup_pte :: \"heap \\ paddr \\ vaddr \\ (paddr \\ page_type \\ arm_perm_bits)\"\n where\n \"lookup_pte h pt_base vp \\\n case_option None\n (\\pte. case pte \n of InvalidPTE \\ None\n | SmallPagePTE base perms \\ Some (base, ArmSmallPage, perms))\n (get_pte h pt_base vp)\"\n\ndefinition\n lookup_pde :: \"heap \\ paddr \\ vaddr \\ (paddr \\ page_type \\ arm_perm_bits)\"\n where\n \"lookup_pde h root vp \\\n case_option None\n (\\pde. case pde \n of InvalidPDE \\ None\n | ReservedPDE \\ None\n | SectionPDE base perms \\ Some (base, ArmSection, perms)\n | PageTablePDE pt_base \\ lookup_pte h pt_base vp)\n (get_pde h root vp)\"\n\n\nsubsection \\Get Page\\\n\ntext \\\n Find out which page a virtual address is on, along with permissions.\n\n Getting a page is a bit more complicated with superpages, as we can't really\n ``get a *page*''. So we get the virtual base address of the page *and* \n the page size. For that, we need to essentially perform a lookup. \n Once we know the page size, we can just mask it out of the virtual pointer.\n\\\n\ndefinition\n get_page :: \"heap \\ paddr \\ vaddr \\ (vaddr \\ page_type \\ arm_perm_bits)\"\n where\n \"get_page h root vp \\\n let\n vp_val = addr_val vp\n in\n map_option \n (\\(base, pg_size, perms). (Addr (addr_base pg_size vp_val), \n pg_size, perms))\n (lookup_pde h root vp)\"\n\n\nsubsection \\Lookup\\\n\ntext \\\n Lookup of a virtual pointer in a Page Table given its base address.\n To obtain the physical address, we get the frame and the page size, \n then mask in offset bits from the virtual pointer into the frame base\n address.\n\\\ndefinition\n ptable_lift :: \"heap \\ paddr \\ vaddr \\ paddr\" where\n \"ptable_lift h pt_root vp \\\n let\n vp_val = addr_val vp\n in\n map_option \n (\\(base, pg_size, perms). \n base r+ (vaddr_offset pg_size vp_val))\n (lookup_pde h pt_root vp)\"\n\n\nsubsection \\Trace\\\n\ntext \\\n Trace of looking up a virtual pointer in a Page Directory given its base \n address.\\\ndefinition\n ptable_trace :: \"heap \\ paddr \\ vaddr \\ paddr set\" where\n \"ptable_trace h root vp \\\n let \n vp_val = addr_val vp ;\n pd_idx_offset = ((vaddr_pd_index vp_val) << 2) ;\n pt_idx_offset = ((vaddr_pt_index vp_val) << 2) ;\n pd_touched = set (addr_seq (root r+ pd_idx_offset) 4) ;\n pt_touched = (\\pt_base. set (addr_seq (pt_base r+ pt_idx_offset) 4))\n in\n (case decode_heap_pde h (root r+ pd_idx_offset)\n of Some pde \\ \n (case pde \n of PageTablePDE pt_base \\ pd_touched \\ pt_touched pt_base\n | _ \\ pd_touched)\n | None \\ {})\"\n\n\nsection \\Properties, Instantiation to pagetable Locale\\\n\ntext \\Heap monotonicity and Frame monotonicity for on option result\\\n\ndefinition\n heap_mono_option :: \"(('a \\ 'b) \\ 'c option) \\ bool\" where\n \"heap_mono_option f \\ \\h h' v. h \\ h' \\ f h = Some v \\ f (h ++ h') = Some v\"\n\nlemma heap_mono_optionE:\n \"\\ heap_mono_option f ; f h = Some v ; h \\ h' \\ \\ f (h ++ h') = Some v\"\n unfolding heap_mono_option_def by blast\n\nlemma heap_mono_option_simp:\n \"\\ heap_mono_option f ; f h = Some v ; h \\ h' \\ \\ f (h ++ h') = f h\"\n by (frule (2) heap_mono_optionE, simp)\n\ndefinition\n frame_mono_option :: \"(('a \\ 'b) \\ 'c option) \\ bool\" where\n \"frame_mono_option f \\ \\h h' v. h \\ h' \\ f (h ++ h') = Some v \n \\ (f h = Some v \\ f h = None)\"\n\nlemma frame_mono_optionE:\n \"\\ frame_mono_option f ; f (h ++ h') = Some v ; h \\ h' \\ \n \\ f h = Some v \\ f h = None\"\n unfolding frame_mono_option_def by fastforce\n\n\nsubsection \\Heap monotonicity\\\n\nlemma load_list_basic_heap_mono_simp:\n assumes disj: \"h \\ h'\"\n assumes some: \"\\v \\ set (load_list_basic h n p). v \\ None\"\n shows \"load_list_basic (h ++ h') n p = load_list_basic h n p\"\n using disj some\nproof (induct n arbitrary: p)\n case 0 thus ?case by simp\nnext\n case (Suc n)\n thus ?case by (clarsimp, subst map_add_eval_left, auto)\nqed\n\nlemma Some_set_member:\n assumes some: \"None \\ S\" \n assumes x: \"x \\ S\"\n shows \"\\y. x = Some y\"\nproof -\n { assume a: \"x = None\"\n hence False using some x by auto\n }\n thus ?thesis by blast\nqed\n\nlemma load_list_heap_mono_option:\n \"heap_mono_option (\\h. load_list h n p)\"\n unfolding heap_mono_option_def load_list_def\n by (clarify, subst load_list_basic_heap_mono_simp)\n (auto simp: deoption_list_def elim!: Some_set_member split: if_split_asm)\n\nlemmas load_list_heap_mono_simp = heap_mono_option_simp[OF load_list_heap_mono_option]\nlemmas load_list_heap_mono = heap_mono_optionE[OF load_list_heap_mono_option]\n\nlemma decode_pde_heap_mono_option:\n \"heap_mono_option (\\h. decode_heap_pde h p)\"\n unfolding heap_mono_option_def decode_pde_def decode_heap_pde_def\n by (auto simp: load_machine_word_def load_value_def \n load_list_heap_mono Let_def \n split: option.splits)\n\nlemmas decode_pde_heap_mono_simp = heap_mono_option_simp[OF decode_pde_heap_mono_option]\nlemmas decode_pde_heap_mono = heap_mono_optionE[OF decode_pde_heap_mono_option]\n\nlemma decode_pte_heap_mono_option:\n \"heap_mono_option (\\h. decode_heap_pte h p)\"\n unfolding heap_mono_option_def decode_pte_def decode_heap_pte_def Let_def\n by (clarsimp simp: load_machine_word_def load_value_def Let_def \n load_list_heap_mono\n split: option.splits)\n \nlemmas decode_pte_heap_mono_simp = heap_mono_option_simp[OF decode_pte_heap_mono_option]\nlemmas decode_pte_heap_mono = heap_mono_optionE[OF decode_pte_heap_mono_option]\n\nlemma lookup_pte_heap_mono_option:\n \"heap_mono_option (\\h. lookup_pte h r vp)\"\n unfolding heap_mono_option_def lookup_pte_def get_pte_def Let_def\n by (clarsimp simp: decode_pte_heap_mono split: option.splits)\n\nlemmas lookup_pte_heap_mono_simp = heap_mono_option_simp[OF lookup_pte_heap_mono_option]\nlemmas lookup_pte_heap_mono = heap_mono_optionE[OF lookup_pte_heap_mono_option]\n\nlemma lookup_pde_heap_mono_option:\n \"heap_mono_option (\\h. lookup_pde h r vp)\"\n unfolding heap_mono_option_def lookup_pde_def get_pde_def Let_def\n by (clarsimp simp: decode_pde_heap_mono lookup_pte_heap_mono \n split: option.splits pde.splits)\n\nthm heap_mono_option_simp[OF lookup_pde_heap_mono_option]\n\nlemmas lookup_pde_heap_mono_simp = heap_mono_option_simp[OF lookup_pde_heap_mono_option]\nlemmas lookup_pde_heap_mono = heap_mono_optionE[OF lookup_pde_heap_mono_option]\n\nlemma ptable_lift_heap_mono_option:\n \"heap_mono_option (\\h. ptable_lift h r vp)\"\n unfolding heap_mono_option_def ptable_lift_def Let_def\n by (clarsimp simp: lookup_pde_heap_mono\n split: option.splits pde.splits)\n\nlemmas ptable_lift_heap_mono_simp = heap_mono_option_simp[OF ptable_lift_heap_mono_option]\nlemmas ptable_lift_heap_mono = heap_mono_optionE[OF ptable_lift_heap_mono_option]\n\nlemma get_page_heap_mono_option:\n \"heap_mono_option (\\h. get_page h r vp)\"\n unfolding heap_mono_option_def get_page_def Let_def\n by (clarsimp simp: lookup_pde_heap_mono split: option.splits)\n\nlemmas get_page_disj_heap_mono_simp = heap_mono_option_simp[OF get_page_heap_mono_option]\nlemmas get_page_disj_heap_mono = heap_mono_optionE[OF get_page_heap_mono_option]\n\ntext \\Heap monotonicity of ptable_trace works a bit differently as it just\n returns a set, so it depends on ptable_lift's monotonicity\\\n\n(*XXX: fold into not_in_trace_not_in_pde?*)\nlemma lift_valid_pde_valid:\n \"\\ ptable_lift h r vp = Some p \\ \n \\ decode_heap_pde h (r r+ (vaddr_pd_index (addr_val vp) << 2)) \\ None\"\n unfolding ptable_lift_def lookup_pde_def Let_def get_pde_def\n by (auto split: option.splits)\n\nlemma ptable_trace_heap_mono_simp:\n \"\\ ptable_lift h r vp = Some p ; h \\ h' \\\n \\ ptable_trace (h ++ h') r vp = ptable_trace h r vp\"\n unfolding ptable_trace_def Let_def\n apply (case_tac \"decode_heap_pde h (r r+ (vaddr_pd_index (addr_val vp) << 2))\")\n apply (drule lift_valid_pde_valid, blast)\n apply (subst decode_pde_heap_mono_simp, assumption+)\n apply simp\n done\n(*XXX: any set-like monotonicity properties can be derived from this*)\n\n\nsubsection \\Frame Monotonicity\\\n\nlemma load_list_frame_mono_option:\n \"frame_mono_option (\\h. load_list h n p)\"\n unfolding frame_mono_option_def load_list_def\n by (clarsimp simp: deoption_list_def, subst load_list_basic_heap_mono_simp)\n (auto elim: Some_set_member)\n\nlemmas load_list_frame_mono = frame_mono_optionE[OF load_list_frame_mono_option]\n\nlemma decode_pde_frame_mono_option:\n \"frame_mono_option (\\h. decode_heap_pde h p)\"\n unfolding frame_mono_option_def decode_pde_def decode_heap_pde_def load_machine_word_def load_value_def\n Let_def\n by (intro allI impI, elim conjE)\n (case_tac \"load_list h (size_of TYPE(32 word)) p\", \n auto simp: load_list_heap_mono)\n\nlemmas decode_pde_frame_mono = frame_mono_optionE[OF decode_pde_frame_mono_option]\n\nlemma decode_pte_frame_mono_option:\n \"frame_mono_option (\\h. decode_heap_pte h p)\"\n unfolding frame_mono_option_def decode_pte_def decode_heap_pte_def load_machine_word_def load_value_def\n Let_def\n by (intro allI impI, elim conjE)\n (case_tac \"load_list h (size_of TYPE(32 word)) p\", \n auto simp: load_list_heap_mono)\n\nlemmas decode_pte_frame_mono = frame_mono_optionE[OF decode_pte_frame_mono_option]\n\nlemma lookup_pte_frame_mono_option:\n \"frame_mono_option (\\h. lookup_pte h r vp)\"\n unfolding frame_mono_option_def lookup_pte_def load_machine_word_def \n load_value_def Let_def get_pte_def\n by (intro allI impI, elim conjE)\n (case_tac \"decode_heap_pte h (r r+ (vaddr_pt_index (addr_val vp) << 2))\",\n auto simp: decode_pte_heap_mono)\n\nlemmas lookup_pte_frame_mono = frame_mono_optionE[OF lookup_pte_frame_mono_option]\n\nlemma lookup_pde_frame_mono_option:\n \"frame_mono_option (\\h. lookup_pde h r vp)\"\n unfolding frame_mono_option_def lookup_pde_def load_machine_word_def \n load_value_def Let_def get_pde_def\n apply (intro allI impI, elim conjE)\n apply (case_tac \"decode_heap_pde h (r r+ (vaddr_pd_index (addr_val vp) << 2))\")\n apply simp\n apply simp\n apply (drule (1) decode_pde_heap_mono)\n apply simp\n apply (case_tac a)\n apply (auto elim!: lookup_pte_frame_mono)\n done\n\nlemmas lookup_pde_frame_mono = frame_mono_optionE[OF lookup_pde_frame_mono_option]\n\nlemma ptable_lift_frame_mono_option:\n \"frame_mono_option (\\h. ptable_lift h r vp)\"\n unfolding frame_mono_option_def ptable_lift_def Let_def\n apply (intro allI impI, elim conjE)\n apply (case_tac \"lookup_pde (h ++ h') r vp\", simp)\n apply (frule (1) lookup_pde_frame_mono)\n apply clarsimp\n done\n\nlemmas ptable_lift_frame_mono = frame_mono_optionE[OF ptable_lift_frame_mono_option]\n\nlemma get_page_frame_mono_option:\n \"frame_mono_option (\\h. get_page h r vp)\"\n unfolding frame_mono_option_def get_page_def Let_def\n apply (intro allI impI, elim conjE)\n apply (case_tac \"lookup_pde (h ++ h') r vp\", simp)\n apply (frule (1) lookup_pde_frame_mono)\n apply clarsimp\n done\n\nlemmas get_page_frame_mono = frame_mono_optionE[OF get_page_frame_mono_option]\n\n\nsubsection \\Preservation of trace and lift During Updates Outside a Trace\\\n\nlemma decode_pde_update_eq:\n \"\\ p \\ set (addr_seq start 4) \\\n \\ decode_heap_pde (h(p \\ v)) start = decode_heap_pde h start\"\n unfolding decode_pde_def decode_heap_pde_def load_machine_word_def\n by (simp add: load_value_update_eq)\n\nlemma decode_pte_update_eq:\n \"\\ p \\ set (addr_seq start 4) \\\n \\ decode_heap_pte (h(p \\ v)) start = decode_heap_pte h start\"\n unfolding decode_pte_def decode_heap_pte_def load_machine_word_def\n by (simp add: load_value_update_eq)\n\nlemma not_in_trace_not_in_pde:\n assumes trace: \"p \\ ptable_trace h r vp\"\n assumes lift: \"ptable_lift h r vp = Some p\"\n shows \"p \\ set (addr_seq (r r+ (vaddr_pd_index (addr_val vp) << 2)) 4)\"\nproof -\n from lift \n obtain pde where \n \"decode_heap_pde h (r r+ (vaddr_pd_index (addr_val vp) << 2)) = Some pde \"\n by (auto dest: lift_valid_pde_valid)\n thus ?thesis using trace unfolding ptable_trace_def Let_def\n by (cases pde, auto)\nqed\n\n(*XXX:name modified to not conflict with instantiation of locale*)\nlemma ptable_trace_preserved':\n \"\\ p \\ ptable_trace h r vp ; ptable_lift h r vp = Some p \\ \n \\ ptable_trace (h(p \\ v)) r vp = ptable_trace h r vp\"\n apply (frule (1) not_in_trace_not_in_pde)\n apply (unfold ptable_trace_def ptable_lift_def Let_def lookup_pde_def)\n apply (simp add: decode_pde_update_eq)\n done\n\n(*XXX:name modified to not conflict with instantiation of locale*)\nlemma ptable_lift_preserved':\n \"\\ p \\ ptable_trace h r vp ; ptable_lift h r vp = Some p \\\n \\ ptable_lift (h(p \\ v)) r vp = Some p\"\n apply (frule (1) not_in_trace_not_in_pde)\n apply (unfold ptable_trace_def ptable_lift_def lookup_pde_def lookup_pte_def Let_def)\n apply clarsimp\n apply (case_tac \"decode_heap_pde h (r r+ (vaddr_pd_index (addr_val vp) << 2))\")\n apply (simp add: get_pde_def)\n apply (rule_tac x=a and y=aa in exI2)\n apply clarsimp\n apply (rename_tac pde)\n apply (case_tac pde)\n apply (clarsimp simp: get_pde_def get_pte_def Let_def \n decode_pde_update_eq decode_pte_update_eq)+\n done\n (*XXX: shorter, but still ugly proof*)\n\ninterpretation (*XXX: no requirements on get_page so ignored in proof, but is it taken into account for the interpretation?*)\n pagetable ptable_lift ptable_trace get_page\n by (unfold_locales)\n (auto elim!: ptable_lift_heap_mono ptable_lift_frame_mono\n ptable_trace_heap_mono_simp\n ptable_lift_preserved' ptable_trace_preserved')\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Page_Tables/PageTable_seL4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.34158251284363395, "lm_q1q2_score": 0.19071473269279965}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__35_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__35_on_rules imports n_german_lemma_on_inv__35\nbegin\nsection{*All lemmas on causal relation between inv__35*}\nlemma lemma_inv__35_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__35) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__35_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.34158249273565866, "lm_q1q2_score": 0.1907147264866852}} {"text": "theory Properties\nimports Cheri_axioms_lemmas Sail.Sail2_state_lemmas\nbegin\n\nlocale CHERI_ISA = Capability_ISA CC ISA\n for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n fixes fetch_assms :: \"'regval trace \\ bool\" and instr_assms :: \"'regval trace \\ bool\"\n assumes instr_cheri_axioms: \"\\t instr. hasTrace t \\instr\\ \\ instr_assms t \\ cheri_axioms CC ISA False (instr_raises_ex ISA instr t) (invokes_caps ISA instr t) t\"\n and fetch_cheri_axioms: \"\\t. hasTrace t (instr_fetch ISA) \\ fetch_assms t \\ cheri_axioms CC ISA True (fetch_raises_ex ISA t) False t\"\n and instr_assms_appendE: \"\\t t' instr. instr_assms (t @ t') \\ Run \\instr\\ t () \\ instr_assms t \\ fetch_assms t'\"\n and fetch_assms_appendE: \"\\t t' instr. fetch_assms (t @ t') \\ Run (instr_fetch ISA) t instr \\ fetch_assms t \\ instr_assms t'\"\n\nlocale Register_Accessors =\n fixes read_regval :: \"register_name \\ 'regs \\ 'regval option\"\n and write_regval :: \"register_name \\ 'regval \\ 'regs \\ 'regs option\"\nbegin\n\nabbreviation \"s_emit_event e s \\ emitEventS (read_regval, write_regval) e s\"\nabbreviation \"s_run_trace t s \\ runTraceS (read_regval, write_regval) t s\"\nabbreviation \"s_allows_trace t s \\ \\s'. s_run_trace t s = Some s'\"\n\nend\n\nlocale CHERI_ISA_State = CHERI_ISA CC ISA + Register_Accessors read_regval write_regval\n for ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\n and CC :: \"'cap Capability_class\"\n and read_regval :: \"register_name \\ 'regs \\ 'regval option\"\n and write_regval :: \"register_name \\ 'regval \\ 'regs \\ 'regs option\" +\n (* State versions of ISA model parameters *)\n fixes s_translation_tables :: \"'regs sequential_state \\ nat set\"\n and s_translate_address :: \"nat \\ acctype \\ 'regs sequential_state \\ nat option\"\n assumes read_absorb_write: \"\\r v s s'. write_regval r v s = Some s' \\ read_regval r s' = Some v\"\n and read_ignore_write: \"\\r r' v s s'. write_regval r v s = Some s' \\ r' \\ r \\ read_regval r' s' = read_regval r' s\"\n and translation_tables_sound: \"\\t s. s_allows_trace t s \\ translation_tables ISA t \\ s_translation_tables s\"\n and translate_address_sound: \"\\t s vaddr paddr load.\n s_allows_trace t s \\\n translate_address ISA vaddr load t = Some paddr \\\n s_translate_address vaddr load s = Some paddr\"\n and translate_address_tag_aligned_iff: \"\\s vaddr paddr load.\n s_translate_address vaddr load s = Some paddr \\\n address_tag_aligned ISA paddr \\ address_tag_aligned ISA vaddr\"\nbegin\n\nsubsection \\Reachable capabilities\\\n\nfun get_reg_val :: \"register_name \\ 'regs sequential_state \\ 'regval option\" where\n \"get_reg_val r s = read_regval r (regstate s)\"\n\nfun put_reg_val :: \"register_name \\ 'regval \\ 'regs sequential_state \\ 'regs sequential_state option\" where\n \"put_reg_val r v s = map_option (\\rs'. s\\regstate := rs'\\) (write_regval r v (regstate s))\"\n\nfun get_reg_caps :: \"register_name \\ 'regs sequential_state \\ 'cap set\" where\n \"get_reg_caps r s = (case read_regval r (regstate s) of Some v \\ {c \\ caps_of_regval ISA v. is_tagged_method CC c} | None \\ {})\"\n\nfun get_mem_cap :: \"nat \\ nat \\ 'regs sequential_state \\ 'cap option\" where\n \"get_mem_cap addr sz s =\n Option.bind (get_mem_bytes addr sz s) (\\(bytes, tag).\n Option.bind (cap_of_mem_bytes_method CC bytes tag) (\\c.\n if is_tagged_method CC c then Some c else None))\"\n\nfun get_aligned_mem_cap :: \"nat \\ nat \\ 'regs sequential_state \\ 'cap option\" where\n \"get_aligned_mem_cap vaddr sz s =\n (if address_tag_aligned ISA vaddr \\ sz = tag_granule ISA then get_mem_cap vaddr sz s else None)\"\n\ninductive_set reachable_caps :: \"'regs sequential_state \\ 'cap set\" for s :: \"'regs sequential_state\" where\n Reg: \"\\c \\ get_reg_caps r s; r \\ privileged_regs ISA; is_tagged_method CC c\\ \\ c \\ reachable_caps s\"\n| SysReg:\n \"\\c \\ get_reg_caps r s; r \\ privileged_regs ISA; c' \\ reachable_caps s;\n permit_system_access (get_perms_method CC c'); \\is_sealed_method CC c';\n is_tagged_method CC c\\\n \\ c \\ reachable_caps s\"\n| Mem:\n \"\\get_aligned_mem_cap addr (tag_granule ISA) s = Some c;\n s_translate_address vaddr Load s = Some addr;\n c' \\ reachable_caps s; is_tagged_method CC c'; \\is_sealed_method CC c';\n set (address_range vaddr (tag_granule ISA)) \\ get_mem_region_method CC c';\n permit_load_capability (get_perms_method CC c');\n is_tagged_method CC c\\\n \\ c \\ reachable_caps s\"\n| Restrict: \"\\c \\ reachable_caps s; leq_cap CC c' c\\ \\ c' \\ reachable_caps s\"\n| Seal:\n \"\\c' \\ reachable_caps s; c'' \\ reachable_caps s; is_tagged_method CC c'; is_tagged_method CC c'';\n \\is_sealed_method CC c''; \\is_sealed_method CC c'; permit_seal (get_perms_method CC c'')\\ \\\n seal CC c' (get_cursor_method CC c'') \\ reachable_caps s\"\n| Unseal:\n \"\\c' \\ reachable_caps s; c'' \\ reachable_caps s; is_tagged_method CC c'; is_tagged_method CC c'';\n \\is_sealed_method CC c''; is_sealed_method CC c'; permit_unseal (get_perms_method CC c'');\n get_obj_type_method CC c' = get_cursor_method CC c''\\ \\\n unseal CC c' (get_global CC c'') \\ reachable_caps s\"\n\nlemma derivable_subseteq_reachableI:\n assumes \"C \\ reachable_caps s\"\n shows \"derivable C \\ reachable_caps s\"\nproof\n fix c\n assume \"c \\ derivable C\"\n then show \"c \\ reachable_caps s\" using assms\n by induction (auto intro: reachable_caps.intros)\nqed\n\nlemma derivable_subseteq_reachableE:\n assumes \"derivable C \\ reachable_caps s\"\n shows \"C \\ reachable_caps s\"\n using assms by (auto intro: derivable.intros)\n\nlemma derivable_reachable_caps_idem[simp]: \"derivable (reachable_caps s) = reachable_caps s\"\n using derivable_subseteq_reachableI[of \"reachable_caps s\" s] derivable_refl\n by auto\n\nlemma runTraceS_rev_induct[consumes 1, case_names Init Step]:\n assumes \"s_run_trace t s = Some s'\"\n and Init: \"P [] s\"\n and Step: \"\\t e s'' s'. s_run_trace t s = Some s'' \\ s_emit_event e s'' = Some s' \\ P t s'' \\ P (t @ [e]) s'\"\n shows \"P t s'\"\n using assms\n by (induction t arbitrary: s' rule: rev_induct)\n (auto elim: runTraceS_appendE runTraceS_ConsE simp: bind_eq_Some_conv)\n\nlemma get_reg_val_s_run_trace_cases:\n assumes v: \"get_reg_val r s' = Some v\" and c: \"c \\ caps_of_regval ISA v\"\n and s': \"s_run_trace t s = Some s'\"\n obtains (Init) \"get_reg_val r s = Some v\"\n | (Update) j v' where \"t ! j = E_write_reg r v'\" and \"c \\ caps_of_regval ISA v'\" and \"j < length t\"\nproof (use s' v c in \\induction rule: runTraceS_rev_induct\\)\n case (Step t e s'' s')\n note Init = Step(4)\n note Update = Step(5)\n note c = \\c \\ caps_of_regval ISA v\\\n show ?case\n proof cases\n assume v_s'': \"get_reg_val r s'' = Some v\"\n show ?thesis\n proof (rule Step.IH[OF _ _ v_s'' c])\n assume \"get_reg_val r s = Some v\"\n then show thesis by (intro Init)\n next\n fix j v'\n assume \"t ! j = E_write_reg r v'\" and \"c \\ caps_of_regval ISA v'\" and \"j < length t\"\n then show thesis by (intro Update[of j v']) (auto simp: nth_append_left)\n qed\n next\n assume v_s'': \"get_reg_val r s'' \\ Some v\"\n note e = \\s_emit_event e s'' = Some s'\\\n note v_s' = \\get_reg_val r s' = Some v\\\n from e v_s' v_s'' have \"e = E_write_reg r v\"\n proof (cases rule: emitEventS_update_cases)\n case (Write_reg r' v' rs')\n then show ?thesis\n using v_s' v_s''\n by (cases \"r' = r\") (auto simp: read_ignore_write read_absorb_write)\n qed (auto simp: put_mem_bytes_def Let_def)\n then show thesis using c by (auto intro: Update[of \"length t\" v])\n qed\nqed auto\n\nlemma reads_reg_cap_at_idx_provenance[consumes 5]:\n assumes r: \"t ! i = E_read_reg r v\" and c: \"c \\ caps_of_regval ISA v\" and tag: \"is_tagged_method CC c\"\n and s': \"s_run_trace t s = Some s'\" and i: \"i < length t\"\n obtains (Initial) \"c \\ get_reg_caps r s\"\n | (Update) j where \"c \\ writes_reg_caps CC (caps_of_regval ISA) (t ! j)\"\n and \"writes_to_reg (t ! j) = Some r\" and \"j < i\"\nproof -\n from s' i obtain s1 s2\n where s1: \"s_run_trace (take i t) s = Some s1\"\n and s2: \"s_emit_event (t ! i) s1 = Some s2\"\n by (blast elim: runTraceS_nth_split)\n from s2 c r tag have \"c \\ get_reg_caps r s1\"\n by (auto simp: bind_eq_Some_conv split: option.splits if_splits)\n with s1 Update show thesis using i\n proof (induction \"take i t\" s1 arbitrary: i t rule: runTraceS_rev_induct)\n case Init\n then show ?case by (intro Initial)\n next\n case (Step t' e s'' s' i t)\n then obtain j where j: \"i = Suc j\" by (cases i) auto\n then have t': \"t' = take j t\" and e: \"e = t ! j\"\n using Step by (auto simp: take_hd_drop[symmetric] hd_drop_conv_nth)\n note IH = Step(3)[of j t]\n note Update = Step(5)\n note i = \\i < length t\\\n show ?case\n proof (use \\s_emit_event e s'' = Some s'\\ in \\cases rule: emitEventS_update_cases\\)\n case (Write_mem wk addr sz v tag res)\n then have c: \"c \\ get_reg_caps r s''\"\n using Step\n by (auto simp: put_mem_bytes_def bind_eq_Some_conv Let_def)\n show ?thesis\n by (rule IH) (use c t' i j Update in \\auto\\)\n next\n case (Write_reg r' v rs')\n show ?thesis\n proof cases\n assume \"r' = r\"\n then show ?thesis\n using Write_reg e j \\c \\ get_reg_caps r s'\\\n by (intro Update[of j]) (auto simp: read_absorb_write)\n next\n assume \"r' \\ r\"\n show ?thesis\n by (rule IH)\n (use \\r' \\ r\\ Write_reg e t' i j \\c \\ get_reg_caps r s'\\ Update in\n \\auto simp: read_ignore_write\\)\n qed\n next\n case Read\n show ?thesis\n by (rule IH) (use Read Step.prems t' i j Update in \\auto\\)\n qed\n qed\nqed\n\nlemma reads_reg_cap_at_idx_from_initial:\n assumes r: \"t ! i = E_read_reg r v\" and c: \"c \\ caps_of_regval ISA v\" and tag: \"is_tagged_method CC c\"\n and s': \"s_run_trace t s = Some s'\" and i: \"i < length t\"\n and \"\\ cap_reg_written_before_idx CC ISA i r t\"\n shows \"c \\ get_reg_caps r s\"\n using assms\n by (elim reads_reg_cap_at_idx_provenance)\n (auto simp: cap_reg_written_before_idx_def writes_reg_caps_at_idx_def)\n\nsubsection \\Capability monotonicity\\\n\nlemma available_caps_mono:\n assumes j: \"j < i\"\n shows \"available_caps CC ISA j t \\ available_caps CC ISA i t\"\nproof -\n have \"available_caps CC ISA j t \\ available_caps CC ISA (Suc (j + k)) t\" for k\n by (induction k) (auto simp: available_caps_Suc image_iff subset_iff)\n then show ?thesis using assms less_iff_Suc_add[of j i] by blast\nqed\n\nlemma reads_reg_cap_non_privileged_accessible[intro]:\n assumes \"c \\ caps_of_regval ISA v\" and \"t ! j = E_read_reg r v\"\n and \"\\cap_reg_written_before_idx CC ISA j r t\"\n and \"r \\ privileged_regs ISA\"\n and \"is_tagged_method CC c\"\n and \"j < i\"\n and \"j < length t\"\n shows \"c \\ available_caps CC ISA i t\"\nproof -\n from assms have c: \"c \\ available_caps CC ISA (Suc j) t\"\n by (auto simp: bind_eq_Some_conv image_iff available_caps.simps)\n consider \"i = Suc j\" | \"Suc j < i\" using \\j < i\\\n by (cases \"i = Suc j\") auto\n then show \"c \\ available_caps CC ISA i t\"\n using c available_caps_mono[of \"Suc j\" i t]\n by cases auto\nqed\n\nlemma system_access_permitted_at_idx_available_caps:\n assumes \"system_access_permitted_before_idx CC ISA i t\"\n obtains c where \"c \\ available_caps CC ISA i t\" and \"is_tagged_method CC c\"\n and \"\\is_sealed_method CC c\" and \"permit_system_access (get_perms_method CC c)\"\n using assms\n by (auto simp: system_access_permitted_before_idx_def; blast)\n\nlemma writes_reg_cap_nth_provenance[consumes 4]:\n assumes \"t ! i = E_write_reg r v\" and \"c \\ caps_of_regval ISA v\"\n and \"cheri_axioms CC ISA is_fetch has_ex inv_caps t\"\n and \"i < length t\"\n and tagged: \"is_tagged_method CC c\"\n obtains (Accessible) \"c \\ derivable (available_caps CC ISA i t)\"\n | (Exception) v' r' j where \"c \\ exception_targets ISA {v. \\r j. j < i \\ j < length t \\ t ! j = E_read_reg r v \\ r \\ KCC ISA}\" (* \"leq_cap CC c c'\"*)\n (*and \"t ! j = E_read_reg r' v'\" and \"j < i\"*) (*and \"c' \\ caps_of_regval ISA v'\"*)\n (*and \"r' \\ KCC ISA\"*) and \"r \\ PCC ISA\" and \"has_ex\"\n | (CCall) cc cd c' where \"inv_caps\" (*\"(cc, cd) \\ inv_caps\"*) and \"invokable CC cc cd\"\n and \"cc \\ derivable (available_caps CC ISA i t)\"\n and \"cd \\ derivable (available_caps CC ISA i t)\"\n and \"(r \\ PCC ISA \\ leq_cap CC c (unseal CC cc True)) \\\n (r \\ IDC ISA \\ leq_cap CC c (unseal CC cd True))\"\n using assms\n unfolding cheri_axioms_def store_cap_reg_axiom_def writes_reg_caps_at_idx_def cap_derivable_iff_derivable\n by (elim impE conjE allE[where x = i] allE[where x = c])\n (auto simp: eq_commute[where b = \"t ! j\" for t j])\n\nlemma get_mem_cap_run_trace_cases:\n assumes c: \"get_mem_cap addr (tag_granule ISA) s' = Some c\"\n and s': \"s_run_trace t s = Some s'\"\n and tagged: \"is_tagged_method CC c\"\n and aligned: \"address_tag_aligned ISA addr\"\n and axiom: \"store_tag_axiom CC ISA t\"\n obtains (Initial) \"get_mem_cap addr (tag_granule ISA) s = Some c\"\n | (Update) k wk bytes r where \"k < length t\"\n and \"t ! k = E_write_memt wk addr (tag_granule ISA) bytes B1 r\"\n and \"cap_of_mem_bytes_method CC bytes B1 = Some c\"\nproof (use s' c axiom in \\induction rule: runTraceS_rev_induct\\)\n case (Step t e s'' s')\n note Update = Step.prems(2)\n have axiom: \"store_tag_axiom CC ISA t\"\n using \\store_tag_axiom CC ISA (t @ [e])\\\n by (auto simp: store_tag_axiom_def writes_mem_val_at_idx_def nth_append bind_eq_Some_conv split: if_splits; metis less_SucI)\n have IH: \"thesis\" if \"get_mem_cap addr (tag_granule ISA) s'' = Some c\"\n proof (rule Step.IH[OF _ _ that axiom])\n assume \"get_mem_cap addr (tag_granule ISA) s = Some c\"\n then show thesis by (rule Initial)\n next\n fix k wk bytes r\n assume \"k < length t\" and \"t ! k = E_write_memt wk addr (tag_granule ISA) bytes B1 r\"\n and \"cap_of_mem_bytes_method CC bytes B1 = Some c\"\n then show thesis\n by (intro Update[of k wk bytes r]) (auto simp: nth_append)\n qed\n obtain v tag\n where v: \"get_mem_bytes addr (tag_granule ISA) s' = Some (v, tag)\"\n and cv: \"cap_of_mem_bytes_method CC v tag = Some c\"\n using \\get_mem_cap addr (tag_granule ISA) s' = Some c\\\n by (auto simp: bind_eq_Some_conv bool_of_bitU_def split: if_splits)\n then have tag: \"tag = B1\" using tagged by auto\n from \\s_emit_event e s'' = Some s'\\ show thesis\n proof (cases rule: emitEventS_update_cases)\n case (Write_mem wk addr' sz' v' tag' r)\n have sz': \"tag' = B1 \\ (address_tag_aligned ISA addr' \\ sz' = tag_granule ISA)\"\n and len_v': \"length v' = sz'\"\n using \\store_tag_axiom CC ISA (t @ [e])\\ Write_mem\n by (auto simp: store_tag_axiom_def writes_mem_val_at_idx_def bind_eq_Some_conv nth_append split: if_splits)\n show ?thesis\n proof cases\n assume addr_disj: \"{addr.. {addr'.. {addr'.. {}\"\n then have tag': \"tag' = B1\"\n proof -\n obtain addr''\n where addr_orig: \"addr'' \\ {addr.. {addr'..get_mem_cap addr (tag_granule ISA) s' = Some c\\ show thesis\n by (auto intro: IH simp: get_mem_bytes_def)\n next\n case Read\n with \\get_mem_cap addr (tag_granule ISA) s' = Some c\\ show thesis\n by (auto intro: IH)\n qed\nqed auto\n\nlemma reads_mem_cap_at_idx_provenance:\n assumes read: \"t ! i = E_read_memt rk addr (tag_granule ISA) (bytes, B1)\"\n and c: \"cap_of_mem_bytes_method CC bytes B1 = Some c\"\n and s': \"s_run_trace t s = Some s'\"\n and axioms: \"cheri_axioms CC ISA is_fetch has_ex inv_caps t\"\n and i: \"i < length t\"\n and tagged: \"is_tagged_method CC c\"\n and aligned: \"address_tag_aligned ISA addr\"\n obtains (Initial) \"get_mem_cap addr (tag_granule ISA) s = Some c\"\n | (Update) k wk bytes' r where \"k < i\"\n and \"t ! k = E_write_memt wk addr (tag_granule ISA) bytes' B1 r\"\n and \"cap_of_mem_bytes_method CC bytes' B1 = Some c\"\nproof -\n obtain s''\n where s'': \"s_run_trace (take i t) s = Some s''\"\n and c': \"get_mem_cap addr (tag_granule ISA) s'' = Some c\"\n using s' i read c tagged\n by (cases rule: runTraceS_nth_split; cases \"t ! i\")\n (auto simp: bind_eq_Some_conv reads_mem_cap_def split: if_splits)\n have \"store_tag_axiom CC ISA (take i t)\"\n using axioms\n by (fastforce simp: cheri_axioms_def store_tag_axiom_def writes_mem_val_at_idx_def bind_eq_Some_conv)\n with c' s'' tagged aligned show thesis\n by (cases rule: get_mem_cap_run_trace_cases) (auto intro: that)\nqed\n\nfun s_invariant :: \"('regs sequential_state \\ 'a) \\ 'regval trace \\ 'regs sequential_state \\ bool\" where\n \"s_invariant f [] s = True\"\n| \"s_invariant f (e # t) s = (case s_emit_event e s of Some s' \\ f s' = f s \\ s_invariant f t s' | None \\ False)\"\n\nabbreviation s_invariant_holds :: \"('regs sequential_state \\ bool) \\ 'regval trace \\ 'regs sequential_state \\ bool\" where\n \"s_invariant_holds P t s \\ P s \\ s_invariant P t s\"\n\nlemma s_invariant_append:\n \"s_invariant f (\\ @ \\) s \\\n (\\s'. s_invariant f \\ s \\ s_run_trace \\ s = Some s' \\ s_invariant f \\ s')\"\n by (induction \\ arbitrary: s) (auto split: option.splits simp: runTraceS_Cons_tl)\n\nlemma s_invariant_takeI:\n assumes \"s_invariant f t s\"\n shows \"s_invariant f (take n t) s\"\nproof -\n from assms have \"s_invariant f (take n t @ drop n t) s\" by auto\n then show ?thesis unfolding s_invariant_append by auto\nqed\n\nlemma s_invariant_run_trace_eq:\n assumes \"s_invariant f t s\" and \"s_run_trace t s = Some s'\"\n shows \"f s' = f s\"\n using assms\n by (induction f t s rule: s_invariant.induct)\n (auto split: option.splits elim: runTraceS_ConsE)\n\ndefinition no_caps_in_translation_tables :: \"'regs sequential_state \\ bool\" where\n \"no_caps_in_translation_tables s \\\n \\addr sz c. get_mem_cap addr sz s = Some c \\ is_tagged_method CC c \\\n addr \\ s_translation_tables s\"\n\nlemma derivable_available_caps_subseteq_reachable_caps:\n assumes axioms: \"cheri_axioms CC ISA is_fetch has_ex inv_caps t\"\n and t: \"s_run_trace t s = Some s'\"\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n shows \"derivable (available_caps CC ISA i t) \\ reachable_caps s\"\nproof (induction i rule: less_induct)\n case (less i)\n show ?case proof\n fix c\n assume \"c \\ derivable (available_caps CC ISA i t)\"\n then show \"c \\ reachable_caps s\"\n proof induction\n fix c\n assume \"c \\ available_caps CC ISA i t\"\n then show \"c \\ reachable_caps s\"\n proof (cases rule: available_caps_cases)\n case (Reg r v j)\n with t have initial: \"c \\ get_reg_caps r s\"\n by (blast intro: reads_reg_cap_at_idx_from_initial)\n show ?thesis\n proof cases\n assume r: \"r \\ privileged_regs ISA\"\n then obtain c' where c': \"c' \\ reachable_caps s\" and \"is_tagged_method CC c'\"\n and \"\\is_sealed_method CC c'\" and p: \"permit_system_access (get_perms_method CC c')\"\n using Reg less.IH[OF \\j < i\\] derivable_refl[of \"available_caps CC ISA j t\"]\n by (auto elim!: system_access_permitted_at_idx_available_caps)\n then show ?thesis\n using Reg\n by (auto intro: reachable_caps.SysReg[OF initial r c'])\n next\n assume \"r \\ privileged_regs ISA\"\n then show ?thesis using initial Reg by (auto intro: reachable_caps.Reg)\n qed\n next\n case (Mem wk paddr bytes j sz)\n note read = \\t ! j = E_read_memt wk paddr sz (bytes, B1)\\\n note bytes = \\cap_of_mem_bytes_method CC bytes B1 = Some c\\\n have addr: \"paddr \\ translation_tables ISA (take j t)\"\n proof\n assume paddr_j: \"paddr \\ translation_tables ISA (take j t)\"\n then have \"paddr \\ s_translation_tables s\"\n using translation_tables_sound[of \"take j t\" s] t \\j < length t\\\n by (auto elim: runTraceS_nth_split)\n moreover have \"paddr \\ s_translation_tables s\"\n proof -\n obtain s''\n where s'': \"s_run_trace (take j t) s = Some s''\"\n and c_s'': \"get_mem_cap paddr sz s'' = Some c\"\n using t \\j < length t\\ read bytes \\is_tagged_method CC c\\\n by (cases rule: runTraceS_nth_split; cases \"t ! j\")\n (auto simp: bind_eq_Some_conv reads_mem_cap_def split: if_splits)\n moreover have \"no_caps_in_translation_tables s''\"\n using no_caps_in_translation_tables s''\n using s_invariant_takeI[of no_caps_in_translation_tables t s j]\n using s_invariant_run_trace_eq[of no_caps_in_translation_tables \"take j t\" s s'']\n by auto\n moreover have \"s_translation_tables s'' = s_translation_tables s\"\n using translation_table_addrs_invariant s''\n by (intro s_invariant_run_trace_eq) (auto intro: s_invariant_takeI)\n ultimately show ?thesis\n using \\is_tagged_method CC c\\\n by (fastforce simp: no_caps_in_translation_tables_def bind_eq_Some_conv)\n qed\n ultimately show False by blast\n qed\n then obtain vaddr c'\n where vaddr: \"translate_address ISA vaddr Load (take j t) = Some paddr\"\n and c': \"c' \\ derivable (available_caps CC ISA j t)\"\n \"is_tagged_method CC c'\" \"\\is_sealed_method CC c'\"\n \"set (address_range vaddr sz) \\ get_mem_region_method CC c'\"\n \"permit_load (get_perms_method CC c')\"\n \"permit_load_capability (get_perms_method CC c')\"\n and sz: \"sz = tag_granule ISA\"\n and aligned: \"address_tag_aligned ISA paddr\"\n using read t axioms \\j < length t\\ \\is_tagged_method CC c\\\n unfolding cheri_axioms_def load_mem_axiom_def reads_mem_cap_def\n by (fastforce simp: reads_mem_val_at_idx_def bind_eq_Some_conv cap_derivable_iff_derivable split: if_splits)\n have s_vaddr: \"s_translate_address vaddr Load s = Some paddr\"\n using vaddr t \\j < length t\\\n by (blast intro: translate_address_sound[of \"take j t\"] elim: runTraceS_nth_split)\n from read[unfolded sz] bytes t axioms \\j < length t\\ \\is_tagged_method CC c\\ aligned\n show ?thesis\n proof (cases rule: reads_mem_cap_at_idx_provenance)\n case Initial\n then show ?thesis\n using Mem s_vaddr less.IH[of j] c' aligned sz\n by (intro reachable_caps.Mem[of paddr s c vaddr c'])\n (auto simp: bind_eq_Some_conv translate_address_tag_aligned_iff permits_cap_load_def)\n next\n case (Update k wk bytes' r)\n then show ?thesis\n using axioms \\is_tagged_method CC c\\ \\j < length t\\ \\j < i\\ less.IH[of k]\n unfolding cheri_axioms_def store_cap_mem_axiom_def\n by (auto simp: writes_mem_cap_at_idx_def writes_mem_cap_Some_iff bind_eq_Some_conv cap_derivable_iff_derivable)\n qed\n qed\n qed (auto intro: reachable_caps.intros)\n qed\nqed\n\nlemma put_regval_get_mem_cap:\n assumes s': \"put_reg_val r v s = Some s'\"\n and \"s_translate_address addr acctype s' = s_translate_address addr acctype s\"\n shows \"get_mem_cap addr sz s' = get_mem_cap addr sz s\"\n using assms by (auto cong: bind_option_cong simp: get_mem_bytes_def)\n\ndefinition system_access_reachable :: \"'regs sequential_state \\ bool\" where\n \"system_access_reachable s \\ \\c \\ reachable_caps s.\n permit_system_access (get_perms_method CC c) \\ \\is_sealed_method CC c\"\n\nlemma get_reg_cap_intra_domain_trace_reachable:\n assumes r: \"c \\ get_reg_caps r s'\"\n (*and t: \"hasTrace t (instr_sem ISA instr)\"*) and s': \"s_run_trace t s = Some s'\"\n and axioms: \"cheri_axioms CC ISA is_fetch False False t\"\n (*and no_exception: \"\\hasException t (instr_sem ISA instr)\"\n and no_ccall: \"invoked_caps ISA instr t = {}\"*)\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n and tag: \"is_tagged_method CC c\"\n and priv: \"r \\ privileged_regs ISA \\ system_access_reachable s\"\n shows \"c \\ reachable_caps s\"\nproof -\n from r obtain v where v: \"get_reg_val r s' = Some v\" and c: \"c \\ caps_of_regval ISA v\"\n by (auto simp: bind_eq_Some_conv split: option.splits)\n from v c s' show \"c \\ reachable_caps s\"\n proof (cases rule: get_reg_val_s_run_trace_cases)\n case Init\n show ?thesis\n proof cases\n assume r: \"r \\ privileged_regs ISA\"\n with priv obtain c' where c': \"c' \\ reachable_caps s\"\n and \"permit_system_access (get_perms_method CC c')\" and \"\\is_sealed_method CC c'\"\n by (auto simp: system_access_reachable_def)\n then show ?thesis using Init c tag by (intro reachable_caps.SysReg[OF _ r c']) auto\n next\n assume \"r \\ privileged_regs ISA\"\n then show ?thesis using Init c tag by (intro reachable_caps.Reg) auto\n qed\n next\n case (Update j v')\n then have *: \"c \\ writes_reg_caps CC (caps_of_regval ISA) (t ! j)\"\n and \"writes_to_reg (t ! j) = Some r\"\n using c tag by auto\n then have \"c \\ derivable (available_caps CC ISA j t)\"\n using axioms tag \\j < length t\\\n unfolding cheri_axioms_def store_cap_reg_axiom_def\n by (fastforce simp: cap_derivable_iff_derivable)\n moreover have \"derivable (available_caps CC ISA j t) \\ reachable_caps s\"\n using axioms s' translation_table_addrs_invariant no_caps_in_translation_tables\n by (intro derivable_available_caps_subseteq_reachable_caps)\n ultimately show ?thesis by auto\n qed\nqed\n\nlemma reachable_caps_trace_intradomain_monotonicity:\n assumes axioms: \"cheri_axioms CC ISA is_fetch False False t\"\n and s': \"s_run_trace t s = Some s'\"\n and addr_trans_inv: \"s_invariant (\\s' addr load. s_translate_address addr load s') t s\"\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n shows \"reachable_caps s' \\ reachable_caps s\"\nproof\n fix c\n assume \"c \\ reachable_caps s'\"\n then show \"c \\ reachable_caps s\"\n proof induction\n case (Reg r c)\n then show ?case\n using axioms s' translation_table_addrs_invariant no_caps_in_translation_tables\n by (intro get_reg_cap_intra_domain_trace_reachable) auto\n next\n case (SysReg r c c')\n then show ?case\n using axioms s' translation_table_addrs_invariant no_caps_in_translation_tables\n by (intro get_reg_cap_intra_domain_trace_reachable) (auto simp: system_access_reachable_def)\n next\n case (Mem addr c vaddr c')\n then have c: \"get_mem_cap addr (tag_granule ISA) s' = Some c\"\n and aligned: \"address_tag_aligned ISA addr\"\n by (auto split: if_splits)\n have axiom: \"store_tag_axiom CC ISA t\"\n using axioms\n by (auto simp: cheri_axioms_def)\n from c s' \\is_tagged_method CC c\\ aligned axiom show ?case\n proof (cases rule: get_mem_cap_run_trace_cases)\n case Initial\n have \"s_translate_address vaddr Load s' = s_translate_address vaddr Load s\"\n using s_invariant_run_trace_eq[OF addr_trans_inv s']\n by meson\n then show ?thesis\n using Initial Mem\n by (intro reachable_caps.Mem[of addr s c vaddr c']) (auto split: if_splits)\n next\n case (Update k wk bytes r)\n have \"derivable (available_caps CC ISA k t) \\ reachable_caps s\"\n using assms axioms\n by (intro derivable_available_caps_subseteq_reachable_caps)\n then show ?thesis\n using Update \\is_tagged_method CC c\\ axioms\n unfolding cheri_axioms_def store_cap_mem_axiom_def cap_derivable_iff_derivable\n by (auto simp: writes_mem_cap_at_idx_def writes_mem_cap_Some_iff)\n qed\n qed (auto intro: reachable_caps.intros)\nqed\n\nlemma reachable_caps_instr_trace_intradomain_monotonicity:\n assumes t: \"hasTrace t (instr_sem ISA instr)\"\n and ta: \"instr_assms t\"\n and s': \"s_run_trace t s = Some s'\"\n and no_exception: \"\\instr_raises_ex ISA instr t\"\n and no_ccall: \"\\invokes_caps ISA instr t\"\n and addr_trans_inv: \"s_invariant (\\s' addr load. s_translate_address addr load s') t s\"\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n shows \"reachable_caps s' \\ reachable_caps s\"\n using assms instr_cheri_axioms[OF t ta]\n by (intro reachable_caps_trace_intradomain_monotonicity) auto\n\nlemma reachable_caps_fetch_trace_intradomain_monotonicity:\n assumes t: \"hasTrace t (instr_fetch ISA)\"\n and ta: \"fetch_assms t\"\n and s': \"s_run_trace t s = Some s'\"\n and no_exception: \"\\fetch_raises_ex ISA t\"\n and addr_trans_inv: \"s_invariant (\\s' addr load. s_translate_address addr load s') t s\"\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n shows \"reachable_caps s' \\ reachable_caps s\"\n using assms fetch_cheri_axioms[OF t ta]\n by (intro reachable_caps_trace_intradomain_monotonicity) auto\n\nend\n\ntext \\Multi-instruction sequences\\\n\nfun fetch_execute_loop :: \"('cap, 'regval, 'instr, 'e) isa \\ nat \\ ('regval, unit, 'e) monad\" where\n \"fetch_execute_loop ISA (Suc bound) = (instr_fetch ISA \\ instr_sem ISA) \\ fetch_execute_loop ISA bound\"\n| \"fetch_execute_loop ISA 0 = return ()\"\n\nfun instrs_raise_ex :: \"('cap, 'regval, 'instr, 'e) isa \\ nat \\ 'regval trace \\ bool\" where\n \"instrs_raise_ex ISA (Suc bound) t =\n (\\tf t'. t = tf @ t' \\ hasTrace tf (instr_fetch ISA) \\\n (fetch_raises_ex ISA tf \\\n (\\instr ti t''. t' = ti @ t'' \\\n runTrace tf (instr_fetch ISA) = Some (Done instr) \\\n hasTrace ti (instr_sem ISA instr) \\\n (instr_raises_ex ISA instr ti \\\n instrs_raise_ex ISA bound t''))))\"\n| \"instrs_raise_ex ISA 0 t = False\"\n\nfun instrs_invoke_caps :: \"('cap, 'regval, 'instr, 'e) isa \\ nat \\ 'regval trace \\ bool\" where\n \"instrs_invoke_caps ISA (Suc bound) t =\n (\\tf t'. t = tf @ t' \\ hasTrace tf (instr_fetch ISA) \\\n (\\instr ti t''. t' = ti @ t'' \\\n runTrace tf (instr_fetch ISA) = Some (Done instr) \\\n hasTrace ti (instr_sem ISA instr) \\\n (invokes_caps ISA instr ti \\\n instrs_invoke_caps ISA bound t'')))\"\n| \"instrs_invoke_caps ISA 0 t = False\"\n\ncontext CHERI_ISA_State\nbegin\n\nlemma reachable_caps_instrs_trace_intradomain_monotonicity:\n assumes t: \"hasTrace t (fetch_execute_loop ISA n)\"\n and ta: \"fetch_assms t\"\n and s': \"s_run_trace t s = Some s'\"\n and no_exception: \"\\instrs_raise_ex ISA n t\"\n and no_ccall: \"\\instrs_invoke_caps ISA n t\"\n and addr_trans_inv: \"s_invariant (\\s' addr load. s_translate_address addr load s') t s\"\n and translation_table_addrs_invariant: \"s_invariant s_translation_tables t s\"\n and no_caps_in_translation_tables: \"s_invariant_holds no_caps_in_translation_tables t s\"\n shows \"reachable_caps s' \\ reachable_caps s\"\nproof (use assms in \\induction n arbitrary: s t\\)\n case 0\n then show ?case by (auto simp: return_def hasTrace_iff_Traces_final)\nnext\n case (Suc n)\n then obtain m'\n where \"(instr_fetch ISA \\ (\\instr. \\instr\\ \\ fetch_execute_loop ISA n), t, m') \\ Traces\"\n and m': \"final m'\"\n by (auto simp: hasTrace_iff_Traces_final)\n then show ?case\n proof (cases rule: bind_Traces_cases)\n case (Left m'')\n then have \"hasTrace t (instr_fetch ISA)\"\n using m'\n by (auto elim!: final_bind_cases) (auto simp: hasTrace_iff_Traces_final final_def)\n then show ?thesis\n using Suc.prems\n by (intro reachable_caps_fetch_trace_intradomain_monotonicity) auto\n next\n case (Bind tf instr t')\n obtain s'' where s'': \"s_run_trace tf s = Some s''\" and t': \"s_run_trace t' s'' = Some s'\"\n using Bind Suc\n by (auto elim: runTraceS_appendE)\n have tf: \"hasTrace tf (instr_fetch ISA)\"\n using Bind\n by (auto simp: hasTrace_iff_Traces_final final_def)\n have invs':\n \"s_invariant (\\s' addr load. s_translate_address addr load s') t' s''\"\n \"s_invariant s_translation_tables t' s''\"\n \"s_invariant_holds no_caps_in_translation_tables t' s''\"\n using tf s'' Bind Suc.prems\n using s_invariant_run_trace_eq[of no_caps_in_translation_tables tf s s'']\n by (auto simp: s_invariant_append)\n have ta': \"fetch_assms tf\" \"instr_assms t'\"\n using Bind Suc.prems fetch_assms_appendE\n by auto\n from \\(\\instr\\ \\ fetch_execute_loop ISA n, t', m') \\ Traces\\\n have \"reachable_caps s' \\ reachable_caps s''\"\n proof (cases rule: bind_Traces_cases)\n case (Left m'')\n then have \"hasTrace t' \\instr\\\"\n using m'\n by (auto elim!: final_bind_cases) (auto simp: hasTrace_iff_Traces_final final_def)\n then show ?thesis\n using tf t' s'' Bind Suc.prems invs' ta'\n by (intro reachable_caps_instr_trace_intradomain_monotonicity)\n (auto simp: runTrace_iff_Traces)\n next\n case (Bind ti am t'')\n obtain s''' where s''': \"s_run_trace ti s'' = Some s'''\" and t'': \"s_run_trace t'' s''' = Some s'\"\n using Bind t'\n by (auto elim: runTraceS_appendE)\n have ti: \"hasTrace ti \\instr\\\"\n using Bind\n by (auto simp: hasTrace_iff_Traces_final final_def)\n have invs'':\n \"s_invariant (\\s' addr load. s_translate_address addr load s') t'' s'''\"\n \"s_invariant s_translation_tables t'' s'''\"\n \"s_invariant_holds no_caps_in_translation_tables t'' s'''\"\n using invs' s''' Bind\n using s_invariant_run_trace_eq[of no_caps_in_translation_tables ti s'' s''']\n by (auto simp: s_invariant_append)\n have ta'': \"instr_assms ti\" \"fetch_assms t''\"\n using Bind ta' instr_assms_appendE\n by auto\n have no_exception': \"\\fetch_raises_ex ISA tf\" \"\\instr_raises_ex ISA instr ti\"\n and no_ccall': \"\\invokes_caps ISA instr ti\"\n and no_exception'': \"\\instrs_raise_ex ISA n t''\"\n and no_ccall'': \"\\instrs_invoke_caps ISA n t''\"\n using ti tf Suc.prems Bind \\t = tf @ t'\\\n using \\Run (instr_fetch ISA) tf instr\\\n by (auto simp: runTrace_iff_Traces)\n then have \"reachable_caps s' \\ reachable_caps s'''\"\n using Bind m' t'' invs'' ta''\n by (intro Suc.IH) (auto simp: hasTrace_iff_Traces_final final_def)\n also have \"reachable_caps s''' \\ reachable_caps s''\"\n using ti s''' no_exception' no_ccall' invs' \\t' = ti @ t''\\ ta''\n by (intro reachable_caps_instr_trace_intradomain_monotonicity)\n (auto simp: s_invariant_append)\n finally show ?thesis .\n qed\n also have \"reachable_caps s'' \\ reachable_caps s\"\n using tf s'' Bind Suc.prems ta'\n by (intro reachable_caps_fetch_trace_intradomain_monotonicity)\n (auto simp: s_invariant_append)\n finally show ?thesis .\n qed\nqed\n\nend\n\nend\n", "meta": {"author": "CTSRD-CHERI", "repo": "sail-cheri-mips-proofs", "sha": "38d00591864abe3bd03d1fcd9efcb0a77921593a", "save_path": "github-repos/isabelle/CTSRD-CHERI-sail-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-sail-cheri-mips-proofs/sail-cheri-mips-proofs-38d00591864abe3bd03d1fcd9efcb0a77921593a/proof/Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.34864514886966624, "lm_q1q2_score": 0.1906176043914019}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory FsopSyncR\nimports\n \"../lib/CogentCorres\"\n \"../refine/AfsFsopR\"\n \"../refine/OstoreR\"\nbegin\n\ndefinition\n rsync_res :: \"(afs_state \\ (unit,ErrCode) R\\<^sub>T) \\ FsopFsP\\<^sub>T \\ (32 word, unit) R \\ bool\"\nwhere\n \"rsync_res \\ (\\(afs, ra) (fsr, rc). ra = rc \\ afs_fsop_rel afs (FsopFsP.fs_st\\<^sub>f fsr))\"\n\nlemmas rsync_simp = rsync_res_def afs_fsop_rel_def Let_def \n afmsu_def afs_fsop_match_step_updates_def match_afs_data_fs_state_def\n\nlemma fold_comp[rule_format]:\n \"xs = ys @ zs \\ fold f xs accu = (fold f zs (fold f ys accu))\"\n by (induct_tac xs, simp+)\n\nlemma corres_sync_err:\n\"afs_fsop_rel afs fs_st \\\n cogent_corres rsync_res (return (afs, R.Error e)) (\\FsopFsP.ex\\<^sub>f = ex, fs_st\\<^sub>f = fs_st\\, R.Error e)\"\n by (simp add: rsync_res_def cogent_corres_def return_def)\n\nlemma length_updates_eqD:\n \"afs_fsop_rel afs fs_st \\\n length (\\_updates (FsState.ostore_st\\<^sub>f fs_st)) = length (a_medium_updates afs)\"\n by (clarsimp simp: rsync_simp)\n\nlemma afs_fsop_match_updates:\n \"afs_fsop_match (fold id xs' a) (fold id ys' c) \\ xs' = xs \\ ys' = ys \\\n afs_fsop_match (fold id xs a) (fold id ys c)\"\nby simp\n\nlemma updates_take_eq:\n \"na \\ (length xs - n) \\\n n \\ length xs \\\n length xs = length ys \\\n take (min (length ys) n + min (length (drop n ys)) na) xs =\n take n xs @ take na (drop n xs)\"\n by (simp add: min_absorb2 take_add)\n\nlemma refine_sync:\nnotes length_drop[simp del]\nassumes rel:\"afs_fsop_rel afs fs_st\"\nshows\n \"\\ex. cogent_corres rsync_res\n (afs_sync afs) (fsop_sync_fs (FsopFsP.make ex fs_st))\"\n unfolding afs_sync_def fsop_sync_fs_def[simplified tuple_simps sanitizers, folded eIO_def]\nusing [[goals_limit=5]]\n apply (rule cogent_corres_conc_let_exec, simp only: prod.case_eq_if)\n apply (rule cogent_corres_conc_let_exec, simp only: prod.case_eq_if)\n apply (rule cogent_corres_if)\n apply (simp add: FsopFsP.make_def)\n apply (fold eRoFs_def)\n apply (rule corres_sync_err[OF rel])\n apply (rule cogent_corres_conc_let_exec, simp only: prod.case_eq_if)\n apply (rule cogent_corres_conc_let_exec, simp only: prod.case_eq_if)\n apply (simp only: FsopFsP.defs)\n apply (fold ostoreWriteNone_def)\n\n apply (rule ostore_sync_ret)\n using rel apply (simp add: rsync_simp)\n using rel apply (simp add: rsync_simp)\n using rel apply (simp add: rsync_simp)\n apply (clarsimp)\n apply (rule_tac v=\"length (a_medium_updates afs)\" in cogent_corres_select, simp)\n apply (simp add: Let_def)\n apply (rule cogent_corres_return)\n using rel apply (clarsimp simp add: rsync_simp prod.case_eq_if)\n apply (erule_tac x=\"length (a_medium_updates afs)\" in allE)\n apply (clarsimp simp: updated_afs_def id_def a_afs_updated_def \\_ostore_uptodate_def)\n apply (drule afs_inv_steps_updated_afsD)\n apply (simp add: afs_inv_steps_def updated_afs_def a_afs_updated_def id_def)\n apply clarsimp\n apply (rule_tac v=\"n\" in cogent_corres_select)\n apply (simp)\n using length_updates_eqD[OF rel]\n apply simp\n using length_updates_eqD[OF rel]\n apply (simp add: Let_def)\n apply (rule_tac v=\"e\" in cogent_corres_select, simp)\n apply (rule cogent_corres_return)\n using rel apply (clarsimp simp add: rsync_simp updated_afs_def)\n apply (rule conjI)\n apply (simp add: afs_inv_steps_def updated_afs_def a_afs_updated_def id_def)\n apply (fold id_def)\n apply clarsimp\n apply (subst fold_comp[symmetric], rule refl)+\n apply (erule_tac x=\"n+na\" in allE)\n apply (fastforce simp add: take_add length_drop)\n apply (rule conjI)\n using length_updates_eqD[OF rel]\n apply (fastforce simp add: length_drop)\n apply clarsimp\n apply (rename_tac na)\n apply (erule_tac x=\"n + na\" in allE)\n apply (erule impE)\n apply (drule sym[where s=\"length _\" and t = \"length _\"])\n apply (simp only: length_drop)\n apply (subst fold_comp[symmetric], rule refl)+\n apply (erule afs_fsop_match_updates)\n apply (fastforce simp only: take_add)+\n using rel\n apply (simp add: rsync_simp FsopFsP.defs)\n done\nend \n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/refine/FsopSyncR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.1906175969909071}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory UnsealCap\n\nimports \n \"UnpredictableBehaviour\"\n \"ExceptionFlag\"\n \"ExecutionStep\"\nbegin\n\n(*>*)\nsection \\Semantics of @{const UnsealCapAction}\\\n\ndefinition SemanticsUnsealPost where\n \"SemanticsUnsealPost authCap cap cd' \\ \n return (getSealed cap \\ \n Permit_Unseal (getPerms authCap) \\ \n getTag authCap \\\n \\ getSealed authCap \\\n ucast (getType cap) \\ RegionOfCap authCap) \\\\<^sub>b\n bind (read_state (getCAPR cd'))\n (\\cap'. return (cap' \\ setType (setSealed (cap, False), 0)))\"\n\nlemma Commute_SemanticsUnsealPost [Commute_compositeI]:\n assumes \"Commute (read_state (getCAPR cd')) m\"\n shows \"Commute (SemanticsUnsealPost authCap cap cd') m\"\nunfolding SemanticsUnsealPost_def\nby (Commute intro: assms)\n\nlemma SemanticsUnseal_CUnseal_aux:\n fixes x y z :: \"'a::len0 word\"\n shows \"(x + y = z) \\ (z - x = y)\"\nby auto\n\nlemma SemanticsUnseal_CUnseal:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (CUnsealActions v) (\\prov. return (UnsealCapAction auth cd cd' \\ prov)))\n (dfn'CUnseal v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsUnsealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nunfolding dfn'CUnseal_alt_def CUnsealActions_def \nunfolding SemanticsUnsealPost_def\nby (HoareTriple intro: nonExceptionCase_exceptions[THEN HoareTriple_post_weakening])\n (auto simp: not_less not_le setPerms_le\n Region_member_simp\n SemanticsUnseal_CUnseal_aux\n split: if_splits\n elim!: notE[OF _ rec'Perms_AND_leq_forget_right])\n\nlemma SemanticsUnseal_Run_aux:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions v) (\\prov. return (UnsealCapAction auth cd cd' \\ prov)))\n (Run v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsUnsealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nunfolding Run_alt_def RunActions_def HoareTriple_def\nusing HoareTripleE[OF SemanticsUnseal_CUnseal]\nby (auto simp: ValueAndStatePart_simp split: all_split)\n\nlemmas SemanticsUnseal_Run =\n HoareTriple_weakest_pre_disj[OF SemanticsUnseal_Run_aux\n UndefinedCase_Run]\n\nlemma SemanticsUnseal_Fetch:\n fixes auth cd cd' authCap cap cdAccessible cd'Accessible authAccessible\n defines \"p \\ \\w. (return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions (Decode w)) (\\ac. return (UnsealCapAction auth cd cd' \\ ac))\"\n shows \"HoareTriple (bind NextInstruction (case_option (return True) p))\n Fetch\n (\\b. case b of None \\ read_state getExceptionSignalled\n | Some y \\ read_state isUnpredictable \\\\<^sub>b p y)\"\nunfolding p_def\nby (intro HoareTriple_Fetch) Commute+\n\nlemma SemanticsUnseal_NextWithGhostState:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind DomainActions (\\prov. return (UnsealCapAction auth cd cd' \\ prov)))\n NextWithGhostState\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsUnsealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nproof -\n note intros = SemanticsUnseal_Run[where cap=cap and authCap=authCap and\n auth=auth and cd=cd and cd'=cd' and\n authAccessible=authAccessible] \n SemanticsUnseal_Fetch[where cap=cap and authCap=authCap and\n auth=auth and cd=cd and cd'=cd' and\n authAccessible=authAccessible]\n show ?thesis\n unfolding NextWithGhostState_def DomainActions_def\n by (HoareTriple intro: intros[THEN HoareTriple_post_weakening] UndefinedCase_TakeBranch)\n (auto split: option.splits)\nqed\n\ntheorem SemanticsUnsealCap:\n assumes prov: \"UnsealCapAction auth cd cd' \\ actions\"\n and suc: \"(PreserveDomain actions, s') \\ SemanticsCheriMips s\"\n shows \"Permit_Unseal (getPerms (getCapReg auth s))\"\n \"getTag (getCapReg auth s)\"\n \"\\ getSealed (getCapReg auth s)\"\n \"ucast (getType (getCAPR cd s)) \\ RegionOfCap (getCapReg auth s)\"\n \"getSealed (getCAPR cd s)\"\n \"getRegisterIsAccessible auth s\"\n \"getCAPR cd' s' \\ setType (setSealed ((getCAPR cd s), False), 0)\"\nusing assms\nusing SemanticsUnseal_NextWithGhostState\n [where cap=\"getCAPR cd s\" and cd=cd and cd'=cd' and\n authCap=\"getCapReg auth s\" and auth=auth and\n authAccessible=\"getRegisterIsAccessible auth s\",\n THEN HoareTripleE[where s=s]]\nunfolding SemanticsUnsealPost_def\nunfolding SemanticsCheriMips_def Next_NextWithGhostState NextNonExceptionStep_def\nby (auto simp: ValueAndStatePart_simp split: if_splits option.splits)\n\ncorollary UnsealCapInstantiation:\n assumes \"(lbl, s') \\ SemanticsCheriMips s\"\n shows \"UnsealCapProp s lbl s'\"\nunfolding UnsealCapProp_def\nusing assms SemanticsUnsealCap\nby auto\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/instantiation/UnsealCap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.1906175969909071}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__43_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__43_on_rules imports n_german_lemma_on_inv__43\nbegin\nsection{*All lemmas on causal relation between inv__43*}\nlemma lemma_inv__43_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__43) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__43_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.3486451285660856, "lm_q1q2_score": 0.19061759329065975}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchArch_AC\nimports Arch_AC\nbegin\n\ntext\\\n\nArch-specific access control.\n\n\\\n\ncontext Arch begin global_naming RISCV64\n\nnamed_theorems Arch_AC_assms\n\nlemma set_mrs_state_vrefs[Arch_AC_assms, wp]:\n \"\\pspace_aligned and valid_vspace_objs and valid_arch_state and (\\s. P (state_vrefs s))\\\n set_mrs thread buf msgs\n \\\\_ s. P (state_vrefs s)\\\"\n apply (simp add: set_mrs_def split_def set_object_def get_object_def split del: if_split)\n apply (wpsimp wp: gets_the_wp get_wp put_wp mapM_x_wp'\n simp: zipWithM_x_mapM_x split_def store_word_offs_def\n split_del: if_split)\n apply (subst state_vrefs_eqI)\n prefer 7\n apply assumption\n apply (clarsimp simp: opt_map_def)\n apply (fastforce simp: opt_map_def aobj_of_def)\n apply clarsimp\n apply (auto simp: valid_arch_state_def)\n done\n\nlemma mul_add_word_size_lt_msg_align_bits_ofnat[Arch_AC_assms]:\n \"\\ p < 2 ^ (msg_align_bits - word_size_bits); k < word_size \\\n \\ of_nat p * of_nat word_size + k < (2 :: obj_ref) ^ msg_align_bits\"\n apply (rule is_aligned_add_less_t2n[where n=word_size_bits])\n apply (simp_all add: msg_align_bits' word_size_word_size_bits is_aligned_mult_triv2)\n apply (simp_all add: word_size_word_size_bits word_size_bits_def)\n apply (erule word_less_power_trans_ofnat[where k=3 and m=10, simplified], simp)\n done\n\nlemma zero_less_word_size[Arch_AC_assms, simp]:\n \"0 < (word_size :: obj_ref)\"\n by (simp add: word_size_def)\n\nend\n\n\nglobal_interpretation Arch_AC_1?: Arch_AC_1\nproof goal_cases\n interpret Arch .\n case 1 show ?case\n by (unfold_locales; fact Arch_AC_assms)\nqed\n\n\ncontext Arch begin global_naming RISCV64\n\ndefinition level_of_table :: \"obj_ref \\ 'z :: state_ext state \\ vm_level\"\n where\n \"level_of_table p s \\\n GREATEST lvl. \\asid vref. vref \\ user_region \\ vs_lookup_table lvl asid vref s = Some (lvl, p)\"\n\nlemma level_of_table_vs_lookup_table:\n \"\\ vs_lookup_table level asid vref s = Some (level, p);\n ptes_of s p = Some pte; level \\ max_pt_level; vref \\ user_region; invs s \\\n \\ level_of_table p s = level\"\n apply (subst level_of_table_def)\n apply (rule Greatest_equality, fastforce)\n apply (case_tac \"y = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid)\n apply (fastforce dest: vs_lookup_table_unique_level)\n done\n\nlemma vs_lookup_slot_level_of_slot:\n \"\\ vs_lookup_slot level asid vref s = Some (level, p);\n ptes_of s p = Some pte; level \\ max_pt_level; vref \\ user_region; invs s \\\n \\ level_of_slot asid vref p s = level\"\n apply (subst level_of_slot_def)\n apply (rule Greatest_equality)\n apply clarsimp\n apply (case_tac \"y = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid)\n apply (fastforce dest: vs_lookup_slot_unique_level)\n done\n\nlemma pool_for_asid_vs_lookupD:\n \"pool_for_asid asid s = Some p \\\n vs_lookup_table asid_pool_level asid vref s = Some (asid_pool_level, p)\"\n by (simp add: pool_for_asid_vs_lookup)\n\nlemma vs_lookup_table_vref_independent:\n \"\\ vs_lookup_table level asid vref s = opt; level \\ max_pt_level \\\n \\ vs_lookup_table level asid vref' s = opt\"\n by (cases \"level = asid_pool_level\"; clarsimp simp: vs_lookup_table_def)\n\nlemma state_vrefs_store_NonPageTablePTE:\n \"\\ invs s; is_aligned p pte_bits; vs_lookup_slot level asid vref s = Some (level, p);\n vref \\ user_region; \\ is_PageTablePTE pte;\n kheap s (table_base p) = Some (ArchObj (PageTable pt)) \\\n \\ state_vrefs (s\\kheap := \\a. if a = table_base p\n then Some (ArchObj (PageTable (\\a. if a = table_index p\n then pte\n else pt a)))\n else kheap s a\\) =\n (\\x. if \\level' vref'. vref_for_level vref' (level + 1) = vref_for_level vref (level + 1) \\\n vref' \\ user_region \\ p = pt_slot_offset level (table_base p) vref' \\\n pt_walk level level' (table_base p) vref' (ptes_of s) = Some (level',x)\n then (if x = table_base p\n then vs_refs_aux level (PageTable (\\a. if a = table_index p then pte else pt a))\n else {})\n else state_vrefs s x)\"\n apply (rule all_ext)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce simp: vs_lookup_slot_def vs_lookup_table_def\n ptes_of_Some pts_of_Some aobjs_of_Some\n dest: pool_for_asid_no_pte)\n apply (prop_tac \"ptes_of s p \\ None\")\n apply (drule valid_vspace_objs_strong_slotD; clarsimp split del: if_split)\n apply (frule vs_lookup_slot_table_base; clarsimp split del: if_split)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp split del: if_split)\n apply safe\n apply (subst (asm) state_vrefs_def opt_map_def)+\n apply (clarsimp split: option.splits split del: if_split)\n apply (subst (asm) vs_lookup_non_PageTablePTE[where s=s and s'=\"kheap_update _ s\" and p=p])\n apply (fastforce simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def\n dest: pte_ptr_eq)+\n apply (case_tac \"x = table_base p\"; clarsimp)\n apply (case_tac \"lvl = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid[OF vs_lookup_level]\n simp: ptes_of_Some pts_of_Some aobjs_of_Some split: if_splits)\n apply (fastforce dest: vs_lookup_table_unique_level[OF vs_lookup_level]\n elim: allE[where x=level] split: if_splits)\n apply (clarsimp split: if_splits)\n apply (case_tac \"level' = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (frule vs_lookup_slot_level_of_slot)\n apply (fastforce simp: ptes_of_Some pts_of_Some aobjs_of_Some split: option.splits)\n apply fastforce+\n apply (subst (asm) vs_lookup_slot_table_unfold; fastforce)\n apply (rule conjI; clarsimp)\n apply (case_tac \"level' < level\")\n apply (subst (asm) vs_lookup_vref_for_level_eq1, rule sym, assumption)\n apply (frule (2) vs_lookup_table_extend)\n apply (case_tac \"lvl = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_pt_at vs_lookup_asid_pool\n simp: asid_pools_of_ko_at obj_at_def)\n apply (frule_tac level=lvl in vs_lookup_level)\n apply (drule (1) vs_lookup_table_unique_level, rule refl)\n apply fastforce+\n apply (frule bit0.plus_one_leq)\n apply (erule_tac x=level in allE)\n apply (subst (asm) vs_lookup_slot_vref_for_level[symmetric], assumption)\n apply (frule_tac bot_level=bot in vs_lookup_min_level)\n apply (fastforce simp: vs_lookup_slot_vref_for_level vs_lookup_slot_table_unfold)\n apply (subst (asm) pt_walk.simps, clarsimp)\n apply (fastforce simp: state_vrefs_def opt_map_def)\n apply (prop_tac \"level_of_slot asid vref p s = level\")\n apply (fastforce simp: vs_lookup_slot_table_unfold vs_lookup_slot_level_of_slot)\n apply (clarsimp split: if_splits)\n apply (rule state_vrefsD)\n apply (subst vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte])\n apply (fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+\n apply (case_tac \"x = table_base p\")\n apply (fastforce elim: allE[where x=level])\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (rule_tac level=lvl and asid=asida and vref=vrefa in state_vrefsD)\n apply (subst vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte])\n apply (fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+\n apply (clarsimp split: if_splits)\n apply (intro conjI; clarsimp)\n apply (case_tac \"level' = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (case_tac \"lvl < level\")\n apply (drule_tac bot_level=bot in vs_lookup_level)\n apply (subst (asm) vs_lookup_split_Some, erule dual_order.strict_implies_order)\n apply fastforce\n apply (drule (1) vs_lookup_table_unique_level; fastforce)\n apply (metis vs_lookup_slot_table vs_lookup_slot_unique_level)\n apply (fastforce dest: vs_lookup_level)\n apply (fastforce simp: aobjs_of_Some opt_map_def)\n apply clarsimp\n apply clarsimp\n done\n\nlemma state_vrefs_store_NonPageTablePTE':\n \"\\ invs s; is_aligned p pte_bits; \\ is_PageTablePTE pte;\n kheap s (table_base p) = Some (ArchObj (PageTable pt));\n \\level asid vref. vref \\ user_region \\ vs_lookup_slot level asid vref s \\ Some (level, p) \\\n \\ state_vrefs (s\\kheap := \\a. if a = table_base p\n then Some (ArchObj (PageTable (\\a. if a = table_index p\n then pte\n else pt a)))\n else kheap s a\\) =\n (\\x. if x = table_base p \\ (\\level. \\\\ (level, table_base p) s)\n then vs_refs_aux (level_of_table (table_base p) s) (PageTable (\\a. if a = table_index p\n then pte\n else pt a))\n else state_vrefs s x)\"\n apply (rule all_ext)\n apply safe\n apply (subst (asm) state_vrefs_def opt_map_def)+\n apply (clarsimp split: option.splits split del: if_split)\n apply (clarsimp split: if_split_asm option.splits split del: if_split)\n apply (subst (asm) vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte])\n apply (fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+\n apply (clarsimp split: if_splits)\n apply (drule vs_lookup_level)\n apply (rule conjI; clarsimp)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (case_tac \"lvl = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (subst level_of_table_vs_lookup_table; fastforce simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (subst (asm) vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte])\n apply (fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+\n apply (fastforce simp: state_vrefs_def aobjs_of_Some)\n apply (clarsimp split: if_splits)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid simp: ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (subst (asm) level_of_table_vs_lookup_table)\n apply (fastforce simp: ptes_of_Some pts_of_Some aobjs_of_Some)+\n apply (rule state_vrefsD)\n apply (subst vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte ])\n apply ((fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+)[7]\n apply auto[1]\n apply (fastforce simp: aobjs_of_Some opt_map_def)\n apply clarsimp\n apply clarsimp\n apply (case_tac \"x = table_base p\")\n apply (fastforce dest: vs_lookup_level simp: state_vrefs_def)\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (rule state_vrefsD)\n apply (subst vs_lookup_non_PageTablePTE[where s=s and p=p and pte=pte ])\n apply ((fastforce dest: pte_ptr_eq\n simp: ptes_of_Some pts_of_Some aobjs_of_Some\n opt_map_def pte_of_def obind_def)+)[7]\n apply auto[1]\n apply (fastforce simp: aobjs_of_Some opt_map_def split: option.splits)\n apply clarsimp\n apply clarsimp\n done\n\n(* FIXME AC: make this less ugly *)\nlemma state_vrefs_store_NonPageTablePTE_wp:\n \"\\\\s. invs s \\ \\ is_PageTablePTE pte \\\n (\\pt. ako_at (PageTable pt) (table_base p) s \\ is_aligned p pte_bits \\\n (if \\level asid vref. vs_lookup_slot level asid vref s = Some (level, p) \\ vref \\ user_region\n then (\\level asid vref. vs_lookup_slot level asid vref s = Some (level, p) \\ vref \\ user_region \\\n P (\\x. (if \\level' vref'. vref_for_level vref' (level + 1) = vref_for_level vref (level + 1) \\\n vref' \\ user_region \\ p = pt_slot_offset level (table_base p) vref' \\\n pt_walk level level' (table_base p) vref' (ptes_of s) = Some (level', x)\n then (if x = table_base p\n then vs_refs_aux level (PageTable (\\a. if a = table_index p then pte else pt a))\n else {})\n else state_vrefs s x)))\n else P (\\x. (if x = table_base p \\ (\\level. \\\\ (level, table_base p) s)\n then vs_refs_aux (level_of_table (table_base p) s) (PageTable (\\a. if a = table_index p then pte else pt a))\n else state_vrefs s x))))\\\n store_pte p pte\n \\\\_ s. P (state_vrefs s)\\\"\n unfolding store_pte_def set_pt_def\n apply (wpsimp wp: set_object_wp)\n apply (case_tac \"\\level asid vref. vs_lookup_slot level asid vref s = Some (level, p) \\\n vref \\ user_region\")\n apply (erule_tac x=pt in allE)\n apply (clarsimp simp: fun_upd_def)\n apply (subst state_vrefs_store_NonPageTablePTE)\n apply fastforce+\n apply (clarsimp simp: obj_at_def)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (case_tac \"levela = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (drule (1) vs_lookup_slot_unique_level)\n apply fastforce+\n apply clarsimp\n apply (frule_tac level'=\"level+1\" in vref_for_level_eq_mono)\n apply (fastforce intro: vm_level_less_le_1)\n apply clarsimp\n apply (erule_tac x=pt in allE)\n apply (clarsimp simp: fun_upd_def)\n apply (subst state_vrefs_store_NonPageTablePTE'; fastforce simp: obj_at_def)\n done\n\nlemma store_pte_thread_st_auth[wp]:\n \"store_pte p pte \\\\s. P (thread_st_auth s)\\\"\n unfolding store_pte_def set_pt_def\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: get_tcb_def thread_st_auth_def tcb_states_of_state_def obj_at_def\n elim!: rsubst[where P=P, OF _ ext])\n done\n\nlemma store_pte_thread_bound_ntfns[wp]:\n \"store_pte p pte \\\\s. P (thread_bound_ntfns s)\\\"\n unfolding store_pte_def set_pt_def\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: get_tcb_def thread_bound_ntfns_def obj_at_def\n elim!: rsubst[where P=P, OF _ ext])\n done\n\nlemma store_pte_domains_of_state[wp]:\n \"store_pte p pte \\\\s. P (domains_of_state s)\\\"\n unfolding store_pte_def set_pt_def by (wpsimp wp: set_object_wp)\n\nlemma mapM_x_store_pte_caps_of_state[wp]:\n \"mapM_x (swp store_pte InvalidPTE) slots \\\\s. P (asid_table s)\\\"\n by (wpsimp wp: mapM_x_wp')\n\nlemma state_bits_to_policy_vrefs_subseteq:\n \"\\cdt. \\ x \\ state_bits_to_policy caps ts tbn cdt vrefs; caps = caps';\n ts = ts'; tbn = tbn'; cdt = cdt'; \\x. vrefs x \\ state_vrefs s x \\\n \\ x \\ state_bits_to_policy caps' ts' tbn' cdt' (state_vrefs s)\"\n apply (cases x; clarsimp)\n apply (erule state_bits_to_policy.cases; fastforce intro: state_bits_to_policy.intros)\n done\n\nlemma state_asids_to_policy_vrefs_subseteq:\n \"\\ x \\ state_asids_to_policy_aux aag caps asid_tab vrefs; caps = caps';\n \\x. vrefs x \\ state_vrefs s x; \\x y. asid_tab x = Some y \\ asid_table s x = Some y \\\n \\ x \\ state_asids_to_policy_aux aag caps' (asid_table s) (state_vrefs s)\"\n apply (cases x; clarsimp)\n apply (erule state_asids_to_policy_aux.cases; fastforce intro: state_asids_to_policy_aux.intros)\n done\n\nlemma store_InvalidPTE_state_objs_in_policy:\n \"\\\\s. state_objs_in_policy aag s \\ invs s \\ table_base p \\ global_refs s \\\n ((\\a. vspace_for_asid a s = Some (table_base p)) \\ table_index p \\ kernel_mapping_slots)\\\n store_pte p InvalidPTE\n \\\\_ s. state_objs_in_policy aag s\\\"\n apply (rule hoare_weaken_pre)\n apply (clarsimp simp: state_objs_to_policy_def pred_conj_def)\n apply wps\n apply (rule state_vrefs_store_NonPageTablePTE_wp)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (intro exI conjI)\n apply assumption\n apply clarsimp\n apply (clarsimp simp: state_objs_to_policy_def)\n apply (erule subsetD)\n apply (clarsimp simp: auth_graph_map_def)\n apply (rule exI, rule conjI, rule refl)+\n apply (erule state_bits_to_policy_vrefs_subseteq; clarsimp)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def split: if_splits)\n apply (clarsimp simp: state_objs_to_policy_def)\n apply (erule subsetD)\n apply (clarsimp simp: auth_graph_map_def)\n apply (rule exI, rule conjI, rule refl)+\n apply (erule state_bits_to_policy_vrefs_subseteq; clarsimp)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (frule level_of_table_vs_lookup_table)\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)+\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def split: if_splits)\n done\n\nlemma store_InvalidPTE_state_asids_to_policy:\n \"\\\\s. state_asids_to_policy aag s \\ pasPolicy aag \\ invs s \\ table_base p \\ global_refs s \\\n ((\\a. vspace_for_asid a s = Some (table_base p)) \\ table_index p \\ kernel_mapping_slots)\\\n store_pte p InvalidPTE\n \\\\_ s. state_asids_to_policy aag s \\ pasPolicy aag\\\"\n apply (rule hoare_weaken_pre)\n apply (clarsimp simp: state_objs_to_policy_def pred_conj_def)\n apply wps\n apply (rule state_vrefs_store_NonPageTablePTE_wp)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (intro exI conjI)\n apply assumption\n apply clarsimp\n apply clarsimp\n apply (erule subsetD)\n apply (erule state_asids_to_policy_vrefs_subseteq; clarsimp)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def split: if_splits)\n apply (erule subsetD)\n apply (erule state_asids_to_policy_vrefs_subseteq; clarsimp)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_table_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (frule level_of_table_vs_lookup_table)\n apply (fastforce dest: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)+\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def split: if_splits)\n done\n\nlemma mapM_x_swp_store_InvalidPTE_pas_refined:\n \"\\pas_refined aag and invs and\n (\\s. \\x \\ set slots. table_base x \\ global_refs s \\\n (\\asid. vspace_for_asid asid s \\ Some (table_base x)))\\\n mapM_x (swp store_pte InvalidPTE) slots\n \\\\_ s. pas_refined aag s\\\"\n supply state_asids_to_policy_arch_def[simp del]\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp[where S=\"set slots\"])\n apply (simp add: pas_refined_def)\n apply (wpsimp wp: store_InvalidPTE_state_objs_in_policy store_InvalidPTE_state_asids_to_policy\n store_pte_invs hoare_vcg_const_Ball_lift hoare_vcg_all_lift)\n apply (auto simp: wellformed_pte_def)\n done\n\nlemma mapM_swp_store_pte_invs_unmap:\n \"\\\\s. invs s \\ pte = InvalidPTE \\ table_base p \\ global_refs s\n \\ (\\asid. vspace_for_asid asid s \\ Some (table_base p))\\\n store_pte p pte\n \\\\_. invs\\\"\n by (wpsimp wp: store_pte_invs simp: wellformed_pte_def)\n\nlemma store_pte_pas_refined:\n \"\\\\s. pas_refined aag s \\ invs s \\ table_base p \\ global_refs s \\\n (\\slot ref. caps_of_state s slot = Some (ArchObjectCap (PageTableCap (table_base p) ref))) \\\n ((\\asid. vspace_for_asid asid s = Some (table_base p)) \\ table_index p \\ kernel_mapping_slots)\\\n store_pte p InvalidPTE\n \\\\_. pas_refined aag\\\"\n supply state_asids_to_policy_arch_def[simp del]\n apply (clarsimp simp: pas_refined_def)\n apply (wpsimp wp: store_InvalidPTE_state_objs_in_policy store_InvalidPTE_state_asids_to_policy)\n done\n\nlemma unmap_page_table_pas_refined:\n \"\\pas_refined aag and invs and K (vaddr \\ user_region)\\\n unmap_page_table asid vaddr pt\n \\\\_. pas_refined aag\\\"\n unfolding unmap_page_table_def\n apply (rule hoare_gen_asm)\n apply (wpsimp wp: set_cap_pas_refined get_cap_wp pt_lookup_from_level_wrp store_pte_invs_unmap\n store_pte_pas_refined hoare_vcg_imp_lift' hoare_vcg_ball_lift hoare_vcg_all_lift)\n apply (rule_tac x=asid in exI)\n apply clarsimp\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (intro conjI)\n apply (clarsimp simp: reachable_page_table_not_global)\n apply (frule vs_lookup_table_pt_at; clarsimp?)\n apply (drule vs_lookup_table_valid_cap; clarsimp?)\n apply (fastforce simp: valid_cap_def valid_arch_cap_def valid_arch_cap_ref_def obj_at_def\n dest: caps_of_state_valid split: cap.splits arch_cap.splits)\n apply (metis vs_lookup_table_vspace user_region_slots is_aligned_neg_mask2 pt_slot_offset_offset)\n done\n\ncrunches unmap_page_table\n for cdt[wp]: \"\\s. P (cdt s)\"\n\ndefinition authorised_page_table_inv :: \"'a PAS \\ page_table_invocation \\ bool\" where\n \"authorised_page_table_inv aag pti \\\n case pti of PageTableMap cap cslot_ptr pde obj_ref \\\n is_subject aag (fst cslot_ptr) \\ is_subject aag (obj_ref && ~~ mask pt_bits) \\\n pas_cap_cur_auth aag (ArchObjectCap cap)\n | PageTableUnmap cap cslot_ptr \\\n is_subject aag (fst cslot_ptr) \\\n aag_cap_auth aag (pasSubject aag) (ArchObjectCap cap) \\\n (\\p asid vspace_ref. cap = PageTableCap p (Some (asid, vspace_ref))\n \\ is_subject_asid aag asid \\\n (\\x \\ set [p, p + 2 ^ pte_bits .e. p + 2 ^ pt_bits - 1].\n is_subject aag (x && ~~ mask pt_bits)))\"\n\nlemma perform_pt_inv_unmap_pas_refined:\n \"\\pas_refined aag and invs and valid_pti (PageTableUnmap cap ct_slot)\n and K (authorised_page_table_inv aag (PageTableUnmap cap ct_slot))\\\n perform_pt_inv_unmap cap ct_slot\n \\\\_. pas_refined aag\\\"\n unfolding perform_pt_inv_unmap_def\n apply (wpsimp wp: set_cap_pas_refined get_cap_wp)\n apply (strengthen invs_psp_aligned invs_vspace_objs invs_arch_state)\n apply wps\n apply (rule hoare_vcg_all_lift[OF hoare_vcg_imp_lift'[OF mapM_x_wp_inv]], wpsimp wp: mapM_x_wp_inv)\n apply (rule hoare_vcg_conj_lift[OF hoare_strengthen_post[OF mapM_x_swp_store_InvalidPTE_pas_refined]], assumption)\n apply (rule hoare_vcg_conj_lift[OF hoare_strengthen_post[OF mapM_x_swp_store_pte_invs_unmap]], assumption)\n apply (wpsimp wp: pt_lookup_from_level_wrp store_pte_invs_unmap store_pte_pas_refined\n mapM_x_wp_inv unmap_page_table_pas_refined\n hoare_vcg_imp_lift' hoare_vcg_ball_lift hoare_vcg_all_lift)+\n apply (rule conjI)\n apply (fastforce simp: is_PageTableCap_def authorised_page_table_inv_def\n valid_pti_def update_map_data_def cte_wp_at_caps_of_state)\n apply (clarsimp simp: is_PageTableCap_def authorised_page_table_inv_def valid_arch_cap_def\n valid_pti_def cte_wp_at_caps_of_state update_map_data_def aag_cap_auth_def\n cap_auth_conferred_def arch_cap_auth_conferred_def wellformed_mapdata_def\n cap_links_asid_slot_def cap_links_irq_def is_transferable.simps)\n apply (prop_tac \"table_base x = acap_obj cap\")\n apply (drule (1) caps_of_state_aligned_page_table)\n apply (simp only: is_aligned_neg_mask_eq')\n apply (clarsimp simp: add_mask_fold)\n apply (drule subsetD[OF upto_enum_step_subset], clarsimp)\n apply (drule neg_mask_mono_le[where n=pt_bits])\n apply (drule neg_mask_mono_le[where n=pt_bits])\n apply (fastforce dest: plus_mask_AND_NOT_mask_eq)\n apply (rule conjI; clarsimp)\n apply (fastforce simp: cte_wp_at_caps_of_state cap_range_def\n dest: invs_valid_global_refs valid_global_refsD)\n apply (frule vspace_for_asid_target)\n apply (drule valid_vs_lookupD; clarsimp)\n apply (drule (1) unique_table_refsD[rotated]; clarsimp)\n apply (drule (1) cap_to_pt_is_pt_cap)\n apply (clarsimp simp: in_omonad obj_at_def)\n apply (fastforce intro: valid_objs_caps)\n apply (clarsimp simp: is_cap_simps)\n done\n\nlemma vs_lookup_PageTablePTE:\n \"\\ vs_lookup_table level asid vref s' = Some (lvl', pt);\n pspace_aligned s; valid_vspace_objs s; valid_asid_table s;\n invalid_pte_at p s; ptes_of s' = ptes_of s (p \\ pte); is_PageTablePTE pte;\n asid_pools_of s' = asid_pools_of s; asid_table s' = asid_table s;\n vref \\ user_region;\n pts_of s (the (pte_ref pte)) = Some empty_pt; pt \\ pptr_from_pte pte \\\n \\ \\level' \\ level. vs_lookup_table level' asid vref s = Some (lvl', pt)\"\n apply (induct level arbitrary: lvl' pt rule: bit0.from_top_full_induct[where y=max_pt_level])\n apply (fastforce simp: geq_max_pt_level vs_lookup_table_def pool_for_asid_def obind_def)\n apply (rule_tac x=lvl' in exI)\n apply (frule vs_lookup_min_level, clarsimp)\n apply (drule vs_lookup_level)\n apply (case_tac \"lvl' < max_pt_level\")\n apply (frule vs_lookup_table_split_last_Some; clarsimp)\n apply (erule_tac x=\"lvl'+1\" in allE)\n apply (drule mp)\n apply (fastforce elim: le_less_trans dest: vm_level_less_plus_1_mono)\n apply (erule_tac x=\"lvl'+1\" in allE)\n apply clarsimp\n apply (frule subst[where s=\"ptes_of s'\" and P=\"\\ptes. ptes _ = _\"])\n apply assumption\n apply (drule mp, fastforce simp: pte_ref_def2 ptes_of_Some split: if_splits)\n apply (cases pte; clarsimp)\n apply (drule_tac bot_level=level' in vs_lookup_level)\n apply (subst vs_lookup_split_Some)\n prefer 3\n apply (rule exI, rule conjI, assumption)\n apply (frule_tac P=\"\\x. x\" and level1=lvl' and level'1=\"lvl'+1\"\n in subst[OF vs_lookup_split_Some, rotated 2])\n apply (fastforce dest: vm_level_less_le_1)\n apply (fastforce dest: vm_level_less_max_pt_level vm_level_less_plus_1_mono)\n apply clarsimp\n apply (subst (asm) pt_walk.simps)\n apply (clarsimp simp: obind_def)\n apply (subst pt_walk.simps)\n apply (clarsimp split: if_splits simp: obind_def)\n apply (fastforce dest: vm_level_less_le_1)\n apply (fastforce dest: vm_level_less_max_pt_level vm_level_less_plus_1_mono)\n apply (case_tac \"lvl' = asid_pool_level\")\n apply (auto simp: geq_max_pt_level vs_lookup_table_def pool_for_asid_def obind_def)\n done\n\nlemma vs_lookup_PageTablePTE':\n \"\\ vs_lookup_table level asid vref s = Some (lvl', pt);\n pspace_aligned s; valid_vspace_objs s; valid_asid_table s;\n invalid_pte_at p s; ptes_of s' = ptes_of s (p \\ pte); is_PageTablePTE pte;\n asid_pools_of s' = asid_pools_of s; asid_table s' = asid_table s; vref \\ user_region \\\n \\ \\level' \\ level. vs_lookup_table level' asid vref s' = Some (lvl', pt)\"\n apply (induct level arbitrary: lvl' pt rule: bit0.from_top_full_induct[where y=max_pt_level])\n apply (fastforce simp: geq_max_pt_level vs_lookup_table_def pool_for_asid_def obind_def)\n apply (rule_tac x=lvl' in exI)\n apply (frule vs_lookup_min_level, clarsimp)\n apply (drule vs_lookup_level)\n apply (case_tac \"lvl' < max_pt_level\")\n apply (frule vs_lookup_table_split_last_Some; clarsimp)\n apply (erule_tac x=\"lvl'+1\" in allE)\n apply (drule mp)\n apply (fastforce elim: le_less_trans dest: vm_level_less_plus_1_mono)\n apply (erule_tac x=\"lvl'+1\" in allE)\n apply clarsimp\n apply (drule_tac bot_level=level' in vs_lookup_level)\n apply (subst vs_lookup_split_Some)\n prefer 3\n apply (rule exI, rule conjI, assumption)\n apply (frule_tac P=\"\\x. x\" and level1=lvl' and level'1=\"lvl'+1\"\n in subst[OF vs_lookup_split_Some, rotated 2])\n apply (fastforce dest: vm_level_less_le_1)\n apply (fastforce dest: vm_level_less_max_pt_level vm_level_less_plus_1_mono)\n apply clarsimp\n apply (subst (asm) pt_walk.simps)\n apply (clarsimp simp: obind_def split: if_splits)\n apply (subst pt_walk.simps)\n apply (clarsimp simp: obind_def split: if_splits)\n apply (cases pte; clarsimp)\n apply (frule is_aligned_pt[rotated])\n apply (erule vs_lookup_table_pt_at; fastforce)\n apply (clarsimp simp: invalid_pte_at_def ptes_of_Some pts_of_Some aobjs_of_Some)\n apply (fastforce dest: vm_level_less_le_1)\n apply (fastforce dest: vm_level_less_max_pt_level vm_level_less_plus_1_mono)\n apply (case_tac \"lvl' = asid_pool_level\")\n apply (auto simp: geq_max_pt_level vs_lookup_table_def pool_for_asid_def obind_def)\n done\n\nlemma state_vrefs_store_PageTablePTE:\n assumes \"invs s\"\n and \"is_aligned p pte_bits\"\n and \"vs_lookup_slot level asid vref s = Some (level, p)\"\n and \"vref \\ user_region\"\n and \"is_PageTablePTE pte\"\n and \"invalid_pte_at p s\"\n and \"pts_of s (the (pte_ref pte)) = Some empty_pt\"\n and \"the (pte_ref pte) \\ table_base p\"\n and \"kheap s (table_base p) = Some (ArchObj (PageTable pt))\"\n shows \"state_vrefs (s\\kheap := \\a. if a = table_base p\n then Some (ArchObj (PageTable (\\a. if a = table_index p\n then pte\n else pt a)))\n else kheap s a\\) =\n (\\x. if x = table_base p\n then vs_refs_aux level (PageTable (\\a. if a = table_index p then pte else pt a))\n else state_vrefs s x)\"\n (is \"state_vrefs ?s' = _\")\n using assms\n apply -\n apply (rule all_ext)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce simp: vs_lookup_slot_def vs_lookup_table_def\n ptes_of_Some pts_of_Some aobjs_of_Some\n dest: pool_for_asid_no_pte split: if_splits)\n apply safe\n apply (clarsimp simp: state_vrefs_def opt_map_def split: option.splits)\n apply (case_tac \"x = pptr_from_pte pte\")\n apply (clarsimp simp: pte_ref_def2 split: if_splits)\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def)\n apply (drule_tac s=s and pte=pte and p=p in vs_lookup_PageTablePTE)\n apply (fastforce simp: pts_of_Some aobjs_of_Some opt_map_def pte_of_def obind_def\n dest: pte_ptr_eq)+\n apply clarsimp\n apply (drule vs_lookup_level)\n apply (case_tac \"lvl = asid_pool_level\")\n apply (fastforce dest: vs_lookup_asid_pool simp: asid_pools_of_ko_at obj_at_def)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (fastforce dest: vs_lookup_table_unique_level split: if_splits)\n apply (clarsimp simp: state_vrefs_def opt_map_def)\n apply (frule vs_lookup_slot_table_base)\n apply clarsimp+\n apply (case_tac \"x = table_base p\"; clarsimp)\n apply (drule_tac pte=pte and s'=\"?s'\" in vs_lookup_PageTablePTE';\n fastforce dest: pte_ptr_eq simp: pts_of_Some aobjs_of_Some opt_map_def pte_of_def obind_def)\n apply (drule_tac level=bot and pte=pte and s'=\"?s'\" in vs_lookup_PageTablePTE';\n fastforce dest: pte_ptr_eq simp: pts_of_Some aobjs_of_Some opt_map_def pte_of_def obind_def)\n done\n\nlemma state_vrefs_store_PageTablePTE_wp:\n \"\\\\s. invs s \\ is_PageTablePTE pte \\ invalid_pte_at p s \\\n pts_of s (the (pte_ref pte)) = Some empty_pt \\ the (pte_ref pte) \\ table_base p \\\n (\\level asid vref. vs_lookup_slot level asid vref s = Some (level, p) \\ vref \\ user_region \\\n (\\pt. ako_at (PageTable pt) (table_base p) s \\\n P (\\x. if x = table_base p\n then vs_refs_aux level (PageTable (\\a. if a = table_index p\n then pte\n else pt a))\n else state_vrefs s x)))\\\n store_pte p pte\n \\\\_ s. P (state_vrefs s)\\\"\n unfolding store_pte_def set_pt_def\n apply (wpsimp wp: set_object_wp)\n apply (fastforce simp: fun_upd_def obj_at_def state_vrefs_store_PageTablePTE)\n done\n\nlemma perform_pt_inv_map_pas_refined[wp]:\n \"\\pas_refined aag and invs and valid_pti (PageTableMap acap (a, b) pte p)\n and K (authorised_page_table_inv aag (PageTableMap acap (a, b) pte p))\\\n perform_pt_inv_map acap (a,b) pte p\n \\\\_. pas_refined aag\\\"\n unfolding perform_pt_inv_map_def\n apply (rule hoare_gen_asm)\n apply (wpsimp simp: pas_refined_def state_objs_to_policy_def)\n apply (wps | wpsimp wp: state_vrefs_store_PageTablePTE_wp arch_update_cap_invs_map\n vs_lookup_slot_lift set_cap_arch_obj_neg set_cap_state_vrefs\n hoare_vcg_ex_lift hoare_vcg_all_lift hoare_vcg_imp_lift')+\n apply (clarsimp simp: invs_psp_aligned invs_vspace_objs invs_arch_state\n valid_pti_def cte_wp_at_cte_at)\n apply (case_tac acap; clarsimp)\n apply (intro conjI; (solves \\simp add: pas_refined_def\\)?)\n apply (fastforce simp: cte_wp_at_caps_of_state vs_cap_ref_def\n is_arch_update_def cap_master_cap_def\n split: arch_cap.splits)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (fastforce dest: caps_of_state_valid\n simp: vs_cap_ref_def is_arch_update_def cap_master_cap_def\n valid_cap_def cap_aligned_def valid_arch_cap_def\n split: cap.splits arch_cap.splits)\n apply (clarsimp simp: vs_lookup_slot_def split: if_splits)\n apply (fastforce dest: pool_for_asid_no_pte simp: vs_lookup_table_def invalid_pte_at_def)\n apply (frule (2) vs_lookup_table_is_aligned; clarsimp)\n apply (drule (1) vs_lookup_table_target)\n apply (drule valid_vs_lookupD, erule vref_for_level_user_region; clarsimp)\n apply (frule (1) cap_to_pt_is_pt_cap, simp, fastforce intro: valid_objs_caps)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp: is_cap_simps is_arch_update_def cap_master_cap_def\n split: cap.splits arch_cap.splits)\n apply (drule (1) unique_table_refsD[rotated]; fastforce simp: table_cap_ref_def)\n apply (intro exI conjI; (simp | clarsimp))\n apply (intro conjI)\n apply (clarsimp simp: pas_refined_def cte_wp_at_caps_of_state auth_graph_map_def)\n apply (erule state_bits_to_policy.cases)\n apply (clarsimp simp: is_arch_update_def cap_master_cap_def state_objs_to_policy_def\n split: if_splits cap.splits arch_cap.splits option.splits;\n fastforce dest: sbta_caps simp: cap_auth_conferred_def arch_cap_auth_conferred_def)\n apply (fastforce dest: sbta_untyped simp: state_objs_to_policy_def split: if_splits)\n apply (fastforce dest: sbta_ts simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_bounds simp: state_objs_to_policy_def)\n apply (clarsimp simp: state_objs_to_policy_def is_arch_update_def cap_master_cap_def)\n apply (drule_tac caps=\"caps_of_state s\" in sbta_cdt; fastforce elim: is_transferable.cases\n split: if_splits)\n apply (fastforce dest: sbta_cdt_transferable simp: state_objs_to_policy_def)\n apply (clarsimp split: if_splits)\n apply (clarsimp simp: authorised_page_table_inv_def vs_refs_aux_def split: arch_kernel_obj.splits)\n apply (erule swap)\n apply (clarsimp simp: graph_of_def pte_ref2_def split: if_split_asm)\n apply (cases pte; clarsimp simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def)\n apply (erule subsetD)\n apply (clarsimp simp: auth_graph_map_def state_objs_to_policy_def)\n apply (rule_tac x=\"table_base p\" in exI, rule conjI, erule sym)\n apply (rule exI, rule conjI, rule refl)\n apply (rule sbta_vref)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest: pool_for_asid_no_pte\n simp: vs_lookup_slot_def vs_lookup_table_def invalid_pte_at_def)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def pte_ref2_def)\n apply (clarsimp simp: is_arch_update_def cap_master_cap_def\n split: cap.splits arch_cap.splits option.splits)\n apply (fastforce dest: sbta_vref simp: pas_refined_def auth_graph_map_def state_objs_to_policy_def)\n apply (clarsimp simp: pas_refined_def)\n apply (erule state_asids_to_policy_aux.cases)\n apply (clarsimp simp: cte_wp_at_caps_of_state split: if_splits)\n apply (clarsimp simp: authorised_page_table_inv_def aag_cap_auth_def\n cap_auth_conferred_def arch_cap_auth_conferred_def\n cap_links_asid_slot_def label_owns_asid_slot_def)\n apply (fastforce dest: sata_asid)\n apply (clarsimp split: if_splits)\n apply (fastforce dest!: state_asids_to_policy_aux.intros simp: vs_refs_aux_def)\n apply (fastforce dest!: sata_asid_lookup)\n apply (fastforce dest!: sata_asidpool)\n apply (clarsimp simp: pas_refined_def)\n apply (erule state_irqs_to_policy_aux.cases)\n apply (clarsimp split: if_splits)\n apply (fastforce dest: sita_controlled)\n done\n\nlemma perform_page_table_invocation_pas_refined:\n \"\\pas_refined aag and invs and valid_pti iv and K (authorised_page_table_inv aag iv)\\\n perform_page_table_invocation iv\n \\\\_. pas_refined aag\\\"\n unfolding perform_page_table_invocation_def\n apply wpsimp\n apply (wpsimp wp: perform_pt_inv_unmap_pas_refined perform_pt_inv_map_pas_refined)+\n apply (case_tac iv; clarsimp)\n done\n\n(* FIXME move to AInvs *)\nlemma store_pte_ekheap[wp]:\n \"store_pte p pte \\\\s. P (ekheap s)\\\"\n apply (simp add: store_pte_def set_pt_def)\n apply (wp get_object_wp)\n apply simp\n done\n\nlemma set_asid_pool_thread_st_auth[wp]:\n \"set_asid_pool p pool \\\\s. P (thread_st_auth s)\\\"\n apply (simp add: set_asid_pool_def)\n apply (wpsimp wp: set_object_wp_strong)\n apply (clarsimp simp: thread_st_auth_def obj_at_def get_tcb_def tcb_states_of_state_def\n elim!: rsubst[where P=P, OF _ ext]\n split: kernel_object.split_asm option.split)\n done\n\nlemma set_asid_pool_thread_bound_ntfns[wp]:\n \"set_asid_pool p pool \\\\s. P (thread_bound_ntfns s)\\\"\n apply (simp add: set_asid_pool_def)\n apply (wpsimp wp: set_object_wp_strong)\n apply (clarsimp simp: thread_bound_ntfns_def obj_at_def get_tcb_def tcb_states_of_state_def\n elim!: rsubst[where P=P, OF _ ext]\n split: kernel_object.split_asm option.split)\n done\n\n(* FIXME move to AInvs *)\nlemma set_asid_pool_ekheap[wp]:\n \"set_asid_pool p pool \\\\s. P (ekheap s)\\\"\n apply (simp add: set_asid_pool_def)\n apply (wp get_object_wp | simp)+\n done\n\ncrunch integrity_autarch: set_asid_pool \"integrity aag X st\"\n (wp: crunch_wps)\n\nlemma store_pte_respects:\n \"\\integrity aag X st and K (is_subject aag (table_base p))\\\n store_pte p pte\n \\\\_. integrity aag X st\\\"\n apply (simp add: store_pte_def set_pt_def)\n apply (wp get_object_wp set_object_integrity_autarch)\n apply simp\n done\n\nlemma integrity_arch_state[iff]:\n \"riscv_asid_table v = riscv_asid_table (arch_state s)\n \\ integrity aag X st (s\\arch_state := v\\) = integrity aag X st s\"\n unfolding integrity_def by simp\n\nlemma integrity_riscv_global_pts[iff]:\n \"integrity aag X st (s\\arch_state := ((arch_state s)\\riscv_global_pts := v\\)\\) =\n integrity aag X st s\"\n unfolding integrity_def by simp\n\nlemma integrity_riscv_kernel_vspace[iff]:\n \"integrity aag X st (s\\arch_state := ((arch_state s)\\riscv_kernel_vspace := v\\)\\) =\n integrity aag X st s\"\n unfolding integrity_def by simp\n\nlemma is_subject_trans:\n \"\\ is_subject aag x; pas_refined aag s;\n (pasObjectAbs aag x, Control, pasObjectAbs aag y) \\ pasPolicy aag \\\n \\ is_subject aag y\"\n by (subst aag_has_Control_iff_owns[symmetric]; simp)\n\nlemma is_subject_asid_trans:\n \"\\ is_subject_asid aag x; pas_refined aag s;\n (pasASIDAbs aag x, Control, pasObjectAbs aag y) \\ pasPolicy aag \\\n \\ is_subject aag y\"\n by (subst aag_has_Control_iff_owns[symmetric]; simp)\n\nlemma pt_walk_is_subject:\n \"\\ pas_refined aag s; valid_vspace_objs s; valid_asid_table s; pspace_aligned s;\n pt_walk level bot_level pt_ptr vptr (ptes_of s) = Some (level', pt);\n vs_lookup_table level asid vptr s = Some (level, pt_ptr);\n level \\ max_pt_level; vptr \\ user_region; is_subject aag pt_ptr \\\n \\ is_subject aag pt\"\n apply (induct level arbitrary: pt_ptr; clarsimp)\n apply (erule_tac x=\"pptr_from_pte (the (ptes_of s (pt_slot_offset level pt_ptr vptr)))\" in meta_allE)\n apply (subst (asm) pt_walk.simps)\n apply (clarsimp simp: obind_def split: if_splits option.splits)\n apply (drule meta_mp)\n apply (erule vs_lookup_table_extend)\n apply (subst pt_walk.simps, clarsimp simp: obind_def)\n apply clarsimp\n apply (erule meta_mp)\n apply (frule vs_lookup_table_pt_at; clarsimp simp: pt_at_eq)\n apply (erule (1) is_subject_trans)\n apply (clarsimp simp: pas_refined_def auth_graph_map_def)\n apply (erule subsetD, clarsimp)\n apply (rule exI conjI refl sta_vref)+\n apply (erule state_vrefsD)\n apply (fastforce simp: pts_of_Some)\n apply clarsimp\n apply (frule_tac pt_ptr=pt_ptr in pspace_aligned_pts_ofD, simp)\n apply (clarsimp simp: ptes_of_def obind_def is_PageTablePTE_def vs_refs_aux_def split: option.splits)\n apply (drule_tac g=y and f=\"pte_ref2 level\" in graph_of_comp)\n apply (fastforce simp: pte_ref2_def)\n apply (fastforce simp: aobjs_of_Some pts_of_Some pptr_from_pte_def\n dest: table_index_max_level_slots\n elim: rev_bexI bexI_minus[rotated]\n intro!: pts_of_Some_alignedD)\n done\n\nlemma pt_lookup_slot_from_level_is_subject:\n \"\\ pas_refined aag s; valid_vspace_objs s; valid_asid_table s; pspace_aligned s;\n pt_lookup_slot_from_level level bot_level pt_ptr vptr (ptes_of s) = Some (level', pt);\n (\\asid. vs_lookup_table level asid vptr s = Some (level, pt_ptr));\n level \\ max_pt_level; vptr \\ user_region; is_subject aag pt_ptr \\\n \\ is_subject aag (table_base pt)\"\n by (fastforce dest: pt_walk_is_aligned vs_lookup_table_is_aligned pt_walk_is_subject\n simp: pt_lookup_slot_from_level_def obind_def split: option.splits)\n\nlemma pt_lookup_from_level_is_subject:\n \"\\\\s. pas_refined aag s \\ pspace_aligned s \\ valid_vspace_objs s \\ valid_asid_table s \\\n is_subject aag pt_ptr \\ level \\ max_pt_level \\ vref \\ user_region \\\n (\\asid. vs_lookup_table level asid vref s = Some (level, pt_ptr))\\\n pt_lookup_from_level level pt_ptr vref pt\n \\\\rv _. is_subject aag (table_base rv)\\, -\"\n apply (wpsimp wp: pt_lookup_from_level_wp)\n apply (erule_tac level=level and bot_level=levela and pt_ptr=pt_ptr and vptr=vref\n in pt_lookup_slot_from_level_is_subject)\n by (auto simp: pt_lookup_slot_from_level_def obind_def)\n\nlemma unmap_page_table_respects:\n \"\\integrity aag X st and pas_refined aag and invs\n and K (is_subject_asid aag asid \\ vaddr \\ user_region)\\\n unmap_page_table asid vaddr pt\n \\\\_. integrity aag X st\\\"\n apply (simp add: unmap_page_table_def sfence_def)\n apply (wpsimp wp: pt_lookup_from_level_is_subject dmo_mol_respects hoare_vcg_conj_liftE\n store_pte_respects pt_lookup_from_level_wrp[where Q=\"\\_. integrity aag X st\"]\n | wp (once) hoare_drop_imps hoare_vcg_E_elim)+\n apply (intro conjI; clarsimp)\n apply fastforce\n apply (rule aag_Control_into_owns[rotated], assumption)\n apply (drule sym)\n apply (clarsimp simp: vspace_for_asid_def obj_at_def pas_refined_def)\n apply (erule_tac A=\"state_asids_to_policy_aux _ _ _ _\" in subsetD)\n apply (rule sata_asid_lookup)\n apply (simp add: vspace_for_pool_def pool_for_asid_def)\n apply (clarsimp simp: vspace_for_pool_def)\n apply (drule pool_for_asid_vs_lookupD)\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some asid_pools_of_ko_at obj_at_def)\n apply assumption\n apply (fastforce simp: vs_refs_aux_def graph_of_def asid_low_bits_of_mask_eq[symmetric]\n word_size ucast_ucast_b is_up_def source_size_def target_size_def)\n apply (fastforce dest: vs_lookup_table_vref_independent[OF vspace_for_asid_vs_lookup])\n done\n\nlemma perform_page_table_invocation_respects:\n \"\\integrity aag X st and pas_refined aag and invs and valid_pti page_table_invocation\n and K (authorised_page_table_inv aag page_table_invocation)\\\n perform_page_table_invocation page_table_invocation\n \\\\_. integrity aag X st\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: perform_page_table_invocation_def perform_pt_inv_map_def perform_pt_inv_unmap_def\n cong: page_table_invocation.case_cong option.case_cong prod.case_cong\n cap.case_cong arch_cap.case_cong)\n apply (cases page_table_invocation; clarsimp)\n apply (wpsimp wp: set_cap_integrity_autarch store_pte_respects\n simp: authorised_page_table_inv_def sfence_def)\n apply (rename_tac cap fst_cslot_ptr snd_cslot_ptr)\n apply (wpsimp wp: set_cap_integrity_autarch)\n apply (rule_tac I=\"\\s. integrity aag X st s \\ is_subject aag fst_cslot_ptr \\ is_PageTableCap cap\"\n in mapM_x_inv_wp; clarsimp)\n apply (rule_tac P=\"\\s. integrity aag X st s \\ is_PageTableCap cap\" in hoare_vcg_conj_lift)\n apply (wpsimp wp: store_pte_respects)\n apply (clarsimp simp: authorised_page_table_inv_def)\n apply (case_tac cap; clarsimp)\n apply (wpsimp wp: unmap_page_table_respects)+\n apply (clarsimp simp: authorised_page_table_inv_def valid_pti_def valid_arch_cap_def\n wellformed_acap_def wellformed_mapdata_def\n split: arch_cap.splits)\n done\n\nlemma perform_pg_inv_get_addr_pas_refined [wp]:\n \"\\pas_refined aag and invs\\\n perform_pg_inv_get_addr ptr\n \\\\_. pas_refined aag\\\"\n unfolding perform_pg_inv_get_addr_def\n by wpsimp\n\nlemma unmap_page_pas_refined:\n \"\\pas_refined aag and invs and K (vptr \\ user_region)\\\n unmap_page pgsz asid vptr pptr\n \\\\_. pas_refined aag\\\"\n unfolding unmap_page_def\n apply (clarsimp simp: conj_ac | wpsimp wp: set_cap_pas_refined_not_transferable hoare_vcg_all_lift\n hoare_vcg_imp_lift' get_cap_wp store_pte_pas_refined\n store_pte_valid_arch_state_unreachable)+\n apply (frule (1) pt_lookup_slot_vs_lookup_slotI0)\n apply (drule vs_lookup_slot_level)\n apply (case_tac \"x = asid_pool_level\")\n apply (fastforce dest: vs_lookup_slot_no_asid)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (intro conjI)\n apply (clarsimp simp: reachable_page_table_not_global)\n apply (frule vs_lookup_table_pt_at; clarsimp?)\n apply (drule vs_lookup_table_valid_cap; clarsimp?)\n apply (fastforce simp: valid_cap_def valid_arch_cap_def valid_arch_cap_ref_def obj_at_def\n dest: caps_of_state_valid split: cap.splits arch_cap.splits)\n apply (metis vs_lookup_table_vspace user_region_slots is_aligned_neg_mask2 pt_slot_offset_offset)\n done\n\ndefinition authorised_slots :: \"'a PAS \\ pte \\ obj_ref \\ 's :: state_ext state \\ bool\" where\n \"authorised_slots aag m s \\ case m of (pte, slot) \\\n (\\level asid vref x.\n vs_lookup_slot level asid vref s = Some (level, slot) \\\n vref \\ user_region \\\n level \\ max_pt_level \\\n pte_ref2 level pte = Some x \\\n (\\a \\ snd (snd x). \\p \\ ptr_range (fst x) (fst (snd x)). aag_has_auth_to aag a p)) \\\n is_subject aag (table_base slot)\"\n\ndefinition authorised_page_inv :: \"'a PAS \\ page_invocation \\ 's :: state_ext state \\ bool\" where\n \"authorised_page_inv aag pgi s \\ case pgi of\n PageMap cap ptr slots \\ pas_cap_cur_auth aag (ArchObjectCap cap) \\\n is_subject aag (fst ptr) \\ authorised_slots aag slots s\n | PageUnmap cap ptr \\ pas_cap_cur_auth aag (ArchObjectCap cap) \\ is_subject aag (fst ptr)\n | PageGetAddr ptr \\ True\"\n\nlemma perform_pg_inv_unmap_pas_refined:\n \"\\pas_refined aag and invs and valid_page_inv (PageUnmap cap ct_slot)\n and authorised_page_inv aag (PageUnmap cap ct_slot)\\\n perform_pg_inv_unmap cap ct_slot\n \\\\_. pas_refined aag\\\"\n unfolding perform_pg_inv_unmap_def\n apply (strengthen invs_psp_aligned invs_vspace_objs invs_arch_state\n | wpsimp wp: unmap_page_pas_refined set_cap_pas_refined_not_transferable\n unmap_page_invs get_cap_wp hoare_vcg_all_lift hoare_vcg_imp_lift)+\n apply (fastforce simp: authorised_page_inv_def valid_page_inv_def valid_arch_cap_def\n cte_wp_at_caps_of_state update_map_data_def aag_cap_auth_def\n cap_auth_conferred_def arch_cap_auth_conferred_def\n cap_links_asid_slot_def cap_links_irq_def wellformed_mapdata_def)\n done\n\nlemma set_cap_vs_lookup_slot[wp]:\n \"set_cap param_a param_b \\\\s. P (vs_lookup_slot level asid vref s)\\ \"\n apply (clarsimp simp: vs_lookup_slot_def obind_def)\n apply (rule hoare_pre)\n apply (rule hoare_lift_Pf3[where f=\"\\s level asid vref. vs_lookup_table level asid vref s\"])\n apply (clarsimp split: option.splits)\n apply wpsimp\n apply wpsimp\n apply (auto split: if_splits)\n done\n\ncrunches set_cap\n for level_of_table[wp]: \"\\s. P (level_of_table p s)\"\n (simp: level_of_table_def)\n\nlemma set_cap_authorised_page_inv[wp]:\n \"set_cap param_a param_b \\\\s. P (authorised_page_inv aag (PageMap cap ct_slot entries) s)\\ \"\n apply (clarsimp simp: authorised_page_inv_def authorised_slots_def)\n apply (rule hoare_pre)\n apply wps\n apply wp\n apply clarsimp\n done\n\nlemma set_cap_same_ref[wp]:\n \"set_cap param_a param_b \\\\s. P (same_ref pte_slot cap s)\\ \"\n apply (case_tac pte_slot; clarsimp)\n apply (clarsimp simp: same_ref_def)\n apply (rule hoare_pre)\n apply wps\n apply wp\n apply clarsimp\n done\n\nlemma perform_pg_inv_map_pas_refined:\n \"\\pas_refined aag and invs and valid_page_inv (PageMap cap ct_slot (pte,slot))\n and authorised_page_inv aag (PageMap cap ct_slot (pte,slot))\\\n perform_pg_inv_map cap ct_slot pte slot\n \\\\_. pas_refined aag\\\"\n unfolding perform_pg_inv_map_def\n apply (wpsimp simp: simp: pas_refined_def state_objs_to_policy_def)\n apply (subst conj_commute, subst conj_commute)\n apply clarsimp\n apply (rule hoare_vcg_conj_lift, wpsimp)\n apply wps\n apply (rule state_vrefs_store_NonPageTablePTE_wp)\n apply (rule_tac Q=\"\\_. invs and pas_refined aag and K (\\ is_PageTablePTE pte)\n and authorised_page_inv aag (PageMap cap ct_slot (pte,slot))\n and same_ref (pte,slot) (ArchObjectCap cap)\"\n in hoare_strengthen_post[rotated])\n apply (clarsimp simp: pas_refined_def)\n apply (rule conjI)\n apply clarsimp\n apply (intro exI, rule conjI, assumption)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (erule_tac A=\"state_asids_to_policy_aux _ _ _ _\" in subsetD)\n apply (erule state_asids_to_policy_aux.cases)\n apply (fastforce dest: sata_asid)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp only: split: if_splits)\n apply (clarsimp simp: vs_refs_aux_def)\n apply (erule sata_asid_lookup)\n apply assumption\n apply (fastforce dest: sata_asidpool)\n apply (clarsimp simp: auth_graph_map_def authorised_page_inv_def)\n apply (erule state_bits_to_policy.cases)\n apply (fastforce dest: sbta_caps simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_untyped simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_ts simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_bounds simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_cdt simp: state_objs_to_policy_def)\n apply (fastforce dest: sbta_cdt_transferable simp: state_objs_to_policy_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: vs_refs_aux_def graph_of_def)\n apply (erule_tac P=\"_ \\ _\" in swap)\n apply (case_tac \"level = asid_pool_level\")\n apply (fastforce dest!: vs_lookup_slot_no_asid\n simp: ptes_of_Some pts_of_Some aobjs_of_Some obj_at_def)\n apply (clarsimp split: if_split_asm)\n apply (case_tac pte; clarsimp simp: authorised_slots_def)\n apply (subst (asm) vs_lookup_slot_table_unfold; clarsimp)\n apply (erule subsetD)\n apply (clarsimp simp: state_objs_to_policy_def)\n apply (rule exI, rule conjI, rule refl)+\n apply (rule sbta_vref)\n apply (erule state_vrefsD)\n apply (fastforce simp: aobjs_of_Some obj_at_def)\n apply fastforce\n apply (fastforce simp: vs_refs_aux_def graph_of_def)\n apply (fastforce dest: sbta_vref simp: state_objs_to_policy_def)\n apply (clarsimp simp: same_ref_def)\n apply (wpsimp wp: arch_update_cap_invs_map set_cap_pas_refined_not_transferable)\n apply (clarsimp simp: valid_page_inv_def authorised_page_inv_def cte_wp_at_caps_of_state\n is_frame_cap_def is_arch_update_def cap_master_cap_def\n split: arch_cap.splits)\n apply (rule conjI)\n apply (fastforce dest: vs_lookup_slot_unique_level simp: same_ref_def parent_for_refs_def)\n apply (fastforce dest: vs_lookup_slot_unique_level caps_of_state_valid\n simp: valid_arch_cap_def valid_cap_def cap_aligned_def)\n done\n\nlemma perform_page_invocation_pas_refined:\n \"\\pas_refined aag and invs and authorised_page_inv aag pgi and valid_page_inv pgi\\\n perform_page_invocation pgi\n \\\\_. pas_refined aag\\\"\n apply (simp add: perform_page_invocation_def)\n apply (wpsimp wp: perform_pg_inv_map_pas_refined perform_pg_inv_unmap_pas_refined)\n apply auto\n done\n\nlemma unmap_page_respects:\n \"\\integrity aag X st and pspace_aligned and valid_vspace_objs and valid_arch_state\n and K (is_subject_asid aag asid) and pas_refined aag\n and K (vptr \\ user_region)\\\n unmap_page sz asid vptr pptr\n \\\\_. integrity aag X st\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: unmap_page_def swp_def cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wpsimp wp: store_pte_respects\n hoare_drop_imps[where Q=\"\\rv. integrity aag X st\"]\n simp: sfence_def is_aligned_mask[symmetric]\n | wp (once) hoare_drop_imps\n mapM_set''[where f=\"(\\a. store_pte a InvalidPTE)\"\n and I=\"\\x s. is_subject aag (x && ~~ mask pt_bits)\"\n and Q=\"integrity aag X st\"]\n | wp (once) hoare_drop_imps[where R=\"\\rv s. rv\"])+\n apply (clarsimp simp: pt_lookup_slot_def)\n apply (frule pt_lookup_slot_from_level_is_subject)\n apply (fastforce simp: valid_arch_state_asid_table\n dest: vs_lookup_table_vref_independent[OF vspace_for_asid_vs_lookup])+\n apply (erule (1) is_subject_asid_trans)\n apply (clarsimp simp: pas_refined_def vspace_for_asid_def vspace_for_pool_def)\n apply (erule subsetD[where A=\"state_asids_to_policy_aux _ _ _ _\"])\n apply (rule sata_asid_lookup)\n apply (fastforce simp: pool_for_asid_def)\n apply (frule pool_for_asid_vs_lookupD)\n apply (erule state_vrefsD)\n apply (fastforce simp: vspace_for_pool_def opt_map_def split: option.splits)\n apply assumption\n apply (fastforce simp: vs_refs_aux_def graph_of_def asid_low_bits_of_mask_eq[symmetric] word_size\n ucast_ucast_b ucast_up_ucast_id is_up_def source_size_def target_size_def)\n apply simp\n done\n\nlemma perform_page_invocation_respects:\n \"\\integrity aag X st and pas_refined aag and authorised_page_inv aag pgi\n and valid_page_inv pgi and valid_vspace_objs\n and pspace_aligned and valid_vspace_objs and valid_arch_state\n and is_subject aag \\ cur_thread\\\n perform_page_invocation pgi\n \\\\_. integrity aag X st\\\"\nproof -\n have set_tl_subset_mp: \"\\xs a. a \\ set (tl xs) \\ a \\ set xs\" by (case_tac xs; clarsimp)\n show ?thesis\n apply (unfold authorised_page_inv_def)\n apply (simp add: perform_page_invocation_def mapM_discarded swp_def valid_page_inv_def\n valid_unmap_def authorised_page_inv_def authorised_slots_def\n perform_pg_inv_map_def perform_pg_inv_unmap_def sfence_def\n split: page_invocation.split sum.split\n arch_cap.split option.split, safe)\n apply ((wp set_cap_integrity_autarch unmap_page_respects\n mapM_x_and_const_wp[OF store_pte_respects] store_pte_respects\n | elim conjE\n | clarsimp dest!: set_tl_subset_mp\n | wpc)+)\n apply (rule conjI)\n apply (case_tac m; clarsimp)\n apply (clarsimp simp: aag_cap_auth_def cte_wp_at_caps_of_state)\n apply (prop_tac \"a \\ acap_asid' (FrameCap r R sz dev (Some (a,b)))\", clarsimp)\n apply (drule (1) sata_asid[where aag=aag])\n apply (clarsimp simp: pas_refined_def)\n apply (drule (1) subsetD)\n apply (fastforce dest: aag_wellformed_Control)\n apply (fastforce simp: valid_arch_cap_def wellformed_mapdata_def split: if_splits)\n apply (wpsimp wp: set_mrs_integrity_autarch set_message_info_integrity_autarch\n simp: ipc_buffer_has_auth_def perform_pg_inv_get_addr_def)\n done\nqed\n\nlemma integrity_asid_table_entry_update':\n \"\\ integrity aag X st s; atable = riscv_asid_table (arch_state s); is_subject aag v;\n (\\asid'. asid' \\ 0 \\ asid_high_bits_of asid' = asid_high_bits_of asid \\ is_subject_asid aag asid') \\\n \\ integrity aag X st (s\\arch_state :=\n arch_state s\\riscv_asid_table := \\a. if a = asid_high_bits_of asid\n then (Some v)\n else atable a\\\\)\"\n by (clarsimp simp: integrity_def)\n\nlemma asid_table_entry_update_integrity:\n \"\\integrity aag X st and (\\s. atable = riscv_asid_table (arch_state s)) and K (is_subject aag v)\n and K (\\asid'. asid' \\ 0 \\ asid_high_bits_of asid' = asid_high_bits_of asid\n \\ is_subject_asid aag asid')\\\n modify (\\s. s\\arch_state := arch_state s\\riscv_asid_table := atable(asid_high_bits_of asid := Some v)\\\\)\n \\\\_. integrity aag X st\\\"\n by wpsimp (blast intro: integrity_asid_table_entry_update')\n\ndefinition authorised_asid_control_inv :: \"'a PAS \\ asid_control_invocation \\ bool\" where\n \"authorised_asid_control_inv aag aci \\\n case aci of MakePool frame slot parent base \\\n is_subject aag (fst slot) \\ is_aligned frame pageBits \\\n (\\asid. is_subject_asid aag asid) \\ is_subject aag (fst parent) \\\n (\\x \\ {frame..frame + 2 ^ pageBits - 1}. is_subject aag x)\"\n\nlemma perform_asid_control_invocation_respects:\n \"\\integrity aag X st and invs and valid_aci aci and K (authorised_asid_control_inv aag aci)\\\n perform_asid_control_invocation aci\n \\\\_. integrity aag X st\\\"\n apply (simp add: perform_asid_control_invocation_def)\n apply (wpc, simp)\n apply (wpsimp wp: set_cap_integrity_autarch cap_insert_integrity_autarch\n asid_table_entry_update_integrity retype_region_integrity[where sz=12]\n static_imp_wp delete_objects_valid_vspace_objs delete_objects_valid_arch_state)\n apply (clarsimp simp: authorised_asid_control_inv_def ptr_range_def add.commute range_cover_def\n obj_bits_api_def default_arch_object_def pageBits_def word_bits_def)\n apply (subst is_aligned_neg_mask_eq[THEN sym], assumption)\n apply (clarsimp simp: and_mask_eq_iff_shiftr_0 mask_zero word_size_bits_def)\n apply (frule is_aligned_no_overflow_mask)\n apply (clarsimp simp: mask_def)\n done\n\nlemma state_vrefs_asid_pool_map:\n \"\\ ako_at (ASIDPool Map.empty) frame s; asid_table s (asid_high_bits_of base) = None \\\n \\ state_vrefs (s\\arch_state := arch_state s\\riscv_asid_table := \\a. if a = asid_high_bits_of base\n then Some frame\n else asid_table s a\\\\)\n = state_vrefs s\"\n apply (rule all_ext)\n apply clarsimp\n apply safe\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (case_tac \"asid_high_bits_of asid = asid_high_bits_of base\")\n apply (clarsimp simp: vs_lookup_table_def pool_for_asid_def vspace_for_pool_def graph_of_def\n asid_pools_of_ko_at obj_at_def vs_refs_aux_def aobjs_of_Some\n split: if_splits)\n apply (subst (asm) asid_update.vs_lookup_table[simplified fun_upd_def])\n apply (clarsimp simp: asid_update_def asid_pools_of_ko_at)\n apply (clarsimp split: if_splits)\n apply (erule (3) state_vrefsD)\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (case_tac \"asid_high_bits_of asid = asid_high_bits_of base\")\n apply (clarsimp simp: vs_lookup_table_def pool_for_asid_def)\n apply (rule_tac level=bot and asid=asid and vref=vref in state_vrefsD)\n apply (subst asid_update.vs_lookup_table[simplified fun_upd_def])\n apply (clarsimp simp: asid_update_def asid_pools_of_ko_at)\n apply fastforce\n apply (fastforce simp: aobjs_of_Some)\n apply clarsimp\n apply clarsimp\n done\n\nlemma pas_refined_asid_control_helper:\n \"authorised_asid_control_inv aag (MakePool frame slot parent base) \\\n \\\\s. pas_refined aag s \\ ko_at (ArchObj (ASIDPool Map.empty)) frame s\n \\ asid_table s (asid_high_bits_of base) = None\\\n do asid_table <- gets (riscv_asid_table \\ arch_state);\n asid_table' <- return (asid_table(asid_high_bits_of base \\ frame));\n modify (\\s. s\\arch_state := arch_state s\\riscv_asid_table := asid_table'\\\\)\n od\n \\\\_. pas_refined aag\\\"\n unfolding pas_refined_def\n apply wpsimp\n apply (rule conjI)\n apply (clarsimp simp: auth_graph_map_def state_objs_to_policy_def)\n apply (erule state_bits_to_policy.cases)\n apply (fastforce dest: sbta_caps)\n apply (fastforce dest: sbta_untyped)\n apply (fastforce dest: sbta_ts)\n apply (fastforce dest: sbta_bounds)\n apply (fastforce dest: sbta_cdt)\n apply (fastforce dest: sbta_cdt_transferable)\n apply (fastforce dest: sbta_vref simp: state_vrefs_asid_pool_map)\n apply clarsimp\n apply (erule state_asids_to_policy_aux.cases)\n apply (fastforce dest: sata_asid)\n apply (subst (asm) state_vrefs_asid_pool_map; clarsimp)\n apply (case_tac \"asid_high_bits_of asid = asid_high_bits_of base\")\n apply (clarsimp simp: state_vrefs_def aobjs_of_Some obj_at_def vs_refs_aux_def graph_of_def)\n apply (drule sata_asid_lookup[rotated]; fastforce)\n apply (clarsimp split: if_splits)\n apply (fastforce simp: authorised_asid_control_inv_def is_aligned_no_overflow aag_wellformed_refl)\n apply (fastforce dest: sata_asidpool)\n done\n\nlemma perform_asid_control_invocation_pas_refined:\n \"\\pas_refined aag and pas_cur_domain aag and invs and valid_aci aci and ct_active\n and K (authorised_asid_control_inv aag aci)\\\n perform_asid_control_invocation aci\n \\\\_. pas_refined aag\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: perform_asid_control_invocation_def )\n apply wpc\n apply (rule pas_refined_asid_control_helper hoare_seq_ext hoare_K_bind)+\n apply (wp cap_insert_pas_refined' static_imp_wp | simp)+\n apply ((wp retype_region_pas_refined'[where sz=pageBits]\n hoare_vcg_ex_lift hoare_vcg_all_lift static_imp_wp hoare_wp_combs hoare_drop_imp\n retype_region_invs_extras(1)[where sz = pageBits]\n retype_region_invs_extras(4)[where sz = pageBits]\n retype_region_invs_extras(6)[where sz = pageBits]\n retype_region_invs_extras(7)[where sz = pageBits]\n retype_region_cte_at_other'[where sz=pageBits]\n max_index_upd_invs_simple max_index_upd_caps_overlap_reserved\n hoare_vcg_ex_lift set_cap_cte_wp_at hoare_vcg_disj_lift set_free_index_valid_pspace\n set_cap_descendants_range_in set_cap_no_overlap get_cap_wp set_cap_caps_no_overlap\n hoare_vcg_all_lift static_imp_wp retype_region_invs_extras\n set_cap_pas_refined_not_transferable arch_update_cap_valid_mdb\n | simp add: do_machine_op_def region_in_kernel_window_def cte_wp_at_neg2)+)[3]\n apply (rename_tac frame slot parent base )\n apply (case_tac slot, rename_tac slot_ptr slot_idx)\n apply (case_tac parent, rename_tac parent_ptr parent_idx)\n apply (rule_tac Q=\"\\rv s.\n (\\idx. cte_wp_at ((=) (UntypedCap False frame pageBits idx)) parent s) \\\n (\\x\\ptr_range frame pageBits. is_subject aag x) \\\n pas_refined aag s \\ pas_cur_domain aag s \\\n pspace_no_overlap_range_cover frame pageBits s \\\n invs s \\ asid_table s (asid_high_bits_of base) = None \\\n descendants_range_in {frame..(frame && ~~ mask pageBits) + 2 ^ pageBits - 1} parent s \\\n range_cover frame pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \\\n is_subject aag slot_ptr \\ is_subject aag parent_ptr \\ is_subject aag frame \\\n pas_cap_cur_auth aag (ArchObjectCap (ASIDPoolCap frame base)) \\\n (\\x. asid_high_bits_of x = asid_high_bits_of base \\ is_subject_asid aag x)\"\n in hoare_strengthen_post)\n apply (simp add: page_bits_def)\n apply (wp add: delete_objects_pspace_no_overlap hoare_vcg_ex_lift\n delete_objects_descendants_range_in delete_objects_invs_ex\n delete_objects_pas_refined\n del: Untyped_AI.delete_objects_pspace_no_overlap\n | simp add: page_bits_def)+\n apply clarsimp\n apply (rename_tac s idx)\n apply (frule untyped_cap_aligned, simp add: invs_valid_objs)\n apply (clarsimp simp: cte_wp_at_def aag_cap_auth_def ptr_range_def pas_refined_refl\n cap_links_asid_slot_def cap_links_irq_def obj_bits_api_def\n default_arch_object_def retype_addrs_def conj_ac\n invs_psp_aligned invs_valid_pspace invs_vspace_objs invs_arch_state)\n apply (rule conjI, force intro: descendants_range_caps_no_overlapI simp: cte_wp_at_def)\n apply (rule conjI, clarsimp simp: max_free_index_def)\n apply (prop_tac \"valid_cap (UntypedCap False frame pageBits idx) s\")\n apply (clarsimp simp: get_cap_caps_of_state)\n apply (simp add: Untyped_AI.caps_of_state_valid)\n apply (clarsimp simp: free_index_of_def max_free_index_def valid_cap_def)\n apply (rule conjI)\n apply (cut_tac s=s and ptr=\"(parent_ptr, parent_idx)\" in cap_refs_in_kernel_windowD)\n apply ((fastforce simp: caps_of_state_def cap_range_def)+)[3]\n apply (fastforce simp: x_power_minus_1 is_aligned_no_overflow')\n apply (clarsimp simp: valid_aci_def authorised_asid_control_inv_def cte_wp_at_caps_of_state)\n apply (rule conjI)\n apply (drule untyped_slots_not_in_untyped_range)\n apply (erule empty_descendants_range_in)\n apply (simp add: cte_wp_at_caps_of_state)\n apply simp\n apply simp\n apply (rule subset_refl)\n apply (simp add: page_bits_def)\n apply (frule_tac x=x in bspec)\n apply (simp add: is_aligned_no_overflow)\n apply (clarsimp simp: ptr_range_def invs_psp_aligned invs_valid_objs aag_cap_auth_def\n descendants_range_def2 empty_descendants_range_in page_bits_def\n pas_refined_refl cap_links_asid_slot_def label_owns_asid_slot_def\n cap_links_irq_def range_cover_def obj_bits_api_def pageBits_def\n default_arch_object_def and_mask_eq_iff_shiftr_0 mask_zero)\n apply (subst is_aligned_neg_mask_eq[THEN sym], assumption)\n apply (intro conjI; fastforce intro: empty_descendants_range_in)\n done\n\nlemma copy_global_mappings_integrity:\n \"\\integrity aag X st and K (is_aligned x pt_bits \\ is_subject aag x)\\\n copy_global_mappings x\n \\\\_. integrity aag X st\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: copy_global_mappings_def)\n apply (wp mapM_x_wp[OF _ subset_refl] store_pte_respects)\n apply (simp only: pt_index_def)\n apply (subst table_base_offset_id)\n apply simp\n apply (clarsimp simp: pte_bits_def word_size_bits_def pt_bits_def\n table_size_def ptTranslationBits_def mask_def)\n apply (word_bitwise, fastforce)\n apply clarsimp\n apply wpsimp+\n done\n\ndefinition authorised_asid_pool_inv :: \"'a PAS \\ asid_pool_invocation \\ bool\" where\n \"authorised_asid_pool_inv aag api \\\n case api of Assign asid pool_ptr ct_slot \\\n is_subject aag pool_ptr \\ is_subject aag (fst ct_slot) \\ is_subject_asid aag asid\"\n\nlemma perform_asid_pool_invocation_respects:\n \"\\integrity aag X st and pas_refined aag and invs and valid_apinv api\n and K (authorised_asid_pool_inv aag api)\\\n perform_asid_pool_invocation api\n \\\\_. integrity aag X st\\\"\n apply (unfold perform_asid_pool_invocation_def store_asid_pool_entry_def)\n apply (wpsimp wp: set_asid_pool_integrity_autarch get_cap_wp set_cap_integrity_autarch\n copy_global_mappings_integrity hoare_drop_imps)\n apply (clarsimp simp: authorised_asid_pool_inv_def valid_apinv_def cte_wp_at_caps_of_state is_cap_simps)\n apply (rule conjI)\n apply (rule is_aligned_pt; fastforce simp: valid_cap_def dest: caps_of_state_valid)\n apply (frule_tac ptr=\"(a,b)\" in sbta_caps)\n apply simp\n apply (simp add: cap_auth_conferred_def arch_cap_auth_conferred_def)\n apply (erule_tac x=a in is_subject_trans, assumption)\n apply (fastforce simp: pas_refined_def auth_graph_map_def state_objs_to_policy_def)\n done\n\nlemma store_pte_state_vrefs_unreachable:\n \"\\\\s. P (state_vrefs s) \\ pspace_aligned s \\ valid_vspace_objs s \\\n valid_asid_table s \\ (\\level. \\ \\\\ (level, table_base p) s)\\\n store_pte p pte\n \\\\_ s. P (state_vrefs s)\\\"\n supply fun_upd_apply[simp del]\n apply (wpsimp simp: store_pte_def set_pt_def wp: set_object_wp)\n apply (erule rsubst[where P=P])\n apply (rule all_ext)\n apply (rule allI, rename_tac x)\n apply safe\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (rule state_vrefsD)\n apply (subst vs_lookup_table_unreachable_upd_idem; fastforce)\n apply (drule vs_lookup_level)\n apply (prop_tac \"x \\ table_base p\", clarsimp)\n apply (fastforce simp: fun_upd_def aobjs_of_Some opt_map_def)\n apply clarsimp\n apply fastforce\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (rule state_vrefsD)\n apply (subst (asm) vs_lookup_table_unreachable_upd_idem; fastforce)\n apply (prop_tac \"x \\ table_base p\")\n apply (subst (asm) vs_lookup_table_unreachable_upd_idem; fastforce dest: vs_lookup_level)\n apply (fastforce simp: fun_upd_def aobjs_of_Some)\n apply clarsimp\n apply clarsimp\n done\n\nlemma copy_global_mappings_state_vrefs:\n \"\\\\s. P (state_vrefs s) \\ invs s \\ is_aligned pt_ptr pt_bits \\ (\\level. \\ \\\\ (level, pt_ptr) s)\\\n copy_global_mappings pt_ptr\n \\\\_ s. P (state_vrefs s)\\\"\n unfolding copy_global_mappings_def\n apply clarsimp\n apply wp\n apply (rule_tac Q=\"\\_ s. P (state_vrefs s) \\ pspace_aligned s \\ valid_vspace_objs s \\\n valid_asid_table s \\ unique_table_refs s \\ valid_vs_lookup s \\\n valid_objs s \\ is_aligned pt_ptr pt_bits \\ is_aligned global_pt pt_bits \\\n (\\level. \\ \\\\ (level, table_base (pt_ptr)) s) \\\n (\\level. \\ \\\\ (level, table_base (global_pt)) s)\"\n in hoare_strengthen_post[rotated], clarsimp)\n apply (wpsimp wp: store_pte_state_vrefs_unreachable store_pte_valid_vs_lookup_unreachable\n store_pte_vs_lookup_table_unreachable store_pte_valid_vspace_objs\n hoare_vcg_all_lift hoare_vcg_imp_lift' mapM_x_wp')\n apply (prop_tac \"table_base (pt_ptr + (x << pte_bits)) = pt_ptr \\\n table_base (global_pt + (x << pte_bits)) = global_pt\")\n apply (metis mask_2pm1 table_base_plus)\n apply (fastforce simp: valid_objs_caps ptes_of_wellformed_pte)\n apply wpsimp+\n apply (simp add: invs_valid_global_vspace_mappings)\n apply (intro conjI; clarsimp)\n apply (frule invs_valid_global_arch_objs)\n apply (frule valid_global_arch_objs_pt_at)\n using not_in_global_refs_vs_lookup apply fastforce\n done\n\ncrunches copy_global_mappings\n for tcb_domain_map_wellformed[wp]: \"\\s. P (tcb_domain_map_wellformed aag s)\"\n and asid_table[wp]: \"\\s. P (asid_table s)\"\n and cdt[wp]: \"\\s. P (cdt s)\"\n and thread_st_auth[wp]: \"\\s. P (thread_st_auth s)\"\n and thread_bound_ntfns[wp]: \"\\s. P (thread_bound_ntfns s)\"\n (wp: crunch_wps)\n\nlemma copy_global_mappings_pas_refined:\n \"\\\\s. pas_refined aag s \\ invs s \\ is_aligned pt_ptr pt_bits \\ (\\level. \\ \\\\ (level, pt_ptr) s)\\\n copy_global_mappings pt_ptr\n \\\\_. pas_refined aag\\\"\n apply (clarsimp simp: pas_refined_def state_objs_to_policy_def)\n apply (rule hoare_pre)\n apply (wps)\n apply (wpsimp wp: copy_global_mappings_state_vrefs)+\n done\n\nlemma store_asid_pool_entry_state_vrefs:\n \"\\\\s. P (\\x. if x = pool_ptr\n then vs_refs_aux asid_pool_level (ASIDPool (\\a. if a = asid_low_bits_of asid\n then Some pt_base\n else the (asid_pools_of s pool_ptr) a))\n else if x = pt_base\n then vs_refs_aux max_pt_level (the (aobjs_of s x))\n else state_vrefs s x) \\\n pspace_aligned s \\ valid_vspace_objs s \\ valid_asid_table s \\\n pool_for_asid asid s = Some pool_ptr \\\n (\\pool. ako_at (ASIDPool pool) pool_ptr s \\ pool (asid_low_bits_of asid) = None) \\\n (\\level. \\\\\\ (level, pt_base) s) \\\n (\\pt. pts_of s pt_base = Some pt \\ kernel_mappings_only pt s)\\\n store_asid_pool_entry pool_ptr asid (Some pt_base)\n \\\\_ s. P (state_vrefs s)\\\"\n unfolding store_asid_pool_entry_def set_asid_pool_def\n apply (wpsimp wp: set_object_wp get_cap_wp)\n apply (erule rsubst[where P=P])\n apply (rule all_ext)\n apply (clarsimp split del: if_split)\n apply (prop_tac \"is_aligned pt_base pt_bits\")\n apply (fastforce elim: pspace_aligned_pts_ofD dest: invs_psp_aligned)\n apply safe\n apply (clarsimp split: if_splits)\n apply (frule pool_for_asid_vs_lookupD)\n apply (rule_tac level=asid_pool_level in state_vrefsD)\n apply (simp only: fun_upd_def)\n apply (subst asid_pool_map.vs_lookup_table[simplified fun_upd_def])\n apply (fastforce simp: asid_pool_map_def asid_pools_of_ko_at\n valid_apinv_def asid_low_bits_of_def aobjs_of_Some)\n apply fastforce\n apply fastforce\n apply fastforce\n apply (fastforce simp: ako_asid_pools_of)\n apply (clarsimp simp: ako_asid_pools_of)\n apply (rule_tac level=max_pt_level and vref=0 in state_vrefsD)\n apply (simp only: fun_upd_def)\n apply (subst asid_pool_map.vs_lookup_table[simplified fun_upd_def])\n apply (fastforce simp: asid_pool_map_def asid_pools_of_ko_at\n valid_apinv_def asid_low_bits_of_def aobjs_of_Some)\n apply clarsimp\n apply fastforce\n apply (fastforce simp: pts_of_Some)\n apply (fastforce simp: pts_of_Some)\n apply (fastforce simp: pts_of_Some)\n apply (clarsimp simp: obj_at_def)\n apply (subst (asm) state_vrefs_def, clarsimp)\n apply (rename_tac asida vref)\n apply (rule_tac asid=asida in state_vrefsD)\n apply (simp only: fun_upd_def)\n apply (subst asid_pool_map.vs_lookup_table[simplified fun_upd_def])\n apply (fastforce simp: asid_pool_map_def asid_pools_of_ko_at obj_at_def\n valid_apinv_def asid_low_bits_of_def aobjs_of_Some)\n apply fastforce\n apply (prop_tac \"asid \\ asida\")\n apply (fastforce simp: vs_lookup_table_def vspace_for_pool_def asid_pools_of_ko_at obj_at_def\n split: if_splits)\n apply fastforce\n apply fastforce\n apply fastforce\n apply clarsimp\n apply (subst (asm) state_vrefs_def, clarsimp split del: if_split)\n apply (simp only: fun_upd_def)\n apply (subst (asm) asid_pool_map.vs_lookup_table[simplified fun_upd_def])\n apply (fastforce simp: asid_pool_map_def asid_pools_of_ko_at\n valid_apinv_def asid_low_bits_of_def aobjs_of_Some)\n apply clarsimp\n apply (case_tac \"x = pool_ptr\")\n apply (prop_tac \"asid_pools_of s pool_ptr = Some pool\")\n apply (clarsimp simp: asid_pools_of_ko_at obj_at_def)\n apply (clarsimp simp: vs_refs_aux_def)\n apply (case_tac \"asida = asid \\ bot \\ max_pt_level\"; clarsimp)\n apply (case_tac \"x = pt_base\")\n apply (fastforce dest: vs_lookup_level)\n apply (fastforce simp: state_vrefs_def)\n done\n\ncrunches store_asid_pool_entry\n for irq_map_wellformed[wp]: \"\\s. P (irq_map_wellformed aag s)\"\n and tcb_domain_map_wellformed[wp]: \"\\s. P (tcb_domain_map_wellformed aag s)\"\n and state_irqs_to_policy[wp]: \"\\s. P (state_irqs_to_policy aag s)\"\n and caps_of_state[wp]: \"\\s. P (caps_of_state s)\"\n and asid_table[wp]: \"\\s. P (asid_table s)\"\n and cdt[wp]: \"\\s. P (cdt s)\"\n and thread_st_auth[wp]: \"\\s. P (thread_st_auth s)\"\n and thread_bound_ntfns[wp]: \"\\s. P (thread_bound_ntfns s)\"\n\nlemma store_asid_pool_entry_pas_refined:\n \"\\\\s. pas_refined aag s \\ pspace_aligned s \\ valid_vspace_objs s \\ valid_asid_table s \\\n pool_for_asid asid s = Some pool_ptr \\ is_subject aag pool_ptr \\\n is_subject aag pt_base \\ is_subject_asid aag asid \\\n (\\level. \\\\\\ (level, pt_base) s) \\\n (\\pool. ako_at (ASIDPool pool) pool_ptr s \\ pool (asid_low_bits_of asid) = None) \\\n (\\pt. pts_of s pt_base = Some pt \\ kernel_mappings_only pt s)\\\n store_asid_pool_entry pool_ptr asid (Some pt_base)\n \\\\_ s. pas_refined aag s\\\"\n apply (clarsimp simp: pas_refined_def state_objs_to_policy_def)\n apply (rule hoare_pre)\n apply wps\n apply (wp store_asid_pool_entry_state_vrefs store_asid_pool_entry_state_vrefs)\n apply (clarsimp simp: auth_graph_map_def)\n apply (frule (1) pool_for_asid_validD)\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (erule state_bits_to_policy.cases)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_caps)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_untyped)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_ts)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_bounds)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_cdt)\n apply (fastforce simp: state_objs_to_policy_def dest: sbta_cdt_transferable)\n apply (case_tac \"ptr = pool_ptr\")\n apply (clarsimp simp: vs_refs_aux_def graph_of_def aag_wellformed_refl split: if_splits)\n apply (erule subsetD)\n apply clarsimp\n apply (rule_tac x=pool_ptr in exI, clarsimp)\n apply (rule exI, rule conjI, rule refl)\n apply (rule sbta_vref)\n apply (drule pool_for_asid_vs_lookupD)\n apply (erule_tac vref=0 in state_vrefsD)\n apply (simp add: asid_pools_of_ko_at aobjs_of_ako_at_Some)\n apply clarsimp\n apply (fastforce simp: vs_refs_aux_def graph_of_def)\n apply (fastforce simp: vs_refs_aux_def kernel_mappings_only_def\n graph_of_def pts_of_Some pte_ref2_def\n dest: sbta_vref split: if_splits)\n apply (erule state_asids_to_policy_aux.cases)\n apply (erule subsetD[where A=\"state_asids_to_policy_aux _ _ _ _\"])\n apply (fastforce dest: sata_asid)\n apply (case_tac \"poolptr = pool_ptr\")\n apply (clarsimp simp: vs_refs_aux_def graph_of_def obj_at_def split: if_splits)\n apply (clarsimp simp: pool_for_asid_def asid_pools_of_ko_at valid_asid_table_def inj_on_def)\n apply (drule_tac x=\"asid_high_bits_of asid\" in bspec, clarsimp)\n apply (drule_tac x=\"asid_high_bits_of asida\" in bspec, clarsimp)\n apply clarsimp\n apply (drule asid_high_low)\n apply (simp add: asid_low_bits_of_mask_eq[symmetric])\n apply (prop_tac \"is_up UCAST(9 \\ 16) \\ is_up UCAST(9 \\ 64)\")\n apply (clarsimp simp: is_up_def source_size_def target_size_def word_size)\n apply (clarsimp simp: ucast_ucast_b)\n apply (metis ucast_up_ucast_id)\n apply (fastforce simp: aag_wellformed_refl)\n apply (erule subsetD[where A=\"state_asids_to_policy_aux _ _ _ _\"])\n apply (rule sata_asid_lookup, fastforce)\n apply (frule pool_for_asid_vs_lookupD)\n apply (erule_tac vref=0 in state_vrefsD)\n apply (simp add: asid_pools_of_ko_at aobjs_of_ako_at_Some)\n apply simp\n apply (fastforce simp: vs_refs_aux_def graph_of_def)\n apply (case_tac \"poolptr = pt_base\")\n apply (clarsimp simp: vs_refs_aux_def pts_of_Some)\n apply (erule subsetD[where A=\"state_asids_to_policy_aux _ _ _ _\"])\n apply (fastforce simp: sata_asid_lookup)\n apply (erule subsetD[where A=\"state_asids_to_policy_aux _ _ _ _\"])\n apply (fastforce simp: sata_asidpool)\n done\n\n\nlemma copy_global_mappings_vs_lookup_table_noteq:\n \"\\\\s. vs_lookup_table level asid vref s \\ Some (level, pt_ptr) \\ invs s \\\n is_aligned pt_ptr pt_bits \\ vref \\ user_region \\ (\\level. \\ \\\\ (level, pt_ptr) s)\\\n copy_global_mappings pt_ptr\n \\\\_ s. vs_lookup_table level asid vref s \\ Some (level, pt_ptr)\\\"\n unfolding copy_global_mappings_def\n apply clarsimp\n apply wp\n apply (rule_tac Q=\"\\_. pspace_aligned and valid_vspace_objs and valid_asid_table and\n unique_table_refs and valid_vs_lookup and valid_objs and\n (\\s. vs_lookup_table level asid vref s \\ Some (level, pt_ptr) \\\n vref \\ user_region \\ is_aligned pt_ptr pt_bits \\\n (\\level. \\ \\\\ (level, table_base pt_ptr) s))\"\n in hoare_strengthen_post[rotated], clarsimp)\n apply (wpsimp wp: mapM_x_wp' store_pte_valid_vspace_objs store_pte_vs_lookup_table_unreachable\n store_pte_valid_vs_lookup_unreachable hoare_vcg_all_lift hoare_vcg_imp_lift')\n apply (metis valid_objs_caps ptes_of_wellformed_pte mask_2pm1 table_base_plus)\n apply wpsimp\n apply fastforce\n done\n\nlemma perform_asid_pool_invocation_pas_refined [wp]:\n \"\\pas_refined aag and invs and valid_apinv api and K (authorised_asid_pool_inv aag api)\\\n perform_asid_pool_invocation api\n \\\\_. pas_refined aag\\\"\n apply (simp add: perform_asid_pool_invocation_def)\n apply (strengthen invs_psp_aligned invs_vspace_objs valid_arch_state_asid_table invs_arch_state |\n wpsimp simp: ako_asid_pools_of\n wp: copy_global_mappings_invs copy_global_mappings_pas_refined\n copy_global_mappings_copies copy_global_mappings_vs_lookup_table_noteq\n store_asid_pool_entry_pas_refined set_cap_pas_refined get_cap_wp\n arch_update_cap_invs_map hoare_vcg_all_lift hoare_vcg_imp_lift')+\n apply (clarsimp simp: cte_wp_at_caps_of_state valid_apinv_def cong: conj_cong)\n apply (clarsimp simp: is_PageTableCap_def is_ArchObjectCap_def)\n apply (clarsimp split: option.splits)\n apply (clarsimp simp: authorised_asid_pool_inv_def)\n apply (prop_tac \"(\\x xa xb. vs_lookup_table x xa xb s = Some (x, x41) \\ xb \\ user_region)\")\n apply (frule (1) caps_of_state_valid)\n apply (clarsimp simp: valid_cap_def)\n apply (clarsimp simp: obj_at_def)\n apply (rename_tac asid' pool_ptr a b acap_obj level asid vref pt)\n apply (drule (1) vs_lookup_table_valid_cap; clarsimp)\n apply (frule (1) cap_to_pt_is_pt_cap, simp add: pts_of_Some aobjs_of_Some, fastforce intro: valid_objs_caps)\n apply (drule (1) unique_table_refsD[rotated]; clarsimp)\n apply (clarsimp simp: is_cap_simps)\n apply (clarsimp simp: is_arch_update_def update_map_data_def is_cap_simps cap_master_cap_def asid_bits_of_defs)\n apply (intro conjI)\n apply (fastforce dest: cap_cur_auth_caps_of_state pas_refined_refl\n simp: update_map_data_def aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def\n cap_links_asid_slot_def label_owns_asid_slot_def cap_links_irq_def)\n apply (fastforce dest: caps_of_state_valid\n simp: update_map_data_def valid_cap_def cap_aligned_def wellformed_mapdata_def)\n apply (fastforce dest: caps_of_state_aligned_page_table)\n apply (fastforce dest: unique_table_capsD[rotated])\n apply (fastforce dest: cap_not_in_valid_global_refs)\n apply (fastforce dest: cap_cur_auth_caps_of_state pas_refined_Control\n simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def)\n apply fastforce\n apply (fastforce dest: invs_valid_table_caps simp: valid_table_caps_def)\n done\n\n\ndefinition authorised_arch_inv :: \"'a PAS \\ arch_invocation \\ 's :: state_ext state \\ bool\" where\n \"authorised_arch_inv aag ai s \\ case ai of\n InvokePageTable pti \\ authorised_page_table_inv aag pti\n | InvokePage pgi \\ authorised_page_inv aag pgi s\n | InvokeASIDControl aci \\ authorised_asid_control_inv aag aci\n | InvokeASIDPool api \\ authorised_asid_pool_inv aag api\"\n\nlemma invoke_arch_respects:\n \"\\integrity aag X st and authorised_arch_inv aag ai and\n pas_refined aag and invs and valid_arch_inv ai and is_subject aag \\ cur_thread\\\n arch_perform_invocation ai\n \\\\_. integrity aag X st\\\"\n apply (simp add: arch_perform_invocation_def)\n apply (wpsimp wp: perform_page_table_invocation_respects perform_page_invocation_respects\n perform_asid_control_invocation_respects perform_asid_pool_invocation_respects)\n apply (auto simp: authorised_arch_inv_def valid_arch_inv_def)\n done\n\nlemma invoke_arch_pas_refined:\n \"\\pas_refined aag and pas_cur_domain aag and invs and ct_active\n and valid_arch_inv ai and authorised_arch_inv aag ai\\\n arch_perform_invocation ai\n \\\\_. pas_refined aag\\\"\n apply (simp add: arch_perform_invocation_def valid_arch_inv_def)\n apply (wpsimp wp: perform_page_table_invocation_pas_refined perform_asid_pool_invocation_pas_refined\n perform_page_invocation_pas_refined perform_asid_control_invocation_pas_refined)+\n apply (auto simp: authorised_arch_inv_def)\n done\n\nlemma vspace_for_asid_is_subject:\n \"\\ vspace_for_asid a s = Some xaa; pas_refined aag s; valid_asid_table s; is_subject_asid aag a \\\n \\ is_subject aag xaa\"\n apply (frule vspace_for_asid_vs_lookup)\n apply (clarsimp simp: vspace_for_asid_def)\n apply (frule pool_for_asid_vs_lookupD)\n apply (frule (1) pool_for_asid_validD)\n apply (clarsimp simp: vspace_for_pool_def pool_for_asid_def asid_pools_of_ko_at obj_at_def)\n apply (frule_tac vrefs=\"state_vrefs s\" in sata_asid_lookup)\n apply (rule_tac level=asid_pool_level and asid=a and vref=0 in state_vrefsD)\n by (fastforce simp: aobjs_of_Some vs_refs_aux_def graph_of_def asid_low_bits_of_mask_eq[symmetric]\n ucast_ucast_b is_up_def source_size_def target_size_def word_size pas_refined_def\n dest: aag_wellformed_Control)+\n\nlemma decode_page_table_invocation_authorised:\n \"\\invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot\n and (\\s. \\(cap, slot) \\ set excaps. cte_wp_at ((=) cap) slot s)\n and K (is_PageTableCap cap \\ (\\(cap, slot) \\ {(ArchObjectCap cap, slot)} \\ set excaps.\n aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \\\n is_subject aag (fst slot) \\\n (\\v \\ cap_asid' cap. is_subject_asid aag v)))\\\n decode_page_table_invocation label msg slot cap excaps\n \\\\rv. authorised_arch_inv aag rv\\, -\"\n apply (rule hoare_gen_asmE)\n apply (clarsimp simp: is_PageTableCap_def)\n apply (rename_tac x xa)\n apply (unfold decode_page_table_invocation_def decode_pt_inv_map_def authorised_arch_inv_def)\n apply (wpsimp simp: Let_def is_final_cap_def if_fun_split)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (prop_tac \"\\y \\ set [x, x + 2 ^ pte_bits .e. x + 2 ^ pt_bits - 1]. table_base y = x\")\n apply (drule (1) caps_of_state_aligned_page_table)\n apply (clarsimp simp only: is_aligned_neg_mask_eq' add_mask_fold)\n apply (drule subsetD[OF upto_enum_step_subset], clarsimp)\n apply (drule neg_mask_mono_le[where n=pt_bits])\n apply (drule neg_mask_mono_le[where n=pt_bits])\n apply (fastforce dest: plus_mask_AND_NOT_mask_eq)\n apply (intro conjI; clarsimp)\n apply (clarsimp simp: authorised_page_table_inv_def)\n apply (case_tac excaps; clarsimp)\n apply (rule conjI)\n apply (clarsimp simp: pt_lookup_slot_def pt_lookup_slot_from_level_def)\n apply (subst table_base_pt_slot_offset)\n apply (fastforce simp: cte_wp_at_caps_of_state\n dest: caps_of_state_aligned_page_table pt_walk_is_aligned)\n apply (frule vs_lookup_table_vref_independent[OF vspace_for_asid_vs_lookup, simplified])\n apply (erule pt_walk_is_subject[rotated 4]; fastforce intro: vspace_for_asid_is_subject\n simp: user_vtop_canonical_user\n user_region_def)\n apply (clarsimp simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def\n cap_links_asid_slot_def label_owns_asid_slot_def cap_links_irq_def)\n apply (auto simp: caps_of_state_pasObjectAbs_eq authorised_page_table_inv_def\n cap_auth_conferred_def arch_cap_auth_conferred_def)\n done\n\nlemma decode_frame_invocation_authorised:\n \"\\invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot\n and (\\s. \\(cap, slot) \\ set excaps. cte_wp_at ((=) cap) slot s)\n and K (is_FrameCap cap \\ (\\(cap, slot) \\ {(ArchObjectCap cap, slot)} \\ set excaps.\n aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \\\n is_subject aag (fst slot) \\\n (\\v \\ cap_asid' cap. is_subject_asid aag v)))\\\n decode_frame_invocation label msg slot cap excaps\n \\\\rv. authorised_arch_inv aag rv\\,-\"\n unfolding decode_frame_invocation_def authorised_arch_inv_def decode_fr_inv_map_def\n apply (wpsimp wp: check_vp_wpR simp: Let_def authorised_page_inv_def)\n apply (rule conj_imp_strg)\n apply (cases excaps; clarsimp)\n apply (clarsimp simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def\n cap_links_asid_slot_def cap_links_irq_def authorised_slots_def)\n apply (prop_tac \"msg ! 0 \\ user_region\")\n apply (fastforce dest: not_le_imp_less user_vtop_canonical_user\n elim: dual_order.trans is_aligned_no_overflow_mask\n simp: user_region_def vmsz_aligned_def)\n apply (rule conjI)\n apply (frule (1) pt_lookup_slot_vs_lookup_slotI, clarsimp)\n apply (drule (1) vs_lookup_slot_unique_level; clarsimp)\n apply (clarsimp simp: cte_wp_at_caps_of_state make_user_pte_def pte_ref2_def split: if_splits)\n apply (subst (asm) ptrFromPAddr_addr_from_ppn[OF is_aligned_pageBitsForSize_table_size])\n apply (fastforce dest: caps_of_state_valid\n simp: valid_cap_def cap_aligned_def pageBitsForSize_pt_bits_left)\n apply (fastforce simp: vspace_cap_rights_to_auth_def mask_vm_rights_def validate_vm_rights_def\n vm_kernel_only_def vm_read_only_def\n split: if_splits)\n apply (clarsimp simp: pt_lookup_slot_def pt_lookup_slot_from_level_def)\n apply (subst table_base_pt_slot_offset)\n apply (fastforce simp: cte_wp_at_caps_of_state\n dest: caps_of_state_aligned_page_table pt_walk_is_aligned)\n apply (frule vs_lookup_table_vref_independent[OF vspace_for_asid_vs_lookup, simplified])\n apply (erule pt_walk_is_subject[rotated 4]; fastforce intro: vspace_for_asid_is_subject)\n done\n\nlemma decode_asid_control_invocation_authorised:\n \"\\invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot\n and (\\s. \\(cap, slot) \\ set excaps. cte_wp_at ((=) cap) slot s)\n and K (cap = ASIDControlCap \\ (\\(cap, slot) \\ {(ArchObjectCap cap, slot)} \\ set excaps.\n aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \\\n is_subject aag (fst slot) \\\n (\\v \\ cap_asid' cap. is_subject_asid aag v)))\\\n decode_asid_control_invocation label msg slot cap excaps\n \\authorised_arch_inv aag\\, -\"\n unfolding decode_asid_control_invocation_def authorised_arch_inv_def authorised_asid_control_inv_def\n apply wpsimp\n apply (cases excaps; clarsimp)\n apply (rename_tac excaps_tail)\n apply (case_tac excaps_tail; clarsimp)\n apply (clarsimp simp: aag_cap_auth_def cte_wp_at_caps_of_state)\n apply (drule (1) caps_of_state_valid[where cap=\"UntypedCap _ _ _ _\"])\n apply (fastforce simp: valid_cap_def cap_aligned_def is_cap_simps cap_auth_conferred_def\n dest: pas_refined_Control)\n done\n\nlemma decode_asid_pool_invocation_authorised:\n \"\\invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot\n and (\\s. \\(cap, slot) \\ set excaps. cte_wp_at ((=) cap) slot s)\n and K (is_ASIDPoolCap cap \\ (\\(cap, slot) \\ {(ArchObjectCap cap, slot)} \\ set excaps.\n aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \\\n is_subject aag (fst slot) \\\n (\\v \\ cap_asid' cap. is_subject_asid aag v)))\\\n decode_asid_pool_invocation label msg slot cap excaps\n \\authorised_arch_inv aag\\, -\"\n unfolding decode_asid_pool_invocation_def authorised_arch_inv_def Let_def\n apply wpsimp\n apply (erule swap[where P=\"authorised_asid_pool_inv _ _\"])\n apply (cases excaps; clarsimp)\n apply (clarsimp simp: authorised_asid_pool_inv_def is_ASIDPoolCap_def)\n apply (rule conjI)\n apply (clarsimp simp: pas_refined_def state_objs_to_policy_def auth_graph_map_def)\n apply (drule subsetD)\n apply (fastforce dest!: sbta_caps\n simp: obj_refs_def cte_wp_at_caps_of_state\n cap_auth_conferred_def arch_cap_auth_conferred_def)\n apply (fastforce dest: aag_wellformed_Control)\n apply (erule allE, erule mp)\n apply (fastforce dest: caps_of_state_valid asid_high_bits_of_add_ucast\n simp: cte_wp_at_caps_of_state valid_cap_def)\n done\n\nlemma decode_arch_invocation_authorised:\n \"\\invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot\n and (\\s. \\(cap, slot) \\ set excaps. cte_wp_at ((=) cap) slot s)\n and K (\\(cap, slot) \\ {(ArchObjectCap cap, slot)} \\ set excaps.\n aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \\\n is_subject aag (fst slot) \\\n (\\v \\ cap_asid' cap. is_subject_asid aag v))\\\n arch_decode_invocation label msg x_slot slot cap excaps\n \\authorised_arch_inv aag\\, -\"\n unfolding arch_decode_invocation_def\n apply (wpsimp wp: decode_page_table_invocation_authorised decode_asid_pool_invocation_authorised\n decode_asid_control_invocation_authorised decode_frame_invocation_authorised)\n apply auto\n done\n\nlemma authorised_arch_inv_sa_update:\n \"authorised_arch_inv aag i (scheduler_action_update (\\_. act) s) =\n authorised_arch_inv aag i s\"\n by (clarsimp simp: authorised_arch_inv_def authorised_page_inv_def authorised_slots_def\n split: arch_invocation.splits page_invocation.splits)\n\nlemma set_thread_state_authorised_arch_inv[wp]:\n \"set_thread_state ref ts \\authorised_arch_inv aag i\\\"\n unfolding set_thread_state_def\n apply (wpsimp wp: dxo_wp_weak)\n apply (clarsimp simp: authorised_arch_inv_def authorised_page_inv_def authorised_slots_def\n split: arch_invocation.splits page_invocation.splits)\n apply (wpsimp wp: set_object_wp)+\n apply (clarsimp simp: authorised_arch_inv_def authorised_page_inv_def\n authorised_slots_def vs_lookup_slot_def obind_def\n split: arch_invocation.splits page_invocation.splits if_splits option.splits)\n apply (clarsimp simp: vs_lookup_table_def obind_def vspace_for_pool_def\n split: option.splits if_splits)\n apply (subgoal_tac \"(\\p. pte_of p ((pts_of s)(ref := None))) = ptes_of s\")\n apply fastforce\n apply (fastforce simp: pte_of_def obind_def pts_of_Some aobjs_of_Some get_tcb_def\n split: option.splits)\n done\n\nend\n\n\ncontext begin interpretation Arch .\n\nrequalify_facts\n invoke_arch_pas_refined\n invoke_arch_respects\n decode_arch_invocation_authorised\n authorised_arch_inv_sa_update\n set_thread_state_authorised_arch_inv\n\nrequalify_consts\n authorised_arch_inv\n\nend\n\ndeclare authorised_arch_inv_sa_update[simp]\ndeclare set_thread_state_authorised_arch_inv[wp]\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/access-control/RISCV64/ArchArch_AC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.3276682942552091, "lm_q1q2_score": 0.19047459215670334}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__2_on_rules imports n_german_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__2 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.36658972248186006, "lm_q1q2_score": 0.19045117723782684}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__3_on_rules imports n_german_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__3 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__3) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.19037457915378642}} {"text": "theory flash72Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_FAck ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_FAck )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_InvVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Inv iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1VsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_InvAck_1 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_1_HomeVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_InvAck_1_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_InvAck_2VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_InvAck_2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_GetXVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak2VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_Nak3VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX2VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX2 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX3VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX3 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX4VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX4 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX5VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX5 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX6VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX6 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_GetX_PutX7VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX7 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX8 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX8_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX9 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX10 N iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 a2 a3 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX10_home N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_GetX_PutX11 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_GetVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak2VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Nak2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Nak3VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Nak3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Put1 N iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put2VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Put2 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_Get_Put3VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Get_Put3 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Local_PutVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_Local_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_Local_PutXAcksDone ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_NakVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Nak iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Nak_ClearVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_Nak_Clear ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''NakcMsg_Cmd'') ) ( Const NAKC_Nakc )) ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Nak_HomeVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_Nak_Home ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_GetX_Nak iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_Nak_HomeVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_GetX_Nak_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_GetX_PutX iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_GetX_PutX_HomeVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_GetX_PutX_Home iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_Get_Nak1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_Get_Nak2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_Get_Put1VsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_Get_Put1 iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n \n have \"?P1 s\"\n \n apply(cut_tac a1 , auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv72: \n (*Rule2VsPInv0*)\n assumes a1:\"iRule1 \\ N\" and a2:\"iRule2 \\ N\" and a3:\"iRule1~=iRule2 \" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_Get_Put2 iRule1 iRule2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1 a2 a3,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_Put iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_Remote_PutXVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ReplaceHomeVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (NI_ReplaceHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceHomeShrVldVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (NI_ReplaceHomeShrVld ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma NI_ReplaceShrVldVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (NI_ReplaceShrVld iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma NI_ShWbVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (NI_ShWb N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P3 s\"\n\n \n apply( simp)\n\n apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) ) ( Const UNI_Get )) ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') ) ( Const SHWB_ShWb )) ) ) \" in exI,auto)\n \n \n done\n\n \n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma NI_WbVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (NI_Wb ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_GetX1VsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_GetX1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_GetX2 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_PutX1 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_PutX2 N ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_PutX3 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_GetX_PutX4VsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (PI_Local_GetX_PutX4 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_Get_GetVsInv72: \n (*Rule0VsPInv0*)\n shows \"invHoldForRule' s (inv72 ) (PI_Local_Get_Get ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof -\n\n \n have \"?P1 s\"\n \n apply( auto)\n\n \n done\n\n then show \"?P1 s\\ ?P2 s\\ ?P3 s\"\n\n by blast\n\n \n\n\n qed\nlemma PI_Local_Get_PutVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (PI_Local_Get_Put ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_PutXVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (PI_Local_PutX ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Local_ReplaceVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (PI_Local_Replace ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n lemma PI_Remote_GetVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (PI_Remote_Get iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_GetXVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (PI_Remote_GetX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_PutXVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (PI_Remote_PutX iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma PI_Remote_ReplaceVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (PI_Remote_Replace iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreVsInv72: \n (*Rule1VsPInv0*)\n assumes a1:\"iRule1 \\ N\" \n\n shows \"invHoldForRule' s (inv72 ) (Store iRule1 ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n proof - \n \n\n have \"?P2 s\" \n\n by (cut_tac a1,auto )\n then show \"?P1 s\\?P2 s\\?P3 s\"\n by auto\n qed\n lemma StoreHomeVsInv72: \n (*Rule0VsPInv0*)\n \n shows \"invHoldForRule' s (inv72 ) (StoreHome ) (invariants N)\" (is \" ?P1 s\\?P2 s\\?P3 s\") \n\n \n by( auto)\n \n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash72Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.1902450726330614}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n\n Based on the Jinja theory Common/WellForm.thy by Tobias Nipkow \n*)\n\n\nheader {* \\isaheader{Generic Well-formedness of programs} *}\n\ntheory WellForm\nimports SystemClasses TypeRel WellType\nbegin\n\n\ntext {*\\noindent This theory defines global well-formedness conditions\nfor programs but does not look inside method bodies. Well-typing of \nexpressions is defined elsewhere (in theory @{text WellType}). \n\nCoreC++ allows covariant return types *}\n\n\ntype_synonym wf_mdecl_test = \"prog \\ cname \\ mdecl \\ bool\"\n\ndefinition wf_fdecl :: \"prog \\ fdecl \\ bool\" where\n \"wf_fdecl P \\ \\(F,T). is_type P T\"\n\ndefinition wf_mdecl :: \"wf_mdecl_test \\ wf_mdecl_test\" where\n \"wf_mdecl wf_md P C \\ \\(M,Ts,T,mb).\n (\\T\\set Ts. is_type P T) \\ is_type P T \\ T \\ NT \\ wf_md P C (M,Ts,T,mb)\"\n\ndefinition wf_cdecl :: \"wf_mdecl_test \\ prog \\ cdecl \\ bool\" where\n \"wf_cdecl wf_md P \\ \\(C,(Bs,fs,ms)).\n (\\M mthd Cs. P \\ C has M = mthd via Cs \\ \n (\\mthd' Cs'. P \\ (C,Cs) has overrider M = mthd' via Cs')) \\ \n (\\f\\set fs. wf_fdecl P f) \\ distinct_fst fs \\\n (\\m\\set ms. wf_mdecl wf_md P C m) \\ distinct_fst ms \\\n (\\D \\ baseClasses Bs.\n is_class P D \\ \\ P \\ D \\\\<^sup>* C \\\n (\\(M,Ts,T,m)\\set ms.\n \\Ts' T' m' Cs. P \\ D has M = (Ts',T',m') via Cs \\\n Ts' = Ts \\ P \\ T \\ T'))\"\n\ndefinition wf_syscls :: \"prog \\ bool\" where\n \"wf_syscls P \\ sys_xcpts \\ set(map fst P)\"\n\ndefinition wf_prog :: \"wf_mdecl_test \\ prog \\ bool\" where\n \"wf_prog wf_md P \\ wf_syscls P \\ distinct_fst P \\ \n (\\c \\ set P. wf_cdecl wf_md P c)\"\n\n\n\nsection{* Well-formedness lemmas *}\n\nlemma class_wf: \n \"\\class P C = Some c; wf_prog wf_md P\\ \\ wf_cdecl wf_md P (C,c)\"\n\napply (unfold wf_prog_def class_def)\napply (fast dest: map_of_SomeD)\ndone\n\n\n\nlemma is_class_xcpt:\n \"\\ C \\ sys_xcpts; wf_prog wf_md P \\ \\ is_class P C\"\n\n apply (simp add: wf_prog_def wf_syscls_def is_class_def class_def)\n apply (fastforce intro!: map_of_SomeI)\n done\n\n\n\nlemma is_type_pTs:\nassumes \"wf_prog wf_md P\" and \"(C,S,fs,ms) \\ set P\" and \"(M,Ts,T,m) \\ set ms\"\nshows \"set Ts \\ types P\"\nproof\n from assms have \"wf_mdecl wf_md P C (M,Ts,T,m)\"\n by (unfold wf_prog_def wf_cdecl_def) auto\n hence \"\\t \\ set Ts. is_type P t\" by (unfold wf_mdecl_def) auto\n moreover fix t assume \"t \\ set Ts\"\n ultimately have \"is_type P t\" by blast\n thus \"t \\ types P\" ..\nqed\n\n\n\nsection{* Well-formedness subclass lemmas *}\n\nlemma subcls1_wfD:\n \"\\ P \\ C \\\\<^sup>1 D; wf_prog wf_md P \\ \\ D \\ C \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n\napply( frule r_into_trancl)\napply( drule subcls1D)\napply(clarify)\napply( drule (1) class_wf)\napply( unfold wf_cdecl_def baseClasses_def)\napply(force simp add: reflcl_trancl [THEN sym] simp del: reflcl_trancl)\ndone\n\n\n\nlemma wf_cdecl_supD: \n \"\\wf_cdecl wf_md P (C,Bs,r); D \\ baseClasses Bs\\ \\ is_class P D\"\nby (auto simp: wf_cdecl_def baseClasses_def)\n\n\nlemma subcls_asym:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ (D,C) \\ (subcls1 P)\\<^sup>+\"\n\napply(erule trancl.cases)\napply(fast dest!: subcls1_wfD )\napply(fast dest!: subcls1_wfD intro: trancl_trans)\ndone\n\n\n\nlemma subcls_irrefl:\n \"\\ wf_prog wf_md P; (C,D) \\ (subcls1 P)\\<^sup>+ \\ \\ C \\ D\"\n\napply (erule trancl_trans_induct)\napply (auto dest: subcls1_wfD subcls_asym)\ndone\n\n\n\nlemma subcls_asym2:\n \"\\ (C,D) \\ (subcls1 P)\\<^sup>*; wf_prog wf_md P; (D,C) \\ (subcls1 P)\\<^sup>* \\ \\ C = D\"\n\napply (induct rule:rtrancl.induct)\napply simp\napply (drule rtrancl_into_trancl1)\napply simp\napply (drule subcls_asym)\napply simp\napply(drule rtranclD)\napply simp\ndone\n\n\n\nlemma acyclic_subcls1:\n \"wf_prog wf_md P \\ acyclic (subcls1 P)\"\n\napply (unfold acyclic_def)\napply (fast dest: subcls_irrefl)\ndone\n\n\n\nlemma wf_subcls1:\n \"wf_prog wf_md P \\ wf ((subcls1 P)\\)\"\n\napply (rule finite_acyclic_wf_converse)\napply (rule finite_subcls1)\napply (erule acyclic_subcls1)\ndone\n\n\n\nlemma subcls_induct: \n \"\\ wf_prog wf_md P; \\C. \\D. (C,D) \\ (subcls1 P)\\<^sup>+ \\ Q D \\ Q C \\ \\ Q C\"\n\n (is \"?A \\ PROP ?P \\ _\")\n\nproof -\n assume p: \"PROP ?P\"\n assume ?A thus ?thesis apply -\napply(drule wf_subcls1)\napply(drule wf_trancl)\napply(simp only: trancl_converse)\napply(erule_tac a = C in wf_induct)\napply(rule p)\napply(auto)\ndone\nqed\n\n\n\n\nsection{* Well-formedness leq\\_path lemmas *}\n\nlemma last_leq_path:\nassumes leq:\"P,C \\ Cs \\\\<^sup>1 Ds\" and wf:\"wf_prog wf_md P\"\nshows \"P \\ last Cs \\\\<^sup>1 last Ds\"\n\nusing leq\nproof (induct rule:leq_path1.induct)\n fix Cs Ds assume suboCs:\"Subobjs P C Cs\" and suboDs:\"Subobjs P C Ds\"\n and butlast:\"Cs = butlast Ds\"\n from suboDs have notempty:\"Ds \\ []\" by -(drule Subobjs_nonempty)\n with butlast have DsCs:\"Ds = Cs @ [last Ds]\" by simp\n from suboCs have notempty:\"Cs \\ []\" by -(drule Subobjs_nonempty)\n with DsCs have \"Ds = ((butlast Cs) @ [last Cs]) @ [last Ds]\" by simp\n with suboDs have \"Subobjs P C ((butlast Cs) @ [last Cs,last Ds])\"\n by simp\n thus \"P \\ last Cs \\\\<^sup>1 last Ds\" by (fastforce intro:subclsR_subcls1 Subobjs_subclsR)\nnext\n fix Cs D assume \"P \\ last Cs \\\\<^sub>S D\"\n thus \"P \\ last Cs \\\\<^sup>1 last [D]\" by (fastforce intro:subclsS_subcls1)\nqed\n\n\n\nlemma last_leq_paths:\nassumes leq:\"(Cs,Ds) \\ (leq_path1 P C)\\<^sup>+\" and wf:\"wf_prog wf_md P\"\nshows \"(last Cs,last Ds) \\ (subcls1 P)\\<^sup>+\"\n\nusing leq\nproof (induct rule:trancl.induct)\n fix Cs Ds assume \"P,C \\ Cs \\\\<^sup>1 Ds\"\n thus \"(last Cs, last Ds) \\ (subcls1 P)\\<^sup>+\" using wf\n by (fastforce intro:r_into_trancl elim:last_leq_path)\nnext\n fix Cs Cs' Ds assume \"(last Cs, last Cs') \\ (subcls1 P)\\<^sup>+\"\n and \"P,C \\ Cs' \\\\<^sup>1 Ds\"\n thus \"(last Cs, last Ds) \\ (subcls1 P)\\<^sup>+\" using wf\n by (fastforce dest:last_leq_path)\nqed\n\n\n\nlemma leq_path1_wfD:\n\"\\ P,C \\ Cs \\\\<^sup>1 Cs'; wf_prog wf_md P \\ \\ Cs \\ Cs' \\ (Cs',Cs) \\ (leq_path1 P C)\\<^sup>+\"\n\napply (rule conjI)\n apply (erule leq_path1.cases) \n apply simp\n apply (drule_tac Cs=\"Ds\" in Subobjs_nonempty)\n apply (rule butlast_noteq) apply assumption\n apply clarsimp\n apply (drule subclsS_subcls1)\n apply (drule subcls1_wfD) apply simp_all\napply clarsimp\napply (frule last_leq_path)\n apply simp\napply (drule last_leq_paths)\n apply simp\napply (drule_tac r=\"subcls1 P\" in r_into_trancl)\napply (drule subcls_asym) \napply auto\ndone\n\n\n\nlemma leq_path_asym:\n\"\\(Cs,Cs') \\ (leq_path1 P C)\\<^sup>+; wf_prog wf_md P\\ \\ (Cs',Cs) \\ (leq_path1 P C)\\<^sup>+\"\n\napply(erule tranclE)\napply(fast dest!:leq_path1_wfD )\napply(fast dest!:leq_path1_wfD intro: trancl_trans)\ndone\n\n\n\nlemma leq_path_asym2:\"\\P,C \\ Cs \\ Cs'; P,C \\ Cs' \\ Cs; wf_prog wf_md P\\ \\ Cs = Cs'\"\n\napply (induct rule:rtrancl.induct)\n apply simp\napply (drule rtrancl_into_trancl1)\n apply simp\napply (drule leq_path_asym)\n apply simp\napply (drule_tac a=\"c\" and b=\"a\" in rtranclD)\napply simp\ndone\n\n\n\nlemma leq_path_Subobjs:\n\"\\P,C \\ [C] \\ Cs; is_class P C; wf_prog wf_md P\\ \\ Subobjs P C Cs\"\nby (induct rule:rtrancl_induct,auto intro:Subobjs_Base elim!:leq_path1.cases,\n auto dest!:Subobjs_subclass intro!:Subobjs_Sh SubobjsR_Base dest!:subclsSD\n intro:wf_cdecl_supD class_wf ShBaseclass_isBaseclass subclsSI)\n\n\n\n\nsection{* Lemmas concerning Subobjs *}\n\nlemma Subobj_last_isClass:\"\\wf_prog wf_md P; Subobjs P C Cs\\ \\ is_class P (last Cs)\"\n\napply (frule Subobjs_isClass)\napply (drule Subobjs_subclass)\napply (drule rtranclD)\napply (erule disjE)\n apply simp\napply clarsimp\napply (erule trancl_induct)\n apply (fastforce dest:subcls1D class_wf elim:wf_cdecl_supD)\napply (fastforce dest:subcls1D class_wf elim:wf_cdecl_supD)\ndone\n\n\n\nlemma converse_SubobjsR_Rep:\n \"\\Subobjs\\<^sub>R P C Cs; P \\ last Cs \\\\<^sub>R C'; wf_prog wf_md P\\ \n\\ Subobjs\\<^sub>R P C (Cs@[C'])\"\n\napply (induct rule:Subobjs\\<^sub>R.induct)\n apply (frule subclsR_subcls1)\n apply (fastforce dest!:subcls1D class_wf wf_cdecl_supD SubobjsR_Base SubobjsR_Rep)\napply (fastforce elim:SubobjsR_Rep simp: SubobjsR_nonempty split:split_if_asm)\ndone\n\n\n\nlemma converse_Subobjs_Rep:\n \"\\Subobjs P C Cs; P \\ last Cs \\\\<^sub>R C'; wf_prog wf_md P\\ \n\\ Subobjs P C (Cs@[C'])\"\nby (induct rule:Subobjs.induct, fastforce dest:converse_SubobjsR_Rep Subobjs_Rep, \n fastforce dest:converse_SubobjsR_Rep Subobjs_Sh)\n\n\n\n\n\n\n\nlemma isSubobj_Subobjs:\nassumes subo:\"is_subobj P ((C,Cs))\" and wf:\"wf_prog wf_md P\"\nshows \"Subobjs P C Cs\"\n\nusing subo\nproof (induct Cs)\n case Nil\n thus ?case by simp\nnext\n case (Cons C' Cs')\n have subo:\"is_subobj P ((C,C'#Cs'))\" by fact\n obtain Cs'' where Cs'':\"Cs'' = rev Cs'\" by simp\n with subo have \"is_subobj P ((C,C'#rev Cs''))\" by simp\n with wf have \"Subobjs P C (C'#rev Cs'')\" by - (rule isSubobj_Subobjs_rev)\n with Cs'' show ?case by simp\nqed\n\n\n\nlemma isSubobj_eq_Subobjs:\n \"wf_prog wf_md P \\ is_subobj P ((C,Cs)) = (Subobjs P C Cs)\"\nby(auto elim:isSubobj_Subobjs Subobjs_isSubobj)\n\n\n\nlemma subo_trans_subcls:\n assumes subo:\"Subobjs P C (Cs@ C'#rev Cs')\"\n shows \"\\C'' \\ set Cs'. (C',C'') \\ (subcls1 P)\\<^sup>+\"\n\nusing subo\nproof (induct Cs')\n case Nil\n thus ?case by simp\nnext\n case (Cons D Ds)\n have IH:\"Subobjs P C (Cs @ C' # rev Ds) \\\n \\C''\\set Ds. (C', C'') \\ (subcls1 P)\\<^sup>+\"\n and \"Subobjs P C (Cs @ C' # rev (D # Ds))\" by fact+\n hence subo':\"Subobjs P C (Cs@ C'#rev Ds @ [D])\" by simp\n hence \"Subobjs P C (Cs@ C'#rev Ds)\"\n by -(rule appendSubobj,simp_all)\n with IH have set:\"\\C''\\set Ds. (C', C'') \\ (subcls1 P)\\<^sup>+\" by simp\n hence revset:\"\\C''\\set (rev Ds). (C', C'') \\ (subcls1 P)\\<^sup>+\" by simp\n have \"(C',D) \\ (subcls1 P)\\<^sup>+\"\n proof (cases \"Ds = []\")\n case True\n with subo' have \"Subobjs P C (Cs@[C',D])\" by simp\n thus ?thesis\n by (fastforce intro: subclsR_subcls1 Subobjs_subclsR)\n next\n case False\n with revset have hd:\"(C',hd Ds) \\ (subcls1 P)\\<^sup>+\"\n apply -\n apply (erule ballE)\n apply simp\n apply (simp add:in_set_conv_decomp)\n apply (erule_tac x=\"[]\" in allE)\n apply (erule_tac x=\"tl Ds\" in allE)\n apply simp\n done\n from False subo' have \"(hd Ds,D) \\ (subcls1 P)\\<^sup>+\"\n apply (cases Ds)\n apply simp\n apply simp\n apply (rule r_into_trancl)\n apply (rule subclsR_subcls1)\n apply (rule_tac Cs=\"Cs @ C' # rev list\" in Subobjs_subclsR)\n apply simp\n done\n with hd show ?thesis by (rule trancl_trans)\n qed\n with set show ?case by simp\nqed\n\n\n\nlemma unique1:\n assumes subo:\"Subobjs P C (Cs@ C'#Cs')\" and wf:\"wf_prog wf_md P\"\n shows \"C' \\ set Cs'\"\n\nproof -\n obtain Ds where Ds:\"Ds = rev Cs'\" by simp\n with subo have \"Subobjs P C (Cs@ C'#rev Ds)\" by simp\n with Ds subo have \"\\C'' \\ set Cs'. (C',C'') \\ (subcls1 P)\\<^sup>+\"\n by (fastforce dest:subo_trans_subcls)\n with wf have \"\\C'' \\ set Cs'. C' \\ C''\"\n by (auto dest:subcls_irrefl)\n thus ?thesis by fastforce\nqed\n\n\n\nlemma subo_subcls_trans:\n assumes subo:\"Subobjs P C (Cs@ C'#Cs')\"\n shows \"\\C'' \\ set Cs. (C'',C') \\ (subcls1 P)\\<^sup>+\"\n\nproof -\n from wf subo have \"\\C''. C'' \\ set Cs \\ (C'',C') \\ (subcls1 P)\\<^sup>+\"\n apply (auto simp:in_set_conv_decomp)\n apply (case_tac zs)\n apply (fastforce intro: subclsR_subcls1 Subobjs_subclsR)\n apply simp\n apply (rule_tac b=\"a\" in trancl_rtrancl_trancl)\n apply (fastforce intro: subclsR_subcls1 Subobjs_subclsR)\n apply (subgoal_tac \"P \\ a \\\\<^sup>* last (a # list @ [C'])\")\n apply simp\n apply (rule Subobjs_subclass)\n apply (rule_tac C=\"C\" and Cs=\" ys @[C'']\" in Subobjs_Subobjs)\n apply (rule_tac Cs'=\"Cs'\" in appendSubobj)\n apply simp_all\n done\n thus ?thesis by fastforce\nqed\n\n\n\nlemma unique2:\n assumes subo:\"Subobjs P C (Cs@ C'#Cs')\" and wf:\"wf_prog wf_md P\"\n shows \"C' \\ set Cs\"\n\nproof -\n from subo wf have \"\\C'' \\ set Cs. (C'',C') \\ (subcls1 P)\\<^sup>+\"\n by (fastforce dest:subo_subcls_trans)\n with wf have \"\\C'' \\ set Cs. C' \\ C''\"\n by (auto dest:subcls_irrefl)\n thus ?thesis by fastforce\nqed\n\n\n\n\nlemma mdc_hd_path:\nassumes subo:\"Subobjs P C Cs\" and set:\"C \\ set Cs\" and wf:\"wf_prog wf_md P\"\nshows \"C = hd Cs\"\n\nproof -\n from subo set obtain Ds Ds' where Cs:\"Cs = Ds@ C#Ds'\"\n by (auto simp:in_set_conv_decomp)\n then obtain Cs' where Cs':\"Cs' = rev Ds\" by simp\n with Cs subo have subo':\"Subobjs P C ((rev Cs')@ C#Ds')\" by simp\n thus ?thesis\n proof (cases Cs')\n case Nil\n with Cs Cs' show ?thesis by simp\n next\n case (Cons X Xs)\n with subo' have suboX:\"Subobjs P C ((rev Xs)@[X,C]@Ds')\" by simp\n hence leq:\"P \\ X \\\\<^sup>1 C\"\n by (fastforce intro:subclsR_subcls1 Subobjs_subclsR)\n from suboX wf have \"P \\ C \\\\<^sup>* last ((rev Xs)@[X])\"\n by (fastforce intro:Subobjs_subclass appendSubobj)\n with leq have \"(C,C) \\ (subcls1 P)\\<^sup>+\" by simp\n with wf show ?thesis by (fastforce dest:subcls_irrefl)\n qed\nqed\n\n\n\nlemma mdc_eq_last:\n assumes subo:\"Subobjs P C Cs\" and last:\"last Cs = C\" and wf:\"wf_prog wf_md P\"\nshows \"Cs = [C]\"\n\nproof -\n from subo have notempty:\"Cs \\ []\" by - (drule Subobjs_nonempty)\n hence lastset:\"last Cs \\ set Cs\"\n apply (auto simp add:in_set_conv_decomp)\n apply (rule_tac x=\"butlast Cs\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply simp\n done\n with last have C:\"C \\ set Cs\" by simp\n with subo wf have hd:\"C = hd Cs\" by -(rule mdc_hd_path)\n then obtain Cs' where Cs':\"Cs' = tl Cs\" by simp\n thus ?thesis\n proof (cases Cs')\n case Nil\n with hd subo Cs' show ?thesis by (fastforce dest:Subobjs_nonempty hd_Cons_tl)\n next\n case (Cons D Ds)\n with Cs' hd notempty have Cs:\"Cs=C#D#Ds\" by simp\n with subo have \"Subobjs P C (C#D#Ds)\" by simp\n with wf have notset:\"C \\ set (D#Ds)\" by -(rule_tac Cs=\"[]\" in unique1,simp_all)\n from Cs last have \"last Cs = last (D#Ds)\" by simp\n hence \"last Cs \\ set (D#Ds)\"\n apply (auto simp add:in_set_conv_decomp)\n apply (erule_tac x=\"butlast Ds\" in allE)\n apply (erule_tac x=\"[]\" in allE)\n apply simp\n done\n with last have \"C \\ set (D#Ds)\" by simp\n with notset show ?thesis by simp\n qed\nqed\n\n\n\nlemma assumes leq:\"P \\ C \\\\<^sup>* D\" and wf:\"wf_prog wf_md P\"\n shows subcls_leq_path:\"\\Cs. P,C \\ [C] \\ Cs@[D]\"\n\nusing leq\nproof (induct rule:rtrancl.induct)\n fix C show \"\\Cs. P,C \\ [C] \\ Cs@[C]\" by (rule_tac x=\"[]\" in exI,simp)\nnext\n fix C C' D assume leq':\"P \\ C \\\\<^sup>* C'\" and IH:\"\\Cs. P,C \\ [C] \\ Cs@[C']\"\n and sub:\"P \\ C' \\\\<^sup>1 D\"\n from sub have \"is_class P C'\" by (rule subcls1_class)\n with leq' have \"class\": \"is_class P C\" by (rule subcls_is_class)\n from IH obtain Cs where steps:\"P,C \\ [C] \\ Cs@[C']\" by auto\n hence subo:\"Subobjs P C (Cs@[C'])\" using \"class\" wf \n by (fastforce intro:leq_path_Subobjs)\n { assume \"P \\ C' \\\\<^sub>R D\"\n with subo wf have \"Subobjs P C (Cs@[C',D])\"\n by (fastforce dest:converse_Subobjs_Rep)\n with subo have \"P,C \\ (Cs@[C']) \\\\<^sup>1 (Cs@[C']@[D])\"\n by (fastforce intro:leq_path_rep) }\n moreover \n { assume \"P \\ C' \\\\<^sub>S D\"\n with subo have \"P,C \\ (Cs@[C']) \\\\<^sup>1 [D]\" by (rule leq_path_sh) }\n ultimately show \"\\Cs. P,C \\ [C] \\ Cs@[D]\" using sub steps\n apply (auto dest!:subcls1_subclsR_or_subclsS)\n apply (rule_tac x=\"Cs@[C']\" in exI) apply simp\n apply (rule_tac x=\"[]\" in exI) apply simp\n done\nqed\n\n \n\n\n\n\n\n\nlemma subobjs_rel:\nassumes subo:\"Subobjs P C Cs\" and wf:\"wf_prog wf_md P\"\nshows \"P,C \\ [C] \\ Cs\"\n\nproof -\n obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n with subo have \"Subobjs P C (rev Cs')\" by simp\n hence \"P,C \\ [C] \\ rev Cs'\" using wf by (rule subobjs_rel_rev)\n with Cs' show ?thesis by simp\nqed\n\n\n\nlemma assumes wf:\"wf_prog wf_md P\"\n shows leq_path_last:\"\\P,C \\ Cs \\ Cs'; last Cs = last Cs'\\ \\ Cs = Cs'\"\n\nproof(induct rule:rtrancl_induct)\n show \"Cs = Cs\" by simp\nnext\n fix Cs' Cs''\n assume leqs:\"P,C \\ Cs \\ Cs'\" and leq:\"P,C \\ Cs' \\\\<^sup>1 Cs''\"\n and last:\"last Cs = last Cs''\"\n and IH:\"last Cs = last Cs' \\ Cs = Cs'\"\n from leq wf have sup1:\"P \\ last Cs' \\\\<^sup>1 last Cs''\"\n by(rule last_leq_path)\n { assume \"Cs = Cs'\"\n with last have eq:\"last Cs'' = last Cs'\" by simp\n with eq wf sup1 have \"Cs = Cs''\" by(fastforce dest:subcls1_wfD) }\n moreover\n { assume \"(Cs,Cs') \\ (leq_path1 P C)\\<^sup>+\"\n hence sub:\"(last Cs,last Cs') \\ (subcls1 P)\\<^sup>+\" using wf\n by(rule last_leq_paths)\n with sup1 last have \"(last Cs'',last Cs'') \\ (subcls1 P)\\<^sup>+\" by simp\n with wf have \"Cs = Cs''\" by(fastforce dest:subcls_irrefl) }\n ultimately show \"Cs = Cs''\" using leqs\n by(fastforce dest:rtranclD)\nqed\n\n \n\n\nsection{* Well-formedness and appendPath *}\n\n\nlemma appendPath1:\n \"\\Subobjs P C Cs; Subobjs P (last Cs) Ds; last Cs \\ hd Ds\\\n\\ Subobjs P C Ds\"\n\napply(subgoal_tac \"\\ Subobjs\\<^sub>R P (last Cs) Ds\")\n apply (subgoal_tac \"\\C' D. P \\ last Cs \\\\<^sup>* C' \\ P \\ C' \\\\<^sub>S D \\ Subobjs\\<^sub>R P D Ds\")\n apply clarsimp\n apply (drule Subobjs_subclass)\n apply (subgoal_tac \"P \\ C \\\\<^sup>* C'\")\n apply (erule_tac C'=\"C'\" and D=\"D\" in Subobjs_Sh)\n apply simp\n apply simp\n apply fastforce\n apply (erule Subobjs_notSubobjsR)\n apply simp\napply (fastforce dest:hd_SubobjsR)\ndone\n \n\n\n\nlemma appendPath2_rev:\nassumes subo1:\"Subobjs P C Cs\" and subo2:\"Subobjs P (last Cs) (last Cs#rev Ds)\"\n and wf:\"wf_prog wf_md P\"\nshows \"Subobjs P C (Cs@(tl (last Cs#rev Ds)))\"\nusing subo2\nproof (induct Ds)\n case Nil\n with subo1 show ?case by simp\nnext\n case (Cons D' Ds')\n have IH:\"Subobjs P (last Cs) (last Cs#rev Ds')\n \\ Subobjs P C (Cs@tl(last Cs#rev Ds'))\"\n and subo:\"Subobjs P (last Cs) (last Cs#rev (D'#Ds'))\" by fact+\n from subo have \"Subobjs P (last Cs) (last Cs#rev Ds')\"\n by (fastforce intro:butlast_Subobjs)\n with IH have subo':\"Subobjs P C (Cs@tl(last Cs#rev Ds'))\"\n by simp\n have last:\"last(last Cs#rev Ds') = last (Cs@tl(last Cs#rev Ds'))\"\n by (cases Ds')auto\n obtain C' Cs' where C':\"C' = last(last Cs#rev Ds')\" and\n \"Cs' = butlast(last Cs#rev Ds')\" by simp\n hence \"Cs'@[C'] = last Cs#rev Ds'\" by simp\n hence \"last Cs#rev (D'#Ds') = Cs'@[C',D']\" by simp\n with subo have \"Subobjs P (last Cs) (Cs'@[C',D'])\" by (cases Cs') auto\n hence \"P \\ C' \\\\<^sub>R D'\" by - (rule Subobjs_subclsR,simp)\n with C' last have \"P \\ last (Cs@tl(last Cs#rev Ds')) \\\\<^sub>R D'\" by simp\n with subo' wf have \"Subobjs P C ((Cs@tl(last Cs#rev Ds'))@[D'])\"\n by (erule_tac Cs=\"(Cs@tl(last Cs#rev Ds'))\" in converse_Subobjs_Rep) simp\n thus ?case by simp\nqed\n\n\n\nlemma appendPath2:\nassumes subo1:\"Subobjs P C Cs\" and subo2:\"Subobjs P (last Cs) Ds\" \n and eq:\"last Cs = hd Ds\" and wf:\"wf_prog wf_md P\"\nshows \"Subobjs P C (Cs@(tl Ds))\"\n\nusing subo2\nproof (cases Ds)\n case Nil\n with subo1 show ?thesis by simp\nnext\n case (Cons D' Ds')\n with subo2 eq have subo:\"Subobjs P (last Cs) (last Cs#Ds')\" by simp\n obtain Ds'' where Ds'':\"Ds'' = rev Ds'\" by simp\n with subo have \"Subobjs P (last Cs) (last Cs#rev Ds'')\" by simp\n with subo1 wf have \"Subobjs P C (Cs@(tl (last Cs#rev Ds'')))\"\n by -(rule appendPath2_rev)\n with Ds'' eq Cons show ?thesis by simp\nqed\n\n\n\nlemma Subobjs_appendPath:\n \"\\Subobjs P C Cs; Subobjs P (last Cs) Ds;wf_prog wf_md P\\\n\\ Subobjs P C (Cs@\\<^sub>pDs)\"\nby(fastforce elim:appendPath2 appendPath1 simp:appendPath_def)\n\n\nsection{* Path and program size *}\n\nlemma assumes subo:\"Subobjs P C Cs\" and wf:\"wf_prog wf_md P\"\n shows path_contains_classes:\"\\C' \\ set Cs. is_class P C'\"\nusing subo\n\nproof clarsimp\n fix C' assume subo:\"Subobjs P C Cs\" and set:\"C' \\ set Cs\"\n from set obtain Ds Ds' where Cs:\"Cs = Ds@C'#Ds'\"\n by (fastforce simp:in_set_conv_decomp)\n with Cs show \"is_class P C'\"\n proof (cases \"Ds = []\")\n case True\n with Cs subo have subo':\"Subobjs P C (C'#Ds')\" by simp\n thus ?thesis by (rule Subobjs.cases,\n auto dest:hd_SubobjsR intro:SubobjsR_isClass)\n next\n case False\n then obtain C'' Cs'' where Cs'':\"Cs'' = butlast Ds\"\n and last:\"C'' = last Ds\" by auto\n with False have Ds:\"Ds = Cs''@[C'']\" by simp\n with Cs subo have subo':\"Subobjs P C (Cs''@[C'',C']@Ds')\"\n by simp\n hence \"P \\ C'' \\\\<^sub>R C'\" by(fastforce intro:isSubobjs_subclsR Subobjs_isSubobj)\n with wf show ?thesis\n by (fastforce dest!:subclsRD\n intro:wf_cdecl_supD class_wf RepBaseclass_isBaseclass subclsSI)\n qed\nqed\n\n\nlemma path_subset_classes:\"\\Subobjs P C Cs; wf_prog wf_md P\\ \n \\ set Cs \\ {C. is_class P C}\"\nby (auto dest:path_contains_classes)\n\n\nlemma assumes subo:\"Subobjs P C (rev Cs)\" and wf:\"wf_prog wf_md P\"\n shows rev_path_distinct_classes:\"distinct Cs\"\n using subo\nproof (induct Cs)\n case Nil thus ?case by(fastforce dest:Subobjs_nonempty)\nnext\n case (Cons C' Cs')\n have subo':\"Subobjs P C (rev(C'#Cs'))\"\n and IH:\"Subobjs P C (rev Cs') \\ distinct Cs'\" by fact+\n show ?case\n proof (cases \"Cs' = []\")\n case True thus ?thesis by simp\n next\n case False\n hence rev:\"rev Cs' \\ []\" by simp\n from subo' have subo'':\"Subobjs P C (rev Cs'@[C'])\" by simp\n hence \"Subobjs P C (rev Cs')\" using rev wf\n by(fastforce dest:appendSubobj)\n with IH have dist:\"distinct Cs'\" by simp\n from subo'' wf have \"C' \\ set (rev Cs')\"\n by(fastforce dest:unique2)\n with dist show ?thesis by simp\n qed\nqed\n\n\nlemma assumes subo:\"Subobjs P C Cs\" and wf:\"wf_prog wf_md P\"\n shows path_distinct_classes:\"distinct Cs\"\n\nproof -\n obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n with subo have \"Subobjs P C (rev Cs')\" by simp\n with wf have \"distinct Cs'\"\n by -(rule rev_path_distinct_classes)\n with Cs' show ?thesis by simp\nqed\n\n\n\nlemma assumes wf:\"wf_prog wf_md P\" \n shows prog_length:\"length P = card {C. is_class P C}\"\n\nproof -\n from wf have dist_fst:\"distinct_fst P\" by (simp add:wf_prog_def)\n hence \"distinct P\" by (simp add:distinct_fst_def,induct P,auto)\n hence card_set:\"card (set P) = length P\" by (rule distinct_card)\n from dist_fst have set:\"{C. is_class P C} = fst ` (set P)\"\n by (simp add:is_class_def class_def,auto simp:distinct_fst_def,\n auto dest:map_of_eq_Some_iff intro!:image_eqI)\n from dist_fst have \"card(fst ` (set P)) = card (set P)\"\n by(auto intro:card_image simp:distinct_map distinct_fst_def)\n with card_set set show ?thesis by simp\nqed\n\n\n\n\nlemma assumes subo:\"Subobjs P C Cs\" and wf:\"wf_prog wf_md P\"\n shows path_length:\"length Cs \\ length P\"\n\nproof -\n from subo wf have \"distinct Cs\" by (rule path_distinct_classes)\n hence card_eq_length:\"card (set Cs) = length Cs\" by (rule distinct_card)\n from subo wf have \"card (set Cs) \\ card {C. is_class P C}\"\n by (auto dest:path_subset_classes intro:card_mono finite_is_class)\n with card_eq_length have \"length Cs \\ card {C. is_class P C}\" by simp\n with wf show ?thesis by(fastforce dest:prog_length)\nqed\n\n\n\nlemma empty_path_empty_set:\"{Cs. Subobjs P C Cs \\ length Cs \\ 0} = {}\" \nby (auto dest:Subobjs_nonempty)\n\nlemma split_set_path_length:\"{Cs. Subobjs P C Cs \\ length Cs \\ Suc(n)} = \n{Cs. Subobjs P C Cs \\ length Cs \\ n} \\ {Cs. Subobjs P C Cs \\ length Cs = Suc(n)}\"\nby auto\n\nlemma empty_list_set:\"{xs. set xs \\ F \\ xs = []} = {[]}\"\nby auto\n\nlemma suc_n_union_of_union:\"{xs. set xs \\ F \\ length xs = Suc n} = (UN x:F. UN xs : {xs. set xs \\ F \\ length xs = n}. {x#xs})\"\nby (auto simp:length_Suc_conv)\n\nlemma max_length_finite_set:\"finite F \\ finite{xs. set xs <= F \\ length xs = n}\"\nby(induct n,simp add:empty_list_set, simp add:suc_n_union_of_union)\n\nlemma path_length_n_finite_set:\n\"wf_prog wf_md P \\ finite{Cs. Subobjs P C Cs \\ length Cs = n}\"\nby (rule_tac B=\"{Cs. set Cs <= {C. is_class P C} \\ length Cs = n}\" in finite_subset,\n auto dest:path_contains_classes intro:max_length_finite_set simp:finite_is_class)\n\nlemma path_finite_leq:\n\"wf_prog wf_md P \\ finite{Cs. Subobjs P C Cs \\ length Cs \\ length P}\"\n by (induct (\"length P\"), simp only:empty_path_empty_set,\n auto intro:path_length_n_finite_set simp:split_set_path_length)\n\nlemma path_finite:\"wf_prog wf_md P \\ finite{Cs. Subobjs P C Cs}\"\nby (subgoal_tac \"{Cs. Subobjs P C Cs} = \n {Cs. Subobjs P C Cs \\ length Cs \\ length P}\",\n auto intro:path_finite_leq path_length)\n\n\nsection{* Well-formedness and Path *}\n\nlemma path_via_reverse:\n assumes path_via:\"P \\ Path C to D via Cs\" and wf:\"wf_prog wf_md P\"\n shows \"\\Cs'. P \\ Path D to C via Cs' \\ Cs = [C] \\ Cs' = [C] \\ C = D\"\nproof -\n from path_via have subo:\"Subobjs P C Cs\" and last:\"last Cs = D\"\n by(simp add:path_via_def)+\n hence leq:\"P \\ C \\\\<^sup>* D\" by(fastforce dest:Subobjs_subclass)\n { fix Cs' assume \"P \\ Path D to C via Cs'\"\n hence subo':\"Subobjs P D Cs'\" and last':\"last Cs' = C\"\n by(simp add:path_via_def)+\n hence leq':\"P \\ D \\\\<^sup>* C\" by(fastforce dest:Subobjs_subclass)\n with leq wf have CeqD:\"C = D\" by(rule subcls_asym2)\n moreover have Cs:\"Cs = [C]\" using CeqD subo last wf by(fastforce intro:mdc_eq_last)\n moreover have \"Cs' = [C]\" using CeqD subo' last' wf by(fastforce intro:mdc_eq_last)\n ultimately have \"Cs = [C] \\ Cs' = [C] \\ C = D\" by simp }\n thus ?thesis by blast\nqed\n\n\nlemma path_hd_appendPath:\n assumes path:\"P,C \\ Cs \\ Cs'@\\<^sub>pCs\" and last:\"last Cs' = hd Cs\"\n and notemptyCs:\"Cs \\ []\" and notemptyCs':\"Cs' \\ []\" and wf:\"wf_prog wf_md P\"\n shows \"Cs' = [hd Cs]\"\n\nusing path\nproof -\n from path notemptyCs last have path2:\"P,C \\ Cs \\ Cs'@ tl Cs\"\n by (simp add:appendPath_def)\n thus ?thesis\n proof (auto dest!:rtranclD)\n assume \"Cs = Cs'@ tl Cs\"\n with notemptyCs show \"Cs' = [hd Cs]\" by (rule app_hd_tl)\n next\n assume trancl:\"(Cs,Cs'@ tl Cs) \\ (leq_path1 P C)\\<^sup>+\"\n from notemptyCs' last have butlastLast:\"Cs' = butlast Cs' @ [hd Cs]\"\n by -(drule append_butlast_last_id,simp)\n with trancl have trancl':\"(Cs, (butlast Cs' @ [hd Cs]) @ tl Cs) \\ (leq_path1 P C)\\<^sup>+\"\n by simp\n from notemptyCs have \"(butlast Cs' @ [hd Cs]) @ tl Cs = butlast Cs' @ Cs\"\n by simp\n with trancl' have \"(Cs, butlast Cs' @ Cs) \\ (leq_path1 P C)\\<^sup>+\" by simp\n hence \"(last Cs, last (butlast Cs' @ Cs)) \\ (subcls1 P)\\<^sup>+\" using wf\n by (rule last_leq_paths)\n with notemptyCs have \"(last Cs, last Cs) \\ (subcls1 P)\\<^sup>+\"\n by -(drule_tac xs=\"butlast Cs'\" in last_appendR,simp)\n with wf show ?thesis by (auto dest:subcls_irrefl)\n qed\nqed\n\n\nlemma path_via_C: \"\\P \\ Path C to C via Cs; wf_prog wf_md P\\ \\ Cs = [C]\"\nby (fastforce intro:mdc_eq_last simp:path_via_def)\n\n\nlemma assumes wf:\"wf_prog wf_md P\"\n and path_via:\"P \\ Path last Cs to C via Cs'\"\n and path_via':\"P \\ Path last Cs to C via Cs''\"\n and appendPath:\"Cs = Cs@\\<^sub>pCs'\"\nshows appendPath_path_via:\"Cs = Cs@\\<^sub>pCs''\"\n\nproof -\n from path_via have notempty:\"Cs' \\ []\"\n by(fastforce intro!:Subobjs_nonempty simp:path_via_def)\n { assume eq:\"last Cs = hd Cs'\"\n and Cs:\"Cs = Cs@tl Cs'\"\n from Cs have \"tl Cs' = []\" by simp\n with eq notempty have \"Cs' = [last Cs]\"\n by -(drule hd_Cons_tl,simp) }\n moreover\n { assume \"Cs = Cs'\"\n with wf path_via have \"Cs' = [last Cs]\"\n by(fastforce intro:mdc_eq_last simp:path_via_def) }\n ultimately have eq:\"Cs' = [last Cs]\" using appendPath\n by(simp add:appendPath_def,split split_if_asm,simp_all)\n with path_via have \"C = last Cs\"\n by(simp add:path_via_def)\n with wf path_via' have \"Cs'' = [last Cs]\"\n by simp(rule path_via_C)\n thus ?thesis by (simp add:appendPath_def)\nqed\n\n\n\nlemma subo_no_path:\n assumes subo:\"Subobjs P C' (Cs @ C#Cs')\" and wf:\"wf_prog wf_md P\"\n and notempty:\"Cs' \\ []\"\n shows \"\\ P \\ Path last Cs' to C via Ds\"\n\nproof\n assume \"P \\ Path last Cs' to C via Ds\"\n hence subo':\"Subobjs P (last Cs') Ds\" and last:\"last Ds = C\"\n by (auto simp:path_via_def)\n hence notemptyDs:\"Ds \\ []\" by -(drule Subobjs_nonempty)\n then obtain D' Ds' where D'Ds':\"Ds = D'#Ds'\" by(cases Ds)auto\n from subo have suboC:\"Subobjs P C (C#Cs')\" by (rule Subobjs_Subobjs)\n with wf subo' notempty have suboapp:\"Subobjs P C ((C#Cs')@\\<^sub>pDs)\"\n by -(rule Subobjs_appendPath,simp_all)\n with notemptyDs last have last':\"last ((C#Cs')@\\<^sub>pDs) = C\"\n by -(drule_tac Cs'=\"(C#Cs')\" in appendPath_last,simp)\n from notemptyDs have \"(C#Cs')@\\<^sub>pDs \\ []\"\n by (simp add:appendPath_def)\n with last' have \"C \\ set ((C#Cs')@\\<^sub>pDs)\"\n apply (auto simp add:in_set_conv_decomp)\n apply (rule_tac x=\"butlast((C#Cs')@\\<^sub>pDs)\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (drule append_butlast_last_id)\n apply simp\n done\n with suboapp wf have hd:\"C = hd ((C#Cs')@\\<^sub>pDs)\" by -(rule mdc_hd_path)\n thus \"False\"\n proof (cases \"last (C#Cs') = hd Ds\")\n case True\n hence eq:\"(C#Cs')@\\<^sub>pDs = (C#Cs')@(tl Ds)\" by (simp add:appendPath_def)\n show ?thesis\n proof (cases Ds')\n case Nil\n with D'Ds' have Ds:\"Ds = [D']\" by simp\n with last have \"C = D'\" by simp\n with True notempty Ds have \"last (C#Cs') = C\" by simp\n with notempty have \"last Cs' = C\" by simp\n with notempty have Cset:\"C \\ set Cs'\"\n apply (auto simp add:in_set_conv_decomp)\n apply (rule_tac x=\"butlast Cs'\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (drule append_butlast_last_id)\n apply simp\n done\n from subo wf have \"C \\ set Cs'\" by (rule unique1)\n with Cset show ?thesis by simp\n next\n case (Cons X Xs)\n with D'Ds' have tlnotempty:\"tl Ds \\ []\" by simp\n with Cons last D'Ds' have \"last (tl Ds) = C\" by simp\n with tlnotempty have \"C \\ set (tl Ds)\"\n apply (auto simp add:in_set_conv_decomp)\n apply (rule_tac x=\"butlast (tl Ds)\" in exI)\n apply (rule_tac x=\"[]\" in exI)\n apply (drule append_butlast_last_id)\n apply simp\n done\n hence Cset:\"C \\ set (Cs'@(tl Ds))\" by simp\n from suboapp eq wf have \"C \\ set (Cs'@(tl Ds))\"\n by (subgoal_tac \"Subobjs P C (C#(Cs'@(tl Ds)))\",\n rule_tac Cs=\"[]\" in unique1,simp_all)\n with Cset show ?thesis by simp\n qed\n next\n case False\n with notemptyDs have eq:\"(C#Cs')@\\<^sub>pDs = Ds\" by (simp add:appendPath_def)\n with subo' last have lastleq:\"P \\ last Cs' \\\\<^sup>* C\" \n by (fastforce dest:Subobjs_subclass)\n from notempty obtain X Xs where X:\"X = last Cs'\" and \"Xs = butlast Cs'\"\n by auto\n with notempty have XXs:\"Cs' = Xs@[X]\" by simp\n hence CleqX:\"(C,X) \\ (subcls1 P)\\<^sup>+\"\n proof (cases Xs)\n case Nil\n with suboC XXs have \"Subobjs P C [C,X]\" by simp\n thus ?thesis\n apply -\n apply (rule r_into_trancl)\n apply (rule subclsR_subcls1)\n apply (rule_tac Cs=\"[]\" in Subobjs_subclsR)\n apply simp\n done\n next\n case (Cons Y Ys)\n with suboC XXs have subo'':\"Subobjs P C ([C,Y]@Ys@[X])\" by simp\n hence plus:\"(C,Y) \\ (subcls1 P)\\<^sup>+\"\n apply -\n apply (rule r_into_trancl)\n apply (rule subclsR_subcls1)\n apply (rule_tac Cs=\"[]\" in Subobjs_subclsR)\n apply simp\n done\n from subo'' have \"P \\ Y \\\\<^sup>* X\"\n apply -\n apply (subgoal_tac \"Subobjs P C ([C]@Y#(Ys@[X]))\")\n apply (drule Subobjs_Subobjs)\n apply (drule_tac C=\"Y\" in Subobjs_subclass) apply simp_all\n done\n with plus show ?thesis by (fastforce elim:trancl_rtrancl_trancl)\n qed\n from lastleq X have leq:\"P \\ X \\\\<^sup>* C\" by simp\n with CleqX have \"(C,C) \\ (subcls1 P)\\<^sup>+\"\n by (rule trancl_rtrancl_trancl)\n with wf show ?thesis by (fastforce dest:subcls_irrefl)\n qed\nqed\n\n\n\nlemma leq_implies_path:\n assumes leq:\"P \\ C \\\\<^sup>* D\" and \"class\": \"is_class P C\"\n and wf:\"wf_prog wf_md P\"\nshows \"\\Cs. P \\ Path C to D via Cs\"\n\nusing leq \"class\"\nproof(induct rule:rtrancl.induct)\n fix C assume \"is_class P C\"\n thus \"\\Cs. P \\ Path C to C via Cs\"\n by (rule_tac x=\"[C]\" in exI,fastforce intro:Subobjs_Base simp:path_via_def)\nnext\n fix C C' D assume CleqC':\"P \\ C \\\\<^sup>* C'\" and C'leqD:\"P \\ C' \\\\<^sup>1 D\"\n and classC:\"is_class P C\" and IH:\"is_class P C \\ \\Cs. P \\ Path C to C' via Cs\"\n from IH[OF classC] obtain Cs where subo:\"Subobjs P C Cs\" and last:\"last Cs = C'\"\n by (auto simp:path_via_def)\n with C'leqD show \"\\Cs. P \\ Path C to D via Cs\"\n proof (auto dest!:subcls1_subclsR_or_subclsS)\n assume \"P \\ last Cs \\\\<^sub>R D\"\n with subo have \"Subobjs P C (Cs@[D])\" using wf\n by (rule converse_Subobjs_Rep)\n thus ?thesis by (fastforce simp:path_via_def)\n next\n assume subS:\"P \\ last Cs \\\\<^sub>S D\"\n from CleqC' last have Cleqlast:\"P \\ C \\\\<^sup>* last Cs\" by simp\n from subS have classLast:\"is_class P (last Cs)\"\n by (auto intro:subcls1_class subclsS_subcls1)\n then obtain Bs fs ms where \"class P (last Cs) = Some(Bs,fs,ms)\"\n by (fastforce simp:is_class_def)\n hence classD:\"is_class P D\" using subS wf\n by (auto intro:wf_cdecl_supD dest:class_wf dest!:subclsSD \n elim:ShBaseclass_isBaseclass)\n with Cleqlast subS have \"Subobjs P C [D]\"\n by (fastforce intro:Subobjs_Sh SubobjsR_Base)\n thus ?thesis by (fastforce simp:path_via_def)\n qed\nqed\n\n\nlemma least_method_implies_path_unique:\nassumes least:\"P \\ C has least M = (Ts,T,m) via Cs\" and wf:\"wf_prog wf_md P\"\nshows \"P \\ Path C to (last Cs) unique\"\n\nproof (auto simp add:path_unique_def)\n (* Existence *)\n from least have \"Subobjs P C Cs\"\n by (simp add:LeastMethodDef_def MethodDefs_def)\n thus \"\\Cs'. Subobjs P C Cs' \\ last Cs' = last Cs\"\n by fastforce\nnext\n (* Uniqueness *)\n fix Cs' Cs''\n assume suboCs':\"Subobjs P C Cs'\" and suboCs'':\"Subobjs P C Cs''\"\n and lastCs':\"last Cs' = last Cs\" and lastCs'':\"last Cs'' = last Cs\"\n from suboCs' have notemptyCs':\"Cs' \\ []\" by (rule Subobjs_nonempty)\n from suboCs'' have notemptyCs'':\"Cs'' \\ []\" by (rule Subobjs_nonempty)\n from least have suboCs:\"Subobjs P C Cs\"\n and all:\"\\Ds. Subobjs P C Ds \\ \n (\\Ts T m Bs ms. (\\fs. class P (last Ds) = Some (Bs, fs, ms)) \\ \n map_of ms M = Some(Ts,T,m)) \\ P,C \\ Cs \\ Ds\"\n by (auto simp:LeastMethodDef_def MethodDefs_def)\n from least obtain Bs fs ms T Ts m where \n \"class\": \"class P (last Cs) = Some(Bs, fs, ms)\" and map:\"map_of ms M = Some(Ts,T,m)\"\n by (auto simp:LeastMethodDef_def MethodDefs_def intro:that)\n from suboCs' lastCs' \"class\" map all have pathCs':\"P,C \\ Cs \\ Cs'\"\n by simp\n with wf lastCs' have eq:\"Cs = Cs'\" by(fastforce intro:leq_path_last)\n from suboCs'' lastCs'' \"class\" map all have pathCs'':\"P,C \\ Cs \\ Cs''\"\n by simp\n with wf lastCs'' have \"Cs = Cs''\" by(fastforce intro:leq_path_last)\n with eq show \"Cs' = Cs''\" by simp\nqed\n\n\n\nlemma least_field_implies_path_unique:\nassumes least:\"P \\ C has least F:T via Cs\" and wf:\"wf_prog wf_md P\"\nshows \"P \\ Path C to (hd Cs) unique\"\n\nproof (auto simp add:path_unique_def)\n (* Existence *)\n from least have \"Subobjs P C Cs\"\n by (simp add:LeastFieldDecl_def FieldDecls_def)\n hence \"Subobjs P C ([hd Cs]@tl Cs)\"\n by - (frule Subobjs_nonempty,simp)\n with wf have \"Subobjs P C [hd Cs]\"\n by (fastforce intro:appendSubobj)\n thus \"\\Cs'. Subobjs P C Cs' \\ last Cs' = hd Cs\"\n by fastforce\nnext\n (* Uniqueness *)\n fix Cs' Cs''\n assume suboCs':\"Subobjs P C Cs'\" and suboCs'':\"Subobjs P C Cs''\"\n and lastCs':\"last Cs' = hd Cs\" and lastCs'':\"last Cs'' = hd Cs\"\n from suboCs' have notemptyCs':\"Cs' \\ []\" by (rule Subobjs_nonempty)\n from suboCs'' have notemptyCs'':\"Cs'' \\ []\" by (rule Subobjs_nonempty)\n from least have suboCs:\"Subobjs P C Cs\"\n and all:\"\\Ds. Subobjs P C Ds \\ \n (\\T Bs fs. (\\ms. class P (last Ds) = Some (Bs, fs, ms)) \\ \n map_of fs F = Some T) \\ P,C \\ Cs \\ Ds\"\n by (auto simp:LeastFieldDecl_def FieldDecls_def)\n from least obtain Bs fs ms T where \n \"class\": \"class P (last Cs) = Some(Bs, fs, ms)\" and map:\"map_of fs F = Some T\"\n by (auto simp:LeastFieldDecl_def FieldDecls_def)\n from suboCs have notemptyCs:\"Cs \\ []\" by (rule Subobjs_nonempty)\n from suboCs notemptyCs have suboHd:\"Subobjs P (hd Cs) (hd Cs#tl Cs)\"\n by -(rule_tac C=\"C\" and Cs=\"[]\" in Subobjs_Subobjs,simp)\n with suboCs' notemptyCs lastCs' wf have suboCs'App:\"Subobjs P C (Cs'@\\<^sub>pCs)\"\n by -(rule Subobjs_appendPath,simp_all)\n from suboHd suboCs'' notemptyCs lastCs'' wf \n have suboCs''App:\"Subobjs P C (Cs''@\\<^sub>pCs)\"\n by -(rule Subobjs_appendPath,simp_all)\n from suboCs'App all \"class\" map notemptyCs have pathCs':\"P,C \\ Cs \\ Cs'@\\<^sub>pCs\"\n by -(erule_tac x=\"Cs'@\\<^sub>pCs\" in allE,drule_tac Cs'=\"Cs'\" in appendPath_last,simp)\n from suboCs''App all \"class\" map notemptyCs have pathCs'':\"P,C \\ Cs \\ Cs''@\\<^sub>pCs\"\n by -(erule_tac x=\"Cs''@\\<^sub>pCs\" in allE,drule_tac Cs'=\"Cs''\" in appendPath_last,simp)\n from pathCs' lastCs' notemptyCs notemptyCs' wf have Cs':\"Cs' = [hd Cs]\"\n by (rule path_hd_appendPath)\n from pathCs'' lastCs'' notemptyCs notemptyCs'' wf have \"Cs'' = [hd Cs]\"\n by (rule path_hd_appendPath)\n with Cs' show \"Cs' = Cs''\" by simp\nqed\n\n\n\nlemma least_field_implies_path_via_hd: \n\"\\P \\ C has least F:T via Cs; wf_prog wf_md P\\ \n\\ P \\ Path C to (hd Cs) via [hd Cs]\"\n\napply (simp add:LeastFieldDecl_def FieldDecls_def)\napply clarsimp\napply (simp add:path_via_def)\napply (frule Subobjs_nonempty)\napply (rule_tac Cs'=\"tl Cs\" in appendSubobj)\napply auto\ndone\n\n\nlemma path_C_to_C_unique:\n\"\\wf_prog wf_md P; is_class P C\\ \\ P \\ Path C to C unique\"\n\napply (unfold path_unique_def)\napply (rule_tac a=\"[C]\" in ex1I)\napply (auto intro:Subobjs_Base mdc_eq_last)\ndone\n\n\nlemma leqR_SubobjsR:\"\\(C,D) \\ (subclsR P)\\<^sup>*; is_class P C; wf_prog wf_md P\\ \n\\ \\Cs. Subobjs\\<^sub>R P C (Cs@[D])\"\n\napply (induct rule:rtrancl_induct)\n apply (drule SubobjsR_Base)\n apply (rule_tac x=\"[]\" in exI)\n apply simp\napply (auto dest:converse_SubobjsR_Rep)\ndone\n\n\n\nlemma assumes path_unique:\"P \\ Path C to D unique\" and leq:\"P \\ C \\\\<^sup>* C'\"\n and leqR:\"(C',D) \\ (subclsR P)\\<^sup>*\" and wf:\"wf_prog wf_md P\"\n shows \"P \\ Path C to C' unique\"\n\nproof -\n from path_unique have \"is_class P C\"\n by (auto intro:Subobjs_isClass simp:path_unique_def)\n with leq wf obtain Cs where path_via:\"P \\ Path C to C' via Cs\"\n by (auto dest:leq_implies_path)\n with wf have classC':\"is_class P C'\"\n by (fastforce intro:Subobj_last_isClass simp:path_via_def)\n with leqR wf obtain Cs' where subo:\"Subobjs\\<^sub>R P C' Cs'\" and last:\"last Cs' = D\"\n by (auto dest:leqR_SubobjsR)\n hence hd:\"hd Cs' = C'\"\n by (fastforce dest:hd_SubobjsR)\n with path_via subo wf have suboApp:\"Subobjs P C (Cs@tl Cs')\"\n by (auto dest!:Subobjs_Rep dest:Subobjs_appendPath \n simp:path_via_def appendPath_def)\n hence last':\"last (Cs@tl Cs') = D\"\n proof (cases \"tl Cs' = []\")\n case True\n with subo hd last have \"C' = D\"\n by (subgoal_tac \"Cs' = [C']\",auto dest!:SubobjsR_nonempty hd_Cons_tl)\n with path_via have \"last Cs = D\"\n by (auto simp:path_via_def)\n with True show ?thesis by simp\n next\n case False\n from subo have Cs':\"Cs' = hd Cs'#tl Cs'\"\n by (auto dest:SubobjsR_nonempty)\n from False have \"last(hd Cs'#tl Cs') = last (tl Cs')\"\n by (rule last_ConsR)\n with False Cs' last show ?thesis by simp\n qed\n with path_unique suboApp \n have all:\"\\Ds. Subobjs P C Ds \\ last Ds = D \\ Ds = Cs@tl Cs'\"\n by (auto simp add:path_unique_def)\n { fix Cs'' assume path_via2:\"P \\ Path C to C' via Cs''\" and noteq:\"Cs'' \\ Cs\"\n with suboApp have \"last (Cs''@tl Cs') = D\"\n proof (cases \"tl Cs' = []\")\n case True\n with subo hd last have \"C' = D\"\n by (subgoal_tac \"Cs' = [C']\",auto dest!:SubobjsR_nonempty hd_Cons_tl)\n with path_via2 have \"last Cs'' = D\"\n by (auto simp:path_via_def)\n with True show ?thesis by simp\n next\n case False\n from subo have Cs':\"Cs' = hd Cs'#tl Cs'\"\n by (auto dest:SubobjsR_nonempty)\n from False have \"last(hd Cs'#tl Cs') = last (tl Cs')\"\n by (rule last_ConsR)\n with False Cs' last show ?thesis by simp\n qed\n with path_via2 noteq have False using all subo hd wf\n apply (auto simp:path_via_def)\n apply (drule Subobjs_Rep)\n apply (drule Subobjs_appendPath)\n apply (auto simp:appendPath_def)\n done }\n with path_via show ?thesis\n by (auto simp:path_via_def path_unique_def)\nqed\n\n\n\nsection{* Well-formedness and member lookup *}\n\nlemma has_path_has:\n\"\\P \\ Path D to C via Ds; P \\ C has M = (Ts,T,m) via Cs; wf_prog wf_md P\\ \n \\ P \\ D has M = (Ts,T,m) via Ds@\\<^sub>pCs\"\nby (clarsimp simp:HasMethodDef_def MethodDefs_def,frule Subobjs_nonempty,\n drule_tac Cs'=\"Ds\" in appendPath_last,\n fastforce intro:Subobjs_appendPath simp:path_via_def)\n\n\nlemma has_least_wf_mdecl:\n \"\\ wf_prog wf_md P; P \\ C has least M = m via Cs \\ \n\\ wf_mdecl wf_md P (last Cs) (M,m)\"\nby(fastforce dest:visible_methods_exist class_wf map_of_SomeD \n simp:LeastMethodDef_def wf_cdecl_def)\n\n\n\nlemma has_overrider_wf_mdecl:\n \"\\ wf_prog wf_md P; P \\ (C,Cs) has overrider M = m via Cs' \\ \n\\ wf_mdecl wf_md P (last Cs') (M,m)\"\nby(fastforce dest:visible_methods_exist map_of_SomeD class_wf\n simp:FinalOverriderMethodDef_def OverriderMethodDefs_def \n MinimalMethodDefs_def wf_cdecl_def)\n\n\nlemma select_method_wf_mdecl:\n \"\\ wf_prog wf_md P; P \\ (C,Cs) selects M = m via Cs' \\ \n\\ wf_mdecl wf_md P (last Cs') (M,m)\"\nby(fastforce elim:SelectMethodDef.induct \n intro:has_least_wf_mdecl has_overrider_wf_mdecl)\n\n\n\nlemma wf_sees_method_fun:\n\"\\P \\ C has least M = mthd via Cs; P \\ C has least M = mthd' via Cs'; \n wf_prog wf_md P\\\n \\ mthd = mthd' \\ Cs = Cs'\"\n\napply (auto simp:LeastMethodDef_def)\napply (erule_tac x=\"(Cs', mthd')\" in ballE)\napply (erule_tac x=\"(Cs, mthd)\" in ballE)\napply auto\napply (drule leq_path_asym2) apply simp_all\napply (rule sees_methods_fun) apply simp_all\napply (erule_tac x=\"(Cs', mthd')\" in ballE)\napply (erule_tac x=\"(Cs, mthd)\" in ballE)\napply (auto intro:leq_path_asym2)\ndone\n\n\nlemma wf_select_method_fun: \n assumes wf:\"wf_prog wf_md P\"\n shows \"\\P \\ (C,Cs) selects M = mthd via Cs'; P \\ (C,Cs) selects M = mthd' via Cs''\\\n \\ mthd = mthd' \\ Cs' = Cs''\"\nproof(induct rule:SelectMethodDef.induct)\n case (dyn_unique C M mthd Cs' Cs)\n have \"P \\ (C, Cs) selects M = mthd' via Cs''\"\n and \"P \\ C has least M = mthd via Cs'\" by fact+\n thus ?case\n proof(induct rule:SelectMethodDef.induct)\n case (dyn_unique D M' mthd' Ds' Ds)\n have \"P \\ D has least M' = mthd' via Ds'\" \n and \"P \\ D has least M' = mthd via Cs'\" by fact+\n with wf show ?case\n by -(rule wf_sees_method_fun,simp_all)\n next\n case (dyn_ambiguous D M' Ds mthd' Ds')\n have \"\\mthd Cs'. \\ P \\ D has least M' = mthd via Cs'\"\n and \"P \\ D has least M' = mthd via Cs'\" by fact+\n thus ?case by blast\n qed\nnext\n case (dyn_ambiguous C M Cs mthd Cs')\n have \"P \\ (C, Cs) selects M = mthd' via Cs''\"\n and \"P \\ (C, Cs) has overrider M = mthd via Cs'\"\n and \"\\mthd Cs'. \\ P \\ C has least M = mthd via Cs'\" by fact+\n thus ?case\n proof(induct rule:SelectMethodDef.induct)\n case (dyn_unique D M' mthd' Ds' Ds)\n have \"P \\ D has least M' = mthd' via Ds'\"\n and \"\\mthd Cs'. \\ P \\ D has least M' = mthd via Cs'\" by fact+\n thus ?case by blast\n next\n case (dyn_ambiguous D M' Ds mthd' Ds')\n have \"P \\ (D, Ds) has overrider M' = mthd' via Ds'\"\n and \"P \\ (D, Ds) has overrider M' = mthd via Cs'\" by fact+\n thus ?case by(fastforce dest:overrider_method_fun)\n qed\nqed\n\n\n\n\nlemma least_field_is_type:\nassumes field:\"P \\ C has least F:T via Cs\" and wf:\"wf_prog wf_md P\"\nshows \"is_type P T\"\n\nproof -\n from field have \"(Cs,T) \\ FieldDecls P C F\"\n by (simp add:LeastFieldDecl_def)\n from this obtain Bs fs ms \n where \"map_of fs F = Some T\" \n and \"class\": \"class P (last Cs) = Some (Bs,fs,ms)\"\n by (auto simp add:FieldDecls_def)\n hence \"(F,T) \\ set fs\" by (simp add:map_of_SomeD)\n with \"class\" wf show ?thesis\n by(fastforce dest!: class_wf simp: wf_cdecl_def wf_fdecl_def)\nqed \n\n\n\nlemma least_method_is_type:\nassumes method:\"P \\ C has least M = (Ts,T,m) via Cs\" and wf:\"wf_prog wf_md P\"\nshows \"is_type P T\"\n\nproof -\n from method have \"(Cs,Ts,T,m) \\ MethodDefs P C M\"\n by (simp add:LeastMethodDef_def)\n from this obtain Bs fs ms \n where \"map_of ms M = Some(Ts,T,m)\" \n and \"class\": \"class P (last Cs) = Some (Bs,fs,ms)\"\n by (auto simp add:MethodDefs_def)\n hence \"(M,Ts,T,m) \\ set ms\" by (simp add:map_of_SomeD)\n with \"class\" wf show ?thesis\n by(fastforce dest!: class_wf simp: wf_cdecl_def wf_mdecl_def)\nqed \n\n\n\nlemma least_overrider_is_type:\nassumes method:\"P \\ (C,Cs) has overrider M = (Ts,T,m) via Cs'\" \n and wf:\"wf_prog wf_md P\"\nshows \"is_type P T\"\n\nproof -\n from method have \"(Cs',Ts,T,m) \\ MethodDefs P C M\"\n by(clarsimp simp:FinalOverriderMethodDef_def OverriderMethodDefs_def \n MinimalMethodDefs_def)\n from this obtain Bs fs ms \n where \"map_of ms M = Some(Ts,T,m)\" \n and \"class\": \"class P (last Cs') = Some (Bs,fs,ms)\"\n by (auto simp add:MethodDefs_def)\n hence \"(M,Ts,T,m) \\ set ms\" by (simp add:map_of_SomeD)\n with \"class\" wf show ?thesis\n by(fastforce dest!: class_wf simp: wf_cdecl_def wf_mdecl_def)\nqed \n\n\n\nlemma select_method_is_type:\n\"\\ P \\ (C,Cs) selects M = (Ts,T,m) via Cs'; wf_prog wf_md P\\ \\ is_type P T\"\nby(auto elim:SelectMethodDef.cases\n intro:least_method_is_type least_overrider_is_type)\n\n\nlemma base_subtype:\n\"\\wf_cdecl wf_md P (C,Bs,fs,ms); C' \\ baseClasses Bs; \n P \\ C' has M = (Ts',T',m') via Cs@\\<^sub>p[D]; (M,Ts,T,m)\\set ms\\\n \\ Ts' = Ts \\ P \\ T \\ T'\"\n\napply (simp add:wf_cdecl_def)\napply clarsimp\napply (rotate_tac -1)\napply (erule_tac x=\"C'\" in ballE)\n apply clarsimp\n apply (rotate_tac -1)\n apply (erule_tac x=\"(M, Ts, T, m)\" in ballE)\n apply clarsimp\n apply (erule_tac x=\"Ts'\" in allE)\n apply (erule_tac x=\"T'\" in allE)\n apply (auto simp:HasMethodDef_def)\n apply (erule_tac x=\"fst m'\" in allE)\n apply (erule_tac x=\"snd m'\" in allE)\n apply (erule_tac x=\"Cs@\\<^sub>p[D]\" in allE)\n apply simp\napply (erule_tac x=\"fst m'\" in allE)\napply (erule_tac x=\"snd m'\" in allE)\napply (erule_tac x=\"Cs@\\<^sub>p[D]\" in allE)\napply simp\ndone\n\n\n\nlemma subclsPlus_subtype:\n assumes classD:\"class P D = Some(Bs',fs',ms')\" \n and mapMs':\"map_of ms' M = Some(Ts',T',m')\"\n and leq:\"(C,D) \\ (subcls1 P)\\<^sup>+\" and wf:\"wf_prog wf_md P\"\nshows \"\\Bs fs ms Ts T m. class P C = Some(Bs,fs,ms) \\ map_of ms M = Some(Ts,T,m) \n \\ Ts' = Ts \\ P \\ T \\ T'\"\n\nusing leq classD mapMs'\nproof (erule_tac a=\"C\" and b=\"D\" in converse_trancl_induct)\n fix C\n assume CleqD:\"P \\ C \\\\<^sup>1 D\" and classD1:\"class P D = Some(Bs',fs',ms')\"\n { fix Bs fs ms Ts T m\n assume classC:\"class P C = Some(Bs,fs,ms)\" and mapMs:\"map_of ms M = Some(Ts,T,m)\"\n from classD1 mapMs' have hasViaD:\"P \\ D has M = (Ts',T',m') via [D]\"\n by (fastforce intro:Subobjs_Base simp:HasMethodDef_def MethodDefs_def is_class_def)\n from CleqD classC have base:\"D \\ baseClasses Bs\"\n by (fastforce dest:subcls1D)\n from classC wf have cdecl:\"wf_cdecl wf_md P (C,Bs,fs,ms)\"\n by (rule class_wf)\n from classC mapMs have \"(M,Ts,T,m)\\set ms\"\n by -(drule map_of_is_SomeD)\n with cdecl base hasViaD have \"Ts' = Ts \\ P \\ T \\ T'\"\n by -(rule_tac Cs=\"[D]\" in base_subtype,auto simp:appendPath_def) }\n thus \"\\Bs fs ms Ts T m. class P C = Some(Bs, fs, ms) \\ map_of ms M = Some(Ts,T,m) \n \\ Ts' = Ts \\ P \\ T \\ T'\" by blast\nnext\n fix C C'\n assume classD1:\"class P D = Some(Bs',fs',ms')\" and CleqC':\"P \\ C \\\\<^sup>1 C'\"\n and subcls:\"(C',D) \\ (subcls1 P)\\<^sup>+\"\n and IH:\"\\Bs fs ms Ts T m. class P C' = Some(Bs,fs,ms) \\ \n map_of ms M = Some(Ts,T,m) \\ \n Ts' = Ts \\ P \\ T \\ T'\"\n { fix Bs fs ms Ts T m\n assume classC:\"class P C = Some(Bs,fs,ms)\" and mapMs:\"map_of ms M = Some(Ts,T,m)\"\n from classD1 mapMs' have hasViaD:\"P \\ D has M = (Ts',T',m') via [D]\"\n by (fastforce intro:Subobjs_Base simp:HasMethodDef_def MethodDefs_def is_class_def)\n from subcls have C'leqD:\"P \\ C' \\\\<^sup>* D\" by simp\n from classC wf CleqC' have \"is_class P C'\"\n by (fastforce intro:wf_cdecl_supD class_wf dest:subcls1D)\n with C'leqD wf obtain Cs where \"P \\ Path C' to D via Cs\"\n by (auto dest!:leq_implies_path simp:is_class_def)\n hence hasVia:\"P \\ C' has M = (Ts',T',m') via Cs@\\<^sub>p[D]\" using hasViaD wf\n by (rule has_path_has)\n from CleqC' classC have base:\"C' \\ baseClasses Bs\"\n by (fastforce dest:subcls1D)\n from classC wf have cdecl:\"wf_cdecl wf_md P (C,Bs,fs,ms)\"\n by (rule class_wf)\n from classC mapMs have \"(M,Ts,T,m)\\set ms\"\n by -(drule map_of_is_SomeD)\n with cdecl base hasVia have \"Ts' = Ts \\ P \\ T \\ T'\"\n by(rule base_subtype) }\n thus \"\\Bs fs ms Ts T m. class P C = Some(Bs, fs, ms) \\ map_of ms M = Some(Ts,T,m) \n \\ Ts' = Ts \\ P \\ T \\ T'\" by blast\nqed\n\n\n\nlemma leq_method_subtypes:\n assumes leq:\"P \\ D \\\\<^sup>* C\" and least:\"P \\ D has least M = (Ts',T',m') via Ds\"\n and wf:\"wf_prog wf_md P\"\n shows \"\\Ts T m Cs. P \\ C has M = (Ts,T,m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\nusing assms\nproof (induct rule:rtrancl.induct)\n fix C\n assume Cleast:\"P \\ C has least M = (Ts',T',m') via Ds\"\n { fix Ts T m Cs\n assume Chas:\"P \\ C has M = (Ts,T,m) via Cs\"\n with Cleast have path:\"P,C \\ Ds \\ Cs\"\n by (fastforce simp:LeastMethodDef_def HasMethodDef_def)\n { assume \"Ds = Cs\"\n with Cleast Chas have \"Ts = Ts' \\ T' = T\"\n by (auto simp:LeastMethodDef_def HasMethodDef_def MethodDefs_def)\n hence \"Ts = Ts' \\ P \\ T' \\ T\" by auto }\n moreover\n { assume \"(Ds,Cs) \\ (leq_path1 P C)\\<^sup>+\"\n hence subcls:\"(last Ds,last Cs) \\ (subcls1 P)\\<^sup>+\" using wf\n by -(rule last_leq_paths)\n from Chas obtain Bs fs ms where \"class P (last Cs) = Some(Bs,fs,ms)\" \n and \"map_of ms M = Some(Ts,T,m)\"\n by (auto simp:HasMethodDef_def MethodDefs_def)\n hence ex:\"\\Bs' fs' ms' Ts' T' m'. class P (last Ds) = Some(Bs',fs',ms') \\ \n map_of ms' M = Some(Ts',T',m') \\ Ts = Ts' \\ P \\ T' \\ T\"\n using subcls wf\n by -(rule subclsPlus_subtype,auto)\n from Cleast obtain Bs' fs' ms' where \"class P (last Ds) = Some(Bs',fs',ms')\" \n and \"map_of ms' M = Some(Ts',T',m')\"\n by (auto simp:LeastMethodDef_def MethodDefs_def)\n with ex have \"Ts = Ts'\" and \"P \\ T' \\ T\" by auto }\n ultimately have \"Ts = Ts'\" and \"P \\ T' \\ T\" using path\n by (auto dest!:rtranclD) }\n thus \"\\Ts T m Cs. P \\ C has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n by (simp add:HasMethodDef_def MethodDefs_def)\nnext\n fix D C' C\n assume DleqC':\"P \\ D \\\\<^sup>* C'\" and C'leqC:\"P \\ C' \\\\<^sup>1 C\"\n and Dleast:\"P \\ D has least M = (Ts',T',m') via Ds\"\n and IH:\"\\P \\ D has least M = (Ts',T',m') via Ds; wf_prog wf_md P\\\n \\ \\Ts T m Cs. P \\ C' has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n { fix Ts T m Cs\n assume Chas:\"P \\ C has M = (Ts,T,m) via Cs\"\n from Dleast have classD:\"is_class P D\"\n by (auto intro:Subobjs_isClass simp:LeastMethodDef_def MethodDefs_def)\n from DleqC' C'leqC have \"P \\ D \\\\<^sup>* C\" by simp\n then obtain Cs' where \"P \\ Path D to C via Cs'\" using classD wf\n by (auto dest:leq_implies_path)\n hence Dhas:\"P \\ D has M = (Ts,T,m) via Cs'@\\<^sub>pCs\" using Chas wf\n by (fastforce intro:has_path_has)\n with Dleast have path:\"P,D \\ Ds \\ Cs'@\\<^sub>pCs\"\n by (auto simp:LeastMethodDef_def HasMethodDef_def)\n { assume \"Ds = Cs'@\\<^sub>pCs\"\n with Dleast Dhas have \"Ts = Ts' \\ T' = T\"\n by (auto simp:LeastMethodDef_def HasMethodDef_def MethodDefs_def)\n hence \"Ts = Ts' \\ T' = T\" by auto }\n moreover\n { assume \"(Ds,Cs'@\\<^sub>pCs) \\ (leq_path1 P D)\\<^sup>+\"\n hence subcls:\"(last Ds,last (Cs'@\\<^sub>pCs)) \\ (subcls1 P)\\<^sup>+\" using wf\n by -(rule last_leq_paths)\n from Dhas obtain Bs fs ms where \"class P (last (Cs'@\\<^sub>pCs)) = Some(Bs,fs,ms)\" \n and \"map_of ms M = Some(Ts,T,m)\"\n by (auto simp:HasMethodDef_def MethodDefs_def)\n hence ex:\"\\Bs' fs' ms' Ts' T' m'. class P (last Ds) = Some(Bs',fs',ms') \\ \n map_of ms' M = Some(Ts',T',m') \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n using subcls wf\n by -(rule subclsPlus_subtype,auto)\n from Dleast obtain Bs' fs' ms' where \"class P (last Ds) = Some(Bs',fs',ms')\" \n and \"map_of ms' M = Some(Ts',T',m')\"\n by (auto simp:LeastMethodDef_def MethodDefs_def)\n with ex have \"Ts = Ts'\" and \"P \\ T' \\ T\" by auto }\n ultimately have \"Ts = Ts'\" and \"P \\ T' \\ T\" using path\n by (auto dest!:rtranclD) }\n thus \"\\Ts T m Cs. P \\ C has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n by simp\nqed\n\n\n\nlemma leq_methods_subtypes:\n assumes leq:\"P \\ D \\\\<^sup>* C\" and least:\"(Ds,(Ts',T',m')) \\ MinimalMethodDefs P D M\"\n and wf:\"wf_prog wf_md P\"\n shows \"\\Ts T m Cs Cs'. P \\ Path D to C via Cs' \\ P,D \\ Ds \\ Cs'@\\<^sub>pCs \\ Cs \\ [] \\ \n P \\ C has M = (Ts,T,m) via Cs \n \\ Ts = Ts' \\ P \\ T' \\ T\"\nusing assms\nproof (induct rule:rtrancl.induct)\n fix C\n assume Cleast:\"(Ds,(Ts',T',m')) \\ MinimalMethodDefs P C M\"\n { fix Ts T m Cs Cs'\n assume path':\"P \\ Path C to C via Cs'\"\n and leq_path:\"P,C \\ Ds \\ Cs' @\\<^sub>p Cs\" and notempty:\"Cs \\ []\"\n and Chas:\"P \\ C has M = (Ts,T,m) via Cs\"\n from path' wf have Cs':\"Cs' = [C]\" by(rule path_via_C)\n from leq_path Cs' notempty have leq':\"P,C \\ Ds \\ Cs\"\n by(auto simp:appendPath_def split:split_if_asm)\n { assume \"Ds = Cs\"\n with Cleast Chas have \"Ts = Ts' \\ T' = T\"\n by (auto simp:MinimalMethodDefs_def HasMethodDef_def MethodDefs_def)\n hence \"Ts = Ts' \\ P \\ T' \\ T\" by auto }\n moreover\n { assume \"(Ds,Cs) \\ (leq_path1 P C)\\<^sup>+\"\n hence subcls:\"(last Ds,last Cs) \\ (subcls1 P)\\<^sup>+\" using wf\n by -(rule last_leq_paths)\n from Chas obtain Bs fs ms where \"class P (last Cs) = Some(Bs,fs,ms)\" \n and \"map_of ms M = Some(Ts,T,m)\"\n by (auto simp:HasMethodDef_def MethodDefs_def)\n hence ex:\"\\Bs' fs' ms' Ts' T' m'. class P (last Ds) = Some(Bs',fs',ms') \\ \n map_of ms' M = Some(Ts',T',m') \\ Ts = Ts' \\ P \\ T' \\ T\"\n using subcls wf\n by -(rule subclsPlus_subtype,auto)\n from Cleast obtain Bs' fs' ms' where \"class P (last Ds) = Some(Bs',fs',ms')\" \n and \"map_of ms' M = Some(Ts',T',m')\"\n by (auto simp:MinimalMethodDefs_def MethodDefs_def)\n with ex have \"Ts = Ts'\" and \"P \\ T' \\ T\" by auto }\n ultimately have \"Ts = Ts'\" and \"P \\ T' \\ T\" using leq'\n by (auto dest!:rtranclD) }\n thus \"\\Ts T m Cs Cs'. P \\ Path C to C via Cs' \\ P,C \\ Ds \\ Cs' @\\<^sub>p Cs \\ Cs \\ [] \\ \n P \\ C has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\" by blast\nnext\n fix D C' C\n assume DleqC':\"P \\ D \\\\<^sup>* C'\" and C'leqC:\"P \\ C' \\\\<^sup>1 C\"\n and Dleast:\"(Ds, Ts', T', m') \\ MinimalMethodDefs P D M\"\n and IH:\"\\(Ds,Ts',T',m') \\ MinimalMethodDefs P D M; wf_prog wf_md P\\\n \\ \\Ts T m Cs Cs'. P \\ Path D to C' via Cs' \\\n P,D \\ Ds \\ Cs' @\\<^sub>p Cs \\ Cs \\ [] \\ P \\ C' has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n { fix Ts T m Cs Cs'\n assume path:\"P \\ Path D to C via Cs'\"\n and leq_path:\"P,D \\ Ds \\ Cs' @\\<^sub>p Cs\"\n and notempty:\"Cs \\ []\"\n and Chas:\"P \\ C has M = (Ts,T,m) via Cs\"\n from Dleast have classD:\"is_class P D\"\n by (auto intro:Subobjs_isClass simp:MinimalMethodDefs_def MethodDefs_def)\n from path have Dhas:\"P \\ D has M = (Ts,T,m) via Cs'@\\<^sub>pCs\" using Chas wf\n by (fastforce intro:has_path_has)\n { assume \"Ds = Cs'@\\<^sub>pCs\"\n with Dleast Dhas have \"Ts = Ts' \\ T' = T\"\n by (auto simp:MinimalMethodDefs_def HasMethodDef_def MethodDefs_def)\n hence \"Ts = Ts' \\ T' = T\" by auto }\n moreover\n { assume \"(Ds,Cs'@\\<^sub>pCs) \\ (leq_path1 P D)\\<^sup>+\"\n hence subcls:\"(last Ds,last (Cs'@\\<^sub>pCs)) \\ (subcls1 P)\\<^sup>+\" using wf\n by -(rule last_leq_paths)\n from Dhas obtain Bs fs ms where \"class P (last (Cs'@\\<^sub>pCs)) = Some(Bs,fs,ms)\" \n and \"map_of ms M = Some(Ts,T,m)\"\n by (auto simp:HasMethodDef_def MethodDefs_def)\n hence ex:\"\\Bs' fs' ms' Ts' T' m'. class P (last Ds) = Some(Bs',fs',ms') \\ \n map_of ms' M = Some(Ts',T',m') \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n using subcls wf\n by -(rule subclsPlus_subtype,auto)\n from Dleast obtain Bs' fs' ms' where \"class P (last Ds) = Some(Bs',fs',ms')\" \n and \"map_of ms' M = Some(Ts',T',m')\"\n by (auto simp:MinimalMethodDefs_def MethodDefs_def)\n with ex have \"Ts = Ts'\" and \"P \\ T' \\ T\" by auto }\n ultimately have \"Ts = Ts'\" and \"P \\ T' \\ T\" using leq_path\n by (auto dest!:rtranclD) }\n thus \"\\Ts T m Cs Cs'. P \\ Path D to C via Cs' \\ P,D \\ Ds \\ Cs' @\\<^sub>p Cs \\ Cs \\ [] \\ \n P \\ C has M = (Ts, T, m) via Cs \\ \n Ts = Ts' \\ P \\ T' \\ T\"\n by blast\nqed\n\n\nlemma select_least_methods_subtypes: \n assumes select_method:\"P \\ (C,Cs@\\<^sub>pDs) selects M = (Ts,T,pns,body) via Cs'\"\n and least_method:\"P \\ last Cs has least M = (Ts',T',pns',body') via Ds\"\n and path:\"P \\ Path C to (last Cs) via Cs\"\n and wf:\"wf_prog wf_md P\"\n shows \"Ts' = Ts \\ P \\ T \\ T'\"\nusing select_method\nproof -\n from path have sub:\"P \\ C \\\\<^sup>* last Cs\"\n by(fastforce intro:Subobjs_subclass simp:path_via_def)\n from least_method have has:\"P \\ last Cs has M = (Ts',T',pns',body') via Ds\"\n by(rule has_least_method_has_method)\n from select_method show ?thesis\n proof cases\n case dyn_unique\n hence dyn:\"P \\ C has least M = (Ts,T,pns,body) via Cs'\" by simp\n with sub has wf show ?thesis\n by -(drule leq_method_subtypes,assumption,simp,blast)+\n next\n case dyn_ambiguous\n hence overrider:\"P \\ (C,Cs@\\<^sub>pDs) has overrider M = (Ts,T,pns,body) via Cs'\" \n by simp\n from least_method have notempty:\"Ds \\ []\"\n by(auto intro!:Subobjs_nonempty simp:LeastMethodDef_def MethodDefs_def)\n have \"last Cs = hd Ds \\ last (Cs @ tl Ds) = last Ds\"\n proof(cases \"tl Ds = []\")\n case True\n assume last:\"last Cs = hd Ds\"\n with True notempty have \"Ds = [last Cs]\" by (fastforce dest:hd_Cons_tl)\n hence \"last Ds = last Cs\" by simp\n with True show ?thesis by simp\n next\n case False\n assume last:\"last Cs = hd Ds\"\n from notempty False have \"last (tl Ds) = last Ds\"\n by -(drule hd_Cons_tl,drule_tac x=\"hd Ds\" in last_ConsR,simp)\n with False show ?thesis by simp\n qed\n hence eq:\"(Cs @\\<^sub>p Ds) @\\<^sub>p [last Ds] = (Cs @\\<^sub>p Ds)\"\n by(simp add:appendPath_def)\n from least_method wf\n have \"P \\ last Ds has least M = (Ts',T',pns',body') via [last Ds]\"\n by(auto dest:Subobj_last_isClass intro:Subobjs_Base subobjs_rel\n simp:LeastMethodDef_def MethodDefs_def)\n with notempty\n have \"P \\ last (Cs@\\<^sub>pDs) has least M = (Ts',T',pns',body') via [last Ds]\"\n by -(drule_tac Cs'=\"Cs\" in appendPath_last,simp)\n with overrider wf eq have \"(Cs',Ts,T,pns,body) \\ MinimalMethodDefs P C M\"\n and \"P,C \\ Cs' \\ Cs @\\<^sub>p Ds\"\n by -(auto simp:FinalOverriderMethodDef_def OverriderMethodDefs_def,\n drule wf_sees_method_fun,auto)\n with sub wf path notempty has show ?thesis\n by -(drule leq_methods_subtypes,simp_all,blast)+\n qed\nqed\n\n\n\nlemma wf_syscls:\n \"set SystemClasses \\ set P \\ wf_syscls P\"\nby (simp add: image_def SystemClasses_def wf_syscls_def sys_xcpts_def\n NullPointerC_def ClassCastC_def OutOfMemoryC_def,force intro:conjI)\n\n\nsection{* Well formedness and widen *}\n\nlemma Class_widen: \"\\P \\ Class C \\ T; wf_prog wf_md P; is_class P C\\ \n \\ \\D. T = Class D \\ P \\ Path C to D unique\"\n\napply (ind_cases \"P \\ Class C \\ T\")\napply (auto intro:path_C_to_C_unique)\ndone\n\n\nlemma Class_widen_Class [iff]: \"\\wf_prog wf_md P; is_class P C\\ \\ \n (P \\ Class C \\ Class D) = (P \\ Path C to D unique)\"\n\napply (rule iffI)\napply (ind_cases \" P \\ Class C \\ Class D\")\napply (auto elim: widen_subcls intro:path_C_to_C_unique)\ndone\n\n\nlemma widen_Class: \"\\wf_prog wf_md P; is_class P C\\ \\ \n (P \\ T \\ Class C) = \n (T = NT \\ (\\D. T = Class D \\ P \\ Path D to C unique))\"\n\napply(induct T) apply (auto intro:widen_subcls)\napply (ind_cases \"P \\ Class D \\ Class C\" for D) apply (auto intro:path_C_to_C_unique)\ndone\n\n\n\nsection{* Well formedness and well typing *}\n\nlemma assumes wf:\"wf_prog wf_md P\" \nshows WT_determ: \"P,E \\ e :: T \\ (\\T'. P,E \\ e :: T' \\ T = T')\"\nand WTs_determ: \"P,E \\ es [::] Ts \\ (\\Ts'. P,E \\ es [::] Ts' \\ Ts = Ts')\"\n\nproof(induct rule:WT_WTs_inducts)\n case (WTDynCast E e D C)\n have \"P,E \\ Cast C e :: T'\" by fact\n thus ?case by (fastforce elim:WT.cases)\nnext\n case (WTStaticCast E e D C)\n have \"P,E \\ \\C\\e :: T'\" by fact\n thus ?case by (fastforce elim:WT.cases)\nnext\n case (WTBinOp E e\\<^sub>1 T\\<^sub>1 e\\<^sub>2 T\\<^sub>2 bop T)\n have bop:\"case bop of Eq \\ T\\<^sub>1 = T\\<^sub>2 \\ T = Boolean\n | Add \\ T\\<^sub>1 = Integer \\ T\\<^sub>2 = Integer \\ T = Integer\"\n and wt:\"P,E \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 :: T'\" by fact+\n from wt obtain T1' T2' where\n bop':\"case bop of Eq \\ T1' = T2' \\ T' = Boolean\n | Add \\ T1' = Integer \\ T2' = Integer \\ T' = Integer\"\n by auto\n from bop show ?case\n proof (cases bop)\n assume Eq:\"bop = Eq\"\n with bop have \"T = Boolean\" by auto\n with Eq bop' show ?thesis by simp\n next\n assume Add:\"bop = Add\"\n with bop have \"T = Integer\"\n by auto\n with Add bop' show ?thesis by simp\n qed\nnext\n case (WTLAss E V T e T' T'')\n have \"P,E \\ V:=e :: T''\" \n and \"E V = Some T\" by fact+\n thus ?case by auto\nnext\n case (WTFAcc E e C F T Cs)\n have IH:\"\\T'. P,E \\ e :: T' \\ Class C = T'\"\n and least:\"P \\ C has least F:T via Cs\"\n and wt:\"P,E \\ e\\F{Cs} :: T'\" by fact+\n from wt obtain C' where wte':\"P,E \\ e :: Class C'\"\n and least':\"P \\ C' has least F:T' via Cs\" by auto\n from IH[OF wte'] have \"C = C'\" by simp\n with least least' show ?case\n by (fastforce simp:sees_field_fun)\nnext\n case (WTFAss E e\\<^sub>1 C F T Cs e\\<^sub>2 T' T'')\n have least:\"P \\ C has least F:T via Cs\"\n and wt:\"P,E \\ e\\<^sub>1\\F{Cs} := e\\<^sub>2 :: T''\" \n and IH:\"\\S. P,E \\ e\\<^sub>1 :: S \\ Class C = S\" by fact+\n from wt obtain C' where wte':\"P,E \\ e\\<^sub>1 :: Class C'\" \n and least':\"P \\ C' has least F:T'' via Cs\" by auto\n from IH[OF wte'] have \"C = C'\" by simp\n with least least' show ?case\n by (fastforce simp:sees_field_fun)\nnext\n case (WTCall E e C M Ts T pns body Cs es Ts')\n have IH:\"\\T'. P,E \\ e :: T' \\ Class C = T'\"\n and least:\"P \\ C has least M = (Ts, T, pns, body) via Cs\"\n and wt:\"P,E \\ e\\M(es) :: T'\" by fact+\n from wt obtain C' Ts' pns' body' Cs' where wte':\"P,E \\ e :: Class C'\"\n and least':\"P \\ C' has least M = (Ts',T',pns',body') via Cs'\" by auto\n from IH[OF wte'] have \"C = C'\" by simp\n with least least' wf show ?case by (auto dest:wf_sees_method_fun)\nnext\n case (WTStaticCall E e C' C M Ts T pns body Cs es Ts')\n have IH:\"\\T'. P,E \\ e :: T' \\ Class C' = T'\" \n and unique:\"P \\ Path C' to C unique\"\n and least:\"P \\ C has least M = (Ts, T, pns, body) via Cs\"\n and wt:\"P,E \\ e\\(C::)M(es) :: T'\" by fact+\n from wt obtain Ts' pns' body' Cs' \n where \"P \\ C has least M = (Ts',T',pns',body') via Cs'\" by auto\n with least wf show ?case by (auto dest:wf_sees_method_fun)\nnext\n case WTBlock thus ?case by (clarsimp simp del:fun_upd_apply)\nnext\n case (WTSeq E e\\<^sub>1 T\\<^sub>1 e\\<^sub>2 T\\<^sub>2)\n have IH:\"\\T'. P,E \\ e\\<^sub>2 :: T' \\ T\\<^sub>2 = T'\"\n and wt:\"P,E \\ e\\<^sub>1;; e\\<^sub>2 :: T'\" by fact+\n from wt have wt':\"P,E \\ e\\<^sub>2 :: T'\" by auto\n from IH[OF wt'] show ?case .\nnext\n case (WTCond E e e\\<^sub>1 T e\\<^sub>2)\n have IH:\"\\S. P,E \\ e\\<^sub>1 :: S \\ T = S\"\n and wt:\"P,E \\ if (e) e\\<^sub>1 else e\\<^sub>2 :: T'\" by fact+\n from wt have \"P,E \\ e\\<^sub>1 :: T'\" by auto\n from IH[OF this] show ?case .\nnext\n case (WTCons E e T es Ts)\n have IHe:\"\\T'. P,E \\ e :: T' \\ T = T'\"\n and IHes:\"\\Ts'. P,E \\ es [::] Ts' \\ Ts = Ts'\"\n and wt:\"P,E \\ e # es [::] Ts'\" by fact+\n from wt show ?case\n proof (cases Ts')\n case Nil with wt show ?thesis by simp\n next\n case (Cons T'' Ts'')\n with wt have wte':\"P,E \\ e :: T''\" and wtes':\"P,E \\ es [::] Ts''\"\n by auto\n from IHe[OF wte'] IHes[OF wtes'] Cons show ?thesis by simp\n qed\nqed clarsimp+\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.37754066879814546, "lm_q1q2_score": 0.1902450726330614}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | February 2006 |\n | April 2006 (modified) |\n | March 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_sf_ren\nimports FNF_F_sf_induct\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n\ndeclare split_if [split del]\n\n(*****************************************************************\n\n 1. full sequentialization for Renaming (P [[r]])\n 2.\n 3.\n\n *****************************************************************)\n\n(*============================================================*\n | |\n | Renaming P [[r]] |\n | |\n *============================================================*)\n\ndefinition\n Pfun_Renaming :: \"('a * 'a) set => (('p,'a) proc => ('p,'a) proc)\"\n where\n Pfun_Renaming_def :\n \"Pfun_Renaming r == (%P1. P1 [[r]])\"\n \ndefinition\n SP_step_Renaming :: \n \"('a * 'a) set => ('a set => ('a => ('p,'a) proc) =>\n ('p,'a) proc => ('a => ('p,'a) proc) \n => ('p,'a) proc)\"\n where\n SP_step_Renaming_def :\n \"SP_step_Renaming r == (%Y1 Pf1 Q1 SPf.\n (? y:(r `` Y1) -> \n (! :{x : Y1. (x, y) : r} .. SPf) [+] Q1))\"\n\ndefinition\n fsfF_Renaming :: \"('p,'a) proc => ('a * 'a) set => ('p,'a) proc\" \n (\"(1_ /[[_]]seq)\" [84,0] 84)\n where\n fsfF_Renaming_def :\n \"P1 [[r]]seq == (fsfF_induct1 (Pfun_Renaming r)\n (SP_step_Renaming r) P1)\"\n\n(*************************************************************\n function fsfF -> fsfF\n *************************************************************)\n\nlemma fsfF_Renaming_in:\n \"P1 : fsfF_proc ==> P1 [[r]]seq : fsfF_proc\"\napply (simp add: fsfF_Renaming_def)\napply (rule fsfF_induct1_in)\napply (simp_all add: SP_step_Renaming_def)\napply (rule fsfF_proc.intros)\napply (rule ballI)\napply (simp add: Rep_int_choice_ss_def)\napply (rule fsfF_proc.intros)\napply (auto)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Renaming_eqF:\n \"P1 [[r]] =F P1 [[r]]seq\"\napply (simp add: fsfF_Renaming_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct1_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Renaming_def\n SP_step_Renaming_def)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_decompo)\napply (rule cspF_step)\napply (simp add: cspF_SKIP_or_DIV_or_STOP_Renaming_Id)\n\n(* congruence *)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (auto)\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_sf_ren.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3775406687981454, "lm_q1q2_score": 0.19024507263306137}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory PolicyExample\nimports Noninterference\nbegin\n\n(* This first example_auth_graphample shows how notifications and endpoints differ.\n Endpoints tend to spray information in all directions, while\n notifications are unidirectional.\n\n This example is a subset of the SAC example from access *)\ndatatype auth_graph_label = T | NTFN1 | NTFN2 | CTR | C | EP | RM\n\nabbreviation partition_label where\n \"partition_label x \\ OrdinaryLabel x\"\n\ndefinition example_auth_graph :: \"(auth_graph_label subject_label \\ auth \\ auth_graph_label subject_label) set\" where\n \"example_auth_graph \\\n { (partition_label T,Notify,partition_label NTFN1),\n (partition_label CTR,Receive,partition_label NTFN1),\n (partition_label C,Read,partition_label CTR),\n (partition_label C,Write,partition_label CTR),\n (partition_label CTR,Read,partition_label C),\n (partition_label CTR,Write,partition_label C),\n (partition_label CTR,SyncSend,partition_label EP),\n (partition_label T,Notify,partition_label NTFN2),\n (partition_label RM,Receive,partition_label NTFN2),\n (partition_label RM,Receive,partition_label EP)\n } \\ {(a,b,c). a = c}\"\n\ndeclare example_auth_graph_def [simp]\n\nlemma subjectReads_T:\n \"subjectReads example_auth_graph (partition_label T) = {partition_label T}\"\n apply(auto elim: subjectReads.induct)\n done\n\nlemma CTR_in_subjectReads_NTFN1:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule read_sync_ep_read_receivers[where ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma EP_in_subjectReads_NTFN1:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label CTR\" and a=\"partition_label EP\"], auto intro: CTR_in_subjectReads_NTFN1[simplified])\n done\n\nlemma C_in_subjectReads_NTFN1:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_thread_read_pages)\n apply (rule CTR_in_subjectReads_NTFN1)\n apply simp\n done\n\nlemma RM_in_subjectReads_NTFN1:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule read_sync_ep_read_receivers, auto intro: EP_in_subjectReads_NTFN1[simplified])\n done\n\nlemma NTFN2_in_subjectReads_NTFN1:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label NTFN1)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label RM\" and a=\"partition_label NTFN2\"], auto intro: RM_in_subjectReads_NTFN1[simplified])\n done\n\nlemmas subjectReads_NTFN1' = reads_lrefl[of \"partition_label NTFN1\"]\n CTR_in_subjectReads_NTFN1\n EP_in_subjectReads_NTFN1\n RM_in_subjectReads_NTFN1\n C_in_subjectReads_NTFN1\n NTFN2_in_subjectReads_NTFN1\n\nlemma subjectReads_NTFN1:\n \"subjectReads example_auth_graph (partition_label NTFN1) = {partition_label NTFN1, partition_label CTR, partition_label EP, partition_label C, partition_label RM, partition_label NTFN2}\"\n apply(rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (fastforce simp: subjectReads_NTFN1'[simplified])+\n done\n\nlemma RM_in_subjectReads_NTFN2:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule read_sync_ep_read_receivers[where ep=\"partition_label NTFN2\"], auto)\n done\n\nlemma EP_in_subjectReads_NTFN2:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label RM\" and a=\"partition_label EP\"], auto intro: RM_in_subjectReads_NTFN2[simplified])\n done\n\nlemma CTR_in_subjectReads_NTFN2:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule read_sync_ep_read_senders[where ep=\"partition_label EP\" and a=\"partition_label EP\"], auto intro: EP_in_subjectReads_NTFN2[simplified])\n done\n\nlemma C_in_subjectReads_NTFN2:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_thread_read_pages)\n apply (rule CTR_in_subjectReads_NTFN2)\n apply simp\n done\n\n\nlemma NTFN1_in_subjectReads_NTFN2:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label NTFN2)\"\n apply(rule reads_read_queued_thread_read_ep[where t=\"partition_label CTR\" and a=\"partition_label NTFN1\"], auto intro: CTR_in_subjectReads_NTFN2[simplified])\n done\n\nlemmas subjectReads_NTFN2' = reads_lrefl[of \"partition_label NTFN2\"]\n CTR_in_subjectReads_NTFN2\n EP_in_subjectReads_NTFN2\n RM_in_subjectReads_NTFN2\n C_in_subjectReads_NTFN2\n NTFN1_in_subjectReads_NTFN2\n\nlemma subjectReads_NTFN2:\n \"subjectReads example_auth_graph (partition_label NTFN2) = {partition_label NTFN2, partition_label NTFN1, partition_label C, partition_label CTR, partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply (rule subsetI)\n apply (erule subjectReads.induct)\n apply (fastforce simp: subjectReads_NTFN2'[simplified])+\n done\n\n\nlemma EP_in_subjectReads_CTR:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac a=\"partition_label CTR\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply auto\n done\n\nlemma RM_in_subjectReads_CTR:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(clarsimp)\n apply(rule_tac ep=\"partition_label EP\" and auth=\"SyncSend\" in read_sync_ep_read_receivers)\n apply blast\n apply blast\n apply(rule EP_in_subjectReads_CTR[simplified])\n apply fastforce\n done\n\nlemma C_in_subjectReads_CTR:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule reads_read, auto)\n done\n\nlemma NTFN1_in_subjectReads_CTR:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac t=\"partition_label CTR\" and auth=\"Receive\" and a=\"partition_label T\" and auth'=\"Notify\" in reads_read_queued_thread_read_ep)\n apply (auto)\n done\n\nlemma NTFN2_in_subjectReads_CTR:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label CTR)\"\n apply(rule_tac t=\"partition_label RM\" and auth=\"Receive\" and a=\"partition_label T\" and auth'=\"Notify\" in reads_read_queued_thread_read_ep)\n apply (auto intro: RM_in_subjectReads_CTR[simplified])\n done\n\nlemmas subjectReads_CTR' = reads_lrefl[of \"partition_label CTR\"]\n NTFN2_in_subjectReads_CTR NTFN1_in_subjectReads_CTR\n C_in_subjectReads_CTR RM_in_subjectReads_CTR EP_in_subjectReads_CTR\n\nlemma subjectReads_CTR:\n \"subjectReads example_auth_graph (partition_label CTR) = {partition_label CTR,partition_label C,partition_label EP, partition_label RM, partition_label NTFN1, partition_label NTFN2}\"\n apply(clarsimp)\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct; auto)\n apply(auto simp: subjectReads_CTR'[simplified])\n done\n\nlemma NTFN1_in_subjectReads_C:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label T\" and ep=\"partition_label NTFN1\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_read)\n done\n\nlemma EP_in_subjectReads_C:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label CTR\" and t=\"partition_label CTR\" in reads_read_queued_thread_read_ep)\n apply (auto intro: reads_read)\n done\n\nlemma RM_in_subjectReads_C:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label C)\"\n apply(clarsimp)\n apply(rule_tac a=\"partition_label CTR\" in read_sync_ep_read_receivers[OF _ _ EP_in_subjectReads_C[simplified]])\n apply simp+\n done\n\nlemma CTR_in_subjectReads_C:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule reads_read, auto)\n done\n\nlemma NTFN2_in_subjectReads_C:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label C)\"\n apply(rule_tac a=\"partition_label T\" and ep=\"partition_label NTFN2\" and t=\"partition_label RM\" in reads_read_queued_thread_read_ep)\n apply(fastforce simp: RM_in_subjectReads_C[simplified])+\n done\n\nlemmas subjectReads_C' = reads_lrefl[of \"partition_label C\"]\n NTFN2_in_subjectReads_C NTFN1_in_subjectReads_C\n RM_in_subjectReads_C EP_in_subjectReads_C CTR_in_subjectReads_C\n\n\nlemma subjectReads_C:\n \"subjectReads example_auth_graph (partition_label C) = {partition_label C,partition_label CTR,partition_label NTFN1, partition_label EP, partition_label RM, partition_label NTFN2}\"\n apply(clarsimp)\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct; auto)\n apply(auto simp: subjectReads_C'[simplified])\n done\n\n\nlemma CTR_in_subjectReads_EP:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(clarsimp)\n apply(rule_tac a=\"partition_label RM\" and ep=\"partition_label EP\" in read_sync_ep_read_senders)\n apply simp+\n done\n\nlemma NTFN1_in_subjectReads_EP:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label NTFN1\", OF _ _ _ _ CTR_in_subjectReads_EP])\n apply(auto)\n done\n\nlemma C_in_subjectReads_EP:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_thread_read_pages[OF CTR_in_subjectReads_EP])\n apply(auto)\n done\n\nlemma RM_in_subjectReads_EP:\n \"partition_label RM \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule read_sync_ep_read_receivers[OF _ _ reads_lrefl])\n apply(auto)\n done\n\nlemma NTFN2_in_subjectReads_EP:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label EP)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label NTFN2\", OF _ _ _ _ RM_in_subjectReads_EP])\n apply(auto)\n done\n\nlemmas subjectReads_EP' = reads_lrefl[of \"partition_label EP\"]\n CTR_in_subjectReads_EP\n C_in_subjectReads_EP\n RM_in_subjectReads_EP\n NTFN2_in_subjectReads_EP\n NTFN1_in_subjectReads_EP\n\nlemma subjectReads_EP:\n \"subjectReads example_auth_graph (partition_label EP) = {partition_label EP,partition_label CTR,partition_label NTFN1, partition_label C, partition_label RM, partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct; auto)\n apply(auto simp: subjectReads_EP'[simplified])\n done\n\nlemma NTFN2_in_subjectReads_RM:\n \"partition_label NTFN2 \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_ep, auto)\n done\n\nlemma EP_in_subjectReads_RM:\n \"partition_label EP \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_ep, auto)\n done\n\nlemma CTR_in_subjectReads_RM:\n \"partition_label CTR \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule read_sync_ep_read_senders[where a=\"partition_label RM\" and ep=\"partition_label EP\", OF _ _ EP_in_subjectReads_RM], auto)\n done\n\nlemma C_in_subjectReads_RM:\n \"partition_label C \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_read_thread_read_pages[where t=\"partition_label CTR\", OF CTR_in_subjectReads_RM], auto)\n done\n\n\nlemma NTFN1_in_subjectReads_RM:\n \"partition_label NTFN1 \\ subjectReads example_auth_graph (partition_label RM)\"\n apply(rule reads_read_queued_thread_read_ep[where a=\"partition_label T\" and t=\"partition_label CTR\", OF _ _ _ _ CTR_in_subjectReads_RM], auto)\n done\n\nlemmas subjectReads_RM' = reads_lrefl[of \"partition_label RM\"]\n CTR_in_subjectReads_RM\n C_in_subjectReads_RM\n EP_in_subjectReads_RM\n NTFN1_in_subjectReads_RM\n NTFN2_in_subjectReads_RM\n\nlemma subjectReads_RM:\n \"subjectReads example_auth_graph (partition_label RM) = {partition_label RM, partition_label NTFN2,partition_label EP,partition_label CTR, partition_label C, partition_label NTFN1}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct; auto)\n apply(auto simp: subjectReads_RM'[simplified])\n done\n\n\nlemma NTFN1_in_subjectAffects_T:\n \"partition_label NTFN1 \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(auto intro: affects_ep)\n done\n\nlemma NTFN2_in_subjectAffects_T:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(auto intro: affects_ep)\n done\n\nlemma C_in_subjectAffects_T:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma CTR_in_subjectAffects_T:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma RM_in_subjectAffects_T:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label T)\n\" apply(rule affects_send[where auth=\"Notify\" and ep=\"partition_label NTFN2\"], auto)\n done\n\nlemma EP_in_subjectAffects_T:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label T)\"\n by (rule affects_ep_bound_trans, auto)\n\nlemmas subjectAffects_T' = affects_lrefl[of \"partition_label T\"]\n NTFN1_in_subjectAffects_T\n NTFN2_in_subjectAffects_T\n C_in_subjectAffects_T\n CTR_in_subjectAffects_T\n RM_in_subjectAffects_T\n EP_in_subjectAffects_T\n\n\n\nlemma subjectAffects_T:\n \"subjectAffects example_auth_graph (partition_label T) = {partition_label NTFN1,partition_label NTFN2,partition_label T,partition_label C, partition_label CTR, partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; fastforce)\n apply(auto simp: subjectAffects_T'[simplified])\n done\n\nlemma CTR_in_subjectAffects_NTFN1:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label NTFN1)\"\n apply(rule affects_send[where ep=\"partition_label NTFN1\"], auto)\n done\n\nlemma C_in_subjectAffects_NTFN1:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label NTFN1)\"\n apply(rule affects_send[where ep=\"partition_label NTFN1\"], auto)\n done\n\nlemmas subjectAffects_NTFN1' = affects_lrefl[of \"partition_label NTFN1\"]\n C_in_subjectAffects_NTFN1\n CTR_in_subjectAffects_NTFN1\n\n\nlemma subjectAffects_NTFN1:\n \"subjectAffects example_auth_graph (partition_label NTFN1) = {partition_label NTFN1,partition_label CTR,partition_label C}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; fastforce)\n apply(auto simp: subjectAffects_NTFN1'[simplified])\n done\n\nlemma RM_in_subjectAffects_NTFN2:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label NTFN2)\"\n apply(rule affects_send[where ep=\"partition_label NTFN2\"], auto)\n done\n\nlemma EP_in_subjectAffects_NTFN2:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label NTFN2)\"\n apply(rule affects_ep_bound_trans, auto)\n done\n\n\nlemmas subjectAffects_NTFN2' = affects_lrefl[of \"partition_label NTFN2\"]\n RM_in_subjectAffects_NTFN2\n EP_in_subjectAffects_NTFN2\n\n\nlemma subjectAffects_NTFN2:\n \"subjectAffects example_auth_graph (partition_label NTFN2) = {partition_label NTFN2,partition_label RM, partition_label EP}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; fastforce)\n apply(auto simp: subjectAffects_NTFN2'[simplified])\n done\n\nlemma C_in_subjectAffects_CTR:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_write[where auth=\"Write\"], auto)\n done\n\nlemma EP_in_subjectAffects_CTR:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_ep, auto)\n done\n\nlemma NTFN1_in_subjectAffects_CTR:\n \"partition_label NTFN1 \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_ep, auto)\n done\n\nlemma RM_in_subjectAffects_CTR:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label CTR)\"\n apply(rule affects_send, auto)\n done\n\nlemmas subjectAffects_CTR' = affects_lrefl[of \"partition_label CTR\"]\n NTFN1_in_subjectAffects_CTR\n C_in_subjectAffects_CTR\n EP_in_subjectAffects_CTR\n RM_in_subjectAffects_CTR\n\nlemma subjectAffects_CTR:\n \"subjectAffects example_auth_graph (partition_label CTR) = {partition_label CTR,partition_label C,partition_label EP,partition_label NTFN1, partition_label RM}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; auto)\n apply(auto simp: subjectAffects_CTR'[simplified])\n done\n\nlemma CTR_in_subjectAffects_C:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label C)\"\n apply(rule affects_write[where auth=Write], auto)\n done\n\nlemmas subjectAffects_C' = affects_lrefl[of \"partition_label C\"]\n CTR_in_subjectAffects_C\n\n\nlemma subjectAffects_C:\n \"subjectAffects example_auth_graph (partition_label C) = {partition_label C,partition_label CTR}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; auto)\n apply(auto simp: subjectAffects_C'[simplified])\n done\n\nlemma RM_in_subjectAffects_EP:\n \"partition_label RM \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_send, auto)\n done\n\nlemma CTR_in_subjectAffects_EP:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_recv, auto)\n done\n\nlemma C_in_subjectAffects_EP:\n \"partition_label C \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_reset[where ep=\"partition_label EP\" and l'=\"partition_label CTR\"], auto)\n done\n\nlemma NTFN2_in_subjectAffects_EP:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label EP)\"\n apply(rule affects_ep_bound_trans, auto)\n done\n\n\nlemmas subjectAffects_EP' = affects_lrefl[of \"partition_label EP\"]\n CTR_in_subjectAffects_EP\n C_in_subjectAffects_EP\n RM_in_subjectAffects_EP\n NTFN2_in_subjectAffects_EP\n\n\nlemma subjectAffects_EP:\n \"subjectAffects example_auth_graph (partition_label EP) = {partition_label EP, partition_label RM, partition_label CTR, partition_label C, partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; fastforce)\n apply(auto simp: subjectAffects_EP'[simplified])\n done\n\nlemma EP_in_subjectAffects_RM:\n \"partition_label EP \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_ep, auto)\n done\n\nlemma CTR_in_subjectAffects_RM:\n \"partition_label CTR \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_recv, auto)\n done\n\nlemma NTFN2_in_subjectAffects_RM:\n \"partition_label NTFN2 \\ subjectAffects example_auth_graph (partition_label RM)\"\n apply(rule affects_ep, auto)\n done\n\nlemmas subjectAffects_RM' = affects_lrefl[of \"partition_label RM\"]\n EP_in_subjectAffects_RM\n NTFN2_in_subjectAffects_RM\n CTR_in_subjectAffects_RM\n\n\nlemma subjectAffects_RM:\n \"subjectAffects example_auth_graph (partition_label RM) = {partition_label RM,partition_label EP,partition_label CTR,partition_label NTFN2}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.cases; auto)\n apply(auto simp: subjectAffects_RM'[simplified])\n done\n\nlemmas subjectReads = subjectReads_T subjectReads_NTFN1 subjectReads_NTFN2 subjectReads_CTR\n subjectReads_EP subjectReads_RM subjectReads_C\n\ndeclare example_auth_graph_def [simp del]\n\nlemma partsSubjectAffects_T:\n \"partsSubjectAffects example_auth_graph T = {Partition T,Partition NTFN1, Partition NTFN2, Partition CTR, Partition C, Partition EP, Partition RM}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_T | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN1:\n \"partsSubjectAffects example_auth_graph NTFN1 = {Partition NTFN1, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_NTFN1 | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN2:\n \"partsSubjectAffects example_auth_graph NTFN2 = {Partition NTFN2, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_NTFN2 | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_CTR:\n \"partsSubjectAffects example_auth_graph CTR = {Partition NTFN1, Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_CTR | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_C:\n \"partsSubjectAffects example_auth_graph C = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_C | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_EP:\n \"partsSubjectAffects example_auth_graph EP = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN1, Partition NTFN2}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_EP | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_RM:\n \"partsSubjectAffects example_auth_graph RM = {Partition CTR, Partition C, Partition EP, Partition RM, Partition NTFN2, Partition NTFN1}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_RM | rename_tac xa, case_tac xa)+\n done\n\nlemmas partsSubjectAffects = partsSubjectAffects_T partsSubjectAffects_NTFN1\n partsSubjectAffects_NTFN2 partsSubjectAffects_CTR\n partsSubjectAffects_C partsSubjectAffects_RM partsSubjectAffects_EP\n\ndefinition example_policy :: \"(auth_graph_label partition \\ auth_graph_label partition) set\" where\n \"example_policy \\ {(PSched,d)|d. True} \\\n {(Partition l,Partition k)|l k. (k = T \\ l = T)}\"\n\n\nlemma \"example_policy = policyFlows example_auth_graph\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(clarsimp simp: example_policy_def)\n apply(elim disjE)\n apply(fastforce intro: policy_scheduler)\n apply clarsimp\n apply (rule policy_affects)\n apply (case_tac \"k = T\")\n apply (clarsimp simp: partsSubjectAffects)\n apply(case_tac l; (auto simp: partsSubjectAffects | case_tac k)+)\n apply(rule subsetI)\n apply(clarsimp simp: example_policy_def)\n apply(erule policyFlows.cases)\n apply(case_tac l, auto simp: partsSubjectAffects)\n done\n\n\n(* This second example is a classic 'one way information flow'\n example, where information is allowed to flow from Low to High,\n but not the reverse. We consider a typical scenario where\n shared memory and an notification for notifications are used to\n implement a ring-buffer. *)\ndatatype auth_graph_label2 = High | Low | SharedPage | NTFN\n\ndefinition example_auth_graph2 :: \"(auth_graph_label2 subject_label \\ auth \\ auth_graph_label2 subject_label) set\" where\n \"example_auth_graph2 \\\n { (partition_label Low,Write,partition_label SharedPage),\n (partition_label Low,Read,partition_label SharedPage),\n (partition_label High,Read,partition_label SharedPage),\n (partition_label Low,Notify,partition_label NTFN),\n (partition_label High,Receive,partition_label NTFN)\n } \\ {(x,a,y). x = y}\"\n\ndeclare example_auth_graph2_def [simp]\n\nlemma subjectReads_Low: \"subjectReads example_auth_graph2 (partition_label Low) = {partition_label Low,partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: reads_read)\n done\n\nlemma subjectReads_SharedPage: \"subjectReads example_auth_graph2 (partition_label SharedPage) = {partition_label Low,partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: reads_read_page_read_thread)\n done\n\nlemma High_in_subjectReads_NTFN:\n \"partition_label High \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule read_sync_ep_read_receivers)\n apply auto\n done\n\nlemma SharedPage_in_subjectReads_NTFN:\n \"partition_label SharedPage \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule reads_read_thread_read_pages[OF High_in_subjectReads_NTFN])\n apply auto\n done\n\nlemma Low_in_subjectReads_NTFN:\n \"partition_label Low \\ subjectReads example_auth_graph2 (partition_label NTFN)\"\n apply(rule reads_read_page_read_thread[OF SharedPage_in_subjectReads_NTFN])\n apply auto\n done\n\nlemma subjectReads_NTFN: \"subjectReads example_auth_graph2 (partition_label NTFN) = {partition_label NTFN,partition_label High,partition_label SharedPage, partition_label Low}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply (auto intro: High_in_subjectReads_NTFN Low_in_subjectReads_NTFN SharedPage_in_subjectReads_NTFN simp del: example_auth_graph2_def)\n done\n\nlemma NTFN_in_subjectReads_High:\n \"partition_label NTFN \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_ep)\n done\n\nlemma SharedPage_in_subjectReads_High:\n \"partition_label SharedPage \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_read_thread_read_pages)\n done\n\nlemma Low_in_subjectReads_High:\n \"partition_label Low \\ subjectReads example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: reads_read_page_read_thread[OF SharedPage_in_subjectReads_High])\n done\n\nlemma subjectReads_High: \"subjectReads example_auth_graph2 (partition_label High) = {partition_label High,partition_label NTFN, partition_label SharedPage,partition_label Low}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectReads.induct, fastforce+)\n apply(auto intro: NTFN_in_subjectReads_High SharedPage_in_subjectReads_High Low_in_subjectReads_High simp del: example_auth_graph2_def)\n done\n\nlemma SharedPage_in_subjectAffects_Low:\n \"partition_label SharedPage \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(fastforce intro: affects_write)\n done\n\nlemma NTFN_in_subjectAffects_Low:\n \"partition_label NTFN \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(fastforce intro: affects_ep)\n done\n\nlemma High_in_subjectAffects_Low:\n \"partition_label High \\ subjectAffects example_auth_graph2 (partition_label Low)\"\n apply(rule affects_send[where ep=\"partition_label NTFN\"])\n apply(auto)\n done\n\nlemma subjectAffects_Low: \"subjectAffects example_auth_graph2 (partition_label Low) = {partition_label Low,partition_label NTFN,partition_label SharedPage, partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl SharedPage_in_subjectAffects_Low NTFN_in_subjectAffects_Low High_in_subjectAffects_Low simp del: example_auth_graph2_def)\n done\n\nlemma subjectAffects_SharedPage: \"subjectAffects example_auth_graph2 (partition_label SharedPage) = {partition_label SharedPage}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl)\n done\n\nlemma High_in_subjectAffects_NTFN:\n \"partition_label High \\ subjectAffects example_auth_graph2 (partition_label NTFN)\"\n apply(rule affects_send[where ep=\"partition_label NTFN\"])\n apply auto\n done\n\nlemma subjectAffects_NTFN: \"subjectAffects example_auth_graph2 (partition_label NTFN) = {partition_label NTFN,partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl High_in_subjectAffects_NTFN simp del: example_auth_graph2_def)\n done\n\nlemma NTFN_in_subjectAffects_High:\n \"partition_label NTFN \\ subjectAffects example_auth_graph2 (partition_label High)\"\n apply(fastforce intro: affects_ep)\n done\n\nlemma subjectAffects_High: \"subjectAffects example_auth_graph2 (partition_label High) = {partition_label NTFN,partition_label High}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(erule subjectAffects.induct, fastforce+)\n apply(auto intro: affects_lrefl NTFN_in_subjectAffects_High simp del: example_auth_graph2_def)\n done\n\n\n\nlemmas subjectReads_2 = subjectReads_High subjectReads_Low subjectReads_NTFN subjectReads_SharedPage\n\ndeclare example_auth_graph2_def [simp del]\n\n\n\nlemma partsSubjectAffects_Low: \"partsSubjectAffects example_auth_graph2 Low = {Partition Low, Partition High, Partition SharedPage, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_Low | case_tac xa, rename_tac xa)+\n done\n\nlemma partsSubjectAffects_SharedPage: \"partsSubjectAffects example_auth_graph2 SharedPage = {Partition SharedPage, Partition High, Partition Low, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_SharedPage | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_NTFN: \"partsSubjectAffects example_auth_graph2 NTFN = {Partition NTFN, Partition High}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_NTFN | rename_tac xa, case_tac xa)+\n done\n\nlemma partsSubjectAffects_High: \"partsSubjectAffects example_auth_graph2 High = {Partition High, Partition NTFN}\"\n apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads_2 subjectAffects_High | rename_tac xa, case_tac xa)+\n done\n\nlemmas partsSubjectAffects2 =\n partsSubjectAffects_High partsSubjectAffects_Low partsSubjectAffects_NTFN\n partsSubjectAffects_SharedPage\n\n\ndefinition example_policy2 where\n \"example_policy2 \\ {(PSched, d)|d. True} \\\n {(d,e). d = e} \\\n {(Partition Low, Partition NTFN), (Partition Low, Partition SharedPage),\n (Partition Low, Partition High)} \\\n {(Partition SharedPage,Partition High), (Partition SharedPage, Partition Low),\n (Partition SharedPage,Partition NTFN)} \\\n {(Partition NTFN, Partition High)} \\\n {(Partition High, Partition NTFN)}\"\n\nlemma \"policyFlows example_auth_graph2 = example_policy2\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply(clarsimp simp: example_policy2_def)\n apply(erule policyFlows.cases)\n apply(case_tac l; auto simp: partsSubjectAffects2)\n apply assumption\n apply(rule subsetI)\n apply(clarsimp simp: example_policy2_def)\n apply(elim disjE)\n apply(fastforce simp: partsSubjectAffects2 intro: policy_affects)+\n apply(fastforce intro: policy_scheduler)\n apply(fastforce intro: policyFlows_refl refl_onD)\n done\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/infoflow/PolicyExample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.34510527769342453, "lm_q1q2_score": 0.19001750778308404}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\nheader \"Toplevel Refinement Statement for nondeterministic specification\"\n\ntheory Refine_nondet_C (* FIXME: broken *)\nimports\n Refine_C\n \"AInvs.BCorres2_AI\"\nbegin\n\ndefinition (in state_rel)\n cstate_to_AN :: \"cstate \\ unit Structures_A.state\"\n where\n \"cstate_to_AN \\ truncate_state \\ absKState \\ cstate_to_H \\ globals\"\ndefinition (in state_rel)\n \"Fin_CN \\ \\((tc,s),m,e). ((tc, cstate_to_AN s),m,e)\"\n\nlemma truncate_trans[simp]: \"truncate_state (trans_state f s) = s\"\n by (simp add: trans_state_def)\n\ncontext kernel\nbegin\n\ndefinition\n ADT_C' :: \"(cstate global_state, unit observable, global_transition) data_type\"\nwhere\n \"ADT_C' \\ \\ Init = Init_C', Fin = Fin_CN,\n Step = global_automaton do_user_op_C (kernel_call_C False) \\\"\n\ndefinition\n ADT_FP_C' :: \"(cstate global_state, unit observable, global_transition) data_type\"\nwhere\n \"ADT_FP_C' \\ \\ Init = Init_C', Fin = Fin_CN,\n Step = global_automaton do_user_op_C (kernel_call_C True) \\\"\n\nlemma refinement2_both_nondet:\n \"\\ Init = Init_C', Fin = Fin_CN,\n Step = global_automaton do_user_op_C (kernel_call_C fp) \\\n \\ ADT_H'\"\n apply (cut_tac refinement2_both)\n apply (clarsimp simp add: refines_def execution_def ADT_H'_def ADT_H_def)\n apply (clarsimp simp add: Fin_CN_def cstate_to_AN_def Fin_C_def cstate_to_A_def Init_C_def)\n apply (rename_tac js aa ba aaa baa ad bd ae be)\n apply (drule_tac x=js in spec)\n apply (drule_tac x=aa in spec)\n apply (drule_tac x=\"trans_state (\\s. undefined) ba\" in spec)\n apply (drule_tac x=aaa in spec)\n apply (drule_tac x=baa in spec)\n apply simp\n apply force\n done\n\ntheorem refinement2_nondet:\n \"ADT_C' \\ ADT_H'\"\n unfolding ADT_C'_def\n by (rule refinement2_both_nondet)\n\ntheorem fp_refinement_nondet:\n \"ADT_FP_C' \\ ADT_H'\"\n unfolding ADT_FP_C'_def\n by (rule refinement2_both_nondet)\n\ntheorem seL4_refinement_nondet:\n \"ADT_C' \\ ADT_A'\"\n by (blast intro: refinement_nondet refinement2_nondet refinement_trans)\n\ntheorem seL4_fastpath_refinement_nondet:\n \"ADT_FP_C' \\ ADT_A'\"\n by (blast intro: refinement_nondet fp_refinement_nondet refinement_trans)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/ARM_HYP/Refine_nondet_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.18998546820621814}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__33_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__33_on_rules imports n_german_lemma_on_inv__33\nbegin\nsection{*All lemmas on causal relation between inv__33*}\nlemma lemma_inv__33_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__33 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__33) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__33_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.18998546820621814}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__45_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__45_on_rules imports n_german_lemma_on_inv__45\nbegin\nsection{*All lemmas on causal relation between inv__45*}\nlemma lemma_inv__45_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__45 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__45) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__45_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.18998546820621814}} {"text": "(* Title: HOL/Auth/n_german_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_invs_on_rules imports n_german_lemma_inv__1_on_rules n_german_lemma_inv__2_on_rules n_german_lemma_inv__3_on_rules n_german_lemma_inv__4_on_rules n_german_lemma_inv__5_on_rules n_german_lemma_inv__6_on_rules n_german_lemma_inv__7_on_rules n_german_lemma_inv__8_on_rules n_german_lemma_inv__9_on_rules n_german_lemma_inv__10_on_rules n_german_lemma_inv__11_on_rules n_german_lemma_inv__12_on_rules n_german_lemma_inv__13_on_rules n_german_lemma_inv__14_on_rules n_german_lemma_inv__15_on_rules n_german_lemma_inv__16_on_rules n_german_lemma_inv__17_on_rules n_german_lemma_inv__18_on_rules n_german_lemma_inv__19_on_rules n_german_lemma_inv__20_on_rules n_german_lemma_inv__21_on_rules n_german_lemma_inv__22_on_rules n_german_lemma_inv__23_on_rules n_german_lemma_inv__24_on_rules n_german_lemma_inv__25_on_rules n_german_lemma_inv__26_on_rules n_german_lemma_inv__27_on_rules n_german_lemma_inv__28_on_rules n_german_lemma_inv__29_on_rules n_german_lemma_inv__30_on_rules n_german_lemma_inv__31_on_rules n_german_lemma_inv__32_on_rules n_german_lemma_inv__33_on_rules n_german_lemma_inv__34_on_rules n_german_lemma_inv__35_on_rules n_german_lemma_inv__36_on_rules n_german_lemma_inv__37_on_rules n_german_lemma_inv__38_on_rules n_german_lemma_inv__39_on_rules n_german_lemma_inv__40_on_rules n_german_lemma_inv__41_on_rules n_german_lemma_inv__42_on_rules n_german_lemma_inv__43_on_rules n_german_lemma_inv__44_on_rules n_german_lemma_inv__45_on_rules n_german_lemma_inv__46_on_rules n_german_lemma_inv__47_on_rules n_german_lemma_inv__48_on_rules n_german_lemma_inv__49_on_rules n_german_lemma_inv__50_on_rules n_german_lemma_inv__51_on_rules n_german_lemma_inv__52_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (f=inv__2 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__10 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__16 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__17 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__19 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__23 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__24 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__26 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__33 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__39 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__40 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__42 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__44 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__46 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__48 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__52 p__Inv3 p__Inv4)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(f=inv__2 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__6_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__7_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__8_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__9_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__10 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__10_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__11_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__12_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__13_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__14_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__15_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__16 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__16_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__17 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__17_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__18_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__19 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__19_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__20_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__21_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__22_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__23 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__23_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__24 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__24_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__25_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__26 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__26_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__27_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__28_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__29_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__30_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__31_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__32_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__33 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__33_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__34_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__35_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__36_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__37_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__38_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__39 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__39_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__40 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__40_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__41_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__42 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__42_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__43_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__44 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__44_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__45_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__46 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__46_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__47_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__48 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__48_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__49_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__50_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__51_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__52 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__52_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.3106943832145539, "lm_q1q2_score": 0.18995294070115956}} {"text": "(* Title: HOL/Bali/Evaln.thy\n Author: David von Oheimb and Norbert Schirmer\n*)\nsubsection {* Operational evaluation (big-step) semantics of Java expressions and \n statements\n*}\n\ntheory Evaln imports TypeSafe begin\n\n\ntext {*\nVariant of @{term eval} relation with counter for bounded recursive depth. \nIn principal @{term evaln} could replace @{term eval}.\n\nValidity of the axiomatic semantics builds on @{term evaln}. \nFor recursive method calls the axiomatic semantics rule assumes the method ok \nto derive a proof for the body. To prove the method rule sound we need to \nperform induction on the recursion depth. \nFor the completeness proof of the axiomatic semantics the notion of the most\ngeneral formula is used. The most general formula right now builds on the \nordinary evaluation relation @{term eval}. \nSo sometimes we have to switch between @{term evaln} and @{term eval} and vice \nversa. To make\nthis switch easy @{term evaln} also does all the technical accessibility tests \n@{term check_field_access} and @{term check_method_access} like @{term eval}. \nIf it would omit them @{term evaln} and @{term eval} would only be equivalent \nfor welltyped, and definitely assigned terms.\n*}\n\ninductive\n evaln :: \"[prog, state, term, nat, vals, state] \\ bool\"\n (\"_\\_ \\_\\\\_\\ '(_, _')\" [61,61,80,61,0,0] 60)\n and evarn :: \"[prog, state, var, vvar, nat, state] \\ bool\"\n (\"_\\_ \\_=\\_\\_\\ _\" [61,61,90,61,61,61] 60)\n and eval_n:: \"[prog, state, expr, val, nat, state] \\ bool\"\n (\"_\\_ \\_-\\_\\_\\ _\" [61,61,80,61,61,61] 60)\n and evalsn :: \"[prog, state, expr list, val list, nat, state] \\ bool\"\n (\"_\\_ \\_\\\\_\\_\\ _\" [61,61,61,61,61,61] 60)\n and execn :: \"[prog, state, stmt, nat, state] \\ bool\"\n (\"_\\_ \\_\\_\\ _\" [61,61,65, 61,61] 60)\n for G :: prog\nwhere\n\n \"G\\s \\c \\n\\ s' \\ G\\s \\In1r c\\\\n\\ (\\ , s')\"\n| \"G\\s \\e-\\v \\n\\ s' \\ G\\s \\In1l e\\\\n\\ (In1 v , s')\"\n| \"G\\s \\e=\\vf \\n\\ s' \\ G\\s \\In2 e\\\\n\\ (In2 vf, s')\"\n| \"G\\s \\e\\\\v \\n\\ s' \\ G\\s \\In3 e\\\\n\\ (In3 v , s')\"\n\n--{* propagation of abrupt completion *}\n\n| Abrupt: \"G\\(Some xc,s) \\t\\\\n\\ (undefined3 t,(Some xc,s))\"\n\n\n--{* evaluation of variables *}\n\n| LVar: \"G\\Norm s \\LVar vn=\\lvar vn s\\n\\ Norm s\"\n\n| FVar: \"\\G\\Norm s0 \\Init statDeclC\\n\\ s1; G\\s1 \\e-\\a\\n\\ s2;\n (v,s2') = fvar statDeclC stat fn a s2;\n s3 = check_field_access G accC statDeclC fn stat a s2'\\ \\\n G\\Norm s0 \\{accC,statDeclC,stat}e..fn=\\v\\n\\ s3\"\n\n| AVar: \"\\G\\ Norm s0 \\e1-\\a\\n\\ s1 ; G\\s1 \\e2-\\i\\n\\ s2; \n (v,s2') = avar G i a s2\\ \\\n G\\Norm s0 \\e1.[e2]=\\v\\n\\ s2'\"\n\n\n\n\n--{* evaluation of expressions *}\n\n| NewC: \"\\G\\Norm s0 \\Init C\\n\\ s1;\n G\\ s1 \\halloc (CInst C)\\a\\ s2\\ \\\n G\\Norm s0 \\NewC C-\\Addr a\\n\\ s2\"\n\n| NewA: \"\\G\\Norm s0 \\init_comp_ty T\\n\\ s1; G\\s1 \\e-\\i'\\n\\ s2; \n G\\abupd (check_neg i') s2 \\halloc (Arr T (the_Intg i'))\\a\\ s3\\ \\\n G\\Norm s0 \\New T[e]-\\Addr a\\n\\ s3\"\n\n| Cast: \"\\G\\Norm s0 \\e-\\v\\n\\ s1;\n s2 = abupd (raise_if (\\G,snd s1\\v fits T) ClassCast) s1\\ \\\n G\\Norm s0 \\Cast T e-\\v\\n\\ s2\"\n\n| Inst: \"\\G\\Norm s0 \\e-\\v\\n\\ s1;\n b = (v\\Null \\ G,store s1\\v fits RefT T)\\ \\\n G\\Norm s0 \\e InstOf T-\\Bool b\\n\\ s1\"\n\n| Lit: \"G\\Norm s \\Lit v-\\v\\n\\ Norm s\"\n\n| UnOp: \"\\G\\Norm s0 \\e-\\v\\n\\ s1\\ \n \\ G\\Norm s0 \\UnOp unop e-\\(eval_unop unop v)\\n\\ s1\"\n\n| BinOp: \"\\G\\Norm s0 \\e1-\\v1\\n\\ s1; \n G\\s1 \\(if need_second_arg binop v1 then (In1l e2) else (In1r Skip))\n \\\\n\\ (In1 v2,s2)\\ \n \\ G\\Norm s0 \\BinOp binop e1 e2-\\(eval_binop binop v1 v2)\\n\\ s2\"\n\n| Super: \"G\\Norm s \\Super-\\val_this s\\n\\ Norm s\"\n\n| Acc: \"\\G\\Norm s0 \\va=\\(v,f)\\n\\ s1\\ \\\n G\\Norm s0 \\Acc va-\\v\\n\\ s1\"\n\n| Ass: \"\\G\\Norm s0 \\va=\\(w,f)\\n\\ s1;\n G\\ s1 \\e-\\v \\n\\ s2\\ \\\n G\\Norm s0 \\va:=e-\\v\\n\\ assign f v s2\"\n\n| Cond: \"\\G\\Norm s0 \\e0-\\b\\n\\ s1;\n G\\ s1 \\(if the_Bool b then e1 else e2)-\\v\\n\\ s2\\ \\\n G\\Norm s0 \\e0 ? e1 : e2-\\v\\n\\ s2\"\n\n| Call: \n \"\\G\\Norm s0 \\e-\\a'\\n\\ s1; G\\s1 \\args\\\\vs\\n\\ s2;\n D = invocation_declclass G mode (store s2) a' statT \\name=mn,parTs=pTs\\; \n s3=init_lvars G D \\name=mn,parTs=pTs\\ mode a' vs s2;\n s3' = check_method_access G accC statT mode \\name=mn,parTs=pTs\\ a' s3;\n G\\s3'\\Methd D \\name=mn,parTs=pTs\\-\\v\\n\\ s4\n \\\n \\ \n G\\Norm s0 \\{accC,statT,mode}e\\mn({pTs}args)-\\v\\n\\ (restore_lvars s2 s4)\"\n\n| Methd:\"\\G\\Norm s0 \\body G D sig-\\v\\n\\ s1\\ \\\n G\\Norm s0 \\Methd D sig-\\v\\Suc n\\ s1\"\n\n| Body: \"\\G\\Norm s0\\Init D\\n\\ s1; G\\s1 \\c\\n\\ s2;\n s3 = (if (\\ l. abrupt s2 = Some (Jump (Break l)) \\ \n abrupt s2 = Some (Jump (Cont l)))\n then abupd (\\ x. Some (Error CrossMethodJump)) s2 \n else s2)\\\\\n G\\Norm s0 \\Body D c\n -\\the (locals (store s2) Result)\\n\\abupd (absorb Ret) s3\"\n\n--{* evaluation of expression lists *}\n\n| Nil:\n \"G\\Norm s0 \\[]\\\\[]\\n\\ Norm s0\"\n\n| Cons: \"\\G\\Norm s0 \\e -\\ v \\n\\ s1;\n G\\ s1 \\es\\\\vs\\n\\ s2\\ \\\n G\\Norm s0 \\e#es\\\\v#vs\\n\\ s2\"\n\n\n--{* execution of statements *}\n\n| Skip: \"G\\Norm s \\Skip\\n\\ Norm s\"\n\n| Expr: \"\\G\\Norm s0 \\e-\\v\\n\\ s1\\ \\\n G\\Norm s0 \\Expr e\\n\\ s1\"\n\n| Lab: \"\\G\\Norm s0 \\c \\n\\ s1\\ \\\n G\\Norm s0 \\l\\ c\\n\\ abupd (absorb l) s1\"\n\n| Comp: \"\\G\\Norm s0 \\c1 \\n\\ s1;\n G\\ s1 \\c2 \\n\\ s2\\ \\\n G\\Norm s0 \\c1;; c2\\n\\ s2\"\n\n| If: \"\\G\\Norm s0 \\e-\\b\\n\\ s1;\n G\\ s1\\(if the_Bool b then c1 else c2)\\n\\ s2\\ \\\n G\\Norm s0 \\If(e) c1 Else c2 \\n\\ s2\"\n\n| Loop: \"\\G\\Norm s0 \\e-\\b\\n\\ s1;\n if the_Bool b \n then (G\\s1 \\c\\n\\ s2 \\ \n G\\(abupd (absorb (Cont l)) s2) \\l\\ While(e) c\\n\\ s3)\n else s3 = s1\\ \\\n G\\Norm s0 \\l\\ While(e) c\\n\\ s3\"\n \n| Jmp: \"G\\Norm s \\Jmp j\\n\\ (Some (Jump j), s)\"\n \n| Throw:\"\\G\\Norm s0 \\e-\\a'\\n\\ s1\\ \\\n G\\Norm s0 \\Throw e\\n\\ abupd (throw a') s1\"\n\n| Try: \"\\G\\Norm s0 \\c1\\n\\ s1; G\\s1 \\sxalloc\\ s2;\n if G,s2\\catch tn then G\\new_xcpt_var vn s2 \\c2\\n\\ s3 else s3 = s2\\\n \\\n G\\Norm s0 \\Try c1 Catch(tn vn) c2\\n\\ s3\"\n\n| Fin: \"\\G\\Norm s0 \\c1\\n\\ (x1,s1);\n G\\Norm s1 \\c2\\n\\ s2;\n s3=(if (\\ err. x1=Some (Error err)) \n then (x1,s1) \n else abupd (abrupt_if (x1\\None) x1) s2)\\ \\\n G\\Norm s0 \\c1 Finally c2\\n\\ s3\"\n \n| Init: \"\\the (class G C) = c;\n if inited C (globs s0) then s3 = Norm s0\n else (G\\Norm (init_class_obj G C s0)\n \\(if C = Object then Skip else Init (super c))\\n\\ s1 \\\n G\\set_lvars empty s1 \\init c\\n\\ s2 \\ \n s3 = restore_lvars s1 s2)\\\n \\\n G\\Norm s0 \\Init C\\n\\ s3\"\nmonos\n if_bool_eq_conj\n\n\ndeclare split_if [split del] split_if_asm [split del]\n option.split [split del] option.split_asm [split del]\n not_None_eq [simp del] \n split_paired_All [simp del] split_paired_Ex [simp del]\nsetup {* map_theory_simpset (fn ctxt => ctxt delloop \"split_all_tac\") *}\n\ninductive_cases evaln_cases: \"G\\s \\t\\\\n\\ (v, s')\"\n\ninductive_cases evaln_elim_cases:\n \"G\\(Some xc, s) \\t \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1r Skip \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (Jmp j) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (l\\ c) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In3 ([]) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In3 (e#es) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (Lit w) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (UnOp unop e) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (BinOp binop e1 e2) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In2 (LVar vn) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (Cast T e) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (e InstOf T) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (Super) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (Acc va) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1r (Expr e) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (c1;; c2) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1l (Methd C sig) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1l (Body D c) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1l (e0 ? e1 : e2) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1r (If(e) c1 Else c2) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (l\\ While(e) c) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (c1 Finally c2) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1r (Throw e) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In1l (NewC C) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (New T[e]) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l (Ass va e) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1r (Try c1 Catch(tn vn) c2) \\\\n\\ (x, s')\"\n \"G\\Norm s \\In2 ({accC,statDeclC,stat}e..fn) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In2 (e1.[e2]) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1l ({accC,statT,mode}e\\mn({pT}p)) \\\\n\\ (v, s')\"\n \"G\\Norm s \\In1r (Init C) \\\\n\\ (x, s')\"\n\ndeclare split_if [split] split_if_asm [split] \n option.split [split] option.split_asm [split]\n not_None_eq [simp] \n split_paired_All [simp] split_paired_Ex [simp]\ndeclaration {* K (Simplifier.map_ss (fn ss => ss addloop (\"split_all_tac\", split_all_tac))) *}\n\nlemma evaln_Inj_elim: \"G\\s \\t\\\\n\\ (w,s') \\ case t of In1 ec \\ \n (case ec of Inl e \\ (\\v. w = In1 v) | Inr c \\ w = \\) \n | In2 e \\ (\\v. w = In2 v) | In3 e \\ (\\v. w = In3 v)\"\napply (erule evaln_cases , auto)\napply (induct_tac \"t\")\napply (rename_tac a, induct_tac \"a\")\napply auto\ndone\n\ntext {* The following simplification procedures set up the proper injections of\n terms and their corresponding values in the evaluation relation:\n E.g. an expression \n (injection @{term In1l} into terms) always evaluates to ordinary values \n (injection @{term In1} into generalised values @{term vals}). \n*}\n\nlemma evaln_expr_eq: \"G\\s \\In1l t\\\\n\\ (w, s') = (\\v. w=In1 v \\ G\\s \\t-\\v \\n\\ s')\"\n by (auto, frule evaln_Inj_elim, auto)\n\nlemma evaln_var_eq: \"G\\s \\In2 t\\\\n\\ (w, s') = (\\vf. w=In2 vf \\ G\\s \\t=\\vf\\n\\ s')\"\n by (auto, frule evaln_Inj_elim, auto)\n\nlemma evaln_exprs_eq: \"G\\s \\In3 t\\\\n\\ (w, s') = (\\vs. w=In3 vs \\ G\\s \\t\\\\vs\\n\\ s')\"\n by (auto, frule evaln_Inj_elim, auto)\n\nlemma evaln_stmt_eq: \"G\\s \\In1r t\\\\n\\ (w, s') = (w=\\ \\ G\\s \\t \\n\\ s')\"\n by (auto, frule evaln_Inj_elim, auto, frule evaln_Inj_elim, auto)\n\nsimproc_setup evaln_expr (\"G\\s \\In1l t\\\\n\\ (w, s')\") = {*\n fn _ => fn _ => fn ct =>\n (case Thm.term_of ct of\n (_ $ _ $ _ $ _ $ _ $ (Const _ $ _) $ _) => NONE\n | _ => SOME (mk_meta_eq @{thm evaln_expr_eq})) *}\n\nsimproc_setup evaln_var (\"G\\s \\In2 t\\\\n\\ (w, s')\") = {*\n fn _ => fn _ => fn ct =>\n (case Thm.term_of ct of\n (_ $ _ $ _ $ _ $ _ $ (Const _ $ _) $ _) => NONE\n | _ => SOME (mk_meta_eq @{thm evaln_var_eq})) *}\n\nsimproc_setup evaln_exprs (\"G\\s \\In3 t\\\\n\\ (w, s')\") = {*\n fn _ => fn _ => fn ct =>\n (case Thm.term_of ct of\n (_ $ _ $ _ $ _ $ _ $ (Const _ $ _) $ _) => NONE\n | _ => SOME (mk_meta_eq @{thm evaln_exprs_eq})) *}\n\nsimproc_setup evaln_stmt (\"G\\s \\In1r t\\\\n\\ (w, s')\") = {*\n fn _ => fn _ => fn ct =>\n (case Thm.term_of ct of\n (_ $ _ $ _ $ _ $ _ $ (Const _ $ _) $ _) => NONE\n | _ => SOME (mk_meta_eq @{thm evaln_stmt_eq})) *}\n\nML {* ML_Thms.bind_thms (\"evaln_AbruptIs\", sum3_instantiate @{context} @{thm evaln.Abrupt}) *}\ndeclare evaln_AbruptIs [intro!]\n\nlemma evaln_Callee: \"G\\Norm s\\In1l (Callee l e)\\\\n\\ (v,s') = False\"\nproof -\n { fix s t v s'\n assume eval: \"G\\s \\t\\\\n\\ (v,s')\" and\n normal: \"normal s\" and\n callee: \"t=In1l (Callee l e)\"\n then have \"False\" by induct auto\n }\n then show ?thesis\n by (cases s') fastforce \nqed\n\nlemma evaln_InsInitE: \"G\\Norm s\\In1l (InsInitE c e)\\\\n\\ (v,s') = False\"\nproof -\n { fix s t v s'\n assume eval: \"G\\s \\t\\\\n\\ (v,s')\" and\n normal: \"normal s\" and\n callee: \"t=In1l (InsInitE c e)\"\n then have \"False\" by induct auto\n }\n then show ?thesis\n by (cases s') fastforce\nqed\n\nlemma evaln_InsInitV: \"G\\Norm s\\In2 (InsInitV c w)\\\\n\\ (v,s') = False\"\nproof -\n { fix s t v s'\n assume eval: \"G\\s \\t\\\\n\\ (v,s')\" and\n normal: \"normal s\" and\n callee: \"t=In2 (InsInitV c w)\"\n then have \"False\" by induct auto\n } \n then show ?thesis\n by (cases s') fastforce\nqed\n\nlemma evaln_FinA: \"G\\Norm s\\In1r (FinA a c)\\\\n\\ (v,s') = False\"\nproof -\n { fix s t v s'\n assume eval: \"G\\s \\t\\\\n\\ (v,s')\" and\n normal: \"normal s\" and\n callee: \"t=In1r (FinA a c)\"\n then have \"False\" by induct auto\n } \n then show ?thesis\n by (cases s') fastforce\nqed\n\nlemma evaln_abrupt_lemma: \"G\\s \\e\\\\n\\ (v,s') \\ \n fst s = Some xc \\ s' = s \\ v = undefined3 e\"\napply (erule evaln_cases , auto)\ndone\n\nlemma evaln_abrupt: \n \"\\s'. G\\(Some xc,s) \\e\\\\n\\ (w,s') = (s' = (Some xc,s) \\ \n w=undefined3 e \\ G\\(Some xc,s) \\e\\\\n\\ (undefined3 e,(Some xc,s)))\"\napply auto\napply (frule evaln_abrupt_lemma, auto)+\ndone\n\nsimproc_setup evaln_abrupt (\"G\\(Some xc,s) \\e\\\\n\\ (w,s')\") = {*\n fn _ => fn _ => fn ct =>\n (case Thm.term_of ct of\n (_ $ _ $ _ $ _ $ _ $ _ $ (Const (@{const_name Pair}, _) $ (Const (@{const_name Some},_) $ _)$ _))\n => NONE\n | _ => SOME (mk_meta_eq @{thm evaln_abrupt}))\n*}\n\nlemma evaln_LitI: \"G\\s \\Lit v-\\(if normal s then v else undefined)\\n\\ s\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.Lit)\n\nlemma CondI: \n \"\\s1. \\G\\s \\e-\\b\\n\\ s1; G\\s1 \\(if the_Bool b then e1 else e2)-\\v\\n\\ s2\\ \\ \n G\\s \\e ? e1 : e2-\\(if normal s1 then v else undefined)\\n\\ s2\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.Cond)\n\nlemma evaln_SkipI [intro!]: \"G\\s \\Skip\\n\\ s\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.Skip)\n\nlemma evaln_ExprI: \"G\\s \\e-\\v\\n\\ s' \\ G\\s \\Expr e\\n\\ s'\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.Expr)\n\nlemma evaln_CompI: \"\\G\\s \\c1\\n\\ s1; G\\s1 \\c2\\n\\ s2\\ \\ G\\s \\c1;; c2\\n\\ s2\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.Comp)\n\nlemma evaln_IfI: \n \"\\G\\s \\e-\\v\\n\\ s1; G\\s1 \\(if the_Bool v then c1 else c2)\\n\\ s2\\ \\ \n G\\s \\If(e) c1 Else c2\\n\\ s2\"\napply (case_tac \"s\", case_tac \"a = None\")\nby (auto intro!: evaln.If)\n\nlemma evaln_SkipD [dest!]: \"G\\s \\Skip\\n\\ s' \\ s' = s\" \nby (erule evaln_cases, auto)\n\nlemma evaln_Skip_eq [simp]: \"G\\s \\Skip\\n\\ s' = (s = s')\"\napply auto\ndone\n\n\n\n\nsubsubsection {* evaln implies eval *}\n\nlemma evaln_eval: \n assumes evaln: \"G\\s0 \\t\\\\n\\ (v,s1)\" \n shows \"G\\s0 \\t\\\\ (v,s1)\"\nusing evaln \nproof (induct)\n case (Loop s0 e b n s1 c s2 l s3)\n note `G\\Norm s0 \\e-\\b\\ s1`\n moreover\n have \"if the_Bool b\n then (G\\s1 \\c\\ s2) \\ \n G\\abupd (absorb (Cont l)) s2 \\l\\ While(e) c\\ s3\n else s3 = s1\"\n using Loop.hyps by simp\n ultimately show ?case by (rule eval.Loop)\nnext\n case (Try s0 c1 n s1 s2 C vn c2 s3)\n note `G\\Norm s0 \\c1\\ s1`\n moreover\n note `G\\s1 \\sxalloc\\ s2`\n moreover\n have \"if G,s2\\catch C then G\\new_xcpt_var vn s2 \\c2\\ s3 else s3 = s2\"\n using Try.hyps by simp\n ultimately show ?case by (rule eval.Try)\nnext\n case (Init C c s0 s3 n s1 s2)\n note `the (class G C) = c`\n moreover\n have \"if inited C (globs s0) \n then s3 = Norm s0\n else G\\Norm ((init_class_obj G C) s0) \n \\(if C = Object then Skip else Init (super c))\\ s1 \\\n G\\(set_lvars empty) s1 \\init c\\ s2 \\\n s3 = (set_lvars (locals (store s1))) s2\"\n using Init.hyps by simp\n ultimately show ?case by (rule eval.Init)\nqed (rule eval.intros,(assumption+ | assumption?))+\n\nlemma Suc_le_D_lemma: \"\\Suc n <= m'; (\\m. n <= m \\ P (Suc m)) \\ \\ P m'\"\napply (frule Suc_le_D)\napply fast\ndone\n\nlemma evaln_nonstrict [rule_format (no_asm), elim]: \n \"G\\s \\t\\\\n\\ (w, s') \\ \\m. n\\m \\ G\\s \\t\\\\m\\ (w, s')\"\napply (erule evaln.induct)\napply (tactic {* ALLGOALS (EVERY'[strip_tac, TRY o etac @{thm Suc_le_D_lemma},\n REPEAT o smp_tac @{context} 1, \n resolve_tac @{thms evaln.intros} THEN_ALL_NEW TRY o atac]) *})\n(* 3 subgoals *)\napply (auto split del: split_if)\ndone\n\nlemmas evaln_nonstrict_Suc = evaln_nonstrict [OF _ le_refl [THEN le_SucI]]\n\nlemma evaln_max2: \"\\G\\s1 \\t1\\\\n1\\ (w1, s1'); G\\s2 \\t2\\\\n2\\ (w2, s2')\\ \\ \n G\\s1 \\t1\\\\max n1 n2\\ (w1, s1') \\ G\\s2 \\t2\\\\max n1 n2\\ (w2, s2')\"\nby (fast intro: max.cobounded1 max.cobounded2)\n\ncorollary evaln_max2E [consumes 2]:\n \"\\G\\s1 \\t1\\\\n1\\ (w1, s1'); G\\s2 \\t2\\\\n2\\ (w2, s2'); \n \\G\\s1 \\t1\\\\max n1 n2\\ (w1, s1');G\\s2 \\t2\\\\max n1 n2\\ (w2, s2') \\ \\ P \\ \\ P\"\nby (drule (1) evaln_max2) simp\n\n\nlemma evaln_max3: \n\"\\G\\s1 \\t1\\\\n1\\ (w1, s1'); G\\s2 \\t2\\\\n2\\ (w2, s2'); G\\s3 \\t3\\\\n3\\ (w3, s3')\\ \\\n G\\s1 \\t1\\\\max (max n1 n2) n3\\ (w1, s1') \\\n G\\s2 \\t2\\\\max (max n1 n2) n3\\ (w2, s2') \\ \n G\\s3 \\t3\\\\max (max n1 n2) n3\\ (w3, s3')\"\napply (drule (1) evaln_max2, erule thin_rl)\napply (fast intro!: max.cobounded1 max.cobounded2)\ndone\n\ncorollary evaln_max3E: \n\"\\G\\s1 \\t1\\\\n1\\ (w1, s1'); G\\s2 \\t2\\\\n2\\ (w2, s2'); G\\s3 \\t3\\\\n3\\ (w3, s3');\n \\G\\s1 \\t1\\\\max (max n1 n2) n3\\ (w1, s1');\n G\\s2 \\t2\\\\max (max n1 n2) n3\\ (w2, s2'); \n G\\s3 \\t3\\\\max (max n1 n2) n3\\ (w3, s3')\n \\ \\ P\n \\ \\ P\"\nby (drule (2) evaln_max3) simp\n\n\nlemma le_max3I1: \"(n2::nat) \\ max n1 (max n2 n3)\"\nproof -\n have \"n2 \\ max n2 n3\"\n by (rule max.cobounded1)\n also\n have \"max n2 n3 \\ max n1 (max n2 n3)\"\n by (rule max.cobounded2)\n finally\n show ?thesis .\nqed\n\nlemma le_max3I2: \"(n3::nat) \\ max n1 (max n2 n3)\"\nproof -\n have \"n3 \\ max n2 n3\"\n by (rule max.cobounded2)\n also\n have \"max n2 n3 \\ max n1 (max n2 n3)\"\n by (rule max.cobounded2)\n finally\n show ?thesis .\nqed\n\ndeclare [[simproc del: wt_expr wt_var wt_exprs wt_stmt]]\n\nsubsubsection {* eval implies evaln *}\nlemma eval_evaln: \n assumes eval: \"G\\s0 \\t\\\\ (v,s1)\"\n shows \"\\n. G\\s0 \\t\\\\n\\ (v,s1)\"\nusing eval \nproof (induct)\n case (Abrupt xc s t)\n obtain n where\n \"G\\(Some xc, s) \\t\\\\n\\ (undefined3 t, (Some xc, s))\"\n by (iprover intro: evaln.Abrupt)\n then show ?case ..\nnext\n case Skip\n show ?case by (blast intro: evaln.Skip)\nnext\n case (Expr s0 e v s1)\n then obtain n where\n \"G\\Norm s0 \\e-\\v\\n\\ s1\"\n by (iprover)\n then have \"G\\Norm s0 \\Expr e\\n\\ s1\"\n by (rule evaln.Expr) \n then show ?case ..\nnext\n case (Lab s0 c s1 l)\n then obtain n where\n \"G\\Norm s0 \\c\\n\\ s1\"\n by (iprover)\n then have \"G\\Norm s0 \\l\\ c\\n\\ abupd (absorb l) s1\"\n by (rule evaln.Lab)\n then show ?case ..\nnext\n case (Comp s0 c1 s1 c2 s2)\n then obtain n1 n2 where\n \"G\\Norm s0 \\c1\\n1\\ s1\"\n \"G\\s1 \\c2\\n2\\ s2\"\n by (iprover)\n then have \"G\\Norm s0 \\c1;; c2\\max n1 n2\\ s2\"\n by (blast intro: evaln.Comp dest: evaln_max2 )\n then show ?case ..\nnext\n case (If s0 e b s1 c1 c2 s2)\n then obtain n1 n2 where\n \"G\\Norm s0 \\e-\\b\\n1\\ s1\"\n \"G\\s1 \\(if the_Bool b then c1 else c2)\\n2\\ s2\"\n by (iprover)\n then have \"G\\Norm s0 \\If(e) c1 Else c2\\max n1 n2\\ s2\"\n by (blast intro: evaln.If dest: evaln_max2)\n then show ?case ..\nnext\n case (Loop s0 e b s1 c s2 l s3)\n from Loop.hyps obtain n1 where\n \"G\\Norm s0 \\e-\\b\\n1\\ s1\"\n by (iprover)\n moreover from Loop.hyps obtain n2 where\n \"if the_Bool b \n then (G\\s1 \\c\\n2\\ s2 \\ \n G\\(abupd (absorb (Cont l)) s2)\\l\\ While(e) c\\n2\\ s3)\n else s3 = s1\"\n by simp (iprover intro: evaln_nonstrict max.cobounded1 max.cobounded2)\n ultimately\n have \"G\\Norm s0 \\l\\ While(e) c\\max n1 n2\\ s3\"\n apply -\n apply (rule evaln.Loop)\n apply (iprover intro: evaln_nonstrict intro: max.cobounded1)\n apply (auto intro: evaln_nonstrict intro: max.cobounded2)\n done\n then show ?case ..\nnext\n case (Jmp s j)\n fix n have \"G\\Norm s \\Jmp j\\n\\ (Some (Jump j), s)\"\n by (rule evaln.Jmp)\n then show ?case ..\nnext\n case (Throw s0 e a s1)\n then obtain n where\n \"G\\Norm s0 \\e-\\a\\n\\ s1\"\n by (iprover)\n then have \"G\\Norm s0 \\Throw e\\n\\ abupd (throw a) s1\"\n by (rule evaln.Throw)\n then show ?case ..\nnext \n case (Try s0 c1 s1 s2 catchC vn c2 s3)\n from Try.hyps obtain n1 where\n \"G\\Norm s0 \\c1\\n1\\ s1\"\n by (iprover)\n moreover \n note sxalloc = `G\\s1 \\sxalloc\\ s2`\n moreover\n from Try.hyps obtain n2 where\n \"if G,s2\\catch catchC then G\\new_xcpt_var vn s2 \\c2\\n2\\ s3 else s3 = s2\"\n by fastforce \n ultimately\n have \"G\\Norm s0 \\Try c1 Catch(catchC vn) c2\\max n1 n2\\ s3\"\n by (auto intro!: evaln.Try max.cobounded1 max.cobounded2)\n then show ?case ..\nnext\n case (Fin s0 c1 x1 s1 c2 s2 s3)\n from Fin obtain n1 n2 where \n \"G\\Norm s0 \\c1\\n1\\ (x1, s1)\"\n \"G\\Norm s1 \\c2\\n2\\ s2\"\n by iprover\n moreover\n note s3 = `s3 = (if \\err. x1 = Some (Error err) \n then (x1, s1)\n else abupd (abrupt_if (x1 \\ None) x1) s2)`\n ultimately \n have \n \"G\\Norm s0 \\c1 Finally c2\\max n1 n2\\ s3\"\n by (blast intro: evaln.Fin dest: evaln_max2)\n then show ?case ..\nnext\n case (Init C c s0 s3 s1 s2)\n note cls = `the (class G C) = c`\n moreover from Init.hyps obtain n where\n \"if inited C (globs s0) then s3 = Norm s0\n else (G\\Norm (init_class_obj G C s0)\n \\(if C = Object then Skip else Init (super c))\\n\\ s1 \\\n G\\set_lvars empty s1 \\init c\\n\\ s2 \\ \n s3 = restore_lvars s1 s2)\"\n by (auto intro: evaln_nonstrict max.cobounded1 max.cobounded2)\n ultimately have \"G\\Norm s0 \\Init C\\n\\ s3\"\n by (rule evaln.Init)\n then show ?case ..\nnext\n case (NewC s0 C s1 a s2)\n then obtain n where \n \"G\\Norm s0 \\Init C\\n\\ s1\"\n by (iprover)\n with NewC \n have \"G\\Norm s0 \\NewC C-\\Addr a\\n\\ s2\"\n by (iprover intro: evaln.NewC)\n then show ?case ..\nnext\n case (NewA s0 T s1 e i s2 a s3)\n then obtain n1 n2 where \n \"G\\Norm s0 \\init_comp_ty T\\n1\\ s1\"\n \"G\\s1 \\e-\\i\\n2\\ s2\" \n by (iprover)\n moreover\n note `G\\abupd (check_neg i) s2 \\halloc Arr T (the_Intg i)\\a\\ s3`\n ultimately\n have \"G\\Norm s0 \\New T[e]-\\Addr a\\max n1 n2\\ s3\"\n by (blast intro: evaln.NewA dest: evaln_max2)\n then show ?case ..\nnext\n case (Cast s0 e v s1 s2 castT)\n then obtain n where\n \"G\\Norm s0 \\e-\\v\\n\\ s1\"\n by (iprover)\n moreover \n note `s2 = abupd (raise_if (\\ G,snd s1\\v fits castT) ClassCast) s1`\n ultimately\n have \"G\\Norm s0 \\Cast castT e-\\v\\n\\ s2\"\n by (rule evaln.Cast)\n then show ?case ..\nnext\n case (Inst s0 e v s1 b T)\n then obtain n where\n \"G\\Norm s0 \\e-\\v\\n\\ s1\"\n by (iprover)\n moreover \n note `b = (v \\ Null \\ G,snd s1\\v fits RefT T)`\n ultimately\n have \"G\\Norm s0 \\e InstOf T-\\Bool b\\n\\ s1\"\n by (rule evaln.Inst)\n then show ?case ..\nnext\n case (Lit s v)\n fix n have \"G\\Norm s \\Lit v-\\v\\n\\ Norm s\"\n by (rule evaln.Lit)\n then show ?case ..\nnext\n case (UnOp s0 e v s1 unop)\n then obtain n where\n \"G\\Norm s0 \\e-\\v\\n\\ s1\"\n by (iprover)\n hence \"G\\Norm s0 \\UnOp unop e-\\eval_unop unop v\\n\\ s1\"\n by (rule evaln.UnOp)\n then show ?case ..\nnext\n case (BinOp s0 e1 v1 s1 binop e2 v2 s2)\n then obtain n1 n2 where \n \"G\\Norm s0 \\e1-\\v1\\n1\\ s1\"\n \"G\\s1 \\(if need_second_arg binop v1 then In1l e2\n else In1r Skip)\\\\n2\\ (In1 v2, s2)\" \n by (iprover)\n hence \"G\\Norm s0 \\BinOp binop e1 e2-\\(eval_binop binop v1 v2)\\max n1 n2\n \\ s2\"\n by (blast intro!: evaln.BinOp dest: evaln_max2)\n then show ?case ..\nnext\n case (Super s )\n fix n have \"G\\Norm s \\Super-\\val_this s\\n\\ Norm s\"\n by (rule evaln.Super)\n then show ?case ..\nnext\n case (Acc s0 va v f s1)\n then obtain n where\n \"G\\Norm s0 \\va=\\(v, f)\\n\\ s1\"\n by (iprover)\n then\n have \"G\\Norm s0 \\Acc va-\\v\\n\\ s1\"\n by (rule evaln.Acc)\n then show ?case ..\nnext\n case (Ass s0 var w f s1 e v s2)\n then obtain n1 n2 where \n \"G\\Norm s0 \\var=\\(w, f)\\n1\\ s1\"\n \"G\\s1 \\e-\\v\\n2\\ s2\" \n by (iprover)\n then\n have \"G\\Norm s0 \\var:=e-\\v\\max n1 n2\\ assign f v s2\"\n by (blast intro: evaln.Ass dest: evaln_max2)\n then show ?case ..\nnext\n case (Cond s0 e0 b s1 e1 e2 v s2)\n then obtain n1 n2 where \n \"G\\Norm s0 \\e0-\\b\\n1\\ s1\"\n \"G\\s1 \\(if the_Bool b then e1 else e2)-\\v\\n2\\ s2\"\n by (iprover)\n then\n have \"G\\Norm s0 \\e0 ? e1 : e2-\\v\\max n1 n2\\ s2\"\n by (blast intro: evaln.Cond dest: evaln_max2)\n then show ?case ..\nnext\n case (Call s0 e a' s1 args vs s2 invDeclC mode statT mn pTs' s3 s3' accC' v s4)\n then obtain n1 n2 where\n \"G\\Norm s0 \\e-\\a'\\n1\\ s1\"\n \"G\\s1 \\args\\\\vs\\n2\\ s2\"\n by iprover\n moreover\n note `invDeclC = invocation_declclass G mode (store s2) a' statT \n \\name=mn,parTs=pTs'\\`\n moreover\n note `s3 = init_lvars G invDeclC \\name=mn,parTs=pTs'\\ mode a' vs s2`\n moreover\n note `s3'=check_method_access G accC' statT mode \\name=mn,parTs=pTs'\\ a' s3`\n moreover \n from Call.hyps\n obtain m where \n \"G\\s3' \\Methd invDeclC \\name=mn, parTs=pTs'\\-\\v\\m\\ s4\"\n by iprover\n ultimately\n have \"G\\Norm s0 \\{accC',statT,mode}e\\mn( {pTs'}args)-\\v\\max n1 (max n2 m)\\ \n (set_lvars (locals (store s2))) s4\"\n by (auto intro!: evaln.Call max.cobounded1 le_max3I1 le_max3I2)\n thus ?case ..\nnext\n case (Methd s0 D sig v s1)\n then obtain n where\n \"G\\Norm s0 \\body G D sig-\\v\\n\\ s1\"\n by iprover\n then have \"G\\Norm s0 \\Methd D sig-\\v\\Suc n\\ s1\"\n by (rule evaln.Methd)\n then show ?case ..\nnext\n case (Body s0 D s1 c s2 s3)\n from Body.hyps obtain n1 n2 where \n evaln_init: \"G\\Norm s0 \\Init D\\n1\\ s1\" and\n evaln_c: \"G\\s1 \\c\\n2\\ s2\"\n by (iprover)\n moreover\n note `s3 = (if \\l. fst s2 = Some (Jump (Break l)) \\ \n fst s2 = Some (Jump (Cont l))\n then abupd (\\x. Some (Error CrossMethodJump)) s2 \n else s2)`\n ultimately\n have\n \"G\\Norm s0 \\Body D c-\\the (locals (store s2) Result)\\max n1 n2\n \\ abupd (absorb Ret) s3\"\n by (iprover intro: evaln.Body dest: evaln_max2)\n then show ?case ..\nnext\n case (LVar s vn )\n obtain n where\n \"G\\Norm s \\LVar vn=\\lvar vn s\\n\\ Norm s\"\n by (iprover intro: evaln.LVar)\n then show ?case ..\nnext\n case (FVar s0 statDeclC s1 e a s2 v s2' stat fn s3 accC)\n then obtain n1 n2 where\n \"G\\Norm s0 \\Init statDeclC\\n1\\ s1\"\n \"G\\s1 \\e-\\a\\n2\\ s2\"\n by iprover\n moreover\n note `s3 = check_field_access G accC statDeclC fn stat a s2'`\n and `(v, s2') = fvar statDeclC stat fn a s2`\n ultimately\n have \"G\\Norm s0 \\{accC,statDeclC,stat}e..fn=\\v\\max n1 n2\\ s3\"\n by (iprover intro: evaln.FVar dest: evaln_max2)\n then show ?case ..\nnext\n case (AVar s0 e1 a s1 e2 i s2 v s2')\n then obtain n1 n2 where \n \"G\\Norm s0 \\e1-\\a\\n1\\ s1\"\n \"G\\s1 \\e2-\\i\\n2\\ s2\" \n by iprover\n moreover \n note `(v, s2') = avar G i a s2`\n ultimately \n have \"G\\Norm s0 \\e1.[e2]=\\v\\max n1 n2\\ s2'\"\n by (blast intro!: evaln.AVar dest: evaln_max2)\n then show ?case ..\nnext\n case (Nil s0)\n show ?case by (iprover intro: evaln.Nil)\nnext\n case (Cons s0 e v s1 es vs s2)\n then obtain n1 n2 where \n \"G\\Norm s0 \\e-\\v\\n1\\ s1\"\n \"G\\s1 \\es\\\\vs\\n2\\ s2\" \n by iprover\n then\n have \"G\\Norm s0 \\e # es\\\\v # vs\\max n1 n2\\ s2\"\n by (blast intro!: evaln.Cons dest: evaln_max2)\n then show ?case ..\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/Evaln.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.37387582974820255, "lm_q1q2_score": 0.18985858211336917}} {"text": "(* @LICENSE(NICTA_CORE) *)\n\n(* Author: Rafal Kolanski, NICTA & UNSW \n\n Generic heap definitions and manipulations instantiated to a machine.\n*)\n\ntheory Heaps\nimports MemTypes WordTypes\nbegin\n\nsection \\Memory Views\\\n\ntext \\\n Apart from the heap, representing the physical machine memory, we recognise\n the virtual address map (mapping each virtual address to a physical one) and\n the virtual address space (mapping each virtual address to a byte).\n \n You can obtain a virtual map from lifting the page table from the heap, and\n an address space from combining a vmap and heap.\n \n All maps are partial. On the physical side, this denotes memory that has been\n allocated. On the virtual side, memory that has been mapped. Allocated memory\n may be unmapped, mapped memory may be unallocated.\n \n The heap is partial, defined on areas used by the program.\n\n A value space is a partial map from any kind of address to bytes.\n\\\ntype_synonym vmap = \"vaddr \\ paddr\"\ntype_synonym heap = \"paddr \\ byte\"\ntype_synonym addr_space = \"vaddr \\ byte\"\n\ntranslations\n (type) \"vmap\" <=(type) \"vaddr \\ paddr\"\n (type) \"heap\" <=(type) \"paddr \\ byte\"\n (type) \"addr_space\" <=(type) \"vaddr \\ byte\"\n\ntype_synonym ('a,'p) value_space = \"('a,'p) addr_t \\ byte\"\n\n\nsection \\Object Loading\\\n\ntext \\Obtaining a list of values (i.e. bytes) from a map with an addr_t domain.\\\n\nprimrec\n load_list_basic :: \"(('a::semiring_1,'p) addr_t \\ 'val) \\ nat \n \\ ('a,'p) addr_t \\ 'val option list\"\nwhere\n \"load_list_basic h 0 p = []\" |\n \"load_list_basic h (Suc n) p = h p # load_list_basic h n (p r+ 1)\"\n\ndefinition\n deoption_list :: \"'a option list \\ 'a list\" where\n \"deoption_list xs \\ if None \\ set xs then None else Some (map the xs)\"\n\ndefinition\n \"load_list h n p \\ deoption_list (load_list_basic h n p)\"\n\nlemma length_load_list_basic [simp]:\n \"length (load_list_basic h sz p) = sz\"\n by (induct sz arbitrary: p, auto)\n\n\nsection \\Loading Objects from the Heap/Address Space\\\n\ntext \\Retrieving a stored value on the heap or addr\\_space\\\n(* FIXME: ugly return-type overloading, improve? *)\n\ndefinition\n load_value :: \"('a::semiring_1,'p) value_space \\ ('a,'p) addr_t \n \\ ('t::mem_type)\" where\n \"load_value h p \\ (case load_list h (size_of TYPE('t)) p \n of None \\ None\n | Some bs \\ Some (from_bytes bs))\"\n\n(* update form Hira: changed Option.map to map_option *)\nlemma load_value_def2:\n \"((load_value h p)::'t option) \\ map_option from_bytes (load_list h (size_of TYPE('t::mem_type)) p)\"\n by (auto intro!: eq_reflection simp: load_value_def split: option.splits)\n\ndefinition\n load_machine_word :: \"('a::semiring_1,'p) value_space \\ ('a,'p) addr_t \n \\ machine_word\" where\n \"load_machine_word \\ load_value\"\n\nsubsection \\Loading Objects After Unrelated Heap Updates\\\n\nlemma load_list_basic_update_eq:\n assumes p: \"p \\ set (addr_seq start sz)\"\n shows \"load_list_basic (h(p \\ v)) sz start = load_list_basic h sz start\"\n using p proof (induct sz arbitrary: start)\n case 0 thus ?case by simp\nnext\n case (Suc sz start)\n hence IH: \"p \\ set (addr_seq (start r+ 1) sz)\n \\ load_list_basic (h(p \\ v)) sz (start r+ 1) = \n load_list_basic h sz (start r+ 1)\"\n and ps: \"p \\ set (addr_seq start (Suc sz))\" by - assumption\n (*WTF:blast or simp don't work here? why?*)\n\n from ps have \"p \\ set (addr_seq (start r+ 1) sz)\" by auto\n\n hence \"load_list_basic (h(p \\ v)) sz (start r+ 1) = \n load_list_basic h sz (start r+ 1)\" using IH by simp\n\n moreover \n\n have \"(\\a. if a = p then Some v else h a) = h(p \\ v)\"\n by (rule ext, auto)\n\n moreover\n\n have \"p \\ start\" using ps\n proof -\n assume \"start = p\"\n hence \"p \\ set (addr_seq start (Suc sz))\" by simp\n qed (auto)\n\n ultimately show ?case by (clarsimp)\nqed\n\nlemma load_list_update_eq:\n \"\\ p \\ set (addr_seq start sz) \\\n \\ load_list (h(p \\ v)) sz start = load_list h sz start\"\n unfolding load_list_def deoption_list_def \n by (simp add: load_list_basic_update_eq)\n\nlemma load_value_update_eq:\n \"\\ p \\ set (addr_seq start (size_of TYPE('a::mem_type))) \\\n \\ load_value (h(p \\ v)) start = ((load_value h start)::'a option)\"\n unfolding load_machine_word_def load_value_def Let_def\n by (simp add: load_list_update_eq)\n\nlemma load_list_basic_nth [simp]:\n fixes p :: \"('a::len word,'b) addr_t\"\n shows \"i < sz \\ load_list_basic h sz p ! i = h (p r+ (of_nat i))\"\nproof (induct sz arbitrary: p i)\n case 0 thus ?case by simp\nnext\n case (Suc sz)\n thus ?case\n by (clarsimp simp: nth_Cons')\n (cases i, auto simp add: addr_add_def add_ac split: nat.split)\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Page_Tables/Heaps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832354982645, "lm_q2_score": 0.3522017820478897, "lm_q1q2_score": 0.1898308560364262}} {"text": "theory Read_Write_Tag_Ref\n\nimports Address_Translate_Tag_Ref\n\nbegin \n\nlemma mmu_write_rel:\n \"\\mmu_write_size (val,va, sz) s = ((), s')\\ \\ s' = s \\ non_det_tlb := non_det_tlb s' , MEM:= MEM s' , exception:= exception s' \\\"\n apply (clarsimp simp: mmu_write_size_non_det_tlb_state_ext_def Let_def, cases \"mmu_translate va s\", clarsimp split: if_split_asm)\n apply (drule write_mem_rel, cases \"mmu_translate va s\" , clarsimp)\n apply (drule mmu_rel, cases s, cases s', case_tac b, clarsimp)\n apply (clarsimp simp: mmu_translate_non_det_tlb_state_ext_def Let_def split: lookup_type.splits)\n by (clarsimp simp: Let_def raise'exception_def split:if_split_asm)+\n\n\nlemma mmu_write_tlb_disj:\n \"\\ mmu_write_size (val,va, sz) s = ((), s') \\ \\\n non_det_tlb s' = non_det_tlb s - tlb_evict (typ_non_det_tlb s) \\ \n non_det_tlb s' = non_det_tlb s - tlb_evict (typ_non_det_tlb s) \\ {the (pt_walk (non_det_asid s) (MEM s) (TTBR0 s) va)}\"\n apply (clarsimp simp: mmu_write_size_non_det_tlb_state_ext_def mmu_translate_non_det_tlb_state_ext_def split_def Let_def write_mem_eq_TLB raise'exception_def \n split: lookup_type.splits split: if_split_asm)\n apply (drule write_mem_eq_TLB state.defs)\n apply (cases s , cases s' ; clarsimp)\n apply (drule write_mem_eq_TLB state.defs)\n by(cases s , cases s' ; clarsimp)\n\n \nlemma mmu_write_det_rel:\n \"\\mmu_write_size (val,va, sz) s = ((), s')\\ \\ s' = s \\ det_tlb := det_tlb s' , MEM:= MEM s' , exception:= exception s' \\\"\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def Let_def, cases \"mmu_translate va s\", clarsimp split: if_split_asm)\n apply (drule write_mem_rel, cases \"mmu_translate va s\" , clarsimp)\n apply (drule mmu_det_rel, cases s, cases s', case_tac b, clarsimp)\n apply (clarsimp simp: mmu_translate_det_tlb_state_ext_def Let_def split: lookup_type.splits)\n by (clarsimp simp: Let_def raise'exception_def split:if_split_asm)+\n\n\nlemma mmu_write_tlb_disj_det:\n \"\\ mmu_write_size (val,va, sz) s = ((), s') \\ \\\n det_tlb s' = det_tlb s \\ det_tlb s' = det_tlb s \\ {the (pt_walk (det_asid s) (MEM s) (TTBR0 s) va)}\"\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def mmu_translate_det_tlb_state_ext_def split_def Let_def write_mem_eq_TLB raise'exception_def \n split: lookup_type.splits split: if_split_asm)\n apply (drule write_mem_eq_TLB state.defs)\n apply (cases s , cases s' ; clarsimp)\n apply (drule write_mem_eq_TLB state.defs)\n by(cases s , cases s' ; clarsimp)\n\n(**************************************************************)\n\n\nlemma mmu_write_tlb_subset_non_det_det:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t); consistent (typ_det_tlb t) va; \n mmu_write_size (val,va, sz) t = ((), t') \\ \\ non_det_tlb s' \\ det_tlb t'\"\n apply (frule tlb_rel_detD)\n apply (subgoal_tac \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (non_det_asid s) va \\ lookup'' (det_tlb t) (det_asid t) va\")\n prefer 2\n apply (simp add: sup.absorb1 asid_tlb_mono tlb_rel_det_def)\n apply (meson Diff_subset order_trans asid_tlb_mono)\n apply (frule mmu_write_tlb_disj)\n apply (frule mmu_write_tlb_disj_det)\n apply (erule disjE)\n apply (clarsimp simp: )\n apply blast\n apply (erule disjE)\n apply clarsimp\n apply (rule conjI)\n prefer 2\n apply blast\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def , cases \"mmu_translate va t\" , clarsimp split: if_split_asm)\n apply (clarsimp simp: mmu_translate_det_tlb_state_ext_def)\n apply (case_tac \"lookup'' (det_tlb t) (det_asid t) va\"; clarsimp simp: Let_def consistent0_def)\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply (clarsimp simp: write'mem1_def split: if_split_asm)\n apply (cases t, cases t', clarsimp simp: state.defs) apply force\n apply (cases t, cases t', clarsimp simp: state.defs) apply force\n apply (cases t, cases t', clarsimp simp: state.defs) apply force\n apply (cases t, cases t', clarsimp simp: state.defs) apply force\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply (cases t, cases t', clarsimp simp: state.defs) apply force\n using lookup_in_asid_tlb apply blast\n apply (clarsimp simp: mmu_translate_det_tlb_state_ext_def)\n apply (case_tac \"lookup'' (det_tlb t) (det_asid t) va\")\n apply (subgoal_tac \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (det_asid t) va = Miss\")\n prefer 2\n apply force\n apply (clarsimp simp: mmu_write_size_non_det_tlb_state_ext_def)\n apply (case_tac \"mmu_translate va s\", clarsimp)\n apply (clarsimp simp: mmu_translate_non_det_tlb_state_ext_def)\n apply (clarsimp simp: Let_def split: if_split_asm)\n apply (case_tac \"exception s = NoException\")\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply (thin_tac \"raise'exception (PAGE_FAULT ''more info'') t = (a, t')\")\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply (thin_tac \"raise'exception (PAGE_FAULT ''more info'') t = (a, t')\")\n apply (clarsimp simp: raise'exception_def split: if_split_asm)\n apply force\n apply force\n apply force\n apply (clarsimp simp: consistent0_def)\n apply (simp only: consistent0_def)\n apply (metis lookup_in_asid_tlb lookup_type.simps(5))\n apply clarsimp\n by blast\n\n\n\nlemma write_mem_non_det_det_MEM:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t) ; consistent (typ_det_tlb t) va; \n mmu_write_size (val,va, sz) t = ((), t') \\ \\ MEM s' = MEM t'\"\n apply (frule tlb_rel_detD)\n apply (clarsimp simp: mmu_write_size_non_det_tlb_state_ext_def , cases \"mmu_translate va s\" , clarsimp)\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def , cases \"mmu_translate va t\" , clarsimp)\n apply (clarsimp split: if_split_asm)\n apply (case_tac \"write'mem1 (val, aa, sz) ba\" , clarsimp)\n apply (subgoal_tac \"MEM b = MEM ba \\ aa = a\")\n using write_same_mem apply blast\n apply (rule conjI)\n apply (clarsimp simp: mmu_eq_asid_root_mem mmu_det_eq_asid_root_mem)\n apply (frule_tac s= \"(typ_non_det_tlb s)\" and va= \"va\" in tlb_rel_det_consistent, clarsimp)\n apply (subgoal_tac \"non_det_tlb s - tlb_evict (typ_non_det_tlb s) \\ non_det_tlb s\")\n prefer 2\n apply blast\n apply (subgoal_tac \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (non_det_asid s) va \\ lookup'' (det_tlb t) (det_asid t) va\")\n prefer 2\n apply (simp add: sup.absorb1 asid_tlb_mono tlb_rel_det_def)\n apply (clarsimp simp: mmu_translate_non_det_tlb_state_ext_def mmu_translate_det_tlb_state_ext_def split_def Let_def)\n apply (cases \"lookup'' (det_tlb t) (det_asid t) va\"; clarsimp)\n apply (clarsimp simp: tlb_rel_det_def Let_def raise'exception_def state.defs split: if_split_asm)\n apply (clarsimp simp: consistent0_def)\n apply (subgoal_tac \"x3 = the (pt_walk (non_det_asid s) (MEM s) (TTBR0 s) va)\")\n prefer 2\n apply (clarsimp simp: consistent0_def)\n apply (cases \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (non_det_asid s) va\"; clarsimp)\n apply (clarsimp simp: Let_def)\n apply (cases \"\\is_fault (pt_walk () (MEM s) (TTBR0 s) va)\")\n apply (clarsimp simp: tlb_rel_det_def typ_det_tlb_def typ_non_det_tlb_def state.defs lookup_in_asid_tlb raise'exception_def split: if_split_asm)\n apply (clarsimp simp: tlb_rel_det_def typ_det_tlb_def typ_non_det_tlb_def state.defs lookup_in_asid_tlb raise'exception_def split: if_split_asm)\n using mmu_translate_non_det_det_excp mmu_translate_non_det_det_pa apply fastforce\n using mmu_translate_non_det_det_excp mmu_translate_non_det_det_pa apply fastforce\n by (simp add: mmu_det_eq_asid_root_mem mmu_eq_asid_root_mem)\n\n \nlemma mmu_write_size_det_non_det_state_trun:\n \"\\mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_det(typ_non_det_tlb s) (typ_det_tlb t) ; consistent (typ_det_tlb t) va;\n mmu_write_size (val,va, sz) t = ((), t')\\ \\ state.truncate t' = state.truncate s' \\ det_asid t' = non_det_asid s'\"\n apply (frule (3) write_mem_non_det_det_MEM)\n apply (frule tlb_rel_detD, clarsimp)\n apply (frule mmu_write_rel)\n apply (rotate_tac)\n apply (frule mmu_write_det_rel)\n apply (clarsimp simp: tlb_rel_det_def)\n apply (subgoal_tac \"exception s' = exception t'\")\n apply (cases s, cases t, cases s' , cases t')\n apply (clarsimp simp: state.defs det_tlb_state.defs)\n apply (clarsimp simp: mmu_write_size_non_det_tlb_state_ext_def mmu_write_size_det_tlb_state_ext_def Let_def)\n apply (case_tac \"mmu_translate va t\" , case_tac \"write'mem1 (val, a, sz) b\" , clarsimp)\n apply (case_tac \"mmu_translate va s\" , clarsimp)\n apply (subgoal_tac \"exception b = exception bb \\ a = aa\")\n apply (clarsimp split: if_split_asm)\n apply (subgoal_tac \"MEM b = MEM bb \")\n apply (frule_tac s=\"bb\" and s'=\"s'\" and t = b and t' = t' in write_same_mem_excep ; clarsimp)\n apply (frule_tac s=\"s\" and s'=\"bb\" and t = t and t' = b and p' = aa in mmu_translate_non_det_det_mem_excp ; clarsimp simp: consistent0_def tlb_rel_det_def)\n apply (rule conjI)\n apply (frule_tac t= t and pa' = a and t' = b in mmu_translate_non_det_det_pa)\n apply (clarsimp simp: tlb_rel_det_def)\n apply (clarsimp simp: consistent0_def)\n apply (clarsimp simp: tlb_rel_det_def)\n apply (frule_tac s = \"s\" and s' = \"bb\" and t = \"t\" and t' = \"b\" in mmu_translate_non_det_det_excp ; clarsimp simp: tlb_rel_det_def)\n apply (subgoal_tac \"non_det_tlb s - tlb_evict (typ_non_det_tlb s) \\ non_det_tlb s\")\n prefer 2\n apply blast\n apply (subgoal_tac \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (non_det_asid s) va \\ lookup'' (det_tlb t) (det_asid t) va\")\n prefer 2\n apply (simp add: sup.absorb1 asid_tlb_mono tlb_rel_det_def)\n apply (clarsimp simp: mmu_translate_non_det_tlb_state_ext_def mmu_translate_det_tlb_state_ext_def split_def Let_def)\n apply (cases \"lookup'' (det_tlb t) (det_asid t) va\")\n apply clarsimp\n prefer 2\n apply (clarsimp simp: consistent0_def)\n apply (clarsimp simp: tlb_rel_det_def Let_def)\n apply (cases \"(is_fault (pt_walk (non_det_asid s) (MEM s) (TTBR0 s) va))\")\n apply (clarsimp simp: raise'exception_def state.defs split: if_split_asm)\n apply (clarsimp simp: lookup_def entry_set_def split: if_split_asm)\n apply clarsimp\n apply (subgoal_tac \"x3 = the (pt_walk (non_det_asid s) (MEM s) (TTBR0 s) va)\")\n prefer 2\n apply (clarsimp simp: consistent0_def)\n apply (cases \"lookup'' (non_det_tlb s - tlb_evict (typ_non_det_tlb s)) (non_det_asid s) va\"; clarsimp)\n by (clarsimp simp: Let_def consistent0_def)\n\n\n\nlemma mmu_write_non_det_det_refine:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t) ; consistent (typ_det_tlb t) va;\n mmu_write_size (val,va, sz) t = ((), t') \\ \\ tlb_rel_det (typ_non_det_tlb s') (typ_det_tlb t') \"\n apply (clarsimp simp: tlb_rel_det_def)\n apply (rule conjI)\n prefer 2 \n apply (frule_tac s = s and s' = s' and t = t and t' = t' in mmu_write_tlb_subset_non_det_det; clarsimp simp: tlb_rel_det_def)\n apply (frule_tac s = s and s' = s' and t = t and t' = t' in mmu_write_size_det_non_det_state_trun; clarsimp simp: tlb_rel_det_def)+\n done\n\n\n\nlemma mmu_write_saturated_state:\n \"\\mmu_write_size (val,va,sz) s = ((), t) \\ \\ saturated (typ_sat_tlb t)\"\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def Let_def)\n apply (case_tac \"mmu_translate va s\" , clarsimp)\n apply (clarsimp split: if_split_asm)\n apply (case_tac \"write'mem1 (val, a, sz) b\" , clarsimp)\n apply (subgoal_tac \"sat_asid s = sat_asid ba \\ TTBR0 s = TTBR0 ba \")\n apply (clarsimp simp: saturated_def)\n apply (subgoal_tac \" sat_asid s = sat_asid b \\ TTBR0 s = TTBR0 b\")\n apply clarsimp\n apply (clarsimp simp: write'mem1_def Let_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: raise'exception_def)\n apply (clarsimp simp: mmu_translate_sat_tlb_state_ext_def Let_def raise'exception_def split:lookup_type.splits if_split_asm)\n using mmu_translate_saturated_state surjective_pairing by blast\n\n\n\nlemma mmu_wrtie_sat_rel:\n \"\\mmu_write_size (val,va, sz) s = ((), s')\\ \\ \n s' = s \\ sat_tlb := sat_tlb s' , MEM:= MEM s' , exception:= exception s' \\\"\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\" , clarsimp)\n apply (clarsimp split: if_split_asm)\n apply (case_tac \" write'mem1 (val, a, sz) b\", clarsimp)\n apply (drule write_mem_rel)\n apply (drule mmu_sat_rel)\n apply (cases s, cases s', case_tac a, case_tac b, case_tac ba)\n apply clarsimp\n apply (clarsimp simp: mmu_translate_sat_tlb_state_ext_def Let_def split: lookup_type.splits)\n apply (clarsimp simp: raise'exception_def split:if_split_asm) \n by (clarsimp simp: raise'exception_def split:if_split_asm)\n\n\n\nlemma wrtie_mem_sat_tlbs:\n \"\\mmu_write_size (val,va, sz) s = ((), s') \\ \\\n sat_tlb s' = sat_tlb s \\ the `{e\\pt_walk (sat_asid s) (MEM s) (TTBR0 s) ` UNIV. \\ is_fault e} \\\n sat_tlb s' = sat_tlb s \\ the `{e\\pt_walk (sat_asid s) (MEM s) (TTBR0 s) ` UNIV. \\ is_fault e} \\ the `{e\\pt_walk (sat_asid s) (MEM s') (TTBR0 s') ` UNIV. \\ is_fault e}\"\n apply (cases \"exception (snd (mmu_translate va s)) \\ NoException\")\n apply (rule disjI1)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def Let_def)\n apply (case_tac \"mmu_translate va s\" , clarsimp)\n apply (clarsimp simp: mmu_translate_sat_tlb_union)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def Let_def)\n apply (case_tac \"mmu_translate va s \" , clarsimp)\n apply (case_tac \"write'mem1 (val, a, sz) b\" , clarsimp)\n apply (subgoal_tac \"sat_tlb ba = sat_tlb b\")\n apply (subgoal_tac \"sat_tlb b = sat_tlb s \\ the `{e\\pt_walk (sat_asid s) (MEM s) (TTBR0 s) ` UNIV. \\ is_fault e}\")\n apply (subgoal_tac \" TTBR0 ba = TTBR0 s\")\n apply clarsimp\n apply (subgoal_tac \" TTBR0 b = TTBR0 s\") \n apply (simp add: write_mem1_eq_ASID_TTBR0)\n apply (simp add: mmu_sat_eq_asid_root_mem)\n apply (clarsimp simp: mmu_translate_sat_tlb_union) \n apply (drule write_mem_eq_TLB)\n apply (case_tac ba , case_tac b ; clarsimp)\n done\n\n\nlemma mmu_write_tlb_subset:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t) ; consistent (typ_sat_tlb t) va ;\n mmu_write_size (val,va, sz) t = ((), t') \\ \\ \n det_tlb s' \\ sat_tlb t'\"\n apply (frule tlb_rel_satD)\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def , cases \"mmu_translate va s\" , clarsimp)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def , cases \"mmu_translate va t\" , clarsimp)\n apply (frule_tac t' = ba and s' = b and t = t and s = s and pa' = aa in mmu_translate_det_sat_subset_rel; simp?)\n apply (subgoal_tac \"det_tlb b = det_tlb s'\", clarsimp split: if_split_asm)\n apply (case_tac \"write'mem1 (val, aa, sz) ba\", clarsimp simp:)\n apply (subgoal_tac \"state.more bb = state.more ba\")\n apply force\n apply (drule write_mem_eq_TLB) \n apply (drule write_mem_eq_TLB)\n apply (clarsimp simp: typ_sat_tlb_def) apply force \n apply (case_tac \"write'mem1 (val, aa, sz) ba\", simp)\n apply (subgoal_tac \"state.more ba = state.more b\")\n apply force\n apply (drule write_mem_eq_TLB) \n apply (clarsimp simp: typ_sat_tlb_def)\n apply (clarsimp simp: typ_sat_tlb_def) apply force\n apply (clarsimp split: if_split_asm)\n apply (drule write_mem_eq_TLB)\n apply (cases s' , case_tac b, clarsimp simp:)\n apply (drule write_mem_eq_TLB)\n by (cases s' , case_tac b, clarsimp simp:)\n\n\nlemma mmu_write_det_sat_mem:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t) ; consistent (typ_sat_tlb t) va; \n mmu_write_size (val,va, sz) t = ((), t') \\ \\ MEM s' = MEM t'\"\n apply (frule tlb_rel_satD)\n apply (clarsimp simp: mmu_write_size_det_tlb_state_ext_def , cases \"mmu_translate va s\" , clarsimp)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def , cases \"mmu_translate va t\" , clarsimp)\n apply (subgoal_tac \"MEM ba = MEM b \\ exception ba = exception b\")\n prefer 2\n apply (frule_tac t = t and t' = ba in mmu_translate_non_det_sat_mem_excp; simp?)\n apply (subgoal_tac \"a = aa\")\n prefer 2\n apply (frule mmu_translate_non_det_sat_pa; simp)\n apply simp\n apply (clarsimp split: if_split_asm)\n apply (case_tac \"write'mem1 (val, aa, sz) ba\", simp)\n apply (frule_tac t = ba and t' = bb in write_same_mem, simp, simp)\n by (case_tac bb, cases t', simp)\n\n \n\nlemma mmu_write_size_det_sat_state_trunc:\n \"\\mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t) ; consistent (typ_sat_tlb t) va;\n mmu_write_size (val,va, sz) t = ((), t')\\ \\ state.truncate t' = state.truncate s' \\ det_asid s' = sat_asid t'\"\n apply (frule (3) mmu_write_det_sat_mem)\n apply (frule tlb_rel_satD, clarsimp)\n apply (frule mmu_write_det_rel)\n apply (rotate_tac)\n apply (frule mmu_wrtie_sat_rel)\n apply (clarsimp simp: tlb_rel_sat_def)\n apply (subgoal_tac \"exception s' = exception t'\")\n apply (cases s, cases t, cases s' , cases t')\n apply (clarsimp simp: state.defs)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def mmu_write_size_det_tlb_state_ext_def Let_def)\n apply (case_tac \"mmu_translate va t\" , case_tac \"write'mem1 (val, a, sz) b\" , clarsimp)\n apply (case_tac \"mmu_translate va s\" , clarsimp?)\n apply (subgoal_tac \"exception b = exception bb \\ a = aa\")\n apply (clarsimp split: if_split_asm)\n apply (subgoal_tac \"MEM b = MEM bb \")\n apply (frule_tac s=\"bb\" and s'=\"s'\" and t = b and t' = ba in write_same_mem_excep ; clarsimp?)\n apply (frule_tac s=\"s\" and s'=\"bb\" and t = t and t' = b and p' = aa in mmu_translate_non_det_sat_mem_excp ; clarsimp simp: consistent0_def tlb_rel_sat_def)\n apply (rule conjI)\n apply (frule_tac s = \"s\" and s' = \"bb\" and t = \"t\" and t' = \"b\" in mmu_translate_non_det_sat_excp ; clarsimp simp: tlb_rel_sat_def)\n by (frule_tac t= t and pa' = a and t' = b in mmu_translate_non_det_sat_pa ; clarsimp simp: tlb_rel_sat_def) +\n\n\n\nlemma mmu_write_det_sat_refine:\n \"\\ mmu_write_size (val,va, sz) s = ((), s'); tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t) ; consistent (typ_sat_tlb t) va;\n mmu_write_size (val,va, sz) t = ((), t') \\ \\ tlb_rel_sat (typ_det_tlb s') (typ_sat_tlb t') \"\n apply (clarsimp simp: tlb_rel_sat_def)\n apply (clarsimp simp: mmu_write_saturated_state )\n apply (rule conjI)\n prefer 2 \n apply (frule_tac s=\"s\" and s'=\"s'\" and t=\"t\" and t'=\"t'\" in mmu_write_tlb_subset; clarsimp simp: tlb_rel_sat_def)\n by (frule_tac s=\"s\" and s'=\"s'\" and t=\"t\" and t'=\"t'\" in mmu_write_size_det_sat_state_trunc; clarsimp simp: tlb_rel_sat_def)+\n\n\n(*\n\nlemma mmu_write_incon_set_rel:\n \"\\ saturated (typ_sat_tlb s) ; \n inconsistent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb t); incoherrent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb t); \n sat_asid s = sat_asid r; TTBR0 s = TTBR0 r\\ \\\n inconsistent_vaddrs (typ_sat_tlb (r\\sat_tlb := sat_tlb s \\ the ` {e \\ range (pt_walk (sat_asid r) (MEM q) (TTBR0 r)). \\ is_fault e}\\))\n \\ iset(set_tlb t) \\ incon_comp (sat_asid r) (sat_asid r) (MEM s) (MEM q) (TTBR0 r) (TTBR0 r)\"\n apply (clarsimp)\n apply (clarsimp simp: inconsistent_vaddrs_def incon_comp_def ptable_comp_def incoherrent_vaddrs_def)\n apply (erule disjE)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) \n apply (erule disjE) \n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) \n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"the (pt_walk (sat_asid r) (MEM q) (TTBR0 r) xc) = the (pt_walk (sat_asid r) (MEM q) (TTBR0 r) x)\")\n apply clarsimp\n using saturatd_lookup_hit_no_fault apply fastforce\n apply (frule asid_tlb_lookup_range_fault_pt_walk)\n apply (drule_tac x = x in bspec)\n using lookup_asid_tlb_hit_entry_range apply blast\n apply clarsimp\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp:)\n apply blast\n apply (clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon) by blast\n *)\n\n\n(*\nlemma mmu_write_asid_ptcomp_rel:\n \"\\saturated (typ_sat_tlb s) ; sat_asid t = set_asid r; set_asid r = sat_asid s; MEM t = MEM r; TTBR0 t = TTBR0 s ;\n inconsistent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb q) ; incoherrent_vaddrs (typ_sat_tlb s) \\ iset(set_tlb q)\\ \\\n incoherrent_vaddrs (typ_sat_tlb (t\\sat_tlb := sat_tlb s \\ the ` {e \\ range (pt_walk (sat_asid t) (MEM r) (TTBR0 t)). \\ is_fault e}\\)) \\ iset (set_tlb q) \\ \n incon_comp (sat_asid t) (sat_asid t) (MEM s) (MEM r) (TTBR0 t) (TTBR0 t)\"\n apply rule\n apply (clarsimp simp: incoherrent_vaddrs_def inconsistent_vaddrs_def )\n apply (drule lookup_asid_tlb_hit_union_cases')\n apply (erule disjE)\n apply (clarsimp simp: incon_comp_def ptable_comp_def Let_def) \n apply blast\n by (clarsimp simp: asid_tlb_lookup_miss_is_fault_intro)\n*)\n\n\nlemma mmu_write_incon_set_rel:\n \"\\ saturated (typ_sat_tlb s) ; \n inconsistent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb t); incoherrent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb t); \n sat_asid s = sat_asid r; TTBR0 s = TTBR0 r\\ \\\n inconsistent_vaddrs (typ_sat_tlb (r\\sat_tlb := sat_tlb s \\ the ` {e \\ range (pt_walk (sat_asid r) (MEM q) (TTBR0 r)). \\ is_fault e}\\))\n \\ iset(set_tlb t) \\ incon_comp (sat_asid r) (sat_asid r) (MEM s) (MEM q) (TTBR0 r) (TTBR0 r)\"\n apply (clarsimp)\n apply (clarsimp simp: inconsistent_vaddrs_def incon_comp_def ptable_comp_def incoherrent_vaddrs_def)\n apply (erule disjE)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) \n apply (erule disjE) \n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon) apply blast\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply clarsimp\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (erule disjE) \n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (subgoal_tac \"is_fault (pt_walk (sat_asid r) (MEM s) (TTBR0 r) x)\")\n apply blast\n apply (clarsimp simp:)\n apply (drule union_asid_tlb_incon_cases)\n apply (erule disjE, clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp)\n apply (subgoal_tac \"the (pt_walk (sat_asid r) (MEM q) (TTBR0 r) xc) = the (pt_walk (sat_asid r) (MEM q) (TTBR0 r) x)\")\n apply clarsimp\n using saturatd_lookup_hit_no_fault apply fastforce\n apply (frule asid_tlb_lookup_range_fault_pt_walk)\n apply (drule_tac x = x in bspec)\n using lookup_asid_tlb_hit_entry_range apply blast\n apply clarsimp\n apply (erule disjE, clarsimp simp: asid_tlb_lookup_range_pt_walk_not_incon)\n apply (erule disjE, clarsimp simp:)\n apply blast\n apply (clarsimp simp: saturated_def asid_tlb_lookup_range_pt_walk_not_incon) by blast\n\n \nlemma mmu_write_asid_ptcomp_rel:\n \"\\saturated (typ_sat_tlb s) ; sat_asid t = set_asid r; set_asid r = sat_asid s; MEM t = MEM r; TTBR0 t = TTBR0 s ;\n inconsistent_vaddrs (typ_sat_tlb s) \\ iset (set_tlb q) ; incoherrent_vaddrs (typ_sat_tlb s) \\ iset(set_tlb q)\\ \\\n incoherrent_vaddrs (typ_sat_tlb (t\\sat_tlb := sat_tlb s \\ the ` {e \\ range (pt_walk (sat_asid t) (MEM r) (TTBR0 t)). \\ is_fault e}\\)) \\ iset (set_tlb q) \\ \n incon_comp (sat_asid t) (sat_asid t) (MEM s) (MEM r) (TTBR0 t) (TTBR0 t)\"\n apply rule\n apply (clarsimp simp: incoherrent_vaddrs_def inconsistent_vaddrs_def )\n apply (drule lookup_asid_tlb_hit_union_cases')\n apply (erule disjE)\n apply (clarsimp simp: incon_comp_def ptable_comp_def Let_def) \n apply blast\n by (clarsimp simp: asid_tlb_lookup_miss_is_fault_intro)\n\n\n\nlemma mmu_write_sat_incon_refine: \n \"\\ mmu_write_size (val,va, sz) s = ((), s'); mmu_write_size (val,va, sz) t = ((), t'); va \\ iset(set_tlb t);\n tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t) \\ \\ \n tlb_rel_abs (typ_sat_tlb s') (typ_set_tlb t')\" \n apply (frule_tac s = s in tlb_rel_abs_consistent' ; clarsimp )\n apply (frule tlb_rel_absD' , clarsimp)\n apply (clarsimp simp: mmu_write_size_sat_tlb_state_ext_def mmu_write_size_set_tlb_state_ext_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\" , clarsimp)\n apply (frule_tac t=t and pa'= aa and t' = ba in mmu_translate_sat_incon_refine; clarsimp) \n apply (clarsimp simp: tlb_rel_abs_def)\n apply (subgoal_tac \"exception b = exception ba\")\n prefer 2 apply (case_tac b , case_tac ba , clarsimp simp: state.defs)\n apply (clarsimp split: if_split_asm)\n apply (case_tac \"write'mem1 (val, aa, sz) b \" , case_tac \"write'mem1 (val, aa, sz) ba\" , clarsimp simp: Let_def)\n apply (subgoal_tac \"state.truncate bb = state.truncate bc\")\n prefer 2 \n apply (meson write_mem_state_trun_equal)\n apply (rule conjI , clarsimp simp: state.defs)\n apply (subgoal_tac \"MEM bb = MEM bc \\ MEM s = MEM b\" , simp)\n apply (subgoal_tac \"sat_asid s = sat_asid b \\ TTBR0 s = TTBR0 b\" , simp)\n apply (subgoal_tac \"saturated (typ_sat_tlb b)\")\n prefer 2 apply blast\n prefer 2 apply (drule mmu_sat_eq_asid_root_mem) apply simp \n prefer 2\n apply (rule conjI)\n apply (clarsimp simp: state.defs)\n apply (drule mmu_sat_eq_asid_root_mem) apply simp \n apply (subgoal_tac \"set_asid t = set_asid bc \\ sat_asid b = sat_asid bb \\ TTBR0 b = TTBR0 bb\")\n prefer 2\n apply (rule conjI)\n apply (subgoal_tac \"set_asid t = set_asid ba \\ set_asid ba = set_asid bc\") \n apply presburger\n apply (rule conjI, drule mmu_incon_eq_asid_root_mem') \n apply presburger\n apply (clarsimp simp: write'mem1_def raise'exception_def split: if_split_asm)\n apply (clarsimp simp: write'mem1_def raise'exception_def split: if_split_asm)\n apply (simp only: incon_addrs_def)\n apply simp\n apply (rule conjI)\n apply (clarsimp simp: saturated_def)\n apply (rule conjI)\n apply (drule_tac s = b and t = ba and q = bc and r = bb in mmu_write_incon_set_rel; clarsimp simp:) \n apply (rule conjI)\n apply (frule_tac t = bb and r = bc and q = ba and s = b in mmu_write_asid_ptcomp_rel ; clarsimp simp:)\n apply (rule conjI) \n apply (simp only: global_entries_union)\n apply clarsimp\n apply blast\n apply (clarsimp simp: )\n apply (subgoal_tac \"sat_tlb b \\ the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e} =\n sat_tlb b \\ non_global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e}) \\ \n global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})\")\n prefer 2\n apply (metis (no_types) sup_assoc tlb_global_non_global_union)\n apply clarsimp\n apply (thin_tac \"sat_tlb b \\ the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e} =\n sat_tlb b \\ non_global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e}) \\ \n global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})\")\n apply (subgoal_tac \"lookup'' (non_global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})) a v = Miss\")\n prefer 2\n apply (clarsimp simp: asid_unequal_lookup_pt_walk_miss)\n apply (drule_tac t = \"sat_tlb b\" and t''' = \"global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})\" \n and t'' = \"global_entries (sat_tlb b \\ non_global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e}) \\ \n global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e}))\" in lookup_union_minus_equal)\n apply clarsimp\n apply (subgoal_tac \" global_entries (sat_tlb b \\ non_global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e}) \\ \n global_entries (the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})) =\n global_entries (sat_tlb b \\ the ` {e \\ range (pt_walk (set_asid bc) (MEM bc) (TTBR0 bb)). \\ is_fault e})\")\n prefer 2\n apply (clarsimp simp: global_entries_def non_global_entries_def) apply blast\n apply (clarsimp)\n apply (subgoal_tac \"sat_tlb b = sat_tlb s \\ set_tlb ba = set_tlb t\")\n prefer 2\n apply (clarsimp simp: mmu_translate_saturated_tlb_unchange mmu_translate_incon_unchange)\n apply clarsimp\n apply (clarsimp simp: global_entries_union)\n apply (clarsimp simp: Un_Diff)\n apply (simp only: set_double_minus [symmetric])\n apply clarsimp\n apply (drule_tac x = a in spec, clarsimp, drule_tac x = v in spec)\n apply (clarsimp simp: lookup_minus_smaller_order)\n done\n\n\n(* refinement for read theroems *)\n\nlemma mem_read1_consistent_tlb_rel_non_det_det:\n \" \\mem_read1 (a, sz) s = (val, s'); mem_read1 (a, sz) t = (val', t'); \n consistent0 (lookup'' (det_tlb t) (det_asid t)) (pt_walk (det_asid t) (MEM t) (TTBR0 t)) va; tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t)\\\n \\ consistent0 (lookup'' (det_tlb t') (det_asid t')) (pt_walk (det_asid t') (MEM t') (TTBR0 t')) va \\ tlb_rel_det (typ_non_det_tlb s') (typ_det_tlb t')\"\n apply (rule conjI)\n apply (subgoal_tac \"MEM t = MEM t' \\ TTBR0 t = TTBR0 t' \\ det_asid t = det_asid t' \\ det_tlb t = det_tlb t'\")\n apply (clarsimp simp: consistent0_def)\n prefer 2\n apply (subgoal_tac \" exception s' = exception t'\")\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (clarsimp simp: tlb_rel_det_def)\n apply (clarsimp simp: saturated_def state.truncate_def)\n apply (cases s', cases t')\n apply clarsimp\n apply (subgoal_tac \"MEM s = MEM t \\ exception s = exception t\")\n apply (thin_tac \"tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t)\")\n apply (clarsimp simp: mem_read1_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n subgoal\n by (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: tlb_rel_det_def state.defs)\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (cases t, cases t' , clarsimp)\n done\n\n\n\n\nlemma mem_read1_consistent_tlb_rel_det_sat:\n \" \\mem_read1 (a, sz) s = (val, s'); mem_read1 (a, sz) t = (val', t'); \n consistent0 (lookup'' (sat_tlb t) (sat_asid t)) (pt_walk (sat_asid t) (MEM t) (TTBR0 t)) va; tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t)\\\n \\ consistent0 (lookup'' (sat_tlb t') (sat_asid t')) (pt_walk (sat_asid t') (MEM t') (TTBR0 t')) va \\ tlb_rel_sat (typ_det_tlb s') (typ_sat_tlb t')\"\n apply (rule conjI)\n apply (subgoal_tac \"MEM t = MEM t' \\ TTBR0 t = TTBR0 t' \\ sat_asid t = sat_asid t' \\ sat_tlb t = sat_tlb t'\")\n apply (clarsimp simp: consistent0_def)\n prefer 2\n apply (subgoal_tac \" exception s' = exception t'\")\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (clarsimp simp: tlb_rel_sat_def)\n apply (clarsimp simp: saturated_def state.truncate_def)\n apply (cases s', cases t')\n apply clarsimp\n apply (subgoal_tac \"MEM s = MEM t \\ exception s = exception t\") \n apply (thin_tac \"tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t)\")\n apply (clarsimp simp: mem_read1_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n subgoal\n by (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: tlb_rel_sat_def state.defs)\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (cases t, cases t' , clarsimp)\n done\n\n\nlemma mmu_read_non_det_det_rel_cons:\n \"\\ mmu_read_size (va, sz) s = (val, s'); tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t);\n consistent (typ_det_tlb t) va; mmu_read_size (va, sz) t = (val', t') \\ \\ \n consistent (typ_det_tlb t') va \\ tlb_rel_det (typ_non_det_tlb s') (typ_det_tlb t') \"\n apply (clarsimp simp: mmu_read_size_det_tlb_state_ext_def mmu_read_size_non_det_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (drule_tac t = t in mmu_translate_non_det_det_refine ; clarsimp simp: Let_def mem_read1_consistent_tlb_rel_non_det_det)\n done\n\n\nlemma mmu_read_det_sat_rel_cons:\n \"\\ mmu_read_size (va, sz) s = (val, s'); tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t);\n consistent (typ_sat_tlb t) va; mmu_read_size (va, sz) t = (val', t') \\ \\ \n consistent (typ_sat_tlb t') va \\ tlb_rel_sat (typ_det_tlb s') (typ_sat_tlb t') \"\n apply (clarsimp simp: mmu_read_size_sat_tlb_state_ext_def mmu_read_size_det_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (drule_tac t = t in mmu_translate_det_sat_refine ; clarsimp simp: Let_def mem_read1_consistent_tlb_rel_det_sat)\n done\n\nlemma same_mem_read_equal:\n \"\\MEM s = MEM t; mem_read1 (pa, sz) s = (val, s'); mem_read1 (pa, sz) t = (val', t') \\ \\ val = val'\"\n apply (clarsimp simp: mem_read1_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n subgoal\n by (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: raise'exception_def split: option.splits if_split_asm)\n done\n\n\nlemma mmu_read_non_det_det_refine:\n \"\\mmu_read_size (va, sz) s = (val, s'); mmu_read_size (va, sz) t = (val', t'); \n tlb_rel_det (typ_non_det_tlb s) (typ_det_tlb t); consistent (typ_det_tlb t) va\\ \\ \n val = val' \\ tlb_rel_det (typ_non_det_tlb s') (typ_det_tlb t') \\ consistent (typ_det_tlb t') va \"\n apply (rule conjI)\n apply (clarsimp simp: mmu_read_size_det_tlb_state_ext_def mmu_read_size_non_det_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (rename_tac pa s'' pa' t'')\n apply (subgoal_tac \"pa = pa'\", clarsimp)\n apply (subgoal_tac \"MEM s'' = MEM t''\")\n apply (clarsimp simp: same_mem_read_equal)\n using mmu_det_eq_asid_root_mem mmu_eq_asid_root_mem tlb_rel_detD apply fastforce \n using det_tlb_more mmu_translate_non_det_det_pa apply fastforce\n by (frule_tac t = t and t' =t' in mmu_read_non_det_det_rel_cons; simp?)\n\n\nlemma mmu_read_non_det_sat_refine:\n \"\\mmu_read_size (va, sz) s = (val, s'); mmu_read_size (va, sz) t = (val', t'); \n tlb_rel_sat (typ_det_tlb s) (typ_sat_tlb t); consistent (typ_sat_tlb t) va\\ \\ \n val = val' \\ tlb_rel_sat (typ_det_tlb s') (typ_sat_tlb t') \\ consistent (typ_sat_tlb t') va \"\n apply (rule conjI)\n apply (clarsimp simp: mmu_read_size_det_tlb_state_ext_def mmu_read_size_sat_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (rename_tac pa s'' pa' t'')\n apply (subgoal_tac \"pa = pa'\", clarsimp)\n apply (subgoal_tac \"MEM s'' = MEM t''\") \n apply (clarsimp simp: same_mem_read_equal) \n using mmu_det_eq_asid_root_mem mmu_sat_eq_asid_root_mem tlb_rel_satD apply fastforce\n apply (simp add: mmu_translate_non_det_sat_pa)\n apply (frule_tac t = t and t' =t' in mmu_read_det_sat_rel_cons; simp?)\n done\n\n\nlemma mmu_read_sat_const_inter [simp]:\n \"saturated (typ_sat_tlb s) \\ sat_tlb (snd (mmu_read_size v s)) = sat_tlb s \"\n by (clarsimp simp: mmu_read_size_sat_tlb_state_ext_def split_def Let_def\n mem_read1_def raise'exception_def split: if_split_asm)\n \n\nlemma mem_read1_consistent_tlb_rel_incon:\n \"\\mem_read1 (a, sz) s = (val, s'); mem_read1 (a, sz) t = (val', t'); \n va \\ iset (set_tlb t); tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t)\\\n \\ va \\ iset(set_tlb t') \\ tlb_rel_abs (typ_sat_tlb s') (typ_set_tlb t')\"\n apply (rule conjI)\n apply (subgoal_tac \"set_tlb t = set_tlb t'\")\n apply clarsimp\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (cases t, cases t')\n apply clarsimp\n apply (subgoal_tac \"exception s' = exception t'\")\n apply (drule mem1_read_exception)\n apply (drule mem1_read_exception)\n apply (clarsimp simp: tlb_rel_abs_def)\n apply (rule conjI)\n apply (clarsimp simp: state.defs)\n apply (cases s', cases t')\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: state.defs)\n apply (cases s', cases t')\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: saturated_def)\n apply (rule conjI)\n apply (clarsimp simp: incon_addrs_def inconsistent_vaddrs_def incoherrent_vaddrs_def)\n apply (cases s', cases t')\n apply clarsimp \n apply (rule conjI)\n apply (cases t, cases t')\n apply (clarsimp)\n apply clarsimp\n apply (subgoal_tac \"set_tlb t' = set_tlb t\")\n apply clarsimp\n apply (cases t, cases t')\n apply clarsimp\n apply (subgoal_tac \"MEM s = MEM t \\ exception s = exception t\")\n apply (thin_tac \" va \\ iset(set_tlb t)\") \n apply (thin_tac \" tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t)\")\n apply (clarsimp simp: mem_read1_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n subgoal\n by (clarsimp simp: mem1_def raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: raise'exception_def split: option.splits if_split_asm)\n apply (clarsimp simp: tlb_rel_abs_def state.defs)\n done\n\n\nlemma mmu_read_sat_incon_rel_con:\n \"\\ mmu_read_size (va, sz) s = (val, s'); tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t);\n va \\ iset (set_tlb t); mmu_read_size (va, sz) t = (val', t') \\ \\ \n va \\ iset(set_tlb t') \\ tlb_rel_abs (typ_sat_tlb s') (typ_set_tlb t') \"\n apply (clarsimp simp: mmu_read_size_sat_tlb_state_ext_def mmu_read_size_set_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (drule_tac t = t and pa' = aa and t' = ba in mmu_translate_sat_incon_refine ; clarsimp simp: Let_def mem_read1_consistent_tlb_rel_incon)\n done\n\n\nlemma mmu_read_sat_incon_refine:\n \"\\ mmu_read_size (va, sz) s = (val, s'); mmu_read_size (va, sz) t = (val', t');\n tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t); va \\ iset (set_tlb t) \\ \\ \n val = val' \\ tlb_rel_abs (typ_sat_tlb s') (typ_set_tlb t') \\ va \\ iset(set_tlb t')\"\n apply (rule conjI)\n apply (clarsimp simp: mmu_read_size_sat_tlb_state_ext_def mmu_read_size_set_tlb_state_ext_def Let_def)\n apply (cases \"mmu_translate va s\", cases \"mmu_translate va t\", clarsimp)\n apply (rename_tac pa s'' pa' t'')\n apply (subgoal_tac \"pa = pa'\", clarsimp)\n apply (subgoal_tac \"MEM s'' = MEM t''\")\n apply (clarsimp simp: same_mem_read_equal)\n using mmu_translate_sat_incon_mem_excp apply force\n using mmu_translate_sat_incon_refine apply force\n by (frule_tac t = t and t' = t' in mmu_read_sat_incon_rel_con; simp)\n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_ASID/Read_Write_Tag_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3522017820478896, "lm_q1q2_score": 0.1898308508201133}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__52_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__52_on_rules imports n_german_lemma_on_inv__52\nbegin\nsection{*All lemmas on causal relation between inv__52*}\nlemma lemma_inv__52_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__52 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__52) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__52_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.18983084560380048}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__159.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__159 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__159 and some rule r*}\nlemma n_PI_Remote_GetVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__159:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__159:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__159:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__159:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__159:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__159:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__159:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__159:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__159:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__159:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__159:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__159:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__159 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__159:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__159:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__159:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__159:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__159:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__159:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__159:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__159:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__159:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__159:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__159:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__159:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__159:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__159:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__159:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__159:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__159:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__159.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.18949865165309507}} {"text": "theory extra\nimports crdt_specs\nbegin\n\nsection \\Extra Material\\\n\ntext \\Some checks for the text.\\\n\nlemma set_rw_spec_Contains:\n(*and \"trans (happensBefore ctxt)\"\n and \"irrefl (happensBefore ctxt)\"\n and \"Field (happensBefore ctxt) \\ dom (calls ctxt)\"\n and \"finite (dom (calls ctxt))\" *)\n shows \"\\(ctxt::('a setOp, 'b::{from_bool}) operationContext) res.\nset_rw_spec (Contains x) ctxt res\n\\ res \\ from_bool ((\\a. Op ctxt a \\ Add x)\n \\ (\\r. Op ctxt r \\ Remove x\n \\ (\\a. Op ctxt a \\ Add x\n \\ (r,a)\\happensBefore ctxt)))\"\nproof -\n define ctxt :: \"('a setOp, 'b) operationContext\" where \n \"ctxt = \\calls = (\\c. Some (Call (Add x) ???)),\n happensBefore = {(CallId x, CallId y) | x y. x < y}\\\"\n\n show ?thesis\n proof (intro exI conjI)\n\n show \"set_rw_spec (Contains x) ctxt (from_bool False)\"\n proof (auto simp add: set_rw_spec_def set_spec_def flag_dw_spec_def intro!: arg_cong[where f=from_bool])\n assume \"Enable \\ latestOps (restrict_ctxt_op (set_to_flag x) ctxt)\"\n and \"Disable \\ latestOps (restrict_ctxt_op (set_to_flag x) ctxt)\"\n have \"latestOps (restrict_ctxt_op (set_to_flag x) ctxt) = {}\"\n apply (auto simp add: latestOps_def restrict_ctxt_op_def restrict_ctxt_def ctxt_def restrict_hb_def cOp_def fmap_map_values_def set_to_flag_def restrict_relation_def split: option.splits)\n by (metis callId.exhaust gt_ex)\n\n with `Enable \\ latestOps (restrict_ctxt_op (set_to_flag x) ctxt)`\n show False\n by auto\n qed\n\n have no_remove: \"Op ctxt r \\ Some (Remove x)\" for r\n by (auto simp add: ctxt_def cOp_def)\n\n have \"((\\a. Op ctxt a \\ Add x) \\\n (\\r. Op ctxt r \\ Remove x \\ (\\a. Op ctxt a \\ Add x \\ (r, a) \\ happensBefore ctxt)))\"\n proof (intro conjI impI allI exI)\n show \"Op ctxt (CallId 0) \\ Add x\"\n by (simp add: cOp_def ctxt_def)\n qed (simp add: no_remove)+\n\n thus \"from_bool False \\\n from_bool\n ((\\a. Op ctxt a \\ Add x) \\\n (\\r. Op ctxt r \\ Remove x \\ (\\a. Op ctxt a \\ Add x \\ (r, a) \\ happensBefore ctxt)))\"\n using from_bool_eq_simp by auto\n qed\nqed\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/extra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3593641451601019, "lm_q1q2_score": 0.18949865165309504}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__33_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__33_on_rules imports n_germanSimp_lemma_on_inv__33\nbegin\nsection{*All lemmas on causal relation between inv__33*}\nlemma lemma_inv__33_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__33) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__33_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3702253856469203, "lm_q1q2_score": 0.1894504773185323}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__27_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__27_on_rules imports n_german_lemma_on_inv__27\nbegin\nsection{*All lemmas on causal relation between inv__27*}\nlemma lemma_inv__27_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__27) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__27_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.34158249273565866, "lm_q1q2_score": 0.18939740859904974}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__40.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__40 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__40 and some rule r*}\nlemma n_SendInv__part__0Vsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__40:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__40 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__40:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__40:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__40:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__40:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__40:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__40:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__40 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__40.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.34864512179822543, "lm_q1q2_score": 0.1892666406384999}} {"text": "(*\n * Copyright 2017, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n\n * @TAG(DATA61_BSD)\n *)\n\ntheory EChronos_arm_sched_prop_stack_invs\n\nimports\n EChronos_arm_sched_prop_tactic\nbegin\n\ndefinition\n schedule\nwhere\n \"schedule \\\n \\True\\\n \\nextT := None;;\n \\\\nextT = None\\\n WHILE \\nextT = None\n INV \\\\nextT=None \\ ((\\n. \\nextT=Some n \\ n\\U))\\\n DO\n \\True\\\n \\E_tmp := \\E;;\n \\True\\\n \\R := handle_events \\E_tmp \\R;;\n \\True\\\n \\E := \\E - \\E_tmp;;\n \\True\\\n \\nextT := sched_policy(\\R)\n OD\"\n\ndefinition\n context_switch\nwhere\n \"context_switch preempt_enabled \\\n \\\\n. \\nextT = Some n \\ n \\ U\\\n \\contexts := \\contexts (\\curUser \\ (preempt_enabled, \\ATStack));;\n \\\\n. \\nextT = Some n \\ n \\ U\\\n \\curUser := the \\nextT;;\n \\\\curUser \\ U\\\n \\ATStack := snd (the (\\contexts (\\curUser)));;\n \\True\\\n IF fst (the (\\contexts (\\curUser)))\n THEN \\True\\ \\svc\\<^sub>aEnable\\\n ELSE \\True\\ \\svc\\<^sub>aDisable\\ FI\"\n\ndefinition\n eChronos_arm_sched_prop_stack_invs_prog\nwhere\n \"eChronos_arm_sched_prop_stack_invs_prog \\\n (hardware_init,,\n eChronos_init,,\n (COBEGIN\n (* svc\\<^sub>a_take *)\n \\True\\\n WHILE True INV \\True\\\n DO\n \\True\\ svc\\<^sub>aTake\n OD\n \\False\\\n\n \\\n\n (* svc\\<^sub>a *)\n \\True\\\n WHILE True INV \\True\\\n DO\n add_await_routine svc\\<^sub>a (\n \\True\\\n \\ghostP := True;;\n add_inv_assn_com \\\\ghostP \\ svc\\<^sub>a \\ set (\\AT # \\ATStack)\\ (\n schedule;;\n context_switch True;;\n \\True\\\n \\\\ghostP := False,, IRet\\))\n OD\n \\False\\\n\n \\\n\n (* svc\\<^sub>s *)\n \\True\\\n WHILE True INV \\True\\\n DO\n add_await_routine svc\\<^sub>s (\n \\True\\\n \\ghostS := True;;\n add_inv_assn_com \\\\ghostS \\ svc\\<^sub>s \\ set (\\AT # \\ATStack)\\ (\n schedule;;\n context_switch False;;\n \\True\\\n \\\\ghostS := False,, IRet\\))\n OD\n \\False\\\n\n \\\n\n SCHEME [user0 \\ i < user0 + nbRoutines]\n \\\\ghostU i = User\\ IF (i\\I) THEN\n\n (* Interrupts *)\n \\i\\I\\\n WHILE True INV \\i\\I\\\n DO\n \\i\\I\\\n ITake i;;\n\n (add_await_routine i (\n add_inv_assn_com\n \\i\\I\\ (\n \\True\\\n \\E :\\ {E'. \\E \\ E'};;\n\n \\True\\\n svc\\<^sub>aRequest;;\n\n \\True\\\n \\IRet\\)))\n OD\n\n ELSE\n (* Users *)\n add_inv_assn_com\n \\i \\ U\\ (\n \\\\ghostU i = User\\\n WHILE True INV \\\\ghostU i = User\\\n DO\n (add_await_routine i (\n \\\\ghostU i = User\\\n \\userSyscall :\\ {SignalSend, Block};;\n\n \\\\ghostU i = User\\\n IF \\userSyscall = SignalSend\n THEN\n \\\\ghostU i = User\\\n \\\\ghostU := \\ghostU (i := Syscall),, svc\\<^sub>aDisable\\;;\n\n add_inv_assn_com\n \\\\ghostU i = Syscall\\ (\n \\True\\\n \\R :\\ {R'. \\i. \\R i = Some True \\ R' i = Some True};;\n\n \\True\\\n svc\\<^sub>aRequest;;\n\n \\True\\\n \\svc\\<^sub>aEnable,, \\ghostU := \\ghostU (i := User)\\);;\n \\\\ghostU i = User\\\n WHILE \\svc\\<^sub>aReq INV \\\\ghostU i = User\\\n DO\n \\\\ghostU i = User\\ SKIP\n OD\n ELSE \\\\ghostU i = User\\ IF \\userSyscall = Block\n THEN\n \\\\ghostU i = User\\\n \\\\ghostU := \\ghostU (i := Syscall),, svc\\<^sub>aDisable\\;;\n\n \\\\ghostU i = Syscall\\\n \\R := \\R (i := Some False);;\n\n \\\\ghostU i = Syscall\\\n \\\\ghostU := \\ghostU (i := Yield),, SVC\\<^sub>s_now\\;;\n\n \\\\ghostU i = Yield\\\n \\ghostU := \\ghostU (i := Syscall);;\n\n \\\\ghostU i = Syscall\\\n \\svc\\<^sub>aEnable,, \\ghostU := \\ghostU (i := User)\\;;\n \\\\ghostU i = User\\\n WHILE \\svc\\<^sub>aReq INV \\\\ghostU i = User\\\n DO\n \\\\ghostU i = User\\ SKIP\n OD\n FI FI))\n OD)\n FI\n \\False\\\n COEND))\"\n\n(*--------------------------------------------------------------------------*)\nsubsection \\The proof\\\n\nlemmas eChronos_arm_sched_prop_stack_invs_prog_defs =\n eChronos_arm_sched_prop_base_defs\n eChronos_arm_sched_prop_stack_invs_prog_def\n schedule_def context_switch_def\n\nlemma eChronos_arm_sched_prop_stack_invs_proof:\n \"0 0 < nbInts \\\n \\True\\\n \\-\\<^sub>i \\\\priority_inv \\ \\last_stack_inv \\\n (\\i \\ U. \\j \\ U. snd (the (\\contexts i)) = [j])\\ \\True\\\n eChronos_arm_sched_prop_stack_invs_prog\n \\False\\\"\n unfolding eChronos_arm_sched_prop_stack_invs_prog_defs\n unfolding inv_defs oghoare_inv_def\n apply (simp add: add_inv_aux_def o_def\n cong: Collect_cong\n del: last.simps butlast.simps (*upt_Suc*))\n apply oghoare\n(*661*)\n\napply (find_goal \\succeeds \\rule subsetI[where A=UNIV]\\\\)\n subgoal\n(* invariant is true initially *)\napply clarify\napply (erule notE)\n(*the next line takes about 10 minutes*)\napply clarsimp\napply (rule conjI)\n apply (case_tac \"nbRoutines - Suc (Suc 0)=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply clarsimp\napply (case_tac \"i=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc 0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc (Suc 0)\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (clarsimp simp: handle_events_empty user0_is_highest)\ndone\n\n apply (tactic \\fn thm => if Thm.nprems_of thm > 0 then\n let val ctxt = @{context}\n val clarsimp_ctxt = (ctxt\n addsimps @{thms Int_Diff card_insert_if\n insert_Diff_if Un_Diff interrupt_policy_I\n handle_events_empty helper16\n helper18 interrupt_policy_self\n user0_is_highest\n interrupt_policy_mono sorted_by_policy_svc\\<^sub>a\n helper21 helper22 helper25}\n delsimps @{thms disj_not1}\n addSIs @{thms last_tl'})\n\n val clarsimp_ctxt2 = (ctxt\n addsimps @{thms neq_Nil_conv\n interrupt_policy_svc\\<^sub>a'\n interrupt_policy_svc\\<^sub>s'\n interrupt_policy_U helper25\n handle_events_empty}\n delsimps @{thms disj_not1}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n val clarsimp_ctxt3 = (put_simpset HOL_basic_ss ctxt)\n\n val fastforce_ctxt = (ctxt\n addsimps @{thms sorted_by_policy_svc\\<^sub>s_svc\\<^sub>a sched_policy_Some_U\n interrupt_policy_U last_tl\n helper26 sorted_by_policy_svc\\<^sub>a''}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n in\n timeit (fn _ => Cache_Tactics.PARALLEL_GOALS_CACHE 51 ((TRY' o SOLVED' o DETERM') (\n ((set_to_logic ctxt\n THEN_ALL_NEW svc_commute ctxt\n THEN_ALL_NEW (((fn tac => fn i => DETERM (tac i))\n (TRY_EVERY_FORWARD' ctxt\n @{thms helper29 helper30\n sorted_by_policy_U\n sorted_by_policy_svc\\<^sub>a_single\n sorted_by_policy_svc\\<^sub>s_single\n sorted_by_policy_U_single\n sched_picks_user\n set_tl\n sorted_by_policy_empty'})\n THEN'\n ((TRY' o REPEAT_ALL_NEW)\n (FORWARD (dresolve_tac ctxt\n @{thms helper21' helper27' helper28'})\n ctxt)))\n THEN' (TRY' (clarsimp_tac clarsimp_ctxt3))\n THEN' (TRY' (\n SOLVED' (fn i => fn st => timed_tac 5 ctxt st\n (Blast.depth_tac ctxt 3 i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt st (clarsimp_tac clarsimp_ctxt i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt2 st (clarsimp_tac clarsimp_ctxt2 i st))\n ORELSE' SOLVED' (clarsimp_tac (ctxt delsimps @{thms disj_not1}\n |> Splitter.add_split @{thm if_split_asm}) THEN_ALL_NEW\n (fn i => fn st => timed_tac 20 fastforce_ctxt st (fast_force_tac fastforce_ctxt i st)))\n )))\n ))) 1)\n thm |> Seq.pull |> the |> fst |> Seq.single) end\n else Seq.empty\\)\n (*221.173s elapsed time, 491.464s cpu time, 50.760s GC time*)\ndone\n\nlemma eChronos_arm_sched_prop_ghostP_S_stack_inv_proof:\n \"0 0 < nbInts \\\n \\\\priority_inv \\ \\last_stack_inv \\\n (\\i \\ U. \\j \\ U. snd (the (\\contexts i)) = [j])\\\n \\-\\<^sub>i \\\\ghostP_S_stack_inv\\ \\True\\\n eChronos_arm_sched_prop_stack_invs_prog\n \\False\\\"\n unfolding eChronos_arm_sched_prop_stack_invs_prog_defs\n unfolding inv_defs oghoare_inv_def\n apply (simp add: add_inv_aux_def o_def\n cong: Collect_cong\n del: last.simps butlast.simps (*upt_Suc*))\n apply oghoare\n(*661*)\n\napply (find_goal \\succeeds \\rule subsetI[where A=UNIV]\\\\)\n subgoal\n(* invariant is true initially *)\napply clarify\napply (erule notE)\napply clarsimp\napply (rule conjI)\n apply (case_tac \"nbRoutines - Suc (Suc 0)=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply clarsimp\napply (case_tac \"i=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc 0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc (Suc 0)\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (clarsimp simp: handle_events_empty user0_is_highest)\ndone\n\n apply (tactic \\fn thm => if Thm.nprems_of thm > 0 then\n let val ctxt = @{context}\n val clarsimp_ctxt = (ctxt\n addsimps @{thms Int_Diff card_insert_if\n insert_Diff_if Un_Diff interrupt_policy_I\n handle_events_empty helper16\n helper18 interrupt_policy_self\n user0_is_highest\n interrupt_policy_mono sorted_by_policy_svc\\<^sub>a\n helper21 helper22 helper25}\n delsimps @{thms disj_not1}\n addSIs @{thms last_tl'})\n\n val clarsimp_ctxt2 = (ctxt\n addsimps @{thms neq_Nil_conv\n interrupt_policy_svc\\<^sub>a'\n interrupt_policy_svc\\<^sub>s'\n interrupt_policy_U helper25\n handle_events_empty}\n delsimps @{thms disj_not1}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n val clarsimp_ctxt3 = (put_simpset HOL_basic_ss ctxt)\n\n val fastforce_ctxt = (ctxt\n addsimps @{thms sorted_by_policy_svc\\<^sub>s_svc\\<^sub>a sched_policy_Some_U\n interrupt_policy_U last_tl\n helper26 sorted_by_policy_svc\\<^sub>a''}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n in\n timeit (fn _ => Cache_Tactics.PARALLEL_GOALS_CACHE 61 ((TRY' o SOLVED' o DETERM') (\n ((set_to_logic ctxt\n THEN_ALL_NEW svc_commute ctxt\n THEN_ALL_NEW (((fn tac => fn i => DETERM (tac i))\n (TRY_EVERY_FORWARD' ctxt\n @{thms helper29 helper30\n sorted_by_policy_U\n sorted_by_policy_svc\\<^sub>a_single\n sorted_by_policy_svc\\<^sub>s_single\n sorted_by_policy_U_single\n sched_picks_user\n set_tl\n sorted_by_policy_empty'})\n THEN'\n ((TRY' o REPEAT_ALL_NEW)\n (FORWARD (dresolve_tac ctxt\n @{thms helper21' helper27' helper28'})\n ctxt)))\n THEN' (TRY' (clarsimp_tac clarsimp_ctxt3))\n THEN' (TRY' (\n SOLVED' (fn i => fn st => timed_tac 5 ctxt st\n (Blast.depth_tac ctxt 3 i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt st (clarsimp_tac clarsimp_ctxt i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt2 st (clarsimp_tac clarsimp_ctxt2 i st))\n ORELSE' SOLVED' (clarsimp_tac (ctxt delsimps @{thms disj_not1}\n |> Splitter.add_split @{thm if_split_asm}) THEN_ALL_NEW\n (fn i => fn st => timed_tac 20 fastforce_ctxt st (fast_force_tac fastforce_ctxt i st)))\n )))\n ))) 1)\n thm |> Seq.pull |> the |> fst |> Seq.single) end\n else Seq.empty\\)\n (*149.959s elapsed time, 414.808s cpu time, 60.468s GC time*)\ndone\n\nend\n", "meta": {"author": "echronos", "repo": "echronos-proofs", "sha": "5983821e591c6878f1fe96aa831e11c5c97ce385", "save_path": "github-repos/isabelle/echronos-echronos-proofs", "path": "github-repos/isabelle/echronos-echronos-proofs/echronos-proofs-5983821e591c6878f1fe96aa831e11c5c97ce385/verif/EChronos_arm_sched_prop_stack_invs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.36658974324230986, "lm_q1q2_score": 0.18902097251552177}} {"text": "(* Title: HOL/Auth/n_deadlock_lemma_on_inv__1.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_on_inv__1 imports n_deadlock_base\nbegin\nsection{*All lemmas on causal relation between inv__1 and some rule r*}\nlemma n_TryVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv3)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_on_inv__1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.35577490717496246, "lm_q1q2_score": 0.18899096550251812}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory TransS\nimports\n \"BilbyFsConsts.BilbyFs_Shallow_Desugar_Tuples\"\n \"BilbyFsConsts.BilbyFs_ShallowConsts_Desugar_Tuples\"\n \"../spec/OstoreInvS\"\nbegin\n\nlemma pTrans_remainder:\n \"prod.fst (pTrans buf) = drop (trans_len buf) buf\"\n apply (induct buf rule:trans_len.induct)\n apply simp\n apply (rename_tac v va)\n apply (case_tac \"trans\\<^sub>f (pObj (v # va) 0) = bilbyFsTransIn\")\n apply (clarsimp simp: Let_def is_valid_ObjTrans)\n apply (rule conjI)\n apply (fastforce simp: trans_len_Cons bilbyFsObjHeaderSize_def )\n apply (clarsimp simp: trans_len_Cons drop_n_ge_0 prod.case_eq_if)\n apply (rule_tac f=\"\\a. drop a (v#va)\" in arg_cong, fastforce)\n apply (fastforce simp: Let_def trans_len_Cons bilbyFsObjHeaderSize_def is_valid_ObjTrans)\n done\n\nlemma list_trans_not_Nil_Nil:\n \"xs \\ [] \\\n list_trans xs \\ ([],[])\"\n by (simp split: list.splits prod.splits)\n\nlemma prefix_n_takeD:\n \"prefix xs ys \\\n n \\ length xs \\\n take n ys = take n xs\"\nby (auto simp: prefix_def)\n\nlemma take_n_eq_simp:\n \"take len ys = take len xs \\\n idx < len \\\n ys !idx = xs !idx\"\nby (metis elem_take_n)\n\nlemma take_n_and_len'_eq_simp:\n \"take len ys = take len xs \\\n idx < len' \\\n len' \\ len \\\n ys !idx = xs !idx\"\nby (erule take_n_eq_simp) simp\n\nlemma take_length_eq:\n \"\\take n xs = take n ys; length xs \\ n\\ \\ length ys \\ n\"\n by (fastforce dest!: arg_cong[where f=length]) \n\nlemma take_drop_eq_bounded:\n \"\\take n xs = take n ys; j + k < n\\\n \\ take j (drop k xs) = take j (drop k ys)\"\n apply (case_tac \"length xs \\ n\")\n apply (subgoal_tac \"length ys \\ n\")\n prefer 2\n apply (erule (1) take_length_eq)\n apply (rule nth_equalityI)\n apply simp\n apply clarsimp\n apply (simp add: take_n_eq_simp[where xs=ys]) \n apply (simp add: not_less_eq_eq)\n done\n \nlemma pObjI:\n \"P(pObj ys 0) \\\n unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj xs 0)) \\\n take (unat (Obj.len\\<^sub>f (pObj xs 0))) xs = take (unat (Obj.len\\<^sub>f (pObj xs 0))) ys \\\n P(pObj xs 0)\"\n apply (erule subst[where P=P,rotated])\n apply (simp add: pObj_def pObjHeader_simp)\n apply (subgoal_tac \"\\nnf (pObj xs 0))) ys = take (unat (Obj.len\\<^sub>f (pObj xs 0))) xs \\\n unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj xs 0)) \\\n pObj ys 0 = pObj xs 0\"\nby (auto intro: pObjI)\n\nlemma length_bilbyFsObjHeaderSize_le_trans:\n \"unat len \\ length xs \\\n length xs \\ length ys \\\n unat bilbyFsObjHeaderSize \\ length ys \\\n bilbyFsObjHeaderSize \\ len \\\n unat bilbyFsObjHeaderSize \\ length xs\"\nby unat_arith\n\nlemma is_valid_ObjHeader_prefix_eq:\n \"prefix xs ys \\\n unat (Obj.len\\<^sub>f (pObj xs 0)) \\ length xs \\\n unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj xs 0)) \\\n is_valid_ObjHeader (pObj ys 0) ys = is_valid_ObjHeader (pObj xs 0) xs\"\n apply (frule (1) prefix_n_takeD[where n=\"unat (Obj.len\\<^sub>f (pObj xs 0))\"])\n apply (drule (1) pObjD)\n apply (frule prefix_n_takeD[where n=\"length xs\" and xs=xs and ys=ys], fastforce)\n apply (subgoal_tac \"take (unat $ Obj.len\\<^sub>f $ pObj xs 0) xs = take (unat $ Obj.len\\<^sub>f $ pObj xs 0) ys\")\n prefer 2\n apply (drule (1) prefix_n_takeD, fastforce)\n apply (frule prefix_length_le)\n apply (auto simp: is_valid_ObjHeader_def length_bilbyFsObjHeaderSize_le_trans)\n done\n\nlemma is_valid_ObjHeader_prefix:\n \"is_valid_ObjHeader (pObj xs 0) xs \\\n prefix xs ys \\\n is_valid_ObjHeader (pObj ys 0) ys\"\n apply (frule is_valid_ObjHeader_buf_len)\n apply (frule is_valid_ObjHeader_len)\n apply (drule is_valid_ObjHeader_prefix_eq) \n apply (clarsimp , unat_arith?)+\n done\n\nlemma is_valid_ObjHeader_prefix_rev:\n \"is_valid_ObjHeader (pObj ys 0) ys \\\n prefix xs ys \\\n unat (Obj.len\\<^sub>f (pObj xs 0)) \\ length xs \\\n unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj xs 0)) \\\n is_valid_ObjHeader (pObj xs 0) xs\"\nby (drule is_valid_ObjHeader_prefix_eq, auto)\n\nlemma is_valid_ObjHeader_data_len:\n \"is_valid_ObjHeader (pObj xs n) (take nb ys) \\\n is_valid_ObjHeader (pObj xs n) ys\"\nby (clarsimp simp: is_valid_ObjHeader_def)\n\nlemma is_valid_ObjHeader_trans_len:\n \"is_valid_ObjHeader (pObj xs 0) xs \\\n unat (Obj.len\\<^sub>f (pObj xs 0)) \\ trans_len xs\"\nby (case_tac \"xs\")\n (clarsimp split:if_splits simp: trans_len_Cons)+\n\nlemma valid_trans_valid_ObjHeaderD:\n \"valid_trans ys \\ is_valid_ObjHeader (pObj ys 0) ys\"\n apply (erule valid_trans.elims)\n apply (clarsimp split:if_splits simp: is_valid_ObjTrans)\n done\n\nlemma valid_trans_pObj_trans_len:\n \"valid_trans xs \\\n unat (Obj.len\\<^sub>f (pObj xs 0)) \\ trans_len xs\"\n apply (case_tac \"xs\")\n apply (simp)\n apply (erule valid_trans.elims)\n apply (clarsimp split:if_splits)\n done\n\nlemma valid_trans_pObj_take_trans_len:\n \"valid_trans (take (trans_len ys) ys) \\\n unat (Obj.len\\<^sub>f (pObj (take (trans_len ys) ys) 0)) \\ trans_len ys\"\n apply (case_tac \"(take (trans_len ys) ys)\")\n apply (clarsimp)\n apply (erule valid_trans.elims)\n apply (clarsimp simp:is_valid_ObjTrans split:if_splits )\n apply (drule sym, simp only:)\n apply (drule is_valid_ObjHeader_buf_len)\n apply simp\n apply (drule sym, simp only:)\n apply (drule is_valid_ObjHeader_buf_len)\n apply simp\n done\n\nlemma valid_trans_take_trans_len_valid_ObjHeaderD:\n assumes \"valid_trans (take (trans_len ys) ys)\"\n shows \"is_valid_ObjHeader (pObj ys 0) ys\"\nproof -\n have tl_take_bound: \"unat (Obj.len\\<^sub>f (pObj (take (trans_len ys) ys) 0)) \\ trans_len ys\"\n by (rule valid_trans_pObj_take_trans_len[OF assms])\n have \"unat bilbyFsObjHeaderSize \\ length (take (trans_len ys) ys)\"\n using is_valid_ObjHeader_len_facts[OF valid_trans_valid_ObjHeaderD[OF assms]]\n by (clarsimp simp: is_valid_ObjHeader_def)\n moreover have \"length (take (trans_len ys) ys) \\ length ys\"\n by simp\n ultimately have len_eq: \"Obj.len\\<^sub>f (pObj ys 0) = (Obj.len\\<^sub>f (pObj (take (trans_len ys) ys) 0))\"\n by (clarsimp simp: pObj_def pObjHeader_def Let_def Obj.make_def bilbyFsObjHeaderSize_def ple32_take)\n from tl_take_bound and len_eq\n have tl_bound: \"unat (Obj.len\\<^sub>f (pObj ys 0)) \\ trans_len ys\"\n by simp\n\n have valid: \"is_valid_ObjHeader (pObj (take (trans_len ys) ys) 0) (take (trans_len ys) ys)\"\n by (rule valid_trans_valid_ObjHeaderD[OF assms])\n\n have len_lower_bound: \"unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj ys 0))\"\n using len_eq[symmetric] is_valid_ObjHeader_len[OF valid] by simp unat_arith\n\n show ?thesis\n using tl_bound valid len_eq\n by - (rule pObjI[where ys=\"(take (trans_len ys) ys)\", OF _ len_lower_bound], simp_all add: is_valid_ObjHeader_def min_absorb1)\nqed\n\n\nlemma valid_log_buf_fun_imp_valid_ObjHeader:\n \"valid_list_trans ys \\ is_valid_ObjHeader (pObj ys 0) ys\"\n apply (erule valid_list_trans.elims)\n apply (clarsimp simp: is_valid_ObjTrans)\n apply (drule sym[where s=ys], simp)\n apply (erule valid_trans.elims)\n apply (rename_tac v va)\n apply (subgoal_tac \"is_valid_ObjHeader (pObj (v#va) 0) (v#va)\")\n apply (erule is_valid_ObjHeader_prefix)\n apply (drule_tac t=\"v # va\" in sym, fastforce)\n apply (fastforce simp: is_valid_ObjTrans split: if_splits dest: is_valid_ObjHeader_buf_len)+\n done\n\nlemma n_idx_in_range:\n \"n < length xs \\ (xs @ ys) ! n = xs ! n\"\n by (metis nth_append)\n\nlemma is_down_32_8[simp]:\n \"is_down (c::(U32 \\ U8))\"\n by (simp add: is_down_def word_size target_size source_size)\n\nlemma u32_to_u8_ignored[simp]:\n \"u32_to_u8 (ucast x) = x\"\n by (simp add: u32_to_u8_is_ucast ucast_down_ucast_id)\n\nlemma word_rcat_8_32_ucast_last:\n \"list \\ [] \\ ucast (word_rcat list :: word32) = (last list :: word8)\"\n apply (cases list rule: rev_cases, simp_all)\n apply (rule word_eqI)\n apply (simp add: word_size test_bit_rcat[OF _ refl] nth_ucast)\n done\n \nlemma is_valid_ObjHeader_first_byte:\n assumes \"is_valid_ObjHeader (pObj data 0) data\"\n shows\n \"hd data = u32_to_u8 bilbyFsMagic\"\nproof -\n have len_data: \"length data > 4\"\n using is_valid_ObjHeader_len_facts[OF assms]\n by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n have \"magic\\<^sub>f (pObj data 0) = bilbyFsMagic\"\n using assms unfolding is_valid_ObjHeader_def by simp\n hence \"ple32 data 0 = bilbyFsMagic\"\n by (simp add: pObj_def pObjHeader_def Let_def Obj.make_def)\n hence \"u32_to_u8 (ple32 data 0) = u32_to_u8 bilbyFsMagic\"\n by (simp)\n thus ?thesis\n using len_data \n by (case_tac data) \n (clarsimp simp: ple32_def u32_to_u8_is_ucast word_rcat_8_32_ucast_last)+\nqed\n\nlemma is_valid_ObjHeader_not_pad:\n \"is_valid_ObjHeader (pObj data 0) data \\ hd data \\ bilbyFsPadByte\"\nby (drule is_valid_ObjHeader_first_byte)\n (simp add: bilbyFsMagic_def bilbyFsPadByte_def u32_to_u8_is_ucast)\n\nlemma valid_list_trans_non_empty:\n \"valid_list_trans ys \\ ys \\ []\"\nby (erule valid_list_trans.elims, simp_all)\n\nlemma nopad_not_Nil:\n \"nopad xs \\ [] \\ xs \\ []\"\nby (case_tac xs) (simp_all add: nopad_def)\n\nlemma valid_trans_imp_valid_trans_trans_len:\n\"valid_trans xs \\ trans_len xs \\ length xs\"\n apply (induct xs rule: trans_len.induct)\n apply (simp)\n apply (erule valid_trans.elims)\n apply (clarsimp split: if_splits simp add: is_valid_ObjTrans)\n apply (rename_tac v vs)\n apply (subgoal_tac \"Suc (length vs) \\ unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\")\n apply (fastforce simp: is_valid_ObjHeader_def)+\n done\n\nlemma validObjIn_imp_validObjHeader:\n \"is_valid_ObjIn obj buf \\ is_valid_ObjHeader obj buf\"\nby (simp add: is_valid_ObjTrans)\n\nlemma trans_len_induct:\n \"P [] \\\n (\\v vs. (is_valid_ObjIn (pObj (v#vs) 0) (v#vs) \\\n P (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs))) \\\n P (v#vs)) \\ P a0\"\nby (erule trans_len.induct)\n (fastforce intro: validObjIn_imp_validObjHeader) \n\nlemma not_is_valid_ObjHeader_trans_len:\n \"\\is_valid_ObjHeader (pObj xs 0) xs \\ trans_len xs = max (unat bilbyFsObjHeaderSize) (unat (Obj.len\\<^sub>f (pObj xs 0)))\"\nby (case_tac xs, simp_all add: trans_len_Cons)\n\nlemma trans_len_idempotence:\nnotes notI [rule del]\nshows\n \"trans_len (take (trans_len xs) xs) = trans_len xs\"\nproof (induction xs rule: trans_len_induct)\n show \"trans_len (take (trans_len []) []) = trans_len []\"\n by simp\n next\n fix v vs\n assume IH: \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs) \\\n trans_len (take (trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs)))\n (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v # vs))) =\n trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\"\n have hdr_sz_le_tl: \"unat bilbyFsObjHeaderSize \\ trans_len (v#vs)\" \n using hdr_sz_le_trans_len[where xs=\"v#vs\"] .\n hence hdr_eq: \"pObjHeader (take (trans_len (v#vs)) (v#vs)) 0 = pObjHeader (v#vs) 0\"\n by (simp add: pObjHeader_simp ple32_take ple64_take)\n have len_eq: \"unat (Obj.len\\<^sub>f (pObj (take (trans_len (v # vs)) (v # vs)) 0)) = unat (Obj.len\\<^sub>f (pObj (v # vs) 0))\"\n using hdr_sz_le_trans_len[where xs=\"v#vs\"] ple32_take[where ys=\"v#vs\"]\n by (simp add: pObjHeader_simp pObj_def)\n have trans_otype_eq: \"\\f. f \\ {Obj.trans\\<^sub>f, Obj.otype\\<^sub>f} \\ (f (pObj (take (trans_len (v # vs)) (v # vs)) 0)) = f (pObj (v # vs) 0)\"\n using hdr_sz_le_trans_len[where xs=\"v#vs\"] \n by (fastforce simp: pObjHeader_simp pObj_def)\n have magic_eq: \"\\f. f \\ {Obj.magic\\<^sub>f, Obj.offs\\<^sub>f} \\ (f (pObj (take (trans_len (v # vs)) (v # vs)) 0)) = f (pObj (v # vs) 0)\"\n using hdr_sz_le_trans_len[where xs=\"v#vs\"] ple32_take[where ys=\"v#vs\"]\n by (fastforce simp: pObjHeader_simp pObj_def)\n show \"trans_len (take (trans_len (v#vs)) (v#vs)) = trans_len (v#vs)\"\n proof (cases)\n assume valid_in: \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\"\n hence valid_hdr: \"is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\n by (simp add: is_valid_ObjTrans)\n have valid_in': \"is_valid_ObjIn (pObj (take (trans_len (v#vs)) (v#vs)) 0) (take (trans_len (v#vs)) (v#vs))\"\n using hdr_eq hdr_sz_le_trans_len[where xs=\"v#vs\"] hdr_sz_le_tl valid_in\n by (simp add: is_valid_ObjTrans is_valid_ObjHeader_def pObj_def Obj.make_def Let_def\n ple32_take[where ys=\"v#vs\"] ple64_take[where ys=\"v#vs\"] pObjHeader_def\n bilbyFsObjHeaderSize_def min_absorb1) (* this takes ages *)\n let ?olen = \"unat (Obj.len\\<^sub>f (pObj (v # vs) 0))\"\n let ?dropolen = \"drop ?olen (v # vs)\"\n\n have tl: \"trans_len (v#vs) = ?olen + trans_len ?dropolen\"\n using valid_in trans_len_Cons by (simp add: is_valid_ObjTrans)\n\n have tl': \"trans_len (take (trans_len (v # vs)) (v # vs)) = (unat $ Obj.len\\<^sub>f $ pObj (take (trans_len (v # vs)) (v # vs)) 0) +\n trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (take (trans_len (v # vs)) (v # vs)) 0) (take (trans_len (v # vs)) (v # vs)))\"\n using valid_in' trans_len_Cons by (simp add: is_valid_ObjTrans)\n\n have olen_assoc: \"?olen + trans_len ?dropolen = trans_len ?dropolen + ?olen\"\n by simp\n\n have tl_plus_eq: \"trans_len (drop ?olen (take (?olen + trans_len ?dropolen) (v # vs))) =\n trans_len (take (trans_len ?dropolen) ?dropolen)\"\n by (rule arg_cong[where f=\"trans_len\"]) (simp add: take_drop olen_assoc)\n\n have \"?olen + trans_len ?dropolen = (unat $ Obj.len\\<^sub>f $ pObj (take (trans_len (v # vs)) (v # vs)) 0) +\n trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (take (trans_len (v # vs)) (v # vs)) 0)\n (take (trans_len (v # vs)) (v # vs)))\"\n using len_eq IH[OF valid_in,simplified] tl_plus_eq\n by (simp add: len_eq valid_in valid_hdr trans_len_Cons)\n thus ?thesis\n by (simp add: tl[symmetric] tl')\n next\n assume not_in: \"\\is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\"\n thus ?thesis\n proof (cases)\n assume valid: \"is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\n\n have valid': \"is_valid_ObjHeader (pObj (take (trans_len (v#vs)) (v#vs)) 0) (take (trans_len (v#vs)) (v#vs))\"\n using hdr_eq len_eq hdr_sz_le_trans_len[where xs=\"v#vs\"] valid apply (simp only: is_valid_ObjTrans is_valid_ObjHeader_def pObj_def Obj.make_def Let_def\n pObjHeader_def )\n using is_valid_ObjHeader_trans_len[OF valid, simplified pObjHeader_simp pObj_def]\n by (simp add: ple32_take[where ys=\"v#vs\"] ple64_take[where ys=\"v#vs\"] bilbyFsObjHeaderSize_def\n min_absorb1)\n hence not_in': \"\\is_valid_ObjIn (pObj (take (trans_len (v#vs)) (v#vs)) 0) (take (trans_len (v#vs)) (v#vs))\"\n using valid' valid not_in apply (simp add: is_valid_ObjTrans)\n apply (drule is_valid_ObjHeader_buf_len)+\n apply (simp only: pObjHeader_simp pObj_def)\n apply clarsimp\n done\n thus ?thesis\n using valid valid' not_in not_in' apply (simp add: trans_len_Cons)\n apply (case_tac \"take (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs)\", fastforce)\n using len_eq apply (clarsimp simp: trans_len_Cons bilbyFsObjHeaderSize_def)\n done\n next\n assume not_valid: \"\\is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\n hence not_valid': \"\\is_valid_ObjHeader (pObj (take (trans_len (v#vs)) (v#vs)) 0) (take (trans_len (v#vs)) (v#vs))\"\n using len_eq\n by (fastforce simp: is_valid_ObjHeader_def magic_eq trans_otype_eq)+\n\n have \"unat (Obj.len\\<^sub>f\n (pObj (take (max (unat bilbyFsObjHeaderSize) (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))))\n (v # vs))\n 0)) = (unat (Obj.len\\<^sub>f (pObj (v # vs) 0)))\"\n using ple32_take[where ys=\"(v # vs)\" and ntake=\"(max (unat bilbyFsObjHeaderSize) (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))))\"]\n by (simp add: pObj_def pObjHeader_simp)\n thus ?thesis\n apply (simp add: trans_len_Cons)\n using not_valid and not_valid' apply simp\n apply (case_tac \"(take (max (unat bilbyFsObjHeaderSize) (unat (Obj.len\\<^sub>f (pObj (v # vs) 0)))) (v # vs))\")\n apply (simp add: bilbyFsObjHeaderSize_def)\n apply (simp add: trans_len_Cons)\n done\n qed\n qed\nqed\n\nlemma trans_len_take_drop_eq:\nassumes is_in:\"is_valid_ObjIn (pObj (v # vs) 0) (v # vs)\"\nand valid_trans: \"valid_trans (v#vs)\"\nshows\n \"take (trans_len (drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs)))\n (drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs)) =\n drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (take (trans_len (v # vs)) (v # vs))\"\nproof -\n have \"valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\"\n using valid_trans is_in by - (erule valid_trans.elims, fastforce)\n let ?lenobj = \"unat (Obj.len\\<^sub>f (pObj (v # vs) 0))\"\n have \"trans_len (drop ?lenobj (v#vs)) + ?lenobj = trans_len (v#vs)\"\n using is_in by (subst trans_len.simps) (clarsimp simp: is_valid_ObjTrans)\n thus ?thesis\n by (simp add: take_drop)\nqed\n\n\nlemma trans_len_take_drop_eq':\nassumes yys_eq: \"y#ys = take (trans_len (v#vs)) (v#vs)\"\nand is_in': \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\"\nand len_eq: \"(unat (Obj.len\\<^sub>f (pObj (y#ys) 0))) = (unat (Obj.len\\<^sub>f (pObj (v#vs) 0)))\"\nshows\n \"take (trans_len (drop (unat (Obj.len\\<^sub>f (pObj (v#vs) 0))) (v#vs)))\n (drop (unat (Obj.len\\<^sub>f (pObj (v#vs) 0))) (v#vs)) =\n drop (unat (Obj.len\\<^sub>f (pObj (v#vs) 0))) (y#ys)\"\n apply (simp add: yys_eq)\n apply (subst trans_len_Cons)\n using is_in' apply (clarsimp simp: is_valid_ObjTrans)\n apply (simp add: take_drop len_eq[simplified yys_eq])\n apply (case_tac \"(drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs))\")\n apply simp\n apply (rename_tac x xs)\n apply (drule_tac t=\"x#xs\" in sym)\n apply (subgoal_tac \"(trans_len (drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs)) +\n unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) = ( unat (Obj.len\\<^sub>f (pObj (v # vs) 0)) +\n trans_len (drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs)))\")\n apply (simp only:)+\ndone\n\nlemma take_trans_len_is_valid_ObjHeader_preserved:\nassumes hdr: \"is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\nand trans: \"Obj.trans\\<^sub>f (pObj (v#vs) 0) = tr\"\nand valid: \"valid_trans (v # vs)\"\nand yys_eq:\"take (trans_len (v#vs)) (v#vs) = y#ys\"\nshows\n \"is_valid_ObjHeader (pObj (y#ys) 0) (y#ys) \\\n Obj.trans\\<^sub>f (pObj (y#ys) 0) = tr \\\n unat (Obj.len\\<^sub>f (pObj (y#ys) 0)) = unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\"\nproof -\n have prefix: \"prefix (y#ys) (v#vs)\"\n using yys_eq by (metis take_is_prefix)\n have len_eq: \"unat (Obj.len\\<^sub>f (pObj (y#ys) 0)) = unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\"\n using hdr_sz_le_trans_len[where xs=\"v#vs\"] \n by (simp only: yys_eq[symmetric] bilbyFsObjHeaderSize_def\n pObj_def pObjHeader_def Obj.make_def Let_def ple32_take)\n (simp add: ple32_take)\n moreover hence len_obj: \"unat (Obj.len\\<^sub>f (pObj (y#ys) 0)) \\ length (y#ys)\"\n using yys_eq[symmetric] is_valid_ObjHeader_buf_len[OF hdr] is_valid_ObjHeader_trans_len[OF hdr]\n by clarsimp\n have lower_bound: \"unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj (y#ys) 0))\"\n using is_valid_ObjHeader_len[OF hdr] len_eq by unat_arith\n have hdr_yys: \"is_valid_ObjHeader (pObj (y # ys) 0) (y # ys)\"\n using is_valid_ObjHeader_prefix_rev[OF hdr prefix len_obj lower_bound] .\n moreover have \"unat bilbyFsObjHeaderSize \\ length (y#ys)\"\n using is_valid_ObjHeader_buf_len[OF hdr_yys] by clarsimp\n hence \"Obj.trans\\<^sub>f (pObj (y#ys) 0) = Obj.trans\\<^sub>f (pObj (v#vs) 0)\"\n by (simp only: yys_eq[symmetric] bilbyFsObjHeaderSize_def\n pObj_def pObjHeader_def Obj.make_def Let_def ple32_def)\n simp\n ultimately show \"?thesis\"\n using trans by simp\nqed\n\nlemma valid_trans_imp_valid_trans_take_trans_len:\nassumes valid: \"valid_trans xs\"\nshows\n \"valid_trans (take (trans_len xs) xs)\"\nusing valid_trans_imp_valid_trans_trans_len[OF valid] valid\nproof (induction xs rule: trans_len_induct)\n assume \"valid_trans []\"\n hence False by simp\n thus \"valid_trans (take (trans_len []) [])\" by simp\nnext\n fix v vs\n assume valid: \"valid_trans (v # vs)\"\n and tllen: \"trans_len (v # vs) \\ length (v # vs)\"\n and IH:\"\\ is_valid_ObjIn (pObj (v#vs) 0) (v#vs);\n trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\n \\ length (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs));\n valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs)) \\ \\\n valid_trans (take (trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs))) (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs)))\"\n thus \"valid_trans (take (trans_len (v # vs)) (v # vs))\"\n proof (cases \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\")\n case True\n obtain y ys where yys_eq:\"take (trans_len (v#vs)) (v#vs) = y#ys\"\n using trans_len_non_zero[where xs=\"v#vs\"]\n by (drule_tac x=v and y=\"take (trans_len (v#vs) - 1) vs\" in meta_spec2)\n (case_tac \"trans_len (v # vs)\", fastforce+)\n have trans_len_le: \"trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\n \\ length (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\"\n using valid True\n by - (fastforce split: if_splits dest: valid_trans_imp_valid_trans_trans_len)\n have valid_nxt: \"valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\"\n using valid True by - fastforce\n have valid_trans_len: \"valid_trans (take (trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs))) (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs)))\"\n using IH[OF True trans_len_le valid_nxt] .\n\n have \"is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\n and \"Obj.trans\\<^sub>f (pObj (v#vs) 0) = bilbyFsTransIn\"\n using True by (simp add: is_valid_ObjTrans)+\n\n hence \"is_valid_ObjIn (pObj (y#ys) 0) (y#ys)\"\n and \"unat (Obj.len\\<^sub>f (pObj (y#ys) 0)) = unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\"\n using take_trans_len_is_valid_ObjHeader_preserved[OF _ _ valid yys_eq]\n by (simp add: is_valid_ObjTrans)+\n\n thus ?thesis\n using valid_trans_len trans_len_take_drop_eq[OF True valid]\n by (auto simp: yys_eq[symmetric])\n next\n case False\n hence validCommit: \"is_valid_ObjCommit (pObj (v#vs) 0) (v#vs)\"\n using valid by - (erule valid_trans.elims, simp)\n thus ?thesis\n proof (cases \"take (trans_len (v # vs)) (v # vs)\")\n case Nil\n hence False using trans_len_non_zero[where xs=\"v#vs\"] by simp\n thus ?thesis by simp\n next\n case (Cons y ys)\n\n have \"is_valid_ObjHeader (pObj (v#vs) 0) (v#vs)\"\n and \"Obj.trans\\<^sub>f (pObj (v#vs) 0) = bilbyFsTransCommit\"\n using validCommit by (simp add: is_valid_ObjTrans)+\n\n hence \"is_valid_ObjCommit (pObj (y#ys) 0) (y#ys)\"\n using take_trans_len_is_valid_ObjHeader_preserved[OF _ _ valid Cons]\n by (simp add: is_valid_ObjTrans)\n\n thus ?thesis\n using Cons by simp\n qed\n qed\nqed\n\nlemma drop_append':\n \"drop n (x#xs @ ys) = drop n (x#xs) @ drop (n - length (x#xs)) ys\"\nby (metis append_Cons drop_append)\n\nlemma obj_len_append:\n assumes \"unat bilbyFsObjHeaderSize \\ Suc (length vs)\"\n shows \" (Obj.len\\<^sub>f (pObj (v # vs @ zs) 0)) = Obj.len\\<^sub>f (pObj (v # vs) 0)\"\nusing assms by (auto simp: pObj_def pObjHeader_simp n_idx_in_range ple32_def)\n\nlemma valid_trans_take_trans_len_imp_valid_trans:\nassumes valid: \"valid_trans (take (trans_len xs) xs)\"\nshows \"valid_trans xs\"\nusing valid\nproof (induction \"xs\" rule: valid_trans.induct)\n assume \"valid_trans (take (trans_len []) [])\"\n hence \"False\" by simp\n thus \"valid_trans []\" by simp\n next\n fix v vs\n assume valid: \"valid_trans (take (trans_len (v # vs)) (v # vs))\"\n and IH: \"is_valid_ObjIn (pObj (v # vs) 0) (v # vs) \\\n valid_trans (take (trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs)))\n (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))) \\\n valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs))\"\n obtain y ys where yys_eq: \"y#ys = take (trans_len (v#vs)) (v#vs)\"\n using trans_len_non_zero[where xs=\"v#vs\"] by (cases \"take (trans_len (v # vs)) (v # vs)\" ,simp+)\n have len_le_trans_len: \"unat (Obj.len\\<^sub>f (pObj (y#ys) 0)) \\ trans_len (y#ys)\"\n using valid_trans_pObj_trans_len[OF valid] yys_eq by simp\n have valid_obj_xs: \"is_valid_ObjHeader (pObj (y#ys) 0) (y#ys)\"\n using valid yys_eq by - (erule valid_trans.elims, clarsimp simp: is_valid_ObjTrans split:if_splits)\n have trans_len_eq: \"trans_len (y#ys) = trans_len (v#vs)\"\n using trans_len_idempotence yys_eq by simp\n have len_yys: \"unat bilbyFsObjHeaderSize \\ length (y#ys)\"\n using hdr_sz_le_trans_len[where xs=\"y#ys\"] yys_eq[symmetric]\n valid_trans_imp_valid_trans_trans_len[OF valid] by simp\n have len_eq: \"Obj.len\\<^sub>f (pObj (y#ys) 0) = Obj.len\\<^sub>f (pObj (v#vs) 0)\"\n using len_yys\n by (simp add: pObj_def pObjHeader_def Obj.make_def yys_eq\n ple32_take bilbyFsObjHeaderSize_def Let_def)\n have min_obj_len_trans_len:\"min (unat (Obj.len\\<^sub>f (pObj (v#vs) 0))) (trans_len (v#vs)) = unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\"\n using len_le_trans_len[simplified trans_len_eq len_eq] by simp\n have len_lower_bound: \"unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj (v#vs) 0))\"\n using is_valid_ObjHeader_len[OF valid_obj_xs] by (simp add: len_eq yys_eq[symmetric]) unat_arith\n\n show \"valid_trans (v # vs)\"\n proof cases\n assume is_in: \"is_valid_ObjIn (pObj (y#ys) 0) (y#ys)\" \n hence is_in': \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\"\n apply (clarsimp simp: is_valid_ObjTrans yys_eq )\n apply (drule is_valid_ObjHeader_data_len[where ys=\"v#vs\"])\n apply (frule is_valid_ObjHeader_len)\n using len_eq min_obj_len_trans_len \n by (auto elim: pObjI[OF _ len_lower_bound] simp: bilbyFsObjHeaderSize_def)\n have \"valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (y#ys) 0) (y#ys))\"\n using valid yys_eq[symmetric] by - (erule valid_trans.elims,simp add: is_in)\n hence valid_take_trans_len_nxt:\n \"valid_trans (take (trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs)))\n (drop (unat $ Obj.len\\<^sub>f $ pObj (v # vs) 0) (v # vs)))\"\n apply (simp add: yys_eq len_eq[simplified yys_eq])\n apply (erule subst[rotated,where P=valid_trans])\n using trans_len_take_drop_eq'[OF yys_eq is_in'] len_eq\n by (simp add: yys_eq)\n\n have \"valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj (v#vs) 0) (v#vs))\"\n using IH[OF is_in' valid_take_trans_len_nxt] .\n thus ?thesis\n using is_in' by (simp add: valid_trans_Cons)\n next\n assume is_not_in: \"\\is_valid_ObjIn (pObj (y#ys) 0) (y#ys)\"\n hence is_commit: \"is_valid_ObjCommit (pObj (y#ys) 0) (y#ys)\"\n using valid by - (erule valid_trans.elims, simp add: yys_eq)\n hence is_commit':\"is_valid_ObjCommit (pObj (v#vs) 0) (v#vs)\"\n apply (clarsimp simp: is_valid_ObjTrans yys_eq)\n apply (drule is_valid_ObjHeader_data_len[where ys=\"v#vs\"])\n apply (frule is_valid_ObjHeader_len)\n using len_eq min_obj_len_trans_len \n apply (auto elim: pObjI[OF _ len_lower_bound] simp: bilbyFsObjHeaderSize_def)\n done\n thus ?thesis\n using is_commit' by (simp add: valid_trans_Cons is_valid_Obj_diff)\n qed\nqed\n\nlemma valid_trans_eq_valid_trans_take_trans_len:\n \"valid_trans xs = valid_trans (take (trans_len xs) xs)\"\n apply (rule iffI)\n apply (erule valid_trans_imp_valid_trans_take_trans_len)\n apply (erule valid_trans_take_trans_len_imp_valid_trans)\n done\n\nlemma valid_trans_prefixD:\n \"valid_trans xs \\\n prefix xs ys \\\n trans_len ys = trans_len xs\"\n apply (clarsimp simp: prefix_def)\n apply (rename_tac zs)\n apply (thin_tac \"ys = xs @ zs\")\n apply (induct xs rule: trans_len_induct)\n apply simp\n apply (erule valid_trans.elims)\n apply (rename_tac v vs)\n apply (case_tac \"is_valid_ObjIn (pObj (v#vs) 0) (v#vs)\")\n apply simp\n apply (case_tac \"(v # vs @ zs)\")\n apply (simp add: trans_len_Cons)\n apply (subst trans_len_Cons)\n apply (clarsimp simp: is_valid_ObjTrans)\n apply (rename_tac v)\n apply (frule_tac ys=\"(v # vs @ zs)\" in is_valid_ObjHeader_prefix)\n apply (simp)\n apply simp\n apply (frule_tac data=\"(v # vs @ zs)\" in is_valid_ObjHeader_len_unat)\n apply (drule_tac xs=\"(v # vs @ zs)\" and ys=\"v#vs\" in pObjD[rotated])\n apply (drule_tac data=\"(v # vs )\" in is_valid_ObjHeader_buf_len)\n apply clarsimp\n apply (rule nth_take_lemma)\n apply (drule_tac is_valid_ObjHeader_buf_len)\n apply (simp add: pObj_def pObjHeader_simp ple32_append_Cons)\n apply (simp add: pObj_def pObjHeader_simp ple32_append_Cons)\n apply (subgoal_tac \"unat (Obj.len\\<^sub>f (pObj (v # vs @ zs) 0)) = unat (Obj.len\\<^sub>f (pObj (v#vs) 0)) \")\n apply (simp)\n apply (rename_tac i)\n apply (case_tac i, simp_all add: nth_append)\n apply (simp add: pObj_def pObjHeader_simp ple32_append_Cons)\n apply (drule_tac x=zs in meta_spec)\n apply (erule_tac P=\"\\xs. trans_len xs =\n trans_len (drop (unat (Obj.len\\<^sub>f (pObj (v # vs @ zs) 0))) (v # vs))\" in subst[rotated])\n apply (subgoal_tac \" (unat (Obj.len\\<^sub>f (pObj (v # vs @ zs) 0))) \\ length (v#vs)\")\n apply (simp add: )\n apply (subgoal_tac \"unat bilbyFsObjHeaderSize \\ unat (Obj.len\\<^sub>f (pObj (v # vs @ zs) 0)) \")\n apply (simp add: bilbyFsObjHeaderSize_def drop_n_ge_0)\n apply (drule is_valid_ObjHeader_len, unat_arith)\n apply (drule is_valid_ObjHeader_buf_len, simp)\n apply (clarsimp simp: trans_len_Cons is_valid_ObjTrans split: if_splits)\n apply (frule is_valid_ObjHeader_len)\n apply (drule is_valid_ObjHeader_buf_len, simp)+\n apply (clarsimp simp: pObj_def pObjHeader_simp ple32_append_Cons nth_append max_absorb2)\n apply unat_arith\n done\n\nlemma valid_trans_prefix_imp:\n \"valid_trans xs \\\n prefix xs ys \\\n valid_trans ys\"\n apply (frule valid_trans_imp_valid_trans_take_trans_len)\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (subgoal_tac \"take (trans_len xs) xs = take (trans_len xs) ys\")\n apply simp\n apply (frule valid_trans_imp_valid_trans_take_trans_len)\n apply (drule (1) valid_trans_prefixD[THEN sym])\n apply simp\n apply (drule (1) valid_trans_take_trans_len_imp_valid_trans)\n apply (fastforce simp: prefix_def)\n done\n\nlemma drop_prefixI:\n \"prefix xs ys \\\n prefix (drop n xs) (drop n ys)\"\nby (auto simp: prefix_def)\n\nlemma drop_Nil_prefixD:\n \"prefix xs ys \\\n drop n xs \\ [] \\ (drop n ys) \\ []\"\nby (auto simp: prefix_def)\n\nlemma drop_length_append:\n \"drop (length xs) (xs@ys) = ys\"\nby auto\n\nlemma drop_trans_len_Nil_eq_length:\n \"drop (trans_len xs) xs = [] \\\n valid_trans xs \\\n trans_len xs = length xs\"\n apply (induct xs rule: trans_len.induct)\n apply fastforce\n apply (simp)\n apply (subst (asm) valid_trans.simps)\n apply (clarsimp split:if_splits simp:is_valid_ObjTrans)\n apply (fastforce dest: is_valid_ObjHeader_buf_len)+\n done\n\ndefinition valid_obj :: \"U8 list \\ bool\"\nwhere\n \"valid_obj xs \\ is_valid_ObjHeader (pObj xs 0) xs\"\n\nlemma not_valid_obj_list_trans:\n \"\\valid_obj xs \\\n prod.fst (list_trans xs) = xs\"\nby (case_tac xs)\n (simp add: Let_def valid_obj_def split: list.splits)+\n\nlemma valid_obj_imp_no_pad_byte:\n \"valid_obj xs \\ xs!0 \\ bilbyFsPadByte\"\n using is_valid_ObjHeader_not_pad[where data=xs]\n apply (simp add: valid_obj_def)\n apply (drule is_valid_ObjHeader_buf_len)\n apply (case_tac xs, simp_all add: bilbyFsObjHeaderSize_def)\n done\n\nlemma valid_trans_imp_valid_obj:\n \"valid_trans xs \\ valid_obj xs\"\n by (erule valid_trans.elims)\n (simp add: is_valid_ObjTrans valid_obj_def split:if_splits)\n\nlemma nopad_Nil:\n \"\\n. nopad xs = [] \\ nopad (xs@(replicate n bilbyFsPadByte)) = []\"\n by (simp add:nopad_def)\n\nlemma list_Cons_append_simp:\n \"b # buf = xs \\\n (b # buf @ ys) = xs @ ys\"\n by simp\n\ndefinition\n padding :: \"nat \\ U8 list\"\nwhere\n \"padding n = replicate n bilbyFsPadByte\"\n\nlemma Cons_append: \"x # xs @ ys = (x#xs) @ ys\"\nby simp\n\nlemma slice_Cons_append: \"slice f t (x #xs @ ys) = slice f t (x#xs) @ slice (f - min (length (x#xs)) t) (t - length (x#xs)) ys\"\n by (simp only: Cons_append slice_append )\n\nlemma is_valid_ObjHeader_pObj_eq:\n \"is_valid_ObjHeader (pObj (b # buf @ xs) 0) (b # buf @xs) \\\n is_valid_ObjHeader (pObj (b # buf) 0) (b # buf) \\\n pObj (b # buf @ xs) 0 = pObj (b # buf) 0 \"\n apply (frule is_valid_ObjHeader_len_facts[where data=\"b # buf\"])\n apply (frule is_valid_ObjHeader_len_facts[where data=\"b # buf@xs\"])\n apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def pObj_def Let_def pObjHeader_def Obj.make_def)\n apply (simp add: ple32_eq_slice4 ple64_eq_slice8 slice_Cons_append slice_n_n )\n apply (simp only: Cons_append take_append nth_append)\n apply simp\n done\n\n\nlemma pTrans_remainderD:\n \"P (prod.fst (pTrans buf)) \\ P (drop (trans_len buf) buf)\"\n by (simp add: pTrans_remainder)\n\nlemma is_valid_ObjHeader_trans_len_le_buf_len:\n \"is_valid_ObjHeader (pObj xs 0) xs \\\n unat (Obj.len\\<^sub>f (pObj xs 0)) \\ length xs\"\nby (clarsimp simp: is_valid_ObjHeader_def)\n\nlemma snd_pTrans_append:\n \"valid_trans xs \\ prod.snd (pTrans (xs @ ys)) = prod.snd (pTrans xs)\"\n apply (induct rule:pTrans.induct)\n apply simp\n apply (erule valid_trans.elims)\n apply (clarsimp split:if_splits simp: is_valid_ObjTrans simp: Let_def)\n apply (frule is_valid_ObjHeader_pObj_eq[rotated, where xs=\"ys\"])\n apply (clarsimp simp: prefix_def is_valid_ObjHeader_prefix)\n apply (rename_tac v vs)\n apply (frule_tac ys=\"(v # vs @ ys)\" in is_valid_ObjHeader_prefix)\n apply simp\n apply (simp add: prod.case_eq_if)\n apply (subgoal_tac \"(drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs) @ ys) = (drop (unat (Obj.len\\<^sub>f (pObj (v # vs) 0))) (v # vs @ ys))\")\n apply simp\n apply (drule is_valid_ObjHeader_trans_len_le_buf_len)\n apply (simp add: drop_append' prod.case_eq_if)\n apply (frule is_valid_ObjHeader_pObj_eq[rotated, where xs=\"ys\"])\n apply (clarsimp simp: prefix_def is_valid_ObjHeader_prefix)\n apply (frule_tac ys=\"(vb # vaa @ ys)\" in is_valid_ObjHeader_prefix, simp)\n apply (drule is_valid_ObjHeader_trans_len_le_buf_len)\n apply (simp)\ndone\n\ntext {* @{term pTrans_valid_non_empty} says that pTrans cannot fail if valid_trans holds *}\nlemma pTrans_valid_non_empty:\n \"valid_trans xs \\ prod.snd (pTrans (xs@ys)) \\ []\"\n apply (case_tac \"xs@ys\")\n apply simp\n apply (rename_tac v va )\n apply (simp add: Let_def, drule sym, simp)\n apply (erule valid_trans.elims)\n apply (rename_tac vb vaa)\n apply (drule_tac t=\"vb # vaa\" in sym)\n apply (simp only:)\n apply (subgoal_tac \"is_valid_ObjHeader (pObj (xs @ ys) 0) (xs @ ys)\")\n apply (clarsimp simp: is_valid_ObjTrans split:if_splits)\n apply (fastforce simp: prod.case_eq_if)+\n apply (clarsimp simp: is_valid_ObjTrans split:if_splits)\n apply (erule is_valid_ObjHeader_prefix, simp_all)+\n done\n\nlemma valid_trans_pTrans_non_empty_trans:\nnotes notI [rule del]\nshows\n \"valid_trans xs \\\n prod.snd (pTrans xs) \\ []\"\n using pTrans_valid_non_empty[where ys=Nil]\n by fastforce\n\ntext {* Nicer induction lemma (variable renamed) *}\nlemma list_trans_induct:\n \"(\\data. (\\data' tx. (data', tx) = pTrans data \\ data' \\[] \\ tx \\ [] \\ P (nopad data')) \\ P data) \\ P a0\"\n apply (rule list_trans.induct)\n apply (drule_tac x=data in meta_spec)\n apply (drule meta_mp)\n apply (drule_tac x=data' and y=tx in meta_spec2)\n apply (drule_tac x=\"hd data'\" and y=\"tl data'\" in meta_spec2)\n apply (drule_tac x=\"hd tx\" and y=\"tl tx\" in meta_spec2)\n apply fastforce\n apply assumption\n done\n\nlemma snd_list_trans_Nil:\n \"prod.snd (list_trans []) = []\"\nby simp\n\nlemma no_pad_Nil:\n \"nopad [] = []\"\nunfolding nopad_def\nby simp\n\nlemma nopad_padding_drop_eq_Nil:\n \"(nopad (drop n (xs @ padding m)) = []) = (nopad (drop n xs) = [])\"\n by (auto simp add: drop_append' nopad_def padding_def)\n\nlemma nopad_padding_drop_eq_NilD:\n \"(nopad (drop n xs) = []) \\ ( nopad (drop n (xs @ padding m)) = [])\"\nusing nopad_padding_drop_eq_Nil\nby auto\n\nlemma nopad_padding_drop_eq_Nil':\n \"( nopad (drop n (x # xs @ padding m)) = []) = (nopad (drop n (x # xs)) = [])\"\nusing nopad_padding_drop_eq_Nil[where xs=\"(x # xs)\" and n=n and m=m]\nby (subst Cons_append) auto\n\nlemma nopad_padding_append:\n \"nopad xs \\ [] \\\n nopad (xs @ padding m) = nopad xs @ padding m\"\n by (clarsimp simp add: nopad_def padding_def)\n\nlemma valid_list_trans_append_padding:\n \"valid_list_trans xs \\\n valid_list_trans (xs @ padding n)\"\n apply (induct xs rule: valid_list_trans.induct)\n apply simp\n apply (erule valid_list_trans.elims)\n apply simp\n apply (rename_tac b' buf' b buf)\n apply (clarsimp)\n apply (frule_tac ys=\"(b # buf @ padding n)\" in valid_trans_prefixD, simp)\n apply (clarsimp simp add: nopad_padding_drop_eq_Nil' split:if_splits)\n apply (frule_tac ys=\"(b # buf @ padding n)\" in valid_trans_prefix_imp, simp)\n apply assumption\n apply (frule_tac ys=\"(b # buf @ padding n)\" in valid_trans_prefix_imp, simp)\n apply simp\n apply (subgoal_tac \"(nopad (drop (trans_len (b # buf)) (b # buf)) @ padding n) = (nopad (drop (trans_len (b # buf)) (b # buf @ padding n)))\")\n apply simp\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (simp add: drop_append')\n apply (case_tac \"nopad (drop (trans_len (b # buf)) (b # buf))\")\n apply (simp add: nopad_padding_drop_eq_Nil' nopad_padding_append)+\n done\n\nlemma snd_list_trans_padding_unchanged:\nnotes list_trans.simps[simp del]\nand length_drop[simp del]\nand pTrans.simps[simp del]\nshows\n \"valid_list_trans xs \\ \n prod.snd (list_trans (xs @ padding n)) = prod.snd (list_trans xs)\"\n apply (case_tac n, simp add: padding_def)\n apply (induct xs rule: list_trans_induct)\n apply (frule valid_list_trans_append_padding[where n=n])\n apply (erule valid_list_trans.elims)\n apply (erule valid_list_trans.elims)\n apply clarsimp\n apply (rename_tac pad_len buf b)\n apply (clarsimp split: if_splits)\n apply (subgoal_tac \"nopad (drop (trans_len (b # buf @ padding (Suc pad_len))) (b # buf @ padding (Suc pad_len))) = nopad (drop (trans_len (b # buf)) (b # buf))\")\n prefer 2\n apply (drule valid_trans_valid_ObjHeaderD,drule is_valid_ObjHeader_trans_len_le_buf_len)\n apply (simp add: drop_append')\n apply (subst list_trans.simps)\n apply (rule sym, subst list_trans.simps, rule sym)\n apply (frule_tac xs=\"(b # buf)\" and ys=\"padding (Suc pad_len)\" in snd_pTrans_append)\n apply (simp only: prod.case_eq_if list.case_eq_if pTrans_remainder)\n apply (case_tac \"drop (trans_len (b # buf)) (b # buf)\")\n apply (simp add: snd_list_trans_Nil)+\n apply (subst list_trans.simps)\n apply (rule sym, subst list_trans.simps, rule sym)\n apply (frule_tac xs=\"(b # buf)\" and ys=\"padding (Suc pad_len)\" in snd_pTrans_append)\n apply (simp only: prod.case_eq_if list.case_eq_if pTrans_remainder)\n apply (subgoal_tac \"drop (trans_len (b # buf @ padding (Suc pad_len))) (b # buf @ padding (Suc pad_len)) \\ []\")\n prefer 2\n apply (frule_tac ys=\"b # buf @ padding (Suc pad_len)\" in valid_trans_prefixD, simp)\n apply (drule valid_trans_imp_valid_trans_trans_len)\n apply (simp add: drop_append' padding_def)\n apply simp\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (simp add: valid_trans_pTrans_non_empty_trans snd_list_trans_Nil)\n apply (frule_tac ys=\"(b # buf @ padding (Suc pad_len))\" in valid_trans_prefixD, simp)\n apply (simp add: )\n apply (frule_tac m=\"(Suc pad_len)\" in nopad_padding_drop_eq_NilD)\n apply simp\n apply (frule_tac ys=\"(b # buf @ padding (Suc pad_len))\" in valid_trans_prefixD, simp)\n apply (simp add: nopad_padding_drop_eq_Nil')\n (* last subgoal uses the induction hypothesis *)\n apply (subst list_trans.simps)\n apply (rule sym, subst list_trans.simps, rule sym)\n apply (frule_tac xs=\"b # buf @ padding (Suc pad_len)\" in valid_trans_pTrans_non_empty_trans)\n apply (frule_tac xs=\"b # buf\" in valid_trans_pTrans_non_empty_trans)\n apply (frule_tac ys=\"padding (Suc pad_len)\" in snd_pTrans_append)\n apply (frule nopad_not_Nil)\n apply (frule_tac ys=\"(b # buf @ padding (Suc pad_len))\" in valid_trans_prefixD, simp)\n apply (simp add: prod.case_eq_if list.case_eq_if del: drop_eq_Nil)\n apply (simp add: pTrans_remainder nopad_padding_drop_eq_Nil' drop_append')\n apply (drule_tac x=\"prod.fst $ pTrans (b#buf)\" and y=\"prod.snd $ pTrans (b#buf)\" in meta_spec2)\n apply (drule_tac x=pad_len in meta_spec)\n apply (simp add: pTrans_remainder)\n apply (erule meta_impE)\n apply (simp add: prod_eq[symmetric] pTrans_remainder)\n apply (erule trans[rotated])\n apply (rule arg_cong[where f=\"\\xs. prod.snd (list_trans xs)\"])\n apply (simp add: nopad_padding_append)\n done\n\nlemma snd_list_trans_no_pad_padding_unchanged:\n \"valid_list_trans xs \\ \n prod.snd (list_trans_no_pad (xs @ padding n)) = prod.snd (list_trans_no_pad xs)\"\n by (fastforce dest: snd_list_trans_padding_unchanged[where n=n] simp: list_trans_no_pad_def prod.case_eq_if simp del: list_trans.simps)\n\nlemma valid_list_trans_no_pad_append_padding:\n \"valid_list_trans_no_pad xs \\\n valid_list_trans_no_pad (xs @ padding n)\"\n by (clarsimp simp add: valid_list_trans_no_pad_def\n valid_list_trans_append_padding[where n=n]\n snd_list_trans_no_pad_padding_unchanged) \n\n \nlemma snd_list_trans_not_Nil:\n \"valid_list_trans xs \\\n prod.snd (list_trans xs) \\ []\"\n apply (erule valid_list_trans.elims)\n apply (clarsimp simp del: pTrans.simps)\n apply (frule valid_trans_pTrans_non_empty_trans)\n apply (clarsimp simp: prod.case_eq_if simp del: pTrans.simps split:list.splits)\n done\n\n \nlemma snd_list_trans_nopad_not_Nil:\n \"valid_list_trans_no_pad xs \\\n prod.snd (list_trans_no_pad xs) \\ []\"\n by (simp add: valid_list_trans_no_pad_def)\n\nlemma valid_trans_nth_0_neq_pad_byte:\n \"valid_trans xs \\ xs!0 \\ bilbyFsPadByte\"\n by (fastforce elim: valid_trans.elims dest: is_valid_ObjHeader_not_pad\n simp: is_valid_ObjTrans split:if_splits)\n\nlemma valid_list_trans_nth_0_neq_pad_byte:\n \"valid_list_trans ys \\ ys!0 \\ bilbyFsPadByte\"\n by (fastforce elim: valid_list_trans.elims dest: valid_trans_nth_0_neq_pad_byte)\n \nlemma nopad_drop_trans_len_Nil_append:\n \"valid_list_trans ys \\\n nopad (drop (trans_len xs) xs) = [] \\\n valid_trans xs \\\n nopad (drop (trans_len (xs @ ys)) (xs @ ys)) = ys\"\n apply (frule valid_trans_prefixD[where ys=\"(xs @ ys)\"], simp)\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (simp add: nopad_def)\n apply (frule valid_list_trans_nth_0_neq_pad_byte)\n apply (case_tac ys, fastforce+)\n done\n\nlemma nopad_drop_trans_len_Nil_append':\n \"valid_list_trans ys \\\n nopad (drop (trans_len xs) xs) = [] \\\n valid_trans xs \\\n nopad (drop (trans_len xs) (xs @ ys)) = ys\"\n apply (frule valid_trans_prefixD[where ys=\"(xs @ ys)\"], simp)\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (simp add: nopad_def)\n apply (frule valid_list_trans_nth_0_neq_pad_byte)\n apply (case_tac ys, fastforce+)\n done\n\n\nlemma nopad_drop_trans_len_not_Nil_append:\n \"nopad (drop (trans_len xs) xs) \\ [] \\\n valid_trans xs \\\n nopad (drop (trans_len (xs @ ys)) (xs @ ys)) \\ []\"\n apply (frule valid_trans_prefixD[where ys=\"xs@ys\"], simp)\n apply (frule valid_trans_imp_valid_trans_trans_len)\n apply (fastforce simp add: nopad_def)\ndone \n\nlemma nopad_ys_eq_ys_nopad_append:\n \"nopad ys = ys \\\n nopad (xs @ ys) = nopad xs @ ys\"\nby (metis (no_types, hide_lams) nopad_def append_self_conv dropWhile_append3\n dropWhile_eq_Cons_conv valid_list_trans.cases)\n\nlemma valid_list_trans_nopad_eq_id:\n \"valid_list_trans xs \\ nopad xs = xs\"\n by (cases xs) (frule valid_list_trans_nth_0_neq_pad_byte, simp add: nopad_def)+\n\nlemma valid_list_trans_append:\n assumes val_xs: \"valid_list_trans xs\"\n and val_ys: \"valid_list_trans ys\"\n shows\n \"valid_list_trans (xs@ys)\"\nproof -\n obtain y' ys' where ys_cons: \"ys = y'#ys'\" using val_ys by (case_tac ys, simp)\n show ?thesis\n using assms\n apply (induct xs rule: valid_list_trans.induct)\n apply simp\n apply (rename_tac x' xs')\n apply (clarsimp simp add: split: if_splits)\n apply (case_tac \"nopad (drop (trans_len (x' # xs' @ ys)) (x' # xs' @ ys)) = []\")\n apply simp\n apply (erule valid_trans_prefix_imp, simp)\n apply simp\n apply (frule_tac ys=\"x'#xs'@ys\" in valid_trans_prefix_imp)\n apply simp\n apply (simp only: Cons_append)\n apply (frule (2) nopad_drop_trans_len_Nil_append)\n apply simp\n apply (simp only: Cons_append)\n apply (frule (1) nopad_drop_trans_len_not_Nil_append[where ys=\"ys\"])\n apply clarsimp\n apply (frule_tac ys=\"x'#xs' @ ys\" in valid_trans_prefix_imp, simp)\n apply (simp)\n apply (frule_tac ys=\"(x' # xs' @ ys)\" in valid_trans_prefixD, simp)\n apply simp\n apply (simp add: drop_append')\n apply (frule_tac xs=\"x'#xs'\" in valid_trans_imp_valid_trans_trans_len)\n apply simp\n apply (frule valid_list_trans_nopad_eq_id)\n apply (simp add: nopad_ys_eq_ys_nopad_append)\n done\nqed\n\nlemma trans_len_append:\n \"valid_trans xs \\\n trans_len (xs @ ys) = trans_len xs\"\n apply (induct xs rule:trans_len.induct)\n apply simp\n apply (erule valid_trans.elims)\n apply (simp add: is_valid_ObjTrans)\n apply (clarsimp split: if_splits)\n apply (subst trans_len.simps)\n apply (rename_tac v vs)\n apply (frule_tac ys=\"(v#vs @ ys)\" in is_valid_ObjHeader_prefix, simp)\n apply (simp add: is_valid_ObjTrans)\n apply (frule (1) is_valid_ObjHeader_pObj_eq[where xs=ys] )\n apply (simp add: )\n apply (erule trans[rotated])\n apply (rule arg_cong[where f=trans_len])\n apply (frule is_valid_ObjHeader_trans_len_le_buf_len)\n apply (simp add: drop_append')\n apply (clarsimp simp add: is_valid_ObjTrans)\n apply (subst trans_len.simps)\n apply (simp add: is_valid_ObjTrans)\n apply (rename_tac v vs)\n apply (frule_tac ys=\"(v#vs @ ys)\" in is_valid_ObjHeader_prefix, simp)\n apply (simp add: is_valid_ObjTrans)\n apply (frule (1) is_valid_ObjHeader_pObj_eq[where xs=ys] )\n apply simp\n done\n\nlemma fst_pTrans_append_valid_trans_not_Nil:\nshows\n \"valid_trans xs \\ ys \\ [] \\\n prod.fst (pTrans (xs @ ys)) \\ []\"\n apply (subgoal_tac \"valid_trans (take (trans_len xs) xs)\")\n prefer 2\n apply (simp add: valid_trans_eq_valid_trans_take_trans_len[symmetric])\n apply (simp add: pTrans_remainder)\n apply (subgoal_tac \"trans_len (xs @ ys) = trans_len xs \\ trans_len xs \\ length xs\")\n apply simp\n apply (frule valid_trans_imp_valid_trans_trans_len, simp)\n apply (simp add: trans_len_append)\ndone\n\nlemma no_pad_byte_nopad_append:\n \"ys ! 0 \\ bilbyFsPadByte \\ \n nopad xs @ ys = nopad (xs @ ys)\"\n apply (simp add: nopad_def)\n apply (case_tac ys)\n apply simp\n apply simp\n apply (simp add: dropWhile_append3)\ndone\n\nlemma list_trans_append:\n notes list_trans.simps[simp del]\n and pTrans.simps[simp del]\n\n assumes valid_xs: \"valid_list_trans xs\"\n and valid_ys: \"valid_list_trans ys\"\n\n shows\n \"prod.snd (list_trans xs) @ prod.snd (list_trans ys) =\n prod.snd (list_trans (xs@ys))\"\nproof -\n obtain y' ys' where ys_cons: \"ys = y'#ys'\" using valid_ys by (case_tac ys, simp)\n\n have ys_not_Nil: \"ys \\ []\" using valid_ys by auto\n\n show ?thesis\n using assms\n proof (induction xs rule: list_trans_induct)\n fix data\n assume IH:\n \"(\\data' tx.\n (data', tx) = pTrans data \\\n data' \\ [] \\\n tx \\ [] \\\n valid_list_trans (nopad data') \\\n valid_list_trans ys \\\n prod.snd (list_trans (nopad data')) @ prod.snd (list_trans ys) =\n prod.snd (list_trans (nopad data' @ ys)))\"\n and valid_data: \"valid_list_trans data\"\n obtain d ds where data_cons: \"data = d#ds\" using valid_data by (case_tac data, simp)\n\n have val_trans_ys: \"valid_trans ys\"\n using valid_ys by (simp add: ys_cons)\n\n have val_trans_data: \"valid_trans data\"\n using valid_data by (simp add: data_cons)\n\n show \"prod.snd (list_trans data) @ prod.snd (list_trans ys) = prod.snd (list_trans (data @ ys))\"\n proof (cases \"nopad (drop (trans_len data) data)\")\n case Nil\n show ?thesis\n using Nil\n apply -\n apply (subst data_cons, subst list_trans.simps, simp only:data_cons[symmetric])\n apply (simp add: prod.case_eq_if)\n apply (simp add: pTrans_remainder)\n apply (simp add: list.case_eq_if)\n using valid_trans_pTrans_non_empty_trans[OF val_trans_data]\n apply simp\n using valid_trans_imp_valid_trans_trans_len[OF val_trans_data] \n apply (simp add: prod.case_eq_if snd_list_trans_Nil)\n apply (subst list_trans.simps[where data=\"data@ys\"])\n apply (simp add: prod.case_eq_if list.case_eq_if)\n using fst_pTrans_append_valid_trans_not_Nil[OF val_trans_data ys_not_Nil]\n apply (simp add: pTrans_valid_non_empty[OF val_trans_data] snd_pTrans_append[OF val_trans_data])\n apply (simp add: pTrans_remainder trans_len_append[OF val_trans_data] )\n using valid_trans_nth_0_neq_pad_byte[OF val_trans_ys]\n apply (simp add: nopad_def)\n apply (rule arg_cong[where f=prod.snd])\n apply (rule arg_cong[where f=list_trans])\n apply (case_tac ys, simp_all)\n done\n next\n case (Cons v vs)\n show ?thesis\n using Cons\n apply (subst list_trans.simps)\n apply (simp add: prod.case_eq_if list.case_eq_if)\n apply (simp add: pTrans_remainder)\n apply (simp add: valid_trans_pTrans_non_empty_trans[OF val_trans_data]) \n using valid_trans_pTrans_non_empty_trans[OF val_trans_data]\n apply (case_tac \"length data \\ trans_len data\")\n apply (simp add: nopad_def)\n apply (simp add: )\n using IH[where data'=\"prod.fst (pTrans data)\" and tx=\"prod.snd (pTrans data)\"]\n apply simp\n apply (erule meta_impE)\n apply (simp add: pTrans_remainder nopad_def)\n apply (simp add: valid_ys)\n apply (erule meta_impE)\n apply (simp only: pTrans_remainder)\n apply (drule sym[where t=\"v#vs\"], simp)\n apply (cut_tac valid_data[simplified data_cons valid_list_trans.simps, THEN conjunct2])\n apply (clarsimp simp add: data_cons[symmetric] split:if_splits)\n apply (drule sym[where t=\"v#vs\"])\n apply simp\n apply (simp only: pTrans_remainder)\n apply (thin_tac _)+\n apply (rule sym, subst list_trans.simps, rule sym)\n apply (simp only: prod.case_eq_if)\n apply (simp only: list.case_eq_if)\n apply (simp add: fst_pTrans_append_valid_trans_not_Nil[OF val_trans_data ys_not_Nil])\n apply (simp add: pTrans_valid_non_empty[OF val_trans_data])\n apply (simp add: snd_pTrans_append[OF val_trans_data])\n apply (simp only: pTrans_remainder)\n apply (simp add: valid_trans_prefixD[OF val_trans_data, where ys=\"data@ys\"])\n apply (simp add: valid_trans_imp_valid_trans_trans_len[OF val_trans_data])\n apply (rule arg_cong[where f=prod.snd])\n apply (rule arg_cong[where f=list_trans])\n using valid_trans_nth_0_neq_pad_byte[OF val_trans_ys]\n using valid_trans_imp_valid_trans_trans_len[OF val_trans_data] \n apply (simp add: no_pad_byte_nopad_append )\n done\n qed\n qed\nqed\n\nlemma valid_list_trans_no_pad_append:\n \"valid_list_trans_no_pad xs \\\n valid_list_trans_no_pad ys \\\n valid_list_trans_no_pad (xs@ys)\"\n using valid_list_trans_append[where xs=xs and ys=ys]\n snd_list_trans_not_Nil[where xs=xs] snd_list_trans_not_Nil[where xs=ys]\n list_trans_append[where xs=xs and ys=ys, symmetric]\n by (clarsimp simp add: prod.case_eq_if valid_list_trans_no_pad_def\n list_trans_no_pad_def simp del:list_trans.simps)\n\nlemma valid_list_trans_no_pad_imp_valid_list_trans:\n \"valid_list_trans_no_pad xs \\ valid_list_trans xs\"\n by (simp add: valid_list_trans_no_pad_def)\n\nlemma slice_drop:\n \"to \\ length xs \\ frm \\ to \\ slice frm to xs @ drop to xs = drop frm xs\"\n using drop_append[where xs=\"take to xs\" and ys=\"drop to xs\" and n=frm]\n by (simp add: slice_def min_absorb1 min_absorb2 unat_arith_simps)\n\nlemma list_trans_no_pad_append:\nnotes list_trans.simps[simp del]\nand pTrans.simps[simp del]\nassumes valid_slice: \"valid_list_trans xs\"\nand valid_drop: \"valid_list_trans ys\"\nshows\n \"prod.snd (list_trans_no_pad xs) @ prod.snd (list_trans_no_pad ys) =\n prod.snd (list_trans_no_pad (xs@ys))\"\n using list_trans_append assms\n by (clarsimp simp: valid_list_trans_no_pad_def list_trans_no_pad_def\n prod.case_eq_if filter_append[symmetric] slice_drop min_absorb2)\n\n\n(* Do I need this lemma?\n It seems that it's not needed it until I start reasoning about pollute_buf. *)\n(*\nlemma fst_list_trans:\nassumes prefixeq: \"prefixeq xs ys\"\nand valid_list: \"valid_list_trans xs\"\nand no_valid_obj: \"\\valid_obj (drop (length xs) ys)\"\n (*nopad (drop (length xs) ys) \\ [] \\*)\nshows\n \"fst (list_trans ys) = drop (length xs) ys\"\nproof -\n from valid_list have \"valid_trans xs\"\n by - (erule valid_list_trans.elims, simp)\n hence valid_ys: \"valid_trans ys\"\n using prefixeq by (rule valid_trans_prefixeq_imp)\n have \"snd (pTrans ys) \\ []\"\n using valid_trans_pTrans_non_empty_trans[OF valid_ys] .\n thus ?thesis\n using assms\n proof (induction \"ys\" arbitrary:xs rule: list_trans_induct)\n fix xs ys\n assume snd_pTrans: \"snd (pTrans ys) \\ []\"\n and prefixeq: \"prefixeq xs ys\"\n and valid_list: \"valid_list_trans xs\"\n and not_valid_obj: \"\\ valid_obj (drop (length xs) ys)\"\n and IH:\n \"\\data' tx xs.\n (data', tx) = pTrans ys \\\n data' \\ [] \\\n tx \\ [] \\\n snd (pTrans (nopad data')) \\ [] \\\n prefixeq xs (nopad data') \\\n valid_list_trans xs \\\n \\ valid_obj (drop (length xs) (nopad data')) \\\n fst (list_trans (nopad data')) = drop (length xs) (nopad data')\"\n show \"fst (list_trans ys) = drop (length xs) ys\"\n proof -\n obtain zs where zsimp: \"ys = xs @ zs\"\n using prefixeq by (fastforce simp : prefixeq_def)\n have valid_trans_xs: \"valid_trans xs\"\n using valid_list by - (erule valid_list_trans.elims, simp)\n hence xs_not_nil: \"xs \\ []\"\n using valid_trans_xs by (case_tac xs, simp_all)\n have valid_trans_ys: \"valid_trans (xs@zs)\"\n using valid_trans_prefixeq_imp[OF valid_trans_xs prefixeq, simplified zsimp] .\n hence ys_not_nil: \"(xs@zs) \\ []\"\n using valid_trans_xs by (case_tac \"xs@zs\", simp_all)\n have trans_len_eq: \"trans_len (xs@zs) = trans_len xs\"\n using valid_trans_prefixeqD[OF valid_trans_xs prefixeq, simplified zsimp] .\n have trans_len_le_length_xs: \"trans_len xs \\ length xs\"\n using valid_trans_imp_valid_trans_trans_len[OF valid_trans_xs] .\n have xs_remainder: \"fst (pTrans xs) = drop (trans_len xs) xs\"\n using pTrans_remainder[where buf=\"xs\"] .\n have ys_remainder: \"fst (pTrans (xs @ zs)) = drop (trans_len (xs @ zs)) (xs @ zs)\"\n using pTrans_remainder[where buf=\"xs@zs\"] .\n thus ?thesis\n proof cases\n assume length_xs: \"trans_len xs = length xs\"\n hence fst_pTrans_ys:\"fst (pTrans (xs@zs)) = zs\"\n using ys_remainder trans_len_eq by simp\n thus ?thesis\n using snd_pTrans apply (case_tac ys, simp, simp del:pTrans.simps)\n apply (drule sym[where s=ys], simp add: zsimp prod.case_eq_if)\n apply (case_tac zs, simp split:list.splits)\n apply (simp)\n apply (case_tac \" snd (pTrans (xs @ zs))\", fastforce)\n using not_valid_obj_list_trans[OF not_valid_obj[simplified zsimp drop_length_append]]\n apply (simp del:pTrans.simps list_trans.simps add: prod.case_eq_if)\n oops\n next\n fix tx\n let ?vs = \"drop (trans_len xs) xs\"\n assume length_xs: \"trans_len xs \\ length xs\"\n hence vs_not_nil: \"?vs \\ []\"\n using trans_len_eq trans_len_le_length_xs by simp\n obtain data' where data'_pTrans: \"data' = fst (pTrans ys)\"\n by simp\n hence data_eq: \"data' = drop (trans_len ys) ys\"\n using zsimp ys_remainder by simp\n hence data'_not_nil: \"data' \\ []\"\n using ys_remainder zsimp trans_len_eq trans_len_le_length_xs length_xs by simp\n obtain tx where tx_facts: \"tx = snd (pTrans ys) \\ tx \\ []\"\n using snd_pTrans by fastforce\n\n hence a1: \"(data', tx) = pTrans ys\"\n using data'_pTrans tx_facts by fastforce\n have a5: \"prefixeq ?vs (nopad data')\"\n by (simp add: data_eq trans_len_eq zsimp)\n have a6: \"valid_list_trans ?vs\"\n using valid_list trans_len_le_length_xs length_xs\n by - (erule valid_list_trans.elims, fastforce)\n have a4: \"snd (pTrans (nopad data')) \\ []\"\n proof -\n have \"valid_trans ?vs\"\n using valid_list a6 length_xs trans_len_le_length_xs\n by - (fastforce elim: valid_list_trans.elims)\n hence \"valid_trans data'\"\n using a5 by - (drule valid_trans_prefixeq_imp)\n thus ?thesis\n by - (drule valid_trans_pTrans_non_empty_trans)\n qed\n have a7: \"\\ valid_obj (drop (length ?vs) data')\"\n using trans_len_le_length_xs trans_len_eq not_valid_obj\n by (simp add: zsimp data_eq)\n have \"fst (list_trans data') = drop (length ?vs) data'\"\n using IH[OF a1 data'_not_nil conjunct2[OF tx_facts] a4 ]\n using IH[OF a1 data'_not_nil conjunct2[OF tx_facts] a4 a5 a6 a7] oops\n thus ?thesis\n apply (simp only:zsimp data_eq)\n apply (subst list_trans.simps)\n using ys_remainder snd_pTrans[simplified zsimp] length_xs trans_len_eq\n apply (simp add: prod.case_eq_if del: list_trans.simps)\n apply (subgoal_tac \"drop (trans_len xs) xs @ drop (trans_len xs - length xs) zs \\ []\")\n using trans_len_le_length_xs\n apply (clarsimp simp: prod.case_eq_if simp del: list_trans.simps split: list.splits)+\n done\n qed\n qed\n qed\nqed\n*)\nend", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/spec/TransS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.1887575758874422}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__50_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__50_on_rules imports n_german_lemma_on_inv__50\nbegin\nsection{*All lemmas on causal relation between inv__50*}\nlemma lemma_inv__50_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__50 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__50) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__50_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.32423539898095244, "lm_q1q2_score": 0.18847903952391973}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory GraphRefine\n\nimports\n TailrecPre\n GraphLangLemmas\n Lib.Lib\n \"CParser.LemmaBucket_C\"\n ExtraSpecs\nbegin\n\ntype_synonym ('s, 'x, 'e) c_trace = \"nat \\ (('s, 'x, 'e) com \\ ('s, 'e) xstate) option\"\n\ndefinition\n c_trace :: \"('x \\ ('s, 'x, 'e) com option) \\ ('s, 'x, 'e) c_trace set\"\nwhere\n \"c_trace Gamma = nat_trace_rel (Not o final) {(cfg, cfg'). step Gamma cfg cfg'}\"\n\ndefinition\n \"exec_final_step cfg = (case cfg of (Throw, Normal xs) \\ Abrupt xs | _ \\ snd cfg)\"\n\nlemma exec_via_trace:\n \"Gamma \\ \\com, Normal s\\ \\ xs\n = (\\tr \\ c_trace Gamma. tr 0 = Some (com, Normal s)\n \\ option_map exec_final_step (trace_end tr) = Some xs)\"\nproof -\n have dom_If: \"\\n f. dom (\\i. if i \\ n then Some (f i) else None) = {..n}\"\n by (auto split: if_split_asm)\n have end_If: \"\\n f. trace_end (\\i. if i \\ n then Some (f i) else None) = Some (f n)\"\n apply (simp add: trace_end_def dom_If)\n apply (subst Max_eqI, simp+)\n apply (rule_tac x=\"Suc n\" in exI, simp)\n done\n show ?thesis unfolding c_trace_def\n apply safe\n apply (clarsimp simp: relpowp_fun_conv dest!: exec_impl_steps rtranclp_imp_relpowp)\n apply (rule_tac x=\"\\i. if i \\ n then Some (f i) else None\" in bexI)\n apply (simp add: end_If exec_final_step_def split: xstate.split_asm)\n apply (simp add: nat_trace_rel_def)\n apply (clarsimp simp: linorder_not_le less_Suc_eq)\n apply (simp add: final_def split: xstate.split_asm)\n apply (drule(1) trace_end_SomeD)\n apply clarsimp\n apply (subgoal_tac \"rtranclp (step Gamma) (the (tr 0)) (the (tr n))\")\n apply (clarsimp simp: final_def)\n apply (auto simp: exec_final_step_def dest: steps_Skip_impl_exec steps_Throw_impl_exec)[1]\n apply (simp add: rtranclp_power relpowp_fun_conv)\n apply (rule_tac x=n in exI)\n apply (rule_tac x=\"the o tr\" in exI)\n apply (frule(1) trace_None_dom_eq)\n apply (clarsimp simp: nat_trace_rel_def)\n apply (subgoal_tac \"i \\ dom tr \\ Suc i \\ dom tr\")\n apply clarify\n apply metis\n apply (drule(1) eqset_imp_iff[THEN iffD1, rotated, OF domI])+\n apply simp\n done\nqed\n\nabbreviation\n \"extend_rel \\ {((i :: nat, tr), (j, tr')).\n j > i \\ restrict_map tr {.. i} = restrict_map tr' {.. i}}\"\n\ndefinition\n \"suffix_tuple_closure_inter Ss\n = (\\S \\ Ss. {(y, tr). \\k. (y, restrict_map tr {.. k}) \\ S})\"\n\nlemma suffix_tuple_closure_prefixI:\n \"(y, restrict_map tr {.. (k :: nat)}) \\ suffix_tuple_closure_inter Ss\n \\ (y, tr) \\ suffix_tuple_closure_inter Ss\"\n by (auto simp add: suffix_tuple_closure_inter_def)\n\ndefinition\n trace_end_match :: \"(state \\ 's \\ bool) \\ 's set\n \\ stack option\n \\ ((('s, 'x, 'e) com \\ ('s, 'e) xstate) option)\n \\ bool\"\nwhere\n \"trace_end_match out_eqs I e e' = ((\\ft. e' = Some (com.Skip, Fault ft))\n \\ ((e = None) \\ (e' = None))\n \\ (\\sst' gst' gf'. e = Some [(Ret, gst', gf')]\n \\ e' = Some (com.Skip, Normal sst')\n \\ out_eqs gst' sst' \\ sst' \\ I))\"\n\ndefinition\n simpl_to_graph :: \"('x \\ ('s, 'x, 'e) com option)\n \\ (string \\ graph_function option) \\ string\n \\ next_node \\ ('s, 'x, 'e) com\n \\ nat \\ (trace \\ ('s, 'x, 'e) c_trace) set list\n \\ 's set \\ 's set \\ (state \\ 's \\ bool)\n \\ (state \\ 's \\ bool)\n \\ bool\"\nwhere\n \"simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\n = (\\tr gst sst n' gf' tr' n''. tr n' = Some [(nn, gst, gf')] \\ sst \\ P \\ sst \\ I\n \\ inp_eqs gst sst \\ n' \\ n \\ n'' \\ n\n \\ tr \\ exec_trace GGamma gf\n \\ (tr, restrict_map tr' {.. n''}) \\ suffix_tuple_closure_inter (set traces)\n \\ tr' \\ nat_trace_rel (\\x. False) {(cfg, cfg'). step SGamma cfg cfg'}\n \\ tr' n'' = Some (com, Normal sst)\n \\ (\\tr''. tr'' \\ c_trace SGamma \\ restrict_map tr'' {.. n''} = restrict_map tr' {.. n''}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr'')))\"\n\nlemma simpl_to_graph_ge_subset:\n \"simpl_to_graph SGamma GGamma gf nn com n traces' P I inp_eqs out_eqs\n \\ n' \\ n \\ set traces' \\ set traces\n \\ simpl_to_graph SGamma GGamma gf nn com n' traces P I inp_eqs out_eqs\"\n apply (simp add: simpl_to_graph_def suffix_tuple_closure_inter_def Ball_def)\n apply (erule mp[rotated], intro all_mono ex_mono imp_mono conj_mono imp_refl,\n simp_all)\n apply blast\n done\n\nlemmas simpl_to_graphI = simpl_to_graph_def[THEN iffD2, rule_format]\nlemmas simpl_to_graphD = simpl_to_graph_def[THEN iffD1, rule_format]\n\nlemma nat_trace_rel_split:\n \"tr n = Some v\n \\ tr' (Suc n) = Some v'\n \\ (v, v') \\ R\n \\ tr \\ nat_trace_rel cont' R\n \\ (\\i. tr' (Suc n + i)) \\ nat_trace_rel cont R\n \\ (\\i. if i \\ n then tr i else tr' i) \\ nat_trace_rel cont R\"\n apply (frule(1) trace_Some_dom_superset)\n apply (clarsimp simp: nat_trace_rel_def, safe)\n apply (simp_all add: linorder_not_le less_Suc_eq_le subset_iff domIff)\n apply (drule_tac x=\"na - Suc n\" in spec | clarsimp)+\n done\n\nlemma nat_trace_rel_to_relpow:\n \"trace \\ nat_trace_rel cont R\n \\ trace i = Some x\n \\ trace (i + j) = Some y\n \\ (x, y) \\ R ^^ j\"\n apply (induct j arbitrary: y)\n apply simp\n apply atomize\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=\"i + j\" in spec, clarsimp)\n apply auto\n done\n\nlemma exec_graph_trace_must_take_steps:\n \"trace \\ exec_trace \\ fn\n \\ trace i = Some [(nn, st, fn)]\n \\ (exec_graph_step \\ ^^ j) `` {[(nn, st, fn)]} \\ {[(nn', st', fn)]}\n \\ \\k < j. \\st'. ([(nn, st, fn)], st') \\ exec_graph_step \\ ^^ k\n \\ continuing st'\n \\ trace (i + j) = Some [(nn', st', fn)]\"\n apply (case_tac \"trace (i + j)\")\n apply (clarsimp simp add: exec_trace_def)\n apply (drule(1) trace_None_dom_eq)\n apply clarsimp\n apply (drule sym[where s=\"dom trace\"])\n apply (frule_tac x=i in eqset_imp_iff)\n apply (frule_tac x=\"n' - 1\" in eqset_imp_iff)\n apply (frule_tac x=\"n'\" in eqset_imp_iff)\n apply (simp(no_asm_use), clarsimp simp: domIff)\n apply (frule_tac i=\"n' - 1\" in trace_end_eq_Some, simp+)\n apply (drule(1) trace_end_SomeD, clarsimp)\n apply (drule_tac x=\"n' - 1 - i\" in spec, simp)\n apply (drule_tac i=i and j=\"n' - 1 - i\" in nat_trace_rel_to_relpow, simp+)\n apply (clarsimp simp add: exec_trace_def)\n apply (drule_tac i=i and j=j in nat_trace_rel_to_relpow, simp+)\n apply auto\n done\n\nlemma c_trace_may_extend:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ ((step \\) ^^ j) (com, Normal st) (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (cases \"j = 0\")\n apply fastforce\n apply (clarsimp simp: relpowp_fun_conv)\n apply (rule_tac x=\"\\k. if k \\ i then trace k else\n if k \\ i + j then Some (f (k - i))\n else None\"\n in exI)\n apply (intro conjI)\n apply (erule nat_trace_rel_split, simp, simp_all)\n apply (drule_tac x=0 in spec, simp)\n apply (simp add: nat_trace_rel_def)\n apply (simp add: restrict_map_def cong: if_cong)\n apply (rule_tac k=i in suffix_tuple_closure_prefixI)\n apply (simp add: restrict_map_def cong: if_cong)\n done\n\nlemma c_trace_may_extend_steps:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ \\ \\ (com, Normal st) \\\\<^sup>* (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\j trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (clarsimp simp: rtranclp_power)\n apply (blast intro: c_trace_may_extend)\n done\n\nlemma restrict_map_prefix_eq: \"(restrict_map tr {..n} = restrict_map tr' {..n})\n = (\\i \\ n. tr i = tr' i)\"\n by (auto simp add: fun_eq_iff restrict_map_def)\n\nlemma restrict_map_eq_mono:\n \"i \\ j \\ restrict_map tr {..j} = restrict_map tr' {..j}\n \\ restrict_map tr {.. (i :: 'a :: linorder)} = restrict_map tr' {..i}\"\n unfolding restrict_map_prefix_eq\n by clarsimp\n\nlemma simpl_to_graph_step_general:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. ((step SGamma) ^^ j) (com, Normal sst) (com', Normal sst')\n \\ (exec_graph_step GGamma ^^ i) `` {[(nn, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ (\\k < i. \\st'. ([(nn, gst, gf)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (n + min i j) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graphI)\n apply (erule_tac x=sst in meta_allE)\n apply (erule_tac x=gst in meta_allE)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_invariant_Cons)\n apply (frule(2) exec_graph_trace_must_take_steps)\n apply simp\n apply (frule(3) c_trace_may_extend)\n apply clarsimp\n apply (drule_tac n''=\"n'' + j\" in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (metis restrict_map_eq_mono[OF le_add1[where m=j]])\n done\n\nlemma simpl_to_graph_step:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ exec_graph_step GGamma `` {[(NextNode m, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (Suc n) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=1 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst sst')\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=0 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R_unchanged:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ (step SGamma) (com, Normal sst) (com', Normal sst))\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (erule simpl_to_graph_step_R[rotated])\n apply blast\n done\n\nlemma simpl_to_graph_steps_Fault1:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn com n Q P I eqs out_eqs\"\n apply (clarsimp simp: simpl_to_graph_def)\n apply (drule_tac x=sst in bspec, clarsimp+)\n apply (cut_tac \\=SGamma and c=\"com'\" and f=F in steps_Fault)\n apply (frule_tac c_trace_may_extend_steps, assumption)\n apply (erule(1) rtranclp_trans)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n done\n\nlemma extensible_traces_to_infinite_trace:\n assumes step: \"\\x \\ S. (trace x, trace (f x)) \\ extend_rel\n \\ f x \\ S \\ m x < m (f x)\"\n and x: \"x \\ S\"\n shows \"\\tr. \\i :: nat. \\y \\ S. \\j. m y > i \\ fst (trace y) > i\n \\ (trace y, (j, tr)) \\ extend_rel\"\nproof -\n\n let ?f = \"\\i. (f ^^ i) x\"\n\n have f_induct: \"\\i. m (?f i) \\ i \\ fst (trace (?f i)) \\ i \\ ?f i \\ S\"\n apply (induct_tac i)\n apply (simp add: x)\n apply (auto dest: step[rule_format])\n done\n\n have f_eq: \"\\i j k. i \\ fst (trace (?f j)) \\ j \\ k\n \\ fst (trace (?f j)) \\ fst (trace (?f k)) \\ snd (trace (?f k)) i = snd (trace (?f j)) i\"\n apply (intro allI, induct_tac k)\n apply simp\n apply clarsimp\n apply (cut_tac i=n in f_induct[rule_format], clarsimp)\n apply (frule_tac step[rule_format])\n apply (clarsimp simp: fun_eq_iff restrict_map_def linorder_not_le split_def\n split: if_split_asm)\n apply (drule_tac x=i in spec)\n apply (auto simp: le_Suc_eq)\n done\n\n have f_norm:\n \"\\i j. j \\ fst (trace (?f i)) \\ snd (trace (?f i)) j = snd (trace (?f j)) j\"\n apply clarsimp\n apply (cut_tac i=j and j=\"min i j\" and k=\"max i j\" in f_eq[rule_format])\n apply (simp add: min_def linorder_not_le f_induct)\n apply simp\n apply (simp add: min_def max_def split: if_split_asm)\n done\n\n show \"?thesis\"\n apply (rule_tac x=\"\\i. snd (trace (?f i)) i\" in exI)\n apply (clarsimp simp: split_def)\n apply (rule_tac x=\"?f (Suc i)\" in bexI)\n apply (cut_tac i=\"Suc i\" in f_induct)\n apply (clarsimp simp: fun_eq_iff restrict_map_def f_norm\n simp del: funpow.simps)\n apply (metis lessI)\n apply (simp add: f_induct del: funpow.simps)\n done\nqed\n\nlemma extensible_traces_to_infinite_trace_choice:\n assumes step: \"\\x \\ S. \\y. (trace x, trace y) \\ extend_rel\n \\ y \\ S \\ m x < m y\"\n and x: \"x \\ S\"\n shows \"\\tr. \\i :: nat. \\y \\ S. \\j. m y > i \\ fst (trace y) > i\n \\ (trace y, (j, tr)) \\ extend_rel\"\nproof -\n\n let ?P = \"\\i x. m x \\ i \\ fst (trace x) \\ i \\ x \\ S\"\n let ?Q = \"\\x y. m y > m x \\ (trace x, trace y) \\ extend_rel\"\n\n have induct:\n \"\\x n. ?P n x \\ \\y. ?P (Suc n) y \\ ?Q x y\"\n apply clarsimp\n apply (frule step[THEN bspec])\n apply clarsimp\n apply (rule_tac x=y in exI)\n apply simp\n done\n\n obtain f where f: \"\\n. ?P n (f n) \\ ?Q (f n) (f (Suc n))\"\n using x dependent_nat_choice[where P=\"?P\" and Q=\"\\_. ?Q\"]\n by (simp only: induct, auto)\n\n have f_induct: \"\\i. m (f i) \\ i \\ fst (trace (f i)) \\ i \\ f i \\ S\"\n apply (cut_tac n=i in f[rule_format], simp)\n done\n\n have f_eq: \"\\i j k. i \\ fst (trace (f j)) \\ j \\ k\n \\ fst (trace (f j)) \\ fst (trace (f k)) \\ snd (trace (f k)) i = snd (trace (f j)) i\"\n apply (intro allI, induct_tac k)\n apply simp\n apply clarsimp\n apply (cut_tac i=n in f_induct[rule_format], clarsimp)\n apply (cut_tac n=n in f[rule_format], simp)\n apply (clarsimp simp: fun_eq_iff restrict_map_def linorder_not_le split_def\n split: if_split_asm)\n apply (drule_tac x=i in spec)\n apply (auto simp: le_Suc_eq)\n done\n\n have f_norm:\n \"\\i j. j \\ fst (trace (f i)) \\ snd (trace (f i)) j = snd (trace (f j)) j\"\n apply clarsimp\n apply (cut_tac i=j and j=\"min i j\" and k=\"max i j\" in f_eq[rule_format])\n apply (simp add: min_def linorder_not_le f_induct)\n apply simp\n apply (simp add: min_def max_def split: if_split_asm)\n done\n\n show \"?thesis\"\n apply (rule_tac x=\"\\i. snd (trace (f i)) i\" in exI)\n apply (clarsimp simp: split_def)\n apply (rule_tac x=\"f (Suc i)\" in bexI)\n apply (cut_tac i=\"Suc i\" in f_induct)\n apply (clarsimp simp: fun_eq_iff restrict_map_def f_norm\n simp del: funpow.simps)\n apply (metis lessI)\n apply (simp add: f_induct del: funpow.simps)\n done\nqed\n\nlemma trace_end_None_ge_seq:\n \"tr \\ nat_trace_rel c R\n \\ \\i. \\j \\ i. tr j \\ None\n \\ trace_end tr = None\"\n apply (clarsimp simp: trace_end_def)\n apply (drule_tac x=n in spec)\n apply (drule(1) trace_None_dom_subset)\n apply auto\n done\n\nlemma restrict_map_eq_Some_le:\n \"(restrict_map tr {..n} = restrict_map tr' {..m})\n \\ tr' (m :: nat) = Some v\n \\ n \\ m \\ (\\k \\ m. restrict_map tr {..k} = restrict_map tr' {..k})\"\n apply (frule_tac x=m in fun_cong, simp(no_asm_use) add: restrict_map_def)\n apply (simp split: if_split_asm)\n apply (auto simp: fun_eq_iff split: if_split_asm)\n done\n\nlemma trace_prefixes_to_trace:\n assumes i: \"\\i. \\j tr k. j \\ i \\ tr j \\ None\n \\ ((j, tr), (k, tr')) \\ extend_rel \\ tr \\ nat_trace_rel c R\"\n shows \"trace_end tr' = None \\ tr' \\ nat_trace_rel c' R\"\nproof (intro conjI)\n have weak: \"tr' \\ nat_trace_rel (\\x. False) R\"\n apply (clarsimp simp: nat_trace_rel_def)\n apply (cut_tac i=\"Suc n\" in i[rule_format])\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=n in spec, clarsimp)\n apply (clarsimp simp: restrict_map_prefix_eq)\n done\n\n have inf: \"\\i. tr' i \\ None\"\n apply (intro allI notI)\n apply (cut_tac i=i in i[rule_format])\n apply (clarsimp simp: restrict_map_prefix_eq)\n apply (drule trace_None_dom_subset[OF _ weak])\n apply auto\n done\n\n thus \"trace_end tr' = None\"\n by (simp only: trace_end_def, simp)\n\n show \"tr' \\ nat_trace_rel c' R\" using weak\n by (simp only: nat_trace_rel_def inf mem_Collect_eq, simp)\nqed\n\nlemma suffix_tuple_closure_inter_insert:\n \"(x, tr) \\ suffix_tuple_closure_inter (insert S Ss)\n = ((\\k. (x, restrict_map tr {..k}) \\ S) \\ (x, tr) \\ suffix_tuple_closure_inter Ss)\"\n by (simp add: suffix_tuple_closure_inter_def)\n\nlemma simpl_to_graph_induct_proof:\n assumes Suc: \"\\S' n'. n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com (Suc n') (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n (({tr} \\ UNIV) # S) P I inp_eqs out_eqs\"\nproof -\n obtain M where M_def:\n \"M = (\\n1 tr1. {(n', n'', tr'). tr' \\ nat_trace_rel (\\x. False) {(x, y). SGamma\\ x \\ y}\n \\ (\\sst gst gf'. tr' n'' = Some (com, Normal sst) \\ tr n' = Some [(nn, gst, gf')]\n \\ inp_eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ (tr, restrict_map tr' {..n''}) \\ suffix_tuple_closure_inter (set S)\n \\ restrict_map tr' {..n1} = restrict_map tr1 {..n1}\n \\ n' \\ n \\ n'' \\ n \\ n'' \\ n1)})\"\n by auto\n\n have induct_ge: \"\\S' m n'. m \\ n \\ simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n'\n \\ n' \\ n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n apply (erule(1) inc_induct)\n apply clarsimp\n apply (erule(1) Suc)\n done\n\n hence ge: \"\\S' m n'. simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n' \\ n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n by auto\n\n have terminating_case: \"\\i j orig_tr' n1 tr1. (i, j, orig_tr') \\ M n1 tr1\n \\ tr \\ exec_trace GGamma gf\n \\ \\v' \\ M n1 tr1. fst v' > i \\ ((j, orig_tr'), snd v') \\ extend_rel\n \\ \\tr'. tr' \\ c_trace SGamma\n \\ restrict_map tr' {..j} = restrict_map orig_tr' {..j}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr')\"\n apply (cut_tac n'=\"min i j\" and m=\"Suc (max i j)\"\n and S'=\"{tr} \\ {restrict_map orig_tr' {..j}}\" in ge)\n apply (clarsimp simp: M_def simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (erule_tac x=n' in allE, erule_tac x=n'' in allE, erule_tac x=tr' in allE)\n apply (simp add: Suc_le_eq)\n apply (drule(1) restrict_map_eq_Some_le)\n apply simp\n apply simp\n apply (clarsimp simp: M_def)\n apply (clarsimp simp: M_def)\n apply (erule_tac n''=j and tr'=orig_tr' in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply (metis min.idem)\n apply simp\n done\n\n have infinite_case:\n \"\\v' n1 tr1. \\v \\ M n1 tr1. \\v' \\ M n1 tr1. fst v' > fst v \\ (snd v, snd v') \\ extend_rel\n \\ tr \\ exec_trace GGamma gf\n \\ v' \\ M n1 tr1\n \\ \\tr'. trace_end tr = None\n \\ restrict_map tr' {.. n1} = restrict_map tr1 {.. n1}\n \\ trace_end tr' = None\n \\ tr' \\ c_trace SGamma\"\n apply (drule extensible_traces_to_infinite_trace_choice[where\n trace=snd and m=fst, rotated])\n apply (rule ballI, drule(1) bspec)\n apply fastforce\n apply (erule exE, rename_tac tr')\n apply (rule_tac x=tr' in exI)\n apply (rule conjI)\n apply (rule trace_end_None_ge_seq)\n apply (auto simp add: exec_trace_def)[1]\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n apply (clarsimp simp: c_trace_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n1 in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n apply (rule trace_prefixes_to_trace)\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n done\n\n show ?thesis\n apply (clarsimp simp: simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (case_tac \"(\\v \\ M n'' tr'. \\v' \\ M n'' tr'. fst v' > fst v \\ (snd v, snd v') \\ extend_rel)\")\n apply (drule(1) infinite_case)\n apply (fastforce simp add: M_def)\n apply (fastforce simp: trace_end_match_def)\n apply clarsimp\n apply (frule(1) terminating_case, simp)\n apply (clarify, rename_tac soln_tr', rule_tac x=soln_tr' in exI)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n'' in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n done\nqed\n\nlemma simpl_to_graph_induct:\n assumes Suc: \"\\S' k. simpl_to_graph SGamma GGamma gf nn com (Suc n + k) (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com (n + k) (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n S P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (cut_tac tr=tr and n=n and S=S in simpl_to_graph_induct_proof)\n apply (cut_tac S'=S' and k=\"n'a - n\" in Suc)\n apply simp+\n apply (erule simpl_to_graphD)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply blast\n done\n\ndefinition\n \"eq_impl addr eqs eqs2 S = (\\gst sst. eqs gst sst \\ sst \\ S \\ eqs2 gst sst)\"\n\nlemma eq_implD:\n \"\\ eq_impl addr eqs eqs2 S; eqs gst sst; sst \\ S \\\n \\ eqs2 gst sst\"\n by (simp add: eq_impl_def)\n\nlemma simpl_to_graph_cases:\n \"simpl_to_graph SGamma GGamma gf nn com n traces (P \\ S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces (P \\ - S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (case_tac \"sst \\ S\")\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ S\"] Compl_iff Int_iff)\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ - S\"] Compl_iff Int_iff)\n done\n\nlemma exec_graph_step_image_node:\n \"GGamma f = Some gf \\ function_graph gf n = Some node\n \\ exec_graph_step GGamma `` {[(NextNode n, gst, f)]}\n = exec_node GGamma gst node [(NextNode n, gst, f)]\"\n by (cases gf, simp add: exec_graph_step_def)\n\ndefinition\n \"add_cont com conts\n = foldl (\\c d. case d of Inl d' \\ c ;; d' | Inr d' \\ com.Catch c d') com conts\"\n\nlemma add_cont_Cons:\n \"add_cont c (Inl d # cont) = add_cont (c ;; d) cont\"\n \"add_cont c (Inr d # cont) = add_cont (com.Catch c d) cont\"\n by (simp_all add: add_cont_def)\n\nlemma add_cont_Nil:\n \"add_cont c [] = c\"\n by (simp add: add_cont_def)\n\nlemma add_cont_step:\n \"SGamma \\ (com, s) \\ (com', s')\n \\ SGamma \\ (add_cont com con, s) \\ (add_cont com' con, s')\"\n apply (induct con rule: rev_induct)\n apply (simp add: add_cont_def)\n apply (simp add: add_cont_def step.intros split: sum.split)\n done\n\nlemma simpl_to_graph_Cond:\n \"\\ nn = NextNode m; GGamma gf = Some gfc; function_graph gfc m = Some (Cond l r cond);\n eq_impl nn eqs (\\gst sst. l \\ r \\ cond gst = (sst \\ C)) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I \\ C);\n simpl_to_graph SGamma GGamma gf l (add_cont c con) (Suc n) Q (P \\ C) I eqs2 out_eqs;\n eq_impl nn eqs eqs3 (P \\ I \\ (- C));\n simpl_to_graph SGamma GGamma gf r (add_cont d con) (Suc n) Q (P \\ - C) I eqs3 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Cond C c d) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (erule_tac nn'=l in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n apply (erule_tac nn'=r in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n done\n\nlemma simpl_to_graph_weaken[rotated]:\n assumes eqs: \"\\gst sst. eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ eqs2 gst sst \\ sst \\ Q\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n tS Q I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n using eqs\n apply (clarsimp simp add: simpl_to_graph_def)\n apply blast\n done\n\nlemma simpl_to_graph_weaken_eq_impl:\n \"eq_impl nn eqs eqs2 (I \\ P)\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_While_lemma:\n assumes ps: \"GGamma f = Some gf\" \"nn = NextNode m\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ P)\"\n assumes loop: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) P I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (P \\ C) I eqs out_eqs\"\n assumes exitloop: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (P \\ (- C)) I eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_induct)\n apply (simp add: ps)\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule loop)\n apply (simp add: ps)\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule simpl_to_graph_ge_subset)\n apply (rule exitloop)\n apply fastforce\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n done\n\nlemma simpl_to_graph_While_inst:\n assumes ps: \"nn = NextNode m\" \"GGamma f = Some gf\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ G)\"\n and ss_eq: \"eq_impl nn eqs eqs2 (I \\ G \\ C)\"\n and ss: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) G I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (G \\ C) I eqs2 out_eqs\"\n and ex_eq: \"eq_impl nn eqs eqs3 (I \\ G \\ - C)\"\n and ex: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (G \\ (- C)) I eqs3 out_eqs\"\n and in_eq: \"eq_impl nn eqs (\\gst sst. sst \\ G) (I \\ G')\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS G' I eqs out_eqs\"\n apply (rule simpl_to_graph_weaken)\n apply (rule simpl_to_graph_While_lemma[where P=G], (rule ps)+)\n apply (rule simpl_to_graph_weaken, erule ss)\n apply (clarsimp simp: ss_eq[THEN eq_implD])\n apply (rule simpl_to_graph_weaken, rule ex)\n apply (clarsimp simp: ex_eq[THEN eq_implD])\n apply (clarsimp simp: in_eq[THEN eq_implD])\n done\n\nlemma use_simpl_to_graph_While_assum:\n \"\\ simpl_to_graph SGamma GGamma f nn com n tS P I eqs out_eqs;\n n \\ n' \\ set tS \\ set tS';\n eq_impl nn eqs (\\gst sst. sst \\ P) (Q \\ I) \\\n \\ simpl_to_graph SGamma GGamma f nn com n' tS' Q I eqs out_eqs\"\n apply (erule simpl_to_graph_ge_subset[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (auto simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_Skip_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Skip con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Skip\n = simpl_to_graph_Skip_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Throw_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Throw con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Throw\n = simpl_to_graph_Throw_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Seq:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (c ;; d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inl d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma simpl_to_graph_Catch:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (com.Catch c d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inr d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma no_next_step: \"eq_impl nn' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 0) `` {[(nn, gst', fn)]} \\ {[(nn, gst', fn)]}\n \\ (\\k < (0 :: nat). \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n by (simp add: eq_impl_def)\n\nlemma basic_next_step: \"GGamma fn = Some gf \\ function_graph gf m = Some (Basic nn' upds)\n \\ eq_impl nn'' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 1) `` {[(NextNode m, gst', fn)]} \\ {[(nn', upd_vars upds gst', fn)]}\n \\ (\\k < 1. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n apply (clarsimp simp: eq_impl_def simp del: imp_disjL)\n apply (clarsimp simp: exec_graph_step_def K_def split: graph_function.split_asm)\n done\n\nlemma simpl_to_graph_Basic_next_step:\n assumes next_step: \"eq_impl nn eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn, gst', fn)]} \\ {[(nn', f gst', fn)]}\n \\ (\\k < steps. \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) (P \\ I)\"\n shows\n \"\\ eq_impl nn eqs (\\gst sst. eqs2 (f gst) (f' sst) \\ f' sst \\ I \\ f' sst \\ Q) (P \\ I);\n simpl_to_graph SGamma GGamma fn nn' (add_cont com.Skip con) (n + min steps 1) tS Q I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fn nn (add_cont (com.Basic f') con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where j=1 and i=steps, rotated -1])\n apply simp\n apply (frule eq_implD[OF next_step], simp)\n apply (simp add: eq_OO)\n apply (rule exI, rule conjI, blast intro: add_cont_step step.intros)\n apply (auto dest: eq_implD)\n done\n\nlemmas simpl_to_graph_Basic_triv'\n = simpl_to_graph_Basic_next_step[OF no_next_step]\n\nlemmas simpl_to_graph_Basic_triv = simpl_to_graph_Basic_triv'[where f'=\"\\x. x\" and Q=UNIV]\n\nlemmas simpl_to_graph_Basic\n = simpl_to_graph_Basic_next_step[OF basic_next_step, where Q=UNIV]\n\ndefinition\n \"upd_range upd_fun v = range (upd_fun (\\_. v))\"\n\nlemma simpl_to_graph_cbreak:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Break) sst) \\ exn_upd (\\_. Break) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (cbreak exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: cbreak_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Break:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Break \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Skip con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Break) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (blast intro: add_cont_step step.intros)\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Return:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Return \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Return) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (rule add_cont_step step.CondFalse)+\n apply clarsimp\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_creturn_void:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Return) sst) \\ exn_upd (\\_. Return) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (creturn_void exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: creturn_void_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma rtranclp_respects_fun:\n assumes respects: \"\\x y. R x y \\ R (f x) (f y)\"\n shows \"R\\<^sup>*\\<^sup>* x y \\ R\\<^sup>*\\<^sup>* (f x) (f y)\"\n apply (induct rule: rtranclp.induct)\n apply (fastforce intro: respects elim: rtranclp_trans)+\n done\n\nlemma add_cont_steps:\n \"\\ \\ (com, xs) \\\\<^sup>* (com', xs')\n \\ \\ \\ (add_cont com con, xs) \\\\<^sup>* (add_cont com' con, xs')\"\n apply (drule_tac f=\"\\(a, b). (add_cont a con, b)\" in rtranclp_respects_fun[rotated])\n apply clarsimp\n apply (erule add_cont_step)\n apply simp\n done\n\nlemma simpl_to_graph_steps_Fault:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont com con) n Q P I eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graph_steps_Fault1)\n apply (drule_tac x=s in bspec, clarsimp+)\n apply (rule exI)\n apply (erule add_cont_steps)\n done\n\nlemma simpl_to_graph_Guard:\n \"\\ nn = NextNode m; eq_impl nn eqs eqs2 (P \\ I \\ G);\n simpl_to_graph SGamma GGamma gf nn (add_cont c con) n Q (G \\ P) I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Guard F G c) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=G in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step_R_unchanged[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n apply (rule add_cont_step)\n apply (blast intro: step.Guard)\n apply (rule simpl_to_graph_steps_Fault)\n apply (blast intro: step.GuardFault)\n done\n\nlemma simpl_to_graph_done:\n \"\\ eq_impl nn eqs out_eqs (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf Ret (add_cont com.Skip []) n Q P I eqs out_eqs\"\n apply (clarsimp simp: c_trace_def add_cont_Nil intro!: simpl_to_graphI)\n apply (frule_tac i=n' in exec_trace_step_cases)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, simp add: final_def)\n apply (clarsimp simp: trace_end_cut exec_graph_step_def)\n apply (clarsimp simp: exec_trace_def trace_end_eq_Some\n eq_impl_def trace_end_match_def)\n done\n\nlemma eq_impl_refl:\n \"eq_impl nn eqs eqs P\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_done2 = simpl_to_graph_done[OF eq_impl_refl]\nlemmas simpl_to_graph_creturn_void2 = simpl_to_graph_creturn_void[where nn=Ret, OF eq_impl_refl]\n\nlemma simpl_to_graph_noop_Basic:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn upds);\n eq_impl nn eqs (\\gst sst. eqs2 (upd_vars upds gst) sst) (P \\ I);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where i=1 and j=0, rotated])\n apply simp+\n apply (simp add: exec_graph_step_image_node eq_impl_def K_def)\n done\n\nlemma simpl_to_graph_noop:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn []);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs;\n eq_impl nn eqs eqs2 (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (erule(1) simpl_to_graph_noop_Basic, simp_all)\n apply (simp add: upd_vars_def save_vals_def eq_impl_def)\n done\n\nlemmas simpl_to_graph_nearly_done\n = simpl_to_graph_noop[where c=\"add_cont com.Skip []\"]\n\nlemma eq_impl_triv: \"eq_impl nn eqs eqs S\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_noop_same_eqs\n = simpl_to_graph_noop[OF _ _ _ eq_impl_triv]\n\ndefinition\n exec_trace_inputs :: \"graph_function \\ trace \\ variable list\"\nwhere\n \"exec_trace_inputs gfun tr = (case tr 0 of Some [(nn, gst, _)]\n => acc_vars (function_inputs gfun) gst)\"\n\ndefinition\n graph_fun_refines\nwhere\n \"graph_fun_refines SGamma GGamma I inputs proc outputs fname\n = (\\gf. GGamma fname = Some gf \\ length (function_inputs gf) = length inputs\n \\ length (function_outputs gf) = length outputs\n \\ distinct (function_inputs gf)\n \\ (\\tr \\ exec_trace GGamma fname.\n \\s. map (\\i. i s) inputs = exec_trace_inputs gf tr \\ s \\ I\n \\ ((\\ft. SGamma \\ \\com.Call proc, Normal s\\ \\ Fault ft)\n \\ (trace_end tr = None \\ \\ terminates SGamma (com.Call proc) (Normal s))\n \\ (\\gst sst. SGamma \\ \\com.Call proc, Normal s\\ \\ Normal sst\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ sst \\ I \\ map (\\j. j sst) outputs\n = acc_vars (function_outputs gf) gst))))\"\n\nlemma var_acc_var_upd:\n \"var_acc nm (var_upd nm' v st) = (if nm = nm' then v else var_acc nm st)\"\n by (cases st, simp add: var_acc_def var_upd_def)\n\nlemma var_acc_var_upd_same[simp]:\n \"var_acc nm (var_upd nm v st) = v\"\n by (simp add: var_acc_var_upd)\n\nlemma var_acc_var_upd_diff:\n \"nm \\ nm' \\ var_acc nm (var_upd nm' v st) = var_acc nm st\"\n by (simp add: var_acc_var_upd)\n\nlemma fetch_returned:\n \"\\ distinct vs; length vs = length xs \\\n \\ acc_vars vs (save_vals vs xs st) = xs\"\n apply (induct vs arbitrary: xs st)\n apply (simp add: acc_vars_def)\n apply (case_tac xs, simp_all add: save_vals_def acc_vars_def)\n apply (rule_tac P=\"\\st. var_acc a st = b\" and Q=\"\\x. x \\ set xs\" for a b xs\n in fold_invariant, simp)\n apply simp\n apply (clarsimp simp: var_acc_var_upd set_zip)\n done\n\nlemma c_trace_nontermination:\n \"tr \\ c_trace \\\n \\ trace_end tr = None\n \\ tr 0 = Some (com, st)\n \\ \\ terminates \\ com st\"\n apply (frule trace_end_NoneD, simp add: c_trace_def)\n apply (erule disjE)\n apply (clarsimp simp: c_trace_def nat_trace_rel_def)+\n apply (drule terminates_impl_no_infinite_trans_computation)\n apply auto\n done\n\nlemma trace_end_Ret_Err:\n \"trace \\ exec_trace Gamma fname\n \\ trace_end trace = Some v\n \\ \\gst er. v = [(er, gst, fname)] \\ er \\ {Ret, Err}\"\n apply (frule trace_end_SomeD)\n apply (clarsimp simp: exec_trace_def, assumption)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (auto simp: continuing_def exec_graph_invariant_Cons\n split: list.split_asm next_node.split_asm,\n auto simp: exec_graph_invariant_def)\n done\n\nlemma graph_fun_refines_from_simpl_to_graph_with_refine:\n \"\\ SGamma proc = Some com; GGamma fname = Some gf;\n simple_simpl_refines SGamma com' com;\n \\Q. simpl_to_graph SGamma GGamma fname (NextNode (entry_point gf)) (add_cont com' []) 0\n [Q] UNIV I eqs\n (\\s s'. map (\\i. var_acc i s) (function_outputs gf) = map (\\i. i s') outs);\n eq_impl (NextNode (entry_point gf))\n (\\gst sst. map (\\i. var_acc i gst) (function_inputs gf) = map (\\i. i sst) ins)\n eqs I;\n distinct (function_inputs gf); length ins = length (function_inputs gf);\n length outs = length (function_outputs gf) \\\n \\ graph_fun_refines SGamma GGamma I ins proc outs fname\"\n apply (clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_def[THEN eqset_imp_iff, THEN iffD1])\n apply clarsimp\n apply (erule_tac x=\"UNIV \\ {[0 \\ (com', Normal s)]}\" in meta_allE)\n apply (drule_tac tr=tr and tr'=\"[0 \\ (com', Normal s)]\"\n and n'=0 and n''=0 and sst=s in simpl_to_graphD)\n apply (rule conjI, assumption)\n apply (simp add: suffix_tuple_closure_inter_def exec_trace_def)\n apply (rule conjI)\n apply (erule eq_implD)\n apply (simp add: fetch_returned exec_trace_inputs_def acc_vars_def)\n apply simp\n apply (simp add: add_cont_Nil nat_trace_rel_def)\n apply (clarsimp simp: trace_end_match_def dest!: fun_cong[where x=0])\n apply (subgoal_tac \"\\st. trace_end tr'' = Some st\n \\ SGamma \\ \\com.Call proc,Normal s\\ \\ exec_final_step st\")\n apply (elim disjE exE conjE)\n apply (clarsimp simp: exec_final_step_def)\n apply clarsimp\n apply (drule step_preserves_termination[rotated])\n apply (erule step.Call)\n apply (drule simple_simpl_refines_no_fault_terminatesD)\n apply (blast intro: exec.Call)\n apply (simp add: c_trace_nontermination simple_simpl_refines_def)\n apply (frule(1) trace_end_Ret_Err)\n apply (clarsimp simp: exec_final_step_def acc_vars_def)\n apply metis\n apply clarsimp\n apply (rule exec.Call, assumption)\n apply (erule simple_simpl_refines_no_fault_execD[rotated])\n apply (blast intro: exec.Call)\n apply (simp add: exec_via_trace)\n apply metis\n done\n\nlemmas graph_fun_refines_from_simpl_to_graph\n = graph_fun_refines_from_simpl_to_graph_with_refine[OF _ _ simple_simpl_refines_refl]\n\nlemma simpl_to_graph_name_simpl_state:\n \"(\\sst. sst \\ P \\ simpl_to_graph SGamma GGamma gf nn com n traces {sst} I inp_eqs out_eqs)\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n by (simp add: simpl_to_graph_def, blast)\n\nlemma trace_drop_n_init:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr 0\n = Some [(NextNode (entry_point gf'), init_vars (function_inputs gf') inps st, fn')]\"\n apply (frule(1) exec_trace_invariant)\n apply (simp add: exec_graph_invariant_Cons)\n apply (frule_tac tr=tr and i=i in exec_trace_step_cases)\n apply (clarsimp simp: exec_graph_step_def split: graph_function.split_asm)\n apply (simp add: trace_drop_n_def)\n done\n\nlemma trace_drop_n_end:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr \\ exec_trace Gamma fn'\n \\ trace_end (trace_drop_n (Suc i) (Suc 0) tr) = Some [(Ret, st', fn''')]\n \\ \\j \\ 2. tr (i + j) = Some [(nn, return_vars (function_outputs gf') outps st' st, fn)]\"\n apply (frule trace_end_SomeD, (auto simp: exec_trace_def)[1])\n apply clarsimp\n apply (rename_tac j')\n apply (drule(4) exec_trace_drop_n_rest[rotated 2, rule_format], simp)\n apply (frule_tac i=\"Suc (i + j')\" in exec_trace_step_cases)\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_step_def exec_graph_invariant_def\n split: graph_function.split_asm)\n apply (rule_tac x=\"Suc (Suc j')\" in exI, simp)\n done\n\nlemma nontermination_to_c_trace:\n \"tr \\ nat_trace_rel F {(cfg, cfg'). \\ \\ cfg \\ cfg'}\n \\ tr i = Some (add_cont com con, st)\n \\ \\ terminates \\ com st\n \\ \\tr'. tr' \\ c_trace \\ \\ restrict_map tr' {..i} = restrict_map tr {..i}\n \\ trace_end tr' = None\"\n apply (clarsimp simp: terminates_iff_no_infinite_computation inf_def)\n apply (rule_tac x=\"\\j. if j \\ i then tr j else case f (j - i) of\n (com', st') \\ Some (add_cont com' con, st')\" in exI)\n apply (rule conjI)\n apply (simp add: c_trace_def)\n apply (rule nat_trace_rel_split, assumption, simp_all)\n apply (simp add: split_def)\n apply (rule add_cont_step)\n apply (drule spec[where x=0])\n apply simp\n apply (clarsimp simp: nat_trace_rel_def split_def)\n apply (rule add_cont_step, simp)\n apply (frule(1) trace_Some_dom_superset)\n apply (rule conjI)\n apply (simp add: restrict_map_def fun_eq_iff)\n apply (simp only: trace_end_def)\n apply (rule if_not_P)\n apply (simp add: trace_end_def split_def subset_iff domIff)\n done\n\nlemma simpl_to_graph_call_next_step:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n assumes next_step: \"eq_impl nn eqs_inner (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn', gst', p)]} \\ {[(nn'', f gst', p)]}\n \\ (\\k < steps. \\st'. ([(nn', gst', p)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n and rel: \"graph_fun_refines SGamma GGamma I inputs proc outputs p'\"\n and modifies: \"(\\\\. SGamma \\\\<^bsub>/UNIV\\<^esub> {\\} com.Call proc (Q \\)) \\ (Q = (\\_. UNIV))\"\n and init: \"eq_impl nn eqs (\\gst sst. initf sst \\ I\n \\ map (\\i. i gst) args = map (\\i. i (initf sst)) inputs) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\sst' vs. map (\\i. i sst') outputs = vs\n \\ sst' \\ I \\ sst' \\ Q (initf sst)\n \\ eqs2 (f (save_vals rets vs gst))\n (f' sst sst' (ret sst sst')) \\ f' sst sst' (ret sst sst') \\ I\n \\ eqs_inner (save_vals rets vs gst) (f' sst sst' (ret sst sst')))) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn'' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (call initf proc ret (\\x y. com.Basic (f' x y))) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: call_def block_def graph)\n apply (rule_tac i=0 and j=3 and P'=\"{initf sst}\"\n and inp_eqs'=\"\\gst _. eqs gst sst \\ sst \\ I\" in simpl_to_graph_step_general)\n apply (simp add: init[THEN eq_implD] numeral_3_eq_3 eq_OO)\n apply (rule conjI[OF _ refl])\n apply (intro relcomppI)\n apply (rule add_cont_step, rule step.DynCom)\n apply (simp add: add_cont_Cons[symmetric])\n apply (rule add_cont_step, rule step.Basic)\n apply (simp add: add_cont_Cons(1), rule add_cont_step, rule step.SeqSkip)\n apply simp\n apply (clarsimp intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (drule_tac x=\"initf sst\" in spec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def fetch_returned)\n apply (elim disjE exE conjE)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Fault)\n apply (rule steps_Fault)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n apply (frule(2) trace_end_trace_drop_n_None)\n apply (frule(2) nontermination_to_c_trace)\n apply (auto simp: trace_end_match_def)[1]\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Normal)\n apply (simp add: add_cont_Cons)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.CatchMiss exec.Seq exec.Skip exec.DynCom exec.Basic | simp)+\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp, clarsimp)\n apply (drule_tac x=ssta in spec, drule mp, rule conjI, assumption)\n apply (rule disjE[OF modifies])\n apply (drule spec, drule cvalidD[OF hoare_sound], simp+)\n apply clarsimp\n apply auto[1]\n apply simp\n apply clarsimp\n apply (frule next_step[THEN eq_implD], simp)\n apply (clarsimp simp: return_vars_def)\n apply (frule(3) exec_graph_trace_must_take_steps)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"f' a b c\" for a b c in simpl_to_graphD[OF cont])\n apply auto[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemmas simpl_to_graph_call_triv\n = simpl_to_graph_call_next_step[where f'=\"\\x y s. s\",\n where eqs_inner=\"\\_ _. True\", OF _ _ _ no_next_step]\n\nlemmas simpl_to_graph_call\n = simpl_to_graph_call_next_step[OF _ _ _ basic_next_step,\n where eqs_inner=\"\\_ _. True\"]\n\nlemma known_guard_then_basic_next_step:\n \"GGamma fn = Some gf \\ function_graph gf m = Some (node.Cond (NextNode m') Err C)\n \\ GGamma fn = Some gf \\ function_graph gf m' = Some (node.Basic nn'' upds)\n \\ eq_impl nn (\\gst' sst'. C gst') (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 2) `` {[(NextNode m, gst', fn)]} \\ {[(nn'', upd_vars upds gst', fn)]}\n \\ (\\k < 2. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n apply (clarsimp simp: eq_impl_def)\n apply (drule_tac n=m and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (drule_tac n=m' and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (simp add: numeral_2_eq_2 relcomp_Image less_Suc_eq K_def)\n apply (simp add: set_eq_iff)\n done\n\nlemmas simpl_to_graph_call_known_guard\n = simpl_to_graph_call_next_step[OF _ _ _ known_guard_then_basic_next_step]\n\nlemma simpl_to_graph_lvar_nondet_init:\n assumes stg: \"simpl_to_graph SGamma GGamma fname nn (add_cont com.Skip con) n traces UNIV I eqs2 out_eqs\"\n and eqs: \"eq_impl nn eqs (\\gst sst. \\f. eqs2 gst (updf f sst) \\ updf f sst \\ I) (P \\ I)\"\n shows \"simpl_to_graph SGamma GGamma fname nn\n (add_cont (lvar_nondet_init accf updf) con) n traces P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_R[OF _ stg])\n apply (simp add: lvar_nondet_init_def)\n apply (drule eq_implD[OF eqs], simp)\n apply (rule exI, rule conjI, rule add_cont_step)\n apply (rule step.Spec)\n apply simp\n apply (rule_tac x=undefined in exI, simp)\n apply simp\n done\n\nlemmas load_word_defs = load_word32_def load_word64_def\nlemmas store_word_defs = store_word32_def store_word64_def\n\nlemma c_guard_ptr_val_gt_0:\n \"c_guard (p :: ('a :: mem_type) ptr) \\ ptr_val p > 0\"\n apply (simp only: word_neq_0_conv[symmetric], rule notI)\n apply (cases p, simp)\n done\n\nlemma h_val_word8:\n \"h_val hp p = load_word8 (ptr_val p) hp\"\n by (simp add: h_val_def load_word8_def from_bytes_def typ_info_word\n word_rcat_bl)\n\nlemma h_val_word32:\n \"h_val hp p = load_word32 (ptr_val p) hp\"\n by (simp add: h_val_def load_word32_def from_bytes_def typ_info_word)\n\nlemma h_val_word64:\n \"h_val hp p = load_word64 (ptr_val p) hp\"\n by (simp add: h_val_def load_word64_def from_bytes_def typ_info_word)\n\nlemma h_val_ptr:\n \"h_val hp (p :: ('a :: c_type) ptr ptr) = Ptr (load_machine_word (ptr_val p) hp)\"\n by (simp add: h_val_def load_word_defs from_bytes_def typ_info_ptr word_size_def)\n\n(* FIXME: should this go into Word.word_ubin near norm_Rep? *)\nlemma bintrunc_len_eq_signed:\n \"bintrunc LENGTH('a) (uint (x :: 'a :: len signed word)) = uint x\"\n by (metis (full_types) len_signed word_of_int_uint word_ubin.eq_norm)\n\nlemma uint_word_of_int_uint_signed_unsigned:\n \"uint (word_of_int (uint (x :: 'a :: len signed word)) :: 'a word) = uint x\"\n by (metis len_signed uint_word_of_int_eq word_uint.Rep_inverse)\n\n(*FIXME: move to lib *)\nlemma is_up_is_down_remove_sign[simp]:\n \"is_up (UCAST('a :: len signed \\ 'a))\"\n \"is_down (UCAST('a signed \\ 'a))\"\n unfolding is_up_def is_down_def source_size target_size by simp_all\n\n(*FIXME: move to lib *)\nlemma to_bytes_remove_sign:\n \"to_bytes (w :: 'a :: len8 signed word) = to_bytes (UCAST('a signed \\ 'a) w)\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_def uint_up_ucast)\n\n(*FIXME: move to lib *)\nlemma size_of_remove_sign:\n \"size_of TYPE('a :: len8 signed word) = size_of TYPE('a word)\"\n by (simp add: size_of_def typ_info_word)\n\n(*FIXME: move to lib *)\nlemma heap_update_remove_sign:\n \"heap_update p (w :: 'a :: len8 signed word) hp =\n heap_update (PTR_COERCE('a signed word \\ 'a word) p) (ucast w) hp\"\n by (simp add: heap_update_def to_bytes_remove_sign size_of_remove_sign)\n\nlemma heap_update_word8:\n \"heap_update p (w :: 8 word) hp = store_word8 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word8_def word_rsplit_same)\n\nlemma heap_update_sword8:\n \"heap_update p (w :: 8 signed word) hp = store_word8 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_def store_word8_def to_bytes_remove_sign to_bytes_word8)\n\nlemma heap_update_word32:\n \"heap_update p w hp = store_word32 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word32_def)\n\nlemma heap_update_sword32:\n \"heap_update p (w :: 32 signed word) hp = store_word32 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_remove_sign heap_update_word32)\n\nlemma heap_update_word64:\n \"heap_update p w hp = store_word64 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word64_def)\n\nlemma heap_update_sword64:\n \"heap_update p (w :: 64 signed word) hp = store_word64 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_remove_sign heap_update_word64)\n\nlemma heap_update_ptr:\n \"heap_update (p :: ('a :: c_type) ptr ptr) p' hp = store_machine_word (ptr_val p) (ptr_val p') hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_ptr store_word_defs)\n\nlemma from_bytes_ucast_isom[OF refl refl]:\n \"x = from_bytes xs \\ y = from_bytes xs\n \\ size x = size y\n \\ size x = length xs * 8\n \\ ucast x = y\"\n apply (clarsimp simp: word_size from_bytes_def typ_info_word)\n apply (rule word_eqI)\n apply (simp add: nth_ucast word_size test_bit_rcat[OF refl refl])\n done\n\nlemma h_val_sword8:\n \"(h_val hp p :: 8 signed word) = ucast (h_val hp (ptr_coerce p) :: 8 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma h_val_sword32:\n \"(h_val hp p :: 32 signed word) = ucast (h_val hp (ptr_coerce p) :: 32 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma h_val_sword64:\n \"(h_val hp p :: 64 signed word) = ucast (h_val hp (ptr_coerce p) :: 64 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma to_bytes_ucast_isom[OF refl]:\n \"y = ucast x\n \\ size x = size y\n \\ 8 dvd size x\n \\ to_bytes y = to_bytes x\"\n apply (rule ext)\n apply (clarsimp simp: word_size to_bytes_def typ_info_word)\n apply (rule nth_equalityI)\n apply (simp add: word_size length_word_rsplit_exp_size')\n apply (clarsimp simp: dvd_def)\n apply (rule word_eqI)\n apply (simp add: test_bit_rsplit_alt length_word_rsplit_exp_size' word_size\n nth_ucast)\n apply auto\n done\n\nlemma to_bytes_sword:\n \"to_bytes (w :: ('a :: len8) signed word)\n = to_bytes (ucast w :: 'a word)\"\n by (simp add: to_bytes_ucast_isom word_size len8_dv8)\n\nlemma heap_list_update_word8:\n \"heap_update_list addr (to_bytes w (heap_list hp' 1 addr')) hp\n = store_word8 addr w hp\"\n \"heap_update_list addr (to_bytes w [hp' addr']) hp\n = store_word8 addr w hp\"\n by (simp_all add: to_bytes_def store_word8_def typ_info_word word_rsplit_same)\n\nlemma heap_list_update_word32:\n \"heap_update_list addr (to_bytes w (heap_list hp' 4 addr')) hp\n = store_word32 addr w hp\"\n by (simp add: to_bytes_def store_word32_def typ_info_word)\n\nlemma heap_list_update_word64:\n \"heap_update_list addr (to_bytes w (heap_list hp' 8 addr')) hp\n = store_word64 addr w hp\"\n by (simp add: to_bytes_def store_word64_def typ_info_word)\n\nlemma heap_list_update_ptr:\n \"heap_update_list addr (to_bytes p (heap_list hp' word_size addr')) hp\n = store_machine_word addr (ptr_val (p :: ('a :: c_type) ptr)) hp\"\n by (simp add: to_bytes_def store_word_defs typ_info_ptr)\n\nlemma field_lvalue_offset_eq:\n \"field_lookup (typ_info_t TYPE('a :: c_type)) f 0 = Some v\n \\ field_lvalue (ptr :: 'a ptr) f = ptr_val ptr + of_nat (snd v)\"\n apply (cases v, simp, drule field_lookup_offset_eq)\n apply (simp add: field_lvalue_def)\n done\n\nlemmas h_val_word_simps =\n h_val_word8 h_val_sword8\n h_val_word32 h_val_sword32\n h_val_word64 h_val_sword64\n h_val_ptr\n\nlemmas heap_update_word_simps =\n heap_update_word8 heap_update_sword8\n heap_update_word32 heap_update_sword32\n heap_update_word64 heap_update_sword64\n heap_update_ptr\n\nlemmas heap_list_update_word_simps =\n heap_list_update_word8\n heap_list_update_word32\n heap_list_update_word64\n heap_list_update_ptr[unfolded word_size_def]\n\nlemma image_fst_cart_UNIV_subset:\n \"S \\ (fst ` S) \\ UNIV\"\n by (auto elim: image_eqI[rotated])\n\nlemma simpl_to_graph_Err_cond:\n \"\\ nn = NextNode m; GGamma fname = Some gf;\n function_graph gf m = Some (node.Cond l Err Check);\n eq_impl nn eqs (\\gst sst. Check gst) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I);\n simpl_to_graph SGamma GGamma fname l com n traces P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule_tac i=1 and j=0 in simpl_to_graph_step_general[rotated -1])\n apply simp\n apply (simp add: exec_graph_step_image_node)\n apply (auto dest: eq_implD)\n done\n\nlemma simpl_to_graph_impossible:\n \"eq_impl nn eqs (\\_ _. False) (P \\ I)\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule simpl_to_graphI, clarsimp)\n apply (drule(1) eq_implD, simp+)\n done\n\ndefinition[simp]: \"VarMachineWord = arch_machine_word_constructor VarWord32 VarWord64\"\n\ndefinition\n \"asm_args_to_list enc xs m_ms\n = map VarMachineWord xs @ [VarMem (fst m_ms), VarMS (enc (snd m_ms))]\"\n\ndefinition\n \"asm_rets_to_list ret enc v mem_vs\n = (if ret then [VarMachineWord v] else []) @ [VarMem (fst mem_vs), VarMS (enc (snd mem_vs))]\"\n\ndefinition\n asm_fun_refines\nwhere\n \"asm_fun_refines specname ret enc len GGamma fname\n = (\\gf. GGamma fname = Some gf\n \\ distinct (function_inputs gf)\n \\ length (function_inputs gf) = len\n \\ (\\tr \\ exec_trace GGamma fname. \\inp_vs inp_mem_ms.\n exec_trace_inputs gf tr = asm_args_to_list enc inp_vs inp_mem_ms\n \\ (\\r gst.\n r \\ asm_semantics specname inp_vs inp_mem_ms\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ acc_vars (function_outputs gf) gst = split (asm_rets_to_list ret enc) r)))\"\n\nlemma asm_args_to_list_inj:\n \"(asm_args_to_list enc vs mem_ms = asm_args_to_list enc vs' mem_ms')\n = (vs = vs' \\ fst mem_ms = fst mem_ms' \\ enc (snd mem_ms) = enc (snd mem_ms'))\"\n apply (simp add: asm_args_to_list_def)\n apply (subst inj_map_eq_map)\n apply (rule inj_onI, simp)\n apply simp\n done\n\nlemma simpl_to_graph_call_asm_fun:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n and rel: \"asm_fun_refines specname ret enc len GGamma p'\"\n and init: \"eq_impl nn eqs (\\gst sst. sst \\ I\n \\ map (\\i. i gst) args = asm_args_to_list enc (asm_args sst)\n (asm_fetch (globals sst))\n \\ length args = len) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\m' v' (ms' :: 'a).\n gdata (asm_store gdata (m', ms') (globals sst)) = gdata (globals sst)\n \\ (v', (m', ms')) \\ asm_semantics specname (asm_args sst) (asm_fetch (globals sst))\n \\ eqs2 (save_vals rets (asm_rets_to_list ret enc v' (m', ms')) gst)\n (asm_ret v' (globals_update (asm_store gdata (m', ms')) sst))\n \\ asm_ret v' (globals_update (asm_store gdata (m', ms')) sst) \\ I)) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (Spec (asm_spec (ti :: 'a itself) gdata vol specname asm_ret asm_args)) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: graph intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: asm_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def)\n apply (subst(asm) fetch_returned, simp_all)\n apply (drule arg_cong[where f=length])+\n apply simp\n apply (simp add: asm_args_to_list_inj)\n apply (drule spec, drule mp, rule refl)\n apply clarsimp\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply clarsimp\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.Spec)\n apply (simp add: asm_spec_def)\n apply (erule rev_bexI)\n apply simp\n apply simp\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"asm_ret a b\" for a b in simpl_to_graphD[OF cont])\n apply (auto simp: return_vars_def asm_store_eq)[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemma take_1_drop:\n \"n < length xs \\ take (Suc 0) (drop n xs) = [xs ! n]\"\n apply (cases \"drop n xs\")\n apply simp\n apply (clarsimp dest!: nth_via_drop)\n done\n\nlemma ptr_safe_field:\n \"\\ ptr_safe (p :: ('a :: mem_type) ptr) d; field_ti TYPE('a) f = Some t;\n export_uinfo t = typ_uinfo_t TYPE('b) \\\n \\ ptr_safe (Ptr &(p\\f) :: ('b :: mem_type) ptr) d\"\n apply (clarsimp simp: field_ti_def split: option.split_asm)\n apply (erule(2) ptr_safe_mono)\n done\n\nlemma heap_update_list_If1:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if unat (x - p) < length xs then xs ! unat (x - p) else hp x)\"\n apply (subst coerce_heap_update_to_heap_updates[where chunk = 1, OF _ refl])\n apply simp\n apply (rule ext)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: take_1_drop)\n apply (rule refl)\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp split del: if_split)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: nth_append)\n apply (rule refl)\n apply (simp add: nth_append split del: if_split cong: if_cong)\n apply (auto simp: addr_card linorder_not_less less_Suc_eq take_bit_nat_eq_self unat_of_nat\n dest: word_unat.Rep_inverse')\n done\n\nlemma heap_update_list_If2:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if x \\ {p ..+ length xs} then xs ! unat (x - p) else hp x)\"\n apply (simp add: heap_update_list_If1)\n apply (rule ext, simp add: intvl_def)\n apply clarsimp\n apply (erule notE, erule order_le_less_trans[rotated])\n apply (simp add: unat_of_nat)\n done\n\nlemma word_sless_to_less:\n \"\\ 0 <=s x; 0 <=s y \\ \\ (x 0 <=s x; 0 <=s y \\ \\ (x <=s y) = (x <= y)\"\n apply (simp add: word_sle_def word_le_def)\n apply (simp add: sint_eq_uint word_msb_sint)\n done\n\nML \\\n\nstructure SimplToGraphProof = struct\n\nfun mk_ptr_val_app p =\n Const (@{const_name ptr_val}, fastype_of p --> @{typ machine_word}) $ p\n\nfun mk_arr_idx arr i = let\n val arrT = fastype_of arr\n val elT = case arrT of Type (@{type_name \"array\"}, [elT, _])\n => elT | _ => raise TYPE (\"mk_arr_idx\", [arrT], [arr])\n in Const (@{const_name \"Arrays.index\"}, arrT --> @{typ nat} --> elT)\n $ arr $ i\n end\n\nval gammaT_to_stateT = strip_type #> snd\n #> dest_Type #> snd #> the_single\n #> dest_Type #> snd #> hd\n\nfun mk_simpl_acc ctxt sT nm = let\n val sst = Free (\"sst\", sT)\n val symbol_table = Free (\"symbol_table\", @{typ \"string => machine_word\"})\n\n val [globals, globals_swap, t_hrs, t_hrs_update, globals_list, pms, pms_encode] =\n map (Syntax.read_term ctxt) [\n \"globals :: globals myvars \\ _\",\n \"globals_swap :: (globals \\ _) \\ _\",\n \"t_hrs_' :: globals \\ _\",\n \"t_hrs_'_update :: _ \\ globals \\ globals\",\n \"globals_list\",\n \"phantom_machine_state_' :: globals \\ _\",\n \"encode_machine_state\"\n ];\n\n val globals_sst = globals $ sst\n val _ = type_of globals_sst (* does type checking *)\n\n val globals_swap = globals_swap $ t_hrs $ t_hrs_update $ symbol_table $ globals_list\n\n fun do_pms_encode t = case pms_encode of Const _ => pms_encode $ t\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [t])\n\n val ghost_assns_fetch = Syntax.read_term ctxt \"ghost_assns_from_globals\"\n fun get_ghost_assns_fetch () = case head_of ghost_assns_fetch of Const _ => ghost_assns_fetch\n | _ => raise TERM (\"mk_simpl_acc: requires `ghost_assns_from_globals :: globals => ghost_assertions\", [])\n\n fun mk_sst_acc \"Mem\" = @{term hrs_mem} $ (t_hrs $ (globals_swap $ globals_sst))\n | mk_sst_acc \"HTD\" = @{term hrs_htd} $ (t_hrs $ globals_sst)\n | mk_sst_acc \"PMS\" = do_pms_encode (pms $ globals_sst)\n | mk_sst_acc \"GhostAssertions\" = get_ghost_assns_fetch () $ globals_sst\n | mk_sst_acc nm = if String.isPrefix \"rv#space#\" nm\n then mk_sst_acc (unprefix \"rv#space#\" nm)\n else if String.isSuffix \"#v\" nm\n then Syntax.read_term ctxt\n (suffix \"_'\" (unsuffix \"#v\" nm) ^ \" :: globals myvars => _\") $ sst\n else let\n val (head, tail) = Library.space_explode \".\" nm\n |> Library.split_last |> apfst (Library.space_implode \".\")\n val acc = mk_sst_acc head\n val typ_nm = fastype_of acc |> dest_Type |> fst\n val acc2 = if typ_nm = \"Arrays.array\"\n then mk_arr_idx acc (HOLogic.mk_number @{typ nat}\n (ParseGraph.parse_int tail))\n else Proof_Context.read_const {proper = true, strict = true}\n ctxt (typ_nm ^ \".\" ^ tail) $ acc\n in acc2 end\n fun mk_sst_acc2 nm = let\n val acc = mk_sst_acc nm\n val T = fastype_of acc |> dest_Type |> fst\n in if T = @{type_name ptr} then mk_ptr_val_app acc else acc end\n in Term.lambda sst (ParseGraph.mk_var_term (mk_sst_acc2 nm)) end\n\nfun foldr1_default _ v [] = v\n | foldr1_default f _ xs = foldr1 f xs\n\ndatatype hints = Hints of { deps: (string * term) list Inttab.table,\n hint_tactics: (Proof.context -> int -> tactic) Inttab.table,\n err_conds: Inttab.set }\n\nfun mk_graph_eqs Gamma (Hints hints) nm n = let\n val vs = case (Inttab.lookup (#deps hints) n) of\n SOME vs => vs\n | NONE => raise TERM (\"mk_graph_eqs: \" ^ nm ^ \" \" ^ string_of_int n, [])\n val sT = gammaT_to_stateT (fastype_of Gamma)\n val sst = Free (\"sst\", sT)\n\n val gst = @{term \"gst :: GraphLang.state\"}\n\n fun mk_eq (nm, acc) = HOLogic.mk_eq (@{term var_acc} $ HOLogic.mk_string nm $ gst,\n betapply (acc, sst))\n val eqs = map mk_eq vs\n in Term.lambda gst (Term.lambda sst\n (foldr1_default HOLogic.mk_conj @{term True} eqs)) end\n\nfun with_cache cache termfun tracer t = case Termtab.lookup (! cache) t\n of SOME v => v\n | NONE => let val v = termfun t\n in tracer t v; cache := Termtab.insert (K false) (t, v) (! cache); v end\n\nfun dest_nat (@{term Suc} $ n) = dest_nat n + 1\n | dest_nat (@{term \"0 :: nat\"}) = 0\n | dest_nat n = HOLogic.dest_number n |> snd\n\nfun simpl_to_graph_skel hints nm (Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ _ $ trS $ P $ I $ _ $ out_eqs)\n = Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ @{term \"n :: nat\"} $ Free (\"trS\", fastype_of trS)\n $ P $ I $ mk_graph_eqs SG hints nm (dest_nat nn) $ out_eqs\n | simpl_to_graph_skel _ _ t = raise TERM (\"simpl_to_graph_skel\", [t])\n\nfun simpl_to_graph_nn (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ (@{term NextNode} $ nn) $ _\n $ _ $ _ $ _ $ _ $ _ $ _)\n = dest_nat nn\n | simpl_to_graph_nn t = raise TERM (\"simpl_to_graph_nn\", [t])\n\nfun SUBGOAL tfun i t = Tactical.SUBGOAL tfun i t\n handle TYPE (s, tps, ts) => raise TYPE (\"SUBGOAL \" ^ s,\n tps, [Thm.cprem_of t i |> Thm.term_of] @ ts)\n\nval standard_GG = @{term \"GG :: string \\ graph_function option\"}\n\nfun graph_gamma_tac ctxt = SUBGOAL (fn (t, i) => let\n val (lhs, _) = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t)) |> HOLogic.dest_eq\n val _ = (head_of lhs = standard_GG andalso length (snd (strip_comb lhs)) = 1)\n orelse raise TERM (\"GG lhs\", [])\n val nm = the_single (snd (strip_comb lhs)) |> HOLogic.dest_string\n |> Long_Name.base_name\n val gfun = Syntax.read_term ctxt (nm ^ \"_graph_fun\")\n val gfun_def = Proof_Context.get_thm ctxt (nm ^ \"_graph_fun_def\")\n val _ = dest_Const (head_of gfun)\n val GG_assum = HOLogic.mk_eq\n (lhs, @{term \"Some :: graph_function \\ _\"} $ gfun)\n |> HOLogic.mk_Trueprop |> Thm.cterm_of ctxt |> Thm.assume\n |> simplify (put_simpset HOL_basic_ss ctxt addsimps [gfun_def])\n in resolve0_tac [GG_assum] i end\n handle TERM (s, ts) => raise TERM (\"graph_gamma_tac: \" ^ s, t :: ts))\n\nfun inst_graph_node_tac ctxt =\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms function_graph.simps})\n THEN' SUBGOAL (fn (t, i) => case\n HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n of @{term \"(=) :: node option \\ _\"} $ (f $ n) $ _ => (let\n val g = head_of f |> dest_Const |> fst\n val n' = dest_nat n\n val thm = Proof_Context.get_thm ctxt\n (Long_Name.base_name g ^ \"_\" ^ Int.toString n')\n val thm = if n = @{term \"Suc 0\"}\n then simplify (put_simpset HOL_basic_ss ctxt addsimps @{thms One_nat_def}) thm\n else thm\n in resolve0_tac [thm] i end handle TERM (s, ts) => raise TERM (\"inst_graph_node_tac: \" ^ s, t :: ts))\n | t => raise TERM (\"inst_graph_node_tac\", [t]))\n\nfun inst_graph_tac ctxt = graph_gamma_tac ctxt THEN' inst_graph_node_tac ctxt\n\nfun mk_graph_refines (funs : ParseGraph.funs) ctxt s = let\n val proc = Syntax.read_term ctxt\n (Long_Name.base_name s ^ \"_'proc\")\n val gamma = Syntax.read_term ctxt \"\\\"\n val invs = Syntax.read_term ctxt \"simpl_invariant\"\n val _ = case head_of invs of Const _ => ()\n | _ => raise TERM (\"mk_graph_refines: requires simpl_invariant constant\", [])\n val sT = fastype_of gamma |> gammaT_to_stateT\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val inputs = map (mk_simpl_acc ctxt sT) xs\n |> HOLogic.mk_list (sT --> @{typ variable})\n val outputs = map (mk_simpl_acc ctxt sT) ys\n |> HOLogic.mk_list (sT --> @{typ variable})\n in HOLogic.mk_Trueprop (Const (@{const_name graph_fun_refines}, [fastype_of gamma,\n @{typ \"string \\ graph_function option\"}, fastype_of invs,\n fastype_of inputs, fastype_of proc, fastype_of outputs,\n @{typ string}] ---> @{typ bool})\n $ gamma $ standard_GG $ invs $ inputs $ proc $ outputs\n $ HOLogic.mk_string s)\n end\n\nfun asm_spec_name_to_fn_name _ specname = let\n val name = space_implode \"_\" (space_explode \" \" specname)\n in \"asm_instruction'\" ^ name end\n\nfun mk_asm_refines (funs : ParseGraph.funs) ctxt specname = let\n val s = asm_spec_name_to_fn_name true specname\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val enc = Syntax.read_term ctxt \"encode_machine_state\"\n val _ = case enc of Const _ => ()\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [])\n in HOLogic.mk_Trueprop (Const (@{const_name asm_fun_refines},\n [@{typ string}, @{typ bool}, fastype_of enc, @{typ nat},\n fastype_of standard_GG, @{typ string}] ---> @{typ bool})\n $ HOLogic.mk_string specname\n $ (if (length ys > 2) then @{term True} else @{term False})\n $ enc\n $ HOLogic.mk_number @{typ nat} (length xs)\n $ standard_GG $ HOLogic.mk_string s)\n end\n\nfun apply_graph_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name graph_fun_refines}, _)\n $ _ $ _ $ _ $ _ $ _ $ _ $ s)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_graph_refines funs ctxt (HOLogic.dest_string s)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_asm_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name asm_fun_refines}, _)\n $ specname $ _ $ _ $ _ $ _ $ _)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_asm_refines funs ctxt (HOLogic.dest_string specname)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_impl_thm ctxt = SUBGOAL (fn (t, i) => case\n Logic.strip_assums_concl (Envir.beta_eta_contract t)\n of @{term Trueprop} $ (Const (@{const_name HOL.eq}, _)\n $ (_ $ Const (s, _)) $ (Const (@{const_name Some}, _) $ _))\n => resolve0_tac [Proof_Context.get_thm ctxt\n (suffix \"_impl\" (unsuffix \"_'proc\" (Long_Name.base_name s)))] i\n | _ => no_tac)\n\nfun get_Call_args (Const (@{const_name com.Call}, _) $ x) = [x]\n | get_Call_args (f $ x) = get_Call_args f @ get_Call_args x\n | get_Call_args (Abs (_, _, t)) = get_Call_args t\n | get_Call_args _ = []\n\nfun apply_modifies_thm ctxt = SUBGOAL (fn (t, i) => case\n get_Call_args (Envir.beta_eta_contract t)\n of [Const (s, _)] => let\n val s = unsuffix \"_'proc\" (Long_Name.base_name s)\n val thms = (@{thm disjI1}, Proof_Context.get_thm ctxt (s ^ \"_modifies\"))\n handle ERROR _ => (@{thm disjI2}, @{thm refl})\n in resolve0_tac [fst thms] i THEN resolve0_tac [snd thms] i end\n | _ => no_tac)\n\nfun is_safe_eq_impl (p as (@{term Trueprop}\n $ (Const (@{const_name \"eq_impl\"}, _) $ _ $ _ $ _ $ _)))\n = not (exists_subterm (fn Var _ => true | Free (\"n\", _) => true\n | _ => false) p)\n | is_safe_eq_impl _ = false\n\nfun eq_impl_assume_tac ctxt = DETERM o SUBGOAL (fn (t, i) => let\n val p = Logic.strip_assums_concl (Envir.beta_eta_contract t)\n in if is_safe_eq_impl p\n then resolve0_tac [Thm.assume (Thm.cterm_of ctxt p)] i\n else no_tac\n end)\n\nfun is_pglobal_valid_conjs (Const (@{const_name conj}, _) $ p $ q)\n = is_pglobal_valid_conjs p andalso is_pglobal_valid_conjs q\n | is_pglobal_valid_conjs (Const (@{const_name \"pglobal_valid\"}, _) $ _ $ _ $ _)\n = true\n | is_pglobal_valid_conjs _ = false\n\nfun simpl_ss ctxt = put_simpset HOL_basic_ss ctxt\n addsimps @{thms switch.simps fst_conv snd_conv\n length_Cons singletonI triv_forall_equality\n simpl_to_graph_Seq simpl_to_graph_Catch\n}\n\nval immediates = @{thms\n simpl_to_graph_Skip_immediate simpl_to_graph_Throw_immediate}\n\nfun except_tac ctxt msg = SUBGOAL (fn (t, _) => let\n in warning msg; Syntax.pretty_term ctxt t |> Pretty.writeln;\n raise TERM (msg, [t]) end)\n\nfun apply_hint_thm ctxt (Hints hints) = SUBGOAL (fn (t, i) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#hint_tactics hints) nn\n of SOME tac => tac ctxt i\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun check_err_cond_tac (Hints hints) = SUBGOAL (fn (t, _) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#err_conds hints) nn\n of SOME () => all_tac\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun apply_simpl_to_graph_tac funs hints ctxt =\n simp_tac (simpl_ss ctxt\n addsimps @{thms One_nat_def whileAnno_def\n creturn_def[folded creturn_void_def]})\n THEN' DETERM o (FIRST' [\n apply_hint_thm ctxt hints,\n resolve0_tac [@{thm simpl_to_graph_Basic_triv}],\n resolve_tac ctxt @{thms simpl_to_graph_lvar_nondet_init\n simpl_to_graph_Skip\n simpl_to_graph_Throw\n simpl_to_graph_cbreak\n simpl_to_graph_creturn_void},\n resolve_tac ctxt @{thms\n simpl_to_graph_ccatchbrk_Break\n simpl_to_graph_ccatchbrk_Return}\n THEN' (simp_tac ctxt\n THEN_ALL_NEW except_tac ctxt\n \"apply_simpl_to_graph_tac: exn eq unsolved\"),\n resolve0_tac [@{thm simpl_to_graph_Guard[OF refl]}],\n check_err_cond_tac hints\n THEN' resolve0_tac [@{thm simpl_to_graph_Err_cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Basic}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_triv[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_known_guard[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_asm_fun[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_asm_refines_ex_tac funs ctxt,\n resolve0_tac [@{thm simpl_to_graph_nearly_done}]\n THEN' inst_graph_tac ctxt\n ] THEN_ALL_NEW (TRY o REPEAT_ALL_NEW\n (resolve_tac ctxt immediates)))\n\nfun trace_cache _ (SOME thm) = tracing\n (\"Adding thm to cache with \" ^ string_of_int (Thm.nprems_of thm) ^ \" prems.\")\n | trace_cache _ NONE = tracing \"Adding NONE to cache.\"\n\nfun simpl_to_graph_cache_tac funs hints cache nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN_ALL_NEW DETERM o FIRST' [\n SUBGOAL (fn (t, i) => (case\n with_cache cache (mk_simpl_to_graph_thm funs hints cache nm ctxt) (K (K ()))\n (simpl_to_graph_skel hints nm (HOLogic.dest_Trueprop\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)))) of\n SOME thm => resolve0_tac [thm] i | _ => no_tac)\n handle TERM _ => no_tac),\n resolve_tac ctxt @{thms simpl_to_graph_done2\n simpl_to_graph_Skip_immediate[where nn=Ret]\n simpl_to_graph_Throw_immediate[where nn=Ret]\n simpl_to_graph_creturn_void2},\n eq_impl_assume_tac ctxt\n ]\n\nand mk_simpl_to_graph_thm funs hints cache nm ctxt tm = let\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop tm)\n in Thm.trivial ct\n |> (apply_simpl_to_graph_tac funs hints ctxt\n THEN_ALL_NEW (TRY o simpl_to_graph_cache_tac funs hints cache nm ctxt)\n THEN_ALL_NEW (TRY o eq_impl_assume_tac ctxt)) 1\n |> Seq.hd\n |> Drule.generalize (Names.empty, Names.make_set [\"n\", \"trS\"])\n |> SOME\n end handle TERM (s, _) => (tracing (\"mk_simpl_to_graph_thm: \" ^ s); NONE)\n | Empty => (tracing \"mk_simpl_to_graph_thm: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt tm |> Pretty.string_of);\n NONE)\n | Option => NONE\n\nfun dest_next_node (@{term NextNode} $ n)\n = dest_nat n\n | dest_next_node @{term Ret} = ~1\n | dest_next_node @{term Err} = ~2\n | dest_next_node t = raise TERM (\"dest_next_node\", [t])\n\nfun get_while (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ nn\n $ (Const (@{const_name add_cont}, _) $ (Const (@{const_name While}, _) $ C $ c) $ _)\n $ _ $ _ $ _ $ _ $ _ $ _)\n = (dest_next_node nn, C, c)\n | get_while t = raise TERM (\"get_while\", [t])\n\nfun check_while_assums t = let\n val hyps = Logic.strip_assums_hyp t\n |> filter (fn (@{term Trueprop} $ (@{term \"All :: (nat => _) => _\"} $ _))\n => true | _ => false)\n in length hyps < 2 orelse raise TERM (\"check_while_assums: too many\", []);\n () end\n\nfun get_while_body_guard C c = case c of\n Const (@{const_name com.Seq}, _) $ _ $ last => let\n val setT = fastype_of C\n fun mk_int (x, y) = Const (fst (dest_Const @{term \"(Int)\"}),\n setT --> setT --> setT) $ x $ y\n fun build_guard (Const (@{const_name Guard}, _) $ _ $ G\n $ Const (@{const_name com.Skip}, _))\n = G\n | build_guard (Const (@{const_name Guard}, _) $ _ $ G $ c)\n = mk_int (G, build_guard c)\n | build_guard _ = error \"\"\n val G = case try build_guard last of SOME G => G\n | NONE => Const (fst (dest_Const @{term \"UNIV\"}), setT)\n in G end\n | _ => Const (fst (dest_Const @{term \"UNIV\"}), fastype_of C)\n\nfun simpl_to_graph_While_tac hints nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN' SUBGOAL (fn (t, i) => let\n val t = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n val (_, Cond, body) = get_while t\n val gd = get_while_body_guard Cond body\n val skel = simpl_to_graph_skel hints nm t\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop skel)\n val rl_inst = infer_instantiate ctxt [((\"G\",0), Thm.cterm_of ctxt gd)]\n @{thm simpl_to_graph_While_inst}\n in\n resolve_tac ctxt [Thm.trivial ct |> Drule.generalize (Names.empty, Names.make_set [\"n\", \"trS\"])] i\n THEN resolve_tac ctxt [rl_inst] i\n THEN resolve_tac ctxt @{thms refl} i\n THEN inst_graph_tac ctxt i\n end handle TERM _ => no_tac)\n\nfun trace_fail_tac ctxt s = SUBGOAL (fn (t, _) =>\n (Syntax.pretty_term ctxt t |> Pretty.string_of\n |> prefix (\"Tactic \" ^ s ^ \" failed on: \") |> tracing;\n no_tac))\n\nfun trace_fail_tac2 _ = K no_tac\n\nfun simpl_to_graph_tac funs hints nm ctxt = let\n val cache = ref (Termtab.empty)\n in REPEAT_ALL_NEW (DETERM o (full_simp_tac (simpl_ss ctxt) THEN_ALL_NEW\n SUBGOAL (fn (t, i) => fn thm =>\n ((simpl_to_graph_cache_tac funs hints cache nm ctxt\n ORELSE' (eresolve0_tac [@{thm use_simpl_to_graph_While_assum}]\n THEN' simp_tac ctxt)\n ORELSE' simpl_to_graph_While_tac hints nm ctxt\n ORELSE' trace_fail_tac ctxt \"simpl_to_graph_tac\") i thm\n handle Empty => (tracing \"simpl_to_graph_tac: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt t |> Pretty.string_of);\n Seq.empty)))\n ))\n end\n\nfun get_conts (@{term node.Basic} $ nn $ _) = [nn]\n | get_conts (@{term node.Cond} $ l $ _ $ Abs (_, _, @{term True})) = [l]\n | get_conts (@{term node.Cond} $ _ $ r $ Abs (_, _, @{term False})) = [r]\n | get_conts (@{term node.Cond} $ l $ r $ _) = [l, r]\n | get_conts (@{term node.Call} $ nn $ _ $ _ $ _) = [nn]\n | get_conts n = raise TERM (\"get_conts\", [n])\n\nfun get_rvals (Abs (_, _, t)) = let\n fun inner (Const _ $ (s as (@{term \"(#) :: char \\ _\"} $ _ $ _)) $ Bound 0)\n = [HOLogic.dest_string s]\n | inner (f $ x) = inner f @ inner x\n | inner (Const _) = []\n | inner (Free (\"symbol_table\", _)) = []\n | inner t = raise TERM (\"get_rvals\", [t])\n in inner t end\n | get_rvals t = raise TERM (\"get_rvals\", [t])\n\nfun flip f x y = f y x\n\nfun get_lvals_rvals (@{term node.Basic} $ _ $ upds) = let\n val (lvs, rvs) = HOLogic.dest_list upds |> map_split HOLogic.dest_prod\n in (map HOLogic.dest_string lvs, maps get_rvals rvs) end\n | get_lvals_rvals (@{term node.Cond} $ _ $ _ $ cond) = ([], get_rvals cond)\n | get_lvals_rvals (@{term node.Call} $ _ $ _ $ args $ rets)\n = (HOLogic.dest_list rets |> map HOLogic.dest_string,\n HOLogic.dest_list args |> maps get_rvals)\n | get_lvals_rvals n = raise TERM (\"get_conts\", [n])\n\nfun get_var_deps nodes ep outputs = let\n fun forward tab (point :: points) = if point < 0\n then forward tab points\n else let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val upds = filter_out (Inttab.lookup_list tab #>\n flip (Ord_List.member int_ord) point) conts\n val tab = fold (fn c => Inttab.map_default (c, [])\n (Ord_List.insert int_ord point)) conts tab\n in forward tab (upds @ points) end\n | forward tab [] = tab\n val preds = forward (Inttab.make [(ep, [])]) [ep]\n fun backward tab (point :: points) = let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val (lvs, rvs) = get_lvals_rvals node\n |> apply2 (Ord_List.make string_ord)\n val cont_vars = maps (Inttab.lookup_list tab) conts\n |> Ord_List.make string_ord\n val vars = Ord_List.merge string_ord (rvs,\n Ord_List.subtract string_ord lvs cont_vars)\n val prev_vars = Inttab.lookup tab point\n val tab = Inttab.update (point, vars) tab\n val upds = if prev_vars <> SOME vars\n then Inttab.lookup_list preds point else []\n in backward tab (upds @ points) end\n | backward tab [] = tab\n val deps = backward (Inttab.make [(~1, outputs), (~2, [])])\n (maps (Inttab.lookup_list preds) [~1, ~2])\n in (preds, deps) end\n\nfun get_loop_var_upd_nodes nodes =\n nodes\n |> filter (snd #> (fn (@{term Basic} $ _ $ _) => true | _ => false))\n |> filter (snd #> get_lvals_rvals #> fst\n #> (fn xs => not (null xs) andalso forall (String.isSuffix \"#count\") xs))\n |> map fst\n\nfun get_err_conds nodes =\n nodes\n |> filter (snd #> (fn (@{term Cond} $ _ $ @{term Err} $ _) => true | _ => false))\n |> map fst\n\nfun mk_hints (funs : ParseGraph.funs) ctxt nm = case Symtab.lookup funs nm of\n NONE => raise TERM (\"mk_var_deps_hints: miss \" ^ nm, [])\n | SOME (_, _, NONE) => Hints {deps = Inttab.empty, hint_tactics = Inttab.empty,\n err_conds = Inttab.empty}\n | SOME (_, outputs, SOME (ep, nodes, _)) => let\n val sT = Syntax.read_typ ctxt \"globals myvars\"\n val deps = snd (get_var_deps (Inttab.make nodes) ep outputs)\n |> Inttab.map (K (filter_out (fn s => String.isSuffix \"#count\" s)\n #> map (fn s => (s, mk_simpl_acc ctxt sT s))))\n val no_deps_nodes = map fst nodes\n |> filter_out (Inttab.defined deps)\n val all_deps = Inttab.join (fn _ => error \"mk_hints\")\n (deps, Inttab.make (map (rpair []) no_deps_nodes))\n val no_deps_tacs = no_deps_nodes\n |> map (rpair (K (resolve0_tac [@{thm simpl_to_graph_impossible}])))\n val loop_tacs = get_loop_var_upd_nodes nodes\n |> map (rpair (fn ctxt => resolve0_tac [@{thm simpl_to_graph_noop_Basic}]\n THEN' inst_graph_tac ctxt))\n val all_tacs = Inttab.make (no_deps_tacs @ loop_tacs)\n val ec = get_err_conds nodes |> Inttab.make_set\n in Hints {deps = all_deps,\n hint_tactics = all_tacs,\n err_conds = ec} end\n\nfun init_graph_refines_proof funs nm ctxt = let\n val body_ref_thm = Get_Body_Refines.get ctxt (Long_Name.base_name nm)\n val ct = mk_graph_refines funs ctxt nm |> Thm.cterm_of ctxt\n in Thm.trivial ct\n |> (resolve_tac ctxt [@{thm graph_fun_refines_from_simpl_to_graph_with_refine}] 1\n THEN apply_impl_thm ctxt 1\n THEN graph_gamma_tac ctxt 1\n THEN resolve_tac ctxt [body_ref_thm] 1\n THEN ALLGOALS (simp_tac (put_simpset HOL_basic_ss ctxt\n addsimps @{thms entry_point.simps function_inputs.simps\n function_outputs.simps list.simps}))\n THEN TRY ((resolve_tac ctxt [@{thm simpl_to_graph_noop_same_eqs}]\n THEN' inst_graph_tac ctxt) 1)\n )\n |> Seq.hd\n end\n\nval thin_While_assums_rule =\n @{thm thin_rl[where V=\"simpl_to_graph SG GG f nn (add_cont (com.While C c) con) n tS P I e e2\"]}\n |> Drule.generalize (Names.empty, Names.make_set [\"SG\", \"GG\", \"f\", \"nn\", \"C\", \"c\", \"con\", \"n\", \"tS\", \"P\", \"I\", \"e\", \"e2\"])\n\nfun eq_impl_unassume_tac t = let\n val hyps = t |> Thm.chyps_of\n |> filter (Thm.term_of #> is_safe_eq_impl)\n in (* tracing (\"Restoring \" ^ string_of_int (length hyps) ^ \" hyps.\") ; *)\n fold Thm.implies_intr hyps t |> Seq.single end\n\nfun simpl_to_graph_upto_subgoals funs hints nm ctxt =\n init_graph_refines_proof funs nm ctxt\n |> (simpl_to_graph_tac funs hints nm ctxt 1\n THEN ALLGOALS (TRY o REPEAT_ALL_NEW (eresolve0_tac [thin_While_assums_rule]))\n THEN eq_impl_unassume_tac\n ) |> Seq.hd\n\nend\n\n\\\n\nML \\\nfun define_graph_fun_short funs s =\n Local_Theory.begin_nested\n #> snd\n #> ParseGraph.define_graph_fun funs (Long_Name.base_name s ^ \"_graph\")\n (Binding.name (Long_Name.base_name s ^ \"_graph_fun\")) s\n #> Local_Theory.end_nested\n\\\n\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/GraphRefine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.18846262013331805}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Example2\nimports Isolation_S\nbegin\n\nlemma direct_caps_of_update [simp]:\n \"direct_caps_of (s(x := y)) =\n (direct_caps_of s)(x:= case y of None \\ {} | Some (Entity c) \\ c)\"\n by (rule ext, simp add: direct_caps_of_def split:option.splits)\n\nlemma direct_caps_of_empty [simp]:\n \"direct_caps_of Map.empty = ( \\ x. {})\"\n by (simp add: direct_caps_of_def fun_eq_iff)\n\ndefinition \"id\\<^sub>0 \\ 0\"\ndefinition \"id\\<^sub>1 \\ 1\"\ndefinition \"id\\<^sub>2 \\ 2\"\ndefinition \"id\\<^sub>3 \\ 3\"\ndefinition \"id\\<^sub>4 \\ 4\"\ndefinition \"id\\<^sub>5 \\ 5\"\n\n(* e0 has create caps to all of memory, and full rights to itself. *)\ndefinition\n e0_caps :: \"cap set\"\nwhere\n \"e0_caps \\ range create_cap \\ {full_cap 0}\"\n\ndefinition\n s0 :: \"state\"\nwhere\n \"s0 \\ [0 \\ Entity e0_caps]\"\n\ndefinition\n s1 :: \"state\"\nwhere\n \"s1 \\ [0 \\ Entity (e0_caps \\ {full_cap 1}),\n 1 \\ null_entity]\"\n\ndefinition\n s2 :: \"state\" where\n \"s2 \\ [0 \\ Entity (e0_caps \\ {full_cap 1}),\n 1 \\ Entity {create_cap 2}]\"\n\ndefinition\n s3 :: \"state\" where\n \"s3 \\ [0 \\ Entity (e0_caps \\ {full_cap 1}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\}]\"\n\ndefinition\n s4 :: \"state\" where\n \"s4 \\ [0 \\ Entity (e0_caps \\ {full_cap 1}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2},\n 2 \\ null_entity]\"\n\ndefinition\n s5 :: \"state\" where\n \"s5 \\ [0 \\ Entity (e0_caps \\ {full_cap 1, write_cap 2}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2},\n 2 \\ null_entity]\"\n\ndefinition\n s6 :: \"state\" where\n \"s6 \\ [0 \\ Entity (e0_caps \\ {full_cap 1, write_cap 2}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2, read_cap 2},\n 2 \\ null_entity]\"\n\ndefinition\n s7 :: \"state\" where \"s7 \\ s4\"\n\ndefinition\n s8 :: \"state\" where\n \"s8 \\ [0 \\ Entity (e0_caps \\ {full_cap 1, full_cap 3}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2},\n 2 \\ null_entity,\n 3 \\ null_entity]\"\n\ndefinition\n s9 :: \"state\" where\n \"s9 \\ [0 \\ Entity (e0_caps \\ {full_cap 1}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2},\n 2 \\ null_entity,\n 3 \\ null_entity]\"\n\ndefinition\n s10 :: \"state\" where \"s10 \\ s4\"\n\ndefinition\n s :: \"state\" where\n \"s \\ [0 \\ Entity (e0_caps - {create_cap 1, create_cap 2}),\n 1 \\ Entity {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2},\n 2 \\ null_entity]\"\n\ndefinition\n op0 :: \"sysOPs\" where\n \"op0 \\ SysCreate 0 (full_cap 0) (create_cap 1)\"\ndefinition\n op1 :: \"sysOPs\" where\n \"op1 \\ SysGrant 0 (full_cap 1) (create_cap 2) UNIV\"\ndefinition\n op2 :: \"sysOPs\" where\n \"op2 \\ SysGrant 0 (full_cap 1) (full_cap 1) {Write, Store}\"\ndefinition\n op3 :: \"sysOPs\" where\n \"op3 \\ SysCreate 1 \\target = 1, rights = {Write, Store}\\ (create_cap 2)\"\ndefinition\n op4 :: \"sysOPs\" where\n \"op4 \\ SysTake 0 (full_cap 1) (full_cap 2) {Write}\"\ndefinition\n op5 :: \"sysOPs\" where\n \"op5 \\ SysCopy 1 \\target = 1, rights = {Write, Store}\\ (full_cap 2) {Read}\"\ndefinition\n op6 :: \"sysOPs\" where\n \"op6 \\ SysRevoke 0 (write_cap 2)\"\ndefinition\n op7 :: \"sysOPs\" where\n \"op7 \\ SysCreate 0 (full_cap 0) (create_cap 3)\"\ndefinition\n op8 :: \"sysOPs\" where\n \"op8 \\ SysRemove 0 (full_cap 0) (full_cap 3)\"\ndefinition\n op9 :: \"sysOPs\" where\n \"op9 \\ SysDestroy 0 (create_cap 3)\"\ndefinition\n op10 :: \"sysOPs\" where\n \"op10 \\ SysRemoveSet 0 (full_cap 0) {full_cap 1, create_cap 1, create_cap 2}\"\n\ndefinition ops :: \"sysOPs list\" where\n(* since the CDT isn't defined, op6 is skipped\n \"ops \\ [op10, op9, op8, op7, op6, op5, op4, op3, op2, op1, op0]\"\n*)\n \"ops \\ [op10, op9, op8, op7, op3, op2, op1, op0]\"\n\n\n(* is_entity lemmas *)\n\nlemma is_entity_s0_e0 [simp]:\n \"is_entity s0 0\"\n by (simp add: is_entity_def s0_def)\n\nlemma is_entity_s1_e0 [simp]:\n \"is_entity s1 0\"\n by (simp add: is_entity_def s1_def)\n\nlemma is_entity_s2_e0 [simp]:\n \"is_entity s2 0\"\n by (simp add: is_entity_def s2_def)\n\nlemma is_entity_s3_e0 [simp]:\n \"is_entity s3 0\"\n by (simp add: is_entity_def s3_def)\n\nlemma is_entity_s4_e0 [simp]:\n \"is_entity s4 0\"\n by (simp add: is_entity_def s4_def)\n\nlemma is_entity_s5_e0 [simp]:\n \"is_entity s5 0\"\n by (simp add: is_entity_def s5_def)\n\nlemma is_entity_s6_e0 [simp]:\n \"is_entity s6 0\"\n by (simp add: is_entity_def s6_def)\n\nlemma is_entity_s8_e0 [simp]:\n \"is_entity s8 0\"\n by (simp add: is_entity_def s8_def)\n\nlemma is_entity_s9_e0 [simp]:\n \"is_entity s9 0\"\n by (simp add: is_entity_def s9_def)\n\nlemma is_entity_s_e0 [simp]:\n \"is_entity s 0\"\n by (simp add: is_entity_def s_def)\n\n\nlemma is_entity_s0_e1 [simp]:\n \"\\ is_entity s0 1\"\n by (simp add: is_entity_def s0_def)\n\nlemma is_entity_s1_e1 [simp]:\n \"is_entity s1 1\"\n by (simp add: is_entity_def s1_def)\n\nlemma is_entity_s2_e1 [simp]:\n \"is_entity s2 1\"\n by (simp add: is_entity_def s2_def)\n\nlemma is_entity_s3_e1 [simp]:\n \"is_entity s3 1\"\n by (simp add: is_entity_def s3_def)\n\nlemma is_entity_s4_e1 [simp]:\n \"is_entity s4 1\"\n by (simp add: is_entity_def s4_def)\n\nlemma is_entity_s5_e1 [simp]:\n \"is_entity s5 1\"\n by (simp add: is_entity_def s5_def)\n\n\nlemma is_entity_s3_e2 [simp]:\n \"\\ is_entity s3 2\"\n by (simp add: is_entity_def s3_def)\n\nlemma is_entity_s4_e3 [simp]:\n \"\\ is_entity s4 3\"\n by (simp add: is_entity_def s4_def)\n\n\n\n(* direct_caps_of, caps_of and similar lemmas *)\n\nlemma direct_caps_of_s0_e0_caps [simp]:\n \"direct_caps_of s0 0 = e0_caps\"\n by (simp add: direct_caps_of_def s0_def e0_caps_def)\n\nlemma direct_caps_of_s1_e0_caps [simp]:\n \"direct_caps_of s1 0 = e0_caps \\ {full_cap 1}\"\n by (simp add: direct_caps_of_def s1_def e0_caps_def)\n\nlemma direct_caps_of_s2_e0_caps [simp]:\n \"direct_caps_of s2 0 = e0_caps \\ {full_cap 1}\"\n by (simp add: direct_caps_of_def s2_def e0_caps_def)\n\nlemma direct_caps_of_s4_e0_caps [simp]:\n \"direct_caps_of s4 0 = e0_caps \\ {full_cap 1}\"\n by (simp add: direct_caps_of_def s4_def e0_caps_def)\n\nlemma direct_caps_of_s5_e0_caps [simp]:\n \"direct_caps_of s5 0 = e0_caps \\ {full_cap 1, write_cap 2}\"\n by (simp add: direct_caps_of_def s5_def e0_caps_def)\n\nlemma direct_caps_of_s6_e0_caps [simp]:\n \"direct_caps_of s6 0 = e0_caps \\ {full_cap 1, write_cap 2}\"\n by (simp add: direct_caps_of_def s6_def e0_caps_def)\n\nlemma direct_caps_of_s8_e0_caps [simp]:\n \"direct_caps_of s8 0 = e0_caps \\ {full_cap 1, full_cap 3}\"\n by (simp add: direct_caps_of_def s8_def e0_caps_def)\n\nlemma direct_caps_of_s9_e0_caps [simp]:\n \"direct_caps_of s9 0 = e0_caps \\ {full_cap 1}\"\n by (simp add: direct_caps_of_def s9_def e0_caps_def)\n\n\nlemma direct_caps_of_s2_e1 [simp]:\n \"direct_caps_of s2 1 = {create_cap 2}\"\n by (simp add: direct_caps_of_def s2_def)\n\nlemma direct_caps_of_s3_e1 [simp]:\n \"direct_caps_of s3 1 = {create_cap 2, \\ target = 1, rights = {Write, Store}\\}\"\n by (simp add: direct_caps_of_def s3_def)\n\nlemma direct_caps_of_s4_e1 [simp]:\n \"direct_caps_of s4 1 = {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2}\"\n by (simp add: direct_caps_of_def s4_def)\n\nlemma direct_caps_of_s6_e1 [simp]:\n \"direct_caps_of s5 1 = {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2}\"\n by (simp add: direct_caps_of_def s5_def)\n\nlemma direct_caps_of_s9_e1 [simp]:\n \"direct_caps_of s9 1 = {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2}\"\n by (simp add: direct_caps_of_def s9_def)\n\n\nlemma full_cap_e0_caps_in_caps_of_s0_e0_caps [simp]:\n \"full_cap 0 \\ caps_of s0 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma full_cap_e1_in_caps_of_s1_e0_caps [simp]:\n \"full_cap 1 \\ caps_of s1 0\"\n by (rule direct_cap_in_cap, simp)\n\nlemma full_cap_e1_in_caps_of_s2_e0_caps [simp]:\n \"full_cap 1 \\ caps_of s2 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma full_cap_e0_caps_in_caps_of_s4_e0_caps [simp]:\n \"full_cap 0 \\ caps_of s4 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma full_cap_e1_in_caps_of_s4_e0_caps [simp]:\n \"full_cap 1 \\ caps_of s4 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma full_cap_e2_in_caps_of_s4_e1 [simp]:\n \"full_cap 2 \\ caps_of s4 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma full_cap_e1_in_caps_of_s5_e0_caps [simp]:\n \"full_cap 1 \\ caps_of s5 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma full_cap_e2_in_caps_of_s5_e0_caps [simp]:\n \"full_cap 2 \\ caps_of s5 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma full_cap_e0_caps_in_caps_of_s8_e0_caps [simp]:\n \"full_cap 0 \\ caps_of s8 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma create_cap_in_caps_of_s0_e0_caps [simp]:\n \"create_cap i \\ caps_of s0 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma create_cap_in_caps_of_s1_e0_caps [simp]:\n \"create_cap i \\ caps_of s1 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma create_cap_in_caps_of_s2_e1 [simp]:\n \"create_cap 2 \\ caps_of s2 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma create_cap_in_caps_of_s3_e1 [simp]:\n \"create_cap 2 \\ caps_of s3 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma create_cap_in_caps_of_s4_e3 [simp]:\n \"create_cap 3 \\ caps_of s4 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma create_cap_in_caps_of_s9_e3 [simp]:\n \"create_cap 3 \\ caps_of s9 0\"\n by (rule direct_cap_in_cap, simp add: e0_caps_def)\n\nlemma write_store_e1_in_caps_of_s3_e1 [simp]:\n \"\\target = 1, rights = {Write, Store}\\ \\ caps_of s3 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma write_store_e1_in_caps_of_s5_e1 [simp]:\n \"\\target = 1, rights = {Write, Store}\\ \\ caps_of s5 1\"\n by (rule direct_cap_in_cap, simp)\n\nlemma write_cap_e2_in_caps_of_s6_e0_caps [simp]:\n \"write_cap 2 \\ caps_of s6 0\"\n by (rule direct_cap_in_cap, simp)\n\n\n\n(*********************************)\n(* State after the opeartions *)\n(*********************************)\n\n(* \"op0 \\ SysCreate 0 (full_cap 0) (create_cap 1)\" *)\nlemma op0_legal:\n \"legal op0 s0\"\n by (clarsimp simp: op0_def all_rights_def)\n\nlemma execute_op0_safe:\n \"step op0 s0 \\ ({s0, s1})\"\n by (fastforce simp: op0_def step_def createOperation_def s0_def s1_def\n split: if_split_asm)\n\nlemma execute_op0_live:\n \"step op0 s0 \\ ({s0, s1})\"\n apply clarsimp\n apply (rule conjI)\n apply (simp add: step_def)\n apply (simp add: step_def op0_legal)\n apply (rule disjI2)\n apply (clarsimp simp: op0_def createOperation_def)\n apply (rule ext)\n apply (clarsimp simp: s0_def s1_def)\n done\n\nlemma execute_op0:\n \"step op0 s0 = ({s0, s1})\"\n apply rule\n apply (rule execute_op0_safe)\n apply (rule execute_op0_live)\n done\n\n\n(* \"op1 \\ SysGrant 0 (full_cap 1) (create_cap 2) UNIV\" *)\nlemma op1_legal:\n \"legal op1 s1\"\n by (clarsimp simp: op1_def all_rights_def)\n\nlemma execute_op1_safe:\n \"step op1 s1 \\ ({s1, s2})\"\n by (clarsimp simp: op1_def step_def grantOperation_def diminish_def\n s1_def s2_def create_cap_def null_entity_def\n split: if_split_asm)\n\nlemma execute_op1_live:\n \"step op1 s1 \\ ({s1, s2})\"\n apply clarsimp\n apply (rule conjI)\n apply (simp add: step_def)\n apply (simp add: step_def op1_legal)\n apply (rule disjI2)\n apply (clarsimp simp: op1_def grantOperation_def)\n apply (rule ext)\n apply (clarsimp simp: s1_def s2_def null_entity_def)\n done\n\nlemma execute_op1:\n \"step op1 s1 = ({s1, s2})\"\n apply rule\n apply (rule execute_op1_safe)\n apply (rule execute_op1_live)\n done\n\n\n(* \"op2 \\ SysGrant 0 (full_cap 1) (full_cap 1) {Write, Store}\" *)\nlemma op2_legal:\n \"legal op2 s2\"\n by (clarsimp simp: op2_def all_rights_def)\n\nlemma execute_op2_safe:\n \"step op2 s2 \\ ({s2, s3})\"\n apply clarsimp\n apply (rule ext)\n apply (auto simp: op2_def step_def grantOperation_def diminish_def s2_def s3_def full_cap_def all_rights_def\n split: if_split_asm)\n done\n\nlemma execute_op2_live:\n \"step op2 s2 \\ ({s2, s3})\"\n apply clarsimp\n apply (simp add: step_def op2_legal)\n apply (rule disjI2)\n apply (simp add: op2_def)\n apply (rule ext)\n apply (fastforce simp: s2_def s3_def grantOperation_def diminish_def all_rights_def full_cap_def)\n done\n\nlemma execute_op2:\n \"step op2 s2 = ({s2, s3})\"\n apply rule\n apply (rule execute_op2_safe)\n apply (rule execute_op2_live)\n done\n\n\n(* \"op3 \\ SysCreate 1 (full_cap 1) (create_cap 2)\" *)\nlemma op3_legal:\n \"legal op3 s3\"\n by (clarsimp simp: op3_def all_rights_def)\n\nlemma execute_op3_safe:\n \"step op3 s3 \\ ({s3, s4})\"\n apply (clarsimp, rule ext)\n apply (auto simp: op3_def step_def createOperation_def s3_def s4_def\n split: if_split_asm)\n done\n\nlemma execute_op3_live:\n \"step op3 s3 \\ ({s3, s4})\"\n apply clarsimp\n apply (simp add: step_def op3_legal)\n apply (rule disjI2)\n apply (clarsimp simp: op3_def createOperation_def)\n apply (rule ext)\n apply (fastforce simp: s3_def s4_def)\n done\n\nlemma execute_op3:\n \"step op3 s3 = ({s3, s4})\"\n apply rule\n apply (rule execute_op3_safe)\n apply (rule execute_op3_live)\n done\n\n(* op4 \\ SysTake 0 (full_cap 1) (full_cap 2) {Write} *)\nlemma op4_legal:\n \"legal op4 s4\"\n by (clarsimp simp: op4_def all_rights_def)\n\nlemma execute_op4_safe:\n \"step op4 s4 \\ ({s4, s5})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s4_def s5_def op4_def step_def takeOperation_def\n diminish_def all_rights_def write_cap_def\n split: if_split_asm)\n done\n\nlemma execute_op4_live:\n \"step op4 s4 \\ ({s4, s5})\"\n apply clarsimp\n apply (simp add: op4_legal step_def)\n apply (rule disjI2)\n apply (simp add: op4_def)\n apply (rule ext)\n apply (fastforce simp: s4_def s5_def takeOperation_def diminish_def all_rights_def write_cap_def)\n done\n\nlemma execute_op4:\n \"step op4 s4 = ({s4, s5})\"\n apply rule\n apply (rule execute_op4_safe)\n apply (rule execute_op4_live)\n done\n\n\n(* op5 \\ SysCopy 1 (full_cap 1) (full_cap 2) {Read} *)\nlemma op5_legal:\n \"legal op5 s5\"\n by (clarsimp simp: op5_def all_rights_def)\n\nlemma execute_op5_safe:\n \"step op5 s5 \\ ({s5, s6})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s5_def s6_def op5_def step_def copyOperation_def diminish_def all_rights_def read_cap_def\n split: if_split_asm)\n done\n\nlemma execute_op5_live:\n \"step op5 s5 \\ ({s5, s6})\"\n apply clarsimp\n apply (simp add: step_def op5_legal)\n apply (rule disjI2)\n apply (simp add: op5_def)\n apply (rule ext)\n apply (fastforce simp: s5_def s6_def copyOperation_def diminish_def all_rights_def read_cap_def)\n done\n\nlemma execute_op5:\n \"step op5 s5 = ({s5, s6})\"\n apply rule\n apply (rule execute_op5_safe)\n apply (rule execute_op5_live)\n done\n\n(* op6 \\ SysRevoke 0 (read_cap 2) *)\nlemma op6_legal:\n \"legal op6 s6\"\n by (clarsimp simp: op6_def all_rights_def)\n\nlemma execute_op6_safe:\n \"step op6 s6 \\ ({s6, s7})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s6_def s7_def s4_def op7_def step_def revokeOperation_def\n split: if_split_asm)\n oops\n\nlemma execute_op6_live:\n \"step op6 s6 \\ ({s6, s7})\"\n apply (insert op6_legal)\n oops (*\n apply (auto simp: step_def op6_legal op6_def s6_def s7_def s4_def revokeOperation_def fun_eq_iff)\n done*)\n\n(* Since cdt is not defined, this proof can't be done *)\nlemma execute_op6_live:\n \"s7 \\ step op6 s6\"\n oops\n\nlemma execute_op6:\n \"step op6 s6 = ({s6, s7})\"\n oops\n\n\n(* op7 \\ SysCreate 0 (full_cap 0) (create_cap 3) *)\nlemma op7_legal:\n \"legal op7 s7\"\n by (clarsimp simp: s7_def op7_def all_rights_def)\n\nlemma execute_op7_safe:\n \"step op7 s7 \\ ({s7, s8})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s7_def s8_def s4_def op7_def step_def createOperation_def\n split: if_split_asm)\n done\n\nlemma execute_op7_live:\n \"step op7 s7 \\ ({s7, s8})\"\n apply clarsimp\n apply (simp add: step_def op7_legal)\n apply (rule disjI2)\n apply (simp add: op7_def)\n apply (rule ext)\n apply (fastforce simp: s7_def s8_def s4_def createOperation_def)\n done\n\nlemma execute_op7:\n \"step op7 s7 = ({s7, s8})\"\n apply rule\n apply (rule execute_op7_safe)\n apply (rule execute_op7_live)\n done\n\n\n(* op8 \\ SysRemove 0 (full_cap 0) (full_cap 3) *)\nlemma op8_legal:\n \"legal op8 s8\"\n by (clarsimp simp: op8_def)\n\nlemma execute_op8_safe:\n \"step op8 s8 \\ ({s8, s9})\"\n apply clarsimp\n apply (rule ext)\n apply (insert op8_legal)\n apply (fastforce simp: step_def op8_def s8_def s9_def removeOperation_def\n full_cap_def create_cap_def all_rights_def e0_caps_def)\n done\n\nlemma execute_op8_live:\n \"step op8 s8 \\ ({s8, s9})\"\n apply (simp add: step_def op8_legal op8_def)\n apply (rule disjI2)\n apply (rule ext)\n apply (clarsimp simp: removeOperation_def)\n apply (fastforce simp: s8_def s9_def full_cap_def create_cap_def all_rights_def e0_caps_def)\n done\n\nlemma execute_op8:\n \"step op8 s8 = ({s8, s9})\"\n apply rule\n apply (rule execute_op8_safe)\n apply (rule execute_op8_live)\n done\n\n(* op9 \\ SysDelete 0 (create_cap 3) *)\n\nlemma op9_legal:\n \"legal op9 s9\"\n apply (simp add: op9_def)\n apply (fastforce simp: s9_def e0_caps_def null_entity_def split:if_split_asm)\n done\n\nlemma execute_op9_safe:\n \"step op9 s9 \\ ({s9, s10})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s9_def s10_def s4_def op9_def step_def destroyOperation_def\n split: if_split_asm)\n done\n\nlemma execute_op9_live:\n \"step op9 s9 \\ ({s9, s10})\"\n apply (simp add: step_def op9_legal)\n apply (rule disjI2)\n apply (simp add: op9_def)\n apply (rule ext)\n apply (clarsimp simp: destroyOperation_def step_def op9_def s9_def s10_def s4_def)\n done\n\nlemma execute_op9:\n \"step op9 s9 = ({s9, s10})\"\n apply rule\n apply (rule execute_op9_safe)\n apply (rule execute_op9_live)\n done\n\n(* op10 \\ SysRemoveSet 0 (full_cap 0) {full_cap 1, create_cap 1, create_cap 2} *)\nlemma op10_legal:\n \"legal op10 s10\"\n by (clarsimp simp: s10_def op10_def all_rights_def)\n\nlemma e0_caps_diminished [simp]:\n \"e0_caps - {full_cap 1, create_cap 1, create_cap 2} = e0_caps - {create_cap 1, create_cap 2}\"\n by (fastforce simp: e0_caps_def create_cap_def full_cap_def all_rights_def)\n\n\nlemma execute_op10_safe:\n \"step op10 s10 \\ ({s10, s})\"\n apply (clarsimp, rule ext)\n apply (auto simp: s10_def op10_def step_def removeSetOperation_def s4_def s_def\n split: if_split_asm)\n done\n\nlemma execute_op10_live:\n \"step op10 s10 \\ ({s10, s})\"\n apply clarsimp\n apply (rule conjI)\n apply (simp add: step_def)\n apply (simp add: step_def op10_legal)\n apply (rule disjI2)\n apply (clarsimp simp: s10_def op10_def removeSetOperation_def)\n apply (rule ext)\n apply (fastforce simp: s4_def s_def)\n done\n\nlemma execute_op10:\n \"step op10 s10 = ({s10, s})\"\n apply rule\n apply (rule execute_op10_safe)\n apply (rule execute_op10_live)\n done\n\n\nlemma execute_ops:\n \"s \\ execute ops s0\"\n apply (clarsimp simp: ops_def)\n apply (insert execute_op0_live execute_op1_live execute_op2_live execute_op3_live\n execute_op4_live execute_op5_live execute_op7_live\n execute_op8_live execute_op9_live execute_op10_live)\n apply (simp add: s7_def)\n apply fastforce\n done\n\n\n\n(*********************************)\n(* Results about the final state *)\n(*********************************)\n\nlemma store_not_in_create_cap [simp]:\n \"Store \\ rights (create_cap i)\"\n by (simp add: create_cap_def)\n\nlemma store_not_in_create_cap2 [simp]:\n \"Store \\ rights c \\ c \\ create_cap i\"\n by (clarsimp simp: create_cap_def)\n\n\n(*********************************)\n(* store_connected_direct *)\n(*********************************)\n\nlemma store_connected_direct_s_helper1:\n \"{c'.(c' = \\target = 0, rights = UNIV\\ \\ c' \\ range create_cap) \\\n c' \\ \\target = 1, rights = {Create}\\ \\ c' \\ \\target = 2, rights = {Create}\\ \\\n Store \\ rights c'} = {full_cap 0}\"\n by (auto simp: create_cap_def full_cap_def all_rights_def e0_caps_def)\n\nlemma store_connected_direct_s_helper2:\n \"{c'. (c' = \\target = 2, rights = {Create}\\ \\ c' = \\target = 1, rights = {Write, Store}\\ \\\n c' = \\target = 2, rights = UNIV\\) \\ Store \\ rights c'}\n = {\\target = 1, rights = {Write, Store}\\, full_cap 2}\"\n by (auto simp: create_cap_def full_cap_def all_rights_def e0_caps_def)\n\n\nlemma store_connected_direct_s:\n \"store_connected_direct s = {(0,0), (1,1), (1,2)}\"\n by (fastforce simp: store_connected_direct_def s_def e0_caps_def\n full_cap_def all_rights_def create_cap_def null_entity_def\n store_connected_direct_s_helper1 store_connected_direct_s_helper2\n split: if_split_asm)\n\n(*********************************)\n(* store_connected *)\n(*********************************)\n\nlemma into_rtrancl [rule_format]:\n \"(a,b) \\ r^* \\ (\\x. (x,b) \\ r \\ x = b) \\ a = b\"\n apply (erule converse_rtrancl_induct)\n apply simp\n apply clarsimp\n done\n\nlemma into_rtrancl2 [rule_format]:\n \" \\ B. \\(a,b) \\ r^*; b \\ B\\ \\ (\\x.(x,b) \\ r \\ x \\ B) \\ a \\ B\"\n thm rtrancl_induct converse_rtrancl_induct\n apply (erule converse_rtrancl_induct)\n apply clarsimp\n apply clarsimp\n oops\n\nlemma store_connected_id:\n \"{(0::word32, 0), (1, 1), (1, 2)}\\<^sup>* = {(1, 2)}\\<^sup>* \"\n apply rule\n apply clarsimp\n apply (erule rtranclE)\n apply simp\n apply (fastforce dest: into_rtrancl)\n apply clarsimp\n apply (erule rtranclE)\n apply simp\n apply (fastforce dest: into_rtrancl)\n done\n\nlemma store_connected_s: \"store_connected s = {(1,2)} \\ Id\"\n apply simp\n apply (rule equalityI)\n apply (insert store_connected_direct_s)\n apply (simp add: store_connected_def)\n apply clarsimp\n apply (erule converse_rtranclE)\n apply simp\n apply clarsimp\n apply (erule rtranclE)\n apply fastforce\n apply (simp add: store_connected_id)\n apply (drule rtranclD)\n apply (safe, simp_all, (erule tranclE, simp, fastforce)+)\n apply (fastforce simp: store_connected_def)\n done\n\n(*********************************)\n(* caps_of *)\n(*********************************)\n\nlemma caps_of_s_e0_caps: \"caps_of s 0 = e0_caps - {create_cap 1, create_cap 2}\"\n apply (clarsimp simp: caps_of_def store_connected_s Collect_disj_eq)\n apply (simp add: s_def)\n done\n\nlemma caps_of_s_e0_caps_2: \"caps_of s 0 = {full_cap 0} \\ ( range create_cap - {create_cap 1, create_cap 2})\"\n by (fastforce simp: caps_of_s_e0_caps e0_caps_def full_cap_def create_cap_def)\n\n\nlemma caps_of_s_e1: \"caps_of s 1 = {create_cap 2, \\ target = 1, rights = {Write, Store}\\, full_cap 2}\"\n apply (clarsimp simp: caps_of_def store_connected_s Collect_disj_eq)\n apply (simp add: s_def null_entity_def)\n done\n\nlemma caps_of_s_e2: \"caps_of s 2 = {}\"\n apply (simp add: caps_of_def store_connected_s)\n apply (simp add: s_def null_entity_def)\n done\n\nlemma caps_of_s_e3: \"\\e \\ 0; e \\ 1\\ \\ caps_of s e = {}\"\n apply (simp add: caps_of_def store_connected_s)\n apply (simp add: s_def null_entity_def)\n done\n\n\n(*********************************)\n(* caps_of' *)\n(*********************************)\n\nlemma extra_rights_create_cap:\n \"extra_rights (create_cap i) = full_cap i\"\n by (simp add: create_cap_def full_cap_def extra_rights_def)\n\n\nlemma extra_rights_full_cap:\n \"extra_rights (full_cap i) = full_cap i\"\n by (simp add: full_cap_def extra_rights_def)\n\nlemma extra_rights_take_cap:\n \"extra_rights (take_cap i) = take_cap i\"\n by (simp add: take_cap_def extra_rights_def)\n\nlemma extra_rights_grant_cap:\n \"extra_rights (grant_cap i) = grant_cap i\"\n by (simp add: take_cap_def extra_rights_def)\n\nlemma caps_of'_s_e0_caps_helper:\n \"extra_rights ` (range create_cap - {create_cap 1, create_cap 2}) =\n range full_cap - {full_cap 1, full_cap 2}\"\n apply rule\n apply (fastforce simp: create_cap_def extra_rights_def all_rights_def full_cap_def)\n apply rule\n apply (erule DiffE)\n apply clarsimp\n apply (rule image_eqI)\n apply (rule extra_rights_create_cap [THEN sym])\n apply (simp add: full_cap_def create_cap_def)\n done\n\n\n\n(*********************************)\n(* connected *)\n(*********************************)\n\nlemma extra_rights_increases_rights:\n \"rights c \\ rights (extra_rights c)\"\n by (simp add: extra_rights_def all_rights_def)\n\nlemma cap_in_caps_take_cap:\n \"\\create_cap x \\ caps_of s y\\ \\ take_cap x \\cap caps_of s y\"\n apply (auto simp: cap_in_caps_def caps_of_def extra_rights_take_cap)\n apply (rule exI, rule conjI, assumption)\n apply (rule rev_bexI, simp)\n apply (rule conjI)\n apply (subgoal_tac \"target (full_cap x) = x\", simp+)\n apply (simp add: extra_rights_create_cap all_rights_def)\n done\n\n\nlemma e0_connected_to:\n \"\\x \\ 1; x \\ 2\\ \\ s \\ 0 \\ x\"\n apply (rule directly_tgs_connected_comm)\n apply (simp add: directly_tgs_connected_def4)\n apply (rule disjI1)\n apply (rule cap_in_caps_take_cap)\n apply (simp add: caps_of_s_e0_caps e0_caps_def create_cap_def)\n done\n\nlemma e1_connected_to_e2:\n \"s \\ 1 \\ 2\"\n apply (simp add: directly_tgs_connected_def4)\n apply (rule disjI2)+\n apply (simp add: shares_caps_def)\n apply (simp add: store_connected_s)\n done\n\nlemma e0_caps_not_connected_to_e1:\n \"\\ (s \\ 0 \\ 1)\"\n apply (simp add: directly_tgs_connected_def4)\n apply (rule conjI)\n apply (simp add: cap_in_caps_def caps_of_s_e1)\n apply (rule conjI)\n apply (clarsimp simp add: cap_in_caps_def caps_of_s_e0_caps e0_caps_def)\n apply (erule disjE)\n apply (simp add: full_cap_def)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp add: cap_in_caps_def caps_of_s_e0_caps e0_caps_def)\n apply (erule disjE)\n apply (simp add: full_cap_def)\n apply clarsimp\n apply (rule conjI)\n apply (simp add: cap_in_caps_def caps_of_s_e1)\n apply (simp add: shares_caps_def)\n apply (simp add: store_connected_s)\n done\n\nlemma e0_caps_not_connected_to_e2:\n \"\\ (s \\ 0 \\ 2)\"\n apply (simp add: directly_tgs_connected_def4)\n apply (rule conjI)\n apply (simp add: cap_in_caps_def caps_of_s_e2)\n apply (rule conjI)\n apply (clarsimp simp add: cap_in_caps_def caps_of_s_e0_caps e0_caps_def)\n apply (erule disjE)\n apply (simp add: full_cap_def)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp add: cap_in_caps_def caps_of_s_e0_caps e0_caps_def)\n apply (erule disjE)\n apply (simp add: full_cap_def)\n apply clarsimp\n apply (rule conjI)\n apply (simp add: cap_in_caps_def caps_of_s_e2)\n apply (simp add: shares_caps_def)\n apply (simp add: store_connected_s)\n done\n\n\n\n\n(*********************************)\n(* connected_trans *)\n(*********************************)\n\n\nlemma e1_connected_trans_to_e2:\n \"s \\ 1 \\* 2\"\n apply (insert e1_connected_to_e2)\n apply (simp add: tgs_connected_def)\n done\n\n\nlemma caps_of_to_e1:\n \"\\c \\ caps_of s x; target c = 1\\ \\ x = 1 \\ x = 2\"\n apply (case_tac \"x = 0\")\n apply (fastforce simp: caps_of_s_e0_caps_2)\n apply (case_tac \"x = 1\")\n apply (fastforce simp: caps_of_s_e1)\n apply (fastforce simp: caps_of_s_e3)\n done\n\nlemma caps_of_to_e2:\n \"\\c \\ caps_of s x; target c = 2\\ \\ x = 1\"\n apply (case_tac \"x = 0\")\n apply (fastforce simp: caps_of_s_e0_caps_2)\n apply (case_tac \"x = 1\")\n apply (fastforce simp: caps_of_s_e1)\n apply (fastforce simp: caps_of_s_e3)\n done\n\nlemma cap_in_caps_caps_of_e1:\n \"c \\cap caps_of s 1 \\ target c = 1 \\ target c = 2\"\n by (clarsimp simp: cap_in_caps_def caps_of_s_e1)\n\nlemma cap_in_caps_caps_of_e2:\n \"c \\cap caps_of s 2 \\ False\"\n by (clarsimp simp: cap_in_caps_def caps_of_s_e2)\n\nlemma cap_in_caps_caps_of_to_e1:\n \"\\c \\cap caps_of s x; target c = 1\\ \\ x = 1 \\ x = 2\"\n apply (clarsimp simp: cap_in_caps_def)\n apply (drule (1) caps_of_to_e1, simp)\n done\n\nlemma cap_in_caps_caps_of_to_e2:\n \"\\c \\cap caps_of s x; target c = 2\\ \\ x = 1\"\n apply (clarsimp simp: cap_in_caps_def)\n apply (erule (1) caps_of_to_e2)\n done\n\nlemma e1_connected_to:\n \"s \\ 1 \\ x \\ x = 1 \\ x = 2\"\n apply (simp add: directly_tgs_connected_def4)\n apply (erule disjE)\n apply (erule cap_in_caps_caps_of_to_e1, simp)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e1, simp)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e1, simp)\n apply (erule disjE)\n apply (erule cap_in_caps_caps_of_to_e1, simp)\n apply (fastforce simp: shares_caps_def store_connected_s)\n done\n\n\nlemma e2_connected_to:\n \"s \\ 2 \\ x \\ x = 1 \\ x = 2\"\n apply (simp add: directly_tgs_connected_def4)\n apply (erule disjE, rule disjI1)\n apply (erule cap_in_caps_caps_of_to_e2, simp)\n apply (erule disjE, rule disjI1)\n apply (drule cap_in_caps_caps_of_e2, simp)\n apply (erule disjE, rule disjI1)\n apply (drule cap_in_caps_caps_of_e2, simp)\n apply (erule disjE, rule disjI1)\n apply (erule cap_in_caps_caps_of_to_e2, simp)\n apply (clarsimp simp: shares_caps_def store_connected_s)\n done\n\n\nlemma directly_tgs_connected_in_inv_image:\n \"(directly_tgs_connected s) \\ inv_image Id (\\ x. x=1 \\ x=2)\"\n by (fastforce simp: inv_image_def\n dest!: e1_connected_to e1_connected_to [OF directly_tgs_connected_comm]\n e2_connected_to e2_connected_to [OF directly_tgs_connected_comm])\n\nlemma connected_inv_image_trans:\n \"trans (inv_image Id (\\ x. x=1 \\ x=2))\"\n by (rule trans_inv_image [OF trans_Id])\n\nlemma eq_inv_image_connected:\n \"(inv_image Id (\\ x. x=1 \\ x=2))\\<^sup>= = inv_image Id (\\ x. x=1 \\ x=2)\"\n by (fastforce simp: inv_image_def)\n\nlemma rtrancl_inv_image_connected:\n \"(inv_image Id (\\ x. x=1 \\ x=2))\\<^sup>* = inv_image Id (\\ x. x=1 \\ x=2)\"\n apply (subst trancl_reflcl [symmetric])\n apply (subst eq_inv_image_connected)\n apply (rule trancl_id)\n apply (rule connected_inv_image_trans)\n done\n\nlemma tgs_connected_in_inv_image:\n \"(tgs_connected s) \\ inv_image Id (\\ x. x=1 \\ x=2)\"\n apply (simp add: tgs_connected_def)\n apply (subst rtrancl_inv_image_connected [symmetric])\n apply (rule rtrancl_mono)\n apply (rule directly_tgs_connected_in_inv_image)\n done\n\nlemma e0_not_connected_trans_e1:\n \"\\ s \\ 0 \\* 1\"\n apply clarsimp\n apply (drule set_mp [OF tgs_connected_in_inv_image])\n apply (simp add: inv_image_def)\n done\n\nlemma e0_not_ever_connected_trans_e1:\n \"s' \\ execute cmds s \\ \\ s' \\ 0 \\* 1\"\n apply clarsimp\n apply (drule (1) tgs_connected_preserved)\n apply (simp add: e0_not_connected_trans_e1)\n done\n\n\nlemma e0_e1_leakage:\n \"s' \\ execute cmds s \\ \\ leak s' 0 1\"\n apply (insert e0_not_connected_trans_e1)\n apply (drule (2) leakage_rule)\n done\n\n\n\n\n\n(*********************************)\n(* islandtems *)\n(*********************************)\nlemma island_e0:\n \"island s 0 = {i. i \\ 1 \\ i \\ 2}\"\n apply rule\n apply (clarsimp simp: island_def)\n apply (insert tgs_connected_in_inv_image)[1]\n apply fastforce\n apply (clarsimp simp: island_def)\n apply (drule (1) e0_connected_to)\n apply (drule directly_tgs_connected_comm)\n by (metis directly_tgs_connected_def2 tgs_connected_comm leakImplyConnectedTrans)\n\nlemma island_e1:\n \"island s 1 = {1,2}\"\n apply rule\n apply (clarsimp simp: island_def)\n apply (insert tgs_connected_in_inv_image)[1]\n apply fastforce\n apply (clarsimp simp: island_def)\n apply (rule e1_connected_trans_to_e2)\n done\n\nlemma island_e2:\n \"island s 2 = {1,2}\"\n apply rule\n apply (clarsimp simp: island_def)\n apply (insert tgs_connected_in_inv_image)[1]\n apply fastforce\n apply (clarsimp simp: island_def)\n apply (rule e1_connected_trans_to_e2 [THEN tgs_connected_comm])\n done\n\nlemma island_e3:\n \"\\x \\ 1; x \\ 2\\ \\ island s x = {i. i \\ 1 \\ i \\ 2}\"\n apply rule\n apply (clarsimp simp: island_def)\n apply (insert tgs_connected_in_inv_image)[1]\n apply fastforce\n apply (clarsimp simp: island_def)\n apply (frule_tac x=x in e0_connected_to, simp)\n apply (frule_tac x=xa in e0_connected_to, simp)\n apply (drule_tac x=0 and y=xa in directly_tgs_connected_comm)\n apply (rule tgs_connected_comm)\n apply (simp add: tgs_connected_def)\n done\n\n\n(*********************************)\n(* isolation *)\n(*********************************)\n\nlemma e1_flow_to:\n \"s \\ 1 \\ x \\ x = 1 \\ x = 2\"\n apply (rule ccontr)\n apply (clarsimp simp: flow_def set_flow_def island_e1 island_e3)\n apply (erule disjE, clarsimp)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e1, clarsimp+)\n apply (drule cap_in_caps_caps_of_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e2, clarsimp+)\n apply (drule cap_in_caps_caps_of_e2, clarsimp+)\n done\n\nlemma e2_flow_to:\n \"s \\ 2 \\ x \\ x = 1 \\ x = 2\"\n apply (rule ccontr)\n apply (clarsimp simp: flow_def set_flow_def island_e2 island_e3)\n apply (erule disjE, clarsimp)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e1, clarsimp+)\n apply (drule cap_in_caps_caps_of_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e2, clarsimp+)\n apply (drule cap_in_caps_caps_of_e2, clarsimp+)\n done\n\nlemma flow_to_e1:\n \"s \\ x \\ 1 \\ x = 1 \\ x = 2\"\n apply (rule ccontr)\n apply (clarsimp simp: flow_def set_flow_def island_e1 island_e3)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e2, clarsimp+)\n apply (drule cap_in_caps_caps_of_to_e2, clarsimp+)\n done\n\nlemma flow_to_e2:\n \"s \\ x \\ 2 \\ x = 1 \\ x = 2\"\n apply (rule ccontr)\n apply (clarsimp simp: flow_def set_flow_def island_e2 island_e3)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_to_e1, clarsimp+)\n apply (erule disjE)\n apply (drule cap_in_caps_caps_of_e2, clarsimp+)\n apply (drule cap_in_caps_caps_of_to_e2, clarsimp+)\n done\n\n\nlemma flow_in_inv_image:\n \"(flow s) \\ inv_image Id (\\ x. x=1 \\ x=2)\"\n by (fastforce simp: inv_image_def\n dest!: e1_flow_to flow_to_e1\n e2_flow_to flow_to_e2)\n\n\nlemma flow_trans_in_inv_image:\n \"(flow_trans s) \\ inv_image Id (\\ x. x=1 \\ x=2)\"\n apply (simp add: flow_trans_def)\n apply (subst rtrancl_inv_image_connected [symmetric])\n apply (rule rtrancl_mono)\n apply (rule flow_in_inv_image)\n done\n\nlemma e0_not_flow_trans_e1:\n \"\\ s \\ 0 \\* 1\"\n apply clarsimp\n apply (drule set_mp [OF flow_trans_in_inv_image])\n apply (simp add: inv_image_def)\n done\n\nlemma e1_not_flow_trans_e0:\n \"\\ s \\ 1 \\* 0\"\n apply clarsimp\n apply (drule set_mp [OF flow_trans_in_inv_image])\n apply (simp add: inv_image_def)\n done\n\nlemma e0_e1_isolated:\n \"s' \\ execute cmds s \\ \\ s' \\ 0 \\* 1 \\ \\ s' \\ 1 \\* 0\"\n apply (rule conjI)\n apply (erule information_flow)\n apply (rule e0_not_flow_trans_e1)\n apply (erule information_flow)\n apply (rule e1_not_flow_trans_e0)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/take-grant/Example2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.35220177524832036, "lm_q1q2_score": 0.18846261649487922}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__61.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__61 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__61 and some rule r*}\nlemma n_NI_Local_Get_Put_HeadVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__61:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__61:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__61:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__61:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__61:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_exists_HomeVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_exists_Home src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_existsVsinv__61:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__61:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__61:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__61:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__61:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__61:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__61 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__61:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__61:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__61:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__61:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__61:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__61:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__61:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__61:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__61:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__61:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__61:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__61:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__61:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__61:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__61:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__61:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__61:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__61:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__61.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.3738758367247085, "lm_q1q2_score": 0.18839834113730364}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory UserOp_IF\nimports ArchSyscall_IF \"Access.ArchADT_AC\"\nbegin\n\ntext \\\n This theory defines an enhanced @{term do_user_op} function for the\n automaton used for the information flow proofs. This enhanced model of\n user behaviour is a less abstract representation than the original one;\n eventually we should probably extend the original one to match up with\n this one and remove the duplication.\n\\\n\nlemma equiv_symmetric:\n \"equiv_for a b c d = equiv_for a b d c\"\n by (auto simp: equiv_for_def)\n\nlemma gets_ev''':\n \"equiv_valid_inv I A (\\s. P s \\ (\\t. I s t \\ A s t \\ P t \\ f s = f t)) (gets f)\"\n apply (simp add: equiv_valid_def2)\n apply (auto simp: equiv_valid_2_def in_monad)\n done\n\nlemma spec_equiv_valid_add_asm:\n \"(P st \\ spec_equiv_valid_inv st I A P f) \\ spec_equiv_valid_inv st I A P f\"\n by (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma spec_equiv_valid_add_rel:\n \"\\ spec_equiv_valid_inv st I A (P and I st) f; \\s. I s s \\\n \\ spec_equiv_valid_inv st I A P f\"\n by (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma spec_equiv_valid_add_rel':\n \"\\ spec_equiv_valid_inv st I A (P and A st) f; \\s. A s s \\\n \\ spec_equiv_valid_inv st I A P f\"\n by (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma reads_equiv_g_refl:\n \"reads_equiv_g aag s s\"\n apply (rule reads_equiv_gI)\n apply (rule reads_equiv_refl)\n apply (rule globals_equiv_refl)\n done\n\nlemma spec_equiv_valid_inv_gets:\n assumes proj_retain: \"\\t. \\ P st; P t; I st t; A st t \\ \\ proj (f st) = proj (f t)\"\n and spec_eqv_valid: \"spec_equiv_valid_inv st I A P (g (proj (f st)))\"\n shows \"spec_equiv_valid_inv st I A P (do r \\ gets f; g (proj r) od)\"\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def gets_def get_def bind_def return_def)\n apply (frule (3) proj_retain)\n apply (cut_tac spec_eqv_valid)\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def gets_def get_def bind_def return_def)\n apply (drule spec)+\n apply (erule impE)\n apply fastforce\n apply fastforce\n done\n\nlemmas spec_equiv_valid_inv_gets_more =\n spec_equiv_valid_inv_gets[where proj=\"\\x. (proj x, projsnd x)\"\n and g=\"\\z. g (fst z) (snd z)\"\n for proj and projsnd and g, simplified]\n\nlemmas spec_equiv_valid_inv_gets_triple =\n spec_equiv_valid_inv_gets_more[where projsnd=\"\\x. (p (projsnd x), p' (projsnd x))\"\n and g=\"\\a z. g a (fst z) (snd z)\"\n for projsnd and p and p' and g, simplified]\n\nlemma restrict_eq_imp_dom_eq:\n \"a |` r = b|` r \\ dom a \\ r = dom b \\ r\"\n apply (clarsimp simp: set_eq_iff restrict_map_def)\n apply (drule_tac x = x in fun_cong)\n apply fastforce\n done\n\nlemma restrict_map_eq_same_domain:\n \"(\\x. x\\ dom a \\ b x = c x) \\ a |` dom b = a |` dom c\"\n apply (rule ext)\n apply (clarsimp simp: restrict_map_def)\n apply (intro conjI impI)\n apply fastforce\n apply (rule ccontr)\n apply (drule not_sym)\n apply fastforce\n done\n\nlemma restrict_map_eq_same_domain_compl:\n \"(\\x. x\\ dom a \\ b x = c x) \\ a |` (- dom b) = a |` (- dom c)\"\n apply (rule ext)\n apply (clarsimp simp: restrict_map_def)\n apply (intro conjI impI)\n apply fastforce\n apply (rule ccontr)\n apply (drule not_sym)\n apply fastforce\n done\n\nlemma map_add_eq:\n \"ms x = ms' x \\ (ms ++ um) x = (ms' ++ um) x\"\n by (clarsimp simp: map_add_def split: option.splits)\n\n\nlocale UserOp_IF_1 =\n assumes arch_globals_equiv_underlying_memory_update[simp]:\n \"\\f. arch_globals_equiv ct it kh kh' as as' (underlying_memory_update f ms) ms' =\n arch_globals_equiv ct it kh kh' as as' ms ms'\"\n \"\\f. arch_globals_equiv ct it kh kh' as as' ms (underlying_memory_update f ms') =\n arch_globals_equiv ct it kh kh' as as' ms ms'\"\n and arch_globals_equiv_device_state_update[simp]:\n \"\\f. arch_globals_equiv ct it kh kh' as as' (device_state_update f ms) ms' =\n arch_globals_equiv ct it kh kh' as as' ms ms'\"\n \"\\f. arch_globals_equiv ct it kh kh' as as' ms (device_state_update f ms') =\n arch_globals_equiv ct it kh kh' as as' ms ms'\"\nbegin\n\n(* Assumptions:\n * User is deterministic based on an address being mapped with no rights or not mapped at all.\n * We implicitly assume that if you have any rights you must have at least read rights.\n*)\n\nlemma dmo_user_memory_update_reads_respects_g:\n \"reads_respects_g aag l \\ (do_machine_op (user_memory_update um))\"\n apply (clarsimp simp: equiv_valid_def2 equiv_valid_2_def)\n apply (clarsimp simp: do_machine_op_def user_memory_update_def\n gets_def get_def select_f_def bind_def in_monad)\n apply (clarsimp simp: reads_equiv_g_def globals_equiv_def split: option.splits)\n apply (subgoal_tac \"reads_respects aag l \\ (do_machine_op (user_memory_update um))\")\n apply (fastforce simp: equiv_valid_def2 equiv_valid_2_def in_monad do_machine_op_def\n user_memory_update_def select_f_def idle_equiv_def)\n apply (rule use_spec_ev)\n apply (simp add: user_memory_update_def)\n apply (rule do_machine_op_spec_reads_respects)\n apply (simp add: equiv_valid_def2)\n apply (rule modify_ev2)\n apply (fastforce intro: equiv_forI elim: equiv_forE split: option.splits)\n apply (wp | simp)+\n done\n\nlemma dmo_device_state_update_reads_respects_g:\n \"reads_respects_g aag l (\\s. dom um \\ device_region s) (do_machine_op (device_memory_update um))\"\n apply (clarsimp simp: equiv_valid_def2 equiv_valid_2_def)\n apply (clarsimp simp: do_machine_op_def device_memory_update_def\n gets_def get_def select_f_def bind_def in_monad)\n apply (clarsimp simp: reads_equiv_g_def globals_equiv_def split: option.splits)\n apply (subgoal_tac \"reads_respects aag l \\ (do_machine_op (device_memory_update um))\")\n apply (fastforce simp: equiv_valid_def2 equiv_valid_2_def in_monad do_machine_op_def\n device_memory_update_def select_f_def idle_equiv_def)\n apply (rule use_spec_ev)\n apply (simp add: device_memory_update_def)\n apply (rule do_machine_op_spec_reads_respects)\n apply (simp add: equiv_valid_def2)\n apply (rule modify_ev2)\n apply (fastforce intro: map_add_eq equiv_forI elim: equiv_forE split: option.splits)\n apply (wp | simp)+\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/UserOp_IF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.35936414516010196, "lm_q1q2_score": 0.18809850625490437}} {"text": "(* Title: variants/a_norreqid/OAodv.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke, Inria\n*)\n\nsection \"The `open' AODV model\"\n\ntheory A_OAodv\nimports A_Aodv AWN.OAWN_SOS_Labels AWN.OAWN_Convert\nbegin\n\ntext \\Definitions for stating and proving global network properties over individual processes.\\\n\ndefinition \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' :: \"((ip \\ state) \\ ((state, msg, pseqp, pseqp label) seqp)) set\"\nwhere \"\\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ {(\\i. aodv_init i, \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V PAodv)}\"\n\nabbreviation opaodv\n :: \"ip \\ ((ip \\ state) \\ (state, msg, pseqp, pseqp label) seqp, msg seq_action) automaton\"\nwhere\n \"opaodv i \\ \\ init = \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V', trans = oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i \\\"\n\nlemma initiali_aodv [intro!, simp]: \"initiali i (init (opaodv i)) (init (paodv i))\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by rule simp_all\n\nlemma oaodv_control_within [simp]: \"control_within \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (init (opaodv i))\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by (rule control_withinI) (auto simp del: \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_simps)\n\nlemma \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_labels [simp]: \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ labels \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V p = {PAodv-:0}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by simp\n\nlemma oaodv_init_kD_empty [simp]:\n \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ kD (rt (\\ i)) = {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def kD_def by simp\n\nlemma oaodv_init_vD_empty [simp]:\n \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ vD (rt (\\ i)) = {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def vD_def by simp\n\nlemma oaodv_trans: \"trans (opaodv i) = oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\"\n by simp\n\ndeclare\n oseq_invariant_ctermsI [OF aodv_wf oaodv_control_within aodv_simple_labels oaodv_trans, cterms_intros]\n oseq_step_invariant_ctermsI [OF aodv_wf oaodv_control_within aodv_simple_labels oaodv_trans, cterms_intros]\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AODV/variants/a_norreqid/A_OAodv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.188098317586914}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Memset\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"memset.c\"\ninstall_C_file \"memset.c\"\n\nautocorres [\n heap_abs_syntax,\n no_heap_abs=memset,\n no_signed_word_abs=memset,\n unsigned_word_abs=memset] \"memset.c\"\n\nlemma c_guard_word8_ptr [simp]:\n \"c_guard (x :: word8 ptr) = (x \\ NULL)\"\n apply (clarsimp simp: c_guard_def ptr_aligned_def c_null_guard_def)\n apply (metis Ptr_ptr_val first_in_intvl intvl_Suc not_less_eq ptr_val.ptr_val_def)\n done\n\nlemma to_bytes_word8 [simp]: \"to_bytes (a :: word8) x = [a]\"\n by (clarsimp simp: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma heap_update_list_id [simp]:\n \"heap_update_list x [] = (\\x. x)\"\n apply (rule ext)\n apply simp\n done\n\nlemma heap_update_heap_update_list:\n \"\\ ptr_val p = q + (of_nat (length l)); Suc (length l) < addr_card \\ \\\n heap_update (p :: word8 ptr) v (heap_update_list q l s) = (heap_update_list q (l @ [v]) s)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def unat_of_nat\n addr_card word_bits_def fun_upd_def)\n apply (subst heap_update_list_value, clarsimp simp: addr_card)\n apply safe\n apply (subst if_P)\n apply (fastforce intro: intvlI)\n apply (clarsimp simp: unat_of_nat word_bits_def)\n apply (subst (1 2) heap_update_list_value,\n simp add: addr_card,\n simp add: addr_card)\n apply (case_tac \"x \\ {q..+length l}\")\n apply (subst if_P, simp)\n apply (subst if_P)\n apply clarsimp\n apply (metis (full_types) intvlD intvlI less_SucI)\n apply (subst nth_append, clarsimp)\n apply (metis (hide_lams, no_types) add_diff_cancel2 intvlD le_unat_uoi less_or_eq_imp_le not_le)\n apply clarsimp\n apply (metis intvlD intvlI less_antisym)\n done\n\nlemma (in memset) memset:\n \"\\s\\<^sub>0. \\ \\s. s = s\\<^sub>0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update (\n heap_update_list (ptr_val p) (replicate n (scast c)))) s\\<^sub>0 \\!\"\nproof -\n {\n fix s0\n have \"\\ \\s. s = s0 \\ n < addr_card \\ 0 \\ {ptr_val p ..+ n} \\\n memset' p c n\n \\ \\rv s. s = t_hrs_'_update (hrs_mem_update\n (heap_update_list (ptr_val p) (replicate n (scast c)))) s0 \\!\"\n apply (rule validNF_assume_pre)\n apply (unfold memset'_def)\n apply (subst whileLoop_add_inv [where M=\"\\((d', n'), _). n'\"\n and I=\"\\(d', n') s.\n n' \\ n \\\n (n' \\ n \\ d' = ptr_coerce p +\\<^sub>p int (n - n')) \\\n (n' \\ n \\ s = t_hrs_'_update\n (hrs_mem_update (heap_update_list (ptr_val p) (replicate (n - n') (scast c)))) s0)\"])\n apply wp\n apply (clarsimp simp:)\n apply (intro conjI impI)\n apply arith\n apply (clarsimp simp: ptr_add_def)\n apply (rule globals.fold_congs, simp, simp)\n apply (clarsimp simp: hrs_mem_update_def)\n apply (subst heap_update_heap_update_list)\n apply (clarsimp simp: ptr_add_def)\n apply (clarsimp)\n apply arith\n apply (metis diff_Suc_diff_eq2 diff_diff_left minus_nat.diff_0 replicate_Suc_append)\n apply (clarsimp simp: ptr_add_def)\n apply (metis (hide_lams, no_types) add_less_cancel_right add.left_neutral intvl_inter_le le0 le_add_diff_inverse of_nat_diff semiring_1_class.of_nat_0)\n apply clarsimp\n apply (clarsimp simp: hrs_mem_update_def)\n done\n }\n\n thus ?thesis\n by simp\nqed\n\nlemma word_rsplit_sword_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize signed word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma word_rsplit_word_0 [simplified, simp]:\n \"word_rsplit (0 :: addr_bitsize word) = replicate (size_of TYPE(addr)) (0 :: word8)\"\n apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n done\n\nlemma heap_update_zero_node [simplified]:\n \"heap_update_list p (replicate (size_of TYPE(node_C)) 0) = heap_update (Ptr p) (node_C NULL 0)\"\n apply (rule ext)\n apply (clarsimp simp: heap_update_def to_bytes_def)\n apply (subst packed_type_access_ti, simp)\n apply (clarsimp simp: access_ti\\<^sub>0_def)\n apply (clarsimp simp: to_bytes_def to_bytes_p_def node_C_tag_def node_C_typ_tag)\n apply (subst final_pad_def)\n apply (clarsimp simp: typ_info_word size_td_lt_ti_typ_pad_combine Let_def padup_def)\n apply (clarsimp simp: ti_typ_pad_combine_def)\n apply (clarsimp simp: ti_typ_combine_def empty_typ_info_def typ_info_ptr typ_info_word)\n done\n\nlemma (in memset) is_valid_node_C_non_NULL [simp]:\n \"is_valid_node_C (lift_global_heap s) p \\ 0 \\ {ptr_val p ..+ size_of TYPE(node_C)}\"\n by (auto simp: lift_global_heap_def c_guard_def c_null_guard_def dest: simple_lift_c_guard)\n\nlemma (in memset) zero_node:\n \"\\s\\<^sub>0. \\ \\s. is_valid_node_C s p \\ s = s\\<^sub>0\\ zero_node' p \\ \\rv s. s = s\\<^sub>0[p := (node_C NULL 0) ] \\! \"\n including nf_no_pre\n apply (clarsimp simp: zero_node'_def)\n apply (wp add: memset [THEN validNF_make_schematic_post, simplified])\n apply (fastforce dest: simple_lift_c_guard is_valid_node_C_non_NULL\n simp: addr_card lift_global_heap_def heap_update_zero_node\n memset.update_node_def typ_simple_heap_simps fun_upd_def)\n done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/autocorres/tests/examples/Memset.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.3702253925955866, "lm_q1q2_score": 0.18800484681746518}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ArchArraysMemInstance\nimports ArraysMemInstance\nbegin\n\n(* Showing arrays are in mem_type requires maximum sizes for objects,\n and maximum counts for elements *)\nclass array_outer_max_size = mem_type +\n assumes array_outer_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 26\"\n\nclass array_max_count = finite +\n assumes array_max_count_ax: \"CARD ('a) <= 2 ^ 20\"\n\ninstance array :: (array_outer_max_size, array_max_count) mem_type\napply intro_classes\napply simp\napply (subgoal_tac \"addr_card = 2 ^ (addr_bitsize - 26) * 2 ^ 26\")\n apply (erule ssubst)\n apply (rule less_le_trans[where y = \"card (UNIV::'b set) * 2 ^ 26\"])\n apply (rule mult_less_mono2)\n apply (rule array_outer_max_size_ax)\n apply simp\n apply (rule mult_le_mono1)\n apply (rule le_trans[where j = \"2 ^ 20\"])\n apply (rule array_max_count_ax)\n apply simp\n apply simp\napply (simp add: addr_card)\ndone\n\nclass array_inner_max_size = array_outer_max_size +\n assumes array_inner_max_size_ax: \"size_of TYPE('a::c_type) < 2 ^ 6\"\n\ninstance array :: (array_inner_max_size, array_max_count) array_outer_max_size\napply intro_classes\napply simp\n apply (rule order_less_le_trans)\n apply (rule mult_le_less_imp_less)\n apply (rule array_max_count_ax)\n apply (rule array_inner_max_size_ax)\n apply simp\n apply simp\n apply simp\n done\n\ninstance word :: (len8) array_outer_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance word :: (len8) array_inner_max_size\napply intro_classes\napply(simp add: size_of_def)\napply(subgoal_tac \"len_of TYPE('a) \\ 128\")\n apply simp\napply(rule len8_width)\ndone\n\ninstance ptr :: (c_type) array_outer_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\ninstance ptr :: (c_type) array_inner_max_size\napply intro_classes\napply (simp add: size_of_def)\ndone\n\nclass lt19 = finite +\n assumes lt19_ax: \"CARD ('a) < 2 ^ 19\"\nclass lt18 = lt19 +\n assumes lt18_ax: \"CARD ('a) < 2 ^ 18\"\nclass lt17 = lt18 +\n assumes lt17_ax: \"CARD ('a) < 2 ^ 17\"\nclass lt16 = lt17 +\n assumes lt16_ax: \"CARD ('a) < 2 ^ 16\"\nclass lt15 = lt16 +\n assumes lt15_ax: \"CARD ('a) < 2 ^ 15\"\nclass lt14 = lt15 +\n assumes lt14_ax: \"CARD ('a) < 2 ^ 14\"\nclass lt13 = lt14 +\n assumes lt13_ax: \"CARD ('a) < 2 ^ 13\"\nclass lt12 = lt13 +\n assumes lt12_ax: \"CARD ('a) < 2 ^ 12\"\nclass lt11 = lt12 +\n assumes lt11_ax: \"CARD ('a) < 2 ^ 11\"\nclass lt10 = lt11 +\n assumes lt10_ax: \"CARD ('a) < 2 ^ 10\"\nclass lt9 = lt10 +\n assumes lt9_ax: \"CARD ('a) < 2 ^ 9\"\nclass lt8 = lt9 +\n assumes lt8_ax: \"CARD ('a) < 2 ^ 8\"\nclass lt7 = lt8 +\n assumes lt7_ax: \"CARD ('a) < 2 ^ 7\"\nclass lt6 = lt7 +\n assumes lt6_ax: \"CARD ('a) < 2 ^ 6\"\nclass lt5 = lt6 +\n assumes lt5_ax: \"CARD ('a) < 2 ^ 5\"\nclass lt4 = lt5 +\n assumes lt4_ax: \"CARD ('a) < 2 ^ 4\"\nclass lt3 = lt4 +\n assumes lt3_ax: \"CARD ('a) < 2 ^ 3\"\nclass lt2 = lt3 +\n assumes lt2_ax: \"CARD ('a) < 2 ^ 2\"\nclass lt1 = lt2 +\n assumes lt1_ax: \"CARD ('a) < 2 ^ 1\"\n\ninstance bit0 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt19) array_max_count\n using lt19_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt18) lt19\n using lt18_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt17) lt18\n using lt17_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt16) lt17\n using lt16_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt15) lt16\n using lt15_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt14) lt15\n using lt14_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt13) lt14\n using lt13_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt12) lt13\n using lt12_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt11) lt12\n using lt11_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt10) lt11\n using lt10_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt9) lt10\n using lt9_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt8) lt9\n using lt8_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt7) lt8\n using lt7_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt6) lt7\n using lt6_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt5) lt6\n using lt5_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt4) lt5\n using lt4_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt3) lt4\n using lt3_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt2) lt3\n using lt2_ax[where 'a='a] by intro_classes simp\n\ninstance bit0 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance bit1 :: (lt1) lt2\n using lt1_ax[where 'a='a] by intro_classes simp\n\ninstance num1 :: lt1\n by (intro_classes, simp_all)\n\n(* don't understand why this also seems to be necessary *)\ninstance num1 :: array_max_count\n by (intro_classes, simp)\n\n(* introduce hackish handling of 8192 type by making a copy of the type\n under a constructor, and then manually showing that it is an instance of\n array_max_count *)\ndatatype array_max_count_ty = array_max_count_ty \"1048576\"\n\n(* ML c-parser code also needs to know at which array size to use this type *)\nML \\\n structure ArchArrayMaxCount = struct\n val array_max_count = 1048576\n end\n\\\n\nlemma univ_array_max_count_ty:\n \"(UNIV::array_max_count_ty set) = image array_max_count_ty (UNIV::1048576 set)\"\n apply (simp add: set_eq_iff image_iff)\n apply (rule_tac allI)\n apply (rule_tac array_max_count_ty.induct)\n apply simp\n done\n\ninstance \"array_max_count_ty\" :: finite\n apply intro_classes\n apply (simp add: univ_array_max_count_ty)\n done\n\nlemma card_array_max_count_ty[simp]: \"CARD(array_max_count_ty) = CARD(1048576)\"\n apply (simp add: univ_array_max_count_ty card_image inj_on_def)\n done\n\ninstance \"array_max_count_ty\" :: array_max_count\n by intro_classes simp\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/X64/ArchArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3486451488696663, "lm_q1q2_score": 0.18791388521490984}} {"text": "theory Old_Semantics\n imports \"NewPsi.Semantics\"\nbegin\n\nlocale old_psi = env subst_term subst_assert subst_cond S_compose' S_imp' S_bottom' S_chan_eq'\n for subst_term :: \"('a::fs_name) \\ name list \\ 'a::fs_name list \\ 'a\"\n and subst_assert :: \"('b::fs_name) \\ name list \\ 'a::fs_name list \\ 'b\"\n and subst_cond :: \"('c::fs_name) \\ name list \\ 'a::fs_name list \\ 'c\"\n and S_compose' :: \"'b \\ 'b \\ 'b\"\n and S_imp' :: \"'b \\ 'c \\ bool\"\n and S_bottom' :: 'b\n and S_chan_eq' :: \"'a \\ 'a \\ 'c\" +\n\n assumes chan_eq_sym: \"S_imp' \\ (S_chan_eq' M N) \\ S_imp' \\ (S_chan_eq' N M)\"\n and chan_eq_trans: \"\\S_imp' \\ (S_chan_eq' M N); S_imp' \\ (S_chan_eq' N L)\\ \\ S_imp' \\ (S_chan_eq' M L)\"\nbegin\n\ninductive old_semantics :: \"'b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) residual \\ bool\"\n (\"_ \\ _ \\\\<^sub>O _\" [50, 50, 50] 50)\nwhere\n c_input: \"\\\\ \\ M \\ K; distinct xvec; set xvec \\ supp N; xvec \\* Tvec;\n length xvec = length Tvec;\n xvec \\* \\; xvec \\* M; xvec \\* K\\ \\ \\ \\ M\\\\*xvec N\\.P \\\\<^sub>O K\\(N[xvec::=Tvec])\\ \\ P[xvec::=Tvec]\"\n| Output: \"\\\\ \\ M \\ K\\ \\ \\ \\ M\\N\\.P \\\\<^sub>O K\\N\\ \\ P\"\n| Case: \"\\\\ \\ P \\\\<^sub>O Rs; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\ \\ \\ Cases Cs \\\\<^sub>O Rs\"\n\n| c_par1: \"\\(\\ \\ \\\\<^sub>Q) \\ P \\\\<^sub>O\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* P'; distinct(bn \\); \n bn \\ \\* \\; bn \\ \\* \\\\<^sub>Q; bn \\ \\* Q; bn \\ \\* P; bn \\ \\* (subject \\)\\ \\\n \\ \\ P \\ Q \\\\<^sub>O\\ \\ (P' \\ Q)\"\n| c_par2: \"\\(\\ \\ \\\\<^sub>P) \\ Q \\\\<^sub>O\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\; A\\<^sub>P \\* \\; A\\<^sub>P \\* Q'; distinct(bn \\); \n bn \\ \\* \\; bn \\ \\* \\\\<^sub>P; bn \\ \\* P; bn \\ \\* Q; bn \\ \\* (subject \\)\\ \\\n \\ \\ P \\ Q \\\\<^sub>O\\ \\ (P \\ Q')\"\n| c_comm1: \"\\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>O M\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>O K\\\\*xvec\\\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K; \n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P';\n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; \n A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P';\n A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q'; A\\<^sub>Q \\* xvec; distinct xvec;\n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M;\n xvec \\* Q; xvec \\* K\\ \\\n \\ \\ P \\ Q \\\\<^sub>O \\ \\ \\\\*xvec\\(P' \\ Q')\"\n| c_comm2: \"\\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>O M\\\\*xvec\\\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>O K\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K; \n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P';\n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; \n A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P';\n A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q'; A\\<^sub>Q \\* xvec; distinct xvec;\n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M;\n xvec \\* Q; xvec \\* K\\ \\\n \\ \\ P \\ Q \\\\<^sub>O \\ \\ \\\\*xvec\\(P' \\ Q')\"\n| c_open: \"\\\\ \\ P \\\\<^sub>O M\\\\*(xvec@yvec)\\\\N\\ \\ P'; x \\ supp N; x \\ xvec; x \\ yvec; x \\ M; x \\ \\;\n distinct xvec; distinct yvec;\n xvec \\* \\; xvec \\* P; xvec \\* M; xvec \\* yvec; yvec \\* \\; yvec \\* P; yvec \\* M\\ \\\n \\ \\ \\\\x\\P \\\\<^sub>O M\\\\*(xvec@x#yvec)\\\\N\\ \\ P'\"\n| c_scope: \"\\\\ \\ P \\\\<^sub>O\\ \\ P'; x \\ \\; x \\ \\; bn \\ \\* \\; bn \\ \\* P; bn \\ \\* (subject \\); distinct(bn \\)\\ \\ \\ \\ \\\\x\\P \\\\<^sub>O\\ \\ (\\\\x\\P')\"\n| Bang: \"\\\\ \\ P \\ !P \\\\<^sub>O Rs; guarded P\\ \\ \\ \\ !P \\\\<^sub>O Rs\"\n\nabbreviation\n old_semantics_bottom_judge (\"_ \\\\<^sub>O _\" [50, 50] 50) where \"P \\\\<^sub>O Rs \\ \\ \\ P \\\\<^sub>O Rs\"\n\nequivariance old_psi.old_semantics\n\nnominal_inductive2 old_psi.old_semantics\n avoids c_input: \"set xvec\"\n | c_par1: \"set A\\<^sub>Q \\ set(bn \\)\"\n | c_par2: \"set A\\<^sub>P \\ set(bn \\)\"\n | c_comm1: \"set A\\<^sub>P \\ set A\\<^sub>Q \\ set xvec\"\n | c_comm2: \"set A\\<^sub>P \\ set A\\<^sub>Q \\ set xvec\"\n | c_open: \"{x} \\ set xvec \\ set yvec\"\n | c_scope: \"{x} \\ set(bn \\)\"\napply(auto intro: subst_term.subst4_chain subst4_chain simp add: abs_fresh residual_fresh)\napply(force simp add: fresh_star_def abs_fresh)\napply(simp add: bound_output_fresh)\napply(simp add: bound_output_fresh_set)\napply(simp add: bound_output_fresh_set)\nby(simp add: fresh_star_def abs_fresh)\n\nlemma old_nil_trans[dest]:\n fixes \\ :: 'b\n and Rs :: \"('a, 'b, 'c) residual\"\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n and K :: 'a\n and yvec :: \"name list\"\n and N' :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and CsP :: \"('c \\ ('a, 'b, 'c) psi) list\"\n and \\' :: 'b\n\n shows \"\\ \\ \\ \\\\<^sub>O Rs \\ False\"\n and \"\\ \\ M\\\\*xvec N\\.P \\\\<^sub>OK\\\\*yvec\\\\N'\\ \\ P' \\ False\"\n and \"\\ \\ M\\\\*xvec N\\.P \\\\<^sub>O\\ \\ P' \\ False\"\n and \"\\ \\ M\\N\\.P \\\\<^sub>OK\\N'\\ \\ P' \\ False\"\n and \"\\ \\ M\\N\\.P \\\\<^sub>O\\ \\ P' \\ False\"\n and \"\\ \\ \\\\'\\ \\\\<^sub>O Rs \\ False\"\napply(cases rule: old_semantics.cases) apply auto\napply(cases rule: old_semantics.cases) apply(auto simp add: residual_inject)\napply(cases rule: old_semantics.cases) apply(auto simp add: residual_inject)\napply(cases rule: old_semantics.cases) apply(auto simp add: residual_inject)\napply(cases rule: old_semantics.cases) apply(auto simp add: residual_inject)\nby(cases rule: old_semantics.cases) (auto simp add: residual_inject)\n\nlemma old_semantics_induct[consumes 3, case_names c_alpha c_input c_output c_case c_par1 c_par2 c_comm1 c_comm2 c_open c_scope c_bang]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n and Prop :: \"'d::fs_name \\ 'b \\ ('a, 'b, 'c) psi \\\n 'a action \\ ('a, 'b, 'c) psi \\ bool\"\n and C :: \"'d::fs_name\"\n\n assumes \"\\ \\ P \\\\<^sub>O\\ \\ P'\"\n and \"bn \\ \\* (subject \\)\"\n and \"distinct(bn \\)\"\n and r_alpha: \"\\\\ P \\ P' p C. \\bn \\ \\* \\; bn \\ \\* P; bn \\ \\* (subject \\); \n bn \\ \\* C; bn \\ \\* (bn(p \\ \\)); \n set p \\ set(bn \\) \\ set(bn(p \\ \\)); distinct_perm p;\n (bn(p \\ \\)) \\* \\; (bn(p \\ \\)) \\* P'; Prop C \\ P \\ P'\\ \\\n Prop C \\ P (p \\ \\) (p \\ P')\"\n and r_input: \"\\\\ M K xvec N Tvec P C.\n \\\\ \\ M \\ K; distinct xvec; set xvec \\ supp N;\n length xvec = length Tvec; xvec \\* \\;\n xvec \\* M; xvec \\* K; xvec \\* C\\ \\\n Prop C \\ (M\\\\*xvec N\\.P)\n (K\\(N[xvec::=Tvec])\\) (P[xvec::=Tvec])\"\n and r_output: \"\\\\ M K N P C. \\\\ \\ M \\ K\\ \\ Prop C \\ (M\\N\\.P) (K\\N\\) P\"\n and r_case: \"\\\\ P \\ P' \\ Cs C. \\\\ \\ P \\\\<^sub>O\\ \\ P'; \\C. Prop C \\ P \\ P'; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\\n Prop C \\ (Cases Cs) \\ P'\"\n and r_par1: \"\\\\ \\\\<^sub>Q P \\ P' A\\<^sub>Q Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>O\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\C. Prop C (\\ \\ \\\\<^sub>Q) P \\ P';\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* C; distinct(bn \\); bn \\ \\* Q;\n bn \\ \\* \\; bn \\ \\* \\\\<^sub>Q; bn \\ \\* P; bn \\ \\* subject \\; bn \\ \\* C\\ \\\n Prop C \\ (P \\ Q) \\ (P' \\ Q)\"\n and r_par2: \"\\\\ \\\\<^sub>P Q \\ Q' A\\<^sub>P P C.\n \\\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>O\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\C. Prop C (\\ \\ \\\\<^sub>P) Q \\ Q';\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\; A\\<^sub>P \\* \\; A\\<^sub>P \\* Q'; A\\<^sub>P \\* C; distinct(bn \\); bn \\ \\* Q;\n bn \\ \\* \\; bn \\ \\* \\\\<^sub>P; bn \\ \\* P; bn \\ \\* subject \\; bn \\ \\* C\\ \\\n Prop C \\ (P \\ Q) \\ (P \\ Q')\"\n and r_comm1: \"\\\\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\N\\ \\ P'; \\C. Prop C (\\ \\ \\\\<^sub>Q) P (M\\N\\) P'; \n extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OK\\\\*xvec\\\\N\\ \\ Q'; \\C. Prop C (\\ \\ \\\\<^sub>P) Q (K\\\\*xvec\\\\N\\) Q'; \n extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; \n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; \n A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q'; distinct xvec;\n A\\<^sub>Q \\* xvec; xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; \n xvec \\* Q; xvec \\* K; A\\<^sub>P \\* C; A\\<^sub>Q \\* C; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) (\\) (\\\\*xvec\\(P' \\ Q'))\"\n and r_comm2: \"\\\\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; \\C. Prop C (\\ \\ \\\\<^sub>Q) P (M\\\\*xvec\\\\N\\) P'; \n extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P; \n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OK\\N\\ \\ Q'; \\C. Prop C (\\ \\ \\\\<^sub>P) Q (K\\N\\) Q'; \n extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; \n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; \n A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q'; distinct xvec;\n A\\<^sub>Q \\* xvec; xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; \n xvec \\* Q; xvec \\* K; A\\<^sub>P \\* C; A\\<^sub>Q \\* C; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) (\\) (\\\\*xvec\\(P' \\ Q'))\"\n and r_open: \"\\\\ P M xvec yvec N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\\\*(xvec@yvec)\\\\N\\ \\ P'; x \\ supp N; \\C. Prop C \\ P (M\\\\*(xvec@yvec)\\\\N\\) P';\n x \\ \\; x \\ M; x \\ xvec; x \\ yvec; xvec \\* \\; xvec \\* P; xvec \\* M; distinct xvec; distinct yvec;\n yvec \\* \\; yvec \\* P; yvec \\* M; yvec \\* C; x \\ C; xvec \\* C\\ \\ \n Prop C \\ (\\\\x\\P) (M\\\\*(xvec@x#yvec)\\\\N\\) P'\"\n and r_scope: \"\\\\ P \\ P' x C.\n \\\\ \\ P \\\\<^sub>O\\ \\ P'; \\C. Prop C \\ P \\ P';\n x \\ \\; x \\ \\; bn \\ \\* \\;\n bn \\ \\* P; bn \\ \\* (subject \\); x \\ C; bn \\ \\* C; distinct(bn \\)\\ \\\n Prop C \\ (\\\\x\\P) \\ (\\\\x\\P')\"\n and r_bang: \"\\\\ P \\ P' C.\n \\\\ \\ P \\ !P \\\\<^sub>O\\ \\ P'; guarded P; \\C. Prop C \\ (P \\ !P) \\ P'\\ \\\n Prop C \\ (!P) \\ P'\"\n\n shows \"Prop C \\ P \\ P'\"\nusing `\\ \\ P \\\\<^sub>O\\ \\ P'` `bn \\ \\* (subject \\)` `distinct(bn \\)`\nproof(nominal_induct x3==\"\\ \\ P'\" avoiding: \\ C arbitrary: P' rule: old_semantics.strong_induct)\n case(c_input \\ M K xvec N Tvec P \\ C P')\n thus ?case by(force intro: r_input simp add: residual_inject)\nnext\n case(Output \\ M K N P \\ C P')\n thus ?case by(force intro: r_output simp add: residual_inject)\nnext\n case(Case \\ P \\ Cs \\ C P')\n thus ?case by(auto intro: r_case)\nnext\n case(c_par1 \\ \\\\<^sub>Q P \\ P' Q A\\<^sub>Q \\' C P'')\n note `\\ \\ (P' \\ Q) = \\' \\ P''`\n moreover from `bn \\ \\* \\'` have \"bn \\ \\* (bn \\')\" by auto\n moreover note `distinct (bn \\)` `distinct(bn \\')`\n moreover from `bn \\ \\* subject \\` `bn \\' \\* subject \\'`\n have \"bn \\ \\* (\\ \\ P' \\ Q)\" and \"bn \\' \\* (\\' \\ P'')\" by simp+\n ultimately obtain p where S: \"(set p) \\ (set(bn \\)) \\ (set(bn(p \\ \\)))\" and \"distinct_perm p\"\n and \\Eq: \"\\' = p \\ \\\" and P'eq: \"P'' = p \\ (P' \\ Q)\" and \"(bn(p \\ \\)) \\* \\\"\n and \"(bn(p \\ \\)) \\* (P' \\ Q)\"\n by(rule residual_eq)\n \n note `\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>O\\ \\ P'` `extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\` `distinct A\\<^sub>Q`\n moreover from `bn \\ \\* subject \\` `distinct(bn \\)`\n have \"\\C. Prop C (\\ \\ \\\\<^sub>Q) P \\ P'\" by(rule_tac c_par1) auto\n moreover note `A\\<^sub>Q \\* P` `A\\<^sub>Q \\* Q` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* \\` `A\\<^sub>Q \\* P'` `A\\<^sub>Q \\* C`\n `bn \\ \\* Q` `distinct(bn \\)` `bn \\ \\* \\` `bn \\ \\* \\\\<^sub>Q` `bn \\ \\* P` `bn \\ \\* subject \\` `bn \\ \\* C`\n ultimately have \"Prop C \\ (P \\ Q) \\ (P' \\ Q)\"\n by(rule_tac r_par1)\n\n with `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* Q` `bn \\ \\* subject \\` `bn \\ \\* C` `bn \\ \\* bn \\'` S `distinct_perm p` `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* (P' \\ Q)` `A\\<^sub>Q \\* C`\n have \"Prop C \\ (P \\ Q) (p \\ \\) (p \\ (P' \\ Q))\"\n by(rule_tac r_alpha) auto\n with \\Eq P'eq `distinct_perm p` show ?case by simp\nnext\n case(c_par2 \\ \\\\<^sub>P Q \\ Q' P A\\<^sub>P \\' C Q'')\n note `\\ \\ (P \\ Q') = \\' \\ Q''`\n moreover from `bn \\ \\* \\'` have \"bn \\ \\* (bn \\')\" by auto\n moreover note `distinct (bn \\)` `distinct(bn \\')`\n moreover from `bn \\ \\* subject \\` `bn \\' \\* subject \\'`\n have \"bn \\ \\* (\\ \\ P \\ Q')\" and \"bn \\' \\* (\\' \\ Q'')\" by simp+\n ultimately obtain p where S: \"(set p) \\ (set(bn \\)) \\ (set(bn(p \\ \\)))\" and \"distinct_perm p\"\n and \\Eq: \"\\' = p \\ \\\" and Q'eq: \"Q'' = p \\ (P \\ Q')\" and \"(bn(p \\ \\)) \\* \\\"\n and \"(bn(p \\ \\)) \\* (P \\ Q')\"\n by(rule residual_eq)\n \n note `\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>O\\ \\ Q'` `extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\` `distinct A\\<^sub>P`\n moreover from `bn \\ \\* subject \\` `distinct(bn \\)`\n have \"\\C. Prop C (\\ \\ \\\\<^sub>P) Q \\ Q'\" by(rule_tac c_par2) auto\n\n moreover note `A\\<^sub>P \\* P` `A\\<^sub>P \\* Q` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* \\` `A\\<^sub>P \\* Q'` `A\\<^sub>P \\* C`\n `bn \\ \\* Q` `distinct(bn \\)` `bn \\ \\* \\` `bn \\ \\* \\\\<^sub>P` `bn \\ \\* P` `bn \\ \\* subject \\` `bn \\ \\* C`\n ultimately have \"Prop C \\ (P \\ Q) \\ (P \\ Q')\"\n by(rule_tac r_par2)\n with `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* Q` `bn \\ \\* subject \\` `bn \\ \\* C` `bn \\ \\* (bn \\')` S `distinct_perm p` `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* (P \\ Q')`\n have \"Prop C \\ (P \\ Q) (p \\ \\) (p \\ (P \\ Q'))\"\n by(rule_tac r_alpha) auto\n with \\Eq Q'eq `distinct_perm p` show ?case by simp\nnext\n case(c_comm1 \\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q \\ C P'')\n hence \"Prop C \\ (P \\ Q) (\\) (\\\\*xvec\\(P' \\ Q'))\"\n by(rule_tac r_comm1) (assumption | simp)+\n thus ?case using `\\ \\ \\\\*xvec\\(P' \\ Q') = \\ \\ P''`\n by(simp add: residual_inject)\nnext\n case(c_comm2 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q \\ C P'')\n hence \"Prop C \\ (P \\ Q) (\\) (\\\\*xvec\\(P' \\ Q'))\"\n by(rule_tac r_comm2) (assumption | simp)+\n thus ?case using `\\ \\ \\\\*xvec\\(P' \\ Q') = \\ \\ P''`\n by(simp add: residual_inject)\nnext\n case(c_open \\ P M xvec yvec N P' x \\ C P'')\n note `M\\\\*(xvec@x#yvec)\\\\N\\ \\ P' = \\ \\ P''`\n moreover from `xvec \\* \\` `x \\ \\` `yvec \\* \\` have \"(xvec@x#yvec) \\* (bn \\)\"\n by auto\n moreover from `xvec \\* yvec` `x \\ xvec` `x \\ yvec` `distinct xvec` `distinct yvec`\n have \"distinct(xvec@x#yvec)\"\n by(auto simp add: fresh_star_def)\n moreover note `distinct(bn \\)`\n moreover from `xvec \\* M` `x \\ M` `yvec \\* M` have \"(xvec@x#yvec) \\* M\" by auto\n hence \"(xvec@x#yvec) \\* (M\\\\*(xvec@x#yvec)\\\\N\\ \\ P')\" by auto\n moreover from `bn \\ \\* subject \\` have \"bn \\ \\* (\\ \\ P'')\" by simp\n ultimately obtain p where S: \"(set p) \\ (set(xvec@x#yvec)) \\ (set(p \\ (xvec@x#yvec)))\" and \"distinct_perm p\"\n and \\eq: \"\\ = (p \\ M)\\\\*(p \\ (xvec@x#yvec))\\\\(p \\ N)\\\" and P'eq: \"P'' = (p \\ P')\"\n and A: \"(xvec@x#yvec) \\* ((p \\ M)\\\\*(p \\ (xvec@x#yvec))\\\\(p \\ N)\\)\"\n and B: \"(p \\ (xvec@x#yvec)) \\* (M\\\\*(xvec@x#yvec)\\\\N\\)\"\n and C: \"(p \\ (xvec@x#yvec)) \\* P'\"\n by(rule_tac residual_eq) (assumption | simp)+\n \n note `\\ \\ P \\\\<^sub>OM\\\\*(xvec@yvec)\\\\N\\ \\ P'` `x \\ (supp N)`\n\n moreover {\n fix C\n from `xvec \\* M` `yvec \\* M` have \"(xvec@yvec) \\* M\" by simp\n moreover from `distinct xvec` `distinct yvec` `xvec \\* yvec` have \"distinct(xvec@yvec)\"\n by auto\n ultimately have \"Prop C \\ P (M\\\\*(xvec@yvec)\\\\N\\) P'\" by(rule_tac c_open) auto\n }\n\n moreover note `x \\ \\` `x \\ M` `x \\ xvec` `x \\ yvec` `xvec \\* \\` `xvec \\* P` `xvec \\* M`\n `yvec \\* \\` `yvec \\* P` `yvec \\* M` `yvec \\* C` `x \\ C` `xvec \\* C` `distinct xvec` `distinct yvec`\n ultimately have \"Prop C \\ (\\\\x\\P) (M\\\\*(xvec@x#yvec)\\\\N\\) P'\"\n by(rule_tac r_open) \n\n with `xvec \\* \\` `yvec \\* \\` `xvec \\* P` `yvec \\* P` `xvec \\* M` `yvec \\* M` \n `yvec \\* C` S `distinct_perm p` `x \\ C` `xvec \\* C`\n `x \\ \\` `x \\ M` `x \\ xvec` `x \\ yvec` A B C\n have \"Prop C \\ (\\\\x\\P) (p \\ (M\\\\*(xvec@x#yvec)\\\\N\\)) (p \\ P')\"\n by(rule_tac \\=\"M\\\\*(xvec@x#yvec)\\\\N\\\" in r_alpha) (auto simp add: fresh_star_def abs_fresh)\n with \\eq P'eq show ?case by simp\nnext\n case(c_scope \\ P \\ P' x \\' C P'')\n note `\\ \\ (\\\\x\\P') = \\' \\ P''`\n moreover from `bn \\ \\* \\'` have \"bn \\ \\* (bn \\')\" by auto\n moreover note `distinct (bn \\)` `distinct(bn \\')`\n moreover from `bn \\ \\* subject \\` `bn \\' \\* subject \\'`\n have \"bn \\ \\* (\\ \\ \\\\x\\P')\" and \"bn \\' \\* (\\' \\ P'')\" by simp+\n ultimately obtain p where S: \"(set p) \\ (set(bn \\)) \\ (set(bn(p \\ \\)))\" and \"distinct_perm p\"\n and \\Eq: \"\\' = p \\ \\\" and P'eq: \"P'' = p \\ (\\\\x\\P')\" and \"(bn(p \\ \\)) \\* \\\"\n and \"(bn(p \\ \\)) \\* (\\\\x\\P')\"\n by(rule residual_eq)\n \n note `\\ \\ P \\\\<^sub>O\\ \\ P'`\n moreover from `bn \\ \\* subject \\` `distinct(bn \\)`\n have \"\\C. Prop C \\ P \\ P'\" by(rule_tac c_scope) auto\n\n moreover note `x \\ \\` `x \\ \\` `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* subject \\`\n `x \\ C` `bn \\ \\* C` `distinct(bn \\)`\n ultimately have \"Prop C \\ (\\\\x\\P) \\ (\\\\x\\P')\"\n by(rule r_scope) \n with `bn \\ \\* \\` `bn \\ \\* P` `x \\ \\` `bn \\ \\* subject \\` `bn \\ \\* C` `bn \\ \\* (bn \\')` S `distinct_perm p` `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* (\\\\x\\P')`\n have \"Prop C \\ (\\\\x\\P) (p \\ \\) (p \\ (\\\\x\\P'))\"\n by(rule_tac r_alpha) simp+\n with \\Eq P'eq `distinct_perm p` show ?case by simp\nnext\n case(Bang \\ P \\ C P')\n thus ?case by(rule_tac r_bang) auto\nqed\n\nlemma old_output_induct[consumes 1, case_names c_output c_case c_par1 c_par2 c_open c_scope c_bang]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and B :: \"('a, 'b, 'c) bound_output\"\n and Prop :: \"'d::fs_name \\ 'b \\ ('a, 'b, 'c) psi \\\n 'a \\ ('a, 'b, 'c) bound_output \\ bool\"\n and C :: \"'d::fs_name\"\n\n assumes \"\\ \\ P \\\\<^sub>OR_out M B\"\n and r_output: \"\\\\ M K N P C. \\\\ \\ M \\ K\\ \\ Prop C \\ (M\\N\\.P) K (N \\' P)\"\n and r_case: \"\\\\ P M B \\ Cs C. \n \\\\ \\ P \\\\<^sub>O(R_out M B); \\C. Prop C \\ P M B; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\ \n Prop C \\ (Cases Cs) M B\"\n and r_par1: \"\\\\ \\\\<^sub>Q P M xvec N P' A\\<^sub>Q Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\C. Prop C (\\ \\ \\\\<^sub>Q) P M (\\\\*xvec\\N \\' P');\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* M; \n A\\<^sub>Q \\* xvec; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* C; xvec \\* Q;\n xvec \\* \\; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) M (\\\\*xvec\\N \\' (P' \\ Q))\"\n and r_par2: \"\\\\ \\\\<^sub>P Q M xvec N Q' A\\<^sub>P P C.\n \\\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\C. Prop C (\\ \\ \\\\<^sub>P) Q M (\\\\*xvec\\N \\' Q');\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\; A\\<^sub>P \\* M; \n A\\<^sub>P \\* xvec; A\\<^sub>P \\* N; A\\<^sub>P \\* Q'; A\\<^sub>P \\* C; xvec \\* P;\n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* Q; xvec \\* M; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) M (\\\\*xvec\\N \\' (P \\ Q'))\"\n and r_open: \"\\\\ P M xvec yvec N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\\\*(xvec@yvec)\\\\N\\ \\ P'; x \\ supp N; \\C. Prop C \\ P M (\\\\*(xvec@yvec)\\N \\' P');\n x \\ \\; x \\ M; x \\ xvec; x \\ yvec; xvec \\* \\; xvec \\* P; xvec \\* M; \n xvec \\* yvec; yvec \\* \\; yvec \\* P; yvec \\* M; yvec \\* C; x \\ C; xvec \\* C\\ \\\n Prop C \\ (\\\\x\\P) M (\\\\*(xvec@x#yvec)\\N \\' P')\"\n and r_scope: \"\\\\ P M xvec N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; \\C. Prop C \\ P M (\\\\*xvec\\N \\' P');\n x \\ \\; x \\ M; x \\ xvec; x \\ N; xvec \\* \\; xvec \\* P; xvec \\* M;\n x \\ C; xvec \\* C\\ \\\n Prop C \\ (\\\\x\\P) M (\\\\*xvec\\N \\' \\\\x\\P')\"\n and r_bang: \"\\\\ P M B C.\n \\\\ \\ P \\ !P \\\\<^sub>O(R_out M B); guarded P; \\C. Prop C \\ (P \\ !P) M B\\ \\\n Prop C \\ (!P) M B\"\n shows \"Prop C \\ P M B\"\nusing `\\ \\ P \\\\<^sub>O(R_out M B)`\nproof(nominal_induct \\ P Rs==\"(R_out M B)\" avoiding: C arbitrary: B rule: old_semantics.strong_induct)\n case(c_input \\ M K xvec N Tvec P C)\n thus ?case by(simp add: residual_inject)\nnext\n case(Output \\ M K N P C)\n thus ?case by(force simp add: residual_inject intro: r_output)\nnext\n case(Case \\ P \\ Cs C B)\n thus ?case by(force intro: r_case) \nnext\n case(c_par1 \\ \\\\<^sub>Q P \\ P' Q A\\<^sub>Q C)\n thus ?case by(force intro: r_par1 simp add: residual_inject)\nnext\n case(c_par2 \\ \\\\<^sub>P Q \\ Q' P A\\<^sub>P C)\n thus ?case by(force intro: r_par2 simp add: residual_inject)\nnext\n case c_comm1\n thus ?case by(simp add: residual_inject)\nnext\n case c_comm2\n thus ?case by(simp add: residual_inject)\nnext\n case(c_open \\ P M xvec yvec N P' x C B)\n thus ?case by(force intro: r_open simp add: residual_inject)\nnext\n case(c_scope \\ P M \\ P' x C)\n thus ?case by(force intro: r_scope simp add: residual_inject)\nnext\n case(Bang \\ P C)\n thus ?case by(force intro: r_bang)\nqed\n\nlemma old_bound_output_bind_object:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and yvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and y :: name\n\n assumes \"\\ \\ P \\\\<^sub>O\\ \\ P'\"\n and \"bn \\ \\* subject \\\"\n and \"distinct(bn \\)\"\n and \"y \\ set(bn \\)\"\n\n shows \"y \\ supp(object \\)\"\nusing assms\nproof(nominal_induct avoiding: P' arbitrary: y rule: old_semantics_induct)\n case(c_alpha \\ P \\ P' p P'' y)\n from `y \\ set(bn(p \\ \\))` have \"(p \\ y) \\ (p \\ set(bn(p \\ \\)))\"\n by(rule pt_set_bij2[OF pt_name_inst, OF at_name_inst])\n hence \"(p \\ y) \\ set(bn \\)\" using `distinct_perm p`\n by(simp add: eqvts)\n hence \"(p \\ y) \\ supp(object \\)\" by(rule c_alpha)\n hence \"(p \\ p \\ y) \\ (p \\ supp(object \\))\"\n by(rule pt_set_bij2[OF pt_name_inst, OF at_name_inst])\n thus ?case using `distinct_perm p`\n by(simp add: eqvts)\nnext\n case c_input \n thus ?case by(simp add: supp_list_nil)\nnext\n case c_output\n thus ?case by(simp add: supp_list_nil)\nnext\n case c_case\n thus ?case by simp\nnext\n case c_par1\n thus ?case by simp\nnext\n case c_par2\n thus ?case by simp\nnext\n case c_comm1\n thus ?case by(simp add: supp_list_nil)\nnext\n case c_comm2\n thus ?case by(simp add: supp_list_nil)\nnext\n case c_open\n thus ?case by(auto simp add: supp_list_cons supp_list_append supp_atm supp_some)\nnext\n case c_scope\n thus ?case by simp\nnext\n case c_bang\n thus ?case by simp\nqed\n\nlemma old_bound_output_distinct:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and \\ :: \"'a action\"\n and P' :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>O\\ \\ P'\"\n\n shows \"distinct(bn \\)\"\nusing assms\nthm old_semantics.strong_induct\nproof(nominal_induct \\ P x3==\"\\ \\ P'\" avoiding: \\ P' rule: old_semantics.strong_induct)\n case c_input\n thus ?case by(simp add: residual_inject)\nnext\n case Output\n thus ?case by(simp add: residual_inject)\nnext\n case Case\n thus ?case by(simp add: residual_inject)\nnext\n case c_par1\n thus ?case by(force intro: alpha_distinct old_bound_output_bind_object)\nnext\n case c_par2\n thus ?case by(force intro: alpha_distinct old_bound_output_bind_object)\nnext \n case c_comm1\n thus ?case by(simp add: residual_inject)\nnext\n case c_comm2\n thus ?case by(simp add: residual_inject)\nnext\n case(c_open \\ P M xvec yvec N P' x \\ P'')\n note `M\\\\*(xvec@x#yvec)\\\\N\\ \\ P' = \\ \\ P''`\n moreover from `xvec \\* yvec` `x \\ xvec` `x \\ yvec` `distinct xvec` `distinct yvec`\n have \"distinct(bn(M\\\\*(xvec@x#yvec)\\\\N\\))\"\n by auto\n moreover {\n fix y\n from `\\ \\ P \\\\<^sub>OM\\\\*(xvec@yvec)\\\\N\\ \\ P'` `x \\ supp N` `x \\ xvec` `x \\ yvec` `x \\ M` `x \\ \\` `distinct xvec` `distinct yvec` `xvec \\* \\` `xvec \\* P` `xvec \\* M` `xvec \\* yvec` `yvec \\* \\` `yvec \\* P` `yvec \\* M`\n have \"\\ \\ \\\\x\\P \\\\<^sub>OM\\\\*(xvec@x#yvec)\\\\N\\ \\ P'\" by(rule old_semantics.c_open)\n moreover moreover from `xvec \\* M` `x \\ M` `yvec \\* M` \n have \"bn(M\\\\*(xvec@x#yvec)\\\\N\\) \\* (subject(M\\\\*(xvec@x#yvec)\\\\N\\))\"\n by simp\n moreover note `distinct(bn(M\\\\*(xvec@x#yvec)\\\\N\\))`\n moreover assume \"y \\ set(bn(M\\\\*(xvec@x#yvec)\\\\N\\))\"\n\n ultimately have \"y \\ supp(object(M\\\\*(xvec@x#yvec)\\\\N\\))\"\n by(rule_tac old_bound_output_bind_object)\n }\n moreover from `xvec \\* \\` `x \\ \\` `yvec \\* \\`\n have \"bn(M\\\\*(xvec@x#yvec)\\\\N\\) \\* bn \\\" and \"bn(M\\\\*(xvec@x#yvec)\\\\N\\) \\* object \\\" by simp+\n moreover from `xvec \\* P''` `x \\ P''` `yvec \\* P''`\n have \"bn(M\\\\*(xvec@x#yvec)\\\\N\\) \\* P''\" by simp\n ultimately show ?case by(rule alpha_distinct)\nnext\n case c_scope\n thus ?case\n by(rule_tac alpha_distinct, auto) (rule_tac old_bound_output_bind_object, auto)\nnext\n case Bang\n thus ?case by simp\nqed\n\nlemma old_input_distinct:\n fixes \\ :: 'b\n and M :: 'a\n and xvec :: \"name list\"\n and N :: 'a\n and P :: \"('a, 'b, 'c) psi\"\n and Rs :: \"('a, 'b, 'c) residual\"\n\n assumes \"\\ \\ M\\\\*xvec N\\.P \\\\<^sub>O Rs\"\n\n shows \"distinct xvec\"\nusing assms\nby(nominal_induct \\ P==\"M\\\\*xvec N\\.P\" Rs avoiding: xvec N P rule: old_semantics.strong_induct)\n (auto simp add: psi.inject intro: alpha_input_distinct)\n\nlemma output_induct'[consumes 2, case_names c_alpha c_output c_case c_par1 c_par2 c_open c_scope c_bang]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and yvec :: \"name list\"\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and Prop :: \"'d::fs_name \\ 'b \\ ('a, 'b, 'c) psi \\\n 'a \\ name list \\ 'a \\ ('a, 'b, 'c) psi \\ bool\"\n and C :: \"'d::fs_name\"\n\n assumes \"\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'\"\n and \"xvec \\* M\"\n and r_alpha: \"\\\\ P M xvec N P' p C. \\xvec \\* \\; xvec \\* P; xvec \\* M; xvec \\* C; xvec \\* (p \\ xvec); \n set p \\ set xvec \\ set(p \\ xvec); distinct_perm p;\n (p \\ xvec) \\* N; (p \\ xvec) \\* P'; Prop C \\ P M xvec N P'\\ \\\n Prop C \\ P M (p \\ xvec) (p \\ N) (p \\ P')\"\n and r_output: \"\\\\ M K N P C. \\\\ \\ M \\ K\\ \\ Prop C \\ (M\\N\\.P) K ([]) N P\"\n and r_case: \"\\\\ P M xvec N P' \\ Cs C. \\\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; \\C. Prop C \\ P M xvec N P'; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\\n Prop C \\ (Cases Cs) M xvec N P'\"\n and r_par1: \"\\\\ \\\\<^sub>Q P M xvec N P' A\\<^sub>Q Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\C. Prop C (\\ \\ \\\\<^sub>Q) P M xvec N P';\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* M; \n A\\<^sub>Q \\* xvec; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* C; xvec \\* Q;\n xvec \\* \\; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) M xvec N (P' \\ Q)\"\n and r_par2: \"\\\\ \\\\<^sub>P Q M xvec N Q' A\\<^sub>P P C.\n \\\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\C. Prop C (\\ \\ \\\\<^sub>P) Q M xvec N Q';\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\; A\\<^sub>P \\* M; \n A\\<^sub>P \\* xvec; A\\<^sub>P \\* N; A\\<^sub>P \\* Q'; A\\<^sub>P \\* C; xvec \\* Q;\n xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* P; xvec \\* M; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) M xvec N (P \\ Q')\"\n and r_open: \"\\\\ P M xvec yvec N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\\\*(xvec@yvec)\\\\N\\ \\ P'; x \\ supp N; \\C. Prop C \\ P M (xvec@yvec) N P';\n x \\ \\; x \\ M; x \\ xvec; x \\ yvec; xvec \\* \\; xvec \\* P; xvec \\* M; \n yvec \\* \\; yvec \\* P; yvec \\* M; yvec \\* C; x \\ C; xvec \\* C\\ \\ \n Prop C \\ (\\\\x\\P) M (xvec@x#yvec) N P'\"\n and r_scope: \"\\\\ P M xvec N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; \\C. Prop C \\ P M xvec N P';\n x \\ \\; x \\ M; x \\ xvec; x \\ N; xvec \\* \\;\n xvec \\* P; xvec \\* M; x \\ C; xvec \\* C\\ \\\n Prop C \\ (\\\\x\\P) M xvec N (\\\\x\\P')\"\n and r_bang: \"\\\\ P M xvec N P' C.\n \\\\ \\ P \\ !P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; guarded P; \\C. Prop C \\ (P \\ !P) M xvec N P'\\ \\\n Prop C \\ (!P) M xvec N P'\"\n shows \"Prop C \\ P M xvec N P'\"\nproof -\n note `\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'`\n moreover from `xvec \\* M` have \"bn(M\\\\*xvec\\\\N\\) \\* subject(M\\\\*xvec\\\\N\\)\" by simp\n moreover from `\\ \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'` have \"distinct(bn(M\\\\*xvec\\\\N\\))\"\n by(rule old_bound_output_distinct)\n ultimately show ?thesis\n proof(nominal_induct \\ P \\==\"M\\\\*xvec\\\\N\\\" P' avoiding: C arbitrary: M xvec N rule: old_semantics_induct)\n case(c_alpha \\ P \\ P' p C M xvec N)\n from `(p \\ \\) = M\\\\*xvec\\\\N\\` have \"(p \\ p \\ \\) = p \\ (M\\\\*xvec\\\\N\\)\"\n by(simp add: fresh_bij)\n with `distinct_perm p` have A: \"\\ = (p \\ M)\\\\*(p \\ xvec)\\\\(p \\ N)\\\"\n by(simp add: eqvts)\n with `bn \\ \\* \\` `bn \\ \\* P` `bn \\ \\* subject \\ ` `bn \\ \\* C` `bn \\ \\* bn(p \\ \\)` `distinct_perm p`\n have \"(p \\ xvec) \\* \\\" and \"(p \\ xvec) \\* P\" and \"(p \\ xvec) \\* (p \\ M)\" and \"(p \\ xvec) \\* C\" and \"(p \\ xvec) \\* (p \\ p \\ xvec)\"\n by auto\n moreover from A `set p \\ set(bn \\) \\ set(bn(p \\ \\))` `distinct_perm p`\n have S: \"set p \\ set(p \\ xvec) \\ set(p \\ p \\ xvec)\" by simp\n moreover note `distinct_perm p`\n moreover from A `bn(p \\ \\) \\* \\` `bn(p \\ \\) \\* P'`\n have \"(p \\ p \\ xvec) \\* (p \\ N)\" and \"(p \\ p \\ xvec) \\* P'\" by simp+\n moreover from A have \"Prop C \\ P (p \\ M) (p \\ xvec) (p \\ N) P'\"\n by(rule c_alpha)\n ultimately have \"Prop C \\ P (p \\ M) (p \\ p \\ xvec) (p \\ p \\ N) (p \\ P')\"\n by(rule r_alpha)\n moreover from A `bn \\ \\* subject \\` have \"(p \\ xvec) \\* (p \\ M)\" by simp\n hence \"xvec \\* M\" by(simp add: fresh_star_bij)\n from A `bn(p \\ \\) \\* \\` `distinct_perm p` have \"xvec \\* (p \\ M)\" by simp\n hence \"(p \\ xvec) \\* (p \\ p \\ M)\" by(simp add: fresh_star_bij)\n with `distinct_perm p` have \"(p \\ xvec) \\* M\" by simp\n with `xvec \\* M` S `distinct_perm p` have \"(p \\ M) = M\" by simp\n ultimately show ?case using S `distinct_perm p` by simp \n next\n case c_input\n thus ?case by(simp add: residual_inject)\n next\n case c_output\n thus ?case by(force dest: r_output simp add: action.inject)\n next\n case c_case\n thus ?case by(force intro: r_case)\n next\n case c_par1\n thus ?case by(force intro: r_par1)\n next\n case c_par2\n thus ?case by(force intro: r_par2)\n next\n case c_comm1\n thus ?case by(simp add: action.inject)\n next\n case c_comm2\n thus ?case by(simp add: action.inject)\n next\n case c_open\n thus ?case by(auto intro: r_open simp add: action.inject)\n next\n case c_scope\n thus ?case by(auto intro: r_scope)\n next\n case c_bang\n thus ?case by(auto intro: r_bang)\n qed\nqed\n\nlemma old_input_induct[consumes 1, case_names c_input c_case c_par1 c_par2 c_scope c_bang]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and M :: 'a\n and N :: 'a\n and P' :: \"('a, 'b, 'c) psi\"\n and Prop :: \"'d::fs_name \\ 'b \\ ('a, 'b, 'c) psi \\\n 'a \\ 'a \\ ('a, 'b, 'c) psi \\ bool\"\n and C :: \"'d::fs_name\"\n\n assumes Trans: \"\\ \\ P \\\\<^sub>OM\\N\\ \\ P'\"\n and r_input: \"\\\\ M K xvec N Tvec P C.\n \\\\ \\ M \\ K; distinct xvec; set xvec \\ supp N;\n length xvec = length Tvec; xvec \\* \\;\n xvec \\* M; xvec \\* K; xvec \\* C\\ \\\n Prop C \\ (M\\\\*xvec N\\.P)\n K (N[xvec::=Tvec]) (P[xvec::=Tvec])\"\n and r_case: \"\\\\ P M N P' \\ Cs C. \\\\ \\ P \\\\<^sub>OM\\N\\ \\ P'; \\C. Prop C \\ P M N P'; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\\n Prop C \\ (Cases Cs) M N P'\" \n and r_par1: \"\\\\ \\\\<^sub>Q P M N P' A\\<^sub>Q Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\N\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\C. Prop C (\\ \\ \\\\<^sub>Q) P M N P'; distinct A\\<^sub>Q;\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* M; A\\<^sub>Q \\* N;\n A\\<^sub>Q \\* P'; A\\<^sub>Q \\* C\\ \\\n Prop C \\ (P \\ Q) M N (P' \\ Q)\"\n and r_par2: \"\\\\ \\\\<^sub>P Q M N Q' A\\<^sub>P P C.\n \\\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OM\\N\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\C. Prop C (\\ \\ \\\\<^sub>P) Q M N Q'; distinct A\\<^sub>P;\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\; A\\<^sub>P \\* M; A\\<^sub>P \\* N;\n A\\<^sub>P \\* Q'; A\\<^sub>P \\* C\\ \\\n Prop C \\ (P \\ Q) M N (P \\ Q')\"\n and r_scope: \"\\\\ P M N P' x C.\n \\\\ \\ P \\\\<^sub>OM\\N\\ \\ P'; \\C. Prop C \\ P M N P'; x \\ \\; x \\ M; x \\ N; x \\ C\\ \\\n Prop C \\ (\\\\x\\P) M N (\\\\x\\P')\"\n and r_bang: \"\\\\ P M N P' C.\n \\\\ \\ P \\ !P \\\\<^sub>OM\\N\\ \\ P'; guarded P; \\C. Prop C \\ (P \\ !P) M N P'\\ \\ Prop C \\ (!P) M N P'\"\n shows \"Prop C \\ P M N P'\"\nusing Trans\nproof(nominal_induct \\ P Rs==\"M\\N\\ \\ P'\" avoiding: C arbitrary: P' rule: old_semantics.strong_induct)\n case(c_input \\ M K xvec N Tvec P C)\n thus ?case\n by(force intro: r_input simp add: residual_inject action.inject)\nnext\n case(Output \\ M K N P C)\n thus ?case by(simp add: residual_inject)\nnext\n case(Case \\ P \\ CS C P')\n thus ?case by(force intro: r_case)\nnext\n case(c_par1 \\ \\\\<^sub>Q P \\ P' Q A\\<^sub>Q C P'')\n thus ?case by(force intro: r_par1 simp add: residual_inject)\nnext \n case(c_par2 \\ \\P Q \\ Q' xvec P C Q'')\n thus ?case by(force intro: r_par2 simp add: residual_inject)\nnext\n case(c_comm1 \\ \\Q P M N P' xvec \\P Q K zvec Q' yvec C PQ)\n thus ?case by(simp add: residual_inject)\nnext\n case(c_comm2 \\ \\Q P M zvec N P' xvec \\P Q K yvec Q' C PQ)\n thus ?case by(simp add: residual_inject)\nnext\n case(c_open \\ P M xvec N P' x yvec C P'') \n thus ?case by(simp add: residual_inject)\nnext\n case(c_scope \\ P \\ P' x C P'')\n thus ?case by(force intro: r_scope simp add: residual_inject)\nnext\n case(Bang \\ P C P')\n thus ?case by(force intro: r_bang)\nqed\n\nlemma old_tau_induct[consumes 1, case_names c_case c_par1 c_par2 c_comm1 c_comm2 c_scope c_bang]:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rs :: \"('a, 'b, 'c) residual\"\n and Prop :: \"'d::fs_name \\ 'b \\ ('a, 'b, 'c) psi \\\n ('a, 'b, 'c) psi \\ bool\"\n and C :: \"'d::fs_name\"\n\n assumes Trans: \"\\ \\ P \\\\<^sub>O\\ \\ P'\"\n and r_case: \"\\\\ P P' \\ Cs C. \\\\ \\ P \\\\<^sub>O\\ \\ P'; \\C. Prop C \\ P P'; (\\, P) mem Cs; \\ \\ \\; guarded P\\ \\ \n Prop C \\ (Cases Cs) P'\"\n and r_par1: \"\\\\ \\\\<^sub>Q P P' A\\<^sub>Q Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>O\\ \\ P'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\C. Prop C (\\ \\ \\\\<^sub>Q) P P';\n A\\<^sub>Q \\* P; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* \\;\n A\\<^sub>Q \\* P'; A\\<^sub>Q \\* C\\ \\\n Prop C \\ (P \\ Q) (P' \\ Q)\"\n and r_par2: \"\\\\ \\\\<^sub>P Q Q' A\\<^sub>P P C.\n \\\\ \\ \\\\<^sub>P \\ Q \\\\<^sub>O\\ \\ Q'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\C. Prop C (\\ \\ \\\\<^sub>P) Q Q';\n A\\<^sub>P \\* P; A\\<^sub>P \\* Q; A\\<^sub>P \\* \\;\n A\\<^sub>P \\* Q'; A\\<^sub>P \\* C\\ \\\n Prop C \\ (P \\ Q) (P \\ Q')\"\n and r_comm1: \"\\\\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P;\n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OK\\\\*xvec\\\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; \n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; \n A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q';\n A\\<^sub>Q \\* xvec; xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; \n xvec \\* Q; xvec \\* K; A\\<^sub>P \\* C; A\\<^sub>Q \\* C; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) (\\\\*xvec\\(P' \\ Q'))\"\n and r_comm2: \"\\\\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q C.\n \\\\ \\ \\\\<^sub>Q \\ P \\\\<^sub>OM\\\\*xvec\\\\N\\ \\ P'; extract_frame P = \\A\\<^sub>P, \\\\<^sub>P\\; distinct A\\<^sub>P; \n \\ \\ \\\\<^sub>P \\ Q \\\\<^sub>OK\\N\\ \\ Q'; extract_frame Q = \\A\\<^sub>Q, \\\\<^sub>Q\\; distinct A\\<^sub>Q;\n \\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K;\n A\\<^sub>P \\* \\; A\\<^sub>P \\* \\\\<^sub>Q; A\\<^sub>P \\* P; A\\<^sub>P \\* M; A\\<^sub>P \\* N; A\\<^sub>P \\* P'; \n A\\<^sub>P \\* Q; A\\<^sub>P \\* Q'; A\\<^sub>P \\* A\\<^sub>Q; A\\<^sub>P \\* xvec; A\\<^sub>Q \\* \\; A\\<^sub>Q \\* \\\\<^sub>P; \n A\\<^sub>Q \\* P; A\\<^sub>Q \\* N; A\\<^sub>Q \\* P'; A\\<^sub>Q \\* Q; A\\<^sub>Q \\* K; A\\<^sub>Q \\* Q';\n A\\<^sub>Q \\* xvec; xvec \\* \\; xvec \\* \\\\<^sub>P; xvec \\* \\\\<^sub>Q; xvec \\* P; xvec \\* M; \n xvec \\* Q; xvec \\* K; A\\<^sub>P \\* C; A\\<^sub>Q \\* C; xvec \\* C\\ \\\n Prop C \\ (P \\ Q) (\\\\*xvec\\(P' \\ Q'))\"\n and r_scope: \"\\\\ P P' x C.\n \\\\ \\ P \\\\<^sub>O\\ \\ P'; \\C. Prop C \\ P P'; x \\ \\; x \\ C\\ \\\n Prop C \\ (\\\\x\\P) (\\\\x\\P')\"\n and r_bang: \"\\\\ P P' C.\n \\\\ \\ P \\ !P \\\\<^sub>O\\ \\ P'; guarded P; \\C. Prop C \\ (P \\ !P) P'\\ \\ Prop C \\ (!P) P'\"\n shows \"Prop C \\ P P'\"\nusing Trans\nproof(nominal_induct \\ P Rs==\"\\ \\ P'\" avoiding: C arbitrary: P' rule: old_semantics.strong_induct)\n case(c_input M K xvec N Tvec P C)\n thus ?case by(simp add: residual_inject)\nnext\n case(Output \\ M K N P C)\n thus ?case by(simp add: residual_inject)\nnext\n case(Case \\ P \\ Cs C P')\n thus ?case by(force intro: r_case simp add: residual_inject)\nnext\n case(c_par1 \\ \\\\<^sub>Q P \\ P' A\\<^sub>Q Q C P'')\n thus ?case by(force intro: r_par1 simp add: residual_inject)\nnext\n case(c_par2 \\ \\\\<^sub>P Q \\ Q' A\\<^sub>P P C Q'')\n thus ?case by(force intro: r_par2 simp add: residual_inject)\nnext\n case(c_comm1 \\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q C PQ)\n thus ?case by(force intro: r_comm1 simp add: residual_inject)\nnext\n case(c_comm2 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\P Q' A\\<^sub>Q C PQ)\n thus ?case by(force intro: r_comm2 simp add: residual_inject)\nnext\n case(c_open \\ P M xvec N P' x yvec C P'')\n thus ?case by(simp add: residual_inject)\nnext\n case(c_scope \\ P \\ P' x C P'')\n thus ?case by(force intro: r_scope simp add: residual_inject)\nnext\n case(Bang \\ P C P')\n thus ?case by(force intro: r_bang simp add: residual_inject)\nqed\n\nlemma old_semantics_complete:\n assumes \"\\ \\ P \\ \\ @ Rs\"\n shows \"\\ \\ P \\\\<^sub>O Rs\"\n using assms\nproof(nominal_induct rule: semantics.strong_induct)\n case c_input\n thus ?case\n by(rule_tac old_semantics.c_input) (auto intro: chan_eq_sym)\nnext\n case Output\n thus ?case\n by(rule_tac old_semantics.Output)\nnext\n case Case\n thus ?case\n by(rule_tac old_semantics.Case)\nnext\n case c_par1\n thus ?case\n by(rule_tac old_semantics.c_par1)\nnext\n case c_par2\n thus ?case\n by(rule_tac old_semantics.c_par2)\nnext\n case(c_comm1 \\ \\\\<^sub>Q P A\\<^sub>P yvec K M N P' \\\\<^sub>P Q A\\<^sub>Q zvec xvec Q')\n moreover hence \"(\\\\\\\\<^sub>P)\\\\\\<^sub>Q \\ M \\ K\"\n apply(rule_tac output_provenance'')\n unfolding residual_inject\n by(assumption|auto)+\n hence \"\\\\\\\\<^sub>P\\\\\\<^sub>Q \\ M \\ K\"\n by(metis Associativity stat_eq_ent)\n ultimately show ?case\n by(rule_tac old_semantics.c_comm1)\nnext\n case(c_comm2 \\ \\\\<^sub>Q P A\\<^sub>P yvec K M xvec N P' \\\\<^sub>P Q A\\<^sub>Q zvec Q')\n moreover hence \"(\\\\\\\\<^sub>P)\\\\\\<^sub>Q \\ K \\ M\"\n by(rule_tac input_provenance'') (assumption|auto)+\n hence \"\\\\\\\\<^sub>P\\\\\\<^sub>Q \\ M \\ K\"\n by(metis Associativity stat_eq_ent chan_eq_sym)\n ultimately show ?case\n by(rule_tac old_semantics.c_comm2)\nnext\n case c_open\n thus ?case\n by(rule_tac old_semantics.c_open)\nnext\n case c_scope\n thus ?case\n by(rule_tac old_semantics.c_scope)\nnext\n case Bang\n thus ?case\n by(rule_tac old_semantics.Bang)\nqed\n\nlemma old_semantics_input_sound:\n assumes \"\\ \\ P \\\\<^sub>O M\\N\\ \\ P'\" \n shows \"\\ \\. \\ \\ P \\ \\ @ M\\N\\ \\ P'\"\n using assms\nproof(nominal_induct rule: old_input_induct)\n case(c_input \\ M K xvec N Tvec P)\n thus ?case by(metis chan_eq_sym Input)\nnext\n case(c_case \\ P M N P' \\ Cs)\n thus ?case by(metis semantics.Case)\nnext\n case(c_par1 \\ \\\\<^sub>Q P M N P' A\\<^sub>Q Q)\n thus ?case by(auto dest: Par1) \nnext\n case(c_par2 \\ \\\\<^sub>P Q M N Q' A\\<^sub>P P)\n thus ?case by(auto dest: Par2)\nnext\n case c_scope\n thus ?case by(auto dest: Scope)\nnext\n case c_bang\n thus ?case by(auto dest: semantics.Bang)\nqed\n\nlemma old_semantics_output_sound:\n assumes \"\\ \\ P \\\\<^sub>O R_out M B\"\n shows \"\\ \\. \\ \\ P \\ \\ @ R_out M B\"\n using assms\nproof(nominal_induct rule: old_output_induct)\n case(c_output \\ M K N P)\n thus ?case\n by(auto dest!: semantics.Output[where P=P] simp add: residual_inject)\nnext\n case(c_case \\ P M B \\ Cs)\n thus ?case by(metis semantics.Case)\nnext\n case(c_par1 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>Q Q)\n thus ?case using Par1[where \\=\"M\\\\*xvec\\\\N\\\"]\n by(simp add: residual_inject) blast\nnext\n case(c_par2 \\ \\\\<^sub>P Q M xvec N Q' A\\<^sub>P P)\n thus ?case using Par2[where \\=\"M\\\\*xvec\\\\N\\\"]\n by(simp add: residual_inject) blast \nnext\n case(c_open \\ P M xvec yvec N P' x)\n moreover then obtain \\ where \"\\ \\ P \\ Some \\ @ R_out M (\\\\*(xvec @ yvec)\\N \\' P')\"\n apply auto\n by(frule_tac output_provenance) auto\n ultimately show ?case using Open\n by(simp add: residual_inject) blast\nnext\n case(c_scope \\ P M xvec N P' x)\n thus ?case using Scope[where \\=\"M\\\\*xvec\\\\N\\\"]\n by(simp add: residual_inject) blast\nnext\n case c_bang\n thus ?case by(auto dest: semantics.Bang)\nqed\n\nlemma old_semantics_output_sound':\n fixes C::\"'ty :: fs_name\" \n assumes Trans: \"\\ \\ P \\\\<^sub>O M\\\\*xvec\\\\N\\ \\ P'\"\n and \"extract_frame P = \\A\\<^sub>P,\\\\<^sub>P\\\"\n and \"distinct A\\<^sub>P\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* M\"\n and \"A\\<^sub>P \\* P\"\n shows \"\\ zvec K. \\ \\ P \\ Some(\\A\\<^sub>P; zvec, K\\) @ M\\\\*xvec\\\\N\\ \\ P' \\ distinct zvec \\ zvec \\* \\ \\ zvec \\* M \\ zvec \\* P \\ zvec \\* xvec \\ zvec \\* N \\ zvec \\* C \\ A\\<^sub>P \\* zvec \\ \\ \\ \\\\<^sub>P \\ K \\ M\"\nproof -\n from Trans obtain \\ where \"\\ \\ P \\ \\ @ M\\\\*xvec\\\\N\\ \\ P'\"\n unfolding residual_inject\n by(auto dest: old_semantics_output_sound)\n moreover hence \"A\\<^sub>P \\* \\\" using `A\\<^sub>P \\* P`\n by(auto intro: trans_fresh_provenance)\n ultimately show ?thesis using assms\n unfolding residual_inject\n by(frule_tac output_provenance'[where B=\"(\\\\*xvec\\N \\' P')\" and C=\"(C,xvec,P')\"]) force+\nqed\n\nlemma old_semantics_input_sound':\n fixes C::\"'ty :: fs_name\" \n assumes Trans: \"\\ \\ P \\\\<^sub>O M\\N\\ \\ P'\"\n and \"extract_frame P = \\A\\<^sub>P,\\\\<^sub>P\\\"\n and \"distinct A\\<^sub>P\"\n and \"A\\<^sub>P \\* \\\"\n and \"A\\<^sub>P \\* M\"\n and \"A\\<^sub>P \\* P\"\n shows \"\\ zvec K. \\ \\ P \\ Some(\\A\\<^sub>P; zvec, K\\) @ M\\N\\ \\ P' \\ distinct zvec \\ zvec \\* \\ \\ zvec \\* M \\ zvec \\* P \\ zvec \\* N \\ zvec \\* C \\ A\\<^sub>P \\* zvec \\ \\ \\ \\\\<^sub>P \\ M \\ K\"\nproof -\n from Trans obtain \\ where \"\\ \\ P \\ \\ @ M\\N\\ \\ P'\"\n by(auto dest: old_semantics_input_sound)\n moreover hence \"A\\<^sub>P \\* \\\" using `A\\<^sub>P \\* P`\n by(auto intro: trans_fresh_provenance)\n ultimately show ?thesis using assms\n by(frule_tac input_provenance') force+\nqed\n\nlemma old_semantics_tau_sound:\n assumes \"\\ \\ P \\\\<^sub>O \\ \\ P'\" \n shows \"\\ \\ P \\ None @ \\ \\ P'\"\n using assms\nproof(nominal_induct rule: old_tau_induct)\n case c_case\n thus ?case\n by(auto dest: semantics.Case)\nnext\n case c_par1\n thus ?case\n by(auto dest: Par1)\nnext\n case c_par2\n thus ?case\n by(auto dest: Par2)\nnext\n case(c_comm1 \\ \\\\<^sub>Q P M N P' A\\<^sub>P \\\\<^sub>P Q K xvec Q' A\\<^sub>Q)\n then obtain zvec K' where \"\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M\\N\\ \\ P'\" \"distinct zvec\" \"zvec \\* \\\" \"zvec \\* M\" \"zvec \\* P\" \"zvec \\* N\" \"zvec \\* Q\" \"zvec \\* A\\<^sub>Q\" \"zvec \\* \\\\<^sub>Q\" \"zvec \\* \\\\<^sub>P\" \"A\\<^sub>P \\* zvec\" \"zvec \\* K\" \"(\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ M \\ K'\"\n by(auto dest!: old_semantics_input_sound'[where C=\"(Q,A\\<^sub>Q,\\\\<^sub>Q,\\\\<^sub>P,K,\\)\"])\n from c_comm1 obtain yvec M' where \"\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\\\*xvec\\\\N\\ \\ Q'\" \"distinct yvec\" \"yvec \\* \\\" \"yvec \\* M\" \"yvec \\* P\" \"yvec \\* N\" \"yvec \\* Q\" \"A\\<^sub>Q \\* yvec\" \"yvec \\* \\\\<^sub>Q\" \"yvec \\* \\\\<^sub>P\" \"A\\<^sub>P \\* yvec\" \"yvec \\* K\" \"yvec \\* zvec\" \"yvec \\* xvec\" \"yvec \\* K'\" \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ M' \\ K\"\n by(auto dest!: old_semantics_output_sound'[where C=\"(P,A\\<^sub>P,\\\\<^sub>Q,\\\\<^sub>P,K,M,\\,zvec,K')\"])\n hence \"\\ \\ \\\\<^sub>Q \\ \\\\<^sub>P \\ M' \\ K'\" using `\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K` `(\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ M \\ K'`\n by (metis Assertion_stat_eq_sym Assertion_stat_imp_def Associativity associativity_sym chan_eq_sym chan_eq_trans stat_eq_ent)\n hence \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M' \\ K'\"\n by(metis Commutativity composition_sym stat_eq_ent)\n have \"A\\<^sub>P \\* M'\" using `A\\<^sub>P \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\\\*xvec\\\\N\\ \\ Q'`\n `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>P \\* yvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"zvec \\* M'\" using `zvec \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\\\*xvec\\\\N\\ \\ Q'`\n `zvec \\* A\\<^sub>Q` `yvec \\* zvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"xvec \\* M'\" using `xvec \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\\\*xvec\\\\N\\ \\ Q'`\n `A\\<^sub>Q \\* xvec` `yvec \\* xvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'') \n have \"A\\<^sub>Q \\* K'\" using `A\\<^sub>Q \\* P` `\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M\\N\\ \\ P'`\n `A\\<^sub>P \\* A\\<^sub>Q` `zvec \\* A\\<^sub>Q`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"A\\<^sub>Q \\* A\\<^sub>P\" using `A\\<^sub>P \\* A\\<^sub>Q` by simp\n have \"yvec \\* A\\<^sub>P\" using `A\\<^sub>P \\* yvec` by simp\n have \"\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M'\\N\\ \\ P'\"\n by(rule_tac comm2_aux) (fact|rule Frame_stat_imp_refl)+\n have \"\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K'\\\\*xvec\\\\N\\ \\ Q'\"\n by(rule_tac comm1_aux[where A\\<^sub>P=\"A\\<^sub>P\"]) (fact|rule Frame_stat_imp_refl)+\n show ?case\n by(rule_tac Comm1[where M=M' and K=K']) fact+\nnext\n case(c_comm2 \\ \\\\<^sub>Q P M xvec N P' A\\<^sub>P \\\\<^sub>P Q K Q' A\\<^sub>Q)\n then obtain zvec K' where \"\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M\\\\*xvec\\\\N\\ \\ P'\" \"distinct zvec\" \"zvec \\* \\\" \"zvec \\* M\" \"zvec \\* P\" \"zvec \\* N\" \"zvec \\* Q\" \"zvec \\* A\\<^sub>Q\" \"zvec \\* \\\\<^sub>Q\" \"zvec \\* \\\\<^sub>P\" \"A\\<^sub>P \\* zvec\" \"zvec \\* K\" \"zvec \\* xvec\" \"(\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ K' \\ M\"\n by(auto dest!: old_semantics_output_sound'[where C=\"(Q,A\\<^sub>Q,\\\\<^sub>Q,\\\\<^sub>P,K,\\)\"])\n from c_comm2 obtain yvec M' where \"\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\N\\ \\ Q'\" \"distinct yvec\" \"yvec \\* \\\" \"yvec \\* M\" \"yvec \\* P\" \"yvec \\* N\" \"yvec \\* Q\" \"A\\<^sub>Q \\* yvec\" \"yvec \\* \\\\<^sub>Q\" \"yvec \\* \\\\<^sub>P\" \"A\\<^sub>P \\* yvec\" \"yvec \\* K\" \"yvec \\* zvec\" \"yvec \\* xvec\" \"yvec \\* K'\" \"(\\ \\ \\\\<^sub>P) \\ \\\\<^sub>Q \\ K \\ M'\"\n by(auto dest!: old_semantics_input_sound'[where C=\"(P,A\\<^sub>P,\\\\<^sub>Q,\\\\<^sub>P,K,M,\\,zvec,K',xvec)\"])\n hence \"\\ \\ \\\\<^sub>Q \\ \\\\<^sub>P \\ K' \\ M'\" using `\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ M \\ K` `(\\ \\ \\\\<^sub>Q) \\ \\\\<^sub>P \\ K' \\ M`\n by (metis Assertion_stat_eq_sym Assertion_stat_imp_def Associativity associativity_sym chan_eq_sym chan_eq_trans stat_eq_ent)\n hence \"\\ \\ \\\\<^sub>P \\ \\\\<^sub>Q \\ K' \\ M'\"\n by(metis Commutativity composition_sym stat_eq_ent)\n have \"A\\<^sub>P \\* M'\" using `A\\<^sub>P \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\N\\ \\ Q'`\n `A\\<^sub>P \\* A\\<^sub>Q` `A\\<^sub>P \\* yvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"zvec \\* M'\" using `zvec \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\N\\ \\ Q'`\n `zvec \\* A\\<^sub>Q` `yvec \\* zvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"xvec \\* M'\" using `xvec \\* Q` `\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K\\N\\ \\ Q'`\n `A\\<^sub>Q \\* xvec` `yvec \\* xvec`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'') \n have \"A\\<^sub>Q \\* K'\" using `A\\<^sub>Q \\* P` `\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M\\\\*xvec\\\\N\\ \\ P'`\n `A\\<^sub>P \\* A\\<^sub>Q` `zvec \\* A\\<^sub>Q`\n by(auto dest!: trans_fresh_provenance simp add: frame_chain_fresh_chain'')\n have \"A\\<^sub>Q \\* A\\<^sub>P\" using `A\\<^sub>P \\* A\\<^sub>Q` by simp\n have \"yvec \\* A\\<^sub>P\" using `A\\<^sub>P \\* yvec` by simp\n have \"\\ \\ \\\\<^sub>Q \\ P \\ Some(\\A\\<^sub>P; zvec, K'\\) @ M'\\\\*xvec\\\\N\\ \\ P'\"\n by(rule_tac comm1_aux) (fact|rule Frame_stat_imp_refl)+\n have \"\\ \\ \\\\<^sub>P \\ Q \\ Some(\\A\\<^sub>Q; yvec, M'\\) @ K'\\N\\ \\ Q'\"\n by(rule_tac comm2_aux[where A\\<^sub>P=\"A\\<^sub>P\"]) (fact|rule Frame_stat_imp_refl)+\n show ?case\n by(rule_tac Comm2[where M=M' and K=K']) fact+\nnext\n case c_scope\n thus ?case\n by(auto dest: Scope)\nnext\n case c_bang\n thus ?case\n by(auto dest: semantics.Bang)\nqed\n\nlemma old_semantics_sound:\n assumes \"\\ \\ P \\\\<^sub>O Rs\" \n shows \"\\ \\. \\ \\ P \\ \\ @ Rs\"\n using assms\n by(nominal_induct rule: residual.strong_induct) (metis old_semantics_tau_sound old_semantics_output_sound old_semantics_input_sound residual_inject)+\n\nend\n\nend", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Old_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.34864512856608554, "lm_q1q2_score": 0.18791387427162048}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_on_inv__1.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_on_inv__1 imports n_mutualEx_base\nbegin\nsection{*All lemmas on causal relation between inv__1 and some rule r*}\nlemma n_TryVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv1)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__1 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_on_inv__1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.18760598715718946}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__15.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__15 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__15 and some rule r*}\nlemma n_SendInvAckVsinv__15:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__15 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__15:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__15 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__15:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__15 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__15:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__15 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__15:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__15:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__15.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.1876059727494972}} {"text": "section \\HRB Slicing guarantees IFC Noninterference\\\n\ntheory NonInterferenceInter \n imports \"HRB-Slicing.FundamentalProperty\"\nbegin\n\nsubsection \\Assumptions of this Approach\\\n\ntext \\\nClassical IFC noninterference, a special case of a noninterference\ndefinition using partial equivalence relations (per)\n\\cite{SabelfeldS:01}, partitions the variables (i.e.\\ locations) into\nsecurity levels. Usually, only levels for secret or high, written\n\\H\\, and public or low, written \\L\\, variables are\nused. Basically, a program that is noninterferent has to fulfil one\nbasic property: executing the program in two different initial states\nthat may differ in the values of their \\H\\-variables yields two\nfinal states that again only differ in the values of their \n\\H\\-variables; thus the values of the \\H\\-variables did not\ninfluence those of the \\L\\-variables.\n\nEvery per-based approach makes certain\nassumptions: (i) all \\mbox{\\H\\-variables} are defined at the\nbeginning of the program, (ii) all \\L\\-variables are observed (or\nused in our terms) at the end and (iii) every variable is either\n\\H\\ or \\L\\. This security label is fixed for a variable\nand can not be altered during a program run. Thus, we have to extend \nthe prerequisites of the slicing framework in \\cite{Wasserrab:09} accordingly\nin a new locale:\n\n\\\n\nlocale NonInterferenceInterGraph =\n SDG sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") \n and Def :: \"'node \\ 'var set\" and Use :: \"'node \\ 'var set\"\n and ParamDefs :: \"'node \\ 'var list\" and ParamUses :: \"'node \\ 'var set list\" +\n fixes H :: \"'var set\"\n fixes L :: \"'var set\"\n fixes High :: \"'node\" (\"'('_High'_')\")\n fixes Low :: \"'node\" (\"'('_Low'_')\")\n assumes Entry_edge_Exit_or_High:\n \"\\valid_edge a; sourcenode a = (_Entry_)\\ \n \\ targetnode a = (_Exit_) \\ targetnode a = (_High_)\"\n and High_target_Entry_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Entry_) \\ targetnode a = (_High_) \\\n kind a = (\\s. True)\\<^sub>\\\"\n and Entry_predecessor_of_High:\n \"\\valid_edge a; targetnode a = (_High_)\\ \\ sourcenode a = (_Entry_)\"\n and Exit_edge_Entry_or_Low: \"\\valid_edge a; targetnode a = (_Exit_)\\ \n \\ sourcenode a = (_Entry_) \\ sourcenode a = (_Low_)\"\n and Low_source_Exit_edge:\n \"\\a. valid_edge a \\ sourcenode a = (_Low_) \\ targetnode a = (_Exit_) \\ \n kind a = (\\s. True)\\<^sub>\\\"\n and Exit_successor_of_Low:\n \"\\valid_edge a; sourcenode a = (_Low_)\\ \\ targetnode a = (_Exit_)\"\n and DefHigh: \"Def (_High_) = H\" \n and UseHigh: \"Use (_High_) = H\"\n and UseLow: \"Use (_Low_) = L\"\n and HighLowDistinct: \"H \\ L = {}\"\n and HighLowUNIV: \"H \\ L = UNIV\"\n\nbegin\n\nlemma Low_neq_Exit: assumes \"L \\ {}\" shows \"(_Low_) \\ (_Exit_)\"\nproof\n assume \"(_Low_) = (_Exit_)\"\n have \"Use (_Exit_) = {}\" by fastforce\n with UseLow \\L \\ {}\\ \\(_Low_) = (_Exit_)\\ show False by simp\nqed\n\n\nlemma valid_node_High [simp]:\"valid_node (_High_)\"\n using High_target_Entry_edge by fastforce\n\nlemma valid_node_Low [simp]:\"valid_node (_Low_)\"\n using Low_source_Exit_edge by fastforce\n\n\nlemma get_proc_Low:\n \"get_proc (_Low_) = Main\"\nproof -\n from Low_source_Exit_edge obtain a where \"valid_edge a\"\n and \"sourcenode a = (_Low_)\" and \"targetnode a = (_Exit_)\"\n and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n with \\sourcenode a = (_Low_)\\ \\targetnode a = (_Exit_)\\ get_proc_Exit\n show ?thesis by simp\nqed\n\nlemma get_proc_High:\n \"get_proc (_High_) = Main\"\nproof -\n from High_target_Entry_edge obtain a where \"valid_edge a\"\n and \"sourcenode a = (_Entry_)\" and \"targetnode a = (_High_)\"\n and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n with \\sourcenode a = (_Entry_)\\ \\targetnode a = (_High_)\\ get_proc_Entry\n show ?thesis by simp\nqed\n\n\n\nlemma Entry_path_High_path:\n assumes \"(_Entry_) -as\\* n\" and \"inner_node n\"\n obtains a' as' where \"as = a'#as'\" and \"(_High_) -as'\\* n\" \n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from \\(_Entry_) -as\\* n\\ \\inner_node n\\\n show \"\\a' as'. as = a'#as' \\ (_High_) -as'\\* n \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct n'\\\"(_Entry_)\" as n rule:path.induct)\n case (Cons_path n'' as n' a)\n from \\n'' -as\\* n'\\ \\inner_node n'\\ have \"n'' \\ (_Exit_)\" \n by(fastforce simp:inner_node_def)\n with \\valid_edge a\\ \\sourcenode a = (_Entry_)\\ \\targetnode a = n''\\\n have \"n'' = (_High_)\" by -(drule Entry_edge_Exit_or_High,auto)\n from High_target_Entry_edge\n obtain a' where \"valid_edge a'\" and \"sourcenode a' = (_Entry_)\"\n and \"targetnode a' = (_High_)\" and \"kind a' = (\\s. True)\\<^sub>\\\"\n by blast\n with \\valid_edge a\\ \\sourcenode a = (_Entry_)\\ \\targetnode a = n''\\\n \\n'' = (_High_)\\\n have \"a = a'\" by(auto dest:edge_det)\n with \\n'' -as\\* n'\\ \\n'' = (_High_)\\ \\kind a' = (\\s. True)\\<^sub>\\\\ show ?case by blast\n qed fastforce\nqed\n\n\nlemma Exit_path_Low_path:\n assumes \"n -as\\* (_Exit_)\" and \"inner_node n\"\n obtains a' as' where \"as = as'@[a']\" and \"n -as'\\* (_Low_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\"\nproof(atomize_elim)\n from \\n -as\\* (_Exit_)\\\n show \"\\as' a'. as = as'@[a'] \\ n -as'\\* (_Low_) \\ kind a' = (\\s. True)\\<^sub>\\\"\n proof(induct as rule:rev_induct)\n case Nil\n with \\inner_node n\\ show ?case by fastforce\n next\n case (snoc a' as')\n from \\n -as'@[a']\\* (_Exit_)\\\n have \"n -as'\\* sourcenode a'\" and \"valid_edge a'\" and \"targetnode a' = (_Exit_)\"\n by(auto elim:path_split_snoc)\n { assume \"sourcenode a' = (_Entry_)\"\n with \\n -as'\\* sourcenode a'\\ have \"n = (_Entry_)\"\n by(blast intro!:path_Entry_target)\n with \\inner_node n\\ have False by(simp add:inner_node_def) }\n with \\valid_edge a'\\ \\targetnode a' = (_Exit_)\\ have \"sourcenode a' = (_Low_)\"\n by(blast dest!:Exit_edge_Entry_or_Low)\n from Low_source_Exit_edge\n obtain ax where \"valid_edge ax\" and \"sourcenode ax = (_Low_)\"\n and \"targetnode ax = (_Exit_)\" and \"kind ax = (\\s. True)\\<^sub>\\\"\n by blast\n with \\valid_edge a'\\ \\targetnode a' = (_Exit_)\\ \\sourcenode a' = (_Low_)\\\n have \"a' = ax\" by(fastforce intro:edge_det)\n with \\n -as'\\* sourcenode a'\\ \\sourcenode a' = (_Low_)\\ \\kind ax = (\\s. True)\\<^sub>\\\\\n show ?case by blast\n qed\nqed\n\n\nlemma not_Low_High: \"V \\ L \\ V \\ H\"\n using HighLowUNIV\n by fastforce\n\nlemma not_High_Low: \"V \\ H \\ V \\ L\"\n using HighLowUNIV\n by fastforce\n\n\nsubsection \\Low Equivalence\\\n\ntext \\\nIn classical noninterference, an external observer can only see public values,\nin our case the \\L\\-variables. If two states agree in the values of all \n\\L\\-variables, these states are indistinguishable for him. \n\\emph{Low equivalence} groups those states in an equivalence class using \nthe relation \\\\\\<^sub>L\\:\n\\\n\ndefinition lowEquivalence :: \"('var \\ 'val) list \\ ('var \\ 'val) list \\ bool\" \n(infixl \"\\\\<^sub>L\" 50)\n where \"s \\\\<^sub>L s' \\ \\V \\ L. hd s V = hd s' V\"\n\ntext \\The following lemmas connect low equivalent states with\nrelevant variables as necessary in the correctness proof for slicing.\\\n\nlemma relevant_vars_Entry:\n assumes \"V \\ rv S (CFG_node (_Entry_))\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n shows \"V \\ L\"\nproof -\n from \\V \\ rv S (CFG_node (_Entry_))\\ obtain as n' \n where \"(_Entry_) -as\\\\<^sub>\\* parent_node n'\" \n and \"n' \\ HRB_slice S\" and \"V \\ Use\\<^bsub>SDG\\<^esub> n'\"\n and \"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n from \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ have \"valid_node (parent_node n')\"\n by(fastforce intro:path_valid_node simp:intra_path_def)\n thus ?thesis\n proof(cases \"parent_node n'\" rule:valid_node_cases)\n case Entry\n with \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\ have False\n by -(drule SDG_Use_parent_Use,simp add:Entry_empty)\n thus ?thesis by simp\n next\n case Exit\n with \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\ have False\n by -(drule SDG_Use_parent_Use,simp add:Exit_empty)\n thus ?thesis by simp\n next\n case inner\n with \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ obtain a' as' where \"as = a'#as'\"\n and \"(_High_) -as'\\\\<^sub>\\* parent_node n'\"\n by(fastforce elim:Entry_path_High_path simp:intra_path_def)\n from \\(_Entry_) -as\\\\<^sub>\\* parent_node n'\\ \\as = a'#as'\\\n have \"sourcenode a' = (_Entry_)\" by(fastforce elim:path.cases simp:intra_path_def)\n show ?thesis\n proof(cases \"as' = []\")\n case True\n with \\(_High_) -as'\\\\<^sub>\\* parent_node n'\\ have \"parent_node n' = (_High_)\"\n by(fastforce simp:intra_path_def)\n with \\n' \\ HRB_slice S\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have False \n by(fastforce dest:valid_SDG_node_in_slice_parent_node_in_slice \n simp:SDG_to_CFG_set_def)\n thus ?thesis by simp\n next\n case False\n with \\(_High_) -as'\\\\<^sub>\\* parent_node n'\\ have \"hd (sourcenodes as') = (_High_)\"\n by(fastforce intro:path_sourcenode simp:intra_path_def)\n from False have \"hd (sourcenodes as') \\ set (sourcenodes as')\"\n by(fastforce intro:hd_in_set simp:sourcenodes_def)\n with \\as = a'#as'\\ have \"hd (sourcenodes as') \\ set (sourcenodes as)\"\n by(simp add:sourcenodes_def)\n from \\hd (sourcenodes as') = (_High_)\\\n have \"valid_node (hd (sourcenodes as'))\" by simp\n have \"valid_SDG_node (CFG_node (_High_))\" by simp\n with \\hd (sourcenodes as') = (_High_)\\\n \\hd (sourcenodes as') \\ set (sourcenodes as)\\\n \\\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\\\n have \"V \\ Def (_High_)\"\n by(fastforce dest:CFG_Def_SDG_Def[OF \\valid_node (hd (sourcenodes as'))\\])\n hence \"V \\ H\" by(simp add:DefHigh)\n thus ?thesis by(rule not_High_Low)\n qed\n qed\nqed\n\n\n\nlemma lowEquivalence_relevant_nodes_Entry:\n assumes \"s \\\\<^sub>L s'\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n shows \"\\V \\ rv S (CFG_node (_Entry_)). hd s V = hd s' V\"\nproof\n fix V assume \"V \\ rv S (CFG_node (_Entry_))\"\n with \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ have \"V \\ L\" by -(rule relevant_vars_Entry)\n with \\s \\\\<^sub>L s'\\ show \"hd s V = hd s' V\" by(simp add:lowEquivalence_def)\nqed\n\n\nsubsection \\The Correctness Proofs\\\n\ntext \\\nIn the following, we present two correctness proofs that slicing\nguarantees IFC noninterference. In both theorems, \\CFG_node\n(_High_) \\ HRB_slice S\\, where \\CFG_node (_Low_) \\ S\\, makes\nsure that no high variable (which are all defined in \\(_High_)\\)\ncan influence a low variable (which are all used in \\(_Low_)\\).\n\n\nFirst, a theorem regarding \\(_Entry_) -as\\* (_Exit_)\\ paths in the \ncontrol flow graph (CFG), which agree to a complete program execution:\\\n\n\nlemma slpa_rv_Low_Use_Low:\n assumes \"CFG_node (_Low_) \\ S\"\n shows \"\\same_level_path_aux cs as; upd_cs cs as = []; same_level_path_aux cs as';\n \\c \\ set cs. valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\i < length cs. \\V \\ rv S (CFG_node (sourcenode (cs!i))). \n fst (s!Suc i) V = fst (s'!Suc i) V; \\i < Suc (length cs). snd (s!i) = snd (s'!i);\n \\V \\ rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs); length s' = Suc (length cs)\\\n \\ \\V \\ Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\"\nproof(induct arbitrary:m as' s s' rule:slpa_induct)\n case (slpa_empty cs)\n from \\m -[]\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n from \\m -[]\\* (_Low_)\\ have \"valid_node m\"\n by(rule path_valid_node)+\n { fix V assume \"V \\ Use (_Low_)\"\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ have \"(_Low_) -[]\\\\<^sub>\\* (_Low_)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ \\CFG_node (_Low_) \\ S\\\n have \"CFG_node (_Low_) \\ HRB_slice S\"\n by(fastforce intro:HRB_slice_refl)\n ultimately have \"V \\ rv S (CFG_node m)\" \n using \\m = (_Low_)\\\n by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n hence \"\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\" by simp\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n from \\m -as'\\* (_Low_)\\ \\m = (_Low_)\\ have \"as' = []\"\n proof(induct m as' m'\\\"(_Low_)\" rule:path.induct)\n case (Cons_path m'' as a m)\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\\n have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n with \\targetnode a = m''\\ \\m'' -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?case by simp\n qed simp\n with \\\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\\\n \\\\V \\ rv S (CFG_node m). state_val s V = state_val s' V\\ Nil\n show ?thesis by(auto simp:slice_kinds_def)\n qed\nnext\n case (slpa_intra cs a as)\n note IH = \\\\m as' s s'. \\upd_cs cs as = []; same_level_path_aux cs as'; \n \\a\\set cs. valid_edge a; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V; \n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs); length s' = Suc (length cs)\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\\\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\preds (slice_kinds S (a # as)) s\\\n obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \n obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n by(cases s')(auto simp:slice_kinds_def)\n have \"intra_kind (kind ax)\"\n proof(cases \"kind ax\" rule:edge_kind_cases)\n case (Call Q r p fs)\n have False\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\intra_kind (kind a)\\ have \"slice_kind S a = kind a\"\n by -(rule slice_intra_kind_in_slice)\n from \\valid_edge ax\\ \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have unique:\"\\!a'. valid_edge a' \\ sourcenode a' = sourcenode ax \\ \n intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n from \\valid_edge ax\\ \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain x \n where \"x \\ get_return_edges ax\" by(fastforce dest:get_return_edge_call)\n with \\valid_edge ax\\ obtain a' where \"valid_edge a'\" \n and \"sourcenode a' = sourcenode ax\" and \"kind a' = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n with \\valid_edge a\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n \\intra_kind (kind a)\\ unique\n have \"a' = a\" by(fastforce simp:intra_kind_def)\n with \\kind a' = (\\cf. False)\\<^sub>\\\\ \\slice_kind S a = kind a\\\n \\preds (slice_kinds S (a#as)) s\\\n have False by(cases s)(auto simp:slice_kinds_def)\n thus ?thesis by simp\n next\n case False\n with \\kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"slice_kind S ax = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce intro:slice_kind_Call)\n with \\as' = ax # asx\\ \\preds (slice_kinds S as') s'\\\n have False by(cases s')(auto simp:slice_kinds_def)\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n next\n case (Return Q p f)\n from \\valid_edge ax\\ \\kind ax = Q\\\\<^bsub>p\\<^esub>f\\ \\valid_edge a\\ \\intra_kind (kind a)\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have False by -(drule return_edges_only,auto simp:intra_kind_def)\n thus ?thesis by simp\n qed simp\n with \\same_level_path_aux cs as'\\ \\as' = ax#asx\\\n have \"same_level_path_aux cs asx\" by(fastforce simp:intra_kind_def)\n show ?thesis\n proof(cases \"targetnode a = targetnode ax\")\n case True\n with \\valid_edge a\\ \\valid_edge ax\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"a = ax\" by(fastforce intro:edge_det)\n with \\valid_edge a\\ \\intra_kind (kind a)\\ \\sourcenode a = m\\\n \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\preds (slice_kinds S (a # as)) s\\\n \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\\n have rv:\"\\V\\rv S (CFG_node (targetnode a)). \n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\"\n by -(rule rv_edge_slice_kinds,auto)\n from \\upd_cs cs (a # as) = []\\ \\intra_kind (kind a)\\\n have \"upd_cs cs as = []\" by(fastforce simp:intra_kind_def)\n from \\targetnode ax -asx\\* (_Low_)\\ \\a = ax\\\n have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n obtain cfx \n where cfx:\"transfer (slice_kind S a) s = cfx#cfs \\ snd cfx = snd cf\"\n apply(cases cf)\n apply(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\") apply auto\n apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n apply(auto simp:intra_kind_def)\n apply(drule slice_kind_Upd) apply auto \n by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n obtain cfx' \n where cfx':\"transfer (slice_kind S a) s' = cfx'#cfs' \\ snd cfx' = snd cf'\"\n apply(cases cf')\n apply(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\") apply auto\n apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n apply(auto simp:intra_kind_def)\n apply(drule slice_kind_Upd) apply auto \n by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n with cfx \\\\i < Suc (length cs). snd (s!i) = snd (s'!i)\\\n have snds:\"\\iiV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (transfer (slice_kind S a) s ! Suc i) V =\n fst (transfer (slice_kind S a) s' ! Suc i) V\"\n by fastforce\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \\a = ax\\\n have \"preds (slice_kinds S asx) (transfer (slice_kind S a) s')\" \n by(simp add:slice_kinds_def)\n moreover\n from \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"length (transfer (slice_kind S a) s) = length s\"\n by(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n with \\length s = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s) = Suc (length cs)\"\n by simp\n moreover\n from \\a = ax\\ \\valid_edge a\\ \\intra_kind (kind a)\\\n have \"length (transfer (slice_kind S a) s') = length s'\"\n by(cases \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n with \\length s' = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s') = Suc (length cs)\"\n by simp\n moreover\n from IH[OF \\upd_cs cs as = []\\ \\same_level_path_aux cs asx\\ \n \\\\c\\set cs. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv calculation]\n \\as' = ax # asx\\ \\a = ax\\\n show ?thesis by(simp add:slice_kinds_def)\n next\n case False\n from \\\\i < Suc(length cs). snd (s!i) = snd (s'!i)\\\n have \"snd (hd s) = snd (hd s')\" by(erule_tac x=\"0\" in allE) fastforce\n with \\valid_edge a\\ \\valid_edge ax\\ \\sourcenode a = m\\\n \\sourcenode ax = m\\ \\as' = ax # asx\\ False\n \\intra_kind (kind a)\\ \\intra_kind (kind ax)\\\n \\preds (slice_kinds S (a # as)) s\\\n \\preds (slice_kinds S as') s'\\\n \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\length s = Suc (length cs)\\ \\length s' = Suc (length cs)\\\n have False by(fastforce intro!:rv_branching_edges_slice_kinds_False[of a ax])\n thus ?thesis by simp\n qed\n qed\n qed\nnext\n case (slpa_Call cs a as Q r p fs)\n note IH = \\\\m as' s s'. \n \\upd_cs (a # cs) as = []; same_level_path_aux (a # cs) as';\n \\c\\set (a # cs). valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode ((a # cs) ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V;\n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length (a # cs)); length s' = Suc (length (a # cs))\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\\\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\\\c\\set cs. valid_edge c\\ \\valid_edge a\\\n have \"\\c\\set (a # cs). valid_edge c\" by simp\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\preds (slice_kinds S (a # as)) s\\\n obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n from \\preds (slice_kinds S as') s'\\ \\as' = ax # asx\\ \n obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n by(cases s')(auto simp:slice_kinds_def)\n have \"\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\"\n proof(cases \"kind ax\" rule:edge_kind_cases)\n case Intra\n have False\n proof(cases \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n with \\intra_kind (kind ax)\\ \n have \"slice_kind S ax = kind ax\"\n by -(rule slice_intra_kind_in_slice)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have unique:\"\\!a'. valid_edge a' \\ sourcenode a' = sourcenode a \\ \n intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain x \n where \"x \\ get_return_edges a\" by(fastforce dest:get_return_edge_call)\n with \\valid_edge a\\ obtain a' where \"valid_edge a'\" \n and \"sourcenode a' = sourcenode a\" and \"kind a' = (\\cf. False)\\<^sub>\\\"\n by(fastforce dest:call_return_node_edge)\n with \\valid_edge ax\\ \\sourcenode ax = m\\ \\sourcenode a = m\\\n \\intra_kind (kind ax)\\ unique\n have \"a' = ax\" by(fastforce simp:intra_kind_def)\n with \\kind a' = (\\cf. False)\\<^sub>\\\\ \n \\slice_kind S ax = kind ax\\ \\as' = ax # asx\\\n \\preds (slice_kinds S as') s'\\\n have False by(simp add:slice_kinds_def)\n thus ?thesis by simp\n next\n case False\n with \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode ax = m\\ \\sourcenode a = m\\\n have \"slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce intro:slice_kind_Call)\n with \\preds (slice_kinds S (a # as)) s\\\n have False by(simp add:slice_kinds_def)\n thus ?thesis by simp\n qed\n thus ?thesis by simp\n next\n case (Return Q' p' f')\n from \\valid_edge ax\\ \\kind ax = Q'\\\\<^bsub>p'\\<^esub>f'\\ \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have False by -(drule return_edges_only,auto)\n thus ?thesis by simp\n qed simp\n have \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n proof(rule ccontr)\n assume \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n from this \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"slice_kind S a = (\\cf. False):r\\\\<^bsub>p\\<^esub>fs\"\n by(rule slice_kind_Call)\n with \\preds (slice_kinds S (a # as)) s\\\n show False by(simp add:slice_kinds_def)\n qed\n with \\preds (slice_kinds S (a # as)) s\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"pred (kind a) s\" \n by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"sourcenode ax \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\" by simp\n with \\as' = ax # asx\\ \\preds (slice_kinds S as') s'\\ \n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"pred (kind ax) s'\"\n by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n { fix V assume \"V \\ Use (sourcenode a)\"\n from \\valid_edge a\\ have \"sourcenode a -[]\\\\<^sub>\\* sourcenode a\"\n by(fastforce intro:empty_path simp:intra_path_def)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\valid_edge a\\ \\V \\ Use (sourcenode a)\\\n have \"V \\ rv S (CFG_node (sourcenode a))\"\n by(auto intro!:rvI CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def) }\n with \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\sourcenode a = m\\\n have Use:\"\\V \\ Use (sourcenode a). state_val s V = state_val s' V\" by simp\n from \\\\i\n have \"snd (hd s) = snd (hd s')\" by fastforce\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\valid_edge ax\\\n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\sourcenode a = m\\ \\sourcenode ax = m\\\n \\pred (kind a) s\\ \\pred (kind ax) s'\\ Use \\length s = Suc (length cs)\\\n \\length s' = Suc (length cs)\\\n have [simp]:\"ax = a\" by(fastforce intro!:CFG_equal_Use_equal_call)\n from \\same_level_path_aux cs as'\\ \\as' = ax#asx\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n \\\\Q r p fs. kind ax = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"same_level_path_aux (a # cs) asx\" by simp\n from \\targetnode ax -asx\\* (_Low_)\\ have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\upd_cs cs (a # as) = []\\ \n have \"upd_cs (a # cs) as = []\" by simp\n from \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have slice_kind:\"slice_kind S a = \n Q:r\\\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n by(rule slice_kind_Call_in_slice)\n from \\\\i slice_kind\n have snds:\"\\ivalid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ obtain ins outs \n where \"(p,ins,outs) \\ set procs\" by(fastforce dest!:callee_in_procs)\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\\n have \"length (ParamUses (sourcenode a)) = length ins\"\n by(fastforce intro:ParamUses_call_source_length)\n with \\valid_edge a\\\n have \"\\i < length ins. \\V \\ (ParamUses (sourcenode a))!i. V \\ Use (sourcenode a)\"\n by(fastforce intro:ParamUses_in_Use)\n with \\\\V \\ Use (sourcenode a). state_val s V = state_val s' V\\\n have \"\\i < length ins. \\V \\ (ParamUses (sourcenode a))!i. \n state_val s V = state_val s' V\"\n by fastforce\n with \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\(p,ins,outs) \\ set procs\\\n \\pred (kind a) s\\ \\pred (kind ax) s'\\\n have \"\\i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\"\n by(fastforce intro!:CFG_call_edge_params)\n from \\valid_edge a\\ \\kind a = Q:r\\\\<^bsub>p\\<^esub>fs\\ \\(p,ins,outs) \\ set procs\\\n have \"length fs = length ins\" by(rule CFG_call_edge_length)\n { fix i assume \"i < length fs\"\n with \\length fs = length ins\\ have \"i < length ins\" by simp\n from \\i < length fs\\ have \"(params fs (fst cf))!i = (fs!i) (fst cf)\"\n by(rule params_nth)\n moreover\n from \\i < length fs\\ have \"(params fs (fst cf'))!i = (fs!i) (fst cf')\"\n by(rule params_nth)\n ultimately have \"(fs!i) (fst (hd s)) = (fs!i) (fst (hd s'))\"\n using \\i < length ins\\\n \\\\i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\\\n by simp }\n hence \"\\i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n { fix i assume \"i < length fs\"\n with \\\\i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')\\\n have \"(fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n have \"((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf) =\n ((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf')\"\n proof(cases \"Formal_in(targetnode a,i + 0) \\ HRB_slice S\")\n case True\n with \\i < length fs\\ \n have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = fs!i\"\n by(rule csppa_Formal_in_in_slice)\n with \\(fs ! i) (fst cf) = (fs ! i) (fst cf')\\ show ?thesis by simp\n next\n case False\n with \\i < length fs\\ \n have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = Map.empty\"\n by(rule csppa_Formal_in_notin_slice)\n thus ?thesis by simp\n qed }\n hence eq:\"\\i < length fs.\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf) =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n by(simp add:cspp_def)\n { fix i assume \"i < length fs\"\n hence \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf))!i =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf)\"\n by(fastforce intro:params_nth)\n moreover\n from \\i < length fs\\\n have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf'))!i =\n ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n by(fastforce intro:params_nth)\n ultimately \n have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n (fst cf))!i =\n (params (cspp (targetnode a) (HRB_slice S) fs)(fst cf'))!i\"\n using eq \\i < length fs\\ by simp }\n hence \"params (cspp (targetnode a) (HRB_slice S) fs)(fst cf) =\n params (cspp (targetnode a) (HRB_slice S) fs)(fst cf')\"\n by(simp add:list_eq_iff_nth_eq)\n with slice_kind \\(p,ins,outs) \\ set procs\\\n obtain cfx where [simp]:\n \"transfer (slice_kind S a) (cf#cfs) = cfx#cf#cfs\"\n \"transfer (slice_kind S a) (cf'#cfs') = cfx#cf'#cfs'\"\n by auto\n hence rv:\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V = \n state_val (transfer (slice_kind S a) s') V\" by simp\n from rvs \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\ \n \\sourcenode a = m\\\n have rvs':\"\\iV\\rv S (CFG_node (sourcenode ((a # cs) ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by auto(case_tac i,auto)\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as)\n (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx)\n (transfer (slice_kind S a) s')\" by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s) = \n Suc (length (a # cs))\" by simp\n moreover\n from \\length s' = Suc (length cs)\\\n have \"length (transfer (slice_kind S a) s') = \n Suc (length (a # cs))\" by simp\n moreover\n from IH[OF \\upd_cs (a # cs) as = []\\ \\same_level_path_aux (a # cs) asx\\\n \\\\c\\set (a # cs). valid_edge c\\ \\targetnode a -as\\* (_Low_)\\\n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n qed\n qed\nnext\n case (slpa_Return cs a as Q p f c' cs')\n note IH = \\\\m as' s s'. \\upd_cs cs' as = []; same_level_path_aux cs' as'; \n \\c\\set cs'. valid_edge c; m -as\\* (_Low_); m -as'\\* (_Low_);\n \\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V; \n \\iV\\rv S (CFG_node m). state_val s V = state_val s' V;\n preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n length s = Suc (length cs'); length s' = Suc (length cs')\\\n \\ \\V\\Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n state_val (transfers(slice_kinds S as') s') V\\\n note rvs = \\ \\iV\\rv S (CFG_node (sourcenode (cs ! i))).\n fst (s ! Suc i) V = fst (s' ! Suc i) V\\\n from \\m -a # as\\* (_Low_)\\ have \"sourcenode a = m\" and \"valid_edge a\"\n and \"targetnode a -as\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\\\c\\set cs. valid_edge c\\ \\cs = c' # cs'\\\n have \"valid_edge c'\" and \"\\c\\set cs'. valid_edge c\" by simp_all\n show ?case\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\* (_Low_)\\ have \"m = (_Low_)\" by fastforce\n with \\valid_edge a\\ \\sourcenode a = m\\ have \"targetnode a = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\ \n \\targetnode a = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"a = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind a = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode a = (_Exit_)\\ \\targetnode a -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax asx)\n with \\m -as'\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\" by(auto elim:path_split_Cons)\n from \\valid_edge a\\ \\valid_edge ax\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n \\sourcenode a = m\\ \\sourcenode ax = m\\\n have \"\\Q f. kind ax = Q\\\\<^bsub>p\\<^esub>f\" by(auto dest:return_edges_only)\n with \\same_level_path_aux cs as'\\ \\as' = ax#asx\\ \\cs = c' # cs'\\\n have \"ax \\ get_return_edges c'\" and \"same_level_path_aux cs' asx\" by auto\n from \\valid_edge c'\\ \\ax \\ get_return_edges c'\\ \\a \\ get_return_edges c'\\\n have [simp]:\"ax = a\" by(rule get_return_edges_unique)\n from \\targetnode ax -asx\\* (_Low_)\\ have \"targetnode a -asx\\* (_Low_)\" by simp\n from \\upd_cs cs (a # as) = []\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\cs = c' # cs'\\\n \\a \\ get_return_edges c'\\\n have \"upd_cs cs' as = []\" by simp\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\\n obtain cf cfx cfs where \"s = cf#cfx#cfs\"\n by(cases s,auto,case_tac list,fastforce+)\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\\n obtain cf' cfx' cfs' where \"s' = cf'#cfx'#cfs'\"\n by(cases s',auto,case_tac list,fastforce+)\n from rvs \\cs = c' # cs'\\ \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have rvs1:\"\\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((cfx#cfs) ! Suc i) V = fst ((cfx'#cfs') ! Suc i) V\"\n and \"\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\"\n by auto\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n obtain Qx rx px fsx where \"kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\"\n by(fastforce dest!:only_call_get_return_edges)\n have \"\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\"\n proof\n fix V assume \"V \\ rv S (CFG_node (targetnode a))\"\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n obtain a' where edge:\"valid_edge a'\" \"sourcenode a' = sourcenode c'\"\n \"targetnode a' = targetnode a\" \"intra_kind (kind a')\"\n by -(drule call_return_node_edge,auto simp:intra_kind_def)\n from \\V \\ rv S (CFG_node (targetnode a))\\\n obtain as n' where \"targetnode a -as\\\\<^sub>\\* parent_node n'\"\n and \"n' \\ HRB_slice S\" and \"V \\ Use\\<^bsub>SDG\\<^esub> n'\"\n and all:\"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes as) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n from \\targetnode a -as\\\\<^sub>\\* parent_node n'\\ edge\n have \"sourcenode c' -a'#as\\\\<^sub>\\* parent_node n'\"\n by(fastforce intro:Cons_path simp:intra_path_def)\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\ have \"Def (sourcenode c') = {}\"\n by(rule call_source_Def_empty)\n hence \"\\n''. valid_SDG_node n'' \\ parent_node n'' = sourcenode c'\n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce dest:SDG_Def_parent_Def)\n with all \\sourcenode a' = sourcenode c'\\\n have \"\\n''. valid_SDG_node n'' \\ parent_node n'' \\ set (sourcenodes (a'#as)) \n \\ V \\ Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce simp:sourcenodes_def)\n with \\sourcenode c' -a'#as\\\\<^sub>\\* parent_node n'\\ \n \\n' \\ HRB_slice S\\ \\V \\ Use\\<^bsub>SDG\\<^esub> n'\\\n show \"V \\ rv S (CFG_node (sourcenode c'))\"\n by(fastforce intro:rvI)\n qed\n show ?thesis\n proof(cases \"sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\")\n case True\n from \\valid_edge c'\\ \\a \\ get_return_edges c'\\\n have \"get_proc (targetnode c') = get_proc (sourcenode a)\"\n by -(drule intra_proc_additional_edge,\n auto dest:get_proc_intra simp:intra_kind_def)\n moreover\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\\n have \"get_proc (targetnode c') = px\" by(rule get_proc_call)\n moreover\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have \"get_proc (sourcenode a) = p\" by(rule get_proc_return)\n ultimately have [simp]:\"px = p\" by simp\n from \\valid_edge c'\\ \\kind c' = Qx:rx\\\\<^bsub>px\\<^esub>fsx\\\n obtain ins outs where \"(p,ins,outs) \\ set procs\"\n by(fastforce dest!:callee_in_procs)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have slice_kind:\"slice_kind S a = \n Q\\\\<^bsub>p\\<^esub>(\\cf cf'. rspp (targetnode a) (HRB_slice S) outs cf' cf)\"\n by(rule slice_kind_Return_in_slice)\n with \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have sx:\"transfer (slice_kind S a) s = \n (rspp (targetnode a) (HRB_slice S) outs (fst cfx) (fst cf),\n snd cfx)#cfs\"\n and sx':\"transfer (slice_kind S a) s' = \n (rspp (targetnode a) (HRB_slice S) outs (fst cfx') (fst cf'),\n snd cfx')#cfs'\"\n by simp_all\n with rvs1 have rvs':\"\\iV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by fastforce\n from slice_kind \\\\i \\cs = c' # cs'\\\n \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have snds:\"\\iV\\rv S (CFG_node (targetnode a)).\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx) (fst cf)) V =\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx') (fst cf')) V\"\n proof\n fix V assume \"V \\ rv S (CFG_node (targetnode a))\"\n show \"(rspp (targetnode a) (HRB_slice S) outs \n (fst cfx) (fst cf)) V =\n (rspp (targetnode a) (HRB_slice S) outs \n (fst cfx') (fst cf')) V\"\n proof(cases \"V \\ set (ParamDefs (targetnode a))\")\n case True\n then obtain i where \"i < length (ParamDefs (targetnode a))\"\n and \"(ParamDefs (targetnode a))!i = V\"\n by(fastforce simp:in_set_conv_nth)\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\(p,ins,outs) \\ set procs\\\n have \"length(ParamDefs (targetnode a)) = length outs\"\n by(fastforce intro:ParamDefs_return_target_length)\n show ?thesis\n proof(cases \"Actual_out(targetnode a,i) \\ HRB_slice S\")\n case True\n with \\i < length (ParamDefs (targetnode a))\\ \\valid_edge a\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have rspp_eq:\"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx) (fst cf)) V = \n (fst cf)(outs!i)\"\n \"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx') (fst cf')) V = \n (fst cf')(outs!i)\"\n by(auto intro:rspp_Actual_out_in_slice)\n from \\valid_edge a\\ \\kind a = Q\\\\<^bsub>p\\<^esub>f\\ \\(p,ins,outs) \\ set procs\\\n have \"\\V \\ set outs. V \\ Use (sourcenode a)\" by(fastforce dest:outs_in_Use)\n have \"\\V \\ Use (sourcenode a). V \\ rv S (CFG_node m)\"\n proof\n fix V assume \"V \\ Use (sourcenode a)\"\n from \\valid_edge a\\ \\sourcenode a = m\\\n have \"parent_node (CFG_node m) -[]\\\\<^sub>\\* parent_node (CFG_node m)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n with \\sourcenode a \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \n \\V \\ Use (sourcenode a)\\ \\sourcenode a = m\\ \\valid_edge a\\\n show \"V \\ rv S (CFG_node m)\"\n by -(rule rvI,\n auto intro!:CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def)\n qed\n with \\\\V \\ set outs. V \\ Use (sourcenode a)\\\n have \"\\V \\ set outs. V \\ rv S (CFG_node m)\" by simp\n with \\\\V\\rv S (CFG_node m). state_val s V = state_val s' V\\\n \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have \"\\V \\ set outs. (fst cf) V = (fst cf') V\" by simp\n with \\i < length (ParamDefs (targetnode a))\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n have \"(fst cf)(outs!i) = (fst cf')(outs!i)\" by fastforce\n with rspp_eq show ?thesis by simp\n next\n case False\n with \\i < length (ParamDefs (targetnode a))\\ \\valid_edge a\\\n \\length(ParamDefs (targetnode a)) = length outs\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have rspp_eq:\"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx) (fst cf)) V = \n (fst cfx)((ParamDefs (targetnode a))!i)\"\n \"(rspp (targetnode a) \n (HRB_slice S) outs (fst cfx') (fst cf')) V = \n (fst cfx')((ParamDefs (targetnode a))!i)\"\n by(auto intro:rspp_Actual_out_notin_slice)\n from \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n \\V \\ rv S (CFG_node (targetnode a))\\\n \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n \\(ParamDefs (targetnode a))!i = V\\[THEN sym]\n have \"(fst cfx) (ParamDefs (targetnode a) ! i) =\n (fst cfx') (ParamDefs (targetnode a) ! i)\" by fastforce\n with rspp_eq show ?thesis by fastforce\n qed\n next\n case False\n with \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n \\V \\ rv S (CFG_node (targetnode a))\\\n \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n show ?thesis by(fastforce simp:rspp_def map_merge_def)\n qed\n qed\n with sx sx'\n have rv':\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\"\n by fastforce\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\"\n by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx) \n (transfer (slice_kind S a) s')\"\n by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\ sx\n have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n by(simp,simp add:\\s = cf#cfx#cfs\\)\n moreover\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\ sx'\n have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n by(simp,simp add:\\s' = cf'#cfx'#cfs'\\)\n moreover\n from IH[OF \\upd_cs cs' as = []\\ \\same_level_path_aux cs' asx\\ \n \\\\c\\set cs'. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv' calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n next\n case False\n from this \\kind a = Q\\\\<^bsub>p\\<^esub>f\\\n have slice_kind:\"slice_kind S a = (\\cf. True)\\\\<^bsub>p\\<^esub>(\\cf cf'. cf')\"\n by(rule slice_kind_Return)\n with \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have [simp]:\"transfer (slice_kind S a) s = cfx#cfs\"\n \"transfer (slice_kind S a) s' = cfx'#cfs'\" by simp_all\n from slice_kind \\\\i \n \\cs = c' # cs'\\ \\s = cf#cfx#cfs\\ \\s' = cf'#cfx'#cfs'\\\n have snds:\"\\iiV\\rv S (CFG_node (sourcenode (cs' ! i))).\n fst ((transfer (slice_kind S a) s) ! Suc i) V = \n fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n by fastforce\n from \\\\V \\ rv S (CFG_node (targetnode a)).\n V \\ rv S (CFG_node (sourcenode c'))\\\n \\\\V\\rv S (CFG_node (sourcenode c')). \n (fst cfx) V = (fst cfx') V\\\n have rv':\"\\V\\rv S (CFG_node (targetnode a)).\n state_val (transfer (slice_kind S a) s) V =\n state_val (transfer (slice_kind S a) s') V\" by simp\n from \\preds (slice_kinds S (a # as)) s\\\n have \"preds (slice_kinds S as) \n (transfer (slice_kind S a) s)\"\n by(simp add:slice_kinds_def)\n moreover\n from \\preds (slice_kinds S as') s'\\ \\as' = ax#asx\\\n have \"preds (slice_kinds S asx) \n (transfer (slice_kind S a) s')\"\n by(simp add:slice_kinds_def)\n moreover\n from \\length s = Suc (length cs)\\ \\cs = c' # cs'\\\n have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n by(simp,simp add:\\s = cf#cfx#cfs\\)\n moreover\n from \\length s' = Suc (length cs)\\ \\cs = c' # cs'\\\n have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n by(simp,simp add:\\s' = cf'#cfx'#cfs'\\)\n moreover\n from IH[OF \\upd_cs cs' as = []\\ \\same_level_path_aux cs' asx\\ \n \\\\c\\set cs'. valid_edge c\\ \\targetnode a -as\\* (_Low_)\\ \n \\targetnode a -asx\\* (_Low_)\\ rvs' snds rv' calculation] \\as' = ax#asx\\\n show ?thesis by(simp add:slice_kinds_def)\n qed\n qed\n qed\nqed\n\n\nlemma rv_Low_Use_Low:\n assumes \"m -as\\\\<^sub>\\* (_Low_)\" and \"m -as'\\\\<^sub>\\* (_Low_)\" and \"get_proc m = Main\"\n and \"\\V \\ rv S (CFG_node m). cf V = cf' V\"\n and \"preds (slice_kinds S as) [(cf,undefined)]\"\n and \"preds (slice_kinds S as') [(cf',undefined)]\"\n and \"CFG_node (_Low_) \\ S\"\n shows \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S as) [(cf,undefined)]) V =\n state_val (transfers(slice_kinds S as') [(cf',undefined)]) V\"\nproof(cases as)\n case Nil\n with \\m -as\\\\<^sub>\\* (_Low_)\\ have \"valid_node m\" and \"m = (_Low_)\" \n by(auto intro:path_valid_node simp:vp_def)\n { fix V assume \"V \\ Use (_Low_)\"\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ have \"(_Low_) -[]\\\\<^sub>\\* (_Low_)\"\n by(fastforce intro:empty_path simp:intra_path_def)\n moreover\n from \\valid_node m\\ \\m = (_Low_)\\ \\CFG_node (_Low_) \\ S\\\n have \"CFG_node (_Low_) \\ HRB_slice S\"\n by(fastforce intro:HRB_slice_refl)\n ultimately have \"V \\ rv S (CFG_node m)\" using \\m = (_Low_)\\\n by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n hence \"\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\" by simp\n show ?thesis\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n from \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"m -as'\\* (_Low_)\" by(simp add:vp_def)\n from \\m -as'\\* (_Low_)\\ \\m = (_Low_)\\ have \"as' = []\"\n proof(induct m as' m'\\\"(_Low_)\" rule:path.induct)\n case (Cons_path m'' as a m)\n from \\valid_edge a\\ \\sourcenode a = m\\ \\m = (_Low_)\\\n have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n with \\targetnode a = m''\\ \\m'' -as\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?case by simp\n qed simp\n with Nil \\\\V \\ rv S (CFG_node m). cf V = cf' V\\\n \\\\V \\ Use (_Low_). V \\ rv S (CFG_node m)\\\n show ?thesis by(fastforce simp:slice_kinds_def)\n qed\nnext\n case (Cons ax asx)\n with \\m -as\\\\<^sub>\\* (_Low_)\\ have \"sourcenode ax = m\" and \"valid_edge ax\"\n and \"targetnode ax -asx\\* (_Low_)\"\n by(auto elim:path_split_Cons simp:vp_def)\n show ?thesis\n proof(cases \"L = {}\")\n case True with UseLow show ?thesis by simp\n next\n case False\n show ?thesis\n proof(cases as')\n case Nil\n with \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"m = (_Low_)\" by(fastforce simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = m\\ have \"targetnode ax = (_Exit_)\"\n by -(rule Exit_successor_of_Low,simp+)\n from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n and \"kind a' = (\\s. True)\\<^sub>\\\" by blast\n from \\valid_edge ax\\ \\sourcenode ax = m\\ \\m = (_Low_)\\ \n \\targetnode ax = (_Exit_)\\ \\valid_edge a'\\ \\sourcenode a' = (_Low_)\\ \n \\targetnode a' = (_Exit_)\\\n have \"ax = a'\" by(fastforce dest:edge_det)\n with \\kind a' = (\\s. True)\\<^sub>\\\\ have \"kind ax = (\\s. True)\\<^sub>\\\" by simp\n with \\targetnode ax = (_Exit_)\\ \\targetnode ax -asx\\* (_Low_)\\\n have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n with False have False by -(drule Low_neq_Exit,simp)\n thus ?thesis by simp\n next\n case (Cons ax' asx')\n from \\m -as\\\\<^sub>\\* (_Low_)\\ have \"valid_path_aux [] as\" and \"m -as\\* (_Low_)\"\n by(simp_all add:vp_def valid_path_def)\n from this \\as = ax#asx\\ \\get_proc m = Main\\\n have \"same_level_path_aux [] as \\ upd_cs [] as = []\"\n by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n hence \"same_level_path_aux [] as\" and \"upd_cs [] as = []\" by simp_all\n from \\m -as'\\\\<^sub>\\* (_Low_)\\ have \"valid_path_aux [] as'\" and \"m -as'\\* (_Low_)\"\n by(simp_all add:vp_def valid_path_def)\n from this \\as' = ax'#asx'\\ \\get_proc m = Main\\\n have \"same_level_path_aux [] as' \\ upd_cs [] as' = []\"\n by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n hence \"same_level_path_aux [] as'\" by simp\n from \\same_level_path_aux [] as\\ \\upd_cs [] as = []\\\n \\same_level_path_aux [] as'\\ \\m -as\\* (_Low_)\\ \\m -as'\\* (_Low_)\\\n \\\\V \\ rv S (CFG_node m). cf V = cf' V\\ \\CFG_node (_Low_) \\ S\\\n \\preds (slice_kinds S as) [(cf,undefined)]\\\n \\preds (slice_kinds S as') [(cf',undefined)]\\\n show ?thesis by -(erule slpa_rv_Low_Use_Low,auto)\n qed\n qed\nqed\n\n\n\nlemma nonInterference_path_to_Low:\n assumes \"[cf] \\\\<^sub>L [cf']\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"(_Entry_) -as\\\\<^sub>\\* (_Low_)\" and \"preds (kinds as) [(cf,undefined)]\"\n and \"(_Entry_) -as'\\\\<^sub>\\* (_Low_)\" and \"preds (kinds as') [(cf',undefined)]\"\n shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n from \\(_Entry_) -as\\\\<^sub>\\* (_Low_)\\ \\preds (kinds as) [(cf,undefined)]\\\n \\CFG_node (_Low_) \\ S\\\n obtain asx where \"preds (slice_kinds S asx) [(cf,undefined)]\"\n and \"\\V \\ Use (_Low_). \n state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n state_val (transfers (kinds as) [(cf,undefined)]) V\"\n and \"slice_edges S [] as = slice_edges S [] asx\"\n and \"transfers (kinds as) [(cf,undefined)] \\ []\"\n and \"(_Entry_) -asx\\\\<^sub>\\* (_Low_)\" \n by(erule fundamental_property_of_static_slicing)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds as') [(cf',undefined)]\\\n \\CFG_node (_Low_) \\ S\\\n obtain asx' where \"preds (slice_kinds S asx') [(cf',undefined)]\"\n and \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n state_val (transfers(kinds as') [(cf',undefined)]) V\"\n and \"slice_edges S [] as' = \n slice_edges S [] asx'\"\n and \"transfers (kinds as') [(cf',undefined)] \\ []\"\n and \"(_Entry_) -asx'\\\\<^sub>\\* (_Low_)\"\n by(erule fundamental_property_of_static_slicing)\n from \\[cf] \\\\<^sub>L [cf']\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\\n have \"\\V \\ rv S (CFG_node (_Entry_)). cf V = cf' V\" \n by(fastforce dest:lowEquivalence_relevant_nodes_Entry)\n with \\(_Entry_) -asx \\\\<^sub>\\*(_Low_)\\ \\(_Entry_) -asx'\\\\<^sub>\\* (_Low_)\\\n \\CFG_node (_Low_) \\ S\\ \\preds (slice_kinds S asx) [(cf,undefined)]\\\n \\preds (slice_kinds S asx') [(cf',undefined)]\\\n have \"\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx) [(cf,undefined)]) V =\n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V\"\n by -(rule rv_Low_Use_Low,auto intro:get_proc_Entry)\n with \\\\V \\ Use (_Low_). \n state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n state_val (transfers (kinds as) [(cf,undefined)]) V\\\n \\\\V \\ Use (_Low_). \n state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n state_val (transfers(kinds as') [(cf',undefined)]) V\\\n \\transfers (kinds as) [(cf,undefined)] \\ []\\ \n \\transfers (kinds as') [(cf',undefined)] \\ []\\\n show ?thesis by(fastforce simp:lowEquivalence_def UseLow neq_Nil_conv)\nqed\n\n\ntheorem nonInterference_path:\n assumes \"[cf] \\\\<^sub>L [cf']\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"(_Entry_) -as\\\\<^sub>\\* (_Exit_)\" and \"preds (kinds as) [(cf,undefined)]\"\n and \"(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\" and \"preds (kinds as') [(cf',undefined)]\"\n shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n from \\(_Entry_) -as\\\\<^sub>\\* (_Exit_)\\ obtain x xs where \"as = x#xs\"\n and \"(_Entry_) = sourcenode x\" and \"valid_edge x\" \n and \"targetnode x -xs\\* (_Exit_)\"\n apply(cases \"as = []\")\n apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(fastforce elim:path_split_Cons simp:vp_def)\n from \\(_Entry_) -as\\\\<^sub>\\* (_Exit_)\\ have \"valid_path as\" by(simp add:vp_def)\n from \\valid_edge x\\ have \"valid_node (targetnode x)\" by simp\n hence \"inner_node (targetnode x)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with \\valid_edge x\\ have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with \\targetnode x -xs\\* (_Exit_)\\ have \"xs = []\"\n by -(drule path_Exit_source,auto)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from \\valid_edge x\\ \\valid_edge z\\ \\(_Entry_) = sourcenode x\\ \n \\sourcenode z = (_Entry_)\\ Exit \\targetnode z = (_Exit_)\\\n have \"x = z\" by(fastforce intro:edge_det)\n with \\preds (kinds as) [(cf,undefined)]\\ \\as = x#xs\\ \\xs = []\\\n \\kind z = (\\s. False)\\<^sub>\\\\ \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with \\targetnode x -xs\\* (_Exit_)\\ obtain x' xs' where \"xs = xs'@[x']\"\n and \"targetnode x -xs'\\* (_Low_)\" and \"kind x' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with \\(_Entry_) = sourcenode x\\ \\valid_edge x\\\n have \"(_Entry_) -x#xs'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from \\valid_path as\\ \\as = x#xs\\ \\xs = xs'@[x']\\\n have \"valid_path (x#xs')\"\n by(simp add:valid_path_def del:valid_path_aux.simps)\n (rule valid_path_aux_split,simp)\n with \\(_Entry_) -x#xs'\\* (_Low_)\\ have \"(_Entry_) -x#xs'\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def)\n from \\as = x#xs\\ \\xs = xs'@[x']\\ have \"as = (x#xs')@[x']\" by simp\n with \\preds (kinds as) [(cf,undefined)]\\ \n have \"preds (kinds (x#xs')) [(cf,undefined)]\"\n by(simp add:kinds_def preds_split)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\\ obtain y ys where \"as' = y#ys\"\n and \"(_Entry_) = sourcenode y\" and \"valid_edge y\" \n and \"targetnode y -ys\\* (_Exit_)\"\n apply(cases \"as' = []\")\n apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n by(fastforce elim:path_split_Cons simp:vp_def)\n from \\(_Entry_) -as'\\\\<^sub>\\* (_Exit_)\\ have \"valid_path as'\" by(simp add:vp_def)\n from \\valid_edge y\\ have \"valid_node (targetnode y)\" by simp\n hence \"inner_node (targetnode y)\"\n proof(cases rule:valid_node_cases)\n case Entry\n with \\valid_edge y\\ have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with \\targetnode y -ys\\* (_Exit_)\\ have \"ys = []\"\n by -(drule path_Exit_source,auto)\n from Entry_Exit_edge obtain z where \"valid_edge z\"\n and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n and \"kind z = (\\s. False)\\<^sub>\\\" by blast\n from \\valid_edge y\\ \\valid_edge z\\ \\(_Entry_) = sourcenode y\\ \n \\sourcenode z = (_Entry_)\\ Exit \\targetnode z = (_Exit_)\\\n have \"y = z\" by(fastforce intro:edge_det)\n with \\preds (kinds as') [(cf',undefined)]\\ \\as' = y#ys\\ \\ys = []\\\n \\kind z = (\\s. False)\\<^sub>\\\\ \n have False by(simp add:kinds_def)\n thus ?thesis by simp\n qed simp\n with \\targetnode y -ys\\* (_Exit_)\\ obtain y' ys' where \"ys = ys'@[y']\"\n and \"targetnode y -ys'\\* (_Low_)\" and \"kind y' = (\\s. True)\\<^sub>\\\"\n by(fastforce elim:Exit_path_Low_path)\n with \\(_Entry_) = sourcenode y\\ \\valid_edge y\\\n have \"(_Entry_) -y#ys'\\* (_Low_)\" by(fastforce intro:Cons_path)\n from \\valid_path as'\\ \\as' = y#ys\\ \\ys = ys'@[y']\\\n have \"valid_path (y#ys')\"\n by(simp add:valid_path_def del:valid_path_aux.simps)\n (rule valid_path_aux_split,simp)\n with \\(_Entry_) -y#ys'\\* (_Low_)\\ have \"(_Entry_) -y#ys'\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def)\n from \\as' = y#ys\\ \\ys = ys'@[y']\\ have \"as' = (y#ys')@[y']\" by simp\n with \\preds (kinds as') [(cf',undefined)]\\ \n have \"preds (kinds (y#ys')) [(cf',undefined)]\"\n by(simp add:kinds_def preds_split)\n from \\[cf] \\\\<^sub>L [cf']\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\CFG_node (_Low_) \\ S\\\n \\(_Entry_) -x#xs'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds (x#xs')) [(cf,undefined)]\\\n \\(_Entry_) -y#ys'\\\\<^sub>\\* (_Low_)\\ \\preds (kinds (y#ys')) [(cf',undefined)]\\\n have \"map fst (transfers (kinds (x#xs')) [(cf,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds (y#ys')) [(cf',undefined)])\"\n by(rule nonInterference_path_to_Low)\n with \\as = x#xs\\ \\xs = xs'@[x']\\ \\kind x' = (\\s. True)\\<^sub>\\\\\n \\as' = y#ys\\ \\ys = ys'@[y']\\ \\kind y' = (\\s. True)\\<^sub>\\\\\n show ?thesis\n apply(cases \"transfers (map kind xs') (transfer (kind x) [(cf,undefined)])\")\n apply (auto simp add:kinds_def transfers_split)\n by((cases \"transfers (map kind ys') (transfer (kind y) [(cf',undefined)])\"),\n (auto simp add:kinds_def transfers_split))+\nqed\n\n\nend\n\ntext \\The second theorem assumes that we have a operational semantics,\nwhose evaluations are written \\\\c,s\\ \\ \\c',s'\\\\ and which conforms \nto the CFG. The correctness theorem then states that if no high variable\ninfluenced a low variable and the initial states were low equivalent, the\nreulting states are again low equivalent:\\\n\n\nlocale NonInterferenceInter = \n NonInterferenceInterGraph sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n H L High Low +\n SemanticsProperty sourcenode targetnode kind valid_edge Entry get_proc\n get_return_edges procs Main Exit Def Use ParamDefs ParamUses sem identifies\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") \n and Def :: \"'node \\ 'var set\" and Use :: \"'node \\ 'var set\"\n and ParamDefs :: \"'node \\ 'var list\" and ParamUses :: \"'node \\ 'var set list\"\n and sem :: \"'com \\ ('var \\ 'val) list \\ 'com \\ ('var \\ 'val) list \\ bool\" \n (\"((1\\_,/_\\) \\/ (1\\_,/_\\))\" [0,0,0,0] 81)\n and identifies :: \"'node \\ 'com \\ bool\" (\"_ \\ _\" [51,0] 80)\n and H :: \"'var set\" and L :: \"'var set\" \n and High :: \"'node\" (\"'('_High'_')\") and Low :: \"'node\" (\"'('_Low'_')\") +\n fixes final :: \"'com \\ bool\"\n assumes final_edge_Low: \"\\final c; n \\ c\\ \n \\ \\a. valid_edge a \\ sourcenode a = n \\ targetnode a = (_Low_) \\ kind a = \\id\"\nbegin\n\n\ntext\\The following theorem needs the explicit edge from \\(_High_)\\\n to \\n\\. An approach using a \\init\\ predicate for initial statements,\n being reachable from \\(_High_)\\ via a \\(\\s. True)\\<^sub>\\\\ edge,\n does not work as the same statement could be identified by several nodes, some\n initial, some not. E.g., in the program \\texttt{while (True) Skip;;Skip}\n two nodes identify this inital statement: the initial node and the node\n within the loop (because of loop unrolling).\\\n\ntheorem nonInterference:\n assumes \"[cf\\<^sub>1] \\\\<^sub>L [cf\\<^sub>2]\" and \"(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\"\n and \"CFG_node (_Low_) \\ S\"\n and \"valid_edge a\" and \"sourcenode a = (_High_)\" and \"targetnode a = n\" \n and \"kind a = (\\s. True)\\<^sub>\\\" and \"n \\ c\" and \"final c'\"\n and \"\\c,[cf\\<^sub>1]\\ \\ \\c',s\\<^sub>1\\\" and \"\\c,[cf\\<^sub>2]\\ \\ \\c',s\\<^sub>2\\\"\n shows \"s\\<^sub>1 \\\\<^sub>L s\\<^sub>2\"\nproof -\n from High_target_Entry_edge obtain ax where \"valid_edge ax\"\n and \"sourcenode ax = (_Entry_)\" and \"targetnode ax = (_High_)\"\n and \"kind ax = (\\s. True)\\<^sub>\\\" by blast\n from \\n \\ c\\ \\\\c,[cf\\<^sub>1]\\ \\ \\c',s\\<^sub>1\\\\\n obtain n\\<^sub>1 as\\<^sub>1 cfs\\<^sub>1 where \"n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\" and \"n\\<^sub>1 \\ c'\"\n and \"preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]\" \n and \"transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1\" and \"map fst cfs\\<^sub>1 = s\\<^sub>1\"\n by(fastforce dest:fundamental_property)\n from \\n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ \\valid_edge a\\ \\sourcenode a = (_High_)\\ \\targetnode a = n\\\n \\kind a = (\\s. True)\\<^sub>\\\\\n have \"(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n from \\final c'\\ \\n\\<^sub>1 \\ c'\\\n obtain a\\<^sub>1 where \"valid_edge a\\<^sub>1\" and \"sourcenode a\\<^sub>1 = n\\<^sub>1\" \n and \"targetnode a\\<^sub>1 = (_Low_)\" and \"kind a\\<^sub>1 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>1 -[a\\<^sub>1]\\* (_Low_)\" by(fastforce intro:path_edge)\n with \\(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"(_High_) -(a#as\\<^sub>1)@[a\\<^sub>1]\\* (_Low_)\"\n by(fastforce intro!:path_Append simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = (_Entry_)\\ \\targetnode ax = (_High_)\\\n have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\* (_Low_)\" by -(rule Cons_path)\n moreover\n from \\(_High_) -a#as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"valid_path_aux [] (a#as\\<^sub>1)\"\n by(simp add:vp_def valid_path_def)\n with \\kind a\\<^sub>1 = \\id\\ have \"valid_path_aux [] ((a#as\\<^sub>1)@[a\\<^sub>1])\"\n by(fastforce intro:valid_path_aux_Append)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ have \"valid_path_aux [] (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))\"\n by simp\n ultimately have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def valid_path_def)\n from \\valid_edge a\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\sourcenode a = (_High_)\\\n \\targetnode a = n\\\n have \"get_proc n = get_proc (_High_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_High have \"get_proc n = Main\" by simp\n from \\valid_edge a\\<^sub>1\\ \\sourcenode a\\<^sub>1 = n\\<^sub>1\\ \\targetnode a\\<^sub>1 = (_Low_)\\ \\kind a\\<^sub>1 = \\id\\\n have \"get_proc n\\<^sub>1 = get_proc (_Low_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_Low have \"get_proc n\\<^sub>1 = Main\" by simp\n from \\n -as\\<^sub>1\\\\<^sub>\\* n\\<^sub>1\\ have \"n -as\\<^sub>1\\\\<^bsub>sl\\<^esub>* n\\<^sub>1\"\n by(cases as\\<^sub>1)\n (auto dest!:vpa_Main_slpa intro:\\get_proc n\\<^sub>1 = Main\\ \\get_proc n = Main\\\n simp:vp_def valid_path_def valid_call_list_def slp_def \n same_level_path_def simp del:valid_path_aux.simps)\n then obtain cfx r where cfx:\"transfers (map kind as\\<^sub>1) [(cf\\<^sub>1,undefined)] = [(cfx,r)]\"\n by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n from \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \n \\preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]\\ \\kind a\\<^sub>1 = \\id\\ cfx \n have \"preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]\"\n by(auto simp:kinds_def preds_split)\n from \\n \\ c\\ \\\\c,[cf\\<^sub>2]\\ \\ \\c',s\\<^sub>2\\\\\n obtain n\\<^sub>2 as\\<^sub>2 cfs\\<^sub>2 where \"n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\" and \"n\\<^sub>2 \\ c'\"\n and \"preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]\" \n and \"transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2\" and \"map fst cfs\\<^sub>2 = s\\<^sub>2\"\n by(fastforce dest:fundamental_property)\n from \\n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ \\valid_edge a\\ \\sourcenode a = (_High_)\\ \\targetnode a = n\\\n \\kind a = (\\s. True)\\<^sub>\\\\\n have \"(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n from \\final c'\\ \\n\\<^sub>2 \\ c'\\\n obtain a\\<^sub>2 where \"valid_edge a\\<^sub>2\" and \"sourcenode a\\<^sub>2 = n\\<^sub>2\" \n and \"targetnode a\\<^sub>2 = (_Low_)\" and \"kind a\\<^sub>2 = \\id\" by(fastforce dest:final_edge_Low)\n hence \"n\\<^sub>2 -[a\\<^sub>2]\\* (_Low_)\" by(fastforce intro:path_edge)\n with \\(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"(_High_) -(a#as\\<^sub>2)@[a\\<^sub>2]\\* (_Low_)\"\n by(fastforce intro!:path_Append simp:vp_def)\n with \\valid_edge ax\\ \\sourcenode ax = (_Entry_)\\ \\targetnode ax = (_High_)\\\n have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\* (_Low_)\" by -(rule Cons_path)\n moreover\n from \\(_High_) -a#as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"valid_path_aux [] (a#as\\<^sub>2)\"\n by(simp add:vp_def valid_path_def)\n with \\kind a\\<^sub>2 = \\id\\ have \"valid_path_aux [] ((a#as\\<^sub>2)@[a\\<^sub>2])\"\n by(fastforce intro:valid_path_aux_Append)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ have \"valid_path_aux [] (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))\"\n by simp\n ultimately have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\\\<^sub>\\* (_Low_)\"\n by(simp add:vp_def valid_path_def)\n from \\valid_edge a\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\sourcenode a = (_High_)\\\n \\targetnode a = n\\\n have \"get_proc n = get_proc (_High_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_High have \"get_proc n = Main\" by simp\n from \\valid_edge a\\<^sub>2\\ \\sourcenode a\\<^sub>2 = n\\<^sub>2\\ \\targetnode a\\<^sub>2 = (_Low_)\\ \\kind a\\<^sub>2 = \\id\\\n have \"get_proc n\\<^sub>2 = get_proc (_Low_)\"\n by(fastforce dest:get_proc_intra simp:intra_kind_def)\n with get_proc_Low have \"get_proc n\\<^sub>2 = Main\" by simp\n from \\n -as\\<^sub>2\\\\<^sub>\\* n\\<^sub>2\\ have \"n -as\\<^sub>2\\\\<^bsub>sl\\<^esub>* n\\<^sub>2\"\n by(cases as\\<^sub>2)\n (auto dest!:vpa_Main_slpa intro:\\get_proc n\\<^sub>2 = Main\\ \\get_proc n = Main\\\n simp:vp_def valid_path_def valid_call_list_def slp_def \n same_level_path_def simp del:valid_path_aux.simps)\n then obtain cfx' r' \n where cfx':\"transfers (map kind as\\<^sub>2) [(cf\\<^sub>2,undefined)] = [(cfx',r')]\"\n by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n from \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \n \\preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]\\ \\kind a\\<^sub>2 = \\id\\ cfx' \n have \"preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]\"\n by(auto simp:kinds_def preds_split)\n from \\[cf\\<^sub>1] \\\\<^sub>L [cf\\<^sub>2]\\ \\(_High_) \\ \\HRB_slice S\\\\<^bsub>CFG\\<^esub>\\ \\CFG_node (_Low_) \\ S\\\n \\(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\\\<^sub>\\* (_Low_)\\ \n \\preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]\\\n \\(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\\\<^sub>\\* (_Low_)\\ \n \\preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]\\\n have \"map fst (transfers (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]) \\\\<^sub>L \n map fst (transfers (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)])\"\n by(rule nonInterference_path_to_Low)\n with \\kind ax = (\\s. True)\\<^sub>\\\\ \\kind a = (\\s. True)\\<^sub>\\\\ \\kind a\\<^sub>1 = \\id\\ \\kind a\\<^sub>2 = \\id\\\n \\transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1\\ \\map fst cfs\\<^sub>1 = s\\<^sub>1\\\n \\transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2\\ \\map fst cfs\\<^sub>2 = s\\<^sub>2\\\n show ?thesis by(cases s\\<^sub>1)(cases s\\<^sub>2,(fastforce simp:kinds_def transfers_split)+)+\nqed\n\n\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/InformationFlowSlicing_Inter/NonInterferenceInter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.18759006064978404}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__52.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__52 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__52 and some rule r*}\nlemma n_RecvReqSVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__0Vsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__0 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__1Vsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__1 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__52:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__52 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__52:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__52:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__52.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.18759005519017088}} {"text": "(* Title: HOL/Auth/Recur.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection\\The Otway-Bull Recursive Authentication Protocol\\\n\ntheory Recur imports Public begin\n\ntext\\End marker for message bundles\\\nabbreviation\n END :: \"msg\" where\n \"END == Number 0\"\n\n(*Two session keys are distributed to each agent except for the initiator,\n who receives one.\n Perhaps the two session keys could be bundled into a single message.\n*)\ninductive_set (*Server's response to the nested message*)\n respond :: \"event list => (msg*msg*key)set\"\n for evs :: \"event list\"\n where\n One: \"Key KAB \\ used evs\n ==> (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\,\n \\Crypt (shrK A) \\Key KAB, Agent B, Nonce NA\\, END\\,\n KAB) \\ respond evs\"\n\n (*The most recent session key is passed up to the caller*)\n | Cons: \"[| (PA, RA, KAB) \\ respond evs;\n Key KBC \\ used evs; Key KBC \\ parts {RA};\n PA = Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, P\\ |]\n ==> (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\,\n \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\,\n KBC)\n \\ respond evs\"\n\n\n(*Induction over \"respond\" can be difficult due to the complexity of the\n subgoals. Set \"responses\" captures the general form of certificates.\n*)\ninductive_set\n responses :: \"event list => msg set\"\n for evs :: \"event list\"\n where\n (*Server terminates lists*)\n Nil: \"END \\ responses evs\"\n\n | Cons: \"[| RA \\ responses evs; Key KAB \\ used evs |]\n ==> \\Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ responses evs\"\n\n\ninductive_set recur :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ recur\"\n\n (*The spy MAY say anything he CAN say. Common to\n all similar protocols.*)\n | Fake: \"[| evsf \\ recur; X \\ synth (analz (knows Spy evsf)) |]\n ==> Says Spy B X # evsf \\ recur\"\n\n (*Alice initiates a protocol run.\n END is a placeholder to terminate the nesting.*)\n | RA1: \"[| evs1 \\ recur; Nonce NA \\ used evs1 |]\n ==> Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\)\n # evs1 \\ recur\"\n\n (*Bob's response to Alice's message. C might be the Server.\n We omit PA = \\XA, Agent A, Agent B, Nonce NA, P\\ because\n it complicates proofs, so B may respond to any message at all!*)\n | RA2: \"[| evs2 \\ recur; Nonce NB \\ used evs2;\n Says A' B PA \\ set evs2 |]\n ==> Says B C (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\)\n # evs2 \\ recur\"\n\n (*The Server receives Bob's message and prepares a response.*)\n | RA3: \"[| evs3 \\ recur; Says B' Server PB \\ set evs3;\n (PB,RB,K) \\ respond evs3 |]\n ==> Says Server B RB # evs3 \\ recur\"\n\n (*Bob receives the returned message and compares the Nonces with\n those in the message he previously sent the Server.*)\n | RA4: \"[| evs4 \\ recur;\n Says B C \\XH, Agent B, Agent C, Nonce NB,\n XA, Agent A, Agent B, Nonce NA, P\\ \\ set evs4;\n Says C' B \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ set evs4 |]\n ==> Says B A RA # evs4 \\ recur\"\n\n (*No \"oops\" message can easily be expressed. Each session key is\n associated--in two separate messages--with two nonces. This is\n one try, but it isn't that useful. Re domino attack, note that\n Recur.thy proves that each session key is secure provided the two\n peers are, even if there are compromised agents elsewhere in\n the chain. Oops cases proved using parts_cut, Key_in_keysFor_parts,\n etc.\n\n Oops: \"[| evso \\ recur; Says Server B RB \\ set evso;\n RB \\ responses evs'; Key K \\ parts {RB} |]\n ==> Notes Spy \\Key K, RB\\ # evso \\ recur\"\n *)\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\n(** Possibility properties: traces that reach the end\n ONE theorem would be more elegant and faster!\n By induction on a list of agents (no repetitions)\n**)\n\n\ntext\\Simplest case: Alice goes directly to the server\\\nlemma \"Key K \\ used [] \n ==> \\NA. \\evs \\ recur.\n Says Server A \\Crypt (shrK A) \\Key K, Agent Server, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] recur.Nil [THEN recur.RA1, \n THEN recur.RA3 [OF _ _ respond.One]])\napply (possibility, simp add: used_Cons) \ndone\n\n\ntext\\Case two: Alice, Bob and the server\\\nlemma \"[| Key K \\ used []; Key K' \\ used []; K \\ K';\n Nonce NA \\ used []; Nonce NB \\ used []; NA < NB |]\n ==> \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil\n [THEN recur.RA1 [of _ NA], \n THEN recur.RA2 [of _ NB],\n THEN recur.RA3 [OF _ _ respond.One \n [THEN respond.Cons [of _ _ K _ K']]],\n THEN recur.RA4], possibility)\napply (auto simp add: used_Cons)\ndone\n\n(*Case three: Alice, Bob, Charlie and the server Rather slow (5 seconds)*)\nlemma \"[| Key K \\ used []; Key K' \\ used []; \n Key K'' \\ used []; K \\ K'; K' \\ K''; K \\ K'';\n Nonce NA \\ used []; Nonce NB \\ used []; Nonce NC \\ used []; \n NA < NB; NB < NC |]\n ==> \\K. \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil [THEN recur.RA1, \n THEN recur.RA2, THEN recur.RA2,\n THEN recur.RA3 \n [OF _ _ respond.One \n [THEN respond.Cons, THEN respond.Cons]],\n THEN recur.RA4, THEN recur.RA4])\napply basic_possibility\napply (tactic \"DEPTH_SOLVE (swap_res_tac @{context} [refl, conjI, disjCI] 1)\")\ndone\n\n\nlemma respond_imp_not_used: \"(PA,RB,KAB) \\ respond evs ==> Key KAB \\ used evs\"\nby (erule respond.induct, simp_all)\n\nlemma Key_in_parts_respond [rule_format]:\n \"[| Key K \\ parts {RB}; (PB,RB,K') \\ respond evs |] ==> Key K \\ used evs\"\napply (erule rev_mp, erule respond.induct)\napply (auto dest: Key_not_used respond_imp_not_used)\ndone\n\ntext\\Simple inductive reasoning about responses\\\nlemma respond_imp_responses:\n \"(PA,RB,KAB) \\ respond evs ==> RB \\ responses evs\"\napply (erule respond.induct)\napply (blast intro!: respond_imp_not_used responses.intros)+\ndone\n\n\n(** For reasoning about the encrypted portion of messages **)\n\nlemmas RA2_analz_spies = Says_imp_spies [THEN analz.Inj]\n\nlemma RA4_analz_spies:\n \"Says C' B \\Crypt K X, X', RA\\ \\ set evs ==> RA \\ analz (spies evs)\"\nby blast\n\n\n(*RA2_analz... and RA4_analz... let us treat those cases using the same\n argument as for the Fake case. This is possible for most, but not all,\n proofs: Fake does not invent new nonces (as in RA2), and of course Fake\n messages originate from the Spy. *)\n\nlemmas RA2_parts_spies = RA2_analz_spies [THEN analz_into_parts]\nlemmas RA4_parts_spies = RA4_analz_spies [THEN analz_into_parts]\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\n(** Spy never sees another agent's shared key! (unless it's bad at start) **)\n\nlemma Spy_see_shrK [simp]:\n \"evs \\ recur ==> (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\napply (erule recur.induct, auto)\ntxt\\RA3. It's ugly to call auto twice, but it seems necessary.\\\napply (auto dest: Key_in_parts_respond simp add: parts_insert_spies)\ndone\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ recur ==> (Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"[|Key (shrK A) \\ parts (knows Spy evs); evs \\ recur|] ==> A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\n(*** Proofs involving analz ***)\n\n(** Session keys are not used to encrypt other session keys **)\n\n(*Version for \"responses\" relation. Handles case RA3 in the theorem below.\n Note that it holds for *any* set H (not just \"spies evs\")\n satisfying the inductive hypothesis.*)\nlemma resp_analz_image_freshK_lemma:\n \"[| RB \\ responses evs;\n \\K KK. KK \\ - (range shrK) -->\n (Key K \\ analz (Key`KK Un H)) =\n (K \\ KK | Key K \\ analz H) |]\n ==> \\K KK. KK \\ - (range shrK) -->\n (Key K \\ analz (insert RB (Key`KK Un H))) =\n (K \\ KK | Key K \\ analz (insert RB H))\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps, auto)\ndone \n\n\ntext\\Version for the protocol. Proof is easy, thanks to the lemma.\\\nlemma raw_analz_image_freshK:\n \"evs \\ recur ==>\n \\K KK. KK \\ - (range shrK) -->\n (Key K \\ analz (Key`KK Un (spies evs))) =\n (K \\ KK | Key K \\ analz (spies evs))\"\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies, analz_freshK, spy_analz)\ntxt\\RA3\\\napply (simp_all add: resp_analz_image_freshK_lemma)\ndone\n\n\n(*Instance of the lemma with H replaced by (spies evs):\n [| RB \\ responses evs; evs \\ recur; |]\n ==> KK \\ - (range shrK) -->\n Key K \\ analz (insert RB (Key`KK Un spies evs)) =\n (K \\ KK | Key K \\ analz (insert RB (spies evs)))\n*)\nlemmas resp_analz_image_freshK = \n resp_analz_image_freshK_lemma [OF _ raw_analz_image_freshK]\n\nlemma analz_insert_freshK:\n \"[| evs \\ recur; KAB \\ range shrK |]\n ==> (Key K \\ analz (insert (Key KAB) (spies evs))) =\n (K = KAB | Key K \\ analz (spies evs))\"\nby (simp del: image_insert\n add: analz_image_freshK_simps raw_analz_image_freshK)\n\n\ntext\\Everything that's hashed is already in past traffic.\\\nlemma Hash_imp_body:\n \"[| Hash \\Key(shrK A), X\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad |] ==> X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [4] RA2_parts_spies)\ntxt\\RA3 requires a further induction\\\napply (erule_tac [5] responses.induct, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ndone\n\n\n(** The Nonce NA uniquely identifies A's message.\n This theorem applies to steps RA1 and RA2!\n\n Unicity is not used in other proofs but is desirable in its own right.\n**)\n\nlemma unique_NA:\n \"[| Hash \\Key(shrK A), Agent A, B, NA, P\\ \\ parts (spies evs);\n Hash \\Key(shrK A), Agent A, B',NA, P'\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad |]\n ==> B=B' & P=P'\"\napply (erule rev_mp, erule rev_mp)\napply (erule recur.induct,\n drule_tac [5] respond_imp_responses)\napply (force, simp_all)\ntxt\\Fake\\\napply blast\napply (erule_tac [3] responses.induct)\ntxt\\RA1,2: creation of new Nonce\\\napply simp_all\napply (blast dest!: Hash_imp_body)+\ndone\n\n\n(*** Lemmas concerning the Server's response\n (relations \"respond\" and \"responses\")\n***)\n\nlemma shrK_in_analz_respond [simp]:\n \"[| RB \\ responses evs; evs \\ recur |]\n ==> (Key (shrK B) \\ analz (insert RB (spies evs))) = (B:bad)\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps resp_analz_image_freshK, auto) \ndone\n\n\nlemma resp_analz_insert_lemma:\n \"[| Key K \\ analz (insert RB H);\n \\K KK. KK \\ - (range shrK) -->\n (Key K \\ analz (Key`KK Un H)) =\n (K \\ KK | Key K \\ analz H);\n RB \\ responses evs |]\n ==> (Key K \\ parts{RB} | Key K \\ analz H)\"\napply (erule rev_mp, erule responses.induct)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps resp_analz_image_freshK_lemma)\ntxt\\Simplification using two distinct treatments of \"image\"\\\napply (simp add: parts_insert2, blast)\ndone\n\nlemmas resp_analz_insert =\n resp_analz_insert_lemma [OF _ raw_analz_image_freshK]\n\ntext\\The last key returned by respond indeed appears in a certificate\\\nlemma respond_certificate:\n \"(Hash[Key(shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\n ==> Crypt (shrK A) \\Key K, B, NA\\ \\ parts {RA}\"\napply (ind_cases \"(Hash[Key (shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\")\napply simp_all\ndone\n\n(*This unicity proof differs from all the others in the HOL/Auth directory.\n The conclusion isn't quite unicity but duplicity, in that there are two\n possibilities. Also, the presence of two different matching messages in\n the inductive step complicates the case analysis. Unusually for such proofs,\n the quantifiers appear to be necessary.*)\nlemma unique_lemma [rule_format]:\n \"(PB,RB,KXY) \\ respond evs ==>\n \\A B N. Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB} -->\n (\\A' B' N'. Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB} -->\n (A'=A & B'=B) | (A'=B & B'=A))\"\napply (erule respond.induct)\napply (simp_all add: all_conj_distrib)\napply (blast dest: respond_certificate)\ndone\n\nlemma unique_session_keys:\n \"[| Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB};\n Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB};\n (PB,RB,KXY) \\ respond evs |]\n ==> (A'=A & B'=B) | (A'=B & B'=A)\"\nby (rule unique_lemma, auto)\n\n\n(** Crucial secrecy property: Spy does not see the keys sent in msg RA3\n Does not in itself guarantee security: an attack could violate\n the premises, e.g. by having A=Spy **)\n\nlemma respond_Spy_not_see_session_key [rule_format]:\n \"[| (PB,RB,KAB) \\ respond evs; evs \\ recur |]\n ==> \\A A' N. A \\ bad & A' \\ bad -->\n Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts{RB} -->\n Key K \\ analz (insert RB (spies evs))\"\napply (erule respond.induct)\napply (frule_tac [2] respond_imp_responses)\napply (frule_tac [2] respond_imp_not_used)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps split_ifs shrK_in_analz_respond\n resp_analz_image_freshK parts_insert2)\ntxt\\Base case of respond\\\napply blast\ntxt\\Inductive step of respond\\\napply (intro allI conjI impI, simp_all)\ntxt\\by unicity, either @{term \"B=Aa\"} or @{term \"B=A'\"}, a contradiction\n if @{term \"B \\ bad\"}\\ \napply (blast dest: unique_session_keys respond_certificate)\napply (blast dest!: respond_certificate)\napply (blast dest!: resp_analz_insert)\ndone\n\n\nlemma Spy_not_see_session_key:\n \"[| Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts (spies evs);\n A \\ bad; A' \\ bad; evs \\ recur |]\n ==> Key K \\ analz (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n frule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies,\n simp_all add: split_ifs analz_insert_eq analz_insert_freshK)\ntxt\\Fake\\\napply spy_analz\ntxt\\RA2\\\napply blast \ntxt\\RA3\\\napply (simp add: parts_insert_spies)\napply (metis Key_in_parts_respond parts.Body parts.Fst resp_analz_insert \n respond_Spy_not_see_session_key usedI)\ntxt\\RA4\\\napply blast \ndone\n\n(**** Authenticity properties for Agents ****)\n\ntext\\The response never contains Hashes\\\nlemma Hash_in_parts_respond:\n \"[| Hash \\Key (shrK B), M\\ \\ parts (insert RB H);\n (PB,RB,K) \\ respond evs |]\n ==> Hash \\Key (shrK B), M\\ \\ parts H\"\napply (erule rev_mp)\napply (erule respond_imp_responses [THEN responses.induct], auto)\ndone\n\ntext\\Only RA1 or RA2 can have caused such a part of a message to appear.\n This result is of no use to B, who cannot verify the Hash. Moreover,\n it can say nothing about how recent A's message is. It might later be\n used to prove B's presence to A at the run's conclusion.\\\nlemma Hash_auth_sender [rule_format]:\n \"[| Hash \\Key(shrK A), Agent A, Agent B, NA, P\\ \\ parts(spies evs);\n A \\ bad; evs \\ recur |]\n ==> Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, NA, P\\) \\ set evs\"\napply (unfold HPair_def)\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [4] RA2_parts_spies,\n simp_all)\ntxt\\Fake, RA3\\\napply (blast dest: Hash_in_parts_respond)+\ndone\n\n(** These two results subsume (for all agents) the guarantees proved\n separately for A and B in the Otway-Rees protocol.\n**)\n\n\ntext\\Certificates can only originate with the Server.\\\nlemma Cert_imp_Server_msg:\n \"[| Crypt (shrK A) Y \\ parts (spies evs);\n A \\ bad; evs \\ recur |]\n ==> \\C RC. Says Server C RC \\ set evs &\n Crypt (shrK A) Y \\ parts {RC}\"\napply (erule rev_mp, erule recur.induct, simp_all)\ntxt\\Fake\\\napply blast\ntxt\\RA1\\\napply blast\ntxt\\RA2: it cannot be a new Nonce, contradiction.\\\napply blast\ntxt\\RA3. Pity that the proof is so brittle: this step requires the rewriting,\n which however would break all other steps.\\\napply (simp add: parts_insert_spies, blast)\ntxt\\RA4\\\napply blast\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Recur.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.33807712415000585, "lm_q1q2_score": 0.18745378519789097}} {"text": "theory Proof_2_8\n imports Proofs_2\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\\n(toEnv\n (setPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR\n Ctrl'emergency))\"\n\nlemma VC8_R2_ind_proof: \"toEnvP s0 \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'motionless \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n ((getPstate s2 ERROR = Ctrl'goUp \\ getPstate s2 ERROR = Ctrl'goDown) \\\n ltime s2 ERROR = DELAY'TIMEOUT \\ \\ (getVarBool s3 userAtTop' \\ getVarBool s3 userAtBottom') \\\n getPstate s2 ERROR = Ctrl'stuckState \\ ltime s2 ERROR = SUSPENSION_TIME'TIMEOUT \\ \\ getVarBool s2 moving') \\\n \\ getVarBool s3 alarmButton' \\\n \\ getVarBool s3 stuck' \\\n (\\s4 s5.\n toEnvP s4 \\\n toEnvP s5 \\\n substate s3 s4 \\\n substate s4 s5 \\\n substate s5 s1 \\\n toEnvNum s4 s5 = ERROR \\\n getPstate s4 ERROR = Ctrl'motionless \\\n \\ getVarBool s5 alarmButton' \\\n \\ getVarBool s5 stuck' \\ \\ (getVarBool s5 userAtTop' \\ getVarBool s5 userAtBottom'))) \\\n (\\s4 s5.\n toEnvP s4 \\\n toEnvP s5 \\\n substate s4 s5 \\\n substate s5 s1 \\\n toEnvNum s4 s5 = ERROR \\\n getPstate s4 ERROR = Ctrl'motionless \\\n \\ getVarBool s5 alarmButton' \\ \\ getVarBool s5 stuck' \\ \\ (getVarBool s5 userAtTop' \\ getVarBool s5 userAtBottom'))) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goUp \\ ltime s1 ERROR \\ DELAY'TIMEOUT) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goUp \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n toEnvNum s2 s1 = ltime s1 ERROR \\\n ((getPstate s2 ERROR = Ctrl'motionless \\ getPstate s2 ERROR = Ctrl'goUp) \\\n (getVarBool s3 userAtTop' \\ getVarBool s3 userAtBottom') \\\n getPstate s2 ERROR = Ctrl'stuckState \\\n ltime s2 ERROR = SUSPENSION_TIME'TIMEOUT \\ getVarBool s2 moving' \\ getVarBool s2 direction' = UP') \\\n \\ getVarBool s3 alarmButton' \\ \\ getVarBool s3 stuck')) \\\n(\\s3. toEnvP s3 \\ substate s3 s0 \\ getPstate s3 ERROR = Ctrl'goUp \\\n (\\s1. toEnvP s1 \\ substate s1 s3 \\ toEnvNum s1 s3 < ltime s3 ERROR \\ getPstate s1 ERROR = Ctrl'goUp) \\\n (\\s2. toEnvP s2 \\ substate s2 s3 \\ toEnvNum s2 s3 < ltime s3 ERROR - ERROR \\\n \\ getVarBool s2 alarmButton' \\ \\ getVarBool s2 stuck' \\ \\ (getVarBool s2 userAtTop' \\ getVarBool s2 userAtBottom'))) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goDown \\ ltime s1 ERROR \\ DELAY'TIMEOUT) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goDown \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n toEnvNum s2 s1 = ltime s1 ERROR \\\n ((getPstate s2 ERROR = Ctrl'motionless \\ getPstate s2 ERROR = Ctrl'goDown) \\\n (getVarBool s3 userAtTop' \\ getVarBool s3 userAtBottom') \\\n getPstate s2 ERROR = Ctrl'stuckState \\\n ltime s2 ERROR = SUSPENSION_TIME'TIMEOUT \\ getVarBool s2 moving' \\ getVarBool s2 direction' = DOWN') \\\n \\ getVarBool s3 alarmButton' \\ \\ getVarBool s3 stuck')) \\\n(\\s3. toEnvP s3 \\ substate s3 s0 \\ getPstate s3 ERROR = Ctrl'goDown \\\n (\\s1. toEnvP s1 \\ substate s1 s3 \\ toEnvNum s1 s3 < ltime s3 ERROR \\ getPstate s1 ERROR = Ctrl'goDown) \\\n (\\s2. toEnvP s2 \\ substate s2 s3 \\ toEnvNum s2 s3 < ltime s3 ERROR - ERROR \\\n \\ getVarBool s2 alarmButton' \\ \\ getVarBool s2 stuck' \\ \\ (getVarBool s2 userAtTop' \\ getVarBool s2 userAtBottom'))) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'stuckState \\ ltime s1 ERROR \\ SUSPENSION_TIME'TIMEOUT) \\\n(\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 ERROR = Ctrl'stuckState \\ getVarBool s1 moving' \\ getVarBool s1 direction' = UP' \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n toEnvNum s2 s1 = ltime s1 ERROR \\\n (getPstate s2 ERROR = Ctrl'goUp \\\n getPstate s2 ERROR = Ctrl'stuckState \\ getVarBool s2 moving' \\ getVarBool s2 direction' = UP') \\\n \\ getVarBool s3 alarmButton' \\ getVarBool s3 stuck')) \\\n(\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 ERROR = Ctrl'stuckState \\ getVarBool s1 moving' \\ getVarBool s1 direction' = DOWN' \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n toEnvNum s2 s1 = ltime s1 ERROR \\\n (getPstate s2 ERROR = Ctrl'goDown \\\n getPstate s2 ERROR = Ctrl'stuckState \\ getVarBool s2 moving' \\ getVarBool s2 direction' = DOWN') \\\n \\ getVarBool s3 alarmButton' \\ getVarBool s3 stuck')) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'stuckState \\ \\ getVarBool s1 moving' \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n toEnvNum s2 s1 = ltime s1 ERROR \\\n (getPstate s2 ERROR = Ctrl'motionless \\ getPstate s2 ERROR = Ctrl'stuckState \\ \\ getVarBool s2 moving') \\\n \\ getVarBool s3 alarmButton' \\ getVarBool s3 stuck')) \\\n(\\s3. toEnvP s3 \\ substate s3 s0 \\ getPstate s3 ERROR = Ctrl'stuckState \\\n (\\s1. toEnvP s1 \\ substate s1 s3 \\ toEnvNum s1 s3 < ltime s3 ERROR \\\n getPstate s1 ERROR = Ctrl'stuckState \\\n getVarBool s1 moving' = getVarBool s3 moving' \\ getVarBool s1 direction' = getVarBool s3 direction') \\\n (\\s2. toEnvP s2 \\ substate s2 s3 \\ toEnvNum s2 s3 < ltime s3 ERROR - ERROR \\\n \\ getVarBool s2 alarmButton' \\ \\ getVarBool s2 stuck' \\ getVarBool s2 up' = DOWN' \\ getVarBool s2 down' = DOWN')) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'emergency \\\n (\\s2 s3.\n toEnvP s2 \\\n toEnvP s3 \\\n substate s2 s3 \\\n substate s3 s1 \\\n toEnvNum s2 s3 = ERROR \\\n getPstate s2 ERROR \\ Ctrl'emergency \\\n getVarBool s3 alarmButton' \\\n (\\s4 s5.\n toEnvP s4 \\ toEnvP s5 \\ substate s3 s4 \\ substate s4 s5 \\ substate s5 s1 \\ toEnvNum s4 s5 = ERROR \\\n getPstate s4 ERROR = Ctrl'emergency \\ getVarBool s5 up' = DOWN' \\ getVarBool s5 down' = DOWN'))) \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'motionless \\\n getVarBool s1 up' = DOWN' \\ getVarBool s1 down' = DOWN' \\ \\ getVarBool s1 moving') \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goUp \\\n getVarBool s1 up' = UP' \\ getVarBool s1 down' = DOWN' \\ getVarBool s1 moving' \\ getVarBool s1 direction' = UP') \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 ERROR = Ctrl'goDown \\\n getVarBool s1 up' = DOWN' \\ getVarBool s1 down' = UP' \\ getVarBool s1 moving' \\ getVarBool s1 direction' = DOWN') \\\n(\\s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 ERROR = Ctrl'motionless \\\n getPstate s1 ERROR = Ctrl'goUp \\\n getPstate s1 ERROR = Ctrl'goDown \\ getPstate s1 ERROR = Ctrl'stuckState \\ getPstate s1 ERROR = Ctrl'emergency) \\\ntoEnvP s2 \\\n getPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR =\n Ctrl'goUp \\\n getVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n alarmButton' \\\n \\ DELAY'TIMEOUT\n \\ ltime\n (setPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR\n Ctrl'emergency)\n ERROR \\\ntoEnvP s5 \\\n substate s2 s5 \\ substate s5 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \\\n pred2 s1 s2 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s5\"\n subgoal premises extraInvs0\n apply(induction rule: state_down_ind)\n using extraInvs0(1) extraInvs0(2) apply simp\n apply(simp only: pred2_def)\n apply(rule impI)\n apply(rule cut_rl[of \"\\s2. toEnvP s2 \\\n substate s2 s0 \\\n toEnvNum s2 s0 \\ ltime s0 ERROR \\\n (getVarBool s2 up' = DOWN' \\ getVarBool s2 down' = DOWN' \\ getVarBool s2 userAtTop' \\ getVarBool s2 userAtBottom')\\\n(toEnvNum s2 s0 = ltime s0 Ctrl' \\ getVarBool s2 up' = False \\ getVarBool s2 down' = False)\n\"])\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply((drule conjE)+)\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n apply(rule disjE[of \"s4=s1\" \"substate s2 s4\"])\n apply(cases \"toEnvNum s4 s0 = DELAY'TIMEOUT\")\n apply(rule disjI1)\n apply(simp split: if_splits)\n apply(rule cut_rl[of \"toEnvNum emptyState s1 = toEnvNum emptyState s4\"])\n using emptyState_substate toEnvNum3\n apply (metis gtimeE_inj substate_linear substate_trans)\n apply(rule cut_rl[of \"toEnvNum s1 s0 = DELAY'TIMEOUT\"])\n apply(rule cut_rl[of \"substate s1 s0\"])\n using emptyState_substate[of s1] emptyState_substate[of s4] toEnvNum3[of emptyState s1 s0] toEnvNum3[of emptyState s4 s0]\n apply simp\n using substate_trans apply blast\n using toEnvNum3 apply simp\n apply(rule disjI2)\n apply (simp split: if_splits)\n apply(rule disjE[of \"substate s2 s4\" \"substate s4 s2 \\ s2 \\ s4\"])\n using substate_linear substate_refl apply blast\n apply assumption\n apply(rule cut_rl[of \"toEnvNum s4 s0 \\ toEnvNum s2 s0\"])\n using toEnvNum3[of s4 s2 s0] gtimeE_inj\n apply (metis add_diff_cancel_right' diff_is_0_eq' substate_toEnvNum_id)\n using extraInvs0(1) apply -[1]\n apply((drule conjE)+)\n prefer 19\n apply assumption\n prefer 18\n apply assumption\n prefer 17\n apply assumption\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n subgoal premises prems\n using extraInvs0(3) prems(2) prems(9) prems(14) prems(24)\n by (metis One_nat_def antisym getPstate.simps(9) le_trans not_less_eq_eq numeral_plus_one one_plus_numeral_commute plus_1_eq_Suc prems(22) semiring_norm(5) semiring_norm(8) substate.simps(2) toEnvP.elims(2))\n apply(rule cut_rl[of \"toEnvNum s1 s0 = DELAY'TIMEOUT\"])\n apply(rule cut_rl[of \"ltime s0 Ctrl' = DELAY'TIMEOUT\"])\n apply simp\n using extraInvs0(3) apply -[1]\n apply (simp split: if_splits)\n apply(rule cut_rl[of \"ltime s0 Ctrl' \\ DELAY'TIMEOUT\"])\n using le_antisym apply simp\n using extraInvs0(1) apply -[1]\n apply((drule conjE)+)\n prefer 18\n apply assumption\n prefer 17\n apply assumption\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n subgoal premises prems\n using prems(18) prems(22) prems(24) substate_refl by auto\n apply (simp split: if_splits)\n using toEnvNum3 apply simp\n apply(drule allE[of _ s4])\n prefer 2\n apply assumption\n apply(rule impE[of \"toEnvP s4 \\\n substate s2 s4 \\\n substate s4 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \\\n s4 \\ s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \"\n\"(getVarBool s4 up' = UP' \\ getVarBool s4 down' = UP') \\ \\ getVarBool s4 userAtTop' \\ \\ getVarBool s4 userAtBottom'\"])\n apply assumption\n apply(rule cut_rl[of \"\\ substate (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s0\"])\n apply (simp split: if_splits)\n apply(rule cut_rl[of \" s0 \\ (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"])\n apply(rule cut_rl[of \"substate s0 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"])\n using substate_antisym apply blast\n using substate_refl by auto\n apply(rule goUp_notMoving[of _ s0])\n apply(rule conjI)\n using extraInvs0(1) apply fast\n apply(rule conjI)\n using substate_refl apply fast\n apply(rule conjI)\n using extraInvs0(3) apply simp\n using extraInvs0(1) apply fast\n\n subgoal for s5\n apply(simp only: pred2_def)\n apply(rule impI)\n apply(cases \"(getVarBool (predEnv s5) up' = DOWN' \\ getVarBool (predEnv s5) down' = DOWN' \\\n getVarBool (predEnv s5) userAtTop' \\ getVarBool (predEnv s5) userAtBottom')\")\n apply(rule exI[of _ \"predEnv s5\"])\n apply(rule conjI)\n apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n apply blast\n apply(rule conjI)\n using substate_refl apply simp\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(rule conjI)\n using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"]\n using le_add1 apply presburger\n apply(rule conjI)\n apply assumption\n apply (metis substate_antisym)\n apply(drule impE)\n apply(((rule conjI),blast)+)\n apply (metis substate_eq_or_predEnv)\n prefer 2\n apply assumption\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule exI[of _ s4])\n apply(rule conjI)\n apply blast\n apply(rule conjI)\n using predEnv_substate substate_trans apply blast\n apply(((rule conjI),blast)+)\n by (metis predEnv_substate_imp_eq_or_substate)\n done\n done\n done\n\ntheorem proof_2_8: \"VC8 inv2 env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n apply(simp only: VC8_def inv2_def R2_def extraInv_def)\n apply(rule impI)\n apply(rule conjI)\n apply(rule conjI)\n apply simp\n apply((rule allI)+)\n apply(rule impI)\n apply((drule conjE)+)\n prefer 32\n apply assumption\n prefer 31\n apply assumption\n prefer 30\n apply assumption\n prefer 29\n apply assumption\n prefer 28\n apply assumption\n prefer 27\n apply assumption\n prefer 26\n apply assumption\n prefer 25\n apply assumption\n prefer 24\n apply assumption\n prefer 23\n apply assumption\n prefer 22\n apply assumption\n prefer 21\n apply assumption\n prefer 20\n apply assumption\n prefer 19\n apply assumption\n prefer 18\n apply assumption\n prefer 17\n apply assumption\n prefer 16\n apply assumption\n prefer 15\n apply assumption\n prefer 14\n apply assumption\n prefer 13\n apply assumption\n prefer 12\n apply assumption\n prefer 11\n apply assumption\n prefer 10\n apply assumption\n prefer 9\n apply assumption\n prefer 8\n apply assumption\n prefer 7\n apply assumption\n prefer 6\n apply assumption\n prefer 5\n apply assumption\n prefer 4\n apply assumption\n prefer 3\n apply assumption\n prefer 2\n apply assumption\n subgoal premises prems for s1 s2\n apply(rule disjE[OF le_imp_less_or_eq[OF prems(13)]])\n apply(rule cut_rl[of \"\\s4. toEnvP s4 \\\n substate s2 s4 \\\n substate s4 s0 \\\n toEnvNum s2 s4 \\ DELAY'TIMEOUT \\\n (getVarBool s4 up' = DOWN' \\ getVarBool s4 down' = DOWN' \\ getVarBool s4 userAtTop' \\ getVarBool s4 userAtBottom') \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s4 \\ s3 \\ s4 \\\n (getVarBool s3 up' = UP' \\ getVarBool s3 down' = UP') \\ \\ getVarBool s3 userAtTop' \\ \\ getVarBool s3 userAtBottom'\n)\"])\n apply(drule exE)\n prefer 2\n apply assumption\n subgoal for s4\n apply(rule exI[of _ s4])\n by simp\n using prems(2) prems(4) prems(6) prems(8) prems(9) prems(11) prems(15) prems(17) prems(18) apply -[1]\n apply(drule allE[of _ s1])\n prefer 2\n apply assumption\n apply(drule allE[of _ s2])\n prefer 2\n apply assumption\n apply (simp split: if_splits)\n apply(rule cut_rl[of\n \"pred2 s1 s2 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s2\"])\n apply(simp only: pred2_def)\n apply(drule impE)\n using prems(2) prems(4) prems(6) prems(8) prems(9) prems(15) prems(17) prems(18) substate_trans substate_refl\n using substate_antisym apply blast\n prefer 2\n apply assumption\n apply assumption\n apply(rule mp[of\n \"toEnvP s2 \\ substate s2 s2 \\\n substate s2 (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\"])\n apply(rule VC8_R2_ind_proof)\n using prems apply fast\n using prems apply fast\n using prems apply fast\n apply(rule conjI)\n using prems apply fast\n apply(rule conjI)\n using substate_refl apply fast\n using prems by fast\n ", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Proof_2_8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.3380771308191988, "lm_q1q2_score": 0.18745378391780837}} {"text": "(* Title: HOL/MicroJava/JVM/JVMDefensive.thy\n Author: Gerwin Klein\n*)\n\nsection \\A Defensive JVM\\\n\ntheory JVMDefensive\nimports JVMExec\nbegin\n\ntext \\\n Extend the state space by one element indicating a type error (or\n other abnormal termination)\\\ndatatype 'a type_error = TypeError | Normal 'a\n\n\nabbreviation\n fifth :: \"'a \\ 'b \\ 'c \\ 'd \\ 'e \\ 'f \\ 'e\"\n where \"fifth x == fst(snd(snd(snd(snd x))))\"\n\nfun isAddr :: \"val \\ bool\" where\n \"isAddr (Addr loc) = True\"\n| \"isAddr v = False\"\n\nfun isIntg :: \"val \\ bool\" where\n \"isIntg (Intg i) = True\"\n| \"isIntg v = False\"\n\ndefinition isRef :: \"val \\ bool\" where\n \"isRef v \\ v = Null \\ isAddr v\"\n\nprimrec check_instr :: \"[instr, jvm_prog, aheap, opstack, locvars, \n cname, sig, p_count, nat, frame list] \\ bool\" where\n \"check_instr (Load idx) G hp stk vars C sig pc mxs frs = \n (idx < length vars \\ size stk < mxs)\"\n\n| \"check_instr (Store idx) G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ idx < length vars)\"\n\n| \"check_instr (LitPush v) G hp stk vars Cl sig pc mxs frs = \n (\\isAddr v \\ size stk < mxs)\"\n\n| \"check_instr (New C) G hp stk vars Cl sig pc mxs frs = \n (is_class G C \\ size stk < mxs)\"\n\n| \"check_instr (Getfield F C) G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ is_class G C \\ field (G,C) F \\ None \\ \n (let (C', T) = the (field (G,C) F); ref = hd stk in \n C' = C \\ isRef ref \\ (ref \\ Null \\ \n hp (the_Addr ref) \\ None \\ \n (let (D,vs) = the (hp (the_Addr ref)) in \n G \\ D \\C C \\ vs (F,C) \\ None \\ G,hp \\ the (vs (F,C)) ::\\ T))))\" \n\n| \"check_instr (Putfield F C) G hp stk vars Cl sig pc mxs frs = \n (1 < length stk \\ is_class G C \\ field (G,C) F \\ None \\ \n (let (C', T) = the (field (G,C) F); v = hd stk; ref = hd (tl stk) in \n C' = C \\ isRef ref \\ (ref \\ Null \\ \n hp (the_Addr ref) \\ None \\ \n (let (D,vs) = the (hp (the_Addr ref)) in \n G \\ D \\C C \\ G,hp \\ v ::\\ T))))\" \n\n| \"check_instr (Checkcast C) G hp stk vars Cl sig pc mxs frs =\n (0 < length stk \\ is_class G C \\ isRef (hd stk))\"\n\n| \"check_instr (Invoke C mn ps) G hp stk vars Cl sig pc mxs frs =\n (length ps < length stk \\ \n (let n = length ps; v = stk!n in\n isRef v \\ (v \\ Null \\ \n hp (the_Addr v) \\ None \\\n method (G,cname_of hp v) (mn,ps) \\ None \\\n list_all2 (\\v T. G,hp \\ v ::\\ T) (rev (take n stk)) ps)))\"\n \n| \"check_instr Return G hp stk0 vars Cl sig0 pc mxs frs =\n (0 < length stk0 \\ (0 < length frs \\ \n method (G,Cl) sig0 \\ None \\ \n (let v = hd stk0; (C, rT, body) = the (method (G,Cl) sig0) in\n Cl = C \\ G,hp \\ v ::\\ rT)))\"\n \n| \"check_instr Pop G hp stk vars Cl sig pc mxs frs = \n (0 < length stk)\"\n\n| \"check_instr Dup G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Dup_x1 G hp stk vars Cl sig pc mxs frs = \n (1 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Dup_x2 G hp stk vars Cl sig pc mxs frs = \n (2 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Swap G hp stk vars Cl sig pc mxs frs =\n (1 < length stk)\"\n\n| \"check_instr IAdd G hp stk vars Cl sig pc mxs frs =\n (1 < length stk \\ isIntg (hd stk) \\ isIntg (hd (tl stk)))\"\n\n| \"check_instr (Ifcmpeq b) G hp stk vars Cl sig pc mxs frs =\n (1 < length stk \\ 0 \\ int pc+b)\"\n\n| \"check_instr (Goto b) G hp stk vars Cl sig pc mxs frs =\n (0 \\ int pc+b)\"\n\n| \"check_instr Throw G hp stk vars Cl sig pc mxs frs =\n (0 < length stk \\ isRef (hd stk))\"\n\ndefinition check :: \"jvm_prog \\ jvm_state \\ bool\" where\n \"check G s \\ let (xcpt, hp, frs) = s in\n (case frs of [] \\ True | (stk,loc,C,sig,pc)#frs' \\ \n (let (C',rt,mxs,mxl,ins,et) = the (method (G,C) sig); i = ins!pc in\n pc < size ins \\ \n check_instr i G hp stk loc C sig pc mxs frs'))\"\n\n\ndefinition exec_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state option type_error\" where\n \"exec_d G s \\ case s of \n TypeError \\ TypeError \n | Normal s' \\ if check G s' then Normal (exec (G, s')) else TypeError\"\n\n\ndefinition\n exec_all_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ \\ _ \\jvmd\\ _\" [61,61,61]60) where\n \"G \\ s \\jvmd\\ t \\\n (s,t) \\ ({(s,t). exec_d G s = TypeError \\ t = TypeError} \\\n {(s,t). \\t'. exec_d G s = Normal (Some t') \\ t = Normal t'})\\<^sup>*\"\n\n\ndeclare split_paired_All [simp del]\ndeclare split_paired_Ex [simp del]\n\nlemma [dest!]:\n \"(if P then A else B) \\ B \\ P\"\n by (cases P, auto)\n\nlemma exec_d_no_errorI [intro]:\n \"check G s \\ exec_d G (Normal s) \\ TypeError\"\n by (unfold exec_d_def) simp\n\ntheorem no_type_error_commutes:\n \"exec_d G (Normal s) \\ TypeError \\ \n exec_d G (Normal s) = Normal (exec (G, s))\"\n by (unfold exec_d_def, auto)\n\n\nlemma defensive_imp_aggressive:\n \"G \\ (Normal s) \\jvmd\\ (Normal t) \\ G \\ s \\jvm\\ t\"\nproof -\n have \"\\x y. G \\ x \\jvmd\\ y \\ \\s t. x = Normal s \\ y = Normal t \\ G \\ s \\jvm\\ t\"\n apply (unfold exec_all_d_def)\n apply (erule rtrancl_induct)\n apply (simp add: exec_all_def)\n apply (fold exec_all_d_def)\n apply simp\n apply (intro allI impI)\n apply (erule disjE, simp)\n apply (elim exE conjE)\n apply (erule allE, erule impE, assumption)\n apply (simp add: exec_all_def exec_d_def split: type_error.splits if_split_asm)\n apply (rule rtrancl_trans, assumption)\n apply blast\n done\n moreover\n assume \"G \\ (Normal s) \\jvmd\\ (Normal t)\" \n ultimately\n show \"G \\ s \\jvm\\ t\" by blast\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/JVM/JVMDefensive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.33807712415000585, "lm_q1q2_score": 0.18745378021993783}} {"text": "(*\n\nCopyright (c) 2018, ETH Zurich\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\nON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\n(*\n Contains definitions that are common to multiple controllers on the \n x86 platform, for instance the I/OAPIC and IOMMU have a the same\n destination mode/format fields.\n\n Based on intel programmers manual and \n \"Intel \\ Virtualization Technology for Directed I/O\", October 2014\n*)\n\ntheory x86int\nimports\n interrupt Main \"HOL-Word.Word\" \"HOL-Word.WordBitwise\"\nbegin\n\n(* Delivery Mode *)\ndatatype DLM = DLMFIXED | DLMLOWPRIO | DLMSMI | DLMNMI | DLMINIT | DLMEXTINT\n\n(* Destination Mode *)\ndatatype DM = DMPHYS | DMLOGICAL\n\n(* Trigger Mode *)\ndatatype TRIGGERM = TRIGGERMEDGE | TRIGGERMLEVEL\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word4 = \"4 word\"\n\n(* Encode Destination mode and the dest field (the dest field interpretation\n depends on the destination mode *)\ndatatype DMDEST = DMPHYS word4 | DMLOGICAL word8\n\n(* IOAPIC Redirection table entry, see 82093AA Datasheet *)\nrecord IOREDTBL_ENTRY =\n dest :: DMDEST\n mask :: bool\n trigger :: TRIGGERM\n delmode :: DLM\n remote_irr :: bool (* Read only *)\n intpol_high :: bool (* true=active high *)\n delivs :: bool (* Read only *)\n vector :: nat\n\n(* This is for the original IOAPIC that has an 8 bit destination *)\ndefinition ioredtbl_entry_well_formed :: \"IOREDTBL_ENTRY \\ bool\"\n where \"ioredtbl_entry_well_formed iot \\ (vector iot) < 256\"\n\ndefinition tset :: \"nat set\"\n where \"tset = {}\"\n\ndefinition to_indexset :: \"word8 \\ nat set\"\n where \"to_indexset w = {x. (w !! x) }\"\n\nlemma \"to_indexset 255 = {7,6,5,4,3,2,1,0}\"\n using bin_nth_Bit0 bin_nth_Bit1 by (simp add:to_indexset_def, auto)\n\nlemma bit_set_bound: \"w !! n \\ n < 8\"\n for w :: \"8 word\"\nproof -\n have L1: \"size w \\ 8\"\n by(simp only:word_size, auto)\n\n have L2: \"w !! n \\ n < size w\"\n by(simp add:test_bit_size)\n\n show ?thesis\n using L1 L2 less_trans by auto\nqed\n\nlemma to_indexset_bound: \"\\ inp. to_indexset inp \\ {x. x < 8}\"\n using bit_set_bound by (simp add: to_indexset_def, auto)\n \n(* Turns a IOREDTBL_ENTRY at index i to a IRQ, Source: Intel 10.6.2.1 *)\ndefinition ioredtbl_entry_to_irq_dest :: \"IOREDTBL_ENTRY \\ IRQ set\"\n where \"ioredtbl_entry_to_irq_dest iot = (case (dest iot) of\n DMPHYS x \\ { \\format = FVECTOR (vector iot), port = unat x\\ } |\n DMLOGICAL ldest \\ {x.\\y \\ (to_indexset ldest). x = \\ format = FVECTOR (vector iot), port = y \\})\"\n\n(* In physical destination mode, the IOAPIC can address a 4 bit destination *) \nlemma \"\\outi \\ (ioredtbl_entry_to_irq_dest y). (port outi) < 16\"\n apply(case_tac \"dest y\")\n apply(simp add:ioredtbl_entry_to_irq_dest_def, unat_arith, auto)\n apply(simp add:ioredtbl_entry_to_irq_dest_def)\n apply(auto)\n using bit_set_bound to_indexset_def by fastforce\n \nend\n", "meta": {"author": "BarrelfishOS", "repo": "Isabelle-hardware-models", "sha": "a638383df9dd8db15805c59efb65724bc919df0a", "save_path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models", "path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models/Isabelle-hardware-models-a638383df9dd8db15805c59efb65724bc919df0a/theories/interrupt/x86int.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.34510527769342453, "lm_q1q2_score": 0.18734498919348871}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__54_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__54_on_rules imports n_g2kAbsAfter_lemma_on_inv__54\nbegin\nsection{*All lemmas on causal relation between inv__54*}\nlemma lemma_inv__54_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__54) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__54_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.32423539898095244, "lm_q1q2_score": 0.1872444401406725}} {"text": "(* Title: JinjaThreads/MM/SC.thy\n Author: David von Oheimb, Andreas Lochbihler\n\n Based on the Jinja theories Common/Objects.thy and Common/Conform by David von Oheimb\n*)\n\nheader {* \\isaheader{Sequential consistency} *}\n\ntheory SC\nimports \n \"../Common/Conform\"\n \"MM\"\nbegin\n\nsubsection{* Objects and Arrays *}\n\ntype_synonym \n fields = \"vname \\ cname \\ addr val\" -- \"field name, defining class, value\"\n\ntype_synonym\n cells = \"addr val list\"\n\ndatatype heapobj\n = Obj cname fields\n -- \"class instance with class name and fields\"\n\n | Arr ty fields cells\n -- \"element type, fields (from object), and list of each cell's content\"\n\nlemma rec_heapobj [simp]: \"rec_heapobj = case_heapobj\"\nby(auto intro!: ext split: heapobj.split)\n\nprimrec obj_ty :: \"heapobj \\ htype\"\nwhere\n \"obj_ty (Obj C f) = Class_type C\"\n| \"obj_ty (Arr T fs cs) = Array_type T (length cs)\"\n\nfun is_Arr :: \"heapobj \\ bool\" where\n \"is_Arr (Obj C fs) = False\"\n| \"is_Arr (Arr T f el) = True\"\n\nlemma is_Arr_conv:\n \"is_Arr arrobj = (\\T f el. arrobj = Arr T f el)\"\nby(cases arrobj, auto)\n\nlemma is_ArrE:\n \"\\ is_Arr arrobj; \\T f el. arrobj = Arr T f el \\ thesis \\ \\ thesis\"\n \"\\ \\ is_Arr arrobj; \\C fs. arrobj = Obj C fs \\ thesis \\ \\ thesis\"\nby(cases arrobj, auto)+\n\ndefinition init_fields :: \"('field_name \\ (ty \\ fmod)) list \\ 'field_name \\ addr val\"\nwhere \"init_fields \\ map_of \\ map (\\(FD,(T, fm)). (FD,default_val T))\"\n\nprimrec\n -- \"a new, blank object with default values in all fields:\"\n blank :: \"'m prog \\ htype \\ heapobj\"\nwhere\n \"blank P (Class_type C) = Obj C (init_fields (fields P C))\"\n| \"blank P (Array_type T n) = Arr T (init_fields (fields P Object)) (replicate n (default_val T))\"\n\nlemma obj_ty_blank [iff]: \n \"obj_ty (blank P hT) = hT\"\nby(cases hT)(simp_all)\n\n\nsubsection{* Heap *}\n\ntype_synonym heap = \"addr \\ heapobj\"\n\ntranslations\n (type) \"heap\" <= (type) \"nat \\ heapobj option\"\n\nabbreviation sc_empty :: heap\nwhere \"sc_empty \\ empty\"\n\nfun the_obj :: \"heapobj \\ cname \\ fields\" where\n \"the_obj (Obj C fs) = (C, fs)\"\n\nfun the_arr :: \"heapobj \\ ty \\ fields \\ cells\" where\n \"the_arr (Arr T f el) = (T, f, el)\"\n\nabbreviation\n cname_of :: \"heap \\ addr \\ cname\" where\n \"cname_of hp a == fst (the_obj (the (hp a)))\"\n\ndefinition sc_allocate :: \"'m prog \\ heap \\ htype \\ (heap \\ addr) set\"\nwhere\n \"sc_allocate P h hT = \n (case new_Addr h of None \\ {}\n | Some a \\ {(h(a \\ blank P hT), a)})\"\n\ndefinition sc_typeof_addr :: \"heap \\ addr \\ htype option\"\nwhere \"sc_typeof_addr h a = map_option obj_ty (h a)\"\n\ninductive sc_heap_read :: \"heap \\ addr \\ addr_loc \\ addr val \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj: \"\\ h a = \\Obj C fs\\; fs (F, D) = \\v\\ \\ \\ sc_heap_read h a (CField D F) v\"\n| Arr: \"\\ h a = \\Arr T f el\\; n < length el \\ \\ sc_heap_read h a (ACell n) (el ! n)\"\n| ArrObj: \"\\ h a = \\Arr T f el\\; f (F, Object) = \\v\\ \\ \\ sc_heap_read h a (CField Object F) v\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_read_cases [elim!]:\n \"sc_heap_read h a (CField C F) v\"\n \"sc_heap_read h a (ACell n) v\"\n\ninductive sc_heap_write :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj: \"\\ h a = \\Obj C fs\\; h' = h(a \\ Obj C (fs((F, D) \\ v))) \\ \\ sc_heap_write h a (CField D F) v h'\"\n| Arr: \"\\ h a = \\Arr T f el\\; h' = h(a \\ Arr T f (el[n := v])) \\ \\ sc_heap_write h a (ACell n) v h'\"\n| ArrObj: \"\\ h a = \\Arr T f el\\; h' = h(a \\ Arr T (f((F, Object) \\ v)) el) \\ \\ sc_heap_write h a (CField Object F) v h'\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_write_cases [elim!]:\n \"sc_heap_write h a (CField C F) v h'\"\n \"sc_heap_write h a (ACell n) v h'\"\n\nconsts sc_spurious_wakeups :: bool\n\ninterpretation sc!: \n heap_base\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n for P .\n\ntext {* Translate notation from @{text heap_base} *}\n\n(* FIXME! Why does sc.preallocated need the type token?? *)\nabbreviation sc_preallocated :: \"'m prog \\ heap \\ bool\"\nwhere \"sc_preallocated == sc.preallocated TYPE('m)\"\n\nabbreviation sc_start_tid :: \"'md prog \\ thread_id\"\nwhere \"sc_start_tid \\ sc.start_tid TYPE('md)\"\n\nabbreviation sc_start_heap_ok :: \"'m prog \\ bool\"\nwhere \"sc_start_heap_ok \\ sc.start_heap_ok TYPE('m)\"\n\nabbreviation sc_start_heap :: \"'m prog \\ heap\"\nwhere \"sc_start_heap \\ sc.start_heap TYPE('m)\"\n\nabbreviation sc_start_state :: \n \"(cname \\ mname \\ ty list \\ ty \\ 'm \\ addr val list \\ 'x)\n \\ 'm prog \\ cname \\ mname \\ addr val list \\ (addr, thread_id, 'x, heap, addr) state\"\nwhere\n \"sc_start_state f P \\ sc.start_state TYPE('m) P f P\"\n\nabbreviation sc_wf_start_state :: \"'m prog \\ cname \\ mname \\ addr val list \\ bool\"\nwhere \"sc_wf_start_state P \\ sc.wf_start_state TYPE('m) P P\"\n\nnotation sc.conf (\"_,_ \\sc _ :\\ _\" [51,51,51,51] 50)\nnotation sc.confs (\"_,_ \\sc _ [:\\] _\" [51,51,51,51] 50)\nnotation sc.hext (\"_ \\sc _\" [51,51] 50)\n\nlemma sc_start_heap_ok: \"sc_start_heap_ok P\"\napply(simp add: sc.start_heap_ok_def sc.start_heap_data_def initialization_list_def sc.create_initial_object_simps sc_allocate_def sys_xcpts_list_def case_option_conv_if new_Addr_SomeI del: blank.simps split del: option.split split_if)\ndone\n\nlemma sc_wf_start_state_iff:\n \"sc_wf_start_state P C M vs \\ (\\Ts T meth D. P \\ C sees M:Ts\\T = \\meth\\ in D \\ P,sc_start_heap P \\sc vs [:\\] Ts)\"\nby(simp add: sc.wf_start_state.simps sc_start_heap_ok)\n\nlemma sc_heap:\n \"heap addr2thread_id thread_id2addr (sc_allocate P) sc_typeof_addr sc_heap_write P\"\nproof\n fix h' a h hT\n assume \"(h', a) \\ sc_allocate P h hT\"\n thus \"sc_typeof_addr h' a = \\hT\\\"\n by(auto simp add: sc_allocate_def sc_typeof_addr_def dest: new_Addr_SomeD split: split_if_asm)\nnext\n fix h' h hT a\n assume \"(h', a) \\ sc_allocate P h hT\"\n from this[symmetric] show \"h \\sc h'\"\n by(fastforce simp add: sc_allocate_def sc_typeof_addr_def sc.hext_def dest: new_Addr_SomeD intro!: map_leI)\nnext\n fix h a al v h'\n assume \"sc_heap_write h a al v h'\"\n thus \"h \\sc h'\"\n by(cases al)(auto intro!: sc.hextI simp add: sc_typeof_addr_def)\nqed simp\n\ninterpretation sc!: \n heap \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n for P by(rule sc_heap)\n\nlemma sc_hext_new:\n \"h a = None \\ h \\sc h(a \\ arrobj)\"\nby(rule sc.hextI)(auto simp add: sc_typeof_addr_def dest!: new_Addr_SomeD)\n\nlemma sc_hext_upd_obj: \"h a = Some (Obj C fs) \\ h \\sc h(a\\(Obj C fs'))\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def)\n\nlemma sc_hext_upd_arr: \"\\ h a = Some (Arr T f e); length e = length e' \\ \\ h \\sc h(a\\(Arr T f' e'))\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def)\n\nsubsection {* Conformance *}\n\ndefinition sc_fconf :: \"'m prog \\ cname \\ heap \\ fields \\ bool\" (\"_,_,_ \\sc _ \\\" [51,51,51,51] 50)\nwhere \"P,C,h \\sc fs \\ = (\\F D T fm. P \\ C has F:T (fm) in D \\ (\\v. fs(F,D) = Some v \\ P,h \\sc v :\\ T))\"\n\nprimrec sc_oconf :: \"'m prog \\ heap \\ heapobj \\ bool\" (\"_,_ \\sc _ \\\" [51,51,51] 50)\nwhere\n \"P,h \\sc Obj C fs \\ \\ is_class P C \\ P,C,h \\sc fs \\\"\n| \"P,h \\sc Arr T fs el \\ \\ is_type P (T\\\\) \\ P,Object,h \\sc fs \\ \\ (\\v \\ set el. P,h \\sc v :\\ T)\"\n\ndefinition sc_hconf :: \"'m prog \\ heap \\ bool\" (\"_ \\sc _ \\\" [51,51] 50)\nwhere \"P \\sc h \\ \\ (\\a obj. h a = Some obj \\ P,h \\sc obj \\)\"\n\ninterpretation sc!: heap_conf_base \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P .\n\ndeclare sc.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nlemma sc_conf_upd_obj: \"h a = Some(Obj C fs) \\ (P,h(a\\(Obj C fs')) \\sc x :\\ T) = (P,h \\sc x :\\ T)\"\napply (unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply (auto simp add: sc_typeof_addr_def split: split_if_asm)\ndone\n\nlemma sc_conf_upd_arr: \"h a = Some(Arr T f el) \\ (P,h(a\\(Arr T f' el')) \\sc x :\\ T') = (P,h \\sc x :\\ T')\"\napply(unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply(auto simp add: sc_typeof_addr_def split: split_if_asm)\ndone\n\n\n\n\n\nlemma sc_oconf_init:\n \"is_htype P hT \\ P,h \\sc blank P hT \\\"\nby(cases hT)(auto simp add: sc_fconf_def has_field_def init_fields_def split_def o_def map_of_map[simplified split_def, where f=\"\\p. default_val (fst p)\"] dest: has_fields_fun)\n\nlemma sc_oconf_fupd [intro?]:\n \"\\ P \\ C has F:T (fm) in D; P,h \\sc v :\\ T; P,h \\sc (Obj C fs) \\ \\ \n \\ P,h \\sc (Obj C (fs((F,D)\\v))) \\\"\nunfolding has_field_def\nby(auto simp add: sc_fconf_def has_field_def dest: has_fields_fun)\n\nlemma sc_oconf_fupd_arr [intro?]:\n \"\\ P,h \\sc v :\\ T; P,h \\sc (Arr T f el) \\ \\\n \\ P,h \\sc (Arr T f (el[i := v])) \\\"\nby(auto dest: subsetD[OF set_update_subset_insert])\n\nlemma sc_oconf_fupd_arr_fields:\n \"\\ P \\ Object has F:T (fm) in Object; P,h \\sc v :\\ T; P,h \\sc (Arr T' f el) \\ \\\n \\ P,h \\sc (Arr T' (f((F, Object) \\ v)) el) \\\"\nby(auto dest: has_fields_fun simp add: sc_fconf_def has_field_def)\n\nlemma sc_oconf_new: \"\\ P,h \\sc obj \\; h a = None \\ \\ P,h(a \\ arrobj) \\sc obj \\\"\nby(erule sc_oconf_hext)(rule sc_hext_new)\n\nlemmas sc_oconf_upd_obj = sc_oconf_hext [OF _ sc_hext_upd_obj]\n\nlemma sc_oconf_upd_arr:\n assumes \"P,h \\sc obj \\\"\n and ha: \"h a = \\Arr T f el\\\"\n shows \"P,h(a \\ Arr T f' el') \\sc obj \\\"\nusing assms\nby(cases obj)(auto simp add: sc_conf_upd_arr[where h=h, OF ha] sc_fconf_def)\n\nlemma sc_hconfD: \"\\ P \\sc h \\; h a = Some obj \\ \\ P,h \\sc obj \\\"\nunfolding sc_hconf_def by blast\n\nlemmas sc_preallocated_new = sc.preallocated_hext[OF _ sc_hext_new]\nlemmas sc_preallocated_upd_obj = sc.preallocated_hext [OF _ sc_hext_upd_obj]\nlemmas sc_preallocated_upd_arr = sc.preallocated_hext [OF _ sc_hext_upd_arr]\n\nlemma sc_hconf_new: \"\\ P \\sc h \\; h a = None; P,h \\sc obj \\ \\ \\ P \\sc h(a\\obj) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_new)\n\nlemma sc_hconf_upd_obj: \"\\ P \\sc h \\; h a = Some (Obj C fs); P,h \\sc (Obj C fs') \\ \\ \\ P \\sc h(a\\(Obj C fs')) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_obj simp del: sc_oconf.simps)\n\nlemma sc_hconf_upd_arr: \"\\ P \\sc h \\; h a = Some(Arr T f el); P,h \\sc (Arr T f' el') \\ \\ \\ P \\sc h(a\\(Arr T f' el')) \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_arr simp del: sc_oconf.simps)\n\nlemma sc_heap_conf: \n \"heap_conf addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_write (sc_hconf P) P\"\nproof\n show \"P \\sc sc_empty \\\" by(simp add: sc_hconf_def)\nnext\n fix h a hT\n assume \"sc_typeof_addr h a = \\hT\\\" \"P \\sc h \\\"\n thus \"is_htype P hT\"\n by(auto simp add: sc_typeof_addr_def sc_oconf_def dest!: sc_hconfD split: heapobj.split_asm)\nnext\n fix h h' hT a\n assume \"P \\sc h \\\" \"(h', a) \\ sc_allocate P h hT\" \"is_htype P hT\"\n thus \"P \\sc h' \\\"\n by(auto simp add: sc_allocate_def dest!: new_Addr_SomeD intro: sc_hconf_new sc_oconf_init split: split_if_asm)\nnext\n fix h a al T v h'\n assume \"P \\sc h \\\"\n and \"sc.addr_loc_type P h a al T\"\n and \"P,h \\sc v :\\ T\"\n and \"sc_heap_write h a al v h'\"\n thus \"P \\sc h' \\\"\n by(cases al)(fastforce elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def intro: sc_hconf_upd_obj sc_oconf_fupd sc_hconfD sc_hconf_upd_arr sc_oconf_fupd_arr sc_oconf_fupd_arr_fields)+\nqed\n\ninterpretation sc!: heap_conf\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P \nby(rule sc_heap_conf)\n\nlemma sc_heap_progress:\n \"heap_progress addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al T\n assume hconf: \"P \\sc h \\\"\n and alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"h a = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n from alt show \"\\v. sc_heap_read h a al v \\ P,h \\sc v :\\ T\"\n proof(cases)\n case (addr_loc_type_field U F fm D) \n note [simp] = `al = CField D F`\n show ?thesis\n proof(cases \"arrobj\")\n case (Obj C' fs)\n with `sc_typeof_addr h a = \\U\\` arrobj\n have [simp]: \"C' = class_type_of U\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Obj have \"P,h \\sc Obj (class_type_of U) fs \\\" by(auto dest: sc_hconfD)\n with `P \\ class_type_of U has F:T (fm) in D` obtain v \n where \"fs (F, D) = \\v\\\" \"P,h \\sc v :\\ T\" by(fastforce simp add: sc_fconf_def)\n thus ?thesis using Obj arrobj by(auto intro: sc_heap_read.intros)\n next\n case (Arr T' f el)\n with `sc_typeof_addr h a = \\U\\` arrobj\n have [simp]: \"U = Array_type T' (length el)\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Arr have \"P,h \\sc Arr T' f el \\\" by(auto dest: sc_hconfD)\n from `P \\ class_type_of U has F:T (fm) in D` have [simp]: \"D = Object\"\n by(auto dest: has_field_decl_above)\n with `P,h \\sc Arr T' f el \\` `P \\ class_type_of U has F:T (fm) in D`\n obtain v where \"f (F, Object) = \\v\\\" \"P,h \\sc v :\\ T\"\n by(fastforce simp add: sc_fconf_def)\n thus ?thesis using Arr arrobj by(auto intro: sc_heap_read.intros)\n qed\n next\n case (addr_loc_type_cell n' n)\n with arrobj obtain f el\n where [simp]: \"arrobj = Arr T f el\"\n by(cases arrobj)(auto simp add: sc_typeof_addr_def)\n from addr_loc_type_cell arrobj\n have [simp]: \"al = ACell n\" \"n < length el\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj have \"P,h \\sc Arr T f el \\\" by(auto dest: sc_hconfD)\n hence \"P,h \\sc el ! n :\\ T\" by(fastforce)\n thus ?thesis using arrobj by(fastforce intro: sc_heap_read.intros)\n qed\nnext\n fix h a al T v\n assume alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"h a = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n thus \"\\h'. sc_heap_write h a al v h'\" using alt\n by(cases arrobj)(fastforce intro: sc_heap_write.intros elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def dest: has_field_decl_above)+\nqed\n\ninterpretation sc!: heap_progress\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P\nby(rule sc_heap_progress)\n\nlemma sc_heap_conf_read:\n \"heap_conf_read addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al v T\n assume read: \"sc_heap_read h a al v\"\n and alt: \"sc.addr_loc_type P h a al T\"\n and hconf: \"P \\sc h \\\"\n thus \"P,h \\sc v :\\ T\"\n by(auto elim!: sc_heap_read.cases sc.addr_loc_type.cases simp add: sc_typeof_addr_def)(fastforce dest!: sc_hconfD simp add: sc_fconf_def)+\nqed\n\ninterpretation sc!: heap_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\nfor P\nby(rule sc_heap_conf_read)\n\nabbreviation sc_deterministic_heap_ops :: \"'m prog \\ bool\"\nwhere \"sc_deterministic_heap_ops \\ sc.deterministic_heap_ops TYPE('m)\"\n\nlemma sc_deterministic_heap_ops: \"\\ sc_spurious_wakeups \\ sc_deterministic_heap_ops P\"\nby(rule sc.deterministic_heap_opsI)(auto elim: sc_heap_read.cases sc_heap_write.cases simp add: sc_allocate_def)\n\nsubsection {* Code generation *}\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n sc_heap_read .\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ i \\ o \\ bool)\n sc_heap_write .\n\nlemma eval_sc_heap_read_i_i_i_o:\n \"Predicate.eval (sc_heap_read_i_i_i_o h ad al) = sc_heap_read h ad al\"\nby(auto elim: sc_heap_read_i_i_i_oE intro: sc_heap_read_i_i_i_oI intro!: ext)\n\nlemma eval_sc_heap_write_i_i_i_i_o:\n \"Predicate.eval (sc_heap_write_i_i_i_i_o h ad al v) = sc_heap_write h ad al v\"\nby(auto elim: sc_heap_write_i_i_i_i_oE intro: sc_heap_write_i_i_i_i_oI intro!: ext)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/SC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.36296920551961687, "lm_q1q2_score": 0.1871541511600748}} {"text": "(* Title: HOL/Auth/n_mutualExOnI_lemma_on_inv__2.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI_lemma_on_inv__2 imports n_mutualExOnI_base\nbegin\nsection{*All lemmas on causal relation between inv__2 and some rule r*}\nlemma n_TryVsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv1)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const I))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__2 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI_lemma_on_inv__2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.18715415116007475}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__158.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__158 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__158 and some rule r*}\nlemma n_PI_Remote_GetVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__158:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__158:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__158:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__158:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__158:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__158:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__158:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__158:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__158:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__158:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__158:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_PutVsinv__158:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__158:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__158:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__158:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__158:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__158:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__158:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__158:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__158:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__158 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__158:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__158:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__158:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__158:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__158:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__158:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__158:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__158:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__158:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__158:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__158:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__158:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__158:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__158:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__158:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__158:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__158:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__158:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__158.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3629691986286475, "lm_q1q2_score": 0.18715414760695379}} {"text": "(* Title: HOL/Auth/n_moesi_lemma_on_inv__2.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_on_inv__2 imports n_moesi_base\nbegin\nsection{*All lemmas on causal relation between inv__2 and some rule r*}\nlemma n_rule_t1Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_rule_t1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rule_t1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rule_t2Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_rule_t2 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rule_t2 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t3Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t3 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t3 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t4Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t4 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t4 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t5Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t5 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t5 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_on_inv__2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.18681032569376216}} {"text": "(* Title: Jinja/J/WellTypeRT.thy\n\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nsection \\Runtime Well-typedness\\\n\ntheory WellTypeRT\nimports WellType\nbegin\n\ninductive\n WTrt :: \"J_prog \\ heap \\ env \\ expr \\ ty \\ bool\"\n and WTrts :: \"J_prog \\ heap \\ env \\ expr list \\ ty list \\ bool\"\n and WTrt2 :: \"[J_prog,env,heap,expr,ty] \\ bool\"\n (\"_,_,_ \\ _ : _\" [51,51,51]50)\n and WTrts2 :: \"[J_prog,env,heap,expr list, ty list] \\ bool\"\n (\"_,_,_ \\ _ [:] _\" [51,51,51]50)\n for P :: J_prog and h :: heap\nwhere\n \n \"P,E,h \\ e : T \\ WTrt P h E e T\"\n| \"P,E,h \\ es[:]Ts \\ WTrts P h E es Ts\"\n\n| WTrtNew:\n \"is_class P C \\\n P,E,h \\ new C : Class C\"\n\n| WTrtCast:\n \"\\ P,E,h \\ e : T; is_refT T; is_class P C \\\n \\ P,E,h \\ Cast C e : Class C\"\n\n| WTrtVal:\n \"typeof\\<^bsub>h\\<^esub> v = Some T \\\n P,E,h \\ Val v : T\"\n\n| WTrtVar:\n \"E V = Some T \\\n P,E,h \\ Var V : T\"\n(*\nWTrtBinOp:\n \"\\ P,E,h \\ e\\<^sub>1 : T\\<^sub>1; P,E,h \\ e\\<^sub>2 : T\\<^sub>2;\n case bop of Eq \\ T = Boolean\n | Add \\ T\\<^sub>1 = Integer \\ T\\<^sub>2 = Integer \\ T = Integer \\\n \\ P,E,h \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\"\n*)\n| WTrtBinOpEq:\n \"\\ P,E,h \\ e\\<^sub>1 : T\\<^sub>1; P,E,h \\ e\\<^sub>2 : T\\<^sub>2 \\\n \\ P,E,h \\ e\\<^sub>1 \\Eq\\ e\\<^sub>2 : Boolean\"\n\n| WTrtBinOpAdd:\n \"\\ P,E,h \\ e\\<^sub>1 : Integer; P,E,h \\ e\\<^sub>2 : Integer \\\n \\ P,E,h \\ e\\<^sub>1 \\Add\\ e\\<^sub>2 : Integer\"\n\n| WTrtLAss:\n \"\\ E V = Some T; P,E,h \\ e : T'; P \\ T' \\ T \\\n \\ P,E,h \\ V:=e : Void\"\n\n| WTrtFAcc:\n \"\\ P,E,h \\ e : Class C; P \\ C has F:T in D \\ \\\n P,E,h \\ e\\F{D} : T\"\n\n| WTrtFAccNT:\n \"P,E,h \\ e : NT \\\n P,E,h \\ e\\F{D} : T\"\n\n| WTrtFAss:\n \"\\ P,E,h \\ e\\<^sub>1 : Class C; P \\ C has F:T in D; P,E,h \\ e\\<^sub>2 : T\\<^sub>2; P \\ T\\<^sub>2 \\ T \\\n \\ P,E,h \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 : Void\"\n\n| WTrtFAssNT:\n \"\\ P,E,h \\ e\\<^sub>1:NT; P,E,h \\ e\\<^sub>2 : T\\<^sub>2 \\\n \\ P,E,h \\ e\\<^sub>1\\F{D}:=e\\<^sub>2 : Void\"\n\n| WTrtCall:\n \"\\ P,E,h \\ e : Class C; P \\ C sees M:Ts \\ T = (pns,body) in D;\n P,E,h \\ es [:] Ts'; P \\ Ts' [\\] Ts \\\n \\ P,E,h \\ e\\M(es) : T\"\n\n| WTrtCallNT:\n \"\\ P,E,h \\ e : NT; P,E,h \\ es [:] Ts \\\n \\ P,E,h \\ e\\M(es) : T\"\n\n| WTrtBlock:\n \"P,E(V\\T),h \\ e : T' \\\n P,E,h \\ {V:T; e} : T'\"\n\n| WTrtSeq:\n \"\\ P,E,h \\ e\\<^sub>1:T\\<^sub>1; P,E,h \\ e\\<^sub>2:T\\<^sub>2 \\\n \\ P,E,h \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2\"\n\n| WTrtCond:\n \"\\ P,E,h \\ e : Boolean; P,E,h \\ e\\<^sub>1:T\\<^sub>1; P,E,h \\ e\\<^sub>2:T\\<^sub>2;\n P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ P \\ T\\<^sub>2 \\ T\\<^sub>1; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\ T = T\\<^sub>2; P \\ T\\<^sub>2 \\ T\\<^sub>1 \\ T = T\\<^sub>1 \\\n \\ P,E,h \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n\n| WTrtWhile:\n \"\\ P,E,h \\ e : Boolean; P,E,h \\ c:T \\\n \\ P,E,h \\ while(e) c : Void\"\n\n| WTrtThrow:\n \"\\ P,E,h \\ e : T\\<^sub>r; is_refT T\\<^sub>r \\ \\\n P,E,h \\ throw e : T\"\n\n| WTrtTry:\n \"\\ P,E,h \\ e\\<^sub>1 : T\\<^sub>1; P,E(V \\ Class C),h \\ e\\<^sub>2 : T\\<^sub>2; P \\ T\\<^sub>1 \\ T\\<^sub>2 \\\n \\ P,E,h \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 : T\\<^sub>2\"\n\n\\ \\well-typed expression lists\\\n\n| WTrtNil:\n \"P,E,h \\ [] [:] []\"\n\n| WTrtCons:\n \"\\ P,E,h \\ e : T; P,E,h \\ es [:] Ts \\\n \\ P,E,h \\ e#es [:] T#Ts\"\n\n(*<*)\ndeclare WTrt_WTrts.intros[intro!] WTrtNil[iff]\ndeclare\n WTrtFAcc[rule del] WTrtFAccNT[rule del]\n WTrtFAss[rule del] WTrtFAssNT[rule del]\n WTrtCall[rule del] WTrtCallNT[rule del]\n\nlemmas WTrt_induct = WTrt_WTrts.induct [split_format (complete)]\n and WTrt_inducts = WTrt_WTrts.inducts [split_format (complete)]\n(*>*)\n\n\nsubsection\\Easy consequences\\\n\n\n\nlemma [iff]: \"(P,E,h \\ e#es [:] T#Ts) = (P,E,h \\ e : T \\ P,E,h \\ es [:] Ts)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrts.cases)\ndone\n(*>*)\n\nlemma [iff]: \"(P,E,h \\ (e#es) [:] Ts) =\n (\\U Us. Ts = U#Us \\ P,E,h \\ e : U \\ P,E,h \\ es [:] Us)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrts.cases)\ndone\n(*>*)\n\n\n\nlemma [iff]: \"P,E,h \\ Val v : T = (typeof\\<^bsub>h\\<^esub> v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E,h \\ Var v : T = (E v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E,h \\ e\\<^sub>1;;e\\<^sub>2 : T\\<^sub>2 = (\\T\\<^sub>1. P,E,h \\ e\\<^sub>1:T\\<^sub>1 \\ P,E,h \\ e\\<^sub>2:T\\<^sub>2)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E,h \\ {V:T; e} : T' = (P,E(V\\T),h \\ e : T')\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt.cases)\ndone\n(*>*)\n(*<*)\ninductive_cases WTrt_elim_cases[elim!]:\n \"P,E,h \\ v :=e : T\"\n \"P,E,h \\ if (e) e\\<^sub>1 else e\\<^sub>2 : T\"\n \"P,E,h \\ while(e) c : T\"\n \"P,E,h \\ throw e : T\"\n \"P,E,h \\ try e\\<^sub>1 catch(C V) e\\<^sub>2 : T\"\n \"P,E,h \\ Cast D e : T\"\n \"P,E,h \\ e\\F{D} : T\"\n \"P,E,h \\ e\\F{D} := v : T\"\n \"P,E,h \\ e\\<^sub>1 \\bop\\ e\\<^sub>2 : T\"\n \"P,E,h \\ new C : T\"\n \"P,E,h \\ e\\M{D}(es) : T\"\n(*>*)\n\nsubsection\\Some interesting lemmas\\\n\nlemma WTrts_Val[simp]:\n \"\\Ts. (P,E,h \\ map Val vs [:] Ts) = (map (typeof\\<^bsub>h\\<^esub>) vs = map Some Ts)\"\n(*<*)\napply(induct vs)\n apply simp\napply(case_tac Ts)\n apply simp\napply simp\ndone\n(*>*)\n\n\n\n\n\nlemma WTrt_env_mono:\n \"P,E,h \\ e : T \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h \\ e : T)\" and\n \"P,E,h \\ es [:] Ts \\ (\\E'. E \\\\<^sub>m E' \\ P,E',h \\ es [:] Ts)\"\n(*<*)\napply(induct rule: WTrt_inducts)\napply(simp add: WTrtNew)\napply(fastforce simp: WTrtCast)\napply(fastforce simp: WTrtVal)\napply(simp add: WTrtVar map_le_def dom_def)\napply(fastforce simp add: WTrtBinOpEq)\napply(fastforce simp add: WTrtBinOpAdd)\napply(force simp: map_le_def)\napply(fastforce simp: WTrtFAcc)\napply(simp add: WTrtFAccNT)\napply(fastforce simp: WTrtFAss)\napply(fastforce simp: WTrtFAssNT)\napply(fastforce simp: WTrtCall)\napply(fastforce simp: WTrtCallNT)\napply(simp add: WTrtNil)\napply(simp add: WTrtCons)\napply(fastforce simp: map_le_def)\napply(fastforce)\napply(fastforce simp: WTrtSeq)\napply(fastforce simp: WTrtWhile)\napply(fastforce simp: WTrtThrow)\napply(auto simp: WTrtTry map_le_def dom_def)\ndone\n(*>*)\n\n\nlemma WTrt_hext_mono: \"P,E,h \\ e : T \\ h \\ h' \\ P,E,h' \\ e : T\"\nand WTrts_hext_mono: \"P,E,h \\ es [:] Ts \\ h \\ h' \\ P,E,h' \\ es [:] Ts\"\n(*<*)\napply(induct rule: WTrt_inducts)\napply(simp add: WTrtNew)\napply(fastforce simp: WTrtCast)\napply(fastforce simp: WTrtVal dest:hext_typeof_mono)\napply(simp add: WTrtVar)\napply(fastforce simp add: WTrtBinOpEq)\napply(fastforce simp add: WTrtBinOpAdd)\napply(fastforce simp add: WTrtLAss)\napply(fast intro: WTrtFAcc)\napply(simp add: WTrtFAccNT)\napply(fastforce simp: WTrtFAss del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtFAssNT)\napply(fastforce simp: WTrtCall)\napply(fastforce simp: WTrtCallNT)\napply(fastforce)\napply(fastforce simp add: WTrtSeq)\napply(fastforce simp add: WTrtCond)\napply(fastforce simp add: WTrtWhile)\napply(fastforce simp add: WTrtThrow)\napply(fastforce simp: WTrtTry)\napply(simp add: WTrtNil)\napply(simp add: WTrtCons)\ndone\n(*>*)\n\n\nlemma WT_implies_WTrt: \"P,E \\ e :: T \\ P,E,h \\ e : T\"\nand WTs_implies_WTrts: \"P,E \\ es [::] Ts \\ P,E,h \\ es [:] Ts\"\n(*<*)\napply(induct rule: WT_WTs_inducts)\napply fast\napply (fast)\napply(fastforce dest:typeof_lit_typeof)\napply(simp)\napply(fastforce)\napply(fastforce)\napply(fastforce)\napply(fastforce simp: WTrtFAcc has_visible_field)\napply(fastforce simp: WTrtFAss dest: has_visible_field)\napply(fastforce simp: WTrtCall)\napply(fastforce)\napply(fastforce)\napply(fastforce simp: WTrtCond)\napply(fastforce)\napply(fastforce)\napply(fastforce)\napply(simp)\napply(simp)\ndone\n(*>*)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/J/WellTypeRT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.186810320775838}} {"text": "(* Title: gASPFutures\n Author: Ludovic Henrio \n 2017\n\n Note: A new type system for futures\n*)\n(*Conventions:\n l = location in store\n x,y=varname\n locs = local variables\n l_\\ = location in the local store of the active object of \\\n Stl = statement list\n EContext is an execution context, ie a thread \n EcL = EContext list*)\n\nchapter {* Syntax and Semantics *}\n\ntheory gASPFutures imports Main AuxiliaryFunctions begin\n \nsubsection {* Syntax *}\ntype_synonym VarName = string\ndatatype VarOrThis = This | Id VarName\ntype_synonym ClassName = string\ntype_synonym MethodName = string\n\ntype_synonym ActName = nat\ntype_synonym FutName = nat\ntype_synonym Location = nat\n\ndatatype BasicType = Integer | Boolean | TObj ClassName | AnyObject\ndatatype ASPType = BType BasicType | FutType BasicType \n\nabbreviation BasicTypeinASPType where\n\"BasicTypeinASPType fT \\ case fT of BType T\\T | FutType T\\T\"\n\ndatatype Signature = Method ASPType MethodName \"(ASPType * VarName) list\" \n (* signature = Method returnType MethodName (list of parameters)*)\n\ndatatype Value = null | ASPInt nat | ASPBool bool (* static values *)\n | ActRef ActName (* runtime values *)\n | FutRef FutName\ntype_synonym Object = \"(VarName\\Value) * ASPType\"\nabbreviation GetObject:: \"Object \\VarName=>Value option\" (\"_.[_]\")\n where \"GetObject ob x \\ (fst ob) x\"\nabbreviation SetObject:: \"Object \\VarName=>Value\\Object\" (\"_.[_]:=_\")\n where \"SetObject ob x v\\ ((fst ob)(x\\v),snd ob)\"\n\ndatatype Atom = Val Value\n | Var VarOrThis \n\n\ndatatype Expression = At Atom\n | Plus Atom Atom (\"_+\\<^sub>A_\" [120,120] 200) \n\ndatatype Rhs = Expr Expression\n | Call Atom MethodName \"Expression list\" (\"_.\\<^sub>A_'(_')\" [440,0,50] 500) (*e.m(e list) *)\n | NewActive ClassName \"Expression list\" (\"newActive _'(_')\" [300,0] 500) (*newActive C(e list) *)\n | Get Atom\n\ndatatype Statement = Assign VarName Rhs (infix \"=\\<^sub>A\" 400) (*x=z*)\n | Return Expression (\"return _\" [300] 300)(*return E *)\n | If Atom \"Statement list\" \"Statement list\" (\"IF _ THEN _ ELSE _ \" [300,0,0] 300)(*if E then s else s *)\n(* skip | NB: skip and seq are not necessary thanks to the use of statement list\n| Seq Statement Statement (infix \";;\" 100)*)\nabbreviation MakeStatementList:: \"Statement \\Statement list\\Statement list\" (infix \";;\" 100)\n where \"MakeStatementList s Stl\\ s#Stl\"\nabbreviation MakeStatementList2:: \"Statement \\Statement\\Statement list\" (infix \";;;\" 120)\n where \"MakeStatementList2 s s'\\ s#[s']\"\n\n\n(*primrec RedContext:: \"Statement\\ Statement \\Statement\" (* returns basic instruction,context , i.e. the rest of the sequence*)\nwhere\n \"RedContext Skip = (Skip,Skip)\" |\n \"RedContext (x=\\<^sub>Az) = ((x=\\<^sub>Az),Skip)\" |\n \"RedContext (return e) = (return e,Skip)\" |\n \"RedContext (IF e THEN s ELSE s') = (IF e THEN s ELSE s',Skip)\" |\n \"RedContext ( s ;; s') = (fst (RedContext s),(snd (RedContext s);;s'))\"\n*)\n(*abbreviation BuildContext::\"Statement\\Statement\\ Statement \\Statement\" (\"_[[_]]\" [300, 0] 300)\nwhere \"BuildContext R s \\ (s,R)\"\n*)\nrecord Method = \nMethSignature:: Signature \nLocalVariables::\"(ASPType * VarName) list\" \nBody::\"Statement list\"\n(*MethDefinition methodname (local variables) body*)\n\nabbreviation MName:: \"Method \\ MethodName\"\nwhere \"MName m \\ case (MethSignature m) of \n (Method returnType MethName listparameters) \\MethName\"\n\nabbreviation MRType:: \"Method \\ ASPType\"\nwhere \"MRType m \\ case (MethSignature m) of \n (Method returnType MethName listparameters) \\returnType\"\n\nabbreviation MParams:: \"Method \\(ASPType * VarName) list\" \nwhere \"MParams m \\ case (MethSignature m) of \n (Method returnType MethName listparameters) \\listparameters\"\n\nrecord Class = \n Name::ClassName \n ClassParameters::\"((ASPType * VarName) list)\"\n Methods::\"(Method list)\"\n (*ASPclass name (classparameters) (listofmethodbodies) *)\n\ndatatype Program = Prog \"Class list\" \"(ASPType * VarName) list\" \"Statement list\"\n\n\n(* --- runtime notions --- *)\ntype_synonym EContext = \" (VarName\\Value) * (Statement list)\" \n (*execution context = location of this, local variables, and statements *)\ntype_synonym Request = \"FutName * MethodName * (Value list)\"\nabbreviation EC_locs:: \"EContext \\(VarName\\Value)\"\nwhere \"EC_locs Ec \\ fst ( Ec)\"\nabbreviation EC_Stl:: \"EContext \\Statement list\"\nwhere \"EC_Stl Ec \\ snd (Ec)\"\n(*datatype Process = Proc Request \"Context list\" *)\n\ndatatype ActiveObject = AO ClassName \"(VarName\\Value)\" \"Request option\" EContext \"Request list\"\n (* active object object's state , curr request id (None if idle), current request statement, request queue*)\n\ndatatype FutValue = Undefined | FutVal Value \n\ndatatype Configuration = Cn \"ActName\\ActiveObject\" \"FutName\\(BasicType*FutValue)\"\nabbreviation Conf_AOs\nwhere \"Conf_AOs conf \\ case conf of Cn ao fut \\ ao\"\nabbreviation Conf_futs\nwhere \"Conf_futs conf \\ case conf of Cn ao fut \\ fut\"\n\ntext{* Binding and fetching elements *}\ndefinition fetchClass\nwhere\n\"fetchClass P C \\ \ncase P of (Prog CL Vars Stl) \\ (List.find (\\class.(Name class) = C) CL) \n\"\ndefinition fetchMethodInClass\nwhere\n\"fetchMethodInClass class m \\ \nList.find (\\method. (MName method = m)) (Methods class)\n\"\n\n(*definition fetchMethodInClassOLD\nwhere\n\"fetchMethodInClassOLD class m \\ \nOption.bind \n(List.find (\\method. (MName method = m)) (Methods class))\n(\\method. Some (map fst (MParams method),map snd (MParams method), map snd (LocalVariables method), Body method))\n\" *)\n\ndefinition Initialisation_from_BasicType\nwhere \n\"Initialisation_from_BasicType T \\ case T of\nInteger \\ (ASPInt 0)| Boolean \\ ASPBool False | TObj ClassName \\ null | AnyObject \\ null\n\"\ndefinition Initialisation_from_ASPType\nwhere \n\"Initialisation_from_ASPType fT \\ \nInitialisation_from_BasicType (BasicTypeinASPType fT)\n\"\n\ndefinition Bind::\"Program\\ClassName\\MethodName\\Value list\\ EContext option\"\nwhere\n \"Bind P C m value_list\\\n(case fetchClass P C of\n Some class \\\n (case fetchMethodInClass class m of \n Some Meth \\ \n let param_list=MParams Meth in\n let param_names = map snd param_list in\n let param_types= map fst param_list in\n let locs = map snd (LocalVariables Meth) in\n if length param_list = length value_list then\n ( let locales= (map_of (zip locs (map Initialisation_from_ASPType param_types)))\n ++ (map_of (zip param_names value_list)) in\n Some ( locales,Body Meth))\n else None\n | None \\ None)\n | _\\ None)\"\ndefinition fields:: \"Program\\ClassName \\VarName list\"\nwhere\n \"fields P C \\\n case (fetchClass P C) of\n Some class \\(map snd (ClassParameters class))\"\n\nabbreviation DefinedClassNames\nwhere \"DefinedClassNames prog \\set (case prog of Prog CL vl xtl \\map Name CL)\"\n\ndefinition ReturnType\nwhere\n\"ReturnType P m C=(case fetchClass P C of\n Some class \\ (case fetchMethodInClass class m of \n Some Meth \\ Some (MRType Meth) |\n None \\ None)\n |\n None \\ None)\"\n\ndefinition MakeFutureType:: \"ASPType \\ ASPType\"\nwhere\n\"MakeFutureType T = (case T of\n FutType T' \\ FutType T' |\n BType T' \\ FutType T')\"\n\ndefinition GetBasicType:: \"ASPType \\ BasicType\"\nwhere\n\"GetBasicType T = (case T of\n FutType T' \\ T' |\n BType T' \\ T')\"\n\nsection{*SOS*}\n\n(*datatype EvaluatedExpr = Undefined | EVal Value | EObj Object | EFutRef FutName*)\n\ninductive_set EvalValue:: \"(Value \\ Value) set\"\nwhere\n Valnull[simp,intro]: \"(null, null)\\EvalValue\" |\n Valint[simp,intro]: \"(ASPInt i, (ASPInt i) )\\EvalValue\" |\n valbool[simp,intro]: \"(ASPBool b, (ASPBool b) )\\EvalValue\" |\n valact[simp,intro]: \"(ActRef \\, ActRef \\ )\\EvalValue\" \n\nlemma EvalValue_is_deterministic[rule_format,intro]: \"(e,v)\\EvalValue \\(e,v')\\EvalValue \\v=v'\"\napply (erule EvalValue.induct)\napply auto\napply (erule EvalValue.cases,simp+)+\ndone\n\ninductive_set EvalAtom:: \"(Atom \\ActName \\ (VarName\\Value) \\ (VarName\\Value) \\ Value) set\"\n(* (e1,\\,state,locs,v) is true if e1 EVALUATES to v in a setting where local variables are locs, state are fields and \\ is the current AO*)\n where\n atomval[simp,intro]: \"(v,ev)\\EvalValue \\(Val v, \\, state,locs, ev)\\EvalAtom\" |\n atomlocs[simp,intro]: \"\\locs(x)=Some v;(v,ev)\\EvalValue\\ \\(Var (Id x),\\, state,locs, ev)\\EvalAtom\" |\n atomThis[simp,intro]: \"(Var This,\\, state, locs, ActRef \\)\\EvalAtom\" |\n atomfield[simp,intro]:\n \"\\locs(x)=None; state x = Some v;(v,ev)\\EvalValue\\ \n \\(Var (Id x),\\, state, locs, ev)\\EvalAtom\" \n\nlemma EvalAtom_is_deterministic[rule_format]: \n \" (e,\\,state,locs,v)\\EvalAtom \\ (\\ v'. (e,\\,state,locs,v')\\EvalAtom \\v=v')\"\napply (erule EvalAtom.induct)\napply (case_tac v,auto)\napply (erule EvalAtom.cases,auto)+\ndone\n\ninductive_set EvalExpr:: \"(Expression \\ActName \\ (VarName\\Value) \\ (VarName\\Value) \\ Value) set\"\n(* (e1,\\,state,locs,v) is true if e1 EVALUATES to v in a setting where local variables are locs, state are fields and \\ is the current AO*)\n where\n expratom[simp,intro]: \"(v,\\,state,locs,ev)\\EvalAtom \\(At v, \\, state,locs, ev)\\EvalExpr\" |\n expradd[simp,intro]:\"\\(v,\\,state,locs,ASPInt i)\\EvalAtom;(v',\\,state,locs, ASPInt i')\\EvalAtom\\ \n \\(v +\\<^sub>A v',\\,state, locs, ASPInt (i+i'))\\EvalExpr\" \n\n\nlemma EvalExpr_is_deterministic[rule_format]: \n \" (e,\\,state,locs,v)\\EvalExpr \\ (\\ v'. (e,\\,state,locs,v')\\EvalExpr \\v=v')\"\napply (erule EvalExpr.induct)\napply auto\napply (erule EvalExpr.cases,auto)\napply (erule EvalAtom_is_deterministic,auto)\napply (erule EvalExpr.cases,auto)\napply (subgoal_tac \"ASPInt i=ASPInt ia\")\napply (subgoal_tac \"ASPInt i'=ASPInt i'a\")\napply force\napply (erule EvalAtom_is_deterministic,force)\napply (erule EvalAtom_is_deterministic,force)\ndone\n\nabbreviation emptyEC::EContext\nwhere \"emptyEC == (empty,[])\"\nabbreviation ExprAORef where\n\"ExprAORef \\\\Expr (At(Val (ActRef \\)))\"\nabbreviation ExprFutRef where\n\"ExprFutRef f\\Expr (At(Val (FutRef f)))\"\n\ninductive reduction :: \"Program\\[Configuration, Configuration] => bool\" (\"_\\_\\_\" 50)\n where\n Serve [simp, intro!]: \n \"\\(Activities \\) = Some (AO C state None s (R#Rq)) ; \n R= (f,m,vl);\n Bind P C m vl = Some Ec\\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C state (Some R) Ec Rq))) Futures\" \n|\n AssignLocal [simp, intro!]: \n \"\\Activities \\ = Some(AO C state (Some R) Ec Rq); \n Ec= (locs,(x=\\<^sub>AExpr e);;Stl);\n x\\dom locs ; (e,\\,state, locs,v)\\EvalExpr\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C state (Some R) (locs(x\\v),Stl) Rq))) Futures\" \n|\nAssignField [simp, intro!]: \n \"\\Activities \\ = Some(AO C state (Some R) Ec Rq); \n Ec= (locs,(x=\\<^sub>AExpr e);;Stl);\n x\\dom locs; x\\dom(state); \n (e,\\,state, locs,v)\\EvalExpr\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C (state(x\\v)) (Some R) (locs,Stl) Rq))) Futures\"\n |\n NewActive [simp, intro!]: \n \"\\Activities \\ = Some(AO C state (Some R) Ec Rq); \n Ec= (locs,(x=\\<^sub>AnewActive C'(el));;Stl); \n fields P C=field_list; \n \\\\dom Activities; \n length field_list = length el; length field_list = length value_list; \n \\ i,state, locs,value_list!i)\\EvalExpr ;\n state'=(map_of (zip field_list value_list))\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\(AO C state (Some R) (locs,x=\\<^sub>A(ExprAORef \\);;Stl) Rq))\n (\\\\ (AO C' state' None emptyEC []))) \n Futures\" \n (* new term to evaluate is artificially complex because obj ref has to be encapsulated in a value and an expression*)\n\n|\n\n InvkActive [simp, intro!]: \n \"\\Activities \\ = Some (AO C state (Some R) (locs,(x=\\<^sub>A(e.\\<^sub>Am(el));;Stl)) Rq); \n Activities \\ = Some (AO C\\<^sub>\\ state\\<^sub>\\ R\\<^sub>\\ Ec\\<^sub>\\ Rq\\<^sub>\\); \n \\\\\\;\n (e,\\,state, locs,ActRef \\)\\EvalAtom;\n f\\dom Futures; \n length value_list = length el; \n \\ i,state, locs,value_list!i)\\EvalExpr) ;\n Some T=ReturnType P m C\\<^sub>\\\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C state (Some R) (locs,(x=\\<^sub>AExprFutRef f);;Stl) Rq))\n (\\\\ (AO C\\<^sub>\\ state\\<^sub>\\ R\\<^sub>\\ Ec\\<^sub>\\ (Rq\\<^sub>\\@[(f,m,value_list)])) )) \n (Futures(f\\(GetBasicType T,Undefined)))\"\n (* new term to evaluate is artificially complex because fut ref has to be encapsulated in a value and an expression*)\n|\n InvkActive_Self [simp, intro!]: \n \"\\Activities \\ = Some (AO C state (Some R) Ec Rq); \n Ec= (locs,(x=\\<^sub>A(e.\\<^sub>Am(el));;Stl));\n (e,\\,state, locs,ActRef \\)\\EvalAtom;\n f\\dom Futures; \n length value_list = length el; \n \\ i,state, locs,value_list!i)\\EvalExpr) ;\n Some T=ReturnType P m C\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C state (Some R) (locs,(x=\\<^sub>AExprFutRef f);;Stl) (Rq@[(f,m,value_list)]))) ) \n (Futures(f\\(GetBasicType T,Undefined)))\"\n (* new term to evaluate is artificially complex because fut ref has to be encapsulated in a value and an expression*)\n|\n ReturnRequest [simp, intro!]: \n \"\\Activities \\ = Some (AO C state (Some R) Ec Rq); \n Ec= (locs,(return e;;Stl)); R=(f,m,vl);\n (e,\\,state, locs,v)\\EvalExpr ;\n Futures f =Some (T,Undefined)\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\(AO C state None emptyEC Rq))) (Futures(f\\(T,FutVal v) ))\" \n\n(************************** AUTOMATIC UPDATE **************************************)\n(*|\n UpdateFuture_state [simp, intro!]: \n \"\\Activities \\ = Some (AO C state R Ec Rq);\n Futures f = Some (T,FutVal v); \n state x = Some (FutRef f)\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C (state(x\\v)) R Ec Rq))) Futures\" \n|\n UpdateFuture_locs [simp, intro!]: \n \"\\Activities \\ = Some (AO C state R (locs, Stl) Rq);\n Futures f = Some (T,FutVal v); \n locs x = Some (FutRef f)\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C state R (locs(x\\v),Stl) Rq))) Futures\" *)\n\n(***************** GET ***************************)\n|\n GetRetrieve [simp, intro!]: \n \"\\Activities \\ = Some (AO C state (Some R) Ec Rq);\n Ec= (locs,(x=\\<^sub>AGet z);;Stl); \n (z,\\,state, locs,(FutRef f))\\EvalAtom;\n Futures f = Some (T,FutVal v)\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\(AO C state (Some R) (locs,(x=\\<^sub>AGet ( (Val v)));;Stl) Rq))) Futures\" \n|\n GetResolved [simp, intro!]: \n \"\\Activities \\ = Some (AO C state (Some R) Ec Rq);\n Ec= (locs,(x=\\<^sub>AGet e);;Stl); \n (Var (Id y),\\,state, locs,v)\\EvalAtom;\n \\ (\\ f. (v=FutRef f))\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\(AO C state (Some R) (locs,(x=\\<^sub>AExpr(At(Val v)));;Stl) Rq))) Futures\" \n|\n IfThenElseTrue [simp, intro!]: \n \"\\Activities \\ = Some(AO C state (Some R) Ec Rq); \n Ec= (locs,(IF e THEN s\\<^sub>t ELSE s\\<^sub>e);;Stl);\n (e,\\,state, locs,ASPBool True)\\EvalAtom\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C (state(x\\v)) (Some R) (locs,s\\<^sub>t@Stl) Rq))) Futures\"\n\n|\n IfThenElseFalse [simp, intro!]: \n \"\\Activities \\ = Some(AO C state (Some R) Ec Rq); \n Ec= (locs,(IF e THEN s\\<^sub>t ELSE s\\<^sub>e);;Stl);\n (e,\\,state, locs,ASPBool False)\\EvalAtom\n \\ \n \\ P\\Cn Activities Futures \n \\Cn (Activities(\\\\ (AO C (state(x\\v)) (Some R) (locs,s\\<^sub>e@Stl) Rq))) Futures\" \n\ndefinition emptyObjClass where\n\"emptyObjClass \\ \n\\Name = ''EmptyObjectClass'',\n ClassParameters=[],\n Methods=[]\n\\\"\n\ndefinition MainMethodEmptyBody where (* for typing *)\n\" MainMethodEmptyBody Vars \\\n\\MethSignature= Method (BType Integer) ''main'' [] ,\nLocalVariables= Vars ,\nBody =[]\n\\\n\"\n\ndefinition MainObjClass where\n\"MainObjClass Vars\\ \n\\Name = ''MainClass'',\n ClassParameters=[],\n Methods=[(MainMethodEmptyBody Vars)]\n\\\"\n\nabbreviation \"EmptyConfig \\ Cn empty empty\"\n\ndefinition BuildInitialConfigurationfromVarsStl:: \"((ASPType * VarName) list) \\Statement list\\ Configuration\"\nwhere\n \"BuildInitialConfigurationfromVarsStl vl stl \\ Cn (empty(0\\(AO (''MainClass'') (empty) \n (Some(0,''main'',[])) (map_of (map (\\ v. (snd v,Initialisation_from_ASPType (fst v))) vl),stl) [])))\n (empty(0\\(Integer,Undefined)))\"\n\ndefinition InitialConfiguration:: \"Program \\Configuration\"\nwhere \n\" InitialConfiguration prog \\ case prog of (Prog CL Vars Stl) \\ BuildInitialConfigurationfromVarsStl (Vars) Stl\" \n\n\nend\n", "meta": {"author": "lhenrio", "repo": "DFEcplicitFuturesinIsabelle", "sha": "a53fe1cbcabf14481577d37778041f76685417e8", "save_path": "github-repos/isabelle/lhenrio-DFEcplicitFuturesinIsabelle", "path": "github-repos/isabelle/lhenrio-DFEcplicitFuturesinIsabelle/DFEcplicitFuturesinIsabelle-a53fe1cbcabf14481577d37778041f76685417e8/gASPFutures.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.3345894478883556, "lm_q1q2_score": 0.18681031585791383}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__1_on_rules imports n_german_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3593641588823761, "lm_q1q2_score": 0.18669734288477402}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory GraphRefine\n\nimports\n TailrecPre\n GraphLangLemmas\n \"CLib.LemmaBucket_C\"\n ExtraSpecs\nbegin\n\ntype_synonym ('s, 'x, 'e) c_trace = \"nat \\ (('s, 'x, 'e) com \\ ('s, 'e) xstate) option\"\n\ndefinition\n c_trace :: \"('x \\ ('s, 'x, 'e) com option) \\ ('s, 'x, 'e) c_trace set\"\nwhere\n \"c_trace Gamma = nat_trace_rel (Not o final) {(cfg, cfg'). step Gamma cfg cfg'}\"\n\ndefinition\n \"exec_final_step cfg = (case cfg of (Throw, Normal xs) \\ Abrupt xs | _ \\ snd cfg)\"\n\nlemma exec_via_trace:\n \"Gamma \\ \\com, Normal s\\ \\ xs\n = (\\tr \\ c_trace Gamma. tr 0 = Some (com, Normal s)\n \\ option_map exec_final_step (trace_end tr) = Some xs)\"\nproof -\n have dom_If: \"\\n f. dom (\\i. if i \\ n then Some (f i) else None) = {..n}\"\n by (auto split: if_split_asm)\n have end_If: \"\\n f. trace_end (\\i. if i \\ n then Some (f i) else None) = Some (f n)\"\n apply (simp add: trace_end_def dom_If)\n apply (subst Max_eqI, simp+)\n apply (rule_tac x=\"Suc n\" in exI, simp)\n done\n show ?thesis unfolding c_trace_def\n apply safe\n apply (clarsimp simp: relpowp_fun_conv dest!: exec_impl_steps rtranclp_imp_relpowp)\n apply (rule_tac x=\"\\i. if i \\ n then Some (f i) else None\" in bexI)\n apply (simp add: end_If exec_final_step_def split: xstate.split_asm)\n apply (simp add: nat_trace_rel_def)\n apply (clarsimp simp: linorder_not_le less_Suc_eq)\n apply (simp add: final_def split: xstate.split_asm)\n apply (drule(1) trace_end_SomeD)\n apply clarsimp\n apply (subgoal_tac \"rtranclp (step Gamma) (the (tr 0)) (the (tr n))\")\n apply (clarsimp simp: final_def)\n apply (auto simp: exec_final_step_def dest: steps_Skip_impl_exec steps_Throw_impl_exec)[1]\n apply (simp add: rtranclp_power relpowp_fun_conv)\n apply (rule_tac x=n in exI)\n apply (rule_tac x=\"the o tr\" in exI)\n apply (frule(1) trace_None_dom_eq)\n apply (clarsimp simp: nat_trace_rel_def)\n apply (subgoal_tac \"i \\ dom tr \\ Suc i \\ dom tr\")\n apply clarify\n apply metis\n apply (drule(1) eqset_imp_iff[THEN iffD1, rotated, OF domI])+\n apply simp\n done\nqed\n\nabbreviation\n \"extend_rel \\ {((i :: nat, tr), (j, tr')).\n j > i \\ restrict_map tr {.. i} = restrict_map tr' {.. i}}\"\n\ndefinition\n \"suffix_tuple_closure_inter Ss\n = (\\S \\ Ss. {(y, tr). \\k. (y, restrict_map tr {.. k}) \\ S})\"\n\nlemma suffix_tuple_closure_prefixI:\n \"(y, restrict_map tr {.. (k :: nat)}) \\ suffix_tuple_closure_inter Ss\n \\ (y, tr) \\ suffix_tuple_closure_inter Ss\"\n by (auto simp add: suffix_tuple_closure_inter_def)\n\ndefinition\n trace_end_match :: \"(state \\ 's \\ bool) \\ 's set\n \\ stack option\n \\ ((('s, 'x, 'e) com \\ ('s, 'e) xstate) option)\n \\ bool\"\nwhere\n \"trace_end_match out_eqs I e e' = ((\\ft. e' = Some (com.Skip, Fault ft))\n \\ ((e = None) \\ (e' = None))\n \\ (\\sst' gst' gf'. e = Some [(Ret, gst', gf')]\n \\ e' = Some (com.Skip, Normal sst')\n \\ out_eqs gst' sst' \\ sst' \\ I))\"\n\ndefinition\n simpl_to_graph :: \"('x \\ ('s, 'x, 'e) com option)\n \\ (string \\ graph_function option) \\ string\n \\ next_node \\ ('s, 'x, 'e) com\n \\ nat \\ (trace \\ ('s, 'x, 'e) c_trace) set list\n \\ 's set \\ 's set \\ (state \\ 's \\ bool)\n \\ (state \\ 's \\ bool)\n \\ bool\"\nwhere\n \"simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\n = (\\tr gst sst n' gf' tr' n''. tr n' = Some [(nn, gst, gf')] \\ sst \\ P \\ sst \\ I\n \\ inp_eqs gst sst \\ n' \\ n \\ n'' \\ n\n \\ tr \\ exec_trace GGamma gf\n \\ (tr, restrict_map tr' {.. n''}) \\ suffix_tuple_closure_inter (set traces)\n \\ tr' \\ nat_trace_rel (\\x. False) {(cfg, cfg'). step SGamma cfg cfg'}\n \\ tr' n'' = Some (com, Normal sst)\n \\ (\\tr''. tr'' \\ c_trace SGamma \\ restrict_map tr'' {.. n''} = restrict_map tr' {.. n''}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr'')))\"\n\nlemma simpl_to_graph_ge_subset:\n \"simpl_to_graph SGamma GGamma gf nn com n traces' P I inp_eqs out_eqs\n \\ n' \\ n \\ set traces' \\ set traces\n \\ simpl_to_graph SGamma GGamma gf nn com n' traces P I inp_eqs out_eqs\"\n apply (simp add: simpl_to_graph_def suffix_tuple_closure_inter_def Ball_def)\n apply (erule mp[rotated], intro all_mono ex_mono imp_mono conj_mono imp_refl,\n simp_all)\n apply blast\n done\n\nlemmas simpl_to_graphI = simpl_to_graph_def[THEN iffD2, rule_format]\nlemmas simpl_to_graphD = simpl_to_graph_def[THEN iffD1, rule_format]\n\nlemma nat_trace_rel_split:\n \"tr n = Some v\n \\ tr' (Suc n) = Some v'\n \\ (v, v') \\ R\n \\ tr \\ nat_trace_rel cont' R\n \\ (\\i. tr' (Suc n + i)) \\ nat_trace_rel cont R\n \\ (\\i. if i \\ n then tr i else tr' i) \\ nat_trace_rel cont R\"\n apply (frule(1) trace_Some_dom_superset)\n apply (clarsimp simp: nat_trace_rel_def, safe)\n apply (simp_all add: linorder_not_le less_Suc_eq_le subset_iff domIff)\n apply (drule_tac x=\"na - Suc n\" in spec | clarsimp)+\n done\n\nlemma nat_trace_rel_to_relpow:\n \"trace \\ nat_trace_rel cont R\n \\ trace i = Some x\n \\ trace (i + j) = Some y\n \\ (x, y) \\ R ^^ j\"\n apply (induct j arbitrary: y)\n apply simp\n apply atomize\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=\"i + j\" in spec, clarsimp)\n apply auto\n done\n\nlemma exec_graph_trace_must_take_steps:\n \"trace \\ exec_trace \\ fn\n \\ trace i = Some [(nn, st, fn)]\n \\ (exec_graph_step \\ ^^ j) `` {[(nn, st, fn)]} \\ {[(nn', st', fn)]}\n \\ \\k < j. \\st'. ([(nn, st, fn)], st') \\ exec_graph_step \\ ^^ k\n \\ continuing st'\n \\ trace (i + j) = Some [(nn', st', fn)]\"\n apply (case_tac \"trace (i + j)\")\n apply (clarsimp simp add: exec_trace_def)\n apply (drule(1) trace_None_dom_eq)\n apply clarsimp\n apply (drule sym[where s=\"dom trace\"])\n apply (frule_tac x=i in eqset_imp_iff)\n apply (frule_tac x=\"n' - 1\" in eqset_imp_iff)\n apply (frule_tac x=\"n'\" in eqset_imp_iff)\n apply (simp(no_asm_use), clarsimp simp: domIff)\n apply (frule_tac i=\"n' - 1\" in trace_end_eq_Some, simp+)\n apply (drule(1) trace_end_SomeD, clarsimp)\n apply (drule_tac x=\"n' - 1 - i\" in spec, simp)\n apply (drule_tac i=i and j=\"n' - 1 - i\" in nat_trace_rel_to_relpow, simp+)\n apply (clarsimp simp add: exec_trace_def)\n apply (drule_tac i=i and j=j in nat_trace_rel_to_relpow, simp+)\n apply auto\n done\n\nlemma c_trace_may_extend:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ ((step \\) ^^ j) (com, Normal st) (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (cases \"j = 0\")\n apply fastforce\n apply (clarsimp simp: relpowp_fun_conv)\n apply (rule_tac x=\"\\k. if k \\ i then trace k else\n if k \\ i + j then Some (f (k - i))\n else None\"\n in exI)\n apply (intro conjI)\n apply (erule nat_trace_rel_split, simp, simp_all)\n apply (drule_tac x=0 in spec, simp)\n apply (simp add: nat_trace_rel_def)\n apply (simp add: restrict_map_def cong: if_cong)\n apply (rule_tac k=i in suffix_tuple_closure_prefixI)\n apply (simp add: restrict_map_def cong: if_cong)\n done\n\nlemma c_trace_may_extend_steps:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ \\ \\ (com, Normal st) \\\\<^sup>* (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\j trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (clarsimp simp: rtranclp_power)\n apply (blast intro: c_trace_may_extend)\n done\n\nlemma restrict_map_prefix_eq: \"(restrict_map tr {..n} = restrict_map tr' {..n})\n = (\\i \\ n. tr i = tr' i)\"\n by (auto simp add: fun_eq_iff restrict_map_def)\n\nlemma restrict_map_eq_mono:\n \"i \\ j \\ restrict_map tr {..j} = restrict_map tr' {..j}\n \\ restrict_map tr {.. (i :: 'a :: linorder)} = restrict_map tr' {..i}\"\n unfolding restrict_map_prefix_eq\n by clarsimp\n\nlemma simpl_to_graph_step_general:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. ((step SGamma) ^^ j) (com, Normal sst) (com', Normal sst')\n \\ (exec_graph_step GGamma ^^ i) `` {[(nn, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ (\\k < i. \\st'. ([(nn, gst, gf)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (n + min i j) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graphI)\n apply (erule_tac x=sst in meta_allE)\n apply (erule_tac x=gst in meta_allE)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_invariant_Cons)\n apply (frule(2) exec_graph_trace_must_take_steps)\n apply simp\n apply (frule(3) c_trace_may_extend)\n apply clarsimp\n apply (drule_tac n''=\"n'' + j\" in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (metis restrict_map_eq_mono[OF le_add1[where m=j]])\n done\n\nlemma simpl_to_graph_step:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ exec_graph_step GGamma `` {[(NextNode m, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (Suc n) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=1 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst sst')\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=0 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R_unchanged:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ (step SGamma) (com, Normal sst) (com', Normal sst))\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (erule simpl_to_graph_step_R[rotated])\n apply blast\n done\n\nlemma simpl_to_graph_steps_Fault1:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn com n Q P I eqs out_eqs\"\n apply (clarsimp simp: simpl_to_graph_def)\n apply (drule_tac x=sst in bspec, clarsimp+)\n apply (cut_tac \\=SGamma and c=\"com'\" and f=F in steps_Fault)\n apply (frule_tac c_trace_may_extend_steps, assumption)\n apply (erule(1) rtranclp_trans)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n done\n\nlemma extensible_traces_to_infinite_trace:\n assumes step: \"\\x \\ S. (trace x, trace (f x)) \\ extend_rel\n \\ f x \\ S \\ m x < m (f x)\"\n and x: \"x \\ S\"\n shows \"\\tr. \\i :: nat. \\y \\ S. \\j. m y > i \\ fst (trace y) > i\n \\ (trace y, (j, tr)) \\ extend_rel\"\nproof -\n\n let ?f = \"\\i. (f ^^ i) x\"\n\n have f_induct: \"\\i. m (?f i) \\ i \\ fst (trace (?f i)) \\ i \\ ?f i \\ S\"\n apply (induct_tac i)\n apply (simp add: x)\n apply (auto dest: step[rule_format])\n done\n\n have f_eq: \"\\i j k. i \\ fst (trace (?f j)) \\ j \\ k\n \\ fst (trace (?f j)) \\ fst (trace (?f k)) \\ snd (trace (?f k)) i = snd (trace (?f j)) i\"\n apply (intro allI, induct_tac k)\n apply simp\n apply clarsimp\n apply (cut_tac i=n in f_induct[rule_format], clarsimp)\n apply (frule_tac step[rule_format])\n apply (clarsimp simp: fun_eq_iff restrict_map_def linorder_not_le split_def\n split: if_split_asm)\n apply (drule_tac x=i in spec)\n apply (auto simp: le_Suc_eq)\n done\n\n have f_norm:\n \"\\i j. j \\ fst (trace (?f i)) \\ snd (trace (?f i)) j = snd (trace (?f j)) j\"\n apply clarsimp\n apply (cut_tac i=j and j=\"min i j\" and k=\"max i j\" in f_eq[rule_format])\n apply (simp add: min_def linorder_not_le f_induct)\n apply simp\n apply (simp add: min_def max_def split: if_split_asm)\n done\n\n show \"?thesis\"\n apply (rule_tac x=\"\\i. snd (trace (?f i)) i\" in exI)\n apply (clarsimp simp: split_def)\n apply (rule_tac x=\"?f (Suc i)\" in bexI)\n apply (cut_tac i=\"Suc i\" in f_induct)\n apply (clarsimp simp: fun_eq_iff restrict_map_def f_norm\n simp del: funpow.simps)\n apply (metis lessI)\n apply (simp add: f_induct del: funpow.simps)\n done\nqed\n\nlemma extensible_traces_to_infinite_trace_choice:\n assumes step: \"\\x \\ S. \\y. (trace x, trace y) \\ extend_rel\n \\ y \\ S \\ m x < m y\"\n and x: \"x \\ S\"\n shows \"\\tr. \\i :: nat. \\y \\ S. \\j. m y > i \\ fst (trace y) > i\n \\ (trace y, (j, tr)) \\ extend_rel\"\nproof -\n\n let ?P = \"\\i x. m x \\ i \\ fst (trace x) \\ i \\ x \\ S\"\n let ?Q = \"\\x y. m y > m x \\ (trace x, trace y) \\ extend_rel\"\n\n have induct:\n \"\\x n. ?P n x \\ \\y. ?P (Suc n) y \\ ?Q x y\"\n apply clarsimp\n apply (frule step[THEN bspec])\n apply clarsimp\n apply (rule_tac x=y in exI)\n apply simp\n done\n\n obtain f where f: \"\\n. ?P n (f n) \\ ?Q (f n) (f (Suc n))\"\n using x dependent_nat_choice[where P=\"?P\" and Q=\"\\_. ?Q\"]\n by (simp only: induct, auto)\n\n have f_induct: \"\\i. m (f i) \\ i \\ fst (trace (f i)) \\ i \\ f i \\ S\"\n apply (cut_tac n=i in f[rule_format], simp)\n done\n\n have f_eq: \"\\i j k. i \\ fst (trace (f j)) \\ j \\ k\n \\ fst (trace (f j)) \\ fst (trace (f k)) \\ snd (trace (f k)) i = snd (trace (f j)) i\"\n apply (intro allI, induct_tac k)\n apply simp\n apply clarsimp\n apply (cut_tac i=n in f_induct[rule_format], clarsimp)\n apply (cut_tac n=n in f[rule_format], simp)\n apply (clarsimp simp: fun_eq_iff restrict_map_def linorder_not_le split_def\n split: if_split_asm)\n apply (drule_tac x=i in spec)\n apply (auto simp: le_Suc_eq)\n done\n\n have f_norm:\n \"\\i j. j \\ fst (trace (f i)) \\ snd (trace (f i)) j = snd (trace (f j)) j\"\n apply clarsimp\n apply (cut_tac i=j and j=\"min i j\" and k=\"max i j\" in f_eq[rule_format])\n apply (simp add: min_def linorder_not_le f_induct)\n apply simp\n apply (simp add: min_def max_def split: if_split_asm)\n done\n\n show \"?thesis\"\n apply (rule_tac x=\"\\i. snd (trace (f i)) i\" in exI)\n apply (clarsimp simp: split_def)\n apply (rule_tac x=\"f (Suc i)\" in bexI)\n apply (cut_tac i=\"Suc i\" in f_induct)\n apply (clarsimp simp: fun_eq_iff restrict_map_def f_norm\n simp del: funpow.simps)\n apply (metis lessI)\n apply (simp add: f_induct del: funpow.simps)\n done\nqed\n\nlemma trace_end_None_ge_seq:\n \"tr \\ nat_trace_rel c R\n \\ \\i. \\j \\ i. tr j \\ None\n \\ trace_end tr = None\"\n apply (clarsimp simp: trace_end_def)\n apply (drule_tac x=n in spec)\n apply (drule(1) trace_None_dom_subset)\n apply auto\n done\n\nlemma restrict_map_eq_Some_le:\n \"(restrict_map tr {..n} = restrict_map tr' {..m})\n \\ tr' (m :: nat) = Some v\n \\ n \\ m \\ (\\k \\ m. restrict_map tr {..k} = restrict_map tr' {..k})\"\n apply (frule_tac x=m in fun_cong, simp(no_asm_use) add: restrict_map_def)\n apply (simp split: if_split_asm)\n apply (auto simp: fun_eq_iff split: if_split_asm)\n done\n\nlemma trace_prefixes_to_trace:\n assumes i: \"\\i. \\j tr k. j \\ i \\ tr j \\ None\n \\ ((j, tr), (k, tr')) \\ extend_rel \\ tr \\ nat_trace_rel c R\"\n shows \"trace_end tr' = None \\ tr' \\ nat_trace_rel c' R\"\nproof (intro conjI)\n have weak: \"tr' \\ nat_trace_rel (\\x. False) R\"\n apply (clarsimp simp: nat_trace_rel_def)\n apply (cut_tac i=\"Suc n\" in i[rule_format])\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=n in spec, clarsimp)\n apply (clarsimp simp: restrict_map_prefix_eq)\n done\n\n have inf: \"\\i. tr' i \\ None\"\n apply (intro allI notI)\n apply (cut_tac i=i in i[rule_format])\n apply (clarsimp simp: restrict_map_prefix_eq)\n apply (drule trace_None_dom_subset[OF _ weak])\n apply auto\n done\n\n thus \"trace_end tr' = None\"\n by (simp only: trace_end_def, simp)\n\n show \"tr' \\ nat_trace_rel c' R\" using weak\n by (simp only: nat_trace_rel_def inf mem_Collect_eq, simp)\nqed\n\nlemma suffix_tuple_closure_inter_insert:\n \"(x, tr) \\ suffix_tuple_closure_inter (insert S Ss)\n = ((\\k. (x, restrict_map tr {..k}) \\ S) \\ (x, tr) \\ suffix_tuple_closure_inter Ss)\"\n by (simp add: suffix_tuple_closure_inter_def)\n\nlemma simpl_to_graph_induct_proof:\n assumes Suc: \"\\S' n'. n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com (Suc n') (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n (({tr} \\ UNIV) # S) P I inp_eqs out_eqs\"\nproof -\n obtain M where M_def:\n \"M = (\\n1 tr1. {(n', n'', tr'). tr' \\ nat_trace_rel (\\x. False) {(x, y). SGamma\\ x \\ y}\n \\ (\\sst gst gf'. tr' n'' = Some (com, Normal sst) \\ tr n' = Some [(nn, gst, gf')]\n \\ inp_eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ (tr, restrict_map tr' {..n''}) \\ suffix_tuple_closure_inter (set S)\n \\ restrict_map tr' {..n1} = restrict_map tr1 {..n1}\n \\ n' \\ n \\ n'' \\ n \\ n'' \\ n1)})\"\n by auto\n\n have induct_ge: \"\\S' m n'. m \\ n \\ simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n'\n \\ n' \\ n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n apply (erule(1) inc_induct)\n apply clarsimp\n apply (erule(1) Suc)\n done\n\n hence ge: \"\\S' m n'. simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n' \\ n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n by auto\n\n have terminating_case: \"\\i j orig_tr' n1 tr1. (i, j, orig_tr') \\ M n1 tr1\n \\ tr \\ exec_trace GGamma gf\n \\ \\v' \\ M n1 tr1. fst v' > i \\ ((j, orig_tr'), snd v') \\ extend_rel\n \\ \\tr'. tr' \\ c_trace SGamma\n \\ restrict_map tr' {..j} = restrict_map orig_tr' {..j}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr')\"\n apply (cut_tac n'=\"min i j\" and m=\"Suc (max i j)\"\n and S'=\"{tr} \\ {restrict_map orig_tr' {..j}}\" in ge)\n apply (clarsimp simp: M_def simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (erule_tac x=n' in allE, erule_tac x=n'' in allE, erule_tac x=tr' in allE)\n apply (simp add: Suc_le_eq)\n apply (drule(1) restrict_map_eq_Some_le)\n apply simp\n apply simp\n apply (clarsimp simp: M_def)\n apply (clarsimp simp: M_def)\n apply (erule_tac n''=j and tr'=orig_tr' in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply (metis min.idem)\n apply simp\n done\n\n have infinite_case:\n \"\\v' n1 tr1. \\v \\ M n1 tr1. \\v' \\ M n1 tr1. fst v' > fst v \\ (snd v, snd v') \\ extend_rel\n \\ tr \\ exec_trace GGamma gf\n \\ v' \\ M n1 tr1\n \\ \\tr'. trace_end tr = None\n \\ restrict_map tr' {.. n1} = restrict_map tr1 {.. n1}\n \\ trace_end tr' = None\n \\ tr' \\ c_trace SGamma\"\n apply (drule extensible_traces_to_infinite_trace_choice[where\n trace=snd and m=fst, rotated])\n apply (rule ballI, drule(1) bspec)\n apply fastforce\n apply (erule exE, rename_tac tr')\n apply (rule_tac x=tr' in exI)\n apply (rule conjI)\n apply (rule trace_end_None_ge_seq)\n apply (auto simp add: exec_trace_def)[1]\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n apply (clarsimp simp: c_trace_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n1 in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n apply (rule trace_prefixes_to_trace)\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n done\n\n show ?thesis\n apply (clarsimp simp: simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (case_tac \"(\\v \\ M n'' tr'. \\v' \\ M n'' tr'. fst v' > fst v \\ (snd v, snd v') \\ extend_rel)\")\n apply (drule(1) infinite_case)\n apply (fastforce simp add: M_def)\n apply (fastforce simp: trace_end_match_def)\n apply clarsimp\n apply (frule(1) terminating_case, simp)\n apply (clarify, rename_tac soln_tr', rule_tac x=soln_tr' in exI)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n'' in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n done\nqed\n\nlemma simpl_to_graph_induct:\n assumes Suc: \"\\S' k. simpl_to_graph SGamma GGamma gf nn com (Suc n + k) (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com (n + k) (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n S P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (cut_tac tr=tr and n=n and S=S in simpl_to_graph_induct_proof)\n apply (cut_tac S'=S' and k=\"n'a - n\" in Suc)\n apply simp+\n apply (erule simpl_to_graphD)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply blast\n done\n\ndefinition\n \"eq_impl addr eqs eqs2 S = (\\gst sst. eqs gst sst \\ sst \\ S \\ eqs2 gst sst)\"\n\nlemma eq_implD:\n \"\\ eq_impl addr eqs eqs2 S; eqs gst sst; sst \\ S \\\n \\ eqs2 gst sst\"\n by (simp add: eq_impl_def)\n\nlemma simpl_to_graph_cases:\n \"simpl_to_graph SGamma GGamma gf nn com n traces (P \\ S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces (P \\ - S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (case_tac \"sst \\ S\")\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ S\"] Compl_iff Int_iff)\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ - S\"] Compl_iff Int_iff)\n done\n\nlemma exec_graph_step_image_node:\n \"GGamma f = Some gf \\ function_graph gf n = Some node\n \\ exec_graph_step GGamma `` {[(NextNode n, gst, f)]}\n = exec_node GGamma gst node [(NextNode n, gst, f)]\"\n by (cases gf, simp add: exec_graph_step_def)\n\ndefinition\n \"add_cont com conts\n = foldl (\\c d. case d of Inl d' \\ c ;; d' | Inr d' \\ com.Catch c d') com conts\"\n\nlemma add_cont_Cons:\n \"add_cont c (Inl d # cont) = add_cont (c ;; d) cont\"\n \"add_cont c (Inr d # cont) = add_cont (com.Catch c d) cont\"\n by (simp_all add: add_cont_def)\n\nlemma add_cont_Nil:\n \"add_cont c [] = c\"\n by (simp add: add_cont_def)\n\nlemma add_cont_step:\n \"SGamma \\ (com, s) \\ (com', s')\n \\ SGamma \\ (add_cont com con, s) \\ (add_cont com' con, s')\"\n apply (induct con rule: rev_induct)\n apply (simp add: add_cont_def)\n apply (simp add: add_cont_def step.intros split: sum.split)\n done\n\nlemma simpl_to_graph_Cond:\n \"\\ nn = NextNode m; GGamma gf = Some gfc; function_graph gfc m = Some (Cond l r cond);\n eq_impl nn eqs (\\gst sst. l \\ r \\ cond gst = (sst \\ C)) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I \\ C);\n simpl_to_graph SGamma GGamma gf l (add_cont c con) (Suc n) Q (P \\ C) I eqs2 out_eqs;\n eq_impl nn eqs eqs3 (P \\ I \\ (- C));\n simpl_to_graph SGamma GGamma gf r (add_cont d con) (Suc n) Q (P \\ - C) I eqs3 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Cond C c d) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (erule_tac nn'=l in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n apply (erule_tac nn'=r in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n done\n\nlemma simpl_to_graph_weaken[rotated]:\n assumes eqs: \"\\gst sst. eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ eqs2 gst sst \\ sst \\ Q\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n tS Q I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n using eqs\n apply (clarsimp simp add: simpl_to_graph_def)\n apply blast\n done\n\nlemma simpl_to_graph_weaken_eq_impl:\n \"eq_impl nn eqs eqs2 (I \\ P)\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_While_lemma:\n assumes ps: \"GGamma f = Some gf\" \"nn = NextNode m\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ P)\"\n assumes loop: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) P I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (P \\ C) I eqs out_eqs\"\n assumes exitloop: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (P \\ (- C)) I eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_induct)\n apply (simp add: ps)\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule loop)\n apply (simp add: ps)\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule simpl_to_graph_ge_subset)\n apply (rule exitloop)\n apply fastforce\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n done\n\nlemma simpl_to_graph_While_inst:\n assumes ps: \"nn = NextNode m\" \"GGamma f = Some gf\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ G)\"\n and ss_eq: \"eq_impl nn eqs eqs2 (I \\ G \\ C)\"\n and ss: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) G I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (G \\ C) I eqs2 out_eqs\"\n and ex_eq: \"eq_impl nn eqs eqs3 (I \\ G \\ - C)\"\n and ex: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (G \\ (- C)) I eqs3 out_eqs\"\n and in_eq: \"eq_impl nn eqs (\\gst sst. sst \\ G) (I \\ G')\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS G' I eqs out_eqs\"\n apply (rule simpl_to_graph_weaken)\n apply (rule simpl_to_graph_While_lemma[where P=G], (rule ps)+)\n apply (rule simpl_to_graph_weaken, erule ss)\n apply (clarsimp simp: ss_eq[THEN eq_implD])\n apply (rule simpl_to_graph_weaken, rule ex)\n apply (clarsimp simp: ex_eq[THEN eq_implD])\n apply (clarsimp simp: in_eq[THEN eq_implD])\n done\n\nlemma use_simpl_to_graph_While_assum:\n \"\\ simpl_to_graph SGamma GGamma f nn com n tS P I eqs out_eqs;\n n \\ n' \\ set tS \\ set tS';\n eq_impl nn eqs (\\gst sst. sst \\ P) (Q \\ I) \\\n \\ simpl_to_graph SGamma GGamma f nn com n' tS' Q I eqs out_eqs\"\n apply (erule simpl_to_graph_ge_subset[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (auto simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_Skip_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Skip con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Skip\n = simpl_to_graph_Skip_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Throw_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Throw con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Throw\n = simpl_to_graph_Throw_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Seq:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (c ;; d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inl d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma simpl_to_graph_Catch:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (com.Catch c d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inr d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma no_next_step: \"eq_impl nn' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 0) `` {[(nn, gst', fn)]} \\ {[(nn, gst', fn)]}\n \\ (\\k < (0 :: nat). \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n by (simp add: eq_impl_def)\n\nlemma basic_next_step: \"GGamma fn = Some gf \\ function_graph gf m = Some (Basic nn' upds)\n \\ eq_impl nn'' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 1) `` {[(NextNode m, gst', fn)]} \\ {[(nn', upd_vars upds gst', fn)]}\n \\ (\\k < 1. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n apply (clarsimp simp: eq_impl_def simp del: imp_disjL)\n apply (clarsimp simp: exec_graph_step_def K_def split: graph_function.split_asm)\n done\n\nlemma simpl_to_graph_Basic_next_step:\n assumes next_step: \"eq_impl nn eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn, gst', fn)]} \\ {[(nn', f gst', fn)]}\n \\ (\\k < steps. \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) (P \\ I)\"\n shows\n \"\\ eq_impl nn eqs (\\gst sst. eqs2 (f gst) (f' sst) \\ f' sst \\ I \\ f' sst \\ Q) (P \\ I);\n simpl_to_graph SGamma GGamma fn nn' (add_cont com.Skip con) (n + min steps 1) tS Q I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fn nn (add_cont (com.Basic f') con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where j=1 and i=steps, rotated -1])\n apply simp\n apply (frule eq_implD[OF next_step], simp)\n apply (simp add: eq_OO)\n apply (rule exI, rule conjI, blast intro: add_cont_step step.intros)\n apply (auto dest: eq_implD)\n done\n\nlemmas simpl_to_graph_Basic_triv'\n = simpl_to_graph_Basic_next_step[OF no_next_step]\n\nlemmas simpl_to_graph_Basic_triv = simpl_to_graph_Basic_triv'[where f'=\"\\x. x\" and Q=UNIV]\n\nlemmas simpl_to_graph_Basic\n = simpl_to_graph_Basic_next_step[OF basic_next_step, where Q=UNIV]\n\ndefinition\n \"upd_range upd_fun v = range (upd_fun (\\_. v))\"\n\nlemma simpl_to_graph_cbreak:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Break) sst) \\ exn_upd (\\_. Break) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (cbreak exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: cbreak_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Break:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Break \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Skip con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Break) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (blast intro: add_cont_step step.intros)\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Return:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Return \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Return) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (rule add_cont_step step.CondFalse)+\n apply clarsimp\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_creturn_void:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Return) sst) \\ exn_upd (\\_. Return) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (creturn_void exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: creturn_void_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma rtranclp_respects_fun:\n assumes respects: \"\\x y. R x y \\ R (f x) (f y)\"\n shows \"R\\<^sup>*\\<^sup>* x y \\ R\\<^sup>*\\<^sup>* (f x) (f y)\"\n apply (induct rule: rtranclp.induct)\n apply (fastforce intro: respects elim: rtranclp_trans)+\n done\n\nlemma add_cont_steps:\n \"\\ \\ (com, xs) \\\\<^sup>* (com', xs')\n \\ \\ \\ (add_cont com con, xs) \\\\<^sup>* (add_cont com' con, xs')\"\n apply (drule_tac f=\"\\(a, b). (add_cont a con, b)\" in rtranclp_respects_fun[rotated])\n apply clarsimp\n apply (erule add_cont_step)\n apply simp\n done\n\nlemma simpl_to_graph_steps_Fault:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont com con) n Q P I eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graph_steps_Fault1)\n apply (drule_tac x=s in bspec, clarsimp+)\n apply (rule exI)\n apply (erule add_cont_steps)\n done\n\nlemma simpl_to_graph_Guard:\n \"\\ nn = NextNode m; eq_impl nn eqs eqs2 (P \\ I \\ G);\n simpl_to_graph SGamma GGamma gf nn (add_cont c con) n Q (G \\ P) I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Guard F G c) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=G in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step_R_unchanged[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n apply (rule add_cont_step)\n apply (blast intro: step.Guard)\n apply (rule simpl_to_graph_steps_Fault)\n apply (blast intro: step.GuardFault)\n done\n\nlemma simpl_to_graph_done:\n \"\\ eq_impl nn eqs out_eqs (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf Ret (add_cont com.Skip []) n Q P I eqs out_eqs\"\n apply (clarsimp simp: c_trace_def add_cont_Nil intro!: simpl_to_graphI)\n apply (frule_tac i=n' in exec_trace_step_cases)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, simp add: final_def)\n apply (clarsimp simp: trace_end_cut exec_graph_step_def)\n apply (clarsimp simp: exec_trace_def trace_end_eq_Some\n eq_impl_def trace_end_match_def)\n done\n\nlemma eq_impl_refl:\n \"eq_impl nn eqs eqs P\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_done2 = simpl_to_graph_done[OF eq_impl_refl]\nlemmas simpl_to_graph_creturn_void2 = simpl_to_graph_creturn_void[where nn=Ret, OF eq_impl_refl]\n\nlemma simpl_to_graph_noop_Basic:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn upds);\n eq_impl nn eqs (\\gst sst. eqs2 (upd_vars upds gst) sst) (P \\ I);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where i=1 and j=0, rotated])\n apply simp+\n apply (simp add: exec_graph_step_image_node eq_impl_def K_def)\n done\n\nlemma simpl_to_graph_noop:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn []);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs;\n eq_impl nn eqs eqs2 (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (erule(1) simpl_to_graph_noop_Basic, simp_all)\n apply (simp add: upd_vars_def save_vals_def eq_impl_def)\n done\n\nlemmas simpl_to_graph_nearly_done\n = simpl_to_graph_noop[where c=\"add_cont com.Skip []\"]\n\nlemma eq_impl_triv: \"eq_impl nn eqs eqs S\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_noop_same_eqs\n = simpl_to_graph_noop[OF _ _ _ eq_impl_triv]\n\ndefinition\n exec_trace_inputs :: \"graph_function \\ trace \\ variable list\"\nwhere\n \"exec_trace_inputs gfun tr = (case tr 0 of Some [(nn, gst, _)]\n => acc_vars (function_inputs gfun) gst)\"\n\ndefinition\n graph_fun_refines\nwhere\n \"graph_fun_refines SGamma GGamma I inputs proc outputs fname\n = (\\gf. GGamma fname = Some gf \\ length (function_inputs gf) = length inputs\n \\ length (function_outputs gf) = length outputs\n \\ distinct (function_inputs gf)\n \\ (\\tr \\ exec_trace GGamma fname.\n \\s. map (\\i. i s) inputs = exec_trace_inputs gf tr \\ s \\ I\n \\ ((\\ft. SGamma \\ \\com.Call proc, Normal s\\ \\ Fault ft)\n \\ (trace_end tr = None \\ \\ terminates SGamma (com.Call proc) (Normal s))\n \\ (\\gst sst. SGamma \\ \\com.Call proc, Normal s\\ \\ Normal sst\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ sst \\ I \\ map (\\j. j sst) outputs\n = acc_vars (function_outputs gf) gst))))\"\n\nlemma var_acc_var_upd:\n \"var_acc nm (var_upd nm' v st) = (if nm = nm' then v else var_acc nm st)\"\n by (cases st, simp add: var_acc_def var_upd_def)\n\nlemma var_acc_var_upd_same[simp]:\n \"var_acc nm (var_upd nm v st) = v\"\n by (simp add: var_acc_var_upd)\n\nlemma var_acc_var_upd_diff:\n \"nm \\ nm' \\ var_acc nm (var_upd nm' v st) = var_acc nm st\"\n by (simp add: var_acc_var_upd)\n\nlemma fetch_returned:\n \"\\ distinct vs; length vs = length xs \\\n \\ acc_vars vs (save_vals vs xs st) = xs\"\n apply (induct vs arbitrary: xs st)\n apply (simp add: acc_vars_def)\n apply (case_tac xs, simp_all add: save_vals_def acc_vars_def)\n apply (rule_tac P=\"\\st. var_acc a st = b\" and Q=\"\\x. x \\ set xs\" for a b xs\n in fold_invariant, simp)\n apply simp\n apply (clarsimp simp: var_acc_var_upd set_zip)\n done\n\nlemma c_trace_nontermination:\n \"tr \\ c_trace \\\n \\ trace_end tr = None\n \\ tr 0 = Some (com, st)\n \\ \\ terminates \\ com st\"\n apply (frule trace_end_NoneD, simp add: c_trace_def)\n apply (erule disjE)\n apply (clarsimp simp: c_trace_def nat_trace_rel_def)+\n apply (drule terminates_impl_no_infinite_trans_computation)\n apply auto\n done\n\nlemma trace_end_Ret_Err:\n \"trace \\ exec_trace Gamma fname\n \\ trace_end trace = Some v\n \\ \\gst er. v = [(er, gst, fname)] \\ er \\ {Ret, Err}\"\n apply (frule trace_end_SomeD)\n apply (clarsimp simp: exec_trace_def, assumption)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (auto simp: continuing_def exec_graph_invariant_Cons\n split: list.split_asm next_node.split_asm,\n auto simp: exec_graph_invariant_def)\n done\n\nlemma graph_fun_refines_from_simpl_to_graph_with_refine:\n \"\\ SGamma proc = Some com; GGamma fname = Some gf;\n simple_simpl_refines SGamma com' com;\n \\Q. simpl_to_graph SGamma GGamma fname (NextNode (entry_point gf)) (add_cont com' []) 0\n [Q] UNIV I eqs\n (\\s s'. map (\\i. var_acc i s) (function_outputs gf) = map (\\i. i s') outs);\n eq_impl (NextNode (entry_point gf))\n (\\gst sst. map (\\i. var_acc i gst) (function_inputs gf) = map (\\i. i sst) ins)\n eqs I;\n distinct (function_inputs gf); length ins = length (function_inputs gf);\n length outs = length (function_outputs gf) \\\n \\ graph_fun_refines SGamma GGamma I ins proc outs fname\"\n apply (clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_def[THEN eqset_imp_iff, THEN iffD1])\n apply clarsimp\n apply (erule_tac x=\"UNIV \\ {[0 \\ (com', Normal s)]}\" in meta_allE)\n apply (drule_tac tr=tr and tr'=\"[0 \\ (com', Normal s)]\"\n and n'=0 and n''=0 and sst=s in simpl_to_graphD)\n apply (rule conjI, assumption)\n apply (simp add: suffix_tuple_closure_inter_def exec_trace_def)\n apply (rule conjI)\n apply (erule eq_implD)\n apply (simp add: fetch_returned exec_trace_inputs_def acc_vars_def)\n apply simp\n apply (simp add: add_cont_Nil nat_trace_rel_def)\n apply (clarsimp simp: trace_end_match_def dest!: fun_cong[where x=0])\n apply (subgoal_tac \"\\st. trace_end tr'' = Some st\n \\ SGamma \\ \\com.Call proc,Normal s\\ \\ exec_final_step st\")\n apply (elim disjE exE conjE)\n apply (clarsimp simp: exec_final_step_def)\n apply clarsimp\n apply (drule step_preserves_termination[rotated])\n apply (erule step.Call)\n apply (drule simple_simpl_refines_no_fault_terminatesD)\n apply (blast intro: exec.Call)\n apply (simp add: c_trace_nontermination simple_simpl_refines_def)\n apply (frule(1) trace_end_Ret_Err)\n apply (clarsimp simp: exec_final_step_def acc_vars_def)\n apply metis\n apply clarsimp\n apply (rule exec.Call, assumption)\n apply (erule simple_simpl_refines_no_fault_execD[rotated])\n apply (blast intro: exec.Call)\n apply (simp add: exec_via_trace)\n apply metis\n done\n\nlemmas graph_fun_refines_from_simpl_to_graph\n = graph_fun_refines_from_simpl_to_graph_with_refine[OF _ _ simple_simpl_refines_refl]\n\nlemma simpl_to_graph_name_simpl_state:\n \"(\\sst. sst \\ P \\ simpl_to_graph SGamma GGamma gf nn com n traces {sst} I inp_eqs out_eqs)\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n by (simp add: simpl_to_graph_def, blast)\n\nlemma trace_drop_n_init:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr 0\n = Some [(NextNode (entry_point gf'), init_vars (function_inputs gf') inps st, fn')]\"\n apply (frule(1) exec_trace_invariant)\n apply (simp add: exec_graph_invariant_Cons)\n apply (frule_tac tr=tr and i=i in exec_trace_step_cases)\n apply (clarsimp simp: exec_graph_step_def split: graph_function.split_asm)\n apply (simp add: trace_drop_n_def)\n done\n\nlemma trace_drop_n_end:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr \\ exec_trace Gamma fn'\n \\ trace_end (trace_drop_n (Suc i) (Suc 0) tr) = Some [(Ret, st', fn''')]\n \\ \\j \\ 2. tr (i + j) = Some [(nn, return_vars (function_outputs gf') outps st' st, fn)]\"\n apply (frule trace_end_SomeD, (auto simp: exec_trace_def)[1])\n apply clarsimp\n apply (rename_tac j')\n apply (drule(4) exec_trace_drop_n_rest[rotated 2, rule_format], simp)\n apply (frule_tac i=\"Suc (i + j')\" in exec_trace_step_cases)\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_step_def exec_graph_invariant_def\n split: graph_function.split_asm)\n apply (rule_tac x=\"Suc (Suc j')\" in exI, simp)\n done\n\nlemma nontermination_to_c_trace:\n \"tr \\ nat_trace_rel F {(cfg, cfg'). \\ \\ cfg \\ cfg'}\n \\ tr i = Some (add_cont com con, st)\n \\ \\ terminates \\ com st\n \\ \\tr'. tr' \\ c_trace \\ \\ restrict_map tr' {..i} = restrict_map tr {..i}\n \\ trace_end tr' = None\"\n apply (clarsimp simp: terminates_iff_no_infinite_computation inf_def)\n apply (rule_tac x=\"\\j. if j \\ i then tr j else case f (j - i) of\n (com', st') \\ Some (add_cont com' con, st')\" in exI)\n apply (rule conjI)\n apply (simp add: c_trace_def)\n apply (rule nat_trace_rel_split, assumption, simp_all)\n apply (simp add: split_def)\n apply (rule add_cont_step)\n apply (drule spec[where x=0])\n apply simp\n apply (clarsimp simp: nat_trace_rel_def split_def)\n apply (rule add_cont_step, simp)\n apply (frule(1) trace_Some_dom_superset)\n apply (rule conjI)\n apply (simp add: restrict_map_def fun_eq_iff)\n apply (simp only: trace_end_def)\n apply (rule if_not_P)\n apply (simp add: trace_end_def split_def subset_iff domIff)\n done\n\nlemma simpl_to_graph_call_next_step:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n assumes next_step: \"eq_impl nn eqs_inner (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn', gst', p)]} \\ {[(nn'', f gst', p)]}\n \\ (\\k < steps. \\st'. ([(nn', gst', p)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n and rel: \"graph_fun_refines SGamma GGamma I inputs proc outputs p'\"\n and modifies: \"(\\\\. SGamma \\\\<^bsub>/UNIV\\<^esub> {\\} com.Call proc (Q \\)) \\ (Q = (\\_. UNIV))\"\n and init: \"eq_impl nn eqs (\\gst sst. initf sst \\ I\n \\ map (\\i. i gst) args = map (\\i. i (initf sst)) inputs) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\sst' vs. map (\\i. i sst') outputs = vs\n \\ sst' \\ I \\ sst' \\ Q (initf sst)\n \\ eqs2 (f (save_vals rets vs gst))\n (f' sst sst' (ret sst sst')) \\ f' sst sst' (ret sst sst') \\ I\n \\ eqs_inner (save_vals rets vs gst) (f' sst sst' (ret sst sst')))) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn'' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (call initf proc ret (\\x y. com.Basic (f' x y))) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: call_def block_def graph)\n apply (rule_tac i=0 and j=3 and P'=\"{initf sst}\"\n and inp_eqs'=\"\\gst _. eqs gst sst \\ sst \\ I\" in simpl_to_graph_step_general)\n apply (simp add: init[THEN eq_implD] numeral_3_eq_3 eq_OO)\n apply (rule conjI[OF _ refl])\n apply (intro relcomppI)\n apply (rule add_cont_step, rule step.DynCom)\n apply (simp add: add_cont_Cons[symmetric])\n apply (rule add_cont_step, rule step.Basic)\n apply (simp add: add_cont_Cons(1), rule add_cont_step, rule step.SeqSkip)\n apply simp\n apply (clarsimp intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (drule_tac x=\"initf sst\" in spec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def fetch_returned)\n apply (elim disjE exE conjE)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Fault)\n apply (rule steps_Fault)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n apply (frule(2) trace_end_trace_drop_n_None)\n apply (frule(2) nontermination_to_c_trace)\n apply (auto simp: trace_end_match_def)[1]\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Normal)\n apply (simp add: add_cont_Cons)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.CatchMiss exec.Seq exec.Skip exec.DynCom exec.Basic | simp)+\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp, clarsimp)\n apply (drule_tac x=ssta in spec, drule mp, rule conjI, assumption)\n apply (rule disjE[OF modifies])\n apply (drule spec, drule cvalidD[OF hoare_sound], simp+)\n apply clarsimp\n apply auto[1]\n apply simp\n apply clarsimp\n apply (frule next_step[THEN eq_implD], simp)\n apply (clarsimp simp: return_vars_def)\n apply (frule(3) exec_graph_trace_must_take_steps)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"f' a b c\" for a b c in simpl_to_graphD[OF cont])\n apply auto[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemmas simpl_to_graph_call_triv\n = simpl_to_graph_call_next_step[where f'=\"\\x y s. s\",\n where eqs_inner=\"\\_ _. True\", OF _ _ _ no_next_step]\n\nlemmas simpl_to_graph_call\n = simpl_to_graph_call_next_step[OF _ _ _ basic_next_step,\n where eqs_inner=\"\\_ _. True\"]\n\nlemma known_guard_then_basic_next_step:\n \"GGamma fn = Some gf \\ function_graph gf m = Some (node.Cond (NextNode m') Err C)\n \\ GGamma fn = Some gf \\ function_graph gf m' = Some (node.Basic nn'' upds)\n \\ eq_impl nn (\\gst' sst'. C gst') (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 2) `` {[(NextNode m, gst', fn)]} \\ {[(nn'', upd_vars upds gst', fn)]}\n \\ (\\k < 2. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n apply (clarsimp simp: eq_impl_def)\n apply (drule_tac n=m and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (drule_tac n=m' and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (simp add: numeral_2_eq_2 relcomp_Image less_Suc_eq K_def)\n apply (simp add: set_eq_iff)\n done\n\nlemmas simpl_to_graph_call_known_guard\n = simpl_to_graph_call_next_step[OF _ _ _ known_guard_then_basic_next_step]\n\nlemma simpl_to_graph_lvar_nondet_init:\n assumes stg: \"simpl_to_graph SGamma GGamma fname nn (add_cont com.Skip con) n traces UNIV I eqs2 out_eqs\"\n and eqs: \"eq_impl nn eqs (\\gst sst. \\f. eqs2 gst (updf f sst) \\ updf f sst \\ I) (P \\ I)\"\n shows \"simpl_to_graph SGamma GGamma fname nn\n (add_cont (lvar_nondet_init accf updf) con) n traces P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_R[OF _ stg])\n apply (simp add: lvar_nondet_init_def)\n apply (drule eq_implD[OF eqs], simp)\n apply (rule exI, rule conjI, rule add_cont_step)\n apply (rule step.Spec)\n apply simp\n apply (rule_tac x=undefined in exI, simp)\n apply simp\n done\n\nlemmas load_word_defs = load_word32_def load_word64_def\nlemmas store_word_defs = store_word32_def store_word64_def\n\nlemma c_guard_ptr_val_gt_0:\n \"c_guard (p :: ('a :: mem_type) ptr) \\ ptr_val p > 0\"\n apply (simp only: word_neq_0_conv[symmetric], rule notI)\n apply (cases p, simp)\n done\n\nlemma h_val_word8:\n \"h_val hp p = load_word8 (ptr_val p) hp\"\n by (simp add: h_val_def load_word8_def from_bytes_def typ_info_word\n word_rcat_bl)\n\nlemma h_val_word32:\n \"h_val hp p = load_word32 (ptr_val p) hp\"\n by (simp add: h_val_def load_word32_def from_bytes_def typ_info_word)\n\nlemma h_val_word64:\n \"h_val hp p = load_word64 (ptr_val p) hp\"\n by (simp add: h_val_def load_word64_def from_bytes_def typ_info_word)\n\nlemma h_val_ptr:\n \"h_val hp (p :: ('a :: c_type) ptr ptr) = Ptr (load_machine_word (ptr_val p) hp)\"\n by (simp add: h_val_def load_word_defs from_bytes_def typ_info_ptr word_size_def)\n\n(* FIXME: should this go into Word.word_ubin near norm_Rep? *)\nlemma bintrunc_len_eq_signed:\n \"bintrunc LENGTH('a) (uint (x :: 'a :: len signed word)) = uint x\"\n by (metis (full_types) len_signed word_of_int_uint word_ubin.eq_norm)\n\nlemma uint_word_of_int_uint_signed_unsigned:\n \"uint (word_of_int (uint (x :: 'a :: len signed word)) :: 'a word) = uint x\"\n by (simp add: bintrunc_len_eq_signed word_ubin.eq_norm)\n\n(*FIXME: move to lib *)\nlemma is_up_is_down_remove_sign[simp]:\n \"is_up (UCAST('a :: len0 signed \\ 'a))\"\n \"is_down (UCAST('a signed \\ 'a))\"\n unfolding is_up_def is_down_def source_size target_size by simp_all\n\n(*FIXME: move to lib *)\nlemma to_bytes_remove_sign:\n \"to_bytes (w :: 'a :: len8 signed word) = to_bytes (UCAST('a signed \\ 'a) w)\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_def uint_up_ucast)\n\n(*FIXME: move to lib *)\nlemma size_of_remove_sign:\n \"size_of TYPE('a :: len8 signed word) = size_of TYPE('a word)\"\n by (simp add: size_of_def typ_info_word)\n\n(*FIXME: move to lib *)\nlemma heap_update_remove_sign:\n \"heap_update p (w :: 'a :: len8 signed word) hp =\n heap_update (PTR_COERCE('a signed word \\ 'a word) p) (ucast w) hp\"\n by (simp add: heap_update_def to_bytes_remove_sign size_of_remove_sign)\n\nlemma heap_update_word8:\n \"heap_update p (w :: 8 word) hp = store_word8 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word8_def word_rsplit_same)\n\nlemma heap_update_sword8:\n \"heap_update p (w :: 8 signed word) hp = store_word8 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_def store_word8_def to_bytes_remove_sign to_bytes_word8)\n\nlemma heap_update_word32:\n \"heap_update p w hp = store_word32 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word32_def)\n\nlemma heap_update_sword32:\n \"heap_update p (w :: 32 signed word) hp = store_word32 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word32_def word_rsplit_same\n ucast_def uint_word_of_int_uint_signed_unsigned word_rsplit_def)\n\nlemma heap_update_word64:\n \"heap_update p w hp = store_word64 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word64_def)\n\nlemma heap_update_sword64:\n \"heap_update p (w :: 64 signed word) hp = store_word64 (ptr_val p) (ucast w) hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word64_def word_rsplit_same\n ucast_def uint_word_of_int_uint_signed_unsigned word_rsplit_def)\n\nlemma heap_update_ptr:\n \"heap_update (p :: ('a :: c_type) ptr ptr) p' hp = store_machine_word (ptr_val p) (ptr_val p') hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_ptr store_word_defs)\n\nlemma from_bytes_ucast_isom[OF refl refl]:\n \"x = from_bytes xs \\ y = from_bytes xs\n \\ size x = size y\n \\ size x = length xs * 8\n \\ ucast x = y\"\n apply (clarsimp simp: word_size from_bytes_def typ_info_word)\n apply (rule word_eqI)\n apply (simp add: nth_ucast word_size test_bit_rcat[OF refl refl])\n done\n\nlemma h_val_sword8:\n \"(h_val hp p :: 8 signed word) = ucast (h_val hp (ptr_coerce p) :: 8 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma h_val_sword32:\n \"(h_val hp p :: 32 signed word) = ucast (h_val hp (ptr_coerce p) :: 32 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma h_val_sword64:\n \"(h_val hp p :: 64 signed word) = ucast (h_val hp (ptr_coerce p) :: 64 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma to_bytes_ucast_isom[OF refl]:\n \"y = ucast x\n \\ size x = size y\n \\ 8 dvd size x\n \\ to_bytes y = to_bytes x\"\n apply (rule ext)\n apply (clarsimp simp: word_size to_bytes_def typ_info_word)\n apply (rule nth_equalityI)\n apply (simp add: word_size length_word_rsplit_exp_size')\n apply (clarsimp simp: dvd_def)\n apply (rule word_eqI)\n apply (simp add: test_bit_rsplit_alt length_word_rsplit_exp_size' word_size\n nth_ucast)\n apply auto\n done\n\nlemma to_bytes_sword:\n \"to_bytes (w :: ('a :: len8) signed word)\n = to_bytes (ucast w :: 'a word)\"\n by (simp add: to_bytes_ucast_isom word_size len8_dv8)\n\nlemma heap_list_update_word8:\n \"heap_update_list addr (to_bytes w (heap_list hp' 1 addr')) hp\n = store_word8 addr w hp\"\n \"heap_update_list addr (to_bytes w [hp' addr']) hp\n = store_word8 addr w hp\"\n by (simp_all add: to_bytes_def store_word8_def typ_info_word word_rsplit_same)\n\nlemma heap_list_update_word32:\n \"heap_update_list addr (to_bytes w (heap_list hp' 4 addr')) hp\n = store_word32 addr w hp\"\n by (simp add: to_bytes_def store_word32_def typ_info_word)\n\nlemma heap_list_update_word64:\n \"heap_update_list addr (to_bytes w (heap_list hp' 8 addr')) hp\n = store_word64 addr w hp\"\n by (simp add: to_bytes_def store_word64_def typ_info_word)\n\nlemma heap_list_update_ptr:\n \"heap_update_list addr (to_bytes p (heap_list hp' word_size addr')) hp\n = store_machine_word addr (ptr_val (p :: ('a :: c_type) ptr)) hp\"\n by (simp add: to_bytes_def store_word_defs typ_info_ptr)\n\nlemma field_lvalue_offset_eq:\n \"field_lookup (typ_info_t TYPE('a :: c_type)) f 0 = Some v\n \\ field_lvalue (ptr :: 'a ptr) f = ptr_val ptr + of_nat (snd v)\"\n apply (cases v, simp, drule field_lookup_offset_eq)\n apply (simp add: field_lvalue_def)\n done\n\nlemmas h_val_word_simps =\n h_val_word8 h_val_sword8\n h_val_word32 h_val_sword32\n h_val_word64 h_val_sword64\n h_val_ptr\n\nlemmas heap_update_word_simps =\n heap_update_word8 heap_update_sword8\n heap_update_word32 heap_update_sword32\n heap_update_word64 heap_update_sword64\n heap_update_ptr\n\nlemmas heap_list_update_word_simps =\n heap_list_update_word8\n heap_list_update_word32\n heap_list_update_word64\n heap_list_update_ptr[unfolded word_size_def]\n\nlemma image_fst_cart_UNIV_subset:\n \"S \\ (fst ` S) \\ UNIV\"\n by (auto elim: image_eqI[rotated])\n\nlemma simpl_to_graph_Err_cond:\n \"\\ nn = NextNode m; GGamma fname = Some gf;\n function_graph gf m = Some (node.Cond l Err Check);\n eq_impl nn eqs (\\gst sst. Check gst) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I);\n simpl_to_graph SGamma GGamma fname l com n traces P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule_tac i=1 and j=0 in simpl_to_graph_step_general[rotated -1])\n apply simp\n apply (simp add: exec_graph_step_image_node)\n apply (auto dest: eq_implD)\n done\n\nlemma simpl_to_graph_impossible:\n \"eq_impl nn eqs (\\_ _. False) (P \\ I)\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule simpl_to_graphI, clarsimp)\n apply (drule(1) eq_implD, simp+)\n done\n\ndefinition[simp]: \"VarMachineWord = arch_machine_word_constructor VarWord32 VarWord64\"\n\ndefinition\n \"asm_args_to_list enc xs m_ms\n = map VarMachineWord xs @ [VarMem (fst m_ms), VarMS (enc (snd m_ms))]\"\n\ndefinition\n \"asm_rets_to_list ret enc v mem_vs\n = (if ret then [VarMachineWord v] else []) @ [VarMem (fst mem_vs), VarMS (enc (snd mem_vs))]\"\n\ndefinition\n asm_fun_refines\nwhere\n \"asm_fun_refines specname ret enc len GGamma fname\n = (\\gf. GGamma fname = Some gf\n \\ distinct (function_inputs gf)\n \\ length (function_inputs gf) = len\n \\ (\\tr \\ exec_trace GGamma fname. \\inp_vs inp_mem_ms.\n exec_trace_inputs gf tr = asm_args_to_list enc inp_vs inp_mem_ms\n \\ (\\r gst.\n r \\ asm_semantics specname inp_vs inp_mem_ms\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ acc_vars (function_outputs gf) gst = split (asm_rets_to_list ret enc) r)))\"\n\nlemma asm_args_to_list_inj:\n \"(asm_args_to_list enc vs mem_ms = asm_args_to_list enc vs' mem_ms')\n = (vs = vs' \\ fst mem_ms = fst mem_ms' \\ enc (snd mem_ms) = enc (snd mem_ms'))\"\n apply (simp add: asm_args_to_list_def)\n apply (subst inj_map_eq_map)\n apply (rule inj_onI, simp)\n apply simp\n done\n\nlemma simpl_to_graph_call_asm_fun:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n and rel: \"asm_fun_refines specname ret enc len GGamma p'\"\n and init: \"eq_impl nn eqs (\\gst sst. sst \\ I\n \\ map (\\i. i gst) args = asm_args_to_list enc (asm_args sst)\n (asm_fetch (globals sst))\n \\ length args = len) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\m' v' (ms' :: 'a).\n gdata (asm_store gdata (m', ms') (globals sst)) = gdata (globals sst)\n \\ (v', (m', ms')) \\ asm_semantics specname (asm_args sst) (asm_fetch (globals sst))\n \\ eqs2 (save_vals rets (asm_rets_to_list ret enc v' (m', ms')) gst)\n (asm_ret v' (globals_update (asm_store gdata (m', ms')) sst))\n \\ asm_ret v' (globals_update (asm_store gdata (m', ms')) sst) \\ I)) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (Spec (asm_spec (ti :: 'a itself) gdata vol specname asm_ret asm_args)) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: graph intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: asm_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def)\n apply (subst(asm) fetch_returned, simp_all)\n apply (drule arg_cong[where f=length])+\n apply simp\n apply (simp add: asm_args_to_list_inj)\n apply (drule spec, drule mp, rule refl)\n apply clarsimp\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply clarsimp\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.Spec)\n apply (simp add: asm_spec_def)\n apply (erule rev_bexI)\n apply simp\n apply simp\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"asm_ret a b\" for a b in simpl_to_graphD[OF cont])\n apply (auto simp: return_vars_def asm_store_eq)[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemma take_1_drop:\n \"n < length xs \\ take (Suc 0) (drop n xs) = [xs ! n]\"\n apply (cases \"drop n xs\")\n apply simp\n apply (clarsimp dest!: nth_via_drop)\n done\n\nlemma ptr_safe_field:\n \"\\ ptr_safe (p :: ('a :: mem_type) ptr) d; field_ti TYPE('a) f = Some t;\n export_uinfo t = typ_uinfo_t TYPE('b) \\\n \\ ptr_safe (Ptr &(p\\f) :: ('b :: mem_type) ptr) d\"\n apply (clarsimp simp: field_ti_def split: option.split_asm)\n apply (erule(2) ptr_safe_mono)\n done\n\nlemma heap_update_list_If1:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if unat (x - p) < length xs then xs ! unat (x - p) else hp x)\"\n apply (subst coerce_heap_update_to_heap_updates[where chunk = 1, OF _ refl])\n apply simp\n apply (rule ext)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: take_1_drop)\n apply (rule refl)\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp split del: if_split)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: nth_append)\n apply (rule refl)\n apply (simp add: nth_append split del: if_split cong: if_cong)\n apply (auto simp: unat_of_nat addr_card linorder_not_less less_Suc_eq\n dest: word_unat.Rep_inverse')\n done\n\nlemma heap_update_list_If2:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if x \\ {p ..+ length xs} then xs ! unat (x - p) else hp x)\"\n apply (simp add: heap_update_list_If1)\n apply (rule ext, simp add: intvl_def)\n apply clarsimp\n apply (erule notE, erule order_le_less_trans[rotated])\n apply (simp add: unat_of_nat)\n done\n\nlemma word_sless_to_less:\n \"\\ 0 <=s x; 0 <=s y \\ \\ (x 0 <=s x; 0 <=s y \\ \\ (x <=s y) = (x <= y)\"\n apply (simp add: word_sle_def word_le_def)\n apply (simp add: sint_eq_uint word_msb_sint)\n done\n\nML \\\n\nstructure SimplToGraphProof = struct\n\nfun mk_ptr_val_app p =\n Const (@{const_name ptr_val}, fastype_of p --> @{typ machine_word}) $ p\n\nfun mk_arr_idx arr i = let\n val arrT = fastype_of arr\n val elT = case arrT of Type (@{type_name \"array\"}, [elT, _])\n => elT | _ => raise TYPE (\"mk_arr_idx\", [arrT], [arr])\n in Const (@{const_name \"Arrays.index\"}, arrT --> @{typ nat} --> elT)\n $ arr $ i\n end\n\nval gammaT_to_stateT = strip_type #> snd\n #> dest_Type #> snd #> the_single\n #> dest_Type #> snd #> hd\n\nfun mk_simpl_acc ctxt sT nm = let\n val sst = Free (\"sst\", sT)\n val symbol_table = Free (\"symbol_table\", @{typ \"string => machine_word\"})\n\n val [globals, globals_swap, t_hrs, t_hrs_update, globals_list, pms, pms_encode] =\n map (Syntax.read_term ctxt) [\n \"globals :: globals myvars \\ _\",\n \"globals_swap :: (globals \\ _) \\ _\",\n \"t_hrs_' :: globals \\ _\",\n \"t_hrs_'_update :: _ \\ globals \\ globals\",\n \"globals_list\",\n \"phantom_machine_state_' :: globals \\ _\",\n \"encode_machine_state\"\n ];\n\n val globals_sst = globals $ sst\n val _ = type_of globals_sst (* does type checking *)\n\n val globals_swap = globals_swap $ t_hrs $ t_hrs_update $ symbol_table $ globals_list\n\n fun do_pms_encode t = case pms_encode of Const _ => pms_encode $ t\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [t])\n\n val ghost_assns_fetch = Syntax.read_term ctxt \"ghost_assns_from_globals\"\n fun get_ghost_assns_fetch () = case head_of ghost_assns_fetch of Const _ => ghost_assns_fetch\n | _ => raise TERM (\"mk_simpl_acc: requires `ghost_assns_from_globals :: globals => ghost_assertions\", [])\n\n fun mk_sst_acc \"Mem\" = @{term hrs_mem} $ (t_hrs $ (globals_swap $ globals_sst))\n | mk_sst_acc \"HTD\" = @{term hrs_htd} $ (t_hrs $ globals_sst)\n | mk_sst_acc \"PMS\" = do_pms_encode (pms $ globals_sst)\n | mk_sst_acc \"GhostAssertions\" = get_ghost_assns_fetch () $ globals_sst\n | mk_sst_acc nm = if String.isPrefix \"rv#space#\" nm\n then mk_sst_acc (unprefix \"rv#space#\" nm)\n else if String.isSuffix \"#v\" nm\n then Syntax.read_term ctxt\n (suffix \"_'\" (unsuffix \"#v\" nm) ^ \" :: globals myvars => _\") $ sst\n else let\n val (head, tail) = Library.space_explode \".\" nm\n |> Library.split_last |> apfst (Library.space_implode \".\")\n val acc = mk_sst_acc head\n val typ_nm = fastype_of acc |> dest_Type |> fst\n val acc2 = if typ_nm = \"Arrays.array\"\n then mk_arr_idx acc (HOLogic.mk_number @{typ nat}\n (ParseGraph.parse_int tail))\n else Proof_Context.read_const {proper = true, strict = true}\n ctxt (typ_nm ^ \".\" ^ tail) $ acc\n in acc2 end\n fun mk_sst_acc2 nm = let\n val acc = mk_sst_acc nm\n val T = fastype_of acc |> dest_Type |> fst\n in if T = @{type_name ptr} then mk_ptr_val_app acc else acc end\n in Term.lambda sst (ParseGraph.mk_var_term (mk_sst_acc2 nm)) end\n\nfun foldr1_default _ v [] = v\n | foldr1_default f _ xs = foldr1 f xs\n\ndatatype hints = Hints of { deps: (string * term) list Inttab.table,\n hint_tactics: (Proof.context -> int -> tactic) Inttab.table,\n err_conds: Inttab.set }\n\nfun mk_graph_eqs Gamma (Hints hints) nm n = let\n val vs = case (Inttab.lookup (#deps hints) n) of\n SOME vs => vs\n | NONE => raise TERM (\"mk_graph_eqs: \" ^ nm ^ \" \" ^ string_of_int n, [])\n val sT = gammaT_to_stateT (fastype_of Gamma)\n val sst = Free (\"sst\", sT)\n\n val gst = @{term \"gst :: GraphLang.state\"}\n\n fun mk_eq (nm, acc) = HOLogic.mk_eq (@{term var_acc} $ HOLogic.mk_string nm $ gst,\n betapply (acc, sst))\n val eqs = map mk_eq vs\n in Term.lambda gst (Term.lambda sst\n (foldr1_default HOLogic.mk_conj @{term True} eqs)) end\n\nfun with_cache cache termfun tracer t = case Termtab.lookup (! cache) t\n of SOME v => v\n | NONE => let val v = termfun t\n in tracer t v; cache := Termtab.insert (K false) (t, v) (! cache); v end\n\nfun dest_nat (@{term Suc} $ n) = dest_nat n + 1\n | dest_nat (@{term \"0 :: nat\"}) = 0\n | dest_nat n = HOLogic.dest_number n |> snd\n\nfun simpl_to_graph_skel hints nm (Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ _ $ trS $ P $ I $ _ $ out_eqs)\n = Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ @{term \"n :: nat\"} $ Free (\"trS\", fastype_of trS)\n $ P $ I $ mk_graph_eqs SG hints nm (dest_nat nn) $ out_eqs\n | simpl_to_graph_skel _ _ t = raise TERM (\"simpl_to_graph_skel\", [t])\n\nfun simpl_to_graph_nn (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ (@{term NextNode} $ nn) $ _\n $ _ $ _ $ _ $ _ $ _ $ _)\n = dest_nat nn\n | simpl_to_graph_nn t = raise TERM (\"simpl_to_graph_nn\", [t])\n\nfun SUBGOAL tfun i t = Tactical.SUBGOAL tfun i t\n handle TYPE (s, tps, ts) => raise TYPE (\"SUBGOAL \" ^ s,\n tps, [Thm.cprem_of t i |> Thm.term_of] @ ts)\n\nval standard_GG = @{term \"GG :: string \\ graph_function option\"}\n\nfun graph_gamma_tac ctxt = SUBGOAL (fn (t, i) => let\n val (lhs, _) = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t)) |> HOLogic.dest_eq\n val _ = (head_of lhs = standard_GG andalso length (snd (strip_comb lhs)) = 1)\n orelse raise TERM (\"GG lhs\", [])\n val nm = the_single (snd (strip_comb lhs)) |> HOLogic.dest_string\n |> Long_Name.base_name\n val gfun = Syntax.read_term ctxt (nm ^ \"_graph_fun\")\n val gfun_def = Proof_Context.get_thm ctxt (nm ^ \"_graph_fun_def\")\n val _ = dest_Const (head_of gfun)\n val GG_assum = HOLogic.mk_eq\n (lhs, @{term \"Some :: graph_function \\ _\"} $ gfun)\n |> HOLogic.mk_Trueprop |> Thm.cterm_of ctxt |> Thm.assume\n |> simplify (put_simpset HOL_basic_ss ctxt addsimps [gfun_def])\n in resolve0_tac [GG_assum] i end\n handle TERM (s, ts) => raise TERM (\"graph_gamma_tac: \" ^ s, t :: ts))\n\nfun inst_graph_node_tac ctxt =\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms function_graph.simps})\n THEN' SUBGOAL (fn (t, i) => case\n HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n of @{term \"(=) :: node option \\ _\"} $ (f $ n) $ _ => (let\n val g = head_of f |> dest_Const |> fst\n val n' = dest_nat n\n val thm = Proof_Context.get_thm ctxt\n (Long_Name.base_name g ^ \"_\" ^ Int.toString n')\n val thm = if n = @{term \"Suc 0\"}\n then simplify (put_simpset HOL_basic_ss ctxt addsimps @{thms One_nat_def}) thm\n else thm\n in resolve0_tac [thm] i end handle TERM (s, ts) => raise TERM (\"inst_graph_node_tac: \" ^ s, t :: ts))\n | t => raise TERM (\"inst_graph_node_tac\", [t]))\n\nfun inst_graph_tac ctxt = graph_gamma_tac ctxt THEN' inst_graph_node_tac ctxt\n\nfun mk_graph_refines (funs : ParseGraph.funs) ctxt s = let\n val proc = Syntax.read_term ctxt\n (Long_Name.base_name s ^ \"_'proc\")\n val gamma = Syntax.read_term ctxt \"\\\"\n val invs = Syntax.read_term ctxt \"simpl_invariant\"\n val _ = case head_of invs of Const _ => ()\n | _ => raise TERM (\"mk_graph_refines: requires simpl_invariant constant\", [])\n val sT = fastype_of gamma |> gammaT_to_stateT\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val inputs = map (mk_simpl_acc ctxt sT) xs\n |> HOLogic.mk_list (sT --> @{typ variable})\n val outputs = map (mk_simpl_acc ctxt sT) ys\n |> HOLogic.mk_list (sT --> @{typ variable})\n in HOLogic.mk_Trueprop (Const (@{const_name graph_fun_refines}, [fastype_of gamma,\n @{typ \"string \\ graph_function option\"}, fastype_of invs,\n fastype_of inputs, fastype_of proc, fastype_of outputs,\n @{typ string}] ---> @{typ bool})\n $ gamma $ standard_GG $ invs $ inputs $ proc $ outputs\n $ HOLogic.mk_string s)\n end\n\nfun asm_spec_name_to_fn_name _ specname = let\n val name = space_implode \"_\" (space_explode \" \" specname)\n in \"asm_instruction'\" ^ name end\n\nfun mk_asm_refines (funs : ParseGraph.funs) ctxt specname = let\n val s = asm_spec_name_to_fn_name true specname\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val enc = Syntax.read_term ctxt \"encode_machine_state\"\n val _ = case enc of Const _ => ()\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [])\n in HOLogic.mk_Trueprop (Const (@{const_name asm_fun_refines},\n [@{typ string}, @{typ bool}, fastype_of enc, @{typ nat},\n fastype_of standard_GG, @{typ string}] ---> @{typ bool})\n $ HOLogic.mk_string specname\n $ (if (length ys > 2) then @{term True} else @{term False})\n $ enc\n $ HOLogic.mk_number @{typ nat} (length xs)\n $ standard_GG $ HOLogic.mk_string s)\n end\n\nfun apply_graph_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name graph_fun_refines}, _)\n $ _ $ _ $ _ $ _ $ _ $ _ $ s)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_graph_refines funs ctxt (HOLogic.dest_string s)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_asm_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name asm_fun_refines}, _)\n $ specname $ _ $ _ $ _ $ _ $ _)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_asm_refines funs ctxt (HOLogic.dest_string specname)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_impl_thm ctxt = SUBGOAL (fn (t, i) => case\n Logic.strip_assums_concl (Envir.beta_eta_contract t)\n of @{term Trueprop} $ (Const (@{const_name HOL.eq}, _)\n $ (_ $ Const (s, _)) $ (Const (@{const_name Some}, _) $ _))\n => resolve0_tac [Proof_Context.get_thm ctxt\n (suffix \"_impl\" (unsuffix \"_'proc\" (Long_Name.base_name s)))] i\n | _ => no_tac)\n\nfun get_Call_args (Const (@{const_name com.Call}, _) $ x) = [x]\n | get_Call_args (f $ x) = get_Call_args f @ get_Call_args x\n | get_Call_args (Abs (_, _, t)) = get_Call_args t\n | get_Call_args _ = []\n\nfun apply_modifies_thm ctxt = SUBGOAL (fn (t, i) => case\n get_Call_args (Envir.beta_eta_contract t)\n of [Const (s, _)] => let\n val s = unsuffix \"_'proc\" (Long_Name.base_name s)\n val thms = (@{thm disjI1}, Proof_Context.get_thm ctxt (s ^ \"_modifies\"))\n handle ERROR _ => (@{thm disjI2}, @{thm refl})\n in resolve0_tac [fst thms] i THEN resolve0_tac [snd thms] i end\n | _ => no_tac)\n\nfun is_safe_eq_impl (p as (@{term Trueprop}\n $ (Const (@{const_name \"eq_impl\"}, _) $ _ $ _ $ _ $ _)))\n = not (exists_subterm (fn Var _ => true | Free (\"n\", _) => true\n | _ => false) p)\n | is_safe_eq_impl _ = false\n\nfun eq_impl_assume_tac ctxt = DETERM o SUBGOAL (fn (t, i) => let\n val p = Logic.strip_assums_concl (Envir.beta_eta_contract t)\n in if is_safe_eq_impl p\n then resolve0_tac [Thm.assume (Thm.cterm_of ctxt p)] i\n else no_tac\n end)\n\nfun is_pglobal_valid_conjs (Const (@{const_name conj}, _) $ p $ q)\n = is_pglobal_valid_conjs p andalso is_pglobal_valid_conjs q\n | is_pglobal_valid_conjs (Const (@{const_name \"pglobal_valid\"}, _) $ _ $ _ $ _)\n = true\n | is_pglobal_valid_conjs _ = false\n\nfun simpl_ss ctxt = put_simpset HOL_basic_ss ctxt\n addsimps @{thms switch.simps fst_conv snd_conv\n length_Cons singletonI triv_forall_equality\n simpl_to_graph_Seq simpl_to_graph_Catch\n}\n\nval immediates = @{thms\n simpl_to_graph_Skip_immediate simpl_to_graph_Throw_immediate}\n\nfun except_tac ctxt msg = SUBGOAL (fn (t, _) => let\n in warning msg; Syntax.pretty_term ctxt t |> Pretty.writeln;\n raise TERM (msg, [t]) end)\n\nfun apply_hint_thm ctxt (Hints hints) = SUBGOAL (fn (t, i) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#hint_tactics hints) nn\n of SOME tac => tac ctxt i\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun check_err_cond_tac (Hints hints) = SUBGOAL (fn (t, _) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#err_conds hints) nn\n of SOME () => all_tac\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun apply_simpl_to_graph_tac funs hints ctxt =\n simp_tac (simpl_ss ctxt\n addsimps @{thms One_nat_def whileAnno_def\n creturn_def[folded creturn_void_def]})\n THEN' DETERM o (FIRST' [\n apply_hint_thm ctxt hints,\n resolve0_tac [@{thm simpl_to_graph_Basic_triv}],\n resolve_tac ctxt @{thms simpl_to_graph_lvar_nondet_init\n simpl_to_graph_Skip\n simpl_to_graph_Throw\n simpl_to_graph_cbreak\n simpl_to_graph_creturn_void},\n resolve_tac ctxt @{thms\n simpl_to_graph_ccatchbrk_Break\n simpl_to_graph_ccatchbrk_Return}\n THEN' (simp_tac ctxt\n THEN_ALL_NEW except_tac ctxt\n \"apply_simpl_to_graph_tac: exn eq unsolved\"),\n resolve0_tac [@{thm simpl_to_graph_Guard[OF refl]}],\n check_err_cond_tac hints\n THEN' resolve0_tac [@{thm simpl_to_graph_Err_cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Basic}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_triv[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_known_guard[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_asm_fun[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_asm_refines_ex_tac funs ctxt,\n resolve0_tac [@{thm simpl_to_graph_nearly_done}]\n THEN' inst_graph_tac ctxt\n ] THEN_ALL_NEW (TRY o REPEAT_ALL_NEW\n (resolve_tac ctxt immediates)))\n\nfun trace_cache _ (SOME thm) = tracing\n (\"Adding thm to cache with \" ^ string_of_int (Thm.nprems_of thm) ^ \" prems.\")\n | trace_cache _ NONE = tracing \"Adding NONE to cache.\"\n\nfun simpl_to_graph_cache_tac funs hints cache nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN_ALL_NEW DETERM o FIRST' [\n SUBGOAL (fn (t, i) => (case\n with_cache cache (mk_simpl_to_graph_thm funs hints cache nm ctxt) (K (K ()))\n (simpl_to_graph_skel hints nm (HOLogic.dest_Trueprop\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)))) of\n SOME thm => resolve0_tac [thm] i | _ => no_tac)\n handle TERM _ => no_tac),\n resolve_tac ctxt @{thms simpl_to_graph_done2\n simpl_to_graph_Skip_immediate[where nn=Ret]\n simpl_to_graph_Throw_immediate[where nn=Ret]\n simpl_to_graph_creturn_void2},\n eq_impl_assume_tac ctxt\n ]\n\nand mk_simpl_to_graph_thm funs hints cache nm ctxt tm = let\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop tm)\n in Thm.trivial ct\n |> (apply_simpl_to_graph_tac funs hints ctxt\n THEN_ALL_NEW (TRY o simpl_to_graph_cache_tac funs hints cache nm ctxt)\n THEN_ALL_NEW (TRY o eq_impl_assume_tac ctxt)) 1\n |> Seq.hd\n |> Drule.generalize ([], [\"n\", \"trS\"])\n |> SOME\n end handle TERM (s, _) => (tracing (\"mk_simpl_to_graph_thm: \" ^ s); NONE)\n | Empty => (tracing \"mk_simpl_to_graph_thm: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt tm |> Pretty.string_of);\n NONE)\n | Option => NONE\n\nfun dest_next_node (@{term NextNode} $ n)\n = dest_nat n\n | dest_next_node @{term Ret} = ~1\n | dest_next_node @{term Err} = ~2\n | dest_next_node t = raise TERM (\"dest_next_node\", [t])\n\nfun get_while (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ nn\n $ (Const (@{const_name add_cont}, _) $ (Const (@{const_name While}, _) $ C $ c) $ _)\n $ _ $ _ $ _ $ _ $ _ $ _)\n = (dest_next_node nn, C, c)\n | get_while t = raise TERM (\"get_while\", [t])\n\nfun check_while_assums t = let\n val hyps = Logic.strip_assums_hyp t\n |> filter (fn (@{term Trueprop} $ (@{term \"All :: (nat => _) => _\"} $ _))\n => true | _ => false)\n in length hyps < 2 orelse raise TERM (\"check_while_assums: too many\", []);\n () end\n\nfun get_while_body_guard C c = case c of\n Const (@{const_name com.Seq}, _) $ _ $ last => let\n val setT = fastype_of C\n fun mk_int (x, y) = Const (fst (dest_Const @{term \"(Int)\"}),\n setT --> setT --> setT) $ x $ y\n fun build_guard (Const (@{const_name Guard}, _) $ _ $ G\n $ Const (@{const_name com.Skip}, _))\n = G\n | build_guard (Const (@{const_name Guard}, _) $ _ $ G $ c)\n = mk_int (G, build_guard c)\n | build_guard _ = error \"\"\n val G = case try build_guard last of SOME G => G\n | NONE => Const (fst (dest_Const @{term \"UNIV\"}), setT)\n in G end\n | _ => Const (fst (dest_Const @{term \"UNIV\"}), fastype_of C)\n\nfun simpl_to_graph_While_tac hints nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN' SUBGOAL (fn (t, i) => let\n val t = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n val (_, Cond, body) = get_while t\n val gd = get_while_body_guard Cond body\n val skel = simpl_to_graph_skel hints nm t\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop skel)\n val rl_inst = infer_instantiate ctxt [((\"G\",0), Thm.cterm_of ctxt gd)]\n @{thm simpl_to_graph_While_inst}\n in\n resolve_tac ctxt [Thm.trivial ct |> Drule.generalize ([], [\"n\", \"trS\"])] i\n THEN resolve_tac ctxt [rl_inst] i\n THEN resolve_tac ctxt @{thms refl} i\n THEN inst_graph_tac ctxt i\n end handle TERM _ => no_tac)\n\nfun trace_fail_tac ctxt s = SUBGOAL (fn (t, _) =>\n (Syntax.pretty_term ctxt t |> Pretty.string_of\n |> prefix (\"Tactic \" ^ s ^ \" failed on: \") |> tracing;\n no_tac))\n\nfun trace_fail_tac2 _ = K no_tac\n\nfun simpl_to_graph_tac funs hints nm ctxt = let\n val cache = ref (Termtab.empty)\n in REPEAT_ALL_NEW (DETERM o (full_simp_tac (simpl_ss ctxt) THEN_ALL_NEW\n SUBGOAL (fn (t, i) => fn thm =>\n ((simpl_to_graph_cache_tac funs hints cache nm ctxt\n ORELSE' (eresolve0_tac [@{thm use_simpl_to_graph_While_assum}]\n THEN' simp_tac ctxt)\n ORELSE' simpl_to_graph_While_tac hints nm ctxt\n ORELSE' trace_fail_tac ctxt \"simpl_to_graph_tac\") i thm\n handle Empty => (tracing \"simpl_to_graph_tac: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt t |> Pretty.string_of);\n Seq.empty)))\n ))\n end\n\nfun get_conts (@{term node.Basic} $ nn $ _) = [nn]\n | get_conts (@{term node.Cond} $ l $ _ $ Abs (_, _, @{term True})) = [l]\n | get_conts (@{term node.Cond} $ _ $ r $ Abs (_, _, @{term False})) = [r]\n | get_conts (@{term node.Cond} $ l $ r $ _) = [l, r]\n | get_conts (@{term node.Call} $ nn $ _ $ _ $ _) = [nn]\n | get_conts n = raise TERM (\"get_conts\", [n])\n\nfun get_rvals (Abs (_, _, t)) = let\n fun inner (Const _ $ (s as (@{term \"(#) :: char \\ _\"} $ _ $ _)) $ Bound 0)\n = [HOLogic.dest_string s]\n | inner (f $ x) = inner f @ inner x\n | inner (Const _) = []\n | inner (Free (\"symbol_table\", _)) = []\n | inner t = raise TERM (\"get_rvals\", [t])\n in inner t end\n | get_rvals t = raise TERM (\"get_rvals\", [t])\n\nfun flip f x y = f y x\n\nfun get_lvals_rvals (@{term node.Basic} $ _ $ upds) = let\n val (lvs, rvs) = HOLogic.dest_list upds |> map_split HOLogic.dest_prod\n in (map HOLogic.dest_string lvs, maps get_rvals rvs) end\n | get_lvals_rvals (@{term node.Cond} $ _ $ _ $ cond) = ([], get_rvals cond)\n | get_lvals_rvals (@{term node.Call} $ _ $ _ $ args $ rets)\n = (HOLogic.dest_list rets |> map HOLogic.dest_string,\n HOLogic.dest_list args |> maps get_rvals)\n | get_lvals_rvals n = raise TERM (\"get_conts\", [n])\n\nfun get_var_deps nodes ep outputs = let\n fun forward tab (point :: points) = if point < 0\n then forward tab points\n else let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val upds = filter_out (Inttab.lookup_list tab #>\n flip (Ord_List.member int_ord) point) conts\n val tab = fold (fn c => Inttab.map_default (c, [])\n (Ord_List.insert int_ord point)) conts tab\n in forward tab (upds @ points) end\n | forward tab [] = tab\n val preds = forward (Inttab.make [(ep, [])]) [ep]\n fun backward tab (point :: points) = let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val (lvs, rvs) = get_lvals_rvals node\n |> apply2 (Ord_List.make string_ord)\n val cont_vars = maps (Inttab.lookup_list tab) conts\n |> Ord_List.make string_ord\n val vars = Ord_List.merge string_ord (rvs,\n Ord_List.subtract string_ord lvs cont_vars)\n val prev_vars = Inttab.lookup tab point\n val tab = Inttab.update (point, vars) tab\n val upds = if prev_vars <> SOME vars\n then Inttab.lookup_list preds point else []\n in backward tab (upds @ points) end\n | backward tab [] = tab\n val deps = backward (Inttab.make [(~1, outputs), (~2, [])])\n (maps (Inttab.lookup_list preds) [~1, ~2])\n in (preds, deps) end\n\nfun get_loop_var_upd_nodes nodes =\n nodes\n |> filter (snd #> (fn (@{term Basic} $ _ $ _) => true | _ => false))\n |> filter (snd #> get_lvals_rvals #> fst\n #> (fn xs => not (null xs) andalso forall (String.isSuffix \"#count\") xs))\n |> map fst\n\nfun get_err_conds nodes =\n nodes\n |> filter (snd #> (fn (@{term Cond} $ _ $ @{term Err} $ _) => true | _ => false))\n |> map fst\n\nfun mk_hints (funs : ParseGraph.funs) ctxt nm = case Symtab.lookup funs nm of\n NONE => raise TERM (\"mk_var_deps_hints: miss \" ^ nm, [])\n | SOME (_, _, NONE) => Hints {deps = Inttab.empty, hint_tactics = Inttab.empty,\n err_conds = Inttab.empty}\n | SOME (_, outputs, SOME (ep, nodes, _)) => let\n val sT = Syntax.read_typ ctxt \"globals myvars\"\n val deps = snd (get_var_deps (Inttab.make nodes) ep outputs)\n |> Inttab.map (K (filter_out (fn s => String.isSuffix \"#count\" s)\n #> map (fn s => (s, mk_simpl_acc ctxt sT s))))\n val no_deps_nodes = map fst nodes\n |> filter_out (Inttab.defined deps)\n val all_deps = Inttab.join (fn _ => error \"mk_hints\")\n (deps, Inttab.make (map (rpair []) no_deps_nodes))\n val no_deps_tacs = no_deps_nodes\n |> map (rpair (K (resolve0_tac [@{thm simpl_to_graph_impossible}])))\n val loop_tacs = get_loop_var_upd_nodes nodes\n |> map (rpair (fn ctxt => resolve0_tac [@{thm simpl_to_graph_noop_Basic}]\n THEN' inst_graph_tac ctxt))\n val all_tacs = Inttab.make (no_deps_tacs @ loop_tacs)\n val ec = get_err_conds nodes |> Inttab.make_set\n in Hints {deps = all_deps,\n hint_tactics = all_tacs,\n err_conds = ec} end\n\nfun init_graph_refines_proof funs nm ctxt = let\n val body_ref_thm = Get_Body_Refines.get ctxt (Long_Name.base_name nm)\n val ct = mk_graph_refines funs ctxt nm |> Thm.cterm_of ctxt\n in Thm.trivial ct\n |> (resolve_tac ctxt [@{thm graph_fun_refines_from_simpl_to_graph_with_refine}] 1\n THEN apply_impl_thm ctxt 1\n THEN graph_gamma_tac ctxt 1\n THEN resolve_tac ctxt [body_ref_thm] 1\n THEN ALLGOALS (simp_tac (put_simpset HOL_basic_ss ctxt\n addsimps @{thms entry_point.simps function_inputs.simps\n function_outputs.simps list.simps}))\n THEN TRY ((resolve_tac ctxt [@{thm simpl_to_graph_noop_same_eqs}]\n THEN' inst_graph_tac ctxt) 1)\n )\n |> Seq.hd\n end\n\nval thin_While_assums_rule =\n @{thm thin_rl[where V=\"simpl_to_graph SG GG f nn (add_cont (com.While C c) con) n tS P I e e2\"]}\n |> Drule.generalize ([], [\"SG\", \"GG\", \"f\", \"nn\", \"C\", \"c\", \"con\", \"n\", \"tS\", \"P\", \"I\", \"e\", \"e2\"])\n\nfun eq_impl_unassume_tac t = let\n val hyps = t |> Thm.chyps_of\n |> filter (Thm.term_of #> is_safe_eq_impl)\n in (* tracing (\"Restoring \" ^ string_of_int (length hyps) ^ \" hyps.\") ; *)\n fold Thm.implies_intr hyps t |> Seq.single end\n\nfun simpl_to_graph_upto_subgoals funs hints nm ctxt =\n init_graph_refines_proof funs nm ctxt\n |> (simpl_to_graph_tac funs hints nm ctxt 1\n THEN ALLGOALS (TRY o REPEAT_ALL_NEW (eresolve0_tac [thin_While_assums_rule]))\n THEN eq_impl_unassume_tac\n ) |> Seq.hd\n\nend\n\n\\\n\nML \\\nfun define_graph_fun_short funs s =\n Local_Theory.subtarget\n (ParseGraph.define_graph_fun funs (Long_Name.base_name s ^ \"_graph\")\n (Binding.name (Long_Name.base_name s ^ \"_graph_fun\")) s)\n\\\n\nend\n\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/tools/asmrefine/GraphRefine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.3486451488696663, "lm_q1q2_score": 0.18655947130844952}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__26.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__26 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__26 and some rule r*}\nlemma n_SendInv__part__0Vsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__26 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__26:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__26 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__26.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.3486451488696663, "lm_q1q2_score": 0.18655947130844946}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory AsmSemanticsRespects\n\nimports \"GlobalsSwap\"\n\nbegin\n\ndefinition\n asm_semantics_protects_globs\n :: \"('g \\ heap_raw_state) \\ ((heap_raw_state \\ heap_raw_state) \\ 'g \\ 'g)\n \\ ('g \\ 'a)\n \\ (string \\ addr) \\ ('g global_data list)\n \\ bool\"\nwhere\n \"asm_semantics_protects_globs mem memu ms symtab xs\n \\ (let sw = globals_swap mem memu symtab xs\n in (\\v v' s m' ms' specname. (v', m', ms')\n \\ asm_semantics specname v\n (hrs_mem (mem (sw s)), ms s)\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (sw s))))\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (memu (hrs_mem_update (\\_. m')) (sw s)))))))\"\n\nabbreviation(input)\n asm_ops_are_swap\n :: \"('g \\ heap_raw_state) \\ ((heap_raw_state \\ heap_raw_state) \\ 'g \\ 'g)\n \\ ('g \\ 'a) \\ (('a \\ 'a) \\ 'g \\ 'g)\n \\ (string \\ addr) \\ ('g \\ 'b) \\ ('g global_data list)\n \\ bool\"\nwhere\n \"asm_ops_are_swap mem memu ms msu symtab gdata xs\n \\ (let sw = globals_swap mem memu symtab xs\n in (\\s. asm_fetch s = (hrs_mem (mem (sw s)), ms (sw s)))\n \\ (\\v s. asm_store gdata v s = sw (msu (\\_. snd v)\n (memu (hrs_mem_update (\\_. fst v)) (sw s))))\n \\ asm_semantics_protects_globs mem memu ms symtab xs)\"\n\nlemma asm_semantics_protects_globs_revD[OF refl]:\n \"sw = globals_swap mem memu symtab xs\n \\ (v', m', ms')\n \\ asm_semantics specname v\n (hrs_mem (mem (sw s)), ms s)\n \\ asm_semantics_protects_globs mem memu ms symtab xs\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (sw s))))\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (memu (hrs_mem_update (\\_. m')) (sw s)))))\"\n apply (simp add: asm_semantics_protects_globs_def Let_def)\n apply blast\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/AsmSemanticsRespects.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.18655946406550672}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory RAB_FN\n\nimports\n \"CSpace1_R\"\n \"Lib.MonadicRewrite\"\n\nbegin\n\ndefinition\n \"only_cnode_caps ctes =\n option_map ((\\x. if isCNodeCap x then x else NullCap) o cteCap) o ctes\"\n\ndefinition locateSlotFun_def:\n\"locateSlotFun cnode offset \\ cnode + 2 ^ cte_level_bits * offset\"\n\ndefinition\n \"cnode_caps_gsCNodes cts cns\n = (\\cap \\ ran cts. isCNodeCap cap\n \\ cns (capCNodePtr cap) = Some (capCNodeBits cap))\"\n\nabbreviation (input)\n \"cnode_caps_gsCNodes' s \\ cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)\"\n\nfunction\n resolveAddressBitsFn ::\n \"capability \\ cptr \\ nat \\ (machine_word \\ capability option)\n \\ (lookup_failure + (machine_word * nat))\"\nwhere\n \"resolveAddressBitsFn a b c =\n(\\x0 capptr bits caps. (let nodeCap = x0 in\n if isCNodeCap nodeCap\n then (let\n radixBits = capCNodeBits nodeCap;\n guardBits = capCNodeGuardSize nodeCap;\n levelBits = radixBits + guardBits;\n offset = (fromCPtr capptr `~shiftR~` (bits-levelBits)) &&\n (mask radixBits);\n guard = (fromCPtr capptr `~shiftR~` (bits-guardBits)) &&\n (mask guardBits);\n bitsLeft = bits - levelBits;\n slot = locateSlotFun (capCNodePtr nodeCap) offset\n in\n if levelBits = 0 then Inr (0, 0)\n else if \\ (guardBits \\ bits \\ guard = capCNodeGuard nodeCap)\n then Inl $ GuardMismatch_ \\\n guardMismatchBitsLeft= bits,\n guardMismatchGuardFound= capCNodeGuard nodeCap,\n guardMismatchGuardSize= guardBits \\\n else if (levelBits > bits) then Inl $ DepthMismatch_ \\\n depthMismatchBitsLeft= bits,\n depthMismatchBitsFound= levelBits \\\n else if (bitsLeft = 0)\n then Inr (slot, 0)\n else (case caps slot of Some NullCap\n \\ Inr (slot, bitsLeft)\n | Some nextCap\n \\ resolveAddressBitsFn nextCap capptr bitsLeft caps\n | None \\ Inr (0, 0))\n )\n else Inl InvalidRoot\n ))\n\na b c\"\n by auto\n\ntermination\n apply (relation \"measure (snd o snd)\")\n apply (auto split: if_split_asm)\n done\n\ndeclare resolveAddressBitsFn.simps[simp del]\n\nlemma isCNodeCap_capUntypedPtr_capCNodePtr:\n \"isCNodeCap c \\ capUntypedPtr c = capCNodePtr c\"\n by (clarsimp simp: isCap_simps)\n\nlemma resolveAddressBitsFn_eq:\n \"monadic_rewrite F E (\\s. (isCNodeCap cap \\ (\\slot. cte_wp_at' (\\cte. cteCap cte = cap) slot s))\n \\ valid_objs' s \\ cnode_caps_gsCNodes' s)\n (resolveAddressBits cap capptr bits)\n (gets (resolveAddressBitsFn cap capptr bits o only_cnode_caps o ctes_of))\"\n (is \"monadic_rewrite F E (?P cap) (?f cap bits) (?g cap capptr bits)\")\nproof (induct cap capptr bits rule: resolveAddressBits.induct)\n case (1 cap cref depth)\n show ?case\n apply (subst resolveAddressBits.simps, subst resolveAddressBitsFn.simps)\n apply (simp only: Let_def haskell_assertE_def K_bind_def)\n apply (rule monadic_rewrite_name_pre)\n apply (rule monadic_rewrite_guard_imp)\n apply (rule_tac P=\"(=) s\" in monadic_rewrite_trans)\n (* step 1, apply the induction hypothesis on the lhs *)\n apply (rule monadic_rewrite_named_if monadic_rewrite_named_bindE\n monadic_rewrite_refl[THEN monadic_rewrite_guard_imp, where f=\"returnOk y\" for y]\n monadic_rewrite_refl[THEN monadic_rewrite_guard_imp, where f=\"x $ y\" for x y]\n monadic_rewrite_refl[THEN monadic_rewrite_guard_imp, where f=\"assertE P\" for P s]\n TrueI)+\n apply (rule_tac g=\"case nextCap of CNodeCap a b c d\n \\ ?g nextCap cref bitsLeft\n | _ \\ returnOk (slot, bitsLeft)\" in monadic_rewrite_guard_imp)\n apply (wpc | rule monadic_rewrite_refl \"1.hyps\"\n | simp only: capability.case haskell_assertE_def simp_thms)+\n apply (clarsimp simp: in_monad locateSlot_conv getSlotCap_def\n dest!: in_getCTE fst_stateAssertD)\n apply (fastforce elim: cte_wp_at_weakenE')\n apply (rule monadic_rewrite_refl[THEN monadic_rewrite_guard_imp], simp)\n (* step 2, split and match based on the lhs structure *)\n apply (simp add: locateSlot_conv liftE_bindE unlessE_def whenE_def\n if_to_top_of_bindE assertE_def stateAssert_def bind_assoc\n assert_def if_to_top_of_bind getSlotCap_def\n split del: if_split cong: if_cong)\n apply (rule monadic_rewrite_if_l monadic_rewrite_symb_exec_l'[OF _ get_wp, rotated]\n empty_fail_get no_fail_get impI\n monadic_rewrite_refl get_wp\n | simp add: throwError_def returnOk_def locateSlotFun_def if_not_P\n isCNodeCap_capUntypedPtr_capCNodePtr\n cong: if_cong split del: if_split)+\n apply (rule monadic_rewrite_symb_exec_l'[OF _ getCTE_inv _ _ getCTE_cte_wp_at, rotated])\n apply simp\n apply (rule impI, rule no_fail_getCTE)\n apply (simp add: monadic_rewrite_def simpler_gets_def return_def returnOk_def\n only_cnode_caps_def cte_wp_at_ctes_of isCap_simps\n locateSlotFun_def isCNodeCap_capUntypedPtr_capCNodePtr\n split: capability.split)\n apply (rule monadic_rewrite_name_pre[where P=\"\\_. False\" and f=fail]\n monadic_rewrite_refl get_wp\n | simp add: throwError_def returnOk_def locateSlotFun_def if_not_P\n isCNodeCap_capUntypedPtr_capCNodePtr\n cong: if_cong split del: if_split)+\n (* step 3, prove the non-failure conditions *)\n apply (clarsimp simp: isCap_simps)\n apply (frule(1) cte_wp_at_valid_objs_valid_cap')\n apply (clarsimp simp: cte_level_bits_def valid_cap_simps'\n real_cte_at' isCap_simps cteSizeBits_def objBits_simps)\n apply (clarsimp simp: cte_wp_at_ctes_of only_cnode_caps_def ball_Un\n cnode_caps_gsCNodes_def ran_map_option o_def)\n apply (drule bspec, rule IntI, erule ranI, simp add: isCap_simps)\n apply (simp add: isCap_simps capAligned_def word_bits_def and_mask_less')\n done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/X64/RAB_FN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.37022539259558657, "lm_q1q2_score": 0.1865588598154674}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__7.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__7 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__7 and some rule r*}\nlemma n_SendInvEVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvSVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__7:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__7:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__7 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqESVsinv__7:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__7:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqVsinv__7:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReq N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__7:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__7:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__7.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.18621982605630719}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__19_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__19_on_rules imports n_german_lemma_on_inv__19\nbegin\nsection{*All lemmas on causal relation between inv__19*}\nlemma lemma_inv__19_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__19 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__19) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__19_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.35577487985229844, "lm_q1q2_score": 0.18621981175506883}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__1.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__1 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__1 and some rule r*}\nlemma n_SendInvAckVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__1:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv3) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv3) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__1:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqESVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvSVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvS i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvEVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvE i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReq N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__1:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__1:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3557748798522984, "lm_q1q2_score": 0.1862198117550688}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__131.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__131 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__131 and some rule r*}\nlemma n_PI_Remote_PutXVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__131:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__131:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__131:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__131:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__131:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__131:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__131:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__131:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__131 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__131:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__131:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__131:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__131:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__131:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__131:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__131:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__131:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__131:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__131:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__131:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__131:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__131:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__131:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__131:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__131:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__131:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__131:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__131:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__131:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__131:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__131.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.186158617427378}} {"text": "theory Parser6_Test\nimports \"../../Primitive_Matchers/Parser6\"\nbegin\n\n\ntext\\\nArgument 1: the name of the prefix for all constants which will be defined.\nArgument 2: The path to the firewall (ip6tables-save). A path is represented as list.\n\\\nparse_ip6tables_save parser6_test_firewall = \"data\" \"ip6tables-save\"\n\n\nterm parser6_test_firewall\nthm parser6_test_firewall_def\nthm parser6_test_firewall_FORWARD_default_policy_def\n\nvalue[code] \"parser6_test_firewall\"\n\nlemma \"parser6_test_firewall =\n[(''FORWARD'',\n [Rule (MatchAnd (Match (Src\n (IpAddrNetmask (ipv6preferred_to_int (IPv6AddrPreferred 0x2001 0xdb8 0 0 0x8d3 0 0 1)) 128)))\n (MatchAnd (Match (Dst\n (IpAddrNetmask (ipv6preferred_to_int (IPv6AddrPreferred 0x2001 0xdb8 0 0 0x8d3 0 0 0)) 128)))\n (MatchAnd (Match (IIface (Iface ''eth0'')))\n (Match (OIface (Iface ''foobar''))))))\n (Call ''gh32_-2qns''),\n Rule (MatchAnd (Match (Extra ''-d ::ffff:127.0.0.1/128'') (*We do not support this IPv6 notation!*))\n (MatchAnd (Match (IIface (Iface ''eth0'')))\n (Match (OIface (Iface ''foobar'')))))\n (Call ''gh32_-2qns''),\n Rule (MatchAnd (Match (Src (IpAddrNetmask 1 128)))\n (MatchAnd (Match (IIface (Iface ''lo'')))\n (Match (OIface (Iface ''lo'')))))\n action.Accept,\n Rule (Match (Extra (''--log-prefix '' @ [char_of_nat 34] @\n ''~%&/()=?'' @ [char_of_nat 34] @ \n '' --log-level 6'')))\n Log,\n Rule (Match (Src (IpAddrNetmask 0 128))) action.Drop]),\n (''INPUT'', []), (''OUTPUT'', []),\n (''gh32_-2qns'',\n [Rule (Match (Src\n (IpAddrNetmask (ipv6preferred_to_int (IPv6AddrPreferred 0x2001 0xdb8 0x85a3 0x8d3 0x1319 0x8a2e 0x370 0x7344)) 128)))\n Reject,\n Rule MatchAny Empty,\n Rule MatchAny action.Accept])]\"\nby eval\n\n(*Broken: (IpAddr 0xFFFF0127)) (Match (Extra ''.0.0.1/128'') ! An address must have a word boundary!*)\n\nlemma \"simple_fw_valid\n (to_simple_firewall (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD parser6_test_firewall_FORWARD_default_policy\n (map_of parser6_test_firewall)))))))\" by eval\n\nlemma \"map simple_rule_ipv6_toString\n (to_simple_firewall (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD parser6_test_firewall_FORWARD_default_policy\n (map_of parser6_test_firewall))))))) =\n[''ACCEPT all -- 2001:db8::8d3:0:0:1/128 2001:db8:0:0:8d3::/128 in: eth0 out: foobar '',\n ''ACCEPT all -- ::/0 ::/0 in: eth0 out: foobar '',\n ''ACCEPT all -- ::1/128 ::/0 in: lo out: lo '',\n ''DROP all -- ::/128 ::/0 '',\n ''DROP all -- ::/0 ::/0 '']\" by eval \n(*33.224s*)\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Examples/Parser_Test/Parser6_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.36658972248186006, "lm_q1q2_score": 0.18615861039910955}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__26_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__26_on_rules imports n_german_lemma_on_inv__26\nbegin\nsection{*All lemmas on causal relation between inv__26*}\nlemma lemma_inv__26_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__26 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__26) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__26_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.3380771308191988, "lm_q1q2_score": 0.18614775834807187}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__36_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__36_on_rules imports n_german_lemma_on_inv__36\nbegin\nsection{*All lemmas on causal relation between inv__36*}\nlemma lemma_inv__36_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__36) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__36_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.3380771308191988, "lm_q1q2_score": 0.18614775834807187}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ArraysMemInstance\nimports Arrays CompoundCTypes\nbegin\n\nprimrec\n array_tag_n :: \"nat \\ ('a::c_type,'b::finite) array typ_info\"\nwhere\n atn_base:\n \"array_tag_n 0 = ((empty_typ_info (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @\n nat_to_bin_string (CARD('b::finite))))::('a::c_type,'b) array\n typ_info)\"\n| atn_rec:\n \"array_tag_n (Suc n) = ((ti_typ_combine TYPE('a::c_type)\n (\\x. index x n) (\\x f. update f n x) (replicate n CHR ''1'')\n (array_tag_n n))::('a,'b::finite) array typ_info)\"\n\ndefinition array_tag :: \"('a::c_type,'b::finite) array itself \\ ('a,'b) array typ_info\" where\n \"array_tag t \\ array_tag_n (CARD('b))\"\n\ninstance array :: (c_type,finite) c_type ..\n\noverloading typ_info_array \\ typ_info_t begin\ndefinition typ_info_array: \"typ_info_array (w::('a::c_type,'b::finite) array itself) \\ array_tag w\"\nend\n\nlemma field_names_array_tag_length [rule_format]:\n \"x \\ set (field_names_list (array_tag_n n)) \\ length x < n\"\n by (induct n) auto\n\nlemma replicate_mem_field_names_array_tag [simp]:\n \"replicate n x \\ set (field_names_list (array_tag_n n))\"\n by (fastforce dest: field_names_array_tag_length)\n\nlemma aggregate_array_tag [simp]:\n \"aggregate (array_tag_n n)\"\n by (cases n; simp)\n\nlemma wf_desc_array_tag [simp]:\n \"wf_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\n by (induct n; simp) (fastforce elim: wf_desc_ti_typ_combine)\n\nlemma wf_size_desc_array_tag [simp]:\n \"0 < n \\ wf_size_desc ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\n apply(induct n; simp)\n apply(case_tac \"n=0\"; simp)\n apply(rule wf_size_desc_ti_typ_combine)\n apply simp\n done\n\nlemma g_ind_array_tag_udpate [simp]:\n \"\\ n \\ m; n \\ CARD('b) \\ \\\n g_ind (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\n by (induct n; fastforce elim: g_ind_ti_typ_combine)\n\nlemma fc_array_tag_udpate [simp]:\n \"\\ n \\ m; n \\ CARD('b) \\ \\\n fu_commutes (update_ti_t ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)) (\\x f. update f m x)\"\n by (induct n; fastforce elim: fc_ti_typ_combine simp: fg_cons_def)\n\nlemma f_ind_array_tag_udpate [simp]:\n \"\\ n \\ m; m < CARD('b) \\ \\\n f_ind (\\x. index x m) (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\n by (induct n; fastforce elim: f_ind_ti_typ_combine)\n\nlemma fa_fu_g_array_tag_udpate [simp]:\n \"\\ n \\ m; m < CARD('b) \\ \\\n fa_ind (lf_fd ` lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) []) (\\x f. update f m x)\"\n by (induct n; fastforce elim: fa_ind_ti_typ_combine)\n\nlemma wf_fdp_array_tag [simp]:\n \"n \\ CARD('b) \\ wf_lf (lf_set ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info) [])\"\n by (induct n; fastforce elim: wf_lf_ti_typ_combine)\n\nlemma upd_local_update [simp]:\n \"upd_local (\\x f. update f n x)\"\n unfolding upd_local_def\n by (metis update_update)\n\nlemma fu_eq_mask_array_tag [simp, rule_format]:\n \"n \\ CARD('b) \\ (\\m. (\\k v. k < CARD('b) \\\n index ((m v)::('a,'b) array) k = (if n \\ k then\n index (undefined::('a::mem_type,'b::finite) array) k\n else index v k)) \\ fu_eq_mask (array_tag_n n) m)\"\n apply(induct n; clarsimp)\n apply(rule fu_eq_mask_empty_typ_info)\n apply(clarsimp simp: array_index_eq)\n apply(rule fu_eq_mask_ti_typ_combine; clarsimp?)\n apply(drule_tac x=\"\\v. update (m v) n (index undefined n)\" in spec)\n apply(erule impE)\n apply clarsimp\n apply(case_tac \"k=n\"; simp)\n apply(subgoal_tac \"\\v bs. m (update v n bs) = update (m v) n bs\"; clarsimp)\n apply(clarsimp simp: array_index_eq)\n apply(case_tac \"i=n\"; clarsimp)\n apply(case_tac \"Suc n \\ i\"; clarsimp)\n apply(clarsimp simp: fg_cons_def)\n done\n\nlemma size_td_array_tag [simp]:\n \"size_td (((array_tag_n n)::('a,'b::finite) array typ_info)) =\n n * size_of TYPE('a::c_type)\"\n by (induct n; simp add: size_td_lt_ti_typ_combine size_of_def)\n\nlemma align_td_array_tag:\n \"0 < n \\\n align_td ((array_tag_n n)::('a,'b::finite) array typ_info) = (align_td (typ_info_t (TYPE('a::c_type))))\"\n by (induct n; clarsimp)\n (case_tac \"n = 0\"; clarsimp simp: align_of_def max_def)\n\nlemma align_field_array [simp]:\n \"align_field ((array_tag_n n)::('a::mem_type,'b::finite) array typ_info)\"\n by (induct_tac n; clarsimp)\n (metis align_field_ti_typ_combine align_of_def align_size_of dvd_mult size_td_array_tag)\n\ninstance array :: (mem_type,finite) mem_type_sans_size\n apply intro_classes\n apply(simp_all add: typ_info_array array_tag_def size_of_def norm_bytes_def)\n apply clarsimp\n apply(rule fu_eq_mask)\n apply(simp add: size_of_def)\n apply(rule fu_eq_mask_array_tag; simp)\n apply (clarsimp simp: align_of_def typ_info_array array_tag_def align_td_array_tag)\n apply (metis align_of_def align_size_of dvd_mult size_of_def)\n done\n\ndeclare atn_base [simp del]\ndeclare atn_rec [simp del]\n\nlemma size_of_array [simp]:\n \"size_of TYPE(('a,'b::finite) array) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma size_td_array:\n \"size_td (typ_info_t TYPE(('a,'b::finite) array)) = CARD('b) * size_of TYPE('a::c_type)\"\n by (simp add: size_of_def typ_info_array array_tag_def)\n\nlemma align_td_array:\n \"2^align_td (typ_info_t TYPE(('a,'b::finite) array)) = align_of TYPE('a::c_type)\"\n by (simp add: align_of_def typ_info_array array_tag_def align_td_array_tag)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/ArraysMemInstance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.34510526422232046, "lm_q1q2_score": 0.1860059518980298}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__33_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__33_on_rules imports n_german_lemma_on_inv__33\nbegin\nsection{*All lemmas on causal relation between inv__33*}\nlemma lemma_inv__33_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__33) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__33_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.1857373694606667}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__36_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__36_on_rules imports n_germanSimp_lemma_on_inv__36\nbegin\nsection{*All lemmas on causal relation between inv__36*}\nlemma lemma_inv__36_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__36) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__36_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.18573736946066666}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__30.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__30 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__30 and some rule r*}\nlemma n_StoreVsinv__30:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\\(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData'')))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (neg (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__30 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE)) (neg (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__30.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.18572181923758121}} {"text": "theory ArityAnalysisSpec\nimports ArityAnalysisAbinds\nbegin\n\nlocale SubstArityAnalysis = EdomArityAnalysis + \n assumes Aexp_subst_restr: \"x \\ S \\ y \\ S \\ (Aexp e[x::=y] \\ a) f|` S = (Aexp e\\a) f|` S\"\n\nlocale ArityAnalysisSafe = SubstArityAnalysis +\n assumes Aexp_Var: \"up \\ n \\ (Aexp (Var x)\\n) x\"\n assumes Aexp_App: \"Aexp e \\(inc\\n) \\ esing x \\ (up\\0) \\ Aexp (App e x) \\ n\"\n assumes Aexp_Lam: \"env_delete y (Aexp e \\(pred\\n)) \\ Aexp (Lam [y]. e) \\ n\"\n assumes Aexp_IfThenElse: \"Aexp scrut\\0 \\ Aexp e1\\a \\ Aexp e2\\a \\ Aexp (scrut ? e1 : e2)\\a\"\n\nlocale ArityAnalysisHeapSafe = ArityAnalysisSafe + ArityAnalysisHeapEqvt +\n assumes edom_Aheap: \"edom (Aheap \\ e\\ a) \\ domA \\\"\n assumes Aheap_subst: \"x \\ domA \\ \\ y \\ domA \\ \\ Aheap \\[x::h=y] e[x ::=y] = Aheap \\ e\"\n\nlocale ArityAnalysisLetSafe = ArityAnalysisHeapSafe +\n assumes Aexp_Let: \"ABinds \\\\(Aheap \\ e\\a) \\ Aexp e\\a \\ Aheap \\ e\\a \\ Aexp (Let \\ e)\\a\"\n\nlocale ArityAnalysisLetSafeNoCard = ArityAnalysisLetSafe +\n assumes Aheap_heap3: \"x \\ thunks \\ \\ (Aheap \\ e\\a) x = up\\0\"\n\ncontext SubstArityAnalysis\nbegin\n lemma Aexp_subst_upd: \"(Aexp e[y::=x]\\n) \\ (Aexp e\\n)(y := \\, x := up\\0)\"\n proof-\n have \"Aexp e[y::=x]\\n f|`(-{x,y}) = Aexp e\\n f|` (-{x,y})\" by (rule Aexp_subst_restr) auto\n \n show ?thesis\n proof (rule fun_belowI)\n fix x'\n have \"x' = x \\ x' = y \\ x' \\ (-{x,y})\" by auto\n thus \"(Aexp e[y::=x]\\n) x' \\ ((Aexp e\\n)(y := \\, x := up\\0)) x'\"\n proof(elim disjE)\n assume \"x' \\ (-{x,y})\"\n moreover\n have \"Aexp e[y::=x]\\n f|`(-{x,y}) = Aexp e\\n f|` (-{x,y})\" by (rule Aexp_subst_restr) auto\n note fun_cong[OF this, where x = x']\n ultimately\n show ?thesis by auto\n next\n assume \"x' = x\"\n thus ?thesis by simp\n next\n assume \"x' = y\"\n thus ?thesis\n using [[simp_trace]]\n by simp\n qed\n qed\n qed\n\n lemma Aexp_subst: \"Aexp (e[y::=x])\\a \\ env_delete y ((Aexp e)\\a) \\ esing x\\(up\\0)\"\n apply (rule below_trans[OF Aexp_subst_upd])\n apply (rule fun_belowI)\n apply auto\n done\nend\n\ncontext ArityAnalysisSafe\nbegin\n\nlemma Aexp_Var_singleton: \"esing x \\ (up\\n) \\ Aexp (Var x) \\ n\"\n by (simp add: Aexp_Var)\n\nlemma fup_Aexp_Var: \"esing x \\ n \\ fup\\(Aexp (Var x))\\n\"\n by (cases n) (simp_all add: Aexp_Var)\nend\n\n\ncontext ArityAnalysisLetSafe\nbegin\n lemma Aheap_nonrec:\n assumes \"nonrec \\\"\n shows \"Aexp e\\a f|` domA \\ \\ Aheap \\ e\\a\"\n proof-\n have \"ABinds \\\\(Aheap \\ e\\a) \\ Aexp e\\a \\ Aheap \\ e\\a \\ Aexp (Let \\ e)\\a\" by (rule Aexp_Let)\n note env_restr_mono[where S = \"domA \\\", OF this]\n moreover\n from assms\n have \"ABinds \\\\(Aheap \\ e\\a) f|` domA \\ = \\\"\n by (rule nonrecE) (auto simp add: fv_def fresh_def dest!: subsetD[OF fup_Aexp_edom])\n moreover\n have \"Aheap \\ e\\a f|` domA \\ = Aheap \\ e\\a\" \n by (rule env_restr_useless[OF edom_Aheap])\n moreover\n have \"(Aexp (Let \\ e)\\a) f|` domA \\ = \\\" \n by (auto dest!: subsetD[OF Aexp_edom])\n ultimately\n show \"Aexp e\\a f|` domA \\ \\ Aheap \\ e\\a\"\n by (simp add: env_restr_join)\n qed\nend\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/ArityAnalysisSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.35220177524832036, "lm_q1q2_score": 0.18572181565205598}} {"text": "(* Title: HOL/Auth/n_german_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_on_inis imports n_german_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (f=inv__2 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__10 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__16 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__17 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__19 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__23 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__24 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__26 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__33 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__39 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__40 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__42 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__44 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__46 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__48 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__52 p__Inv3 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__2 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__10 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__16 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__17 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__19 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__23 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__24 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__26 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__33 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__39 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__40 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__42 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__44 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__46 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__48 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__52 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.30735802320985245, "lm_q1q2_score": 0.18562329456751187}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchLevityCatch_AI\nimports\n \"ArchBCorres_AI\"\n \"Lib.LemmaBucket\"\n \"Lib.SplitRule\"\nbegin\n\ncontext Arch begin global_naming ARM_HYP\n\nlemma asid_high_bits_of_shift :\n \"asid_high_bits_of (ucast x << asid_low_bits) = x\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_eqI)\n apply (simp add: word_size nth_ucast nth_shiftr nth_shiftl asid_low_bits_def)\n done\n\nlemma ptrFormPAddr_addFromPPtr :\n \"ptrFromPAddr (Platform.ARM_HYP.addrFromPPtr x) = x\"\n by (simp add: ptrFromPAddr_def Platform.ARM_HYP.addrFromPPtr_def)\n\n(****** From GeneralLib *******)\n\nlemma asid_high_bits_of_add_ucast:\n \"is_aligned w asid_low_bits \\\n asid_high_bits_of (ucast (x::10 word) + w) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr is_aligned_nth)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: nth_ucast)\n apply (drule test_bit_size)\n apply (simp add: word_size asid_low_bits_def)\n apply (auto dest: test_bit_size simp: word_size asid_low_bits_def nth_ucast)\n done\n\nlemma asid_high_bits_of_add:\n \"\\is_aligned w asid_low_bits; x \\ 2 ^ asid_low_bits - 1\\\n \\ asid_high_bits_of (w + x) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr\n is_aligned_nth)\n apply (drule le2p_bits_unset_32, simp add: asid_low_bits_def)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size)\n apply (case_tac \"na < asid_low_bits\")\n apply (simp add: asid_low_bits_def linorder_not_less word_bits_def)\n apply (auto dest: test_bit_size\n simp: asid_low_bits_def word_bits_def nth_ucast)\n done\n\nlemma preemption_point_success [simp,intro]:\n \"((Inr (), s') \\ fst (preemption_point s)) \\\n \\f es. s' = s \\ machine_state := machine_state s \\ irq_state := f (irq_state (machine_state s)) \\, exst := es \\\"\n apply (auto simp: in_monad preemption_point_def do_machine_op_def\n select_f_def select_def getActiveIRQ_def alternative_def\n do_extended_op_def OR_choiceE_def mk_ef_def\n split: option.splits if_splits\n intro: exI[where x=id])\n apply (rule_tac x=Suc in exI, rule_tac x=\"exst bb\" in exI, force)+\n apply (rule_tac x=id in exI, rule_tac x=\"exst b\" in exI, force)+\n done\n\nlemma pageBits_less_word_bits [simp]:\n \"pageBits < word_bits\" by (simp add: pageBits_def word_bits_conv)\n\nlemma aobj_ref_arch_cap[simp]:\n \"aobj_ref (arch_default_cap aty ptr us dev) = Some ptr\"\n apply (case_tac aty)\n apply (simp_all add: aobj_ref_def arch_default_cap_def p_assoc_help)\n done\n\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM_HYP/ArchLevityCatch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.18551996674150922}} {"text": "(* Title: HOL/MicroJava/JVM/JVMDefensive.thy\n Author: Gerwin Klein\n Copyright GPL\n*)\n\nheader {* \\isaheader{A Defensive JVM} *}\n\ntheory JVMDefensive\nimports JVMExec \"../Common/Conform\"\nbegin\n\ntext {*\n Extend the state space by one element indicating a type error (or\n other abnormal termination) *}\ndatatype 'a type_error = TypeError | Normal 'a\n\nfun is_Addr :: \"val \\ bool\" where\n \"is_Addr (Addr a) \\ True\"\n| \"is_Addr v \\ False\"\n\nfun is_Intg :: \"val \\ bool\" where\n \"is_Intg (Intg i) \\ True\"\n| \"is_Intg v \\ False\"\n\nfun is_Bool :: \"val \\ bool\" where\n \"is_Bool (Bool b) \\ True\"\n| \"is_Bool v \\ False\"\n\ndefinition is_Ref :: \"val \\ bool\" where\n \"is_Ref v \\ v = Null \\ is_Addr v\"\n\nprimrec check_instr :: \"[instr, jvm_prog, heap, val list, val list, \n cname, mname, pc, frame list] \\ bool\" where\n check_instr_Load:\n \"check_instr (Load n) P h stk loc C M\\<^sub>0 pc frs = \n (n < length loc)\"\n\n| check_instr_Store:\n \"check_instr (Store n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk \\ n < length loc)\"\n\n| check_instr_Push:\n \"check_instr (Push v) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (\\is_Addr v)\"\n\n| check_instr_New:\n \"check_instr (New C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n is_class P C\"\n\n| check_instr_Getfield:\n \"check_instr (Getfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk \\ (\\C' T. P \\ C sees F:T in C') \\ \n (let (C', T) = field P C F; ref = hd stk in \n C' = C \\ is_Ref ref \\ (ref \\ Null \\ \n h (the_Addr ref) \\ None \\ \n (let (D,vs) = the (h (the_Addr ref)) in \n P \\ D \\\\<^sup>* C \\ vs (F,C) \\ None \\ P,h \\ the (vs (F,C)) :\\ T))))\" \n\n| check_instr_Putfield:\n \"check_instr (Putfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (1 < length stk \\ (\\C' T. P \\ C sees F:T in C') \\\n (let (C', T) = field P C F; v = hd stk; ref = hd (tl stk) in \n C' = C \\ is_Ref ref \\ (ref \\ Null \\ \n h (the_Addr ref) \\ None \\ \n (let D = fst (the (h (the_Addr ref))) in \n P \\ D \\\\<^sup>* C \\ P,h \\ v :\\ T))))\" \n\n| check_instr_Checkcast:\n \"check_instr (Checkcast C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_class P C \\ is_Ref (hd stk))\"\n\n| check_instr_Invoke:\n \"check_instr (Invoke M n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (n < length stk \\ is_Ref (stk!n) \\ \n (stk!n \\ Null \\ \n (let a = the_Addr (stk!n); \n C = cname_of h a;\n Ts = fst (snd (method P C M))\n in h a \\ None \\ P \\ C has M \\ \n P,h \\ rev (take n stk) [:\\] Ts)))\"\n \n| check_instr_Return:\n \"check_instr Return P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ ((0 < length frs) \\ \n (P \\ C\\<^sub>0 has M\\<^sub>0) \\ \n (let v = hd stk; \n T = fst (snd (snd (method P C\\<^sub>0 M\\<^sub>0)))\n in P,h \\ v :\\ T)))\"\n \n| check_instr_Pop:\n \"check_instr Pop P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk)\"\n\n| check_instr_IAdd:\n \"check_instr IAdd P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (1 < length stk \\ is_Intg (hd stk) \\ is_Intg (hd (tl stk)))\"\n\n| check_instr_IfFalse:\n \"check_instr (IfFalse b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_Bool (hd stk) \\ 0 \\ int pc+b)\"\n\n| check_instr_CmpEq:\n \"check_instr CmpEq P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (1 < length stk)\"\n\n| check_instr_Goto:\n \"check_instr (Goto b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 \\ int pc+b)\"\n\n| check_instr_Throw:\n \"check_instr Throw P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_Ref (hd stk))\"\n\ndefinition check :: \"jvm_prog \\ jvm_state \\ bool\" where\n \"check P \\ = (let (xcpt, h, frs) = \\ in\n (case frs of [] \\ True | (stk,loc,C,M,pc)#frs' \\ \n P \\ C has M \\\n (let (C',Ts,T,mxs,mxl\\<^sub>0,ins,xt) = method P C M; i = ins!pc in\n pc < size ins \\ size stk \\ mxs \\\n check_instr i P h stk loc C M pc frs')))\"\n\n\ndefinition exec_d :: \"jvm_prog \\ jvm_state \\ jvm_state option type_error\" where\n \"exec_d P \\ = (if check P \\ then Normal (exec (P, \\)) else TypeError)\"\n\n\ninductive_set\n exec_1_d :: \"jvm_prog \\ (jvm_state type_error \\ jvm_state type_error) set\" \n and exec_1_d' :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ \\ _ -jvmd\\\\<^sub>1 _\" [61,61,61]60)\n for P :: jvm_prog\nwhere\n \"P \\ \\ -jvmd\\\\<^sub>1 \\' \\ (\\,\\') \\ exec_1_d P\"\n| exec_1_d_ErrorI: \"exec_d P \\ = TypeError \\ P \\ Normal \\ -jvmd\\\\<^sub>1 TypeError\"\n| exec_1_d_NormalI: \"exec_d P \\ = Normal (Some \\') \\ P \\ Normal \\ -jvmd\\\\<^sub>1 Normal \\'\"\n\n-- \"reflexive transitive closure:\"\ndefinition exec_all_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ |- _ -jvmd-> _\" [61,61,61]60) where\n exec_all_d_def1: \"P |- \\ -jvmd-> \\' \\ (\\,\\') \\ (exec_1_d P)\\<^sup>*\"\n\nnotation (xsymbols)\n \"exec_all_d\" (\"_ \\ _ -jvmd\\ _\" [61,61,61]60)\n\nlemma exec_1_d_eq:\n \"exec_1_d P = {(s,t). \\\\. s = Normal \\ \\ t = TypeError \\ exec_d P \\ = TypeError} \\ \n {(s,t). \\\\ \\'. s = Normal \\ \\ t = Normal \\' \\ exec_d P \\ = Normal (Some \\')}\"\nby (auto elim!: exec_1_d.cases intro!: exec_1_d.intros)\n\n\ndeclare split_paired_All [simp del]\ndeclare split_paired_Ex [simp del]\n\nlemma if_neq [dest!]:\n \"(if P then A else B) \\ B \\ P\"\n by (cases P, auto)\n\nlemma exec_d_no_errorI [intro]:\n \"check P \\ \\ exec_d P \\ \\ TypeError\"\n by (unfold exec_d_def) simp\n\ntheorem no_type_error_commutes:\n \"exec_d P \\ \\ TypeError \\ exec_d P \\ = Normal (exec (P, \\))\"\n by (unfold exec_d_def, auto)\n\n\nlemma defensive_imp_aggressive:\n \"P \\ (Normal \\) -jvmd\\ (Normal \\') \\ P \\ \\ -jvm\\ \\'\"\n(*<*)\nproof -\n have \"\\x y. P \\ x -jvmd\\ y \\ \\\\ \\'. x = Normal \\ \\ y = Normal \\' \\ P \\ \\ -jvm\\ \\'\"\n apply (unfold exec_all_d_def1)\n apply (erule rtrancl_induct)\n apply (simp add: exec_all_def)\n apply (fold exec_all_d_def1)\n apply simp\n apply (intro allI impI)\n apply (erule exec_1_d.cases, simp)\n apply (simp add: exec_all_def exec_d_def split: type_error.splits split_if_asm)\n apply (rule rtrancl_trans, assumption)\n apply blast\n done\n moreover\n assume \"P \\ (Normal \\) -jvmd\\ (Normal \\')\" \n ultimately\n show \"P \\ \\ -jvm\\ \\'\" by blast\nqed\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/JVM/JVMDefensive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.334589441253186, "lm_q1q2_score": 0.18551996306250362}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory LemmaBucket_C\nimports\n Lib\n \"$L4V_ARCH/WordSetup\"\n TypHeapLib\n \"../tools/c-parser/umm_heap/ArrayAssertion\"\nbegin\n\ndeclare word_neq_0_conv [simp del]\n\nlemma Ptr_not_null_pointer_not_zero: \"(Ptr p \\ NULL)=(p\\0)\"\n by simp\n\nlemma hrs_mem_f: \"f (hrs_mem s) = hrs_mem (hrs_mem_update f s)\"\n apply (cases s) \n apply (clarsimp simp: hrs_mem_def hrs_mem_update_def)\n done\n\nlemma hrs_mem_heap_update:\n \"heap_update p v (hrs_mem s) = hrs_mem (hrs_mem_update (heap_update p v) s)\"\n apply (rule hrs_mem_f)\n done\n\nlemma addr_card_wb:\n \"addr_card = 2 ^ word_bits\"\n by (simp add: addr_card_def card_word word_bits_conv)\n\nlemma surj_Ptr [simp]:\n \"surj Ptr\"\n by (rule surjI [where f = ptr_val], simp)\n\nlemma inj_Ptr [simp]:\n \"inj Ptr\"\n apply (rule injI)\n apply simp\n done\n \nlemma bij_Ptr :\n \"bij Ptr\" \n by (simp add: bijI)\n\nlemma exec_Guard:\n \"(G \\ \\Guard Err S c, Normal s\\ \\ s')\n = (if s \\ S then G \\ \\c, Normal s\\ \\ s'\n else s' = Fault Err)\"\n by (auto split: if_split elim!: exec_elim_cases intro: exec.intros)\n\nlemma to_bytes_word8:\n \"to_bytes (v :: word8) xs = [v]\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma byte_ptr_guarded:\"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc)\n\nlemma heap_update_list_append:\n fixes v :: word8\n shows \"heap_update_list s (xs @ ys) hp = \n heap_update_list (s + of_nat (length xs)) ys (heap_update_list s xs hp)\"\nproof (induct xs arbitrary: ys rule: rev_induct)\n case Nil\n show ?case by simp\nnext\n case (snoc v' vs')\n show ?case\n apply (simp add: snoc.hyps field_simps)\n apply (rule arg_cong [where f = \"heap_update_list (1 + (s + of_nat (length vs'))) ys\"])\n apply (rule ext)\n apply simp\n done\nqed\n\nlemma intvl_aligned_bottom_eq:\n fixes p :: \"'a::len word\"\n assumes al1: \"is_aligned x n\" \n and al2: \"is_aligned p bits\"\n and nb: \"\\ n < bits\"\n and off: \"off \\ 2 ^ bits\" \"off \\ 0\"\n shows \"(x \\ {p ..+ off}) = (x = p)\"\nproof (rule iffI)\n assume \"x = p\"\n thus \"x \\ {p ..+ off}\" using off\n by (simp add: intvl_self)\nnext\n assume x_in_intvl: \"x \\ {p ..+ off}\"\n\n show \"x = p\"\n proof cases\n assume wb: \"bits < len_of TYPE('a)\"\n\n from x_in_intvl obtain kp where xp: \"x = p + of_nat kp\" and kp: \"kp < off\"\n by (clarsimp dest!: intvlD)\n \n hence \"is_aligned (p + of_nat kp) n\" using al1 by simp\n hence \"2 ^ n dvd unat (p + of_nat kp)\" unfolding is_aligned_def .\n hence \"2 ^ n dvd unat p + kp\" using kp off wb\n apply -\n apply (subst (asm) iffD1 [OF unat_plus_simple])\n apply (rule is_aligned_no_wrap' [OF al2])\n apply (rule of_nat_power)\n apply simp_all[2]\n apply (subst (asm) unat_of_nat)\n apply (subst (asm) mod_less)\n apply (erule order_less_le_trans)\n apply (erule order_trans)\n apply simp\n apply simp\n done\n\n moreover from al2 obtain q2 where pbits: \"p = 2 ^ bits * of_nat q2\"\n and q2: \"q2 < 2 ^ (len_of TYPE('a) - bits)\"\n by (rule is_alignedE)\n \n moreover from nb obtain kn where nbits: \"n = bits + kn\"\n by (clarsimp simp: linorder_not_less le_iff_add)\n\n ultimately have \"2 ^ bits dvd 2 ^ bits * q2 + kp\" \n apply (simp add: power_add)\n apply (simp add: unat_mult_power_lem [OF q2])\n apply (erule dvd_mult_left)\n done\n \n hence \"2 ^ bits dvd kp\" by (simp add: dvd_reduce_multiple)\n with kp have \"kp = 0\" \n apply -\n apply (erule contrapos_pp)\n apply (simp add: linorder_not_less)\n apply (drule (1) dvd_imp_le)\n apply (erule order_trans [OF off(1)])\n done\n \n thus ?thesis using xp by simp\n next\n assume wb: \"\\ bits < len_of TYPE('a)\"\n with assms\n show ?thesis by (simp add: is_aligned_mask mask_def power_overflow)\n qed\nqed\n\nlemma intvl_mem_weaken: \"x \\ {p..+a - n} \\ x \\ {p..+a}\"\n apply -\n apply (drule intvlD)\n apply clarsimp\n apply (rule intvlI)\n apply simp\n done\n\n\nlemma upto_intvl_eq:\n fixes x :: \"'a::len word\"\n assumes al: \"is_aligned x n\"\n shows \"{x..+2 ^ n} = {x .. x + 2 ^ n - 1}\"\nproof cases\n assume \"n < len_of TYPE('a)\"\n with assms show ?thesis\n unfolding intvl_def\n apply simp\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k < (2 :: 'a word) ^ n\")\n apply (intro conjI)\n apply (erule (1) is_aligned_no_wrap')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (simp add: word_less_sub_1)\n apply (simp add: field_simps is_aligned_no_overflow)\n apply (simp add: of_nat_power)\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply clarsimp\n apply (rule unat_less_power, assumption)\n apply (subst word_less_sub_le [symmetric])\n apply assumption\n apply (rule word_diff_ls'(4))\n apply (simp add: field_simps)\n apply assumption\n done\nnext\n assume \"\\ n < len_of TYPE('a)\"\n with assms show ?thesis\n apply (simp add: is_aligned_mask mask_def power_overflow intvl_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rename_tac w)\n apply (case_tac w)\n apply (rename_tac m)\n apply (rule_tac x=m in exI)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n done\nqed\n\nlemma upto_intvl_eq': \n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ x + (of_nat b - 1); b \\ 0; b \\ 2 ^ len_of TYPE('a)\\ \\ {x..+b} = {x .. x + of_nat b - 1}\"\n unfolding intvl_def\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k \\ (of_nat (b - 1) :: 'a word)\")\n apply (intro conjI)\n apply (erule word_random)\n apply simp\n apply (subst field_simps [symmetric], rule word_plus_mono_right)\n apply simp\n apply assumption\n apply (subst Word_Lemmas.of_nat_mono_maybe_le [symmetric])\n apply simp\n apply simp\n apply simp\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI) \n apply simp\n apply (simp add: unat_sub)\n apply (rule nat_diff_less)\n apply (subst (asm) word_le_nat_alt, erule order_le_less_trans)\n apply (subst add_diff_eq[symmetric], subst unat_plus_if')\n apply (simp add: no_olen_add_nat)\n apply (simp add: le_eq_less_or_eq)\n apply (erule disjE)\n apply (subst unat_minus_one)\n apply (erule (1) of_nat_neq_0)\n apply (simp add: unat_of_nat)\n apply (erule ssubst, rule unat_lt2p)\n apply (simp add: word_le_nat_alt)\n done\n\nlemma intvl_aligned_top:\n fixes x :: \"'a::len word\"\n assumes al1: \"is_aligned x n\" \n and al2: \"is_aligned p bits\"\n and nb: \"n \\ bits\"\n and offn: \"off < 2 ^ n\"\n and wb: \"bits < len_of TYPE('a)\"\n shows \"(x \\ {p ..+ 2 ^ bits - off}) = (x \\ {p ..+ 2 ^ bits})\"\nproof (rule iffI)\n assume \"x \\ {p..+2 ^ bits - off}\"\n thus \"x \\ {p..+2 ^ bits}\" by (rule intvl_mem_weaken)\nnext\n assume asm: \"x \\ {p..+2 ^ bits}\"\n\n show \"x \\ {p..+2 ^ bits - off}\"\n proof (cases \"n = 0\")\n case True\n with offn asm show ?thesis by simp\n next\n case False\n \n from asm have \"x \\ {p .. p + 2 ^ bits - 1}\"\n by (simp add: upto_intvl_eq [OF al2])\n then obtain q where xp: \"x = p + of_nat (q * 2 ^ n)\" and qb: \"q < 2 ^ (bits - n)\" using False nb\n by (fastforce dest!: is_aligned_diff[OF al1 al2 wb,simplified field_simps])\n \n have \"q * 2 ^ n < 2 ^ bits - off\"\n proof - \n show ?thesis using offn qb nb\n apply (simp add: less_diff_conv)\n apply (erule (1) nat_add_offset_less)\n apply arith\n done\n qed\n \n with xp show ?thesis\n apply -\n apply (erule ssubst)\n apply (erule intvlI)\n done\n qed\nqed\n\nlemma intvl_nowrap:\n fixes x :: \"'a::len word\"\n shows \"\\y \\ 0; unat y + z \\ 2 ^ len_of TYPE('a)\\ \\ x \\ {x + y ..+ z}\"\n apply clarsimp\n apply (drule intvlD)\n apply clarsimp\n apply (simp add: unat_arith_simps)\n apply (simp split: if_split_asm)\n apply (simp add: unat_of_nat)\n done\n\nlemma heap_update_list_update:\n fixes v :: word8\n shows \"x \\ y \\ heap_update_list s xs (hp(y := v)) x = heap_update_list s xs hp x\"\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp add: heap_update_list_append cong: if_cong)\n done\n\n(* FIXME: generalise *) \nlemma heap_update_list_append2:\n fixes v :: word8\n shows \"length xs + length ys < 2 ^ word_bits \\ heap_update_list s (xs @ ys) hp = \n (heap_update_list s xs (heap_update_list (s + of_nat (length xs)) ys hp))\"\nproof (induct xs arbitrary: hp s)\n case Nil\n show ?case by simp\nnext\n case (Cons v' vs')\n\n have \"(1 :: word32) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"\\ \\ 0\" using Cons.prems\n apply -\n apply (rule of_nat_neq_0)\n apply simp\n apply (simp add: word_bits_conv)\n done\n finally have neq0: \"(1 :: word32) + of_nat (length vs') \\ 0\" .\n\n have \"(1 :: word32) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"unat \\ + length ys < 2 ^ word_bits\" using Cons.prems \n apply (subst unat_of_nat)\n apply (simp add: word_bits_conv)\n done\n finally have lt: \"unat ((1 :: word32) + of_nat (length vs')) + length ys < 2 ^ word_bits\" .\n \n from Cons.prems have \"length vs' + length ys < 2 ^ word_bits\" by simp\n thus ?case\n apply simp\n apply (subst Cons.hyps, assumption)\n apply (rule arg_cong [where f = \"heap_update_list (s + 1) vs'\"])\n apply (rule ext)\n apply (case_tac \"x = s\")\n apply simp\n apply (subst heap_update_nmem_same)\n apply (subst add.assoc)\n apply (rule intvl_nowrap[OF neq0 order_less_imp_le\n [OF lt[unfolded word_bits_def]]])\n apply simp\n apply (clarsimp simp: heap_update_list_update field_simps)\n done\nqed\n\nlemma heap_update_word8:\n \"heap_update p (v :: word8) hp = hp(ptr_val p := v)\"\n unfolding heap_update_def by (simp add: to_bytes_word8)\n\nlemma index_foldr_update2:\n \"\\ n \\ i; i < CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. i < n; n \\ CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\" \n shows \"{a..+b} \\ {c..+d} = {}\"\nproof (rule disjointI, rule notI)\n fix x y\n assume x: \"x \\ {a..+b}\" and y: \"y \\ {c..+d}\" and xy: \"x = y\"\n \n from x obtain kx where \"x = a + of_nat kx\" and kx: \"kx < b\"\n by (clarsimp dest!: intvlD)\n \n moreover from y obtain ky where \"y = c + of_nat ky\" and ky: \"ky < d\"\n by (clarsimp dest!: intvlD)\n \n ultimately have ac: \"a + of_nat kx = c + of_nat ky\" using xy by simp\n \n have \"of_nat kx < (of_nat b :: 'a word)\" using blt kx\n by (rule of_nat_mono_maybe) \n hence \"a + of_nat kx < a + of_nat b\" using alb\n by (rule word_plus_strict_mono_right)\n \n also have \"\\ \\ c\" by (rule abc) \n also have \"\\ \\ c + of_nat ky\" using cld dlt ky\n by - (rule word_random [OF _ iffD1 [OF Word_Lemmas.of_nat_mono_maybe_le]], simp+ )\n finally show False using ac by simp\nqed\n\nlemma intvl_disjoint2:\n fixes a :: \"'a :: len word\"\n assumes abc: \"a + of_nat b \\ c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\" \n shows \"{c..+d} \\ {a..+b} = {}\"\n using abc alb cld blt dlt\n by (subst Int_commute, rule intvl_disjoint1)\n\n \nlemma intvl_off_disj:\n fixes x :: word32\n assumes ylt: \"y \\ off\"\n and zoff: \"z + off < 2 ^ word_bits\"\n shows \"{x ..+ y} \\ {x + of_nat off ..+ z} = {}\"\n using ylt zoff\n apply (cases \"off = 0\")\n apply simp\n apply (rule contrapos_pp [OF TrueI])\n apply (drule intvl_inter)\n apply (erule disjE)\n apply (cut_tac intvl_nowrap [where x = x and y = \"of_nat off :: word32\" and z = z])\n apply simp\n apply (rule of_nat_neq_0)\n apply simp\n apply (unfold word_bits_len_of)\n apply simp\n apply (simp add: unat_of_nat word_bits_conv)\n apply (drule intvlD)\n apply clarsimp\n apply (drule (1) order_less_le_trans)\n apply (drule unat_cong)\n apply (simp add: unat_of_nat word_bits_conv)\n done\n\n\nlemma list_map_comono:\n assumes s: \"list_map m \\\\<^sub>m list_map n\"\n shows \"m \\ n\" \n using s\nproof (induct m arbitrary: n rule: rev_induct)\n case Nil thus ?case unfolding list_map_def by simp\nnext\n case (snoc x xs)\n\n from snoc.prems have \n sm: \"[length xs \\ x] ++ list_map xs \\\\<^sub>m list_map n\"\n unfolding list_map_def by simp\n \n hence xsn: \"xs \\ n\" \n by (rule snoc.hyps [OF map_add_le_mapE])\n \n have \"list_map n (length xs) = Some x\" using sm\n by (simp add: map_le_def list_map_def merge_dom2 set_zip)\n \n hence \"length xs < length n\" and \"x = n ! length xs\"\n by (auto simp add: list_map_eq split: if_split_asm)\n \n thus \"xs @ [x] \\ n\" using xsn \n by (simp add: append_one_prefix less_eq_list_def)\nqed\n\nlemma typ_slice_t_self:\n \"td \\ fst ` set (typ_slice_t td m)\"\n apply (cases td)\n apply (simp split: if_split)\n done\n\nlemma drop_heap_list_le2:\n \"heap_list h n (x + of_nat k)\n = drop k (heap_list h (n + k) x)\"\n by (simp add: drop_heap_list_le)\n\nlemma index_fold_update:\n \"\\ distinct xs; set xs \\ {..< card (UNIV :: 'b set)}; n < card (UNIV :: 'b set) \\ \\\n index (foldr (\\n (arr :: 'a['b :: finite]). Arrays.update arr n (f n (index arr n))) xs v) n\n = (if n \\ set xs then f n (index v n) else index v n)\"\n apply (induct xs)\n apply simp\n apply (rename_tac x xs)\n apply (case_tac \"x = n\"; simp)\n done\n\nlemma heap_update_list_id:\n \"heap_list hp n ptr = xs \\ heap_update_list ptr xs hp = hp\"\n apply (induct xs arbitrary: ptr n)\n apply simp\n apply simp\n apply (case_tac n, simp_all)\n apply (clarsimp simp add: fun_upd_idem)\n done\n\nlemma size_td_list_map2: \"\\f adjs. \\ \\a. size_td_pair (f a) = size_td_pair a \\\n \\ size_td_list (map f adjs) = size_td_list adjs\"\n by (induct_tac adjs, simp_all)\n\nlemma hrs_mem_update_cong:\n \"\\ \\x. f x = f' x \\ \\ hrs_mem_update f = hrs_mem_update f'\"\n by (simp add: hrs_mem_update_def)\n\nlemma Guard_no_cong:\n \"\\ A=A'; c=c' \\ \\ Guard A P c = Guard A' P c'\"\n by simp\n\nlemma heap_update_list_concat_fold:\n assumes \"ptr' = ptr + of_nat (length ys)\" \n shows \"heap_update_list ptr' xs (heap_update_list ptr ys s)\n = heap_update_list ptr (ys @ xs) s\"\n unfolding assms\n apply (induct ys arbitrary: ptr s)\n apply simp\n apply simp\n apply (elim meta_allE)\n apply (erule trans[rotated])\n apply (simp add: field_simps)\n done\n\nlemma heap_update_list_concat_fold_hrs_mem:\n \"ptr' = ptr + of_nat (length ys) \\\n hrs_mem_update (heap_update_list ptr' xs)\n (hrs_mem_update (heap_update_list ptr ys) s)\n = hrs_mem_update (heap_update_list ptr (ys @ xs)) s\"\n by (simp add: hrs_mem_update_def split_def\n heap_update_list_concat_fold)\n\nlemmas heap_update_list_concat_unfold\n = heap_update_list_concat_fold[OF refl, symmetric]\n\nlemma coerce_heap_update_to_heap_updates:\n assumes n: \"n = chunk * m\" and len: \"length xs = n\"\n shows \"heap_update_list x xs\n = (\\s. foldl (\\s n. heap_update_list (x + (of_nat n * of_nat chunk))\n (take chunk (drop (n * chunk) xs)) s)\n s [0 ..< m])\"\n using len[simplified n]\n apply (induct m arbitrary: x xs)\n apply (rule ext, simp)\n apply (rule ext)\n apply (simp only: upt_conv_Cons map_Suc_upt[symmetric])\n apply (subgoal_tac \"\\ys zs. length ys = chunk \\ xs = ys @ zs\")\n apply (clarsimp simp: heap_update_list_concat_unfold foldl_map\n field_simps)\n apply (rule_tac x=\"take chunk xs\" in exI)\n apply (rule_tac x=\"drop chunk xs\" in exI)\n apply simp\n done\n\nlemma update_ti_list_array':\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = y;\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m)) \\\n \\ y = foldr (\\n arr. Arrays.update arr n (update_ti_t (g n) (take v3 (drop (v3 * n) xs)) (index arr n))) [0 ..< n] v\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs y v)\n apply simp\n apply (simp add: access_ti_append)\n apply (elim meta_allE, drule(1) meta_mp)\n apply simp\n apply (rule foldr_cong, (rule refl)+)\n apply (simp add: take_drop)\n apply (subst min.absorb1)\n apply (fold mult_Suc_right, rule mult_le_mono2)\n apply simp\n apply simp\n done\n\nlemma update_ti_list_array:\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = (y :: 'a['b :: finite]);\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m));\n n \\ card (UNIV :: 'b set) \\\n \\ \\m < n. update_ti_t (g m) (take v3 (drop (v3 * m) xs)) (index v m) = index y m\"\n apply (subst update_ti_list_array'[where y=y], assumption+)\n apply clarsimp\n apply (subst index_fold_update)\n apply clarsimp+\n done\n\nlemma access_in_array:\n fixes y :: \"('a :: c_type)['b :: finite]\"\n assumes assms: \"h_val hp x = y\"\n \"n < card (UNIV :: 'b set)\"\n and subst: \"\\xs v. length xs = size_of TYPE('a)\n \\ update_ti_t (typ_info_t TYPE('a)) xs v = f xs\"\n shows \"h_val hp\n (Ptr (ptr_val x + of_nat (n * size_of TYPE('a)))) = index y n\"\n using assms\n apply (simp add: h_val_def drop_heap_list_le2 del: of_nat_mult)\n apply (subst take_heap_list_le[symmetric, where n=\"card (UNIV :: 'b set) * size_of TYPE ('a)\"])\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n apply (simp add: from_bytes_def typ_info_array')\n apply (drule update_ti_list_array, simp+)\n apply (simp add: size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply simp\n apply (drule spec, drule(1) mp)\n apply (simp add: size_of_def ac_simps drop_take)\n apply (subgoal_tac \"length v = size_of TYPE('a)\" for v)\n apply (subst subst, assumption)\n apply (subst(asm) subst, assumption)\n apply simp\n apply (simp add: size_of_def)\n apply (subst le_diff_conv2)\n apply simp\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n done\n\nlemma foo: \"P (access_ti (typ_info_t TYPE (('a :: c_type)[4])) v xs)\"\n apply (simp add: typ_info_array' upt_rec)\n oops\n\nlemma access_ti_list_array:\n \"\\ \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m. m < n \\ v3 \\ length (drop (v3 * m) xs)\n \\ access_ti_pair (f m) (FCP g) (take v3 (drop (v3 * m) xs)) = (h m)\n \\ \\\n access_ti_list (map f [0 ..< n]) (FCP g) xs\n = foldl (op @) [] (map h [0 ..< n])\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs)\n apply simp\n apply (simp add: access_ti_append)\n apply (erule_tac x=\"take (v3 * n) xs\" in meta_allE)\n apply simp\n apply (frule spec, drule mp, rule conjI, rule lessI)\n apply simp\n apply simp\n apply (erule meta_mp)\n apply (auto simp add: drop_take)\n done\n\nlemma take_drop_foldl_concat:\n \"\\ \\y. y < m \\ length (f y) = n; x < m \\\n \\ take n (drop (x * n) (foldl op @ [] (map f [0 ..< m]))) = f x\"\n apply (subst split_upt_on_n, assumption)\n apply (simp only: foldl_concat_concat map_append)\n apply (subst drop_append_miracle)\n apply (induct x, simp_all)[1]\n apply simp\n done\n \ndefinition\n array_ptr_index :: \"(('a :: c_type)['b :: finite]) ptr \\ bool \\ nat \\ 'a ptr\"\nwhere\n \"array_ptr_index p coerce n = CTypesDefs.ptr_add (ptr_coerce p)\n (if coerce \\ n \\ CARD ('b) then 0 else of_nat n)\"\n\nlemmas array_ptr_index_simps\n = array_ptr_index_def[where coerce=False, simplified]\n array_ptr_index_def[where coerce=True, simplified]\n\nlemma heap_update_Array:\n \"heap_update (p ::('a::packed_type['b::finite]) ptr) arr\n = (\\s. foldl (\\s n. heap_update (array_ptr_index p False n)\n (Arrays.index arr n) s) s [0 ..< card (UNIV :: 'b set)])\"\n apply (rule ext, simp add: heap_update_def)\n apply (subst coerce_heap_update_to_heap_updates\n [OF _ refl, where chunk=\"size_of TYPE('a)\" and m=\"card (UNIV :: 'b set)\"])\n apply simp\n apply (rule foldl_cong[OF refl refl])\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def)\n apply (rule_tac f=\"\\xs. heap_update_list p xs s\" for p s in arg_cong)\n apply (simp add: to_bytes_def size_of_def\n packed_type_access_ti)\n apply (simp add: typ_info_array')\n apply (subst fcp_eta[symmetric], subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: packed_type_access_ti size_of_def)\n apply fastforce\n apply (rule take_drop_foldl_concat)\n apply (simp add: size_of_def)\n apply simp\n done\n\nlemma from_bytes_Array_element:\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n assumes len: \"length bs = size_of TYPE('a) * CARD('b)\"\n shows\n \"index (from_bytes bs :: 'a['b]) n \n = from_bytes (take (size_of TYPE('a)) (drop (n * size_of TYPE('a)) bs))\"\n using less\n apply (simp add: from_bytes_def size_of_def typ_info_array')\n apply (subst update_ti_list_array'[OF refl])\n apply simp\n apply (simp add: len size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply (simp add: split_upt_on_n[OF less])\n apply (rule trans, rule foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp+\n apply (subst foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp\n apply (simp add: mult.commute)\n apply (frule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (rule upd_rf)\n apply (simp add: size_of_def len mult.commute)\n done\n\nlemma heap_access_Array_element':\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n shows\n \"index (h_val hp p) n\n = h_val hp (array_ptr_index p False n)\"\n using less\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def h_val_def)\n apply (simp add: from_bytes_Array_element)\n apply (simp add: drop_heap_list_le take_heap_list_le)\n apply (subst take_heap_list_le)\n apply (simp add: le_diff_conv2)\n apply (drule Suc_leI)\n apply (drule_tac k=\"size_of TYPE('a)\" in mult_le_mono2)\n apply (simp add: mult.commute)\n apply simp\n done\n\nlemmas heap_access_Array_element\n = heap_access_Array_element'[simplified array_ptr_index_simps]\n\nlemma heap_update_id:\n \"h_val hp ptr = (v :: 'a :: packed_type)\n \\ heap_update ptr v hp = hp\"\n apply (simp add: h_val_def heap_update_def)\n apply (rule heap_update_list_id[where n=\"size_of TYPE('a)\"])\n apply clarsimp\n apply (simp add: from_bytes_def to_bytes_def update_ti_t_def\n size_of_def field_access_update_same\n td_fafu_idem)\n done\n\nlemma fold_cong':\n \"a = b \\ xs = ys \\ (\\x. x \\ set xs =simp=> f x = g x)\n \\ fold f xs a = fold g ys b\"\n unfolding simp_implies_def\n by (metis fold_cong)\n\nlemma intvl_empty2:\n \"({p ..+ n} = {}) = (n = 0)\"\n by (auto simp add: intvl_def)\n\nlemma heap_update_list_commute:\n \"{p ..+ length xs} \\ {q ..+ length ys} = {}\n \\ heap_update_list p xs (heap_update_list q ys hp)\n = heap_update_list q ys (heap_update_list p xs hp)\"\n apply (cases \"length xs < addr_card\")\n apply (cases \"length ys < addr_card\")\n apply (rule ext, simp add: heap_update_list_value)\n apply blast\n apply (simp_all add: addr_card intvl_overflow intvl_empty2)\n done\n\nlemma heap_update_commute:\n \"\\ {ptr_val p ..+ size_of TYPE('a)} \\ {ptr_val q ..+ size_of TYPE('b)} = {};\n wf_fd (typ_info_t TYPE('a)); wf_fd (typ_info_t TYPE('b)) \\\n \\ heap_update p v (heap_update q (u :: 'b :: c_type) h)\n = heap_update q u (heap_update p (v :: 'a :: c_type) h)\"\n apply (simp add: heap_update_def)\n apply (simp add: heap_update_list_commute heap_list_update_disjoint_same\n to_bytes_def length_fa_ti size_of_def Int_commute)\n done\n\nlemma heap_update_Array_update:\n assumes n: \"n < CARD('b :: finite)\"\n assumes size: \"CARD('b) * size_of TYPE('a :: packed_type) < 2 ^ 32\"\n shows \"heap_update p (Arrays.update (arr :: 'a['b]) n v) hp\n = heap_update (array_ptr_index p False n) v (heap_update p arr hp)\"\nproof -\n\n have P: \"\\x k. \\ x < CARD('b); k < size_of TYPE('a) \\\n \\ unat (of_nat x * of_nat (size_of TYPE('a)) + (of_nat k :: word32))\n = x * size_of TYPE('a) + k\"\n using size\n apply (case_tac \"size_of TYPE('a)\", simp_all)\n apply (case_tac \"CARD('b)\", simp_all)\n apply (subst unat_add_lem[THEN iffD1])\n apply (simp add: unat_word_ariths unat_of_nat less_Suc_eq_le)\n apply (subgoal_tac \"Suc x * size_of TYPE('a) < 2 ^ 32\", simp_all)\n apply (erule order_le_less_trans[rotated], simp add: add_mono)\n apply (subst unat_mult_lem[THEN iffD1])\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n apply (rule order_less_le_trans, erule order_le_less_trans[rotated],\n rule add_mono, simp+)\n apply (simp add: less_Suc_eq_le trans_le_add2)\n apply simp\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n done\n\n let ?key_upd = \"heap_update (array_ptr_index p False n) v\"\n note commute = fold_commute_apply[where h=\"?key_upd\"\n and xs=\"[Suc n ..< CARD('b)]\", where g=f' and f=f' for f']\n\n show ?thesis using n\n apply (simp add: heap_update_Array split_upt_on_n[OF n]\n foldl_conv_fold)\n apply (subst commute)\n apply (simp_all add: packed_heap_update_collapse\n cong: fold_cong')\n apply (rule ext, simp)\n apply (rule heap_update_commute, simp_all add: ptr_add_def)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def intvl_def Suc_le_eq)\n apply (rule set_eqI, clarsimp)\n apply (drule word_unat.Rep_inject[THEN iffD2])\n apply (clarsimp simp: P nat_eq_add_iff1)\n apply (case_tac x, simp_all add: less_Suc_eq_le Suc_diff_le)\n done\nqed\n\nlemma heap_update_id_Array:\n fixes arr :: \"('a :: packed_type)['b :: finite]\"\n shows \"arr = h_val hp p\n \\ heap_update p arr hp = hp\"\n apply (simp add: heap_update_Array)\n apply (rule foldl_does_nothing[where s=hp])\n apply (simp add: heap_access_Array_element' heap_update_id)\n done\n\nlemma heap_update_Array_element'':\n fixes p' :: \"(('a :: packed_type)['b::finite]) ptr\"\n fixes p :: \"('a :: packed_type) ptr\"\n fixes hp w\n assumes p: \"p = array_ptr_index p' False n\"\n assumes n: \"n < CARD('b)\"\n assumes size: \"CARD('b) * size_of TYPE('a) < 2 ^ 32\"\n shows \"heap_update p' (Arrays.update (h_val hp p') n w) hp\n = heap_update p w hp\"\n apply (subst heap_update_Array_update[OF n size])\n apply (simp add: heap_update_id_Array p)\n done\n\nlemmas heap_update_Array_element'\n = heap_update_Array_element''[simplified array_ptr_index_simps]\n\nlemma fourthousand_size:\n \"CARD('b :: fourthousand_count) * size_of TYPE('a :: oneMB_size) < 2 ^ 32\"\n using oneMB_size_ax[where 'a='a] fourthousand_count_ax[where 'a='b]\n apply (clarsimp dest!: nat_le_Suc_less_imp)\n apply (drule(1) mult_mono, simp+)\n done\n\nlemmas heap_update_Array_element\n = heap_update_Array_element'[OF refl _ fourthousand_size]\n\nlemma typ_slice_list_cut:\n \"\\ (\\x \\ set xs. size_td (dt_fst x) = m); m \\ 0; n < (length xs * m) \\\n \\ typ_slice_list xs n =\n typ_slice_pair (xs ! (n div m)) (n mod m)\"\n apply (induct xs arbitrary: n, simp_all)\n apply (intro conjI impI)\n apply simp\n apply (subgoal_tac \"\\n'. n = n' + m\")\n apply clarsimp\n apply (rule_tac x=\"n - m\" in exI)\n apply simp\n done\n\nlemma typ_slice_t_array:\n \"\\ n < CARD('b); y < size_of TYPE('a) \\\n \\ typ_slice_t (export_uinfo (typ_info_t TYPE('a))) y \\\n typ_slice_t (export_uinfo (array_tag TYPE('a['b :: finite])))\n (y + size_of TYPE('a :: mem_type) * n)\"\n apply (simp add: array_tag_def array_tag_n_eq\n split del: if_split)\n apply (rule disjI2)\n apply (subgoal_tac \"y + (size_of TYPE('a) * n) < CARD('b) * size_of TYPE('a)\")\n apply (simp add: typ_slice_list_cut[where m=\"size_of TYPE('a)\"]\n map_td_list_map o_def size_of_def\n sz_nzero[unfolded size_of_def])\n apply (simp add: export_uinfo_def[symmetric])\n apply (rule_tac y=\"Suc n * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n done\n\nlemma h_t_valid_Array_element':\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); coerce \\ n < CARD('b) \\\n \\ htd \\\\<^sub>t array_ptr_index p coerce n\"\n apply (clarsimp simp only: h_t_valid_def valid_footprint_def Let_def\n c_guard_def c_null_guard_def)\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n apply (clarsimp simp: size_td_array size_of_def typ_uinfo_t_def\n typ_info_array array_tag_def)\n apply (intro conjI)\n apply (clarsimp simp: CTypesDefs.ptr_add_def\n field_simps)\n apply (drule_tac x=\"offs * size_of TYPE('a) + y\" in spec)\n apply (drule mp)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (clarsimp simp: field_simps)\n apply (erule map_le_trans[rotated])\n apply (rule list_map_mono)\n apply (subst mult.commute, rule typ_slice_t_array[unfolded array_tag_def])\n apply assumption\n apply (simp add: size_of_def)\n apply (simp add: ptr_aligned_def align_of_def align_td_array\n array_ptr_index_def\n CTypesDefs.ptr_add_def unat_word_ariths unat_of_nat)\n using align_size_of[where 'a='a] align[where 'a='a]\n apply (simp add: align_of_def size_of_def addr_card_def card_word)\n apply (simp add: dvd_mod)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"offs * size_of TYPE('a) + k\" in spec)\n apply (drule mp)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def field_simps)\n apply (erule notE)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (auto simp add: array_ptr_index_def intro: exI[where x=0])\n done\n\nlemma h_t_valid_Array_element:\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); 0 \\ n; n < int CARD('b) \\\n \\ htd \\\\<^sub>t ((ptr_coerce p :: 'a ptr) +\\<^sub>p n)\"\n apply (drule_tac n=\"nat n\" and coerce=False in h_t_valid_Array_element')\n apply simp\n apply (simp add: array_ptr_index_def)\n done\n\nlemma ptr_safe_Array_element:\n \"\\ ptr_safe (p :: (('a :: mem_type)['b :: finite]) ptr) htd; coerce \\ n < CARD('b) \\\n \\ ptr_safe (array_ptr_index p coerce n) htd\"\n apply (simp add: ptr_safe_def)\n apply (erule order_trans[rotated])\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n prefer 2\n apply (auto simp: array_ptr_index_def intro: exI[where x=0])[1]\n apply (clarsimp simp: s_footprint_def s_footprint_untyped_def\n CTypesDefs.ptr_add_def\n size_td_array size_of_def)\n apply (rule_tac x=\"offs * size_of TYPE('a) + x\" in exI)\n apply (simp add: size_of_def)\n apply (rule conjI)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def)\n apply (rule mult_le_mono1)\n apply simp\n apply (thin_tac \"coerce \\ P\" for P)\n apply (elim disjE exE conjE, simp_all add: typ_uinfo_t_def)\n apply (erule order_less_le_trans)\n apply (rule prefix_length_le)\n apply (rule order_trans, erule typ_slice_t_array)\n apply (simp add: size_of_def)\n apply (simp add: size_of_def field_simps typ_info_array)\n done\n\nlemma from_bytes_eq:\n \"from_bytes [x] = x\"\n apply (clarsimp simp:from_bytes_def update_ti_t_def typ_info_word)\n apply (simp add:word_rcat_def)\n apply (simp add:bin_rcat_def)\n by (metis len8 word_of_int_uint word_ubin.Abs_norm)\n\nlemma bytes_disjoint:\"(x::('a::c_type) ptr) \\ y \\ {ptr_val x + a ..+ 1} \\ {ptr_val y + a ..+ 1} = {}\"\n by (clarsimp simp:intvl_def)\n\nlemma byte_ptrs_disjoint:\"(x::('a::c_type) ptr) \\ y \\ \\i < of_nat (size_of TYPE('a)). ptr_val x + i \\ ptr_val y + i\"\n by force\n\nlemma le_step:\"\\(x::('a::len) word) < y + 1; x \\ y\\ \\ x < y\"\n by (metis less_x_plus_1 max_word_max order_less_le)\n\nlemma ptr_add_disjoint:\n \"\\ ptr_val y \\ {ptr_val x ..+ size_of TYPE('a)};\n ptr_val (x::('a::c_type) ptr) < ptr_val (y::('b::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val x + a < ptr_val y\"\n apply (erule swap)\n apply (rule intvl_inter_le [where k=0 and ka=\"unat (ptr_val y - ptr_val x)\"])\n apply clarsimp\n apply (metis (hide_lams, mono_tags) add_diff_cancel2 add_diff_inverse diff_add_cancel\n trans_less_add1 unat_less_helper word_le_less_eq word_less_add_right\n word_of_nat_less word_unat.Rep_inverse)\n apply simp\n done\n\nlemma ptr_add_disjoint2:\n \"\\ ptr_val x \\ {ptr_val y ..+ size_of TYPE('a)};\n ptr_val (y::('b::c_type) ptr) < ptr_val (x::('a::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val y + a < ptr_val x\"\n apply (erule swap)\n apply (rule intvl_inter_le[where k=0 and ka=\"unat (ptr_val x - ptr_val y)\"])\n apply clarsimp\n apply (metis (no_types, hide_lams) add.commute less_imp_le less_le_trans not_le unat_less_helper\n word_diff_ls'(4)) \n apply simp\n done\n\nlemma ptr_aligned_is_aligned:\"\\ptr_aligned (x::('a::c_type) ptr); align_of TYPE('a) = 2 ^ n\\ \\ is_aligned (ptr_val x) n\"\n by (clarsimp simp: ptr_aligned_def is_aligned_def)\n\nlemma intvl_no_overflow:\n assumes no_overflow: \"unat a + b < 2 ^ len_of TYPE('a::len)\"\n shows \"(x \\ {(a :: 'a word) ..+ b}) = (a \\ x \\ x < (a + of_nat b))\"\nproof -\n obtain \"sk\" :: \"'a word \\ 'a word \\ nat \\ nat\"\n where f1: \"\\x y z. x \\ {y..+z} \\ x = y + of_nat (sk x y z) \\ sk x y z < z\"\n using [[metis_new_skolem]] by (metis intvlD)\n\n have f2: \"\\x. a + x < a + of_nat b \\ \\ x < of_nat b\"\n using no_overflow\n by (metis PackedTypes.of_nat_mono_maybe_le add_lessD1 le_add1\n add.commute olen_add_eqv unat_of_nat_eq word_arith_nat_add\n word_plus_strict_mono_right)\n\n have f3: \"\\x y. y \\ {x..+b} \\ of_nat (sk y x b) < (of_nat b :: 'a word)\"\n using no_overflow f1\n by (metis add_lessD1 add.commute of_nat_mono_maybe)\n\n have \"x < a + of_nat b \\ \\ of_nat (sk x a b) < (of_nat b :: 'a word) \\ ?thesis\"\n using f1 f2 by metis\n\n hence \"x < a + of_nat b \\ ?thesis\"\n using f3 by metis\n\n thus \"?thesis\"\n apply (rule disjE)\n apply (rule iffI)\n apply (clarsimp simp: intvl_def)\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (subgoal_tac \"k + (b + unat a) < 2 ^ len_of (TYPE('a)) + b\")\n apply (subgoal_tac \"k + unat a < 2 ^ len_of (TYPE('a))\")\n apply (metis add_lessD1 le_def less_not_refl2 add.commute unat_eq_of_nat word_arith_nat_add)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (rule exI [where x=\"unat (x - a)\"])\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (metis diff_le_self le_add_diff_inverse le_diff_conv le_eq_less_or_eq le_unat_uoi add.commute nat_neq_iff unat_of_nat_eq word_arith_nat_add)\n apply simp\n done\nqed\n\n(* arg_cong specified for FCP because it does not apply as is. *)\nlemma FCP_arg_cong:\"f = g \\ FCP f = FCP g\"\n by simp\n\nlemma h_val_id:\n \"h_val (hrs_mem (hrs_mem_update (heap_update x y) s)) x = (y::'a::mem_type)\"\n apply (subst hrs_mem_update)\n apply (rule h_val_heap_update)\n done\n\nlemma heap_update_id2:\n \"hrs_mem_update (heap_update p ((h_val (hrs_mem s) p)::'a::packed_type)) s = s\"\n apply (clarsimp simp:hrs_mem_update_def case_prod_beta)\n apply (subst heap_update_id)\n apply (simp add:hrs_mem_def)+\n done\n\nlemma intvlI_unat:\"unat b < unat c \\ a + b \\ {a ..+ unat c}\"\n by (metis intvlI word_unat.Rep_inverse)\n\nlemma neq_imp_bytes_disjoint:\n \"\\ c_guard (x::'a::c_type ptr); c_guard y; unat j < align_of TYPE('a);\n unat i < align_of TYPE('a); x \\ y; 2 ^ n = align_of TYPE('a); n < 32\\ \\\n ptr_val x + j \\ ptr_val y + i\"\n apply (rule ccontr)\n apply (subgoal_tac \"is_aligned (ptr_val x) n\")\n apply (subgoal_tac \"is_aligned (ptr_val y) n\")\n apply (subgoal_tac \"(ptr_val x + j && ~~ mask n) = (ptr_val y + i && ~~ mask n)\")\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply simp\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n done\n\nlemma heap_update_list_base':\"heap_update_list p [] = id\"\n by (rule ext, simp)\n\nlemma hrs_mem_update_id3: \"hrs_mem_update id = id\"\n unfolding hrs_mem_update_def by simp\n\nabbreviation\n ptr_span :: \"'a::mem_type ptr \\ word32 set\" where\n \"ptr_span p \\ {ptr_val p ..+ size_of TYPE('a)}\"\n\nabbreviation (input)\n cptr_type :: \"('a :: c_type) ptr \\ 'a itself\"\nwhere\n \"cptr_type p \\ TYPE('a)\"\n\nlemma ptr_retyp_valid_footprint_disjoint2:\n \"\\valid_footprint (ptr_retyp (q::'b::mem_type ptr) d) p s; {p..+size_td s} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ valid_footprint d p s\"\n apply(clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule (1) mp)\n apply(subgoal_tac \"p + of_nat y \\ {p..+size_td s}\") \n apply (subst (asm) ptr_retyp_d)\n apply clarsimp\n apply fast\n apply (clarsimp simp add: ptr_retyp_d_eq_fst split: if_split_asm)\n apply fast\n apply (erule intvlI)\n done\n\nlemma ptr_retyp_disjoint2:\n \"\\ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q;\n {ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {} \\\n \\ d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\napply(clarsimp simp: h_t_valid_def)\napply(erule ptr_retyp_valid_footprint_disjoint2)\napply(simp add: size_of_def)\napply fast\ndone\n\nlemma ptr_retyp_disjoint_iff:\n \"{ptr_val p..+size_of TYPE('a)} \\ {ptr_val q..+size_of TYPE('b)} = {}\n \\ ptr_retyp (p::'a::mem_type ptr) d,g \\\\<^sub>t q = d,g \\\\<^sub>t (q::'b::mem_type ptr)\"\n apply rule\n apply (erule (1) ptr_retyp_disjoint2)\n apply (erule (1) ptr_retyp_disjoint)\n done\n\nlemma h_t_valid_ptr_retyp_eq:\n \"\\ cptr_type p <\\<^sub>\\ cptr_type p' \\ h_t_valid (ptr_retyp p td) g p'\n = (if ptr_span p \\ ptr_span p' = {} then h_t_valid td g p'\n else field_of_t p' p \\ g p')\"\n apply (clarsimp simp: ptr_retyp_disjoint_iff split: if_split)\n apply (cases \"g p'\")\n apply (rule iffI)\n apply (rule ccontr, drule h_t_valid_neq_disjoint, rule ptr_retyp_h_t_valid, simp+)\n apply (simp add: Int_commute)\n apply (clarsimp simp: field_of_t_def field_of_def)\n apply (drule sub_h_t_valid[where p=p, rotated], rule ptr_retyp_h_t_valid, simp, simp)\n apply (erule(1) h_t_valid_guard_subst)\n apply (simp add: h_t_valid_def)\n done\n\nlemma field_lookup_list_Some_again:\n \"dt_snd (xs ! i) = f\n \\ i < length xs\n \\ f \\ dt_snd ` set ((take i xs))\n \\ field_lookup_list xs [f] n\n = Some (dt_fst (xs ! i), n + sum_list (map (size_td o dt_fst) (take i xs)))\"\n apply (induct xs arbitrary: i n, simp_all)\n apply (case_tac x1, simp)\n apply (case_tac i, auto split: if_split)\n done\n\nlemma field_lookup_array:\n \"n < CARD('b) \\ field_lookup (typ_info_t TYPE(('a :: c_type)['b :: finite]))\n [replicate n (CHR ''1'')] i = Some (adjust_ti (typ_info_t TYPE('a))\n (\\x. x.[n]) (\\x f. Arrays.update f n x), i + n * size_of TYPE ('a))\"\n apply (simp add: typ_info_array array_tag_def array_tag_n_eq)\n apply (subst field_lookup_list_Some_again[where i=n],\n auto simp add: take_map o_def sum_list_triv size_of_def)\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/LemmaBucket_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.359364152021239, "lm_q1q2_score": 0.18529531377906422}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__43_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__43_on_rules imports n_germanSimp_lemma_on_inv__43\nbegin\nsection{*All lemmas on causal relation between inv__43*}\nlemma lemma_inv__43_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__43) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__43_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3593641382989649, "lm_q1q2_score": 0.18529530670358643}} {"text": "theory UPPAAL_State_Networks_Impl_Refine\n imports\n Program_Analysis\n TA_Impl.Normalized_Zone_Semantics_Impl_Refine\n TA_Impl.TA_Impl_Misc\n TA_Library.Syntax_Bundles\nbegin\n\nunbundle no_library_syntax\n\nchapter \\Imperative Implementation of UPPAAL Style Networks\\\n\n(* XXX Rename this way *)\nlemmas mem_nth = aux\n\nsubsection \\Executable successor computation\\\n\nlemma exec_state_length:\n assumes \"exec prog n (pc, st, s, f, rs) pcs = Some ((pc', st', s', f', rs'), pcs')\"\n shows \"length s = length s'\"\n using assms\nproof (induction prog n \"(pc, st, s, f, rs)\" pcs arbitrary: pc st s f rs pcs rule: exec.induct)\n case 1\n then show ?case by simp\nnext\n case prems: (2 prog n pc st m f rs pcs)\n from prems(2) show ?case\n apply (clarsimp split: option.split_asm if_split_asm)\n apply (drule prems(1), assumption+)\n by (erule step.elims; simp split: if_split_asm)\nqed\n\nlocale UPPAAL_Reachability_Problem_precompiled_defs' =\n UPPAAL_Reachability_Problem_precompiled_defs +\n fixes na :: nat\nbegin\n\ntext \\Definition of implementation auxiliaries (later connected to the automaton via proof)\\\n\n (*\n definition\n \"trans_i_map \\\n map (map (map (\\ (g, a, r, l').\n case a of Sil a \\ (g, a, r, l')) o filter (\\ (g, a, r, l').\n case a of Sil a \\ True | _ \\ False))) trans\"\n *)\n\n definition\n \"trans_i_map =\n map (map (List.map_filter\n (\\ (g, a, m, l'). case a of Sil a \\ Some (g, a, m, l') | _ \\ None)\n )) trans\"\n\n definition\n \"trans_in_map \\\n map (map (map\n (\\ (g, a, m, l'). case a of In a \\ (g, a, m, l')) o filter (\\ (g, a, m, l').\n case a of In a \\ True | _ \\ False))\n ) trans\"\n\n definition\n \"trans_out_map \\\n map (map (map\n (\\ (g, a, m, l'). case a of Out a \\ (g, a, m, l')) o filter (\\ (g, a, m, l').\n case a of Out a \\ True | _ \\ False))\n ) trans\"\n\n abbreviation\n \"nested_list_to_iarray xs \\ IArray (map IArray xs)\"\n\n (* XXX Optimize by using a better data structure? *)\n definition\n \"actions_by_state i \\ fold (\\ t acc. acc[fst (snd t) := (i, t) # (acc ! fst (snd t))])\"\n\n definition\n \"all_actions_by_state t L \\\n fold (\\ i. actions_by_state i (t !! i !! (L ! i))) [0.. (if pc < length prog then (IArray prog) !! pc else None)\"\n abbreviation \"PF \\ stripfp PROG'\"\n abbreviation \"PT \\ striptp PROG'\"\n definition \"runf pc s \\ exec PF max_steps (pc, [], s, True, []) []\"\n definition \"runt pc s \\ exec PT max_steps (pc, [], s, True, []) []\"\n\n lemma PROG'_PROG [simp]:\n \"PROG' = PROG\"\n unfolding PROG'_def PROG_def by (rule ext) simp\n\n definition \"bounded' s \\\n (\\i s ! i < snd (IArray bounds !! i))\"\n\n definition\n \"check_pred L s \\\n list_all\n (\\ q.\n case runf (pred ! q ! (L ! q)) s of\n Some ((_, _, _, f, _), _) \\ f \\ bounded' s\n | None \\ False\n )\n [0.. pc.\n case PROG pc of\n Some (CEXP ac) \\ Some ac\n | _ \\ None\n )\n pcs\"\n\n definition\n \"check_g pc s \\\n case runt pc s of\n Some ((_, _, _, True, _), pcs) \\ Some (make_cconstr pcs)\n | _ \\ None\n \"\n\n definition\n \"trans_i_from \\ \\ (L, s) i.\n List.map_filter (\\ (g, a, m, l').\n case check_g g s of\n Some cc \\\n (case runf m s of\n Some ((_, _, s', _, r), _) \\\n if check_pred (L[i := l']) s'\n then Some (cc, a, r, (L[i := l'], s'))\n else None\n | _ \\ None)\n | _ \\ None)\n ((IArray (map IArray trans_i_map)) !! i !! (L ! i))\"\n\n definition\n \"trans_i_fun L \\ concat (map (trans_i_from L) [0..\n case runf m1 s of\n Some ((_, _, _, _, r1), _) \\ r1\n | None \\ []\n \"\n\n definition\n \"pairs_by_action \\ \\ (L, s) OUT. concat o\n map (\\ (i, g1, a, m1, l1). List.map_filter\n (\\ (j, g2, a, m2, l2).\n if i = j then None else\n case (check_g g1 s, check_g g2 s) of\n (Some cc1, Some cc2) \\\n case runf m2 s of\n Some ((_, _, s1, _, r2), _) \\\n case runf m1 s1 of\n Some (( _, _, s', _, _), _) \\\n if check_pred (L[i := l1, j := l2]) s'\n then Some (cc1 @ cc2, a, make_reset m1 s @ r2, (L[i := l1, j := l2], s'))\n else None\n | _ \\ None\n | _ \\ None\n | _ \\ None\n )\n OUT)\n \"\n\n definition\n \"trans_s_fun \\ \\ (L, s).\n let\n In = all_actions_by_state (nested_list_to_iarray trans_in_map) L;\n Out = all_actions_by_state (nested_list_to_iarray trans_out_map) L\n in\n concat (map (\\ a. pairs_by_action (L, s) (Out ! a) (In ! a)) [0.. trans_s_fun L @ trans_i_fun L\"\n\n lemma trans_i_fun_trans_fun:\n assumes \"(g, a, r, L') \\ set (trans_i_fun L)\"\n shows \"(g, a, r, L') \\ set (trans_fun L)\"\n using assms unfolding trans_fun_def by auto\n\n lemma trans_s_fun_trans_fun:\n assumes \"(g, a, r, L') \\ set (trans_s_fun L)\"\n shows \"(g, a, r, L') \\ set (trans_fun L)\"\n using assms unfolding trans_fun_def by auto\n\nend (* End of locale for implementation definitions *)\n\ncontext Prod_TA_Defs\nbegin\n\n (* XXX Can overwrite this theorem from other context in SAME locale *)\n lemma prod_trans_i_alt_def:\n \"prod_trans_i =\n {((L, s), g, a, r, (L', s')) | L s g c a r m L' s'.\n (L, g, (a, Networks.label.Act (c, m)), r, L') \\ Product_TA_Defs.product_trans_i (N_s s) \\\n (\\ q < p. (P ! q) (L ! q) s) \\ (\\ q < p. (P ! q) (L' ! q) s')\n \\ c s \\ Some s' = m s}\"\n unfolding\n prod_trans_i_def trans_of_def Product_TA_Defs.product_ta_def\n Product_TA_Defs.product_trans_def\n Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n by (safe; simp; metis)\n\n lemma prod_trans_s_alt_def:\n \"prod_trans_s =\n {((L, s), g, a, r, (L', s')) | L s g ci co a r mi mo L' s1 s'.\n ci s \\ co s\n \\ (\\ q < p. (P ! q) (L ! q) s) \\ (\\ q < p. (P ! q) (L' ! q) s')\n \\ (L, g, (a, Networks.label.Syn (ci, mi) (co, mo)), r, L')\n \\ Product_TA_Defs.product_trans_s (N_s s)\n \\ Some s' = mi s1 \\ Some s1 = mo s\n }\"\n unfolding\n prod_trans_s_def trans_of_def Product_TA_Defs.product_ta_def\n Product_TA_Defs.product_trans_def\n Product_TA_Defs.product_trans_i_def\n Product_TA_Defs.product_trans_s_def\n by (safe; simp; metis)\n\nend\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n lemma T_s_unfold_1:\n \"fst ` equiv.defs.T_s q s = fst ` fst (equiv.N ! q)\" if \"q < p\"\n using \\q < p\\\n unfolding equiv.defs.T_s_def\n unfolding equiv.state_ta_def\n unfolding equiv.state_trans_t_def\n by force\n\n lemma T_s_unfold_2:\n \"(snd o snd o snd o snd) ` equiv.defs.T_s q s = (snd o snd o snd o snd) ` fst (equiv.N ! q)\"\n if \"q < p\"\n using \\q < p\\\n unfolding equiv.defs.T_s_def\n unfolding equiv.state_ta_def\n unfolding equiv.state_trans_t_def\n by force\n\nend\n\ncontext Equiv_TA_Defs\nbegin\n\n lemma p_p:\n \"defs.p = p\"\n by simp\n\nend\n\ncontext\n Prod_TA_Defs\nbegin\n\n lemma states'_alt_def:\n \"states' s =\n {L. length L = p \\\n (\\ q < p. (L ! q) \\ fst ` (fst (fst A ! q)) \\ (snd o snd o snd o snd) ` (fst (fst A ! q)))}\"\n unfolding trans_of_def Product_TA_Defs.product_ta_def N_s_def\n unfolding Product_TA_Defs.product_trans_def\n unfolding Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n apply simp\n apply safe\n unfolding T_s_def\n apply (fastforce simp: Product_TA_Defs.states_def trans_of_def p_def)\n apply (force simp: Product_TA_Defs.states_def trans_of_def p_def)\n by (fastforce simp: Product_TA_Defs.states_def trans_of_def p_def image_iff)\n\nend\n\n\ncontext UPPAAL_Reachability_Problem_precompiled\nbegin\n\n(* XXX Clean *)\n(* XXX Is this already somewhere else? *)\nlemma PF_unfold:\n \"equiv.PF = stripfp (conv_prog PROG)\"\n using [[show_abbrevs=false]]\n unfolding N_def\n apply auto\n unfolding stripfp_def\n apply (rule ext)\n apply auto\n subgoal for x\n apply (cases \"PROG x\")\n apply auto\n subgoal for a\n by (cases a) auto\n done\n done\n\n(* XXX Clean *)\n(* XXX Is this already somewhere else? *)\nlemma PT_unfold:\n \"equiv.PT = striptp (conv_prog PROG)\"\n using [[show_abbrevs=false]]\n unfolding N_def\n apply auto\n unfolding striptp_def\n apply (rule ext)\n apply auto\n subgoal for x\n apply (cases \"PROG x\")\n apply auto\n subgoal for a\n by (cases a) auto\n done\n done\n\nlemma states'I:\n \"l \\ equiv.defs.states' s\" if \"A \\ (l, s) \\\\<^bsup>g,a,r\\<^esup> (l', s')\"\n using equiv.defs.prod_ta_cases[OF that]\n unfolding equiv.defs.prod_trans_i_alt_def equiv.defs.prod_trans_s_alt_def\n unfolding Product_TA_Defs.product_trans_def\n unfolding Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n by fastforce\n\nlemma A_lengthD:\n \"length l = p\" if \"A \\ (l, s) \\\\<^bsup>g,a,r\\<^esup> (l', s')\"\n using that by (auto dest: states'I)\n\nlemma N_s_state_trans:\n assumes \"equiv.defs.N_s s ! q \\ l ! q \\\\<^bsup>g,(a, c, m'),r\\<^esup> l'\" \"q < p\"\n obtains f' g' where\n \"(l ! q, g', (a, c, m'), f', l') \\ equiv.state_trans q\" \"g = g' s\" \"r = f' s\"\n using assms\n unfolding equiv.defs.N_s_def trans_of_def equiv.defs.T_s_def\n unfolding equiv.state_ta_def by auto\n\nlemma make_f_collect_store:\n assumes \"(l, pc_g, a, pc_u, l') \\ fst (equiv.N ! q)\" \"c \\ set (equiv.make_f pc_u s)\" \"q < p\"\n shows \"c \\ fst ` collect_store' pc_u\"\nproof -\n from assms(1) \\q < p\\ have \"(pc_g, a, pc_u, l') \\ set (trans ! q ! l)\"\n unfolding N_def T_def by (auto dest!: nth_mem)\n from assms obtain pc x2 x3 x4 pcs r where exec:\n \"exec equiv.PF max_steps (pc_u, [], s, True, []) [] = Some ((pc, x2, x3, x4, r), pcs)\"\n unfolding equiv.make_f_def by (auto split: option.split_asm) metis\n with assms have \"c \\ set r\" unfolding equiv.make_f_def by auto\n with exec_reset'[OF exec] obtain pc' d where \"Some (STOREC c d) = equiv.PF pc'\" \"pc' \\ set pcs\"\n by force\n with exec obtain y2 y3 y4 y5 where steps:\n \"steps equiv.PF max_steps (pc_u, [], s, True, []) (pc', y2, y3, y4, y5)\"\n by (auto intro: exec_steps')\n from \\_ = equiv.PF pc'\\ have \"pc' < length prog\"\n unfolding N_def PROG_def stripfp_def by (simp split: if_split_asm)\n from steps have \"pc' \\ steps_approx max_steps prog pc_u\"\n unfolding PF_unfold\n unfolding stripfp_def\n by (auto simp: PROG_def intro: steps_steps_approx[of stripf, OF _ _ _ \\pc' < length prog\\])\n with \\_ = equiv.PF pc'\\ \\_ \\ set (trans ! q ! l)\\ show ?thesis\n unfolding collect_store'_def stripfp_def N_def PROG_def apply (auto split: if_split_asm)\n apply (cases \"prog ! pc'\")\n apply (simp; fail)\n subgoal for x\n by (cases x; force)\n done\nqed\n\nlemma resets_approx:\n \"set r \\\n \\ {fst ` collect_store' r | i g a r. (g, a, r, (l' ! i)) \\ set (trans ! i ! (l ! i))}\"\n if \"A \\ (l, s) \\\\<^bsup>g,a,r\\<^esup> (l', s')\"\nproof -\n from that have [simp]: \"length l = p\" by (auto dest: A_lengthD)\n show ?thesis using that\n apply clarsimp\n apply (drule equiv.defs.prod_ta_cases)\n apply safe\n subgoal for x\n unfolding equiv.defs.prod_trans_i_alt_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n apply safe\n unfolding Product_TA_Defs.product_trans_i_def\n apply clarsimp\n apply (erule N_s_state_trans, assumption)\n unfolding equiv.state_trans_t_def\n apply clarsimp\n subgoal for q l'' pc_g pc_u\n apply (frule make_f_collect_store, assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for b j\n proof -\n from prems(6,8,11-) have\n \"(pc_g, Sil a, pc_u, l[q := l''] ! q) \\ set (trans ! q ! (l ! q))\"\n by simp\n with prems(6,8,11-) show ?thesis by blast\n qed\n done\n done\n subgoal for x\n unfolding equiv.defs.prod_trans_s_alt_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n apply safe\n unfolding Product_TA_Defs.product_trans_s_def\n apply clarsimp\n apply (erule N_s_state_trans, assumption)\n apply (erule N_s_state_trans, assumption)\n unfolding equiv.state_trans_t_def\n apply clarsimp\n apply (erule disjE)\n subgoal for s1 p' q l'' l'aa pc_g pc_ga pc_u pc_ua\n apply (frule make_f_collect_store, assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for b j j'\n proof -\n from prems(9-) have\n \"(pc_g, In a, pc_u, l[p' := l'', q := l'aa] ! p') \\ set (trans ! p' ! (l ! p'))\"\n by simp\n with prems(9-) show ?thesis by blast\n qed\n done\n subgoal for s1 q p' l'aa l'' pc_ga pc_g pc_ua pc_u\n apply (frule make_f_collect_store, assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for b j j'\n proof -\n from prems(9-) have\n \"(pc_g, Out a, pc_u, l[q := l'aa, p' := l''] ! p') \\ set (trans ! p' ! (l ! p'))\"\n by simp\n with prems(9-) show ?thesis by blast\n qed\n done\n done\n done\nqed\n\n(* XXX Remove\nlemma resets_approx':\n assumes \"A \\ (l, s) \\\\<^bsup>g,a,r\\<^esup> (l', s')\"\n obtains pc_u pc_g a' i where\n \"fst ` collect_store' pc_u \\ set r\" \"i < length l\"\n \"(pc_g, a', pc_u, (l' ! i)) \\ set (trans ! i ! (l ! i))\"\n apply atomize_elim\n*)\n\nlemma make_g_clkp_set'':\n fixes x\n assumes\n \"(l, pc_g, a, pc_u, l') \\ fst (equiv.N ! q)\" \"x \\ collect_clock_pairs (equiv.make_g pc_g s)\"\n \"q < p\"\n shows \"x \\ clkp_set'' q l\"\nproof -\n from assms(1) \\q < p\\ have \"(pc_g, a, pc_u, l') \\ set (trans ! q ! l)\"\n unfolding N_def T_def by (auto dest!: nth_mem)\n from assms obtain pc x2 x3 x4 r pcs where exec:\n \"exec equiv.PT max_steps (pc_g, [], s, True, []) [] = Some ((pc, x2, x3, x4, r), pcs)\"\n unfolding equiv.make_g_def by (auto split: option.split_asm)\n with assms have \"x \\ collect_clock_pairs (List.map_filter (\\ pc.\n case equiv.P pc of\n Some (CEXP ac) \\ Some ac\n | _ \\ None\n )\n pcs)\"\n unfolding equiv.make_g_def by auto\n then obtain pc' ac where\n \"equiv.P pc' = Some (CEXP ac)\" \"x = constraint_pair ac\" \"pc' \\ set pcs\"\n unfolding equiv.make_g_def collect_clock_pairs_def set_map_filter\n by (auto split: option.split_asm; auto split: instrc.split_asm)\n with exec obtain y2 y3 y4 y5 where steps:\n \"steps equiv.PT max_steps (pc_g, [], s, True, []) (pc', y2, y3, y4, y5)\"\n by (auto intro: exec_steps')\n from \\equiv.P pc' = _\\ have \"pc' < length prog\"\n unfolding N_def PROG_def by (simp split: if_split_asm)\n from steps have \"pc' \\ steps_approx max_steps prog pc_g\"\n unfolding PT_unfold\n unfolding striptp_def\n by (auto simp: PROG_def intro: steps_steps_approx[of stript, OF _ _ _ \\pc' < length prog\\])\n with \\equiv.P pc' = _\\ \\_ \\ set (trans ! q ! l)\\ \\x = _\\ show ?thesis\n unfolding clkp_set''_def collect_cexp'_def N_def PROG_def by (force split: if_split_asm)\nqed\n\nlemma guard_approx:\n \"collect_clock_pairs g \\\n \\ {clkp_set'' i (l ! i) | i g a r.\n (g, a, r, (l' ! i)) \\ set (trans ! i ! (l ! i)) \\ l \\ equiv.defs.states' s \\ i < p\n }\"\n if \"A \\ (l, s) \\\\<^bsup>g,a,r\\<^esup> (l', s')\"\nproof -\n from that have [simp]: \"length l = p\" by (auto dest: A_lengthD)\n show ?thesis using that\n apply clarsimp\n apply (drule equiv.defs.prod_ta_cases)\n apply safe\n subgoal for x b\n unfolding equiv.defs.prod_trans_i_alt_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n apply safe\n unfolding Product_TA_Defs.product_trans_i_def\n apply clarsimp\n apply (erule N_s_state_trans, assumption)\n unfolding equiv.state_trans_t_def\n apply clarsimp\n subgoal for q l'' pc_g pc_u\n apply (frule make_g_clkp_set'', assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for j\n proof -\n from prems(6,8,11-) have\n \"(pc_g, Sil a, pc_u, l[q := l''] ! q) \\ set (trans ! q ! (l ! q))\"\n by simp\n with prems(6,8,11-) prems show ?thesis by blast\n qed\n done\n done\n subgoal for x b\n unfolding equiv.defs.prod_trans_s_alt_def\n apply simp\n unfolding Product_TA_Defs.product_trans_def\n apply safe\n unfolding Product_TA_Defs.product_trans_s_def\n apply clarsimp\n apply (erule N_s_state_trans, assumption)\n apply (erule N_s_state_trans, assumption)\n unfolding equiv.state_trans_t_def\n apply clarsimp\n apply (drule collect_clock_pairs_append_cases)\n apply (erule disjE)\n subgoal for s1 p' q l'' l'aa pc_g pc_ga pc_u pc_ua\n unfolding equiv.make_c_def\n apply (clarsimp split: option.split_asm)\n apply (frule make_g_clkp_set'', assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for j j'\n proof -\n from prems(9-) have\n \"(pc_g, In a, pc_u, l[p' := l'', q := l'aa] ! p') \\ set (trans ! p' ! (l ! p'))\"\n by simp\n with prems(9-) show ?thesis by blast\n qed\n done\n subgoal for s1 q p' l'aa l'' pc_ga pc_g pc_ua pc_u\n apply (frule make_g_clkp_set'', assumption+)\n unfolding N_def T_def\n apply (clarsimp dest!: nth_mem)\n subgoal premises prems for j j'\n proof -\n from prems(9-) have\n \"(pc_g, Out a, pc_u, l[q := l'aa, p' := l''] ! p') \\ set (trans ! p' ! (l ! p'))\"\n by simp\n with prems(9-) show ?thesis by blast\n qed\n done\n done\n done\nqed\n\nend (* End of context for pre-compiled reachability problem *)\n\n\nabbreviation \"conv B \\ (conv_prog (fst B), (map conv_A' (fst (snd B))), snd (snd B))\"\n\ncontext UPPAAL_Reachability_Problem_precompiled\nbegin\n\n sublocale defs':\n Equiv_TA_Defs \"conv N\" max_steps .\n\n lemma equiv_states'_alt_def:\n \"equiv.defs.states' s =\n {L. length L = p \\\n (\\ q < p. L ! q \\ fst ` fst (equiv.N ! q)\n \\ L ! q \\ (snd o snd o snd o snd) ` fst (equiv.N ! q))}\"\n unfolding Product_TA_Defs.states_def\n unfolding equiv.defs.N_s_def trans_of_def\n using T_s_unfold_1 T_s_unfold_2 by simp\n\n lemma init_states:\n \"init \\ equiv.defs.states' s\\<^sub>0\"\n using processes_have_trans start_has_trans\n unfolding equiv_states'_alt_def\n unfolding init_def N_def T_def by force\n\n lemma p_p[simp]:\n \"defs'.p = p\"\n unfolding defs'.p_def by simp\n\n lemma T_s_unfold_1':\n \"fst ` defs'.defs.T_s q s = fst ` fst (defs'.N ! q)\" if \"q < p\"\n using \\q < p\\\n unfolding defs'.defs.T_s_def\n unfolding defs'.state_ta_def\n unfolding defs'.state_trans_t_def p_p\n by force\n\n lemma T_s_unfold_2':\n \"(snd o snd o snd o snd) ` defs'.defs.T_s q s = (snd o snd o snd o snd) ` fst (defs'.N ! q)\"\n if \"q < p\"\n using \\q < p\\\n unfolding defs'.defs.T_s_def\n unfolding defs'.state_ta_def\n unfolding defs'.state_trans_t_def p_p\n by force\n\n lemma product_states'_alt_def:\n \"defs'.defs.states' s =\n {L. length L = p \\\n (\\ q < p. L ! q \\ fst ` fst (defs'.N ! q)\n \\ L ! q \\ (snd o snd o snd o snd) ` fst (defs'.N ! q))}\"\n unfolding Product_TA_Defs.states_def\n unfolding defs'.defs.N_s_def trans_of_def\n using T_s_unfold_1' T_s_unfold_2'\n by force\n\n lemma states'_conv[simp]:\n \"defs'.defs.states' s = equiv.defs.states' s\"\n unfolding product_states'_alt_def equiv_states'_alt_def\n unfolding N_def T_def by simp\n\n lemma [intro]:\n \"init \\ defs'.defs.states' s\\<^sub>0\"\n using init_states by simp\n\n lemma\n \"defs'.I = equiv.I\"\n by simp\n\n lemma PF_PF[simp]:\n \"defs'.PF = equiv.PF\"\n apply simp\n unfolding stripfp_def\n apply (rule ext)\n apply clarsimp\n subgoal for x\n apply (cases \"equiv.P x\")\n apply simp\n subgoal for a\n by (cases a) auto\n done\n done\n\n lemma PF_PROG[simp]:\n \"equiv.PF = stripfp PROG\"\n unfolding N_def by simp\n\n lemma I_simp[simp]:\n \"(equiv.I ! q) l = pred ! q ! l\" if \"q < p\"\n unfolding N_def P_def using \\q < p\\ process_length(3) by simp\n\n lemma\n \"defs'.P = conv_prog PROG\"\n by (simp add: N_def)\n\n lemma states_len[intro]:\n assumes\n \"q < p\" \"L \\ equiv.defs.states' s\"\n shows\n \"L ! q < length (trans ! q)\"\n using assms unfolding Product_TA_Defs.states_def\n apply simp\n unfolding trans_of_def equiv.defs.N_s_def\n apply (simp add: T_s_unfold_1[simplified] T_s_unfold_2[simplified])\n unfolding N_def\n apply simp\n unfolding T_def\n using state_set\n unfolding process_length(2)[symmetric]\n apply auto\n apply (erule allE)\n apply (erule impE)\n apply assumption\n apply auto\n by (clarsimp dest!: nth_mem; force)\n\nend (* End of context for precompiled reachability problem *)\n\n\nlocale UPPAAL_Reachability_Problem_precompiled_ceiling =\n UPPAAL_Reachability_Problem_precompiled +\n fixes k :: \"nat list list list\"\n assumes k_ceiling:\n \"\\ i < p. \\ l < length (trans ! i). \\ (x, m) \\ clkp_set'' i l. m \\ k ! i ! l ! x\"\n \"\\ i < p. \\ l < length (trans ! i). \\ (x, m) \\ collect_clock_pairs (inv ! i ! l).\n m \\ k ! i ! l ! x\"\n and k_resets:\n \"\\ i < p. \\ l < length (trans ! i). \\ (g, a, r, l') \\ set (trans ! i ! l).\n \\ c \\ {0.. k ! i ! l ! c\"\n and k_length:\n \"length k = p\" \"\\ i < p. length (k ! i) = length (trans ! i)\"\n \"\\ xs \\ set k. \\ xxs \\ set xs. length xxs = m + 1\"\n and k_0:\n \"\\ i < p. \\ l < length (trans ! i). k ! i ! l ! 0 = 0\"\n and guaranteed_resets:\n \"\\ i < p. \\ l < length (trans ! i). \\ (g, a, r, l') \\ set (trans ! i ! l).\n guaranteed_execution_cond prog r max_steps\n \"\nbegin\n\ndefinition \"k_fun l c \\ if c > 0 \\ c \\ m then Max {k ! i ! (fst l ! i) ! c | i . i < p} else 0\"\n\n\nlemma p_p':\n \"equiv.p = p\"\n by simp\n\nlemma clkp_set_clk_set_subs:\n \"fst ` clkp_set A (l, s) \\ clk_set A\"\n unfolding TA_clkp_set_unfold by auto\n\nlemma k_ceiling_1:\n \"\\ l. \\(x,m) \\ clkp_set A l. m \\ k_fun l x\"\n\n apply safe\n subgoal premises prems for l s x d (* XXX Do many of these unfolds automatically? *)\n proof -\n from \\(x, d) \\ _\\ have \"0 < x\" \"x \\ m\"\n using clkp_set_clk_set_subs[of l s] clk_set by force+\n from prems show ?thesis\n unfolding clkp_set_def\n apply safe\n subgoal\n unfolding collect_clki_def\n unfolding inv_of_def\n unfolding equiv.defs.prod_ta_def\n unfolding equiv.defs.prod_invariant_def\n unfolding inv_of_def\n Product_TA_Defs.product_ta_def\n Product_TA_Defs.product_invariant_def\n equiv.defs.N_s_def\n unfolding length_N\n unfolding equiv.state_ta_def\n unfolding p_p'\n unfolding equiv.state_inv_def\n unfolding N_def\n unfolding collect_clock_pairs_def\n apply (clarsimp cong: if_cong simp: I_def)\n subgoal premises prems for l' i\n (* XXX Automate this single forward reasoning step away *)\n proof -\n have \"nat d \\ k ! i ! (l ! i) ! x\"\n using prems lengths k_ceiling(2)\n unfolding collect_clock_pairs_def\n by (auto 4 4)\n also from \\_ < p\\ have \"\\ \\ Max {k ! i ! (l ! i) ! x |i. i < p}\"\n by (auto intro: Max_ge)\n finally show ?thesis\n unfolding k_fun_def using \\0 < x\\ \\x \\ m\\ by auto\n qed\n done\n subgoal\n unfolding collect_clkt_def\n apply clarsimp\n subgoal premises prems for g a r l' s'\n proof -\n from guard_approx[OF prems(2)] prems(1) obtain i g a r where *:\n \"(x, d) \\ clkp_set'' i (l ! i)\" \"(g, a, r, l' ! i) \\ set (trans ! i ! (l ! i))\"\n \"l \\ equiv.defs.states' s\" \"i < p\"\n by auto\n from \\i < p\\ \\l \\ _\\ have \"l ! i < length (trans ! i)\"\n by auto\n with k_ceiling(1) * have \"nat d \\ k ! i ! (l ! i) ! x\"\n by force\n also from \\_ < p\\ have \"\\ \\ Max {k ! i ! (l ! i) ! x |i. i < p}\"\n by (auto intro: Max_ge)\n finally show ?thesis\n unfolding k_fun_def using \\0 < x\\ \\x \\ m\\ by auto\n qed\n done\n done\n qed\ndone\n\nlemma k_ceiling_2:\n \"\\ l g a r l' c. A \\ l \\\\<^bsup>g,a,r\\<^esup> l' \\ c \\ set r \\ k_fun l' c \\ k_fun l c\"\n unfolding trans_of_def equiv.defs.prod_ta_def equiv.defs.prod_trans_def\n apply clarsimp\n apply safe\n subgoal premises prems for l s g a r l' s' c\n proof -\n from prems obtain p' l'' pc_g pc_u where *:\n \"p' < p\" \"l' = l[p' := l'']\"\n \"r = equiv.make_f pc_u s\" \"Some s' = equiv.make_mf pc_u s\"\n \"(l ! p', pc_g, Sil a, pc_u, l'') \\ fst (equiv.N ! p')\"\n \"l \\ equiv.defs.states' s\"\n apply atomize_elim\n unfolding equiv.defs.prod_trans_i_def\n unfolding Product_TA_Defs.product_ta_def Product_TA_Defs.product_trans_def trans_of_def\n apply clarsimp\n apply safe\n unfolding Product_TA_Defs.product_trans_i_def\n unfolding trans_of_def\n apply clarsimp\n unfolding equiv.defs.N_s_def\n unfolding equiv.defs.T_s_def\n unfolding Equiv_TA_Defs.state_ta_def\n unfolding equiv.state_trans_t_def\n unfolding Product_TA_Defs.product_trans_s_def\n by auto\n from \\l \\ _\\ have [simp]: \"length l = p\"\n by simp\n from \\r = _\\ have \"fst ` collect_store'' pc_u \\ set r\"\n supply find_resets_start.simps[simp del]\n unfolding collect_store''_def equiv.make_f_def\n apply (clarsimp split: option.split_asm)\n subgoal\n using \\Some s' = _\\ unfolding equiv.make_mf_def\n by (auto split: option.split_asm)\n subgoal premises prems for pc' g st f pcs c d pc_t pc''\n proof -\n from prems have\n \"steps (map_option stripf o (\\pc. if pc < size prog then prog ! pc else None)) max_steps\n (pc_u, [], s, True, []) (pc', g, st, f, r)\"\n \"prog ! pc' = Some (INSTR HALT)\"\n unfolding PF_unfold stripfp_def N_def PROG_def\n by (auto dest!: exec_steps split: if_split_asm elim!: stripf.elims)\n with prems show ?thesis\n by (force intro: sym dest!: resets_start')\n qed\n done\n with \\c \\ _\\ have \"c \\ fst ` collect_store'' pc_u\" by blast\n show ?thesis\n proof (cases \"c > m\")\n case True\n then show ?thesis\n unfolding k_fun_def by auto\n next\n case False\n with \\c \\ fst ` _ _\\ have \"c \\ {0.. set (trans ! p' ! (l ! p'))\"\n \"(l ! p') < length (trans ! p')\"\n unfolding N_def T_def by auto\n with k_resets \\c \\ _\\ \\p' < _\\ have \"k ! p' ! l'' ! c \\ k ! p' ! (l ! p') ! c\"\n unfolding k_fun_def by force\n with \\l' = _\\ show ?thesis\n unfolding k_fun_def\n apply clarsimp\n apply (rule Max.boundedI)\n apply force\n using p_gt_0 apply force\n apply clarsimp\n subgoal for i\n apply (cases \"i = p'\")\n apply simp\n apply (rule le_trans)\n by (auto intro: Max_ge)\n done\n qed\n qed\n subgoal premises prems for l s g a r l' s' c\n proof -\n from prems obtain p1 l1 pc_g1 pc_u1 p2 l2 pc_g2 pc_u2 s'' where *:\n \"p1 < p\" \"p2 < p\" \"l' = l[p1 := l1, p2 := l2]\"\n \"r = equiv.make_f pc_u1 s @ equiv.make_f pc_u2 s\"\n \"Some s' = equiv.make_mf pc_u1 s''\" \"Some s'' = equiv.make_mf pc_u2 s\"\n \"(l ! p1, pc_g1, In a, pc_u1, l1) \\ fst (equiv.N ! p1)\"\n \"(l ! p2, pc_g2, Out a, pc_u2, l2) \\ fst (equiv.N ! p2)\"\n \"l \\ equiv.defs.states' s\"\n apply atomize_elim\n unfolding equiv.defs.prod_trans_s_def\n unfolding Product_TA_Defs.product_ta_def Product_TA_Defs.product_trans_def trans_of_def\n apply clarsimp\n apply safe\n subgoal\n unfolding Product_TA_Defs.product_trans_i_def\n by auto\n unfolding Product_TA_Defs.product_trans_s_def\n unfolding trans_of_def\n apply clarsimp\n unfolding equiv.defs.N_s_def\n unfolding equiv.defs.T_s_def\n unfolding Equiv_TA_Defs.state_ta_def\n unfolding equiv.state_trans_t_def\n apply clarsimp\n by blast\n from \\l \\ _\\ have [simp]: \"length l = p\"\n by simp\n from * have **:\n \"(pc_g1, In a, pc_u1, l1) \\ set (trans ! p1 ! (l ! p1))\" \"(l ! p1) < length (trans ! p1)\"\n \"(pc_g2, Out a, pc_u2, l2) \\ set (trans ! p2 ! (l ! p2))\" \"(l ! p2) < length (trans ! p2)\"\n unfolding N_def T_def by auto\n with \\p1 < p\\ guaranteed_resets have guaranteed_execution:\n \"guaranteed_execution_cond prog pc_u1 max_steps\"\n by blast\n thm guaranteed_execution'[of prog pc_u2 max_steps]\n from \\r = _\\ have \"fst ` collect_store'' pc_u1 \\ set r\"\n supply find_resets_start.simps[simp del]\n unfolding collect_store''_def\n equiv.make_f_def\n apply (clarsimp split: option.split_asm)\n subgoal\n using \\Some s'' = _\\ unfolding equiv.make_mf_def\n by (auto split: option.split_asm)\n subgoal\n using \\Some s'' = _\\ unfolding equiv.make_mf_def\n by (auto split: option.split_asm)\n subgoal\n using \\Some s' = _\\ unfolding equiv.make_mf_def\n using guaranteed_execution'[OF guaranteed_execution, of \"[]\" s True \"[]\" \"[]\"]\n unfolding stripfp_def PROG_def by auto\n subgoal premises prems for _ _ _ _ r2 _ pc' g st f r1 pcs c d pc_t pc''\n proof -\n from prems have\n \"steps (map_option stripf o (\\pc. if pc < size prog then prog ! pc else None)) max_steps\n (pc_u1, [], s, True, []) (pc', g, st, f, r1)\"\n \"prog ! pc' = Some (INSTR HALT)\" \"r = r1 @ r2\"\n unfolding PF_unfold stripfp_def N_def PROG_def\n by (auto dest!: exec_steps split: if_split_asm elim!: stripf.elims)\n with prems show ?thesis\n by (force intro: sym dest!: resets_start')\n qed\n done\n moreover from \\r = _\\ have \"fst ` collect_store'' pc_u2 \\ set r\"\n supply find_resets_start.simps[simp del]\n unfolding collect_store''_def\n equiv.make_f_def\n apply (clarsimp split: option.split_asm)\n subgoal\n using \\Some s'' = _\\ unfolding equiv.make_mf_def\n by (auto split: option.split_asm)\n subgoal\n using \\Some s'' = _\\ unfolding equiv.make_mf_def\n by (auto split: option.split_asm)\n subgoal\n using \\Some s' = _\\ unfolding equiv.make_mf_def\n using guaranteed_execution'[OF guaranteed_execution, of \"[]\" s True \"[]\" \"[]\"]\n unfolding stripfp_def PROG_def by auto\n subgoal premises prems for pc' g st f r1 pcs _ _ _ _ r2 _ c d pc_t pc''\n proof -\n from prems have\n \"steps (map_option stripf o (\\pc. if pc < size prog then prog ! pc else None)) max_steps\n (pc_u2, [], s, True, []) (pc', g, st, f, r1)\"\n \"prog ! pc' = Some (INSTR HALT)\" \"r = r2 @ r1\"\n unfolding PF_unfold stripfp_def N_def PROG_def\n by (auto dest!: exec_steps split: if_split_asm elim!: stripf.elims)\n with prems show ?thesis\n by (force intro: sym dest!: resets_start')\n qed\n done\n ultimately have c_not_elem: \"c \\ fst ` collect_store'' pc_u1\" \"c \\ fst ` collect_store'' pc_u2\"\n using \\c \\ _\\ by auto\n show ?thesis\n proof (cases \"c > m\")\n case True\n then show ?thesis\n unfolding k_fun_def by auto\n next\n case False\n with c_not_elem have\n \"c \\ {0.. {0..p1 < _\\ \\p2 < _\\ have\n \"k ! p1 ! l1 ! c \\ k ! p1 ! (l ! p1) ! c\" \"k ! p2 ! l2 ! c \\ k ! p2 ! (l ! p2) ! c\"\n by (auto split: prod.split_asm)\n with \\l' = _\\ show ?thesis\n unfolding k_fun_def\n apply clarsimp\n apply (rule Max.boundedI)\n apply force\n using p_gt_0 apply force\n apply clarsimp\n subgoal for i\n apply (cases \"i = p2\")\n subgoal\n apply simp\n apply (rule le_trans)\n by (auto intro: Max_ge)\n apply (cases \"i = p1\")\n apply simp\n apply (rule le_trans)\n by (auto intro: Max_ge)\n done\n qed\n qed\n done\n\nlemma\n shows k_ceiling':\n \"\\ l. \\(x,m) \\ clkp_set A l. m \\ k_fun l x\"\n \"\\ l g a r l' c. A \\ l \\\\<^bsup>g,a,r\\<^esup> l' \\ c \\ set r \\ k_fun l' c \\ k_fun l c\"\n and k_bound':\n \"\\ l. \\ i > m. k_fun l i = 0\"\n and k_0':\n \"\\ l. k_fun l 0 = 0\"\n using k_ceiling_1 k_ceiling_2 unfolding k_fun_def by auto\n\nsublocale Reachability_Problem A \"(init, s\\<^sub>0)\" m k_fun \"PR_CONST (\\ (l, s). F l s)\"\n by (standard; rule k_ceiling' k_bound' k_0')\n\nend (* End of context for precompiled reachability problem with ceiling *)\n\n\nlocale UPPAAL_Reachability_Problem_precompiled_start_state =\n UPPAAL_Reachability_Problem_precompiled _ _ _ _ pred\n for pred :: \"nat list list\" +\n fixes s\\<^sub>0 :: \"int list\" (* XXX Why does nat not work? *)\n assumes start_pred:\n \"\\ q < p. \\ pc st s' rs pcs.\n exec (stripfp PROG) max_steps ((pred ! q ! (init ! q)), [], s\\<^sub>0, True, []) []\n = Some ((pc, st, s', True, rs), pcs)\"\n and bounded: \"bounded bounds s\\<^sub>0\"\n and pred_time_indep: \"\\ x \\ set pred. \\ pc \\ set x. time_indep_check prog pc max_steps\"\n and upd_time_indep:\n \"\\ T \\ set trans. \\ xs \\ set T. \\ (_, _, pc_u, _) \\ set xs.\n time_indep_check prog pc_u max_steps\"\n and clock_conj:\n \"\\ T \\ set trans. \\ xs \\ set T. \\ (pc_g, _, _, _) \\ set xs.\n conjunction_check prog pc_g max_steps\"\nbegin\n\n lemma [intro]:\n \"bounded defs'.B s\\<^sub>0\"\n using bounded unfolding bounded_def N_def by simp\n\n lemma equiv_P_simp:\n \"equiv.P = PROG\"\n unfolding N_def by simp\n\n lemma [intro]:\n \"time_indep (conv_prog equiv.P) max_steps (pred ! q ! (L ! q), [], s, True, [])\"\n if \"q < p\" \"L \\ equiv.defs.states' s\"\n proof -\n from that lengths process_length have \"q < length pred\" \"L ! q < length (pred ! q)\" by auto\n then have \"pred ! q \\ set pred\" \"pred ! q ! (L ! q) \\ set (pred ! q)\" by auto\n with pred_time_indep time_indep_overapprox show ?thesis\n by (auto simp: PROG_def equiv_P_simp)\n qed\n\n lemma [intro]:\n \"time_indep (conv_prog PROG) max_steps (pc_u, [], s, True, [])\"\n if \"q < p\" \"(l, pc_g, a, pc_u, l') \\ T q\"\n proof -\n from that lengths process_length have\n \"q < length trans\" \"l < length (trans ! q)\" \"(pc_g, a, pc_u, l') \\ set (trans ! q ! l)\"\n unfolding T_def by auto\n moreover then have \"trans ! q \\ set trans\" \"trans ! q ! l \\ set (trans ! q)\" by auto\n ultimately show ?thesis using upd_time_indep time_indep_overapprox\n unfolding PROG_def by blast\n qed\n\n lemma [intro]:\n \"u \\\\<^sub>a ac\" if\n \"q < defs'.p\"\n \"(l, pc_g, a, pc_u, l') \\ fst (defs'.N ! q)\"\n \"stepst defs'.P max_steps u (pc_g, [], s, True, []) (pc_t, st_t, s_t, True, rs_t)\"\n \"stepsc defs'.P max_steps u (pc_g, [], s, True, []) (pc', st, s', f', rs)\"\n \"defs'.P pc' = Some (CEXP ac)\"\n proof -\n let ?P = \"conv_P prog\"\n from that(5) obtain ac' where\n \"ac = conv_ac ac'\" \"prog ! pc' = Some (CEXP ac')\" \"pc' < length prog\"\n apply (clarsimp split: option.split_asm if_split_asm simp add: PROG_def N_def)\n subgoal for z\n by (cases z) auto\n done\n with that have \"u \\\\<^sub>a conv_ac ac'\"\n apply -\n apply (rule conjunction_check)\n using clock_conj apply simp_all\n unfolding N_def apply simp_all\n using lengths process_length(2) by (force dest!: nth_mem simp: PROG_def N_def T_def)+\n with \\ac = _\\ show ?thesis by simp\n qed\n\n sublocale product':\n Equiv_TA \"conv N\" max_steps init s\\<^sub>0\n apply standard\n apply rule\n apply (simp; blast)\n subgoal\n apply clarsimp\n apply (force simp: N_def)\n done\n apply blast\n apply (simp; fail)\n unfolding PF_PF using start_pred apply simp\n by rule\n\n \n\n lemma [simp]:\n \"(snd \\ snd \\ snd \\ snd) ` (\\(l, g, a, r, l'). (l, map conv_ac g, a, r, l')) ` S\n = (snd \\ snd \\ snd \\ snd) ` S\"\n by force\n\n (*\n lemma map_trans_of:\n \"map trans_of (map conv_A (fst N)) = map ((`) conv_t) (map trans_of (fst N))\"\n by (simp add: trans_of_def split: prod.split)\n\n lemma [simp]:\n \"Product_TA_Defs.states (map conv_A (fst N)) = Product_TA_Defs.states (fst N)\"\n unfolding Product_TA_Defs.states_def map_trans_of by simp\n\n lemma [simp]:\n \"product.P = P\"\n unfolding N_def by simp\n\n lemma start_pred':\n \"\\ i < p. (pred ! i ! (init ! i)) s\\<^sub>0\"\n using start_pred unfolding init_def by auto\n\n lemma start_pred'':\n \"\\ i < p. ((P ! i) (init ! i)) s\\<^sub>0\"\n using start_pred' process_length(3) unfolding P_def by auto\n\n sublocale product': Prod_TA \"(map conv_A (fst N), snd N)\" init s\\<^sub>0\n by (standard; simp add: init_states start_pred'')\n *)\n\nend (* End of locale *)\n\nlocale UPPAAL_Reachability_Problem_precompiled' =\n UPPAAL_Reachability_Problem_precompiled_start_state +\n UPPAAL_Reachability_Problem_precompiled_defs' +\n UPPAAL_Reachability_Problem_precompiled_ceiling +\n assumes action_set:\n \"\\ T \\ set trans. \\ xs \\ set T. \\ (_, a, _) \\ set xs. pred_act (\\ a. a < na) a\"\nbegin\n\n (* XXX Why are we re-doing this here? *)\n sublocale Reachability_Problem_Impl_Defs _ _ A \"(init, s\\<^sub>0)\" m k_fun \"PR_CONST (\\ (l, s). F l s)\" .\n\n definition\n \"states' = {(L, s). L \\ equiv.defs.states' s \\ check_pred L s \\ length s = length bounds}\"\n\n lemma in_trans_in_mapI:\n assumes\n \"q < p\" \"l < length (trans ! q)\" \"i < length (trans ! q ! l)\"\n \"(g1, In a, r1) = trans ! q ! l ! i\"\n shows \"(g1, a, r1) \\ set (IArray (map IArray trans_in_map) !! q !! l)\"\n using assms process_length(2) unfolding trans_in_map_def\n by (force dest: nth_mem intro!: image_eqI[where x = \"(g1, In a, r1)\"])\n\n lemma in_trans_out_mapI:\n assumes\n \"q < p\" \"l < length (trans ! q)\" \"i < length (trans ! q ! l)\"\n \"(g1, Out a, r1) = trans ! q ! l ! i\"\n shows \"(g1, a, r1) \\ set (IArray (map IArray trans_out_map) !! q !! l)\"\n using assms process_length(2) unfolding trans_out_map_def\n by (force dest: nth_mem intro!: image_eqI[where x = \"(g1, Out a, r1)\"])\n\n lemma in_trans_in_mapD:\n assumes\n \"(g1, a, r1) \\ set (IArray (map IArray trans_in_map) !! q !! l)\"\n \"q < p\" \"l < length (trans ! q)\"\n obtains i where\n \"i < length (trans ! q ! l) \\ trans ! q ! l ! i = (g1, In a, r1)\"\n using assms process_length(2) unfolding trans_in_map_def\n by (fastforce dest: mem_nth split: act.split_asm)\n\n (* XXX Remove duplication *)\n lemma in_trans_out_mapD:\n assumes\n \"(g1, a, r1) \\ set (IArray (map IArray trans_out_map) !! q !! l)\"\n \"q < p\" \"l < length (trans ! q)\"\n obtains i where\n \"i < length (trans ! q ! l) \\ trans ! q ! l ! i = (g1, Out a, r1)\"\n using assms process_length(2) unfolding trans_out_map_def\n by (fastforce dest: mem_nth split: act.split_asm)\n\n lemma in_actions_by_stateI:\n assumes\n \"(g1, a, r1) \\ set xs\" \"a < length acc\"\n shows\n \"(q, g1, a, r1) \\ set (actions_by_state q xs acc ! a)\n \\ a < length (actions_by_state q xs acc)\"\n using assms unfolding actions_by_state_def\n apply (induction xs arbitrary: acc)\n apply (simp; fail)\n apply simp\n apply (erule disjE)\n apply (rule fold_acc_preserv\n [where P = \"\\ acc. (q, g1, a, r1) \\ set (acc ! a) \\ a < length acc\"]\n )\n apply (subst list_update_nth_split; auto)\n by auto\n\n lemma in_actions_by_state_preserv:\n assumes\n \"(q, g1, a, r1) \\ set (acc ! a)\" \"a < length acc\"\n shows\n \"(q, g1, a, r1) \\ set (actions_by_state y xs acc ! a)\n \\ a < length (actions_by_state y xs acc)\"\n using assms unfolding actions_by_state_def\n apply -\n apply (rule fold_acc_preserv\n [where P = \"\\ acc. (q, g1, a, r1) \\ set (acc ! a) \\ a < length acc\"]\n )\n apply (subst list_update_nth_split; auto)\n by auto\n\n lemma length_actions_by_state_preserv[simp]:\n shows \"length (actions_by_state y xs acc) = length acc\"\n unfolding actions_by_state_def by (auto intro: fold_acc_preserv simp: list_update_nth_split)\n\n lemma in_all_actions_by_stateI:\n assumes\n \"a < na\" \"q < p\" \"(g1, a, r1) \\ set (M !! q !! (L ! q))\"\n shows\n \"(q, g1, a, r1) \\ set (all_actions_by_state M L ! a)\"\n unfolding all_actions_by_state_def\n apply (rule fold_acc_ev_preserv\n [where P = \"\\ acc. (q, g1, a, r1) \\ set (acc ! a)\" and Q = \"\\ acc. a < length acc\",\n THEN conjunct1]\n )\n apply (rule in_actions_by_state_preserv[THEN conjunct1])\n using assms by (auto intro: in_actions_by_stateI[THEN conjunct1])\n\n lemma actions_by_state_inj:\n assumes \"j < length acc\"\n shows \"\\ (q, a) \\ set (actions_by_state i xs acc ! j). (q, a) \\ set (acc ! j) \\ i = q\"\n unfolding actions_by_state_def\n apply (rule fold_acc_preserv\n [where P =\n \"\\ acc'. (\\ (q, a) \\ set (acc' ! j). (q, a) \\ set (acc ! j) \\ i = q) \\ j < length acc'\",\n THEN conjunct1])\n subgoal for x acc\n by (cases \"fst (snd x) = j\"; simp)\n using assms by auto\n\n lemma actions_by_state_inj':\n assumes \"j < length acc\" \"(q, a) \\ set (acc ! j)\" \"(q, a) \\ set (actions_by_state i xs acc ! j)\"\n shows \"i = q\"\n using actions_by_state_inj[OF assms(1)] assms(2-) by fast\n\n lemma in_actions_by_stateD:\n assumes\n \"(q, g, a, t) \\ set (actions_by_state i xs acc ! j)\" \"(q, g, a, t) \\ set (acc ! j)\"\n \"j < length acc\"\n shows\n \"(g, a, t) \\ set xs \\ j = a\"\n using assms unfolding actions_by_state_def\n apply -\n apply (drule fold_evD\n [where y = \"(g, a, t)\" and Q = \"\\ acc'. length acc' = length acc\"\n and R = \"\\ (_, a', t). a' = j\"]\n )\n apply assumption\n (* XXX Define asm split rule *)\n apply (subst (asm) list_update_nth_split[of j]; force)\n apply simp+\n apply (subst (asm) list_update_nth_split[of j]; force)\n by auto\n\n lemma in_all_actions_by_stateD:\n assumes\n \"(q, g1, a, r1) \\ set (all_actions_by_state M L ! a')\" \"a' < na\"\n shows\n \"(g1, a, r1) \\ set (M !! q !! (L ! q)) \\ q < p \\ a' = a\"\n using assms\n unfolding all_actions_by_state_def\n apply -\n apply (drule fold_evD''[where y = q and Q = \"\\ acc. length acc = na\"])\n apply (simp; fail)\n apply (drule actions_by_state_inj'[rotated])\n apply (simp; fail)+\n apply safe\n apply (drule in_actions_by_stateD)\n apply assumption\n apply (rule fold_acc_preserv)\n apply (simp; fail)+\n subgoal premises prems\n proof -\n from prems(2) have \"q \\ set [0..a. a < na) a\"\n using action_set assms process_length(2) by (force dest!: nth_mem)\n\n lemma in_actions_trans_in_mapI:\n assumes\n \"pa < p\"\n \"(g1, In a, r1) = trans ! pa ! (L ! pa) ! j\"\n \"L ! pa < length (trans ! pa)\"\n \"j < length (trans ! pa ! (L ! pa))\"\n shows \"(pa, g1, a, r1) \\ set (all_actions_by_state (IArray (map IArray trans_in_map)) L ! a)\"\n apply (rule in_all_actions_by_stateI)\n using assms action_set process_length(2) apply (fastforce dest!: nth_mem)\n using assms by (fastforce intro: in_trans_in_mapI)+\n\n lemma in_actions_trans_out_mapI:\n assumes\n \"pa < p\"\n \"(g1, Out a, r1) = trans ! pa ! (L ! pa) ! j\"\n \"L ! pa < length (trans ! pa)\"\n \"j < length (trans ! pa ! (L ! pa))\"\n shows \"(pa, g1, a, r1) \\ set (all_actions_by_state (IArray (map IArray trans_out_map)) L ! a)\"\n apply (rule in_all_actions_by_stateI)\n using assms action_set process_length(2) apply (fastforce dest!: nth_mem)\n using assms by (fastforce intro: in_trans_out_mapI)+\n\n lemma in_pairs_by_actionD2:\n assumes\n \"(g, a, r, L', s') \\ set (pairs_by_action (L, s) xs ys)\"\n \"\\ (q, g, a'', m, l) \\ set xs. a'' = a'\"\n \"\\ (q, g, a'', m, l) \\ set ys. a'' = a'\"\n shows \"check_pred L' s'\"\n using assms(1) unfolding pairs_by_action_def using assms(2,3)\n by (clarsimp split: option.split_asm simp: set_map_filter) (clarsimp split: if_split_asm)\n\n lemma in_pairs_by_actionD1:\n assumes\n \"(g, a, r, L', s') \\ set (pairs_by_action (L, s) xs ys)\"\n \"\\ (q, g, a'', m, l) \\ set xs. a'' = a'\"\n \"\\ (q, g, a'', m, l) \\ set ys. a'' = a'\"\n obtains\n pa q pc_g1 pc_g2 g1 g2 r1 r2 pc_u1 pc_u2 l1' l2' s1\n x1 x2 x3 x4 x5 y1 y2 y3 y4\n where\n \"pa \\ q\"\n \"(pa, pc_g1, a, pc_u1, l1') \\ set ys\"\n \"(q, pc_g2, a, pc_u2, l2') \\ set xs\"\n \"L' = L[pa := l1', q := l2']\"\n \"runf pc_u1 s1 = Some ((x1, x2, s', x3, x4), x5)\"\n \"runf pc_u2 s = Some ((y1, y2, s1, y3, r2), y4)\"\n \"check_g pc_g1 s = Some g1\" \"check_g pc_g2 s = Some g2\"\n \"r1 = make_reset pc_u1 s\"\n \"g = g1 @ g2\" \"r = r1 @ r2\"\n proof -\n obtain\n pa q pc_g1 pc_g2 g1 g2 r1 r2 pc_u1 pc_u2 l1' l2' s1\n x1 x2 x3 x4 x5 y1 y2 y3 y4\n where\n \"(q, pc_g1, a, pc_u1, l1') \\ set ys\" \"(pa, pc_g2, a, pc_u2, l2') \\ set xs\" \"q \\ pa\"\n \"check_g pc_g1 s = Some g1\" \"check_g pc_g2 s = Some g2\"\n \"runf pc_u1 s1 = Some ((x1, x2, s', x3, x4), x5)\"\n \"runf pc_u2 s = Some ((y1, y2, s1, y3, r2), y4)\"\n \"r1 = make_reset pc_u1 s\"\n \"Some (g1 @ g2, a, r1 @ r2, L[q := l1', pa := l2'], s') = Some (g, a, r, L', s')\"\n proof -\n from assms(1) show ?thesis\n unfolding pairs_by_action_def using assms(2,3)\n apply clarsimp\n unfolding set_map_filter\n apply clarsimp\n apply (clarsimp split: option.split_asm if_split_asm)\n by (force intro!: that)\n qed\n then show ?thesis by (fast intro: that)\n qed\n\n lemma in_pairs_by_actionD:\n assumes\n \"(g, a, r, L', s') \\ set (pairs_by_action (L, s) xs ys)\"\n \"\\ (q, g, a'', m, l) \\ set xs. a'' = a'\"\n \"\\ (q, g, a'', m, l) \\ set ys. a'' = a'\"\n obtains\n pa q pc_g1 pc_g2 p1 p2 g1 g2 r1 r2 pc_u1 pc_u2 l1' l2' s1\n x1 x2 x3 x4 x5 y1 y2 y3 y4\n where\n \"pa \\ q\"\n \"(pa, pc_g1, a, pc_u1, l1') \\ set ys\"\n \"(q, pc_g2, a, pc_u2, l2') \\ set xs\"\n \"L' = L[pa := l1', q := l2']\"\n (*\"s' = m1 (m2 s)\"*)\n \"runf pc_u1 s1 = Some ((x1, x2, s', x3, x4), x5)\"\n \"runf pc_u2 s = Some ((y1, y2, s1, y3, r2), y4)\"\n \"check_g pc_g1 s = Some g1\" \"check_g pc_g2 s = Some g2\"\n \"r1 = make_reset pc_u1 s\"\n \"g = g1 @ g2\" \"r = r1 @ r2\"\n (* \"\\ q' < p. (P ! q') (L' ! q') s'\" *)\n \"check_pred L' s'\"\n (* Some ((_, _, s1, _, r2), _) *)\n using in_pairs_by_actionD1[OF assms] in_pairs_by_actionD2[OF assms] by metis\n\n lemma in_trans_funD:\n assumes \"y \\ set (trans_fun L)\"\n shows \"y \\ set (trans_s_fun L) \\ y \\ set (trans_i_fun L)\"\n using assms unfolding trans_fun_def by auto\n\n lemma states'_states'[intro]:\n \"L \\ equiv.defs.states' s\" if \"(L, s) \\ states'\"\n using that unfolding states'_def by auto\n\n lemma bounded'_bounded:\n \"bounded' s \\ bounded bounds s\" if \"length s = length bounds\"\n using that unfolding bounded'_def bounded_def by simp\n\n lemma bounded_bounded':\n \"bounded bounds s \\ bounded' s\"\n unfolding bounded'_def bounded_def by simp\n\n lemma P_unfold:\n \"(\\q (check_pred L s)\" if \"length s = length bounds\"\n unfolding equiv.state_ta_def equiv.state_pred_def check_pred_def using process_length(3) that\n apply simp\n unfolding list_all_iff\n unfolding N_def\n unfolding runf_def P_def\n apply safe\n apply (auto split: option.split simp: bounded'_bounded; auto split: option.split_asm; fail)\n by (force split: option.splits simp: bounded'_bounded)\n\n lemma P_unfold_1:\n \"(\\q (check_pred L s)\"\n unfolding equiv.state_ta_def equiv.state_pred_def check_pred_def using process_length(3)\n apply simp\n unfolding list_all_iff\n unfolding N_def\n unfolding runf_def P_def\n by (auto split: option.split simp: bounded_bounded'; auto split: option.split_asm; fail)\n\n lemma [simp]:\n \"equiv.PT = PT\"\n unfolding striptp_def N_def by simp\n\n lemmas [simp] = equiv_P_simp\n\n lemma transD:\n assumes\n \"(pc_g, a, pc_u, l') = trans ! q ! (L ! q) ! j\"\n \"L ! q < length (trans ! q)\" \"j < length (trans ! q ! (L ! q))\"\n \"q < p\"\n shows \"(L ! q, pc_g, a, pc_u, l') \\ fst (equiv.N ! q)\"\n using assms unfolding N_def T_def by simp solve_ex_triv\n\n lemma trans_ND:\n assumes\n \"(L ! q, pc_g, a, pc_u, l') \\ fst (equiv.N ! q)\"\n \"q < p\"\n shows\n \"equiv.defs.N_s s ! q \\ L ! q\n \\\\<^bsup>equiv.make_g pc_g s,(a, equiv.make_c pc_g, equiv.make_mf pc_u),equiv.make_f pc_u s\\<^esup> l'\"\n using assms\n unfolding equiv.defs.N_s_def trans_of_def equiv.defs.T_s_def\n unfolding equiv.state_ta_def equiv.state_trans_t_def\n by clarsimp solve_ex_triv+\n\n lemma make_f_unfold:\n \"equiv.make_f pc s = make_reset pc s\"\n unfolding make_reset_def equiv.make_f_def runf_def by simp\n\n lemma make_g_simp:\n assumes \"check_g pc_g s = Some g1\"\n shows \"g1 = equiv.make_g pc_g s\"\n using assms unfolding check_g_def equiv.make_g_def runt_def\n by (clarsimp split: option.splits bool.splits simp: make_cconstr_def)\n\n lemma make_c_simp:\n assumes \"check_g pc_g s = Some g1\"\n shows \"equiv.make_c pc_g s\"\n using assms unfolding check_g_def equiv.make_c_def runt_def\n by (clarsimp split: option.splits bool.splits simp: make_cconstr_def)\n\n lemma make_reset_simp:\n assumes \"runf pc_u s = Some ((y1, y2, s1, y3, r2), y4)\"\n shows \"make_reset pc_u s = r2\"\n using assms unfolding runf_def make_reset_def by (auto split: option.splits)\n\n lemma make_mf_simp:\n assumes \"runf pc_u s = Some ((y1, y2, s1, y3, r2), y4)\"\n shows \"equiv.make_mf pc_u s = Some s1\"\n using assms unfolding runf_def equiv.make_mf_def by (auto split: option.splits)\n\n lemma trans_fun_trans_of':\n \"(trans_fun, trans_of A) \\ transition_rel states'\"\n unfolding transition_rel_def T_def\n apply simp\n unfolding trans_of_def\n apply safe\n subgoal for L s g a r L' s'\n unfolding equiv.defs.prod_ta_def equiv.defs.prod_trans_def\n apply simp\n apply safe\n subgoal\n apply (rule trans_i_fun_trans_fun)\n unfolding equiv.defs.prod_trans_i_alt_def\n apply safe\n unfolding trans_fun_def trans_i_from_def trans_i_fun_def\n unfolding Product_TA_Defs.product_trans_i_def\n apply clarsimp\n subgoal premises prems for c m p' l'\n proof -\n from prems have \"L ! p' < length (trans ! p')\" by auto\n from prems obtain pc_g pc_u where\n \"(L ! p', pc_g, Sil a, pc_u, l') \\ T p'\"\n \"g = equiv.make_g pc_g s\" \"r = equiv.make_f pc_u s\"\n \"c = equiv.make_c pc_g\" \"m = equiv.make_mf pc_u\"\n unfolding equiv.defs.N_s_def trans_of_def equiv.defs.T_s_def\n unfolding equiv.state_ta_def equiv.state_trans_t_def\n apply clarsimp\n unfolding N_def T_def by clarsimp\n from this(1) have \"(pc_g, Sil a, pc_u, l') \\ set (trans ! p' ! (L ! p'))\"\n unfolding T_def by auto\n moreover have \"check_g pc_g s = Some g\"\n using \\g = _\\ \\c = _\\ \\c s\\\n unfolding check_g_def equiv.make_g_def equiv.make_c_def\n by (auto split: option.splits simp: runt_def make_cconstr_def)\n moreover obtain x1 x2 x3 pcs where \"runf pc_u s = Some ((x1, x2, s', x3, r), pcs)\"\n using \\r = _\\ \\m = _\\ prems(5)\n unfolding equiv.make_f_def equiv.make_mf_def runf_def trans_of_def\n by (auto split: option.splits)\n moreover have \"check_pred (L[p' := l']) s'\"\n using prems(3) by (auto intro: P_unfold_1)\n ultimately show ?thesis using process_length(2) \\p' < _\\ \\L ! p' < _\\\n by (force simp: set_map_filter trans_i_map_def)\n qed\n done\n subgoal\n apply (rule trans_s_fun_trans_fun)\n unfolding equiv.defs.prod_trans_s_alt_def\n apply safe\n unfolding trans_fun_def trans_s_fun_def\n unfolding Product_TA_Defs.product_trans_s_def\n apply clarsimp\n subgoal premises prems for ci co mi mo s1 q1 q2 g1 g2 r1 r2 l1' l2'\n proof -\n from prems have \"L ! q1 < length (trans ! q1)\" \"L ! q2 < length (trans ! q2)\" by auto\n from prems obtain pc_g1 pc_u1 where\n \"(L ! q1, pc_g1, In a, pc_u1, l1') \\ T q1\"\n \"g1 = equiv.make_g pc_g1 s\" \"r1 = equiv.make_f pc_u1 s\"\n \"ci = equiv.make_c pc_g1\" \"mi = equiv.make_mf pc_u1\"\n unfolding equiv.defs.N_s_def trans_of_def equiv.defs.T_s_def\n unfolding equiv.state_ta_def equiv.state_trans_t_def\n apply clarsimp\n unfolding N_def T_def by clarsimp\n from prems obtain pc_g2 pc_u2 where\n \"(L ! q2, pc_g2, Out a, pc_u2, l2') \\ T q2\"\n \"g2 = equiv.make_g pc_g2 s\" \"r2 = equiv.make_f pc_u2 s\"\n \"co = equiv.make_c pc_g2\" \"mo = equiv.make_mf pc_u2\"\n unfolding equiv.defs.N_s_def trans_of_def equiv.defs.T_s_def\n unfolding equiv.state_ta_def equiv.state_trans_t_def\n apply clarsimp\n unfolding N_def T_def by clarsimp\n from \\_ \\ T q1\\ have \"(pc_g1, In a, pc_u1, l1') \\ set (trans ! q1 ! (L ! q1))\"\n unfolding T_def by auto\n from \\_ \\ T q2\\ have \"(pc_g2, Out a, pc_u2, l2') \\ set (trans ! q2 ! (L ! q2))\"\n unfolding T_def by auto\n moreover have \"check_g pc_g1 s = Some g1\" \"check_g pc_g2 s = Some g2\"\n using \\g1 = _\\ \\ci = _\\ \\ci s\\ \\g2 = _\\ \\co = _\\ \\co s\\\n unfolding check_g_def equiv.make_g_def equiv.make_c_def\n by (auto split: option.splits simp: runt_def make_cconstr_def)\n moreover obtain x1 x2 x3 pcs where \"runf pc_u2 s = Some ((x1, x2, s1, x3, r2), pcs)\"\n using \\r2 = _\\ \\mo = _\\ \\Some s1 = _\\\n unfolding equiv.make_f_def equiv.make_mf_def runf_def trans_of_def\n by (auto split: option.splits)\n moreover obtain x1 x2 x3 x4 pcs where \"runf pc_u1 s1 = Some ((x1, x2, s', x3, x4), pcs)\"\n using \\r1 = _\\ \\mi = _\\ \\Some s' = _\\\n unfolding equiv.make_f_def equiv.make_mf_def runf_def trans_of_def\n by (auto split: option.splits)\n moreover have \"r1 = make_reset pc_u1 s\"\n using \\r1 = _\\ unfolding make_reset_def equiv.make_f_def runf_def by auto\n moreover have \"check_pred (L[q1 := l1', q2 := l2']) s'\"\n using prems(5) by (auto intro: P_unfold_1)\n moreover have \"a < na\"\n using action_set \\_ \\ set (trans ! q1 ! (L ! q1))\\ \\q1 < _\\ \\L ! q1 < _\\\n process_length(2)\n by (fastforce dest!: nth_mem)\n moreover have\n \"(q1, pc_g1, a, pc_u1, l1')\n \\ set (all_actions_by_state (nested_list_to_iarray trans_in_map) L ! a)\"\n using \\L ! q1 < _\\ \\_ \\ set (trans ! q1 ! (L ! q1))\\ \\q1 < p\\\n by (force intro: in_actions_trans_in_mapI dest: mem_nth)\n moreover have\n \"(q2, pc_g2, a, pc_u2, l2')\n \\ set (all_actions_by_state (nested_list_to_iarray trans_out_map) L ! a)\"\n using \\L ! q2 < _\\ \\_ \\ set (trans ! q2 ! (L ! q2))\\ \\q2 < p\\\n by (force intro: in_actions_trans_out_mapI dest: mem_nth)\n ultimately show ?thesis\n using process_length(2) \\q1 < _\\ \\L ! q1 < _\\ \\q2 < _\\ \\L ! q2 < _\\ \\_ \\ _\\\n unfolding pairs_by_action_def\n apply -\n apply (rule bexI[where x = a])\n by auto (force simp: set_map_filter)\n qed\n done\n done\n subgoal for L s g a r L' s'\n apply (drule in_trans_funD)\n apply (erule disjE)\n unfolding equiv.defs.prod_ta_def equiv.defs.prod_trans_def\n apply simp\n apply (rule disjI2)\n subgoal\n unfolding equiv.defs.prod_trans_s_alt_def\n apply safe\n unfolding trans_s_fun_def\n apply clarsimp\n subgoal for x\n apply (erule in_pairs_by_actionD[where a' = x])\n apply (auto dest: in_all_actions_by_stateD; fail)\n apply (auto dest: in_all_actions_by_stateD; fail)\n apply (drule in_all_actions_by_stateD, assumption)\n apply (drule in_all_actions_by_stateD, assumption)\n apply safe\n apply (erule in_trans_in_mapD)\n apply (simp; fail)\n apply blast\n apply (erule in_trans_out_mapD)\n apply blast\n apply blast\n apply (simp only: ex_simps[symmetric])\n unfolding states'_def\n apply (clarsimp)\n apply (subst P_unfold, assumption)\n apply (subst P_unfold)\n subgoal\n unfolding runf_def by (auto dest!: exec_state_length)\n apply simp thm transD[rotated 2]\n apply (drule transD[rotated 2], solve_triv+, blast)\n apply (drule transD[rotated 2], solve_triv+, blast) thm trans_ND\n apply (drule_tac s = s in trans_ND, assumption)\n apply (drule_tac s = s in trans_ND, assumption)\n unfolding Product_TA_Defs.product_trans_s_def\n apply clarsimp\n unfolding trans_of_def\n subgoal\n apply (simp only: ex_simps[symmetric])\n apply defer_ex\n apply defer_ex\n apply solve_ex_triv\n apply solve_ex_triv\n apply solve_ex_triv\n unfolding make_f_unfold\n by (auto simp add: make_c_simp make_mf_simp make_reset_simp make_g_simp[symmetric])\n done\n done\n subgoal\n apply simp\n apply (rule disjI1)\n using process_length(2)\n unfolding equiv.defs.prod_trans_i_alt_def\n apply simp\n unfolding P_unfold\n unfolding trans_i_fun_def trans_i_from_def states'_def\n apply simp\n apply (erule bexE)\n\n unfolding set_map_filter thm set_map_filter\n apply simp\n subgoal premises prems for q\n proof -\n from prems have len: \"q < length trans\" \"L ! q < length (trans ! q)\" by auto\n from prems(4) obtain pc_g pc_u l' x1 x2 x3 x4 where\n \"(pc_g, a, pc_u, l') \\ set (IArray.list_of (map IArray trans_i_map ! q) ! (L ! q))\"\n \"check_g pc_g s = Some g\"\n \"r = make_reset pc_u s\"\n \"runf pc_u s = Some ((x1, x2, s', x3, r), x4)\"\n \"check_pred (L[q := l']) s'\"\n \"L' = L[q := l']\"\n apply atomize_elim\n unfolding make_reset_def\n by (force split: option.splits if_split_asm)\n moreover then have\n \"(L, g, (a, Networks.label.Act (equiv.make_c pc_g, equiv.make_mf pc_u)), r, L')\n \\ Product_TA_Defs.product_trans_i (equiv.defs.N_s s)\"\n unfolding Product_TA_Defs.product_trans_i_def\n apply clarsimp\n apply solve_ex_triv\n apply safe\n using prems apply simp\n unfolding trans_i_map_def\n using len \\q < p\\ apply (clarsimp simp: set_map_filter)\n apply (clarsimp split: act.split_asm)\n apply (frule make_c_simp)\n apply (drule mem_nth)\n apply safe\n apply (drule transD[rotated], solve_triv+)\n apply (drule trans_ND)\n apply solve_triv\n apply (subst make_g_simp)\n using \\q < p\\ prems(1) by (auto simp add: make_f_unfold)\n ultimately show ?thesis\n apply (subst P_unfold)\n subgoal\n using prems(1) by fast\n apply (subst P_unfold)\n subgoal\n using \\runf _ _ = _\\ prems(1)\n unfolding runf_def by (auto dest!: exec_state_length)\n using prems(1) by (force simp: make_mf_simp dest: make_c_simp)\n qed\n done\n done\n done\n\n (* XXX Unused *)\n lemma transition_rel_mono:\n \"(a, b) \\ transition_rel B\" if \"(a, b) \\ transition_rel C\" \"B \\ C\"\n using that unfolding transition_rel_def b_rel_def fun_rel_def by auto\n\nend\n\ncontext\n Equiv_TA_Defs\nbegin\n\n lemma state_set_subs: (* XXX Clean *)\n \"state_set (trans_of (defs.product s''))\n \\ {L. length L = defs.p \\ (\\q State_Networks.state_set (fst (defs.N ! q)))}\"\n unfolding defs.states'_alt_def[symmetric]\n unfolding defs.N_s_def\n unfolding state_set_def Product_TA_Defs.states_def\n unfolding trans_of_def\n unfolding Product_TA_Defs.product_ta_def Product_TA_Defs.product_trans_def\n unfolding Product_TA_Defs.product_trans_i_def Product_TA_Defs.product_trans_s_def\n unfolding defs.T_s_def\n unfolding Product_TA_Defs.states_def trans_of_def\n apply simp\n apply safe\n apply (simp; fail)\n using [[goals_limit = 1]]\n apply force\n apply force\n apply (force simp: image_iff)\n apply force\n apply (case_tac \"pa = q\")\n apply (force simp: image_iff)\n apply (force simp: image_iff)\n apply force\n apply (case_tac \"qa = q\")\n apply force\n apply (case_tac \"qa = pa\")\n by (force simp: image_iff)+\n\nend\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n lemma N_s_state_indep:\n assumes \"(L ! q, g, a, r, l') \\ map trans_of (equiv.defs.N_s s) ! q\" \"q < p\"\n obtains g r where \"(L ! q, g, a, r, l') \\ map trans_of (equiv.defs.N_s s') ! q\"\n using assms unfolding trans_of_def equiv.defs.N_s_def equiv.defs.T_s_def by force\n\n lemma fst_product_state_indep:\n \"fst ` fst (equiv.defs.product s) = fst ` fst (equiv.defs.product s')\"\n unfolding Product_TA_Defs.product_ta_def Product_TA_Defs.product_trans_def\n unfolding Product_TA_Defs.product_trans_s_def Product_TA_Defs.product_trans_i_def\n apply simp\n unfolding equiv.defs.states'_alt_def\n apply clarsimp\n apply rule\n subgoal\n apply rule\n apply clarsimp\n apply (erule disjE)\n apply (erule conjE exE)+\n apply (erule N_s_state_indep)\n apply (simp; fail)\n apply (rule img_fst)\n apply (rule Set.UnI1)\n apply (subst mem_Collect_eq)\n apply solve_ex_triv+\n apply (erule conjE exE)+\n apply (erule N_s_state_indep, (simp; fail))\n apply (erule N_s_state_indep, (simp; fail))\n apply (rule img_fst)\n apply (rule Set.UnI2)\n apply (subst mem_Collect_eq)\n apply (rule exI)+\n apply (rule conjI)\n defer\n by solve_ex_triv+\n subgoal\n apply rule\n apply clarsimp\n apply (erule disjE)\n apply (erule conjE exE)+\n apply (erule N_s_state_indep)\n apply (simp; fail)\n apply (rule img_fst)\n apply (rule Set.UnI1)\n apply (subst mem_Collect_eq)\n apply solve_ex_triv+\n apply (erule conjE exE)+\n apply (erule N_s_state_indep, (simp; fail))\n apply (erule N_s_state_indep, (simp; fail))\n apply (rule img_fst)\n apply (rule Set.UnI2)\n apply (subst mem_Collect_eq)\n apply (rule exI)+\n apply (rule conjI)\n defer\n by solve_ex_triv+\n done\n\n lemma last_product_state_indep:\n \"(snd o snd o snd o snd) ` fst (equiv.defs.product s)\n = (snd o snd o snd o snd) ` fst (equiv.defs.product s')\"\n unfolding Product_TA_Defs.product_ta_def Product_TA_Defs.product_trans_def\n unfolding Product_TA_Defs.product_trans_s_def Product_TA_Defs.product_trans_i_def\n apply simp\n unfolding equiv.defs.states'_alt_def\n apply clarsimp\n apply rule\n subgoal\n apply rule\n apply clarsimp\n apply (erule disjE)\n apply (erule conjE exE)+\n apply (erule N_s_state_indep)\n apply (simp; fail)\n apply (rule )\n prefer 2\n apply (rule Set.UnI1)\n apply (subst mem_Collect_eq)\n apply solve_ex_triv+\n apply (erule conjE exE)+\n apply (erule N_s_state_indep, (simp; fail))\n apply (erule N_s_state_indep, (simp; fail))\n apply (rule )\n defer\n apply (rule Set.UnI2)\n apply (subst mem_Collect_eq)\n apply (rule exI)+\n apply (rule conjI)\n defer\n apply solve_ex_triv+\n defer\n apply (rule HOL.refl)\n by simp\n subgoal\n apply rule\n apply clarsimp\n apply (erule disjE)\n apply (erule conjE exE)+\n apply (erule N_s_state_indep)\n apply (simp; fail)\n apply (rule )\n prefer 2\n apply (rule Set.UnI1)\n apply (subst mem_Collect_eq)\n apply solve_ex_triv+\n apply (erule conjE exE)+\n apply (erule N_s_state_indep, (simp; fail))\n apply (erule N_s_state_indep, (simp; fail))\n apply (rule )\n defer\n apply (rule Set.UnI2)\n apply (subst mem_Collect_eq)\n apply (rule exI)+\n apply (rule conjI)\n defer\n apply solve_ex_triv+\n defer\n apply (rule HOL.refl)\n by simp\n done\n\n lemma state_set_T':\n \"state_set (equiv.defs.T' s'') \\ fst ` state_set (trans_of A)\"\n unfolding trans_of_def\n unfolding state_set_def\n unfolding Prod_TA_Defs.prod_ta_def equiv.defs.prod_trans_def\n apply simp\n unfolding equiv.defs.prod_trans_i_def equiv.defs.prod_trans_s_def\n unfolding trans_of_def\n apply safe\n apply (subst fst_product_state_indep; force)\n apply (subst fst_product_state_indep; force)\n apply (subst (asm) last_product_state_indep[simplified]; force)\n by (subst (asm) last_product_state_indep[simplified]; force)\n\n lemma state_set_T'2[simplified]:\n \"length L = equiv.defs.p\"\n \"\\q State_Networks.state_set (fst (equiv.defs.N ! q))\"\n if \"(L, s) \\ state_set (trans_of A)\"\n using subset_trans [OF state_set_T' equiv.state_set_subs] that by blast+\n\n lemma state_set_states':\n \"L \\ equiv.defs.states' s\" if \"(L, s) \\ state_set (trans_of A)\"\n using state_set_T'2[OF that] unfolding equiv.defs.states'_alt_def by simp\n\n lemma state_set_pred:\n \"\\q state_set (trans_of A)\"\n using that\n unfolding Normalized_Zone_Semantics_Impl_Refine.state_set_def\n unfolding trans_of_def Prod_TA_Defs.prod_ta_def Prod_TA_Defs.prod_trans_def\n unfolding Prod_TA_Defs.prod_trans_i_def Prod_TA_Defs.prod_trans_s_def\n by force\n\nend\n\n\ncontext UPPAAL_Reachability_Problem_precompiled'\nbegin\n\n lemma bounded_bounded'':\n \"bounded bounds s \\ length s = length bounds\"\n unfolding bounded'_def bounded_def by simp\n\n lemma P_bounded:\n \"(\\q bounded bounds s\"\n unfolding equiv.state_ta_def equiv.state_pred_def check_pred_def using process_length(3) p_gt_0\n apply simp\n unfolding list_all_iff\n unfolding N_def\n unfolding runf_def P_def\n apply (drule spec[of _ 0])\n by (auto split: option.split dest: bounded_bounded''; auto split: option.split_asm)\n\n lemma P_state_length:\n \"(\\q length s = length bounds\"\n by (intro P_bounded bounded_bounded'')\n\n lemma state_set_state_length:\n \"length s = length bounds\" if \"(L, s) \\ state_set (trans_of A)\"\n using that unfolding state_set_def\n apply (safe dest!: equiv.defs.prod_ta_cases)\n unfolding equiv.defs.prod_trans_i_alt_def equiv.defs.prod_trans_s_alt_def\n by safe (auto dest: P_state_length)\n\n lemma state_set_states:\n \"state_set (trans_of A) \\ states'\"\n using state_set_states' state_set_pred unfolding states'_def\n by (auto intro: P_unfold_1 state_set_state_length)\n\n lemma p_p_2[simp]:\n \"defs'.defs.p = p\"\n unfolding defs'.p_p p_p ..\n\n lemma len_product'_N[simp]:\n \"length defs'.defs.N = p\"\n unfolding defs'.defs.p_def[symmetric] by (rule p_p_2)\n\n lemma len_equiv_N:\n \"length equiv.defs.N = p\"\n unfolding equiv.defs.p_def[symmetric] by simp\n\n lemma\n \"defs'.p = p\"\n unfolding defs'.p_def by simp\n\n lemma equiv_p_p: \"equiv.p = p\"\n by simp\n\n (* R *)\n lemma init_states:\n \"init \\ equiv.defs.states' s\\<^sub>0\"\n using processes_have_trans start_has_trans\n unfolding equiv_states'_alt_def\n unfolding init_def N_def T_def by force\n\n lemma start_pred':\n \"check_pred init s\\<^sub>0\"\n using start_pred bounded unfolding check_pred_def runf_def list_all_iff\n by (fastforce split: option.split intro: bounded_bounded')\n\n lemma start_states':\n \"(init, s\\<^sub>0) \\ states'\"\n using start_pred' init_states bounded unfolding states'_def bounded_def by auto\n\n lemma trans_fun_trans_of[intro, simp]:\n \"(trans_fun, trans_of A) \\ transition_rel states\"\n using trans_fun_trans_of' state_set_states start_states' unfolding transition_rel_def by blast\n\n definition\n \"inv_fun \\ \\ (L, _). concat (map (\\ i. IArray (map IArray inv) !! i !! (L ! i)) [0.. states'\"\n using state_set_states start_states' by auto\n\n lemma [simp]:\n \"length L = p\" if \"(L, s) \\ states'\"\n using that unfolding states'_def by auto\n\n lemma inv_simp:\n \"I q (L ! q) = inv ! q ! (L ! q)\" if \"q < p\" \"(L, s) \\ states'\"\n unfolding I_def using that states'_states'[OF that(2)] lengths by (auto dest!: states_len)\n\n lemma inv_fun_inv_of':\n \"(inv_fun, inv_of A) \\ inv_rel Id states'\"\n unfolding inv_rel_def\n apply (clarsimp simp: equiv.defs.inv_of_simp Product_TA_Defs.inv_of_product)\n using process_length(1)\n unfolding inv_fun_def Product_TA_Defs.product_invariant_def init_def\n unfolding equiv.defs.N_s_def\n apply simp\n apply (rule arg_cong[where f = concat])\n unfolding inv_of_def Equiv_TA_Defs.state_ta_def apply simp\n unfolding equiv.state_inv_def N_def Equiv_TA_Defs.state_inv_def\n by (auto simp: inv_simp)\n\n lemma inv_rel_mono:\n \"(a, b) \\ inv_rel Id B\" if \"(a, b) \\ inv_rel Id C\" \"B \\ C\"\n using that unfolding inv_rel_def b_rel_def fun_rel_def by auto\n\n lemma inv_fun_inv_of[intro, simp]:\n \"(inv_fun, inv_of A) \\ inv_rel Id states\"\n using inv_fun_inv_of' states_states' by (rule inv_rel_mono)\n\n definition \"final_fun \\ \\ (L, s). hd_of_formula formula L s\"\n\n lemma final_fun_final':\n \"(final_fun, (\\ (l, s). F l s)) \\ inv_rel Id states'\"\n unfolding F_def final_fun_def inv_rel_def in_set_member[symmetric] list_ex_iff\n by (force dest!: states'_states')\n\n lemma final_fun_final[intro, simp]:\n \"(final_fun, (\\ (l, s). F l s)) \\ inv_rel Id states\"\n using final_fun_final' states_states' by (rule inv_rel_mono)\n\n lemma fst_clkp_setD:\n assumes \"(c, d) \\ clkp_set A l\"\n shows \"c > 0\" \"c \\ m\" \"d \\ range int\"\n using assms clock_set consts_nats clkp_set'_subs\n unfolding Nats_def clk_set'_def TA_clkp_set_unfold by force+\n\n lemma init_has_trans:\n \"(init, s\\<^sub>0) \\ fst ` (trans_of A) \\ trans_fun (init, s\\<^sub>0) \\ []\"\n apply standard\n using trans_fun_trans_of unfolding transition_rel_def apply force\n using trans_fun_trans_of' start_states' unfolding transition_rel_def by fast\n\nend (* End of context *)\n\ncontext UPPAAL_Reachability_Problem_precompiled'\nbegin\n\n abbreviation \"k_i \\ IArray (map (IArray o (map (IArray o map int))) k)\"\n\n definition\n \"k_impl \\ \\ (l, _). IArray (map (\\ c. Max {k_i !! i !! (l ! i) !! c | i. i < p}) [0.. (l, _). IArray (map (\\ c. Max ((\\ i. k_i !! i !! (l ! i) !! c) ` {0.. i < p. \\ j < length (k ! i). length (k ! i ! j) = m + 1\"\n using k_length(1,3) by (auto dest: nth_mem)\n\n lemma Max_int_commute:\n \"int (Max S) = Max (int ` S)\" if \"finite S\" \"S \\ {}\"\n apply (rule mono_Max_commute)\n apply rule\n using that by auto\n\n lemma [intro]:\n \"k_impl (l, s) = IArray (k' (l, s))\" if\n \"(l, s) \\ states'\"\n proof -\n have l_len[simp]: \"l ! i < length (trans ! i)\" if \"i < p\" for i\n using \\i < p\\ \\(l, s) \\ _\\ by auto thm states_len\n have *: \"k_i !! i !! (l ! i) !! c = k ! i ! (l ! i) ! c\"\n if \"c \\ m\" \"i < p\" for c i\n proof -\n from k_length_alt that k_length(1,2) have \"length (k ! i ! (l ! i)) = m + 1\"\n by auto\n with that k_length process_length(2) processes_have_trans start_has_trans show ?thesis\n unfolding init_def by auto\n qed\n show ?thesis\n unfolding k_impl_def k'_def k_fun_def\n\n apply clarsimp\n apply safe\n subgoal\n apply (subst Max_int_commute)\n subgoal\n by auto\n subgoal\n using p_gt_0 by auto\n apply (rule arg_cong[where f = Max])\n apply safe\n using * apply (auto; fail)\n by (auto simp add: *[symmetric]; fail)\n\n subgoal\n apply (rule Max_eqI)\n apply (auto; fail)\n using k_length_alt k_length processes_have_trans k_0 p_gt_0 unfolding init_def\n apply (auto; fail)\n\n using k_length_alt k_length processes_have_trans k_0 p_gt_0 unfolding init_def\n apply clarsimp\n apply (rule exI[where x = 0])\n by simp\n\n subgoal\n apply (subst Max_int_commute)\n subgoal\n by auto\n subgoal\n using p_gt_0 by auto\n apply (rule arg_cong[where f = Max])\n apply safe\n using * apply (auto; fail)\n by (auto simp add: *[symmetric]; fail)\n done\n qed\n\n lemma [intro]:\n \"k_impl (l, s) = IArray (k' (l, s))\" if\n \"(l, s) \\ Normalized_Zone_Semantics_Impl_Refine.state_set (trans_of A)\"\n using that states_states' by auto\n\n lemma [intro]:\n \"k_impl (init, s\\<^sub>0) = IArray (k' (init, s\\<^sub>0))\"\n using states_states' by auto\n\n sublocale impl:\n Reachability_Problem_Impl\n where trans_fun = trans_fun\n and trans_impl = trans_fun\n and inv_fun = inv_fun\n and F_fun = final_fun\n and ceiling = k_impl\n and A = A\n and l\\<^sub>0 = \"(init, s\\<^sub>0)\"\n and l\\<^sub>0i = \"(init, s\\<^sub>0)\"\n and F = \"PR_CONST ((\\ (l, s). F l s))\"\n and n = m\n and k = k_fun\n and loc_rel = Id\n and show_clock = \"show\"\n and show_state = \"show\"\n and states' = states\n unfolding PR_CONST_def\n apply standard\n apply (fastforce simp: inv_rel_def b_rel_def)\n subgoal\n by auto (metis IdI list_rel_id_simp relAPP_def)\n by (fastforce simp: inv_rel_def b_rel_def)+\n\n (*\n (* XXX Unused *)\n lemma length_reachable:\n \"length L' = p\" if \"E\\<^sup>*\\<^sup>* a\\<^sub>0 ((L', s), u)\"\n thm impl.reachable_states impl.(.reachable_def) term (.reachable)\n using states_states' impl.reachable_states[unfolded impl.(.reachable_def), OF that]\n unfolding reachable_def (* by (force simp: init_def) *)\n oops\n\n lemma length_steps:\n \"length L' = p\" if \"conv_A A \\' \\(init, s\\<^sub>0), u\\ \\* \\(L', s'), u'\\\" \"\\c\\{1..m}. u c = 0\"\n using that reachable_decides_emptiness'[of \"(L', s')\"] by (auto intro: length_reachable)\n *)\n\n lemma F_reachable_correct':\n \"impl.op.F_reachable\n \\ (\\ L' s' u u'.\n conv_A A \\' \\(init, s\\<^sub>0), u\\ \\* \\(L', s'), u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\" if \"formula = formula.EX \\\"\n using that E_op''.E_from_op_reachability_check[of F_rel \"PR_CONST (\\(x, y). F x y)\",\n unfolded F_rel_def, OF HOL.refl]\n reachability_check\n unfolding impl.E_op_F_reachable E_op''.F_reachable_def E_op''.reachable_def\n unfolding F_rel_def unfolding F_def by force\n\n lemma PT_PT:\n \"defs'.PT = equiv.PT\"\n apply simp\n unfolding striptp_def\n apply (rule ext)\n apply clarsimp\n subgoal for x\n apply (cases \"PROG x\")\n apply (simp; fail)\n subgoal for a\n by (cases a) auto\n done\n done\n\n lemma P_P[simp]:\n \"defs'.defs.P = equiv.defs.P\"\n unfolding Equiv_TA_Defs.state_ta_def\n unfolding Equiv_TA_Defs.p_def\n unfolding Equiv_TA_Defs.state_pred_def\n using PF_PF by (auto split: option.split)\n\n lemma map_map_filter:\n \"map f (List.map_filter g xs) = List.map_filter (map_option f o g) xs\"\n by (induction xs; simp add: List.map_filter_simps split: option.split)\n\n lemma make_g_conv:\n \"defs'.make_g = conv_cc oo equiv.make_g\"\n unfolding Equiv_TA_Defs.make_g_def PT_PT PF_PF apply simp\n apply (rule ext)\n apply (rule ext)\n apply simp\n apply (auto split: option.splits simp: map_map_filter)\n apply (rule arg_cong2[where f = List.map_filter])\n by (auto split: option.split instrc.split)\n\n lemma make_c_conv:\n \"defs'.make_c = equiv.make_c\"\n unfolding Equiv_TA_Defs.make_c_def PT_PT by simp\n\n lemma make_f_conv:\n \"defs'.make_f = equiv.make_f\"\n unfolding Equiv_TA_Defs.make_f_def PF_PF by simp\n\n lemma make_mf_conv:\n \"defs'.make_mf = equiv.make_mf\"\n unfolding Equiv_TA_Defs.make_mf_def PF_PF by simp\n\n lemmas make_convs = make_g_conv make_c_conv make_f_conv make_mf_conv\n\n lemma state_trans_conv:\n \"Equiv_TA_Defs.state_trans_t (conv N) max_steps q\n = (\\ (a, b, c). (a, \\ x. conv_cc (b x), c)) ` equiv.state_trans q\" if \\q < p\\\n unfolding Equiv_TA_Defs.state_trans_t_def image_Collect\n using \\q < _\\ make_convs by (force split: prod.splits)+\n\n lemma map_conv_t:\n \"map trans_of (defs'.defs.N_s s) ! q = conv_t ` (map trans_of (equiv.defs.N_s s) ! q)\"\n if \\q < p\\\n using \\q < p\\\n apply (subst nth_map)\n unfolding defs'.defs.N_s_length p_p_2\n apply assumption\n apply (subst nth_map)\n unfolding equiv.defs.N_s_length\n apply simp\n unfolding trans_of_def Prod_TA_Defs.N_s_def\n unfolding len_equiv_N len_product'_N\n apply simp\n unfolding Prod_TA_Defs.T_s_def\n unfolding image_Collect\n unfolding Equiv_TA_Defs.state_ta_def Equiv_TA_Defs.p_def\n apply simp\n using state_trans_conv[of q]\n apply simp\n apply auto\n apply force\n apply solve_ex_triv+\n unfolding image_iff by force (* XXX Slow *)\n\n lemma product_trans_t_conv:\n \"Product_TA_Defs.product_trans_s (defs'.defs.N_s s)\n = conv_t ` Product_TA_Defs.product_trans_s (equiv.defs.N_s s)\"\n unfolding Product_TA_Defs.product_trans_s_def\n apply (simp only: states'_conv)\n apply safe\n apply (simp only: equiv.states'_len_simp equiv_p_p map_conv_t)\n unfolding image_Collect\n apply (simp split: prod.split)\n apply safe\n subgoal\n by defer_ex solve_ex_triv+\n subgoal\n by solve_ex_triv+ (force simp only: equiv.states'_len_simp equiv_p_p map_conv_t)\n done\n\n lemma product_trans_t_conv':\n \"Product_TA_Defs.product_trans_i (defs'.defs.N_s s)\n = conv_t ` Product_TA_Defs.product_trans_i (equiv.defs.N_s s)\"\n unfolding Product_TA_Defs.product_trans_i_def\n apply (simp only: states'_conv)\n apply safe\n apply (simp only: equiv.states'_len_simp equiv_p_p map_conv_t)\n unfolding image_Collect\n apply (simp split: prod.split)\n apply safe\n subgoal\n by defer_ex solve_ex_triv+\n subgoal\n by solve_ex_triv+ (force simp only: equiv.states'_len_simp equiv_p_p map_conv_t)\n done\n\n lemma prod_trans_s_conv:\n \"defs'.defs.prod_trans_s = conv_t ` equiv.defs.prod_trans_s\"\n unfolding defs'.defs.prod_trans_s_alt_def\n unfolding equiv.defs.prod_trans_s_alt_def\n unfolding product_trans_t_conv\n unfolding p_p_2 P_P\n apply simp\n apply safe\n unfolding p_p P_P\n apply (simp add: image_Collect)\n apply solve_ex_triv\n subgoal\n apply defer_ex\n apply defer_ex\n by solve_ex_triv+\n subgoal\n apply defer_ex\n apply defer_ex\n by solve_ex_triv+\n done\n\n lemma prod_trans_i_conv:\n \"defs'.defs.prod_trans_i = conv_t ` equiv.defs.prod_trans_i\"\n unfolding defs'.defs.prod_trans_i_alt_def\n unfolding equiv.defs.prod_trans_i_alt_def\n unfolding product_trans_t_conv'\n unfolding p_p_2 P_P\n apply simp\n apply safe\n unfolding p_p P_P\n apply (simp add: image_Collect)\n apply solve_ex_triv\n subgoal\n apply defer_ex\n apply defer_ex\n by solve_ex_triv+\n subgoal\n apply defer_ex\n apply defer_ex\n by solve_ex_triv+\n done\n\n lemma prod_trans_conv:\n \"defs'.defs.prod_trans = conv_t ` equiv.defs.prod_trans\"\n unfolding defs'.defs.prod_trans_def\n unfolding equiv.defs.prod_trans_def\n unfolding prod_trans_s_conv\n unfolding prod_trans_i_conv image_Un ..\n\n lemma prod_invariant_conv:\n \"defs'.defs.prod_invariant = (map conv_ac \\\\ Prod_TA_Defs.prod_invariant) EA\"\n apply (rule ext)\n apply safe\n unfolding defs'.defs.prod_invariant_def equiv.defs.prod_invariant_def\n unfolding Product_TA_Defs.product_ta_def inv_of_def\n apply simp\n unfolding Product_TA_Defs.product_invariant_def List.map_concat\n apply (simp add: Prod_TA_Defs.N_s_length)\n unfolding Equiv_TA_Defs.p_p Equiv_TA_Defs.p_def apply simp\n apply (rule cong[where f = concat])\n apply (rule HOL.refl)\n unfolding Prod_TA_Defs.N_s_def inv_of_def Equiv_TA_Defs.state_ta_def\n unfolding Equiv_TA_Defs.p_def unfolding Equiv_TA_Defs.state_inv_def\n by (simp split: prod.split)\n\n lemma prod_conv: \"defs'.defs.prod_ta = conv_A A\"\n unfolding defs'.defs.prod_ta_def\n unfolding equiv.defs.prod_ta_def\n unfolding conv_A_def\n by (simp add: prod_invariant_conv[symmetric] prod_trans_conv[symmetric])\n\n lemma F_reachable_correct:\n \"impl.op.F_reachable\n \\ (\\ L' s' u u'.\n conv N \\\\<^sub>max_steps \\init, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\" if \"formula = formula.EX \\\" \"start_inv_check\"\n unfolding F_reachable_correct'[OF that(1)]\n apply (subst product'.prod_correct[symmetric])\n using prod_conv p_p p_gt_0 apply simp\n using prod_conv p_p p_gt_0 apply simp\n using F_reachable_equiv[OF that(2)]\n by (simp add: F_def, simp add: that(1))\n\n definition\n \"reachability_checker_old \\\n worklist_algo2_impl\n impl.subsumes_impl impl.a\\<^sub>0_impl impl.F_impl impl.succs_impl impl.emptiness_check_impl\"\n\n definition\n \"reachability_checker' \\\n pw_impl\n (return o fst) impl.state_copy_impl impl.tracei impl.subsumes_impl impl.a\\<^sub>0_impl impl.F_impl\n impl.succs_impl impl.emptiness_check_impl\"\n\n theorem reachability_check':\n \"(uncurry0 reachability_checker',\n uncurry0 (\n Refine_Basic.RETURN (\\ L' s' u u'.\n conv_A A \\' \\(init, s\\<^sub>0), u\\ \\* \\(L', s'), u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\n )\n )\n \\ unit_assn\\<^sup>k \\\\<^sub>a bool_assn\" if \"formula = formula.EX \\\"\n using impl.pw_impl_hnr_F_reachable\n unfolding reachability_checker'_def F_reachable_correct'[OF that] .\n\n corollary reachability_checker'_hoare:\n \" reachability_checker'\n <\\ r. \\(r = (\\ L' s' u u'.\n conv_A A \\' \\(init, s\\<^sub>0), u\\ \\* \\(L', s'), u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n ))\n >\\<^sub>t\" if \"formula = formula.EX \\\"\n apply (rule cons_post_rule)\n using reachability_check'[OF that, to_hnr] apply (simp add: hn_refine_def)\n by (sep_auto simp: pure_def)\n\n definition reachability_checker where\n \"reachability_checker \\ do\n {\n init_sat \\ impl.start_inv_check_impl;\n if init_sat then do\n { x \\ reachability_checker';\n return (if x then REACHABLE else UNREACHABLE)\n }\n else\n return INIT_INV_ERR\n }\"\n\n theorem reachability_check:\n \"(uncurry0 reachability_checker,\n uncurry0 (\n Refine_Basic.RETURN (\n if start_inv_check\n then\n if\n (\n \\ L' s' u u'.\n conv N \\\\<^sub>max_steps \\init, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\n then REACHABLE\n else UNREACHABLE\n else INIT_INV_ERR\n )\n ))\n \\ unit_assn\\<^sup>k \\\\<^sub>a id_assn\" if \"formula = formula.EX \\\"\n apply (simp only: F_reachable_correct[OF that, symmetric] cong: if_cong)\n supply\n impl.pw_impl_hnr_F_reachable\n [unfolded reachability_checker'_def[symmetric], to_hnr, unfolded hn_refine_def,\n rule_format, sep_heap_rules]\n supply\n impl.start_inv_check_impl.refine[to_hnr, unfolded hn_refine_def, rule_format, sep_heap_rules]\n unfolding reachability_checker_def\n by sepref_to_hoare (sep_auto simp: pure_def)\n\n corollary reachability_checker_hoare:\n \" reachability_checker\n <\\ r. \\(r =\n (\n if start_inv_check\n then\n if\n (\n \\ L' s' u u'.\n conv N \\\\<^sub>max_steps \\init, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\n then REACHABLE\n else UNREACHABLE\n else INIT_INV_ERR\n )\n )\n >\\<^sub>t\" if \"formula = formula.EX \\\"\n apply (rule cons_post_rule)\n using reachability_check[OF that, to_hnr] apply (simp add: hn_refine_def)\n by (sep_auto simp: pure_def)\n\n (* XXX Add to standard library? Move *)\n lemma list_all_concat:\n \"list_all Q (concat xxs) \\ (\\ xs \\ set xxs. list_all Q xs)\"\n unfolding list_all_iff by auto\n\n lemma inv_of_init_unfold:\n \"u \\ inv_of (conv_A A) (init, s\\<^sub>0) \\ (\\ i < p. u \\ conv_cc (inv ! i ! 0))\"\n proof -\n have *: \"inv_of (conv_A A) (init, s\\<^sub>0) = conv_cc (equiv.defs.I' s\\<^sub>0 init)\"\n using equiv.defs.inv_of_simp[of init s\\<^sub>0]\n unfolding inv_of_def conv_A_def by (auto split: prod.split)\n have \"u \\ inv_of (conv_A A) (init, s\\<^sub>0) \\ (\\ i < p. u \\ conv_cc (I i 0))\"\n unfolding * Product_TA_Defs.inv_of_product Product_TA_Defs.product_invariant_def\n apply (simp only: product'.prod.length_L p_p_2 cong: list.map_cong_simp)\n unfolding equiv.defs.N_s_def length_N\n apply (simp cong: list.map_cong_simp)\n unfolding inv_of_def\n apply (simp cong: list.map_cong_simp)\n unfolding init_def\n apply (simp cong: list.map_cong_simp)\n unfolding Equiv_TA_Defs.state_ta_def\n apply (simp cong: list.map_cong_simp)\n unfolding equiv.state_inv_def\n unfolding N_def\n by (force simp: map_concat list_all_concat clock_val_def cong: list.map_cong_simp)\n also have \"(\\ i < p. u \\ conv_cc (I i 0)) \\ (\\ i < p. u \\ conv_cc (inv ! i ! 0))\"\n unfolding I_def using lengths processes_have_trans by fastforce\n finally show ?thesis .\n qed\n\n corollary reachability_checker_hoare':\n \" reachability_checker\n <\\ r. \\(r =\n (\n if (\\u. (\\c\\{1..m}. u c = 0) \\ (\\ i < p. u \\ conv_cc (inv ! i ! 0)))\n then\n if\n (\n \\ L' s' u u'.\n conv N \\\\<^sub>max_steps \\init, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp \\ L' s'\n )\n then REACHABLE\n else UNREACHABLE\n else INIT_INV_ERR\n )\n )\n >\\<^sub>t\" if \"formula = formula.EX \\\"\n using reachability_checker_hoare[OF that] unfolding start_inv_check_correct inv_of_init_unfold .\n\n subsubsection \\Post-processing\\\n\n schematic_goal succs_impl_alt_def:\n \"impl.succs_impl \\ ?impl\"\n unfolding impl.succs_impl_def\n unfolding k_impl_alt_def\n apply (abstract_let\n \"\\ (l, _ :: int list). IArray (map (\\ c. MAX i\\{0.. int list \\ (nat, int) acconstraint list\" inv_fun)\n apply (abstract_let \"trans_fun\" trans_fun)\n unfolding inv_fun_def[abs_def] trans_fun_def[abs_def] trans_s_fun_def trans_i_fun_def trans_i_from_def\n apply (abstract_let \"IArray (map IArray inv)\" inv)\n apply (abstract_let \"IArray (map IArray trans_out_map)\" trans_out_map)\n apply (abstract_let \"IArray (map IArray trans_in_map)\" trans_in_map)\n apply (abstract_let \"IArray (map IArray trans_in_map)\" trans_in_map)\n by (rule Pure.reflexive)\n\n lemma reachability_checker'_alt_def':\n \"reachability_checker' \\\n let\n key = return \\ fst;\n sub = impl.subsumes_impl;\n copy = impl.state_copy_impl;\n start = impl.a\\<^sub>0_impl;\n final = impl.F_impl;\n succs = impl.succs_impl;\n empty = impl.emptiness_check_impl;\n trace = impl.tracei\n in pw_impl key copy trace sub start final succs empty\"\n unfolding reachability_checker'_def by simp\n\n (* XXX Re-inspect these *)\n schematic_goal reachability_checker_alt_def:\n \"reachability_checker \\ ?impl\"\n unfolding reachability_checker_def\n unfolding reachability_checker'_alt_def' impl.succs_impl_def\n unfolding impl.E_op''_impl_def impl.abstr_repair_impl_def impl.abstra_repair_impl_def\n unfolding\n impl.start_inv_check_impl_def impl.unbounded_dbm_impl_def\n impl.unbounded_dbm'_def unbounded_dbm_def\n unfolding k_impl_alt_def\n apply (abstract_let k_i k_i)\n apply (abstract_let \"inv_fun :: nat list \\ int list \\ (nat, int) acconstraint list\" )\n apply (abstract_let \"trans_fun\" trans_fun)\n (*\n unfolding inv_fun_def trans_fun_def trans_s_fun_def trans_i_fun_def trans_i_from_def\n thm inv_fun_def trans_fun_def trans_s_fun_def trans_i_fun_def trans_i_from_def trans_i_map_def\n apply (abstract_let \"IArray (map IArray inv)\" )\n apply (abstract_let \"IArray (map IArray trans_out_map)\" )\n apply (abstract_let \"IArray (map IArray trans_in_map)\" )\n apply (abstract_let \"IArray (map IArray trans_i_map)\" )\n *)\n unfolding impl.init_dbm_impl_def impl.a\\<^sub>0_impl_def\n unfolding impl.F_impl_def\n unfolding final_fun_def[abs_def]\n unfolding impl.subsumes_impl_def\n unfolding impl.emptiness_check_impl_def\n unfolding impl.state_copy_impl_def\n by (rule Pure.reflexive)\n\nend (* End of locale *)\n\nlemmas [code] = UPPAAL_Reachability_Problem_precompiled'.k_impl_def\n\nparagraph \\Some post refinements\\\ncode_thms \"fw_upd'\"\ncode_thms fw_impl'\ncode_thms fw_impl\n\nterm dbm_add\nthm fw_upd'_def[of \"m :: int DBM'\" k i j]\n\nabbreviation plus_int :: \"int \\ int \\ int\" where\n \"plus_int a b \\ a + b\"\n\nfun dbm_add_int :: \"int DBMEntry \\ int DBMEntry \\ int DBMEntry\"\nwhere\n \"dbm_add_int \\ _ = \\\" |\n \"dbm_add_int _ \\ = \\\" |\n \"dbm_add_int (Le a) (Le b) = (Le (plus_int a b))\" |\n \"dbm_add_int (Le a) (Lt b) = (Lt (plus_int a b))\" |\n \"dbm_add_int (Lt a) (Le b) = (Lt (plus_int a b))\" |\n \"dbm_add_int (Lt a) (Lt b) = (Lt (plus_int a b))\"\n\nlemma dbm_add_int:\n \"dbm_add = dbm_add_int\"\n apply (rule ext)+\n subgoal for x y\n by (cases x; cases y) auto\n done\n\ndefinition\n \"fw_upd'_int m k i j =\n Refine_Basic.RETURN\n (op_mtx_set m (i, j)\n (min (op_mtx_get m (i, j)) (dbm_add_int (op_mtx_get m (i, k)) (op_mtx_get m (k, j)))))\"\n\ndefinition\n \"fw_upd_impl_int n \\ \\ai bib bia bi. do {\n xa \\ mtx_get (Suc n) ai (bia, bib);\n xb \\ mtx_get (Suc n) ai (bib, bi);\n x \\ mtx_get (Suc n) ai (bia, bi);\n let e = (dbm_add_int xa xb);\n if e < x then mtx_set (Suc n) ai (bia, bi) e else Heap_Monad.return ai\n }\"\n\nlemma fw_upd_impl_int_eq:\n \"fw_upd_impl_int = fw_upd_impl\"\n unfolding fw_upd_impl_int_def fw_upd_impl_def\n unfolding dbm_add_int add\n unfolding Let_def ..\n\ndefinition\n \"fw_impl_int n \\\n imp_for' 0 (n + 1)\n (\\xb. imp_for' 0 (n + 1)\n (\\xd. imp_for' 0 (n + 1) (\\xf \\'''''. fw_upd_impl_int n \\''''' xb xd xf)))\"\n\nlemma fw_impl'_int:\n \"fw_impl = fw_impl_int\"\n unfolding fw_impl_def fw_impl_int_def\n unfolding fw_upd_impl_int_eq ..\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs'\nbegin\n\n definition \"run_impl program pc s \\ exec program max_steps (pc, [], s, True, []) []\"\n\n lemma runf_impl:\n \"runf = run_impl PF\"\n unfolding runf_def run_impl_def ..\n\n lemma runt_impl:\n \"runt = run_impl PT\"\n unfolding runt_def run_impl_def ..\n\n definition\n \"make_cconstr_impl program pcs =\n List.map_filter\n (\\pc. case program pc of None \\ None | Some (INSTR x) \\ Map.empty x\n | Some (CEXP ac) \\ Some ac)\n pcs\"\n\n lemma make_cconstr_impl:\n \"make_cconstr = make_cconstr_impl PROG\"\n unfolding make_cconstr_def make_cconstr_impl_def ..\n\n definition\n \"check_g_impl programf program pc s \\\n case run_impl programf pc s of None \\ None\n | Some ((x, xa, xb, True, xc), pcs) \\ Some (make_cconstr_impl program pcs)\n | Some ((x, xa, xb, False, xc), pcs) \\ None\"\n\n lemma check_g_impl:\n \"check_g = check_g_impl PT PROG'\"\n unfolding check_g_impl_def check_g_def runt_impl PROG'_PROG make_cconstr_impl ..\n\n (*\n definition\n \"trans_i_from \\ \\ (L, s) i.\n List.map_filter (\\ (g, a, m, l').\n case check_g g s of\n Some cc \\\n case runf m s of\n Some ((_, _, s', _, r), _) \\\n if check_pred (L[i := l']) s'\n then Some (cc, a, r, (L[i := l'], s'))\n else None\n | _ \\ None\n | _ \\ None)\n ((IArray (map IArray trans_i_map)) !! i !! (L ! i))\"\n\n definition\n \"trans_i_fun L \\ concat (map (trans_i_from L) [0..\n case run_impl program m1 s of\n Some ((_, _, _, _, r1), _) \\ r1\n | None \\ []\n \"\n\n lemma make_reset_impl:\n \"make_reset = make_reset_impl PF\"\n unfolding make_reset_def make_reset_impl_def runf_impl ..\n\n definition\n \"check_pred_impl program bnds L s \\\n list_all\n (\\q. case run_impl program (pred ! q ! (L ! q)) s of None \\ False\n | Some ((x, xa, xb, f, xc), xd) \\\n f \\ (\\i s ! i < snd (bnds !! i)))\n [0.. \\ (L, s) OUT. concat o\n map (\\ (i, g1, a, m1, l1). List.map_filter\n (\\ (j, g2, a, m2, l2).\n if i = j then None else\n case (check_g_impl pt porig g1 s, check_g_impl pt porig g2 s) of\n (Some cc1, Some cc2) \\\n (case run_impl pf m2 s of\n Some ((_, _, s1, _, r2), _) \\\n (case run_impl pf m1 s1 of\n Some (( _, _, s', _, _), _) \\\n if check_pred_impl pf bnds (L[i := l1, j := l2]) s'\n then Some (cc1 @ cc2, a, make_reset_impl pf m1 s @ r2, (L[i := l1, j := l2], s'))\n else None\n | _ \\ None)\n | _ \\ None)\n | _ \\ None\n )\n OUT)\"\n\n lemma pairs_by_action_impl:\n \"pairs_by_action = pairs_by_action_impl PF PT PROG' (IArray bounds)\"\n unfolding pairs_by_action_def pairs_by_action_impl_def\n unfolding check_g_impl make_reset_impl check_pred_impl runf_impl ..\n\n definition\n \"all_actions_by_state_impl upt_p empty_ran i L \\\n fold (\\ia. actions_by_state ia (i !! ia !! (L ! ia))) upt_p empty_ran\"\n\n lemma all_actions_by_state_impl:\n \"all_actions_by_state = all_actions_by_state_impl [0..\n \\(L, s) i.\n List.map_filter\n (\\(g, a, m, l').\n case check_g_impl programt program g s of None \\ None\n | Some cc \\\n (case run_impl programf m s of None \\ None\n | Some ((xx, xa, s', xb, r), xc) \\\n if check_pred_impl programf (IArray bounds) (L[i := l']) s'\n then Some (cc, a, r, L[i := l'], s') else None))\n (trans_i_array !! i !! (L ! i))\"\n\n lemma trans_i_from_impl:\n \"trans_i_from = trans_i_from_impl PF PT PROG' (IArray bounds) (IArray (map IArray trans_i_map))\"\n unfolding trans_i_from_def trans_i_from_impl_def\n unfolding check_g_impl runf_impl check_pred_impl ..\n\nend\n\ncontext UPPAAL_Reachability_Problem_precompiled'\nbegin\n\n lemma PF_alt_def:\n \"PF = (\\ pc. if pc < length prog then (IArray (map (map_option stripf) prog)) !! pc else None)\"\n unfolding stripfp_def PROG'_def by auto\n\n lemma PT_alt_def:\n \"PT = (\\ pc. if pc < length prog then (IArray (map (map_option stript) prog)) !! pc else None)\"\n unfolding striptp_def PROG'_def by auto\n\n thm inv_fun_def trans_fun_def trans_s_fun_def trans_i_fun_def trans_i_from_def trans_i_map_def\n\n thm check_g_impl_def runf_impl check_pred_impl_def check_pred_def\n\n schematic_goal reachability_checker_alt_def_refined:\n \"reachability_checker \\ ?impl\"\n unfolding reachability_checker_alt_def\n unfolding fw_impl'_int\n unfolding inv_fun_def trans_fun_def trans_s_fun_def trans_i_fun_def\n unfolding trans_i_from_impl\n unfolding runf_impl runt_impl check_g_impl pairs_by_action_impl check_pred_impl\n apply (abstract_let \"IArray (map IArray inv)\" inv)\n apply (abstract_let \"IArray (map IArray trans_out_map)\" trans_out_map)\n apply (abstract_let \"IArray (map IArray trans_in_map)\" trans_in_map)\n apply (abstract_let \"IArray (map IArray trans_i_map)\" trans_i_map)\n apply (abstract_let \"IArray bounds\" bounds)\n apply (abstract_let PF PF)\n apply (abstract_let PT PT)\n unfolding PF_alt_def PT_alt_def\n apply (abstract_let PROG' PROG')\n unfolding PROG'_def\n apply (abstract_let \"length prog\" len_prof)\n apply (abstract_let \"IArray (map (map_option stripf) prog)\" prog_f)\n apply (abstract_let \"IArray (map (map_option stript) prog)\" prog_t)\n apply (abstract_let \"IArray prog\" prog)\n unfolding all_actions_by_state_impl\n apply (abstract_let \"[0..0\n by (standard; rule init_pred actions_bounded)\n\n schematic_goal reachability_checker_alt_def:\n \"reachability_checker \\ ?impl\"\n unfolding reachability_checker_alt_def .\n\n corollary reachability_checker_hoare:\n \" reachability_checker\n <\\ r. \\(r \\ (\\ L' s' u u'.\n (map conv_A (fst N), snd N) \\ \\init, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ (\\ i < p. L' ! i \\ set (final ! i)))\n )\n >\\<^sub>t\"\n by (rule reachability_checker_hoare)\n\nend\n*)\n\nsubsection \\Check preconditions\\\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n (*\n definition\n \"collect_cexp = {ac. Some (CEXP ac) \\ set prog}\"\n\n lemma collect_cexp_alt_def:\n \"collect_cexp =\n set (List.map_filter\n (\\ x. case x of Some (CEXP ac) \\ Some ac | _ \\ None)\n prog)\"\n unfolding collect_cexp_def set_map_filter by (auto split: option.split_asm instrc.split_asm)\n\n lemma clkp_set'_alt_def:\n \"clkp_set' =\n \\ (collect_clock_pairs ` set (concat inv)) \\ (constraint_pair ` collect_cexp)\"\n unfolding clkp_set'_def collect_cexp_def by auto\n\n definition\n \"collect_store = {(c, x). Some (INSTR (STOREC c x)) \\ set prog}\"\n\n lemma collect_store_alt_def:\n \"collect_store =\n set (List.map_filter\n (\\ x. case x of Some (INSTR (STOREC c x)) \\ Some (c, x) | _ \\ None)\n prog)\"\n unfolding collect_store_def set_map_filter\n by (auto split: option.split_asm instrc.split_asm instr.split_asm)\n\n lemma clk_set'_alt_def: \"clk_set' = (fst ` clkp_set' \\ fst ` collect_store)\"\n unfolding clk_set'_def collect_store_def by auto\n\n *)\n\n abbreviation\n \"check_nat_subs \\ \\ (_, d) \\ clkp_set'. d \\ 0\"\n\n lemma check_nat_subs:\n \"check_nat_subs \\ snd ` clkp_set' \\ \\\"\n unfolding Nats_def apply safe\n subgoal for _ _ b using rangeI[of int \"nat b\"] by auto\n by auto\n\n definition\n \"check_resets \\ \\ x c. Some (INSTR (STOREC c x)) \\ set prog \\ x = 0\"\n\n lemma check_resets_alt_def:\n \"check_resets =\n (\\ (c, x) \\ collect_store. x = 0)\"\n unfolding check_resets_def collect_store_def by auto\n\n definition\n \"check_pre \\\n length inv = p \\ length trans = p \\ length pred = p\n \\ (\\ i < p. length (pred ! i) = length (trans ! i) \\ length (inv ! i) = length (trans ! i))\n \\ (\\ T \\ set trans. \\ xs \\ set T. \\ (_, _, _, l) \\ set xs. l < length T)\n \\ p > 0 \\ m > 0\n \\ (\\ i < p. trans ! i \\ []) \\ (\\ q < p. trans ! q ! 0 \\ [])\n \\ check_nat_subs \\ clk_set' = {1..m}\n \\ check_resets\n \"\n\n lemma finite_clkp_set'[intro, simp]:\n \"finite clkp_set'\"\n unfolding clkp_set'_def\n using [[simproc add: finite_Collect]]\n by (auto intro!: finite_vimageI finite_imageI simp: inj_on_def)\n\n lemma check_pre:\n \"UPPAAL_Reachability_Problem_precompiled p m inv pred trans prog \\ check_pre\"\n unfolding\n UPPAAL_Reachability_Problem_precompiled_def\n check_pre_def check_nat_subs check_resets_def\n by auto\n\nend (* End of definitions context for precompiled reachachability problem*)\n\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\ncontext\n fixes k :: \"nat list list list\"\nbegin\n\n definition\n \"check_ceiling \\\n UPPAAL_Reachability_Problem_precompiled_ceiling_axioms p m max_steps inv trans prog k\"\n\n lemma check_axioms:\n \"UPPAAL_Reachability_Problem_precompiled_ceiling p m max_steps inv pred trans prog k\n \\ check_pre \\ check_ceiling\"\n unfolding UPPAAL_Reachability_Problem_precompiled_ceiling_def check_pre check_ceiling_def\n by auto\n\nend\n\nend\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs.collect_cexp_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs.collect_store_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs.check_resets_alt_def\n\nexport_code UPPAAL_Reachability_Problem_precompiled_defs.collect_cexp in SML module_name Test\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs.check_pre\n UPPAAL_Reachability_Problem_precompiled_defs.check_axioms\n UPPAAL_Reachability_Problem_precompiled_defs.clkp_set'_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs.clk_set'_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs.check_pre_def\n UPPAAL_Reachability_Problem_precompiled_defs.check_ceiling_def\n UPPAAL_Reachability_Problem_precompiled_defs.init_def\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs'.trans_out_map_def\n UPPAAL_Reachability_Problem_precompiled_defs'.trans_in_map_def\n UPPAAL_Reachability_Problem_precompiled_defs'.trans_i_map_def\n UPPAAL_Reachability_Problem_precompiled_defs'.all_actions_by_state_def\n UPPAAL_Reachability_Problem_precompiled_defs'.actions_by_state_def\n UPPAAL_Reachability_Problem_precompiled_defs'.pairs_by_action_def\n\ncode_pred clock_val_a .\n\nconcrete_definition reachability_checker_impl\n uses UPPAAL_Reachability_Problem_precompiled'.reachability_checker_alt_def_refined\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs'.make_cconstr_def\n UPPAAL_Reachability_Problem_precompiled_defs'.make_reset_def\n UPPAAL_Reachability_Problem_precompiled_defs'.check_pred_def\n UPPAAL_Reachability_Problem_precompiled_defs'.check_g_def\n UPPAAL_Reachability_Problem_precompiled_defs'.runf_def\n UPPAAL_Reachability_Problem_precompiled_defs'.runt_def\n UPPAAL_Reachability_Problem_precompiled_defs.PROG_def\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs.P_def\n\nlemma exec_code[code]:\n \"exec prog n (pc, st, m, f, rs) pcs =\n (case n of 0 \\ None\n | Suc n \\\n (case prog pc of None \\ None\n | Some instr \\\n if instr = HALT\n then Some ((pc, st, m, f, rs), pc # pcs)\n else\n (case UPPAAL_Asm.step instr (pc, st, m, f, rs) of\n None \\ None | Some s \\ exec prog n s (pc # pcs))))\"\n by (cases n) auto\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled'_axioms_def\n UPPAAL_Reachability_Problem_precompiled'_def\n pred_act_def\n\ndefinition\n \"init_pred_check \\ \\ p prog max_steps pred s\\<^sub>0.\n (\\ q < p.\n case (exec\n (stripfp (UPPAAL_Reachability_Problem_precompiled_defs.PROG prog))\n max_steps\n ((pred ! q ! (UPPAAL_Reachability_Problem_precompiled_defs.init p ! q)), [], s\\<^sub>0, True, [])\n [])\n of Some ((pc, st, s', True, rs), pcs) \\ True | _ \\ False)\n \"\n\ndefinition\n \"time_indep_check1 \\ \\ pred prog max_steps.\n (\\x\\set pred. \\pc\\set x. time_indep_check prog pc max_steps)\n \"\n\ndefinition\n \"time_indep_check2 \\ \\ trans prog max_steps.\n (\\T\\set trans. \\xs\\set T. \\(_, _, pc_u, _)\\set xs. time_indep_check prog pc_u max_steps)\n \"\n\ndefinition\n \"conjunction_check2 \\ \\ trans prog max_steps.\n (\\T\\set trans. \\xs\\set T. \\(pc_g, _, _, _)\\set xs. conjunction_check prog pc_g max_steps)\n \"\n\nlemma start_pred[code]:\n \"UPPAAL_Reachability_Problem_precompiled_start_state_axioms = (\\ p max_steps trans prog bounds pred s\\<^sub>0.\n init_pred_check p prog max_steps pred s\\<^sub>0\n \\ bounded bounds s\\<^sub>0\n \\ time_indep_check1 pred prog max_steps\n \\ time_indep_check2 trans prog max_steps\n \\ conjunction_check2 trans prog max_steps\n )\"\n unfolding UPPAAL_Reachability_Problem_precompiled_start_state_axioms_def\n unfolding init_pred_check_def bounded_def time_indep_check1_def time_indep_check2_def\n conjunction_check2_def\n apply (rule ext)+\n apply safe\n apply (fastforce split: option.split_asm bool.split_asm)\n subgoal premises prems\n using prems(1,7) by (fastforce split: option.split_asm bool.split_asm)\n done\n\nexport_code UPPAAL_Reachability_Problem_precompiled_start_state_axioms\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n lemma collect_store''_alt_def:\n \"collect_store'' pc \\\n case find_resets_start prog pc of\n None \\ {} |\n Some pc' \\\n \\ (\n (\\ cmd. case cmd of Some (INSTR (STOREC c x)) \\ {(c, x)} | _ \\ {}) `\n ((!) prog) ` {pc .. pc'}\n )\"\n unfolding collect_store''_def\n apply (rule eq_reflection)\n apply (auto simp del: find_resets_start.simps split: option.split_asm)\n by (auto intro: sym intro!: bexI split: option.split instrc.split_asm instr.split_asm\n simp del: find_resets_start.simps\n )\n\n lemma collect_cexp'_alt_def:\n \"collect_cexp' pc \\\n \\ ((\\ cmd. case cmd of Some (CEXP ac) \\ {ac} | _ \\ {}) `\n ((!) prog) ` steps_approx max_steps prog pc\n )\"\n unfolding collect_cexp'_def\n by (auto 4 3 intro!: eq_reflection bexI intro: sym split: option.splits instrc.split_asm)\n\nend\n\nlemmas [code] =\n UPPAAL_Reachability_Problem_precompiled_defs'.PROG'_def\n UPPAAL_Reachability_Problem_precompiled_start_state_def\n UPPAAL_Reachability_Problem_precompiled_ceiling_axioms_def\n UPPAAL_Reachability_Problem_precompiled_defs.N_def\n UPPAAL_Reachability_Problem_precompiled_defs.collect_store''_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs.clkp_set''_def\n UPPAAL_Reachability_Problem_precompiled_defs.collect_cexp'_alt_def\n UPPAAL_Reachability_Problem_precompiled_defs'.pairs_by_action_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.make_reset_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.check_g_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.run_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.make_cconstr_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.check_pred_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.all_actions_by_state_impl_def\n UPPAAL_Reachability_Problem_precompiled_defs'.trans_i_from_impl_def\n\nlemmas [code] =\n Equiv_TA_Defs.state_ta_def Prod_TA_Defs.N_s_def Product_TA_Defs.states_def\n\nexport_code UPPAAL_Reachability_Problem_precompiled'_axioms in SML module_name Test\n\nexport_code UPPAAL_Reachability_Problem_precompiled' in SML module_name Test\n\n(* export_code reachability_checker_impl in SML_imp module_name TA *)\n\nhide_const check_and_verify\n\ndefinition [code]:\n \"check_and_verify p m k max_steps I T prog final bounds P s\\<^sub>0 na \\\n if UPPAAL_Reachability_Problem_precompiled' p m max_steps I T prog bounds P s\\<^sub>0 na k\n then\n reachability_checker_impl p m max_steps I T prog bounds P s\\<^sub>0 na k final\n \\ (\\ x. return (Some x))\n else return None\"\n\nabbreviation \"N \\ UPPAAL_Reachability_Problem_precompiled_defs.N\"\n\ntheorem reachability_check:\n \"(uncurry0 (check_and_verify p m k max_steps I T prog (formula.EX formula) bounds P s\\<^sub>0 na),\n uncurry0 (\n Refine_Basic.RETURN (\n if UPPAAL_Reachability_Problem_precompiled' p m max_steps I T prog bounds P s\\<^sub>0 na k\n then Some (\n if (\\u. (\\c\\{1..m}. u c = 0) \\ (\\ i < p. u \\ conv_cc (I ! i ! 0)))\n then\n if\n (\n \\ L' s' u u'.\n conv (N p I P T prog bounds) \\\\<^sub>max_steps\n \\repeat 0 p, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp formula L' s'\n )\n then REACHABLE\n else UNREACHABLE\n else INIT_INV_ERR\n )\n else None\n )\n )\n )\n \\ unit_assn\\<^sup>k \\\\<^sub>a id_assn\"\nproof -\n define A where \"A \\ conv (N p I P T prog bounds)\"\n define start_inv where\n \"start_inv \\ (\\u. (\\c\\{1..m}. u c = 0) \\ (\\ i < p. u \\ conv_cc (I ! i ! 0)))\"\n define reach where\n \"reach \\\n \\ L' s' u u'.\n A \\\\<^sub>max_steps\n \\repeat 0 p, s\\<^sub>0, u\\ \\* \\L', s', u'\\\n \\ (\\ c \\ {1..m}. u c = 0) \\ check_bexp formula L' s'\"\n thm UPPAAL_Reachability_Problem_precompiled'.reachability_checker_hoare'\n thm HOL.refl[of \"formula.EX formula\"]\n note [sep_heap_rules] =\n UPPAAL_Reachability_Problem_precompiled'.reachability_checker_hoare'\n [ OF _ HOL.refl[of \"formula.EX formula\"],\n unfolded UPPAAL_Reachability_Problem_precompiled_defs.init_def,\n of p m max_steps I T prog bounds P s\\<^sub>0 na k,\n unfolded A_def[symmetric] start_inv_def[symmetric] reach_def[symmetric]\n ]\n show ?thesis\n unfolding A_def[symmetric] start_inv_def[symmetric] reach_def[symmetric]\n unfolding check_and_verify_def\n by sepref_to_hoare (sep_auto simp: reachability_checker_impl.refine[symmetric])\nqed\n\nexport_code open\n check_and_verify init_pred_check time_indep_check1 time_indep_check1 conjunction_check2\n checking SML_imp\n\nend (* End of theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Uppaal_Networks/UPPAAL_State_Networks_Impl_Refine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.359364131437828, "lm_q1q2_score": 0.1852953031658476}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__17_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__17_on_rules imports n_german_lemma_on_inv__17\nbegin\nsection{*All lemmas on causal relation between inv__17*}\nlemma lemma_inv__17_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__17 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__17) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__17_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.34864514210180597, "lm_q1q2_score": 0.18520356746570457}} {"text": "theory RCU_model\nimports Main PSem OpSem_Proof_Rules OpSem_definite\nbegin \n\n\n\ndatatype PC = I1 | I2 | I3 | I4 | I5 | I6 | I7 | I8 | I9 | I10 | I11 | I12 | I13 | I14 | cas_res | finished\n | R1 | R2 | R3 | R4 | R5 \n | S1 | S2 | S3 | S4 | S5 | S6 | S7 \n\n\n\nconsts rcu_0 ::address (*first location of rcu array*)\nconsts F::nat\nconsts T_max::nat (*max_thread ID + 1*)\nconsts C :: nat (*just referred to by its location in A(1) = (C,pointer) where C = nat*)\nconsts casloc :: nat\ndefinition \"set_T \\ {n . n\\0 \\ n {n . n\\rcu_0 \\ n < rcu_0+T_max}\"\ndefinition \"something \\ F \\ rcu_addrs \\ F \\ C \\ F \\ casloc\"\n\ndefinition \"con_assms_shared \\ T_max >0 \\ (\\t. t C \\ rcu_0+t)\"\nlemma showsss: \"con_assms_shared \\ C \\ rcu_0\" \n apply(simp add:con_assms_shared_def)\n by (metis Nat.add_0_right)\n\n\n\n\nlemma test:\n assumes \"F = i\"\n and \"something\"\n shows \"C \\ i\"\n using assms \n by(simp add:something_def) \n\n\n(*\ndefinition\n \"wfs_2 \\ \\\n wfs \\ \\ (\\ x. lastWr \\ x \\ covered \\)\"*)\n\n\n\n\n\n(*Recorded variables partial function*)\nrecord mstate =\n pc :: \"T \\ PC\"\n r :: \"T \\ nat \\ nat\" (*local copy of rcu*)\n n_dec :: \"T \\ bool\" (*now modelled as local pointer allocation - True/False*)\n s_dec :: \"T \\ bool\" (*now modelled as local pointer allocation - True/False*)\n v :: \"T \\ nat option\" (*now modelled as local value - so M(&v)*)\n n :: \"T \\ nat option\" (*now modelled as local value - so M(&n)*)\n s :: \"T \\ nat option\" (*now modelled as local value - so M(&s)*)\n det :: \"T \\ L list\" (*detached list*)\n CTRsync\\<^sub>1 :: \"T \\ nat\"\n CTRsync\\<^sub>2 :: \"T \\ nat\"\n res :: \"T \\ nat\" (*return v*)\n reg :: \"T \\ nat\" (*says whether a thread is locally in RCU or not*)\n nondet_val :: \"T \\ bool\" (* result of function nondet() *)\n CAS_succ :: \"T \\ bool\" (*CAS succ, aux*)\n repeat :: \"T \\ bool\" (*says whether the CAS has failed*)\n\n own\\<^sub>R :: \"nat \\ nat set\" (* own\\<^sub>R ms i = { ... 2, 3, 6, ...}*)\n own\\<^sub>W :: \"nat \\ nat option\" (* own\\<^sub>W ms i = Some 1 or own\\<^sub>W ms i = None*)\n\n\n(*for pointers we will have A(0) = (x58,pointer) which is equivalent to A(order) = (address,pointer)\n for variables --//--- A(1) = (x78,variable) --//-- --//-- A(order) = (address,variable)*)\n \n\n(* start state must take out rcu_addrs from free_addrs *)\n\n(*---------------- ownership transfer functions ---------------------*)\n\ndefinition take_read_ownership :: \"T \\ nat \\ mstate \\ mstate\" (\"takesRown[_,_]\" [200,200])\n where\n \"take_read_ownership t loc ms \\ ms \\ own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc \\ {t}) \\\"\n\ndefinition giveup_readandwrite_ownership :: \"T \\ nat \\ mstate \\ mstate\" (\"givesupRown[_,_]\" [200,200])\n where\n \"giveup_readandwrite_ownership t loc ms \\ ms \\ own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc - {t}) \\\"\n\ndefinition take_write_ownership :: \"T \\ nat \\ mstate \\ mstate\" (\"takesWown[_,_]\" [200,200])\n where\n \"take_write_ownership t loc ms \\ ms \\ own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc \\ {t}),\n own\\<^sub>W := (own\\<^sub>W ms) (loc:=Some t)\\\"\n\n\n\n\n(*---------------- basic functional definitons ----------------------*)\n\n(*int v*)\ndefinition v_allocation :: \"mstate \\ T \\ mstate \\ bool\" (\"_ int[v\\<^sub>_] _\" [200,200]) \\\\int v, note v is a local variable\\\n where \\\\ and doesn't need allocation\\\n \"v_allocation ms t ms' \\ ms' =ms \\v := (v ms) (t := None),\n pc := (pc ms) (t := I2)\\\"\n(*int *n*)\ndefinition int_star_n :: \"mstate \\ T \\ mstate \\ bool\" (\"_ int[*n\\<^sub>_] _\" [200,200,200]) \\\\int *n\\\n where\n \"int_star_n ms t ms' \\ ms' = ms \\n_dec := (n_dec ms) (t := True),\n n := (n ms) (t := None),\n pc := (pc ms) (t := I3)\\\"\n(*int *s*)\ndefinition int_star_s :: \"mstate \\ T \\ mstate \\ bool\" (\"_ int[*s\\<^sub>_] _\" [200,200,200]) \\\\int *s\\\n where\n \"int_star_s ms t ms' \\ ms' = ms \\s_dec := (s_dec ms) (t := True),\n s := (s ms) (t := None),\n pc := (pc ms) (t := I4) \\\"\n\n\n\n\n(******* n = new int **********)\ndefinition new_int :: \"mstate \\ posem \\ T \\ mstate \\ posem \\ bool\" ( \"_ _ n:=newint _ _ _\" [200,200,200,200,200])\n where\n \"new_int ms ps t ms' ps' \\ (\\loc prov. (allocate_object ps loc prov ps' variable \n \\ ms' = ms \\n := (n ms) (t := Some loc),\n own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc \\ {t}),\n own\\<^sub>W := (own\\<^sub>W ms) (loc:=Some t),\n pc := (pc ms) (t := I5) \\))\"\n\nlemma switch:\n \"prov\\ dom(A ps) \\ A ps prov = None\"\n by auto\n\nlemma switch2:\n \"n ms t = None \\ \\prov loc. (allocate_object ps loc prov ps' variable \n \\ ms' = ms \\n := (n ms) (t := Some loc),\n own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc \\ {t}),\n own\\<^sub>W := (own\\<^sub>W ms) (loc:=Some t),\n pc := (pc ms) (t := I5) \\) \n \\ n ms' t\\ None\"\n apply(simp add:new_int_def) apply clarify\n by simp\n\nlemma switch3:\n \"n ms t = None \\ \\prov loc. (allocate_object ps loc prov ps' variable \n \\ ms' = ms \\n := (n ms) (t := Some loc),\n own\\<^sub>R := (own\\<^sub>R ms) (loc:=own\\<^sub>R ms loc \\ {t}),\n own\\<^sub>W := (own\\<^sub>W ms) (loc:=Some t),\n pc := (pc ms) (t := I5) \\) \n \\ own\\<^sub>W ms' (the(n ms' t)) =Some t\"\n apply(simp add:new_int_def) apply clarify \n by clarsimp\n\n\n\n\n\n\n\n\n\n(******* s = C **********)\ndefinition get_C_val :: \"mstate \\ surrey_state \\ T \\ mstate \\ surrey_state \\ bool\" ( \"_ _ s:=\\<^sup>FC _ _ _\" [200,200,200,200,200])\n where\n \"get_C_val ms \\ t ms' \\' \\ (\\ w ts'.\n w \\ visible_writes \\ t C \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\\n \\' = fst(FAAZ t w \\ ts')\n \\ ms' = ms \\ s := (s ms) (t := Some (snd(FAAZ t w \\ ts'))),\n pc := (pc ms) (t := I9),\n own\\<^sub>R := (own\\<^sub>R ms) ((snd(FAAZ t w \\ ts')):=own\\<^sub>R ms (snd(FAAZ t w \\ ts')) \\ {t})\\)\" \n\n\n\n\n\n\n\n(******* v=*s **********)\ndefinition get_s :: \"mstate \\ surrey_state \\ T \\ mstate \\ surrey_state \\ bool\" ( \"_ _ v:=*s _ _ _\" [200,200,200,200,200])\n where\n \"get_s ms \\ t ms' \\' \\ (\\z. \\ [z \\ the (s ms t)]\\<^sub>t \\'\n \\ ms' = ms \\ v := (v ms) (t := Some z),\n pc := (pc ms) (t := I10)\\)\" \n\n\n(******* *n = v+1 **********) \ndefinition writeto_star_n :: \"mstate \\ surrey_state \\ T \\ mstate \\ surrey_state \\ bool\" ( \"_ _ *n:=newv _ _ _\" [200,200,200,200,200])\n where\n \"writeto_star_n ms \\ t ms' \\' \\ \\ [the(n ms t) := (the (v ms t) + 1)]\\<^sub>t \\'\n \\ ms' = ms \\pc := (pc ms) (t := I11)\\\" \n\n\n\n\n\n\n(********* free(pop(detached)) ******************)\ndefinition pop_address :: \"mstate \\ posem \\ T \\ mstate \\ posem \\ bool\" (\"_ _ free[pop[detached[_]]] _ _\" [200,200,200,200,200]) \\\\pop(detached[tid-1])\\\n where\n \"pop_address ms ps t ms' ps' \\ (\\i. (A ps i = Some (hd((det ms) t), variable) \\\n kill ps i ps')) \\ \n ms' = ms\\ det := (det ms) (t:= tl ((det ms) t)),\n own\\<^sub>R := (own\\<^sub>R ms) ((hd((det ms) t)):=(own\\<^sub>R ms (hd((det ms) t))) - {t}),\n own\\<^sub>W := (own\\<^sub>W ms) ((hd((det ms) t)):=None),\n pc := (pc ms) (t := R4)\\ \"\n\n\n\n(******* r[i] = rcu[i] **********)\ndefinition load_rcu_to_r :: \"mstate \\ posem \\ surrey_state \\ nat \\ T \\ mstate \\ posem \\ surrey_state \\ bool\" ( \"_ _ _ r[i]:=rcu[_] _ _ _ _\" [200,200,200,200,200])\n where\n \"load_rcu_to_r ms ps \\ i t ms' ps' \\' \\ ps = ps' \\ (\\x y. (A ps y = Some (rcu_0, pointer)) \n \\ \\ [x \\(rcu_0 + i)]\\<^sub>t \\'\n \\ ms' = ms \\ r := (r ms) (t := ((r ms) t) (i := x)),\n pc := (pc ms) (t := S2),\n CTRsync\\<^sub>1 := (CTRsync\\<^sub>1 ms) (t:=(CTRsync\\<^sub>1 ms t)+1) \\)\"\n\ndefinition enter_rcu :: \"posem \\ surrey_state \\ T \\ posem \\ surrey_state \\ bool\" ( \"_ _ rcuenter[] _ _ _\" [200,200,200,200,200])\n where\n \"enter_rcu ps \\ t ps' \\' \\ ps = ps' \\ (\\x. (A ps x = Some (rcu_0, pointer))\n \\ (\\ [ (rcu_0+t) := 1 ]\\<^sub>t \\'))\" \n\ndefinition exit_rcu :: \"posem \\ surrey_state \\ T \\ posem \\ surrey_state \\ bool\" ( \"_ _ rcuexit[] _ _ _\" [200,200,200,200,200])\n where\n \"exit_rcu ps \\ t ps' \\' \\ ps = ps' \\ (\\x. (A ps x = Some (rcu_0, pointer))\n \\ (\\ [ (rcu_0+t) := 0 ]\\<^sub>t \\'))\" \n\ndefinition setup_r :: \"mstate \\ T \\ mstate \\ bool\" (\"_ r[N]:={0} _ _\" [200]) \\\\r[N] = {0}\\\n where\n \"setup_r ms t ms' \\ ms' = ms \\ r := (r ms) (t := \\ i . 0),\n pc := (pc ms) (t := S2)\\\"\n\n\n\n\n\n\n\n\n\ndefinition insert_address :: \" mstate \\ T \\ nat \\ mstate \\ bool\" (\"_ insert[detached[_],_] _\" [200,200,200,200]) \\\\insert(_, s)\\\n where\n \"insert_address ms t loc ms' \\ ms' = ms\\ det := (det ms) (t:= (((det ms) t) @ [loc])),\n pc := (pc ms) (t := R2), \n s_dec := (s_dec ms) (t := False),\n s := (s ms) (t := None)\\\"\n\n\ndefinition nondet :: \"mstate \\ T \\ bool \\ mstate \\ bool\" (\"_ nondet[_,_] _\" [200,200,200,200]) \\\\nondet()\\\n where\n \"nondet ms t b ms' \\ ms' = ms \\ nondet_val := (nondet_val ms) (t:= b),\n pc := (pc ms) (t := R3)\\\"\n\n\ndefinition rcu_temp_copy :: \"mstate \\ surrey_state \\ nat \\ T \\ mstate \\ surrey_state \\ bool\" ( \"_ _ load(_)\\<^sub>_ _ _\" [200,200,200,200,200,200])\n where\n \"rcu_temp_copy ms \\ i t ms' \\'\\ \\ v. ((\\ [ v \\ (rcu_0 + i)]\\<^sub>t \\') \\\\read rcu[i]\\\n \\ (ms' = ms\\reg := (reg ms) (t := v),\n pc := (pc ms) (t := S7)\\)) \"\n\n\ndefinition cas_step_rcu :: \"mstate \\ surrey_state \\T \\ L \\ V \\ V \\ mstate \\ surrey_state \\ bool\"\n where\n \"cas_step_rcu ms \\ t l cv nv ms' \\'\\ \\ w ts'. w \\ visible_writes \\ t l \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\ (let (a, b) = CAS t w cv nv \\ ts' in \n\n \\\\CAS(&C,s,n)\\\n \n \\' = a \n \\ \n(b \\(ms' = ms\\CAS_succ := (CAS_succ ms) (t := b),\n n_dec := (n_dec ms) (t := False), \\\\acquire wr_cap on location\\\n own\\<^sub>W := (own\\<^sub>W ms) (nv:=None , cv:= Some t), \\\\let go of wr_cap on location\\\n pc := (pc ms) (t := cas_res)\\))\n \\ \n(\\ b \\(ms' = ms\\CAS_succ := (CAS_succ ms) (t := b),\n pc := (pc ms) (t := cas_res)\\)))\" \n\n\n\n\n\n\ndefinition inc_ctr1 :: \"T \\ mstate \\ mstate\" ( \"CTRsync\\<^sub>1[_]++\" [200])\n where\n \"inc_ctr1 t ms \\ ms \\ CTRsync\\<^sub>1 := (CTRsync\\<^sub>1 ms) (t:=(CTRsync\\<^sub>1 ms t)+1) \\ \"\n\ndefinition inc_ctr2 :: \"T \\ mstate \\ mstate\" ( \"CTRsync\\<^sub>2[_]++\" [200])\n where\n \"inc_ctr2 t ms \\ ms \\ CTRsync\\<^sub>2 := (CTRsync\\<^sub>2 ms) (t:=(CTRsync\\<^sub>2 ms t)+1) \\ \"\n\ndefinition regreset :: \"T \\ mstate \\ mstate\" ( \"regreset[_]\" [200])\n where\n \"regreset t ms \\ ms \\ reg := (reg ms) (t:=0) \\\"\n\ndefinition update_ctr1 :: \"T \\ nat \\ mstate \\ mstate\" ( \"CTRsync\\<^sub>1[_]:=_\" [200,200])\n where\n \"update_ctr1 t ctr_val ms \\ ms \\ CTRsync\\<^sub>1 := (CTRsync\\<^sub>1 ms) (t:=ctr_val) \\ \"\n\ndefinition update_ctr2 :: \"T \\ nat \\ mstate \\ mstate\" ( \"CTRsync\\<^sub>2[_]:=_\" [200,200])\n where\n \"update_ctr2 t ctr_val ms \\ ms \\ CTRsync\\<^sub>2 := (CTRsync\\<^sub>2 ms) (t:=ctr_val) \\ \"\n\ndefinition update_pc :: \"T \\ PC \\ mstate \\ mstate\" ( \"pc[_]:=_\" [200,200])\n where\n \"update_pc t pc_val ms \\ ms \\ pc := (pc ms) (t:=pc_val) \\ \"\n\ndefinition repetition :: \"T \\ bool \\ mstate \\ mstate\" ( \"repeat[_]:=_\" [200,200])\n where\n \"repetition t b ms \\ ms \\ repeat := (repeat ms) (t:=b) \\ \"\n\ndefinition nallocdef :: \"T \\ bool \\ mstate \\ mstate\" ( \"n[_]:=_\" [200,200])\n where\n \"nallocdef t b ms \\ ms \\ n_dec := (n_dec ms) (t:=b) \\ \"\n\ndefinition sallocdef :: \"T \\ bool \\ mstate \\ mstate\" ( \"s[_]:=_\" [200,200])\n where\n \"sallocdef t b ms \\ ms \\ s_dec := (s_dec ms) (t:=b) \\ \"\n\ndefinition SC_fence :: \"surrey_state \\ T \\ surrey_state \\ bool \" (\"_ Fence _ _\" [200,200,200])\n where\n \"SC_fence \\ t \\' \\ \n \\ w ts'. w \\ visible_writes \\ t casloc \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\\n \\' = fst(CAS t w (value \\ w) (value \\ w) \\ ts')\"\n\n\n\n\n\nlemmas abbr = v_allocation_def int_star_n_def int_star_s_def\n new_int_def get_s_def writeto_star_n_def\n pop_address_def\n load_rcu_to_r_def \n enter_rcu_def exit_rcu_def\n setup_r_def\n insert_address_def nondet_def\n rcu_temp_copy_def\n inc_ctr1_def inc_ctr2_def update_ctr1_def update_ctr2_def update_pc_def\n repetition_def SC_fence_def\n sallocdef_def nallocdef_def\n giveup_readandwrite_ownership_def regreset_def\n\n\n\n(*========================== Thread behaviour =================================*)\n\nsection \\Program step\\\ndefinition step :: \"mstate \\ posem \\ surrey_state \\ PC \\ T \\ mstate \\ posem \\ surrey_state \\ bool \" where\n\"step ms ps \\ pcr t ms' ps' \\' \\ \ncase pcr of \n R1 \\ (ms insert[detached[t],the (s ms t)] ms') \\ ps = ps' \\ \\ =\\' \n| R2 \\ (\\b. (b\\{True,False} \\ (ms nondet[t,b] ms'))) \\ ps = ps' \\ \\ =\\' \n| R3 \\ if (nondet_val ms t) = True \n then ms' = (pc[t]:=S1) ms \\ ps = ps' \\ \\ =\\' \n \\\\ sync() \\\n else ms' = (pc[t]:=I13) ms \\ ps = ps' \\ \\ =\\' \n \\\\ return to inc() \\\n| R4 \\ if (det ms t \\ [])\n then ms' = (pc[t]:=R5) ms \\ ps = ps' \\ \\ =\\' \n else ms' = (pc[t]:=I13) ms \\ ps = ps' \\ \\ =\\' \\\\ return to inc() \\\n\\\\ \\\n| R5 \\ (ms ps free[pop[detached[t]]] ms' ps') \\ \\ =\\' \\\\ ownW ps hd(det ps t) := None \\\n\\\\ \\\n| S1 \\ (ms r[N]:={0} t ms') \\ ps = ps' \\ \\ = \\'\n| S2 \\ if (CTRsync\\<^sub>1 ms t < T_max)\n then (if CTRsync\\<^sub>1 ms t = t \n then ms' = (pc[t]:=S2 \\ CTRsync\\<^sub>1[t]++) ms \\ ps = ps' \\ \\ =\\'\n else ms' = (pc[t]:=S3) ms \\ ps = ps' \\ \\ =\\')\n else ms' = (pc[t]:=S4) ms \\ ps = ps' \\ \\ =\\'\n| S3 \\ (ms ps \\ r[i]:=rcu[CTRsync\\<^sub>1 ms t] t ms' ps' \\')\n| S4 \\ if (CTRsync\\<^sub>2 ms t < T_max)\n then ms' = (pc[t]:=S5) ms \\ ps = ps' \\ \\ =\\'\n else ms' = (pc[t]:=R4) ms \\ ps = ps' \\ \\ =\\' \\\\ return to Reclaim (R4)\\\n| S5 \\ if r ms t (CTRsync\\<^sub>2 ms t) = 0\n then ms' = (CTRsync\\<^sub>2[t]++ \\ pc[t]:=S4) ms \\ ps = ps' \\ \\ =\\'\n else ms' = (pc[t]:=S6) ms \\ ps = ps' \\ \\ =\\'\n| S6 \\ ms \\ load((CTRsync\\<^sub>2 ms t))\\<^sub>t ms' \\' \\ ps = ps' \\\\ load \\rcu[i]\\ into reg, increment pc\\\n| S7 \\ if reg ms t = 1 \\\\ test while \\rcu[i]\\\\\n then ms' = (pc[t]:=S6 \\ regreset[t]) ms \\ ps = ps' \\ \\ =\\'\n else ms' = (CTRsync\\<^sub>2[t]++ \\ pc[t]:=S4 \\ regreset[t]) ms \\ ps = ps' \\ \\ =\\'\n\n\n| I1 \\ (ms int[v\\<^sub>t] ms') \\ ps = ps' \\ \\ = \\'\n| I2 \\ (ms int[*n\\<^sub>t] ms') \\ ps = ps' \\ \\ = \\'\n| I3 \\ (ms int[*s\\<^sub>t] ms') \\ ps = ps' \\ \\ = \\'\n| I4 \\ (ms ps n:=newint t ms' ps') \\ \\ = \\' \\\\ takes raw cap on n\\\n| I5 \\ (ps \\ rcuenter[] t ps' \\') \\ (ms' = (pc[t]:=I6) ms)\n| I6 \\ (ps \\ rcuexit[] t ps' \\') \\ (repeat ms t \\ ms' = (pc[t]:=I7 \\ givesupRown[t,the (s ms t)]) ms) \\\\ lets go of raw cap on s\\\n \\ (\\repeat ms t \\ ms' = (pc[t]:=I7) ms)\n| I7 \\ (ps \\ rcuenter[] t ps' \\') \\ (ms' = (pc[t]:=I8) ms)\n\\\\| fence \\ (\\ Fence t \\') \\ ps = ps' \\ (ms' = (pc[t]:=I8) ms) SC fence \\ \n| I8 \\ (ms \\ s:=\\<^sup>FC t ms' \\') \\ ps = ps' \\\\ Fetch and Add 0 \\ \\\\ takes r cap on s (C weak read)\\\n| I9 \\ (ms \\ v:=*s t ms' \\') \\ ps = ps' \n| I10 \\ (ms \\ *n:=newv t ms' \\') \\ ps = ps' \\\\ (ownW ps n) = t \\\n| I11 \\ cas_step_rcu ms \\ t C (the (s ms t)) (the (n ms t)) ms' \\' \\ ps = ps' \\\\ swaps wr cap from n to s\\\n| cas_res \\ if CAS_succ ms t \n then (ms' = (pc[t]:=I12) ms) \\ ps = ps' \\ \\ = \\'\n else (ms' = (pc[t]:=I6 \\ repeat[t]:=True) ms) \\ ps = ps' \\ \\ = \\'\n| I12 \\ (ps \\ rcuexit[] t ps' \\') \\ (ms' = ((pc[t]:=R1 \\ givesupRown[t,the (n ms t)])) ms) \\\\ lets go of raw cap on n\\\n \\\\reclaim(s)\\ \\\\ (ownW ps s) = t \\ \\\\ lets go of raw cap on s\\\n| I13 \\ (ms' = (pc[t]:=I14) ms) \\ \\ = \\' \\ ps = ps' \n| I14 \\ ms' = (repeat[t]:=False) ms \\ \\ = \\' \\ ps = ps' \\\\ return(v) \\ \n| finished \\ ms = ms' \\ ps=ps' \\ \\=\\'\n\" \n\nlemma \"n ms' t \\ i \\ (SOME loc. (the(n ms' t) = loc)) \\ the(n ms' t)\"\n by simp\n \n\n \nlemma \" \\ x. (x=2 \\ x = p) \\ (SOME x. x) \\ p=2 \"\n by (simp add: some_equality)\n\n\n\n\n\n\n\ndefinition \"Rcap ms t addrs \\ \\i. (i\\addrs) \\ (t\\own\\<^sub>R ms i)\"\ndefinition \"Wcap ms t addrs \\ \\i. (i\\addrs) \\ ((own\\<^sub>W ms i) = Some t)\"\n\ndefinition \"inlist a lst \\ \\j.(j lst!j = a)\"\ndefinition \"detaddrs ms t \\ {i. inlist i (det ms t)}\"\ndefinition \"tail_detaddrs ms t \\ {i. inlist i (det ms t)}\"\ndefinition \"n_pointer ms t\\ the(n ms t)\"\ndefinition \"s_pointer ms t\\ the(s ms t)\"\ndefinition \"s_and_n ms t \\ {n_pointer ms t,s_pointer ms t}\"\ndefinition \"just_n ms t \\ {n_pointer ms t}\"\ndefinition \"just_s ms t \\ {s_pointer ms t}\"\n\n(*\\t loc. t loc\\s_t \\ loc\\n_t \\ loc \\ detaddrs ms t \\ loc\\C \\ loc\\rcu[t]\\ loc\\free *)\n(*\\loc. loc\\free \\ own\\<^sub>R ms loc = {}*)\nlemmas names [simp] = n_pointer_def s_pointer_def s_and_n_def just_n_def just_s_def\n inlist_def detaddrs_def tail_detaddrs_def\nlemmas names_2 = Rcap_def Wcap_def\n\n\n(*------------structure lemmas---------------*)\n\ndefinition \"addr_allocated ms ps \\ \\addr t . addr \\ detaddrs ms t \\ \n (\\prov. (A ps prov = Some (addr, pointer)))\"\n\ndefinition \"nptr_true_imp ms ps \\ \\t . (n_dec ms t = True \\ n ms t\\None) \\\n (\\prov. (A ps prov = Some (the (n ms t), pointer)))\"\n\ndefinition \"sptr_true_imp ms ps \\ \\t . (s_dec ms t = True \\ s ms t\\None) \\\n (\\prov. (A ps prov = Some (the (s ms t), pointer)))\"\n\n(*-----------observation lemmas --------------*)\n\n\n\nlemma testingthisonebecauseofreasons:\n \"Rcap ms t (detaddrs ms t) \\ \n Wcap ms t (detaddrs ms t) \\\nRcap ms t' (detaddrs ms t') \\\nt\\t' \\\n2 \\ detaddrs ms t \\\n Wcap ms t' (detaddrs ms t') \\\nms' = ms \\ s := (s ms) (t := Some 2),\n pc := (pc ms) (t := I9),\n own\\<^sub>R := (own\\<^sub>R ms) (2:= own\\<^sub>R ms 2 \\ {t})\\\n\\ Rcap ms' t' (detaddrs ms' t') \n\" by (simp add:Rcap_def)\n\n\n\n(*------- careful observation of preCond per thread ----------*)\ndefinition \"pre_I1 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ n ms t = None \n \\ n_dec ms t = False\n \\ s ms t = None\n \\ \\repeat ms t \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I2 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ n ms t = None \n \\ n_dec ms t = False\n \\ s ms t = None\n \\ \\repeat ms t \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I3 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ n ms t = None \n \\ n_dec ms t = True\n \\ s ms t = None\n \\ \\repeat ms t \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I4 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ n ms t = None \n \\ n_dec ms t = True\n \\ s ms t = None\n \\ \\repeat ms t \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I5 ms t \\\n Rcap ms t (detaddrs ms t \\ just_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ s ms t = None\n \\ \\repeat ms t \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I6 ms t \\\n Wcap ms t (detaddrs ms t \\ just_n ms t) \n \\ (repeat ms t \\(s ms t \\ None \\ Rcap ms t (detaddrs ms t \\ s_and_n ms t)))\n \\ (\\repeat ms t \\(s ms t = None \\ Rcap ms t (detaddrs ms t \\ just_n ms t)))\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I7 ms t \\\n Rcap ms t (detaddrs ms t \\ just_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ (repeat ms t \\ s ms t \\ None )\n \\ (\\repeat ms t \\ s ms t = None )\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I8 ms t \\ \n Rcap ms t (detaddrs ms t \\ just_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ (repeat ms t \\ s ms t \\ None )\n \\ (\\repeat ms t \\ s ms t = None )\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I9 ms t \\ \n Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I10 ms t \\\n Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n \n\"\n\ndefinition \"pre_I11 ms t \\\n Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ n ms t \\ None \n \\ n_dec ms t = True\n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_cas_res ms t \\\n (CAS_succ ms t \\ Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_s ms t)\n \\ \\n_dec ms t)\n \\ (\\CAS_succ ms t\\ Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_n ms t)\n \\ n_dec ms t)\n \\ n ms t \\ None \n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_I12 ms t \\\n Rcap ms t (detaddrs ms t \\ s_and_n ms t) \\ Wcap ms t (detaddrs ms t \\ just_s ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\n\\\\ start to reclaim() \\\ndefinition \"pre_I13 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ (CTRsync\\<^sub>1 ms t = T_max \\ CTRsync\\<^sub>1 ms t = 0)\n \\ (CTRsync\\<^sub>2 ms t = T_max \\ CTRsync\\<^sub>2 ms t = 0)\n\"\n\ndefinition \"pre_I14 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ (CTRsync\\<^sub>1 ms t = T_max \\ CTRsync\\<^sub>1 ms t = 0)\n \\ (CTRsync\\<^sub>2 ms t = T_max \\ CTRsync\\<^sub>2 ms t = 0)\n\"\n\ndefinition \"pre_R1 ms t \\ \n Rcap ms t (detaddrs ms t \\ just_s ms t) \\ Wcap ms t (detaddrs ms t \\ just_s ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t \\ None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_R2 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_R3 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\n\\\\ start to sync() \\\n\\\\ or return to inc() \\\ndefinition \"pre_R4 ms t \\ \n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t = T_max\n\"\n\n\\\\ return to inc() \\\ndefinition \"pre_R5 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ det ms t \\ []\n \\ s ms t = None \n \\ (\\loc. loc\\detaddrs ms t \\ own\\<^sub>R ms loc = {t})\n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t = T_max\n\"\n\ndefinition \"pre_S1 ms t \\ \n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_S2 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t \\ T_max\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_S3 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t < T_max\n \\ CTRsync\\<^sub>2 ms t = 0\n\"\n\ndefinition \"pre_S4 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t \\ T_max\n\"\n\ndefinition \"pre_S5 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t < T_max\n\"\n\ndefinition \"pre_S6 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t < T_max\n\"\n\ndefinition \"pre_S7 ms t \\\n Rcap ms t (detaddrs ms t) \\ Wcap ms t (detaddrs ms t)\n \\ \\n_dec ms t\n \\ n ms t \\ None \n \\ s ms t = None \n \\ CTRsync\\<^sub>1 ms t = T_max\n \\ CTRsync\\<^sub>2 ms t < T_max\n\"\n\n\n\n\n\ndefinition preCond :: \"mstate \\ posem \\ surrey_state \\ PC \\ T \\ bool\" where\n\"preCond ms ps \\ pcr t \\ \ncase pcr of\n I1 \\ pre_I1 ms t\n| I2 \\ pre_I2 ms t\n| I3 \\ pre_I3 ms t\n| I4 \\ pre_I4 ms t\n| I5 \\ pre_I5 ms t\n| I6 \\ pre_I6 ms t\n| I7 \\ pre_I7 ms t\n\\\\| fence \\ pre_fence ms t\\\n| I8 \\ pre_I8 ms t\n| I9 \\ pre_I9 ms t\n| I10 \\ pre_I10 ms t\n| I11 \\ pre_I11 ms t\n| cas_res \\ pre_cas_res ms t\n| I12 \\ pre_I12 ms t\n| I13 \\ pre_I13 ms t\n| I14 \\ pre_I14 ms t\n| finished \\ True\n\n| R1 \\ pre_R1 ms t\n| R2 \\ pre_R2 ms t\n| R3 \\ pre_R3 ms t\n| R4 \\ pre_R4 ms t\n| R5 \\ pre_R5 ms t\n\n| S1 \\ pre_S1 ms t\n| S2 \\ pre_S2 ms t\n| S3 \\ pre_S3 ms t\n| S4 \\ pre_S4 ms t\n| S5 \\ pre_S5 ms t\n| S6 \\ pre_S6 ms t\n| S7 \\ pre_S7 ms t\n\n\"\n\nlemmas pre_conds [simp] = pre_I1_def pre_I2_def pre_I3_def pre_I4_def pre_I5_def\n pre_I6_def pre_I7_def pre_I8_def pre_I9_def pre_I10_def\n pre_I11_def pre_I12_def pre_I13_def pre_I14_def \n pre_cas_res_def \n pre_R1_def pre_R2_def pre_R3_def pre_R4_def pre_R5_def\n pre_S1_def pre_S2_def pre_S3_def pre_S4_def pre_S5_def \n pre_S6_def pre_S7_def \n\n\n\ndefinition \"init ms ps \\ (\\t. (t pc ms t = I1\n \\ n_dec ms t = False\n \\ s_dec ms t = False\n \\ v ms t = None\n \\ n ms t = None\n \\ det ms t = []\n \\ CTRsync\\<^sub>1 ms t = 0\n \\ CTRsync\\<^sub>2 ms t = 0\n \\ res ms t = 0\n \\ reg ms t = 0\n \\ nondet_val ms t = False\n \\ CAS_succ ms t = False\n \\ repeat ms t = False)\n \\ (\\t t'. (t t' \n r ms t t' = 0)\n \\ (\\i. (i\\0) \\ A ps i = None \\ own\\<^sub>R ms i = {} \\ own\\<^sub>W ms i = None)\n \\ alloc_addrs ps = {}\"\n\n\n(* old main invariant version\ndefinition \"main_invariant_1 ms \\ \\k t t'. ( k t'\\t \\ t'1 ms t \\ (r ms t t') = 0)\n \\ t' \\ own\\<^sub>R ms ((det ms t) ! k)\"\n\ndefinition \"main_invariant_2 ms \\ \\k t t'. ( k t'\\t \\ t'2 ms t)\n \\ t' \\ own\\<^sub>R ms ((det ms t) ! k)\"\n\ndefinition \"main_invariant_3 ms \\ \\ \\k t t'. ( k t'\\t \\ CTRsync\\<^sub>2 ms t < T_max \n \\ t'=CTRsync\\<^sub>2 ms t \\ [(rcu_0+t') \\\\<^sub>t 0] \\)\n \\ t' \\ own\\<^sub>R ms ((det ms t) ! k)\"*)\n\n\n\n(*-------------------------- Main Invariant --------------------------*)\ndefinition \"main_inv_1 ms \\\\t. (t n_dec ms t = True\n \\ n ms t \\ None)\n \\ own\\<^sub>R ms (the (n ms t)) = {t}\"\ndefinition \"main_inv_2 ms ps\\ \\loc. isfree_addr loc ps \\ own\\<^sub>R ms loc = {}\"\ndefinition \"main_inv_3 ms ps\\ \\loc t. t\\own\\<^sub>R ms loc \\ own\\<^sub>W ms loc \\ Some t\"\n\n\nlemma not_some_may_mean_none:\n \"s ms t \\ Some loc \\ \\loca. loca\\ loc \\ (s ms t = Some loca) \\ (s ms t = None)\"\n by fastforce\n\ndefinition \"main_inv ms ps \\ main_inv_1 ms \\ main_inv_2 ms ps \\ main_inv_3 ms ps\"\n\nlemmas main_inv_lemmas = main_inv_def main_inv_1_def main_inv_2_def main_inv_3_def\n\nlemma \"main_inv_2 ms ps \\ main_inv_3 ms ps \\ isfree_addr loc ps \\\n own\\<^sub>R ms loc = {} \\ own\\<^sub>W ms loc = None\"\n apply (simp add:main_inv_2_def main_inv_3_def) \n by (metis empty_iff option.exhaust)\n\n\n\n\n(*-------------------------- Supporting Invariant --------------------------*)\ndefinition \"observation_inv_ms ms \\ \\t loc .( (t (own\\<^sub>W ms (loc)) = Some t)) \\\n (loc \\ (detaddrs ms t) \\ \n Some loc = s ms t \\\n (Some loc = n ms t \\ n_dec ms t))\"\n\ndefinition \"observation_inv_sig ms ps \\ \\ \\t loc val .(( (t (own\\<^sub>W ms (loc)) = Some t)\n \\ isfree_addr loc ps) \\ cvd[C, val] \\) \n \\ val \\ loc\"\n\n\n\n\n\n\n\n\n(*-------------supporting structure invariants----------------*)\n\n(*allocated_addresses_lemmas*)\ndefinition \"allocated_n_addr ms ps \\ \\t i. (t (n ms t) = Some i \\ (n_dec ms t))\\ \\(isfree_addr i ps)\"\ndefinition \"allocated_det_addr ms ps \\ \\t i. (t det ms t\\[] \\ i \\(isfree_addr (det ms t ! i) ps)\"\ndefinition \"allocated_s_addr ms ps \\ \\i t. t t \\ own\\<^sub>R ms i \\ s ms t = Some i \\ \\isfree_addr i ps \"\n\ndefinition \"allocated_addresses ms ps \\ allocated_s_addr ms ps \\ allocated_n_addr ms ps \\ \n allocated_det_addr ms ps \"\nlemmas allocated_addresses_lemmas = allocated_addresses_def\n allocated_s_addr_def allocated_n_addr_def\n allocated_det_addr_def\n\n\n\n(*general_structure_lemmas*)\n\ndefinition \"n_differ ms \\ \\i t ta . t ta t\\ta \n \\ n_dec ms t \\ n_dec ms ta \\ n ms t = Some i \n \\ n ms ta \\ Some i\"\n\n\ndefinition \"n_differ_from_s_outside ms \\ \\i t ta . t ta t\\ta \\ \n n_dec ms t \\ n ms t = Some i \\\n (ta \\ own\\<^sub>R ms i)\"\n\ndefinition \"n_differ_from_s_inside ms \\ \\i t . t \n (n_dec ms t \\ n ms t = Some i) \n \\ s ms t \\ Some i\"\n\ndefinition \"s_differ_from_det_inside ms \\ \\j i t . t \n (t \\ own\\<^sub>R ms i \\ s ms t =Some i) \n \\ det ms t\\[] \\ j det ms t ! j \\ the(s ms t)\"\n\ndefinition \"n_differ_from_det ms \\ \\i loc t ta . t ta\n n_dec ms t \\ n ms t = Some loc \\\n det ms ta \\ [] \\ i det ms ta ! i \\ loc\"\n\ndefinition \"det_differ_from_det ms \\ \\i j t ta . t ta t\\ta \\\n det ms t \\ [] \\ det ms ta \\ [] \n \\ i j det ms t ! i \\ det ms ta ! j\"\n\ndefinition \"det_differ_inside ms \\ \\i j t . t det ms t \\ [] \\\n i j j\\i\n \\ det ms t ! i \\ det ms t ! j\"\n\ndefinition \"own\\<^sub>W_and_det_things ms \\ \\ t i. t i det ms t \\ []\\\n own\\<^sub>W ms (det ms t!i) = Some t\"\n\n(*!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!missing!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! *)\ndefinition \"s_loc_rule ms \\ \\t ta. t ta (s ms t \\ None \\ t\\ own\\<^sub>R ms (the(s ms t)))\n \\ the(s ms t) \\ (detaddrs ms ta)\"\n(*!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!missing!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! *)\n\ndefinition \"general_structure ms \\ n_differ ms\n \\ n_differ_from_s_outside ms \n \\ n_differ_from_s_inside ms \n \\ s_differ_from_det_inside ms \n \\ n_differ_from_det ms \n \\ det_differ_from_det ms \n \\ det_differ_inside ms \n \\ own\\<^sub>W_and_det_things ms\"\n \nlemmas general_structure_lemmas = general_structure_def\n s_loc_rule_def s_differ_from_det_inside_def\n n_differ_def n_differ_from_s_outside_def \n n_differ_from_s_inside_def\n n_differ_from_det_def\n det_differ_from_det_def det_differ_inside_def\n own\\<^sub>W_and_det_things_def\n\n\ndefinition \"testingtesting ms \\ \\t. n ms t \\None \\ (Some t = own\\<^sub>W ms (the(n ms t)) \\ n_dec ms t)\"\n\nlemma testttt1: \"n ms t \\ None \\ the(n ms t) = L \\ n ms t = Some L\" \n by fastforce\n\nlemma testttt2: \" n ms t = Some L \\ (\\y. n ms t = Some y) \\ the(n ms t) = L\" \n by fastforce\n\n\n\n\n\n(*write_capability ownership constraints*)\n\ndefinition \"own\\<^sub>W_n_by_t_imp ms \\ \\t loc . (t n ms t = Some loc) \\ \n (n_dec ms t \\ own\\<^sub>W ms loc = Some t)\"\n\nlemma \"((n_dec ms t \\ n ms t \\ None) \\ own\\<^sub>W ms (the(n ms t)) = Some t) \n = \n ((own\\<^sub>W ms (the(n ms t)) \\ Some t) \\ (\\n_dec ms t \\ n ms t = None))\"\n apply simp\n by auto\n\nlemma \"allocated_addresses ms ps \\ isfree_addr loc ps \\\n \\t. t ((n ms t) \\ Some loc \\(\\n_dec ms t))\"\n apply(simp add:allocated_addresses_lemmas) \n by auto\n\nlemma pecpec1: \"isfree_addr loc ps \\own\\<^sub>W_n_by_t_imp ms \\\n allocated_n_addr ms ps \\ n_dec ms t \\ n ms t \\ None \\ t n ms t \\ Some loc\"\n apply (simp add:allocated_addresses_lemmas own\\<^sub>W_n_by_t_imp_def)\n by blast\n\n\n\ndefinition \"counter2_rule ms \\ \\ta loc t. ta < T_max \\ t ta\\t \n \\ ta2 ms t \\ loc\\detaddrs ms t\n \\ ta\\own\\<^sub>R ms loc\"\n\n\n\ndefinition \"counter1_rule ms \\ \\t t' loc. t\\t' \\ t t' t'1 ms t \\ r ms t t' = 0 \\ loc\\detaddrs ms t\n \\ t' \\ own\\<^sub>R ms loc\"\n\ndefinition \"CTRsync_2_wm_rule ms \\\\ \\t t' loc. t'\\ t \\ t' t t'\\CTRsync\\<^sub>2 ms t \\ loc\\detaddrs ms t \n \\ [(rcu_0+t') =\\<^sub>t 0] \\\n \\ t' \\ own\\<^sub>R ms loc\"\n\ndefinition \"CTRsync_1_wm_rule ms \\\\ \\t t' loc. t'\\ t \\ t' t t'\\CTRsync\\<^sub>1 ms t \\ loc\\detaddrs ms t \n \\ [(rcu_0+t') =\\<^sub>t 0] \\\n \\ t' \\ own\\<^sub>R ms loc\"\n\n\n\nlemma checkRown:\n \"counter2_rule ms \\ t \nt\\own\\<^sub>R ms loc \\ CTRsync\\<^sub>2 ms t = T_max \\ loc\\detaddrs ms t \n \\ \\t. t\\T_max \\ t\\ own\\<^sub>R ms loc\n \\ own\\<^sub>R ms loc = {t}\"\n apply(simp add:counter2_rule_def) \n by (metis insert_absorb is_singletonI' is_singleton_the_elem nat_le_linear nat_less_le singleton_insert_inj_eq)\n\n\n\n(*\n\\ [rcu[t] =\\<^sub>t 0] \\\n\n rcu[t] := 1 **I5** \\\n \\\n \\ [rcu[t] =\\<^sub>t 1] \\ \\\n \\\n rcu[t] := 0 **I6** \\ rcu[t'] := 0\n \\\n \\ [rcu[t] =\\<^sub>t 0] \\ \\ \n \\\n rcu[t] := 1 **I7** \\ rcu[t'] := 1 \n \\\n \\ [rcu[t] =\\<^sub>t 1] \\ \\ \\ [rcu[t'] =\\<^sub>t\\<^sub>' 1] \\\n \\\n \\ \\ t' u. cvd(C, u) \\ \\ \\ t'' u. cvd(C, v) \n \\ t'\\ own\\<^sub>R ms u \\ \\ \\ t''\\ own\\<^sub>R ms v \\ \n [[C = u]]_t\\rcu[t'] =\\<^sub>t 1\\ \\ \\ [[C = v]]_t\\rcu[t''] =\\<^sub>t\\<^sub>' 1\\ \\\n \\\n \\\n s\\<^sub>t \\\\<^sup>F\\<^sup>A\\<^sup>A\\<^sup>Z C **I8** \\ s\\<^sub>t\\<^sub>' \\\\<^sup>F\\<^sup>A\\<^sup>A\\<^sup>Z C \n \\\n \\ [rcu[t] =\\<^sub>t 1] \\ \\ \\ [rcu[t'] =\\<^sub>t\\<^sub>' 1] \\ \n \\\n \\ (t'\\ own\\<^sub>R ms s\\<^sub>t \\ [rcu[t'] =\\<^sub>t 1]) \\ \\ (t''\\ own\\<^sub>R ms s\\<^sub>t\\<^sub>' \\ [rcu[t''] =\\<^sub>t\\<^sub>' 1])\n \\ (\\ t' u. cvd(C, u) \\ \\ (\\ t'' u. cvd(C, u) \n \\ t'\\ own\\<^sub>R ms u \\ \\ \\ t''\\ own\\<^sub>R ms u \\ \n [[C = u]]_t\\rcu[t'] =\\<^sub>t 1\\)\\ \\ [[C = u]]_t\\rcu[t''] =\\<^sub>t\\<^sub>' 1\\)\\\n \\\n CAS\\<^sup>R\\<^sup>A( &C, s\\<^sub>t, n\\<^sub>t) **I11** \\ CAS\\<^sup>R\\<^sup>A( &C, s\\<^sub>t\\<^sub>', n\\<^sub>t\\<^sub>')\n \\\n \\ [rcu[t] =\\<^sub>t 1] \\ \\ \\ [rcu[t'] =\\<^sub>t\\<^sub>' 1] \\ \n \\\n \\ t'\\ own\\<^sub>R ms s\\<^sub>t \\ [rcu[t'] =\\<^sub>t 1] \\ \\ \\ t''\\ own\\<^sub>R ms s\\<^sub>t\\<^sub>' \\ [rcu[t''] =\\<^sub>t\\<^sub>' 1] \\\n \\\n \\\n rcu[t] := 0 **I12** \\ rcu[t'] := 0\n \\\n \\\n \\ t'\\ own\\<^sub>R ms s\\<^sub>t \\ [rcu[t'] =_t 1] \\ \\\n \\\n 4 reg\\<^sub>t <-- rcu[t'] **S3** \\ reg\\<^sub>t' <-- rcu[t] \n\n\n\n\n\n\n\n\n d := 0 || e := 0 \n ||\n d := 1 || e := 1 \n ||\n 1 Fenced_Chunk (f) || 2 3 Fenced_Chunk (s) ****version 1****\n 2 Fenced_Chunk (f) || 1 3 Fenced_Chunk (s) ****version 2****\n ||\n d := 0 || e := 0 \n ||\n || while reg = 1\n || reg \\ d\n ||\n d := 1 ||\n ||\n Fenced_Chunk (f/s)||\n ||\n d := 0 ||\n\n\nFenced_Chunk starts on line I8 and finished with execution of line I11\nhence: {Pre(I8)} \\ {Pre(Fenced_Chunk)}\nand: {Post(I11)} \\ {Post(Fenced_Chunk)}\n\n\nPre(I8) in WM is two-fold:\n\n\nshows_WM_local_corr_1\n\\ [rcu[t] =\\<^sub>t 1] \\ \"\"local\"\"\n\\ \\ t' u. cvd(C, u) \\ t'\\ own\\<^sub>R ms u \\ [C = u]\\rcu[t'] =\\<^sub>t 1\\ \\ \"\"global\"\"\n\n\n\nChunk invariant:\n\nshows_WM_local_corr_1\n\\ [rcu[t] =\\<^sub>t 1] \\ \"\"local\"\"\n\\ (\\ t' u. cvd(C, u) \\ t'\\ own\\<^sub>R ms u \\ [C = u]\\rcu[t'] =\\<^sub>t 1\\) \"\"global\"\"\n \\ (\\t'. cvd(C,s\\<^sub>t) \\ t'\\ own\\<^sub>R ms s\\<^sub>t\\ [rcu[t'] =\\<^sub>t 1]) \\\n\n\nPost(I11) in WM is two-fold:\n\nshows_WM_local_corr_1\n\\ [rcu[t] =\\<^sub>t 1] \\ \"\"local\"\"\n\\ \\t'. t'\\ own\\<^sub>R ms s\\<^sub>t \\ [rcu[t'] =\\<^sub>t 1] \\ \"\"global\"\"\n\n\n*)\n\n\nlemma Failed_CAS_preserves_d_obs_1:\n assumes \"[x =\\<^sub>t u] \\\"\n and \"\\' = read_trans t False w \\\"\n and \"w \\ visible_writes \\ t l\"\n and \"x \\ l\"\n shows \"[x =\\<^sub>t u] \\'\"\n using assms\n apply(simp add:cas_step_def CAS_def) \n apply(simp add:d_obs_t_def d_obs_def)\n by (metis lastWr_read_pres)\n\n\n\nlemma Failed_CAS_preserves_d_obs_3:\n assumes \"[x =\\<^sub>t u] \\\"\n and \" w \\ visible_writes \\ t l \"\n and \"l \\ x\"\n and \"\\' = read_trans t False w \\\"\nshows \"[x =\\<^sub>t u] \\'\"\n using assms \n by (metis Failed_CAS_preserves_d_obs_1)\n \n\n\nlemma relating_step_to_update_trans_1:\n assumes \"\\' = update_trans t w nv' \\ ts'\"\n and \"k = value \\ w\"\n and \"w \\ covered \\\"\n and \"valid_fresh_ts \\ w ts'\"\n and \"w \\ visible_writes \\ t l\"\n shows \"OpSem.step t (Update l k nv') \\ \\'\"\n using assms apply (simp add:OpSem.step_def) \n by (metis prod.exhaust_sel)\n \n\n\nlemma d_obs_other_representation_2: \\ \\Rule: DV-Other\\\n assumes \"wfs \\\"\n and \"[x =\\<^sub>t u] \\\"\n and \"w \\ visible_writes \\ t l\"\n and \"w \\ covered \\\"\n and \"valid_fresh_ts \\ w ts'\"\n and \"\\' = update_trans t w nv' \\ ts'\" \n and \"l \\ x\"\n shows \"[x =\\<^sub>t u] \\'\"\n using assms d_obs_other\n by (metis avar.simps(3) relating_step_to_update_trans_1) \n\n\nlemma Succ_CAS_preserves_d_obs_1:\n assumes \"[x =\\<^sub>t u] \\\"\n and \" w \\ visible_writes \\ t l\"\n and \" w \\ covered \\\"\n and \"valid_fresh_ts \\ w ts'\"\n and \"wfs \\\"\n and \"\\' = update_trans t w nv' \\ ts'\"\n and \"x \\ l\"\n shows \"[x =\\<^sub>t u] \\'\"\n using assms \n by (metis d_obs_other_representation_2)\n\n\n\n\n\n\n\n\nlemma CAS_preserves_d_obs_7:\n assumes \"[(rcu_0 + t) =\\<^sub>t u] \\\"\n and \"cas_step t C cv nv \\ \\'\"\n and \"C \\ (rcu_0 + t)\"\n and \"wfs \\\"\nshows \"[(rcu_0 + t) =\\<^sub>t u] \\'\"\n using assms apply(simp add:cas_step_def CAS_def) apply clarsimp\n apply(case_tac \"value \\ (a, b) = cv\", simp_all)\n prefer 2 \n apply (meson Failed_CAS_preserves_d_obs_3) \n using d_obs_other_representation_2 by blast\n\n\nlemma CAS_preserves_d_obs_8:\n assumes \"[(rcu_0 + t) =\\<^sub>t u] \\\"\n and \"cas_step_rcu ms \\ t l cv nv ms' \\'\"\n and \"C \\ (rcu_0 + t)\"\n and \"wfs \\\"\nshows \"cas_step t l cv nv \\ \\'\"\n using assms apply(simp add:cas_step_rcu_def cas_step_def CAS_def) apply clarsimp\n apply(case_tac \"value \\ (a, b) = cv\", simp_all)\n prefer 2 \n apply (meson Failed_CAS_preserves_d_obs_3) \n apply blast \n by blast\n\n\n\nlemma CAS_preserves_d_obs_9:\n assumes \"[(rcu_0 + t) =\\<^sub>t u] \\\"\n and \"cas_step_rcu ms \\ t C cv nv ms' \\'\"\n and \"C \\ (rcu_0 + t)\"\n and \"wfs \\\"\nshows \"[(rcu_0 + t) =\\<^sub>t u] \\'\"\n using assms apply(subgoal_tac \"cas_step t C cv nv \\ \\'\", simp_all)\n using CAS_preserves_d_obs_7 apply blast\n by (simp add: CAS_preserves_d_obs_8)\n\n\n\n\n\n\n\nlemma shows_WM_local_corr_1:\n \" pre_cond \\ step ms ps \\ (pre_step) t ms' ps' \\' \\\n wfs \\ \\ cvd[C, u] \\ \\ the (n ms t)\\(rcu_0+t) \\ C \\ (rcu_0 + t) \\\n((pre_step \\ {I5,I7} \\ pre_cond = [(rcu_0 + t) =\\<^sub>t 0] \\) \\ [(rcu_0 + t) =\\<^sub>t 1] \\') \\\n((pre_step \\ {I6} \\ pre_cond = [(rcu_0 + t) =\\<^sub>t 1] \\) \\ [(rcu_0 + t) =\\<^sub>t 0] \\') \\\n((pre_step \\ {I8,I9,I10,I11} \\ pre_cond = [(rcu_0 + t) =\\<^sub>t 1] \\) \\ [(rcu_0 + t) =\\<^sub>t 1] \\')\"\n apply(simp add:step_def abbr)\n apply(case_tac pre_step, simp_all add:abbr)\n apply (metis d_obs_WrX_set)\n apply (meson d_obs_WrX_set)\n using d_obs_WrX_set apply blast\n defer\n apply (metis d_obs_RdX_other d_obs_RdX_pres)\n apply (metis d_obs_WrX_other)\n apply(clarify)\n using CAS_preserves_d_obs_9 apply blast\n apply(simp add:get_C_val_def)\n by (metis FAAZ_def d_obs_other_representation_2 fst_conv)\n\n\n\n\n\n\nlemma shows_WM_local_corr_2:\n \" cvd[C, u] \\ \\ ta\\ own\\<^sub>R ms u \\ [[C = u]]\\<^sub>t\\(rcu_0+ta) = 1\\ \\ \n\\ step ms ps \\ (pre_step) t ms' ps' \\' \\\n wfs_2 \\ \\ cvd[C, u] \\ \\\npre_step \\ {I7} \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ C \\ t \\ ta\n \\ cvd[C, u] \\' \\ ta\\ own\\<^sub>R ms' u \\ [[C = u]]\\<^sub>t\\(rcu_0+ta) = 1\\ \\'\"\n apply (simp_all add:step_def abbr wfs_2_def)\n apply safe \n by (metis add_left_cancel c_obs_last_WrX_diff_pres wfs_2_def)\n\n\n\n\n\nlemma testingthisone3:\n \"[C =\\<^sub>t u] \\ \\ wfs \\ \\\n \\ w \\ visible_writes \\ t C . value \\ w = u\"\n using d_obs_p_obs_agree p_obs_def by blast\n\n\nlemma testingthisone4:\n \"[C =\\<^sub>t u] \\ \\ wfs \\ \\ \\ w \\ visible_writes \\ t C. value \\ w = u \\\n d_obs \\ (modView \\ w) y k \\\n \\ w \\ visible_writes \\ t C. d_obs \\ (modView \\ w) y k\"\n using testingthisone3 by auto\n\n\nlemma testingthisone5:\n \"[C =\\<^sub>t u] \\ \\ wfs \\ \\ [[C = u]]\\<^sub>t\\y = k\\ \\ \\\n \\ w \\ visible_writes \\ t C. d_obs \\ (modView \\ w) y k\" \n by (metis c_obs_last_def d_obs_lastWr_visible testingthisone3)\n\nlemma testingthisone6:\n \"[C =\\<^sub>t u] \\ \\ wfs \\ \\ [[C = u]]\\<^sub>t\\y = k\\ \\ \\\nview y = (lastWr \\ y) \\\n d_obs \\ view y k\"\n by (simp add: c_obs_last_def d_obs_def d_obs_t_def)\n\n\nlemma testingthisone7:\n \"[x =\\<^sub>t u] \\ \\ wfs \\ \\ [[x = u]]\\<^sub>t\\y = k\\ \\ \\\n(thrView \\ t) y = (lastWr \\ y) \\\n d_obs_t \\ t y k\" \n by (simp add: c_obs_last_def d_obs_def d_obs_t_def)\n\nlemma testingthisone8:\n \"\\ w ts'.\n w \\ visible_writes \\ t x \\\n w \\ covered \\ \\\n valid_fresh_ts \\ w ts' \\\nupdate_trans t w (value \\ w) \\ ts' = \\' \\\n [x =\\<^sub>t u] \\ \\ wfs \\ \\ [[x = u]]\\<^sub>t\\y = k\\ \\ \\\n(thrView \\' t) y = (lastWr \\' y) \" \n by (metis c_obs_UpRA_d_obs c_obs_def c_obs_last_def d_obs_RMW_set d_obs_def d_obs_lastWr_visible d_obs_t_def relating_step_to_update_trans_1)\n \n\n\nlemma testingthisone10:\n \"get_C_val ms \\ t ms' \\' \\ [C =\\<^sub>t u] \\ \\ [[C = u]]\\<^sub>t\\y = k\\ \\ \\ wfs \\ \n\\ (thrView \\' t) y = (lastWr \\' y) \"\n apply (simp add:get_C_val_def FAAZ_def)\n using testingthisone8 [where x = C]\n by blast\n\n\n\n\nlemma FAAZ_expanded_is_Up:\n \"wfs \\ \\ \nw \\ visible_writes \\ t x \\ \nw \\ covered \\ \\ \nvalid_fresh_ts \\ w ts' \\ \n\\' = update_trans t w u \\ ts'\n\\ cvd[x, u] \\ \n\\ OpSem.step t (Update x u u) \\ \\'\"\n apply(simp add:OpSem.step_def)\n by (metis Up_reads_cvd_v eq_fst_iff relating_step_to_update_trans_1)\n \nlemma FAAZ_step_is_Up:\n \"wfs \\ \\ \nget_C_val ms \\ t ms' \\'\n\\ cvd[C, u] \\ \n\\ OpSem.step t (Update C u u) \\ \\'\"\n apply(simp add:get_C_val_def FAAZ_def)\n using Up_reads_cvd_v relating_step_to_update_trans_1 by blast\n\n\n\n\n\n\nlemma shows_WM_local_corr_supp2:\n \" cvd[C, u] \\ \\ [[C = u]]\\<^sub>t\\y = k\\ \\ \n\\ OpSem.step t (Update C u u') \\ \\'\n\\ wfs_2 \\ \n\\ y\\ C\n\\ cvd[C, u] \\ \n\\ [y =\\<^sub>t k] \\'\"\n apply (simp_all add:step_def abbr get_C_val_def FAAZ_def) \n using c_obs_last_UpRA_d_obs by auto\n\nlemma shows_WM_local_corr_supp3:\n \" cvd[C, u] \\ \\ ta\\own\\<^sub>R ms u\\ [[C = u]]\\<^sub>t\\(rcu_0+ta) = k\\ \\ \n\\ OpSem.step t (Update C u u) \\ \\'\n\\ wfs_2 \\ \n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, u] \\ \n\\ ta\\own\\<^sub>R ms u\n\\ [(rcu_0+ta) =\\<^sub>t k] \\'\"\n apply (simp_all add:step_def abbr get_C_val_def FAAZ_def) \n using shows_WM_local_corr_supp2 by auto\n\n\n\nlemma shows_WM_local_corr_supp4:\n \" cvd[C, u] \\ \\ ta\\own\\<^sub>R ms u\\ [[C = u]]\\<^sub>t\\(rcu_0+ta) = k\\ \\ \n\\ get_C_val ms \\ t ms' \\'\n\\ wfs_2 \\ \n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, u] \\ \n\\ ta\\own\\<^sub>R ms u\n\\ [(rcu_0+ta) =\\<^sub>t k] \\'\"\n apply (simp_all add:step_def abbr get_C_val_def FAAZ_def) \n using shows_WM_local_corr_supp2 \n by (metis Up_reads_cvd_v relating_step_to_update_trans_1)\n\n\nlemma shows_WM_local_corr_3:\n \" cvd[C, u] \\ \\ ta\\own\\<^sub>R ms u\\ [[C = u]]\\<^sub>t\\(rcu_0+ta) = 1\\ \\ \n\\ step ms ps \\ (pre_step) t ms' ps' \\' \\\npre_step \\ {I8}\n\\ wfs_2 \\ \n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, u] \\ \n\\ ta\\own\\<^sub>R ms u\n\\ [(rcu_0+ta) =\\<^sub>t 1] \\'\"\n apply (simp_all add:step_def abbr get_C_val_def FAAZ_def) \n using shows_WM_local_corr_supp2 \n by (metis Up_reads_cvd_v relating_step_to_update_trans_1)\n\nlemma c_obs_tdash_Rd_pres_c_obs:\n\"wfs_2 \\ \\ cvd[x, u] \\ \\ [[x = u]]\\<^sub>t\\y = k\\ \\ \\ z\\x \\\nx\\y \\ \\ [w \\ z]\\<^sub>t' \\' \\ [[x = u]]\\<^sub>t\\y = k\\ \\'\" \n using c_obs_last_RdX_pres \n by (smt (z3) c_obs_last_def) \n\nlemma c_obs_t_Rd_pres_c_obs:\n\"wfs_2 \\ \\ cvd[x, u] \\ \\ [[x = u]]\\<^sub>t\\y = k\\ \\ \\ \nx\\y \\ \\ [w \\ y]\\<^sub>t' \\' \\ [[x = u]]\\<^sub>t\\y = k\\ \\'\" \n using c_obs_last_RdX_pres \n by (metis c_obs_tdash_Rd_pres_c_obs)\n\n(*dealing with CAS, has 2 possible outcomes: (pre_block) if fail and (post_block) if succ*)\n\n\n\n\n\n\n\ndefinition \"pre_block t t' u ms \\ \\ cvd[C,u] \\ \\ t'\\own\\<^sub>R ms u \\ [[C = u]]\\<^sub>t\\(rcu_0 + t') = 1\\ \\\"\n\ndefinition \"post_block t t' ms \\ \\ t'\\ own\\<^sub>R ms (the (s ms t)) \\ [(rcu_0+t') =\\<^sub>t 1] \\\"\n\ndefinition \"in_block t t' u ms \\ \\ pre_block t t' u ms \\ \\ post_block t t' ms \\\"\n\n\n\n(*\nTHE FOLLOWING ARE WM OPERATIONS INSIDE CRIT. REGION\nAND THEIR PRE/POST CONDITIONS.\n\n\nFIRST TRY REPEAT TRY CAS SUCC\n\npre_block\nI5 rcu_enter()\npre_block\n\n\npre_block in_block\nI6 I6 rcu_exit()\npre_block in_block\n\n\npre_block in_block\nI7 I7 rcu_enter()\npre_block in_block\n\n\npre_block in_block\nI8 I8 FAAZ\nin_block in_block\n\n\n\nin_block in_block in_block\nI11 I11 I11 CAS\nin_block in_block post_block\n\n\n in_block\n I12 rcu_exit()\n post_block\n\n\n\n\n\n\n\n\n\n\n*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*\nlemma wmr_unsynced_doesnt_influence_cond:\n \"wfs_2 \\ \n\\ w \\ visible_writes \\ t C \n\\ w \\ covered \\ \n\\ valid_fresh_ts \\ w ts' \n\\ cvd[C,k] \\\n\\ \\' = read_trans t False w \\ \n\\ \\ [u \\ C]\\<^sub>t \\'\"\n\n*)\n\n\n\n(*\n\ndealing with LEAVING the critical region\n\n*)\n\nlemma succ_CAS_I11_pres_post:\n\" in_block t ta l ms \\\n\\ step ms ps \\ (pre_step) t ms' ps' \\' \\\npre_step \\ {I11}\n\\ wfs_2 \\ \n\n\\ l = the(s ms t)\n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, l] \\ \n\\ CAS_succ ms' t \n\\ post_block t ta ms' \\' \"\n apply(simp add:step_def cas_step_rcu_def post_block_def)\n apply(simp add:in_block_def wfs_2_def)\n apply(subgoal_tac \"post_block t ta ms \\\") prefer 2\n apply blast apply(thin_tac \"pre_block t ta (the (s ms t)) ms \\ \\\n post_block t ta ms \\\")\n apply clarify apply(simp add:CAS_def) apply(case_tac \"value \\ (a, b) = the (s ms t)\", simp_all)\n by (metis One_nat_def d_obs_other_representation_2 post_block_def)\n\nlemma fail_CAS_I11_pres_pre:\n\" in_block t ta l ms \\\n\\ step ms ps \\ (pre_step) t ms' ps' \\' \\\npre_step \\ {I11}\n\\ wfs_2 \\ \n\\ These_writes_releasing \\ C\n\\ l \\ the(s ms t)\n\\ (rcu_0+ta)\\ C \\ (rcu_0+t)\\ C \\ t\\ta\n\\ cvd[C, l] \\ \n\\ \\CAS_succ ms' t \n\\ pre_block t ta l ms' \\' \"\n apply(simp add:step_def cas_step_rcu_def pre_block_def in_block_def)\n apply clarify apply(simp add:CAS_def) apply(case_tac \"value \\ (a, b) = the (s ms t)\", simp_all add:wfs_2_def)\n apply(thin_tac \"post_block t ta ms \\\")\n apply(subgoal_tac \"OpSem.step t (RdX C l) \\ \\'\") prefer 2\n apply(simp add:OpSem.step_def)\n apply clarify apply(case_tac \"RdX C l\", simp_all)\n apply(simp_all add:read_trans_def rev_app_def Let_def)\n apply (metis RdX_def action.inject(1) covered_v_def subset_iff syncing_def visible_var visible_writes_in_writes wfs_def)\n apply (metis RdX_def isRd.simps(1) isRd.simps(2))\n apply auto\n apply (metis RdX_def isUp.simps(1) isUp.simps(3))\n by (metis RdX_def c_obs_last_Rd_pres c_obs_last_def isRA.simps(1) isRd.simps(1) wfs_2_def)\n \n \n\n\nlemma fail_CAS_I11_pres_post:\n\" in_block t ta l ms \\\n\\ step ms ps \\ (pre_step) t ms' ps' \\' \\\npre_step \\ {I11}\n\\ wfs_2 \\ \n\\ l \\ the(s ms t)\n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, l] \\ \n\\ \\CAS_succ ms' t \n\\ post_block t ta ms' \\' \"\n apply(simp add:step_def cas_step_rcu_def pre_block_def post_block_def in_block_def)\n apply clarify apply(simp add:CAS_def) apply(case_tac \"value \\ (a, b) = the (s ms t)\", simp_all) \n by (meson Failed_CAS_preserves_d_obs_1)\n\nlemma CAS_I11_pres_inblock_or_post:\n\" in_block t ta l ms \\\n\\ step ms ps \\ (pre_step) t ms' ps' \\' \n\\ pre_step \\ {I11}\n\\ These_writes_releasing \\ C\n\\ wfs_2 \\ \n\\ (rcu_0+ta)\\ C\n\\ (rcu_0+t)\\ C\n\\ t\\ta\n\\ cvd[C, l] \\ \n\\ in_block t ta l ms' \\' \\ post_block t ta ms' \\'\"\n apply(case_tac \"CAS_succ ms' t\")\n apply(subgoal_tac \"post_block t ta ms' \\'\") \n apply blast \n apply(case_tac \"l = the(s ms t) \") \n using succ_CAS_I11_pres_post\n apply blast\n apply(subgoal_tac \"\\CAS_succ ms' t \", simp_all)\n apply(simp add:step_def cas_step_rcu_def CAS_def)\n apply clarify\n apply(case_tac \"value \\ (a, b) = the (s ms t)\", simp_all)\n apply (simp add: covered_v_def visible_writes_def)\n apply(subgoal_tac \"in_block t ta l ms' \\'\", simp_all)\n apply(subgoal_tac \"post_block t ta ms' \\' \\ pre_block t ta l ms' \\' \")\n using in_block_def apply blast\n apply(subgoal_tac \"l\\the(s ms t)\") prefer 2\n apply(simp add:step_def cas_step_rcu_def CAS_def)\n apply clarify\n apply(case_tac \"value \\ (a, b) = the (s ms t)\", simp_all) \n apply (simp add: covered_v_def visible_writes_def)\n apply(intro conjI)\n using fail_CAS_I11_pres_post \n apply blast\n using fail_CAS_I11_pres_pre\n by blast\n\n\n(*\n\ndealing with ENTERING the critical region\n\n*)\n\n\nlemma FAAZ_returns_l_on_s:\n\" wfs_2 \\ \\ cvd[C, l] \\\n\\ w \\ visible_writes \\ t l \n\\ valid_fresh_ts \\ w ts'\n\\ w \\ covered \\ \n\\ \\' = update_trans t w l \\ ts'\n\\ These_writes_releasing \\ C\n\\ cvd[C,l] \\'\"\n apply simp using wfs_2_def\n by (metis avar.simps(3) covered_diff_var_pres cvd_RMW_new_cvd relating_step_to_update_trans_1)\n\n\nlemma I8_first_preserves_pre_block:\n \"pre_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\\\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I8}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" \n apply(simp add:pre_block_def step_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all) prefer 2\n apply(subgoal_tac \"ta \\ own\\<^sub>R ms' l\", simp_all)\n apply(simp add:get_C_val_def FAAZ_def) apply clarify\n apply(subgoal_tac \"value \\ (a, b) = l\") prefer 2\n apply(simp add:covered_v_def)\n apply metis\n apply(subgoal_tac \"own\\<^sub>R ms' l= {x. x = t \\ x \\ own\\<^sub>R ms l}\")\n apply clarify\n apply blast apply simp\n apply(subgoal_tac \"ta \\ own\\<^sub>R ms' l\", simp_all) prefer 2\n apply(simp add:get_C_val_def FAAZ_def) apply clarify\n apply(subgoal_tac \"value \\ (a, b) = l\") prefer 2\n apply(simp add:covered_v_def)\n apply (simp add: visible_writes_def)\n apply(subgoal_tac \"own\\<^sub>R ms' l= {x. x = t \\ x \\ own\\<^sub>R ms l}\")\n apply clarify\n apply blast\n apply simp\n apply blast\n apply(subgoal_tac \"cvd[C, l] \\'\") apply clarify\n apply(subgoal_tac \"\\ RMW[C,l,l]\\<^sub>t \\'\") \n apply (metis c_obs_last_Up_same_loc_pres_col_global c_obs_last_def x_has_lastWr)\n using FAAZ_step_is_Up wfs_2_def apply blast\n using FAAZ_step_is_Up cvd_RMW_new_cvd wfs_2_def by blast\n\n\n\n\nlemma I8_first_preserves_post_block:\n \"pre_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\\\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I8}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ post_block t ta ms' \\'\n\" \n apply(simp add:pre_block_def post_block_def step_def) \n apply(subgoal_tac \"the (s ms' t) = l\") prefer 2 apply(simp add:get_C_val_def FAAZ_def)\n apply(simp add:update_trans_def rev_app_def Let_def)\n apply(simp add: These_writes_releasing_def) apply clarify\n apply(case_tac \"releasing \\ (a,b)\", simp_all) \n apply (simp add: covered_v_def visible_writes_def)\n apply (simp add: visible_writes_def)\n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply (metis shows_WM_local_corr_supp4)\n apply(subgoal_tac \"ta\\ own\\<^sub>R ms' l\")\n apply blast\n apply(simp add:get_C_val_def FAAZ_def)\n by auto\n \n\n\n\n\n\nlemma I8_second_preserves_pre_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ l\\the(s ms t)\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I8}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" \n using in_block_def I8_first_preserves_pre_block by blast\n \n\nlemma I8_second_preserves_post_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ l\\the(s ms t)\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I8}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ post_block t ta ms' \\'\n\" \n using in_block_def I8_first_preserves_post_block by blast\n\n\nlemma I8_second_preserves_in_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ l\\the(s ms t)\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I8}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ in_block t ta l ms' \\'\n\" apply (simp add:in_block_def) apply(intro conjI impI)\n using I8_first_preserves_pre_block apply blast\n using I8_first_preserves_post_block by blast\n\n\n\n\n\n\n\nlemma I5_preserves_pre_block:\n \"pre_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I5}\n\\ s ms t = None\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" \n apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' l\", simp_all)\n apply (metis add_left_imp_eq c_obs_last_WrX_diff_pres)\n using update_pc_def by auto \n \n\n\n\n\n\n\nlemma I6_first_preserves_pre_block:\n \"pre_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\\\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I6}\n\\ s ms t = None\n\\ \\repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' l\", simp_all) \n apply (metis abbr(10) add_left_imp_eq c_obs_last_WrX_diff_pres)\n using exit_rcu_def update_pc_def by auto\n\n\n\n\nlemma I6_second_preserves_pre_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I6}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" apply(simp add:in_block_def) \n apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' l\", simp_all) \n apply (metis abbr(10) add_left_imp_eq c_obs_last_WrX_diff_pres)\n using exit_rcu_def giveup_readandwrite_ownership_def update_pc_def by auto\n\n\nlemma I6_second_preserves_post_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I6}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ post_block t ta ms' \\'\n\" apply(simp add:in_block_def) \n apply(simp add:step_def enter_rcu_def)\n apply(simp add:post_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms (the (s ms t))\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' (the (s ms t))\", simp_all) \n apply (meson abbr(10) add_left_imp_eq d_obs_WrX_other wfs_2_def)\n using exit_rcu_def giveup_readandwrite_ownership_def update_pc_def by auto\n \n\nlemma I6_second_preserves_in_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I6}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ in_block t ta l ms' \\'\n\" apply(simp add:in_block_def)\n apply(intro conjI impI)\n using I6_second_preserves_pre_block apply auto \n using in_block_def apply blast\n using I6_second_preserves_post_block apply auto \n by (meson in_block_def)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nlemma I7_first_preserves_pre_block:\n \"pre_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\\\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I7}\n\\ \\repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' l\", simp_all)\n apply (metis add_left_imp_eq c_obs_last_WrX_diff_pres)\n using update_pc_def by auto \n\n\n\n\nlemma I7_second_preserves_pre_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I7}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ pre_block t ta l ms' \\'\n\" apply(simp add:in_block_def)\n apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def post_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms l\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' l\", simp_all)\n apply (metis add_left_imp_eq c_obs_last_WrX_diff_pres)\n using update_pc_def by auto \n\n\n\nlemma I7_second_preserves_post_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I7}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ post_block t ta ms' \\'\n\" apply(simp add:in_block_def)\n apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def post_block_def) \n apply(case_tac \"ta \\ own\\<^sub>R ms (the (s ms t))\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' (the (s ms t))\", simp_all) \n apply (metis add_left_imp_eq d_obs_WrX_other wfs_2_def)\n using update_pc_def by auto \n\n\nlemma I7_second_preserves_in_block:\n \"in_block t ta l ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I7}\n\\ repeat ms t\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ in_block t ta l ms' \\'\n\" apply(simp add:in_block_def)\n apply(intro conjI impI)\n using I7_second_preserves_pre_block in_block_def apply blast\n using I7_second_preserves_post_block in_block_def by blast\n \n\n\n\n\n\n\nlemma I12_preserves_post_block:\n \"post_block t ta ms \\\n\\ wfs_2 \\\n\\ These_writes_releasing \\ C\n\\ cvd[C, l] \\ \\ \\repeat\\\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ pre_step \\ {I12}\n\\ C \\ (rcu_0 + t) \\ C \\ (rcu_0 + ta) \\ ta\\t \n\\ post_block t ta ms' \\'\n\" apply(simp add:in_block_def)\n apply(simp add:step_def enter_rcu_def)\n apply(simp add:pre_block_def post_block_def)\n apply(case_tac \"ta \\ own\\<^sub>R ms (the (s ms t))\", simp_all)\n apply(subgoal_tac \" ta \\ own\\<^sub>R ms' (the (s ms t))\", simp_all) \n apply (meson abbr(10) add_left_imp_eq d_obs_WrX_other wfs_2_def)\n using update_pc_def giveup_readandwrite_ownership_def by auto\n\n\n(*weak memory invariant during reclamation/synchronisation*)\n\n\nlemma S3_corr_val_preserves_post_block:\n \"post_block t ta ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S3}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ ta\\t \n\\ post_block t ta ms' \\'\"\n apply(case_tac \"ta = (CTRsync\\<^sub>1 ms t)\")\n apply(simp add:step_def load_rcu_to_r_def post_block_def wfs_2_def)\n apply(case_tac \"CTRsync\\<^sub>1 ms t \\ own\\<^sub>R ms' (the (s ms' t))\", simp_all)\n apply clarify apply auto\n apply (meson d_obs_RdX_pres)\n apply(simp add:step_def load_rcu_to_r_def post_block_def wfs_2_def)\n apply clarify apply auto\n by (meson add_left_imp_eq d_obs_RdX_other)\n\n\nlemma S3_corr_val_preserves_post_sc:\n \"post_block t ta ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S3}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ ta\\t \n\\ r ms t ta = 0\n\\ CTRsync\\<^sub>1 ms t = ta\n\\ ta\\ own\\<^sub>R ms (the (s ms t)) \\ r ms' t ta = 1\"\n apply(simp add:step_def load_rcu_to_r_def post_block_def wfs_2_def)\n apply(case_tac \"CTRsync\\<^sub>1 ms t \\ own\\<^sub>R ms' (the (s ms' t))\", simp_all)\n apply clarify apply auto\n by (meson d_obs_read_value)\n\n\n(*do the same for S6*)\n\n\n\nlemma S6_corr_val_preserves_post_sc:\n \"r ms t t' = 1 \\ post_block t t' ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S6}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ r ms' t t' = 1 \\ post_block t t' ms' \\'\"\n apply(simp add:step_def load_rcu_to_r_def post_block_def wfs_2_def rcu_temp_copy_def)\n apply clarify apply auto \n by (metis d_obs_RdX_other d_obs_RdX_pres)\n \n\nlemma S6_corr_val_preserves_post_sc_2:\n \"r ms t ta = 1 \\ post_block t ta ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S6}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ r ms t ta = 1 \n\\ post_block t ta ms' \\'\"\n apply(subgoal_tac \"r ms' t ta = 1\") prefer 2\n apply(simp add:step_def rcu_temp_copy_def) apply auto\n by (metis One_nat_def S6_corr_val_preserves_post_sc insertI1)\n\n\nlemma S6_corr_val_preserves_post_sc_3:\n \"r ms t ta = 1 \\ post_block t ta ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S6}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ r ms t ta = 1 \n\\ ta \\ own\\<^sub>R ms (the (s ms t))\n\\ [(rcu_0+ta) =\\<^sub>t 1] \\'\"\n apply (simp add:post_block_def) \n apply(subgoal_tac \"r ms' t ta = 1\") prefer 2 apply(simp add:step_def rcu_temp_copy_def) apply auto\n apply(subgoal_tac \"ta \\ own\\<^sub>R ms' (the (s ms' t))\") prefer 2 apply(simp add:step_def rcu_temp_copy_def) apply auto\n by (metis One_nat_def S6_corr_val_preserves_post_sc insertI1 post_block_def)\n \n\nlemma S6_corr_val_preserves_post_sc_4:\n \"r ms t ta = 1 \\ post_block t ta ms \\\n\\ wfs_2 \\\n\\ pre_step \\ {S6}\n\\ step ms ps \\ (pre_step) t ms' ps' \\'\n\\ r ms t ta = 1 \n\\ ta = CTRsync\\<^sub>2 ms t\n\\ ta \\ own\\<^sub>R ms (the (s ms t)) \\ reg ms' t = 1\"\n apply simp\n apply(case_tac \"ta \\ own\\<^sub>R ms (the (s ms t))\")\n apply(simp add:step_def rcu_temp_copy_def post_block_def wfs_2_def)\n apply(subgoal_tac \"[(rcu_0+ta) =\\<^sub>t 1] \\\", simp_all add:d_obs_t_def OpSem.step_def)\n apply clarify\n apply(case_tac \"RdX (rcu_0 + CTRsync\\<^sub>2 ms t) v\", simp_all) \n apply (metis RdX_def action.inject(1) d_obs_p_obs_agree d_obs_t_def p_obs_def)\n apply (metis RdX_def action.distinct(1))\n by (metis RdX_def action.simps(7))\n\n(*the S6 and S3 dependencies MIGHT need revisiting*)\n\n\n\n\n\n\n\n\n(*-------------------------------------------------------------*)\n(*-------------------------------------------------------------*)\n(*-----------------RCU free(pop(det)) stuff--------------------*)\n(*-------------------------------------------------------------*)\n(*-------------------------------------------------------------*)\n\n\n\n\n\n\n\n\n\n\n\n\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/RCU_model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.34864514886966624, "lm_q1q2_score": 0.18520356588587888}} {"text": "(* Title: variants/e_all_abcd/Aodv_Message.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke, Inria\n Author: Peter Höfner, NICTA\n*)\n\nsection \"AODV protocol messages\"\n\ntheory E_Aodv_Message\nimports E_All_ABCD\nbegin\n\ndatatype msg =\n Rreq nat ip sqn k ip sqn ip bool\n | Rrep nat ip sqn ip ip\n | Rerr \"ip \\ sqn\" ip\n | Newpkt data ip\n | Pkt data ip ip\n\ninstantiation msg :: msg\nbegin\n definition newpkt_def [simp]: \"newpkt \\ \\(d, dip). Newpkt d dip\"\n definition eq_newpkt_def: \"eq_newpkt m \\ case m of Newpkt d dip \\ True | _ \\ False\"\n\n instance by intro_classes (simp add: eq_newpkt_def)\nend\n\ntext \\The @{type msg} type models the different messages used within AODV.\n The instantiation as a @{class msg} is a technicality due to the special\n treatment of @{term newpkt} messages in the AWN SOS rules.\n This use of classes allows a clean separation of the AWN-specific definitions\n and these AODV-specific definitions.\\\n\ndefinition rreq :: \"nat \\ ip \\ sqn \\ k \\ ip \\ sqn \\ ip \\ bool \\ msg\"\n where \"rreq \\ \\(hops, dip, dsn, dsk, oip, osn, sip, handled).\n Rreq hops dip dsn dsk oip osn sip handled\"\n\nlemma rreq_simp [simp]:\n \"rreq(hops, dip, dsn, dsk, oip, osn, sip, handled) = Rreq hops dip dsn dsk oip osn sip handled\"\n unfolding rreq_def by simp\n\ndefinition rrep :: \"nat \\ ip \\ sqn \\ ip \\ ip \\ msg\"\n where \"rrep \\ \\(hops, dip, dsn, oip, sip). Rrep hops dip dsn oip sip\"\n\nlemma rrep_simp [simp]:\n \"rrep(hops, dip, dsn, oip, sip) = Rrep hops dip dsn oip sip\"\n unfolding rrep_def by simp\n\ndefinition rerr :: \"(ip \\ sqn) \\ ip \\ msg\"\n where \"rerr \\ \\(dests, sip). Rerr dests sip\"\n\nlemma rerr_simp [simp]:\n \"rerr(dests, sip) = Rerr dests sip\"\n unfolding rerr_def by simp\n\nlemma not_eq_newpkt_rreq [simp]: \"\\eq_newpkt (Rreq hops dip dsn dsk oip osn sip handled)\"\n unfolding eq_newpkt_def by simp\n\nlemma not_eq_newpkt_rrep [simp]: \"\\eq_newpkt (Rrep hops dip dsn oip sip)\"\n unfolding eq_newpkt_def by simp\n\nlemma not_eq_newpkt_rerr [simp]: \"\\eq_newpkt (Rerr dests sip)\"\n unfolding eq_newpkt_def by simp\n\nlemma not_eq_newpkt_pkt [simp]: \"\\eq_newpkt (Pkt d dip sip)\"\n unfolding eq_newpkt_def by simp\n\ndefinition pkt :: \"data \\ ip \\ ip \\ msg\"\n where \"pkt \\ \\(d, dip, sip). Pkt d dip sip\"\n\nlemma pkt_simp [simp]:\n \"pkt(d, dip, sip) = Pkt d dip sip\"\n unfolding pkt_def by simp\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AODV/variants/e_all_abcd/E_Aodv_Message.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.3140505321516081, "lm_q1q2_score": 0.18494094489593557}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__52_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__52_on_rules imports n_german_lemma_on_inv__52\nbegin\nsection{*All lemmas on causal relation between inv__52*}\nlemma lemma_inv__52_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__52 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__52) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__52_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583270090337582, "lm_q2_score": 0.3311197462295937, "lm_q1q2_score": 0.1848730975443861}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__6_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__6_on_rules imports n_german_lemma_on_inv__6\nbegin\nsection{*All lemmas on causal relation between inv__6*}\nlemma lemma_inv__6_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__6) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__6_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.33807711081162, "lm_q1q2_score": 0.18483965479344264}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_on_inv__41.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_on_inv__41 imports n_germanSymIndex_base\nbegin\nsection{*All lemmas on causal relation between inv__41 and some rule r*}\nlemma n_RecvReqSVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''CurCmd'')) (Const ReqS)) (eqn (IVar (Ident ''ExGntd'')) (Const false))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__41:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__41 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__41:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__41:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__41:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__41:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__41:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_on_inv__41.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.3665897501624599, "lm_q1q2_score": 0.18472683715957758}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Andrew Boyton, 2012\n Maintainers: Gerwin Klein \n Rafal Kolanski \n*)\n\nchapter \"Instantiating capDL as a separation algebra.\"\n\ntheory Abstract_Separation_D\nimports\n \"../../Sep_Tactics\"\n Types_D\n \"../../Map_Extra\"\nbegin\n\n(**************************************\n * Start of lemmas to move elsewhere. *\n **************************************)\n\nlemma inter_empty_not_both:\n\"\\x \\ A; A \\ B = {}\\ \\ x \\ B\"\n by fastforce\n\nlemma union_intersection:\n \"A \\ (A \\ B) = A\"\n \"B \\ (A \\ B) = B\"\n \"(A \\ B) \\ A = A\"\n \"(A \\ B) \\ B = B\"\n by fastforce+\n\nlemma union_intersection1: \"A \\ (A \\ B) = A\"\n by (rule inf_sup_absorb)\nlemma union_intersection2: \"B \\ (A \\ B) = B\"\n by fastforce\n\n(* This lemma is strictly weaker than restrict_map_disj. *)\nlemma restrict_map_disj':\n \"S \\ T = {} \\ h |` S \\ h' |` T\"\n by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_add_restrict_comm:\n \"S \\ T = {} \\ h |` S ++ h' |` T = h' |` T ++ h |` S\"\n apply (drule restrict_map_disj')\n apply (erule map_add_com)\n done\n\n(************************************\n * End of lemmas to move elsewhere. *\n ************************************)\n\n\n\n(* The state for separation logic has:\n * The memory heap.\n * A function for which objects own which fields.\n In capDL, we say that an object either owns all of its fields, or none of them.\n These are both taken from the cdl_state.\n *)\n\ndatatype sep_state = SepState cdl_heap cdl_ghost_state\n\n(* Functions to get the heap and the ghost_state from the sep_state. *)\nprimrec sep_heap :: \"sep_state \\ cdl_heap\"\nwhere \"sep_heap (SepState h gs) = h\"\n\nprimrec sep_ghost_state :: \"sep_state \\ cdl_ghost_state\"\nwhere \"sep_ghost_state (SepState h gs) = gs\"\n\ndefinition\n the_set :: \"'a option set \\ 'a set\"\nwhere\n \"the_set xs = {x. Some x \\ xs}\"\n\nlemma the_set_union [simp]:\n \"the_set (A \\ B) = the_set A \\ the_set B\"\n by (fastforce simp: the_set_def)\n\nlemma the_set_inter [simp]:\n \"the_set (A \\ B) = the_set A \\ the_set B\"\n by (fastforce simp: the_set_def)\n\nlemma the_set_inter_empty:\n \"A \\ B = {} \\ the_set A \\ the_set B = {}\"\n by (fastforce simp: the_set_def)\n\n\n(* As the capDL operations mostly take the state (rather than the heap)\n * we need to redefine some of them again to take just the heap.\n *)\ndefinition\n slots_of_heap :: \"cdl_heap \\ cdl_object_id \\ cdl_cap_map\"\nwhere\n \"slots_of_heap h \\ \\obj_id. \n case h obj_id of \n None \\ empty \n | Some obj \\ object_slots obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n add_to_slots :: \"cdl_cap_map \\ cdl_object \\ cdl_object\"\nwhere\n \"add_to_slots new_val obj \\ update_slots (new_val ++ (object_slots obj)) obj\"\n\nlemma add_to_slots_assoc:\n \"add_to_slots x (add_to_slots (y ++ z) obj) = \n add_to_slots (x ++ y) (add_to_slots z obj)\"\n apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n apply (fastforce simp: cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\n(* Lemmas about add_to_slots, update_slots and object_slots. *)\nlemma add_to_slots_twice [simp]:\n \"add_to_slots x (add_to_slots y a) = add_to_slots (x ++ y) a\"\n by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n split: cdl_object.splits)\n\nlemma slots_of_heap_empty [simp]: \"slots_of_heap empty object_id = empty\"\n by (simp add: slots_of_heap_def)\n\nlemma slots_of_heap_empty2 [simp]:\n \"h obj_id = None \\ slots_of_heap h obj_id = empty\"\n by (simp add: slots_of_heap_def)\n\nlemma update_slots_add_to_slots_empty [simp]:\n \"update_slots empty (add_to_slots new obj) = update_slots empty obj\"\n by (clarsimp simp: update_slots_def add_to_slots_def split:cdl_object.splits)\n\nlemma update_object_slots_id [simp]: \"update_slots (object_slots a) a = a\"\n by (clarsimp simp: update_slots_def object_slots_def\n split: cdl_object.splits)\n\nlemma update_slots_of_heap_id [simp]:\n \"h obj_id = Some obj \\ update_slots (slots_of_heap h obj_id) obj = obj\"\n by (clarsimp simp: update_slots_def slots_of_heap_def object_slots_def\n split: cdl_object.splits)\n\nlemma add_to_slots_empty [simp]: \"add_to_slots empty h = h\"\n by (simp add: add_to_slots_def)\n\nlemma update_slots_eq:\n \"update_slots a o1 = update_slots a o2 \\ update_slots b o1 = update_slots b o2\"\n by (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n\n\n\n(* If there are not two conflicting objects at a position in two states.\n * Objects conflict if their types are different or their ghost_states collide.\n *)\ndefinition\n not_conflicting_objects :: \"sep_state \\ sep_state \\ cdl_object_id \\ bool\"\nwhere\n \"not_conflicting_objects state_a state_b = (\\obj_id.\n let heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in case (heap_a obj_id, heap_b obj_id) of \n (Some o1, Some o2) \\ object_type o1 = object_type o2 \\ gs_a obj_id \\ gs_b obj_id = {}\n | _ \\ True)\"\n\n\n(* \"Cleans\" slots to conform with the components. *)\ndefinition\n clean_slots :: \"cdl_cap_map \\ cdl_components \\ cdl_cap_map\"\nwhere\n \"clean_slots slots cmp \\ slots |` the_set cmp\"\n\n(* Sets the fields of an object to a \"clean\" state.\n Because a frame's size is part of it's type, we don't reset it. *)\ndefinition\n object_clean_fields :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean_fields obj cmp \\ if None \\ cmp then obj else case obj of\n Tcb x \\ Tcb (x\\cdl_tcb_fault_endpoint := undefined\\)\n | CNode x \\ CNode (x\\cdl_cnode_size_bits := undefined \\)\n | _ \\ obj\"\n\n(* Sets the slots of an object to a \"clean\" state. *)\ndefinition\n object_clean_slots :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean_slots obj cmp \\ update_slots (clean_slots (object_slots obj) cmp) obj\"\n\n(* Sets an object to a \"clean\" state. *)\ndefinition\n object_clean :: \"cdl_object \\ cdl_components \\ cdl_object\"\nwhere\n \"object_clean obj gs \\ object_clean_slots (object_clean_fields obj gs) gs\"\n\n(* Overrides the left object with the attributes of the right, as specified by the ghost state.\n If the components for an object are empty, then this object is treated as empty, and thus ignored.\n *)\ndefinition\n object_add :: \"cdl_object \\ cdl_object \\ cdl_components \\ cdl_components \\ cdl_object\"\nwhere\n \"object_add obj_a obj_b cmps_a cmps_b \\\n let clean_obj_a = object_clean obj_a cmps_a;\n clean_obj_b = object_clean obj_b cmps_b\n in if (cmps_a = {})\n then clean_obj_b\n else if (cmps_b = {})\n then clean_obj_a\n else if (None \\ cmps_b)\n then (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_b)\n else (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_a)\"\n\n(* Heaps are added by adding their respective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n * (overwrites the left with the right).\n *)\ndefinition\n cdl_heap_add :: \"sep_state \\ sep_state \\ cdl_heap\"\nwhere\n \"cdl_heap_add state_a state_b \\ \\obj_id.\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n case heap_b obj_id of\n None \\ heap_a obj_id\n | Some obj_b \\ \n (case heap_a obj_id of\n None \\ heap_b obj_id\n | Some obj_a \\ Some (object_add obj_a obj_b (gs_a obj_id) (gs_b obj_id)))\"\n\n(* Heaps are added by adding their repsective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n * (overwrites the left with the right).\n *)\ndefinition\n cdl_ghost_state_add :: \"sep_state \\ sep_state \\ cdl_ghost_state\"\nwhere\n \"cdl_ghost_state_add state_a state_b \\ \\obj_id.\n let heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in if heap_a obj_id = None \\ heap_b obj_id \\ None then gs_b obj_id\n else if heap_b obj_id = None \\ heap_a obj_id \\ None then gs_a obj_id\n else gs_a obj_id \\ gs_b obj_id\"\n\n\n(* Adding states adds their heaps,\n * and each objects owns whichever fields it owned in either heap.\n *)\ndefinition\n sep_state_add :: \"sep_state \\ sep_state \\ sep_state\"\nwhere\n \"sep_state_add state_a state_b \\\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n SepState (cdl_heap_add state_a state_b) (cdl_ghost_state_add state_a state_b)\"\n\n\n(* Heaps are disjoint if for all of their objects:\n * the caps of their respective objects are disjoint,\n * their respective objects don't conflict,\n * they don't both own any of the same fields.\n*)\ndefinition\n sep_state_disj :: \"sep_state \\ sep_state \\ bool\"\nwhere\n \"sep_state_disj state_a state_b \\\n let\n heap_a = sep_heap state_a;\n heap_b = sep_heap state_b;\n gs_a = sep_ghost_state state_a;\n gs_b = sep_ghost_state state_b\n in\n \\obj_id. not_conflicting_objects state_a state_b obj_id\"\n\nlemma not_conflicting_objects_comm:\n \"not_conflicting_objects h1 h2 obj = not_conflicting_objects h2 h1 obj\"\n apply (clarsimp simp: not_conflicting_objects_def split:option.splits)\n apply (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\nlemma object_clean_comm:\n \"\\object_type obj_a = object_type obj_b;\n object_slots obj_a ++ object_slots obj_b = object_slots obj_b ++ object_slots obj_a; None \\ cmp\\\n \\ object_clean (add_to_slots (object_slots obj_a) obj_b) cmp =\n object_clean (add_to_slots (object_slots obj_b) obj_a) cmp\"\n apply (clarsimp simp: object_type_def split: cdl_object.splits)\n apply (clarsimp simp: object_clean_def object_clean_slots_def object_clean_fields_def\n add_to_slots_def object_slots_def update_slots_def\n cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)+\n done\n\nlemma add_to_slots_object_slots:\n \"object_type y = object_type z\n \\ add_to_slots (object_slots (add_to_slots (x) y)) z =\n add_to_slots (x ++ object_slots y) z\"\n apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n apply (fastforce simp: object_type_def cdl_tcb.splits cdl_cnode.splits\n split: cdl_object.splits)\n done\n\nlemma not_conflicting_objects_empty [simp]:\n \"not_conflicting_objects s (SepState empty (\\obj_id. {})) obj_id\"\n by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma empty_not_conflicting_objects [simp]:\n \"not_conflicting_objects (SepState empty (\\obj_id. {})) s obj_id\"\n by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma not_conflicting_objects_empty_object [elim!]:\n \"(sep_heap x) obj_id = None \\ not_conflicting_objects x y obj_id\"\n by (clarsimp simp: not_conflicting_objects_def)\n\nlemma empty_object_not_conflicting_objects [elim!]:\n \"(sep_heap y) obj_id = None \\ not_conflicting_objects x y obj_id\"\n apply (drule not_conflicting_objects_empty_object [where y=x])\n apply (clarsimp simp: not_conflicting_objects_comm)\n done\n\nlemma cdl_heap_add_empty [simp]:\n \"cdl_heap_add (SepState h gs) (SepState empty (\\obj_id. {})) = h\"\n by (simp add: cdl_heap_add_def)\n\nlemma empty_cdl_heap_add [simp]:\n \"cdl_heap_add (SepState empty (\\obj_id. {})) (SepState h gs)= h\"\n apply (simp add: cdl_heap_add_def)\n apply (rule ext)\n apply (clarsimp split: option.splits)\n done\n\nlemma map_add_result_empty1: \"a ++ b = empty \\ a = empty\"\n apply (subgoal_tac \"dom (a++b) = {}\")\n apply (subgoal_tac \"dom (a) = {}\")\n apply clarsimp\n apply (unfold dom_map_add)[1]\n apply clarsimp\n apply clarsimp\n done\n\nlemma map_add_result_empty2: \"a ++ b = empty \\ b = empty\"\n apply (subgoal_tac \"dom (a++b) = {}\")\n apply (subgoal_tac \"dom (a) = {}\")\n apply clarsimp\n apply (unfold dom_map_add)[1]\n apply clarsimp\n apply clarsimp\n done\n\nlemma map_add_emptyE [elim!]: \"\\a ++ b = empty; \\a = empty; b = empty\\ \\ R\\ \\ R\"\n apply (frule map_add_result_empty1)\n apply (frule map_add_result_empty2)\n apply clarsimp\n done\n\nlemma clean_slots_empty [simp]:\n \"clean_slots empty cmp = empty\"\n by (clarsimp simp: clean_slots_def)\n\nlemma object_type_update_slots [simp]:\n \"object_type (update_slots slots x) = object_type x\"\n by (clarsimp simp: object_type_def update_slots_def split: cdl_object.splits)\n\nlemma object_type_object_clean_slots [simp]:\n \"object_type (object_clean_slots x cmp) = object_type x\"\n by (clarsimp simp: object_clean_slots_def)\n\nlemma object_type_object_clean_fields [simp]:\n \"object_type (object_clean_fields x cmp) = object_type x\"\n by (clarsimp simp: object_clean_fields_def object_type_def split: cdl_object.splits) \n\nlemma object_type_object_clean [simp]:\n \"object_type (object_clean x cmp) = object_type x\"\n by (clarsimp simp: object_clean_def)\n\nlemma object_type_add_to_slots [simp]:\n \"object_type (add_to_slots slots x) = object_type x\"\n by (clarsimp simp: object_type_def add_to_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_update_slots [simp]:\n \"has_slots obj \\ object_slots (update_slots slots obj) = slots\"\n by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n split: cdl_object.splits)\n\nlemma object_slots_update_slots_empty [simp]:\n \"\\has_slots obj \\ object_slots (update_slots slots obj) = empty\"\n by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n split: cdl_object.splits)\n\nlemma update_slots_no_slots [simp]:\n \"\\has_slots obj \\ update_slots slots obj = obj\"\n by (clarsimp simp: update_slots_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_update_slots [simp]:\n \"update_slots slots (update_slots slots' obj) = update_slots slots obj\"\n by (clarsimp simp: update_slots_def split: cdl_object.splits)\n\nlemma update_slots_same_object:\n \"a = b \\ update_slots a obj = update_slots b obj\"\n by (erule arg_cong)\n\nlemma object_type_has_slots:\n \"\\has_slots x; object_type x = object_type y\\ \\ has_slots y\"\n by (clarsimp simp: object_type_def has_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_fields [simp]:\n \"object_slots (object_clean_fields obj cmp) = object_slots obj\"\n by (clarsimp simp: object_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_slots [simp]:\n \"object_slots (object_clean_slots obj cmp) = clean_slots (object_slots obj) cmp\"\n by (clarsimp simp: object_clean_slots_def object_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean [simp]:\n \"object_slots (object_clean obj cmp) = clean_slots (object_slots obj) cmp\"\n by (clarsimp simp: object_clean_def)\n\nlemma object_slots_add_to_slots [simp]:\n \"object_type y = object_type z \\ object_slots (add_to_slots (object_slots y) z) = object_slots y ++ object_slots z\"\n by (clarsimp simp: object_slots_def add_to_slots_def update_slots_def object_type_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_slots [simp]:\n \"update_slots slots (object_clean_slots obj cmp) = update_slots slots obj\"\n by (clarsimp simp: object_clean_slots_def)\n\nlemma object_clean_fields_idem [simp]:\n \"object_clean_fields (object_clean_fields obj cmp) cmp = object_clean_fields obj cmp\"\n by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma object_clean_slots_idem [simp]:\n \"object_clean_slots (object_clean_slots obj cmp) cmp = object_clean_slots obj cmp\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: object_clean_slots_def clean_slots_def)+\n done\n\nlemma object_clean_fields_object_clean_slots [simp]:\n \"object_clean_fields (object_clean_slots obj gs) gs = object_clean_slots (object_clean_fields obj gs) gs\"\n by (clarsimp simp: object_clean_fields_def object_clean_slots_def\n clean_slots_def object_slots_def update_slots_def\n split: cdl_object.splits)\n\nlemma object_clean_idem [simp]:\n \"object_clean (object_clean obj cmp) cmp = object_clean obj cmp\"\n by (clarsimp simp: object_clean_def)\n\nlemma has_slots_object_clean_slots:\n \"has_slots (object_clean_slots obj cmp) = has_slots obj\"\n by (clarsimp simp: has_slots_def object_clean_slots_def update_slots_def split: cdl_object.splits)\n\nlemma has_slots_object_clean_fields:\n \"has_slots (object_clean_fields obj cmp) = has_slots obj\"\n by (clarsimp simp: has_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma has_slots_object_clean:\n \"has_slots (object_clean obj cmp) = has_slots obj\"\n by (clarsimp simp: object_clean_def has_slots_object_clean_slots has_slots_object_clean_fields)\n\nlemma object_slots_update_slots_object_clean_fields [simp]:\n \"object_slots (update_slots slots (object_clean_fields obj cmp)) = object_slots (update_slots slots obj)\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: has_slots_object_clean_fields)+\n done\n\nlemma object_clean_fields_update_slots [simp]:\n \"object_clean_fields (update_slots slots obj) cmp = update_slots slots (object_clean_fields obj cmp)\"\n by (clarsimp simp: object_clean_fields_def update_slots_def split: cdl_object.splits)\n\nlemma object_clean_fields_twice [simp]:\n \"(object_clean_fields (object_clean_fields obj cmp') cmp) = object_clean_fields obj (cmp \\ cmp')\"\n by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_fields:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'\\\n \\ update_slots slots (object_clean_fields obj cmps) =\n update_slots slots (object_clean_fields obj' cmps')\"\n by (fastforce simp: update_slots_def object_clean_fields_def object_type_def split: cdl_object.splits)\n\nlemma object_clean_fields_no_slots:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'; \\ has_slots obj; \\ has_slots obj'\\\n \\ object_clean_fields obj cmps = object_clean_fields obj' cmps'\"\n by (fastforce simp: object_clean_fields_def object_type_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_object_clean:\n \"\\None \\ cmps; None \\ cmps'; object_type obj = object_type obj'\\\n \\ update_slots slots (object_clean obj cmps) = update_slots slots (object_clean obj' cmps')\"\n apply (clarsimp simp: object_clean_def object_clean_slots_def)\n apply (erule (2) update_slots_object_clean_fields)\n done\n\nlemma cdl_heap_add_assoc':\n \"\\obj_id. not_conflicting_objects x z obj_id \\\n not_conflicting_objects y z obj_id \\\n not_conflicting_objects x z obj_id \\\n cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (rule ext)\n apply (rename_tac obj_id)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp simp: cdl_heap_add_def cdl_ghost_state_add_def not_conflicting_objects_def)\n apply (simp add: Let_unfold split: option.splits)\n apply (rename_tac obj_y obj_x obj_z)\n apply (clarsimp simp: object_add_def clean_slots_def object_clean_def object_clean_slots_def Let_unfold)\n apply (case_tac \"has_slots obj_z\")\n apply (subgoal_tac \"has_slots obj_y\")\n apply (subgoal_tac \"has_slots obj_x\")\n apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n map_add_restrict union_intersection | \n drule inter_empty_not_both | \n erule update_slots_object_clean_fields |\n erule object_type_has_slots, simp |\n simp | safe)+)[3]\n apply (subgoal_tac \"\\ has_slots obj_y\")\n apply (subgoal_tac \"\\ has_slots obj_x\")\n apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n map_add_restrict union_intersection | \n drule inter_empty_not_both | \n erule object_clean_fields_no_slots |\n erule object_type_has_slots, simp |\n simp | safe)+)\n apply (fastforce simp: object_type_has_slots)+\n done\n\nlemma cdl_heap_add_assoc:\n \"\\sep_state_disj x y; sep_state_disj y z; sep_state_disj x z\\\n \\ cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (clarsimp simp: sep_state_disj_def)\n apply (cut_tac cdl_heap_add_assoc')\n apply fast\n apply fastforce\n done\n\nlemma cdl_ghost_state_add_assoc:\n \"cdl_ghost_state_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n cdl_ghost_state_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n apply (rule ext)\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def Let_unfold)\n done\n\nlemma clean_slots_map_add_comm:\n \"cmps_a \\ cmps_b = {}\n \\ clean_slots slots_a cmps_a ++ clean_slots slots_b cmps_b =\n clean_slots slots_b cmps_b ++ clean_slots slots_a cmps_a\"\n apply (clarsimp simp: clean_slots_def)\n apply (drule the_set_inter_empty)\n apply (erule map_add_restrict_comm)\n done\n\nlemma object_clean_all:\n \"object_type obj_a = object_type obj_b \\ object_clean obj_b {} = object_clean obj_a {}\"\n apply (clarsimp simp: object_clean_def object_clean_slots_def clean_slots_def the_set_def)\n apply (rule_tac cmps'1=\"{}\" and obj'1=\"obj_a\" in trans [OF update_slots_object_clean_fields], fastforce+)\n done\n\nlemma object_add_comm:\n \"\\object_type obj_a = object_type obj_b; cmps_a \\ cmps_b = {}\\\n \\ object_add obj_a obj_b cmps_a cmps_b = object_add obj_b obj_a cmps_b cmps_a\"\n apply (clarsimp simp: object_add_def Let_unfold)\n apply (rule conjI | clarsimp)+\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n apply (rule conjI | clarsimp)+\n apply (erule object_clean_all)\n apply (clarsimp)\n apply (rule_tac cmps'1=cmps_b and obj'1=obj_b in trans [OF update_slots_object_clean], assumption+)\n apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n apply fastforce\n done\n\nlemma sep_state_add_comm:\n \"sep_state_disj x y \\ sep_state_add x y = sep_state_add y x\"\n apply (clarsimp simp: sep_state_add_def sep_state_disj_def)\n apply (rule conjI)\n apply (case_tac x, case_tac y, clarsimp)\n apply (rename_tac heap_a gs_a heap_b gs_b)\n apply (clarsimp simp: cdl_heap_add_def Let_unfold)\n apply (rule ext)\n apply (case_tac \"heap_a obj_id\")\n apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n apply (rename_tac obj_a obj_b)\n apply (erule_tac x=obj_id in allE)\n apply (rule object_add_comm)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (rule ext, fastforce simp: cdl_ghost_state_add_def Let_unfold Un_commute)\n done\n\nlemma add_to_slots_comm:\n \"\\object_slots y_obj \\ object_slots z_obj; update_slots empty y_obj = update_slots empty z_obj \\\n \\ add_to_slots (object_slots z_obj) y_obj = add_to_slots (object_slots y_obj) z_obj\"\n by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n cdl_tcb.splits cdl_cnode.splits\n dest!: map_add_com\n split: cdl_object.splits)\n\nlemma cdl_heap_add_none1:\n \"cdl_heap_add x y obj_id = None \\ (sep_heap x) obj_id = None\"\n by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma cdl_heap_add_none2:\n \"cdl_heap_add x y obj_id = None \\ (sep_heap y) obj_id = None\"\n by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma object_type_object_addL:\n \"object_type obj = object_type obj'\n \\ object_type (object_add obj obj' cmp cmp') = object_type obj\"\n by (clarsimp simp: object_add_def Let_unfold)\n\nlemma object_type_object_addR:\n \"object_type obj = object_type obj'\n \\ object_type (object_add obj obj' cmp cmp') = object_type obj'\"\n by (clarsimp simp: object_add_def Let_unfold)\n\nlemma sep_state_add_disjL:\n \"\\sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\ \\ sep_state_disj x y\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\nlemma sep_state_add_disjR:\n \"\\sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\ \\ sep_state_disj x z\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\nlemma sep_state_add_disj:\n \"\\sep_state_disj y z; sep_state_disj x y; sep_state_disj x z\\ \\ sep_state_disj x (sep_state_add y z)\"\n apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n apply (rename_tac obj_id)\n apply (clarsimp simp: not_conflicting_objects_def)\n apply (erule_tac x=obj_id in allE)+\n apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n split: option.splits)\n done\n\n\n\n\n(*********************************************)\n(* Definition of separation logic for capDL. *)\n(*********************************************)\n\ninstantiation \"sep_state\" :: zero\nbegin\n definition \"0 \\ SepState empty (\\obj_id. {})\"\n instance ..\nend\n\ninstantiation \"sep_state\" :: stronger_sep_algebra\nbegin\n\ndefinition \"(op ##) \\ sep_state_disj\"\ndefinition \"(op +) \\ sep_state_add\"\n\n\n\n(**********************************************\n * The proof that this is a separation logic. *\n **********************************************)\n\ninstance\n apply intro_classes\n(* x ## 0 *)\n apply (simp add: sep_disj_sep_state_def sep_state_disj_def zero_sep_state_def)\n(* x ## y \\ y ## x *)\n apply (clarsimp simp: not_conflicting_objects_comm sep_disj_sep_state_def sep_state_disj_def Let_unfold\n map_disj_com Int_commute)\n(* x + 0 = x *)\n apply (simp add: plus_sep_state_def sep_state_add_def zero_sep_state_def)\n apply (case_tac x)\n apply (clarsimp simp: cdl_heap_add_def)\n apply (rule ext)\n apply (clarsimp simp: cdl_ghost_state_add_def split:if_split_asm)\n(* x ## y \\ x + y = y + x *)\n apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n apply (erule sep_state_add_comm)\n(* (x + y) + z = x + (y + z) *)\n apply (simp add: plus_sep_state_def sep_state_add_def)\n apply (rule conjI)\n apply (clarsimp simp: sep_disj_sep_state_def)\n apply (erule (2) cdl_heap_add_assoc)\n apply (rule cdl_ghost_state_add_assoc)\n(* x ## y + z = (x ## y \\ x ## z) *)\n apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n apply (rule iffI)\n (* x ## y + z \\ (x ## y \\ x ## z) *)\n apply (rule conjI)\n (* x ## y + z \\ (x ## y) *)\n apply (erule (1) sep_state_add_disjL)\n (* x ## y + z \\ (x ## z) *)\n apply (erule (1) sep_state_add_disjR)\n (* x ## y + z \\ (x ## y \\ x ## z) *)\n apply clarsimp\n apply (erule (2) sep_state_add_disj)\n done\n\nend\n\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/ex/capDL/Abstract_Separation_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.36658973632215985, "lm_q1q2_score": 0.18472683018536493}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__115.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__115 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__115 and some rule r*}\nlemma n_NI_Local_Get_Put_HeadVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__115:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__115:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__115:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__115:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__115:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__115:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__115:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_exists_HomeVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_exists_Home src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_existsVsinv__115:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__115:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__115:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__115:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Nak_ClearVsinv__115:\nassumes a1: \"(r=n_NI_Nak_Clear )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__115:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__115 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__115:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__115:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__115:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__115:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__115:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__115:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__115:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__115:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__115:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__115:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__115:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__115:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__115:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__115:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__115:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__115:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__115:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__115:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__115:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__115:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__115.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3665897294020099, "lm_q1q2_score": 0.18472682669825868}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__27_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__27_on_rules imports n_german_lemma_on_inv__27\nbegin\nsection{*All lemmas on causal relation between inv__27*}\nlemma lemma_inv__27_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__27) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__27_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.34510527095787247, "lm_q1q2_score": 0.18466528820031855}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory SubMonad_AI\nimports KHeap_AI\nbegin\n\n(* SubMonadLib *)\nlemma submonad_do_machine_op:\n \"submonad machine_state (machine_state_update \\ K) \\ do_machine_op\"\n apply unfold_locales\n apply (clarsimp simp: ext stateAssert_def do_machine_op_def o_def gets_def\n get_def bind_def return_def submonad_fn_def)+\n done\n\ninterpretation submonad_do_machine_op:\n submonad machine_state \"(machine_state_update \\ K)\" \\ do_machine_op\n by (rule submonad_do_machine_op)\n\nlemma submonad_args_pspace:\n \"submonad_args kheap (kheap_update o (\\x _. x)) \\\"\n by (simp add: submonad_args_def)\n\nschematic_goal assert_get_tcb_pspace:\n \"gets_the (get_tcb t) = submonad_fn kheap (kheap_update o (\\x _. x)) \\ ?f\"\n apply (unfold gets_the_def)\n apply (rule submonad_bind_alt [OF submonad_args_pspace])\n apply (rule gets_submonad [OF submonad_args_pspace _ refl])\n apply (simp add: get_tcb_def)\n apply (rule assert_opt_submonad [OF submonad_args_pspace])\n apply simp\n apply (rule empty_fail_assert_opt)\n done\n\nlemma assert_get_thread_do_machine_op_comm:\n \"empty_fail m' \\\n do x \\ gets_the (get_tcb t); y \\ do_machine_op m'; n x y od =\n do y \\ do_machine_op m'; x \\ gets_the (get_tcb t); n x y od\"\n apply (rule submonad_comm2 [OF _ _ submonad_do_machine_op])\n apply (rule submonad_args_pspace)\n apply (rule assert_get_tcb_pspace)\n apply (simp add: empty_fail_cond)+\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/SubMonad_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.3451052709578724, "lm_q1q2_score": 0.18466528820031852}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory InitCSpace_SI\nimports\n \"../proof/capDL-api/CNode_DP\"\n ObjectInitialised_SI\n RootTask_SI\n SysInit_SI\nbegin\n\n(****************************\n * Move me\n *****************************)\n\nlemma sum_less:\n \"\\(a::nat) \\ a'; a' + b \\ c\\ \\ a + b \\ c\"\n by auto\n\nlemma mask_smaller:\n \"((x::word32) && mask n) \\ x\"\n by (metis word_and_le2)\n\n(* Not used by might be useful someday *)\nlemma map_of_zip_is_Some2:\n \"\\length xs = length ys; distinct xs\\\n \\ (y \\ set ys) = (\\x. map_of (zip xs ys) x = Some y)\"\n apply (subst ran_map_of_zip [symmetric, where xs=xs and ys=ys], simp+)\n apply (rule)\n apply (metis map_of_SomeD ranE)\n apply (clarsimp simp: ran_def)\n done\n\n(* Not used by might be useful someday *)\nlemma map_of_zip_is_Some2':\n \"\\length xs \\ length ys; distinct xs; map_of (zip xs ys) x = Some y\\ \\ y \\ set ys\"\n apply (subst (asm) zip_take_length[symmetric])\n apply (drule iffD2 [OF map_of_zip_is_Some2, rotated], fast)\n apply (clarsimp simp: min_def)\n by (rule in_set_takeD)\n\n(*********************\n Moved to capDL somewhere.\n *)\n\nlemma object_slot_spec2s:\n \"object_slots obj slot = object_slots obj' slot\n \\ object_slots (spec2s t obj) slot =\n object_slots (spec2s t obj') slot\"\n apply (case_tac \"has_slots obj\")\n apply (case_tac \"has_slots obj'\")\n apply (clarsimp simp: spec2s_def)+\n apply (case_tac obj')\n apply (simp_all add:object_slots_def update_slots_def)\n done\n\nlemma irqhandler_cap_cap_irq [simp]:\n \"is_irqhandler_cap cap \\ IrqHandlerCap (cap_irq cap) = cap\"\n by (clarsimp simp: cap_type_def cap_irq_def split: cdl_cap.splits)\n\nlemma InitThreadCNode_guard_equal[simp]:\n \"guard_equal si_cspace_cap seL4_CapInitThreadCNode word_bits\"\n apply (clarsimp simp:seL4_CapInitThreadCNode_def word_bits_def)\n apply (rule guard_equal_si_cspace_cap)\n apply (simp add:si_cnode_size_def)\n done\n\nlemma default_cap_has_type:\n \"cap_type cap = Some type\n \\ cap_has_type (default_cap type ids sz dev)\"\n by (fastforce simp: default_cap_def cap_type_def\n split: cdl_cap.splits)\n\nlemma cap_has_type_update_cap_object[simp]:\n \"cap_has_type (update_cap_object client_object_id spec_cap)\n = cap_has_type spec_cap\"\n apply (case_tac spec_cap,\n (fastforce simp: cap_type_def update_cap_object_def)+)\n done\n\nlemma ep_related_cap_badge_of_default:\n \"\\ep_related_cap spec_cap; cap_type spec_cap = Some type\\\n \\ cap_badge (default_cap type {client_object_id} sz dev) = 0\"\n by (clarsimp simp: ep_related_cap_def cap_type_def\n default_cap_def cap_badge_def safe_for_derive_def\n split: cdl_cap.splits)\n\n\nlemma valid_src_cap_cnode_cap_size_le_32:\n \"valid_src_cap spec_cap (cap_data spec_cap) \\\n cnode_cap_size spec_cap \\ 32\"\n apply (case_tac \"is_cnode_cap spec_cap\")\n apply (clarsimp simp: valid_src_cap_def word_bits_def)\n apply (clarsimp simp: cnode_cap_size_def split: cdl_cap.splits)\n done\n\nlemma si_spec_irq_null_cap_at_si_spec_irq_cap_at_has_type:\n \"\\opt_cap (obj_id, slot) spec = Some spec_cap; cap_type spec_cap = Some type; type \\ IRQNodeType\\\n \\ si_spec_irq_null_cap_at irq_caps spec obj_id slot\n = si_spec_irq_cap_at irq_caps spec obj_id slot\"\n by (clarsimp simp: si_spec_irq_cap_at_def si_spec_irq_null_cap_at_def cap_at_def)\n\nlemma cnode_at_not_tcb_at:\n \"\\cnode_at obj_id spec \\\\ \\tcb_at obj_id spec\"\n apply (clarsimp simp: object_at_def is_cnode_def is_tcb_def)\n apply (case_tac object, simp_all)\n done\n\nlemma guard_size_well_formed:\n \"\\guard_size < guard_bits; (g::word32) < 2 ^ guard_size\\ \\\n g < 2 ^ (size g - 8)\"\n apply (frule (1) guard_less_guard_bits)\n apply (erule less_le_trans)\n apply (rule two_power_increasing)\n apply (clarsimp simp: word_bits_size word_bits_def guard_bits_def)\n apply (clarsimp simp: word_bits_size word_bits_def)\n done\n\nlemma well_formed_cap_valid_src_cap:\n \"well_formed_cap cap \\ valid_src_cap cap (cap_data cap)\"\n apply (clarsimp simp: valid_src_cap_def)\n apply (clarsimp simp: cap_data_def cnode_cap_size_def)\n apply (clarsimp simp: well_formed_cap_def cap_type_def guard_as_rawdata_def split: cdl_cap.splits)\n apply (rename_tac guard guard_size size_bits)\n apply (subst is_aligned_add_or [where n=8])\n apply (rule is_aligned_shift)\n apply (rule shiftl_less_t2n)\n apply (rule word_of_nat_less)\n apply (clarsimp simp: guard_bits_def)\n apply clarsimp\n apply (clarsimp simp: shiftr_over_or_dist)\n apply (subst shiftl_shiftr_id, simp+)\n apply (rule word_of_nat_less)\n apply (clarsimp simp: guard_bits_def)\n apply (subst shiftl_shiftr1, simp)\n apply clarsimp\n apply (subst less_mask_eq, erule (1) guard_size_well_formed)\n apply (subst word_ao_dist)\n apply (subst shiftl_mask_is_0, simp)\n apply (clarsimp simp: word_bits_size word_bits_def)\n apply (rule_tac a'=\"guard_size\" in sum_less)\n apply (cut_tac x=\"of_nat guard_size\" and n=5 in mask_smaller)\n apply (erule word_unat_less_le)\n apply simp\n done\n\nlemma well_formed_cap_has_object_has_type [simp]:\n \"\\well_formed_cap cap; cap_has_object cap\\ \\ cap_has_type cap\"\n by (clarsimp simp: cap_has_object_def well_formed_cap_def cap_type_def\n split: cdl_cap.splits)\n\n(* Needed? *)\nlemma si_spec_irq_cap_at_empty_cap_has_object:\n \"cap_at cap_has_object (obj_id, slot) spec\n \\ si_spec_irq_cap_at irq_caps spec obj_id slot = \\\"\n by (clarsimp simp: si_spec_irq_cap_at_def cap_at_def)\n\n(* Needed? *)\nlemma si_obj_cap_at_empty_cap_has_object:\n \"irqhandler_cap_at (obj_id, slot) spec\n \\ si_obj_cap_at t orig_caps spec False obj_id slot = \\\"\n by (clarsimp simp: si_obj_cap_at_def cap_at_def)\n\n(* MOVEME *)\nlemma well_formed_cap_no_object_irqhandler_cap:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap; cap \\ NullCap;\n \\ cap_at cap_has_object (obj_id, slot) spec\\\n \\ cap_at is_irqhandler_cap (obj_id, slot) spec\"\n apply (clarsimp simp: cap_at_def)\n apply (frule opt_cap_cdl_objects, clarsimp)\n apply (frule (1) object_slots_opt_capI)\n apply (drule (3) well_formed_well_formed_cap)\n apply (clarsimp simp: well_formed_cap_def cap_has_object_def\n split: cdl_cap.splits)\n done\n\n(**********************************************************************\n * Helper lemmas about CNodes, and when they are halfway initialised. *\n **********************************************************************)\n\nlemma valid_src_cap_if_cnode:\n \"\\cap_type spec_cap = Some type;\n is_cnode_cap spec_cap \\ sz = cnode_cap_size spec_cap;\n valid_src_cap spec_cap data\\\n \\ valid_src_cap (default_cap type {client_object_id} sz dev) data\"\n apply (clarsimp simp: valid_src_cap_def)\n apply (clarsimp simp: cnode_cap_size_def cap_type_def default_cap_def)\n done\n\nlemma default_cap_data_if_cnode:\n \"\\cap_type spec_cap = Some type;\n is_cnode_cap spec_cap \\ sz = cnode_cap_size spec_cap\\\n \\ (default_cap type m sz dev)\n = (default_cap type m (cnode_cap_size spec_cap) dev)\"\n by (case_tac spec_cap,\n (clarsimp simp: default_cap_def cap_type_def is_cnode_cap_simps)+)\n\n\n(************************************************************\n * A CNode slot that is half done is either done, or empty. *\n ************************************************************)\n\n\n\nlemma object_slots_cnode_half:\n \"\\\\original_cap_at (obj_id, slot) spec\\\n \\ object_slots (cnode_half spec obj_id obj) slot =\n object_slots obj slot\"\n apply (case_tac \"has_slots obj\")\n apply (clarsimp simp: cnode_half_def restrict_map_def)\n apply (clarsimp simp: cnode_half_def)\n done\n\nlemma cnode_slot_half_initialised_not_original_slot:\n \"\\original_cap_at (obj_id, slot) spec\n \\ cnode_slot_half_initialised spec t obj_id slot\n = object_slot_initialised spec t obj_id slot\"\n apply (clarsimp simp: cnode_slot_half_initialised_def object_slot_initialised_def)\n apply (clarsimp simp: object_initialised_general_def)\n apply (rule ext, rule iffI)\n apply (clarsimp simp: sep_map_s_def sep_map_general_def)\n apply (rule ext)\n apply (clarsimp simp: object_to_sep_state_def object_project_def\n object_slots_object_clean\n split: option.splits)\n apply (cut_tac obj = \"cnode_half spec obj_id spec_object\" and\n obj' = spec_object and slot=slot and t=t in object_slot_spec2s)\n apply (erule object_slots_cnode_half)\n apply clarsimp\n apply (clarsimp simp: sep_map_s_def sep_map_general_def)\n apply (rule ext)\n apply (clarsimp simp: object_to_sep_state_def object_project_def\n object_slots_object_clean\n split: option.splits)\n apply (cut_tac obj = \"cnode_half spec obj_id spec_object\" and\n obj' = spec_object and slot=slot and t=t in object_slot_spec2s)\n apply (erule object_slots_cnode_half)\n apply clarsimp\n done\n\nlemma slots_empty_cnode1:\n \"slot < 2 ^ sz\n \\ object_slots (CNode (empty_cnode sz)) slot = Some NullCap\"\n by (fastforce simp: object_slots_def empty_cnode_def empty_cap_map_def\n restrict_map_def cdl_cnode.splits)\n\nlemma slots_empty_cnode2:\n \"\\ slot < 2 ^ sz\n \\ object_slots (CNode (empty_cnode sz)) slot = None\"\n by (fastforce simp: object_slots_def empty_cnode_def empty_cap_map_def\n restrict_map_def cdl_cnode.splits)\n\nlemma slots_spec2s_cnode_half1:\n \"\\slot < 2 ^ sz; original_cap_at (obj_id, slot) spec; (cdl_cnode_caps cnode slot) \\ None\\\n \\ object_slots (spec2s t (cnode_half spec obj_id (CNode cnode))) slot\n = Some NullCap\"\n by (fastforce simp: object_slots_def cnode_half_def spec2s_def update_slots_def)\n\nlemma slots_spec2s_cnode_half2:\n \"\\\\ slot < 2 ^ sz; original_cap_at (obj_id, slot) spec; (cdl_cnode_caps cnode slot) = None\\\n \\ object_slots (spec2s t (cnode_half spec obj_id (CNode cnode))) slot\n = None\"\n by (fastforce simp: object_slots_def cnode_half_def spec2s_def update_slots_def\n restrict_map_def)\n\nlemma object_slots_spec2s_cnode_half_object_default_state:\n \"\\well_formed spec; original_cap_at (obj_id, slot) spec;\n cdl_objects spec obj_id = Some spec_object; is_cnode spec_object\\\n \\ object_slots (spec2s t (cnode_half spec obj_id spec_object)) slot =\n object_slots (object_default_state spec_object) slot\"\n apply (clarsimp simp: well_formed_def)\n apply (erule_tac x=obj_id in allE)\n apply (clarsimp simp: opt_object_def split: option.splits)\n apply (clarsimp simp: object_default_state_def2 is_cnode_def\n split: cdl_object.splits)\n apply (rename_tac cnode)\n apply (case_tac \"slot < 2 ^ cdl_cnode_size_bits cnode\")\n apply (frule slots_empty_cnode1)\n apply (frule_tac cnode=cnode and t=t in slots_spec2s_cnode_half1, assumption)\n apply (clarsimp simp: object_slots_def dom_def empty_cnode_def empty_cap_map_def)\n apply fastforce\n apply (clarsimp simp: update_slots_def empty_cnode_def spec2s_def cnode_half_def)\n apply (frule slots_empty_cnode2)\n apply (frule_tac cnode=cnode and t=t in slots_spec2s_cnode_half2, assumption)\n apply (fastforce simp: object_slots_def dom_def empty_cnode_def empty_cap_map_def)\n apply clarsimp\n done\n\nlemma cnode_slot_half_initialised_original_slot:\n \"\\well_formed spec; original_cap_at (obj_id, slot) spec; cnode_at obj_id spec\\\n \\ cnode_slot_half_initialised spec t obj_id slot\n = object_slot_empty spec t obj_id slot\"\n apply (clarsimp simp: object_at_def)\n apply (frule (1) well_formed_object_slots)\n apply (clarsimp simp: cnode_slot_half_initialised_def object_slot_empty_def)\n apply (clarsimp simp: object_initialised_general_def)\n apply (rule ext, rule iffI)\n apply (clarsimp simp: sep_map_s_def sep_map_general_def)\n apply (rule ext, clarsimp simp:object_to_sep_state_def\n object_project_def object_slots_object_clean)\n apply (subst object_slots_spec2s_cnode_half_object_default_state)\n apply simp+\n apply (clarsimp simp: object_at_def)+\n apply (clarsimp simp: sep_map_s_def sep_map_general_def)\n apply (rule ext)\n apply (clarsimp simp:object_to_sep_state_def object_project_def object_slots_object_clean)\n apply (subst object_slots_spec2s_cnode_half_object_default_state, simp+)\n apply (clarsimp split: option.splits)\n done\n\n(**************************\n **************************\n * init_cspace proof *\n **************************\n **************************)\n\nlemma default_cap_cnode_dev:\n \"default_cap CNodeType a b dev = CNodeCap (pick a) 0 0 b\"\n by (simp add:default_cap_def)\n\nlemma mint_pre:\n \"\\well_formed spec; cnode_at obj_id spec;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n spec_cap \\ NullCap;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n data = cap_badge spec_cap;\n\n Some dest_root = dup_caps obj_id;\n dest_index = of_nat slot;\n (dest_depth::word32) = of_nat (object_size_bits spec_obj);\n\n src_root = seL4_CapInitThreadCNode;\n Some src_index = orig_caps (cap_object spec_cap);\n src_index < 2 ^ si_cnode_size;\n src_depth = (32::word32);\n\n rights = cap_rights spec_cap;\n\n \\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s;\n\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_object;\n\n dest_root_slot = offset dest_root si_cnode_size;\n cnode_cap_slot = offset src_root si_cnode_size;\n src_slot = offset src_index si_cnode_size;\n t obj_id = Some dest_id;\n default_cap CNodeType {dest_id} dest_size False = dest_root_cap;\n\n object_size_bits spec_obj = dest_size;\n dest_slot = offset dest_index dest_size;\n t (cap_object spec_cap) = Some client_object_id;\n default_cap type {client_object_id} (object_size_bits spec_cap_object) = src_cap\\\n \\\n \\si_tcb_id \\f root_tcb \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n\n (* Root CNode. *)\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n (* Client cnode. *)\n dest_id \\f CNode (empty_cnode dest_size) \\*\n\n (* Cap to the root CNode. *)\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (* Cap to the client CNode. *)\n (si_cnode_id, dest_root_slot) \\c dest_root_cap \\*\n (* Cap that the root task has to it's own CNode. *)\n (si_cnode_id, cnode_cap_slot) \\c si_cnode_cap \\*\n (* Cap to be copied, in the root CNode. *)\n (si_cnode_id, src_slot) \\c src_cap dev \\*\n (* Where to copy the cap (in the client CNode). *)\n (dest_id, dest_slot) \\c NullCap \\*\n (* IRQ control cap *)\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n (* ASID caps. *)\n si_asid \\*\n R\\ s \\\n\n (* Cap slots match their cptrs. *)\n one_lvl_lookup si_cspace_cap 32 si_cnode_size \\\n one_lvl_lookup si_cspace_cap 32 si_cnode_size \\\n one_lvl_lookup si_cspace_cap (unat src_depth) si_cnode_size \\\n one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \\\n\n unat src_depth \\ word_bits \\\n 0 < unat src_depth \\\n unat dest_depth \\ word_bits \\\n 0 < unat dest_depth \\\n is_tcb root_tcb \\\n is_cnode_cap dest_root_cap \\\n is_cnode_cap si_cspace_cap \\\n guard_equal si_cspace_cap src_index (unat src_depth) \\\n guard_equal dest_root_cap dest_index (unat dest_depth) \\\n\n Some dest_root = dup_caps obj_id \\\n Some src_index = orig_caps (cap_object spec_cap)\"\n apply clarsimp\n apply (frule (3) well_formed_types_match)\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (2) well_formed_cnode_object_size_bits)\n apply (clarsimp simp: object_slot_empty_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_cap_at_def sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def)\n apply (clarsimp simp: object_type_is_object)\n apply (rule conjI)\n apply (sep_drule sep_map_c_sep_map_s)\n apply (erule object_slots_object_default_state_NullCap [where obj_id=obj_id])\n apply (fastforce simp: object_at_def object_type_is_object)\n apply assumption\n apply assumption\n apply (subst offset_slot, assumption, simp)\n apply (subst offset_slot', assumption)\n apply (subst offset_slot', assumption)\n apply (subst empty_cnode_object_size_bits, simp add: object_type_is_object)\n apply (frule (1) well_formed_object_size_bits)\n apply (cut_tac obj_id=dest_id and obj'=spec_obj in\n sep_map_f_object_size_bits_cnode, (simp add: object_type_is_object)+)\n apply (simp add: default_cap_cnode_dev)\n apply (sep_solve add: sep_any_imp )\n apply (clarsimp simp: one_lvl_lookup_def)\n apply (drule guard_equal_si_cspace_cap)\n apply (clarsimp simp: default_cap_def object_type_is_object)\n apply (cut_tac x=\"object_size_bits spec_obj\" in unat_of_nat32)\n apply (insert n_less_equal_power_2 [where n=word_bits])\n apply (frule (1) well_formed_object_size_bits_word_bits)\n apply (metis lt_word_bits_lt_pow)\n apply (frule (1) well_formed_object_size_bits_word_bits)\n apply (drule guard_equal_si_cspace_cap)+\n apply clarsimp\n apply (clarsimp simp: word_bits_def guard_equal_def Let_unfold)\n apply (drule (1) well_formed_object_size_bits_word_bits)\n apply (simp add: word_bits_def)\n done\n\n\n\nlemma move_pre_irq_handler:\n \"\\well_formed spec; cnode_at obj_id spec;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n is_irqhandler_cap spec_cap;\n\n Some dest_root = dup_caps obj_id;\n dest_index = of_nat slot;\n (dest_depth::word32) = of_nat (object_size_bits spec_obj);\n\n src_root = seL4_CapInitThreadCNode;\n Some src_index = irq_caps (cap_irq spec_cap);\n src_index < 2 ^ si_cnode_size;\n src_depth = (32::word32);\n\n rights = cap_rights spec_cap;\n\n \\object_slot_empty spec t obj_id slot \\*\n si_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s;\n\n dest_root_slot = offset dest_root si_cnode_size;\n cnode_cap_slot = offset src_root si_cnode_size;\n src_slot = offset src_index si_cnode_size;\n t obj_id = Some dest_id;\n default_cap CNodeType {dest_id} dest_size False = dest_root_cap;\n\n object_size_bits spec_obj = dest_size;\n dest_slot = offset dest_index dest_size\\\n \\\n \\si_tcb_id \\f root_tcb \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n\n (* Root CNode. *)\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n (* Client cnode. *)\n dest_id \\f CNode (empty_cnode dest_size) \\*\n\n (* Cap to the root CNode. *)\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (* Cap to the client CNode. *)\n (si_cnode_id, dest_root_slot) \\c dest_root_cap \\*\n (* Cap that the root task has to it's own CNode. *)\n (si_cnode_id, cnode_cap_slot) \\c si_cnode_cap \\*\n (* Cap to be copied, in the root CNode. *)\n (si_cnode_id, src_slot) \\c spec_cap \\*\n (* Where to copy the cap (in the client CNode). *)\n (dest_id, dest_slot) \\c NullCap \\*\n (* IRQ control cap *)\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n (* ASID caps. *)\n si_asid \\*\n R\\ s \\\n\n (* Cap slots match their cptrs. *)\n one_lvl_lookup si_cspace_cap 32 si_cnode_size \\\n one_lvl_lookup si_cspace_cap 32 si_cnode_size \\\n one_lvl_lookup si_cspace_cap (unat src_depth) si_cnode_size \\\n one_lvl_lookup dest_root_cap (unat dest_depth) dest_size \\\n\n unat src_depth \\ word_bits \\\n 0 < unat src_depth \\\n unat dest_depth \\ word_bits \\\n 0 < unat dest_depth \\\n is_tcb root_tcb \\\n is_cnode_cap dest_root_cap \\\n is_cnode_cap si_cspace_cap \\\n guard_equal si_cspace_cap src_index (unat src_depth) \\\n guard_equal dest_root_cap dest_index (unat dest_depth) \\\n\n Some dest_root = dup_caps obj_id \\\n Some src_index = irq_caps (cap_irq spec_cap)\"\n apply clarsimp\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (2) well_formed_cnode_object_size_bits)\n apply (clarsimp simp: object_slot_empty_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_cap_at_def si_irq_cap_at_def sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def)\n apply (clarsimp simp: object_type_is_object)\n apply (rule conjI)\n apply (sep_drule sep_map_c_sep_map_s)\n apply (erule object_slots_object_default_state_NullCap [where obj_id=obj_id])\n apply (fastforce simp: object_at_def object_type_is_object)\n apply assumption\n apply assumption\n apply (simp add:default_cap_cnode_dev)\n apply (subst offset_slot, assumption, simp)\n apply (subst offset_slot', assumption)\n apply (subst offset_slot', assumption)\n apply (subst empty_cnode_object_size_bits, simp add: object_type_is_object)\n apply (frule (1) well_formed_object_size_bits)\n apply (cut_tac obj_id=dest_id and obj'=spec_obj in\n sep_map_f_object_size_bits_cnode, (simp add: object_type_is_object)+)\n apply sep_solve\n apply (clarsimp simp: one_lvl_lookup_def)\n apply (drule guard_equal_si_cspace_cap)\n apply (clarsimp simp: default_cap_def object_type_is_object)\n apply (cut_tac x=\"object_size_bits spec_obj\" in unat_of_nat32)\n apply (insert n_less_equal_power_2 [where n=word_bits])\n apply (frule (1) well_formed_object_size_bits_word_bits)\n apply (metis lt_word_bits_lt_pow)\n apply (frule (1) well_formed_object_size_bits_word_bits)\n apply (drule guard_equal_si_cspace_cap)+\n apply clarsimp\n apply (clarsimp simp: word_bits_def guard_equal_def Let_unfold)\n apply (drule (1) well_formed_object_size_bits_word_bits)\n apply (simp add: word_bits_def)\n done\n\nlemma mint_post:\n \"\\well_formed spec;\n t obj_id = Some dest_id;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n dup_caps obj_id = Some dest_root;\n orig_caps (cap_object spec_cap) = Some src_index;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_object;\n t (cap_object spec_cap) = Some client_object_id;\n data = cap_data spec_cap;\n cnode_at obj_id spec;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n\n (* Remove me. *)\n \\ is_untyped_cap spec_cap;\n spec_cap \\ NullCap;\n\n \\si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n dest_id \\f CNode (empty_cnode (object_size_bits spec_obj)) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, offset dest_root si_cnode_size) \\c default_cap CNodeType {dest_id} (object_size_bits spec_obj) False \\*\n (si_cnode_id, offset seL4_CapInitThreadCNode si_cnode_size) \\c si_cnode_cap \\*\n (si_cnode_id, offset src_index si_cnode_size) \\c default_cap type {client_object_id} (object_size_bits spec_cap_object) dev \\*\n (dest_id, offset (of_nat slot) (object_size_bits spec_obj)) \\c\n derived_cap (update_cap_data_det data\n (update_cap_rights (cap_rights (default_cap type {client_object_id} (object_size_bits spec_cap_object) dev) \\ cap_rights spec_cap)\n (default_cap type {client_object_id} (cnode_cap_size spec_cap) (is_device_cap spec_cap)))) \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid \\* R\\ s\\\n \\\n \\object_slot_initialised spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\"\n apply (frule (3) well_formed_types_match)\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (1) well_formed_object_slots, simp)\n apply (clarsimp simp: object_slot_initialised_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_cap_at_def sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def object_type_is_object)\n apply (frule_tac obj_id=dest_id in empty_cnode_object_size_bits, clarsimp)\n apply (cut_tac slot=slot in offset_slot, assumption, simp, simp)\n apply (subst sep_map_s_sep_map_c_eq [where cap=\"update_cap_object client_object_id spec_cap\"])\n apply (rule object_slots_spec2s, (clarsimp simp: opt_cap_def slots_of_def opt_object_def)+)\n apply (frule (2) well_formed_well_formed_cap, clarsimp simp: cap_has_object_def)\n apply (frule (2) well_formed_vm_cap_has_asid)\n apply (frule (1) well_formed_is_fake_vm_cap,\n (assumption|simp add: object_type_is_object)+)\n apply (clarsimp simp: cap_rights_inter_default_cap_rights)\n apply (subst (asm) update_cap_rights_and_data,(assumption|clarsimp)+)\n apply (subst (asm) offset_slot', assumption)+\n apply (clarsimp simp: default_cap_cnode_dev)\n apply sep_solve\n done\n\nlemma mutate_post:\n \"\\well_formed spec; original_cap_at (obj_id, slot) spec;\n t obj_id = Some dest_id;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n dup_caps obj_id = Some dest_root;\n orig_caps (cap_object spec_cap) = Some src_index;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_object;\n t (cap_object spec_cap) = Some client_object_id;\n data = cap_data spec_cap;\n cnode_at obj_id spec;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n\n \\ is_untyped_cap spec_cap;\n spec_cap \\ NullCap;\n \\si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n dest_id \\f CNode (empty_cnode (object_size_bits spec_obj)) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, offset dest_root si_cnode_size) \\c default_cap CNodeType {dest_id} (object_size_bits spec_obj) False \\*\n (si_cnode_id, offset seL4_CapInitThreadCNode si_cnode_size) \\c si_cnode_cap \\*\n (si_cnode_id, offset src_index si_cnode_size) \\c NullCap \\*\n (dest_id, offset (of_nat slot) (object_size_bits spec_obj)) \\c\n update_cap_data_det data (default_cap type {client_object_id} (cnode_cap_size spec_cap) dev) \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid \\* R\\ s\\\n \\\n \\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\"\n apply (frule (3) well_formed_types_match)\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (1) well_formed_object_slots, simp)\n apply (clarsimp simp: object_slot_initialised_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_null_cap_at_def si_cap_at_def sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def object_type_is_object)\n apply (frule_tac obj_id=dest_id in empty_cnode_object_size_bits, clarsimp)\n apply (cut_tac slot=slot in offset_slot, assumption, simp, simp)\n apply (subst sep_map_s_sep_map_c_eq [where cap=\"update_cap_object client_object_id spec_cap\"])\n apply (rule object_slots_spec2s, (clarsimp simp: opt_cap_def slots_of_def opt_object_def)+)\n apply (frule (2) well_formed_well_formed_cap, clarsimp simp: cap_has_object_def)\n apply (frule (2) well_formed_vm_cap_has_asid)\n apply (frule (1) well_formed_is_fake_vm_cap,\n (assumption|simp add: object_type_is_object)+)\n apply (subst update_cap_data [symmetric], simp+)\n apply (clarsimp simp: cap_has_object_not_irqhandler_cap)\n apply (erule well_formed_orig_caps, (simp add: slots_of_def opt_object_def)+)\n apply (subst (asm) offset_slot', assumption)+\n apply (clarsimp simp: default_cap_cnode_dev)\n apply sep_solve\n done\n\nlemma move_post:\n \"\\well_formed spec; original_cap_at (obj_id, slot) spec;\n t obj_id = Some dest_id;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n dup_caps obj_id = Some dest_root;\n orig_caps (cap_object spec_cap) = Some src_index;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_object;\n t (cap_object spec_cap) = Some client_object_id;\n cap_has_object spec_cap;\n data = cap_data spec_cap;\n spec_cap \\ NullCap;\n cnode_at obj_id spec;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n \\ is_untyped_cap spec_cap;\n \\si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n dest_id \\f CNode (empty_cnode (object_size_bits spec_obj)) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, offset dest_root si_cnode_size) \\c default_cap CNodeType {dest_id} (object_size_bits spec_obj) False \\*\n (si_cnode_id, offset seL4_CapInitThreadCNode si_cnode_size) \\c si_cnode_cap \\*\n (si_cnode_id, offset src_index si_cnode_size) \\c NullCap \\*\n (dest_id, offset (of_nat slot) (object_size_bits spec_obj)) \\c\n update_cap_object client_object_id spec_cap \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid \\* R\\ s\\\n \\\n \\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\"\n apply (frule (3) well_formed_types_match)\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (1) well_formed_object_slots, simp)\n apply (clarsimp simp: object_slot_initialised_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_null_cap_at_def si_cap_at_def sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def object_type_is_object)\n apply (frule_tac obj_id=dest_id in empty_cnode_object_size_bits, clarsimp)\n apply (cut_tac slot=slot in offset_slot, assumption, simp, simp)\n apply (subst sep_map_s_sep_map_c_eq [where cap=\"update_cap_object client_object_id spec_cap\"])\n apply (rule object_slots_spec2s, (clarsimp simp: opt_cap_def slots_of_def opt_object_def)+)\n apply (subst (asm) offset_slot', assumption)+\n apply (clarsimp simp: default_cap_cnode_dev)\n apply sep_solve\n done\n\nlemma move_post_irq_handler:\n \"\\well_formed spec;\n t obj_id = Some dest_id;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n dup_caps obj_id = Some dest_root;\n irq_caps (cap_irq spec_cap) = Some src_index;\n is_irqhandler_cap spec_cap;\n cnode_at obj_id spec;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n\n \\si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n dest_id \\f CNode (empty_cnode (object_size_bits spec_obj)) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, offset dest_root si_cnode_size) \\c default_cap CNodeType {dest_id} (object_size_bits spec_obj) False \\*\n (si_cnode_id, offset seL4_CapInitThreadCNode si_cnode_size) \\c si_cnode_cap \\*\n (si_cnode_id, offset src_index si_cnode_size) \\c NullCap \\*\n (dest_id, offset (of_nat slot) (object_size_bits spec_obj)) \\c spec_cap \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid \\* R\\ s\\\n \\\n \\object_slot_initialised spec t obj_id slot \\*\n si_null_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\"\n apply (frule (3) well_formed_slot_object_size_bits)\n apply (frule (1) well_formed_object_slots, simp)\n apply (clarsimp simp: object_slot_initialised_def object_fields_empty_def object_initialised_general_def)\n apply (clarsimp simp: si_objects_def)\n apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n apply (clarsimp simp: si_null_cap_at_def si_cap_at_def si_null_irq_cap_at_def\n sep_conj_assoc sep_conj_exists)\n apply (clarsimp simp: object_at_def object_type_is_object)\n apply (frule_tac obj_id=dest_id in empty_cnode_object_size_bits, clarsimp)\n apply (cut_tac slot=slot in offset_slot, assumption, simp, simp)\n apply (subst sep_map_s_sep_map_c_eq [where cap=spec_cap],\n (clarsimp simp: opt_cap_def slots_of_def opt_object_def)+)\n apply (subst (asm) offset_slot', assumption)+\n apply (clarsimp simp: default_cap_cnode_dev)\n apply sep_solve\n done\n\nlemma seL4_CNode_Mutate_object_slot_initialised_sep_helper:\n \"\\well_formed spec;\n cdl_objects spec obj_id = Some spec_obj;\n cnode_at obj_id spec;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n spec_cap \\ NullCap;\n original_cap_at (obj_id, slot) spec;\n valid_src_cap spec_cap data;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n \\ ep_related_cap spec_cap;\n \\ is_untyped_cap spec_cap;\n data = cap_data spec_cap;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj;\n is_cnode_cap spec_cap \\ object_size_bits spec_cap_obj = cnode_cap_size spec_cap;\n t obj_id = Some dest_id;\n t (cap_object spec_cap) = Some client_object_id;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n Some dest_root = dup_caps obj_id;\n Some src_index = orig_caps (cap_object spec_cap)\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n seL4_CNode_Mutate dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32 data\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_chain)\n apply (rule_tac cnode_cap = si_cspace_cap\n and cnode_cap' = si_cnode_cap\n and dest_root_cap = \"default_cap CNodeType {dest_id} (object_size_bits spec_obj) False\"\n and root_size=si_cnode_size\n and src_root=seL4_CapInitThreadCNode\n and src_depth=32\n and tcb=root_tcb\n and src_cap = \"default_cap type {client_object_id} (object_size_bits spec_cap_obj) dev\"\n in seL4_CNode_Mutate_sep[where\n R = \"(si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\* si_asid \\* R\"])\n apply (assumption|simp add: ep_related_cap_default_cap\n default_cap_has_type valid_src_cap_if_cnode\n get_index_def)+\n apply (frule_tac s=s and dup_caps=dup_caps and\n t=t and orig_caps=orig_caps\n in mint_pre,(assumption|rule refl|simp)+)\n apply (elim conjE)\n apply clarsimp\n apply (intro conjI,\n simp_all add: has_type_default_not_non ep_related_cap_default_cap)\n apply (thin_tac \"\\P \\* Q \\s\" for P Q)\n apply sep_solve\n apply ((clarsimp simp: si_cnode_cap_def word_bits_def si_cspace_cap_def\n dest!: guard_equal_si_cspace_cap |\n rule is_cnode_cap_si_cnode_cap)+)[2]\n (* it works because si_cnode_cap = si_cspace_cap *)\n apply (drule_tac s=s and dest_root=dest_root and src_index=src_index and R=R\n in mutate_post, (assumption|simp|fastforce)+)[1]\n apply (subst(asm) default_cap_data_if_cnode, fastforce+)\n done\n\nlemma seL4_CNode_Move_object_slot_initialised_cap_has_object_sep_helper:\n \"\\well_formed spec;\n cdl_objects spec obj_id = Some spec_obj;\n cnode_at obj_id spec;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n spec_cap \\ NullCap;\n original_cap_at (obj_id, slot) spec;\n is_default_cap spec_cap;\n valid_src_cap spec_cap data;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n \\ is_untyped_cap spec_cap;\n \\ is_asidpool_cap spec_cap;\n data = cap_data spec_cap;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj;\n is_cnode_cap spec_cap \\ object_size_bits spec_cap_obj = cnode_cap_size spec_cap;\n t obj_id = Some dest_id;\n t (cap_object spec_cap) = Some client_object_id;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n Some dest_root = dup_caps obj_id;\n Some src_index = orig_caps (cap_object spec_cap)\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n seL4_CNode_Move dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_chain)\n apply (rule_tac cnode_cap = si_cspace_cap\n and cnode_cap' = si_cnode_cap\n and dest_root_cap = \"default_cap CNodeType {dest_id} (object_size_bits spec_obj) False\"\n and root_size=si_cnode_size\n and src_root=seL4_CapInitThreadCNode\n and src_depth=32\n and tcb=root_tcb\n and src_cap = \"default_cap type {client_object_id} (object_size_bits spec_cap_obj) dev\"\n in seL4_CNode_Move_sep[where\n R = \"(si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\* si_asid \\* R\"],\n (assumption|simp add: ep_related_cap_default_cap\n default_cap_has_type\n get_index_def)+)\n apply (frule_tac s=s and t=t and dup_caps=dup_caps and orig_caps=orig_caps\n in mint_pre,(assumption|rule refl|simp)+)\n apply (elim conjE)\n apply clarsimp\n apply (intro conjI,\n simp_all add:has_type_default_not_non ep_related_cap_default_cap)\n apply (thin_tac \"\\P \\* Q \\s\" for P Q)\n apply sep_solve\n apply ((clarsimp simp: si_cnode_cap_def word_bits_def si_cspace_cap_def\n dest!: guard_equal_si_cspace_cap |\n rule is_cnode_cap_si_cnode_cap)+)[2]\n (* it works because si_cnode_cap = si_cspace_cap *)\n apply (drule_tac s=s and dest_root=dest_root and src_index=src_index and R=R\n in move_post, (assumption|simp)+)\n apply sep_cancel+\n apply (drule cap_has_object_not_irqhandler_cap)\n apply (subst(asm) default_cap_data_if_cnode,simp+)\n apply clarsimp\n apply (subst(asm) default_cap_update_cap_object,\n (simp add: valid_src_cap_cnode_cap_size_le_32)+)\n done\n\nlemma seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep_helper:\n \"\\well_formed spec;\n cdl_objects spec obj_id = Some spec_obj;\n cnode_at obj_id spec;\n opt_cap (obj_id, slot) spec = Some spec_cap;\n is_irqhandler_cap spec_cap;\n t obj_id = Some dest_id;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n Some dest_root = dup_caps obj_id;\n Some src_index = irq_caps (cap_irq spec_cap)\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n seL4_CNode_Move dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_chain)\n apply (rule_tac cnode_cap = si_cspace_cap\n and cnode_cap' = si_cnode_cap\n and dest_root_cap = \"default_cap CNodeType {dest_id} (object_size_bits spec_obj) False\"\n and root_size=si_cnode_size\n and src_root=seL4_CapInitThreadCNode\n and src_depth=32\n and tcb=root_tcb\n and src_cap = \" IrqHandlerCap (cap_irq spec_cap)\"\n in seL4_CNode_Move_sep[where\n R = \"(si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\* si_asid \\* R\"],\n (assumption|simp add: ep_related_cap_default_cap\n default_cap_has_type\n get_index_def)+)\n apply (frule_tac s=s and t=t and dup_caps=dup_caps and irq_caps=irq_caps\n in move_pre_irq_handler,(assumption|rule refl|simp)+)\n apply (elim conjE)\n apply (intro conjI,\n simp_all add:has_type_default_not_non ep_related_cap_default_cap)\n apply (thin_tac \"\\P \\* Q \\s\" for P Q)\n apply (sep_solve add: sep_any_imp)\n apply ((clarsimp simp: si_cnode_cap_def word_bits_def si_cspace_cap_def\n dest!: guard_equal_si_cspace_cap |\n rule is_cnode_cap_si_cnode_cap)+)[2]\n (* it works because si_cnode_cap = si_cspace_cap *)\n apply (drule_tac s=s and dest_root=dest_root and src_index=src_index and R=R\n in move_post_irq_handler, (assumption|simp)+)\n done\n\nlemma seL4_CNode_Move_object_slot_initialised_cap_has_object_sep:\n \"\\\\s. well_formed spec \\ original_cap_at (obj_id, slot) spec \\\n data = cap_data spec_cap \\\n cap_has_object spec_cap \\\n cnode_at obj_id spec \\ cdl_objects spec obj_id = Some spec_obj \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\ spec_cap \\ NullCap \\\n cap_has_type spec_cap \\ valid_src_cap spec_cap data \\ (is_device_cap spec_cap = dev) \\\n \\is_untyped_cap spec_cap \\ is_default_cap spec_cap \\ \\ is_asidpool_cap spec_cap \\\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj \\\n (is_cnode_cap spec_cap \\ object_size_bits spec_cap_obj = cnode_cap_size spec_cap) \\\n Some dest_root = dup_caps obj_id \\\n Some src_index = orig_caps (cap_object spec_cap) \\\n \\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\\\n seL4_CNode_Move dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (elim conjE)\n apply (rule hoare_weaken_pre)\n apply clarsimp\n apply (rule_tac dest_id=\"the(t obj_id)\" and client_object_id=\"the(t (cap_object spec_cap))\"\n in seL4_CNode_Move_object_slot_initialised_cap_has_object_sep_helper, (assumption|simp)+)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = src_index\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t dup_caps spec (is_device_cap spec_cap) obj_id \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"])\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = dest_root and t=t and spec=spec\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t orig_caps spec (is_device_cap spec_cap) (cap_object spec_cap) \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"])\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp+\n done\n\n\nlemma seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep:\n \"\\\\s. well_formed spec \\\n cnode_at obj_id spec \\\n cdl_objects spec obj_id = Some spec_obj \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\\n is_irqhandler_cap spec_cap \\\n Some dest_root = dup_caps obj_id \\\n Some src_index = irq_caps (cap_irq spec_cap) \\\n \\object_slot_empty spec t obj_id slot \\*\n si_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\\\n seL4_CNode_Move dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (elim conjE)\n apply (rule hoare_weaken_pre)\n apply (rule_tac dest_id=\"the (t obj_id)\"\n in seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep_helper, (assumption|simp)+)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (sep_drule (direct) si_irq_cap_at_less_si_cnode_size, assumption+)\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size, assumption+)\n apply clarsimp\n done\n\nlemma seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep_new:\n \"\\\\object_slot_empty spec t obj_id slot \\*\n si_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\n and K( well_formed spec \\\n cnode_at obj_id spec \\\n cdl_objects spec obj_id = Some spec_obj \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\\n is_irqhandler_cap spec_cap \\\n Some dest_root = dup_caps obj_id \\\n Some src_index = irq_caps (cap_irq spec_cap))\\\n seL4_CNode_Move dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_irq_cap_at irq_caps spec (cap_irq spec_cap) \\*\n si_cap_at t dup_caps spec False obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (clarsimp)\n apply (wp sep_wp: seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep_helper\n [where dest_id=\"the(t obj_id)\" and t=t and obj_id=obj_id], (assumption|simp)+)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (sep_drule (direct) si_irq_cap_at_less_si_cnode_size, assumption+)\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size, assumption+)\n apply (sep_safe+, sep_solve)\n done\n\nlemma seL4_CNode_Mutate_object_slot_initialised_sep:\n \"\\\\s. well_formed spec \\ original_cap_at (obj_id, slot) spec \\\n data = cap_data spec_cap \\\n cnode_at obj_id spec \\ cdl_objects spec obj_id = Some spec_obj \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\ spec_cap \\ NullCap \\\n cap_has_type spec_cap \\ valid_src_cap spec_cap data \\ is_device_cap spec_cap = dev \\\n cap_has_object spec_cap \\\n \\ is_untyped_cap spec_cap \\ \\ ep_related_cap spec_cap \\\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj \\\n (is_cnode_cap spec_cap \\ object_size_bits spec_cap_obj = cnode_cap_size spec_cap) \\\n Some dest_root = dup_caps obj_id \\\n Some src_index = orig_caps (cap_object spec_cap) \\\n \\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s \\\n seL4_CNode_Mutate dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32 data\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_null_cap_at t orig_caps spec (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (elim conjE)\n apply (rule hoare_weaken_pre)\n apply clarsimp\n apply (rule_tac dest_id=\"the(t obj_id)\" and client_object_id=\"the(t (cap_object spec_cap))\"\n in seL4_CNode_Mutate_object_slot_initialised_sep_helper, (assumption|simp)+)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = src_index\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t dup_caps spec (is_device_cap spec_cap) obj_id \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"])\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = dest_root and t=t and spec=spec\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t orig_caps spec (is_device_cap spec_cap) (cap_object spec_cap) \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"] )\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp+\n done\n\nlemma irq_handler_cap_not_device[simp]:\n \"is_irqhandler_cap y \\ is_device_cap y = False\"\n by (auto simp:is_device_cap_def split:cdl_cap.splits)\n\nlemma init_cnode_slot_move_original_sep:\n \"\\well_formed spec; cnode_at obj_id spec;\n original_cap_at (obj_id, slot) spec;\n cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec\\ \\\n \\\\cnode_slot_half_initialised spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev obj_id slot \\*\n si_spec_irq_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n init_cnode_slot spec orig_caps dup_caps irq_caps Move obj_id slot\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_spec_obj_null_cap_at t orig_caps spec obj_id slot \\*\n si_spec_irq_null_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (subst cnode_slot_half_initialised_original_slot, assumption+)\n apply (frule cnode_at_not_tcb_at)\n\n (* Case: opt_cap (obj_id, slot) spec = Some NullCap *)\n apply (case_tac \"opt_cap (obj_id, slot) spec = Some NullCap\")\n apply (clarsimp simp: init_cnode_slot_def sep_conj_exists opt_object_def cap_at_def\n si_obj_cap_at_def si_spec_irq_cap_at_def\n si_spec_obj_null_cap_at_def si_spec_irq_null_cap_at_def)\n apply (frule opt_cap_cdl_objects)\n apply (wp | clarsimp)+\n apply (subst (asm) object_slot_empty_initialised_NullCap, assumption+)\n\n (* Case: opt_cap (obj_id, slot) spec = None *)\n apply (case_tac \"opt_cap (obj_id, slot) spec = None\")\n apply (clarsimp simp: init_cnode_slot_def assert_opt_def)\n apply clarsimp\n\n (* Case: cap_at cap_has_object (obj_id, slot) spec *)\n apply (case_tac \"cap_at cap_has_object (obj_id, slot) spec\")\n apply (clarsimp simp: cap_at_def)\n apply (rename_tac cap)\n apply (frule (2) well_formed_cap_object)\n apply (frule (2) well_formed_is_untyped_cap)\n apply (clarsimp simp: init_cnode_slot_def)\n apply (clarsimp simp: si_obj_cap_at_def si_obj_cap_at'_def cap_at_def\n si_spec_obj_null_cap_at_def si_spec_obj_null_cap_at'_def\n si_spec_irq_cap_at_def si_spec_irq_cap_at'_def\n si_spec_irq_null_cap_at_def si_spec_irq_null_cap_at'_def)\n apply (wp seL4_CNode_Mutate_object_slot_initialised_sep seL4_CNode_Move_object_slot_initialised_cap_has_object_sep |\n clarsimp)+\n apply (intro impI conjI,simp_all add:opt_object_def)\n apply (drule(1) well_formed_well_formed_cap[where obj_id = obj_id])\n apply (simp add:opt_cap_def opt_object_def slots_of_def)\n apply (simp add:cap_type_null)\n apply simp\n apply (metis cap_has_object_not_NullCap well_formed_cap_valid_src_cap well_formed_well_formed_cap')\n apply (metis cap_has_object_not_NullCap well_formed_orig_ep_cap_is_default)\n apply (simp add: ep_related_cap_def cap_type_def split:cdl_cap.splits)\n apply (erule (3) well_formed_cnode_object_size_bits_eq)\n apply (metis cap_has_object_NullCap well_formed_cap_has_object_has_type well_formed_well_formed_cap')\n apply (metis cap_has_object_NullCap well_formed_cap_valid_src_cap well_formed_well_formed_cap')\n apply (erule (3) well_formed_cnode_object_size_bits_eq)\n\n (* Case: cap_at is_irqhandler_cap (obj_id, slot) spec *)\n apply (frule (3) well_formed_cap_no_object_irqhandler_cap)\n apply (clarsimp simp: cap_at_def)\n apply (rename_tac cap)\n apply (clarsimp simp: init_cnode_slot_def)\n apply (clarsimp simp: si_obj_cap_at_def si_obj_cap_at'_def cap_at_def\n si_spec_obj_null_cap_at_def si_spec_obj_null_cap_at'_def\n si_spec_irq_cap_at_def si_spec_irq_cap_at'_def\n si_spec_irq_null_cap_at_def si_spec_irq_null_cap_at'_def)\n apply (wp seL4_CNode_Move_object_slot_initialised_irqhandler_cap_sep | clarsimp)+\n apply (clarsimp simp: opt_object_def)\n done\n\nlemma init_cnode_slot_move_not_original_inv:\n \"\\\\original_cap_at (obj_id, slot) spec\\\n \\ \\P\\ init_cnode_slot spec orig_caps dup_caps irq_caps Move obj_id slot \\\\_. P\\\"\n apply (clarsimp simp: init_cnode_slot_def cap_at_def)\n apply wp\n apply (rule hoare_pre_cont)\n apply (rule hoare_pre_cont)\n apply clarsimp\n apply wp+\n apply clarsimp\n done\n\nlemma si_obj_cap_at_si_spec_obj_null_cap_at_not_original:\n \"\\\\ original_cap_at (obj_id, slot) spec\\\n \\ si_obj_cap_at t si_caps spec dev obj_id slot =\n si_spec_obj_null_cap_at t si_caps spec obj_id slot\"\n by (clarsimp simp: si_obj_cap_at_def si_spec_obj_null_cap_at_def)\n\nlemma init_cnode_slot_move_not_original_sep:\n \"\\well_formed spec; cnode_at obj_id spec;\n \\ original_cap_at (obj_id, slot) spec\\ \\\n \\\\cnode_slot_half_initialised spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev obj_id slot \\*\n si_spec_irq_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n init_cnode_slot spec orig_caps dup_caps irq_caps Move obj_id slot\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_spec_obj_null_cap_at t orig_caps spec obj_id slot \\*\n si_spec_irq_null_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (wp init_cnode_slot_move_not_original_inv)\n apply (subst (asm) cnode_slot_half_initialised_not_original_slot, assumption+)\n apply (subst (asm) si_obj_cap_at_si_spec_obj_null_cap_at_not_original, assumption)\n apply (clarsimp simp: si_spec_irq_cap_at_def si_spec_irq_null_cap_at_def original_cap_at_def)\n done\n\nlemma init_cnode_slot_move_sep:\n \"\\well_formed spec; cnode_at obj_id spec;cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec\\ \\\n \\\\cnode_slot_half_initialised spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev obj_id slot \\*\n si_spec_irq_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n init_cnode_slot spec orig_caps dup_caps irq_caps Move obj_id slot\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_spec_obj_null_cap_at t orig_caps spec obj_id slot \\*\n si_spec_irq_null_cap_at irq_caps spec obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (case_tac \"original_cap_at (obj_id, slot) spec\")\n apply (wp init_cnode_slot_move_original_sep)\n apply (wp init_cnode_slot_move_not_original_sep)\n done\n\nlemma init_cnode_slots_move_sep:\n \"\\well_formed spec; cnode_at obj_id spec;\n \\slot\\ dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id,slot) spec\\ \\\n \\\\cnode_slots_half_initialised spec t obj_id \\*\n si_obj_caps_at t orig_caps spec dev obj_id \\*\n si_spec_irq_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\n init_cnode spec orig_caps dup_caps irq_caps Move obj_id\n \\\\_.\\object_slots_initialised spec t obj_id \\*\n si_spec_obj_null_caps_at t orig_caps spec obj_id \\*\n si_spec_irq_null_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (simp add: init_cnode_def si_obj_caps_at_def si_spec_obj_null_caps_at_def\n si_spec_irq_caps_at_def si_spec_irq_null_caps_at_def)\n apply (frule_tac obj_id=obj_id and t=t in cnode_slots_half_initialised_decomp, fastforce+)\n apply (cut_tac obj_id=obj_id and t=t in object_slots_initialised_decomp, fastforce+)\n apply simp\n apply (subst cnode_empty_slots_half_initialised_object_empty_slots_initialised)\n apply (simp add: sep_conj_assoc)\n apply (rule hoare_chain)\n apply (rule_tac mapM_x_set_sep [where\n P=\"\\slot. cnode_slot_half_initialised spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev obj_id slot \\*\n si_spec_irq_cap_at irq_caps spec obj_id slot\" and\n Q=\"\\slot. object_slot_initialised spec t obj_id slot \\*\n si_spec_obj_null_cap_at t orig_caps spec obj_id slot \\*\n si_spec_irq_null_cap_at irq_caps spec obj_id slot\" and\n I=\"si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\*\n si_objects \\* object_empty_slots_initialised spec t obj_id\" and\n xs=\"slots_of_list spec obj_id\",\n simplified sep_conj_assoc], clarsimp+)\n apply (wp init_cnode_slot_move_sep, simp+)\n apply fastforce\n apply (subst sep.prod.distrib)+\n apply (clarsimp simp: sep_conj_assoc fun_eq_iff)\n apply sep_solve\n apply clarsimp\n apply (subst (asm) sep.prod.distrib)+\n apply (clarsimp simp: sep_conj_assoc fun_eq_iff)\n apply sep_solve\n done\n\nlemma init_cnode_move_sep:\n \"\\well_formed spec; cnode_at obj_id spec;\n \\slot\\dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec\\ \\\n \\\\cnode_half_initialised spec t obj_id \\*\n si_obj_caps_at t orig_caps spec dev obj_id \\*\n si_spec_irq_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n si_objects \\* R\\\\\n init_cnode spec orig_caps dup_caps irq_caps Move obj_id\n \\\\_.\\object_initialised spec t obj_id \\*\n si_spec_obj_null_caps_at t orig_caps spec obj_id \\*\n si_spec_irq_null_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (subst object_initialised_decomp, subst cnode_half_initialised_decomp)\n apply (subst object_fields_empty_half_initialised, simp)\n apply (rule hoare_chain)\n apply (rule_tac R=R and t=t in init_cnode_slots_move_sep, simp+)\n apply sep_solve\n apply (subst (asm) cnode_fields_empty_initialised, assumption+, sep_solve)\n done\n\nlemma init_cspace_move_sep:\n \"\\\\cnodes_half_initialised spec t cnode_set \\*\n si_objs_caps_at t orig_caps spec dev cnode_set \\*\n si_spec_irqs_caps_at irq_caps spec cnode_set \\*\n si_caps_at t dup_caps spec dev cnode_set \\*\n si_objects \\* R\\ and K(\n well_formed spec \\\n (\\obj_id \\ set cnode_list. \n (cnode_at obj_id spec \\ \n (\\slot\\dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec)))\n \\ distinct cnode_list \\ cnode_set = set cnode_list)\\\n mapM_x (init_cnode spec orig_caps dup_caps irq_caps Move) cnode_list\n \\\\_. \\objects_initialised spec t cnode_set \\*\n si_spec_objs_null_caps_at t orig_caps spec cnode_set \\*\n si_spec_irqs_null_caps_at irq_caps spec cnode_set \\*\n si_caps_at t dup_caps spec dev cnode_set \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_gen_asm)\n apply (clarsimp simp: cnodes_half_initialised_def objects_initialised_def si_caps_at_def\n si_objs_caps_at_def si_spec_objs_null_caps_at_def\n si_spec_irqs_caps_at_def si_spec_irqs_null_caps_at_def)\n apply (rule hoare_name_pre_state)\n apply (rule hoare_chain)\n apply (rule_tac R=R in mapM_x_set_sep [where\n P=\"\\obj_id. cnode_half_initialised spec t obj_id \\*\n si_obj_caps_at t orig_caps spec dev obj_id \\*\n si_spec_irq_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id\" and\n Q=\"\\obj_id. object_initialised spec t obj_id \\*\n si_spec_obj_null_caps_at t orig_caps spec obj_id \\*\n si_spec_irq_null_caps_at irq_caps spec obj_id \\*\n si_cap_at t dup_caps spec dev obj_id\" and\n I=\"si_objects\" and\n xs=\"cnode_list\", simplified sep_conj_assoc], simp)\n apply (wp init_cnode_move_sep, simp+)\n apply clarsimp\n apply (subst sep.prod.distrib)+\n apply sep_solve\n apply (subst (asm) sep.prod.distrib)+\n apply sep_solve\n done\n\nlemma init_cnode_slot_copy_original_sep:\n \"\\original_cap_at (obj_id, slot) spec\\\n \\ \\P\\ init_cnode_slot spec orig_caps dup_caps irq_caps Copy obj_id slot \\\\_. P\\\"\n apply (clarsimp simp: init_cnode_slot_def)\n apply (wp|clarsimp)+\n done\n\nlemma seL4_CNode_Mint_object_slot_initialised_sep_helper:\n \"\\well_formed spec;\n cnode_at obj_id spec;\n \\ original_cap_at (obj_id, slot) spec; \\ is_untyped_cap spec_cap;\n valid_src_cap spec_cap data;\n cap_has_object spec_cap;\n cap_type spec_cap = Some type;\n is_device_cap spec_cap = dev;\n data = cap_data spec_cap; rights = cap_rights spec_cap;\n well_formed spec; cnode_at obj_id spec;\n cdl_objects spec obj_id = Some spec_obj;\n opt_cap (obj_id, slot) spec = Some spec_cap; spec_cap \\ NullCap;\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj;\n is_cnode_cap spec_cap \\object_size_bits spec_cap_obj = cnode_cap_size spec_cap;\n t obj_id = Some dest_id;\n t (cap_object spec_cap) = Some client_object_id;\n src_index < 2 ^ si_cnode_size;\n dest_root < 2 ^ si_cnode_size;\n Some dest_root = dup_caps obj_id;\n Some src_index = orig_caps (cap_object spec_cap)\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n seL4_CNode_Mint dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32 rights data\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_chain)\n apply (cut_tac cnode_cap = si_cspace_cap\n and cnode_cap' = si_cnode_cap\n and dest_root_cap = \"default_cap CNodeType {dest_id} (object_size_bits spec_obj) False\"\n and root_size=si_cnode_size\n and src_root=seL4_CapInitThreadCNode\n and src_depth=32\n and tcb=root_tcb\n and src_cap = \"default_cap type {client_object_id} (object_size_bits spec_cap_obj) dev\"\n in seL4_CNode_Mint_sep,\n (assumption|simp add: ep_related_cap_default_cap get_index_def\n default_cap_has_type ep_related_cap_badge_of_default)+)\n apply (frule_tac s=s and t=t and dup_caps=dup_caps and orig_caps=orig_caps\n in mint_pre,(assumption|rule refl|simp)+)\n apply (elim conjE)\n apply (intro conjI,\n simp_all add:has_type_default_not_non ep_related_cap_default_cap\n valid_src_cap_if_cnode)\n apply ((clarsimp simp: si_cnode_cap_def word_bits_def si_cspace_cap_def\n dest!: guard_equal_si_cspace_cap |\n rule is_cnode_cap_si_cnode_cap | sep_cancel)+)[2]\n apply (drule_tac s=s and dest_root=dest_root and src_index=src_index and R=R\n in mint_post, (assumption|simp)+)\n apply sep_cancel+\n apply (subst default_cap_data_if_cnode[symmetric],simp+)\n done\n\nlemma seL4_CNode_Mint_object_slot_initialised_sep:\n \"\\\\s. well_formed spec \\ \\ original_cap_at (obj_id, slot) spec \\\n rights = cap_rights spec_cap \\ data = cap_data spec_cap \\\n cnode_at obj_id spec \\ cdl_objects spec obj_id = Some spec_obj \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\ spec_cap \\ NullCap \\\n \\is_untyped_cap spec_cap \\\n valid_src_cap spec_cap data \\\n cap_has_object spec_cap \\\n cap_has_type spec_cap \\\n is_device_cap spec_cap = dev \\\n cdl_objects spec (cap_object spec_cap) = Some spec_cap_obj \\\n (is_cnode_cap spec_cap \\ object_size_bits spec_cap_obj = cnode_cap_size spec_cap) \\\n Some dest_root = dup_caps obj_id \\\n Some src_index = orig_caps (cap_object spec_cap) \\\n \\object_slot_empty spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s \\\n seL4_CNode_Mint dest_root (of_nat slot) (of_nat (object_size_bits spec_obj))\n seL4_CapInitThreadCNode src_index 32 rights data\n \\\\_ s. \\object_slot_initialised spec t obj_id slot \\*\n si_cap_at t orig_caps spec dev (cap_object spec_cap) \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ s\\\"\n apply (rule hoare_assume_pre)\n apply (elim conjE)\n apply (rule hoare_weaken_pre)\n apply clarsimp\n apply (rule_tac dest_id=\"the(t obj_id)\" and client_object_id=\"the(t (cap_object spec_cap))\"\n in seL4_CNode_Mint_object_slot_initialised_sep_helper, (assumption|simp)+)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n apply (clarsimp simp: si_cap_at_def sep_conj_exists)\n(* Why doesn't sep_drule work when you don't mention s? *)\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = src_index\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t dup_caps spec (is_device_cap spec_cap) obj_id \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"])\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp\n apply (sep_drule (direct) si_cap_at_less_si_cnode_size [where cap_ptr = dest_root and t=t and spec=spec\n and R=\"object_slot_empty spec t obj_id slot \\* si_cap_at t orig_caps spec (is_device_cap spec_cap) (cap_object spec_cap) \\* object_fields_empty spec t obj_id \\* si_objects \\* R\"])\n apply (fastforce simp: sep_conj_ac)\n apply clarsimp+\n done\n\nlemma init_cnode_slot_copy_not_original_sep_helper:\n \"\\well_formed spec; cnode_at obj_id spec; \\ original_cap_at (obj_id, slot) spec;\n original_cap_at (orig_obj_id, orig_slot) spec;\n opt_cap (obj_id, slot) spec = Some cap; cap \\ NullCap;\n opt_cap (orig_obj_id, orig_slot) spec = Some orig_cap; orig_cap \\ NullCap;\n cap_has_object cap; cap_has_object orig_cap; is_device_cap cap = dev;\n cap_object orig_cap = cap_object cap\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev orig_obj_id orig_slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\ \\\n init_cnode_slot spec orig_caps dup_caps irq_caps Copy obj_id slot\n \\\\_.\\object_slot_initialised spec t obj_id slot \\*\n si_obj_cap_at t orig_caps spec dev orig_obj_id orig_slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (clarsimp simp: si_obj_cap_at_def si_obj_cap_at'_def)\n apply (frule well_formed_cap_object, assumption+)\n apply (clarsimp simp: init_cnode_slot_def cap_at_def)\n apply (wp seL4_CNode_Mint_object_slot_initialised_sep)+\n apply (wp seL4_CNode_Mint_object_slot_initialised_sep | clarsimp)+\n apply (intro impI conjI,simp_all add:opt_object_def)\n apply (erule (2) well_formed_is_untyped_cap)\n apply (metis cap_has_object_NullCap well_formed_cap_valid_src_cap well_formed_well_formed_cap')\n apply (metis well_formed_types_match)\n apply (erule well_formed_cnode_object_size_bits_eq)\n apply (simp add:opt_object_def)+\n done\n\nlemma init_cnode_slot_copy_not_original_sep:\n \"\\well_formed spec; obj_id \\ cnodes; \\ original_cap_at (obj_id, slot) spec;\n cnodes = {obj_id. cnode_at obj_id spec}; cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\n init_cnode_slot spec orig_caps dup_caps irq_caps Copy obj_id slot\n \\\\_. \\object_slot_initialised spec t obj_id slot \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (clarsimp, rename_tac spec_obj)\n\n (* Case: opt_cap (obj_id, slot) spec = Some NullCap *)\n apply (case_tac \"opt_cap (obj_id, slot) spec = Some NullCap\")\n apply (clarsimp simp: init_cnode_slot_def si_obj_cap_at_def\n si_obj_cap_at'_def\n sep_conj_exists opt_object_def)\n apply (frule opt_cap_cdl_objects)\n apply (wp | clarsimp)+\n apply (frule cnode_at_not_tcb_at)\n apply (subst (asm) object_slot_empty_initialised_NullCap, assumption+)\n apply (subst (asm) object_slot_empty_initialised_NullCap, assumption+)\n\n (* Case: opt_cap (obj_id, slot) spec = None *)\n apply (case_tac \"opt_cap (obj_id, slot) spec = None\")\n apply (clarsimp simp: init_cnode_slot_def)\n apply (wp|clarsimp)+\n apply (rule hoare_pre_cont)\n apply (wp|clarsimp)+\n\n (* Case: cap_at cap_has_object (obj_id, slot) spec *)\n apply (case_tac \"cap_at cap_has_object (obj_id, slot) spec\")\n apply (clarsimp simp: cap_at_def)\n apply (rename_tac cap)\n (* Rearrange to work with the sep_list_conj_map_singleton_wp rule. *)\n apply (rule hoare_chain [where P=\"\\(object_slot_empty spec t obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\*\n si_objects) \\*\n si_objs_caps_at t orig_caps spec dev {obj_id. cnode_at obj_id spec} \\* R\\\"\n and Q=\"\\_. \\(object_slot_initialised spec t obj_id slot \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\*\n si_objects) \\*\n si_objs_caps_at t orig_caps spec dev {obj_id. cnode_at obj_id spec} \\* R\\\"])\n apply (frule (3) well_formed_cdt)\n apply (clarsimp simp: si_objs_caps_at_def)\n apply (rule_tac x=orig_obj_id in sep_set_conj_map_singleton_wp, simp)\n apply (clarsimp simp: object_at_def)\n apply (clarsimp simp: si_obj_caps_at_def)\n apply (rule_tac x=orig_slot in sep_set_conj_map_singleton_wp, clarsimp+)\n apply (clarsimp simp: opt_cap_def)\n apply clarsimp\n apply (rule hoare_chain)\n apply (rule_tac orig_cap=orig_cap and cap=cap and R=Ra\n in init_cnode_slot_copy_not_original_sep_helper, (simp|sep_solve)+)\n (* Case: cap_at is_irqhandler_cap (obj_id, slot) spec *)\n apply (frule (3) well_formed_cap_no_object_irqhandler_cap)\n apply (clarsimp simp: original_cap_at_def)\n done\n\nlemma init_cnode_slot_copy_sep:\n \"\\well_formed spec; obj_id \\ cnodes;cap_at (\\c. is_device_cap c = dev) (obj_id, slot) spec;\n cnodes = {obj_id. cnode_at obj_id spec}\\ \\\n \\\\object_slot_empty spec t obj_id slot \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\n init_cnode_slot spec orig_caps dup_caps irq_caps Copy obj_id slot\n \\\\_.\\cnode_slot_half_initialised spec t obj_id slot \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (case_tac \"original_cap_at (obj_id, slot) spec\")\n apply (wp init_cnode_slot_copy_original_sep, simp+)\n apply (subst cnode_slot_half_initialised_original_slot, simp+)\n apply (subst cnode_slot_half_initialised_not_original_slot, assumption+)\n apply (wp init_cnode_slot_copy_not_original_sep, simp+)\n done\n\nlemma init_cnode_slots_copy_sep:\n \"\\well_formed spec; obj_id \\ cnodes;\n \\slot\\ dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id,slot) spec;\n cnodes = {obj_id. cnode_at obj_id spec}\\ \\\n \\\\object_slots_empty spec t obj_id \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\n init_cnode spec orig_caps dup_caps irq_caps Copy obj_id\n \\\\_.\\cnode_slots_half_initialised spec t obj_id \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\* si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (simp add: init_cnode_def si_obj_caps_at_def)\n apply (frule_tac obj_id=obj_id and t=t in object_slots_empty_decomp)\n apply (frule_tac obj_id=obj_id and t=t in cnode_slots_half_initialised_decomp, fastforce+)\n apply simp\n apply (subst cnode_empty_slots_half_initialised_object_empty_slots_initialised)\n apply (subst object_empty_slots_empty_initialised, simp)\n apply (simp add: sep_conj_assoc)\n apply (rule hoare_chain)\n apply (rule_tac mapM_x_set_sep [where\n P=\"\\slot. object_slot_empty spec t obj_id slot\" and\n Q=\"\\slot. cnode_slot_half_initialised spec t obj_id slot\" and\n I=\"si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n object_fields_empty spec t obj_id \\*\n si_objects \\* object_empty_slots_initialised spec t obj_id\" and\n xs=\"slots_of_list spec obj_id\",\n simplified sep_conj_assoc])\n apply (clarsimp simp: sep_conj_assoc)\n apply (wp init_cnode_slot_copy_sep, (simp add: dom_def | sep_solve)+)\n done\n\nlemma init_cnode_copy_sep:\n \"\\well_formed spec; obj_id \\ cnodes; \n \\slot\\ dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id,slot) spec;\n cnodes = {obj_id. cnode_at obj_id spec}\\ \\\n \\\\object_empty spec t obj_id \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n si_objects \\* R\\\\\n init_cnode spec orig_caps dup_caps irq_caps Copy obj_id\n \\\\_.\\cnode_half_initialised spec t obj_id \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_cap_at t dup_caps spec dev obj_id \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_assume_pre)\n apply (subst object_empty_decomp, subst cnode_half_initialised_decomp)\n apply (subst object_fields_empty_half_initialised, simp+)\n apply (rule hoare_chain)\n apply (rule_tac R=R and t=t and cnodes=cnodes in init_cnode_slots_copy_sep, (simp|sep_solve)+)\n done\n\nlemma init_cspace_copy_sep:\n \"\\\\objects_empty spec t cnode_set \\*\n si_objs_caps_at t orig_caps spec dev cnode_set \\*\n si_spec_irqs_caps_at irq_caps spec cnode_set \\*\n si_caps_at t dup_caps spec dev cnode_set \\*\n si_objects \\* R\\ and K(\n well_formed spec \\\n distinct cnode_list \\ cnode_set = set cnode_list \\\n set cnode_list = {obj_id. cnode_at obj_id spec} \n \\ (\\obj_id\\cnode_set. \\slot\\ dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id,slot) spec))\\\n mapM_x (init_cnode spec orig_caps dup_caps irq_caps Copy) cnode_list\n \\\\_.\\cnodes_half_initialised spec t cnode_set \\*\n si_objs_caps_at t orig_caps spec dev cnode_set \\*\n si_spec_irqs_caps_at irq_caps spec cnode_set \\*\n si_caps_at t dup_caps spec dev cnode_set \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_gen_asm)\n apply (clarsimp simp: cnodes_half_initialised_def objects_empty_def\n si_caps_at_def)\n apply (rule hoare_name_pre_state)\n apply (rule hoare_chain)\n apply (rule_tac R=R in\n mapM_x_set_sep [where\n P=\"\\obj_id. object_empty spec t obj_id \\*\n si_cap_at t dup_caps spec dev obj_id\" and\n Q=\"\\obj_id. cnode_half_initialised spec t obj_id \\*\n si_cap_at t dup_caps spec dev obj_id\" and\n I=\"si_spec_irqs_caps_at irq_caps spec (set cnode_list) \\*\n si_objs_caps_at t orig_caps spec dev (set cnode_list) \\*\n si_objects\" and\n xs=\"cnode_list\",\n simplified sep_conj_assoc], simp+)\n apply (rule hoare_chain)\n apply (wp init_cnode_copy_sep [where t=t and cnodes=\"set cnode_list\" and dev = dev],simp+)\n apply sep_solve\n apply clarsimp\n apply sep_solve\n apply (subst sep.prod.distrib)+\n apply clarsimp\n apply sep_solve\n apply (subst (asm) sep.prod.distrib)+\n apply clarsimp\n apply sep_solve\n done\n\nlemma init_cspace_sep':\n \"\\\\objects_empty spec t cnodes \\*\n si_objs_caps_at t orig_caps spec dev cnodes \\*\n si_spec_irqs_caps_at irq_caps spec cnodes \\*\n si_caps_at t dup_caps spec dev cnodes \\*\n si_objects \\* R\\ and K(\n well_formed spec \\\n set obj_ids = dom (cdl_objects spec) \\\n distinct obj_ids \\\n cnodes = {obj_id. cnode_at obj_id spec} \\\n (\\obj_id\\ cnodes. \\slot\\ dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = dev) (obj_id,slot) spec))\\\n init_cspace spec orig_caps dup_caps irq_caps obj_ids\n \\\\_.\\objects_initialised spec t cnodes \\*\n si_spec_objs_null_caps_at t orig_caps spec cnodes \\*\n si_spec_irqs_null_caps_at irq_caps spec cnodes \\*\n si_caps_at t dup_caps spec dev cnodes \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_gen_asm)\n apply (unfold init_cspace_def)\n apply (wp init_cspace_move_sep)\n apply (wp init_cspace_copy_sep)+\n apply simp\n done\n\nlemma hoare_subst:\n \"\\\\A\\ f \\C\\; A = B; C = D\\ \\ \\B\\ f \\D\\\"\n by simp\n\n\nlemma si_caps_at_filter:\n \"si_caps_at t si_caps spec dev (set xs) =\n (si_caps_at t si_caps spec dev (set [x\\xs. P x]) \\* si_caps_at t si_caps spec dev (set [x\\xs. \\P x]))\"\n apply (clarsimp simp: si_caps_at_def)\n apply (subst sep.prod.union_disjoint [symmetric], (fastforce simp: union_filter)+)\n done\n\nlemma si_caps_at_restrict:\n \"si_caps_at t si_caps spec dev xs =\n (si_caps_at t si_caps spec dev {x \\ xs. P x} \\* si_caps_at t si_caps spec dev {x \\ xs. \\P x})\"\n by (clarsimp simp: si_caps_at_def sep_map_set_conj_restrict)\n\nlemma length_Un_disjoint:\n \"\\distinct zs; distinct xs; distinct ys;\n set xs \\ set ys = set zs; set xs \\ set ys = {}\\\n \\ length xs + length ys = length zs\"\n by (metis List.finite_set card_Un_disjoint distinct_card)\n\nlemma set_take_add:\n \"\\i+j \\ length zs; i + j = k\\ \\\n set (take i zs) \\ set (take j (drop i zs)) = set (take k zs)\"\n by (metis set_append take_add)\n\nlemma sep_map_set_conj_set_cong:\n \"\\sep_map_set_conj f xs s; xs = ys\\ \\ sep_map_set_conj f ys s\"\n by simp\n\nlemma wellformed_no_dev:\n \"well_formed spec \\(\\obj_id. cnode_at obj_id spec \\\n (\\slot\\dom (slots_of obj_id spec). cap_at (\\c. is_device_cap c = False) (obj_id, slot) spec))\"\n apply (simp add: well_formed_def cap_at_def del:split_paired_All)\n apply (intro allI impI ballI)\n apply (clarsimp simp: dom_def slots_of_def opt_cap_def)\n done\n\nlemma init_cspace_sep:\n \"\\\\objects_empty spec t {obj_id. cnode_at obj_id spec} \\*\n si_caps_at t orig_caps spec False {obj_id. real_object_at obj_id spec} \\*\n si_irq_caps_at irq_caps spec (used_irqs spec) \\*\n si_caps_at t dup_caps spec False {obj_id. cnode_or_tcb_at obj_id spec} \\*\n si_objects \\* R\\ and K(\n well_formed spec \\\n set obj_ids = dom (cdl_objects spec) \\\n distinct obj_ids \\\n distinct free_cptrs \\\n orig_caps = map_of (zip [obj\\obj_ids. real_object_at obj spec] free_cptrs) \\\n irq_caps = map_of (zip (used_irq_list spec) (drop (card {obj_id. real_object_at obj_id spec}) free_cptrs)) \\\n length obj_ids \\ length free_cptrs\n )\\\n init_cspace spec orig_caps dup_caps irq_caps obj_ids\n \\\\_. \\objects_initialised spec t {obj_id. cnode_at obj_id spec} \\*\n (\\* cptr \\ set (take (card (dom (cdl_objects spec))) free_cptrs). (si_cnode_id, unat cptr) \\c NullCap) \\*\n si_caps_at t dup_caps spec False {obj_id. cnode_or_tcb_at obj_id spec} \\*\n si_objects \\* R\\\\\"\n apply (rule hoare_gen_asm, clarsimp)\n apply (frule well_formed_inj_cdl_irq_node)\n apply (frule well_formed_objects_real_or_irq)\n apply (frule well_formed_objects_only_real_or_irq)\n apply (frule well_formed_objects_card)\n apply (insert distinct_card [where xs = obj_ids], clarsimp)\n apply (insert distinct_card [where xs = \"[obj\\obj_ids . real_object_at obj spec]\", symmetric], clarsimp)\n apply (subst si_caps_at_conversion [where\n real_ids = \"{obj_id. real_object_at obj_id spec}\" and\n cnode_ids = \"{obj_id. cnode_at obj_id spec}\", symmetric], simp+)\n apply (subst si_irq_caps_at_conversion [where\n irqs = \"used_irqs spec\" and\n cnode_ids = \"{obj_id. cnode_at obj_id spec}\", symmetric], simp+)\n apply (subst si_caps_at_restrict [where P=\"\\ref. cnode_at ref spec\" and\n xs=\"{obj_id. cnode_or_tcb_at obj_id spec}\"])+\n apply (wp sep_wp: init_cspace_sep'[where t=t and dev=False and cnodes=\"set [obj\\obj_ids. cnode_at obj spec]\"])\n apply (clarsimp simp: cnode_or_tcb_at_simps wellformed_no_dev)\n apply (frule wellformed_no_dev)\n apply simp\n apply sep_cancel+\n apply (sep_drule si_null_caps_at_simplified [where\n obj_ids = \"[obj\\obj_ids. real_object_at obj spec]\"\n and real_ids = \"{obj_id. real_object_at obj_id spec}\"\n and free_cptrs = free_cptrs], simp+)\n apply (sep_drule si_irq_null_caps_at_simplified [where\n free_cptrs=\"drop (card {obj_id. real_object_at obj_id spec}) free_cptrs\"\n and irqs=\"used_irq_list spec\"], simp+)\n apply (subst (asm) sep.prod.union_disjoint [symmetric], simp+)\n apply (metis (no_types) distinct_append distinct_take_strg inf_sup_aci(1) take_add)\n apply (erule sep_map_set_conj_set_cong)\n apply clarsimp\n apply (subst Un_commute, subst set_take_add, (simp add: add.commute)+)\n done\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/sys-init/InitCSpace_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.3073580105206753, "lm_q1q2_score": 0.18447269564378407}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n\n Based on the Jinja theory Common/Decl.thy by David von Oheimb\n*)\n\nheader {* \\isaheader{Class Declarations and Programs} *}\n\ntheory Decl imports Expr begin\n\n\ntype_synonym\n fdecl = \"vname \\ ty\" -- \"field declaration\"\ntype_synonym\n method = \"ty list \\ ty \\ (vname list \\ expr)\" -- {* arg.\\ types, return type, params, body *}\ntype_synonym\n mdecl = \"mname \\ method\" -- \"method declaration\"\ntype_synonym\n \"class\" = \"base list \\ fdecl list \\ mdecl list\" -- \"class = superclasses, fields, methods\"\ntype_synonym\n cdecl = \"cname \\ class\" -- \"classa declaration\"\ntype_synonym\n prog = \"cdecl list\" -- \"program\"\n\n\ntranslations\n (type) \"fdecl\" <= (type) \"vname \\ ty\"\n (type) \"mdecl\" <= (type) \"mname \\ ty list \\ ty \\ (vname list \\ expr)\"\n (type) \"class\" <= (type) \"cname \\ fdecl list \\ mdecl list\"\n (type) \"cdecl\" <= (type) \"cname \\ class\"\n (type) \"prog \" <= (type) \"cdecl list\"\n\n\ndefinition \"class\" :: \"prog \\ cname \\ class\" where\n \"class \\ map_of\"\n\ndefinition is_class :: \"prog \\ cname \\ bool\" where\n \"is_class P C \\ class P C \\ None\"\n\ndefinition baseClasses :: \"base list \\ cname set\" where\n \"baseClasses Bs \\ set ((map getbase) Bs)\"\n\ndefinition RepBases :: \"base list \\ cname set\" where\n \"RepBases Bs \\ set ((map getbase) (filter isRepBase Bs))\"\n\ndefinition SharedBases :: \"base list \\ cname set\" where\n \"SharedBases Bs \\ set ((map getbase) (filter isShBase Bs))\"\n\n\nlemma not_getbase_repeats:\n \"D \\ set (map getbase xs) \\ Repeats D \\ set xs\"\nby (induct rule: list.induct, auto)\n\nlemma not_getbase_shares:\n \"D \\ set (map getbase xs) \\ Shares D \\ set xs\"\nby (induct rule: list.induct, auto)\n\n\nlemma RepBaseclass_isBaseclass:\n \"\\class P C = Some(Bs,fs,ms); Repeats D \\ set Bs\\\n\\ D \\ baseClasses Bs\"\nby (simp add:baseClasses_def, induct rule: list.induct, \n auto simp:not_getbase_repeats)\n\nlemma ShBaseclass_isBaseclass:\n \"\\class P C = Some(Bs,fs,ms); Shares D \\ set Bs\\\n\\ D \\ baseClasses Bs\"\nby (simp add:baseClasses_def, induct rule: list.induct, \n auto simp:not_getbase_shares)\n\nlemma base_repeats_or_shares:\n \"\\B \\ set Bs; D = getbase B\\ \n\\ Repeats D \\ set Bs \\ Shares D \\ set Bs\"\nby(induct B rule:base.induct) simp+\n\nlemma baseClasses_repeats_or_shares:\n \"D \\ baseClasses Bs \\ Repeats D \\ set Bs \\ Shares D \\ set Bs\"\nby (auto elim!:bexE base_repeats_or_shares \n simp add:baseClasses_def image_def)\n\n\nlemma finite_is_class: \"finite {C. is_class P C}\"\n\napply (unfold is_class_def class_def)\napply (fold dom_def)\napply (rule finite_dom_map_of)\ndone\n\n\nlemma finite_baseClasses: \n \"class P C = Some(Bs,fs,ms) \\ finite (baseClasses Bs)\"\n\napply (unfold is_class_def class_def baseClasses_def)\napply clarsimp\ndone\n\n\n\ndefinition is_type :: \"prog \\ ty \\ bool\" where\n \"is_type P T \\\n (case T of Void \\ True | Boolean \\ True | Integer \\ True | NT \\ True\n | Class C \\ is_class P C)\"\n\nlemma is_type_simps [simp]:\n \"is_type P Void \\ is_type P Boolean \\ is_type P Integer \\\n is_type P NT \\ is_type P (Class C) = is_class P C\"\nby(simp add:is_type_def)\n\nabbreviation\n \"types P == Collect (CONST is_type P)\"\n\nlemma typeof_lit_is_type: \n \"typeof v = Some T \\ is_type P T\"\n by (induct v) (auto)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/Decl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3522017956470284, "lm_q1q2_score": 0.1843495867735675}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__7_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__7_on_rules imports n_german_lemma_on_inv__7\nbegin\nsection{*All lemmas on causal relation between inv__7*}\nlemma lemma_inv__7_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__7 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__7) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__7_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.35220177524832036, "lm_q1q2_score": 0.18434957609646863}} {"text": "theory UniSWP_Common\n imports Phi_Semantics.PhiSem_Int_ArbiPrec HOL.Real\n Phi_Semantics.PhiSem_Real_Abst\n Phi_Semantics.PhiSem_CF_Routine\nbegin\n\nno_notation inter (infixl \"Int\" 70)\n and union (infixl \"Un\" 65)\n and Nats (\"\\\")\n and Ints (\"\\\")\n\ntype_synonym token = int\ntype_synonym fee = real\ntype_synonym address = int\ntype_synonym tick = int\ntype_synonym growth = \\fee \\ fee \\ int \\ real \\ int\\\ntype_synonym liquidity = \\tick \\ int\\\ntype_synonym growths = \\tick \\ growth\\\n\n\nsetup \\Sign.mandatory_path \"growth\"\\\n\ndefinition \\fee0 (x::growth) = (case x of (a,b,c,d,e) \\ a)\\\ndefinition \\map_fee0 f (x::growth) = (case x of (a,b,c,d,e) \\ ((f a,b,c,d,e) :: growth))\\\n\n\ndefinition \\fee1 (x::growth) = (case x of (a,b,c,d,e) \\ b)\\\ndefinition \\map_fee1 f (x::growth) = (case x of (a,b,c,d,e) \\ ((a,f b,c,d,e) :: growth))\\\nlemma [simp]: \\growth.fee1 (a,b,c,d,e) = b\\ unfolding growth.fee1_def by simp\nlemma [simp]: \\growth.map_fee1 f (a,b,c,d,e) = (a,f b,c,d,e)\\ unfolding growth.map_fee1_def by simp\n\ndefinition \\tickCumulative (x::growth) = (case x of (a,b,c,d,e) \\ c)\\\ndefinition \\map_tickCumulative f (x::growth) = (case x of (a,b,c,d,e) \\ ((a,b,f c,d,e) :: growth))\\\nlemma [simp]: \\growth.tickCumulative (a,b,c,d,e) = c\\ unfolding growth.tickCumulative_def by simp\nlemma [simp]: \\growth.map_tickCumulative f (a,b,c,d,e) = (a,b,f c,d,e)\\ unfolding growth.map_tickCumulative_def by simp\n\ndefinition \\secondsPerLiquidity (x::growth) = (case x of (a,b,c,d,e) \\ d)\\\ndefinition \\map_secondsPerLiquidity f (x::growth) = (case x of (a,b,c,d,e) \\ ((a,b,c,f d,e) :: growth))\\\nlemma [simp]: \\growth.secondsPerLiquidity (a,b,c,d,e) = d\\ unfolding growth.secondsPerLiquidity_def by simp\nlemma [simp]: \\growth.map_secondsPerLiquidity f (a,b,c,d,e) = (a,b,c,f d,e)\\ unfolding growth.map_secondsPerLiquidity_def by simp\n\ndefinition \\seconds (x::growth) = (case x of (a,b,c,d,e) \\ e)\\\ndefinition \\map_seconds f (x::growth) = (case x of (a,b,c,d,e) \\ ((a,b,c,d,f e) :: growth))\\\nlemma [simp]: \\growth.seconds (a,b,c,d,e) = e\\ unfolding growth.seconds_def by simp\nlemma [simp]: \\growth.map_seconds f (a,b,c,d,e) = (a,b,c,d,f e)\\ unfolding growth.map_seconds_def by simp\n\nsetup \\Sign.parent_path\\\n\nlemma fee0_plus_homo[simp]:\n \\growth.fee0 (a + b) = growth.fee0 a + growth.fee0 b\\\n by (cases a; cases b; simp)\n\nlemma fee0_sub_homo[simp]:\n \\growth.fee0 (a - b) = growth.fee0 a - growth.fee0 b\\\n by (cases a; cases b; simp)\n\nlemma fee0_sum:\n \\growth.fee0 (sum f S) = sum (growth.fee0 o f) S\\\n by (metis add.right_neutral add_diff_cancel_left' fee0_plus_homo sum_comp_morphism)\n\nlemma fee1_plus_homo[simp]:\n \\growth.fee1 (a + b) = growth.fee1 a + growth.fee1 b\\\n by (cases a; cases b; simp)\n\nlemma fee1_sub_homo[simp]:\n \\growth.fee1 (a - b) = growth.fee1 a - growth.fee1 b\\\n by (cases a; cases b; simp)\n\nlemma fee1_sum:\n \\growth.fee1 (sum f S) = sum (growth.fee1 o f) S\\\n by (metis add.right_neutral add_diff_cancel_left' fee1_plus_homo sum_comp_morphism)\n\n\n\n\n\ndatatype apos_info \\ \\abstract pos info\\ = apos_info\n (liquidity: token)\n (revenue0: fee) \\ \\All time revenue, no matter whether is updated\\\n (revenue1: fee)\n (withdrawn0: fee) \\ \\the amount that the user has withdrawn\\\n (withdrawn1: fee)\n\nhide_const (open) liquidity revenue0 revenue1 withdrawn0 withdrawn1\n\ntext \\The implementation records a settled revenue and the timestamp of the last settling.\n It will not calculate the actual revenue in time until an explicit update operation is invoked.\n Here, we specify the system using the in-time actual revenue, intuitively reflecting the system behavior.\n\\\n\n\n\n\ndefinition Address :: \\(VAL, address) \\\\\n where [\\defs]: \\Address a = (a \\ \\)\\\n\nlemma [\\reason 1200]:\n \\ \\\\\\\\\\\\\\\\\\ 1\n\\ \\

\\\\\\\\\\\\ i = j\n\\ i \\ \\ \\\\\\

\\\\\\\\ j \\ Address\\\n \\ construct\\ \\i \\ Address\\ \\. .\n\nlemma [\\reason 1200]:\n \\ i \\ \\ \\\\\\

\\\\\\\\ i \\ Address @action to Tick\\ \\ \\. .\n\nlemma [\\reason 1200]:\n \\ \\\\\\\\\\\\\\\\\\ 1\n\\ \\

\\\\\\\\\\\\ i = j\n\\ i \\ Address \\\\\\

\\\\\\\\ j \\ \\ \\\n \\ destruct\\ _ \\. .\n\nlemma [\\reason 1200, \\inhabitance_rule]: \\i \\ Address \\\\\\

\\\\\\\\ i \\ \\ @action to \\\\ \\ \\. .\n\nlemma [\\reason 1000]: \"\\Equal Address (\\x y. True) (=)\" \\ to \\ \\. .\n\nlemma [\\reason 1000]: \\\\SemType (x \\ Address) aint\\ \\ to \\ \\. .\n\nlemma [\\reason 1000]: \"\\Zero aint Address 0\" \\ \\0 \\ \\\\ \\. .\n\n\n\nsubsection \\Tick\\\n\ndefinition \\MIN_TICK = (-887272::int)\\\ndefinition \\MAX_TICK = ( 887272::int)\\\n\nlemma MIN_TICK_LT_MAX_TICK[simp]:\n \\MIN_TICK < MAX_TICK\\\n unfolding MIN_TICK_def MAX_TICK_def by simp\n\nlemma MM_TICK_LT_0[simp]:\n \\MIN_TICK < 0\\ \\0 < MAX_TICK\\\n unfolding MIN_TICK_def MAX_TICK_def by simp_all\n\nlemma MM_TICK_LE_0[simp]:\n \\MIN_TICK \\ 0\\ \\0 \\ MAX_TICK\\\n unfolding MIN_TICK_def MAX_TICK_def by simp_all\n\n\n\n\ndefinition Tick :: \\(VAL, tick) \\\\ where [\\defs]: \\Tick i = (i \\ \\ \\\\\\\\ i \\ {MIN_TICK..MAX_TICK})\\\n\nlemma [\\reason 1200]:\n \\ \\\\\\\\\\\\\\\\\\ 1\n\\ \\

\\\\\\\\\\\\ i = j \\ j \\ {MIN_TICK..MAX_TICK}\n\\ i \\ \\ \\\\\\

\\\\\\\\ j \\ Tick\\\n \\ construct\\ \\i \\ Tick\\ \\. .\n\nlemma [\\reason 1200]:\n \\ \\

\\\\\\\\\\\\ i \\ {MIN_TICK..MAX_TICK}\n\\ i \\ \\ \\\\\\

\\\\\\\\ i \\ Tick @action to Tick\\ \\ \\. .\n\nlemma [\\reason 1200]:\n \\ \\\\\\\\\\\\\\\\\\ 1\n\\ \\

\\\\\\\\\\\\ i = j\n\\ i \\ Tick \\\\\\

\\\\\\\\ j \\ \\ \\\\\\ i \\ {MIN_TICK..MAX_TICK}\\\n \\ destruct\\ _ \\. .\n\nlemma [\\reason 1200, \\inhabitance_rule]:\n \\i \\ Tick \\\\\\

\\\\\\\\ i \\ \\ \\\\\\ i \\ {MIN_TICK..MAX_TICK} @action to \\\\ \\ \\. .\n\nlemma [\\reason 1000]: \"\\Equal Tick (\\x y. True) (=)\" \\ to \\ \\. .\n\nlemma [\\reason 1000]: \\\\SemType (x \\ Tick) aint\\ \\ to \\ \\. .\n\nlemma [\\reason 1000]: \"\\Zero aint Tick 0\" \\ \\0 \\ \\\\ \\. .\n\n\n\nend", "meta": {"author": "xqyww123", "repo": "Uniswap_v", "sha": "8ac4e6e29b5a0b95b68120e3188b2c34d8ee8e0c", "save_path": "github-repos/isabelle/xqyww123-Uniswap_v", "path": "github-repos/isabelle/xqyww123-Uniswap_v/Uniswap_v-8ac4e6e29b5a0b95b68120e3188b2c34d8ee8e0c/UniSWP_Common.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118791767282, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.1843200743382007}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__66.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__66 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__66 and some rule r*}\nlemma n_NI_Local_Get_Put_HeadVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__66:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__66:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__66:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__66:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__66:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__66:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__66:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_exists_HomeVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_exists_Home src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_existsVsinv__66:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__66:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_GetVsinv__66:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__66:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__66:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__66:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__66:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Nak_HomeVsinv__66:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__66:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__66:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__66:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__66 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__66:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__66:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__66:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__66:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__66:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__66:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__66:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__66:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__66:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__66:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__66:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__66:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__66:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__66:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__66:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__66:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__66:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__66:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__66:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__66.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5506073802837477, "lm_q2_score": 0.334589441253186, "lm_q1q2_score": 0.18422741571901965}} {"text": "theory ProcLemma\n imports ProcSendCase\nbegin\n\n (* ##### 3. process reduction validity for thread case ##### *)\n\ndefinition dsub_env :: \"'a state_env \\ 'b state_env \\ bool\" where\n \"dsub_env s env = (\\ x. env x \\ None \\ s x \\ None)\" \n \nlemma id_dsub_env: \"dsub_env s s\"\n apply (simp add: dsub_env_def)\n done\n \nlemma add_dsub_env: \"\\ dsub_env s env \\ \\ dsub_env (add_env s x v) env\" \n apply (simp add: dsub_env_def)\n apply (simp add: add_env_def)\n done \n \nlemma super_sub_use_env: \"\\ dsub_env s' s; sub_use_env s r_s \\ \\ sub_use_env s' r_s\" \n apply (simp add: dsub_env_def)\n apply (simp add: sub_use_env_def)\n apply (auto)\n done \n \nlemma app_red_exp_dsub_env: \"\\ app_red_exp are (s1, e1) ax (s2, e2) \\ \\ dsub_env s2 s1\"\n apply (case_tac are)\n apply (auto)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac add_dsub_env)\n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (case_tac c)\n apply (auto)\n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n apply (rule_tac id_dsub_env) \n apply (rule_tac add_dsub_env)\n apply (rule_tac id_dsub_env)\n done\n \n \n (* MAIN PROCESS REDUCTION LEMMA *)\n \nlemma srps_thread_case: \"\\well_typed_system env rs_map p_map s1 ps1; valid_reduct app_red_exp; r_ax = ThreadAct; ps1 u = Some (app_hole h e1); wf_hole h;\n ps2 = add_env ps1 u (app_hole h e2); app_red_exp are (s1, e1) ax (s2, e2)\\\n \\ \\r_s g_ax. (\\p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2 (add_env ps1 u (app_hole h e2))) \\ safe_act s1 r_s g_ax\"\n (* case where action is performed on single thread 'u'. *)\n apply (case_tac \"\\ (well_typed_state s1 env rs_map \\ well_typed_proc_set env rs_map p_map ps1 \\ sub_nres_map s1 p_map \\ (\\ u. case p_map u of\n None \\ True | Some r_s \\ sep_nres_map r_s rs_map))\")\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* we start by obtaining the well-typedness and validity for thread 'u' *)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (case_tac \"p_map u\")\n apply (auto)\n (* using the gsre lemma, we know that the resulting expression will be well-typed. *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"a\" and ?e1.0=\"app_hole h e1\" and tau=\"UnitTy\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and ?s1.0=\"s1\" and\n rs_map=\"rs_map\" and ?e2.0=\"app_hole h e2\" and ax=\"ax\" and ?s2.0=\"s2\" and r_f=\"a\" in safe_full_red_exp)\n apply (auto)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sub_nres_map_def)\n apply (simp add: nres_lookup_def)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"g_ax\" in exI) \n apply (auto)\n apply (rule_tac x=\"add_env p_map u (exp_red_use_env a g_ax)\" in exI)\n (* prove that the resulting system is well-typed overall *)\n apply (simp add: well_typed_system_def)\n (* prove that the process set in particular remains well-typed *)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* prove that the new map still covers the state *)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* prove that it is still disjoint *)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n apply (rule_tac ?s1.0=\"s1\" in red_sep_nres_map)\n apply (auto)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n (* prove that everything is still well-typed. we start with the original expressions from ps1 *) \n apply (case_tac \"u \\ ua\")\n apply (case_tac \"add_env ps1 u (app_hole h e2) ua\")\n apply (auto)\n apply (erule_tac x=\"ua\" in allE)\n apply (simp add: add_env_def)\n apply (case_tac \"p_map ua\")\n apply (auto)\n apply (rule_tac x=\"rxa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac env'=\"env\" in well_typed_contain_env)\n apply (rule_tac s=\"s1\" in red_contain_env)\n apply (simp_all)\n apply (simp add: well_typed_state_def)\n (* - proving that it's still proper as well *)\n apply (rule_tac s=\"s1\" in red_proper_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)\n (* - it's true for the modified res map by valid_reduct's def *)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n (* prove that each res map in p_map is still contained in s2. this is true for the original\n res maps since s1 <: s2 *)\n apply (simp add: sub_nres_map_def)\n apply (auto)\n apply (case_tac \"u \\ x\")\n apply (rule_tac s=\"s1\" in super_sub_use_env)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (rule_tac are=\"are\" in app_red_exp_dsub_env)\n apply (auto)\n (* - it's true for the modified res map by valid_exp *) \n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n (* prove that each res map in p_map is disjoint from the new rs_map. this is true for the original\n res maps by lemma *)\n apply (case_tac \"u \\ ua\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (erule_tac x=\"ua\" in allE)\n apply (erule_tac x=\"ua\" in allE)\n apply (case_tac \"p_map ua\")\n apply (auto)\n apply (simp add: valid_exp_use_env_def)\n apply (rule_tac p_map=\"p_map\" and u=\"u\" and v=\"ua\" and r_p=\"aa\" and r_s=\"a\" and ?s1.0=\"s1\" in red_sep_nres_map2)\n apply (auto)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* - it's true for the modified res map by valid_reduct's def *)\n apply (simp add: add_env_def)\n apply (simp add: valid_exp_use_env_def)\n (* - action safety *)\n apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n apply (simp)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n done \n \n (* ##### 4a. fork lemma: proves well-typedness of new thread ##### *)\n \ndefinition unit_app_abbrev where\n \"unit_app_abbrev e = (AppExp e (ConstExp UnitConst))\"\n \n (* this lemma allows us to type the expression passed into a fork so that it can be moved into another thread. since it will be\n stored in another thread, the requirements must be contained by r_s1, yet completely removable from it.\n from the previous lemma, we know that this can be taken from just the non-prim vars in e *)\n\nlemma safe_fork_lam: \"\\ well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e; is_own r \\ \\\n well_typed env (np_dom_use_env env e) (unit_app_abbrev e) UnitTy empty_use_env empty_use_env\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n apply (simp add: unit_app_abbrev_def)\n (* base case *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"FunTy UnitTy UnitTy UsePerm a\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (simp)\n apply (rule_tac value_is_sexp)\n apply (auto)\n apply (rule_tac x=\"UsePerm\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n apply (auto)\n (* the idea is that the infl_sexp_wp requirements are strictly greater than np_dom, and since np_dom is strong, there is an exact way of\n subtracting to get to np_dom. (we do cheat a little by lifting rx2). *)\n apply (rule_tac t=\"np_dom_use_env env e\" and s=\"diff_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3))\n (diff_use_env (lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r) (np_dom_use_env env e))\" in subst)\n apply (rule_tac sfl_diff_use_env)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (simp add: leq_use_env_def)\n apply (auto)\n (* to prove that the infl_sexp_wp reqs are greater than np_dom, we use the fact that any npv must have a permission *)\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (auto)\n apply (case_tac \"comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3) x \\ OwnPerm\")\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac x=\"x\" and env=\"env\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (cut_tac r_sa=\"lift_use_env rx2 ra\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_no_own_both)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (simp add: is_own_def)\n apply (case_tac \"rx2 x\")\n apply (auto)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* with that in mind, we manipulate until we match the infl sexp lemma *)\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_req)\n apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_lift_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n (* next, we must show that the differential is actually subtractible, which is true since it removes all non-prim vars *)\n apply (auto)\n apply (case_tac \"np_dom_use_env env e x \\ OwnPerm\")\n apply (simp add: np_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (cut_tac r_s=\"lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r\" and\n r_ex=\"np_dom_use_env env e\" and x=\"x\" in diff_use_none_ex)\n apply (simp)\n apply (simp add: own_env_vars_def)\n (* lastly, we prove the various inequalities for application to a unit const *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)(*\n apply (simp add: empty_use_env_def)\n apply (simp add: unlim_def)*)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac disj_empty_use_env1)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (rule_tac leq_empty_use_env)\n done \n \n (* ##### 4b. fork lemma: if x is an npv in 'e', then we have ownership permissions for 'h (fork e)' ##### *)\n \nlemma safe_fork_own_npv_use: \"\\ well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n is_value e; x \\ non_prim_vars env e \\ \\ r_s1 x = OwnPerm\"\n apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n apply (auto)\n (* base case *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (simp)\n apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n apply (auto)\n apply (case_tac \"rx2 x \\ NoPerm\")\n apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n apply (simp add: is_own_def)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (case_tac \"infl_use_env r_s2a r_s3 x \\ NoPerm\")\n apply (simp add: infl_use_env_def)\n apply (case_tac \"r_s2a x = OwnPerm \\ r_s3 x = NoPerm\")\n apply (auto)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (auto)\n apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* rhs pair *)\n apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n apply (simp)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n done \n \n (* ##### 4c. fork lemma: proves well-typedness of original thread post-fork ##### *)\n\n (* this lemma proves that e should be removable from the fork. combined with the previous lemmas, we can also remove the\n permissions of e, and type the two resultant expressions disjointly. *)\n \nlemma safe_fork_exp_ih: \"\\ well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e \\ \\\n well_typed env r_s1 (app_hole h (ConstExp UnitConst)) tau r_s2 rx\"\n apply (induct h arbitrary: env r_s1 e tau r_s2 rx)\n apply (auto)\n (* base case *)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* lhs induct *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs induct *)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n (* if case *)\n apply (rule_tac x=\"rx'\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n (* lhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n (* rhs pair case *)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n done\n \n (* uses:\n - safe_fork_hole_npv_use: to determine that if x is an np-var, it is not in h\n - 4b (safe_fork_own_npv_use) to determine that if x is an np-var, we own it\n *)\n \nlemma safe_fork_exp: \"\\ well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s1; wf_hole h; is_value e \\ \\\n well_typed env (diff_use_env r_s1 (full_dom_use_env env rs_map e)) (app_hole h (ConstExp UnitConst)) tau\n (diff_use_env r_s2 (full_dom_use_env env rs_map e)) (diff_use_env rx (full_dom_use_env env rs_map e))\"\n apply (rule_tac well_typed_diff_perms)\n apply (rule_tac safe_fork_exp_ih)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (auto)\n (* we want to show that if x is in the dominator, it is not an np-var in h.\n > if x is an np-var itself, it cannot be in e by lemma *)\n apply (case_tac \"x \\ non_prim_vars env e\")\n apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" in safe_fork_hole_npv_use)\n apply (auto)\n (* otherwise, x is in the completion. we identify its ancestor z. *)\n apply (simp add: own_env_vars_def)\n apply (simp add: full_dom_use_env_def)\n apply (simp add: dom_use_env_def)\n apply (case_tac \"\\xa. x = Loc xa \\ (\\l z. Loc z \\ non_prim_vars env e \\ path_lookup rs_map z l xa)\")\n apply (auto)\n (* we note that z is a np-var of e therefore r_s1 z = Own *)\n apply (cut_tac x=\"Loc z\" and env=\"env\" in safe_fork_own_npv_use)\n apply (auto)\n (* x then is in the lookup map of some parent y. *)\n apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"xa\" in path_lookup_parent)\n apply (auto)\n (* with that in mind, by separation, x is disjoint from r_s1. *)\n apply (case_tac \"r_s1 (Loc xa) \\ NoPerm\")\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp add: strong_disj_use_env_def)\n apply (erule_tac x=\"Loc xa\" in allE)\n apply (auto)\n (* by extension, x is not in 'h (fork e)' *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"Loc xa\" in well_typed_no_npv_use)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n (* the very last part is showing that x not in 'h (fork e)' implies x not in 'h ()'. *)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_res_vars_rev)\n apply (auto)\n apply (cut_tac x=\"Loc xa\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_res_vars2)\n apply (auto)\n done\n\n (* ##### 4d. fork lemma: structural lemma for thread-disjointness in fork case ###### *)\n \nlemma alift_strong_disj_use_env1: \"\\ strong_disj_use_env r_x r_s \\ \\ strong_disj_use_env (lift_use_env r_x r) r_s\" \n apply (simp add: strong_disj_use_env_def)\n apply (auto)\n apply (case_tac r)\n apply (auto)\n done\n \n (* a special lemma that makes it easier to comprehend our strategy for proving the disjointness of the fork *)\nlemma fork_disj_nres_map: \"\\ disj_nres_map p_map; p_map u = Some r_s; is_own r;\n leq_use_env r_xa (lift_use_env r_s r); leq_use_env r_xb (lift_use_env r_s r);\n strong_disj_use_env r_xa r_xb \\ \\ disj_nres_map (add_env (add_env p_map u r_xa) v r_xb)\"\n apply (rule_tac disj_add_nres_map)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n (* first we must prove the disjointness of the new assignment to u *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"u = x\")\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" in nres_rem_same)\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" in nres_rem_diff)\n apply (auto)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* next we prove the disjointness of v, starting with its disjointness to u *)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = v\")\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" in nres_rem_same)\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (case_tac \"x = u\")\n apply (auto)\n apply (case_tac \"\\ nres_lookup (add_env p_map u r_xa) u = r_xa\")\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"u\" in nres_rem_diff)\n apply (auto)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp)\n (* next we prove its disjointess to the rest of the map *)\n apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"x\" in nres_rem_diff)\n apply (auto)\n apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" and r_s=\"r_xa\" in nres_add_diff)\n apply (auto)\n apply (simp add: disj_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (simp add: nres_lookup_def)\n apply (simp)\n done\n\n (* ##### 4_X. process reduction validity for fork case ##### *) \n \nlemma lift_sep_nres_map: \"\\ sep_nres_map r_s rs_map \\ \\ sep_nres_map (lift_use_env r_s r) rs_map\" \n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (rule_tac alift_strong_disj_use_env1)\n apply (auto)\n done\n \nlemma srps_fork_case: \"\\well_typed_system env rs_map p_map s2 ps1; r_ax = ForkAct; ps1 u = Some (app_hole h (AppExp (ConstExp ForkConst) e));\n wf_hole h; is_value e; ps2 = add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)); fresh_var ps1 v;\n s1 = s2\\\n \\ \\r_s g_ax. (\\p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2\n (add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)))) \\\n safe_act s2 r_s g_ax\" \n (* fork case. no resources are generated in this step *)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (simp add: well_typed_system_def)\n apply (auto)\n (* before we can give the new process map types, we have to get the well-typedness statement for h (fork e) *)\n (*apply (case_tac \"\\ (case ps1 u of None \\ True\n | Some e \\ (case lookup_mem p_map u of None \\ False\n | Some (r_c, s') \\ \\rx r_s r_s2. well_typed env r_s e UnitTy r_s2 rx \\ valid_use_env s2 rs_map r_c r_s))\")*)\n apply (case_tac \"\\ (full_nres_map ps1 p_map \\\n disj_nres_map p_map \\ (\\u. case ps1 u of None \\ True | Some e \\\n (case p_map u of None \\ False | Some r_s \\ \\rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\ proper_exp rs_map e)))\")\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n apply (case_tac \"\\ (case ps1 u of None \\ True | Some e \\ (case p_map u of None \\ False | Some r_s \\ \\rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\ proper_exp rs_map e))\")\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (auto)\n apply (case_tac \"p_map u\")\n apply (auto)\n (* using the fork lemmas, we can generate a type for e + a type for h () *)\n apply (cut_tac eq_own)\n apply (auto)\n apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and r=\"r\" in safe_fork_lam)\n apply (auto)\n apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and s=\"s2\" and rs_map=\"rs_map\" in safe_fork_exp)\n apply (auto)\n apply (simp add: well_typed_state_def)\n (* - complete proof that a is still valid *)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: well_typed_proc_set_def)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n (* - prelim: prove that (full_dom_use_env env rs_map e) \\ a (old complete map) *)(*\n apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and r_c=\"a\" and h=\"h\" and env=\"env\" in valid_full_dom_leq_use_env)\n apply (auto)\n apply (simp add: well_typed_state_def)*)\n (* - prelim: np_dom_use_env env e \\ lift_use_env a r *)\n apply (cut_tac r_sc=\"np_dom_use_env env e\" and r_sb=\"np_dom_use_env env (app_hole h (AppExp (ConstExp ForkConst) e))\" \n and r_sa=\"lift_use_env a r\" in trans_leq_use_env)\n apply (rule_tac wt_np_leq_use_env)\n apply (auto)\n apply (simp add: np_dom_use_env_def)\n apply (rule_tac dist_dom_leq_use_env)\n apply (auto)\n apply (simp add: non_prim_vars_def)\n apply (cut_tac x=\"x\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_res_vars)\n apply (auto)\n (* we fill in the new process map, by taking perms from 'u' [[ h () ]] and giving them to 'v' [[ e () ]] *)\n apply (rule_tac x=\"add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)\" in exI)\n apply (simp add: well_typed_proc_set_def)\n apply (auto)\n (* completeness of the new process map *)\n apply (rule_tac add_full_nres_map)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* disjointness of the new process map *)\n apply (rule_tac r_s=\"a\" and r=\"r\" in fork_disj_nres_map)\n apply (auto)\n apply (rule_tac lift_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"full_dom_use_env env rs_map e\" in strong_disj_leq_use_env2)\n apply (rule_tac reduce_strong_disj_use_env)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"a\" in mini_disj_strong_use_env)\n apply (rule_tac id_leq_use_env)\n apply (simp add: full_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac mini_disj_diff_use_env)\n apply (simp add: full_dom_use_env_def)\n apply (rule_tac strong_dom_use_env)\n apply (rule_tac full_dom_leq_use_env)\n (* proving everything is still well-typed. we start with ua = v, ie the 'e ()' thread. *)\n apply (case_tac \"ua = v\")\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n Some (unit_app_abbrev e)\")\n apply (simp add: add_env_def)\n apply (simp add: unit_app_abbrev_def)\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) v =\n Some (np_dom_use_env env e)\")\n apply (simp add: add_env_def)\n apply (auto)\n (* - properness *)\n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in proper_app_hole_split2)\n apply (simp)\n apply (simp add: unit_app_abbrev_def)\n apply (simp add: proper_exp_def)\n (* - well-typedness for ua = u, the 'h ()' thread*)\n apply (case_tac \"ua = u\")\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n Some (app_hole h (ConstExp UnitConst))\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) u =\n Some (diff_use_env a (full_dom_use_env env rs_map e))\")\n apply (simp add: add_env_def)\n apply (auto)\n (* - properness *)\n apply (cut_tac rs_map=\"rs_map\" and h=\"h\" in proper_app_hole_split1)\n apply (simp)\n apply (rule_tac proper_app_hole_recon)\n apply (simp)\n apply (simp add: proper_exp_def)\n (* - well-typedness for unaltered threads *)\n apply (erule_tac x=\"ua\" in allE)\n apply (case_tac \"\\ add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua = ps1 ua\")\n apply (simp add: add_env_def)\n apply (case_tac \"ps1 ua\")\n apply (auto)\n apply (case_tac \"\\ (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) ua =\n p_map ua\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (erule_tac x=\"ua\" in allE)\n apply (auto)\n (* proving the new process map is contained in the state *)\n apply (rule_tac add_sub_nres_map1)\n apply (rule_tac add_sub_nres_map1)\n apply (simp)\n apply (rule_tac r_s=\"a\" in trans_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac r_s=\"lift_use_env a r\" in trans_sub_use_env)\n apply (rule_tac lift_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (erule_tac x=\"u\" in allE)\n apply (erule_tac x=\"u\" in allE)\n apply (simp add: nres_lookup_def)\n apply (simp)\n (* proving that separation still holds. we again start with ua = v, the 'e ()' thread *)\n apply (case_tac \"ua = v\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"lift_use_env a r\" in leq_sep_nres_map)\n apply (simp)\n apply (rule_tac lift_sep_nres_map)\n apply (erule_tac x=\"u\" in allE)\n apply (simp)\n (* - same for ua = u, ie the 'h ()' thread *)\n apply (case_tac \"ua = u\")\n apply (simp add: add_env_def)\n apply (rule_tac r_s=\"a\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (erule_tac x=\"u\" in allE)\n apply (simp)\n (* - lastly prove separation for original threads *)\n apply (simp add: add_env_def)\n done\n \n (* ##### 5. final proof composition ##### *) \n \nlemma safe_red_proc_set: \"\\ well_typed_system env rs_map p_map s1 ps1; red_proc_set (s1, ps1) r_ax (s2, ps2); valid_reduct app_red_exp \\ \\\n (\\ r_s g_ax p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2 ps2 \\ safe_act s1 r_s g_ax)\"\n (* split over process reduction type. *)\n apply (case_tac \"r_ax\")\n apply (auto)\n (* single thread action case. *)\n apply (rule_tac srps_thread_case)\n apply (auto)\n (* fork case. *)\n apply (rule_tac srps_fork_case)\n apply (auto)\n (* send case. *)\n apply (rule_tac srps_send_case)\n apply (auto)\ndone\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ProcLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.3345894279828469, "lm_q1q2_score": 0.18422740347757838}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__29_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__29_on_rules imports n_g2kAbsAfter_lemma_on_inv__29\nbegin\nsection{*All lemmas on causal relation between inv__29*}\nlemma lemma_inv__29_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__29 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__29) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__29_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.3276683073862188, "lm_q1q2_score": 0.1842074224975566}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__21.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__21 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__21 and some rule r*}\nlemma n_SendInv__part__0Vsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Ident ''ExGntd'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__21:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__21 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__21:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__21:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__21.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.34158250614097546, "lm_q1q2_score": 0.1841072392904336}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__41_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__41_on_rules imports n_german_lemma_on_inv__41\nbegin\nsection{*All lemmas on causal relation between inv__41*}\nlemma lemma_inv__41_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__41) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__41_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.359364152021239, "lm_q1q2_score": 0.1838926037246999}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__37_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__37_on_rules imports n_german_lemma_on_inv__37\nbegin\nsection{*All lemmas on causal relation between inv__37*}\nlemma lemma_inv__37_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__37 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__37) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__37_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.35936413143782797, "lm_q1q2_score": 0.18389259319182674}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__14_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__14_on_rules imports n_german_lemma_on_inv__14\nbegin\nsection{*All lemmas on causal relation between inv__14*}\nlemma lemma_inv__14_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__14 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__14) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__14_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.3486451488696663, "lm_q1q2_score": 0.1838463477951041}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ExecConcrete\nimports CorresXF\nbegin\n\ndefinition \"exec_transformed (sr :: ('s \\ 't) set) (M :: ('t, 'r) nondet_monad) \\\n \\s. (\\ ((\\(r', t'). {(r, t). r = r' \\ (t, t') \\ sr}) ` (\\ (fst ` M ` {s'. (s, s') \\ sr}))),\n True \\ snd ` M ` {s'. (s, s') \\ sr})\"\n\nlemma in_exec_transformed:\n \"((r, s') \\ fst (exec_transformed sr A s)) = (\\t t'. (s, t) \\ sr \\ (s', t') \\ sr \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_transformed_def)\n apply force\n done\n\nlemma snd_exec_transformed:\n \"snd (exec_transformed sr M s) = (\\x. (s, x) \\ sr \\ snd (M x))\"\n by (clarsimp simp: exec_transformed_def)\n\nlemma exec_transformed_Id [simp]:\n \"exec_transformed Id M = M\"\n apply (auto simp: exec_transformed_def)\n done\n\nlemma exec_transformed_valid_def:\n \"\\ P \\ exec_transformed sr M \\ Q \\ = \\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\\"\n apply (rule iffI [rotated])\n apply (clarsimp simp: image_def split_def valid_def in_exec_transformed)\n apply force\n apply (clarsimp simp: image_def split_def valid_def exec_transformed_def)\n apply (erule allE, erule (1) impE)\n apply (case_tac \"M s\")\n apply (erule_tac allE, erule impE)\n by (auto intro!: exI)\n\nlemma exec_transformed_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\ \\ \\ P \\ exec_transformed sr M \\ Q \\\"\n apply (subst exec_transformed_valid_def)\n apply simp\n done\n\nlemma exec_transformedE_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\,\\ \\r s. \\s'. (s', s) \\ sr \\ E r s' \\\n \\ \\ P \\ exec_transformed sr M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_transformed_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_transformed_no_fail [wp]:\n \"no_fail (\\s. \\s'. (s', s) \\ sr \\ P s') M \\ no_fail P (exec_transformed sr M)\"\n apply (clarsimp simp: no_fail_def snd_exec_transformed)\n apply force\n done\n\nlemmas exec_transformed_wp_nf [wp] =\n validNF [OF exec_transformed_wp exec_transformed_no_fail]\n\nlemma exec_transformed_return_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (return a) \\ P \\\"\n apply (rule exec_transformed_wp, wp)\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_returnOk_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (returnOk a) \\ P \\,\\ E \\\"\n apply (rule exec_transformedE_wp, wp)\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_fail_wp_nf [wp]:\n \"\\ \\s. \\ (\\s'. (s, s') \\ sr) \\ exec_transformed sr fail \\ P \\!\"\n apply (rule exec_transformed_wp_nf, wp)\n apply (clarsimp simp: fail_def no_fail_def)\n apply force\n done\n\nlemma exec_transformed_fail_wp [wp]:\n \"\\ \\_. True \\ exec_transformed st fail \\ P \\\"\n by (rule exec_transformed_wp, wp)\n\n(*\n * Execute the given monad with a concrete state.\n *\n * In particular, we non-determinstically select a concrete state that maps\n * to the current abstract state, execute @{term M}, and then map the resulting\n * states back into the abstract universe.\n *)\ndefinition \"exec_concrete (st :: 't \\ 's) (M :: ('t, 'r) nondet_monad) \\\n \\s. ({(r, t). \\s' t'. s = st s' \\ t = st t' \\ (r, t') \\ fst (M s')},\n \\s'. s = st s' \\ snd (M s'))\"\n\nlemma \"exec_concrete st M = exec_transformed {(s, t). st t = s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_concrete_def exec_transformed_def)\n apply force\n done\n\nlemma in_exec_concrete [monad_eq]:\n \"((r, s') \\ fst (exec_concrete st A s)) = (\\t t'. st t = s \\ st t' = s' \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_concrete_def split_def image_def)\n apply force\n done\n\nlemma snd_exec_concrete [monad_eq]:\n \"snd (exec_concrete st M s) = (\\x. st x = s \\ snd (M x))\"\n by (fastforce simp: exec_concrete_def)\n\nlemma exec_concrete_id [simp]:\n \"exec_concrete id M = M\"\n \"exec_concrete (\\a. a) M = M\"\n apply (auto simp: exec_concrete_def)\n done\n\nlemma exec_concrete_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\ \\ \\ P \\ exec_concrete st M \\ Q \\\"\n apply (clarsimp simp: image_def split_def valid_def in_exec_concrete)\n apply force\n done\n\nlemma exec_concreteE_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\,\\ \\r s. E r (st s) \\\n \\ \\ P \\ exec_concrete st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_concrete_wp)\n apply simp\n done\n\nlemma exec_concrete_no_fail [wp]:\n \"no_fail (\\s. P (st s)) M \\ no_fail P (exec_concrete st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_concrete)\n done\n\nlemma exec_concrete_wp_nf [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\! \\ \\ P \\ exec_concrete st M \\ Q \\!\"\n apply rule\n apply (rule exec_concrete_wp)\n apply (erule validNF_valid)\n including no_pre\n apply wp\n apply (erule validNF_no_fail)\n done\n\nlemma exec_concrete_return_wp [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\\"\n by wp\n\nlemma exec_concrete_returnOk_wp [wp]:\n \"\\ P a \\ exec_concrete st (returnOk a) \\ P \\,\\ E \\\"\n by wp\n\nlemma exec_concrete_return_wp_nf [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_concrete st fail \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp [wp]:\n \"\\ \\_. True \\ exec_concrete st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_concrete:\n \"corresXF_simple st (\\r s. r) P (exec_concrete st M) M\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_concrete in_exec_concrete)\n apply force\n done\n\nlemma corresXF_exec_concrete_self:\n \"corresXF st (\\r s. r) (\\r s. r) P (exec_concrete st M) M\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_concrete)\n done\n\nlemma corresXF_exec_concrete [intro?]:\n \"corresXF id ret_xf ex_xf P A C \\ corresXF st ret_xf ex_xf P (exec_concrete st A) C\"\n apply (clarsimp simp: corresXF_def exec_concrete_def split: sum.splits)\n apply safe\n apply (clarsimp simp: image_def split_def)\n apply force\n apply (clarsimp simp: image_def split_def)\n apply force\n done\n\nlemma exec_concrete_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_concrete st M)\"\n apply (subst empty_fail_def)\n apply (clarsimp simp: exec_concrete_def)\n apply (metis empty_failD2 surjective_pairing)\n done\n\n(*\n * Execute the given monad in a modified state.\n *)\ndefinition \"exec_abstract st M \\\n \\s'. ({(r', t'). \\t. t = st t' \\ (r', t) \\ fst (M (st s'))},\n \\s. s = st s' \\ snd (M (st s')))\"\n\nlemma exec_abstract_transformed:\n \"exec_abstract st M = exec_transformed {(s, t). t = st s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_transformed_def exec_abstract_def)\n apply blast\n done\n\nlemma in_exec_abstract [monad_eq]:\n \"((r, t) \\ fst (exec_abstract st A s)) = (\\t'. st t = t' \\ (r, t') \\ fst (A (st s)))\"\n by (clarsimp simp: exec_abstract_def split_def image_def)\n\nlemma snd_exec_abstract [monad_eq]:\n \"snd (exec_abstract st M s) = (snd (M (st s)))\"\n by (clarsimp simp: exec_abstract_def)\n\nlemma exec_abstract_id [simp]:\n \"exec_abstract id M = M\"\n \"exec_abstract (\\a. a) M = M\"\n apply (auto simp: exec_abstract_def)\n done\n\nlemma exec_abstract_valid_def:\n \"\\ P \\ exec_abstract st M \\ Q \\ = \\ \\s. \\s'. st s' = s \\ P s' \\ M \\ \\r s. \\t. st t = s \\ Q r t \\\"\n apply (subst exec_abstract_transformed)\n apply (subst exec_transformed_valid_def)\n apply (fastforce simp: valid_def)\n done\n\nlemma exec_abstract_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\\"\n apply (subst exec_abstract_valid_def)\n apply (clarsimp simp: valid_def)\n apply force\n done\n\nlemma exec_abstractE_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\,\\ \\r s. \\t. st t = s \\ E r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_abstract_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_abstract_no_fail [wp]:\n \"no_fail (\\s. \\t. st t = s \\ P t) M \\ no_fail P (exec_abstract st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_abstract)\n apply force\n done\n\nlemma exec_abstract_wp_nf [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\! \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\!\"\n apply rule\n apply (rule exec_abstract_wp)\n apply (erule validNF_valid)\n apply (rule exec_abstract_no_fail)\n apply (rule validNF_no_fail)\n apply (erule validNF_weaken_pre)\n apply force\n done\n\nlemma exec_abstract_return_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_returnOk_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (returnOk a) \\ P \\,\\ E \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_return_wp_nf [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\!\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_abstract st fail \\ P \\!\"\n apply wp\n apply clarsimp?\n done\n\nlemma exec_abstract_fail_wp [wp]:\n \"\\ \\_. True \\ exec_abstract st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_abstract:\n \"corresXF_simple st (\\r s. r) P M (exec_abstract st M)\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_abstract in_exec_abstract)\n done\n\nlemma corresXF_exec_abstract_self:\n \"corresXF st (\\r s. r) (\\r s. r) P M (exec_abstract st M)\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_abstract)\n done\n\nlemma corresXF_exec_abstract [intro?]:\n \"corresXF st ret_xf ex_xf P A C \\ corresXF id ret_xf ex_xf P (exec_abstract st A) C\"\n apply (clarsimp simp: corresXF_def exec_abstract_def split: sum.splits)\n done\n\nlemma exec_abstract_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_abstract st M)\"\n apply (clarsimp simp: empty_fail_def exec_abstract_def)\n apply (metis nonemptyE surjective_pairing)\n done\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/ExecConcrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3486451353339458, "lm_q1q2_score": 0.18384634065749497}} {"text": "(* Title: HOL/Bali/WellForm.thy\n Author: David von Oheimb and Norbert Schirmer\n*)\n\nsubsection {* Well-formedness of Java programs *}\ntheory WellForm imports DefiniteAssignment begin\n\ntext {*\nFor static checks on expressions and statements, see WellType.thy\n\nimprovements over Java Specification 1.0 (cf. 8.4.6.3, 8.4.6.4, 9.4.1):\n\\begin{itemize}\n\\item a method implementing or overwriting another method may have a result \n type that widens to the result type of the other method \n (instead of identical type)\n\\item if a method hides another method (both methods have to be static!)\n there are no restrictions to the result type \n since the methods have to be static and there is no dynamic binding of \n static methods\n\\item if an interface inherits more than one method with the same signature, the\n methods need not have identical return types\n\\end{itemize}\nsimplifications:\n\\begin{itemize}\n\\item Object and standard exceptions are assumed to be declared like normal \n classes\n\\end{itemize}\n*}\n\nsubsubsection \"well-formed field declarations\"\ntext {* well-formed field declaration (common part for classes and interfaces),\n cf. 8.3 and (9.3) *}\n\ndefinition\n wf_fdecl :: \"prog \\ pname \\ fdecl \\ bool\"\n where \"wf_fdecl G P = (\\(fn,f). is_acc_type G P (type f))\"\n\nlemma wf_fdecl_def2: \"\\fd. wf_fdecl G P fd = is_acc_type G P (type (snd fd))\"\napply (unfold wf_fdecl_def)\napply simp\ndone\n\n\n\nsubsubsection \"well-formed method declarations\"\n (*well-formed method declaration,cf. 8.4, 8.4.1, 8.4.3, 8.4.5, 14.3.2, (9.4)*)\n (* cf. 14.15, 15.7.2, for scope issues cf. 8.4.1 and 14.3.2 *)\n\ntext {*\nA method head is wellformed if:\n\\begin{itemize}\n\\item the signature and the method head agree in the number of parameters\n\\item all types of the parameters are visible\n\\item the result type is visible\n\\item the parameter names are unique\n\\end{itemize} \n*}\ndefinition\n wf_mhead :: \"prog \\ pname \\ sig \\ mhead \\ bool\" where\n \"wf_mhead G P = (\\ sig mh. length (parTs sig) = length (pars mh) \\\n ( \\T\\set (parTs sig). is_acc_type G P T) \\ \n is_acc_type G P (resTy mh) \\\n distinct (pars mh))\"\n\n\ntext {*\nA method declaration is wellformed if:\n\\begin{itemize}\n\\item the method head is wellformed\n\\item the names of the local variables are unique\n\\item the types of the local variables must be accessible\n\\item the local variables don't shadow the parameters\n\\item the class of the method is defined\n\\item the body statement is welltyped with respect to the\n modified environment of local names, were the local variables, \n the parameters the special result variable (Res) and This are assoziated\n with there types. \n\\end{itemize}\n*}\n\ndefinition\n callee_lcl :: \"qtname \\ sig \\ methd \\ lenv\" where\n \"callee_lcl C sig m =\n (\\k. (case k of\n EName e \n \\ (case e of \n VNam v \n \\(table_of (lcls (mbody m))((pars m)[\\](parTs sig))) v\n | Res \\ Some (resTy m))\n | This \\ if is_static m then None else Some (Class C)))\"\n\ndefinition\n parameters :: \"methd \\ lname set\" where\n \"parameters m = set (map (EName \\ VNam) (pars m)) \\ (if (static m) then {} else {This})\"\n\ndefinition\n wf_mdecl :: \"prog \\ qtname \\ mdecl \\ bool\" where\n \"wf_mdecl G C =\n (\\(sig,m).\n wf_mhead G (pid C) sig (mhead m) \\ \n unique (lcls (mbody m)) \\ \n (\\(vn,T)\\set (lcls (mbody m)). is_acc_type G (pid C) T) \\ \n (\\pn\\set (pars m). table_of (lcls (mbody m)) pn = None) \\\n jumpNestingOkS {Ret} (stmt (mbody m)) \\ \n is_class G C \\\n \\prg=G,cls=C,lcl=callee_lcl C sig m\\\\(stmt (mbody m))\\\\ \\\n (\\ A. \\prg=G,cls=C,lcl=callee_lcl C sig m\\ \n \\ parameters m \\\\stmt (mbody m)\\\\ A \n \\ Result \\ nrm A))\"\n\nlemma callee_lcl_VNam_simp [simp]:\n\"callee_lcl C sig m (EName (VNam v)) \n = (table_of (lcls (mbody m))((pars m)[\\](parTs sig))) v\"\nby (simp add: callee_lcl_def)\n \nlemma callee_lcl_Res_simp [simp]:\n\"callee_lcl C sig m (EName Res) = Some (resTy m)\" \nby (simp add: callee_lcl_def)\n\nlemma callee_lcl_This_simp [simp]:\n\"callee_lcl C sig m (This) = (if is_static m then None else Some (Class C))\" \nby (simp add: callee_lcl_def)\n\nlemma callee_lcl_This_static_simp:\n\"is_static m \\ callee_lcl C sig m (This) = None\"\nby simp\n\nlemma callee_lcl_This_not_static_simp:\n\"\\ is_static m \\ callee_lcl C sig m (This) = Some (Class C)\"\nby simp\n\nlemma wf_mheadI: \n\"\\length (parTs sig) = length (pars m); \\T\\set (parTs sig). is_acc_type G P T;\n is_acc_type G P (resTy m); distinct (pars m)\\ \\ \n wf_mhead G P sig m\"\napply (unfold wf_mhead_def)\napply (simp (no_asm_simp))\ndone\n\nlemma wf_mdeclI: \"\\ \n wf_mhead G (pid C) sig (mhead m); unique (lcls (mbody m)); \n (\\pn\\set (pars m). table_of (lcls (mbody m)) pn = None); \n \\(vn,T)\\set (lcls (mbody m)). is_acc_type G (pid C) T;\n jumpNestingOkS {Ret} (stmt (mbody m));\n is_class G C;\n \\prg=G,cls=C,lcl=callee_lcl C sig m\\\\(stmt (mbody m))\\\\;\n (\\ A. \\prg=G,cls=C,lcl=callee_lcl C sig m\\ \\ parameters m \\\\stmt (mbody m)\\\\ A\n \\ Result \\ nrm A)\n \\ \\ \n wf_mdecl G C (sig,m)\"\napply (unfold wf_mdecl_def)\napply simp\ndone\n\nlemma wf_mdeclE [consumes 1]: \n \"\\wf_mdecl G C (sig,m); \n \\wf_mhead G (pid C) sig (mhead m); unique (lcls (mbody m)); \n \\pn\\set (pars m). table_of (lcls (mbody m)) pn = None; \n \\(vn,T)\\set (lcls (mbody m)). is_acc_type G (pid C) T;\n jumpNestingOkS {Ret} (stmt (mbody m));\n is_class G C;\n \\prg=G,cls=C,lcl=callee_lcl C sig m\\\\(stmt (mbody m))\\\\;\n (\\ A. \\prg=G,cls=C,lcl=callee_lcl C sig m\\\\ parameters m \\\\stmt (mbody m)\\\\ A\n \\ Result \\ nrm A)\n \\ \\ P\n \\ \\ P\"\nby (unfold wf_mdecl_def) simp\n\n\nlemma wf_mdeclD1: \n\"wf_mdecl G C (sig,m) \\ \n wf_mhead G (pid C) sig (mhead m) \\ unique (lcls (mbody m)) \\ \n (\\pn\\set (pars m). table_of (lcls (mbody m)) pn = None) \\ \n (\\(vn,T)\\set (lcls (mbody m)). is_acc_type G (pid C) T)\"\napply (unfold wf_mdecl_def)\napply simp\ndone\n\nlemma wf_mdecl_bodyD: \n\"wf_mdecl G C (sig,m) \\ \n (\\T. \\prg=G,cls=C,lcl=callee_lcl C sig m\\\\Body C (stmt (mbody m))\\-T \\ \n G\\T\\(resTy m))\"\napply (unfold wf_mdecl_def)\napply clarify\napply (rule_tac x=\"(resTy m)\" in exI)\napply (unfold wf_mhead_def)\napply (auto simp add: wf_mhead_def is_acc_type_def intro: wt.Body )\ndone\n\n\n(*\nlemma static_Object_methodsE [elim!]: \n \"\\wf_mdecl G Object (sig, m);static m\\ \\ R\"\napply (unfold wf_mdecl_def)\napply auto\ndone\n*)\n\nlemma rT_is_acc_type: \n \"wf_mhead G P sig m \\ is_acc_type G P (resTy m)\"\napply (unfold wf_mhead_def)\napply auto\ndone\n\nsubsubsection \"well-formed interface declarations\"\n (* well-formed interface declaration, cf. 9.1, 9.1.2.1, 9.1.3, 9.4 *)\n\ntext {*\nA interface declaration is wellformed if:\n\\begin{itemize}\n\\item the interface hierarchy is wellstructured\n\\item there is no class with the same name\n\\item the method heads are wellformed and not static and have Public access\n\\item the methods are uniquely named\n\\item all superinterfaces are accessible\n\\item the result type of a method overriding a method of Object widens to the\n result type of the overridden method.\n Shadowing static methods is forbidden.\n\\item the result type of a method overriding a set of methods defined in the\n superinterfaces widens to each of the corresponding result types\n\\end{itemize}\n*}\ndefinition\n wf_idecl :: \"prog \\ idecl \\ bool\" where\n \"wf_idecl G =\n (\\(I,i). \n ws_idecl G I (isuperIfs i) \\ \n \\is_class G I \\\n (\\(sig,mh)\\set (imethods i). wf_mhead G (pid I) sig mh \\ \n \\is_static mh \\\n accmodi mh = Public) \\\n unique (imethods i) \\\n (\\ J\\set (isuperIfs i). is_acc_iface G (pid I) J) \\\n (table_of (imethods i)\n hiding (methd G Object)\n under (\\ new old. accmodi old \\ Private)\n entails (\\new old. G\\resTy new\\resTy old \\ \n is_static new = is_static old)) \\ \n (set_option \\ table_of (imethods i) \n hidings Un_tables((\\J.(imethds G J))`set (isuperIfs i))\n entails (\\new old. G\\resTy new\\resTy old)))\"\n\nlemma wf_idecl_mhead: \"\\wf_idecl G (I,i); (sig,mh)\\set (imethods i)\\ \\ \n wf_mhead G (pid I) sig mh \\ \\is_static mh \\ accmodi mh = Public\"\napply (unfold wf_idecl_def)\napply auto\ndone\n\nlemma wf_idecl_hidings: \n\"wf_idecl G (I, i) \\ \n (\\s. set_option (table_of (imethods i) s)) \n hidings Un_tables ((\\J. imethds G J) ` set (isuperIfs i)) \n entails \\new old. G\\resTy new\\resTy old\"\napply (unfold wf_idecl_def o_def)\napply simp\ndone\n\nlemma wf_idecl_hiding:\n\"wf_idecl G (I, i) \\ \n (table_of (imethods i)\n hiding (methd G Object)\n under (\\ new old. accmodi old \\ Private)\n entails (\\new old. G\\resTy new\\resTy old \\ \n is_static new = is_static old))\"\napply (unfold wf_idecl_def)\napply simp\ndone\n\nlemma wf_idecl_supD: \n\"\\wf_idecl G (I,i); J \\ set (isuperIfs i)\\ \n \\ is_acc_iface G (pid I) J \\ (J, I) \\ (subint1 G)^+\"\napply (unfold wf_idecl_def ws_idecl_def)\napply auto\ndone\n\nsubsubsection \"well-formed class declarations\"\n (* well-formed class declaration, cf. 8.1, 8.1.2.1, 8.1.2.2, 8.1.3, 8.1.4 and\n class method declaration, cf. 8.4.3.3, 8.4.6.1, 8.4.6.2, 8.4.6.3, 8.4.6.4 *)\n\ntext {*\nA class declaration is wellformed if:\n\\begin{itemize}\n\\item there is no interface with the same name\n\\item all superinterfaces are accessible and for all methods implementing \n an interface method the result type widens to the result type of \n the interface method, the method is not static and offers at least \n as much access \n (this actually means that the method has Public access, since all \n interface methods have public access)\n\\item all field declarations are wellformed and the field names are unique\n\\item all method declarations are wellformed and the method names are unique\n\\item the initialization statement is welltyped\n\\item the classhierarchy is wellstructured\n\\item Unless the class is Object:\n \\begin{itemize}\n \\item the superclass is accessible\n \\item for all methods overriding another method (of a superclass )the\n result type widens to the result type of the overridden method,\n the access modifier of the new method provides at least as much\n access as the overwritten one.\n \\item for all methods hiding a method (of a superclass) the hidden \n method must be static and offer at least as much access rights.\n Remark: In contrast to the Java Language Specification we don't\n restrict the result types of the method\n (as in case of overriding), because there seems to be no reason,\n since there is no dynamic binding of static methods.\n (cf. 8.4.6.3 vs. 15.12.1).\n Stricly speaking the restrictions on the access rights aren't \n necessary to, since the static type and the access rights \n together determine which method is to be called statically. \n But if a class gains more then one static method with the \n same signature due to inheritance, it is confusing when the \n method selection depends on the access rights only: \n e.g.\n Class C declares static public method foo().\n Class D is subclass of C and declares static method foo()\n with default package access.\n D.foo() ? if this call is in the same package as D then\n foo of class D is called, otherwise foo of class C.\n \\end{itemize}\n\n\\end{itemize}\n*}\n(* to Table *)\ndefinition\n entails :: \"('a,'b) table \\ ('b \\ bool) \\ bool\" (\"_ entails _\" 20)\n where \"(t entails P) = (\\k. \\ x \\ t k: P x)\"\n\nlemma entailsD:\n \"\\t entails P; t k = Some x\\ \\ P x\"\nby (simp add: entails_def)\n\nlemma empty_entails[simp]: \"empty entails P\"\nby (simp add: entails_def)\n\ndefinition\n wf_cdecl :: \"prog \\ cdecl \\ bool\" where\n \"wf_cdecl G =\n (\\(C,c).\n \\is_iface G C \\\n (\\I\\set (superIfs c). is_acc_iface G (pid C) I \\\n (\\s. \\ im \\ imethds G I s.\n (\\ cm \\ methd G C s: G\\resTy cm\\resTy im \\\n \\ is_static cm \\\n accmodi im \\ accmodi cm))) \\\n (\\f\\set (cfields c). wf_fdecl G (pid C) f) \\ unique (cfields c) \\ \n (\\m\\set (methods c). wf_mdecl G C m) \\ unique (methods c) \\\n jumpNestingOkS {} (init c) \\\n (\\ A. \\prg=G,cls=C,lcl=empty\\\\ {} \\\\init c\\\\ A) \\\n \\prg=G,cls=C,lcl=empty\\\\(init c)\\\\ \\ ws_cdecl G C (super c) \\\n (C \\ Object \\ \n (is_acc_class G (pid C) (super c) \\\n (table_of (map (\\ (s,m). (s,C,m)) (methods c)) \n entails (\\ new. \\ old sig. \n (G,sig\\new overrides\\<^sub>S old \n \\ (G\\resTy new\\resTy old \\\n accmodi old \\ accmodi new \\\n \\is_static old)) \\\n (G,sig\\new hides old \n \\ (accmodi old \\ accmodi new \\\n is_static old)))) \n )))\"\n\n(*\ndefinition wf_cdecl :: \"prog \\ cdecl \\ bool\" where\n\"wf_cdecl G \\ \n \\(C,c).\n \\is_iface G C \\\n (\\I\\set (superIfs c). is_acc_iface G (pid C) I \\\n (\\s. \\ im \\ imethds G I s.\n (\\ cm \\ methd G C s: G\\resTy (mthd cm)\\resTy (mthd im) \\\n \\ is_static cm \\\n accmodi im \\ accmodi cm))) \\\n (\\f\\set (cfields c). wf_fdecl G (pid C) f) \\ unique (cfields c) \\ \n (\\m\\set (methods c). wf_mdecl G C m) \\ unique (methods c) \\ \n \\prg=G,cls=C,lcl=empty\\\\(init c)\\\\ \\ ws_cdecl G C (super c) \\\n (C \\ Object \\ \n (is_acc_class G (pid C) (super c) \\\n (table_of (map (\\ (s,m). (s,C,m)) (methods c)) \n hiding methd G (super c)\n under (\\ new old. G\\new overrides old)\n entails (\\ new old. \n (G\\resTy (mthd new)\\resTy (mthd old) \\\n accmodi old \\ accmodi new \\\n \\ is_static old))) \\\n (table_of (map (\\ (s,m). (s,C,m)) (methods c)) \n hiding methd G (super c)\n under (\\ new old. G\\new hides old)\n entails (\\ new old. is_static old \\ \n accmodi old \\ accmodi new)) \\\n (table_of (cfields c) hiding accfield G C (super c)\n entails (\\ newF oldF. accmodi oldF \\ access newF))))\"\n*)\n\nlemma wf_cdeclE [consumes 1]: \n \"\\wf_cdecl G (C,c);\n \\\\is_iface G C;\n (\\I\\set (superIfs c). is_acc_iface G (pid C) I \\\n (\\s. \\ im \\ imethds G I s.\n (\\ cm \\ methd G C s: G\\resTy cm\\resTy im \\\n \\ is_static cm \\\n accmodi im \\ accmodi cm))); \n \\f\\set (cfields c). wf_fdecl G (pid C) f; unique (cfields c); \n \\m\\set (methods c). wf_mdecl G C m; unique (methods c);\n jumpNestingOkS {} (init c);\n \\ A. \\prg=G,cls=C,lcl=empty\\\\ {} \\\\init c\\\\ A;\n \\prg=G,cls=C,lcl=empty\\\\(init c)\\\\; \n ws_cdecl G C (super c); \n (C \\ Object \\ \n (is_acc_class G (pid C) (super c) \\\n (table_of (map (\\ (s,m). (s,C,m)) (methods c)) \n entails (\\ new. \\ old sig. \n (G,sig\\new overrides\\<^sub>S old \n \\ (G\\resTy new\\resTy old \\\n accmodi old \\ accmodi new \\\n \\is_static old)) \\\n (G,sig\\new hides old \n \\ (accmodi old \\ accmodi new \\\n is_static old)))) \n ))\\ \\ P\n \\ \\ P\"\nby (unfold wf_cdecl_def) simp\n\nlemma wf_cdecl_unique: \n\"wf_cdecl G (C,c) \\ unique (cfields c) \\ unique (methods c)\"\napply (unfold wf_cdecl_def)\napply auto\ndone\n\nlemma wf_cdecl_fdecl: \n\"\\wf_cdecl G (C,c); f\\set (cfields c)\\ \\ wf_fdecl G (pid C) f\"\napply (unfold wf_cdecl_def)\napply auto\ndone\n\nlemma wf_cdecl_mdecl: \n\"\\wf_cdecl G (C,c); m\\set (methods c)\\ \\ wf_mdecl G C m\"\napply (unfold wf_cdecl_def)\napply auto\ndone\n\nlemma wf_cdecl_impD: \n\"\\wf_cdecl G (C,c); I\\set (superIfs c)\\ \n\\ is_acc_iface G (pid C) I \\ \n (\\s. \\im \\ imethds G I s. \n (\\cm \\ methd G C s: G\\resTy cm\\resTy im \\ \\is_static cm \\\n accmodi im \\ accmodi cm))\"\napply (unfold wf_cdecl_def)\napply auto\ndone\n\nlemma wf_cdecl_supD: \n\"\\wf_cdecl G (C,c); C \\ Object\\ \\ \n is_acc_class G (pid C) (super c) \\ (super c,C) \\ (subcls1 G)^+ \\ \n (table_of (map (\\ (s,m). (s,C,m)) (methods c)) \n entails (\\ new. \\ old sig. \n (G,sig\\new overrides\\<^sub>S old \n \\ (G\\resTy new\\resTy old \\\n accmodi old \\ accmodi new \\\n \\is_static old)) \\\n (G,sig\\new hides old \n \\ (accmodi old \\ accmodi new \\\n is_static old))))\"\napply (unfold wf_cdecl_def ws_cdecl_def)\napply auto\ndone\n\n\nlemma wf_cdecl_overrides_SomeD:\n\"\\wf_cdecl G (C,c); C \\ Object; table_of (methods c) sig = Some newM;\n G,sig\\(C,newM) overrides\\<^sub>S old\n\\ \\ G\\resTy newM\\resTy old \\\n accmodi old \\ accmodi newM \\\n \\ is_static old\" \napply (drule (1) wf_cdecl_supD)\napply (clarify)\napply (drule entailsD)\napply (blast intro: table_of_map_SomeI)\napply (drule_tac x=\"old\" in spec)\napply (auto dest: overrides_eq_sigD simp add: msig_def)\ndone\n\nlemma wf_cdecl_hides_SomeD:\n\"\\wf_cdecl G (C,c); C \\ Object; table_of (methods c) sig = Some newM;\n G,sig\\(C,newM) hides old\n\\ \\ accmodi old \\ access newM \\\n is_static old\" \napply (drule (1) wf_cdecl_supD)\napply (clarify)\napply (drule entailsD)\napply (blast intro: table_of_map_SomeI)\napply (drule_tac x=\"old\" in spec)\napply (auto dest: hides_eq_sigD simp add: msig_def)\ndone\n\nlemma wf_cdecl_wt_init: \n \"wf_cdecl G (C, c) \\ \\prg=G,cls=C,lcl=empty\\\\init c\\\\\"\napply (unfold wf_cdecl_def)\napply auto\ndone\n\n\nsubsubsection \"well-formed programs\"\n (* well-formed program, cf. 8.1, 9.1 *)\n\ntext {*\nA program declaration is wellformed if:\n\\begin{itemize}\n\\item the class ObjectC of Object is defined\n\\item every method of Object has an access modifier distinct from Package. \n This is\n necessary since every interface automatically inherits from Object. \n We must know, that every time a Object method is \"overriden\" by an \n interface method this is also overriden by the class implementing the\n the interface (see @{text \"implement_dynmethd and class_mheadsD\"})\n\\item all standard Exceptions are defined\n\\item all defined interfaces are wellformed\n\\item all defined classes are wellformed\n\\end{itemize}\n*}\ndefinition\n wf_prog :: \"prog \\ bool\" where\n \"wf_prog G = (let is = ifaces G; cs = classes G in\n ObjectC \\ set cs \\ \n (\\ m\\set Object_mdecls. accmodi m \\ Package) \\\n (\\xn. SXcptC xn \\ set cs) \\\n (\\i\\set is. wf_idecl G i) \\ unique is \\\n (\\c\\set cs. wf_cdecl G c) \\ unique cs)\"\n\nlemma wf_prog_idecl: \"\\iface G I = Some i; wf_prog G\\ \\ wf_idecl G (I,i)\"\napply (unfold wf_prog_def Let_def)\napply simp\napply (fast dest: map_of_SomeD)\ndone\n\nlemma wf_prog_cdecl: \"\\class G C = Some c; wf_prog G\\ \\ wf_cdecl G (C,c)\"\napply (unfold wf_prog_def Let_def)\napply simp\napply (fast dest: map_of_SomeD)\ndone\n\nlemma wf_prog_Object_mdecls:\n\"wf_prog G \\ (\\ m\\set Object_mdecls. accmodi m \\ Package)\"\napply (unfold wf_prog_def Let_def)\napply simp\ndone\n\nlemma wf_prog_acc_superD:\n \"\\wf_prog G; class G C = Some c; C \\ Object \\ \n \\ is_acc_class G (pid C) (super c)\"\nby (auto dest: wf_prog_cdecl wf_cdecl_supD)\n\nlemma wf_ws_prog [elim!,simp]: \"wf_prog G \\ ws_prog G\"\napply (unfold wf_prog_def Let_def)\napply (rule ws_progI)\napply (simp_all (no_asm))\napply (auto simp add: is_acc_class_def is_acc_iface_def \n dest!: wf_idecl_supD wf_cdecl_supD )+\ndone\n\nlemma class_Object [simp]: \n\"wf_prog G \\ \n class G Object = Some \\access=Public,cfields=[],methods=Object_mdecls,\n init=Skip,super=undefined,superIfs=[]\\\"\napply (unfold wf_prog_def Let_def ObjectC_def)\napply (fast dest!: map_of_SomeI)\ndone\n\nlemma methd_Object[simp]: \"wf_prog G \\ methd G Object = \n table_of (map (\\(s,m). (s, Object, m)) Object_mdecls)\"\napply (subst methd_rec)\napply (auto simp add: Let_def)\ndone\n\nlemma wf_prog_Object_methd:\n\"\\wf_prog G; methd G Object sig = Some m\\ \\ accmodi m \\ Package\"\nby (auto dest!: wf_prog_Object_mdecls) (auto dest!: map_of_SomeD) \n\nlemma wf_prog_Object_is_public[intro]:\n \"wf_prog G \\ is_public G Object\"\nby (auto simp add: is_public_def dest: class_Object)\n\nlemma class_SXcpt [simp]: \n\"wf_prog G \\ \n class G (SXcpt xn) = Some \\access=Public,cfields=[],methods=SXcpt_mdecls,\n init=Skip,\n super=if xn = Throwable then Object \n else SXcpt Throwable,\n superIfs=[]\\\"\napply (unfold wf_prog_def Let_def SXcptC_def)\napply (fast dest!: map_of_SomeI)\ndone\n\nlemma wf_ObjectC [simp]: \n \"wf_cdecl G ObjectC = (\\is_iface G Object \\ Ball (set Object_mdecls)\n (wf_mdecl G Object) \\ unique Object_mdecls)\"\napply (unfold wf_cdecl_def ws_cdecl_def ObjectC_def)\napply (auto intro: da.Skip)\ndone\n\nlemma Object_is_class [simp,elim!]: \"wf_prog G \\ is_class G Object\"\napply (simp (no_asm_simp))\ndone\n \nlemma Object_is_acc_class [simp,elim!]: \"wf_prog G \\ is_acc_class G S Object\"\napply (simp (no_asm_simp) add: is_acc_class_def is_public_def\n accessible_in_RefT_simp)\ndone\n\nlemma SXcpt_is_class [simp,elim!]: \"wf_prog G \\ is_class G (SXcpt xn)\"\napply (simp (no_asm_simp))\ndone\n\nlemma SXcpt_is_acc_class [simp,elim!]: \n\"wf_prog G \\ is_acc_class G S (SXcpt xn)\"\napply (simp (no_asm_simp) add: is_acc_class_def is_public_def\n accessible_in_RefT_simp)\ndone\n\nlemma fields_Object [simp]: \"wf_prog G \\ DeclConcepts.fields G Object = []\"\nby (force intro: fields_emptyI)\n\nlemma accfield_Object [simp]: \n \"wf_prog G \\ accfield G S Object = empty\"\napply (unfold accfield_def)\napply (simp (no_asm_simp) add: Let_def)\ndone\n\nlemma fields_Throwable [simp]: \n \"wf_prog G \\ DeclConcepts.fields G (SXcpt Throwable) = []\"\nby (force intro: fields_emptyI)\n\nlemma fields_SXcpt [simp]: \"wf_prog G \\ DeclConcepts.fields G (SXcpt xn) = []\"\napply (case_tac \"xn = Throwable\")\napply (simp (no_asm_simp))\nby (force intro: fields_emptyI)\n\nlemmas widen_trans = ws_widen_trans [OF _ _ wf_ws_prog, elim]\nlemma widen_trans2 [elim]: \"\\G\\U\\T; G\\S\\U; wf_prog G\\ \\ G\\S\\T\"\napply (erule (2) widen_trans)\ndone\n\nlemma Xcpt_subcls_Throwable [simp]: \n\"wf_prog G \\ G\\SXcpt xn\\\\<^sub>C SXcpt Throwable\"\napply (rule SXcpt_subcls_Throwable_lemma)\napply auto\ndone\n\nlemma unique_fields: \n \"\\is_class G C; wf_prog G\\ \\ unique (DeclConcepts.fields G C)\"\napply (erule ws_unique_fields)\napply (erule wf_ws_prog)\napply (erule (1) wf_prog_cdecl [THEN wf_cdecl_unique [THEN conjunct1]])\ndone\n\nlemma fields_mono: \n\"\\table_of (DeclConcepts.fields G C) fn = Some f; G\\D\\\\<^sub>C C; \n is_class G D; wf_prog G\\ \n \\ table_of (DeclConcepts.fields G D) fn = Some f\"\napply (rule map_of_SomeI)\napply (erule (1) unique_fields)\napply (erule (1) map_of_SomeD [THEN fields_mono_lemma])\napply (erule wf_ws_prog)\ndone\n\n\nlemma fields_is_type [elim]: \n\"\\table_of (DeclConcepts.fields G C) m = Some f; wf_prog G; is_class G C\\ \\ \n is_type G (type f)\"\napply (frule wf_ws_prog)\napply (force dest: fields_declC [THEN conjunct1] \n wf_prog_cdecl [THEN wf_cdecl_fdecl]\n simp add: wf_fdecl_def2 is_acc_type_def)\ndone\n\nlemma imethds_wf_mhead [rule_format (no_asm)]: \n\"\\m \\ imethds G I sig; wf_prog G; is_iface G I\\ \\ \n wf_mhead G (pid (decliface m)) sig (mthd m) \\ \n \\ is_static m \\ accmodi m = Public\"\napply (frule wf_ws_prog)\napply (drule (2) imethds_declI [THEN conjunct1])\napply clarify\napply (frule_tac I=\"(decliface m)\" in wf_prog_idecl,assumption)\napply (drule wf_idecl_mhead)\napply (erule map_of_SomeD)\napply (cases m, simp)\ndone\n\nlemma methd_wf_mdecl: \n \"\\methd G C sig = Some m; wf_prog G; class G C = Some y\\ \\ \n G\\C\\\\<^sub>C (declclass m) \\ is_class G (declclass m) \\ \n wf_mdecl G (declclass m) (sig,(mthd m))\"\napply (frule wf_ws_prog)\napply (drule (1) methd_declC)\napply fast\napply clarsimp\napply (frule (1) wf_prog_cdecl, erule wf_cdecl_mdecl, erule map_of_SomeD)\ndone\n\n(*\nThis lemma doesn't hold!\nlemma methd_rT_is_acc_type: \n\"\\wf_prog G;methd G C C sig = Some (D,m);\n class G C = Some y\\\n\\ is_acc_type G (pid C) (resTy m)\"\nThe result Type is only visible in the scope of defining class D \n\"is_vis_type G (pid D) (resTy m)\" but not necessarily in scope of class C!\n(The same is true for the type of pramaters of a method)\n*)\n\n\nlemma methd_rT_is_type: \n\"\\wf_prog G;methd G C sig = Some m;\n class G C = Some y\\\n\\ is_type G (resTy m)\"\napply (drule (2) methd_wf_mdecl)\napply clarify\napply (drule wf_mdeclD1)\napply clarify\napply (drule rT_is_acc_type)\napply (cases m, simp add: is_acc_type_def)\ndone\n\nlemma accmethd_rT_is_type:\n\"\\wf_prog G;accmethd G S C sig = Some m;\n class G C = Some y\\\n\\ is_type G (resTy m)\"\nby (auto simp add: accmethd_def \n intro: methd_rT_is_type)\n\nlemma methd_Object_SomeD:\n\"\\wf_prog G;methd G Object sig = Some m\\ \n \\ declclass m = Object\"\nby (auto dest: class_Object simp add: methd_rec )\n\nlemmas iface_rec_induct' = iface_rec.induct [of \"%x y z. P x y\"] for P\n\nlemma wf_imethdsD: \n \"\\im \\ imethds G I sig;wf_prog G; is_iface G I\\ \n \\ \\is_static im \\ accmodi im = Public\"\nproof -\n assume asm: \"wf_prog G\" \"is_iface G I\" \"im \\ imethds G I sig\"\n\n have \"wf_prog G \\ \n (\\ i im. iface G I = Some i \\ im \\ imethds G I sig\n \\ \\is_static im \\ accmodi im = Public)\" (is \"?P G I\")\n proof (induct G I rule: iface_rec_induct', intro allI impI)\n fix G I i im\n assume hyp: \"\\ i J. iface G I = Some i \\ ws_prog G \\ J \\ set (isuperIfs i)\n \\ ?P G J\"\n assume wf: \"wf_prog G\" and if_I: \"iface G I = Some i\" and \n im: \"im \\ imethds G I sig\" \n show \"\\is_static im \\ accmodi im = Public\" \n proof -\n let ?inherited = \"Un_tables (imethds G ` set (isuperIfs i))\"\n let ?new = \"(set_option \\ table_of (map (\\(s, mh). (s, I, mh)) (imethods i)))\"\n from if_I wf im have imethds:\"im \\ (?inherited \\\\ ?new) sig\"\n by (simp add: imethds_rec)\n from wf if_I have \n wf_supI: \"\\ J. J \\ set (isuperIfs i) \\ (\\ j. iface G J = Some j)\"\n by (blast dest: wf_prog_idecl wf_idecl_supD is_acc_ifaceD)\n from wf if_I have\n \"\\ im \\ set (imethods i). \\ is_static im \\ accmodi im = Public\"\n by (auto dest!: wf_prog_idecl wf_idecl_mhead)\n then have new_ok: \"\\ im. table_of (imethods i) sig = Some im \n \\ \\ is_static im \\ accmodi im = Public\"\n by (auto dest!: table_of_Some_in_set)\n show ?thesis\n proof (cases \"?new sig = {}\")\n case True\n from True wf wf_supI if_I imethds hyp \n show ?thesis by (auto simp del: split_paired_All) \n next\n case False\n from False wf wf_supI if_I imethds new_ok hyp \n show ?thesis by (auto dest: wf_idecl_hidings hidings_entailsD)\n qed\n qed\n qed\n with asm show ?thesis by (auto simp del: split_paired_All)\nqed\n\nlemma wf_prog_hidesD:\n assumes hides: \"G \\new hides old\" and wf: \"wf_prog G\"\n shows\n \"accmodi old \\ accmodi new \\\n is_static old\"\nproof -\n from hides \n obtain c where \n clsNew: \"class G (declclass new) = Some c\" and\n neqObj: \"declclass new \\ Object\"\n by (auto dest: hidesD declared_in_classD)\n with hides obtain newM oldM where\n newM: \"table_of (methods c) (msig new) = Some newM\" and \n new: \"new = (declclass new,(msig new),newM)\" and\n old: \"old = (declclass old,(msig old),oldM)\" and\n \"msig new = msig old\"\n by (cases new,cases old) \n (auto dest: hidesD \n simp add: cdeclaredmethd_def declared_in_def)\n with hides \n have hides':\n \"G,(msig new)\\(declclass new,newM) hides (declclass old,oldM)\"\n by auto\n from clsNew wf \n have \"wf_cdecl G (declclass new,c)\" by (blast intro: wf_prog_cdecl)\n note wf_cdecl_hides_SomeD [OF this neqObj newM hides']\n with new old \n show ?thesis\n by (cases new, cases old) auto\nqed\n\ntext {* Compare this lemma about static \noverriding @{term \"G \\new overrides\\<^sub>S old\"} with the definition of \ndynamic overriding @{term \"G \\new overrides old\"}. \nConforming result types and restrictions on the access modifiers of the old \nand the new method are not part of the predicate for static overriding. But\nthey are enshured in a wellfromed program. Dynamic overriding has \nno restrictions on the access modifiers but enforces confrom result types \nas precondition. But with some efford we can guarantee the access modifier\nrestriction for dynamic overriding, too. See lemma \n@{text wf_prog_dyn_override_prop}.\n*}\nlemma wf_prog_stat_overridesD:\n assumes stat_override: \"G \\new overrides\\<^sub>S old\" and wf: \"wf_prog G\"\n shows\n \"G\\resTy new\\resTy old \\\n accmodi old \\ accmodi new \\\n \\ is_static old\"\nproof -\n from stat_override \n obtain c where \n clsNew: \"class G (declclass new) = Some c\" and\n neqObj: \"declclass new \\ Object\"\n by (auto dest: stat_overrides_commonD declared_in_classD)\n with stat_override obtain newM oldM where\n newM: \"table_of (methods c) (msig new) = Some newM\" and \n new: \"new = (declclass new,(msig new),newM)\" and\n old: \"old = (declclass old,(msig old),oldM)\" and\n \"msig new = msig old\"\n by (cases new,cases old) \n (auto dest: stat_overrides_commonD \n simp add: cdeclaredmethd_def declared_in_def)\n with stat_override \n have stat_override':\n \"G,(msig new)\\(declclass new,newM) overrides\\<^sub>S (declclass old,oldM)\"\n by auto\n from clsNew wf \n have \"wf_cdecl G (declclass new,c)\" by (blast intro: wf_prog_cdecl)\n note wf_cdecl_overrides_SomeD [OF this neqObj newM stat_override']\n with new old \n show ?thesis\n by (cases new, cases old) auto\nqed\n \nlemma static_to_dynamic_overriding: \n assumes stat_override: \"G\\new overrides\\<^sub>S old\" and wf : \"wf_prog G\"\n shows \"G\\new overrides old\"\nproof -\n from stat_override \n show ?thesis (is \"?Overrides new old\")\n proof (induct)\n case (Direct new old superNew)\n then have stat_override:\"G\\new overrides\\<^sub>S old\" \n by (rule stat_overridesR.Direct)\n from stat_override wf\n have resTy_widen: \"G\\resTy new\\resTy old\" and\n not_static_old: \"\\ is_static old\" \n by (auto dest: wf_prog_stat_overridesD) \n have not_private_new: \"accmodi new \\ Private\"\n proof -\n from stat_override \n have \"accmodi old \\ Private\"\n by (rule no_Private_stat_override)\n moreover\n from stat_override wf\n have \"accmodi old \\ accmodi new\"\n by (auto dest: wf_prog_stat_overridesD)\n ultimately\n show ?thesis\n by (auto dest: acc_modi_bottom)\n qed\n with Direct resTy_widen not_static_old \n show \"?Overrides new old\" \n by (auto intro: overridesR.Direct stat_override_declclasses_relation) \n next\n case (Indirect new inter old)\n then show \"?Overrides new old\" \n by (blast intro: overridesR.Indirect) \n qed\nqed\n\nlemma non_Package_instance_method_inheritance:\n assumes old_inheritable: \"G\\Method old inheritable_in (pid C)\" and\n accmodi_old: \"accmodi old \\ Package\" and \n instance_method: \"\\ is_static old\" and\n subcls: \"G\\C \\\\<^sub>C declclass old\" and\n old_declared: \"G\\Method old declared_in (declclass old)\" and\n wf: \"wf_prog G\"\n shows \"G\\Method old member_of C \\\n (\\ new. G\\ new overrides\\<^sub>S old \\ G\\Method new member_of C)\"\nproof -\n from wf have ws: \"ws_prog G\" by auto\n from old_declared have iscls_declC_old: \"is_class G (declclass old)\"\n by (auto simp add: declared_in_def cdeclaredmethd_def)\n from subcls have iscls_C: \"is_class G C\"\n by (blast dest: subcls_is_class)\n from iscls_C ws old_inheritable subcls \n show ?thesis (is \"?P C old\")\n proof (induct rule: ws_class_induct')\n case Object\n assume \"G\\Object\\\\<^sub>C declclass old\"\n then show \"?P Object old\"\n by blast\n next\n case (Subcls C c)\n assume cls_C: \"class G C = Some c\" and \n neq_C_Obj: \"C \\ Object\" and\n hyp: \"\\G \\Method old inheritable_in pid (super c); \n G\\super c\\\\<^sub>C declclass old\\ \\ ?P (super c) old\" and\n inheritable: \"G \\Method old inheritable_in pid C\" and\n subclsC: \"G\\C\\\\<^sub>C declclass old\"\n from cls_C neq_C_Obj \n have super: \"G\\C \\\\<^sub>C1 super c\" \n by (rule subcls1I)\n from wf cls_C neq_C_Obj\n have accessible_super: \"G\\(Class (super c)) accessible_in (pid C)\" \n by (auto dest: wf_prog_cdecl wf_cdecl_supD is_acc_classD)\n {\n fix old\n assume member_super: \"G\\Method old member_of (super c)\"\n assume inheritable: \"G \\Method old inheritable_in pid C\"\n assume instance_method: \"\\ is_static old\"\n from member_super\n have old_declared: \"G\\Method old declared_in (declclass old)\"\n by (cases old) (auto dest: member_of_declC)\n have \"?P C old\"\n proof (cases \"G\\mid (msig old) undeclared_in C\")\n case True\n with inheritable super accessible_super member_super\n have \"G\\Method old member_of C\"\n by (cases old) (auto intro: members.Inherited)\n then show ?thesis\n by auto\n next\n case False\n then obtain new_member where\n \"G\\new_member declared_in C\" and\n \"mid (msig old) = memberid new_member\"\n by (auto dest: not_undeclared_declared)\n then obtain new where\n new: \"G\\Method new declared_in C\" and\n eq_sig: \"msig old = msig new\" and\n declC_new: \"declclass new = C\" \n by (cases new_member) auto\n then have member_new: \"G\\Method new member_of C\"\n by (cases new) (auto intro: members.Immediate)\n from declC_new super member_super\n have subcls_new_old: \"G\\declclass new \\\\<^sub>C declclass old\"\n by (auto dest!: member_of_subclseq_declC\n dest: r_into_trancl intro: trancl_rtrancl_trancl)\n show ?thesis\n proof (cases \"is_static new\")\n case False\n with eq_sig declC_new new old_declared inheritable\n super member_super subcls_new_old\n have \"G\\new overrides\\<^sub>S old\"\n by (auto intro!: stat_overridesR.Direct)\n with member_new show ?thesis\n by blast\n next\n case True\n with eq_sig declC_new subcls_new_old new old_declared inheritable\n have \"G\\new hides old\"\n by (auto intro: hidesI) \n with wf \n have \"is_static old\"\n by (blast dest: wf_prog_hidesD)\n with instance_method\n show ?thesis\n by (contradiction)\n qed\n qed\n } note hyp_member_super = this\n from subclsC cls_C \n have \"G\\(super c)\\\\<^sub>C declclass old\"\n by (rule subcls_superD)\n then\n show \"?P C old\"\n proof (cases rule: subclseq_cases) \n case Eq\n assume \"super c = declclass old\"\n with old_declared \n have \"G\\Method old member_of (super c)\" \n by (cases old) (auto intro: members.Immediate)\n with inheritable instance_method \n show ?thesis\n by (blast dest: hyp_member_super)\n next\n case Subcls\n assume \"G\\super c\\\\<^sub>C declclass old\"\n moreover\n from inheritable accmodi_old\n have \"G \\Method old inheritable_in pid (super c)\"\n by (cases \"accmodi old\") (auto simp add: inheritable_in_def)\n ultimately\n have \"?P (super c) old\"\n by (blast dest: hyp)\n then show ?thesis\n proof\n assume \"G \\Method old member_of super c\"\n with inheritable instance_method\n show ?thesis\n by (blast dest: hyp_member_super)\n next\n assume \"\\new. G \\ new overrides\\<^sub>S old \\ G \\Method new member_of super c\"\n then obtain super_new where\n super_new_override: \"G \\ super_new overrides\\<^sub>S old\" and\n super_new_member: \"G \\Method super_new member_of super c\"\n by blast\n from super_new_override wf\n have \"accmodi old \\ accmodi super_new\"\n by (auto dest: wf_prog_stat_overridesD)\n with inheritable accmodi_old\n have \"G \\Method super_new inheritable_in pid C\"\n by (auto simp add: inheritable_in_def \n split: acc_modi.splits\n dest: acc_modi_le_Dests)\n moreover\n from super_new_override \n have \"\\ is_static super_new\"\n by (auto dest: stat_overrides_commonD)\n moreover\n note super_new_member\n ultimately have \"?P C super_new\"\n by (auto dest: hyp_member_super)\n then show ?thesis\n proof \n assume \"G \\Method super_new member_of C\"\n with super_new_override\n show ?thesis\n by blast\n next\n assume \"\\new. G \\ new overrides\\<^sub>S super_new \\ \n G \\Method new member_of C\"\n with super_new_override show ?thesis\n by (blast intro: stat_overridesR.Indirect) \n qed\n qed\n qed\n qed\nqed\n\nlemma non_Package_instance_method_inheritance_cases:\n assumes old_inheritable: \"G\\Method old inheritable_in (pid C)\" and\n accmodi_old: \"accmodi old \\ Package\" and \n instance_method: \"\\ is_static old\" and\n subcls: \"G\\C \\\\<^sub>C declclass old\" and\n old_declared: \"G\\Method old declared_in (declclass old)\" and\n wf: \"wf_prog G\"\n obtains (Inheritance) \"G\\Method old member_of C\"\n | (Overriding) new where \"G\\ new overrides\\<^sub>S old\" and \"G\\Method new member_of C\"\nproof -\n from old_inheritable accmodi_old instance_method subcls old_declared wf \n Inheritance Overriding\n show thesis\n by (auto dest: non_Package_instance_method_inheritance)\nqed\n\nlemma dynamic_to_static_overriding:\n assumes dyn_override: \"G\\ new overrides old\" and\n accmodi_old: \"accmodi old \\ Package\" and\n wf: \"wf_prog G\"\n shows \"G\\ new overrides\\<^sub>S old\" \nproof - \n from dyn_override accmodi_old\n show ?thesis (is \"?Overrides new old\")\n proof (induct rule: overridesR.induct)\n case (Direct new old)\n assume new_declared: \"G\\Method new declared_in declclass new\"\n assume eq_sig_new_old: \"msig new = msig old\"\n assume subcls_new_old: \"G\\declclass new \\\\<^sub>C declclass old\"\n assume \"G \\Method old inheritable_in pid (declclass new)\" and\n \"accmodi old \\ Package\" and\n \"\\ is_static old\" and\n \"G\\declclass new\\\\<^sub>C declclass old\" and\n \"G\\Method old declared_in declclass old\" \n from this wf\n show \"?Overrides new old\"\n proof (cases rule: non_Package_instance_method_inheritance_cases)\n case Inheritance\n assume \"G \\Method old member_of declclass new\"\n then have \"G\\mid (msig old) undeclared_in declclass new\"\n proof cases\n case Immediate \n with subcls_new_old wf show ?thesis \n by (auto dest: subcls_irrefl)\n next\n case Inherited\n then show ?thesis\n by (cases old) auto\n qed\n with eq_sig_new_old new_declared\n show ?thesis\n by (cases old,cases new) (auto dest!: declared_not_undeclared)\n next\n case (Overriding new') \n assume stat_override_new': \"G \\ new' overrides\\<^sub>S old\"\n then have \"msig new' = msig old\"\n by (auto dest: stat_overrides_commonD)\n with eq_sig_new_old have eq_sig_new_new': \"msig new=msig new'\"\n by simp\n assume \"G \\Method new' member_of declclass new\"\n then show ?thesis\n proof (cases)\n case Immediate\n then have declC_new: \"declclass new' = declclass new\" \n by auto\n from Immediate \n have \"G\\Method new' declared_in declclass new\"\n by (cases new') auto\n with new_declared eq_sig_new_new' declC_new \n have \"new=new'\"\n by (cases new, cases new') (auto dest: unique_declared_in) \n with stat_override_new'\n show ?thesis\n by simp\n next\n case Inherited\n then have \"G\\mid (msig new') undeclared_in declclass new\"\n by (cases new') (auto)\n with eq_sig_new_new' new_declared\n show ?thesis\n by (cases new,cases new') (auto dest!: declared_not_undeclared)\n qed\n qed\n next\n case (Indirect new inter old)\n assume accmodi_old: \"accmodi old \\ Package\"\n assume \"accmodi old \\ Package \\ G \\ inter overrides\\<^sub>S old\"\n with accmodi_old \n have stat_override_inter_old: \"G \\ inter overrides\\<^sub>S old\"\n by blast\n moreover \n assume hyp_inter: \"accmodi inter \\ Package \\ G \\ new overrides\\<^sub>S inter\"\n moreover\n have \"accmodi inter \\ Package\"\n proof -\n from stat_override_inter_old wf \n have \"accmodi old \\ accmodi inter\"\n by (auto dest: wf_prog_stat_overridesD)\n with stat_override_inter_old accmodi_old\n show ?thesis\n by (auto dest!: no_Private_stat_override\n split: acc_modi.splits \n dest: acc_modi_le_Dests)\n qed\n ultimately show \"?Overrides new old\"\n by (blast intro: stat_overridesR.Indirect)\n qed\nqed\n\nlemma wf_prog_dyn_override_prop:\n assumes dyn_override: \"G \\ new overrides old\" and\n wf: \"wf_prog G\"\n shows \"accmodi old \\ accmodi new\"\nproof (cases \"accmodi old = Package\")\n case True\n note old_Package = this\n show ?thesis\n proof (cases \"accmodi old \\ accmodi new\")\n case True then show ?thesis .\n next\n case False\n with old_Package \n have \"accmodi new = Private\"\n by (cases \"accmodi new\") (auto simp add: le_acc_def less_acc_def)\n with dyn_override \n show ?thesis\n by (auto dest: overrides_commonD)\n qed \nnext\n case False\n with dyn_override wf\n have \"G \\ new overrides\\<^sub>S old\"\n by (blast intro: dynamic_to_static_overriding)\n with wf \n show ?thesis\n by (blast dest: wf_prog_stat_overridesD)\nqed \n\nlemma overrides_Package_old: \n assumes dyn_override: \"G \\ new overrides old\" and \n accmodi_new: \"accmodi new = Package\" and\n wf: \"wf_prog G \"\n shows \"accmodi old = Package\"\nproof (cases \"accmodi old\")\n case Private\n with dyn_override show ?thesis\n by (simp add: no_Private_override)\nnext\n case Package\n then show ?thesis .\nnext\n case Protected\n with dyn_override wf\n have \"G \\ new overrides\\<^sub>S old\"\n by (auto intro: dynamic_to_static_overriding)\n with wf \n have \"accmodi old \\ accmodi new\"\n by (auto dest: wf_prog_stat_overridesD)\n with Protected accmodi_new\n show ?thesis\n by (simp add: less_acc_def le_acc_def)\nnext\n case Public\n with dyn_override wf\n have \"G \\ new overrides\\<^sub>S old\"\n by (auto intro: dynamic_to_static_overriding)\n with wf \n have \"accmodi old \\ accmodi new\"\n by (auto dest: wf_prog_stat_overridesD)\n with Public accmodi_new\n show ?thesis\n by (simp add: less_acc_def le_acc_def)\nqed\n\nlemma dyn_override_Package:\n assumes dyn_override: \"G \\ new overrides old\" and\n accmodi_old: \"accmodi old = Package\" and \n accmodi_new: \"accmodi new = Package\" and\n wf: \"wf_prog G\"\n shows \"pid (declclass old) = pid (declclass new)\"\nproof - \n from dyn_override accmodi_old accmodi_new\n show ?thesis (is \"?EqPid old new\")\n proof (induct rule: overridesR.induct)\n case (Direct new old)\n assume \"accmodi old = Package\"\n \"G \\Method old inheritable_in pid (declclass new)\"\n then show \"pid (declclass old) = pid (declclass new)\"\n by (auto simp add: inheritable_in_def)\n next\n case (Indirect new inter old)\n assume accmodi_old: \"accmodi old = Package\" and\n accmodi_new: \"accmodi new = Package\" \n assume \"G \\ new overrides inter\"\n with accmodi_new wf\n have \"accmodi inter = Package\"\n by (auto intro: overrides_Package_old)\n with Indirect\n show \"pid (declclass old) = pid (declclass new)\"\n by auto\n qed\nqed\n\nlemma dyn_override_Package_escape:\n assumes dyn_override: \"G \\ new overrides old\" and\n accmodi_old: \"accmodi old = Package\" and \n outside_pack: \"pid (declclass old) \\ pid (declclass new)\" and\n wf: \"wf_prog G\"\n shows \"\\ inter. G \\ new overrides inter \\ G \\ inter overrides old \\\n pid (declclass old) = pid (declclass inter) \\\n Protected \\ accmodi inter\"\nproof -\n from dyn_override accmodi_old outside_pack\n show ?thesis (is \"?P new old\")\n proof (induct rule: overridesR.induct)\n case (Direct new old)\n assume accmodi_old: \"accmodi old = Package\"\n assume outside_pack: \"pid (declclass old) \\ pid (declclass new)\"\n assume \"G \\Method old inheritable_in pid (declclass new)\"\n with accmodi_old \n have \"pid (declclass old) = pid (declclass new)\"\n by (simp add: inheritable_in_def)\n with outside_pack \n show \"?P new old\"\n by (contradiction)\n next\n case (Indirect new inter old)\n assume accmodi_old: \"accmodi old = Package\"\n assume outside_pack: \"pid (declclass old) \\ pid (declclass new)\"\n assume override_new_inter: \"G \\ new overrides inter\"\n assume override_inter_old: \"G \\ inter overrides old\"\n assume hyp_new_inter: \"\\accmodi inter = Package; \n pid (declclass inter) \\ pid (declclass new)\\\n \\ ?P new inter\"\n assume hyp_inter_old: \"\\accmodi old = Package; \n pid (declclass old) \\ pid (declclass inter)\\\n \\ ?P inter old\"\n show \"?P new old\"\n proof (cases \"pid (declclass old) = pid (declclass inter)\")\n case True\n note same_pack_old_inter = this\n show ?thesis\n proof (cases \"pid (declclass inter) = pid (declclass new)\")\n case True\n with same_pack_old_inter outside_pack\n show ?thesis\n by auto\n next\n case False\n note diff_pack_inter_new = this\n show ?thesis\n proof (cases \"accmodi inter = Package\")\n case True\n with diff_pack_inter_new hyp_new_inter \n obtain newinter where\n over_new_newinter: \"G \\ new overrides newinter\" and\n over_newinter_inter: \"G \\ newinter overrides inter\" and \n eq_pid: \"pid (declclass inter) = pid (declclass newinter)\" and\n accmodi_newinter: \"Protected \\ accmodi newinter\"\n by auto\n from over_newinter_inter override_inter_old\n have \"G\\newinter overrides old\"\n by (rule overridesR.Indirect)\n moreover\n from eq_pid same_pack_old_inter \n have \"pid (declclass old) = pid (declclass newinter)\"\n by simp\n moreover\n note over_new_newinter accmodi_newinter\n ultimately show ?thesis\n by blast\n next\n case False\n with override_new_inter\n have \"Protected \\ accmodi inter\"\n by (cases \"accmodi inter\") (auto dest: no_Private_override)\n with override_new_inter override_inter_old same_pack_old_inter\n show ?thesis\n by blast\n qed\n qed\n next\n case False\n with accmodi_old hyp_inter_old\n obtain newinter where\n over_inter_newinter: \"G \\ inter overrides newinter\" and\n over_newinter_old: \"G \\ newinter overrides old\" and \n eq_pid: \"pid (declclass old) = pid (declclass newinter)\" and\n accmodi_newinter: \"Protected \\ accmodi newinter\"\n by auto\n from override_new_inter over_inter_newinter \n have \"G \\ new overrides newinter\"\n by (rule overridesR.Indirect)\n with eq_pid over_newinter_old accmodi_newinter\n show ?thesis\n by blast\n qed\n qed\nqed\n\nlemmas class_rec_induct' = class_rec.induct [of \"%x y z w. P x y\"] for P\n\nlemma declclass_widen[rule_format]: \n \"wf_prog G \n \\ (\\c m. class G C = Some c \\ methd G C sig = Some m \n \\ G\\C \\\\<^sub>C declclass m)\" (is \"?P G C\")\nproof (induct G C rule: class_rec_induct', intro allI impI)\n fix G C c m\n assume Hyp: \"\\c. class G C = Some c \\ ws_prog G \\ C \\ Object\n \\ ?P G (super c)\"\n assume wf: \"wf_prog G\" and cls_C: \"class G C = Some c\" and\n m: \"methd G C sig = Some m\"\n show \"G\\C\\\\<^sub>C declclass m\" \n proof (cases \"C=Object\")\n case True \n with wf m show ?thesis by (simp add: methd_Object_SomeD)\n next\n let ?filter=\"filter_tab (\\sig m. G\\C inherits method sig m)\"\n let ?table = \"table_of (map (\\(s, m). (s, C, m)) (methods c))\"\n case False \n with cls_C wf m\n have methd_C: \"(?filter (methd G (super c)) ++ ?table) sig = Some m \"\n by (simp add: methd_rec)\n show ?thesis\n proof (cases \"?table sig\")\n case None\n from this methd_C have \"?filter (methd G (super c)) sig = Some m\"\n by simp\n moreover\n from wf cls_C False obtain sup where \"class G (super c) = Some sup\"\n by (blast dest: wf_prog_cdecl wf_cdecl_supD is_acc_class_is_class)\n moreover note wf False cls_C \n ultimately have \"G\\super c \\\\<^sub>C declclass m\" \n by (auto intro: Hyp [rule_format])\n moreover from cls_C False have \"G\\C \\\\<^sub>C1 super c\" by (rule subcls1I)\n ultimately show ?thesis by - (rule rtrancl_into_rtrancl2)\n next\n case Some\n from this wf False cls_C methd_C show ?thesis by auto\n qed\n qed\nqed\n\nlemma declclass_methd_Object: \n \"\\wf_prog G; methd G Object sig = Some m\\ \\ declclass m = Object\"\nby auto\n\nlemma methd_declaredD: \n \"\\wf_prog G; is_class G C;methd G C sig = Some m\\ \n \\ G\\(mdecl (sig,mthd m)) declared_in (declclass m)\"\nproof -\n assume wf: \"wf_prog G\"\n then have ws: \"ws_prog G\" ..\n assume clsC: \"is_class G C\"\n from clsC ws \n show \"methd G C sig = Some m \n \\ G\\(mdecl (sig,mthd m)) declared_in (declclass m)\"\n proof (induct C rule: ws_class_induct')\n case Object\n assume \"methd G Object sig = Some m\" \n with wf show ?thesis\n by - (rule method_declared_inI, auto) \n next\n case Subcls\n fix C c\n assume clsC: \"class G C = Some c\"\n and m: \"methd G C sig = Some m\"\n and hyp: \"methd G (super c) sig = Some m \\ ?thesis\" \n let ?newMethods = \"table_of (map (\\(s, m). (s, C, m)) (methods c))\"\n show ?thesis\n proof (cases \"?newMethods sig\")\n case None\n from None ws clsC m hyp \n show ?thesis by (auto intro: method_declared_inI simp add: methd_rec)\n next\n case Some\n from Some ws clsC m \n show ?thesis by (auto intro: method_declared_inI simp add: methd_rec) \n qed\n qed\nqed\n\nlemma methd_rec_Some_cases:\n assumes methd_C: \"methd G C sig = Some m\" and\n ws: \"ws_prog G\" and\n clsC: \"class G C = Some c\" and\n neq_C_Obj: \"C\\Object\"\n obtains (NewMethod) \"table_of (map (\\(s, m). (s, C, m)) (methods c)) sig = Some m\"\n | (InheritedMethod) \"G\\C inherits (method sig m)\" and \"methd G (super c) sig = Some m\"\nproof -\n let ?inherited = \"filter_tab (\\sig m. G\\C inherits method sig m) \n (methd G (super c))\"\n let ?new = \"table_of (map (\\(s, m). (s, C, m)) (methods c))\"\n from ws clsC neq_C_Obj methd_C \n have methd_unfold: \"(?inherited ++ ?new) sig = Some m\"\n by (simp add: methd_rec)\n show thesis\n proof (cases \"?new sig\")\n case None\n with methd_unfold have \"?inherited sig = Some m\"\n by (auto)\n with InheritedMethod show ?thesis by blast\n next\n case Some\n with methd_unfold have \"?new sig = Some m\"\n by auto\n with NewMethod show ?thesis by blast\n qed\nqed\n\n \nlemma methd_member_of:\n assumes wf: \"wf_prog G\"\n shows\n \"\\is_class G C; methd G C sig = Some m\\ \\ G\\Methd sig m member_of C\" \n (is \"?Class C \\ ?Method C \\ ?MemberOf C\") \nproof -\n from wf have ws: \"ws_prog G\" ..\n assume defC: \"is_class G C\"\n from defC ws \n show \"?Class C \\ ?Method C \\ ?MemberOf C\"\n proof (induct rule: ws_class_induct') \n case Object\n with wf have declC: \"Object = declclass m\"\n by (simp add: declclass_methd_Object)\n from Object wf have \"G\\Methd sig m declared_in Object\"\n by (auto intro: methd_declaredD simp add: declC)\n with declC \n show \"?MemberOf Object\"\n by (auto intro!: members.Immediate\n simp del: methd_Object)\n next\n case (Subcls C c)\n assume clsC: \"class G C = Some c\" and\n neq_C_Obj: \"C \\ Object\" \n assume methd: \"?Method C\"\n from methd ws clsC neq_C_Obj\n show \"?MemberOf C\"\n proof (cases rule: methd_rec_Some_cases)\n case NewMethod\n with clsC show ?thesis\n by (auto dest: method_declared_inI intro!: members.Immediate)\n next\n case InheritedMethod\n then show \"?thesis\"\n by (blast dest: inherits_member)\n qed\n qed\nqed\n\nlemma current_methd: \n \"\\table_of (methods c) sig = Some new;\n ws_prog G; class G C = Some c; C \\ Object; \n methd G (super c) sig = Some old\\ \n \\ methd G C sig = Some (C,new)\"\nby (auto simp add: methd_rec\n intro: filter_tab_SomeI map_add_find_right table_of_map_SomeI)\n\nlemma wf_prog_staticD:\n assumes wf: \"wf_prog G\" and\n clsC: \"class G C = Some c\" and\n neq_C_Obj: \"C \\ Object\" and \n old: \"methd G (super c) sig = Some old\" and \n accmodi_old: \"Protected \\ accmodi old\" and\n new: \"table_of (methods c) sig = Some new\"\n shows \"is_static new = is_static old\"\nproof -\n from clsC wf \n have wf_cdecl: \"wf_cdecl G (C,c)\" by (rule wf_prog_cdecl)\n from wf clsC neq_C_Obj\n have is_cls_super: \"is_class G (super c)\" \n by (blast dest: wf_prog_acc_superD is_acc_classD)\n from wf is_cls_super old \n have old_member_of: \"G\\Methd sig old member_of (super c)\" \n by (rule methd_member_of)\n from old wf is_cls_super \n have old_declared: \"G\\Methd sig old declared_in (declclass old)\"\n by (auto dest: methd_declared_in_declclass)\n from new clsC \n have new_declared: \"G\\Methd sig (C,new) declared_in C\"\n by (auto intro: method_declared_inI)\n note trancl_rtrancl_tranc = trancl_rtrancl_trancl [trans] (* ### in Basis *)\n from clsC neq_C_Obj\n have subcls1_C_super: \"G\\C \\\\<^sub>C1 super c\"\n by (rule subcls1I)\n then have \"G\\C \\\\<^sub>C super c\" ..\n also from old wf is_cls_super\n have \"G\\super c \\\\<^sub>C (declclass old)\" by (auto dest: methd_declC)\n finally have subcls_C_old: \"G\\C \\\\<^sub>C (declclass old)\" .\n from accmodi_old \n have inheritable: \"G\\Methd sig old inheritable_in pid C\"\n by (auto simp add: inheritable_in_def\n dest: acc_modi_le_Dests)\n show ?thesis\n proof (cases \"is_static new\")\n case True\n with subcls_C_old new_declared old_declared inheritable\n have \"G,sig\\(C,new) hides old\"\n by (auto intro: hidesI)\n with True wf_cdecl neq_C_Obj new \n show ?thesis\n by (auto dest: wf_cdecl_hides_SomeD)\n next\n case False\n with subcls_C_old new_declared old_declared inheritable subcls1_C_super\n old_member_of\n have \"G,sig\\(C,new) overrides\\<^sub>S old\"\n by (auto intro: stat_overridesR.Direct)\n with False wf_cdecl neq_C_Obj new \n show ?thesis\n by (auto dest: wf_cdecl_overrides_SomeD)\n qed\nqed\n\nlemma inheritable_instance_methd: \n assumes subclseq_C_D: \"G\\C \\\\<^sub>C D\" and\n is_cls_D: \"is_class G D\" and\n wf: \"wf_prog G\" and \n old: \"methd G D sig = Some old\" and\n accmodi_old: \"Protected \\ accmodi old\" and \n not_static_old: \"\\ is_static old\"\n shows\n \"\\new. methd G C sig = Some new \\\n (new = old \\ G,sig\\new overrides\\<^sub>S old)\"\n (is \"(\\new. (?Constraint C new old))\")\nproof -\n from subclseq_C_D is_cls_D \n have is_cls_C: \"is_class G C\" by (rule subcls_is_class2) \n from wf \n have ws: \"ws_prog G\" ..\n from is_cls_C ws subclseq_C_D \n show \"\\new. ?Constraint C new old\"\n proof (induct rule: ws_class_induct')\n case (Object co)\n then have eq_D_Obj: \"D=Object\" by auto\n with old \n have \"?Constraint Object old old\"\n by auto\n with eq_D_Obj \n show \"\\ new. ?Constraint Object new old\" by auto\n next\n case (Subcls C c)\n assume hyp: \"G\\super c\\\\<^sub>C D \\ \\new. ?Constraint (super c) new old\"\n assume clsC: \"class G C = Some c\"\n assume neq_C_Obj: \"C\\Object\"\n from clsC wf \n have wf_cdecl: \"wf_cdecl G (C,c)\" \n by (rule wf_prog_cdecl)\n from ws clsC neq_C_Obj\n have is_cls_super: \"is_class G (super c)\"\n by (auto dest: ws_prog_cdeclD)\n from clsC wf neq_C_Obj \n have superAccessible: \"G\\(Class (super c)) accessible_in (pid C)\" and\n subcls1_C_super: \"G\\C \\\\<^sub>C1 super c\"\n by (auto dest: wf_prog_cdecl wf_cdecl_supD is_acc_classD\n intro: subcls1I)\n show \"\\new. ?Constraint C new old\"\n proof (cases \"G\\super c\\\\<^sub>C D\")\n case False\n from False Subcls \n have eq_C_D: \"C=D\"\n by (auto dest: subclseq_superD)\n with old \n have \"?Constraint C old old\"\n by auto\n with eq_C_D \n show \"\\ new. ?Constraint C new old\" by auto\n next\n case True\n with hyp obtain super_method\n where super: \"?Constraint (super c) super_method old\" by blast\n from super not_static_old\n have not_static_super: \"\\ is_static super_method\"\n by (auto dest!: stat_overrides_commonD)\n from super old wf accmodi_old\n have accmodi_super_method: \"Protected \\ accmodi super_method\"\n by (auto dest!: wf_prog_stat_overridesD)\n from super accmodi_old wf\n have inheritable: \"G\\Methd sig super_method inheritable_in (pid C)\"\n by (auto dest!: wf_prog_stat_overridesD\n acc_modi_le_Dests\n simp add: inheritable_in_def) \n from super wf is_cls_super\n have member: \"G\\Methd sig super_method member_of (super c)\"\n by (auto intro: methd_member_of) \n from member\n have decl_super_method:\n \"G\\Methd sig super_method declared_in (declclass super_method)\"\n by (auto dest: member_of_declC)\n from super subcls1_C_super ws is_cls_super \n have subcls_C_super: \"G\\C \\\\<^sub>C (declclass super_method)\"\n by (auto intro: rtrancl_into_trancl2 dest: methd_declC) \n show \"\\ new. ?Constraint C new old\"\n proof (cases \"methd G C sig\")\n case None\n have \"methd G (super c) sig = None\"\n proof -\n from clsC ws None \n have no_new: \"table_of (methods c) sig = None\" \n by (auto simp add: methd_rec)\n with clsC \n have undeclared: \"G\\mid sig undeclared_in C\"\n by (auto simp add: undeclared_in_def cdeclaredmethd_def)\n with inheritable member superAccessible subcls1_C_super\n have inherits: \"G\\C inherits (method sig super_method)\"\n by (auto simp add: inherits_def)\n with clsC ws no_new super neq_C_Obj\n have \"methd G C sig = Some super_method\"\n by (auto simp add: methd_rec map_add_def intro: filter_tab_SomeI)\n with None show ?thesis\n by simp\n qed\n with super show ?thesis by auto\n next\n case (Some new)\n from this ws clsC neq_C_Obj\n show ?thesis\n proof (cases rule: methd_rec_Some_cases)\n case InheritedMethod\n with super Some show ?thesis \n by auto\n next\n case NewMethod\n assume new: \"table_of (map (\\(s, m). (s, C, m)) (methods c)) sig \n = Some new\"\n from new \n have declcls_new: \"declclass new = C\" \n by auto\n from wf clsC neq_C_Obj super new not_static_super accmodi_super_method\n have not_static_new: \"\\ is_static new\" \n by (auto dest: wf_prog_staticD) \n from clsC new\n have decl_new: \"G\\Methd sig new declared_in C\"\n by (auto simp add: declared_in_def cdeclaredmethd_def)\n from not_static_new decl_new decl_super_method\n member subcls1_C_super inheritable declcls_new subcls_C_super \n have \"G,sig\\ new overrides\\<^sub>S super_method\"\n by (auto intro: stat_overridesR.Direct) \n with super Some\n show ?thesis\n by (auto intro: stat_overridesR.Indirect)\n qed\n qed\n qed\n qed\nqed\n\nlemma inheritable_instance_methd_cases:\n assumes subclseq_C_D: \"G\\C \\\\<^sub>C D\" and\n is_cls_D: \"is_class G D\" and\n wf: \"wf_prog G\" and \n old: \"methd G D sig = Some old\" and\n accmodi_old: \"Protected \\ accmodi old\" and \n not_static_old: \"\\ is_static old\"\n obtains (Inheritance) \"methd G C sig = Some old\"\n | (Overriding) new where \"methd G C sig = Some new\" and \"G,sig\\new overrides\\<^sub>S old\"\nproof -\n from subclseq_C_D is_cls_D wf old accmodi_old not_static_old \n show ?thesis\n by (auto dest: inheritable_instance_methd intro: Inheritance Overriding)\nqed\n\nlemma inheritable_instance_methd_props: \n assumes subclseq_C_D: \"G\\C \\\\<^sub>C D\" and\n is_cls_D: \"is_class G D\" and\n wf: \"wf_prog G\" and \n old: \"methd G D sig = Some old\" and\n accmodi_old: \"Protected \\ accmodi old\" and \n not_static_old: \"\\ is_static old\"\n shows\n \"\\new. methd G C sig = Some new \\\n \\ is_static new \\ G\\resTy new\\resTy old \\ accmodi old \\accmodi new\"\n (is \"(\\new. (?Constraint C new old))\")\nproof -\n from subclseq_C_D is_cls_D wf old accmodi_old not_static_old \n show ?thesis\n proof (cases rule: inheritable_instance_methd_cases)\n case Inheritance\n with not_static_old accmodi_old show ?thesis by auto\n next\n case (Overriding new)\n then have \"\\ is_static new\" by (auto dest: stat_overrides_commonD)\n with Overriding not_static_old accmodi_old wf \n show ?thesis \n by (auto dest!: wf_prog_stat_overridesD)\n qed\nqed\n \n(* local lemma *)\nlemma bexI': \"x \\ A \\ P x \\ \\x\\A. P x\" by blast\nlemma ballE': \"\\x\\A. P x \\ (x \\ A \\ Q) \\ (P x \\ Q) \\ Q\" by blast\n\nlemma subint_widen_imethds: \n assumes irel: \"G\\I\\I J\"\n and wf: \"wf_prog G\"\n and is_iface: \"is_iface G J\"\n and jm: \"jm \\ imethds G J sig\"\n shows \"\\im \\ imethds G I sig. is_static im = is_static jm \\ \n accmodi im = accmodi jm \\\n G\\resTy im\\resTy jm\"\n using irel jm\nproof (induct rule: converse_rtrancl_induct)\n case base\n then show ?case by (blast elim: bexI')\n next\n case (step I SI)\n from `G\\I \\I1 SI`\n obtain i where\n ifI: \"iface G I = Some i\" and\n SI: \"SI \\ set (isuperIfs i)\"\n by (blast dest: subint1D)\n\n let ?newMethods \n = \"(set_option \\ table_of (map (\\(sig, mh). (sig, I, mh)) (imethods i)))\"\n show ?case\n proof (cases \"?newMethods sig = {}\")\n case True\n with ifI SI step wf\n show \"?thesis\" \n by (auto simp add: imethds_rec) \n next\n case False\n from ifI wf False\n have imethds: \"imethds G I sig = ?newMethods sig\"\n by (simp add: imethds_rec)\n from False\n obtain im where\n imdef: \"im \\ ?newMethods sig\" \n by (blast)\n with imethds \n have im: \"im \\ imethds G I sig\"\n by (blast)\n with im wf ifI \n obtain\n imStatic: \"\\ is_static im\" and\n imPublic: \"accmodi im = Public\"\n by (auto dest!: imethds_wf_mhead) \n from ifI wf \n have wf_I: \"wf_idecl G (I,i)\" \n by (rule wf_prog_idecl)\n with SI wf \n obtain si where\n ifSI: \"iface G SI = Some si\" and\n wf_SI: \"wf_idecl G (SI,si)\" \n by (auto dest!: wf_idecl_supD is_acc_ifaceD\n dest: wf_prog_idecl)\n from step\n obtain sim::\"qtname \\ mhead\" where\n sim: \"sim \\ imethds G SI sig\" and\n eq_static_sim_jm: \"is_static sim = is_static jm\" and \n eq_access_sim_jm: \"accmodi sim = accmodi jm\" and \n resTy_widen_sim_jm: \"G\\resTy sim\\resTy jm\"\n by blast\n with wf_I SI imdef sim \n have \"G\\resTy im\\resTy sim\" \n by (auto dest!: wf_idecl_hidings hidings_entailsD)\n with wf resTy_widen_sim_jm \n have resTy_widen_im_jm: \"G\\resTy im\\resTy jm\"\n by (blast intro: widen_trans)\n from sim wf ifSI \n obtain\n simStatic: \"\\ is_static sim\" and\n simPublic: \"accmodi sim = Public\"\n by (auto dest!: imethds_wf_mhead)\n from im \n imStatic simStatic eq_static_sim_jm\n imPublic simPublic eq_access_sim_jm\n resTy_widen_im_jm\n show ?thesis \n by auto \n qed\nqed\n \n(* Tactical version *)\n(* \nlemma subint_widen_imethds: \"\\G\\I\\I J; wf_prog G; is_iface G J\\ \\ \n \\ jm \\ imethds G J sig. \n \\ im \\ imethds G I sig. static (mthd im)=static (mthd jm) \\ \n access (mthd im)= access (mthd jm) \\\n G\\resTy (mthd im)\\resTy (mthd jm)\"\napply (erule converse_rtrancl_induct)\napply (clarsimp elim!: bexI')\napply (frule subint1D)\napply clarify\napply (erule ballE')\napply fast\napply (erule_tac V = \"?x \\ imethds G J sig\" in thin_rl)\napply clarsimp\napply (subst imethds_rec, assumption, erule wf_ws_prog)\napply (unfold overrides_t_def)\napply (drule (1) wf_prog_idecl)\napply (frule (3) imethds_wf_mhead [OF _ _ wf_idecl_supD [THEN conjunct1 \n [THEN is_acc_ifaceD [THEN conjunct1]]]])\napply (case_tac \"(set_option \\ table_of (map (\\(s, mh). (s, y, mh)) (imethods i)))\n sig ={}\")\napply force\n\napply (simp only:)\napply (simp)\napply clarify\napply (frule wf_idecl_hidings [THEN hidings_entailsD])\napply blast\napply blast\napply (rule bexI')\napply simp\napply (drule table_of_map_SomeI [of _ \"sig\"])\napply simp\n\napply (frule wf_idecl_mhead [of _ _ _ \"sig\"])\napply (rule table_of_Some_in_set)\napply assumption\napply auto\ndone\n*)\n \n\n(* local lemma *)\nlemma implmt1_methd: \n \"\\sig. \\G\\C\\1I; wf_prog G; im \\ imethds G I sig\\ \\ \n \\cm \\methd G C sig: \\ is_static cm \\ \\ is_static im \\ \n G\\resTy cm\\resTy im \\\n accmodi im = Public \\ accmodi cm = Public\"\napply (drule implmt1D)\napply clarify\napply (drule (2) wf_prog_cdecl [THEN wf_cdecl_impD])\napply (frule (1) imethds_wf_mhead)\napply (simp add: is_acc_iface_def)\napply (force)\ndone\n\n\n(* local lemma *)\nlemma implmt_methd [rule_format (no_asm)]: \n\"\\wf_prog G; G\\C\\I\\ \\ is_iface G I \\ \n (\\ im \\imethds G I sig. \n \\ cm\\methd G C sig: \\is_static cm \\ \\ is_static im \\ \n G\\resTy cm\\resTy im \\\n accmodi im = Public \\ accmodi cm = Public)\"\napply (frule implmt_is_class)\napply (erule implmt.induct)\napply safe\napply (drule (2) implmt1_methd)\napply fast\napply (drule (1) subint_widen_imethds)\napply simp\napply assumption\napply clarify\napply (drule (2) implmt1_methd)\napply (force)\napply (frule subcls1D)\napply (drule (1) bspec)\napply clarify\napply (drule (3) r_into_rtrancl [THEN inheritable_instance_methd_props, \n OF _ implmt_is_class])\napply auto \ndone\n\nlemma mheadsD [rule_format (no_asm)]: \n\"emh \\ mheads G S t sig \\ wf_prog G \\\n (\\C D m. t = ClassT C \\ declrefT emh = ClassT D \\ \n accmethd G S C sig = Some m \\\n (declclass m = D) \\ mhead (mthd m) = (mhd emh)) \\\n (\\I. t = IfaceT I \\ ((\\im. im \\ accimethds G (pid S) I sig \\ \n mthd im = mhd emh) \\ \n (\\m. G\\Iface I accessible_in (pid S) \\ accmethd G S Object sig = Some m \\ \n accmodi m \\ Private \\ \n declrefT emh = ClassT Object \\ mhead (mthd m) = mhd emh))) \\\n (\\T m. t = ArrayT T \\ G\\Array T accessible_in (pid S) \\\n accmethd G S Object sig = Some m \\ accmodi m \\ Private \\ \n declrefT emh = ClassT Object \\ mhead (mthd m) = mhd emh)\"\napply (rule_tac ref_ty1=\"t\" in ref_ty_ty.induct [THEN conjunct1])\napply auto\napply (auto simp add: cmheads_def accObjectmheads_def Objectmheads_def)\napply (auto dest!: accmethd_SomeD)\ndone\n\nlemma mheads_cases:\n assumes \"emh \\ mheads G S t sig\" and \"wf_prog G\"\n obtains (Class_methd) C D m where\n \"t = ClassT C\" \"declrefT emh = ClassT D\" \"accmethd G S C sig = Some m\"\n \"declclass m = D\" \"mhead (mthd m) = mhd emh\"\n | (Iface_methd) I im where \"t = IfaceT I\"\n \"im \\ accimethds G (pid S) I sig\" \"mthd im = mhd emh\"\n | (Iface_Object_methd) I m where\n \"t = IfaceT I\" \"G\\Iface I accessible_in (pid S)\"\n \"accmethd G S Object sig = Some m\" \"accmodi m \\ Private\"\n \"declrefT emh = ClassT Object\" \"mhead (mthd m) = mhd emh\"\n | (Array_Object_methd) T m where\n \"t = ArrayT T\" \"G\\Array T accessible_in (pid S)\"\n \"accmethd G S Object sig = Some m\" \"accmodi m \\ Private\"\n \"declrefT emh = ClassT Object\" \"mhead (mthd m) = mhd emh\"\nusing assms by (blast dest!: mheadsD)\n\nlemma declclassD[rule_format]:\n \"\\wf_prog G;class G C = Some c; methd G C sig = Some m; \n class G (declclass m) = Some d\\\n \\ table_of (methods d) sig = Some (mthd m)\"\nproof -\n assume wf: \"wf_prog G\"\n then have ws: \"ws_prog G\" ..\n assume clsC: \"class G C = Some c\"\n from clsC ws \n show \"\\ m d. \\methd G C sig = Some m; class G (declclass m) = Some d\\\n \\ table_of (methods d) sig = Some (mthd m)\" \n proof (induct rule: ws_class_induct)\n case Object\n with wf show \"?thesis m d\" by auto\n next\n case (Subcls C c)\n let ?newMethods = \"table_of (map (\\(s, m). (s, C, m)) (methods c)) sig\"\n show \"?thesis m d\" \n proof (cases \"?newMethods\")\n case None\n from None ws Subcls\n show \"?thesis\" by (auto simp add: methd_rec) (rule Subcls)\n next\n case Some\n from Some ws Subcls\n show \"?thesis\" \n by (auto simp add: methd_rec\n dest: wf_prog_cdecl wf_cdecl_supD is_acc_class_is_class)\n qed\n qed\nqed\n\nlemma dynmethd_Object:\n assumes statM: \"methd G Object sig = Some statM\" and\n private: \"accmodi statM = Private\" and \n is_cls_C: \"is_class G C\" and\n wf: \"wf_prog G\"\n shows \"dynmethd G Object C sig = Some statM\"\nproof -\n from is_cls_C wf \n have subclseq: \"G\\C \\\\<^sub>C Object\" \n by (auto intro: subcls_ObjectI)\n from wf have ws: \"ws_prog G\" \n by simp\n from wf \n have is_cls_Obj: \"is_class G Object\" \n by simp\n from statM subclseq is_cls_Obj ws private\n show ?thesis\n proof (cases rule: dynmethd_cases)\n case Static then show ?thesis .\n next\n case Overrides \n with private show ?thesis \n by (auto dest: no_Private_override)\n qed\nqed\n\nlemma wf_imethds_hiding_objmethdsD: \n assumes old: \"methd G Object sig = Some old\" and\n is_if_I: \"is_iface G I\" and\n wf: \"wf_prog G\" and \n not_private: \"accmodi old \\ Private\" and\n new: \"new \\ imethds G I sig\" \n shows \"G\\resTy new\\resTy old \\ is_static new = is_static old\" (is \"?P new\")\nproof -\n from wf have ws: \"ws_prog G\" by simp\n {\n fix I i new\n assume ifI: \"iface G I = Some i\"\n assume new: \"table_of (imethods i) sig = Some new\" \n from ifI new not_private wf old \n have \"?P (I,new)\"\n by (auto dest!: wf_prog_idecl wf_idecl_hiding cond_hiding_entailsD\n simp del: methd_Object)\n } note hyp_newmethod = this \n from is_if_I ws new \n show ?thesis\n proof (induct rule: ws_interface_induct)\n case (Step I i)\n assume ifI: \"iface G I = Some i\" \n assume new: \"new \\ imethds G I sig\" \n from Step\n have hyp: \"\\ J \\ set (isuperIfs i). (new \\ imethds G J sig \\ ?P new)\"\n by auto \n from new ifI ws\n show \"?P new\"\n proof (cases rule: imethds_cases)\n case NewMethod\n with ifI hyp_newmethod\n show ?thesis\n by auto\n next\n case (InheritedMethod J)\n assume \"J \\ set (isuperIfs i)\" \n \"new \\ imethds G J sig\"\n with hyp \n show \"?thesis\"\n by auto\n qed\n qed\nqed\n\ntext {*\nWhich dynamic classes are valid to look up a member of a distinct static type?\nWe have to distinct class members (named static members in Java) \nfrom instance members. Class members are global to all Objects of a class,\ninstance members are local to a single Object instance. If a member is\nequipped with the static modifier it is a class member, else it is an \ninstance member.\nThe following table gives an overview of the current framework. We assume\nto have a reference with static type statT and a dynamic class dynC. Between\nboth of these types the widening relation holds \n@{term \"G\\Class dynC\\ statT\"}. Unfortunately this ordinary widening relation \nisn't enough to describe the valid lookup classes, since we must cope the\nspecial cases of arrays and interfaces,too. If we statically expect an array or\ninteface we may lookup a field or a method in Object which isn't covered in \nthe widening relation.\n\nstatT field instance method static (class) method\n------------------------------------------------------------------------\n NullT / / /\n Iface / dynC Object\n Class dynC dynC dynC\n Array / Object Object\n\nIn most cases we con lookup the member in the dynamic class. But as an\ninterface can't declare new static methods, nor an array can define new\nmethods at all, we have to lookup methods in the base class Object.\n\nThe limitation to classes in the field column is artificial and comes out\nof the typing rule for the field access (see rule @{text \"FVar\"} in the \nwelltyping relation @{term \"wt\"} in theory WellType). \nI stems out of the fact, that Object\nindeed has no non private fields. So interfaces and arrays can actually\nhave no fields at all and a field access would be senseless. (In Java\ninterfaces are allowed to declare new fields but in current Bali not!).\nSo there is no principal reason why we should not allow Objects to declare\nnon private fields. Then we would get the following column:\n \n statT field\n----------------- \n NullT / \n Iface Object \n Class dynC \n Array Object\n*}\nprimrec valid_lookup_cls:: \"prog \\ ref_ty \\ qtname \\ bool \\ bool\"\n (\"_,_ \\ _ valid'_lookup'_cls'_for _\" [61,61,61,61] 60)\nwhere\n \"G,NullT \\ dynC valid_lookup_cls_for static_membr = False\"\n| \"G,IfaceT I \\ dynC valid_lookup_cls_for static_membr \n = (if static_membr \n then dynC=Object \n else G\\Class dynC\\ Iface I)\"\n| \"G,ClassT C \\ dynC valid_lookup_cls_for static_membr = G\\Class dynC\\ Class C\"\n| \"G,ArrayT T \\ dynC valid_lookup_cls_for static_membr = (dynC=Object)\"\n\nlemma valid_lookup_cls_is_class:\n assumes dynC: \"G,statT \\ dynC valid_lookup_cls_for static_membr\" and\n ty_statT: \"isrtype G statT\" and\n wf: \"wf_prog G\"\n shows \"is_class G dynC\"\nproof (cases statT)\n case NullT\n with dynC ty_statT show ?thesis\n by (auto dest: widen_NT2)\nnext\n case (IfaceT I)\n with dynC wf show ?thesis\n by (auto dest: implmt_is_class)\nnext\n case (ClassT C)\n with dynC ty_statT show ?thesis\n by (auto dest: subcls_is_class2)\nnext\n case (ArrayT T)\n with dynC wf show ?thesis\n by (auto)\nqed\n\ndeclare split_paired_All [simp del] split_paired_Ex [simp del]\nsetup {* map_theory_simpset (fn ctxt => ctxt delloop \"split_all_tac\") *}\nsetup {* map_theory_claset (fn ctxt => ctxt delSWrapper \"split_all_tac\") *}\n\nlemma dynamic_mheadsD: \n\"\\emh \\ mheads G S statT sig; \n G,statT \\ dynC valid_lookup_cls_for (is_static emh);\n isrtype G statT; wf_prog G\n \\ \\ \\m \\ dynlookup G statT dynC sig: \n is_static m=is_static emh \\ G\\resTy m\\resTy emh\"\nproof - \n assume emh: \"emh \\ mheads G S statT sig\"\n and wf: \"wf_prog G\"\n and dynC_Prop: \"G,statT \\ dynC valid_lookup_cls_for (is_static emh)\"\n and istype: \"isrtype G statT\"\n from dynC_Prop istype wf \n obtain y where\n dynC: \"class G dynC = Some y\" \n by (auto dest: valid_lookup_cls_is_class)\n from emh wf show ?thesis\n proof (cases rule: mheads_cases)\n case Class_methd\n fix statC statDeclC sm\n assume statC: \"statT = ClassT statC\"\n assume \"accmethd G S statC sig = Some sm\"\n then have sm: \"methd G statC sig = Some sm\" \n by (blast dest: accmethd_SomeD) \n assume eq_mheads: \"mhead (mthd sm) = mhd emh\"\n from statC \n have dynlookup: \"dynlookup G statT dynC sig = dynmethd G statC dynC sig\"\n by (simp add: dynlookup_def)\n from wf statC istype dynC_Prop sm \n obtain dm where\n \"dynmethd G statC dynC sig = Some dm\"\n \"is_static dm = is_static sm\" \n \"G\\resTy dm\\resTy sm\" \n by (force dest!: ws_dynmethd accmethd_SomeD)\n with dynlookup eq_mheads \n show ?thesis \n by (cases emh type: prod) (auto)\n next\n case Iface_methd\n fix I im\n assume statI: \"statT = IfaceT I\" and\n eq_mheads: \"mthd im = mhd emh\" and\n \"im \\ accimethds G (pid S) I sig\" \n then have im: \"im \\ imethds G I sig\" \n by (blast dest: accimethdsD)\n with istype statI eq_mheads wf \n have not_static_emh: \"\\ is_static emh\"\n by (cases emh) (auto dest: wf_prog_idecl imethds_wf_mhead)\n from statI im\n have dynlookup: \"dynlookup G statT dynC sig = methd G dynC sig\"\n by (auto simp add: dynlookup_def dynimethd_def) \n from wf dynC_Prop statI istype im not_static_emh \n obtain dm where\n \"methd G dynC sig = Some dm\"\n \"is_static dm = is_static im\" \n \"G\\resTy (mthd dm)\\resTy (mthd im)\" \n by (force dest: implmt_methd)\n with dynlookup eq_mheads\n show ?thesis \n by (cases emh type: prod) (auto)\n next\n case Iface_Object_methd\n fix I sm\n assume statI: \"statT = IfaceT I\" and\n sm: \"accmethd G S Object sig = Some sm\" and \n eq_mheads: \"mhead (mthd sm) = mhd emh\" and\n nPriv: \"accmodi sm \\ Private\"\n show ?thesis \n proof (cases \"imethds G I sig = {}\")\n case True\n with statI \n have dynlookup: \"dynlookup G statT dynC sig = dynmethd G Object dynC sig\"\n by (simp add: dynlookup_def dynimethd_def)\n from wf dynC \n have subclsObj: \"G\\dynC \\\\<^sub>C Object\"\n by (auto intro: subcls_ObjectI)\n from wf dynC dynC_Prop istype sm subclsObj \n obtain dm where\n \"dynmethd G Object dynC sig = Some dm\"\n \"is_static dm = is_static sm\" \n \"G\\resTy (mthd dm)\\resTy (mthd sm)\" \n by (auto dest!: ws_dynmethd accmethd_SomeD \n intro: class_Object [OF wf] intro: that)\n with dynlookup eq_mheads\n show ?thesis \n by (cases emh type: prod) (auto)\n next\n case False\n with statI\n have dynlookup: \"dynlookup G statT dynC sig = methd G dynC sig\"\n by (simp add: dynlookup_def dynimethd_def)\n from istype statI\n have \"is_iface G I\"\n by auto\n with wf sm nPriv False \n obtain im where\n im: \"im \\ imethds G I sig\" and\n eq_stat: \"is_static im = is_static sm\" and\n resProp: \"G\\resTy (mthd im)\\resTy (mthd sm)\"\n by (auto dest: wf_imethds_hiding_objmethdsD accmethd_SomeD)\n from im wf statI istype eq_stat eq_mheads\n have not_static_sm: \"\\ is_static emh\"\n by (cases emh) (auto dest: wf_prog_idecl imethds_wf_mhead)\n from im wf dynC_Prop dynC istype statI not_static_sm\n obtain dm where\n \"methd G dynC sig = Some dm\"\n \"is_static dm = is_static im\" \n \"G\\resTy (mthd dm)\\resTy (mthd im)\" \n by (auto dest: implmt_methd)\n with wf eq_stat resProp dynlookup eq_mheads\n show ?thesis \n by (cases emh type: prod) (auto intro: widen_trans)\n qed\n next\n case Array_Object_methd\n fix T sm\n assume statArr: \"statT = ArrayT T\" and\n sm: \"accmethd G S Object sig = Some sm\" and \n eq_mheads: \"mhead (mthd sm) = mhd emh\" \n from statArr dynC_Prop wf\n have dynlookup: \"dynlookup G statT dynC sig = methd G Object sig\"\n by (auto simp add: dynlookup_def dynmethd_C_C)\n with sm eq_mheads sm \n show ?thesis \n by (cases emh type: prod) (auto dest: accmethd_SomeD)\n qed\nqed\ndeclare split_paired_All [simp] split_paired_Ex [simp]\nsetup {* map_theory_claset (fn ctxt => ctxt addSbefore (\"split_all_tac\", split_all_tac)) *}\nsetup {* map_theory_simpset (fn ctxt => ctxt addloop (\"split_all_tac\", split_all_tac)) *}\n\n(* Tactical version *)\n(*\nlemma dynamic_mheadsD: \" \n \\emh \\ mheads G S statT sig; wf_prog G; class G dynC = Some y; \n if (\\T. statT=ArrayT T) then dynC=Object else G\\Class dynC\\RefT statT; \n isrtype G statT\\ \\ \n \\m \\ dynlookup G statT dynC sig: \n static (mthd m)=static (mhd emh) \\ G\\resTy (mthd m)\\resTy (mhd emh)\"\napply (drule mheadsD)\napply safe\n -- reftype statT is a class \napply (case_tac \"\\T. ClassT C = ArrayT T\")\napply (simp)\n\napply (clarsimp simp add: dynlookup_def )\napply (frule_tac statC=\"C\" and dynC=\"dynC\" and sig=\"sig\" \n in ws_dynmethd)\napply assumption+\napply (case_tac \"emh\") \napply (force dest: accmethd_SomeD)\n\n -- reftype statT is a interface, method defined in interface \napply (clarsimp simp add: dynlookup_def)\napply (drule (1) implmt_methd)\napply blast\napply blast\napply (clarify) \napply (unfold dynimethd_def)\napply (rule_tac x=\"cm\" in bexI)\napply (case_tac \"emh\")\napply force\n\napply force\n\n -- reftype statT is a interface, method defined in Object \napply (simp add: dynlookup_def)\napply (simp only: dynimethd_def)\napply (case_tac \"imethds G I sig = {}\")\napply simp\napply (frule_tac statC=\"Object\" and dynC=\"dynC\" and sig=\"sig\" \n in ws_dynmethd)\napply (blast intro: subcls_ObjectI wf_ws_prog) \napply (blast dest: class_Object)\napply (case_tac \"emh\") \napply (force dest: accmethd_SomeD)\n\napply simp\napply (subgoal_tac \"\\ im. im \\ imethds G I sig\") \nprefer 2 apply blast\napply clarify\napply (frule (1) implmt_methd)\napply simp\napply blast \napply (clarify dest!: accmethd_SomeD)\napply (frule (4) iface_overrides_Object)\napply clarify\napply (case_tac emh)\napply force\n\n -- reftype statT is a array\napply (simp add: dynlookup_def)\napply (case_tac emh)\napply (force dest: accmethd_SomeD simp add: dynmethd_def)\ndone\n*)\n\n(* FIXME occasionally convert to ws_class_induct*) \nlemma methd_declclass:\n\"\\class G C = Some c; wf_prog G; methd G C sig = Some m\\ \n \\ methd G (declclass m) sig = Some m\"\nproof -\n assume asm: \"class G C = Some c\" \"wf_prog G\" \"methd G C sig = Some m\"\n have \"wf_prog G \\ \n (\\ c m. class G C = Some c \\ methd G C sig = Some m \n \\ methd G (declclass m) sig = Some m)\" (is \"?P G C\") \n proof (induct G C rule: class_rec_induct', intro allI impI)\n fix G C c m\n assume hyp: \"\\c. class G C = Some c \\ ws_prog G \\ C \\ Object \\\n ?P G (super c)\"\n assume wf: \"wf_prog G\" and cls_C: \"class G C = Some c\" and\n m: \"methd G C sig = Some m\"\n show \"methd G (declclass m) sig = Some m\"\n proof (cases \"C=Object\")\n case True\n with wf m show ?thesis by (auto intro: table_of_map_SomeI)\n next\n let ?filter=\"filter_tab (\\sig m. G\\C inherits method sig m)\"\n let ?table = \"table_of (map (\\(s, m). (s, C, m)) (methods c))\"\n case False\n with cls_C wf m\n have methd_C: \"(?filter (methd G (super c)) ++ ?table) sig = Some m \"\n by (simp add: methd_rec)\n show ?thesis\n proof (cases \"?table sig\")\n case None\n from this methd_C have \"?filter (methd G (super c)) sig = Some m\"\n by simp\n moreover\n from wf cls_C False obtain sup where \"class G (super c) = Some sup\"\n by (blast dest: wf_prog_cdecl wf_cdecl_supD is_acc_class_is_class)\n moreover note wf False cls_C \n ultimately show ?thesis by (auto intro: hyp [rule_format])\n next\n case Some\n from this methd_C m show ?thesis by auto \n qed\n qed\n qed \n with asm show ?thesis by auto\nqed\n\nlemma dynmethd_declclass:\n \"\\dynmethd G statC dynC sig = Some m;\n wf_prog G; is_class G statC\n \\ \\ methd G (declclass m) sig = Some m\"\nby (auto dest: dynmethd_declC)\n\nlemma dynlookup_declC:\n \"\\dynlookup G statT dynC sig = Some m; wf_prog G;\n is_class G dynC;isrtype G statT\n \\ \\ G\\dynC \\\\<^sub>C (declclass m) \\ is_class G (declclass m)\"\nby (cases \"statT\")\n (auto simp add: dynlookup_def dynimethd_def \n dest: methd_declC dynmethd_declC)\n\nlemma dynlookup_Array_declclassD [simp]:\n\"\\dynlookup G (ArrayT T) Object sig = Some dm;wf_prog G\\ \n \\ declclass dm = Object\"\nproof -\n assume dynL: \"dynlookup G (ArrayT T) Object sig = Some dm\"\n assume wf: \"wf_prog G\"\n from wf have ws: \"ws_prog G\" by auto\n from wf have is_cls_Obj: \"is_class G Object\" by auto\n from dynL wf\n show ?thesis\n by (auto simp add: dynlookup_def dynmethd_C_C [OF is_cls_Obj ws]\n dest: methd_Object_SomeD)\nqed \n \n\ndeclare split_paired_All [simp del] split_paired_Ex [simp del]\nsetup {* map_theory_simpset (fn ctxt => ctxt delloop \"split_all_tac\") *}\nsetup {* map_theory_claset (fn ctxt => ctxt delSWrapper \"split_all_tac\") *}\n\nlemma wt_is_type: \"E,dt\\v\\T \\ wf_prog (prg E) \\ \n dt=empty_dt \\ (case T of \n Inl T \\ is_type (prg E) T \n | Inr Ts \\ Ball (set Ts) (is_type (prg E)))\"\napply (unfold empty_dt_def)\napply (erule wt.induct)\napply (auto split del: split_if_asm simp del: snd_conv \n simp add: is_acc_class_def is_acc_type_def)\napply (erule typeof_empty_is_type)\napply (frule (1) wf_prog_cdecl [THEN wf_cdecl_supD], \n force simp del: snd_conv, clarsimp simp add: is_acc_class_def)\napply (drule (1) max_spec2mheads [THEN conjunct1, THEN mheadsD])\napply (drule_tac [2] accfield_fields) \napply (frule class_Object)\napply (auto dest: accmethd_rT_is_type \n imethds_wf_mhead [THEN conjunct1, THEN rT_is_acc_type]\n dest!:accimethdsD\n simp del: class_Object\n simp add: is_acc_type_def\n )\ndone\ndeclare split_paired_All [simp] split_paired_Ex [simp]\nsetup {* map_theory_claset (fn ctxt => ctxt addSbefore (\"split_all_tac\", split_all_tac)) *}\nsetup {* map_theory_simpset (fn ctxt => ctxt addloop (\"split_all_tac\", split_all_tac)) *}\n\nlemma ty_expr_is_type: \n\"\\E\\e\\-T; wf_prog (prg E)\\ \\ is_type (prg E) T\"\nby (auto dest!: wt_is_type)\nlemma ty_var_is_type: \n\"\\E\\v\\=T; wf_prog (prg E)\\ \\ is_type (prg E) T\"\nby (auto dest!: wt_is_type)\nlemma ty_exprs_is_type: \n\"\\E\\es\\\\Ts; wf_prog (prg E)\\ \\ Ball (set Ts) (is_type (prg E))\"\nby (auto dest!: wt_is_type)\n\n\nlemma static_mheadsD: \n \"\\ emh \\ mheads G S t sig; wf_prog G; E\\e\\-RefT t; prg E=G ; \n invmode (mhd emh) e \\ IntVir \n \\ \\ \\m. ( (\\ C. t = ClassT C \\ accmethd G S C sig = Some m)\n \\ (\\ C. t \\ ClassT C \\ accmethd G S Object sig = Some m )) \\ \n declrefT emh = ClassT (declclass m) \\ mhead (mthd m) = (mhd emh)\"\napply (subgoal_tac \"is_static emh \\ e = Super\")\ndefer apply (force simp add: invmode_def)\napply (frule ty_expr_is_type)\napply simp\napply (case_tac \"is_static emh\")\napply (frule (1) mheadsD)\napply clarsimp\napply safe\napply blast\napply (auto dest!: imethds_wf_mhead\n accmethd_SomeD \n accimethdsD\n simp add: accObjectmheads_def Objectmheads_def)\n\napply (erule wt_elim_cases)\napply (force simp add: cmheads_def)\ndone\n\nlemma wt_MethdI: \n\"\\methd G C sig = Some m; wf_prog G; \n class G C = Some c\\ \\ \n \\T. \\prg=G,cls=(declclass m),\n lcl=callee_lcl (declclass m) sig (mthd m)\\\\ Methd C sig\\-T \\ G\\T\\resTy m\"\napply (frule (2) methd_wf_mdecl, clarify)\napply (force dest!: wf_mdecl_bodyD intro!: wt.Methd)\ndone\n\nsubsection \"accessibility concerns\"\n\nlemma mheads_type_accessible:\n \"\\emh \\ mheads G S T sig; wf_prog G\\\n \\ G\\RefT T accessible_in (pid S)\"\nby (erule mheads_cases)\n (auto dest: accmethd_SomeD accessible_from_commonD accimethdsD)\n\nlemma static_to_dynamic_accessible_from_aux:\n\"\\G\\m of C accessible_from accC;wf_prog G\\ \n \\ G\\m in C dyn_accessible_from accC\"\nproof (induct rule: accessible_fromR.induct)\nqed (auto intro: dyn_accessible_fromR.intros \n member_of_to_member_in\n static_to_dynamic_overriding)\n\nlemma static_to_dynamic_accessible_from:\n assumes stat_acc: \"G\\m of statC accessible_from accC\" and\n subclseq: \"G\\dynC \\\\<^sub>C statC\" and\n wf: \"wf_prog G\"\n shows \"G\\m in dynC dyn_accessible_from accC\"\nproof - \n from stat_acc subclseq \n show ?thesis (is \"?Dyn_accessible m\")\n proof (induct rule: accessible_fromR.induct)\n case (Immediate m statC)\n then show \"?Dyn_accessible m\"\n by (blast intro: dyn_accessible_fromR.Immediate\n member_inI\n permits_acc_inheritance)\n next\n case (Overriding m _ _)\n with wf show \"?Dyn_accessible m\"\n by (blast intro: dyn_accessible_fromR.Overriding\n member_inI\n static_to_dynamic_overriding \n rtrancl_trancl_trancl \n static_to_dynamic_accessible_from_aux)\n qed\nqed\n\nlemma static_to_dynamic_accessible_from_static:\n assumes stat_acc: \"G\\m of statC accessible_from accC\" and\n static: \"is_static m\" and\n wf: \"wf_prog G\"\n shows \"G\\m in (declclass m) dyn_accessible_from accC\"\nproof -\n from stat_acc wf \n have \"G\\m in statC dyn_accessible_from accC\"\n by (auto intro: static_to_dynamic_accessible_from)\n from this static\n show ?thesis\n by (rule dyn_accessible_from_static_declC)\nqed\n\nlemma dynmethd_member_in:\n assumes m: \"dynmethd G statC dynC sig = Some m\" and\n iscls_statC: \"is_class G statC\" and\n wf: \"wf_prog G\"\n shows \"G\\Methd sig m member_in dynC\"\nproof -\n from m \n have subclseq: \"G\\dynC \\\\<^sub>C statC\"\n by (auto simp add: dynmethd_def)\n from subclseq iscls_statC \n have iscls_dynC: \"is_class G dynC\"\n by (rule subcls_is_class2)\n from iscls_dynC iscls_statC wf m\n have \"G\\dynC \\\\<^sub>C (declclass m) \\ is_class G (declclass m) \\\n methd G (declclass m) sig = Some m\" \n by - (drule dynmethd_declC, auto)\n with wf \n show ?thesis\n by (auto intro: member_inI dest: methd_member_of)\nqed\n\nlemma dynmethd_access_prop:\n assumes statM: \"methd G statC sig = Some statM\" and\n stat_acc: \"G\\Methd sig statM of statC accessible_from accC\" and\n dynM: \"dynmethd G statC dynC sig = Some dynM\" and\n wf: \"wf_prog G\" \n shows \"G\\Methd sig dynM in dynC dyn_accessible_from accC\"\nproof -\n from wf have ws: \"ws_prog G\" ..\n from dynM \n have subclseq: \"G\\dynC \\\\<^sub>C statC\"\n by (auto simp add: dynmethd_def)\n from stat_acc \n have is_cls_statC: \"is_class G statC\"\n by (auto dest: accessible_from_commonD member_of_is_classD)\n with subclseq \n have is_cls_dynC: \"is_class G dynC\"\n by (rule subcls_is_class2)\n from is_cls_statC statM wf \n have member_statC: \"G\\Methd sig statM member_of statC\"\n by (auto intro: methd_member_of)\n from stat_acc \n have statC_acc: \"G\\Class statC accessible_in (pid accC)\"\n by (auto dest: accessible_from_commonD)\n from statM subclseq is_cls_statC ws \n show ?thesis\n proof (cases rule: dynmethd_cases)\n case Static\n assume dynmethd: \"dynmethd G statC dynC sig = Some statM\"\n with dynM have eq_dynM_statM: \"dynM=statM\" \n by simp\n with stat_acc subclseq wf \n show ?thesis\n by (auto intro: static_to_dynamic_accessible_from)\n next\n case (Overrides newM)\n assume dynmethd: \"dynmethd G statC dynC sig = Some newM\"\n assume override: \"G,sig\\newM overrides statM\"\n assume neq: \"newM\\statM\"\n from dynmethd dynM \n have eq_dynM_newM: \"dynM=newM\" \n by simp\n from dynmethd eq_dynM_newM wf is_cls_statC\n have \"G\\Methd sig dynM member_in dynC\"\n by (auto intro: dynmethd_member_in)\n moreover\n from subclseq\n have \"G\\dynC\\\\<^sub>C statC\"\n proof (cases rule: subclseq_cases)\n case Eq\n assume \"dynC=statC\"\n moreover\n from is_cls_statC obtain c\n where \"class G statC = Some c\"\n by auto\n moreover \n note statM ws dynmethd \n ultimately\n have \"newM=statM\" \n by (auto simp add: dynmethd_C_C)\n with neq show ?thesis \n by (contradiction)\n next\n case Subcls then show ?thesis .\n qed \n moreover\n from stat_acc wf \n have \"G\\Methd sig statM in statC dyn_accessible_from accC\"\n by (blast intro: static_to_dynamic_accessible_from)\n moreover\n note override eq_dynM_newM\n ultimately show ?thesis\n by (cases dynM,cases statM) (auto intro: dyn_accessible_fromR.Overriding)\n qed\nqed\n\nlemma implmt_methd_access:\n fixes accC::qtname\n assumes iface_methd: \"imethds G I sig \\ {}\" and\n implements: \"G\\dynC\\I\" and\n isif_I: \"is_iface G I\" and\n wf: \"wf_prog G\" \n shows \"\\ dynM. methd G dynC sig = Some dynM \\ \n G\\Methd sig dynM in dynC dyn_accessible_from accC\"\nproof -\n from implements \n have iscls_dynC: \"is_class G dynC\" by (rule implmt_is_class)\n from iface_methd\n obtain im\n where \"im \\ imethds G I sig\"\n by auto\n with wf implements isif_I \n obtain dynM \n where dynM: \"methd G dynC sig = Some dynM\" and\n pub: \"accmodi dynM = Public\"\n by (blast dest: implmt_methd)\n with iscls_dynC wf\n have \"G\\Methd sig dynM in dynC dyn_accessible_from accC\"\n by (auto intro!: dyn_accessible_fromR.Immediate \n intro: methd_member_of member_of_to_member_in\n simp add: permits_acc_def)\n with dynM \n show ?thesis\n by blast\nqed\n\ncorollary implmt_dynimethd_access:\n fixes accC::qtname\n assumes iface_methd: \"imethds G I sig \\ {}\" and\n implements: \"G\\dynC\\I\" and\n isif_I: \"is_iface G I\" and\n wf: \"wf_prog G\" \n shows \"\\ dynM. dynimethd G I dynC sig = Some dynM \\ \n G\\Methd sig dynM in dynC dyn_accessible_from accC\"\nproof -\n from iface_methd\n have \"dynimethd G I dynC sig = methd G dynC sig\"\n by (simp add: dynimethd_def)\n with iface_methd implements isif_I wf \n show ?thesis\n by (simp only:)\n (blast intro: implmt_methd_access)\nqed\n\nlemma dynlookup_access_prop:\n assumes emh: \"emh \\ mheads G accC statT sig\" and\n dynM: \"dynlookup G statT dynC sig = Some dynM\" and\n dynC_prop: \"G,statT \\ dynC valid_lookup_cls_for is_static emh\" and\n isT_statT: \"isrtype G statT\" and\n wf: \"wf_prog G\"\n shows \"G \\Methd sig dynM in dynC dyn_accessible_from accC\"\nproof -\n from emh wf\n have statT_acc: \"G\\RefT statT accessible_in (pid accC)\"\n by (rule mheads_type_accessible)\n from dynC_prop isT_statT wf\n have iscls_dynC: \"is_class G dynC\"\n by (rule valid_lookup_cls_is_class)\n from emh dynC_prop isT_statT wf dynM\n have eq_static: \"is_static emh = is_static dynM\"\n by (auto dest: dynamic_mheadsD)\n from emh wf show ?thesis\n proof (cases rule: mheads_cases)\n case (Class_methd statC _ statM)\n assume statT: \"statT = ClassT statC\"\n assume \"accmethd G accC statC sig = Some statM\"\n then have statM: \"methd G statC sig = Some statM\" and\n stat_acc: \"G\\Methd sig statM of statC accessible_from accC\"\n by (auto dest: accmethd_SomeD)\n from dynM statT\n have dynM': \"dynmethd G statC dynC sig = Some dynM\"\n by (simp add: dynlookup_def) \n from statM stat_acc wf dynM'\n show ?thesis\n by (auto dest!: dynmethd_access_prop)\n next\n case (Iface_methd I im)\n then have iface_methd: \"imethds G I sig \\ {}\" and\n statT_acc: \"G\\RefT statT accessible_in (pid accC)\" \n by (auto dest: accimethdsD)\n assume statT: \"statT = IfaceT I\"\n assume im: \"im \\ accimethds G (pid accC) I sig\"\n assume eq_mhds: \"mthd im = mhd emh\"\n from dynM statT\n have dynM': \"dynimethd G I dynC sig = Some dynM\"\n by (simp add: dynlookup_def)\n from isT_statT statT \n have isif_I: \"is_iface G I\"\n by simp\n show ?thesis\n proof (cases \"is_static emh\")\n case False\n with statT dynC_prop \n have widen_dynC: \"G\\Class dynC \\ RefT statT\"\n by simp\n from statT widen_dynC\n have implmnt: \"G\\dynC\\I\"\n by auto \n from eq_static False \n have not_static_dynM: \"\\ is_static dynM\" \n by simp\n from iface_methd implmnt isif_I wf dynM'\n show ?thesis\n by - (drule implmt_dynimethd_access, auto)\n next\n case True\n assume \"is_static emh\"\n moreover\n from wf isT_statT statT im \n have \"\\ is_static im\"\n by (auto dest: accimethdsD wf_prog_idecl imethds_wf_mhead)\n moreover note eq_mhds\n ultimately show ?thesis\n by (cases emh) auto\n qed\n next\n case (Iface_Object_methd I statM)\n assume statT: \"statT = IfaceT I\"\n assume \"accmethd G accC Object sig = Some statM\"\n then have statM: \"methd G Object sig = Some statM\" and\n stat_acc: \"G\\Methd sig statM of Object accessible_from accC\"\n by (auto dest: accmethd_SomeD)\n assume not_Private_statM: \"accmodi statM \\ Private\"\n assume eq_mhds: \"mhead (mthd statM) = mhd emh\"\n from iscls_dynC wf\n have widen_dynC_Obj: \"G\\dynC \\\\<^sub>C Object\"\n by (auto intro: subcls_ObjectI)\n show ?thesis\n proof (cases \"imethds G I sig = {}\")\n case True\n from dynM statT True\n have dynM': \"dynmethd G Object dynC sig = Some dynM\"\n by (simp add: dynlookup_def dynimethd_def)\n from statT \n have \"G\\RefT statT \\Class Object\"\n by auto\n with statM statT_acc stat_acc widen_dynC_Obj statT isT_statT \n wf dynM' eq_static dynC_prop \n show ?thesis\n by - (drule dynmethd_access_prop,force+) \n next\n case False\n then obtain im where\n im: \"im \\ imethds G I sig\"\n by auto\n have not_static_emh: \"\\ is_static emh\"\n proof -\n from im statM statT isT_statT wf not_Private_statM \n have \"is_static im = is_static statM\"\n by (fastforce dest: wf_imethds_hiding_objmethdsD)\n with wf isT_statT statT im \n have \"\\ is_static statM\"\n by (auto dest: wf_prog_idecl imethds_wf_mhead)\n with eq_mhds\n show ?thesis \n by (cases emh) auto\n qed\n with statT dynC_prop\n have implmnt: \"G\\dynC\\I\"\n by simp\n with isT_statT statT\n have isif_I: \"is_iface G I\"\n by simp\n from dynM statT\n have dynM': \"dynimethd G I dynC sig = Some dynM\"\n by (simp add: dynlookup_def) \n from False implmnt isif_I wf dynM'\n show ?thesis\n by - (drule implmt_dynimethd_access, auto)\n qed\n next\n case (Array_Object_methd T statM)\n assume statT: \"statT = ArrayT T\"\n assume \"accmethd G accC Object sig = Some statM\"\n then have statM: \"methd G Object sig = Some statM\" and\n stat_acc: \"G\\Methd sig statM of Object accessible_from accC\"\n by (auto dest: accmethd_SomeD)\n from statT dynC_prop\n have dynC_Obj: \"dynC = Object\" \n by simp\n then\n have widen_dynC_Obj: \"G\\Class dynC \\ Class Object\"\n by simp\n from dynM statT \n have dynM': \"dynmethd G Object dynC sig = Some dynM\"\n by (simp add: dynlookup_def)\n from statM statT_acc stat_acc dynM' wf widen_dynC_Obj \n statT isT_statT \n show ?thesis \n by - (drule dynmethd_access_prop, simp+) \n qed\nqed\n\nlemma dynlookup_access:\n assumes emh: \"emh \\ mheads G accC statT sig\" and\n dynC_prop: \"G,statT \\ dynC valid_lookup_cls_for (is_static emh) \" and\n isT_statT: \"isrtype G statT\" and\n wf: \"wf_prog G\"\n shows \"\\ dynM. dynlookup G statT dynC sig = Some dynM \\ \n G\\Methd sig dynM in dynC dyn_accessible_from accC\"\nproof - \n from dynC_prop isT_statT wf\n have is_cls_dynC: \"is_class G dynC\"\n by (auto dest: valid_lookup_cls_is_class)\n with emh wf dynC_prop isT_statT\n obtain dynM where \n \"dynlookup G statT dynC sig = Some dynM\"\n by - (drule dynamic_mheadsD,auto)\n with emh dynC_prop isT_statT wf\n show ?thesis \n by (blast intro: dynlookup_access_prop)\nqed\n\nlemma stat_overrides_Package_old: \n assumes stat_override: \"G \\ new overrides\\<^sub>S old\" and \n accmodi_new: \"accmodi new = Package\" and\n wf: \"wf_prog G \"\n shows \"accmodi old = Package\"\nproof -\n from stat_override wf \n have \"accmodi old \\ accmodi new\"\n by (auto dest: wf_prog_stat_overridesD)\n with stat_override accmodi_new show ?thesis\n by (cases \"accmodi old\") (auto dest: no_Private_stat_override \n dest: acc_modi_le_Dests)\nqed\n\nsubsubsection {* Properties of dynamic accessibility *}\n\nlemma dyn_accessible_Private:\n assumes dyn_acc: \"G \\ m in C dyn_accessible_from accC\" and\n priv: \"accmodi m = Private\"\n shows \"accC = declclass m\"\nproof -\n from dyn_acc priv\n show ?thesis\n proof (induct)\n case (Immediate m C)\n from `G \\ m in C permits_acc_from accC` and `accmodi m = Private`\n show ?case\n by (simp add: permits_acc_def)\n next\n case Overriding\n then show ?case\n by (auto dest!: overrides_commonD)\n qed\nqed\n\ntext {* @{text dyn_accessible_Package} only works with the @{text wf_prog} assumption. \nWithout it. it is easy to leaf the Package!\n*}\nlemma dyn_accessible_Package:\n \"\\G \\ m in C dyn_accessible_from accC; accmodi m = Package;\n wf_prog G\\\n \\ pid accC = pid (declclass m)\"\nproof -\n assume wf: \"wf_prog G \"\n assume accessible: \"G \\ m in C dyn_accessible_from accC\"\n then show \"accmodi m = Package \n \\ pid accC = pid (declclass m)\"\n (is \"?Pack m \\ ?P m\")\n proof (induct rule: dyn_accessible_fromR.induct)\n case (Immediate m C)\n assume \"G\\m member_in C\"\n \"G \\ m in C permits_acc_from accC\"\n \"accmodi m = Package\" \n then show \"?P m\"\n by (auto simp add: permits_acc_def)\n next\n case (Overriding new declC newm old Sup C)\n assume member_new: \"G \\ new member_in C\" and\n new: \"new = (declC, mdecl newm)\" and\n override: \"G \\ (declC, newm) overrides old\" and\n subcls_C_Sup: \"G\\C \\\\<^sub>C Sup\" and\n acc_old: \"G \\ methdMembr old in Sup dyn_accessible_from accC\" and\n hyp: \"?Pack (methdMembr old) \\ ?P (methdMembr old)\" and\n accmodi_new: \"accmodi new = Package\"\n from override accmodi_new new wf \n have accmodi_old: \"accmodi old = Package\" \n by (auto dest: overrides_Package_old)\n with hyp \n have P_sup: \"?P (methdMembr old)\"\n by (simp)\n from wf override new accmodi_old accmodi_new\n have eq_pid_new_old: \"pid (declclass new) = pid (declclass old)\"\n by (auto dest: dyn_override_Package)\n with eq_pid_new_old P_sup show \"?P new\"\n by auto\n qed\nqed\n\ntext {* For fields we don't need the wellformedness of the program, since\nthere is no overriding *}\nlemma dyn_accessible_field_Package:\n assumes dyn_acc: \"G \\ f in C dyn_accessible_from accC\" and\n pack: \"accmodi f = Package\" and\n field: \"is_field f\"\n shows \"pid accC = pid (declclass f)\"\nproof -\n from dyn_acc pack field\n show ?thesis\n proof (induct)\n case (Immediate f C)\n from `G \\ f in C permits_acc_from accC` and `accmodi f = Package`\n show ?case\n by (simp add: permits_acc_def)\n next\n case Overriding\n then show ?case by (simp add: is_field_def)\n qed\nqed\n\ntext {* @{text dyn_accessible_instance_field_Protected} only works for fields\nsince methods can break the package bounds due to overriding\n*}\nlemma dyn_accessible_instance_field_Protected:\n assumes dyn_acc: \"G \\ f in C dyn_accessible_from accC\" and\n prot: \"accmodi f = Protected\" and\n field: \"is_field f\" and\n instance_field: \"\\ is_static f\" and\n outside: \"pid (declclass f) \\ pid accC\"\n shows \"G\\ C \\\\<^sub>C accC\"\nproof -\n from dyn_acc prot field instance_field outside\n show ?thesis\n proof (induct)\n case (Immediate f C)\n note `G \\ f in C permits_acc_from accC`\n moreover \n assume \"accmodi f = Protected\" and \"is_field f\" and \"\\ is_static f\" and\n \"pid (declclass f) \\ pid accC\"\n ultimately \n show \"G\\ C \\\\<^sub>C accC\"\n by (auto simp add: permits_acc_def)\n next\n case Overriding\n then show ?case by (simp add: is_field_def)\n qed\nqed\n \nlemma dyn_accessible_static_field_Protected:\n assumes dyn_acc: \"G \\ f in C dyn_accessible_from accC\" and\n prot: \"accmodi f = Protected\" and\n field: \"is_field f\" and\n static_field: \"is_static f\" and\n outside: \"pid (declclass f) \\ pid accC\"\n shows \"G\\ accC \\\\<^sub>C declclass f \\ G\\C \\\\<^sub>C declclass f\"\nproof -\n from dyn_acc prot field static_field outside\n show ?thesis\n proof (induct)\n case (Immediate f C)\n assume \"accmodi f = Protected\" and \"is_field f\" and \"is_static f\" and\n \"pid (declclass f) \\ pid accC\"\n moreover\n note `G \\ f in C permits_acc_from accC`\n ultimately\n have \"G\\ accC \\\\<^sub>C declclass f\"\n by (auto simp add: permits_acc_def)\n moreover\n from `G \\ f member_in C`\n have \"G\\C \\\\<^sub>C declclass f\"\n by (rule member_in_class_relation)\n ultimately show ?case\n by blast\n next\n case Overriding\n then show ?case by (simp add: is_field_def)\n qed\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Bali/WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.3140505578320071, "lm_q1q2_score": 0.18375134840982796}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\ntheory SubMonad_AI\nimports KHeap_AI\nbegin\n\n(* SubMonadLib *)\nlemma submonad_do_machine_op:\n \"submonad machine_state (machine_state_update \\ K) \\ do_machine_op\"\n apply unfold_locales\n apply (clarsimp simp: ext stateAssert_def do_machine_op_def o_def gets_def\n get_def bind_def return_def submonad_fn_def)+\n done\n\ninterpretation submonad_do_machine_op:\n submonad machine_state \"(machine_state_update \\ K)\" \\ do_machine_op\n by (rule submonad_do_machine_op)\n\nlemma submonad_args_pspace:\n \"submonad_args kheap (kheap_update o (\\x _. x)) \\\"\n by (simp add: submonad_args_def)\n\nschematic_goal assert_get_tcb_pspace:\n \"gets_the (get_tcb t) = submonad_fn kheap (kheap_update o (\\x _. x)) \\ ?f\"\n apply (unfold gets_the_def)\n apply (rule submonad_bind_alt [OF submonad_args_pspace])\n apply (rule gets_submonad [OF submonad_args_pspace _ refl])\n apply (simp add: get_tcb_def)\n apply (rule assert_opt_submonad [OF submonad_args_pspace])\n apply simp\n apply (rule empty_fail_assert_opt)\n done\n\nlemma assert_get_thread_do_machine_op_comm:\n \"empty_fail m' \\\n do x \\ gets_the (get_tcb t); y \\ do_machine_op m'; n x y od =\n do y \\ do_machine_op m'; x \\ gets_the (get_tcb t); n x y od\"\n apply (rule submonad_comm2 [OF _ _ submonad_do_machine_op])\n apply (rule submonad_args_pspace)\n apply (rule assert_get_tcb_pspace)\n apply simp+\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/SubMonad_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3380771241500058, "lm_q1q2_score": 0.1835296575815908}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__18.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__18 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__18 and some rule r*}\nlemma n_StoreVsinv__18:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\\(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Empty))) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__18:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__18 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__18:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__18.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725051, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.1835296539611308}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\ntheory DetSchedInvs_AI\nimports \"$L4V_ARCH/ArchDeterministic_AI\"\nbegin\n\nlemma get_etcb_rev:\n \"ekheap s p = Some etcb \\ get_etcb p s = Some etcb\"\n by (clarsimp simp: get_etcb_def)\n\nlemma get_etcb_SomeD: \"get_etcb ptr s = Some v \\ ekheap s ptr = Some v\"\n apply (case_tac \"ekheap s ptr\", simp_all add: get_etcb_def)\n done\n\ndefinition obj_at_kh where\n\"obj_at_kh P ref kh \\ obj_at P ref ((undefined :: det_ext state)\\kheap := kh\\)\"\n\nlemma obj_at_kh_simp[simp]: \"obj_at_kh P ref (kheap st) = obj_at P ref st\"\n apply (simp add: obj_at_def obj_at_kh_def)\n done\n\n\ndefinition st_tcb_at_kh where\n\"st_tcb_at_kh test \\ obj_at_kh (\\ko. \\tcb. ko = TCB tcb \\ test (tcb_state tcb))\"\n\nlemma st_tcb_at_kh_simp[simp]: \"st_tcb_at_kh test t (kheap st) = st_tcb_at test t st\"\n apply (simp add: pred_tcb_at_def st_tcb_at_kh_def)\n done\n\n\ndefinition is_etcb_at' where\n\"is_etcb_at' ref ekh \\ ekh ref \\ None\"\n\nabbreviation is_etcb_at:: \"obj_ref \\ det_ext state \\ bool\" where\n\"is_etcb_at ref s \\ is_etcb_at' ref (ekheap s)\"\n\nlemmas is_etcb_at_def = is_etcb_at'_def\n\ndefinition etcb_at' :: \"(etcb \\ bool) \\ obj_ref \\ (obj_ref \\ etcb option) \\ bool\" where\n\"etcb_at' P ref ekh \\ case ekh ref of Some x \\ P x | _ \\ True\"\n\nabbreviation etcb_at :: \"(etcb \\ bool) \\ obj_ref \\ det_ext state \\ bool\" where\n\"etcb_at P ref s \\ etcb_at' P ref (ekheap s)\"\n\nlemmas etcb_at_def = etcb_at'_def\n\nlemma etcb_at_taut[simp]: \"etcb_at' \\ ref ekh\"\n apply (simp add: etcb_at'_def split: option.split)\n done\n\nlemma etcb_at_conj_is_etcb_at:\n \"(is_etcb_at' t ekh \\ etcb_at' P t ekh)\n = (case ekh t of None \\ False | Some x \\ P x)\"\n by (simp add: is_etcb_at_def etcb_at_def split: option.splits)\n\ndefinition valid_etcbs_2 :: \"(obj_ref \\ etcb option) \\ (obj_ref \\ kernel_object option) \\ bool\"where\n\"valid_etcbs_2 ekh kh \\ \\ptr. (st_tcb_at_kh \\ ptr kh) = (is_etcb_at' ptr ekh)\"\n\n\nabbreviation valid_etcbs :: \"det_ext state \\ bool\" where\n\"valid_etcbs s \\ valid_etcbs_2 (ekheap s) (kheap s)\"\n\nlemmas valid_etcbs_def = valid_etcbs_2_def\n\n\ndefinition\n valid_idle_etcb_2 :: \"(obj_ref \\ etcb option) \\ bool\"\nwhere\n \"valid_idle_etcb_2 ekh \\ etcb_at' (\\etcb. tcb_domain etcb = default_domain) idle_thread_ptr ekh\"\n\nabbreviation valid_idle_etcb :: \"det_ext state \\ bool\" where\n \"valid_idle_etcb s \\ valid_idle_etcb_2 (ekheap s)\"\n\nlemmas valid_idle_etcb_def = valid_idle_etcb_2_def\n\n\ndefinition not_queued_2 where\n \"not_queued_2 qs t \\ \\d p. t \\ set (qs d p)\"\n\nabbreviation not_queued :: \"obj_ref \\ det_ext state \\ bool\" where\n \"not_queued t s \\ not_queued_2 (ready_queues s) t\"\n\ndefinition valid_queues_2 where\n \"valid_queues_2 queues ekh kh \\ (\\d p.\n (\\t \\ set (queues d p). is_etcb_at' t ekh\n \\ etcb_at' (\\t. tcb_priority t = p \\ tcb_domain t = d) t ekh\n \\ st_tcb_at_kh runnable t kh)\n \\ distinct (queues d p))\"\n\nabbreviation valid_queues :: \"det_ext state \\ bool\" where\n\"valid_queues s \\ valid_queues_2 (ready_queues s) (ekheap s) (kheap s)\"\n\nlemmas valid_queues_def = valid_queues_2_def\n\nlemma valid_queues_def2:\n \"valid_queues_2 queues ekh kh =\n (\\d p. (\\t \\ set (queues d p).\n is_etcb_at' t ekh \\\n (case ekh t of None \\ False | Some x \\ tcb_priority x = p \\ tcb_domain x = d) \\\n st_tcb_at_kh runnable t kh) \\\n distinct (queues d p))\"\n by (clarsimp simp: valid_queues_def\n conj_assoc[where P=\"is_etcb_at' t ekh \\ (case ekh t of\n None \\ False |\n Some x \\ tcb_priority x = p \\ tcb_domain x = d)\"]\n etcb_at_conj_is_etcb_at[symmetric])\n\ndefinition valid_blocked_2 where\n \"valid_blocked_2 queues kh sa ct \\\n (\\t st. not_queued_2 queues t \\ st_tcb_at_kh (op = st) t kh \\ \n t \\ ct \\ sa \\ switch_thread t \\ (\\ active st))\"\n\nabbreviation valid_blocked :: \"det_ext state \\ bool\" where\n \"valid_blocked s \\ valid_blocked_2 (ready_queues s) (kheap s) (scheduler_action s) (cur_thread s)\"\n\nlemmas valid_blocked_def = valid_blocked_2_def\n\ndefinition valid_blocked_except_2 where\n \"valid_blocked_except_2 thread queues kh sa ct \\\n (\\t st. t \\ thread \\ not_queued_2 queues t \\ st_tcb_at_kh (op = st) t kh \\ \n t \\ ct \\ sa \\ switch_thread t \\ (\\ active st))\"\n\nabbreviation valid_blocked_except :: \"obj_ref \\ det_ext state \\ bool\" where\n \"valid_blocked_except t s \\ valid_blocked_except_2 t (ready_queues s) (kheap s) (scheduler_action s) (cur_thread s)\"\n\nlemmas valid_blocked_except_def = valid_blocked_except_2_def\n\ndefinition in_cur_domain_2 where\n \"in_cur_domain_2 thread cdom ekh \\ etcb_at' (\\t. tcb_domain t = cdom) thread ekh\"\n\nabbreviation in_cur_domain :: \"obj_ref \\ det_ext state \\ bool\" where\n \"in_cur_domain thread s \\ in_cur_domain_2 thread (cur_domain s) (ekheap s)\"\n\nlemmas in_cur_domain_def = in_cur_domain_2_def\n\ndefinition ct_in_cur_domain_2 where\n \"ct_in_cur_domain_2 thread thread' sa cdom ekh \\\n sa = resume_cur_thread \\ thread = thread' \\ in_cur_domain_2 thread cdom ekh\"\n\nabbreviation ct_in_cur_domain where\n \"ct_in_cur_domain s \\ ct_in_cur_domain_2 (cur_thread s) (idle_thread s) (scheduler_action s) (cur_domain s) (ekheap s)\"\n\nlemmas ct_in_cur_domain_def = ct_in_cur_domain_2_def\n\ndefinition is_activatable_2 where\n\"is_activatable_2 thread sa kh \\ sa = resume_cur_thread \\ st_tcb_at_kh activatable thread kh\"\n\nabbreviation is_activatable :: \"obj_ref \\ det_ext state \\ bool\" where\n\"is_activatable thread s \\ is_activatable_2 thread (scheduler_action s) (kheap s)\"\n\nlemmas is_activatable_def = is_activatable_2_def\n\ndefinition weak_valid_sched_action_2 where\n \"weak_valid_sched_action_2 sa ekh kh \\\n \\t. sa = switch_thread t \\ st_tcb_at_kh runnable t kh\"\n\nabbreviation weak_valid_sched_action:: \"det_ext state \\ bool\" where\n \"weak_valid_sched_action s \\ weak_valid_sched_action_2 (scheduler_action s) (ekheap s) (kheap s)\"\n\nlemmas weak_valid_sched_action_def = weak_valid_sched_action_2_def\n\ndefinition switch_in_cur_domain_2 where\n \"switch_in_cur_domain_2 sa ekh cdom \\\n \\t. sa = switch_thread t \\ in_cur_domain_2 t cdom ekh\"\n\nabbreviation switch_in_cur_domain:: \"det_ext state \\ bool\" where\n \"switch_in_cur_domain s \\ switch_in_cur_domain_2 (scheduler_action s) (ekheap s) (cur_domain s)\"\n\nlemmas switch_in_cur_domain_def = switch_in_cur_domain_2_def\n\ndefinition valid_sched_action_2 where\n \"valid_sched_action_2 sa ekh kh ct cdom \\\n is_activatable_2 ct sa kh \\ weak_valid_sched_action_2 sa ekh kh \\ switch_in_cur_domain_2 sa ekh cdom\"\n\nabbreviation valid_sched_action :: \"det_ext state \\ bool\" where\n \"valid_sched_action s \\ valid_sched_action_2 (scheduler_action s) (ekheap s) (kheap s) (cur_thread s) (cur_domain s)\"\n\nlemmas valid_sched_action_def = valid_sched_action_2_def\n\n\n\nabbreviation ct_not_queued where\n \"ct_not_queued s \\ not_queued (cur_thread s) s\"\n\ndefinition\n \"ct_not_in_q_2 queues sa ct \\ sa = resume_cur_thread \\ not_queued_2 queues ct\"\n\nabbreviation ct_not_in_q :: \"det_ext state \\ bool\" where\n \"ct_not_in_q s \\ ct_not_in_q_2 (ready_queues s) (scheduler_action s) (cur_thread s)\"\n\nlemmas ct_not_in_q_def = ct_not_in_q_2_def\n\ndefinition valid_sched_2 where\n \"valid_sched_2 queues ekh sa cdom kh ct it \\\n valid_etcbs_2 ekh kh \\ valid_queues_2 queues ekh kh \\ ct_not_in_q_2 queues sa ct \\ valid_sched_action_2 sa ekh kh ct cdom \\ ct_in_cur_domain_2 ct it sa cdom ekh \\ valid_blocked_2 queues kh sa ct \\ valid_idle_etcb_2 ekh\"\n\nabbreviation valid_sched :: \"det_ext state \\ bool\" where\n \"valid_sched s \\ valid_sched_2 (ready_queues s) (ekheap s) (scheduler_action s) (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)\"\n\nlemmas valid_sched_def = valid_sched_2_def\n\n\ndefinition not_cur_thread_2 :: \"obj_ref \\ scheduler_action \\ obj_ref \\ bool\" where\n \"not_cur_thread_2 thread sa ct \\ sa = resume_cur_thread \\ thread \\ ct\"\n\nabbreviation not_cur_thread :: \"obj_ref \\ det_ext state \\ bool\" where\n \"not_cur_thread thread s \\ not_cur_thread_2 thread (scheduler_action s) (cur_thread s)\"\n\nlemmas not_cur_thread_def = not_cur_thread_2_def\n\n\ndefinition simple_sched_action_2 :: \"scheduler_action \\ bool\" where\n \"simple_sched_action_2 action \\ (case action of switch_thread t \\ False | _ \\ True)\"\n\nabbreviation simple_sched_action :: \"det_state \\ bool\" where\n \"simple_sched_action s \\ simple_sched_action_2 (scheduler_action s)\"\n\nlemmas simple_sched_action_def = simple_sched_action_2_def\n\n\ndefinition schact_is_rct :: \"det_ext state \\ bool\" where\n \"schact_is_rct s \\ scheduler_action s = resume_cur_thread\"\n\nlemma schact_is_rct[elim!]: \"schact_is_rct s \\ scheduler_action s = resume_cur_thread\"\n apply (simp add: schact_is_rct_def)\n done\n\nlemma schact_is_rct_simple[elim]: \"schact_is_rct s \\ simple_sched_action s\"\n apply (simp add: simple_sched_action_def schact_is_rct_def)\n done\n\ndefinition scheduler_act_not_2 where\n\"scheduler_act_not_2 sa t \\ sa \\ switch_thread t\"\n\n\nabbreviation scheduler_act_not :: \"obj_ref \\ det_ext state \\ bool\" where\n\"scheduler_act_not t s \\ scheduler_act_not_2 (scheduler_action s) t\"\n\nabbreviation scheduler_act_sane :: \"det_ext state \\ bool\" where\n\"scheduler_act_sane s \\ scheduler_act_not_2 (scheduler_action s) (cur_thread s)\"\n\n\nlemmas scheduler_act_sane_def = scheduler_act_not_2_def\nlemmas scheduler_act_not_def = scheduler_act_not_2_def\n\n\n\nlemmas ct_not_queued_lift = hoare_lift_Pf2[where f=\"cur_thread\" and P=\"not_queued\"]\n\nlemmas sch_act_sane_lift = hoare_lift_Pf2[where f=\"cur_thread\" and P=\"scheduler_act_not\"]\n\nlemmas not_queued_def = not_queued_2_def\n\n\nlemma valid_etcbs_lift:\n assumes a: \"\\P T t. \\\\s. P (typ_at T t s)\\ f \\\\rv s. P (typ_at T t s)\\\"\n and b: \"\\P. \\\\s. P (ekheap s)\\ f \\\\rv s. P (ekheap s)\\\"\n shows \"\\valid_etcbs\\ f \\\\rv. valid_etcbs\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. ekheap s\", OF _ b])\n apply (simp add: valid_etcbs_def)\n apply (simp add: tcb_at_st_tcb_at[symmetric] tcb_at_typ)\n apply (wp hoare_vcg_all_lift a)\n done\n\nlemma valid_queues_lift:\n assumes a: \"\\Q t. \\\\s. st_tcb_at Q t s\\ f \\\\rv s. st_tcb_at Q t s\\\"\n and c: \"\\P. \\\\s. P (ekheap s)\\ f \\\\rv s. P (ekheap s)\\\"\n and d: \"\\P. \\\\s. P (ready_queues s)\\ f \\\\rv s. P (ready_queues s)\\\"\n shows \"\\valid_queues\\ f \\\\rv. valid_queues\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. ekheap s\", OF _ c])\n apply (rule hoare_lift_Pf[where f=\"\\s. ready_queues s\", OF _ d])\n apply (simp add: valid_queues_def)\n apply (wp hoare_vcg_ball_lift hoare_vcg_all_lift hoare_vcg_conj_lift a)\n done\n\nlemma typ_at_st_tcb_at_lift:\n assumes typ_lift: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\r s. P (typ_at T p s)\\\"\n assumes st_lift: \"\\P. \\st_tcb_at P t\\ f \\\\_. st_tcb_at P t\\\"\n shows \"\\\\s. \\ st_tcb_at P t s\\ f \\\\r s. \\ st_tcb_at P t s\\\"\n\n apply (simp add: valid_def obj_at_def st_tcb_at_def)\n apply clarsimp\n apply (case_tac \"kheap s t\")\n apply (cut_tac P=\"\\x. \\ x\" and p=t and T=\"ATCB\" in typ_lift)\n apply (simp add: valid_def obj_at_def)\n apply force\n apply (cut_tac P=\"\\x. x\" and p=t and T=\"a_type aa\" in typ_lift)\n apply (cut_tac P=\"\\t. \\ P t\" in st_lift)\n apply (simp add: valid_def obj_at_def st_tcb_at_def)\n apply (drule_tac x=s in spec)\n apply simp\n apply (drule_tac x=\"(a,b)\" in bspec)\n apply simp\n apply simp\n apply (subgoal_tac \"a_type aa = ATCB\")\n apply (erule a_type_ATCBE)\n apply simp\n apply force\n apply simp\n done\n\nlemma valid_blocked_lift:\n assumes a: \"\\Q t. \\\\s. st_tcb_at Q t s\\ f \\\\rv s. st_tcb_at Q t s\\\"\n assumes t: \"\\P T t. \\\\s. P (typ_at T t s)\\ f \\\\rv s. P (typ_at T t s)\\\"\n and c: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n and e: \"\\P. \\\\s. P (cur_thread s)\\ f \\\\rv s. P (cur_thread s)\\\"\n and d: \"\\P. \\\\s. P (ready_queues s)\\ f \\\\rv s. P (ready_queues s)\\\"\n shows \"\\valid_blocked\\ f \\\\rv. valid_blocked\\\"\n apply (rule hoare_pre)\n apply (wps c e d)\n apply (simp add: valid_blocked_def)\n apply (wp_trace hoare_vcg_ball_lift hoare_vcg_all_lift hoare_vcg_conj_lift static_imp_wp a)\n apply (rule hoare_convert_imp)\n apply (rule typ_at_st_tcb_at_lift)\n apply (wp a t)+\n apply (simp add: valid_blocked_def)\n done\n\nlemma ct_not_in_q_lift:\n assumes a: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n and b: \"\\P. \\\\s. P (ready_queues s)\\ f \\\\rv s. P (ready_queues s)\\\"\n and c: \"\\P. \\\\s. P (cur_thread s)\\ f \\\\rv s. P (cur_thread s)\\\"\n shows \"\\ct_not_in_q\\ f \\\\rv. ct_not_in_q\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. scheduler_action s\", OF _ a])\n apply (rule hoare_lift_Pf[where f=\"\\s. ready_queues s\", OF _ b])\n apply (rule hoare_lift_Pf[where f=\"\\s. cur_thread s\", OF _ c])\n apply wp\n done\n\nlemma ct_in_cur_domain_lift:\n assumes a: \"\\P. \\\\s. P (ekheap s)\\ f \\\\rv s. P (ekheap s)\\\"\n and b: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n and c: \"\\P. \\\\s. P (cur_domain s)\\ f \\\\rv s. P (cur_domain s)\\\"\n and d: \"\\P. \\\\s. P (cur_thread s)\\ f \\\\rv s. P (cur_thread s)\\\"\n and e: \"\\P. \\\\s. P (idle_thread s)\\ f \\\\rv s. P (idle_thread s)\\\"\n shows \"\\ct_in_cur_domain\\ f \\\\rv. ct_in_cur_domain\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. ekheap s\", OF _ a])\n apply (rule hoare_lift_Pf[where f=\"\\s. scheduler_action s\", OF _ b])\n apply (rule hoare_lift_Pf[where f=\"\\s. cur_domain s\", OF _ c])\n apply (rule hoare_lift_Pf[where f=\"\\s. cur_thread s\", OF _ d])\n apply (rule hoare_lift_Pf[where f=\"\\s. idle_thread s\", OF _ e])\n apply wp\n done\n\nlemma weak_valid_sched_action_lift:\n assumes a: \"\\Q t. \\\\s. st_tcb_at Q t s\\ f \\\\rv s. st_tcb_at Q t s\\\"\n assumes c: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n shows \"\\weak_valid_sched_action\\ f \\\\rv. weak_valid_sched_action\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. scheduler_action s\", OF _ c])\n apply (simp add: weak_valid_sched_action_def)\n apply (wp hoare_vcg_all_lift static_imp_wp a)\n done\n\nlemma switch_in_cur_domain_lift:\n assumes a: \"\\Q t. \\\\s. etcb_at Q t s\\ f \\\\rv s. etcb_at Q t s\\\"\n assumes b: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n assumes c: \"\\P. \\\\s. P (cur_domain s)\\ f \\\\rv s. P (cur_domain s)\\\"\n shows \"\\switch_in_cur_domain\\ f \\\\rv. switch_in_cur_domain\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. scheduler_action s\", OF _ b])\n apply (rule hoare_lift_Pf[where f=\"\\s. cur_domain s\", OF _ c])\n apply (simp add: switch_in_cur_domain_def in_cur_domain_def)\n apply (wp hoare_vcg_all_lift static_imp_wp a c)\n done\n\nlemma valid_sched_action_lift:\n assumes a: \"\\Q t. \\\\s. st_tcb_at Q t s\\ f \\\\rv s. st_tcb_at Q t s\\\"\n assumes b: \"\\Q t. \\\\s. etcb_at Q t s\\ f \\\\rv s. etcb_at Q t s\\\"\n assumes c: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n assumes d: \"\\P. \\\\s. P (cur_thread s)\\ f \\\\rv s. P (cur_thread s)\\\"\n assumes e: \"\\Q t. \\\\s. Q (cur_domain s)\\ f \\\\rv s. Q (cur_domain s)\\\"\n shows \"\\valid_sched_action\\ f \\\\rv. valid_sched_action\\\"\n apply (rule hoare_lift_Pf[where f=\"\\s. cur_thread s\", OF _ d])\n apply (simp add: valid_sched_action_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_lift_Pf[where f=\"\\s. scheduler_action s\", OF _ c])\n apply (simp add: is_activatable_def)\n apply (wp weak_valid_sched_action_lift switch_in_cur_domain_lift static_imp_wp a b c d e)+\n done\n\nlemma valid_sched_lift:\n assumes a: \"\\Q t. \\\\s. st_tcb_at Q t s\\ f \\\\rv s. st_tcb_at Q t s\\\"\n assumes b: \"\\Q t. \\\\s. etcb_at Q t s\\ f \\\\rv s. etcb_at Q t s\\\"\n assumes c: \"\\P T t. \\\\s. P (typ_at T t s)\\ f \\\\rv s. P (typ_at T t s)\\\"\n assumes d: \"\\P. \\\\s. P (ekheap s)\\ f \\\\rv s. P (ekheap s)\\\"\n assumes e: \"\\P. \\\\s. P (scheduler_action s)\\ f \\\\rv s. P (scheduler_action s)\\\"\n assumes f: \"\\P. \\\\s. P (ready_queues s)\\ f \\\\rv s. P (ready_queues s)\\\"\n assumes g: \"\\P. \\\\s. P (cur_domain s)\\ f \\\\rv s. P (cur_domain s)\\\"\n assumes h: \"\\P. \\\\s. P (cur_thread s)\\ f \\\\rv s. P (cur_thread s)\\\"\n assumes i: \"\\P. \\\\s. P (idle_thread s)\\ f \\\\rv s. P (idle_thread s)\\\"\n shows \"\\valid_sched\\ f \\\\rv. valid_sched\\\"\n apply (simp add: valid_sched_def)\n apply (wp valid_etcbs_lift valid_queues_lift ct_not_in_q_lift ct_in_cur_domain_lift\n valid_sched_action_lift valid_blocked_lift a b c d e f g h i hoare_vcg_conj_lift)\n done\n\nlemma valid_etcbs_tcb_etcb:\n \"\\ valid_etcbs s; kheap s ptr = Some (TCB tcb) \\ \\ \\etcb. ekheap s ptr = Some etcb\"\n by (force simp: valid_etcbs_def is_etcb_at_def st_tcb_at_def obj_at_def)\n\nlemma valid_etcbs_get_tcb_get_etcb:\n \"\\ valid_etcbs s; get_tcb ptr s = Some tcb \\ \\ \\etcb. get_etcb ptr s = Some etcb\"\n apply (clarsimp simp: valid_etcbs_def valid_etcbs_def st_tcb_at_def obj_at_def is_etcb_at_def get_etcb_def get_tcb_def split: option.splits if_split)\n apply (erule_tac x=ptr in allE)\n apply (clarsimp simp: get_etcb_def split: option.splits kernel_object.splits)+\n done\n\nlemma valid_etcbs_ko_etcb:\n \"\\ valid_etcbs s; kheap s ptr = Some ko \\ \\ \\tcb. (ko = TCB tcb = (\\etcb. ekheap s ptr = Some etcb))\"\n apply (clarsimp simp: valid_etcbs_def st_tcb_at_def obj_at_def is_etcb_at_def)\n apply (erule_tac x=\"ptr\" in allE)\n apply auto\n done\n\nlemma ekheap_tcb_at:\n \"\\ekheap s x = Some y; valid_etcbs s\\ \\ tcb_at x s\"\n by (fastforce simp: valid_etcbs_def is_etcb_at_def st_tcb_at_def obj_at_def is_tcb_def)\n\nlemma tcb_at_is_etcb_at:\n \"\\tcb_at t s; valid_etcbs s\\ \\ is_etcb_at t s\"\n by (simp add: valid_etcbs_def tcb_at_st_tcb_at)\n\nlemma tcb_at_ekheap_dom:\n \"\\tcb_at x s; valid_etcbs s\\ \\ (\\etcb. ekheap s x = Some etcb)\"\n by (auto simp: is_etcb_at_def dest: tcb_at_is_etcb_at)\n\nlemma ekheap_kheap_dom:\n \"\\ekheap s x = Some etcb; valid_etcbs s\\\n \\ \\tcb. kheap s x = Some (TCB tcb)\"\n by (fastforce simp: valid_etcbs_def st_tcb_at_def obj_at_def is_etcb_at_def)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/DetSchedInvs_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.32423538592116935, "lm_q1q2_score": 0.18352323819784297}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__4_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__4_on_rules imports n_germanSymIndex_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__4) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__4) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.35577490717496246, "lm_q1q2_score": 0.18344462765391786}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__39_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__39_on_rules imports n_german_lemma_on_inv__39\nbegin\nsection{*All lemmas on causal relation between inv__39*}\nlemma lemma_inv__39_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__39 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__39) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__39_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.35577488668296436, "lm_q1q2_score": 0.18344461708783555}} {"text": "(* Title: JinjaThreads/MM/JMM_Heap.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Locales for heap operations with set of allocated addresses} *}\n\ntheory JMM_Heap \nimports\n \"../Common/WellForm\"\n \"SC_Completion\"\n \"HB_Completion\"\nbegin\n\ndefinition w_addrs :: \"('addr \\ addr_loc \\ 'addr val set) \\ 'addr set\"\nwhere \"w_addrs vs = {a. \\adal. Addr a \\ vs adal}\"\n\nlemma w_addrs_empty [simp]: \"w_addrs (\\_. {}) = {}\"\nby(simp add: w_addrs_def)\n\nlocale allocated_heap_base = heap_base +\n constrains addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n fixes allocated :: \"'heap \\ 'addr set\"\n\nlocale allocated_heap = \n allocated_heap_base +\n heap +\n constrains addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and allocated :: \"'heap \\ 'addr set\"\n and P :: \"'m prog\"\n\n assumes allocated_empty: \"allocated empty_heap = {}\"\n and allocate_allocatedD:\n \"(h', a) \\ allocate h hT \\ allocated h' = insert a (allocated h) \\ a \\ allocated h\"\n and heap_write_allocated_same:\n \"heap_write h a al v h' \\ allocated h' = allocated h\"\nbegin\n\nlemma allocate_allocated_mono: \"(h', a) \\ allocate h C \\ allocated h \\ allocated h'\"\nby(simp_all add: allocate_allocatedD)\n\nlemma\n shows start_addrs_allocated: \"allocated start_heap = set start_addrs\"\n and distinct_start_addrs': \"distinct start_addrs\"\nproof -\n { fix h ads b and xs :: \"cname list\"\n let \"?start_addrs h ads b xs\" = \"fst (snd (foldl create_initial_object (h, ads, b) xs))\"\n let \"?start_heap h ads b xs\" = \"fst (foldl create_initial_object (h, ads, b) xs)\"\n assume \"allocated h = set ads\"\n hence \"allocated (?start_heap h ads b xs) = set (?start_addrs h ads b xs) \\\n (distinct ads \\ distinct (?start_addrs h ads b xs))\"\n (is \"?concl xs h ads b\")\n proof(induct xs arbitrary: h ads b)\n case Nil thus ?case by auto\n next\n case (Cons x xs)\n note ads = `allocated h = set ads`\n show ?case\n proof(cases \"b \\ allocate h (Class_type x) \\ {}\")\n case False thus ?thesis using ads\n by(simp add: create_initial_object_simps zip_append1)\n next\n case True[simp]\n then obtain h' a' \n where h'a': \"(SOME ha. ha \\ allocate h (Class_type x)) = (h', a')\"\n and new_obj: \"(h', a') \\ allocate h (Class_type x)\"\n by(cases \"(SOME ha. ha \\ allocate h (Class_type x))\")(auto simp del: True dest: allocate_Eps)\n\n from new_obj have \"allocated h' = insert a' (allocated h)\" \"a' \\ allocated h\"\n by(auto dest: allocate_allocatedD)\n with ads have \"allocated h' = set (ads @ [a'])\" by auto\n hence \"?concl xs h' (ads @ [a']) True\" by(rule Cons)\n moreover have \"a' \\ set ads\" using `a' \\ allocated h` ads by blast\n ultimately show ?thesis by(simp add: create_initial_object_simps new_obj h'a')\n qed\n qed }\n from this[of empty_heap \"[]\" True initialization_list]\n show \"allocated start_heap = set start_addrs\"\n and distinct_start_addrs: \"distinct start_addrs\"\n unfolding start_heap_def start_addrs_def start_heap_data_def\n by(auto simp add: allocated_empty)\nqed\n\nlemma w_addrs_start_heap_obs: \"w_addrs (w_values P vs (map NormalAction start_heap_obs)) \\ w_addrs vs\"\nproof -\n { fix xs\n let ?NewObj = \"\\a C. NewHeapElem a (Class_type C) :: ('addr, 'thread_id) obs_event\"\n let \"?start_heap_obs xs\" = \"map (\\(C, a). ?NewObj a C) xs\"\n have \"w_addrs (w_values P vs (map NormalAction (?start_heap_obs xs))) \\ w_addrs vs\"\n (is \"?concl xs\")\n proof(induct xs arbitrary: vs)\n case Nil thus ?case by simp\n next\n case (Cons x xs)\n have \"w_addrs (w_values P vs (map NormalAction (map (\\(C, a). ?NewObj a C) (x # xs))))\n = w_addrs (w_values P (w_value P vs (NormalAction (?NewObj (snd x) (fst x)))) (map NormalAction (map (\\(C, a). ?NewObj a C) xs)))\"\n by(simp add: split_beta)\n also have \"\\ \\ w_addrs (w_value P vs (NormalAction (?NewObj (snd x) (fst x))))\" by(rule Cons)\n also have \"\\ \\ w_addrs vs\"\n by(auto simp add: w_addrs_def default_val_not_Addr Addr_not_default_val)\n finally show ?case .\n qed }\n thus ?thesis by(simp add: start_heap_obs_def)\nqed\n\nend\n\ncontext heap_base begin\n\nlemma addr_loc_default_conf:\n \"P \\ class_type_of CTn has F:T (fm) in C \n \\ P,h \\ addr_loc_default P CTn (CField C F) :\\ T\"\napply(cases CTn)\n apply simp\napply(frule has_field_decl_above)\napply simp\ndone\n\ndefinition vs_conf :: \"'m prog \\ 'heap \\ ('addr \\ addr_loc \\ 'addr val set) \\ bool\"\nwhere \"vs_conf P h vs \\ (\\ad al v. v \\ vs (ad, al) \\ (\\T. P,h \\ ad@al : T \\ P,h \\ v :\\ T))\"\n\n\n\nlemma vs_confD:\n \"\\ vs_conf P h vs; v \\ vs (ad, al) \\ \\ \\T. P,h \\ ad@al : T \\ P,h \\ v :\\ T\"\nunfolding vs_conf_def by blast\n\nlemma vs_conf_insert_iff:\n \"vs_conf P h (vs((ad, al) := insert v (vs (ad, al)))) \n \\ vs_conf P h vs \\ (\\T. P,h \\ ad@al : T \\ P,h \\ v :\\ T)\"\nby(auto 4 3 elim: vs_confD intro: vs_confI split: split_if_asm)\n\nend\n\ncontext heap begin\n\nlemma vs_conf_hext: \"\\ vs_conf P h vs; h \\ h' \\ \\ vs_conf P h' vs\"\nby(blast intro!: vs_confI intro: conf_hext addr_loc_type_hext_mono dest: vs_confD)\n\nlemma vs_conf_allocate:\n \"\\ vs_conf P h vs; (h', a) \\ allocate h hT; is_htype P hT \\ \n \\ vs_conf P h' (w_value P vs (NormalAction (NewHeapElem a hT)))\"\napply(drule vs_conf_hext)\n apply(erule hext_allocate)\napply(auto intro!: vs_confI simp add: addr_locs_def split: split_if_asm htype.split_asm)\napply(auto 3 3 intro: addr_loc_type.intros defval_conf dest: allocate_SomeD elim: has_field_is_class vs_confD)\napply(rule exI conjI addr_loc_type.intros|drule allocate_SomeD|erule has_field_is_class|simp)+\ndone\n\nend\n\ntext {* \n @{text heap_read_typeable} must not be defined in @{term heap_conf_base} (where it should be) because\n this would lead to duplicate definitions of @{text heap_read_typeable} in contexts where @{term heap_conf_base} \n is imported twice with different parameters, e.g., @{term P} and @{term \"J2JVM P\"} in @{term \"J_JVM_heap_conf_read\"}.\n*}\n\ncontext heap_base begin\n\ndefinition heap_read_typeable :: \"('heap \\ bool) \\ 'm prog \\ bool\"\nwhere \"heap_read_typeable hconf P \\ (\\h ad al v T. hconf h \\ P,h \\ ad@al : T \\ P,h \\ v :\\ T \\ heap_read h ad al v)\"\n\nlemma heap_read_typeableI:\n \"(\\h ad al v T. \\ P,h \\ ad@al : T; P,h \\ v :\\ T; hconf h \\ \\ heap_read h ad al v) \\ heap_read_typeable hconf P\"\nunfolding heap_read_typeable_def by blast\n\nlemma heap_read_typeableD:\n \"\\ heap_read_typeable hconf P; P,h \\ ad@al : T; P,h \\ v :\\ T; hconf h \\ \\ heap_read h ad al v\"\nunfolding heap_read_typeable_def by blast\n\nend\n\ncontext heap_base begin\n\ndefinition heap_read_typed :: \"'m prog \\ 'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\nwhere \"heap_read_typed P h ad al v \\ heap_read h ad al v \\ (\\T. P,h \\ ad@al : T \\ P,h \\ v :\\ T)\"\n\nlemma heap_read_typedI:\n \"\\ heap_read h ad al v; \\T. P,h \\ ad@al : T \\ P,h \\ v :\\ T \\ \\ heap_read_typed P h ad al v\"\nunfolding heap_read_typed_def by blast\n\nlemma heap_read_typed_into_heap_read:\n \"heap_read_typed P h ad al v \\ heap_read h ad al v\"\nunfolding heap_read_typed_def by blast\n\nlemma heap_read_typed_typed:\n \"\\ heap_read_typed P h ad al v; P,h \\ ad@al : T \\ \\ P,h \\ v :\\ T\"\nunfolding heap_read_typed_def by blast\n\nend\n\ncontext heap_conf begin\n\nlemma heap_conf_read_heap_read_typed:\n \"heap_conf_read addr2thread_id thread_id2addr empty_heap allocate typeof_addr (heap_read_typed P) heap_write hconf P\"\nproof\n fix h a al v T\n assume \"heap_read_typed P h a al v\" \"P,h \\ a@al : T\" \n thus \"P,h \\ v :\\ T\" by(rule heap_read_typed_typed)\nqed\n\nend\n\ncontext heap begin\n\nlemma start_addrs_dom_w_values:\n assumes wf: \"wf_syscls P\"\n and a: \"a \\ set start_addrs\"\n and adal: \"P,start_heap \\ a@al : T\"\n shows \"w_values P (\\_. {}) (map NormalAction start_heap_obs) (a, al) \\ {}\"\nproof -\n from a obtain CTn where CTn: \"NewHeapElem a CTn \\ set start_heap_obs\"\n unfolding in_set_start_addrs_conv_NewHeapElem ..\n then obtain obs obs' where obs: \"start_heap_obs = obs @ NewHeapElem a CTn # obs'\" by(auto dest: split_list)\n have \"w_value P (w_values P (\\_. {}) (map NormalAction obs)) (NormalAction (NewHeapElem a CTn)) (a, al) \\ {}\"\n proof(cases CTn)\n case (Class_type C)[simp]\n with wf CTn have \"typeof_addr start_heap a = \\Class_type C\\\"\n by(auto intro: NewHeapElem_start_heap_obsD)\n with adal show ?thesis by cases auto\n next\n case (Array_type T n)[simp]\n with wf CTn have \"typeof_addr start_heap a = \\Array_type T n\\\"\n by(auto dest: NewHeapElem_start_heap_obsD)\n with adal show ?thesis by cases(auto dest: has_field_decl_above)\n qed\n moreover have \"w_value P (w_values P (\\_. {}) (map NormalAction obs)) (NormalAction (NewHeapElem a CTn :: ('addr, 'thread_id) obs_event))\n (a, al) \\ w_values P (\\_. {}) (map NormalAction start_heap_obs) (a, al)\"\n by(simp add: obs del: w_value.simps)(rule w_values_mono)\n ultimately show ?thesis by blast\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.3073580232098525, "lm_q1q2_score": 0.1833185128127281}} {"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory CLib\n imports Word_Lib.Many_More\nbegin\n\nlemma nat_diff_less:\n \"\\ x < y + z; z \\ x\\ \\ x - z < y\" for x :: nat\n using less_diff_conv2 by blast\n\nlemma foldl_conv_concat:\n \"foldl (@) xs xss = xs @ concat xss\"\nproof (induct xss arbitrary: xs)\n case Nil show ?case by simp\nnext\n case Cons then show ?case by simp\nqed\n\nlemma foldl_concat_concat:\n \"foldl (@) [] (xs @ ys) = foldl (@) [] xs @ foldl (@) [] ys\"\n by (simp add: foldl_conv_concat)\n\nlemma take_drop_foldl_concat:\n \"\\ \\y. y < m \\ length (f y) = n; x < m \\ \\\n take n (drop (x * n) (foldl (@) [] (map f [0 ..< m]))) = f x\"\n apply (subst split_upt_on_n, assumption)\n apply (simp only: foldl_concat_concat map_append)\n apply (subst drop_append_miracle)\n apply (induct x; simp)\n apply simp\n done\n\nlemma foldl_does_nothing:\n \"\\ \\x. x \\ set xs \\ f s x = s \\ \\ foldl f s xs = s\"\n by (induct xs) auto\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Basics/CLib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.35220176844875106, "lm_q1q2_score": 0.18297632833836008}} {"text": "(* Title: variants/d_fwdrreqs/OAodv.thy\n License: BSD 2-Clause. See LICENSE.\n Author: Timothy Bourke, Inria\n*)\n\nsection \"The `open' AODV model\"\n\ntheory D_OAodv\nimports D_Aodv AWN.OAWN_SOS_Labels AWN.OAWN_Convert\nbegin\n\ntext \\Definitions for stating and proving global network properties over individual processes.\\\n\ndefinition \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' :: \"((ip \\ state) \\ ((state, msg, pseqp, pseqp label) seqp)) set\"\nwhere \"\\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ {(\\i. aodv_init i, \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V PAodv)}\"\n\nabbreviation opaodv\n :: \"ip \\ ((ip \\ state) \\ (state, msg, pseqp, pseqp label) seqp, msg seq_action) automaton\"\nwhere\n \"opaodv i \\ \\ init = \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V', trans = oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i \\\"\n\nlemma initiali_aodv [intro!, simp]: \"initiali i (init (opaodv i)) (init (paodv i))\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_def \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by rule simp_all\n\nlemma oaodv_control_within [simp]: \"control_within \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V (init (opaodv i))\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by (rule control_withinI) (auto simp del: \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V_simps)\n\nlemma \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_labels [simp]: \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ labels \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V p = {PAodv-:0}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def by simp\n\nlemma oaodv_init_kD_empty [simp]:\n \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ kD (rt (\\ i)) = {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def kD_def by simp\n\nlemma oaodv_init_vD_empty [simp]:\n \"(\\, p) \\ \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V' \\ vD (rt (\\ i)) = {}\"\n unfolding \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V'_def vD_def by simp\n\nlemma oaodv_trans: \"trans (opaodv i) = oseqp_sos \\\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\"\n by simp\n\ndeclare\n oseq_invariant_ctermsI [OF aodv_wf oaodv_control_within aodv_simple_labels oaodv_trans, cterms_intros]\n oseq_step_invariant_ctermsI [OF aodv_wf oaodv_control_within aodv_simple_labels oaodv_trans, cterms_intros]\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AODV/variants/d_fwdrreqs/D_OAodv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.3276683008207139, "lm_q1q2_score": 0.18294605272001402}} {"text": "(* Title: JinjaThreads/MM/SC_Collections.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Sequential consistency with efficient data structures} *}\n\ntheory SC_Collections\nimports\n \"../Common/Conform\"\n (*\"../../Collections/impl/RBTMapImpl\"\n \"../../Collections/impl/TrieMapImpl\"\n \"../../Collections/impl/ListMapImpl\"*)\n \"../Basic/JT_ICF\"\n MM\nbegin\n\nhide_const (open) new_Addr\nhide_fact (open) new_Addr_SomeD new_Addr_SomeI\n\nsubsection{* Objects and Arrays *}\n\ntype_synonym fields = \"(char, (cname, addr val) lm) tm\"\ntype_synonym array_cells = \"(nat, addr val) rbt\"\ntype_synonym array_fields = \"(vname, addr val) lm\"\n\ndatatype heapobj\n = Obj cname fields -- \"class instance with class name and fields\"\n | Arr ty nat array_fields array_cells -- \"element type, size, fields and cell contents\"\n\nlemma rec_heapobj [simp]: \"rec_heapobj = case_heapobj\"\nby(auto intro!: ext split: heapobj.split)\n\nprimrec obj_ty :: \"heapobj \\ htype\"\nwhere\n \"obj_ty (Obj c f) = Class_type c\"\n| \"obj_ty (Arr t si f e) = Array_type t si\"\n\nfun is_Arr :: \"heapobj \\ bool\" where\n \"is_Arr (Obj C fs) = False\"\n| \"is_Arr (Arr T f si el) = True\"\n\nlemma is_Arr_conv:\n \"is_Arr arrobj = (\\T si f el. arrobj = Arr T si f el)\"\nby(cases arrobj, auto)\n\nlemma is_ArrE:\n \"\\ is_Arr arrobj; \\T si f el. arrobj = Arr T si f el \\ thesis \\ \\ thesis\"\n \"\\ \\ is_Arr arrobj; \\C fs. arrobj = Obj C fs \\ thesis \\ \\ thesis\"\nby(cases arrobj, auto)+\n\ndefinition init_fields :: \"((vname \\ cname) \\ ty) list \\ fields\"\nwhere\n \"init_fields FDTs \\\n foldr (\\((F, D), T) fields. \n let F' = String.explode F\n in tm_update F' (lm_update D (default_val T)\n (case tm_lookup F' fields of None \\ lm_empty () | Some lm \\ lm)) fields)\n FDTs (tm_empty ())\"\n\ndefinition init_fields_array :: \"(vname \\ ty) list \\ array_fields\"\nwhere\n \"init_fields_array \\ lm.to_map \\ map (\\(F, T). (F, default_val T))\"\n\ndefinition init_cells :: \"ty \\ nat \\ array_cells\"\nwhere \"init_cells T n = foldl (\\cells i. rm_update i (default_val T) cells) (rm_empty ()) [0.. htype \\ heapobj\"\nwhere\n \"blank P (Class_type C) = Obj C (init_fields (map (\\(FD, (T, fm)). (FD, T)) (TypeRel.fields P C)))\"\n| \"blank P (Array_type T n) =\n Arr T n (init_fields_array (map (\\((F, D), (T, fm)). (F, T)) (TypeRel.fields P Object))) (init_cells T n)\"\n\nlemma obj_ty_blank [iff]: \"obj_ty (blank P hT) = hT\"\nby(cases hT) simp_all\n\nsubsection{* Heap *}\n\ntype_synonym heap = \"(addr, heapobj) rbt\"\n\ntranslations\n (type) \"heap\" <= (type) \"(nat, heapobj) rbt\"\n\nabbreviation sc_empty :: heap\nwhere \"sc_empty \\ rm_empty ()\"\n\nfun the_obj :: \"heapobj \\ cname \\ fields\" where\n \"the_obj (Obj C fs) = (C, fs)\"\n\nfun the_arr :: \"heapobj \\ ty \\ nat \\ array_fields \\ array_cells\" where\n \"the_arr (Arr T si f el) = (T, si, f, el)\"\n\nabbreviation\n cname_of :: \"heap \\ addr \\ cname\" where\n \"cname_of hp a == fst (the_obj (the (rm_lookup a hp)))\"\n\ndefinition new_Addr :: \"heap \\ addr option\"\nwhere \"new_Addr h = Some (case rm_max h (\\_. True) of None \\ 0 | Some (a, _) \\ a + 1)\"\n\ndefinition sc_allocate :: \"'m prog \\ heap \\ htype \\ (heap \\ addr) set\"\nwhere\n \"sc_allocate P h hT = \n (case new_Addr h of None \\ {}\n | Some a \\ {(rm_update a (blank P hT) h, a)})\"\n\ndefinition sc_typeof_addr :: \"heap \\ addr \\ htype option\"\nwhere \"sc_typeof_addr h a = map_option obj_ty (rm_lookup a h)\"\n\ninductive sc_heap_read :: \"heap \\ addr \\ addr_loc \\ addr val \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj: \"\\ rm_lookup a h = \\Obj C fs\\; tm_lookup (String.explode F) fs = \\fs'\\; lm_lookup D fs' = \\v\\ \\ \\ sc_heap_read h a (CField D F) v\"\n| Arr: \"\\ rm_lookup a h = \\Arr T si f el\\; n < si \\ \\ sc_heap_read h a (ACell n) (the (rm_lookup n el))\"\n| ArrObj: \"\\ rm_lookup a h = \\Arr T si f el\\; lm_lookup F f = \\v\\ \\ \\ sc_heap_read h a (CField Object F) v\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_read_cases [elim!]:\n \"sc_heap_read h a (CField C F) v\"\n \"sc_heap_read h a (ACell n) v\"\n\ninductive sc_heap_write :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap \\ bool\"\nfor h :: heap and a :: addr\nwhere\n Obj:\n \"\\ rm_lookup a h = \\Obj C fs\\; F' = String.explode F;\n h' = rm_update a (Obj C (tm_update F' (lm_update D v (case tm_lookup (String.explode F) fs of None \\ lm_empty () | Some fs' \\ fs')) fs)) h \\\n \\ sc_heap_write h a (CField D F) v h'\"\n\n| Arr:\n \"\\ rm_lookup a h = \\Arr T si f el\\; h' = rm_update a (Arr T si f (rm_update n v el)) h \\\n \\ sc_heap_write h a (ACell n) v h'\"\n\n| ArrObj:\n \"\\ rm_lookup a h = \\Arr T si f el\\; h' = rm_update a (Arr T si (lm_update F v f) el) h \\\n \\ sc_heap_write h a (CField Object F) v h'\"\n\nhide_fact (open) Obj Arr ArrObj\n\ninductive_cases sc_heap_write_cases [elim!]:\n \"sc_heap_write h a (CField C F) v h'\"\n \"sc_heap_write h a (ACell n) v h'\"\n\nconsts sc_spurious_wakeups :: bool\n\nlemma new_Addr_SomeD: \"new_Addr h = \\a\\ \\ rm_lookup a h = None\"\napply(simp add: new_Addr_def)\napply(drule rm.max_None[OF rm.invar])\napply(simp add: rm.lookup_correct rel_of_def)\napply(clarsimp simp add: rm.lookup_correct)\napply(frule rm.max_Some[OF rm.invar])\napply(clarsimp simp add: rel_of_def)\napply(hypsubst_thin)\napply(rule ccontr)\napply(clarsimp)\napply(drule_tac k'=\"Suc a\" in rm.max_Some(2)[OF rm.invar])\napply(auto simp add: rel_of_def)\ndone\n\ninterpretation sc!: \n heap_base\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n for P . \n\ntext {* Translate notation from @{text heap_base} *}\n\nabbreviation sc_preallocated :: \"'m prog \\ heap \\ bool\"\nwhere \"sc_preallocated == sc.preallocated TYPE('m)\"\n\nabbreviation sc_start_tid :: \"'md prog \\ thread_id\"\nwhere \"sc_start_tid \\ sc.start_tid TYPE('md)\"\n\nabbreviation sc_start_heap_ok :: \"'m prog \\ bool\"\nwhere \"sc_start_heap_ok \\ sc.start_heap_ok TYPE('m)\"\n\nabbreviation sc_start_heap :: \"'m prog \\ heap\"\nwhere \"sc_start_heap \\ sc.start_heap TYPE('m)\"\n\nabbreviation sc_start_state :: \n \"(cname \\ mname \\ ty list \\ ty \\ 'm \\ addr val list \\ 'x)\n \\ 'm prog \\ cname \\ mname \\ addr val list \\ (addr, thread_id, 'x, heap, addr) state\"\nwhere\n \"sc_start_state f P \\ sc.start_state TYPE('m) P f P\"\n\nabbreviation sc_wf_start_state :: \"'m prog \\ cname \\ mname \\ addr val list \\ bool\"\nwhere \"sc_wf_start_state P \\ sc.wf_start_state TYPE('m) P P\"\n\nnotation sc.conf (\"_,_ \\sc _ :\\ _\" [51,51,51,51] 50)\nnotation sc.confs (\"_,_ \\sc _ [:\\] _\" [51,51,51,51] 50)\nnotation sc.hext (\"_ \\sc _\" [51,51] 50)\n\nlemma new_Addr_SomeI: \"\\a. new_Addr h = Some a\"\nby(simp add: new_Addr_def)\n\nlemma sc_start_heap_ok: \"sc_start_heap_ok P\"\nby(simp add: sc.start_heap_ok_def sc.start_heap_data_def initialization_list_def sc.create_initial_object_simps sc_allocate_def case_option_conv_if new_Addr_SomeI sys_xcpts_list_def del: blank.simps split del: option.split split_if)\n\nlemma sc_wf_start_state_iff:\n \"sc_wf_start_state P C M vs \\ (\\Ts T meth D. P \\ C sees M:Ts\\T = \\meth\\ in D \\ P,sc_start_heap P \\sc vs [:\\] Ts)\"\nby(simp add: sc.wf_start_state.simps sc_start_heap_ok)\n\nlemma sc_heap:\n \"heap addr2thread_id thread_id2addr (sc_allocate P) sc_typeof_addr sc_heap_write P\"\nproof\n fix h' a h hT\n assume \"(h', a) \\ sc_allocate P h hT\"\n thus \"sc_typeof_addr h' a = \\hT\\\"\n by(auto simp add: sc_allocate_def sc_typeof_addr_def rm.lookup_correct rm.update_correct dest: new_Addr_SomeD split: split_if_asm)\nnext\n fix h h' hT a\n assume \"(h', a) \\ sc_allocate P h hT\"\n from this[symmetric] show \"h \\sc h'\"\n by(fastforce simp add: sc_allocate_def sc_typeof_addr_def sc.hext_def rm.lookup_correct rm.update_correct intro!: map_leI dest: new_Addr_SomeD)\nnext\n fix h a al v h'\n assume \"sc_heap_write h a al v h'\"\n thus \"h \\sc h'\"\n by(cases al)(auto intro!: sc.hextI simp add: sc_typeof_addr_def rm.lookup_correct rm.update_correct)\nqed simp\n\ninterpretation sc!: \n heap \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n P\n for P by(rule sc_heap)\n\ndeclare sc.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nlemma sc_hext_new:\n \"rm_lookup a h = None \\ h \\sc rm_update a arrobj h\"\nby(rule sc.hextI)(auto simp add: sc_typeof_addr_def rm.lookup_correct rm.update_correct dest!: new_Addr_SomeD)\n\nlemma sc_hext_upd_obj: \"rm_lookup a h = Some (Obj C fs) \\ h \\sc rm_update a (Obj C fs') h\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def rm.lookup_correct rm.update_correct)\n\nlemma sc_hext_upd_arr: \"\\ rm_lookup a h = Some (Arr T si f e) \\ \\ h \\sc rm_update a (Arr T si f' e') h\"\nby(rule sc.hextI)(auto simp:fun_upd_apply sc_typeof_addr_def rm.lookup_correct rm.update_correct)\n\nsubsection {* Conformance *}\n\ndefinition sc_oconf :: \"'m prog \\ heap \\ heapobj \\ bool\" (\"_,_ \\sc _ \\\" [51,51,51] 50)\nwhere\n \"P,h \\sc obj \\ \\\n (case obj of \n Obj C fs \\ \n is_class P C \\ \n (\\F D T fm. P \\ C has F:T (fm) in D \\ \n (\\fs' v. tm_\\ fs (String.explode F) = Some fs' \\ lm_\\ fs' D = Some v \\ P,h \\sc v :\\ T))\n | Arr T si f el \\ \n is_type P (T\\\\) \\ (\\n. n < si \\ (\\v. rm_\\ el n = Some v \\ P,h \\sc v :\\ T)) \\\n (\\F T fm. P \\ Object has F:T (fm) in Object \\ (\\v. lm_lookup F f = Some v \\ P,h \\sc v :\\ T)))\"\n\ndefinition sc_hconf :: \"'m prog \\ heap \\ bool\" (\"_ \\sc _ \\\" [51,51] 50)\nwhere \"P \\sc h \\ \\ (\\a obj. rm_\\ h a = Some obj \\ P,h \\sc obj \\)\"\n\ninterpretation sc!: \n heap_conf_base \n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\n for P \n.\n\nlemma sc_conf_upd_obj: \"rm_lookup a h = Some(Obj C fs) \\ (P,rm_update a (Obj C fs') h \\sc x :\\ T) = (P,h \\sc x :\\ T)\"\napply (unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply (auto simp add: sc_typeof_addr_def rm.lookup_correct rm.update_correct split: split_if_asm)\ndone\n\nlemma sc_conf_upd_arr:\n \"rm_lookup a h = Some(Arr T si f el) \\ (P,rm_update a (Arr T si f' el') h \\sc x :\\ T') = (P,h \\sc x :\\ T')\"\napply(unfold sc.conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\napply(auto simp add: sc_typeof_addr_def rm.lookup_correct rm.update_correct split: split_if_asm)\ndone\n\n\n\nlemma map_of_fields_init_fields:\n assumes \"map_of FDTs (F, D) = \\(T, fm)\\\"\n shows \"\\fs' v. tm_\\ (init_fields (map (\\(FD, (T, fm)). (FD, T)) FDTs)) (String.explode F) = \\fs'\\ \\ lm_\\ fs' D = \\v\\ \\ sc.conf P h v T\"\nusing assms\nby(induct FDTs)(auto simp add: tm.lookup_correct tm.update_correct lm.update_correct init_fields_def explode_inject)\n\n\n\nlemma sc_oconf_init_arr:\n assumes type: \"is_type P (T\\\\)\"\n shows \"P,h \\sc Arr T n (init_fields_array (map (\\((F, D), (T, fm)). (F, T)) (TypeRel.fields P Object))) (init_cells T n) \\\"\nproof -\n { fix n'\n assume \"n' < n\"\n { fix rm and k :: nat\n assume \"\\iv. rm_\\ rm i = \\v\\ \\ sc.conf P h v T\"\n with `n' < n` have \"\\v. rm_\\ (foldl (\\cells i. rm_update i (default_val T) cells) rm [k..v\\ \\ sc.conf P h v T\"\n by(induct m\\\"n-k\" arbitrary: n k rm)(auto simp add: rm.update_correct upt_conv_Cons type)\n }\n from this[of 0 \"rm_empty ()\"]\n have \"\\v. rm_\\ (foldl (\\cells i. rm_update i (default_val T) cells) (rm_empty ()) [0..v\\ \\ sc.conf P h v T\" by simp\n }\n moreover\n { fix F T fm\n assume \"P \\ Object has F:T (fm) in Object\"\n then obtain FDTs where has: \"P \\ Object has_fields FDTs\"\n and FDTs: \"map_of FDTs (F, Object) = \\(T, fm)\\\"\n by(auto simp add: has_field_def)\n from has have \"snd ` fst ` set FDTs \\ {Object}\" by(rule Object_has_fields_Object)\n with FDTs have \"map_of (map ((\\(F, T). (F, default_val T)) \\ (\\((F, D), T, fm). (F, T))) FDTs) F = \\default_val T\\\"\n by(induct FDTs) auto\n with has FDTs\n have \"\\v. lm_lookup F (init_fields_array (map (\\((F, D), T, fm). (F, T)) (TypeRel.fields P Object))) = \\v\\ \\\n sc.conf P h v T\"\n by(auto simp add: init_fields_array_def lm_correct has_field_def)\n }\n ultimately show ?thesis using type by(auto simp add: sc_oconf_def init_cells_def)\nqed\n\nlemma sc_oconf_fupd [intro?]:\n \"\\ P \\ C has F:T (fm) in D; P,h \\sc v :\\ T; P,h \\sc (Obj C fs) \\;\n fs' = (case tm_lookup (String.explode F) fs of None \\ lm_empty () | Some fs' \\ fs') \\\n \\ P,h \\sc (Obj C (tm_update (String.explode F) (lm_update D v fs') fs)) \\\"\nunfolding sc_oconf_def has_field_def\napply(auto dest: has_fields_fun simp add: lm.update_correct tm.update_correct tm.lookup_correct explode_inject)\napply(drule (1) has_fields_fun, fastforce)\napply(drule (1) has_fields_fun, fastforce)\ndone\n\nlemma sc_oconf_fupd_arr [intro?]:\n \"\\ P,h \\sc v :\\ T; P,h \\sc (Arr T si f el) \\ \\\n \\ P,h \\sc (Arr T si f (rm_update i v el)) \\\"\nunfolding sc_oconf_def\nby(auto simp add: rm.update_correct)\n\nlemma sc_oconf_fupd_arr_fields:\n \"\\ P \\ Object has F:T (fm) in Object; P,h \\sc v :\\ T; P,h \\sc (Arr T' si f el) \\ \\\n \\ P,h \\sc (Arr T' si (lm_update F v f) el) \\\"\nunfolding sc_oconf_def by(auto dest: has_field_fun simp add: lm_correct)\n\nlemma sc_oconf_new: \"\\ P,h \\sc obj \\; rm_lookup a h = None \\ \\ P,rm_update a arrobj h \\sc obj \\\"\nby(erule sc_oconf_hext)(rule sc_hext_new)\n\nlemmas sc_oconf_upd_obj = sc_oconf_hext [OF _ sc_hext_upd_obj]\n\nlemma sc_oconf_upd_arr:\n assumes \"P,h \\sc obj \\\"\n and ha: \"rm_lookup a h = \\Arr T si f el\\\"\n shows \"P,rm_update a (Arr T si f' el') h \\sc obj \\\"\nusing assms\nby(fastforce simp add: sc_oconf_def sc_conf_upd_arr[OF ha] split: heapobj.split)\n\nlemma sc_oconf_blank: \"is_htype P hT \\ P,h \\sc blank P hT \\\"\napply(cases hT)\n apply(fastforce dest: map_of_fields_init_fields simp add: has_field_def sc_oconf_def)\nby(auto intro: sc_oconf_init_arr)\n\nlemma sc_hconfD: \"\\ P \\sc h \\; rm_lookup a h = Some obj \\ \\ P,h \\sc obj \\\"\nunfolding sc_hconf_def by(auto simp add: rm.lookup_correct)\n\nlemmas sc_preallocated_new = sc.preallocated_hext[OF _ sc_hext_new]\nlemmas sc_preallocated_upd_obj = sc.preallocated_hext [OF _ sc_hext_upd_obj]\nlemmas sc_preallocated_upd_arr = sc.preallocated_hext [OF _ sc_hext_upd_arr]\n\nlemma sc_hconf_new: \"\\ P \\sc h \\; rm_lookup a h = None; P,h \\sc obj \\ \\ \\ P \\sc rm_update a obj h \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_new simp add: rm.lookup_correct rm.update_correct)\n\nlemma sc_hconf_upd_obj: \"\\ P \\sc h \\; rm_lookup a h = Some (Obj C fs); P,h \\sc (Obj C fs') \\ \\ \\ P \\sc rm_update a (Obj C fs') h \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_obj simp add: rm.lookup_correct rm.update_correct)\n\nlemma sc_hconf_upd_arr: \"\\ P \\sc h \\; rm_lookup a h = Some(Arr T si f el); P,h \\sc (Arr T si f' el') \\ \\ \\ P \\sc rm_update a (Arr T si f' el') h \\\"\nunfolding sc_hconf_def\nby(auto intro: sc_oconf_upd_arr simp add: rm.lookup_correct rm.update_correct)\n\nlemma sc_heap_conf: \n \"heap_conf addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_write (sc_hconf P) P\"\nproof\n show \"P \\sc sc_empty \\\" by(simp add: sc_hconf_def rm.empty_correct)\nnext\n fix h a hT\n assume \"sc_typeof_addr h a = \\hT\\\" \"P \\sc h \\\"\n thus \"is_htype P hT\"\n by(auto simp add: sc_typeof_addr_def sc_oconf_def dest!: sc_hconfD split: heapobj.split_asm)\nnext\n fix h' hT h a\n assume \"P \\sc h \\\" \"(h', a) \\ sc_allocate P h hT\" \"is_htype P hT\"\n thus \"P \\sc h' \\\"\n by(auto simp add: sc_allocate_def dest!: new_Addr_SomeD intro: sc_hconf_new sc_oconf_blank split: split_if_asm)\nnext\n fix h a al T v h'\n assume \"P \\sc h \\\"\n and \"sc.addr_loc_type P h a al T\"\n and \"P,h \\sc v :\\ T\"\n and \"sc_heap_write h a al v h'\"\n thus \"P \\sc h' \\\"\n by(cases al)(fastforce elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def intro: sc_hconf_upd_obj sc_oconf_fupd sc_hconfD sc_hconf_upd_arr sc_oconf_fupd_arr sc_oconf_fupd_arr_fields)+\nqed\n\ninterpretation sc!: \n heap_conf\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\n for P \nby(rule sc_heap_conf)\n\nlemma sc_heap_progress:\n \"heap_progress addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al T\n assume hconf: \"P \\sc h \\\"\n and alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"rm_lookup a h = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n from alt show \"\\v. sc_heap_read h a al v \\ P,h \\sc v :\\ T\"\n proof(cases)\n case (addr_loc_type_field U F fm D) \n note [simp] = `al = CField D F`\n show ?thesis\n proof(cases \"arrobj\")\n case (Obj C' fs)\n with `sc_typeof_addr h a = \\U\\` arrobj\n have [simp]: \"C' = class_type_of U\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Obj have \"P,h \\sc Obj (class_type_of U) fs \\\" by(auto dest: sc_hconfD)\n with `P \\ class_type_of U has F:T (fm) in D` obtain fs' v \n where \"tm_lookup (String.explode F) fs = \\fs'\\\" \"lm_lookup D fs' = \\v\\\" \"P,h \\sc v :\\ T\"\n by(fastforce simp add: sc_oconf_def tm.lookup_correct lm.lookup_correct)\n thus ?thesis using Obj arrobj by(auto intro: sc_heap_read.intros)\n next\n case (Arr T' si f el)\n with `sc_typeof_addr h a = \\U\\` arrobj\n have [simp]: \"U = Array_type T' si\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj Arr have \"P,h \\sc Arr T' si f el \\\" by(auto dest: sc_hconfD)\n from `P \\ class_type_of U has F:T (fm) in D` have [simp]: \"D = Object\"\n by(auto dest: has_field_decl_above)\n with `P,h \\sc Arr T' si f el \\` `P \\ class_type_of U has F:T (fm) in D`\n obtain v where \"lm_lookup F f = \\v\\\" \"P,h \\sc v :\\ T\"\n by(fastforce simp add: sc_oconf_def)\n thus ?thesis using Arr arrobj by(auto intro: sc_heap_read.intros)\n qed\n next\n case (addr_loc_type_cell n' n)\n with arrobj obtain si f el\n where [simp]: \"arrobj = Arr T si f el\"\n by(cases arrobj)(auto simp add: sc_typeof_addr_def)\n from addr_loc_type_cell arrobj\n have [simp]: \"al = ACell n\" and n: \"n < si\" by(auto simp add: sc_typeof_addr_def)\n from hconf arrobj have \"P,h \\sc Arr T si f el \\\" by(auto dest: sc_hconfD)\n with n obtain v where \"rm_lookup n el = \\v\\\" \"P,h \\sc v :\\ T\"\n by(fastforce simp add: sc_oconf_def rm.lookup_correct)\n thus ?thesis using arrobj n by(fastforce intro: sc_heap_read.intros)\n qed\nnext\n fix h a al T v\n assume alt: \"sc.addr_loc_type P h a al T\"\n from alt obtain arrobj where arrobj: \"rm_lookup a h = \\arrobj\\\"\n by(auto elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n thus \"\\h'. sc_heap_write h a al v h'\" using alt\n by(cases arrobj)(fastforce intro: sc_heap_write.intros elim!: sc.addr_loc_type.cases simp add: sc_typeof_addr_def dest: has_field_decl_above)+\nqed\n\ninterpretation sc!: \n heap_progress\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\n for P\nby(rule sc_heap_progress)\n\nlemma sc_heap_conf_read:\n \"heap_conf_read addr2thread_id thread_id2addr sc_empty (sc_allocate P) sc_typeof_addr sc_heap_read sc_heap_write (sc_hconf P) P\"\nproof\n fix h a al v T\n assume read: \"sc_heap_read h a al v\"\n and alt: \"sc.addr_loc_type P h a al T\"\n and hconf: \"P \\sc h \\\"\n thus \"P,h \\sc v :\\ T\"\n apply(auto elim!: sc_heap_read.cases sc.addr_loc_type.cases simp add: sc_typeof_addr_def)\n apply(fastforce dest!: sc_hconfD simp add: sc_oconf_def tm.lookup_correct lm.lookup_correct rm.lookup_correct)+\n done\nqed\n\ninterpretation sc!: \n heap_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n \"P\"\n for P\nby(rule sc_heap_conf_read)\n\nabbreviation sc_deterministic_heap_ops :: \"'m prog \\ bool\"\nwhere \"sc_deterministic_heap_ops \\ sc.deterministic_heap_ops TYPE('m)\"\n\nlemma sc_deterministic_heap_ops: \"\\ sc_spurious_wakeups \\ sc_deterministic_heap_ops P\"\nby(rule sc.deterministic_heap_opsI)(auto elim: sc_heap_read.cases sc_heap_write.cases simp add: sc_allocate_def)\n\nsubsection {* Code generation *}\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ o \\ bool)\n sc_heap_read .\n\ncode_pred \n (modes: i \\ i \\ i \\ i \\ i \\ bool, i \\ i \\ i \\ i \\ o \\ bool)\n sc_heap_write .\n\nlemma eval_sc_heap_read_i_i_i_o:\n \"Predicate.eval (sc_heap_read_i_i_i_o h ad al) = sc_heap_read h ad al\"\nby(auto elim: sc_heap_read_i_i_i_oE intro: sc_heap_read_i_i_i_oI intro!: ext)\n\nlemma eval_sc_heap_write_i_i_i_i_o:\n \"Predicate.eval (sc_heap_write_i_i_i_i_o h ad al v) = sc_heap_write h ad al v\"\nby(auto elim: sc_heap_write_i_i_i_i_oE intro: sc_heap_write_i_i_i_i_oI intro!: ext)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/SC_Collections.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.36296921241058616, "lm_q1q2_score": 0.18290242584577487}} {"text": "(*\n * Copyright 2016, Data61\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory AsmSemanticsRespects\n\nimports \"GlobalsSwap\"\n\nbegin\n\ndefinition\n asm_semantics_protects_globs\n :: \"('g \\ heap_raw_state) \\ ((heap_raw_state \\ heap_raw_state) \\ 'g \\ 'g)\n \\ ('g \\ 'a)\n \\ (string \\ addr) \\ ('g global_data list)\n \\ bool\"\nwhere\n \"asm_semantics_protects_globs mem memu ms symtab xs\n \\ (let sw = globals_swap mem memu symtab xs\n in (\\v v' s m' ms' specname. (v', m', ms')\n \\ asm_semantics specname v\n (hrs_mem (mem (sw s)), ms s)\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (sw s))))\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (memu (hrs_mem_update (\\_. m')) (sw s)))))))\"\n\nabbreviation(input)\n asm_ops_are_swap\n :: \"('g \\ heap_raw_state) \\ ((heap_raw_state \\ heap_raw_state) \\ 'g \\ 'g)\n \\ ('g \\ 'a) \\ (('a \\ 'a) \\ 'g \\ 'g)\n \\ (string \\ addr) \\ ('g \\ 'b) \\ ('g global_data list)\n \\ bool\"\nwhere\n \"asm_ops_are_swap mem memu ms msu symtab gdata xs\n \\ (let sw = globals_swap mem memu symtab xs\n in (\\s. asm_fetch s = (hrs_mem (mem (sw s)), ms (sw s)))\n \\ (\\v s. asm_store gdata v s = sw (msu (\\_. snd v)\n (memu (hrs_mem_update (\\_. fst v)) (sw s))))\n \\ asm_semantics_protects_globs mem memu ms symtab xs)\"\n\nlemma asm_semantics_protects_globs_revD[OF refl]:\n \"sw = globals_swap mem memu symtab xs\n \\ (v', m', ms')\n \\ asm_semantics specname v\n (hrs_mem (mem (sw s)), ms s)\n \\ asm_semantics_protects_globs mem memu ms symtab xs\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (sw s))))\n \\ const_globals_in_memory symtab xs\n (hrs_mem (mem (sw (memu (hrs_mem_update (\\_. m')) (sw s)))))\"\n apply (simp add: asm_semantics_protects_globs_def Let_def)\n apply blast\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/asmrefine/AsmSemanticsRespects.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3629692055196168, "lm_q1q2_score": 0.1829024223733729}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory StoreCap\n\nimports \n \"UnpredictableBehaviour\"\n \"ExceptionFlag\"\n \"ExecutionStep\"\nbegin\n\n(*>*)\nsection \\Semantics of @{const StoreCapAction}}\\\n\nnamed_theorems SemanticsStoreCapI\n \nmethod SemanticsStoreCap uses intro =\n HoareTriple intro: intro SemanticsStoreCapI[THEN HoareTriple_post_weakening]\n\ndeclare nonExceptionCase_exceptions [SemanticsStoreCapI]\n\ndefinition AddressIsCapWritable :: \n \"Capability \\ Capability \\ PhysicalCapAddress \\ \n (VirtualAddress \\ AccessType \\ PhysicalAddress option) \\ bool\" \nwhere\n \"AddressIsCapWritable authCap cap a addrTrans \\\n Permit_Store (getPerms authCap) \\ \n Permit_Store_Capability (getPerms authCap) \\ \n getTag authCap \\\n \\ getSealed authCap \\\n (getTag cap \\ \\ Global (getPerms cap) \\ \n Permit_Store_Local_Capability (getPerms authCap)) \\\n (\\a'\\Region (ExtendCapAddress a) 32. \n \\vAddr\\RegionOfCap authCap.\n addrTrans (vAddr, STORE) = Some a')\"\n\nlemma AddressIsCapWritableI:\n assumes v_upper: \"ucast vAddr + (32::65 word) \\ \n ucast (getBase authCap) + ucast (getLength authCap)\"\n and v_lower: \"getBase authCap \\ vAddr\"\n and alignment: \"isCapAligned vAddr\"\n and pAddr: \"getTranslateAddr (vAddr, STORE) s = Some pAddr\"\n and a: \"a = GetCapAddress pAddr\"\n and trans: \"addrTrans = getTranslateAddrFunc s\"\n and \"Permit_Store (getPerms authCap)\"\n and \"Permit_Store_Capability (getPerms authCap)\"\n and \"getTag authCap\"\n and \"\\ getSealed authCap\"\n and \"getTag cap \\\n \\ Global (getPerms cap) \\\n Permit_Store_Local_Capability (getPerms authCap)\"\n shows \"AddressIsCapWritable authCap cap a addrTrans\"\nproof -\n have \"(ucast vAddr::5 word) = 0\"\n using alignment\n unfolding isCapAligned_def\n by simp\n have \"(ucast pAddr::5 word) = 0\"\n using arg_cong[where f=\"\\x. (ucast x::5 word)\", \n OF getTranslateAddr_ucast12[OF pAddr]]\n using `(ucast vAddr::5 word) = 0`\n by simp\n hence [simp]: \"pAddr AND mask 5 = 0\"\n using eq_ucast_eq_and_mask[where x=pAddr and y=0 and n=5 and 'b=5]\n by simp \n have [simp]: \"pAddr AND NOT mask 5 = pAddr\"\n unfolding word_minus_word_and_mask[THEN sym]\n by (simp del: word_minus_word_and_mask)\n note TranslateNearbyAddress_CapAligned2 = \n TranslateNearbyAddress_CapAligned\n [where cap=authCap and vAddr=vAddr and \n pAddr=pAddr and s=s and accessType=STORE]\n show ?thesis\n using assms\n unfolding AddressIsCapWritable_def \n unfolding getTranslateAddrFunc_def\n unfolding ExtendCapAddress_def GetCapAddress_def\n by (auto elim!: TranslateNearbyAddress_CapAligned2)\nqed\n\ndefinition SemanticsStoreCapPost where\n \"SemanticsStoreCapPost authCap cap a addrTrans \\ \n return (AddressIsCapWritable authCap cap a addrTrans) \\\\<^sub>b\n (read_state (getMemCap a) =\\<^sub>b return cap)\"\n\nlemma Commute_SemanticsStoreCapPost [Commute_compositeI]:\n assumes \"Commute (read_state (getMemCap a)) m\"\n shows \"Commute (SemanticsStoreCapPost authCap cap a addrTrans) m\"\nunfolding SemanticsStoreCapPost_def\nby (Commute intro: assms)\n\nlemma SemanticsStoreCapability_WriteCap [SemanticsStoreCapI]:\n shows \"HoareTriple (if fst v = a then return (snd v = cap)\n else read_state (getMemCap a) =\\<^sub>b return cap)\n (WriteCap v) \n (\\_. read_state (getMemCap a) =\\<^sub>b return cap)\"\nunfolding HoareTriple_def\nby (cases v) (simp add: ValueAndStatePart_simp)\n\nlemmas SemanticsStoreCapability_AddressTranslation =\n HoareTriple_DefinedAddressTranslation\n [where p=\"\\x. return (AddressIsCapWritable authCap cap a' addrTrans) \\\\<^sub>b \n (bind (read_state getLLbit)\n (\\y. if (slice 5 x = a) \\ (cond \\ y = Some True)\n then return (cap' = cap) \n else read_state (getMemCap a) =\\<^sub>b return cap)) \\\\<^sub>b\n return extra\"]\n for a a' cap cap' authCap addrTrans cond extra\n\nlemma SemanticsStoreCapability_StoreCap:\n shows \"HoareTriple (read_state getExceptionSignalled \\\\<^sub>b \n read_state isUnpredictable \\\\<^sub>b \n bind (read_state (getTranslateAddr (vAddr', STORE)))\n (\\x. case x of None \\ return True \n | Some y \\ \n return (AddressIsCapWritable authCap cap a addrTrans) \\\\<^sub>b \n (bind (read_state getLLbit)\n (\\z. if (slice 5 y = a) \\ \n (cond \\ z = Some True)\n then return (cap' = cap) \n else read_state (getMemCap a) =\\<^sub>b return cap))) \\\\<^sub>b\n return authAccessible)\n (StoreCap (vAddr', cap', cond))\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsStoreCapPost authCap cap a addrTrans \\\\<^sub>b\n return authAccessible)\"\nproof -\n note [SemanticsStoreCapI] = \n SemanticsStoreCapability_AddressTranslation\n [where cond=cond and cap'=cap' and a=a and extra=authAccessible]\n show ?thesis\n unfolding StoreCap_alt_def\n unfolding SemanticsStoreCapPost_def\n by (simp, SemanticsStoreCap) auto\nqed\n\nlemma SemanticsStoreCapability_CSC [SemanticsStoreCapI]:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return addrTrans =\\<^sub>b read_state getTranslateAddrFunc) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (CSCActions v) (\\prov. return (StoreCapAction auth cd a \\ prov)))\n (dfn'CSC v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsStoreCapPost authCap cap a addrTrans \\\\<^sub>b\n return authAccessible)\"\nproof -\n note [SemanticsStoreCapI] =\n SemanticsStoreCapability_StoreCap[where authAccessible=authAccessible]\n note TranslateNearbyAddress_CapAligned2 = \n TranslateNearbyAddress_CapAligned\n [where pAddr=\"ExtendCapAddress a\" and accessType=STORE]\n show ?thesis\n unfolding dfn'CSC_alt_def CSCActions_def\n unfolding CSCPhysicalAddress_def CSCVirtualAddress_def\n by SemanticsStoreCap\n (auto simp: not_le not_less \n GetCapAddress_def ExtendCapAddress_def\n getTranslateAddrFunc_def\n split: option.splits\n intro!: AddressIsCapWritableI)\nqed\n\nlemma SemanticsStoreCapability_CSCC [SemanticsStoreCapI]:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return addrTrans =\\<^sub>b read_state getTranslateAddrFunc) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (CSCCActions v) (\\prov. return (StoreCapAction auth cd a \\ prov)))\n (dfn'CSCC v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsStoreCapPost authCap cap a addrTrans \\\\<^sub>b\n return authAccessible)\"\nproof -\n note [SemanticsStoreCapI] =\n SemanticsStoreCapability_StoreCap[where authAccessible=authAccessible]\n show ?thesis\n unfolding dfn'CSCC_alt_def CSCCActions_def \n unfolding CSCCPhysicalAddress_def CSCCVirtualAddress_def\n by SemanticsStoreCap\n (auto simp: not_le not_less if_distrib[where f=\"\\x. _ \\ x\"]\n GetCapAddress_def ExtendCapAddress_def\n getTranslateAddrFunc_def\n split: option.splits if_splits\n intro!: AddressIsCapWritableI)\nqed\n\nlemma SemanticsStoreCapability_Run_aux:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return addrTrans =\\<^sub>b read_state getTranslateAddrFunc) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions v) (\\prov. return (StoreCapAction auth cd a \\ prov)))\n (Run v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsStoreCapPost authCap cap a addrTrans \\\\<^sub>b\n return authAccessible)\"\nunfolding Run_alt_def RunActions_def \nby (HoareTriple_cases;\n rule HoareTriple_pre_strengthening,\n rule SemanticsStoreCapability_CSC\n SemanticsStoreCapability_CSCC\n HoareTriple_weakest_pre_any,\n solves \\auto simp: ValueAndStatePart_simp\\)\n\nlemmas SemanticsStoreCapability_Run =\n HoareTriple_weakest_pre_disj[OF SemanticsStoreCapability_Run_aux\n UndefinedCase_Run]\n\nlemma SemanticsStoreCapability_Fetch:\n fixes auth a a' cd authCap cap addrTrans cdAccessible authAccessible\n defines \"p \\ \\w. (return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return addrTrans =\\<^sub>b read_state getTranslateAddrFunc) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions (Decode w)) (\\ac. return (StoreCapAction auth cd a \\ ac))\"\n shows \"HoareTriple (bind NextInstruction (case_option (return True) p))\n Fetch\n (\\b. case b of None \\ read_state getExceptionSignalled\n | Some y \\ read_state isUnpredictable \\\\<^sub>b p y)\"\nunfolding p_def\nby (intro HoareTriple_Fetch) Commute+\n\nlemma SemanticsStoreCapability_NextWithGhostState:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return addrTrans =\\<^sub>b read_state getTranslateAddrFunc) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind DomainActions (\\ac. return (StoreCapAction auth cd a \\ ac)))\n NextWithGhostState\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsStoreCapPost authCap cap a addrTrans \\\\<^sub>b\n return authAccessible)\"\nproof -\n note [SemanticsStoreCapI] = \n SemanticsStoreCapability_Run[where auth=auth and\n authAccessible=authAccessible]\n note [SemanticsStoreCapI] = \n SemanticsStoreCapability_Fetch[where auth=auth and a=a and cd=cd and\n cap=cap and authCap=authCap and \n addrTrans=addrTrans and\n authAccessible=authAccessible]\n show ?thesis\n unfolding NextWithGhostState_def DomainActions_def\n by (SemanticsStoreCap intro: UndefinedCase_TakeBranch)\n (auto split: option.splits)\nqed\n\ntheorem SemanticsStoreCap:\n assumes prov: \"StoreCapAction auth cd a \\ actions\"\n and suc: \"(PreserveDomain actions, s') \\ SemanticsCheriMips s\"\n shows \"Permit_Store (getPerms (getCapReg auth s))\"\n \"Permit_Store_Capability (getPerms (getCapReg auth s))\"\n \"getTag (getCapReg auth s)\"\n \"\\ getSealed (getCapReg auth s)\"\n \"getTag (getCAPR cd s) \\ \\ Global (getPerms (getCAPR cd s)) \\\n Permit_Store_Local_Capability (getPerms (getCapReg auth s))\"\n \"Region (ExtendCapAddress a) 32 \\ \n getTranslateAddresses (RegionOfCap (getCapReg auth s)) STORE s\"\n \"getRegisterIsAccessible auth s\"\n \"getMemCap a s' = getCAPR cd s\"\nusing assms\nusing SemanticsStoreCapability_NextWithGhostState\n [where cap=\"getCAPR cd s\" and cd=cd and a=a and auth=auth and\n authCap=\"getCapReg auth s\" and \n addrTrans=\"getTranslateAddrFunc s\" and\n authAccessible=\"getRegisterIsAccessible auth s\",\n THEN HoareTripleE[where s=s]]\nunfolding SemanticsStoreCapPost_def \nunfolding AddressIsCapWritable_def \nunfolding getTranslateAddrFunc_def getTranslateAddresses_def\nunfolding SemanticsCheriMips_def Next_NextWithGhostState NextNonExceptionStep_def\nby (auto simp: ValueAndStatePart_simp split: if_splits option.splits)\n\ncorollary StoreCapInstantiation:\n assumes \"(lbl, s') \\ SemanticsCheriMips s\"\n shows \"StoreCapProp s lbl s'\"\nunfolding StoreCapProp_def\nusing assms SemanticsStoreCap\nby metis\n\ncorollary StoreLocalCapInstantiation:\n assumes \"(lbl, s') \\ SemanticsCheriMips s\"\n shows \"StoreLocalCapProp s lbl s'\"\nunfolding StoreLocalCapProp_def\nusing assms SemanticsStoreCap\nby metis\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/instantiation/StoreCap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.32082131381216084, "lm_q1q2_score": 0.1828208763060332}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__57_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__57_on_rules imports n_g2kAbsAfter_lemma_on_inv__57\nbegin\nsection{*All lemmas on causal relation between inv__57*}\nlemma lemma_inv__57_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__57 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__57) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__57_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.32082130082460697, "lm_q1q2_score": 0.18282086890504118}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__5_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__5_on_rules imports n_german_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__5 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__5) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.34158251284363395, "lm_q1q2_score": 0.18278026080406312}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__40_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__40_on_rules imports n_german_lemma_on_inv__40\nbegin\nsection{*All lemmas on causal relation between inv__40*}\nlemma lemma_inv__40_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__40 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__40) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__40_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.3415824927356586, "lm_q1q2_score": 0.18278025510921186}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__46_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__46_on_rules imports n_german_lemma_on_inv__46\nbegin\nsection{*All lemmas on causal relation between inv__46*}\nlemma lemma_inv__46_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__46) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__46_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.35936413143782797, "lm_q1q2_score": 0.18248936954052047}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__37_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__37_on_rules imports n_german_lemma_on_inv__37\nbegin\nsection{*All lemmas on causal relation between inv__37*}\nlemma lemma_inv__37_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__37) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__37_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.33111973962899144, "lm_q1q2_score": 0.18231697239735564}} {"text": "(* Title: JinjaThreads/Execute/JVMExec_Execute.thy\n Author: Andreas Lochbihler\n*)\n\ntheory JVMExec_Execute\nimports\n \"../JVM/JVMExec\"\n ExternalCall_Execute\nbegin\n\nsubsection \\Manual translation of the JVM to use sets instead of predicates\\\n\nlocale JVM_heap_execute = heap_execute +\n constrains addr2thread_id :: \"('addr :: addr) \\ 'thread_id\" \n and thread_id2addr :: \"'thread_id \\ 'addr\" \n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\" \n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\" \n and typeof_addr :: \"'heap \\ 'addr \\ htype option\" \n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val set\" \n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap set\"\n\nsublocale JVM_heap_execute < execute: JVM_heap_base\n addr2thread_id thread_id2addr \n spurious_wakeups\n empty_heap allocate typeof_addr\n \"\\h a ad v. v \\ heap_read h a ad\" \"\\h a ad v h'. h' \\ heap_write h a ad v\"\n.\n\ncontext JVM_heap_execute begin\n\ndefinition exec_instr ::\n \"'addr instr \\ 'addr jvm_prog \\ 'thread_id \\ 'heap \\ 'addr val list \\ 'addr val list\n \\ cname \\ mname \\ pc \\ 'addr frame list \n \\ (('addr, 'thread_id, 'heap) jvm_thread_action \\ ('addr, 'heap) jvm_state) set\"\nwhere [simp]: \"exec_instr = execute.exec_instr\"\n\nlemma exec_instr_code [code]:\n \"exec_instr (Load n) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, ((loc ! n) # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr (Store n) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (tl stk, loc[n:=hd stk], C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr (Push v) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (v # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr (New C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let HA = allocate h (Class_type C) in\n if HA = {} then {(\\, \\execute.addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else do { (h', a) \\ HA; {(\\NewHeapElem a (Class_type C)\\, None, h', (Addr a # stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1)#frs)} })\"\n \"exec_instr (NewArray T) P t h stk loc C0 M0 pc frs =\n (let si = the_Intg (hd stk);\n i = nat (sint si)\n in if si , \\execute.addr_of_sys_xcpt NegativeArraySize\\, h, (stk, loc, C0, M0, pc) # frs)}\n else let HA = allocate h (Array_type T i) in\n if HA = {} then {(\\, \\execute.addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C0, M0, pc) # frs)}\n else do { (h', a) \\ HA; {(\\NewHeapElem a (Array_type T i)\\, None, h', (Addr a # tl stk, loc, C0, M0, pc + 1) # frs)}})\"\n \"exec_instr ALoad P t h stk loc C0 M0 pc frs =\n (let va = hd (tl stk)\n in (if va = Null then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else \n let i = the_Intg (hd stk);\n a = the_Addr va;\n len = alen_of_htype (the (typeof_addr h a))\n in if i int len \\ sint i then\n {(\\, \\execute.addr_of_sys_xcpt ArrayIndexOutOfBounds\\, h, (stk, loc, C0, M0, pc) # frs)}\n else do {\n v \\ heap_read h a (ACell (nat (sint i)));\n {(\\ReadMem a (ACell (nat (sint i))) v\\, None, h, (v # tl (tl stk), loc, C0, M0, pc + 1) # frs)}\n }))\"\n \"exec_instr AStore P t h stk loc C0 M0 pc frs =\n (let ve = hd stk;\n vi = hd (tl stk);\n va = hd (tl (tl stk))\n in (if va = Null then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else (let i = the_Intg vi;\n idx = nat (sint i);\n a = the_Addr va;\n hT = the (typeof_addr h a);\n T = ty_of_htype hT;\n len = alen_of_htype hT;\n U = the (execute.typeof_h h ve)\n in (if i int len \\ sint i then\n {(\\, \\execute.addr_of_sys_xcpt ArrayIndexOutOfBounds\\, h, (stk, loc, C0, M0, pc) # frs)}\n else if P \\ U \\ the_Array T then \n do {\n h' \\ heap_write h a (ACell idx) ve;\n {(\\WriteMem a (ACell idx) ve\\, None, h', (tl (tl (tl stk)), loc, C0, M0, pc+1) # frs)}\n }\n else {(\\, (\\execute.addr_of_sys_xcpt ArrayStore\\, h, (stk, loc, C0, M0, pc) # frs))}))))\"\n \"exec_instr ALength P t h stk loc C0 M0 pc frs =\n {(\\, (let va = hd stk\n in if va = Null\n then (\\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)\n else (None, h, (Intg (word_of_int (int (alen_of_htype (the (typeof_addr h (the_Addr va)))))) # tl stk, loc, C0, M0, pc+1) # frs)))}\"\n \"exec_instr (Getfield F C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let v = hd stk\n in if v = Null then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else let a = the_Addr v\n in do {\n v' \\ heap_read h a (CField C F);\n {(\\ReadMem a (CField C F) v'\\, None, h, (v' # (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)}\n })\"\n \"exec_instr (Putfield F C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let v = hd stk;\n r = hd (tl stk)\n in if r = Null then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else let a = the_Addr r\n in do {\n h' \\ heap_write h a (CField C F) v;\n {(\\WriteMem a (CField C F) v\\, None, h', (tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)}\n })\"\n \"exec_instr (Checkcast T) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, let U = the (typeof\\<^bsub>h\\<^esub> (hd stk))\n in if P \\ U \\ T then (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)\n else (\\execute.addr_of_sys_xcpt ClassCast\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs))}\"\n \"exec_instr (Instanceof T) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, None, h, (Bool (hd stk \\ Null \\ P \\ the (typeof\\<^bsub>h\\<^esub> (hd stk)) \\ T) # tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)}\"\n \"exec_instr (Invoke M n) P t h stk loc C0 M0 pc frs =\n (let r = stk ! n\n in (if r = Null then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else (let ps = rev (take n stk);\n a = the_Addr r;\n T = the (typeof_addr h a);\n (D,M',Ts,meth)= method P (class_type_of T) M\n in case meth of \n Native \\\n do {\n (ta, va, h') \\ red_external_aggr P t a M ps h;\n {(extTA2JVM P ta, extRet2JVM n h' stk loc C0 M0 pc frs va)}\n }\n | \\(mxs,mxl\\<^sub>0,ins,xt)\\ \\\n let f' = ([],[r]@ps@(replicate mxl\\<^sub>0 undefined_value),D,M,0)\n in {(\\, None, h, f' # (stk, loc, C0, M0, pc) # frs)})))\"\n \"exec_instr Return P t h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (if frs=[] then (None, h, []) \n else \n let v = hd stk\\<^sub>0; \n (stk,loc,C,m,pc) = hd frs;\n n = length (fst (snd (method P C\\<^sub>0 M\\<^sub>0)))\n in (None, h, (v#(drop (n+1) stk),loc,C,m,pc+1)#tl frs)))}\"\n \"exec_instr Pop P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = {(\\, (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr Dup P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = {(\\, (None, h, (hd stk # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr Swap P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = {(\\, (None, h, (hd (tl stk) # hd stk # tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n \"exec_instr (BinOpInstr bop) P t h stk loc C0 M0 pc frs =\n {(\\, \n case the (execute.binop bop (hd (tl stk)) (hd stk)) of\n Inl v \\ (None, h, (v # tl (tl stk), loc, C0, M0, pc + 1) # frs)\n | Inr a \\ (Some a, h, (stk, loc, C0, M0, pc) # frs))}\"\n \"exec_instr (IfFalse i) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (let pc' = if hd stk = Bool False then nat(int pc+i) else pc+1\n in (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc')#frs)))}\"\n \"exec_instr (Goto i) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = {(\\, (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, nat(int pc+i))#frs))}\"\n \"exec_instr ThrowExc P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (let xp' = if hd stk = Null then \\execute.addr_of_sys_xcpt NullPointer\\ else \\the_Addr(hd stk)\\\n in (xp', h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc)#frs)))}\"\n \"exec_instr MEnter P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(let v = hd stk\n in if v = Null\n then (\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)\n else (\\Lock\\the_Addr v, SyncLock (the_Addr v)\\, None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs))}\"\n \"exec_instr MExit P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (let v = hd stk\n in if v = Null\n then {(\\, \\execute.addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else {(\\Unlock\\the_Addr v, SyncUnlock (the_Addr v)\\, None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs),\n (\\UnlockFail\\the_Addr v\\, \\execute.addr_of_sys_xcpt IllegalMonitorState\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)})\"\nby(auto 4 4 intro: rev_bexI)\n\ndefinition exec :: \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state \\ ('addr, 'thread_id, 'heap) jvm_ta_state set\"\nwhere \"exec = execute.exec\"\n\nlemma exec_code:\n \"exec P t (xcp, h, []) = {}\"\n \"exec P t (None, h, (stk, loc, C, M, pc) # frs) = exec_instr (instrs_of P C M ! pc) P t h stk loc C M pc frs\"\n \"exec P t (\\a\\, h, fr # frs) = {(\\, execute.exception_step P a h fr frs)}\"\nby(simp_all add: exec_def)\n\ndefinition exec_1 ::\n \"'addr jvm_prog \\ 'thread_id \\ ('addr, 'heap) jvm_state\n \\ (('addr, 'thread_id, 'heap) jvm_thread_action \\ ('addr, 'heap) jvm_state) Predicate.pred\"\nwhere \"exec_1 P t \\ = pred_of_set (exec P t \\)\"\n\nlemma exec_1I: \"execute.exec_1 P t \\ ta \\' \\ Predicate.eval (exec_1 P t \\) (ta, \\')\"\nby(erule execute.exec_1.cases)(simp add: exec_1_def exec_def)\n\nlemma exec_1E:\n assumes \"Predicate.eval (exec_1 P t \\) (ta, \\')\"\n obtains \"execute.exec_1 P t \\ ta \\'\"\nusing assms\nby(auto simp add: exec_1_def exec_def intro: execute.exec_1.intros)\n\nlemma exec_1_eq [simp]:\n \"Predicate.eval (exec_1 P t \\) (ta, \\') \\ execute.exec_1 P t \\ ta \\'\"\nby(auto intro: exec_1I elim: exec_1E)\n\nlemma exec_1_eq':\n \"Predicate.eval (exec_1 P t \\) = (\\(ta, \\'). execute.exec_1 P t \\ ta \\')\"\nby(rule ext)(simp split: prod.split)\n\nend\n\nlemmas [code] = \n JVM_heap_execute.exec_instr_code\n JVM_heap_base.exception_step.simps\n JVM_heap_execute.exec_code\n JVM_heap_execute.exec_1_def\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Execute/JVMExec_Execute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.550607350786733, "lm_q2_score": 0.33111972642778714, "lm_q1q2_score": 0.18231695536163164}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_on_inv__27.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_on_inv__27 imports n_g2kAbsAfter_base\nbegin\nsection{*All lemmas on causal relation between inv__27 and some rule r*}\nlemma n_n_RecvInvAck_i1Vsinv__27:\nassumes a1: \"(r=n_n_RecvInvAck_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_SendGntE_i1Vsinv__27:\nassumes a1: \"(r=n_n_SendGntE_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''AShrSet_1'')) (Const false)) (eqn (IVar (Field (Ident ''AChan2_1'') ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvE_i1Vsinv__27:\nassumes a1: \"(r=n_n_ASendInvE_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (neg (eqn (IVar (Field (Ident ''ACache_1'') ''State'')) (Const E)))) (eqn (IVar (Field (Ident ''AChan2_1'') ''Cmd'')) (Const Empty))) (eqn (IVar (Ident ''AInvSet_1'')) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvS_i1Vsinv__27:\nassumes a1: \"(r=n_n_ASendInvS_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (neg (eqn (IVar (Field (Ident ''ACache_1'') ''State'')) (Const E)))) (eqn (IVar (Field (Ident ''AChan2_1'') ''Cmd'')) (Const Empty))) (eqn (IVar (Ident ''AInvSet_1'')) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvAck_i1Vsinv__27:\nassumes a1: \"(r=n_n_ASendInvAck_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvInvAck_i1Vsinv__27:\nassumes a1: \"(r=n_n_ARecvInvAck_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_ASendGntS_i1Vsinv__27:\nassumes a1: \"(r=n_n_ASendGntS_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendGntE_i1Vsinv__27:\nassumes a1: \"(r=n_n_ASendGntE_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvGntS_i1Vsinv__27:\nassumes a1: \"(r=n_n_ARecvGntS_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvGntE_i1Vsinv__27:\nassumes a1: \"(r=n_n_ARecvGntE_i1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_RecvReq_i1Vsinv__27:\n assumes a1: \"r=n_n_RecvReq_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvS_i1Vsinv__27:\n assumes a1: \"r=n_n_SendInvS_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEI_i1Vsinv__27:\n assumes a1: \"r=n_n_SendReqEI_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqEI_i1Vsinv__27:\n assumes a1: \"r=n_n_ASendReqEI_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqIS_j1Vsinv__27:\n assumes a1: \"r=n_n_ASendReqIS_j1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqES_i1Vsinv__27:\n assumes a1: \"r=n_n_ASendReqES_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendGntS_i1Vsinv__27:\n assumes a1: \"r=n_n_SendGntS_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqES_i1Vsinv__27:\n assumes a1: \"r=n_n_SendReqES_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvE_i1Vsinv__27:\n assumes a1: \"r=n_n_SendInvE_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqSE_j1Vsinv__27:\n assumes a1: \"r=n_n_ASendReqSE_j1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntS_i1Vsinv__27:\n assumes a1: \"r=n_n_RecvGntS_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEE_i1Vsinv__27:\n assumes a1: \"r=n_n_SendReqEE_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntE_i1Vsinv__27:\n assumes a1: \"r=n_n_RecvGntE_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ARecvReq_i1Vsinv__27:\n assumes a1: \"r=n_n_ARecvReq_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_Store_i1Vsinv__27:\n assumes a1: \"\\ d. d\\N\\r=n_n_Store_i1 d\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_AStore_i1Vsinv__27:\n assumes a1: \"\\ d. d\\N\\r=n_n_AStore_i1 d\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqS_j1Vsinv__27:\n assumes a1: \"r=n_n_SendReqS_j1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvAck_i1Vsinv__27:\n assumes a1: \"r=n_n_SendInvAck_i1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_on_inv__27.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565327, "lm_q2_score": 0.3242353989809524, "lm_q1q2_score": 0.18227752681919396}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__10.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__10 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__10 and some rule r*}\nlemma n_StoreVsinv__10:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\\(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__10:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__10 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__10:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__10.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832354982645, "lm_q2_score": 0.33807711081161995, "lm_q1q2_score": 0.18221789503315222}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__145.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__145 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__145 and some rule r*}\nlemma n_PI_Remote_GetVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__145:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__145:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__145:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__145:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__145:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__145:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__145:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__145:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__145:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__145:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__145:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__145:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__145:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__145 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__145:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__145:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__145:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__145:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__145:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__145:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__145:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__145:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__145:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__145:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__145:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__145:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__145:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__145:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__145:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__145:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__145.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.35577490034429643, "lm_q1q2_score": 0.18205592404314616}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__17.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__17 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__17 and some rule r*}\nlemma n_SendInv__part__0Vsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__17:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__17 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__17:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__17:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_on_inv__17.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.3557749003442964, "lm_q1q2_score": 0.18205592404314608}} {"text": "(*******************************************************************************\n\n Project: Development of Security Protocols by Refinement\n\n Module: Key_establish/m1b_keydist.thy (Isabelle/HOL 2016-1)\n ID: $Id: m1_keydist.thy 134925 2017-05-24 17:53:14Z csprenge $\n Author: Christoph Sprenger, ETH Zurich \n \n Key distribution protocols\n First refinement: abstract server-based key transport protocol with \n initiator and responder roles.\n\n Copyright (c) 2009-2016 Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nchapter \\Key Establishment Protocols\\\n\ntext \\In this chapter, we develop several key establishment protocols:\n\\begin{itemize} \n\\item Needham-Schroeder Shared Key (NSSK) \n\\item core Kerberos IV and V, and\n\\item Denning-Sacco. \n\\end{itemize}\n\\\n\n\nsection \\Basic abstract key distribution (L1)\\\n\ntheory m1_keydist imports \"../Refinement/Runs\" \"../Refinement/s0g_secrecy\"\nbegin\n\ntext \\The first refinement introduces the protocol roles, local memory of the\nagents and the communication structure of the protocol. For actual \ncommunication, the \"receiver\" directly reads the memory of the \"sender\". \n\nIt captures the core of essentials of server-based key distribution protocols:\nThe server generates a key that the clients read from his memory. At this\nstage we are only interested in secrecy preservation, not in authentication.\n\\\n\ndeclare option.split_asm [split]\ndeclare domIff [simp, iff del] \n\nconsts\n sk :: \"nat\" \\ \\identifier used for session keys\\\n\n\n(******************************************************************************)\nsubsection \\State\\\n(******************************************************************************)\n\ntext \\Runs record the protocol participants (initiator, responder) and the \nkeys learned during the execution. In later refinements, we will also add\nnonces and timestamps to the run record.\n\nThe variables \\kn\\ and \\az\\ from \\s0g_secrecy_leak\\ \nare replaced by runs using a data refinement. Variable \\lk\\ is \nconcretized into variable \\leak\\. \n\nWe define the state in two separate record definitions. The first one has \njust a runs field and the second extends this with a leak field. Later \nrefinements may define different state for leaks (e.g. to record more context).\n\\\n\nrecord m1r_state = \n runs :: runs_t\n\nrecord m1x_state = m1r_state + \n leak :: \"key set\" \\ \\keys leaked to attacker\\\n\ntype_synonym m1x_obs = \"m1x_state\"\n\ntext \\Predicate types for invariants and transition relation types. Use the\nr-version for invariants and transitions if there is no reference to the leak\nvariable. This improves reusability in later refinements.\n\\\ntype_synonym 'x m1r_pred = \"'x m1r_state_scheme set\"\ntype_synonym 'x m1x_pred = \"'x m1x_state_scheme set\"\n\ntype_synonym 'x m1r_trans = \"('x m1r_state_scheme \\ 'x m1r_state_scheme) set\"\ntype_synonym 'x m1x_trans = \"('x m1x_state_scheme \\ 'x m1x_state_scheme) set\"\n\n\nsubsubsection \\Key knowledge and authorization (reconstruction)\\\n(******************************************************************************)\n\ntext \\Key knowledge and authorization relations, reconstructed from the runs \nand an unspecified initial key setup. These auxiliary definitions are used in \nsome event guards and in the simulation relation (see below).\\\n\ntext \\Knowledge relation (reconstructed)\\\n\ninductive_set\n knC :: \"runs_t \\ (key \\ agent) set\" for runz :: \"runs_t\" \nwhere\n knC_init:\n \"runz Ra = Some (Init, [A, B], aKey K # al) \\ (K, A) \\ knC runz\"\n| knC_resp:\n \"runz Rb = Some (Resp, [A, B], aKey K # al) \\ (K, B) \\ knC runz\"\n| knC_serv:\n \"\\ Rs \\ dom runz; fst (the (runz Rs)) = Serv \\ \\ (sesK (Rs$sk), Sv) \\ knC runz\"\n| knC_0:\n \"(K, A) \\ keySetup \\ (K, A) \\ knC runz\"\n\n\ntext \\Authorization relation (reconstructed)\\\n\ninductive_set\n azC :: \"runs_t \\ (key \\ agent) set\" for runz :: \"runs_t\"\nwhere\n azC_good:\n \"\\ runz Rs = Some (Serv, [A, B], al); C \\ {A, B, Sv} \\ \n \\ (sesK (Rs$sk), C) \\ azC runz\"\n| azC_bad:\n \"\\ runz Rs = Some (Serv, [A, B], al); A \\ bad \\ B \\ bad \\ \n \\ (sesK (Rs$sk), C) \\ azC runz\"\n| azC_0:\n \"\\ (K, C) \\ keySetup \\ \\ (K, C) \\ azC runz\"\n\n\ndeclare knC.intros [intro]\ndeclare azC.intros [intro]\n\n\ntext \\Misc lemmas: empty state, projections, ...\\\n\nlemma knC_empty [simp]: \"knC Map.empty = keySetup\"\nby (auto elim: knC.cases)\n\nlemma azC_empty [simp]: \"azC Map.empty = keySetup\"\nby (auto elim: azC.cases)\n\n\ntext \\\\azC\\ and run abstraction\\\n\nlemma azC_map_runs [simp]: \"azC (map_runs h runz) = azC runz\"\nby (auto simp add: map_runs_def elim!: azC.cases)\n\n\ntext \\Update lemmas for @{term \"knC\"}\\\n\nlemma knC_upd_Init_Resp_None:\n \"\\ R \\ dom runz; rol \\ {Init, Resp} \\\n \\ knC (runz(R \\ (rol, [A, B], []))) = knC runz\"\nby (fastforce simp add: domIff elim!: knC.cases)\n\nlemma knC_upd_Init_Some:\n \"\\ runz Ra = Some (Init, [A, B], []) \\ \n \\ knC (runz(Ra \\ (Init, [A, B], [aKey Kab]))) = insert (Kab, A) (knC runz)\"\napply (auto elim!: knC.cases) \n\\ \\3 subgoals\\\napply (rename_tac Raa Aa Ba K al, rule_tac A=Aa and B=Ba and al=al in knC_init, auto)\napply (rename_tac Rb Aa Ba K al, rule_tac A=Aa and B=Ba and al=al in knC_resp, auto)\napply (rule_tac knC_serv, auto)\ndone\n\nlemma knC_upd_Resp_Some:\n \"\\ runz Ra = Some (Resp, [A, B], []) \\ \n \\ knC (runz(Ra \\ (Resp, [A, B], [aKey Kab]))) = insert (Kab, B) (knC runz)\"\napply (auto elim!: knC.cases)\n\\ \\3 subgoals\\\napply (rename_tac Raa Aa Ba K al, rule_tac A=Aa and B=Ba and al=al in knC_init, auto)\napply (rename_tac Raa Aa Ba K al, rule_tac A=Aa and B=Ba and al=al in knC_resp, auto)\napply (rule_tac knC_serv, auto)\ndone\n\nlemma knC_upd_Server:\n \"\\ Rs \\ dom runz \\\n \\ knC (runz(Rs \\ (Serv, [A, B], []))) = insert (sesK (Rs$sk), Sv) (knC runz)\"\napply (auto elim!: knC.cases)\n\\ \\2 subgoals\\\napply (rename_tac Raa Aa Ba K al, rule_tac A=Aa and B=Ba in knC_init, auto dest: dom_lemmas)\napply (rename_tac Raa Aa Ba K al, rule_tac A=Aa and B=Ba in knC_resp, auto dest: dom_lemmas)\ndone\n\nlemmas knC_upd_lemmas [simp] = \n knC_upd_Init_Resp_None knC_upd_Init_Some knC_upd_Resp_Some\n knC_upd_Server \n\n\ntext \\Update lemmas for @{term \"azC\"}\\\n\nlemma azC_upd_Init_None:\n \"\\ Ra \\ dom runz \\\n \\ azC (runz(Ra \\ (Init, [A, B], []))) = azC runz\"\nby (auto simp add: azC.simps elim!: azC.cases dest: dom_lemmas)\n\nlemma azC_upd_Resp_None:\n \"\\ Rb \\ dom runz \\\n \\ azC (runz(Rb \\ (Resp, [A, B], []))) = azC runz\"\nby (auto simp add: azC.simps elim!: azC.cases dest: dom_lemmas)\n\nlemma azC_upd_Init_Some:\n \"\\ runz Ra = Some (Init, [A, B], []) \\\n \\ azC (runz(Ra \\ (Init, [A, B], al))) = azC runz\"\napply (auto elim!: azC.cases)\n\\ \\5 subgoals\\\napply (rule_tac azC_good, auto)\napply (rule_tac azC_good, auto)\napply (rule_tac azC_good, auto)\napply (rule_tac azC_bad, auto)+\ndone\n\nlemma azC_upd_Resp_Some:\n \"\\ runz Rb = Some (Resp, [A, B], []) \\\n \\ azC (runz(Rb \\ (Resp, [A, B], al))) = azC runz\"\napply (auto elim!: azC.cases)\n\\ \\5 subgoals\\\napply (rule_tac azC_good, auto)\napply (rule_tac azC_good, auto)\napply (rule_tac azC_good, auto)\napply (rule_tac azC_bad, auto)+\ndone\n\nlemma azC_upd_Serv_bad:\n \"\\ Rs \\ dom runz; A \\ bad \\ B \\ bad \\\n \\ azC (runz(Rs \\ (Serv, [A, B], al))) = azC runz \\ {sesK (Rs$sk)} \\ UNIV\"\napply (auto elim!: azC.cases)\n\\ \\10 subgoals\\\napply (\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala C, rule_tac A=Aa and B=Ba and al=ala in azC_bad, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala C, rule_tac A=Aa and B=Ba and al=ala in azC_bad, auto dest: dom_lemmas\n)+\ndone\n\nlemma azC_upd_Serv_good:\n \"\\ Rs \\ dom runz; K = sesK (Rs$sk); A \\ bad; B \\ bad \\\n \\ azC (runz(Rs \\ (Serv, [A, B], al))) \n = azC runz \\ {(K, A), (K, B), (K, Sv)}\"\napply (auto elim!: azC.cases)\n\\ \\5 subgoals\\\napply (\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala, rule_tac A=Aa and B=Ba and al=ala in azC_good, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala C, rule_tac A=Aa and B=Ba and al=ala in azC_bad, auto dest: dom_lemmas,\n rename_tac Rsa Aa Ba ala C, rule_tac A=Aa and B=Ba and al=ala in azC_bad, auto dest: dom_lemmas\n)+\ndone\n\nlemma azC_upd_Serv:\n \"\\ Rs \\ dom runz; K = sesK (Rs$sk) \\\n \\ azC (runz(Rs \\ (Serv, [A, B], al))) =\n azC runz \\ {K} \\ (if A \\ bad \\ B \\ bad then {A, B, Sv} else UNIV)\" \nby (simp add: azC_upd_Serv_bad azC_upd_Serv_good) \n\nlemmas azC_upd_lemmas [simp] =\n azC_upd_Init_None azC_upd_Resp_None\n azC_upd_Init_Some azC_upd_Resp_Some azC_upd_Serv\n\n\n(******************************************************************************)\nsubsection \\Events\\\n(******************************************************************************)\n\ndefinition \\ \\by @{term \"A\"}, refines skip\\\n m1x_step1 :: \"[rid_t, agent, agent] \\ 'x m1r_trans\"\nwhere\n \"m1x_step1 Ra A B \\ {(s, s1).\n\n \\ \\guards:\\\n Ra \\ dom (runs s) \\ \\ \\\\Ra\\ is fresh\\\n\n \\ \\actions:\\\n \\ \\create initiator thread\\\n s1 = s\\ runs := (runs s)(Ra \\ (Init, [A, B], [])) \\\n }\"\n\ndefinition \\ \\by @{term \"B\"}, refines skip\\\n m1x_step2 :: \"[rid_t, agent, agent] \\ 'x m1r_trans\"\nwhere\n \"m1x_step2 Rb A B \\ {(s, s1).\n\n \\ \\guards:\\\n Rb \\ dom (runs s) \\ \\ \\\\Rb\\ is fresh\\\n\n \\ \\actions:\\\n \\ \\create responder thread\\\n s1 = s\\ runs := (runs s)(Rb \\ (Resp, [A, B], [])) \\\n }\"\n\ndefinition \\ \\by @{term \"Server\"}, refines @{term s0g_gen}\\\n m1x_step3 :: \"[rid_t, agent, agent, key] \\ 'x m1r_trans\"\nwhere\n \"m1x_step3 Rs A B Kab \\ {(s, s1).\n\n \\ \\guards:\\\n Rs \\ dom (runs s) \\ \\ \\\\Rs\\ is fresh\\\n Kab = sesK (Rs$sk) \\ \\ \\generate session key\\\n\n \\ \\actions:\\\n s1 = s\\ runs := (runs s)(Rs \\ (Serv, [A, B], [])) \\\n }\"\n\ndefinition \\ \\by @{term \"A\"}, refines @{term s0g_learn}\\\n m1x_step4 :: \"[rid_t, agent, agent, key] \\ 'x m1x_trans\"\nwhere\n \"m1x_step4 Ra A B Kab \\ {(s, s1).\n \\ \\guards:\\\n runs s Ra = Some (Init, [A, B], []) \\\n (Kab \\ leak s \\ (Kab, A) \\ azC (runs s)) \\ \\ \\authorization guard\\\n\n \\ \\actions:\\\n s1 = s\\ runs := (runs s)(Ra \\ (Init, [A, B], [aKey Kab])) \\\n }\"\n\ndefinition \\ \\by @{text \"B\"}, refines @{term s0g_learn}\\\n m1x_step5 :: \"[rid_t, agent, agent, key] \\ 'x m1x_trans\"\nwhere\n \"m1x_step5 Rb A B Kab \\ {(s, s1).\n \\ \\guards:\\\n runs s Rb = Some (Resp, [A, B], []) \\ \n (Kab \\ leak s \\ (Kab, B) \\ azC (runs s)) \\ \\ \\authorization guard\\\n\n \\ \\actions:\\\n s1 = s\\ runs := (runs s)(Rb \\ (Resp, [A, B], [aKey Kab])) \\\n }\"\n\ndefinition \\ \\by attacker, refines @{term s0g_leak}\\\n m1x_leak :: \"rid_t \\ 'x m1x_trans\"\nwhere\n \"m1x_leak Rs \\ {(s, s1). \n \\ \\guards:\\\n Rs \\ dom (runs s) \\\n fst (the (runs s Rs)) = Serv \\ \\ \\compromise server run \\Rs\\\\\n\n \\ \\actions:\\\n s1 = s\\ leak := insert (sesK (Rs$sk)) (leak s) \\\n }\"\n\n\n(******************************************************************************)\nsubsection \\Specification\\\n(******************************************************************************)\n\ndefinition \n m1x_init :: \"m1x_state set\"\nwhere\n \"m1x_init \\ { \\\n runs = Map.empty,\n leak = corrKey \\ \\statically corrupted keys initially leaked\\\n \\ }\"\n\ndefinition \n m1x_trans :: \"'x m1x_trans\" where\n \"m1x_trans \\ (\\A B Ra Rb Rs Kab.\n m1x_step1 Ra A B \\\n m1x_step2 Rb A B \\\n m1x_step3 Rs A B Kab \\\n m1x_step4 Ra A B Kab \\\n m1x_step5 Rb A B Kab \\\n m1x_leak Rs \\\n Id\n )\"\n\ndefinition \n m1x :: \"(m1x_state, m1x_obs) spec\" where\n \"m1x \\ \\\n init = m1x_init,\n trans = m1x_trans,\n obs = id\n \\\"\n\nlemmas m1x_defs = \n m1x_def m1x_init_def m1x_trans_def\n m1x_step1_def m1x_step2_def m1x_step3_def m1x_step4_def m1x_step5_def \n m1x_leak_def \n\nlemma m1x_obs_id [simp]: \"obs m1x = id\"\nby (simp add: m1x_def)\n\n\n(******************************************************************************)\nsubsection \\Invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv1: Key definedness\\\n(*inv**************************************************************************)\n\ntext \\Only run identifiers or static keys can be (concretely) known or \nauthorized keys. (This reading corresponds to the contraposition of the \nproperty expressed below.)\\\n\ndefinition \n m1x_inv1_key :: \"m1x_state set\" \nwhere\n \"m1x_inv1_key \\ {s. \\Rs A.\n Rs \\ dom (runs s) \\ \n (sesK (Rs$sk), A) \\ knC (runs s) \\ \n (sesK (Rs$sk), A) \\ azC (runs s) \\\n sesK (Rs$sk) \\ leak s\n }\"\n\nlemmas m1x_inv1_keyI = m1x_inv1_key_def [THEN setc_def_to_intro, rule_format]\nlemmas m1x_inv1_keyE [elim] = \n m1x_inv1_key_def [THEN setc_def_to_elim, rule_format]\nlemmas m1x_inv1_keyD [dest] = \n m1x_inv1_key_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m1x_inv1_key_init [iff]:\n \"init m1x \\ m1x_inv1_key\"\nby (auto simp add: m1x_defs m1x_inv1_key_def) \n\nlemma PO_m1x_inv1_key_trans [iff]:\n \"{m1x_inv1_key} trans m1x {> m1x_inv1_key}\"\nby (auto simp add: PO_hoare_defs m1x_defs intro!: m1x_inv1_keyI)\n\nlemma PO_m1x_inv1_key [iff]: \"reach m1x \\ m1x_inv1_key\"\nby (rule inv_rule_basic) (auto)\n\n\n(******************************************************************************)\nsubsection \\Refinement of s0g\\\n(******************************************************************************)\n\ntext \\med10: The mediator function maps a concrete observation to an \nabstract one.\\\n\ndefinition \n med01x :: \"m1x_obs \\ key s0g_obs\"\nwhere\n \"med01x t \\ \\ kn = knC (runs t), az = azC (runs t), lk = leak t \\\"\n\n\ntext \\R01: The simulation relation expreses key knowledge and authorization\nin terms of the client and server run information.\\\n\ndefinition\n R01x :: \"(key s0g_state \\ m1x_state) set\" where\n \"R01x \\ {(s, t). s = med01x t}\"\n\nlemmas R01x_defs = R01x_def med01x_def\n\n\ntext \\Refinement proof.\\\n\nlemma PO_m1x_step1_refines_skip:\n \"{R01x} \n Id, (m1x_step1 Ra A B) \n {> R01x}\"\nby (auto simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs)\n\nlemma PO_m1x_step2_refines_skip:\n \"{R01x} \n Id, (m1x_step2 Rb A B) \n {> R01x}\"\nby (auto simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs)\n\nlemma PO_m1x_step3_refines_s0g_gen:\n \"{R01x \\ UNIV \\ m1x_inv1_key} \n (s0g_gen Kab Sv {Sv, A, B}), (m1x_step3 Rs A B Kab) \n {> R01x}\"\nby (auto simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs)\n\nlemma PO_m1x_step4_refines_s0g_learn:\n \"{R01x} \n (s0g_learn Kab A), (m1x_step4 Ra A B Kab) \n {> R01x}\"\nby (auto simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs)\n\nlemma PO_m1x_step5_refines_s0g_learn:\n \"{R01x} \n (s0g_learn Kab B), (m1x_step5 Rb A B Kab) \n {> R01x}\"\nby (auto simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs) \n\nlemma PO_m1x_leak_refines_s0g_leak:\n \"{R01x} \n (s0g_leak (sesK (Rs$sk))), (m1x_leak Rs) \n {> R01x}\"\nby (fastforce simp add: PO_rhoare_defs R01x_defs s0g_defs m1x_defs)\n\n\ntext \\All together now...\\\n\nlemmas PO_m1x_trans_refines_s0g_trans = \n PO_m1x_step1_refines_skip PO_m1x_step2_refines_skip\n PO_m1x_step3_refines_s0g_gen PO_m1x_step4_refines_s0g_learn \n PO_m1x_step5_refines_s0g_learn PO_m1x_leak_refines_s0g_leak\n\nlemma PO_m1x_refines_init_s0g [iff]:\n \"init m1x \\ R01x``(init s0g)\"\nby (auto simp add: R01x_defs s0g_defs m1x_defs intro!: s0g_secrecyI s0g_domI)\n\nlemma PO_m1x_refines_trans_s0g [iff]:\n \"{R01x \\ UNIV \\ m1x_inv1_key} \n (trans s0g), (trans m1x) \n {> R01x}\"\nby (auto simp add: m1x_def m1x_trans_def s0g_def s0g_trans_def\n intro!: PO_m1x_trans_refines_s0g_trans)\n\n\ntext \\Observation consistency.\\\n\nlemma obs_consistent_med01x [iff]: \n \"obs_consistent R01x med01x s0g m1x\"\nby (auto simp add: obs_consistent_def R01x_defs s0g_def m1x_def)\n\n\ntext \\Refinement result.\\\n\nlemma PO_m1x_refines_s0g [iff]: \n \"refines \n (R01x \\ UNIV \\ m1x_inv1_key)\n med01x s0g m1x\"\nby (rule Refinement_using_invariants) (auto del: subsetI)\n\nlemma m1x_implements_s0g [iff]: \"implements med01x s0g m1x\"\nby (rule refinement_soundness) (fast)\n\n\nsubsection \\Derived invariants\\\n(******************************************************************************)\n\nsubsubsection \\inv2: Secrecy\\\n(*invh*************************************************************************)\n\ntext \\Secrecy, expressed in terms of runs.\\\n\ndefinition \n m1x_secrecy :: \"'x m1x_pred\"\nwhere\n \"m1x_secrecy \\ {s. knC (runs s) \\ azC (runs s) \\ leak s \\ UNIV}\"\n\nlemmas m1x_secrecyI = m1x_secrecy_def [THEN setc_def_to_intro, rule_format]\nlemmas m1x_secrecyE [elim] = m1x_secrecy_def [THEN setc_def_to_elim, rule_format]\n\n\ntext \\Invariance proof.\\\n\nlemma PO_m1x_obs_secrecy [iff]: \"oreach m1x \\ m1x_secrecy\"\napply (rule external_invariant_translation [OF PO_s0g_obs_secrecy _ m1x_implements_s0g])\napply (auto simp add: med01x_def m1x_secrecy_def s0g_secrecy_def)\ndone\n\nlemma PO_m1x_secrecy [iff]: \"reach m1x \\ m1x_secrecy\"\nby (rule external_to_internal_invariant [OF PO_m1x_obs_secrecy], auto)\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m1_keydist.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.35577488668296436, "lm_q1q2_score": 0.1820559170524157}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__38_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__38_on_rules imports n_german_lemma_on_inv__38\nbegin\nsection{*All lemmas on causal relation between inv__38*}\nlemma lemma_inv__38_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__38) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__38_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.34510526422232046, "lm_q1q2_score": 0.18197970812970093}} {"text": "(* Title: HOL/Auth/flash_data_cub_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_on_inis imports flash_data_cub_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (f=inv__3 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\\\n (f=inv__8 )\\\n (f=inv__9 )\\\n (f=inv__10 )\\\n (f=inv__11 )\\\n (f=inv__12 )\\\n (f=inv__13 )\\\n (f=inv__14 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (f=inv__22 )\\\n (f=inv__23 )\\\n (f=inv__24 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\\\n (f=inv__26 )\\\n (f=inv__27 )\\\n (f=inv__28 )\\\n (f=inv__29 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__32 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (f=inv__35 )\\\n (f=inv__36 )\\\n (f=inv__37 )\\\n (f=inv__38 )\\\n (f=inv__39 )\\\n (f=inv__40 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\\\n (f=inv__42 )\\\n (f=inv__43 )\\\n (f=inv__44 )\\\n (f=inv__45 )\\\n (f=inv__46 )\\\n (f=inv__47 )\\\n (f=inv__48 )\\\n (f=inv__49 )\\\n (f=inv__50 )\\\n (f=inv__51 )\\\n (f=inv__52 )\\\n (f=inv__53 )\\\n (f=inv__54 )\\\n (f=inv__55 )\\\n (f=inv__56 )\\\n (f=inv__57 )\\\n (f=inv__58 )\\\n (f=inv__59 )\\\n (f=inv__60 )\\\n (f=inv__61 )\\\n (f=inv__62 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__63 p__Inv4)\\\n (f=inv__64 )\\\n (f=inv__65 )\\\n (f=inv__66 )\\\n (f=inv__67 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__68 p__Inv4)\\\n (f=inv__69 )\\\n (f=inv__70 )\\\n (f=inv__71 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__72 p__Inv4)\\\n (f=inv__73 )\\\n (f=inv__74 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__75 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__76 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__79 p__Inv4)\\\n (f=inv__80 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\\\n (f=inv__82 )\\\n (f=inv__83 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\\\n (f=inv__85 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__86 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__87 p__Inv4)\\\n (f=inv__88 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__90 p__Inv4)\\\n (f=inv__91 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__92 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__93 p__Inv4)\\\n (f=inv__94 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__95 p__Inv4)\\\n (f=inv__96 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__97 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__98 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__101 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__102 p__Inv4)\\\n (f=inv__103 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__104 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\\\n (f=inv__109 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\\\n (f=inv__111 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__113 p__Inv4)\\\n (f=inv__114 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\\\n (f=inv__117 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__118 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__119 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__120 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__122 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__123 p__Inv4)\\\n (f=inv__124 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__127 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__130 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__133 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__134 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__135 p__Inv4)\\\n (f=inv__136 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__137 p__Inv4)\\\n (f=inv__138 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\\\n (f=inv__140 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\\\n (f=inv__142 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__143 p__Inv4)\\\n (f=inv__144 )\\\n (f=inv__145 )\\\n (f=inv__146 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__147 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__148 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__151 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__152 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__153 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__154 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__155 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__156 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__157 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\\\n (f=inv__160 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__161 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__162 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__3 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__8 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__9 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__10 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__11 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__12 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__13 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__14 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__22 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__23 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__24 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__26 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__27 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__28 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__29 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__32 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__35 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__36 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__37 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__38 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__39 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__40 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__41 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__42 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__43 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__44 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__45 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__46 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__47 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__48 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__49 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__50 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__51 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__52 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__53 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__53)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__54 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__54)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__55 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__55)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__56 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__56)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__57 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__57)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__58 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__58)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__59 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__59)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__60 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__60)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__61 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__61)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__62 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__62)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__63 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__63)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__64 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__64)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__65 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__65)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__66 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__66)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__67 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__67)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__68 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__68)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__69 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__69)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__70 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__70)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__71 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__71)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__72 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__72)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__73 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__73)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__74 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__74)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__75 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__75)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__76 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__76)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__77)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__78)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__79 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__79)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__80 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__80)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__81)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__82 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__82)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__83 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__83)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__84)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__85 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__85)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__86 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__86)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__87 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__87)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__88 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__88)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__89)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__90 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__90)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__91 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__91)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__92 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__92)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__93 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__93)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__94 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__94)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__95 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__95)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__96 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__96)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__97 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__97)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__98 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__98)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__99)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__100)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__101 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__101)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__102 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__102)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__103 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__103)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__104 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__104)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__105)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__106)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__107)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__108)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__109 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__109)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__110)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__111 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__111)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__112)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__113 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__113)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__114 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__114)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__115)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__116)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__117 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__117)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__118 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__118)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__119 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__119)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__120 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__120)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__121)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__122 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__122)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__123 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__123)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__124 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__124)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__125)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__126)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__127 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__127)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__128)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__129)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__130 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__130)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__131)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__132)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__133 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__133)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__134 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__134)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__135 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__135)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__136 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__136)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__137 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__137)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__138 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__138)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__139)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__140 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__140)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__141)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__142 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__142)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__143 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__143)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__144 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__144)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__145 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__145)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__146 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__146)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__147 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__147)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__148 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__148)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__149)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__150)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__151 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__151)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__152 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__152)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__153 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__153)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__154 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__154)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__155 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__155)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__156 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__156)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__157 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__157)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__158)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__159)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__160 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__160)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__161 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__161)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__162 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__162)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.29746993014852224, "lm_q1q2_score": 0.1818677486771941}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__16_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__16_on_rules imports n_g2kAbsAfter_lemma_on_inv__16\nbegin\nsection{*All lemmas on causal relation between inv__16*}\nlemma lemma_inv__16_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__16 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__16) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__16_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.32766830738621877, "lm_q1q2_score": 0.18168240357392343}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__11_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__11_on_rules imports n_g2kAbsAfter_lemma_on_inv__11\nbegin\nsection{*All lemmas on causal relation between inv__11*}\nlemma lemma_inv__11_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__11 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__11) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__11) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__11_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.32766830738621877, "lm_q1q2_score": 0.18168239874923292}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n Retype refinement\n*)\n\ntheory Retype_R\nimports VSpace_R\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n APIType_map2 :: \"kernel_object + ARM_HYP_H.object_type \\ Structures_A.apiobject_type\"\nwhere\n \"APIType_map2 ty \\ case ty of\n Inr (APIObjectType ArchTypes_H.Untyped) \\ Structures_A.Untyped\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Structures_A.TCBObject\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Structures_A.EndpointObject\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Structures_A.NotificationObject\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Structures_A.CapTableObject\n | Inr PageTableObject \\ ArchObject PageTableObj\n | Inr PageDirectoryObject \\ ArchObject PageDirectoryObj\n | Inr LargePageObject \\ ArchObject LargePageObj\n | Inr SectionObject \\ ArchObject SectionObj\n | Inr SuperSectionObject \\ ArchObject SuperSectionObj\n | Inl (KOArch (KOASIDPool _)) \\ ArchObject ASIDPoolObj\n\\ \\ | Inl (KOArch (KOVCPU _)) \\ ArchObject ARM_A.VCPUObj\\ \\ \\inl? inr?\\\n | Inr VCPUObject \\ ArchObject ARM_A.VCPUObj \\ \\inl? inr?\\\n | _ \\ ArchObject SmallPageObj\"\n\nlemma placeNewObject_def2:\n \"placeNewObject ptr val gb = createObjects' ptr 1 (injectKO val) gb\"\n apply (clarsimp simp:placeNewObject_def placeNewObject'_def\n createObjects'_def shiftL_nat)\n done\n\nlemma createObjects_ret:\n \"\\n < 2^word_bits;n\\ 0\\ \\\n \\\\\\ createObjects y n ko gbits\n \\\\r s. r = map (\\p. ptr_add y (p * 2 ^ objBitsKO ko * 2 ^ gbits))\n [0..< n]\\\"\n unfolding createObjects_def createObjects'_def\n apply (simp add: split_def)\n apply (wp|simp cong: if_cong)+\n apply (clarsimp simp: ptr_add_def upto_enum_def o_def\n unat_sub word_le_nat_alt\n power_sub[symmetric]\n objBits_def[symmetric]\n simp del: upt_Suc)\n apply (clarsimp simp: unat_of_nat_minus_1 word_bits_def\n shiftl_t2n power_add)\n done\n\nlemma objBitsKO_bounded2[simp]:\n \"objBitsKO ko < word_bits\"\n by (simp add: objBits_simps' word_bits_def vspace_bits_defs vcpu_bits_def archObjSize_def\n split: Structures_H.kernel_object.split arch_kernel_object.split)\n\ndefinition\n APIType_capBits :: \"ARM_HYP_H.object_type \\ nat \\ nat\"\nwhere\n \"APIType_capBits ty us \\ case ty of\n APIObjectType ArchTypes_H.Untyped \\ us\n | APIObjectType ArchTypes_H.TCBObject \\ objBits (makeObject :: tcb)\n | APIObjectType ArchTypes_H.EndpointObject \\ objBits (makeObject :: endpoint)\n | APIObjectType ArchTypes_H.NotificationObject \\ objBits (makeObject :: Structures_H.notification)\n | APIObjectType ArchTypes_H.CapTableObject \\ objBits (makeObject :: cte) + us\n | SmallPageObject \\ pageBitsForSize ARMSmallPage\n | LargePageObject \\ pageBitsForSize ARMLargePage\n | SectionObject \\ pageBitsForSize ARMSection\n | SuperSectionObject \\ pageBitsForSize ARMSuperSection\n | PageTableObject \\ 12\n | PageDirectoryObject \\ 14\n | VCPUObject \\ vcpu_bits\"\n\ndefinition\n makeObjectKO :: \"bool \\ (kernel_object + ARM_HYP_H.object_type) \\ kernel_object\"\nwhere\n \"makeObjectKO dev ty \\ case ty of\n Inl KOUserData \\ Some KOUserData\n | Inl (KOArch (KOASIDPool _)) \\ Some (KOArch (KOASIDPool makeObject))\n | Inl (KOArch (KOVCPU _)) \\ Some (KOArch (KOVCPU makeObject)) \\ \\inl or inr?\\\n | Inr VCPUObject \\ Some (KOArch (KOVCPU makeObject)) \\ \\inl or inr?\\\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Some (KOTCB makeObject)\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Some (KOEndpoint makeObject)\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Some (KONotification makeObject)\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Some (KOCTE makeObject)\n | Inr PageTableObject \\ Some (KOArch (KOPTE makeObject))\n | Inr PageDirectoryObject \\ Some (KOArch (KOPDE makeObject))\n | Inr SmallPageObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | Inr LargePageObject \\ Some(if dev then KOUserDataDevice else KOUserData)\n | Inr SectionObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | Inr SuperSectionObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | _ \\ None\"\n\ntext \\makeObject etc. lemmas\\\n\nlemma NullCap_valid' [iff]: \"s \\' capability.NullCap\"\n unfolding valid_cap'_def by simp\n\nlemma valid_obj_makeObject_cte [simp]:\n \"valid_obj' (KOCTE makeObject) s\"\n unfolding valid_obj'_def valid_cte'_def\n by (clarsimp simp: makeObject_cte)\n\nlemma valid_obj_makeObject_tcb [simp]:\n \"valid_obj' (KOTCB makeObject) s\"\n unfolding valid_obj'_def valid_tcb'_def valid_tcb_state'_def valid_arch_tcb'_def\n by (clarsimp simp: makeObject_tcb makeObject_cte tcb_cte_cases_def minBound_word newArchTCB_def)\n\nlemma valid_obj_makeObject_endpoint [simp]:\n \"valid_obj' (KOEndpoint makeObject) s\"\n unfolding valid_obj'_def valid_ep'_def\n by (clarsimp simp: makeObject_endpoint)\n\nlemma valid_obj_makeObject_notification [simp]:\n \"valid_obj' (KONotification makeObject) s\"\n unfolding valid_obj'_def valid_ntfn'_def\n by (clarsimp simp: makeObject_notification)\n\nlemma valid_obj_makeObject_user_data [simp]:\n \"valid_obj' (KOUserData) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_user_data_device [simp]:\n \"valid_obj' (KOUserDataDevice) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_pte[simp]:\n \"valid_obj' (KOArch (KOPTE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pte)\n\nlemma valid_obj_makeObject_pde[simp]:\n \"valid_obj' (KOArch (KOPDE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pde)\n\nlemma valid_obj_makeObject_asid_pool[simp]:\n \"valid_obj' (KOArch (KOASIDPool makeObject)) s\"\n unfolding valid_obj'_def\n by (simp add: makeObject_asidpool Let_def ran_def dom_def)\n\nlemma valid_obj_makeObject_vcpu[simp]:\n \"valid_obj' (KOArch (KOVCPU makeObject)) s\"\n unfolding valid_obj'_def\n by (simp add: makeObject_vcpu makeVCPUObject_def valid_vcpu'_def)\n\nlemmas valid_obj_makeObject_rules =\n valid_obj_makeObject_user_data valid_obj_makeObject_tcb\n valid_obj_makeObject_endpoint valid_obj_makeObject_notification\n valid_obj_makeObject_cte valid_obj_makeObject_pte valid_obj_makeObject_pde\n valid_obj_makeObject_asid_pool valid_obj_makeObject_user_data_device\n\ntext \\On the abstract side\\\n\ntext \\Lemmas for createNewObjects etc.\\\n\nlemma pspace_dom_upd:\n assumes orth: \"set as \\ dom ps = {}\"\n shows \"pspace_dom (foldr (\\p ps. ps(p \\ ko)) as ps) =\n pspace_dom ps \\ (\\x \\ set as. fst ` obj_relation_cuts ko x)\"\n using orth\n apply (subst foldr_upd_app_if)\n apply (rule set_eqI, simp add: pspace_dom_def)\n apply (rule iffI)\n apply (clarsimp split: if_split_asm)\n apply (rule rev_bexI, erule domI)\n apply (fastforce simp: image_def)\n apply (erule disjE)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule exI)\n apply clarsimp\n apply (intro conjI impI)\n apply (drule equals0D, erule notE, erule IntI, erule domI)\n apply (fastforce simp: image_def)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule(1) notE)\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\ndefinition\n \"new_cap_addrs \\ \\n ptr ko. map (\\p. ptr + ((of_nat p :: word32) << (objBitsKO ko)))\n [0 ..< n]\"\n\ndefinition\n null_filter' :: \"('a \\ cte) \\ ('a \\ cte)\"\nwhere\n \"null_filter' f \\ \\x. if f x = Some (CTE NullCap nullMDBNode) then None else f x\"\n\nlemma across_null_filter_eq':\n assumes eq: \"null_filter' xs = null_filter' ys\"\n shows \"\\ xs x = Some v; ys x = Some v \\ R;\n \\ v = CTE NullCap nullMDBNode; ys x = None \\ \\ R \\\n \\ R\"\n apply (cases \"null_filter' xs x\")\n apply (subgoal_tac \"null_filter' ys x = None\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n apply (subgoal_tac \"null_filter' ys x = Some a\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n done\n\nlemma null_filter_parent_of'':\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ c; c \\ 0 \\\n \\ ys \\ x \\ c\"\n apply (clarsimp simp add: mdb_next_unfold)\n apply (drule arg_cong[where f=\"\\xs. xs x\"])\n apply (simp add: null_filter'_def nullPointer_def split: if_split_asm)\n done\n\nlemma null_filter_parentOf:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x parentOf y \\\n \\ ys \\ x parentOf y\"\n apply (clarsimp simp add: parentOf_def)\n apply (rule across_null_filter_eq'[where x=x], assumption+)\n apply (erule(1) across_null_filter_eq')\n apply clarsimp\n apply simp\n apply simp\n done\n\nlemma null_filter_descendant:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ y \\\n \\ ys \\ x \\ y\"\n apply (erule subtree.induct)\n apply (rule subtree.direct_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n apply (erule subtree.trans_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n done\n\nlemma null_filter_descendants_of':\n \"null_filter' xs = null_filter' ys\n \\ descendants_of' x xs = descendants_of' x ys\"\n apply (simp add: descendants_of'_def)\n apply (rule set_eqI, rule iffI)\n apply simp\n apply (erule(1) null_filter_descendant)\n apply simp\n apply (erule(1) null_filter_descendant[OF sym])\n done\n\nlemma descendants_of_cte_at':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\\n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD2)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\nlemma descendants_of_cte_at2':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\\n \\ cte_wp_at (\\c. c \\ cap.NullCap) x s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\nlemma cte_at_next_slot'':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list s; valid_mdb s; finite_depth (cdt s)\\\n \\ next_slot p (cdt_list s) (cdt s) = Some n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply(simp add: next_slot_def)\n apply(simp split: if_split_asm)\n apply(drule next_childD, simp)\n apply(rule_tac p=n in descendants_of_cte_at2')\n apply(simp add: child_descendant)\n apply(simp)\n apply(subgoal_tac \"next_not_child_dom (p, cdt_list s, cdt s)\")\n prefer 2\n apply(simp add: next_not_child_termination valid_mdb_def valid_list_def)\n apply(simp split: if_split_asm)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n done\n\n\nlemma state_relation_null_filterE:\n \"\\ (s, s') \\ state_relation; t = kheap_update f (ekheap_update ef s);\n \\f' g' h'.\n t' = s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\;\n null_filter (caps_of_state t) = null_filter (caps_of_state s);\n null_filter' (ctes_of t') = null_filter' (ctes_of s');\n pspace_relation (kheap t) (ksPSpace t');\n ekheap_relation (ekheap t) (ksPSpace t');\n ghost_relation (kheap t) (gsUserPages t') (gsCNodes t'); valid_list s;\n pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s;\n pspace_aligned' t'; pspace_distinct' t';\n mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s) \\\n \\ (t, t') \\ state_relation\"\n apply (clarsimp simp: state_relation_def)\n apply (intro conjI)\n apply (simp add: cdt_relation_def cte_wp_at_caps_of_state)\n apply (elim allEI)\n apply clarsimp\n apply (erule(1) across_null_filter_eq)\n apply simp\n apply (rule null_filter_descendants_of', simp)\n apply simp\n apply (case_tac \"cdt s (a, b)\")\n apply (subst mdb_cte_at_no_descendants, assumption)\n apply (simp add: cte_wp_at_caps_of_state swp_def)\n apply (cut_tac s=\"kheap_update f (ekheap_update ef s)\" and\n s'=\"s'\\ksPSpace := f' (ksPSpace s'),\n gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n in pspace_relation_ctes_ofI, simp_all)[1]\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n apply (erule caps_of_state_cteD)\n apply (clarsimp simp: descendants_of'_def)\n apply (case_tac cte)\n apply (erule Null_not_subtree[rotated])\n apply simp\n apply (drule(1) mdb_cte_atD)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply(simp add: cdt_list_relation_def cte_wp_at_caps_of_state)\n apply(elim allEI)\n apply(clarsimp)\n apply(case_tac \"next_slot (a, b) (cdt_list (s)) (cdt s)\")\n apply(simp)\n apply(subgoal_tac \"cte_wp_at (\\c. c \\ cap.NullCap) (a, b) s\")\n apply(drule_tac f=\"\\cs. cs (a, b)\" in arg_cong)\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(clarsimp simp: null_filter_def split: if_split_asm)\n apply(drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply(simp add: null_filter'_def cte_wp_at_ctes_of split: if_split_asm)\n apply(frule pspace_relation_cte_wp_at)\n apply(simp add: cte_wp_at_caps_of_state)\n apply(simp)\n apply(simp)\n apply(simp add: cte_wp_at_ctes_of)\n apply (simp add: mdb_cte_at_def)\n apply(frule finite_depth)\n apply(frule(3) cte_at_next_slot'')\n apply simp\n apply (simp add: revokable_relation_def)\n apply (elim allEI, rule impI, drule(1) mp, elim allEI)\n apply (clarsimp elim!: null_filterE)\n apply (drule(3) pspace_relation_cte_wp_at [OF _ caps_of_state_cteD])\n apply (drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply (clarsimp simp: null_filter'_def cte_wp_at_ctes_of\n split: if_split_asm)\n done\n\nlemma lookupAround2_pspace_no:\n \"is_aligned ptr sz \\\n (case fst (lookupAround2 (ptr + 2 ^ sz - 1) ps) of None \\ return ()\n | Some (x, y) \\ haskell_assert (x < fromPPtr ptr) [])\n = assert ({ptr..ptr + 2 ^ sz - 1} \\ dom ps = {})\"\n apply (simp add: assert_def split: option.split)\n apply safe\n apply (clarsimp simp: lookupAround2_None1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (drule_tac a=a in equals0D)\n apply (simp add: linorder_not_less)\n apply fastforce\n done\n\nlemma pspace_no_overlap_disjoint':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s\\\n \\ {x .. (x && ~~ mask n) + 2 ^ n - 1} \\ dom (ksPSpace s) = {}\"\n unfolding pspace_no_overlap'_def\n apply (rule disjointI)\n apply (rule ccontr)\n apply clarsimp\n apply (elim allE impE notE)\n apply (simp add:field_simps)+\n apply (erule(2) order_trans[OF _ is_aligned_no_overflow,OF _ pspace_alignedD'])\n apply (erule(1) is_aligned_no_overflow[OF pspace_alignedD'])\n apply (erule order_trans)\n apply (simp add:p_assoc_help)\ndone\n\nlemma foldr_update_ko_wp_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"ko_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then P obj\n else ko_wp_at' P p s)\"\n (is \"ko_wp_at' P p ?s' = ?Q\")\n apply (clarsimp simp: ko_wp_at'_def projectKOs al)\n apply (intro conjI impI)\n apply safe[1]\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n apply safe[1]\n apply (simp add: ps_clear_def dom_if_Some)\n apply blast\n apply simp\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n done\n\nlemma foldr_update_obj_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"obj_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then (\\obj'. projectKO_opt obj = Some obj' \\ P obj')\n else obj_at' P p s)\"\n apply (simp only: obj_at'_real_def)\n apply (rule foldr_update_ko_wp_at' [OF pv pv' al])\n done\n\nlemma makeObjectKO_eq:\n assumes x: \"makeObjectKO dev tp = Some v\"\n shows\n \"(v = KOCTE cte) =\n (tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ cte = makeObject)\"\n \"(v = KOTCB tcb) =\n (tp = Inr (APIObjectType ArchTypes_H.TCBObject) \\ tcb = makeObject)\"\n using x\n by (simp add: makeObjectKO_def eq_commute\n split: apiobject_type.split_asm sum.split_asm kernel_object.split_asm\n ARM_HYP_H.object_type.split_asm arch_kernel_object.split_asm)+\n\nlemma pspace_no_overlap_base':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s; is_aligned x n \\ \\ ksPSpace s x = None\"\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule equals0D[where a=x])\n apply (rule ccontr, clarsimp)\n apply (erule is_aligned_get_word_bits)\n apply (erule impE)\n apply (frule mask_out_add_aligned[where q = 0,simplified,symmetric])\n apply (fastforce simp add: is_aligned_no_overflow)\n apply clarsimp+\n done\n\nlemma the_ctes_makeObject:\n \"fst (the (tcb_cte_cases n)) makeObject\n = (if tcb_cte_cases n = None\n then fst (the None :: (Structures_H.tcb \\ cte) \\ ((cte \\ cte) \\ Structures_H.tcb \\ Structures_H.tcb))\n (makeObject :: tcb)\n else makeObject)\"\n apply (simp add: makeObject_tcb)\n apply (clarsimp simp: tcb_cte_cases_def)\n done\n\nlemma cte_wp_at_obj_cases_mask:\n \"cte_wp_at' P p s =\n (obj_at' P p s \\\n (p && mask tcbBlockSizeBits \\ dom tcb_cte_cases\n \\ obj_at' (P \\ fst (the (tcb_cte_cases (p && mask tcbBlockSizeBits))))\n (p && ~~ mask tcbBlockSizeBits) s))\"\n apply (simp add: cte_wp_at_obj_cases')\n apply (rule arg_cong [where f=\"\\x. F \\ x\" for F])\n apply (rule iffI)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (frule(1) tcb_cte_cases_aligned_helpers)\n apply fastforce\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (rule bexI[where x=\"p && mask tcbBlockSizeBits\"])\n apply (clarsimp simp: subtract_mask)\n apply fastforce\n done\n\nlemma ps_clearD:\n \"\\ ps_clear x n s; ksPSpace s y = Some v; x < y; y \\ x + 2 ^ n - 1 \\ \\ False\"\n apply (clarsimp simp: ps_clear_def)\n apply (drule_tac a=y in equals0D)\n apply (simp add: dom_def)\n apply fastforce\n done\n\nlemma cte_wp_at_retype':\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"cte_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ p \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (p && ~~ mask tcbBlockSizeBits \\ set addrs) \\ (p && mask tcbBlockSizeBits \\ dom tcb_cte_cases)\n then P (CTE NullCap nullMDBNode)\n else cte_wp_at' P p s)\"\n (is \"cte_wp_at' P p ?s' = ?Q\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: cte \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: tcb \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"(\\P :: cte \\ bool. obj_at' P p ?s')\n \\ (\\ (\\P :: tcb \\ bool. obj_at' P (p && ~~ mask tcbBlockSizeBits) ?s'))\")\n apply (simp only: cte_wp_at_obj_cases_mask foldr_update_obj_at'[OF pv pv' al])\n apply (simp add: projectKOs the_ctes_makeObject\n makeObjectKO_eq [OF ko]\n makeObject_cte dom_def\n split del: if_split\n cong: if_cong)\n apply (insert al ko)\n apply (simp, safe, simp_all)\n apply fastforce\n apply fastforce\n apply (clarsimp elim!: obj_atE' simp: projectKOs objBits_simps)\n apply (drule ps_clearD[where y=p and n=tcbBlockSizeBits])\n apply simp\n apply (rule order_trans_rules(17))\n apply (clarsimp cong: if_cong)\n apply (rule word_and_le2)\n apply (simp add: word_le_mask_out_plus_2sz)\n apply simp\n apply (clarsimp elim!: obj_atE' simp: pn)\n apply (clarsimp elim!: obj_atE' simp: pn)\n done\n\nlemma ctes_of_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"map_to_ctes (\\ xa. if xa \\ set addrs then Some obj else ksPSpace s xa)\n = (\\x. if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ x \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (x && ~~ mask tcbBlockSizeBits \\ set addrs) \\ (x && mask tcbBlockSizeBits \\ dom tcb_cte_cases)\n then Some (CTE NullCap nullMDBNode)\n else map_to_ctes (ksPSpace s) x)\"\n (is \"map_to_ctes ?ps' = ?map'\")\n using cte_wp_at_retype' [where P=\"(=) cte\" for cte, OF ko pv pv' al pn]\n arg_cong [where f=Not, OF cte_wp_at_retype' [OF ko pv pv' al pn, where P=\"\\\"]]\n apply (simp(no_asm_use) add: cte_wp_at_ctes_of cong: if_cong)\n apply (rule ext)\n apply (case_tac \"map_to_ctes ?ps' x\")\n apply (simp(no_asm_simp))\n apply (simp split: if_split_asm)\n apply simp\n done\n\nlemma None_ctes_of_cte_at:\n \"(None = ctes_of s x) = (\\ cte_at' x s)\"\n by (fastforce simp add: cte_wp_at_ctes_of)\n\nlemma null_filter_ctes_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"null_filter' (map_to_ctes (foldr (\\addr. data_map_insert addr obj) addrs (ksPSpace s)))\n = null_filter' (map_to_ctes (ksPSpace s))\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (subst ctes_of_retype[OF ko pv pv' al pn])\n apply (rule ext)\n apply (clarsimp simp: null_filter'_def None_ctes_of_cte_at)\n apply (intro conjI impI notI)\n apply (elim cte_wp_atE' disjE conjE)\n apply (simp_all add: pn)\n apply (cut_tac x=\"ptr'\" and v=\"if ptr' \\ set addrs then obj else KOTCB tcb\"\n in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (insert ko[symmetric],\n simp add: makeObjectKO_def objBits_simps pn\n split: if_split_asm)[1]\n apply (drule(2) tcb_ctes_clear[where s=\"ksPSpace_update f s\" for f s])\n apply simp\n apply fastforce\n apply (cut_tac x=\"x && ~~ mask tcbBlockSizeBits\" in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (elim cte_wp_atE' disjE conjE)\n apply (insert ko[symmetric], simp add: makeObjectKO_def objBits_simps)\n apply clarsimp\n apply (subst(asm) subtract_mask[symmetric],\n erule_tac v=\"if x \\ set addrs then KOTCB makeObject else KOCTE cte\"\n in tcb_space_clear)\n apply (simp add: is_aligned_mask word_bw_assocs)\n apply assumption\n apply simp\n apply simp\n apply (simp add: pn)\n apply (clarsimp simp: makeObjectKO_def)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (clarsimp simp: pn)\n done\n\nlemma new_cap_addrs_aligned:\n \"\\ is_aligned ptr (objBitsKO ko) \\\n \\ \\x \\ set (new_cap_addrs n ptr ko). is_aligned x (objBitsKO ko)\"\n apply (clarsimp simp: new_cap_addrs_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_shift])\n apply simp\n done\n\nlemma new_cap_addrs_distinct:\n assumes cover: \"range_cover ptr sz (objBitsKO ko) n\"\n shows \"distinct (new_cap_addrs n ptr ko)\"\n unfolding new_cap_addrs_def\n apply (simp add: distinct_map)\n apply (rule comp_inj_on[where f=of_nat, unfolded o_def])\n apply (rule subset_inj_on)\n apply (rule word_unat.Abs_inj_on)\n apply (clarsimp simp only: unats_def atLeastLessThan_iff\n dest!: less_two_pow_divD)\n apply (insert cover)\n apply (erule less_le_trans)\n apply (insert range_cover.range_cover_n_le[OF cover])\n apply (erule le_trans)\n apply (cases \"objBitsKO ko = 0\")\n apply (simp add:word_bits_def)\n apply (rule less_imp_le)\n apply (rule power_strict_increasing)\n apply (simp add:word_bits_def)\n apply simp\n apply (rule inj_onI)\n apply clarsimp\n apply (drule arg_cong[where f=\"\\x. x >> objBitsKO ko\"])\n apply (cases \"objBitsKO ko = 0\")\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply assumption\n done\n\nlemma new_cap_addrs_subset:\n assumes range_cover:\"range_cover ptr sz (objBitsKO ko) n\"\n shows \"set (new_cap_addrs n ptr ko) \\ {ptr .. ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n apply (clarsimp simp add: new_cap_addrs_def shiftl_t2n\n field_simps\n dest!: less_two_pow_divD)\n apply (intro conjI)\n apply (insert range_cover)\n apply (rule machine_word_plus_mono_right_split[OF range_cover.range_cover_compare])\n apply assumption\n apply simp\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:ptr_add_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (drule(1) range_cover.range_cover_compare)\n apply (rule iffD1[OF le_m1_iff_lt,THEN iffD2])\n using range_cover\n apply (simp add: p2_gt_0 range_cover_def word_bits_def)\n apply (rule iffD2[OF word_less_nat_alt])\n apply (rule le_less_trans[OF unat_plus_gt])\n using range_cover\n apply (clarsimp simp: range_cover_def)\n apply (insert range_cover)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def)+\ndone\n\ndefinition\n obj_relation_retype :: \"Structures_A.kernel_object \\\n Structures_H.kernel_object \\ bool\"\nwhere\n \"obj_relation_retype ko ko' \\\n obj_bits ko \\ objBitsKO ko'\n \\ (\\p. fst ` obj_relation_cuts ko p\n = {p + x * 2 ^ (objBitsKO ko') | x. x < 2 ^ (obj_bits ko - objBitsKO ko')}\n \\ (\\x \\ obj_relation_cuts ko p. snd x ko ko'))\"\n\nlemma obj_relation_retype_cutsD:\n \"\\ (x, P) \\ obj_relation_cuts ko p; obj_relation_retype ko ko' \\\n \\ \\y. x = p + y * 2 ^ (objBitsKO ko') \\ y < 2 ^ (obj_bits ko - objBitsKO ko')\n \\ P ko ko'\"\n apply (clarsimp simp: obj_relation_retype_def)\n apply (drule spec[where x=p])\n apply clarsimp\n apply (drule(1) bspec)\n apply (drule arg_cong[where f=\"\\S. x \\ S\"])\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\nlemma APIType_map2_Untyped[simp]:\n \"(APIType_map2 tp = Structures_A.Untyped)\n = (tp = Inr (APIObjectType ArchTypes_H.Untyped))\"\n by (simp add: APIType_map2_def\n split: sum.split object_type.split kernel_object.split arch_kernel_object.splits\n apiobject_type.split)\n\nlemma obj_relation_retype_leD:\n \"\\ obj_relation_retype ko ko' \\\n \\ objBitsKO ko' \\ obj_bits ko\"\n by (simp add: obj_relation_retype_def)\n\nlemma obj_relation_retype_default_leD:\n \"\\ obj_relation_retype (default_object (APIType_map2 ty) dev us) ko;\n ty \\ Inr (APIObjectType ArchTypes_H.Untyped) \\\n \\ objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n by (simp add: obj_relation_retype_def objBits_def obj_bits_dev_irr)\n\nlemma makeObjectKO_Untyped:\n \"makeObjectKO dev ty = Some v \\ ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (clarsimp simp: makeObjectKO_def)\n\nlemma obj_relation_cuts_trivial:\n \"ptr \\ fst ` obj_relation_cuts x ptr\"\n apply (case_tac x)\n apply (rename_tac sz cs)\n apply (clarsimp simp:image_def cte_map_def well_formed_cnode_n_def)\n apply (rule_tac x = \"replicate sz False\" in exI)\n apply clarsimp+\n apply (rename_tac arch_kernel_obj)\n apply (case_tac arch_kernel_obj)\n apply clarsimp\n apply (simp_all add:image_def pageBits_def)\n apply (rule_tac x = 0 in exI, simp)+\n apply (rule p2_gt_0[THEN iffD2])\n apply (rename_tac vmpage_size)\n apply (case_tac vmpage_size)\n apply (clarsimp simp:pageBitsForSize_def)+\n done\n\nlemma obj_relation_retype_addrs_eq:\n assumes not_unt:\"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n assumes amp: \"m = 2^ ((obj_bits_api (APIType_map2 ty) us) - (objBitsKO ko)) * n\"\n assumes orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n shows \"\\ range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n \\ \\\n (\\x \\ set (retype_addrs ptr (APIType_map2 ty) n us).\n fst ` obj_relation_cuts (default_object (APIType_map2 ty) dev us) x)\n = set (new_cap_addrs m ptr ko)\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: retype_addrs_def)\n apply (rename_tac p a b)\n apply (drule obj_relation_retype_cutsD[OF _ orr])\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (clarsimp simp: new_cap_addrs_def image_def\n dest!: less_two_pow_divD)\n apply (rule_tac x=\"p * 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) + unat y\"\n in rev_bexI)\n apply (simp add: amp obj_bits_api_default_object not_unt obj_bits_dev_irr)\n apply (rule less_le_trans[OF nat_add_left_cancel_less[THEN iffD2]])\n apply (erule unat_mono)\n apply (subst unat_power_lower)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def\n split: Structures_A.apiobject_type.splits)\n apply (simp add:field_simps,subst mult_Suc[symmetric])\n apply (rule mult_le_mono1)\n apply simp\n apply (simp add: ptr_add_def shiftl_t2n field_simps\n objBits_def[symmetric] word_unat_power[symmetric])\n apply (simp add: power_add[symmetric])\n apply (clarsimp simp: new_cap_addrs_def retype_addrs_def\n dest!: less_two_pow_divD)\n apply (rename_tac p)\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (cut_tac obj_relation_retype_leD[OF orr])\n apply (case_tac \"n = 0\")\n apply (simp add:amp)\n apply (case_tac \"p = 0\")\n apply simp\n apply (rule_tac x = 0 in rev_bexI)\n apply simp+\n apply (rule obj_relation_cuts_trivial)\n apply (rule_tac x=\"p div (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko))\"\n in rev_bexI)\n apply (simp add:amp)\n apply (rule td_gal_lt[THEN iffD1])\n apply (simp add:field_simps)+\n using orr\n apply (clarsimp simp: obj_relation_retype_def ptr_add_def)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule_tac x=\"of_nat (p mod (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko)))\" in exI)\n apply (simp only: word_unat_power Abs_fnat_homs shiftl_t2n)\n apply (rule conjI)\n apply (rule arg_cong[where f=of_nat])\n apply (subst mult_div_rearrange)\n apply simp\n apply (subst minus_mod_eq_mult_div[symmetric])\n apply (simp add:diff_mult_distrib2)\n apply (rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def obj_bits_api_default_object obj_bits_dev_irr\n not_unt word_bits_def)+\ndone\n\nlemma objBits_le_obj_bits_api:\n \"makeObjectKO dev ty = Some ko \\\n objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n apply (case_tac ty)\n apply (auto simp: default_arch_object_def vspace_bits_defs vcpu_bits_def archObjSize_def\n makeObjectKO_def objBits_simps' APIType_map2_def obj_bits_api_def slot_bits_def\n split: Structures_H.kernel_object.splits arch_kernel_object.splits object_type.splits\n Structures_H.kernel_object.splits arch_kernel_object.splits apiobject_type.splits)\n done\n\n\nlemma obj_relation_retype_other_obj:\n \"\\ is_other_obj_relation_type (a_type ko); other_obj_relation ko ko' \\\n \\ obj_relation_retype ko ko'\"\n apply (simp add: obj_relation_retype_def)\n apply (subgoal_tac \"objBitsKO ko' = obj_bits ko\")\n apply (clarsimp simp: is_other_obj_relation_type)\n apply (fastforce simp: other_obj_relation_def objBits_simps' archObjSize_def\n split: Structures_A.kernel_object.split_asm\n Structures_H.kernel_object.split_asm\n Structures_H.kernel_object.split\n arch_kernel_obj.split_asm arch_kernel_object.split)\n done\n\nlemma retype_pspace_relation:\n assumes sr: \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"pspace_relation (foldr (\\p ps. ps(p \\ default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"pspace_relation ?ps ?ps'\")\n unfolding pspace_relation_def\nproof\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n\n have dom_not_ra:\n \"\\x \\ dom (kheap s). x \\ set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply clarsimp\n apply (erule(1) pspace_no_overlapC[OF pn _ _ cover vs(1)])\n done\n\n hence dom_Int_ra:\n \"set (retype_addrs ptr (APIType_map2 ty) n us) \\ dom (kheap s) = {}\"\n by auto\n\n note pdom = pspace_dom_upd [OF dom_Int_ra, where ko=\"default_object (APIType_map2 ty) dev us\"]\n\n have pdom': \"dom ?ps' = dom (ksPSpace s') \\ set (new_cap_addrs m ptr ko)\"\n by (clarsimp simp add: foldr_upd_app_if[folded data_map_insert_def]\n dom_if_Some Un_commute\n split del: if_split)\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n\n have \"pspace_dom (kheap s) = dom (ksPSpace s')\"\n using sr by (simp add: pspace_relation_def)\n\n thus \"pspace_dom ?ps = dom ?ps'\"\n apply (simp add: pdom pdom')\n apply (rule arg_cong[where f=\"\\T. S \\ T\" for S])\n apply (rule obj_relation_retype_addrs_eq[OF not_unt num_r orr cover])\n done\n\n have dom_same:\n \"\\x v. kheap s x = Some v \\ ?ps x = Some v\"\n apply (frule bspec [OF dom_not_ra, OF domI])\n apply (simp add: foldr_upd_app_if)\n done\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have dom_same':\n \"\\x v. ksPSpace s' x = Some v \\ ?ps' x = Some v\"\n apply (clarsimp simp:foldr_upd_app_if[folded data_map_insert_def])\n apply (drule domI[where m = \"ksPSpace s'\"])\n apply (drule(1) IntI)\n apply (erule_tac A = \"A \\ B\" for A B in in_emptyE[rotated])\n apply (rule disjoint_subset[OF new_cap_addrs_subset[OF cover']])\n apply (clarsimp simp:ptr_add_def field_simps)\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n done\n\n show \"\\x \\ dom ?ps. \\(y, P) \\ obj_relation_cuts (the (?ps x)) x.\n P (the (?ps x)) (the (?ps' y))\"\n using sr\n apply (clarsimp simp: pspace_relation_def)\n apply (simp add: foldr_upd_app_if split: if_split_asm)\n apply (clarsimp simp: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule conjI)\n apply (drule obj_relation_retype_cutsD [OF _ orr], clarsimp)\n apply (rule impI, erule notE)\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (erule rev_bexI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n apply (drule bspec, erule domI)\n apply clarsimp\n apply (drule(1) bspec, simp)\n apply (subgoal_tac \"a \\ pspace_dom (kheap s)\")\n apply clarsimp\n apply (frule dom_same', simp)\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n done\nqed\n\n\n(*Clagged from Retype_AC*)\nlemma foldr_upd_app_if': \"foldr (\\p ps. ps(p := f p)) as g = (\\x. if x \\ set as then (f x) else g x)\"\n apply (induct as)\n apply simp\n apply simp\n apply (rule ext)\n apply simp\n done\n\nlemma etcb_rel_makeObject: \"etcb_relation default_etcb makeObject\"\n apply (simp add: etcb_relation_def default_etcb_def)\n apply (simp add: makeObject_tcb default_priority_def default_domain_def)\n done\n\n\nlemma ekh_at_tcb_at: \"valid_etcbs_2 ekh kh \\ ekh x = Some y \\ \\tcb. kh x = Some (TCB tcb)\"\n apply (simp add: valid_etcbs_2_def\n st_tcb_at_kh_def obj_at_kh_def\n is_etcb_at'_def obj_at_def)\n apply force\n done\n\nlemma default_etcb_default_domain_futz [simp]:\n \"default_etcb\\tcb_domain := default_domain\\ = default_etcb\"\nunfolding default_etcb_def by simp\n\nlemma retype_ekheap_relation:\n assumes sr: \"ekheap_relation (ekheap s) (ksPSpace s')\"\n and sr': \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"ekheap_relation (foldr (\\p ps. ps(p := default_ext (APIType_map2 ty) default_domain))\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"ekheap_relation ?ps ?ps'\")\n proof -\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n show ?thesis\n apply (case_tac \"ty \\ Inr (APIObjectType apiobject_type.TCBObject)\")\n apply (insert ko)\n apply (cut_tac retype_pspace_relation[OF sr' vs vs' pn pn' ko cover orr num_r])\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (insert sr)\n apply (clarsimp simp add: ekheap_relation_def\n pspace_relation_def default_ext_def cong: if_cong\n split: if_split_asm)\n subgoal by (clarsimp simp add: makeObjectKO_def APIType_map2_def cong: if_cong\n split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits ARM_HYP_H.object_type.splits apiobject_type.splits)\n\n apply (frule ekh_at_tcb_at[OF et])\n apply (intro impI conjI)\n apply clarsimp\n apply (drule_tac x=a in bspec,force)\n apply (clarsimp simp add: other_obj_relation_def split: if_split_asm)\n apply (case_tac ko,simp_all)\n apply (clarsimp simp add: makeObjectKO_def cong: if_cong split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits ARM_HYP_H.object_type.splits\n apiobject_type.splits if_split_asm)\n apply (drule_tac x=xa in bspec,simp)\n subgoal by force\n subgoal by force\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (clarsimp simp add: APIType_map2_def default_ext_def ekheap_relation_def\n default_object_def makeObjectKO_def etcb_rel_makeObject\n cong: if_cong\n split: if_split_asm)\n apply force\n done\nqed\n\nlemma pspace_no_overlapD':\n \"\\ ksPSpace s x = Some ko; pspace_no_overlap' p bits s \\\n \\ {x .. x + 2 ^ objBitsKO ko - 1} \\ {p .. (p && ~~ mask bits) + 2 ^ bits - 1} = {}\"\n apply (simp add:pspace_no_overlap'_def)\n apply (intro impI)\n apply (elim allE impE)\n apply (simp add:field_simps)+\ndone\n\nlemma new_range_subset:\n assumes\n cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and addr: \"x \\ set (new_cap_addrs n ptr ko)\"\n shows \"{x .. x + 2 ^ (objBitsKO ko) - 1} \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n (is \"?lhs \\ ?rhs\")\nproof -\n have base_in: \"x \\ {ptr..ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n by (rule set_mp[OF new_cap_addrs_subset[OF cover] addr])\n have aligned: \"is_aligned x (objBitsKO ko)\"\n apply (insert cover)\n apply (clarsimp simp:range_cover_def)\n apply (drule new_cap_addrs_aligned)\n apply (erule bspec[OF _ addr])\n done\n show ?thesis using base_in aligned addr\n apply (intro range_subsetI)\n apply (clarsimp simp:ptr_add_def field_simps)+\n apply (simp add:x_power_minus_1)\n apply (clarsimp simp:new_cap_addrs_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (simp add:mask_2pm1[symmetric])\n apply (rule iffD2[OF shiftr_mask_cmp[where c = \"objBitsKO ko\"]])\n apply (insert cover)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def word_bits_def)\n apply (subst aligned_shift')\n apply (simp add:mask_lt_2pn range_cover_def word_bits_def )\n apply (drule is_aligned_addD1)\n apply (simp add:range_cover_def)\n apply (rule aligned_add_aligned)\n apply (rule aligned_already_mask)\n apply (fastforce simp:range_cover_def)\n apply (simp_all add: range_cover_def)[3]\n apply (subst shiftr_mask2[symmetric])\n apply (simp add:range_cover_def word_bits_def)\n apply (rule le_shiftr)\n apply (subst le_mask_iff_lt_2n[THEN iffD1])\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:word_less_nat_alt)\n apply (rule le_less_trans[OF unat_plus_gt])\n apply (frule(1) range_cover.range_cover_compare)\n apply (clarsimp simp:shiftl_t2n mult.commute range_cover_def)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask])\n apply (rule le_refl)\n apply (simp add:range_cover_def)\n done\nqed\n\nlemma retype_aligned_distinct':\n assumes vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n \"\n shows\n \"pspace_distinct' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n \"pspace_aligned' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n (is \"pspace_aligned' (s'\\ksPSpace := ?ps\\)\")\nproof -\n have al: \"is_aligned ptr (objBitsKO ko)\"\n using cover\n by (simp add:cover range_cover_def)\n let ?s' = \"s'\\ksPSpace := ?ps\\\"\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al]]\n note nc_al' = nc_al[unfolded objBits_def]\n\n show pa': \"pspace_aligned' ?s'\" using vs'(1)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (clarsimp simp add: pspace_aligned'_def nc_al'\n split: if_split_asm)\n apply (drule bspec, erule domI, simp)\n done\n\n have okov: \"objBitsKO ko < word_bits\"\n by (simp add: objBits_def)\n\n have new_range_disjoint:\n \"\\x. x \\ set (new_cap_addrs n ptr ko) \\\n ({x .. x + 2 ^ (objBitsKO ko) - 1} - {x}) \\ set (new_cap_addrs n ptr ko) = {}\"\n apply safe\n apply (rule ccontr)\n apply (frule(2) aligned_neq_into_no_overlap [OF _ nc_al nc_al])\n apply (drule_tac a=xa in equals0D)\n apply (clarsimp simp: field_simps is_aligned_no_overflow [OF nc_al])\n done\n note new_range_sub = new_range_subset [OF cover]\n\n show pd': \"pspace_distinct' ?s'\" using vs'(2)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: pspace_distinct'_def dom_if_Some ball_Un)\n apply (intro conjI ballI impI)\n apply (simp add: ps_clear_def dom_if_Some Int_Un_distrib\n objBits_def[symmetric])\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (subst Int_commute)\n apply (rule disjoint_subset[OF new_cap_addrs_subset,OF cover])\n apply (subst Int_commute)\n apply (simp add:ptr_add_def field_simps)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule pspace_no_overlapD' [OF _ pn'])\n done\nqed\n\ndefinition\n update_gs :: \"Structures_A.apiobject_type \\ nat \\ word32 set\n \\ 'a kernel_state_scheme \\ 'a kernel_state_scheme\"\nwhere\n \"update_gs ty us ptrs \\\n case ty of\n Structures_A.CapTableObject \\ gsCNodes_update\n (\\cns x. if x \\ ptrs then Some us else cns x)\n | ArchObject (SmallPageObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSmallPage else ups x)\n | ArchObject (LargePageObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMLargePage else ups x)\n | ArchObject (SectionObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSection else ups x)\n | ArchObject (SuperSectionObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSuperSection else ups x)\n | _ \\ id\"\n\nlemma ksPSpace_update_gs_eq[simp]:\n \"ksPSpace (update_gs ty us ptrs s) = ksPSpace s\"\n by (simp add: update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nend\n\nglobal_interpretation update_gs: PSpace_update_eq \"update_gs ty us ptrs\"\n by (simp add: PSpace_update_eq_def)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma update_gs_id:\n \"tp \\ no_gs_types \\ update_gs tp us addrs = id\"\n by (simp add: no_gs_types_def update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nlemma update_gs_simps[simp]:\n \"update_gs Structures_A.apiobject_type.CapTableObject us ptrs =\n gsCNodes_update (\\cns x. if x \\ ptrs then Some us else cns x)\"\n \"update_gs (ArchObject SmallPageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSmallPage else ups x)\"\n \"update_gs (ArchObject LargePageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMLargePage else ups x)\"\n \"update_gs (ArchObject SectionObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSection else ups x)\"\n \"update_gs (ArchObject SuperSectionObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSuperSection\n else ups x)\"\n by (simp_all add: update_gs_def)\n\nlemma retype_state_relation:\n notes data_map_insert_def[simp del]\n assumes sr: \"(s, s') \\ state_relation\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\" \"valid_list s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and api: \"obj_bits_api (APIType_map2 ty) us \\ sz\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"(ekheap_update\n (\\_. foldr (\\p ekh a. if a = p then default_ext (APIType_map2 ty) default_domain else ekh a)\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n s\n \\kheap :=\n foldr (\\p. data_map_insert p (default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s)\\,\n update_gs (APIType_map2 ty) us (set (retype_addrs ptr (APIType_map2 ty) n us))\n (s'\\ksPSpace :=\n foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko)\n (ksPSpace s')\\))\n \\ state_relation\"\n (is \"(ekheap_update (\\_. ?eps) s\\kheap := ?ps\\, update_gs _ _ _ (s'\\ksPSpace := ?ps'\\))\n \\ state_relation\")\n proof (rule state_relation_null_filterE[OF sr refl _ _ _ _ _ _ _ vs'], simp_all add: trans_state_update[symmetric] del: trans_state_update)\n\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have al':\"is_aligned ptr (objBitsKO ko)\"\n using cover'\n by (simp add:range_cover_def)\n have sz:\"sz < word_bits\"\n using cover'\n by (simp add:range_cover_def word_bits_def)\n let ?t = \"s\\kheap := ?ps\\\"\n let ?tp = \"APIType_map2 ty\"\n let ?al = \"retype_addrs ptr ?tp n us\"\n let ?t' = \"update_gs ?tp us (set ?al) (s'\\ksPSpace := ?ps'\\)\"\n\n note pad' = retype_aligned_distinct' [OF vs' pn' cover']\n thus pa': \"pspace_aligned' (s'\\ksPSpace := ?ps'\\)\"\n and pd': \"pspace_distinct' (s'\\ksPSpace := ?ps'\\)\"\n by simp_all\n\n note pa'' = pa'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n note pd'' = pd'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n show \"null_filter (caps_of_state ?t) = null_filter (caps_of_state s)\"\n apply (rule null_filter_caps_of_state_foldr[folded data_map_insert_def])\n apply (simp add: not_unt)\n apply (rule ballI)\n apply (erule pspace_no_overlapD2 [OF pn _ cover vs(1)])\n done\n\n have nc_dis: \"distinct (new_cap_addrs m ptr ko)\"\n by (rule new_cap_addrs_distinct [OF cover'])\n\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al']]\n note nc_al' = nc_al[unfolded objBits_def]\n show \"null_filter' (map_to_ctes ?ps') = null_filter' (ctes_of s')\"\n apply (rule null_filter_ctes_retype [OF ko vs' pa'' pd''])\n apply (simp add: nc_al)\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (drule orthD1)\n apply (simp add:ptr_add_def field_simps)\n apply clarsimp\n done\n\n show \"valid_objs s\" using vs\n by (clarsimp simp: valid_pspace_def)\n\n show \"valid_mdb s\" using vs\n by (clarsimp)\n\n show \"valid_list s\" using et\n by (clarsimp)\n\n show \"mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s)\" using vs\n by (clarsimp simp: valid_mdb_def)\n\n have pspr: \"pspace_relation (kheap s) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"pspace_relation ?ps ?ps'\"\n by (rule retype_pspace_relation [OF _ vs vs' pn pn' ko cover orr num_r,\n folded data_map_insert_def])\n\n have \"ekheap_relation (ekheap (s)) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"ekheap_relation ?eps ?ps'\"\n by (fold fun_upd_apply) (rule retype_ekheap_relation[OF _ pspr vs et(1) vs' pn pn' ko cover orr num_r])\n\n have pn2: \"\\a\\set ?al. kheap s a = None\"\n by (rule ccontr) (clarsimp simp: pspace_no_overlapD1[OF pn _ cover vs(1)])\n\n from sr have gr: \"ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\"\n by (rule state_relationE)\n\n show \"ghost_relation ?ps (gsUserPages ?t') (gsCNodes ?t')\"\n proof (cases ?tp)\n case Untyped thus ?thesis by (simp add: not_unt)\n next\n note data_map_insert_def[simp]\n\n case TCBObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def TCBObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def TCBObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap, simp add: TCBObject update_gs_def)\n next\n case EndpointObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: EndpointObject update_gs_def)\n next\n note data_map_insert_def[simp]\n case NotificationObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def NotificationObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def\n default_object_def NotificationObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: NotificationObject update_gs_def)\n next\n case CapTableObject\n note data_map_insert_def[simp]\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def CapTableObject)\n have [simp]: \"cns_of_heap ?ps = (\\x. if x \\ set ?al then Some us\n else cns_of_heap (kheap s) x)\"\n by (rule ext, induct (?al),\n simp_all add: cns_of_heap_def wf_empty_bits wf_unique default_object_def CapTableObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: CapTableObject update_gs_def ext)\n next\n case (ArchObject ao)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def data_map_insert_def\n default_object_def ArchObject)\n from pn2 gr show ?thesis\n apply (clarsimp simp add: ghost_relation_of_heap)\n apply (rule conjI[rotated])\n apply (simp add: ArchObject update_gs_def split: aobject_type.splits)\n apply (thin_tac \"cns_of_heap h = g\" for h g)\n apply (drule sym)\n apply (rule ext)\n apply (induct (?al))\n apply (simp add: update_gs_def ArchObject split: aobject_type.splits)\n apply (simp add: update_gs_def ArchObject default_object_def\n default_arch_object_def ups_of_heap_def\n data_map_insert_def\n split: aobject_type.splits)\n done\n qed\n\n show \"\\f' g' h'. ?t' =\n s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n apply (clarsimp simp: update_gs_def\n split: Structures_A.apiobject_type.splits)\n apply (intro conjI impI)\n apply (subst ex_comm, rule_tac x=id in exI,\n subst ex_comm, rule_tac x=id in exI, fastforce)+\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (subst ex_comm)\n apply (rule_tac x=\"\\cns x. if x\\set ?al then Some us else cns x\" in exI,\n simp)\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI, simp)\n apply clarsimp\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI)\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (simp split: aobject_type.splits)\n apply (intro conjI impI)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSmallPage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMLargePage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSection\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSuperSection\n else cns x\" in exI, simp)\n apply (rule_tac x=id in exI, simp)+\n done\nqed\n\nlemma new_cap_addrs_fold':\n \"1 \\ n \\\n map (\\n. ptr + (n << objBitsKO ko)) [0.e.n - 1] =\n new_cap_addrs (unat n) ptr ko\"\n by (clarsimp simp:new_cap_addrs_def ptr_add_def upto_enum_red'\n shiftl_t2n power_add field_simps)\n\nlemma objBitsKO_gt_0: \"0 < objBitsKO ko\"\n apply (case_tac ko)\n apply (simp_all add:objBits_simps' pageBits_def)\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object)\n apply (simp_all add:archObjSize_def vcpu_bits_def vspace_bits_defs)\n done\n\nlemma kheap_ekheap_double_gets:\n \"(\\rv erv rv'. \\pspace_relation rv rv'; ekheap_relation erv rv'\\\n \\ corres r (R rv erv) (R' rv') (b rv erv) (d rv')) \\\n corres r (\\s. R (kheap s) (ekheap s) s) (\\s. R' (ksPSpace s) s)\n (do x \\ gets kheap; xa \\ gets ekheap; b x xa od) (gets ksPSpace >>= d)\"\n apply (rule corres_symb_exec_l)\n apply (rule corres_guard_imp)\n apply (rule_tac r'= \"\\erv rv'. ekheap_relation erv rv' \\ pspace_relation x rv'\"\n in corres_split)\n apply (subst corres_gets[where P=\"\\s. x = kheap s\" and P'=\\])\n apply clarsimp\n apply (simp add: state_relation_def)\n apply clarsimp\n apply assumption\n apply (wp gets_exs_valid | simp)+\n done\n\n(*\n\nSplit out the extended operation that sets the etcb domains.\n\nThis allows the existing corres proofs in this file to more-or-less go\nthrough as they stand.\n\nA more principled fix would be to change the abstract spec and\ngeneralise init_arch_objects to initialise other object types.\n\n*)\n\ndefinition retype_region2_ext :: \"obj_ref list \\ Structures_A.apiobject_type \\ unit det_ext_monad\" where\n \"retype_region2_ext ptrs type \\ modify (\\s. ekheap_update (foldr (\\p ekh. (ekh(p := default_ext type default_domain))) ptrs) s)\"\n\ncrunch all_but_exst[wp]: retype_region2_ext \"all_but_exst P\"\ncrunch (empty_fail) empty_fail[wp]: retype_region2_ext\n\nend\n\ninterpretation retype_region2_ext_extended: is_extended \"retype_region2_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n \"retype_region2_extra_ext ptrs type \\\n when (type = Structures_A.TCBObject) (do\n cdom \\ gets cur_domain;\n mapM_x (ethread_set (\\tcb. tcb\\tcb_domain := cdom\\)) ptrs\n od)\"\n\ncrunch all_but_exst[wp]: retype_region2_extra_ext \"all_but_exst P\" (wp: mapM_x_wp)\ncrunch (empty_fail) empty_fail[wp]: retype_region2_extra_ext (wp: mapM_x_wp)\n\nend\n\ninterpretation retype_region2_extra_ext_extended: is_extended \"retype_region2_extra_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n retype_region2 :: \"obj_ref \\ nat \\ nat \\ Structures_A.apiobject_type \\ bool \\ (obj_ref list,'z::state_ext) s_monad\"\nwhere\n \"retype_region2 ptr numObjects o_bits type dev \\ do\n obj_size \\ return $ 2 ^ obj_bits_api type o_bits;\n ptrs \\ return $ map (\\p. ptr_add ptr (p * obj_size)) [0..< numObjects];\n when (type \\ Structures_A.Untyped) (do\n kh \\ gets kheap;\n kh' \\ return $ foldr (\\p kh. kh(p \\ default_object type dev o_bits)) ptrs kh;\n do_extended_op (retype_region2_ext ptrs type);\n modify $ kheap_update (K kh')\n od);\n return $ ptrs\n od\"\n\nlemma retype_region_ext_modify_kheap_futz:\n \"(retype_region2_extra_ext ptrs type :: (unit, det_ext) s_monad) >>= (\\_. modify (kheap_update f))\n = (modify (kheap_update f) >>= (\\_. retype_region2_extra_ext ptrs type))\"\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (subst oblivious_modify_swap)\n defer\n apply (simp add: bind_assoc)\n apply (rule oblivious_bind)\n apply simp\n apply (rule oblivious_mapM_x)\n apply (clarsimp simp: ethread_set_def set_eobject_def)\n apply (rule oblivious_bind)\n apply (simp add: gets_the_def)\n apply (rule oblivious_bind)\n apply (clarsimp simp: get_etcb_def)\n apply simp\n apply (simp add: modify_def[symmetric])\ndone\n\nlemmas retype_region_ext_modify_kheap_futz' =\n fun_cong[OF arg_cong[where f=NonDetMonad.bind,\n OF retype_region_ext_modify_kheap_futz[symmetric]], simplified bind_assoc]\n\nlemma foldr_upd_app_if_eta_futz:\n \"foldr (\\p ps. ps(p \\ f p)) as = (\\g x. if x \\ set as then Some (f x) else g x)\"\napply (rule ext)\napply (rule foldr_upd_app_if)\ndone\n\nlemma modify_ekheap_update_comp_futz:\n \"modify (ekheap_update (f \\ g)) = modify (ekheap_update g) >>= (K (modify (ekheap_update f)))\"\nby (simp add: o_def modify_def bind_def gets_def get_def put_def)\n\nlemma mapM_x_modify_futz:\n assumes \"\\ptr\\set ptrs. ekheap s ptr \\ None\"\n shows \"mapM_x (ethread_set F) (rev ptrs) s\n = modify (ekheap_update (foldr (\\p ekh. ekh(p := Some (F (the (ekh p))))) ptrs)) s\" (is \"?lhs ptrs s = ?rhs ptrs s\")\nusing assms\nproof(induct ptrs arbitrary: s)\n case Nil thus ?case by (simp add: mapM_x_Nil return_def simpler_modify_def)\nnext\n case (Cons ptr ptrs s)\n have \"?rhs (ptr # ptrs) s\n = (do modify (ekheap_update (foldr (\\p ekh. ekh(p \\ F (the (ekh p)))) ptrs));\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n by (simp only: foldr_Cons modify_ekheap_update_comp_futz) simp\n also have \"... = (do ?lhs ptrs;\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n apply (rule monad_eq_split_tail)\n apply simp\n apply (rule Cons.hyps[symmetric])\n using Cons.prems\n apply force\n done\n also have \"... = ?lhs (ptr # ptrs) s\"\n apply (simp add: mapM_x_append mapM_x_singleton)\n apply (rule monad_eq_split2[OF refl, where\n P=\"\\s. \\ptr\\set (ptr # ptrs). ekheap s ptr \\ None\"\n and Q=\"\\_ s. ekheap s ptr \\ None\"])\n apply (simp add: ethread_set_def\n assert_opt_def get_etcb_def gets_the_def gets_def get_def modify_def put_def set_eobject_def\n bind_def fail_def return_def split_def\n split: option.splits)\n apply ((wp mapM_x_wp[OF _ subset_refl] | simp add: ethread_set_def set_eobject_def)+)[1]\n using Cons.prems\n apply force\n done\n finally show ?case by (rule sym)\nqed\n\nlemma awkward_fold_futz:\n \"fold (\\p ekh. ekh(p \\ the (ekh p)\\tcb_domain := cur_domain s\\)) ptrs ekh\n = (\\x. if x \\ set ptrs then Some ((the (ekh x))\\tcb_domain := cur_domain s\\) else ekh x)\"\nby (induct ptrs arbitrary: ekh) (simp_all add: fun_eq_iff)\n\nlemma retype_region2_ext_retype_region_ext_futz:\n \"retype_region2_ext ptrs type >>= (\\_. retype_region2_extra_ext ptrs type)\n = retype_region_ext ptrs type\"\nproof(cases type)\n case TCBObject\n have complete_futz:\n \"\\F x. modify (ekheap_update (\\_. F (cur_domain x) (ekheap x))) x = modify (ekheap_update (\\ekh. F (cur_domain x) ekh)) x\"\n by (simp add: modify_def get_def get_etcb_def put_def bind_def return_def)\n have second_futz:\n \"\\f G.\n do modify (ekheap_update f);\n cdom \\ gets (\\s. cur_domain s);\n G cdom\n od =\n do cdom \\ gets (\\s. cur_domain s);\n modify (ekheap_update f);\n G cdom\n od\"\n by (simp add: bind_def gets_def get_def return_def simpler_modify_def)\n from TCBObject show ?thesis\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (clarsimp simp: exec_gets fun_eq_iff)\n apply (subst complete_futz)\n apply (simp add: second_futz[simplified] exec_gets)\n apply (simp add: default_ext_def exec_modify)\n apply (subst mapM_x_modify_futz[where ptrs=\"rev ptrs\", simplified])\n apply (simp add: foldr_upd_app_if_eta_futz)\n apply (simp add: modify_def exec_get put_def o_def)\n apply (simp add: foldr_upd_app_if_eta_futz foldr_conv_fold awkward_fold_futz)\n apply (simp cong: if_cong)\n done\nqed (auto simp: fun_eq_iff retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def\n put_def gets_def get_def bind_def return_def mk_ef_def modify_def foldr_upd_app_if' when_def default_ext_def)\n\nlemma retype_region2_ext_retype_region:\n \"(retype_region ptr numObjects o_bits type dev :: (obj_ref list, det_ext) s_monad)\n = (do ptrs \\ retype_region2 ptr numObjects o_bits type dev;\n retype_region2_extra_ext ptrs type;\n return ptrs\n od)\"\napply (clarsimp simp: retype_region_def retype_region2_def when_def bind_assoc)\n apply safe\n defer\n apply (simp add: retype_region2_extra_ext_def)\napply (subst retype_region_ext_modify_kheap_futz'[simplified bind_assoc])\napply (subst retype_region2_ext_retype_region_ext_futz[symmetric])\napply (simp add: bind_assoc)\ndone\n\nlemma getObject_tcb_gets:\n \"getObject addr >>= (\\x::tcb. gets proj >>= (\\y. G x y))\n = gets proj >>= (\\y. getObject addr >>= (\\x. G x y))\"\nby (auto simp: exec_gets fun_eq_iff intro: bind_apply_cong dest!: in_inv_by_hoareD[OF getObject_inv_tcb])\n\nlemma setObject_tcb_gets_ksCurDomain:\n \"setObject addr (tcb::tcb) >>= (\\_. gets ksCurDomain >>= G)\n = gets ksCurDomain >>= (\\x. setObject addr tcb >>= (\\_. G x))\"\napply (clarsimp simp: exec_gets fun_eq_iff)\napply (rule bind_apply_cong)\n apply simp\napply (drule_tac P1=\"\\cdom. cdom = ksCurDomain x\" in use_valid[OF _ setObject_cd_inv])\napply (simp_all add: exec_gets)\ndone\n\nlemma curDomain_mapM_x_futz:\n \"curDomain >>= (\\cdom. mapM_x (threadSet (F cdom)) addrs)\n = mapM_x (\\addr. curDomain >>= (\\cdom. threadSet (F cdom) addr)) addrs\"\nproof(induct addrs)\n case Nil thus ?case\n by (simp add: curDomain_def mapM_x_def sequence_x_def bind_def gets_def get_def return_def)\nnext\n case (Cons addr addrs)\n have H: \"\\G. do cdom \\ curDomain;\n _ \\ threadSet (F cdom) addr;\n G cdom\n od\n = do cdom \\ curDomain;\n threadSet (F cdom) addr;\n cdom \\ curDomain;\n G cdom\n od\"\n by (simp add: bind_assoc curDomain_def threadSet_def setObject_tcb_gets_ksCurDomain\n getObject_tcb_gets double_gets_drop_regets)\n from Cons.hyps show ?case\n apply (simp add: mapM_x_def sequence_x_def)\n apply (simp add: bind_assoc foldr_map o_def)\n apply (subst H)\n apply (simp add: mapM_x_def sequence_x_def)\n done\nqed\n\n(*\n\nThe existing proof continues below.\n\n*)\n\nlemma modify_ekheap_update_ekheap:\n \"modify (\\s. ekheap_update f s) = do s \\ gets ekheap; modify (\\s'. s'\\ekheap := f s\\) od\"\nby (simp add: modify_def gets_def get_def put_def bind_def return_def split_def fun_eq_iff)\n\nlemma corres_retype':\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"(sz < obj_bits_api (APIType_map2 ty) us)\n = (sz < objBitsKO ko + gbits)\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (update_gs (APIType_map2 ty) us (set addrs));\n return (g addrs) od)\"\n (is \"corres ?r ?P ?P' ?C ?A\")\nproof -\n note data_map_insert_def[simp del]\n have not_zero':\"((of_nat n)::word32) \\ 0\"\n by (rule range_cover_not_zero[OF not_zero cover])\n have shiftr_not_zero:\" ((of_nat n)::word32) << gbits \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_zero cover])\n apply (simp add:obj_bits_api)\n done\n have unat_of_nat_shift:\"unat (((of_nat n)::word32) << gbits) =\n (n * 2^ gbits)\"\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_shift':\n \"unat (((of_nat n)::word32) * 2^(gbits + objBitsKO ko)) =\n n * 2^(gbits + objBitsKO ko)\"\n apply (subst mult.commute)\n apply (simp add:shiftl_t2n[symmetric])\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_n':\n \"unat (((of_nat n)::word32) * 2 ^ (gbits + objBitsKO ko)) \\ 0\"\n by (simp add:unat_of_nat_shift' not_zero)\n have bound:\"obj_bits_api (APIType_map2 ty) us \\ sz\"\n using cover\n by (simp add:range_cover_def)\n have n_estimate: \"n < 2 ^ (word_bits - (objBitsKO ko + gbits))\"\n apply (rule le_less_trans)\n apply (rule range_cover.range_cover_n_le(2)[OF cover])\n apply (rule power_strict_increasing)\n apply (simp add:obj_bits_api ko)\n apply (rule diff_less_mono)\n using cover obj_bits_api\n apply (simp_all add:range_cover_def ko word_bits_def)\n done\n\n have set_retype_addrs_fold:\n \"image (\\n. ptr + 2 ^ obj_bits_api (APIType_map2 ty) us * n)\n {x. x \\ of_nat n - 1} =\n set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply (clarsimp simp: retype_addrs_def image_def Bex_def ptr_add_def\n Collect_eq)\n apply (rule iffI)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"unat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover]\n not_le not_zero\n split: if_split_asm)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"of_nat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover])\n apply (rule nat_le_Suc_less_imp)\n apply (metis le_unat_uoi nat_less_le not_le_imp_less)\n done\n\n have new_caps_adds_fold:\n \"map (\\n. ptr + 2 ^ objBitsKO ko * n) [0.e.2 ^ gbits * of_nat n - 1] =\n new_cap_addrs (2 ^ gbits * n) ptr ko\"\n apply (simp add: new_cap_addrs_def shiftl_t2n)\n apply (subgoal_tac \"1 \\ (2::word32) ^ gbits * of_nat n\")\n apply (simp add: upto_enum_red' o_def)\n apply (rule arg_cong2[where f=map, OF refl])\n apply (rule arg_cong2[where f=upt, OF refl])\n apply (metis mult.commute shiftl_t2n unat_of_nat_shift)\n using shiftr_not_zero\n apply (simp add: shiftl_t2n)\n apply (metis word_less_1 word_not_le)\n done\n\n from aligned\n have al': \"is_aligned ptr (obj_bits_api (APIType_map2 ty) us)\"\n by (simp add: obj_bits_api ko)\n show ?thesis\n apply (simp add: when_def retype_region2_def createObjects'_def\n createObjects_def aligned obj_bits_api[symmetric]\n ko[symmetric] al' shiftl_t2n data_map_insert_def[symmetric]\n is_aligned_mask[symmetric] split_def unless_def\n lookupAround2_pspace_no check\n split del: if_split)\n apply (subst retype_addrs_fold)+\n apply (subst if_P)\n using ko\n apply (clarsimp simp: makeObjectKO_def)\n apply (simp add: bind_assoc retype_region2_ext_def)\n apply (rule corres_guard_imp)\n apply (subst modify_ekheap_update_ekheap)\n apply (simp only: bind_assoc)\n apply (rule kheap_ekheap_double_gets)\n apply (rule corres_symb_exec_r)\n apply (simp add: not_less modify_modify bind_assoc[symmetric]\n obj_bits_api[symmetric] shiftl_t2n upto_enum_red'\n range_cover.unat_of_nat_n[OF cover])\n apply (rule corres_split_nor[OF _ corres_trivial])\n apply (rename_tac x eps ps)\n apply (rule_tac P=\"\\s. x = kheap s \\ eps = ekheap (s) \\ ?P s\" and\n P'=\"\\s. ps = ksPSpace s \\ ?P' s\" in corres_modify)\n apply (simp add: set_retype_addrs_fold new_caps_adds_fold)\n apply (erule retype_state_relation[OF _ _ _ _ _ _ _ _ _ cover _ _ orr],\n simp_all add: ko not_zero obj_bits_api\n bound[simplified obj_bits_api ko])[1]\n apply (clarsimp simp: retype_addrs_fold[symmetric] ptr_add_def upto_enum_red' not_zero'\n range_cover.unat_of_nat_n[OF cover] word_le_sub1\n simp del: word_of_nat_eq_0_iff)\n apply (rule_tac f=g in arg_cong)\n apply clarsimp\n apply wp+\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply (clarsimp|wp)+\n apply (clarsimp split: option.splits)\n apply wpsimp\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply wp\n apply (clarsimp simp:lookupAround2_char1)\n apply wp\n apply (clarsimp simp: obj_bits_api ko)\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (rule_tac x1 = a in ccontr[OF in_empty_interE])\n apply simp\n apply (clarsimp simp: not_less shiftL_nat)\n apply (erule order_trans)\n apply (subst p_assoc_help)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n using cover\n apply -\n apply (rule iffD2[OF word_le_nat_alt])\n apply (subst word_of_nat_minus)\n using not_zero\n apply simp\n apply (rule le_trans[OF unat_plus_gt])\n apply simp\n apply (subst unat_minus_one)\n apply (subst mult.commute)\n apply (rule word_power_nonzero_32)\n apply (rule of_nat_less_pow_32[OF n_estimate])\n apply (simp add:word_bits_def objBitsKO_gt_0 ko)\n apply (simp add:range_cover_def obj_bits_api ko word_bits_def)\n apply (cut_tac not_zero',clarsimp simp:ko)\n apply(clarsimp simp:field_simps ko)\n apply (subst unat_sub[OF word_1_le_power])\n apply (simp add:range_cover_def)\n apply (subst diff_add_assoc[symmetric])\n apply (cut_tac unat_of_nat_n',simp add:ko)\n apply (clarsimp simp: obj_bits_api ko)\n apply (rule diff_le_mono)\n apply (frule range_cover.range_cover_compare_bound)\n apply (cut_tac obj_bits_api unat_of_nat_shift')\n apply (clarsimp simp:add.commute range_cover_def ko)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def domI)+\n done\nqed\n\nlemma createObjects_corres':\n \"\\corres r P P' f (createObjects a b ko d); ko = injectKO val\\\n \\ corres dc P P' f (createObjects' a b ko d)\"\n apply (clarsimp simp:corres_underlying_def createObjects_def return_def)\n apply (rule conjI)\n apply (clarsimp simp:bind_def split_def)\n apply (drule(1) bspec)\n apply (clarsimp simp:image_def)\n apply (drule(1) bspec)\n apply clarsimp\n apply (erule bexI[rotated])\n apply simp\n apply (clarsimp simp:bind_def split_def image_def)\n apply (drule(1) bspec|clarsimp)+\n done\n\nlemmas retype_aligned_distinct'' = retype_aligned_distinct'\n [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\nlemma retype_ko_wp_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"ko_wp_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then P obj\n else ko_wp_at' P p s)\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (rule foldr_update_ko_wp_at' [OF vs])\n apply (simp add: retype_aligned_distinct'' [OF vs pn cover])+\n apply (rule new_cap_addrs_aligned)\n using cover\n apply (simp add:range_cover_def cover)\n done\n\nlemma retype_obj_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then (\\ko. projectKO_opt obj = Some ko \\ P ko)\n else obj_at' P p s)\"\n unfolding obj_at'_real_def\n apply (rule retype_ko_wp_at'[OF vs pn cover])\ndone\n\nlemma retype_obj_at_disj':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (obj_at' P p s \\ p \\ set (new_cap_addrs n ptr obj)\n \\ (\\ko. projectKO_opt obj = Some ko \\ P ko))\"\n apply (simp add: retype_obj_at' [OF vs pn cover])\n apply (safe, simp_all)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover]])\n apply (insert pspace_no_overlap_disjoint' [OF vs(1) pn ])\n apply (clarsimp simp: obj_at'_def)\n apply (rule_tac x1 = p in ccontr[OF in_empty_interE])\n apply (simp add:ptr_add_def p_assoc_help domI)+\n done\n\ndeclare word_unat_power[symmetric,simp]\n\nlemma createObjects_ko_at_strg:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\nproof -\n have shiftr_not_zero:\" 1 \\ ((of_nat n)::word32) << gbits\"\n using range_cover_not_zero_shift[OF not_0 cover,where gbits = gbits]\n apply -\n apply (simp add:word_le_sub1)\n done\n note unat_of_nat_shiftl = range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified]\n note word_of_nat_eq_0_iff[simp del]\n have in_new:\"\\idx offs. \\idx \\ of_nat n - 1;offs<2 ^ gbits\\\n \\ ptr + (idx << objBitsKO ko + gbits) + (offs << objBitsKO ko)\n \\ set (new_cap_addrs (n * 2 ^ gbits) ptr ko)\"\n apply (insert range_cover_not_zero[OF not_0 cover] not_0)\n apply (clarsimp simp:new_cap_addrs_def image_def)\n apply (rule_tac x =\"unat (2 ^ gbits * idx + offs)\" in bexI)\n apply (subst add.commute)\n apply (simp add:shiftl_shiftl[symmetric])\n apply (simp add:shiftl_t2n distrib_left[symmetric])\n apply simp\n apply (rule unat_less_helper)\n apply (rule less_le_trans)\n apply (erule word_plus_strict_mono_right)\n apply (subst distrib_left[where c = \"1 :: 32 word\",symmetric,simplified])\n apply (subst mult.commute[where a = \"2^gbits\"])+\n apply (insert cover)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply (erule order_trans[OF _ word_sub_1_le])\n apply (simp add:range_cover_not_zero[OF not_0 cover])\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(1)])\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper[OF inc_le])\n apply (simp add:word_leq_minus_one_le)\n apply (simp add:word_bits_def)\n apply (rule no_plus_overflow_neg)\n apply (rule less_le_trans[where y = \"of_nat n\"])\n apply unat_arith\n using range_cover.range_cover_n_less[OF cover]\n apply (simp add:word_bits_def)\n apply (subst distrib_left[where c = \"1 :: 32 word\",symmetric,simplified])\n apply (subst mult.commute)\n apply simp\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (simp add:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply unat_arith\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (erule range_cover.range_cover_le_n_less)\n apply (simp add:range_cover.unat_of_nat_n[OF cover])\n apply (simp add: unat_le_helper)\n apply (simp add:word_bits_def)\n apply unat_arith\n done\n show ?thesis\n apply (simp add: split_def createObjects_def lookupAround2_pspace_no\n alignError_def unless_def createObjects'_def)\n apply (rule hoare_pre)\n apply (wp|simp add:data_map_insert_def[symmetric]\n cong: if_cong del: fun_upd_apply data_map_insert_def)+\n apply (wpc|wp|clarsimp simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold'[OF shiftr_not_zero])+\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n using range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified] pi\n apply (simp add: in_new)\n done\nqed\n\nlemma createObjects_ko_at:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\n by (wp createObjects_ko_at_strg[OF cover not_0 pi],fastforce)\n\nlemma createObjects_obj_at:\n fixes ptr :: word32 and val :: \"'a :: pspace_storable\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n and not_0:\"n \\ 0\"\n and pi: \"\\(val::'a). projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n ko gbits \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits.\n obj_at' (\\(x::'a). True) (x + (offs << objBitsKO ko)) s\\\"\n apply (rule exE[OF pi])\n apply (erule_tac val1 = x in\n hoare_post_imp [OF _ createObjects_ko_at [OF cover not_0 ],rotated])\n apply (intro allI ballI impI)\n apply (drule(1) bspec)\n apply (drule spec, drule(1) mp)\n apply (clarsimp elim!: obj_at'_weakenE)\n done\n\n(* until we figure out what we really need of page\n mappings it's just alignment, which, fortunately,\n is trivial *)\nlemma createObjects_aligned:\n assumes al: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and bound :\"n < 2 ^ word_bits\" \"n\\0\"\n and bound':\"objBitsKO ko + gbits < word_bits\"\n shows \"\\\\\\ createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x (objBitsKO ko + gbits)\\\"\n apply (rule hoare_strengthen_post)\n apply (rule createObjects_ret[OF bound])\n apply (clarsimp dest!: less_two_pow_divD)\n apply (rule is_aligned_ptr_add_helper[OF al])\n apply (simp_all add:bound')\n done\n\nlemma createObjects_aligned2:\n \"\\\\s. is_aligned ptr (objBitsKO ko + gbits) \\ n < 2 ^ word_bits \\ n \\ 0\n \\ aln < word_bits\n \\ aln = objBitsKO ko + gbits\\\n createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x aln\\\"\n apply (rule hoare_name_pre_state)\n apply simp\n apply (rule hoare_pre, wp createObjects_aligned, simp_all)\n done\n\nlemma range_cover_n_wb:\n \"range_cover (ptr :: obj_ref) sz us n \\ n < 2 ^ word_bits\"\n apply (rule order_le_less_trans, erule range_cover.range_cover_n_le(2))\n apply (clarsimp simp: range_cover_def)\n apply (simp add: word_bits_def)\n done\n\nlemma createObjects_nonzero:\n assumes not_0: \"n \\ 0\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + bits) n\"\n shows \"\\\\s. ptr \\ 0\\\n createObjects ptr n ko bits\n \\\\rv s. \\p \\ set rv. p \\ 0\\\"\n apply (insert not_0)\n apply (rule hoare_pre)\n apply (rule hoare_gen_asm [where P = \"ptr \\ 0\"])\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (erule is_aligned_get_word_bits,simp_all)\n apply (rule hoare_post_imp [OF _ createObjects_ret])\n apply (simp add: ptr_add_def)\n apply (intro allI impI ballI)\n apply (simp add:power_add[symmetric] mult.assoc)\n apply (drule(1) range_cover_no_0[OF _ cover])\n apply (simp add: objBits_def)\n apply (simp add: range_cover_n_wb[OF cover])\n apply simp\n done\n\nlemma objBits_if_dev:\n \"objBitsKO (if dev then KOUserDataDevice else KOUserData) = pageBits\"\n by (simp add: objBitsKO_def)\n\nlemma cwo_ret:\n assumes cover:\"range_cover ptr sz v n\"\n assumes not_0:\"n\\ 0\"\n shows result: \"\\pspace_no_overlap' ptr sz and valid_pspace' and K (v = 12 + bs)\\\n createObjects ptr n (if dev then KOUserDataDevice else KOUserData) bs\n \\\\rv s. \\x\\set rv. \\p<2 ^ (v - pageBits).\n typ_at' (if dev then UserDataDeviceT else UserDataT) (x + p * 2 ^ pageBits) s\\\"\nproof -\n note create_objs_device = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserDataDevice,simplified]]]\n\n note create_objs_normal = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserData,simplified]]]\n\nshow ?thesis\n apply (cases dev)\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (rule create_objs_device)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n apply (rule hoare_gen_asm[unfolded K_def])\n apply (rule hoare_pre)\n apply (rule create_objs_normal)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n done\nqed\nlemmas capFreeIndex_update_valid_untyped' =\n capFreeIndex_update_valid_cap'[unfolded valid_cap'_def,simplified,THEN conjunct2,THEN conjunct1]\n\nlemma createNewCaps_valid_cap:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n \"\n assumes not_0: \"n \\ 0\"\n assumes ct: \"ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us\"\n \"ty = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits\"\n assumes ptr: \" ptr \\ 0\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createNewCaps ty ptr n us dev\n \\\\r s. (\\cap \\ set r. s \\' cap)\\\"\nproof -\n note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n note if_split_def[split del] = if_splits\n\n show ?thesis\n proof(cases \"Types_H.toAPIType ty\")\n case None thus ?thesis\n using not_0\n apply (clarsimp simp: createNewCaps_def Arch_createNewCaps_def)\n using cover\n apply (simp add: range_cover_def)\n using cover\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def APIType_capBits_def\n split: ARM_HYP_H.object_type.splits)\n \\ \\SmallPageObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply ((wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+)\n apply (simp add:pageBits_def ptr word_bits_def)\n \\ \\LargePageObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n \\ \\SectionObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev vspace_bits_defs ptr range_cover_n_wb)+\n apply (simp add: pageBits_def ptr word_bits_def)\n\n \\ \\SuperSectionObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n \\ \\PageTableObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_table_at'_def\n typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (simp add:objBits_simps archObjSize_def vspace_bits_defs)+\n apply (simp add:range_cover_def word_bits_def)\n apply (rule createObjects_obj_at[where 'a =pte, OF _ not_0])\n apply (simp add:objBits_simps archObjSize_def vspace_bits_defs)+\n apply (simp add: projectKOs projectKO_opt_pte)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def vspace_bits_defs)\n apply clarsimp\n \\ \\PageDirectoryObject\\\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp mapM_x_wp' )\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_directory_at'_def\n typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (simp add:objBits_simps archObjSize_def vspace_bits_defs)+\n apply (simp add:range_cover_def word_bits_def)\n apply (rule createObjects_obj_at [where 'a=pde, OF _ not_0])\n apply (simp add:objBits_simps archObjSize_def vspace_bits_defs)\n apply (simp add: projectKOs projectKO_opt_pde)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def vspace_bits_defs)\n apply simp\n \\ \\VCPUObject\\\n apply (wpsimp wp: hoare_vcg_const_Ball_lift simp: valid_cap'_def capAligned_def n_less_word_bits)+\n apply (simp only: imp_conv_disj typ_at_to_obj_at_arches vcpu_bits_def pageBits_def)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (simp add:objBits_simps archObjSize_def vcpu_bits_def pageBits_def)+\n apply (simp add:range_cover_def word_bits_def)\n apply (rule createObjects_obj_at [where 'a=vcpu, OF _ not_0])\n apply (simp add:objBits_simps archObjSize_def vcpu_bits_def pageBits_def)\n apply (simp add: projectKOs projectKO_opt_pde)\n apply simp\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def vcpu_bits_def pageBits_def)\n apply simp+\n done\n next\n case (Some a) thus ?thesis\n proof(cases a)\n case Untyped with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_HYP_H.toAPIType_def fromIntegral_def\n toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_HYP_H.object_type.splits)\n apply wp\n apply (intro ballI)\n apply (clarsimp simp: image_def upto_enum_red' valid_cap'_def capAligned_def\n split: capability.splits)\n apply (drule word_leq_minus_one_le[rotated])\n apply (rule range_cover_not_zero[OF not_0 cover])\n apply (intro conjI)\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (fastforce simp:range_cover_def word_bits_def)+\n apply (clarsimp simp:valid_untyped'_def ko_wp_at'_def obj_range'_def)\n apply (drule(1) pspace_no_overlapD'[rotated])\n apply (frule(1) range_cover_cell_subset)\n apply (erule disjE)\n apply (drule psubset_imp_subset)\n apply (drule(1) disjoint_subset2[rotated])\n apply (drule(1) disjoint_subset)\n apply (drule(1) range_cover_subset_not_empty)\n apply clarsimp+\n apply blast\n apply (drule(1) range_cover_no_0[OF ptr _ unat_less_helper])\n apply simp\n done\n next\n case TCBObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_HYP_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def curDomain_def\n split: ARM_HYP_H.object_type.splits)\n apply (wp mapM_x_wp' hoare_vcg_const_Ball_lift)+\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a = \"tcb\",OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def APIType_capBits_def objBits_simps\n split: ARM_HYP_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_tcbI)\n done\n next\n case EndpointObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_HYP_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_HYP_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=endpoint, OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def APIType_capBits_def objBits_simps\n split: ARM_HYP_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_epI)\n done\n next\n case NotificationObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_HYP_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_HYP_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=\"notification\", OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def APIType_capBits_def objBits_simps\n split: ARM_HYP_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_ntfnI)\n done\n next\n case CapTableObject with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_HYP_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_HYP_H.object_type.splits)\n apply wp\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def APIType_capBits_def objBits_simps\n split: ARM_HYP_H.object_type.split object_type.splits)\n apply (rule hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ _ not_0 ])\n apply ((clarsimp simp:objBits_simps range_cover_def range_cover.range_cover_n_less[where 'a=32, unfolded word_bits_len_of, OF cover])+)[3]\n apply (simp add: word_bits_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret [OF range_cover.range_cover_n_less(1)[where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (rule createObjects_obj_at [where 'a=cte, OF _ not_0])\n apply (simp add: objBits_simps APIType_capBits_def)\n apply (simp add: projectKOs)\n apply simp\n apply (clarsimp simp: valid_cap'_def capAligned_def objBits_simps\n dest!: less_two_pow_divD)\n apply (thin_tac \"\\x\\S. is_aligned (p x) n\" for S p n)\n apply (intro conjI)\n apply ((simp add:range_cover_def word_bits_def)+)[2]\n apply (clarsimp simp: power_sub)\n apply (drule bspec, simp)\n apply (drule_tac x = \"addr && mask us\" in spec)\n apply (drule mp)\n apply simp\n apply (rule and_mask_less')\n apply (simp add: range_cover_def word_bits_def)\n apply (clarsimp simp add: shiftl_t2n)\n apply simp\n done\n qed\n qed\nqed\n\n\nlemma other_objs_default_relation:\n \"\\ case ty of Structures_A.EndpointObject \\ ko = injectKO (makeObject :: endpoint)\n | Structures_A.NotificationObject \\ ko = injectKO (makeObject :: Structures_H.notification)\n | Structures_A.TCBObject \\ ko = injectKO (makeObject :: tcb)\n | _ \\ False \\ \\\n obj_relation_retype (default_object ty dev n) ko\"\n apply (rule obj_relation_retype_other_obj)\n apply (clarsimp simp: default_object_def\n is_other_obj_relation_type_def\n split: Structures_A.apiobject_type.split_asm)\n apply (clarsimp simp: other_obj_relation_def default_object_def\n ep_relation_def ntfn_relation_def\n tcb_relation_def default_tcb_def makeObject_tcb\n makeObject_cte new_context_def newContext_def\n default_ep_def makeObject_endpoint default_notification_def\n makeObject_notification default_ntfn_def\n fault_rel_optionation_def\n initContext_def\n arch_tcb_context_get_def atcbContextGet_def\n default_arch_tcb_def newArchTCB_def\n arch_tcb_relation_def\n split: Structures_A.apiobject_type.split_asm)\n done\n\nlemma captable_relation_retype:\n \"n < word_bits \\\n obj_relation_retype (default_object Structures_A.CapTableObject dev n) (KOCTE makeObject)\"\n apply (clarsimp simp: obj_relation_retype_def default_object_def\n wf_empty_bits objBits_simps'\n dom_empty_cnode ex_with_length cte_level_bits_def)\n apply (rule conjI)\n defer\n apply (clarsimp simp: cte_relation_def empty_cnode_def makeObject_cte)\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: cte_map_def')\n apply (rule_tac x=\"of_bl y\" in exI)\n apply (simp add: of_bl_length[where 'a=32, folded word_bits_def])\n apply (clarsimp simp: image_def cte_map_def')\n apply (rule_tac x=\"drop (word_bits - n) (to_bl xa)\" in exI)\n apply (simp add: of_drop_to_bl word_bits_def word_size)\n apply (simp add: less_mask_eq)\n done\n\nlemma pagetable_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageTableObj) dev n)\n (KOArch (KOPTE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pte obj_relation_retype_def\n objBits_simps archObjSize_def\n pte_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less vspace_bits_defs)\n apply (fastforce simp:pte_relation_aligned_def)\n done\n\nlemma pagedirectory_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageDirectoryObj) dev n)\n (KOArch (KOPDE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pde obj_relation_retype_def\n objBits_simps archObjSize_def\n pde_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less vspace_bits_defs)\n apply (fastforce simp:pde_relation_aligned_def)\n done\n\nlemmas makeObjectKO_simps = makeObjectKO_def[split_simps ARM_HYP_H.object_type.split\n apiobject_type.split sum.split kernel_object.split ]\n\nlemma corres_retype:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us = objBitsKO ko + gbits\"\n and tp: \"APIType_map2 ty \\ no_gs_types\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (=)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\n \\ (\\val. ko = injectKO val))\n (retype_region2 ptr n us (APIType_map2 ty) dev) (createObjects ptr n ko gbits)\"\n apply (rule corres_guard_imp)\n apply (rule_tac F = \"(\\val. ko = injectKO val)\" in corres_gen_asm2)\n apply (erule exE)\n apply (rule corres_rel_imp)\n apply (rule corres_retype'[where g=id and ty=ty and sz = sz,OF not_zero aligned _ _ _ ko\n ,simplified update_gs_id[OF tp] modify_id_return,simplified])\n using assms\n apply (simp_all add: objBits_def no_gs_types_def)\n apply auto\n done\n\nlemma init_arch_objects_APIType_map2:\n \"init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs =\n (case ty of APIObjectType _ \\ return ()\n | _ \\ init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs)\"\n apply (clarsimp split: ARM_HYP_H.object_type.split)\n apply (simp add: init_arch_objects_def APIType_map2_def\n split: apiobject_type.split)\n done\n\nlemma copyGlobalMappings_corres:\n \"corres dc (valid_arch_state and valid_etcbs and pspace_aligned and page_directory_at pd)\n (valid_arch_state' and page_directory_at' pd)\n (copy_global_mappings pd)\n (copyGlobalMappings pd)\"\n apply (simp add: copy_global_mappings_def\n copyGlobalMappings_def\n objBits_simps archObjSize_def\n pd_bits_def pdBits_def mapM_x_mapM)\n done\n\n(* FIXME: move *)\nlemma copyGlobalMappings_cte_wp_at[wp]:\n \"\\\\s. P (cte_wp_at' P' p s)\\\n copyGlobalMappings pd\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: copyGlobalMappings_def)\n done\n\ncrunch ct[wp]: copyGlobalMappings \"\\s. P (ksCurThread s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\ncrunch ksCurDomain[wp]: copyGlobalMappings \"\\s. P (ksCurDomain s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\nlemmas copyGlobalMappings_ctes_of[wp]\n = ctes_of_from_cte_wp_at[where Q=\"\\\", simplified,\n OF copyGlobalMappings_cte_wp_at]\n\nlemmas object_splits =\n apiobject_type.split_asm\n ARM_HYP_H.object_type.split_asm\n sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n\nlemma ksMachineState_update_gs[simp]:\n \"ksMachineState (update_gs tp us addrs s) = ksMachineState s\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\nlemma update_gs_ksMachineState_update_swap:\n \"update_gs tp us addrs (ksMachineState_update f s) =\n ksMachineState_update f (update_gs tp us addrs s)\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\n\ndeclare hoare_in_monad_post[wp del]\ndeclare univ_get_wp[wp del]\ndeclare result_in_set_wp[wp del]\n\ncrunch valid_arch_state'[wp]: copyGlobalMappings \"valid_arch_state'\"\n (wp: crunch_wps)\n\nlemma nullPointer_0_simp[simp]:\n \"(nullPointer = 0) = True\"\n by (simp add: nullPointer_def)\n\nlemma descendants_of_retype':\n assumes P: \"\\p. P p \\ m p = None\"\n shows \"descendants_of' p (\\p. if P p then Some makeObject else m p) =\n descendants_of' p m\"\n apply (rule set_eqI)\n apply (simp add: descendants_of'_def)\n apply (rule iffI)\n apply (erule subtree.induct)\n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule subtree.induct)\n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n done\n\nlemma capRange_Null [simp]: \"capRange NullCap = {}\"\n by (simp add: capRange_def)\n\nend\n\nlocale retype_mdb = vmdb +\n fixes P n\n assumes P: \"\\p. P p \\ m p = None\"\n assumes 0: \"\\P 0\"\n defines \"n \\ \\p. if P p then Some makeObject else m p\"\nbegin\ninterpretation Arch . (*FIXME: arch_split*)\n\nlemma no_0_n: \"no_0 n\"\n using no_0 by (simp add: no_0_def n_def 0)\n\nlemma n_next:\n \"n \\ c \\ c' = (if P c then c' = 0 else m \\ c \\ c')\"\n by (simp add: mdb_next_unfold n_def makeObject_cte nullPointer_def)\n\nlemma n_prev:\n \"n \\ c \\ c' = (if P c' then c = 0 else m \\ c \\ c')\"\n by (simp add: mdb_prev_def n_def makeObject_cte nullPointer_def)\n\nlemma dlist_n: \"valid_dlist n\"\n using dlist no_0 no_0_n\n apply (simp add: valid_dlist_def2)\n apply (clarsimp simp: n_prev n_next)\n apply (rule conjI)\n apply clarsimp\n apply (erule allE, erule (1) impE)\n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_next_unfold)\n apply clarsimp\n apply (erule allE, erule (1) impE)\n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_prev_def)\n done\n\nlemma n_next_trancl:\n \"n \\ c \\\\<^sup>+ c' \\ (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n apply (insert no_0_n chain)\n apply (erule trancl_induct)\n apply (fastforce simp: n_next)\n apply (simp split: if_split_asm)\n apply (clarsimp simp: mdb_next_unfold)\n apply (simp add: n_next split: if_split_asm)\n apply (simp add: mdb_chain_0_def)\n apply (drule_tac x=c in bspec)\n apply (drule tranclD)\n apply (clarsimp simp: mdb_next_unfold)\n apply assumption\n done\n\nlemma next_not_P:\n \"m \\ c \\ c' \\ \\P c\"\n by (clarsimp simp: mdb_next_unfold dest!: P)\n\nlemma m_next_trancl:\n \"m \\ c \\\\<^sup>+ c' \\ n \\ c \\\\<^sup>+ c'\"\n apply (erule trancl_induct)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n apply (erule trancl_trans)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n done\n\nlemma P_to_0:\n \"P c \\ n \\ c \\\\<^sup>+ 0\"\n by (rule r_into_trancl) (simp add: n_next)\n\nlemma n_trancl_eq:\n \"n \\ c \\\\<^sup>+ c' = (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n by (auto dest: m_next_trancl n_next_trancl P_to_0)\n\nlemma n_rtrancl_eq:\n \"n \\ c \\\\<^sup>* c' = (if P c then c' = 0 \\ c = c' else m \\ c \\\\<^sup>* c')\"\n by (auto simp: n_trancl_eq rtrancl_eq_or_trancl)\n\nlemma dom_n:\n \"dom n = dom m \\ Collect P\"\n by (auto simp add: n_def)\n\nlemma mdb_chain_0_n: \"mdb_chain_0 n\"\n using chain\n by (auto simp: mdb_chain_0_def dom_n n_trancl_eq)\n\nlemma n_Some_eq:\n \"(n p = Some (CTE cap node)) =\n (if P p then cap = NullCap \\ node = nullMDBNode\n else m p = Some (CTE cap node))\"\n by (auto simp: n_def makeObject_cte)\n\nlemma valid_badges_n: \"valid_badges n\"\nproof -\n from valid\n have \"valid_badges m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_badges_def)\n apply (simp add: n_Some_eq n_next split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma caps_contained_n: \"caps_contained' n\"\nproof -\n from valid\n have \"caps_contained' m\" ..\n thus ?thesis\n apply (clarsimp simp: caps_contained'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma mdb_chunked_n: \"mdb_chunked n\"\nproof -\n from valid\n have \"mdb_chunked m\" ..\n thus ?thesis\n apply (clarsimp simp: mdb_chunked_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (simp add: n_Some_eq n_trancl_eq n_rtrancl_eq is_chunk_def)\n apply fastforce\n done\nqed\n\nlemma descendants [simp]:\n \"descendants_of' p n = descendants_of' p m\"\n apply (unfold n_def)\n apply (subst descendants_of_retype')\n apply (erule P)\n apply (rule refl)\n done\n\nlemma untyped_mdb_n: \"untyped_mdb' n\"\nproof -\n from valid\n have \"untyped_mdb' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_mdb'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma untyped_inc_n: \"untyped_inc' n\"\nproof -\n from valid\n have \"untyped_inc' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_inc'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply blast\n done\nqed\n\nlemma valid_nullcaps_n: \"valid_nullcaps n\"\nproof -\n from valid\n have \"valid_nullcaps m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_nullcaps_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma ut_rev_n: \"ut_revocable' n\"\nproof -\n from valid\n have \"ut_revocable' m\" ..\n thus ?thesis\n apply (clarsimp simp: ut_revocable'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma class_links_m:\n \"class_links m\"\n using valid by (simp add: valid_mdb_ctes_def)\n\nlemma next_not_P2:\n \"\\ m \\ p \\ p'; p' \\ nullPointer \\ \\ \\ P p'\"\n using dlist\n apply (clarsimp simp: mdb_next_unfold)\n apply (erule(1) valid_dlistE)\n apply clarsimp\n apply (clarsimp dest!: P)\n done\n\nlemma class_links_n:\n \"class_links n\"\n using class_links_m\n apply (simp add: class_links_def)\n apply (elim allEI)\n apply clarsimp\n apply (subgoal_tac \"p' \\ nullPointer\")\n apply (simp add: n_next split: if_split_asm)\n apply (case_tac cte, case_tac cte')\n apply (clarsimp simp add: n_Some_eq split: if_split_asm)\n apply (drule(1) next_not_P2)\n apply simp\n apply (clarsimp simp: no_0_n nullPointer_def)\n done\n\nlemma irq_control_n:\n \"irq_control n\"\n apply (clarsimp simp add: irq_control_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (frule irq_revocable, rule irq_control)\n apply clarsimp\n apply (erule (1) irq_controlD, rule irq_control)\n done\n\nlemma dist_z_m: \"distinct_zombies m\"\n using valid by auto\n\nlemma dist_z_n: \"distinct_zombies n\"\n using dist_z_m\n apply (simp add: n_def distinct_zombies_def\n distinct_zombie_caps_def\n split del: if_split)\n apply (erule allEI, erule allEI)\n apply (clarsimp split del: if_split)\n apply (clarsimp split: if_split_asm simp: makeObject_cte)\n apply (clarsimp simp: isCap_simps)\n done\n\nlemma reply_masters_rvk_fb_m: \"reply_masters_rvk_fb m\"\n using valid by auto\n\nlemma reply_masters_rvk_fb_n: \"reply_masters_rvk_fb n\"\n using reply_masters_rvk_fb_m\n by (simp add: n_def reply_masters_rvk_fb_def\n ball_ran_eq makeObject_cte isCap_simps)\n\nlemma valid_n:\n \"valid_mdb_ctes n\"\n by (simp add: valid_mdb_ctes_def dlist_n no_0_n mdb_chain_0_n\n valid_badges_n caps_contained_n untyped_mdb_n\n untyped_inc_n mdb_chunked_n valid_nullcaps_n ut_rev_n\n class_links_n irq_control_n dist_z_n\n reply_masters_rvk_fb_n)\n\nend\n\ndefinition\n caps_no_overlap'' :: \"word32 \\ nat \\ kernel_state \\ bool\"\nwhere\n \"caps_no_overlap'' ptr sz s \\ \\cte \\ ran (ctes_of s).\n untypedRange (cteCap cte) \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange (cteCap cte)\"\n\nlemma obj_range'_subset:\n \"\\range_cover ptr sz (objBitsKO val) n; ptr' \\ set (new_cap_addrs n ptr val)\\\n \\ obj_range' ptr' val \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n unfolding obj_range'_def\n by (rule new_range_subset, auto)\n\nlemma obj_range'_subset_strong:\n assumes \"range_cover ptr sz (objBitsKO val) n\"\n and \"ptr' \\ set (new_cap_addrs n ptr val)\"\n shows \"obj_range' ptr' val \\ {ptr..ptr + (of_nat n * 2 ^ objBitsKO val) - 1}\"\nproof -\n {\n assume cover: \"range_cover ptr sz (objBitsKO val) n\"\n and mem_p: \"ptr' \\ set (new_cap_addrs n ptr val)\"\n and not_0: \"n\\ 0\"\n note n_less = range_cover.range_cover_n_less[OF cover]\n have unat_of_nat_m1: \"unat (of_nat n - (1::machine_word)) < n\"\n using not_0 n_less by (simp add:unat_of_nat_minus_1)\n have decomp:\n \"of_nat n * 2 ^ objBitsKO val =\n of_nat (n - 1) * 2 ^ objBitsKO val + (2 :: machine_word) ^ objBitsKO val\"\n apply (simp add:distrib_right[where b = \"1 :: machine_word\",simplified,symmetric])\n using not_0 n_less\n apply simp\n done\n have \"ptr' + 2 ^ objBitsKO val - 1 \\ ptr + of_nat n * 2 ^ objBitsKO val - 1\"\n using cover\n apply (subst decomp)\n apply (simp add:add.assoc[symmetric])\n apply (simp add:p_assoc_help)\n apply (rule order_trans[OF word_plus_mono_left word_plus_mono_right])\n using mem_p not_0\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rule word_plus_mono_right)\n apply (subst mult.commute)\n apply (rule word_mult_le_mono1[OF word_of_nat_le])\n using n_less not_0\n apply (simp add:unat_of_nat_minus_1)\n apply (rule p2_gt_0[THEN iffD2])\n apply (simp add:word_bits_def range_cover_def)\n apply (simp only: word_bits_def[symmetric])\n apply (clarsimp simp: unat_of_nat_minus_1[OF n_less(1) not_0])\n apply (rule nat_less_power_trans2\n [OF range_cover.range_cover_le_n_less(2),OF cover, folded word_bits_def])\n apply (simp add:unat_of_nat_m1 less_imp_le)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n using range_cover.range_cover_compare[OF cover,where p = \"unat (of_nat n - (1::machine_word))\"]\n apply (clarsimp simp:unat_of_nat_m1)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule olen_add_eqv[THEN iffD2])\n apply (subst add.commute[where a = \"2^objBitsKO val - 1\"])\n apply (subst p_assoc_help[symmetric])\n apply (rule is_aligned_no_overflow)\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_mult_triv2]; simp)\n apply simp\n by (meson assms(1) is_aligned_add is_aligned_mult_triv2 is_aligned_no_overflow' range_cover_def)\n }\n with assms show ?thesis\n unfolding obj_range'_def\n apply -\n apply (frule(1) obj_range'_subset)\n apply (simp add: obj_range'_def)\n apply (cases \"n = 0\"; clarsimp simp:new_cap_addrs_def)\n done\nqed\n\nlemma caps_no_overlapD'':\n \"\\cte_wp_at' (\\cap. cteCap cap = c) q s;caps_no_overlap'' ptr sz s\\\n \\ untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {} \\\n {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange c\"\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps caps_no_overlap''_def\n simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule_tac x = cte in bspec)\n apply fastforce\n apply (erule(1) impE)\n apply blast\ndone\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\nlemma valid_untyped'_helper:\n assumes valid : \"valid_cap' c s\"\n and cte_at : \"cte_wp_at' (\\cap. cteCap cap = c) q s\"\n and cover : \"range_cover ptr sz (objBitsKO val) n\"\n and range : \"caps_no_overlap'' ptr sz s\"\n and pres : \"isUntypedCap c \\ usableUntypedRange c \\ {ptr..ptr + of_nat n * 2 ^ objBitsKO val - 1} = {}\"\n shows \"\\pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s\\\n \\ valid_cap' c (s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs n ptr val) (ksPSpace s)\\)\"\n proof -\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff\n assume pn : \"pspace_aligned' s\" \"pspace_distinct' s\"\n and no_overlap: \"pspace_no_overlap' ptr sz s\"\n show ?thesis\n using pn pres no_overlap valid cover cte_wp_at_ctes_of[THEN iffD1,OF cte_at]\n caps_no_overlapD''[OF cte_at range]\n apply (clarsimp simp:valid_cap'_def retype_ko_wp_at')\n apply (case_tac \"cteCap cte\"; simp add: valid_cap'_def cte_wp_at_obj_cases'\n valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm)\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches\n page_table_at'_def page_directory_at'_def split del: if_splits)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n unfolding valid_untyped'_def\n apply (intro allI)\n apply (rule ccontr)\n apply clarify\n using cover[unfolded range_cover_def]\n apply (clarsimp simp:isCap_simps retype_ko_wp_at' split:if_split_asm)\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (elim disjE)\n apply (frule(1) obj_range'_subset)\n apply (erule impE)\n apply (drule(1) psubset_subset_trans)\n apply (drule Int_absorb1[OF psubset_imp_subset])\n apply (drule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (simp add:Int_ac)\n apply (drule(1) subset_trans)\n apply blast\n apply (frule(1) obj_range'_subset_strong)\n apply (drule(1) non_disjoing_subset)\n apply blast\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (frule(1) obj_range'_subset)\n apply (drule(1) subset_trans)\n apply (erule impE)\n apply clarsimp\n apply blast\n apply blast\n done\nqed\n\ndefinition caps_overlap_reserved' :: \"word32 set \\ kernel_state \\ bool\"\nwhere\n \"caps_overlap_reserved' S s \\ \\cte \\ ran (ctes_of s).\n (isUntypedCap (cteCap cte) \\ usableUntypedRange (cteCap cte) \\ S = {})\"\n\nlemma createObjects_valid_pspace':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s\n \\ ptr \\ 0\\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (cut_tac not_0)\n apply (simp add: split_def createObjects'_def\n lookupAround2_pspace_no\n alignError_def unless_def)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def del:fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst data_map_insert_def[symmetric])+\n apply (rule impI)\n apply (clarsimp simp: new_cap_addrs_fold'\n valid_pspace'_def linorder_not_less\n objBits_def[symmetric])\n apply (simp only: imp_disjL[symmetric] imp_conjL[symmetric] imp_ex[symmetric]\n range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified])\nproof (intro conjI impI)\n\n fix s\n\n assume pn: \"pspace_no_overlap' ptr sz s\"\n and vo: \"valid_objs' s\"\n and ad: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pc: \"caps_no_overlap'' ptr sz s\"\n and mdb: \"valid_mdb' s\"\n and p_0: \"ptr \\ 0\"\n and reserved : \"caps_overlap_reserved' {ptr..ptr + of_nat n *2 ^ gbits * 2 ^ objBitsKO val - 1} s\"\n and no_0_obj': \"no_0_obj' s\"\n have obj': \"objBitsKO val \\ sz\"\n using cover\n by (simp add:range_cover_def)\n\n let ?s' = \"s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs (n * 2 ^ gbits) ptr val) (ksPSpace s)\\\"\n\n note cover' = range_cover_rel[where sbit' = \"objBitsKO val\",OF cover _ refl,simplified]\n\n note ad' = retype_aligned_distinct'[OF ad pn cover']\n\n note shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n\n have al: \"is_aligned ptr (objBitsKO val)\"\n using cover'\n by (simp add:range_cover_def)\n\n show pspace_aligned: \"pspace_aligned' ?s'\"\n using ad' range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n by (simp add:field_simps)\n\n show \"pspace_distinct' ?s'\"\n using ad' shift\n by (simp add:field_simps)\n\n note obj_at_disj = retype_obj_at_disj' [OF ad pn cover']\n\n note obj_at_disj' = obj_at_disj [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\n have obj_atC: \"\\P x. x \\ set (new_cap_addrs (2 ^ gbits * n) ptr val) \\ \\ obj_at' P x s\"\n apply (clarsimp simp: obj_at'_def)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover' ]])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule domI[where m = \"ksPSpace s\"])\n apply (drule(1) orthD2)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n done\n\n have valid_cap: \"\\cap q. \\ s \\' cap; cte_wp_at' (\\cte. cteCap cte = cap) q s \\\n \\ ?s' \\' cap\"\n apply (rule valid_untyped'_helper[OF _ _ _ pc _ ad pn ])\n apply simp+\n apply (subst mult.commute)\n apply (rule cover')\n using reserved\n apply (clarsimp simp:caps_overlap_reserved'_def cte_wp_at_ctes_of)\n apply (drule_tac x = cte in bspec)\n apply fastforce\n apply simp\n done\n\n show valid_objs: \"valid_objs' ?s'\" using vo\n apply (clarsimp simp: valid_objs'_def\n foldr_upd_app_if[folded data_map_insert_def]\n elim!: ranE\n split: if_split_asm)\n apply (insert sym[OF mko])[1]\n apply (clarsimp simp: makeObjectKO_def\n split: bool.split_asm sum.split_asm\n ARM_HYP_H.object_type.split_asm\n apiobject_type.split_asm\n kernel_object.split_asm\n arch_kernel_object.split_asm)\n apply (drule bspec, erule ranI)\n apply (subst mult.commute)\n apply (case_tac obj; simp add: valid_obj'_def)\n apply (rename_tac endpoint)\n apply (case_tac endpoint; simp add: valid_ep'_def obj_at_disj')\n apply (rename_tac notification)\n apply (case_tac notification; simp add: valid_ntfn'_def valid_bound_tcb'_def obj_at_disj')\n apply (rename_tac ntfn xa)\n apply (case_tac ntfn, simp_all, (clarsimp simp: obj_at_disj' split:option.splits)+)\n apply (rename_tac tcb)\n apply (case_tac tcb, clarsimp simp add: valid_tcb'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps)\n apply (subst mult.commute)\n apply (intro conjI ballI)\n apply (clarsimp elim!: ranE)\n apply (rule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (fastforce)\n apply (rule_tac ptr=\"x + xa\" in cte_wp_at_tcbI', assumption+)\n apply fastforce\n apply simp\n apply (rename_tac thread_state mcp priority bool option nat cptr vptr bound user_context)\n apply (case_tac thread_state, simp_all add: valid_tcb_state'_def\n valid_bound_ntfn'_def obj_at_disj'\n split: option.splits)[2]\n apply (clarsimp simp add: valid_arch_tcb'_def typ_at_to_obj_at_arches obj_at_disj')\n apply (simp add: valid_cte'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps')\n apply (subst mult.commute)\n apply (erule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (erule(2) cte_wp_at_cteI'[unfolded cte_level_bits_def])\n apply simp\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object; simp)\n apply (rename_tac asidpool)\n apply (case_tac asidpool, clarsimp simp: page_directory_at'_def\n typ_at_to_obj_at_arches\n obj_at_disj')\n apply (rename_tac pte)\n apply (case_tac pte; simp add: valid_mapping'_def)\n apply (rename_tac pde)\n apply (case_tac pde; simp add: valid_mapping'_def page_table_at'_def\n typ_at_to_obj_at_arches obj_at_disj')\n apply (rename_tac vcpu)\n apply (case_tac \"vcpuTCBPtr vcpu\";\n clarsimp simp: valid_vcpu'_def typ_at_to_obj_at'[where 'a=tcb, simplified]\n typ_at_to_obj_at_arches obj_at_disj')\n done\n have not_0: \"0 \\ set (new_cap_addrs (2 ^ gbits * n) ptr val)\"\n using p_0\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover'],rotated])\n apply (clarsimp simp:ptr_add_def)\n done\n show \"valid_mdb' ?s'\"\n apply (simp add: valid_mdb'_def foldr_upd_app_if[folded data_map_insert_def])\n apply (subst mult.commute)\n apply (subst ctes_of_retype [OF mko ad])\n apply (rule ad'[unfolded foldr_upd_app_if[folded data_map_insert_def]])+\n apply (simp add: objBits_def[symmetric] new_cap_addrs_aligned [OF al])\n apply (rule ballI, drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule_tac x = x in orthD1)\n apply (simp add:ptr_add_def p_assoc_help)\n apply fastforce\n apply (fold makeObject_cte)\n apply (rule retype_mdb.valid_n)\n apply unfold_locales\n apply (rule mdb[unfolded valid_mdb'_def])\n apply (rule iffD2 [OF None_ctes_of_cte_at[unfolded cte_wp_at_obj_cases'], THEN sym])\n apply (rule notI)\n apply (elim disjE conjE, simp_all add: obj_atC)[1]\n apply (thin_tac \"S \\ T = {}\" for S T)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (drule pspace_no_overlapD' [OF _ pn])\n apply (drule subsetD [OF new_cap_addrs_subset[OF cover']])\n apply (frule_tac ptr'=p in mask_in_range)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:objBits_simps)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (frule new_range_subset[OF cover'])\n apply (drule bspec [OF new_cap_addrs_aligned[OF al]])\n apply (drule(1) disjoint_subset[rotated])\n apply (drule_tac a=p in equals0D)\n apply (frule_tac ptr'=p in mask_in_range)\n apply (insert sym [OF mko],\n clarsimp simp: objBits_simps makeObjectKO_def obj_at'_def)[1]\n apply (insert sym[OF mko] cover',\n clarsimp simp: obj_at'_def objBits_simps\n makeObjectKO_def projectKOs)[1]\n apply (drule(1) tcb_cte_cases_aligned_helpers(2))\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset,rotated])\n apply (simp add:objBits_simps)\n apply (drule orthD1)\n apply (fastforce simp:p_assoc_help ptr_add_def)\n apply fastforce\n apply (simp add: not_0)\n done\n\n have data_map_ext: \"\\x y. data_map_insert x y = (\\m. m (x \\ y))\"\n by (rule ext) simp\n show no_0_obj: \"no_0_obj' ?s'\"\n using not_0 no_0_obj'\n by (simp add: no_0_obj'_def data_map_ext field_simps foldr_upd_app_other)\n\nqed\n\nlemma createObjects_valid_pspace_untyped':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s \\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (wp createObjects_valid_pspace' [OF mko not_0 cover])\n apply simp\n done\n\ncrunch valid_objs'[wp]: copyGlobalMappings \"valid_objs'\"\n (ignore: storePDE wp: crunch_wps)\ncrunch pspace_aligned'[wp]: copyGlobalMappings \"pspace_aligned'\"\n (wp: crunch_wps)\ncrunch pspace_distinct'[wp]: copyGlobalMappings \"pspace_distinct'\"\n (wp: crunch_wps)\n\nlemmas storePDE_valid_mdb[wp]\n = storePDE_ctes[where P=valid_mdb_ctes, folded valid_mdb'_def]\ncrunch valid_mdb[wp]: copyGlobalMappings \"valid_mdb'\"\n (wp: crunch_wps)\n\ncrunch no_0_obj' [wp]: copyGlobalMappings no_0_obj'\n (wp: crunch_wps)\n\nlemma copyGlobalMappings_valid_pspace[wp]:\n \"\\valid_pspace'\\ copyGlobalMappings pd \\\\rv. valid_pspace'\\\"\n by (simp add: valid_pspace'_def | wp)+\n\ndeclare bleeding_obvious [simp]\n\nlemma range_cover_new_cap_addrs_compare:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and ptr_in: \"p \\ set (new_cap_addrs (unat (((of_nat n)::word32) << gbits)) ptr val)\"\n shows \"p \\ ptr + of_nat (shiftL n (objBitsKO val + gbits) - Suc 0)\"\nproof -\n note unat_of_nat_shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n have cover' :\"range_cover ptr sz (objBitsKO val) (n*2^gbits)\"\n by (rule range_cover_rel[OF cover],simp+)\n have upbound:\" unat ((((of_nat n)::word32) * 2 ^ gbits)) * unat ((2::word32) ^ objBitsKO val) < 2 ^ word_bits\"\n using range_cover.range_cover_le_n_less[OF cover' le_refl] cover'\n apply -\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def)\n apply (fold word_bits_def)\n using unat_of_nat_shift not_0\n apply (simp add:field_simps shiftl_t2n)\n done\n have not_0': \"(2::word32) ^ (objBitsKO val + gbits) * of_nat n \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_0,unfolded shiftl_t2n,OF _ le_refl])\n apply (rule range_cover_rel[OF cover]; simp)\n done\n have \"gbits < word_bits\"\n using cover\n by (simp add:range_cover_def word_bits_def)\n thus ?thesis\n apply -\n apply (insert not_0 cover ptr_in)\n apply (frule range_cover.range_cover_le_n_less[OF _ le_refl])\n apply (fold word_bits_def)\n apply (simp add:shiftL_nat )\n apply (simp add:range_cover.unat_of_nat_n_shift)\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rename_tac pa)\n apply (rule word_plus_mono_right)\n apply (rule order_trans)\n apply (subst mult.commute)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (clarsimp simp:p2_gt_0 range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"0\"])\n apply (simp+)[2]\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(2)])\n apply (clarsimp simp:field_simps power_add)\n apply (rule unat_le_helper)\n apply (rule of_nat_mono_maybe_le[THEN iffD1])\n using range_cover.range_cover_le_n_less[OF cover' le_refl]\n apply (simp_all only:word_bits_def[symmetric])\n apply simp\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule less_le_trans[OF mult_less_mono1])\n apply (rule unat_mono)\n apply (rule_tac y1= \"pa\" in of_nat_mono_maybe'[THEN iffD1,rotated -1])\n apply (assumption)\n apply (simp add:word_bits_def)\n apply (simp add:word_bits_def)\n apply simp\n using unat_of_nat_shift\n apply (simp add:field_simps shiftl_t2n)\n apply simp\n apply (rule word_less_sub_1)\n apply (simp add:power_add field_simps)\n apply (subst mult.assoc[symmetric])\n apply (rule word_mult_less_mono1)\n apply (rule word_of_nat_less)\n using unat_of_nat_shift\n apply (simp add:shiftl_t2n field_simps)\n apply (meson less_exp objBitsKO_bounded2 of_nat_less_pow_32 word_gt_a_gt_0)\n using upbound\n apply (simp add:word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n apply (rule less_le_trans[rotated -1])\n apply (rule range_cover.range_cover_compare_bound[OF cover'])\n apply (simp add: unat_minus_one[OF not_0'])\n using range_cover.unat_of_nat_n_shift[OF cover le_refl]\n apply (simp add:shiftl_t2n power_add field_simps)\n apply (simp add:range_cover_def word_bits_def)\n done\nqed\n\nlemma createObjects_orig_ko_wp_at2':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' val \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (ko_wp_at' P' p s)\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del:fun_upd_apply)\n apply (rule hoare_grab_asm)+\n apply (subst new_cap_addrs_fold')\n apply (drule range_cover_not_zero_shift[rotated])\n apply (rule le_add2)\n apply (simp add:word_le_sub1 del:fun_upd_apply)+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (clarsimp simp:valid_pspace'_def linorder_not_less simp del:fun_upd_apply)\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (cases \"P' val\")\n apply simp\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def)\n apply (fastforce simp:ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\n\nlemma createObjects_orig_obj_at2':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (obj_at' P' p s)\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (obj_at' P' p s)\\\"\n unfolding obj_at'_real_def\n by (wp createObjects_orig_ko_wp_at2') auto\n\nlemma createObjects_orig_cte_wp_at2':\n \"\\\\s. P (cte_wp_at' P' p s)\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ (case_option False (P' \\ getF) (projectKO_opt val)))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: cte_wp_at'_obj_at')\n apply (rule handy_prop_divs)\n apply (wp createObjects_orig_obj_at2'[where sz = sz], simp)\n apply (simp add: tcb_cte_cases_def)\n including no_pre\n apply (wp handy_prop_divs createObjects_orig_obj_at2'[where sz = sz]\n | simp add: o_def cong: option.case_cong)+\n done\n\nlemma threadSet_cte_wp_at2'T:\n assumes \"\\tcb. \\(getF, setF) \\ ran tcb_cte_cases. getF (F tcb) = getF tcb\"\n shows \"\\\\s. P (cte_wp_at' P' p s)\\ threadSet F t \\\\rv s. P (cte_wp_at' P' p s)\\\"\n using assms by (rule threadSet_cte_wp_at'T)\n\nlemmas threadSet_cte_wp_at2' =\n threadSet_cte_wp_at2'T [OF all_tcbI, OF ball_tcb_cte_casesI]\n\nlemma createNewCaps_cte_wp_at2:\n \"\\\\s. P (cte_wp_at' P' p s) \\ \\ P' makeObject\n \\ n \\ 0\n \\ range_cover ptr sz (APIType_capBits ty objsz) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n objsz dev\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n including no_pre\n apply (simp add: createNewCaps_def createObjects_def ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: createNewCaps_def createObjects_def Arch_createNewCaps_def\n split del: if_split cong: if_cong)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp add:createObjects_def)\n apply ((wp createObjects_orig_cte_wp_at2'[where sz = sz]\n mapM_x_wp' threadSet_cte_wp_at2')+\n | assumption\n | clarsimp simp: APIType_capBits_def\n projectKOs projectKO_opts_defs\n makeObject_tcb tcb_cte_cases_def\n archObjSize_def vspace_bits_defs\n createObjects_def curDomain_def\n Let_def objBits_if_dev\n split del: if_split\n | simp add: objBits_simps)+\n done\n\nlemma createObjects_orig_obj_at':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ obj_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r. obj_at' P p\\\"\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: createObjects'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (wp|simp add:split_def cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (simp add: alignError_def del: fun_upd_apply | wpc|wp)+\n apply (clarsimp simp del:fun_upd_apply)\n apply (subst data_map_insert_def[symmetric])+\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst retype_obj_at',simp+)+\n apply (intro conjI impI allI)\n apply (clarsimp simp:obj_at'_real_def ko_wp_at'_def)\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply simp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def obj_at'_real_def ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_orig_cte_wp_at':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ cte_wp_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. cte_wp_at' P p s\\\"\n apply (simp add: cte_wp_at'_obj_at' tcb_cte_cases_def)\n apply (rule hoare_pre, wp hoare_vcg_disj_lift createObjects_orig_obj_at'[where sz = sz])\n apply clarsimp\n done\n\nlemma createNewCaps_cte_wp_at':\n \"\\\\s. cte_wp_at' P p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us dev\n \\\\rv. cte_wp_at' P p\\\"\n apply (simp add: createNewCaps_def ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (wp createObjects_orig_cte_wp_at'[where sz = sz] mapM_x_wp'\n threadSet_cte_wp_at'T\n | clarsimp simp: objBits_simps APIType_capBits_def createObjects_def curDomain_def\n vspace_bits_defs archObjSize_def\n | intro conjI impI\n | force simp: tcb_cte_cases_def)+\n done\n\nlemma createObjects_obj_at_other:\n assumes cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and not_0: \"n\\ 0\"\n shows \"\\\\s. obj_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\_. obj_at' P p\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_orig_obj_at'[where sz = sz])\n using cover not_0\n apply (clarsimp simp: cover not_0 valid_pspace'_def pspace_no_overlap'_def)\n done\n\nlemma valid_cap'_range_no_overlap:\n \"\\untypedRange c \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; s \\' c;\n valid_pspace' s; pspace_no_overlap' ptr sz s;\n range_cover ptr sz (objBitsKO val) n\\\n \\ s\\ksPSpace := foldr (\\addr. data_map_insert addr val)\n (new_cap_addrs n ptr val) (ksPSpace s)\\ \\' c\"\n apply (cases c; simp add: valid_cap'_def cte_wp_at_obj_cases' valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm\n del: Int_atLeastAtMost)[1]\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches\n page_table_at'_def page_directory_at'_def)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n apply (rename_tac word nat1 nat2)\n apply (clarsimp simp:valid_untyped'_def retype_ko_wp_at'\n simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (intro conjI impI)\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (erule disjE)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2[OF psubset_imp_subset])\n apply (simp add: Int_absorb ptr_add_def p_assoc_help\n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(1) obj_range'_subset)\n apply (drule_tac A'=\" {word + of_nat nat2..word + 2 ^ nat1 - 1}\" in disjoint_subset[rotated])\n apply clarsimp\n apply (rule is_aligned_no_wrap')\n apply (fastforce simp:capAligned_def)\n apply (erule of_nat_less_pow_32)\n apply (simp add:capAligned_def)\n apply (drule(1) disjoint_subset2)\n apply blast\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2)\n apply (simp add: Int_absorb ptr_add_def p_assoc_help\n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n done\n\nlemma createObjects_valid_cap':\n \"\\valid_cap' c and valid_pspace' and pspace_no_overlap' ptr sz and\n K (untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2^sz - 1} = {} \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects' ptr n val gbits\n \\\\_. valid_cap' c\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (clarsimp simp: linorder_not_less valid_pspace'_def)\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])+\n apply clarsimp\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst range_cover.unat_of_nat_n_shift,simp+)+\n apply (subst (asm) range_cover.unat_of_nat_n_shift,simp+)+\n apply (intro conjI impI allI)\n apply (erule(4) valid_cap'_range_no_overlap)+\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_cte_wp_at':\n \"\\range_cover ptr sz (objBitsKO val + gbits) n; n \\ 0\\\n \\\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\_. cte_wp_at' P p\\\"\n apply (clarsimp simp: valid_def cte_wp_at_obj_cases')\n apply (erule disjE)\n apply (erule use_valid[OF _ ])\n apply (rule createObjects_orig_obj_at')\n apply fastforce\n apply clarsimp\n apply (drule_tac x = na in bspec)\n apply clarsimp\n apply clarsimp\n apply (drule use_valid[OF _ createObjects_orig_obj_at'])\n apply fastforce\n apply simp\n done\n\nlemma createNewCaps_cte_wp_at:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0 : \"n \\ 0\"\n shows \"\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us dev\n \\\\_. cte_wp_at' P p\\\"\n apply (wp createNewCaps_cte_wp_at')\n apply (auto simp: cover not_0)\n done\n\nlemma createObjects_ret2:\n \"\\(\\s. P (map (\\p. ptr_add y (p * 2 ^ (objBitsKO ko + gbits)))\n [0.. n \\ 0)\\\n createObjects y n ko gbits \\\\rv s. P rv\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret)\n apply simp+\n apply (rule hoare_vcg_prop)\n defer\n apply (clarsimp simp: power_add mult.commute mult.left_commute | assumption)+\n done\n\nlemma state_refs_ko_wp_at_eq:\n \"state_refs_of' s = (\\x. {r. ko_wp_at' (\\ko. r \\ refs_of' ko) x s})\"\n apply (rule ext)\n apply (simp add: state_refs_of'_def ko_wp_at'_def\n split: option.split)\n done\n\nlemma state_hyp_refs_ko_wp_at_eq:\n \"state_hyp_refs_of' s = (\\x. {r. ko_wp_at' (\\ko. r \\ hyp_refs_of' ko) x s})\"\n apply (rule ext)\n apply (simp add: state_hyp_refs_of'_def ko_wp_at'_def\n split: option.split)\n done\n\nlemma createObjects_state_refs_of'':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ P (state_refs_of' s) \\ refs_of' val = {}\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. P (state_refs_of' s)\\\"\n apply (clarsimp simp:valid_def lookupAround2_pspace_no state_refs_ko_wp_at_eq)\n apply (erule ssubst[where P = P,rotated])\n apply (rule ext)\n apply (rule set_eqI)\n apply clarsimp\n apply (intro iffI,rule ccontr)\n apply (drule_tac P1=\"\\x. \\ x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp\n apply (intro conjI)\n apply simp+\n apply (drule_tac P1=\"\\x. x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp+\n done\n\nlemma createObjects_state_hyp_refs_of'':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ P (state_hyp_refs_of' s) \\ hyp_refs_of' val = {}\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. P (state_hyp_refs_of' s)\\\"\n apply (clarsimp simp:valid_def lookupAround2_pspace_no state_hyp_refs_ko_wp_at_eq)\n apply (erule ssubst[where P = P,rotated])\n apply (rule ext)\n apply (rule set_eqI)\n apply clarsimp\n apply (intro iffI,rule ccontr)\n apply (drule_tac P1=\"\\x. \\ x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp\n apply (intro conjI)\n apply simp+\n apply (drule_tac P1=\"\\x. x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp+\n done\n\ncrunch state_hyp_refs_of'[wp]: copyGlobalMappings \"\\s. P (state_hyp_refs_of' s)\"\n (wp: crunch_wps)\n\ncrunch state_refs_of'[wp]: copyGlobalMappings \"\\s. P (state_refs_of' s)\"\n (wp: crunch_wps)\n\nlemma createNewCaps_state_refs_of':\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ P (state_refs_of' s)\\\n createNewCaps ty ptr n us dev\n \\\\rv s. P (state_refs_of' s)\\\"\n unfolding createNewCaps_def\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (cases ty; simp add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (insert cover not_0)\n apply(wp mapM_x_wp' createObjects_state_refs_of'' threadSet_state_refs_of'\n | simp add: not_0 pspace_no_overlap'_def objBitsKO_def APIType_capBits_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint objBits_def\n makeObject_notification vspace_bits_defs\n archObjSize_def createObjects_def curDomain_def\n | intro conjI impI)+\n done\n\n(* FIXME move to KHeap_R *)\nlemma doMachineOp_hyp_bit:\n \"\\\\s. P (state_hyp_refs_of' s)\\\n doMachineOp m\n \\\\rv s. P (state_hyp_refs_of' s)\\\"\n by (simp add: doMachineOp_def split_def | wp)+\n\nlemma createNewCaps_state_hyp_refs_of':\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ P (state_hyp_refs_of' s)\\\n createNewCaps ty ptr n us dev\n \\\\rv s. P (state_hyp_refs_of' s)\\\"\n unfolding createNewCaps_def\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (cases ty; simp add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (insert cover not_0)\n apply (wp mapM_x_wp' createObjects_state_hyp_refs_of'' threadSet_state_hyp_refs_of' doMachineOp_hyp_bit\n | simp add: not_0 pspace_no_overlap'_def objBitsKO_def APIType_capBits_def\n valid_pspace'_def makeObject_tcb makeObject_vcpu objBits_def\n vspace_bits_defs newArchTCB_def vcpu_tcb_refs'_def makeVCPUObject_def\n archObjSize_def createObjects_def curDomain_def\n | intro conjI impI)+\n done\n\nlemma createObjects_iflive':\n \"\\\\s. if_live_then_nonz_cap' s \\ \\ live' val\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n apply (rule hoare_pre)\n apply (simp only: if_live_then_nonz_cap'_def\n ex_nonz_cap_to'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n hoare_vcg_ex_lift createObjects_orig_ko_wp_at2'\n createObjects_orig_cte_wp_at')\n apply clarsimp\n apply (intro conjI allI impI)\n apply simp_all\n apply (rule ccontr)\n apply clarsimp\n apply (drule(1) if_live_then_nonz_capE')\n apply (fastforce simp: ex_nonz_cap_to'_def)\n done\n\ncrunch ksReadyQueues[wp]: copyGlobalMappings \"\\s. P (ksReadyQueues s)\"\n (wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL1[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n (wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL2[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (wp: updateObject_default_inv crunch_wps)\n\ncrunch valid_idle'[wp]: copyGlobalMappings \"valid_idle'\"\n (simp: objBits_simps archObjSize_def\n wp: updateObject_default_inv crunch_wps setObject_idle' refl)\n\ncrunch iflive'[wp]: copyGlobalMappings \"if_live_then_nonz_cap'\"\n (wp: crunch_wps)\n\nlemma createNewCaps_iflive'[wp]:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ if_live_then_nonz_cap' s\\\n createNewCaps ty ptr n us dev\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n unfolding createNewCaps_def\n apply (insert cover)\n apply (clarsimp simp: toAPIType_def ARM_HYP_H.toAPIType_def)\n apply (cases ty, simp_all add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_wp' createObjects_iflive' threadSet_iflive'\n | simp add: not_0 pspace_no_overlap'_def createObjects_def live'_def hyp_live'_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint\n makeObject_notification objBitsKO_def newArchTCB_def arch_live'_def\n APIType_capBits_def objBits_def makeObject_vcpu makeVCPUObject_def\n archObjSize_def vspace_bits_defs\n curDomain_def split del:if_split\n | simp split: if_split\n | fastforce)+\n done\n\nlemma createObjects_pspace_only:\n \"\\ \\f s. P (ksPSpace_update f s) = P s \\\n \\ \\P\\ createObjects' ptr n val gbits \\\\rv. P\\\"\n apply (simp add: createObjects_def createObjects'_def unless_def alignError_def\n split_def lookupAround2_pspace_no)\n apply wpsimp\n done\n\nlemma createObjects'_qs[wp]:\n \"\\\\s. P (ksReadyQueues s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueues s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\n(* FIXME move these 2 to TcbAcc_R *)\nlemma threadSet_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\nlemma threadSet_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\ncrunches createObjects, createNewCaps\n for qs[wp]: \"\\s. P (ksReadyQueues s)\"\n and qsL1[wp]: \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n and qsL2[wp]: \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (simp: crunch_simps wp: crunch_wps)\n\nlemma sch_act_wf_lift_asm:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\\n f\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (frule use_valid [OF _ ksA])\n prefer 2\n apply assumption\n apply (frule_tac P1=\"(=) (ksCurThread s)\" in use_valid [OF _ kCT])\n apply (rule refl)\n apply (frule_tac P1=\"(=) (ksCurDomain s)\" in use_valid [OF _ kCD])\n apply (rule refl)\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply (frule use_valid [OF _ tcbDomain], fastforce)\n apply auto\n done\n\nlemma valid_queues_lift_asm':\n assumes tat: \"\\d p t. \\\\s. \\ obj_at' (inQ d p) t s \\ Q d p s\\ f \\\\_ s. \\ obj_at' (inQ d p) t s\\\"\n and prq: \"\\P. \\\\s. P (ksReadyQueues s)\\ f \\\\_ s. P (ksReadyQueues s)\\\"\n shows \"\\\\s. valid_queues' s \\ (\\d p. Q d p s)\\ f \\\\_. valid_queues'\\\"\n apply (simp only: valid_queues'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n tat prq)\n apply simp\n done\n\nlemma createObjects'_ct[wp]:\n \"\\\\s. P (ksCurThread s)\\ createObjects' p n v us \\\\rv s. P (ksCurThread s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunches createObjects, doMachineOp, createNewCaps\n for ksCurDomain[wp]: \"\\s. P (ksCurDomain s)\"\n and ct[wp]: \"\\s. P (ksCurThread s)\"\n (ignore: clearMemory simp: unless_def crunch_simps wp: crunch_wps)\n\nlemma copyGlobalMappings_ko_wp_at:\n \"\\(\\s. P (ko_wp_at' P' p s)) and K (\\pde_x :: pde. P' (injectKO pde_x) = v)\\\n copyGlobalMappings pd\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: copyGlobalMappings_def storePDE_def)\n done\n\nlemma threadSet_ko_wp_at2':\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\tcb_x :: tcb. P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps')+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma threadSet_ko_wp_at2'_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ obj_at' Q ptr s\n \\ (\\tcb_x :: tcb. Q tcb_x \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps')+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma mapM_x_threadSet_createNewCaps_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\addr\\set addrs. obj_at' (\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive) addr s)\n \\ (\\tcb_x :: tcb. tcbQueued (F tcb_x) = tcbQueued tcb_x \\ tcbState (F tcb_x) = tcbState tcb_x)\n \\ (\\tcb_x :: tcb. \\ tcbQueued tcb_x \\ tcbState tcb_x = Inactive \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n mapM_x (threadSet F) addrs\n \\\\_ s. P (ko_wp_at' P' p s)\\\" (is \"\\?PRE\\ _ \\\\_. ?POST\\\")\napply (rule mapM_x_inv_wp[where P=\"?PRE\"])\n apply simp\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ball_lift threadSet_ko_wp_at2'[where P=\"id\", simplified]\n | wp (once) threadSet_ko_wp_at2'_futz[where Q=\"\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive\"]\n | simp)+\ndone\n\nlemma createObjects_makeObject_not_tcbQueued:\n assumes \"range_cover ptr sz (objBitsKO tcb) n\"\n assumes \"n \\ 0\" \"tcb = injectKO (makeObject::tcb)\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n tcb 0\n \\\\rv s. \\addr\\set rv. obj_at' (\\tcb. \\ tcbQueued tcb \\ tcbState tcb = Structures_H.thread_state.Inactive) addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where 'a=tcb]])\n using assms\n apply (auto simp: obj_at'_def projectKO_opt_tcb objBitsKO_def\n objBits_def makeObject_tcb)\n done\n\nlemma createObjects_ko_wp_at2:\n \"\\\\s. range_cover ptr sz (objBitsKO ko + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' ko \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n ko gbits\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: createObjects_def)\napply (wp createObjects_orig_ko_wp_at2')\napply auto\ndone\n\ncrunch ko_wp_at_'_P[wp]: doMachineOp \"\\s. P (ko_wp_at' P' t s)\"\n\nlemma createNewCaps_ko_wp_atQ':\n \"\\(\\s. P (ko_wp_at' P' p s)\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s)\n and K (\\pde_x :: pde. P' (injectKO pde_x)\n \\ (\\pde_y :: pde. P' (injectKO pde_y)))\n and K (\\d (tcb_x :: tcb). \\tcbQueued tcb_x \\ tcbState tcb_x = Inactive\n \\ P' (injectKO (tcb_x \\ tcbDomain := d \\)) = P' (injectKO tcb_x))\n and K (\\v. makeObjectKO d (Inr ty) = Some v\n \\ P' v \\ P True)\\\n createNewCaps ty ptr n us d\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: createNewCaps_def ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_threadSet_createNewCaps_futz\n mapM_x_wp'\n createObjects_obj_at\n createObjects_ko_wp_at2 createObjects_makeObject_not_tcbQueued\n copyGlobalMappings_ko_wp_at[where v=\"\\pde :: pde. P' (injectKO pde)\"]\n | simp add: makeObjectKO_def objBitsKO_def archObjSize_def APIType_capBits_def\n objBits_def vspace_bits_defs curDomain_def\n split del: if_split\n | intro conjI impI | fastforce\n | split if_split_asm)+\n done\n\n\nlemmas createNewCaps_ko_wp_at'\n = createNewCaps_ko_wp_atQ'[simplified, unfolded fold_K]\n\nlemmas createNewCaps_obj_at2 =\n createNewCaps_ko_wp_at'\n [where P'=\"\\ko. \\obj :: ('a :: pspace_storable).\n projectKO_opt ko = Some obj \\ P' obj\" for P',\n folded obj_at'_real_def,\n unfolded pred_conj_def, simplified]\n\nlemma createNewCaps_obj_at'':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (koType(TYPE('a)) = koType(TYPE(pde))\n \\ (\\x. P x)\n \\ (\\pde :: pde. \\x :: 'a. injectKO x = injectKO pde))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n apply (simp add: obj_at'_real_def)\n apply (wp createNewCaps_ko_wp_at')\n apply clarsimp\n apply (intro conjI impI)\n apply simp+\n apply clarsimp\n apply (clarsimp simp: projectKOs dest!: iffD1 [OF project_koType, OF exI])\n apply (clarsimp simp:project_inject)+\ndone\n\nlemma createNewCaps_obj_at':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ koType(TYPE('a)) \\ koType(TYPE(pde))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n by (wp createNewCaps_obj_at'', auto)\n\nlemmas createNewCaps_pred_tcb_at'\n = createNewCaps_obj_at'[where P=\"\\ko. (Q :: 'a :: type \\ bool) (proj (tcb_to_itcb' ko))\" for Q proj,\n folded pred_tcb_at'_def, simplified]\n\nlemma createNewCaps_cur:\n \"\\range_cover ptr sz (APIType_capBits ty us) n ; n \\ 0\\ \\\n \\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n cur_tcb' s\\\n createNewCaps ty ptr n us d\n \\\\rv. cur_tcb'\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createNewCaps_obj_at')\n apply (clarsimp simp: pspace_no_overlap'_def cur_tcb'_def valid_pspace'_def)\n apply auto\n done\n\ncrunch ksInterrupt[wp]: createNewCaps \"\\s. P (ksInterruptState s)\"\n (simp: crunch_simps unless_def\n wp: setObject_ksInterrupt updateObject_default_inv crunch_wps\n ignore: clearMemoryVM)\n\nlemma createNewCaps_ifunsafe':\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createNewCaps ty ptr n us d\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createNewCaps_ksInterrupt])\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2 hoare_vcg_ex_lift)\n apply (simp add: makeObject_cte pspace_no_overlap'_def\n valid_pspace'_def)\n apply auto\n done\n\nlemma createObjects_nosch'[wp]:\n \"\\\\s. P (ksSchedulerAction s)\\\n createObjects' ptr n val gbits\n \\\\rv s. P (ksSchedulerAction s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunches copyGlobalMappings, createObjects, createNewCaps\n for nosch[wp]: \"\\s. P (ksSchedulerAction s)\"\n and it[wp]: \"\\s. P (ksIdleThread s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\nlemma createObjects_idle':\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and (\\s. \\ case_option False (\\cte. ksIdleThread s \\ capRange (cteCap cte))\n (projectKO_opt val)\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ case_option False (\\tcb. ksIdleThread s \\ capRange (cteCap (getF tcb)))\n (projectKO_opt val)))\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects' ptr n val gbits\n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (clarsimp simp add: valid_idle'_def pred_tcb_at'_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_as_subst [OF createObjects'_it])\n apply (wp createObjects_orig_obj_at'\n createObjects_orig_cte_wp_at2'\n hoare_vcg_all_lift | simp)+\n apply (clarsimp simp: valid_idle'_def projectKOs o_def\n pred_tcb_at'_def valid_pspace'_def\n cong: option.case_cong)\n apply auto\n done\n\nlemma createNewCaps_idle'[wp]:\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (clarsimp simp: createNewCaps_def ARM_HYP_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (wp, simp)\n including no_pre\n apply (wp mapM_x_wp'\n createObjects_idle'\n threadSet_idle'\n | simp add: projectKO_opt_tcb projectKO_opt_cte\n makeObject_cte makeObject_tcb archObjSize_def\n tcb_cte_cases_def objBitsKO_def APIType_capBits_def\n vspace_bits_defs objBits_def\n createObjects_def\n | intro conjI impI\n | fastforce simp: curDomain_def)+\n done\n\ncrunch ksArch[wp]: createNewCaps \"\\s. P (ksArchState s)\"\n (simp: crunch_simps unless_def wp: crunch_wps)\ncrunch it[wp]: createNewCaps \"\\s. P (ksIdleThread s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv)\ncrunch gsMaxObjectSize[wp]: createNewCaps \"\\s. P (gsMaxObjectSize s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv)\n\nlemma createNewCaps_global_refs':\n \"\\\\s. range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s \\ valid_global_refs' s\n \\ 0 < gsMaxObjectSize s\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_global_refs'\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createNewCaps_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createNewCaps_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (wp hoare_vcg_all_lift createNewCaps_cte_wp_at2[where sz=sz])\n apply (clarsimp simp: cte_wp_at_ctes_of global_refs'_def\n makeObject_cte)\n apply (auto simp: linorder_not_less ball_ran_eq)\n done\n\nlemma koTypeOf_eq_UserDataT:\n \"(koTypeOf ko = UserDataT)\n = (ko = KOUserData)\"\n by (cases ko, simp_all)\n\nlemma createNewCaps_valid_arch_state:\n \"\\(\\s. valid_arch_state' s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ (tp = APIObjectType ArchTypes_H.CapTableObject \\ us > 0))\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_arch_state'\\\"\n apply (simp add: valid_arch_state'_def valid_asid_table'_def valid_global_pts'_def\n page_table_at'_def page_directory_at'_def option_case_all_conv)\n apply (wpsimp wp: hoare_vcg_prop createNewCaps_ko_wp_at' createNewCaps_obj_at''\n hoare_vcg_all_lift hoare_vcg_imp_lift\n simp: typ_at_to_obj_at_arches o_def is_vcpu'_def)\n apply (fastforce simp: valid_pspace'_def o_def pred_conj_def)\n done\n\nlemma valid_irq_handlers_cte_wp_at_form':\n \"valid_irq_handlers' = (\\s. \\irq. irq_issued' irq s \\\n (\\p. \\ cte_wp_at' (\\cte. cteCap cte = IRQHandlerCap irq) p s))\"\n by (auto simp: valid_irq_handlers'_def cteCaps_of_def cte_wp_at_ctes_of\n fun_eq_iff ran_def)\n\nlemma createNewCaps_irq_handlers':\n \"\\valid_irq_handlers' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_irq_handlers'\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2)\n apply (clarsimp simp: makeObject_cte)\n apply auto\n done\n\nlemma valid_pde_mappings'_def3:\n \"valid_pde_mappings' =\n (\\s. \\x. \\ obj_at' (Not \\ valid_pde_mapping' (x && mask pdBits)) x s)\"\n apply (simp add: valid_pde_mappings'_def)\n apply (rule ext, rule iff_allI)\n apply (auto simp: obj_at'_def projectKOs)\n done\n\nlemma createObjects'_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (\\pde. projectKO_opt val = Some pde \\ pde = InvalidPDE)\\\n createObjects' ptr n val gbits\n \\\\_. valid_pde_mappings'\\\"\n apply (simp only: valid_pde_mappings'_def3 all_simps(1)[symmetric])\n apply (rule hoare_vcg_all_lift)\n apply (wp createObjects_orig_obj_at2')\n apply (clarsimp simp: projectKO_opt_pde o_def\n split: Structures_H.kernel_object.split_asm\n arch_kernel_object.split_asm)\n apply auto\n done\n\nlemma createObjects_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (objBitsKO ko + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (\\pde. projectKO_opt ko = Some pde \\ pde = InvalidPDE)\\\n createObjects ptr n ko gbits\n \\\\_. valid_pde_mappings'\\\"\n by (simp add: createObjects_def objBits_def | intro conjI | wp | clarsimp)+\n\nlemma copyGlobalMappings_pde_mappings':\n \"\\valid_pde_mappings' and K (is_aligned pd pdBits)\\ copyGlobalMappings pd \\\\rv. valid_pde_mappings'\\\"\n apply (simp add: copyGlobalMappings_def objBits_simps archObjSize_def)\n apply wpsimp\n done\n\nlemma mapM_x_copyGlobalMappings_pde_mappings':\n \"\\valid_pde_mappings' and K (\\x \\ set xs. is_aligned x pdBits)\\\n mapM_x copyGlobalMappings xs \\\\rv. valid_pde_mappings'\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp [OF _ subset_refl])\n apply (wp copyGlobalMappings_pde_mappings' | simp)+\n done\n\nlemma createNewCaps_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ valid_arch_state' s\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us d\n \\\\_. valid_pde_mappings'\\\"\n apply (simp add: createNewCaps_def Arch_createNewCaps_def Let_def\n split del: if_split cong: option.case_cong\n object_type.case_cong)\n apply (rule hoare_pre)\n apply (wp mapM_x_copyGlobalMappings_pde_mappings' | wpc\n | simp split del: if_split)+\n apply (rule_tac P=\"range_cover ptr sz (APIType_capBits ty us) n \\ n\\ 0\" in hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule createObjects_aligned, simp+)\n apply (simp add: objBits_simps vspace_bits_defs archObjSize_def APIType_capBits_def range_cover_def)\n apply (rule range_cover.range_cover_n_less[where 'a=32, folded word_bits_def],fastforce+)\n apply (simp add: objBits_simps vspace_bits_defs archObjSize_def APIType_capBits_def range_cover_def word_bits_def)+\n apply (wp mapM_x_wp[OF _ subset_refl] | wpc | simp add: curDomain_def)+\n apply (clarsimp simp: projectKOs)\n apply (simp add: objBits_simps pdBits_def pageBits_def archObjSize_def APIType_capBits_def)\n apply (case_tac ty; simp)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (auto simp: ARM_HYP_H.toAPIType_def objBits_simps vspace_bits_defs\n makeObject_pde valid_arch_state'_def page_directory_at'_def)\n done\n\nlemma createObjects'_irq_states' [wp]:\n \"\\valid_irq_states'\\ createObjects' a b c d \\\\_. valid_irq_states'\\\"\n apply (simp add: createObjects'_def split_def)\n apply (wp unless_wp|wpc|simp add: alignError_def)+\n apply fastforce\n done\n\ncrunch irq_states' [wp]: createNewCaps valid_irq_states'\n (wp: crunch_wps no_irq no_irq_clearMemory simp: crunch_simps unless_def)\n\ncrunch ksMachine[wp]: createObjects \"\\s. P (ksMachineState s)\"\n (simp: crunch_simps unless_def)\ncrunch cur_domain[wp]: createObjects \"\\s. P (ksCurDomain s)\"\n (simp: unless_def)\n\nlemma createNewCaps_valid_queues':\n \"\\valid_queues' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues'\\\"\n apply (wp valid_queues_lift_asm' [OF createNewCaps_obj_at2])\n apply (clarsimp simp: projectKOs)\n apply (simp add: makeObjectKO_def\n split: object_type.split_asm\n apiobject_type.split_asm)\n apply (clarsimp simp: inQ_def)\n apply (auto simp: makeObject_tcb\n split: object_type.splits apiobject_type.splits)\n done\n\nlemma createNewCaps_valid_queues:\n \"\\valid_queues and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues\\\"\napply (rule hoare_gen_asm)\napply (wp valid_queues_lift_asm createNewCaps_obj_at2[where sz=sz])\napply (clarsimp simp: projectKO_opts_defs)\napply (simp add: inQ_def)\napply (wp createNewCaps_pred_tcb_at'[where sz=sz] | simp)+\ndone\n\nlemma mapM_x_threadSet_valid_pspace:\n \"\\valid_pspace' and K (curdom \\ maxDomain)\\\n mapM_x (threadSet (tcbDomain_update (\\_. curdom))) addrs \\\\y. valid_pspace'\\\"\n apply (rule hoare_gen_asm)\n apply (wp mapM_x_wp' threadSet_valid_pspace')\n apply simp_all\n done\n\nlemma createNewCaps_valid_pspace:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0 \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s \\ ksCurDomain s \\ maxDomain\\\n createNewCaps ty ptr n us dev \\\\r. valid_pspace'\\\"\n unfolding createNewCaps_def Arch_createNewCaps_def\n using valid_obj_makeObject_rules\n apply (clarsimp simp: ARM_HYP_H.toAPIType_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp, clarsimp)\n apply (insert cover)\n apply (wp createObjects_valid_pspace_untyped' [OF _ not_0 , where ty=\"Inr ty\" and sz = sz]\n mapM_x_threadSet_valid_pspace mapM_x_wp'\n | simp add: makeObjectKO_def archObjSize_def APIType_capBits_def\n objBits_simps vspace_bits_defs not_0\n createObjects_def curDomain_def\n | intro conjI impI\n | simp add: power_add field_simps)+\n done\n\nlemma copyGlobalMappings_inv[wp]:\n \"\\\\s. P (ksMachineState s)\\\n copyGlobalMappings newPD\n \\\\_ s. P (ksMachineState s)\\\"\n by (simp add: copyGlobalMappings_def storePDE_def split_def\n | wp mapM_x_wp_inv setObject_ksMachine updateObject_default_inv)+\n\nlemma doMachineOp_return_foo:\n \"doMachineOp (do x\\a;return () od) = (do (doMachineOp a); return () od)\"\n apply (clarsimp simp: doMachineOp_def bind_def gets_def\n get_def return_def select_f_def split_def simpler_modify_def)\n apply (rule ext)+\n apply simp\n apply (rule set_eqI)\n apply clarsimp\n done\n\nlemma doMachineOp_mapM_x_wp:\n assumes empty_fail:\"\\x. empty_fail (f x)\"\n assumes valid: \"\\z. \\P\\ doMachineOp (f z) \\\\y. P\\\"\n shows \"\\P\\ doMachineOp (mapM_x f xs) \\\\y. P\\\"\n apply (clarsimp simp: mapM_x_mapM doMachineOp_return_foo)\n apply (subst doMachineOp_mapM)\n apply (wp valid empty_fail mapM_wp' | simp)+\n done\n\n\nlemma createNewCaps_vms:\n \"\\pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and\n K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) and\n valid_machine_state'\\\n createNewCaps ty ptr n us dev\n \\\\archCaps. valid_machine_state'\\\"\n apply (clarsimp simp: valid_machine_state'_def pointerInDeviceData_def\n Arch_createNewCaps_def createNewCaps_def pointerInUserData_def\n typ_at'_def createObjects_def doMachineOp_return_foo\n split del: if_split)\n apply (rule hoare_pre)\n apply (wpc\n | wp hoare_vcg_const_Ball_lift hoare_vcg_disj_lift\n hoare_vcg_all_lift\n doMachineOp_ko_wp_at' createObjects_orig_ko_wp_at2'[where sz = sz]\n hoare_vcg_all_lift\n doMachineOp_mapM_x_wp dmo_lift' mapM_x_wp' copyGlobalMappings_ko_wp_at threadSet_ko_wp_at2'\n | clarsimp simp: createObjects_def Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split\n | assumption)+\n apply (case_tac ty)\n apply (auto simp: APIType_capBits_def archObjSize_def objBits_simps vspace_bits_defs\n ARM_HYP_H.toAPIType_def object_type.splits)\n done\n\nlemma createObjects_pspace_domain_valid':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects' ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects'_def split_def unless_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp only: alignError_def haskell_assert_def)+\n apply (clarsimp simp: new_cap_addrs_fold' unat_1_0 unat_gt_0\n range_cover_not_zero_shift\n caps_overlap_reserved'_def)\n apply (simp add: pspace_domain_valid_def foldr_upd_app_if\n fun_upd_def[symmetric])\n apply (subgoal_tac \" \\x \\ set (new_cap_addrs (unat (of_nat n << gbits)) ptr\n val). {x..x + 2 ^ objBitsKO val - 1}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply blast\n\n apply (rule ballI)\n apply (rule new_range_subset)\n apply (erule range_cover_rel, simp+)\n apply (simp add: range_cover.unat_of_nat_n_shift field_simps)\n done\n\nlemma createObjects_pspace_domain_valid:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_pspace_domain_valid'[where sz=sz])\n apply (simp add: objBits_def)\n done\n\ncrunches copyGlobalMappings, doMachineOp\n for pspace_domain_valid[wp]: \"pspace_domain_valid\"\n (wp: crunch_wps)\n\nlemma createNewCaps_pspace_domain_valid[wp]:\n \"\\pspace_domain_valid and K ({ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\n \\ kernel_data_refs = {}\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\rv. pspace_domain_valid\\\"\n apply (simp add: createNewCaps_def)\n apply (rule hoare_pre)\n apply (wp createObjects_pspace_domain_valid[where sz=sz]\n mapM_x_wp'\n | wpc | simp add: Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split)+\n apply (simp add: ARM_HYP_H.toAPIType_def\n split: object_type.splits)\n apply (auto simp: objBits_simps APIType_capBits_def\n archObjSize_def vspace_bits_defs)\n done\n\ncrunch cur_domain[wp]: createNewCaps \"\\s. P (ksCurDomain s)\"\n (wp: crunch_wps)\n\n(* FIXME: move *)\nlemma ct_idle_or_in_cur_domain'_lift_futz:\n assumes a: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes b: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n assumes c: \"\\P. \\\\s. P (ksIdleThread s)\\ f \\\\_ s. P (ksIdleThread s)\\\"\n assumes d: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes e: \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t\\\"\n shows \"\\ct_idle_or_in_cur_domain' and ct_active' and Q\\ f \\\\_. ct_idle_or_in_cur_domain'\\\"\nproof -\n from e have e':\n \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. d = tcbDomain tcb) t\\\"\n apply (rule hoare_strengthen_post)\n apply (auto simp: obj_at'_def)\n done\n show ?thesis\n apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (rule hoare_pre)\n apply (wps a b c d)\n apply (wp static_imp_wp e' hoare_vcg_disj_lift)\n apply (auto simp: obj_at'_def ct_in_state'_def projectKOs st_tcb_at'_def)\n done\nqed\n\nlemma createNewCaps_ct_idle_or_in_cur_domain':\n \"\\ct_idle_or_in_cur_domain' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and ct_active' and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) \\\n createNewCaps ty ptr n us dev\n \\\\rv. ct_idle_or_in_cur_domain'\\\"\napply (wp ct_idle_or_in_cur_domain'_lift_futz createNewCaps_obj_at'[where sz=sz] | simp)+\ndone\n\nlemma sch_act_wf_lift_asm_futz:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\\n f\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (frule use_valid [OF _ ksA])\n prefer 2\n apply assumption\n apply (frule_tac P1=\"(=) (ksCurThread s)\" in use_valid [OF _ kCT])\n apply (rule refl)\n apply (frule_tac P1=\"(=) (ksCurDomain s)\" in use_valid [OF _ kCD])\n apply (rule refl)\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply simp\n apply (rename_tac word)\n apply (subgoal_tac \"(obj_at' (\\tcb. runnable' (tcbState tcb) \\ ksCurDomain b = tcbDomain tcb) word and Q) s\")\n apply (drule use_valid [OF _ tcbDomain], fastforce)\n apply (auto simp: st_tcb_at'_def o_def obj_at'_def ko_wp_at'_def)\n done\n\nlemma createNewCaps_sch_act_wf:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\_ s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (wp sch_act_wf_lift_asm_futz\n createNewCaps_pred_tcb_at'[where sz=sz]\n createNewCaps_obj_at'[where sz=sz]\n | simp)+\n done\n\nlemma createObjects'_ksDomSchedule[wp]:\n \"\\\\s. P (ksDomSchedule s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomSchedule s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\nlemma createObjects'_ksDomScheduleIdx[wp]:\n \"\\\\s. P (ksDomScheduleIdx s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomScheduleIdx s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\ncrunch ksDomSchedule[wp]: copyGlobalMappings \"\\s. P (ksDomSchedule s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\ncrunch ksDomSchedule[wp]: createNewCaps \"\\s. P (ksDomSchedule s)\"\n (wp: mapM_x_wp' simp: crunch_simps)\n\ncrunch ksDomScheduleIdx[wp]: createNewCaps \"\\s. P (ksDomScheduleIdx s)\"\n (wp: mapM_x_wp' simp: crunch_simps)\n\nlemma createObjects_null_filter':\n \"\\\\s. P (null_filter' (ctes_of s)) \\ makeObjectKO dev ty = Some val \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\addrs a. P (null_filter' (ctes_of a))\\\"\n apply (clarsimp simp: createObjects'_def split_def)\n apply (wp unless_wp|wpc\n | clarsimp simp:haskell_assert_def alignError_def\n split del: if_splits simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp\n apply assumption\n apply simp\n apply (subst data_map_insert_def[symmetric])+\n apply (frule(2) retype_aligned_distinct'[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule(2) retype_aligned_distinct'(2)[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule null_filter_ctes_retype\n [where addrs = \"(new_cap_addrs (unat (((of_nat n)::word32) << gbits)) ptr val)\"])\n apply assumption+\n apply (clarsimp simp:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n range_cover.unat_of_nat_shift)+\n apply (rule new_cap_addrs_aligned[THEN bspec])\n apply (erule range_cover.aligned[OF range_cover_rel])\n apply simp+\n apply (clarsimp simp:shiftl_t2n field_simps range_cover.unat_of_nat_shift)\n apply (drule subsetD[OF new_cap_addrs_subset,rotated])\n apply (erule range_cover_rel)\n apply simp\n apply simp\n apply (rule ccontr)\n apply clarify\n apply (frule(1) pspace_no_overlapD')\n apply (erule_tac B = \"{x..x+2^objBitsKO y - 1}\" in in_empty_interE[rotated])\n apply (drule(1) pspace_alignedD')\n apply (clarsimp)\n apply (erule is_aligned_no_overflow)\n apply (simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff add:Int_ac ptr_add_def p_assoc_help)\n apply (simp add:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n)\n apply auto\n done\n\nlemma createNewCaps_null_filter':\n \"\\(\\s. P (null_filter' (ctes_of s)))\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\_ s. P (null_filter' (ctes_of s))\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createNewCaps_def toAPIType_def\n Arch_createNewCaps_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp,simp)\n apply (simp add: createObjects_def makeObjectKO_def\n APIType_capBits_def objBits_def\n archObjSize_def vspace_bits_defs curDomain_def\n objBits_if_dev\n split del: if_split\n | wp createObjects_null_filter'[where ty = \"Inr ty\" and sz = sz and dev=dev]\n copyGlobalMappings_ctes_of threadSet_ctes_of mapM_x_wp'\n | simp add: objBits_simps\n | fastforce)+\n done\n\ncrunch gsUntypedZeroRanges[wp]: createNewCaps \"\\s. P (gsUntypedZeroRanges s)\"\n (wp: crunch_wps simp: crunch_simps unless_def)\n\nlemma untyped_ranges_zero_inv_null_filter:\n \"untyped_ranges_zero_inv (option_map cteCap o null_filter' ctes)\n = untyped_ranges_zero_inv (option_map cteCap o ctes)\"\n apply (simp add: untyped_ranges_zero_inv_def fun_eq_iff null_filter'_def)\n apply clarsimp\n apply (rule_tac f=\"\\caps. x = ran caps\" for caps in arg_cong)\n apply (clarsimp simp: fun_eq_iff map_comp_def untypedZeroRange_def)\n done\n\nlemma untyped_ranges_zero_inv_null_filter_cteCaps_of:\n \"untyped_ranges_zero_inv (cteCaps_of s)\n = untyped_ranges_zero_inv (option_map cteCap o null_filter' (ctes_of s))\"\n by (simp add: untyped_ranges_zero_inv_null_filter cteCaps_of_def)\n\nlemma createNewCaps_urz:\n \"\\untyped_ranges_zero'\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\archCaps. untyped_ranges_zero'\\\"\n apply (simp add: untyped_ranges_zero_inv_null_filter_cteCaps_of)\n apply (rule hoare_pre)\n apply (rule untyped_ranges_zero_lift)\n apply (wp createNewCaps_null_filter')+\n apply (auto simp: o_def)\n done\n\nlemma createNewCaps_invs':\n \"\\(\\s. invs' s \\ ct_active' s \\ pspace_no_overlap' ptr sz s\n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s\n \\ (ty = APIObjectType ArchTypes_H.CapTableObject \\ us > 0)\n \\ gsMaxObjectSize s > 0)\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n (is \"\\?P and K ?Q\\ ?f \\\\rv. invs'\\\")\nproof (rule hoare_gen_asm, erule conjE)\n assume cover: \"range_cover ptr sz (APIType_capBits ty us) n\" and not_0: \"n \\ 0\"\n have cnc_ct_not_inQ:\n \"\\ct_not_inQ and valid_pspace' and pspace_no_overlap' ptr sz\\\n createNewCaps ty ptr n us dev \\\\_. ct_not_inQ\\\"\n unfolding ct_not_inQ_def\n apply (rule_tac Q=\"\\s. ksSchedulerAction s = ResumeCurrentThread\n \\ (obj_at' (Not \\ tcbQueued) (ksCurThread s) s\n \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createNewCaps_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createNewCaps_ct)\n apply (wp createNewCaps_obj_at')\n using cover not_0\n apply (fastforce simp: valid_pspace'_def)\n done\n show \"\\?P\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n apply (simp add: invs'_def valid_state'_def\n pointerInUserData_def typ_at'_def)\n apply (rule hoare_pre)\n apply (wp createNewCaps_valid_pspace [OF not_0 cover]\n createNewCaps_state_refs_of' [OF cover not_0 ]\n createNewCaps_state_hyp_refs_of' [OF cover not_0 ]\n createNewCaps_iflive' [OF cover not_0 ]\n irqs_masked_lift\n createNewCaps_ifunsafe'\n createNewCaps_cur [OF cover not_0]\n createNewCaps_global_refs'\n createNewCaps_valid_arch_state\n valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createNewCaps_obj_at']\n createNewCaps_irq_handlers' createNewCaps_vms\n createNewCaps_valid_queues\n createNewCaps_valid_queues'\n createNewCaps_pred_tcb_at' cnc_ct_not_inQ\n createNewCaps_ct_idle_or_in_cur_domain'\n createNewCaps_sch_act_wf\n createNewCaps_urz[where sz=sz]\n | simp)+\n using not_0\n apply (clarsimp simp: valid_pspace'_def)\n using cover\n apply (intro conjI)\n apply simp_all\n done\nqed\n\nlemma createObjects_obj_ranges':\n \"\\\\s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {}) \\\n pspace_no_overlap' ptr sz s \\\n pspace_aligned' s \\ pspace_distinct' s \\\n S \\ {ptr..(ptr &&~~ mask sz) + 2^sz - 1} = {} \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects' ptr n val gbits\n \\\\r s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {})\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del: fun_upd_apply)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (clarsimp simp: foldr_fun_upd_value)\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (erule(1) disjoint_subset[OF obj_range'_subset])\n apply (simp add: Int_commute)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_pred_tcb_at':\n \"\\pred_tcb_at' proj P t and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\\\n createObjects ptr n val gbits \\\\rv. pred_tcb_at' proj P t\\\"\n apply (simp add: pred_tcb_at'_def createObjects_def)\n apply (wp createObjects_orig_obj_at')\n apply auto\n done\n\nlemma createObjects_ex_cte_cap_to [wp]:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\ pspace_aligned' s \\\n pspace_distinct' s \\ ex_cte_cap_to' p s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. ex_cte_cap_to' p\\\"\n apply (simp add: ex_cte_cap_to'_def createObjects_def)\n apply (rule hoare_lift_Pf2 [where f=\"irq_node'\"])\n apply (wp hoare_vcg_ex_lift createObjects_orig_cte_wp_at'[where sz = sz])\n apply simp\n apply wp\n done\n\nlemma createObjects_orig_obj_at3:\n \"\\\\s. obj_at' P p s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. obj_at' P p\\\"\n by (wp createObjects_orig_obj_at'[where sz = sz] | simp add: createObjects_def)+\n\nlemma createObjects_sch:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects ptr n val gbits\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (rule hoare_gen_asm)\n apply (wp sch_act_wf_lift_asm createObjects_pred_tcb_at' createObjects_orig_obj_at3 | force)+\n done\n\nlemma createObjects_queues:\n \"\\\\s. valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects ptr n val gbits\n \\\\rv. valid_queues\\\"\n apply (wp valid_queues_lift_asm [unfolded pred_conj_def, OF createObjects_orig_obj_at3]\n createObjects_pred_tcb_at' [unfolded pred_conj_def])\n apply fastforce\n apply wp+\n apply fastforce\n done\n\nlemma createObjects_queues':\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_queues' s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects ptr n val gbits\n \\\\rv. valid_queues'\\\"\n apply (simp add: createObjects_def)\n apply (wp valid_queues_lift_asm')\n apply (wp createObjects_orig_obj_at2')\n apply clarsimp\n apply assumption\n apply wp\n apply (clarsimp simp: no_tcb split: option.splits)\n apply fastforce\n done\n\nlemma createObjects_no_cte_ifunsafe':\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createObjects ptr n val gbits\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createObjects_ksInterrupt])\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_imp_lift\n createObjects_orig_cte_wp_at2' hoare_vcg_ex_lift)\n apply (simp add: valid_pspace'_def disj_imp)\n apply (simp add: split_def no_cte no_tcb split: option.splits)\n apply auto\n done\n\nlemma createObjects_no_cte_valid_global:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_global_refs' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_global_refs' s\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createObjects_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createObjects_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createObjects_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift createObjects_orig_cte_wp_at2')\n apply (simp add: no_cte no_tcb split_def cte_wp_at_ctes_of split: option.splits)\n apply (clarsimp simp: global_refs'_def)\n apply (auto simp: ball_ran_eq linorder_not_less[symmetric])\n done\n\nlemma createObjects'_typ_at:\n \"\\\\s. n \\ 0 \\\n range_cover ptr sz (objBitsKO val + gbits) n \\\n typ_at' T p s \\\n pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. typ_at' T p s\\\"\n apply (rule hoare_grab_asm)+\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def typ_at'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])\n apply clarsimp\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add: lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp: ptr_add_def p_assoc_help)\n apply (simp add: dom_def)\n apply (fastforce simp: ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_valid_arch:\n \"\\\\s. valid_arch_state' s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n createObjects ptr n val gbits\n \\\\rv s. valid_arch_state' s\\\"\n apply (simp add: valid_arch_state'_def valid_asid_table'_def page_directory_at'_def\n valid_global_pts'_def page_table_at'_def createObjects_def)\n apply (wp createObjects'_typ_at hoare_vcg_all_lift createObjects'_typ_at hoare_vcg_imp_lift\n createObjects_orig_ko_wp_at2'\n | clarsimp split: option.splits)+\n apply (simp add: o_def; auto simp: pred_conj_def)+\n done\n\nlemma createObjects_irq_state:\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_node' (irq_node' s) s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_node' (irq_node' s) s\\\"\n apply (wp valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createObjects_orig_obj_at3])\n apply auto\n done\n\nlemma createObjects_no_cte_irq_handlers:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_handlers' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_handlers' s\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' createObjects_def irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createObjects_orig_cte_wp_at2')\n apply (clarsimp simp: no_cte no_tcb split_def split: option.splits)\n apply auto\n done\n\nlemma createObjects_cur':\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n cur_tcb' s\\\n createObjects ptr n val gbits\n \\\\rv s. cur_tcb' s\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createObjects_orig_obj_at3)\n apply (clarsimp simp: cur_tcb'_def)\n apply auto\n done\n\nlemma createObjects_vms'[wp]:\n \"\\(\\_. (range_cover ptr sz (objBitsKO val + gbits) n \\ 0 < n)) and pspace_aligned' and\n pspace_distinct' and pspace_no_overlap' ptr sz and valid_machine_state'\\\n createObjects ptr n val gbits\n \\\\rv. valid_machine_state'\\\"\n apply (simp add: valid_machine_state'_def pointerInUserData_def pointerInDeviceData_def\n typ_at'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift createObjects_orig_ko_wp_at2'\n | simp add: createObjects_def)+\n apply auto\n done\n\nlemma createObjects_ct_idle_or_in_cur_domain':\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and ct_idle_or_in_cur_domain'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. ct_idle_or_in_cur_domain'\\\"\napply (rule hoare_gen_asm)\napply (wp ct_idle_or_in_cur_domain'_lift_futz createObjects_obj_at_other[where sz=sz])\napply simp_all\ndone\n\nlemma untyped_zero_ranges_cte_def:\n \"untyped_ranges_zero_inv (cteCaps_of s) rs\n = (\\r. (\\p. cte_wp_at' (\\cte. untypedZeroRange (cteCap cte) = Some r) p s)\n = (r \\ rs))\"\n apply (clarsimp simp: untyped_ranges_zero_inv_def cte_wp_at_ctes_of\n cteCaps_of_def set_eq_iff ran_def map_comp_Some_iff)\n apply (safe, metis+)\n done\n\ncrunch gsUntypedZeroRanges[wp]: createObjects \"\\s. P (gsUntypedZeroRanges s)\"\n (simp: unless_def)\n\nlemma createObjects_untyped_ranges_zero':\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n shows\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and untyped_ranges_zero'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. untyped_ranges_zero'\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: untyped_zero_ranges_cte_def iff_conv_conj_imp\n createObjects_def)\n apply (simp only: imp_conv_disj not_all not_ex)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_conj_lift\n hoare_vcg_disj_lift createObjects_orig_cte_wp_at2'[where sz=sz])\n apply (clarsimp simp: valid_pspace'_def)\n apply (cut_tac moKO[symmetric])\n apply (simp add: makeObjectKO_def projectKO_opt_tcb projectKO_opt_cte\n split: sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n object_type.split_asm apiobject_type.split_asm)\n apply (simp add: makeObject_tcb tcb_cte_cases_def makeObject_cte\n untypedZeroRange_def)\n apply (simp add: makeObject_cte untypedZeroRange_def)\n done\n\nlemma createObjects_no_cte_invs:\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. range_cover ptr sz ((objBitsKO val) + gbits) n \\ n \\ 0 \\ invs' s \\ ct_active' s\n \\ pspace_no_overlap' ptr sz s \\ ptr \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ caps_overlap_reserved' {ptr..ptr + of_nat (n * 2 ^ gbits * 2 ^ objBitsKO val) - 1} s\n \\ caps_no_overlap'' ptr sz s \\\n refs_of' val = {} \\ hyp_refs_of' val = {} \\ \\ live' val\n \\ (\\pde. projectKO_opt val = Some pde \\ pde = InvalidPDE)\\\n createObjects ptr n val gbits\n \\\\rv. invs'\\\"\nproof -\n have co_ct_not_inQ:\n \"\\range_cover ptr sz ((objBitsKO val) + gbits) n; n \\ 0\\ \\\n \\\\s. ct_not_inQ s \\ pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n val gbits \\\\_. ct_not_inQ\\\"\n (is \"\\ _; _ \\ \\ \\\\s. ct_not_inQ s \\ ?REST s\\ _ \\_\\\")\n apply (simp add: ct_not_inQ_def)\n apply (rule_tac Q=\"\\s. (ksSchedulerAction s = ResumeCurrentThread) \\\n (obj_at' (Not \\ tcbQueued) (ksCurThread s) s \\ ?REST s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createObjects_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createObjects_ct)\n apply (wp createObjects_obj_at_other)\n apply (simp)+\n done\n show ?thesis\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: invs'_def valid_state'_def)\n apply wp\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def,wp createObjects_valid_pspace_untyped')\n apply (wp assms | simp add: objBits_def)+\n apply (wp createObjects_sch createObjects_queues)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_state_refs_of'')\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_state_hyp_refs_of'')\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_iflive')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb]\n assms | simp add: objBits_def )+\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_idle')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb] assms\n createObjects_pspace_domain_valid co_ct_not_inQ\n createObjects_ct_idle_or_in_cur_domain'\n createObjects_untyped_ranges_zero'[OF moKO]\n | simp)+\n apply clarsimp\n apply (simp add: conj_comms)\n apply ((intro conjI; assumption?); simp add: valid_pspace'_def objBits_def)\n apply (fastforce simp add: no_cte no_tcb split_def split: option.splits)\n apply (clarsimp simp: invs'_def no_tcb valid_state'_def no_cte split: option.splits)\n done\nqed\n\nlemma corres_retype_update_gsI:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"sz < obj_bits_api (APIType_map2 ty) us \\\n sz < objBitsKO ko + gbits\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and f: \"f = update_gs (APIType_map2 ty) us\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (f (set addrs));\n return (g addrs)\n od)\"\n using corres_retype' [OF not_zero aligned obj_bits_api check usv ko orr cover]\n by (simp add: f)\n\nlemma gcd_corres: \"corres (=) \\ \\ (gets cur_domain) curDomain\"\n by (simp add: curDomain_def state_relation_def)\n\nlemma retype_region2_extra_ext_mapM_x_corres:\n shows \"corres dc\n (valid_etcbs and (\\s. \\addr\\set addrs. tcb_at addr s))\n (\\s. \\addr\\set addrs. tcb_at' addr s)\n (retype_region2_extra_ext addrs Structures_A.apiobject_type.TCBObject)\n (mapM_x (\\addr. do cdom \\ curDomain;\n threadSet (tcbDomain_update (\\_. cdom)) addr\n od)\n addrs)\"\n apply (rule corres_guard_imp)\n apply (simp add: retype_region2_extra_ext_def curDomain_mapM_x_futz[symmetric] when_def)\n apply (rule corres_split_eqr[OF gcd_corres])\n apply (rule_tac S=\"Id \\ {(x, y). x \\ set addrs}\"\n and P=\"\\s. (\\t \\ set addrs. tcb_at t s) \\ valid_etcbs s\"\n and P'=\"\\s. \\t \\ set addrs. tcb_at' t s\"\n in corres_mapM_x)\n apply simp\n apply (rule corres_guard_imp)\n apply (rule ethread_set_corres, simp_all add: etcb_relation_def non_exst_same_def)[1]\n apply (case_tac tcb')\n apply simp\n apply fastforce\n apply fastforce\n apply (wp hoare_vcg_ball_lift | simp)+\n apply auto[1]\n apply (wp | simp add: curDomain_def)+\n done\n\nlemma retype_region2_extra_ext_trivial:\n \"ty \\ APIType_map2 (Inr (APIObjectType apiobject_type.TCBObject))\n \\ retype_region2_extra_ext ptrs ty = return ()\"\nby (simp add: retype_region2_extra_ext_def when_def APIType_map2_def)\n\nlemma retype_region2_ext_retype_region_ArchObject_PageDirectoryObj:\n \"retype_region ptr n us (APIType_map2 (Inr PageDirectoryObject)) dev =\n (retype_region2 ptr n us (APIType_map2 (Inr PageDirectoryObject)) dev :: obj_ref list det_ext_monad)\"\nby (simp add: retype_region2_ext_retype_region retype_region2_extra_ext_def when_def APIType_map2_def)\n\nlemma retype_region2_valid_etcbs[wp]:\"\\valid_etcbs\\ retype_region2 a b c d dev \\\\_. valid_etcbs\\\"\n apply (simp add: retype_region2_def)\n apply (simp add: retype_region2_ext_def bind_assoc)\n apply wp\n apply (clarsimp simp del: fun_upd_apply)\n apply (blast intro: valid_etcb_fold_update)\n done\n\nlemma retype_region2_obj_at:\n assumes tytcb: \"ty = Structures_A.apiobject_type.TCBObject\"\n shows \"\\\\\\ retype_region2 ptr n us ty dev \\\\rv s. \\x \\ set rv. tcb_at x s\\\"\n using tytcb unfolding retype_region2_def\n apply (simp only: return_bind bind_return foldr_upd_app_if fun_app_def K_bind_def)\n apply (wp dxo_wp_weak | simp)+\n apply (auto simp: obj_at_def default_object_def is_tcb_def)\n done\n\nlemma createObjects_tcb_at':\n \"\\range_cover ptr sz (objBitsKO (injectKOS (makeObject::tcb))) n; n \\ 0\\ \\\n \\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n (KOTCB makeObject) 0 \\\\ptrs s. \\addr\\set ptrs. tcb_at' addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where val = \"(makeObject :: tcb)\"]])\n apply (auto simp: obj_at'_def projectKOs project_inject objBitsKO_def objBits_def makeObject_tcb)\n done\n\nlemma init_arch_objects_APIType_map2_noop:\n \"tp \\ Inr PageDirectoryObject\n \\ init_arch_objects (APIType_map2 tp) ptr n m addrs\n = return ()\"\n apply (simp add: init_arch_objects_def APIType_map2_def)\n apply (cases tp, simp_all split: kernel_object.split arch_kernel_object.split\n object_type.split apiobject_type.split)\n done\n\nlemma data_page_relation_retype:\n \"obj_relation_retype (ArchObj (DataPage False pgsz)) KOUserData\"\n \"obj_relation_retype (ArchObj (DataPage True pgsz)) KOUserDataDevice\"\n apply (simp_all add: obj_relation_retype_def\n objBits_simps archObjSize_def\n pbfs_atleast_pageBits)\n apply (clarsimp simp: image_def)+\n done\n\nlemma corres_retype_region_createNewCaps:\n \"corres ((\\r r'. length r = length r' \\ list_all2 cap_relation r r')\n \\ map (\\ref. default_cap (APIType_map2 (Inr ty)) ref us dev))\n (\\s. valid_pspace s \\ valid_mdb s \\ valid_etcbs s \\ valid_list s \\ valid_arch_state s\n \\ caps_no_overlap y sz s \\ pspace_no_overlap_range_cover y sz s\n \\ caps_overlap_reserved {y..y + of_nat n * 2 ^ (obj_bits_api (APIType_map2 (Inr ty)) us) - 1} s\n \\ (\\slot. cte_wp_at (\\c. up_aligned_area y sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n \\ (APIType_map2 (Inr ty) = Structures_A.CapTableObject \\ 0 < us))\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' y sz s\n \\ valid_pspace' s \\ valid_arch_state' s\n \\ range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \\ n\\ 0)\n (do x \\ retype_region y n us (APIType_map2 (Inr ty)) dev :: obj_ref list det_ext_monad;\n init_arch_objects (APIType_map2 (Inr ty)) y n us x;\n return x od)\n (createNewCaps ty y n us dev)\"\n apply (rule_tac F=\"range_cover y sz\n (obj_bits_api (APIType_map2 (Inr ty)) us) n \\\n n \\ 0 \\\n (APIType_map2 (Inr ty) = Structures_A.CapTableObject\n \\ 0 < us)\"\n in corres_req, simp)\n apply (clarsimp simp add: createNewCaps_def toAPIType_def\n split del: if_split cong: if_cong)\n apply (subst init_arch_objects_APIType_map2)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n \\ \\Untyped\\\n apply (simp add: retype_region_def obj_bits_api_def\n APIType_map2_def\n split del: if_split\n cong: if_cong)\n apply (subst upto_enum_red')\n apply (drule range_cover_not_zero[rotated])\n apply simp\n apply unat_arith\n apply (clarsimp simp: list_all2_same enum_word_def range_cover.unat_of_nat_n\n list_all2_map1 list_all2_map2\n ptr_add_def fromIntegral_def toInteger_nat fromInteger_nat)\n apply (subst unat_of_nat_minus_1)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def)\n apply (arith+)[4]\n \\ \\TCB, EP, NTFN\\\n defer 10\n apply (simp_all add: retype_region2_ext_retype_region bind_cong[OF curDomain_mapM_x_futz refl, unfolded bind_assoc]\n split del: if_split)[10] (* not PageDirectoryObject *)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (rule corres_retype[where 'a = tcb],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply (rule corres_split_nor)\n apply (simp add: APIType_map2_def)\n apply (rule retype_region2_extra_ext_mapM_x_corres)\n apply (rule corres_trivial, simp)\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n apply wp\n apply wp\n apply ((wp retype_region2_obj_at | simp add: APIType_map2_def)+)[1]\n apply ((wp createObjects_tcb_at'[where sz=sz] | simp add: APIType_map2_def objBits_simps' obj_bits_api_def)+)[1]\n apply simp\n apply simp\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = endpoint],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = notification],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n \\ \\CapTable\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (subst bind_assoc_return_reverse[of \"createObjects y n (KOCTE makeObject) us\"])\n apply (subst liftM_def\n [of \"map (\\addr. capability.CNodeCap addr us 0 0)\", symmetric])\n apply simp\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def\n APIType_map2_def makeObjectKO_def slot_bits_def\n field_simps ext)[1]\n apply (simp add: range_cover_def)\n apply (rule captable_relation_retype,simp add: range_cover_def word_bits_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps allRights_def APIType_map2_def\n split del: if_split)\n \\ \\SmallPageObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\LargePageObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\SectionObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\SuperSectionObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\PageTable\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp_all add: corres_liftM2_simp[unfolded liftM_def])\n apply (rule corres_guard_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop)\n apply (rule corres_rel_imp)\n apply (rule corres_retype[where 'a =pte],\n simp_all add: APIType_map2_def obj_bits_api_def\n default_arch_object_def objBits_simps\n archObjSize_def vspace_bits_defs\n makeObjectKO_def range_cover.aligned)[1]\n apply (rule pagetable_relation_retype)\n apply (wp | simp)+\n apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same\n APIType_map2_def arch_default_cap_def)\n apply simp+\n defer\n \\ \\PageDirectory\\\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (rule corres_retype[where ty = \"Inr PageDirectoryObject\" and 'a = pde\n , simplified, folded retype_region2_ext_retype_region_ArchObject_PageDirectoryObj],\n simp_all add: APIType_map2_def obj_bits_api_def\n default_arch_object_def objBits_simps\n archObjSize_def vspace_bits_defs\n makeObjectKO_def)[1]\n apply (simp add: range_cover_def)+\n apply (rule pagedirectory_relation_retype)\n apply (simp add: init_arch_objects_def APIType_map2_def\n bind_assoc)\n apply (rule corres_split_nor)\n apply (simp add: mapM_x_mapM)\n apply (rule corres_underlying_split[where r' = dc])\n apply (rule_tac Q=\"\\xs s. (\\x \\ set xs. page_directory_at x s)\n \\ valid_arch_state s \\ pspace_aligned s \\ valid_etcbs s\"\n and Q'=\"\\xs s. (\\x \\ set xs. page_directory_at' x s) \\ valid_arch_state' s\"\n in corres_mapM_list_all2[where r'=dc and S=\"(=)\"])\n apply simp+\n apply (rule corres_guard_imp, rule copyGlobalMappings_corres)\n apply simp+\n apply (wp hoare_vcg_const_Ball_lift | simp)+\n apply (simp add: list_all2_same)\n apply (rule corres_return[where P =\\ and P'=\\,THEN iffD2])\n apply simp\n apply wp+\n apply (simp add: liftM_def[symmetric] o_def list_all2_map1\n list_all2_map2 list_all2_same\n arch_default_cap_def mapM_x_mapM)\n apply (simp add: dc_def[symmetric])\n apply (rule corres_machine_op)\n apply (rule corres_Id)\n apply (simp add: shiftl_t2n shiftL_nat\n vspace_bits_defs)\n apply simp\n apply (simp add: mapM_discarded[where g = \"return ()\",simplified,symmetric])\n apply (rule no_fail_pre)\n apply (wp no_fail_mapM|clarsimp)+\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule hoare_vcg_conj_lift)\n apply (rule retype_region_obj_at)\n apply (simp add: APIType_map2_def)\n apply (subst APIType_map2_def, simp)\n apply (rule retype_region_ret)\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def APIType_map2_def\n default_arch_object_def default_object_def)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (wp retype_region_valid_arch retype_region_aligned|simp)+\n apply (clarsimp simp: objBits_simps retype_addrs_def obj_bits_api_def\n APIType_map2_def default_arch_object_def default_object_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ko_at[where sz = sz and 'a = pde])\n apply (simp add: objBits_simps archObjSize_def vspace_bits_defs\n page_directory_at'_def)+\n apply (simp add: projectKOs)\n apply (rule createObjects_aligned)\n apply (simp add: objBits_simps archObjSize_def vspace_bits_defs\n page_directory_at'_def)+\n apply (simp add: range_cover_def)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def word_bits_def)\n apply arith+\n apply (simp add: objBits_simps archObjSize_def vspace_bits_defs\n page_directory_at'_def)+\n apply (simp add: range_cover_def word_bits_def)\n apply clarsimp\n apply (drule (1) bspec)+\n apply (simp add: objBits_simps retype_addrs_def obj_bits_api_def vspace_bits_defs\n APIType_map2_def default_arch_object_def default_object_def\n archObjSize_def)\n apply (clarsimp simp: objBits_simps archObjSize_def vspace_bits_defs\n page_directory_at'_def)\n apply (drule_tac x = ya in spec)\n apply (clarsimp simp:typ_at'_def obj_at'_real_def)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp: projectKOs)\n apply (wp createObjects_valid_arch)\n apply (auto simp: objBits_simps retype_addrs_def obj_bits_api_def\n APIType_map2_def default_arch_object_def default_object_def archObjSize_def\n vspace_bits_defs fromIntegral_def toInteger_nat fromInteger_nat)[2]\n \\ \\VCPUObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = vcpu],\n simp_all add: obj_bits_api_def objBits_simps pageBits_def default_arch_object_def\n APIType_map2_def makeObjectKO_def archObjSize_def vcpu_bits_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply (simp add: no_gs_types_def)\n apply (auto simp add: obj_relation_retype_def range_cover_def objBitsKO_def arch_kobj_size_def default_object_def\n archObjSize_def vcpu_bits_def pageBits_def obj_bits_def cte_level_bits_def default_arch_object_def\n other_obj_relation_def vcpu_relation_def default_vcpu_def makeObject_vcpu\n makeVCPUObject_def default_gic_vcpu_interface_def vgic_map_def)[1]\n apply simp+\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def arch_default_cap_def)\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/ARM_HYP/Retype_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.32766828768970435, "lm_q1q2_score": 0.18168238782809742}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__40_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__40_on_rules imports n_germanSymIndex_lemma_on_inv__40\nbegin\nsection{*All lemmas on causal relation between inv__40*}\nlemma lemma_inv__40_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__40 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__40) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__40) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__40_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.1816363261955486}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__22_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__22_on_rules imports n_german_lemma_on_inv__22\nbegin\nsection{*All lemmas on causal relation between inv__22*}\nlemma lemma_inv__22_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__22) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__22) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__22_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725051, "lm_q2_score": 0.33458944125318596, "lm_q1q2_score": 0.18163632259355855}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__9_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__9_on_rules imports n_german_lemma_on_inv__9\nbegin\nsection{*All lemmas on causal relation between inv__9*}\nlemma lemma_inv__9_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__9) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__9_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.18163631899156868}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__47.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__47 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__47 and some rule r*}\nlemma n_RecvReqVsinv__47:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReq N i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReq N i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv3) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv3) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv3) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__47:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv3) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv3) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__47:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__47:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__47:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__47:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqESVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvSVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvS i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvEVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvE i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__47:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__47:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__47 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__47.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.18160225317702877}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__121.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__121 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__121 and some rule r*}\nlemma n_PI_Remote_GetVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__121:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__121:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__121:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__121:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__121:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__121:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__121:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__121:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__121:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__121:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__121:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__121:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__121:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__121:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__121 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__121:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__121:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__121:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__121:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__121:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__121:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__121:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__121:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__121:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__121:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__121:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__121:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__121:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__121:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__121:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__121:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__121:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__121:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__121:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__121:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__121:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__121:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__121:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__121:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__121.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199008363969, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.18160224793393512}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__100.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__100 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__100 and some rule r*}\nlemma n_PI_Remote_GetVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__100:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__100:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__100:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__100:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__100:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__100:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__100:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__100:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__100:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__100:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__100:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__100:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__100:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__100 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__100:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__100:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__100:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__100:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__100:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__100:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__100:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__100:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__100:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__100:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__100:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__100:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__100:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__100:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__100:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__100:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__100.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3522017684487511, "lm_q1q2_score": 0.18160224616504214}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__15_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__15_on_rules imports n_german_lemma_on_inv__15\nbegin\nsection{*All lemmas on causal relation between inv__15*}\nlemma lemma_inv__15_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__15 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__15) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__15) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__15_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3522017684487511, "lm_q1q2_score": 0.18160224616504214}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__42.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__42 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__42 and some rule r*}\nlemma n_NI_Remote_Get_Nak_HomeVsinv__42:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__42:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__42:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__42:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__42:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__42:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_GetVsinv__42:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__42:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__42:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__42:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__42:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__42:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__42:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__42:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__42 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__42:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__42:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_5Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_3Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__42:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__42:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__42:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__42:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__42:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_6Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__42:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__42:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_11Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__42:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__42:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__42:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__42:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__42:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10Vsinv__42:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8Vsinv__42:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__42:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_2Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__42:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__42:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__42:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__42:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_4Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__42:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" and\n a2: \"(f=inv__42 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__42.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.18112858160085787}} {"text": "(* Title: Jinja/Compiler/J1.thy\n Author: Tobias Nipkow\n Copyright 2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\chapter{Compilation}\\label{cha:comp}\n \\isaheader{An Intermediate Language} *}\n\ntheory J1 imports \"../J/BigStep\" begin\n\ntype_synonym expr\\<^sub>1 = \"nat exp\"\ntype_synonym J\\<^sub>1_prog = \"expr\\<^sub>1 prog\"\ntype_synonym state\\<^sub>1 = \"heap \\ (val list)\"\n\nprimrec\n max_vars :: \"'a exp \\ nat\"\n and max_varss :: \"'a exp list \\ nat\"\nwhere\n \"max_vars(new C) = 0\"\n| \"max_vars(Cast C e) = max_vars e\"\n| \"max_vars(Val v) = 0\"\n| \"max_vars(e\\<^sub>1 \\bop\\ e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(Var V) = 0\"\n| \"max_vars(V:=e) = max_vars e\"\n| \"max_vars(e\\F{D}) = max_vars e\"\n| \"max_vars(FAss e\\<^sub>1 F D e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(e\\M(es)) = max (max_vars e) (max_varss es)\"\n| \"max_vars({V:T; e}) = max_vars e + 1\"\n| \"max_vars(e\\<^sub>1;;e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2)\"\n| \"max_vars(if (e) e\\<^sub>1 else e\\<^sub>2) =\n max (max_vars e) (max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2))\"\n| \"max_vars(while (b) e) = max (max_vars b) (max_vars e)\"\n| \"max_vars(throw e) = max_vars e\"\n| \"max_vars(try e\\<^sub>1 catch(C V) e\\<^sub>2) = max (max_vars e\\<^sub>1) (max_vars e\\<^sub>2 + 1)\"\n\n| \"max_varss [] = 0\"\n| \"max_varss (e#es) = max (max_vars e) (max_varss es)\"\n\ninductive\n eval\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ expr\\<^sub>1 \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) \\/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n and evals\\<^sub>1 :: \"J\\<^sub>1_prog \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ expr\\<^sub>1 list \\ state\\<^sub>1 \\ bool\"\n (\"_ \\\\<^sub>1 ((1\\_,/_\\) [\\]/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n for P :: J\\<^sub>1_prog\nwhere\n\n New\\<^sub>1:\n \"\\ new_Addr h = Some a; P \\ C has_fields FDTs; h' = h(a\\(C,init_fields FDTs)) \\\n \\ P \\\\<^sub>1 \\new C,(h,l)\\ \\ \\addr a,(h',l)\\\"\n| NewFail\\<^sub>1:\n \"new_Addr h = None \\\n P \\\\<^sub>1 \\new C, (h,l)\\ \\ \\THROW OutOfMemory,(h,l)\\\"\n\n| Cast\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(D,fs); P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\\"\n| CastNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\\"\n| CastFail\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,l)\\; h a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\THROW ClassCast,(h,l)\\\"\n| CastThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\Cast C e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Val\\<^sub>1:\n \"P \\\\<^sub>1 \\Val v,s\\ \\ \\Val v,s\\\"\n\n| BinOp\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v\\<^sub>2,s\\<^sub>2\\; binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>2\\\"\n| BinOpThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n| BinOpThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1 \\bop\\ e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>2\\\"\n\n| Var\\<^sub>1:\n \"\\ ls!i = v; i < size ls \\ \\\n P \\\\<^sub>1 \\Var i,(h,ls)\\ \\ \\Val v,(h,ls)\\\"\n\n| LAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,(h,ls)\\; i < size ls; ls' = ls[i := v] \\\n \\ P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\unit,(h,ls')\\\"\n| LAssThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\i:= e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAcc\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,(h,ls)\\; h a = Some(C,fs); fs(F,D) = Some v \\\n \\ P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\Val v,(h,ls)\\\"\n| FAccNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| FAccThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\F{D},s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| FAss\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,(h\\<^sub>2,l\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); fs' = fs((F,D)\\v); h\\<^sub>2' = h\\<^sub>2(a\\(C,fs')) \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\unit,(h\\<^sub>2',l\\<^sub>2)\\\"\n| FAssNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\Val v,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| FAssThrow\\<^sub>1\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| FAssThrow\\<^sub>2\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>1\\F{D}:= e\\<^sub>2,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| CallObjThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| CallNull\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>2\\\"\n| Call\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\map Val vs,(h\\<^sub>2,ls\\<^sub>2)\\;\n h\\<^sub>2 a = Some(C,fs); P \\ C sees M:Ts\\T = body in D;\n size vs = size Ts; ls\\<^sub>2' = (Addr a) # vs @ replicate (max_vars body) undefined;\n P \\\\<^sub>1 \\body,(h\\<^sub>2,ls\\<^sub>2')\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>3)\\ \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\e',(h\\<^sub>3,ls\\<^sub>2)\\\"\n| CallParamsThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\;\n es' = map Val vs @ throw ex # es\\<^sub>2 \\\n \\ P \\\\<^sub>1 \\e\\M(es),s\\<^sub>0\\ \\ \\throw ex,s\\<^sub>2\\\"\n\n| Block\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\ \\ P \\\\<^sub>1 \\Block i T e,s\\<^sub>0\\ \\ \\e',s\\<^sub>1\\\"\n\n| Seq\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e\\<^sub>2,s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\e\\<^sub>2,s\\<^sub>2\\\"\n| SeqThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>0,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e\\<^sub>0;;e\\<^sub>1,s\\<^sub>0\\ \\ \\throw e,s\\<^sub>1\\\"\n\n| CondT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondF\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\; P \\\\<^sub>1 \\e\\<^sub>2,s\\<^sub>1\\ \\ \\e',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2,s\\<^sub>0\\ \\ \\e',s\\<^sub>2\\\"\n| CondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| WhileF\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\false,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\unit,s\\<^sub>1\\\"\n| WhileT\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\Val v\\<^sub>1,s\\<^sub>2\\;\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>2\\ \\ \\e\\<^sub>3,s\\<^sub>3\\ \\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\e\\<^sub>3,s\\<^sub>3\\\"\n| WhileCondThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n| WhileBodyThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\true,s\\<^sub>1\\; P \\\\<^sub>1 \\c,s\\<^sub>1\\ \\ \\throw e',s\\<^sub>2\\\\\n \\ P \\\\<^sub>1 \\while (e) c,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>2\\\"\n\n| Throw\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\addr a,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\Throw a,s\\<^sub>1\\\"\n| ThrowNull\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\null,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\THROW NullPointer,s\\<^sub>1\\\"\n| ThrowThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\throw e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\\"\n\n| Try\\<^sub>1:\n \"P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Val v\\<^sub>1,s\\<^sub>1\\\"\n| TryCatch\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\;\n h\\<^sub>1 a = Some(D,fs); P \\ D \\\\<^sup>* C; i < length ls\\<^sub>1;\n P \\\\<^sub>1 \\e\\<^sub>2,(h\\<^sub>1,ls\\<^sub>1[i:=Addr a])\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2)\\ \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\e\\<^sub>2',(h\\<^sub>2,ls\\<^sub>2)\\\"\n| TryThrow\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e\\<^sub>1,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\; h\\<^sub>1 a = Some(D,fs); \\ P \\ D \\\\<^sup>* C \\\n \\ P \\\\<^sub>1 \\try e\\<^sub>1 catch(C i) e\\<^sub>2,s\\<^sub>0\\ \\ \\Throw a,(h\\<^sub>1,ls\\<^sub>1)\\\"\n\n| Nil\\<^sub>1:\n \"P \\\\<^sub>1 \\[],s\\ [\\] \\[],s\\\"\n\n| Cons\\<^sub>1:\n \"\\ P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\Val v,s\\<^sub>1\\; P \\\\<^sub>1 \\es,s\\<^sub>1\\ [\\] \\es',s\\<^sub>2\\ \\\n \\ P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\Val v # es',s\\<^sub>2\\\"\n| ConsThrow\\<^sub>1:\n \"P \\\\<^sub>1 \\e,s\\<^sub>0\\ \\ \\throw e',s\\<^sub>1\\ \\\n P \\\\<^sub>1 \\e#es,s\\<^sub>0\\ [\\] \\throw e' # es, s\\<^sub>1\\\"\n\n(*<*)\nlemmas eval\\<^sub>1_evals\\<^sub>1_induct = eval\\<^sub>1_evals\\<^sub>1.induct [split_format (complete)]\n and eval\\<^sub>1_evals\\<^sub>1_inducts = eval\\<^sub>1_evals\\<^sub>1.inducts [split_format (complete)]\n(*>*)\n\nlemma eval\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\e\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\nand evals\\<^sub>1_preserves_len:\n \"P \\\\<^sub>1 \\es\\<^sub>0,(h\\<^sub>0,ls\\<^sub>0)\\ [\\] \\es\\<^sub>1,(h\\<^sub>1,ls\\<^sub>1)\\ \\ length ls\\<^sub>0 = length ls\\<^sub>1\"\n(*<*)by (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts, simp_all)(*>*)\n\n\nlemma evals\\<^sub>1_preserves_elen:\n \"\\es' s s'. P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ length es = length es'\"\n(*<*)\napply(induct es type:list)\napply (auto elim:evals\\<^sub>1.cases)\ndone\n(*>*)\n\n\nlemma eval\\<^sub>1_final: \"P \\\\<^sub>1 \\e,s\\ \\ \\e',s'\\ \\ final e'\"\n and evals\\<^sub>1_final: \"P \\\\<^sub>1 \\es,s\\ [\\] \\es',s'\\ \\ finals es'\"\n(*<*)by(induct rule:eval\\<^sub>1_evals\\<^sub>1.inducts, simp_all)(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/Compiler/J1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3486451353339458, "lm_q1q2_score": 0.18112858160085785}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__56.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__56 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__56 and some rule r*}\nlemma n_RecvReqSVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv0)) (Const true)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))) (eqn (IVar (Ident ''ExGntd'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__56:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__56:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__56:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__56:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__56:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__56:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__56 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__56.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.35936413829896496, "lm_q1q2_score": 0.18108580675571434}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__58_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__58_on_rules imports n_g2kAbsAfter_lemma_on_inv__58\nbegin\nsection{*All lemmas on causal relation between inv__58*}\nlemma lemma_inv__58_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__58 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__58) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__58_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583270090337582, "lm_q2_score": 0.3242354055108441, "lm_q1q2_score": 0.18102938418171732}} {"text": "(* Title: JinjaThreads/JVM/JVMExecInstr.thy\n Author: Cornelia Pusch, Gerwin Klein, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{JVM Instruction Semantics} *}\n\ntheory JVMExecInstr\nimports\n JVMInstructions\n JVMHeap\n \"../Common/ExternalCall\"\nbegin\n\nprimrec extRet2JVM :: \n \"nat \\ 'heap \\ 'addr val list \\ 'addr val list \\ cname \\ mname \\ pc \\ 'addr frame list \n \\ 'addr extCallRet \\ ('addr, 'heap) jvm_state\"\nwhere\n \"extRet2JVM n h stk loc C M pc frs (RetVal v) = (None, h, (v # drop (Suc n) stk, loc, C, M, pc + 1) # frs)\"\n| \"extRet2JVM n h stk loc C M pc frs (RetExc a) = (\\a\\, h, (stk, loc, C, M, pc) # frs)\"\n| \"extRet2JVM n h stk loc C M pc frs RetStaySame = (None, h, (stk, loc, C, M, pc) # frs)\"\n\nlemma eq_extRet2JVM_conv [simp]:\n \"(xcp, h', frs') = extRet2JVM n h stk loc C M pc frs va \\ \n h' = h \\ (case va of RetVal v \\ xcp = None \\ frs' = (v # drop (Suc n) stk, loc, C, M, pc + 1) # frs\n | RetExc a \\ xcp = \\a\\ \\ frs' = (stk, loc, C, M, pc) # frs\n | RetStaySame \\ xcp = None \\ frs' = (stk, loc, C, M, pc) # frs)\"\nby(cases va) auto\n\ndefinition extNTA2JVM :: \"'addr jvm_prog \\ (cname \\ mname \\ 'addr) \\ 'addr jvm_thread_state\"\nwhere \"extNTA2JVM P \\ (\\(C, M, a). let (D,M',Ts,meth) = method P C M; (mxs,mxl0,ins,xt) = the meth\n in (None, [([],Addr a # replicate mxl0 undefined_value, D, M, 0)]))\"\n\nabbreviation extTA2JVM :: \n \"'addr jvm_prog \\ ('addr, 'thread_id, 'heap) external_thread_action \\ ('addr, 'thread_id, 'heap) jvm_thread_action\"\nwhere \"extTA2JVM P \\ convert_extTA (extNTA2JVM P)\"\n\ncontext JVM_heap_base begin\n\nprimrec exec_instr ::\n \"'addr instr \\ 'addr jvm_prog \\ 'thread_id \\ 'heap \\ 'addr val list \\ 'addr val list\n \\ cname \\ mname \\ pc \\ 'addr frame list \\\n (('addr, 'thread_id, 'heap) jvm_thread_action \\ ('addr, 'heap) jvm_state) set\"\nwhere\nexec_instr_Load:\n \"exec_instr (Load n) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, ((loc ! n) # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n\n| \"exec_instr (Store n) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (tl stk, loc[n:=hd stk], C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n\n| exec_instr_Push:\n \"exec_instr (Push v) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (v # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs))}\"\n\n| exec_instr_New:\n \"exec_instr (New C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let HA = allocate h (Class_type C)\n in if HA = {} then {(\\, \\addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else (\\(h', a). (\\NewHeapElem a (Class_type C)\\, None, h', (Addr a # stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1)#frs)) ` HA)\"\n\n| exec_instr_NewArray:\n \"exec_instr (NewArray T) P t h stk loc C0 M0 pc frs =\n (let si = the_Intg (hd stk);\n i = nat (sint si)\n in (if si , \\addr_of_sys_xcpt NegativeArraySize\\, h, (stk, loc, C0, M0, pc) # frs)}\n else let HA = allocate h (Array_type T i)\n in if HA = {} then {(\\, \\addr_of_sys_xcpt OutOfMemory\\, h, (stk, loc, C0, M0, pc) # frs)}\n else (\\(h', a). (\\NewHeapElem a (Array_type T i)\\, None, h', (Addr a # tl stk, loc, C0, M0, pc + 1) # frs)) ` HA))\"\n\n| exec_instr_ALoad:\n \"exec_instr ALoad P t h stk loc C0 M0 pc frs =\n (let i = the_Intg (hd stk);\n va = hd (tl stk);\n a = the_Addr va;\n len = alen_of_htype (the (typeof_addr h a))\n in (if va = Null then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else if i int len \\ sint i then\n {(\\, \\addr_of_sys_xcpt ArrayIndexOutOfBounds\\, h, (stk, loc, C0, M0, pc) # frs)}\n else {(\\ReadMem a (ACell (nat (sint i))) v\\, None, h, (v # tl (tl stk), loc, C0, M0, pc + 1) # frs) | v. \n heap_read h a (ACell (nat (sint i))) v }))\"\n\n| exec_instr_AStore:\n \"exec_instr AStore P t h stk loc C0 M0 pc frs =\n (let ve = hd stk;\n vi = hd (tl stk);\n va = hd (tl (tl stk))\n in (if va = Null then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else (let i = the_Intg vi;\n idx = nat (sint i);\n a = the_Addr va;\n hT = the (typeof_addr h a);\n T = ty_of_htype hT;\n len = alen_of_htype hT;\n U = the (typeof\\<^bsub>h\\<^esub> ve)\n in (if i int len \\ sint i then\n {(\\, \\addr_of_sys_xcpt ArrayIndexOutOfBounds\\, h, (stk, loc, C0, M0, pc) # frs)}\n else if P \\ U \\ the_Array T then \n {(\\WriteMem a (ACell idx) ve\\, None, h', (tl (tl (tl stk)), loc, C0, M0, pc+1) # frs)\n | h'. heap_write h a (ACell idx) ve h'}\n else {(\\, (\\addr_of_sys_xcpt ArrayStore\\, h, (stk, loc, C0, M0, pc) # frs))}))))\"\n\n| exec_instr_ALength:\n \"exec_instr ALength P t h stk loc C0 M0 pc frs =\n {(\\, (let va = hd stk\n in if va = Null\n then (\\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)\n else (None, h, (Intg (word_of_int (int (alen_of_htype (the (typeof_addr h (the_Addr va)))))) # tl stk, loc, C0, M0, pc+1) # frs)))}\"\n\n| \"exec_instr (Getfield F C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let v = hd stk\n in if v = Null then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else let a = the_Addr v\n in {(\\ReadMem a (CField C F) v'\\, None, h, (v' # (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs) | v'.\n heap_read h a (CField C F) v'})\"\n\n| \"exec_instr (Putfield F C) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (let v = hd stk;\n r = hd (tl stk)\n in if r = Null then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)}\n else let a = the_Addr r\n in {(\\WriteMem a (CField C F) v\\, None, h', (tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs) | h'.\n heap_write h a (CField C F) v h'})\"\n\n| \"exec_instr (Checkcast T) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, let U = the (typeof\\<^bsub>h\\<^esub> (hd stk))\n in if P \\ U \\ T then (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)\n else (\\addr_of_sys_xcpt ClassCast\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs))}\"\n\n| \"exec_instr (Instanceof T) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, None, h, (Bool (hd stk \\ Null \\ P \\ the (typeof\\<^bsub>h\\<^esub> (hd stk)) \\ T) # tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)}\"\n\n| exec_instr_Invoke:\n \"exec_instr (Invoke M n) P t h stk loc C0 M0 pc frs =\n (let ps = rev (take n stk);\n r = stk ! n;\n a = the_Addr r;\n T = the (typeof_addr h a)\n in (if r = Null then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C0, M0, pc) # frs)}\n else \n let C = class_type_of T;\n (D,M',Ts,meth)= method P C M\n in case meth of \n Native \\\n {(extTA2JVM P ta, extRet2JVM n h' stk loc C0 M0 pc frs va) | ta va h'.\n (ta, va, h') \\ red_external_aggr P t a M ps h}\n | \\(mxs,mxl\\<^sub>0,ins,xt)\\ \\\n let f' = ([],[r]@ps@(replicate mxl\\<^sub>0 undefined_value),D,M,0)\n in {(\\, None, h, f' # (stk, loc, C0, M0, pc) # frs)}))\"\n\n| \"exec_instr Return P t h stk\\<^sub>0 loc\\<^sub>0 C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (if frs=[] then (None, h, []) else \n let v = hd stk\\<^sub>0; \n (stk,loc,C,m,pc) = hd frs;\n n = length (fst (snd (method P C\\<^sub>0 M\\<^sub>0)))\n in (None, h, (v#(drop (n+1) stk),loc,C,m,pc+1)#tl frs)) )}\"\n\n| \"exec_instr Pop P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs) )}\"\n\n| \"exec_instr Dup P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (hd stk # stk, loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs) )}\"\n\n| \"exec_instr Swap P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n {(\\, (None, h, (hd (tl stk) # hd stk # tl (tl stk), loc, C\\<^sub>0, M\\<^sub>0, pc+1)#frs) )}\"\n\n| \"exec_instr (BinOpInstr bop) P t h stk loc C0 M0 pc frs =\n {(\\, \n case the (binop bop (hd (tl stk)) (hd stk)) of\n Inl v \\ (None, h, (v # tl (tl stk), loc, C0, M0, pc+1) # frs)\n | Inr a \\ (Some a, h, (stk, loc, C0, M0, pc) # frs))}\"\n\n| \"exec_instr (IfFalse i) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (let pc' = if hd stk = Bool False then nat(int pc+i) else pc+1\n in (None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc')#frs)) )}\"\n\n| exec_instr_Goto:\n \"exec_instr (Goto i) P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (None, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, nat(int pc+i))#frs) )}\"\n\n| \"exec_instr ThrowExc P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {(\\, (let xp' = if hd stk = Null then \\addr_of_sys_xcpt NullPointer\\ else \\the_Addr(hd stk)\\\n in (xp', h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc)#frs)) )}\"\n\n| exec_instr_MEnter:\n \"exec_instr MEnter P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n {let v = hd stk\n in if v = Null\n then (\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)\n else (\\Lock\\the_Addr v, SyncLock (the_Addr v)\\, None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs)}\"\n\n| exec_instr_MExit:\n \"exec_instr MExit P t h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (let v = hd stk\n in if v = Null\n then {(\\, \\addr_of_sys_xcpt NullPointer\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc)#frs)}\n else {(\\Unlock\\the_Addr v, SyncUnlock (the_Addr v)\\, None, h, (tl stk, loc, C\\<^sub>0, M\\<^sub>0, pc + 1) # frs),\n (\\UnlockFail\\the_Addr v\\, \\addr_of_sys_xcpt IllegalMonitorState\\, h, (stk, loc, C\\<^sub>0, M\\<^sub>0, pc) # frs)})\"\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/JVM/JVMExecInstr.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.32423541204073586, "lm_q1q2_score": 0.18102938306179575}} {"text": "(* Title: HOL/MicroJava/BV/JVM.thy\n\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nsection \\The Typing Framework for the JVM \\label{sec:JVM}\\\n\ntheory TF_JVM\nimports \"../DFA/Typing_Framework_err\" EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ ex_table \\ instr list \\ ty\\<^sub>i' err step_type\"\nwhere \n \"exec G maxs rT et bs \\\n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc (size bs) et) \n (\\pc. eff (bs!pc) G pc et)\"\n\nlocale JVM_sl =\n fixes P :: jvm_prog and mxs and mxl\\<^sub>0\n fixes Ts :: \"ty list\" and \"is\" and xt and T\\<^sub>r\n\n fixes mxl and A and r and f and app and eff and step\n defines [simp]: \"mxl \\ 1+size Ts+mxl\\<^sub>0\"\n defines [simp]: \"A \\ states P mxs mxl\"\n defines [simp]: \"r \\ JVM_SemiType.le P mxs mxl\"\n defines [simp]: \"f \\ JVM_SemiType.sup P mxs mxl\"\n\n defines [simp]: \"app \\ \\pc. Effect.app (is!pc) P mxs T\\<^sub>r pc (size is) xt\"\n defines [simp]: \"eff \\ \\pc. Effect.eff (is!pc) P pc xt\"\n defines [simp]: \"step \\ err_step (size is) app eff\"\n\n\nlocale start_context = JVM_sl +\n fixes p and C\n assumes wf: \"wf_prog p P\"\n assumes C: \"is_class P C\"\n assumes Ts: \"set Ts \\ types P\"\n\n fixes first :: ty\\<^sub>i' and start\n defines [simp]: \n \"first \\ Some ([],OK (Class C) # map OK Ts @ replicate mxl\\<^sub>0 Err)\"\n defines [simp]:\n \"start \\ OK first # replicate (size is - 1) (OK None)\"\n\n\n\nsubsection \\Connecting JVM and Framework\\\n\n\nlemma (in JVM_sl) step_def_exec: \"step \\ exec P mxs T\\<^sub>r xt is\" \n by (simp add: exec_def) \n\nlemma special_ex_swap_\n\nlemma ex_in_list [iff]:\n \"(\\n. ST \\ list n A \\ n \\ mxs) = (set ST \\ A \\ size ST \\ mxs)\"\n by (unfold list_def) auto\n\nlemma singleton_list: \n \"(\\n. [Class C] \\ list n (types P) \\ n \\ mxs) = (is_class P C \\ 0 < mxs)\"\n by auto\n\nlemma set_drop_subset:\n \"set xs \\ A \\ set (drop n xs) \\ A\"\n by (auto dest: in_set_dropD)\n\nlemma Suc_minus_minus_le:\n \"n < mxs \\ Suc (n - (n - b)) \\ mxs\"\n by arith\n\nlemma in_listE:\n \"\\ xs \\ list n A; \\size xs = n; set xs \\ A\\ \\ P \\ \\ P\"\n by (unfold list_def) blast\n\ndeclare is_relevant_entry_def [simp]\ndeclare set_drop_subset [simp]\n\ntheorem (in start_context) exec_pres_type:\n \"pres_type step (size is) A\"\n(*<*)\n apply (insert wf)\n apply simp\n apply (unfold JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (rename_tac s pc pc' s')\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def relevant_entries_def)\n apply (case_tac \"is!pc\")\n\n \\ \\Load\\\n apply clarsimp\n apply (frule listE_nth_in, assumption)\n apply fastforce\n\n \\ \\Store\\\n apply fastforce\n\n \\ \\Push\\\n apply (fastforce simp add: typeof_lit_is_type)\n\n \\ \\New\\\n apply fastforce\n\n \\ \\Getfield\\\n apply (fastforce dest: sees_field_is_type)\n\n \\ \\Putfield\\\n apply fastforce\n\n \\ \\Checkcast\\\n apply fastforce\n\n defer \n \n \\ \\Return\\\n apply fastforce\n\n \\ \\Pop\\\n apply fastforce\n\n \\ \\IAdd\\\n apply fastforce\n \n \\ \\Goto\\\n apply fastforce\n\n \\ \\CmpEq\\\n apply fastforce\n\n \\ \\IfFalse\\\n apply fastforce\n\n \\ \\Throw\\\n apply fastforce\n\n \\ \\Invoke\\\n apply (clarsimp split!: if_splits)\n apply fastforce\n apply (erule disjE)\n prefer 2\n apply fastforce\n apply clarsimp\n apply (rule conjI)\n apply (drule (1) sees_wf_mdecl)\n apply (clarsimp simp add: wf_mdecl_def)\n apply arith\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\ndeclare set_drop_subset [simp del]\n\nlemma lesubstep_type_simple:\n \"xs [\\\\<^bsub>Product.le (=) r\\<^esub>] ys \\ set xs {\\\\<^bsub>r\\<^esub>} set ys\"\n(*<*)\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\n\n\nlemma conjI2: \"\\ A; A \\ B \\ \\ A \\ B\" by blast\n \nlemma (in JVM_sl) eff_mono:\n \"\\wf_prog p P; pc < length is; s \\\\<^bsub>sup_state_opt P\\<^esub> t; app pc t\\\n \\ set (eff pc s) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (eff pc t)\"\n(*<*)\n apply simp\n apply (unfold Effect.eff_def) \n apply (cases t)\n apply (simp add: lesub_def)\n apply (rename_tac a)\n apply (cases s)\n apply simp\n apply (rename_tac b)\n apply simp\n apply (rule lesubstep_union)\n prefer 2\n apply (rule lesubstep_type_simple)\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply (simp add: split_beta)\n apply (simp add: split_beta)\n apply (simp add: lesub_def fun_of_def)\n apply (case_tac a)\n apply (case_tac b)\n apply simp \n apply (subgoal_tac \"size ab = size aa\")\n prefer 2\n apply (clarsimp simp add: list_all2_lengthD)\n apply simp\n apply (clarsimp simp add: norm_eff_def lesubstep_type_def lesub_def iff del: sup_state_conv)\n apply (rule exI)\n apply (rule conjI2)\n apply (rule imageI)\n apply (clarsimp simp add: Effect.app_def iff del: sup_state_conv)\n apply (drule (2) succs_mono)\n apply blast\n apply simp\n apply (erule eff\\<^sub>i_mono)\n apply simp\n apply assumption \n apply clarsimp\n apply clarsimp \n done\n(*>*)\n\nlemma (in JVM_sl) bounded_step: \"bounded step (size is)\"\n(*<*)\n apply simp\n apply (unfold bounded_def err_step_def Effect.app_def Effect.eff_def)\n apply (auto simp add: error_def map_snd_def split: err.splits option.splits)\n done\n(*>*)\n\ntheorem (in JVM_sl) step_mono:\n \"wf_prog wf_mb P \\ mono r step (size is) A\"\n(*<*)\n apply (simp add: JVM_le_Err_conv) \n apply (insert bounded_step)\n apply (unfold JVM_states_unfold)\n apply (rule mono_lift)\n apply blast\n apply (unfold app_mono_def lesub_def)\n apply clarsimp\n apply (erule (2) app_mono)\n apply simp\n apply clarify\n apply (drule eff_mono)\n apply (auto simp add: lesub_def)\n done\n(*>*)\n\n\nlemma (in start_context) first_in_A [iff]: \"OK first \\ A\"\n using Ts C by (force intro!: list_appendI simp add: JVM_states_unfold)\n\n\nlemma (in JVM_sl) wt_method_def2:\n \"wt_method P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s =\n (is \\ [] \\ \n size \\s = size is \\\n OK ` set \\s \\ states P mxs mxl \\\n wt_start P C' Ts mxl\\<^sub>0 \\s \\ \n wt_app_eff (sup_state_opt P) app eff \\s)\"\n(*<*)\n apply (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def check_types_def)\n apply auto\n done\n(*>*)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/BV/TF_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.32423539245106087, "lm_q1q2_score": 0.18102937212435138}} {"text": "(*\n * Copyright 2022, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchFinalise_AI\nimports Finalise_AI\nbegin\n\ncontext Arch begin\n\nnamed_theorems Finalise_AI_asms\n\nglobal_naming AARCH64\n\nlemma valid_global_refs_asid_table_udapte [iff]:\n \"valid_global_refs (s\\arch_state := arm_asid_table_update f (arch_state s)\\) =\n valid_global_refs s\"\n by (simp add: valid_global_refs_def global_refs_def)\n\nlemma nat_to_cref_unat_of_bl':\n \"\\ length xs < 64; n = length xs \\ \\\n nat_to_cref n (unat (of_bl xs :: machine_word)) = xs\"\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (rule nth_equalityI)\n apply simp\n apply clarsimp\n apply (subst to_bl_nth)\n apply (simp add: word_size)\n apply (simp add: word_size)\n apply (simp add: test_bit_of_bl rev_nth)\n apply fastforce\n done\n\nlemmas nat_to_cref_unat_of_bl = nat_to_cref_unat_of_bl' [OF _ refl]\n\nlemma global_pt_asid_table_update[simp]:\n \"arm_us_global_vspace (arch_state s\\arm_asid_table := atable\\) = global_pt s\"\n by simp\n\nlemma equal_kernel_mappings_asid_table_unmap:\n \"equal_kernel_mappings s\n \\ equal_kernel_mappings (s\\arch_state := arch_state s\n \\arm_asid_table := (asid_table s)(i := None)\\\\)\"\n unfolding equal_kernel_mappings_def by simp\n\nlemma invs_arm_asid_table_unmap:\n \"invs s\n \\ is_aligned base asid_low_bits\n \\ (\\asid_low. vmid_for_asid s (asid_of (asid_high_bits_of base) asid_low) = None)\n \\ tab = asid_table s\n \\ invs (s\\arch_state := arch_state s\\arm_asid_table := tab(asid_high_bits_of base := None)\\\\)\"\n apply (clarsimp simp: invs_def valid_state_def valid_arch_caps_def)\n apply (strengthen valid_asid_map_unmap valid_vspace_objs_unmap_strg\n valid_vs_lookup_unmap_strg valid_arch_state_unmap_strg)\n apply (simp add: valid_irq_node_def valid_kernel_mappings_def)\n apply (simp add: valid_table_caps_def valid_machine_state_def valid_global_objs_def\n valid_asid_pool_caps_def equal_kernel_mappings_asid_table_unmap)\n done\n\nlemma asid_low_bits_of_add:\n \"\\ is_aligned base asid_low_bits; offset \\ mask asid_low_bits \\ \\\n asid_low_bits_of (base + offset) = ucast offset\"\n unfolding asid_low_bits_of_def\n by (metis and_mask_eq_iff_le_mask asid_bits_of_defs(2) asid_high_bits_shl asid_low_bits_of_mask_eq\n constructed_asid_low_bits_of word_and_or_mask_aligned)\n\nlemma invalidate_asid_entry_vmid_for_asid:\n \"\\\\s. asid' \\ asid \\ vmid_for_asid s asid' = None\\\n invalidate_asid_entry asid\n \\\\_ s. vmid_for_asid s asid' = None\\\"\n unfolding invalidate_asid_entry_def\n by (wpsimp wp: hoare_vcg_const_imp_lift)\n\nlemma invalidate_asid_entry_vmid_for_asid_low:\n \"\\\\s. asid_low_bits_of asid \\ asid_low \\\n vmid_for_asid s (asid_of (asid_high_bits_of asid) asid_low) = None\\\n invalidate_asid_entry asid\n \\\\_ s. vmid_for_asid s (asid_of (asid_high_bits_of asid) asid_low) = None\\\"\n by (wpsimp wp: invalidate_asid_entry_vmid_for_asid)\n\nlemma invalidate_asid_entry_vmid_for_asid_add:\n \"\\\\s. is_aligned base asid_low_bits \\ offset \\ mask asid_low_bits \\ offset' \\ mask asid_low_bits \\\n (offset \\ offset' \\\n vmid_for_asid s (asid_of (asid_high_bits_of base) (ucast offset')) = None) \\\n invalidate_asid_entry (base + offset)\n \\\\_ s. vmid_for_asid s (asid_of (asid_high_bits_of base) (ucast offset')) = None\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_chain, rule invalidate_asid_entry_vmid_for_asid_low[where asid_low=\"ucast offset'\"])\n apply (clarsimp simp: asid_low_bits_of_add asid_high_bits_of_add mask_def)\n apply (clarsimp simp: asid_high_bits_of_add mask_def)\n done\n\ncrunches invalidate_tlb_by_asid\n for vmid_for_asid[wp]: \"\\s. P (vmid_for_asid s)\"\n and asid_pools_of[wp]: \"\\s. P (asid_pools_of s)\"\n and pool_for_asid[wp]: \"\\s. P (pool_for_asid asid s)\"\n\nlemma invalidate_asid_entry_asid_pools_of:\n \"\\\\s. asid_table s (asid_high_bits_of asid) = Some pptr \\\n (\\ap entry. asid_pools_of s pptr = Some ap \\\n ap (asid_low_bits_of asid) = Some entry \\\n P (Some (ap(asid_low_bits_of asid \\ ASIDPoolVSpace None (ap_vspace entry)))))\\\n invalidate_asid_entry asid\n \\\\rv s. P (asid_pools_of s pptr)\\\"\n unfolding invalidate_asid_entry_def invalidate_asid_def invalidate_vmid_entry_def\n by (wpsimp simp: pool_for_asid_def)\n\nlemma delete_asid_pool_invs[wp]:\n \"delete_asid_pool base pptr \\invs\\\"\n unfolding delete_asid_pool_def\n supply fun_upd_apply[simp del]\n apply wpsimp\n apply (strengthen invs_arm_asid_table_unmap)\n apply (rename_tac table pool)\n apply (rule_tac Q=\"\\_ s. (invs s \\ is_aligned base asid_low_bits \\ table = asid_table s \\\n (\\ap. asid_pools_of s pptr = Some ap \\\n (\\asid_low. ap asid_low \\ None \\ pool asid_low \\ None))) \\\n (\\x \\ set [0 .e. mask asid_low_bits].\n vmid_for_asid s (asid_of (asid_high_bits_of base) (ucast x)) = None)\"\n in hoare_strengthen_post)\n apply (rule mapM_set_inv)\n apply (wpsimp wp: invalidate_asid_entry_vmid_for_asid)\n apply (wp invalidate_asid_entry_asid_pools_of)\n apply (wp invalidate_tlb_by_asid_invs hoare_vcg_all_lift)\n apply (clarsimp simp: vmid_for_asid_def asid_low_bits_of_add fun_upd_apply\n asid_high_bits_of_add mask_def)\n apply (wpsimp wp: invalidate_asid_entry_vmid_for_asid_add hoare_vcg_const_imp_lift)\n apply (fastforce simp: vmid_for_asid_def entry_for_pool_def obind_def opt_map_def\n split: option.splits)\n apply (wpsimp wp: invalidate_asid_entry_vmid_for_asid_add invalidate_asid_entry_asid_pools_of)\n apply (clarsimp simp: vmid_for_asid_def entry_for_pool_def obind_def opt_map_def\n split: option.splits)\n apply (metis asid_low_bits_of_and_mask asid_low_bits_of_def asid_low_bits_of_mask_eq\n asid_pool_entry.exhaust asid_pool_entry.sel(1) word_and_le1 word_ao_absorbs(8))\n apply wp+\n apply (clarsimp simp: asid_low_bits_of_def ucast_zero_is_aligned asid_low_bits_def)\n done\n\nlemma get_vm_id_pool_for_asid[wp]:\n \"get_vmid asid' \\\\s. P (pool_for_asid asid s)\\\"\n by (wp pool_for_asid_lift)\n\ncrunches set_vm_root\n for pool_for_asid[wp]: \"\\s. P (pool_for_asid asid s)\"\n and vspace_for_asid[wp]: \"\\s. P (vspace_for_asid asid s)\"\n (simp: crunch_simps)\n\nlemma delete_asid_invs[wp]:\n \"\\ invs and valid_asid_table and pspace_aligned \\ delete_asid asid pd \\\\_. invs\\\"\n apply (simp add: delete_asid_def cong: option.case_cong)\n apply (wpsimp wp: set_asid_pool_invs_unmap invalidate_asid_entry_asid_pools_of hoare_vcg_ex_lift\n invalidate_asid_entry_vmid_for_asid invalidate_tlb_by_asid_invs\n hoare_vcg_imp_lift'\n simp: pool_for_asid_def)\n apply blast\n done\n\nlemma delete_asid_pool_unmapped[wp]:\n \"\\\\s. True \\\n delete_asid_pool asid poolptr\n \\\\_ s. pool_for_asid asid s \\ Some poolptr \\\"\n unfolding delete_asid_pool_def\n by (wpsimp simp: pool_for_asid_def)\n\nlemma set_asid_pool_unmap:\n \"\\\\s. pool_for_asid asid s = Some poolptr \\\n set_asid_pool poolptr (pool(asid_low_bits_of asid := None))\n \\\\rv s. vspace_for_asid asid s = None \\\"\n unfolding set_asid_pool_def\n apply (wp set_object_wp)\n by (simp add: pool_for_asid_def entry_for_asid_def entry_for_pool_def vspace_for_asid_def\n vspace_for_pool_def obind_def in_omonad\n split: option.splits)\n\ncrunches invalidate_asid_entry\n for pool_for_asid[wp]: \"\\s. P (pool_for_asid asid s)\"\n (simp: pool_for_asid_def)\n\nlemma delete_asid_unmapped:\n \"\\\\s. vspace_for_asid asid s = Some pt\\\n delete_asid asid pt\n \\\\_ s. vspace_for_asid asid s = None\\\"\n unfolding delete_asid_def\n apply (simp cong: option.case_cong)\n apply (wpsimp wp: set_asid_pool_unmap | wp (once) hoare_drop_imps)+\n apply (clarsimp simp: vspace_for_asid_def pool_for_asid_def vspace_for_pool_def\n obind_def in_omonad entry_for_asid_def entry_for_pool_def\n split: option.splits)\n by (meson asid_pool_entry.exhaust_sel)\n\nlemma set_pt_tcb_at:\n \"\\\\s. P (ko_at (TCB tcb) t s)\\ set_pt a b \\\\_ s. P (ko_at (TCB tcb) t s)\\\"\n by (wpsimp simp: set_pt_def obj_at_def wp: set_object_wp)\n\nlemma set_vcpu_tcb_at_arch: (* generalise? this holds except when the ko is a vcpu *)\n \"set_vcpu p v \\\\s. P (ko_at (TCB tcb) t s)\\\"\n by (wp set_vcpu_nonvcpu_at; auto)\n\ncrunch tcb_at_arch: vcpu_switch \"\\s. P (ko_at (TCB tcb) t s)\"\n (simp: crunch_simps when_def\n wp: crunch_wps set_vcpu_tcb_at_arch)\n\ncrunch tcb_at_arch: unmap_page \"\\s. P (ko_at (TCB tcb) t s)\"\n (simp: crunch_simps wp: crunch_wps set_pt_tcb_at ignore: set_object)\n\nlemmas unmap_page_tcb_at = unmap_page_tcb_at_arch\n\nlemma unmap_page_tcb_cap_valid:\n \"unmap_page sz asid vaddr pptr \\\\s. tcb_cap_valid cap r s\\\"\n apply (rule tcb_cap_valid_typ_st)\n apply wp\n apply (simp add: pred_tcb_at_def2)\n apply (wp unmap_page_tcb_at hoare_vcg_ex_lift hoare_vcg_all_lift)+\n done\n\n\nglobal_naming Arch\n\nlemma (* replaceable_cdt_update *)[simp,Finalise_AI_asms]:\n \"replaceable (cdt_update f s) = replaceable s\"\n by (fastforce simp: replaceable_def tcb_cap_valid_def\n reachable_frame_cap_def reachable_target_def)\n\nlemma (* replaceable_revokable_update *)[simp,Finalise_AI_asms]:\n \"replaceable (is_original_cap_update f s) = replaceable s\"\n by (fastforce simp: replaceable_def is_final_cap'_def2 tcb_cap_valid_def\n reachable_frame_cap_def reachable_target_def)\n\nlemma (* replaceable_more_update *) [simp,Finalise_AI_asms]:\n \"replaceable (trans_state f s) sl cap cap' = replaceable s sl cap cap'\"\n by (simp add: replaceable_def reachable_frame_cap_def reachable_target_def)\n\nlemma reachable_target_trans_state[simp]:\n \"reachable_target ref p (trans_state f s) = reachable_target ref p s\"\n by (clarsimp simp: reachable_target_def split_def)\n\nlemma reachable_frame_cap_trans_state[simp]:\n \"reachable_frame_cap cap (trans_state f s) = reachable_frame_cap cap s\"\n by (simp add: reachable_frame_cap_def)\n\nlemmas [Finalise_AI_asms] = obj_refs_obj_ref_of (* used under name obj_ref_ofI *)\n\nlemma (* empty_slot_invs *) [Finalise_AI_asms]:\n \"\\\\s. invs s \\ cte_wp_at (replaceable s sl cap.NullCap) sl s \\\n emptyable sl s \\\n (info \\ NullCap \\ post_cap_delete_pre info ((caps_of_state s) (sl \\ NullCap)))\\\n empty_slot sl info\n \\\\rv. invs\\\"\n apply (simp add: empty_slot_def set_cdt_def bind_assoc cong: if_cong)\n apply (wp post_cap_deletion_invs)\n apply (simp add: invs_def valid_state_def valid_mdb_def2)\n apply (wp replace_cap_valid_pspace set_cap_caps_of_state2\n replace_cap_ifunsafe get_cap_wp\n set_cap_idle valid_irq_node_typ set_cap_typ_at\n set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_cap_refs_respects_device_region_NullCap\n | simp add: trans_state_update[symmetric]\n del: trans_state_update fun_upd_apply\n split del: if_split)+\n apply (clarsimp simp: is_final_cap'_def2 simp del: fun_upd_apply)\n apply (clarsimp simp: conj_comms invs_def valid_state_def valid_mdb_def2)\n apply (subgoal_tac \"mdb_empty_abs s\")\n prefer 2\n apply (rule mdb_empty_abs.intro)\n apply (rule vmdb_abs.intro)\n apply (simp add: valid_mdb_def swp_def cte_wp_at_caps_of_state conj_comms)\n apply (clarsimp simp: untyped_mdb_def mdb_empty_abs.descendants mdb_empty_abs.no_mloop_n\n valid_pspace_def cap_range_def)\n apply (clarsimp simp: untyped_inc_def mdb_empty_abs.descendants mdb_empty_abs.no_mloop_n)\n apply (simp add: ut_revocable_def cur_tcb_def valid_irq_node_def\n no_cap_to_obj_with_diff_ref_Null)\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_cte_at)\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_mdb_def)\n apply (rule conjI)\n apply (clarsimp simp: irq_revocable_def)\n apply (rule conjI)\n apply (clarsimp simp: reply_master_revocable_def)\n apply (thin_tac \"info \\ NullCap \\ P info\" for P)\n apply (rule conjI)\n apply (clarsimp simp: valid_machine_state_def)\n apply (rule conjI)\n apply (clarsimp simp:descendants_inc_def mdb_empty_abs.descendants)\n apply (rule conjI)\n apply (clarsimp simp: reply_mdb_def)\n apply (rule conjI)\n apply (unfold reply_caps_mdb_def)[1]\n apply (rule allEI, assumption)\n apply (fold reply_caps_mdb_def)[1]\n apply (case_tac \"sl = ptr\", simp)\n apply (simp add: fun_upd_def split del: if_split del: split_paired_Ex)\n apply (erule allEI, rule impI, erule(1) impE)\n apply (erule exEI)\n apply (simp, rule ccontr)\n apply (erule(5) emptyable_no_reply_cap)\n apply simp\n apply (unfold reply_masters_mdb_def)[1]\n apply (elim allEI)\n apply (clarsimp simp: mdb_empty_abs.descendants)\n apply (rule conjI)\n apply (simp add: valid_ioc_def)\n apply (rule conjI)\n apply (clarsimp simp: tcb_cap_valid_def\n dest!: emptyable_valid_NullCapD)\n apply (rule conjI)\n apply (clarsimp simp: mdb_cte_at_def cte_wp_at_caps_of_state)\n apply (cases sl)\n apply (rule conjI, clarsimp)\n apply (subgoal_tac \"cdt s \\ (ab,bb) \\ (ab,bb)\")\n apply (simp add: no_mloop_def)\n apply (rule r_into_trancl)\n apply (simp add: cdt_parent_of_def)\n apply fastforce\n apply (clarsimp simp: cte_wp_at_caps_of_state replaceable_def\n reachable_frame_cap_def reachable_target_def\n del: allI)\n apply (case_tac \"is_final_cap' cap s\")\n apply auto[1]\n apply (simp add: is_final_cap'_def2 cte_wp_at_caps_of_state)\n by fastforce\n\nlemma dom_tcb_cap_cases_lt_ARCH [Finalise_AI_asms]:\n \"dom tcb_cap_cases = {xs. length xs = 3 \\ unat (of_bl xs :: machine_word) < 5}\"\n apply (rule set_eqI, rule iffI)\n apply clarsimp\n apply (simp add: tcb_cap_cases_def tcb_cnode_index_def to_bl_1 split: if_split_asm)\n apply clarsimp\n apply (frule tcb_cap_cases_lt)\n apply (clarsimp simp: nat_to_cref_unat_of_bl')\n done\n\nlemma (* unbind_notification_final *) [wp,Finalise_AI_asms]:\n \"\\is_final_cap' cap\\ unbind_notification t \\ \\rv. is_final_cap' cap\\\"\n unfolding unbind_notification_def\n apply (wp final_cap_lift thread_set_caps_of_state_trivial hoare_drop_imps\n | wpc | simp add: tcb_cap_cases_def)+\n done\n\nlemma arch_thread_set_caps_of_state[wp]:\n \"arch_thread_set v t \\\\s. P (caps_of_state s) \\\"\n apply (wpsimp simp: arch_thread_set_def wp: set_object_wp)\n apply (clarsimp simp: fun_upd_def)\n apply (frule get_tcb_ko_atD)\n apply (auto simp: caps_of_state_after_update obj_at_def tcb_cap_cases_def)\n done\n\nlemma arch_thread_set_final_cap[wp]:\n \"\\is_final_cap' cap\\ arch_thread_set v t \\\\rv. is_final_cap' cap\\\"\n by (wpsimp simp: is_final_cap'_def2 cte_wp_at_caps_of_state)\n\nlemma arch_thread_get_final_cap[wp]:\n \"\\is_final_cap' cap\\ arch_thread_get v t \\\\rv. is_final_cap' cap\\\"\n apply (simp add: arch_thread_get_def is_final_cap'_def2 cte_wp_at_caps_of_state, wp)\n apply auto\n done\n\ncrunches prepare_thread_delete\n for caps_of_state[wp]: \"\\s. P (caps_of_state s)\"\n (wp: crunch_wps ignore: do_machine_op)\n\ndeclare prepare_thread_delete_caps_of_state [Finalise_AI_asms]\n\nlemma dissociate_vcpu_tcb_final_cap[wp]:\n \"\\is_final_cap' cap\\ dissociate_vcpu_tcb v t \\\\rv. is_final_cap' cap\\\"\n by (wpsimp simp: is_final_cap'_def2 cte_wp_at_caps_of_state)\n\nlemma prepare_thread_delete_final[wp]:\n \"\\is_final_cap' cap\\ prepare_thread_delete t \\ \\rv. is_final_cap' cap\\\"\n unfolding prepare_thread_delete_def fpu_thread_delete_def by wpsimp\n\nlemma length_and_unat_of_bl_length:\n \"(length xs = x \\ unat (of_bl xs :: 'a::len word) < 2 ^ x) = (length xs = x)\"\n by (auto simp: unat_of_bl_length)\n\nlemma (* finalise_cap_cases1 *)[Finalise_AI_asms]:\n \"\\\\s. final \\ is_final_cap' cap s\n \\ cte_wp_at ((=) cap) slot s\\\n finalise_cap cap final\n \\\\rv s. fst rv = cap.NullCap\n \\ snd rv = (if final then cap_cleanup_opt cap else NullCap)\n \\ (snd rv \\ NullCap \\ is_final_cap' cap s)\n \\\n is_zombie (fst rv) \\ is_final_cap' cap s\n \\ snd rv = NullCap\n \\ appropriate_cte_cap (fst rv) = appropriate_cte_cap cap\n \\ cte_refs (fst rv) = cte_refs cap\n \\ gen_obj_refs (fst rv) = gen_obj_refs cap\n \\ obj_size (fst rv) = obj_size cap\n \\ fst_cte_ptrs (fst rv) = fst_cte_ptrs cap\n \\ vs_cap_ref cap = None\\\"\n apply (cases cap, simp_all split del: if_split cong: if_cong)\n apply ((wp suspend_final_cap[where sl=slot]\n deleting_irq_handler_final[where slot=slot]\n | simp add: o_def is_cap_simps fst_cte_ptrs_def\n dom_tcb_cap_cases_lt_ARCH tcb_cnode_index_def\n can_fast_finalise_def length_and_unat_of_bl_length\n appropriate_cte_cap_def gen_obj_refs_def\n vs_cap_ref_def cap_cleanup_opt_def\n | intro impI TrueI ext conjI)+)[11]\n apply (simp add: arch_finalise_cap_def split del: if_split)\n apply (wpsimp simp: cap_cleanup_opt_def arch_cap_cleanup_opt_def)\n done\n\ncrunch typ_at_arch [wp]: arch_thread_set \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps set_object_typ_at)\n\ncrunch typ_at[wp]: dissociate_vcpu_tcb \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps simp: crunch_simps unless_def assertE_def\n ignore: do_machine_op set_object)\n\ncrunch typ_at[wp,Finalise_AI_asms]: arch_finalise_cap \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps simp: crunch_simps unless_def assertE_def\n ignore: maskInterrupt set_object)\n\ncrunch typ_at[wp,Finalise_AI_asms]: prepare_thread_delete \"\\s. P (typ_at T p s)\"\n\ncrunch tcb_at[wp]: arch_thread_set \"\\s. tcb_at p s\"\n (ignore: set_object)\n\ncrunch tcb_at[wp]: arch_thread_get \"\\s. tcb_at p s\"\n\nlemma vcpu_set_tcb_at[wp]: \"\\\\s. tcb_at p s\\ set_vcpu t vcpu \\\\_ s. tcb_at p s\\\"\n by (wpsimp simp: tcb_at_typ)\n\ncrunch tcb_at[wp]: dissociate_vcpu_tcb \"\\s. tcb_at p s\"\n (wp: crunch_wps)\n\ncrunch tcb_at[wp]: prepare_thread_delete \"\\s. tcb_at p s\"\n\nlemma (* finalise_cap_new_valid_cap *)[wp,Finalise_AI_asms]:\n \"\\valid_cap cap\\ finalise_cap cap x \\\\rv. valid_cap (fst rv)\\\"\n apply (cases cap; simp)\n apply (wp suspend_valid_cap prepare_thread_delete_typ_at\n | simp add: o_def valid_cap_def cap_aligned_def\n valid_cap_Null_ext\n split del: if_split\n | clarsimp | rule conjI)+\n (* ArchObjectCap *)\n apply (wpsimp wp: o_def valid_cap_def cap_aligned_def\n split_del: if_split\n | clarsimp simp: arch_finalise_cap_def)+\n done\n\ncrunch inv[wp]: arch_thread_get \"P\"\n\nlemma hoare_split: \"\\\\P\\ f \\Q\\; \\P\\ f \\Q'\\\\ \\ \\P\\ f \\\\r. Q r and Q' r\\\"\n by (auto simp: valid_def)\n\nsublocale\n arch_thread_set: non_aobj_non_cap_non_mem_op \"arch_thread_set f v\"\n by (unfold_locales;\n ((wpsimp)?;\n wpsimp wp: set_object_non_arch simp: non_arch_objs arch_thread_set_def)?)\n\n(* arch_thread_set invariants *)\nlemma arch_thread_set_cur_tcb[wp]: \"\\cur_tcb\\ arch_thread_set p v \\\\_. cur_tcb\\\"\n unfolding cur_tcb_def[abs_def]\n apply (rule hoare_lift_Pf [where f=cur_thread])\n apply (simp add: tcb_at_typ)\n apply wp\n apply (simp add: arch_thread_set_def)\n apply (wp hoare_drop_imp)\n apply simp\n done\n\nlemma cte_wp_at_update_some_tcb:\n \"\\kheap s v = Some (TCB tcb) ; tcb_cnode_map tcb = tcb_cnode_map (f tcb)\\\n \\ cte_wp_at P p (s\\kheap := kheap s (v \\ TCB (f tcb))\\) = cte_wp_at P p s\"\n apply (clarsimp simp: cte_wp_at_cases2 dest!: get_tcb_SomeD)\n done\n\nlemma arch_thread_set_cap_refs_respects_device_region[wp]:\n \"\\cap_refs_respects_device_region\\\n arch_thread_set p v\n \\\\s. cap_refs_respects_device_region\\\"\n apply (simp add: arch_thread_set_def set_object_def get_object_def)\n apply wp\n apply (clarsimp dest!: get_tcb_SomeD simp del: fun_upd_apply)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (subst cap_refs_respects_region_cong)\n prefer 3\n apply assumption\n apply (rule cte_wp_caps_of_lift)\n apply (subst arch_tcb_update_aux3)\n apply (rule_tac cte_wp_at_update_some_tcb, assumption)\n apply (simp add: tcb_cnode_map_def)+\n done\n\nlemma arch_thread_set_pspace_respects_device_region[wp]:\n \"\\pspace_respects_device_region\\\n arch_thread_set p v\n \\\\s. pspace_respects_device_region\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp get_object_wp set_object_pspace_respects_device_region)\n apply clarsimp\n done\n\nlemma arch_thread_set_cap_refs_in_kernel_window[wp]:\n \"\\cap_refs_in_kernel_window\\ arch_thread_set p v \\\\_. cap_refs_in_kernel_window\\\"\n unfolding cap_refs_in_kernel_window_def[abs_def]\n apply (rule hoare_lift_Pf [where f=\"\\s. not_kernel_window s\"])\n apply (rule valid_refs_cte_lift)\n apply wp+\n done\n\ncrunch valid_irq_states[wp]: arch_thread_set valid_irq_states\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch interrupt_state[wp]: arch_thread_set \"\\s. P (interrupt_states s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemmas arch_thread_set_valid_irq_handlers[wp] = valid_irq_handlers_lift[OF arch_thread_set.caps arch_thread_set_interrupt_state]\n\ncrunch interrupt_irq_node[wp]: arch_thread_set \"\\s. P (interrupt_irq_node s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemmas arch_thread_set_valid_irq_node[wp] = valid_irq_node_typ[OF arch_thread_set_typ_at_arch arch_thread_set_interrupt_irq_node]\n\ncrunch idle_thread[wp]: arch_thread_set \"\\s. P (idle_thread s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma arch_thread_set_valid_global_refs[wp]:\n \"\\valid_global_refs\\ arch_thread_set p v \\\\rv. valid_global_refs\\\"\n by (rule valid_global_refs_cte_lift) wp+\n\nlemma arch_thread_set_valid_reply_masters[wp]:\n \"\\valid_reply_masters\\ arch_thread_set p v \\\\rv. valid_reply_masters\\\"\n by (rule valid_reply_masters_cte_lift) wp\n\nlemma arch_thread_set_pred_tcb_at[wp_unsafe]:\n \"\\pred_tcb_at proj P t and K (proj_not_field proj tcb_arch_update)\\\n arch_thread_set p v\n \\\\rv. pred_tcb_at proj P t\\\"\n apply (simp add: arch_thread_set_def set_object_def get_object_def)\n apply wp\n apply (clarsimp simp: pred_tcb_at_def obj_at_def get_tcb_rev\n dest!: get_tcb_SomeD)\n done\n\nlemma arch_thread_set_valid_reply_caps[wp]:\n \"\\valid_reply_caps\\ arch_thread_set p v \\\\rv. valid_reply_caps\\\"\n by (rule valid_reply_caps_st_cte_lift)\n (wpsimp wp: arch_thread_set_pred_tcb_at)+\n\nlemma arch_thread_set_if_unsafe_then_cap[wp]:\n \"\\if_unsafe_then_cap\\ arch_thread_set p v \\\\rv. if_unsafe_then_cap\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp get_object_wp set_object_ifunsafe)\n apply (clarsimp split: kernel_object.splits arch_kernel_obj.splits\n dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev)\n apply assumption\n apply simp\n apply (subst get_tcb_rev, assumption, simp)+\n apply (clarsimp simp: obj_at_def tcb_cap_cases_def)\n done\n\nlemma arch_thread_set_only_idle[wp]:\n \"\\only_idle\\ arch_thread_set p v \\\\rv. only_idle\\\"\n by (wpsimp wp: only_idle_lift set_asid_pool_typ_at\n arch_thread_set_pred_tcb_at)\n\nlemma arch_thread_set_valid_idle[wp]:\n \"\\valid_idle and (\\ s. t \\ idle_thread s \\ (\\atcb. tcb_vcpu atcb = None \\ tcb_vcpu (f atcb) = None))\\\n arch_thread_set f t\n \\\\rv. valid_idle\\\"\n by (wpsimp simp: arch_thread_set_def set_object_def get_object_def valid_idle_def\n valid_arch_idle_def get_tcb_def pred_tcb_at_def obj_at_def pred_neg_def)\n\nlemma arch_thread_set_valid_ioc[wp]:\n \"\\valid_ioc\\ arch_thread_set p v \\\\rv. valid_ioc\\\"\n apply (simp add: arch_thread_set_def set_object_def get_object_def)\n apply (wp set_object_valid_ioc_caps)\n apply (clarsimp simp add: valid_ioc_def\n simp del: fun_upd_apply\n split: kernel_object.splits arch_kernel_obj.splits\n dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (subst arch_tcb_update_aux3)\n apply (subst cte_wp_at_update_some_tcb,assumption)\n apply (clarsimp simp: tcb_cnode_map_def)+\n done\n\nlemma arch_thread_set_valid_mdb[wp]: \"\\valid_mdb\\ arch_thread_set p v \\\\rv. valid_mdb\\\"\n by (wpsimp wp: valid_mdb_lift get_object_wp simp: arch_thread_set_def set_object_def)\n\nlemma arch_thread_set_zombies_final[wp]: \"\\zombies_final\\ arch_thread_set p v \\\\rv. zombies_final\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp get_object_wp set_object_zombies)\n apply (clarsimp split: kernel_object.splits arch_kernel_obj.splits\n dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev)\n apply assumption\n apply simp\n apply (subst get_tcb_rev, assumption, simp)+\n apply (clarsimp simp: obj_at_def tcb_cap_cases_def)\n done\n\nlemma arch_thread_set_if_live_then_nonz_cap_Some[wp]:\n \"\\ (ex_nonz_cap_to t or obj_at live t) and if_live_then_nonz_cap\\\n arch_thread_set (tcb_vcpu_update (\\_. Some vcp)) t \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_iflive)\n apply (clarsimp simp: ex_nonz_cap_to_def if_live_then_nonz_cap_def\n dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (clarsimp simp: obj_at_def tcb_cap_cases_def)\n done\n\nlemma arch_thread_set_pspace_in_kernel_window[wp]:\n \"\\pspace_in_kernel_window\\ arch_thread_set f v \\\\_.pspace_in_kernel_window\\\"\n by (rule pspace_in_kernel_window_atyp_lift, wp+)\n\nlemma arch_thread_set_pspace_distinct[wp]: \"\\pspace_distinct\\arch_thread_set f v\\\\_. pspace_distinct\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_distinct)\n apply (clarsimp simp: get_object_def obj_at_def\n dest!: get_tcb_SomeD)\n done\n\nlemma arch_thread_set_pspace_aligned[wp]:\n \"\\pspace_aligned\\ arch_thread_set f v \\\\_. pspace_aligned\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_aligned)\n apply (clarsimp simp: obj_at_def get_object_def\n dest!: get_tcb_SomeD)\n done\n\nlemma arch_thread_set_valid_objs_context[wp]:\n \"arch_thread_set (tcb_context_update f) v \\valid_objs\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_valid_objs)\n apply (clarsimp simp: Ball_def obj_at_def valid_objs_def dest!: get_tcb_SomeD)\n apply (erule_tac x=v in allE)\n apply (clarsimp simp: dom_def)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (clarsimp simp:valid_obj_def valid_tcb_def tcb_cap_cases_def)\n done\n\nlemma arch_thread_set_valid_objs_vcpu_None[wp]:\n \"arch_thread_set (tcb_vcpu_update Map.empty) v \\valid_objs\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_valid_objs)\n apply (clarsimp simp: Ball_def obj_at_def valid_objs_def dest!: get_tcb_SomeD)\n apply (erule_tac x=v in allE)\n apply (clarsimp simp: dom_def)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (clarsimp simp:valid_obj_def valid_tcb_def tcb_cap_cases_def valid_arch_tcb_def)\n done\n\nlemma arch_thread_set_valid_objs_vcpu_Some[wp]:\n \"\\valid_objs and vcpu_at vcpu\\ arch_thread_set (tcb_vcpu_update (\\_. Some vcpu)) v \\\\_. valid_objs\\\"\n apply (simp add: arch_thread_set_def)\n apply (wpsimp wp: set_object_valid_objs)\n apply (clarsimp simp: Ball_def obj_at_def valid_objs_def dest!: get_tcb_SomeD)\n apply (erule_tac x=v in allE)\n apply (clarsimp simp: dom_def)\n apply (clarsimp simp:valid_obj_def valid_tcb_def tcb_cap_cases_def valid_arch_tcb_def obj_at_def)\n done\n\nlemma sym_refs_update_some_tcb:\n \"\\kheap s v = Some (TCB tcb) ; refs_of (TCB tcb) = refs_of (TCB (f tcb))\\\n \\ sym_refs (state_refs_of (s\\kheap := kheap s (v \\ TCB (f tcb))\\)) = sym_refs (state_refs_of s)\"\n apply (rule_tac f=sym_refs in arg_cong)\n apply (rule all_ext)\n apply (clarsimp simp: sym_refs_def state_refs_of_def)\n done\n\nlemma arch_thread_sym_refs[wp]:\n \"\\\\s. sym_refs (state_refs_of s)\\ arch_thread_set f p \\\\rv s. sym_refs (state_refs_of s)\\\"\n apply (simp add: arch_thread_set_def set_object_def get_object_def)\n apply wp\n apply (clarsimp simp del: fun_upd_apply dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (subst arch_tcb_update_aux3)\n apply (subst sym_refs_update_some_tcb[where f=\"tcb_arch_update f\"])\n apply assumption\n apply (clarsimp simp: refs_of_def)\n apply assumption\n done\n\nlemma arch_thread_get_tcb:\n \"\\ \\ \\ arch_thread_get tcb_vcpu p \\\\rv s. \\t. obj_at (\\tcb. tcb = (TCB t) \\ rv = tcb_vcpu (tcb_arch t)) p s\\\"\n apply (simp add: arch_thread_get_def)\n apply wp\n apply (clarsimp simp: obj_at_def dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply simp\n done\n\nlemma get_vcpu_ko: \"\\Q\\ get_vcpu p \\\\rv s. ko_at (ArchObj (VCPU rv)) p s \\ Q s\\\"\n unfolding get_vcpu_def\n by wpsimp\n (simp add: obj_at_def in_omonad)\n\nlemma vcpu_invalidate_tcbs_inv[wp]:\n \"\\obj_at (\\tcb. \\t'. tcb = TCB t' \\ P t') t\\\n vcpu_invalidate_active \\\\rv. obj_at (\\tcb. \\t'. tcb = TCB t' \\ P t') t\\\"\n unfolding vcpu_invalidate_active_def vcpu_disable_def by wpsimp\n\nlemma sym_refs_vcpu_None:\n assumes sym_refs: \"sym_refs (state_hyp_refs_of s)\"\n assumes tcb: \"ko_at (TCB tcb) t s\" \"tcb_vcpu (tcb_arch tcb) = Some vr\"\n shows \"sym_refs (state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_arch := tcb_vcpu_update Map.empty (tcb_arch tcb)\\),\n vr \\ ArchObj (VCPU (vcpu_tcb_update Map.empty v)))\\))\"\n (is \"sym_refs (state_hyp_refs_of ?s')\")\nproof -\n from tcb\n have t: \"state_hyp_refs_of s t = {(vr,TCBHypRef)}\"\n by (simp add: state_hyp_refs_of_def obj_at_def)\n moreover\n from t\n have \"(t,HypTCBRef) \\ state_hyp_refs_of s vr\"\n using sym_refsD [of vr _ _ t, OF _ sym_refs] by auto\n hence vr: \"state_hyp_refs_of s vr = {(t,HypTCBRef)}\"\n by (auto simp: state_hyp_refs_of_def hyp_refs_of_def tcb_vcpu_refs_def vcpu_tcb_refs_def\n refs_of_def refs_of_ao_def\n split: option.splits kernel_object.splits arch_kernel_obj.splits)\n moreover\n from sym_refs vr\n have \"\\x r rt. \\ (r, rt) \\ state_hyp_refs_of s x; x \\ t \\ \\ r \\ vr\"\n by (auto dest: sym_refsD)\n moreover\n from sym_refs t\n have \"\\x r rt. \\ (r, rt) \\ state_hyp_refs_of s x; x \\ vr \\ \\ r \\ t\"\n by (auto dest: sym_refsD)\n ultimately\n have \"sym_refs ((state_hyp_refs_of s) (vr := {}, t := {}))\"\n using sym_refs unfolding sym_refs_def by (clarsimp simp: split_def)\n moreover\n have \"state_hyp_refs_of ?s' = (state_hyp_refs_of s) (vr := {}, t := {})\"\n unfolding state_hyp_refs_of_def by (rule ext) (simp add: vcpu_tcb_refs_def)\n ultimately\n show ?thesis by simp\nqed\n\nlemma arch_thread_set_wp:\n \"\\\\s. get_tcb p s \\ None \\ Q (s\\kheap := kheap s(p \\ TCB (the (get_tcb p s)\\tcb_arch := f (tcb_arch (the (get_tcb p s)))\\))\\) \\\n arch_thread_set f p\n \\\\_. Q\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_wp)\n apply simp\n done\n\nlemma arch_thread_get_wp:\n \"\\\\s. \\tcb. ko_at (TCB tcb) t s \\ Q (f (tcb_arch tcb)) s\\ arch_thread_get f t \\Q\\\"\n apply (wpsimp simp: arch_thread_get_def)\n apply (auto dest!: get_tcb_ko_atD)\n done\n\n(* FIXME: move *)\nlemma get_tcb_None_tcb_at:\n \"(get_tcb p s = None) = (\\tcb_at p s)\"\n by (auto simp: get_tcb_def obj_at_def is_tcb_def split: kernel_object.splits option.splits)\n\n(* FIXME: move *)\nlemma get_tcb_Some_ko_at:\n \"(get_tcb p s = Some t) = ko_at (TCB t) p s\"\n by (auto simp: get_tcb_def obj_at_def is_tcb_def split: kernel_object.splits option.splits)\n\nlemma dissociate_vcpu_tcb_sym_refs_hyp[wp]:\n \"\\\\s. sym_refs (state_hyp_refs_of s)\\ dissociate_vcpu_tcb vr t \\\\rv s. sym_refs (state_hyp_refs_of s)\\\"\n apply (simp add: dissociate_vcpu_tcb_def arch_get_sanitise_register_info_def)\n apply (wp arch_thread_set_wp set_vcpu_wp)\n apply (rule_tac Q=\"\\_ s. obj_at (\\ko. \\tcb. ko = TCB tcb \\ tcb_vcpu (tcb_arch tcb) = Some vr) t s\n \\ sym_refs (state_hyp_refs_of s)\" in hoare_post_imp)\n apply clarsimp\n apply (clarsimp simp: get_tcb_Some_ko_at obj_at_def sym_refs_vcpu_None split: if_splits)\n apply (wp get_vcpu_wp arch_thread_get_wp)+\n apply clarsimp\n apply (rule conjI, clarsimp simp: obj_at_def)\n apply clarsimp\n apply (clarsimp simp: get_tcb_Some_ko_at obj_at_def sym_refs_vcpu_None split: if_splits)\n done\n\ncrunch valid_objs[wp]: dissociate_vcpu_tcb \"valid_objs\"\n (wp: crunch_wps simp: crunch_simps valid_obj_def valid_vcpu_def ignore: arch_thread_set)\n\nlemma set_vcpu_unlive_hyp[wp]:\n \"\\\\s. vr \\ t \\ obj_at (Not \\ hyp_live) t s\\\n set_vcpu vr (vcpu_tcb_update Map.empty v) \\\\rv. obj_at (Not \\ hyp_live) t\\\"\n apply (wpsimp wp: set_vcpu_wp)\n apply (clarsimp simp: obj_at_def hyp_live_def arch_live_def)\n done\n\nlemma arch_thread_set_unlive_hyp[wp]:\n \"\\\\s. vr \\ t \\ obj_at (Not \\ hyp_live) vr s\\\n arch_thread_set (tcb_vcpu_update Map.empty) t \\\\_. obj_at (Not \\ hyp_live) vr\\\"\n apply (wpsimp simp: arch_thread_set_def wp: set_object_wp)\n apply (clarsimp simp: obj_at_def hyp_live_def)\n done\n\nlemma as_user_unlive_hyp[wp]:\n \"\\obj_at (Not \\ hyp_live) vr\\ as_user t f \\\\_. obj_at (Not \\ hyp_live) vr\\\"\n unfolding as_user_def\n by (wpsimp wp: set_object_wp)\n (clarsimp simp: obj_at_def hyp_live_def get_tcb_Some_ko_at arch_tcb_context_set_def)\n\nlemma dissociate_vcpu_tcb_unlive_hyp_vr[wp]:\n \"\\\\\\ dissociate_vcpu_tcb vr t \\ \\_. obj_at (Not \\ hyp_live) vr\\\"\n unfolding dissociate_vcpu_tcb_def arch_get_sanitise_register_info_def\n by (wpsimp wp: get_vcpu_wp hoare_vcg_const_imp_lift hoare_drop_imps)\n\nlemma dissociate_vcpu_tcb_unlive_hyp_t[wp]:\n \"\\\\\\ dissociate_vcpu_tcb vr t \\ \\_. obj_at (Not \\ hyp_live) t\\\"\n unfolding dissociate_vcpu_tcb_def arch_get_sanitise_register_info_def\n by (wpsimp wp: hoare_vcg_const_imp_lift hoare_drop_imps get_vcpu_wp)\n\nlemma arch_thread_set_unlive0[wp]:\n \"\\obj_at (Not \\ live0) vr\\ arch_thread_set (tcb_vcpu_update Map.empty) t \\\\_. obj_at (Not \\ live0) vr\\\"\n apply (wpsimp simp: arch_thread_set_def wp: set_object_wp)\n apply (clarsimp simp: obj_at_def get_tcb_def split: kernel_object.splits)\n done\n\nlemma set_vcpu_unlive0[wp]:\n \"\\obj_at (Not \\ live0) t\\ set_vcpu vr v \\\\rv. obj_at (Not \\ live0) t\\\"\n by (wpsimp wp: set_vcpu_wp simp: obj_at_def)\n\nlemma as_user_unlive0[wp]:\n \"\\obj_at (Not \\ live0) vr\\ as_user t f \\\\_. obj_at (Not \\ live0) vr\\\"\n unfolding as_user_def\n apply (wpsimp wp: set_object_wp)\n by (clarsimp simp: obj_at_def arch_tcb_context_set_def dest!: get_tcb_SomeD)\n\nlemma o_def_not: \"obj_at (\\a. \\ P a) t s = obj_at (Not o P) t s\"\n by (simp add: obj_at_def)\n\ncrunch unlive0: dissociate_vcpu_tcb \"obj_at (Not \\ live0) t\"\n (wp: crunch_wps simp: o_def_not ignore: arch_thread_set)\n\nlemma arch_thread_set_if_live_then_nonz_cap':\n \"\\y. hyp_live (TCB (y\\tcb_arch := p (tcb_arch y)\\)) \\ hyp_live (TCB y) \\\n \\if_live_then_nonz_cap\\ arch_thread_set p v \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_iflive)\n apply (clarsimp simp: ex_nonz_cap_to_def if_live_then_nonz_cap_def\n dest!: get_tcb_SomeD)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (clarsimp simp: obj_at_def tcb_cap_cases_def)\n apply (erule_tac x=v in allE, drule mp; assumption?)\n apply (clarsimp simp: live_def)\n done\n\nlemma arch_thread_set_if_live_then_nonz_cap_None[wp]:\n \"\\if_live_then_nonz_cap\\ arch_thread_set (tcb_vcpu_update Map.empty) t \\\\rv. if_live_then_nonz_cap\\\"\n apply (wp arch_thread_set_if_live_then_nonz_cap')\n apply (clarsimp simp: hyp_live_def)\n apply assumption\n done\n\nlemma set_vcpu_if_live_then_nonz_cap_same_refs:\n \"\\if_live_then_nonz_cap and obj_at (\\ko'. hyp_refs_of ko' = hyp_refs_of (ArchObj (VCPU v))) p\\\n set_vcpu p v \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: set_vcpu_def)\n including unfold_objects\n apply (wpsimp wp: set_object_iflive[THEN hoare_set_object_weaken_pre]\n simp: a_type_def live_def hyp_live_def arch_live_def)\n apply (rule if_live_then_nonz_capD; simp)\n apply (clarsimp simp: live_def hyp_live_def arch_live_def,\n clarsimp simp: vcpu_tcb_refs_def split: option.splits)\n done\n\nlemma vgic_update_if_live_then_nonz_cap[wp]:\n \"\\if_live_then_nonz_cap\\ vgic_update vcpuptr f \\\\_. if_live_then_nonz_cap\\\"\n unfolding vgic_update_def vcpu_update_def\n apply (wp set_vcpu_if_live_then_nonz_cap_same_refs get_vcpu_wp)\n apply (clarsimp simp: obj_at_def in_omonad)\n done\n\nlemma vcpu_save_reg_if_live_then_nonz_cap[wp]:\n \"\\if_live_then_nonz_cap\\ vcpu_save_reg vcpuptr r \\\\_. if_live_then_nonz_cap\\\"\n unfolding vcpu_save_reg_def vcpu_update_def\n apply (wpsimp wp: set_vcpu_if_live_then_nonz_cap_same_refs get_vcpu_wp\n hoare_vcg_imp_lift hoare_vcg_all_lift)\n apply (simp add: obj_at_def in_omonad)\n done\n\nlemma vcpu_update_regs_if_live_then_nonz_cap[wp]:\n \"vcpu_update vcpu_ptr (vcpu_regs_update f) \\if_live_then_nonz_cap\\\"\n unfolding vcpu_update_def\n by (wpsimp wp: set_vcpu_if_live_then_nonz_cap_same_refs get_vcpu_wp)\n (simp add: obj_at_def in_omonad)\n\nlemma vcpu_write_if_live_then_nonz_cap[wp]:\n \"vcpu_write_reg vcpu_ptr reg val \\if_live_then_nonz_cap\\\"\n unfolding vcpu_write_reg_def by (wpsimp cong: vcpu.fold_congs)\n\nlemma vcpu_update_vtimer_if_live_then_nonz_cap[wp]:\n \"vcpu_update vcpu_ptr (vcpu_vtimer_update f) \\if_live_then_nonz_cap\\\"\n unfolding vcpu_update_def\n by (wpsimp wp: set_vcpu_if_live_then_nonz_cap_same_refs get_vcpu_wp)\n (simp add: obj_at_def in_omonad)\n\ncrunches vcpu_disable, vcpu_invalidate_active\n for if_live_then_nonz_cap[wp]: if_live_then_nonz_cap\n (ignore: vcpu_update)\n\nlemma dissociate_vcpu_tcb_if_live_then_nonz_cap[wp]:\n \"\\if_live_then_nonz_cap\\ dissociate_vcpu_tcb vr t \\\\rv. if_live_then_nonz_cap\\\"\n unfolding dissociate_vcpu_tcb_def arch_get_sanitise_register_info_def\n by (wpsimp wp: get_vcpu_wp arch_thread_get_wp hoare_drop_imps)\n\nlemma vcpu_invalidate_active_ivs[wp]: \"\\invs\\ vcpu_invalidate_active \\\\_. invs\\\"\n unfolding vcpu_invalidate_active_def\n by (wpsimp simp: cur_vcpu_at_def | strengthen invs_current_vcpu_update')+\n\ncrunch cur_tcb[wp]: dissociate_vcpu_tcb \"cur_tcb\"\n (wp: crunch_wps)\n\ncrunches dissociate_vcpu_tcb\n for cur_thread[wp]: \"\\s. P (cur_thread s)\"\n (wp: crunch_wps)\n\nlemma same_caps_tcb_arch_update[simp]:\n \"same_caps (TCB (tcb_arch_update f tcb)) = same_caps (TCB tcb)\"\n by (rule ext) (clarsimp simp: tcb_cap_cases_def)\n\ncrunches dissociate_vcpu_tcb\n for cap_refs_respects_device_region[wp]: \"cap_refs_respects_device_region\"\n (wp: crunch_wps cap_refs_respects_device_region_dmo\n simp: crunch_simps read_cntpct_def maskInterrupt_def\n ignore: do_machine_op)\n\ncrunch pspace_respects_device_region[wp]: dissociate_vcpu_tcb \"pspace_respects_device_region\"\n (wp: crunch_wps)\n\ncrunch cap_refs_in_kernel_window[wp]: dissociate_vcpu_tcb \"cap_refs_in_kernel_window\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch pspace_in_kernel_window[wp]: dissociate_vcpu_tcb \"pspace_in_kernel_window\"\n (wp: crunch_wps)\n\nlemma valid_asid_map_arm_current_vcpu_update[simp]:\n \"valid_asid_map (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\) = valid_asid_map s\"\n by (simp add: valid_asid_map_def vspace_at_asid_def)\n\ncrunch valid_asid_map[wp]: dissociate_vcpu_tcb \"valid_asid_map\"\n (wp: crunch_wps)\n\ncrunch valid_kernel_mappings[wp]: dissociate_vcpu_tcb \"valid_kernel_mappings\"\n (wp: crunch_wps)\n\ncrunch valid_arch_caps[wp]: dissociate_vcpu_tcb \"valid_arch_caps\"\n (wp: crunch_wps)\n\ncrunch valid_vspace_objs[wp]: dissociate_vcpu_tcb \"valid_vspace_objs\"\n (wp: crunch_wps)\n\ncrunch valid_irq_handlers[wp]: dissociate_vcpu_tcb \"valid_irq_handlers\"\n (wp: crunch_wps ignore: do_machine_op)\n\nlemma as_user_valid_irq_node[wp]:\n \"\\valid_irq_node\\ as_user t f \\\\_. valid_irq_node\\\"\n unfolding as_user_def\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: valid_irq_node_def obj_at_def is_cap_table dest!: get_tcb_SomeD)\n by (metis kernel_object.distinct(1) option.inject)\n\ncrunch valid_irq_node[wp]: dissociate_vcpu_tcb \"valid_irq_node\"\n (wp: crunch_wps)\n\nlemma dmo_maskInterrupt_True_valid_irq_states[wp]:\n \"do_machine_op (maskInterrupt True irq) \\valid_irq_states\\\"\n unfolding valid_irq_states_def do_machine_op_def maskInterrupt_def\n apply wpsimp\n apply (erule use_valid)\n apply (wpsimp simp: valid_irq_masks_def)+\n done\n\ncrunches vcpu_save_reg, vgic_update, vcpu_disable\n for valid_irq_states[wp]: valid_irq_states\n and in_user_frame[wp]: \"in_user_frame p\"\n (wp: dmo_maskInterrupt_True_valid_irq_states dmo_valid_irq_states\n simp: isb_def setHCR_def setSCTLR_def set_gic_vcpu_ctrl_hcr_def getSCTLR_def\n get_gic_vcpu_ctrl_hcr_def dsb_def readVCPUHardwareReg_def writeVCPUHardwareReg_def\n read_cntpct_def maskInterrupt_def check_export_arch_timer_def)\n\nlemma dmo_writeVCPUHardwareReg_valid_machine_state[wp]:\n \"do_machine_op (writeVCPUHardwareReg r v) \\valid_machine_state\\\"\n unfolding valid_machine_state_def\n by (wpsimp wp: hoare_vcg_all_lift hoare_vcg_disj_lift dmo_machine_state_lift)\n\ncrunches vgic_update, vcpu_update, vcpu_write_reg, vcpu_save_reg, save_virt_timer\n for in_user_frame[wp]: \"in_user_frame p\"\n and valid_machine_state[wp]: valid_machine_state\n and underlying_memory[wp]: \"\\s. P (underlying_memory (machine_state s))\"\n (simp: readVCPUHardwareReg_def read_cntpct_def\n wp: writeVCPUHardwareReg_underlying_memory_inv dmo_machine_state_lift\n ignore: do_machine_op)\n\nlemma vcpu_disable_valid_machine_state[wp]:\n \"\\valid_machine_state\\ vcpu_disable vcpu_opt \\\\_. valid_machine_state\\\"\n unfolding vcpu_disable_def valid_machine_state_def\n by (wpsimp wp: dmo_machine_state_lift hoare_vcg_all_lift hoare_vcg_disj_lift\n simp: isb_def setHCR_def setSCTLR_def set_gic_vcpu_ctrl_hcr_def getSCTLR_def\n get_gic_vcpu_ctrl_hcr_def dsb_def writeVCPUHardwareReg_def maskInterrupt_def)\n\nlemma valid_arch_state_vcpu_update_str:\n \"valid_arch_state s \\ valid_arch_state (s\\arch_state := arm_current_vcpu_update Map.empty (arch_state s)\\)\"\n unfolding valid_arch_state_def\n by (clarsimp simp: cur_vcpu_def valid_global_arch_objs_def)\n\nlemma valid_global_refs_vcpu_update_str:\n \"valid_global_refs s \\ valid_global_refs (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\"\n by (simp add: valid_global_refs_def global_refs_def)\n\nlemma set_vcpu_None_valid_arch[wp]:\n \"\\valid_arch_state and (\\s. \\a. arm_current_vcpu (arch_state s) \\ Some (vr, a))\\\n set_vcpu vr (vcpu_tcb_update Map.empty v) \\\\_. valid_arch_state\\\"\n supply fun_upd_apply[simp del]\n apply (wpsimp wp: set_vcpu_wp)\n apply (clarsimp simp: valid_arch_state_def valid_global_arch_objs_def pts_of_vcpu_None_upd_idem\n asid_pools_of_vcpu_None_upd_idem vmid_inv_def pt_at_eq_set_vcpu)\n apply (clarsimp simp add: cur_vcpu_def fun_upd_apply in_opt_pred split: option.splits)\n done\n\nlemma dissociate_vcpu_valid_arch[wp]:\n \"\\valid_arch_state\\ dissociate_vcpu_tcb vr t \\\\_. valid_arch_state\\\"\n unfolding dissociate_vcpu_tcb_def vcpu_invalidate_active_def arch_get_sanitise_register_info_def\n by (wpsimp wp: get_vcpu_wp arch_thread_get_wp\n | strengthen valid_arch_state_vcpu_update_str | wp (once) hoare_drop_imps)+\n\nlemma as_user_valid_irq_states[wp]:\n \"\\valid_irq_states\\ as_user t f \\\\rv. valid_irq_states\\\"\n unfolding as_user_def\n by (wpsimp wp: set_object_wp simp: obj_at_def valid_irq_states_def)\n\nlemma as_user_ioc[wp]:\n \"\\\\s. P (is_original_cap s)\\ as_user t f \\\\rv s. P (is_original_cap s)\\\"\n unfolding as_user_def by (wpsimp wp: set_object_wp)\n\nlemma as_user_valid_ioc[wp]:\n \"\\valid_ioc\\ as_user t f \\\\rv. valid_ioc\\\"\n unfolding valid_ioc_def by (wpsimp wp: hoare_vcg_imp_lift hoare_vcg_all_lift)\n\nlemma dissociate_vcpu_tcb_invs[wp]: \"\\invs\\ dissociate_vcpu_tcb vr t \\\\_. invs\\\"\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (simp add: pred_conj_def)\n apply (rule hoare_vcg_conj_lift[rotated])+\n apply (wpsimp wp: weak_if_wp get_vcpu_wp arch_thread_get_wp as_user_only_idle arch_thread_set_valid_idle\n | simp add: dissociate_vcpu_tcb_def vcpu_invalidate_active_def arch_get_sanitise_register_info_def\n | strengthen valid_arch_state_vcpu_update_str valid_global_refs_vcpu_update_str\n | simp add: vcpu_disable_def valid_global_vspace_mappings_def valid_global_objs_def\n | wp (once) hoare_drop_imps)+\n done\n\ncrunch invs[wp]: vcpu_finalise invs\n (ignore: dissociate_vcpu_tcb)\n\nlemma arch_finalise_cap_invs' [wp,Finalise_AI_asms]:\n \"\\invs and valid_cap (ArchObjectCap cap)\\\n arch_finalise_cap cap final\n \\\\rv. invs\\\"\n apply (simp add: arch_finalise_cap_def)\n apply (rule hoare_pre)\n apply (wp unmap_page_invs | wpc)+\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (auto simp: mask_def vmsz_aligned_def wellformed_mapdata_def)\n done\n\nlemma arch_thread_set_unlive_other:\n \"\\\\s. vr \\ t \\ obj_at (Not \\ live) vr s\\ arch_thread_set (tcb_vcpu_update Map.empty) t \\\\_. obj_at (Not \\ live) vr\\\"\n apply (wpsimp simp: arch_thread_set_def wp: set_object_wp)\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma set_vcpu_unlive[wp]:\n \"\\\\\\ set_vcpu vr (vcpu_tcb_update Map.empty v) \\\\rv. obj_at (Not \\ live) vr\\\"\n apply (wp set_vcpu_wp)\n apply (clarsimp simp: obj_at_def live_def hyp_live_def arch_live_def)\n done\n\nlemma as_user_unlive[wp]:\n \"\\obj_at (Not \\ live) vr\\ as_user t f \\\\_. obj_at (Not \\ live) vr\\\"\n unfolding as_user_def\n apply (wpsimp wp: set_object_wp)\n by (clarsimp simp: obj_at_def live_def hyp_live_def arch_tcb_context_set_def dest!: get_tcb_SomeD)\n\nlemma dissociate_vcpu_tcb_unlive_v:\n \"\\\\\\ dissociate_vcpu_tcb vr t \\ \\_. obj_at (Not \\ live) vr\\\"\n unfolding dissociate_vcpu_tcb_def\n by (wpsimp wp: arch_thread_set_unlive_other get_vcpu_wp arch_thread_get_wp hoare_drop_imps\n simp: bind_assoc)\n\nlemma vcpu_finalise_unlive:\n \"\\\\\\ vcpu_finalise r \\ \\_. obj_at (Not \\ live) r \\\"\n apply (wpsimp simp: vcpu_finalise_def wp: dissociate_vcpu_tcb_unlive_v get_vcpu_wp)\n apply (auto simp: obj_at_def in_omonad live_def hyp_live_def arch_live_def)\n done\n\nlemma arch_finalise_cap_vcpu:\n notes strg = tcb_cap_valid_imp_NullCap\n vcpu_finalise_unlive[simplified o_def]\n notes simps = replaceable_def\n is_cap_simps vs_cap_ref_def\n no_cap_to_obj_with_diff_ref_Null o_def\n notes wps = hoare_drop_imp[where R=\"%_. is_final_cap' cap\" for cap]\n valid_cap_typ\n shows\n \"cap = VCPUCap r \\ \\\\s. s \\ cap.ArchObjectCap cap \\\n x = is_final_cap' (cap.ArchObjectCap cap) s \\\n pspace_aligned s \\ valid_vspace_objs s \\ valid_objs s \\\n valid_asid_table s\\\n arch_finalise_cap cap x\n \\\\rv s. replaceable s sl (fst rv) (cap.ArchObjectCap cap)\\\"\n apply (simp add: arch_finalise_cap_def)\n apply (wpsimp wp: wps simp: simps reachable_frame_cap_def | strengthen strg)+\n done\n\nlemma obj_at_not_live_valid_arch_cap_strg [Finalise_AI_asms]:\n \"(s \\ ArchObjectCap cap \\ aobj_ref cap = Some r \\ \\ typ_at (AArch AVCPU) r s)\n \\ obj_at (\\ko. \\ live ko) r s\"\n by (clarsimp simp: live_def valid_cap_def valid_arch_cap_ref_def obj_at_def a_type_arch_live\n valid_cap_simps hyp_live_def arch_live_def\n split: arch_cap.split_asm if_splits)\n\nlemma obj_at_not_live_valid_arch_cap_strg' [Finalise_AI_asms]:\n \"(s \\ ArchObjectCap cap \\ aobj_ref cap = Some r \\ cap \\ VCPUCap r)\n \\ obj_at (\\ko. \\ live ko) r s\"\n by (clarsimp simp: live_def valid_cap_def valid_arch_cap_ref_def obj_at_def\n hyp_live_def arch_live_def\n split: arch_cap.split_asm if_splits)\n\ncrunches set_vm_root\n for ptes_of[wp]: \"\\s. P (ptes_of s)\"\n and asid_table[wp]: \"\\s. P (asid_table s)\"\n (simp: crunch_simps)\n\nlemma vs_lookup_table_lift_strong:\n assumes \"\\P. f \\\\s. P (ptes_of s)\\\"\n assumes \"\\P ap_ptr. f \\\\s. P (vspace_for_pool ap_ptr asid (asid_pools_of s))\\\"\n assumes \"\\P. f \\\\s. P (asid_table s)\\\"\n shows \"f \\\\s. P (vs_lookup_table level asid vref s)\\\"\n apply (simp add: vs_lookup_table_def obind_def split: option.splits)\n apply (wpsimp wp: hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_imp_lift' pool_for_asid_lift assms\n simp: not_le)\n done\n\nlemma vs_lookup_slot_lift_strong:\n assumes \"\\P. f \\\\s. P (ptes_of s)\\\"\n assumes \"\\P ap_ptr. f \\\\s. P (vspace_for_pool ap_ptr asid (asid_pools_of s))\\\"\n assumes \"\\P. f \\\\s. P (asid_table s)\\\"\n shows \"f \\\\s. P (vs_lookup_slot level asid vref s)\\\"\n apply (simp add: vs_lookup_slot_def obind_def split: option.splits)\n apply (wpsimp wp: assms hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_imp_lift' pool_for_asid_lift\n vs_lookup_table_lift_strong\n simp: not_le)\n done\n\nlemma vs_lookup_target_lift_strong:\n assumes \"\\P. f \\\\s. P (ptes_of s)\\\"\n assumes \"\\P ap_ptr. f \\\\s. P (vspace_for_pool ap_ptr asid (asid_pools_of s))\\\"\n assumes \"\\P. f \\\\s. P (asid_table s)\\\"\n shows \"f \\\\s. P (vs_lookup_target level asid vref s)\\\"\n apply (simp add: vs_lookup_target_def obind_def split: option.splits)\n apply (wpsimp wp: assms hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_imp_lift' pool_for_asid_lift\n vs_lookup_slot_lift_strong\n simp: not_le)\n done\n\nlemma update_asid_pool_entry_vspace_for_pool:\n \"\\\\s. (\\entry. f entry \\ None \\ ap_vspace (the (f entry)) = ap_vspace entry) \\\n P (vspace_for_pool ap_ptr asid (asid_pools_of s))\\\n update_asid_pool_entry f asid'\n \\\\_ s. P (vspace_for_pool ap_ptr asid (asid_pools_of s)) \\\"\n unfolding update_asid_pool_entry_def\n apply (wpsimp simp_del: fun_upd_apply)\n apply (erule rsubst[where P=P])\n apply (simp add: vspace_for_pool_def entry_for_pool_def obind_def split: option.splits)\n by (metis if_option_None_eq(2) option.sel)\n\ncrunches get_vmid, set_vm_root\n for vspace_for_pool[wp]: \"\\s. P (vspace_for_pool ap_ptr asid (asid_pools_of s))\"\n (simp: crunch_simps\n wp: update_asid_pool_entry_vspace_for_pool\n wp_del: update_asid_pool_entry_asid_pools\n ignore: update_asid_pool_entry)\n\nlemma set_vm_root_vs_lookup_target[wp]:\n \"set_vm_root tcb \\\\s. P (vs_lookup_target level asid vref s)\\\"\n by (wp vs_lookup_target_lift_strong)\n\nlemma vs_lookup_target_no_asid_pool:\n \"\\asid_pool_at ptr s; valid_vspace_objs s; valid_asid_table s; pspace_aligned s;\n vs_lookup_target level asid 0 s = Some (level, ptr)\\\n \\ False\"\n apply (clarsimp simp: vs_lookup_target_def split: if_split_asm)\n apply (clarsimp simp: vs_lookup_slot_def vs_lookup_table_def obj_at_def)\n apply (frule (1) pool_for_asid_validD, clarsimp)\n apply (subst (asm) pool_for_asid_vs_lookup[symmetric, where vref=0 and level=asid_pool_level, simplified])\n apply (drule (1) valid_vspace_objsD; simp add: in_omonad)\n apply (fastforce simp: vspace_for_pool_def in_omonad obj_at_def ran_def entry_for_pool_def)\n apply (rename_tac pt_ptr)\n apply (clarsimp simp: vs_lookup_slot_def obj_at_def split: if_split_asm)\n apply (clarsimp simp: in_omonad)\n apply (frule (1) vs_lookup_table_is_aligned; clarsimp?)\n apply (clarsimp simp: ptes_of_def)\n apply (rename_tac pt)\n apply (drule (1) valid_vspace_objsD; simp add: in_omonad)\n apply (simp add: is_aligned_mask pt_range_def)\n apply (erule_tac x=0 in allE)\n apply (clarsimp simp: pte_ref_def data_at_def obj_at_def split: pte.splits)\n apply (simp add: pptr_from_pte_def)\n done\n\nlemma vs_lookup_target_clear_asid_strg:\n \"table = asid_table s \\\n vs_lookup_target level asid 0\n (s\\arch_state := (arch_state s) \\arm_asid_table :=\n table (asid_high_bits_of asid := None)\\\\)\n = None\"\n by (clarsimp simp: vs_lookup_target_def vs_lookup_slot_def vs_lookup_table_def pool_for_asid_def\n obind_def)\n\nlemma delete_asid_pool_not_target[wp]:\n \"\\asid_pool_at ptr and valid_vspace_objs and valid_asid_table and pspace_aligned\\\n delete_asid_pool asid ptr\n \\\\rv s. vs_lookup_target level asid 0 s \\ Some (level, ptr)\\\"\n unfolding delete_asid_pool_def\n supply fun_upd_apply[simp del]\n apply (wpsimp)\n apply (strengthen vs_lookup_target_clear_asid_strg[THEN None_Some_strg])\n apply (wpsimp wp: mapM_wp' get_asid_pool_wp)+\n apply (erule (4) vs_lookup_target_no_asid_pool)\n done\n\nlemma delete_asid_pool_not_reachable[wp]:\n \"\\asid_pool_at ptr and valid_vspace_objs and valid_asid_table and pspace_aligned\\\n delete_asid_pool asid ptr\n \\\\rv s. \\ reachable_target (asid, 0) ptr s\\\"\n unfolding reachable_target_def by (wpsimp wp: hoare_vcg_all_lift)\n\nlemmas reachable_frame_cap_simps =\n reachable_frame_cap_def[unfolded is_frame_cap_def arch_cap_fun_lift_def, split_simps cap.split]\n\nlemma unmap_page_table_pool_for_asid[wp]:\n \"unmap_page_table asid vref pt \\\\s. P (pool_for_asid asid s)\\\"\n unfolding unmap_page_table_def by (wpsimp simp: pool_for_asid_def)\n\nlemma unmap_page_table_unreachable:\n \"\\ normal_pt_at pt\n and valid_asid_table and valid_vspace_objs and pspace_aligned and pspace_distinct\n and unique_table_refs and valid_vs_lookup and (\\s. valid_caps (caps_of_state s) s)\n and K (0 < asid \\ vref \\ user_region) \\\n unmap_page_table asid vref pt\n \\\\_ s. \\ reachable_target (asid, vref) pt s\\\"\n unfolding reachable_target_def\n apply (wpsimp wp: hoare_vcg_all_lift unmap_page_table_not_target)\n apply (drule (1) pool_for_asid_validD)\n apply (clarsimp simp: obj_at_def in_omonad)\n done\n\nlemma unmap_page_unreachable:\n \"\\ data_at pgsz pptr and valid_asid_table and valid_vspace_objs\n and pspace_aligned and pspace_distinct\n and unique_table_refs and valid_vs_lookup and (\\s. valid_caps (caps_of_state s) s)\n and K (0 < asid \\ vref \\ user_region) \\\n unmap_page pgsz asid vref pptr\n \\\\rv s. \\ reachable_target (asid, vref) pptr s\\\"\n unfolding reachable_target_def\n apply (wpsimp wp: hoare_vcg_all_lift unmap_page_not_target)\n apply (drule (1) pool_for_asid_validD)\n apply (clarsimp simp: obj_at_def data_at_def in_omonad)\n done\n\nlemma set_asid_pool_pool_for_asid[wp]:\n \"set_asid_pool ptr pool \\\\s. P (pool_for_asid asid' s)\\\"\n unfolding pool_for_asid_def by wpsimp\n\nlemma delete_asid_pool_for_asid[wp]:\n \"delete_asid asid pt \\\\s. P (pool_for_asid asid' s)\\\"\n unfolding delete_asid_def by (wpsimp wp: hoare_drop_imps)\n\nlemma delete_asid_no_vs_lookup_target_vspace:\n \"\\\\s. vspace_for_asid asid s = Some pt \\\n delete_asid asid pt\n \\\\rv s. vs_lookup_target level asid vref s \\ Some (level, pt)\\\"\n apply (rule hoare_assume_pre)\n apply (prop_tac \"0 < asid\")\n apply (clarsimp simp: vspace_for_asid_def entry_for_asid_def)\n apply (rule hoare_strengthen_post, rule delete_asid_unmapped)\n apply (clarsimp simp: vs_lookup_target_def vs_lookup_slot_def vs_lookup_table_def\n vspace_for_asid_def vspace_for_pool_def entry_for_asid_def obind_None_eq\n split: if_split_asm)\n done\n\nlemma delete_asid_no_vs_lookup_target_no_vspace:\n \"\\\\s. vspace_for_asid asid s \\ Some pt \\ 0 < asid \\ vref \\ user_region \\ vspace_pt_at pt s \\\n valid_vspace_objs s \\ valid_asid_table s \\ pspace_aligned s \\\n delete_asid asid pt\n \\\\rv s. vs_lookup_target level asid vref s \\ Some (level, pt)\\\"\n unfolding delete_asid_def\n (* We know we are in the case where delete_asid does not do anything *)\n apply (wpsimp wp: when_wp[where Q=\"\\_. False\", simplified])\n apply (rule conjI, fastforce simp: vs_lookup_target_def vs_lookup_slot_def vs_lookup_table_def)\n (* pool_for_asid asid s \\ None *)\n apply clarsimp\n apply (rename_tac ap pool)\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: vspace_for_asid_def entry_for_asid_def entry_for_pool_def obind_def\n split: option.splits if_split_asm)\n apply (clarsimp simp: vs_lookup_target_def vs_lookup_slot_pool_for_asid split: if_split_asm)\n (* asid_pool_level *)\n apply (fastforce simp: vspace_for_asid_def entry_for_asid_def vspace_for_pool_def obind_def\n split: option.splits)\n apply (drule (5) valid_vspace_objs_strong_slotD)\n apply (clarsimp simp: in_omonad)\n apply (rename_tac pte)\n apply (case_tac pte; clarsimp simp: obj_at_def data_at_def)\n apply (simp add: pptr_from_pte_def)\n done\n\nlemma delete_asid_no_vs_lookup_target:\n \"\\\\s. 0 < asid \\ vref \\ user_region \\ vspace_pt_at pt s \\ valid_vspace_objs s \\\n valid_asid_table s \\ pspace_aligned s \\\n delete_asid asid pt\n \\\\rv s. vs_lookup_target level asid vref s \\ Some (level, pt)\\\"\n by (rule hoare_pre_cases[where P=\"\\_.True\", simplified,\n OF delete_asid_no_vs_lookup_target_vspace\n delete_asid_no_vs_lookup_target_no_vspace])\n\nlemma delete_asid_unreachable:\n \"\\\\s. 0 < asid \\ vref \\ user_region \\ vspace_pt_at pt s \\ valid_vspace_objs s \\\n valid_asid_table s \\ pspace_aligned s \\\n delete_asid asid pt\n \\\\_ s. \\ reachable_target (asid, vref) pt s\\\"\n unfolding reachable_target_def\n apply (wpsimp wp: hoare_vcg_all_lift delete_asid_no_vs_lookup_target)\n apply (drule (1) pool_for_asid_validD)\n apply (clarsimp simp: obj_at_def in_omonad)\n done\n\nlemma arch_finalise_cap_replaceable:\n notes strg = tcb_cap_valid_imp_NullCap\n obj_at_not_live_valid_arch_cap_strg[where cap=cap]\n notes simps = replaceable_def and_not_not_or_imp\n is_cap_simps vs_cap_ref_def\n no_cap_to_obj_with_diff_ref_Null o_def\n reachable_frame_cap_simps\n notes wps = hoare_drop_imp[where R=\"%_. is_final_cap' cap\" for cap]\n valid_cap_typ\n unmap_page_unreachable unmap_page_table_unreachable\n delete_asid_unreachable vcpu_finalise_unlive[simplified o_def]\n shows\n \"\\\\s. s \\ ArchObjectCap cap \\\n x = is_final_cap' (ArchObjectCap cap) s \\\n pspace_aligned s \\ pspace_distinct s \\\n valid_vspace_objs s \\ valid_objs s \\ valid_asid_table s \\ valid_arch_caps s\\\n arch_finalise_cap cap x\n \\\\rv s. replaceable s sl (fst rv) (ArchObjectCap cap)\\\"\n apply (simp add: arch_finalise_cap_def valid_arch_caps_def)\n apply (wpsimp simp: simps valid_objs_caps wp: wps | strengthen strg)+\n apply (rule conjI, clarsimp)\n apply (in_case \"ASIDPoolCap ?p ?asid\")\n apply (clarsimp simp: valid_cap_def obj_at_def)\n apply (rule conjI, clarsimp)\n apply (in_case \"FrameCap ?p ?R ?sz ?dev ?m\")\n apply (fastforce simp: valid_cap_def wellformed_mapdata_def data_at_def obj_at_def\n split: if_split_asm)\n apply clarsimp\n apply (in_case \"PageTableCap ?p ?T ?m\")\n apply (rule conjI; clarsimp)\n apply (in_case \"PageTableCap ?p VSRootPT_T ?m\")\n apply (rule conjI; clarsimp simp: valid_cap_def wellformed_mapdata_def data_at_def obj_at_def\n split: if_split_asm)\n apply (in_case \"PageTableCap ?p NormalPT_T ?m\")\n apply (rule conjI; clarsimp)\n apply (clarsimp simp: valid_cap_def obj_at_def)\n apply (clarsimp simp: valid_cap_def wellformed_mapdata_def cap_aligned_def obj_at_def)\n done\n\nglobal_naming Arch\nlemma (* deleting_irq_handler_slot_not_irq_node *)[Finalise_AI_asms]:\n \"\\if_unsafe_then_cap and valid_global_refs\n and cte_wp_at (\\cp. cap_irqs cp \\ {}) sl\\\n deleting_irq_handler irq\n \\\\rv s. (interrupt_irq_node s irq, []) \\ sl\\\"\n apply (simp add: deleting_irq_handler_def)\n apply wp\n apply clarsimp\n apply (drule(1) if_unsafe_then_capD)\n apply clarsimp\n apply (clarsimp simp: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state)\n apply (drule cte_refs_obj_refs_elem)\n apply (erule disjE)\n apply simp\n apply (drule(1) valid_global_refsD[OF _ caps_of_state_cteD])\n prefer 2\n apply (erule notE, simp add: cap_range_def, erule disjI2)\n apply (simp add: global_refs_def)\n apply (clarsimp simp: appropriate_cte_cap_def split: cap.split_asm)\n done\n\nlemma no_cap_to_obj_with_diff_ref_finalI_ARCH[Finalise_AI_asms]:\n \"\\ cte_wp_at ((=) cap) p s; is_final_cap' cap s;\n obj_refs cap' = obj_refs cap \\\n \\ no_cap_to_obj_with_diff_ref cap' {p} s\"\n apply (case_tac \"obj_refs cap = {}\")\n apply (case_tac \"cap_irqs cap = {}\")\n apply (case_tac \"arch_gen_refs cap = {}\")\n apply (simp add: is_final_cap'_def)\n apply (case_tac cap, simp_all add: gen_obj_refs_def)\n apply ((clarsimp simp add: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state\n vs_cap_ref_def\n dest!: obj_ref_none_no_asid[rule_format])+)[2]\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n is_final_cap'_def2\n simp del: split_paired_All)\n apply (frule_tac x=p in spec)\n apply (drule_tac x=\"(a, b)\" in spec)\n apply (clarsimp simp: cte_wp_at_caps_of_state\n gen_obj_refs_Int)\n done\n\nlemma (* suspend_no_cap_to_obj_ref *)[wp,Finalise_AI_asms]:\n \"\\no_cap_to_obj_with_diff_ref cap S\\\n suspend t\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n apply (simp add: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (wp suspend_caps_of_state)\n apply (clarsimp dest!: obj_ref_none_no_asid[rule_format])\n done\n\nlemma dissociate_vcpu_tcb_no_cap_to_obj_ref[wp]:\n \"\\no_cap_to_obj_with_diff_ref cap S\\\n dissociate_vcpu_tcb v t\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n by (wpsimp simp: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n\nlemma prepare_thread_delete_no_cap_to_obj_ref[wp]:\n \"\\no_cap_to_obj_with_diff_ref cap S\\\n prepare_thread_delete t\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n unfolding prepare_thread_delete_def\n by (wpsimp simp: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n\nlemma prepare_thread_delete_unlive_hyp:\n \"\\obj_at \\ ptr\\ prepare_thread_delete ptr \\\\rv. obj_at (Not \\ hyp_live) ptr\\\"\n apply (simp add: prepare_thread_delete_def fpu_thread_delete_def)\n apply (wpsimp wp: hoare_vcg_imp_lift' hoare_vcg_all_lift arch_thread_get_wp)\n apply (clarsimp simp: obj_at_def is_tcb_def hyp_live_def)\n done\n\nlemma prepare_thread_delete_unlive0:\n \"\\obj_at (Not \\ live0) ptr\\ prepare_thread_delete ptr \\\\rv. obj_at (Not \\ live0) ptr\\\"\n apply (simp add: prepare_thread_delete_def set_thread_state_def set_object_def fpu_thread_delete_def)\n apply (wpsimp wp: dissociate_vcpu_tcb_unlive0 simp: obj_at_exst_update comp_def)\n done\n\nlemma prepare_thread_delete_unlive[wp]:\n \"\\obj_at (Not \\ live0) ptr\\ prepare_thread_delete ptr \\\\rv. obj_at (Not \\ live) ptr\\\"\n apply (rule_tac Q=\"\\rv. obj_at (Not \\ live0) ptr and obj_at (Not \\ hyp_live) ptr\" in hoare_strengthen_post)\n apply (wpsimp wp: hoare_vcg_conj_lift prepare_thread_delete_unlive_hyp prepare_thread_delete_unlive0)\n apply (clarsimp simp: obj_at_def)\n apply (clarsimp simp: obj_at_def, case_tac ko, simp_all add: is_tcb_def live_def)\n done\n\nlemma finalise_cap_replaceable [Finalise_AI_asms]:\n \"\\\\s. s \\ cap \\ x = is_final_cap' cap s \\ valid_mdb s\n \\ cte_wp_at ((=) cap) sl s \\ valid_objs s \\ sym_refs (state_refs_of s)\n \\ (cap_irqs cap \\ {} \\ if_unsafe_then_cap s \\ valid_global_refs s)\n \\ (is_arch_cap cap \\ pspace_aligned s \\\n pspace_distinct s \\\n valid_vspace_objs s \\\n valid_arch_state s \\\n valid_arch_caps s)\\\n finalise_cap cap x\n \\\\rv s. replaceable s sl (fst rv) cap\\\"\n apply (cases \"is_arch_cap cap\")\n apply (clarsimp simp: is_cap_simps)\n apply (wp arch_finalise_cap_replaceable)\n apply (clarsimp simp: replaceable_def reachable_frame_cap_def\n o_def cap_range_def valid_arch_state_def\n ran_tcb_cap_cases is_cap_simps\n gen_obj_refs_subset vs_cap_ref_def\n all_bool_eq)\n apply (cases cap;\n simp add: replaceable_def reachable_frame_cap_def is_arch_cap_def\n split del: if_split;\n ((wp suspend_unlive[unfolded o_def]\n suspend_final_cap[where sl=sl]\n prepare_thread_delete_unlive[unfolded o_def]\n unbind_maybe_notification_not_bound\n get_simple_ko_ko_at unbind_notification_valid_objs\n | clarsimp simp: o_def dom_tcb_cap_cases_lt_ARCH\n ran_tcb_cap_cases is_cap_simps\n cap_range_def unat_of_bl_length\n can_fast_finalise_def\n gen_obj_refs_subset\n vs_cap_ref_def\n valid_ipc_buffer_cap_def\n dest!: tcb_cap_valid_NullCapD\n split: Structures_A.thread_state.split_asm\n | simp cong: conj_cong\n | simp cong: rev_conj_cong add: no_cap_to_obj_with_diff_ref_Null\n | (strengthen tcb_cap_valid_imp_NullCap tcb_cap_valid_imp', wp)\n | rule conjI\n | erule cte_wp_at_weakenE tcb_cap_valid_imp'[rule_format, rotated -1]\n | erule(1) no_cap_to_obj_with_diff_ref_finalI_ARCH\n | (wp (once) hoare_drop_imps,\n wp (once) cancel_all_ipc_unlive[unfolded o_def]\n cancel_all_signals_unlive[unfolded o_def])\n | ((wp (once) hoare_drop_imps)?,\n (wp (once) hoare_drop_imps)?,\n wp (once) deleting_irq_handler_empty)\n | wpc\n | simp add: valid_cap_simps is_nondevice_page_cap_simps)+))\n done\n\nlemma (* deleting_irq_handler_cte_preserved *)[Finalise_AI_asms]:\n assumes x: \"\\cap. P cap \\ \\ can_fast_finalise cap\"\n shows \"\\cte_wp_at P p\\ deleting_irq_handler irq \\\\rv. cte_wp_at P p\\\"\n apply (simp add: deleting_irq_handler_def)\n apply (wp cap_delete_one_cte_wp_at_preserved | simp add: x)+\n done\n\nlemma arch_thread_set_cte_wp_at[wp]:\n \"\\\\s. P (cte_wp_at P' p s)\\ arch_thread_set f t \\ \\_ s. P (cte_wp_at P' p s)\\\"\n apply (simp add: arch_thread_set_def)\n apply (wp set_object_wp)\n apply (clarsimp dest!: get_tcb_SomeD simp del: fun_upd_apply)\n apply (subst get_tcb_rev, assumption, subst option.sel)+\n apply (subst arch_tcb_update_aux3)\n apply (subst cte_wp_at_update_some_tcb[where f=\"tcb_arch_update f\"])\n apply (clarsimp simp: tcb_cnode_map_def)+\n done\n\ncrunch cte_wp_at[wp,Finalise_AI_asms]: dissociate_vcpu_tcb \"\\s. P (cte_wp_at P' p s)\"\n (simp: crunch_simps assertE_def wp: crunch_wps set_object_cte_at ignore: arch_thread_set)\n\ncrunch cte_wp_at[wp,Finalise_AI_asms]: prepare_thread_delete \"\\s. P (cte_wp_at P' p s)\"\n (simp: crunch_simps assertE_def wp: crunch_wps set_object_cte_at ignore: arch_thread_set)\n\ncrunch cte_wp_at[wp,Finalise_AI_asms]: arch_finalise_cap \"\\s. P (cte_wp_at P' p s)\"\n (simp: crunch_simps assertE_def wp: crunch_wps set_object_cte_at ignore: arch_thread_set)\n\nend\n\ninterpretation Finalise_AI_1?: Finalise_AI_1\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (intro_locales; (unfold_locales; fact Finalise_AI_asms)?)\n qed\n\ncontext Arch begin global_naming AARCH64\n\nlemma fast_finalise_replaceable[wp]:\n \"\\\\s. s \\ cap \\ x = is_final_cap' cap s\n \\ cte_wp_at ((=) cap) sl s \\ valid_asid_table s\n \\ valid_mdb s \\ valid_objs s \\ sym_refs (state_refs_of s)\\\n fast_finalise cap x\n \\\\rv s. cte_wp_at (replaceable s sl cap.NullCap) sl s\\\"\n apply (cases \"cap_irqs cap = {}\")\n apply (simp add: fast_finalise_def2)\n apply wp\n apply (rule hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule finalise_cap_replaceable[where sl=sl])\n apply (rule finalise_cap_equal_cap[where sl=sl])\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp simp: is_cap_simps can_fast_finalise_def)\n apply (clarsimp simp: cap_irqs_def cap_irq_opt_def split: cap.split_asm)\n done\n\nglobal_naming Arch\nlemma (* cap_delete_one_invs *) [Finalise_AI_asms,wp]:\n \"\\invs and emptyable ptr\\ cap_delete_one ptr \\\\rv. invs\\\"\n apply (simp add: cap_delete_one_def unless_def is_final_cap_def)\n apply (rule hoare_pre)\n apply (wp empty_slot_invs get_cap_wp)\n apply clarsimp\n apply (drule cte_wp_at_valid_objs_valid_cap, fastforce+)\n done\n\nend\n\ninterpretation Finalise_AI_2?: Finalise_AI_2\n proof goal_cases\n interpret Arch .\n case 1 show ?case by (intro_locales; (unfold_locales; fact Finalise_AI_asms)?)\n qed\n\ncontext Arch begin global_naming AARCH64\n\ncrunches\n vcpu_update, vgic_update, vcpu_disable, vcpu_restore, vcpu_save_reg_range, vgic_update_lr,\n vcpu_save, vcpu_switch\n for irq_node[wp]: \"\\s. P (interrupt_irq_node s)\"\n (wp: crunch_wps subset_refl)\n\ncrunch irq_node[Finalise_AI_asms,wp]: prepare_thread_delete \"\\s. P (interrupt_irq_node s)\"\n (wp: crunch_wps select_wp simp: crunch_simps)\n\ncrunch irq_node[wp]: arch_finalise_cap \"\\s. P (interrupt_irq_node s)\"\n (simp: crunch_simps wp: crunch_wps)\n\ncrunch pred_tcb_at[wp]:\n delete_asid_pool, delete_asid, unmap_page_table, unmap_page, vcpu_invalidate_active\n \"pred_tcb_at proj P t\"\n (simp: crunch_simps wp: crunch_wps test)\n\ncrunch pred_tcb_at[wp_unsafe]: arch_finalise_cap \"pred_tcb_at proj P t\"\n (simp: crunch_simps wp: crunch_wps)\n\nlemma set_vcpu_empty[wp]:\n \"\\\\s. P (obj_at (empty_table {}) word s)\\ set_vcpu p v \\\\_ s. P (obj_at (empty_table {}) word s)\\\"\n apply (rule set_vcpu.vsobj_at)\n apply (clarsimp simp: vspace_obj_pred_def empty_table_def\n split: kernel_object.splits arch_kernel_obj.splits)\n done\n\ncrunches\n vcpu_update, vgic_update, vcpu_disable, vcpu_restore, vcpu_save_reg_range, vgic_update_lr,\n vcpu_save, vcpu_switch\n for empty[wp]: \"\\s. P (obj_at (empty_table {}) word s)\"\n (wp: crunch_wps subset_refl)\n\ndefinition\n replaceable_or_arch_update :: \"'z::state_ext state \\ cslot_ptr \\ cap \\ cap \\ bool\" where\n \"replaceable_or_arch_update \\ \\s slot cap cap'.\n if is_frame_cap cap\n then is_arch_update cap cap' \\\n (\\asid vref. vs_cap_ref cap' = Some (asid,vref) \\\n vs_cap_ref cap = Some (asid,vref) \\\n obj_refs cap = obj_refs cap' \\\n (\\oref\\obj_refs cap'. \\level. vs_lookup_target level asid vref s \\ Some (level, oref)))\n else replaceable s slot cap cap'\"\n\nlemma is_final_cap_pt_asid_eq:\n \"is_final_cap' (ArchObjectCap (PageTableCap p pt_t y)) s \\\n is_final_cap' (ArchObjectCap (PageTableCap p pt_t x)) s\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n done\n\nlemma is_final_cap_pd_asid_eq:\n \"is_final_cap' (ArchObjectCap (PageTableCap p pt_t y)) s \\\n is_final_cap' (ArchObjectCap (PageTableCap p pt_t x)) s\"\n by (rule is_final_cap_pt_asid_eq)\n\nlemma cte_wp_at_obj_refs_singleton_page_table:\n \"\\cte_wp_at\n (\\cap'. obj_refs cap' = {p}\n \\ (\\p pt_t asid. cap' = ArchObjectCap (PageTableCap p pt_t asid)))\n (a, b) s\\ \\\n \\asid pt_t. cte_wp_at ((=) (ArchObjectCap (PageTableCap p pt_t asid))) (a,b) s\"\n apply (clarsimp simp: cte_wp_at_def)\n done\n\nlemma final_cap_pt_slot_eq:\n \"\\is_final_cap' (ArchObjectCap (PageTableCap p pt_t asid)) s;\n cte_wp_at ((=) (ArchObjectCap (PageTableCap p pt_t asid'))) slot s;\n cte_wp_at ((=) (ArchObjectCap (PageTableCap p pt_t asid''))) slot' s\\ \\\n slot' = slot\"\n apply (clarsimp simp:is_final_cap'_def2)\n apply (case_tac \"(a,b) = slot'\")\n apply (case_tac \"(a,b) = slot\")\n apply simp\n apply (erule_tac x=\"fst slot\" in allE)\n apply (erule_tac x=\"snd slot\" in allE)\n apply (clarsimp simp: gen_obj_refs_def cap_irqs_def cte_wp_at_def)\n apply (erule_tac x=\"fst slot'\" in allE)\n apply (erule_tac x=\"snd slot'\" in allE)\n apply (clarsimp simp: gen_obj_refs_def cap_irqs_def cte_wp_at_def)\n done\n\nlemma is_arch_update_reset_page:\n \"is_arch_update\n (ArchObjectCap (FrameCap p r sz dev m))\n (ArchObjectCap (FrameCap p r' sz dev m'))\"\n apply (simp add: is_arch_update_def is_arch_cap_def cap_master_cap_def)\n done\n\ncrunches vcpu_finalise, arch_finalise_cap\n for caps_of_state [wp]: \"\\s. P (caps_of_state s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma set_asid_pool_empty[wp]:\n \"set_asid_pool p ap \\\\s. P (obj_at (empty_table S) p' s)\\\"\n unfolding set_asid_pool_def\n apply (wpsimp wp: set_object_wp)\n apply (erule rsubst[where P=P])\n apply (clarsimp simp: obj_at_def in_omonad empty_table_def)\n done\n\ncrunches set_global_user_vspace, arm_context_switch\n for empty[wp]: \"\\s. P (obj_at (empty_table S) p s)\"\n\nlemma set_vm_root_empty[wp]:\n \"set_vm_root v \\\\s. P (obj_at (empty_table S) p s) \\\"\n unfolding set_vm_root_def\n by (wpsimp wp: get_cap_wp)\n\nlemma ucast_less_shiftl_helper3:\n \"\\ len_of TYPE('b) + 3 < len_of TYPE('a); 2 ^ (len_of TYPE('b) + 3) \\ n\\\n \\ (ucast (x :: 'b::len word) << 3) < (n :: 'a::len word)\"\n by (rule ucast_less_shiftl_helper')\n\nlemma caps_of_state_aligned_page_table:\n \"\\caps_of_state s slot = Some (ArchObjectCap (PageTableCap word pt_t option)); invs s\\\n \\ is_aligned word (pt_bits pt_t)\"\n apply (frule caps_of_state_valid)\n apply (frule invs_valid_objs, assumption)\n apply (frule valid_cap_aligned)\n apply (simp add: cap_aligned_def pt_bits_def pageBits_def)\n done\n\nend\n\nlemma invs_valid_arch_capsI:\n \"invs s \\ valid_arch_caps s\"\n by (simp add: invs_def valid_state_def)\n\ncontext Arch begin global_naming AARCH64 (*FIXME: arch_split*)\n\nlemma do_machine_op_reachable_pg_cap[wp]:\n \"\\\\s. P (reachable_frame_cap cap s)\\\n do_machine_op mo\n \\\\rv s. P (reachable_frame_cap cap s)\\\"\n apply (simp add:reachable_frame_cap_def reachable_target_def)\n apply (wp_pre, wps dmo.vs_lookup_pages, wpsimp)\n apply simp\n done\n\nlemma replaceable_or_arch_update_pg:\n \" (case (vs_cap_ref (ArchObjectCap (FrameCap word fun vm_pgsz dev y))) of None \\ True | Some (asid,vref) \\\n \\level. vs_lookup_target level asid vref s \\ Some (level, word))\n \\ replaceable_or_arch_update s slot (ArchObjectCap (FrameCap word fun vm_pgsz dev None))\n (ArchObjectCap (FrameCap word fun vm_pgsz dev y))\"\n unfolding replaceable_or_arch_update_def\n apply (auto simp: is_cap_simps is_arch_update_def cap_master_cap_simps)\n done\n\n\nglobal_naming Arch\n\ncrunch invs[wp]: prepare_thread_delete invs\n (ignore: set_object do_machine_op wp: dmo_invs_lift)\n\nlemma (* finalise_cap_invs *)[Finalise_AI_asms]:\n shows \"\\invs and cte_wp_at ((=) cap) slot\\ finalise_cap cap x \\\\rv. invs\\\"\n apply (cases cap, simp_all split del: if_split)\n apply (wp cancel_all_ipc_invs cancel_all_signals_invs unbind_notification_invs\n unbind_maybe_notification_invs\n | simp add: o_def split del: if_split cong: if_cong\n | wpc )+\n apply clarsimp (* thread *)\n apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp)\n apply (clarsimp simp: valid_cap_def)\n apply (frule(1) valid_global_refsD[OF invs_valid_global_refs])\n apply (simp add: global_refs_def, rule disjI1, rule refl)\n apply (simp add: cap_range_def)\n apply (wp deleting_irq_handler_invs | simp | intro conjI impI)+\n apply (auto dest: cte_wp_at_valid_objs_valid_cap)\n done\n\nlemma (* finalise_cap_irq_node *)[Finalise_AI_asms]:\n\"\\\\s. P (interrupt_irq_node s)\\ finalise_cap a b \\\\_ s. P (interrupt_irq_node s)\\\"\n by (case_tac a, wpsimp+)\n\nlemmas (*arch_finalise_cte_irq_node *) [wp,Finalise_AI_asms]\n = hoare_use_eq_irq_node [OF arch_finalise_cap_irq_node arch_finalise_cap_cte_wp_at]\n\nlemma (* deleting_irq_handler_st_tcb_at *) [Finalise_AI_asms]:\n \"\\st_tcb_at P t and K (\\st. simple st \\ P st)\\\n deleting_irq_handler irq\n \\\\rv. st_tcb_at P t\\\"\n apply (simp add: deleting_irq_handler_def)\n apply (wp cap_delete_one_st_tcb_at)\n apply simp\n done\n\nlemma irq_node_global_refs_ARCH [Finalise_AI_asms]:\n \"interrupt_irq_node s irq \\ global_refs s\"\n by (simp add: global_refs_def)\n\nlemma (* get_irq_slot_fast_finalisable *)[wp,Finalise_AI_asms]:\n \"\\invs\\ get_irq_slot irq \\cte_wp_at can_fast_finalise\\\"\n apply (simp add: get_irq_slot_def)\n apply wp\n apply (clarsimp simp: invs_def valid_state_def valid_irq_node_def)\n apply (drule spec[where x=irq], drule cap_table_at_cte_at[where offset=\"[]\"])\n apply simp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (case_tac \"cap = cap.NullCap\")\n apply (simp add: can_fast_finalise_def)\n apply (frule(1) if_unsafe_then_capD [OF caps_of_state_cteD])\n apply simp\n apply (clarsimp simp: ex_cte_cap_wp_to_def)\n apply (drule cte_wp_at_norm, clarsimp)\n apply (drule(1) valid_global_refsD [OF _ _ irq_node_global_refs_ARCH[where irq=irq]])\n apply (case_tac c, simp_all)\n apply (clarsimp simp: cap_range_def)\n apply (clarsimp simp: cap_range_def)\n apply (clarsimp simp: appropriate_cte_cap_def can_fast_finalise_def split: cap.split_asm)\n apply (clarsimp simp: cap_range_def)\n done\n\nlemma (* replaceable_or_arch_update_same *) [Finalise_AI_asms]:\n \"replaceable_or_arch_update s slot cap cap\"\n by (clarsimp simp: replaceable_or_arch_update_def\n replaceable_def is_arch_update_def is_cap_simps)\n\nlemma (* replace_cap_invs_arch_update *)[Finalise_AI_asms]:\n \"\\\\s. cte_wp_at (replaceable_or_arch_update s p cap) p s\n \\ invs s\n \\ cap \\ cap.NullCap\n \\ ex_cte_cap_wp_to (appropriate_cte_cap cap) p s\n \\ s \\ cap\\\n set_cap cap p\n \\\\rv s. invs s\\\"\n apply (simp add:replaceable_or_arch_update_def)\n apply (cases \"is_frame_cap cap\")\n apply (wp hoare_pre_disj[OF arch_update_cap_invs_unmap_page arch_update_cap_invs_map])\n apply (simp add:replaceable_or_arch_update_def replaceable_def cte_wp_at_caps_of_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps gen_obj_refs_def\n cap_master_cap_simps is_arch_update_def)\n apply (wp replace_cap_invs)\n apply simp\n done\n\nlemma dmo_pred_tcb_at[wp]:\n \"do_machine_op mop \\\\s. P (pred_tcb_at f Q t s)\\\"\n apply (simp add: do_machine_op_def split_def)\n apply (wp select_wp)\n apply (clarsimp simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma dmo_tcb_cap_valid_ARCH [Finalise_AI_asms]:\n \"do_machine_op mop \\\\s. P (tcb_cap_valid cap ptr s)\\\"\n apply (simp add: tcb_cap_valid_def no_cap_to_obj_with_diff_ref_def)\n apply (wp_pre, wps, rule hoare_vcg_prop)\n apply simp\n done\n\nlemma dmo_vs_lookup_target[wp]:\n \"do_machine_op mop \\\\s. P (vs_lookup_target level asid vref s)\\\"\n by (rule dmo.vs_lookup_pages)\n\nlemma dmo_reachable_target[wp]:\n \"do_machine_op mop \\\\s. P (reachable_target ref p s)\\\"\n apply (simp add: reachable_target_def split_def)\n apply (wp_pre, wps, wp)\n apply simp\n done\n\nlemma (* dmo_replaceable_or_arch_update *) [Finalise_AI_asms,wp]:\n \"\\\\s. replaceable_or_arch_update s slot cap cap'\\\n do_machine_op mo\n \\\\r s. replaceable_or_arch_update s slot cap cap'\\\"\n unfolding replaceable_or_arch_update_def replaceable_def no_cap_to_obj_with_diff_ref_def\n replaceable_final_arch_cap_def replaceable_non_final_arch_cap_def\n apply (wp_pre, wps dmo_tcb_cap_valid_ARCH do_machine_op_reachable_pg_cap)\n apply (rule hoare_vcg_prop)\n apply simp\n done\n\nend\n\ncontext begin interpretation Arch .\nrequalify_consts replaceable_or_arch_update\nend\n\ninterpretation Finalise_AI_3?: Finalise_AI_3\n where replaceable_or_arch_update = replaceable_or_arch_update\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (intro_locales; (unfold_locales; fact Finalise_AI_asms)?)\n qed\n\ncontext Arch begin global_naming AARCH64\n\nlemma typ_at_data_at_wp:\n assumes typ_wp: \"\\a.\\typ_at a p \\ g \\\\s. typ_at a p\\\"\n shows \"\\data_at b p\\ g \\\\s. data_at b p\\\"\n apply (simp add: data_at_def)\n apply (wp typ_wp hoare_vcg_disj_lift)\n done\n\nend\n\ninterpretation Finalise_AI_4?: Finalise_AI_4\n where replaceable_or_arch_update = replaceable_or_arch_update\n proof goal_cases\n interpret Arch .\n case 1 show ?case by (intro_locales; (unfold_locales; fact Finalise_AI_asms)?)\n qed\n\ncontext Arch begin global_naming AARCH64\n\nlemma set_asid_pool_obj_at_ptr:\n \"\\\\s. P (ArchObj (arch_kernel_obj.ASIDPool mp))\\\n set_asid_pool ptr mp\n \\\\rv s. obj_at P ptr s\\\"\n apply (simp add: set_asid_pool_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n done\n\nlocale_abbrev\n \"asid_table_update asid ap s \\\n s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\\"\n\nlemma valid_table_caps_table [simp]:\n \"valid_table_caps (s\\arch_state := arch_state s\\arm_asid_table := table'\\\\) = valid_table_caps s\"\n by (simp add: valid_table_caps_def)\n\nlemma valid_kernel_mappings [iff]:\n \"valid_kernel_mappings (s\\arch_state := arch_state s\\arm_asid_table := table'\\\\) = valid_kernel_mappings s\"\n by (simp add: valid_kernel_mappings_def)\n\ncrunches unmap_page_table, store_pte, delete_asid_pool\n for valid_cap[wp]: \"valid_cap c\"\n (wp: mapM_wp_inv mapM_x_wp' simp: crunch_simps)\n\nlemmas vcpu_finalise_typ_ats [wp] = abs_typ_at_lifts [OF vcpu_finalise_typ_at]\nlemmas delete_asid_typ_ats[wp] = abs_typ_at_lifts [OF delete_asid_typ_at]\n\nlemma arch_finalise_cap_valid_cap[wp]:\n \"arch_finalise_cap cap b \\valid_cap c\\\"\n unfolding arch_finalise_cap_def\n by (wpsimp split: arch_cap.split option.split bool.split)\n\nglobal_naming Arch\n\nlemmas clearMemory_invs[wp,Finalise_AI_asms] = clearMemory_invs\n\nlemma valid_idle_has_null_cap_ARCH[Finalise_AI_asms]:\n \"\\ if_unsafe_then_cap s; valid_global_refs s; valid_idle s; valid_irq_node s;\n caps_of_state s (idle_thread s, v) = Some cap \\\n \\ cap = NullCap\"\n apply (rule ccontr)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (clarsimp simp: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state)\n apply (frule(1) valid_global_refsD2)\n apply (case_tac capa, simp_all add: cap_range_def global_refs_def)[1]\n apply (clarsimp simp: valid_irq_node_def valid_idle_def pred_tcb_at_def\n obj_at_def is_cap_table_def)\n apply (rename_tac word tcb)\n apply (drule_tac x=word in spec, simp)\n done\n\nlemma (* zombie_cap_two_nonidles *)[Finalise_AI_asms]:\n \"\\ caps_of_state s ptr = Some (Zombie ptr' zbits n); invs s \\\n \\ fst ptr \\ idle_thread s \\ ptr' \\ idle_thread s\"\n apply (frule valid_global_refsD2, clarsimp+)\n apply (simp add: cap_range_def global_refs_def)\n apply (cases ptr, auto dest: valid_idle_has_null_cap_ARCH[rotated -1])[1]\n done\n\ncrunches empty_slot, finalise_cap, send_ipc, receive_ipc\n for ioports[wp]: valid_ioports\n (wp: crunch_wps valid_ioports_lift simp: crunch_simps ignore: set_object)\n\nlemma arch_derive_cap_notzombie[wp]:\n \"\\\\\\ arch_derive_cap acap \\\\rv s. \\ is_zombie rv\\, -\"\n by (cases acap; wpsimp simp: arch_derive_cap_def is_zombie_def o_def)\n\nlemma arch_derive_cap_notIRQ[wp]:\n \"\\\\\\ arch_derive_cap cap \\\\rv s. rv \\ cap.IRQControlCap\\,-\"\n by (cases cap; wpsimp simp: arch_derive_cap_def o_def)\n\nend\n\ninterpretation Finalise_AI_5?: Finalise_AI_5\n where replaceable_or_arch_update = replaceable_or_arch_update\n proof goal_cases\n interpret Arch .\n case 1 show ?case by (intro_locales; (unfold_locales; fact Finalise_AI_asms)?)\n qed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/AARCH64/ArchFinalise_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.34510528442897664, "lm_q1q2_score": 0.18063512839558432}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__8_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__8_on_rules imports n_german_lemma_on_inv__8\nbegin\nsection{*All lemmas on causal relation between inv__8*}\nlemma lemma_inv__8_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__8) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__8_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.32766831395172374, "lm_q1q2_score": 0.18041658711433264}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__55_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__55_on_rules imports n_g2kAbsAfter_lemma_on_inv__55\nbegin\nsection{*All lemmas on causal relation between inv__55*}\nlemma lemma_inv__55_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__55 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__55) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__55_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.3208212943308302, "lm_q1q2_score": 0.18035819265655886}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepCode\nimports\n Separation\n \"Simpl-VCG.Vcg\"\nbegin\n\ndefinition\n singleton_t :: \"'a::c_type ptr \\ 'a \\ heap_state\"\nwhere\n \"singleton_t p v \\ lift_state (heap_update p v (\\x. 0), (ptr_retyp p empty_htd))\"\n\ndefinition\n tagd :: \"'a ptr_guard \\ 'a::c_type ptr \\ heap_assert\" (infix \"\\\\<^sub>s\" 100)\nwhere\n \"g \\\\<^sub>s p \\ \\s. s,g \\\\<^sub>s p \\ dom s = s_footprint p\"\n\ndefinition\n field_footprint :: \"'a::c_type ptr \\ qualified_field_name \\ (addr \\ s_heap_index) set\"\nwhere\n \"field_footprint p f \\\n s_footprint_untyped (ptr_val p + of_nat (field_offset TYPE('a) f))\n (export_uinfo (field_typ TYPE('a) f))\"\n\ndefinition\n fs_footprint :: \"'a::c_type ptr \\ qualified_field_name set \\ (addr \\ s_heap_index) set\"\nwhere\n \"fs_footprint p F \\ \\{field_footprint p f | f. f \\ F}\"\n\ndefinition fields :: \"'a::c_type itself \\ qualified_field_name set\" where\n \"fields t \\ {f. field_lookup (typ_info_t TYPE('a)) f 0 \\ None}\"\n\ndefinition\n mfs_sep_map :: \"'a::c_type ptr \\ 'a ptr_guard \\ qualified_field_name set \\ 'a \\ heap_assert\"\n (\"_ \\\\<^bsub>_\\<^esub>\\<^bsup>_\\<^esup> _\" [56,0,0,51] 56)\nwhere\n \"p \\\\<^bsub>g\\<^esub>\\<^bsup>F\\<^esup> v \\ \\s. lift_typ_heap g (singleton_t p v ++ s) p = Some v \\\n F \\ fields TYPE('a) \\\n dom s = s_footprint p - fs_footprint p F \\ wf_heap_val s\"\n\nnotation (input)\n mfs_sep_map (\"_ \\\\<^sub>_\\<^sup>_ _\" [56,0,1000,51] 56)\n\ndefinition\n disjoint_fn :: \"qualified_field_name \\ qualified_field_name set \\ bool\"\nwhere\n \"disjoint_fn f F \\ \\f'\\F. \\ f \\ f' \\ \\ f' \\ f\"\n\ndefinition\n sep_cut' :: \"addr \\ nat \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut' p n \\ \\s. dom s = {(x,y). x \\ {p..+n}}\"\n\ndefinition\n sep_cut :: \"addr \\ addr_bitsize word \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut x y \\ sep_cut' x (unat y)\"\n\ntext \\----\\\n\n(* FIXME MOVE *)\nlemma heap_list_h_eq:\n \"\\ x \\ {p..+q}; q < addr_card; heap_list h q p = heap_list h' q p \\ \\ h x = h' x\"\nproof (induct q arbitrary: p)\n case 0 thus ?case by simp\nnext\n case (Suc n) thus ?case by (force dest: intvl_neq_start)\nqed\n\nlemma s_footprint_intvl:\n \"(a, SIndexVal) \\ s_footprint p = (a \\ {ptr_val (p::'a::c_type ptr)..+size_of TYPE('a)})\"\n apply(clarsimp simp: s_footprint_def s_footprint_untyped_def)\n apply(rule iffI, clarsimp)\n apply(rule intvlI)\n apply(simp add: size_of_def)\n apply(drule intvlD, clarsimp)\n apply(simp add: size_of_def)\n apply fast\n done\n\nlemma singleton_t_dom [simp]:\n \"dom (singleton_t p (v::'a::mem_type)) = s_footprint p\"\n apply(rule equalityI; clarsimp simp: singleton_t_def lift_state_def s_footprint_intvl\n split: s_heap_index.splits if_split_asm option.splits)\n apply(rule ccontr)\n apply(simp add: ptr_retyp_None)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint list_map_eq split: if_split_asm)\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI)\n apply(subst (asm) word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\n apply(simp add: map_le_def)\n apply assumption\n apply(simp add: ptr_retyp_None)\n apply(rule conjI; clarsimp)\n apply (simp add: ptr_retyp_d_empty s_footprintD)\n apply(frule s_footprintD2)\n apply(frule s_footprintD)\n apply(simp add: ptr_retyp_footprint)\n done\n\nlemma heap_update_merge:\n assumes val: \"d,g \\\\<^sub>t p\"\n shows \"lift_state ((heap_update p (v::'a::mem_type) h),d)\n = lift_state (h,d) ++ singleton p v h d\" (is \"?x = ?y\")\nproof (rule ext, cases)\n fix x\n assume c: \"x \\ dom (singleton p v h d)\"\n with val\n have \"lift_state (heap_update_list (ptr_val p)\n (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h,\n d) x =\n singleton p v h d x\"\n by (auto simp: heap_list_update_to_bytes singleton_def lift_state_def heap_update_def\n singleton_dom\n split: option.splits s_heap_index.splits)\n with c show \"?x x = ?y x\" by (force simp: heap_update_def dest: domD)\nnext\n fix x\n assume nc: \"x \\ dom (singleton p v h d)\"\n with val show \"?x x = ?y x\"\n apply(cases x)\n apply(clarsimp simp: lift_state_def heap_update_def map_add_def\n split: option.splits s_heap_index.splits)\n apply(safe; clarsimp)\n by (metis heap_list_length heap_update_nmem_same len nc s_footprint_intvl singleton_dom)\nqed\n\nlemma tagd_dom_exc:\n \"(g \\\\<^sub>s p) s \\ dom s = s_footprint p\"\n by (clarsimp simp: tagd_def)\n\nlemma tagd_dom_p_exc:\n \"(g \\\\<^sub>s p) s \\ (ptr_val (p::'a::mem_type ptr),SIndexVal) \\ dom s\"\n by (drule tagd_dom_exc) clarsimp\n\nlemma tagd_g_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* P) s \\ g p\"\n by (drule sep_conjD, force simp: tagd_def elim: s_valid_g)\n\nlemma sep_map_tagd_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) s \\ (g \\\\<^sub>s p) s\"\n by (clarsimp simp: sep_map_def tagd_def lift_typ_heap_s_valid)\n\nlemma sep_map_any_tagd_exc:\n \"(p \\\\<^sub>g -) s \\ (g \\\\<^sub>s (p::'a::mem_type ptr)) s\"\n by (clarsimp dest!: sep_map_anyD_exc, erule sep_map_tagd_exc)\n\nlemma ptr_retyp_tagd_exc:\n \"g (p::'a::mem_type ptr) \\\n (g \\\\<^sub>s p) (lift_state (h, ptr_retyp p empty_htd))\"\n apply(simp add: tagd_def ptr_retyp_s_valid lift_state_dom)\n apply(rule equalityI;\n clarsimp simp: lift_state_def split: s_heap_index.splits if_split_asm option.splits)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI2, simp)\n apply(subst (asm) ptr_retyp_None; simp)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: if_split_asm)\n apply(erule (1) s_footprintI)\n apply(simp add: ptr_retyp_None)\n apply(rule conjI; clarsimp)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(drule s_footprintD)\n apply simp\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: if_split_asm)\n apply(drule s_footprintD2)\n apply simp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans, simp)\n apply simp\n apply(fastforce dest: s_footprintD)\n done\n\nlemma singleton_dom_proj_d [simp]:\n \"(g \\\\<^sub>s p) s \\ dom (singleton p (v::'a::mem_type) h (proj_d s)) = dom s\"\n by (clarsimp simp: tagd_def singleton_dom s_valid_def)\n\nlemma singleton_d_restrict_eq:\n \"restrict_s d (s_footprint p) = restrict_s d' (s_footprint p)\n \\ singleton p v h d = singleton p (v::'a::mem_type) h d'\"\n apply(clarsimp simp: singleton_def)\n apply(rule ext, rename_tac x)\n apply(case_tac \"x \\ s_footprint p\"; simp)\n apply(case_tac x, clarsimp, rename_tac a b)\n apply(drule_tac x=a in fun_cong)\n apply(clarsimp simp: s_footprint_restrict lift_state_def\n split: s_heap_index.splits if_split_asm option.splits)\n apply(rule conjI, clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(rename_tac x')\n apply(drule_tac x=\"x'\" in fun_cong)\n apply auto\n done\n\n\nlemma sep_heap_update'_exc:\n assumes sep: \"(g \\\\<^sub>s p \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d))\"\n shows \"P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\nproof -\n from sep obtain s\\<^sub>0 s\\<^sub>1 where disj: \"s\\<^sub>0 \\ s\\<^sub>1\" and\n merge: \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n l: \"(g \\\\<^sub>s p) s\\<^sub>0\" and r: \"(p \\\\<^sub>g v \\\\<^sup>* P) s\\<^sub>1\" by (force dest: sep_conjD)\n moreover from this have \"s\\<^sub>1 \\ singleton p v h (proj_d s\\<^sub>0)\"\n by (fastforce simp: map_disj_def)\n moreover from l have \"g p\" by (force simp: tagd_def elim: s_valid_g)\n moreover from merge l have \"lift_state (h,d),g \\\\<^sub>s p\"\n by (force simp: tagd_def intro: s_valid_heap_merge_right)\n hence \"d,g \\\\<^sub>t p\" by (simp add: h_t_s_valid)\n moreover from l have \"s\\<^sub>0 ++ singleton p v h (proj_d s\\<^sub>0) = singleton p v h (proj_d s\\<^sub>0)\"\n by (force simp: map_add_dom_eq singleton_dom dest: tagd_dom_exc)\n moreover from l merge have \"s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0) = s\\<^sub>1 ++ s\\<^sub>0 ++ singleton p v h d\"\n apply(clarsimp simp: tagd_def)\n apply(rule ext, rename_tac x)\n apply(case_tac x, clarsimp simp: restrict_map_def)\n apply(rename_tac a b)\n apply(simp add: s_valid_def)\n apply(drule_tac v=v and h=h in singleton_dom)\n apply(drule_tac x=\"(a,b)\" in fun_cong)\n apply(case_tac \"(a,b) \\ s_footprint p\")\n apply(subgoal_tac \"(s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0)) (a, b) = singleton p v h d (a, b)\")\n apply(clarsimp simp: map_add_def s_valid_def split: option.splits)\n apply force\n apply (fastforce intro: sym)\n apply(force simp: lift_state_def map_add_def singleton_def proj_d_def\n split: option.splits s_heap_index.splits if_split_asm)\n apply(auto simp: map_add_def singleton_def split: option.splits)\n done\n ultimately show ?thesis\n by (fastforce dest: sep_implD simp: sep_map_singleton tagd_def s_valid_def heap_update_merge)\nqed\n\nlemma sep_heap_update_exc:\n \"\\ (p \\\\<^sub>g - \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d)) \\ \\\n P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (force intro: sep_heap_update'_exc dest: sep_map_anyD_exc sep_map_tagd_exc\n elim: sep_conj_impl)\n\nlemma sep_heap_update_global'_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (rule sep_heap_update'_exc, erule sep_conj_sep_conj_sep_impl_sep_conj)\n\nlemma sep_heap_update_global_exc:\n \"(p \\\\<^sub>g - \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fast intro: sep_heap_update_global'_exc sep_conj_impl sep_map_any_tagd_exc)\n\nlemma sep_heap_update_global_exc2:\n \"(p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fastforce intro: sep_heap_update_global_exc simp: sep_map_any_def sep_conj_exists)\n\nlemma heap_update_mem_same_point:\n \"\\ q \\ {p..+length v}; length v < addr_card \\ \\\n heap_update_list p v h q = v ! unat (q - p)\"\n apply(induct v arbitrary: p h; clarsimp)\n apply(case_tac \"p=q\")\n apply (simp add: heap_update_list_same [where k=1, simplified])\n apply(drule_tac x=\"p+1\" in meta_spec)\n apply(drule meta_spec, drule meta_mp)\n apply(fastforce dest: intvl_neq_start)\n apply(subgoal_tac \"unat (q - p) = unat (1::addr) + unat (q - (p + 1))\", simp)\n apply(subgoal_tac \"q - (p + 1) = (q-p) - 1\")\n apply(simp only:)\n apply(simp add: unat_minus_one)\n apply(subgoal_tac \"unat (q - p) \\ 0\"; clarsimp)\n apply(subst unat_gt_0; simp)\n apply simp\n done\n\nlemma heap_update_list_value:\n \"length v < addr_card \\\n heap_update_list p v h q = (if q \\ {p..+length v} then v!unat (q-p) else h q)\"\n by (auto simp: heap_update_nmem_same heap_update_mem_same_point\n split: if_split)\n\nlemma heap_update_list_value':\n \"length xs < addr_card \\\n heap_update_list ptr xs hp x = (if unat (x - ptr) < length xs then xs ! unat (x - ptr) else hp x)\"\n apply (simp only: heap_update_list_value addr_card_def card_word)\n apply (rule if_cong; simp)\n apply (rule iffI)\n apply (drule intvlD, clarsimp simp: unat_of_nat)\n apply (simp add: intvl_def unat_arith_simps(4) unat_of_nat split: if_split_asm)\n apply (rule_tac x=\"unat x - unat ptr\" in exI, simp)\n apply (rule_tac x=\"unat x + 2^addr_bitsize - unat ptr\" in exI)\n apply (cut_tac x=ptr in unat_lt2p)\n apply (simp add: unat_arith_simps unat_of_nat)\n done\n\nlemma heap_list_h_eq2:\n \"(\\x. x \\ {p..+n} \\ h x = h' x) \\ heap_list h n p = heap_list h' n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce intro: intvl_self)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma map_td_f_eq':\n \"(f=g) \\ (map_td f t = map_td g t)\"\n \"(f=g) \\ (map_td_struct f st = map_td_struct g st)\"\n \"(f=g) \\ (map_td_list f ts = map_td_list g ts)\"\n \"(f=g) \\ (map_td_pair f x = map_td_pair g x)\"\n by (induct t and st and ts and x) auto\n\nlemma map_td_f_eq:\n \"f=g \\ map_td f t = map_td g t\"\n by (erule arg_cong)\n\nlemma sep_map'_lift_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ lift h p = v\"\n by (frule sep_map'_lift_typ_heapD, simp add: lift_t lift_t_lift)\n\nlemma sep_map_lift_wp_exc:\n \"\\v. (p \\\\<^sub>g v \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P v)) (lift_state (h,d))\n \\ P (lift h (p::'a::mem_type ptr)) (lift_state (h,d))\"\n apply clarsimp\n apply(subst sep_map'_lift_exc)\n apply(fastforce simp: sep_map'_def elim: sep_conj_impl)\n apply(rule_tac P=\"p \\\\<^sub>g v\" and Q=\"P v\" in sep_conj_impl_same)\n apply(erule (2) sep_conj_impl)\n done\n\n\nlemma sep_map_lift_exc:\n \"((p::'a::mem_type ptr) \\\\<^sub>g -) (lift_state (h,d)) \\\n (p \\\\<^sub>g lift h p) (lift_state (h,d))\"\n by (clarsimp simp: sep_map_any_def)\n (frule sep_map_sep_map'_exc, drule sep_map'_lift_exc, simp)\n\nlemma sep_map'_lift_rev_exc:\n \"\\ lift h p = (v::'a::mem_type); (p \\\\<^sub>g -) (lift_state (h,d)) \\ \\\n (p \\\\<^sub>g v) (lift_state (h,d))\"\n by (clarsimp simp: sep_map'_any_def)\n (frule sep_map'_lift_exc, simp)\n\n(* FIXME: can be made more flexible when generalised separation conjunction\n is added *)\nlemma sep_lift_exists_exc:\n fixes p :: \"'a::mem_type ptr\"\n assumes ex: \"((\\s. \\v. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q) (lift_state (h,d))\"\n shows \"(P (lift h p) \\\\<^sup>* Q) (lift_state (h,d))\"\nproof -\n from ex obtain v where \"((\\s. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q)\n (lift_state (h,d))\"\n by (subst (asm) sep_conj_exists, clarsimp)\n thus ?thesis\n by (force simp: sep_map'_lift_exc sep_conj_ac\n dest: sep_map'_conjE2_exc dest!: sep_conj_conj)\nqed\n\nlemma merge_dom:\n \"x \\ dom s \\ (t ++ s) x = s x\"\n by (force simp: map_add_def)\n\nlemma merge_dom2:\n \"x \\ dom s \\ (t ++ s) x = t x\"\n by (force simp: map_add_def split: option.splits)\n\nlemma fs_footprint_empty [simp]:\n \"fs_footprint p {} = {}\"\n by (auto simp: fs_footprint_def)\n\nlemma fs_footprint_un:\n \"fs_footprint p (insert f F) = fs_footprint p {f} \\ fs_footprint p F\"\n by (auto simp: fs_footprint_def)\n\nlemma proj_d_restrict_map_le:\n \"snd (proj_d (s |` X) x) \\\\<^sub>m snd (proj_d s x)\"\n by(clarsimp simp: map_le_def proj_d_def restrict_map_def\n split: option.splits if_split_asm)\n\nlemma SIndexVal_conj_setcomp_simp [simp]:\n \"{x. snd x = SIndexVal \\ x \\ s_footprint_untyped p t}\n = {(x,SIndexVal) | x. x \\ {p..+size_td t}}\"\n by (force dest: intvlD intro: intvlI simp: s_footprint_untyped_def)\n\nlemma heap_list_s_restrict_same:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ X \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\n apply(induct n arbitrary: p; clarsimp simp: heap_list_s_def)\n apply(rule conjI)\n apply(fastforce intro: intvl_self simp: proj_h_def restrict_map_def)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_s_restrict_fs_footprint:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t,n) \\\n heap_list_s (s |` fs_footprint p {f}) (size_td t) &(p\\f)\n = heap_list_s s (size_td t) &((p::'a ptr)\\f)\"\n apply(simp add: fs_footprint_def field_footprint_def field_offset_def)\n apply(subst heap_list_s_restrict_same)\n apply(fastforce simp: s_footprint_untyped_def field_size_def field_lvalue_def field_offset_def\n field_ti_def field_typ_def field_typ_untyped_def dest: intvlD)\n apply simp\n done\n\nlemma heap_list_proj_h_disj [rule_format]:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 = {} \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>0) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce simp: proj_h_def intro: intvl_self split: option.splits)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_proj_h_sub [rule_format]:\n \"{(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>1) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI, fastforce simp: proj_h_def intro: intvl_self split: option.splits)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\", fast)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\n\nlemma heap_list_s_map_add_super_update_bs:\n \"\\ {x. (x,SIndexVal) \\ dom s\\<^sub>1} = {p+of_nat k..+z}; k + z \\ n; n < addr_card \\\n \\ heap_list_s (s\\<^sub>0 ++ s\\<^sub>1) n p =\n super_update_bs (heap_list_s s\\<^sub>1 z (p+of_nat k)) (heap_list_s s\\<^sub>0 n p) k\"\n apply(clarsimp simp: super_update_bs_def heap_list_s_def)\n apply(subgoal_tac \"heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) (k + z + (n - (k+z))) p =\n take k (heap_list (proj_h s\\<^sub>0) n p) @\n heap_list (proj_h s\\<^sub>1) z (p + of_nat k) @\n drop (k + z) (heap_list (proj_h s\\<^sub>0) n p)\")\n apply simp\n apply(subst heap_list_split2)\n apply(subst heap_list_split2)\n apply simp\n apply(rule conjI)\n apply(subst take_heap_list_le, simp)\n apply(subst heap_list_proj_h_disj)\n using init_intvl_disj [of k z p]\n apply fastforce\n apply simp\n apply(rule conjI)\n apply(subst heap_list_proj_h_sub; fast)\n apply(simp add: drop_heap_list_le)\n apply(subst heap_list_proj_h_disj)\n using final_intvl_disj [of k z n p]\n apply fast\n apply simp\n done\n\nlemma s_footprint_untyped_dom_SIndexVal:\n \"dom s = s_footprint_untyped p t \\\n {x. (x,SIndexVal) \\ dom s} = {p..+size_td t}\"\n by (auto simp: s_footprint_untyped_def intro: intvlI dest: intvlD)\n\nlemma field_ti_s_sub:\n \"field_lookup (export_uinfo (typ_info_t TYPE('b::mem_type))) f 0 = Some (a,b) \\\n s_footprint_untyped &(p\\f) a \\ s_footprint (p::'b ptr)\"\n apply(clarsimp simp: field_ti_def s_footprint_def s_footprint_untyped_def split: option.splits)\n apply(simp add: field_lvalue_def field_offset_def typ_uinfo_t_def)\n apply(rule_tac x=\"b+x\" in exI)\n apply simp\n apply(simp add: field_offset_untyped_def)\n apply(drule td_set_field_lookupD)\n apply(frule td_set_offset_size)\n apply(drule_tac k=x in typ_slice_td_set)\n apply simp\n apply(auto simp: prefix_def less_eq_list_def)\n done\n\nlemma wf_heap_val_map_add [simp]:\n \"\\ wf_heap_val s\\<^sub>0; wf_heap_val s\\<^sub>1 \\ \\ wf_heap_val (s\\<^sub>0 ++ s\\<^sub>1)\"\n unfolding wf_heap_val_def by auto\n\nlemma of_nat_lt_size_of:\n \"\\ (of_nat x::addr) = of_nat y + of_nat z; x < size_of TYPE('a::mem_type);\n y + z < size_of TYPE('a) \\ \\ x = y+z\"\n by (metis (mono_tags) len_of_addr_card less_trans max_size mod_less of_nat_add unat_of_nat)\n\nlemma proj_d_map_add:\n \"snd (proj_d s\\<^sub>1 p) n = Some k \\ snd (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p) n = Some k\"\n by (auto simp: proj_d_def split: option.splits)\n\nlemma proj_d_map_add2:\n \"fst (proj_d s\\<^sub>1 p) \\ fst (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p)\"\n by (auto simp: proj_d_def split: option.splits)\n\nlemma heap_list_s_restrict_disj_same:\n \"dom s \\ (UNIV - X) = {} \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\n apply(induct n arbitrary: p; clarsimp simp: heap_list_s_def)\n apply(fastforce simp: proj_h_def restrict_map_def split: option.splits)\n done\n\nlemma UNIV_minus_inter:\n \"(X - Y) \\ (X \\ (X - Y) - Z) = X - (Y \\ Z)\"\n by fast\n\nlemma sep_map_mfs_sep_map_empty:\n \"(p \\\\<^sub>g (v::'a::mem_type)) = (p \\\\<^sub>g\\<^sup>({}) v)\"\n by (auto simp: sep_map_def mfs_sep_map_def map_add_dom_eq)\n\nlemma fd_cons_double_update:\n \"\\ fd_cons t; length bs = length bs' \\ \\\n update_ti_t t bs (update_ti_t t bs' v) = update_ti_t t bs v\"\n by (simp add: fd_cons_def Let_def fd_cons_double_update_def fd_cons_desc_def)\n\nlemma fd_cons_update_access:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t (access_ti t v bs) v = v\"\n by (simp add: fd_cons_def Let_def fd_cons_update_access_def fd_cons_desc_def)\n\nlemma fd_cons_length:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n length (access_ti t v bs) = size_td t\"\n by (simp add: fd_cons_def Let_def fd_cons_desc_def fd_cons_length_def access_ti\\<^sub>0_def)\n\nlemma fd_cons_length_p:\n \"fd_cons t \\ length (access_ti\\<^sub>0 t v) = size_td t\"\n by (simp add: fd_cons_length access_ti\\<^sub>0_def)\n\nlemma fd_cons_update_normalise:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t ((norm_desc (field_desc t) (size_td t)) bs) v = update_ti_t t bs v\"\n by (fastforce simp: fd_cons_def Let_def fd_cons_desc_def fd_cons_update_normalise_def\n dest: fd_cons_update_normalise)\n\nlemma field_footprint_SIndexVal:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t, n) \\\n {x. (x, SIndexVal) \\ field_footprint (p::'a ptr) f} =\n {ptr_val p + of_nat n..+size_td t}\"\n by (auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def\n intro: intvlI dest: intvlD)\n\nlemma fs_footprint_subset:\n \"F \\ fields TYPE('a::mem_type) \\ fs_footprint (p::'a ptr) F \\ s_footprint p\"\n unfolding fs_footprint_def field_footprint_def\n apply(clarsimp simp: fields_def)\n apply(drule (1) subsetD, clarsimp)\n apply(frule field_lookup_export_uinfo_Some)\n apply(drule field_ti_s_sub)\n apply(unfold field_lvalue_def)[1]\n apply(subst (asm) field_lookup_offset_eq, assumption)\n apply(fastforce simp: field_typ_def field_typ_untyped_def)\n done\n\nlemma length_heap_list_s [simp]:\n \"length (heap_list_s s n p) = n\"\n by (clarsimp simp: heap_list_s_def)\n\nlemma heap_list_proj_h_restrict:\n \"{p..+n} \\ {x. (x,SIndexVal) \\ X} \\ heap_list (proj_h (s |` X)) n p = heap_list (proj_h s) n p\"\n apply(induct n arbitrary: p; clarsimp)\n apply(rule conjI)\n apply(fastforce simp: proj_h_restrict intro: intvl_self)\n apply(fastforce intro: intvl_plus_sub_Suc)\n done\n\nlemma heap_list_proj_h_lift_state:\n \"{p..+n} \\ {x. fst (d x)} \\ heap_list (proj_h (lift_state (h,d))) n p = heap_list h n p\"\n by (fastforce intro: heap_list_h_eq2 simp: proj_h_lift_state)\n\nlemma heap_list_rpbs:\n \"heap_list (\\x. 0) n p = replicate n 0\"\n by (induct n arbitrary: p) auto\n\nlemma field_access_take_drop:\n \"\\s m n f. field_lookup t f m = Some (s,n) \\ wf_fd t \\\n take (size_td s) (drop (n - m) (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_struct st f m = Some (s,n) \\ wf_fd_struct st \\\n take (size_td s) (drop (n - m) (access_ti_struct st v (replicate (size_td_struct st) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_list ts f m = Some (s,n) \\ wf_fd_list ts \\\n take (size_td s) (drop (n - m) (access_ti_list ts v (replicate (size_td_list ts) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_pair x f m = Some (s,n) \\ wf_fd_pair x \\\n take (size_td s) (drop (n - m) (access_ti_pair x v (replicate (size_td_pair x) 0))) =\n access_ti\\<^sub>0 s v\"\n apply(induct t and st and ts and x, all \\clarsimp simp: access_ti\\<^sub>0_def\\)\n apply(fastforce dest: wf_fd_cons_structD\n simp: fd_cons_struct_def fd_cons_desc_def fd_cons_length_def)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(clarsimp split: option.splits)\n apply(subst drop_all)\n apply(fastforce dest: field_lookup_offset_le simp: fd_cons_length_def split_DTPair_all)\n apply simp\n apply(rotate_tac -3)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(erule impE, fast)\n apply(drule sym, clarsimp)\n apply(subgoal_tac \"(size_td_pair dt_pair - (n - m)) = 0\")\n apply (fastforce simp: split_DTPair_all)\n apply (fastforce simp: split_DTPair_all dest: field_lookup_offset_le)\n apply(subgoal_tac \"(size_td s - (size_td_pair dt_pair - (n - m))) = 0\")\n apply fastforce\n apply(fastforce dest: td_set_pair_field_lookup_pairD td_set_pair_offset_size_m)\n apply fastforce\n done\n\nlemma field_access_take_dropD:\n \"\\ field_lookup t f 0 = Some (s,n); wf_lf (lf_set t []); wf_desc t \\ \\\n take (size_td s) (drop n (access_ti\\<^sub>0 t v)) = access_ti\\<^sub>0 s v\"\n using field_access_take_drop(1) [of t v] by (fastforce dest: wf_fdp_fdD wf_lf_fdp)\n\nlemma singleton_t_field:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t, n) \\\n heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t) (ptr_val p + of_nat n) =\n access_ti\\<^sub>0 t v\"\n apply(clarsimp simp: heap_list_s_def singleton_def singleton_t_def)\n apply(subst heap_list_proj_h_restrict)\n apply(fastforce simp: fields_def fs_footprint_def\n intro!: fs_footprint_subset\n dest: field_footprint_SIndexVal)\n apply(subst heap_list_proj_h_lift_state)\n apply(frule_tac p=p in field_tag_sub)\n apply(fastforce simp: field_lvalue_def dest: ptr_retyp_footprint[where d=empty_htd])\n apply(clarsimp simp: access_ti\\<^sub>0_def heap_update_def)\n apply(subst heap_list_update_list; simp?)\n apply(simp add: size_of_def)\n apply(erule field_lookup_offset_size)\n apply(fastforce simp: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def\n dest: field_access_take_dropD\n elim: field_lookup_offset_size)\n done\n\nlemma field_lookup_fd_consD:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t,n) \\ fd_cons t\"\n by (erule fd_consistentD) simp\n\nlemma s_valid_map_add:\n \"\\ s,g \\\\<^sub>s p; t,g' \\\\<^sub>s p \\ \\ (s ++ t |` X),g \\\\<^sub>s p\"\n by (clarsimp simp: map_le_def s_valid_def h_t_valid_def valid_footprint_def Let_def\n proj_d_map_add_snd proj_d_restrict_map_snd proj_d_map_add_fst\n proj_d_restrict_map_fst)\n\nlemma singleton_t_s_valid:\n \"g p \\ singleton_t p (v::'a::mem_type),g \\\\<^sub>s p\"\n by (fastforce simp: singleton_t_def h_t_s_valid elim: ptr_retyp_h_t_valid)\n\nlemma sep_map_mfs_sep_map:\n \"\\ (p \\\\<^sub>g\\<^sup>F v) s; field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type)) (s |` (dom s - fs_footprint p {f}))\"\n apply(clarsimp simp: mfs_sep_map_def)\n apply(rule conjI)\n prefer 2\n apply(fastforce simp: fs_footprint_un[where F=F] fields_def)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, clarsimp)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(subst heap_list_s_map_add_super_update_bs)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(subgoal_tac \"{x. (x, SIndexVal) \\ fs_footprint p {f}} =\n {ptr_val p + of_nat n..+size_td t}\")\n apply fast\n apply(clarsimp simp: fs_footprint_def)\n apply(erule field_footprint_SIndexVal)\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: size_of_def)\n apply(subst ac_simps)\n apply(rule td_set_offset_size)\n apply(erule td_set_field_lookupD)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p v ++ s) (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp)\n apply(simp add: size_of_def)\n apply(simp add: singleton_t_field)\n apply(fastforce simp: access_ti\\<^sub>0_def fd_cons_update_access dest!: field_lookup_fd_consD)\n apply(simp add: map_add_restrict_sub)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply(fastforce intro: s_valid_map_add singleton_t_s_valid ptr_retyp_h_t_valid)\n apply(simp add: map_add_restrict_sub)\n done\n\nlemma disjoint_fn_disjoint:\n \"\\ disjoint_fn f F; F \\ fields TYPE('a::mem_type);\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n fs_footprint (p::'a ptr) F \\ field_footprint p f = {}\"\n apply(clarsimp simp: fs_footprint_def field_footprint_def s_footprint_untyped_def field_typ_def\n field_typ_untyped_def fields_def)\n apply(safe;\n (drule (1) subsetD, clarsimp,\n drule (1) fa_fu_lookup_disj_interD;\n force intro: intvlI simp: max_size[unfolded size_of_def] disj_fn_def disjoint_fn_def))\n done\n\nlemma sep_map_mfs_sep_map2:\n \"\\field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo s = typ_uinfo_t TYPE('b); ((p::'a ptr) \\\\<^sub>g\\<^sup>F v) x\\\n \\ (Ptr &(p\\f) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 s v))::'b::mem_type))\n (x |` field_footprint p f)\"\n apply(clarsimp simp: mfs_sep_map_def sep_map_def)\n apply(rule conjI)\n apply(subgoal_tac \"field_footprint p f = s_footprint ((Ptr &(p\\f))::'b ptr)\")\n prefer 2\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def typ_uinfo_t_def\n field_typ_def field_typ_untyped_def)\n apply simp\n apply(frule lift_typ_heap_mono, assumption+)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, fastforce simp: heap_list_s_heap_merge_right[where p=\"&(p\\f)\"])\n apply(erule s_valid_heap_merge_right2)\n apply simp\n apply(frule (2) disjoint_fn_disjoint[where p=p])\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(fastforce simp: fs_footprint_def)\n apply(rule fs_footprint_subset)\n apply(fastforce simp: fields_def)\n apply(clarsimp simp: field_footprint_def field_lvalue_def s_footprint_def field_typ_def\n field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule fs_footprint_subset[where F=\"{f}\" and p=p])\n apply(rotate_tac -1)\n apply(subst (asm) fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"fs_footprint p F \\\n s_footprint_untyped (ptr_val p + of_nat n) (typ_uinfo_t TYPE('b)) = {}\")\n apply blast\n apply(drule_tac p=p in disjoint_fn_disjoint, assumption+)\n apply(simp add: field_footprint_def field_typ_def field_typ_untyped_def)\n apply(clarsimp simp: fields_def)\n done\n\nlemma export_size_of:\n \"export_uinfo t = typ_uinfo_t TYPE('a) \\ size_of TYPE('a::c_type) = size_td t\"\n by (fastforce simp: size_of_def simp flip: typ_uinfo_size dest: sym)\n\nlemma sep_map_field_unfold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F v) = (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type) \\\\<^sup>*\n Ptr (&(p\\f)) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 t v))::'b::mem_type))\"\n apply(rule ext)\n apply(rule iffI)\n apply(rule_tac s\\<^sub>0=\"x |` (dom x - fs_footprint p {f})\" and\n s\\<^sub>1=\"x |` fs_footprint p {f}\" in sep_conjI)\n apply(erule (1) sep_map_mfs_sep_map)\n apply(clarsimp simp: fs_footprint_def)\n apply(erule (4) sep_map_mfs_sep_map2)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply clarsimp\n apply(drule sep_conjD, clarsimp)\n apply(clarsimp simp: mfs_sep_map_def sep_map_def)\n apply(rule conjI)\n apply(subst map_ac_simps)\n apply(subst map_add_com, solves \\simp add: map_ac_simps\\)\n apply(subst map_add_assoc)\n apply(clarsimp simp: lift_typ_heap_if split: if_split_asm)\n apply(rule conjI, clarsimp)\n apply(subst heap_list_s_map_add_super_update_bs)\n apply(subst s_footprint_untyped_dom_SIndexVal)\n apply(fastforce simp: s_footprint_def)\n apply(fastforce simp: field_lvalue_def)\n apply(drule field_lookup_offset_size)\n apply(drule export_size_of)\n apply(simp add: size_of_def)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s s\\<^sub>1 (size_td (typ_info_t TYPE('b))) (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p v ++ s\\<^sub>0) (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp)\n apply(simp add: size_of_def)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subst fd_cons_update_normalise [symmetric])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(simp add: norm_desc_def)\n apply(drule_tac f=\"access_ti\\<^sub>0 (typ_info_t TYPE('b))\" in arg_cong)\n apply(drule_tac f=\"\\bs. update_ti_t t bs v\" in arg_cong)\n apply(subst (asm) wf_fd_norm_tuD [symmetric]; simp?)\n apply(simp add: size_of_def)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subgoal_tac \"export_uinfo (typ_info_t TYPE('b)) = typ_uinfo_t TYPE('b)\")\n prefer 2\n apply(simp add: typ_uinfo_t_def)\n apply simp\n apply(drule sym, simp)\n apply(subst (asm) wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply simp\n apply(drule sym, drule export_size_of)\n apply(simp add: size_of_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(simp add: size_of_def)\n apply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length; simp?)\n apply(erule field_lookup_fd_consD)\n apply(subgoal_tac \"update_ti_t t (norm_desc (field_desc t) (size_td t)\n (access_ti t v (replicate (size_td t) 0))) v = v\")\n apply(simp add: norm_desc_def access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_normalise)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length; simp?)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_update_access; simp?)\n apply(erule field_lookup_fd_consD)\n prefer 2\n apply(subst fs_footprint_un)\n apply(subst fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def)\n apply(drule_tac p=p in disjoint_fn_disjoint; assumption?)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(clarsimp simp: s_footprint_def)\n apply(fastforce simp: fs_footprint_def field_footprint_def s_footprint_def\n field_typ_def field_typ_untyped_def field_lvalue_def)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\n apply(rule, clarsimp simp: map_le_def) thm proj_d_map_add_snd\n apply(subst proj_d_map_add_snd[where s=\"a ++ b\" for a b])\n apply(clarsimp split: if_split_asm)\n apply(frule s_footprintD2)\n apply(drule s_footprintD)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(drule intvlD, clarsimp simp: field_lvalue_def)\n apply(drule_tac x=k in spec)\n apply(clarsimp simp add: size_of_def)\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply simp\n apply(simp add: ac_simps)\n apply(rotate_tac -1)\n apply(drule sym)\n apply simp\n apply(drule sym[where s=\"Some s\" for s])\n apply simp\n apply(drule field_lookup_export_uinfo_Some)\n apply(drule td_set_field_lookupD)\n apply(frule_tac k=k in typ_slice_td_set)\n apply simp\n apply simp\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"y=n+k\")\n apply(simp add: strict_prefix_def)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply (clarsimp simp: prefix_eq_nth)\n apply(drule_tac f=unat in arg_cong)\n apply(rotate_tac -1)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(simp add: max_size[unfolded size_of_def])\n apply(subst (asm) Abs_fnat_hom_add)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(drule td_set_offset_size)\n apply(rule_tac y=\"size_td (typ_info_t TYPE('a))\" in le_less_trans, simp)\n apply(simp add: max_size[unfolded size_of_def])\n apply simp\n apply(subst proj_d_map_add_fst)\n apply(fastforce simp: size_of_def field_lvalue_def ac_simps\n dest: intvlD s_footprintD)\n done\n\nlemma disjoint_fn_empty [simp]:\n \"disjoint_fn f {}\"\n by (simp add: disjoint_fn_def)\n\nlemma sep_map_field_map':\n \"\\ ((p::'a::mem_type ptr) \\\\<^sub>g v) s;\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (d,n); export_uinfo d = typ_uinfo_t TYPE('b);\n guard_mono g g' \\ \\\n ((Ptr (&(p\\f))::'b::mem_type ptr) \\\\<^sub>g' from_bytes (access_ti\\<^sub>0 d v)) s\"\n by (fastforce dest: sep_map_g elim: sep_conj_impl\n simp: sep_map_mfs_sep_map_empty sep_map_field_unfold sep_map'_def sep_conj_ac)\n\nlemma fd_cons_access_update_p:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n access_ti\\<^sub>0 t (update_ti_t t bs v) = access_ti\\<^sub>0 t (update_ti_t t bs w)\"\n by (simp add: fd_cons_def Let_def fd_cons_access_update_def fd_cons_desc_def access_ti\\<^sub>0_def)\n\nlemma length_to_bytes_p [simp]:\n \"length (to_bytes_p (v::'a)) = size_of TYPE('a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma inv_p [simp]:\n \"from_bytes (to_bytes_p v) = (v::'a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma singleton_SIndexVal:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n singleton_t p (v::'a::mem_type) (x,SIndexVal) = Some (SValue (to_bytes_p v ! unat (x - ptr_val p)))\"\n by (clarsimp simp: singleton_def singleton_t_def lift_state_def heap_update_def\n heap_update_mem_same_point to_bytes_p_def heap_list_rpbs ptr_retyp_d_eq_fst)\n\nlemma access_ti\\<^sub>0:\n \"access_ti s v (replicate (size_td s) 0) = access_ti\\<^sub>0 s v\"\n by (simp add: access_ti\\<^sub>0_def)\n\nlemma fd_cons_mem_type [simp]:\n \"fd_cons (typ_info_t TYPE('a::mem_type))\"\n by (rule wf_fd_consD) simp\n\nlemma norm_tu_rpbs:\n \"wf_fd t \\ norm_tu (export_uinfo t) (access_ti\\<^sub>0 t v) = access_ti\\<^sub>0 t v\"\n apply(frule wf_fd_consD)\n apply(simp add: wf_fd_norm_tuD fd_cons_length_p)\n apply(subst fd_cons_access_update_p [where w=v]; (simp add: fd_cons_length_p)?)\n apply(fastforce simp: access_ti\\<^sub>0_def fd_cons_update_access)\n done\n\nlemma heap_list_s_singleton_t_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v)) (size_td s)\n (ptr_val (p::'a::mem_type ptr) + of_nat n) =\n to_bytes_p (w::'b::mem_type)\"\n apply(clarsimp simp: singleton_t_def singleton_def)\n apply(subst heap_list_s_heap_list_dom)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\n apply(simp add: heap_update_def)\n apply(subst heap_list_update_list; simp?)\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\n apply(frule_tac v=\"(update_ti_t s (to_bytes_p w) v)\" in field_access_take_dropD; simp?)\n apply(simp add: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def to_bytes_p_def)\n apply(simp add: access_ti\\<^sub>0)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(fastforce simp: fd_cons_length_p size_of_def dest: export_size_of)\n apply(simp add: typ_uinfo_t_def norm_tu_rpbs)\n done\n\nlemma field_access_update_nth_disj:\n \"\\m f s n x bs bs'. field_lookup t f m = Some (s,n) \\ x < size_td t \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd t \\ length bs = size_td s \\ length bs' = size_td t \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_struct st f m = Some (s,n) \\ x < size_td_struct st \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_struct st \\length bs = size_td s \\ length bs' = size_td_struct st \\\n access_ti_struct st (update_ti_t s bs v) bs' ! x\n = access_ti_struct st v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_list ts f m = Some (s,n) \\ x < size_td_list ts \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_list ts \\length bs = size_td s \\ length bs' = size_td_list ts \\\n access_ti_list ts (update_ti_t s bs v) bs' ! x\n = access_ti_list ts v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_pair y f m = Some (s,n) \\ x < size_td_pair y \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_pair y \\length bs = size_td s \\ length bs' = size_td_pair y \\\n access_ti_pair y (update_ti_t s bs v) bs' ! x\n = access_ti_pair y v bs' ! x\"\n apply(induct t and st and ts and y)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply clarsimp\n prefer 2\n apply clarsimp\n apply clarify\n apply(clarsimp split: if_split_asm)\n apply(clarsimp split: option.splits)\n\n apply(rotate_tac -3)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=n in spec)\n\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"x - size_td_pair dt_pair\" in spec)\n apply(frule field_lookup_fa_fu_rhs_listD)\n apply simp\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"access_ti_pair dt_pair (update_ti_t s bs v) (take (size_td_pair dt_pair) bs') =\n access_ti_pair dt_pair v (take (size_td_pair dt_pair) bs')\")\n prefer 2\n apply (fastforce simp: min_def)\n apply(clarsimp simp: nth_append)\n apply(subgoal_tac \"length\n (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply simp\n prefer 2\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(erule impE)\n apply simp\n apply(case_tac dt_pair, simp+)\n apply(rename_tac a b)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"drop (size_td a) bs'\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_offset_size_m)\n apply clarsimp\n apply(erule disjE)\n apply arith\n apply arith\n apply(frule field_lookup_fa_fu_rhs_pairD, simp)\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"length (access_ti_pair dt_pair (update_ti_t s bs v)\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(subgoal_tac \"length (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(clarsimp simp: nth_append)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=n in spec)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply clarsimp\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(clarsimp simp: min_def split: if_split_asm)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n done\n\nlemma field_access_update_nth_disjD:\n \"\\ field_lookup t f m = Some (s,n); x < size_td t;\n (x < n - m \\ x \\ (n - m) + size_td s); wf_fd t;\n length bs = size_td s; length bs' = size_td t \\ \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n by (simp add: field_access_update_nth_disj)\n\nlemma intvl_cut:\n \"\\ (x::addr) \\ {p..+m}; x \\ {p+of_nat k..+n}; m < addr_card \\ \\\n unat (x - p) < k \\ k + n \\ unat (x - p)\"\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat, subst mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\n apply(subst (asm) unat_of_nat, subst (asm) mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\n apply(rule ccontr)\n apply(subgoal_tac \"\\z. ka = k + z\")\n apply(force simp flip: add.assoc intro: intvlI)\n apply arith\n done\n\nlemma singleton_t_mask_out:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n K = (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) \\ \\\n singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a)) |` K =\n singleton_t p v |` K\"\n supply max_size[unfolded size_of_def, simp]\n apply(rule ext)\n apply(clarsimp simp: restrict_map_def singleton_t_def singleton_def lift_state_def\n heap_update_def to_bytes_def access_ti\\<^sub>0 heap_list_rpbs size_of_def\n split: s_heap_index.splits)\n apply(subst heap_update_mem_same_point)\n apply(fastforce simp: fd_cons_length_p ptr_retyp_None size_of_def intro: ccontr)\n apply(simp add: fd_cons_length_p)\n apply(subst heap_update_mem_same_point)\n apply(fastforce simp: fd_cons_length_p ptr_retyp_None size_of_def intro: ccontr)\n apply(simp add: fd_cons_length_p)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(rule field_access_update_nth_disjD; simp?)\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: if_split_asm)\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(simp add: size_of_def)\n apply(clarsimp simp: empty_htd_def ptr_retyp_d_eq_fst split: if_split_asm)\n apply(drule_tac k=\"of_nat n\" and n=\"size_td s\" in intvl_cut; simp?)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def s_footprint_untyped_def field_lvalue_def)\n apply(drule export_size_of, simp add: size_of_def)\n done\n\nlemma singleton_t_SIndexTyp:\n \"singleton_t p v (x,SIndexTyp n) = singleton_t p undefined (x,SIndexTyp n)\"\n by (auto simp: singleton_t_def singleton_def restrict_map_def lift_state_def)\n\n\nlemma proj_d_singleton_t:\n \"proj_d (singleton_t p (v::'a::mem_type) ++ x) = proj_d (singleton_t p undefined ++ x)\"\n apply(rule ext)\n apply(clarsimp simp: proj_d_def)\n apply(safe)\n apply(subgoal_tac \"dom (singleton_t p undefined) = dom (singleton_t p v)\", blast, simp)+\n apply(rule ext)\n apply(clarsimp split: option.splits)\n apply(safe; clarsimp?)\n apply(subgoal_tac \"dom (singleton_t p undefined) = dom (singleton_t p v)\", blast, simp)+\n apply(subst (asm) singleton_t_SIndexTyp)\n apply simp\n done\n\nlemma from_bytes_heap_list_s_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b::mem_type);\n dom x = s_footprint p - fs_footprint p F; f \\ F \\ \\\n from_bytes (heap_list_s (singleton_t p (update_ti_t s (to_bytes_p (w::'b)) (v::'a)) ++ x)\n (size_of TYPE('a)) (ptr_val p)) =\n update_ti_t s (to_bytes_p w)\n (from_bytes (heap_list_s (singleton_t p v ++ x) (size_of TYPE('a)) (ptr_val p)))\"\n apply(subst map_add_restrict_UNIV [where X=\"s_footprint_untyped (&(p\\f)) (export_uinfo s)\" and\n h=\"singleton_t p v\"])\n apply(force simp: fs_footprint_def field_footprint_def field_lvalue_def\n field_typ_def field_typ_untyped_def )\n apply simp\n apply(subst heap_list_s_map_add_super_update_bs [where k=n and z=\"size_td s\"]; simp?)\n apply(rule equalityI)\n apply(fastforce dest: s_footprintD export_size_of intro: intvlI\n simp: s_footprint_untyped_def field_lvalue_def size_of_def)\n apply clarsimp\n apply(rule conjI)\n apply(frule field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(fastforce elim: s_footprintI2 dest: intvlD)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def s_footprint_untyped_def field_lvalue_def)\n apply(fastforce dest: field_lookup_offset_size simp: size_of_def)\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n s_footprint_untyped &(p\\f) (export_uinfo s))\n (size_td s) (ptr_val p + of_nat n)\" and\n bs=\"heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) ++\n singleton_t p v |`\n s_footprint_untyped &(p\\f) (typ_uinfo_t TYPE('b)) ++ x)\n (size_of TYPE('a)) (ptr_val p)\" and\n w=undefined in fi_fu_consistentD; simp add: size_of_def)\n apply(subst heap_list_s_restrict)\n apply(fastforce dest: intvlD export_size_of\n simp: size_of_def field_lvalue_def s_footprint_untyped_def)\n apply(simp add: heap_list_s_singleton_t_field_update)\n apply(subst singleton_t_mask_out; assumption?)\n apply simp\n apply(subst map_add_restrict_comp_left)\n apply simp\n done\n\nlemma mfs_sep_map_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n); f \\ F;\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (w::'b::mem_type)) v) =\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (u::'b::mem_type)) (v::'a::mem_type))\"\n apply(rule ext)\n apply(clarsimp simp: mfs_sep_map_def lift_typ_heap_if s_valid_def)\n apply safe\n apply(simp add: from_bytes_heap_list_s_update)\n apply(drule_tac f=\"update_ti_t s (to_bytes_p u)\" in arg_cong)\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(simp add: from_bytes_heap_list_s_update)\n apply(drule_tac f=\"update_ti_t s (to_bytes_p w)\" in arg_cong)\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\n done\n\nlemma mfs_sep_map_field_update_v:\n \"\\field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n); f \\ F;\n disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n p \\\\<^sub>g\\<^sup>F update_ti_t t (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type) = p \\\\<^sub>g\\<^sup>F v\"\n apply(subst mfs_sep_map_field_update [where u=\"from_bytes (access_ti\\<^sub>0 t v)\"]; simp?)\n apply(simp add: to_bytes_p_def to_bytes_def from_bytes_def access_ti\\<^sub>0 size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric], simp)\n apply(fastforce dest: fd_cons_length_p export_size_of field_lookup_fd_consD simp: size_of_def)\n apply(rotate_tac -1)\n apply(drule sym)\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(clarsimp simp: norm_bytes_def\n wf_fd_norm_tuD wf_fd_field_lookupD fd_cons_length_p field_lookup_fd_consD)\n apply(subst fd_cons_access_update_p [where w=v])\n apply(erule field_lookup_fd_consD)\n apply(simp add: fd_cons_length_p field_lookup_fd_consD)\n apply(simp add: access_ti\\<^sub>0_def fd_cons_update_access field_lookup_fd_consD)\n done\n\nlemma sep_map_field_fold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n f \\ F; disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F (v::'a::mem_type) \\\\<^sup>*\n Ptr &(p\\f) \\\\<^bsub>g'\\<^esub> (w::'b::mem_type))\n = p \\\\<^sub>g\\<^sup>(F - {f}) (update_ti_t t (to_bytes_p w) v)\"\n apply(simp add: sep_map_field_unfold)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(fastforce dest: export_size_of simp: size_of_def)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(simp add: wf_fd_field_lookupD)\n apply(fastforce dest: export_size_of simp: size_of_def)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n apply(simp add: sep_conj_ac norm mfs_sep_map_field_update_v insert_absorb)\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n done\n\nlemma norm_bytes:\n \"length bs = size_of TYPE('a) \\\n to_bytes_p ((from_bytes bs)::'a) = norm_bytes TYPE('a::mem_type) bs\"\n by (simp add: norm_bytes_def wf_fd_norm_tuD size_of_def to_bytes_p_def from_bytes_def\n to_bytes_def access_ti\\<^sub>0_def)\n\nlemma sep_heap_update_global_super_fl:\n \"\\ (p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d));\n field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (t,n);\n export_uinfo t = (typ_uinfo_t TYPE('a)) \\ \\\n ((p \\\\<^sub>g update_ti_t t (to_bytes_p v) u) \\\\<^sup>* R)\n (lift_state (heap_update (Ptr &(p\\f)) (v::'a::mem_type) h,d))\"\n apply(subst sep_map_mfs_sep_map_empty)\n apply(simp add: sep_map_field_unfold [where g'=\"\\x. True\"] guard_mono_def)\n apply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(simp add: export_size_of)\n apply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD, simp)\n apply(simp add: export_size_of)\n apply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('a)) = norm_bytes TYPE('a)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(simp add: norm sep_conj_ac)\n apply(subst sep_conj_com)\n apply(simp add: sep_conj_assoc)\n apply(rule sep_heap_update_global_exc2 [where u=\"from_bytes (access_ti\\<^sub>0 t u)\"])\n apply(simp add: sep_conj_ac)\n apply(subst sep_conj_com)\n apply(simp add: sep_map_field_fold guard_mono_def)\n apply(subst sep_map_mfs_sep_map_empty [symmetric])\n apply(simp add: fd_cons_double_update field_lookup_fd_consD)\n apply(simp add: norm_bytes fd_cons_length_p field_lookup_fd_consD export_size_of)\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\n apply(rotate_tac -1)\n apply(drule sym)\n apply(simp add: wf_fd_norm_tuD wf_fd_field_lookupD fd_cons_length_p field_lookup_fd_consD)\n apply(subst fd_cons_access_update_p [where w=u])\n apply(erule field_lookup_fd_consD)\n apply(simp add: fd_cons_length_p field_lookup_fd_consD)\n apply(simp add: access_ti\\<^sub>0_def fd_cons_update_access field_lookup_fd_consD sep_conj_com)\n done\n\nlemma sep_cut'_dom:\n \"sep_cut' x y s \\ dom s = {(a,b). a \\ {x..+y}}\"\n by (simp add: sep_cut'_def)\n\nlemma dom_exact_sep_cut':\n \"dom_exact (sep_cut' x y)\"\n by (force intro!: dom_exactI dest!: sep_cut'_dom)\n\nlemma dom_lift_state_dom_s [simp]:\n \"dom (lift_state (h,d)) = dom_s d\"\n by (force simp: lift_state_def dom_s_def split: s_heap_index.splits if_split_asm option.splits)\n\nlemma dom_ptr_retyp_empty_htd [simp]:\n \"dom (lift_state (h,ptr_retyp (p::'a::mem_type ptr) empty_htd)) = s_footprint p\"\n by simp\n\nlemma ptr_retyp_sep_cut'_exc:\n fixes p::\"'a::mem_type ptr\"\n assumes sc: \"(sep_cut' (ptr_val p) (size_of TYPE('a)) \\\\<^sup>* P) (lift_state (h,d))\" and \"g p\"\n shows \"(g \\\\<^sub>s p \\\\<^sup>* sep_true \\\\<^sup>* P) (lift_state (h,(ptr_retyp p d)))\"\nproof -\n from sc\n obtain s\\<^sub>0 and s\\<^sub>1 where \"s\\<^sub>0 \\ s\\<^sub>1\" and \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n \"P s\\<^sub>1\" and d: \"dom s\\<^sub>0 = {(a,b). a \\ {ptr_val p..+size_of TYPE('a)}}\"\n by (fast dest: sep_conjD sep_cut'_dom)\n moreover from this\n have \"lift_state (h, ptr_retyp p d) = s\\<^sub>1 ++ lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0\"\n apply -\n apply(rule ext, rename_tac x)\n apply (case_tac \"x \\ dom s\\<^sub>0\")\n apply(case_tac \"x \\ dom s\\<^sub>1\")\n apply(fastforce simp: map_disj_def)\n apply(subst map_add_com)\n apply(fastforce simp: map_disj_def)\n apply(clarsimp simp: map_add_def split: option.splits)\n apply(case_tac x, clarsimp)\n apply(clarsimp simp: lift_state_ptr_retyp_d merge_dom2)\n done\n moreover have \"g p\" by fact\n with d have \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0)\"\n apply(clarsimp simp: lift_state_ptr_retyp_restrict sep_conj_ac intro: ptr_retyp_tagd_exc)\n apply(rule_tac s\\<^sub>0=\"lift_state (h,d) |` ({(a, b). a \\ {ptr_val p..+size_of TYPE('a)}} - s_footprint p)\" in sep_conjI)\n apply (simp add: sep_conj_ac)\n apply(erule_tac h=h in ptr_retyp_tagd_exc)\n apply(fastforce simp: map_disj_def)\n apply(subst map_add_com[where h\\<^sub>0=\"lift_state (h, ptr_retyp p empty_htd)\"])\n apply (simp add: map_disj_def)\n apply fast\n apply(rule ext)\n apply(clarsimp simp: map_add_def split: option.splits)\n by (metis (mono_tags) Diff_iff dom_ptr_retyp_empty_htd non_dom_eval_eq restrict_in_dom restrict_out)\n ultimately\n show ?thesis\n by (subst sep_conj_assoc [symmetric])\n (rule_tac s\\<^sub>0=\"(lift_state (h,ptr_retyp p d))|`dom s\\<^sub>0\" and s\\<^sub>1=s\\<^sub>1 in sep_conjI,\n auto simp: map_disj_def)\nqed\n\nlemma sep_cut_dom:\n \"sep_cut x y s \\ dom s = {(a,b). a \\ {x..+unat y}}\"\n by (force simp: sep_cut_def dest: sep_cut'_dom)\n\nlemma sep_cut_0 [simp]:\n \"sep_cut p 0 = \\\"\n by (auto simp: sep_cut'_def sep_cut_def sep_emp_def None_com split_def)\n\nlemma heap_merge_restrict_dom_un:\n \"dom s = P \\ Q \\ (s|`P) ++ (s|`Q) = s\"\n by (force simp: map_add_def restrict_map_def split: option.splits)\n\nlemma sep_cut_split:\n assumes sc: \"sep_cut p y s\" and le: \"x \\ y\"\n shows \"(sep_cut p x \\\\<^sup>* sep_cut (p + x) (y - x)) s\"\nproof (rule_tac s\\<^sub>0=\"s|`{(a,b). a \\ {p..+unat x}}\" and\n s\\<^sub>1=\"s|`({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\" in sep_conjI)\n from sc le show \"sep_cut p x (s |` {(a,b). a \\ {p..+unat x}})\"\n by (force simp: sep_cut_def sep_cut'_def word_le_nat_alt\n dest: intvl_start_le)\nnext\n from sc le\n show \"sep_cut (p + x) (y - x) (s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}))\"\n by (force simp: sep_cut_def sep_cut'_def intvl_sub_eq)\nnext\n show \"s |` {(a,b). a \\ {p..+unat x}} \\ s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n by (force simp: map_disj_def)\nnext\n from sc le\n show \"s = s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}) ++ s |` {(a,b). a \\ {p..+unat x}}\"\n by (simp add: sep_cut_def sep_cut'_def, subst heap_merge_restrict_dom_un)\n (auto simp: word_le_nat_alt dest: intvl_start_le)\nqed\n\nlemma tagd_ptr_safe_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h,d)) \\ ptr_safe p d\"\n apply(clarsimp simp: ptr_safe_def sep_conj_ac sep_conj_def, drule tagd_dom_exc)\n apply(drule_tac x=\"(a,b)\" in fun_cong)\n apply(force simp: map_ac_simps lift_state_def sep_conj_ac dom_s_def merge_dom\n split: option.splits s_heap_index.splits if_split_asm)\n\n done\n\nlemma sep_map'_ptr_safe_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ ptr_safe p d\"\n by (force simp: sep_map'_def intro: sep_conj_impl tagd_ptr_safe_exc\n dest: sep_map_tagd_exc)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/SepCode.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3345894478883556, "lm_q1q2_score": 0.18033809823097996}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_on_inv__3.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_on_inv__3 imports n_mutualEx_base\nbegin\nsection{*All lemmas on causal relation between inv__3 and some rule r*}\nlemma n_TryVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv1)) (Const E)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv0)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv1)) (Const C))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv0 p__Inv1. p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv0~=p__Inv1\\f=inv__3 p__Inv0 p__Inv1\" apply fastforce done\nhave \"(i=p__Inv0)\\(i=p__Inv1)\\(i~=p__Inv0\\i~=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv1)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_on_inv__3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.35220178204788966, "lm_q1q2_score": 0.1802275053256362}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__141.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__141 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__141 and some rule r*}\nlemma n_PI_Remote_PutXVsinv__141:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__141:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__141:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__141:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__141:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__141:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__141:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_WbVsinv__141:\nassumes a1: \"(r=n_NI_Wb )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__141:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__141 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__141:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__141:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__141:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__141:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__141:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__141:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__141:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__141:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__141:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__141:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__141:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__141:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__141:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__141:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__141:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__141:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__141:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__141:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__141:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__141:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__141:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__141.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.352201788847459, "lm_q1q2_score": 0.1802275035597551}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__5.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__5 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__5 and some rule r*}\nlemma n_PI_Remote_GetVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__5:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__5:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__5:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__5:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__5:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__5:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__5:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__5:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__5:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__5:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__5:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_PutVsinv__5:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__5:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__5:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__5:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__5:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__5:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__5:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__5:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__5:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__5 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__5:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__5:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__5:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__5:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__5:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__5:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__5:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__5:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__5:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__5:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__5:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__5:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__5:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__5:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.35220177524832036, "lm_q1q2_score": 0.18022749660085005}} {"text": "(* Additional definitions and tweaks for the paper *)\n\ntheory Paper_Defs_machine_Inter\n imports\n \t\"~~/src/HOL/Library/LaTeXsugar\"\n\t Refinement\nbegin\n\n\nlemma pt_walk_pair_def2:\n\"pt_walk_pair asid heap ttbr0 v \\\n case pdc_walk asid heap ttbr0 v\n of None \\ Fault \n | Some pde \\ (case pde_tlb_entry pde heap v \n of None \\ Partial_Walk pde\n | Some te \\ Full_Walk te pde)\"\n by (clarsimp simp: pt_walk_pair_def)\n\nlemma less_eq_lookup_type1:\n \"e \\ e' \\ e = Miss \\ e' = e \\ e' = Incon\"\n by (smt less_eq_lookup_type)\n\n\n\ndefinition\n \"read_state4 \\ \\(a,b,c,d). do { \n x <- read_state a;\n y <- read_state b;\n z <- read_state c;\n z2 <- read_state d;\n return (x,y,z,z2)\n }\" \n\nlemma read_state4_conv:\n \"do {\n f;\n (x,y,z,z2) <- read_state4 (a,b,c,d);\n g x y z z2\n } = do {\n f;\n x <- read_state a;\n y <- read_state b;\n z <- read_state c;\n z2 <- read_state d;\n g x y z z2\n }\"\n by (auto simp: read_state4_def)\n\n\n \ndefinition\n \"read_state2 \\ \\(a,b). do { \n x <- read_state a;\n y <- read_state b;\n return (x,y)\n }\"\n\nlemma read_state2:\n \"do {\n (x,y) <- read_state2 (a,b);\n f x y\n } = do {\n x <- read_state a;\n y <- read_state b;\n f x y\n }\"\n by (auto simp: read_state2_def)\n\nlemma read_state2_conv:\n \"do {\n g;\n (x,y) <- read_state2 (a,b);\n f x y\n } = do {\n g;\n x <- read_state a;\n y <- read_state b;\n f x y\n }\"\n by (auto simp: read_state2_def)\n\ndefinition\n \"read_state3 \\ \\(a,b,c). do { \n x <- read_state a;\n y <- read_state b;\n z <- read_state c;\n return (x,y,z)\n }\"\n\nlemma read_state3:\n \"do {\n (x,y,z) <- read_state3 (a,b,c);\n f x y z\n } = do {\n x <- read_state a;\n y <- read_state b;\n z <- read_state c;\n f x y z\n }\"\n by (auto simp: read_state3_def)\n\nlemma read_state3_conv:\n \"do {\n g;\n (x,y,z) <- read_state3 (a,b,c);\n f x y z\n } = do {\n g;\n x <- read_state a;\n y <- read_state b;\n z <- read_state c;\n f x y z\n }\"\n by (auto simp: read_state3_def)\n\n\n\n\ndefinition\n \"K_bindn'' f g \\ bind f (\\_. g)\"\n\n\nnotation (output) K_bindn'' (\"do { //_;//_ }\") \n\ndefinition\n \"tlb_pdc_reload entry pde = update_state (\\s. s\\ non_det_tlb := pairunion (non_det_tlb s) ({entry} , {pde}) \\)\"\n\n\nlemma mmu_translate_tlb_state_ext_def2':\n\"mmu_translate v = do {\n update_state (\\s. s\\ non_det_tlb := pairsub (non_det_tlb s) (tlb_evict (typ_non_det_tlb s)) \\);\n (m, rt, a,t,p) <- read_state4 (MEM, TTBR0, ASID,non_det_tlb);\n case lookup'' t a v of \n Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'') \n | Hit te \\ return (va_to_pa v te)\n | Miss \\ (case lookup_pdc p a v of\n Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'')\n | Hit pde \\ do { \n let te = pde_tlb_entry pde m v;\n if is_fault te \n then raise'exception (PAGE_FAULT ''more info'')\n else \n K_bindn'' (update_state (\\s. s\\ non_det_tlb := pairunion (non_det_tlb s) ({the te} , {}) \\))\n (return (va_to_pa v (the te)) )\n }\n | Miss \\ do { \n let walk = pt_walk_pair a m rt v;\n case walk of Fault \\ raise'exception (PAGE_FAULT ''more info'')\n | Partial_Walk pde \\ K_bindn'' ( update_state (\\s. s\\ non_det_tlb := pairunion (non_det_tlb s) ({} , {pde}) \\))\n (raise'exception (PAGE_FAULT ''more info''))\n | Full_Walk te pde \\ \n K_bindn'' (tlb_pdc_reload te pde)\n (return (va_to_pa v te)) \n } \n )\n \n }\"\n\n apply (rule ext)\n apply (clarsimp simp:mmu_translate_non_det_tlb_state_ext_def K_bindn''_def\n Let_def split_def read_state4_def\n pt_walk_pair_def\n raise'exception_def is_fault_def \n split: lookup_type.splits option.splits)\n apply (simp only: pt_walk'_pt_walk)\n apply (clarsimp simp: pt_walk'_def map_opt_def)\n apply (clarsimp simp: tlb_pdc_reload_def)\n apply (subgoal_tac \"pairunion ({}, {x2}) ({x2a}, {}) = ({x2a}, {x2})\")\n apply (metis (no_types, hide_lams) fst_conv old.prod.exhaust pairunion.elims pairunion.simps sup_bot.right_neutral ) \n by force\n\ndefinition\n flush_tlb_pdc_vset' :: \" (tlb \\ pdc) \\ vaddr set \\ (tlb \\ pdc)\"\nwhere\n \"flush_tlb_pdc_vset' tp vset = (let tlb = fst tp ;\n pdc = snd tp in \n (tlb - \\((\\ v. {e\\tlb. v \\ range_of e}) ` vset), \n pdc - \\((\\ v. {e\\pdc. v \\ range_of e}) ` vset)))\"\n\nlemma\n \"flush_tlb_pdc_vset' tp vset = flush_tlb_pdc_vset tp vset\"\n by (clarsimp simp: flush_tlb_pdc_vset'_def flush_tlb_pdc_vset_def Let_def)\n\n\ndefinition\n flush_asid_tlb_pdc :: \" (tlb \\ pdc) \\ asid \\ (tlb \\ pdc)\"\nwhere\n \"flush_asid_tlb_pdc t a = (let tlb = fst t ;\n pdc = snd t in \n (tlb - {e\\tlb. asid_of e = Some a}, pdc - {e\\pdc. asid_of_pdc e = Some a}))\"\n\ndefinition\n flush_asid_vset_tlb_pdc :: \" (tlb \\ pdc) \\ asid \\ vaddr set \\ (tlb \\ pdc)\"\nwhere\n \"flush_asid_vset_tlb_pdc t a vset = \n (let tlb = fst t ;\n pdc = snd t in \n (tlb - (\\v\\vset. {e\\tlb. v \\ range_of e \\ asid_of e = Some a}),\n pdc - (\\v\\vset. {e\\pdc. v \\ range_of e \\ asid_of_pdc e = Some a})))\"\n\n\ndefinition\n \"no_fault e \\ \\is_fault e\"\n\ndefinition\n \"consistent0'' mem ttbr0 tlb pdc asid va \\\n consistent0' mem asid ttbr0 tlb pdc va\"\n\n\n\n\n\n(* take saturated trans *)\n\n\ndefinition \"mmu_translate_sat v \\ mmu_translate v :: ('a sat_tlb_state_scheme \\ _)\"\n\ndefinition \"mmu_write_sat \\ (mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a sat_tlb_state_scheme \\ unit \\ 'a sat_tlb_state_scheme))\"\n\n\ndefinition \"mmu_read_sat \\ (mmu_read_size :: (vaddr \\ nat \\ 'a sat_tlb_state_scheme \\ bool list \\ 'a sat_tlb_state_scheme))\"\n\ndefinition\n to_tlb :: \"pdc \\ asid \\heap \\ ttbr0 \\ vaddr \\ tlb_entry option set\"\nwhere\n \"to_tlb pdc asid mem rt va = tlb_pdc_walk asid pdc mem rt va \"\n\n\nlemma ran_Somes:\n \"ran f = Somes (range f)\"\n by (force simp: ran_def Somes_def)\n\ndefinition\n \"pdc_tlb_refill = do {\n (m, rt, a) <- read_state3 (MEM, TTBR0, ASID);\n let pdes = ran (pdc_walk a m rt) ;\n let tes = Somes (\\v. to_tlb pdes a m rt v);\n update_state (\\s. s\\ sat_tlb := pairunion (sat_tlb s) (tes , pdes)\\)\n }\"\n\n\n\nlemma ran_pdc_walk_simp':\n \" Somes (\\range (to_tlb pdes a m rt)) = \n the ` {e. (\\x. e \\ to_tlb pdes a m rt x) \\ no_fault e}\"\n apply (clarsimp simp: Somes_def is_fault_def no_fault_def)\n by force\n\n\nlemma ran_pdc_walk_simp:\n \"ran (pdc_walk a m rt) = the ` {e\\pdc_walk a m rt ` UNIV. no_fault e}\"\n apply (clarsimp simp: ran_def no_fault_def is_fault_def)\n by force\n(*\nlemma\n \" the ` {e. (\\x. e \\ to_tlb pdes a m rt x) \\ no_fault e} = ran (to_tlb pdes a m rt)\"\n*)\n \nlemma mmu_translate_sat_def2:\n\"mmu_translate_sat va = do {\n pdc_tlb_refill;\n (a,t,p) <- read_state2 (ASID,sat_tlb);\n case lookup'' t a va of\n Hit te \\ return (va_to_pa va te)\n | Miss \\ raise'exception (PAGE_FAULT ''more info'')\n | Incon \\ raise'exception (IMPLEMENTATION_DEFINED ''set on fire'')\n }\" \n apply (rule ext)\n apply (simp only: pdc_tlb_refill_def ran_pdc_walk_simp ran_pdc_walk_simp')\n by (clarsimp simp: mmu_translate_sat_def mmu_translate_sat_tlb_state_ext_def read_state3_def \n Let_def pdc_tlb_refill_def split_def read_state2_def to_tlb_def no_fault_def \n split:lookup_type.splits ) \n\n \n\ndefinition\n when_no_exc (\"when'_no'_exc _\")\nwhere\n \"(when_no_exc f) = do {\n exception \\ read_state exception;\n if exception = NoException then f else return ()\n }\"\n\ndefinition\n \"K_bind f g \\ bind f (\\_. g)\"\n\nabbreviation (K_bind)\n K_bind2 (\"do { _; _ }\")\nwhere\n \"K_bind2 \\ K_bind\"\n\n\n\nlemma mmu_write_sat_def2:\n \"mmu_write_sat (val, va, sz) = do {\n pa <- mmu_translate_sat va;\n when_no_exc (K_bind (write'mem1 (val, pa, sz)) (pdc_tlb_refill))\n }\"\n apply (rule ext)\n apply (simp add: mmu_write_sat_def when_no_exc_def mmu_translate_sat_def)\n apply (simp add: mmu_write_size_sat_tlb_state_ext_def mmu_translate_sat_def [symmetric])\n apply (case_tac \"mmu_translate_sat va x\"; clarsimp)\n apply (case_tac \"write'mem1 (val, a, sz) b\"; clarsimp simp: K_bind_def)\n apply (simp only: pdc_tlb_refill_def ran_pdc_walk_simp ran_pdc_walk_simp')\n apply (clarsimp simp: read_state3_def Let_def no_fault_def)\n apply (subgoal_tac \"ASID x = ASID ba \\ TTBR0 x = TTBR0 ba \\ sat_tlb b = sat_tlb ba\") \n apply (clarsimp simp: to_tlb_def)\n by (clarsimp simp: mmu_translate_sat_def to_tlb_def\n mmu_translate_sat_tlb_state_ext_def write'mem1_def raise'exception_def Let_def \n split: lookup_type.splits if_split_asm)\n \n\nlemma mmu_read_sat_def2:\n \"mmu_read_sat (va, sz) = do {\n pa \\ mmu_translate_sat va;\n mem_read1 (pa, sz)\n }\"\n by (simp add: mmu_read_size_sat_tlb_state_ext_def mmu_read_sat_def mmu_translate_sat_def)\n\n\ndefinition \"update_TTBR0_sat \\ (update_TTBR0 :: (paddr \\ 'a sat_tlb_state_scheme \\ unit \\ 'a sat_tlb_state_scheme))\"\n\ndefinition \"update_ASID_sat \\ (update_ASID :: (asid \\ 'a sat_tlb_state_scheme \\ unit \\ 'a sat_tlb_state_scheme))\"\n\n\nlemma upd_ttbr0_sat_def2:\n \"update_TTBR0_sat r = do {\n (K_bind (update_state (\\s. s\\ TTBR0 := r \\)) (pdc_tlb_refill))\n }\"\n apply (simp only: pdc_tlb_refill_def ran_pdc_walk_simp ran_pdc_walk_simp')\n apply (simp add: update_TTBR0_sat_def update_TTBR0_sat_tlb_state_ext_def to_tlb_def\n split_def Let_def K_bind_def no_fault_def read_state3_def cong: if_cong)\n done \n\nlemma upd_asid_sat_def2:\n \"update_ASID_sat a = do {\n (K_bind (update_state (\\s. s\\ ASID := a \\)) (pdc_tlb_refill))\n }\"\n apply (simp only: pdc_tlb_refill_def ran_pdc_walk_simp ran_pdc_walk_simp')\n apply (simp add: update_ASID_sat_def update_ASID_sat_tlb_state_ext_def to_tlb_def\n split_def Let_def K_bind_def no_fault_def read_state3_def cong: if_cong)\n done\n\n\ndefinition \"flush_sat \\ (flush :: (flush_type \\ 'a sat_tlb_state_scheme \\ unit \\ 'a sat_tlb_state_scheme))\"\n\n(* to_do *)\n\nlemma flush_sat_def2:\n \"flush_sat f = do {\n case f of FlushTLB \\ update_state (\\s. s\\ sat_tlb := ({}, {}) \\) \n | Flushvarange vset \\ update_state (\\s. s\\ sat_tlb := flush_tlb_pdc_vset' (sat_tlb s) vset \\)\n | FlushASID a \\update_state (\\s. s\\ sat_tlb := flush_asid_tlb_pdc (sat_tlb s) a \\)\n | FlushASIDvarange a vset \\ update_state (\\s. s\\ sat_tlb := flush_asid_vset_tlb_pdc (sat_tlb s) a vset \\);\n pdc_tlb_refill \n }\"\n apply (simp only: pdc_tlb_refill_def ran_pdc_walk_simp ran_pdc_walk_simp')\n by (clarsimp simp: flush_sat_def flush_sat_tlb_state_ext_def flush_tlb_pdc_vset_def to_tlb_def\n split_def Let_def K_bind_def flush_tlb_pdc_vset'_def no_fault_def read_state3_def \n flush_asid_vset_tlb_pdc_def flush_asid_tlb_pdc_def flush_tlb_pdc_asid_def flush_tlb_pdc_a_vset_def \n split: flush_type.splits cong: if_cong)\n\n\n\ndefinition\n tlb_saturated :: \"'b sat_tlb_state_scheme \\ bool\"\nwhere\n \"tlb_saturated s \\ ran (pt_walk (ASID s) (MEM s) (TTBR0 s)) \\ fst(sat_tlb s) \"\n\n\nlemma tlb_sat_simp:\n \"tlb_saturated s = (the ` {e\\pt_walk (ASID s) (MEM s) (TTBR0 s) ` UNIV. no_fault e} \\ fst(sat_tlb s)) \"\n apply (clarsimp simp: tlb_saturated_def ran_def is_fault_def no_fault_def)\n by force\n\n\ndefinition\n pdc_saturated :: \"'b sat_tlb_state_scheme \\ bool\"\nwhere\n \"pdc_saturated s \\ \n ran(pdc_walk (ASID s) (MEM s) (TTBR0 s)) \\ snd(sat_tlb s)\"\n\n\nlemma pdc_sat_simp:\n \"pdc_saturated s = (the ` {e\\pdc_walk (ASID s) (MEM s) (TTBR0 s) ` UNIV. no_fault e} \\ snd(sat_tlb s)) \"\n apply (clarsimp simp: pdc_saturated_def ran_def is_fault_def no_fault_def)\n by force\n\n\ndefinition\n saturated' :: \"'b sat_tlb_state_scheme \\ bool\"\nwhere\n \"saturated' s \\ tlb_saturated s \\ pdc_saturated s \"\n \n\nlemma\n \"saturated' s = saturated (typ_sat_tlb s)\"\n by (clarsimp simp: saturated'_def saturated_def typ_sat_tlb_def state.defs tlb_sat_simp pdc_sat_simp\n no_fault_def)\n\ndefinition \"mmu_write_abs \\ (mmu_write_size :: (bool list \\ vaddr \\ nat \\ 'a set_tlb_state_scheme \\ unit \\ 'a set_tlb_state_scheme))\"\n\ndefinition \"mmu_read_abs \\ (mmu_read_size :: (vaddr \\ nat \\ 'a set_tlb_state_scheme \\ bool list \\ 'a set_tlb_state_scheme))\"\n\n\ndefinition \"mmu_translate_abs v \\ mmu_translate v :: ('a set_tlb_state_scheme \\ _)\"\n\ndefinition \"mmu_write \\ mmu_write_size \"\n\ndefinition \"mmu_read \\ mmu_read_size \"\n\ndefinition read_state_iset :: _ where\n \"read_state_iset is = (\\s. (is(set_tlb s), s))\"\n\ndefinition\n \"read_state4i \\ \\(a,b,c,d). do { \n x <- read_state a;\n y <- read_state b; \n z <- read_state c;\n i <- read_state_iset d;\n return (x,y,z,i)\n }\"\n\ndefinition\n \"read_state5i \\ \\(a,b,c,d,e). do { \n x <- read_state a;\n y <- read_state b; \n z <- read_state c;\n i <- read_state_iset d;\n g <- read_state_iset e;\n return (x,y,z,i,g)\n }\"\n\ndefinition\n \"read_state6i \\ \\(a,b,c,d,e,f). do { \n x <- read_state a;\n y <- read_state b; \n z <- read_state c;\n i <- read_state_iset d;\n g <- read_state_iset e;\nf' <- read_state_iset f;\n return (x,y,z,i,g,f')\n }\"\n\ndefinition\n \"global_varange' asid mem ttbr0 \\ (\\e\\global_entries (the ` {e\\pt_walk asid mem ttbr0 ` UNIV. \\is_fault e}). range_of e)\"\n\n\ndefinition\n \"global_varange asid mem ttbr0 \\ (\\e\\global_entries (ran (pt_walk asid mem ttbr0)). range_of e)\"\n\nlemma global_varange_rewrite:\n \"global_varange asid mem ttbr0 = global_varange' asid mem ttbr0\"\n apply (clarsimp simp: global_varange_def global_varange'_def ran_def is_fault_def no_fault_def image_def global_entries_def)\n by force\n \n \n\ndefinition\n \"update_incon_set \\ \\ist. do { \n set_tlb <- read_state set_tlb; \n let neww = set_tlb \\iset := ist \\;\n update_state (\\s. s\\ set_tlb := neww \\)\n }\" \n\ndefinition\n \"update_global_set \\ \\ist. do { \n set_tlb <- read_state set_tlb; \n let neww = set_tlb \\global_set := ist \\;\n update_state (\\s. s\\ set_tlb := neww \\)\n }\" \n\ndefinition\n \"update_snapshot \\ \\ist. do { \n set_tlb <- read_state set_tlb; \n let neww = set_tlb \\snapshot := ist \\;\n update_state (\\s. s\\ set_tlb := neww \\)\n }\" \n\n\nlemma mmu_write_set_def2:\n \"mmu_write_abs (val, va, sz) \n = do {\n m <- read_state MEM; rt <- read_state TTBR0; a <- read_state ASID;\n iset <- read_state_iset iset;\n gset <- read_state_iset global_set;\n pa <- mmu_translate_abs va;\n when_no_exc do {\n write'mem1 (val, pa, sz);\n m' <- read_state MEM; \n update_incon_set (iset \\ ptable_comp (pt_walk_pair a m rt) (pt_walk_pair a m' rt));\n update_global_set (gset \\ global_varange a m' rt)\n }\n }\"\n apply (simp only: global_varange_rewrite)\n apply rule\n apply (clarsimp simp: mmu_write_abs_def mmu_write_size_set_tlb_state_ext_def K_bind_def \n when_no_exc_def \n update_incon_set_def mmu_translate_abs_def\n update_global_set_def read_state_iset_def global_varange'_def\n split_def Let_def incon_comp_def split: if_split_asm)\n apply (subgoal_tac \" set_tlb (snd (mmu_translate va x)) = set_tlb x\") prefer 2\napply (clarsimp simp: mmu_translate_set_tlb_state_ext_def Let_def raise'exception_def split: if_split_asm)\n apply clarsimp\n apply (subgoal_tac \"set_tlb (snd (write'mem1 (val, fst (mmu_translate va x), sz) (snd (mmu_translate va x)))) = set_tlb x\")\n apply clarsimp\n by (clarsimp simp: mmu_translate_set_tlb_state_ext_def Let_def write'mem1_def raise'exception_def split: if_split_asm)\n\n\nlemma mmu_read_set_def2:\n \"mmu_read_abs (va, sz) =\n do {\n pa \\ mmu_translate_abs va ;\n mem_read1 (pa , sz)\n }\"\n by (clarsimp simp: mmu_read_abs_def mmu_read_size_set_tlb_state_ext_def mmu_translate_abs_def)\n\n\ndefinition \"update_TTBR0_abs \\ (update_TTBR0 :: (paddr \\ 'a::type set_tlb_state_scheme \\ unit \\ 'a set_tlb_state_scheme))\"\n\ndefinition \"update_ASID_abs \\ (update_ASID :: (asid \\ 'a set_tlb_state_scheme \\ unit \\ 'a set_tlb_state_scheme))\"\n\n\n\ndefinition \"flush_abs \\ (flush :: (flush_type \\ 'a set_tlb_state_scheme \\ unit \\ 'a set_tlb_state_scheme))\"\n\n\n\ndefinition\n \"K_bindn f g \\ bind f (\\_. g)\"\n\n\nnotation (output) K_bindn (\"_ ; _\")\n\nlemma update_TTBR0_set_def2:\n \"update_TTBR0_abs r = do {\n \n m <- read_state MEM; rt <- read_state TTBR0; a <- read_state ASID;\n iset <- read_state_iset iset;\n gset <- read_state_iset global_set;\n K_bindn ( update_state (\\s. s\\ TTBR0 := r \\)) (update_global_set (gset \\ global_varange a m r));\n \n update_incon_set (iset \\ ptable_comp (pt_walk_pair a m rt) (pt_walk_pair a m r))\n \n}\"\n apply (simp only: global_varange_rewrite)\n apply (clarsimp simp: update_TTBR0_abs_def update_TTBR0_set_tlb_state_ext_def K_bindn_def K_bind_def\n when_no_exc_def \n update_incon_set_def mmu_translate_abs_def\n update_global_set_def read_state_iset_def global_varange'_def\n split_def Let_def incon_comp_def split: if_split_asm)\n apply rule+\n by (case_tac s; clarsimp)\n\n (* read_state6i*)\n\n\nlemma update_ASID_set_def2:\n \"(update_ASID_abs asid :: ('a set_tlb_state_scheme \\ _)) = do {\n (m, rt, a, iset, gset, snp) <- read_state6i (MEM, TTBR0, ASID, iset, global_set, snapshot); \n \\ \\snapshot update\\\n let snp' = snp_upd_cur' snp iset m rt a;\n\nK_bindn (update_snapshot snp') ( update_state (\\s. s\\ ASID := asid \\));\n\n \\ \\for the new iset\\\n let glb_iset = iset \\ gset;\n let snp_iset = fst (snp' asid);\n let pt_iset = ptable_comp (snd(snp' asid)) (pt_walk_pair asid m rt); \n update_incon_set (glb_iset \\ snp_iset \\ pt_iset)\n}\"\n by (clarsimp simp: read_state6i_def update_ASID_abs_def update_ASID_set_tlb_state_ext_def update_incon_set_def update_global_set_def K_bindn_def\n read_state_iset_def global_varange_def incon_comp_def update_snapshot_def Let_def Un_commute)\n\n\n\n\n\ndefinition\n \"upd_abs \\ \\ist gs snp. do { \n set_tlb <- read_state set_tlb; \n let neww = set_tlb \\iset := ist, global_set := gs, snapshot := snp \\;\n update_state (\\s. s\\ set_tlb := neww \\)\n }\" \n\n\n\n\nlemma flush_set_def2:\n \"(flush_abs f :: ('a set_tlb_state_scheme \\ _)) = do {\n (m,rt,a, is, gs, snp) <- \n read_state6i (MEM,TTBR0,ASID,iset,global_set, snapshot);\n case f of FlushTLB \\ \n upd_abs {} (global_varange a m rt) (\\ a. ({}, \\v. Fault))\n \n | Flushvarange vs \\ upd_abs (is - vs)\n ((gs - vs) \\ global_varange a m rt )\n ( \\ a. (fst(snp a) - vs, \\v. if v \\ vs then Fault else snd(snp a) v))\n | FlushASID a' \\ \n if a' = a then \n update_incon_set (is \\ gs)\n else update_snapshot (snp (a' := ({}, \\v. Fault)))\n | FlushASIDvarange a' vs \\ \n \n if a' = a then \n update_incon_set (is - (vs - gs))\n else do{ let iset = fst (snp a') ; pt = snd (snp a') in\n update_snapshot (\\a''. if a'' = a' then (iset - vs, \n \\v. if v \\ vs then Fault else pt v) else snp a'' )}\n }\"\napply (simp only: global_varange_rewrite upd_abs_def)\n apply (cases f)\n apply (clarsimp simp: flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def global_varange'_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits)\n apply (clarsimp simp: flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def global_varange'_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits)\n \n apply rule+\n apply (clarsimp simp: flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def global_varange_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits if_split_asm)\n apply (clarsimp simp: flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits if_split_asm)\n apply rule+\n apply (clarsimp simp: flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits if_split_asm)\n by (clarsimp simp:flush_abs_def flush_set_tlb_state_ext_def update_incon_set_def update_global_set_def \n read_state_iset_def incon_comp_def update_snapshot_def Let_def Un_commute read_state6i_def split: flush_type.splits if_split_asm)\n\n\ndefinition\n iset' :: \"_\"\nwhere\n \"iset' t = iset (set_tlb t)\" \n\ndefinition\n gset' :: \"_\"\nwhere\n \"gset' t = global_set (set_tlb t)\" \n\ndefinition\n snp' :: \"_\"\nwhere\n \"snp' t = snapshot (set_tlb t)\" \n\n\ndefinition \n tlb_incon_addrs :: _\nwhere \n \"tlb_incon_addrs s \\ let tlb= fst (sat_tlb s) ; a = ASID s; m = MEM s ; rt = TTBR0 s in \n {va. lookup'' tlb a va = Incon} \\ \n {va. \\e. lookup'' tlb a va = Hit e \\\n is_fault (pt_walk a m rt va)}\"\n\ndefinition \n pdc_incon_addrs :: _\nwhere \n \"pdc_incon_addrs s \\ let pdc= snd (sat_tlb s) ; a = ASID s; m = MEM s ; rt = TTBR0 s in \n {va. lookup_pdc pdc a va = Incon} \\\n {va. \\e. lookup_pdc pdc a va = Hit e \\\n is_fault (pdc_walk a m rt va)}\"\n\n\ndefinition \n incon_addrs' :: _\nwhere \n \"incon_addrs' s \\ tlb_incon_addrs s \\ pdc_incon_addrs s\"\n\n\ndefinition [simp]: \"conjn = conj\"\nnotation (output) conjn (\"((\\unbreakable\\_) \\/ (\\unbreakable\\_))\" [30,30] 36)\n\n\ndefinition \n incon_addrs'' :: _\nwhere \n \"incon_addrs'' s \\ let tlb= fst (sat_tlb s) ; pdc= snd (sat_tlb s) ; a = ASID s; m = MEM s ; rt = TTBR0 s in \n {va. lookup'' tlb a va = Incon \\ lookup_pdc pdc a va = Incon} \\ \n {va. (\\te. lookup'' tlb a va = Hit te \\\n is_fault (pt_walk a m rt va)) \\ conjn (\\pe. lookup_pdc pdc a va = Hit pe) \n (is_fault (pdc_walk a m rt va))}\"\n\nlemma incon_simp: \n \"incon_addrs'' s = incon_addrs' s\"\n apply (clarsimp simp: incon_addrs'_def incon_addrs''_def Let_def tlb_incon_addrs_def pdc_incon_addrs_def)\n by force\n\n\n definition \n tlb_global_range :: _\nwhere \n \"tlb_global_range s \\ let tlb = fst (sat_tlb s) in \n (\\e\\global_entries tlb. range_of e)\"\n\n \n definition \n pdc_global_range :: _\nwhere \n \"pdc_global_range s \\ let pdc= snd (sat_tlb s) in \n (\\e\\global_entries_pdc pdc. range_of e)\"\n\n \n \n definition \n global_range' :: _\nwhere \n \"global_range' s \\ tlb_global_range s \\ pdc_global_range s\"\n\n\n definition \n global_range'' :: _\nwhere \n \"global_range'' s \\ let tlb = fst (sat_tlb s) ; pdc= snd (sat_tlb s) in \n (\\e\\global_entries tlb. range_of e) \\ (\\e\\global_entries_pdc pdc. range_of e)\"\n\nlemma global_range_simp: \n \"global_range'' s = global_range' s\"\n by (clarsimp simp: global_range''_def global_range'_def tlb_global_range_def Let_def pdc_global_range_def )\n\n\n\ndefinition\n snap_conv_tlb :: \"(vaddr set \\ (vaddr \\ pt_walk_typ)) \\ (vaddr \\ tlb_entry lookup_type)\"\n where \n \"snap_conv_tlb snp \\ \\v. let iset = fst snp ; pt = snd snp in if v \\ iset then Incon else \n case pt v of Fault \\ Miss\n | Partial_Walk pe \\ Miss\n | Full_Walk te pe \\ if asid_of te = None \n then Miss else Hit te\"\n\n\ndefinition \n \"tlb_lookup_from snp a v \\ snap_conv_tlb (snp a) v\"\n\n \n\ndefinition\n snap_conv_pdc :: \"(vaddr set \\ (vaddr \\ pt_walk_typ)) \\ (vaddr \\ pdc_entry lookup_type)\"\n where \n \"snap_conv_pdc snp \\ \\v. let iset = fst snp ; pt = snd snp in if v \\ iset then Incon else \n case pt v of Fault \\ Miss\n | Partial_Walk pe \\ if asid_of_pdc pe = None then Miss else Hit pe\n | Full_Walk te pe \\ (if asid_of te = None \\ \n asid_of_pdc pe = None then Miss else Hit pe) \"\n\n\n\ndefinition \n \"pdc_lookup_from snp a v \\ snap_conv_pdc (snp a) v\"\n\n definition\n tlb_rel_set :: \"'a sat_tlb_state_scheme \\ 'b set_tlb_state_scheme \\ bool\"\nwhere\n \"tlb_rel_set s t \\ let tlb = fst(sat_tlb s) ; pdc = snd(sat_tlb s) ; a = ASID s ;\n snp = snp' t\n in \n ( conjn (conjn (state.truncate s = state.truncate t) \n (saturated (typ_sat_tlb s))) \n (incon_addrs'' s \\ iset' t) \\ \n global_range'' s \\ gset' t \\ \n (\\a' v. a' \\ a \\ \n lookup'' (non_global_entries tlb) a' v \\ \n tlb_lookup_from snp a' v \\\n lookup_pdc (non_global_entries_pdc pdc) a' v \\ \n pdc_lookup_from snp a' v ))\" \n\n lemma tlb_rel_set_eq:\n \"tlb_rel_set s t = tlb_rel_abs (typ_sat_tlb s) (typ_set_tlb t)\"\n apply (simp only: tlb_rel_set_def non_global_to_global non_global_to_global_pdc incon_simp global_range_simp)\n apply (clarsimp simp: tlb_rel_abs_def global_range'_def global_range_def\ntlb_global_range_def pdc_global_range_def incon_addrs'_def incon_addrs_def tlb_incon_addrs_def pdc_incon_addrs_def Let_def \ninconsistent_vaddrs_def incoherrent_vaddrs_def iset'_def mem_Collect_eq gset'_def snp'_def pdc_lookup_from_def tlb_lookup_from_def\n snap_conv_pdc_def snap_conv_tlb_def lookup_from'_def snap_conv'_def)\n apply safe \n apply (clarsimp split: if_split_asm pt_walk_typ.splits)\n apply safe [1]\n apply blast\n apply fastforce\n apply fastforce\n apply (metis (no_types, hide_lams) option.simps(3))\n apply (metis (mono_tags, hide_lams) option.simps(3))\n apply (clarsimp split: if_split_asm pt_walk_typ.splits)\n apply safe [1]\n apply blast\n apply fastforce\n apply fastforce\n apply (metis (no_types, hide_lams) option.simps(3))\n apply (metis (mono_tags, hide_lams) option.simps(3))\n apply (metis (mono_tags, hide_lams) option.simps(3))\n apply (metis (mono_tags, hide_lams) option.simps(3))\n apply (clarsimp split: if_split_asm pt_walk_typ.splits)\n apply safe [1]\n apply blast\n apply fastforce\n apply (metis (no_types, hide_lams) option.simps(3))\n apply (metis (mono_tags, hide_lams) option.simps(3))\n \n apply (clarsimp split: if_split_asm pt_walk_typ.splits)\n apply safe [1]\n apply blast\n apply fastforce\n apply fastforce\n apply (metis (no_types, hide_lams) option.simps(3))\n by (metis (mono_tags, hide_lams) option.simps(3)) + \n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_PDC/Paper_Defs_machine_Inter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3522017684487511, "lm_q1q2_score": 0.18022749312139755}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Proofs about untyped invocations. *)\n\ntheory Untyped_R\nimports Detype_R Invocations_R InterruptAcc_R\nbegin\n\nunbundle l4v_word_context\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nprimrec\n untypinv_relation :: \"Invocations_A.untyped_invocation \\\n Invocations_H.untyped_invocation \\ bool\"\nwhere\n \"untypinv_relation\n (Invocations_A.Retype c reset ob n ao n2 cl d) x = (\\ao'. x =\n (Invocations_H.Retype (cte_map c) reset ob n ao' n2\n (map cte_map cl) d)\n \\ ao = APIType_map2 (Inr ao'))\"\n\nprimrec\n valid_untyped_inv_wcap' :: \"Invocations_H.untyped_invocation\n \\ capability option \\ kernel_state \\ bool\"\nwhere\n \"valid_untyped_inv_wcap' (Invocations_H.Retype slot reset ptr_base ptr ty us slots d)\n = (\\co s. \\sz idx. (cte_wp_at' (\\cte. cteCap cte = UntypedCap d ptr_base sz idx\n \\ (co = None \\ co = Some (cteCap cte))) slot s\n \\ range_cover ptr sz (APIType_capBits ty us) (length slots)\n \\ ((\\ reset \\ idx \\ unat (ptr - ptr_base)) \\ (reset \\ ptr = ptr_base))\n \\ (ptr && ~~ mask sz) = ptr_base)\n \\ (reset \\ descendants_of' slot (ctes_of s) = {})\n \\ distinct (slot # slots)\n \\ (ty = APIObjectType ArchTypes_H.CapTableObject \\ us > 0)\n \\ (ty = APIObjectType ArchTypes_H.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits)\n \\ (\\slot \\ set slots. cte_wp_at' (\\c. cteCap c = NullCap) slot s)\n \\ (\\slot \\ set slots. ex_cte_cap_to' slot s)\n \\ sch_act_simple s \\ 0 < length slots\n \\ (d \\ ty = APIObjectType ArchTypes_H.Untyped \\ isFrameType ty)\n \\ APIType_capBits ty us \\ maxUntypedSizeBits)\"\n\nabbreviation\n \"valid_untyped_inv' ui \\ valid_untyped_inv_wcap' ui None\"\n\nlemma valid_untyped_inv_wcap':\n \"valid_untyped_inv' ui\n = (\\s. \\sz idx. valid_untyped_inv_wcap' ui\n (Some (case ui of Invocations_H.Retype slot reset ptr_base ptr ty us slots d\n \\ UntypedCap d (ptr && ~~ mask sz) sz idx)) s)\"\n by (cases ui, auto simp: fun_eq_iff cte_wp_at_ctes_of)\n\nlemma whenE_rangeCheck_eq:\n \"(rangeCheck (x :: 'a :: {linorder, integral}) y z) =\n (whenE (x < fromIntegral y \\ fromIntegral z < x)\n (throwError (RangeError (fromIntegral y) (fromIntegral z))))\"\n by (simp add: rangeCheck_def unlessE_whenE linorder_not_le[symmetric])\n\nlemma APIType_map2_CapTable[simp]:\n \"(APIType_map2 ty = Structures_A.CapTableObject)\n = (ty = Inr (APIObjectType ArchTypes_H.CapTableObject))\"\n by (simp add: APIType_map2_def\n split: sum.split RISCV64_H.object_type.split\n apiobject_type.split\n kernel_object.split arch_kernel_object.splits)\n\nlemma alignUp_H[simp]:\n \"Untyped_H.alignUp = More_Word_Operations.alignUp\"\n apply (rule ext)+\n apply (clarsimp simp:Untyped_H.alignUp_def More_Word_Operations.alignUp_def mask_def)\n done\n\n(* MOVE *)\nlemma corres_check_no_children:\n \"corres (\\x y. x = y) (cte_at slot)\n (pspace_aligned' and pspace_distinct' and valid_mdb' and\n cte_wp_at' (\\_. True) (cte_map slot))\n (const_on_failure x\n (doE z \\ ensure_no_children slot;\n returnOk y\n odE))\n (constOnFailure x\n (doE z \\ ensureNoChildren (cte_map slot);\n returnOk y\n odE))\"\n apply (clarsimp simp:const_on_failure_def constOnFailure_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split_catch[where E = dc and E'=dc])\n apply (rule corres_guard_imp[OF corres_splitEE])\n apply (rule ensureNoChildren_corres)\n apply simp\n apply (rule corres_returnOkTT)\n apply simp\n apply wp+\n apply simp+\n apply (clarsimp simp:dc_def,wp)+\n apply simp\n apply simp\n done\n\nlemma mapM_x_stateAssert:\n \"mapM_x (\\x. stateAssert (f x) (ss x)) xs\n = stateAssert (\\s. \\x \\ set xs. f x s) []\"\n apply (induct xs)\n apply (simp add: mapM_x_Nil)\n apply (simp add: mapM_x_Cons)\n apply (simp add: fun_eq_iff stateAssert_def bind_assoc exec_get assert_def)\n done\n\nlemma mapM_locate_eq:\n \"isCNodeCap cap\n \\ mapM (\\x. locateSlotCap cap x) xs\n = (do stateAssert (\\s. case gsCNodes s (capUntypedPtr cap) of None \\ xs = [] | Some n\n \\ \\x \\ set xs. n = capCNodeBits cap \\ x < 2 ^ n) [];\n return (map (\\x. (capCNodePtr cap) + 2 ^ cte_level_bits * x) xs) od)\"\n apply (clarsimp simp: isCap_simps)\n apply (simp add: locateSlot_conv objBits_simps cte_level_bits_def\n liftM_def[symmetric] mapM_liftM_const isCap_simps)\n apply (simp add: liftM_def mapM_discarded mapM_x_stateAssert)\n apply (intro bind_cong refl arg_cong2[where f=stateAssert] ext)\n apply (simp add: isCap_simps split: option.split)\n done\n\nlemmas is_frame_type_defs = is_frame_type_def isFrameType_def arch_is_frame_type_def\n\nlemma is_frame_type_isFrameType_eq[simp]:\n \"(is_frame_type (APIType_map2 (Inr (toEnum (unat arg0))))) =\n (Types_H.isFrameType (toEnum (unat arg0)))\"\n by (simp add: APIType_map2_def is_frame_type_defs split: apiobject_type.splits object_type.splits)+\n\n(* FIXME: remove *)\nlemmas APIType_capBits = objSize_eq_capBits\n\n(* FIXME: move *)\nlemma corres_whenE_throw_merge:\n \"corres r P P' f (doE _ \\ whenE (A \\ B) (throwError e); h odE)\n \\ corres r P P' f (doE _ \\ whenE A (throwError e); _ \\ whenE B (throwError e); h odE)\"\n by (auto simp: whenE_def split: if_splits)\n\nlemma decodeUntypedInvocation_corres:\n assumes cap_rel: \"list_all2 cap_relation cs cs'\"\n shows \"corres\n (ser \\ untypinv_relation)\n (invs and cte_wp_at ((=) (cap.UntypedCap d w n idx)) slot and (\\s. \\x \\ set cs. s \\ x))\n (invs'\n and (\\s. \\x \\ set cs'. s \\' x))\n (decode_untyped_invocation label args slot (cap.UntypedCap d w n idx) cs)\n (decodeUntypedInvocation label args (cte_map slot)\n (capability.UntypedCap d w n idx) cs')\"\nproof (cases \"6 \\ length args \\ cs \\ []\n \\ gen_invocation_type label = UntypedRetype\")\n case False\n show ?thesis using False cap_rel\n apply (clarsimp simp: decode_untyped_invocation_def\n decodeUntypedInvocation_def\n whenE_whenE_body unlessE_whenE\n split del: if_split cong: list.case_cong)\n apply (auto split: list.split)\n done\nnext\n case True\n have val_le_length_Cons: (* clagged from Tcb_R *)\n \"\\n xs. n \\ 0 \\ (n \\ length xs) = (\\y ys. xs = y # ys \\ (n - 1) \\ length ys)\"\n apply (case_tac xs, simp_all)\n apply (case_tac n, simp_all)\n done\n\n obtain arg0 arg1 arg2 arg3 arg4 arg5 argsmore cap cap' csmore csmore'\n where args: \"args = arg0 # arg1 # arg2 # arg3 # arg4 # arg5 # argsmore\"\n and cs: \"cs = cap # csmore\"\n and cs': \"cs' = cap' # csmore'\"\n and crel: \"cap_relation cap cap'\"\n using True cap_rel\n by (clarsimp simp: neq_Nil_conv list_all2_Cons1 val_le_length_Cons)\n\n have il: \"gen_invocation_type label = UntypedRetype\"\n using True by simp\n\n have word_unat_power2:\n \"\\bits. \\ bits < 64 \\ bits < word_bits \\ \\ unat (2 ^ bits :: machine_word) = 2 ^ bits\"\n by (simp add: word_bits_def)\n\n have P: \"\\P. corres (ser \\ dc) \\ \\\n (whenE P (throwError ExceptionTypes_A.syscall_error.TruncatedMessage))\n (whenE P (throwError Fault_H.syscall_error.TruncatedMessage))\"\n by (simp add: whenE_def returnOk_def)\n have Q: \"\\v. corres (ser \\ (\\a b. APIType_map2 (Inr (toEnum (unat v))) = a)) \\ \\\n (data_to_obj_type v)\n (whenE (fromEnum (maxBound :: RISCV64_H.object_type) < unat v)\n (throwError (Fault_H.syscall_error.InvalidArgument 0)))\"\n apply (simp only: data_to_obj_type_def returnOk_bindE fun_app_def)\n apply (simp add: maxBound_def enum_apiobject_type\n fromEnum_def whenE_def)\n apply (simp add: returnOk_def APIType_map2_def toEnum_def\n enum_apiobject_type enum_object_type)\n apply (intro conjI impI)\n apply (subgoal_tac \"unat v - 5 > 3\")\n apply (simp add: arch_data_to_obj_type_def)\n apply simp\n apply (subgoal_tac \"\\n. unat v = n + 5\")\n apply (clarsimp simp: arch_data_to_obj_type_def returnOk_def)\n apply (rule_tac x=\"unat v - 5\" in exI)\n apply arith\n done\n have S: \"\\x (y :: ('g :: len) word) (z :: 'g word) bits. \\ bits < len_of TYPE('g); x < 2 ^ bits \\ \\ toEnum x = (of_nat x :: 'g word)\"\n apply (rule toEnum_of_nat)\n apply (erule order_less_trans)\n apply simp\n done\n obtain xs where xs: \"xs = [unat arg4..ref bits.\n \\ is_aligned ref bits;\n Suc (unat arg4 + unat arg5 - Suc 0) \\ 2 ^ bits;\n bits < 64; 1 \\ arg4 + arg5;\n arg4 \\ arg4 + arg5 \\ \\\n (map (\\x. ref + 2 ^ cte_level_bits * x) [arg4 .e. arg4 + arg5 - 1])\n = map cte_map\n (map (Pair ref)\n (map (nat_to_cref bits) xs))\"\n apply (subgoal_tac \"Suc (unat (arg4 + arg5 - 1)) = unat arg4 + unat arg5\")\n apply (simp add: upto_enum_def xs del: upt.simps)\n apply (clarsimp simp: cte_map_def)\n apply (subst of_bl_nat_to_cref)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst S)\n apply simp\n apply simp\n apply (simp add: cte_level_bits_def shiftl_t2n)\n apply unat_arith\n done\n have another:\n \"\\bits a. \\ (a::machine_word) \\ 2 ^ bits; bits < word_bits\\\n \\ 2 ^ bits - a = of_nat (2 ^ bits - unat a)\"\n apply (subst of_nat_diff)\n apply (subst (asm) word_le_nat_alt)\n apply (simp add: word_unat_power2)\n apply simp\n done\n have ty_size:\n \"\\x y. (obj_bits_api (APIType_map2 (Inr x)) y) = (Types_H.getObjectSize x y)\"\n apply (clarsimp simp:obj_bits_api_def APIType_map2_def getObjectSize_def simp del: APIType_capBits)\n apply (case_tac x)\n apply (simp_all add:arch_kobj_size_def default_arch_object_def pageBits_def ptBits_def)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (simp_all add: apiGetObjectSize_def tcbBlockSizeBits_def epSizeBits_def\n ntfnSizeBits_def slot_bits_def cteSizeBits_def bit_simps)\n done\n obtain if_res where if_res_def: \"\\reset. if_res reset = (if reset then 0 else idx)\"\n by auto\n have if_res_2n:\n \"\\d res. (\\s. s \\ cap.UntypedCap d w n idx) \\ if_res res \\ 2 ^ n\"\n by (simp add: if_res_def valid_cap_def)\n\n note word_unat_power [symmetric, simp del]\n show ?thesis\n apply (rule corres_name_pre)\n apply clarsimp\n apply (subgoal_tac \"cte_wp_at' (\\cte. cteCap cte = (capability.UntypedCap d w n idx)) (cte_map slot) s'\")\n prefer 2\n apply (drule state_relation_pspace_relation)\n apply (case_tac slot)\n apply simp\n apply (drule(1) pspace_relation_cte_wp_at)\n apply fastforce+\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (frule caps_of_state_valid_cap[unfolded valid_cap_def])\n apply fastforce\n apply (clarsimp simp:cap_aligned_def)\n(* ugh yuck. who likes a word proof? furthermore, some more restriction of\n the returnOk_bindE stuff needs to be done in order to give you a single\n target to do the word proof against or else it needs repeating. ugh.\n maybe could seperate out the equality Isar-style? *)\n apply (simp add: decodeUntypedInvocation_def decode_untyped_invocation_def\n args cs cs' xs[symmetric] il whenE_rangeCheck_eq\n cap_case_CNodeCap unlessE_whenE case_bool_If lookupTargetSlot_def\n untypedBits_defs untyped_min_bits_def untyped_max_bits_def\n del: upt.simps\n split del: if_split\n cong: if_cong list.case_cong)\n apply (rule corres_guard_imp)\n apply (rule corres_splitEE[OF Q])\n apply (rule corres_whenE_throw_merge)\n apply (rule whenE_throwError_corres)\n apply (simp add: word_bits_def word_size)\n apply (clarsimp simp: word_size word_bits_def fromIntegral_def ty_size\n toInteger_nat fromInteger_nat wordBits_def)\n apply (simp add: not_le)\n apply (rule whenE_throwError_corres, simp)\n apply (clarsimp simp: fromAPIType_def)\n apply (rule whenE_throwError_corres, simp)\n apply (clarsimp simp: fromAPIType_def)\n apply (rule_tac r' = \"\\cap cap'. cap_relation cap cap'\"\n in corres_splitEE[OF corres_if])\n apply simp\n apply (rule corres_returnOkTT)\n apply (rule crel)\n apply simp\n apply (rule corres_splitEE[OF lookupSlotForCNodeOp_corres])\n apply (rule crel)\n apply simp\n apply simp\n apply (rule getSlotCap_corres,simp)\n apply wp+\n apply (rule_tac corres_split_norE)\n apply (rule corres_if)\n apply simp\n apply (rule corres_returnOkTT,clarsimp)\n apply (rule corres_trivial)\n apply (clarsimp simp: fromAPIType_def lookup_failure_map_def)\n apply (rule_tac F=\"is_cnode_cap rva \\ cap_aligned rva\" in corres_gen_asm)\n apply (subgoal_tac \"is_aligned (obj_ref_of rva) (bits_of rva) \\ bits_of rva < 64\")\n prefer 2\n apply (clarsimp simp: is_cap_simps bits_of_def cap_aligned_def word_bits_def\n is_aligned_weaken)\n apply (rule whenE_throwError_corres)\n apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+\n apply (simp add: unat_arith_simps(2) unat_2p_sub_1 word_bits_def)\n apply (rule whenE_throwError_corres)\n apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+\n apply (simp add: unat_eq_0 word_less_nat_alt)\n apply (rule whenE_throwError_corres)\n apply (clarsimp simp:Kernel_Config.retypeFanOutLimit_def is_cap_simps bits_of_def)+\n apply (clarsimp simp:toInteger_word unat_arith_simps(2) cap_aligned_def)\n apply (subst unat_sub)\n apply (simp add: linorder_not_less word_le_nat_alt)\n apply (fold neq0_conv)\n apply (simp add: unat_eq_0 cap_aligned_def)\n apply (clarsimp simp:fromAPIType_def)\n apply (clarsimp simp:liftE_bindE mapM_locate_eq)\n apply (subgoal_tac \"unat (arg4 + arg5) = unat arg4 + unat arg5\")\n prefer 2\n apply (clarsimp simp:not_less)\n apply (subst unat_word_ariths(1))\n apply (rule mod_less)\n apply (unfold word_bits_len_of)[1]\n apply (subgoal_tac \"2 ^ bits_of rva < (2 :: nat) ^ word_bits\")\n apply arith\n apply (rule power_strict_increasing, simp add: word_bits_conv)\n apply simp\n apply (rule_tac P'=\"valid_cap rva\" in corres_stateAssert_implied)\n apply (frule_tac bits2 = \"bits_of rva\" in YUCK)\n apply (simp)\n apply (simp add: word_bits_conv)\n apply (simp add: word_le_nat_alt)\n apply (simp add: word_le_nat_alt)\n apply (simp add:liftE_bindE[symmetric] free_index_of_def)\n apply (rule corres_split_norE)\n apply (clarsimp simp:is_cap_simps simp del:ser_def)\n apply (simp add: mapME_x_map_simp del: ser_def)\n apply (rule_tac P = \"valid_cap (cap.CNodeCap r bits g) and invs\" in corres_guard_imp [where P' = invs'])\n apply (rule mapME_x_corres_inv [OF _ _ _ refl])\n apply (simp del: ser_def)\n apply (rule ensureEmptySlot_corres)\n apply (clarsimp simp: is_cap_simps)\n apply (simp, wp)\n apply (simp, wp)\n apply clarsimp\n apply (clarsimp simp add: xs is_cap_simps bits_of_def valid_cap_def)\n apply (erule cap_table_at_cte_at)\n apply (simp add: nat_to_cref_def word_bits_conv)\n apply simp\n apply (subst liftE_bindE)+\n apply (rule corres_split_eqr[OF corres_check_no_children])\n apply (simp only: free_index_of_def cap.simps if_res_def[symmetric])\n apply (rule_tac F=\"if_res reset \\ 2 ^ n\" in corres_gen_asm)\n apply (rule whenE_throwError_corres)\n apply (clarsimp simp:shiftL_nat word_less_nat_alt shiftr_div_2n'\n split del: if_split)+\n apply (simp add: word_of_nat_le another)\n apply (drule_tac x = \"if_res reset\" in unat_of_nat64[OF le_less_trans])\n apply (simp add:ty_size shiftR_nat)+\n apply (simp add:unat_of_nat64 le_less_trans[OF div_le_dividend]\n le_less_trans[OF diff_le_self])\n apply (rule whenE_throwError_corres)\n apply (clarsimp)\n apply (clarsimp simp: fromAPIType_def)\n apply (rule corres_returnOkTT)\n apply (clarsimp simp:ty_size getFreeRef_def get_free_ref_def is_cap_simps)\n apply simp\n apply (strengthen if_res_2n, wp)\n apply simp\n apply wp\n apply (wp mapME_x_inv_wp\n validE_R_validE[OF valid_validE_R[OF ensure_empty_inv]]\n validE_R_validE[OF valid_validE_R[OF ensureEmpty_inv]])+\n apply (clarsimp simp: is_cap_simps valid_cap_simps\n cap_table_at_gsCNodes bits_of_def\n linorder_not_less)\n apply (erule order_le_less_trans)\n apply (rule word_leq_le_minus_one)\n apply (simp add: word_le_nat_alt)\n apply (simp add: unat_arith_simps)\n apply wpsimp+\n apply (rule hoare_strengthen_post [where Q = \"\\r. invs and valid_cap r and cte_at slot\"])\n apply wp+\n apply (clarsimp simp: is_cap_simps bits_of_def cap_aligned_def\n valid_cap_def word_bits_def)\n apply (frule caps_of_state_valid_cap, clarsimp+)\n apply (strengthen refl exI[mk_strg I E] exI[where x=d])+\n apply simp\n apply wp+\n apply (rule hoare_strengthen_post [where Q = \"\\r. invs' and cte_at' (cte_map slot)\"])\n apply wp+\n apply (clarsimp simp:invs_pspace_aligned' invs_pspace_distinct')\n apply (wp whenE_throwError_wp | wp (once) hoare_drop_imps)+\n apply (clarsimp simp: invs_valid_objs' invs_pspace_aligned' invs_pspace_distinct'\n cte_wp_at_caps_of_state cte_wp_at_ctes_of )\n apply (clarsimp simp: invs_valid_objs invs_psp_aligned)\n apply (frule caps_of_state_valid_cap, clarsimp+)\n apply (strengthen refl[where t=True] refl exI[mk_strg I E] exI[where x=d])+\n apply (clarsimp simp: is_cap_simps valid_cap_def bits_of_def cap_aligned_def\n cte_level_bits_def word_bits_conv)\n apply (clarsimp simp: invs_valid_objs' invs_pspace_aligned' invs_pspace_distinct'\n cte_wp_at_caps_of_state cte_wp_at_ctes_of )\n done\nqed\n\nlemma decodeUntyped_inv[wp]:\n \"\\P\\ decodeUntypedInvocation label args slot (UntypedCap d w n idx) cs \\\\rv. P\\\"\n apply (simp add: decodeUntypedInvocation_def whenE_def\n split_def unlessE_def Let_def\n split del: if_split cong: if_cong list.case_cong)\n apply (rule hoare_pre)\n apply (wp mapME_x_inv_wp hoare_drop_imps constOnFailure_wp\n mapM_wp'\n | wpcw\n | simp add: lookupTargetSlot_def locateSlot_conv)+\n done\n\ndeclare inj_Pair[simp]\n\ndeclare upt_Suc[simp del]\n\nlemma descendants_of_cte_at':\n \"\\p \\ descendants_of' x (ctes_of s); valid_mdb' s\\\n \\ cte_wp_at' (\\_. True) p s\"\n by (clarsimp simp:descendants_of'_def cte_wp_at_ctes_of\n dest!:subtree_target_Some)\n\nlemma ctes_of_ko:\n \"valid_cap' cap s \\\n isUntypedCap cap \\\n (\\ptr\\capRange cap. \\optr ko. ksPSpace s optr = Some ko \\ ptr \\ obj_range' optr ko)\"\n apply (case_tac cap; simp add: isCap_simps capRange_def)\n \\ \\TCB case\\\n apply (clarsimp simp: valid_cap'_def obj_at'_def)\n apply (intro exI conjI, assumption)\n apply (clarsimp simp: objBits_def obj_range'_def mask_def add_diff_eq\n dest!: projectKO_opt_tcbD simp: objBitsKO_def)\n \\ \\NTFN case\\\n apply (clarsimp simp: valid_cap'_def obj_at'_def)\n apply (intro exI conjI, assumption)\n apply (clarsimp simp: objBits_def mask_def add_diff_eq obj_range'_def objBitsKO_def)\n \\ \\EP case\\\n apply (clarsimp simp: valid_cap'_def obj_at'_def)\n apply (intro exI conjI, assumption)\n apply (clarsimp simp: objBits_def mask_def add_diff_eq obj_range'_def objBitsKO_def)\n \\ \\Zombie case\\\n apply (rename_tac word zombie_type nat)\n apply (case_tac zombie_type)\n apply (clarsimp simp: valid_cap'_def obj_at'_def)\n apply (intro exI conjI, assumption)\n apply (clarsimp simp: mask_def add_ac objBits_simps' obj_range'_def dest!: projectKO_opt_tcbD)\n apply (clarsimp simp: valid_cap'_def obj_at'_def capAligned_def objBits_simps')\n apply (frule_tac ptr=ptr and sz=cte_level_bits\n in nasty_range [where 'a=machine_word_len, folded word_bits_def])\n apply (simp add: cte_level_bits_def)+\n apply clarsimp\n apply (drule_tac x=idx in spec)\n apply (clarsimp simp: less_mask_eq)\n apply (fastforce simp: obj_range'_def objBits_simps' mask_def field_simps)\n \\ \\Arch cases\\\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability)\n \\ \\ASID control\\\n apply clarsimp\n \\ \\ASIDPool\\\n apply (clarsimp simp: valid_cap'_def valid_acap'_def valid_arch_cap_ref'_def typ_at'_def ko_wp_at'_def)\n apply (intro exI conjI, assumption)\n apply (clarsimp simp: obj_range'_def archObjSize_def objBitsKO_def)\n apply (case_tac ko; simp)\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object;\n simp add: archObjSize_def asid_low_bits_def bit_simps mask_def add_ac)\n \\ \\Frame case\\\n apply (rename_tac word vmrights vmpage_size option)\n apply (clarsimp simp: valid_cap'_def valid_acap'_def valid_arch_cap_ref'_def typ_at'_def\n ko_wp_at'_def capAligned_def)\n apply (frule_tac ptr = ptr and sz = \"pageBits\" in\n nasty_range[where 'a=machine_word_len, folded word_bits_def, rotated])\n apply simp\n apply (simp add: pbfs_atleast_pageBits)+\n apply (clarsimp simp: frame_at'_def)\n apply (drule_tac x = idx in spec, clarsimp simp: typ_at'_def ko_wp_at'_def)\n apply (intro exI conjI,assumption)\n apply (clarsimp simp: obj_range'_def shiftl_t2n mask_def add_diff_eq)\n apply (case_tac ko, simp_all split: if_splits,\n (simp add: objBitsKO_def archObjSize_def field_simps shiftl_t2n)+)[1]\n \\ \\PT case\\\n apply (rename_tac word option)\n apply (clarsimp simp: valid_cap'_def valid_acap'_def valid_arch_cap_ref'_def obj_at'_def bit_simps\n page_table_at'_def typ_at'_def ko_wp_at'_def)\n apply (frule_tac ptr=ptr and sz=3 in\n nasty_range[where 'a=machine_word_len and bz=\"ptBits\", folded word_bits_def,\n simplified ptBits_def word_bits_def bit_simps, simplified,\n simplified bit_simps, simplified])\n apply simp\n apply simp\n apply clarsimp\n apply (drule_tac x=\"ucast idx\" in spec)\n apply clarsimp\n apply (intro exI conjI,assumption)\n apply (clarsimp simp: obj_range'_def)\n apply (case_tac ko; simp)\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object; simp)\n apply (simp add: objBitsKO_def archObjSize_def bit_simps mask_def ucast_ucast_len field_simps\n shiftl_t2n)\n \\ \\CNode case\\\n apply (clarsimp simp: valid_cap'_def obj_at'_def capAligned_def objBits_simps)\n apply (frule_tac ptr=ptr and sz=cte_level_bits\n in nasty_range [where 'a=machine_word_len, folded word_bits_def])\n apply (simp add: cte_level_bits_def objBits_defs)+\n apply clarsimp\n apply (drule_tac x=idx in spec)\n apply (clarsimp simp: less_mask_eq)\n apply (fastforce simp: obj_range'_def mask_def objBits_simps' field_simps)[1]\n done\n\nlemma untypedCap_descendants_range':\n \"\\valid_pspace' s; ctes_of s p = Some cte;\n isUntypedCap (cteCap cte); valid_mdb' s;\n q \\ descendants_of' p (ctes_of s) \\\n \\ cte_wp_at' (\\c. (capRange (cteCap c) \\\n usableUntypedRange (cteCap cte) = {})) q s\"\n apply (clarsimp simp: valid_pspace'_def)\n apply (frule(1) descendants_of_cte_at')\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (clarsimp simp:valid_mdb'_def)\n apply (frule valid_mdb_no_loops)\n apply (case_tac \"isUntypedCap (cteCap ctea)\")\n apply (case_tac ctea)\n apply (rename_tac cap node)\n apply (case_tac cte)\n apply (rename_tac cap' node')\n apply clarsimp\n apply (frule(1) valid_capAligned[OF ctes_of_valid_cap'])\n apply (frule_tac c = cap in valid_capAligned[OF ctes_of_valid_cap'])\n apply (simp add:untypedCapRange)+\n apply (frule_tac c = cap' in aligned_untypedRange_non_empty)\n apply simp\n apply (frule_tac c = cap in aligned_untypedRange_non_empty)\n apply simp\n apply (clarsimp simp:valid_mdb'_def valid_mdb_ctes_def)\n apply (drule untyped_incD', simp+)\n apply clarify\n apply (erule subset_splitE)\n apply simp\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (elim conjE)\n apply (simp add:descendants_of'_def)\n apply (drule(1) subtree_trans)\n apply (simp add:no_loops_no_subtree)\n apply simp\n apply (clarsimp simp:descendants_of'_def | erule disjE)+\n apply (drule(1) subtree_trans)\n apply (simp add:no_loops_no_subtree)+\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (erule(1) disjoint_subset2[OF usableRange_subseteq])\n apply (simp add:Int_ac)\n apply (case_tac ctea)\n apply (rename_tac cap node)\n apply (case_tac cte)\n apply clarsimp\n apply (drule(1) ctes_of_valid_cap')+\n apply (frule_tac cap = cap in ctes_of_ko; assumption?)\n apply (elim disjE)\n apply clarsimp+\n apply (thin_tac \"s \\' cap\")\n apply (clarsimp simp: valid_cap'_def isCap_simps valid_untyped'_def\n simp del: usableUntypedRange.simps untypedRange.simps)\n apply (thin_tac \"\\x y z. P x y z\" for P)\n apply (rule ccontr)\n apply (clarsimp dest!: int_not_emptyD\n simp del: usableUntypedRange.simps untypedRange.simps)\n apply (drule(1) bspec)\n apply (clarsimp simp: ko_wp_at'_def simp del: usableUntypedRange.simps untypedRange.simps)\n apply (drule_tac x = optr in spec)\n apply (clarsimp simp: ko_wp_at'_def simp del: usableUntypedRange.simps untypedRange.simps)\n apply (frule(1) pspace_alignedD')\n apply (frule(1) pspace_distinctD')\n apply (erule(1) impE)\n apply (clarsimp simp del: usableUntypedRange.simps untypedRange.simps)\n apply blast\n done\n\nlemma cte_wp_at_caps_descendants_range_inI':\n \"\\invs' s; cte_wp_at' (\\c. cteCap c = UntypedCap d (ptr && ~~ mask sz) sz idx) cref s;\n idx \\ unat (ptr && mask sz); sz < word_bits\\\n \\ descendants_range_in' {ptr .. (ptr && ~~ mask sz) + mask sz}\n cref (ctes_of s)\"\n apply (frule invs_mdb')\n apply (frule(1) le_mask_le_2p)\n apply (clarsimp simp: descendants_range_in'_def cte_wp_at_ctes_of)\n apply (drule untypedCap_descendants_range'[rotated])\n apply (simp add: isCap_simps)+\n apply (simp add: invs_valid_pspace')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule disjoint_subset2[rotated])\n apply clarsimp\n apply (rule le_plus'[OF word_and_le2])\n apply simp\n apply (erule word_of_nat_le)\n done\n\nlemma checkFreeIndex_wp:\n \"\\\\s. if descendants_of' slot (ctes_of s) = {} then Q y s else Q x s\\\n constOnFailure x (doE z \\ ensureNoChildren slot; returnOk y odE)\n \\Q\\\"\n apply (clarsimp simp:constOnFailure_def const_def)\n apply (wp ensureNoChildren_wp)\n apply simp\n done\n\ndeclare upt_Suc[simp]\n\nlemma ensureNoChildren_sp:\n \"\\P\\ ensureNoChildren sl \\\\rv s. P s \\ descendants_of' sl (ctes_of s) = {}\\,-\"\n by (wp ensureNoChildren_wp, simp)\n\nlemma dui_sp_helper':\n \"\\P\\ if Q then returnOk root_cap\n else doE slot \\\n lookupTargetSlot root_cap cref dpth;\n liftE (getSlotCap slot)\n odE \\\\rv s. (rv = root_cap \\ (\\slot. cte_wp_at' ((=) rv o cteCap) slot s)) \\ P s\\, -\"\n apply (cases Q, simp_all add: lookupTargetSlot_def)\n apply (wp, simp)\n apply (simp add: getSlotCap_def split_def)\n apply wp\n apply (rule hoare_strengthen_post [OF getCTE_sp[where P=P]])\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (elim allE, drule(1) mp)\n apply simp\n apply wpsimp\n apply simp\n done\n\nlemma map_ensure_empty':\n \"\\\\s. (\\slot \\ set slots. cte_wp_at' (\\cte. cteCap cte = NullCap) slot s) \\ P s\\\n mapME_x ensureEmptySlot slots\n \\\\rv s. P s \\,-\"\n apply (induct slots arbitrary: P)\n apply (simp add: mapME_x_def sequenceE_x_def)\n apply wp\n apply (simp add: mapME_x_def sequenceE_x_def)\n apply (rule_tac Q=\"\\rv s. (\\slot\\set slots. cte_wp_at' (\\cte. cteCap cte = NullCap) slot s) \\ P s\"\n in validE_R_sp)\n apply (simp add: ensureEmptySlot_def unlessE_def)\n apply (wp getCTE_wp')\n apply (clarsimp elim!: cte_wp_at_weakenE')\n apply (erule meta_allE)\n apply (erule hoare_post_imp_R)\n apply clarsimp\n done\n\nlemma irq_nodes_global:\n \"irq_node' s + (ucast (irq :: irq) << cteSizeBits) \\ global_refs' s\"\n by (simp add: global_refs'_def)\n\nlemma valid_global_refsD2':\n \"\\ctes_of s p = Some cte; valid_global_refs' s\\ \\ global_refs' s \\ capRange (cteCap cte) = {}\"\n by (blast dest: valid_global_refsD')\n\nlemma cte_cap_in_untyped_range:\n \"\\ ptr \\ x; x \\ ptr + mask bits; cte_wp_at' (\\cte. cteCap cte = UntypedCap d ptr bits idx) cref s;\n descendants_of' cref (ctes_of s) = {}; invs' s;\n ex_cte_cap_to' x s; valid_global_refs' s \\ \\ False\"\n apply (clarsimp simp: ex_cte_cap_to'_def cte_wp_at_ctes_of)\n apply (case_tac ctea, simp)\n apply (rename_tac cap node)\n apply (frule ctes_of_valid_cap', clarsimp)\n apply (case_tac \"\\irq. cap = IRQHandlerCap irq\")\n apply (drule (1) equals0D[where a=x, OF valid_global_refsD2'[where p=cref]])\n apply (clarsimp simp: irq_nodes_global add_mask_fold)\n apply (frule_tac p=crefa and p'=cref in caps_containedD', assumption)\n apply (clarsimp dest!: isCapDs)\n apply (rule_tac x=x in notemptyI)\n apply (simp add: subsetD[OF cte_refs_capRange] add_mask_fold)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def valid_mdb'_def valid_mdb_ctes_def)\n apply (frule_tac p=cref and p'=crefa in untyped_mdbD', assumption)\n apply (simp_all add: isUntypedCap_def add_mask_fold)\n apply (frule valid_capAligned)\n apply (frule capAligned_capUntypedPtr)\n apply (case_tac cap; simp)\n apply blast\n apply (case_tac cap; simp)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def valid_mdb'_def valid_mdb_ctes_def)\n done\n\nlemma cap_case_CNodeCap_True_throw:\n \"(case cap of CNodeCap a b c d \\ returnOk ()\n | _ \\ throw $ e)\n = (whenE (\\isCNodeCap cap) (throwError e))\"\n by (simp split: capability.split bool.split\n add: whenE_def isCNodeCap_def)\n\nlemma empty_descendants_range_in':\n \"\\descendants_of' slot m = {}\\ \\ descendants_range_in' S slot m \"\n by (clarsimp simp:descendants_range_in'_def)\n\nlemma liftE_validE_R:\n \"\\P\\ f \\Q\\ \\ \\P\\ liftE f \\Q\\,-\"\n by wpsimp\n\nlemma decodeUntyped_wf[wp]:\n \"\\invs' and cte_wp_at' (\\cte. cteCap cte = UntypedCap d w sz idx) slot\n and sch_act_simple\n and (\\s. \\x \\ set cs. s \\' x)\n and (\\s. \\x \\ set cs. \\r \\ cte_refs' x (irq_node' s). ex_cte_cap_to' r s)\\\n decodeUntypedInvocation label args slot\n (UntypedCap d w sz idx) cs\n \\valid_untyped_inv'\\,-\"\n unfolding decodeUntypedInvocation_def\n apply (simp add: unlessE_def[symmetric] unlessE_whenE rangeCheck_def whenE_def[symmetric]\n returnOk_liftE[symmetric] Let_def cap_case_CNodeCap_True_throw\n split del: if_split cong: if_cong list.case_cong)\n apply (rule list_case_throw_validE_R)\n apply (clarsimp split del: if_split split: list.splits)\n apply (intro conjI impI allI)\n apply (wp+)[6]\n apply (clarsimp split del: if_split)\n apply (rename_tac ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs')\n apply (rule validE_R_sp[OF map_ensure_empty'] validE_R_sp[OF whenE_throwError_sp]\n validE_R_sp[OF dui_sp_helper'])+\n apply (case_tac \"\\ isCNodeCap nodeCap\")\n apply (simp add: validE_R_def)\n apply (simp add: mapM_locate_eq bind_liftE_distrib bindE_assoc returnOk_liftE[symmetric])\n apply (rule validE_R_sp, rule liftE_validE_R, rule stateAssert_sp)\n apply (rule hoare_pre, wp whenE_throwError_wp checkFreeIndex_wp map_ensure_empty')\n apply (clarsimp simp:cte_wp_at_ctes_of not_less shiftL_nat)\n apply (case_tac cte)\n apply clarsimp\n apply (frule(1) valid_capAligned[OF ctes_of_valid_cap'[OF _ invs_valid_objs']])\n apply (clarsimp simp:capAligned_def)\n apply (subgoal_tac \"idx \\ 2^ sz\")\n prefer 2\n apply (frule(1) ctes_of_valid_cap'[OF _ invs_valid_objs'])\n apply (clarsimp simp:valid_cap'_def valid_untyped_def)\n apply (subgoal_tac \"(2 ^ sz - idx) < 2^ word_bits\")\n prefer 2\n apply (rule le_less_trans[where y = \"2^sz\"])\n apply simp+\n apply (subgoal_tac \"of_nat (2 ^ sz - idx) = (2::machine_word)^sz - of_nat idx\")\n prefer 2\n apply (simp add:word_of_nat_minus)\n apply (subgoal_tac \"valid_cap' nodeCap s\")\n prefer 2\n apply (erule disjE)\n apply (fastforce dest: cte_wp_at_valid_objs_valid_cap')\n apply clarsimp\n apply (case_tac cte)\n apply clarsimp\n apply (drule(1) ctes_of_valid_cap'[OF _ invs_valid_objs'])+\n apply simp\n apply (clarsimp simp: toEnum_of_nat [OF less_Suc_unat_less_bound])\n apply (subgoal_tac \"args ! 4 \\ 2 ^ capCNodeBits nodeCap\")\n prefer 2\n apply (clarsimp simp: isCap_simps)\n apply (subst (asm) le_m1_iff_lt[THEN iffD1])\n apply (clarsimp simp:valid_cap'_def isCap_simps p2_gt_0 capAligned_def word_bits_def)\n apply (rule less_imp_le)\n apply simp\n apply (subgoal_tac\n \"distinct (map (\\y. capCNodePtr nodeCap + y * 2^cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\")\n prefer 2\n apply (simp add: distinct_map upto_enum_def del: upt_Suc)\n apply (rule comp_inj_on)\n apply (rule inj_onI)\n apply (clarsimp dest!: less_Suc_unat_less_bound)\n apply (erule word_unat.Abs_eqD)\n apply (simp add: unats_def)\n apply (simp add: unats_def)\n apply (rule inj_onI)\n apply (clarsimp simp: toEnum_of_nat[OF less_Suc_unat_less_bound] isCap_simps)\n apply (erule(2) inj_bits, simp add: cte_level_bits_def word_bits_def)\n apply (subst Suc_unat_diff_1)\n apply (rule word_le_plus_either,simp)\n apply (subst olen_add_eqv)\n apply (subst add.commute)\n apply (erule(1) plus_minus_no_overflow_ab)\n apply (drule(1) le_plus)\n apply (rule unat_le_helper)\n apply (erule order_trans)\n apply (subst unat_power_lower64[symmetric], simp add: word_bits_def cte_level_bits_def)\n apply (simp add: word_less_nat_alt[symmetric])\n apply (rule two_power_increasing)\n apply (clarsimp dest!: valid_capAligned\n simp: capAligned_def objBits_def objBitsKO_def)\n apply (simp_all add: word_bits_def cte_level_bits_def objBits_defs)[2]\n apply (clarsimp simp: RISCV64_H.fromAPIType_def)\n apply (subgoal_tac \"Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\")\n prefer 2\n apply simp\n apply (subst Suc_unat_diff_1)\n apply (rule word_le_plus_either,simp)\n apply (subst olen_add_eqv)\n apply (subst add.commute)\n apply (erule(1) plus_minus_no_overflow_ab)\n apply (rule unat_plus_simple[THEN iffD1])\n apply (subst olen_add_eqv)\n apply (subst add.commute)\n apply (erule(1) plus_minus_no_overflow_ab)\n apply clarsimp\n apply (subgoal_tac \"(\\x. (args ! 4) \\ x \\ x \\ (args ! 4) + (args ! 5) - 1 \\\n ex_cte_cap_wp_to' (\\_. True) (capCNodePtr nodeCap + x * 2^cteSizeBits) s)\")\n prefer 2\n apply clarsimp\n apply (erule disjE)\n apply (erule bspec)\n apply (clarsimp simp:isCap_simps image_def shiftl_t2n mult_ac)\n apply (rule_tac x = x in bexI,simp)\n apply (simp add: mask_def)\n apply (erule order_trans)\n apply (frule(1) le_plus)\n apply (rule word_l_diffs,simp+)\n apply (rule word_le_plus_either,simp)\n apply (subst olen_add_eqv)\n apply (subst add.commute)\n apply (erule(1) plus_minus_no_overflow_ab)\n apply (clarsimp simp:ex_cte_cap_wp_to'_def)\n apply (rule_tac x = nodeSlot in exI)\n apply (case_tac cte)\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps image_def\n shiftl_t2n)\n apply (rule_tac x = x in bexI,simp)\n apply (simp add: mask_def)\n apply (erule order_trans)\n apply (frule(1) le_plus)\n apply (rule word_l_diffs,simp+)\n apply (rule word_le_plus_either,simp)\n apply (subst olen_add_eqv)\n apply (subst add.commute)\n apply (erule(1) plus_minus_no_overflow_ab)\n apply (simp add: fromIntegral_def toInteger_nat fromInteger_nat)\n apply (rule conjI)\n apply (simp add: objBits_defs cte_level_bits_def)\n apply (clarsimp simp:of_nat_shiftR word_le_nat_alt)\n apply (frule_tac n = \"unat (args ! 5)\"\n and bits = \"(APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))\"\n in range_cover_stuff[where rv = 0,rotated -1])\n apply (simp add:unat_1_0)\n apply simp\n apply (simp add:word_sub_le_iff word_of_nat_le)\n apply simp+\n apply (clarsimp simp:getFreeRef_def)\n apply (frule alignUp_idem[OF is_aligned_weaken,where a = w])\n apply (erule range_cover.sz)\n apply (simp add:range_cover_def)\n apply (simp add:empty_descendants_range_in' untypedBits_defs)\n apply (clarsimp simp: image_def isCap_simps nullPointer_def word_size field_simps)\n apply (intro conjI)\n apply (clarsimp simp: image_def isCap_simps nullPointer_def word_size field_simps)\n apply (drule_tac x=x in spec)+\n apply simp\n apply (clarsimp simp: APIType_capBits_def)\n apply clarsimp\n apply (clarsimp simp: image_def getFreeRef_def cte_level_bits_def objBits_simps' field_simps)\n apply (clarsimp simp: of_nat_shiftR word_le_nat_alt)\n apply (frule_tac n = \"unat (args ! 5)\"\n and bits = \"(APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))\"\n in range_cover_stuff[where w=w and sz=sz and rv = idx,rotated -1]; simp?)\n apply (intro conjI; clarsimp simp add: image_def word_size)\n apply (clarsimp simp: image_def isCap_simps nullPointer_def word_size field_simps)\n apply (drule_tac x=x in spec)+\n apply simp\n apply (clarsimp simp: APIType_capBits_def)\n done\n\nlemma corres_list_all2_mapM_':\n assumes w: \"suffix xs oxs\" \"suffix ys oys\"\n assumes y: \"\\x xs y ys. \\ F x y; suffix (x # xs) oxs; suffix (y # ys) oys \\\n \\ corres dc (P (x # xs)) (P' (y # ys)) (f x) (g y)\"\n assumes z: \"\\x y xs. \\ F x y; suffix (x # xs) oxs \\ \\ \\P (x # xs)\\ f x \\\\rv. P xs\\\"\n \"\\x y ys. \\ F x y; suffix (y # ys) oys \\ \\ \\P' (y # ys)\\ g y \\\\rv. P' ys\\\"\n assumes x: \"list_all2 F xs ys\"\n shows \"corres dc (P xs) (P' ys) (mapM_x f xs) (mapM_x g ys)\"\n apply (insert x w)\n apply (induct xs arbitrary: ys)\n apply (simp add: mapM_x_def sequence_x_def)\n apply (case_tac ys)\n apply simp\n apply (clarsimp simp add: mapM_x_def sequence_x_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF y]; assumption?)\n apply (clarsimp dest!: suffix_ConsD)\n apply (erule meta_allE, (drule(1) meta_mp)+)\n apply assumption\n apply (erule(1) z)+\n apply simp+\n done\n\nlemmas suffix_refl = suffix_order.refl\n\nlemmas corres_list_all2_mapM_\n = corres_list_all2_mapM_' [OF suffix_refl suffix_refl]\n\ndeclare modify_map_id[simp]\n\nlemma valid_mdbD3':\n \"\\ ctes_of s p = Some cte; valid_mdb' s \\ \\ p \\ 0\"\n by (clarsimp simp add: valid_mdb'_def valid_mdb_ctes_def no_0_def)\n\nlemma capRange_sameRegionAs:\n \"\\ sameRegionAs x y; s \\' y; capClass x = PhysicalClass \\ capClass y = PhysicalClass \\\n \\ capRange x \\ capRange y \\ {}\"\n apply (erule sameRegionAsE)\n apply (subgoal_tac \"capClass x = capClass y \\ capRange x = capRange y\")\n apply simp\n apply (drule valid_capAligned)\n apply (drule(1) capAligned_capUntypedPtr)\n apply clarsimp\n apply (rule conjI)\n apply (rule master_eqI, rule capClass_Master, simp)\n apply (rule master_eqI, rule capRange_Master, simp)\n apply blast\n apply blast\n apply (clarsimp simp: isCap_simps)+\n done\nend\n\nlocale mdb_insert_again =\n mdb_ptr_parent?: mdb_ptr m _ _ parent parent_cap parent_node +\n mdb_ptr_site?: mdb_ptr m _ _ site site_cap site_node\n for m parent parent_cap parent_node site site_cap site_node +\n\n fixes c'\n\n assumes site_cap: \"site_cap = NullCap\"\n assumes site_prev: \"mdbPrev site_node = 0\"\n assumes site_next: \"mdbNext site_node = 0\"\n\n assumes is_untyped: \"isUntypedCap parent_cap\"\n assumes same_region: \"sameRegionAs parent_cap c'\"\n\n assumes range: \"descendants_range' c' parent m\"\n assumes phys: \"capClass c' = PhysicalClass\"\n\n fixes s\n assumes valid_capI': \"m p = Some (CTE cap node) \\ s \\' cap\"\n\n assumes ut_rev: \"ut_revocable' m\"\n\n fixes n\n defines \"n \\\n (modify_map\n (\\x. if x = site\n then Some (CTE c' (MDB (mdbNext parent_node) parent True True))\n else m x)\n parent (cteMDBNode_update (mdbNext_update (\\x. site))))\"\n\n assumes neq: \"parent \\ site\"\n\ncontext mdb_insert_again\nbegin\ninterpretation Arch . (*FIXME: arch_split*)\nlemmas parent = mdb_ptr_parent.m_p\nlemmas site = mdb_ptr_site.m_p\n\nlemma next_wont_bite:\n \"\\ mdbNext parent_node \\ 0; m (mdbNext parent_node) = Some cte \\\n \\ \\ sameRegionAs c' (cteCap cte)\"\n using range ut_rev\n apply (cases cte)\n apply clarsimp\n apply (cases \"m \\ parent \\ mdbNext parent_node\")\n apply (drule (2) descendants_rangeD')\n apply (drule capRange_sameRegionAs)\n apply (erule valid_capI')\n apply (simp add: phys)\n apply blast\n apply (erule notE, rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold parent)\n apply assumption\n apply (simp add: parentOf_def parent)\n apply (insert is_untyped same_region)\n apply (clarsimp simp: isMDBParentOf_CTE)\n apply (rule conjI)\n apply (erule (1) sameRegionAs_trans)\n apply (simp add: ut_revocable'_def)\n apply (insert parent)\n apply simp\n apply (clarsimp simp: isCap_simps)\n done\n\nlemma no_0_helper: \"no_0 m \\ no_0 n\"\n by (simp add: n_def, simp add: no_0_def)\n\nlemma no_0_n [intro!]: \"no_0 n\" by (auto intro: no_0_helper)\n\nlemmas n_0_simps [iff] = no_0_simps [OF no_0_n]\n\nlemmas neqs [simp] = neq neq [symmetric]\n\ndefinition\n \"new_site \\ CTE c' (MDB (mdbNext parent_node) parent True True)\"\n\ndefinition\n \"new_parent \\ CTE parent_cap (mdbNext_update (\\a. site) parent_node)\"\n\nlemma n: \"n = m (site \\ new_site, parent \\ new_parent)\"\n using parent site\n by (simp add: n_def modify_map_apply new_site_def new_parent_def\n fun_upd_def[symmetric])\n\nlemma site_no_parent [iff]:\n \"m \\ site \\ x = False\" using site site_next\n by (auto dest: subtree_next_0)\n\nlemma site_no_child [iff]:\n \"m \\ x \\ site = False\" using site site_prev\n by (auto dest: subtree_prev_0)\n\nlemma parent_next: \"m \\ parent \\ mdbNext parent_node\"\n by (simp add: parent mdb_next_unfold)\n\nlemma parent_next_rtrancl_conv [simp]:\n \"m \\ mdbNext parent_node \\\\<^sup>* site = m \\ parent \\\\<^sup>+ site\"\n apply (rule iffI)\n apply (insert parent_next)\n apply (fastforce dest: rtranclD)\n apply (drule tranclD)\n apply (clarsimp simp: mdb_next_unfold)\n done\n\nlemma site_no_next [iff]:\n \"m \\ x \\ site = False\" using site site_prev dlist\n apply clarsimp\n apply (simp add: mdb_next_unfold)\n apply (elim exE conjE)\n apply (case_tac z)\n apply simp\n apply (rule dlistEn [where p=x], assumption)\n apply clarsimp\n apply clarsimp\n done\n\nlemma site_no_next_trans [iff]:\n \"m \\ x \\\\<^sup>+ site = False\"\n by (clarsimp dest!: tranclD2)\n\nlemma site_no_prev [iff]:\n \"m \\ site \\ p = (p = 0)\" using site site_next\n by (simp add: mdb_next_unfold)\n\nlemma site_no_prev_trancl [iff]:\n \"m \\ site \\\\<^sup>+ p = (p = 0)\"\n apply (rule iffI)\n apply (drule tranclD)\n apply clarsimp\n apply simp\n apply (insert chain site)\n apply (simp add: mdb_chain_0_def)\n apply auto\n done\n\nlemma chain_n:\n \"mdb_chain_0 n\"\nproof -\n from chain\n have \"m \\ mdbNext parent_node \\\\<^sup>* 0\" using dlist parent\n apply (cases \"mdbNext parent_node = 0\")\n apply simp\n apply (erule dlistEn, simp)\n apply (auto simp: mdb_chain_0_def)\n done\n moreover\n have \"\\m \\ mdbNext parent_node \\\\<^sup>* parent\"\n using parent_next\n apply clarsimp\n apply (drule (1) rtrancl_into_trancl2)\n apply simp\n done\n moreover\n have \"\\ m \\ 0 \\\\<^sup>* site\" using no_0 site\n by (auto elim!: next_rtrancl_tranclE dest!: no_0_lhs_trancl)\n moreover\n have \"\\ m \\ 0 \\\\<^sup>* parent\" using no_0 parent\n by (auto elim!: next_rtrancl_tranclE dest!: no_0_lhs_trancl)\n moreover\n note chain\n ultimately show \"mdb_chain_0 n\" using no_0 parent site\n apply (simp add: n new_parent_def new_site_def)\n apply (auto intro!: mdb_chain_0_update no_0_update simp: next_update_lhs_rtrancl)\n done\nqed\n\nlemma no_loops_n: \"no_loops n\" using chain_n no_0_n\n by (rule mdb_chain_0_no_loops)\n\nlemma n_direct_eq:\n \"n \\ p \\ p' = (if p = parent then p' = site else\n if p = site then m \\ parent \\ p'\n else m \\ p \\ p')\"\n using parent site site_prev\n by (auto simp: mdb_next_update n new_parent_def new_site_def\n parent_next mdb_next_unfold)\n\nlemma next_not_parent:\n \"\\ mdbNext parent_node \\ 0; m (mdbNext parent_node) = Some cte \\\n \\ \\ isMDBParentOf new_site cte\"\n apply (drule(1) next_wont_bite)\n apply (cases cte)\n apply (simp add: isMDBParentOf_def new_site_def)\n done\n\n(* The newly inserted cap should never have children. *)\nlemma site_no_parent_n:\n \"n \\ site \\ p = False\" using parent valid_badges\n apply clarsimp\n apply (erule subtree.induct)\n prefer 2\n apply simp\n apply (clarsimp simp: parentOf_def mdb_next_unfold new_site_def n)\n apply (cases \"mdbNext parent_node = site\")\n apply (subgoal_tac \"m \\ parent \\ site\")\n apply simp\n apply (subst mdb_next_unfold)\n apply (simp add: parent)\n apply clarsimp\n apply (erule notE[rotated], erule(1) next_not_parent[unfolded new_site_def])\n done\n\nend\n\nlocale mdb_insert_again_child = mdb_insert_again +\n assumes child:\n \"isMDBParentOf\n (CTE parent_cap parent_node)\n (CTE c' (MDB (mdbNext parent_node) parent True True))\"\n\ncontext mdb_insert_again_child\nbegin\n\nlemma new_child [simp]:\n \"isMDBParentOf new_parent new_site\"\n by (simp add: new_parent_def new_site_def) (rule child)\n\nlemma n_site_child:\n \"n \\ parent \\ site\"\n apply (rule subtree.direct_parent)\n apply (simp add: n_direct_eq)\n apply simp\n apply (clarsimp simp: parentOf_def parent site n)\n done\n\nlemma parent_m_n:\n assumes \"m \\ p \\ p'\"\n shows \"if p' = parent then n \\ p \\ site \\ n \\ p \\ p' else n \\ p \\ p'\" using assms\nproof induct\n case (direct_parent c)\n thus ?case\n apply (cases \"p = parent\")\n apply simp\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (rule subtree.trans_parent [where c'=site])\n apply (rule n_site_child)\n apply (simp add: n_direct_eq)\n apply simp\n apply (clarsimp simp: parentOf_def n)\n apply (clarsimp simp: new_parent_def parent)\n apply simp\n apply (subgoal_tac \"n \\ p \\ c\")\n prefer 2\n apply (rule subtree.direct_parent)\n apply (clarsimp simp add: n_direct_eq)\n apply simp\n apply (clarsimp simp: parentOf_def n)\n apply (fastforce simp: new_parent_def parent)\n apply clarsimp\n apply (erule subtree_trans)\n apply (rule n_site_child)\n done\nnext\n case (trans_parent c d)\n thus ?case\n apply -\n apply (cases \"c = site\", simp)\n apply (cases \"d = site\", simp)\n apply (cases \"c = parent\")\n apply clarsimp\n apply (erule subtree.trans_parent [where c'=site])\n apply (clarsimp simp add: n_direct_eq)\n apply simp\n apply (clarsimp simp: parentOf_def n)\n apply (rule conjI, clarsimp)\n apply (clarsimp simp: new_parent_def parent)\n apply clarsimp\n apply (subgoal_tac \"n \\ p \\ d\")\n apply clarsimp\n apply (erule subtree_trans, rule n_site_child)\n apply (erule subtree.trans_parent)\n apply (simp add: n_direct_eq)\n apply simp\n apply (clarsimp simp: parentOf_def n)\n apply (fastforce simp: parent new_parent_def)\n done\nqed\n\nlemma n_to_site [simp]:\n \"n \\ p \\ site = (p = parent)\"\n by (simp add: n_direct_eq)\n\nlemma parent_n_m:\n assumes \"n \\ p \\ p'\"\n shows \"if p' = site then p \\ parent \\ m \\ p \\ parent else m \\ p \\ p'\"\nproof -\n from assms have [simp]: \"p \\ site\" by (clarsimp simp: site_no_parent_n)\n from assms\n show ?thesis\n proof induct\n case (direct_parent c)\n thus ?case\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply clarsimp\n apply (rule subtree.direct_parent)\n apply (simp add: n_direct_eq split: if_split_asm)\n apply simp\n apply (clarsimp simp: parentOf_def n parent new_parent_def split: if_split_asm)\n done\n next\n case (trans_parent c d)\n thus ?case\n apply clarsimp\n apply (rule conjI, clarsimp)\n apply (clarsimp split: if_split_asm)\n apply (simp add: n_direct_eq)\n apply (cases \"p=parent\")\n apply simp\n apply (rule subtree.direct_parent, assumption, assumption)\n apply (clarsimp simp: parentOf_def n parent new_parent_def split: if_split_asm)\n apply clarsimp\n apply (erule subtree.trans_parent, assumption, assumption)\n apply (clarsimp simp: parentOf_def n parent new_parent_def split: if_split_asm)\n apply (erule subtree.trans_parent)\n apply (simp add: n_direct_eq split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def n parent new_parent_def split: if_split_asm)\n done\n qed\nqed\n\nlemma descendants:\n \"descendants_of' p n =\n (if parent \\ descendants_of' p m \\ p = parent\n then descendants_of' p m \\ {site} else descendants_of' p m)\"\n apply (rule set_eqI)\n apply (simp add: descendants_of'_def)\n apply (fastforce dest!: parent_n_m dest: parent_m_n simp: n_site_child split: if_split_asm)\n done\n\nend\n\nlemma blarg_descendants_of':\n \"descendants_of' x (modify_map m p (if P then id else cteMDBNode_update (mdbPrev_update f)))\n = descendants_of' x m\"\n by (simp add: descendants_of'_def)\n\nlemma bluhr_descendants_of':\n \"mdb_insert_again_child (ctes_of s') parent parent_cap pmdb site site_cap site_node cap s\n \\\n descendants_of' x\n (modify_map\n (modify_map\n (\\c. if c = site\n then Some (CTE cap (MDB (mdbNext pmdb) parent True True))\n else ctes_of s' c)\n (mdbNext pmdb)\n (if mdbNext pmdb = 0 then id\n else cteMDBNode_update (mdbPrev_update (\\x. site))))\n parent (cteMDBNode_update (mdbNext_update (\\x. site))))\n = (if parent \\ descendants_of' x (ctes_of s') \\ x = parent\n then descendants_of' x (ctes_of s') \\ {site}\n else descendants_of' x (ctes_of s'))\"\n apply (subst modify_map_com)\n apply (case_tac x, rename_tac node, case_tac node, clarsimp)\n apply (subst blarg_descendants_of')\n apply (erule mdb_insert_again_child.descendants)\n done\n\nlemma mdb_relation_simp:\n \"\\ (s, s') \\ state_relation; cte_at p s \\\n \\ descendants_of' (cte_map p) (ctes_of s') = cte_map ` descendants_of p (cdt s)\"\n by (cases p, clarsimp simp: state_relation_def cdt_relation_def)\n\nlemma in_getCTE2:\n \"((cte, s') \\ fst (getCTE p s)) = (s' = s \\ cte_wp_at' ((=) cte) p s)\"\n apply (safe dest!: in_getCTE)\n apply (clarsimp simp: cte_wp_at'_def getCTE_def)\n done\n\ndeclare wrap_ext_op_det_ext_ext_def[simp]\n\nlemma do_ext_op_update_cdt_list_symb_exec_l':\n \"corres_underlying {(s::det_state, s'). f (kheap s) (ekheap s) s'} nf nf' dc P P' (create_cap_ext p z a) (return x)\"\n apply (simp add: corres_underlying_def create_cap_ext_def\n update_cdt_list_def set_cdt_list_def bind_def put_def get_def gets_def return_def)\n done\n\ncrunches updateMDB, updateNewFreeIndex\n for it'[wp]: \"\\s. P (ksIdleThread s)\"\n and ups'[wp]: \"\\s. P (gsUserPages s)\"\n and cns'[wp]: \"\\s. P (gsCNodes s)\"\n and ksDomainTime[wp]: \"\\s. P (ksDomainTime s)\"\n and ksDomScheduleIdx[wp]: \"\\s. P (ksDomScheduleIdx s)\"\n and ksWorkUnitsCompleted[wp]: \"\\s. P (ksWorkUnitsCompleted s)\"\n and ksMachineState[wp]: \"\\s. P (ksMachineState s)\"\n and ksArchState[wp]: \"\\s. P (ksArchState s)\"\ncrunches insertNewCap\n for ksInterrupt[wp]: \"\\s. P (ksInterruptState s)\"\n and norq[wp]: \"\\s. P (ksReadyQueues s)\"\n and ksIdleThread[wp]: \"\\s. P (ksIdleThread s)\"\n and ksDomSchedule[wp]: \"\\s. P (ksDomSchedule s)\"\n and ksCurDomain[wp]: \"\\s. P (ksCurDomain s)\"\n and ksCurThread[wp]: \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps)\ncrunch nosch[wp]: insertNewCaps \"\\s. P (ksSchedulerAction s)\"\n (simp: crunch_simps zipWithM_x_mapM wp: crunch_wps)\n\n\ncrunch exst[wp]: set_cdt \"\\s. P (exst s)\"\n\n(*FIXME: Move to StateRelation*)\nlemma state_relation_schact[elim!]:\n \"(s,s') \\ state_relation \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\"\n apply (simp add: state_relation_def)\n done\n\nlemma state_relation_queues[elim!]: \"(s,s') \\ state_relation \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\"\n apply (simp add: state_relation_def)\n done\n\nlemma set_original_symb_exec_l:\n \"corres_underlying {(s, s'). f (kheap s) (exst s) s'} nf nf' dc P P' (set_original p b) (return x)\"\n by (simp add: corres_underlying_def return_def set_original_def in_monad Bex_def)\n\nlemma set_cdt_symb_exec_l:\n \"corres_underlying {(s, s'). f (kheap s) (exst s) s'} nf nf' dc P P' (set_cdt g) (return x)\"\n by (simp add: corres_underlying_def return_def set_cdt_def in_monad Bex_def)\n\ncrunch domain_index[wp]: create_cap_ext \"\\s. P (domain_index s)\"\ncrunch work_units_completed[wp]: create_cap_ext \"\\s. P (work_units_completed s)\"\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma updateNewFreeIndex_noop_psp_corres:\n \"corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True\n dc \\ (cte_at' slot)\n (return ()) (updateNewFreeIndex slot)\"\n apply (simp add: updateNewFreeIndex_def)\n apply (rule corres_guard_imp)\n apply (rule corres_bind_return2)\n apply (rule corres_symb_exec_r_conj[where P'=\"cte_at' slot\"])\n apply (rule corres_trivial, simp)\n apply (wp getCTE_wp' | wpc\n | simp add: updateTrackedFreeIndex_def getSlotCap_def)+\n done\n\nlemma insertNewCap_corres:\nnotes if_cong[cong del] if_weak_cong[cong]\nshows\n \"\\ cref' = cte_map (fst tup)\n \\ cap_relation (default_cap tp (snd tup) sz d) cap \\ \\\n corres dc\n (cte_wp_at ((=) cap.NullCap) (fst tup) and pspace_aligned\n and pspace_distinct and valid_objs and valid_mdb and valid_list\n and cte_wp_at ((\\) cap.NullCap) p)\n (cte_wp_at' (\\c. cteCap c = NullCap) cref' and\n cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\ sameRegionAs (cteCap cte) cap) (cte_map p)\n and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs'\n and (\\s. descendants_range' cap (cte_map p) (ctes_of s)))\n (create_cap tp sz p d tup)\n (insertNewCap (cte_map p) cref' cap)\"\n apply (cases tup,\n clarsimp simp add: create_cap_def insertNewCap_def\n liftM_def)\n apply (rule corres_symb_exec_r [OF _ getCTE_sp])+\n prefer 3\n apply (rule no_fail_pre, wp)\n apply (clarsimp elim!: cte_wp_at_weakenE')\n prefer 4\n apply (rule no_fail_pre, wp)\n apply (clarsimp elim!: cte_wp_at_weakenE')\n apply (rule corres_assert_assume)\n prefer 2\n apply (case_tac oldCTE)\n apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def\n valid_nullcaps_def)\n apply (erule allE)+\n apply (erule (1) impE)\n apply (simp add: initMDBNode_def)\n apply clarsimp\n apply (rule_tac F=\"capClass cap = PhysicalClass\" in corres_req)\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n apply (drule sameRegionAs_classes, simp)\n apply (rule corres_caps_decomposition)\n prefer 3\n apply wp+\n apply (rule hoare_post_imp, simp)\n apply (wp | assumption)+\n defer\n apply ((wp | simp)+)[1]\n apply (simp add: create_cap_ext_def set_cdt_list_def update_cdt_list_def bind_assoc)\n apply ((wp | simp)+)[1]\n apply (wp updateMDB_ctes_of_cases\n | simp add: o_def split del: if_split)+\n apply (clarsimp simp: cdt_relation_def cte_wp_at_ctes_of\n split del: if_split cong: if_cong simp del: id_apply)\n apply (subst if_not_P, erule(1) valid_mdbD3')\n apply (case_tac x, case_tac oldCTE)\n apply (subst bluhr_descendants_of')\n apply (rule mdb_insert_again_child.intro)\n apply (rule mdb_insert_again.intro)\n apply (rule mdb_ptr.intro)\n apply (simp add: valid_mdb'_def vmdb_def)\n apply (rule mdb_ptr_axioms.intro)\n apply simp\n apply (rule mdb_ptr.intro)\n apply (simp add: valid_mdb'_def vmdb_def)\n apply (rule mdb_ptr_axioms.intro)\n apply fastforce\n apply (rule mdb_insert_again_axioms.intro)\n apply (clarsimp simp: nullPointer_def)+\n apply (erule (1) ctes_of_valid_cap')\n apply (simp add: valid_mdb'_def valid_mdb_ctes_def)\n apply clarsimp\n apply (rule mdb_insert_again_child_axioms.intro)\n apply (clarsimp simp: isMDBParentOf_def)\n apply (clarsimp simp: isCap_simps)\n apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def\n ut_revocable'_def)\n apply (fold fun_upd_def)\n apply (subst descendants_of_insert_child')\n apply (erule(1) mdb_Null_descendants)\n apply (clarsimp simp: cte_wp_at_def)\n apply (erule(1) mdb_Null_None)\n apply (subgoal_tac \"cte_at (aa, bb) s\")\n prefer 2\n apply (drule not_sym, clarsimp simp: cte_wp_at_caps_of_state split: if_split_asm)\n apply (subst descendants_of_eq' [OF _ cte_wp_at_cte_at], assumption+)\n apply (clarsimp simp: state_relation_def)\n apply assumption+\n apply (subst cte_map_eq_subst [OF _ cte_wp_at_cte_at], assumption+)\n apply (simp add: mdb_relation_simp)\n defer\n apply (clarsimp split del: if_split)+\n apply (clarsimp simp add: revokable_relation_def cte_wp_at_ctes_of\n split del: if_split)\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply (elim modify_map_casesE)\n apply ((clarsimp split: if_split_asm cong: conj_cong\n simp: cte_map_eq_subst cte_wp_at_cte_at\n revokable_relation_simp)+)[4]\n apply clarsimp\n apply (subgoal_tac \"null_filter (caps_of_state s) (aa, bb) \\ None\")\n prefer 2\n apply (clarsimp simp: null_filter_def cte_wp_at_caps_of_state split: if_split_asm)\n apply (subgoal_tac \"cte_at (aa,bb) s\")\n prefer 2\n apply clarsimp\n apply (drule null_filter_caps_of_stateD)\n apply (erule cte_wp_cte_at)\n apply (elim modify_map_casesE)\n apply (clarsimp split: if_split_asm cong: conj_cong\n simp: cte_map_eq_subst cte_wp_at_cte_at revokable_relation_simp)+\n apply (clarsimp simp: state_relation_def ghost_relation_of_heap)+\n apply wp+\n apply (rule corres_guard_imp)\n apply (rule corres_underlying_symb_exec_l [OF gets_symb_exec_l])\n apply (rule corres_underlying_symb_exec_l [OF gets_symb_exec_l])\n apply (rule corres_underlying_symb_exec_l [OF set_cdt_symb_exec_l])\n apply (rule corres_underlying_symb_exec_l [OF do_ext_op_update_cdt_list_symb_exec_l'])\n apply (rule corres_underlying_symb_exec_l [OF set_original_symb_exec_l])\n apply (rule corres_cong[OF refl refl _ refl refl, THEN iffD1])\n apply (rule bind_return[THEN fun_cong])\n apply (rule corres_split)\n apply (rule setCTE_corres; simp)\n apply (subst bind_return[symmetric],\n rule corres_split)\n apply (simp add: dc_def[symmetric])\n apply (rule updateMDB_symb_exec_r)\n apply (simp add: dc_def[symmetric])\n apply (rule corres_split_noop_rhs[OF updateMDB_symb_exec_r])\n apply (rule updateNewFreeIndex_noop_psp_corres)\n apply (wp getCTE_wp set_cdt_valid_objs set_cdt_cte_at\n hoare_weak_lift_imp | simp add: o_def)+\n apply (clarsimp simp: cte_wp_at_cte_at)\n apply (clarsimp simp: cte_wp_at_ctes_of no_0_def valid_mdb'_def\n valid_mdb_ctes_def)\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (erule (2) valid_dlistEn)\n apply simp\n apply(simp only: cdt_list_relation_def valid_mdb_def2)\n apply(subgoal_tac \"finite_depth (cdt s)\")\n prefer 2\n apply(simp add: finite_depth valid_mdb_def2[symmetric])\n apply(intro impI allI)\n apply(subgoal_tac \"mdb_insert_abs (cdt s) p (a, b)\")\n prefer 2\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(rule mdb_insert_abs.intro)\n apply(clarsimp)\n apply(erule (1) mdb_cte_at_Null_None)\n apply (erule (1) mdb_cte_at_Null_descendants)\n apply(subgoal_tac \"no_0 (ctes_of s')\")\n prefer 2\n apply(simp add: valid_mdb_ctes_def valid_mdb'_def)\n apply simp\n apply (elim conjE)\n apply (case_tac \"cdt s (a,b)\")\n prefer 2\n apply (simp add: mdb_insert_abs_def)\n apply simp\n apply(case_tac x)\n apply(simp add: cte_wp_at_ctes_of)\n apply(simp add: mdb_insert_abs.next_slot split del: if_split)\n apply(case_tac \"c=p\")\n apply(simp)\n apply(clarsimp simp: modify_map_def)\n apply(case_tac z)\n apply(fastforce split: if_split_asm)\n apply(case_tac \"c = (a, b)\")\n apply(simp)\n apply(case_tac \"next_slot p (cdt_list s) (cdt s)\")\n apply(simp)\n apply(simp)\n apply(clarsimp simp: modify_map_def const_def)\n apply(clarsimp split: if_split_asm)\n apply(drule_tac p=\"cte_map p\" in valid_mdbD1')\n apply(simp)\n apply(simp add: valid_mdb'_def valid_mdb_ctes_def)\n apply(clarsimp simp: nullPointer_def no_0_def)\n apply(clarsimp simp: state_relation_def)\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(drule_tac slot=p in pspace_relation_ctes_ofI)\n apply(simp add: cte_wp_at_caps_of_state)\n apply(simp)\n apply(simp)\n apply(simp)\n apply(clarsimp simp: state_relation_def cdt_list_relation_def)\n apply(erule_tac x=\"fst p\" in allE, erule_tac x=\"snd p\" in allE)\n apply(fastforce)\n apply(simp)\n apply(case_tac \"next_slot c (cdt_list s) (cdt s)\")\n apply(simp)\n apply(simp)\n apply(subgoal_tac \"cte_at c s\")\n prefer 2\n apply(rule cte_at_next_slot)\n apply(simp_all add: valid_mdb_def2)[4]\n apply(clarsimp simp: modify_map_def const_def)\n apply(simp split: if_split_asm)\n apply(simp add: valid_mdb'_def)\n apply(drule_tac ptr=\"cte_map p\" in no_self_loop_next)\n apply(simp)\n apply(simp)\n apply(drule_tac p=\"(aa, bb)\" in cte_map_inj)\n apply(simp_all add: cte_wp_at_caps_of_state)[5]\n apply(clarsimp)\n apply(simp)\n apply(clarsimp)\n apply(drule cte_map_inj_eq; simp add: cte_wp_at_caps_of_state)\n apply(clarsimp)\n apply(case_tac z)\n apply(clarsimp simp: state_relation_def cdt_list_relation_def)\n apply(erule_tac x=aa in allE, erule_tac x=bb in allE)\n apply(fastforce)\n apply(clarsimp)\n apply(drule cte_map_inj_eq)\n apply(simp_all add: cte_wp_at_caps_of_state)[6]\n apply(clarsimp simp: state_relation_def cdt_list_relation_def)\n apply(erule_tac x=aa in allE, erule_tac x=bb in allE, fastforce)\n done\n\nlemma insertNewCap_more_wps[wp]:\n \"\\pspace_canonical'\\ insertNewCap parent slot cap \\\\rv. pspace_canonical'\\\"\n \"\\pspace_in_kernel_mappings'\\ insertNewCap parent slot cap \\\\rv. pspace_in_kernel_mappings'\\\"\n by (wpsimp simp: insertNewCap_def o_def wp: hoare_drop_imps)+\n\ndefinition apitype_of :: \"cap \\ apiobject_type option\"\nwhere\n \"apitype_of c \\ case c of\n Structures_A.UntypedCap d p b idx \\ Some ArchTypes_H.Untyped\n | Structures_A.EndpointCap r badge rights \\ Some EndpointObject\n | Structures_A.NotificationCap r badge rights \\ Some NotificationObject\n | Structures_A.CNodeCap r bits guard \\ Some ArchTypes_H.CapTableObject\n | Structures_A.ThreadCap r \\ Some TCBObject\n | _ \\ None\"\n\nlemma cte_wp_at_cteCaps_of:\n \"cte_wp_at' (\\cte. P (cteCap cte)) p s\n = (\\cap. cteCaps_of s p = Some cap \\ P cap)\"\n apply (subst tree_cte_cteCap_eq[unfolded o_def])\n apply (clarsimp split: option.splits)\n done\n\nlemma caps_contained_modify_mdb_helper[simp]:\n \"(\\n. modify_map m p (cteMDBNode_update f) x = Some (CTE c n))\n = (\\n. m x = Some (CTE c n))\"\n apply (cases \"m p\", simp_all add: modify_map_def)\n apply (case_tac a, simp_all)\n done\n\nlemma sameRegionAs_capRange_subset:\n \"\\ sameRegionAs c c'; capClass c = PhysicalClass \\ \\ capRange c' \\ capRange c\"\n apply (erule sameRegionAsE)\n apply (rule equalityD1)\n apply (rule master_eqI, rule capRange_Master)\n apply simp\n apply assumption+\n apply (clarsimp simp: isCap_simps)+\n done\n\n\ndefinition\n is_end_chunk :: \"cte_heap \\ capability \\ machine_word \\ bool\"\nwhere\n \"is_end_chunk ctes cap p \\ \\p'. ctes \\ p \\ p'\n \\ (\\cte. ctes p = Some cte \\ sameRegionAs cap (cteCap cte))\n \\ (\\cte'. ctes p' = Some cte' \\ \\ sameRegionAs cap (cteCap cte'))\"\n\ndefinition\n mdb_chunked2 :: \"cte_heap \\ bool\"\nwhere\n \"mdb_chunked2 ctes \\ (\\x p p' cte. ctes x = Some cte\n \\ is_end_chunk ctes (cteCap cte) p \\ is_end_chunk ctes (cteCap cte) p'\n \\ p = p')\n \\ (\\p p' cte cte'. ctes p = Some cte \\ ctes p' = Some cte'\n \\ ctes \\ p \\ p' \\ sameRegionAs (cteCap cte') (cteCap cte)\n \\ sameRegionAs (cteCap cte) (cteCap cte'))\"\n\nlemma mdb_chunked2_revD:\n \"\\ ctes p = Some cte; ctes p' = Some cte'; ctes \\ p \\ p';\n mdb_chunked2 ctes; sameRegionAs (cteCap cte') (cteCap cte) \\\n \\ sameRegionAs (cteCap cte) (cteCap cte')\"\n by (fastforce simp add: mdb_chunked2_def)\n\nlemma valid_dlist_step_back:\n \"\\ ctes \\ p \\ p''; ctes \\ p' \\ p''; valid_dlist ctes; p'' \\ 0 \\\n \\ p = p'\"\n apply (simp add: mdb_next_unfold valid_dlist_def)\n apply (frule_tac x=p in spec)\n apply (drule_tac x=p' in spec)\n apply (clarsimp simp: Let_def)\n done\n\nlemma chunk_sameRegionAs_step1:\n \"\\ ctes \\ p' \\\\<^sup>* p''; ctes p'' = Some cte;\n is_chunk ctes (cteCap cte) p p'';\n mdb_chunked2 ctes; valid_dlist ctes \\ \\\n \\cte'. ctes p' = Some cte'\n \\ ctes \\ p \\\\<^sup>+ p'\n \\ sameRegionAs (cteCap cte') (cteCap cte)\"\n apply (erule converse_rtrancl_induct)\n apply (clarsimp simp: is_chunk_def)\n apply (drule_tac x=p'' in spec, clarsimp)\n apply (clarsimp simp: is_chunk_def)\n apply (frule_tac x=y in spec)\n apply (drule_tac x=z in spec)\n apply ((drule mp, erule(1) transitive_closure_trans)\n | clarsimp)+\n apply (rule sameRegionAs_trans[rotated], assumption)\n apply (drule(3) mdb_chunked2_revD)\n apply simp\n apply (erule(1) sameRegionAs_trans)\n apply simp\n done\n\nend\nlocale mdb_insert_again_all = mdb_insert_again_child +\n assumes valid_c': \"s \\' c'\"\n\n fixes n'\n defines \"n' \\ modify_map n (mdbNext parent_node) (cteMDBNode_update (mdbPrev_update (\\a. site)))\"\nbegin\ninterpretation Arch . (*FIXME: arch_split*)\nlemma no_0_n' [simp]: \"no_0 n'\"\n using no_0_n by (simp add: n'_def)\n\nlemma dom_n' [simp]: \"dom n' = dom n\"\n apply (simp add: n'_def)\n apply (simp add: modify_map_if dom_def)\n apply (rule set_eqI)\n apply simp\n apply (rule iffI)\n apply auto[1]\n apply clarsimp\n apply (case_tac y)\n apply (case_tac \"mdbNext parent_node = x\")\n apply auto\n done\n\nlemma mdb_chain_0_n' [simp]: \"mdb_chain_0 n'\"\n using chain_n\n apply (simp add: mdb_chain_0_def)\n apply (simp add: n'_def trancl_prev_update)\n done\n\nlemma parency_n':\n \"n' \\ p \\ p' = (if m \\ p \\ parent \\ p = parent\n then m \\ p \\ p' \\ p' = site\n else m \\ p \\ p')\"\n using descendants [of p]\n unfolding descendants_of'_def\n by (auto simp add: set_eq_iff n'_def)\n\nlemma n'_direct_eq:\n \"n' \\ p \\ p' = (if p = parent then p' = site else\n if p = site then m \\ parent \\ p'\n else m \\ p \\ p')\"\n by (simp add: n'_def n_direct_eq)\n\nlemma n'_tranclD:\n \"n' \\ p \\\\<^sup>+ p' \\\n (if p = site then m \\ parent \\\\<^sup>+ p'\n else if m \\ p \\\\<^sup>+ parent \\ p = parent then m \\ p \\\\<^sup>+ p' \\ p' = site\n else m \\ p \\\\<^sup>+ p')\"\n apply (erule trancl_induct)\n apply (fastforce simp: n'_direct_eq split: if_split_asm)\n apply (fastforce simp: n'_direct_eq split: if_split_asm elim: trancl_trans)\n done\n\nlemma site_in_dom: \"site \\ dom n\"\n by (simp add: n)\n\nlemma m_tranclD:\n assumes m: \"m \\ p \\\\<^sup>+ p'\"\n shows \"p' \\ site \\ n' \\ p \\\\<^sup>+ p'\"\nproof -\n from m have \"p = site \\ p' = 0\" by clarsimp\n with mdb_chain_0_n' m\n show ?thesis\n apply -\n apply (erule trancl_induct)\n apply (rule context_conjI)\n apply clarsimp\n apply (cases \"p = site\")\n apply (simp add: mdb_chain_0_def site_in_dom)\n apply (cases \"p = parent\")\n apply simp\n apply (rule trancl_trans)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (rule context_conjI)\n apply clarsimp\n apply clarsimp\n apply (erule trancl_trans)\n apply (case_tac \"y = parent\")\n apply simp\n apply (rule trancl_trans)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n done\nqed\n\nlemma n'_trancl_eq:\n \"n' \\ p \\\\<^sup>+ p' =\n (if p = site then m \\ parent \\\\<^sup>+ p'\n else if m \\ p \\\\<^sup>+ parent \\ p = parent then m \\ p \\\\<^sup>+ p' \\ p' = site\n else m \\ p \\\\<^sup>+ p')\"\n apply simp\n apply (intro conjI impI iffI)\n apply (drule n'_tranclD)\n apply simp\n apply simp\n apply (drule n'_tranclD)\n apply simp\n apply (erule disjE)\n apply (drule m_tranclD)+\n apply simp\n apply (drule m_tranclD)\n apply simp\n apply (erule trancl_trans)\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (drule n'_tranclD, simp)\n apply (erule disjE)\n apply (drule m_tranclD)\n apply simp\n apply simp\n apply (rule r_into_trancl)\n apply (simp add: n'_direct_eq)\n apply (drule n'_tranclD, simp)\n apply simp\n apply (cases \"p' = site\", simp)\n apply (drule m_tranclD)\n apply clarsimp\n apply (drule tranclD)\n apply (clarsimp simp: n'_direct_eq)\n apply (simp add: rtrancl_eq_or_trancl)\n apply (drule n'_tranclD, simp)\n apply clarsimp\n apply (drule m_tranclD, simp)\n done\n\nlemma n'_rtrancl_eq:\n \"n' \\ p \\\\<^sup>* p' =\n (if p = site then p' \\ site \\ m \\ parent \\\\<^sup>+ p' \\ p' = site\n else if m \\ p \\\\<^sup>* parent then m \\ p \\\\<^sup>* p' \\ p' = site\n else m \\ p \\\\<^sup>* p')\"\n by (auto simp: rtrancl_eq_or_trancl n'_trancl_eq)\n\nlemma mdbNext_parent_site [simp]:\n \"mdbNext parent_node \\ site\"\nproof\n assume \"mdbNext parent_node = site\"\n hence \"m \\ parent \\ site\"\n using parent\n by (unfold mdb_next_unfold) simp\n thus False by simp\nqed\n\nlemma mdbPrev_parent_site [simp]:\n \"site \\ mdbPrev parent_node\"\nproof\n assume \"site = mdbPrev parent_node\"\n with parent site\n have \"m \\ site \\ parent\"\n apply (unfold mdb_next_unfold)\n apply simp\n apply (erule dlistEp)\n apply clarsimp\n apply clarsimp\n done\n with p_0 show False by simp\nqed\n\nlemma parent_prev:\n \"(m \\ parent \\ p) = (p = mdbNext parent_node \\ p \\ 0)\"\n apply (rule iffI)\n apply (frule dlist_prevD, rule parent)\n apply (simp add: mdb_next_unfold parent)\n apply (clarsimp simp: mdb_prev_def)\n apply clarsimp\n apply (rule dlist_nextD0)\n apply (rule parent_next)\n apply assumption\n done\n\nlemma parent_next_prev:\n \"(m \\ p \\ mdbNext parent_node) = (p = parent \\ mdbNext parent_node \\ 0)\"\n using parent\n apply -\n apply (rule iffI)\n apply (clarsimp simp add: mdb_prev_def)\n apply (rule conjI)\n apply (erule dlistEn)\n apply clarsimp\n apply simp\n apply clarsimp\n apply clarsimp\n apply (rule dlist_nextD0)\n apply (rule parent_next)\n apply assumption\n done\n\n\nlemma n'_prev_eq:\n notes if_cong[cong del] if_weak_cong[cong]\n shows \"n' \\ p \\ p' = (if p' = site then p = parent\n else if p = site then m \\ parent \\ p'\n else if p = parent then p' = site\n else m \\ p \\ p')\"\n using parent site site_prev\n apply (simp add: n'_def n mdb_prev_def new_parent_def new_site_def split del: if_split)\n apply (clarsimp simp add: modify_map_if cong: if_cong split del: if_split)\n apply (cases \"p' = site\", simp)\n apply (simp cong: if_cong split del: if_split)\n apply (cases \"p' = parent\")\n apply clarsimp\n apply (rule conjI, clarsimp simp: mdb_prev_def)\n apply (clarsimp simp: mdb_prev_def)\n apply (simp cong: if_cong split del: if_split)\n apply (cases \"p = site\")\n apply (simp add: parent_prev)\n apply (cases \"mdbNext parent_node = p'\")\n apply simp\n apply (rule iffI)\n prefer 2\n apply clarsimp\n apply (erule dlistEn)\n apply simp\n apply clarsimp\n apply (case_tac cte')\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply (insert site_next)[1]\n apply (rule valid_dlistEp [OF dlist, where p=p'], assumption)\n apply clarsimp\n apply clarsimp\n apply (simp cong: if_cong split del: if_split)\n apply (cases \"p = parent\")\n apply clarsimp\n apply (insert site_next)\n apply (cases \"mdbNext parent_node = p'\", clarsimp)\n apply clarsimp\n apply (rule valid_dlistEp [OF dlist, where p=p'], assumption)\n apply clarsimp\n apply clarsimp\n apply simp\n apply (cases \"mdbNext parent_node = p'\")\n prefer 2\n apply (clarsimp simp: mdb_prev_def)\n apply (rule iffI, clarsimp)\n apply clarsimp\n apply (case_tac z)\n apply simp\n apply (rule iffI)\n apply (clarsimp simp: mdb_prev_def)\n apply (drule sym [where t=p'])\n apply (simp add: parent_next_prev)\n done\n\nlemma dlist_n' [simp]:\n notes if_cong[cong del] if_weak_cong[cong]\n shows \"valid_dlist n'\"\n using no_0_n'\n by (clarsimp simp: valid_dlist_def2 n'_direct_eq\n n'_prev_eq Invariants_H.valid_dlist_prevD [OF dlist])\n\nlemma n'_cap:\n \"n' p = Some (CTE c node) \\\n if p = site then c = c' \\ m p = Some (CTE NullCap site_node)\n else \\node'. m p = Some (CTE c node')\"\n by (auto simp: n'_def n modify_map_if new_parent_def parent\n new_site_def site site_cap split: if_split_asm)\n\nlemma m_cap:\n \"m p = Some (CTE c node) \\\n if p = site\n then \\node'. n' site = Some (CTE c' node')\n else \\node'. n' p = Some (CTE c node')\"\n by (clarsimp simp: n n'_def new_parent_def new_site_def parent)\n\nlemma n'_badged:\n \"n' p = Some (CTE c node) \\\n if p = site then c = c' \\ mdbFirstBadged node\n else \\node'. m p = Some (CTE c node') \\ mdbFirstBadged node = mdbFirstBadged node'\"\n by (auto simp: n'_def n modify_map_if new_parent_def parent\n new_site_def site site_cap split: if_split_asm)\n\nlemma no_next_region:\n \"\\ m \\ parent \\ p'; m p' = Some (CTE cap' node) \\ \\ \\sameRegionAs c' cap'\"\n apply (clarsimp simp: mdb_next_unfold parent)\n apply (frule next_wont_bite [rotated], clarsimp)\n apply simp\n done\n\nlemma valid_badges_n' [simp]: \"valid_badges n'\"\n using valid_badges\n apply (clarsimp simp: valid_badges_def)\n apply (simp add: n'_direct_eq)\n apply (drule n'_badged)+\n apply (clarsimp split: if_split_asm)\n apply (drule (1) no_next_region)\n apply simp\n apply (erule_tac x=p in allE)\n apply (erule_tac x=p' in allE)\n apply simp\n done\n\nlemma c'_not_Null: \"c' \\ NullCap\"\n using same_region by clarsimp\n\nlemma valid_nullcaps_n' [simp]:\n \"valid_nullcaps n'\"\n using nullcaps is_untyped c'_not_Null\n apply (clarsimp simp: valid_nullcaps_def n'_def n modify_map_if new_site_def\n new_parent_def isCap_simps)\n apply (erule allE)+\n apply (erule (1) impE)\n apply (simp add: nullMDBNode_def)\n apply (insert parent)\n apply (rule dlistEn, rule parent)\n apply clarsimp\n apply (clarsimp simp: nullPointer_def)\n done\n\nlemma phys': \"capClass parent_cap = PhysicalClass\"\n using sameRegionAs_classes [OF same_region] phys\n by simp\n\nlemma capRange_c': \"capRange c' \\ capRange parent_cap\"\n apply (rule sameRegionAs_capRange_subset)\n apply (rule same_region)\n apply (rule phys')\n done\n\nlemma untypedRange_c':\n assumes ut: \"isUntypedCap c'\"\n shows \"untypedRange c' \\ untypedRange parent_cap\"\n using ut is_untyped capRange_c'\n by (auto simp: isCap_simps)\n\nlemma sameRegion_parentI:\n \"sameRegionAs c' cap \\ sameRegionAs parent_cap cap\"\n using same_region\n apply -\n apply (erule (1) sameRegionAs_trans)\n done\n\nlemma no_loops_n': \"no_loops n'\"\n using mdb_chain_0_n' no_0_n'\n by (rule mdb_chain_0_no_loops)\n\nlemmas no_loops_simps' [simp]=\n no_loops_trancl_simp [OF no_loops_n']\n no_loops_direct_simp [OF no_loops_n']\n\nlemma rangeD:\n \"\\ m \\ parent \\ p; m p = Some (CTE cap node) \\ \\\n capRange cap \\ capRange c' = {}\"\n using range by (rule descendants_rangeD')\n\nlemma capAligned_c': \"capAligned c'\"\n using valid_c' by (rule valid_capAligned)\n\nlemma capRange_ut:\n \"capRange c' \\ untypedRange parent_cap\"\n using capRange_c' is_untyped\n by (clarsimp simp: isCap_simps del: subsetI)\n\nlemma untyped_mdb_n' [simp]: \"untyped_mdb' n'\"\n using untyped_mdb capRange_ut untyped_inc\n apply (clarsimp simp: untyped_mdb'_def descendants_of'_def)\n apply (drule n'_cap)+\n apply (simp add: parency_n')\n apply (simp split: if_split_asm)\n apply clarsimp\n apply (erule_tac x=parent in allE)\n apply (simp add: parent is_untyped)\n apply (erule_tac x=p' in allE)\n apply simp\n apply (frule untypedCapRange)\n apply (drule untypedRange_c')\n apply (erule impE, blast)\n apply (drule (1) rangeD)\n apply simp\n apply clarsimp\n apply (thin_tac \"All P\" for P)\n apply (simp add: untyped_inc'_def)\n apply (erule_tac x=parent in allE)\n apply (erule_tac x=p in allE)\n apply (simp add: parent is_untyped)\n apply (clarsimp simp: descendants_of'_def)\n apply (case_tac \"untypedRange parent_cap = untypedRange c\")\n apply simp\n apply (elim disjE conjE)\n apply (drule (1) rangeD)\n apply (drule untypedCapRange)\n apply simp\n apply blast\n apply simp\n apply (erule disjE)\n apply clarsimp\n apply (erule disjE)\n apply (simp add: psubsetI)\n apply (elim conjE)\n apply (drule (1) rangeD)\n apply (drule untypedCapRange)\n apply simp\n apply blast\n apply blast\n apply clarsimp\n done\n\nlemma site':\n \"n' site = Some new_site\"\n by (simp add: n n'_def modify_map_if new_site_def)\n\nlemma loopE: \"m \\ x \\\\<^sup>+ x \\ P\"\n by simp\n\nlemma m_loop_trancl_rtrancl:\n \"m \\ y \\\\<^sup>* x \\ \\ m \\ x \\\\<^sup>+ y\"\n apply clarsimp\n apply (drule(1) transitive_closure_trans)\n apply (erule loopE)\n done\n\nlemma m_rtrancl_to_site:\n \"m \\ p \\\\<^sup>* site = (p = site)\"\n apply (rule iffI)\n apply (erule rtranclE)\n apply assumption\n apply simp\n apply simp\n done\n\nlemma descendants_of'_D: \"p' \\ descendants_of' p ctes \\ ctes \\ p \\ p' \"\n by (clarsimp simp:descendants_of'_def)\n\nlemma untyped_inc_mdbD:\n \"\\ sameRegionAs cap cap'; isUntypedCap cap;\n ctes p = Some (CTE cap node); ctes p' = Some (CTE cap' node');\n untyped_inc' ctes; untyped_mdb' ctes; no_loops ctes \\\n \\ ctes \\ p \\ p' \\ p = p' \\\n (isUntypedCap cap' \\ untypedRange cap \\ untypedRange cap'\n \\ sameRegionAs cap' cap\n \\ ctes \\ p' \\ p)\"\n apply (subgoal_tac \"untypedRange cap \\ untypedRange cap' \\ sameRegionAs cap' cap\")\n apply (cases \"isUntypedCap cap'\")\n apply (drule(4) untyped_incD'[where p=p and p'=p'])\n apply (erule sameRegionAsE, simp_all add: untypedCapRange)[1]\n apply (cases \"untypedRange cap = untypedRange cap'\")\n apply simp\n apply (elim disjE conjE)\n apply (simp only: simp_thms descendants_of'_D)+\n apply (elim disjE conjE)\n apply (simp add: subset_iff_psubset_eq)\n apply (elim disjE)\n apply (simp add:descendants_of'_D)+\n apply (clarsimp simp:descendants_of'_def)\n apply (clarsimp simp: isCap_simps)\n apply clarsimp\n apply (erule sameRegionAsE)\n apply simp\n apply (drule(1) untyped_mdbD',simp)\n apply (simp add:untypedCapRange)\n apply blast\n apply simp\n apply assumption\n apply (simp add:descendants_of'_def)\n apply (clarsimp simp:isCap_simps)\n apply (clarsimp simp:isCap_simps)\n apply (clarsimp simp add: sameRegionAs_def3 del: disjCI)\n apply (rule disjI1)\n apply (erule disjE)\n apply (intro conjI)\n apply blast\n apply (simp add:untypedCapRange)\n apply (erule subset_trans[OF _ untypedRange_in_capRange])\n apply clarsimp\n apply (rule untypedRange_not_emptyD)\n apply (simp add:untypedCapRange)\n apply blast\n apply (clarsimp simp:isCap_simps)\n done\n\nlemma parent_chunk:\n \"is_chunk n' parent_cap parent site\"\n by (clarsimp simp: is_chunk_def\n n'_trancl_eq n'_rtrancl_eq site' new_site_def same_region\n m_loop_trancl_rtrancl m_rtrancl_to_site)\n\nlemma mdb_chunked_n' [simp]:\n notes if_cong[cong del] if_weak_cong[cong]\n shows \"mdb_chunked n'\"\n using chunked untyped_mdb untyped_inc\n apply (clarsimp simp: mdb_chunked_def)\n apply (drule n'_cap)+\n apply (simp add: n'_trancl_eq split del: if_split)\n apply (simp split: if_split_asm)\n apply clarsimp\n apply (frule sameRegion_parentI)\n apply (frule(1) untyped_inc_mdbD [OF _ is_untyped _ _ untyped_inc untyped_mdb no_loops, OF _ parent])\n apply (elim disjE)\n apply (frule sameRegionAs_capRange_Int)\n apply (simp add: phys)\n apply (rule valid_capAligned [OF valid_c'])\n apply (rule valid_capAligned)\n apply (erule valid_capI')\n apply (erule notE, erule(1) descendants_rangeD' [OF range, rotated])\n apply (clarsimp simp: parent parent_chunk)\n apply clarsimp\n apply (frule subtree_mdb_next)\n apply (simp add: m_loop_trancl_rtrancl [OF trancl_into_rtrancl, where x=parent])\n apply (case_tac \"p' = parent\")\n apply (clarsimp simp: parent)\n apply (drule_tac x=p' in spec)\n apply (drule_tac x=parent in spec)\n apply (frule sameRegionAs_trans [OF _ same_region])\n apply (clarsimp simp: parent is_chunk_def n'_trancl_eq n'_rtrancl_eq\n m_rtrancl_to_site site' new_site_def)\n apply (drule_tac x=p'' in spec)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap, clarsimp)\n apply clarsimp\n apply (erule_tac x=p in allE)\n apply (erule_tac x=parent in allE)\n apply (insert parent is_untyped)[1]\n apply simp\n apply (case_tac \"p = parent\")\n apply (simp add: parent)\n apply (clarsimp simp add: is_chunk_def)\n apply (simp add: rtrancl_eq_or_trancl)\n apply (erule disjE)\n apply (clarsimp simp: site' new_site_def)\n apply clarsimp\n apply (drule tranclD)\n apply (clarsimp simp: n'_direct_eq)\n apply (drule (1) transitive_closure_trans)\n apply simp\n apply simp\n apply (case_tac \"isUntypedCap cap\")\n prefer 2\n apply (simp add: untyped_mdb'_def)\n apply (erule_tac x=parent in allE)\n apply simp\n apply (erule_tac x=p in allE)\n apply (simp add: descendants_of'_def)\n apply (drule mp[where P=\"S \\ T \\ {}\" for S T])\n apply (frule sameRegionAs_capRange_Int, simp add: phys)\n apply (rule valid_capAligned, erule valid_capI')\n apply (rule valid_capAligned, rule valid_c')\n apply (insert capRange_ut)[1]\n apply blast\n apply (drule (1) rangeD)\n apply (drule capRange_sameRegionAs, rule valid_c')\n apply (simp add: phys)\n apply simp\n apply (case_tac \"untypedRange parent_cap \\ untypedRange cap\")\n apply (erule impE)\n apply (clarsimp simp only: isCap_simps untypedRange.simps)\n apply (subst (asm) range_subset_eq)\n apply (drule valid_capI')+\n apply (drule valid_capAligned)+\n apply (clarsimp simp: capAligned_def)\n apply (erule is_aligned_no_overflow)\n apply (simp(no_asm) add: sameRegionAs_def3 isCap_simps)\n apply (drule valid_capI')+\n apply (drule valid_capAligned)+\n apply (clarsimp simp: capAligned_def is_aligned_no_overflow)\n apply clarsimp\n apply (erule disjE)\n apply simp\n apply (rule conjI)\n prefer 2\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (clarsimp simp: is_chunk_def)\n apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm)\n apply (simp add: site' new_site_def)\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (simp add: rtrancl_eq_or_trancl)\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply clarsimp\n apply (clarsimp simp: is_chunk_def)\n apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm)\n apply (drule (1) transitive_closure_trans, erule loopE)\n apply (subgoal_tac \"m \\ p \\ parent\")\n apply (drule subtree_mdb_next)\n apply (drule (1) trancl_trans, erule loopE)\n apply (thin_tac \"All P\" for P)\n apply (drule_tac p=parent and p'=p in untyped_incD'[rotated], assumption+)\n apply simp\n apply (subgoal_tac \"\\ m \\ parent \\ p\")\n prefer 2\n apply clarsimp\n apply (drule (1) rangeD)\n apply (drule capRange_sameRegionAs, rule valid_c')\n apply (simp add: phys)\n apply simp\n apply (clarsimp simp: descendants_of'_def subset_iff_psubset_eq)\n apply (erule disjE,simp,simp)\n apply (drule_tac p=parent and p'=p in untyped_incD'[rotated], assumption+)\n apply (simp add:subset_iff_psubset_eq descendants_of'_def)\n apply (elim disjE conjE| simp )+\n apply (drule(1) rangeD)\n apply (drule capRange_sameRegionAs[OF _ valid_c'])\n apply (simp add:phys)+\n apply (insert capRange_c' is_untyped)[1]\n apply (simp add: untypedCapRange [symmetric])\n apply (drule(1) disjoint_subset)\n apply (drule capRange_sameRegionAs[OF _ valid_c'])\n apply (simp add:phys)\n apply (simp add:Int_ac)\n apply clarsimp\n apply (erule_tac x=p in allE)\n apply (erule_tac x=p' in allE)\n apply clarsimp\n apply (erule disjE)\n apply simp\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (subgoal_tac \"is_chunk n' cap p p'\")\n prefer 2\n apply (clarsimp simp: is_chunk_def)\n apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm)\n apply (erule disjE)\n apply (erule_tac x=parent in allE)\n apply clarsimp\n apply (erule impE, fastforce)\n apply (clarsimp simp: parent)\n apply (simp add: site' new_site_def)\n apply (erule sameRegionAs_trans, rule same_region)\n apply (clarsimp simp add: parent)\n apply (simp add: site' new_site_def)\n apply (rule same_region)\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI, clarsimp)\n apply (drule (1) trancl_trans, erule loopE)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply simp\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (subgoal_tac \"is_chunk n' cap' p' p\")\n prefer 2\n apply (clarsimp simp: is_chunk_def)\n apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm)\n apply (erule disjE)\n apply (erule_tac x=parent in allE)\n apply clarsimp\n apply (erule impE, fastforce)\n apply (clarsimp simp: parent)\n apply (simp add: site' new_site_def)\n apply (erule sameRegionAs_trans, rule same_region)\n apply (clarsimp simp add: parent)\n apply (simp add: site' new_site_def)\n apply (rule same_region)\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply (erule_tac x=p'' in allE)\n apply clarsimp\n apply (drule_tac p=p'' in m_cap)\n apply clarsimp\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI, clarsimp)\n apply (drule (1) trancl_trans, erule loopE)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (drule (1) trancl_trans, erule loopE)\n done\n\nlemma caps_contained_n' [simp]: \"caps_contained' n'\"\n using caps_contained untyped_mdb untyped_inc\n apply (clarsimp simp: caps_contained'_def)\n apply (drule n'_cap)+\n apply (clarsimp split: if_split_asm)\n apply (drule capRange_untyped)\n apply simp\n apply (frule capRange_untyped)\n apply (frule untypedRange_c')\n apply (erule_tac x=parent in allE)\n apply (erule_tac x=p' in allE)\n apply (simp add: parent)\n apply (erule impE, blast)\n apply (simp add: untyped_mdb'_def)\n apply (erule_tac x=parent in allE)\n apply (erule_tac x=p' in allE)\n apply (simp add: parent is_untyped descendants_of'_def)\n apply (erule impE)\n apply (thin_tac \"m site = t\" for t)\n apply (drule valid_capI')\n apply (frule valid_capAligned)\n apply blast\n apply (drule (1) rangeD)\n apply (frule capRange_untyped)\n apply (drule untypedCapRange)\n apply simp\n apply (thin_tac \"All P\" for P)\n apply (insert capRange_c')[1]\n apply (simp add: untypedCapRange is_untyped)\n apply (subgoal_tac \"untypedRange parent_cap \\ untypedRange c \\ {}\")\n prefer 2\n apply blast\n apply (frule untyped_incD'[OF _ capRange_untyped _ is_untyped])\n apply (case_tac c)\n apply simp_all\n apply (simp add:isCap_simps)\n apply (rule parent)\n apply clarsimp\n apply (case_tac \"untypedRange c = untypedRange parent_cap\")\n apply blast\n apply simp\n apply (elim disjE)\n apply (drule_tac A = \"untypedRange c\" in psubsetI)\n apply simp+\n apply (thin_tac \"P\\Q\" for P Q)\n apply (elim conjE)\n apply (simp add:descendants_of'_def)\n apply (drule(1) rangeD)\n apply (frule capRange_untyped)\n apply (simp add:untypedCapRange Int_ac)\n apply blast\n apply (simp add:descendants_of'_def)\n apply blast\n apply blast\n done\n\nlemma untyped_inc_n' [simp]: \"untypedRange c' \\ usableUntypedRange parent_cap = {} \\ untyped_inc' n'\"\n using untyped_inc\n apply (clarsimp simp: untyped_inc'_def)\n apply (drule n'_cap)+\n apply (clarsimp simp: descendants_of'_def parency_n' split: if_split_asm)\n apply (frule untypedRange_c')\n apply (insert parent is_untyped)[1]\n apply (erule_tac x=parent in allE)\n apply (erule_tac x=p' in allE)\n apply clarsimp\n apply (case_tac \"untypedRange parent_cap = untypedRange c'a\")\n apply simp\n apply (intro conjI)\n apply (intro impI)\n apply (elim disjE conjE)\n apply (drule(1) subtree_trans,simp)\n apply (simp add:subset_not_psubset)\n apply simp\n apply (clarsimp simp:subset_not_psubset)\n apply (drule valid_capI')+\n apply (drule(2) disjoint_subset[OF usableRange_subseteq[OF valid_capAligned],rotated -1])\n apply simp\n apply (clarsimp)\n apply (rule int_not_empty_subsetD)\n apply (drule(1) rangeD)\n apply (simp add:untypedCapRange Int_ac)\n apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']])\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply simp\n apply (erule subset_splitE)\n apply (simp|elim conjE)+\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply blast\n apply (simp|elim conjE)+\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (intro conjI,intro impI,drule(1) subtree_trans,simp)\n apply clarsimp\n apply (intro impI)\n apply (drule(1) rangeD)\n apply (simp add:untypedCapRange Int_ac)\n apply (rule int_not_empty_subsetD)\n apply (simp add:Int_ac)\n apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']])\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply simp\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (drule(1) disjoint_subset[rotated])\n apply simp\n apply (drule_tac B = \"untypedRange c'a\" in int_not_empty_subsetD)\n apply (erule aligned_untypedRange_non_empty[OF capAligned_c'])\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply simp\n apply (frule untypedRange_c')\n apply (insert parent is_untyped)[1]\n apply (erule_tac x=p in allE)\n apply (erule_tac x=parent in allE)\n apply clarsimp\n apply (case_tac \"untypedRange parent_cap = untypedRange c\")\n apply simp\n apply (intro conjI)\n apply (intro impI)\n apply (elim disjE conjE)\n apply (clarsimp simp:subset_not_psubset )+\n apply (drule(1) subtree_trans,simp)\n apply simp\n apply (clarsimp simp:subset_not_psubset)\n apply (drule disjoint_subset[OF usableRange_subseteq[OF valid_capAligned[OF valid_capI']],rotated])\n apply simp\n apply assumption\n apply simp\n apply clarsimp\n apply (rule int_not_empty_subsetD)\n apply (drule(1) rangeD)\n apply (simp add:untypedCapRange Int_ac)\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply (erule aligned_untypedRange_non_empty[OF capAligned_c'])\n apply simp\n apply (erule subset_splitE)\n apply (simp|elim conjE)+\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (intro conjI,intro impI,drule(1) subtree_trans,simp)\n apply clarsimp\n apply (intro impI)\n apply (drule(1) rangeD)\n apply (simp add:untypedCapRange Int_ac)\n apply (rule int_not_empty_subsetD)\n apply (simp add:Int_ac)\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']])\n apply simp\n apply (thin_tac \"P\\Q\" for P Q)+\n apply blast\n apply (thin_tac \"P\\Q\" for P Q)+\n apply simp\n apply (drule(1) disjoint_subset2[rotated])\n apply simp\n apply (drule_tac B = \"untypedRange c'\" in int_not_empty_subsetD)\n apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']])\n apply (erule aligned_untypedRange_non_empty[OF capAligned_c'])\n apply simp\n apply (erule_tac x=p in allE)\n apply (erule_tac x=p' in allE)\n apply simp\n apply blast\n done\n\nlemma ut_rev_n' [simp]: \"ut_revocable' n'\"\n using ut_rev\n apply (clarsimp simp: ut_revocable'_def n'_def n_def)\n apply (clarsimp simp: modify_map_if split: if_split_asm)\n done\n\nlemma class_links_m: \"class_links m\"\n using valid\n by (simp add: valid_mdb_ctes_def)\n\nlemma parent_phys: \"capClass parent_cap = PhysicalClass\"\n using is_untyped\n by (clarsimp simp: isCap_simps)\n\nlemma class_links [simp]: \"class_links n'\"\n using class_links_m\n apply (clarsimp simp add: class_links_def)\n apply (simp add: n'_direct_eq\n split: if_split_asm)\n apply (case_tac cte,\n clarsimp dest!: n'_cap simp: site' parent new_site_def phys parent_phys)\n apply (drule_tac x=parent in spec)\n apply (drule_tac x=p' in spec)\n apply (case_tac cte')\n apply (clarsimp simp: site' new_site_def parent parent_phys phys dest!: n'_cap\n split: if_split_asm)\n apply (case_tac cte, case_tac cte')\n apply (clarsimp dest!: n'_cap split: if_split_asm)\n apply fastforce\n done\n\nlemma irq_control_n' [simp]:\n \"irq_control n'\"\n using irq_control phys\n apply (clarsimp simp: irq_control_def)\n apply (clarsimp simp: n'_def n_def)\n apply (clarsimp simp: modify_map_if split: if_split_asm)\n done\n\nlemma dist_z_m:\n \"distinct_zombies m\"\n using valid by auto\n\nlemma dist_z [simp]:\n \"distinct_zombies n'\"\n using dist_z_m\n apply (simp add: n'_def distinct_zombies_nonCTE_modify_map)\n apply (simp add: n_def distinct_zombies_nonCTE_modify_map\n fun_upd_def[symmetric])\n apply (erule distinct_zombies_seperateE, simp)\n apply (case_tac cte, clarsimp)\n apply (rename_tac cap node)\n apply (subgoal_tac \"capRange cap \\ capRange c' \\ {}\")\n apply (frule untyped_mdbD' [OF _ _ _ _ _ untyped_mdb, OF parent])\n apply (simp add: is_untyped)\n apply (clarsimp simp add: untypedCapRange[OF is_untyped, symmetric])\n apply (drule disjoint_subset2 [OF capRange_c'])\n apply simp\n apply simp\n apply (simp add: descendants_of'_def)\n apply (drule(1) rangeD)\n apply simp\n apply (drule capAligned_capUntypedPtr [OF capAligned_c'])\n apply (frule valid_capAligned [OF valid_capI'])\n apply (drule(1) capAligned_capUntypedPtr)\n apply auto\n done\n\nlemma reply_masters_rvk_fb_m:\n \"reply_masters_rvk_fb m\"\n using valid by auto\n\nlemma reply_masters_rvk_fb_n[simp]:\n \"reply_masters_rvk_fb n'\"\n using reply_masters_rvk_fb_m\n apply (simp add: reply_masters_rvk_fb_def n'_def ball_ran_modify_map_eq\n n_def fun_upd_def[symmetric])\n apply (rule ball_ran_fun_updI, assumption)\n apply clarsimp\n done\n\nlemma valid_n':\n \"untypedRange c' \\ usableUntypedRange parent_cap = {} \\ valid_mdb_ctes n'\"\n by auto\n\nend\n\nlemma caps_overlap_reserved'_D:\n \"\\caps_overlap_reserved' S s; ctes_of s p = Some cte;isUntypedCap (cteCap cte)\\ \\ usableUntypedRange (cteCap cte) \\ S = {}\"\n apply (simp add:caps_overlap_reserved'_def)\n apply (erule ballE)\n apply (erule(2) impE)\n apply fastforce\n done\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\nlemma insertNewCap_valid_mdb:\n \"\\valid_mdb' and valid_objs' and K (slot \\ p) and\n caps_overlap_reserved' (untypedRange cap) and\n cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) cap) p and\n K (\\isZombie cap) and valid_cap' cap and\n (\\s. descendants_range' cap p (ctes_of s))\\\n insertNewCap p slot cap\n \\\\rv. valid_mdb'\\\"\n apply (clarsimp simp: insertNewCap_def valid_mdb'_def)\n apply (wp getCTE_ctes_of | simp add: o_def)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (rule conjI)\n apply (clarsimp simp: no_0_def valid_mdb_ctes_def)\n apply (case_tac cte)\n apply (rename_tac p_cap p_node)\n apply (clarsimp cong: if_cong)\n apply (case_tac ya)\n apply (rename_tac node)\n apply (clarsimp simp: nullPointer_def)\n apply (rule mdb_insert_again_all.valid_n')\n apply unfold_locales[1]\n apply (assumption|rule refl)+\n apply (frule sameRegionAs_classes, clarsimp simp: isCap_simps)\n apply (erule (1) ctes_of_valid_cap')\n apply (simp add: valid_mdb_ctes_def)\n apply simp\n apply (clarsimp simp: isMDBParentOf_CTE)\n apply (clarsimp simp: isCap_simps valid_mdb_ctes_def ut_revocable'_def)\n apply assumption\n apply (drule(1) caps_overlap_reserved'_D)\n apply simp\n apply (simp add:Int_ac)\n done\n\n(* FIXME: move *)\nlemma no_default_zombie:\n \"cap_relation (default_cap tp p sz d) cap \\ \\isZombie cap\"\n by (cases tp, auto simp: isCap_simps)\n\nlemmas updateNewFreeIndex_typ_ats[wp] = typ_at_lifts[OF updateNewFreeIndex_typ_at']\n\nlemma updateNewFreeIndex_valid_objs[wp]:\n \"\\valid_objs'\\ updateNewFreeIndex slot \\\\_. valid_objs'\\\"\n apply (simp add: updateNewFreeIndex_def getSlotCap_def)\n apply (wp getCTE_wp' | wpc | simp add: updateTrackedFreeIndex_def)+\n done\n\nlemma insertNewCap_valid_objs [wp]:\n \"\\ valid_objs' and valid_cap' cap and pspace_aligned' and pspace_distinct'\\\n insertNewCap parent slot cap\n \\\\_. valid_objs'\\\"\n apply (simp add: insertNewCap_def)\n apply (wp setCTE_valid_objs getCTE_wp')\n apply clarsimp\n done\n\nlemma insertNewCap_valid_cap [wp]:\n \"\\ valid_cap' c \\\n insertNewCap parent slot cap\n \\\\_. valid_cap' c\\\"\n apply (simp add: insertNewCap_def)\n apply (wp getCTE_wp')\n apply clarsimp\n done\n\nlemmas descendants_of'_mdbPrev = descendants_of_prev_update\n\nlemma insertNewCap_ranges:\n \"\\\\s. descendants_range' c p (ctes_of s) \\\n descendants_range' cap p (ctes_of s) \\\n capRange c \\ capRange cap = {} \\\n cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) cap) p s \\\n valid_mdb' s \\ valid_objs' s\\\n insertNewCap p slot cap\n \\\\_ s. descendants_range' c p (ctes_of s)\\\"\n apply (simp add: insertNewCap_def)\n apply (wp getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (rule conjI)\n apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def no_0_def)\n apply (case_tac ctea)\n apply (case_tac cteb)\n apply (clarsimp simp: nullPointer_def cong: if_cong)\n apply (simp (no_asm) add: descendants_range'_def descendants_of'_mdbPrev)\n apply (subst mdb_insert_again_child.descendants)\n apply unfold_locales[1]\n apply (simp add: valid_mdb'_def)\n apply (assumption|rule refl)+\n apply (frule sameRegionAs_classes, clarsimp simp: isCap_simps)\n apply (erule (1) ctes_of_valid_cap')\n apply (simp add: valid_mdb'_def valid_mdb_ctes_def)\n apply clarsimp\n apply (clarsimp simp: isMDBParentOf_def)\n apply (clarsimp simp: isCap_simps valid_mdb'_def\n valid_mdb_ctes_def ut_revocable'_def)\n apply clarsimp\n apply (rule context_conjI, blast)\n apply (clarsimp simp: descendants_range'_def)\n done\n\nlemma insertNewCap_overlap_reserved'[wp]:\n \"\\\\s. caps_overlap_reserved' (capRange c) s\\\n capRange c \\ capRange cap = {} \\ capAligned cap \\\n cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) cap) p s \\\n valid_mdb' s \\ valid_objs' s\\\n insertNewCap p slot cap\n \\\\_ s. caps_overlap_reserved' (capRange c) s\\\"\n apply (simp add: insertNewCap_def caps_overlap_reserved'_def)\n apply (wp getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (rule conjI)\n apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def no_0_def)\n apply (case_tac ctea)\n apply (case_tac cteb)\n apply (clarsimp simp: nullPointer_def ball_ran_modify_map_eq\n caps_overlap_reserved'_def[symmetric])\n apply (clarsimp simp: ran_def split: if_splits)\n apply (case_tac \"slot = a\")\n apply clarsimp\n apply (rule disjoint_subset)\n apply (erule(1) usableRange_subseteq)\n apply (simp add:untypedCapRange Int_ac)+\n apply (subst Int_commute)\n apply (erule(2) caps_overlap_reserved'_D)\n done\n\ncrunch ksArch[wp]: insertNewCap \"\\s. P (ksArchState s)\"\n (wp: crunch_wps)\n\nlemma inv_untyped_corres_helper1:\n \"list_all2 cap_relation (map (\\ref. default_cap tp ref sz d) orefs) cps\n \\\n corres dc\n (\\s. pspace_aligned s \\ pspace_distinct s\n \\ valid_objs s \\ valid_mdb s \\ valid_list s\n \\ cte_wp_at is_untyped_cap p s\n \\ (\\tup \\ set (zip crefs orefs).\n cte_wp_at (\\c. cap_range (default_cap tp (snd tup) sz d) \\ untyped_range c) p s)\n \\ (\\tup \\ set (zip crefs orefs).\n descendants_range (default_cap tp (snd tup) sz d) p s)\n \\ (\\tup \\ set (zip crefs orefs).\n caps_overlap_reserved (untyped_range (default_cap tp (snd tup) sz d)) s)\n \\ (\\tup \\ set (zip crefs orefs). real_cte_at (fst tup) s)\n \\ (\\tup \\ set (zip crefs orefs).\n cte_wp_at ((=) cap.NullCap) (fst tup) s)\n \\ distinct (p # (map fst (zip crefs orefs)))\n \\ distinct_sets (map (\\tup. cap_range (default_cap tp (snd tup) sz d)) (zip crefs orefs))\n \\ (\\tup \\ set (zip crefs orefs).\n valid_cap (default_cap tp (snd tup) sz d) s))\n (\\s. (\\tup \\ set (zip (map cte_map crefs) cps). valid_cap' (snd tup) s)\n \\ (\\tup \\ set (zip (map cte_map crefs) cps). cte_wp_at' (\\c. cteCap c = NullCap) (fst tup) s)\n \\ cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n (\\tup \\ set (zip (map cte_map crefs) cps).\n sameRegionAs (cteCap cte) (snd tup)))\n (cte_map p) s\n \\ distinct ((cte_map p) # (map fst (zip (map cte_map crefs) cps)))\n \\ valid_mdb' s \\ valid_objs' s \\ pspace_aligned' s \\ pspace_distinct' s\n \\ (\\tup \\ set (zip (map cte_map crefs) cps). descendants_range' (snd tup) (cte_map p) (ctes_of s))\n \\ (\\tup \\ set (zip (map cte_map crefs) cps).\n caps_overlap_reserved' (capRange (snd tup)) s)\n \\ distinct_sets (map capRange (map snd (zip (map cte_map crefs) cps))))\n (sequence_x (map (create_cap tp sz p d) (zip crefs orefs)))\n (zipWithM_x (insertNewCap (cte_map p))\n ((map cte_map crefs)) cps)\"\n apply (simp add: zipWithM_x_def zipWith_def split_def)\n apply (fold mapM_x_def)\n apply (rule corres_list_all2_mapM_)\n apply (rule corres_guard_imp)\n apply (erule insertNewCap_corres)\n apply (clarsimp simp: cte_wp_at_def is_cap_simps)\n apply (clarsimp simp: fun_upd_def cte_wp_at_ctes_of)\n apply clarsimp\n apply (rule hoare_pre, wp hoare_vcg_const_Ball_lift)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_caps_of_state\n cap_range_def[where c=\"default_cap a b c d\" for a b c d])\n apply (drule(2) caps_overlap_reservedD[rotated])\n apply (simp add:Int_ac)\n apply (rule conjI)\n apply (clarsimp simp: valid_cap_def)\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (rule conjI)\n apply (clarsimp simp:Int_ac)\n apply (erule disjoint_subset2[rotated])\n apply fastforce\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI)\n subgoal by fastforce\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps valid_cap_def)\n apply (fastforce simp: image_def)\n apply (rule hoare_pre)\n apply (wp\n hoare_vcg_const_Ball_lift\n insertNewCap_valid_mdb hoare_vcg_all_lift insertNewCap_ranges\n | subst cte_wp_at_cteCaps_of)+\n apply (subst(asm) cte_wp_at_cteCaps_of)+\n apply (clarsimp simp only:)\n apply simp\n apply (rule conjI)\n apply clarsimp\n apply (thin_tac \"cte_map p \\ S\" for S)\n apply (erule notE, erule rev_image_eqI)\n apply simp\n apply (rule conjI,clarsimp+)\n apply (rule conjI,erule caps_overlap_reserved'_subseteq)\n apply (rule untypedRange_in_capRange)\n apply (rule conjI,erule no_default_zombie)\n apply (rule conjI, clarsimp simp:Int_ac)\n apply fastforce\n apply (clarsimp simp:Int_ac valid_capAligned )\n apply fastforce\n apply (rule list_all2_zip_split)\n apply (simp add: list_all2_map2 list_all2_refl)\n apply (simp add: list_all2_map1)\n done\n\nlemma createNewCaps_valid_pspace_extras:\n \"\\(\\s. n \\ 0 \\ ptr \\ 0 \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ pspace_no_overlap' ptr sz s\n \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s\n \\ ksCurDomain s \\ maxDomain\n )\\\n createNewCaps ty ptr n us d\n \\\\rv. pspace_aligned'\\\"\n \"\\(\\s. n \\ 0 \\ ptr \\ 0 \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ pspace_no_overlap' ptr sz s\n \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s\n \\ ksCurDomain s \\ maxDomain\n )\\\n createNewCaps ty ptr n us d\n \\\\rv. pspace_canonical'\\\"\n \"\\(\\s. n \\ 0 \\ ptr \\ 0 \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ pspace_no_overlap' ptr sz s\n \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s\n \\ ksCurDomain s \\ maxDomain\n )\\\n createNewCaps ty ptr n us d\n \\\\rv. pspace_distinct'\\\"\n \"\\(\\s. n \\ 0 \\ ptr \\ 0 \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ pspace_no_overlap' ptr sz s\n \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s\n \\ ksCurDomain s \\ maxDomain\n )\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_mdb'\\\"\n \"\\(\\s. n \\ 0 \\ ptr \\ 0 \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ pspace_no_overlap' ptr sz s\n \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s\n \\ ksCurDomain s \\ maxDomain\n )\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_objs'\\\"\n apply (rule hoare_grab_asm)+\n apply (rule hoare_pre,rule hoare_strengthen_post[OF createNewCaps_valid_pspace])\n apply (simp add:valid_pspace'_def)+\n apply (rule hoare_grab_asm)+\n apply (rule hoare_pre,rule hoare_strengthen_post[OF createNewCaps_valid_pspace])\n apply (simp add:valid_pspace'_def)+\n apply (rule hoare_grab_asm)+\n apply (rule hoare_pre,rule hoare_strengthen_post[OF createNewCaps_valid_pspace])\n apply (simp add:valid_pspace'_def)+\n apply (rule hoare_grab_asm)+\n apply (rule hoare_pre,rule hoare_strengthen_post[OF createNewCaps_valid_pspace])\n apply (simp add:valid_pspace'_def)+\n apply (rule hoare_grab_asm)+\n apply (rule hoare_pre,rule hoare_strengthen_post[OF createNewCaps_valid_pspace])\n apply (simp add:valid_pspace'_def)+\n done\n\ndeclare map_fst_zip_prefix[simp]\n\ndeclare map_snd_zip_prefix[simp]\n\ndeclare word_unat_power [symmetric, simp del]\n\nlemma createNewCaps_range_helper:\n \"\\\\s. range_cover ptr sz (APIType_capBits tp us) n \\ 0 < n\\\n createNewCaps tp ptr n us d\n \\\\rv s. \\capfn.\n rv = map capfn (map (\\p. ptr_add ptr (p * 2 ^ (APIType_capBits tp us)))\n [0 ..< n])\n \\ (\\p. capClass (capfn p) = PhysicalClass\n \\ capUntypedPtr (capfn p) = p\n \\ capBits (capfn p) = (APIType_capBits tp us))\\\"\n apply (simp add: createNewCaps_def toAPIType_def Arch_createNewCaps_def\n split del: if_split cong: option.case_cong)\n apply (rule hoare_grab_asm)+\n apply (frule range_cover.range_cover_n_less)\n apply (frule range_cover.unat_of_nat_n)\n apply (cases tp, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp)\n apply (frule range_cover_not_zero[rotated -1],simp)\n apply (clarsimp simp: APIType_capBits_def objBits_simps ptr_add_def o_def)\n apply (subst upto_enum_red')\n apply unat_arith\n apply (clarsimp simp: o_def fromIntegral_def toInteger_nat fromInteger_nat)\n apply fastforce\n apply (rule hoare_pre,wp createObjects_ret2)\n apply (clarsimp simp: APIType_capBits_def word_bits_def bit_simps\n objBits_simps ptr_add_def o_def)\n apply (fastforce simp: objBitsKO_def objBits_def)\n apply (rule hoare_pre,wp createObjects_ret2)\n apply (clarsimp simp: APIType_capBits_def word_bits_def\n objBits_simps ptr_add_def o_def)\n apply (fastforce simp: objBitsKO_def objBits_def)\n apply (rule hoare_pre,wp createObjects_ret2)\n apply (clarsimp simp: APIType_capBits_def word_bits_def objBits_simps ptr_add_def o_def)\n apply (fastforce simp: objBitsKO_def objBits_def)\n apply (rule hoare_pre,wp createObjects_ret2)\n apply (clarsimp simp: APIType_capBits_def word_bits_def objBits_simps ptr_add_def o_def)\n apply (fastforce simp: objBitsKO_def objBits_def)\n apply (wp createObjects_ret2\n | clarsimp simp: APIType_capBits_def objBits_if_dev archObjSize_def\n word_bits_def bit_simps\n split del: if_split\n | simp add: objBits_simps\n | (rule exI, (fastforce simp: bit_simps)))+\n done\n\nlemma createNewCaps_range_helper2:\n \"\\\\s. range_cover ptr sz (APIType_capBits tp us) n \\ 0 < n\\\n createNewCaps tp ptr n us d\n \\\\rv s. \\cp \\ set rv. capRange cp \\ {} \\ capRange cp \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_strengthen_post)\n apply (rule createNewCaps_range_helper)\n apply (clarsimp simp: capRange_def ptr_add_def word_unat_power[symmetric]\n simp del: atLeastatMost_subset_iff\n dest!: less_two_pow_divD)\n apply (rule conjI)\n apply (rule is_aligned_no_overflow)\n apply (rule is_aligned_add_multI [OF _ _ refl])\n apply (fastforce simp:range_cover_def)\n apply simp\n apply (rule range_subsetI)\n apply (rule machine_word_plus_mono_right_split[OF range_cover.range_cover_compare])\n apply (assumption)+\n apply (simp add:range_cover_def word_bits_def)\n apply (frule range_cover_cell_subset)\n apply (erule of_nat_mono_maybe[rotated])\n apply (drule (1) range_cover.range_cover_n_less )\n apply (clarsimp)\n apply (erule impE)\n apply (simp add:range_cover_def)\n apply (rule is_aligned_no_overflow)\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (fastforce simp:range_cover_def)\n apply simp\n done\n\nlemma createNewCaps_children:\n \"\\\\s. cap = UntypedCap d (ptr && ~~ mask sz) sz idx\n \\ range_cover ptr sz (APIType_capBits tp us) n \\ 0 < n\\\n createNewCaps tp ptr n us d\n \\\\rv s. \\y \\ set rv. (sameRegionAs cap y)\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_chain [OF createNewCaps_range_helper2])\n apply fastforce\n apply clarsimp\n apply (drule(1) bspec)\n apply (clarsimp simp: sameRegionAs_def3 isCap_simps)\n apply (drule(1) subsetD)\n apply clarsimp\n apply (erule order_trans[rotated])\n apply (rule word_and_le2)\n done\n\nfun isDeviceCap :: \"capability \\ bool\"\nwhere\n \"isDeviceCap (UntypedCap d _ _ _) = d\"\n| \"isDeviceCap (ArchObjectCap (FrameCap _ _ _ d _)) = d\"\n| \"isDeviceCap _ = False\"\n\nlemmas makeObjectKO_simp = makeObjectKO_def[split_simps RISCV64_H.object_type.split\n Structures_H.kernel_object.split ArchTypes_H.apiobject_type.split\n sum.split arch_kernel_object.split]\n\nlemma createNewCaps_descendants_range':\n \"\\\\s. descendants_range' p q (ctes_of s) \\\n range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0 \\\n pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us d\n \\ \\rv s. descendants_range' p q (ctes_of s)\\\"\n apply (clarsimp simp:descendants_range'_def2 descendants_range_in'_def2)\n apply (wp createNewCaps_null_filter')\n apply fastforce\n done\n\nlemma caps_overlap_reserved'_def2:\n \"caps_overlap_reserved' S =\n (\\s. (\\cte \\ ran (null_filter' (ctes_of s)).\n isUntypedCap (cteCap cte) \\\n usableUntypedRange (cteCap cte) \\ S = {}))\"\n apply (rule ext)\n apply (clarsimp simp:caps_overlap_reserved'_def)\n apply (intro iffI ballI impI)\n apply (elim ballE impE)\n apply simp\n apply simp\n apply (simp add:ran_def null_filter'_def split:if_split_asm option.splits)\n apply (elim ballE impE)\n apply simp\n apply simp\n apply (clarsimp simp: ran_def null_filter'_def is_cap_simps\n simp del: split_paired_All split_paired_Ex split: if_splits)\n apply (drule_tac x = a in spec)\n apply simp\n done\n\nlemma createNewCaps_caps_overlap_reserved':\n \"\\\\s. caps_overlap_reserved' S s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ 0 < n \\\n range_cover ptr sz (APIType_capBits ty us) n\\\n createNewCaps ty ptr n us d\n \\\\rv s. caps_overlap_reserved' S s\\\"\n apply (clarsimp simp: caps_overlap_reserved'_def2)\n apply (wp createNewCaps_null_filter')\n apply fastforce\n done\n\nlemma createNewCaps_caps_overlap_reserved_ret':\n \"\\\\s. caps_overlap_reserved'\n {ptr..ptr + of_nat n * 2 ^ APIType_capBits ty us - 1} s \\\n pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s \\\n 0 < n \\ range_cover ptr sz (APIType_capBits ty us) n\\\n createNewCaps ty ptr n us d\n \\\\rv s. \\y\\set rv. caps_overlap_reserved' (capRange y) s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:valid_def)\n apply (frule use_valid[OF _ createNewCaps_range_helper])\n apply fastforce\n apply clarsimp\n apply (erule use_valid[OF _ createNewCaps_caps_overlap_reserved'])\n apply (intro conjI,simp_all)\n apply (erule caps_overlap_reserved'_subseteq)\n apply (drule(1) range_cover_subset)\n apply simp\n apply (clarsimp simp: ptr_add_def capRange_def\n simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n done\n\nlemma createNewCaps_descendants_range_ret':\n \"\\\\s. (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ descendants_range_in' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} cref (ctes_of s)\\\n createNewCaps ty ptr n us d\n \\ \\rv s. \\y\\set rv. descendants_range' y cref (ctes_of s)\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: valid_def)\n apply (frule use_valid[OF _ createNewCaps_range_helper])\n apply simp\n apply (erule use_valid[OF _ createNewCaps_descendants_range'])\n apply (intro conjI,simp_all)\n apply (clarsimp simp:descendants_range'_def descendants_range_in'_def)\n apply (drule(1) bspec)+\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (erule disjoint_subset2[rotated])\n apply (drule(1) range_cover_subset)\n apply simp\n apply (simp add:capRange_def ptr_add_def)\n done\n\nlemma createNewCaps_parent_helper:\n \"\\\\s. cte_wp_at' (\\cte. cteCap cte = UntypedCap d (ptr && ~~ mask sz) sz idx) p s\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us)\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n \\\n createNewCaps ty ptr n us d\n \\\\rv. cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n (\\tup\\set (zip (xs rv) rv).\n sameRegionAs (cteCap cte) (snd tup)))\n p\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\cte. cte_wp_at' ((=) cte) p s\n \\ isUntypedCap (cteCap cte)\n \\ (\\tup\\set (zip (xs rv) rv).\n sameRegionAs (cteCap cte) (snd tup))\"])\n apply (clarsimp elim!: cte_wp_at_weakenE')\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift createNewCaps_cte_wp_at'\n set_tuple_pick createNewCaps_children)\n apply (auto simp:cte_wp_at'_def isCap_simps)\n done\n\nlemma createNewCaps_valid_cap':\n \"\\\\s. pspace_no_overlap' ptr sz s \\\n valid_pspace' s \\ n \\ 0 \\\n range_cover ptr sz (APIType_capBits ty us) n \\\n (ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us) \\\n (ty = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits) \\\n ptr \\ 0 \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz) \\ ptr && ~~ mask sz \\ kernel_mappings \\\n createNewCaps ty ptr n us d\n \\\\r s. \\cap\\set r. s \\' cap\\\"\n apply (rule hoare_assume_pre)\n apply clarsimp\n apply (erule createNewCaps_valid_cap)\n apply simp+\n done\n\nlemma dmo_ctes_of[wp]:\n \"\\\\s. P (ctes_of s)\\ doMachineOp mop \\\\rv s. P (ctes_of s)\\\"\n by (simp add: doMachineOp_def split_def | wp select_wp)+\n\nlemma createNewCaps_ranges:\n \"\\\\s. range_cover ptr sz (APIType_capBits ty us) n \\ 0\n createNewCaps ty ptr n us d\n \\\\rv s. distinct_sets (map capRange rv)\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_chain)\n apply (rule createNewCaps_range_helper)\n apply fastforce\n apply (clarsimp simp: distinct_sets_prop distinct_prop_map)\n apply (rule distinct_prop_distinct)\n apply simp\n apply (clarsimp simp: capRange_def simp del: Int_atLeastAtMost\n dest!: less_two_pow_divD)\n apply (rule aligned_neq_into_no_overlap[simplified field_simps])\n apply (rule notI)\n apply (erule(3) ptr_add_distinct_helper)\n apply (simp add:range_cover_def word_bits_def)\n apply (erule range_cover.range_cover_n_le(1)[where 'a=machine_word_len])\n apply (clarsimp simp: ptr_add_def word_unat_power[symmetric])\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (simp add:range_cover_def)+\n apply (clarsimp simp: ptr_add_def word_unat_power[symmetric])\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (simp add:range_cover_def)+\n done\n\nlemma createNewCaps_ranges':\n \"\\\\s. range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n\\\n createNewCaps ty ptr n us d\n \\\\rv s. distinct_sets (map capRange (map snd (zip xs rv)))\\\"\n apply (rule hoare_strengthen_post)\n apply (rule createNewCaps_ranges)\n apply (simp add: distinct_sets_prop del: map_map)\n apply (erule distinct_prop_prefixE)\n apply (rule Sublist.map_mono_prefix)\n apply (rule map_snd_zip_prefix [unfolded less_eq_list_def])\n done\n\ndeclare split_paired_Ex[simp del]\nlemmas corres_split_retype_createNewCaps\n = corres_split[OF corres_retype_region_createNewCaps,\n simplified bind_assoc, simplified ]\ndeclare split_paired_Ex[simp add]\n\nlemma retype_region_caps_overlap_reserved:\n \"\\valid_pspace and valid_mdb and\n pspace_no_overlap_range_cover ptr sz and caps_no_overlap ptr sz and\n caps_overlap_reserved\n {ptr..ptr + of_nat n * 2^obj_bits_api (APIType_map2 (Inr ao')) us - 1} and\n (\\s. \\slot. cte_wp_at (\\c. up_aligned_area ptr sz \\ cap_range c \\ cap_is_device c = dev) slot s) and\n K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \\ 0 < us) and\n K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) n) and\n K (S \\ {ptr..ptr + of_nat n *\n 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1})\\\n retype_region ptr n us (APIType_map2 (Inr ao')) dev\n \\\\rv s. caps_overlap_reserved S s\\\"\n apply (rule hoare_gen_asm)+\n apply (simp (no_asm) add:caps_overlap_reserved_def2)\n apply (rule hoare_pre)\n apply (wp retype_region_caps_of)\n apply simp+\n apply (simp add:caps_overlap_reserved_def2)\n apply (intro conjI,simp+)\n apply clarsimp\n apply (drule bspec)\n apply simp+\n apply (erule(1) disjoint_subset2)\n done\n\nlemma retype_region_caps_overlap_reserved_ret:\n \"\\valid_pspace and valid_mdb and caps_no_overlap ptr sz and\n pspace_no_overlap_range_cover ptr sz and\n caps_overlap_reserved\n {ptr..ptr + of_nat n * 2^obj_bits_api (APIType_map2 (Inr ao')) us - 1} and\n (\\s. \\slot. cte_wp_at (\\c. up_aligned_area ptr sz \\ cap_range c \\ cap_is_device c = dev) slot s) and\n K (APIType_map2 (Inr ao') = Structures_A.apiobject_type.CapTableObject \\ 0 < us) and\n K (range_cover ptr sz (obj_bits_api (APIType_map2 (Inr ao')) us) n)\\\n retype_region ptr n us (APIType_map2 (Inr ao')) dev\n \\\\rv s. \\y\\set rv. caps_overlap_reserved (untyped_range (default_cap\n (APIType_map2 (Inr ao')) y us d)) s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:valid_def)\n apply (frule retype_region_ret[unfolded valid_def,simplified,THEN spec,THEN bspec])\n apply clarsimp\n apply (erule use_valid[OF _ retype_region_caps_overlap_reserved])\n apply clarsimp\n apply (intro conjI,simp_all)\n apply fastforce\n apply (case_tac ao')\n apply (simp_all add:APIType_map2_def)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (simp_all add:obj_bits_api_def ptr_add_def)\n apply (drule(1) range_cover_subset)\n apply (clarsimp)+\n done\n\nlemma updateFreeIndex_pspace_no_overlap':\n \"\\\\s. pspace_no_overlap' ptr sz s \\\n valid_pspace' s \\ cte_wp_at' (isUntypedCap o cteCap) src s\\\n updateFreeIndex src index\n \\\\r s. pspace_no_overlap' ptr sz s\\\"\n apply (simp add: updateFreeIndex_def getSlotCap_def updateTrackedFreeIndex_def)\n apply (rule hoare_pre)\n apply (wp getCTE_wp' | wp (once) pspace_no_overlap'_lift\n | simp)+\n apply (clarsimp simp:valid_pspace'_def pspace_no_overlap'_def)\n done\n\nlemma updateFreeIndex_updateCap_caps_overlap_reserved:\n \"\\\\s. valid_mdb' s \\ valid_objs' s \\ S \\ untypedRange cap \\\n usableUntypedRange (capFreeIndex_update (\\_. index) cap) \\ S = {} \\\n isUntypedCap cap \\ descendants_range_in' S src (ctes_of s) \\\n cte_wp_at' (\\c. cteCap c = cap) src s\\\n updateCap src (capFreeIndex_update (\\_. index) cap)\n \\\\r s. caps_overlap_reserved' S s\\\"\n apply (clarsimp simp:caps_overlap_reserved'_def)\n apply (wp updateCap_ctes_of_wp)\n apply (clarsimp simp:modify_map_def cte_wp_at_ctes_of)\n apply (erule ranE)\n apply (clarsimp split:if_split_asm simp:valid_mdb'_def valid_mdb_ctes_def)\n apply (case_tac cte)\n apply (case_tac ctea)\n apply simp\n apply (drule untyped_incD')\n apply (simp+)[4]\n apply clarify\n apply (erule subset_splitE)\n apply (simp del:usable_untyped_range.simps)\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (elim conjE)\n apply blast\n apply (simp)\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (elim conjE)\n apply (drule(2) descendants_range_inD')\n apply simp\n apply (rule disjoint_subset[OF usableRange_subseteq])\n apply (rule valid_capAligned)\n apply (erule(1) ctes_of_valid_cap')\n apply (simp add:untypedCapRange)+\n apply (elim disjE)\n apply clarsimp\n apply (drule(2) descendants_range_inD')\n apply simp\n apply (rule disjoint_subset[OF usableRange_subseteq])\n apply (rule valid_capAligned)\n apply (erule(1) ctes_of_valid_cap')\n apply (simp add:untypedCapRange)+\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (rule disjoint_subset[OF usableRange_subseteq])\n apply (rule valid_capAligned)\n apply (erule(1) ctes_of_valid_cap')\n apply simp+\n apply blast\n done\n\nlemma updateFreeIndex_caps_overlap_reserved:\n \"\\\\s. valid_pspace' s \\ descendants_range_in' S src (ctes_of s)\n \\ cte_wp_at' ((\\cap. S \\ untypedRange cap \\\n usableUntypedRange (capFreeIndex_update (\\_. index) cap) \\ S = {} \\\n isUntypedCap cap) o cteCap) src s\\\n updateFreeIndex src index\n \\\\r s. caps_overlap_reserved' S s\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateFreeIndex_updateCap_caps_overlap_reserved getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of valid_pspace'_def)\n apply (clarsimp simp: valid_mdb'_def split: option.split)\n done\n\nlemma updateFreeIndex_updateCap_caps_no_overlap'':\n \"\\\\s. isUntypedCap cap \\ caps_no_overlap'' ptr sz s \\\n cte_wp_at' (\\c. cteCap c = cap) src s\\\n updateCap src (capFreeIndex_update (\\_. index) cap)\n \\\\r s. caps_no_overlap'' ptr sz s\\\"\n apply (clarsimp simp:caps_no_overlap''_def)\n apply (wp updateCap_ctes_of_wp)\n apply (clarsimp simp: modify_map_def ran_def cte_wp_at_ctes_of\n simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex)\n apply (case_tac \"a = src\")\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex)\n apply (erule subsetD[rotated])\n apply (elim allE impE)\n apply fastforce\n apply (clarsimp simp:isCap_simps)\n apply (erule subset_trans)\n apply (clarsimp simp:isCap_simps)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex)\n apply (erule subsetD[rotated])\n apply (elim allE impE)\n prefer 2\n apply assumption\n apply fastforce+\n done\n\nlemma updateFreeIndex_caps_no_overlap'':\n \"\\\\s. caps_no_overlap'' ptr sz s \\\n cte_wp_at' (isUntypedCap o cteCap) src s\\\n updateFreeIndex src index\n \\\\r s. caps_no_overlap'' ptr sz s\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateFreeIndex_updateCap_caps_no_overlap'' getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (clarsimp simp: caps_no_overlap''_def split: option.split)\n done\n\nlemma updateFreeIndex_descendants_of':\n \"\\\\s. cte_wp_at' (\\c. \\idx'. cteCap c = capFreeIndex_update (K idx') cap) ptr s \\ isUntypedCap cap \\\n P ((swp descendants_of') (null_filter' (ctes_of s)))\\\n updateCap ptr (capFreeIndex_update (\\_. index) cap)\n \\\\r s. P ((swp descendants_of') (null_filter' (ctes_of s)))\\\"\n apply (wp updateCap_ctes_of_wp)\n apply clarsimp\n apply (erule subst[rotated,where P = P])\n apply (rule ext)\n apply (clarsimp simp:null_filter_descendants_of'[OF null_filter_simp'])\n apply (rule mdb_inv_preserve.descendants_of)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (frule_tac m=\"ctes_of s\" and index=index in mdb_inv_preserve_updateCap)\n apply (clarsimp simp: isCap_simps)\n apply (clarsimp simp: isCap_simps)\n done\n\nlemma updateFreeIndex_updateCap_descendants_range_in':\n \"\\\\s. cte_wp_at' (\\c. cteCap c = cap) slot s \\ isUntypedCap cap \\\n descendants_range_in' S slot (ctes_of s)\\\n updateCap slot (capFreeIndex_update (\\_. index) cap)\n \\\\r s. descendants_range_in' S slot (ctes_of s)\\\"\n apply (rule hoare_pre)\n apply (wp descendants_range_in_lift'\n [where Q'=\"\\s. cte_wp_at' (\\c. cteCap c = cap) slot s \\ isUntypedCap cap\" and\n Q = \"\\s. cte_wp_at' (\\c. cteCap c = cap) slot s \\ isUntypedCap cap \"] )\n apply (wp updateFreeIndex_descendants_of')\n apply (clarsimp simp: cte_wp_at_ctes_of swp_def isCap_simps)\n apply (simp add:updateCap_def)\n apply (wp setCTE_weak_cte_wp_at getCTE_wp)\n apply (fastforce simp:cte_wp_at_ctes_of isCap_simps)\n apply (clarsimp)\n done\n\nlemma updateFreeIndex_descendants_range_in':\n \"\\\\s. cte_wp_at' (isUntypedCap o cteCap) slot s\n \\ descendants_range_in' S slot (ctes_of s)\\\n updateFreeIndex slot index\n \\\\r s. descendants_range_in' S slot (ctes_of s)\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateFreeIndex_updateCap_descendants_range_in' getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma caps_no_overlap''_def2:\n \"caps_no_overlap'' ptr sz =\n (\\s. \\cte\\ran (null_filter' (ctes_of s)).\n untypedRange (cteCap cte) \\\n {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {} \\\n {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \\\n untypedRange (cteCap cte))\"\n apply (intro ext iffI)\n apply (clarsimp simp:caps_no_overlap''_def null_filter'_def ran_def)\n apply (drule_tac x = cte in spec)\n apply fastforce\n apply (clarsimp simp:caps_no_overlap''_def null_filter'_def)\n apply (case_tac \"cte = CTE capability.NullCap nullMDBNode\")\n apply clarsimp\n apply (drule_tac x = cte in bspec)\n apply (clarsimp simp:ran_def)\n apply (rule_tac x= a in exI)\n apply clarsimp\n apply clarsimp\n apply (erule subsetD)\n apply simp\n done\n\nlemma deleteObjects_caps_no_overlap'':\n \"\\\\s. invs' s \\ ct_active' s \\ sch_act_simple s \\\n cte_wp_at' (\\c. cteCap c = capability.UntypedCap d ptr sz idx) slot s \\\n caps_no_overlap'' ptr sz s \\\n descendants_range' (capability.UntypedCap d ptr sz idx) slot (ctes_of s)\\\n deleteObjects ptr sz\n \\\\rv s. caps_no_overlap'' ptr sz s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp split:if_splits)\n apply (clarsimp simp:caps_no_overlap''_def2 deleteObjects_def2 capAligned_def valid_cap'_def\n dest!:ctes_of_valid_cap')\n apply (wp deleteObjects_null_filter[where idx = idx and p = slot])\n apply (clarsimp simp:cte_wp_at_ctes_of invs_def)\n apply (case_tac cte)\n apply clarsimp\n apply (frule ctes_of_valid_cap')\n apply (simp add:invs_valid_objs')\n apply (simp add:valid_cap'_def capAligned_def)\n done\n\nlemma descendants_range_in_subseteq':\n \"\\descendants_range_in' A p ms ;B\\ A\\ \\ descendants_range_in' B p ms\"\n by (auto simp:descendants_range_in'_def cte_wp_at_ctes_of dest!:bspec)\n\nlemma updateFreeIndex_mdb_simple':\n \"\\\\s. descendants_of' src (ctes_of s) = {} \\\n pspace_no_overlap' (capPtr cap) (capBlockSize cap) s \\\n valid_pspace' s \\ cte_wp_at' (\\c. \\idx'. cteCap c = capFreeIndex_update (\\_. idx') cap) src s \\\n isUntypedCap cap\\\n updateCap src (capFreeIndex_update (\\_. idx) cap)\n \\\\rv. valid_mdb'\\\"\n apply (clarsimp simp:valid_mdb'_def updateCap_def valid_pspace'_def)\n apply (wp getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of isCap_simps simp del:fun_upd_apply)\n\n apply (frule mdb_inv_preserve_updateCap[where index=idx and m=\"ctes_of s\" and slot=src for s])\n apply (simp add: isCap_simps)\n apply (simp add: modify_map_def)\n apply (clarsimp simp add: mdb_inv_preserve.preserve_stuff mdb_inv_preserve.by_products valid_mdb_ctes_def)\n\n proof -\n fix s cte ptr sz idx' d\n assume descendants: \"descendants_of' src (ctes_of s) = {}\"\n and cte_wp_at' :\"ctes_of s src = Some cte\" \"cteCap cte = capability.UntypedCap d ptr sz idx'\"\n and unt_inc' :\"untyped_inc' (ctes_of s)\"\n and valid_objs' :\"valid_objs' s\"\n and invp: \"mdb_inv_preserve (ctes_of s) (ctes_of s(src \\ cteCap_update (\\_. capability.UntypedCap d ptr sz idx) cte))\"\n (is \"mdb_inv_preserve (ctes_of s) ?ctes\")\n\n show \"untyped_inc' ?ctes\"\n using cte_wp_at'\n apply (clarsimp simp:untyped_inc'_def mdb_inv_preserve.descendants_of[OF invp, symmetric]\n descendants\n split del: if_split)\n apply (case_tac \"ctes_of s p\")\n apply (simp split: if_split_asm)\n apply (case_tac \"ctes_of s p'\")\n apply (simp split: if_split_asm)\n apply (case_tac \"the (ctes_of s p)\", case_tac \"the (ctes_of s p')\")\n apply clarsimp\n apply (cut_tac p=p and p'=p' in untyped_incD'[OF _ _ _ _ unt_inc'])\n apply assumption\n apply (clarsimp simp: isCap_simps split: if_split_asm)\n apply assumption\n apply (clarsimp simp: isCap_simps split: if_split_asm)\n apply (clarsimp simp: descendants split: if_split_asm)\n done\nqed\n\nlemma pspace_no_overlap_valid_untyped':\n \"\\ pspace_no_overlap' ptr bits s; is_aligned ptr bits; bits < word_bits;\n pspace_aligned' s \\\n \\ valid_untyped' d ptr bits idx s\"\n apply (clarsimp simp: valid_untyped'_def ko_wp_at'_def split del: if_split)\n apply (frule(1) pspace_no_overlapD')\n apply (simp add: obj_range'_def[symmetric] Int_commute add_mask_fold)\n apply (erule disjE)\n apply (drule base_member_set[simplified field_simps add_mask_fold])\n apply (simp add: word_bits_def)\n apply blast\n apply (simp split: if_split_asm)\n apply (erule notE, erule disjoint_subset2[rotated])\n apply (clarsimp simp: is_aligned_no_wrap'[OF _ word_of_nat_less])\n done\n\nlemma updateFreeIndex_valid_pspace_no_overlap':\n \"\\\\s. valid_pspace' s \\\n (\\ptr sz. pspace_no_overlap' ptr sz s \\ idx \\ 2 ^ sz \\\n cte_wp_at' ((\\c. isUntypedCap c \\ capPtr c = ptr \\ capBlockSize c = sz) o cteCap) src s)\n \\ is_aligned (of_nat idx :: machine_word) minUntypedSizeBits \\\n descendants_of' src (ctes_of s) = {}\\\n updateFreeIndex src idx\n \\\\r s. valid_pspace' s\\\"\n apply (clarsimp simp:valid_pspace'_def updateFreeIndex_def updateTrackedFreeIndex_def)\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_lift)\n apply (clarsimp simp:updateCap_def getSlotCap_def)\n apply (wp getCTE_wp | simp)+\n apply (wp updateFreeIndex_mdb_simple' getCTE_wp' | simp add: getSlotCap_def)+\n apply (clarsimp simp:cte_wp_at_ctes_of valid_pspace'_def)\n apply (case_tac cte,simp add:isCap_simps)\n apply (frule(1) ctes_of_valid_cap')\n apply (clarsimp simp: valid_cap_simps' capAligned_def pspace_no_overlap_valid_untyped')\n done\n\ncrunch vms'[wp]: updateFreeIndex \"valid_machine_state'\"\n\n(* FIXME: move *)\nlemma setCTE_tcbDomain_inv[wp]:\n \"\\obj_at' (\\tcb. P (tcbState tcb)) t\\ setCTE ptr v \\\\_. obj_at' (\\tcb. P (tcbState tcb)) t\\\"\n apply (simp add: setCTE_def)\n apply (rule setObject_cte_obj_at_tcb', simp_all)\n done\n\n(* FIXME: move *)\ncrunch tcbState_inv[wp]: cteInsert \"obj_at' (\\tcb. P (tcbState tcb)) t\"\n (wp: crunch_simps hoare_drop_imps)\n\nlemma updateFreeIndex_clear_invs':\n \"\\\\s. invs' s \\\n (\\ptr sz. pspace_no_overlap' ptr sz s \\ idx \\ 2 ^ sz \\\n cte_wp_at' ((\\c. isUntypedCap c \\ capPtr c = ptr \\ capBlockSize c = sz) o cteCap) src s)\n \\ is_aligned (of_nat idx :: machine_word) minUntypedSizeBits\n \\ descendants_of' src (ctes_of s) = {}\\\n updateFreeIndex src idx\n \\\\r s. invs' s\\\"\n apply (clarsimp simp:invs'_def valid_state'_def)\n apply (wp updateFreeIndex_valid_pspace_no_overlap')\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def)\n apply (wp updateFreeIndex_valid_pspace_no_overlap' sch_act_wf_lift valid_queues_lift\n updateCap_iflive' tcb_in_cur_domain'_lift\n | simp add: pred_tcb_at'_def)+\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: ifunsafe'_def3 cteInsert_def setUntypedCapAsFull_def\n split del: if_split)\n apply wp+\n apply (rule hoare_vcg_conj_lift)\n apply (simp add:updateCap_def)\n apply wp+\n apply (wp valid_irq_node_lift)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add:updateCap_def)\n apply (wp setCTE_irq_handlers' getCTE_wp)\n apply (simp add:updateCap_def)\n apply (wp irqs_masked_lift valid_queues_lift' cur_tcb_lift ct_idle_or_in_cur_domain'_lift\n hoare_vcg_disj_lift untyped_ranges_zero_lift getCTE_wp\n | wp (once) hoare_use_eq[where f=\"gsUntypedZeroRanges\"]\n | simp add: getSlotCap_def\n | simp add: cte_wp_at_ctes_of)+\n apply (clarsimp simp: cte_wp_at_ctes_of fun_upd_def[symmetric])\n apply (clarsimp simp: isCap_simps)\n apply (frule(1) valid_global_refsD_with_objSize)\n apply clarsimp\n apply (intro conjI allI impI)\n apply (clarsimp simp: modify_map_def cteCaps_of_def ifunsafe'_def3 split:if_splits)\n apply (drule_tac x=src in spec)\n apply (clarsimp simp:isCap_simps)\n apply (rule_tac x = cref' in exI)\n apply clarsimp\n apply (drule_tac x = cref in spec)\n apply clarsimp\n apply (rule_tac x = cref' in exI)\n apply clarsimp\n apply (clarsimp simp: valid_pspace'_def)\n apply (erule untyped_ranges_zero_fun_upd, simp_all)\n apply (clarsimp simp: untypedZeroRange_def cteCaps_of_def isCap_simps)\n done\n\nlemma cte_wp_at_pspace_no_overlapI':\n \"\\invs' s; cte_wp_at' (\\c. cteCap c = capability.UntypedCap\n d (ptr && ~~ mask sz) sz idx) cref s;\n idx \\ unat (ptr && mask sz); sz < word_bits\\\n \\ pspace_no_overlap' ptr sz s\"\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (case_tac cte,clarsimp)\n apply (frule ctes_of_valid_cap')\n apply (simp add:invs_valid_objs')\n apply (clarsimp simp:valid_cap'_def invs'_def valid_state'_def valid_pspace'_def\n valid_untyped'_def simp del:usableUntypedRange.simps)\n apply (unfold pspace_no_overlap'_def)\n apply (intro allI impI)\n apply (unfold ko_wp_at'_def)\n apply (clarsimp simp del: atLeastAtMost_iff\n atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff usableUntypedRange.simps)\n apply (drule spec)+\n apply (frule(1) pspace_distinctD')\n apply (frule(1) pspace_alignedD')\n apply (erule(1) impE)+\n apply (clarsimp simp: obj_range'_def simp del: atLeastAtMost_iff\n atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff usableUntypedRange.simps)\n apply (erule disjoint_subset2[rotated])\n apply (frule(1) le_mask_le_2p)\n apply (clarsimp simp:p_assoc_help)\n apply (rule le_plus'[OF word_and_le2])\n apply simp\n apply (erule word_of_nat_le)\n done\n\nlemma descendants_range_caps_no_overlapI':\n \"\\invs' s; cte_wp_at' (\\c. cteCap c = capability.UntypedCap\n d (ptr && ~~ mask sz) sz idx) cref s;\n descendants_range_in' {ptr .. (ptr && ~~ mask sz) + mask sz} cref (ctes_of s)\\\n \\ caps_no_overlap'' ptr sz s\"\n apply (frule invs_mdb')\n apply (clarsimp simp:valid_mdb'_def valid_mdb_ctes_def cte_wp_at_ctes_of\n simp del:usableUntypedRange.simps untypedRange.simps)\n apply (unfold caps_no_overlap''_def add_mask_fold)\n apply (intro ballI impI)\n apply (erule ranE)\n apply (subgoal_tac \"isUntypedCap (cteCap ctea)\")\n prefer 2\n apply (rule untypedRange_not_emptyD)\n apply blast\n apply (case_tac ctea,case_tac cte)\n apply simp\n apply (drule untyped_incD')\n apply ((simp add:isCap_simps del:usableUntypedRange.simps untypedRange.simps)+)[4]\n apply (elim conjE subset_splitE)\n apply (erule subset_trans[OF _ psubset_imp_subset,rotated])\n apply (clarsimp simp:word_and_le2 add_mask_fold)\n apply simp\n apply (elim conjE)\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (drule(2) descendants_range_inD')\n apply (simp add:untypedCapRange)+\n apply (erule subset_trans[OF _ equalityD1,rotated])\n apply (clarsimp simp:word_and_le2 add_mask_fold)\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (drule disjoint_subset[rotated, where A' = \"{ptr..(ptr && ~~ mask sz) + mask sz}\"])\n apply (clarsimp simp:word_and_le2 Int_ac add_mask_fold)+\n done\n\nlemma cte_wp_at_caps_no_overlapI':\n \"\\invs' s; cte_wp_at' (\\c. (cteCap c) = UntypedCap d (ptr && ~~ mask sz) sz idx) cref s;\n idx \\ unat (ptr && mask sz); sz < word_bits\\\n \\ caps_no_overlap'' ptr sz s\"\n apply (frule invs_mdb')\n apply (frule(1) le_mask_le_2p)\n apply (clarsimp simp:valid_mdb'_def valid_mdb_ctes_def cte_wp_at_ctes_of)\n apply (case_tac cte)\n apply simp\n apply (frule(1) ctes_of_valid_cap'[OF _ invs_valid_objs'])\n apply (unfold caps_no_overlap''_def)\n apply (intro ballI impI)\n apply (erule ranE)\n apply (subgoal_tac \"isUntypedCap (cteCap ctea)\")\n prefer 2\n apply (rule untypedRange_not_emptyD)\n apply blast\n apply (case_tac ctea)\n apply simp\n apply (drule untyped_incD')\n apply (simp add:isCap_simps)+\n apply (elim conjE)\n apply (erule subset_splitE)\n apply (erule subset_trans[OF _ psubset_imp_subset,rotated])\n apply (clarsimp simp: word_and_le2)\n apply simp\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (elim conjE)\n apply (drule disjoint_subset2[rotated, where B' = \"{ptr..(ptr && ~~ mask sz) + mask sz}\"])\n apply clarsimp\n apply (rule le_plus'[OF word_and_le2])\n apply simp\n apply (erule word_of_nat_le)\n apply (simp add: add_mask_fold)\n apply (erule subset_trans[OF _ equalityD1,rotated])\n apply (clarsimp simp:word_and_le2)\n apply (thin_tac \"P\\Q\" for P Q)+\n apply (drule disjoint_subset[rotated, where A' = \"{ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"])\n apply (clarsimp simp:word_and_le2 Int_ac)+\n done\n\n\nlemma descendants_range_ex_cte':\n \"\\descendants_range_in' S p (ctes_of s'); ex_cte_cap_wp_to' P q s'; S \\ capRange (cteCap cte);\n invs' s'; ctes_of s' p = Some cte; isUntypedCap (cteCap cte)\\ \\ q \\ S\"\n apply (frule invs_valid_objs')\n apply (frule invs_mdb')\n apply (clarsimp simp:invs'_def valid_state'_def)\n apply (clarsimp simp: ex_cte_cap_to'_def cte_wp_at_ctes_of)\n apply (frule_tac cte = \"cte\" in valid_global_refsD')\n apply simp\n apply (case_tac \"\\irq. cteCap ctea = IRQHandlerCap irq\")\n apply clarsimp\n apply (erule(1) in_empty_interE[OF _ _ subsetD,rotated -1])\n apply (clarsimp simp:global_refs'_def)\n apply (erule_tac A = \"range P\" for P in subsetD)\n apply (simp add:range_eqI field_simps)\n apply (case_tac ctea)\n apply clarsimp\n apply (case_tac ctea)\n apply (drule_tac cte = \"cte\" and cte' = ctea in untyped_mdbD')\n apply assumption\n apply (clarsimp simp:isCap_simps)\n apply (drule_tac B = \"untypedRange (cteCap cte)\" in subsetD[rotated])\n apply (clarsimp simp:untypedCapRange)\n apply clarsimp\n apply (drule_tac x = \" (irq_node' s')\" in cte_refs_capRange[rotated])\n apply (erule(1) ctes_of_valid_cap')\n apply blast\n apply (clarsimp simp:isCap_simps)\n apply (simp add:valid_mdb'_def valid_mdb_ctes_def)\n apply (drule(2) descendants_range_inD')\n apply clarsimp\n apply (drule_tac x = \" (irq_node' s')\" in cte_refs_capRange[rotated])\n apply (erule(1) ctes_of_valid_cap')\n apply blast\n done\n\nlemma updateCap_isUntypedCap_corres:\n \"\\is_untyped_cap cap; isUntypedCap cap'; cap_relation cap cap'\\\n \\ corres dc\n (cte_wp_at (\\c. is_untyped_cap c \\ obj_ref_of c = obj_ref_of cap \\\n cap_bits c = cap_bits cap \\ cap_is_device c = cap_is_device cap) src and valid_objs and\n pspace_aligned and pspace_distinct)\n (cte_at' (cte_map src) and pspace_distinct' and pspace_aligned')\n (set_cap cap src) (updateCap (cte_map src) cap')\"\n apply (rule corres_name_pre)\n apply (simp add: updateCap_def)\n apply (frule state_relation_pspace_relation)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (frule pspace_relation_cte_wp_atI)\n apply (fastforce simp: cte_wp_at_ctes_of)\n apply simp\n apply clarify\n apply (frule cte_map_inj_eq)\n apply (fastforce simp: cte_wp_at_ctes_of cte_wp_at_caps_of_state)+\n apply (clarsimp simp: is_cap_simps isCap_simps)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_r)\n apply (rule_tac F = \"cteCap_update (\\_. capability.UntypedCap dev r bits f) ctea\n = cteCap_update (\\cap. capFreeIndex_update (\\_. f) (cteCap cte)) cte\"\n in corres_gen_asm2)\n apply (rule_tac F = \" (cap.UntypedCap dev r bits f) = free_index_update (\\_. f) c\"\n in corres_gen_asm)\n apply simp\n apply (rule setCTE_UntypedCap_corres)\n apply ((clarsimp simp: cte_wp_at_caps_of_state cte_wp_at_ctes_of)+)[3]\n apply (subst identity_eq)\n apply (wp getCTE_sp getCTE_get no_fail_getCTE)+\n apply (clarsimp simp: cte_wp_at_ctes_of cte_wp_at_caps_of_state)+\n done\n\nend\n\nlemma updateFreeIndex_corres:\n \"\\is_untyped_cap cap; free_index_of cap = idx \\\n \\ corres dc\n (cte_wp_at (\\c. is_untyped_cap c \\ obj_ref_of c = obj_ref_of cap \\\n cap_bits c = cap_bits cap \\ cap_is_device c = cap_is_device cap) src and valid_objs\n and pspace_aligned and pspace_distinct)\n (cte_at' (cte_map src)\n and pspace_distinct' and pspace_aligned')\n (set_cap cap src) (updateFreeIndex (cte_map src) idx)\"\n apply (rule corres_name_pre)\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_r_conj[where P'=\"cte_at' (cte_map src)\"])+\n apply (rule_tac F=\"isUntypedCap capa\n \\ cap_relation cap (capFreeIndex_update (\\_. idx) capa)\"\n in corres_gen_asm2)\n apply (rule updateCap_isUntypedCap_corres, simp+)\n apply (clarsimp simp: isCap_simps)\n apply simp\n apply (wp getSlotCap_wp)+\n apply (clarsimp simp: state_relation_def cte_wp_at_ctes_of)\n apply (rule no_fail_pre, wp no_fail_getSlotCap)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (wp getSlotCap_wp)+\n apply (clarsimp simp: state_relation_def cte_wp_at_ctes_of)\n apply (rule no_fail_pre, wp no_fail_getSlotCap)\n apply simp\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_ctes_of cte_wp_at_caps_of_state)\n apply (frule state_relation_pspace_relation)\n apply (frule(1) pspace_relation_ctes_ofI[OF _ caps_of_state_cteD], simp+)\n apply (clarsimp simp: isCap_simps is_cap_simps\n cte_wp_at_caps_of_state free_index_of_def)\n done\n\n\nlocale invokeUntyped_proofs =\n fixes s cref reset ptr_base ptr tp us slots sz idx dev\n assumes vui: \"valid_untyped_inv_wcap'\n (Invocations_H.Retype cref reset ptr_base ptr tp us slots dev)\n (Some (UntypedCap dev (ptr && ~~ mask sz) sz idx)) s\"\n and misc: \"ct_active' s\" \"invs' s\"\n\nbegin\n\nlemma cte_wp_at': \"cte_wp_at' (\\cte. cteCap cte = capability.UntypedCap\n dev (ptr && ~~ mask sz) sz idx) cref s\"\n and cover: \"range_cover ptr sz (APIType_capBits tp us) (length (slots::machine_word list))\"\n and misc2: \"distinct slots\"\n \"slots \\ []\"\n \"\\slot\\set slots. cte_wp_at' (\\c. cteCap c = capability.NullCap) slot s\"\n \"\\x\\set slots. ex_cte_cap_wp_to' (\\_. True) x s\"\n using vui\n by (auto simp: cte_wp_at_ctes_of)\n\ninterpretation Arch . (*FIXME: arch_split*)\n\nlemma idx_cases:\n \"((\\ reset \\ idx \\ unat (ptr - (ptr && ~~ mask sz))) \\ reset \\ ptr = ptr && ~~ mask sz)\"\n using vui\n by (clarsimp simp: cte_wp_at_ctes_of)\n\nlemma desc_range:\n \"reset \\ descendants_range_in' (mask_range ptr sz) (cref) (ctes_of s)\"\n using vui by (clarsimp simp: empty_descendants_range_in')\n\nabbreviation(input)\n \"retype_range == {ptr..ptr + of_nat (length slots) * 2 ^ APIType_capBits tp us - 1}\"\n\nabbreviation(input)\n \"usable_range == {ptr..(ptr && ~~ mask sz) + mask sz}\"\n\nlemma not_0_ptr[simp]: \"ptr\\ 0\"\n using misc cte_wp_at'\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (case_tac cte)\n apply clarsimp\n apply (drule(1) ctes_of_valid_cap'[OF _ invs_valid_objs'])\n apply (simp add: valid_cap'_def)\n done\n\nlemmas range_cover_subset'' = range_cover_subset'[simplified add_mask_fold]\n\nlemma subset_stuff[simp]:\n \"retype_range \\ usable_range\"\n apply (rule range_cover_subset''[OF cover])\n apply (simp add:misc2)\n done\n\nlemma descendants_range[simp]:\n \"descendants_range_in' usable_range cref (ctes_of s)\"\n \"descendants_range_in' retype_range cref (ctes_of s)\"\nproof -\n have \"descendants_range_in' usable_range cref (ctes_of s)\"\n using misc idx_cases cte_wp_at' cover\n apply -\n apply (erule disjE)\n apply (erule cte_wp_at_caps_descendants_range_inI'\n [OF _ _ _ range_cover.sz(1)[where 'a=machine_word_len, folded word_bits_def]])\n apply simp+\n using desc_range\n apply simp\n done\n thus \"descendants_range_in' usable_range cref (ctes_of s)\"\n by simp\n thus \"descendants_range_in' retype_range cref (ctes_of s)\"\n by (rule descendants_range_in_subseteq'[OF _ subset_stuff])\nqed\n\nlemma vc'[simp] : \"s \\' capability.UntypedCap dev (ptr && ~~ mask sz) sz idx\"\n using misc cte_wp_at'\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (case_tac cte)\n apply clarsimp\n apply (erule ctes_of_valid_cap')\n apply (simp add: invs_valid_objs')\n done\n\nlemma ptr_cn[simp]:\n \"canonical_address (ptr && ~~ mask sz)\"\n using vc' unfolding valid_cap'_def by (clarsimp simp: kernel_mappings_canonical)\n\nlemma ptr_km[simp]:\n \"ptr && ~~ mask sz \\ kernel_mappings\"\n using vc' unfolding valid_cap'_def by clarsimp\n\nlemma sz_limit[simp]:\n \"sz \\ maxUntypedSizeBits\"\n using vc' unfolding valid_cap'_def by clarsimp\n\nlemma ps_no_overlap'[simp]: \"\\ reset \\ pspace_no_overlap' ptr sz s\"\n using misc cte_wp_at' cover idx_cases\n apply clarsimp\n apply (erule cte_wp_at_pspace_no_overlapI'\n [OF _ _ _ range_cover.sz(1)[where 'a=machine_word_len, folded word_bits_def]])\n apply (simp add: cte_wp_at_ctes_of)\n apply simp+\n done\n\nlemma caps_no_overlap'[simp]: \"caps_no_overlap'' ptr sz s\"\n using cte_wp_at' misc cover desc_range idx_cases\n apply -\n apply (erule disjE)\n apply (erule cte_wp_at_caps_no_overlapI'\n [OF _ _ _ range_cover.sz(1)[where 'a=machine_word_len, folded word_bits_def]])\n apply simp+\n apply (erule descendants_range_caps_no_overlapI')\n apply simp+\n done\n\nlemma idx_compare'[simp]:\n \"unat ((ptr && mask sz) + (of_nat (length slots)<< (APIType_capBits tp us))) \\ 2 ^ sz\"\n apply (rule le_trans[OF unat_plus_gt])\n apply (simp add: range_cover.unat_of_nat_n_shift[OF cover] range_cover_unat)\n apply (insert range_cover.range_cover_compare_bound[OF cover])\n apply simp\n done\n\nlemma ex_cte_no_overlap':\n \"\\P p. ex_cte_cap_wp_to' P p s \\ p \\ usable_range\"\n using cte_wp_at' misc\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule_tac cte = cte in descendants_range_ex_cte'[OF descendants_range(1)])\n apply (clarsimp simp: word_and_le2 isCap_simps add_mask_fold)+\n done\n\nlemma cref_inv: \"cref \\ usable_range\"\n apply (insert misc cte_wp_at')\n apply (drule if_unsafe_then_capD')\n apply (simp add: invs'_def valid_state'_def)\n apply simp\n apply (erule ex_cte_no_overlap')\n done\n\nlemma slots_invD:\n \"\\x. x \\ set slots \\ x \\ cref \\ x \\ usable_range \\ ex_cte_cap_wp_to' (\\_. True) x s\"\n using misc cte_wp_at' vui\n apply clarsimp\n apply (drule(1) bspec)+\n apply (drule ex_cte_no_overlap')\n apply simp\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma usableRange_disjoint:\n \"usableUntypedRange (capability.UntypedCap d (ptr && ~~ mask sz) sz\n (unat ((ptr && mask sz) + of_nat (length slots) * 2 ^ APIType_capBits tp us))) \\\n {ptr..ptr + of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {}\"\nproof -\n have idx_compare''[simp]:\n \"unat ((ptr && mask sz) + (of_nat (length slots) * (2::machine_word) ^ APIType_capBits tp us)) < 2 ^ sz\n \\ ptr + of_nat (length slots) * 2 ^ APIType_capBits tp us - 1\n < ptr + of_nat (length slots) * 2 ^ APIType_capBits tp us\"\n apply (rule word_leq_le_minus_one,simp)\n apply (rule neq_0_no_wrap)\n apply (rule machine_word_plus_mono_right_split)\n apply (simp add: shiftl_t2n range_cover_unat[OF cover] field_simps)\n apply (simp add: range_cover.sz(1)[where 'a=machine_word_len, folded word_bits_def, OF cover])+\n done\n show ?thesis\n apply (clarsimp simp: mask_out_sub_mask)\n apply (drule idx_compare'')\n apply simp\n done\nqed\n\nlemma szw: \"sz < word_bits\"\n using cte_wp_at_valid_objs_valid_cap'[OF cte_wp_at'] misc\n by (clarsimp simp: valid_cap_simps' capAligned_def invs_valid_objs')\n\nlemma idx_le_new_offs:\n \"\\ reset\n \\ idx \\ unat ((ptr && mask sz) + (of_nat (length slots) * 2 ^ (APIType_capBits tp us)))\"\n using misc idx_cases range_cover.range_cover_base_le[OF cover]\n apply (clarsimp simp only: simp_thms)\n apply (erule order_trans)\n apply (simp add: word_le_nat_alt[symmetric]\n shiftl_t2n mult.commute)\n done\n\nend\n\nlemma valid_sched_etcbs[elim!]: \"valid_sched_2 queues ekh sa cdom kh ct it \\ valid_etcbs_2 ekh kh\"\n by (simp add: valid_sched_def)\n\ncrunch ksIdleThread[wp]: deleteObjects \"\\s. P (ksIdleThread s)\"\n (simp: crunch_simps wp: hoare_drop_imps unless_wp)\ncrunch ksCurDomain[wp]: deleteObjects \"\\s. P (ksCurDomain s)\"\n (simp: crunch_simps wp: hoare_drop_imps unless_wp)\ncrunch irq_node[wp]: deleteObjects \"\\s. P (irq_node' s)\"\n (simp: crunch_simps wp: hoare_drop_imps unless_wp)\n\nlemma deleteObjects_ksCurThread[wp]:\n \"\\\\s. P (ksCurThread s)\\ deleteObjects ptr sz \\\\_ s. P (ksCurThread s)\\\"\n apply (simp add: deleteObjects_def3)\n apply (wp | simp add: doMachineOp_def split_def)+\n done\n\nlemma deleteObjects_ct_active':\n \"\\invs' and sch_act_simple and ct_active'\n and cte_wp_at' (\\c. cteCap c = UntypedCap d ptr sz idx) cref\n and (\\s. descendants_range' (UntypedCap d ptr sz idx) cref (ctes_of s))\n and K (sz < word_bits \\ is_aligned ptr sz)\\\n deleteObjects ptr sz\n \\\\_. ct_active'\\\"\n apply (simp add: ct_in_state'_def)\n apply (rule hoare_pre)\n apply wps\n apply (wp deleteObjects_st_tcb_at')\n apply (auto simp: ct_in_state'_def elim: pred_tcb'_weakenE)\n done\n\ndefs cNodeOverlap_def:\n \"cNodeOverlap \\ \\cns inRange. \\p n. cns p = Some n \\ (\\ is_aligned p (cte_level_bits + n)\n \\ cte_level_bits + n \\ word_bits\n \\ ({p .. p + 2 ^ (cte_level_bits + n) - 1} \\ {p. inRange p} \\ {}))\"\n\nlemma cNodeNoOverlap:\n notes Int_atLeastAtMost[simp del]\n shows\n \"corres dc (\\s. \\cref. cte_wp_at (\\cap. is_untyped_cap cap\n \\ Collect R \\ usable_untyped_range cap) cref s\n \\ valid_objs s \\ pspace_aligned s)\n \\\n (return x) (stateAssert (\\s. \\ cNodeOverlap (gsCNodes s) R) [])\"\n apply (simp add: stateAssert_def assert_def)\n apply (rule corres_symb_exec_r[OF _ get_sp])\n apply (rule corres_req[rotated], subst if_P, assumption)\n apply simp\n apply (clarsimp simp: cNodeOverlap_def cte_wp_at_caps_of_state)\n apply (frule(1) caps_of_state_valid_cap)\n apply (frule usable_range_subseteq[rotated], simp add: valid_cap_def)\n apply (clarsimp simp: valid_cap_def valid_untyped_def cap_table_at_gsCNodes_eq\n obj_at_def is_cap_table is_cap_simps)\n apply (frule(1) pspace_alignedD)\n apply simp\n apply (elim allE, drule(1) mp, simp add: obj_range_def valid_obj_def cap_aligned_def)\n apply (erule is_aligned_get_word_bits[where 'a=machine_word_len, folded word_bits_def])\n apply (clarsimp simp: is_aligned_no_overflow simp del: )\n apply blast\n apply (simp add: is_aligned_no_overflow power_overflow word_bits_def\n Int_atLeastAtMost)\n apply wp+\n done\n\nlemma reset_ineq_eq_idx_0:\n \"\\ idx \\ 2 ^ sz; b \\ sz; (ptr :: obj_ref) \\ 0; is_aligned ptr sz; sz < word_bits \\\n \\ (ptr + of_nat idx - 1 < ptr) = (idx = 0)\"\n apply (cases \"idx = 0\")\n apply (simp add: gt0_iff_gem1[symmetric] word_neq_0_conv)\n apply simp\n apply (subgoal_tac \"ptr \\ ptr + of_nat idx - 1\", simp_all)[1]\n apply (subst field_simps[symmetric], erule is_aligned_no_wrap')\n apply (subst word_less_nat_alt)\n apply simp\n apply (subst unat_of_nat_minus_1)\n apply (erule order_le_less_trans, rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (rule notI, simp)\n apply (erule order_less_le_trans[rotated])\n apply simp\n done\n\nlemma reset_addrs_same:\n \"\\ idx \\ 2 ^ sz; resetChunkBits \\ sz; ptr \\ 0; is_aligned ptr sz; sz < word_bits \\\n \\ [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] =\n map (\\i. getFreeRef ptr (i * 2 ^ resetChunkBits))\n [i\\[0..<2 ^ (sz - resetChunkBits)]. i * 2 ^ resetChunkBits < idx]\"\n apply (simp add: upto_enum_step_def getFreeRef_def reset_ineq_eq_idx_0)\n apply (clarsimp simp: upto_enum_word o_def unat_div simp del: upt.simps)\n apply (subst unat_of_nat_minus_1)\n apply (rule_tac y=\"2 ^ sz\" in order_le_less_trans, simp)\n apply (rule power_strict_increasing, simp_all add: word_bits_def)[1]\n apply simp\n apply (rule_tac f=\"map f\" for f in arg_cong)\n apply (rule filter_upt_eq[symmetric])\n apply clarsimp\n apply (erule order_le_less_trans[rotated])\n apply simp\n apply (rule notI)\n apply (drule order_less_le_trans[where x=\"a * b\" for a b],\n rule_tac m=\"2 ^ resetChunkBits\" and n=idx in alignUp_ge_nat)\n apply simp+\n apply (simp add: field_simps)\n apply (simp only: mult_Suc_right[symmetric])\n apply (subst(asm) div_add_self1[where 'a=nat, simplified, symmetric])\n apply simp\n apply (simp only: field_simps)\n apply simp\n apply clarsimp\n apply (rule order_le_less_trans, rule div_mult_le, simp)\n apply (simp add: Suc_le_eq td_gal_lt[symmetric] power_add[symmetric])\n done\n\nlemmas descendants_of_null_filter' = null_filter_descendants_of'[OF null_filter_simp']\n\nlemmas deleteObjects_descendants\n = deleteObjects_null_filter[where P=\"\\c. Q (descendants_of' p c)\" for p Q,\n simplified descendants_of_null_filter']\n\nlemma updateFreeIndex_descendants_of2:\n \" \\\\s. cte_wp_at' (isUntypedCap o cteCap) ptr s \\\n P (\\y. descendants_of' y (ctes_of s))\\\n updateFreeIndex ptr index\n \\\\r s. P (\\y. descendants_of' y (ctes_of s))\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateFreeIndex_descendants_of'[simplified swp_def descendants_of_null_filter']\n getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n done\n\ncrunch typ_at'[wp]: updateFreeIndex \"\\s. P (typ_at' T p s)\"\n\nlemma updateFreeIndex_cte_wp_at:\n \"\\\\s. cte_wp_at' (\\c. P (cteCap_update (if p = slot\n then capFreeIndex_update (\\_. idx) else id) c)) p s\\\n updateFreeIndex slot idx\n \\\\rv. cte_wp_at' P p\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def split del: if_split)\n apply (rule hoare_pre, wp updateCap_cte_wp_at' getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (case_tac \"the (ctes_of s p)\")\n apply (auto split: if_split_asm)\n done\n\nlemma ex_tupI:\n \"P (fst x) (snd x) \\ \\a b. P a b\"\n by blast\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma resetUntypedCap_corres:\n \"untypinv_relation ui ui'\n \\ corres (dc \\ dc)\n (invs and valid_untyped_inv_wcap ui\n (Some (cap.UntypedCap dev ptr sz idx))\n and ct_active and einvs\n and (\\_. \\ptr_base ptr' ty us slots dev'. ui = Invocations_A.Retype slot True\n ptr_base ptr' ty us slots dev))\n (invs' and valid_untyped_inv_wcap' ui' (Some (UntypedCap dev ptr sz idx)) and ct_active')\n (reset_untyped_cap slot)\n (resetUntypedCap (cte_map slot))\"\n apply (rule corres_gen_asm, clarsimp)\n apply (simp add: reset_untyped_cap_def resetUntypedCap_def liftE_bindE cong: if_cong)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF getSlotCap_corres])\n apply simp\n apply (rule_tac F=\"cap = cap.UntypedCap dev ptr sz idx \\ (\\s. s \\ cap)\" in corres_gen_asm)\n apply (clarsimp simp: bits_of_def free_index_of_def unlessE_def\n split del: if_split cong: if_cong)\n apply (rule corres_if[OF refl])\n apply (rule corres_returnOk[where P=\\ and P'=\\], simp)\n apply (rule corres_split[OF deleteObjects_corres])\n apply (clarsimp simp add: valid_cap_def cap_aligned_def)\n apply (clarsimp simp add: valid_cap_def cap_aligned_def untyped_min_bits_def)\n apply (rule corres_if)\n apply simp\n apply (simp add: bits_of_def shiftL_nat)\n apply (rule corres_split_nor)\n apply (simp add: unless_def)\n apply (rule corres_when, simp)\n apply (rule corres_machine_op)\n apply (rule corres_Id, simp, simp, wp)\n apply (rule updateFreeIndex_corres, simp)\n apply (simp add: free_index_of_def)\n apply (wp | simp only: unless_def)+\n apply (rule_tac F=\"sz < word_bits \\ idx \\ 2 ^ sz\n \\ ptr \\ 0 \\ is_aligned ptr sz\n \\ resetChunkBits \\ sz\" in corres_gen_asm)\n apply (simp add: bits_of_def free_index_of_def mapME_x_map_simp liftE_bindE\n reset_addrs_same[where ptr=ptr and idx=idx and sz=sz]\n o_def rev_map\n del: capFreeIndex_update.simps)\n apply (rule_tac P=\"\\x. valid_objs and pspace_aligned and pspace_distinct\n and pspace_no_overlap {ptr .. ptr + 2 ^ sz - 1}\n and cte_wp_at (\\a. is_untyped_cap a \\ obj_ref_of a = ptr \\ cap_bits a = sz\n \\ cap_is_device a = dev) slot\"\n and P'=\"\\_. valid_pspace' and (\\s. descendants_of' (cte_map slot) (ctes_of s) = {})\n and pspace_no_overlap' ptr sz\n and cte_wp_at' (\\cte. \\idx. cteCap cte = UntypedCap dev ptr sz idx) (cte_map slot)\"\n in mapME_x_corres_same_xs)\n apply (rule corres_guard_imp)\n apply (rule corres_split_nor)\n apply (rule corres_machine_op)\n apply (rule corres_Id)\n apply (simp add: shiftL_nat getFreeRef_def shiftl_t2n mult.commute)\n apply simp\n apply wp\n apply (rule corres_split_nor[OF updateFreeIndex_corres])\n apply simp\n apply (simp add: getFreeRef_def getFreeIndex_def free_index_of_def)\n apply clarify\n apply (subst unat_mult_simple)\n apply (subst unat_of_nat_eq)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (erule order_less_le_trans; simp)\n apply (subst unat_p2)\n apply (simp add: Kernel_Config.resetChunkBits_def)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (subst unat_of_nat_eq)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (erule order_less_le_trans; simp)\n apply simp\n apply (rule preemptionPoint_corres)\n apply wp+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp: getFreeRef_def valid_pspace'_def cte_wp_at_ctes_of\n valid_cap_def cap_aligned_def)\n apply (erule aligned_add_aligned)\n apply (rule is_aligned_weaken)\n apply (rule is_aligned_mult_triv2)\n apply (simp add: Kernel_Config.resetChunkBits_def)\n apply (simp add: untyped_min_bits_def)\n apply (rule hoare_pre)\n apply simp\n apply (strengthen imp_consequent)\n apply (wp preemption_point_inv set_cap_cte_wp_at update_untyped_cap_valid_objs\n set_cap_no_overlap | simp)+\n apply (clarsimp simp: exI cte_wp_at_caps_of_state)\n apply (drule caps_of_state_valid_cap, simp+)\n apply (clarsimp simp: is_cap_simps valid_cap_simps\n cap_aligned_def\n valid_untyped_pspace_no_overlap)\n apply (rule hoare_pre)\n apply (simp del: capFreeIndex_update.simps)\n apply (strengthen imp_consequent)\n apply (wp updateFreeIndex_valid_pspace_no_overlap'\n updateFreeIndex_descendants_of2\n doMachineOp_psp_no_overlap\n updateFreeIndex_cte_wp_at\n pspace_no_overlap'_lift\n preemptionPoint_inv\n hoare_vcg_ex_lift\n | simp)+\n apply (clarsimp simp add: cte_wp_at_ctes_of exI isCap_simps valid_pspace'_def)\n apply (clarsimp simp: getFreeIndex_def getFreeRef_def)\n apply (subst is_aligned_weaken[OF is_aligned_mult_triv2])\n apply (simp add: Kernel_Config.resetChunkBits_def minUntypedSizeBits_def)\n apply (subst unat_mult_simple)\n apply (subst unat_of_nat_eq)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (erule order_less_le_trans; simp)\n apply (subst unat_p2)\n apply (simp add: Kernel_Config.resetChunkBits_def)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (subst unat_of_nat_eq)\n apply (rule order_less_trans[rotated],\n rule_tac n=sz in power_strict_increasing; simp add: word_bits_def)\n apply (erule order_less_le_trans; simp)\n apply simp\n apply simp\n apply (simp add: if_apply_def2)\n apply (strengthen invs_valid_objs invs_psp_aligned invs_distinct)\n apply (wp hoare_vcg_const_imp_lift)\n apply (simp add: if_apply_def2)\n apply (strengthen invs_pspace_aligned' invs_pspace_distinct'\n invs_valid_pspace')\n apply (wp hoare_vcg_const_imp_lift deleteObjects_cte_wp_at'[where p=\"cte_map slot\"]\n deleteObjects_invs'[where p=\"cte_map slot\"]\n deleteObjects_descendants[where p=\"cte_map slot\"]\n | simp)+\n apply (wp get_cap_wp getCTE_wp' | simp add: getSlotCap_def)+\n apply (clarsimp simp: cte_wp_at_caps_of_state descendants_range_def2)\n apply (cases slot)\n apply (strengthen empty_descendants_range_in\n ex_tupI[where x=slot])+\n apply (frule(1) caps_of_state_valid)\n apply (clarsimp simp: valid_cap_simps cap_aligned_def)\n apply (frule(1) caps_of_state_valid)\n apply (frule if_unsafe_then_capD[OF caps_of_state_cteD], clarsimp+)\n apply (drule(1) ex_cte_cap_protects[OF _ caps_of_state_cteD\n empty_descendants_range_in _ order_refl]; clarsimp)\n apply (intro conjI impI; auto)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of descendants_range'_def2\n empty_descendants_range_in')\n apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+)\n apply (clarsimp simp: valid_cap_simps' capAligned_def is_aligned_weaken untypedBits_defs)\n apply (frule if_unsafe_then_capD'[OF ctes_of_cte_wpD], clarsimp+)\n apply (frule(1) descendants_range_ex_cte'[OF empty_descendants_range_in' _ order_refl],\n (simp add: isCap_simps add_mask_fold)+)\n by (intro conjI impI; clarsimp)\n\nend\n\nlemma deleteObjects_ex_cte_cap_wp_to':\n \"\\invs' and ex_cte_cap_wp_to' P slot and (\\s. descendants_of' p (ctes_of s) = {})\n and cte_wp_at' (\\cte. \\idx d. cteCap cte = UntypedCap d ptr sz idx) p\\\n deleteObjects ptr sz\n \\\\rv. ex_cte_cap_wp_to' P slot\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (rule hoare_pre)\n apply (simp add: ex_cte_cap_wp_to'_def)\n apply wps\n apply (wp hoare_vcg_ex_lift)\n apply (rule_tac idx=idx in deleteObjects_cte_wp_at')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (frule ctes_of_valid[OF ctes_of_cte_wpD], clarsimp+)\n apply (clarsimp simp: ex_cte_cap_wp_to'_def\n cte_wp_at_ctes_of)\n apply (rule_tac x=cref in exI, simp)\n apply (frule_tac p=cref in if_unsafe_then_capD'[OF ctes_of_cte_wpD], clarsimp+)\n apply (frule descendants_range_ex_cte'[rotated, OF _ order_refl, where p=p],\n (simp add: isCap_simps empty_descendants_range_in')+)\n apply (auto simp: add_mask_fold)\n done\n\nlemma updateCap_cte_cap_wp_to':\n \"\\\\s. cte_wp_at' (\\cte. p' \\ cte_refs' (cteCap cte) (irq_node' s) \\ P (cteCap cte)\n \\ p' \\ cte_refs' cap (irq_node' s) \\ P cap) p s\n \\ ex_cte_cap_wp_to' P p' s\\\n updateCap p cap\n \\\\rv. ex_cte_cap_wp_to' P p'\\\"\n apply (simp add: ex_cte_cap_wp_to'_def cte_wp_at_ctes_of updateCap_def)\n apply (rule hoare_pre, (wp getCTE_wp | wps)+)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (rule_tac x=cref in exI)\n apply auto\n done\n\ncrunch ct_in_state'[wp]: doMachineOp \"ct_in_state' P\"\n (simp: crunch_simps ct_in_state'_def)\n\ncrunch st_tcb_at'[wp]: doMachineOp \"st_tcb_at' P p\"\n (simp: crunch_simps ct_in_state'_def)\n\nlemma ex_cte_cap_wp_to_irq_state_independent_H[simp]:\n \"irq_state_independent_H (ex_cte_cap_wp_to' P slot)\"\n by (simp add: ex_cte_cap_wp_to'_def)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma updateFreeIndex_ctes_of:\n \"\\\\s. P (modify_map (ctes_of s) ptr (cteCap_update (capFreeIndex_update (\\_. idx))))\\\n updateFreeIndex ptr idx\n \\\\r s. P (ctes_of s)\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateCap_ctes_of_wp getCTE_wp' | simp)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule rsubst[where P=P])\n apply (case_tac cte)\n apply (clarsimp simp: modify_map_def fun_eq_iff)\n done\n\nlemma updateFreeIndex_cte_cap_wp_to'[wp]:\n \"\\\\s. cte_wp_at' (isUntypedCap o cteCap) p s\n \\ ex_cte_cap_wp_to' P p' s\\\n updateFreeIndex p idx\n \\\\rv. ex_cte_cap_wp_to' P p'\\\"\n apply (simp add: updateFreeIndex_def updateTrackedFreeIndex_def getSlotCap_def)\n apply (wp updateCap_cte_cap_wp_to' getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (clarsimp simp: isCap_simps ex_cte_cap_wp_to'_def split: option.split)\n done\n\nlemma setCTE_ct_in_state:\n \"\\ct_in_state' P\\ setCTE p cte \\\\rv. ct_in_state' P\\\"\n apply (rule hoare_name_pre_state)\n apply (rule hoare_pre, wp ct_in_state'_decomp setCTE_pred_tcb_at')\n apply (auto simp: ct_in_state'_def)\n done\n\ncrunch ct_in_state[wp]: updateFreeIndex \"ct_in_state' P\"\ncrunch nosch[wp]: updateFreeIndex \"\\s. P (ksSchedulerAction s)\"\n\nlemma resetUntypedCap_invs_etc:\n \"\\invs' and valid_untyped_inv_wcap' ui\n (Some (UntypedCap dev ptr sz idx))\n and ct_active'\n and K (\\ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\\\n resetUntypedCap slot\n \\\\_. invs' and valid_untyped_inv_wcap' ui (Some (UntypedCap dev ptr sz 0))\n and ct_active'\n and pspace_no_overlap' ptr sz\\, \\\\_. invs'\\\"\n (is \"\\invs' and valid_untyped_inv_wcap' ?ui (Some ?cap) and ct_active' and ?asm\\\n ?f \\\\_. invs' and ?vu2 and ct_active' and ?psp\\, \\\\_. invs'\\\")\n apply (simp add: resetUntypedCap_def getSlotCap_def\n liftE_bind_return_bindE_returnOk bindE_assoc)\n apply (rule hoare_vcg_seqE[rotated])\n apply simp\n apply (rule getCTE_sp)\n apply (rule hoare_name_pre_stateE)\n apply (clarsimp split del: if_split)\n apply (subgoal_tac \"capAligned ?cap\")\n prefer 2\n apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp+)\n apply (clarsimp simp: cte_wp_at_ctes_of capAligned_def valid_cap_simps')\n apply (cases \"idx = 0\")\n apply (clarsimp simp: cte_wp_at_ctes_of unlessE_def split del: if_split)\n apply wp\n apply (clarsimp simp: valid_cap_simps' capAligned_def)\n apply (rule cte_wp_at_pspace_no_overlapI'[where cref=slot],\n (simp_all add: cte_wp_at_ctes_of)+)[1]\n apply (clarsimp simp: unlessE_def cte_wp_at_ctes_of\n split del: if_split)\n apply (rule_tac B=\"\\_. invs' and valid_untyped_inv_wcap' ?ui (Some ?cap)\n and ct_active' and ?psp\" in hoare_vcg_seqE[rotated])\n apply clarsimp\n apply (rule hoare_pre)\n apply (simp add: sch_act_simple_def)\n apply (wps )\n apply (wp deleteObject_no_overlap[where idx=idx]\n deleteObjects_invs'[where idx=idx and p=slot]\n hoare_vcg_ex_lift hoare_vcg_const_Ball_lift\n deleteObjects_cte_wp_at'[where idx=idx]\n deleteObjects_descendants[where p=slot]\n deleteObjects_nosch\n deleteObjects_ct_active'[where idx=idx and cref=slot]\n deleteObjects_ex_cte_cap_wp_to'[where p=slot])\n apply (clarsimp simp: cte_wp_at_ctes_of descendants_range'_def2\n empty_descendants_range_in'\n capAligned_def sch_act_simple_def)\n apply (strengthen refl)\n apply (frule ctes_of_valid[OF ctes_of_cte_wpD], clarsimp+)\n apply (frule if_unsafe_then_capD'[OF ctes_of_cte_wpD], clarsimp+)\n apply (erule rev_mp[where P=\"Ball S f\" for S f]\n rev_mp[where P=\"ex_cte_cap_wp_to' P p s\" for P p s])+\n apply (strengthen descendants_range_ex_cte'[rotated, OF _ order_refl, mk_strg D _ E])\n apply (clarsimp simp: isCap_simps empty_descendants_range_in' add_mask_fold)\n apply auto[1]\n apply (cases \"dev \\ sz < resetChunkBits\")\n apply (simp add: pred_conj_def unless_def)\n apply (rule hoare_pre)\n apply (strengthen exI[where x=sz])\n apply (wp updateFreeIndex_clear_invs'\n hoare_vcg_ex_lift\n hoare_vcg_const_Ball_lift\n updateFreeIndex_descendants_of2\n sch_act_simple_lift\n pspace_no_overlap'_lift\n doMachineOp_psp_no_overlap\n updateFreeIndex_ctes_of\n updateFreeIndex_cte_wp_at\n | simp | wps | wp (once) ex_cte_cap_to'_pres)+\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps\n modify_map_def)\n apply auto[1]\n apply simp\n apply (rule hoare_pre, rule hoare_post_impErr,\n rule_tac P=\"\\i. invs' and ?psp and ct_active' and valid_untyped_inv_wcap' ?ui\n (Some (UntypedCap dev ptr sz (if i = 0 then idx\n else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)))\"\n and E=\"\\_. invs'\"\n in mapME_x_validE_nth)\n apply (rule hoare_pre)\n apply simp\n apply (wp preemptionPoint_invs\n updateFreeIndex_clear_invs'\n hoare_vcg_ex_lift\n updateFreeIndex_descendants_of2\n updateFreeIndex_ctes_of\n updateFreeIndex_cte_wp_at\n doMachineOp_psp_no_overlap\n hoare_vcg_ex_lift hoare_vcg_const_Ball_lift\n pspace_no_overlap'_lift[OF preemptionPoint_inv]\n pspace_no_overlap'_lift\n updateFreeIndex_ct_in_state[unfolded ct_in_state'_def]\n | strengthen invs_pspace_aligned' invs_pspace_distinct'\n | simp add: ct_in_state'_def\n sch_act_simple_def\n | rule hoare_vcg_conj_lift_R\n | wp (once) preemptionPoint_inv\n | wps\n | wp (once) ex_cte_cap_to'_pres)+\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps\n conj_comms)\n apply (subgoal_tac \"getFreeIndex ptr\n (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)\n = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) *\n 2 ^ resetChunkBits\")\n apply clarsimp\n apply (frule ctes_of_valid[OF ctes_of_cte_wpD], clarsimp+)\n apply (subgoal_tac \"resetChunkBits < word_bits \\ sz < word_bits\")\n apply (strengthen is_aligned_weaken[OF is_aligned_mult_triv2])\n apply (subst nat_less_power_trans2[THEN order_less_imp_le])\n apply (clarsimp simp add: upto_enum_step_def getFreeRef_def)\n apply (rule less_imp_diff_less)\n apply (simp add: unat_div td_gal_lt[symmetric] power_add[symmetric])\n apply (cases \"idx = 0\")\n apply (simp add: gt0_iff_gem1[symmetric, folded word_neq_0_conv])\n apply (simp add: valid_cap_simps')\n apply (subst unat_minus_one)\n apply (clarsimp simp: valid_cap_simps')\n apply (drule of_nat64_0)\n apply (erule order_le_less_trans, simp)\n apply simp\n apply (clarsimp simp: unat_of_nat valid_cap_simps')\n apply (erule order_less_le_trans[rotated], simp)\n apply simp\n apply (auto simp: Kernel_Config.resetChunkBits_def minUntypedSizeBits_def)[1]\n apply (simp add: valid_cap_simps' Kernel_Config.resetChunkBits_def capAligned_def)\n apply (simp add: nth_rev)\n apply (simp add: upto_enum_step_def upto_enum_word getFreeIndex_def\n getFreeRef_def\n del: upt.simps)\n apply (intro conjI impI, simp_all)[1]\n apply (subgoal_tac \"resetChunkBits < word_bits\")\n apply (rule word_unat.Abs_eqD[OF _ word_unat.Rep])\n apply (simp add: word_of_nat_plus Abs_fnat_hom_mult[symmetric])\n apply (simp only: unats_def word_bits_def[symmetric])\n apply (clarsimp simp: unat_div nat_mult_power_less_eq)\n apply (rule less_imp_diff_less)\n apply (simp add: td_gal_lt[symmetric] power_add[symmetric])\n apply (simp only: unat_lt2p word_bits_def)\n apply (simp add: Kernel_Config.resetChunkBits_def word_bits_def)\n apply (clarsimp simp: cte_wp_at_ctes_of getFreeRef_def\n upto_enum_step_def upto_enum_word)\n apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+)\n apply (clarsimp simp: valid_cap_simps' capAligned_def)\n apply (simp add: reset_ineq_eq_idx_0)\n apply simp\n apply clarsimp\n done\n\nend\n\nlemma whenE_reset_resetUntypedCap_invs_etc:\n \"\\invs' and valid_untyped_inv_wcap' ui\n (Some (UntypedCap dev ptr sz idx))\n and ct_active'\n and K (\\ptr_base ty us slots. ui = Retype slot reset ptr_base ptr' ty us slots dev)\\\n whenE reset (resetUntypedCap slot)\n \\\\_. invs' and valid_untyped_inv_wcap' ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx)))\n and ct_active'\n and pspace_no_overlap' (if reset then ptr else ptr') sz\\, \\\\_. invs'\\\"\n apply (rule hoare_pre)\n apply (wp whenE_wp resetUntypedCap_invs_etc[where idx=idx,\n simplified pred_conj_def conj_assoc]\n | simp)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+)\n apply (clarsimp simp: valid_cap_simps' capAligned_def)\n apply (drule_tac cref=slot in cte_wp_at_pspace_no_overlapI',\n simp add: cte_wp_at_ctes_of, simp+)\n done\n\ncrunch ksCurDomain[wp]: updateFreeIndex \"\\s. P (ksCurDomain s)\"\n\nlemma (in range_cover) funky_aligned:\n \"is_aligned ((ptr && foo) + v * 2 ^ sbit) sbit\"\n apply (rule aligned_add_aligned)\n apply (rule is_aligned_andI1)\n apply (rule aligned)\n apply (rule is_aligned_mult_triv2)\n apply simp\n done\n\ndefs canonicalAddressAssert_def:\n \"canonicalAddressAssert p \\ RISCV64.canonical_address p\"\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma inv_untyped_corres':\n \"\\ untypinv_relation ui ui' \\ \\\n corres (dc \\ (=))\n (einvs and valid_untyped_inv ui and ct_active)\n (invs' and valid_untyped_inv' ui' and ct_active')\n (invoke_untyped ui) (invokeUntyped ui')\"\n apply (cases ui)\n apply (rule corres_name_pre)\n apply (clarsimp simp only: valid_untyped_inv_wcap\n valid_untyped_inv_wcap'\n Invocations_A.untyped_invocation.simps\n Invocations_H.untyped_invocation.simps\n untypinv_relation.simps)\n apply (rename_tac cref oref reset ptr ptr' dc us slots dev s s' ao' sz sz' idx idx')\n proof -\n fix cref reset ptr ptr_base us slots dev ao' sz sz' idx idx' s s'\n\n let ?ui = \"Invocations_A.Retype cref reset ptr_base ptr (APIType_map2 (Inr ao')) us slots dev\"\n let ?ui' = \"Invocations_H.untyped_invocation.Retype\n (cte_map cref) reset ptr_base ptr ao' us (map cte_map slots) dev\"\n\n assume invs: \"invs (s :: det_state)\" \"ct_active s\" \"valid_list s\" \"valid_sched s\"\n and invs': \"invs' s'\" \"ct_active' s'\"\n and sr: \"(s, s') \\ state_relation\"\n and vui: \"valid_untyped_inv_wcap ?ui (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s\"\n (is \"valid_untyped_inv_wcap _ (Some ?cap) s\")\n and vui': \"valid_untyped_inv_wcap' ?ui' (Some (UntypedCap dev (ptr && ~~ mask sz') sz' idx')) s'\"\n assume ui: \"ui = ?ui\" and ui': \"ui' = ?ui'\"\n\n have cte_at: \"cte_wp_at ((=) ?cap) cref s\" (is \"?cte_cond s\")\n using vui by (simp add:cte_wp_at_caps_of_state)\n\n have ptr_sz_simp[simp]: \"ptr_base = ptr && ~~ mask sz\n \\ sz' = sz \\ idx' = idx \\ 2 \\ sz\"\n using cte_at vui vui' sr invs\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule pspace_relation_cte_wp_atI'[OF state_relation_pspace_relation])\n apply (simp add:cte_wp_at_ctes_of)\n apply (simp add:invs_valid_objs)\n apply (clarsimp simp:is_cap_simps isCap_simps)\n apply (frule cte_map_inj_eq)\n apply ((erule cte_wp_at_weakenE | simp\n | clarsimp simp: cte_wp_at_caps_of_state)+)[5]\n apply (clarsimp simp:cte_wp_at_caps_of_state cte_wp_at_ctes_of)\n apply (drule caps_of_state_valid_cap,fastforce)\n apply (clarsimp simp:valid_cap_def untyped_min_bits_def)\n done\n\n have obj_bits_low_bound[simp]:\n \"minUntypedSizeBits \\ obj_bits_api (APIType_map2 (Inr ao')) us\"\n using vui\n apply clarsimp\n apply (cases ao')\n apply (simp_all add: obj_bits_api_def slot_bits_def arch_kobj_size_def default_arch_object_def\n APIType_map2_def bit_simps untyped_min_bits_def minUntypedSizeBits_def\n split: apiobject_type.splits)\n done\n\n have cover: \"range_cover ptr sz\n (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots)\"\n and vslot: \"slots\\ []\"\n using vui\n by (auto simp: cte_wp_at_caps_of_state)\n\n have misc'[simp]:\n \"distinct (map cte_map slots)\"\n using vui'\n by (auto simp: cte_wp_at_ctes_of)\n\n have intvl_eq[simp]:\n \"ptr && ~~ mask sz = ptr \\ {ptr + of_nat k |k. k < 2 ^ sz} = {ptr..ptr + 2 ^ sz - 1}\"\n using cover\n apply (subgoal_tac \"is_aligned (ptr &&~~ mask sz) sz\")\n apply (rule intvl_range_conv)\n apply (simp)\n apply (drule range_cover.sz)\n apply simp\n apply (rule is_aligned_neg_mask,simp)\n done\n\n have delete_objects_rewrite:\n \"ptr && ~~ mask sz = ptr \\ delete_objects ptr sz =\n do y \\ modify (clear_um {ptr + of_nat k |k. k < 2 ^ sz});\n modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})\n od\"\n using cover\n apply (clarsimp simp:delete_objects_def freeMemory_def word_size_def)\n apply (subgoal_tac \"is_aligned (ptr &&~~ mask sz) sz\")\n apply (subst mapM_storeWord_clear_um[simplified word_size_def word_size_bits_def];\n clarsimp simp: range_cover_def word_bits_def)\n apply (drule_tac z=sz in order_trans[OF obj_bits_low_bound];\n simp add: minUntypedSizeBits_def)\n apply (rule is_aligned_neg_mask)\n apply simp\n done\n\n have of_nat_length: \"(of_nat (length slots)::machine_word) - (1::machine_word) < (of_nat (length slots)::machine_word)\"\n using vslot\n using range_cover.range_cover_le_n_less(1)[OF cover,where p = \"length slots\"]\n apply -\n apply (case_tac slots)\n apply clarsimp+\n apply (subst add.commute)\n apply (subst word_le_make_less[symmetric])\n apply (rule less_imp_neq)\n apply (simp add:word_bits_def minus_one_norm)\n apply (rule word_of_nat_less)\n apply auto\n done\n\n have not_0_ptr[simp]: \"ptr\\ 0\"\n using cte_at invs\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid)+\n apply (simp add:valid_cap_def)\n done\n\n have size_eq[simp]: \"APIType_capBits ao' us = obj_bits_api (APIType_map2 (Inr ao')) us\"\n apply (case_tac ao')\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (clarsimp simp: APIType_capBits_def objBits_simps' arch_kobj_size_def default_arch_object_def\n obj_bits_api_def APIType_map2_def slot_bits_def pageBitsForSize_def bit_simps)+\n done\n\n have non_reset_idx_le[simp]: \"\\ reset \\ idx < 2^sz\"\n using vui\n apply (clarsimp simp: cte_wp_at_caps_of_state )\n apply (erule le_less_trans)\n apply (rule unat_less_helper)\n apply simp\n apply (rule and_mask_less')\n using cover\n apply (clarsimp simp:range_cover_def)\n done\n\n note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex usableUntypedRange.simps\n\n have vc'[simp] : \"s' \\' capability.UntypedCap dev (ptr && ~~ mask sz) sz idx\"\n using vui' invs'\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (case_tac cte)\n apply clarsimp\n apply (erule ctes_of_valid_cap')\n apply (simp add:invs_valid_objs')\n done\n\n have nidx[simp]: \"ptr + (of_nat (length slots) * 2^obj_bits_api (APIType_map2 (Inr ao')) us) - (ptr && ~~ mask sz)\n = (ptr && mask sz) + (of_nat (length slots) * 2^obj_bits_api (APIType_map2 (Inr ao')) us)\"\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\" and t = ptr])\n apply simp\n done\n\n have idx_compare'[simp]:\"unat ((ptr && mask sz) + (of_nat (length slots)<< obj_bits_api (APIType_map2 (Inr ao')) us)) \\ 2 ^ sz\"\n apply (rule le_trans[OF unat_plus_gt])\n apply (simp add:range_cover.unat_of_nat_n_shift[OF cover] range_cover_unat)\n apply (insert range_cover.range_cover_compare_bound[OF cover])\n apply simp\n done\n\n have idx_compare''[simp]:\n \"unat ((ptr && mask sz) + (of_nat (length slots) * (2::machine_word) ^ obj_bits_api (APIType_map2 (Inr ao')) us)) < 2 ^ sz\n \\ ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1\n < ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us\"\n apply (rule word_leq_le_minus_one,simp)\n apply (rule neq_0_no_wrap)\n apply (rule machine_word_plus_mono_right_split)\n apply (simp add:shiftl_t2n range_cover_unat[OF cover] field_simps)\n apply (simp add:range_cover.sz[where 'a=machine_word_len, folded word_bits_def, OF cover])+\n done\n\n note neg_mask_add_mask = word_plus_and_or_coroll2[symmetric,where w = \"mask sz\" and t = ptr,symmetric]\n\n have idx_compare'''[simp]:\n \"\\unat (of_nat (length slots) * (2::machine_word) ^ obj_bits_api (APIType_map2 (Inr ao')) us) < 2 ^ sz;\n ptr && ~~ mask sz = ptr\\\n \\ ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us - 1\n < ptr + of_nat (length slots) * 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us \"\n apply (rule word_leq_le_minus_one,simp)\n apply (simp add:is_aligned_neg_mask_eq'[symmetric])\n apply (rule neq_0_no_wrap)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n apply (simp add:is_aligned_mask)+\n apply (simp add:range_cover.sz[where 'a=machine_word_len, folded word_bits_def, OF cover])+\n done\n\n have maxDomain:\"ksCurDomain s' \\ maxDomain\"\n using invs'\n by (simp add:invs'_def valid_state'_def)\n\n have sz_mask_less:\n \"unat (ptr && mask sz) < 2 ^ sz\"\n using range_cover.sz[OF cover]\n by (simp add: unat_less_helper and_mask_less_size word_size)\n\n have overlap_ranges1:\n \"{x. ptr \\ x \\ x \\ ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us\n * of_nat (length slots) - 1} \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n apply (rule order_trans[rotated])\n apply (rule range_cover_subset'[OF cover], simp add: vslot)\n apply (clarsimp simp: atLeastAtMost_iff field_simps)\n done\n\n have overlap_ranges2:\n \"idx \\ unat (ptr && mask sz)\n \\ {x. ptr \\ x \\ x \\ ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us\n * of_nat (length slots) - 1} \\ {(ptr && ~~ mask sz) + of_nat idx..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n apply (rule order_trans[OF overlap_ranges1])\n apply (clarsimp simp add: atLeastatMost_subset_iff)\n apply (rule order_trans, rule word_plus_mono_right)\n apply (erule word_of_nat_le)\n apply (simp add: add.commute word_plus_and_or_coroll2 word_and_le2)\n apply (simp add: add.commute word_plus_and_or_coroll2)\n done\n\n have overlap_ranges:\n \"{x. ptr \\ x \\ x \\ ptr + 2 ^ obj_bits_api (APIType_map2 (Inr ao')) us * of_nat (length slots) - 1}\n \\ usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))\"\n apply (cases reset, simp_all add: usable_untyped_range.simps)\n apply (rule order_trans, rule overlap_ranges1)\n apply (simp add: blah word_and_le2)\n apply (rule overlap_ranges2)\n apply (cut_tac vui)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n have ptr_cn[simp]: \"canonical_address (ptr && ~~ mask sz)\"\n using vc' unfolding valid_cap'_def by (clarsimp simp: kernel_mappings_canonical)\n\n have ptr_km[simp]: \"ptr && ~~ mask sz \\ kernel_mappings\"\n using vc' unfolding valid_cap'_def by clarsimp\n\n have sz_limit[simp]: \"sz \\ maxUntypedSizeBits\"\n using vc' unfolding valid_cap'_def by clarsimp\n\n have canonical_ptr[simp]: \"canonical_address ptr\"\n using ptr_cn sz_limit\n unfolding canonical_address_range maxUntypedSizeBits_def canonical_bit_def\n by word_bitwise (simp add: word_size)\n\n note set_cap_free_index_invs_spec = set_free_index_invs[where cap = \"cap.UntypedCap\n dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)\"\n ,unfolded free_index_update_def free_index_of_def,simplified]\n\n note msimp[simp add] = neg_mask_add_mask\n note if_split[split del]\n show \" corres (dc \\ (=)) ((=) s) ((=) s')\n (invoke_untyped ?ui)\n (invokeUntyped ?ui')\"\n apply (clarsimp simp:invokeUntyped_def invoke_untyped_def getSlotCap_def bind_assoc)\n apply (insert cover)\n apply (rule corres_guard_imp)\n apply (rule corres_split_norE)\n apply (rule corres_whenE, simp)\n apply (rule resetUntypedCap_corres[where ui=ui and ui'=ui'])\n apply (simp add: ui ui')\n apply simp\n apply simp\n apply (rule corres_symb_exec_l_Ex)\n apply (rule_tac F = \"cap = cap.UntypedCap dev (ptr && ~~ mask sz)\n sz (if reset then 0 else idx)\" in corres_gen_asm)\n apply (rule corres_add_noop_lhs)\n apply (rule corres_split_nor[OF cNodeNoOverlap _ return_wp stateAssert_wp])\n apply (clarsimp simp: canonicalAddressAssert_def)\n apply (rule corres_split[OF updateFreeIndex_corres])\n apply (simp add:isCap_simps)+\n apply (clarsimp simp:getFreeIndex_def bits_of_def shiftL_nat shiftl_t2n\n free_index_of_def)\n apply (insert range_cover.range_cover_n_less[OF cover] vslot)\n apply (rule createNewObjects_corres_helper)\n apply simp+\n apply (simp add: insertNewCaps_def)\n apply (rule corres_split_retype_createNewCaps[where sz = sz,OF corres_rel_imp])\n apply (rule inv_untyped_corres_helper1)\n apply simp\n apply simp\n apply ((wp retype_region_invs_extras[where sz = sz]\n retype_region_plain_invs [where sz = sz]\n retype_region_descendants_range_ret[where sz = sz]\n retype_region_caps_overlap_reserved_ret[where sz = sz]\n retype_region_cte_at_other[where sz = sz]\n retype_region_distinct_sets[where sz = sz]\n retype_region_ranges[where p=cref and sz = sz]\n retype_ret_valid_caps [where sz = sz]\n retype_region_arch_objs [where sza = \"\\_. sz\"]\n hoare_vcg_const_Ball_lift\n set_tuple_pick distinct_tuple_helper\n retype_region_obj_at_other3[where sz = sz]\n | assumption)+)[1]\n apply (wp set_tuple_pick createNewCaps_cte_wp_at'[where sz= sz]\n hoare_vcg_ex_lift distinct_tuple_helper\n createNewCaps_parent_helper [where p=\"cte_map cref\" and sz = sz]\n createNewCaps_valid_pspace_extras [where ptr=ptr and sz = sz]\n createNewCaps_ranges'[where sz = sz]\n hoare_vcg_const_Ball_lift createNewCaps_valid_cap'[where sz = sz]\n createNewCaps_descendants_range_ret'[where sz = sz]\n createNewCaps_caps_overlap_reserved_ret'[where sz = sz])\n apply clarsimp\n apply (erule cte_wp_at_weakenE')\n apply (case_tac c, simp)\n apply hypsubst\n apply (case_tac c,clarsimp simp:isCap_simps)\n apply (clarsimp simp: getFreeIndex_def is_cap_simps bits_of_def shiftL_nat)\n apply (clarsimp simp:conj_comms)\n apply (strengthen invs_mdb invs_valid_objs\n invs_valid_pspace invs_arch_state invs_psp_aligned\n caps_region_kernel_window_imp[where p=cref]\n invs_cap_refs_in_kernel_window)+\n apply (clarsimp simp:conj_comms bits_of_def)\n apply (wp set_cap_free_index_invs_spec set_cap_caps_no_overlap set_cap_no_overlap)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF set_cap_sets])\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (wp set_cap_no_overlap hoare_vcg_ball_lift\n set_cap_free_index_invs_spec\n set_cap_descendants_range_in\n set_untyped_cap_caps_overlap_reserved[where\n idx=\"if reset then 0 else idx\"]\n set_cap_cte_wp_at\n | strengthen exI[where x=cref])+\n apply (clarsimp simp:conj_comms ball_conj_distrib simp del:capFreeIndex_update.simps)\n apply (strengthen invs_pspace_aligned' invs_pspace_distinct'\n invs_valid_pspace' invs_arch_state'\n imp_consequent[where Q = \"(\\x. x \\ cte_map ` set slots)\"]\n | clarsimp simp: conj_comms simp del: capFreeIndex_update.simps)+\n apply ((wp updateFreeIndex_forward_invs' updateFreeIndex_caps_overlap_reserved\n updateFreeIndex_caps_no_overlap'' updateFreeIndex_pspace_no_overlap'\n hoare_vcg_const_Ball_lift updateFreeIndex_cte_wp_at\n updateFreeIndex_descendants_range_in')+)[1]\n apply clarsimp\n apply (clarsimp simp:conj_comms)\n apply (strengthen invs_mdb invs_valid_objs\n invs_valid_pspace invs_arch_state invs_psp_aligned\n invs_distinct)\n apply (clarsimp simp:conj_comms ball_conj_distrib ex_in_conv)\n apply ((rule validE_R_validE)?,\n rule_tac Q'=\"\\_ s. valid_etcbs s \\ valid_list s \\ invs s \\ ct_active s\n \\ valid_untyped_inv_wcap ui\n (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s\n \\ (reset \\ pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s)\n \" in hoare_post_imp_R)\n apply (simp add: whenE_def, wp)\n apply (rule validE_validE_R, rule hoare_post_impErr, rule reset_untyped_cap_invs_etc, auto)[1]\n apply wp\n apply (clarsimp simp: ui cte_wp_at_caps_of_state\n bits_of_def untyped_range.simps)\n apply (frule(1) valid_global_refsD2[OF _ invs_valid_global_refs])\n apply (cut_tac cref=\"cref\" and reset=reset\n in invoke_untyped_proofs.intro,\n simp_all add: cte_wp_at_caps_of_state)[1]\n apply (rule conjI, (assumption | rule refl))+\n apply (simp split: if_split)\n\n apply (simp add: invoke_untyped_proofs.simps)\n apply (strengthen if_split[where P=\"\\v. v \\ unat x\" for x, THEN iffD2]\n exI[where x=cref])\n apply (simp add: arg_cong[OF mask_out_sub_mask, where f=\"\\y. x - y\" for x]\n field_simps invoke_untyped_proofs.idx_le_new_offs\n if_split[where P=\"\\v. v \\ unat x\" for x])\n apply (frule range_cover.sz(1), fold word_bits_def)\n apply (frule cte_wp_at_pspace_no_overlapI,\n simp add: cte_wp_at_caps_of_state, simp split: if_split,\n simp add: invoke_untyped_proofs.szw)\n apply (simp add: field_simps conj_comms ex_in_conv\n cte_wp_at_caps_of_state\n in_get_cap_cte_wp_at\n atLeastatMost_subset_iff[where b=x and d=x for x]\n word_and_le2)\n apply (intro conjI impI)\n\n (* offs *)\n apply (drule(1) invoke_untyped_proofs.idx_le_new_offs)\n apply simp\n\n (* usable untyped range *)\n apply (simp add: shiftL_nat shiftl_t2n overlap_ranges)\n\n apply (rule order_trans, erule invoke_untyped_proofs.subset_stuff)\n apply (simp add: blah word_and_le2)\n\n apply (drule invoke_untyped_proofs.usable_range_disjoint)\n apply (clarsimp simp: field_simps mask_out_sub_mask shiftl_t2n)\n\n apply ((rule validE_validE_R)?, rule hoare_post_impErr,\n rule whenE_reset_resetUntypedCap_invs_etc[where ptr=\"ptr && ~~ mask sz\"\n and ptr'=ptr and sz=sz and idx=idx and ui=ui' and dev=dev])\n\n prefer 2\n apply simp\n apply clarsimp\n apply (simp only: ui')\n apply (frule(2) invokeUntyped_proofs.intro)\n apply (clarsimp simp: cte_wp_at_ctes_of\n invokeUntyped_proofs.caps_no_overlap'\n invokeUntyped_proofs.ps_no_overlap'\n invokeUntyped_proofs.descendants_range\n if_split[where P=\"\\v. v \\ getFreeIndex x y\" for x y]\n empty_descendants_range_in'\n invs_pspace_aligned' invs_pspace_distinct'\n invs_ksCurDomain_maxDomain'\n cong: if_cong)\n apply (strengthen refl)\n apply (frule invokeUntyped_proofs.idx_le_new_offs)\n apply (frule invokeUntyped_proofs.szw)\n apply (frule invokeUntyped_proofs.descendants_range(2), simp)\n apply (clarsimp simp: getFreeIndex_def conj_comms shiftL_nat\n is_aligned_weaken[OF range_cover.funky_aligned]\n invs_valid_pspace' isCap_simps\n arg_cong[OF mask_out_sub_mask, where f=\"\\y. x - y\" for x]\n field_simps)\n\n apply (intro conjI)\n (* pspace_no_overlap' *)\n apply (cases reset, simp_all)[1]\n apply (rule order_trans[rotated],\n erule invokeUntyped_proofs.idx_compare')\n apply (simp add: shiftl_t2n mult.commute)\n apply (drule invokeUntyped_proofs.subset_stuff, simp,\n erule order_trans, simp add: blah word_and_le2 add_mask_fold)\n apply (auto simp: add_mask_fold split: if_split)[1]\n apply (drule invokeUntyped_proofs.usableRange_disjoint, simp)\n apply (clarsimp simp only: pred_conj_def invs ui)\n apply (strengthen vui)\n apply (cut_tac vui invs invs')\n apply (clarsimp simp: cte_wp_at_caps_of_state valid_sched_etcbs)\n apply (cut_tac vui' invs')\n apply (clarsimp simp: ui cte_wp_at_ctes_of if_apply_def2 ui')\n done\nqed\n\nlemmas inv_untyped_corres = inv_untyped_corres'\n\ncrunches insertNewCap, doMachineOp\n for pred_tcb_at'[wp]: \"pred_tcb_at' proj P t\"\n (wp: crunch_wps)\n\nlemma sts_valid_untyped_inv':\n \"\\valid_untyped_inv' ui\\ setThreadState st t \\\\rv. valid_untyped_inv' ui\\\"\n apply (cases ui, simp add: ex_cte_cap_to'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF setThreadState_ksInterruptState])\n apply (wp hoare_vcg_const_Ball_lift hoare_vcg_ex_lift | simp)+\n done\n\ncrunch nosch[wp]: invokeUntyped \"\\s. P (ksSchedulerAction s)\"\n (simp: crunch_simps zipWithM_x_mapM\n wp: crunch_wps unless_wp mapME_x_inv_wp preemptionPoint_inv)\n\ncrunch no_0_obj'[wp]: insertNewCap no_0_obj'\n (wp: crunch_wps)\n\nlemma insertNewCap_valid_pspace':\n \"\\\\s. valid_pspace' s \\ s \\' cap\n \\ slot \\ parent \\ caps_overlap_reserved' (untypedRange cap) s\n \\ cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) cap) parent s\n \\ \\ isZombie cap \\ descendants_range' cap parent (ctes_of s)\\\n insertNewCap parent slot cap\n \\\\rv. valid_pspace'\\\"\n apply (simp add: valid_pspace'_def)\n apply (wp insertNewCap_valid_mdb)\n apply simp_all\n done\n\ncrunches insertNewCap\n for tcb'[wp]: \"tcb_at' t\"\n and inQ[wp]: \"obj_at' (inQ d p) t\"\n and norqL1[wp]: \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n and norqL2[wp]: \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n and state_refs_of'[wp]: \"\\s. P (state_refs_of' s)\"\n and idle'[wp]: \"valid_idle'\"\n and global_refs': \"\\s. P (global_refs' s)\"\n and gsMaxObjectSize[wp]: \"\\s. P (gsMaxObjectSize s)\"\n and irq_states' [wp]: valid_irq_states'\n and vq'[wp]: valid_queues'\n and irqs_masked' [wp]: irqs_masked'\n and valid_machine_state'[wp]: valid_machine_state'\n and pspace_domain_valid[wp]: pspace_domain_valid\n and ct_not_inQ[wp]: \"ct_not_inQ\"\n and tcbState_inv[wp]: \"obj_at' (\\tcb. P (tcbState tcb)) t\"\n and tcbDomain_inv[wp]: \"obj_at' (\\tcb. P (tcbDomain tcb)) t\"\n and tcbPriority_inv[wp]: \"obj_at' (\\tcb. P (tcbPriority tcb)) t\"\n (wp: crunch_wps)\n\ncrunch if_unsafe_then_cap'[wp]: updateNewFreeIndex \"if_unsafe_then_cap'\"\n\nlemma insertNewCap_ifunsafe'[wp]:\n \"\\if_unsafe_then_cap' and ex_cte_cap_to' slot\\\n insertNewCap parent slot cap\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp add: insertNewCap_def)\n apply (rule hoare_pre)\n apply (wp getCTE_wp' | clarsimp simp: ifunsafe'_def3)+\n apply (clarsimp simp: ex_cte_cap_to'_def cte_wp_at_ctes_of cteCaps_of_def)\n apply (drule_tac x=cref in spec)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=crefa in exI, fastforce)\n apply clarsimp\n apply (rule_tac x=cref' in exI, fastforce)\n done\n\ncrunch if_live_then_nonz_cap'[wp]: updateNewFreeIndex \"if_live_then_nonz_cap'\"\n\nlemma insertNewCap_iflive'[wp]:\n \"\\if_live_then_nonz_cap'\\ insertNewCap parent slot cap \\\\rv. if_live_then_nonz_cap'\\\"\n apply (simp add: insertNewCap_def)\n apply (wp setCTE_iflive' getCTE_wp')\n apply (clarsimp elim!: cte_wp_at_weakenE')\n done\n\nlemma insertNewCap_cte_wp_at'':\n \"\\cte_wp_at' (\\cte. P (cteCap cte)) p and K (\\ P NullCap)\\\n insertNewCap parent slot cap\n \\\\rv s. cte_wp_at' (P \\ cteCap) p s\\\"\n apply (simp add: insertNewCap_def tree_cte_cteCap_eq)\n apply (wp getCTE_wp')\n apply (clarsimp simp: cte_wp_at_ctes_of cteCaps_of_def)\n done\n\nlemmas insertNewCap_cte_wp_at' = insertNewCap_cte_wp_at''[unfolded o_def]\n\nlemma insertNewCap_cap_to'[wp]:\n \"\\ex_cte_cap_to' p\\ insertNewCap parent slot cap \\\\rv. ex_cte_cap_to' p\\\"\n apply (simp add: ex_cte_cap_to'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node'[OF insertNewCap_ksInterrupt])\n apply (wp hoare_vcg_ex_lift insertNewCap_cte_wp_at')\n apply clarsimp\n done\n\nlemma insertNewCap_nullcap:\n \"\\P and cte_wp_at' (\\cte. cteCap cte = NullCap) slot\\ insertNewCap parent slot cap \\Q\\\n \\ \\P\\ insertNewCap parent slot cap \\Q\\\"\n apply (clarsimp simp: valid_def)\n apply (subgoal_tac \"cte_wp_at' (\\cte. cteCap cte = NullCap) slot s\")\n apply fastforce\n apply (clarsimp simp: insertNewCap_def in_monad cte_wp_at_ctes_of liftM_def\n dest!: use_valid [OF _ getCTE_sp[where P=\"(=) s\" for s], OF _ refl])\n done\n\nlemma insertNewCap_valid_global_refs':\n \"\\valid_global_refs' and\n cte_wp_at' (\\cte. capRange cap \\ capRange (cteCap cte)\n \\ capBits cap \\ capBits (cteCap cte)) parent\\\n insertNewCap parent slot cap\n \\\\rv. valid_global_refs'\\\"\n apply (simp add: valid_global_refs'_def valid_refs'_cteCaps valid_cap_sizes_cteCaps)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=global_refs', OF insertNewCap_global_refs'])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize])\n apply wp+\n apply (clarsimp simp: cte_wp_at_ctes_of cteCaps_of_def ball_ran_eq)\n apply (frule power_increasing[where a=2], simp)\n apply (blast intro: order_trans)\n done\n\nlemma insertNewCap_valid_irq_handlers:\n \"\\valid_irq_handlers' and (\\s. \\irq. cap = IRQHandlerCap irq \\ irq_issued' irq s)\\\n insertNewCap parent slot cap\n \\\\rv. valid_irq_handlers'\\\"\n apply (simp add: insertNewCap_def valid_irq_handlers'_def irq_issued'_def)\n apply (wp | wp (once) hoare_use_eq[where f=ksInterruptState, OF updateNewFreeIndex_ksInterrupt])+\n apply (simp add: cteCaps_of_def)\n apply (wp | wp (once) hoare_use_eq[where f=ksInterruptState, OF setCTE_ksInterruptState]\n getCTE_wp)+\n apply (clarsimp simp: cteCaps_of_def cte_wp_at_ctes_of ran_def)\n apply auto\n done\n\nlemma insertNewCap_ct_idle_or_in_cur_domain'[wp]:\n \"\\ct_idle_or_in_cur_domain' and ct_active'\\ insertNewCap parent slot cap \\\\_. ct_idle_or_in_cur_domain'\\\"\napply (wp ct_idle_or_in_cur_domain'_lift_futz[where Q=\\])\napply (rule_tac Q=\"\\_. obj_at' (\\tcb. tcbState tcb \\ Structures_H.thread_state.Inactive) t and obj_at' (\\tcb. d = tcbDomain tcb) t\"\n in hoare_strengthen_post)\napply (wp | clarsimp elim: obj_at'_weakenE)+\napply (auto simp: obj_at'_def)\ndone\n\ncrunch ksDomScheduleIdx[wp]: insertNewCap \"\\s. P (ksDomScheduleIdx s)\"\n (wp: crunch_simps hoare_drop_imps)\n\nlemma capRange_subset_capBits:\n \"capAligned cap \\ capAligned cap'\n \\ capRange cap \\ capRange cap'\n \\ capRange cap \\ {}\n \\ capBits cap \\ capBits cap'\"\n supply\n is_aligned_neg_mask_eq[simp del]\n is_aligned_neg_mask_weaken[simp del]\n apply (simp add: capRange_def capAligned_def is_aligned_no_overflow\n split: if_split_asm del: atLeastatMost_subset_iff)\n apply (frule_tac c=\"capUntypedPtr cap\" in subsetD)\n apply (simp only: mask_in_range[symmetric])\n apply (simp add: is_aligned_neg_mask_eq)\n apply (drule_tac c=\"(capUntypedPtr cap && ~~ mask (capBits cap))\n || (~~ capUntypedPtr cap' && mask (capBits cap))\" in subsetD)\n apply (simp_all only: mask_in_range[symmetric])\n apply (simp add: word_ao_dist is_aligned_neg_mask_eq)\n apply (simp add: word_ao_dist)\n apply (cases \"capBits cap = 0\")\n apply simp\n apply (drule_tac f=\"\\x. x !! (capBits cap - 1)\"\n and x=\"a || b\" for a b in arg_cong)\n apply (simp add: word_ops_nth_size word_bits_def word_size)\n apply auto\n done\n\nlemma insertNewCap_urz[wp]:\n \"\\untyped_ranges_zero' and valid_objs' and valid_mdb'\\\n insertNewCap parent slot cap \\\\rv. untyped_ranges_zero'\\\"\n apply (simp add: insertNewCap_def updateNewFreeIndex_def)\n apply (wp getCTE_cteCap_wp\n | simp add: updateTrackedFreeIndex_def getSlotCap_def case_eq_if_isUntypedCap\n split: option.split split del: if_split\n | wps | wp (once) getCTE_wp')+\n apply (clarsimp simp: cte_wp_at_ctes_of fun_upd_def[symmetric])\n apply (strengthen untyped_ranges_zero_fun_upd[mk_strg I E])\n apply (intro conjI impI; clarsimp simp: isCap_simps)\n apply (auto simp add: cteCaps_of_def untypedZeroRange_def isCap_simps)\n done\n\nlemma insertNewCap_invs':\n \"\\invs' and ct_active'\n and valid_cap' cap\n and cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) cap) parent\n and K (\\ isZombie cap) and (\\s. descendants_range' cap parent (ctes_of s))\n and caps_overlap_reserved' (untypedRange cap)\n and ex_cte_cap_to' slot\n and (\\s. ksIdleThread s \\ capRange cap)\n and (\\s. \\irq. cap = IRQHandlerCap irq \\ irq_issued' irq s)\\\n insertNewCap parent slot cap\n \\\\rv. invs'\\\"\n apply (rule insertNewCap_nullcap)\n apply (simp add: invs'_def valid_state'_def)\n apply (rule hoare_pre)\n apply (wp insertNewCap_valid_pspace' sch_act_wf_lift\n valid_queues_lift cur_tcb_lift tcb_in_cur_domain'_lift\n insertNewCap_valid_global_refs'\n valid_arch_state_lift'\n valid_irq_node_lift insertNewCap_valid_irq_handlers)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (frule ctes_of_valid[rotated, where p=parent, OF valid_pspace_valid_objs'])\n apply (fastforce simp: cte_wp_at_ctes_of)\n apply (auto simp: isCap_simps sameRegionAs_def3\n intro!: capRange_subset_capBits\n elim: valid_capAligned)\n done\n\nlemma insertNewCap_irq_issued'[wp]:\n \"\\\\s. P (irq_issued' irq s)\\ insertNewCap parent slot cap \\\\rv s. P (irq_issued' irq s)\\\"\n by (simp add: irq_issued'_def, wp)\n\nlemma insertNewCap_ct_in_state'[wp]:\n \"\\ct_in_state' p\\insertNewCap parent slot cap \\\\rv. ct_in_state' p\\\"\n unfolding ct_in_state'_def\n apply (rule hoare_pre)\n apply wps\n apply wp\n apply simp\n done\n\nlemma zipWithM_x_insertNewCap_invs'':\n \"\\\\s. invs' s \\ ct_active' s \\ (\\tup \\ set ls. s \\' snd tup)\n \\ cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n (\\tup \\ set ls. sameRegionAs (cteCap cte) (snd tup))) parent s\n \\ (\\tup \\ set ls. \\ isZombie (snd tup))\n \\ (\\tup \\ set ls. ex_cte_cap_to' (fst tup) s)\n \\ (\\tup \\ set ls. descendants_range' (snd tup) parent (ctes_of s))\n \\ (\\tup \\ set ls. ksIdleThread s \\ capRange (snd tup))\n \\ (\\tup \\ set ls. caps_overlap_reserved' (capRange (snd tup)) s)\n \\ distinct_sets (map capRange (map snd ls))\n \\ (\\irq. IRQHandlerCap irq \\ set (map snd ls) \\ irq_issued' irq s)\n \\ distinct (map fst ls)\\\n mapM (\\(x, y). insertNewCap parent x y) ls\n \\\\rv. invs'\\\"\n apply (induct ls)\n apply (simp add: mapM_def sequence_def)\n apply (wp, simp)\n apply (simp add: mapM_Cons)\n including no_pre apply wp\n apply (thin_tac \"valid P f Q\" for P f Q)\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp insertNewCap_invs'\n hoare_vcg_const_Ball_lift\n insertNewCap_cte_wp_at' insertNewCap_ranges\n hoare_vcg_all_lift insertNewCap_pred_tcb_at')+\n apply (clarsimp simp: cte_wp_at_ctes_of invs_mdb' invs_valid_objs' dest!:valid_capAligned)\n apply (drule caps_overlap_reserved'_subseteq[OF _ untypedRange_in_capRange])\n apply (auto simp:comp_def)\n done\n\nlemma createNewCaps_not_isZombie[wp]:\n \"\\\\\\ createNewCaps ty ptr bits sz d \\\\rv s. (\\cap \\ set rv. \\ isZombie cap)\\\"\n apply (simp add: createNewCaps_def toAPIType_def\n cong: option.case_cong if_cong apiobject_type.case_cong)\n apply (wpsimp wp: undefined_valid simp: isCap_simps)\n done\n\nlemma createNewCaps_cap_to':\n \"\\\\s. ex_cte_cap_to' p s \\ 0 < n\n \\ range_cover ptr sz (APIType_capBits ty us) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us d\n \\\\rv. ex_cte_cap_to' p\\\"\n apply (simp add: ex_cte_cap_to'_def)\n apply (wp hoare_vcg_ex_lift\n hoare_use_eq_irq_node' [OF createNewCaps_ksInterrupt\n createNewCaps_cte_wp_at'])\n apply fastforce\n done\n\ncrunch it[wp]: copyGlobalMappings \"\\s. P (ksIdleThread s)\"\n (wp: mapM_x_wp')\n\nlemma createNewCaps_idlethread[wp]:\n \"\\\\s. P (ksIdleThread s)\\ createNewCaps tp ptr sz us d \\\\rv s. P (ksIdleThread s)\\\"\n apply (simp add: createNewCaps_def toAPIType_def\n split: RISCV64_H.object_type.split\n apiobject_type.split)\n apply safe\n apply (wp mapM_x_wp' | simp)+\n done\n\nlemma createNewCaps_idlethread_ranges[wp]:\n \"\\\\s. 0 < n \\ range_cover ptr sz (APIType_capBits tp us) n\n \\ ksIdleThread s \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\\\n createNewCaps tp ptr n us d\n \\\\rv s. \\cap\\set rv. ksIdleThread s \\ capRange cap\\\"\n apply (rule hoare_as_subst [OF createNewCaps_idlethread])\n apply (rule hoare_assume_pre)\n apply (rule hoare_chain, rule createNewCaps_range_helper2)\n apply fastforce\n apply blast\n done\n\nlemma createNewCaps_IRQHandler[wp]:\n \"\\\\\\\n createNewCaps tp ptr sz us d\n \\\\rv s. IRQHandlerCap irq \\ set rv \\ P rv s\\\"\n apply (simp add: createNewCaps_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp | wpc | simp add: image_def | rule hoare_pre_cont)+\n done\n\nlemma createNewCaps_ct_active':\n \"\\ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us d\n \\\\_. ct_active'\\\"\n apply (simp add: ct_in_state'_def)\n apply (rule hoare_pre)\n apply wps\n apply (wp createNewCaps_pred_tcb_at'[where sz=sz])\n apply simp\n done\n\ncrunch gsMaxObjectSize[wp]: deleteObjects \"\\s. P (gsMaxObjectSize s)\"\n (simp: unless_def wp: crunch_wps)\n\ncrunch gsMaxObjectSize[wp]: updateFreeIndex \"\\s. P (gsMaxObjectSize s)\"\n\ncrunch ksIdleThread[wp]: updateFreeIndex \"\\s. P (ksIdleThread s)\"\n\nlemma invokeUntyped_invs'':\n assumes insertNew_Q[wp]: \"\\p cref cap.\n \\Q\\ insertNewCap p cref cap \\\\_. Q\\\"\n assumes createNew_Q: \"\\tp ptr n us sz dev. \\\\s. Q s\n \\ range_cover ptr sz (APIType_capBits tp us) n\n \\ (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \\ 0 < us)\n \\ 0 < n \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createNewCaps tp ptr n us dev \\\\_. Q\\\"\n assumes set_free_Q[wp]: \"\\slot idx. \\invs' and Q\\ updateFreeIndex slot idx \\\\_.Q\\\"\n assumes reset_Q: \"\\Q'\\ resetUntypedCap (case ui of Invocations_H.Retype src_slot _ _ _ _ _ _ _ \\ src_slot) \\\\_. Q\\\"\n shows \"\\invs' and valid_untyped_inv' ui\n and (\\s. (case ui of Invocations_H.Retype _ reset _ _ _ _ _ _ \\ reset) \\ Q' s)\n and Q and ct_active'\\\n invokeUntyped ui\n \\\\rv. invs' and Q\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp only: pred_conj_def valid_untyped_inv_wcap')\n proof -\n fix s sz idx\n assume vui1: \"valid_untyped_inv_wcap' ui\n (Some (case ui of\n Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \\\n capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\"\n assume misc: \"invs' s\" \"Q s\" \"ct_active' s\"\n \"(case ui of\n Invocations_H.untyped_invocation.Retype x reset _ _ _ _ _ _ \\ reset) \\\n Q' s\"\n\n obtain cref reset ptr tp us slots dev\n where pf: \"invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev\"\n and ui: \"ui = Invocations_H.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev\"\n using vui1 misc\n apply (cases ui, simp only: Invocations_H.untyped_invocation.simps)\n apply (frule(2) invokeUntyped_proofs.intro)\n apply clarsimp\n apply (unfold cte_wp_at_ctes_of)\n apply (drule meta_mp; clarsimp)\n done\n\n note vui = vui1[simplified ui Invocations_H.untyped_invocation.simps]\n\n have cover: \"range_cover ptr sz (APIType_capBits tp us) (length slots)\"\n and slots: \"cref \\ set slots\" \"distinct slots\" \"slots \\ []\"\n and tps: \"tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \\ 0 < us\"\n \"tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits\"\n using vui\n by (clarsimp simp: ui cte_wp_at_ctes_of)+\n\n note not_0_ptr[simp] = invokeUntyped_proofs.not_0_ptr [OF pf]\n note subset_stuff[simp] = invokeUntyped_proofs.subset_stuff[OF pf]\n\n have non_detype_idx_le[simp]: \"~ reset \\ idx < 2^sz\"\n using vui ui\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (erule le_less_trans)\n apply (rule unat_less_helper)\n apply simp\n apply (rule le_less_trans)\n apply (rule word_and_le1)\n apply (simp add:mask_def)\n apply (rule word_leq_le_minus_one)\n apply simp\n apply (clarsimp simp:range_cover_def)\n done\n\n note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff\n atLeastatMost_subset_iff atLeastLessThan_iff Int_atLeastAtMost\n atLeastatMost_empty_iff split_paired_Ex usableUntypedRange.simps\n note descendants_range[simp] = invokeUntyped_proofs.descendants_range[OF pf]\n note vc'[simp] = invokeUntyped_proofs.vc'[OF pf]\n note ps_no_overlap'[simp] = invokeUntyped_proofs.ps_no_overlap'[OF pf]\n note caps_no_overlap'[simp] = invokeUntyped_proofs.caps_no_overlap'[OF pf]\n note ex_cte_no_overlap' = invokeUntyped_proofs.ex_cte_no_overlap'[OF pf]\n note cref_inv = invokeUntyped_proofs.cref_inv[OF pf]\n note slots_invD = invokeUntyped_proofs.slots_invD[OF pf]\n note nidx[simp] = add_minus_neg_mask[where ptr = ptr]\n note idx_compare' = invokeUntyped_proofs.idx_compare'[OF pf]\n note ptr_cn[simp] = invokeUntyped_proofs.ptr_cn[OF pf]\n note ptr_km[simp] = invokeUntyped_proofs.ptr_km[OF pf]\n note sz_limit[simp] = invokeUntyped_proofs.sz_limit[OF pf]\n\n have valid_global_refs': \"valid_global_refs' s\"\n using misc by auto\n\n have mapM_insertNewCap_Q:\n \"\\caps. \\Q\\ mapM (\\(x, y). insertNewCap cref x y) (zip slots caps) \\\\rv. Q\\\"\n by (wp mapM_wp' | clarsimp)+\n\n note reset_Q' = reset_Q[simplified ui, simplified]\n\n note neg_mask_add_mask = word_plus_and_or_coroll2[symmetric,where w = \"mask sz\" and t = ptr,symmetric]\n note msimp[simp add] = misc neg_mask_add_mask\n show \"\\(=) s\\ invokeUntyped ui \\\\rv s. invs' s \\ Q s\\\"\n including no_pre\n apply (clarsimp simp:invokeUntyped_def getSlotCap_def ui)\n apply (rule validE_valid)\n apply (rule hoare_pre)\n apply (rule_tac B=\"\\_ s. invs' s \\ Q s \\ ct_active' s\n \\ valid_untyped_inv_wcap' ui\n (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s\n \\ (reset \\ pspace_no_overlap' (ptr && ~~ mask sz) sz s)\n \" in hoare_vcg_seqE[rotated])\n apply (simp only: whenE_def)\n apply wp\n apply (rule hoare_post_impErr, rule combine_validE,\n rule resetUntypedCap_invs_etc, rule valid_validE, rule reset_Q')\n apply (clarsimp simp only: if_True)\n apply auto[1]\n apply simp\n apply wp[1]\n prefer 2\n apply (cut_tac vui1 misc)\n apply (clarsimp simp: ui cte_wp_at_ctes_of simp del: misc)\n apply auto[1]\n apply (rule hoare_pre)\n apply (wp createNewObjects_wp_helper[where sz = sz])\n apply (simp add: slots)+\n apply (rule cover)\n apply (simp add: slots)+\n apply (clarsimp simp:insertNewCaps_def)\n apply (wp zipWithM_x_insertNewCap_invs''\n set_tuple_pick distinct_tuple_helper\n hoare_vcg_const_Ball_lift\n createNewCaps_invs'[where sz = sz]\n createNewCaps_valid_cap[where sz = sz,OF cover]\n createNewCaps_parent_helper[where sz = sz]\n createNewCaps_cap_to'[where sz = sz]\n createNewCaps_descendants_range_ret'[where sz = sz]\n createNewCaps_caps_overlap_reserved_ret'[where sz = sz]\n createNewCaps_ranges[where sz = sz]\n createNewCaps_ranges'[where sz = sz]\n createNewCaps_IRQHandler\n createNewCaps_ct_active'[where sz=sz]\n mapM_insertNewCap_Q\n | simp add: zipWithM_x_mapM slots tps)+\n apply (wp hoare_vcg_all_lift)\n apply (wp hoare_strengthen_post[OF createNewCaps_IRQHandler])\n apply (intro impI)\n apply (erule impE)\n apply (erule(1) snd_set_zip_in_set)\n apply (simp add: conj_comms, wp createNew_Q[where sz=sz])\n apply (wp hoare_strengthen_post[OF createNewCaps_range_helper[where sz = sz]])\n apply (clarsimp simp: slots)\n apply (clarsimp simp:conj_comms ball_conj_distrib pred_conj_def\n simp del:capFreeIndex_update.simps)\n apply (strengthen invs_pspace_aligned' invs_pspace_distinct'\n invs_valid_pspace' invs_arch_state'\n imp_consequent[where Q = \"(\\x. x \\ set slots)\"]\n | clarsimp simp: conj_comms simp del: capFreeIndex_update.simps)+\n apply (wp updateFreeIndex_forward_invs' updateFreeIndex_caps_overlap_reserved\n updateFreeIndex_caps_no_overlap'' updateFreeIndex_pspace_no_overlap'\n hoare_vcg_const_Ball_lift\n updateFreeIndex_cte_wp_at\n updateCap_cte_cap_wp_to')\n apply (wp updateFreeIndex_caps_overlap_reserved\n updateFreeIndex_descendants_range_in' getCTE_wp | simp)+\n apply (clarsimp simp only: ui)\n apply (frule(2) invokeUntyped_proofs.intro)\n apply (frule invokeUntyped_proofs.idx_le_new_offs)\n apply (frule invokeUntyped_proofs.szw)\n apply (frule invokeUntyped_proofs.descendants_range(2), simp)\n apply (frule invokeUntyped_proofs.idx_compare')\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps getFreeIndex_def\n shiftL_nat shiftl_t2n mult.commute\n if_split[where P=\"\\x. x \\ unat v\" for v]\n invs_valid_pspace' invs_ksCurDomain_maxDomain'\n invokeUntyped_proofs.caps_no_overlap'\n invokeUntyped_proofs.usableRange_disjoint\n split del: if_split)\n apply (strengthen refl)\n apply simp\n apply (intro conjI; assumption?)\n apply (erule is_aligned_weaken[OF range_cover.funky_aligned])\n apply (simp add: APIType_capBits_def objBits_simps' bit_simps untypedBits_defs\n split: object_type.split apiobject_type.split)[1]\n apply (cases reset)\n apply (clarsimp simp: bit_simps)\n apply (clarsimp simp: invokeUntyped_proofs.ps_no_overlap')\n apply (drule invs_valid_global')\n apply (clarsimp simp: valid_global_refs'_def cte_at_valid_cap_sizes_0)\n apply (auto)[1]\n apply (frule valid_global_refsD', clarsimp)\n apply (clarsimp simp: Int_commute)\n apply (erule disjoint_subset2[rotated])\n apply (simp add: blah word_and_le2)\n apply (rule order_trans, erule invokeUntyped_proofs.subset_stuff)\n apply (simp add: blah word_and_le2 add_mask_fold)\n apply (frule valid_global_refsD2', clarsimp)\n apply (clarsimp simp: global_refs'_def)\n apply (erule notE, erule subsetD[rotated], simp add: blah word_and_le2)\n done\nqed\n\nlemma invokeUntyped_invs'[wp]:\n \"\\invs' and valid_untyped_inv' ui and ct_active'\\\n invokeUntyped ui\n \\\\rv. invs'\\\"\n apply (wp invokeUntyped_invs''[where Q=\\, simplified hoare_post_taut, simplified])\n apply auto\n done\n\ncrunch pred_tcb_at'[wp]: updateFreeIndex \"pred_tcb_at' pr P p\"\n\nlemma resetUntypedCap_st_tcb_at':\n \"\\invs' and st_tcb_at' (P and ((\\) Inactive) and ((\\) IdleThreadState)) t\n and cte_wp_at' (\\cp. isUntypedCap (cteCap cp)) slot\n and ct_active' and sch_act_simple and (\\s. descendants_of' slot (ctes_of s) = {})\\\n resetUntypedCap slot\n \\\\_. st_tcb_at' P t\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n apply (simp add: resetUntypedCap_def)\n apply (rule hoare_pre)\n apply (wp mapME_x_inv_wp preemptionPoint_inv\n deleteObjects_st_tcb_at'[where p=slot] getSlotCap_wp\n | simp add: unless_def\n | wp (once) hoare_drop_imps)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (strengthen refl)\n apply (rule exI, strengthen refl)\n apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+)\n apply (clarsimp simp: valid_cap_simps' capAligned_def empty_descendants_range_in'\n descendants_range'_def2\n elim!: pred_tcb'_weakenE)\n done\n\nlemma inv_untyp_st_tcb_at'[wp]:\n \"\\invs' and st_tcb_at' (P and ((\\) Inactive) and ((\\) IdleThreadState)) tptr\n and valid_untyped_inv' ui and ct_active'\\\n invokeUntyped ui\n \\\\rv. st_tcb_at' P tptr\\\"\n apply (rule hoare_pre)\n apply (rule hoare_strengthen_post)\n apply (rule invokeUntyped_invs''[where Q=\"st_tcb_at' P tptr\"];\n wp createNewCaps_pred_tcb_at')\n apply (auto simp: valid_pspace'_def)[1]\n apply (wp resetUntypedCap_st_tcb_at' | simp)+\n apply (cases ui, clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n apply (clarsimp elim!: pred_tcb'_weakenE)\n done\n\nlemma inv_untyp_tcb'[wp]:\n \"\\invs' and st_tcb_at' active' tptr\n and valid_untyped_inv' ui and ct_active'\\\n invokeUntyped ui\n \\\\rv. tcb_at' tptr\\\"\n apply (rule hoare_chain [OF inv_untyp_st_tcb_at'[where tptr=tptr and P=\"\\\"]])\n apply (clarsimp elim!: pred_tcb'_weakenE)\n apply fastforce\n apply (clarsimp simp: pred_tcb_at'_def)\n done\n\ncrunch ksInterruptState_eq[wp]: invokeUntyped \"\\s. P (ksInterruptState s)\"\n (wp: crunch_wps mapME_x_inv_wp preemptionPoint_inv\n simp: crunch_simps unless_def)\n\ncrunches deleteObjects, updateFreeIndex\n for valid_irq_states'[wp]: \"valid_irq_states'\"\n (wp: doMachineOp_irq_states' crunch_wps\n simp: freeMemory_def no_irq_storeWord unless_def)\n\nlemma resetUntypedCap_IRQInactive:\n \"\\valid_irq_states'\\\n resetUntypedCap slot\n \\\\_ _. True\\, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n (is \"\\?P\\ resetUntypedCap slot \\?Q\\,\\?E\\\")\n apply (simp add: resetUntypedCap_def)\n apply (rule hoare_pre)\n apply (wp mapME_x_inv_wp[where P=valid_irq_states' and E=\"?E\", THEN hoare_post_impErr]\n doMachineOp_irq_states' preemptionPoint_inv hoare_drop_imps\n | simp add: no_irq_clearMemory if_apply_def2)+\n done\n\nlemma inv_untyped_IRQInactive:\n \"\\valid_irq_states'\\\n invokeUntyped ui\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n unfolding invokeUntyped_def\n by (wpsimp wp: whenE_wp resetUntypedCap_IRQInactive)\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/RISCV64/Untyped_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.3140505578320071, "lm_q1q2_score": 0.18016402845474055}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__8.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__8 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__8 and some rule r*}\nlemma n_PI_Local_Get_PutVsinv__8:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__8:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__8:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__8:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__8:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__8:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__8:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__8:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__8:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__8:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__8:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__8:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__8:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_WbVsinv__8:\nassumes a1: \"(r=n_NI_Wb )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__8:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__8 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__8:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__8:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__8:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__8:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__8:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__8:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__8:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__8:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__8:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__8:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__8:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__8:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__8:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__8:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__8:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__8:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784220301064, "lm_q2_score": 0.3140505385717078, "lm_q1q2_score": 0.1801640174055224}} {"text": "theory Sorting_Unguarded_Insertion_Sort\nimports Sorting_Setup Sorting_Partially_Sorted\nbegin\n\n\n(* TODO: Move *)\n\n\n \nlemma mop_eo_extract_slice_refine: \"\\ (i, i') \\ idx_shift_rel l; (xs, xs') \\ slice_rel xs\\<^sub>0 l h\\\n \\ mop_eo_extract xs i \\ \\ (Id \\\\<^sub>r slice_rel xs\\<^sub>0 l h) (mop_eo_extract xs' i')\" \n by (auto intro!: refine0 simp: idx_shift_rel_def slice_rel_def in_br_conv take_map drop_map slice_nth slice_upd_sym algebra_simps)\n \n \nlemma mop_eo_set_slice_refine: \"\\(i, i') \\ idx_shift_rel l; (xs, xs') \\ slice_rel xs\\<^sub>0 l h; (v,v')\\Id\\ \n \\ mop_eo_set xs i v \\ \\ (slice_rel xs\\<^sub>0 l h) (mop_eo_set xs' i' v')\" \n by (auto intro!: refine0 simp: idx_shift_rel_def slice_rel_def in_br_conv take_map drop_map slice_nth slice_upd_sym algebra_simps)\n \nlemma mop_to_eo_conv_slice_refine: \"\\(xs, xs') \\ slice_rel xs\\<^sub>0 l h; (i, i') \\ idx_shift_rel l\\\n \\ mop_to_eo_conv xs \\ \\ (slice_rel (map Some xs\\<^sub>0) l h) (mop_to_eo_conv xs')\" \n by (auto simp: idx_shift_rel_def slice_rel_def in_br_conv slice_map take_map drop_map) \n \nlemma mop_to_wo_conv_slice_refine: \"\\(xs, xs') \\ slice_rel (map Some xs\\<^sub>0) l h\\ \\ mop_to_wo_conv xs \\ \\ (slice_rel xs\\<^sub>0 l h) (mop_to_wo_conv xs')\"\n apply simp\n apply (intro refine0)\n subgoal\n apply (simp add: slice_rel_def in_br_conv)\n apply (auto simp: in_set_conv_nth slice_nth list_eq_iff_nth_eq algebra_simps)\n by (metis Groups.add_ac(2) add_diff_inverse_nat less_diff_conv)\n subgoal \n by (auto simp: slice_rel_def in_br_conv drop_map take_map slice_map)\n done\n\n\ncontext weak_ordering begin\n lemma mop_cmp_v_idx_slice_refine: \"\\ (xs, xs') \\ slice_rel xs\\<^sub>0 l h; (i, i') \\ idx_shift_rel l; (v,v')\\Id \\\n \\ mop_cmpo_v_idx xs v i \\ \\ bool_rel (mop_cmpo_v_idx xs' v' i')\"\n supply [simp del] = conc_Id\n by (auto intro!: refine0 simp: idx_shift_rel_def slice_rel_def in_br_conv slice_nth algebra_simps)\nend \n\n\n\n context weak_ordering begin\n\n \n definition \"is_insert_spec_aux xs i xs' \\ \n \\i'\\i.\n i (length xs' = length xs) \n \\ (\\j\\{0.. (xs'!i' = xs!i)\n \\ (\\j\\{i'<..i}. xs'!j = xs!(j-1) \\ xs!i\\<^bold> (\\j\\{i<.. (i'>0 \\ \\(xs!i \\<^bold>< xs'!(i'-1)) )\n \"\n \n lemma is_insert_spec_aux_imp_sorted:\n \"\\is_insert_spec_aux xs i xs'; sorted_wrt_lt (\\<^bold><) (take i xs)\\ \n \\ sorted_wrt_lt (\\<^bold><) (take (i+1) xs')\" \n (* TODO: Clean up this mess! *)\n apply (subgoal_tac \"i 'a list \\ nat \\ 'a list nres\" where \"is_insert GUARDED xs i \\ doN {\n ASSERT ((\\GUARDED \\ 0 i mop_list_get xs i;\n \n (xs,i)\\WHILEIT (\\(xs',i'). \n i'\\0 \\ (\\GUARDED \\ i'>0) \\ i'\\i \\ length xs'=length xs\n \\ (\\j\\{0..i'}. xs'!j = xs!j) \n \\ (\\j\\{i'<..i}. xs'!j = xs!(j-1) \\ x\\<^bold> (\\j\\{i<..(xs,i). (GUARDED \\ i>0) \\ xs!(i-1)\\<^bold>>x) (\\(xs,i). doN {\n ASSERT (i>0 \\ i mop_list_set xs i x; \n \n RETURN xs\n }\"\n \n definition \"is_insert_spec GUARDED xs i \\ doN {\n ASSERT (i (\\GUARDED \\ 0 \\xs!i\\<^bold>When unguarded, the first element of the list cannot change\\\n lemma is_insert_spec_alt: \"is_insert_spec GUARDED xs i = doN {\n ASSERT (i (\\GUARDED \\ 0 \\xs!i\\<^bold>xs'. is_insert_spec_aux xs i xs' \\ (\\GUARDED \\ xs'!0 = xs!0))\n }\"\n unfolding is_insert_spec_def \n apply (simp only: pw_eq_iff refine_pw_simps; clarsimp; safe)\n unfolding is_insert_spec_aux_def\n apply clarsimp\n by (metis Suc_leI Suc_to_right atLeast0LessThan greaterThanAtMost_iff lessThan_iff not_less_eq)\n \n lemma is_insert_correct: \"is_insert GUARDED xs i \\ is_insert_spec GUARDED xs i\"\n unfolding is_insert_def is_insert_spec_def\n apply (refine_vcg WHILEIT_rule[where R=\"measure snd\"])\n apply clarsimp_all\n subgoal by (metis Suc_lessI Suc_to_right)\n subgoal by linarith\n subgoal by (metis Suc_lessI Suc_pred greaterThanAtMost_iff le_less_trans nth_list_update')\n \n subgoal for xs' i'\n unfolding is_insert_spec_aux_def\n apply (rule exI[where x=i']) \n by auto\n \n done\n \n definition is_insert2 :: \"bool \\ 'a list \\ nat \\ 'a list nres\" where \"is_insert2 GUARDED xs i \\ doN {\n ASSERT ((\\GUARDED\\0 i mop_to_eo_conv xs;\n \n (x,xs) \\ mop_eo_extract xs i;\n \n (xs,i)\\monadic_WHILEIT (\\(xs',i'). True) \n (\\(xs,i). if \\GUARDED \\ i>0 then doN { ASSERT (i>0); mop_cmpo_v_idx xs x (i-1)} else RETURN False) (\\(xs,i). doN {\n ASSERT (i>0);\n (t,xs) \\ mop_eo_extract xs (i-1);\n xs \\ mop_eo_set xs i t;\n let i = i-1;\n RETURN (xs,i)\n }) (xs,i);\n \n xs \\ mop_eo_set xs i x; \n \n xs \\ mop_to_wo_conv xs;\n \n RETURN xs\n }\"\n \n \n definition \"ii2_loop_rel \\ {((xs',i'), (xs,i)). i'=i \\ length xs' = length xs \\ i (\\j\\{0.. xs'!i=None}\"\n \n lemma is_insert2_refine: \"is_insert2 GUARDED xs i \\\\(\\Id\\list_rel) (is_insert GUARDED xs i)\"\n unfolding is_insert2_def is_insert_def\n supply [simp del] = conc_Id\n \n apply simp\n apply (intro refine0; simp)\n apply (rule refine)\n apply (rule monadic_WHILEIT_refine_WHILEIT[where R=ii2_loop_rel])\n subgoal by (auto simp: ii2_loop_rel_def)\n subgoal by simp\n subgoal\n apply (clarsimp split: prod.splits simp: ii2_loop_rel_def)\n apply refine_vcg\n apply (auto)\n done\n subgoal \n apply clarsimp\n apply refine_vcg\n unfolding ii2_loop_rel_def\n apply (auto simp: nth_list_update split: if_splits)\n done\n subgoal\n apply refine_vcg\n apply (auto simp: ii2_loop_rel_def nth_list_update in_set_conv_nth intro: list_eq_iff_nth_eq[THEN iffD2]) \n done\n done\n \n \n definition \"is_insert3 GUARDED xs l i \\ doN {\n \n ASSERT (i mop_to_eo_conv xs;\n \n (x,xs) \\ mop_eo_extract xs i;\n \n (xs,i)\\monadic_WHILEIT (\\(xs',i'). True) \n (\\(xs,i). if \\GUARDED \\ i>l then doN {ASSERT (i>0); mop_cmpo_v_idx xs x (i-1)} else RETURN False) (\\(xs,i). doN {\n ASSERT (i>0);\n (t,xs) \\ mop_eo_extract xs (i-1);\n xs \\ mop_eo_set xs i t;\n let i = i-1;\n RETURN (xs,i)\n }) (xs,i);\n \n xs \\ mop_eo_set xs i x; \n \n xs \\ mop_to_wo_conv xs;\n \n RETURN xs\n }\"\n \n \n lemma is_insert3_refine: \"\\ (xs,xs')\\slice_rel xs\\<^sub>0 l h; (i,i')\\idx_shift_rel l; i \n \\ is_insert3 GUARDED xs l i \\\\(slice_rel xs\\<^sub>0 l h) (is_insert2 GUARDED xs' i')\"\n unfolding is_insert2_def is_insert3_def\n supply [simp del] = conc_Id\n (*apply (simp cong: if_cong)*)\n supply [refine_dref_RELATES] = \n RELATESI[of \"slice_rel xs\\<^sub>0 l h\"] \n RELATESI[of \"slice_rel (map Some xs\\<^sub>0) l h\"] \n RELATESI[of \"slice_rel (map Some xs\\<^sub>0) l h \\\\<^sub>r idx_shift_rel l\"] \n apply (refine_rcg slice_nth_refine' slice_upd_refine' \n mop_eo_extract_slice_refine mop_eo_set_slice_refine mop_to_eo_conv_slice_refine\n mop_cmp_v_idx_slice_refine mop_to_wo_conv_slice_refine\n )\n apply refine_dref_type\n apply (all \\(assumption|simp add: idx_shift_rel_def;simp add: slice_rel_def in_br_conv)?\\)\n done\n\n lemma is_insert3_refine': \"\\ (xs,xs')\\slicep_rel l h; (i,i')\\idx_shift_rel l; i \n \\ is_insert3 GUARDED xs l i \\\\(slice_rel xs l h) (is_insert2 GUARDED xs' i')\"\n unfolding is_insert2_def is_insert3_def\n supply [simp del] = conc_Id\n (*apply (simp cong: if_cong)*)\n supply [refine_dref_RELATES] = \n RELATESI[of \"slicep_rel l h\"] \n RELATESI[of \"slice_rel (map Some xs) l h\"] \n RELATESI[of \"slice_rel (map Some xs) l h \\\\<^sub>r idx_shift_rel l\"] \n apply (refine_rcg slice_nth_refine' slice_upd_refine' \n mop_eo_extract_slice_refine mop_eo_set_slice_refine mop_to_eo_conv_slice_refine\n mop_cmp_v_idx_slice_refine mop_to_wo_conv_slice_refine\n )\n apply refine_dref_type\n apply (all \\(assumption|simp add: idx_shift_rel_def;simp add: slice_rel_def slicep_rel_def in_br_conv)?\\)\n done\n \n lemma is_insert3_correct: \"\\ (xs,xs')\\slice_rel xs\\<^sub>0 l h; (i,i')\\idx_shift_rel l; i \n \\ is_insert3 GUARDED xs l i \\\\(slice_rel xs\\<^sub>0 l h) (is_insert_spec GUARDED xs' i')\"\n using is_insert3_refine is_insert2_refine is_insert_correct \n apply (subgoal_tac \"i' (xs,xs')\\slicep_rel l h; (i,i')\\idx_shift_rel l; i \n \\ is_insert3 GUARDED xs l i \\\\(slice_rel xs l h) (is_insert_spec GUARDED xs' i')\"\n using is_insert3_refine' is_insert2_refine is_insert_correct \n apply (subgoal_tac \"i'd *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\\\<^sub>a woarray_assn elem_assn\"\n unfolding is_insert3_def PR_CONST_def\n apply (simp named_ss HOL_ss:)\n supply [[goals_limit = 1]]\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n\n sepref_def is_unguarded_insert_impl is \"uncurry2 (PR_CONST (is_insert3 False))\" \n :: \"(woarray_assn elem_assn)\\<^sup>d *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\\\<^sub>a woarray_assn elem_assn\"\n unfolding is_insert3_def PR_CONST_def\n apply (simp named_ss HOL_ss:)\n supply [[goals_limit = 1]]\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \n\n (* Approximation of what would be generated for pure elements *) \n thm is_unguarded_insert_impl_def[unfolded eo_extract_impl_def cmpo_v_idx_impl_def, simplified bind_laws split] \n \n (* For presentation in paper *)\n lemma \"is_unguarded_insert_impl \\ \\xs _ i. doM {\n x \\ array_nth xs i;\n (xs, i) \\ llc_while (\\(xs, i). doM {\n bi \\ ll_sub i 1;\n t \\ array_nth xs bi;\n b \\ lt_impl x t;\n array_upd xs bi t;\n return b\n }) (\\(xs, i). doM {\n i' \\ ll_sub i 1;\n t \\ array_nth xs i';\n xs \\ array_upd xs i t;\n i \\ ll_sub i 1;\n return (xs, i)\n })\n (xs, i);\n array_upd xs i x\n }\"\n using is_unguarded_insert_impl_def[unfolded eo_extract_impl_def cmpo_v_idx_impl_def, simplified bind_laws split]\n by simp\n \nend \n\n\n\ncontext weak_ordering begin\n\n lemma is_insert_spec_aux_split: \"is_insert_spec_aux xs i xs' \\ (\\i'\\i. \n xs' = take i' xs @ xs!i # drop i' (take i xs) @ drop (i+1) xs \\ ii\" \n and XS'_EQ: \"xs' = take i' xs @ xs ! i # drop i' (take i xs) @ drop (i + 1) xs\"\n by blast \n \n have XS_EQ: \"xs = take i' xs @ drop i' (take i xs) @ xs!i # drop (i + 1) xs\" \n using L I'\n apply auto \n by (metis atd_lem drop_Suc_nth drop_take_drop_unsplit) \n \n show ?thesis\n apply (rewrite in \"\\ = _\" XS'_EQ)\n apply (rewrite in \"_ = \\\" XS_EQ)\n by (auto) \n \n qed \n\n \n lemma is_insert_spec_aux_imp_mset_eq':\n assumes A: \"is_insert_spec_aux xs i xs'\" \n shows \"mset (take (i+1) xs') = mset (take (i+1) xs)\"\n using A\n proof -\n from A have L: \"ii\" \n and \"xs' = take i' xs @ xs ! i # drop i' (take i xs) @ drop (i + 1) xs\"\n by blast \n hence XS'_EQ: \"take (i+1) xs' = take i' xs @ xs ! i # drop i' (take i xs)\" using L\n by (auto simp: take_Cons split: nat.splits) \n \n have XS_EQ: \"take (i+1) xs = take i' xs @ drop i' (take i xs) @ [xs!i]\" using L I'\n using L I'\n apply auto\n by (metis append.assoc drop_take le_add_diff_inverse take_Suc_conv_app_nth take_add) \n \n show ?thesis\n apply (rewrite in \"\\ = _\" XS'_EQ)\n apply (rewrite in \"_ = \\\" XS_EQ)\n by (auto) \n \n qed \n \n \n lemma is_insert_spec_aux_imp_rest_eq:\n assumes A: \"is_insert_spec_aux xs i xs'\" \n shows \"drop (i+1) xs' = drop (i+1) xs\"\n using A unfolding is_insert_spec_aux_def \n apply (simp add: list_eq_iff_nth_eq)\n by force \n\n lemma is_insert_spec_aux_imp_length_eq:\n assumes A: \"is_insert_spec_aux xs i xs'\" \n shows \"length xs' = length xs\"\n using A unfolding is_insert_spec_aux_def \n by force \n \n \n definition \"sort_one_more_spec GUARDED xs i \\ doN {\n ASSERT (i sorted_wrt_lt (\\<^bold><) (take i xs));\n ASSERT (\\GUARDED \\ 0 \\xs!i\\<^bold>xs'. mset (take (i+1) xs') = mset (take (i+1) xs) \\ drop (i+1) xs' = drop (i+1) xs \\ length xs'=length xs \\ sorted_wrt_lt (\\<^bold><) (take (i+1) xs') \\ (\\GUARDED \\ xs'!0 = xs!0))\n }\" \n \n (* For presentation in paper *) \n lemma \"sort_one_more_spec G xs i = doN {\n ASSERT (i sorted_wrt_lt (\\<^bold><) (slice 0 i xs));\n ASSERT (G \\ 0 \\(xs!i\\<^bold>xs'. inres (slice_sort_spec (\\<^bold><) xs 0 (i+1)) xs' \\ (\\G \\ xs'!0 = xs!0))\n }\"\n unfolding slice_sort_spec_def sort_one_more_spec_def\n apply (simp only: pw_eq_iff refine_pw_simps; safe)\n apply (simp_all add: Misc.slice_def sort_spec_def)\n done\n \n lemma \"sort_one_more_spec G xs i = doN {\n ASSERT (i sorted_wrt_lt (\\<^bold><) (slice 0 i xs));\n ASSERT (G \\ 0 \\(xs!i\\<^bold>xs'. sort_spec (\\<^bold><) (slice 0 (i+1) xs) (slice 0 (i+1) xs') \n \\ length xs'=length xs \n \\ slice (i+1) (length xs) xs' = slice (i+1) (length xs) xs \n \\ (\\G \\ xs'!0 = xs!0))\n }\"\n unfolding slice_sort_spec_def sort_one_more_spec_def\n apply (simp only: pw_eq_iff refine_pw_simps; safe)\n apply (simp_all add: Misc.slice_def sort_spec_def)\n done\n \n \n \n lemma conv_idxs_to_drop_eq: \"length xs = length ys \\ (\\j\\{n.. drop n xs = drop n ys\"\n apply (simp add: list_eq_iff_nth_eq)\n apply (safe;clarsimp)\n by (metis add_diff_cancel_left' diff_less_mono le_iff_add)\n\n (*\n lemma is_insert_sorts_one_more[param_fo, THEN nres_relD,refine]: \n \"(is_insert_spec GUARDED, sort_one_more_spec GUARDED) \n \\ \\Id\\list_rel \\ nat_rel \\ \\\\Id\\list_rel\\nres_rel\"\n apply (intro fun_relI nres_relI; auto) \n unfolding sort_one_more_spec_def is_insert_spec_alt is_insert_spec_aux_def\n apply (clarsimp simp: pw_le_iff refine_pw_simps)\n apply (intro conjI)\n subgoal sledgehammer sorry\n subgoal apply (simp add: list_eq_iff_nth_eq)\n *)\n \n \n lemma is_insert_sorts_one_more[param_fo, THEN nres_relD,refine]: \n \"(is_insert_spec GUARDED, sort_one_more_spec GUARDED) \n \\ \\Id\\list_rel \\ nat_rel \\ \\\\Id\\list_rel\\nres_rel\"\n apply (intro fun_relI nres_relI) \n using is_insert_spec_aux_imp_sorted is_insert_spec_aux_imp_mset_eq' \n is_insert_spec_aux_imp_rest_eq is_insert_spec_aux_imp_length_eq\n unfolding sort_one_more_spec_def is_insert_spec_alt\n apply (simp add: pw_le_iff refine_pw_simps)\n apply (auto simp: )\n done\n\n \n definition \"gen_insertion_sort GUARDED i\\<^sub>0 h xs \\ doN {\n ASSERT ((\\GUARDED \\ 00) \\ h\\length xs);\n (xs,_)\\WHILEIT (\\(xs',i). \n i\\<^sub>0\\i \\ i\\h \\ length xs'=length xs \\ mset (take i xs') = mset (take i xs) \\ drop i xs' = drop i xs \\ sorted_wrt_lt (\\<^bold><) (take i xs')\n \\ (\\GUARDED \\ xs'!0 = xs!0)\n ) \n (\\(xs,i). i(xs,i). doN {\n xs \\ sort_one_more_spec GUARDED xs i;\n ASSERT (i0);\n RETURN xs\n }\" \n \n \n lemma gen_insertion_sort_correct: \n \"\\sorted_wrt_lt (\\<^bold><) (take i\\<^sub>0 xs); \\GUARDED \\ 00; i\\<^sub>0length xs; \\GUARDED \\ (\\i\\{i\\<^sub>0..xs!i \\<^bold>< xs!0) \\ \n \\ gen_insertion_sort GUARDED i\\<^sub>0 h xs \\ slice_sort_spec (\\<^bold><) xs 0 h\"\n unfolding gen_insertion_sort_def sort_one_more_spec_def slice_sort_spec_def sort_spec_def sorted_sorted_wrt\n apply (refine_vcg \n WHILEIT_rule[where R=\"measure (\\(_,i). length xs - i)\"]) \n \n apply (all \\(clarsimp;fail)?\\) \n subgoal by clarsimp (metis atLeastLessThan_iff hd_drop_conv_nth less_le_trans)\n subgoal by clarsimp (metis hd_drop_conv_nth less_le_trans take_Suc_conv_app_nth union_code)\n subgoal apply clarsimp by (metis drop_Suc tl_drop)\n subgoal apply simp by force\n subgoal apply simp by (metis Misc.slice_def drop0 drop_take)\n subgoal by (clarsimp simp: Misc.slice_def) \n done\n\n(*\n \n lemma \"\\part_sorted_wrt (le_by_lt (\\<^bold><)) n xs; sort_spec (\\<^bold><) (slice 0 n xs) (slice 0 n xs'); drop n xs' = drop n xs\\ \n \\ part_sorted_wrt (le_by_lt (\\<^bold><)) n xs'\"\n unfolding sort_spec_def\n apply auto\n proof -\n define xs\\<^sub>1 where \"xs\\<^sub>1 = slice 0 n xs\"\n define xs\\<^sub>2 where \"xs\\<^sub>2 = drop n xs\"\n have \"xs = xs\\<^sub>1@xs\\<^sub>2\" unfolding xs\\<^sub>1_def xs\\<^sub>2_def Misc.slice_def by auto\n thm part_sorted_concatI\n \n \n \n unfolding sort_spec_def\n apply auto\n \n \n oops end end\n*) \n\n\n \n definition \"gen_insertion_sort2 GUARDED l i h xs \\ doN {\n (xs,_)\\WHILET\n (\\(xs,i). i(xs,i). doN {\n xs \\ is_insert3 GUARDED xs l i;\n ASSERT (islicep_rel l h\" \"(i,i')\\idx_shift_rel l\" \"i\\(slice_rel xs l h) (sort_one_more_spec GUARDED xs' i')\"\n proof -\n note is_insert3_correct' \n also note is_insert_sorts_one_more\n finally show ?thesis using assms by simp\n qed\n\n \n lemma gen_insertion_sort2_refine: \n \"\\ (xsi,xs) \\ slicep_rel l h; (ii,i)\\idx_shift_rel l; (ji,j)\\idx_shift_rel l \\ \n \\ gen_insertion_sort2 GUARDED l ii ji xsi \\\\(slice_rel xsi l h) (gen_insertion_sort GUARDED i j xs)\"\n unfolding gen_insertion_sort_def gen_insertion_sort2_def\n apply (refine_rcg is_insert3_sorts_one_more)\n supply [refine_dref_RELATES] = RELATESI[of \"slice_rel xsi l h \\\\<^sub>r idx_shift_rel l\"] \n apply refine_dref_type\n apply clarsimp_all\n applyS (auto simp: idx_shift_rel_def slice_rel_alt eq_outside_range_triv slicep_rel_def)[]\n applyS (auto simp: idx_shift_rel_def slicep_rel_def)[]\n applyS (auto simp: idx_shift_rel_def slice_rel_alt) []\n applyS (auto simp: idx_shift_rel_def slicep_rel_def)[]\n subgoal\n apply (clarsimp simp: idx_shift_rel_def slice_rel_alt) []\n by (erule (1) eq_outside_range_gen_trans; auto)\n done\n \n \nend\n \ncontext sort_impl_context begin\n \n sepref_register \n unguarded_insertion_sort2: \"gen_insertion_sort2 False\"\n guarded_insertion_sort2: \"gen_insertion_sort2 True\"\n \n sepref_def unguarded_insertion_sort_impl is \"uncurry3 (PR_CONST (gen_insertion_sort2 False))\" \n :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (woarray_assn elem_assn)\\<^sup>d \\\\<^sub>a woarray_assn elem_assn\"\n unfolding gen_insertion_sort2_def PR_CONST_def\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \n sepref_def guarded_insertion_sort_impl is \"uncurry3 (PR_CONST (gen_insertion_sort2 True))\" \n :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (woarray_assn elem_assn)\\<^sup>d \\\\<^sub>a woarray_assn elem_assn\"\n unfolding gen_insertion_sort2_def PR_CONST_def\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \nend \n\n \ncontext parameterized_weak_ordering begin \n\n definition \"is_insert_param GUARDED cparam xs l i \\ doN {\n \n ASSERT (i\\ASSERT (set xs \\ cdom);\\\n \n xs \\ mop_to_eo_conv xs;\n \n (x,xs) \\ mop_eo_extract xs i;\n\n \\<^cancel>\\\n ASSERT (x \\ cdom);\n ASSERT (\\x. Some x \\ set xs \\ x\\cdom);\n \\\n \n (xs,i)\\monadic_WHILEIT (\\(xs',i'). True) \n (\\(xs,i). if \\GUARDED \\ i>l then doN {ASSERT (i>0); pcmpo_v_idx2 cparam xs x (i-1)} else RETURN False) (\\(xs,i). doN {\n ASSERT (i>0);\n (t,xs) \\ mop_eo_extract xs (i-1);\n xs \\ mop_eo_set xs i t;\n let i = i-1;\n RETURN (xs,i)\n }) (xs,i);\n \n xs \\ mop_eo_set xs i x; \n \n xs \\ mop_to_wo_conv xs;\n \n RETURN xs\n }\"\n \n\n term is_insert4\n \n lemma is_insert_param_refine[refine]:\n assumes \"(xs',xs)\\cdom_list_rel cparam\"\n assumes \"(l',l)\\Id\"\n assumes \"(i',i)\\Id\"\n shows \"is_insert_param GUARDED cparam xs' l' i' \\\\(cdom_list_rel cparam) (WO.is_insert3 cparam GUARDED xs l i)\"\n supply [refine_dref_RELATES] = RELATESI[of \"cdom_list_rel cparam\"] RELATESI[of \"cdom_olist_rel cparam\"]\n unfolding is_insert_param_def WO.is_insert3_def\n apply refine_rcg\n apply (refine_dref_type)\n using assms\n by (auto simp: cdom_list_rel_alt cdom_olist_rel_alt in_br_conv)\n \n definition \"gen_insertion_sort_param GUARDED cparam l i h xs \\ doN {\n (xs,_)\\WHILET\n (\\(xs,i). i(xs,i). doN {\n xs \\ is_insert_param GUARDED cparam xs l i;\n ASSERT (i\n (l',l)\\Id; (i',i)\\Id; (h',h)\\Id; (xs',xs)\\cdom_list_rel cparam\n \\ \\ gen_insertion_sort_param GUARDED cparam l' i' h' xs' \n \\ \\(cdom_list_rel cparam) (WO.gen_insertion_sort2 cparam GUARDED l i h xs)\"\n unfolding gen_insertion_sort_param_def WO.gen_insertion_sort2_def\n supply [refine_dref_RELATES] = RELATESI[of \"cdom_list_rel cparam\"]\n apply refine_rcg\n apply refine_dref_type\n apply auto\n done\n\n \n\nend\n\n \ncontext parameterized_sort_impl_context begin\n \n sepref_register \n is_guarded_param_insert3: \"is_insert_param True\"\n is_unguarded_param_insert3: \"is_insert_param False\"\n \n sepref_def is_guarded_param_insert_impl is \"uncurry3 (PR_CONST (is_insert_param True))\" \n :: \"cparam_assn\\<^sup>k *\\<^sub>a wo_assn\\<^sup>d *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\\\<^sub>a wo_assn\"\n unfolding is_insert_param_def PR_CONST_def\n apply (simp named_ss HOL_ss:)\n supply [[goals_limit = 1]]\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n\n sepref_def is_unguarded_param_insert_impl is \"uncurry3 (PR_CONST (is_insert_param False))\" \n :: \"cparam_assn\\<^sup>k *\\<^sub>a wo_assn\\<^sup>d *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\\\<^sub>a wo_assn\"\n unfolding is_insert_param_def PR_CONST_def\n apply (simp named_ss HOL_ss:)\n supply [[goals_limit = 1]]\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \n\n \n sepref_register \n unguarded_insertion_sort_param: \"gen_insertion_sort_param False\"\n guarded_insertion_sort_param: \"gen_insertion_sort_param True\"\n \n sepref_def unguarded_insertion_sort_param_impl is \"uncurry4 (PR_CONST (gen_insertion_sort_param False))\" \n :: \"cparam_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a wo_assn\\<^sup>d \\\\<^sub>a wo_assn\"\n unfolding gen_insertion_sort_param_def PR_CONST_def\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \n sepref_def guarded_insertion_sort_param_impl is \"uncurry4 (PR_CONST (gen_insertion_sort_param True))\" \n :: \"cparam_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a wo_assn\\<^sup>d \\\\<^sub>a wo_assn\"\n unfolding gen_insertion_sort_param_def PR_CONST_def\n apply (annot_snat_const \"TYPE(size_t)\")\n by sepref\n \nend\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/examples/sorting/Sorting_Unguarded_Insertion_Sort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.34158251284363395, "lm_q1q2_score": 0.18012210311996138}} {"text": "(* \n Title: Psi-calculi \n Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weaken_Stat_Imp\n imports Weaken_Transition\nbegin\n\ncontext weak begin\n\ndefinition\n \"weakenStatImp\" :: \"'b \\ ('a, 'b, 'c) psi \\\n ('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set \\ \n ('a, 'b, 'c) psi \\ bool\" (\"_ \\ _ \\\\<^sub>w<_> _\" [80, 80, 80, 80] 80)\nwhere \"\\ \\ P \\\\<^sub>w Q \\ \\Q'. \\ \\ Q \\\\<^sup>^\\<^sub>\\ Q' \\ insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q') \\ \\ (\\, P, Q') \\ Rel\"\n\nlemma weakenStatImpMonotonic:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and A :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and B :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n\n assumes \"\\ \\ P \\\\<^sub>w Q\"\n and \"A \\ B\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nusing assms\nby(auto simp add: weakenStatImp_def)\n\nlemma weakenStatImpI:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\"\n and \"insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q') \\\"\n and \"(\\, P, Q') \\ Rel\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nusing assms\nby(auto simp add: weakenStatImp_def)\n\nlemma weakenStatImpE:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n and \\' :: 'b\n\n assumes \"\\ \\ P \\\\<^sub>w Q\"\n\n obtains Q' where \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\" and \"insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q') \\ \" and \"(\\, P, Q') \\ Rel\"\nusing assms\nby(auto simp add: weakenStatImp_def)\n\nlemma weak_stat_impWeakenStatImp:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes cSim: \"\\ \\ P \\ Q\"\n and cStatEq: \"\\\\' R S \\''. \\(\\', R, S) \\ Rel; \\' \\ \\''\\ \\ (\\'', R, S) \\ Rel\"\n\n shows \"\\ \\ P \\\\<^sub>w Q\"\nproof -\n from `\\ \\ P \\ Q` \n obtain Q' Q'' where QChain: \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\"\n and PImpQ': \"insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q') \\\"\n and Q'Chain: \"\\ \\ \\ \\ Q' \\\\<^sup>^\\<^sub>\\ Q''\" and \"(\\ \\ \\, P, Q'') \\ Rel\"\n by(rule weak_stat_impE)\n from Q'Chain Identity have Q'Chain: \"\\ \\ Q' \\\\<^sup>^\\<^sub>\\ Q''\" by(rule tau_chain_stat_eq)\n with QChain have \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q''\" by auto\n moreover from Q'Chain have \"insert_assertion(extract_frame Q') \\ \\\\<^sub>F insert_assertion(extract_frame Q'') \\\"\n by(rule statImpTauChainDerivative)\n with PImpQ' have \"insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q'') \\\"\n by(rule Frame_stat_imp_trans)\n moreover from `(\\ \\ \\, P, Q'') \\ Rel` Identity have \"(\\, P, Q'') \\ Rel\" by(rule cStatEq)\n ultimately show ?thesis by(rule weakenStatImpI)\nqed\n\nlemma weakenStatImpWeakStatImp:\n fixes \\ :: 'b\n and P :: \"('a, 'b, 'c) psi\"\n and Rel :: \"('b \\ ('a, 'b, 'c) psi \\ ('a, 'b, 'c) psi) set\"\n and Q :: \"('a, 'b, 'c) psi\"\n\n assumes \"\\ \\ P \\\\<^sub>w Q\"\n and cExt: \"\\\\' R S \\''. (\\', R, S) \\ Rel \\ (\\' \\ \\'', R, S) \\ Rel\"\n\n shows \"\\ \\ P \\ Q\"\nproof(induct rule: weak_stat_impI)\n case(cStatImp \\')\n \n from `\\ \\ P \\\\<^sub>w Q` \n obtain Q' where QChain: \"\\ \\ Q \\\\<^sup>^\\<^sub>\\ Q'\"\n and PImpQ': \"insert_assertion(extract_frame P) \\ \\\\<^sub>F insert_assertion(extract_frame Q') \\\"\n and \"(\\, P, Q') \\ Rel\"\n by(rule weakenStatImpE)\n note QChain PImpQ'\n moreover have \"\\ \\ \\' \\ Q' \\\\<^sup>^\\<^sub>\\ Q'\" by simp\n moreover from `(\\, P, Q') \\ Rel` have \"(\\ \\ \\', P, Q') \\ Rel\" by(rule cExt)\n ultimately show ?case by blast\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weaken_Stat_Imp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3486451217982255, "lm_q1q2_score": 0.17976836831884152}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__46.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__46 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__46 and some rule r*}\nlemma n_RecvReqSVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__46 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__46:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__46 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__46.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.1795897337289884}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__149.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__149 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__149 and some rule r*}\nlemma n_PI_Remote_GetVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__149:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__149:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__149:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__149:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__149:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__149:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__149:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__149:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__149:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__149:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__149:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__149:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__149:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__149:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__149 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__149:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__149:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__149:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__149:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__149:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__149:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__149:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__149:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__149:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__149:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__149:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__149:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__149:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__149:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__149:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__149:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__149:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__149:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__149:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__149:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__149.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.34510526422232046, "lm_q1q2_score": 0.17928954308140627}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n Example C structure instantiation and related lemmas\n*)\n\ntheory CompoundCTypesEx\nimports CompoundCTypes\nbegin\n\nrecord x_struct_ex =\n x_example :: \"32 word\"\n y_example :: \"8 word\"\n\ndefinition x_struct_ex_tag :: \"'a x_struct_ex_scheme typ_info\" where\n \"x_struct_ex_tag \\ (\n final_pad \\\n (ti_typ_pad_combine TYPE(8 word) y_example (y_example_update \\ (\\x _. x)) ''y_example'') \\\n (ti_typ_pad_combine TYPE(32 word) x_example (x_example_update \\ (\\x _. x)) ''x_example''))\n (empty_typ_info ''x_struct_ex'')\"\n\ninstantiation x_struct_ex_ext :: (type) c_type\nbegin\ninstance ..\nend\n\noverloading x_struct_ex_typ_tag \\ typ_info_t begin\ndefinition\nx_struct_ex_typ_tag: \"x_struct_ex_typ_tag (t::'a x_struct_ex_ext itself) \\\n (x_struct_ex_tag::'a x_struct_ex_scheme typ_info)\"\nend\n\n\nlemma aggregate_x_struct_ex_tag [simp]:\n \"aggregate x_struct_ex_tag\"\n by (simp add: x_struct_ex_tag_def final_pad_def Let_def)\n\nlemma\n \"upd_local (x_example_update \\ (\\x _. x))\"\napply(auto simp: upd_local_def )\napply(tactic \\Record.split_tac @{context} 1\\ )\napply simp\ndone\n\ninstantiation x_struct_ex_ext :: (unit_class) mem_type\nbegin\ninstance\napply intro_classes\n\napply(auto simp: x_struct_ex_typ_tag x_struct_ex_tag_def)\n\n(* wf_desc *)\napply(fastforce intro: wf_desc_final_pad wf_desc_ti_typ_pad_combine)\n\n(* wf_size_desc *)\napply(fastforce intro: wf_size_desc_ti_typ_pad_combine wf_size_desc_final_pad)\n\n(* wf_lf *)\napply(fastforce intro: wf_lf_final_pad wf_lf_ti_typ_pad_combine\n wf_desc_final_pad wf_desc_ti_typ_pad_combine\n g_ind_ti_typ_pad_combine f_ind_ti_typ_pad_combine\n fa_ind_ti_typ_pad_combine)\n\n(* fu_eq_mask *)\napply(rule fu_eq_mask)\n apply(simp add: size_of_def x_struct_ex_typ_tag x_struct_ex_tag_def)\napply(rule fu_eq_mask_final_pad)\napply(rule fu_eq_mask_ti_typ_pad_combine)+\napply(rule fu_eq_mask_empty_typ_info)\napply(simp add: there_is_only_one)\napply(fastforce simp: fg_cons_def intro: fc_ti_typ_pad_combine)+\n\n(* align_of dvd size_of *)\napply(simp add: align_of_def size_of_def x_struct_ex_typ_tag\n x_struct_ex_tag_def)\n\n(* align_field *)\napply(simp add: align_field_final_pad align_field_ti_typ_pad_combine)\n\n(* max_size *)\napply(simp add: size_of_def x_struct_ex_typ_tag x_struct_ex_tag_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine\n size_td_lt_ti_typ_combine size_td_lt_ti_pad_combine padup_def\n addr_card align_of_final_pad align_of_def)\ndone\nend\n\ndeclare x_struct_ex_typ_tag [simp add]\ndeclare x_struct_ex_tag_def [simp add]\n\nlemma x_struct_ex_fnl [simp]:\n \"field_names_list (x_struct_ex_tag::'a x_struct_ex_scheme typ_info) =\n [''x_example'',''y_example''] @\n padding_fields (x_struct_ex_tag::'a x_struct_ex_scheme typ_info)\"\napply(clarsimp simp: field_names_list_def)\ndone\n\n\nrecord y_struct_ex =\n x2_example :: \"32 word ptr\"\n(*\n x3_example :: \"32 word ptr\"\n x4_example :: \"32 word ptr\"\n x5_example :: \"32 word ptr\"\n x6_example :: \"32 word ptr\"\n x7_example :: \"32 word ptr\"\n\n x12_example :: \"32 word ptr\"\n x13_example :: \"32 word ptr\"\n x14_example :: \"32 word ptr\"\n x15_example :: \"32 word ptr\"\n x16_example :: \"32 word ptr\"\n x17_example :: \"32 word ptr\"*)\n y2_example :: \"x_struct_ex\"\n\ndefinition y_struct_ex_tag :: \"'a y_struct_ex_scheme typ_info\" where\n \"y_struct_ex_tag \\ (\n final_pad \\\n (ti_typ_pad_combine TYPE(x_struct_ex) y2_example (y2_example_update \\ (\\x _. x)) ''y2_example'') \\\n (ti_typ_pad_combine TYPE(32 word ptr) x2_example (x2_example_update \\ (\\x _. x)) ''x2_example'')\n )\n (empty_typ_info ''y_struct_ex'')\"\n\ninstantiation y_struct_ex_ext :: (type) c_type\nbegin\ninstance ..\nend\n\noverloading y_struct_ex_typ_tag \\ typ_info_t\nbegin\ndefinition\ny_struct_ex_typ_tag: \"y_struct_ex_typ_tag (t::'a y_struct_ex_ext itself) \\\n (y_struct_ex_tag::'a y_struct_ex_scheme typ_info)\"\nend\n\ninstantiation y_struct_ex_ext :: (unit_class) mem_type\nbegin\n\ninstance\napply intro_classes\n\napply(auto simp: y_struct_ex_typ_tag y_struct_ex_tag_def align_of_def size_of_def)\n\n(* wf_desc *)\napply(fastforce intro: wf_desc_final_pad wf_desc_ti_typ_pad_combine)\n\n(* wf_size_desc *)\napply(fastforce intro: wf_size_desc_ti_typ_pad_combine wf_size_desc_final_pad)\n\n(* wf_lf *)\napply(force intro: wf_lf_final_pad wf_lf_ti_typ_pad_combine\n wf_desc_final_pad wf_desc_ti_typ_pad_combine\n g_ind_ti_typ_pad_combine f_ind_ti_typ_pad_combine\n fa_ind_ti_typ_pad_combine)\n\n(* fu_eq_mask *)\napply(rule fu_eq_mask)\n apply(simp add: size_of_def y_struct_ex_typ_tag y_struct_ex_tag_def)\napply(rule fu_eq_mask_final_pad)\napply(rule fu_eq_mask_ti_typ_pad_combine)+\napply(rule fu_eq_mask_empty_typ_info)\napply(simp add: there_is_only_one)\napply(fastforce simp: fg_cons_def intro: fc_ti_typ_pad_combine)+\n\n(* align_field *)\napply(simp add: align_field_final_pad align_field_ti_typ_pad_combine)\n\n(* max_size *)\napply(simp add: size_td_simps_1)\napply(simp add: size_td_simps_2 addr_card )\ndone\n\nend\n\ndeclare y_struct_ex_typ_tag [simp add]\ndeclare y_struct_ex_tag_def [simp add]\n\nlemma y_struct_ex_fnl [simp]:\n \"field_names_list (y_struct_ex_tag::'a y_struct_ex_scheme typ_info) =\n [''x2_example'',''y2_example''] @\n padding_fields (y_struct_ex_tag::'a y_struct_ex_scheme typ_info)\"\napply(clarsimp simp: field_names_list_def)\ndone\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/CompoundCTypesEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.34510526422232046, "lm_q1q2_score": 0.17928954308140624}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__117.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__117 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__117 and some rule r*}\nlemma n_PI_Remote_GetVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__117:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__117:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__117:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__117:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__117:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__117:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__117:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__117:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__117:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__117:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__117:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_GetVsinv__117:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__117:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__117:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__117:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__117:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_ClearVsinv__117:\nassumes a1: \"(r=n_NI_Nak_Clear )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__117:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__117:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__117:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__117:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__117 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__117:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__117:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__117:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__117:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__117:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__117:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__117:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__117:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__117:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__117:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__117:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__117:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__117:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__117:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__117:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__117.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.17927717104487445}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__20_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__20_on_rules imports n_german_lemma_on_inv__20\nbegin\nsection{*All lemmas on causal relation between inv__20*}\nlemma lemma_inv__20_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__20 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__20) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__20_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3557749071749625, "lm_q1q2_score": 0.17927717104487445}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__61_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__61_on_rules imports n_g2kAbsAfter_lemma_on_inv__61\nbegin\nsection{*All lemmas on causal relation between inv__61*}\nlemma lemma_inv__61_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__61 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__61) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__61) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__61_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.3276683073862188, "lm_q1q2_score": 0.17914876968424231}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory LemmaBucket_C\nimports\n TypHeapLib\n Aligned\n WordLemmaBucket\nbegin\n\ndeclare word_neq_0_conv [simp del]\n\nlemma Ptr_not_null_pointer_not_zero: \"(Ptr p \\ NULL)=(p\\0)\"\n by simp\n\nlemma hrs_mem_f: \"f (hrs_mem s) = hrs_mem (hrs_mem_update f s)\"\n apply (cases s) \n apply (clarsimp simp: hrs_mem_def hrs_mem_update_def)\n done\n\nlemma hrs_mem_heap_update:\n \"heap_update p v (hrs_mem s) = hrs_mem (hrs_mem_update (heap_update p v) s)\"\n apply (rule hrs_mem_f)\n done\n\nlemma addr_card_wb:\n \"addr_card = 2 ^ word_bits\"\n by (simp add: addr_card_def card_word word_bits_conv)\n\nlemma surj_Ptr [simp]:\n \"surj Ptr\"\n by (rule surjI [where f = ptr_val], simp)\n\nlemma inj_Ptr [simp]:\n \"inj Ptr\"\n apply (rule injI)\n apply simp\n done\n \nlemma bij_Ptr :\n \"bij Ptr\" \n by (simp add: bijI)\n\nlemma exec_Guard:\n \"(G \\ \\Guard Err S c, Normal s\\ \\ s')\n = (if s \\ S then G \\ \\c, Normal s\\ \\ s'\n else s' = Fault Err)\"\n by (auto split: split_if elim!: exec_elim_cases\n intro: exec.intros)\n\nlemma to_bytes_word8:\n \"to_bytes (v :: word8) xs = [v]\"\n by (simp add: to_bytes_def typ_info_word word_rsplit_same)\n\nlemma byte_ptr_guarded:\"ptr_val (x::8 word ptr) \\ 0 \\ c_guard x\"\n unfolding c_guard_def c_null_guard_def ptr_aligned_def\n by (clarsimp simp: intvl_Suc)\n\nlemma heap_update_list_append:\n fixes v :: word8\n shows \"heap_update_list s (xs @ ys) hp = \n heap_update_list (s + of_nat (length xs)) ys (heap_update_list s xs hp)\"\nproof (induct xs arbitrary: ys rule: rev_induct)\n case Nil\n show ?case by simp\nnext\n case (snoc v' vs')\n show ?case\n apply (simp add: snoc.hyps field_simps)\n apply (rule arg_cong [where f = \"heap_update_list (1 + (s + of_nat (length vs'))) ys\"])\n apply (rule ext)\n apply simp\n done\nqed\n\nlemma intvl_aligned_bottom_eq:\n fixes p :: \"'a::len word\"\n assumes al1: \"is_aligned x n\" \n and al2: \"is_aligned p bits\"\n and nb: \"\\ n < bits\"\n and off: \"off \\ 2 ^ bits\" \"off \\ 0\"\n shows \"(x \\ {p ..+ off}) = (x = p)\"\nproof (rule iffI)\n assume \"x = p\"\n thus \"x \\ {p ..+ off}\" using off\n by (simp add: intvl_self)\nnext\n assume x_in_intvl: \"x \\ {p ..+ off}\"\n\n show \"x = p\"\n proof cases\n assume wb: \"bits < len_of TYPE('a)\"\n\n from x_in_intvl obtain kp where xp: \"x = p + of_nat kp\" and kp: \"kp < off\"\n by (clarsimp dest!: intvlD)\n \n hence \"is_aligned (p + of_nat kp) n\" using al1 by simp\n hence \"2 ^ n dvd unat (p + of_nat kp)\" unfolding is_aligned_def .\n hence \"2 ^ n dvd unat p + kp\" using kp off wb\n apply -\n apply (subst (asm) iffD1 [OF unat_plus_simple])\n apply (rule is_aligned_no_wrap' [OF al2])\n apply (rule of_nat_power)\n apply simp_all[2]\n apply (subst (asm) unat_of_nat)\n apply (subst (asm) mod_less)\n apply (erule order_less_le_trans)\n apply (erule order_trans)\n apply simp\n apply simp\n done\n\n moreover from al2 obtain q2 where pbits: \"p = 2 ^ bits * of_nat q2\"\n and q2: \"q2 < 2 ^ (len_of TYPE('a) - bits)\"\n by (rule is_alignedE)\n \n moreover from nb obtain kn where nbits: \"n = bits + kn\"\n by (clarsimp simp: linorder_not_less le_iff_add)\n\n ultimately have \"2 ^ bits dvd 2 ^ bits * q2 + kp\" \n apply (simp add: power_add)\n apply (simp add: unat_mult_power_lem [OF q2])\n apply (erule dvd_mult_left)\n done\n \n hence \"2 ^ bits dvd kp\" by (simp add: dvd_reduce_multiple)\n with kp have \"kp = 0\" \n apply -\n apply (erule contrapos_pp)\n apply (simp add: linorder_not_less)\n apply (drule (1) dvd_imp_le)\n apply (erule order_trans [OF off(1)])\n done\n \n thus ?thesis using xp by simp\n next\n assume wb: \"\\ bits < len_of TYPE('a)\"\n with assms\n show ?thesis by (simp add: is_aligned_mask mask_def power_overflow)\n qed\nqed\n\nlemma intvl_mem_weaken: \"x \\ {p..+a - n} \\ x \\ {p..+a}\"\n apply -\n apply (drule intvlD)\n apply clarsimp\n apply (rule intvlI)\n apply simp\n done\n\n\nlemma upto_intvl_eq:\n fixes x :: \"'a::len word\"\n assumes al: \"is_aligned x n\"\n shows \"{x..+2 ^ n} = {x .. x + 2 ^ n - 1}\"\nproof cases\n assume \"n < len_of TYPE('a)\"\n with assms show ?thesis\n unfolding intvl_def\n apply simp\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k < (2 :: 'a word) ^ n\")\n apply (intro conjI)\n apply (erule (1) is_aligned_no_wrap')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (simp add: word_less_sub_1)\n apply (simp add: field_simps is_aligned_no_overflow)\n apply (simp add: of_nat_power)\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI)\n apply clarsimp\n apply (rule unat_less_power, assumption)\n apply (subst word_less_sub_le [symmetric])\n apply assumption\n apply (rule word_diff_ls'(4))\n apply (simp add: field_simps)\n apply assumption\n done\nnext\n assume \"\\ n < len_of TYPE('a)\"\n with assms show ?thesis\n apply (simp add: is_aligned_mask mask_def power_overflow intvl_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rename_tac w)\n apply (case_tac w)\n apply (rename_tac m)\n apply (rule_tac x=m in exI)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n done\nqed\n\nlemma upto_intvl_eq': \n fixes x :: \"'a :: len word\"\n shows \"\\ x \\ x + (of_nat b - 1); b \\ 0; b \\ 2 ^ len_of TYPE('a)\\ \\ {x..+b} = {x .. x + of_nat b - 1}\"\n unfolding intvl_def\n apply rule\n apply clarsimp\n apply (subgoal_tac \"of_nat k \\ (of_nat (b - 1) :: 'a word)\")\n apply (intro conjI)\n apply (erule word_random)\n apply simp\n apply (subst field_simps [symmetric], rule word_plus_mono_right)\n apply simp\n apply assumption\n apply (subst of_nat_mono_maybe_le [symmetric])\n apply simp\n apply simp\n apply simp\n apply clarsimp\n apply (rule_tac x = \"unat (xa - x)\" in exI) \n apply simp\n apply (simp add: unat_sub)\n apply (rule nat_diff_less)\n apply (subst (asm) word_le_nat_alt, erule order_le_less_trans)\n apply (subst add_diff_eq[symmetric], subst unat_plus_if')\n apply (simp add: no_olen_add_nat)\n apply (simp add: le_eq_less_or_eq)\n apply (erule disjE)\n apply (subst unat_minus_one)\n apply (erule (1) of_nat_neq_0)\n apply (simp add: unat_of_nat)\n apply (erule ssubst, rule unat_lt2p)\n apply (simp add: word_le_nat_alt)\n done\n\nlemma intvl_aligned_top:\n fixes x :: \"'a::len word\"\n assumes al1: \"is_aligned x n\" \n and al2: \"is_aligned p bits\"\n and nb: \"n \\ bits\"\n and offn: \"off < 2 ^ n\"\n and wb: \"bits < len_of TYPE('a)\"\n shows \"(x \\ {p ..+ 2 ^ bits - off}) = (x \\ {p ..+ 2 ^ bits})\"\nproof (rule iffI)\n assume \"x \\ {p..+2 ^ bits - off}\"\n thus \"x \\ {p..+2 ^ bits}\" by (rule intvl_mem_weaken)\nnext\n assume asm: \"x \\ {p..+2 ^ bits}\"\n\n show \"x \\ {p..+2 ^ bits - off}\"\n proof (cases \"n = 0\")\n case True\n with offn asm show ?thesis by simp\n next\n case False\n \n from asm have \"x \\ {p .. p + 2 ^ bits - 1}\"\n by (simp add: upto_intvl_eq [OF al2])\n then obtain q where xp: \"x = p + of_nat (q * 2 ^ n)\" and qb: \"q < 2 ^ (bits - n)\" using False nb\n by (fastforce dest!: is_aligned_diff[OF al1 al2 wb,simplified field_simps])\n \n have \"q * 2 ^ n < 2 ^ bits - off\"\n proof - \n show ?thesis using offn qb nb\n apply (simp add: less_diff_conv)\n apply (erule (1) nat_add_offset_less)\n apply arith\n done\n qed\n \n with xp show ?thesis\n apply -\n apply (erule ssubst)\n apply (erule intvlI)\n done\n qed\nqed\n\nlemma intvl_nowrap:\n fixes x :: \"'a::len word\"\n shows \"\\y \\ 0; unat y + z \\ 2 ^ len_of TYPE('a)\\ \\ x \\ {x + y ..+ z}\"\n apply clarsimp\n apply (drule intvlD)\n apply clarsimp\n apply (simp add: unat_arith_simps)\n apply (simp split: split_if_asm)\n apply (simp add: unat_of_nat)\n done\n\nlemma heap_update_list_update:\n fixes v :: word8\n shows \"x \\ y \\ heap_update_list s xs (hp(y := v)) x = heap_update_list s xs hp x\"\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp add: heap_update_list_append cong: if_cong)\n done\n\n(* FIXME: generalise *) \nlemma heap_update_list_append2:\n fixes v :: word8\n shows \"length xs + length ys < 2 ^ word_bits \\ heap_update_list s (xs @ ys) hp = \n (heap_update_list s xs (heap_update_list (s + of_nat (length xs)) ys hp))\"\nproof (induct xs arbitrary: hp s)\n case Nil\n show ?case by simp\nnext\n case (Cons v' vs')\n\n have \"(1 :: word32) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"\\ \\ 0\" using Cons.prems\n apply -\n apply (rule of_nat_neq_0)\n apply simp\n apply (simp add: word_bits_conv)\n done\n finally have neq0: \"(1 :: word32) + of_nat (length vs') \\ 0\" .\n\n have \"(1 :: word32) + of_nat (length vs') = of_nat (length (v' # vs'))\"\n by simp\n also have \"unat \\ + length ys < 2 ^ word_bits\" using Cons.prems \n apply (subst unat_of_nat)\n apply (simp add: word_bits_conv)\n done\n finally have lt: \"unat ((1 :: word32) + of_nat (length vs')) + length ys < 2 ^ word_bits\" .\n \n from Cons.prems have \"length vs' + length ys < 2 ^ word_bits\" by simp\n thus ?case\n apply simp\n apply (subst Cons.hyps, assumption)\n apply (rule arg_cong [where f = \"heap_update_list (s + 1) vs'\"])\n apply (rule ext)\n apply (case_tac \"x = s\")\n apply simp\n apply (subst heap_update_nmem_same)\n apply (subst add.assoc)\n apply (rule intvl_nowrap[OF neq0 order_less_imp_le\n [OF lt[unfolded word_bits_def]]])\n apply simp\n apply (clarsimp simp: heap_update_list_update field_simps)\n done\nqed\n\nlemma heap_update_word8:\n \"heap_update p (v :: word8) hp = hp(ptr_val p := v)\"\n unfolding heap_update_def by (simp add: to_bytes_word8)\n\nlemma index_foldr_update2:\n \"\\ n \\ i; i < CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. i < n; n \\ CARD('b::finite) \\ \\ index (foldr (\\n arr. Arrays.update arr n m) [0.. c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\" \n shows \"{a..+b} \\ {c..+d} = {}\"\nproof (rule disjointI, rule notI)\n fix x y\n assume x: \"x \\ {a..+b}\" and y: \"y \\ {c..+d}\" and xy: \"x = y\"\n \n from x obtain kx where \"x = a + of_nat kx\" and kx: \"kx < b\"\n by (clarsimp dest!: intvlD)\n \n moreover from y obtain ky where \"y = c + of_nat ky\" and ky: \"ky < d\"\n by (clarsimp dest!: intvlD)\n \n ultimately have ac: \"a + of_nat kx = c + of_nat ky\" using xy by simp\n \n have \"of_nat kx < (of_nat b :: 'a word)\" using blt kx\n by (rule of_nat_mono_maybe) \n hence \"a + of_nat kx < a + of_nat b\" using alb\n by (rule word_plus_strict_mono_right)\n \n also have \"\\ \\ c\" by (rule abc) \n also have \"\\ \\ c + of_nat ky\" using cld dlt ky\n by - (rule word_random [OF _ iffD1 [OF of_nat_mono_maybe_le]], simp+ )\n finally show False using ac by simp\nqed\n\nlemma intvl_disjoint2:\n fixes a :: \"'a :: len word\"\n assumes abc: \"a + of_nat b \\ c\"\n and alb: \"a \\ a + of_nat b\"\n and cld: \"c \\ c + of_nat d\"\n and blt: \"b < 2 ^ len_of TYPE('a)\"\n and dlt: \"d < 2 ^ len_of TYPE('a)\" \n shows \"{c..+d} \\ {a..+b} = {}\"\n using abc alb cld blt dlt\n by (subst Int_commute, rule intvl_disjoint1)\n\n \nlemma intvl_off_disj:\n fixes x :: word32\n assumes ylt: \"y \\ off\"\n and zoff: \"z + off < 2 ^ word_bits\"\n shows \"{x ..+ y} \\ {x + of_nat off ..+ z} = {}\"\n using ylt zoff\n apply (cases \"off = 0\")\n apply simp\n apply (rule contrapos_pp [OF TrueI])\n apply (drule intvl_inter)\n apply (erule disjE)\n apply (cut_tac intvl_nowrap [where x = x and y = \"of_nat off :: word32\" and z = z])\n apply simp\n apply (rule of_nat_neq_0)\n apply simp\n apply (unfold word_bits_len_of)\n apply simp\n apply (simp add: unat_of_nat word_bits_conv)\n apply (drule intvlD)\n apply clarsimp\n apply (drule (1) order_less_le_trans)\n apply (drule unat_cong)\n apply (simp add: unat_of_nat word_bits_conv)\n done\n\n\nlemma list_map_comono:\n assumes s: \"list_map m \\\\<^sub>m list_map n\"\n shows \"m \\ n\" \n using s\nproof (induct m arbitrary: n rule: rev_induct)\n case Nil thus ?case unfolding list_map_def by simp\nnext\n case (snoc x xs)\n\n from snoc.prems have \n sm: \"[length xs \\ x] ++ list_map xs \\\\<^sub>m list_map n\"\n unfolding list_map_def by simp\n \n hence xsn: \"xs \\ n\" \n by (rule snoc.hyps [OF map_add_le_mapE])\n \n have \"list_map n (length xs) = Some x\" using sm\n by (simp add: map_le_def list_map_def merge_dom2 set_zip)\n \n hence \"length xs < length n\" and \"x = n ! length xs\"\n by (auto simp add: list_map_eq split: split_if_asm)\n \n thus \"xs @ [x] \\ n\" using xsn \n by (simp add: append_one_prefixeq less_eq_list_def)\nqed\n\nlemma typ_slice_t_self:\n \"td \\ fst ` set (typ_slice_t td m)\"\n apply (cases td)\n apply (simp split: split_if)\n done\n\nlemma drop_heap_list_le2:\n \"heap_list h n (x + of_nat k)\n = drop k (heap_list h (n + k) x)\"\n by (simp add: drop_heap_list_le)\n\nlemma index_fold_update:\n \"\\ distinct xs; set xs \\ {..< card (UNIV :: 'b set)}; n < card (UNIV :: 'b set) \\ \\\n index (foldr (\\n (arr :: 'a['b :: finite]). Arrays.update arr n (f n (index arr n))) xs v) n\n = (if n \\ set xs then f n (index v n) else index v n)\"\n apply (induct xs)\n apply simp\n apply (rename_tac x xs)\n apply (case_tac \"x = n\"; simp)\n done\n\nlemma heap_update_list_id:\n \"heap_list hp n ptr = xs \\ heap_update_list ptr xs hp = hp\"\n apply (induct xs arbitrary: ptr n)\n apply simp\n apply simp\n apply (case_tac n, simp_all)\n apply (clarsimp simp add: fun_upd_idem)\n done\n\nlemma size_td_list_map2: \"\\f adjs. \\ \\a. size_td_pair (f a) = size_td_pair a \\\n \\ size_td_list (map f adjs) = size_td_list adjs\"\n by (induct_tac adjs, simp_all)\n\nlemma hrs_mem_update_cong:\n \"\\ \\x. f x = f' x \\ \\ hrs_mem_update f = hrs_mem_update f'\"\n by (simp add: hrs_mem_update_def)\n\nlemma Guard_no_cong:\n \"\\ A=A'; c=c' \\ \\ Guard A P c = Guard A' P c'\"\n by simp\n\nlemma heap_update_list_concat_fold:\n assumes \"ptr' = ptr + of_nat (length ys)\" \n shows \"heap_update_list ptr' xs (heap_update_list ptr ys s)\n = heap_update_list ptr (ys @ xs) s\"\n unfolding assms\n apply (induct ys arbitrary: ptr s)\n apply simp\n apply simp\n apply (elim meta_allE)\n apply (erule trans[rotated])\n apply (simp add: field_simps)\n done\n\nlemma heap_update_list_concat_fold_hrs_mem:\n \"ptr' = ptr + of_nat (length ys) \\\n hrs_mem_update (heap_update_list ptr' xs)\n (hrs_mem_update (heap_update_list ptr ys) s)\n = hrs_mem_update (heap_update_list ptr (ys @ xs)) s\"\n by (simp add: hrs_mem_update_def split_def\n heap_update_list_concat_fold)\n\nlemmas heap_update_list_concat_unfold\n = heap_update_list_concat_fold[OF refl, symmetric]\n\nlemma coerce_heap_update_to_heap_updates:\n assumes n: \"n = chunk * m\" and len: \"length xs = n\"\n shows \"heap_update_list x xs\n = (\\s. foldl (\\s n. heap_update_list (x + (of_nat n * of_nat chunk))\n (take chunk (drop (n * chunk) xs)) s)\n s [0 ..< m])\"\n using len[simplified n]\n apply (induct m arbitrary: x xs)\n apply (rule ext, simp)\n apply (rule ext)\n apply (simp only: upt_conv_Cons map_Suc_upt[symmetric])\n apply (subgoal_tac \"\\ys zs. length ys = chunk \\ xs = ys @ zs\")\n apply (clarsimp simp: heap_update_list_concat_unfold foldl_map\n field_simps)\n apply (rule_tac x=\"take chunk xs\" in exI)\n apply (rule_tac x=\"drop chunk xs\" in exI)\n apply simp\n done\n\nlemma array_tag_n_eq: \n \"(array_tag_n n :: ('a :: c_type['b :: finite]) field_desc typ_desc) = \n TypDesc (TypAggregate \n (map (\\n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..n. DTPair (adjust_ti (typ_info_t TYPE('a)) (\\x. index x n)\n (\\x f. Arrays.update f n x)) (replicate n CHR ''1'')) [0..<(card (UNIV :: 'b :: finite set))]))\n (typ_name (typ_uinfo_t TYPE('a)) @ ''_array_'' @ nat_to_bin_string (card (UNIV :: 'b :: finite set)))\"\n by (simp add: typ_info_array array_tag_def array_tag_n_eq)\n\nlemma update_ti_list_array':\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = y;\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m)) \\\n \\ y = foldr (\\n arr. Arrays.update arr n (update_ti_t (g n) (take v3 (drop (v3 * n) xs)) (index arr n))) [0 ..< n] v\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs y v)\n apply simp\n apply (simp add: access_ti_append)\n apply (elim meta_allE, drule(1) meta_mp)\n apply simp\n apply (rule foldr_cong, (rule refl)+)\n apply (simp add: take_drop)\n apply (subst min.absorb1)\n apply (fold mult_Suc_right, rule mult_le_mono2)\n apply simp\n apply simp\n done\n\nlemma update_ti_list_array:\n \"\\ update_ti_list_t (map f [0 ..< n]) xs v = (y :: 'a['b :: finite]);\n \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m xs v'. length xs = v3 \\ m < n \\\n update_ti_pair_t (f m) xs v' = Arrays.update v' m (update_ti_t (g m) xs (index v' m));\n n \\ card (UNIV :: 'b set) \\\n \\ \\m < n. update_ti_t (g m) (take v3 (drop (v3 * m) xs)) (index v m) = index y m\"\n apply (subst update_ti_list_array'[where y=y], assumption+)\n apply clarsimp\n apply (subst index_fold_update)\n apply clarsimp+\n done\n\nlemma access_in_array:\n fixes y :: \"('a :: c_type)['b :: finite]\"\n assumes assms: \"h_val hp x = y\"\n \"n < card (UNIV :: 'b set)\"\n and subst: \"\\xs v. length xs = size_of TYPE('a)\n \\ update_ti_t (typ_info_t TYPE('a)) xs v = f xs\"\n shows \"h_val hp\n (Ptr (ptr_val x + of_nat (n * size_of TYPE('a)))) = index y n\"\n using assms\n apply (simp add: h_val_def drop_heap_list_le2 del: of_nat_mult)\n apply (subst take_heap_list_le[symmetric, where n=\"card (UNIV :: 'b set) * size_of TYPE ('a)\"])\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n apply (simp add: from_bytes_def typ_info_array')\n apply (drule update_ti_list_array, simp+)\n apply (simp add: size_of_def)\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply simp\n apply (drule spec, drule(1) mp)\n apply (simp add: size_of_def ac_simps drop_take)\n apply (subgoal_tac \"length v = size_of TYPE('a)\" for v)\n apply (subst subst, assumption)\n apply (subst(asm) subst, assumption)\n apply simp\n apply (simp add: size_of_def)\n apply (subst le_diff_conv2)\n apply simp\n apply (fold mult_Suc, rule mult_le_mono1)\n apply simp\n done\n\nlemma foo: \"P (access_ti (typ_info_t TYPE (('a :: c_type)[4])) v xs)\"\n apply (simp add: typ_info_array' upt_rec)\n oops\n\nlemma access_ti_list_array:\n \"\\ \\n. size_td_pair (f n) = v3; length xs = v3 * n;\n \\m. m < n \\ v3 \\ length (drop (v3 * m) xs)\n \\ access_ti_pair (f m) (FCP g) (take v3 (drop (v3 * m) xs)) = (h m)\n \\ \\\n access_ti_list (map f [0 ..< n]) (FCP g) xs\n = foldl (op @) [] (map h [0 ..< n])\"\n apply (subgoal_tac \"\\ys. size_td_list (map f ys) = v3 * length ys\")\n prefer 2\n apply (rule allI, induct_tac ys, simp+)\n apply (induct n arbitrary: xs)\n apply simp\n apply (simp add: access_ti_append)\n apply (erule_tac x=\"take (v3 * n) xs\" in meta_allE)\n apply simp\n apply (frule spec, drule mp, rule conjI, rule lessI)\n apply simp\n apply simp\n apply (erule meta_mp)\n apply (auto simp add: drop_take)\n done\n\nlemma take_drop_foldl_concat:\n \"\\ \\y. y < m \\ length (f y) = n; x < m \\\n \\ take n (drop (x * n) (foldl op @ [] (map f [0 ..< m]))) = f x\"\n apply (subst split_upt_on_n, assumption)\n apply (simp only: foldl_concat_concat map_append)\n apply (subst drop_append_miracle)\n apply (induct x, simp_all)[1]\n apply simp\n done\n\n(* FIXME : Move to WordLib *)\nlemma scast_of_nat [simp]:\n \"scast (of_nat x :: 'a::len signed word) = (of_nat x :: 'a word)\"\n by (metis (hide_lams, no_types) len_signed scast_def uint_sint\n word_of_nat word_ubin.Abs_norm word_ubin.eq_norm)\n\ndefinition\n array_ptr_index :: \"(('a :: c_type)['b :: finite]) ptr \\ bool \\ nat \\ 'a ptr\"\nwhere\n \"array_ptr_index p coerce n = CTypesDefs.ptr_add (ptr_coerce p)\n (if coerce \\ n \\ CARD ('b) then 0 else of_nat n)\"\n\nlemmas array_ptr_index_simps\n = array_ptr_index_def[where coerce=False, simplified]\n array_ptr_index_def[where coerce=True, simplified]\n\nlemma heap_update_Array:\n \"heap_update (p ::('a::packed_type['b::finite]) ptr) arr\n = (\\s. foldl (\\s n. heap_update (array_ptr_index p False n)\n (Arrays.index arr n) s) s [0 ..< card (UNIV :: 'b set)])\"\n apply (rule ext, simp add: heap_update_def)\n apply (subst coerce_heap_update_to_heap_updates\n [OF _ refl, where chunk=\"size_of TYPE('a)\" and m=\"card (UNIV :: 'b set)\"])\n apply simp\n apply (rule foldl_cong[OF refl refl])\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def)\n apply (rule_tac f=\"\\xs. heap_update_list p xs s\" for p s in arg_cong)\n apply (simp add: to_bytes_def size_of_def\n packed_type_access_ti)\n apply (simp add: typ_info_array')\n apply (subst fcp_eta[symmetric], subst access_ti_list_array)\n apply simp\n apply simp\n apply (simp add: packed_type_access_ti size_of_def)\n apply fastforce\n apply (rule take_drop_foldl_concat)\n apply (simp add: size_of_def)\n apply simp\n done\n\nlemma heap_access_Array_element':\n fixes p :: \"('a::mem_type['b::finite]) ptr\"\n assumes less: \"of_nat n < card (UNIV :: 'b set)\"\n shows\n \"index (h_val hp p) n\n = h_val hp (array_ptr_index p False n)\"\n using less\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def h_val_def)\n apply (simp add: from_bytes_def size_of_def typ_info_array')\n apply (subst update_ti_list_array'[OF refl])\n apply simp\n apply simp\n apply (clarsimp simp: update_ti_s_adjust_ti)\n apply (rule refl)\n apply (simp add: split_upt_on_n[OF less])\n apply (rule trans, rule foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp+\n apply (subst foldr_does_nothing_to_xf[where xf=\"\\s. index s n\"])\n apply simp\n apply (simp add: drop_heap_list_le take_heap_list_le)\n apply (subst take_heap_list_le)\n apply (simp add: le_diff_conv2)\n apply (drule Suc_leI)\n apply (drule mult_le_mono2, simp)\n apply (erule order_trans, simp)\n apply (simp add: field_simps)\n apply (rule upd_rf)\n apply (simp add: size_of_def)\n done\n\nlemmas heap_access_Array_element\n = heap_access_Array_element'[simplified array_ptr_index_simps]\n\nlemma heap_update_id:\n \"h_val hp ptr = (v :: 'a :: packed_type)\n \\ heap_update ptr v hp = hp\"\n apply (simp add: h_val_def heap_update_def)\n apply (rule heap_update_list_id[where n=\"size_of TYPE('a)\"])\n apply clarsimp\n apply (simp add: from_bytes_def to_bytes_def update_ti_t_def\n size_of_def field_access_update_same\n td_fafu_idem)\n done\n\nlemma fold_cong':\n \"a = b \\ xs = ys \\ (\\x. x \\ set xs =simp=> f x = g x)\n \\ fold f xs a = fold g ys b\"\n unfolding simp_implies_def\n by (metis fold_cong)\n\nlemma intvl_empty2:\n \"({p ..+ n} = {}) = (n = 0)\"\n by (auto simp add: intvl_def)\n\nlemma heap_update_list_commute:\n \"{p ..+ length xs} \\ {q ..+ length ys} = {}\n \\ heap_update_list p xs (heap_update_list q ys hp)\n = heap_update_list q ys (heap_update_list p xs hp)\"\n apply (cases \"length xs < addr_card\")\n apply (cases \"length ys < addr_card\")\n apply (rule ext, simp add: heap_update_list_value)\n apply blast\n apply (simp_all add: addr_card intvl_overflow intvl_empty2)\n done\n\nlemma heap_update_commute:\n \"\\ {ptr_val p ..+ size_of TYPE('a)} \\ {ptr_val q ..+ size_of TYPE('b)} = {};\n wf_fd (typ_info_t TYPE('a)); wf_fd (typ_info_t TYPE('b)) \\\n \\ heap_update p v (heap_update q (u :: 'b :: c_type) h)\n = heap_update q u (heap_update p (v :: 'a :: c_type) h)\"\n apply (simp add: heap_update_def)\n apply (simp add: heap_update_list_commute heap_list_update_disjoint_same\n to_bytes_def length_fa_ti size_of_def Int_commute)\n done\n\nlemma heap_update_Array_update:\n assumes n: \"n < CARD('b :: finite)\"\n assumes size: \"CARD('b) * size_of TYPE('a :: packed_type) < 2 ^ 32\"\n shows \"heap_update p (Arrays.update (arr :: 'a['b]) n v) hp\n = heap_update (array_ptr_index p False n) v (heap_update p arr hp)\"\nproof -\n\n have P: \"\\x k. \\ x < CARD('b); k < size_of TYPE('a) \\\n \\ unat (of_nat x * of_nat (size_of TYPE('a)) + (of_nat k :: word32))\n = x * size_of TYPE('a) + k\"\n using size\n apply (case_tac \"size_of TYPE('a)\", simp_all)\n apply (case_tac \"CARD('b)\", simp_all)\n apply (subst unat_add_lem[THEN iffD1])\n apply (simp add: unat_word_ariths unat_of_nat less_Suc_eq_le)\n apply (subgoal_tac \"Suc x * size_of TYPE('a) < 2 ^ 32\", simp_all)\n apply (erule order_le_less_trans[rotated], simp add: add_mono)\n apply (subst unat_mult_lem[THEN iffD1])\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n apply (rule order_less_le_trans, erule order_le_less_trans[rotated],\n rule add_mono, simp+)\n apply (simp add: less_Suc_eq_le trans_le_add2)\n apply simp\n apply (simp add: unat_of_nat unat_add_lem[THEN iffD1])\n done\n\n let ?key_upd = \"heap_update (array_ptr_index p False n) v\"\n note commute = fold_commute_apply[where h=\"?key_upd\"\n and xs=\"[Suc n ..< CARD('b)]\", where g=f' and f=f' for f']\n\n show ?thesis using n\n apply (simp add: heap_update_Array split_upt_on_n[OF n]\n foldl_conv_fold)\n apply (subst commute)\n apply (simp_all add: packed_heap_update_collapse\n cong: fold_cong')\n apply (rule ext, simp)\n apply (rule heap_update_commute, simp_all add: ptr_add_def)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def intvl_def Suc_le_eq)\n apply (rule set_eqI, clarsimp)\n apply (drule word_unat.Rep_inject[THEN iffD2])\n apply (clarsimp simp: P nat_eq_add_iff1)\n apply (case_tac x, simp_all add: less_Suc_eq_le Suc_diff_le)\n done\nqed\n\nlemma heap_update_id_Array:\n fixes arr :: \"('a :: packed_type)['b :: finite]\"\n shows \"arr = h_val hp p\n \\ heap_update p arr hp = hp\"\n apply (simp add: heap_update_Array)\n apply (rule foldl_does_nothing[where s=hp])\n apply (simp add: heap_access_Array_element' heap_update_id)\n done\n\nlemma heap_update_Array_element'':\n fixes p' :: \"(('a :: packed_type)['b::finite]) ptr\"\n fixes p :: \"('a :: packed_type) ptr\"\n fixes hp w\n assumes p: \"p = array_ptr_index p' False n\"\n assumes n: \"n < CARD('b)\"\n assumes size: \"CARD('b) * size_of TYPE('a) < 2 ^ 32\"\n shows \"heap_update p' (Arrays.update (h_val hp p') n w) hp\n = heap_update p w hp\"\n apply (subst heap_update_Array_update[OF n size])\n apply (simp add: heap_update_id_Array p)\n done\n\nlemmas heap_update_Array_element'\n = heap_update_Array_element''[simplified array_ptr_index_simps]\n\nlemma fourthousand_size:\n \"CARD('b :: fourthousand_count) * size_of TYPE('a :: oneMB_size) < 2 ^ 32\"\n using oneMB_size_ax[where 'a='a] fourthousand_count_ax[where 'a='b]\n apply (clarsimp dest!: nat_le_Suc_less_imp)\n apply (drule(1) mult_mono, simp+)\n done\n\nlemmas heap_update_Array_element\n = heap_update_Array_element'[OF refl _ fourthousand_size]\n\nlemma map_td_list_map:\n \"map_td_list f = map (map_td_pair f)\"\n apply (rule ext)\n apply (induct_tac x, simp_all)\n done\n\nlemma typ_slice_list_cut:\n \"\\ (\\x \\ set xs. size_td (dt_fst x) = m); m \\ 0; n < (length xs * m) \\\n \\ typ_slice_list xs n =\n typ_slice_pair (xs ! (n div m)) (n mod m)\"\n apply (induct xs arbitrary: n, simp_all)\n apply (intro conjI impI)\n apply simp\n apply (subgoal_tac \"\\n'. n = n' + m\")\n apply clarsimp\n apply (rule_tac x=\"n - m\" in exI)\n apply simp\n done\n\nlemma typ_slice_t_array:\n \"\\ n < CARD('b); y < size_of TYPE('a) \\\n \\ typ_slice_t (export_uinfo (typ_info_t TYPE('a))) y \\\n typ_slice_t (export_uinfo (array_tag TYPE('a['b :: finite])))\n (y + size_of TYPE('a :: mem_type) * n)\"\n apply (simp add: array_tag_def array_tag_n_eq\n split del: split_if)\n apply (rule disjI2)\n apply (subgoal_tac \"y + (size_of TYPE('a) * n) < CARD('b) * size_of TYPE('a)\")\n apply (simp add: typ_slice_list_cut[where m=\"size_of TYPE('a)\"]\n map_td_list_map o_def size_of_def\n sz_nzero[unfolded size_of_def])\n apply (simp add: export_uinfo_def[symmetric])\n apply (rule_tac y=\"Suc n * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n done\n\nlemma h_t_valid_Array_element':\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); coerce \\ n < CARD('b) \\\n \\ htd \\\\<^sub>t array_ptr_index p coerce n\"\n apply (clarsimp simp only: h_t_valid_def valid_footprint_def Let_def\n c_guard_def c_null_guard_def)\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n apply (clarsimp simp: size_td_array size_of_def typ_uinfo_t_def\n typ_info_array array_tag_def)\n apply (intro conjI)\n apply (clarsimp simp: CTypesDefs.ptr_add_def\n field_simps)\n apply (drule_tac x=\"offs * size_of TYPE('a) + y\" in spec)\n apply (drule mp)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (clarsimp simp: field_simps)\n apply (erule map_le_trans[rotated])\n apply (rule list_map_mono)\n apply (subst mult.commute, rule typ_slice_t_array[unfolded array_tag_def])\n apply assumption\n apply (simp add: size_of_def)\n apply (simp add: ptr_aligned_def align_of_def align_td_array\n array_ptr_index_def\n CTypesDefs.ptr_add_def unat_word_ariths unat_of_nat)\n using align_size_of[where 'a='a] align[where 'a='a]\n apply (simp add: align_of_def size_of_def addr_card_def card_word)\n apply (simp add: dvd_mod)\n apply (thin_tac \"\\x. P x\" for P)\n apply (clarsimp simp: intvl_def)\n apply (drule_tac x=\"offs * size_of TYPE('a) + k\" in spec)\n apply (drule mp)\n apply (simp add: array_ptr_index_def CTypesDefs.ptr_add_def field_simps of_nat_nat)\n apply (erule notE)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def mult_le_mono1)\n apply (auto simp add: array_ptr_index_def intro: exI[where x=0])\n done\n\nlemma h_t_valid_Array_element:\n \"\\ htd \\\\<^sub>t (p :: (('a :: mem_type)['b :: finite]) ptr); 0 \\ n; n < int CARD('b) \\\n \\ htd \\\\<^sub>t ((ptr_coerce p :: 'a ptr) +\\<^sub>p n)\"\n apply (drule_tac n=\"nat n\" and coerce=False in h_t_valid_Array_element')\n apply simp\n apply (simp add: array_ptr_index_def)\n done\n\nlemma ptr_safe_Array_element:\n \"\\ ptr_safe (p :: (('a :: mem_type)['b :: finite]) ptr) htd; coerce \\ n < CARD('b) \\\n \\ ptr_safe (array_ptr_index p coerce n) htd\"\n apply (simp add: ptr_safe_def)\n apply (erule order_trans[rotated])\n apply (subgoal_tac \"\\offs. array_ptr_index p coerce n = ptr_add (ptr_coerce p) (of_nat offs)\n \\ offs < CARD ('b)\")\n prefer 2\n apply (auto simp: array_ptr_index_def intro: exI[where x=0])[1]\n apply (clarsimp simp: s_footprint_def s_footprint_untyped_def\n CTypesDefs.ptr_add_def\n size_td_array size_of_def)\n apply (rule_tac x=\"offs * size_of TYPE('a) + x\" in exI)\n apply (simp add: size_of_def)\n apply (rule conjI)\n apply (rule_tac y=\"Suc offs * size_of TYPE('a)\" in order_less_le_trans)\n apply (simp add: size_of_def)\n apply (simp only: size_of_def)\n apply (rule mult_le_mono1)\n apply simp\n apply (thin_tac \"coerce \\ P\" for P)\n apply (elim disjE exE conjE, simp_all add: typ_uinfo_t_def)\n apply (erule order_less_le_trans)\n apply (rule prefix_length_le)\n apply (rule order_trans, erule typ_slice_t_array)\n apply (simp add: size_of_def)\n apply (simp add: size_of_def field_simps typ_info_array)\n done\n\nlemma from_bytes_eq:\n \"from_bytes [x] = x\"\n apply (clarsimp simp:from_bytes_def update_ti_t_def typ_info_word)\n apply (simp add:word_rcat_def)\n apply (simp add:bin_rcat_def)\n by (metis len8 word_of_int_uint word_ubin.Abs_norm)\n\nlemma bytes_disjoint:\"(x::('a::c_type) ptr) \\ y \\ {ptr_val x + a ..+ 1} \\ {ptr_val y + a ..+ 1} = {}\"\n by (clarsimp simp:intvl_def)\n\nlemma byte_ptrs_disjoint:\"(x::('a::c_type) ptr) \\ y \\ \\i < of_nat (size_of TYPE('a)). ptr_val x + i \\ ptr_val y + i\"\n by force\n\nlemma le_step:\"\\(x::('a::len) word) < y + 1; x \\ y\\ \\ x < y\"\n by (metis less_x_plus_1 max_word_max order_less_le)\n\nlemma ptr_add_disjoint:\n \"\\ ptr_val y \\ {ptr_val x ..+ size_of TYPE('a)};\n ptr_val (x::('a::c_type) ptr) < ptr_val (y::('b::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val x + a < ptr_val y\"\n apply (erule swap)\n apply (rule intvl_inter_le [where k=0 and ka=\"unat (ptr_val y - ptr_val x)\"])\n apply clarsimp\n apply (metis (hide_lams, mono_tags) add_diff_cancel2 add_diff_inverse diff_add_cancel\n trans_less_add1 unat_less_helper word_le_less_eq word_less_add_right\n word_of_nat_less word_unat.Rep_inverse)\n apply simp\n done\n\nlemma ptr_add_disjoint2:\n \"\\ ptr_val x \\ {ptr_val y ..+ size_of TYPE('a)};\n ptr_val (y::('b::c_type) ptr) < ptr_val (x::('a::c_type) ptr);\n a < of_nat (size_of TYPE('a)) \\ \\\n ptr_val y + a < ptr_val x\"\n apply (erule swap)\n apply (rule intvl_inter_le[where k=0 and ka=\"unat (ptr_val x - ptr_val y)\"])\n apply clarsimp\n apply (metis (no_types, hide_lams) add.commute less_imp_le less_le_trans not_le unat_less_helper\n word_diff_ls'(4)) \n apply simp\n done\n\nlemma ptr_aligned_is_aligned:\"\\ptr_aligned (x::('a::c_type) ptr); align_of TYPE('a) = 2 ^ n\\ \\ is_aligned (ptr_val x) n\"\n by (clarsimp simp: ptr_aligned_def is_aligned_def)\n\nlemma intvl_no_overflow:\n assumes no_overflow: \"unat a + b < 2 ^ len_of TYPE('a::len)\"\n shows \"(x \\ {(a :: 'a word) ..+ b}) = (a \\ x \\ x < (a + of_nat b))\"\nproof -\n obtain \"sk\" :: \"'a word \\ 'a word \\ nat \\ nat\"\n where f1: \"\\x y z. x \\ {y..+z} \\ x = y + of_nat (sk x y z) \\ sk x y z < z\"\n using [[metis_new_skolem]] by (metis intvlD)\n\n have f2: \"\\x. a + x < a + of_nat b \\ \\ x < of_nat b\"\n using no_overflow\n by (metis PackedTypes.of_nat_mono_maybe_le add_lessD1 le_add1\n add.commute olen_add_eqv unat_of_nat_eq word_arith_nat_add\n word_plus_strict_mono_right)\n\n have f3: \"\\x y. y \\ {x..+b} \\ of_nat (sk y x b) < (of_nat b :: 'a word)\"\n using no_overflow f1\n by (metis add_lessD1 add.commute of_nat_mono_maybe)\n\n have \"x < a + of_nat b \\ \\ of_nat (sk x a b) < (of_nat b :: 'a word) \\ ?thesis\"\n using f1 f2 by metis\n\n hence \"x < a + of_nat b \\ ?thesis\"\n using f3 by metis\n\n thus \"?thesis\"\n apply (rule disjE)\n apply (rule iffI)\n apply (clarsimp simp: intvl_def)\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (subgoal_tac \"k + (b + unat a) < 2 ^ len_of (TYPE('a)) + b\")\n apply (subgoal_tac \"k + unat a < 2 ^ len_of (TYPE('a))\")\n apply (metis add_lessD1 le_def less_not_refl2 add.commute unat_eq_of_nat word_arith_nat_add)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: intvl_def)\n apply (rule exI [where x=\"unat (x - a)\"])\n apply (clarsimp simp: unat_sub_if_size word_le_nat_alt word_less_nat_alt)\n apply (cut_tac no_overflow)\n apply (metis diff_le_self le_add_diff_inverse le_diff_conv le_eq_less_or_eq le_unat_uoi add.commute nat_neq_iff unat_of_nat_eq word_arith_nat_add)\n apply simp\n done\nqed\n\n(* arg_cong specified for FCP because it does not apply as is. *)\nlemma FCP_arg_cong:\"f = g \\ FCP f = FCP g\"\n by simp\n\nlemma h_val_id:\n \"h_val (hrs_mem (hrs_mem_update (heap_update x y) s)) x = (y::'a::mem_type)\"\n apply (subst hrs_mem_update)\n apply (rule h_val_heap_update)\n done\n\nlemma heap_update_id2:\n \"hrs_mem_update (heap_update p ((h_val (hrs_mem s) p)::'a::packed_type)) s = s\"\n apply (clarsimp simp:hrs_mem_update_def case_prod_beta)\n apply (subst heap_update_id)\n apply (simp add:hrs_mem_def)+\n done\n\nlemma intvlI_unat:\"unat b < unat c \\ a + b \\ {a ..+ unat c}\"\n by (metis intvlI word_unat.Rep_inverse)\n\nlemma neq_imp_bytes_disjoint:\n \"\\ c_guard (x::'a::c_type ptr); c_guard y; unat j < align_of TYPE('a);\n unat i < align_of TYPE('a); x \\ y; 2 ^ n = align_of TYPE('a); n < 32\\ \\\n ptr_val x + j \\ ptr_val y + i\"\n apply (rule ccontr)\n apply (subgoal_tac \"is_aligned (ptr_val x) n\")\n apply (subgoal_tac \"is_aligned (ptr_val y) n\")\n apply (subgoal_tac \"(ptr_val x + j && ~~ mask n) = (ptr_val y + i && ~~ mask n)\")\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (subst (asm) neg_mask_add_aligned, simp, simp add: word_less_nat_alt)\n apply (clarsimp simp: is_aligned_neg_mask_eq)\n apply simp\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n apply (clarsimp simp: c_guard_def ptr_aligned_def is_aligned_def)\n done\n\nlemma heap_update_list_base':\"heap_update_list p [] = id\"\n by (rule ext, simp)\n\nlemma hrs_mem_update_id3: \"hrs_mem_update id = id\"\n unfolding hrs_mem_update_def by simp\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/LemmaBucket_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.3276683008207139, "lm_q1q2_score": 0.17914876125465568}} {"text": "theory SARES\n imports SafeRedCV SafeRedCase SafeSubTPX\nbegin\n (* ##### general stuff *)\n \nlemma lease_mini_disj_use_env: \"\\ mini_disj_use_env r_s (diff_use_env r_x r_ex); mini_disj_use_env r_ex r_s \\ \\ mini_disj_use_env r_s r_x\" \n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done \n \nlemma lease_disj_use_env1: \"\\ disj_use_env r_s (diff_use_env r_x r_ex); mini_disj_use_env r_ex r_s \\ \\ disj_use_env r_s r_x\" \n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac lease_mini_disj_use_env)\n apply (auto)\n (* we expect a similar formulation to exist using this logic\n rx2a | rx2 + [infl r_s2a - r_s3], rx2a |> rx2 + [infl r_s2a - r_s3], rx2a |> r_s3 - EX, EX |> r_s3 - EX\n rx2 + [infl r_s2a - r_s3] |> rx2a - EX\n apply (rule_tac r_s=\"diff_use_env r_s r_ex\" in mini_disj_leq_use_env2)\n *)\n apply (simp add: mini_disj_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n done\n \nlemma lease_disj_use_env2: \"\\ disj_use_env (diff_use_env r_x r_ex) r_s; mini_disj_use_env r_ex r_s \\ \\ disj_use_env r_x r_s\"\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac r_ex=\"r_ex\" in lease_disj_use_env1)\n apply (rule_tac comm_disj_use_env)\n apply (auto)\n done \n \n (* ##### res use env *)\n \ndefinition res_use_env where\n \"res_use_env rs_map = (\\ x. if lookup_mem rs_map x = None then NoPerm else OwnPerm)\"\n (*\nlemma norm_res_leq_use_env: \"\\ well_typed_state s env rs_map; valid_exp_use_env s rs_map r_s \\ \\ leq_use_env r_s (res_use_env rs_map)\"\n apply (simp add: leq_use_env_def)\n apply (simp add: res_use_env_def)\n apply (auto)\n apply (simp add: valid_use_env_def)\n apply (simp add: well_typed_state_def)\n apply (simp add: valid_res_map_def)\n apply (simp add: sub_res_map_def)\n apply (simp add: sub_use_env_def)\n apply (cut_tac r_s=\"r_c\" and r_x=\"r_s\" and x=\"x\" in leq_use_none)\n apply (auto)\n done*)\n \nlemma norm_res_use_env: \"\\ leq_use_env r_s (res_use_env rs_map) \\ \\ norm_use_env r_s (res_use_env rs_map) = r_s\" \n apply (case_tac \"\\ x. norm_use_env r_s (res_use_env rs_map) x = r_s x\")\n apply (auto)\n apply (simp add: norm_use_env_def)\n apply (simp add: res_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"lookup_mem rs_map x\")\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \nlemma norm_scope_use_env: \"scope_use_env rs_map (norm_use_env r_s (res_use_env rs_map))\" \n apply (simp add: scope_use_env_def)\n apply (simp add: norm_use_env_def)\n apply (simp add: res_use_env_def)\n apply (auto)\n done\n \n (* ##### sares *)\n \nlemma sares_lam_helper: \"\\ well_typed env r_s1 e2 tau (diff_use_env (comp_use_env r_s3 r_exa) (comp_use_env rxa (lift_use_env rx2 r)))\n (diff_use_env (comp_use_env rxa rx2) (comp_use_env rxa (lift_use_env rx2 r))); non_prim_env env \\ \\\n well_typed env r_s1 e2 tau (diff_use_env (comp_use_env r_s3 r_exa) (comp_use_env rxa (lift_use_env rx2 r))) (app_req rxa rx2 r tau empty_use_env)\"\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac rx=\"diff_use_env (comp_use_env rxa rx2) (comp_use_env rxa (lift_use_env rx2 r))\" in prim_type_no_req)\n apply (auto)\n apply (cut_tac r=\"comp_use_env rxa (lift_use_env rx2 r)\" in comp_empty_use_env2)\n apply (auto)\n done \n\nlemma sares_fix_case: \"\\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; app_red_exp FixApp (s1, AppExp (ConstExp FixConst) x62) ax (s2, e2);\n e1 = AppExp (ConstExp FixConst) x62; well_typed env r_s2a x62 t1 r_s3 rx2; proper_exp rs_map (AppExp (ConstExp FixConst) x62);\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); (*safe_use_lift rx2 r; safe_type t1 r;*)\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (app_req rx1 rx2 r tau r_ex) rx; leq_use_env r_s2a r_s1; leq_use_env rx1 r_s2a;\n FunTy t1 tau r a = pure_fun (pure_fun t t (req_type t)) t Prim; fun_ty t; unlim t; leq_use_env r_s1 r_f \\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax\"\n apply (case_tac x62)\n apply (auto)\n apply (case_tac ax)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (auto)\n (* - prelim: rxa is weak *)\n apply (case_tac \"\\ weak_use_env rxa\")\n apply (simp add: aff_use_env_def)\n apply (case_tac \"req_type tau\")\n apply (simp add: unlim_def)\n apply (simp)\n apply (simp add: null_use_env_def)\n apply (simp add: weak_use_env_def)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n (* e2 = x52 (Fix (\\ x51. x52)). We can type the external app as: <> x52 <> (Fix (\\ x51. x52)) <>\n We can type the internal app as: <> Fix <> (\\ x51. x52) <>\n *)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env r_s2a (comp_use_env rxa (lift_use_env rxa UsePerm))) (comp_use_env rx2 (comp_use_env r_exa r_ex))\" and\n rx=\"diff_use_env (diff_use_env (comp_use_env rxa rxa) (comp_use_env rxa (lift_use_env rxa UsePerm))) (comp_use_env rx2 (comp_use_env r_exa r_ex))\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac t=\"tau\" and ?rx1.0=\"rxa\" and r_s'=\"r_s'\" and r_end=\"r_end\" and ?e1.0=\"x62a\" and x=\"x61\" and\n ?r_s2.0=\"r_s2a\" and ?r_s3.0=\"r_s2a\" and e'=\"AppExp (ConstExp FixConst) (LamExp x61 x62a)\" in safe_subst_type_preserve_x)\n apply (auto)\n apply (rule_tac x=\"FunTy tau tau UsePerm (req_type tau)\" in exI)\n apply (rule_tac x=\"UsePerm\" in exI)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (case_tac \"\\ weak_use_env empty_use_env\")\n apply (simp add: weak_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (rule_tac x=\"rxa\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (auto)\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac x=\"empty_use_env\" in exI)\n apply (auto)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (auto)(*\n apply (simp add: aff_use_env_def)\n apply (simp add: weak_use_env_def)*)\n apply (rule_tac id_leq_use_env)(*\n apply (simp add: aff_use_env_def)\n apply (case_tac \"req_type tau\")\n apply (simp add: unlim_def)\n apply (simp add: weak_use_env_def)\n apply (simp add: null_use_env_def)*)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (simp)\n apply (rule_tac disj_empty_use_env2)\n apply (rule_tac leq_empty_use_env)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (simp add: weak_use_env_def)\n apply (simp add: aff_use_env_def)\n apply (simp add: disj_use_env_def)\n apply (simp add: mini_disj_use_env_def)\n (* diff correctness *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 rx2\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n (* prove bound shifts were valid. to show that r_s2 (the only end perm bound) is lower than r_s2a - rxa (our proposed bound),\n we use the fact that r_s2 \\ r_s3 - rx2, and whatever is not removed by rx2 was already removed by r_exa from r_s2a. *)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s2a r_exa) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac rhs_weak_leq_use_env)\n apply (rule_tac dist_weak_comp_use_env)\n apply (simp_all)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* proving the rx bound in the primitive case is predicated on the fact that rxa is null *)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (case_tac \"\\ leq_use_env rxa empty_use_env\")\n apply (simp add: aff_use_env_def)\n apply (simp add: null_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (rule_tac r_sb=\"empty_use_env\" in trans_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n (* otherwise, to show that rx \\ rxa - (rxa + r_exa + r_ex) (our proposed bound). we note that rxa - r_exa \\ rx2.\n rx \\ rx2 - (rx1 + rx2 + r_ex). rx1 is disjoint, rx2 is weak, r_ex is included in our bound *) \n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env rxa r_exa) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac disj_diff_leq_use_env)\n apply (rule_tac r_s=\"rx2\" in disj_leq_use_env2)\n apply (simp)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* proving e2 is proper *)\n apply (rule_tac e=\"x62a\" and x=\"x61\" and e'=\"e1\" and env=\"add_env env x61 t\" in proper_safe_subst_exp)\n apply (auto)\n apply (simp add: proper_exp_def)\n done\n \n \nlemma sares_lam_case: \"\\well_typed_state s2 env rs_map; valid_exp_use_env s2 rs_map r_f; e1 = AppExp (LamExp x51 x52) x62; well_typed env r_s2a x62 t1 r_s3 rx2;\n proper_exp rs_map (AppExp (LamExp x51 x52) x62);\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); (*safe_use_lift rx2 r; safe_type t1 r;*)\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n leq_use_env (app_req rx1 rx2 r tau r_ex) rx; ax = NoAct; well_typed (add_env env x51 t1) (add_use_env rxa x51 r) x52 tau r_s' r_end; is_value x62;\n aff_use_env rxa a; safe_subst_exp x52 x51 x62 e2; s1 = s2; leq_use_env rxa r_s1; leq_use_env r_s2a (diff_use_env r_s1 r_exa); leq_use_env rx1 r_s2a;\n leq_use_env r_exa r_s1; leq_use_env (diff_use_env rxa r_exa) rx1; leq_use_env r_s1 r_f \\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s2 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax\"\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"diff_use_env (diff_use_env (comp_use_env r_s3 (cut_use_env r_exa)) (comp_use_env rxa (lift_use_env rx2 r))) (comp_use_env r_exa (comp_use_env r_ex rx1))\" and\n rx=\"diff_use_env (app_req rxa rx2 r tau empty_use_env) (comp_use_env r_exa (comp_use_env r_ex rx1))\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac sares_lam_helper)\n apply (auto)\n apply (rule_tac x=\"x51\" and t=\"t1\" and ?rx1.0=\"rxa\" and r=\"r\" and ?e1.0=\"x52\" and r_s'=\"r_s'\" and r_end=\"r_end\"\n and e'=\"x62\" and ?r_s2.0=\"comp_use_env r_s2a (cut_use_env r_exa)\" and ?r_s3.0=\"comp_use_env r_s3 (cut_use_env r_exa)\" and ?rx2.0=\"rx2\" in safe_subst_type_preserve_x)\n apply (auto)\n apply (case_tac x62)\n apply (auto)\n apply (case_tac x71)\n apply (auto)\n apply (case_tac x1)\n apply (auto)\n apply (rule_tac well_typed_comp_perms_gen)\n apply (auto)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_strong_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac strong_cut_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac cut_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac diff_cut_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n (* the last thing we have to do is show that rxa is disjoint from rx2. the idea is that rxa is contained in rx1 + cut r_exa. *)\n apply (rule_tac r_s=\"comp_use_env rx1 (cut_use_env r_exa)\" in disj_leq_use_env1)\n apply (rule_tac disj_comp_use_env1)\n apply (simp)\n apply (rule_tac r_s=\"r_s2a\" in disj_leq_use_env2)\n apply (simp add: disj_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"r_s1\" in swp_mini_disj_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"r_s1\" in mini_disj_strong_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac self_cut_leq_use_env)\n apply (simp)\n apply (rule_tac strong_cut_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env rxa r_exa\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_cut_leq_use_env)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac well_typed_state_non_prim_env)\n apply (auto)\n (* - proving initial boundary changes *)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (auto)\n (*apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)*)\n apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_exa\" in trans_leq_use_env)\n apply (rule_tac fold_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 r_exa\" in trans_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac st_diff_comp_leq_use_env)\n apply (simp)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac mini_disj_diff_leq_use_env)\n apply (simp)\n apply (rule_tac r_s=\"diff_use_env r_s1 r_exa\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n (* - secondary boundary change. *)\n apply (simp add: app_req_def)\n apply (auto)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac unroll_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_flip_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac lhs_flip_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env_gen)\n apply (rule_tac lhs_dist_dcl_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n (* proving e2 is still proper *)\n apply (rule_tac e=\"x52\" and x=\"x51\" and e'=\"x62\" and env=\"add_env env x51 t1\" in proper_safe_subst_exp)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (simp add: proper_exp_def)\n done\n \nlemma empty_infl_use_env: \"infl_use_env r_s r_s = empty_use_env\" \n apply (case_tac \"\\ x. infl_use_env r_s r_s x = empty_use_env x\")\n apply (auto)\n apply (simp add: infl_use_env_def)\n apply (simp add: empty_use_env_def)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n \nlemma flat_infl_sexp_wp: \"\\ well_typed env r_s e tau r_s rx; is_value e \\ \\ well_typed env rx e tau rx rx\" \n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s\" and e=\"e\" and rx=\"rx\" in infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (auto)\n apply (cut_tac r_s=\"r_s\" in empty_infl_use_env)\n apply (auto)\n apply (cut_tac r=\"rx\" in comp_empty_use_env2)\n apply (auto)\n done\n \nlemma cancel_strong_leq_use_env: \"\\ strong_use_env r_x \\ \\ leq_use_env (diff_use_env r_x r_x) r_s\" \n apply (simp add: strong_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: diff_use_env_def)\n apply (simp add: minus_use_env_def)\n apply (simp add: neg_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma infl_strong_use_env: \"strong_use_env (infl_use_env r_s r_x)\" \n apply (simp add: strong_use_env_def)\n apply (simp add: infl_use_env_def)\n done\n \nlemma strong_lift_use_env: \"\\ strong_use_env r_s \\ \\ lift_use_env r_s r = r_s\"\n apply (case_tac \"\\ x. lift_use_env r_s r x = r_s x\")\n apply (auto)\n apply (simp add: strong_use_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac r)\n apply (auto)\n apply (case_tac \"r_s x\")\n apply (auto)\n done\n\nlemma proper_op: \"\\ app_op xop c e \\ \\ proper_exp rs_map e\"\n apply (simp add: proper_exp_def) \n apply (case_tac xop)\n apply (auto)\n done\n \nlemma safe_app_red_exp_strict: \"\\ well_typed env r_s1 e1 tau r_s2 rx; proper_exp rs_map e1; well_typed_state s1 env rs_map;\n valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f; app_red_exp are (s1, e1) ax (s2, e2) \\ \\ (\\ g_ax.\n well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n (*red_env env ax env' \\ *)proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax)\"\n apply (case_tac are)\n apply (auto)\n (* lam case *)\n apply (rule_tac sares_lam_case)\n apply (auto)\n (* fix-point case *)\n apply (rule_tac r_s2a=\"r_s2a\" and ?r_s3.0=\"r_s3\" in sares_fix_case)\n apply (auto)(*\n apply (rule_tac x=\"rxa\" in exI)\n apply (auto)*)\n (* remaining const cases. the idea is that any \"destructive\" uses should have had\n end perms removes to begin with, so red_use_env should be fine. *)\n apply (rule_tac ?r_s1.0=\"r_s1\" and ?r_s2.0=\"r_s3\" and ?rx1.0=\"rx1\" and ?rx2.0=\"rx2\" in safe_app_con_case)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)(*\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)*)\n (* op case *)\n apply (case_tac \"ax \\ NoAct\")\n apply (auto)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (rule_tac ?r_s2.0=\"r_s1\" and rx=\"empty_use_env\" in well_typed_simul_end_perm)\n apply (rule_tac safe_app_op_case)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac diff_leq_use_env)\n apply (simp)\n apply (rule_tac leq_empty_use_env)\n apply (rule_tac proper_op)\n apply (auto)\n (* if case 1 *)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rx=\"rx1\" in well_typed_incr_req) \n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (simp add: proper_exp_def)\n (* if case 2 *)\n apply (rule_tac x=\"NoResAct\" in exI)\n apply (auto)\n apply (case_tac ax)\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac rx=\"rx2\" in well_typed_incr_req)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (rule_tac well_typed_perm_leqx)\n apply (auto)\n apply (simp add: proper_exp_def)\n (* cv case *)\n apply (rule_tac sares_cv_case)\n apply (auto)\n done \n \n \nlemma sares_valid: \"valid_reduct app_red_exp\"\n apply (simp add: valid_reduct_def)\n apply (auto)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and ?e1.0=\"e1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and\n ?s1.0=\"s1\" and rs_map=\"rs_map\" and ax=\"ax\" and ?s2.0=\"s2\" and ?e2.0=\"e2\" in safe_app_red_exp_strict)\n apply (auto)\n(*\n apply (rule_tac x=\"red_env env tau' ax\" in exI)\n apply (rule_tac x=\"red_use_env r_s1 ax\" in exI)\n apply (auto)\n apply (rule_tac x=\"rs_map'\" in exI)\n apply (auto)\n apply (rule_tac s=\"s1\" in red_contain_env)\n apply (rule_tac safe_act_well_typed_app)\n apply (auto)\n apply (simp add: well_typed_state_def)\n apply (rule_tac red_leq_use_env)\n apply (rule_tac id_leq_use_env)*)\n done\n \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/SARES.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.3276682876897044, "lm_q1q2_score": 0.17914875891540616}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__18_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__18_on_rules imports n_g2kAbsAfter_lemma_on_inv__18\nbegin\nsection{*All lemmas on causal relation between inv__18*}\nlemma lemma_inv__18_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__18 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__18) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__18) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__18_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.3208212943308302, "lm_q1q2_score": 0.17912318898251692}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: sklvl2.thy (Isabelle/HOL 2016-1)\n ID: $Id: sklvl2.thy 133183 2017-01-31 13:55:43Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Level-2 SKEME/IKEv1 channel protocol using confidential channels and \n dynamically keyed HMACs. Refines model sklvl1.\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\SKEME Protocol (L2)\\\n\ntheory sklvl2\nimports sklvl1 Channels\nbegin\n\ndeclare domIff [simp, iff del]\n\n(**************************************************************************************************)\nsubsection \\State and Events\\\n(**************************************************************************************************)\n\n\ntext \\Initial compromise.\\\n\nconsts\n bad_init :: \"agent set\" \n\nspecification (bad_init)\n bad_init_spec: \"test_owner \\ bad_init \\ test_partner \\ bad_init\"\nby auto\n\n\ntext \\Level 2 state.\\\n\nrecord l2_state = \n skl1_state +\n chan :: \"chan set\"\n bad :: \"agent set\"\n\n\ntype_synonym l2_obs = \"l2_state\"\n\ntype_synonym\n l2_pred = \"l2_state set\"\n\ntype_synonym\n l2_trans = \"(l2_state \\ l2_state) set\"\n\n\ntext \\Attacker events.\\\n\ndefinition\n l2_dy_fake_msg :: \"msg \\ l2_trans\"\nwhere\n \"l2_dy_fake_msg m \\ {(s,s').\n \\ \\guards\\\n m \\ dy_fake_msg (bad s) (ik s) (chan s) \\\n \\ \\actions\\\n s' = s\\ik := {m} \\ ik s\\\n }\"\n\ndefinition\n l2_dy_fake_chan :: \"chan \\ l2_trans\"\nwhere\n \"l2_dy_fake_chan M \\ {(s,s').\n \\ \\guards\\\n M \\ dy_fake_chan (bad s) (ik s) (chan s)\\\n \\ \\actions\\\n s' = s\\chan := {M} \\ chan s\\\n }\"\n\n\ntext \\Partnering.\\\n\nfun\n role_comp :: \"role_t \\ role_t\"\nwhere\n \"role_comp Init = Resp\"\n| \"role_comp Resp = Init\"\n\ndefinition\n matching :: \"frame \\ frame \\ bool\"\nwhere\n \"matching sigma sigma' \\ \\ x. x \\ dom sigma \\ dom sigma' \\ sigma x = sigma' x\"\n\ndefinition\n partner_runs :: \"rid_t \\ rid_t \\ bool\"\nwhere\n \"partner_runs R R' \\ \n role (guessed_runs R) = role_comp (role (guessed_runs R')) \\\n owner (guessed_runs R) = partner (guessed_runs R') \\\n owner (guessed_runs R') = partner (guessed_runs R) \\\n matching (guessed_frame R) (guessed_frame R')\n \"\n\nlemma role_comp_inv [simp]:\n \"role_comp (role_comp x) = x\"\nby (cases x, auto)\n\nlemma role_comp_inv_eq:\n \"y = role_comp x \\ x = role_comp y\"\nby (auto elim!: role_comp.elims [OF sym])\n\ndefinition\n partners :: \"rid_t set\"\nwhere\n \"partners \\ {R. partner_runs test R}\"\n\nlemma test_not_partner [simp]:\n \"test \\ partners\"\nby (auto simp add: partners_def partner_runs_def, cases \"role (guessed_runs test)\", auto)\n\n\nlemma matching_symmetric:\n \"matching sigma sigma' \\ matching sigma' sigma\"\nby (auto simp add: matching_def)\n\nlemma partner_symmetric:\n \"partner_runs R R' \\ partner_runs R' R\"\nby (auto simp add: partner_runs_def matching_symmetric)\n\ntext \\The unicity of the parther is actually protocol dependent:\nit only holds if there are generated fresh nonces (which identify the runs) in the frames\\\nlemma partner_unique:\n \"partner_runs R R'' \\ partner_runs R R' \\ R' = R''\"\nproof -\n assume H':\"partner_runs R R'\"\n then have Hm': \"matching (guessed_frame R) (guessed_frame R')\"\n by (auto simp add: partner_runs_def)\n assume H'':\"partner_runs R R''\"\n then have Hm'': \"matching (guessed_frame R) (guessed_frame R'')\"\n by (auto simp add: partner_runs_def)\n show ?thesis\n proof (cases \"role (guessed_runs R')\")\n case Init\n with H' partner_symmetric [OF H''] have Hrole:\"role (guessed_runs R) = Resp\"\n \"role (guessed_runs R'') = Init\"\n by (auto simp add: partner_runs_def)\n with Init Hm' have \"guessed_frame R xgnx = Some (Exp Gen (NonceF (R'$nx)))\"\n by (simp add: matching_def)\n moreover from Hrole Hm'' have \"guessed_frame R xgnx = Some (Exp Gen (NonceF (R''$nx)))\"\n by (simp add: matching_def)\n ultimately show ?thesis by (auto dest: Exp_Gen_inj)\n next\n case Resp\n with H' partner_symmetric [OF H''] have Hrole:\"role (guessed_runs R) = Init\"\n \"role (guessed_runs R'') = Resp\"\n by (auto simp add: partner_runs_def)\n with Resp Hm' have \"guessed_frame R xgny = Some (Exp Gen (NonceF (R'$ny)))\"\n by (simp add: matching_def)\n moreover from Hrole Hm'' have \"guessed_frame R xgny = Some (Exp Gen (NonceF (R''$ny)))\"\n by (simp add: matching_def)\n ultimately show ?thesis by (auto dest: Exp_Gen_inj)\n qed\nqed\n\nlemma partner_test:\n \"R \\ partners \\ partner_runs R R' \\ R' = test\"\nby (auto intro!:partner_unique simp add:partners_def partner_symmetric)\n\ntext \\compromising events\\\ndefinition\n l2_lkr_others :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_others A \\ {(s,s').\n \\ \\guards\\\n A \\ test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_lkr_actor :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_actor A \\ {(s,s').\n \\ \\guards\\\n A = test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_lkr_after :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_after A \\ {(s,s').\n \\ \\guards\\\n test_ended s \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_skr :: \"rid_t \\ msg \\ l2_trans\"\nwhere\n \"l2_skr R K \\ {(s,s').\n \\ \\guards\\\n R \\ test \\ R \\ partners \\\n in_progress (progress s R) xsk \\\n guessed_frame R xsk = Some K \\\n \\ \\actions\\\n s' = s\\ik := {K} \\ ik s\\\n }\"\n\n\ntext \\Protocol events (with $K=H(ni, nr)$):\n\\begin{itemize}\n\\item step 1: create @{term \"Ra\"}, @{term \"A\"} generates @{term \"nx\"} and @{term \"ni\"},\n confidentially sends @{term \"ni\"},\n computes and insecurely sends $@{term \"g\"}^@{term \"nx\"}$\n\\item step 2: create @{term \"Rb\"}, @{term \"B\"} receives @{term \"ni\"} (confidentially)\n and $@{term \"g\"}^@{term \"nx\"}$ (insecurely),\n generates @{term \"ny\"} and @{term \"nr\"},\n confidentially sends @{term \"nr\"}, insecurely sends $@{term \"g\"}^@{term \"ny\"}$ and\n $MAC_K(@{term \"g\"}^@{term \"nx\"}, @{term \"g\"}^@{term \"ny\"}, @{term \"B\"}, @{term \"A\"})$\n computes $@{term \"g\"}^@{term \"nx*ny\"}$,\n emits a running signal for @{term \"Init\"}, @{term \"ni\"}, @{term \"nr\"}, $@{term \"g\"}^@{term \"nx*ny\"}$\n\\item step 3: @{term \"A\"} receives @{term \"nr\"} confidentially,\n and $@{term \"g\"}^@{term \"ny\"}$ and the MAC insecurely,\n sends $MAC_K(@{term \"g\"}^@{term \"ny\"}, @{term \"g\"}^@{term \"nx\"}, @{term \"A\"}, @{term \"B\"})$\n insecurely, computes $@{term \"g\"}^@{term \"ny*nx\"}$, emits a commit signal for @{term \"Init\"},\n @{term \"ni\"}, @{term \"nr\"}, $@{term \"g\"}^@{term \"ny*nx\"}$,\n a running signal for @{term \"Resp\"}, @{term \"ni\"}, @{term \"nr\"}, $@{term \"g\"}^@{term \"ny*nx\"}$,\n declares the secret $@{term \"g\"}^@{term \"ny*nx\"}$\n\\item step 4: @{term \"B\"} receives the MAC insecurely,\n emits a commit signal for @{term \"Resp\"}, @{term \"ni\"}, @{term \"nr\"},\n $@{term \"g\"}^@{term \"nx*ny\"}$,\n declares the secret $@{term \"g\"}^@{term \"nx*ny\"}$\n\\end{itemize}\n\\\ndefinition\n l2_step1 :: \"rid_t \\ agent \\ agent \\ l2_trans\"\nwhere\n \"l2_step1 Ra A B \\ {(s, s').\n \\ \\guards:\\\n Ra \\ dom (progress s) \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n \\ \\actions:\\\n s' = s\\\n progress := (progress s)(Ra \\ {xnx, xni, xgnx}),\n chan := {Confid A B (NonceF (Ra$ni))} \\ \n ({Insec A B (Exp Gen (NonceF (Ra$nx)))} \\\n (chan s))\n \\\n }\"\n\n\ndefinition\n l2_step2 :: \"rid_t \\ agent \\ agent \\ msg \\ msg \\ l2_trans\"\nwhere\n \"l2_step2 Rb A B Ni gnx \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n Rb \\ dom (progress s) \\\n guessed_frame Rb xgnx = Some gnx \\\n guessed_frame Rb xni = Some Ni \\\n guessed_frame Rb xsk = Some (Exp gnx (NonceF (Rb$ny))) \\\n Confid A B Ni \\ chan s \\\n Insec A B gnx \\ chan s \\\n \\ \\actions:\\\n s' = s\\ progress := (progress s)(Rb \\ {xny, xni, xnr, xgny, xgnx, xsk}),\n chan := {Confid B A (NonceF (Rb$nr))} \\\n ({Insec B A \n \\Exp Gen (NonceF (Rb$ny)),\n hmac \\Number 0, gnx, Exp Gen (NonceF (Rb$ny)), Agent B, Agent A\\\n (Hash \\Ni, NonceF (Rb$nr)\\)\\ } \\ \n (chan s)),\n signalsInit := \n if can_signal s A B then\n addSignal (signalsInit s) \n (Running A B \\Ni, NonceF (Rb$nr), Exp gnx (NonceF (Rb$ny))\\)\n else\n signalsInit s,\n signalsInit2 := \n if can_signal s A B then\n addSignal (signalsInit2 s) (Running A B (Exp gnx (NonceF (Rb$ny))))\n else\n signalsInit2 s\n \\\n }\" \n\n\ndefinition\n l2_step3 :: \"rid_t \\ agent \\ agent \\ msg \\ msg \\ l2_trans\"\nwhere\n \"l2_step3 Ra A B Nr gny \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n progress s Ra = Some {xnx, xni, xgnx} \\\n guessed_frame Ra xgny = Some gny \\\n guessed_frame Ra xnr = Some Nr \\\n guessed_frame Ra xsk = Some (Exp gny (NonceF (Ra$nx))) \\\n Confid B A Nr \\ chan s \\\n Insec B A \\gny, hmac \\Number 0, Exp Gen (NonceF (Ra$nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra$ni), Nr\\)\\ \\ chan s \\\n \\ \\actions:\\\n s' = s\\ progress := (progress s)(Ra \\ {xnx, xni, xnr, xgnx, xgny, xsk, xEnd}),\n chan := {Insec A B \n (hmac \\Number 1, gny, Exp Gen (NonceF (Ra$nx)), Agent A, Agent B\\\n (Hash \\NonceF (Ra$ni), Nr\\))} \n \\ chan s,\n secret := {x. x = Exp gny (NonceF (Ra$nx)) \\ Ra = test} \\ secret s,\n signalsInit := \n if can_signal s A B then\n addSignal (signalsInit s) \n (Commit A B \\NonceF (Ra$ni), Nr, Exp gny (NonceF (Ra$nx))\\)\n else\n signalsInit s,\n signalsInit2 := \n if can_signal s A B then\n addSignal (signalsInit2 s) (Commit A B (Exp gny (NonceF (Ra$nx))))\n else\n signalsInit2 s,\n signalsResp := \n if can_signal s A B then\n addSignal (signalsResp s) \n (Running A B \\NonceF (Ra$ni), Nr, Exp gny (NonceF (Ra$nx))\\)\n else\n signalsResp s,\n signalsResp2 := \n if can_signal s A B then\n addSignal (signalsResp2 s) (Running A B (Exp gny (NonceF (Ra$nx))))\n else\n signalsResp2 s\n \\\n }\"\n\n\ndefinition\n l2_step4 :: \"rid_t \\ agent \\ agent \\ msg \\ msg \\ l2_trans\"\nwhere\n \"l2_step4 Rb A B Ni gnx \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n progress s Rb = Some {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgnx = Some gnx \\\n guessed_frame Rb xni = Some Ni \\\n Insec A B (hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\)) \\ chan s \\\n\n \\ \\actions:\\\n s' = s\\ progress := (progress s)(Rb \\ {xny, xni, xnr, xgnx, xgny, xsk, xEnd}),\n secret := {x. x = Exp gnx (NonceF (Rb$ny)) \\ Rb = test} \\ secret s,\n signalsResp := \n if can_signal s A B then\n addSignal (signalsResp s) \n (Commit A B \\Ni, NonceF (Rb$nr), Exp gnx (NonceF (Rb$ny))\\)\n else\n signalsResp s,\n signalsResp2 := \n if can_signal s A B then\n addSignal (signalsResp2 s) (Commit A B (Exp gnx (NonceF (Rb$ny))))\n else\n signalsResp2 s\n \\\n }\"\n\ntext \\specification\\\ndefinition \n l2_init :: \"l2_state set\"\nwhere\n \"l2_init \\ { \\\n ik = {},\n secret = {},\n progress = Map.empty,\n signalsInit = \\x. 0,\n signalsResp = \\x. 0,\n signalsInit2 = \\x. 0,\n signalsResp2 = \\x. 0,\n chan = {},\n bad = bad_init\n \\}\"\n\ndefinition \n l2_trans :: \"l2_trans\" where\n \"l2_trans \\ (\\m M X Rb Ra A B K Y.\n l2_step1 Ra A B \\\n l2_step2 Rb A B X Y \\\n l2_step3 Ra A B X Y \\\n l2_step4 Rb A B X Y \\\n l2_dy_fake_chan M \\\n l2_dy_fake_msg m \\\n l2_lkr_others A \\\n l2_lkr_after A \\\n l2_skr Ra K \\\n Id\n )\"\n\n\ndefinition \n l2 :: \"(l2_state, l2_obs) spec\" where\n \"l2 \\ \\\n init = l2_init,\n trans = l2_trans,\n obs = id\n \\\"\n\nlemmas l2_loc_defs = \n l2_step1_def l2_step2_def l2_step3_def l2_step4_def\n l2_def l2_init_def l2_trans_def\n l2_dy_fake_chan_def l2_dy_fake_msg_def\n l2_lkr_after_def l2_lkr_others_def l2_skr_def\n\nlemmas l2_defs = l2_loc_defs ik_dy_def\n\nlemmas l2_nostep_defs = l2_def l2_init_def l2_trans_def\nlemmas l2_step_defs = \n l2_step1_def l2_step2_def l2_step3_def l2_step4_def \n l2_dy_fake_chan_def l2_dy_fake_msg_def l2_lkr_after_def l2_lkr_others_def l2_skr_def\n\nlemma l2_obs_id [simp]: \"obs l2 = id\"\nby (simp add: l2_def)\n\n\ntext \\Once a run is finished, it stays finished, therefore if the test is not finished at some\npoint then it was not finished before either.\\\n\ndeclare domIff [iff]\nlemma l2_run_ended_trans:\n \"run_ended (progress s R) \\\n (s, s') \\ trans l2 \\\n run_ended (progress s' R)\"\napply (auto simp add: l2_nostep_defs)\napply (auto simp add: l2_defs)\ndone\ndeclare domIff [iff del]\n\nlemma l2_can_signal_trans:\n \"can_signal s' A B \\\n (s, s') \\ trans l2 \\\n can_signal s A B\"\nby (auto simp add: can_signal_def l2_run_ended_trans)\n\nlemma in_progressS_trans: \n \"in_progressS (progress s R) S \\ (s, s') \\ trans l2 \\ in_progressS (progress s' R) S\" \napply (auto simp add: l2_nostep_defs)\napply (auto simp add: l2_defs domIff)\ndone\n\n(**************************************************************************************************)\nsubsection \\Invariants\\\n(**************************************************************************************************)\n\nsubsubsection \\inv1\\\n(**************************************************************************************************)\n\ntext \\If @{term \"can_signal s A B\"}\n(i.e., @{term \"A\"}, @{term \"B\"} are the test session agents and the test \nis not finished), then @{term \"A\"}, @{term \"B\"} are honest.\\\n\ndefinition\n l2_inv1 :: \"l2_state set\"\nwhere\n \"l2_inv1 \\ {s. \\A B.\n can_signal s A B \\\n A \\ bad s \\ B \\ bad s\n }\"\n\nlemmas l2_inv1I = l2_inv1_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv1E [elim] = l2_inv1_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv1D = l2_inv1_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv1_init [iff]:\n \"init l2 \\ l2_inv1\"\nby (auto simp add: l2_def l2_init_def l2_inv1_def can_signal_def bad_init_spec)\n\nlemma l2_inv1_trans [iff]:\n \"{l2_inv1} trans l2 {> l2_inv1}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv1I del: conjI)\n fix s' s :: l2_state\n fix A B\n assume HI:\"s \\ l2_inv1\" \n assume HT:\"(s, s') \\ trans l2\"\n assume \"can_signal s' A B\"\n with HT have HS:\"can_signal s A B\"\n by (auto simp add: l2_can_signal_trans)\n with HI have \"A \\ bad s \\ B \\ bad s\"\n by fast\n with HS HT show \"A \\ bad s' \\ B \\ bad s'\"\n by (auto simp add: l2_nostep_defs can_signal_def)\n (simp_all add: l2_defs)\nqed\n\nlemma PO_l2_inv1 [iff]: \"reach l2 \\ l2_inv1\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv2\\\n(**************************************************************************************************)\n\ntext \\For a run @{term \"R\"} (with any role), the session key is always\n$something^n$ where $n$ is a nonce generated by @{term \"R\"}.\\\n\ndefinition\n l2_inv2 :: \"l2_state set\"\nwhere\n \"l2_inv2 \\ {s. \\R.\n in_progress (progress s R) xsk \\\n (\\ X N.\n guessed_frame R xsk = Some (Exp X (NonceF (R$N))))\n }\"\n\nlemmas l2_inv2I = l2_inv2_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv2E [elim] = l2_inv2_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv2D = l2_inv2_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv2_init [iff]:\n \"init l2 \\ l2_inv2\"\nby (auto simp add: l2_def l2_init_def l2_inv2_def)\n\nlemma l2_inv2_trans [iff]:\n \"{l2_inv2} trans l2 {> l2_inv2}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv2I)\napply (auto simp add: l2_defs dy_fake_chan_def dest: l2_inv2D)\ndone\n\nlemma PO_l2_inv2 [iff]: \"reach l2 \\ l2_inv2\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv3\\\n(**************************************************************************************************)\n\ndefinition\n \"bad_runs s = {R. owner (guessed_runs R) \\ bad s \\ partner (guessed_runs R) \\ bad s}\"\n\nabbreviation\n generators :: \"l2_state \\ msg set\"\nwhere\n \"generators s \\ \n \\ \\from the \\insec\\ messages in steps 1 2\\\n {x. \\ N. x = Exp Gen (Nonce N)} \\ \n \\ \\from the opened \\confid\\ messages in steps 1 2\\\n {x. \\ R \\ bad_runs s. x = NonceF (R$ni) \\ x = NonceF (R$nr)} \\ \n \\ \\from the \\insec\\ messages in steps 2 3\\\n {x. \\ y y' z. x = hmac \\y, y'\\ (Hash z)} \\ \n \\ \\from the \\skr\\\\\n {Exp y (NonceF (R$N)) | y N R. R \\ test \\ R \\ partners}\" \n\nlemma analz_generators: \"analz (generators s) = generators s\"\nby (rule, rule, erule analz.induct) (auto)\n\n\ndefinition \n faked_chan_msgs :: \"l2_state \\ chan set\"\nwhere\n \"faked_chan_msgs s = \n {Chan x A B M | x A B M. M \\ synth (analz (extr (bad s) (ik s) (chan s)))}\"\n \ndefinition\n chan_generators :: \"chan set\"\nwhere\n \"chan_generators = {x. \\ n R. \\ \\the messages that can't be opened\\\n x = Confid (owner (guessed_runs R)) (partner (guessed_runs R)) (NonceF (R$n)) \\ \n (n = ni \\ n = nr)\n }\"\n\n\ndefinition\n l2_inv3 :: \"l2_state set\"\nwhere\n \"l2_inv3 \\ {s.\n extr (bad s) (ik s) (chan s) \\ synth (analz (generators s)) \\\n chan s \\ faked_chan_msgs s \\ chan_generators\n }\"\n \nlemmas l2_inv3_aux_defs = faked_chan_msgs_def chan_generators_def\n \nlemmas l2_inv3I = l2_inv3_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv3E = l2_inv3_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv3D = l2_inv3_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n \nlemma l2_inv3_init [iff]:\n \"init l2 \\ l2_inv3\"\nby (auto simp add: l2_def l2_init_def l2_inv3_def)\n\nlemma l2_inv3_step1:\n \"{l2_inv3} l2_step1 Ra A B {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv3I)\napply (auto simp add: l2_defs bad_runs_def intro: synth_analz_increasing dest!: l2_inv3D)\napply (auto simp add: l2_inv3_aux_defs intro: synth_analz_monotone \n dest!: subsetD [where A=\"chan _\"])\ndone\n\nlemma l2_inv3_step2:\n \"{l2_inv3} l2_step2 Rb A B Ni gnx {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv3I)\napply (auto simp add: l2_defs) \napply (auto simp add: bad_runs_def intro: synth_analz_increasing dest!: l2_inv3D)\napply (auto simp add: l2_inv3_aux_defs) \\ \\SLOW, ca. 30s\\\napply (blast intro: synth_analz_monotone analz.intros insert_iff synth_analz_increasing\n dest!: subsetD [where A=\"chan _\"])+\ndone\n\nlemma l2_inv3_step3:\n \"{l2_inv3} l2_step3 Ra A B Nr gny {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv3I)\napply (auto simp add: l2_defs bad_runs_def intro: synth_analz_increasing dest!: l2_inv3D)\napply (auto simp add: l2_inv3_aux_defs)\napply (blast intro: synth_analz_monotone dest!: subsetD [where A=\"chan _\"])+\ndone\n\nlemma l2_inv3_step4:\n \"{l2_inv3} l2_step4 Rb A B Ni gnx {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv3I, auto simp add: l2_defs)\napply (auto simp add: bad_runs_def intro:synth_analz_increasing dest!: l2_inv3D)\napply (auto simp add: l2_inv3_aux_defs dest!: subsetD [where A=\"chan _\"])\ndone\n\nlemma l2_inv3_dy_fake_msg:\n \"{l2_inv3} l2_dy_fake_msg M {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_defs extr_insert_IK_eq \n intro!: l2_inv3I \n elim!: l2_inv3E dy_fake_msg_extr [THEN [2] rev_subsetD])\napply (auto intro!: fake_New\n intro: synth_analz_increasing fake_monotone dy_fake_msg_monotone \n dy_fake_msg_insert_chan \n simp add: bad_runs_def elim!: l2_inv3E)\napply (auto simp add: l2_inv3_aux_defs intro: synth_analz_monotone \n dest!: subsetD [where A=\"chan _\"])\ndone\n\n\nlemma l2_inv3_dy_fake_chan:\n \"{l2_inv3} l2_dy_fake_chan M {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_defs \n intro!: l2_inv3I \n elim!: l2_inv3E)\napply (auto intro: synth_analz_increasing simp add: bad_runs_def elim!: l2_inv3E\n dest:dy_fake_msg_extr [THEN [2] rev_subsetD]\n dy_fake_chan_extr_insert [THEN [2] rev_subsetD]\n dy_fake_chan_mono2)\napply (simp add: l2_inv3_aux_defs dy_fake_chan_def dy_fake_msg_def, \n erule fake.cases, simp_all)\napply (auto simp add: l2_inv3_aux_defs elim!: synth_analz_monotone \n dest!: subsetD [where A=\"chan _\"])\ndone\n\nlemma l2_inv3_lkr_others:\n \"{l2_inv3} l2_lkr_others A {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_defs \n intro!: l2_inv3I\n dest!: extr_insert_bad [THEN [2] rev_subsetD]\n elim!: l2_inv3E)\napply (auto simp add: l2_inv3_aux_defs bad_runs_def \n intro: synth_analz_increasing synth_analz_monotone)\napply (drule synth_analz_mono [where G=\"extr _ _ _\"], auto,\n (drule rev_subsetD [where A=\"chan _\"], simp)+, auto intro: synth_analz_increasing,\n drule rev_subsetD [where A=\"synth (analz (extr _ _ _))\"], \n auto intro: synth_analz_monotone)+\ndone\n\nlemma l2_inv3_lkr_after:\n \"{l2_inv3} l2_lkr_after A {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_defs intro!: l2_inv3I\n dest!: extr_insert_bad [THEN [2] rev_subsetD]\n elim!: l2_inv3E)\napply (auto simp add: l2_inv3_aux_defs bad_runs_def \n intro: synth_analz_increasing synth_analz_monotone)\napply (drule synth_analz_mono [where G=\"extr _ _ _\"], auto,\n (drule rev_subsetD [where A=\"chan _\"], simp)+, auto intro: synth_analz_increasing,\n drule rev_subsetD [where A=\"synth (analz (extr _ _ _))\"], \n auto intro: synth_analz_monotone)+\ndone\n \nlemma l2_inv3_skr:\n \"{l2_inv3 \\ l2_inv2} l2_skr R K {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_defs intro!: l2_inv3I dest!: l2_inv2D)\napply (auto simp add: l2_inv3_aux_defs bad_runs_def intro: synth_analz_increasing \n elim!: l2_inv3E)\napply (blast intro: synth_analz_monotone dest!: subsetD [where A=\"chan _\"])+\ndone\n\n\nlemmas l2_inv3_trans_aux =\n l2_inv3_step1 l2_inv3_step2 l2_inv3_step3 l2_inv3_step4\n l2_inv3_dy_fake_msg l2_inv3_dy_fake_chan\n l2_inv3_lkr_others l2_inv3_lkr_after l2_inv3_skr\n\nlemma l2_inv3_trans [iff]:\n \"{l2_inv3 \\ l2_inv2} trans l2 {> l2_inv3}\"\nby (auto simp add: l2_nostep_defs intro:l2_inv3_trans_aux)\n\nlemma PO_l2_inv3 [iff]: \"reach l2 \\ l2_inv3\"\nby (rule_tac J=\"l2_inv2\" in inv_rule_incr) (auto)\n\ntext \\Auxiliary dest rule for inv3.\\\n\nlemmas l2_inv3D_aux =\n l2_inv3D [THEN conjunct1,\n THEN [2] subset_trans,\n THEN synth_analz_mono, simplified,\n THEN [2] rev_subsetD, rotated 1, OF IK_subset_extr]\n\nlemma l2_inv3D_HashNonce1:\n \"s \\ l2_inv3 \\\n Hash \\NonceF (R$N), X\\ \\ synth (analz (extr (bad s) (ik s) (chan s))) \\\n R \\ bad_runs s\"\napply (drule l2_inv3D, auto, drule synth_analz_monotone, auto simp add: analz_generators)\napply (erule synth.cases, auto)\ndone\n\nlemma l2_inv3D_HashNonce2:\n \"s \\ l2_inv3 \\\n Hash \\X, NonceF (R$N)\\ \\ synth (analz (extr (bad s) (ik s) (chan s))) \\\n R \\ bad_runs s\"\napply (drule l2_inv3D, auto, drule synth_analz_monotone, auto simp add: analz_generators)\napply (erule synth.cases, auto)\ndone\n\n\n\nsubsubsection \\hmac preservation lemmas\\\n(**************************************************************************************************)\n\ntext \\If @{term \"(s, s') \\ trans l2\"} then the MACs (with secret keys) that the attacker knows in\n @{term \"s'\"} (overapproximated by those in @{term \"parts (extr (bad s') (ik s') (chan s'))\"})\n are already known in @{term \"s\"}, except in the case of the steps 2 and 3 of the protocol.\n\\\n\nlemma hmac_key_unknown:\n \"hmac X K \\ synth (analz H) \\ K \\ synth (analz H) \\ hmac X K \\ analz H\"\nby (erule synth.cases, auto)\n\nlemma parts_exp [simp]:\"parts {Exp X Y} = {Exp X Y}\"\nby (auto,erule parts.induct, auto)\n\nlemma hmac_trans_1_4_skr_extr_fake:\n \"hmac X K \\ parts (extr (bad s') (ik s') (chan s')) \\\n K \\ synth (analz (extr (bad s) (ik s) (chan s))) \\ \\ \\necessary for the \\dy_fake_msg\\ case\\\n s \\ l2_inv2 \\ \\ \\necessary for the \\skr\\ case\\\n (s, s') \\ l2_step1 Ra A B \\ l2_step4 Rb A B Ni gnx \\ l2_skr R KK \\ \n l2_dy_fake_msg M \\ l2_dy_fake_chan MM \\\n hmac X K \\ parts (extr (bad s) (ik s) (chan s))\"\napply (auto simp add: l2_defs parts_insert [where H=\"extr _ _ _\"] \n parts_insert [where H=\"insert _ (extr _ _ _)\"])\napply (auto dest!:l2_inv2D)\napply (auto dest!:dy_fake_chan_extr_insert_parts [THEN [2] rev_subsetD]\n parts_monotone [of _ \"{M}\" \"synth (analz (extr (bad s) (ik s) (chan s)))\"],\n auto simp add: dy_fake_msg_def)\ndone\n\nlemma hmac_trans_2:\n \"hmac X K \\ parts (extr (bad s') (ik s') (chan s')) \\\n (s, s') \\ l2_step2 Rb A B Ni gnx \\\n hmac X K \\ parts (extr (bad s) (ik s) (chan s)) \\\n (X = \\Number 0, gnx, Exp Gen (NonceF (Rb$ny)), Agent B, Agent A\\ \\\n K = Hash \\Ni, NonceF (Rb$nr)\\ \\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n progress s' Rb = Some {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgnx = Some gnx \\\n guessed_frame Rb xni = Some Ni )\"\napply (auto simp add: l2_defs parts_insert [where H=\"extr _ _ _\"] \n parts_insert [where H=\"insert _ (extr _ _ _)\"])\ndone\n\nlemma hmac_trans_3:\n \"hmac X K \\ parts (extr (bad s') (ik s') (chan s')) \\\n (s, s') \\ l2_step3 Ra A B Nr gny \\\n hmac X K \\ parts (extr (bad s) (ik s) (chan s)) \\\n (X = \\Number 1, gny, Exp Gen (NonceF (Ra$nx)), Agent A, Agent B\\ \\\n K = Hash \\NonceF (Ra$ni), Nr\\ \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n progress s' Ra = Some {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgny = Some gny \\\n guessed_frame Ra xnr = Some Nr)\"\napply (auto simp add: l2_defs parts_insert [where H=\"extr _ _ _\"] \n parts_insert [where H=\"insert _ (extr _ _ _)\"])\ndone\n\nlemma hmac_trans_lkr_aux:\n \"hmac X K \\ parts {M. \\ x A B. Chan x A B M \\ chan s} \\\n K \\ synth (analz (extr (bad s) (ik s) (chan s))) \\\n s \\ l2_inv3 \\\n hmac X K \\ parts (extr (bad s) (ik s) (chan s))\"\nproof -\n assume A:\"K \\ synth (analz (extr (bad s) (ik s) (chan s)))\" \"s \\ l2_inv3\"\n assume \"hmac X K \\ parts {M. \\ x A B. Chan x A B M \\ chan s}\"\n then obtain x A B M where H:\"hmac X K \\ parts {M}\" and H':\"Chan x A B M \\ chan s\"\n by (auto dest: parts_singleton)\n assume \"s \\ l2_inv3\"\n with H' have \"M \\ range Nonce \\ M \\ synth (analz (extr (bad s) (ik s) (chan s)))\"\n by (auto simp add: l2_inv3_aux_defs dest!: l2_inv3D, auto)\n with H show ?thesis\n proof (auto)\n assume \"M \\ synth (analz (extr (bad s) (ik s) (chan s)))\"\n then have \"{M} \\ synth (analz (extr (bad s) (ik s) (chan s)))\" by (auto)\n then have \"parts {M} \\ parts (synth (analz (extr (bad s) (ik s) (chan s))))\" \n by (rule parts_mono)\n with H have \"hmac X K \\ parts (synth (analz (extr (bad s) (ik s) (chan s))))\" by auto\n with A show ?thesis by auto\n qed\nqed\n \n\nlemma hmac_trans_lkr:\n \"hmac X K \\ parts (extr (bad s') (ik s') (chan s')) \\\n K \\ synth (analz (extr (bad s) (ik s) (chan s))) \\\n s \\ l2_inv3 \\ \n (s, s') \\ l2_lkr_others A \\ l2_lkr_after A \\\n hmac X K \\ parts (extr (bad s) (ik s) (chan s))\"\napply (auto simp add: l2_defs\n dest!: parts_monotone [OF _ extr_insert_bad])\napply (auto intro: parts_monotone intro!:hmac_trans_lkr_aux)\ndone\n\nlemmas hmac_trans = hmac_trans_1_4_skr_extr_fake hmac_trans_lkr hmac_trans_2 hmac_trans_3\n\n\n\nsubsubsection \\inv4 (authentication guard)\\\n(**************************************************************************************************)\n\ntext \\If HMAC is @{term \"parts (extr (bad s) (ik s) (chan s))\"} and @{term \"A\"}, @{term \"B\"} \nare honest then the message has indeed been sent by a responder run (etc).\\\n\ndefinition\n l2_inv4 :: \"l2_state set\"\nwhere\n \"l2_inv4 \\ {s. \\ Ra A B gny Nr.\n hmac \\Number 0, Exp Gen (NonceF (Ra$nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra$ni), Nr\\) \\ parts (extr (bad s) (ik s) (chan s)) \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n A \\ bad s \\ B \\ bad s \\\n (\\ Rb. guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n in_progressS (progress s Rb) {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgny = Some gny \\\n guessed_frame Rb xnr = Some Nr \\\n guessed_frame Rb xni = Some (NonceF (Ra$ni)) \\\n guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra$nx))))\n }\"\n\nlemmas l2_inv4I = l2_inv4_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv4E [elim] = l2_inv4_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv4D = l2_inv4_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv4_init [iff]:\n \"init l2 \\ l2_inv4\"\nby (auto simp add: l2_def l2_init_def l2_inv4_def)\n\nlemma l2_inv4_trans [iff]:\n \"{l2_inv4 \\ l2_inv2 \\ l2_inv3} trans l2 {> l2_inv4}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv4I)\n fix s' s :: l2_state\n fix Ra A B gny Nr\n assume HHparts:\"hmac \\Number 0, Exp Gen (NonceF (Ra $ nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra $ ni), Nr\\)\n \\ parts (extr (bad s') (ik s') (chan s'))\"\n assume HRa: \"guessed_runs Ra = \\role=Init, owner=A, partner=B\\\"\n assume Hi:\"s \\ l2_inv4\" \"s \\ l2_inv2\" \"s \\ l2_inv3\"\n assume Ht:\"(s, s') \\ trans l2\"\n assume \"A \\ bad s'\" \"B \\ bad s'\"\n with Ht have Hb:\"A \\ bad s\" \"B \\ bad s\" \n by (auto simp add: l2_nostep_defs) (simp_all add: l2_defs)\n with HRa Hi \n have HH:\"Hash \\NonceF (Ra$ ni), Nr\\ \\ synth (analz (extr (bad s) (ik s) (chan s)))\"\n by (auto dest!: l2_inv3D_HashNonce1 simp add: bad_runs_def)\n from Ht Hi HHparts HH \n have \"hmac \\Number 0, Exp Gen (NonceF (Ra $ nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra $ ni), Nr\\) \\ parts (extr (bad s) (ik s) (chan s)) \\\n (\\ Rb. (s, s') \\ l2_step2 Rb A B (NonceF (Ra$ni)) (Exp Gen (NonceF (Ra $ nx))) \\\n gny = Exp Gen (NonceF (Rb$ny)) \\\n Nr = NonceF (Rb$nr) \\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n progress s' Rb = Some {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra$nx))) \\\n guessed_frame Rb xni = Some (NonceF (Ra$ni)))\"\n apply (auto simp add: l2_nostep_defs)\n (*apply (auto dest: hmac_trans) does not work*)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_2, auto)\n apply (drule hmac_trans_3, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_lkr, auto)\n apply (drule hmac_trans_lkr, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n done\n then show \"\\Rb. guessed_runs Rb = \\role = Resp, owner = B, partner = A\\ \\\n in_progressS (progress s' Rb) {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgny = Some gny \\\n guessed_frame Rb xnr = Some Nr \\\n guessed_frame Rb xni = Some (NonceF (Ra $ ni)) \\\n guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra $ nx)))\"\n proof (auto)\n assume \n \"hmac \\Number 0, Exp Gen (NonceF (Ra $ nx)), gny, Agent B, Agent A\\ \n (hmac (NonceF (Ra $ ni)) Nr)\n \\ parts (extr (bad s) (ik s) (chan s))\"\n with Hi Hb HRa obtain Rb where \n HRb: \"guessed_runs Rb = \\role = Resp, owner = B, partner = A\\\"\n \"in_progressS (progress s Rb) {xny, xni, xnr, xgnx, xgny, xsk}\"\n \"guessed_frame Rb xgny = Some gny\"\n \"guessed_frame Rb xnr = Some Nr\"\n \"guessed_frame Rb xni = Some (NonceF (Ra $ ni))\"\n \"guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra $ nx)))\"\n by (auto dest!: l2_inv4D)\n with Ht have \"in_progressS (progress s' Rb) {xny, xni, xnr, xgnx, xgny, xsk}\"\n by (auto elim: in_progressS_trans)\n with HRb show ?thesis by auto\n qed\nqed\n\nlemma PO_l2_inv4 [iff]: \"reach l2 \\ l2_inv4\"\nby (rule_tac J=\"l2_inv2 \\ l2_inv3\" in inv_rule_incr) (auto)\n\n\nlemma auth_guard_step3:\n \"s \\ l2_inv4 \\\n s \\ l2_inv1 \\\n Insec B A \\gny, hmac \\Number 0, Exp Gen (NonceF (Ra$nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra$ni), Nr\\)\\\n \\ chan s \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n can_signal s A B \\\n (\\ Rb. guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n in_progressS (progress s Rb) {xny, xni, xnr, xgnx, xgny, xsk} \\\n guessed_frame Rb xgny = Some gny \\\n guessed_frame Rb xnr = Some Nr \\\n guessed_frame Rb xni = Some (NonceF (Ra$ni)) \\\n guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra$nx))))\"\nproof -\n assume \"s \\ l2_inv1\" \"can_signal s A B\"\n hence Hb:\"A \\ bad s\" \"B \\ bad s\" by auto\n assume \"Insec B A \\gny, hmac \\Number 0, Exp Gen (NonceF (Ra$nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (Ra$ni), Nr\\)\\ \\ chan s\"\n hence HH:\n \"hmac \\Number 0, Exp Gen (NonceF (Ra$nx)), gny, Agent B, Agent A\\ \n (Hash \\NonceF (Ra$ni), Nr\\)\n \\ parts (extr (bad s) (ik s) (chan s))\" by auto\n assume \"s \\ l2_inv4\" \"guessed_runs Ra = \\role=Init, owner=A, partner=B\\\"\n with Hb HH show ?thesis by auto\nqed\n\n\nsubsubsection \\inv5 (authentication guard)\\\n(**************************************************************************************************)\n\ntext \\If MAC is in @{term \"parts (extr (bad s) (ik s) (chan s))\"} and @{term \"A\"}, @{term \"B\"}\n are honest then the message has indeed been sent by an initiator run (etc).\\\n\ndefinition\n l2_inv5 :: \"l2_state set\"\nwhere\n \"l2_inv5 \\ {s. \\ Rb A B gnx Ni.\n hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\) \\ parts (extr (bad s) (ik s) (chan s)) \\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n A \\ bad s \\ B \\ bad s \\\n (\\ Ra. guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgnx = Some gnx \\\n guessed_frame Ra xni = Some Ni \\\n guessed_frame Ra xnr = Some (NonceF (Rb$nr)) \\\n guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny))))\n }\"\n\nlemmas l2_inv5I = l2_inv5_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv5E [elim] = l2_inv5_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv5D = l2_inv5_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv5_init [iff]:\n \"init l2 \\ l2_inv5\"\nby (auto simp add: l2_def l2_init_def l2_inv5_def)\n\nlemma l2_inv5_trans [iff]:\n \"{l2_inv5 \\ l2_inv2 \\ l2_inv3} trans l2 {> l2_inv5}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv5I)\n fix s' s :: l2_state\n fix Rb A B gnx Ni\n assume HHparts:\"hmac \\Number (Suc 0), Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\)\n \\ parts (extr (bad s') (ik s') (chan s'))\"\n assume HRb: \"guessed_runs Rb = \\role=Resp, owner=B, partner=A\\\"\n assume Hi:\"s \\ l2_inv5\" \"s \\ l2_inv2\" \"s \\ l2_inv3\"\n assume Ht:\"(s, s') \\ trans l2\"\n assume \"A \\ bad s'\" \"B \\ bad s'\"\n with Ht have Hb:\"A \\ bad s\" \"B \\ bad s\" \n by (auto simp add: l2_nostep_defs) (simp_all add: l2_defs)\n with HRb Hi have HH:\"Hash \\Ni, NonceF (Rb$nr)\\ \\ synth (analz (extr (bad s) (ik s) (chan s)))\"\n by (auto dest!: l2_inv3D_HashNonce2 simp add: bad_runs_def)\n from Ht Hi HHparts HH have \"hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\) \\ parts (extr (bad s) (ik s) (chan s)) \\\n (\\ Ra. (s, s') \\ l2_step3 Ra A B (NonceF (Rb$nr)) (Exp Gen (NonceF (Rb$ny))) \\\n gnx = Exp Gen (NonceF (Ra$nx)) \\\n Ni = NonceF (Ra$ni) \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n progress s' Ra = Some {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny))) \\\n guessed_frame Ra xnr = Some (NonceF (Rb$nr)))\"\n apply (auto simp add: l2_nostep_defs)\n (*apply (auto dest: hmac_trans) does not work*)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_2, auto)\n apply (drule hmac_trans_3, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n apply (drule hmac_trans_lkr, auto)\n apply (drule hmac_trans_lkr, auto)\n apply (drule hmac_trans_1_4_skr_extr_fake, auto)\n done\n then show \"\\Ra. guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progressS (progress s' Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgnx = Some gnx \\\n guessed_frame Ra xni = Some Ni \\\n guessed_frame Ra xnr = Some (NonceF (Rb$nr)) \\\n guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny)))\"\n proof (auto)\n assume \n \"hmac \\Number (Suc 0), Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\ \n (Hash \\Ni, NonceF (Rb$nr)\\)\n \\ parts (extr (bad s) (ik s) (chan s))\"\n with Hi Hb HRb obtain Ra where HRa:\"guessed_runs Ra = \\role=Init, owner=A, partner=B\\\"\n \"in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd}\"\n \"guessed_frame Ra xgnx = Some gnx\"\n \"guessed_frame Ra xni = Some Ni\"\n \"guessed_frame Ra xnr = Some (NonceF (Rb$nr))\"\n \"guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny)))\"\n by (auto dest!: l2_inv5D)\n with Ht have \"in_progressS (progress s' Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd}\"\n by (auto elim: in_progressS_trans)\n with HRa show ?thesis by auto\n qed\nqed\n\nlemma PO_l2_inv5 [iff]: \"reach l2 \\ l2_inv5\"\nby (rule_tac J=\"l2_inv2 \\ l2_inv3\" in inv_rule_incr) (auto)\n\n\nlemma auth_guard_step4:\n \"s \\ l2_inv5 \\\n s \\ l2_inv1 \\\n Insec A B (hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\))\n \\ chan s \\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n can_signal s A B \\\n (\\ Ra. guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgnx = Some gnx \\\n guessed_frame Ra xni = Some Ni \\\n guessed_frame Ra xnr = Some (NonceF (Rb$nr)) \\\n guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny))))\"\nproof -\n assume \"s \\ l2_inv1\" \"can_signal s A B\"\n hence Hb:\"A \\ bad s\" \"B \\ bad s\" by auto\n assume \"Insec A B (hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (Rb$nr)\\)) \\ chan s\"\n hence HH:\n \"hmac \\Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\\ \n (Hash \\Ni, NonceF (Rb$nr)\\)\n \\ parts (extr (bad s) (ik s) (chan s))\" by auto\n assume \"s \\ l2_inv5\" \"guessed_runs Rb = \\role=Resp, owner=B, partner=A\\\"\n with Hb HH show ?thesis by auto\nqed\n\n\nsubsubsection \\inv6\\\n(**************************************************************************************************)\n\ntext \\For an initiator, the session key is always $@{term \"gny\"}^@{term \"nx\"}$.\\\n\ndefinition\n l2_inv6 :: \"l2_state set\"\nwhere\n \"l2_inv6 \\ {s. \\Ra A B gny.\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progress (progress s Ra) xsk \\\n guessed_frame Ra xgny = Some gny \\\n guessed_frame Ra xsk = Some (Exp gny (NonceF (Ra$nx)))\n }\"\n\nlemmas l2_inv6I = l2_inv6_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv6E [elim] = l2_inv6_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv6D = l2_inv6_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv6_init [iff]:\n \"init l2 \\ l2_inv6\"\nby (auto simp add: l2_def l2_init_def l2_inv6_def)\n\nlemma l2_inv6_trans [iff]:\n \"{l2_inv6} trans l2 {> l2_inv6}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv6I)\napply (auto simp add: l2_defs dy_fake_chan_def)\ndone\n\nlemma PO_l2_inv6 [iff]: \"reach l2 \\ l2_inv6\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv6'\\\n(**************************************************************************************************)\n\ntext \\For a responder, the session key is always $@{term \"gnx\"}^@{term \"ny\"}$.\\\n\ndefinition\n l2_inv6' :: \"l2_state set\"\nwhere\n \"l2_inv6' \\ {s. \\Rb A B gnx.\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n in_progress (progress s Rb) xsk \\\n guessed_frame Rb xgnx = Some gnx \\\n guessed_frame Rb xsk = Some (Exp gnx (NonceF (Rb$ny)))\n }\"\n\nlemmas l2_inv6'I = l2_inv6'_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv6'E [elim] = l2_inv6'_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv6'D = l2_inv6'_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv6'_init [iff]:\n \"init l2 \\ l2_inv6'\"\nby (auto simp add: l2_def l2_init_def l2_inv6'_def)\n\nlemma l2_inv6'_trans [iff]:\n \"{l2_inv6'} trans l2 {> l2_inv6'}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv6'I)\napply (auto simp add: l2_defs dy_fake_chan_def)\ndone\n\nlemma PO_l2_inv6' [iff]: \"reach l2 \\ l2_inv6'\"\nby (rule inv_rule_basic) (auto)\n\nsubsubsection \\inv7: form of the secrets\\\n(**************************************************************************************************)\ndefinition\n l2_inv7 :: \"l2_state set\"\nwhere\n \"l2_inv7 \\ {s.\n secret s \\ {Exp (Exp Gen (NonceF (R$N))) (NonceF (R'$N')) | N N' R R'.\n R = test \\ R' \\ partners \\ (N=nx \\ N=ny) \\ (N'=nx \\ N'=ny)}\n }\"\n\nlemmas l2_inv7I = l2_inv7_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv7E [elim] = l2_inv7_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv7D = l2_inv7_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\n\n\n\ntext \\Steps 3 and 4 are the hard part.\\\n\nlemma l2_inv7_step3:\n \"{l2_inv7 \\ l2_inv1 \\ l2_inv4 \\ l2_inv6'} l2_step3 Ra A B Nr gny {> l2_inv7}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv7I)\n fix s s' :: l2_state fix x\n assume Hi:\"s \\ l2_inv1\" \"s \\ l2_inv7\" \"s \\ l2_inv4\" \"s \\ l2_inv6'\"\n assume Ht:\"(s, s') \\ l2_step3 Ra A B Nr gny\"\n assume Hs:\"x \\ secret s'\"\n from Hs Ht have \"x \\ secret s \\ (Ra = test \\ x = Exp gny (NonceF (Ra$nx)))\"\n by (auto simp add: l2_defs)\n with Hi Ht \n show \"\\N N' R'. x = Exp (Exp Gen (NonceF (R' $ N'))) (NonceF (test $ N)) \\ \n R' \\ partners \\ (N = nx \\ N = ny) \\ (N' = nx \\ N' = ny)\"\n proof (auto dest: l2_inv7D simp add: l2_defs)\n assume Htest: \"guessed_runs test = \\role = Init, owner = A, partner = B\\\"\n \"guessed_frame test xgny = Some gny\"\n \"guessed_frame test xnr = Some Nr\"\n \"guessed_frame test xsk = Some (Exp gny (NonceF (test $ nx)))\"\n assume \n \"Insec B A \\gny, hmac \\Number 0, Exp Gen (NonceF (test$nx)), gny, Agent B, Agent A\\\n (Hash \\NonceF (test$ni), Nr\\)\\\n \\ chan s\"\n \"can_signal s A B\"\n with Htest Hi obtain Rb where HRb:\n \"guessed_runs Rb = \\role=Resp, owner=B, partner=A\\\"\n \"in_progressS (progress s Rb) {xny, xni, xnr, xgnx, xgny, xsk}\"\n \"gny = Exp Gen (NonceF (Rb$ny))\"\n \"Nr = NonceF (Rb$nr)\"\n \"guessed_frame Rb xni = Some (NonceF (test$ni))\"\n \"guessed_frame Rb xgnx = Some (Exp Gen (NonceF (test$nx)))\"\n by (auto dest!: auth_guard_step3)\n with Hi \n have \"guessed_frame Rb xsk = Some (Exp (Exp Gen (NonceF (Rb$ny))) (NonceF (test$nx)))\"\n by (auto dest: l2_inv6'D)\n with HRb Htest have \"Rb \\ partners\"\n by (auto simp add: partners_def partner_runs_def, simp add: matching_def)\n with HRb have \"Exp gny (NonceF (test $ nx)) = \n Exp (Exp Gen (NonceF (Rb $ ny))) (NonceF (test $ nx)) \\ Rb \\ partners\"\n by auto\n then show \"\\N N' R'.\n Exp gny (NonceF (test $ nx)) = Exp (Exp Gen (NonceF (R' $ N'))) (NonceF (test $ N)) \\\n R' \\ partners \\ (N = nx \\ N = ny) \\ (N' = nx \\ N' = ny)\"\n by blast\n qed (auto simp add: can_signal_def)\nqed\n\nlemma l2_inv7_step4:\n \"{l2_inv7 \\ l2_inv1 \\ l2_inv5 \\ l2_inv6 \\ l2_inv6'} l2_step4 Rb A B Ni gnx {> l2_inv7}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv7I)\n fix s s' :: l2_state fix x\n assume Hi:\"s \\ l2_inv1\" \"s \\ l2_inv7\" \"s \\ l2_inv5\" \"s \\ l2_inv6\" \"s \\ l2_inv6'\"\n assume Ht:\"(s, s') \\ l2_step4 Rb A B Ni gnx\"\n assume Hs:\"x \\ secret s'\"\n from Hs Ht have \"x \\ secret s \\ (Rb = test \\ x = Exp gnx (NonceF (Rb$ny)))\"\n by (auto simp add: l2_defs)\n with Hi Ht \n show \"\\N N' R'. x = Exp (Exp Gen (NonceF (R' $ N'))) (NonceF (test $ N)) \\ R' \\ partners\n \\ (N = nx \\ N = ny) \\ (N' = nx \\ N' = ny)\"\n proof (auto dest: l2_inv7D simp add: l2_defs)\n assume Htest: \"guessed_runs test = \\role = Resp, owner = B, partner = A\\\"\n \"guessed_frame test xgnx = Some gnx\"\n \"guessed_frame test xni = Some Ni\"\n assume \"progress s test = Some {xny, xni, xnr, xgnx, xgny, xsk}\"\n with Htest Hi have Htest': \"guessed_frame test xsk = Some (Exp gnx (NonceF (test $ ny)))\"\n by (auto dest: l2_inv6'D)\n assume \n \"Insec A B (hmac \\Number (Suc 0), Exp Gen (NonceF (test$ny)), gnx, Agent A, Agent B\\\n (Hash \\Ni, NonceF (test $ nr)\\))\n \\ chan s\"\n \"can_signal s A B\"\n with Hi Htest obtain Ra where HRa:\n \"guessed_runs Ra = \\role=Init, owner=A, partner=B\\\"\n \"in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd}\"\n \"gnx = Exp Gen (NonceF (Ra$nx))\"\n \"Ni = NonceF (Ra$ni)\"\n \"guessed_frame Ra xgny = Some (Exp Gen (NonceF (test$ny)))\"\n \"guessed_frame Ra xnr = Some (NonceF (test$nr))\"\n by (auto dest!: auth_guard_step4)\n with Hi \n have \"guessed_frame Ra xsk = Some (Exp (Exp Gen (NonceF (Ra$nx))) (NonceF (test$ny)))\"\n by (auto dest: l2_inv6D)\n with HRa Htest Htest' have \"Ra \\ partners\"\n by (auto simp add: partners_def partner_runs_def, simp add: matching_def)\n with HRa have \"Exp gnx (NonceF (test $ ny)) = \n Exp (Exp Gen (NonceF (Ra $ nx))) (NonceF (test $ ny)) \\ Ra \\ partners\"\n by auto\n then show \"\\N N' R'.\n Exp gnx (NonceF (test $ ny)) \n = Exp (Exp Gen (NonceF (R' $ N'))) (NonceF (test $ N)) \\\n R' \\ partners \\ (N = nx \\ N = ny) \\ (N' = nx \\ N' = ny)\"\n by auto\n qed (auto simp add: can_signal_def)\nqed\n\n\nlemma l2_inv7_trans [iff]:\n \"{l2_inv7 \\ l2_inv1 \\ l2_inv4 \\ l2_inv5 \\ l2_inv6 \\ l2_inv6'} trans l2 {> l2_inv7}\"\napply (auto simp add: l2_nostep_defs intro!: l2_inv7_step3 l2_inv7_step4)\napply (auto simp add: PO_hoare_defs intro!: l2_inv7I)\napply (auto simp add: l2_defs dy_fake_chan_def dest: l2_inv7D)\ndone\n\nlemma PO_l2_inv7 [iff]: \"reach l2 \\ l2_inv7\"\nby (rule_tac J=\"l2_inv1 \\ l2_inv4 \\ l2_inv5 \\ l2_inv6 \\ l2_inv6'\" in inv_rule_incr) (auto)\n\n\ntext \\auxiliary dest rule for inv7\\\nlemma Exp_Exp_Gen_synth: \n\"Exp (Exp Gen X) Y \\ synth H \\ Exp (Exp Gen X) Y \\ H \\ X \\ synth H \\ Y \\ synth H\"\nby (erule synth.cases, auto dest: Exp_Exp_Gen_inj2)\n\nlemma l2_inv7_aux:\n \"s \\ l2_inv7 \\\n x \\ secret s \\\n x \\ synth (analz (generators s))\"\napply (auto simp add: analz_generators dest!: l2_inv7D [THEN [2] rev_subsetD])\napply (auto dest!: Exp_Exp_Gen_synth Exp_Exp_Gen_inj2)\ndone\n\n(**************************************************************************************************)\nsubsection \\Refinement\\\n(**************************************************************************************************)\n\ntext \\Mediator function.\\\n\ndefinition\n med12s :: \"l2_obs \\ skl1_obs\"\nwhere\n \"med12s t \\ \\\n ik = ik t,\n secret = secret t,\n progress = progress t,\n signalsInit = signalsInit t,\n signalsResp = signalsResp t,\n signalsInit2 = signalsInit2 t,\n signalsResp2 = signalsResp2 t\n \\\"\n\n\ntext \\Relation between states.\\\ndefinition\n R12s :: \"(skl1_state * l2_state) set\"\nwhere\n \"R12s \\ {(s,s').\n s = med12s s'\n }\"\n\nlemmas R12s_defs = R12s_def med12s_def\n\n\nlemma can_signal_R12 [simp]:\n \"(s1, s2) \\ R12s \\\n can_signal s1 A B \\ can_signal s2 A B\"\nby (auto simp add: can_signal_def R12s_defs)\n\ntext \\Protocol events.\\\n\nlemma l2_step1_refines_step1:\n \"{R12s} skl1_step1 Ra A B, l2_step1 Ra A B {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs skl1_step1_def l2_step1_def)\n\n\n\ntext \\for step3 and 4, we prove the level 1 guard, i.e.,\n \"the future session key is not in @{term \"synth (analz (ik s))\"}\",\n using the fact that inv8 also holds for the future state in which the session key is already in \n @{term \"secret s\"}\\\nlemma l2_step3_refines_step3:\n \"{R12s \\ UNIV \\ (l2_inv1 \\ l2_inv3 \\ l2_inv4 \\ l2_inv6' \\ l2_inv7)} \n skl1_step3 Ra A B Nr gny, l2_step3 Ra A B Nr gny \n {>R12s}\"\nproof (auto simp add: PO_rhoare_defs R12s_defs)\n fix s s'\n assume Hi:\"s \\ l2_inv1\" \"s \\ l2_inv4\" \"s\\ l2_inv6'\"\n assume Ht: \"(s, s') \\ l2_step3 Ra A B Nr gny\"\n assume \"s \\ l2_inv7\" \"s \\ l2_inv3\"\n with Hi Ht l2_inv7_step3 l2_inv3_step3 have Hi':\"s' \\ l2_inv7\" \"s'\\ l2_inv3\"\n by (auto simp add: PO_hoare_defs, blast, blast)\n from Ht have \"Ra = test \\ Exp gny (NonceF (Ra$nx)) \\ secret s'\"\n by (auto simp add: l2_defs)\n with Hi' have \"Ra = test \\ Exp gny (NonceF (Ra$nx)) \\ synth (analz (generators s'))\"\n by (auto dest: l2_inv7_aux)\n with Hi' have G2:\"Ra = test \\ Exp gny (NonceF (Ra$nx)) \\ synth (analz (ik s'))\"\n by (auto dest!: l2_inv3D_aux)\n from Ht Hi have G1:\n \"can_signal s A B \\ (\\ Rb. guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n in_progressS (progress s Rb) {xny, xni, xnr, xgnx, xgny, xsk} \\\n gny = Exp Gen (NonceF (Rb$ny)) \\\n Nr = NonceF (Rb$nr) \\\n guessed_frame Rb xgnx = Some (Exp Gen (NonceF (Ra$nx))) \\\n guessed_frame Rb xni = Some (NonceF (Ra$ni)))\"\n by (auto dest!: auth_guard_step3 simp add: l2_defs)\n with Ht G1 G2 show\n \"(\\ik = ik s, secret = secret s, progress = progress s, \n signalsInit = signalsInit s, signalsResp = signalsResp s,\n signalsInit2 = signalsInit2 s, signalsResp2 = signalsResp2 s\\,\n \\ik = ik s', secret = secret s', progress = progress s',\n signalsInit = signalsInit s', signalsResp = signalsResp s',\n signalsInit2 = signalsInit2 s', signalsResp2 = signalsResp2 s'\\)\n \\ skl1_step3 Ra A B Nr gny\"\n apply (auto simp add: l2_step3_def, auto simp add: skl1_step3_def)\n apply (auto simp add: can_signal_def)\n done\nqed\n\nlemma l2_step4_refines_step4:\n \"{R12s \\ UNIV \\ (l2_inv1 \\ l2_inv3 \\ l2_inv5 \\ l2_inv6 \\ l2_inv6' \\ l2_inv7)} \n skl1_step4 Rb A B Ni gnx, l2_step4 Rb A B Ni gnx\n {>R12s}\"\nproof (auto simp add: PO_rhoare_defs R12s_defs)\n fix s s'\n assume Hi:\"s \\ l2_inv1\" \"s \\ l2_inv5\" \"s \\ l2_inv6\" \"s \\ l2_inv6'\"\n assume Ht: \"(s, s') \\ l2_step4 Rb A B Ni gnx\"\n assume \"s \\ l2_inv7\" \"s \\ l2_inv3\"\n with Hi Ht l2_inv7_step4 l2_inv3_step4 have Hi':\"s' \\ l2_inv7\" \"s' \\ l2_inv3\"\n by (auto simp add: PO_hoare_defs, blast, blast)\n from Ht have \"Rb = test \\ Exp gnx (NonceF (Rb$ny)) \\ secret s'\"\n by (auto simp add: l2_defs)\n with Hi' have \"Rb = test \\ Exp gnx (NonceF (Rb$ny)) \\ synth (analz (generators s'))\"\n by (auto dest: l2_inv7_aux)\n with Hi' have G2:\"Rb = test \\ Exp gnx (NonceF (Rb$ny)) \\ synth (analz (ik s'))\"\n by (auto dest!: l2_inv3D_aux)\n from Ht Hi have G1:\n \"can_signal s A B \\ (\\ Ra. guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \\\n guessed_frame Ra xgnx = Some gnx \\\n guessed_frame Ra xni = Some Ni \\\n guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny))) \\\n guessed_frame Ra xnr = Some (NonceF (Rb$nr)))\"\n by (auto dest!: auth_guard_step4 simp add: l2_defs)\n with Ht G1 G2 show\n \"(\\ik = ik s, secret = secret s, progress = progress s,\n signalsInit = signalsInit s, signalsResp = signalsResp s,\n signalsInit2 = signalsInit2 s, signalsResp2 = signalsResp2 s\\,\n \\ik = ik s', secret = secret s', progress = progress s',\n signalsInit = signalsInit s', signalsResp = signalsResp s',\n signalsInit2 = signalsInit2 s', signalsResp2 = signalsResp2 s'\\)\n \\ skl1_step4 Rb A B Ni gnx\"\n apply (auto simp add: l2_step4_def, auto simp add: skl1_step4_def)\n apply (auto simp add: can_signal_def)\n done\nqed\n\ntext \\attacker events\\\nlemma l2_dy_fake_chan_refines_skip:\n \"{R12s} Id, l2_dy_fake_chan M {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_defs)\n\n\nlemma l2_dy_fake_msg_refines_learn:\n \"{R12s \\ UNIV \\ (l2_inv3 \\ l2_inv7)} l1_learn m, l2_dy_fake_msg m {>R12s}\"\napply (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\napply (drule Fake_insert_dy_fake_msg, erule l2_inv3D [THEN conjunct1])\napply (auto dest!: l2_inv7_aux)\ndone\n\ntext \\compromising events\\\nlemma l2_lkr_others_refines_skip:\n \"{R12s} Id, l2_lkr_others A {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n\nlemma l2_lkr_after_refines_skip:\n \"{R12s} Id, l2_lkr_after A {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n\nlemma l2_skr_refines_learn:\n \"{R12s \\ UNIV \\ (l2_inv2 \\ l2_inv3 \\ l2_inv7)} l1_learn K, l2_skr R K {>R12s}\"\nproof (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n fix s :: l2_state fix x\n assume H:\n \"s \\ l2_inv2\" \"s \\ l2_inv3\"\n \"R \\ partners\" \"R \\ test\" \"in_progress (progress s R) xsk\" \"guessed_frame R xsk = Some K\"\n assume Hx:\"x \\ synth (analz (insert K (ik s)))\"\n assume \"x \\ secret s\" \"s \\ l2_inv7\"\n then obtain R R' N N' where Hx':\"x = Exp (Exp Gen (NonceF (R$N))) (NonceF (R'$N'))\"\n \"R = test \\ R' \\ partners \\ (N=nx \\ N=ny) \\ (N'=nx \\ N'=ny)\"\n by (auto dest!: l2_inv7D subsetD)\n from H have \"s \\ik := insert K (ik s)\\ \\ l2_inv3\"\n by (auto intro: hoare_apply [OF l2_inv3_skr] simp add: l2_defs)\n with Hx have \"x \\ synth (analz (generators (s \\ik := insert K (ik s)\\)))\"\n by (auto dest: l2_inv3D_aux)\n with Hx' show False\n by (auto dest!: Exp_Exp_Gen_synth dest: Exp_Exp_Gen_inj2 simp add: analz_generators)\nqed\n\n\ntext \\Refinement proof.\\\n\nlemmas l2_trans_refines_l1_trans = \n l2_dy_fake_msg_refines_learn l2_dy_fake_chan_refines_skip\n l2_lkr_others_refines_skip l2_lkr_after_refines_skip l2_skr_refines_learn\n l2_step1_refines_step1 l2_step2_refines_step2 l2_step3_refines_step3 l2_step4_refines_step4\n\nlemma l2_refines_init_l1 [iff]:\n \"init l2 \\ R12s `` (init skl1)\"\nby (auto simp add: R12s_defs skl1_defs l2_loc_defs)\n\nlemma l2_refines_trans_l1 [iff]:\n \"{R12s \\ (UNIV \\ (l2_inv1 \\ l2_inv2 \\ l2_inv3 \\ l2_inv4 \\ l2_inv5 \\ \n l2_inv6 \\ l2_inv6' \\ l2_inv7))}\n trans skl1, trans l2\n {> R12s}\"\nby (auto 0 3 simp add: skl1_def l2_def skl1_trans_def l2_trans_def\n intro!: l2_trans_refines_l1_trans)\n\nlemma PO_obs_consistent_R12s [iff]: \n \"obs_consistent R12s med12s skl1 l2\"\nby (auto simp add: obs_consistent_def R12s_def med12s_def l2_defs)\n\nlemma l2_refines_l1 [iff]:\n \"refines \n (R12s \\ \n (reach skl1 \\ (l2_inv1 \\ l2_inv2 \\ l2_inv3 \\ l2_inv4 \\ l2_inv5 \\\n l2_inv6 \\ l2_inv6' \\ l2_inv7)))\n med12s skl1 l2\"\nby (rule Refinement_using_invariants, auto)\n\nlemma l2_implements_l1 [iff]:\n \"implements med12s skl1 l2\"\nby (rule refinement_soundness) (auto)\n\n\nsubsection \\Derived invariants\\\n(**************************************************************************************************)\ntext \\\n We want to prove @{term \"l2_secrecy\"}:\n @{term \"dy_fake_msg (bad s) (ik s) (chan s) \\ secret s = {}\"}\n but by refinement we only get @{term \"l2_partial_secrecy\"}:\n @{term \"synth (analz (ik s)) \\ secret s = {}\"}\n This is fine, since a message in\n @{term \"dy_fake_msg (bad s) (ik s) (chan s)\"} could be added to @{term \"ik s\"},\n and @{term \"l2_partial_secrecy\"} would still hold for this new state.\n\\\n\ndefinition\n l2_partial_secrecy :: \"('a l2_state_scheme) set\"\nwhere\n \"l2_partial_secrecy \\ {s. synth (analz (ik s)) \\ secret s = {}}\"\n\n\nlemma l2_obs_partial_secrecy [iff]: \"oreach l2 \\ l2_partial_secrecy\"\napply (rule external_invariant_translation \n [OF skl1_obs_secrecy _ l2_implements_l1])\napply (auto simp add: med12s_def s0_secrecy_def l2_partial_secrecy_def)\ndone\n\nlemma l2_oreach_dy_fake_msg:\n \"\\ s \\ oreach l2; x \\ dy_fake_msg (bad s) (ik s) (chan s) \\\n \\ s \\ik := insert x (ik s)\\ \\ oreach l2\"\napply (auto simp add: oreach_def, rule, simp_all, \n simp add: l2_def l2_trans_def l2_dy_fake_msg_def)\napply blast\ndone\n\n\ndefinition \n l2_secrecy :: \"('a l2_state_scheme) set\"\nwhere\n \"l2_secrecy \\ {s. dy_fake_msg (bad s) (ik s) (chan s) \\ secret s = {}}\"\n\nlemma l2_obs_secrecy [iff]: \"oreach l2 \\ l2_secrecy\"\napply (auto simp add:l2_secrecy_def)\napply (drule l2_oreach_dy_fake_msg, simp_all)\napply (drule l2_obs_partial_secrecy [THEN [2] rev_subsetD], simp add: l2_partial_secrecy_def)\napply blast\ndone\n\n\nlemma l2_secrecy [iff]: \"reach l2 \\ l2_secrecy\"\nby (rule external_to_internal_invariant [OF l2_obs_secrecy], auto)\n\n\nabbreviation \"l2_iagreement_Init \\ l1_iagreement_Init\"\n\nlemma l2_obs_iagreement_Init [iff]: \"oreach l2 \\ l2_iagreement_Init\"\napply (rule external_invariant_translation \n [OF skl1_obs_iagreement_Init _ l2_implements_l1])\napply (auto simp add: med12s_def l1_iagreement_Init_def)\ndone\n\nlemma l2_iagreement_Init [iff]: \"reach l2 \\ l2_iagreement_Init\"\nby (rule external_to_internal_invariant [OF l2_obs_iagreement_Init], auto)\n\nabbreviation \"l2_iagreement_Resp \\ l1_iagreement_Resp\"\n\nlemma l2_obs_iagreement_Resp [iff]: \"oreach l2 \\ l2_iagreement_Resp\"\napply (rule external_invariant_translation \n [OF skl1_obs_iagreement_Resp _ l2_implements_l1])\napply (auto simp add: med12s_def l1_iagreement_Resp_def)\ndone\n\nlemma l2_iagreement_Resp [iff]: \"reach l2 \\ l2_iagreement_Resp\"\nby (rule external_to_internal_invariant [OF l2_obs_iagreement_Resp], auto)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/sklvl2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.1790382856603702}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__110.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__110 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__110 and some rule r*}\nlemma n_PI_Remote_GetVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__110:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__110:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__110:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__110:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__110:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__110:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__110:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__110:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__110:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__110 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__110:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__110:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__110:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__110:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__110:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__110:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__110:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__110:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__110:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__110:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__110:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__110:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__110:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__110:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__110:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__110:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__110:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__110:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__110:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__110:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__110:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__110:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__110:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__110.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.334589441253186, "lm_q1q2_score": 0.1790382842496358}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__8.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__8 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__8 and some rule r*}\nlemma n_SendInvAckVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan3'') i) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__8 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__8:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.35220179564702847, "lm_q1q2_score": 0.17885225045000092}} {"text": "theory Autoref_Relator_Interface\nimports Main Autoref_Id_Ops Autoref_Fix_Rel\nbegin\n\ndefinition [simp]: \"REL_INTF R I \\ True\"\nlemma REL_INTFI: \"REL_INTF R I\" by simp\n\n\nML {*\n (* Keeping track of relator - interface bindings *)\n signature AUTOREF_RELATOR_INTERFACE = sig\n val mk_intfAPP: term -> term -> term\n\n val declare_rel_intf: thm -> Context.generic -> Context.generic\n val delete_rel_intf: thm -> Context.generic -> Context.generic\n val get_rel_intfs: Proof.context -> thm list\n\n val intf_of_rel: Proof.context -> term -> term\n val list_invented_intf: term -> term list\n val warn_invented_intf: Proof.context -> term -> unit\n\n val itype_of_rule: Proof.context -> thm -> (term * term) option\n\n val setup: theory -> theory\n end\n\n structure Autoref_Relator_Interface :AUTOREF_RELATOR_INTERFACE = struct\n\n structure relator_intf = Named_Thms (\n val name = @{binding autoref_rel_intf}\n val description = \"Relator interface declaration\"\n )\n \n val declare_rel_intf = relator_intf.add_thm\n val delete_rel_intf = relator_intf.del_thm\n val get_rel_intfs = relator_intf.get\n\n fun mk_intfAPP I J = let\n val JT = fastype_of J\n val rT = range_type JT\n in\n Const (@{const_name intfAPP},JT --> @{typ interface} --> rT) $ J $ I\n end\n\n fun intf_of_rel ctxt R = let\n fun dest_ri thm = case Thm.prop_of thm of\n @{mpat \"Trueprop (REL_INTF ?R ?I)\"} => SOME (R,I)\n | _ => NONE\n\n val rel_intfs = relator_intf.get ctxt\n |> map Drule.zero_var_indexes\n |> map_filter dest_ri\n\n val thy = Proof_Context.theory_of ctxt\n\n fun get_ri R = \n find_first (fn (p,_) => Pattern.matches thy (p,R)) rel_intfs\n |> map_option #2\n\n val idx = Term.maxidx_of_term R + 1\n\n fun mk_i_of R T = \n Const (@{const_name i_of_rel}, fastype_of R --> T)$R\n\n fun r @{mpat \"\\?Ra\\?Rf\"} i = mk_intfAPP (r Ra 0) (r Rf (i+1))\n | r R i = (case get_ri R of \n SOME I => I |> Logic.incr_indexes ([], [], idx)\n | NONE => let\n val T = replicate i @{typ interface} ---> @{typ interface}\n in \n case R of\n Free (_,_) => mk_i_of R T\n | Var ((name,idx'),_) => Var ((name,idx+idx'+2),T)\n | _ => mk_i_of R T\n end\n )\n\n in\n r R 0\n |> Term_Subst.zero_var_indexes \n end\n\n fun \n list_invented_intf @{mpat \"i_of_rel ?c\"} = [c] \n | list_invented_intf (f$x) =\n list_invented_intf f @ list_invented_intf x\n | list_invented_intf (Abs (_,_,t)) = list_invented_intf t\n | list_invented_intf _ = []\n\n fun warn_invented_intf ctxt I = case list_invented_intf I of\n [] => ()\n | l => Pretty.block [\n Pretty.str \"No interfaces known for constant(s):\",\n Pretty.brk 1,\n Pretty.block (Pretty.commas (map (Syntax.pretty_term ctxt) l))\n ] |> Pretty.string_of |> warning\n\n fun itype_of_rule ctxt thm = \n case try (Autoref_Fix_Rel.constraint_of_thm ctxt) thm of\n NONE => NONE\n | SOME (_,(f,R)) => let\n val I = intf_of_rel ctxt R\n in\n SOME (f,I)\n end\n\n \n val setup = relator_intf.setup\n end\n*}\nsetup Autoref_Relator_Interface.setup\n\nattribute_setup autoref_rules = {*\n Scan.lift (Args.mode \"overloaded\")\n >> (fn overl => Thm.declaration_attribute (fn thm => fn context => let\n val context = Autoref_Rules.add_thm thm context\n val ctxt = Context.proof_of context\n in\n case Autoref_Relator_Interface.itype_of_rule ctxt thm of\n NONE => (warning \"Strange autoref rule: Could not infer relator\"; context)\n | SOME (c,I) => Autoref_Id_Ops.decl_derived_typing overl c I context\n end\n ))\n*}\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Automatic_Refinement/Tool/Autoref_Relator_Interface.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792046, "lm_q2_score": 0.3522017820478896, "lm_q1q2_score": 0.1788522435441969}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__126.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__126 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__126 and some rule r*}\nlemma n_PI_Remote_GetVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__126:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__126:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__126:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__126:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__126:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__126:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__126:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__126:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__126:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__126:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__126:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_PutVsinv__126:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__126:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__126:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__126:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__126:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__126:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__126:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__126:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__126:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__126 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__126:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__126:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__126:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__126:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__126:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__126:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__126:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__126:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__126:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__126:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__126:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__126:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__126:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__126:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__126:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__126:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__126:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__126:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__126.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.3522017820478897, "lm_q1q2_score": 0.17885224354419688}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepCode\nimports\n Separation\n \"../hoare-package/Vcg\"\nbegin\n\ndefinition\n singleton_t :: \"'a::c_type ptr \\ 'a \\ heap_state\"\nwhere\n \"singleton_t p v \\ lift_state (heap_update p v (\\x. 0), (ptr_retyp p empty_htd))\"\n\ndefinition\n tagd :: \"'a ptr_guard \\ 'a::c_type ptr \\ heap_assert\" (infix \"\\\\<^sub>s\" 100)\nwhere\n \"g \\\\<^sub>s p \\ \\s. s,g \\\\<^sub>s p \\ dom s = s_footprint p\"\n\ndefinition\n field_footprint :: \"'a::c_type ptr \\ qualified_field_name \\ (addr \\ s_heap_index) set\"\nwhere\n \"field_footprint p f \\ s_footprint_untyped (ptr_val p + of_nat (field_offset TYPE('a) f)) (export_uinfo (field_typ TYPE('a) f))\"\n\ndefinition\n fs_footprint :: \"'a::c_type ptr \\ qualified_field_name set \\ (addr \\ s_heap_index) set\"\nwhere\n \"fs_footprint p F \\ \\{field_footprint p f | f. f \\ F}\"\n\ndefinition fields :: \"'a::c_type itself \\ qualified_field_name set\" where\n \"fields t \\ {f. field_lookup (typ_info_t TYPE('a)) f 0 \\ None}\"\n\ndefinition\n mfs_sep_map :: \"'a::c_type ptr \\ 'a ptr_guard \\ qualified_field_name set \\ 'a \\ heap_assert\"\n (\"_ \\\\<^bsub>_\\<^esub>\\<^bsup>_\\<^esup> _\" [56,0,0,51] 56)\nwhere\n \"p \\\\<^bsub>g\\<^esub>\\<^bsup>F\\<^esup> v \\ \\s. lift_typ_heap g (singleton_t p v ++ s) p = Some v \\\n F \\ fields TYPE('a) \\\n dom s = s_footprint p - fs_footprint p F \\ wf_heap_val s\"\n\n(*XXX: 0,1000 or 1000,1000?*)\nnotation (input)\n mfs_sep_map (\"_ \\\\<^sub>_\\<^sup>_ _\" [56,0,1000,51] 56)\n\ndefinition\n disjoint_fn :: \"qualified_field_name \\ qualified_field_name set \\ bool\"\nwhere\n \"disjoint_fn f F \\ \\f'\\F. \\ f \\ f' \\ \\ f' \\ f\"\n\ndefinition\n sep_cut' :: \"addr \\ nat \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut' p n \\ \\s. dom s = {(x,y). x \\ {p..+n}}\"\n\ndefinition\n sep_cut :: \"addr \\ 32 word \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut x y \\ sep_cut' x (unat y)\"\n\ntext {* ---- *}\n\n(* FIXME MOVE *)\nlemma heap_list_h_eq:\n \"\\p. \\ x \\ {p..+q}; q < addr_card; heap_list h q p = heap_list h' q p \\\n \\ h x = h' x\"\nproof (induct q)\n case 0 thus ?case by simp\nnext\n case (Suc n) thus ?case by (force dest: intvl_neq_start)\nqed\n\nlemma s_footprint_intvl:\n \"(a, SIndexVal) \\ s_footprint p = (a \\ {ptr_val (p::'a::c_type ptr)..+size_of TYPE('a)})\"\napply(auto simp: s_footprint_def s_footprint_untyped_def)\n apply(rule intvlI)\n apply(simp add: size_of_def)\napply(drule intvlD, clarsimp)\napply(simp add: size_of_def)\napply fast\ndone\n\nlemma singleton_t_dom [simp]:\n \"dom (singleton_t p (v::'a::mem_type)) = s_footprint p\"\napply(auto simp: singleton_t_def lift_state_def s_footprint_intvl split: s_heap_index.splits split_if_asm option.splits)\napply(rule ccontr)\n apply(simp add: ptr_retyp_None)\n prefer 2\n apply(simp add: ptr_retyp_footprint)\n prefer 2\n apply(frule s_footprintD2)\n apply(frule s_footprintD)\n apply(simp add: ptr_retyp_footprint)\napply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(simp add: list_map_eq split: split_if_asm)\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI)\n apply(subst (asm) word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\n apply(simp add: map_le_def)\n apply assumption\napply(simp add: ptr_retyp_None)\ndone\n\nlemma heap_update_merge:\n assumes val: \"d,g \\\\<^sub>t p\"\n shows \"lift_state ((heap_update p (v::'a::mem_type) h),d)\n = lift_state (h,d) ++ singleton p v h d\" (is \"?x = ?y\")\nproof (rule ext, cases)\n fix x\n assume c: \"x \\ dom (singleton p v h d)\"\n with val have \"lift_state ((heap_update_list (ptr_val p)\n (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h),d) x = singleton p v h d x\"\napply(subst (asm) singleton_dom)\n apply fast\napply(cases x)\napply(auto simp: heap_list_update_to_bytes singleton_def lift_state_def\n heap_update_def\n split: option.splits s_heap_index.splits)\ndone\n with c show \"?x x = ?y x\" by (force simp: heap_update_def dest: domD)\nnext\n fix x\n assume nc: \"x \\ dom (singleton p v h d)\"\n with val show \"?x x = ?y x\"\napply -\napply(cases x)\napply(auto simp: lift_state_def heap_update_def map_add_def split: option.splits s_heap_index.splits)\napply(rule heap_update_nmem_same)\napply clarsimp\napply(subgoal_tac \"(a,SIndexVal) \\ dom (singleton p v h d)\")\n apply fast\napply(simp add: singleton_dom)\napply(drule intvlD, clarsimp)\napply(rule s_footprintI2)\napply simp\ndone\nqed\n\nlemma tagd_dom_exc:\n \"(g \\\\<^sub>s p) s \\ dom s = s_footprint p\"\n by (clarsimp simp: tagd_def)\n\nlemma tagd_dom_p_exc:\n \"(g \\\\<^sub>s p) s \\ (ptr_val (p::'a::mem_type ptr),SIndexVal) \\ dom s\"\napply(drule tagd_dom_exc)\napply(clarsimp)\ndone\n\nlemma tagd_g_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* P) s \\ g p\"\n by (drule sep_conjD, force simp: tagd_def elim: s_valid_g)\n\nlemma sep_map_tagd_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) s \\ (g \\\\<^sub>s p) s\"\n by (clarsimp simp: sep_map_def tagd_def lift_typ_heap_s_valid)\n\nlemma sep_map_any_tagd_exc:\n \"(p \\\\<^sub>g -) s \\ (g \\\\<^sub>s (p::'a::mem_type ptr)) s\"\n by (clarsimp dest!: sep_map_anyD_exc, erule sep_map_tagd_exc)\n\nlemma ptr_retyp_tagd_exc:\n \"g (p::'a::mem_type ptr) \\\n (g \\\\<^sub>s p) (lift_state (h, ptr_retyp p empty_htd))\"\napply(simp add: tagd_def ptr_retyp_s_valid lift_state_dom)\napply(auto simp: lift_state_def split: s_heap_index.splits split_if_asm option.splits)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI2, simp)\n apply(subst (asm) ptr_retyp_None)\n apply simp+\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: split_if_asm)\n apply(erule (1) s_footprintI)\n apply(simp add: ptr_retyp_None)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(drule s_footprintD)\n apply simp\napply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: split_if_asm)\n apply(drule s_footprintD2)\n apply simp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans, simp)\n apply simp\napply(drule s_footprintD)\napply simp\ndone\n\nlemma singleton_dom_proj_d [simp]:\n \"(g \\\\<^sub>s p) s \\ dom (singleton p (v::'a::mem_type) h (proj_d s)) = dom s\"\napply(clarsimp simp: tagd_def)\napply(subst singleton_dom)\n apply(simp add: s_valid_def)+\ndone\n\nlemma singleton_d_restrict_eq:\n \"restrict_s d (s_footprint p) = restrict_s d' (s_footprint p)\n \\ singleton p v h d = singleton p (v::'a::mem_type) h d'\"\napply(clarsimp simp: singleton_def)\napply(rule ext)\napply(case_tac \"x \\ s_footprint p\")\n prefer 2 apply simp\napply(case_tac x, clarsimp)\napply(drule_tac x=aa in fun_cong)\napply(auto simp: s_footprint_restrict lift_state_def\n split: s_heap_index.splits split_if_asm option.splits)\n apply(clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"nat\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"nat\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"nat\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"nat\" in fun_cong)\n apply clarsimp\napply(clarsimp simp: restrict_s_def)\napply(drule_tac x=\"nat\" in fun_cong)\napply clarsimp\ndone\n\n\nlemma sep_heap_update'_exc:\n assumes sep: \"(g \\\\<^sub>s p \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d))\"\n shows \"P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\nproof -\n from sep obtain s\\<^sub>0 s\\<^sub>1 where disj: \"s\\<^sub>0 \\ s\\<^sub>1\" and\n merge: \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n l: \"(g \\\\<^sub>s p) s\\<^sub>0\" and r: \"(p \\\\<^sub>g v \\\\<^sup>* P) s\\<^sub>1\" by (force dest: sep_conjD)\n moreover hence \"s\\<^sub>1 \\ singleton p v h (proj_d s\\<^sub>0)\"\napply(clarsimp simp: map_disj_def)\napply fast\ndone\n moreover from l have \"g p\" by (force simp: tagd_def elim: s_valid_g)\n moreover from merge l have \"lift_state (h,d),g \\\\<^sub>s p\"\n by (force simp: tagd_def intro: s_valid_heap_merge_right)\n hence \"d,g \\\\<^sub>t p\" by (simp add: h_t_s_valid)\n moreover from l have \"s\\<^sub>0 ++ singleton p v h (proj_d s\\<^sub>0) = singleton p v h (proj_d s\\<^sub>0)\"\n by (force simp: map_add_dom_eq singleton_dom dest: tagd_dom_exc)\n moreover from l merge have \"s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0) = s\\<^sub>1 ++ s\\<^sub>0 ++ singleton p v h d\"\napply -\napply(clarsimp simp: tagd_def)\napply(rule ext)\napply(case_tac x, clarsimp simp: restrict_map_def)\napply(simp add: s_valid_def)\napply(drule_tac v=v and h=h in singleton_dom)\napply(drule_tac x=\"(aa,ba)\" in fun_cong)\napply(case_tac \"(aa,ba) \\ s_footprint p\")\n apply(subgoal_tac \"(s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0)) (aa, ba) = singleton p v h d (aa, ba)\")\n apply(clarsimp simp: map_add_def s_valid_def split: option.splits)\n apply force\n apply(rule exI, rule sym, assumption)\n apply(clarsimp simp: map_add_def split: option.splits)\n apply(force)\n apply(rule, clarsimp)\n apply force\n apply clarsimp\n apply(clarsimp simp: lift_state_def map_add_def split: option.splits s_heap_index.splits split_if_asm)\n apply(clarsimp simp: singleton_def lift_state_def split: split_if_asm)\n apply(clarsimp simp: singleton_def lift_state_def split: split_if_asm option.splits)\n apply(clarsimp simp: proj_d_def)\napply(auto simp: map_add_def singleton_def split: option.splits)\ndone\n ultimately show ?thesis\napply -\napply(drule sep_implD, drule_tac x=\"singleton p v h (proj_d s\\<^sub>0)\" in spec)\napply clarsimp\napply(subst heap_update_merge)\n apply fast\napply(subst (asm) sep_map_singleton)\n apply(clarsimp simp: tagd_def s_valid_def)\napply clarsimp\ndone\nqed\n\nlemma sep_heap_update_exc:\n \"\\ (p \\\\<^sub>g - \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d)) \\ \\\n P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (force intro: sep_heap_update'_exc dest: sep_map_anyD_exc sep_map_tagd_exc\n elim: sep_conj_impl)\n\nlemma sep_heap_update_global'_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (rule sep_heap_update'_exc, erule sep_conj_sep_conj_sep_impl_sep_conj)\n\nlemma sep_heap_update_global_exc:\n \"(p \\\\<^sub>g - \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fast intro: sep_heap_update_global'_exc sep_conj_impl sep_map_any_tagd_exc)\n\nlemma sep_heap_update_global_exc2:\n \"(p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\napply(rule sep_heap_update_global_exc)\napply(subst sep_map_any_def)\napply(subst sep_conj_exists)\napply fast\ndone\n\nlemma heap_update_mem_same_point [rule_format]:\n \"\\p h h'. q \\ {p..+length v} \\ length v < addr_card \\\n heap_update_list p v h q = v ! unat (q - p)\"\napply(induct_tac v)\n apply simp\napply clarsimp\napply(case_tac \"p=q\")\n apply simp\n apply(subst heap_update_list_same [where k=1, simplified])\n apply simp\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply(drule (1) intvl_neq_start)\n apply simp\napply simp\napply(subgoal_tac \"unat (q - p) = unat (1::32 word) + unat (q - (p + 1))\")\n apply(simp add: unat_1)\napply(subgoal_tac \"q - (p + 1) = (q-p) - 1\")\n apply(simp only:)\napply(subst unat_minus_one)\n apply simp+\n apply(subgoal_tac \"unat (q - p) \\ 0\")\n apply simp\n apply clarsimp\n apply(subst unat_gt_0)\n apply simp+\ndone\n\nlemma heap_update_list_value:\n \"length v < addr_card \\\n heap_update_list p v h q =\n (if q \\ {p..+length v} then v!unat (q-p) else h q)\"\nby (auto simp add: heap_update_nmem_same heap_update_mem_same_point\n split: split_if)\n\nlemma heap_update_list_value':\n \"length xs < addr_card \\\n heap_update_list ptr xs hp x\n = (if unat (x - ptr) < length xs\n then xs ! unat (x - ptr)\n else hp x)\"\napply (simp only: heap_update_list_value addr_card_def card_word)\napply (rule if_cong)\n apply simp_all\napply (rule iffI)\n apply (drule intvlD, clarsimp simp add: unat_of_nat)\napply (simp add: intvl_def unat_arith_simps(4) unat_of_nat split: split_if_asm)\n apply (rule_tac x=\"unat x - unat ptr\" in exI, simp)\napply (rule_tac x=\"unat x + 2^32 - unat ptr\" in exI)\napply (cut_tac x=ptr in unat_lt2p)\napply (simp add: unat_arith_simps unat_of_nat)\ndone\n\nlemma heap_list_h_eq2 [rule_format]:\n \"\\p. (\\x. x \\ {p..+n} \\ h x = h' x) \\\n heap_list h n p = heap_list h' n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(thin_tac \"All ?P\")\n apply(drule_tac x=p in spec)\n apply(erule impE)\n apply(rule intvl_self)\n apply simp+\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply(erule impE)\n apply(rule intvl_plus_sub_Suc)\n apply simp+\ndone\n\nlemma map_td_f_eq':\n \"(f=g) \\ (map_td f t = map_td g t)\"\n \"(f=g) \\ (map_td_struct f st = map_td_struct g st)\"\n \"(f=g) \\ (map_td_list f ts = map_td_list g ts)\"\n \"(f=g) \\ (map_td_pair f x = map_td_pair g x)\"\napply(induct t and st and ts and x)\n apply auto\ndone\n\nlemma map_td_f_eq:\n \"f=g \\ map_td f t = map_td g t\"\n by (erule arg_cong)\n\nlemma sep_map'_lift_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ lift h p = v\"\n by - (frule sep_map'_lift_typ_heapD, simp add: lift_t lift_t_lift)\n\nlemma sep_map_lift_wp_exc:\n \"\\ \\v. (p \\\\<^sub>g v \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P v)) (lift_state (h,d)) \\\n \\ P (lift h (p::'a::mem_type ptr)) (lift_state (h,d))\"\napply clarsimp\napply(subst sep_map'_lift_exc)\n apply(subst sep_map'_def)\n apply(erule sep_conj_impl)\n apply assumption\n apply simp\napply(rule_tac P=\"p \\\\<^sub>g v\" and Q=\"P v\" in sep_conj_impl_same)\napply(erule (2) sep_conj_impl)\ndone\n\n\nlemma sep_map_lift_exc:\n \"((p::'a::mem_type ptr) \\\\<^sub>g -) (lift_state (h,d)) \\\n (p \\\\<^sub>g lift h p) (lift_state (h,d))\"\n by (clarsimp simp: sep_map_any_def)\n (frule sep_map_sep_map'_exc, drule sep_map'_lift_exc, simp)\n\nlemma sep_map'_lift_rev_exc:\n \"\\ lift h p = (v::'a::mem_type); (p \\\\<^sub>g -) (lift_state (h,d)) \\ \\\n (p \\\\<^sub>g v) (lift_state (h,d))\"\n by (clarsimp simp: sep_map'_any_def)\n (frule sep_map'_lift_exc, simp)\n\n(* FIXME: can be made more flexible when generalised separation conjunction\n is added *)\nlemma sep_lift_exists_exc:\n fixes p :: \"'a::mem_type ptr\"\n assumes ex: \"((\\s. \\v. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q) (lift_state (h,d))\"\n shows \"(P (lift h p) \\\\<^sup>* Q) (lift_state (h,d))\"\nproof -\n from ex obtain v where \"((\\s. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q)\n (lift_state (h,d))\"\n by (subst (asm) sep_conj_exists, clarsimp)\n thus ?thesis\n by (force simp: sep_map'_lift_exc sep_conj_ac\n dest: sep_map'_conjE2_exc dest!: sep_conj_conj)\nqed\n\nlemma merge_dom:\n \"x \\ dom s \\ (t ++ s) x = s x\"\n by (force simp: map_add_def)\n\nlemma merge_dom2:\n \"x \\ dom s \\ (t ++ s) x = t x\"\n by (force simp: map_add_def split: option.splits)\n\nlemma fs_footprint_empty [simp]:\n \"fs_footprint p {} = {}\"\n by (auto simp: fs_footprint_def)\n\nlemma fs_footprint_un:\n \"fs_footprint p (insert f F) = fs_footprint p {f} \\ fs_footprint p F\"\n by (auto simp: fs_footprint_def)\n\nlemma proj_d_restrict_map_le:\n \"snd (proj_d (s |` X) x) \\\\<^sub>m snd (proj_d s x)\"\napply(clarsimp simp: map_le_def proj_d_def restrict_map_def\n split: option.splits split_if_asm)\ndone\n\nlemma SIndexVal_conj_setcomp_simp [simp]:\n \"{x. snd x = SIndexVal \\ x \\ s_footprint_untyped p t}\n = {(x,SIndexVal) | x. x \\ {p..+size_td t}}\"\napply(auto simp: s_footprint_untyped_def)\n apply(drule intvlD, clarsimp)\n apply force\napply(erule notE)\napply(erule intvlI)\ndone\n\nlemma heap_list_s_restrict_same [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ X \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\napply(induct_tac n)\n apply(simp add: heap_list_s_def)\napply(clarsimp simp: heap_list_s_def)\napply rule\n apply(simp add: proj_h_def restrict_map_def)\n apply clarsimp\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self)\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply clarsimp\napply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\napply clarsimp\napply(rule intvl_plus_sub_Suc)\napply simp\ndone\n\nlemma heap_list_s_restrict_fs_footprint:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t,n) \\\n heap_list_s (s |` fs_footprint p {f}) (size_td t) &(p\\f)\n = heap_list_s s (size_td t) &((p::'a ptr)\\f)\"\napply(simp add: fs_footprint_def field_footprint_def field_offset_def)\napply(subst heap_list_s_restrict_same)\n apply(clarsimp simp add: s_footprint_untyped_def field_size_def field_lvalue_def field_offset_def field_ti_def)\n apply(drule intvlD, clarsimp)\n apply(simp add: field_typ_def field_typ_untyped_def)\n apply fast\napply simp\ndone\n\nlemma heap_list_proj_h_disj [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 = {} \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>0) n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(clarsimp simp: proj_h_def split: option.splits)\n apply(rule, clarsimp)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self, simp)\n apply clarsimp\n apply(erule disjE)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self, simp)\n apply clarsimp\napply(drule_tac x=\"p+1\" in spec)\n apply(erule impE)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\n apply clarsimp\n apply(rule intvl_plus_sub_Suc)\n apply simp\napply simp\ndone\n\nlemma heap_list_proj_h_sub [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>1) n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(clarsimp simp: proj_h_def split: option.splits)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply force\n apply(rule intvl_self, simp)\napply(drule_tac x=\"p+1\" in spec)\n apply(erule impE)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\n apply clarsimp\n apply(rule intvl_plus_sub_Suc)\n apply simp\napply simp\ndone\n\n\nlemma heap_list_s_map_add_super_update_bs:\n \"\\ {x. (x,SIndexVal) \\ dom s\\<^sub>1} = {p+of_nat k..+z}; k + z \\ n; n < addr_card \\\n \\ heap_list_s (s\\<^sub>0 ++ s\\<^sub>1) n p = super_update_bs (heap_list_s s\\<^sub>1 z (p+of_nat k)) (heap_list_s s\\<^sub>0 n p) k\"\napply(auto simp: super_update_bs_def heap_list_s_def)\napply(subgoal_tac \"heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) (k + z + (n - (k+z))) p =\n take k (heap_list (proj_h s\\<^sub>0) n p) @\n heap_list (proj_h s\\<^sub>1) z (p + of_nat k) @\n drop (k + z) (heap_list (proj_h s\\<^sub>0) n p)\")\n apply simp\napply(subst heap_list_split2)\napply(subst heap_list_split2)\napply simp\napply rule\n apply(subst take_heap_list_le)\n apply simp\n apply(subst heap_list_proj_h_disj)\n apply(insert init_intvl_disj [of k z p])\n apply simp\n apply fast\n apply simp\napply rule\n apply(subst heap_list_proj_h_sub)\n apply fast\n apply simp\napply(subst drop_heap_list_le)\n apply simp\napply simp\napply(subst heap_list_proj_h_disj)\n apply(insert final_intvl_disj [of k z n p])\n apply fast\napply simp\ndone\n\nlemma s_footprint_untyped_dom_SIndexVal:\n \"dom s = s_footprint_untyped p t \\\n {x. (x,SIndexVal) \\ dom s} = {p..+size_td t}\"\napply(clarsimp simp: s_footprint_untyped_def)\napply auto\n apply(erule intvlI)\napply(drule intvlD, force)\ndone\n\nlemma field_ti_s_sub:\n \"field_lookup (export_uinfo (typ_info_t TYPE('b::mem_type))) f 0 = Some (a,b) \\\n s_footprint_untyped &(p\\f) a \\ s_footprint (p::'b ptr)\"\napply(clarsimp simp: field_ti_def s_footprint_def s_footprint_untyped_def split: option.splits)\napply(simp add: field_lvalue_def field_offset_def typ_uinfo_t_def)\napply(rule_tac x=\"b+x\" in exI)\napply simp\napply(simp add: field_offset_untyped_def)\napply(drule td_set_field_lookupD)\napply(frule td_set_offset_size)\napply(drule_tac k=x in typ_slice_td_set)\napply simp\napply(auto simp: prefixeq_def less_eq_list_def)\ndone\n\nlemma wf_heap_val_map_add [simp]:\n \"\\ wf_heap_val s\\<^sub>0; wf_heap_val s\\<^sub>1 \\ \\ wf_heap_val (s\\<^sub>0 ++ s\\<^sub>1)\"\napply(unfold wf_heap_val_def)\napply auto\ndone\n\nlemma of_nat_lt_size_of:\n \"\\ ((of_nat x)::addr) = of_nat y + of_nat z; x < size_of TYPE('a::mem_type);\n y + z < size_of TYPE('a) \\ \\ x = y+z\"\napply(subst (asm) Abs_fnat_homs)\napply(subst (asm) word_unat.norm_eq_iff [symmetric])\napply(simp only: len_of_addr_card)\napply(subst (asm) mod_less)\n apply(erule less_trans)\n apply simp\napply(subst (asm) mod_less)\n apply(erule less_trans)\n apply simp+\ndone\n\nlemma proj_d_map_add:\n \"snd (proj_d s\\<^sub>1 p) n = Some k \\ snd (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p) n = Some k\"\napply(auto simp: proj_d_def split: option.splits)\ndone\n\nlemma proj_d_map_add2:\n \"fst (proj_d s\\<^sub>1 p) \\ fst (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p)\"\napply(auto simp: proj_d_def split: option.splits)\ndone\n\n\nlemma heap_list_s_restrict_disj_same [rule_format]:\n \"\\p. dom s \\ (UNIV - X) = {} \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\napply(induct_tac n)\n apply(simp add: heap_list_s_def)\napply(clarsimp simp: heap_list_s_def)\napply(simp add: proj_h_def restrict_map_def split: option.splits)\napply clarsimp\napply fast\ndone\n\nlemma UNIV_minus_inter:\n \"(X - Y) \\ (X \\ (X - Y) - Z) = X - (Y \\ Z)\"\napply fast\ndone\n\nlemma restrict_un_map:\n \"f |` (X \\ Y) = f |` X |` Y\"\napply(auto simp add: restrict_map_def)\napply(rule ext)\napply auto\noops\n\nlemma sep_map_mfs_sep_map_empty:\n \"(p \\\\<^sub>g (v::'a::mem_type)) = (p \\\\<^sub>g\\<^sup>({}) v)\"\n by (auto simp: sep_map_def mfs_sep_map_def map_add_dom_eq intro!: ext)\n\nlemma fd_cons_double_update:\n \"\\ fd_cons t; length bs = length bs' \\ \\\n update_ti_t t bs (update_ti_t t bs' v) = update_ti_t t bs v\"\napply(simp add: fd_cons_def Let_def fd_cons_double_update_def fd_cons_desc_def)\ndone\n\nlemma fd_cons_update_access:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t (access_ti t v bs) v = v\"\napply(simp add: fd_cons_def Let_def fd_cons_update_access_def fd_cons_desc_def)\ndone\n\nlemma fd_cons_length:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n length (access_ti t v bs) = size_td t\"\napply(simp add: fd_cons_def Let_def fd_cons_desc_def fd_cons_length_def access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_length_p:\n \"fd_cons t \\\n length (access_ti\\<^sub>0 t v) = size_td t\"\napply(simp add: fd_cons_length access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_update_normalise:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t ((norm_desc (field_desc t) (size_td t)) bs) v = update_ti_t t bs v\"\napply(clarsimp simp: fd_cons_def Let_def fd_cons_desc_def)\napply(drule (3) fd_cons_update_normalise)\napply(clarsimp simp: fd_cons_update_normalise_def)\ndone\n\nlemma field_footprint_SIndexVal:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t, n) \\\n {x. (x, SIndexVal) \\ field_footprint (p::'a ptr) f} =\n {ptr_val p + of_nat n..+size_td t}\"\napply(auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def intro: intvlI)\napply(drule intvlD, clarsimp)\ndone\n\nlemma fs_footprint_subset:\n \"F \\ fields TYPE('a::mem_type) \\\n fs_footprint (p::'a ptr) F \\ s_footprint p\"\napply(unfold fs_footprint_def field_footprint_def)\napply(clarsimp simp: fields_def)\napply(drule (1) subsetD)\napply clarsimp\napply(frule field_lookup_export_uinfo_Some)\napply(drule field_ti_s_sub)\napply(unfold field_lvalue_def)\napply(subst (asm) field_lookup_offset_eq)\n apply assumption\napply(clarsimp simp: field_typ_def field_typ_untyped_def)\napply(drule subsetD)\n apply assumption+\ndone\n\nlemma length_heap_list_s [simp]:\n \"length (heap_list_s s n p) = n\"\n by (clarsimp simp: heap_list_s_def)\n\nlemma heap_list_proj_h_restrict [rule_format]:\n \"\\p. {p..+n} \\ {x. (x,SIndexVal) \\ X} \\\n heap_list (proj_h (s |` X)) n p = heap_list (proj_h s) n p\"\napply(induct_tac n)\n apply clarsimp\napply clarsimp\napply rule\n apply(subst proj_h_restrict)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply(drule (1) subsetD)\n apply clarsimp\n apply(rule intvl_self)\n apply simp\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply clarsimp\n apply(subgoal_tac \"x \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_plus_sub_Suc)\n apply simp+\ndone\n\nlemma heap_list_proj_h_lift_state:\n \"{p..+n} \\ {x. fst (d x)} \\\n heap_list (proj_h (lift_state (h,d))) n p = heap_list h n p\"\napply(rule heap_list_h_eq2)\napply(subst proj_h_lift_state)\n apply fast\napply simp\ndone\n\nlemma heap_list_rpbs [rule_format]:\n \"\\p. heap_list (\\x. 0) n p = replicate n 0\"\napply(induct_tac n)\n apply simp\napply simp\ndone\n\nlemma field_access_take_drop:\n \"\\s m n f. field_lookup t f m = Some (s,n) \\ wf_fd t \\\n take (size_td s) (drop (n - m) (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_struct st f m = Some (s,n) \\ wf_fd_struct st \\\n take (size_td s) (drop (n - m) (access_ti_struct st v (replicate (size_td_struct st) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_list ts f m = Some (s,n) \\ wf_fd_list ts \\\n take (size_td s) (drop (n - m) (access_ti_list ts v (replicate (size_td_list ts) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_pair x f m = Some (s,n) \\ wf_fd_pair x \\\n take (size_td s) (drop (n - m) (access_ti_pair x v (replicate (size_td_pair x) 0))) =\n access_ti\\<^sub>0 s v\"\napply(induct t and st and ts and x)\n apply(auto simp: access_ti\\<^sub>0_def)\n apply(thin_tac \"All ?P\")+\n apply(subst (asm) take_all)\n apply(drule wf_fd_cons_structD)\n apply(clarsimp simp: fd_cons_struct_def fd_cons_desc_def fd_cons_length_def)\n apply simp\napply(clarsimp simp: min_def)\napply(drule wf_fd_cons_pairD)\napply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\napply(clarsimp split: option.splits)\n apply(subst drop_all)\n apply clarsimp\n apply(drule field_lookup_offset_le, clarsimp)\n apply(case_tac dt_pair)\n apply(clarsimp simp: fd_cons_length_def)\n apply arith\n apply simp\n apply(rotate_tac -3)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(erule impE)\n apply fast\n apply(drule sym, clarsimp)\n apply(subgoal_tac \"(size_td_pair dt_pair - (n - m)) = 0\")\n apply simp\n apply(case_tac dt_pair, simp)\n apply(drule field_lookup_offset_le, clarsimp)\n apply(case_tac dt_pair, simp)\napply(subgoal_tac \"(size_td s - (size_td_pair dt_pair - (n - m))) = 0\")\n prefer 2\n apply clarsimp\n apply(drule td_set_pair_field_lookup_pairD)\n apply(drule td_set_pair_offset_size_m)\n apply simp\napply simp\napply(drule_tac x=s in spec)\napply(drule_tac x=m in spec)\napply(drule_tac x=n in spec)\napply clarsimp\ndone\n\nlemma field_access_take_dropD:\n \"\\ field_lookup t f 0 = Some (s,n); wf_lf (lf_set t []); wf_desc t \\ \\\n take (size_td s) (drop n (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\napply(insert field_access_take_drop(1) [of t v])\napply clarsimp\napply(drule (1) wf_lf_fdp)\napply(drule (1) wf_fdp_fdD)\napply(drule_tac x=s in spec)\napply(drule_tac x=0 in spec)\napply(drule_tac x=n in spec)\napply simp\napply(erule impE, fast)\napply simp\ndone\n\nlemma singleton_t_field:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t, n) \\\n heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n) = access_ti\\<^sub>0 t v\"\napply(clarsimp simp: heap_list_s_def singleton_def singleton_t_def)\napply(subst heap_list_proj_h_restrict)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(clarsimp simp: fs_footprint_def)\n apply(drule_tac p=p in field_footprint_SIndexVal)\n apply fast\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\napply(subst heap_list_proj_h_lift_state)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac d=empty_htd in ptr_retyp_footprint)\n apply simp\napply(clarsimp simp: access_ti\\<^sub>0_def heap_update_def)\napply(subst heap_list_update_list)\n apply clarsimp\n apply(simp add: size_of_def)\n apply(erule field_lookup_offset_size)\napply(clarsimp simp: to_bytes_def heap_list_rpbs size_of_def)\napply(drule_tac v=v in field_access_take_dropD)\n apply simp+\napply(clarsimp simp: access_ti\\<^sub>0_def)\ndone\n\nlemma field_lookup_fd_consD:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t,n) \\ fd_cons t\"\napply(erule fd_consistentD)\napply simp\ndone\n\nlemma s_valid_map_add:\n \"\\ s,g \\\\<^sub>s p; t,g' \\\\<^sub>s p \\ \\ (s ++ t |` X),g \\\\<^sub>s p\"\napply(auto simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\n apply(clarsimp simp: map_le_def)\n apply(simp add: proj_d_map_add_snd)\n apply(rule, clarsimp+)\n apply(subst proj_d_restrict_map_snd)\n apply simp+\napply(subst proj_d_map_add_fst)\napply(clarsimp split: split_if_asm)\napply(subst proj_d_restrict_map_fst)\n apply simp+\ndone\n\nlemma singleton_t_s_valid:\n \"g p \\ singleton_t p (v::'a::mem_type),g \\\\<^sub>s p\"\napply(simp add: singleton_t_def)\napply(subst h_t_s_valid)\napply(erule ptr_retyp_h_t_valid)\ndone\n\n\nlemma sep_map_mfs_sep_map:\n \"\\ (p \\\\<^sub>g\\<^sup>F v) s; field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type)) (s |` (dom s - fs_footprint p {f}))\"\napply(clarsimp simp: mfs_sep_map_def)\napply(rule conjI)\n defer\n apply(subst fs_footprint_un[where F=F])\n apply(clarsimp simp: fields_def)\n apply fast\napply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\napply(rule, clarsimp)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(subst heap_list_s_map_add_super_update_bs)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(subgoal_tac \"{x. (x, SIndexVal) \\ fs_footprint p {f}} = {ptr_val p + of_nat n..+size_td t}\")\n apply fast\n apply(clarsimp simp: fs_footprint_def)\n apply(erule field_footprint_SIndexVal)\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: size_of_def)\n apply(subst ac_simps)\n apply(rule td_set_offset_size)\n apply(erule td_set_field_lookupD)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"(heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n))\" and bs=\"(heap_list_s (singleton_t p v ++ s) (size_of TYPE('a))\n (ptr_val p))\" and w=undefined\n in fi_fu_consistentD)\n apply simp\n apply(simp add: size_of_def)\n apply simp\n apply simp\n apply(simp add: singleton_t_field)\n apply(clarsimp simp: access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp+\n apply(subst map_add_restrict_sub)\n apply simp\n apply assumption\n apply simp\napply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(erule s_valid_map_add)\n apply(simp add: singleton_t_def)\n apply(fold singleton_t_def)\n apply(rule singleton_t_s_valid)\n apply(rule ptr_retyp_h_t_valid)\n apply fast\napply(subst map_add_restrict_sub)\n apply simp\n apply assumption\napply simp\ndone\n\nlemma disjoint_fn_disjoint:\n \"\\ disjoint_fn f F; F \\ fields TYPE('a::mem_type);\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n fs_footprint (p::'a ptr) F \\ field_footprint p f = {}\"\napply(auto simp: fs_footprint_def)\napply(auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def fields_def)\n apply(drule (1) subsetD, clarsimp)\n apply(drule (1) fa_fu_lookup_disj_interD)\n apply(clarsimp simp: disj_fn_def disjoint_fn_def)\n apply simp+\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\n apply(subgoal_tac \"of_nat n + of_nat x \\ {of_nat n..+size_td t}\")\n apply(subgoal_tac \"of_nat b + of_nat xa \\ {of_nat b..+size_td a}\")\n apply force\n apply(rule intvlI, assumption)+\napply(drule (1) subsetD, clarsimp)\napply(drule (1) fa_fu_lookup_disj_interD)\n apply(clarsimp simp: disj_fn_def disjoint_fn_def)\n apply simp+\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(subgoal_tac \"of_nat n + of_nat x \\ {of_nat n..+size_td t}\")\n apply(subgoal_tac \"of_nat b + of_nat xa \\ {of_nat b..+size_td a}\")\n apply force\n apply(rule intvlI, assumption)+\ndone\n\n\nlemma sep_map_mfs_sep_map2:\n \"\\field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo s = typ_uinfo_t TYPE('b); ((p::'a ptr) \\\\<^sub>g\\<^sup>F v) x\\\n \\ (Ptr &(p\\f) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 s v))::'b::mem_type))\n (x |` field_footprint p f)\"\napply(clarsimp simp: mfs_sep_map_def sep_map_def)\napply rule\n defer\n apply(clarsimp simp: field_footprint_def field_lvalue_def)\n apply(clarsimp simp: s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(rotate_tac -1)\n apply(subst (asm) fs_footprint_def)\n apply(clarsimp simp: field_footprint_def)\n apply(clarsimp simp: s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"fs_footprint p F \\ s_footprint_untyped (ptr_val p + of_nat n) (typ_uinfo_t TYPE('b)) = {}\")\n apply blast\n apply(drule_tac p=p in disjoint_fn_disjoint, assumption+)\n apply(simp add: field_footprint_def field_typ_def field_typ_untyped_def)\n apply simp\n apply(clarsimp simp: fields_def)\napply(subgoal_tac \"field_footprint p f = s_footprint ((Ptr &(p\\f))::'b ptr)\")\n prefer 2\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def typ_uinfo_t_def field_typ_def field_typ_untyped_def)\napply simp\napply(frule lift_typ_heap_mono)\n apply assumption+\napply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\napply(rule, clarsimp)\n apply(subst (asm) heap_list_s_heap_merge_right[where p=\"&(p\\f)\"])\n apply assumption+\napply(erule s_valid_heap_merge_right2)\napply simp\napply(frule_tac p=p in disjoint_fn_disjoint, assumption+)\napply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n prefer 2\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\napply(fastforce simp: fs_footprint_def)\ndone\n\nlemma export_size_of:\n \"export_uinfo t = typ_uinfo_t TYPE('a) \\\n size_of TYPE('a::c_type) = size_td t\"\napply(simp add: size_of_def)\napply(subst typ_uinfo_size [symmetric])\napply(drule sym)\napply simp\ndone\n\nlemma sep_map_field_unfold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F v) = (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type) \\\\<^sup>*\n Ptr (&(p\\f)) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 t v))::'b::mem_type))\"\napply(rule ext)\napply rule\n apply(rule_tac s\\<^sub>0=\"x |` (dom x - fs_footprint p {f})\" and\n s\\<^sub>1=\"x |` fs_footprint p {f}\" in sep_conjI)\n apply(erule (1) sep_map_mfs_sep_map)\n apply(clarsimp simp: fs_footprint_def)\n apply(erule (4) sep_map_mfs_sep_map2)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply clarsimp\napply(drule sep_conjD, clarsimp)\napply(clarsimp simp: mfs_sep_map_def sep_map_def)\napply rule\n apply(subst map_ac_simps)\n apply(subst map_add_com [where h\\<^sub>0=s\\<^sub>1])\n apply(simp add: map_ac_simps)\n apply(subst map_add_assoc)\n apply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\n apply(rule, clarsimp)\n apply(subst heap_list_s_map_add_super_update_bs)\n apply(subst s_footprint_untyped_dom_SIndexVal)\n apply(clarsimp simp: s_footprint_def)\n apply fast\n apply(clarsimp simp: field_lvalue_def)\n apply fast\n apply(drule field_lookup_offset_size)\n apply(drule export_size_of)\n apply(simp add: size_of_def)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s s\\<^sub>1 (size_td (typ_info_t TYPE('b)))\n (ptr_val p + of_nat n)\" and bs=\"(heap_list_s (singleton_t p v ++ s\\<^sub>0) (size_of TYPE('a))\n (ptr_val p))\" and w=undefined in fi_fu_consistentD)\n apply simp+\n apply(simp add: size_of_def)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply simp\n apply(subst fd_cons_update_normalise [symmetric])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(simp add: norm_desc_def)\n apply(drule_tac f=\"access_ti\\<^sub>0 (typ_info_t TYPE('b))\" in arg_cong)\n apply(drule_tac f=\"\\bs. update_ti_t t bs v\" in arg_cong)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(simp add: size_of_def)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subgoal_tac \"export_uinfo (typ_info_t TYPE('b)) = typ_uinfo_t TYPE('b)\")\n prefer 2\n apply(simp add: typ_uinfo_t_def)\n apply simp\n apply(drule sym, simp)\n apply(subst (asm) wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply simp\n apply(drule sym, drule export_size_of)\n apply(simp add: size_of_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(simp add: size_of_def)\n apply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subgoal_tac \"update_ti_t t (norm_desc (field_desc t) (size_td t) (access_ti t v (replicate (size_td t) 0))) v = v\")\n apply(simp add: norm_desc_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_normalise)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n prefer 2\n apply(subst fs_footprint_un)\n apply(subst fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def field_typ_untyped_def)\n apply(drule_tac p=p in disjoint_fn_disjoint)\n apply assumption+\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(clarsimp simp: s_footprint_def)\n apply(fastforce simp: fs_footprint_def field_footprint_def s_footprint_def\n field_typ_def field_typ_untyped_def field_lvalue_def)\n apply(clarsimp simp: fields_def)\napply(clarsimp simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\napply(rule, clarsimp simp: map_le_def)\n apply(subst proj_d_map_add_snd[where t=s\\<^sub>1])\n apply(clarsimp split: split_if_asm)\n apply(frule s_footprintD2)\n apply(drule s_footprintD)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(drule intvlD, clarsimp simp: field_lvalue_def)\n apply(drule_tac x=k in spec)\n apply(clarsimp simp add: size_of_def)\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('b) < addr_card\", simp only:size_of_def)\n apply simp\n apply simp\n apply(simp add: ac_simps)\n apply(rotate_tac -1)\n apply(drule sym)\n apply simp\n apply(drule sym[where s=\"Some s\" for s])\n apply simp\n apply(drule field_lookup_export_uinfo_Some)\n apply(drule td_set_field_lookupD)\n apply(frule_tac k=k in typ_slice_td_set)\n apply simp\n apply simp\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"y=n+k\")\n apply(simp add: prefix_def)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('b) < addr_card\", simp only:size_of_def)\n apply simp\n apply (clarsimp simp: prefix_eq_nth)\n apply(drule_tac f=unat in arg_cong)\n apply(rotate_tac -1)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\", simp only:size_of_def)\n apply simp\n apply(subst (asm) Abs_fnat_hom_add)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(drule td_set_offset_size)\n apply simp\n apply(rule_tac y=\"size_td (typ_info_t TYPE('a))\" in le_less_trans)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\", simp only:size_of_def)\n apply simp\n apply simp\napply(subst proj_d_map_add_fst)\napply(clarsimp split: split_if_asm)\napply(drule s_footprintD, clarsimp)\napply(drule intvlD, clarsimp simp: field_lvalue_def)\napply(fastforce simp: size_of_def ac_simps)\ndone\n\nlemma disjoint_fn_empty [simp]:\n \"disjoint_fn f {}\"\n by (simp add: disjoint_fn_def)\n\nlemma sep_map_field_map':\n \"\\ ((p::'a::mem_type ptr) \\\\<^sub>g v) s; field_lookup (typ_info_t TYPE('a)) f 0\n = Some (d,n); export_uinfo d = typ_uinfo_t TYPE('b);\n guard_mono g g' \\ \\\n ((Ptr (&(p\\f))::'b::mem_type ptr) \\\\<^sub>g' from_bytes (access_ti\\<^sub>0 d v)) s\"\napply(frule sep_map_g)\napply(subst (asm) sep_map_mfs_sep_map_empty)\napply(subst (asm) sep_map_field_unfold)\n apply fast\n apply simp\n apply assumption+\napply(clarsimp simp: sep_map'_def sep_conj_ac)\napply(erule sep_conj_impl)\n apply simp\napply simp\ndone\n\nlemma fd_cons_access_update_p:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n access_ti\\<^sub>0 t (update_ti_t t bs v) = access_ti\\<^sub>0 t (update_ti_t t bs w)\"\napply(simp add: fd_cons_def Let_def fd_cons_access_update_def fd_cons_desc_def access_ti\\<^sub>0_def)\ndone\n\nlemma length_to_bytes_p [simp]:\n \"length (to_bytes_p (v::'a)) = size_of TYPE('a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma inv_p [simp]:\n \"from_bytes (to_bytes_p v) = (v::'a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma singleton_SIndexVal:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n singleton_t p (v::'a::mem_type) (x,SIndexVal) = Some (SValue (to_bytes_p v ! unat (x - ptr_val p)))\"\napply(auto simp: singleton_def singleton_t_def)\napply(auto simp: lift_state_def)\n apply(clarsimp simp: heap_update_def)\n apply(subst heap_update_mem_same_point)\n apply simp\n apply simp\n apply(simp add: to_bytes_p_def heap_list_rpbs)\napply(subst ptr_retyp_d_eq_fst)\napply simp\ndone\n\nlemma access_ti\\<^sub>0:\n \"access_ti s v (replicate (size_td s) 0) = access_ti\\<^sub>0 s v\"\napply(simp add: access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_mem_type [simp]:\n \"fd_cons (typ_info_t TYPE('a::mem_type))\"\napply(rule wf_fd_consD)\napply simp\ndone\n\nlemma norm_tu_rpbs:\n \"wf_fd t \\\n norm_tu (export_uinfo t) (access_ti\\<^sub>0 t v) = access_ti\\<^sub>0 t v\"\napply(subst wf_fd_norm_tuD)\n apply assumption\n apply(subst fd_cons_length_p)\n apply(erule wf_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=v])\n apply(erule wf_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule wf_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule wf_fd_consD)\n apply simp+\ndone\n\nlemma heap_list_s_singleton_t_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v)) (size_td s)\n (ptr_val (p::'a::mem_type ptr) + of_nat n) = (to_bytes_p (w::'b::mem_type))\"\napply(auto simp: singleton_t_def singleton_def)\napply(subst heap_list_s_heap_list_dom)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\napply(simp add: heap_update_def)\napply(subst heap_list_update_list)\n apply simp\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\napply(frule_tac v=\"(update_ti_t s (to_bytes_p w) v)\" in field_access_take_dropD)\n apply simp+\napply(simp add: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def to_bytes_p_def)\napply(simp add: access_ti\\<^sub>0)\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply simp\napply(simp add: typ_uinfo_t_def)\napply(rule norm_tu_rpbs)\napply simp\ndone\n\nlemma field_access_update_nth_disj:\n \"\\m f s n x bs bs'. field_lookup t f m = Some (s,n) \\ x < size_td t \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd t \\ length bs = size_td s \\ length bs' = size_td t \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_struct st f m = Some (s,n) \\ x < size_td_struct st \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_struct st \\length bs = size_td s \\ length bs' = size_td_struct st \\\n access_ti_struct st (update_ti_t s bs v) bs' ! x\n = access_ti_struct st v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_list ts f m = Some (s,n) \\ x < size_td_list ts \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_list ts \\length bs = size_td s \\ length bs' = size_td_list ts \\\n access_ti_list ts (update_ti_t s bs v) bs' ! x\n = access_ti_list ts v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_pair y f m = Some (s,n) \\ x < size_td_pair y \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_pair y \\length bs = size_td s \\ length bs' = size_td_pair y \\\n access_ti_pair y (update_ti_t s bs v) bs' ! x\n = access_ti_pair y v bs' ! x\"\napply(induct t and st and ts and y)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply clarsimp\n prefer 2\n apply clarsimp\napply clarify\napply(clarsimp split: split_if_asm)\napply(clarsimp split: option.splits)\n\n apply(rotate_tac -3)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=n in spec)\n\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"x - size_td_pair dt_pair\" in spec)\n apply(frule field_lookup_fa_fu_rhs_listD)\n apply simp\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"access_ti_pair dt_pair (update_ti_t s bs v) (take (size_td_pair dt_pair) bs') =\n access_ti_pair dt_pair v (take (size_td_pair dt_pair) bs')\")\n prefer 2\n apply (fastforce simp: min_def)\n apply(clarsimp simp: nth_append)\n apply(subgoal_tac \"length\n (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply simp\n prefer 2\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(erule impE)\n apply simp\n apply(case_tac dt_pair, simp+)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"drop (size_td a) bs'\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_offset_size_m)\n apply clarsimp\n apply(erule disjE)\n apply arith\n apply arith\napply(frule field_lookup_fa_fu_rhs_pairD, simp)\n apply assumption\napply(clarsimp simp: fa_fu_ind_def)\napply(subgoal_tac \"length (access_ti_pair dt_pair (update_ti_t s bs v)\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(subgoal_tac \"length (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(clarsimp simp: nth_append)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=n in spec)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply clarsimp\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(clarsimp simp: min_def split: split_if_asm)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\napply(drule wf_fd_cons_pairD)\napply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\ndone\n\nlemma field_access_update_nth_disjD:\n \"\\ field_lookup t f m = Some (s,n); x < size_td t;\n (x < n - m \\ x \\ (n - m) + size_td s); wf_fd t;\n length bs = size_td s; length bs' = size_td t \\ \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\napply(simp add: field_access_update_nth_disj)\ndone\n\nlemma intvl_cut:\n \"\\ (x::addr) \\ {p..+m}; x \\ {p+of_nat k..+n}; m < addr_card \\ \\\n unat (x - p) < k \\ k + n \\ unat (x - p)\"\napply(drule intvlD, clarsimp)\napply(subst unat_of_nat, subst mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\napply(subst (asm) unat_of_nat, subst (asm) mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\napply(rule ccontr)\napply(erule notE)\napply(subgoal_tac \"\\z. ka = k + z\")\n prefer 2\n apply(rule_tac x=\"ka - k\" in exI)\n apply simp\napply clarsimp\napply(simp add: add.assoc [symmetric])\napply(rule intvlI)\napply simp\ndone\n\nlemma singleton_t_mask_out:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n K = (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) \\ \\\n singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a)) |` K =\n singleton_t p v |` K\"\napply(rule ext)\napply simp\napply(auto simp: restrict_map_def)\napply(simp add: singleton_t_def singleton_def)\napply(auto simp: lift_state_def restrict_map_def split: s_heap_index.splits)\napply(simp add: heap_update_def)\napply(simp add: to_bytes_def access_ti\\<^sub>0 heap_list_rpbs size_of_def)\napply(subst heap_update_mem_same_point)\n apply(subst fd_cons_length_p)\n apply simp\n apply(rule ccontr)\n apply(subst (asm) ptr_retyp_None)\n apply(simp add: size_of_def)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(subst heap_update_mem_same_point)\n apply(subst fd_cons_length_p)\n apply simp\n apply(rule ccontr)\n apply(subst (asm) ptr_retyp_None)\n apply(simp add: size_of_def)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(rule field_access_update_nth_disjD)\n apply assumption\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: split_if_asm)\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(simp add: size_of_def)\n apply simp\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: split_if_asm)\n apply(drule_tac k=\"of_nat n\" and n=\"size_td s\" in intvl_cut)\n prefer 2\n apply simp\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(drule intvlD, clarsimp)\n apply(drule export_size_of, simp add: size_of_def)\n apply simp\n apply simp+\n apply(drule export_size_of, simp add: size_of_def)\napply simp\ndone\n\nlemma singleton_t_SIndexTyp:\n \"singleton_t p v (x,SIndexTyp n) = singleton_t p undefined (x,SIndexTyp n)\"\napply(auto simp: singleton_t_def singleton_def restrict_map_def lift_state_def)\ndone\n\nlemma proj_d_singleton_t:\n \"proj_d (singleton_t p (v::'a::mem_type) ++ x) = proj_d (singleton_t p undefined ++ x)\"\napply(rule ext)\napply(auto simp: proj_d_def)\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\napply(rule ext)\napply(auto simp: split: option.splits)\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\napply(subst (asm) singleton_t_SIndexTyp)\napply simp\ndone\n\nlemma from_bytes_heap_list_s_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n dom x = s_footprint p - fs_footprint p F; f \\ F \\ \\\n from_bytes (heap_list_s (singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type)) ++ x) (size_of TYPE('a)) (ptr_val p)) =\n update_ti_t s (to_bytes_p w) (from_bytes (heap_list_s (singleton_t p v ++ x) (size_of TYPE('a)) (ptr_val p)))\"\napply(subst map_add_restrict_UNIV [where X=\"s_footprint_untyped (&(p\\f)) (export_uinfo s)\" and h=\"singleton_t p v\"])\n apply(clarsimp simp: fs_footprint_def field_footprint_def field_lvalue_def)\n apply(thin_tac \"dom x = ?X\")\n apply(clarsimp simp: field_typ_def field_typ_untyped_def)\n apply force\n apply simp\napply(subst heap_list_s_map_add_super_update_bs [where k=n and z=\"size_td s\"])\n apply simp\n apply rule\n apply clarsimp\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(drule s_footprintD)\n apply(rule intvlI)\n apply(drule export_size_of, simp add: size_of_def)\n apply clarsimp\n apply rule\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\n apply(drule intvlD, clarsimp)\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(rule_tac x=k in exI)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\n apply simp\napply(clarsimp simp: from_bytes_def)\napply(frule_tac v=\"(heap_list_s\n (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n s_footprint_untyped &(p\\f) (export_uinfo s))\n (size_td s) (ptr_val p + of_nat n))\" and\n bs=\"(heap_list_s\n (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) ++\n singleton_t p v |`\n s_footprint_untyped &(p\\f) (typ_uinfo_t TYPE('b)) ++\n x)\n (size_of TYPE('a)) (ptr_val p))\" and\n w=undefined in fi_fu_consistentD)\n apply(simp add: size_of_def)+\napply(subst heap_list_s_restrict)\n apply clarsimp\n apply(drule intvlD, clarsimp)\n apply(subst s_footprint_untyped_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(rule_tac x=k in exI)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst heap_list_s_singleton_t_field_update)\n apply assumption+\napply(subst singleton_t_mask_out)\n apply assumption+\n apply simp\napply(subst map_add_restrict_comp_left)\napply simp\ndone\n\nlemma mfs_sep_map_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n); f \\ F;\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (w::'b::mem_type)) v) = (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (u::'b::mem_type)) (v::'a::mem_type))\"\napply(rule ext)\napply(auto simp: mfs_sep_map_def lift_typ_heap_if)\n prefer 2\n apply(subst from_bytes_heap_list_s_update)\n apply assumption+\n apply(subst (asm) from_bytes_heap_list_s_update)\n apply assumption+\n apply(drule_tac f=\"update_ti_t s (to_bytes_p w)\" in arg_cong)\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subst from_bytes_heap_list_s_update)\n apply assumption+\n apply(subst (asm) from_bytes_heap_list_s_update)\n apply assumption+\n apply(drule_tac f=\"update_ti_t s (to_bytes_p u)\" in arg_cong)\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(clarsimp simp: s_valid_def)\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\napply(clarsimp simp: s_valid_def)\napply(subst (asm) proj_d_singleton_t)\napply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\napply simp\ndone\n\nlemma mfs_sep_map_field_update_v:\n \" \\field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n); f \\ F;\n disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\\n \\\n p \\\\<^sub>g\\<^sup>F update_ti_t t (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type) = p \\\\<^sub>g\\<^sup>F v\"\napply(subst mfs_sep_map_field_update [where u=\"from_bytes (access_ti\\<^sub>0 t v)\"])\n apply assumption\n apply simp+\napply(simp add: to_bytes_p_def to_bytes_def from_bytes_def access_ti\\<^sub>0 size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\napply(rotate_tac -1)\napply(drule sym)\napply(simp add: typ_uinfo_t_def)\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(clarsimp simp: norm_bytes_def)\napply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=v])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply simp\ndone\n\nlemma sep_map_field_fold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n f \\ F; disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F (v::'a::mem_type) \\\\<^sup>*\n Ptr &(p\\f) \\\\<^bsub>g'\\<^esub> (w::'b::mem_type))\n = p \\\\<^sub>g\\<^sup>(F - {f}) (update_ti_t t (to_bytes_p w) v)\"\napply(subst sep_map_field_unfold, assumption, assumption+)\napply simp\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp+\n apply(drule export_size_of, simp add: size_of_def)\napply simp\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply (simp add: sep_conj_ac)\napply(subst norm)\n apply simp+\napply(subst mfs_sep_map_field_update_v)\n apply assumption+\n apply fast\n apply simp\n apply assumption+\napply(subgoal_tac \"insert f F = F\")\n apply simp\napply fast\ndone\n\nlemma norm_bytes:\n \"length bs = size_of TYPE('a) \\\n to_bytes_p ((from_bytes bs)::'a) = norm_bytes TYPE('a::mem_type) bs\"\napply(simp add: norm_bytes_def)\napply(subst wf_fd_norm_tuD)\n apply simp\n apply(simp add: size_of_def)\napply(simp add: to_bytes_p_def size_of_def from_bytes_def to_bytes_def access_ti\\<^sub>0_def)\ndone\n\nlemma sep_heap_update_global_super_fl:\n \"\\ (p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d));\n field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (t,n);\n export_uinfo t = (typ_uinfo_t TYPE('a)) \\ \\\n ((p \\\\<^sub>g update_ti_t t (to_bytes_p v) u) \\\\<^sup>* R)\n (lift_state (heap_update (Ptr &(p\\f)) (v::'a::mem_type) h,d))\"\napply(subst sep_map_mfs_sep_map_empty)\napply(subst sep_map_field_unfold [where g'=\"\\x. True\"])\n apply assumption\n apply simp\n apply(simp add: guard_mono_def)\n apply assumption\napply simp\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(simp add: export_size_of)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD, simp)\n apply(simp add: export_size_of)\napply simp\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('a)) = norm_bytes TYPE('a)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(simp add: norm sep_conj_ac)\napply(subst sep_conj_com)\napply(subst sep_conj_assoc)+\napply(rule sep_heap_update_global_exc2 [where u=\"from_bytes (access_ti\\<^sub>0 t u)\"])\napply(simp add: sep_conj_ac)\napply(subst sep_conj_com)\napply(subst sep_map_field_fold)\n apply assumption\n apply simp+\n apply(simp add: guard_mono_def)\n apply assumption\napply simp\napply(subst sep_map_mfs_sep_map_empty [symmetric])\napply(subst fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst norm_bytes)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(simp add: export_size_of)\napply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(rotate_tac -1)\napply(drule sym)\napply simp\napply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=u])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: sep_conj_com)\ndone\n\nlemma sep_cut'_dom:\n \"sep_cut' x y s \\ dom s = {(a,b). a \\ {x..+y}}\"\n by (simp add: sep_cut'_def)\n\nlemma dom_exact_sep_cut':\n \"dom_exact (sep_cut' x y)\"\n by (force intro!: dom_exactI dest!: sep_cut'_dom)\n\nlemma dom_lift_state_dom_s [simp]:\n \"dom (lift_state (h,d)) = dom_s d\"\napply(auto simp: lift_state_def dom_s_def split: s_heap_index.splits split_if_asm option.splits)\napply fast\ndone\n\nlemma dom_ptr_retyp_empty_htd [simp]:\n \"dom (lift_state (h,ptr_retyp (p::'a::mem_type ptr) empty_htd)) = s_footprint p\"\napply simp\ndone\n\nlemma ptr_retyp_sep_cut'_exc:\n fixes p::\"'a::mem_type ptr\"\n assumes sc: \"(sep_cut' (ptr_val p) (size_of TYPE('a)) \\\\<^sup>* P)\n (lift_state (h,d))\" and \"g p\"\n shows \"(g \\\\<^sub>s p \\\\<^sup>* sep_true \\\\<^sup>* P) (lift_state (h,(ptr_retyp p d)))\"\nproof -\n from sc obtain s\\<^sub>0 and s\\<^sub>1 where \"s\\<^sub>0 \\ s\\<^sub>1\" and \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\"\n and \"P s\\<^sub>1\" and d: \"dom s\\<^sub>0 = {(a,b). a \\ {ptr_val p..+size_of TYPE('a)}}\"\n by (fast dest: sep_conjD sep_cut'_dom)\n moreover hence \"lift_state (h, ptr_retyp p d) = s\\<^sub>1 ++\n lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0\"\napply -\napply(rule ext, case_tac \"x \\ dom s\\<^sub>0\")\n apply(case_tac \"x \\ dom s\\<^sub>1\")\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply(subst map_add_com)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply(clarsimp simp: map_add_def split: option.splits)\napply(case_tac x, clarsimp)\napply(clarsimp simp: lift_state_ptr_retyp_d merge_dom2)\ndone\n moreover have \"g p\" by fact\n with d have \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0)\"\napply (auto simp: lift_state_ptr_retyp_restrict sep_conj_ac intro: ptr_retyp_tagd_exc)\napply(rule_tac s\\<^sub>0=\"lift_state (h,d) |` ({(a, b). a \\ {ptr_val p..+size_of TYPE('a)}} - s_footprint p)\" in sep_conjI)\n apply (simp add: sep_conj_ac)\n apply(erule_tac h=h in ptr_retyp_tagd_exc)\n apply(clarsimp simp: map_disj_def)\n apply fast\napply(subst map_add_com[where h\\<^sub>0=\"lift_state (h, ptr_retyp p empty_htd)\"])\n apply (simp add: map_disj_def)\n apply fast\napply(rule ext)\napply(auto simp: map_add_def split: option.splits)\napply(subgoal_tac \"(a,b) \\ s_footprint p\")\n apply(clarsimp simp: restrict_map_def)\napply(subgoal_tac \"s_footprint p = dom (lift_state (h, ptr_retyp p empty_htd) )\")\n apply(simp only:)\n apply fast\napply simp\ndone\nultimately show ?thesis\napply -\napply(subst sep_conj_assoc [symmetric])\napply(rule_tac s\\<^sub>0=\"(lift_state (h,ptr_retyp p d))|`dom s\\<^sub>0\" and s\\<^sub>1=s\\<^sub>1 in\n sep_conjI, auto simp: map_disj_def)\ndone\nqed\n\nlemma sep_cut_dom:\n \"sep_cut x y s \\ dom s = {(a,b). a \\ {x..+unat y}}\"\n by (force simp: sep_cut_def dest: sep_cut'_dom)\n\nlemma sep_cut_0 [simp]:\n \"sep_cut p 0 = \\\"\n apply (rule ext)\n apply (auto simp: sep_cut'_def sep_cut_def sep_emp_def None_com split_def)\n done\n\nlemma heap_merge_restrict_dom_un:\n \"dom s = P \\ Q \\ (s|`P) ++ (s|`Q) = s\"\n by (force simp: map_add_def restrict_map_def intro: ext split: option.splits)\n\nlemma sep_cut_split:\n assumes sc: \"sep_cut p y s\" and le: \"x \\ y\"\n shows \"(sep_cut p x \\\\<^sup>* sep_cut (p + x) (y - x)) s\"\nproof (rule_tac s\\<^sub>0=\"s|`{(a,b). a \\ {p..+unat x}}\" and s\\<^sub>1=\"s|`({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n in sep_conjI)\n from sc le show \"sep_cut p x (s |` {(a,b). a \\ {p..+unat x}})\"\n by (force simp: sep_cut_def sep_cut'_def word_le_nat_alt\n dest: intvl_start_le)\nnext\n from sc le show \"sep_cut (p + x) (y - x) (s |` ({(a,b). a \\ {p..+unat y}} -\n {(a,b). a \\ {p..+unat x}}))\"\n by (force simp: sep_cut_def sep_cut'_def intvl_sub_eq)\nnext\n show \"s |` {(a,b). a \\ {p..+unat x}} \\ s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n by (force simp: map_disj_def)\nnext\n from sc le show \"s = s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}) ++ s |` {(a,b). a \\ {p..+unat x}}\"\n by (simp add: sep_cut_def sep_cut'_def, subst heap_merge_restrict_dom_un)\n (auto simp: word_le_nat_alt dest: intvl_start_le)\nqed\n\nlemma tagd_ptr_safe_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h,d)) \\ ptr_safe p d\"\napply(clarsimp simp: ptr_safe_def sep_conj_ac sep_conj_def, drule tagd_dom_exc)\napply(drule_tac x=\"(a,b)\" in fun_cong)\napply(auto simp: map_ac_simps lift_state_def sep_conj_ac split: option.splits s_heap_index.splits split_if_asm)\n apply(clarsimp simp: dom_s_def sep_conj_ac)\n apply(subst (asm) merge_dom)\n apply fast\n apply force\n apply(subst (asm) merge_dom)\n apply fast\n apply force\napply(clarsimp simp: dom_s_def)\ndone\n\nlemma sep_map'_ptr_safe_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ ptr_safe p d\"\n by (force simp: sep_map'_def intro: sep_conj_impl tagd_ptr_safe_exc\n dest: sep_map_tagd_exc)\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/umm_heap/SepCode.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3415825128436339, "lm_q1q2_score": 0.17879123806316125}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__27.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__27 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__27 and some rule r*}\nlemma n_SendInv__part__0Vsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__27 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__27:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__27 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__27.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3415825061409754, "lm_q1q2_score": 0.1787912345548534}} {"text": "(* Title: JinjaDCI/BV/TF_JVM.thy\n\n Author: Tobias Nipkow, Gerwin Klein, Susannah Mansky\n Copyright 2000 TUM, 2019-20 UIUC\n\n Based on the Jinja theory BV/TF_JVM.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\ The Typing Framework for the JVM \\label{sec:JVM} \\\n\ntheory TF_JVM\nimports \"../DFA/Typing_Framework_err\" EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ ex_table \\ instr list \\ ty\\<^sub>i' err step_type\"\nwhere \n \"exec G maxs rT et bs \\\n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc (size bs) et) \n (\\pc. eff (bs!pc) G pc et)\"\n\nlocale JVM_sl =\n fixes P :: jvm_prog and mxs and mxl\\<^sub>0\n fixes b and Ts :: \"ty list\" and \"is\" and xt and T\\<^sub>r\n\n fixes mxl and A and r and f and app and eff and step\n defines [simp]: \"mxl \\ (case b of Static \\ 0 | NonStatic \\ 1)+size Ts+mxl\\<^sub>0\"\n defines [simp]: \"A \\ states P mxs mxl\"\n defines [simp]: \"r \\ JVM_SemiType.le P mxs mxl\"\n defines [simp]: \"f \\ JVM_SemiType.sup P mxs mxl\"\n\n defines [simp]: \"app \\ \\pc. Effect.app (is!pc) P mxs T\\<^sub>r pc (size is) xt\"\n defines [simp]: \"eff \\ \\pc. Effect.eff (is!pc) P pc xt\"\n defines [simp]: \"step \\ err_step (size is) app eff\"\n\n\nlocale start_context = JVM_sl +\n fixes p and C\n assumes wf: \"wf_prog p P\"\n assumes C: \"is_class P C\"\n assumes Ts: \"set Ts \\ types P\"\n\n fixes first :: ty\\<^sub>i' and start\n defines [simp]: \n \"first \\ Some ([],(case b of Static \\ [] | NonStatic \\ [OK (Class C)]) @ map OK Ts @ replicate mxl\\<^sub>0 Err)\"\n defines [simp]:\n \"start \\ (OK first) # replicate (size is - 1) (OK None)\"\n\n\n\nsubsection \\ Connecting JVM and Framework \\\n\n\nlemma (in JVM_sl) step_def_exec: \"step \\ exec P mxs T\\<^sub>r xt is\" \n by (simp add: exec_def) \n\nlemma special_ex_swap_\n\nlemma ex_in_list [iff]:\n \"(\\n. ST \\ list n A \\ n \\ mxs) = (set ST \\ A \\ size ST \\ mxs)\"\n by (unfold list_def) auto\n\nlemma singleton_list: \n \"(\\n. [Class C] \\ list n (types P) \\ n \\ mxs) = (is_class P C \\ 0 < mxs)\"\n by auto\n\nlemma set_drop_subset:\n \"set xs \\ A \\ set (drop n xs) \\ A\"\n by (auto dest: in_set_dropD)\n\nlemma Suc_minus_minus_le:\n \"n < mxs \\ Suc (n - (n - b)) \\ mxs\"\n by arith\n\nlemma in_listE:\n \"\\ xs \\ list n A; \\size xs = n; set xs \\ A\\ \\ P \\ \\ P\"\n by (unfold list_def) blast\n\ndeclare is_relevant_entry_def [simp]\ndeclare set_drop_subset [simp]\n\ntheorem (in start_context) exec_pres_type:\n \"pres_type step (size is) A\"\n(*<*)\n apply (insert wf)\n apply simp\n apply (unfold JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (rename_tac s pc pc' s')\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def relevant_entries_def)\n apply (case_tac \"is!pc\")\n\n \\ \\Load\\\n apply clarsimp\n apply (frule listE_nth_in, assumption)\n apply fastforce\n\n \\ \\Store\\\n apply fastforce\n\n \\ \\Push\\\n apply (fastforce simp add: typeof_lit_is_type)\n\n \\ \\New\\\n apply fastforce\n\n \\ \\Getfield\\\n apply (fastforce dest: sees_field_is_type)\n\n \\ \\Getstatic\\\n apply (fastforce dest: sees_field_is_type)\n\n \\ \\Putfield\\\n apply fastforce\n\n \\ \\Putstatic\\\n apply fastforce\n\n \\ \\Checkcast\\\n apply fastforce\n\n defer defer \\ \\Invoke and Invokestatic deferred\\\n \n \\ \\Return\\\n apply fastforce\n\n \\ \\Pop\\\n apply fastforce\n\n \\ \\IAdd\\\n apply fastforce\n \n \\ \\Goto\\\n apply fastforce\n\n \\ \\CmpEq\\\n apply fastforce\n\n \\ \\IfFalse\\\n apply fastforce\n\n \\ \\Throw\\\n apply fastforce\n\n \\ \\Invoke\\\n apply (clarsimp split!: if_splits)\n apply fastforce\n apply (erule disjE)\n prefer 2\n apply fastforce\n apply clarsimp\n apply (rule conjI)\n apply (drule (1) sees_wf_mdecl)\n apply (clarsimp simp add: wf_mdecl_def)\n apply arith\n\n \\ \\Invokestatic\\\n apply (clarsimp split!: if_splits)\n apply (erule disjE)\n prefer 2\n apply fastforce\n apply clarsimp\n apply (drule (1) sees_wf_mdecl)\n apply (clarsimp simp add: wf_mdecl_def)\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\ndeclare set_drop_subset [simp del]\n\nlemma lesubstep_type_simple:\n \"xs [\\\\<^bsub>Product.le (=) r\\<^esub>] ys \\ set xs {\\\\<^bsub>r\\<^esub>} set ys\"\n(*<*)\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\n\n\nlemma conjI2: \"\\ A; A \\ B \\ \\ A \\ B\" by blast\n \nlemma (in JVM_sl) eff_mono:\n \"\\wf_prog p P; pc < length is; s \\\\<^bsub>sup_state_opt P\\<^esub> t; app pc t\\\n \\ set (eff pc s) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (eff pc t)\"\n(*<*)\n apply simp\n apply (unfold Effect.eff_def) \n apply (cases t)\n apply (simp add: lesub_def)\n apply (rename_tac a)\n apply (cases s)\n apply simp\n apply (rename_tac b)\n apply simp\n apply (rule lesubstep_union)\n prefer 2\n apply (rule lesubstep_type_simple)\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply (simp add: split_beta)\n apply (simp add: split_beta)\n apply (simp add: lesub_def fun_of_def)\n apply (case_tac a)\n apply (case_tac b)\n apply simp \n apply (subgoal_tac \"size ab = size aa\")\n prefer 2\n apply (clarsimp simp add: list_all2_lengthD)\n apply simp\n apply (clarsimp simp add: norm_eff_def lesubstep_type_def lesub_def iff del: sup_state_conv)\n apply (rule exI)\n apply (rule conjI2)\n apply (rule imageI)\n apply (clarsimp simp add: Effect.app_def iff del: sup_state_conv)\n apply (drule (2) succs_mono)\n apply blast\n apply simp\n apply (erule eff\\<^sub>i_mono)\n apply simp\n apply assumption \n apply clarsimp\n apply clarsimp \n done\n(*>*)\n\nlemma (in JVM_sl) bounded_step: \"bounded step (size is)\"\n(*<*)\n apply simp\n apply (unfold bounded_def err_step_def Effect.app_def Effect.eff_def)\n apply (auto simp add: error_def map_snd_def split: err.splits option.splits)\n done\n(*>*)\n\ntheorem (in JVM_sl) step_mono:\n \"wf_prog wf_mb P \\ mono r step (size is) A\"\n(*<*)\n apply (simp add: JVM_le_Err_conv) \n apply (insert bounded_step)\n apply (unfold JVM_states_unfold)\n apply (rule mono_lift)\n apply blast\n apply (unfold app_mono_def lesub_def)\n apply clarsimp\n apply (erule (2) app_mono)\n apply simp\n apply clarify\n apply (drule eff_mono)\n apply (auto simp add: lesub_def)\n done\n(*>*)\n\n\nlemma (in start_context) first_in_A [iff]: \"OK first \\ A\"\n using Ts C by (cases b; force intro!: list_appendI simp add: JVM_states_unfold)\n\n\nlemma (in JVM_sl) wt_method_def2:\n \"wt_method P C' b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s =\n (is \\ [] \\ \n size \\s = size is \\\n OK ` set \\s \\ states P mxs mxl \\\n wt_start P C' b Ts mxl\\<^sub>0 \\s \\ \n wt_app_eff (sup_state_opt P) app eff \\s)\"\n(*<*)\n apply (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def check_types_def)\n apply auto\n done\n(*>*)\n\n\nend\n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/BV/TF_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073507867328, "lm_q2_score": 0.32423540551084407, "lm_q1q2_score": 0.1785263976595879}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__18.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__18 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__18 and some rule r*}\nlemma n_PI_Remote_GetVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__18:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__18:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__18:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__18:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__18:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__18:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__18:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__18:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__18:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__18 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__18:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__18:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__18:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__18:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__18:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__18:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__18:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__18:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__18:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__18:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__18:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__18:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__18:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__18:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__18:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__18:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__18:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__18:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__18:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__18:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__18:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__18.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.33111974622959367, "lm_q1q2_score": 0.178467987256115}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__22.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__22 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__22 and some rule r*}\nlemma n_SendInv__part__0Vsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__22:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__22 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__22:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__22:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__22.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.33111973962899144, "lm_q1q2_score": 0.17846798369850117}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference\nimports\n Noninterference_Base\n Noninterference_Base_Alternatives\n ArchScheduler_IF\n ArchADT_IF\n Access.ArchADT_AC\nbegin\n\ntext \\\n\nThe top-level information flow theorems. (There are also theories for\nexample systems, which go on top of this one.)\n\nWe will instantiate the various unwinding systems, defined in\nNoninterference_Base(_Alternative), with the actual kernel automaton\nfrom ADT_IF. Then we consider the @{term noninterference_system.Nonleakage}\nand @{term noninterference_system.Noninterference} properties over\nour kernel big steps.\n\nAt the end of this file, we show the top-level Nonleakage theorem.\nThe Noninterference property does not hold on the kernel and is not\nproven despite the name of the file, but a partial integrity result\nholds in integrity_part.\n\n\\\n\nsection \\sameFor : unwinding relation\\\n\ndatatype 'a partition = Partition 'a | PSched\n\nfun scheduler_modes where\n \"scheduler_modes KernelPreempted = True\"\n| \"scheduler_modes (KernelEntry Interrupt) = True\"\n| \"scheduler_modes (KernelSchedule b) = b\"\n| \"scheduler_modes _ = False\"\n\n(*Modes where thread context is valid*)\nfun user_modes where\n \"user_modes KernelExit = False\"\n| \"user_modes _ = True\"\n\ndefinition sameFor_subject ::\n \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ 'a \\ (observable_if \\ observable_if) set\" where\n \"sameFor_subject g ab irqab asidab domainab l \\\n {(os,os') | os os' s s'.\n s = internal_state_if os \\ s' = internal_state_if os' \\\n states_equiv_for (\\x. ab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. irqab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. asidab x \\ subjectReads g (OrdinaryLabel l))\n (\\x. domainab x \\ subjectReads g (OrdinaryLabel l) \\ {}) s s' \\\n ((domainab (cur_domain s) \\ subjectReads g (OrdinaryLabel l) \\ {} \\\n domainab (cur_domain s') \\ subjectReads g (OrdinaryLabel l) \\ {})\n \\ (cur_domain s = cur_domain s' \\ globals_equiv s s' \\\n scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\ user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\ equiv_for (\\x. ab x = SilcLabel) kheap s s'))}\"\n\ndefinition sameFor_scheduler ::\n \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ (observable_if \\ observable_if) set\" where\n \"sameFor_scheduler g ab irqab asidab domainab \\\n {(os,os') | os os' s s'.\n s = internal_state_if os \\ s' = internal_state_if os' \\ domain_fields_equiv s s' \\\n idle_thread s = idle_thread s' \\ globals_equiv_scheduler s s' \\\n equiv_for (\\x. ab x = SilcLabel) kheap s s' \\ irq_state_of_state s = irq_state_of_state s' \\\n scheduler_modes (sys_mode_of os) = scheduler_modes (sys_mode_of os') \\\n interrupted_modes (sys_mode_of os) = interrupted_modes (sys_mode_of os')}\"\n\ntext \\\n From the graph we define an equivalence relation on states for each partition.\n\n This is the unwinding relation of domain d with the right parameters (cf uwr later in this file)\n\\\ndefinition sameFor ::\n \"'a subject_label auth_graph \\ 'a subject_label agent_map \\\n 'a subject_label agent_irq_map \\ 'a subject_label agent_asid_map \\\n 'a subject_label agent_domain_map \\ 'a partition \\ (observable_if \\ observable_if) set\" where\n \"sameFor g ab irqab asidab domainab d \\\n case d of Partition l \\ sameFor_subject g ab irqab asidab domainab l\n | PSched \\ sameFor_scheduler g ab irqab asidab domainab\"\n\nabbreviation same_for where\n \"same_for aag d \\ sameFor (pasPolicy aag) (pasObjectAbs aag) (pasIRQAbs aag)\n (pasASIDAbs aag) (pasDomainAbs aag) d\"\n\ntext \\\n We want @{term sameFor} to be an equivalence relation always.\n\\\nlemma sameFor_refl: \"refl (sameFor g ab irqab asidab domainab d)\"\n by (auto intro!: refl_onI equiv_for_refl\n simp: sameFor_def sameFor_subject_def sameFor_scheduler_def domain_fields_equiv_def\n split: partition.splits\n intro: states_equiv_for_refl globals_equiv_refl globals_equiv_scheduler_refl)\n\nlemma domain_fields_equiv_sym:\n \"domain_fields_equiv s t \\ domain_fields_equiv t s\"\n by (clarsimp simp: domain_fields_equiv_def)\n\nlemma sameFor_sym:\n \"sym (sameFor g ab irqab asidab domainab d)\"\n by (fastforce intro: symI\n simp: sameFor_def sameFor_subject_def sameFor_scheduler_def\n split: partition.splits\n intro: states_equiv_for_sym globals_equiv_sym equiv_for_sym domain_fields_equiv_sym)\n\nlemma domain_fields_equiv_trans:\n \"\\ domain_fields_equiv s t; domain_fields_equiv t u \\\n \\ domain_fields_equiv s u\"\n by (clarsimp simp: domain_fields_equiv_def)\n\nlemma sameFor_trans:\n \"trans (sameFor g ab irqab asidab domainab d)\"\n apply (rule transI)\n apply (auto simp: sameFor_def sameFor_subject_def sameFor_scheduler_def\n split: partition.splits\n intro: states_equiv_for_trans globals_equiv_trans\n equiv_for_trans domain_fields_equiv_trans)\n done\n\nfun label_of where\n \"label_of (OrdinaryLabel l) = l\"\n\nlemma is_label[simp]:\n \"x \\ SilcLabel \\ OrdinaryLabel (label_of x) = x\"\n by (case_tac x, auto)\n\nlemma pasSubject_not_SilcLabel:\n \"silc_inv aag s s' \\ pasSubject aag \\ SilcLabel\"\n by (auto simp: silc_inv_def)\n\n(* needs silc_inv to ensure pasSubject is not SilcLabel *)\nlemma sameFor_reads_equiv_f_g:\n \"\\ reads_equiv_f_g aag s s'; silc_inv aag st' st'';\n pasSubject aag \\ pasDomainAbs aag (cur_domain s) \\ pasDomainAbs aag (cur_domain s') \\\n \\ (((uc,s),mode),((uc,s'),mode)) \\ same_for aag (Partition (label_of (pasSubject aag)))\"\n apply (clarsimp simp: reads_equiv_f_g_def reads_equiv_def2 sameFor_def silc_dom_equiv_def)\n apply (simp add: sameFor_subject_def)\n apply (frule pasSubject_not_SilcLabel)\n apply (clarsimp)\n done\n\nlemma sameFor_reads_equiv_f_g':\n \"\\ pas_cur_domain aag s \\ pas_cur_domain aag s'; silc_inv aag st s;\n (((uc,s),mode),((uc',s'),mode')) \\ same_for aag (Partition (label_of (pasSubject aag))) \\\n \\ reads_equiv_f_g aag s s'\"\n apply (frule pasSubject_not_SilcLabel)\n apply (auto simp: reads_equiv_f_g_def reads_equiv_def2 sameFor_def\n sameFor_subject_def silc_dom_equiv_def globals_equiv_def)\n done\n\nlemma sameFor_scheduler_equiv:\n \"(s,s') \\ same_for aag PSched\n \\ scheduler_equiv aag (internal_state_if s) (internal_state_if s')\"\n by (clarsimp simp: scheduler_equiv_def sameFor_def sameFor_scheduler_def silc_dom_equiv_def)\n\n\ndefinition label_can_affect_partition where\n \"label_can_affect_partition g k l \\ \\d. d \\ subjectAffects g k \\ d \\ subjectReads g l\"\n\ndefinition partsSubjectAffects where\n \"partsSubjectAffects g l \\\n Partition ` {x. label_can_affect_partition g (OrdinaryLabel l) (OrdinaryLabel x)}\"\n\n\nlemma reads_g_affects_equiv_sameFor:\n \"\\ reads_equiv_f_g aag s s' \\ affects_equiv aag (OrdinaryLabel l) s s';\n pas_cur_domain aag s; silc_inv aag st' st'';\n Partition l \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag)) \\\n \\ (((uc,s),mode),((uc,s'),mode)) \\ same_for aag (Partition l)\"\n apply (clarsimp simp: partsSubjectAffects_def)\n apply (simp add: affects_equiv_def2 sameFor_def sameFor_subject_def)\n apply (frule pasSubject_not_SilcLabel)\n apply (simp add: reads_equiv_f_g_def reads_equiv_def2 silc_dom_equiv_def)\n apply (erule states_equiv_for_guard_imp)\n apply (simp add: aag_can_affect_label_def label_can_affect_partition_def)+\n done\n\nlemma schedule_reads_affects_equiv_sameFor_PSched:\n \"\\ scheduler_equiv aag s s'; scheduler_modes mode = scheduler_modes mode';\n interrupted_modes mode = interrupted_modes mode' \\\n \\ (((uc,s),mode),((uc',s'),mode')) \\ same_for aag PSched\"\n by (simp add: sameFor_def sameFor_scheduler_def scheduler_equiv_def silc_dom_equiv_def)\n\nlemma schedule_reads_affects_equiv_sameFor_PSched':\n \"\\ scheduler_equiv aag (internal_state_if s) (internal_state_if s');\n scheduler_modes (sys_mode_of s) = scheduler_modes (sys_mode_of s');\n interrupted_modes (sys_mode_of s) = interrupted_modes (sys_mode_of s') \\\n \\ (s,s') \\ same_for aag PSched\"\n apply (case_tac s)\n apply (case_tac a)\n apply (case_tac s')\n apply (case_tac ab)\n apply clarsimp\n apply (rule schedule_reads_affects_equiv_sameFor_PSched; simp)\n done\n\nlemma observable_if_cases:\n \"P (s::observable_if) \\ P (((user_context_of s),(internal_state_if s)),sys_mode_of s)\"\n by (case_tac s, case_tac \"fst s\", simp)\n\nlemma sameFor_reads_f_g_affects_equiv:\n \"\\ pas_cur_domain aag (internal_state_if s); silc_inv aag st (internal_state_if s);\n (s,s') \\ same_for aag (Partition (label_of (pasSubject aag)));\n Partition l \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag));\n (s,s') \\ same_for aag (Partition l) \\\n \\ reads_equiv_f_g aag (internal_state_if s) (internal_state_if s') \\\n affects_equiv aag (OrdinaryLabel l) (internal_state_if s) (internal_state_if s')\"\n apply (rule conjI)\n apply (rule sameFor_reads_equiv_f_g')\n apply blast\n apply blast\n apply (rule_tac s=s in observable_if_cases)\n apply (erule_tac s=s' in observable_if_cases)\n apply (simp add: partsSubjectAffects_def)\n apply (frule pasSubject_not_SilcLabel)\n apply clarsimp\n apply (clarsimp simp: affects_equiv_def2 sameFor_def)\n apply (clarsimp simp: sameFor_subject_def[where l=l])\n apply (blast intro: states_equiv_for_guard_imp)\n done\n\nlemma schedule_reads_affects_equiv_sameFor:\n \"\\ scheduler_equiv aag s s'; scheduler_affects_equiv aag (OrdinaryLabel l) s s';\n user_modes mode \\ uc = uc' \\\n \\ (((uc,s),mode),((uc',s'),mode)) \\ same_for aag (Partition l)\"\n by (auto simp: scheduler_equiv_def scheduler_affects_equiv_def sameFor_def sameFor_subject_def\n silc_dom_equiv_def reads_scheduler_def domain_fields_equiv_def\n disjoint_iff_not_equal Bex_def\n intro: globals_equiv_from_scheduler)\n\nlemma globals_equiv_to_scheduler_globals_frame_equiv:\n \"\\ globals_equiv s t; invs s; invs t \\\n \\ scheduler_globals_frame_equiv s t\"\n by (simp add: globals_equiv_def scheduler_globals_frame_equiv_def)\n\nlemma globals_equiv_to_cur_thread_eq:\n \"globals_equiv s t \\ cur_thread s = cur_thread t\"\n by (simp add: globals_equiv_def)\n\nlemma no_subject_affects_PSched:\n \"PSched \\ partsSubjectAffects g l\"\n by (auto simp: partsSubjectAffects_def elim: subjectAffects.cases)\n\n\nsection \\InfoFlow policy and partition integrity\\\n\ntext \\\n We derive a noninterference policy from the authority graph\n We exclude the silc label from the noninterference policy\n since it exists in the authority graph solely to ensure that no actual subject's\n label covers the inter label caps.\n\\\n\ninductive_set policyFlows :: \"'a subject_label auth_graph \\ ('a partition \\ 'a partition) set\"\n for g :: \"'a subject_label auth_graph\" where\n policy_affects: \"d \\ partsSubjectAffects g l \\ (Partition l, d) \\ policyFlows g\"\n| policy_scheduler: \"(PSched,d) \\ policyFlows g\"\n\nlemma no_partition_flows_to_PSched:\n \"(Partition l, PSched) \\ policyFlows g\"\n apply (rule notI)\n apply (erule policyFlows.cases)\n apply (simp_all add: no_subject_affects_PSched)\n done\n\nlemma partsSubjectAffects_bounds_those_subject_not_allowed_to_affect:\n \"(Partition l,d) \\ policyFlows g \\ d \\ partsSubjectAffects g l\"\n apply (clarify)\n apply (drule policy_affects)\n apply (blast)\n done\n\nlemma PSched_flows_to_all:\n \"(PSched,d) \\ policyFlows g\"\n by (rule policyFlows.intros)\n\nlemma policyFlows_refl:\n \"refl (policyFlows g)\"\n apply (rule refl_onI)\n apply simp\n apply (case_tac x)\n apply simp\n apply (rule policy_affects)\n apply (simp add: partsSubjectAffects_def image_def)\n apply (simp add: label_can_affect_partition_def)\n apply (blast intro: affects_lrefl)\n apply (blast intro: PSched_flows_to_all)\n done\n\n\n(* a more constrained integrity property for non-PSched transitions\n TODO: can we constrain this further? *)\ndefinition partitionIntegrity :: \"'a subject_label PAS \\ det_ext state \\ det_ext state \\ bool\"\nwhere\n \"partitionIntegrity aag s s' \\\n integrity (aag\\pasMayActivate := False, pasMayEditReadyQueues := False\\)\n (scheduler_affects_globals_frame s) s s' \\\n domain_fields_equiv s s' \\ idle_thread s = idle_thread s' \\\n globals_equiv_scheduler s s' \\ silc_dom_equiv aag s s'\"\n\n\nlemma thread_set_tcb_context_update_ct_active[wp]:\n \"thread_set (tcb_arch_update (arch_tcb_context_set f)) t \\\\s. P (ct_active s)\\\"\n apply (simp add: thread_set_def ct_in_state_def | wp set_object_wp)+\n apply (clarsimp simp: st_tcb_at_def obj_at_def get_tcb_def\n split: option.splits kernel_object.splits)\n done\n\nlemma prop_of_two_valid:\n assumes f: \"\\P. m \\\\s. P (f s)\\\"\n assumes g: \"\\P. m \\\\s. P (g s)\\\"\n shows \"m \\\\s. P (f s) (g s)\\\"\n by (rule hoare_pre, wps f g, wp, simp)\n\nlemma thread_set_tcb_context_update_wp:\n \"\\\\s. P (s\\kheap := kheap s(t \\ TCB (tcb_arch_update f (the (get_tcb t s))))\\)\\\n thread_set (tcb_arch_update f) t\n \\\\_. P\\\"\n apply (simp add: thread_set_def)\n apply (wp set_object_wp)\n apply simp\n done\n\n\nlemma dmo_device_update_respects_Write:\n \"\\integrity aag X st and K (\\p \\ dom um'. aag_has_auth_to aag Write p)\\\n do_machine_op (device_memory_update um')\n \\\\_. integrity aag X st\\\"\n apply (simp add: device_memory_update_def)\n apply (rule hoare_pre)\n apply (wp dmo_wp)\n apply clarsimp\n apply (simp cong: abstract_state.fold_congs)\n apply (rule integrity_device_state_update)\n apply simp\n apply clarify\n apply (drule (1) bspec)\n apply simp\n apply fastforce\n done\n\nlemma check_active_irq_if_integrity:\n \"check_active_irq_if tc \\integrity aag X st\\\"\n by (wpsimp wp: check_active_irq_if_wp simp: integrity_subjects_def)\n\nlemma silc_dom_equiv_from_silc_inv_valid':\n assumes \"\\st. \\P and silc_inv aag st\\ f \\\\_. silc_inv aag st\\\"\n shows \"\\P and silc_inv aag st and silc_dom_equiv aag sta\\ f \\\\_. silc_dom_equiv aag sta\\\"\n apply (rule hoare_pre)\n apply (rule hoare_strengthen_post)\n apply (rule assms)\n apply (fastforce simp: silc_inv_def)\n (* we can't use clarsimp below because it splits pairs unconditionally *)\n apply (simp add: silc_inv_def silc_dom_equiv_def del: split_paired_All)\n apply (elim conjE)\n apply (intro allI impI notI)\n apply (drule(1) equiv_forD)+\n apply (frule(1) cte_wp_at_pspace'[THEN iffD1])\n apply (drule spec, drule(1) mp, erule notE, erule(1) cte_wp_at_pspace'[THEN iffD2])\n done\n\nlemma ct_running_not_idle:\n \"\\ ct_running s; valid_idle s \\ \\ cur_thread s \\ idle_thread s\"\n by (clarsimp simp add: ct_in_state_def pred_tcb_at_def obj_at_def valid_idle_def)\n\nlemma kernel_entry_if_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and valid_arch_state and invs\n and (\\s. e \\ Interrupt \\ ct_active s)\n and (\\s. ct_idle s \\ tc = idle_context s)\\\n kernel_entry_if e tc\n \\\\_. globals_equiv_scheduler st\\\"\n apply (wp globals_equiv_scheduler_inv' kernel_entry_if_globals_equiv)\n apply (clarsimp)\n apply assumption\n apply clarsimp\n done\n\nlemma domain_fields_equiv_lift:\n assumes a: \"\\P. \\domain_fields P and Q\\ f \\\\_. domain_fields P\\\"\n assumes b: \"\\P. \\(\\s. P (cur_domain s)) and R\\ f \\\\_ s. P (cur_domain s)\\\"\n shows \"\\domain_fields_equiv st and Q and R\\ f \\\\_. domain_fields_equiv st\\\"\n apply (clarsimp simp: valid_def domain_fields_equiv_def)\n apply (erule use_valid, wp a b)\n apply simp\n done\n\nlemma check_active_irq_if_partitionIntegrity:\n \"check_active_irq_if tc \\partitionIntegrity aag st\\\"\n apply (simp add: check_active_irq_if_def)\n apply (wp dmo_getActiveIRQ_wp)\n apply (simp add: partitionIntegrity_def integrity_subjects_def)\n apply (simp add: silc_dom_equiv_def equiv_for_def globals_equiv_scheduler_def)\n apply (fastforce simp: domain_fields_equiv_def)\n done\n\nlemma do_machine_op_globals_equiv_scheduler:\n \"(\\s sa. \\ P sa; globals_equiv_scheduler s sa \\\n \\ \\x \\ fst (f (machine_state sa)).\n globals_equiv_scheduler s (sa\\machine_state := snd x\\))\n \\ \\globals_equiv_scheduler s and P\\\n do_machine_op f\n \\\\_. globals_equiv_scheduler s\\\"\n unfolding do_machine_op_def by (wp | simp add: split_def)+\n\nlemma dmo_user_memory_update_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and\n (invs and (\\s. pl = ptable_lift t s |` {x. pr x \\ {}} \\ pr = ptable_rights t s))\\\n do_machine_op\n (user_memory_update ((ba |` {y. \\x. pl x = Some y \\ AllowWrite \\ pr x} \\ addrFromPPtr) |` S))\n \\\\_. globals_equiv_scheduler st\\\"\n apply (rule do_machine_op_globals_equiv_scheduler)\n apply clarsimp\n apply (erule use_valid)\n apply (simp add: user_memory_update_def)\n apply (wp modify_wp)\n apply (clarsimp simp: globals_equiv_scheduler_def split: option.splits)\n done\n\nlemma dmo_device_memory_update_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and (\\s. device_region s = S)\\\n do_machine_op\n (device_memory_update ((ba |` {y. \\x. pl x = Some y \\ AllowWrite \\ pr x} \\ addrFromPPtr) |` S))\n \\\\_. globals_equiv_scheduler st\\\"\n apply (rule do_machine_op_globals_equiv_scheduler)\n apply clarsimp\n apply (simp add: device_memory_update_def simpler_modify_def)\n apply (clarsimp simp: globals_equiv_scheduler_def split: option.splits)\n done\n\nlemma pas_refined_pasMayActivate_update[simp]:\n \"pas_refined (aag\\pasMayActivate := x, pasMayEditReadyQueues := x\\) s =\n pas_refined (aag :: 'a subject_label PAS) s\"\n apply (simp add: pas_refined_def irq_map_wellformed_aux_def tcb_domain_map_wellformed_aux_def)\n apply (simp add: state_asids_to_policy_pasMayActivate_update[simplified]\n state_irqs_to_policy_pasMayActivate_update\n state_asids_to_policy_pasMayEditReadyQueues_update[simplified]\n state_irqs_to_policy_pasMayEditReadyQueues_update)\n done\n\nlemma activate_thread_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and valid_arch_state and valid_idle\\\n activate_thread\n \\\\_. globals_equiv_scheduler st\\\"\n by (wp globals_equiv_scheduler_inv' activate_thread_globals_equiv | force | fastforce)+\n\nlemma schedule_cur_domain:\n \"\\\\s. P (cur_domain s) \\ domain_time s \\ 0\\\n schedule\n \\\\_ s. P (cur_domain s)\\\"\n (is \"\\?PRE\\ _ \\_\\\")\n supply hoare_pre_cont[where f=next_domain, wp add]\n ethread_get_wp[wp del] if_split[split del] if_cong[cong]\n apply (simp add: schedule_def schedule_choose_new_thread_def | wp | wpc)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (clarsimp split: if_split)\n done\n\nlemma schedule_domain_fields:\n \"\\domain_fields P and (\\s. domain_time s \\ 0)\\\n schedule\n \\\\_. domain_fields P\\\"\n (is \"\\?PRE\\ _ \\_\\\")\n supply hoare_pre_cont[where f=next_domain, wp add]\n ethread_get_wp[wp del] if_split[split del] if_cong[cong]\n apply (simp add: schedule_def schedule_choose_new_thread_def | wp | wpc)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (rule_tac Q=\"\\_. ?PRE\" in hoare_strengthen_post)\n apply (simp | wp gts_wp | wp (once) hoare_drop_imps)+\n apply (clarsimp split: if_split)\n done\n\nlemma schedule_if_partitionIntegrity:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows \"\\partitionIntegrity aag st and guarded_pas_domain aag and pas_cur_domain aag and\n (\\s. domain_time s \\ 0) and silc_inv aag st and einvs and pas_refined aag\\\n schedule_if tc\n \\\\_. partitionIntegrity aag st\\\"\n apply (simp add: schedule_if_def)\n apply (rule_tac Q=\"\\rv s. integrity (aag\\pasMayActivate := False, pasMayEditReadyQueues := False\\)\n (scheduler_affects_globals_frame st) st s \\\n domain_fields_equiv st s \\ idle_thread s = idle_thread st \\\n globals_equiv_scheduler st s \\ silc_dom_equiv aag st s\"\n in hoare_strengthen_post)\n apply (wpsimp wp: activate_thread_integrity activate_thread_globals_equiv_scheduler\n silc_dom_equiv_from_silc_inv_valid'[where P=\"\\\"] schedule_integrity\n hoare_vcg_all_lift domain_fields_equiv_lift[where Q=\"\\\" and R=\"\\\"])\n apply (rule_tac Q=\"\\r s. guarded_pas_domain aag s \\ pas_cur_domain aag s \\\n domain_fields_equiv st s \\ idle_thread s = idle_thread st \\\n globals_equiv_scheduler st s \\ silc_inv aag st s \\\n silc_dom_equiv aag st s \\ invs s\" in hoare_strengthen_post)\n apply (wp schedule_guarded_pas_domain schedule_cur_domain\n silc_dom_equiv_from_silc_inv_valid'[where P=\"\\\" and st=st]\n domain_fields_equiv_lift schedule_cur_domain schedule_domain_fields\n | simp add: silc_inv_def partitionIntegrity_def guarded_pas_domain_def\n invs_valid_idle silc_dom_equiv_def)+\n apply (fastforce simp: equiv_for_refl dest: domains_distinct[THEN pas_domains_distinct_inj])\n apply (fastforce simp: partitionIntegrity_def globals_equiv_scheduler_def)+\n done\n\nlemma partitionIntegrity_integrity:\n \"partitionIntegrity aag s s'\n \\ integrity (aag\\pasMayActivate := False, pasMayEditReadyQueues := False\\)\n (scheduler_affects_globals_frame s) s s'\"\n by (clarsimp simp: partitionIntegrity_def)\n\nlemma receive_blocked_on_eq:\n \"\\ receive_blocked_on ep ts; receive_blocked_on ep' ts \\\n \\ ep = ep'\"\n by (case_tac ts; simp)\n\nlemma receive_blocked_on_eq':\n \"\\ receive_blocked_on ep ts; blocked_on ep' ts \\\n \\ ep = ep'\"\n by (case_tac ts; simp)\n\nlemma receive_blocked_on_contradiction:\n \"\\ receive_blocked_on ep ts; send_blocked_on ep' ts \\\n \\ False\"\n by (case_tac ts; simp)\n\nlemma pas_refined_tcb_st_to_auth:\n \"\\ pas_refined aag s; (ep, auth) \\ tcb_st_to_auth (tcb_state tcb); kheap s p = Some (TCB tcb) \\\n \\ (pasObjectAbs aag p, auth, pasObjectAbs aag ep) \\ pasPolicy aag\"\n apply (rule pas_refined_mem)\n apply (rule_tac s=s in sta_ts)\n apply (simp add: thread_st_auth_def tcb_states_of_state_def get_tcb_def)\n apply assumption\n done\n\n(* FIXME DO _state abreviation for all elements and use them to write rule explicitely *)\n\nlemmas integrity_subjects_obj =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct1]\n\nlemmas integrity_subjects_eobj =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_cdt =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_cdt_list =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_interrupts =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_ready_queues =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_mem =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_device =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct1]\n\nlemmas integrity_subjects_asids =\n integrity_subjects_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2, THEN conjunct2]\n\nlemma pas_wellformed_pasSubject_update_Control:\n \"\\ pas_wellformed (aag\\pasSubject := pasObjectAbs aag p\\);\n (pasObjectAbs aag p, Control, pasObjectAbs aag p') \\ pasPolicy aag \\\n \\ pasObjectAbs aag p = pasObjectAbs aag p'\"\n by (fastforce simp: policy_wellformed_def)\n\nlemma pas_wellformed_noninterference_policy_refl:\n \"\\ pas_wellformed_noninterference aag; pasObjectAbs aag x \\ SilcLabel \\\n \\ (pasObjectAbs aag x, auth, pasObjectAbs aag x) \\ pasPolicy aag\"\n unfolding pas_wellformed_noninterference_def\n by (fastforce intro!:aag_wellformed_refl)\n\nlemma pas_wellformed_noninterference_control_to_eq:\n \"\\ pas_wellformed_noninterference aag;\n (pasObjectAbs aag x, Control, l) \\ pasPolicy aag; pasObjectAbs aag x \\ SilcLabel \\\n \\ pasObjectAbs aag x = l\"\n unfolding pas_wellformed_noninterference_def\n by (erule aag_wellformed_Control; fastforce)\n\n(* FIXME: MOVE *)\nlemma fun_noteqD:\n \"f \\ g \\ \\a. f a \\ g a\"\n by blast\n\n\nlocale Noninterference_1 =\n fixes current_aag :: \"det_state \\ 'a subject_label PAS\"\n and arch_globals_equiv_strengthener :: \"machine_state \\ machine_state \\ bool\"\n assumes do_user_op_if_integrity:\n \"\\invs and integrity aag X st and is_subject aag \\ cur_thread and pas_refined aag\\\n do_user_op_if uop tc\n \\\\_. integrity aag X st\\\"\n and do_user_op_if_globals_equiv_scheduler:\n \"\\globals_equiv_scheduler st and invs\\\n do_user_op_if uop tc\n \\\\_. globals_equiv_scheduler st\\\"\n and do_user_op_if_silc_dom_equiv[wp]:\n \"do_user_op_if uop tc \\silc_dom_equiv (aag :: 'a subject_label PAS) st\\\"\n and sameFor_scheduler_affects_equiv:\n \"\\s s'. \\ (s,s') \\ same_for aag PSched; (s,s') \\ same_for aag (Partition l');\n invs (internal_state_if s); invs (internal_state_if s') \\\n \\ scheduler_equiv aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv aag (OrdinaryLabel l')\n (internal_state_if s) (internal_state_if s')\"\n and do_user_op_if_partitionIntegrity:\n \"\\aag :: 'a subject_label PAS.\n \\partitionIntegrity aag st and pas_refined aag and invs and is_subject aag \\ cur_thread\\\n do_user_op_if uop tc\n \\\\_. partitionIntegrity aag st\\\"\n and arch_activate_idle_thread_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (arch_activate_idle_thread t)\"\n and dmo_storeWord_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (do_machine_op (storeWord ptr w))\"\n and integrity_asids_update_reference_state:\n \"is_subject aag t\n \\ integrity_asids aag {pasSubject aag} x asid s (s\\kheap := kheap s(t \\ blah)\\)\"\n and partitionIntegrity_subjectAffects_aobj:\n \"\\ partitionIntegrity aag s s'; kheap s x = Some (ArchObj ao); kheap s x \\ kheap s' x;\n silc_inv aag st s; pas_refined aag s; pas_wellformed_noninterference aag \\\n \\ subject_can_affect_label_directly aag (pasObjectAbs aag x)\"\n and partitionIntegrity_subjectAffects_asid:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s; valid_objs s; valid_arch_state s;\n valid_arch_state s'; pas_wellformed_noninterference aag; silc_inv aag st s'; invs s';\n \\ equiv_asids (\\x. pasASIDAbs aag x = a) s s'\\\n \\ a \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n and arch_switch_to_thread_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag) (affects_equiv aag l)\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (\\s. is_subject aag t) (arch_switch_to_thread t)\"\n and arch_globals_equiv_strengthener_thread_independent:\n \"arch_globals_equiv_strengthener (machine_state s) (machine_state s')\n \\ \\ct ct' it it'. arch_globals_equiv ct it (kheap s) (kheap s')\n (arch_state s) (arch_state s') (machine_state s) (machine_state s') =\n arch_globals_equiv ct' it' (kheap s) (kheap s')\n (arch_state s) (arch_state s') (machine_state s) (machine_state s')\"\n and ev2_invisible':\n \"\\ pas_domains_distinct aag; labels_are_invisible aag l L; labels_are_invisible aag l L';\n modifies_at_most aag L Q f; modifies_at_most aag L' Q' g;\n doesnt_touch_globals Q f; doesnt_touch_globals Q' g;\n \\st :: det_state. f \\\\s. arch_globals_equiv_strengthener (machine_state st) (machine_state s)\\;\n \\st :: det_state. g \\\\s. arch_globals_equiv_strengthener (machine_state st) (machine_state s)\\;\n \\s t. P s \\ P' t \\ (\\(rva,s') \\ fst (f s). \\(rvb,t') \\ fst (g t). W rva rvb) \\\n \\ equiv_valid_2 (reads_equiv_g aag)\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (W :: unit \\ unit \\ bool) (P and Q) (P' and Q') f g\"\n and arch_switch_to_idle_thread_reads_respects_g[wp]:\n \"reads_respects_g aag l \\ (arch_switch_to_idle_thread)\"\n and arch_globals_equiv_threads_eq:\n \"arch_globals_equiv t' t'' kh kh' as as' ms ms'\n \\ arch_globals_equiv t t kh kh' as as' ms ms'\"\n and arch_globals_equiv_globals_equiv_scheduler[elim]:\n \"arch_globals_equiv (cur_thread s') (idle_thread s) (kheap s) (kheap s')\n (arch_state s) (arch_state s') (machine_state s) (machine_state s')\n \\ arch_globals_equiv_scheduler (kheap s) (kheap s') (arch_state s) (arch_state s')\"\n and getActiveIRQ_ret_no_dmo[wp]:\n \"\\\\\\ getActiveIRQ in_kernel \\\\rv s. \\x. rv = Some x \\ x \\ maxIRQ\\\"\n and dmo_getActive_IRQ_reads_respect_scheduler:\n \"reads_respects_scheduler aag l (\\s. irq_masks_of_state st = irq_masks_of_state s)\n (do_machine_op (getActiveIRQ in_kernel))\"\n (* FIXME IF: precludes ARM_HYP *)\n and getActiveIRQ_no_non_kernel_IRQs:\n \"getActiveIRQ True = getActiveIRQ False\"\nbegin\n\nlemma integrity_update_reference_state:\n \"\\ is_subject aag t; integrity aag X st s; st = st'\\kheap := kheap st'(t \\ blah)\\ \\\n \\ integrity (aag :: 'a subject_label PAS) X st' s\"\n apply (erule integrity_trans[rotated])\n apply (clarsimp simp: integrity_def opt_map_def integrity_asids_update_reference_state)\n done\n\n(* lots of ugly hackery because handle_event_integrity wants the reference state to\n be identical to the initial one, but it isn't because we first update the\n context of cur_thread *)\nlemma kernel_entry_if_integrity:\n \"\\einvs and schact_is_rct and pas_refined aag and is_subject aag \\ cur_thread\n and domain_sep_inv (pasMaySendIrqs aag) st' and guarded_pas_domain aag\n and (\\s. e \\ Interrupt \\ ct_active s) and (=) st\\\n kernel_entry_if e tc\n \\\\_. integrity (aag :: 'a subject_label PAS) X st\\\"\n unfolding kernel_entry_if_def\n apply wp\n apply (rule valid_validE)\n apply (rule_tac Q=\"\\_ s. integrity aag X (st\\kheap :=\n (kheap st)(cur_thread st \\ TCB (tcb_arch_update (arch_tcb_context_set tc)\n (the (get_tcb (cur_thread st) st))))\\) s\n \\ is_subject aag (cur_thread s)\n \\ cur_thread s = cur_thread st\" in hoare_strengthen_post)\n apply (wp handle_event_integrity handle_event_cur_thread | simp)+\n apply (fastforce intro: integrity_update_reference_state)\n apply (wp thread_set_integrity_autarch thread_set_pas_refined guarded_pas_domain_lift\n thread_set_invs_trivial thread_set_not_state_valid_sched\n | simp add: tcb_cap_cases_def schact_is_rct_def arch_tcb_update_aux2)+\n apply (wp (once) prop_of_two_valid[where f=\"ct_active\" and g=\"cur_thread\"])\n apply (wp | simp)+\n apply (wp thread_set_tcb_context_update_wp)+\n apply (clarsimp simp: schact_is_rct_def)\n apply (rule conjI)\n apply (erule integrity_update_reference_state[where blah=\"the (kheap st (cur_thread st))\",\n OF _ integrity_refl])\n apply simp\n apply (subgoal_tac \"kheap st (cur_thread st) \\ None\")\n apply clarsimp\n apply (drule tcb_at_invs, clarsimp simp: tcb_at_def get_tcb_def\n split: kernel_object.splits option.splits)\n apply (clarsimp simp: invs_psp_aligned invs_vspace_objs invs_arch_state)\n apply (rule conjI)\n apply assumption\n apply (rule state.equality, simp_all)\n apply (rule ext, simp_all)\n done\n\nlemma kernel_entry_if_partitionIntegrity:\n \"\\silc_inv aag st and pas_refined aag and einvs and schact_is_rct\n and is_subject aag \\ cur_thread and domain_sep_inv (pasMaySendIrqs aag) st'\n and guarded_pas_domain aag and (\\s. ev \\ Interrupt \\ ct_active s) and (=) st\\\n kernel_entry_if ev tc\n \\\\_. partitionIntegrity (aag :: 'a subject_label PAS) st\\\"\n apply (rule_tac Q=\"\\rv s. (\\X. integrity (aag\\pasMayActivate := False,\n pasMayEditReadyQueues := False\\) X st s) \\\n domain_fields_equiv st s \\ globals_equiv_scheduler st s \\\n idle_thread s = idle_thread st \\ silc_dom_equiv aag st s\"\n in hoare_strengthen_post)\n apply (wp hoare_vcg_conj_lift)\n apply (rule hoare_vcg_all_lift[OF kernel_entry_if_integrity[where st'=st']])\n apply (wp kernel_entry_if_cur_thread kernel_entry_if_globals_equiv_scheduler\n kernel_entry_if_cur_domain domain_fields_equiv_lift[where R=\"\\\"]\n kernel_entry_if_domain_fields | simp)+\n apply (rule_tac P=\"pas_refined aag and einvs and schact_is_rct and\n is_subject aag \\ cur_thread and domain_sep_inv (pasMaySendIrqs aag) st' and\n (\\ s. ev \\ Interrupt \\ ct_active s)\"\n in silc_dom_equiv_from_silc_inv_valid')\n apply (wp kernel_entry_silc_inv[where st'=st'], simp add: schact_is_rct_simple)\n apply (fastforce simp: pas_refined_pasMayActivate_update pas_refined_pasMayEditReadyQueues_update\n globals_equiv_scheduler_refl silc_dom_equiv_def equiv_for_refl\n domain_fields_equiv_def ct_active_not_idle')\n apply (fastforce simp: partitionIntegrity_def)\n done\n\ntext \\\n This a very important theorem that ensures that @{const subjectAffects} is\n coherent with @{const integrity_obj}\n\\\nlemma partitionIntegrity_subjectAffects_obj:\n assumes par_inte: \"partitionIntegrity (aag :: 'a subject_label PAS) s s'\"\n assumes pas_ref: \"pas_refined aag s\"\n assumes invs: \"invs s\"\n assumes pwni: \"pas_wellformed_noninterference aag\"\n assumes silc_inv: \"silc_inv aag st s\"\n assumes kh_diff: \"kheap s x \\ kheap s' x\"\n notes inte_obj = par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_obj,\n THEN spec[where x=x], simplified integrity_obj_def, simplified]\n shows \"pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n\nproof -\n show ?thesis\n using inte_obj\n proof (induct \"kheap s x\" rule: converse_rtranclp_induct)\n case base\n thus ?case using kh_diff by force\n next\n case (step z)\n note troa = step.hyps(1)\n show ?case\n proof (cases \"z = kheap s x\")\n case True\n thus ?thesis using step.hyps by blast\n next\n case False\n note hyps = this pwni pas_ref invs silc_inv kh_diff\n hence sym_helper: \"\\auth tcb. kheap s x = Some (TCB tcb) \\\n (pasObjectAbs aag x, auth, pasObjectAbs aag x) \\ pasPolicy aag\"\n by (fastforce elim!: pas_wellformed_noninterference_policy_refl\n silc_inv_cnode_onlyE obj_atE\n simp: is_cap_table_def)\n show ?thesis\n using troa\n proof (cases rule: integrity_obj_atomic.cases)\n case troa_lrefl\n thus ?thesis by (fastforce intro: subjectAffects.intros)\n next\n case (troa_ntfn ntfn ntfn' auth s)\n thus ?thesis by (fastforce intro: affects_ep)\n next\n case (troa_ep ep ep' auth s)\n thus ?thesis by (fastforce intro: affects_ep)\n next\n case (troa_ep_unblock ep ep' tcb ntfn)\n thus ?thesis by (fastforce intro: affects_ep_bound_trans)\n next\n case (troa_tcb_send tcb tcb' ctxt' ep)\n thus ?thesis using hyps\n apply (clarsimp simp: direct_send_def indirect_send_def)\n apply (erule disjE)\n apply (clarsimp simp: receive_blocked_on_def2)\n apply (frule (2) pas_refined_tcb_st_to_auth)\n apply (fastforce intro!: affects_send sym_helper)\n apply (fastforce intro!: affects_send bound_tcb_at_implies_receive\n pred_tcb_atI sym_helper)\n done\n next\n case (troa_tcb_call tcb tcb' caller R ctxt' ep)\n thus ?thesis using hyps\n apply (clarsimp simp add: direct_call_def ep_recv_blocked_def)\n apply (rule affects_send[rotated 2])\n apply (erule (1) pas_refined_tcb_st_to_auth[rotated 2]; force)\n apply (fastforce intro: sym_helper)\n apply assumption\n apply blast\n done\n next\n case (troa_tcb_reply tcb tcb' new_st ctxt')\n thus ?thesis using hyps\n apply clarsimp\n apply (erule affects_reply)\n by (rule sym_helper)\n next\n case (troa_tcb_receive tcb tcb' new_st ep)\n thus ?thesis using hyps\n by (auto intro: affects_recv pas_refined_tcb_st_to_auth simp: send_blocked_on_def2)\n next\n case (troa_tcb_restart tcb tcb' ep)\n thus ?thesis using hyps\n by (fastforce intro: affects_reset[where auth=Receive] affects_reset[where auth=SyncSend]\n elim: blocked_on.elims pas_refined_tcb_st_to_auth[rotated 2]\n intro!: sym_helper)\n next\n case (troa_tcb_unbind tcb tcb')\n thus ?thesis using hyps\n apply -\n by (cases \"tcb_bound_notification tcb\" ;\n fastforce intro: affects_reset[where auth=Receive] bound_tcb_at_implies_receive\n pred_tcb_atI sym_helper)\n next\n case (troa_tcb_empty_ctable tcb tcb' cap')\n thus ?thesis using hyps\n apply (clarsimp simp:reply_cap_deletion_integrity_def; elim disjE; clarsimp)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule cap_auth_caps_of_state[rotated,where p =\"(x,tcb_cnode_index 0)\"],\n force simp: caps_of_state_def')\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def reply_cap_rights_to_auth_def\n split: if_splits)\n next\n case (troa_tcb_empty_caller tcb tcb' cap')\n thus ?thesis using hyps\n apply (clarsimp simp:reply_cap_deletion_integrity_def)\n apply (elim disjE; clarsimp)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule cap_auth_caps_of_state[rotated,where p =\"(x,tcb_cnode_index 3)\"],\n force simp: caps_of_state_def')\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def\n reply_cap_rights_to_auth_def\n split: if_splits)\n next\n case (troa_tcb_activate tcb tcb')\n thus ?thesis by blast\n next\n case (troa_arch ao ao')\n thus ?thesis\n using assms by (fastforce dest: partitionIntegrity_subjectAffects_aobj)\n next\n case (troa_cnode n content content')\n thus ?thesis\n using hyps unfolding cnode_integrity_def\n apply clarsimp\n apply (drule fun_noteqD)\n apply (erule exE, rename_tac l)\n apply (drule_tac x=l in spec)\n apply (clarsimp dest!:not_sym[where t=None])\n apply (clarsimp simp:reply_cap_deletion_integrity_def)\n apply (rule affects_delete_derived)\n apply (rule aag_wellformed_delete_derived[rotated -1, OF pas_refined_wellformed],\n assumption)\n apply (frule_tac p=\"(x,l)\" in cap_auth_caps_of_state[rotated])\n apply (force simp: caps_of_state_def' intro:well_formed_cnode_invsI)\n by (fastforce simp: aag_cap_auth_def cap_auth_conferred_def\n reply_cap_rights_to_auth_def\n split: if_splits)\n qed\n qed\n qed\nqed\n\nend\n\n\nlemma kheap_ep_tcb_states_of_state_eq:\n \"kheap s x = kheap s' x \\ tcb_states_of_state s x = tcb_states_of_state s' x\"\n unfolding tcb_states_of_state_def get_tcb_def by simp\n\nlemma partitionIntegrity_subjectAffects_mem:\n assumes par_inte: \"partitionIntegrity aag s s'\"\n assumes pas_ref: \"pas_refined aag s\"\n assumes invs: \"invs s\"\n assumes um_diff:\n \"underlying_memory (machine_state s) x \\ underlying_memory (machine_state s') x\"\n notes inte_mem =\n par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_mem, THEN spec[where x=x]]\n shows\n \"pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n using inte_mem\n proof (cases rule: integrity_mem.cases)\n case trm_lrefl\n thus ?thesis by (fastforce intro: affects_lrefl)\n next\n case trm_orefl\n thus ?thesis using um_diff by blast\n next\n case trm_write\n thus ?thesis by (fastforce intro: affects_write)\n next\n case trm_globals\n thus ?thesis by blast\n next\n case (trm_ipc p) note trm_ipc_hyps = this\n then obtain tcbst where \"tcb_states_of_state s p = Some tcbst\" \"can_receive_ipc tcbst\"\n by (force split:option.splits)\n note hyps = this trm_ipc_hyps(2-)[simplified] pas_ref invs um_diff\n from par_inte[THEN partitionIntegrity_integrity, THEN integrity_subjects_obj,\n THEN spec[where x=p], THEN tro_tro_alt]\n show ?thesis\n proof (cases rule: integrity_obj_alt.cases)\n case (tro_alt_tcb_send tcb tcb' ccap' cap' ntfn' ep)\n thus ?thesis using hyps\n apply (clarsimp simp: direct_send_def indirect_send_def)\n apply (erule disjE)\n apply (clarsimp simp: receive_blocked_on_def2)\n apply (frule (2) pas_refined_tcb_st_to_auth)\n apply (fastforce intro!: affects_send auth_ipc_buffers_mem_Write')\n apply clarsimp\n apply (rule affects_send[rotated 2])\n apply (fastforce intro!: affects_send bound_tcb_at_implies_receive pred_tcb_atI\n dest: sym)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n apply assumption\n apply blast\n done\n next\n case (tro_alt_tcb_call tcb tcb' ccap' cap' ntfn' caller R ep)\n thus ?thesis using hyps\n apply (clarsimp simp add: direct_call_def ep_recv_blocked_def)\n apply (rule affects_send[rotated 2])\n apply (erule (1) pas_refined_tcb_st_to_auth[rotated 2]; force)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n apply assumption\n apply blast\n done\n next\n case (tro_alt_tcb_reply tcb tcb' ccap' cap' ntfn' new_st)\n thus ?thesis using hyps\n apply (clarsimp simp: direct_reply_def)\n apply (erule affects_reply)\n by (force intro: auth_ipc_buffers_mem_Write')\n next\n case (tro_alt_tcb_receive tcb tcb' ccap' cap' ntfn' new_st ep)\n thus ?thesis using hyps\n apply (clarsimp elim!: tcb_states_of_state_kheapE send_blocked_on.elims\n can_receive_ipc.elims)\n apply (frule (1) pas_refined_tcb_st_to_auth[rotated 2,where auth=Call and ep =ep])\n apply force\n apply (rule affects_reply)\n apply (erule (1) aag_wellformed_reply, force)\n apply (fastforce intro!: auth_ipc_buffers_mem_Write')\n done\n next\n case (tro_alt_tcb_restart tcb tcb' ccap' cap' ntfn' ep)\n thus ?thesis using hyps\n by (fastforce intro: affects_reset[where auth=Receive] affects_reset[where auth=SyncSend]\n elim: blocked_on.elims pas_refined_tcb_st_to_auth[rotated 2]\n intro!: auth_ipc_buffers_mem_Write')\n qed (insert hyps, force elim: tcb_states_of_state_kheapE)+\n qed\n\nlemma partitionIntegrity_subjectAffects_cdt:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s;\n valid_mdb s; valid_objs s; cdt s (x,y) \\ cdt s' (x,y) \\\n \\ pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_cdt)\n apply (drule_tac x=\"(x,y)\" in spec)\n apply (clarsimp simp: integrity_cdt_def)\n apply (rule affects_delete_derived)\n apply (frule (3) cdt_change_allowed_delete_derived)\n by simp\n\nlemma partitionIntegrity_subjectAffects_cdt_list:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s; pas_refined aag s';\n valid_list s; valid_list s'; silc_inv aag st s; silc_inv aag st' s';\n pas_wellformed_noninterference aag; invs s; invs s'; cdt_list s (x,y) \\ cdt_list s' (x,y) \\\n \\ pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_cdt_list)\n apply (simp add: integrity_cdt_list_def)\n apply (drule_tac x=\"x\" in spec)\n apply (drule_tac x=\"y\" in spec)\n apply (elim disjE)\n apply (drule(1) neq_filtered_ex)\n apply (elim bexE)\n apply (case_tac \"pasObjectAbs aag x = SilcLabel\")\n apply (subgoal_tac \"pasObjectAbs aag (fst xa) = SilcLabel\")\n apply simp\n apply (rule affects_delete_derived)\n apply (frule (3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n apply force\n subgoal by (fastforce simp add: silc_inv_def valid_list_2_def all_children_def\n simp del: split_paired_All)\n apply (rule affects_delete_derived2)\n apply (frule (3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n apply assumption\n subgoal by (fastforce dest!: aag_cdt_link_DeleteDerived\n simp add: valid_list_2_def\n simp del: split_paired_All)\n apply (rule affects_delete_derived)\n apply (frule(3) cdt_change_allowed_delete_derived[OF invs_valid_objs invs_mdb])\n by simp\n\nlemma partitionIntegrity_subjectAffects_is_original_cap:\n \"\\partitionIntegrity aag s s'; pas_refined aag s; valid_mdb s; valid_objs s;\n is_original_cap s (x,y) \\ is_original_cap s' (x,y)\\ \\\n pasObjectAbs aag x\n \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_cdt)\n apply (drule_tac x=\"(x,y)\" in spec)\n apply (clarsimp simp: integrity_cdt_def)\n apply (rule affects_delete_derived)\n apply (frule (3) cdt_change_allowed_delete_derived)\n by simp\n\nlemma partitionIntegrity_subjectAffects_interrupt_states:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s;\n valid_objs s; interrupt_states s x \\ interrupt_states s' x \\\n \\ pasIRQAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_interrupts)\n apply (drule_tac x=x in spec)\n apply (clarsimp simp: integrity_interrupts_def)\n apply (rule affects_lrefl)\n done\n\nlemma partitionIntegrity_subjectAffects_interrupt_irq_node:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s; valid_objs s;\n interrupt_irq_node s x \\ interrupt_irq_node s' x \\\n \\ pasIRQAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_interrupts)\n apply (drule_tac x=x in spec)\n apply (clarsimp simp: integrity_interrupts_def)\n apply (rule affects_lrefl)\n done\n\nlemma pas_wellformed_pasSubject_update:\n \"\\ pas_wellformed_noninterference aag; silc_inv aag st s; invs s;\n kheap s x = Some (TCB t) \\ kheap s x = Some (ArchObj a) \\\n \\ pas_wellformed (aag\\pasSubject := pasObjectAbs aag x\\)\"\n apply (simp add: pas_wellformed_noninterference_def)\n apply (elim conjE)\n apply (erule bspec)\n apply (clarsimp simp: silc_inv_def obj_at_def split: kernel_object.splits)\n apply (drule spec, erule (1) impE)\n apply (fastforce simp: is_cap_table_def)\n done\n\nlemma partitionIntegrity_subjectAffects_eobj:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s;\n valid_objs s; einvs s; einvs s'; pas_wellformed_noninterference aag;\n silc_inv aag st s; silc_inv aag st' s'; ekheap s x \\ ekheap s' x \\\n \\ pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (drule integrity_subjects_eobj)\n apply (drule_tac x=x in spec)\n apply (erule integrity_eobj.cases)\n apply simp\n apply (rule subjectAffects.affects_lrefl)\n apply simp\n done\n\n(*FIXME: Move*)\nlemma prefix_helper:\n \"\\ a @ l = l'; distinct l; distinct l' \\ \\ set a \\ set l = {} \\ set a \\ set l'\"\n apply (induct l)\n apply simp+\n by (metis append_Cons disjoint_iff_not_equal distinct.simps(2) distinct_append\n distinct_length_2_or_more subset_code(1))\n\n(*FIXME: Move*)\nlemma valid_queuesE:\n assumes \"valid_queues s\"\n assumes \"t \\ set (ready_queues s d p)\"\n assumes \"\\ is_etcb_at t s; etcb_at (\\t. tcb_priority t = p \\ tcb_domain t = d) t s;\n st_tcb_at runnable t s; distinct (ready_queues s d p) \\\n \\ R \"\n shows R\n using assms by (clarsimp simp: valid_queues_def)\n\nlemma valid_blocked_imp:\n \"\\ valid_blocked s; tcb_at t s; not_queued t s;\n t \\ cur_thread s; scheduler_action s \\ switch_thread t \\\n \\ st_tcb_at (\\s. \\ runnable s) t s\"\n by (fastforce simp: valid_blocked_def st_tcb_at_def\n tcb_at_st_tcb_at runnable_eq_active obj_at_def)\n\nlemma valid_queues_not_in_place:\n \"\\ valid_queues s; t \\ set (ready_queues s d a);\n etcb_at (\\t. tcb_priority t = a \\ tcb_domain t = d) t s; is_etcb_at t s\\\n \\ not_queued t s\"\n by (clarsimp simp: valid_queues_def not_queued_def etcb_at_def is_etcb_at_def\n split: option.splits)\n\nlemma ready_queues_alters_kheap:\n assumes a: \"valid_queues s\"\n assumes b: \"valid_blocked s\"\n assumes c: \"valid_idle s'\"\n shows \"\\ ready_queues s d a \\ ready_queues s' d a;\n threads @ ready_queues s d a = ready_queues s' d a; valid_queues s';\n valid_etcbs s; valid_etcbs s'; t \\ set threads; ekheap s t = ekheap s' t;\n t \\ idle_thread s \\ (t \\ cur_thread s \\ t \\ cur_thread s');\n scheduler_action s \\ switch_thread t; idle_thread s = idle_thread s' \\\n \\ kheap s t \\ kheap s' t\"\n apply (frule prefix_helper)\n using a apply ((simp add: valid_queues_def)+)[2]\n apply clarsimp\n apply (drule(1) set_mp)\n apply (drule(1) orthD1)\n apply (erule(1) valid_queuesE)\n apply (subgoal_tac \"tcb_at t s\")\n apply (frule valid_blocked_imp[OF b])\n apply (rule valid_queues_not_in_place[OF a],assumption)\n apply (simp add: etcb_at_def)\n apply (simp add: is_etcb_at_def)\n using c apply (auto simp: pred_tcb_at_def tcb_at_st_tcb_at obj_at_def valid_idle_def)\n done\n\nlemma valid_sched_valid_blocked: \"valid_sched s \\ valid_blocked s\"\n by (simp add: valid_sched_def)\n\n\ncontext Noninterference_1 begin\n\nlemma partitionIntegrity_subjectAffects_ready_queues:\n assumes domains_distinct: \"pas_domains_distinct (aag :: 'a subject_label PAS)\"\n shows \"\\ partitionIntegrity aag s s'; pas_refined aag s; valid_objs s; einvs s; einvs s';\n pas_refined aag s'; pas_cur_domain aag s; pas_wellformed_noninterference aag;\n silc_inv aag st s; silc_inv aag st' s'; ready_queues s d \\ ready_queues s' d;\n cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s);\n cur_thread s' \\ idle_thread s' \\ is_subject aag (cur_thread s') \\\n \\ pasDomainAbs aag d \\ subjectAffects (pasPolicy aag) (pasSubject aag) \\ {}\"\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply (frule valid_sched_valid_blocked[where s=s])\n apply (case_tac \"pasSubject aag \\ pasDomainAbs aag d\")\n apply (metis affects_lrefl)\n apply (drule fun_noteqD,clarsimp)\n apply (clarsimp simp add: partitionIntegrity_def)\n apply (frule_tac d=d and p=a in integrity_subjects_ready_queues[rule_format])\n apply (clarsimp simp: integrity_ready_queues_def)\n apply (case_tac \"threads = []\")\n apply simp\n apply (erule not_NilE)\n apply (frule_tac x=x and d=d and p=a and s=s' in tcb_with_domain_at[OF valid_sched_valid_queues])\n apply (drule_tac t=\"ready_queues s' d a\" in sym)\n apply simp\n apply clarsimp\n apply (frule(1) tcb_domain_wellformed)\n apply (rename_tac tcb_ptr tcbs tcb)\n apply (rule_tac x = \"pasObjectAbs aag tcb_ptr\" in bexI)\n apply (case_tac \"scheduler_action s = switch_thread tcb_ptr\")\n apply (drule switch_to_cur_domain[rotated])\n apply simp\n apply simp\n apply (fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n apply (case_tac \"ekheap s tcb_ptr \\ ekheap s' tcb_ptr\")\n apply (rule_tac s=s and s'=s' in partitionIntegrity_subjectAffects_eobj)\n apply (simp add: partitionIntegrity_def)+\n apply (subgoal_tac \"kheap s tcb_ptr \\ kheap s' tcb_ptr\")\n apply (rule partitionIntegrity_subjectAffects_obj)\n apply (fastforce simp add: partitionIntegrity_def valid_sched_def)+\n apply (rule_tac threads=\"tcb_ptr # tcbs\" in ready_queues_alters_kheap)\n apply (fastforce simp add: partitionIntegrity_def valid_sched_def)+\n done\n\nend\n\n\nlemma pas_refined_asid_mem:\n \"\\ v \\ state_asids_to_policy aag s; pas_refined aag s \\\n \\ v \\ pasPolicy aag\"\n by (auto simp add: pas_refined_def)\n\nlemma sameFor_subject_def2:\n \"sameFor_subject g ab irqab asidab domainab l =\n {(os,os') | os os' s s'. s = internal_state_if os \\ s' = internal_state_if os' \\\n (\\d \\ subjectReads g (OrdinaryLabel l).\n states_equiv_for (\\x. ab x = d) (\\x. irqab x = d)\n (\\x. asidab x = d) (\\x. d \\ domainab x) s s') \\\n ((domainab (cur_domain s) \\ subjectReads g (OrdinaryLabel l) \\ {} \\\n domainab (cur_domain s') \\ subjectReads g (OrdinaryLabel l) \\ {})\n \\ cur_domain s = cur_domain s' \\ globals_equiv s s' \\\n scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\ user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\\n equiv_for (\\x. ab x = SilcLabel) kheap s s')}\"\n apply (clarsimp simp: sameFor_subject_def)\n apply (rule equalityI)\n apply (rule subsetI)\n apply (drule CollectD)\n apply (rule CollectI)\n apply (clarify)\n apply (rule exI)+\n apply (rule conjI, rule refl)\n apply (rule conjI)\n apply (rule ballI)\n apply (erule states_equiv_for_guard_imp)\n apply (blast+)[4]\n apply (fastforce simp: globals_equiv_def)\n apply (rule subsetI)\n apply (drule CollectD)\n apply (rule CollectI)\n apply (clarify)\n apply (rule exI)+\n apply (rule conjI, rule refl)\n apply (rule conjI)\n apply (rule states_equiv_forI)\n apply ((fastforce intro: equiv_forI elim: states_equiv_forE equiv_forD)+)[5]\n apply (fastforce intro: equiv_forI elim: states_equiv_forE_is_original_cap)\n apply ((fastforce intro: equiv_forI elim: states_equiv_forE equiv_forD)+)[2]\n apply (solves \\clarsimp simp: equiv_asids_def states_equiv_for_def\\)\n apply (fastforce intro: equiv_forI elim: states_equiv_forE_ready_queues)\n apply fastforce\n done\n\ntext \\\n This lemma says that everything the current subject can affect, according to the\n integrity property, is included in @{term partsSubjectAffects}.\n\\\n\nlemma subject_can_affect_its_own_partition:\n \"d \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag))\n \\ d \\ Partition (label_of (pasSubject aag))\"\n apply (erule contrapos_nn)\n apply (simp add: partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply (blast intro: affects_lrefl)\n done\n\n(* FIXME: cleanup this wonderful proof *)\nlemma partitionIntegrity_subjectAffects_device:\n \"\\ partitionIntegrity aag s s'; pas_refined aag s; invs s; invs s';\n device_state (machine_state s) x \\ device_state (machine_state s') x \\\n \\ pasObjectAbs aag x \\ subjectAffects (pasPolicy aag) (pasSubject aag)\"\n apply (drule partitionIntegrity_integrity)\n apply (frule integrity_subjects_device)\n apply (drule_tac x=x in spec)\n apply (erule integrity_device.cases)\n apply (fastforce intro: affects_lrefl)\n apply blast\n apply (fastforce intro: affects_write)\n done\n\n\n(* a hack to prevent safe etc. below from taking apart the implication *)\ndefinition guarded_is_subject_cur_thread\nwhere\n \"guarded_is_subject_cur_thread aag s \\\n cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)\"\n\n\ncontext Noninterference_1 begin\n\nlemma partsSubjectAffects_bounds_subjects_affects:\n assumes domains_distinct: \"pas_domains_distinct (aag :: 'a subject_label PAS)\"\n shows \"\\ partitionIntegrity aag s s'; pas_refined aag s; pas_refined aag s'; valid_objs s;\n valid_arch_state s'; einvs s; einvs s'; silc_inv aag st s; silc_inv aag st' s';\n pas_wellformed_noninterference aag; pas_cur_domain aag s;\n guarded_is_subject_cur_thread aag s; guarded_is_subject_cur_thread aag s';\n d \\ partsSubjectAffects (pasPolicy aag) (label_of (pasSubject aag)); d \\ PSched \\\n \\ (((uc,s),mode),((uc',s'),mode')) \\ same_for aag d\"\n apply (frule pasSubject_not_SilcLabel)\n apply (erule contrapos_np)\n apply (cases d)\n prefer 2\n apply simp\n apply (clarsimp simp: sameFor_def sameFor_subject_def2 states_equiv_for_def equiv_for_def\n partsSubjectAffects_def image_def label_can_affect_partition_def)\n apply (safe del: iffI notI)\n apply (fastforce dest: partitionIntegrity_subjectAffects_obj)\n apply ((auto dest: partitionIntegrity_subjectAffects_obj\n partitionIntegrity_subjectAffects_eobj\n partitionIntegrity_subjectAffects_mem\n partitionIntegrity_subjectAffects_device\n partitionIntegrity_subjectAffects_cdt\n partitionIntegrity_subjectAffects_cdt_list\n partitionIntegrity_subjectAffects_is_original_cap\n partitionIntegrity_subjectAffects_interrupt_states\n partitionIntegrity_subjectAffects_interrupt_irq_node\n partitionIntegrity_subjectAffects_asid\n partitionIntegrity_subjectAffects_ready_queues\n [folded guarded_is_subject_cur_thread_def,\n OF domains_distinct]\n domains_distinct[THEN pas_domains_distinct_inj]\n | fastforce simp: partitionIntegrity_def\n silc_dom_equiv_def equiv_for_def)+)[11]\n apply ((fastforce intro: affects_lrefl\n simp: partitionIntegrity_def domain_fields_equiv_def\n dest: domains_distinct[THEN pas_domains_distinct_inj])+)[16]\n done\n\nend\n\n\nlemma cur_thread_not_SilcLabel:\n \"\\ silc_inv aag st s; invs s \\ \\ pasObjectAbs aag (cur_thread s) \\ SilcLabel\"\n apply (rule notI)\n apply (simp add: silc_inv_def)\n apply (drule tcb_at_invs)\n apply clarify\n apply (drule_tac x=\"cur_thread s\" in spec, erule (1) impE)\n apply (auto simp: obj_at_def is_tcb_def is_cap_table_def)\n apply (case_tac ko, simp_all)\n done\n\nlemma ev_add_pre:\n \"equiv_valid_inv I A P f \\ equiv_valid_inv I A (P and Q) f\"\n apply (rule equiv_valid_guard_imp)\n apply assumption\n apply simp\n done\n\ncrunch invs[wp]: check_active_irq_if \"einvs\"\n (wp: dmo_getActiveIRQ_wp ignore: do_machine_op)\n\ncrunch schact_is_rct[wp]: thread_set \"schact_is_rct\"\n (wp: get_object_wp simp: schact_is_rct_def)\n\ndefinition partition :: \"'a subject_label agent_domain_map \\ det_state \\ 'a\" where\n \"partition ab s \\ label_of (the_elem (ab (cur_domain s)))\"\n\nlemma silc_inv_refl:\n \"silc_inv aag st s \\ silc_inv aag s s\"\n by (fastforce simp: silc_inv_def silc_dom_equiv_def equiv_for_refl\n intro!: silc_inv_no_transferableD')\n\n\nsection \\Valid initial state is complete unwinding system\\\n\ncontext valid_initial_state begin\n\ntext \\current running partition\\\ndefinition part where\n \"part s \\ if scheduler_modes (sys_mode_of s) then PSched\n else Partition (partition (pasDomainAbs initial_aag) (internal_state_if s))\"\n\ntext \\unwinding relation\\\ndefinition uwr where\n \"uwr \\ same_for initial_aag\"\n\nend\n\n\ntext \\\n Here we are basically that the big step ADT of the kernel is a\n valid complete unwinding system on the policyFlow policy\n\n For those unfamiliar with the local subtleties, we are importing the all the facts\n of the complete_unwinding_system locale in the valid_initial_state locale under namespace ni.\n\\\nsublocale valid_initial_state \\ ni?:\n complete_unwinding_system \"big_step_ADT_A_if utf\" (* the ADT that we prove infoflow for *)\n s0 (* initial state *)\n \"\\e s. part s\" (* dom function *)\n uwr (* uwr *)\n \"policyFlows (pasPolicy initial_aag)\" (* policy *)\n undefined (* out -- unused *)\n PSched (* scheduler partition name *)\n apply (simp add: complete_unwinding_system_def big_step_ADT_A_if_enabled_Step_system\n unwinding_system_def complete_unwinding_system_axioms_def)\n apply (rule conjI)\n apply (unfold_locales)\n apply (clarsimp simp: equiv_def uwr_def, safe)[1]\n apply (simp add: sameFor_refl)\n apply (simp add: sameFor_sym)\n apply (simp add: sameFor_trans)\n apply (clarsimp simp: uwr_def sameFor_def sameFor_scheduler_def part_def\n domain_fields_equiv_def partition_def)\n apply (rule PSched_flows_to_all)\n apply (case_tac x)\n apply (fastforce simp: no_partition_flows_to_PSched)\n apply simp\n apply (simp add: refl_onD[OF policyFlows_refl])\n done\n\nlemma Fin_big_step_adt:\n \"Fin (big_step_adt A R evmap) = Fin A\"\n by (simp add: big_step_adt_def)\n\n\ncontext valid_initial_state begin\n\nlemma small_step_reachable:\n \"ni.reachable s \\ system.reachable (ADT_A_if utf) s0 s\"\n apply (rule reachable_big_step_adt)\n apply (simp add: big_step_ADT_A_if_def)\n done\n\nlemma reachable_invs_if:\n \"ni.reachable s \\ invs_if s\"\n apply (rule ADT_A_if_reachable_invs_if)\n apply (erule small_step_reachable)\n done\n\nabbreviation pas_refined_if where\n \"pas_refined_if s \\ pas_refined (current_aag (internal_state_if s)) (internal_state_if s)\"\n\nabbreviation guarded_pas_domain_if where\n \"guarded_pas_domain_if s \\\n guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s)\"\n\nlemma pas_refined_if:\n \"ni.reachable s \\ pas_refined_if s\"\n apply (drule reachable_invs_if)\n apply (simp add: invs_if_def Invs_def)\n done\n\nlemma guarded_pas_domain_if:\n \"ni.reachable s \\ guarded_pas_domain_if s\"\n apply (drule reachable_invs_if)\n apply (simp add: invs_if_def Invs_def)\n done\n\nlemma current_aag_eqI:\n \"cur_domain s = cur_domain t \\ current_aag s = current_aag t\"\n by (simp add: current_aag_def)\n\nlemma pas_refined_current_aag':\n \"\\ reachable t; current_aag (internal_state_if s) = current_aag (internal_state_if t) \\\n \\ pas_refined (current_aag (internal_state_if s)) (internal_state_if t)\"\n by (fastforce intro: pas_refined_if)\n\nlemma guarded_pas_domain_current_aag':\n \"\\ reachable t; current_aag (internal_state_if s) = current_aag (internal_state_if t) \\\n \\ guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if t)\"\n by (fastforce intro: guarded_pas_domain_if)\n\nabbreviation partition_if where\n \"partition_if s \\ partition (pasDomainAbs initial_aag) (internal_state_if s)\"\n\nlemma pasDomainAbs_not_SilcLabel[simp]:\n \"SilcLabel \\ pasDomainAbs initial_aag x\"\n apply (rule pas_wellformed_noninterference_silc)\n apply (rule policy_wellformed)\n done\n\nlemma domain_in_ordinary_label[simp]:\n \"OrdinaryLabel (label_of (the_elem (pasDomainAbs initial_aag (cur_domain s)))) =\n the_elem (pasDomainAbs initial_aag (cur_domain s))\"\n apply (case_tac \"the_elem (pasDomainAbs initial_aag (cur_domain s))\")\n apply simp\n apply (metis the_label_of_domain_exists pasDomainAbs_not_SilcLabel)\n done\n\nlemma uwr_partition_if:\n \"\\ (os,os') \\ uwr (Partition (partition_if os));\n s = internal_state_if os; s' = internal_state_if os' \\\n \\ states_equiv_for\n (\\x. pasObjectAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag)\n (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasIRQAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag)\n (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasASIDAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag)\n (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)))\n (\\x. pasDomainAbs initial_aag x \\\n subjectReads (pasPolicy initial_aag)\n (OrdinaryLabel (partition (pasDomainAbs initial_aag) s)) \\ {}) s s' \\\n cur_thread s = cur_thread s' \\ cur_domain s = cur_domain s' \\\n globals_equiv s s' \\ scheduler_action s = scheduler_action s' \\\n work_units_completed s = work_units_completed s' \\\n irq_state (machine_state s) = irq_state (machine_state s') \\\n (user_modes (sys_mode_of os) \\ user_context_of os = user_context_of os') \\\n sys_mode_of os = sys_mode_of os' \\\n equiv_for (\\x. pasObjectAbs initial_aag x = SilcLabel) kheap s s'\"\n apply (simp add: uwr_def sameFor_def sameFor_subject_def)\n apply (clarify | simp (no_asm_use) add: partition_def)+\n apply (subst (asm) the_subject_of_aag_domain, rule subject_current_aag)+\n apply (simp add: current_aag_def)\n apply (erule impE)\n using reads_lrefl subject_current_aag apply fastforce\n apply (fastforce simp: globals_equiv_def)\n done\n\nlemma schact_is_rct_eqI:\n \"(s,t) \\ uwr(Partition (partition_if s))\n \\ schact_is_rct (internal_state_if s) = schact_is_rct (internal_state_if t)\"\n apply (drule uwr_partition_if[OF _ refl refl])\n apply (simp add: schact_is_rct_def)\n done\n\n(*FIXME move*)\nlemma handle_ev[wp]:\n assumes ok: \"equiv_valid I AA AA P f\"\n assumes err: \"\\e. equiv_valid I AA AA (E e) (handler e)\"\n assumes hoare: \"\\P\\ f -, \\E\\\"\n shows \"equiv_valid I AA AA P (f handler)\"\n apply (simp add: handleE_def handleE'_def)\n apply (wp err ok | wpc | simp)+\n apply (insert hoare[simplified validE_E_def validE_def])[1]\n apply (simp split: sum.splits)\n by simp\n\nlemma pas_refined_initial_aag_reachable:\n \"system.reachable (big_step_ADT_A_if utf) s0 s\n \\ pas_refined initial_aag (internal_state_if s)\"\n apply (simp add: initial_aag_bak[where s=\"internal_state_if s\"])\n apply (rule pas_refined_pasSubject_update[OF pas_refined_if pas_wellformed_cur])\n apply assumption\n apply (clarsimp simp: current_aag_def)\n apply blast\n done\n\nlemma silc_inv_initial_aag_reachable:\n \"system.reachable (big_step_ADT_A_if utf) s0 s\n \\ silc_inv initial_aag s0_internal (internal_state_if s)\"\n apply (simp add: silc_inv_cur[symmetric])\n apply (fastforce dest: reachable_invs_if simp: invs_if_def Invs_def)\n done\n\nlemma uwr_def_cur:\n \"uwr \\ same_for (current_aag (internal_state_if s))\"\n by (simp add: uwr_def current_aag_def)\n\nlemma Step_big_step_ADT_A_if:\n \"data_type.Step (big_step_ADT_A_if utf) = big_steps (ADT_A_if utf) big_step_R big_step_evmap\"\n by (simp add: big_step_ADT_A_if_def big_step_adt_def)\n\nlemma partitionIntegrity_refl:\n \"partitionIntegrity aag s s\"\n by (fastforce simp: partitionIntegrity_def silc_dom_equiv_def domain_fields_equiv_def\n intro: integrity_refl globals_equiv_scheduler_refl equiv_for_refl)\n\nlemma partitionIntegrity_trans:\n \"\\ partitionIntegrity aag s t; partitionIntegrity aag t u \\\n \\ partitionIntegrity aag s u\"\n apply (clarsimp simp: partitionIntegrity_def)\n apply (rule conjI)\n apply (blast intro: integrity_trans)\n apply (fastforce intro: domain_fields_equiv_trans simp: silc_dom_equiv_def)\n done\n\nlemma check_active_irq_A_if_partitionIntegrity:\n \"((a, b), x, aa, ba) \\ check_active_irq_A_if\n \\ partitionIntegrity (current_aag b) b ba\"\n apply (simp add: check_active_irq_A_if_def)\n apply (erule use_valid)\n apply (wp check_active_irq_if_partitionIntegrity)\n apply (rule partitionIntegrity_refl)\n done\n\nlemma check_active_irq_A_if_result_state:\n \"((a, b), x, aa, ba) \\ check_active_irq_A_if\n \\ ba = (b\\machine_state := (machine_state b)\\irq_state := irq_state_of_state b + 1\\\\)\"\n apply (simp add: check_active_irq_A_if_def check_active_irq_if_def)\n apply (erule use_valid)\n apply (wp dmo_getActiveIRQ_wp)\n apply simp\n done\n\nlemma ct_running_not_ct_idle:\n \"\\ valid_idle s; ct_running s \\ \\ \\ ct_idle s\"\n by (auto simp: ct_in_state_def valid_idle_def st_tcb_at_def obj_at_def)\n\nlemma not_schedule_modes_KernelEntry:\n \"(\\ scheduler_modes (KernelEntry event)) = (event \\ Interrupt)\"\n by (case_tac event, simp_all)\n\nlemma Step_ADT_A_if'':\n \"\\ (s, t) \\ data_type.Step (ADT_A_if utf) (); system.reachable (ADT_A_if utf) s0 s \\\n \\ (s, t) \\ system.Step (ADT_A_if utf) ()\"\n apply (simp add: system.reachable_def)\n apply (clarsimp)\n apply (frule execution_invs)\n apply (frule invs_if_full_invs_if)\n apply (frule execution_restrict)\n apply (simp add: system.Step_def execution_def steps_def ADT_A_if_def)\n done\n\nend\n\n\nlocale Noninterference_valid_initial_state =\n Noninterference_1 current_aag + valid_initial_state _ _ _ _ _ current_aag for current_aag\nbegin\n\nlemma kernel_call_A_if_partitionIntegrity:\n \"\\ ((a, b), x, aa, ba) \\ kernel_call_A_if e; e \\ Interrupt;\n ct_active b; Invs b; scheduler_action b = resume_cur_thread \\\n \\ partitionIntegrity (current_aag b) b ba\"\n apply (clarsimp simp: kernel_call_A_if_def)\n apply (erule use_valid)\n apply (wp kernel_entry_if_partitionIntegrity)\n apply (clarsimp simp: partitionIntegrity_refl Invs_def silc_inv_refl)\n apply (simp add: guarded_pas_domain_def current_aag_def active_from_running schact_is_rct_def)\n apply (erule impE)\n apply (rule ct_active_cur_thread_not_idle_thread, simp add: invs_valid_idle)\n apply simp\n apply (simp add: the_subject_of_aag_domain)\n done\n\nlemma do_user_op_A_if_partitionIntegrity:\n \"((a, b), x, aa, ba) \\ do_user_op_A_if uop \\ ct_running b \\ Invs b\n \\ partitionIntegrity (current_aag b) b ba\"\n apply (simp add: do_user_op_A_if_def)\n apply (erule use_valid)\n apply (wp do_user_op_if_partitionIntegrity)\n apply (simp add: partitionIntegrity_refl)\n apply (simp add: Invs_def)\n apply (clarsimp simp: guarded_pas_domain_def current_aag_def)\n apply (erule impE)\n apply (erule ct_running_not_idle)\n apply (simp add: invs_valid_idle)\n apply (simp add: the_subject_of_aag_domain)\n done\n\nlemma partitionIntegrity_current_aag_eq:\n \"partitionIntegrity (current_aag s) s s' \\ current_aag s' = current_aag s\"\n by (simp add: current_aag_def partitionIntegrity_def domain_fields_equiv_def)\n\nlemma partitionIntegrity_trans':\n \"\\ partitionIntegrity (current_aag s) s s';\n partitionIntegrity (current_aag s') s' t \\\n \\ partitionIntegrity (current_aag s) s t\"\n apply (rule partitionIntegrity_trans, assumption)\n apply (simp add: partitionIntegrity_current_aag_eq)\n done\n\nlemma user_small_Step_partitionIntegrity:\n \"\\ ((a, b), x, aa, ba) \\ check_active_irq_A_if;\n ct_running b; Invs b; ((aa, ba), y, ab, bb) \\ do_user_op_A_if utf \\\n \\ partitionIntegrity (current_aag b) b bb\"\n apply (rule partitionIntegrity_trans'[rotated])\n apply (rule do_user_op_A_if_partitionIntegrity)\n apply assumption\n apply (drule check_active_irq_A_if_result_state)\n apply simp\n apply (drule check_active_irq_A_if_result_state)\n apply (simp add: Invs_def current_aag_def)\n apply (rule check_active_irq_A_if_partitionIntegrity)\n apply assumption\n done\n\nlemma small_Step_partitionIntegrity:\n notes active_from_running[simp]\n assumes step: \"(s, t) \\ data_type.Step (ADT_A_if utf) ()\"\n and reachable: \"system.reachable (ADT_A_if utf) s0 s\"\n and sched: \"part s \\ PSched\"\n shows \"partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if t)\"\nproof (cases \"sys_mode_of s\")\n case InUserMode\n with assms show ?thesis\n by (fastforce dest: ADT_A_if_reachable_invs_if\n simp: invs_if_def part_def global_automaton_if_def\n Step_ADT_A_if_def_global_automaton_if\n intro: user_small_Step_partitionIntegrity check_active_irq_A_if_partitionIntegrity)\nnext case InIdleMode\n with assms show ?thesis\n by (fastforce simp: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n intro: check_active_irq_A_if_partitionIntegrity)\nnext case KernelEntry\n with assms show ?thesis\n by (fastforce dest: ADT_A_if_reachable_invs_if\n simp: invs_if_def part_def Step_ADT_A_if_def_global_automaton_if\n global_automaton_if_def not_schedule_modes_KernelEntry\n intro: kernel_call_A_if_partitionIntegrity)\nnext case KernelExit\n with assms show ?thesis\n apply (clarsimp simp: Step_ADT_A_if_def_global_automaton_if\n global_automaton_if_def kernel_exit_A_if_def)\n apply (safe; simp)\n apply (erule use_valid)\n apply wp\n apply (rule partitionIntegrity_refl)\n done\nnext case KernelPreempted\n with assms show ?thesis\n by (simp add: part_def)\nnext case KernelSchedule\n with assms show ?thesis\n apply (clarsimp simp: part_def Step_ADT_A_if_def_global_automaton_if\n global_automaton_if_def kernel_schedule_if_def)\n apply (safe; simp)\n apply (erule use_valid)\n apply (wp schedule_if_partitionIntegrity[OF current_domains_distinct])\n apply (clarsimp simp: partitionIntegrity_refl)\n apply (drule ADT_A_if_reachable_invs_if)\n apply (clarsimp simp: invs_if_def Invs_def silc_inv_refl current_aag_def)\n done\nqed\n\nend\n\n\ncontext valid_initial_state begin\n\nlemma sub_big_steps_reachable:\n \"\\ (s', evlist') \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n system.reachable (ADT_A_if utf) s0 s \\\n \\ system.reachable (ADT_A_if utf) s0 s'\"\n apply (rule_tac s=s and js=evlist' in Step_system.reachable_execution[OF ADT_A_if_Step_system])\n apply assumption\n apply (drule sub_big_steps_Run)\n apply (clarsimp simp: execution_def image_def)\n apply (subst Bex_def)\n apply (simp only: steps_eq_Run)\n apply (rule_tac x=\"s'\" in exI)\n apply (rule conjI)\n apply (rule_tac x=s in exI)\n apply (clarsimp simp: system.reachable_def)\n apply (frule execution_invs)\n apply (frule invs_if_full_invs_if)\n apply (frule execution_restrict)\n apply (simp add: ADT_A_if_def)\n apply (simp add: ADT_A_if_def)\n done\n\nlemma sub_big_steps_not_PSched:\n \"\\ (s', blah) \\ sub_big_steps (ADT_A_if utf) big_step_R s; big_step_R\\<^sup>*\\<^sup>* s0 s; part s \\ PSched \\\n \\ part s' \\ PSched\"\n apply (drule tranclp_s0)\n apply (induct s' blah rule: sub_big_steps.induct)\n apply simp\n apply simp\n apply (simp add: part_def split: if_splits)\n apply (case_tac \"sys_mode_of s\", simp_all add: sys_mode_of_def)\n apply (case_tac \"sys_mode_of s'\", simp_all add: sys_mode_of_def)\n apply (case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def big_step_R_def split: if_splits)\n apply (rename_tac event)\n apply (case_tac event, simp_all)\n apply ((fastforce simp: ADT_A_if_def global_automaton_if_def)+)[2]\n apply (case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def big_step_R_def split: if_splits)\n apply (fastforce simp: ADT_A_if_def global_automaton_if_def)+\n apply (case_tac \"sys_mode_of t\", simp_all add: sys_mode_of_def)\n apply (clarsimp simp: ADT_A_if_def global_automaton_if_def kernel_exit_A_if_def split: if_splits)+\n done\n\nlemma reachable_Step':\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ data_type.Step (big_step_ADT_A_if utf) a \\\n \\ system.reachable (big_step_ADT_A_if utf) s0 s'\"\n apply (rule reachable_Step, assumption)\n apply (drule small_step_reachable)\n apply (frule ADT_A_if_reachable_full_invs_if)\n apply (drule ADT_A_if_reachable_step_restrict)\n apply (clarsimp simp: system.Step_def execution_def big_step_ADT_A_if_def\n Fin_big_step_adt Fin_ADT_if steps_eq_Run)\n apply (simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n apply (cases s)\n apply (case_tac a)\n apply blast\n done\n\nend\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma sub_big_steps_partitionIntegrity:\n \"\\ (t, as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n big_step_R\\<^sup>*\\<^sup>* s0 s; system.reachable (ADT_A_if utf) s0 s; part s \\ PSched \\\n \\ partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if t)\"\n apply (induct t as rule: sub_big_steps.induct)\n apply (simp add: partitionIntegrity_def globals_equiv_scheduler_refl\n silc_dom_equiv_def equiv_for_refl domain_fields_equiv_def)\n apply simp\n apply (erule partitionIntegrity_trans')\n apply (erule small_Step_partitionIntegrity)\n apply (blast intro: sub_big_steps_reachable)\n apply (rule sub_big_steps_not_PSched, simp+)\n done\n\nlemma Step_partitionIntegrity':\n \"\\ (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ()\\\n \\ system.reachable (big_step_ADT_A_if utf) s0 s \\ part s \\ PSched\n \\ partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if s')\"\n apply (simp add: Step_big_step_ADT_A_if)\n apply (erule big_steps.induct)\n apply (simp add: big_step_evmap_def)\n apply (intro impI | elim conjE)+\n apply (rule partitionIntegrity_trans')\n apply (erule sub_big_steps_partitionIntegrity)\n apply (simp add: reachable_def execution_def)\n apply (clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_if steps_eq_Run)\n apply (rule Run_big_steps_tranclp)\n apply (simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n apply (blast intro: small_step_reachable)\n apply assumption\n apply (erule small_Step_partitionIntegrity)\n apply (erule(1) sub_big_steps_reachable[OF _ small_step_reachable])\n apply (rule sub_big_steps_not_PSched, simp+)\n apply (simp add: reachable_def execution_def)\n apply (clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_if steps_eq_Run)\n apply (rule Run_big_steps_tranclp)\n apply (simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n by simp\n\nlemma Step_partitionIntegrity:\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) (); part s \\ PSched \\\n \\ partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if s')\"\n by (blast dest: Step_partitionIntegrity')\n\nlemma Step_cur_domain_unchanged:\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) (); part s \\ PSched \\\n \\ cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\"\n by (fastforce dest: Step_partitionIntegrity\n simp: partitionIntegrity_def domain_fields_equiv_def)\n\nlemma Step_current_aag_unchanged:\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) (); part s \\ PSched \\\n \\ current_aag (internal_state_if s') = current_aag (internal_state_if s)\"\n apply (simp add: current_aag_def)\n apply (metis Step_cur_domain_unchanged)\n done\n\n(* TOPLEVEL *)\nlemma integrity_part:\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag); u \\ PSched; part s \\ PSched \\\n \\ (s,s') \\ uwr u\"\n supply [[simp_depth_limit=0]] \\ \\speedup\\\n apply (simp add: uwr_def_cur[where s=s])\n apply (case_tac s, case_tac s', simp)\n apply (case_tac a, case_tac aa, simp)\n apply (rule partsSubjectAffects_bounds_subjects_affects)\n apply (rule current_domains_distinct)\n apply (fastforce dest: Step_partitionIntegrity)\n apply (fastforce dest: pas_refined_initial_aag_reachable simp: pas_refined_cur)\n apply (frule (2) pas_refined_current_aag'[OF _ Step_current_aag_unchanged[symmetric],\n OF reachable_Step']; force)\n apply (fastforce dest!: reachable_invs_if simp: invs_if_def Invs_def)\n apply (fastforce dest!: reachable_invs_if[OF reachable_Step'] simp: invs_if_def Invs_def)\n apply (fastforce dest!: reachable_invs_if simp: invs_if_def Invs_def)\n apply (fastforce dest!: reachable_invs_if[OF reachable_Step'] simp: invs_if_def Invs_def)\n apply (fastforce dest: silc_inv_initial_aag_reachable simp: silc_inv_cur)\n apply (frule Step_current_aag_unchanged[symmetric];simp)\n apply (fastforce dest: silc_inv_initial_aag_reachable[OF reachable_Step'] simp: silc_inv_cur)\n apply (rule pas_wellformed_cur)\n apply (simp add: current_aag_def)\n apply (fastforce dest!: reachable_invs_if domains_distinct[THEN pas_domains_distinct_inj]\n simp: invs_if_def Invs_def guarded_pas_domain_def\n guarded_is_subject_cur_thread_def current_aag_def)\n apply (frule Step_current_aag_unchanged[symmetric];simp)\n apply (fastforce dest!: reachable_invs_if[OF reachable_Step']\n domains_distinct[THEN pas_domains_distinct_inj]\n simp: invs_if_def Invs_def guarded_pas_domain_def\n guarded_is_subject_cur_thread_def current_aag_def)\n apply (rule partsSubjectAffects_bounds_those_subject_not_allowed_to_affect)\n apply (simp add: part_def partition_def current_aag_def split: if_split_asm)\n apply assumption\n done\n\nend\n\n\ncontext valid_initial_state begin\n\nlemma not_PSched:\n \"\\ (x, u) \\ policyFlows (pasPolicy initial_aag); u \\ PSched \\\n \\ x \\ PSched\"\n apply (erule contrapos_nn)\n apply simp\n apply (rule schedFlowsToAll)\n done\n\nlemma not_PSched_big_step_R:\n \"\\ part s \\ PSched; big_step_R s t \\\n \\ sys_mode_of s = KernelExit \\ interrupted_modes (sys_mode_of t)\"\n apply (clarsimp simp: part_def big_step_R_def sys_mode_of_def split: if_split_asm)\n apply (cases s, simp, case_tac b; simp)\n done\n\nlemma sub_big_steps_Nil:\n \"(s',[]) \\ sub_big_steps A R s \\ s' = s \\ \\ R s s\"\n by (erule sub_big_steps.cases; simp)\n\nlemma sub_big_steps_App:\n \"(s',as @ [a]) \\ sub_big_steps A R s\n \\ \\s'a. (s'a, as) \\ sub_big_steps A R s \\ (s'a, s') \\ data_type.Step A a \\ \\ R s s'\"\n by (erule sub_big_steps.cases; fastforce)\n\n(* FIXME: move to ADT_IF.thy *)\nlemma relation_preserved_across_sub_big_steps:\n \"\\ (s', as) \\ sub_big_steps A R s; (t', as') \\ sub_big_steps A R t; X s t; as' = as;\n \\sa ta sa' ta'. X sa ta \\\n (\\bs. (sa,bs) \\ sub_big_steps A R s \\ (sa',bs @ [()]) \\ sub_big_steps A R s) \\\n (\\cs. (ta,cs) \\ sub_big_steps A R t \\ (sa',cs @ [()]) \\ sub_big_steps A R s) \\\n (sa,sa') \\ data_type.Step A () \\ (ta,ta') \\ data_type.Step A ()\n \\ X sa' ta' \\\n \\ X s' t'\"\n apply hypsubst_thin\n apply (induct as arbitrary: s t s' t' rule: rev_induct)\n apply (drule sub_big_steps_Nil)+\n apply simp\n apply (frule_tac s=s in sub_big_steps_App)\n apply (frule_tac s=t in sub_big_steps_App)\n apply clarify\n apply (drule_tac x=s in meta_spec)\n apply (drule_tac x=t in meta_spec)\n apply (drule_tac x=s'a in meta_spec)\n apply (drule_tac x=s'aa in meta_spec)\n apply simp\n apply blast\n done\n\nend\n\n\n(* FIXME: move these next lemmas culminating in reads_respects_g\n for activate_thread and schedule into Schedule_IF or similar *)\nlemma set_thread_state_runnable_reads_respects_g:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n (valid_arch_state and K (runnable ts)) (set_thread_state t ts)\"\n apply (rule gen_asm_ev)\n apply (rule equiv_valid_guard_imp)\n apply (rule reads_respects_g[OF set_thread_state_runnable_reads_respects[OF domains_distinct]])\n apply assumption\n apply (rule doesnt_touch_globalsI)\n apply (wp set_thread_state_globals_equiv | simp)+\n done\n\nlemma globals_equiv_idle_thread_ptr:\n \"globals_equiv s t \\ idle_thread s= idle_thread t\"\n by (simp add: globals_equiv_def idle_equiv_def)\n\nlemma get_thread_state_reads_respects_g:\n \"reads_respects_g aag l (valid_idle and (\\s. is_subject aag t \\ t = idle_thread s))\n (get_thread_state t)\"\n apply (rule use_spec_ev)\n apply (case_tac \"t = idle_thread st\")\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply (drule_tac Q=\"\\rv s. s = st \\ idle rv\" in use_valid[OF _ gts_wp])\n apply (simp add: valid_idle_def)\n apply (clarsimp simp: pred_tcb_at_def obj_at_def)\n apply (drule_tac Q=\"\\rv s. s = ta \\ idle rv\" in use_valid[OF _ gts_wp])\n apply (simp add: valid_idle_def)\n apply (fastforce simp: pred_tcb_at_def obj_at_def reads_equiv_g_def globals_equiv_idle_thread_ptr)\n apply (simp add: pred_tcb_at_def obj_at_def)\n apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n apply (frule aag_can_read_self)\n apply (frule get_thread_state_reads_respects_g[simplified equiv_valid_def2 equiv_valid_2_def,\n rule_format, OF conjI, simplified]; fastforce)\n done\n\nlemmas set_scheduler_action_reads_respects_g =\n reads_respects_g[OF set_scheduler_action_reads_respects,\n OF doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF set_scheduler_action_globals_equiv]\n\nlemmas thread_get_reads_respects_g =\n reads_respects_g[OF thread_get_rev,\n OF doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF thread_get_inv]\n\nlemmas tcb_sched_action_reads_respects_g =\n reads_respects_g[OF tcb_sched_action_reads_respects,\n OF _ doesnt_touch_globalsI[where P=\"\\\"],\n simplified,\n OF _ tcb_sched_action_extended.globals_equiv]\n\nlemma set_tcb_queue_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag)\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n \\ (set_tcb_queue d prio queue)\"\n unfolding equiv_valid_def2 equiv_valid_2_def\n supply if_cong[cong]\n apply (clarsimp simp: set_tcb_queue_def bind_def modify_def put_def get_def)\n by ((rule conjI\n | rule affects_equiv_ready_queues_update reads_equiv_ready_queues_update, assumption\n | clarsimp simp: reads_equiv_g_def\n | fastforce elim!: affects_equivE reads_equivE\n simp: equiv_for_def globals_equiv_def idle_equiv_def)+)\n\nlemma set_tcb_queue_globals_equiv[wp]:\n \"set_tcb_queue d prio queue \\globals_equiv st\\\"\n by (simp add: set_tcb_queue_def modify_def | wp)+\n\n\ncontext Noninterference_1 begin\n\nlemma activate_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct pas\"\n shows \"reads_respects_g pas (l :: 'a subject_label)\n ((\\s. cur_thread s \\ idle_thread s \\ is_subject pas (cur_thread s)) and invs)\n activate_thread\"\n apply (simp add: activate_thread_def)\n apply (wp set_thread_state_runnable_reads_respects_g as_user_reads_respects_g\n get_thread_state_reads_respects_g gts_wp\n | wpc | simp add: det_setNextPC)+\n apply (clarsimp cong: conj_cong)\n apply (rule conjI)\n apply (blast intro: requiv_g_cur_thread_eq)\n apply (frule invs_valid_idle)\n apply simp\n apply (rule conjI)\n apply blast\n apply (rule impI)\n apply (clarsimp simp: pred_tcb_at_def obj_at_def valid_idle_def)\n apply (fastforce simp: det_getRestartPC)\n done\n\nlemma cur_thread_update_reads_respects_g':\n \"equiv_valid (reads_equiv_g aag)\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (affects_equiv aag l) \\ (modify (cur_thread_update (\\_. t)))\"\n apply (simp add: equiv_valid_def2)\n apply (rule modify_ev2)\n apply (clarsimp simp: reads_equiv_g_def reads_equiv_def2\n affects_equiv_def2 globals_equiv_def idle_equiv_def)\n apply (fastforce intro: states_equiv_for_sym\n dest: arch_globals_equiv_strengthener_thread_independent)\n done\n\nlemma tcb_sched_action_reads_respects_g':\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows\n \"equiv_valid (reads_equiv_g aag)\n (\\s s'. affects_equiv aag (l :: 'a subject_label) s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (\\s s'. affects_equiv aag l s s' \\\n arch_globals_equiv_strengthener (machine_state s) (machine_state s'))\n (pas_refined aag) (tcb_sched_action action thread)\"\n apply (simp add: tcb_sched_action_def get_tcb_queue_def)\n apply (subst gets_apply)\n apply (case_tac \"aag_can_read aag thread \\ aag_can_affect aag l thread\")\n apply (simp add: ethread_get_def)\n apply (wp set_tcb_queue_reads_respects_g')\n apply (rule_tac Q=\"\\s. pasObjectAbs aag thread \\ pasDomainAbs aag (tcb_domain rv)\"\n in equiv_valid_guard_imp)\n apply (wp gets_apply_ev')\n apply (clarsimp simp: reads_equiv_g_def)\n apply (elim reads_equivE affects_equivE equiv_forE)\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply metis (* only one that works *)\n apply (wp | simp)+\n apply (intro conjI impI allI\n | fastforce simp: get_etcb_def reads_equiv_g_def\n elim: reads_equivE affects_equivE equiv_forE)+\n apply (clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def split: option.splits)\n apply (erule_tac x=\"(thread, tcb_domain y)\" in ballE, force)\n apply (force intro: domtcbs simp: get_etcb_def)\n apply (simp add: equiv_valid_def2 ethread_get_def)\n apply (rule equiv_valid_rv_bind)\n apply (wp equiv_valid_rv_trivial', simp)\n apply (rule equiv_valid_2_bind)\n prefer 2\n apply (wp equiv_valid_rv_trivial, simp)\n apply (rule equiv_valid_2_bind)\n apply (rule_tac P=\"\\\" and P'=\"\\\" and L=\"{pasObjectAbs aag thread}\" and\n L'=\"{pasObjectAbs aag thread}\" in ev2_invisible')\n apply (blast | simp add: labels_are_invisible_def)+\n apply (rule set_tcb_queue_modifies_at_most)\n apply (rule set_tcb_queue_modifies_at_most)\n apply (rule doesnt_touch_globalsI | simp | wp)+\n apply (clarsimp simp: equiv_valid_2_def gets_apply_def get_def bind_def return_def\n labels_are_invisible_def)\n apply wpsimp+\n apply (clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def)\n apply (erule_tac x=\"(thread, tcb_domain y)\" in ballE)\n apply force\n apply (force intro: domtcbs simp: get_etcb_def)\n done\n\nlemma switch_to_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n (pas_refined aag and (\\s. is_subject aag t)) (switch_to_thread t)\"\n apply (simp add: switch_to_thread_def)\n apply (subst bind_assoc[symmetric])\n apply (rule equiv_valid_guard_imp)\n apply (rule bind_ev)\n apply (wp bind_ev_general cur_thread_update_reads_respects_g'\n tcb_sched_action_reads_respects_g' arch_switch_to_thread_reads_respects_g')\n apply (simp add: equiv_valid_def2)\n apply (rule_tac R'=\"\\\\\" in equiv_valid_2_bind)\n apply (rule assert_ev2 | simp)+\n apply (rule equiv_valid_rv_trivial, wp+)\n apply fastforce\n done\n\nlemma guarded_switch_to_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n (pas_refined aag and valid_idle and (\\s. is_subject aag t))\n (guarded_switch_to t)\"\n apply (simp add: guarded_switch_to_def)\n apply (wp switch_to_thread_reads_respects_g get_thread_state_reads_respects_g gts_wp)\n apply fastforce\n done\n\nlemma cur_thread_update_idle_reads_respects_g':\n \"reads_respects_g aag (l :: 'a subject_label) (\\s. t = idle_thread s) (modify (cur_thread_update (\\_. t)))\"\n apply (simp add: equiv_valid_def2)\n apply (rule modify_ev2)\n apply (clarsimp simp: reads_equiv_g_def reads_equiv_def2\n affects_equiv_def2 globals_equiv_def idle_equiv_def)\n apply (fastforce intro: states_equiv_for_sym arch_globals_equiv_threads_eq)\n done\n\nlemma switch_to_idle_thread_reads_respects_g[wp]:\n \"reads_respects_g aag (l :: 'a subject_label) \\ (switch_to_idle_thread)\"\n apply (simp add: switch_to_idle_thread_def)\n apply (wp cur_thread_update_idle_reads_respects_g')\n apply (fastforce simp: reads_equiv_g_def globals_equiv_idle_thread_ptr)\n done\n\nlemma choose_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n ((\\s. cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)) and\n einvs and valid_queues and pas_cur_domain aag and pas_refined aag)\n choose_thread\"\n apply (simp add: choose_thread_def)\n apply (wp guarded_switch_to_reads_respects_g)\n apply (rule conjI)\n apply (fastforce simp: reads_equiv_g_def reads_equiv_def)\n apply (rule conjI)\n apply (clarsimp simp: reads_equiv_g_def reads_equiv_def2\n states_equiv_for_def equiv_for_def disjoint_iff_not_equal)\n apply (metis reads_lrefl)\n apply (simp add: invs_valid_idle)\n (* everything from here clagged from Syscall_AC.choose_thread_respects *)\n apply (clarsimp simp: pas_refined_def)\n apply (clarsimp simp: tcb_domain_map_wellformed_aux_def)\n apply (erule_tac x=\"(hd (max_non_empty_queue (ready_queues s (cur_domain s))), cur_domain s)\"\n in ballE)\n apply (fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n apply (clarsimp simp: valid_queues_def is_etcb_at_def)\n apply (erule_tac x=\"cur_domain s\" in allE)\n apply (erule_tac x=\"Max {prio. ready_queues s (cur_domain s) prio \\ []}\" in allE)\n apply clarsimp\n apply (erule_tac x=\"hd (max_non_empty_queue (ready_queues s (cur_domain s)))\" in ballE)\n apply (clarsimp)\n apply (erule notE, rule domtcbs)\n apply force\n apply (simp add: etcb_at_def)\n apply (simp add: max_non_empty_queue_def)\n apply (erule_tac P=\"hd A \\ B\" for A B in notE)\n apply (rule Max_prop)\n apply force+\n done\n\nend\n\n\nlemma scheduler_action_switch_thread_is_subject:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"\\ valid_sched s; pas_cur_domain aag s; pas_refined aag s \\\n \\ \\x. scheduler_action s = switch_thread x \\ is_subject aag x\"\n apply (clarsimp simp: valid_sched_def valid_sched_action_2_def\n switch_in_cur_domain_2_def in_cur_domain_def)\n apply (clarsimp simp: pas_refined_def tcb_domain_map_wellformed_aux_def)\n apply (drule_tac x=\"(x,cur_domain s)\" in bspec)\n apply (clarsimp simp: etcb_at_def)\n apply (clarsimp simp: weak_valid_sched_action_2_def)\n apply (clarsimp simp: valid_etcbs_def)\n apply (drule_tac x=x in spec)\n apply (simp add: st_tcb_weakenE)\n apply (simp add: is_etcb_at_def split: option.splits)\n apply (fastforce elim: domains_of_state_aux.intros)\n apply (fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma gets_app_rewrite:\n \"(gets y >>= (\\x. g (f x))) = (gets (\\s. f (y s)) >>= g)\"\n apply (rule ext)\n apply (simp add: gets_def bind_def get_def return_def)\n done\n\nlemma gets_domain_time_zero_ev:\n \"equiv_valid_inv I A (\\s. domain_time s > 0) (gets (\\s. domain_time s = 0))\"\n apply (rule gets_ev'')\n apply fastforce\n done\n\nlemma reads_equiv_valid_g_inv_schedule_switch_thread_fastfail:\n \"reads_equiv_valid_g_inv (affects_equiv aag l) aag\n ((\\s. ct \\ it \\ is_subject aag (ct)))\n (schedule_switch_thread_fastfail ct it ct_prio target_prio)\"\n unfolding schedule_switch_thread_fastfail_def\n by (wpsimp wp: reads_respects_g_from_inv[OF reads_respects_ethread_get])\n\nlemma reads_respects_gets_ready_queues:\n \"reads_respects aag l (\\s. pasSubject aag \\ pasDomainAbs aag d)\n (gets (\\s. f (ready_queues s d)))\"\n apply (wp gets_ev'')\n apply (force elim: reads_equivE simp: equiv_for_def)\n done\n\nlemma reads_respects_is_highest_prio:\n \"reads_respects aag l (\\s. pasSubject aag \\ pasDomainAbs aag d)\n (gets (\\s. is_highest_prio d p s))\"\n by (fastforce simp: is_highest_prio_def intro: reads_respects_gets_ready_queues)\n\nlemma reads_respects_ethread_get_when:\n \"reads_respects aag l (\\_. b \\ is_subject aag thread) (ethread_get_when b f thread)\"\n apply (simp add: ethread_get_when_def)\n apply (rule conjI; clarsimp)\n apply (rule reads_respects_ethread_get)\n apply wp\n done\n\ntext \\strengthening of @{thm ArchSyscall_AC.valid_sched_action_switch_subject_thread}\\\nlemma valid_sched_action_switch_is_subject:\n assumes domains_distinct: \"pas_domains_distinct aag\"\n shows \"\\ scheduler_action s = switch_thread t ; valid_sched_action s ;\n valid_etcbs s ; pas_refined aag s ; pas_cur_domain aag s \\\n \\ is_subject aag t\"\n by (fastforce dest: valid_sched_action_switch_subject_thread\n domains_distinct[THEN pas_domains_distinct_inj])\n\n\ncontext Noninterference_1 begin\n\nlemma schedule_choose_new_thread_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n ((\\s. domain_time s \\ 0) and einvs and pas_cur_domain aag and pas_refined aag and\n (\\s. (cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s))))\n schedule_choose_new_thread\"\n apply (simp add: schedule_choose_new_thread_def )\n apply (subst gets_app_rewrite[where y=domain_time and f=\"\\x. x = 0\"])+\n apply (wp gets_domain_time_zero_ev set_scheduler_action_reads_respects_g\n choose_thread_reads_respects_g ev_pre_cont[where f=next_domain]\n hoare_pre_cont[where f=next_domain] when_ev)\n apply (clarsimp simp: valid_sched_def word_neq_0_conv)\n done\n\nlemma schedule_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label)\n ((\\s. cur_thread s \\ idle_thread s \\ is_subject aag (cur_thread s)) and einvs and\n pas_cur_domain aag and (\\s. domain_time s \\ 0) and pas_refined aag)\n schedule\"\n supply ethread_get_wp[wp del]\n supply set_scheduler_action_wp[wp del]\n supply conj_cong[cong del] (* knowing the scheduler action messes with valid_sched_2 *)\n apply (simp add: schedule_def)\n apply wp\n apply wpc\n (* resume current thread *)\n apply wp[1]\n prefer 2\n (* choose new thread *)\n apply ((wp set_scheduler_action_reads_respects_g tcb_sched_action_reads_respects_g\n schedule_choose_new_thread_reads_respects_g when_ev\n | wpc | simp)+)[1]\n (* now switch_thread case *)\n apply (wpsimp wp: schedule_choose_new_thread_reads_respects_g enqueue_thread_queued\n set_scheduler_action_reads_respects_g tcb_sched_action_reads_respects_g\n set_scheduler_action_cnt_valid_sched)+\n (* tcb_sched_action tcb_sched_append *)\n apply (wp append_thread_queued set_scheduler_action_reads_respects_g\n guarded_switch_to_reads_respects_g\n reads_respects_g_from_inv[OF reads_respects_is_highest_prio]\n reads_equiv_valid_g_inv_schedule_switch_thread_fastfail)+\n (* fastfail calculation *)\n apply (wpsimp wp: reads_respects_g_from_inv[OF reads_respects_ethread_get]\n reads_respects_g_from_inv[OF reads_respects_ethread_get_when]\n when_ev gts_wp tcb_sched_action_reads_respects_g\n tcb_sched_action_enqueue_valid_blocked_except\n get_thread_state_reads_respects_g\n | wp (once) hoare_drop_imp)+\n apply (clarsimp simp: invs_valid_idle)\n apply (intro allI conjI impI; (elim conjE)?;\n ((fastforce simp: valid_sched_def valid_sched_action_switch_is_subject[OF domains_distinct]\n dest!: reads_equiv_gD intro!: globals_equiv_idle_thread_ptr))?)\n apply (tactic \\distinct_subgoals_tac\\)\n apply (all \\(erule requiv_g_cur_thread_eq)?\\)\n apply (simp_all add: requiv_sched_act_eq[OF reads_equiv_gD[THEN conjunct1]])\n apply (all \\(solves \\clarsimp elim!: st_tcb_weakenE\\)?\\)\n apply (all \\(solves \\clarsimp simp: not_cur_thread_def\\)?\\)\n apply (clarsimp simp: valid_sched_def valid_sched_action_def weak_valid_sched_action_def)+\n done\n\nlemma schedule_if_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct pas\"\n shows \"reads_respects_g pas (l :: 'a subject_label)\n (einvs and pas_cur_domain pas and guarded_pas_domain pas\n and (\\s. domain_time s > 0) and pas_refined pas) (schedule_if tc)\"\n apply (simp add: schedule_if_def)\n apply (wp schedule_reads_respects_g activate_thread_reads_respects_g)\n apply (rule_tac Q=\"\\rv s. guarded_pas_domain pas s \\ invs s \\ pas_cur_domain pas s\"\n in hoare_strengthen_post)\n apply (wp schedule_guarded_pas_domain schedule_cur_domain\n | simp add: guarded_pas_domain_def\n | fastforce dest: domains_distinct[THEN pas_domains_distinct_inj])+\n done\n\nlemma globals_equiv_globals_equiv_scheduler[elim]:\n \"globals_equiv s t \\ globals_equiv_scheduler s t\"\n by (auto simp: globals_equiv_def globals_equiv_scheduler_def)\n\nend\n\n\nlemma sameFor_current_partition_sys_mode_of_eq:\n \"\\ (s, t) \\ sameFor_subject (pasPolicy initial_aag) (pasObjectAbs initial_aag)\n (pasIRQAbs initial_aag) (pasASIDAbs initial_aag)\n (pasDomainAbs initial_aag) a;\n label_of (the_elem (pasDomainAbs initial_aag (cur_domain (internal_state_if t)))) = a;\n OrdinaryLabel a \\ pasDomainAbs initial_aag (cur_domain (internal_state_if s)) \\\n \\ sys_mode_of s = sys_mode_of t\"\n apply (simp add: sameFor_subject_def2)\n apply clarify\n apply (erule impE)\n apply fastforce\n apply simp\n done\n\nlemma flow_then_affect:\n \"(Partition x, Partition l) \\ policyFlows (pasPolicy initial_aag)\n \\ Partition l \\ partsSubjectAffects (pasPolicy initial_aag) x\"\n by (erule policyFlows.cases, simp_all add: partsSubjectAffects_def)\n\n\ncontext valid_initial_state begin\n\nlemma do_user_op_if_reads_respects_g:\n \"reads_respects_g aag l (pas_refined aag and valid_vspace_objs_if and einvs and\n is_subject aag \\ cur_thread and det_inv InUserMode tc and ct_running)\n (do_user_op_if utf tc)\"\n apply (rule equiv_valid_guard_imp)\n apply (rule do_user_op_reads_respects_g[where P=\"\\tc. einvs and\n det_inv InUserMode tc and ct_running\"])\n using utf_det apply fastforce\n apply simp\n apply (rule ct_running_not_idle)\n apply simp\n apply (simp add: invs_valid_idle)\n done\n\nlemma uwr_part_sys_mode_of_eq:\n \"\\ (s,t) \\ uwr (part s); part t = part s; part s \\ PSched \\\n \\ sys_mode_of s = sys_mode_of t\"\n apply (simp add: part_def split: if_split_asm)\n apply (simp add: partition_def)\n apply (cut_tac pas_wellformed_noninterference_silc\n [OF policy_wellformed, where d=\"cur_domain (internal_state_if s)\"])\n apply (case_tac \"the_elem (pasDomainAbs initial_aag (cur_domain (internal_state_if s)))\")\n apply (simp add: uwr_def sameFor_def)\n apply (erule (1) sameFor_current_partition_sys_mode_of_eq)\n apply (metis the_subject_of_aag_domain subject_current_aag)\n apply (metis the_label_of_domain_exists)\n done\n\nlemma uwr_reads_equiv_f_g_affects_equiv:\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr (Partition l); invs_if s; invs_if t;\n (part s, Partition l) \\ policyFlows (pasPolicy initial_aag); part s \\ PSched \\\n \\ reads_equiv_f_g (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if t) \\\n affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel l)\n (internal_state_if s) (internal_state_if t)\"\n apply (rule sameFor_reads_f_g_affects_equiv)\n apply (simp add: current_aag_def)\n apply (simp add: invs_if_def Invs_def)\n apply blast\n apply (clarsimp simp: uwr_def part_def current_aag_def partition_def split: if_splits)\n apply (simp add: part_def split: if_splits add: partition_def current_aag_def flow_then_affect)\n apply (clarsimp simp: uwr_def part_def current_aag_def partition_def split: if_splits)\n done\n\nend\n\n\nlemma check_active_irq_if_reads_respects_g:\n \"reads_respects_g aag (l :: 'a subject_label)\n (invs and only_timer_irq_inv irq st) (check_active_irq_if tc)\"\n apply (simp add: check_active_irq_if_def)\n apply (wp dmo_getActiveIRQ_reads_respects_g| blast)+\n done\n\nlemma check_active_irq_if_reads_respects_f_g:\n \"reads_respects_f_g aag (l :: 'a subject_label)\n (silc_inv aag st and invs and only_timer_irq_inv irq st') (check_active_irq_if tc)\"\n apply (rule equiv_valid_guard_imp)\n apply (rule reads_respects_f_g'[where Q=\"\\\", OF check_active_irq_if_reads_respects_g])\n apply (wp check_active_irq_if_wp)\n apply fastforce+\n done\n\nlemma partitionIntegrity_cur_domain:\n \"partitionIntegrity aag s s' \\ cur_domain s = cur_domain s'\"\n by (clarsimp simp: partitionIntegrity_def domain_fields_equiv_def)\n\nlemma use_ev:\n \"\\ equiv_valid I A B P f; (rv,s') \\ fst (f s); (rv',t') \\ fst (f t); P s; P t; I s t; A s t \\\n \\ rv' = rv \\ I s' t' \\ B s' t'\"\n by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\n\ncontext valid_initial_state begin\n\nlemma uwr_part_sys_mode_of_user_context_of_eq:\n \"\\ (s,t) \\ uwr (part s); part s \\ PSched \\\n \\ sys_mode_of s = sys_mode_of t \\\n (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of t)\"\n by (clarsimp simp: part_def uwr_partition_if split: if_splits)\n\nlemma uwr_PSched_cur_domain:\n \"(s,t) \\ uwr PSched \\ cur_domain (internal_state_if s) = cur_domain (internal_state_if t)\"\n by (fastforce simp: uwr_def sameFor_def sameFor_scheduler_def domain_fields_equiv_def)\n\nlemma uwr_PSched_cur_domain':\n \"(((sx, s), sm), ((tx, t), tm)) \\ uwr PSched \\ cur_domain s = cur_domain t\"\n by (fastforce dest: uwr_PSched_cur_domain)\n\nlemma part_not_PSched_sys_mode_of_not_KernelSchedule_True:\n \"part s \\ PSched \\ sys_mode_of s \\ KernelSchedule True\"\n apply (erule contrapos_nn)\n apply (simp add: part_def)\n done\n\nend\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma reads_equiv_f_g_affects_equiv_uwr:\n \"\\ reads_equiv_f_g (current_aag (internal_state_if s))\n (internal_state_if s') (internal_state_if t');\n affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel a)\n (internal_state_if s') (internal_state_if t');\n (part s, Partition a) \\ policyFlows (pasPolicy initial_aag); part s \\ PSched;\n silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s');\n (s,t) \\ uwr PSched;\n partitionIntegrity (current_aag (internal_state_if s))\n (internal_state_if s) (internal_state_if s');\n partitionIntegrity (current_aag (internal_state_if t))\n (internal_state_if t) (internal_state_if t');\n sys_mode_of s' = sys_mode_of t'; user_context_of s' = user_context_of t' \\\n \\ (s', t') \\ uwr (Partition a) \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply (frule_tac s=\"internal_state_if s\" in partitionIntegrity_cur_domain)\n apply (subgoal_tac \"current_aag (internal_state_if s) = current_aag (internal_state_if s')\")\n apply (case_tac s', case_tac t')\n apply (case_tac aa, case_tac aaa)\n apply (rule conjI)\n apply simp\n apply (drule (1) reads_g_affects_equiv_sameFor[OF conjI])\n apply (simp add: current_aag_def)\n apply (fastforce)\n apply (simp add: current_aag_def)\n apply (rule flow_then_affect)\n apply (simp add: part_def partition_def split: if_splits)\n apply (clarsimp simp: uwr_def current_aag_def)\n apply assumption\n apply (rule conjI)\n apply (clarsimp simp: uwr_def sameFor_def sameFor_scheduler_def)\n apply (clarsimp simp: reads_equiv_f_g_def reads_equiv_def silc_dom_equiv_def current_aag_def\n globals_equiv_idle_thread_ptr globals_equiv_globals_equiv_scheduler)\n apply (fastforce simp: domain_fields_equiv_def partitionIntegrity_def)\n apply (drule sameFor_reads_equiv_f_g)\n apply (fastforce simp: invs_if_def Invs_def)\n apply (fastforce simp: current_aag_def)\n apply (simp add: uwr_def part_def partition_def current_aag_def split: if_splits)\n apply (simp add: current_aag_def)\n done\n\nlemma check_active_irq_A_if_confidentiality_helper:\n notes reads_respects_irq = use_ev[OF check_active_irq_if_reads_respects_f_g[where st=s0_internal\n and st'=s0_internal\n and irq=timer_irq]]\n shows\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s; invs_if t;\n silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s');\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if; ((fst t),y,(fst t')) \\ check_active_irq_A_if \\\n \\ x = y \\ (snd s' = f x \\ snd t' = f y\n \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s))\"\n apply (frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply (clarsimp simp: check_active_irq_A_if_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac u, simp_all)\n apply (frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (match premises in \"s = ((_, p), _)\" and \"t = ((_, q), _)\"\n and H: \"(_, _) \\ fst (check_active_irq_if _ p)\"\n for p q \\ \\rule revcut_rl[OF reads_respects_irq[where s=p and t=q, OF H]]\\)\n apply assumption\n apply (simp add: invs_if_def Invs_def)\n apply (elim conjE)\n apply assumption\n apply (simp add: invs_if_def Invs_def)\n apply (simp only: current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply simp\n apply fastforce\n apply simp\n apply (rule impI)\n apply (rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply (erule use_valid[OF _ check_active_irq_if_partitionIntegrity])\n apply (rule partitionIntegrity_refl)\n apply simp\n apply (erule use_valid[OF _ check_active_irq_if_partitionIntegrity])\n apply (rule partitionIntegrity_refl)\n apply (simp add: sys_mode_of_def)\n apply (simp add: user_context_of_def)\n done\n\nlemma check_active_irq_A_if_confidentiality:\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s; invs_if t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if; ((fst t),y,(fst t')) \\ check_active_irq_A_if \\\n \\ x = y \\ (snd s' = f x \\ snd t' = f y\n \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s))\"\n apply (subgoal_tac \"silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s')\")\n apply (blast dest!: check_active_irq_A_if_confidentiality_helper)\n apply (case_tac s', simp)\n apply (case_tac a, simp)\n apply (clarsimp simp: check_active_irq_A_if_def)\n apply (erule use_valid)\n apply (wp check_active_irq_if_wp)\n apply (fastforce simp: invs_if_def Invs_def current_aag_def)\n done\n\nlemma check_active_irq_A_if_confidentiality':\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if; ((fst t),y,(fst t')) \\ check_active_irq_A_if;\n snd s' = (case x of None \\ InUserMode | Some xx \\ KernelEntry Interrupt);\n snd t' = (case y of None \\ InUserMode | Some yy \\ KernelEntry Interrupt) \\\n \\ x = y \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n by (blast dest: check_active_irq_A_if_confidentiality)\n\nlemma check_active_irq_A_if_confidentiality'':\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,(fst s')) \\ check_active_irq_A_if; ((fst t),y,(fst t')) \\ check_active_irq_A_if;\n snd s' = (case x of None \\ InIdleMode | Some xx \\ KernelEntry Interrupt);\n snd t' = (case y of None \\ InIdleMode | Some yy \\ KernelEntry Interrupt) \\\n \\ x = y \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n by (blast dest: check_active_irq_A_if_confidentiality)\n\nlemma check_active_irq_A_if_retval_eq:\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),x,s') \\ check_active_irq_A_if; ((fst t),y,t') \\ check_active_irq_A_if \\\n \\ x = y\"\n apply simp\n apply (drule_tac s'=\"(s',undefined)\" and t'=\"(t',undefined)\" and u=u\n in check_active_irq_A_if_confidentiality, simp+)\n apply (elim conjE, assumption)\n done\n\nlemmas do_user_op_if_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified,\n OF do_user_op_if_reads_respects_g,\n OF do_user_op_silc_inv]\n\nlemma partitionIntegrity_irq_state_update[simp]:\n \"partitionIntegrity aag y (y\\machine_state := (machine_state y)\\irq_state := X\\\\)\"\n apply (cut_tac s=y and aag=aag in partitionIntegrity_refl)\n apply (clarsimp simp: partitionIntegrity_def integrity_subjects_def domain_fields_equiv_def\n globals_equiv_scheduler_def silc_dom_equiv_def equiv_for_def)\n done\n\nlemma invs_if_Invs:\n \"invs_if s\n \\ Invs (internal_state_if s) \\\n det_inv (sys_mode_of s) (cur_thread_context_of s) (internal_state_if s)\"\n by (simp add: invs_if_def)\n\nlemma do_user_op_A_if_confidentiality:\n notes read_respects_irq =\n use_ev[OF check_active_irq_if_reads_respects_f_g[where st=s0_internal\n and st'=s0_internal\n and irq=timer_irq\n and aag=\"current_aag (internal_state_if s)\"]]\n and read_respects_user_op =\n use_ev[OF do_user_op_if_reads_respects_f_g[where aag=\"current_aag (internal_state_if s)\"\n and st=\"s0_internal\"]]\n shows\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s; invs_if t;\n invs_if s'; invs_if t'; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode;\n (fst s, None, s_aux) \\ check_active_irq_A_if; (fst t, None, t_aux) \\ check_active_irq_A_if;\n (s_aux, xx, fst s') \\ do_user_op_A_if utf; (t_aux, yy, fst t') \\ do_user_op_A_if utf;\n snd s' = f xx; snd t' = f yy \\\n \\ xx = yy \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n including no_pre\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply (frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply (clarsimp simp: check_active_irq_A_if_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac u, simp_all)\n apply (frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (match premises in \"s = ((_,p),_)\" and \"t = ((_,q),_)\"\n and H: \"(_,_) \\ fst (check_active_irq_if _ p)\"\n for p q \\ \\rule revcut_rl[OF read_respects_irq[where t=q, OF H]]\\)\n apply assumption\n apply (clarsimp dest!: invs_if_Invs simp: Invs_def)\n apply (drule uwr_PSched_cur_domain)\n apply (clarsimp dest!: invs_if_Invs simp: Invs_def)\n subgoal by (clarsimp simp: current_aag_def)\n apply simp\n apply fastforce\n apply (simp add: do_user_op_A_if_def | elim exE conjE)+\n apply (match premises in \"s_aux = (_,p)\" and \"t_aux = (_,q)\"\n and H: \"(_,_) \\ fst (do_user_op_if _ _ p)\"\n for p q \\ \\rule revcut_rl[OF read_respects_user_op[where t=q, OF H]]\\)\n apply assumption\n apply (match premises in \"s = ((_,p),_)\" and H: \"(_,_) \\ fst (check_active_irq_if _ p)\"\n for p \\ \\rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\\)\n apply (simp (no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def)\n apply metis\n apply simp\n apply (erule use_valid)\n apply (wp check_active_irq_if_wp)\n apply (clarsimp simp: invs_if_def Invs_def)\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply (match premises in \"t_aux = (_,q)\" and H: \"(_,q) \\ fst (check_active_irq_if _ _)\"\n for q \\ \\rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\\)\n apply (simp (no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def)\n apply metis\n apply simp\n apply (erule_tac s'=yc in use_valid)\n apply (wp check_active_irq_if_wp)\n apply (clarsimp simp: invs_if_def Invs_def current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply (match premises in \"t = ((_,q),_)\" and H: \"invs q\" for q \\\n \\rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\\)\n apply assumption\n apply (match premises in \"t = ((_,q),_)\" for q \\\n \\rule revcut_rl[OF current_aag_def[where t=q]]\\)\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply simp\n apply simp\n apply simp\n apply (rule reads_equiv_f_g_affects_equiv_uwr)\n apply ((clarsimp simp: Invs_def dest!: invs_if_Invs; rule TrueI)+)\n apply (simp add: invs_if_def Invs_def)\n apply (simp add: invs_if_def Invs_def)\n apply (erule use_valid[OF _ do_user_op_if_partitionIntegrity])\n apply (erule use_valid[OF _ check_active_irq_if_wp])\n apply clarsimp\n apply (frule (1) ct_running_not_idle[OF _ invs_valid_idle])\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply simp\n apply (erule_tac s'=s'aa in use_valid[OF _ do_user_op_if_partitionIntegrity])\n apply (erule_tac s'=yc in use_valid[OF _ check_active_irq_if_wp])\n apply (clarsimp simp: invs_if_def Invs_def)\n apply (match premises in \"t = ((_,q),_)\" and H: \"invs q\" for q \\\n \\rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\\)\n apply assumption\n apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running)\n apply (simp add: sys_mode_of_def)\n apply (simp add: user_context_of_def)\n done\n\nlemma do_user_op_A_if_confidentiality':\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s;\n invs_if t; invs_if s'; invs_if t'; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode;\n ((fst s),None,s_aux) \\ check_active_irq_A_if; ((fst t),None,t_aux) \\ check_active_irq_A_if;\n (s_aux,xx,fst s') \\ do_user_op_A_if utf; (t_aux,yy,fst t') \\ do_user_op_A_if utf;\n snd s' = (case xx of None \\ InUserMode | Some xxx \\ KernelEntry xxx);\n snd t' = (case yy of None \\ InUserMode | Some yyy \\ KernelEntry yyy) \\\n \\ xx = yy \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n by (rule do_user_op_A_if_confidentiality, simp+)\n\nend\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemmas schedule_if_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified, OF schedule_if_reads_respects_g,\n OF _ schedule_if_silc_inv]\n\nlemma kernel_schedule_if_confidentiality:\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s; invs_if t;\n invs_if s'; invs_if t'; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),(),(fst s')) \\ kernel_schedule_if;\n ((fst t),(),(fst t')) \\ kernel_schedule_if; snd s' = snd t' \\\n \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=1]] \\ \\speedup\\\n apply (frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply (frule part_not_PSched_sys_mode_of_not_KernelSchedule_True)\n apply (clarsimp simp: kernel_schedule_if_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac u, simp_all)\n apply (frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (simp split: prod.splits)\n apply (case_tac s', case_tac t')\n apply (simp add: split_paired_all)\n apply (frule_tac s=x2 and t=bb and s2=x2\n in use_ev[OF schedule_if_reads_respects_f_g\n [where st=s0_internal, OF current_domains_distinct]])\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def current_aag_def)\n apply (clarsimp simp: invs_if_def Invs_def)\n apply (drule uwr_PSched_cur_domain)\n apply (clarsimp simp: current_aag_def)\n apply simp\n apply fastforce\n apply simp\n apply (rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply (fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply (erule use_valid[OF _ schedule_if_partitionIntegrity[OF current_domains_distinct]])\n apply (clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def silc_inv_refl)\n apply simp\n apply (erule use_valid[OF _ schedule_if_partitionIntegrity[OF current_domains_distinct]])\n apply (clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def silc_inv_refl)\n apply (simp add: sys_mode_of_def)\n apply (simp add: user_context_of_def)\n done\n\nlemma kernel_schedule_if_confidentiality':\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s;\n invs_if t; invs_if s'; invs_if t'; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; user_modes (sys_mode_of s);\n ((fst s),(),(fst s')) \\ kernel_schedule_if;\n ((fst t),(),(fst t')) \\ kernel_schedule_if; snd s' = snd t' \\\n \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n by (blast dest: kernel_schedule_if_confidentiality)\n\nend\n\n\nlemma thread_set_tcb_context_update_runnable_globals_equiv:\n \"\\globals_equiv st and st_tcb_at runnable t and invs\\\n thread_set (tcb_arch_update (arch_tcb_context_set uc)) t\n \\\\_. globals_equiv st\\\"\n apply (rule hoare_pre)\n apply (rule thread_set_context_globals_equiv)\n apply clarsimp\n apply (frule invs_valid_idle)\n apply (fastforce simp: valid_idle_def pred_tcb_at_def obj_at_def)\n done\n\nlemma thread_set_tcb_context_update_reads_respects_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_g aag (l :: 'a subject_label) (st_tcb_at runnable t and invs)\n (thread_set (tcb_arch_update (arch_tcb_context_set uc)) t)\"\n apply (rule equiv_valid_guard_imp)\n apply (rule reads_respects_g)\n apply (rule thread_set_reads_respects[OF domains_distinct])\n apply (rule doesnt_touch_globalsI)\n apply (wp thread_set_tcb_context_update_runnable_globals_equiv)\n apply simp+\n done\n\nlemma thread_set_tcb_context_update_silc_inv:\n \"thread_set (tcb_arch_update (arch_tcb_context_set f)) t \\silc_inv aag st\\\"\n apply (rule thread_set_silc_inv)\n apply (simp add: tcb_cap_cases_def)\n done\n\nlemmas thread_set_tcb_context_update_reads_respects_f_g =\n reads_respects_f_g'[where Q=\"\\\", simplified,\n OF thread_set_tcb_context_update_reads_respects_g,\n OF _ thread_set_tcb_context_update_silc_inv]\n\nlemma kernel_entry_if_reads_respects_f_g:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_f_g aag l (ct_active and silc_inv aag st and einvs\n and only_timer_irq_inv irq st'\n and schact_is_rct and pas_refined aag\n and pas_cur_domain aag and guarded_pas_domain aag\n and K (ev \\ Interrupt \\ \\ pasMaySendIrqs aag))\n (kernel_entry_if ev tc)\"\n apply (simp add: kernel_entry_if_def)\n apply (wp handle_event_reads_respects_f_g thread_set_tcb_context_update_reads_respects_f_g\n thread_set_tcb_context_update_silc_inv only_timer_irq_inv_pres[where P=\"\\\" and Q=\"\\\"]\n thread_set_invs_trivial thread_set_not_state_valid_sched thread_set_pas_refined\n | simp add: tcb_cap_cases_def arch_tcb_update_aux2)+\n apply (elim conjE)\n apply (frule (1) ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n apply (clarsimp simp: ct_in_state_def runnable_eq_active)\n apply (rule conjI)\n apply (fastforce dest: requiv_g_cur_thread_eq simp: reads_equiv_f_g_def)\n apply (clarsimp simp: guarded_pas_domain_def)\n apply (fastforce simp: only_timer_irq_inv_def invs_valid_idle\n dest: domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma reads_respects_f_g_2':\n \"\\ equiv_valid_2 (reads_equiv_g aag) (affects_equiv aag l) (affects_equiv aag l) (=) P P' f f';\n \\silc_inv aag st and Q\\ f \\\\_. silc_inv aag st\\;\n \\silc_inv aag st and Q'\\ f' \\\\_. silc_inv aag st\\ \\\n \\ equiv_valid_2 (reads_equiv_f_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (silc_inv aag st and P and Q) (silc_inv aag st and P' and Q') f f'\"\n apply (clarsimp simp: equiv_valid_def2 equiv_valid_2_def reads_equiv_f_g_def reads_equiv_g_def)\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (subst conj_commute, rule conjI, fastforce)\n apply (rule silc_dom_equiv_trans)\n apply (rule silc_dom_equiv_sym)\n apply (rule silc_inv_silc_dom_equiv)\n apply (erule (1) use_valid, fastforce)\n apply (rule silc_inv_silc_dom_equiv)\n apply (erule (1) use_valid, fastforce)\n done\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma kernel_call_A_if_confidentiality:\n notes active_from_running[simp]\n shows \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u; invs_if s; invs_if t;\n invs_if s'; invs_if t'; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched; ((fst s),x,(fst s')) \\ kernel_call_A_if e;\n ((fst t),y,(fst t')) \\ kernel_call_A_if e; e \\ Interrupt;\n sys_mode_of s = KernelEntry e; sys_mode_of t = KernelEntry e; snd s' = f x; snd t' = f y \\\n \\ x = y \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=3]] \\ \\speedup\\\n apply (frule (1) uwr_part_sys_mode_of_user_context_of_eq)\n apply (frule part_not_PSched_sys_mode_of_not_KernelSchedule_True)\n apply (clarsimp simp: kernel_call_A_if_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac u, simp_all)\n apply (frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (frule_tac s=b and t=ba and s2=b\n in use_ev[OF kernel_entry_if_reads_respects_f_g\n [where st=s0_internal, OF current_domains_distinct]])\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def schact_is_rct_def current_aag_def)\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def schact_is_rct_def\n current_aag_eqI[OF uwr_PSched_cur_domain'])\n apply (simp add: current_aag_def)\n apply simp\n apply fastforce\n apply simp\n apply (rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply (fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply (erule use_valid[OF _ kernel_entry_if_partitionIntegrity])\n apply (clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def\n silc_inv_refl schact_is_rct_def guarded_pas_domain_def\n ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n (* XXX: the conjI is needed here -- metis won't instantiate a schematic var *)\n apply (rule conjI)\n apply (metis the_subject_of_aag_domain)\n apply assumption\n apply simp\n apply (erule use_valid[OF _ kernel_entry_if_partitionIntegrity])\n apply (clarsimp simp: partitionIntegrity_refl invs_if_def Invs_def current_aag_def\n silc_inv_refl schact_is_rct_def guarded_pas_domain_def\n ct_active_cur_thread_not_idle_thread[OF invs_valid_idle])\n (* XXX: and here *)\n apply (rule conjI)\n apply (metis the_subject_of_aag_domain)\n apply assumption\n apply (simp add: sys_mode_of_def)\n apply (simp add: user_context_of_def)\n done\n\nlemma kernel_call_A_if_confidentiality':\n \"\\ (XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag); part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_call_A_if e; ((fst t),y,(fst t')) \\ kernel_call_A_if e;\n e \\ Interrupt; sys_mode_of s = KernelEntry e; sys_mode_of t = KernelEntry e;\n snd s' = (case x of True \\ KernelPreempted | _ \\ KernelSchedule False);\n snd t' = (case y of True \\ KernelPreempted | _ \\ KernelSchedule False) \\\n \\ x = y \\ (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n by (blast dest: kernel_call_A_if_confidentiality)\n\nlemma thread_get_tcb_context_reads_respects_g_helper:\n \"equiv_valid_rv_inv (reads_equiv_g aag) (affects_equiv aag l)\n (\\rv rv'. arch_tcb_context_get (tcb_arch rv) = arch_tcb_context_get (tcb_arch rv'))\n (\\s. t = idle_thread s \\ is_subject aag t)\n (gets (get_tcb t) >>= assert_opt)\"\n apply (clarsimp simp: equiv_valid_2_def in_monad reads_equiv_g_def)\n apply (erule disjE)\n apply (frule globals_equiv_idle_thread_ptr)\n apply (simp add: get_tcb_def split: kernel_object.splits option.splits)\n apply (fastforce simp: globals_equiv_def idle_equiv_def)\n apply (fastforce dest: requiv_get_tcb_eq)\n done\n\nlemma thread_get_tcb_context_reads_respects_g:\n \"reads_respects_g aag l\n (\\s. t = idle_thread s \\ is_subject aag t) (thread_get (arch_tcb_context_get o tcb_arch) t)\"\n apply (simp add: thread_get_def gets_the_def equiv_valid_def2)\n apply (rule_tac W=\"\\ rv rv'. arch_tcb_context_get (tcb_arch rv) = arch_tcb_context_get (tcb_arch rv')\"\n and Q=\"\\\\\" in equiv_valid_rv_bind)\n apply (rule thread_get_tcb_context_reads_respects_g_helper)\n apply (rule return_ev2, simp)\n apply (rule hoare_post_taut)\n done\n\n(* this is a little more complicated because the context isn't\n guaranteed to be equal when called, so we need an equiv_valid_2\n*)\nlemma kernel_exit_if_reads_respects_g_2:\n \"equiv_valid_2 (reads_equiv_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s))\n (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s))\n (kernel_exit_if tc) (kernel_exit_if tc')\"\n apply (simp add: kernel_exit_if_def)\n apply (fold equiv_valid_def2)\n apply (wp thread_get_tcb_context_reads_respects_g)\n apply (fastforce dest: requiv_g_cur_thread_eq)\n done\n\nlemma kernel_exit_if_reads_respects_f_g_2:\n \"equiv_valid_2 (reads_equiv_f_g aag) (affects_equiv aag l) (affects_equiv aag l) (=)\n (silc_inv aag st and (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s)))\n (silc_inv aag st and (\\s. cur_thread s = idle_thread s \\ is_subject aag (cur_thread s)))\n (kernel_exit_if tc) (kernel_exit_if tc')\"\n apply (rule equiv_valid_2_guard_imp)\n apply (rule reads_respects_f_g_2'[where Q=\"\\\" and Q'=\"\\\", OF kernel_exit_if_reads_respects_g_2])\n apply (wp | simp | blast)+\n done\n\nend\n\n\nlemma use_ev2:\n \"\\ equiv_valid_2 I A B R P P' f f'; (rv,s') \\ fst (f s);\n (rv',t') \\ fst (f' t); P s; P' t; I s t; A s t \\\n \\ R rv rv' \\ I s' t' \\ B s' t'\"\n by (fastforce simp: equiv_valid_2_def)\n\nlemma reads_equiv_f_g_reads_equiv_g:\n \"reads_equiv_f_g aag s t \\ reads_equiv_g aag s t\"\n by (fastforce simp: reads_equiv_f_g_def reads_equiv_g_def)\n\n\ncontext valid_initial_state begin\n\nlemma reads_equiv_g_ct_running_eq:\n \"\\ reads_equiv_g (current_aag bb) bd be; Invs bd; Invs be; current_aag bb = current_aag bd \\\n \\ ct_running bd = ct_running be\"\n apply (clarsimp simp: reads_equiv_f_g_def)\n apply (clarsimp simp: reads_equiv_g_def)\n apply (frule globals_equiv_idle_thread_ptr)\n apply (frule requiv_cur_thread_eq)\n apply (case_tac \"cur_thread bd = idle_thread bd\")\n apply (simp add: Invs_def)\n apply (elim conjE)\n apply (drule invs_valid_idle)+\n apply (clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def valid_idle_def)\n apply (clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def)\n apply (fastforce simp: Invs_def guarded_pas_domain_def simp: current_aag_def\n dest: is_subject_kheap_eq domains_distinct[THEN pas_domains_distinct_inj])\n done\n\nlemma partitionIntegrity_part_unchanged:\n \"\\partitionIntegrity aag (internal_state_if s) (internal_state_if s'); part s \\ PSched;\n part s' \\ PSched\\ \\ part s' = part s\"\n apply (simp add: part_def split: if_splits\n add: partition_def partitionIntegrity_def domain_fields_equiv_def)\n done\n\nlemma big_step_R_rtranclp:\n \"system.reachable (big_step_ADT_A_if utf) s0 s\n \\ big_step_R\\<^sup>*\\<^sup>* s0 s\"\n apply (simp add: reachable_def execution_def)\n apply (clarsimp simp: big_step_ADT_A_if_def Fin_big_step_adt Fin_ADT_if steps_eq_Run)\n apply (rule Run_big_steps_tranclp)\n apply (simp add: big_step_ADT_A_if_def big_step_adt_def Init_ADT_if)\n done\n\nlemma sub_big_steps_strict_prefix:\n \"(s', as @ bs) \\ sub_big_steps A R s \\\n \\t. (t, as) \\ sub_big_steps A R s\"\n apply (induct bs arbitrary: s s' rule: rev_induct)\n apply fastforce\n apply (subst (asm) append_assoc[symmetric])\n apply (drule sub_big_steps_App)\n apply blast\n done\n\nlemma uwr_part_sys_mode_of_eq':\n \"\\(s,t) \\ uwr (part x); part s = part x; part t = part x; part x \\ PSched\\\n \\ sys_mode_of s = sys_mode_of t\"\n apply (fastforce intro: uwr_part_sys_mode_of_eq)\n done\n\nend\n\n\nlemma app_Cons:\n \"xs @ (a # b) = (xs @ [a]) @ b\"\n by simp\n\nlemma sys_mode_of_eq_big_step_R_contradiction:\n \"\\ sys_mode_of s = sys_mode_of t; sys_mode_of s' = sys_mode_of t';\n big_step_R s s'; \\ big_step_R t t' \\\n \\ False\"\n apply (simp add: big_step_R_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac s', case_tac t', simp_all)\n apply auto\n done\n\nlemma unit_list_as_replicate:\n \"(as::unit list) = replicate (length as) ()\"\n apply (induct as, auto)\n done\n\nlemma unit_lists_unequal:\n \"(as::unit list) \\ (as'::unit list) \\ as < as' \\ as' < as\"\n apply (simp add: less_list_def' strict_prefix_def)\n apply (case_tac \"length as \\ length as'\")\n apply (rule disjI2)\n apply (subst unit_list_as_replicate[where as=as])\n apply (subst unit_list_as_replicate[where as=as'])\n apply (clarsimp simp: prefix_def)\n apply (rule_tac x=\"replicate (length as - length as') ()\" in exI)\n apply (subst replicate_add[symmetric])\n apply simp\n apply (rule disjI1)\n apply (subst unit_list_as_replicate[where as=as])\n apply (subst unit_list_as_replicate[where as=as'])\n apply (clarsimp simp: prefix_def)\n apply (rule_tac x=\"replicate (length as' - length as) ()\" in exI)\n apply (subst replicate_add[symmetric])\n apply simp\n done\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma kernel_exit_A_if_confidentiality:\n \"\\(s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_exit_A_if;\n ((fst t),y,(fst t')) \\ kernel_exit_A_if;\n sys_mode_of s = KernelExit; sys_mode_of t = KernelExit;\n snd s' = f x; snd t' = f y\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply (clarsimp simp: kernel_exit_A_if_def)\n apply (case_tac s, case_tac t, simp_all)\n apply (case_tac u, simp_all)\n apply (frule (6) uwr_reads_equiv_f_g_affects_equiv)\n apply (simp split: prod.splits)\n apply (case_tac \"fst s'\", simp)\n apply (case_tac \"fst t'\", simp)\n apply (frule_tac s=x2 and t=x2a and aag1=\"current_aag x2\"\n in use_ev2[OF kernel_exit_if_reads_respects_f_g_2[where st=s0_internal]])\n apply assumption\n apply (clarsimp simp: invs_if_def Invs_def current_aag_def guarded_pas_domain_def)\n apply (metis the_subject_of_aag_domain)\n apply (clarsimp simp: invs_if_def Invs_def)\n apply (drule uwr_PSched_cur_domain)\n apply (clarsimp simp: current_aag_def guarded_pas_domain_def)\n apply (metis the_subject_of_aag_domain)\n apply simp\n apply fastforce\n apply simp\n apply (elim conjE)\n apply (drule state_unchanged[OF kernel_exit_if_inv])+\n apply (subgoal_tac \"ct_running bb = ct_running bc\")\n apply simp\n apply (rule reads_equiv_f_g_affects_equiv_uwr)\n apply simp+\n apply (fastforce simp: invs_if_def Invs_def)\n apply simp\n apply simp\n apply (rule partitionIntegrity_refl)\n apply simp\n apply (rule partitionIntegrity_refl)\n apply (simp add: sys_mode_of_def)\n apply (simp add: user_context_of_def)\n apply (frule_tac bd=bb in reads_equiv_g_ct_running_eq[OF reads_equiv_f_g_reads_equiv_g])\n apply (fastforce simp: invs_if_def)\n apply (fastforce simp: invs_if_def)\n apply (fastforce simp: reads_equiv_f_g_def reads_equiv_def current_aag_def)\n apply simp\n done\n\nlemma kernel_exit_A_if_confidentiality':\n \"\\(XX, YY) \\ uwr PSched; XX = s; YY = t; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n invs_if s; invs_if t; invs_if s'; invs_if t';\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched;\n ((fst s),x,(fst s')) \\ kernel_exit_A_if;\n ((fst t),y,(fst t')) \\ kernel_exit_A_if;\n sys_mode_of s = KernelExit; sys_mode_of t = KernelExit;\n snd s' = f x; snd t' = f y\\ \\\n x = y \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply (blast dest: kernel_exit_A_if_confidentiality)\n done\n\nlemma small_Step_confidentiality_part_not_PSched:\n shows\n \"\\(s, s') \\ Simulation.Step (ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (ADT_A_if utf) ();\n (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (ADT_A_if utf) s0 s;\n system.reachable (ADT_A_if utf) s0 t;\n (part s, u) \\ policyFlows (pasPolicy initial_aag);\n part s \\ PSched; u \\ PSched\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s)\"\n apply (frule schedIncludesCurrentDom)\n apply (frule uwr_part_sys_mode_of_eq, simp+)\n apply (frule_tac s=s in ADT_A_if_reachable_invs_if)\n apply (frule_tac s=t in ADT_A_if_reachable_invs_if)\n apply (frule(2) Step_system.reachable_Step[where s=s, OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (frule(2) Step_system.reachable_Step[where s=t, OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (frule_tac s=s' in ADT_A_if_reachable_invs_if)\n apply (frule_tac s=t' in ADT_A_if_reachable_invs_if)\n apply (case_tac \"sys_mode_of s\")\n (* InUserMode *)\n apply ((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply (drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u],simp+)\n apply (drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply (drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(ad,bd)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply (drule do_user_op_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(ad,bd)\"\n in check_active_irq_A_if_retval_eq, simp+)\n apply (drule check_active_irq_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n (* InIdleMode *)\n apply ((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply (drule check_active_irq_A_if_confidentiality'[\n where s=s and t=t and s'=s' and t'=t' and u=u], simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\" in check_active_irq_A_if_retval_eq,\n simp+)\n apply (drule_tac s=s and t=t and u=u and s'=\"(aa,ba)\" in check_active_irq_A_if_retval_eq,\n simp+)\n apply (drule check_active_irq_A_if_confidentiality''[\n where s=s and t=t and s'=s' and t'=t' and u=u],simp+)\n (* KernelEntry event -- where event \\ Interrupt *)\n apply (rename_tac event)\n apply (subgoal_tac \"event \\ Interrupt\")\n prefer 2\n apply (case_tac t, simp)\n apply (case_tac event, (fastforce simp: part_def split: if_splits)+)[1]\n apply ((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply (drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply (drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply (drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n apply (drule kernel_call_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n (* KernelPreempted *)\n apply (simp add: part_def)\n (* KernelSchedule bool -- where \\ bool *)\n apply ((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply (drule kernel_schedule_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n (* KernelExit *)\n apply ((simp add: Step_ADT_A_if_def_global_automaton_if global_automaton_if_def\n split: if_splits\n | intro impI allI\n | elim exE conjE disjE\n | simp_all add: not_schedule_modes_KernelEntry)+)[1]\n apply (drule kernel_exit_A_if_confidentiality'[where s=s and t=t and s'=s' and t'=t' and u=u],\n simp+)\n done\n\nlemma sub_big_steps_not_PSched_confidentiality_part:\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (t', as) \\ sub_big_steps (ADT_A_if utf) big_step_R t;\n (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n u \\ PSched; (part s, u) \\ policyFlows (pasPolicy initial_aag);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 t; part s \\ PSched\\ \\\n (s', t') \\ uwr u \\ (s', t') \\ uwr PSched \\ (s', t') \\ uwr (part s) \\\n part s' = part s\"\n apply (frule_tac s=s and t=t and X=\"\\s t. part s \\ PSched \\ ((s, t) \\ uwr PSched \\\n (s, t) \\ uwr (part s) \\ (s, t) \\ uwr u \\\n system.reachable (ADT_A_if utf) s0 s \\\n system.reachable (ADT_A_if utf) s0 t)\"\n in relation_preserved_across_sub_big_steps)\n apply (simp add: small_step_reachable del: split_paired_All)+\n apply (intro impI allI | elim conjE)+\n apply (rename_tac sx tx sx' tx')\n apply (subgoal_tac \"part sx = part s \\ part sx' = part s\")\n apply (frule_tac u=u and s=sx and t=tx in small_Step_confidentiality_part_not_PSched)\n apply (simp add: small_step_reachable)+\n apply (fastforce intro: Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if'',\n rotated])\n apply (elim exE conjE)\n apply (frule schedIncludesCurrentDom)\n apply (frule_tac s'=sx in partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply (blast intro: big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply assumption\n apply assumption\n apply assumption\n apply (rule conjI, assumption)\n apply (rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply assumption\n apply (blast intro: big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply assumption\n apply assumption\n apply (rule sub_big_steps_not_PSched)\n apply assumption\n apply (blast intro: big_step_R_rtranclp)\n apply assumption\n apply (frule_tac s'=s' in partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply (blast intro: big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply assumption\n apply assumption\n apply blast\n apply simp\n done\n\nlemma non_PSched_steps_run_in_lock_step':\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (s', t) \\ data_type.Step (ADT_A_if utf) (); big_step_R s t;\n (s'a, asa) \\ sub_big_steps (ADT_A_if utf) big_step_R sa;\n (s'a, ta) \\ data_type.Step (ADT_A_if utf) (); big_step_R sa ta;\n (s, sa) \\ uwr PSched; (s, sa) \\ uwr (part s);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 sa; part s \\ PSched;\n asa < as\\ \\ False\"\n apply (erule strict_prefixE')\n apply (simp, subst (asm) app_Cons)\n apply (drule sub_big_steps_strict_prefix)\n apply (erule exE, rename_tac s'ab)\n apply (frule sub_big_steps_App)\n apply (erule exE, rename_tac s'aa)\n (* s'ab and ta need to be equivalent with respect to part s, which means their\n modes must be equal. The modes between sa and s are equal too,\n which means that big_step_R sa ta and \\ big_step_R s s'ab is a contradiction *)\n apply (elim conjE)\n apply (frule_tac s=sa in sub_big_steps_reachable, simp add: small_step_reachable)\n apply (frule_tac s=s and s'=s'aa in sub_big_steps_reachable, simp add: small_step_reachable)\n apply (frule_tac s=sa and t=s and u=\"part s\" in sub_big_steps_not_PSched_confidentiality_part)\n apply ((fastforce simp: uwr_sym dest: schedIncludesCurrentDom\n simp: refl_onD[OF policyFlows_refl, simplified])+)[9]\n apply (elim conjE)\n (*apply (simp del: split_paired_All)*)\n apply (frule_tac s=s'aa and t=s'a and u=\"part sa\" in small_Step_confidentiality_part_not_PSched)\n apply ((fastforce simp: uwr_sym dest: schedIncludesCurrentDom\n simp: refl_onD[OF policyFlows_refl, simplified])+)[9] (* slowish *)\n apply (elim conjE)\n apply (subgoal_tac \"part ta = part s\")\n apply (drule schedIncludesCurrentDom)+\n apply (rule_tac s=sa and t=s in sys_mode_of_eq_big_step_R_contradiction)\n apply (fastforce intro: uwr_part_sys_mode_of_eq'[symmetric])\n prefer 2\n apply assumption\n prefer 2\n apply assumption\n apply (fastforce intro: uwr_part_sys_mode_of_eq'[symmetric])\n apply (rule sym)\n apply (rule trans[rotated])\n apply (erule schedIncludesCurrentDom)\n apply (rule sym, rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply assumption\n apply (erule big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply simp+\n apply (rule sub_big_steps_not_PSched, assumption)\n apply (erule big_step_R_rtranclp)\n apply simp\n done\n\nlemma non_PSched_steps_run_in_lock_step:\n \"\\(s', as) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n (s', t) \\ data_type.Step (ADT_A_if utf) (); big_step_R s t;\n (s'a, asa) \\ sub_big_steps (ADT_A_if utf) big_step_R sa;\n (s'a, ta) \\ data_type.Step (ADT_A_if utf) (); big_step_R sa ta;\n (s, sa) \\ uwr PSched; (s, sa) \\ uwr (part s);\n system.reachable (big_step_ADT_A_if utf) s0 s;\n system.reachable (big_step_ADT_A_if utf) s0 sa;\n part s \\ PSched\\\n \\ asa = as\"\n apply (case_tac \"asa = as\", assumption)\n apply (drule unit_lists_unequal)\n apply (erule disjE)\n apply (drule non_PSched_steps_run_in_lock_step', simp+)\n apply (frule schedIncludesCurrentDom[symmetric])\n apply (drule_tac as=asa and asa=as in non_PSched_steps_run_in_lock_step', (simp add: uwr_sym)+)\n done\n\nlemma confidentiality_part_not_PSched:\n \"\\(s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ()\\ \\\n (s, t) \\ uwr PSched \\ (s, t) \\ uwr (part s) \\ (s, t) \\ uwr u \\\n system.reachable (big_step_ADT_A_if utf) s0 s \\\n system.reachable (big_step_ADT_A_if utf) s0 t \\\n (part s, u) \\ policyFlows (pasPolicy initial_aag) \\\n part s \\ PSched \\ u \\ PSched \\\n (s', t') \\ uwr u\"\n apply (simp add: Step_big_step_ADT_A_if)\n apply (erule big_steps.induct)+\n apply (intro impI | elim conjE)+\n apply (subgoal_tac \"asa = as\")\n apply (drule_tac X=\"\\s t. (s, t) \\ uwr PSched \\ (s, t) \\ uwr (part s) \\\n (s, t) \\ uwr u \\\n system.reachable (ADT_A_if utf) s0 s \\\n system.reachable (ADT_A_if utf) s0 t \\\n (part s, u) \\ policyFlows (pasPolicy initial_aag) \\\n part s \\ PSched\" in relation_preserved_across_sub_big_steps)\n apply assumption\n apply (fastforce simp: small_step_reachable)\n apply assumption\n apply (simp del: split_paired_All)\n apply (thin_tac \"(x,y) \\ data_type.Step A b\" for x y A b\n | thin_tac \"big_step_R a b\" for a b)+\n apply (intro allI impI | elim conjE)+\n apply (rename_tac x_s x_t x_s' x_t')\n apply (subgoal_tac \"part x_s' = part x_s\")\n apply (simp del: split_paired_All)\n apply (frule_tac u=u and s=x_s and t=x_t in small_Step_confidentiality_part_not_PSched)\n apply (simp add: small_step_reachable)+\n apply (fastforce intro: Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if'',\n rotated])\n apply (elim exE)\n apply (rule trans)\n apply (rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply blast\n apply (erule big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply simp+\n apply (rule sub_big_steps_not_PSched)\n apply blast\n apply (erule big_step_R_rtranclp)\n apply simp\n apply (rule sym)\n apply (rule partitionIntegrity_part_unchanged[OF sub_big_steps_partitionIntegrity])\n apply blast\n apply (erule big_step_R_rtranclp)\n apply (erule small_step_reachable)\n apply (simp+)[3]\n apply (elim conjE)\n apply simp\n apply (drule_tac s=s' and t=s'a and u=u in small_Step_confidentiality_part_not_PSched)\n apply (simp+)[10]\n apply (fastforce dest: non_PSched_steps_run_in_lock_step)\n done\n\nend\n\n\nlemma try_some_magic:\n \"(\\x. y = Some x \\ P x) = ((\\x. y = Some x) \\ P (the y))\"\n by auto\n\nlemma thread_set_as_user2:\n \"thread_set (tcb_arch_update (arch_tcb_context_set uc)) t = as_user t (modify (\\_. uc))\"\nproof -\n have P: \"\\f. det (modify f)\"\n by (simp add: modify_def)\n thus ?thesis\n apply (simp add: as_user_def P thread_set_def)\n apply (clarsimp simp: select_f_def simpler_modify_def bind_def\n image_def fun_cong[OF arch_tcb_update_aux2])\n done\nqed\n\nlemma handle_preemption_agnostic_tc:\n \"\\P Q uc uc'. \\P\\ handle_preemption_if uc \\\\_. Q\\ \\ \\P\\ handle_preemption_if uc' \\\\_. Q\\\"\n apply (clarsimp simp add: handle_preemption_if_def bind_assoc[symmetric])\n apply (erule bind_return_ign)\n done\n\n\ncontext Noninterference_1 begin\n\nlemma preemption_interrupt_scheduler_invisible:\n assumes domains_distinct[wp]: \"pas_domains_distinct (aag :: 'a subject_label PAS)\"\n shows \"equiv_valid_2 (scheduler_equiv aag) (scheduler_affects_equiv aag l)\n (scheduler_affects_equiv aag l) (\\r r'. r = uc \\ snd r' = uc')\n (einvs and pas_refined aag and guarded_pas_domain aag\n and domain_sep_inv False st and silc_inv aag st'\n and (\\s. irq_masks_of_state st = irq_masks_of_state s)\n and (\\s. ct_idle s \\ uc = idle_context s)\n and (\\s. \\ reads_scheduler_cur_domain aag l s))\n (einvs and pas_refined aag and guarded_pas_domain aag\n and domain_sep_inv False st and silc_inv aag st'\n and (\\s. irq_masks_of_state st = irq_masks_of_state s)\n and (\\s. ct_idle s \\ uc' = idle_context s)\n and (\\s. \\ reads_scheduler_cur_domain aag l s))\n (handle_preemption_if uc) (kernel_entry_if Interrupt uc')\"\n apply (simp add: kernel_entry_if_def handle_preemption_if_def getActiveIRQ_no_non_kernel_IRQs)\n apply (rule equiv_valid_2_bind_right)\n apply (rule equiv_valid_2_bind_right)\n apply (simp add: liftE_def bind_assoc)\n apply (simp only: option.case_eq_if)\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (simp add: when_def split del: if_split)\n apply (subst if_swap)\n apply (simp split del: if_split)\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\" and Q=\"\\\\\" and Q'=\"\\\\\"])\n apply (rule return_ev2)\n apply simp\n apply (rule equiv_valid_2)\n apply (wp handle_interrupt_reads_respects_scheduler[where st=st] | simp)+\n apply (rule equiv_valid_2)\n apply (rule dmo_getActive_IRQ_reads_respect_scheduler)\n apply (wp dmo_getActiveIRQ_return_axiom[simplified try_some_magic]\n | simp add: imp_conjR arch_tcb_update_aux2\n | elim conjE\n | intro conjI\n | wp (once) hoare_drop_imps)+\n apply (subst thread_set_as_user2)\n apply (wp guarded_pas_domain_lift)\n apply ((simp add: arch_tcb_update_aux2 | wp | force)+)[7]\n apply (fastforce simp: silc_inv_not_cur_thread cur_thread_idle guarded_pas_domain_def)+\n done\n\nlemma handle_preemption_reads_respects_scheduler:\n assumes domains_distinct[wp]: \"pas_domains_distinct (aag :: 'a subject_label PAS)\"\n shows\n \"reads_respects_scheduler aag l (einvs and pas_refined aag and guarded_pas_domain aag\n and domain_sep_inv False st and silc_inv aag st'\n and (\\s. irq_masks_of_state st = irq_masks_of_state s))\n (handle_preemption_if uc)\"\n apply (simp add: handle_preemption_if_def)\n apply (wp when_ev handle_interrupt_reads_respects_scheduler\n dmo_getActiveIRQ_return_axiom[simplified try_some_magic]\n dmo_getActive_IRQ_reads_respect_scheduler\n | simp add: imp_conjR| wp (once) hoare_drop_imps)+\n apply force\n done\n\nlemmas handle_preemption_reads_respects_scheduler_2 =\n agnostic_to_ev2[OF handle_preemption_agnostic_tc handle_preemption_context\n handle_preemption_reads_respects_scheduler]\n\nlemma kernel_entry_scheduler_equiv_2:\n assumes domains_distinct[wp]: \"pas_domains_distinct (aag :: 'a subject_label PAS)\"\n shows \"equiv_valid_2 (scheduler_equiv aag) (scheduler_affects_equiv aag l)\n (scheduler_affects_equiv aag l) (\\r r'. snd r = uc \\ snd r' = uc')\n (einvs and pas_refined aag and guarded_pas_domain aag\n and domain_sep_inv False st and silc_inv aag st'\n and (\\s. irq_masks_of_state st = irq_masks_of_state s)\n and (\\s. ct_idle s \\ uc = idle_context s)\n and (\\s. reads_scheduler_cur_domain aag l s \\ uc = uc'))\n (einvs and pas_refined aag and guarded_pas_domain aag\n and domain_sep_inv False st and silc_inv aag st'\n and (\\s. irq_masks_of_state st = irq_masks_of_state s)\n and (\\s. ct_idle s \\ uc' = idle_context s)\n and (\\s. reads_scheduler_cur_domain aag l s \\ uc = uc'))\n (kernel_entry_if Interrupt uc) (kernel_entry_if Interrupt uc')\"\n apply (simp add: kernel_entry_if_def)\n apply (simp add: bind_assoc[symmetric])\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (rule_tac P=\"\\\" and P'=\"\\\" in return_ev2)\n apply simp\n apply (rule equiv_valid_2_bind_pre[where R'=\"(=)\"])\n apply (rule equiv_valid_2)\n apply simp\n apply (wp del: no_irq add: handle_interrupt_reads_respects_scheduler[where st=st]\n dmo_getActive_IRQ_reads_respect_scheduler\n | wpc\n | simp add: imp_conjR all_conj_distrib arch_tcb_update_aux2\n | wp (once) hoare_drop_imps)+\n apply (rule context_update_cur_thread_snippit)\n apply (wp thread_set_invs_trivial guarded_pas_domain_lift\n thread_set_pas_refined thread_set_not_state_valid_sched\n | simp add: tcb_cap_cases_def arch_tcb_update_aux2)+\n apply (fastforce simp: silc_inv_not_cur_thread cur_thread_idle)+\n done\n\nend\n\n\ncontext valid_initial_state begin\n\nlemma interrupt_step:\n assumes interrupt:\n \"\\r. (r,internal_state_if s')\n \\ fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s))\n \\ sys_mode_of s = KernelEntry Interrupt \\ (sys_mode_of s' = KernelSchedule True)\n \\ snd r = user_context_of s \\ snd r = user_context_of s'\n \\ cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\n \\ P\"\n assumes preemption:\n \"\\r. (r,internal_state_if s')\n \\ fst (handle_preemption_if (user_context_of s) (internal_state_if s))\n \\ sys_mode_of s = KernelPreempted \\ sys_mode_of s' = KernelSchedule True\n \\ r = user_context_of s \\ r = user_context_of s'\n \\ cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\n \\ P\"\n shows \"\\ interrupted_modes (sys_mode_of s); (s,s') \\ data_type.Step (ADT_A_if utf) () \\ \\ P\"\n apply (insert interrupt preemption)\n apply atomize\n apply (case_tac s, clarsimp)\n apply (rename_tac uc i_s mode)\n apply (case_tac mode ; clarsimp)\n subgoal for uc i_s\n apply (clarsimp simp: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_call_A_if_def\n kernel_handle_preemption_if_def del: notI)\n apply (frule use_valid[OF _ kernel_entry_context] ; clarsimp)\n apply (frule_tac P1=\"\\x. x = cur_domain i_s\" in use_valid[OF _ kernel_entry_if_cur_domain])\n apply auto\n done\n subgoal for uc i_s\n apply (clarsimp simp: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_call_A_if_def\n kernel_handle_preemption_if_def del: notI)\n apply (frule use_valid[OF _ handle_preemption_context] ; clarsimp)\n apply (frule_tac P1=\"\\x. x = cur_domain i_s\" in use_valid[OF _ handle_preemption_if_cur_domain])\n apply auto\n done\n done\n\nlemma irq_masks_constant':\n \"\\ system.reachable (ADT_A_if utf) s0 s1; i_s1 = internal_state_if s1 \\\n \\ irq_masks_of_state i_s1 = irq_masks_of_state (internal_state_if s0)\"\n apply simp\n apply (rule Step_system.reachable_induct[OF ADT_A_if_Step_system,rotated,rotated], rule refl)\n apply (rule trans)\n prefer 2\n apply assumption\n apply (rule ADT_A_if_Step_irq_masks, simp add: Step_ADT_A_if')\n apply (rule ADT_A_if_reachable_invs_if,assumption)\n apply simp\n done\n\nlemmas irq_masks_constant = irq_masks_constant'[OF small_step_reachable]\n\nlemma internal_state_s0: \"internal_state_if s0 = s0_internal\"\n by (simp add: s0_def)\n\nend\n\n\n(* FIXME: clarify the following comment *)\n(*Lets pretend PSched is labeled with SilcLabel*)\nfun label_for_partition where\n \"label_for_partition (Partition a) = (OrdinaryLabel a)\"\n | \"label_for_partition PSched = SilcLabel\"\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma uwr_scheduler_affects_equiv:\n \"\\ (s,s') \\ uwr PSched; (s,s') \\ uwr u; invs_if s; invs_if s' \\\n \\ scheduler_equiv initial_aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv initial_aag (label_for_partition u)\n (internal_state_if s) (internal_state_if s')\"\n apply (simp add: uwr_def)\n apply (case_tac u)\n apply simp\n apply (rule sameFor_scheduler_affects_equiv)\n apply (simp add: invs_if_def Invs_def)+\n apply (rule context_conjI)\n apply (rule sameFor_scheduler_equiv,simp+)\n apply (rule SilcLabel_affects_scheduler_equiv)\n apply (rule sameFor_scheduler_equiv,simp)\n done\n\nlemma scheduler_affects_equiv_uwr:\n assumes schedeq:\n \"scheduler_equiv initial_aag (internal_state_if s) (internal_state_if s') \\\n scheduler_affects_equiv initial_aag (label_for_partition u)\n (internal_state_if s) (internal_state_if s')\"\n assumes imodes: \"interrupted_modes (sys_mode_of s) = interrupted_modes (sys_mode_of s')\"\n assumes smodes: \"scheduler_modes (sys_mode_of s) = scheduler_modes (sys_mode_of s')\"\n assumes dom_context:\n \"reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\n \\ (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of s') \\\n sys_mode_of s = sys_mode_of s'\"\n shows \"(s,s') \\ uwr u\"\n apply (case_tac u)\n prefer 2\n apply simp\n apply (simp add: uwr_def)\n apply (rule schedule_reads_affects_equiv_sameFor_PSched')\n apply (simp add: schedeq imodes smodes)+\n apply (insert schedeq dom_context)\n apply (case_tac \"reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\")\n apply clarsimp\n apply (frule_tac s=\"internal_state_if s\" and mode=\"sys_mode_of s\" and uc=\"user_context_of s\"\n and uc'=\"user_context_of s'\" and aag=\"initial_aag\"\n in schedule_reads_affects_equiv_sameFor, simp, simp)\n apply (simp add: uwr_def user_context_of_def sys_mode_of_def)\n apply (case_tac s)\n apply fastforce\n apply simp\n apply (clarsimp simp: scheduler_equiv_def scheduler_affects_equiv_def sameFor_def\n sameFor_subject_def uwr_def silc_dom_equiv_def reads_scheduler_def\n domain_fields_equiv_def\n intro: globals_equiv_from_scheduler\n split: if_split_asm)\n apply (case_tac s)\n apply clarsimp\n apply (case_tac s')\n apply (clarsimp simp: disjoint_iff_not_equal)\n apply metis\n done\n\nlemma cur_domain_reads:\n \"(s,s') \\ uwr u\n \\ reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\n \\ (user_modes (sys_mode_of s) \\ user_context_of s = user_context_of s') \\\n sys_mode_of s = sys_mode_of s'\"\n by (cases u) (auto simp: reads_scheduler_def uwr_def sameFor_def sameFor_subject_def)\n\nlemmas domain_can_read_context = cur_domain_reads[THEN conjunct1]\nlemmas domain_can_read_context' = cur_domain_reads[OF uwr_sym, THEN conjunct1]\nlemmas domain_can_read_sys_mode = cur_domain_reads[THEN conjunct2]\nlemmas domain_can_read_sys_mode' = cur_domain_reads[OF uwr_sym, THEN conjunct2]\n\nlemma equiv_valid_2E:\n assumes ev: \"equiv_valid_2 I A B R P P' f g\"\n assumes f: \"(a,s') \\ fst (f s)\"\n assumes g: \"(b,t') \\ fst (g t)\"\n assumes I: \"I s t \\ A s t\"\n assumes P: \"P s\"\n assumes P': \"P' t\"\n assumes Q: \"I s' t' \\ B s' t' \\ R a b \\ S\"\n shows S\n apply (insert ev)\n apply (clarsimp simp: equiv_valid_2_def)\n apply (drule_tac x=s in spec)\n apply (drule_tac x=t in spec)\n apply (simp add: I P P')\n apply (drule bspec[OF _ f],simp)\n apply (drule bspec[OF _ g],simp)\n apply (rule Q,simp+)\n done\n\nlemma ev2_sym:\n assumes symI: \"\\x y. I x y \\ I y x\"\n assumes symA: \"\\x y. A x y \\ A y x\"\n assumes symB: \"\\x y. B x y \\ B y x\"\n assumes symR: \"\\x y. R x y \\ R' y x\"\n shows \"equiv_valid_2 I A B R P' P f' f \\ equiv_valid_2 I A B R' P P' f f'\"\n apply (clarsimp simp: equiv_valid_2_def)\n apply (blast intro: symA symB symI symR)\n done\n\nlemma scheduler_step_1_confidentiality:\n notes blob = invs_if_def Invs_def sys_mode_of_def\n silc_inv_cur pas_refined_cur guarded_pas_domain_cur internal_state_s0\n domain_can_read_context domain_can_read_context'\n domain_can_read_sys_mode'[simplified sys_mode_of_def]\n domain_can_read_sys_mode[simplified sys_mode_of_def]\n assumes uwr: \"(s,t) \\ uwr PSched\" \"(s,t) \\ uwr u\"\n assumes step_s: \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes step_t: \"(t,t') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes reach_s: \"system.reachable (ADT_A_if utf) s0 s\"\n assumes reach_t: \"system.reachable (ADT_A_if utf) s0 t\"\n shows \"interrupted_modes (sys_mode_of s) \\ (s',t') \\ uwr u\"\n supply [[simp_depth_limit=2]] \\ \\speedup\\\n apply (insert uwr step_s step_t)\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_s])\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_t])\n apply (cut_tac irq_masks_constant'[OF reach_s, OF refl])\n apply (cut_tac irq_masks_constant'[OF reach_t, OF refl])\n apply (subgoal_tac \"interrupted_modes (sys_mode_of t)\")\n apply (rule_tac s=s and s'=s' in interrupt_step,simp_all)\n apply (rule_tac s=t and s'=t' in interrupt_step,simp_all)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF kernel_entry_scheduler_equiv_2\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and l=\"label_for_partition u\",\n OF domains_distinct]], assumption, assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule equiv_valid_2E\n [where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF ev2_sym[where R'=\"\\r r'. r' = user_context_of t \\ snd r = user_context_of s\",\n OF _ _ _ _ preemption_interrupt_scheduler_invisible\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and l=\"label_for_partition u\"\n and uc=\"user_context_of t\" and uc'=\"user_context_of s\",\n OF domains_distinct],\n OF scheduler_equiv_sym scheduler_affects_equiv_sym\n scheduler_affects_equiv_sym, simplified]])\n apply (fastforce+)[2]\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n (* FIXME: manual frule *)\n apply (clarsimp simp: blob)\n (* this restores normal form for reads_scheduler_cur_domain *)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context[where u = u])\n apply (frule domain_can_read_context'[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def])\n apply force\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context'[where u = u])\n apply (frule domain_can_read_context[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def])\n apply force\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule_tac s=t and s'=t' in interrupt_step,simp_all)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF preemption_interrupt_scheduler_invisible\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and uc=\"user_context_of s\"\n and l=\"label_for_partition u\", OF domains_distinct]],\n assumption, assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n (* FIXME: also clean up here *)\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context[where u = u])\n apply (frule domain_can_read_context'[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def])\n apply force\n (* FIXME: and here *)\n apply (clarsimp simp: blob)\n apply (rule ccontr[where P = \"_ \\ _ = {}\"])\n apply (frule (1) domain_can_read_context'[where u = u])\n apply (frule domain_can_read_context[where u = u])\n apply (metis uwr_PSched_cur_domain)\n apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def])\n apply force\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF handle_preemption_reads_respects_scheduler_2\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and st'=\"s0_internal\" and l=\"label_for_partition u\",\n OF domains_distinct]], assumption, assumption)\n apply (rule uwr_scheduler_affects_equiv,assumption+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n apply (clarsimp simp: blob)\n apply (clarsimp simp add: sameFor_def sameFor_scheduler_def uwr_def)\n done\n\nend\n\n\nlemma schedule_if_context:\n \"\\\\\\ schedule_if tc \\\\r s. r = tc\\\"\n apply (simp add: schedule_if_def)\n apply (wp | simp)+\n done\n\nlemma schedule_step:\n assumes schedule:\n \"\\r. \\ (r,internal_state_if s') \\ fst (schedule_if (user_context_of s) (internal_state_if s));\n sys_mode_of s' = KernelExit; r = user_context_of s; r = user_context_of s' \\\n \\ P\"\n shows\n \"\\ (sys_mode_of s) = KernelSchedule True; (s,s') \\ data_type.Step (ADT_A_if utf) () \\\n \\ P\"\n apply (insert schedule)\n apply atomize\n apply (case_tac s, clarsimp)\n apply (rename_tac uc i_s)\n apply (simp_all add: system.Step_def execution_def steps_def ADT_A_if_def\n global_automaton_if_def kernel_schedule_if_def\n | safe | clarsimp)+\n apply (frule use_valid[OF _ schedule_if_context], simp+)+\n done\n\nlemma schedule_if_reads_respects_scheduler:\n assumes domains_distinct[wp]: \"pas_domains_distinct aag\"\n shows \"reads_respects_scheduler aag l\n (einvs and pas_refined aag and silc_inv aag st and guarded_pas_domain aag and tick_done)\n (schedule_if uc)\"\n apply (simp add: schedule_if_def)\n apply (wp schedule_reads_respects_scheduler schedule_guarded_pas_domain)\n apply fastforce\n done\n\nlemma schedule_if_agnostic_tc:\n \"\\P Q uc uc'. \\P\\ schedule_if uc \\\\_. Q\\ \\ \\P\\ schedule_if uc' \\\\_. Q\\\"\n apply (clarsimp simp add: schedule_if_def bind_assoc[symmetric])\n apply (erule bind_return_ign)\n done\n\n\ncontext valid_initial_state begin\n\nlemma step_from_interrupt_to_schedule:\n \"\\ (s', evs) \\ sub_big_steps (ADT_A_if utf) big_step_R s;\n evs \\ []; interrupted_modes (sys_mode_of s) \\\n \\ (s,s') \\ data_type.Step (ADT_A_if utf) () \\ (sys_mode_of s') = KernelSchedule True\"\n apply (induct rule: sub_big_steps.induct)\n apply simp\n apply (case_tac \"evlist'\")\n apply simp\n apply (erule sub_big_steps.cases)\n apply simp\n apply (erule interrupt_step[rotated,rotated],assumption)\n apply ((simp add: big_step_R_def sys_mode_of_def)+)[2]\n apply simp\n apply simp\n apply (elim conjE)\n apply (erule schedule_step[rotated],assumption)\n apply (simp add: big_step_R_def sys_mode_of_def)\n done\n\nlemma scheduler_steps:\n assumes big_step: \"(s,s'') \\ data_type.Step (big_step_ADT_A_if utf) ()\"\n assumes interrupted: \"part s = PSched\"\n obtains s' where \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n \"sys_mode_of s' = KernelSchedule True\"\n \"(s',s'') \\ data_type.Step (ADT_A_if utf) ()\"\n apply (insert big_step interrupted)\n apply (simp add: Step_big_step_ADT_A_if)\n apply (simp add: big_steps.simps)\n apply clarsimp\n apply (subgoal_tac \"interrupted_modes (sys_mode_of s)\")\n prefer 2\n apply (clarsimp simp add: big_step_R_def part_def sys_mode_of_def split: if_split_asm)\n apply (case_tac \"snd s\",simp_all)\n apply (case_tac \"as = []\")\n\n apply (erule sub_big_steps.cases)\n apply simp\n apply (erule interrupt_step[rotated,rotated],assumption)\n apply ((simp add: big_step_R_def sys_mode_of_def)+)[3]\n apply (frule step_from_interrupt_to_schedule)\n by clarsimp+\n\nlemma PSched_reachable_interrupted:\n \"\\ part s = PSched; system.reachable (big_step_ADT_A_if utf) s0 s \\\n \\ interrupted_modes (sys_mode_of s)\"\n apply (drule big_step_R_rtranclp)\n apply (drule tranclp_s0)\n apply (clarsimp simp add: part_def sys_mode_of_def split: if_split_asm)\n done\n\n(*If we're starting a non_schedule partition then we must have just exited*)\nlemma reachable_nonsched_exit:\n \"\\ system.reachable (big_step_ADT_A_if utf) s0 s; part s \\ PSched \\\n \\ (snd s) = KernelExit\"\n apply (drule big_step_R_rtranclp)\n apply (drule tranclp_s0)\n apply (clarsimp simp add: part_def split: if_split_asm)\n apply (case_tac s)\n apply simp\n apply (simp add: sys_mode_of_def)\n apply (case_tac b; simp)\n done\n\nlemma silc_dom_equiv_current_aag:\n \"silc_dom_equiv (current_aag s) st s' = silc_dom_equiv initial_aag st s'\"\n by (simp add: silc_dom_equiv_def pasObjectAbs_current_aag)\n\nend\n\n\nlemmas schedule_if_reads_respects_scheduler_2 =\n agnostic_to_ev2[OF schedule_if_agnostic_tc schedule_if_context\n schedule_if_reads_respects_scheduler]\n\nlemma big_Step2:\n \"(s,s') \\ system.Step (big_step_ADT_A_if utf) u \\\n (s,s') \\ Simulation.Step (big_step_ADT_A_if utf) u\"\n apply (simp add: system.Step_def execution_def big_step_ADT_A_if_def\n big_step_adt_def ADT_A_if_def steps_def)\n apply blast\n done\n\n\ncontext Noninterference_valid_initial_state begin\n\nlemma scheduler_step_2_confidentiality:\n notes blob = invs_if_def Invs_def sys_mode_of_def silc_inv_cur pas_refined_cur\n guarded_pas_domain_cur internal_state_s0 tick_done_def\n assumes uwr: \"(s,t) \\ uwr PSched\" \"(s,t) \\ uwr u\"\n assumes step_s: \"(s,s') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes step_t: \"(t,t') \\ data_type.Step (ADT_A_if utf) ()\"\n assumes reach_s: \"system.reachable (ADT_A_if utf) s0 s\"\n assumes reach_t: \"system.reachable (ADT_A_if utf) s0 t\"\n shows \"\\ (sys_mode_of s) = KernelSchedule True; (sys_mode_of t) = KernelSchedule True \\\n \\ (s',t') \\ uwr u\"\n apply (insert uwr step_s step_t)\n apply (rule_tac s=s and s'=s' in schedule_step,simp_all)\n apply (rule_tac s=t and s'=t' in schedule_step,simp_all)\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_s])\n apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_t])\n apply (rule equiv_valid_2E[where s=\"internal_state_if s\" and t=\"internal_state_if t\",\n OF schedule_if_reads_respects_scheduler_2\n [where aag=\"initial_aag\" and st=\"s0_internal\"\n and l=\"label_for_partition u\", OF domains_distinct]],\n assumption,assumption)\n apply (rule uwr_scheduler_affects_equiv,simp+)\n apply ((clarsimp simp: blob)+)[2]\n apply (rule scheduler_affects_equiv_uwr,simp+)\n done\n\nlemma confidentiality_part_sched_transition:\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (big_step_ADT_A_if utf) s0 s; system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag); part s = PSched \\\n \\ (s', t') \\ uwr u\"\n apply (frule schedIncludesCurrentDom)\n apply (case_tac \"part s = PSched\")\n apply simp\n apply (erule scheduler_steps, assumption+)\n apply (erule scheduler_steps, simp)\n apply (frule (3) scheduler_step_1_confidentiality[where u=PSched])\n apply (erule small_step_reachable)+\n apply (rule PSched_reachable_interrupted,simp+)\n apply (frule (3) scheduler_step_1_confidentiality[where u=u])\n apply (erule small_step_reachable)+\n apply (rule PSched_reachable_interrupted,simp+)\n apply (frule_tac s=\"s'a\" and t=\"s'aa\" and u=u in scheduler_step_2_confidentiality,\n assumption, assumption, assumption)\n apply (rule Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (erule small_step_reachable, simp)\n apply (erule small_step_reachable)\n apply (rule Step_system.reachable_Step[OF ADT_A_if_Step_system _ Step_ADT_A_if''])\n apply (erule small_step_reachable, simp)\n apply (erule small_step_reachable)\n apply simp+\n done\n\nlemma confidentiality_for_sched:\n \"\\ (s, t) \\ uwr PSched;\n system.reachable (big_step_ADT_A_if utf) s0 s; system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) (); part s \\ PSched \\\n \\ (s', t') \\ uwr PSched\"\n apply (frule schedIncludesCurrentDom)\n apply (frule_tac s=s in reachable_nonsched_exit,assumption)\n apply (frule_tac s=t in reachable_nonsched_exit,simp)\n apply (frule_tac s=s and s'=s' in Step_partitionIntegrity,simp+)\n apply (frule_tac s=t and s'=t' in Step_partitionIntegrity,simp+)\n apply (simp add: uwr_def sameFor_def)\n apply (simp add: sameFor_scheduler_def)\n apply clarsimp\n apply (case_tac s')\n apply clarsimp\n apply (case_tac t')\n apply clarsimp\n apply (clarsimp simp add: partitionIntegrity_def)\n apply (rule conjI)\n apply (metis domain_fields_equiv_sym domain_fields_equiv_trans)\n apply (rule conjI)\n apply (metis globals_equiv_scheduler_sym globals_equiv_scheduler_trans)\n apply (rule conjI)\n apply (fold silc_dom_equiv_def)\n apply (simp add: silc_dom_equiv_current_aag)\n apply (metis silc_dom_equiv_sym silc_dom_equiv_trans)\n apply (rule conjI)\n apply (rule trans)\n apply (rule sym)\n apply (rule_tac ?s1.0=\"((a, b), KernelExit)\" in big_step_irq_state_next_irq)\n apply (simp add: reachable_invs_if)\n apply (simp add: big_step_R_rtranclp)\n apply simp+\n apply (subgoal_tac \"irq_masks_of_state b = irq_masks_of_state bb\")\n apply simp\n apply (rule_tac ?s1.0=\"((aa, bb), KernelExit)\" in big_step_irq_state_next_irq)\n apply (simp add: reachable_invs_if)\n apply (simp add: big_step_R_rtranclp)\n apply simp+\n apply (rule trans)\n apply (rule irq_masks_constant,assumption,fastforce)\n apply (rule sym)\n apply (rule irq_masks_constant,assumption,fastforce)\n apply (simp add: Step_big_step_ADT_A_if)\n apply (erule big_stepsE)\n apply (erule big_stepsE)\n apply (simp add: big_step_R_def)\n apply (case_tac baa, simp_all)\n apply (case_tac bca, simp_all)\n apply (case_tac bca, simp_all)\n done\n\nlemma confidentiality_part:\n \"\\ (s, t) \\ uwr PSched; (s, t) \\ uwr (part s); (s, t) \\ uwr u;\n system.reachable (big_step_ADT_A_if utf) s0 s; system.reachable (big_step_ADT_A_if utf) s0 t;\n (s, s') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (t, t') \\ Simulation.Step (big_step_ADT_A_if utf) ();\n (part s, u) \\ policyFlows (pasPolicy initial_aag); u = PSched \\ part s = PSched \\\n \\ (s', t') \\ uwr u\"\n apply (frule schedIncludesCurrentDom)\n apply (case_tac \"part s = PSched\")\n apply (fastforce intro: confidentiality_part_sched_transition)\n apply (fastforce intro: confidentiality_part_not_PSched[rule_format])\n done\n\nlemma confidentiality_u:\n notes split_paired_All[simp del]\n shows \"ni.confidentiality_u\"\n apply (simp add: ni.confidentiality_u_def | intro allI impI | elim conjE)+\n apply (case_tac \"(part s, u) \\ policyFlows (pasPolicy initial_aag)\")\n apply (simp)\n apply (fastforce intro: confidentiality_part schedNotGlobalChannel simp: big_Step2)\n apply (case_tac \"u = PSched\")\n apply (subgoal_tac \"part s \\ PSched\")\n apply (blast intro: confidentiality_for_sched big_Step2)\n apply (fastforce intro: policyFlows_refl[THEN refl_onD])\n apply (metis integrity_part uwr_sym uwr_trans schedIncludesCurrentDom not_PSched big_Step2)\n done\n\n(* TOPLEVEL *)\nlemma nonleakage:\n \"ni.Nonleakage_gen\"\n apply (rule Nonleakage_gen[OF confidentiality_u])\n done\n\n(* TOPLEVEL *)\nlemma xnonleakage:\n \"ni.xNonleakage_gen\"\n apply (rule xNonleakage_gen[OF confidentiality_u])\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/Noninterference.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.17840750489971097}} {"text": "theory AbstractCorrectnessSestoft\nimports AbstractCorrectness Sestoft\nbegin\n\nlocale AbstractCorrectnessSestoft = AbstractCorrectness step +\n assumes conf_app\\<^sub>1: \"(\\, App e x, S) \\ s \\ (\\, e, Arg x # S) \\ update (\\, App e x, S) s\"\n assumes trans_app\\<^sub>1: \"(\\, App e x, S) \\ s \\ trans s (\\, App e x, S) \\\\<^sup>* trans (update (\\, App e x, S) s) (\\, e, Arg x # S)\" \n assumes conf_app\\<^sub>2: \"(\\, Lam [y]. e, Arg x # S) \\ s \\ (\\, e[y::=x], S) \\ update (\\, Lam [y]. e, Arg x # S) s\"\n assumes trans_app\\<^sub>2: \"(\\, Lam [y]. e, Arg x # S) \\ s \\ trans s (\\, Lam [y]. e, Arg x # S) \\\\<^sup>* trans (update (\\, Lam [y]. e, Arg x # S) s) (\\, e[y::=x], S)\"\n assumes conf_thunk: \"map_of \\ x = Some e \\ \\ isLam e \\ (\\, Var x, S) \\ s \\ (delete x \\, e, Upd x # S) \\ update (\\, Var x, S) s\"\n assumes trans_thunk: \"map_of \\ x = Some e \\ \\ isLam e \\ (\\, Var x, S) \\ s \\ trans s (\\, Var x, S) \\\\<^sup>* trans (update (\\, Var x, S) s) (delete x \\, e, Upd x # S)\"\n assumes conf_lamvar: \"map_of \\ x = Some e \\ isLam e \\ (\\, Var x, S) \\ s \\ ((x, e) # delete x \\, e, S) \\ update (\\, Var x, S) s\"\n assumes trans_lamvar: \"map_of \\ x = Some e \\ isLam e \\ (\\, Var x, S) \\ s \\ trans s (\\, Var x, S) \\\\<^sup>* trans (update (\\, Var x, S) s) ((x, e) # delete x \\, e, S)\"\n assumes conf_var\\<^sub>2: \"x \\ domA \\ \\ isLam e \\ (\\, e, Upd x # S) \\ s \\ ((x, e) # \\, e, S) \\ update (\\, e, Upd x # S) s\"\n assumes trans_var\\<^sub>2: \"x \\ domA \\ \\ isLam e \\ (\\, e, Upd x # S) \\ s \\ trans s (\\, e, Upd x # S) \\\\<^sup>* trans (update (\\, e, Upd x # S) s) ((x, e) # \\, e, S)\"\n assumes conf_let: \"atom ` domA \\ \\* \\ \\ atom ` domA \\ \\* S \\ (\\, Terms.Let \\ e, S) \\ s \\ (\\ @ \\, e, S) \\ update (\\, Terms.Let \\ e, S) s\"\n assumes trans_let: \"atom ` domA \\ \\* \\ \\ atom ` domA \\ \\* S \\ (\\, Terms.Let \\ e, S) \\ s \\ trans s (\\, Terms.Let \\ e, S) \\\\<^sup>* trans (update (\\, Terms.Let \\ e, S) s) (\\ @ \\, e, S)\"\nbegin\n\n\nlemma correct:\n assumes \"c \\\\<^sup>* c'\"\n assumes \"\\ boring_step c'\"\n assumes \"c \\ s\"\n obtains s' where \"c' \\ s'\" and \"trans s c \\\\<^sup>* trans s' c'\"\nproof-\n from assms\n have \"\\ s'. c' \\ s' \\ trans s c \\\\<^sup>* trans s' c'\"\n apply (induction arbitrary: s rule: step_induction)\n apply (rule exI, rule conjI[OF conf_app\\<^sub>1 trans_app\\<^sub>1], assumption+)\n apply (rule exI, rule conjI[OF conf_app\\<^sub>2 trans_app\\<^sub>2], assumption+)\n apply (rule exI, rule conjI[OF conf_thunk trans_thunk], assumption+)\n apply (rule exI, rule conjI[OF conf_lamvar trans_lamvar], assumption+)\n apply (rule exI, rule conjI[OF conf_var\\<^sub>2 trans_var\\<^sub>2], assumption+)\n apply (rule exI, rule conjI[OF conf_let trans_let], assumption+)\n apply auto[1]\n apply fastforce\n done\n thus ?thesis using that by auto\nqed\n\nend\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/AbstractCorrectnessSestoft.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.17823865896696506}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Retype_C\nimports\n Detype_C\n CSpace_All\n StoreWord_C\nbegin\n\ndeclare word_neq_0_conv [simp del]\n\ninstance cte_C :: array_outer_max_size\n by intro_classes simp\n\n\n\nlemma sle_positive: \"\\ b < 0x8000000000000000; (a :: machine_word) \\ b \\ \\ a <=s b\"\n apply (simp add:word_sle_def)\n apply (subst sint_eq_uint)\n apply (rule unat_less_helper)\n apply simp\n apply (subst sint_eq_uint)\n apply (rule unat_less_helper)\n apply simp\n apply (clarsimp simp:word_le_def)\n done\n\nlemma sless_positive: \"\\ b < 0x8000000000000000; (a :: machine_word) < b \\ \\ a 0 \\ (a :: machine_word); a < 0x8000000000000000 \\ \\ 0 \\ sint a\"\n apply (subst sint_eq_uint)\n apply (simp add:unat_less_helper)\n apply simp\n done\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma map_option_byte_to_word_heap:\n assumes disj: \"\\(off :: 9 word) x. x<8 \\ p + ucast off * 8 + x \\ S \" (*9=page table index*)\n shows \"byte_to_word_heap (\\x. if x \\ S then 0 else mem x) p\n = byte_to_word_heap mem p\"\n by (clarsimp simp: option_map_def byte_to_word_heap_def[abs_def]\n Let_def disj disj[where x = 0,simplified]\n split: option.splits)\n\ntext \\Generalise the different kinds of retypes to allow more general proofs\nabout what they might change.\\\ndefinition\n ptr_retyps_gen :: \"nat \\ ('a :: c_type) ptr \\ bool \\ heap_typ_desc \\ heap_typ_desc\"\nwhere\n \"ptr_retyps_gen n p mk_array\n = (if mk_array then ptr_arr_retyps n p else ptr_retyps n p)\"\n\nend\n\ncontext kernel_m\nbegin\n\n(* Ensure that the given region of memory does not contain any typed memory. *)\ndefinition\n region_is_typeless :: \"machine_word \\ nat \\ ('a globals_scheme, 'b) StateSpace.state_scheme \\ bool\"\nwhere\n \"region_is_typeless ptr sz s \\\n \\z\\{ptr ..+ sz}. snd (snd (t_hrs_' (globals s)) z) = Map.empty\"\n\nlemma c_guard_word8:\n \"c_guard (p :: word8 ptr) = (ptr_val p \\ 0)\"\n unfolding c_guard_def ptr_aligned_def c_null_guard_def\n apply simp\n apply (rule iffI)\n apply (drule intvlD)\n apply clarsimp\n apply simp\n apply (rule intvl_self)\n apply simp\n done\n\nlemma\n \"(x \\ {x ..+ n}) = (n \\ 0)\"\n apply (rule iffI)\n apply (drule intvlD)\n apply clarsimp\n apply (rule intvl_self)\n apply simp\n done\n\nlemma heap_update_list_append3:\n \"\\ s' = s + of_nat (length xs) \\ \\ heap_update_list s (xs @ ys) H = heap_update_list s' ys (heap_update_list s xs H)\"\n apply simp\n apply (subst heap_update_list_append [symmetric])\n apply clarsimp\n done\n\nlemma ptr_aligned_machine_word:\n \"\\ is_aligned p 3 \\ \\ ptr_aligned ((Ptr p) :: machine_word ptr)\"\n apply (clarsimp simp: is_aligned_def ptr_aligned_def)\n done\n\nlemma c_guard_machine_word:\n \"\\ is_aligned (ptr_val p) 3; p \\ NULL \\ \\ c_guard (p :: (machine_word ptr))\"\n apply (clarsimp simp: c_guard_def)\n apply (rule conjI)\n apply (case_tac p, clarsimp simp: ptr_aligned_machine_word)\n apply (case_tac p, simp add: c_null_guard_def)\n apply (subst intvl_aligned_bottom_eq [where n=3 and bits=3], auto simp: word_bits_def)\n done\n\nlemma is_aligned_and_not_zero: \"\\ is_aligned n k; n \\ 0 \\ \\ 2^k \\ n\"\n apply (metis aligned_small_is_0 word_not_le)\n done\n\nlemma replicate_append [rule_format]: \"\\xs. replicate n x @ (x # xs) = replicate (n + 1) x @ xs\"\n apply (induct n)\n apply clarsimp\n apply clarsimp\n done\n\nlemmas unat_add_simple =\n iffD1 [OF unat_add_lem [where 'a = 32, folded word_bits_def]]\n\nlemma replicate_append_list [rule_format]:\n \"\\n. set L \\ {0::word8} \\ (replicate n 0 @ L = replicate (n + length L) 0)\"\n apply (rule rev_induct)\n apply clarsimp\n apply (rule allI)\n apply (erule_tac x=\"n+1\" in allE)\n apply clarsimp\n apply (subst append_assoc[symmetric])\n apply clarsimp\n apply (subgoal_tac \"\\n. (replicate n 0 @ [0]) = (0 # replicate n (0 :: word8))\")\n apply clarsimp\n apply (induct_tac na)\n apply clarsimp\n apply clarsimp\n done\n\nlemma heap_update_list_replicate:\n \"\\ set L = {0}; n' = n + length L \\ \\ heap_update_list s ((replicate n 0) @ L) H = heap_update_list s (replicate n' 0) H\"\n apply (subst replicate_append_list)\n apply clarsimp\n apply clarsimp\n done\n\nlemma heap_update_machine_word_is_heap_update_list:\n \"heap_update p (x :: machine_word) = heap_update_list (ptr_val p) (to_bytes x a)\"\n apply (rule ext)+\n apply (clarsimp simp: heap_update_def)\n apply (clarsimp simp: to_bytes_def typ_info_word)\n done\n\nlemma to_bytes_machine_word_0:\n \"to_bytes (0 :: machine_word) xs = [0, 0, 0, 0,0,0,0,0 :: word8]\"\n apply (simp add: to_bytes_def typ_info_word word_rsplit_same word_rsplit_0 word_bits_def)\n done\n\nlemma globals_list_distinct_subset:\n \"\\ globals_list_distinct D symtab xs; D' \\ D \\\n \\ globals_list_distinct D' symtab xs\"\n by (simp add: globals_list_distinct_def disjoint_subset)\n\nlemma fst_s_footprint:\n \"(fst ` s_footprint p) = {ptr_val (p :: 'a ptr)\n ..+ size_of TYPE('a :: c_type)}\"\n apply (simp add: s_footprint_def s_footprint_untyped_def)\n apply (auto simp: intvl_def size_of_def image_def)\n done\n\nlemma memzero_spec:\n \"\\s. \\ \\ \\s. ptr_val \\s \\ 0 \\ ptr_val \\s \\ ptr_val \\s + (\\n - 1)\n \\ (is_aligned (ptr_val \\s) 3) \\ (is_aligned (\\n) 3)\n \\ {ptr_val \\s ..+ unat \\n} \\ {SIndexVal, SIndexTyp 0} \\ dom_s (hrs_htd \\t_hrs)\n \\ gs_get_assn cap_get_capSizeBits_'proc \\ghost'state \\ insert 0 {\\n ..}\\\n Call memzero_'proc {t.\n t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (s_' s))\n (replicate (unat (n_' s)) (ucast (0)))) (t_hrs_' (globals s))}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (clarsimp simp: whileAnno_def)\n apply (rule_tac I1=\"{t. (ptr_val (s_' s) \\ ptr_val (s_' s) + ((n_' s) - 1) \\ ptr_val (s_' s) \\ 0) \\\n ptr_val (s_' s) + (n_' s - n_' t) = ptr_val (p___ptr_to_unsigned_char_' t) \\\n n_' t \\ n_' s \\\n (is_aligned (n_' t) 3) \\\n (is_aligned (n_' s) 3) \\\n (is_aligned (ptr_val (s_' t)) 3) \\\n (is_aligned (ptr_val (s_' s)) 3) \\\n (is_aligned (ptr_val (p___ptr_to_unsigned_char_' t)) 3) \\\n {ptr_val (p___ptr_to_unsigned_char_' t) ..+ unat (n_' t)} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals t))) \\\n globals t = (globals s)\\ t_hrs_' :=\n hrs_mem_update (heap_update_list (ptr_val (s_' s))\n (replicate (unat (n_' s - n_' t)) 0))\n (t_hrs_' (globals s))\\ }\"\n and V1=undefined in subst [OF whileAnno_def])\n apply vcg\n apply (clarsimp simp add: hrs_mem_update_def)\n\n apply clarsimp\n apply (case_tac s, case_tac p___ptr_to_unsigned_char)\n\n apply (subgoal_tac \"8 \\ unat na\")\n apply (intro conjI)\n apply (simp add: ptr_safe_def s_footprint_def s_footprint_untyped_def\n typ_uinfo_t_def typ_info_word)\n apply (erule order_trans[rotated])\n apply (auto intro!: intvlI)[1]\n apply (subst c_guard_machine_word, simp_all)[1]\n apply (clarsimp simp: field_simps)\n apply (metis le_minus' word_leq_minus_one_le olen_add_eqv diff_self word_le_0_iff word_le_less_eq)\n apply (clarsimp simp: field_simps)\n apply (frule is_aligned_and_not_zero)\n apply clarsimp\n apply (rule word_le_imp_diff_le, auto)[1]\n apply clarsimp\n apply (rule aligned_sub_aligned [where n=3], simp_all add: is_aligned_def word_bits_def)[1]\n apply clarsimp\n apply (rule is_aligned_add, simp_all add: is_aligned_def word_bits_def)[1]\n apply (erule order_trans[rotated])\n apply (clarsimp simp: subset_iff)\n apply (erule subsetD[OF intvl_sub_offset, rotated])\n apply (simp add: unat_sub word_le_nat_alt)\n apply (clarsimp simp: word_bits_def hrs_mem_update_def)\n apply (subst heap_update_machine_word_is_heap_update_list [where a=\"[]\"])\n apply (subst heap_update_list_append3[symmetric])\n apply clarsimp\n apply (subst to_bytes_machine_word_0)\n apply (rule heap_update_list_replicate)\n apply clarsimp\n apply (rule_tac s=\"unat ((n - na) + 8)\" in trans)\n apply (simp add: field_simps)\n apply (subst Word.unat_plus_simple[THEN iffD1])\n apply (rule is_aligned_no_overflow''[where n=3, simplified])\n apply (erule(1) aligned_sub_aligned, simp)\n apply (clarsimp simp: field_simps)\n apply (frule_tac x=n in is_aligned_no_overflow'', simp)\n apply simp\n apply simp\n apply (rule dvd_imp_le)\n apply (simp add: is_aligned_def)\n apply (simp add: unat_eq_0[symmetric])\n apply clarsimp\n done\n\nlemma is_aligned_and_2_to_k:\n assumes mask_2_k: \"(n && 2 ^ k - 1) = 0\"\n shows \"is_aligned (n :: machine_word) k\"\nproof (subst is_aligned_mask)\n have \"mask k = (2 :: machine_word) ^ k - 1\"\n by (clarsimp simp: mask_def)\n thus \"n && mask k = 0\" using mask_2_k\n by simp\nqed\n\nlemma memset_spec:\n \"\\s. \\ \\ \\s. ptr_val \\s \\ 0 \\ ptr_val \\s \\ ptr_val \\s + (\\n - 1)\n \\ {ptr_val \\s ..+ unat \\n} \\ {SIndexVal, SIndexTyp 0} \\ dom_s (hrs_htd \\t_hrs)\n \\ gs_get_assn cap_get_capSizeBits_'proc \\ghost'state \\ insert 0 {\\n ..}\\\n Call memset_'proc\n {t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (s_' s))\n (replicate (unat (n_' s)) (ucast (c_' s)))) (t_hrs_' (globals s))}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (clarsimp simp: whileAnno_def)\n apply (rule_tac I1=\"{t. (ptr_val (s_' s) \\ ptr_val (s_' s) + ((n_' s) - 1) \\ ptr_val (s_' s) \\ 0) \\\n c_' t = c_' s \\\n ptr_val (s_' s) + (n_' s - n_' t) = ptr_val (p___ptr_to_unsigned_char_' t) \\\n n_' t \\ n_' s \\\n {ptr_val (p___ptr_to_unsigned_char_' t) ..+ unat (n_' t)} \\ {SIndexVal, SIndexTyp 0}\n \\ dom_s (hrs_htd (t_hrs_' (globals t))) \\\n globals t = (globals s)\\ t_hrs_' :=\n hrs_mem_update (heap_update_list (ptr_val (s_' s))\n (replicate (unat (n_' s - n_' t)) (ucast (c_' t))))\n (t_hrs_' (globals s))\\}\"\n and V1=undefined in subst [OF whileAnno_def])\n apply vcg\n apply (clarsimp simp add: hrs_mem_update_def del: mod_0_imp_dvd split: if_split_asm)\n apply (subst (asm) word_mod_2p_is_mask [where n=3, simplified], simp)\n apply (subst (asm) word_mod_2p_is_mask [where n=3, simplified], simp)\n apply (rule conjI)\n apply (rule is_aligned_and_2_to_k, clarsimp simp: mask_def)\n apply (rule is_aligned_and_2_to_k, clarsimp simp: mask_def)\n apply clarsimp\n apply (intro conjI)\n apply (simp add: ptr_safe_def s_footprint_def s_footprint_untyped_def\n typ_uinfo_t_def typ_info_word)\n apply (erule order_trans[rotated])\n apply (auto simp: intvl_self unat_gt_0 intro!: intvlI)[1]\n apply (simp add: c_guard_word8)\n apply (erule subst)\n apply (subst lt1_neq0 [symmetric])\n apply (rule order_trans)\n apply (subst lt1_neq0, assumption)\n apply (erule word_random)\n apply (rule word_le_minus_mono_right)\n apply (simp add: lt1_neq0)\n apply assumption\n apply (erule order_trans [rotated])\n apply (simp add: lt1_neq0)\n apply (case_tac p___ptr_to_unsigned_char, simp add: CTypesDefs.ptr_add_def unat_minus_one field_simps)\n apply (metis word_must_wrap word_not_simps(1) linear)\n apply (erule order_trans[rotated])\n apply (clarsimp simp: ptr_val_case split: ptr.splits)\n apply (erule subsetD[OF intvl_sub_offset, rotated])\n apply (simp add: unat_sub word_le_nat_alt word_less_nat_alt)\n apply (clarsimp simp: ptr_val_case unat_minus_one hrs_mem_update_def split: ptr.splits)\n apply (subgoal_tac \"unat (n - (na - 1)) = Suc (unat (n - na))\")\n apply (erule ssubst, subst replicate_Suc_append)\n apply (subst heap_update_list_append)\n apply (simp add: heap_update_word8)\n apply (subst unatSuc [symmetric])\n apply (subst add.commute)\n apply (metis word_neq_0_conv word_sub_plus_one_nonzero)\n apply (simp add: field_simps)\n apply (clarsimp)\n apply (metis diff_0_right word_gt_0)\n done\n\ndeclare snd_get[simp]\n\ndeclare snd_gets[simp]\n\nlemma snd_when_aligneError[simp]:\n shows \"(snd ((when P (alignError sz)) s)) = P\"\n by (simp add: when_def alignError_def fail_def split: if_split)\n\nlemma snd_unless_aligneError[simp]:\n shows \"(snd ((unless P (alignError sz)) s)) = (\\ P)\"\n by (simp add: unless_def)\n\nlemma lift_t_retyp_heap_same:\n fixes p :: \"'a :: mem_type ptr\"\n assumes gp: \"g p\"\n shows \"lift_t g (hp, ptr_retyp p td) p = Some (from_bytes (heap_list hp (size_of TYPE('a)) (ptr_val p)))\"\n apply (simp add: lift_t_def lift_typ_heap_if s_valid_def hrs_htd_def)\n apply (subst ptr_retyp_h_t_valid)\n apply (rule gp)\n apply simp\n apply (subst heap_list_s_heap_list_dom)\n apply (clarsimp simp: s_footprint_intvl)\n apply simp\n done\n\nlemma lift_t_retyp_heap_same_rep0:\n fixes p :: \"'a :: mem_type ptr\"\n assumes gp: \"g p\"\n shows \"lift_t g (heap_update_list (ptr_val p) (replicate (size_of TYPE('a)) 0) hp, ptr_retyp p td) p =\n Some (from_bytes (replicate (size_of TYPE('a)) 0))\"\n apply (subst lift_t_retyp_heap_same)\n apply (rule gp)\n apply (subst heap_list_update [where v = \"replicate (size_of TYPE('a)) 0\", simplified])\n apply (rule order_less_imp_le)\n apply simp\n apply simp\n done\n\nlemma lift_t_retyp_heap_other2:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'b :: mem_type ptr\"\n assumes orth: \"{ptr_val p..+size_of TYPE('a)} \\ {ptr_val p'..+size_of TYPE('b)} = {}\"\n shows \"lift_t g (hp, ptr_retyp p td) p' = lift_t g (hp, td) p'\"\n apply (simp add: lift_t_def lift_typ_heap_if s_valid_def hrs_htd_def ptr_retyp_disjoint_iff [OF orth])\n apply (cases \"td, g \\\\<^sub>t p'\")\n apply simp\n apply (simp add: h_t_valid_taut heap_list_s_heap_list heap_list_update_disjoint_same\n ptr_retyp_disjoint_iff orth)\n apply (simp add: h_t_valid_taut heap_list_s_heap_list heap_list_update_disjoint_same\n ptr_retyp_disjoint_iff orth)\n done\n\nlemma dom_s_SindexValD:\n \"(x, SIndexVal) \\ dom_s td \\ fst (td x)\"\n unfolding dom_s_def by clarsimp\n\nlemma typ_slice_t_self_nth:\n \"\\n < length (typ_slice_t td m). \\b. typ_slice_t td m ! n = (td, b)\"\n using typ_slice_t_self [where td = td and m = m]\n by (fastforce simp add: in_set_conv_nth)\n\nlemma ptr_retyp_other_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'b :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n and tdisj: \"typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b :: mem_type)\"\n and clear: \"\\x \\ {ptr_val p ..+ size_of TYPE('a)}. \\n b. snd (td x) n \\ Some (typ_uinfo_t TYPE('b), b)\"\n shows \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} = {}\"\nproof (rule classical)\n assume asm: \"{ptr_val p'..+ size_of TYPE('b)} \\ {ptr_val p ..+ size_of TYPE('a)} \\ {}\"\n then obtain mv where mvp: \"mv \\ {ptr_val p..+size_of TYPE('a)}\"\n and mvp': \"mv \\ {ptr_val p'..+size_of TYPE('b)}\"\n by blast\n\n then obtain k' where mv: \"mv = ptr_val p' + of_nat k'\" and klt: \"k' < size_td (typ_info_t TYPE('b))\"\n by (clarsimp dest!: intvlD simp: size_of_def typ_uinfo_size)\n\n let ?mv = \"ptr_val p' + of_nat k'\"\n\n obtain n b where nl: \"n < length (typ_slice_t (typ_uinfo_t TYPE('b)) k')\"\n and tseq: \"typ_slice_t (typ_uinfo_t TYPE('b)) k' ! n = (typ_uinfo_t TYPE('b), b)\"\n using typ_slice_t_self_nth [where td = \"typ_uinfo_t TYPE('b)\" and m = k']\n by clarsimp\n\n with ht have \"snd (ptr_retyp p td ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n unfolding h_t_valid_def\n apply -\n apply (clarsimp simp: valid_footprint_def Let_def)\n apply (drule spec, drule mp [OF _ klt])\n apply (clarsimp simp: map_le_def)\n apply (drule bspec)\n apply simp\n apply simp\n done\n\n moreover {\n assume \"snd (ptr_retyp p empty_htd ?mv) n = Some (typ_uinfo_t TYPE('b), b)\"\n hence \"(typ_uinfo_t TYPE('b)) \\ fst ` set (typ_slice_t (typ_uinfo_t TYPE('a))\n (unat (ptr_val p' + of_nat k' - ptr_val p)))\"\n using asm mv mvp\n apply -\n apply (rule_tac x = \"(typ_uinfo_t TYPE('b), b)\" in image_eqI)\n apply simp\n apply (fastforce simp add: ptr_retyp_footprint list_map_eq in_set_conv_nth split: if_split_asm)\n done\n\n with typ_slice_set have \"(typ_uinfo_t TYPE('b)) \\ fst ` td_set (typ_uinfo_t TYPE('a)) 0\"\n by (rule subsetD)\n\n hence False using tdisj by (clarsimp simp: tag_disj_def typ_tag_le_def)\n } ultimately show ?thesis using mvp mvp' mv unfolding h_t_valid_def valid_footprint_def\n apply -\n apply (subst (asm) ptr_retyp_d_eq_snd)\n apply (auto simp add: map_add_Some_iff clear)\n done\nqed\n\nlemma h_t_valid_not_empty:\n fixes p :: \"'a :: c_type ptr\"\n shows \"\\ d,g \\\\<^sub>t p; x \\ {ptr_val p..+size_of TYPE('a)} \\ \\ snd (d x) \\ Map.empty\"\n apply (drule intvlD)\n apply (clarsimp simp: h_t_valid_def size_of_def)\n apply (drule valid_footprintD)\n apply (simp add: typ_uinfo_size)\n apply clarsimp\n done\n\nlemma ptr_retyps_out:\n fixes p :: \"'a :: mem_type ptr\"\n shows \"x \\ {ptr_val p..+n * size_of TYPE('a)} \\ ptr_retyps n p td x = td x\"\nproof (induct n arbitrary: p)\n case 0 thus ?case by simp\nnext\n case (Suc m)\n\n have ih: \"ptr_retyps m (CTypesDefs.ptr_add p 1) td x = td x\"\n proof (rule Suc.hyps)\n from Suc.prems show \"x \\ {ptr_val (CTypesDefs.ptr_add p 1)..+m * size_of TYPE('a)}\"\n apply (rule contrapos_nn)\n apply (erule subsetD [rotated])\n apply (simp add: CTypesDefs.ptr_add_def)\n apply (rule intvl_sub_offset)\n apply (simp add: unat_of_nat)\n done\n qed\n\n from Suc.prems have \"x \\ {ptr_val p..+size_of TYPE('a)}\"\n apply (rule contrapos_nn)\n apply (erule subsetD [rotated])\n apply (rule intvl_start_le)\n apply simp\n done\n\n thus ?case\n by (simp add: ptr_retyp_d ih)\nqed\n\nlemma image_add_intvl:\n \"((+) x) ` {p ..+ n} = {p + x ..+ n}\"\n by (auto simp add: intvl_def)\n\nlemma intvl_sum:\n \"{p..+ i + j}\n = {p ..+ i} \\ {(p :: ('a :: len) word) + of_nat i ..+ j}\"\n apply (simp add: intvl_def, safe)\n apply clarsimp\n apply (case_tac \"k < i\")\n apply auto[1]\n apply (drule_tac x=\"k - i\" in spec)\n apply simp\n apply fastforce\n apply (rule_tac x=\"k + i\" in exI)\n apply simp\n done\n\nlemma intvl_Suc_right:\n \"{p ..+ Suc n} = {p} \\ {(p :: ('a :: len) word) + 1 ..+ n}\"\n apply (simp add: intvl_sum[where p=p and i=1 and j=n, simplified])\n apply (auto dest: intvl_Suc simp: intvl_self)\n done\n\nlemma htd_update_list_same2:\n \"x \\ {p ..+ length xs} \\\n htd_update_list p xs htd x = htd x\"\n by (induct xs arbitrary: p htd, simp_all add: intvl_Suc_right)\n\nlemma ptr_retyps_gen_out:\n fixes p :: \"'a :: mem_type ptr\"\n shows \"x \\ {ptr_val p..+n * size_of TYPE('a)} \\ ptr_retyps_gen n p arr td x = td x\"\n apply (simp add: ptr_retyps_gen_def ptr_retyps_out split: if_split)\n apply (clarsimp simp: ptr_arr_retyps_def htd_update_list_same2)\n done\n\nlemma h_t_valid_intvl_htd_contains_uinfo_t:\n \"h_t_valid d g (p :: ('a :: c_type) ptr) \\ x \\ {ptr_val p ..+ size_of TYPE('a)} \\\n (\\n. snd (d x) n \\ None \\ fst (the (snd (d x) n)) = typ_uinfo_t TYPE ('a))\"\n apply (clarsimp simp: h_t_valid_def valid_footprint_def Let_def intvl_def size_of_def)\n apply (drule spec, drule(1) mp)\n apply (cut_tac m=k in typ_slice_t_self[where td=\"typ_uinfo_t TYPE ('a)\"])\n apply (clarsimp simp: in_set_conv_nth)\n apply (drule_tac x=i in map_leD)\n apply simp\n apply fastforce\n done\n\nlemma list_map_override_comono:\n \"list_map xs \\\\<^sub>m m ++ list_map ys\n \\ xs \\ ys \\ ys \\ xs\"\n apply (simp add: map_le_def list_map_eq map_add_def)\n apply (cases \"length xs \\ length ys\")\n apply (simp add: prefix_eq_nth)\n apply (simp split: if_split_asm add: prefix_eq_nth)\n done\n\nlemma list_map_plus_le_not_tag_disj:\n \"list_map (typ_slice_t td y) \\\\<^sub>m m ++ list_map (typ_slice_t td' y')\n \\ \\ td \\\\<^sub>t td'\"\n apply (drule list_map_override_comono)\n apply (auto dest: typ_slice_sub)\n done\n\nlemma htd_update_list_not_tag_disj:\n \"list_map (typ_slice_t td y)\n \\\\<^sub>m snd (htd_update_list p xs htd x)\n \\ x \\ {p ..+ length xs}\n \\ y < size_td td\n \\ length xs < addr_card\n \\ set xs \\ list_map ` typ_slice_t td' ` {..< size_td td'}\n \\ \\ td \\\\<^sub>t td'\"\n apply (induct xs arbitrary: p htd)\n apply simp\n apply (clarsimp simp: intvl_Suc_right)\n apply (erule disjE)\n apply clarsimp\n apply (subst(asm) htd_update_list_same2,\n rule intvl_Suc_nmem'[where n=\"Suc m\" for m, simplified])\n apply (simp add: addr_card_def card_word)\n apply (simp add: list_map_plus_le_not_tag_disj)\n apply blast\n done\n\n(* Sigh *)\nlemma td_set_offset_ind:\n \"\\j. td_set t (Suc j) = (apsnd Suc :: ('a typ_desc \\ nat) \\ _) ` td_set t j\"\n \"\\j. td_set_struct ts (Suc j) = (apsnd Suc :: ('a typ_desc \\ nat) \\ _) ` td_set_struct ts j\"\n \"\\j. td_set_list xs (Suc j) = (apsnd Suc :: ('a typ_desc \\ nat) \\ _) ` td_set_list xs j\"\n \"\\j. td_set_pair x (Suc j) = (apsnd Suc :: ('a typ_desc \\ nat) \\ _) ` td_set_pair x j\"\n apply (induct t and ts and xs and x)\n apply (simp_all add: image_Un)\n done\n\nlemma td_set_offset:\n \"(td, i) \\ td_set td' j \\ (td, i - j) \\ td_set td' 0\"\n by (induct j arbitrary: i, auto simp: td_set_offset_ind)\n\nlemma typ_le_uinfo_array_tag_n_m:\n \"0 < n \\ td \\ uinfo_array_tag_n_m TYPE('a :: c_type) n m\n = (td \\ typ_uinfo_t TYPE('a) \\ td = uinfo_array_tag_n_m TYPE('a) n m)\"\nproof -\n have ind: \"\\xs cs. \\n'. td_set_list (map (\\i. DTPair (typ_uinfo_t TYPE('a)) (cs i)) xs) n'\n \\ (fst ` (\\i. td_set (typ_uinfo_t TYPE('a)) i)) \\ UNIV\"\n apply (induct_tac xs)\n apply clarsimp\n apply clarsimp\n apply (fastforce intro: image_eqI[rotated])\n done\n assume \"0 < n\"\n thus ?thesis\n apply (simp add: uinfo_array_tag_n_m_def typ_tag_le_def upt_conv_Cons)\n apply (auto dest!: ind[rule_format, THEN subsetD], (blast dest: td_set_offset)+)\n done\nqed\n\nlemma h_t_array_valid_retyp:\n \"0 < n \\ n * size_of TYPE('a) < addr_card\n \\ h_t_array_valid (ptr_arr_retyps n p htd) (p :: ('a :: wf_type) ptr) n\"\n apply (clarsimp simp: ptr_arr_retyps_def h_t_array_valid_def\n valid_footprint_def)\n apply (simp add: htd_update_list_index intvlI mult.commute)\n apply (simp add: addr_card_wb unat_of_nat64)\n done\n\nlemma valid_call_Spec_eq_subset:\n\"\\' procname = Some (Spec R)\n\\ (\\x. \\'\\\\<^bsub>/NF\\<^esub> (P x) Call procname (Q x),(A x))\n = ((\\x. P x \\ fst ` R) \\ (R \\ (\\x. (- P x) \\ UNIV \\ UNIV \\ Q x)))\"\n supply image_cong_simp [cong del]\n apply (safe, simp_all)\n apply (clarsimp simp: HoarePartialDef.valid_def)\n apply (rule ccontr)\n apply (elim allE, subst(asm) imageI, assumption)\n apply (drule mp, erule exec.Call, rule exec.SpecStuck)\n apply (auto simp: image_def)[2]\n apply (clarsimp simp: HoarePartialDef.valid_def)\n apply (elim allE, drule mp, erule exec.Call, erule exec.Spec)\n apply auto[1]\n apply (clarsimp simp: HoarePartialDef.valid_def)\n apply (erule exec_Normal_elim_cases, simp_all)\n apply (erule exec_Normal_elim_cases, auto simp: image_def)\n apply blast\n apply (thin_tac \"R \\ _\", fastforce)\n done\n\nlemma field_of_t_refl:\n \"field_of_t p p' = (p = p')\"\n apply (safe, simp_all add: field_of_t_def field_of_self)\n apply (simp add: field_of_def)\n apply (drule td_set_size_lte)\n apply (simp add: unat_eq_0)\n done\n\nlemma h_t_valid_ptr_retyps_gen:\n assumes sz: \"nptrs * size_of TYPE('a :: mem_type) < addr_card\"\n and gd: \"gd p'\"\n shows\n \"(p' \\ ((+\\<^sub>p) (Ptr p :: 'a ptr) \\ int) ` {k. k < nptrs})\n \\ h_t_valid (ptr_retyps_gen nptrs (Ptr p :: 'a ptr) arr htd) gd p'\"\n using gd sz\n apply (cases arr, simp_all add: ptr_retyps_gen_def)\n apply (cases \"nptrs = 0\")\n apply simp\n apply (cut_tac h_t_array_valid_retyp[where p=\"Ptr p\" and htd=htd, OF _ sz], simp_all)\n apply clarsimp\n apply (drule_tac k=x in h_t_array_valid_field, simp_all)\n apply (induct nptrs arbitrary: p htd)\n apply simp\n apply clarsimp\n apply (case_tac x, simp_all add: ptr_retyp_h_t_valid)\n apply (rule ptr_retyp_disjoint)\n apply (elim meta_allE, erule meta_mp, rule image_eqI[rotated], simp)\n apply (simp add: field_simps)\n apply simp\n apply (cut_tac p=p and z=\"size_of TYPE('a)\"\n and k=\"Suc nat * size_of TYPE('a)\" in init_intvl_disj)\n apply (erule order_le_less_trans[rotated])\n apply (simp del: mult_Suc)\n apply (simp add: field_simps Int_ac)\n apply (erule disjoint_subset[rotated] disjoint_subset2[rotated])\n apply (rule intvl_start_le, simp)\n done\n\nlemma ptr_retyps_gen_not_tag_disj:\n \"x \\ {p ..+ n * size_of TYPE('a :: mem_type)}\n \\ list_map (typ_slice_t td y)\n \\\\<^sub>m snd (ptr_retyps_gen n (Ptr p :: 'a ptr) arr htd x)\n \\ y < size_td td\n \\ n * size_of TYPE('a) < addr_card\n \\ 0 < n\n \\ \\ td \\\\<^sub>t typ_uinfo_t TYPE('a)\"\n apply (simp add: ptr_retyps_gen_def ptr_arr_retyps_def\n split: if_split_asm)\n apply (drule_tac td'=\"uinfo_array_tag_n_m TYPE('a) n n\"\n in htd_update_list_not_tag_disj, simp+)\n apply (clarsimp simp: mult.commute)\n apply (clarsimp simp: tag_disj_def)\n apply (erule disjE)\n apply (metis order_refl typ_le_uinfo_array_tag_n_m)\n apply (erule notE, erule order_trans[rotated])\n apply (simp add: typ_le_uinfo_array_tag_n_m)\n apply clarsimp\n apply (induct n arbitrary: p htd, simp_all)\n apply (case_tac \"x \\ {p ..+ size_of TYPE('a)}\")\n apply (simp add: intvl_sum ptr_retyp_def)\n apply (drule_tac td'=\"typ_uinfo_t TYPE('a)\"\n in htd_update_list_not_tag_disj, simp+)\n apply (clarsimp simp add: typ_slices_def size_of_def)\n apply simp\n apply (simp add: intvl_sum)\n apply (case_tac \"n = 0\")\n apply simp\n apply (simp add: ptr_retyps_out[where n=1, simplified])\n apply blast\n done\n\nlemma ptr_retyps_gen_valid_footprint:\n assumes cleared: \"region_is_bytes' p (n * size_of TYPE('a)) htd\"\n and distinct: \"td \\\\<^sub>t typ_uinfo_t TYPE('a)\"\n and not_byte: \"td \\ typ_uinfo_t TYPE(word8)\"\n and sz: \"n * size_of TYPE('a) < addr_card\"\n shows\n \"valid_footprint (ptr_retyps_gen n (Ptr p :: 'a :: mem_type ptr) arr htd) p' td\n = (valid_footprint htd p' td)\"\n apply (cases \"n = 0\")\n apply (simp add: ptr_retyps_gen_def ptr_arr_retyps_def split: if_split)\n apply (simp add: valid_footprint_def Let_def)\n apply (intro conj_cong refl, rule all_cong)\n apply (case_tac \"p' + of_nat y \\ {p ..+ n * size_of TYPE('a)}\")\n apply (simp_all add: ptr_retyps_gen_out)\n apply (rule iffI; clarsimp)\n apply (frule(1) ptr_retyps_gen_not_tag_disj, (simp add: sz)+)\n apply (simp add: distinct)\n apply (cut_tac m=y in typ_slice_t_self[where td=td])\n apply (clarsimp simp: in_set_conv_nth)\n apply (drule_tac x=i in map_leD)\n apply simp\n apply (simp add: cleared[unfolded region_is_bytes'_def] not_byte)\n done\n\nlemma list_map_length_is_None [simp]:\n \"list_map xs (length xs) = None\"\n apply (induct xs)\n apply (simp add: list_map_def)\n apply (simp add: list_map_def)\n done\n\nlemma list_map_append_one:\n \"list_map (xs @ [x]) = [length xs \\ x] ++ list_map xs\"\n by (simp add: list_map_def)\n\nlemma ptr_retyp_same_cleared_region:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p' \\ {ptr_val p..+ size_of TYPE('a)} \\ {ptr_val p' ..+ size_of TYPE('a)} = {}\"\n using ht\n by (simp add: h_t_valid_ptr_retyp_eq[where p=p and p'=p'] field_of_t_refl\n split: if_split_asm)\n\nlemma h_t_valid_ptr_retyp_inside_eq:\n fixes p :: \"'a :: mem_type ptr\" and p' :: \"'a :: mem_type ptr\"\n assumes inside: \"ptr_val p' \\ {ptr_val p ..+ size_of TYPE('a)}\"\n and ht: \"ptr_retyp p td, g \\\\<^sub>t p'\"\n shows \"p = p'\"\n using ptr_retyp_same_cleared_region[OF ht] inside mem_type_self[where p=p']\n by blast\n\nlemma ptr_add_orth:\n fixes p :: \"'a :: mem_type ptr\"\n assumes lt: \"Suc n * size_of TYPE('a) < 2 ^ word_bits\"\n shows \"{ptr_val p..+size_of TYPE('a)} \\ {ptr_val (CTypesDefs.ptr_add p 1)..+n * size_of TYPE('a)} = {}\"\n using lt\n apply -\n apply (rule disjointI)\n apply clarsimp\n apply (drule intvlD)+\n apply (clarsimp simp: CTypesDefs.ptr_add_def)\n apply (simp only: Abs_fnat_hom_add)\n apply (drule unat_cong)\n apply (simp only: unat_of_nat)\n apply (unfold word_bits_len_of)\n apply (simp add: addr_card_wb [symmetric])\n done\n\nlemma dom_lift_t_heap_update:\n \"dom (lift_t g (hrs_mem_update v hp)) = dom (lift_t g hp)\"\n by (clarsimp simp add: lift_t_def lift_typ_heap_if s_valid_def hrs_htd_def hrs_mem_update_def split_def dom_def\n intro!: Collect_cong split: if_split)\n\nlemma h_t_valid_ptr_retyps_gen_same:\n assumes guard: \"\\n' < nptrs. gd (CTypesDefs.ptr_add (Ptr p :: 'a ptr) (of_nat n'))\"\n assumes cleared: \"region_is_bytes' p (nptrs * size_of TYPE('a :: mem_type)) htd\"\n and not_byte: \"typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE(word8)\"\n assumes sz: \"nptrs * size_of TYPE('a) < addr_card\"\n shows\n \"h_t_valid (ptr_retyps_gen nptrs (Ptr p :: 'a ptr) arr htd) gd p'\n = ((p' \\ ((+\\<^sub>p) (Ptr p :: 'a ptr) \\ int) ` {k. k < nptrs}) \\ h_t_valid htd gd p')\"\n (is \"h_t_valid ?htd' gd p' = (p' \\ ?S \\ h_t_valid htd gd p')\")\nproof (cases \"{ptr_val p' ..+ size_of TYPE('a)} \\ {p ..+ nptrs * size_of TYPE('a)} = {}\")\n case True\n\n from True have notin:\n \"p' \\ ?S\"\n apply clarsimp\n apply (drule_tac x=\"p + of_nat (x * size_of TYPE('a))\" in eqset_imp_iff)\n apply (simp only: Int_iff empty_iff simp_thms)\n apply (subst(asm) intvlI, simp)\n apply (simp add: intvl_self)\n done\n\n from True have same: \"\\y < size_of TYPE('a). ?htd' (ptr_val p' + of_nat y)\n = htd (ptr_val p' + of_nat y)\"\n apply clarsimp\n apply (rule ptr_retyps_gen_out)\n apply simp\n apply (blast intro: intvlI)\n done\n\n show ?thesis\n by (clarsimp simp: h_t_valid_def valid_footprint_def Let_def\n notin same size_of_def[symmetric, where t=\"TYPE('a)\"]\n cong del: image_cong_simp)\nnext\n case False\n\n from False have nvalid: \"\\ h_t_valid htd gd p'\"\n apply (clarsimp simp: h_t_valid_def valid_footprint_def set_eq_iff\n Let_def size_of_def[symmetric, where t=\"TYPE('a)\"]\n intvl_def[where x=\"(ptr_val p', a)\" for a])\n apply (drule cleared[unfolded region_is_bytes'_def, THEN bspec])\n apply (drule spec, drule(1) mp, clarsimp)\n apply (cut_tac m=k in typ_slice_t_self[where td=\"typ_uinfo_t TYPE ('a)\"])\n apply (clarsimp simp: in_set_conv_nth)\n apply (drule_tac x=i in map_leD, simp_all)\n apply (simp add: not_byte)\n done\n\n have mod_split: \"\\k. k < nptrs * size_of TYPE('a)\n \\ \\quot rem. k = quot * size_of TYPE('a) + rem \\ rem < size_of TYPE('a) \\ quot < nptrs\"\n apply (intro exI conjI, rule div_mult_mod_eq[symmetric])\n apply simp\n apply (simp add: More_Divides.td_gal_lt)\n done\n\n have gd: \"\\p'. p' \\ ?S \\ gd p'\"\n using guard by auto\n\n note htv = h_t_valid_ptr_retyps_gen[where gd=gd, OF sz gd]\n\n show ?thesis using False\n apply (simp add: nvalid)\n apply (rule iffI, simp_all add: htv)\n apply (clarsimp simp: set_eq_iff intvl_def[where x=\"(p, a)\" for a])\n apply (drule mod_split, clarsimp)\n apply (frule_tac htv[OF imageI, simplified])\n apply fastforce\n apply (rule ccontr)\n apply (drule(1) h_t_valid_neq_disjoint)\n apply simp\n apply (clarsimp simp: field_of_t_refl)\n apply (simp add: set_eq_iff)\n apply (drule spec, drule(1) mp)\n apply (subst(asm) add.assoc[symmetric], subst(asm) intvlI, assumption)\n apply simp\n done\nqed\n\nlemma clift_ptr_retyps_gen_memset_same:\n assumes guard: \"\\n' < n. c_guard (CTypesDefs.ptr_add (Ptr p :: 'a :: mem_type ptr) (of_nat n'))\"\n assumes cleared: \"region_is_bytes' p (n * size_of TYPE('a :: mem_type)) (hrs_htd hrs)\"\n and not_byte: \"typ_uinfo_t TYPE('a :: mem_type) \\ typ_uinfo_t TYPE(word8)\"\n and nb: \"nb = n * size_of TYPE ('a)\"\n and sz: \"n * size_of TYPE('a) < 2 ^ word_bits\"\n shows \"(clift (hrs_htd_update (ptr_retyps_gen n (Ptr p :: 'a :: mem_type ptr) arr)\n (hrs_mem_update (heap_update_list p (replicate nb 0))\n hrs)) :: 'a :: mem_type typ_heap)\n = (\\y. if y \\ (CTypesDefs.ptr_add (Ptr p :: 'a :: mem_type ptr) o of_nat) ` {k. k < n}\n then Some (from_bytes (replicate (size_of TYPE('a :: mem_type)) 0)) else clift hrs y)\"\n supply if_cong[cong]\n using sz\n apply (simp add: nb liftt_if[folded hrs_mem_def hrs_htd_def]\n hrs_htd_update hrs_mem_update\n h_t_valid_ptr_retyps_gen_same[OF guard cleared not_byte]\n addr_card_wb)\n apply (rule ext, rename_tac p')\n apply (case_tac \"p' \\ ((+\\<^sub>p) (Ptr p) \\ int) ` {k. k < n}\")\n apply (clarsimp simp: h_val_def)\n apply (simp only: Word.Abs_fnat_hom_mult hrs_mem_update)\n apply (frule_tac k=\"size_of TYPE('a)\" in mult_le_mono1[where j=n, OF Suc_leI])\n apply (subst heap_list_update_list; simp?)\n apply (simp add: addr_card_def card_word word_bits_def)\n apply (clarsimp split: if_split)\n apply (simp add: h_val_def)\n apply (subst heap_list_update_disjoint_same, simp_all)\n apply (simp add: region_is_bytes_disjoint[OF cleared not_byte])\n done\n\nlemma clift_ptr_retyps_gen_prev_memset_same:\n assumes guard: \"\\n' < n. c_guard (CTypesDefs.ptr_add (Ptr p :: 'a :: mem_type ptr) (of_nat n'))\"\n assumes cleared: \"region_is_bytes' p (n * size_of TYPE('a :: mem_type)) (hrs_htd hrs)\"\n and not_byte: \"typ_uinfo_t TYPE('a :: mem_type) \\ typ_uinfo_t TYPE(word8)\"\n and nb: \"nb = n * size_of TYPE ('a)\"\n and sz: \"n * size_of TYPE('a) < 2 ^ word_bits\"\n and rep0: \"heap_list (hrs_mem hrs) nb p = replicate nb 0\"\n shows \"(clift (hrs_htd_update (ptr_retyps_gen n (Ptr p :: 'a :: mem_type ptr) arr) hrs) :: 'a :: mem_type typ_heap)\n = (\\y. if y \\ (CTypesDefs.ptr_add (Ptr p :: 'a :: mem_type ptr) o of_nat) ` {k. k < n}\n then Some (from_bytes (replicate (size_of TYPE('a :: mem_type)) 0)) else clift hrs y)\"\n using rep0\n apply (subst clift_ptr_retyps_gen_memset_same[symmetric, OF guard cleared not_byte nb sz])\n apply (rule arg_cong[where f=clift])\n apply (rule_tac f=\"hrs_htd_update f\" for f in arg_cong)\n apply (cases hrs, simp add: hrs_mem_update_def)\n apply (simp add: heap_update_list_id hrs_mem_def)\n done\n\nlemma clift_ptr_retyps_gen_other:\n assumes cleared: \"region_is_bytes' (ptr_val p) (nptrs * size_of TYPE('a :: mem_type)) (hrs_htd hrs)\"\n and sz: \"nptrs * size_of TYPE('a) < 2 ^ word_bits\"\n and other: \"typ_uinfo_t TYPE('b) \\\\<^sub>t typ_uinfo_t TYPE('a)\"\n and not_byte: \"typ_uinfo_t TYPE('b :: mem_type) \\ typ_uinfo_t TYPE(word8)\"\n shows \"(clift (hrs_htd_update (ptr_retyps_gen nptrs (p :: 'a ptr) arr) hrs) :: 'b :: mem_type typ_heap)\n = clift hrs\"\n using sz cleared\n apply (cases p)\n apply (simp add: liftt_if[folded hrs_mem_def hrs_htd_def]\n h_t_valid_def hrs_htd_update\n ptr_retyps_gen_valid_footprint[simplified addr_card_wb, OF _ other not_byte sz]\n cong: if_cong)\n done\n\nlemma clift_heap_list_update_no_heap_other:\n assumes cleared: \"region_is_bytes' p (length xs) (hrs_htd hrs)\"\n and not_byte: \"typ_uinfo_t TYPE('a :: c_type) \\ typ_uinfo_t TYPE(word8)\"\n shows \"clift (hrs_mem_update (heap_update_list p xs) hrs) = (clift hrs :: 'a typ_heap)\"\n apply (clarsimp simp: liftt_if[folded hrs_mem_def hrs_htd_def] hrs_mem_update\n fun_eq_iff h_val_def split: if_split)\n apply (subst heap_list_update_disjoint_same, simp_all)\n apply (clarsimp simp: set_eq_iff h_t_valid_def valid_footprint_def Let_def\n dest!: intvlD[where n=\"size_of TYPE('a)\"])\n apply (drule_tac x=\"of_nat k\" in spec, clarsimp simp: size_of_def)\n apply (cut_tac m=k in typ_slice_t_self[where td=\"typ_uinfo_t TYPE('a)\"])\n apply (clarsimp simp: in_set_conv_nth)\n apply (drule_tac x=i in map_leD, simp)\n apply (simp add: cleared[unfolded region_is_bytes'_def] not_byte size_of_def)\n done\n\nlemma add_is_injective_ring:\n \"inj ((+) (x :: 'a :: ring))\"\n by (rule inj_onI, clarsimp)\n\n(* assumes that y & elements are n-aligned but not that the compound\n interval is aligned to a higher power of two. needed for cte arrays. *)\nlemma ptr_span_disjoint_ptr_set_span:\n fixes y :: \"('a :: mem_type) ptr\"\n assumes align: \"is_aligned p n\"\n and size_of: \"size_of TYPE('a) = 2 ^ n\"\n and al: \"is_aligned (ptr_val y) n\"\n and card: \"b * 2 ^ n < addr_card\"\n and b: \"b \\ 0\"\n shows \"y \\ ((+\\<^sub>p) (Ptr p) \\ int) ` {k. k < b}\n \\ ptr_span y \\ {p ..+ b * 2 ^ n} = {}\"\nproof -\n from card b have word_bits: \"n < word_bits\"\n using power_increasing[where n=word_bits and N=n and a=2]\n apply (simp add: word_bits_def addr_card)\n apply (rule ccontr, simp)\n apply (cases b, simp_all)\n apply (drule(1) order_less_le_trans)\n apply simp\n done\n\n note al_sub = aligned_sub_aligned_simple[OF al align]\n\n have yuck: \"of_nat b * 2 ^ n \\ (0 :: machine_word)\"\n using of_nat_neq_0[where k=\"b * 2 ^ n\" and 'a=machine_word_len] b card\n by (clarsimp simp: addr_card_def card_word)\n\n show ?thesis\n supply image_cong_simp [cong del]\n apply (clarsimp simp add: size_of)\n apply (rule inj_image_eq_iff[OF add_is_injective_ring[where x=\"- p\"], THEN iffD1])\n apply (subst image_Int[OF add_is_injective_ring])\n apply (simp add: image_add_intvl upto_intvl_eq al_sub)\n apply (subst upto_intvl_eq', simp, simp add: b)\n apply (cut_tac card, simp add: addr_card_def card_word)\n apply safe\n apply (simp only: mask_in_range[symmetric] al_sub)\n apply simp\n apply (drule_tac f=\"(+) p\" in arg_cong, simp)\n apply (erule notE, rule_tac x=\"unat (x >> n)\" in image_eqI)\n apply (simp add: size_of)\n apply (cases y, clarsimp simp: and_not_mask shiftl_t2n)\n apply (simp add: shiftr_div_2n')\n apply (rule More_Divides.td_gal_lt[THEN iffD1], simp)\n apply (drule word_leq_minus_one_le[OF yuck])\n apply (rule unat_less_helper, simp)\n done\nqed\n\nlemma ptr_retyp_to_array:\n \"ptr_retyps_gen 1 (p :: (('a :: wf_type)['b :: finite]) ptr) False\n = ptr_retyps_gen CARD('b) (ptr_coerce p :: 'a ptr) True\"\n by (intro ext, simp add: ptr_retyps_gen_def ptr_arr_retyps_to_retyp)\n\nlemma projectKO_opt_retyp_other:\n assumes cover: \"range_cover ptr sz (objBitsKO ko) n\"\n assumes pal: \"pspace_aligned' \\\"\n assumes pno: \"pspace_no_overlap' ptr sz \\\"\n and ko_def: \"ko \\ x\"\n and pko: \"\\v. (projectKO_opt x :: ('a :: pre_storable) option) \\ Some v\"\n shows \"projectKO_opt \\\\<^sub>m\n (\\x. if x \\ set (new_cap_addrs n ptr ko) then Some ko else ksPSpace \\ x)\n = (projectKO_opt \\\\<^sub>m (ksPSpace \\) :: machine_word \\ ('a :: pre_storable) option)\" (is \"?LHS = ?RHS\")\nproof (rule ext)\n fix x\n show \"?LHS x = ?RHS x\"\n proof (cases \"x \\ set (new_cap_addrs n ptr ko)\")\n case False\n thus ?thesis by (simp add: map_comp_def)\n next\n case True\n hence \"ksPSpace \\ x = None\"\n apply -\n apply (cut_tac no_overlap_new_cap_addrs_disjoint [OF cover pal pno])\n apply (rule ccontr)\n apply (clarsimp,drule domI[where a = x])\n apply blast\n done\n thus ?thesis using True pko ko_def by simp\n qed\nqed\n\nlemma pspace_aligned_to_C:\n fixes v :: \"'a :: pre_storable\"\n assumes pal: \"pspace_aligned' s\"\n and cmap: \"cmap_relation (projectKO_opt \\\\<^sub>m (ksPSpace s) :: machine_word \\ 'a)\n (cslift x :: 'b :: mem_type typ_heap) Ptr rel\"\n and pko: \"projectKO_opt ko = Some v\"\n and pkorl: \"\\ko' (v' :: 'a). projectKO_opt ko' = Some v' \\ objBitsKO ko = objBitsKO ko'\"\n shows \"\\x\\dom (cslift x :: 'b :: mem_type typ_heap). is_aligned (ptr_val x) (objBitsKO ko)\"\n (is \"\\x\\dom ?CS. is_aligned (ptr_val x) (objBitsKO ko)\")\nproof\n fix z\n assume \"z \\ dom ?CS\"\n hence \"z \\ Ptr ` dom (projectKO_opt \\\\<^sub>m (ksPSpace s) :: machine_word \\ 'a)\" using cmap\n by (simp add: cmap_relation_def)\n hence pvz: \"ptr_val z \\ dom (projectKO_opt \\\\<^sub>m (ksPSpace s) :: machine_word \\ 'a)\"\n by clarsimp\n then obtain v' :: 'a where \"projectKO_opt (the (ksPSpace s (ptr_val z))) = Some v'\"\n and pvz: \"ptr_val z \\ dom (ksPSpace s)\"\n apply -\n apply (frule map_comp_subset_domD)\n apply (clarsimp simp: dom_def)\n done\n\n thus \"is_aligned (ptr_val z) (objBitsKO ko)\" using pal\n unfolding pspace_aligned'_def\n apply -\n apply (drule (1) bspec)\n apply (simp add: pkorl)\n done\nqed\n\nlemma pspace_aligned_to_C_cte:\n fixes v :: \"cte\"\n assumes pal: \"pspace_aligned' s\"\n and cmap: \"cmap_relation (ctes_of s) (cslift x :: cte_C typ_heap) Ptr ccte_relation\"\n and pko: \"projectKO_opt ko = Some v\"\n shows \"\\x\\dom (cslift x :: cte_C typ_heap). is_aligned (ptr_val x) (objBitsKO ko)\"\n (is \"\\x\\dom ?CS. is_aligned (ptr_val x) (objBitsKO ko)\")\nproof\n fix z\n assume \"z \\ dom ?CS\"\n hence \"z \\ Ptr ` dom (ctes_of s)\" using cmap\n by (simp add: cmap_relation_def)\n hence pvz: \"ptr_val z \\ dom (ctes_of s)\"\n by clarsimp\n thus \"is_aligned (ptr_val z) (objBitsKO ko)\" using pal pko\n unfolding pspace_aligned'_def\n apply -\n apply clarsimp\n apply (drule ctes_of_is_aligned)\n apply (cases ko, simp_all add: projectKOs)\n apply (simp add: objBits_simps)\n done\nqed\n\nlemma pspace_aligned_to_C_tcb:\n fixes v :: \"tcb\"\n assumes pal: \"pspace_aligned' s\"\n and cmap: \"cpspace_tcb_relation (ksPSpace s) (t_hrs_' (globals x))\"\n shows \"\\x\\dom (cslift x :: tcb_C typ_heap). is_aligned (ptr_val x) ctcb_size_bits\"\n (is \"\\x\\dom ?CS. is_aligned (ptr_val x) ctcb_size_bits\")\nproof\n fix z\n assume \"z \\ dom ?CS\"\n hence \"z \\ tcb_ptr_to_ctcb_ptr ` dom (map_to_tcbs (ksPSpace s))\" using cmap\n by (simp add: cmap_relation_def)\n hence pvz: \"ctcb_ptr_to_tcb_ptr z \\ dom (map_to_tcbs (ksPSpace s))\"\n by clarsimp\n then obtain v' :: tcb where \"projectKO_opt (the (ksPSpace s (ctcb_ptr_to_tcb_ptr z))) = Some v'\"\n and pvz: \"ctcb_ptr_to_tcb_ptr z \\ dom (ksPSpace s)\"\n apply -\n apply (frule map_comp_subset_domD)\n apply (clarsimp simp: dom_def)\n done\n\n thus \"is_aligned (ptr_val z) ctcb_size_bits\" using pal\n unfolding pspace_aligned'_def\n apply -\n apply (drule (1) bspec)\n apply (clarsimp simp add: projectKOs objBits_simps)\n apply (erule ctcb_ptr_to_tcb_ptr_aligned)\n done\nqed\n\nlemma ptr_add_to_new_cap_addrs:\n assumes size_of_m: \"size_of TYPE('a :: mem_type) = 2 ^ objBitsKO ko\"\n shows \"(CTypesDefs.ptr_add (Ptr ptr :: 'a :: mem_type ptr) \\ of_nat) ` {k. k < n}\n = Ptr ` set (new_cap_addrs n ptr ko)\"\n unfolding new_cap_addrs_def\n apply (simp add: comp_def image_image shiftl_t2n size_of_m field_simps)\n apply (clarsimp simp: atLeastLessThan_def lessThan_def)\n done\n\nlemma cmap_relation_retype:\n assumes cm: \"cmap_relation mp mp' Ptr rel\"\n and rel: \"rel (makeObject :: 'a :: pspace_storable) ko'\"\n shows \"cmap_relation\n (\\x. if x \\ addrs then Some (makeObject :: 'a :: pspace_storable) else mp x)\n (\\y. if y \\ Ptr ` addrs then Some ko' else mp' y)\n Ptr rel\"\n using cm rel\n apply -\n apply (rule cmap_relationI)\n apply (simp add: dom_if cmap_relation_def image_Un)\n apply (case_tac \"x \\ addrs\")\n apply simp\n apply simp\n apply (subst (asm) if_not_P)\n apply clarsimp\n apply (erule (2) cmap_relation_relI)\n done\n\nlemma word_rcat_single[simp]:\n \"word_rcat [x] = x\"\n by (simp add: word_rcat_def bin_rcat_def)\n\nlemma update_ti_t_machine_word_0s:\n \"update_ti_t (typ_info_t TYPE(machine_word)) [0,0,0,0,0,0,0,0] X = 0\"\n \"word_rcat [0, 0, 0, 0,0,0,0,(0 :: word8)] = (0 :: machine_word)\"\n by (simp_all add: typ_info_word word_rcat_def bin_rcat_def)\n\nlemma retype_guard_helper:\n assumes cover: \"range_cover p sz (objBitsKO ko) n\"\n and ptr0: \"p \\ 0\"\n and szo: \"size_of TYPE('a :: c_type) = 2 ^ objBitsKO ko\"\n and lt2: \"m \\ objBitsKO ko\"\n and ala: \"align_of TYPE('a :: c_type) = 2 ^ m\"\n shows \"\\b < n. c_guard (CTypesDefs.ptr_add (Ptr p :: 'a ptr) (of_nat b))\"\nproof (rule allI, rule impI)\n fix b :: nat\n assume nv: \"b < n\"\n let ?p = \"(Ptr p :: 'a ptr)\"\n\n have \"of_nat b * of_nat (size_of TYPE('a)) = (of_nat (b * 2 ^ objBitsKO ko) :: machine_word)\"\n by (simp add: szo)\n\n also have \"\\ < (2 :: machine_word) ^ sz\" using nv cover\n apply simp\n apply (rule word_less_power_trans_ofnat)\n apply (erule less_le_trans)\n apply (erule range_cover.range_cover_n_le(2))\n apply (erule range_cover.sz)+\n done\n\n finally have ofn: \"of_nat b * of_nat (size_of TYPE('a)) < (2 :: machine_word) ^ sz\" .\n\n have le: \"p \\ p + of_nat b * 2 ^ objBitsKO ko\"\n using ofn szo nv\n apply -\n apply (cases b,clarsimp+)\n apply (cut_tac n = nat in range_cover_ptr_le)\n apply (rule range_cover_le[OF cover])\n apply simp\n apply (simp add:ptr0)\n apply (simp add:shiftl_t2n field_simps)\n done\n\n show \"c_guard (CTypesDefs.ptr_add ?p (of_nat b))\"\n apply (rule is_aligned_c_guard[OF _ _ ala _ lt2])\n apply (simp add: szo)\n apply (rule is_aligned_add)\n apply (rule range_cover.aligned, rule cover)\n apply (rule is_aligned_mult_triv2)\n apply (simp add: szo neq_0_no_wrap[OF le ptr0])\n apply (simp add: szo)\n done\nqed\n\nlemma retype_guard_helper2:\n assumes cover: \"range_cover p sz (objBitsKO ko) n\"\n and ptr0: \"p \\ 0\"\n and szo: \"size_of TYPE('a :: c_type) = 2 ^ objBitsKO ko\"\n and ala: \"align_of TYPE('a :: c_type) \\ set (map (\\x. 2 ^ x) [0 ..< Suc (objBitsKO ko)])\"\n shows \"\\b < n. c_guard (CTypesDefs.ptr_add (Ptr p :: 'a ptr) (of_nat b))\"\n using ala retype_guard_helper[OF cover ptr0 szo]\n by (clarsimp simp del: upt.simps)\n\n(* When we are retyping, CTEs in the system do not change,\n * unless we happen to be retyping into a CNode or a TCB,\n * in which case new CTEs only pop up in the new object. *)\nlemma retype_ctes_helper:\n assumes pal: \"pspace_aligned' s\"\n and pdst: \"pspace_distinct' s\"\n and pno: \"pspace_no_overlap' ptr sz s\"\n and al: \"is_aligned ptr (objBitsKO ko)\"\n and sz: \"objBitsKO ko \\ sz\"\n and szb: \"sz < word_bits\"\n and mko: \"makeObjectKO dev tp = Some ko\"\n and rc: \"range_cover ptr sz (objBitsKO ko) n\"\n shows \"map_to_ctes (\\xa. if xa \\ set (new_cap_addrs n ptr ko) then Some ko else ksPSpace s xa) =\n (\\x. if tp = Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) \\ x \\ set (new_cap_addrs n ptr ko) \\\n tp = Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject) \\\n x && ~~ mask tcbBlockSizeBits \\ set (new_cap_addrs n ptr ko) \\ x && mask tcbBlockSizeBits \\ dom tcb_cte_cases\n then Some (CTE capability.NullCap nullMDBNode) else ctes_of s x)\"\n using mko pal pdst\nproof (rule ctes_of_retype)\n show \"pspace_aligned' (s\\ksPSpace := \\xa. if xa \\ set (new_cap_addrs n ptr ko) then Some ko else ksPSpace s xa\\)\"\n using pal pdst pno szb al sz rc\n apply -\n apply (rule retype_aligned_distinct'', simp_all)\n done\n\n show \"pspace_distinct' (s\\ksPSpace := \\xa. if xa \\ set (new_cap_addrs n ptr ko) then Some ko else ksPSpace s xa\\)\"\n using pal pdst pno szb al sz rc\n apply -\n apply (rule retype_aligned_distinct'', simp_all)\n done\n\n show \"\\x\\set (new_cap_addrs n ptr ko). is_aligned x (objBitsKO ko)\"\n using al szb\n apply -\n apply (rule new_cap_addrs_aligned, simp_all)\n done\n\n show \"\\x\\set (new_cap_addrs n ptr ko). ksPSpace s x = None\"\n using al szb pno pal rc sz\n apply -\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (frule new_cap_addrs_subset)\n apply (clarsimp simp: More_Word_Operations.ptr_add_def field_simps)\n apply fastforce\n done\nqed\n\nlemma ptr_retyps_htd_safe:\n \"\\ htd_safe D htd;\n {ptr_val ptr ..+ n * size_of TYPE('a :: mem_type)}\n \\ D \\\n \\ htd_safe D (ptr_retyps_gen n (ptr :: 'a ptr) arr htd)\"\n apply (clarsimp simp: htd_safe_def)\n apply (case_tac \"a \\ {ptr_val ptr..+n * size_of TYPE('a)}\")\n apply blast\n apply (case_tac \"(a, b) \\ dom_s htd\")\n apply blast\n apply (clarsimp simp: dom_s_def ptr_retyps_gen_out)\n done\n\nlemma ptr_retyps_htd_safe_neg:\n \"\\ htd_safe D htd; {ptr_val ptr ..+ n * size_of TYPE('a :: mem_type)} \\ D' = {}; -D \\ D' \\\n \\ htd_safe D (ptr_retyps_gen n (ptr :: 'a ptr) arr htd)\"\n using ptr_retyps_htd_safe by blast\n\nlemmas ptr_retyps_htd_safe_neg' = ptr_retyps_htd_safe_neg[OF _ _ subset_refl]\n\nlemma region_is_bytes_subset:\n \"region_is_bytes' ptr sz htd\n \\ {ptr' ..+ sz'} \\ {ptr ..+ sz}\n \\ region_is_bytes' ptr' sz' htd\"\n by (auto simp: region_is_bytes'_def)\n\nlemma (in range_cover) strong_times_64:\n \"len_of TYPE('a) = len_of TYPE(64) \\ n * 2 ^ sbit < 2 ^ word_bits\"\n apply (simp add: nat_mult_power_less_eq)\n apply (rule order_less_le_trans, rule string)\n apply (simp add: word_bits_def)\n done\n\n(* Helper for use in the many proofs below. *)\nlemma cslift_ptr_retyp_other_inst:\n assumes bytes: \"region_is_bytes' p (n * (2 ^ bits)) (hrs_htd hp)\"\n and cover: \"range_cover p sz bits n\"\n and sz: \"region_sz = n * size_of TYPE('a :: mem_type)\"\n and sz2: \"size_of TYPE('a :: mem_type) = 2 ^ bits\"\n and tdisj: \"typ_uinfo_t TYPE('b) \\\\<^sub>t typ_uinfo_t TYPE('a)\"\n and not_byte: \"typ_uinfo_t TYPE('b :: mem_type) \\ typ_uinfo_t TYPE(word8)\"\n shows \"(clift (hrs_htd_update (ptr_retyps_gen n (Ptr p :: 'a :: mem_type ptr) arr)\n hp) :: 'b :: mem_type typ_heap)\n = clift hp\"\n using bytes\n apply (subst clift_ptr_retyps_gen_other[OF _ _ tdisj not_byte], simp_all)\n apply (simp add: sz2)\n apply (simp add: sz2 range_cover.strong_times_64[OF cover])\n done\n\n(* Helper for use in the many proofs below. *)\nlemma cslift_ptr_retyp_memset_other_inst:\n assumes bytes: \"region_is_bytes p (n * (2 ^ bits)) x\"\n and cover: \"range_cover p sz bits n\"\n and sz: \"region_sz = n * size_of TYPE('a :: mem_type)\"\n and sz2: \"size_of TYPE('a :: mem_type) = 2 ^ bits\"\n and tdisj: \"typ_uinfo_t TYPE('b) \\\\<^sub>t typ_uinfo_t TYPE('a)\"\n and not_byte: \"typ_uinfo_t TYPE('b :: mem_type) \\ typ_uinfo_t TYPE(word8)\"\n shows \"(clift (hrs_htd_update (ptr_retyps_gen n (Ptr p :: 'a :: mem_type ptr) arr)\n (hrs_mem_update (heap_update_list p (replicate (region_sz) 0))\n (t_hrs_' (globals x)))) :: 'b :: mem_type typ_heap)\n = cslift x\"\n using bytes\n apply (subst cslift_ptr_retyp_other_inst[OF _ cover sz sz2 tdisj not_byte])\n apply simp\n apply (rule clift_heap_list_update_no_heap_other[OF _ not_byte])\n apply (simp add: hrs_htd_def sz sz2)\n done\n\nlemma ptr_retyps_one:\n \"ptr_retyps (Suc 0) = ptr_retyp\"\n apply (rule ext)+\n apply simp\n done\n\nlemma uinfo_array_tag_n_m_not_le_typ_name:\n \"typ_name (typ_info_t TYPE('b)) @ ''_array_'' @ nat_to_bin_string m\n \\ td_names (typ_info_t TYPE('a))\n \\ \\ uinfo_array_tag_n_m TYPE('b :: c_type) n m \\ typ_uinfo_t TYPE('a :: c_type)\"\n apply (clarsimp simp: typ_tag_le_def typ_uinfo_t_def)\n apply (drule td_set_td_names)\n apply (clarsimp simp: uinfo_array_tag_n_m_def typ_uinfo_t_def)\n apply (drule arg_cong[where f=\"\\xs. set ''r'' \\ set xs\"], simp)\n apply (simp add: uinfo_array_tag_n_m_def typ_uinfo_t_def)\n done\n\nlemma tag_not_le_via_td_name:\n \"typ_name (typ_info_t TYPE('a)) \\ td_names (typ_info_t TYPE('b))\n \\ typ_name (typ_info_t TYPE('a)) \\ pad_typ_name\n \\ \\ typ_uinfo_t TYPE('a :: c_type) \\ typ_uinfo_t TYPE ('b :: c_type)\"\n apply (clarsimp simp: typ_tag_le_def typ_uinfo_t_def)\n apply (drule td_set_td_names, simp+)\n done\n\nlemma in_set_list_map:\n \"x \\ set xs \\ \\n. [n \\ x] \\\\<^sub>m list_map xs\"\n apply (clarsimp simp: in_set_conv_nth)\n apply (rule_tac x=i in exI)\n apply (simp add: map_le_def)\n done\n\nlemma h_t_valid_eq_array_valid:\n \"h_t_valid htd gd (p :: (('a :: wf_type)['b :: finite]) ptr)\n = (gd p \\ h_t_array_valid htd (ptr_coerce p :: 'a ptr) CARD('b))\"\n by (auto simp: h_t_array_valid_def h_t_valid_def\n typ_uinfo_array_tag_n_m_eq)\n\nlemma h_t_array_valid_ptr_retyps_gen:\n assumes sz2: \"size_of TYPE('a :: mem_type) = sz\"\n assumes bytes: \"region_is_bytes' (ptr_val p) (n * sz) htd\"\n shows \"h_t_array_valid htd p' n'\n \\ h_t_array_valid (ptr_retyps_gen n (p :: 'a :: mem_type ptr) arr htd) p' n'\"\n apply (clarsimp simp: h_t_array_valid_def valid_footprint_def)\n apply (drule spec, drule(1) mp, clarsimp)\n apply (case_tac \"ptr_val p' + of_nat y \\ {ptr_val p ..+ n * size_of TYPE('a)}\")\n apply (cut_tac s=\"uinfo_array_tag_n_m TYPE('b) n' n'\" and n=y in ladder_set_self)\n apply (clarsimp dest!: in_set_list_map)\n apply (drule(1) map_le_trans)\n apply (simp add: map_le_def)\n apply (subst(asm) bytes[unfolded region_is_bytes'_def, rule_format, symmetric])\n apply (simp add: sz2)\n apply (simp add: uinfo_array_tag_n_m_def typ_uinfo_t_def typ_info_word)\n apply simp\n apply (simp add: ptr_retyps_gen_out)\n done\n\nlemma cvariable_array_ptr_retyps:\n assumes sz2: \"size_of TYPE('a :: mem_type) = sz\"\n assumes bytes: \"region_is_bytes' (ptr_val p) (n * sz) htd\"\n shows \"cvariable_array_map_relation m ns ptrfun htd\n \\ cvariable_array_map_relation m ns (ptrfun :: _ \\ ('b :: mem_type) ptr)\n (ptr_retyps_gen n (p :: 'a :: mem_type ptr) arr htd)\"\n by (clarsimp simp: cvariable_array_map_relation_def\n h_t_array_valid_ptr_retyps_gen[OF sz2 bytes])\n\nlemma cvariable_array_ptr_upd:\n assumes at: \"h_t_array_valid htd (ptrfun x) (ns y)\"\n shows \"cvariable_array_map_relation m ns ptrfun htd\n \\ cvariable_array_map_relation (m(x \\ y))\n ns (ptrfun :: _ \\ ('b :: mem_type) ptr) htd\"\n by (clarsimp simp: cvariable_array_map_relation_def at\n split: if_split)\n\nlemma clift_eq_h_t_valid_eq:\n \"clift hp = (clift hp' :: ('a :: c_type) ptr \\ _)\n \\ (h_t_valid (hrs_htd hp) c_guard :: 'a ptr \\ _)\n = h_t_valid (hrs_htd hp') c_guard\"\n by (rule ext, simp add: h_t_valid_clift_Some_iff)\n\nlemma region_is_bytes_typ_region_bytes:\n \"{ptr ..+ len} \\ {ptr' ..+ 2 ^ bits}\n \\ region_is_bytes' ptr len (typ_region_bytes ptr' bits htd)\"\n apply (clarsimp simp: region_is_bytes'_def typ_region_bytes_def hrs_htd_update)\n apply (simp add: subsetD split: if_split_asm)\n done\n\nlemma region_actually_is_bytes_retyp_disjoint:\n \"{ptr ..+ sz} \\ {ptr_val (p :: 'a ptr)..+n * size_of TYPE('a :: mem_type)} = {}\n \\ region_actually_is_bytes' ptr sz htd\n \\ region_actually_is_bytes' ptr sz (ptr_retyps_gen n p arr htd)\"\n apply (clarsimp simp: region_actually_is_bytes'_def del: impI)\n apply (subst ptr_retyps_gen_out)\n apply blast\n apply simp\n done\n\nlemma intvl_plus_unat_eq:\n \"p \\ p + x - 1 \\ x \\ 0\n \\ {p ..+ unat x} = {p .. p + x - 1}\"\n apply (subst upto_intvl_eq', simp_all add: unat_eq_0 field_simps)\n apply (rule order_less_imp_le, simp)\n done\n\nlemma zero_ranges_ptr_retyps:\n \"zero_ranges_are_zero (gsUntypedZeroRanges s) hrs\n \\ caps_overlap_reserved' {ptr_val (p :: 'a ptr) ..+ n * size_of TYPE ('a :: mem_type)} s\n \\ untyped_ranges_zero' s\n \\ valid_objs' s\n \\ zero_ranges_are_zero (gsUntypedZeroRanges s)\n (hrs_htd_update (ptr_retyps_gen n p arr) hrs)\"\n apply (clarsimp simp: zero_ranges_are_zero_def untyped_ranges_zero_inv_def\n hrs_htd_update)\n apply (drule(1) bspec, clarsimp)\n apply (rule region_actually_is_bytes_retyp_disjoint, simp_all)\n apply (clarsimp simp: map_comp_Some_iff cteCaps_of_def\n elim!: ranE)\n apply (frule(1) ctes_of_valid')\n apply (simp add: caps_overlap_reserved'_def,\n drule bspec, erule ranI)\n apply (frule(1) untypedZeroRange_to_usableCapRange)\n apply (clarsimp simp: isCap_simps untypedZeroRange_def\n getFreeRef_def max_free_index_def\n split: if_split_asm)\n apply (erule disjoint_subset[rotated])\n apply (subst intvl_plus_unat_eq)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: word_unat.Rep_inject[symmetric]\n valid_cap_simps' capAligned_def\n unat_of_nat\n simp del: word_unat.Rep_inject)\n apply clarsimp\n done\n\nabbreviation\n \"ret_zero ptr sz\n \\ valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ptr ..+ sz}\"\n\nlemma createObjects_ccorres_ep:\n defines \"ko \\ (KOEndpoint (makeObject :: endpoint))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr\n \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (n * (2 ^ objBitsKO ko)) \\\n \\ region_is_zero_bytes ptr (n * (2 ^ objBitsKO ko)) x\n \\ range_cover ptr sz (objBitsKO ko) n\n \\ {ptr ..+ n * (2 ^ objBitsKO ko)} \\ kernel_data_refs = {}\n \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs n ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen n (Ptr ptr :: endpoint_C ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: endpoint_C ptr\"\n\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and al: \"is_aligned ptr (objBitsKO ko)\" and ptr0: \"ptr \\ 0\"\n and sz: \"objBitsKO ko \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (n * (2 ^ objBitsKO ko)) \\\"\n and empty: \"region_is_bytes ptr (n * (2 ^ objBitsKO ko)) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (n * (2 ^ objBitsKO ko))\"\n and rc: \"range_cover ptr sz (objBitsKO ko) n\"\n and kdr: \"{ptr..+n * (2 ^ objBitsKO ko)} \\ kernel_data_refs = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Some ko\"\n by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cendpoint_relation (cslift x) makeObject (from_bytes (replicate (size_of TYPE(endpoint_C)) 0))\"\n unfolding cendpoint_relation_def\n apply (simp add: Let_def makeObject_endpoint size_of_def endpoint_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps endpoint_C_tag_def endpoint_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n_eq)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: EPState_Idle_def update_ti_t_machine_word_0s)\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(endpoint_C) = 2 ^ objBitsKO ko\" by (simp add: size_of_def objBits_simps' ko_def)\n have szo': \"n * (2 ^ objBitsKO ko) = n * size_of TYPE(endpoint_C)\"\n by (metis szo)\n\n note rl' = cslift_ptr_retyp_other_inst[OF empty cover[simplified] szo' szo]\n\n note rl = projectKO_opt_retyp_other [OF rc pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al sz szb mko rc, simplified]\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have guard:\n \"\\b < n. c_guard (CTypesDefs.ptr_add ?ptr (of_nat b))\"\n apply (rule retype_guard_helper [where m = 3, OF cover ptr0 szo])\n apply (simp add: ko_def objBits_simps')\n apply (simp add: align_of_def)\n done\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n apply -\n supply image_cong_simp[cong del]\n apply (clarsimp simp: rl' cterl tag_disj_via_td_name foldr_upd_app_if [folded data_map_insert_def]\n heap_to_user_data_def cte_C_size heap_to_device_data_def)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard _ _ szo' _ zero],\n simp_all only: szo empty, simp_all)\n apply (rule range_cover.strong_times_64[OF cover refl])\n apply (simp add: ptr_add_to_new_cap_addrs [OF szo] ht_rl)\n apply (simp add: rl projectKO_opt_retyp_same projectKOs)\n apply (simp add: ko_def projectKO_opt_retyp_same projectKOs cong: if_cong)\n apply (erule cmap_relation_retype)\n apply (rule relrl[simplified szo ko_def])\n done\n\n thus ?thesis using rf empty kdr rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl'\n tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (simp add: rl' cterl tag_disj_via_td_name h_t_valid_clift_Some_iff)\n apply (clarsimp simp: hrs_htd_update ptr_retyps_htd_safe_neg szo\n kernel_data_refs_domain_eq_rotate\n ht_rl foldr_upd_app_if [folded data_map_insert_def]\n rl projectKOs cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps\n simp del: endpoint_C_size)\n done\nqed\n\nlemma createObjects_ccorres_ntfn:\n defines \"ko \\ (KONotification (makeObject :: Structures_H.notification))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (n * (2 ^ objBitsKO ko)) \\\n \\ region_is_zero_bytes ptr (n * 2 ^ objBitsKO ko) x\n \\ range_cover ptr sz (objBitsKO ko) n\n \\ {ptr ..+ n * (2 ^ objBitsKO ko)} \\ kernel_data_refs = {}\n \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs n ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen n (Ptr ptr :: notification_C ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\n\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: notification_C ptr\"\n\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and al: \"is_aligned ptr (objBitsKO ko)\" and ptr0: \"ptr \\ 0\"\n and sz: \"objBitsKO ko \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (n * (2 ^ objBitsKO ko)) \\\"\n and empty: \"region_is_bytes ptr (n * (2 ^ objBitsKO ko)) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (n * (2 ^ objBitsKO ko))\"\n and rc: \"range_cover ptr sz (objBitsKO ko) n\"\n and kdr: \"{ptr..+n * 2 ^ objBitsKO ko} \\ kernel_data_refs = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n (* obj specific *)\n have mko: \"\\ dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Some ko\" by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cnotification_relation (cslift x) makeObject (from_bytes (replicate (size_of TYPE(notification_C)) 0))\"\n unfolding cnotification_relation_def\n apply (simp add: Let_def makeObject_notification size_of_def notification_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps notification_C_tag_def notification_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: update_ti_t_machine_word_0s NtfnState_Idle_def option_to_ctcb_ptr_def)\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(notification_C) = 2 ^ objBitsKO ko\" by (simp add: size_of_def objBits_simps' ko_def)\n have szo': \"n * (2 ^ objBitsKO ko) = n * size_of TYPE(notification_C)\" using sz\n apply (subst szo)\n apply (simp add: power_add [symmetric])\n done\n\n note rl' = cslift_ptr_retyp_other_inst[OF empty cover[simplified] szo' szo]\n\n (* rest is generic *)\n note rl = projectKO_opt_retyp_other [OF rc pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al sz szb mko rc, simplified]\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have guard:\n \"\\b) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n apply -\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl tag_disj_via_td_name foldr_upd_app_if [folded data_map_insert_def]\n heap_to_user_data_def cte_C_size)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard _ _ szo' _ zero],\n simp_all only: szo empty, simp_all)\n apply (rule range_cover.strong_times_64[OF cover refl])\n apply (simp add: ptr_add_to_new_cap_addrs [OF szo] ht_rl)\n apply (simp add: rl projectKO_opt_retyp_same projectKOs)\n apply (simp add: ko_def projectKO_opt_retyp_same projectKOs cong: if_cong)\n apply (erule cmap_relation_retype)\n apply (rule relrl[simplified szo ko_def])\n done\n\n thus ?thesis using rf empty kdr rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (simp add: rl' cterl tag_disj_via_td_name h_t_valid_clift_Some_iff )\n apply (clarsimp simp: hrs_htd_update ptr_retyps_htd_safe_neg szo\n kernel_data_refs_domain_eq_rotate\n ht_rl foldr_upd_app_if [folded data_map_insert_def]\n rl projectKOs cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps\n simp del: notification_C_size)\n done\nqed\n\n\nlemma ccte_relation_makeObject:\n notes option.case_cong_weak [cong]\n shows \"ccte_relation makeObject (from_bytes (replicate (size_of TYPE(cte_C)) 0))\"\n apply (simp add: Let_def makeObject_cte size_of_def ccte_relation_def map_option_Some_eq2)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps cte_C_tag_def cte_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def align_of_def\n typ_info_simps cap_C_tag_def mdb_node_C_tag_def split: option.splits)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def update_ti_t_machine_word_0s)\n apply (simp add: cap_lift_def Let_def cap_get_tag_def cap_tag_defs cte_to_H_def cap_to_H_def mdb_node_to_H_def\n mdb_node_lift_def nullMDBNode_def c_valid_cte_def)\n done\n\nlemma ccte_relation_nullCap:\n notes option.case_cong_weak [cong]\n shows \"ccte_relation (CTE NullCap (MDB 0 0 False False)) (from_bytes (replicate (size_of TYPE(cte_C)) 0))\"\n apply (simp add: Let_def makeObject_cte size_of_def ccte_relation_def map_option_Some_eq2)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps cte_C_tag_def cte_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def align_of_def\n typ_info_simps cap_C_tag_def mdb_node_C_tag_def split: option.splits)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def update_ti_t_machine_word_0s)\n apply (simp add: cap_lift_def Let_def cap_get_tag_def cap_tag_defs cte_to_H_def cap_to_H_def mdb_node_to_H_def\n mdb_node_lift_def nullMDBNode_def c_valid_cte_def)\n done\n\nlemma createObjects_ccorres_cte:\n defines \"ko \\ (KOCTE (makeObject :: cte))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (n * 2 ^ objBitsKO ko) \\\n \\ region_is_zero_bytes ptr (n * 2 ^ objBitsKO ko) x\n \\ range_cover ptr sz (objBitsKO ko) n\n \\ {ptr ..+ n * (2 ^ objBitsKO ko)} \\ kernel_data_refs = {}\n \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs n ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen n (Ptr ptr :: cte_C ptr) True)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: cte_C ptr\"\n\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and al: \"is_aligned ptr (objBitsKO ko)\" and ptr0: \"ptr \\ 0\"\n and sz: \"objBitsKO ko \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (n * 2 ^ objBitsKO ko) \\\"\n and empty: \"region_is_bytes ptr (n * (2 ^ objBitsKO ko)) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (n * (2 ^ objBitsKO ko))\"\n and rc: \"range_cover ptr sz (objBitsKO ko) n\"\n and kdr: \"{ptr..+n * 2 ^ objBitsKO ko} \\ kernel_data_refs = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Some ko\"\n by (simp add: ko_def makeObjectKO_def)\n\n note relrl = ccte_relation_makeObject\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(cte_C) = 2 ^ objBitsKO ko\" by (simp add: size_of_def objBits_simps' ko_def)\n have szo': \"n * 2 ^ objBitsKO ko = n * size_of TYPE(cte_C)\" using sz\n apply (subst szo)\n apply (simp add: power_add [symmetric])\n done\n\n note rl' = cslift_ptr_retyp_other_inst[OF empty cover szo' szo]\n\n (* rest is generic *)\n note rl = projectKO_opt_retyp_other [OF rc pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al sz szb mko rc, simplified]\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have guard:\n \"\\b< n. c_guard (CTypesDefs.ptr_add ?ptr (of_nat b))\"\n apply (rule retype_guard_helper[where m=3, OF cover ptr0 szo])\n apply (simp add: ko_def objBits_simps' align_of_def)+\n done\n\n note irq = h_t_valid_eq_array_valid[where 'a=cte_C]\n h_t_array_valid_ptr_retyps_gen[where p=\"Ptr ptr\", simplified, OF szo empty]\n\n with rf have irq: \"h_t_valid (hrs_htd ?ks') c_guard intStateIRQNode_array_Ptr\"\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (simp add: hrs_htd_update h_t_valid_eq_array_valid)\n apply (simp add: h_t_array_valid_ptr_retyps_gen[OF szo] empty)\n done\n\n note if_cong[cong] (* needed by some of the [simplified]'s below. *)\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n apply -\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl tag_disj_via_td_name foldr_upd_app_if [folded data_map_insert_def])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard _ _ szo' _ zero],\n simp_all only: szo empty, simp_all)\n apply (rule range_cover.strong_times_64[OF cover refl])\n apply (simp add: ptr_add_to_new_cap_addrs [OF szo] ht_rl)\n apply (simp add: rl projectKO_opt_retyp_same projectKOs)\n apply (simp add: ko_def projectKO_opt_retyp_same projectKOs cong: if_cong)\n apply (subst makeObject_cte[symmetric])\n apply (erule cmap_relation_retype)\n apply (rule relrl[simplified szo ko_def])\n done\n\n thus ?thesis using rf empty kdr irq rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (simp add: rl' cterl tag_disj_via_td_name h_t_valid_clift_Some_iff)\n apply (clarsimp simp: hrs_htd_update ptr_retyps_htd_safe_neg szo\n kernel_data_refs_domain_eq_rotate\n rl foldr_upd_app_if [folded data_map_insert_def] projectKOs\n zero_ranges_ptr_retyps\n ht_rl cvariable_array_ptr_retyps[OF szo])\n done\nqed\n\nlemma h_t_valid_ptr_retyps_gen_disjoint_iff:\n \"\\ {ptr_val p..+ size_of TYPE('b)} \\ {ptr_val ptr..+n * size_of TYPE('a)} = {} \\ \\\n ptr_retyps_gen n (ptr::'a::mem_type ptr) arr d \\\\<^sub>t (p::'b::c_type ptr) = d \\\\<^sub>t p\"\n apply (cases \"0 < size_td (typ_info_t TYPE('b))\"; cases \"c_guard p\";\n clarsimp simp: h_t_valid_def valid_footprint_def Let_def)\n apply (rule forall_eq[rule_format], rule iff_impI)\n apply (subgoal_tac \"ptr_val p + of_nat y \\ {ptr_val ptr..+n * size_of TYPE('a)}\")\n apply (simp add: ptr_retyps_gen_out)\n apply clarsimp\n apply (drule intvlD)\n apply (clarsimp simp: disjoint_iff_not_equal )\n apply (drule_tac x = \"ptr_val p + of_nat y\" in bspec)\n apply (rule intvlI)\n apply (simp add: size_of_def)\n apply (drule_tac x = \"ptr_val ptr + of_nat k\" in bspec)\n apply (erule intvlI)\n apply simp\n done\n\nlemma h_t_valid_ptr_retyps_gen_disjoint:\n \"\\ d \\\\<^sub>t p; {ptr_val p..+ size_of TYPE('b)} \\ {ptr_val ptr..+n * size_of TYPE('a)} = {} \\ \\\n ptr_retyps_gen n (ptr::'a::mem_type ptr) arr d \\\\<^sub>t (p::'b::mem_type ptr)\"\n using h_t_valid_ptr_retyps_gen_disjoint_iff[where arr=arr and d=d] by auto\n\nlemma range_cover_intvl:\nassumes cover: \"range_cover (ptr :: 'a :: len word) sz us n\"\nassumes not0 : \"n \\ 0\"\nshows \"{ptr..+n * 2 ^ us} = {ptr..ptr + (of_nat n * 2 ^ us - 1)}\"\n proof\n have not0' : \"(0 :: 'a word) < of_nat n * (2 :: 'a word) ^ us\"\n using range_cover_not_zero_shift[OF _ cover,where gbits = \"us\"]\n apply (simp add:not0 shiftl_t2n field_simps)\n apply unat_arith\n done\n\n show \"{ptr..+n * 2 ^ us} \\ {ptr..ptr + (of_nat n* 2 ^ us - 1)}\"\n using not0 not0'\n apply (clarsimp simp:intvl_def)\n apply (intro conjI)\n apply (rule word_plus_mono_right2[rotated,where b = \"of_nat n * 2^us - 1\"])\n apply (subst le_m1_iff_lt[THEN iffD1])\n apply (simp add:not0')\n apply (rule word_of_nat_less)\n apply (clarsimp simp: range_cover.unat_of_nat_shift[OF cover] field_simps)\n apply (clarsimp simp: field_simps)\n apply (erule range_cover_bound[OF cover])\n apply (rule word_plus_mono_right)\n apply (subst le_m1_iff_lt[THEN iffD1])\n apply (simp add:not0')\n apply (rule word_of_nat_less)\n apply (clarsimp simp: range_cover.unat_of_nat_shift[OF cover] field_simps)\n apply (clarsimp simp: field_simps)\n apply (erule range_cover_bound[OF cover])\n done\n show \"{ptr..ptr + (of_nat n * 2 ^ us - 1)} \\ {ptr..+n * 2 ^ us}\"\n using not0 not0'\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x = \"unat (x - ptr)\" in exI)\n apply simp\n apply (simp add:field_simps)\n apply (rule unat_less_helper)\n apply (subst le_m1_iff_lt[THEN iffD1,symmetric])\n apply (simp add:field_simps not0 range_cover_not_zero_shift[unfolded shiftl_t2n,OF _ _ le_refl])\n apply (rule word_diff_ls')\n apply (simp add:field_simps)\n apply simp\n done\n qed\n\nlemma aligned_new_cap_addrs_eq_base:\n \"is_aligned p bits \\ is_aligned ptr bits\n \\ n = 2 ^ (bits - objBitsKO ko)\n \\ objBitsKO ko = shft\n \\ y < of_nat n\n \\ (p + (y << shft) \\ set (new_cap_addrs n ptr ko)) = (p = ptr)\"\n apply (erule is_aligned_get_word_bits)\n apply (rule iffI)\n apply (clarsimp simp: new_cap_addrs_def)\n apply (rule ccontr, drule(2) aligned_neq_into_no_overlap)\n apply (simp only: field_simps upto_intvl_eq[symmetric])\n apply (drule equals0D, erule notE, rule_tac c=\"p + (y << shft)\" in IntI)\n apply (simp(no_asm) add: offs_in_intvl_iff)\n apply (rule unat_less_helper, simp, rule shiftl_less_t2n; simp)\n apply (simp add: offs_in_intvl_iff)\n apply (rule unat_less_helper, simp, rule shiftl_less_t2n; simp add: word_of_nat_less)\n apply (simp add: new_cap_addrs_def)\n apply (rule_tac x=\"unat y\" in image_eqI; simp add: unat_less_helper)\n apply (erule is_aligned_get_word_bits; simp)\n apply (simp add: new_cap_addrs_def)\n apply (rule_tac x=\"unat y\" in image_eqI; simp add: unat_less_helper)\n done\n\nlemma cmap_relation_array_add_array[OF refl]:\n \"ptrf = Ptr \\ carray_map_relation n ahp chp ptrf\n \\ is_aligned p n\n \\ ahp' = (\\x. if x \\ set (new_cap_addrs sz p ko) then Some v else ahp x)\n \\ (\\x. chp x \\ is_aligned (ptr_val x) n \\ \\y. chp' y = (y = ptrf p | chp y))\n \\ sz = 2 ^ (n - objBits v)\n \\ objBitsKO ko = objBitsKO (injectKOS v)\n \\ objBits v \\ n \\ n < word_bits\n \\ carray_map_relation n ahp' chp' ptrf\"\n apply (clarsimp simp: carray_map_relation_def objBits_koTypeOf\n objBitsT_koTypeOf[symmetric]\n koTypeOf_injectKO\n simp del: objBitsT_koTypeOf)\n apply (drule meta_mp)\n apply auto[1]\n apply (case_tac \"pa = p\"; clarsimp)\n apply (subst if_P; simp add: new_cap_addrs_def)\n apply (rule_tac x=\"unat ((p' && mask n) >> objBitsKO ko)\" in image_eqI)\n apply (simp add: shiftr_shiftl1 is_aligned_andI1 add.commute\n word_plus_and_or_coroll2)\n apply (simp, rule unat_less_helper, simp, rule shiftr_less_t2n)\n apply (simp add: and_mask_less_size word_size word_bits_def)\n apply (case_tac \"chp (ptrf pa)\", simp_all)\n apply (drule spec, drule(1) iffD2)\n apply (auto split: if_split)[1]\n apply (drule_tac x=pa in spec, clarsimp)\n apply (drule_tac x=p' in spec, clarsimp split: if_split_asm)\n apply (clarsimp simp: new_cap_addrs_def)\n apply (subst(asm) is_aligned_add_helper, simp_all)\n apply (rule shiftl_less_t2n, rule word_of_nat_less, simp_all add: word_bits_def)\n done\n\nlemma createObjects_ccorres_pte:\n defines \"ko \\ (KOArch (KOPTE (makeObject :: pte)))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (2 ^ ptBits) \\\n \\ region_is_zero_bytes ptr (2 ^ ptBits) x\n \\ range_cover ptr sz ptBits 1\n \\ valid_global_refs' s\n \\ kernel_data_refs \\ {ptr..+ 2 ^ ptBits} = {} \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs 512 ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen 1 (pt_Ptr ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: (pte_C[512]) ptr\"\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz ptBits 1\"\n and al: \"is_aligned ptr ptBits\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"ptBits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\"\n and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (2 ^ ptBits) \\\"\n and empty: \"region_is_bytes ptr (2 ^ ptBits) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (2 ^ ptBits)\"\n and kernel_data_refs_disj : \"kernel_data_refs \\ {ptr..+ 2 ^ ptBits} = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr X64_H.PageTableObject) = Some ko\" by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cpte_relation makeObject (from_bytes (replicate (size_of TYPE(pte_C)) 0))\"\n unfolding cpte_relation_def\n apply (simp add: Let_def makeObject_pte size_of_def pte_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps pte_C_tag_def pte_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: update_ti_t_machine_word_0s )\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(pte_C[512]) = 2 ^ ptBits\"\n by (simp add: size_of_def size_td_array bit_simps)\n have szo2: \"512 * size_of TYPE(pte_C) = 2 ^ ptBits\"\n by (simp add: szo[symmetric] bit_simps)\n have szo': \"size_of TYPE(pte_C) = 2 ^ objBitsKO ko\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n\n note rl' = cslift_ptr_retyp_other_inst[where n=1,\n simplified, OF empty, simplified, OF cover[simplified]\n szo[symmetric] szo[simplified bit_simps_corres]]\n\n have sz_weaken: \"objBitsKO ko \\ ptBits\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n have cover': \"range_cover ptr sz (objBitsKO ko) 512\"\n apply (rule range_cover_rel[OF cover sz_weaken])\n apply (simp add: ptBits_def objBits_simps ko_def archObjSize_def bit_simps)\n done\n from sz sz_weaken have sz': \"objBitsKO ko \\ sz\" by simp\n note al' = is_aligned_weaken[OF al sz_weaken]\n\n have koT: \"koTypeOf ko = ArchT PTET\"\n by (simp add: ko_def)\n\n (* rest used to be generic, but PT arrays are complicating everything *)\n\n note rl = projectKO_opt_retyp_other [OF cover' pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al' sz' szb mko cover']\n\n have guard: \"c_guard ?ptr\"\n using al[simplified bit_simps]\n apply -\n apply (rule is_aligned_c_guard[where n=ptBits and m=3])\n apply (simp_all add: align_td_array align_of_def bit_simps ptr0)\n done\n\n have guard': \"\\n < 512. c_guard (pte_Ptr ptr +\\<^sub>p int n)\"\n using al[simplified bit_simps]\n apply -\n apply (rule retype_guard_helper [OF cover' ptr0 szo', where m=3])\n apply (simp_all add: objBits_simps ko_def archObjSize_def align_of_def bit_simps)\n done\n\n note ptr_retyps.simps[simp del]\n\n from rf have pterl: \"cmap_relation (map_to_ptes (ksPSpace \\)) (cslift x) Ptr cpte_relation\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def cpspace_relation_def)\n\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have pte_arr: \"cpspace_pte_array_relation (ksPSpace \\) (t_hrs_' (globals x))\n \\ cpspace_pte_array_relation ?ks ?ks'\"\n apply (erule cmap_relation_array_add_array[OF _ al])\n apply (simp add: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule projectKO_opt_retyp_same, simp add: ko_def projectKOs)\n apply (simp add: h_t_valid_clift_Some_iff dom_def split: if_split)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[where n=1, simplified, OF guard],\n simp_all only: szo refl empty, simp_all add: zero[simplified])[1]\n apply (simp add: bit_simps word_bits_def)\n apply (auto split: if_split)[1]\n apply (simp_all add: objBits_simps archObjSize_def bit_simps\n ko_def word_bits_def)\n done\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using pte_arr\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl cte_C_size tag_disj_via_td_name\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: ht_rl)\n apply (simp add: ptr_retyp_to_array[simplified])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard'], simp_all only: szo2 empty)\n apply simp\n apply (simp(no_asm) add: bit_simps word_bits_def)\n apply (simp add: zero[simplified])\n apply (simp add: rl projectKOs del: pte_C_size)\n apply (simp add: rl projectKO_opt_retyp_same ko_def projectKOs Let_def\n ptr_add_to_new_cap_addrs [OF szo']\n cong: if_cong del: pte_C_size)\n apply (erule cmap_relation_retype)\n apply (insert relrl, auto)\n done\n\n moreover\n from rf szb al\n have \"ptr_span (pml4_Ptr (symbol_table ''x64KSSKIMPML4'')) \\ {ptr ..+ 2 ^ ptBits} = {}\"\n apply (clarsimp simp: valid_global_refs'_def Let_def\n valid_refs'_def ran_def rf_sr_def cstate_relation_def)\n apply (erule disjoint_subset)\n apply (simp add:kernel_data_refs_disj[simplified bit_simps_corres])\n done\n\n ultimately\n show ?thesis using rf empty kernel_data_refs_disj rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (clarsimp simp add: rl' cterl tag_disj_via_td_name\n hrs_htd_update ht_rl foldr_upd_app_if [folded data_map_insert_def] rl projectKOs\n cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps[where p=\"pt_Ptr ptr\", simplified szo])\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n by (simp add:szo ptr_retyps_htd_safe_neg hrs_htd_def\n kernel_data_refs_domain_eq_rotate bit_simps\n Int_ac del: replicate_numeral)\n\nqed\n\nlemma createObjects_ccorres_pde:\n defines \"ko \\ (KOArch (KOPDE (makeObject :: pde)))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (2 ^ pdBits) \\\n \\ region_is_zero_bytes ptr (2 ^ pdBits) x\n \\ range_cover ptr sz pdBits 1\n \\ valid_global_refs' s\n \\ kernel_data_refs \\ {ptr..+ 2 ^ pdBits} = {} \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs 512 ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen 1 (pd_Ptr ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"pd_Ptr ptr\"\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz pdBits 1\"\n and al: \"is_aligned ptr pdBits\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"pdBits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\"\n and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (2 ^ pdBits) \\\"\n and empty: \"region_is_bytes ptr (2 ^ pdBits) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (2 ^ pdBits)\"\n and kernel_data_refs_disj : \"kernel_data_refs \\ {ptr..+ 2 ^ pdBits} = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr X64_H.PageDirectoryObject) = Some ko\" by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cpde_relation makeObject (from_bytes (replicate (size_of TYPE(pde_C)) 0))\"\n unfolding cpde_relation_def\n supply if_cong[cong]\n apply (simp add: Let_def makeObject_pde size_of_def pde_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps pde_C_tag_def pde_lift_def size_td_lt_final_pad\n size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine size_of_def\n padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: update_ti_t_machine_word_0s pde_get_tag_def pde_pde_pt_def)\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(pde_C[512]) = 2 ^ pdBits\"\n by (simp add: size_of_def size_td_array bit_simps)\n have szo2: \"512 * size_of TYPE(pde_C) = 2 ^ pdBits\"\n by (simp add: szo[symmetric] bit_simps)\n have szo': \"size_of TYPE(pde_C) = 2 ^ objBitsKO ko\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n\n note rl' = cslift_ptr_retyp_other_inst[where n=1,\n simplified, OF empty, simplified, OF cover[simplified]\n szo[symmetric] szo[simplified bit_simps_corres]]\n\n have sz_weaken: \"objBitsKO ko \\ pdBits\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n have cover': \"range_cover ptr sz (objBitsKO ko) 512\"\n apply (rule range_cover_rel[OF cover sz_weaken])\n apply (simp add: ptBits_def objBits_simps ko_def archObjSize_def bit_simps)\n done\n from sz sz_weaken have sz': \"objBitsKO ko \\ sz\" by simp\n note al' = is_aligned_weaken[OF al sz_weaken]\n\n have koT: \"koTypeOf ko = ArchT PDET\"\n by (simp add: ko_def)\n\n (* rest used to be generic, but PT arrays are complicating everything *)\n\n note rl = projectKO_opt_retyp_other [OF cover' pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al' sz' szb mko cover']\n\n have guard: \"c_guard ?ptr\"\n using al[simplified bit_simps]\n apply -\n apply (rule is_aligned_c_guard[where n=pdBits and m=3])\n apply (simp_all add: align_td_array align_of_def bit_simps ptr0)\n done\n\n have guard': \"\\n < 512. c_guard (pde_Ptr ptr +\\<^sub>p int n)\"\n using al[simplified bit_simps]\n apply -\n apply (rule retype_guard_helper [OF cover' ptr0 szo', where m=3])\n apply (simp_all add: objBits_simps ko_def archObjSize_def align_of_def bit_simps)\n done\n\n note ptr_retyps.simps[simp del]\n\n from rf have pderl: \"cmap_relation (map_to_pdes (ksPSpace \\)) (cslift x) Ptr cpde_relation\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def cpspace_relation_def)\n\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have pde_arr: \"cpspace_pde_array_relation (ksPSpace \\) (t_hrs_' (globals x))\n \\ cpspace_pde_array_relation ?ks ?ks'\"\n apply (erule cmap_relation_array_add_array[OF _ al])\n apply (simp add: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule projectKO_opt_retyp_same, simp add: ko_def projectKOs)\n apply (simp add: h_t_valid_clift_Some_iff dom_def split: if_split)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[where n=1, simplified, OF guard],\n simp_all only: szo refl empty, simp_all add: zero[simplified])[1]\n apply (simp add: bit_simps word_bits_def)\n apply (auto split: if_split)[1]\n apply (simp_all add: objBits_simps archObjSize_def bit_simps\n ko_def word_bits_def)\n done\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using pde_arr\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl cte_C_size tag_disj_via_td_name\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: ht_rl)\n apply (simp add: ptr_retyp_to_array[simplified])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard'], simp_all only: szo2 empty)\n apply simp\n apply (simp(no_asm) add: bit_simps word_bits_def)\n apply (simp add: zero[simplified])\n apply (simp add: rl projectKOs del: pde_C_size)\n apply (simp add: rl projectKO_opt_retyp_same ko_def projectKOs Let_def\n ptr_add_to_new_cap_addrs [OF szo']\n cong: if_cong del: pde_C_size)\n apply (erule cmap_relation_retype)\n apply (insert relrl, auto)\n done\n\n moreover\n from rf szb al\n have \"ptr_span (pml4_Ptr (symbol_table ''x64KSSKIMPML4'')) \\ {ptr ..+ 2 ^ pdBits} = {}\"\n apply (clarsimp simp: valid_global_refs'_def Let_def\n valid_refs'_def ran_def rf_sr_def cstate_relation_def)\n apply (erule disjoint_subset)\n apply (simp add:kernel_data_refs_disj[simplified bit_simps_corres])\n done\n\n ultimately\n show ?thesis using rf empty kernel_data_refs_disj rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (clarsimp simp add: rl' cterl tag_disj_via_td_name\n hrs_htd_update ht_rl foldr_upd_app_if [folded data_map_insert_def] rl projectKOs\n cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps[where p=\"pd_Ptr ptr\", simplified szo])\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n by (simp add: szo ptr_retyps_htd_safe_neg hrs_htd_def kernel_data_refs_domain_eq_rotate\n bit_simps Int_ac)\nqed\n\nlemma createObjects_ccorres_pdpte:\n defines \"ko \\ (KOArch (KOPDPTE (makeObject :: pdpte)))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (2 ^ pdptBits) \\\n \\ region_is_zero_bytes ptr (2 ^ pdptBits) x\n \\ range_cover ptr sz pdptBits 1\n \\ valid_global_refs' s\n \\ kernel_data_refs \\ {ptr..+ 2 ^ pdptBits} = {} \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs 512 ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen 1 (pdpt_Ptr ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"pdpt_Ptr ptr\"\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz pdptBits 1\"\n and al: \"is_aligned ptr pdptBits\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"pdptBits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\"\n and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (2 ^ pdptBits) \\\"\n and empty: \"region_is_bytes ptr (2 ^ pdptBits) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (2 ^ pdptBits)\"\n and kernel_data_refs_disj : \"kernel_data_refs \\ {ptr..+ 2 ^ pdptBits} = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr X64_H.PDPointerTableObject) = Some ko\" by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cpdpte_relation makeObject (from_bytes (replicate (size_of TYPE(pdpte_C)) 0))\"\n unfolding cpdpte_relation_def\n supply if_cong[cong]\n apply (simp add: Let_def makeObject_pdpte size_of_def pdpte_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps pdpte_C_tag_def pdpte_lift_def size_td_lt_final_pad\n size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def size_td_lt_ti_typ_pad_combine size_of_def\n padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n.simps)\n apply (simp add: final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: update_ti_t_machine_word_0s pdpte_get_tag_def pdpte_pdpte_1g_def\n pdpte_pdpte_pd_def)\n done\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(pdpte_C[512]) = 2 ^ pdptBits\"\n by (simp add: size_of_def size_td_array bit_simps)\n have szo2: \"512 * size_of TYPE(pdpte_C) = 2 ^ pdptBits\"\n by (simp add: szo[symmetric] bit_simps)\n have szo': \"size_of TYPE(pdpte_C) = 2 ^ objBitsKO ko\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n\n note rl' = cslift_ptr_retyp_other_inst[where n=1,\n simplified, OF empty, simplified, OF cover[simplified]\n szo[symmetric] szo[simplified bit_simps_corres]]\n\n have sz_weaken: \"objBitsKO ko \\ pdptBits\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n have cover': \"range_cover ptr sz (objBitsKO ko) 512\"\n apply (rule range_cover_rel[OF cover sz_weaken])\n apply (simp add: ptBits_def objBits_simps ko_def archObjSize_def bit_simps)\n done\n from sz sz_weaken have sz': \"objBitsKO ko \\ sz\" by simp\n note al' = is_aligned_weaken[OF al sz_weaken]\n\n have koT: \"koTypeOf ko = ArchT PDPTET\"\n by (simp add: ko_def)\n\n (* rest used to be generic, but PT arrays are complicating everything *)\n\n note rl = projectKO_opt_retyp_other [OF cover' pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al' sz' szb mko cover']\n\n have guard: \"c_guard ?ptr\"\n using al[simplified bit_simps]\n apply -\n apply (rule is_aligned_c_guard[where n=pdptBits and m=3])\n apply (simp_all add: align_td_array align_of_def bit_simps ptr0)\n done\n\n have guard': \"\\n < 512. c_guard (pdpte_Ptr ptr +\\<^sub>p int n)\"\n using al[simplified bit_simps]\n apply -\n apply (rule retype_guard_helper [OF cover' ptr0 szo', where m=3])\n apply (simp_all add: objBits_simps ko_def archObjSize_def align_of_def bit_simps)\n done\n\n note ptr_retyps.simps[simp del]\n\n from rf have pdpterl: \"cmap_relation (map_to_pdptes (ksPSpace \\)) (cslift x) Ptr cpdpte_relation\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def cpspace_relation_def)\n\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have pdpte_arr: \"cpspace_pdpte_array_relation (ksPSpace \\) (t_hrs_' (globals x))\n \\ cpspace_pdpte_array_relation ?ks ?ks'\"\n apply (erule cmap_relation_array_add_array[OF _ al])\n apply (simp add: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule projectKO_opt_retyp_same, simp add: ko_def projectKOs)\n apply (simp add: h_t_valid_clift_Some_iff dom_def split: if_split)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[where n=1, simplified, OF guard],\n simp_all only: szo refl empty, simp_all add: zero[simplified])[1]\n apply (simp add: bit_simps word_bits_def)\n apply (auto split: if_split)[1]\n apply (simp_all add: objBits_simps archObjSize_def bit_simps\n ko_def word_bits_def)\n done\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using pdpte_arr\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl cte_C_size tag_disj_via_td_name\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: ht_rl)\n apply (simp add: ptr_retyp_to_array[simplified])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard'], simp_all only: szo2 empty)\n apply simp\n apply (simp(no_asm) add: bit_simps word_bits_def)\n apply (simp add: zero[simplified])\n apply (simp add: rl projectKOs del: pdpte_C_size)\n apply (simp add: rl projectKO_opt_retyp_same ko_def projectKOs Let_def\n ptr_add_to_new_cap_addrs [OF szo']\n cong: if_cong del: pdpte_C_size)\n apply (erule cmap_relation_retype)\n apply (insert relrl, auto)\n done\n\n moreover\n from rf szb al\n have \"ptr_span (pml4_Ptr (symbol_table ''x64KSSKIMPML4'')) \\ {ptr ..+ 2 ^ pdptBits} = {}\"\n apply (clarsimp simp: valid_global_refs'_def Let_def\n valid_refs'_def ran_def rf_sr_def cstate_relation_def)\n apply (erule disjoint_subset)\n apply (simp add:kernel_data_refs_disj[simplified bit_simps_corres])\n done\n\n ultimately\n show ?thesis using rf empty kernel_data_refs_disj rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (clarsimp simp add: rl' cterl tag_disj_via_td_name\n hrs_htd_update ht_rl foldr_upd_app_if [folded data_map_insert_def] rl projectKOs\n cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps[where p=\"pdpt_Ptr ptr\", simplified szo])\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n by (simp add:szo ptr_retyps_htd_safe_neg hrs_htd_def\n kernel_data_refs_domain_eq_rotate bit_simps\n Int_ac del: replicate_numeral)\nqed\n\nlemma createObjects_ccorres_pml4e:\n defines \"ko \\ (KOArch (KOPML4E (makeObject :: pml4e)))\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (2 ^ pml4Bits) \\\n \\ region_is_zero_bytes ptr (2 ^ pml4Bits) x\n \\ range_cover ptr sz pml4Bits 1\n \\ valid_global_refs' s\n \\ kernel_data_refs \\ {ptr..+ 2 ^ pml4Bits} = {} \\\n (\\\\ksPSpace := foldr (\\addr. data_map_insert addr ko) (new_cap_addrs 512 ptr ko) (ksPSpace \\)\\,\n x\\globals := globals x\n \\t_hrs_' := hrs_htd_update (ptr_retyps_gen 1 (Ptr ptr :: (pml4e_C[512]) ptr) False)\n (t_hrs_' (globals x))\\\\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"pml4_Ptr ptr\"\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\"\n and cover: \"range_cover ptr sz pml4Bits 1\"\n and al: \"is_aligned ptr pml4Bits\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"pml4Bits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\"\n and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (2 ^ pml4Bits) \\\"\n and empty: \"region_is_bytes ptr (2 ^ pml4Bits) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (2 ^ pml4Bits)\"\n and kernel_data_refs_disj : \"kernel_data_refs \\ {ptr..+ 2 ^ pml4Bits} = {}\"\n by (clarsimp simp:range_cover_def[where 'a=machine_word_len, folded word_bits_def])+\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n (* obj specific *)\n have mko: \"\\dev. makeObjectKO dev (Inr X64_H.PML4Object) = Some ko\" by (simp add: ko_def makeObjectKO_def)\n\n have relrl:\n \"cpml4e_relation makeObject (from_bytes (replicate (size_of TYPE(pml4e_C)) 0))\"\n unfolding cpml4e_relation_def\n apply (simp add: Let_def makeObject_pml4e size_of_def pml4e_lift_def)\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps pml4e_C_tag_def pml4e_lift_def\n size_td_lt_final_pad size_td_lt_ti_typ_pad_combine Let_def size_of_def)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: typ_info_array array_tag_def eval_nat_numeral)\n apply (simp add: array_tag_n.simps)\n apply (simp add: final_pad_def Let_def size_td_lt_ti_typ_pad_combine Let_def\n size_of_def padup_def align_td_array' size_td_array update_ti_adjust_ti\n ti_typ_pad_combine_def Let_def ti_typ_combine_def empty_typ_info_def)\n apply (simp add: update_ti_t_machine_word_0s)\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n have szo: \"size_of TYPE(pml4e_C[512]) = 2 ^ pml4Bits\"\n by (simp add: size_of_def size_td_array bit_simps)\n have szo2: \"512 * size_of TYPE(pml4e_C) = 2 ^ pml4Bits\"\n by (simp add: szo[symmetric] bit_simps)\n have szo': \"size_of TYPE(pml4e_C) = 2 ^ objBitsKO ko\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n\n note rl' = cslift_ptr_retyp_other_inst[where n=1,\n simplified, OF empty, simplified, OF cover[simplified]\n szo[symmetric] szo[simplified bit_simps_corres]]\n\n have sz_weaken: \"objBitsKO ko \\ pml4Bits\"\n by (simp add: objBits_simps ko_def archObjSize_def bit_simps)\n have cover': \"range_cover ptr sz (objBitsKO ko) 512\"\n apply (rule range_cover_rel[OF cover sz_weaken])\n apply (simp add: ptBits_def objBits_simps ko_def archObjSize_def bit_simps)\n done\n from sz sz_weaken have sz': \"objBitsKO ko \\ sz\" by simp\n note al' = is_aligned_weaken[OF al sz_weaken]\n\n have koT: \"koTypeOf ko = ArchT PML4ET\"\n by (simp add: ko_def)\n\n (* rest used to be generic, but PT arrays are complicating everything *)\n\n note rl = projectKO_opt_retyp_other [OF cover' pal pno ko_def]\n note cterl = retype_ctes_helper [OF pal pdst pno al' sz' szb mko cover']\n\n have guard: \"c_guard ?ptr\"\n using al[simplified bit_simps]\n apply -\n apply (rule is_aligned_c_guard[where n=pml4Bits and m=3])\n apply (simp_all add: align_td_array align_of_def bit_simps ptr0)\n done\n\n have guard': \"\\n < 512. c_guard (pml4e_Ptr ptr +\\<^sub>p int n)\"\n using al[simplified bit_simps]\n apply -\n apply (rule retype_guard_helper [OF cover' ptr0 szo', where m=3])\n apply (simp_all add: objBits_simps ko_def archObjSize_def align_of_def bit_simps)\n done\n\n note ptr_retyps.simps[simp del]\n\n from rf have pml4erl: \"cmap_relation (map_to_pml4es (ksPSpace \\)) (cslift x) Ptr cpml4e_relation\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def cpspace_relation_def)\n\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n uinfo_array_tag_n_m_not_le_typ_name\n\n have pml4e_arr: \"cpspace_pml4e_array_relation (ksPSpace \\) (t_hrs_' (globals x))\n \\ cpspace_pml4e_array_relation ?ks ?ks'\"\n apply (erule cmap_relation_array_add_array[OF _ al])\n apply (simp add: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule projectKO_opt_retyp_same, simp add: ko_def projectKOs)\n apply (simp add: h_t_valid_clift_Some_iff dom_def split: if_split)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[where n=1, simplified, OF guard],\n simp_all only: szo refl empty, simp_all add: zero[simplified])[1]\n apply (simp add: bit_simps word_bits_def)\n apply (auto split: if_split)[1]\n apply (simp_all add: objBits_simps archObjSize_def bit_simps\n ko_def word_bits_def)\n done\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using pml4e_arr\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' cterl cte_C_size tag_disj_via_td_name\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: ht_rl)\n apply (simp add: ptr_retyp_to_array[simplified])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard'], simp_all only: szo2 empty)\n apply simp\n apply (simp(no_asm) add: bit_simps word_bits_def)\n apply (simp add: zero[simplified])\n apply (simp add: rl projectKOs del: pml4e_C_size)\n apply (simp add: rl projectKO_opt_retyp_same ko_def projectKOs Let_def\n ptr_add_to_new_cap_addrs [OF szo']\n cong: if_cong del: pml4e_C_size)\n apply (erule cmap_relation_retype)\n apply (insert relrl, auto)\n done\n\n moreover\n from rf szb al\n have \"ptr_span (pml4_Ptr (symbol_table ''x64KSSKIMPML4'')) \\ {ptr ..+ 2 ^ pml4Bits} = {}\"\n apply (clarsimp simp: valid_global_refs'_def Let_def\n valid_refs'_def ran_def rf_sr_def cstate_relation_def)\n apply (erule disjoint_subset)\n apply (simp add:kernel_data_refs_disj[simplified bit_simps_corres])\n done\n\n ultimately\n show ?thesis using rf empty kernel_data_refs_disj rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name)\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (clarsimp simp add: rl' cterl tag_disj_via_td_name\n hrs_htd_update ht_rl foldr_upd_app_if [folded data_map_insert_def] rl projectKOs\n cvariable_array_ptr_retyps[OF szo]\n zero_ranges_ptr_retyps[where p=\"pml4_Ptr ptr\", simplified szo])\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n apply (subst h_t_valid_ptr_retyps_gen_disjoint, assumption)\n apply (simp add:szo cte_C_size cte_level_bits_def)\n apply (erule disjoint_subset)\n apply (simp add: bit_simps del: replicate_numeral)\n by (simp add:szo ptr_retyps_htd_safe_neg hrs_htd_def\n kernel_data_refs_domain_eq_rotate bit_simps\n Int_ac del: replicate_numeral)\nqed\n\ndefinition\n object_type_from_H :: \"object_type \\ machine_word\"\n where\n \"object_type_from_H tp \\ case tp of\n APIObjectType x \\\n (case x of ArchTypes_H.apiobject_type.Untyped \\ scast seL4_UntypedObject\n | ArchTypes_H.apiobject_type.TCBObject \\ scast seL4_TCBObject\n | ArchTypes_H.apiobject_type.EndpointObject \\ scast seL4_EndpointObject\n | ArchTypes_H.apiobject_type.NotificationObject \\ scast seL4_NotificationObject\n | ArchTypes_H.apiobject_type.CapTableObject \\ scast seL4_CapTableObject)\n | X64_H.SmallPageObject \\ scast seL4_X86_4K\n | X64_H.LargePageObject \\ scast seL4_X86_LargePageObject\n | X64_H.HugePageObject \\ scast seL4_X64_HugePageObject\n | X64_H.PageTableObject \\ scast seL4_X86_PageTableObject\n | X64_H.PageDirectoryObject \\ scast seL4_X86_PageDirectoryObject\n | X64_H.PDPointerTableObject \\ scast seL4_X86_PDPTObject\n | X64_H.PML4Object \\ scast seL4_X64_PML4Object\"\n\nlemmas nAPIObjects_def = seL4_NonArchObjectTypeCount_def\n\n(* FIXME x64: find aggregator lemma for mode objects *)\nlemma nAPIOBjects_object_type_from_H:\n \"(scast nAPIObjects <=s object_type_from_H tp) = (toAPIType tp = None)\"\n by (simp add: toAPIType_def nAPIObjects_def\n object_type_from_H_def word_sle_def api_object_defs \"StrictC'_object_defs\"\n seL4_X64_HugePageObject_def seL4_X86_PDPTObject_def seL4_X64_PML4Object_def\n split: X64_H.object_type.splits ArchTypes_H.apiobject_type.splits)\n\ndefinition\n object_type_to_H :: \"machine_word \\ object_type\"\n where\n \"object_type_to_H x \\\n (if (x = scast seL4_UntypedObject) then APIObjectType ArchTypes_H.apiobject_type.Untyped else (\n if (x = scast seL4_TCBObject) then APIObjectType ArchTypes_H.apiobject_type.TCBObject else (\n if (x = scast seL4_EndpointObject) then APIObjectType ArchTypes_H.apiobject_type.EndpointObject else (\n if (x = scast seL4_NotificationObject) then APIObjectType ArchTypes_H.apiobject_type.NotificationObject else (\n if (x = scast seL4_CapTableObject) then APIObjectType ArchTypes_H.apiobject_type.CapTableObject else (\n if (x = scast seL4_X86_4K) then X64_H.SmallPageObject else (\n if (x = scast seL4_X86_LargePageObject) then X64_H.LargePageObject else (\n if (x = scast seL4_X64_HugePageObject) then X64_H.HugePageObject else (\n if (x = scast seL4_X86_PageTableObject) then X64_H.PageTableObject else (\n if (x = scast seL4_X86_PageDirectoryObject) then X64_H.PageDirectoryObject else (\n if (x = scast seL4_X86_PDPTObject) then X64_H.PDPointerTableObject else (\n if (x = scast seL4_X64_PML4Object) then X64_H.PML4Object else\n undefined))))))))))))\"\n\nlemmas Kernel_C_defs =\n seL4_UntypedObject_def\n seL4_TCBObject_def\n seL4_EndpointObject_def\n seL4_NotificationObject_def\n seL4_CapTableObject_def\n seL4_X86_4K_def\n seL4_X86_LargePageObject_def\n seL4_X86_PageTableObject_def\n seL4_X86_PageDirectoryObject_def\n seL4_X64_HugePageObject_def\n seL4_X86_PDPTObject_def\n seL4_X64_PML4Object_def\n Kernel_C.asidLowBits_def\n Kernel_C.asidHighBits_def\n\nabbreviation(input)\n \"Basic_htd_update f ==\n (Basic (globals_update (t_hrs_'_update (hrs_htd_update f))))\"\n\nlemma object_type_to_from_H [simp]: \"object_type_to_H (object_type_from_H x) = x\"\n apply (clarsimp simp: object_type_from_H_def object_type_to_H_def Kernel_C_defs)\n by (clarsimp split: object_type.splits apiobject_type.splits simp: Kernel_C_defs)\n\ndeclare ptr_retyps_one[simp]\n\n(* FIXME: move *)\nlemma ccorres_return_C_Seq:\n \"ccorres_underlying sr \\ r rvxf arrel xf P P' hs X (return_C xfu v) \\\n ccorres_underlying sr \\ r rvxf arrel xf P P' hs X (return_C xfu v ;; Z)\"\n apply (clarsimp simp: return_C_def)\n apply (erule ccorres_semantic_equiv0[rotated])\n apply (rule semantic_equivI)\n apply (clarsimp simp: exec_assoc[symmetric])\n apply (rule exec_Seq_cong, simp)\n apply (clarsimp simp: exec_assoc[symmetric])\n apply (rule exec_Seq_cong, simp)\n apply (rule iffI)\n apply (auto elim!:exec_Normal_elim_cases intro: exec.Throw exec.Seq)[1]\n apply (auto elim!:exec_Normal_elim_cases intro: exec.Throw)\n done\n\n(* FIXME: move *)\nlemma ccorres_rewrite_while_guard:\n assumes rl: \"\\s. s \\ R \\ (s \\ P) = (s \\ P')\"\n and cc: \"ccorres r xf G G' hs a (While P' b)\"\n shows \"ccorres r xf G (G' \\ R) hs a (While P' b)\"\nproof (rule iffD1 [OF ccorres_semantic_equiv])\n show \"ccorres r xf G (G' \\ R) hs a (While P' b)\"\n by (rule ccorres_guard_imp2 [OF cc]) simp\nnext\n fix s s'\n assume \"s \\ G' \\ R\"\n hence sin: \"(s \\ P) = (s \\ P')\" using rl by simp\n\n show \"semantic_equiv \\ s s' (While P' b) (While P' b)\"\n apply (rule semantic_equivI)\n apply (simp add: sin)\n done\nqed\n\n(* FIXME: move *)\nlemma ccorres_to_vcg_nf:\n \"\\ccorres rrel xf P P' [] a c; no_fail Q a; \\s. P s \\ Q s\\\n \\ \\\\ {s. P \\ \\ s \\ P' \\ (\\, s) \\ rf_sr} c\n {s. \\(rv, \\')\\fst (a \\). (\\', s) \\ rf_sr \\ rrel rv (xf s)}\"\n apply (rule HoarePartial.conseq_exploit_pre)\n apply clarsimp\n apply (rule conseqPre)\n apply (drule ccorres_to_vcg')\n prefer 2\n apply simp\n apply (simp add: no_fail_def)\n apply clarsimp\n done\n\nlemma mdb_node_get_mdbNext_heap_ccorres:\n \"ccorres (=) ret__unsigned_longlong_' \\ UNIV hs\n (liftM (mdbNext \\ cteMDBNode) (getCTE parent))\n (\\ret__unsigned_longlong :== CALL mdb_node_get_mdbNext(h_val\n (hrs_mem \\t_hrs)\n (Ptr &((Ptr parent :: cte_C ptr) \\[''cteMDBNode_C'']))))\"\n apply (simp add: ccorres_liftM_simp)\n apply (rule ccorres_add_return2)\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_getCTE)\n apply (rule_tac P = \"\\s. ctes_of s parent = Some x\" in ccorres_from_vcg [where P' = UNIV])\n apply (rule allI, rule conseqPre)\n apply vcg\n apply (clarsimp simp: return_def)\n apply (drule cmap_relation_cte)\n apply (erule (1) cmap_relationE1)\n apply (simp add: typ_heap_simps)\n apply (drule ccte_relation_cmdbnode_relation)\n apply (erule mdbNext_CL_mdb_node_lift_eq_mdbNext [symmetric])\n apply simp\n done\n\nlemma getCTE_pre_cte_at:\n \"\\\\s. \\ cte_at' p s \\ getCTE p \\ \\_ _. False \\\"\n apply (wp getCTE_wp)\n apply clarsimp\n done\n\nlemmas ccorres_getCTE_cte_at = ccorres_guard_from_wp [OF getCTE_pre_cte_at empty_fail_getCTE]\n ccorres_guard_from_wp_bind [OF getCTE_pre_cte_at empty_fail_getCTE]\n\nlemmas ccorres_guard_from_wp_liftM = ccorres_guard_from_wp [OF liftM_pre empty_fail_liftM]\nlemmas ccorres_guard_from_wp_bind_liftM = ccorres_guard_from_wp_bind [OF liftM_pre empty_fail_liftM]\n\nlemmas ccorres_liftM_getCTE_cte_at = ccorres_guard_from_wp_liftM [OF getCTE_pre_cte_at empty_fail_getCTE]\n ccorres_guard_from_wp_bind_liftM [OF getCTE_pre_cte_at empty_fail_getCTE]\n\nlemma insertNewCap_ccorres_helper:\n notes option.case_cong_weak [cong]\n shows \"ccap_relation cap rv'b\n \\ ccorres dc xfdc (cte_at' slot and K (is_aligned next cteSizeBits \\ canonical_address next \\ is_aligned parent cteSizeBits))\n UNIV hs (setCTE slot (CTE cap (MDB next parent True True)))\n (Basic (\\s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update\n (Ptr &(Ptr slot :: cte_C ptr\\[''cap_C'']) :: cap_C ptr) rv'b))) s);;\n \\ret__struct_mdb_node_C :== CALL mdb_node_new(ptr_val (Ptr next),scast true,scast true,ptr_val (Ptr parent));;\n Guard C_Guard \\hrs_htd \\t_hrs \\\\<^sub>t (Ptr slot :: cte_C ptr)\\\n (Basic (\\s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update\n (Ptr &(Ptr slot :: cte_C ptr\\[''cteMDBNode_C'']) :: mdb_node_C ptr)\n (ret__struct_mdb_node_C_' s)))) s)))\"\n apply simp\n apply (rule ccorres_from_vcg)\n apply (rule allI, rule conseqPre)\n apply vcg\n apply (clarsimp simp: Collect_const_mem cte_wp_at_ctes_of)\n apply (frule (1) rf_sr_ctes_of_clift)\n apply (clarsimp simp: typ_heap_simps)\n apply (rule fst_setCTE [OF ctes_of_cte_at], assumption)\n apply (erule bexI [rotated])\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (clarsimp simp add: rf_sr_def cstate_relation_def typ_heap_simps Let_def cpspace_relation_def)\n apply (rule conjI)\n apply (erule (2) cmap_relation_updI)\n apply (simp add: ccap_relation_def ccte_relation_def cte_lift_def)\n subgoal by (simp add: cte_to_H_def map_option_Some_eq2 mdb_node_to_H_def to_bool_mask_to_bool_bf is_aligned_neg_mask_weaken\n c_valid_cte_def true_def canonical_address_sign_extended sign_extended_iff_sign_extend cteSizeBits_def\n split: option.splits)\n subgoal by simp\n apply (erule_tac t = s' in ssubst)\n apply (simp cong: lifth_update)\n apply (rule conjI)\n apply (erule (1) setCTE_tcb_case)\n apply (simp add: carch_state_relation_def cmachine_state_relation_def\n fpu_null_state_heap_update_tag_disj_simps typ_heap_simps\n cvariable_array_map_const_add_map_option[where f=\"tcb_no_ctes_proj\"])\n done\n\ndefinition\n byte_regions_unmodified :: \"heap_raw_state \\ heap_raw_state \\ bool\"\nwhere\n \"byte_regions_unmodified hrs hrs' \\ \\x. (\\n td b. snd (hrs_htd hrs x) n = Some (td, b)\n \\ td = typ_uinfo_t TYPE (word8))\n \\ snd (hrs_htd hrs x) 0 \\ None\n \\ hrs_mem hrs' x = hrs_mem hrs x\"\n\nabbreviation\n byte_regions_unmodified' :: \"globals myvars \\ globals myvars \\ bool\"\nwhere\n \"byte_regions_unmodified' s t \\ byte_regions_unmodified (t_hrs_' (globals s))\n (t_hrs_' (globals t))\"\n\nlemma byte_regions_unmodified_refl[iff]:\n \"byte_regions_unmodified hrs hrs\"\n by (simp add: byte_regions_unmodified_def)\n\nlemma byte_regions_unmodified_trans:\n \"byte_regions_unmodified hrs hrs'\n \\ byte_regions_unmodified hrs' hrs''\n \\ hrs_htd hrs' = hrs_htd hrs\n \\ byte_regions_unmodified hrs hrs''\"\n by (simp add: byte_regions_unmodified_def)\n\nlemma byte_regions_unmodified_hrs_mem_update1:\n \"byte_regions_unmodified hrs hrs'\n \\ hrs_htd hrs \\\\<^sub>t (p :: ('a :: wf_type) ptr)\n \\ hrs_htd hrs' = hrs_htd hrs\n \\ typ_uinfo_t TYPE ('a) \\ typ_uinfo_t TYPE (word8)\n \\ byte_regions_unmodified hrs\n (hrs_mem_update (heap_update p v) hrs')\"\n apply (erule byte_regions_unmodified_trans, simp_all)\n apply (clarsimp simp: byte_regions_unmodified_def hrs_mem_update\n heap_update_def h_t_valid_def\n valid_footprint_def Let_def)\n apply (rule heap_update_nmem_same)\n apply (clarsimp simp: size_of_def intvl_def)\n apply (drule spec, drule(1) mp, clarsimp)\n apply (cut_tac s=\"(typ_uinfo_t TYPE('a))\" and n=k in ladder_set_self)\n apply (clarsimp dest!: in_set_list_map)\n apply (drule(1) map_le_trans)\n apply (simp add: map_le_def)\n apply metis\n done\n\nlemma byte_regions_unmodified_hrs_mem_update2:\n \"byte_regions_unmodified hrs hrs'\n \\ hrs_htd hrs \\\\<^sub>t (p :: ('a :: wf_type) ptr)\n \\ typ_uinfo_t TYPE ('a) \\ typ_uinfo_t TYPE (word8)\n \\ byte_regions_unmodified (hrs_mem_update (heap_update p v) hrs) hrs'\"\n apply (erule byte_regions_unmodified_trans[rotated], simp_all)\n apply (clarsimp simp: byte_regions_unmodified_def hrs_mem_update\n heap_update_def h_t_valid_def\n valid_footprint_def Let_def)\n apply (rule sym, rule heap_update_nmem_same)\n apply (clarsimp simp: size_of_def intvl_def)\n apply (drule spec, drule(1) mp, clarsimp)\n apply (cut_tac s=\"(typ_uinfo_t TYPE('a))\" and n=k in ladder_set_self)\n apply (clarsimp dest!: in_set_list_map)\n apply (drule(1) map_le_trans)\n apply (simp add: map_le_def)\n apply metis\n done\n\nlemmas byte_regions_unmodified_hrs_mem_update\n = byte_regions_unmodified_hrs_mem_update1\n byte_regions_unmodified_hrs_mem_update2\n\nlemma byte_regions_unmodified_hrs_htd_update[iff]:\n \"byte_regions_unmodified\n (hrs_htd_update h hrs) hrs\"\n by (clarsimp simp: byte_regions_unmodified_def)\n\nlemma byte_regions_unmodified_flip:\n \"byte_regions_unmodified (hrs_htd_update (\\_. hrs_htd hrs) hrs') hrs\n \\ byte_regions_unmodified hrs hrs'\"\n by (simp add: byte_regions_unmodified_def hrs_htd_update)\n\nlemma mdb_node_ptr_set_mdbPrev_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_ptr_set_mdbPrev_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' s t}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: )\n apply (intro byte_regions_unmodified_hrs_mem_update byte_regions_unmodified_refl,\n simp_all add: typ_heap_simps)\n done\n\nlemma mdb_node_ptr_set_mdbNext_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_ptr_set_mdbNext_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' s t}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: )\n apply (intro byte_regions_unmodified_hrs_mem_update byte_regions_unmodified_refl,\n simp_all add: typ_heap_simps)\n done\n\nlemma updateNewFreeIndex_noop_ccorres:\n \"ccorres dc xfdc (valid_objs' and cte_wp_at' (\\cte. cteCap cte = cap) slot)\n {s. (case untypedZeroRange cap of None \\ True\n | Some (a, b) \\ region_actually_is_zero_bytes a (unat ((b + 1) - a)) s)} hs\n (updateNewFreeIndex slot) Skip\"\n (is \"ccorres _ _ ?P ?P' hs _ _\")\n apply (simp add: updateNewFreeIndex_def getSlotCap_def)\n apply (rule ccorres_guard_imp)\n apply (rule ccorres_pre_getCTE[where P=\"\\rv. cte_wp_at' ((=) rv) slot and ?P\"\n and P'=\"K ?P'\"])\n apply (case_tac \"cteCap cte\", simp_all add: ccorres_guard_imp[OF ccorres_return_Skip])[1]\n defer\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply simp\n apply (simp add: updateTrackedFreeIndex_def getSlotCap_def)\n apply (rule ccorres_guard_imp)\n apply (rule_tac P=\"\\rv. cte_wp_at' ((=) rv) slot and K (rv = cte) and ?P\"\n in ccorres_pre_getCTE[where P'=\"K ?P'\"])\n defer\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply simp\n apply (rule ccorres_from_vcg)\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: bind_def simpler_modify_def)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (clarsimp simp: zero_ranges_are_zero_def\n cte_wp_at_ctes_of\n split: option.split)\n done\n\nlemma byte_regions_unmodified_region_is_bytes:\n \"byte_regions_unmodified hrs hrs'\n \\ region_actually_is_bytes' y n (hrs_htd hrs)\n \\ x \\ {y ..+ n}\n \\ hrs_mem hrs' x = hrs_mem hrs x\"\n apply (clarsimp simp: byte_regions_unmodified_def imp_conjL[symmetric])\n apply (drule spec, erule mp)\n apply (clarsimp simp: region_actually_is_bytes'_def)\n apply (drule(1) bspec, simp split: if_split_asm)\n done\n\n\nlemma insertNewCap_ccorres1:\n \"ccorres dc xfdc (pspace_aligned' and pspace_canonical' and valid_mdb' and valid_objs' and valid_cap' cap)\n ({s. (case untypedZeroRange cap of None \\ True\n | Some (a, b) \\ region_actually_is_zero_bytes a (unat ((b + 1) - a)) s)}\n \\ {s. ccap_relation cap (cap_' s)} \\ {s. parent_' s = Ptr parent}\n \\ {s. slot_' s = Ptr slot}) []\n (insertNewCap parent slot cap)\n (Call insertNewCap_'proc)\"\n supply if_cong[cong] option.case_cong[cong]\n apply (cinit (no_ignore_call) lift: cap_' parent_' slot_')\n apply (rule ccorres_liftM_getCTE_cte_at)\n apply (rule ccorres_move_c_guard_cte)\n apply (simp only: )\n apply (rule ccorres_split_nothrow [OF mdb_node_get_mdbNext_heap_ccorres])\n apply ceqv\n apply (erule_tac s = \"next\" in subst)\n apply csymbr\n apply (ctac (c_lines 3) pre: ccorres_pre_getCTE ccorres_assert add: insertNewCap_ccorres_helper)\n apply (simp only: Ptr_not_null_pointer_not_zero)\n apply (ctac add: updateMDB_set_mdbPrev)\n apply (rule ccorres_seq_skip'[THEN iffD1])\n apply (ctac add: updateMDB_set_mdbNext)\n apply (rule updateNewFreeIndex_noop_ccorres[where cap=cap])\n apply (wp updateMDB_weak_cte_wp_at)\n apply simp\n apply (vcg exspec=mdb_node_ptr_set_mdbNext_preserves_bytes)\n apply (wp updateMDB_weak_cte_wp_at)\n apply clarsimp\n apply (vcg exspec=mdb_node_ptr_set_mdbPrev_preserves_bytes)\n apply (wp setCTE_weak_cte_wp_at)\n apply (clarsimp simp: hrs_mem_update Collect_const_mem\n simp del: imp_disjL)\n apply vcg\n apply simp\n apply (wp getCTE_wp')\n apply (clarsimp simp: hrs_mem_update)\n apply vcg\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_ctes_of is_aligned_3_next ctes_of_aligned_bits\n canonical_address_mdbNext ctes_of_canonical)\n apply (clarsimp split: option.split)\n apply (intro allI conjI impI; simp; clarsimp simp: region_actually_is_bytes)\n apply (erule trans[OF heap_list_h_eq2, rotated])\n apply (rule byte_regions_unmodified_region_is_bytes)\n apply (erule byte_regions_unmodified_trans[rotated]\n | simp\n | rule byte_regions_unmodified_hrs_mem_update\n | simp add: typ_heap_simps')+\n apply (erule trans[OF heap_list_h_eq2, rotated])\n apply (rule byte_regions_unmodified_region_is_bytes)\n apply (erule byte_regions_unmodified_trans[rotated]\n | simp\n | rule byte_regions_unmodified_hrs_mem_update\n | simp add: typ_heap_simps')+\n done\n\nlemma insertNewCap_pre_cte_at:\n \"\\\\s. \\ (cte_at' p s \\ cte_at' p' s) \\ insertNewCap p p' cap \\ \\_ _. False \\\"\n unfolding insertNewCap_def\n apply simp\n apply (wp getCTE_wp)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemmas createNewCaps_guard_helper = createNewCaps_guard[where 'a=64, folded word_bits_def]\n\nend\n\nlocale insertNewCap_i_locale = kernel\nbegin\n\nlemma mdb_node_get_mdbNext_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_get_mdbNext_'proc {t. i_' t = i_' s}\"\n apply (rule allI)\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply vcg\n apply simp\n done\n\nlemma mdb_node_new_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_new_'proc {t. i_' t = i_' s}\"\n apply (rule allI)\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply vcg\n apply simp\n done\n\nlemma mdb_node_ptr_set_mdbPrev_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_ptr_set_mdbPrev_'proc {t. i_' t = i_' s}\"\n apply (rule allI)\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply vcg\n apply simp\n done\n\nlemma mdb_node_ptr_set_mdbNext_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call mdb_node_ptr_set_mdbNext_'proc {t. i_' t = i_' s}\"\n apply (rule allI)\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply vcg\n apply simp\n done\n\nlemma insertNewCap_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call insertNewCap_'proc {t. i_' t = i_' s}\"\n apply vcg\n apply clarsimp\n done\nend\n\ncontext kernel_m\nbegin\n\nlemma insertNewCap_spec:\n \"\\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} Call insertNewCap_'proc {t. i_' t = i_' s}\"\n apply (rule insertNewCap_i_locale.insertNewCap_spec)\n apply (intro_locales)\n done\n\nlemma ccorres_fail:\n \"ccorres r xf \\ UNIV hs fail c\"\n apply (rule ccorresI')\n apply (simp add: fail_def)\n done\n\nlemma hoarep_Cond_UNIV:\n \"\\\\\\<^bsub>/UNIV\\<^esub> P c P', A \\\n \\\\\\<^bsub>/UNIV\\<^esub> P (Cond UNIV c d) P', A\"\n apply (rule HoarePartial.Cond [where P\\<^sub>1 = P and P\\<^sub>2 = \"{}\"])\n apply simp\n apply assumption\n apply (rule HoarePartial.conseq_exploit_pre)\n apply simp\n done\n\n(* FIXME x64: mode object defs *)\nlemma object_type_from_H_toAPIType_simps:\n \"(object_type_from_H tp = scast seL4_UntypedObject) = (toAPIType tp = Some ArchTypes_H.apiobject_type.Untyped)\"\n \"(object_type_from_H tp = scast seL4_TCBObject) = (toAPIType tp = Some ArchTypes_H.apiobject_type.TCBObject)\"\n \"(object_type_from_H tp = scast seL4_EndpointObject) = (toAPIType tp = Some ArchTypes_H.apiobject_type.EndpointObject)\"\n \"(object_type_from_H tp = scast seL4_NotificationObject) = (toAPIType tp = Some ArchTypes_H.apiobject_type.NotificationObject)\"\n \"(object_type_from_H tp = scast seL4_CapTableObject) = (toAPIType tp = Some ArchTypes_H.apiobject_type.CapTableObject)\"\n \"(object_type_from_H tp = scast seL4_X86_4K) = (tp = X64_H.SmallPageObject)\"\n \"(object_type_from_H tp = scast seL4_X86_LargePageObject) = (tp = X64_H.LargePageObject)\"\n \"(object_type_from_H tp = scast seL4_X64_HugePageObject) = (tp = X64_H.HugePageObject)\"\n \"(object_type_from_H tp = scast seL4_X86_PageTableObject) = (tp = X64_H.PageTableObject)\"\n \"(object_type_from_H tp = scast seL4_X86_PageDirectoryObject) = (tp = X64_H.PageDirectoryObject)\"\n \"(object_type_from_H tp = scast seL4_X86_PDPTObject) = (tp = X64_H.PDPointerTableObject)\"\n \"(object_type_from_H tp = scast seL4_X64_PML4Object) = (tp = X64_H.PML4Object)\"\n by (auto simp: toAPIType_def seL4_X86_PDPTObject_def seL4_X64_PML4Object_def seL4_X64_HugePageObject_def\n object_type_from_H_def \"StrictC'_object_defs\" api_object_defs\n split: object_type.splits ArchTypes_H.apiobject_type.splits)\n\ndeclare Collect_const_mem [simp]\n\nlemma createNewCaps_untyped_if_helper:\n \"\\s s'. (s, s') \\ rf_sr \\ (sz < word_bits \\ gbits < word_bits) \\ True \\\n (\\ gbits \\ sz) = (s' \\ \\of_nat sz < (of_nat gbits :: machine_word)\\)\"\n by (clarsimp simp: not_le unat_of_nat64 word_less_nat_alt lt_word_bits_lt_pow)\n\nlemma true_mask1 [simp]:\n \"true && mask (Suc 0) = true\"\n unfolding true_def\n by (simp add: bang_eq cong: conj_cong)\n\nlemma to_bool_simps [simp]:\n \"to_bool true\" \"\\ to_bool false\"\n unfolding true_def false_def to_bool_def\n by simp_all\n\nlemma heap_list_update':\n \"\\ n = length v; length v \\ 2 ^ word_bits \\ \\ heap_list (heap_update_list p v h) n p = v\"\n by (simp add: heap_list_update addr_card_wb)\n\nlemma h_t_valid_clift_Some_iff':\n \"td \\\\<^sub>t p = (clift (hp, td) p = Some (h_val hp p))\"\n by (simp add: lift_t_if split: if_split)\n\nlemma option_noneI: \"\\ \\x. a = Some x \\ False \\ \\ a = None\"\n apply (case_tac a)\n apply clarsimp\n apply atomize\n apply clarsimp\n done\n\nlemma projectKO_opt_retyp_other':\n assumes pko: \"\\v. (projectKO_opt ko :: 'a :: pre_storable option) \\ Some v\"\n and pno: \"pspace_no_overlap' ptr (objBitsKO ko) (\\ :: kernel_state)\"\n and pal: \"pspace_aligned' (\\ :: kernel_state)\"\n and al: \"is_aligned ptr (objBitsKO ko)\"\n shows \"projectKO_opt \\\\<^sub>m ((ksPSpace \\)(ptr \\ ko))\n = (projectKO_opt \\\\<^sub>m (ksPSpace \\) :: machine_word \\ 'a :: pre_storable option)\" (is \"?LHS = ?RHS\")\nproof (rule ext)\n fix x\n show \"?LHS x = ?RHS x\"\n proof (cases \"x = ptr\")\n case True\n hence \"x \\ {ptr..(ptr && ~~ mask (objBitsKO ko)) + 2 ^ objBitsKO ko - 1}\"\n apply (rule ssubst)\n apply (insert al)\n apply (clarsimp simp: is_aligned_def)\n done\n hence \"ksPSpace \\ x = None\" using pno\n apply -\n apply (rule option_noneI)\n apply (frule pspace_no_overlap_disjoint'[rotated])\n apply (rule pal)\n apply (drule domI[where a = x])\n apply blast\n done\n thus ?thesis using True pko by simp\n next\n case False\n thus ?thesis by (simp add: map_comp_def)\n qed\nqed\n\nlemma dom_tcb_cte_cases_iff:\n \"(x \\ dom tcb_cte_cases) = (\\y < 5. unat x = y * (2^cteSizeBits))\"\n unfolding tcb_cte_cases_def\n by (auto simp: unat_arith_simps objBits_simps')\n\nlemma cmap_relation_retype2:\n assumes cm: \"cmap_relation mp mp' Ptr rel\"\n and rel: \"rel (mobj :: 'a :: pre_storable) ko'\"\n shows \"cmap_relation\n (\\x. if x \\ ptr_val ` addrs then Some (mobj :: 'a :: pre_storable) else mp x)\n (\\y. if y \\ addrs then Some ko' else mp' y)\n Ptr rel\"\n using cm rel\n apply -\n apply (rule cmap_relationI)\n apply (simp add: dom_if cmap_relation_def image_Un)\n apply (case_tac \"x \\ addrs\")\n apply (simp add: image_image)\n apply (simp add: image_image)\n apply (clarsimp split: if_split_asm)\n apply (erule contrapos_np)\n apply (erule image_eqI [rotated])\n apply simp\n apply (erule (2) cmap_relation_relI)\n done\n\nlemma ti_typ_pad_combine_empty_ti:\n fixes tp :: \"'b :: c_type itself\"\n shows \"ti_typ_pad_combine tp lu upd fld (empty_typ_info n) =\n TypDesc (TypAggregate [DTPair (adjust_ti (typ_info_t TYPE('b)) lu upd) fld]) n\"\n by (simp add: ti_typ_pad_combine_def ti_typ_combine_def empty_typ_info_def Let_def)\n\nlemma ti_typ_combine_empty_ti:\n fixes tp :: \"'b :: c_type itself\"\n shows \"ti_typ_combine tp lu upd fld (empty_typ_info n) =\n TypDesc (TypAggregate [DTPair (adjust_ti (typ_info_t TYPE('b)) lu upd) fld]) n\"\n by (simp add: ti_typ_combine_def empty_typ_info_def Let_def)\n\nlemma ti_typ_pad_combine_td:\n fixes tp :: \"'b :: c_type itself\"\n shows \"padup (align_of TYPE('b)) (size_td_struct st) = 0 \\\n ti_typ_pad_combine tp lu upd fld (TypDesc st n) =\n TypDesc (extend_ti_struct st (adjust_ti (typ_info_t TYPE('b)) lu upd) fld) n\"\n by (simp add: ti_typ_pad_combine_def ti_typ_combine_def Let_def)\n\nlemma ti_typ_combine_td:\n fixes tp :: \"'b :: c_type itself\"\n shows \"padup (align_of TYPE('b)) (size_td_struct st) = 0 \\\n ti_typ_combine tp lu upd fld (TypDesc st n) =\n TypDesc (extend_ti_struct st (adjust_ti (typ_info_t TYPE('b)) lu upd) fld) n\"\n by (simp add: ti_typ_combine_def Let_def)\n\nlemma update_ti_t_pad_combine:\n assumes std: \"size_td td' mod 2 ^ align_td (typ_info_t TYPE('a :: c_type)) = 0\"\n shows \"update_ti_t (ti_typ_pad_combine TYPE('a :: c_type) lu upd fld td') bs v =\n update_ti_t (ti_typ_combine TYPE('a :: c_type) lu upd fld td') bs v\"\n using std\n by (simp add: ti_typ_pad_combine_def size_td_simps Let_def)\n\n\nlemma update_ti_t_ptr_0s:\n \"update_ti_t (typ_info_t TYPE('a :: c_type ptr)) [0,0,0,0,0,0,0,0] X = NULL\"\n apply (simp add: typ_info_ptr word_rcat_def bin_rcat_def)\n done\n\nlemma size_td_map_list:\n \"size_td_list (map (\\n. DTPair\n (adjust_ti (typ_info_t TYPE('a :: c_type))\n (\\x. index x n)\n (\\x f. Arrays.update f n x))\n (replicate n CHR ''1''))\n [0.. bs = replicate (n * size_td (typ_info_t TYPE('a))) v; n \\ card (UNIV :: 'b set) \\ \\\n update_ti_t (array_tag_n n) bs x =\n foldr (\\n arr. Arrays.update arr n\n (update_ti_t (typ_info_t TYPE('a)) (replicate (size_td (typ_info_t TYPE('a))) v) (index arr n)))\n [0..\n update_ti_t (typ_info_t TYPE('a :: c_type['b :: finite])) bs x =\n foldr (\\n arr. Arrays.update arr n\n (update_ti_t (typ_info_t TYPE('a)) (replicate (size_td (typ_info_t TYPE('a))) v) (index arr n)))\n [0..<(card (UNIV :: 'b :: finite set))] x\"\n unfolding typ_info_array array_tag_def\n apply (rule update_ti_t_array_tag_n_rep)\n apply simp\n apply simp\n done\n\nlemma update_ti_t_array_rep_word0:\n \"bs = replicate ((card (UNIV :: 'b :: finite set)) * 8) 0 \\\n update_ti_t (typ_info_t TYPE(machine_word['b :: finite])) bs x =\n foldr (\\n arr. Arrays.update arr n 0)\n [0..<(card (UNIV :: 'b :: finite set))] x\"\n apply (subst update_ti_t_array_rep)\n apply simp\n apply (simp add: update_ti_t_machine_word_0s)\n done\n\nlemma update_ti_t_array_rep_byte0:\n \"bs = replicate (CARD('b)) 0 \\\n update_ti_t (typ_info_t TYPE(8 word['b :: finite])) bs x =\n foldr (\\n arr. Arrays.update arr n 0)\n [0.. UserContext FPUNullState (\\x. if x = CS then 0x2B\n else if x = SS then 0x33\n else if x = FLAGS then 0x202\n else 0)\"\n (is \"_ \\ ?UC\")\nproof -\n have \"newContext = ?UC\"\n apply (simp add: newContext_def initContext_def selCS3_eq selDS3_eq fun_upd_def)\n apply (rule ext, simp split: if_splits)\n done\n thus \"newContext \\ ?UC\" by simp\nqed\n\nlemma tcb_queue_update_other:\n \"\\ ctcb_ptr_to_tcb_ptr p \\ set tcbs \\ \\\n tcb_queue_relation next prev (mp(p \\ v)) tcbs qe qh =\n tcb_queue_relation next prev mp tcbs qe qh\"\n apply (induct tcbs arbitrary: qh qe)\n apply simp\n apply (rename_tac a tcbs qh qe)\n apply simp\n apply (subgoal_tac \"p \\ tcb_ptr_to_ctcb_ptr a\")\n apply (simp cong: conj_cong)\n apply clarsimp\n done\n\nlemma cmap_relation_cong':\n \"\\am = am'; cm = cm';\n \\p a a' b b'.\n \\am p = Some a; am' p = Some a'; cm (f p) = Some b; cm' (f p) = Some b'\\\n \\ rel a b = rel' a' b'\\\n \\ cmap_relation am cm f rel = cmap_relation am' cm' f rel'\"\n by (rule cmap_relation_cong, simp_all)\n\nlemma tcb_queue_update_other':\n \"\\ ctcb_ptr_to_tcb_ptr p \\ set tcbs \\ \\\n tcb_queue_relation' next prev (mp(p \\ v)) tcbs qe qh =\n tcb_queue_relation' next prev mp tcbs qe qh\"\n unfolding tcb_queue_relation'_def\n by (simp add: tcb_queue_update_other)\n\nlemma c_guard_tcb:\n assumes al: \"is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits\"\n and ptr0: \"ctcb_ptr_to_tcb_ptr p \\ 0\"\n shows \"c_guard p\"\n unfolding c_guard_def\nproof (rule conjI)\n show \"ptr_aligned p\" using al\n apply -\n apply (rule is_aligned_ptr_aligned [where n = word_size_bits])\n apply (rule is_aligned_weaken)\n apply (erule ctcb_ptr_to_tcb_ptr_aligned)\n apply (simp add: ctcb_size_bits_def word_size_bits_def)\n apply (simp add: align_of_def word_size_bits_def)\n done\n\n show \"c_null_guard p\" using ptr0 al\n unfolding c_null_guard_def\n apply -\n apply (rule intvl_nowrap [where x = 0, simplified])\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs tcbBlockSizeBits_def is_aligned_def)\n apply (drule ctcb_ptr_to_tcb_ptr_aligned)\n apply (erule is_aligned_no_wrap_le)\n apply (simp add: word_bits_conv ctcb_size_bits_def)\n apply (simp add: size_of_def ctcb_size_bits_def)\n done\nqed\n\nlemma tcb_ptr_orth_cte_ptrs:\n \"{ptr_val p..+size_of TYPE(tcb_C)} \\ {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} = {}\"\n apply (rule disjointI)\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def intvl_def field_simps size_of_def ctcb_offset_defs)\n apply unat_arith\n apply (simp add: unat_of_nat64 word_bits_conv)\n apply (simp add: unat_of_nat64 word_bits_conv)\n done\n\nlemma tcb_ptr_orth_cte_ptrs':\n \"ptr_span (tcb_Ptr (regionBase + 0x400)) \\ ptr_span (Ptr regionBase :: (cte_C[5]) ptr) = {}\"\n apply (rule disjointI)\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def size_td_array\n intvl_def field_simps size_of_def ctcb_offset_def)\n apply (simp add: unat_arith_simps unat_of_nat)\n done\n\nlemma region_is_typeless_weaken:\n \"\\ region_is_typeless a b s'; (t_hrs_' (globals s)) = (t_hrs_' (globals s')); a \\ x; unat x + y \\ unat a + b \\ \\ region_is_typeless x y s\"\n by (clarsimp simp: region_is_typeless_def subsetD[OF intvl_both_le])\n\nlemmas ptr_retyp_htd_safe_neg\n = ptr_retyps_htd_safe_neg[where n=\"Suc 0\" and arr=False, unfolded ptr_retyps_gen_def, simplified]\n\nlemmas ptr_retyp_htd_safe_neg' = ptr_retyp_htd_safe_neg[OF _ _ subset_refl]\n\nabbreviation\n tcbContext_of_tcb_Ptr :: \"tcb_C ptr \\ user_context_C ptr\"\nwhere\n \"tcbContext_of_tcb_Ptr p \\ Ptr &(atcb_Ptr &(p\\[''tcbArch_C''])\\[''tcbContext_C''])\"\n\nabbreviation\n registers_of_tcb_Ptr :: \"tcb_C ptr \\ (machine_word[24]) ptr\"\nwhere\n \"registers_of_tcb_Ptr p \\ Ptr &(tcbContext_of_tcb_Ptr p \\[''registers_C''])\"\n\nabbreviation\n fpu_state_of_tcb_Ptr :: \"tcb_C ptr \\ user_fpu_state_C ptr\"\nwhere\n \"fpu_state_of_tcb_Ptr p \\ fpu_state_Ptr &(tcbContext_of_tcb_Ptr p\\[''fpuState_C''])\"\n\ndefinition\n array_updates :: \"'a::c_type['b::finite] \\ (nat \\ 'a) list \\ 'a['b]\"\nwhere\n \"array_updates \\ foldl (\\a (i,v). Arrays.update a i v)\"\n\ndefinition\n heap_updates :: \"heap_raw_state \\ (heap_mem \\ heap_mem) list \\ heap_raw_state\"\nwhere\n \"heap_updates \\ foldl (\\h upd. hrs_mem_update upd h)\"\n\nlemmas heap_updates_defs =\n heap_updates_def heap_modify_def array_updates_def\n\n(* FIXME: move up to TypHeapLib? *)\nlemma clift_heap_update_same':\n fixes p :: \"'a :: mem_type ptr\"\n shows \"\\ hrs_htd hp \\\\<^sub>t p; typ_uinfo_t TYPE('a) \\\\<^sub>t typ_uinfo_t TYPE('b) \\\n \\ clift (hrs_mem_update (\\h. heap_update p (v h) h) hp) = (clift hp :: 'b :: mem_type typ_heap)\"\n unfolding hrs_mem_update_def\n apply (cases hp)\n apply (simp add: split_def hrs_htd_def)\n apply (erule lift_t_heap_update_same)\n apply simp\n done\n\n(* FIXME: move up to TypHeapLib? *)\nlemmas clift_heap_update_same_td_name' =\n clift_heap_update_same'[OF _ tag_disj_via_td_name, unfolded pad_typ_name_def]\n\ndefinition\n initContext_registers :: \"(nat \\ machine_word) list\"\nwhere\n \"initContext_registers \\\n [(unat Kernel_C.RAX, 0), (unat Kernel_C.RBX, 0), (unat Kernel_C.RCX, 0), (unat Kernel_C.RDX, 0),\n (unat Kernel_C.RSI, 0), (unat Kernel_C.RDI, 0), (unat Kernel_C.RBP, 0), (unat Kernel_C.R8 , 0),\n (unat Kernel_C.R9 , 0), (unat Kernel_C.R10, 0), (unat Kernel_C.R11, 0), (unat Kernel_C.R12, 0),\n (unat Kernel_C.R13, 0), (unat Kernel_C.R14, 0), (unat Kernel_C.R15, 0), (unat Kernel_C.RSP, 0),\n (unat Kernel_C.FS_BASE, 0), (unat Kernel_C.GS_BASE, 0), (unat Kernel_C.Error, 0),\n (unat Kernel_C.FaultIP, 0), (unat Kernel_C.NextIP, 0), (unat Kernel_C.CS, 0x2B),\n (unat Kernel_C.FLAGS, 0x202), (unat Kernel_C.SS, 0x33)]\"\n\n(* FIXME: move *)\nlemma field_tag_sub':\n fixes p :: \"'a::mem_type ptr\"\n assumes fl: \"field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n)\"\n assumes sz: \"size_of TYPE('b) = size_td t\"\n shows \"ptr_span (Ptr &(p\\f)::'b::mem_type ptr) \\ ptr_span p\"\n by (clarsimp simp: sz field_tag_sub[OF fl])\n\nlemmas field_tag_sub_trans =\n subset_trans[OF field_tag_sub', rotated -1]\n\nlemmas field_tag_subs =\n field_tag_sub_trans[OF field_tag_sub_trans[OF field_tag_sub_trans[OF field_tag_sub']]]\n field_tag_sub_trans[OF field_tag_sub_trans[OF field_tag_sub']]\n field_tag_sub_trans[OF field_tag_sub']\n field_tag_sub'\n\nlemmas fpu_null_state_heap_update_field =\n field_tag_subs[THEN disjoint_subset[where B=kernel_data_refs],\n THEN fpu_null_state_heap_update_span_disjoint]\n\ncontext\n fixes p:: \"'a::mem_type ptr\" and n :: nat\n assumes nkr: \"{ptr_val p ..+ n * size_of TYPE('a)} \\ kernel_data_refs = {}\"\nbegin\n\nlemma retyp_non_kernel_data_ref:\n fixes q :: \"'b::mem_type ptr\"\n assumes \"ptr_span q \\ kernel_data_refs\"\n shows \"ptr_retyps_gen n p foo (hrs_htd h) \\\\<^sub>t q \\ hrs_htd h \\\\<^sub>t q\"\n apply (rule h_t_valid_ptr_retyps_gen_disjoint_iff)\n apply (subst Int_commute)\n apply (rule disjoint_subset2[OF assms nkr])\n done\n\nlemma fpu_null_state_retyp_disjoint:\n \"fpu_null_state_relation (hrs_htd_update (ptr_retyps_gen n p foo) h) = fpu_null_state_relation h\"\n by (cases \"ptr_span (fpu_state_Ptr (symbol_table ''x86KSnullFpuState'')) \\ kernel_data_refs\";\n clarsimp simp: fpu_null_state_relation_def lift_t_Some_iff hrs_htd_update\n retyp_non_kernel_data_ref)\n\nend\n\nlemma cnc_tcb_helper:\n fixes p :: \"tcb_C ptr\"\n defines \"kotcb \\ (KOTCB (makeObject :: tcb))\"\n assumes rfsr: \"(\\\\ksPSpace := ks\\, x) \\ rf_sr\"\n assumes al: \"is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\"\n assumes ptr0: \"ctcb_ptr_to_tcb_ptr p \\ 0\"\n assumes vq: \"valid_queues \\\"\n assumes pal: \"pspace_aligned' (\\\\ksPSpace := ks\\)\"\n assumes pno: \"pspace_no_overlap' (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (\\\\ksPSpace := ks\\)\"\n assumes pds: \"pspace_distinct' (\\\\ksPSpace := ks\\)\"\n assumes symref: \"sym_refs (state_refs_of' (\\\\ksPSpace := ks\\))\"\n assumes kssub: \"dom (ksPSpace \\) \\ dom ks\"\n assumes rzo: \"ret_zero (ctcb_ptr_to_tcb_ptr p) (2 ^ objBitsKO kotcb) \\\"\n assumes empty: \"region_is_bytes (ctcb_ptr_to_tcb_ptr p) (2 ^ tcbBlockSizeBits) x\"\n assumes rep0: \"heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p) = replicate (2 ^ tcbBlockSizeBits) 0\"\n assumes kdr: \"{ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \\ kernel_data_refs = {}\"\n shows \"(\\\\ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \\ kotcb)\\,\n globals_update\n (t_hrs_'_update\n (\\hrs. (heap_updates (hrs_htd_update (\\htd. ptr_retyps_gen 1 (tcb_cnode_Ptr (ctcb_ptr_to_tcb_ptr p)) False\n (ptr_retyps_gen 1 p False htd)) hrs)\n [heap_update (registers_of_tcb_Ptr p)\n (array_updates (h_val (hrs_mem hrs) (registers_of_tcb_Ptr p))\n initContext_registers),\n heap_update (fpu_state_of_tcb_Ptr p)\n (user_fpu_state_C (ARRAY i. FPUNullState (finite_index i))),\n heap_update (machine_word_Ptr &(p\\[''tcbTimeSlice_C''])) 5])\n )) x)\n \\ rf_sr\"\n (is \"(\\\\ksPSpace := ?ks\\, globals_update ?gs' x) \\ rf_sr\")\nproof -\n define ko where \"ko \\ (KOCTE (makeObject :: cte))\"\n let ?ptr = \"cte_Ptr (ctcb_ptr_to_tcb_ptr p)\"\n let ?arr_ptr = \"Ptr (ctcb_ptr_to_tcb_ptr p) :: (cte_C[5]) ptr\"\n let ?sp = \"\\\\ksPSpace := ks\\\"\n let ?s = \"\\\\ksPSpace := ?ks\\\"\n let ?gs = \"?gs' (globals x)\"\n let ?hp = \"(fst (t_hrs_' ?gs), (ptr_retyps_gen 1 p False (snd (t_hrs_' (globals x)))))\"\n\n note tcb_C_size[simp del]\n\n from al have cover: \"range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\n (objBitsKO kotcb) (Suc 0)\"\n by (rule range_cover_full, simp_all add: al)\n\n have \"\\n<2 ^ (objBitsKO kotcb - objBitsKO ko). c_guard (CTypesDefs.ptr_add ?ptr (of_nat n))\"\n apply (rule retype_guard_helper [where m = 3])\n apply (rule range_cover_rel[OF cover, rotated])\n apply simp\n apply (simp add: ko_def objBits_simps' kotcb_def)\n apply (rule ptr0)\n apply (simp add: ko_def objBits_simps' size_of_def)\n apply (simp add: ko_def objBits_simps')\n apply (simp add: ko_def objBits_simps align_of_def)\n done\n hence guard: \"\\n<5. c_guard (CTypesDefs.ptr_add ?ptr (of_nat n))\"\n by (simp add: ko_def kotcb_def objBits_simps' align_of_def)\n\n have arr_guard: \"c_guard ?arr_ptr\"\n apply (rule is_aligned_c_guard[where m=3], simp, rule al)\n apply (simp add: ptr0)\n apply (simp add: align_of_def align_td_array)\n apply (simp add: cte_C_size objBits_simps' kotcb_def)\n apply (simp add: kotcb_def objBits_simps')\n done\n\n have heap_update_to_hrs_mem_update:\n \"\\p x hp ht. (heap_update p x hp, ht) = hrs_mem_update (heap_update p x) (hp, ht)\"\n by (simp add: hrs_mem_update_def split_def)\n\n have empty_smaller:\n \"region_is_bytes (ptr_val p) (size_of TYPE(tcb_C)) x\"\n \"region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C))\n (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x))))\"\n using al region_is_bytes_subset[OF empty] tcb_ptr_to_ctcb_ptr_in_range'\n apply (simp add: objBits_simps kotcb_def)\n apply (clarsimp simp: region_is_bytes'_def)\n apply (subst(asm) ptr_retyps_gen_out)\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs intvl_def)\n apply (simp add: unat_arith_simps unat_of_nat cte_C_size tcb_C_size\n split: if_split_asm)\n apply (subst(asm) empty[unfolded region_is_bytes'_def], simp_all)\n apply (erule subsetD[rotated], rule intvl_start_le)\n apply (simp add: cte_C_size objBits_simps')\n done\n\n note htd[simp] = hrs_htd_update_htd_update[unfolded o_def,\n where d=\"ptr_retyps_gen n p a\" and d'=\"ptr_retyps_gen n' p' a'\"\n for n p a n' p' a', symmetric]\n\n have cgp: \"c_guard p\" using al\n apply -\n apply (rule c_guard_tcb [OF _ ptr0])\n apply (simp add: kotcb_def objBits_simps)\n done\n\n from pal rfsr have \"\\x\\dom (cslift x :: cte_C typ_heap). is_aligned (ptr_val x) (objBitsKO ko)\"\n apply (rule pspace_aligned_to_C_cte [OF _ cmap_relation_cte])\n apply (simp add: projectKOs ko_def)\n done\n\n have \"ptr_val p = ctcb_ptr_to_tcb_ptr p + ctcb_offset\"\n by (simp add: ctcb_ptr_to_tcb_ptr_def)\n\n have cte_tcb_disjoint: \"\\y. y \\ (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \\ of_nat) ` {k. k < 5}\n \\ {ptr_val p..+size_of TYPE(tcb_C)} \\ {ptr_val y..+size_of TYPE(cte_C)} = {}\"\n apply (rule disjoint_subset2 [OF _ tcb_ptr_orth_cte_ptrs])\n apply (clarsimp simp: intvl_def size_of_def)\n apply (rule_tac x = \"x * (2^cteSizeBits) + k\" in exI)\n apply (simp add: objBits_simps')\n done\n\n have cl_cte: \"(cslift (x\\globals := ?gs\\) :: cte_C typ_heap) =\n (\\y. if y \\ (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \\\n of_nat) `\n {k. k < 5}\n then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y)\"\n using cgp unfolding heap_updates_defs\n apply (simp add: ptr_retyp_to_array[simplified] hrs_comm[symmetric] Let_def)\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard],\n simp_all add: hrs_htd_update empty_smaller[simplified])\n apply (simp add: cte_C_size word_bits_def)\n apply (simp add: hrs_mem_update typ_heap_simps\n packed_heap_update_collapse)\n apply (simp add: heap_update_def)\n apply (subst heap_list_update_disjoint_same)\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs intvl_def\n set_eq_iff)\n apply (simp add: unat_arith_simps unat_of_nat cte_C_size tcb_C_size)\n apply (subst take_heap_list_le[symmetric])\n prefer 2\n apply (simp add: hrs_mem_def, subst rep0)\n apply (simp only: take_replicate, simp add: cte_C_size objBits_simps')\n apply (simp add: cte_C_size objBits_simps')\n apply (simp add: fun_eq_iff o_def\n split: if_split)\n apply (simp add: hrs_comm packed_heap_update_collapse\n typ_heap_simps)\n apply (subst clift_heap_update_same_td_name', simp_all,\n simp add: hrs_htd_update ptr_retyps_gen_def ptr_retyp_h_t_valid)+\n apply (subst clift_ptr_retyps_gen_other,\n simp_all add: empty_smaller tag_disj_via_td_name)\n apply (simp add: tcb_C_size word_bits_def)\n done\n\n have tcb0: \"heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0\"\n proof -\n have \"heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p)\n = take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p))\n (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p)))\"\n by (simp add: drop_heap_list_le take_heap_list_le size_of_def ctcb_ptr_to_tcb_ptr_def\n ctcb_offset_defs objBits_simps')\n also have \"\\ = replicate (size_of TYPE(tcb_C)) 0\"\n apply (subst rep0)\n apply (simp only: take_replicate drop_replicate)\n apply (rule arg_cong [where f = \"\\x. replicate x 0\"])\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs size_of_def objBits_simps')\n done\n finally show \"heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0\" .\n qed\n\n note alrl = pspace_aligned_to_C_tcb [OF pal cmap_relation_tcb [OF rfsr]]\n\n have tdisj:\n \"\\xa\\dom (cslift x) \\ {p}. \\y\\dom (cslift x). {ptr_val xa..+size_of TYPE(tcb_C)} \\ {ptr_val y..+size_of TYPE(tcb_C)} \\ {}\n \\ xa = y\"\n using al\n apply (intro ballI impI)\n apply (erule contrapos_np)\n apply (subgoal_tac \"is_aligned (ptr_val xa) ctcb_size_bits\")\n apply (subgoal_tac \"is_aligned (ptr_val y) ctcb_size_bits\")\n apply (subgoal_tac \"ctcb_size_bits < word_bits\")\n apply (rule_tac A = \"{ptr_val xa..+2 ^ ctcb_size_bits}\" in disjoint_subset)\n apply (rule intvl_start_le)\n apply (simp add: size_of_def ctcb_size_bits_def)\n apply (rule_tac B = \"{ptr_val y..+2 ^ ctcb_size_bits}\" in disjoint_subset2)\n apply (rule intvl_start_le)\n apply (simp add: size_of_def ctcb_size_bits_def)\n apply (simp only: upto_intvl_eq)\n apply (rule aligned_neq_into_no_overlap [simplified field_simps])\n apply simp\n apply assumption+\n apply (simp add: word_bits_conv ctcb_size_bits_def)\n apply (erule bspec [OF alrl])\n apply (clarsimp)\n apply (erule disjE)\n apply (simp add: objBits_simps kotcb_def)\n apply (erule ctcb_ptr_to_tcb_ptr_aligned)\n apply (erule bspec [OF alrl])\n done\n\n let ?tcbArch_C = \"tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))\"\n\n let ?new_tcb = \"(from_bytes (replicate (size_of TYPE(tcb_C)) 0)\n \\tcbArch_C := ?tcbArch_C\n \\tcbContext_C := tcbContext_C ?tcbArch_C\n \\registers_C := array_updates (registers_C (tcbContext_C ?tcbArch_C))\n initContext_registers,\n fpuState_C := fpuState_C (tcbContext_C ?tcbArch_C)\n \\state_C := ARRAY i. FPUNullState (finite_index i)\\\\\\,\n tcbTimeSlice_C := 5\\)\"\n\n have tdisj':\n \"\\y. hrs_htd (t_hrs_' (globals x)) \\\\<^sub>t y \\ ptr_span p \\ ptr_span y \\ {} \\ y = p\"\n using tdisj by (auto simp: h_t_valid_clift_Some_iff)\n\n have state_C_udpate_const_user_fpu_state_C:\n \"\\arr. state_C_update (\\_. arr) = (\\_. user_fpu_state_C arr)\"\n by (metis state_C_update.simps user_fpu_state_C.exhaust)\n\n have \"ptr_retyp p (snd (t_hrs_' (globals x))) \\\\<^sub>t p\" using cgp\n by (rule ptr_retyp_h_t_valid)\n hence \"clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p\n = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0))\"\n by (simp add: lift_t_if h_val_def tcb0 hrs_mem_def)\n hence cl_tcb: \"(cslift (x\\globals := ?gs\\) :: tcb_C typ_heap) = (cslift x)(p \\ ?new_tcb)\"\n using cgp\n apply (clarsimp simp add: typ_heap_simps heap_updates_def\n hrs_mem_update packed_heap_update_collapse_hrs)\n apply (simp add: hrs_comm[symmetric])\n apply (subst clift_ptr_retyps_gen_other,\n simp_all add: hrs_htd_update empty_smaller[simplified] tag_disj_via_td_name)\n apply (simp add: cte_C_size word_bits_def)\n apply (simp add: hrs_comm typ_heap_simps ptr_retyps_gen_def\n hrs_htd_update ptr_retyp_h_t_valid\n h_val_heap_update h_val_field_from_bytes')\n apply (simp add: h_val_def tcb0[folded hrs_mem_def]\n state_C_udpate_const_user_fpu_state_C)\n apply (rule ext, rename_tac p')\n apply (case_tac \"p' = p\", simp_all)\n apply (cut_tac clift_ptr_retyps_gen_prev_memset_same\n [where n=1 and arr=False, simplified, OF _ empty_smaller(1) _ refl])\n apply (simp_all add: tcb0[folded hrs_mem_def] ptr_retyps_gen_def)\n apply (simp add: tcb_C_size word_bits_def)\n done\n\n have cl_rest:\n \"\\typ_uinfo_t TYPE(tcb_C) \\\\<^sub>t typ_uinfo_t TYPE('a :: mem_type);\n typ_uinfo_t TYPE(cte_C[5]) \\\\<^sub>t typ_uinfo_t TYPE('a :: mem_type);\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE(word8) \\ \\\n cslift (x\\globals := ?gs\\) = (cslift x :: 'a :: mem_type typ_heap)\"\n using cgp\n apply (clarsimp simp: hrs_comm[symmetric] heap_updates_def)\n apply (subst clift_ptr_retyps_gen_other,\n simp_all add: hrs_htd_update empty_smaller[simplified],\n simp_all add: cte_C_size tcb_C_size word_bits_def)\n apply (simp add: hrs_comm ptr_retyps_gen_def)\n apply (simp add: clift_heap_update_same hrs_htd_update ptr_retyp_h_t_valid typ_heap_simps)\n apply (rule trans[OF _ clift_ptr_retyps_gen_other[where nptrs=1 and arr=False,\n simplified, OF empty_smaller(1)]], simp_all)\n apply (simp add: ptr_retyps_gen_def)\n apply (simp add: tcb_C_size word_bits_def)\n done\n\n have rl:\n \"(\\v :: 'a :: pre_storable. projectKO_opt kotcb \\ Some v) \\\n (projectKO_opt \\\\<^sub>m (ks(ctcb_ptr_to_tcb_ptr p \\ KOTCB makeObject)) :: machine_word \\ 'a option)\n = projectKO_opt \\\\<^sub>m ks\" using pno al\n apply -\n apply (drule(2) projectKO_opt_retyp_other'[OF _ _ pal])\n apply (simp add: kotcb_def)\n done\n\n have rl_tcb: \"(projectKO_opt \\\\<^sub>m (ks(ctcb_ptr_to_tcb_ptr p \\ KOTCB makeObject)) :: machine_word \\ tcb option)\n = (projectKO_opt \\\\<^sub>m ks)(ctcb_ptr_to_tcb_ptr p \\ makeObject)\"\n apply (rule ext)\n apply (clarsimp simp: projectKOs map_comp_def split: if_split)\n done\n\n have mko: \"\\dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Some kotcb\"\n by (simp add: makeObjectKO_def kotcb_def)\n note hacky_cte = retype_ctes_helper [where sz = \"objBitsKO kotcb\" and ko = kotcb and ptr = \"ctcb_ptr_to_tcb_ptr p\",\n OF pal pds pno al _ _ mko, simplified new_cap_addrs_def, simplified]\n\n \\ \\Ugh\\\n moreover have\n \"\\y. y \\ ptr_val ` (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \\ of_nat) ` {k. k < 5}\n = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \\ y && mask tcbBlockSizeBits \\ dom tcb_cte_cases)\" (is \"\\y. ?LHS y = ?RHS y\")\n proof -\n fix y\n\n have al_rl: \"\\k. k < 5 \\\n ctcb_ptr_to_tcb_ptr p + of_nat k * of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = of_nat k * of_nat (size_of TYPE(cte_C))\n \\ ctcb_ptr_to_tcb_ptr p + of_nat k * of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p\" using al\n apply -\n apply (rule is_aligned_add_helper)\n apply (simp add: objBits_simps kotcb_def)\n apply (subst Abs_fnat_hom_mult)\n apply (subst word_less_nat_alt)\n apply (subst unat_of_nat64)\n apply (simp add: size_of_def word_bits_conv objBits_simps')+\n done\n\n have al_rl2: \"\\k. k < 5 \\ unat (of_nat k * of_nat (size_of TYPE(cte_C)) :: machine_word) = k * (2^cteSizeBits)\"\n apply (subst Abs_fnat_hom_mult)\n apply (subst unat_of_nat64)\n apply (simp add: size_of_def word_bits_conv objBits_simps')+\n done\n\n show \"?LHS y = ?RHS y\" using al\n apply (simp add: image_image kotcb_def objBits_simps)\n apply rule\n apply (clarsimp simp: dom_tcb_cte_cases_iff al_rl al_rl2)\n apply (clarsimp simp: dom_tcb_cte_cases_iff al_rl al_rl2)\n apply (rule_tac x = ya in image_eqI)\n apply (rule mask_eqI [where n = tcbBlockSizeBits])\n apply (subst unat_arith_simps(3))\n apply (simp add: al_rl al_rl2)+\n done\n qed\n\n ultimately have rl_cte: \"(map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \\ KOTCB makeObject)) :: machine_word \\ cte option)\n = (\\x. if x \\ ptr_val ` (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \\ of_nat) ` {k. k < 5}\n then Some (CTE NullCap nullMDBNode)\n else map_to_ctes ks x)\"\n apply simp\n apply (drule_tac x = \"Suc 0\" in meta_spec)\n apply clarsimp\n apply (erule impE[OF impI])\n apply (rule range_cover_full[OF al])\n apply (simp add: objBits_simps' word_bits_conv bit_simps archObjSize_def\n split:kernel_object.splits arch_kernel_object.splits)\n apply (simp add: fun_upd_def kotcb_def cong: if_cong)\n done\n\n let ?tcb = \"(tcbArch_C_update\n (\\_. tcbContext_C_update\n (\\_. registers_C_update (\\_. foldr (\\n arr. Arrays.update arr n 0) [0..<24]\n (registers_C (tcbContext_C (tcbArch_C undefined))))\n (fpuState_C_update\n (\\_. state_C_update (\\_. foldr (\\n arr. Arrays.update arr n 0) [0..<576]\n (state_C (fpuState_C (tcbContext_C (tcbArch_C undefined)))))\n (fpuState_C (tcbContext_C (tcbArch_C undefined))))\n (tcbContext_C (tcbArch_C undefined))))\n (tcbArch_C undefined))\n undefined)\\\n tcbState_C :=\n thread_state_C.words_C_update\n (\\_. foldr (\\n arr. Arrays.update arr n 0) [0..<3]\n (thread_state_C.words_C (tcbState_C undefined)))\n (tcbState_C undefined),\n tcbFault_C :=\n seL4_Fault_C.words_C_update\n (\\_. foldr (\\n arr. Arrays.update arr n 0) [0..<2]\n (seL4_Fault_C.words_C (tcbFault_C undefined)))\n (tcbFault_C undefined),\n tcbLookupFailure_C :=\n lookup_fault_C.words_C_update\n (\\_. foldr (\\n arr. Arrays.update arr n 0) [0..<2]\n (lookup_fault_C.words_C (tcbLookupFailure_C undefined)))\n (tcbLookupFailure_C undefined),\n tcbPriority_C := 0, tcbMCP_C := 0, tcbDomain_C := 0, tcbTimeSlice_C := 0,\n tcbFaultHandler_C := 0, tcbIPCBuffer_C := 0,\n tcbSchedNext_C := tcb_Ptr 0, tcbSchedPrev_C := tcb_Ptr 0,\n tcbEPNext_C := tcb_Ptr 0, tcbEPPrev_C := tcb_Ptr 0,\n tcbBoundNotification_C := ntfn_Ptr 0\\\"\n have fbtcb: \"from_bytes (replicate (size_of TYPE(tcb_C)) 0) = ?tcb\"\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps tcb_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def)(* takes ages *)\n apply (simp add: update_ti_adjust_ti update_ti_t_machine_word_0s\n typ_info_simps thread_state_C_tag_def seL4_Fault_C_tag_def\n lookup_fault_C_tag_def update_ti_t_ptr_0s arch_tcb_C_tag_def\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n ti_typ_combine_empty_ti ti_typ_combine_td\n align_of_def padup_def user_fpu_state_C_tag_def user_context_C_tag_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def\n align_td_array' size_td_array)\n apply (simp add: update_ti_t_array_rep_word0 update_ti_t_array_rep_byte0)\n done\n\n have tcb_rel:\n \"ctcb_relation makeObject ?new_tcb\"\n unfolding ctcb_relation_def makeObject_tcb heap_updates_defs initContext_registers_def\n apply (simp add: fbtcb minBound_word)\n apply (intro conjI)\n apply (simp add: cthread_state_relation_def thread_state_lift_def\n eval_nat_numeral ThreadState_Inactive_def)\n apply (clarsimp simp: ccontext_relation_def newContext_def2 carch_tcb_relation_def\n newArchTCB_def cregs_relation_def atcbContextGet_def fpu_relation_def)\n apply (case_tac r; simp add: C_register_defs index_foldr_update\n atcbContext_def newArchTCB_def newContext_def\n initContext_def selCS3_eq selDS3_eq)\n apply (clarsimp simp: fpu_relation_def)\n apply (simp add: thread_state_lift_def index_foldr_update atcbContextGet_def)\n apply (simp add: Kernel_Config.timeSlice_def)\n apply (simp add: cfault_rel_def seL4_Fault_lift_def seL4_Fault_get_tag_def Let_def\n lookup_fault_lift_def lookup_fault_get_tag_def lookup_fault_invalid_root_def\n index_foldr_update seL4_Fault_NullFault_def option_to_ptr_def option_to_0_def\n split: if_split)+\n done\n\n have pks: \"ks (ctcb_ptr_to_tcb_ptr p) = None\"\n by (rule pspace_no_overlap_base' [OF pal pno al, simplified])\n\n have ep1 [simplified]: \"\\p' list. map_to_eps (ksPSpace ?sp) p' = Some (Structures_H.endpoint.RecvEP list)\n \\ ctcb_ptr_to_tcb_ptr p \\ set list\"\n using symref pks pal pds\n apply -\n apply (frule map_to_ko_atI)\n apply simp\n apply simp\n apply (drule (1) sym_refs_ko_atD')\n apply clarsimp\n apply (drule (1) bspec)\n apply (simp add: ko_wp_at'_def)\n done\n\n have ep2 [simplified]: \"\\p' list. map_to_eps (ksPSpace ?sp) p' = Some (Structures_H.endpoint.SendEP list)\n \\ ctcb_ptr_to_tcb_ptr p \\ set list\"\n using symref pks pal pds\n apply -\n apply (frule map_to_ko_atI)\n apply simp\n apply simp\n apply (drule (1) sym_refs_ko_atD')\n apply clarsimp\n apply (drule (1) bspec)\n apply (simp add: ko_wp_at'_def)\n done\n\n have ep3 [simplified]: \"\\p' list boundTCB. map_to_ntfns (ksPSpace ?sp) p' = Some (Structures_H.notification.NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB)\n \\ ctcb_ptr_to_tcb_ptr p \\ set list\"\n using symref pks pal pds\n apply -\n apply (frule map_to_ko_atI)\n apply simp\n apply simp\n apply (drule (1) sym_refs_ko_atD')\n apply clarsimp\n apply (drule_tac x=\"(ctcb_ptr_to_tcb_ptr p, NTFNSignal)\" in bspec, simp)\n apply (simp add: ko_wp_at'_def)\n done\n\n have pks': \"ksPSpace \\ (ctcb_ptr_to_tcb_ptr p) = None\" using pks kssub\n apply -\n apply (erule contrapos_pp)\n apply (fastforce simp: dom_def)\n done\n\n hence kstcb: \"\\qdom prio. ctcb_ptr_to_tcb_ptr p \\ set (ksReadyQueues \\ (qdom, prio))\" using vq\n apply (clarsimp simp add: valid_queues_def valid_queues_no_bitmap_def)\n apply (drule_tac x = qdom in spec)\n apply (drule_tac x = prio in spec)\n apply clarsimp\n apply (drule (1) bspec)\n apply (simp add: obj_at'_def)\n done\n\n have ball_subsetE:\n \"\\P S R. \\ \\x \\ S. P x; R \\ S \\ \\ \\x \\ R. P x\"\n by blast\n\n have domain_kdr:\n \"-domain \\ kernel_data_refs\"\n using rfsr unfolding rf_sr_def cstate_relation_def Let_def by simp\n\n have htd_safe:\n \"htd_safe domain (hrs_htd (t_hrs_' (globals x)))\n \\ htd_safe domain (hrs_htd (t_hrs_' ?gs))\"\n using kdr\n apply (simp add: hrs_htd_update heap_updates_def)\n apply (intro ptr_retyps_htd_safe_neg[OF _ _ domain_kdr], simp_all)\n apply (erule disjoint_subset[rotated])\n apply (simp add: ctcb_ptr_to_tcb_ptr_def size_of_def)\n apply (rule intvl_sub_offset[where k=\"ptr_val p - ctcb_offset\" and x=\"ctcb_offset\", simplified])\n apply (simp add: ctcb_offset_defs objBits_simps')\n apply (erule disjoint_subset[rotated])\n apply (rule intvl_start_le)\n apply (simp add: size_of_def objBits_simps')\n done\n\n have zro:\n \"zero_ranges_are_zero (gsUntypedZeroRanges \\) (t_hrs_' (globals x))\"\n using rfsr\n by (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n\n have h_t_valid_p:\n \"h_t_valid (hrs_htd (t_hrs_' ?gs)) c_guard p\"\n using fun_cong[OF cl_tcb, where x=p]\n by (clarsimp dest!: h_t_valid_clift)\n\n have zro':\n \"zero_ranges_are_zero (gsUntypedZeroRanges \\) (t_hrs_' ?gs)\"\n using zro h_t_valid_p rzo al\n apply clarsimp\n apply (simp add: heap_updates_def hrs_htd_update typ_heap_simps')\n apply (intro zero_ranges_ptr_retyps, simp_all)\n apply (erule caps_overlap_reserved'_subseteq)\n apply (rule order_trans, rule tcb_ptr_to_ctcb_ptr_in_range')\n apply (simp add: objBits_simps kotcb_def)\n apply (simp add: objBits_simps kotcb_def)\n apply (erule caps_overlap_reserved'_subseteq)\n apply (rule intvl_start_le)\n apply (simp add: cte_C_size kotcb_def objBits_simps')\n done\n\n note al' = al[simplified objBits_simps kotcb_def, simplified]\n\n have p_nkr: \"ptr_span p \\ kernel_data_refs = {}\"\n apply (rule disjoint_subset[OF _ kdr])\n using ptr_span_ctcb_subset[OF al']\n apply (simp add: upto_intvl_eq[OF al'])\n done\n\n note ht_rest = clift_eq_h_t_valid_eq[OF cl_rest, simplified]\n\n note irq = h_t_valid_eq_array_valid[where p=intStateIRQNode_array_Ptr]\n h_t_array_valid_ptr_retyps_gen[where n=1, simplified, OF refl empty_smaller(1)]\n h_t_array_valid_ptr_retyps_gen[where p=\"Ptr x\" for x, simplified, OF refl empty_smaller(2)]\n\n from rfsr have \"cpspace_relation ks (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) (t_hrs_' ?gs)\"\n unfolding cpspace_relation_def\n apply -\n apply (simp add: cl_cte [simplified] cl_tcb [simplified] cl_rest [simplified] tag_disj_via_td_name\n ht_rest)\n apply (simp add: rl kotcb_def projectKOs rl_tcb rl_cte)\n apply (elim conjE)\n apply (intro conjI)\n \\ \\cte\\\n apply (erule cmap_relation_retype2)\n apply (simp add:ccte_relation_nullCap nullMDBNode_def nullPointer_def)\n \\ \\tcb\\\n apply (erule cmap_relation_updI2 [where dest = \"ctcb_ptr_to_tcb_ptr p\" and f = \"tcb_ptr_to_ctcb_ptr\", simplified])\n apply (rule map_comp_simps)\n apply (rule pks)\n apply (rule tcb_rel[simplified FLAGS_default_eq, simplified])\n \\ \\ep\\\n apply (erule iffD2 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply (simp add: cendpoint_relation_def Let_def)\n apply (subst endpoint.case_cong)\n apply (rule refl)\n apply (simp add: tcb_queue_update_other' ep1)\n apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty)\n apply (simp add: tcb_queue_update_other' ep2)\n apply clarsimp\n \\ \\ntfn\\\n apply (erule iffD2 [OF cmap_relation_cong, OF refl refl, rotated -1])\n apply (simp add: cnotification_relation_def Let_def)\n apply (subst ntfn.case_cong)\n apply (rule refl)\n apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty)\n apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty)\n apply (case_tac a, simp add: tcb_queue_update_other' ep3)\n apply (clarsimp simp: typ_heap_simps)\n done\n\n moreover have \"cte_array_relation \\ ?gs\n \\ tcb_cte_array_relation ?s ?gs\"\n using rfsr\n apply (clarsimp simp: heap_updates_def\n rf_sr_def cstate_relation_def Let_def\n hrs_htd_update map_comp_update\n kotcb_def projectKO_opt_tcb)\n apply (intro cvariable_array_ptr_upd conjI\n cvariable_array_ptr_retyps[OF refl, where n=1, simplified],\n simp_all add: empty_smaller[simplified])\n apply (simp add: ptr_retyps_gen_def)\n apply (rule ptr_retyp_h_t_valid[where g=c_guard, OF arr_guard,\n THEN h_t_array_valid, simplified])\n done\n\n ultimately show ?thesis\n using rfsr zro'\n apply (simp add: rf_sr_def cstate_relation_def Let_def h_t_valid_clift_Some_iff\n tag_disj_via_td_name carch_state_relation_def\n cmachine_state_relation_def irq)\n apply (simp add: cl_cte [simplified] cl_tcb [simplified] cl_rest [simplified] tag_disj_via_td_name)\n apply (clarsimp simp: cready_queues_relation_def Let_def\n htd_safe[simplified] kernel_data_refs_domain_eq_rotate)\n apply (simp add: heap_updates_def kstcb tcb_queue_update_other' hrs_htd_update\n ptr_retyp_to_array[simplified] irq[simplified])\n apply (match premises in H: \\fpu_null_state_relation _\\ \\\n \\match premises in _[thin]: _ (multi) \\ \\insert H\\\\)\n apply (simp add: fpu_null_state_heap_update_field p_nkr size_td_array\n fpu_null_state_retyp_disjoint\n disjoint_subset[OF _ kdr] disjoint_subset[OF _ p_nkr]\n intvl_start_le cte_C_size tcbBlockSizeBits_def)\n done\nqed\n\nlemma cnc_foldl_foldr:\n defines \"ko \\ (KOTCB makeObject)\"\n shows \"foldl (\\v addr. v(addr \\ ko)) mp\n (map (\\n. ptr + (of_nat n << tcbBlockSizeBits)) [0..< n]) =\n foldr (\\addr. data_map_insert addr ko) (new_cap_addrs n ptr ko) mp\"\n by (simp add: foldr_upd_app_if foldl_conv_foldr\n new_cap_addrs_def objBits_simps ko_def power_minus_is_div\n cong: foldr_cong)\n\nlemma objBitsKO_gt_1:\n \"(1 :: machine_word) < 2 ^ objBitsKO ko\"\n by (simp add: objBits_simps' archObjSize_def bit_simps\n split: kernel_object.splits arch_kernel_object.splits)\n\nlemma ps_clear_subset:\n assumes pd: \"ps_clear x (objBitsKO ko) (s' \\ksPSpace := (\\x. if x \\ as then Some (f x) else ksPSpace s' x) \\)\"\n and sub: \"as' \\ as\"\n and al: \"is_aligned x (objBitsKO ko)\"\n shows \"ps_clear x (objBitsKO ko) (s' \\ksPSpace := (\\x. if x \\ as' then Some (f x) else ksPSpace s' x) \\)\"\n using al pd sub\n apply -\n apply (simp add: ps_clear_def3 [OF al objBitsKO_gt_0] dom_if_Some)\n apply (erule disjoint_subset2 [rotated])\n apply fastforce\n done\n\nlemma pspace_distinct_subset:\n assumes pd: \"pspace_distinct' (s' \\ksPSpace := (\\x. if x \\ as then Some (f x) else ksPSpace s' x) \\)\"\n and pal: \"pspace_aligned' (s' \\ksPSpace := (\\x. if x \\ as then Some (f x) else ksPSpace s' x) \\)\"\n and sub: \"as' \\ as\"\n and doms: \"as \\ dom (ksPSpace s') = {}\"\n shows \"pspace_distinct' (s' \\ksPSpace := (\\x. if x \\ as' then Some (f x) else ksPSpace s' x) \\)\"\n using pd sub doms pal\n unfolding pspace_distinct'_def pspace_aligned'_def\n apply -\n apply (rule ballI)\n apply (simp add: pspace_distinct'_def dom_if_Some)\n apply (drule_tac x = x in bspec)\n apply fastforce\n apply (drule_tac x = x in bspec)\n apply fastforce\n apply (erule disjE)\n apply (frule (1) subsetD)\n apply simp\n apply (erule (2) ps_clear_subset)\n apply (subgoal_tac \"x \\ as\")\n apply (frule (1) contra_subsetD)\n apply simp\n apply (erule (2) ps_clear_subset)\n apply fastforce\n done\n\nlemma pspace_aligned_subset:\n assumes pal: \"pspace_aligned' (s' \\ksPSpace := (\\x. if x \\ as then Some (f x) else ksPSpace s' x) \\)\"\n and sub: \"as' \\ as\"\n and doms: \"as \\ dom (ksPSpace s') = {}\"\n shows \"pspace_aligned' (s' \\ksPSpace := (\\x. if x \\ as' then Some (f x) else ksPSpace s' x) \\)\"\n using pal sub doms unfolding pspace_aligned'_def\n apply -\n apply (rule ballI)\n apply (simp add: dom_if_Some)\n apply (drule_tac x = x in bspec)\n apply fastforce\n apply (erule disjE)\n apply simp\n apply (frule (1) subsetD)\n apply simp\n apply (subgoal_tac \"x \\ as\")\n apply (frule (1) contra_subsetD)\n apply simp\n apply fastforce\n done\n\n\nlemma cslift_empty_mem_update:\n fixes x :: cstate and sz and ptr\n defines \"x' \\ x\\globals := globals x\n \\t_hrs_' := hrs_mem_update (heap_update_list ptr (replicate sz 0)) (t_hrs_' (globals x))\\\\\"\n assumes empty: \"region_is_typeless ptr sz x\"\n shows \"cslift x' = clift (fst (t_hrs_' (globals x)), snd (t_hrs_' (globals x)))\"\n using empty\n apply -\n apply (unfold region_is_typeless_def)\n apply (rule ext)\n apply (simp only: lift_t_if hrs_mem_update_def split_def x'_def)\n apply (simp add: lift_t_if hrs_mem_update_def split_def)\n apply (clarsimp simp: h_val_def split: if_split)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule disjointI)\n apply clarsimp\n apply (drule (1) bspec)\n apply (frule (1) h_t_valid_not_empty)\n apply simp\n apply simp\n done\n\nlemma cslift_bytes_mem_update:\n fixes x :: cstate and sz and ptr\n defines \"x' \\ x\\globals := globals x\n \\t_hrs_' := hrs_mem_update (heap_update_list ptr (replicate sz 0)) (t_hrs_' (globals x))\\\\\"\n assumes bytes: \"region_is_bytes ptr sz x\"\n assumes not_byte: \"typ_uinfo_t TYPE ('a) \\ typ_uinfo_t TYPE (word8)\"\n shows \"(cslift x' :: ('a :: mem_type) ptr \\ _)\n = clift (fst (t_hrs_' (globals x)), snd (t_hrs_' (globals x)))\"\n using bytes\n apply (unfold region_is_bytes'_def)\n apply (rule ext)\n apply (simp only: lift_t_if hrs_mem_update_def split_def x'_def)\n apply (simp add: lift_t_if hrs_mem_update_def split_def)\n apply (clarsimp simp: h_val_def split: if_split)\n apply (subst heap_list_update_disjoint_same)\n apply simp\n apply (rule disjointI)\n apply clarsimp\n apply (drule (1) bspec)\n apply (frule (1) h_t_valid_intvl_htd_contains_uinfo_t)\n apply (clarsimp simp: hrs_htd_def not_byte)\n apply simp\n done\n\nlemma heap_list_eq_replicate_eq_eq:\n \"(heap_list hp n ptr = replicate n v)\n = (\\p \\ {ptr ..+ n}. hp p = v)\"\n by (induct n arbitrary: ptr, simp_all add: intvl_Suc_right)\n\nlemma heap_update_list_replicate_eq:\n \"(heap_update_list x (replicate n v) hp y)\n = (if y \\ {x ..+ n} then v else hp y)\"\n apply (induct n arbitrary: x hp, simp_all add: intvl_Suc_right)\n apply (simp split: if_split)\n done\n\nlemma zero_ranges_are_zero_update_zero[simp]:\n \"zero_ranges_are_zero rs hrs\n \\ zero_ranges_are_zero rs (hrs_mem_update (heap_update_list ptr (replicate n 0)) hrs)\"\n supply if_cong[cong]\n apply (clarsimp simp: zero_ranges_are_zero_def hrs_mem_update)\n apply (drule(1) bspec)\n apply (clarsimp simp: heap_list_eq_replicate_eq_eq heap_update_list_replicate_eq)\n done\n\nlemma rf_sr_rep0:\n assumes sr: \"(\\, x) \\ rf_sr\"\n assumes empty: \"region_is_bytes ptr sz x\"\n shows \"(\\, globals_update (t_hrs_'_update (hrs_mem_update (heap_update_list ptr (replicate sz 0)))) x) \\ rf_sr\"\n using sr\n by (clarsimp simp: rf_sr_def cstate_relation_def Let_def cpspace_relation_def\n carch_state_relation_def fpu_null_state_relation_def\n cmachine_state_relation_def hrs_mem_update\n cslift_bytes_mem_update[OF empty, simplified] cte_C_size)\n\n(* FIXME: generalise *)\nlemma ccorres_already_have_rrel:\n \"\\ ccorres dc xfdc P P' hs a c; \\s. \\ \\\\<^bsub>/UNIV\\<^esub> {s} c {t. xf t = xf s} \\\n \\\n ccorres r xf P (P' \\ {s. r v (xf s)}) hs (a >>= (\\_. return v)) c\"\n apply (rule ccorres_return_into_rel)\n apply (rule ccorresI')\n apply (erule (2) ccorresE)\n apply simp\n apply assumption+\n apply (clarsimp elim!: rev_bexI)\n apply (simp add: unif_rrel_def)\n apply (drule_tac x = s' in spec)\n apply (drule (1) exec_handlers_use_hoare_nothrow)\n apply simp\n apply fastforce\n done\n\nlemma mapM_x_storeWord:\n assumes al: \"is_aligned ptr 3\"\n shows \"mapM_x (\\x. storeWord (ptr + of_nat x * 8) 0) [0..m x. if x \\ {ptr..+ n * 8} then 0 else m x))\"\nproof (induct n)\n case 0\n thus ?case\n apply (rule ext)\n apply (simp add: mapM_x_mapM mapM_def sequence_def\n modify_def get_def put_def bind_def return_def)\n done\nnext\n case (Suc n')\n\n have funs_eq:\n \"\\m x. (if x \\ {ptr..+8 + n' * 8} then 0 else (m x :: word8)) =\n ((\\xa. if xa \\ {ptr..+n' * 8} then 0 else m xa)\n (ptr + of_nat n' * 8 := word_rsplit (0 :: machine_word) ! 7,\n ptr + of_nat n' * 8 + 1 := word_rsplit (0 :: machine_word) ! 6,\n ptr + of_nat n' * 8 + 2 := word_rsplit (0 :: machine_word) ! 5,\n ptr + of_nat n' * 8 + 3 := word_rsplit (0 :: machine_word) ! 4,\n ptr + of_nat n' * 8 + 4:= word_rsplit (0 :: machine_word) ! 3,\n ptr + of_nat n' * 8 + 5 := word_rsplit (0 :: machine_word) ! 2,\n ptr + of_nat n' * 8 + 6 := word_rsplit (0 :: machine_word) ! Suc 0,\n ptr + of_nat n' * 8 + 7 := word_rsplit (0 :: machine_word) ! 0)) x\"\n proof -\n fix m x\n\n have xin': \"\\x. (x < 8 + n' * 8) = (x < n' * 8 \\ x = n' * 8\n \\ x = (n' * 8) + 1 \\ x = (n' * 8) + 2 \\ x = (n' * 8) + 3\n \\ x = (n' * 8) + 4 \\ x = (n' * 8) + 5 \\ x = (n' * 8) + 6\n \\ x = (n' * 8) + 7)\"\n by (safe, simp_all)\n\n have xin: \"x \\ {ptr..+8 + n' * 8} = (x \\ {ptr..+n' * 8} \\ x = ptr + of_nat n' * 8 \\\n x = ptr + of_nat n' * 8 + 1 \\ x = ptr + of_nat n' * 8 + 2 \\ x = ptr + of_nat n' * 8 + 3\n \\ x = ptr + of_nat n' * 8 + 4 \\ x = ptr + of_nat n' * 8 + 5 \\ x = ptr + of_nat n' * 8 + 6\n \\ x = ptr + of_nat n' * 8 + 7)\"\n by (simp add: intvl_def xin' conj_disj_distribL\n ex_disj_distrib field_simps)\n\n show \"?thesis m x\"\n apply (simp add: xin word_rsplit_0 word_bits_def cong: if_cong)\n apply (simp split: if_split)\n done\n qed\n\n from al have \"is_aligned (ptr + of_nat n' * 8) 3\"\n apply (rule aligned_add_aligned)\n apply (rule is_aligned_mult_triv2 [where n = 3, simplified])\n apply (simp add: word_bits_conv)+\n done\n\n thus ?case\n apply (simp add: mapM_x_append bind_assoc Suc.hyps mapM_x_singleton)\n apply (simp add: storeWord_def assert_def is_aligned_mask modify_modify comp_def)\n apply (simp only: funs_eq upto0_7_def)\n apply (rule arg_cong[where f=modify])\n apply (rule arg_cong[where f=underlying_memory_update])\n apply (simp add: fold_def del: fun_upd_apply)\n done\nqed\n\nlemma mapM_x_storeWord_step:\n assumes al: \"is_aligned ptr sz\"\n and sz2: \"3 \\ sz\"\n and sz: \"sz < word_bits\"\n shows \"mapM_x (\\p. storeWord p 0) [ptr , ptr + 8 .e. ptr + 2 ^ sz - 1] =\n modify (underlying_memory_update (\\m x. if x \\ {ptr..+2 ^ (sz - 3) * 8} then 0 else m x))\"\n using al sz\n apply (simp only: upto_enum_step_def field_simps cong: if_cong)\n apply (subst if_not_P)\n apply (subst not_less)\n apply (erule is_aligned_no_overflow)\n apply (simp add: mapM_x_map comp_def upto_enum_word del: upt.simps)\n apply (subst div_power_helper_64 [OF sz2, simplified])\n apply assumption\n apply (simp add: word_bits_def unat_minus_one del: upt.simps)\n apply (subst mapM_x_storeWord)\n apply (erule is_aligned_weaken [OF _ sz2])\n apply (simp add: field_simps)\n done\n\n\nlemma pspace_aligned_to_C_user_data:\n fixes v :: \"user_data\"\n assumes pal: \"pspace_aligned' s\"\n and cmap: \"cpspace_user_data_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals x))\"\n shows \"\\x\\dom (cslift x :: user_data_C typ_heap). is_aligned (ptr_val x) (objBitsKO KOUserData)\"\n (is \"\\x\\dom ?CS. is_aligned (ptr_val x) (objBitsKO KOUserData)\")\nproof\n fix z\n assume \"z \\ dom ?CS\"\n hence \"z \\ Ptr ` dom (map_to_user_data (ksPSpace s))\" using cmap\n by (simp add: cmap_relation_def dom_heap_to_user_data)\n hence pvz: \"ptr_val z \\ dom (map_to_user_data (ksPSpace s))\"\n by clarsimp\n hence \"projectKO_opt (the (ksPSpace s (ptr_val z))) = Some UserData\"\n apply -\n apply (frule map_comp_subset_domD)\n apply (clarsimp simp: dom_def)+\n done\n moreover have pvz: \"ptr_val z \\ dom (ksPSpace s)\" using pvz\n by (rule map_comp_subset_domD)\n ultimately show \"is_aligned (ptr_val z) (objBitsKO KOUserData)\" using pal\n unfolding pspace_aligned'_def\n apply -\n apply (drule (1) bspec)\n apply (simp add: projectKOs)\n done\nqed\n\nlemma range_cover_bound_weak:\n \"\\ n \\ 0; range_cover ptr sz us n \\ \\\n ptr + (of_nat n * 2 ^ us - 1) \\ (ptr && ~~ mask sz) + 2 ^ sz - 1\"\n apply (frule range_cover_cell_subset[where x = \"of_nat (n - 1)\"])\n apply (simp add:range_cover_not_zero)\n apply (frule range_cover_subset_not_empty[rotated,where x = \"of_nat (n - 1)\"])\n apply (simp add:range_cover_not_zero)\n apply (clarsimp simp: field_simps)\n done\n\nlemma pspace_no_overlap_underlying_zero:\n \"pspace_no_overlap' ptr sz \\\n \\ valid_machine_state' \\\n \\ x \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\n \\ underlying_memory (ksMachineState \\) x = 0\"\n using mask_in_range[where ptr'=x and bits=pageBits and ptr=\"x && ~~ mask pageBits\"]\n apply (clarsimp simp: valid_machine_state'_def)\n apply (drule_tac x=x in spec, clarsimp simp: pointerInUserData_def)\n apply (clarsimp simp: typ_at'_def ko_wp_at'_def koTypeOf_eq_UserDataT)\n apply (case_tac \"pointerInDeviceData x \\\")\n apply (clarsimp simp: pointerInDeviceData_def\n ko_wp_at'_def obj_at'_def projectKOs\n dest!: device_data_at_ko)\n apply (drule(1) pspace_no_overlapD')\n apply (drule_tac x=x in eqset_imp_iff)\n apply (simp add: objBits_simps)\n apply clarsimp\n apply (drule(1) pspace_no_overlapD')\n apply (drule_tac x=x in eqset_imp_iff, simp)\n apply (simp add: objBits_simps)\n done\n\nlemma range_cover_nca_neg: \"\\x p (off :: 9 word).\n \\(x::machine_word) < 8; {p..+2 ^pageBits } \\ {ptr..ptr + (of_nat n * 2 ^ (gbits + pageBits) - 1)} = {};\n range_cover ptr sz (gbits + pageBits) n\\\n \\ p + ucast off * 8 + x \\ {ptr..+n * 2 ^ (gbits + pageBits)}\"\n apply (case_tac \"n = 0\")\n apply simp\n apply (subst range_cover_intvl,simp)\n apply simp\n apply (subgoal_tac \"p + ucast off * 8 + x \\ {p..+2 ^ pageBits}\")\n apply blast\n apply (clarsimp simp: intvl_def)\n apply (rule_tac x = \"unat off * 8 + unat x\" in exI)\n apply (simp add: ucast_nat_def)\n apply (rule nat_add_offset_less [where n = 3, simplified])\n apply (simp add: word_less_nat_alt)\n apply (rule unat_lt2p)\n apply (simp add: pageBits_def objBits_simps)\n done\n\nlemma heap_to_device_data_disj_mdf:\n assumes rc: \"range_cover ptr sz (gbits + pageBits) n\"\n and ko_at: \"ksPSpace \\ a = Some obj\"\n and obj_size: \"objBitsKO obj = pageBits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and sz: \"gbits + pageBits \\ sz\"\n and szb: \"sz < word_bits\"\n shows \"(heap_to_device_data (ksPSpace \\)\n (\\x. if x \\ {ptr..+n * 2 ^ (gbits + pageBits)} then 0 else underlying_memory (ksMachineState \\) x) a)\n = (heap_to_device_data (ksPSpace \\) (underlying_memory (ksMachineState \\)) a)\"\n proof -\n from sz have \"3 \\ sz\" by (simp add: objBits_simps pageBits_def)\n\n hence sz2: \"2 ^ (sz - 3) * 8 = (2 :: nat) ^ sz\"\n apply (subgoal_tac \"(8 :: nat) = 2 ^ 3\")\n apply (erule ssubst)\n apply (subst power_add [symmetric])\n apply (rule arg_cong [where f = \"\\n. 2 ^ n\"])\n apply simp\n apply simp\n done\n have p2dist: \"n * (2::nat) ^ (gbits + pageBits) = n * 2 ^ gbits * 2 ^ pageBits\" (is \"?lhs = ?rhs\")\n by (simp add: monoid_mult_class.power_add)\n show ?thesis\n apply (simp add: heap_to_device_data_def)\n apply (case_tac \"n = 0\")\n apply simp\n apply (subst map_option_byte_to_word_heap)\n apply (erule range_cover_nca_neg[OF _ _ rc])\n using range_cover_intvl[OF rc]\n apply (clarsimp simp add: heap_to_user_data_def Let_def\n byte_to_word_heap_def[abs_def] map_comp_Some_iff projectKOs)\n apply (cut_tac pspace_no_overlapD' [OF ko_at pno])\n apply (subst (asm) upto_intvl_eq [symmetric])\n apply (rule pspace_alignedD' [OF ko_at pal])\n apply (simp add: obj_size p2dist)\n apply (drule_tac B' = \"{ptr..ptr + (of_nat n * 2 ^ (gbits + pageBits) - 1)}\" in disjoint_subset2[rotated])\n apply (clarsimp simp: p2dist )\n apply (rule range_cover_bound_weak)\n apply simp\n apply (rule rc)\n apply simp\n apply simp\n done\nqed\n\nlemma pageBitsForSize_mess_multi:\n \"8 * (2::nat) ^ (pageBitsForSize sz - 3) = 2^(pageBitsForSize sz)\"\n apply (subgoal_tac \"(8 :: nat) = 2 ^ 3\")\n apply (erule ssubst)\n apply (subst power_add [symmetric])\n apply (rule arg_cong [where f = \"\\n. 2 ^ n\"])\n apply (case_tac sz,(simp add: bit_simps)+)\n done\n\nlemma createObjects_ccorres_user_data:\n defines \"ko \\ KOUserData\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ range_cover ptr sz (gbits + pageBits) n\n \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ valid_machine_state' \\\n \\ ret_zero ptr (n * 2 ^ (gbits + pageBits)) \\\n \\ pspace_no_overlap' ptr sz \\\n \\ region_is_zero_bytes ptr (n * 2 ^ (gbits + pageBits)) x\n \\ {ptr ..+ n * (2 ^ (gbits + pageBits))} \\ kernel_data_refs = {}\n \\\n (\\\\ksPSpace :=\n foldr (\\addr. data_map_insert addr KOUserData)\n (new_cap_addrs (n * 2^gbits) ptr KOUserData) (ksPSpace \\)\\,\n x\\globals := globals x\\t_hrs_' :=\n hrs_htd_update\n (ptr_retyps_gen (n * 2 ^ gbits) (Ptr ptr :: user_data_C ptr) arr)\n ((t_hrs_' (globals x)))\\ \\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: user_data_C ptr\"\n\n note Kernel_C.user_data_C_size [simp del]\n\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\" and al: \"is_aligned ptr (gbits + pageBits)\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"gbits + pageBits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and vms: \"valid_machine_state' \\\"\n and rzo: \"ret_zero ptr (n * 2 ^ (gbits + pageBits)) \\\"\n and empty: \"region_is_bytes ptr (n * 2 ^ (gbits + pageBits)) x\"\n and zero: \"heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr (n * 2 ^ (gbits + pageBits))\"\n and rc: \"range_cover ptr sz (gbits + pageBits) n\"\n and rc': \"range_cover ptr sz (objBitsKO ko) (n * 2^ gbits)\"\n and kdr: \"{ptr..+n * 2 ^ (gbits + pageBits)} \\ kernel_data_refs = {}\"\n by (auto simp: range_cover.aligned objBits_simps ko_def\n range_cover_rel[where sbit' = pageBits]\n range_cover.sz[where 'a=machine_word_len, folded word_bits_def])\n\n hence al': \"is_aligned ptr (objBitsKO ko)\"\n by (clarsimp dest!: is_aligned_weaken range_cover.aligned)\n\n (* This is a hack *)\n have mko: \"\\dev. makeObjectKO False (Inr object_type.SmallPageObject) = Some ko\"\n by (simp add: makeObjectKO_def ko_def)\n\n from sz have \"3 \\ sz\" by (simp add: objBits_simps pageBits_def ko_def)\n\n hence sz2: \"2 ^ (sz - 3) * 8 = (2 :: nat) ^ sz\"\n apply (subgoal_tac \"(8 :: nat) = 2 ^ 3\")\n apply (erule ssubst)\n apply (subst power_add [symmetric])\n apply (rule arg_cong [where f = \"\\n. 2 ^ n\"])\n apply simp\n apply simp\n done\n\n define big_0s where \"big_0s \\ (replicate (2^pageBits) 0) :: word8 list\"\n\n have \"length big_0s = 4096\" unfolding big_0s_def\n by simp (simp add: bit_simps)\n\n hence i1: \"\\off :: 9 word. index (user_data_C.words_C (from_bytes big_0s)) (unat off) = 0\"\n apply (simp add: from_bytes_def)\n apply (simp add: typ_info_simps user_data_C_tag_def)\n apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def align_td_array' size_td_array size_of_def\n cong: if_cong)\n apply (simp add: update_ti_adjust_ti update_ti_t_machine_word_0s\n typ_info_simps update_ti_t_ptr_0s\n ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td\n ti_typ_combine_empty_ti ti_typ_combine_td\n align_of_def padup_def\n final_pad_def size_td_lt_ti_typ_pad_combine Let_def\n align_td_array' size_td_array cong: if_cong)\n apply (subst update_ti_t_array_rep_word0)\n apply (unfold big_0s_def)[1]\n apply (rule arg_cong [where f = \"\\x. replicate x 0\"])\n apply (simp (no_asm) add: size_of_def pageBits_def)\n apply (subst index_foldr_update)\n apply (rule order_less_le_trans [OF unat_lt2p])\n apply simp\n apply simp\n apply simp\n done\n\n have p2dist: \"n * (2::nat) ^ (gbits + pageBits) = n * 2 ^ gbits * 2 ^ pageBits\" (is \"?lhs = ?rhs\")\n by (simp add:monoid_mult_class.power_add)\n\n have nca: \"\\x p (off :: 9 word). \\ p \\ set (new_cap_addrs (n*2^gbits) ptr KOUserData); x < 8 \\\n \\ p + ucast off * 8 + x \\ {ptr..+ n * 2 ^ (gbits + pageBits) }\"\n using sz\n apply (clarsimp simp: new_cap_addrs_def objBits_simps shiftl_t2n intvl_def)\n apply (rename_tac x off pa)\n apply (rule_tac x = \"2 ^ pageBits * pa + unat off * 8 + unat x\" in exI)\n apply (simp add: ucast_nat_def power_add)\n apply (subst mult.commute, subst add.assoc)\n apply (rule_tac y = \"(pa + 1) * 2 ^ pageBits \" in less_le_trans)\n apply (simp add:word_less_nat_alt)\n apply (rule_tac y=\"unat off * 8 + 8\" in less_le_trans)\n apply simp\n apply (simp add:pageBits_def)\n apply (cut_tac x = off in unat_lt2p)\n apply simp\n apply (subst mult.assoc[symmetric])\n apply (rule mult_right_mono)\n apply simp+\n done\n\n have nca_neg: \"\\x p (off :: 9 word).\n \\x < 4; {p..+2 ^ objBitsKO KOUserData } \\ {ptr..ptr + (of_nat n * 2 ^ (gbits + pageBits) - 1)} = {}\\\n \\ p + ucast off * 8 + x \\ {ptr..+n * 2 ^ (gbits + pageBits)}\"\n apply (case_tac \"n = 0\")\n apply simp\n apply (subst range_cover_intvl[OF rc])\n apply simp\n apply (subgoal_tac \" p + ucast off * 8 + x \\ {p..+2 ^ objBitsKO KOUserData}\")\n apply blast\n apply (clarsimp simp:intvl_def)\n apply (rule_tac x = \"unat off * 8 + unat x\" in exI)\n apply (simp add: ucast_nat_def)\n apply (rule nat_add_offset_less [where n = 3, simplified])\n apply (simp add: word_less_nat_alt)\n apply (rule unat_lt2p)\n apply (simp add: pageBits_def objBits_simps)\n done\n\n have zero_app: \"\\x. x \\ {ptr..+ n * 2 ^ (gbits + pageBits) }\n \\ underlying_memory (ksMachineState \\) x = 0\"\n apply (cases \"n = 0\")\n apply simp\n apply (rule pspace_no_overlap_underlying_zero[OF pno vms])\n apply (erule subsetD[rotated])\n apply (cases \"n = 0\")\n apply simp\n apply (subst range_cover_intvl[OF rc], simp)\n apply (rule order_trans[rotated], erule range_cover_subset'[OF rc])\n apply (simp add: field_simps)\n done\n\n have cud: \"\\p. p \\ set (new_cap_addrs (n * 2^ gbits) ptr KOUserData) \\\n cuser_user_data_relation\n (byte_to_word_heap\n (underlying_memory (ksMachineState \\)) p)\n (from_bytes big_0s)\"\n unfolding cuser_user_data_relation_def\n apply -\n apply (rule allI)\n apply (subst i1)\n apply (simp add: byte_to_word_heap_def Let_def\n zero_app nca nca [where x3 = 0, simplified])\n apply (simp add: word_rcat_bl)\n done\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n have cud2: \"\\xa v y.\n \\ heap_to_user_data\n (\\x. if x \\ set (new_cap_addrs (n*2^gbits) ptr KOUserData)\n then Some KOUserData else ksPSpace \\ x)\n (underlying_memory (ksMachineState \\)) xa =\n Some v; xa \\ set (new_cap_addrs (n*2^gbits) ptr KOUserData);\n heap_to_user_data (ksPSpace \\) (underlying_memory (ksMachineState \\)) xa = Some y \\ \\ y = v\"\n using range_cover_intvl[OF rc]\n by (clarsimp simp add: heap_to_user_data_def Let_def sz2\n byte_to_word_heap_def[abs_def] map_comp_Some_iff projectKOs)\n\n have relrl: \"cmap_relation (heap_to_user_data (ksPSpace \\) (underlying_memory (ksMachineState \\)))\n (cslift x) Ptr cuser_user_data_relation\n \\ cmap_relation\n (heap_to_user_data\n (\\x. if x \\ set (new_cap_addrs (n * 2 ^ gbits) ptr KOUserData)\n then Some KOUserData else ksPSpace \\ x)\n (underlying_memory (ksMachineState \\)))\n (\\y. if y \\ Ptr ` set (new_cap_addrs (n*2^gbits) ptr KOUserData)\n then Some\n (from_bytes (replicate (2 ^ pageBits) 0))\n else cslift x y)\n Ptr cuser_user_data_relation\"\n apply (rule cmap_relationI)\n apply (clarsimp simp: dom_heap_to_user_data cmap_relation_def dom_if image_Un\n projectKO_opt_retyp_same projectKOs)\n apply (case_tac \"xa \\ set (new_cap_addrs (n*2^gbits) ptr KOUserData)\")\n apply (clarsimp simp: heap_to_user_data_def sz2)\n apply (erule cud [unfolded big_0s_def])\n apply (subgoal_tac \"(Ptr xa :: user_data_C ptr) \\ Ptr ` set (new_cap_addrs (n*2^gbits) ptr KOUserData)\")\n apply simp\n apply (erule (1) cmap_relationE2)\n apply (drule (1) cud2)\n apply simp\n apply simp\n apply clarsimp\n done\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n\n have szo: \"size_of TYPE(user_data_C) = 2 ^ objBitsKO ko\" by (simp add: size_of_def objBits_simps archObjSize_def ko_def pageBits_def)\n have szo': \"n * 2 ^ (gbits + pageBits) = n * 2 ^ gbits * size_of TYPE(user_data_C)\" using sz\n apply (subst szo)\n apply (clarsimp simp: power_add[symmetric] objBits_simps ko_def)\n done\n\n have rb': \"region_is_bytes ptr (n * 2 ^ gbits * 2 ^ objBitsKO ko) x\"\n using empty\n by (simp add: mult.commute mult.left_commute power_add objBits_simps ko_def)\n\n note rl' = cslift_ptr_retyp_other_inst[OF rb' rc' szo' szo, simplified]\n\n (* rest is generic *)\n\n note rl = projectKO_opt_retyp_other [OF rc' pal pno,unfolded ko_def]\n note cterl = retype_ctes_helper[OF pal pdst pno al' range_cover.sz(2)[OF rc'] range_cover.sz(1)[OF rc', folded word_bits_def] mko rc']\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n\n have guard:\n \"\\t) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using empty rc' szo\n apply -\n supply image_cong_simp [cong del]\n apply (clarsimp simp: rl' tag_disj_via_td_name cte_C_size ht_rl\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: rl ko_def projectKOs p2dist\n cterl[unfolded ko_def])\n apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard])\n apply (simp add: pageBits_def objBits_simps)\n apply simp\n apply (simp add: pageBits_def objBits_simps)\n apply (cut_tac range_cover.strong_times_64[OF rc], simp_all)[1]\n apply (simp add: p2dist objBits_simps)\n apply (cut_tac zero)\n apply (simp add: pageBits_def power_add field_simps)\n apply (simp add: objBits_simps ptr_add_to_new_cap_addrs[OF szo] ko_def\n cong: if_cong)\n apply (simp add: p2dist[symmetric])\n apply (erule relrl[simplified])\n done\n\n thus ?thesis using rf empty kdr rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name )\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (simp add: tag_disj_via_td_name rl' tcb_C_size h_t_valid_clift_Some_iff)\n apply (clarsimp simp: hrs_htd_update szo'[symmetric])\n apply (simp add:szo hrs_htd_def p2dist objBits_simps ko_def ptr_retyps_htd_safe_neg\n kernel_data_refs_domain_eq_rotate\n rl foldr_upd_app_if [folded data_map_insert_def]\n projectKOs cvariable_array_ptr_retyps\n zero_ranges_ptr_retyps)\n done\nqed\n\nlemma t_hrs_update_hrs_htd_id:\n \"t_hrs_'_update id = id\"\n \"hrs_htd_update id = id\"\n by (simp_all add: fun_eq_iff hrs_htd_update_def)\n\nlemmas clift_array_assertionE\n = clift_array_assertion_imp[where p=\"Ptr q\" and p'=\"Ptr q\" for q,\n OF _ refl _ exI[where x=0], simplified]\n\nlemma copyGlobalMappings_ccorres:\n \"ccorres dc xfdc (page_map_l4_at' pm) (UNIV \\ {s. new_vspace_' s = Ptr pm}) []\n (copyGlobalMappings pm) (Call copyGlobalMappings_'proc)\"\n apply (cinit lift: new_vspace_' simp:)\n apply csymbr\n apply (rule ccorres_pre_gets_x64KSSKIMPML4_ksArchState, rename_tac skimPM)\n apply (rule ccorres_rel_imp[where r=dc, OF _ dc_simp])\n apply (clarsimp simp: whileAnno_def objBits_simps archObjSize_def\n getPML4Index_def bit_simps X64.pptrBase_def mask_def)\n apply csymbr\n apply (rule_tac F=\"\\n s. skimPM = x64KSSKIMPML4 (ksArchState s) \\ page_map_l4_at' pm s\"\n and i=\"0x1FF\"\n in ccorres_mapM_x_while';\n clarsimp simp: word_bits_def)\n apply (rule ccorres_guard_imp2)\n apply (rule ccorres_pre_getObject_pml4e, rename_tac pml4e)\n apply (simp add: storePML4E_def)\n apply (rule_tac P=\"\\s. ko_at' pml4e (x64KSSKIMPML4 (ksArchState s) + 0xFF8) s\n \\ page_map_l4_at' pm s\" and P'=\"\\\\i = 0x1FF\\\"\n in setObject_ccorres_helper)\n apply (rule conseqPre, vcg, clarsimp)\n apply (strengthen array_assertion_shrink_right[where n'=511 and n=512, simplified])\n apply (frule (1) page_map_l4_at'_array_assertion; clarsimp simp: bit_simps)\n apply (frule page_map_l4_pml4e_atI'[where x=\"0x1FF\"]; simp add: bit_simps c_guard_abs_pml4e)\n apply (rule conjI, clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (clarsimp simp: rf_sr_x64KSSKIMPML4)\n apply (rule cmap_relationE1[OF rf_sr_cpml4e_relation], assumption,\n erule_tac ko=ko' in ko_at_projectKO_opt)\n apply (rule cmap_relationE1[OF rf_sr_cpml4e_relation], assumption,\n erule_tac ko=pml4e in ko_at_projectKO_opt)\n apply (clarsimp simp: typ_heap_simps' heap_access_Array_element)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (clarsimp simp: typ_heap_simps update_pml4e_map_tos)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps\n update_pml4e_map_tos update_pml4e_map_to_pml4es\n carray_map_relation_upd_triv)\n subgoal by (erule (2) cmap_relation_updI; simp)\n subgoal by (clarsimp simp: carch_state_relation_def cmachine_state_relation_def\n global_ioport_bitmap_heap_update_tag_disj_simps\n fpu_null_state_heap_update_tag_disj_simps)\n apply simp\n apply (simp add: objBits_simps archObjSize_def)\n apply clarsimp\n apply (rule conseqPre, vcg, clarsimp)\n by clarsimp\n\nlemma getObjectSize_symb:\n \"\\s. \\ \\ {s. t_' s = object_type_from_H newType \\ userObjSize_' s = sz} Call getObjectSize_'proc\n {s'. ret__unsigned_long_' s' = of_nat (getObjectSize newType (unat sz))}\"\n apply (rule allI, rule conseqPre, vcg)\n apply (clarsimp simp: nAPIObjects_def Kernel_C_defs framesize_to_H_def)\n apply (case_tac newType)\n apply (simp_all add: object_type_from_H_def Kernel_C_defs\n X86_SmallPage_def X86_LargePage_def X64_HugePage_def\n APIType_capBits_def objBits_simps')\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (simp_all add: object_type_from_H_def Kernel_C_defs\n X86_SmallPage_def X86_LargePage_def X64_HugePage_def\n APIType_capBits_def objBits_simps' bit_simps)\n apply unat_arith\n done\n\n(* If we only change local variables on the C side, nothing need be done on the abstract side. *)\nlemma ccorres_only_change_locals:\n \"\\ \\s. \\ \\ {s} C {t. globals s = globals t} \\ \\ ccorresG rf_sr \\ dc xfdc \\ UNIV hs (return x) C\"\n apply (rule ccorres_from_vcg)\n apply (clarsimp simp: return_def)\n apply (clarsimp simp: rf_sr_def)\n apply (rule hoare_complete)\n apply (clarsimp simp: HoarePartialDef.valid_def)\n apply (erule_tac x=x in meta_allE)\n apply (drule hoare_sound)\n apply (clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n apply auto\n done\n\nlemmas upt_enum_offset_trivial = upt_enum_offset_trivial[where 'a=64, folded word_bits_def]\n\nlemma getObjectSize_max_size:\n \"\\ newType = APIObjectType apiobject_type.Untyped \\ x < 64;\n newType = APIObjectType apiobject_type.CapTableObject \\ x < 59 \\ \\ getObjectSize newType x < word_bits\"\n apply (clarsimp simp only: getObjectSize_def apiGetObjectSize_def word_bits_def\n split: X64_H.object_type.splits apiobject_type.splits)\n apply (clarsimp simp: tcbBlockSizeBits_def epSizeBits_def ntfnSizeBits_def cteSizeBits_def\n bit_simps)\n done\n\nlemma getObjectSize_min_size:\n \"\\ newType = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ x;\n newType = APIObjectType apiobject_type.CapTableObject \\ 2 \\ x \\ \\\n 4 \\ getObjectSize newType x\"\n apply (clarsimp simp only: getObjectSize_def apiGetObjectSize_def word_bits_def\n split: X64_H.object_type.splits apiobject_type.splits)\n apply (clarsimp simp: tcbBlockSizeBits_def epSizeBits_def ntfnSizeBits_def cteSizeBits_def\n bit_simps untypedBits_defs)\n done\n\n(*\n * Assuming \"placeNewObject\" doesn't fail, it is equivalent\n * to placing a number of objects into the PSpace.\n *)\nlemma placeNewObject_eq:\n notes option.case_cong_weak [cong]\n shows\n \"\\ groupSizeBits < word_bits; is_aligned ptr (groupSizeBits + objBitsKO (injectKOS object));\n no_fail ((=) s) (placeNewObject ptr object groupSizeBits) \\ \\\n ((), (s\\ksPSpace := foldr (\\addr. data_map_insert addr (injectKOS object)) (new_cap_addrs (2 ^ groupSizeBits) ptr (injectKOS object)) (ksPSpace s)\\))\n \\ fst (placeNewObject ptr object groupSizeBits s)\"\n apply (clarsimp simp: placeNewObject_def placeNewObject'_def)\n apply (clarsimp simp: split_def field_simps split del: if_split)\n apply (clarsimp simp: no_fail_def)\n apply (subst lookupAround2_pspace_no)\n apply assumption\n apply (subst (asm) lookupAround2_pspace_no)\n apply assumption\n apply (clarsimp simp add: in_monad' split_def bind_assoc field_simps\n snd_bind ball_to_all unless_def split: option.splits if_split_asm)\n apply (clarsimp simp: data_map_insert_def new_cap_addrs_def)\n apply (subst upto_enum_red2)\n apply (fold word_bits_def, assumption)\n apply (clarsimp simp: field_simps shiftl_t2n power_add mult.commute mult.left_commute\n cong: foldr_cong map_cong)\n done\n\nlemma globals_list_distinct_rf_sr:\n \"\\ (s, s') \\ rf_sr; S \\ kernel_data_refs = {} \\\n \\ globals_list_distinct S symbol_table globals_list\"\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (erule globals_list_distinct_subset)\n apply blast\n done\n\nlemma rf_sr_htd_safe:\n \"(s, s') \\ rf_sr \\ htd_safe domain (hrs_htd (t_hrs_' (globals s')))\"\n by (simp add: rf_sr_def cstate_relation_def Let_def)\n\nlemma region_actually_is_bytes_dom_s:\n \"region_actually_is_bytes' ptr len htd\n \\ S \\ {ptr ..+ len}\n \\ S \\ {SIndexVal, SIndexTyp 0} \\ dom_s htd\"\n apply (clarsimp simp: region_actually_is_bytes'_def dom_s_def)\n apply fastforce\n done\n\nlemma typ_region_bytes_actually_is_bytes:\n \"htd = typ_region_bytes ptr bits htd'\n \\ region_actually_is_bytes' ptr (2 ^ bits) htd\"\n by (clarsimp simp: region_actually_is_bytes'_def typ_region_bytes_def)\n\n(* FIXME: need a way to avoid overruling the parser on this, it's ugly *)\nlemma memzero_modifies:\n \"\\\\. \\\\\\<^bsub>/UNIV\\<^esub> {\\} Call memzero_'proc {t. t may_only_modify_globals \\ in [t_hrs]}\"\n apply (rule allI, rule conseqPre)\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (tactic \\HoarePackage.vcg_tac \"_modifies\" \"false\" [] @{context} 1\\)\n apply (clarsimp simp: mex_def meq_def simp del: split_paired_Ex)\n apply (intro exI globals.equality, simp_all)\n done\n\nlemma ghost_assertion_size_logic_no_unat:\n \"sz \\ gsMaxObjectSize s\n \\ (s, \\) \\ rf_sr\n \\ gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals \\)) = 0 \\\n of_nat sz \\ gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals \\))\"\n apply (rule ghost_assertion_size_logic'[rotated])\n apply (simp add: rf_sr_def)\n apply (simp add: unat_of_nat)\n done\n\nlemma ccorres_placeNewObject_endpoint:\n \"ko = (makeObject :: endpoint)\n \\ ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct'\n and pspace_no_overlap' regionBase (objBits ko)\n and ret_zero regionBase (2 ^ objBits ko)\n and (\\s. 2 ^ (objBits ko) \\ gsMaxObjectSize s)\n and K (regionBase \\ 0 \\ range_cover regionBase (objBits ko) (objBits ko) 1\n \\ {regionBase..+ 2 ^ (objBits ko)} \\ kernel_data_refs = {}))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ objBits ko) s})\n hs\n (placeNewObject regionBase ko 0)\n (global_htd_update (\\_. (ptr_retyp (ep_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n objBits_simps'\n ptr_retyp_htd_safe_neg)\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def)\n apply (clarsimp simp: new_cap_addrs_def)\n apply (cut_tac createObjects_ccorres_ep [where ptr=regionBase and n=\"1\" and sz=\"objBitsKO (KOEndpoint makeObject)\"])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def)+\n apply (clarsimp simp: split_def Let_def\n Fun.comp_def rf_sr_def new_cap_addrs_def\n region_actually_is_bytes ptr_retyps_gen_def\n objBits_simps\n elim!: rsubst[where P=\"cstate_relation s'\" for s'])\n apply (clarsimp simp: word_bits_conv)\n apply (clarsimp simp: range_cover.aligned objBits_simps)\n apply (clarsimp simp: no_fail_def)\n done\n\nlemma ccorres_placeNewObject_notification:\n \"ko = (makeObject :: notification)\n \\ ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct'\n and pspace_no_overlap' regionBase (objBits ko)\n and ret_zero regionBase (2 ^ objBits ko)\n and (\\s. 2 ^ (objBits ko) \\ gsMaxObjectSize s)\n and K (regionBase \\ 0 \\ range_cover regionBase (objBits ko) (objBits ko) 1\n \\ {regionBase..+ 2 ^ (objBits ko)} \\ kernel_data_refs = {}))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ objBits ko) s})\n hs\n (placeNewObject regionBase ko 0)\n (global_htd_update (\\_. (ptr_retyp (ntfn_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate objBits_simps'\n ptr_retyp_htd_safe_neg)\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def)\n apply (clarsimp simp: new_cap_addrs_def)\n apply (cut_tac createObjects_ccorres_ntfn [where ptr=regionBase and n=\"1\" and sz=\"objBitsKO (KONotification makeObject)\"])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def)+\n apply (clarsimp simp: split_def Let_def\n Fun.comp_def rf_sr_def new_cap_addrs_def\n region_actually_is_bytes ptr_retyps_gen_def\n objBits_simps'\n elim!: rsubst[where P=\"cstate_relation s'\" for s'])\n apply (clarsimp simp: word_bits_conv)\n apply (clarsimp simp: range_cover.aligned objBits_simps)\n apply (clarsimp simp: no_fail_def)\n done\n\n\nlemma htd_update_list_dom_better [rule_format]:\n \"(\\p d. dom_s (htd_update_list p xs d) =\n (dom_s d) \\ dom_tll p xs)\"\n apply(induct_tac xs)\n apply simp\n apply clarsimp\n apply(auto split: if_split_asm)\n apply(erule notE)\n apply(clarsimp simp: dom_s_def)\n apply(case_tac y)\n apply clarsimp+\n apply(clarsimp simp: dom_s_def)\n done\n\nlemma ptr_array_retyps_htd_safe_neg:\n \"\\ htd_safe D htd; {ptr_val ptr ..+ n * size_of TYPE('a :: mem_type)} \\ D' = {}; -D \\ D' \\\n \\ htd_safe D (ptr_arr_retyps n (ptr :: 'a ptr) htd)\"\n apply (simp add: htd_safe_def ptr_arr_retyps_def htd_update_list_dom_better)\n apply (auto simp: dom_tll_def intvl_def)\n done\n\nlemmas ptr_array_retyps_htd_safe_neg' = ptr_array_retyps_htd_safe_neg[OF _ _ subset_refl]\n\nlemma ccorres_placeNewObject_captable:\n \"ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSize + 5)\n and (\\s. 2 ^ (unat userSize + 5) \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ (unat userSize + 5))\n and K (regionBase \\ 0 \\ range_cover regionBase (unat userSize + 5) (unat userSize + 5) 1\n \\ ({regionBase..+2 ^ (unat userSize + 5)} \\ kernel_data_refs = {})))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ (unat userSize + 5)) s})\n hs\n (placeNewObject regionBase (makeObject :: cte) (unat (userSize::machine_word)))\n (global_htd_update (\\_. (ptr_arr_retyps (2 ^ (unat userSize)) (cte_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_array_retyps_htd_safe_neg\n size_of_def power_add)\n apply (frule range_cover_rel[where sbit' = 5])\n apply simp\n apply simp\n apply (frule range_cover.unat_of_nat_shift[where gbits = 5 , OF _ le_refl le_refl ])\n apply (subgoal_tac \"region_is_bytes regionBase (2 ^ (unat userSize + 5)) x\")\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def new_cap_addrs_def)\n apply (cut_tac createObjects_ccorres_cte [where ptr=regionBase and n=\"2 ^ unat userSize\" and sz=\"unat userSize + objBitsKO (KOCTE makeObject)\"])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def cteSizeBits_def)+\n apply (clarsimp simp: split_def objBitsKO_def\n Fun.comp_def rf_sr_def split_def Let_def cteSizeBits_def\n new_cap_addrs_def field_simps power_add ptr_retyps_gen_def\n elim!: rsubst[where P=\"cstate_relation s'\" for s'])\n apply (clarsimp simp: word_bits_conv range_cover_def)\n apply (clarsimp simp: objBitsKO_def objBits_simps' range_cover.aligned)\n apply (clarsimp simp: no_fail_def)\n apply (simp add: region_actually_is_bytes)\n done\n\nlemma rf_sr_helper:\n \"\\a b P X. ((a, globals_update P (b\\tcb_' := X\\)) \\ rf_sr) = ((a, globals_update P b) \\ rf_sr)\"\n apply (clarsimp simp: rf_sr_def)\n done\n\ndeclare replicate_numeral [simp del]\n\ndefinition\n array_updates_rev :: \"(nat \\ 'a) list \\ 'a::c_type['b::finite] \\ 'a['b]\"\nwhere\n \"array_updates_rev \\ foldr (\\(i,v) a. Arrays.update a i v)\"\n\nlemma array_updates_rev:\n \"array_updates_rev upds arr = array_updates arr (fold (#) upds [])\"\n by (auto simp: array_updates_rev_def array_updates_def rev_conv_fold[symmetric]\n foldl_conv_foldr\n intro: foldr_cong[OF refl refl])\n\nlemma array_updates_rev':\n \"array_updates arr upds = array_updates_rev (fold (#) upds []) arr\"\n by (auto simp: array_updates_rev_def array_updates_def rev_conv_fold[symmetric]\n foldl_conv_foldr\n intro: foldr_cong[OF refl refl])\n\nlemma Arrays_udpate_array_updates_rev:\n \"Arrays.update a i v = array_updates_rev [(i,v)] a\"\n by (simp add: array_updates_rev_def)\n\nlemma array_updates_rev_app:\n \"array_updates_rev upds1 (array_updates_rev upds2 a) = array_updates_rev (upds1 @ upds2) a\"\n by (simp add: array_updates_rev_def)\n\nlemma Mode_initContext_spec':\n defines\n \"Mode_initContext_regs \\\n [(unat Kernel_C.RAX, 0), (unat Kernel_C.RBX, 0), (unat Kernel_C.RCX, 0), (unat Kernel_C.RDX, 0),\n (unat Kernel_C.RSI, 0), (unat Kernel_C.RDI, 0), (unat Kernel_C.RBP, 0), (unat Kernel_C.R8 , 0),\n (unat Kernel_C.R9 , 0), (unat Kernel_C.R10, 0), (unat Kernel_C.R11, 0), (unat Kernel_C.R12, 0),\n (unat Kernel_C.R13, 0), (unat Kernel_C.R14, 0), (unat Kernel_C.R15, 0), (unat Kernel_C.RSP, 0)]\"\n shows\n \"\\s\\<^sub>0. \\ \\\n {t. t = s\\<^sub>0 \\ t \\\\<^sub>c context_' t}\n Call Mode_initContext_'proc\n {t. t = globals_update\n (t_hrs_'_update\n (hrs_mem_update\n (heap_update\n (registers_Ptr &(context_' s\\<^sub>0\\[''registers_C'']))\n (array_updates (h_val (hrs_mem (t_hrs_' (globals s\\<^sub>0)))\n (registers_Ptr &(context_' s\\<^sub>0\\[''registers_C''])))\n Mode_initContext_regs)))) s\\<^sub>0}\"\n unfolding Mode_initContext_regs_def\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (simp add: C_register_defs Arrays_udpate_array_updates_rev)\n apply (rule allI, rule conseqPre)\n apply (rule hoarep.Catch[rotated], vcg)\n apply (rule conseqPost[where A'=\"{}\" and Q'=Q and Q=Q for Q, simplified])\n apply (rule hoarep.Seq[rotated]\n | (vcg, clarsimp simp: hrs_mem_update_compose h_val_id packed_heap_update_collapse'\n array_updates_rev_app))+\n by (simp add: array_updates_rev)\n\nlemmas Mode_initContext_spec'' =\n Mode_initContext_spec'[simplified array_updates_rev' C_register_defs, simplified]\n\nlemma Arch_initContext_spec':\n shows\n \"\\s\\<^sub>0. \\ \\\n {t. t = s\\<^sub>0 \\ t \\\\<^sub>c context_' t \\ s\\<^sub>0 \\\\<^sub>c fpu_state_Ptr (symbol_table ''x86KSnullFpuState'')}\n Call Arch_initContext_'proc\n {t. t = globals_update\n (t_hrs_'_update\n (hrs_mem_update\n (heap_update (fpu_state_Ptr &(context_' s\\<^sub>0\\[''fpuState_C'']))\n (h_val (hrs_mem (t_hrs_' (globals s\\<^sub>0)))\n (fpu_state_Ptr (symbol_table ''x86KSnullFpuState''))) \\\n heap_update (registers_Ptr &(context_' s\\<^sub>0\\[''registers_C'']))\n (array_updates (h_val (hrs_mem (t_hrs_' (globals s\\<^sub>0)))\n (registers_Ptr &(context_' s\\<^sub>0\\[''registers_C''])))\n initContext_registers)))) s\\<^sub>0}\"\n unfolding initContext_registers_def\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (simp add: C_register_defs Arrays_udpate_array_updates_rev)\n apply (rule allI, rule conseqPre)\n apply (rule hoarep.Catch[rotated], vcg)\n apply (rule conseqPost[where A'=\"{}\" and Q'=Q and Q=Q for Q, simplified])\n apply (rule hoarep.Seq[rotated], vcg)\n apply (rule hoarep.Seq[rotated]\n | (vcg exspec=Mode_initContext_spec'',\n clarsimp simp: hrs_mem_update_compose h_val_id packed_heap_update_collapse o_def\n array_updates_rev_app))+\n apply (auto simp: h_val_heap_same_hrs_mem_update_typ_disj[OF h_t_valid_c_guard_field _ tag_disj_via_td_name]\n export_tag_adjust_ti typ_uinfo_t_def array_updates_rev\n cong: Kernel_C.globals.unfold_congs StateSpace.state.unfold_congs)\n done\n\nlemma rf_sr_fpu_null_relation:\n \"(s,s') \\ rf_sr \\ fpu_null_state_relation (t_hrs_' (globals s'))\"\n by (simp add: rf_sr_def cstate_relation_def Let_def carch_state_relation_def)\n\nlemma ccorres_placeNewObject_tcb:\n \"ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and valid_queues and (\\s. sym_refs (state_refs_of' s))\n and (\\s. 2 ^ tcbBlockSizeBits \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ tcbBlockSizeBits)\n and K (regionBase \\ 0 \\ range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits 1\n \\ {regionBase..+2^tcbBlockSizeBits} \\ kernel_data_refs = {}))\n ({s. region_actually_is_zero_bytes regionBase (2^tcbBlockSizeBits) s})\n hs\n (placeNewObject regionBase (makeObject :: tcb) 0)\n (\\tcb :== tcb_Ptr (regionBase + 0x400);;\n (global_htd_update (\\s. ptr_retyp (Ptr (ptr_val (tcb_' s) - ctcb_offset) :: (cte_C[5]) ptr)\n \\ ptr_retyp (tcb_' s)));;\n (Guard C_Guard \\hrs_htd \\t_hrs \\\\<^sub>t \\tcb\\\n (call (\\s. s\\context_' := Ptr &((Ptr &(tcb_' s\\[''tcbArch_C'']) :: arch_tcb_C ptr)\\[''tcbContext_C''])\\) Arch_initContext_'proc (\\s t. s\\globals := globals t\\) (\\s' s''. Basic (\\s. s))));;\n (Guard C_Guard \\hrs_htd \\t_hrs \\\\<^sub>t \\tcb\\\n (Basic (\\s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (Ptr &((tcb_' s)\\[''tcbTimeSlice_C''])) (5::machine_word)))) s))))\"\n apply (simp add: placeNewObject_eq)\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre, vcg exspec=Arch_initContext_spec')\n apply (clarsimp simp: rf_sr_htd_safe ctcb_offset_defs cong: conj_cong)\n apply (subgoal_tac \"c_guard (tcb_Ptr (regionBase + 0x400))\")\n prefer 2\n apply (rule c_guard_tcb;\n clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs range_cover.aligned)\n apply (subgoal_tac \"hrs_htd (hrs_htd_update (ptr_retyp (Ptr regionBase :: (cte_C[5]) ptr)\n \\ ptr_retyp (tcb_Ptr (regionBase + 0x400)))\n (t_hrs_' (globals x))) \\\\<^sub>t tcb_Ptr (regionBase + 0x400)\")\n prefer 2\n apply (clarsimp simp: hrs_htd_update)\n apply (rule h_t_valid_ptr_retyps_gen_disjoint\n [where n=1 and arr=False, unfolded ptr_retyps_gen_def, simplified])\n apply (rule ptr_retyp_h_t_valid)\n apply simp\n apply (rule tcb_ptr_orth_cte_ptrs')\n apply (simp add: o_def)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate)\n apply (intro ptr_retyps_htd_safe_neg ptr_retyp_htd_safe_neg, simp_all add: size_of_def)[1]\n apply (erule disjoint_subset[rotated])\n apply (rule intvl_sub_offset, simp add: objBits_defs)\n apply (erule disjoint_subset[rotated],\n simp add: intvl_start_le size_td_array cte_C_size objBits_defs)\n apply (clarsimp simp: hrs_htd_update)\n apply (rule h_t_valid_field[rotated], simp+)+\n apply (clarsimp simp: hrs_htd_update)\n apply (subgoal_tac \"{regionBase + 0x400 ..+ size_of TYPE(tcb_C)} \\ {regionBase ..+ 2 ^ tcbBlockSizeBits}\")\n apply (subgoal_tac \"{regionBase ..+ 5*size_of TYPE(cte_C)} \\ {regionBase ..+ 2 ^ tcbBlockSizeBits}\")\n apply (intro h_t_valid_ptr_retyps_gen_disjoint\n [where n=1 and arr=False, unfolded ptr_retyps_gen_def, simplified];\n clarsimp simp: rf_sr_def cstate_relation_def Let_def carch_state_relation_def\n fpu_null_state_relation_def2 objBits_defs\n elim!: disjoint_subset disjoint_subset2; blast)\n apply (rule intvl_sub_offset intvl_start_le; clarsimp simp: objBits_defs cte_C_size)+\n apply (rule bexI[OF _ placeNewObject_eq];\n clarsimp simp: hrs_htd_update word_bits_def no_fail_def objBitsKO_def\n range_cover.aligned new_cap_addrs_def)\n apply (cut_tac \\=\\ and x=x and ks=\"ksPSpace \\\" and p=\"tcb_Ptr (regionBase + ctcb_offset)\"\n in cnc_tcb_helper;\n clarsimp simp: ctcb_ptr_to_tcb_ptr_def objBitsKO_def range_cover.aligned)\n apply (frule region_actually_is_bytes; clarsimp simp: region_is_bytes'_def)\n apply (clarsimp simp: hrs_mem_def)\n apply (frule rf_sr_fpu_null_relation; simp add: fpu_null_state_relation_def2)\n by (clarsimp simp: ctcb_offset_defs rf_sr_def ptr_retyps_gen_def heap_updates_def\n hrs_mem_update_compose\n cong: Kernel_C.globals.unfold_congs StateSpace.state.unfold_congs\n kernel_state.unfold_congs)\n\nlemma placeNewObject_pte:\n \"ccorresG rf_sr \\ dc xfdc\n ( valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase pageBits\n and (\\s. 2 ^ pageBits \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ pageBits)\n and K (regionBase \\ 0 \\ range_cover regionBase pageBits pageBits 1\n \\ ({regionBase..+2 ^ pageBits} \\ kernel_data_refs = {})\n ))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ pageBits) s})\n hs\n (placeNewObject regionBase (makeObject :: pte) ptTranslationBits)\n (global_htd_update (\\_. (ptr_retyp (pt_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyp_htd_safe_neg bit_simps)\n apply (frule range_cover_rel[where sbit' = 3])\n apply ((simp add: pageBits_def)+)[3]\n apply (frule range_cover.unat_of_nat_shift[where gbits = 3 ])\n apply (simp add: pageBits_def)+\n apply (rule le_refl)\n apply (subgoal_tac \"region_is_bytes regionBase 4096 x\")\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def new_cap_addrs_def)\n apply (cut_tac s=\\ in createObjects_ccorres_pte [where ptr=regionBase and sz=pageBits])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def)+\n apply (clarsimp simp: split_def objBitsKO_def archObjSize_def\n Fun.comp_def rf_sr_def split_def Let_def ptr_retyps_gen_def\n new_cap_addrs_def field_simps power_add\n cong: globals.unfold_congs)\n apply (simp add: Int_ac bit_simps)\n apply (clarsimp simp: word_bits_conv range_cover_def archObjSize_def bit_simps)\n apply (clarsimp simp: objBitsKO_def range_cover.aligned archObjSize_def bit_simps)\n apply (clarsimp simp: no_fail_def)\n apply (simp add: region_actually_is_bytes bit_simps)\n done\n\nlemma placeNewObject_pde:\n \"ccorresG rf_sr \\ dc xfdc\n ( valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase pdBits\n and (\\s. 2 ^ pdBits \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ pdBits)\n and K (regionBase \\ 0 \\ range_cover regionBase pdBits pdBits 1\n \\ ({regionBase..+2 ^ pdBits} \\ kernel_data_refs = {})\n ))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ pdBits) s})\n hs\n (placeNewObject regionBase (makeObject :: pde) ptTranslationBits)\n (global_htd_update (\\_. (ptr_retyp (pd_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyp_htd_safe_neg bit_simps)\n apply (frule range_cover_rel[where sbit' = 3])\n apply ((simp add: bit_simps)+)[3]\n apply (frule range_cover.unat_of_nat_shift[where gbits = 3 ])\n apply (simp add: bit_simps)+\n apply (rule le_refl)\n apply (subgoal_tac \"region_is_bytes regionBase 4096 x\")\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def new_cap_addrs_def)\n apply (cut_tac s=\\ in createObjects_ccorres_pde [where ptr=regionBase and sz=pdBits])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def)+\n apply (clarsimp simp: split_def objBitsKO_def archObjSize_def\n Fun.comp_def rf_sr_def split_def Let_def ptr_retyps_gen_def\n new_cap_addrs_def field_simps power_add\n cong: globals.unfold_congs)\n apply (simp add: Int_ac bit_simps)\n apply (clarsimp simp: word_bits_conv range_cover_def archObjSize_def bit_simps)\n apply (clarsimp simp: objBitsKO_def range_cover.aligned archObjSize_def bit_simps)\n apply (clarsimp simp: no_fail_def)\n apply (simp add: region_actually_is_bytes bit_simps)\n done\n\nlemma placeNewObject_pdpte:\n \"ccorresG rf_sr \\ dc xfdc\n ( valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase pdptBits\n and (\\s. 2 ^ pdptBits \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ pdptBits)\n and K (regionBase \\ 0 \\ range_cover regionBase pdptBits pdptBits 1\n \\ ({regionBase..+2 ^ pdptBits} \\ kernel_data_refs = {})\n ))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ pdptBits) s})\n hs\n (placeNewObject regionBase (makeObject :: pdpte) ptTranslationBits)\n (global_htd_update (\\_. (ptr_retyp (pdpt_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyp_htd_safe_neg bit_simps)\n apply (frule range_cover_rel[where sbit' = 3])\n apply ((simp add: bit_simps)+)[3]\n apply (frule range_cover.unat_of_nat_shift[where gbits = 3 ])\n apply (simp add: bit_simps)+\n apply (rule le_refl)\n apply (subgoal_tac \"region_is_bytes regionBase 4096 x\")\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def new_cap_addrs_def)\n apply (cut_tac s=\\ in createObjects_ccorres_pdpte [where ptr=regionBase and sz=pdptBits])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def)+\n apply (clarsimp simp: split_def objBitsKO_def archObjSize_def\n Fun.comp_def rf_sr_def split_def Let_def ptr_retyps_gen_def\n new_cap_addrs_def field_simps power_add\n cong: globals.unfold_congs)\n apply (simp add: Int_ac bit_simps)\n apply (clarsimp simp: word_bits_conv range_cover_def archObjSize_def bit_simps)\n apply (clarsimp simp: objBitsKO_def range_cover.aligned archObjSize_def bit_simps)\n apply (clarsimp simp: no_fail_def)\n apply (simp add: region_actually_is_bytes bit_simps)\n done\n\nlemma placeNewObject_pml4e:\n \"ccorresG rf_sr \\ dc xfdc\n (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase pml4Bits\n and (\\s. 2 ^ pml4Bits \\ gsMaxObjectSize s)\n and ret_zero regionBase (2 ^ pml4Bits)\n and K (regionBase \\ 0 \\ range_cover regionBase pml4Bits pml4Bits 1\n \\ ({regionBase..+2 ^ pml4Bits}\n \\ kernel_data_refs = {})\n ))\n ({s. region_actually_is_zero_bytes regionBase (2 ^ pml4Bits) s})\n hs\n (placeNewObject regionBase (makeObject :: pml4e) ptTranslationBits)\n (global_htd_update (\\_. (ptr_retyp (pml4_Ptr regionBase))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply clarsimp\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyp_htd_safe_neg bit_simps)\n apply (frule range_cover_rel[where sbit' = 3])\n apply (simp add: bit_simps)+\n apply (frule range_cover.unat_of_nat_shift[where gbits = 3 ])\n apply simp+\n apply (rule le_refl)\n\n apply (subgoal_tac \"region_is_bytes regionBase 4096 x\")\n apply (rule bexI [OF _ placeNewObject_eq])\n apply (clarsimp simp: split_def new_cap_addrs_def)\n apply (cut_tac s=\\ in createObjects_ccorres_pml4e [where ptr=regionBase and sz=pml4Bits])\n apply (erule_tac x=\\ in allE, erule_tac x=x in allE)\n apply (clarsimp elim!:is_aligned_weaken simp: objBitsKO_def word_bits_def bit_simps)+\n apply (clarsimp simp: split_def objBitsKO_def archObjSize_def\n Fun.comp_def rf_sr_def Let_def ptr_retyps_gen_def\n new_cap_addrs_def field_simps power_add\n cong: globals.unfold_congs)\n apply (simp add: Int_ac bit_simps)\n apply (clarsimp simp: word_bits_conv range_cover_def archObjSize_def)\n apply (clarsimp simp: objBitsKO_def range_cover.aligned archObjSize_def bit_simps)\n apply (clarsimp simp: no_fail_def)\n apply (simp add: region_actually_is_bytes)\n done\n\nend\n\nlemma dom_disj_union:\n \"dom (\\x. if P x \\ Q x then Some (G x) else None) = dom (\\x. if P x then Some (G x) else None)\n \\ dom (\\x. if Q x then Some (G x) else None)\"\n by (auto split:if_splits)\n\ncontext kernel_m begin\n\nlemma createObjects_ccorres_user_data_device:\n defines \"ko \\ KOUserDataDevice\"\n shows \"\\\\ x. (\\, x) \\ rf_sr \\ range_cover ptr sz (gbits + pageBits) n\n \\ ptr \\ 0\n \\ pspace_aligned' \\ \\ pspace_distinct' \\\n \\ pspace_no_overlap' ptr sz \\\n \\ ret_zero ptr (n * 2 ^ (gbits + pageBits)) \\\n \\ region_is_bytes ptr (n * 2 ^ (gbits + pageBits)) x\n \\ {ptr ..+ n * (2 ^ (gbits + pageBits))} \\ kernel_data_refs = {}\n \\\n (\\\\ksPSpace :=\n foldr (\\addr. data_map_insert addr KOUserDataDevice) (new_cap_addrs (n * 2^gbits) ptr KOUserDataDevice) (ksPSpace \\)\\,\n x\\globals := globals x\\t_hrs_' :=\n hrs_htd_update\n (ptr_retyps_gen (n * 2 ^ gbits) (Ptr ptr :: user_data_device_C ptr) arr)\n (t_hrs_' (globals x))\\ \\) \\ rf_sr\"\n (is \"\\\\ x. ?P \\ x \\\n (\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\")\nproof (intro impI allI)\n fix \\ x\n let ?thesis = \"(\\\\ksPSpace := ?ks \\\\, x\\globals := globals x\\t_hrs_' := ?ks' x\\\\) \\ rf_sr\"\n let ?ks = \"?ks \\\"\n let ?ks' = \"?ks' x\"\n let ?ptr = \"Ptr ptr :: user_data_device_C ptr\"\n\n note Kernel_C.user_data_C_size [simp del]\n\n assume \"?P \\ x\"\n hence rf: \"(\\, x) \\ rf_sr\" and al: \"is_aligned ptr (gbits + pageBits)\"\n and ptr0: \"ptr \\ 0\"\n and sz: \"gbits + pageBits \\ sz\"\n and szb: \"sz < word_bits\"\n and pal: \"pspace_aligned' \\\" and pdst: \"pspace_distinct' \\\"\n and pno: \"pspace_no_overlap' ptr sz \\\"\n and rzo: \"ret_zero ptr (n * 2 ^ (gbits + pageBits)) \\\"\n and empty: \"region_is_bytes ptr (n * 2 ^ (gbits + pageBits)) x\"\n and rc: \"range_cover ptr sz (gbits + pageBits) n\"\n and rc': \"range_cover ptr sz (objBitsKO ko) (n * 2^ gbits)\"\n and kdr: \"{ptr..+n * 2 ^ (gbits + pageBits)} \\ kernel_data_refs = {}\"\n by (auto simp: range_cover.aligned objBits_simps ko_def\n range_cover_rel[where sbit' = pageBits]\n range_cover.sz[where 'a=machine_word_len, folded word_bits_def])\n\n\n hence al': \"is_aligned ptr (objBitsKO ko)\"\n by (clarsimp dest!:is_aligned_weaken range_cover.aligned)\n\n note range_cover.no_overflow_n[OF rc']\n hence sz_word_bits:\n \"n * 2 ^ gbits * size_of TYPE(user_data_device_C) < 2 ^ word_bits\"\n by (simp add:word_bits_def objBits_simps ko_def pageBits_def)\n\n (* This is a hack *)\n have mko: \"\\dev. makeObjectKO True (Inr object_type.SmallPageObject) = Some ko\"\n by (simp add: makeObjectKO_def ko_def)\n\n from sz have \"3 \\ sz\" by (simp add: objBits_simps pageBits_def ko_def)\n\n hence sz2: \"2 ^ (sz - 3) * 8 = (2 :: nat) ^ sz\"\n apply (subgoal_tac \"(8 :: nat) = 2 ^ 3\")\n apply (erule ssubst)\n apply (subst power_add [symmetric])\n apply (rule arg_cong [where f = \"\\n. 2 ^ n\"])\n apply simp\n apply simp\n done\n\n have p2dist: \"n * (2::nat) ^ (gbits + pageBits) = n * 2 ^ gbits * 2 ^ pageBits\" (is \"?lhs = ?rhs\")\n by (simp add:monoid_mult_class.power_add)\n\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n\n (* /obj specific *)\n\n (* s/obj/obj'/ *)\n\n have szo: \"size_of TYPE(user_data_device_C) = 2 ^ objBitsKO ko\"\n by (simp add: size_of_def objBits_simps archObjSize_def ko_def pageBits_def)\n have szo': \"n * 2 ^ (gbits + pageBits) = n * 2 ^ gbits * size_of TYPE(user_data_device_C)\" using sz\n apply (subst szo)\n apply (clarsimp simp: power_add[symmetric] objBits_simps ko_def)\n done\n\n have rb': \"region_is_bytes ptr (n * 2 ^ gbits * 2 ^ objBitsKO ko) x\"\n using empty\n by (simp add: mult.commute mult.left_commute power_add objBits_simps ko_def)\n\n from rb' have rbu: \"region_is_bytes ptr (n * 2 ^ gbits * size_of TYPE(user_data_device_C)) x\"\n by (simp add:szo[symmetric])\n\n note rl' = clift_ptr_retyps_gen_other[where p = \"Ptr ptr\",simplified, OF rbu sz_word_bits]\n\n (* rest is generic *)\n\n note rl = projectKO_opt_retyp_other [OF rc' pal pno,unfolded ko_def]\n note cterl = retype_ctes_helper[OF pal pdst pno al' range_cover.sz(2)[OF rc'] range_cover.sz(1)[OF rc', folded word_bits_def] mko rc']\n note ht_rl = clift_eq_h_t_valid_eq[OF rl', OF tag_disj_via_td_name, simplified]\n\n have guard:\n \"\\txa v y.\n \\ heap_to_device_data\n (\\x. if x \\ set (new_cap_addrs (n*2^gbits) ptr KOUserDataDevice)\n then Some KOUserData else ksPSpace \\ x)\n (underlying_memory (ksMachineState \\)) xa =\n Some v; xa \\ set (new_cap_addrs (n*2^gbits) ptr KOUserDataDevice);\n heap_to_device_data (ksPSpace \\) (underlying_memory (ksMachineState \\)) xa = Some y \\ \\ y = v\"\n using range_cover_intvl[OF rc]\n by (clarsimp simp add: heap_to_device_data_def Let_def sz2\n byte_to_word_heap_def[abs_def] map_comp_Some_iff projectKOs)\n\n note ptr_retyps_valid = h_t_valid_ptr_retyps_gen_same[OF guard rbu,unfolded addr_card_wb,OF _ sz_word_bits,simplified]\n\n from rf have \"cpspace_relation (ksPSpace \\) (underlying_memory (ksMachineState \\)) (t_hrs_' (globals x))\"\n unfolding rf_sr_def cstate_relation_def by (simp add: Let_def)\n\n hence \"cpspace_relation ?ks (underlying_memory (ksMachineState \\)) ?ks'\"\n unfolding cpspace_relation_def\n using empty rc' szo\n supply if_cong[cong]\n apply -\n apply (clarsimp simp: rl' tag_disj_via_td_name cte_C_size ht_rl\n clift_ptr_retyps_gen_other\n foldr_upd_app_if [folded data_map_insert_def])\n apply (simp add: rl ko_def projectKOs p2dist\n cterl[unfolded ko_def])\n apply (rule cmap_relationI)\n apply (clarsimp simp: dom_heap_to_device_data cmap_relation_def dom_if image_Un\n projectKO_opt_retyp_same projectKOs liftt_if[folded hrs_mem_def hrs_htd_def]\n hrs_htd_update hrs_mem_update ptr_retyps_valid dom_disj_union\n simp flip: ptr_add_to_new_cap_addrs)\n apply (simp add: heap_to_device_data_def cuser_user_data_device_relation_def)\n done (* dont need to track all the device memory *)\n\n thus ?thesis using rf empty kdr rzo\n apply (simp add: rf_sr_def cstate_relation_def Let_def rl' tag_disj_via_td_name )\n apply (simp add: carch_state_relation_def fpu_null_state_relation_def cmachine_state_relation_def)\n apply (simp add: tag_disj_via_td_name rl' tcb_C_size h_t_valid_clift_Some_iff)\n apply (clarsimp simp: hrs_htd_update szo'[symmetric] cvariable_array_ptr_retyps[OF szo] rb')\n apply (subst zero_ranges_ptr_retyps, simp_all only: szo'[symmetric] power_add, simp)\n apply (simp add:szo p2dist objBits_simps ko_def ptr_retyps_htd_safe_neg\n kernel_data_refs_domain_eq_rotate\n rl foldr_upd_app_if [folded data_map_insert_def]\n projectKOs cvariable_array_ptr_retyps)\n apply (subst cvariable_array_ptr_retyps[OF szo])\n apply (simp add: rb' ptr_retyps_htd_safe_neg)+\n apply (erule ptr_retyps_htd_safe_neg; simp add:pageBits_def field_simps)\n done\nqed\n\nlemma placeNewObject_user_data:\n \"ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (pageBits+us)\n and valid_queues and valid_machine_state'\n and ret_zero regionBase (2 ^ (pageBits+us))\n and (\\s. sym_refs (state_refs_of' s))\n and (\\s. 2^(pageBits + us) \\ gsMaxObjectSize s)\n and K (regionBase \\ 0 \\ range_cover regionBase (pageBits + us) (pageBits+us) (Suc 0)\n \\ us < word_bits\n \\ {regionBase..+2^(pageBits + us)} \\ kernel_data_refs = {}))\n ({s. region_actually_is_zero_bytes regionBase (2^(pageBits+us)) s})\n hs\n (placeNewObject regionBase UserData us)\n (global_htd_update (\\s. (ptr_retyps (2^us) (Ptr regionBase :: user_data_C ptr))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply (clarsimp simp:)\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyps_htd_safe_neg[where arr=False, unfolded ptr_retyps_gen_def, simplified]\n size_of_def pageBits_def power_add mult.commute mult.left_commute)\n apply (frule range_cover.unat_of_nat_shift[where gbits = \"pageBits + us\"])\n apply simp\n apply (clarsimp simp:size_of_def power_add pageBits_def\n rf_sr_def cstate_relation_def Let_def field_simps)\n apply blast\n apply (frule range_cover.aligned)\n apply (rule bexI [OF _ placeNewObject_eq], simp_all)\n apply (cut_tac ptr=regionBase and sz=\"pageBits + us\" and gbits=us and arr=False\n in createObjects_ccorres_user_data[rule_format])\n apply (rule conjI, assumption, clarsimp)\n apply (fastforce simp: pageBits_def field_simps region_actually_is_bytes)\n apply (clarsimp elim!: rsubst[where P=\"\\x. (\\, x) \\ rf_sr\" for \\]\n simp: field_simps objBitsKO_def ptr_retyps_gen_def)\n apply (simp add: objBitsKO_def field_simps)\n apply (rule no_fail_pre, rule no_fail_placeNewObject)\n apply (clarsimp simp: objBitsKO_def)\n done\n\ndefinition\n createObject_hs_preconds :: \"machine_word \\ ArchTypes_H.object_type \\ nat \\ bool \\ kernel_state \\ bool\"\nwhere\n \"createObject_hs_preconds regionBase newType userSize d \\\n (invs' and pspace_no_overlap' regionBase (getObjectSize newType userSize)\n and caps_overlap_reserved' {regionBase ..+ 2 ^ (getObjectSize newType userSize)}\n and (\\s. 2 ^ (getObjectSize newType userSize) \\ gsMaxObjectSize s)\n and K(regionBase \\ 0 \\ canonical_address regionBase\n \\ ({regionBase..+2 ^ (getObjectSize newType userSize)} \\ kernel_data_refs = {})\n \\ range_cover regionBase (getObjectSize newType userSize) (getObjectSize newType userSize) (Suc 0)\n \\ (newType = APIObjectType apiobject_type.Untyped \\ userSize \\ maxUntypedSizeBits)\n \\ (newType = APIObjectType apiobject_type.CapTableObject \\ userSize < 59)\n \\ (newType = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ userSize)\n \\ (newType = APIObjectType apiobject_type.CapTableObject \\ 0 < userSize)\n \\ (d \\ newType = APIObjectType apiobject_type.Untyped \\ isFrameType newType)\n ))\"\n\nabbreviation\n \"region_actually_is_dev_bytes ptr len devMem s\n \\ region_actually_is_bytes ptr len s\n \\ (\\ devMem \\ heap_list_is_zero (hrs_mem (t_hrs_' (globals s))) ptr len)\"\n\n(* these preconds actually used throughout the proof *)\nabbreviation(input)\n createObject_c_preconds1 :: \"machine_word \\ ArchTypes_H.object_type \\ nat \\ bool \\ (globals myvars) set\"\nwhere\n \"createObject_c_preconds1 regionBase newType userSize deviceMemory \\\n {s. region_actually_is_dev_bytes regionBase (2 ^ getObjectSize newType userSize) deviceMemory s}\"\n\n(* these preconds used at start of proof *)\ndefinition\n createObject_c_preconds :: \"machine_word \\ ArchTypes_H.object_type \\ nat \\ bool \\ (globals myvars) set\"\nwhere\n \"createObject_c_preconds regionBase newType userSize deviceMemory \\\n (createObject_c_preconds1 regionBase newType userSize deviceMemory\n \\ {s. object_type_from_H newType = t_' s}\n \\ {s. Ptr regionBase = regionBase_' s}\n \\ {s. unat (scast (userSize_' s) :: machine_word) = userSize}\n \\ {s. deviceMemory_' s = from_bool deviceMemory}\n )\"\n\nlemma ccorres_apiType_split:\n \"\\ apiType = apiobject_type.Untyped \\ ccorres rr xf P1 P1' hs X Y;\n apiType = apiobject_type.TCBObject \\ ccorres rr xf P2 P2' hs X Y;\n apiType = apiobject_type.EndpointObject \\ ccorres rr xf P3 P3' hs X Y;\n apiType = apiobject_type.NotificationObject \\ ccorres rr xf P4 P4' hs X Y;\n apiType = apiobject_type.CapTableObject \\ ccorres rr xf P5 P5' hs X Y\n \\ \\ ccorres rr xf\n ((\\s. apiType = apiobject_type.Untyped \\ P1 s)\n and (\\s. apiType = apiobject_type.TCBObject \\ P2 s)\n and (\\s. apiType = apiobject_type.EndpointObject \\ P3 s)\n and (\\s. apiType = apiobject_type.NotificationObject \\ P4 s)\n and (\\s. apiType = apiobject_type.CapTableObject \\ P5 s))\n ({s. apiType = apiobject_type.Untyped \\ s \\ P1'}\n \\ {s. apiType = apiobject_type.TCBObject \\ s \\ P2'}\n \\ {s. apiType = apiobject_type.EndpointObject \\ s \\ P3'}\n \\ {s. apiType = apiobject_type.NotificationObject \\ s \\ P4'}\n \\ {s. apiType = apiobject_type.CapTableObject \\ s \\ P5'})\n hs X Y\"\n apply (case_tac apiType, simp_all)\n done\n\nlemma range_cover_simpleI:\n \"\\ is_aligned (ptr :: 'a :: len word) a; a < len_of TYPE('a); c = Suc 0 \\\n \\ range_cover ptr a a c\"\n apply (clarsimp simp: range_cover_def)\n apply (metis shiftr_0 is_aligned_mask unat_0)\n done\n\nlemma range_coverI:\n \"\\is_aligned (ptr :: 'a :: len word) a; b \\ a; a < len_of TYPE('a);\n c \\ 2 ^ (a - b)\\\n \\ range_cover ptr a b c\"\n apply (clarsimp simp: range_cover_def field_simps)\n apply (rule conjI)\n apply (erule(1) is_aligned_weaken)\n apply (subst mask_zero, simp)\n apply simp\n done\n\n(* FIXME: with the current state of affairs, we could simplify gs_new_frames *)\nlemma gsUserPages_update_ccorres:\n \"ccorresG rf_sr G dc xf (\\_. sz = pageBitsForSize pgsz) UNIV hs\n (modify (gsUserPages_update (\\m a. if a = ptr then Some pgsz else m a)))\n (Basic (globals_update (ghost'state_'_update\n (gs_new_frames pgsz ptr sz))))\"\n apply (rule ccorres_from_vcg)\n apply vcg_step\n apply (clarsimp simp: split_def simpler_modify_def gs_new_frames_def)\n apply (case_tac \"ghost'state_' (globals x)\")\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def fun_upd_def\n carch_state_relation_def cmachine_state_relation_def\n ghost_size_rel_def ghost_assertion_data_get_def\n cong: if_cong)\n done\n\nlemma placeNewObject_user_data_device:\n \"ccorresG rf_sr \\ dc xfdc\n (pspace_aligned' and pspace_distinct'\n and ret_zero regionBase (2 ^ (pageBits + us))\n and pspace_no_overlap' regionBase (pageBits+us) and valid_queues\n and (\\s. sym_refs (state_refs_of' s))\n and (\\s. 2^(pageBits + us) \\ gsMaxObjectSize s)\n and K (regionBase \\ 0 \\ range_cover regionBase (pageBits + us) (pageBits+us) (Suc 0)\n \\ {regionBase..+2^(pageBits + us)} \\ kernel_data_refs = {}))\n ({s. region_actually_is_bytes regionBase (2^(pageBits+us)) s})\n hs\n (placeNewObject regionBase UserDataDevice us )\n (global_htd_update (\\s. (ptr_retyps (2^us) (Ptr regionBase :: user_data_device_C ptr))))\"\n apply (rule ccorres_from_vcg_nofail)\n apply (clarsimp simp:)\n apply (rule conseqPre)\n apply vcg\n apply (clarsimp simp: rf_sr_htd_safe)\n apply (intro conjI allI impI)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def\n kernel_data_refs_domain_eq_rotate\n ptr_retyps_htd_safe_neg[where arr=False, unfolded ptr_retyps_gen_def, simplified]\n size_of_def pageBits_def power_add mult.commute mult.left_commute)\n apply (frule range_cover.unat_of_nat_shift[where gbits = \"pageBits + us\"])\n apply simp\n apply (clarsimp simp:size_of_def power_add pageBits_def\n rf_sr_def cstate_relation_def Let_def field_simps)\n apply blast\n apply (frule range_cover.aligned)\n apply (frule range_cover.sz(1), fold word_bits_def)\n apply (rule bexI [OF _ placeNewObject_eq], simp_all)\n apply (cut_tac ptr=regionBase and sz=\"pageBits + us\" and gbits=us and arr=False\n in createObjects_ccorres_user_data_device[rule_format])\n apply (rule conjI, assumption, clarsimp)\n apply (fastforce simp: pageBits_def field_simps region_actually_is_bytes)\n apply (clarsimp elim!: rsubst[where P=\"\\x. (\\, x) \\ rf_sr\" for \\]\n simp: field_simps objBitsKO_def ptr_retyps_gen_def)\n apply (simp add: objBitsKO_def field_simps)\n apply (rule no_fail_pre, rule no_fail_placeNewObject)\n apply (clarsimp simp: objBitsKO_def)\n done\n\nlemma createObjects'_page_directory_at_global:\n \"\\ \\s. n \\ 0 \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\n \\ page_directory_at' (armKSGlobalPD (ksArchState s)) s \\\n createObjects' ptr n val gbits\n \\ \\rv s. page_directory_at' (armKSGlobalPD (ksArchState s)) s \\\"\n apply (simp add: page_directory_at'_def)\n apply (rule hoare_pre, wp hoare_vcg_all_lift hoare_vcg_const_imp_lift)\n apply (wps createObjects'_ksArch)\n apply (wp createObjects'_typ_at[where sz=sz])\n apply simp\n done\n\nlemma gsUserPages_update:\n \"\\f. (\\s. s\\gsUserPages := f(gsUserPages s)\\) = gsUserPages_update f\"\n by (rule ext) simp\n\nlemma modify_gsUserPages_update:\n \"modify (\\s. s\\gsUserPages := f(gsUserPages s)\\) = modify (gsUserPages_update f)\"\n by (simp only: gsUserPages_update)\n\nmethod arch_create_data_obj_corres_helper =\n (match conclusion in \"ccorres ?rel ?var ?P ?P' ?hs\n (X64_H.createObject object_type.SmallPageObject ?regionBase sz ?deviceMemory)\n (Call Arch_createObject_'proc)\n \" for sz \\ \\(simp add: toAPIType_def X64_H.createObject_def\n placeNewDataObject_def bind_assoc\n ),subst gsUserPages_update,((rule ccorres_gen_asm)+) \\)\n\nlemma placeNewDataObject_ccorres:\n \"ccorresG rf_sr \\ dc xfdc\n (createObject_hs_preconds regionBase newType us devMem\n and K (APIType_capBits newType us = pageBits + us))\n ({s. region_actually_is_bytes regionBase (2 ^ (pageBits + us)) s\n \\ (\\ devMem \\ heap_list_is_zero (hrs_mem (t_hrs_' (globals s))) regionBase\n (2 ^ (pageBits + us)))})\n hs\n (placeNewDataObject regionBase us devMem)\n (Cond {s. devMem}\n (global_htd_update (\\s. (ptr_retyps (2^us) (Ptr regionBase :: user_data_device_C ptr))))\n (global_htd_update (\\s. (ptr_retyps (2^us) (Ptr regionBase :: user_data_C ptr))))\n )\"\n apply (cases devMem)\n apply (simp add: placeNewDataObject_def ccorres_cond_univ_iff)\n apply (rule ccorres_guard_imp, rule placeNewObject_user_data_device, simp_all)\n apply (clarsimp simp: createObject_hs_preconds_def invs'_def\n valid_state'_def valid_pspace'_def)\n apply (simp add: placeNewDataObject_def ccorres_cond_empty_iff)\n apply (rule ccorres_guard_imp, rule placeNewObject_user_data, simp_all)\n apply (clarsimp simp: createObject_hs_preconds_def invs'_def\n valid_state'_def valid_pspace'_def)\n apply (frule range_cover.sz(1), simp add: word_bits_def)\n done\n\nlemma cond_second_eq_seq_ccorres:\n \"ccorres_underlying sr Gamm r xf arrel axf G G' hs m\n (Cond P (a ;; c) (b ;; c) ;; d)\n = ccorres_underlying sr Gamm r xf arrel axf G G' hs m\n (Cond P a b ;; c ;; d)\"\n apply (rule ccorres_semantic_equiv)\n apply (rule semantic_equivI)\n apply (auto elim!: exec_Normal_elim_cases intro: exec.Seq exec.CondTrue exec.CondFalse)\n done\n\nlemma cvariable_array_ptr_kill:\n \"cvariable_array_map_relation m ns ptrfun htd\n \\ cvariable_array_map_relation (m(x := None))\n ns (ptrfun :: _ \\ ('b :: mem_type) ptr) htd\"\n by (clarsimp simp: cvariable_array_map_relation_def\n split: if_split)\n\nlemma maptype_scast_mask_VMNoMap[simp]:\n \"maptype_to_H (SCAST(32 signed \\ 64) X86_MappingNone && 3) = VMNoMap\"\n by (simp add: maptype_to_H_def X86_MappingNone_def)\n\nlemma Mode_createObject_ccorres:\n assumes t: \"toAPIType newType = None\"\n shows \"ccorres (\\a b. ccap_relation (ArchObjectCap a) b) ret__struct_cap_C_'\n (createObject_hs_preconds regionBase newType userSize deviceMemory)\n (createObject_c_preconds regionBase newType userSize deviceMemory)\n []\n (Arch.createObject newType regionBase userSize deviceMemory)\n (Call Mode_createObject_'proc)\"\nproof -\n note if_cong[cong]\n note sign_extend_canonical_address[simp]\n\n show ?thesis\n apply (clarsimp simp: createObject_c_preconds_def\n createObject_hs_preconds_def)\n apply (rule ccorres_gen_asm)\n apply clarsimp\n apply (frule range_cover.aligned)\n apply (cut_tac t)\n apply (case_tac newType; simp add: toAPIType_def bind_assoc)\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def\n APIType_capBits_def shiftL_nat objBits_simps\n ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def\n fold_eq_0_to_bool)\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def pageBits_def\n cond_second_eq_seq_ccorres modify_gsUserPages_update\n intro!: ccorres_rhs_assoc)\n apply ((rule ccorres_return_C | simp | wp | vcg\n | (rule match_ccorres, ctac add:\n placeNewDataObject_ccorres[where us=0 and newType=newType, simplified]\n gsUserPages_update_ccorres[folded modify_gsUserPages_update])\n | (rule match_ccorres, csymbr))+)[1]\n apply (intro conjI)\n apply (clarsimp simp: createObject_hs_preconds_def frameSizeConstants_defs\n APIType_capBits_def pageBits_def)\n apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_frame_cap_lift X86_SmallPage_def\n vmrights_to_H_def mask_def vm_rights_defs c_valid_cap_def cl_valid_cap_def\n vm_page_map_type_defs maptype_to_H_def)\n\n \\ \\Page objects: could possibly fix the duplication here\\\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def\n APIType_capBits_def shiftL_nat objBits_simps\n ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def\n fold_eq_0_to_bool)\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def pageBits_def ptTranslationBits_def\n cond_second_eq_seq_ccorres modify_gsUserPages_update\n intro!: ccorres_rhs_assoc)\n apply ((rule ccorres_return_C | simp | wp | vcg\n | (rule match_ccorres, ctac add:\n placeNewDataObject_ccorres[where us=9 and newType=newType, simplified]\n gsUserPages_update_ccorres[folded modify_gsUserPages_update])\n | (rule match_ccorres, csymbr))+)[1]\n apply (intro conjI)\n apply (clarsimp simp: createObject_hs_preconds_def frameSizeConstants_defs ptTranslationBits_def\n APIType_capBits_def pageBits_def)\n apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_frame_cap_lift\n X86_SmallPage_def X86_LargePage_def ptTranslationBits_def\n vmrights_to_H_def mask_def vm_rights_defs c_valid_cap_def cl_valid_cap_def\n vm_page_map_type_defs maptype_to_H_def)\n\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def\n APIType_capBits_def shiftL_nat objBits_simps\n ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def\n fold_eq_0_to_bool)\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def pageBits_def ptTranslationBits_def\n cond_second_eq_seq_ccorres modify_gsUserPages_update\n intro!: ccorres_rhs_assoc)\n apply ((rule ccorres_return_C | simp | wp | vcg\n | (rule match_ccorres, ctac add:\n placeNewDataObject_ccorres[where us=18 and newType=newType, simplified]\n gsUserPages_update_ccorres[folded modify_gsUserPages_update])\n | (rule match_ccorres, csymbr))+)[1]\n apply (intro conjI)\n apply (clarsimp simp: createObject_hs_preconds_def frameSizeConstants_defs ptTranslationBits_def\n APIType_capBits_def pageBits_def)\n apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_frame_cap_lift\n X86_SmallPage_def X86_LargePage_def X64_HugePage_def ptTranslationBits_def\n vmrights_to_H_def mask_def vm_rights_defs c_valid_cap_def cl_valid_cap_def\n vm_page_map_type_defs maptype_to_H_def)\n\n \\ \\PageTableObject\\\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def\n sle_positive APIType_capBits_def shiftL_nat objBits_simps\n ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def)\n apply (rule ccorres_rhs_assoc)+\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def pageBits_def pt_bits_def table_size)\n apply (ctac pre only: add: placeNewObject_pte[simplified ptTranslationBits_def])\n apply csymbr\n apply (rule ccorres_return_C)\n apply simp\n apply simp\n apply simp\n apply wp\n apply vcg\n apply clarify\n apply (intro conjI)\n apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' invs_valid_global'\n APIType_capBits_def invs_queues invs_valid_objs'\n invs_urz pageBits_def)\n apply clarsimp\n apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_page_table_cap_lift\n vmrights_to_H_def)\n apply (clarsimp simp: to_bool_def false_def isFrameType_def)\n\n \\ \\PageDirectoryObject\\\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def sle_positive APIType_capBits_def shiftL_nat\n objBits_simps archObjSize_def\n ptBits_def pageBits_def pdBits_def word_sle_def word_sless_def)\n apply (rule ccorres_rhs_assoc)+\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def bit_simps)\n apply (ctac pre only: add: placeNewObject_pde[simplified ptTranslationBits_def])\n apply csymbr\n apply (rule ccorres_return_C)\n apply simp\n apply simp\n apply simp\n apply wp\n apply vcg\n apply clarify\n apply (intro conjI)\n apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' invs_valid_global'\n APIType_capBits_def invs_queues invs_valid_objs'\n invs_urz bit_simps)\n apply clarsimp\n apply (clarsimp simp: ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_page_directory_cap_lift\n vmrights_to_H_def bit_simps)\n apply (clarsimp simp: to_bool_def false_def isFrameType_def)\n\n \\ \\PDPointerTableObject\\\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def sle_positive APIType_capBits_def shiftL_nat\n objBits_simps archObjSize_def\n ptBits_def pageBits_def pdBits_def word_sle_def word_sless_def)\n apply (rule ccorres_rhs_assoc)+\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def bit_simps)\n apply (ctac pre only: add: placeNewObject_pdpte[simplified ptTranslationBits_def])\n apply csymbr\n apply (rule ccorres_return_C)\n apply simp\n apply simp\n apply simp\n apply wp\n apply vcg\n apply clarify\n apply (intro conjI)\n apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' invs_valid_global'\n APIType_capBits_def invs_queues invs_valid_objs' invs_urz bit_simps)\n apply clarsimp\n apply (clarsimp simp: ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_pdpt_cap_lift\n vmrights_to_H_def bit_simps)\n apply (clarsimp simp: to_bool_def false_def isFrameType_def)\n\n \\ \\PML4Object\\\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (simp add: object_type_from_H_def Kernel_C_defs)\n apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff\n asidInvalid_def sle_positive APIType_capBits_def shiftL_nat\n objBits_simps archObjSize_def\n ptBits_def pageBits_def pdBits_def word_sle_def word_sless_def)\n apply (rule ccorres_rhs_assoc)+\n apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def\n X64_H.createObject_def bit_simps)\n apply (ctac pre only: add: placeNewObject_pml4e[simplified ptTranslationBits_def])\n apply (ctac add: copyGlobalMappings_ccorres)\n apply csymbr\n apply (rule ccorres_return_C)\n apply simp\n apply simp\n apply simp\n apply wp\n apply (vcg exspec=copyGlobalMappings_modifies)\n apply (wp placeNewObject_pml4_at'[simplified bitSimps objBits_simps archObjSize_def, simplified])\n apply vcg\n apply clarify\n apply (intro conjI)\n apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' invs_valid_global'\n APIType_capBits_def invs_queues invs_valid_objs' invs_urz bit_simps)\n apply clarsimp\n apply (clarsimp simp: ccap_relation_def APIType_capBits_def\n framesize_to_H_def cap_to_H_simps cap_pml4_cap_lift\n vmrights_to_H_def bit_simps)\n apply (clarsimp simp: to_bool_def false_def isFrameType_def\n c_valid_cap_def cl_valid_cap_def asidInvalid_def)\n done\nqed\n\n\nlemma Arch_createObject_ccorres:\n assumes t: \"toAPIType newType = None\"\n shows \"ccorres (\\a b. ccap_relation (ArchObjectCap a) b) ret__struct_cap_C_'\n (createObject_hs_preconds regionBase newType userSize deviceMemory)\n (createObject_c_preconds regionBase newType userSize deviceMemory)\n []\n (Arch.createObject newType regionBase userSize deviceMemory)\n (Call Arch_createObject_'proc)\"\n apply (clarsimp simp: createObject_c_preconds_def createObject_hs_preconds_def)\n apply (rule ccorres_gen_asm)\n apply clarsimp\n apply (frule range_cover.aligned)\n apply (cut_tac t)\n apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (subst bind_return[symmetric])\n apply (ctac add: Mode_createObject_ccorres)\n apply (rule ccorres_return_C; simp)\n apply wp\n apply (vcg exspec=Mode_createObject_modifies)\n apply (simp add: createObject_c_preconds_def createObject_hs_preconds_def)\n done\n\n(* FIXME: with the current state of affairs, we could simplify gs_new_cnodes *)\nlemma gsCNodes_update_ccorres:\n \"ccorresG rf_sr G dc xf (\\_. bits = sz + 4)\n \\ h_t_array_valid (hrs_htd \\t_hrs) (cte_Ptr ptr) (2 ^ sz) \\ hs\n (modify (gsCNodes_update (\\m a. if a = ptr then Some sz else m a)))\n (Basic (globals_update (ghost'state_'_update\n (gs_new_cnodes sz ptr bits))))\"\n apply (rule ccorres_from_vcg)\n apply vcg_step\n apply (clarsimp simp: split_def simpler_modify_def gs_new_cnodes_def)\n apply (case_tac \"ghost'state_' (globals x)\")\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def fun_upd_def\n carch_state_relation_def cmachine_state_relation_def\n ghost_size_rel_def ghost_assertion_data_get_def\n cong: if_cong)\n apply (rule cvariable_array_ptr_upd[unfolded fun_upd_def], simp_all)\n done\n\n(* FIXME: move *)\nlemma map_to_tcbs_upd:\n \"map_to_tcbs (ksPSpace s(t \\ KOTCB tcb')) = map_to_tcbs (ksPSpace s)(t \\ tcb')\"\n apply (rule ext)\n apply (clarsimp simp: map_comp_def projectKOs split: option.splits if_splits)\n done\n\n(* FIXME: move *)\nlemma cmap_relation_updI:\n \"\\cmap_relation am cm f rel; am dest = Some ov; rel nv nv'; inj f\\ \\ cmap_relation (am(dest \\ nv)) (cm(f dest \\ nv')) f rel\"\n apply (clarsimp simp: cmap_relation_def)\n apply (rule conjI)\n apply (drule_tac t=\"dom cm\" in sym)\n apply fastforce\n apply clarsimp\n apply (case_tac \"x = dest\")\n apply simp\n apply clarsimp\n apply (subgoal_tac \"f x \\ f dest\")\n apply simp\n apply force\n apply clarsimp\n apply (drule (1) injD)\n apply simp\n done\n\nlemma cep_relations_drop_fun_upd:\n \"\\ f x = Some v; tcbEPNext_C v' = tcbEPNext_C v; tcbEPPrev_C v' = tcbEPPrev_C v \\\n \\ cendpoint_relation (f (x \\ v')) = cendpoint_relation f\"\n \"\\ f x = Some v; tcbEPNext_C v' = tcbEPNext_C v; tcbEPPrev_C v' = tcbEPPrev_C v \\\n \\ cnotification_relation (f (x \\ v')) = cnotification_relation f\"\n by (intro ext cendpoint_relation_upd_tcb_no_queues[where thread=x]\n cnotification_relation_upd_tcb_no_queues[where thread=x]\n | simp split: if_split)+\n\nlemma threadSet_domain_ccorres [corres]:\n \"ccorres dc xfdc\n (tcb_at' thread)\n {s. thread' s = tcb_ptr_to_ctcb_ptr thread \\ d' s = ucast d} hs\n (threadSet (tcbDomain_update (\\_. d)) thread)\n (Basic (\\s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (Ptr &(thread' s\\[''tcbDomain_C''])::machine_word ptr) (d' s)))) s))\"\n apply (rule ccorres_guard_imp2)\n apply (rule threadSet_ccorres_lemma4 [where P=\\ and P'=\\])\n apply vcg\n prefer 2\n apply (rule conjI, simp)\n apply assumption\n apply clarsimp\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (clarsimp simp: cmachine_state_relation_def carch_state_relation_def cpspace_relation_def\n fpu_null_state_heap_update_tag_disj_simps)\n apply (clarsimp simp: update_tcb_map_tos typ_heap_simps')\n apply (simp add: map_to_ctes_upd_tcb_no_ctes map_to_tcbs_upd tcb_cte_cases_def)\n apply (simp add: cep_relations_drop_fun_upd\n cvariable_relation_upd_const ko_at_projectKO_opt)\n apply (rule conjI)\n apply (drule ko_at_projectKO_opt)\n apply (erule (2) cmap_relation_upd_relI)\n subgoal by (simp add: ctcb_relation_def)\n apply assumption\n apply simp\n apply (erule cready_queues_relation_not_queue_ptrs)\n apply (rule ext, simp split: if_split)\n apply (rule ext, simp split: if_split)\n done\n\nlemma createObject_ccorres:\n notes APITypecapBits_simps[simp] =\n APIType_capBits_def[split_simps\n object_type.split apiobject_type.split]\n shows\n \"ccorres ccap_relation ret__struct_cap_C_'\n (createObject_hs_preconds regionBase newType userSize isdev)\n (createObject_c_preconds regionBase newType userSize isdev)\n []\n (createObject newType regionBase userSize isdev)\n (Call createObject_'proc)\"\nproof -\n note if_cong[cong]\n\n have canonical_tcb_offset[simp]:\n \"\\ canonical_address regionBase; is_aligned regionBase 11\\\n \\ sign_extend 47 (regionBase + 0x400) - 0x400 = regionBase\"\n apply (drule canonical_address_add[where f=\"0x400\"]; simp?)\n apply (simp add: sign_extend_canonical_address[symmetric])\n done\n\n have aligned_and: \"\\p. is_aligned p 1 \\ p && 0xFFFFFFFFFFFFFFFE = (p::machine_word)\"\n by word_bitwise (simp add: is_aligned_nth)\n\n have gsCNodes_update:\n \"\\f. (\\ks. ks \\gsCNodes := f (gsCNodes ks)\\) = gsCNodes_update f\"\n by (rule ext) simp\n\n show ?thesis\n apply (clarsimp simp: createObject_c_preconds_def\n createObject_hs_preconds_def)\n apply (rule ccorres_gen_asm_state)\n apply (cinit lift: t_' regionBase_' userSize_' deviceMemory_')\n apply (rule ccorres_cond_seq)\n (* Architecture specific objects. *)\n apply (rule_tac\n Q=\"createObject_hs_preconds regionBase newType userSize isdev\" and\n S=\"createObject_c_preconds1 regionBase newType userSize isdev\" and\n R=\"createObject_hs_preconds regionBase newType userSize isdev\" and\n T=\"createObject_c_preconds1 regionBase newType userSize isdev\"\n in ccorres_Cond_rhs)\n apply (subgoal_tac \"toAPIType newType = None\")\n apply clarsimp\n apply (rule ccorres_rhs_assoc)+\n apply (rule ccorres_guard_imp)\n apply (ctac (no_vcg) add: Arch_createObject_ccorres)\n apply (rule ccorres_return_C_Seq)\n apply (rule ccorres_return_C)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply wp[1]\n apply clarsimp\n apply (clarsimp simp: createObject_c_preconds_def\n region_actually_is_bytes\n region_actually_is_bytes_def)\n apply (clarsimp simp: object_type_from_H_def\n X64_H.toAPIType_def Kernel_C_defs\n nAPIObjects_def word_sle_def createObject_c_preconds_def\n word_le_nat_alt split:\n apiobject_type.splits object_type.splits)\n apply (subgoal_tac \"\\apiType. newType = APIObjectType apiType\")\n apply clarsimp\n apply (rule ccorres_guard_imp)\n apply (rule_tac apiType=apiType in ccorres_apiType_split)\n\n (* Untyped *)\n apply (clarsimp simp: Kernel_C_defs object_type_from_H_def\n X64_H.toAPIType_def nAPIObjects_def\n word_sle_def\n intro!: Corres_UL_C.ccorres_cond_empty\n Corres_UL_C.ccorres_cond_univ ccorres_rhs_assoc)\n apply (rule_tac\n A =\"createObject_hs_preconds regionBase\n (APIObjectType apiobject_type.Untyped)\n (unat (userSizea :: machine_word)) isdev\" and\n A'=UNIV in\n ccorres_guard_imp)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_return_C, simp, simp, simp)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply simp\n apply (clarsimp simp: ccap_relation_def cap_to_H_def\n getObjectSize_def apiGetObjectSize_def\n cap_untyped_cap_lift to_bool_eq_0 true_def\n aligned_add_aligned sign_extend_canonical_address\n split: option.splits)\n apply (subst word_le_mask_eq, clarsimp simp: mask_def, unat_arith,\n auto simp: word_bits_conv untypedBits_defs)[1]\n\n (* TCB *)\n apply (clarsimp simp: Kernel_C_defs object_type_from_H_def\n toAPIType_def nAPIObjects_def word_sle_def\n intro!: Corres_UL_C.ccorres_cond_empty\n Corres_UL_C.ccorres_cond_univ ccorres_rhs_assoc)\n apply (rule_tac\n A =\"createObject_hs_preconds regionBase\n (APIObjectType apiobject_type.TCBObject) (unat userSizea) isdev\" and\n A'=\"createObject_c_preconds1 regionBase\n (APIObjectType apiobject_type.TCBObject) (unat userSizea) isdev\" in\n ccorres_guard_imp2)\n apply (rule ccorres_symb_exec_r)\n apply (ccorres_remove_UNIV_guard)\n apply (simp add: hrs_htd_update)\n apply (ctac (c_lines 4) add: ccorres_placeNewObject_tcb[simplified])\n apply simp\n apply (rule ccorres_pre_curDomain)\n apply ctac\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_return_C, simp, simp, simp)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply wp\n apply vcg\n apply (simp add: obj_at'_real_def)\n apply (wp placeNewObject_ko_wp_at')\n apply (vcg exspec=Arch_initContext_modifies)\n apply (clarsimp simp: dc_def)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply (clarsimp simp: createObject_hs_preconds_def\n createObject_c_preconds_def)\n apply (frule invs_pspace_aligned')\n apply (frule invs_pspace_distinct')\n apply (frule invs_queues)\n apply (frule invs_sym')\n apply (simp add: getObjectSize_def objBits_simps word_bits_conv\n apiGetObjectSize_def\n tcbBlockSizeBits_def new_cap_addrs_def projectKO_opt_tcb)\n apply (clarsimp simp: range_cover.aligned\n region_actually_is_bytes_def APIType_capBits_def)\n apply (frule(1) ghost_assertion_size_logic_no_unat)\n apply (clarsimp simp: ccap_relation_def cap_to_H_def\n getObjectSize_def apiGetObjectSize_def\n cap_thread_cap_lift to_bool_def true_def\n aligned_add_aligned\n split: option.splits)\n apply (frule range_cover.aligned)\n apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs\n tcb_ptr_to_ctcb_ptr_def\n invs_valid_objs' invs_urz isFrameType_def)\n\n (* Endpoint *)\n apply (clarsimp simp: Kernel_C_defs object_type_from_H_def\n toAPIType_def nAPIObjects_def\n word_sle_def intro!: ccorres_cond_empty ccorres_cond_univ\n ccorres_rhs_assoc)\n apply (rule_tac\n A =\"createObject_hs_preconds regionBase\n (APIObjectType apiobject_type.EndpointObject)\n (unat (userSizea :: machine_word)) isdev\" and\n A'=\"createObject_c_preconds1 regionBase\n (APIObjectType apiobject_type.EndpointObject)\n (unat userSizea) isdev\" in\n ccorres_guard_imp2)\n apply (simp add: hrs_htd_update)\n apply (ctac (no_vcg) pre only: add: ccorres_placeNewObject_endpoint)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_return_C, simp, simp, simp)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply wp\n apply (clarsimp simp: ccap_relation_def cap_to_H_def getObjectSize_def\n objBits_simps apiGetObjectSize_def epSizeBits_def\n cap_endpoint_cap_lift to_bool_def true_def sign_extend_canonical_address\n split: option.splits dest!: range_cover.aligned)\n apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def)\n apply (frule invs_pspace_aligned')\n apply (frule invs_pspace_distinct')\n apply (frule invs_queues)\n apply (frule invs_sym')\n apply (auto simp: getObjectSize_def objBits_simps apiGetObjectSize_def\n epSizeBits_def word_bits_conv\n elim!: is_aligned_no_wrap' intro!: range_cover_simpleI)[1]\n\n (* Notification *)\n apply (clarsimp simp: createObject_c_preconds_def)\n apply (clarsimp simp: getObjectSize_def objBits_simps\n apiGetObjectSize_def\n epSizeBits_def word_bits_conv word_sle_def word_sless_def)\n apply (clarsimp simp: Kernel_C_defs object_type_from_H_def\n toAPIType_def nAPIObjects_def\n word_sle_def intro!: ccorres_cond_empty ccorres_cond_univ\n ccorres_rhs_assoc)\n apply (rule_tac\n A =\"createObject_hs_preconds regionBase\n (APIObjectType apiobject_type.NotificationObject)\n (unat (userSizea :: machine_word)) isdev\" and\n A'=\"createObject_c_preconds1 regionBase\n (APIObjectType apiobject_type.NotificationObject)\n (unat userSizea) isdev\" in\n ccorres_guard_imp2)\n apply (simp add: hrs_htd_update)\n apply (ctac (no_vcg) pre only: add: ccorres_placeNewObject_notification)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_return_C, simp, simp, simp)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply wp\n apply (clarsimp simp: ccap_relation_def cap_to_H_def\n getObjectSize_def sign_extend_canonical_address\n apiGetObjectSize_def ntfnSizeBits_def objBits_simps\n cap_notification_cap_lift to_bool_def true_def\n dest!: range_cover.aligned split: option.splits)\n apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def)\n apply (frule invs_pspace_aligned')\n apply (frule invs_pspace_distinct')\n apply (frule invs_queues)\n apply (frule invs_sym')\n apply (auto simp: getObjectSize_def objBits_simps\n apiGetObjectSize_def\n ntfnSizeBits_def word_bits_conv\n elim!: is_aligned_no_wrap' intro!: range_cover_simpleI)[1]\n\n (* CapTable *)\n apply (clarsimp simp: createObject_c_preconds_def)\n apply (clarsimp simp: getObjectSize_def objBits_simps\n apiGetObjectSize_def\n ntfnSizeBits_def word_bits_conv)\n apply (clarsimp simp: Kernel_C_defs object_type_from_H_def\n toAPIType_def nAPIObjects_def\n word_sle_def word_sless_def zero_le_sint\n intro!: ccorres_cond_empty ccorres_cond_univ ccorres_rhs_assoc\n ccorres_move_c_guards ccorres_Guard_Seq)\n apply (rule_tac\n A =\"createObject_hs_preconds regionBase\n (APIObjectType apiobject_type.CapTableObject)\n (unat (userSizea :: machine_word)) isdev\" and\n A'=\"createObject_c_preconds1 regionBase\n (APIObjectType apiobject_type.CapTableObject)\n (unat userSizea) isdev\" in\n ccorres_guard_imp2)\n apply (simp add:field_simps hrs_htd_update)\n apply (ctac pre only: add: ccorres_placeNewObject_captable)\n apply (subst gsCNodes_update)\n apply (ctac add: gsCNodes_update_ccorres)\n apply (rule ccorres_symb_exec_r)\n apply (rule ccorres_return_C, simp, simp, simp)\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply (rule hoare_triv[of \\], simp add:hoare_TrueI)\n apply vcg\n apply wp\n apply vcg\n apply (rule conjI)\n apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def)\n apply (frule invs_pspace_aligned')\n apply (frule invs_pspace_distinct')\n apply (frule invs_queues)\n apply (frule invs_sym')\n apply (frule(1) ghost_assertion_size_logic_no_unat)\n apply (clarsimp simp: getObjectSize_def objBits_simps\n apiGetObjectSize_def\n cteSizeBits_def word_bits_conv add.commute createObject_c_preconds_def\n region_actually_is_bytes_def\n invs_valid_objs' invs_urz\n elim!: is_aligned_no_wrap'\n dest: word_of_nat_le intro!: range_coverI)[1]\n apply (clarsimp simp: createObject_hs_preconds_def hrs_htd_update isFrameType_def)\n apply (frule range_cover.strong_times_64[folded addr_card_wb], simp+)\n apply (subst h_t_array_valid_retyp, simp+)\n apply (simp add: power_add cte_C_size cteSizeBits_def)\n apply (clarsimp simp: ccap_relation_def cap_to_H_def\n cap_cnode_cap_lift to_bool_def true_def\n getObjectSize_def\n apiGetObjectSize_def cteSizeBits_def\n objBits_simps field_simps is_aligned_power2\n addr_card_wb is_aligned_weaken[where y=2]\n is_aligned_neg_mask_weaken\n split: option.splits)\n apply (rule conjI)\n apply (frule range_cover.aligned)\n apply (simp add: aligned_and is_aligned_weaken sign_extend_canonical_address)\n apply (subst word_le_mask_eq[symmetric, THEN eqTrueI])\n apply (clarsimp simp: mask_def untypedBits_defs)\n apply unat_arith\n apply (clarsimp simp: word_bits_conv)\n apply simp\n apply auto[1]\n apply (clarsimp simp: createObject_c_preconds_def)\n apply (clarsimp simp:nAPIOBjects_object_type_from_H)?\n apply (intro impI conjI, simp_all)[1]\n apply (clarsimp simp: nAPIObjects_def object_type_from_H_def Kernel_C_defs\n split: object_type.splits)\n apply (clarsimp simp: createObject_c_preconds_def\n createObject_hs_preconds_def)\n done\nqed\n\nlemma ccorres_guard_impR:\n \"\\ccorres_underlying sr \\ r xf arrel axf W Q' hs f g; (\\s s'. \\(s, s') \\ sr; s' \\ A'\\ \\ s' \\ Q')\\\n \\ ccorres_underlying sr \\ r xf arrel axf W A' hs f g\"\n by (rule ccorres_guard_imp2,simp+)\n\nlemma typ_clear_region_dom:\n \"dom (clift (hrs_htd_update (typ_clear_region ptr bits) hp) :: 'b :: mem_type typ_heap)\n \\ dom ((clift hp) :: 'b :: mem_type typ_heap)\"\n apply (clarsimp simp:lift_t_def lift_typ_heap_def Fun.comp_def)\n apply (clarsimp simp:lift_state_def)\n apply (case_tac hp)\n apply (clarsimp simp:)\n apply (case_tac x)\n apply (clarsimp simp:s_valid_def h_t_valid_def)\n apply (clarsimp simp:valid_footprint_def Let_def)\n apply (drule spec)\n apply (erule(1) impE)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp add:map_le_def)\n apply (drule_tac x = aa in bspec)\n apply simp\n apply (drule sym)\n apply simp\n apply (clarsimp simp:proj_d_def)\n apply (clarsimp simp:hrs_htd_update_def typ_clear_region_def\n split:if_splits option.splits)\n apply (clarsimp simp:proj_d_def)\n apply (clarsimp simp:hrs_htd_update_def typ_clear_region_def\n split:if_splits option.splits)\n done\n\nlemma tcb_range_subseteq:\n \"is_aligned x (objBitsKO (KOTCB ko))\n \\ {ptr_val (tcb_ptr_to_ctcb_ptr x)..+size_of TYPE(tcb_C)} \\ {x..x + 2 ^ objBitsKO (KOTCB ko) - 1}\"\n apply (simp add:ptr_val_def tcb_ptr_to_ctcb_ptr_def)\n apply (rule subset_trans)\n apply (rule intvl_sub_offset[where z = \"2^objBitsKO (KOTCB ko)\"])\n apply (simp add:ctcb_offset_defs size_of_def objBits_simps')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add:objBits_simps' word_bits_conv)\n apply simp\n done\n\nlemma pspace_no_overlap_induce_tcb:\n \"\\cpspace_relation (ksPSpace (s::kernel_state))\n (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::tcb_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(tcb_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def)\n apply (subgoal_tac \"xa\\tcb_ptr_to_ctcb_ptr ` dom (map_to_tcbs (ksPSpace s))\")\n prefer 2\n apply (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def projectKO_opt_tcb map_comp_def\n split: option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (rule disjoint_subset[OF tcb_range_subseteq[simplified]])\n apply (erule(1) pspace_alignedD')\n apply (subst intvl_range_conv)\n apply (simp add: word_bits_def)+\n done\n\nlemma pspace_no_overlap_induce_endpoint:\n \"\\cpspace_relation (ksPSpace (s::kernel_state))\n (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::endpoint_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(endpoint_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp: cpspace_relation_def)\n apply (clarsimp simp: cmap_relation_def)\n apply (subgoal_tac \"xa\\ep_Ptr ` dom (map_to_eps (ksPSpace s))\")\n prefer 2\n subgoal by (simp add: domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def projectKO_opt_ep map_comp_def\n split: option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (simp add: size_of_def)\n apply (subst intvl_range_conv[where bits = epSizeBits,simplified epSizeBits_def, simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps' archObjSize_def\n split: arch_kernel_object.split_asm)\n apply (simp add: word_bits_conv)\n apply (simp add: objBits_simps' archObjSize_def\n split: arch_kernel_object.split_asm)\n done\n\nlemma pspace_no_overlap_induce_notification:\n \"\\cpspace_relation (ksPSpace (s::kernel_state))\n (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::notification_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(notification_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp: cpspace_relation_def)\n apply (clarsimp simp: cmap_relation_def size_of_def)\n apply (subgoal_tac \"xa\\ntfn_Ptr ` dom (map_to_ntfns (ksPSpace s))\")\n prefer 2\n apply (simp add: domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def projectKO_opt_ntfn map_comp_def\n split: option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = ntfnSizeBits,simplified ntfnSizeBits_def, simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps' archObjSize_def\n split: arch_kernel_object.split_asm)\n apply (simp add: word_bits_conv)\n apply (simp add: objBits_simps' archObjSize_def\n split: arch_kernel_object.split_asm)\n done\n\nlemma ctes_of_ko_at_strong:\n \"\\ctes_of s p = Some a;is_aligned p cteSizeBits\\ \\\n (\\ptr ko. (ksPSpace s ptr = Some ko \\ {p ..+ 2^cteSizeBits} \\ obj_range' ptr ko))\"\n apply (clarsimp simp: map_to_ctes_def Let_def split:if_split_asm)\n apply (intro exI conjI,assumption)\n apply (simp add:obj_range'_def objBits_simps is_aligned_no_wrap' field_simps)\n apply (subst intvl_range_conv[where bits = cteSizeBits,simplified])\n apply simp\n apply (simp add:word_bits_def objBits_simps')\n apply (simp add:field_simps)\n apply (intro exI conjI,assumption)\n apply (clarsimp simp:objBits_simps obj_range'_def word_and_le2)\n apply (cut_tac intvl_range_conv[where bits = cteSizeBits and ptr = p, simplified])\n defer\n apply simp\n apply (simp add:word_bits_conv objBits_simps')\n apply (intro conjI)\n apply (rule order_trans[OF word_and_le2])\n apply clarsimp\n apply clarsimp\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (erule order_trans)\n apply (subst word_plus_and_or_coroll2[where x = p and w = \"mask tcbBlockSizeBits\",symmetric])\n apply (clarsimp simp:tcb_cte_cases_def field_simps split:if_split_asm)\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right[OF _ is_aligned_no_wrap'])\n apply (simp add: objBits_simps')\n apply (rule Aligned.is_aligned_neg_mask)\n apply (rule le_refl,simp)\n apply (simp add: objBits_simps')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right[OF _ is_aligned_no_wrap'])\n apply (simp add: objBits_simps')\n apply (rule Aligned.is_aligned_neg_mask)\n apply (rule le_refl,simp)\n apply (simp add: objBits_simps')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right[OF _ is_aligned_no_wrap'])\n apply (simp add:objBits_simps')\n apply (rule Aligned.is_aligned_neg_mask)\n apply (rule le_refl,simp)\n apply (simp add: objBits_simps')\n apply (subst p_assoc_help)\n apply (rule word_plus_mono_right[OF _ is_aligned_no_wrap'])\n apply (simp add: objBits_simps')\n apply (rule Aligned.is_aligned_neg_mask)\n apply (rule le_refl,simp)\n apply (simp add: objBits_simps')\n apply (subst p_assoc_help)+\n apply (rule word_plus_mono_right[OF _ is_aligned_no_wrap'])\n apply (simp add: objBits_simps')\n apply (rule Aligned.is_aligned_neg_mask)\n apply (rule le_refl,simp)\n apply (simp add: objBits_simps')\n done\n\nlemma pspace_no_overlap_induce_cte:\n \"\\cpspace_relation (ksPSpace (s::kernel_state))\n (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::cte_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(cte_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp: cpspace_relation_def)\n apply (clarsimp simp: cmap_relation_def size_of_def)\n apply (subgoal_tac \"xa\\cte_Ptr ` dom (ctes_of s)\")\n prefer 2\n apply (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def projectKO_opt_cte map_comp_def\n split: option.splits kernel_object.split_asm)\n apply (frule ctes_of_is_aligned)\n apply (simp add: objBits_simps)\n apply (drule ctes_of_ko_at_strong)\n apply simp\n apply (clarsimp simp: objBits_simps')\n apply (erule disjoint_subset)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (simp add: obj_range'_def)\n done\n\nlemma pspace_no_overlap_induce_asidpool:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::asid_pool_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(asid_pool_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def size_of_def)\n apply (subgoal_tac \"xa\\ap_Ptr ` dom (map_to_asidpools (ksPSpace s))\")\n prefer 2\n apply (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp:image_def projectKO_opt_asidpool\n map_comp_def split:option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = 12,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def pageBits_def split:arch_kernel_object.split_asm)\n apply (clarsimp elim!:is_aligned_weaken)\n apply (simp only: is_aligned_neg_mask_eq)\n apply (erule disjoint_subset[rotated])\n apply (clarsimp simp: field_simps)\n apply (simp add: p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (clarsimp simp:objBits_simps archObjSize_def pageBits_def split:arch_kernel_object.split_asm)+\n done\n\nlemma pspace_no_overlap_induce_user_data:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::user_data_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(user_data_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def size_of_def)\n apply (subgoal_tac \"xa\\Ptr ` dom (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s)))\")\n prefer 2\n apply (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def heap_to_user_data_def projectKO_opt_user_data map_comp_def\n split: option.splits kernel_object.splits)\n apply (frule(1) pspace_no_overlapD')\n apply (clarsimp simp: word_bits_def)\n apply (subst intvl_range_conv[where bits = 12,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add:objBits_simps archObjSize_def pageBits_def split:arch_kernel_object.split_asm)\n apply (clarsimp elim!:is_aligned_weaken)\n apply (subst intvl_range_conv, simp, simp)\n apply (clarsimp simp: field_simps)\n apply (simp add: p_assoc_help)\n apply (clarsimp simp: objBits_simps archObjSize_def pageBits_def split:arch_kernel_object.split_asm)+\n done\n\nlemma pspace_no_overlap_induce_device_data:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::user_data_device_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(user_data_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp: cpspace_relation_def)\n apply (clarsimp simp: cmap_relation_def size_of_def)\n apply (subgoal_tac \"xa\\Ptr ` dom (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s)))\")\n prefer 2\n apply (simp add: domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def heap_to_device_data_def projectKO_opt_user_data_device map_comp_def\n split: option.splits kernel_object.splits)\n apply (frule(1) pspace_no_overlapD')\n apply (clarsimp simp: word_bits_def)\n apply (subst intvl_range_conv[where bits = 12,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def pageBits_def split: arch_kernel_object.split_asm)\n apply (clarsimp elim!: is_aligned_weaken)\n apply (subst intvl_range_conv, simp, simp)\n apply (clarsimp simp: field_simps)\n apply (simp add: p_assoc_help)\n apply (clarsimp simp: objBits_simps archObjSize_def pageBits_def split:arch_kernel_object.split_asm)+\n done\n\nlemma typ_region_bytes_dom:\n \"typ_uinfo_t TYPE('b) \\ typ_uinfo_t TYPE (word8)\n \\ dom (clift (hrs_htd_update (typ_region_bytes ptr bits) hp) :: 'b :: mem_type typ_heap)\n \\ dom ((clift hp) :: 'b :: mem_type typ_heap)\"\n apply (clarsimp simp: liftt_if split: if_splits)\n apply (case_tac \"{ptr_val x ..+ size_of TYPE('b)} \\ {ptr ..+ 2 ^ bits} = {}\")\n apply (clarsimp simp: h_t_valid_def valid_footprint_def Let_def\n hrs_htd_update_def split_def typ_region_bytes_def)\n apply (drule spec, drule(1) mp)\n apply (simp add: size_of_def split: if_split_asm)\n apply (drule subsetD[OF equalityD1], rule IntI, erule intvlI, simp)\n apply simp\n apply (clarsimp simp: set_eq_iff)\n apply (drule(1) h_t_valid_intvl_htd_contains_uinfo_t)\n apply (clarsimp simp: hrs_htd_update_def typ_region_bytes_def split_def\n split: if_split_asm)\n done\n\nlemma lift_t_typ_region_bytes_none:\n \"\\ \\x (v :: 'a). lift_t g hp x = Some v\n \\ {ptr_val x ..+ size_of TYPE('a)} \\ {ptr ..+ 2 ^ bits} = {};\n typ_uinfo_t TYPE('a) \\ typ_uinfo_t TYPE(8 word) \\ \\\n lift_t g (hrs_htd_update (typ_region_bytes ptr bits) hp)\n = (lift_t g hp :: (('a :: mem_type) ptr) \\ _)\"\n apply atomize\n apply (subst lift_t_typ_region_bytes, simp_all)\n apply (clarsimp simp: liftt_if hrs_htd_def split: if_splits)\n apply (rule ext, simp add: restrict_map_def)\n apply (rule ccontr, clarsimp split: if_splits)\n apply (clarsimp simp: liftt_if hrs_htd_def split: if_splits)\n apply (clarsimp simp: set_eq_iff intvl_self)\n done\n\nlemma typ_bytes_cpspace_relation_clift_userdata:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\nshows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (user_data_C ptr \\ user_data_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (rule pspace_no_overlap_induce_user_data[simplified], auto)\n done\n\n\nlemma typ_bytes_cpspace_relation_clift_devicedata:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (user_data_device_C ptr \\ user_data_device_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (rule pspace_no_overlap_induce_device_data[simplified], auto)\n done\n\n\nlemma pspace_no_overlap_induce_pte:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::pte_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(pte_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def)\n apply (subgoal_tac \"xa\\pte_Ptr ` dom (map_to_ptes (ksPSpace s))\")\n prefer 2\n apply (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp: image_def projectKO_opt_pte map_comp_def\n split: option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = 3,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n apply (simp add: word_bits_conv)\n apply (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n done\n\nlemma pspace_no_overlap_induce_pde:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::pde_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(pde_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def)\n apply (subgoal_tac \"xa\\pde_Ptr ` dom (map_to_pdes (ksPSpace s))\")\n prefer 2\n subgoal by (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp:image_def projectKO_opt_pde\n map_comp_def split:option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = 3,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n apply (simp add:word_bits_conv)\n by (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n\nlemma pspace_no_overlap_induce_pdpte:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::pdpte_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(pdpte_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def)\n apply (subgoal_tac \"xa\\pdpte_Ptr ` dom (map_to_pdptes (ksPSpace s))\")\n prefer 2\n subgoal by (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp:image_def projectKO_opt_pdpte\n map_comp_def split:option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = 3,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n apply (simp add:word_bits_conv)\n by (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n\nlemma pspace_no_overlap_induce_pml4e:\n \"\\cpspace_relation (ksPSpace (s::kernel_state)) (underlying_memory (ksMachineState s)) hp;\n pspace_aligned' s; clift hp xa = Some (v::pml4e_C);\n is_aligned ptr bits; bits < word_bits;\n pspace_no_overlap' ptr bits s\\\n \\ {ptr_val xa..+size_of TYPE(pml4e_C)} \\ {ptr..+2 ^ bits} = {}\"\n apply (clarsimp simp:cpspace_relation_def)\n apply (clarsimp simp:cmap_relation_def)\n apply (subgoal_tac \"xa\\pml4e_Ptr ` dom (map_to_pml4es (ksPSpace s))\")\n prefer 2\n subgoal by (simp add:domI)\n apply (thin_tac \"S = dom K\" for S K)+\n apply (thin_tac \"\\x\\ S. K x\" for S K)+\n apply (clarsimp simp:image_def projectKO_opt_pml4e\n map_comp_def split:option.splits kernel_object.split_asm)\n apply (frule(1) pspace_no_overlapD')\n apply (subst intvl_range_conv)\n apply simp\n apply (simp add: word_bits_def)\n apply (subst intvl_range_conv[where bits = 3,simplified])\n apply (drule(1) pspace_alignedD')\n apply (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n apply (simp add:word_bits_conv)\n by (simp add: objBits_simps archObjSize_def bit_simps split:arch_kernel_object.split_asm)\n\n\nlemma typ_bytes_cpspace_relation_clift_tcb:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (tcb_C ptr \\ tcb_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_tcb[simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_pml4e:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (pml4e_C ptr \\ pml4e_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_pml4e[unfolded size_of_def,simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_pdpte:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (pdpte_C ptr \\ pdpte_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_pdpte[unfolded size_of_def,simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_pde:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (pde_C ptr \\ pde_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_pde[unfolded size_of_def,simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_pte:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (pte_C ptr \\ pte_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_pte[unfolded size_of_def,simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_endpoint:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (endpoint_C ptr \\ endpoint_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_endpoint[simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_notification:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (notification_C ptr \\ notification_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_notification[simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_asid_pool:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (asid_pool_C ptr \\ asid_pool_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none, simp_all)\n apply (erule(5) pspace_no_overlap_induce_asidpool[simplified])\n done\n\nlemma typ_bytes_cpspace_relation_clift_cte:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"pspace_no_overlap' ptr bits s\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp) = ((clift hp) :: (cte_C ptr \\ cte_C))\"\n (is \"?lhs = ?rhs\")\n using assms\n apply -\n apply (rule lift_t_typ_region_bytes_none)\n apply (erule(5) pspace_no_overlap_induce_cte)\n apply (simp add: cte_C_size)\n done\n\nlemma pspace_no_overlap_obj_atD':\n \"obj_at' P p s \\ pspace_no_overlap' ptr bits s\n \\ \\ko. P ko \\ is_aligned p (objBitsKO (injectKOS ko))\n \\ {p .. p + (2 ^ objBitsKO (injectKOS ko)) - 1}\n \\ {ptr .. (ptr && ~~ mask bits) + 2 ^ bits - 1} = {}\"\n apply (clarsimp simp: obj_at'_def)\n apply (drule(1) pspace_no_overlapD')\n apply (clarsimp simp: projectKOs project_inject)\n apply auto\n done\n\nlemma typ_bytes_cpspace_relation_clift_gptr:\nassumes \"cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState (s::kernel_state))) hp\"\n and \"is_aligned ptr bits\" \"bits < word_bits\"\n and \"pspace_aligned' s\"\n and \"kernel_data_refs \\ {ptr ..+ 2^bits} = {}\"\n and \"ptr_span (ptr' :: 'a ptr) \\ kernel_data_refs\"\n and \"typ_uinfo_t TYPE('a :: mem_type) \\ typ_uinfo_t TYPE(8 word)\"\n shows \"clift (hrs_htd_update (typ_region_bytes ptr bits) hp)\n ptr'\n = (clift hp) ptr'\"\n (is \"?lhs = ?rhs ptr'\")\n using assms\n apply -\n apply (case_tac \"ptr' \\ dom ?rhs\")\n apply (frule contra_subsetD[OF typ_region_bytes_dom[where ptr = ptr and bits = bits], rotated])\n apply simp\n apply fastforce\n apply (clarsimp simp: liftt_if hrs_htd_update_def split_def split: if_splits)\n apply (simp add: h_t_valid_typ_region_bytes)\n apply blast\n done\n\nlemma cmap_array_typ_region_bytes_triv[OF refl]:\n \"ptrf = (Ptr :: _ \\ 'b ptr)\n \\ carray_map_relation bits' (map_comp f (ksPSpace s)) (h_t_valid htd c_guard) ptrf\n \\ is_aligned ptr bits\n \\ pspace_no_overlap' ptr bits s\n \\ pspace_aligned' s\n \\ typ_uinfo_t TYPE('b :: c_type) \\ typ_uinfo_t TYPE(8 word)\n \\ size_of TYPE('b) = 2 ^ bits'\n \\ objBitsT (koType TYPE('a :: pspace_storable)) \\ bits\n \\ objBitsT (koType TYPE('a :: pspace_storable)) \\ bits'\n \\ bits' < word_bits\n \\ carray_map_relation bits' (map_comp (f :: _ \\ 'a option) (ksPSpace s))\n (h_t_valid (typ_region_bytes ptr bits htd) c_guard) ptrf\"\n apply (frule(7) cmap_array_typ_region_bytes[where ptrf=ptrf])\n apply (subst(asm) restrict_map_subdom, simp_all)\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add: upto_intvl_eq)\n apply (rule order_trans[OF map_comp_subset_dom])\n apply auto\n done\n\nlemma intvl_mult_is_union:\n \"{p..+n * m} = (\\i < m. {p + of_nat (i * n)..+ n})\"\n apply (cases \"n = 0\")\n apply simp\n apply (simp add: intvl_def, safe, simp_all)\n apply (rule_tac x=\"k div n\" in bexI)\n apply (rule_tac x=\"k mod n\" in exI)\n apply (simp only: Abs_fnat_hom_mult Abs_fnat_hom_add, simp)\n apply (simp add: More_Divides.td_gal_lt[symmetric] mult.commute)\n apply (rule_tac x=\"xa * n + k\" in exI, simp)\n apply (subst add.commute, rule order_less_le_trans, erule add_less_mono1)\n apply (case_tac m, simp_all)\n done\n\nlemma h_t_array_first_element_at:\n \"h_t_array_valid htd p n\n \\ 0 < n\n \\ gd p\n \\ h_t_valid htd gd (p :: ('a :: wf_type) ptr)\"\n apply (clarsimp simp: h_t_array_valid_def h_t_valid_def valid_footprint_def\n Let_def CTypes.sz_nzero[unfolded size_of_def])\n apply(drule_tac x=\"y\" in spec, erule impE)\n apply (erule order_less_le_trans, simp add: size_of_def)\n apply (clarsimp simp: uinfo_array_tag_n_m_def upt_conv_Cons)\n apply (erule map_le_trans[rotated])\n apply (simp add: list_map_mono split: if_split)\n done\n\nlemma aligned_intvl_disjointI:\n \"is_aligned p sz \\ is_aligned q sz'\n \\ p \\ {q ..+ 2 ^ sz'}\n \\ q \\ {p ..+ 2 ^ sz}\n \\ {p..+2 ^ sz} \\ {q..+2 ^ sz'} = {}\"\n apply (frule(1) aligned_ranges_subset_or_disjoint[where p=p and p'=q])\n apply (simp add: upto_intvl_eq[symmetric])\n apply (elim disjE, simp_all)\n apply (erule notE, erule subsetD, simp add: intvl_self)\n apply (erule notE, erule subsetD, simp add: intvl_self)\n done\n\nend\n\ndefinition\n \"cnodes_retype_have_size R bits cns\n = (\\ptr' sz'. cns ptr' = Some sz'\n \\ is_aligned ptr' (cte_level_bits + sz')\n \\ ({ptr' ..+ 2 ^ (cte_level_bits + sz')} \\ R = {}\n \\ cte_level_bits + sz' = bits))\"\n\nlemma cnodes_retype_have_size_mono:\n \"cnodes_retype_have_size T bits cns \\ S \\ T\n \\ cnodes_retype_have_size S bits cns\"\n by (auto simp add: cnodes_retype_have_size_def)\n\ncontext kernel_m begin\n\nlemma gsCNodes_typ_region_bytes:\n \"cvariable_array_map_relation (gsCNodes \\) ((^) 2) cte_Ptr (hrs_htd hrs)\n \\ cnodes_retype_have_size {ptr..+2 ^ bits} bits (gsCNodes \\)\n \\ 0 \\ {ptr..+2 ^ bits} \\ is_aligned ptr bits\n \\ clift (hrs_htd_update (typ_region_bytes ptr bits) hrs)\n = (clift hrs :: cte_C ptr \\ _)\n \\ cvariable_array_map_relation (gsCNodes \\) ((^) 2) cte_Ptr\n (typ_region_bytes ptr bits (hrs_htd hrs))\"\n apply (clarsimp simp: cvariable_array_map_relation_def\n h_t_array_valid_def)\n apply (elim allE, drule(1) mp)\n apply (subst valid_footprint_typ_region_bytes)\n apply (simp add: uinfo_array_tag_n_m_def typ_uinfo_t_def typ_info_word)\n apply (clarsimp simp: cnodes_retype_have_size_def field_simps)\n apply (elim allE, drule(1) mp)\n apply (subgoal_tac \"size_of TYPE(cte_C) * 2 ^ v = 2 ^ (cte_level_bits + v)\")\n prefer 2\n apply (simp add: cte_C_size cte_level_bits_def power_add)\n apply (clarsimp simp add: upto_intvl_eq[symmetric] field_simps)\n apply (case_tac \"p \\ {ptr ..+ 2 ^ bits}\")\n apply (drule h_t_array_first_element_at[where p=\"Ptr p\" and gd=c_guard for p,\n unfolded h_t_array_valid_def, simplified])\n apply simp\n apply (rule is_aligned_c_guard[where m=3], simp+)\n apply clarsimp\n apply (simp add: align_of_def)\n apply (simp add: size_of_def cte_level_bits_def power_add)\n apply (simp add: cte_level_bits_def)\n apply (drule_tac x=\"cte_Ptr p\" in fun_cong)\n apply (simp add: liftt_if[folded hrs_htd_def] hrs_htd_update\n h_t_valid_def valid_footprint_typ_region_bytes\n split: if_split_asm)\n apply (subgoal_tac \"p \\ {p ..+ size_of TYPE(cte_C)}\")\n apply (simp add: cte_C_size)\n apply blast\n apply (simp add: intvl_self)\n apply (simp only: upto_intvl_eq mask_in_range[symmetric])\n apply (rule aligned_ranges_subset_or_disjoint_coroll, simp_all)\n done\n\nlemma tcb_ctes_typ_region_bytes:\n \"cvariable_array_map_relation (map_to_tcbs (ksPSpace \\))\n (\\x. 5) cte_Ptr (hrs_htd hrs)\n \\ pspace_no_overlap' ptr bits \\\n \\ pspace_aligned' \\\n \\ is_aligned ptr bits\n \\ cpspace_tcb_relation (ksPSpace \\) hrs\n \\ cvariable_array_map_relation (map_to_tcbs (ksPSpace \\)) (\\x. 5)\n cte_Ptr (typ_region_bytes ptr bits (hrs_htd hrs))\"\n apply (clarsimp simp: cvariable_array_map_relation_def\n h_t_array_valid_def)\n apply (drule spec, drule mp, erule exI)\n apply (subst valid_footprint_typ_region_bytes)\n apply (simp add: uinfo_array_tag_n_m_def typ_uinfo_t_def typ_info_word)\n apply (clarsimp simp only: map_comp_Some_iff projectKOs\n pspace_no_overlap'_def is_aligned_neg_mask_weaken\n field_simps upto_intvl_eq[symmetric])\n apply (elim allE, drule(1) mp)\n apply simp\n apply (drule(1) pspace_alignedD')\n apply (erule disjoint_subset[rotated])\n apply (simp add: upto_intvl_eq[symmetric])\n apply (rule intvl_start_le)\n apply (simp add: objBits_simps' cte_C_size)\n done\n\nlemma ccorres_typ_region_bytes_dummy:\n \"ccorresG rf_sr\n AnyGamma dc xfdc\n (invs' and ct_active' and sch_act_simple and\n pspace_no_overlap' ptr bits and\n (cnodes_retype_have_size S bits o gsCNodes)\n and K (bits < word_bits \\ is_aligned ptr bits \\ 4 \\ bits\n \\ 0 \\ {ptr..+2 ^ bits}\n \\ {ptr ..+ 2 ^ bits} \\ S\n \\ kernel_data_refs \\ {ptr..+2 ^ bits} = {}))\n UNIV hs\n (return ())\n (global_htd_update (\\_. (typ_region_bytes ptr bits)))\"\n apply (rule ccorres_from_vcg)\n apply (clarsimp simp: return_def)\n apply (simp add: rf_sr_def)\n apply vcg\n apply (clarsimp simp: cstate_relation_def Let_def)\n apply (frule typ_bytes_cpspace_relation_clift_tcb)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_pte)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_pde)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_pdpte)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_pml4e)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_endpoint)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_notification)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_asid_pool)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_cte)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_userdata)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_devicedata)\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_gptr[where ptr'=\"x64KSSKIMPML4_Ptr\"])\n apply (simp add: invs_pspace_aligned')+\n apply (frule typ_bytes_cpspace_relation_clift_gptr[where ptr'=\"intStateIRQNode_array_Ptr\"])\n apply (simp add: invs_pspace_aligned')+\n apply (simp add: carch_state_relation_def cmachine_state_relation_def)\n apply (simp add: cpspace_relation_def htd_safe_typ_region_bytes)\n apply (simp add: h_t_valid_clift_Some_iff)\n apply (simp add: hrs_htd_update gsCNodes_typ_region_bytes\n cnodes_retype_have_size_mono[where T=S]\n tcb_ctes_typ_region_bytes[OF _ _ invs_pspace_aligned'])\n apply (simp add: cmap_array_typ_region_bytes_triv invs_pspace_aligned' bit_simps\n objBitsT_simps word_bits_def zero_ranges_are_zero_typ_region_bytes\n cong: conj_cong)\n apply (rule conjI, rule htd_safe_typ_region_bytes, simp, blast)\n by (clarsimp simp: global_ioport_bitmap_relation_def fpu_null_state_relation_def\n typ_bytes_cpspace_relation_clift_gptr\n cpspace_relation_def bit_simps word_bits_def invs_pspace_aligned')\n\nlemma region_is_typeless_cong:\n \"t_hrs_' (globals t) = t_hrs_' (globals s)\n \\ region_is_typeless ptr sz s = region_is_typeless ptr sz t\"\n by (simp add:region_is_typeless_def)\n\nlemma region_is_bytes_cong:\n \"t_hrs_' (globals t) = t_hrs_' (globals s)\n \\ region_is_bytes ptr sz s = region_is_bytes ptr sz t\"\n by (simp add:region_is_bytes'_def)\n\nlemma insertNewCap_sch_act_simple[wp]:\n \"\\sch_act_simple\\insertNewCap a b c\\\\_. sch_act_simple\\\"\n by (simp add:sch_act_simple_def,wp)\n\nlemma insertNewCap_ct_active'[wp]:\n \"\\ct_active'\\insertNewCap a b c\\\\_. ct_active'\\\"\n apply (simp add:ct_in_state'_def)\n apply (rule hoare_pre)\n apply wps\n apply (wp insertNewCap_ksCurThread | simp)+\n done\n\nlemma updateMDB_ctes_of_cap:\n \"\\\\s. (\\x\\ran(ctes_of s). P (cteCap x)) \\ no_0 (ctes_of s)\\\n updateMDB srcSlot t\n \\\\r s. \\x\\ran (ctes_of s). P (cteCap x)\\\"\n apply (rule hoare_pre)\n apply wp\n apply (clarsimp)\n apply (erule ranE)\n apply (clarsimp simp:modify_map_def split:if_splits)\n apply (drule_tac x = z in bspec)\n apply fastforce\n apply simp\n apply (drule_tac x = x in bspec)\n apply fastforce\n apply simp\n done\n\nlemma insertNewCap_caps_no_overlap'':\nnotes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\nshows \"\\cte_wp_at' (\\_. True) cptr and valid_pspace'\n and caps_no_overlap'' ptr us\n and K (cptr \\ (0::machine_word)) and K (untypedRange x \\ {ptr..(ptr && ~~ mask us) + 2 ^ us - 1} = {})\\\n insertNewCap srcSlot cptr x\n \\\\rv s. caps_no_overlap'' ptr us s\\\"\n apply (clarsimp simp:insertNewCap_def caps_no_overlap''_def)\n apply (rule hoare_pre)\n apply (wp getCTE_wp updateMDB_ctes_of_cap)\n apply (clarsimp simp:cte_wp_at_ctes_of valid_pspace'_def\n valid_mdb'_def valid_mdb_ctes_def no_0_def split:if_splits)\n apply (erule ranE)\n apply (clarsimp split:if_splits)\n apply (frule_tac c= \"(cteCap xa)\" and q = xb in caps_no_overlapD''[rotated])\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply clarsimp\n apply blast\n done\n\nlemma insertNewCap_caps_overlap_reserved':\nnotes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\nshows \"\\cte_wp_at' (\\_. True) cptr and valid_pspace' and caps_overlap_reserved' S\n and valid_cap' x and K (cptr \\ (0::machine_word)) and K (untypedRange x \\ S = {})\\\n insertNewCap srcSlot cptr x\n \\\\rv s. caps_overlap_reserved' S s\\\"\n apply (clarsimp simp:insertNewCap_def caps_overlap_reserved'_def)\n apply (rule hoare_pre)\n apply (wp getCTE_wp updateMDB_ctes_of_cap)\n apply (clarsimp simp:cte_wp_at_ctes_of valid_pspace'_def\n valid_mdb'_def valid_mdb_ctes_def no_0_def split:if_splits)\n apply (erule ranE)\n apply (clarsimp split:if_splits)\n apply (drule usableRange_subseteq[rotated])\n apply (simp add:valid_cap'_def)\n apply blast\n apply (drule_tac p = xaa in caps_overlap_reserved'_D)\n apply simp\n apply simp\n apply blast\n done\n\nlemma insertNewCap_pspace_no_overlap':\nnotes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\nshows \"\\pspace_no_overlap' ptr sz and pspace_aligned'\n and pspace_distinct' and cte_wp_at' (\\_. True) cptr\\\n insertNewCap srcSlot cptr x\n \\\\rv s. pspace_no_overlap' ptr sz s\\\"\n apply (clarsimp simp:insertNewCap_def)\n apply (rule hoare_pre)\n apply (wp updateMDB_pspace_no_overlap'\n setCTE_pspace_no_overlap' getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n done\n\nlemma insertNewCap_cte_at:\n \"\\cte_at' p\\ insertNewCap srcSlot q cap\n \\\\rv. cte_at' p\\\"\n apply (clarsimp simp:insertNewCap_def)\n apply (wp getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n done\n\nlemma createObject_invs':\n \"\\\\s. invs' s \\ ct_active' s \\ pspace_no_overlap' ptr (APIType_capBits ty us) s\n \\ caps_no_overlap'' ptr (APIType_capBits ty us) s \\ ptr \\ 0 \\\n caps_overlap_reserved' {ptr..ptr + 2 ^ APIType_capBits ty us - 1} s \\\n (ty = APIObjectType apiobject_type.CapTableObject \\ 0 < us) \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us \\ maxUntypedSizeBits \\\n canonical_address ptr \\ ptr \\ kernel_mappings \\\n {ptr..ptr + 2 ^ APIType_capBits ty us - 1} \\ kernel_data_refs = {} \\\n 0 < gsMaxObjectSize s\n \\ createObject ty ptr us dev\\\\r s. invs' s \\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply (wp createNewCaps_invs'[where sz = \"APIType_capBits ty us\"])\n apply (subgoal_tac \"APIType_capBits ty us < word_bits\")\n apply (clarsimp simp: range_cover_full invs_pspace_in_kernel_mappings' pspace_in_kernel_mappings'_def)\n apply (fastforce simp: untypedBits_defs word_bits_def)\n done\n\nlemma createObject_sch_act_simple[wp]:\n \"\\\\s. sch_act_simple s\n \\createObject ty ptr us dev\\\\r s. sch_act_simple s \\\"\n apply (simp add:sch_act_simple_def)\n apply wp\n done\n\nlemma createObject_ct_active'[wp]:\n \"\\\\s. ct_active' s \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr (APIType_capBits ty us) s\n \\ is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\createObject ty ptr us dev\\\\r s. ct_active' s \\\"\n apply (simp add:ct_in_state'_def createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply wps\n apply (wp createNewCaps_pred_tcb_at')\n apply (intro conjI)\n apply (auto simp:range_cover_full)\n done\n\nlemma createObject_notZombie[wp]:\n \"\\\\\\createObject ty ptr us dev \\\\r s. \\ isZombie r\\\"\n apply (rule hoare_pre)\n apply (simp add:createObject_def)\n apply wpc\n apply (wp| clarsimp simp add:isCap_simps)+\n apply wpc\n apply (wp| clarsimp simp add:isCap_simps)+\n done\n\nlemma createObject_valid_cap':\n \"\\\\s. pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n valid_pspace' s \\\n is_aligned ptr (APIType_capBits ty us) \\ canonical_address ptr \\\n ptr \\ kernel_mappings \\\n APIType_capBits ty us < word_bits \\\n (ty = APIObjectType apiobject_type.CapTableObject \\ 0 < us \\ us \\ 42) \\\n (ty = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits) \\ ptr \\ 0\\\n createObject ty ptr us dev \\\\r s. s \\' r\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_valid_cap'[where sz = \"APIType_capBits ty us\"]])\n apply assumption\n apply clarsimp\n apply (clarsimp simp add:word_bits_conv range_cover_full)\n apply (cases ty; simp add: APIType_capBits_def maxUntypedSizeBits_def bit_simps)\n apply (rename_tac t, case_tac t; simp add: objBits_simps')\n done\n\nlemma createObject_untypedRange:\n assumes split:\n \"\\P\\ createObject ty ptr us dev\n \\\\m s. (toAPIType ty = Some apiobject_type.Untyped \\\n Q {ptr..ptr + 2 ^ us - 1} s) \\\n (toAPIType ty \\ Some apiobject_type.Untyped \\ Q {} s)\\\"\n shows \"\\P\\ createObject ty ptr us dev\\\\m s. Q (untypedRange m) s\\\"\n including no_pre\n using split\n apply (simp add: createObject_def)\n apply (case_tac \"toAPIType ty\")\n apply (simp add: split | wp)+\n apply (simp add: valid_def return_def bind_def split_def)\n apply (case_tac a, simp_all)\n apply (simp add: valid_def return_def simpler_gets_def simpler_modify_def\n bind_def split_def curDomain_def)+\n done\n\nlemma createObject_capRange:\nshows \"\\P\\createObject ty ptr us dev \\\\m s. capRange m = {ptr.. ptr + 2 ^ (APIType_capBits ty us) - 1}\\\"\n apply (simp add:createObject_def)\n apply (case_tac \"ty\")\n apply (simp_all add:toAPIType_def X64_H.toAPIType_def)\n apply (rule hoare_pre)\n apply wpc\n apply wp\n apply (simp add:split untypedRange.simps objBits_simps capRange_def APIType_capBits_def | wp)+\n apply (wpsimp simp: X64_H.createObject_def capRange_def APIType_capBits_def\n bit_simps acapClass.simps)+\n done\n\nlemma createObject_capRange_helper:\nassumes static: \"\\P\\createObject ty ptr us dev \\\\m s. Q {ptr.. ptr + 2 ^ (APIType_capBits ty us) - 1} s\\\"\nshows \"\\P\\createObject ty ptr us dev \\\\m s. Q (capRange m) s\\\"\n apply (rule hoare_pre)\n apply (rule hoare_strengthen_post[OF hoare_vcg_conj_lift])\n apply (rule static)\n apply (rule createObject_capRange)\n apply simp\n apply simp\n done\n\nlemma createObject_caps_overlap_reserved':\n \"\\\\s. caps_overlap_reserved' S s \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\createObject ty ptr us dev \\\\rv. caps_overlap_reserved' S\\\"\n apply (simp add:createObject_def3)\n apply (wp createNewCaps_caps_overlap_reserved'[where sz = \"APIType_capBits ty us\"])\n apply (clarsimp simp:range_cover_full)\n done\n\nlemma createObject_caps_overlap_reserved_ret':\n \"\\\\s. caps_overlap_reserved' {ptr..ptr + 2 ^ APIType_capBits ty us - 1} s \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\createObject ty ptr us dev \\\\rv. caps_overlap_reserved' (untypedRange rv)\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_caps_overlap_reserved_ret'[where sz = \"APIType_capBits ty us\"]])\n apply assumption\n apply (rename_tac rv s)\n apply (case_tac rv,simp)\n apply clarsimp\n apply (erule caps_overlap_reserved'_subseteq)\n apply (rule untypedRange_in_capRange)\n apply (clarsimp simp add:word_bits_conv range_cover_full)\n done\n\nlemma createObject_descendants_range':\n \"\\\\s. descendants_range_in' {ptr..ptr + 2 ^ APIType_capBits ty us - 1} q (ctes_of s) \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\createObject ty ptr us dev \\\\rv s. descendants_range' rv q (ctes_of s)\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_descendants_range_ret'[where sz = \"APIType_capBits ty us\"]])\n apply assumption\n apply fastforce\n apply (clarsimp simp add:word_bits_conv range_cover_full)\n done\n\nlemma createObject_descendants_range_in':\n \"\\\\s. descendants_range_in' S q (ctes_of s) \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\createObject ty ptr us dev \\\\rv s. descendants_range_in' S q (ctes_of s)\\\"\n apply (simp add:createObject_def3 descendants_range_in'_def2)\n apply (wp createNewCaps_null_filter')\n apply clarsimp\n apply (intro conjI)\n apply simp\n apply (simp add:range_cover_full)\n done\n\nlemma createObject_idlethread_range:\n \"\\\\s. is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\ ksIdleThread s \\ {ptr..ptr + 2 ^ (APIType_capBits ty us) - 1}\\\n createObject ty ptr us dev \\\\cap s. ksIdleThread s \\ capRange cap\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_idlethread_ranges[where sz = \"APIType_capBits ty us\"]])\n apply assumption\n apply clarsimp\n apply (clarsimp simp:word_bits_conv range_cover_full)\n done\n\nlemma caps_overlap_reserved_empty'[simp]:\n \"caps_overlap_reserved' {} s = True\"\n by (simp add:caps_overlap_reserved'_def)\n\nlemma createObject_IRQHandler:\n \"\\\\\\ createObject ty ptr us dev\n \\\\rv s. rv = IRQHandlerCap x \\ P rv s x\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_IRQHandler[where irq = x and P = \"\\_ _. False\"]])\n apply assumption\n apply (rename_tac rv s)\n apply (case_tac rv; clarsimp)\n apply (clarsimp simp:word_bits_conv)\n done\n\nlemma createObject_capClass[wp]:\n \"\\ \\s. is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits\n \\ createObject ty ptr us dev\n \\\\rv s. capClass rv = PhysicalClass\\\"\n apply (simp add:createObject_def3)\n apply (rule hoare_pre)\n apply wp\n apply (rule_tac Q = \"\\r s. r \\ [] \\ Q r s\" for Q in hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF createNewCaps_ret_len])\n apply clarsimp\n apply (rule hoare_strengthen_post[OF createNewCaps_range_helper])\n apply assumption\n apply (rename_tac rv s)\n apply (case_tac rv; clarsimp)\n apply (clarsimp simp:word_bits_conv )\n apply (rule range_cover_full)\n apply (simp add:word_bits_conv)+\n done\n\nlemma createObject_child:\n \"\\\\s.\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits \\\n {ptr .. ptr + (2^APIType_capBits ty us) - 1} \\ (untypedRange cap) \\ isUntypedCap cap\n \\ createObject ty ptr us dev\n \\\\rv s. sameRegionAs cap rv\\\"\n apply (rule hoare_assume_pre)\n apply (simp add:createObject_def3)\n apply wp\n apply (rule hoare_chain [OF createNewCaps_range_helper[where sz = \"APIType_capBits ty us\"]])\n apply (fastforce simp:range_cover_full)\n apply clarsimp\n apply (drule_tac x = ptr in spec)\n apply (case_tac \"(capfn ptr)\")\n apply (simp_all add: capUntypedPtr_def sameRegionAs_def Let_def isCap_simps)+\n apply clarsimp+\n apply (rename_tac arch_capability d v0 v1 f)\n apply (simp add: X64_H.capUntypedSize_def bit_simps)+\n apply (case_tac arch_capability,\n auto simp: X64_H.capUntypedSize_def bit_simps\n is_aligned_no_wrap' add.commute[where b=ptr]\n split: arch_capability.split)\n done\n\nlemma createObject_parent_helper:\n \"\\\\s. cte_wp_at' (\\cte. isUntypedCap (cteCap cte)\n \\ {ptr .. ptr + (2^APIType_capBits ty us) - 1} \\ untypedRange (cteCap cte)) p s \\\n pspace_aligned' s \\\n pspace_distinct' s \\\n pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n is_aligned ptr (APIType_capBits ty us) \\ APIType_capBits ty us < word_bits \\\n (ty = APIObjectType apiobject_type.CapTableObject \\ 0 < us)\n \\\n createObject ty ptr us dev\n \\\\rv. cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\ (sameRegionAs (cteCap cte) rv)) p\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\cte. cte_wp_at' ((=) cte) p s\n \\ isUntypedCap (cteCap cte) \\\n sameRegionAs (cteCap cte) rv\"])\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (wp hoare_vcg_ex_lift)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add:createObject_def3)\n apply (wp createNewCaps_cte_wp_at')\n apply (wp createObject_child)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (intro conjI)\n apply (erule range_cover_full)\n apply simp\n apply simp\n done\n\nlemma insertNewCap_untypedRange:\n \"\\\\s. cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\ P untypedRange (cteCap cte)) srcSlot s\\\n insertNewCap srcSlot destSlot x\n \\\\rv s. cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\ P untypedRange (cteCap cte)) srcSlot s\\\"\n apply (simp add:insertNewCap_def)\n apply (wp updateMDB_weak_cte_wp_at setCTE_cte_wp_at_other getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n done\n\nlemma createObject_caps_no_overlap'':\n \" \\\\s. caps_no_overlap'' (ptr + (1 + of_nat n << APIType_capBits newType userSize))\n sz s \\\n pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' (ptr + (of_nat n << APIType_capBits newType userSize)) (APIType_capBits newType userSize) s\n \\ is_aligned ptr (APIType_capBits newType userSize)\n \\ APIType_capBits newType userSize < word_bits\\\n createObject newType (ptr + (of_nat n << APIType_capBits newType userSize)) userSize dev\n \\\\rv s. caps_no_overlap'' (ptr + (1 + of_nat n << APIType_capBits newType userSize))\n sz s \\\"\n apply (clarsimp simp:createObject_def3 caps_no_overlap''_def2)\n apply (wp createNewCaps_null_filter')\n apply clarsimp\n apply (intro conjI)\n apply simp\n apply (rule range_cover_full)\n apply (erule aligned_add_aligned)\n apply (rule is_aligned_shiftl_self)\n apply simp\n apply simp\n done\n\nlemma createObject_ex_cte_cap_wp_to:\n \"\\\\s. ex_cte_cap_wp_to' P p s \\ is_aligned ptr (APIType_capBits ty us) \\ pspace_aligned' s\n \\ pspace_distinct' s \\ (APIType_capBits ty us) < word_bits \\ pspace_no_overlap' ptr (APIType_capBits ty us) s \\\n createObject ty ptr us dev\n \\\\rv s. ex_cte_cap_wp_to' P p s \\\"\n apply (clarsimp simp:ex_cte_cap_wp_to'_def createObject_def3)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift)\n apply wps\n apply (wp createNewCaps_cte_wp_at')\n apply clarsimp\n apply (intro exI conjI)\n apply assumption\n apply (rule range_cover_full)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply simp\n apply simp\n done\n\nlemma range_cover_one:\n \"\\is_aligned (ptr :: 'a :: len word) us; us\\ sz;sz < len_of TYPE('a)\\\n \\ range_cover ptr sz us (Suc 0)\"\n apply (clarsimp simp:range_cover_def)\n apply (rule Suc_leI)\n apply (rule unat_less_power)\n apply simp\n apply (rule shiftr_less_t2n)\n apply simp\n apply (rule le_less_trans[OF word_and_le1])\n apply (simp add:mask_def)\n done\n\nlemma createObject_no_inter:\nnotes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\nshows\n \"\\\\s. range_cover ptr sz (APIType_capBits newType userSize) (n + 2) \\ ptr \\ 0\\\n createObject newType (ptr + (of_nat n << APIType_capBits newType userSize)) userSize dev\n \\\\rv s. untypedRange rv \\\n {ptr + (1 + of_nat n << APIType_capBits newType userSize) ..\n ptrend } =\n {}\\\"\n apply (rule createObject_untypedRange)\n apply (clarsimp | wp)+\n apply (clarsimp simp: blah toAPIType_def APIType_capBits_def\n X64_H.toAPIType_def split: object_type.splits)\n apply (clarsimp simp:shiftl_t2n field_simps)\n apply (drule word_eq_zeroI)\n apply (drule(1) range_cover_no_0[where p = \"Suc n\"])\n apply simp\n apply (simp add:field_simps)\n done\n\nlemma range_cover_bound'':\n \"\\range_cover ptr sz us n; x < of_nat n\\\n \\ ptr + x * 2 ^ us + 2 ^ us - 1 \\ (ptr && ~~ mask sz) + 2 ^ sz - 1\"\n apply (frule range_cover_cell_subset)\n apply assumption\n apply (drule(1) range_cover_subset_not_empty)\n apply (clarsimp simp: field_simps)\n done\n\nlemma caps_no_overlap''_cell:\n \"\\range_cover ptr sz us n;caps_no_overlap'' ptr sz s;p < n\\\n \\ caps_no_overlap'' (ptr + (of_nat p << us)) us s\"\n apply (clarsimp simp:caps_no_overlap''_def)\n apply (drule(1) bspec)\n apply (subgoal_tac \"{ptr + (of_nat p << us)..(ptr + (of_nat p << us) && ~~ mask us) + 2 ^ us - 1}\n \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply (erule impE)\n apply (rule ccontr)\n apply clarify\n apply (drule(1) disjoint_subset2[rotated -1])\n apply simp\n apply (erule subsetD)+\n apply simp\n apply (subst is_aligned_neg_mask_eq)\n apply (rule aligned_add_aligned[OF range_cover.aligned],assumption)\n apply (simp add:is_aligned_shiftl_self)\n apply (simp add:range_cover_sz')\n apply simp\n apply (frule range_cover_cell_subset[where x = \"of_nat p\"])\n apply (rule word_of_nat_less)\n apply (simp add:range_cover.unat_of_nat_n)\n apply (simp add:shiftl_t2n field_simps)\n done\n\nlemma caps_no_overlap''_le:\n \"\\caps_no_overlap'' ptr sz s;us \\ sz;sz < word_bits\\\n \\ caps_no_overlap'' ptr us s\"\n apply (clarsimp simp:caps_no_overlap''_def)\n apply (drule(1) bspec)\n apply (subgoal_tac \"{ptr..(ptr && ~~ mask us) + 2 ^ us - 1}\n \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply (erule impE)\n apply (rule ccontr)\n apply clarify\n apply (drule(1) disjoint_subset2[rotated -1])\n apply simp\n apply (erule subsetD)+\n apply simp\n apply clarsimp\n apply (frule neg_mask_diff_bound[where ptr = ptr])\n apply (simp add:p_assoc_help)\n apply (rule word_plus_mcs[where x = \"2 ^ us - 1 + (ptr && ~~ mask sz)\"])\n apply (simp add:field_simps)\n apply (simp add:field_simps)\n apply (simp add:p_assoc_help)\n apply (rule word_plus_mono_right)\n apply (simp add: word_bits_def)\n apply (erule two_power_increasing)\n apply simp\n apply (rule is_aligned_no_overflow')\n apply (simp add:is_aligned_neg_mask)\n done\n\nlemma caps_no_overlap''_le2:\n \"\\caps_no_overlap'' ptr sz s;ptr \\ ptr'; ptr' && ~~ mask sz = ptr && ~~ mask sz\\\n \\ caps_no_overlap'' ptr' sz s\"\n apply (clarsimp simp:caps_no_overlap''_def)\n apply (drule(1) bspec)\n apply (subgoal_tac \"{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}\n \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply (erule impE)\n apply (rule ccontr)\n apply clarify\n apply (drule(1) disjoint_subset2[rotated -1])\n apply simp\n apply (erule subsetD)+\n apply simp\n apply clarsimp\n done\n\nlemma range_cover_head_mask:\n \"\\range_cover (ptr :: machine_word) sz us (Suc n); ptr \\ 0\\\n \\ ptr + (of_nat n << us) && ~~ mask sz = ptr && ~~ mask sz\"\n apply (case_tac n)\n apply clarsimp\n apply (clarsimp simp:range_cover_tail_mask)\n done\n\nlemma pspace_no_overlap'_strg:\n \"pspace_no_overlap' ptr sz s \\ sz' \\ sz \\ sz < word_bits \\ pspace_no_overlap' ptr sz' s\"\n apply clarsimp\n apply (erule(2) pspace_no_overlap'_le)\n done\n\nlemma cte_wp_at_no_0:\n \"\\invs' s; cte_wp_at' (\\_. True) ptr s\\ \\ ptr \\ 0\"\n by (clarsimp dest!:invs_mdb' simp:valid_mdb'_def valid_mdb_ctes_def no_0_def cte_wp_at_ctes_of)\n\nlemma insertNewCap_descendants_range_in':\n \"\\\\s. valid_pspace' s \\ descendants_range_in' S p (ctes_of s)\n \\ capRange x \\ S = {}\n \\ cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\ sameRegionAs (cteCap cte) x) p s\n \\ cte_wp_at' (\\cte. cteCap cte = capability.NullCap) dslot s\n \\ descendants_range' x p (ctes_of s) \\ capClass x = PhysicalClass\n \\ insertNewCap p dslot x\n \\\\rv s. descendants_range_in' S p (ctes_of s)\\\"\n apply (clarsimp simp:insertNewCap_def descendants_range_in'_def)\n apply (wp getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n apply (intro conjI allI)\n apply (clarsimp simp:valid_pspace'_def valid_mdb'_def\n valid_mdb_ctes_def no_0_def split:if_splits)\n apply (clarsimp simp: descendants_of'_mdbPrev split:if_splits)\n apply (cut_tac p = p and m = \"ctes_of s\" and parent = p and s = s\n and parent_cap = \"cteCap cte\" and parent_node = \"cteMDBNode cte\"\n and site = dslot and site_cap = capability.NullCap and site_node = \"cteMDBNode ctea\"\n and c' = x\n in mdb_insert_again_child.descendants)\n apply (case_tac cte ,case_tac ctea)\n apply (rule mdb_insert_again_child.intro[OF mdb_insert_again.intro])\n apply (simp add:mdb_ptr_def vmdb_def valid_pspace'_def valid_mdb'_def\n mdb_ptr_axioms_def mdb_insert_again_axioms_def )+\n apply (intro conjI allI impI)\n apply clarsimp\n apply (erule(1) ctes_of_valid_cap')\n apply (clarsimp simp:valid_mdb_ctes_def)\n apply clarsimp\n apply (rule mdb_insert_again_child_axioms.intro)\n apply (clarsimp simp: nullPointer_def)+\n apply (clarsimp simp:isMDBParentOf_def valid_pspace'_def\n valid_mdb'_def valid_mdb_ctes_def)\n apply (frule(2) ut_revocableD'[rotated 1])\n apply (clarsimp simp:isCap_simps)\n apply (clarsimp cong: if_cong)\n done\n\nlemma insertNewCap_cte_wp_at_other:\n \"\\cte_wp_at' (\\cte. P (cteCap cte)) p and K (slot \\ p)\\ insertNewCap srcSlot slot x\n \\\\rv. cte_wp_at' (\\cte. P (cteCap cte)) p \\\"\n apply (clarsimp simp:insertNewCap_def)\n apply (wp updateMDB_weak_cte_wp_at setCTE_cte_wp_at_other getCTE_wp)\n apply (clarsimp simp:cte_wp_at_ctes_of)\n done\n\nlemma range_cover_bound3:\n \"\\range_cover ptr sz us n; x < of_nat n\\\n \\ ptr + x * 2 ^ us + 2 ^ us - 1 \\ ptr + (of_nat n) * 2 ^ us - 1\"\n apply (frule range_cover_subset[where p = \"unat x\"])\n apply (simp add:unat_less_helper)\n apply (rule ccontr,simp)\n apply (drule(1) range_cover_subset_not_empty)\n apply (clarsimp simp: field_simps)\n done\n\nlemma range_cover_gsMaxObjectSize:\n \"cte_wp_at' (\\cte. cteCap cte = UntypedCap dev (ptr &&~~ mask sz) sz idx) srcSlot s\n \\ range_cover ptr sz (APIType_capBits newType userSize) (length destSlots)\n \\ valid_global_refs' s\n \\ unat num = length destSlots\n \\ unat (num << (APIType_capBits newType userSize) :: machine_word) \\ gsMaxObjectSize s\n \\ 2 ^ APIType_capBits newType userSize \\ gsMaxObjectSize s\"\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule (1) valid_global_refsD_with_objSize)\n apply clarsimp\n apply (rule conjI)\n apply (frule range_cover.range_cover_compare_bound)\n apply (drule range_cover.unat_of_nat_n_shift, rule order_refl)\n apply (drule_tac s=\"unat num\" in sym)\n apply simp\n apply (clarsimp simp: range_cover_def)\n apply (erule order_trans[rotated])\n apply simp\n done\n\nlemma APIType_capBits_min:\n \"(tp = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ userSize)\n \\ 4 \\ APIType_capBits tp userSize\"\n by (simp add: APIType_capBits_def objBits_simps' bit_simps untypedBits_defs\n split: object_type.split ArchTypes_H.apiobject_type.split)\n\nend\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma createNewCaps_1_gsCNodes_p:\n \"\\\\s. P (gsCNodes s p) \\ p \\ ptr\\ createNewCaps newType ptr 1 n dev\\\\rv s. P (gsCNodes s p)\\\"\n apply (simp add: createNewCaps_def)\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' | wpc | simp add: createObjects_def)+\n done\n\nlemma createObject_gsCNodes_p:\n \"\\\\s. P (gsCNodes s p) \\ p \\ ptr\\ createObject t ptr sz dev\\\\rv s. P (gsCNodes s p)\\\"\n apply (simp add: createObject_def)\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' | wpc | simp add: createObjects_def)+\n done\n\nlemma createObject_cnodes_have_size:\n \"\\\\s. is_aligned ptr (APIType_capBits newType userSize)\n \\ cnodes_retype_have_size R (APIType_capBits newType userSize) (gsCNodes s)\\\n createObject newType ptr userSize dev\n \\\\rv s. cnodes_retype_have_size R (APIType_capBits newType userSize) (gsCNodes s)\\\"\n apply (simp add: createObject_def)\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' | wpc | simp add: createObjects_def)+\n apply (cases newType, simp_all add: X64_H.toAPIType_def)\n apply (clarsimp simp: APIType_capBits_def objBits_simps'\n cnodes_retype_have_size_def cte_level_bits_def\n split: if_split_asm)\n done\n\nlemma range_cover_not_in_neqD:\n \"\\ x \\ {ptr..ptr + (of_nat n << APIType_capBits newType userSize) - 1};\n range_cover ptr sz (APIType_capBits newType userSize) n; n' < n \\\n \\ x \\ ptr + (of_nat n' << APIType_capBits newType userSize)\"\n apply (clarsimp simp only: shiftl_t2n mult.commute)\n apply (erule notE, rule subsetD, erule_tac p=n' in range_cover_subset)\n apply simp+\n apply (rule is_aligned_no_overflow)\n apply (rule aligned_add_aligned)\n apply (erule range_cover.aligned)\n apply (simp add: is_aligned_mult_triv2)\n apply simp\n done\n\ncrunch gsMaxObjectSize[wp]: createObject \"\\s. P (gsMaxObjectSize s)\"\n (simp: crunch_simps unless_def wp: crunch_wps)\n\nend\n\ncontext kernel_m begin\n\nlemma ceqv_restore_as_guard:\n \"ceqv Gamma xf' rv' t t' d (Guard C_Guard {s. xf' s = rv'} d)\"\n apply (simp add: ceqv_def)\n apply (auto elim!: exec_Normal_elim_cases intro: exec.Guard)\n done\n\nlemma insertNewCap_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call insertNewCap_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' s t}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (rule allI, rule conseqPre, vcg exspec=mdb_node_ptr_set_mdbPrev_preserves_bytes\n exspec=mdb_node_ptr_set_mdbNext_preserves_bytes\n exspec=mdb_node_get_mdbNext_modifies exspec=mdb_node_new_modifies)\n apply (safe intro!: byte_regions_unmodified_hrs_mem_update\n elim!: byte_regions_unmodified_trans byte_regions_unmodified_trans[rotated],\n simp_all add: h_t_valid_field)\n done\n\nlemma byte_regions_unmodified_flip_eq:\n \"byte_regions_unmodified hrs' hrs\n \\ hrs_htd hrs' = hrs_htd hrs\n \\ byte_regions_unmodified hrs hrs'\"\n by (simp add: byte_regions_unmodified_def)\n\nlemma insertNewCap_preserves_bytes_flip:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call insertNewCap_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' t s}\"\n by (rule allI, rule conseqPost,\n rule insertNewCap_preserves_bytes[rule_format],\n auto elim: byte_regions_unmodified_flip_eq)\n\nlemma copyGlobalMappings_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call copyGlobalMappings_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' s t}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (clarsimp simp only: whileAnno_def)\n apply (subst whileAnno_def[symmetric, where V=undefined\n and I=\"{t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' s t}\" for s])\n apply (rule conseqPre, vcg)\n apply (safe intro!: byte_regions_unmodified_hrs_mem_update\n elim!: byte_regions_unmodified_trans byte_regions_unmodified_trans[rotated],\n (simp_all add: h_t_valid_field)+)\n done\n\nlemma hrs_htd_update_canon:\n \"hrs_htd_update (\\_. f (hrs_htd hrs)) hrs = hrs_htd_update f hrs\"\n by (cases hrs, simp add: hrs_htd_update_def hrs_htd_def)\n\nlemma Arch_createObject_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call Arch_createObject_'proc\n {t. \\nt. t_' s = object_type_from_H nt\n \\ (\\x \\ - {ptr_val (regionBase_' s) ..+ 2 ^ getObjectSize nt (unat (userSize_' s))}.\n hrs_htd (t_hrs_' (globals t)) x = hrs_htd (t_hrs_' (globals s)) x)\n \\ byte_regions_unmodified' t s}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply clarsimp\n apply (rule conseqPre,\n vcg exspec=cap_frame_cap_new_modifies\n exspec=cap_page_table_cap_new_modifies\n exspec=addrFromPPtr_modifies\n exspec=cap_page_directory_cap_new_modifies\n exspec=copyGlobalMappings_preserves_bytes)\n apply (safe intro!: byte_regions_unmodified_hrs_mem_update)\n apply (simp_all add: h_t_valid_field hrs_htd_update)\n apply (safe intro!: ptr_retyp_d ptr_retyps_out)\n apply (simp_all add: object_type_from_H_def Kernel_C_defs APIType_capBits_def bit_simps\n split: object_type.split_asm ArchTypes_H.apiobject_type.split_asm)\n apply (rule byte_regions_unmodified_flip, simp)\n apply (rule byte_regions_unmodified_trans[rotated], assumption)\n apply (simp_all add: hrs_htd_update_canon hrs_htd_update)\n done\n\nlemma ptr_arr_retyps_eq_outside_dom:\n \"x \\ {ptr_val (p :: 'a ptr) ..+ n * size_of TYPE ('a :: wf_type)}\n \\ ptr_arr_retyps n p htd x = htd x\"\n by (simp add: ptr_arr_retyps_def htd_update_list_same2)\n\nlemma Arch_initFpuContext_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call Arch_initFpuContext_'proc\n {t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' t s}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply (rule allI, rule conseqPre, vcg, clarsimp)\n apply (intro byte_regions_unmodified_hrs_mem_update byte_regions_unmodified_refl)\n apply (simp_all add: typ_heap_simps)\n done\n\ncontext begin\n\nprivate abbreviation\n \"preserves_bytes_inv P s \\\n {t. P s \\ P t \\ hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))\n \\ byte_regions_unmodified' t s}\"\n\nprivate lemma preserves_bytes_modifies_inv_prop:\n \"modifies_inv_prop (preserves_bytes_inv P)\"\n by (clarsimp simp: modifies_inv_prop_def modifies_inv_refl_def modifies_inv_incl_def\n byte_regions_unmodified_def)\n\nprivate abbreviation\n \"registers_Ptr_valid \\ \\s. s \\\\<^sub>c registers_Ptr &(context_' s\\[''registers_C''])\"\n\nprivate lemmas registers_modifies_inv_intros =\n modifies_inv_intros[OF preserves_bytes_modifies_inv_prop[where P=\"registers_Ptr_valid\"]]\n\nprivate method preserves_bytes_inv methods vcg =\n (hoare_rule HoarePartial.ProcNoRec1;\n intro allI registers_modifies_inv_intros;\n clarsimp;\n (rule conseqPre, vcg);\n clarsimp;\n rule byte_regions_unmodified_hrs_mem_update;\n clarsimp simp: typ_heap_simps)\n\nlemma Mode_initContext_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call Mode_initContext_'proc (preserves_bytes_inv registers_Ptr_valid s)\"\n by (preserves_bytes_inv \\vcg\\)\n\nlemma Arch_initContext_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call Arch_initContext_'proc (preserves_bytes_inv registers_Ptr_valid s)\"\n by (preserves_bytes_inv \\vcg exspec=Mode_initContext_preserves_bytes\n exspec=Arch_initFpuContext_preserves_bytes\\)\n\nend\n\nlemma createObject_preserves_bytes:\n \"\\s. \\\\\\<^bsub>/UNIV\\<^esub> {s} Call createObject_'proc\n {t. \\nt. t_' s = object_type_from_H nt\n \\ (\\x \\ - {ptr_val (regionBase_' s) ..+ 2 ^ getObjectSize nt (unat (userSize_' s))}.\n hrs_htd (t_hrs_' (globals t)) x = hrs_htd (t_hrs_' (globals s)) x)\n \\ byte_regions_unmodified' t s}\"\n apply (hoare_rule HoarePartial.ProcNoRec1)\n apply clarsimp\n apply (rule conseqPre,\n vcg exspec=Arch_createObject_preserves_bytes\n exspec=cap_thread_cap_new_modifies\n exspec=cap_endpoint_cap_new_modifies\n exspec=cap_notification_cap_new_modifies\n exspec=cap_cnode_cap_new_modifies\n exspec=cap_untyped_cap_new_modifies\n exspec=Arch_initContext_preserves_bytes)\n apply (safe intro!: byte_regions_unmodified_hrs_mem_update,\n simp_all add: h_t_valid_field hrs_htd_update)\n apply (safe intro!: ptr_retyp_d ptr_retyps_out trans[OF ptr_retyp_d ptr_retyp_d]\n ptr_arr_retyps_eq_outside_dom)\n apply (simp_all add: object_type_from_H_def Kernel_C_defs APIType_capBits_def\n objBits_simps' cte_C_size power_add ctcb_offset_def ctcb_size_bits_def\n byte_regions_unmodified_def\n split: object_type.split_asm ArchTypes_H.apiobject_type.split_asm)\n apply (erule notE, erule subsetD[rotated], rule intvl_start_le intvl_sub_offset, simp)+\n done\n\nlemma offset_intvl_first_chunk_subsets:\n \"range_cover (p :: addr) sz bits n\n \\ i < of_nat n\n \\ {p + (i << bits) ..+ 2 ^ bits} \\ {p + (i << bits) ..+ (n - unat i) * 2 ^ bits}\n \\ {p + ((i + 1) << bits) ..+ (n - unat (i + 1)) * 2 ^ bits}\n \\ {p + (i << bits) ..+ (n - unat i) * 2 ^ bits}\n \\ {p + (i << bits) ..+ 2 ^ bits}\n \\ {p + ((i + 1) << bits) ..+ (n - unat (i + 1)) * 2 ^ bits}\n = {}\"\n apply (strengthen intvl_start_le)\n apply (strengthen order_trans[OF _\n intvl_sub_offset[where x=\"2 ^ bits\" and y=\"(n - unat (i + 1)) * 2 ^ bits\"]])\n apply (frule range_cover_sz')\n apply (cut_tac n=i in unatSuc)\n apply unat_arith\n apply (simp add: word_shiftl_add_distrib field_simps TWO)\n apply (simp add: mult_Suc[symmetric] del: mult_Suc)\n apply (frule unat_less_helper)\n apply (cut_tac p=\"p + (i << bits)\" and k=\"2 ^ bits\"\n and z=\"(n - unat (i + 1)) * 2 ^ bits\" in init_intvl_disj)\n apply (simp add: field_simps)\n apply (drule range_cover.strong_times_64, simp)\n apply (simp add: addr_card_def word_bits_def card_word)\n apply (erule order_le_less_trans[rotated])\n apply (simp add: mult_Suc[symmetric] del: mult_Suc)\n apply (simp add: Int_commute field_simps)\n apply unat_arith\n done\n\nlemma offset_intvl_first_chunk_subsets_unat:\n \"range_cover (p :: addr) sz bits n\n \\ unat n' = n\n \\ i < of_nat n\n \\ {p + (i << bits) ..+ 2 ^ bits} \\ {p + (i << bits) ..+ unat (n' - i) * 2 ^ bits}\n \\ {p + ((i + 1) << bits) ..+ unat (n' - (i + 1)) * 2 ^ bits}\n \\ {p + (i << bits) ..+ unat (n' - i) * 2 ^ bits}\n \\ {p + (i << bits) ..+ 2 ^ bits}\n \\ {p + ((i + 1) << bits) ..+ unat (n' - (i + 1)) * 2 ^ bits}\n = {}\"\n apply (subgoal_tac \"unat (n' - (i + 1)) = unat n' - unat (i + 1)\n \\ unat (n' - i) = unat n' - unat i\")\n apply (frule(1) offset_intvl_first_chunk_subsets)\n apply simp\n apply (intro conjI unat_sub)\n apply (rule word_minus_one_le_leq, simp)\n apply (simp add: word_less_nat_alt unat_of_nat)\n apply (simp add: word_le_nat_alt word_less_nat_alt unat_of_nat)\n done\n\nlemma retype_offs_region_actually_is_zero_bytes:\n \"\\ ctes_of s p = Some cte; (s, s') \\ rf_sr; untyped_ranges_zero' s;\n cteCap cte = UntypedCap False (ptr &&~~ mask sz) sz idx;\n idx \\ unat (ptr && mask sz);\n range_cover ptr sz (getObjectSize newType userSize) num_ret \\\n \\ region_actually_is_zero_bytes ptr\n (num_ret * 2 ^ APIType_capBits newType userSize) s'\"\n using word_unat_mask_lt[where w=ptr and m=sz]\n apply -\n apply (frule range_cover.sz(1))\n apply (drule(2) ctes_of_untyped_zero_rf_sr)\n apply (simp add: untypedZeroRange_def max_free_index_def word_size)\n apply clarify\n apply (strengthen heap_list_is_zero_mono2[mk_strg I E]\n region_actually_is_bytes_subset[mk_strg I E])\n apply (simp add: getFreeRef_def word_size)\n apply (rule intvl_both_le)\n apply (rule order_trans, rule word_plus_mono_right, erule word_of_nat_le)\n apply (simp add: word_plus_and_or_coroll2 add.commute word_and_le2)\n apply (simp add: word_plus_and_or_coroll2 add.commute)\n apply (subst unat_plus_simple[THEN iffD1], rule is_aligned_no_wrap',\n rule is_aligned_neg_mask2)\n apply (rule word_of_nat_less, simp)\n apply (simp add: unat_of_nat_eq[OF order_less_trans, OF _ power_strict_increasing[where n=sz]]\n unat_sub[OF word_of_nat_le])\n apply (subst word_plus_and_or_coroll2[where x=ptr and w=\"mask sz\", symmetric])\n apply (subst unat_plus_simple[THEN iffD1],\n simp add: word_plus_and_or_coroll2 add.commute word_and_le2)\n apply simp\n apply (rule order_trans[rotated], erule range_cover.range_cover_compare_bound)\n apply simp\n done\n\nlemma createNewCaps_valid_cap_hd:\n \"\\\\s. pspace_no_overlap' ptr sz s \\\n valid_pspace' s \\ n \\ 0 \\\n sz \\ maxUntypedSizeBits \\ canonical_address ptr \\\n (ptr && ~~ mask sz) \\ kernel_mappings \\\n range_cover ptr sz (APIType_capBits ty us) n \\\n (ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us) \\\n (ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \\\n minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits) \\\n ptr \\ 0 \\\n createNewCaps ty ptr n us dev\n \\\\r s. s \\' hd r\\\"\n apply (cases \"n = 0\")\n apply simp\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createNewCaps_ret_len)\n apply (rule createNewCaps_valid_cap'[where sz=sz])\n apply (clarsimp simp: range_cover_n_wb canonical_address_neq_mask)\n apply simp\n done\n\nlemma insertNewCap_ccorres:\n \"ccorres dc xfdc (pspace_aligned' and pspace_canonical' and valid_mdb' and cte_wp_at' (\\_. True) slot\n and valid_objs' and valid_cap' cap)\n ({s. cap_get_tag (cap_' s) = scast cap_untyped_cap\n \\ (case untypedZeroRange (cap_to_H (the (cap_lift (cap_' s)))) of None \\ True\n | Some (a, b) \\ region_actually_is_zero_bytes a (unat ((b + 1) - a)) s)}\n \\ {s. ccap_relation cap (cap_' s)} \\ {s. parent_' s = Ptr parent}\n \\ {s. slot_' s = Ptr slot}) []\n (insertNewCap parent slot cap)\n (Call insertNewCap_'proc)\"\n (is \"ccorres _ _ ?P ?P' _ _ _\")\n apply (rule ccorres_guard_imp2, rule insertNewCap_ccorres1)\n apply (clarsimp simp: cap_get_tag_isCap)\n apply (clarsimp simp: ccap_relation_def map_option_Some_eq2)\n apply (simp add: untypedZeroRange_def Let_def)\n done\n\nlemma createObject_untyped_region_is_zero_bytes:\n \"\\\\. \\\\\\<^bsub>/UNIV\\<^esub> {s. let tp = (object_type_to_H (t_' s));\n sz = APIType_capBits tp (unat (userSize_' s))\n in (\\ to_bool (deviceMemory_' s)\n \\ region_actually_is_zero_bytes (ptr_val (regionBase_' s)) (2 ^ sz) s)\n \\ canonical_address (ptr_val (regionBase_' s))\n \\ sz < 64 \\ (tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \\ sz \\ minUntypedSizeBits)}\n Call createObject_'proc\n {t. cap_get_tag (ret__struct_cap_C_' t) = scast cap_untyped_cap\n \\ (case untypedZeroRange (cap_to_H (the (cap_lift (ret__struct_cap_C_' t)))) of None \\ True\n | Some (a, b) \\ region_actually_is_zero_bytes a (unat ((b + 1) - a)) t)}\"\n apply (rule allI, rule conseqPre, vcg exspec=copyGlobalMappings_modifies\n exspec=Arch_initContext_modifies)\n apply (clarsimp simp: cap_tag_defs Let_def)\n apply (simp add: cap_lift_untyped_cap cap_tag_defs cap_to_H_simps\n cap_untyped_cap_lift_def object_type_from_H_def)\n apply (simp add: untypedZeroRange_def split: if_split)\n apply (clarsimp simp: getFreeRef_def Let_def object_type_to_H_def APIType_capBits_def\n less_mask_eq word_less_nat_alt\n dest!: sign_extend_canonical_address[THEN iffD2, THEN sym])\n done\n\nlemma range_cover_n_le':\n \"range_cover ptr sz sbit n \\ 2 ^ sbit * n \\ 2 ^ sz\"\n \"range_cover ptr sz sbit n \\ n \\ 2 ^ sz\"\n unfolding atomize_conj atomize_imp\n apply (rule context_conjI, rule impI)\n apply (rule nat_le_power_trans, erule range_cover.range_cover_n_le, erule range_cover.sz)\n apply (erule tfl_imp_trans, rule impI)\n apply (erule le_trans[rotated])\n apply (rule rsubst[of \"\\r. r \\ 2 ^ sbit * n\", OF _ nat_mult_1])\n apply (rule mult_le_mono1, rule one_le_power, simp)\n done\n\nlemma createNewObjects_ccorres:\nnotes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\nand hoare_TrueI[simp add]\ndefines \"unat_eq a b \\ unat a = b\"\nshows \"ccorres dc xfdc\n (invs' and sch_act_simple and ct_active'\n and (cte_wp_at' (\\cte. cteCap cte = UntypedCap isdev (ptr && ~~ mask sz) sz idx) srcSlot)\n and (\\s. \\slot\\set destSlots. cte_wp_at' (\\c. cteCap c = NullCap) slot s)\n and (\\s. \\slot\\set destSlots. ex_cte_cap_wp_to' (\\_. True) slot s)\n and (\\s. \\n. gsCNodes s cnodeptr = Some n \\ unat start + length destSlots \\ 2 ^ n)\n and (pspace_no_overlap' ptr sz)\n and caps_no_overlap'' ptr sz\n and caps_overlap_reserved' {ptr .. ptr + of_nat (length destSlots) * 2^ (getObjectSize newType userSize) - 1}\n and (\\s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} srcSlot (ctes_of s))\n and cnodes_retype_have_size {ptr .. ptr + of_nat (length destSlots) * 2^ (getObjectSize newType userSize) - 1}\n (APIType_capBits newType userSize) o gsCNodes\n and (K (srcSlot \\ set destSlots\n \\ destSlots \\ []\n \\ range_cover ptr sz (getObjectSize newType userSize) (length destSlots)\n \\ ptr \\ 0\n \\ sz \\ maxUntypedSizeBits\n \\ APIType_capBits newType userSize \\ maxUntypedSizeBits\n \\ canonical_address (ptr && ~~ mask sz) \\ (ptr && ~~ mask sz) \\ kernel_mappings\n \\ {ptr .. ptr + of_nat (length destSlots) * 2^ (getObjectSize newType userSize) - 1}\n \\ kernel_data_refs = {}\n \\ cnodeptr \\ {ptr .. ptr + (of_nat (length destSlots) << APIType_capBits newType userSize) - 1}\n \\ 0 \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\n \\ is_aligned ptr 4\n \\ (newType = APIObjectType apiobject_type.Untyped \\ userSize \\ maxUntypedSizeBits)\n \\ (newType = APIObjectType apiobject_type.CapTableObject \\ userSize < 59)\n \\ (newType = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ userSize)\n \\ (newType = APIObjectType apiobject_type.CapTableObject \\ 0 < userSize)\n \\ (isdev \\ newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \\\n isFrameType newType)\n \\ (unat num = length destSlots)\n )))\n ({s. (\\ isdev \\ region_actually_is_zero_bytes ptr\n (length destSlots * 2 ^ APIType_capBits newType userSize) s)}\n \\ {s. t_' s = object_type_from_H newType}\n \\ {s. parent_' s = cte_Ptr srcSlot}\n \\ {s. destCNode_' s = cte_Ptr cnodeptr}\n \\ {s. destOffset_' s = start \\ (\\n. n < length destSlots \\ destSlots ! n = cnodeptr + ((start + of_nat n) * 0x20))}\n \\ {s. destLength_' s = num \\ unat num \\ 0}\n \\ {s. regionBase_' s = Ptr ptr }\n \\ {s. unat_eq (userSize_' s) userSize}\n \\ {s. deviceMemory_' s = from_bool isdev}\n ) []\n (createNewObjects newType srcSlot destSlots ptr userSize isdev)\n (Call createNewObjects_'proc)\"\n unfolding from_bool_to_bool_iff\n supply if_cong[cong]\n apply (rule ccorres_gen_asm_state)\n apply clarsimp\n apply (subgoal_tac \"unat (of_nat (getObjectSize newType userSize)) = getObjectSize newType userSize\")\n prefer 2\n apply (rule unat_of_nat64)\n apply (rule less_le_trans[OF getObjectSize_max_size]; clarsimp simp: word_bits_def untypedBits_defs)\n apply (subgoal_tac \"\\n < length destSlots. canonical_address (ptr + (of_nat n << APIType_capBits newType userSize))\")\n prefer 2 subgoal by (simp add: shiftl_t2n field_simps range_cover_canonical_address)\n apply (cinit lift: t_' parent_' destCNode_' destOffset_' destLength_' regionBase_' userSize_' deviceMemory_')\n apply (rule ccorres_rhs_assoc2)+\n apply (rule ccorres_rhs_assoc)\n apply (rule_tac Q' = \"Q'\n \\ {s. objectSize_' s = of_nat (APIType_capBits newType userSize)}\n \\ {s. nextFreeArea_' s = Ptr ptr } \"\n and R=\"(\\s. unat (num << (APIType_capBits newType userSize) :: machine_word)\n \\ gsMaxObjectSize s) and R''\"\n for Q' R'' in ccorres_symb_exec_r)\n apply (rule ccorres_guard_imp[where A=\"X and Q\"\n and A'=Q' and Q=Q and Q'=Q' for X Q Q', rotated]\n (* this moves the gsMaxObjectSize bit into the ccorres_symb_exec_r\n vcg proof *))\n apply clarsimp\n apply clarsimp\n apply (cinitlift objectSize_' nextFreeArea_')\n apply simp\n apply (clarsimp simp: whileAnno_def)\n apply (rule ccorres_rel_imp)\n apply (rule_tac Q=\"{s. \\ isdev \\ region_actually_is_zero_bytes\n (ptr + (i_' s << APIType_capBits newType userSize))\n (unat (num - i_' s) * 2 ^ APIType_capBits newType userSize) s}\"\n in ccorres_zipWithM_x_while_genQ[where j=1, OF _ _ _ _ _ i_xf_for_sequence, simplified])\n apply clarsimp\n apply (subst upt_enum_offset_trivial)\n apply (rule word_leq_le_minus_one)\n apply (rule word_of_nat_le)\n apply (drule range_cover.range_cover_n_less)\n apply (simp add:word_bits_def minus_one_norm)\n apply (erule range_cover_not_zero[rotated],simp)\n apply simp\n apply (rule ccorres_guard_impR)\n apply (rule_tac xf'=i_' in ccorres_abstract, ceqv)\n apply (rule_tac P=\"rv' = of_nat n\" in ccorres_gen_asm2, simp)\n apply (rule ccorres_rhs_assoc)+\n apply (rule ccorres_add_return)\n apply (simp only: dc_def[symmetric] hrs_htd_update)\n apply ((rule ccorres_Guard_Seq[where S=UNIV])+)?\n apply (rule ccorres_split_nothrow,\n rule_tac S=\"{ptr .. ptr + of_nat (length destSlots) * 2^ (getObjectSize newType userSize) - 1}\"\n in ccorres_typ_region_bytes_dummy, ceqv)\n apply (rule ccorres_Guard_Seq)+\n apply (ctac add:createObject_ccorres)\n apply (rule ccorres_move_array_assertion_cnode_ctes\n ccorres_move_c_guard_cte)+\n apply (rule ccorres_add_return2)\n apply (ctac (no_vcg) add: insertNewCap_ccorres)\n apply (rule ccorres_move_array_assertion_cnode_ctes\n ccorres_return_Skip')+\n apply wp\n apply (clarsimp simp: createObject_def3 conj_ac)\n apply (wp createNewCaps_valid_pspace_extras[where sz = sz]\n createNewCaps_cte_wp_at[where sz = sz]\n createNewCaps_valid_cap_hd[where sz = sz])\n apply (rule range_cover_one)\n apply (rule aligned_add_aligned[OF is_aligned_shiftl_self])\n apply (simp add:range_cover.aligned)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover.sz)\n apply (wp createNewCaps_1_gsCNodes_p[simplified]\n createNewCaps_cte_wp_at'[where sz=sz])[1]\n apply clarsimp\n apply (vcg exspec=createObject_untyped_region_is_zero_bytes)\n apply (simp add:size_of_def)\n apply (rule_tac P = \"\\s. cte_wp_at' (\\cte. isUntypedCap (cteCap cte) \\\n {ptr .. ptr + (of_nat (length destSlots)<< APIType_capBits newType userSize) - 1} \\ untypedRange (cteCap cte)) srcSlot s\n \\ pspace_no_overlap' ((of_nat n << APIType_capBits newType userSize) + ptr) sz s\n \\ caps_no_overlap'' ((of_nat n << APIType_capBits newType userSize) + ptr) sz s\n \\ caps_overlap_reserved' {(of_nat n << APIType_capBits newType userSize) +\n ptr.. ptr + of_nat (length destSlots) * 2^ (getObjectSize newType userSize) - 1 } s\n \\ kernel_data_refs \\ {ptr .. ptr + (of_nat (length destSlots) << APIType_capBits newType userSize) - 1} = {}\n \\ (\\n < length destSlots. cte_at' (cnodeptr + (start * 0x20 + of_nat n * 0x20)) s\n \\ ex_cte_cap_wp_to' (\\_. True) (cnodeptr + (start * 0x20 + of_nat n * 0x20)) s)\n \\ invs' s\n \\ 2 ^ APIType_capBits newType userSize \\ gsMaxObjectSize s\n \\ (\\cn. gsCNodes s cnodeptr = Some cn \\ unat start + length destSlots \\ 2 ^ cn)\n \\ cnodeptr \\ {ptr .. ptr + (of_nat (length destSlots)<< APIType_capBits newType userSize) - 1}\n \\ (\\k < length destSlots - n.\n cte_wp_at' (\\c. cteCap c = NullCap)\n (cnodeptr + (of_nat k * 0x20 + start * 0x20 + of_nat n * 0x20)) s)\n \\ descendants_range_in' {(of_nat n << APIType_capBits newType userSize) +\n ptr.. (ptr && ~~ mask sz) + 2 ^ sz - 1} srcSlot (ctes_of s)\"\n in hoare_pre(1))\n apply wp\n apply (clarsimp simp:createObject_hs_preconds_def conj_comms add.commute[where b=ptr]\n invs_valid_pspace' invs_pspace_distinct' invs_pspace_aligned'\n invs_pspace_canonical' invs_ksCurDomain_maxDomain')\n apply (subst intvl_range_conv)\n apply (rule aligned_add_aligned[OF range_cover.aligned],assumption)\n subgoal by (simp add:is_aligned_shiftl_self)\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems\n by (simp_all add: range_cover_sz'[where 'a=machine_word_len, folded word_bits_def]\n word_bits_def range_cover_def)\n apply (simp add: range_cover_not_in_neqD canonical_address_neq_mask)\n apply (intro conjI)\n apply (drule_tac p = n in range_cover_no_0)\n apply (simp add:shiftl_t2n mult.commute)+\n apply (cut_tac x=num in unat_lt2p, simp)\n apply (simp add: unat_arith_simps unat_of_nat, simp split: if_split)\n apply (intro impI, erule order_trans[rotated], simp)\n apply (erule pspace_no_overlap'_le)\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems\n by (simp add:range_cover.sz[where 'a=machine_word_len, folded word_bits_def])+\n subgoal by (simp add: range_cover_neg_mask_offset)\n apply (rule range_cover_one)\n apply (rule aligned_add_aligned[OF range_cover.aligned],assumption)\n apply (simp add: is_aligned_shiftl_self)\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems\n by (simp add: range_cover_sz'[where 'a=machine_word_len, folded word_bits_def]\n range_cover.sz[where 'a=machine_word_len, folded word_bits_def])+\n apply (simp add: word_bits_def range_cover_def)\n apply (rule range_cover_full)\n apply (rule aligned_add_aligned[OF range_cover.aligned],assumption)\n apply (simp add:is_aligned_shiftl_self)\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems\n by (simp add: range_cover_sz'[where 'a=machine_word_len, folded word_bits_def]\n range_cover.sz[where 'a=machine_word_len, folded word_bits_def])+\n apply (erule caps_overlap_reserved'_subseteq)\n apply (frule_tac x=\"of_nat n\" in range_cover_bound3)\n apply (rule word_of_nat_less)\n apply (simp add: range_cover.unat_of_nat_n)\n apply (clarsimp simp: shiftl_t2n blah mult.commute)\n apply (erule disjoint_subset[rotated])\n apply (rule_tac p1 = n in subset_trans[OF _ range_cover_subset])\n apply (simp add: upto_intvl_eq is_aligned_add range_cover.aligned is_aligned_shiftl)\n apply (simp add: shiftl_t2n mult.commute)\n apply simp+\n apply (erule caps_overlap_reserved'_subseteq)\n apply (frule_tac x = \"of_nat n\" in range_cover_bound3)\n apply (rule word_of_nat_less)\n apply (simp add: range_cover.unat_of_nat_n)\n apply (clarsimp simp: shiftl_t2n blah mult.commute)\n apply (clarsimp simp: createObject_c_preconds_def add.commute[where b=ptr] from_bool_to_bool_iff\n cong: region_is_bytes_cong)\n apply vcg\n apply (clarsimp simp: cte_C_size conj_comms untypedBits_defs)\n apply (simp cong: conj_cong)\n apply (intro conjI impI)\n apply (simp add: unat_eq_def)\n apply (drule range_cover_sz')\n apply (simp add: unat_eq_def word_less_nat_alt)\n apply (simp add: hrs_htd_update typ_region_bytes_actually_is_bytes)\n apply clarsimp\n apply (erule heap_list_is_zero_mono)\n apply (subgoal_tac \"unat (num - of_nat n) \\ 0\")\n apply simp\n apply (simp only: unat_eq_0, clarsimp simp: unat_of_nat)\n apply (frule range_cover_sz')\n apply (clarsimp simp: Let_def hrs_htd_update\n APIType_capBits_def[where ty=\"APIObjectType ArchTypes_H.apiobject_type.Untyped\"])\n apply (simp, subst range_cover.unat_of_nat_n)\n apply (erule range_cover_le)\n subgoal by simp\n subgoal by (simp add:word_unat.Rep_inverse')\n apply clarsimp\n apply (rule conseqPre, vcg exspec=insertNewCap_preserves_bytes_flip\n exspec=createObject_preserves_bytes)\n apply (clarsimp simp del: imp_disjL)\n apply (frule(1) offset_intvl_first_chunk_subsets_unat,\n erule order_less_le_trans)\n apply (drule range_cover.weak)\n apply (simp add: word_le_nat_alt unat_of_nat)\n\n apply (drule spec, drule mp, rule refl[where t=\"object_type_from_H newType\"])\n apply clarsimp\n apply (rule context_conjI)\n apply (simp add: hrs_htd_update)\n apply (simp add: region_actually_is_bytes'_def, rule ballI)\n apply (drule bspec, erule(1) subsetD)\n apply (drule(1) orthD2)\n apply (simp add: Ball_def unat_eq_def typ_bytes_region_out)\n apply (erule trans[OF heap_list_h_eq2 heap_list_is_zero_mono2, rotated])\n apply (simp add: word_shiftl_add_distrib field_simps)\n apply (rule sym, rule byte_regions_unmodified_region_is_bytes)\n apply (erule byte_regions_unmodified_trans, simp_all)[1]\n apply (simp add: byte_regions_unmodified_def)\n apply simp\n apply assumption\n\n apply (clarsimp simp:conj_comms field_simps\n createObject_hs_preconds_def range_cover_sz')\n apply (subgoal_tac \"is_aligned (ptr + (1 + of_nat n << APIType_capBits newType userSize))\n (APIType_capBits newType userSize)\")\n prefer 2\n apply (rule aligned_add_aligned[OF range_cover.aligned],assumption)\n apply (rule is_aligned_shiftl_self)\n apply (simp)\n apply (simp add: range_cover_one[OF _ range_cover.sz(2) range_cover.sz(1)])\n including no_pre\n apply (wp insertNewCap_invs' insertNewCap_valid_pspace' insertNewCap_caps_overlap_reserved'\n insertNewCap_pspace_no_overlap' insertNewCap_caps_no_overlap'' insertNewCap_descendants_range_in'\n insertNewCap_untypedRange hoare_vcg_all_lift insertNewCap_cte_at static_imp_wp)\n apply (wp insertNewCap_cte_wp_at_other)\n apply (wp hoare_vcg_all_lift static_imp_wp insertNewCap_cte_at)\n apply (clarsimp simp:conj_comms |\n strengthen invs_valid_pspace' invs_pspace_aligned'\n invs_pspace_distinct')+\n apply (frule range_cover.range_cover_n_less)\n apply (subst upt_enum_offset_trivial)\n apply (rule word_leq_le_minus_one[OF word_of_nat_le])\n apply (fold_subgoals (prefix))[3]\n subgoal premises prems using prems\n by (simp add:word_bits_conv minus_one_norm range_cover_not_zero[rotated])+\n apply (simp add: intvl_range_conv aligned_add_aligned[OF range_cover.aligned]\n is_aligned_shiftl_self range_cover_sz')\n apply (subst intvl_range_conv)\n apply (erule aligned_add_aligned[OF range_cover.aligned])\n apply (rule is_aligned_shiftl_self, rule le_refl)\n apply (erule range_cover_sz')\n apply (subst intvl_range_conv)\n apply (erule aligned_add_aligned[OF range_cover.aligned])\n apply (rule is_aligned_shiftl_self, rule le_refl)\n apply (erule range_cover_sz')\n apply (rule hoare_pre)\n apply (strengthen pspace_no_overlap'_strg[where sz = sz])\n apply (clarsimp simp:range_cover.sz conj_comms)\n apply (wp createObject_invs'\n createObject_caps_overlap_reserved_ret' createObject_valid_cap'\n createObject_descendants_range' createObject_idlethread_range\n hoare_vcg_all_lift createObject_IRQHandler createObject_parent_helper\n createObject_caps_overlap_reserved' createObject_caps_no_overlap''\n createObject_pspace_no_overlap' createObject_cte_wp_at'\n createObject_ex_cte_cap_wp_to createObject_descendants_range_in'\n createObject_caps_overlap_reserved'\n hoare_vcg_prop createObject_gsCNodes_p createObject_cnodes_have_size)\n apply (rule hoare_vcg_conj_lift[OF createObject_capRange_helper])\n apply (wp createObject_cte_wp_at' createObject_ex_cte_cap_wp_to\n createObject_no_inter[where sz = sz] hoare_vcg_all_lift static_imp_wp)+\n apply (clarsimp simp:invs_pspace_aligned' invs_pspace_distinct' invs_valid_pspace'\n field_simps range_cover.sz conj_comms range_cover.aligned range_cover_sz'\n is_aligned_shiftl_self aligned_add_aligned[OF range_cover.aligned])\n apply (drule_tac x = n and P = \"\\x. x< length destSlots \\ Q x\" for Q in spec)+\n apply clarsimp\n apply (simp add: range_cover_not_in_neqD)\n apply (intro conjI)\n subgoal by (simp add: word_bits_def range_cover_def)\n subgoal by (clarsimp simp: cte_wp_at_ctes_of invs'_def valid_state'_def\n valid_global_refs'_def cte_at_valid_cap_sizes_0)\n subgoal by (erule range_cover_le, simp)\n subgoal by (simp add: range_cover_in_kernel_mappings shiftl_t2n field_simps)\n subgoal by (simp add: range_cover_no_0 shiftl_t2n field_simps)\n apply (erule caps_no_overlap''_le)\n apply (simp add:range_cover.sz[where 'a=machine_word_len, folded word_bits_def])+\n apply (erule caps_no_overlap''_le2)\n apply (erule range_cover_compare_offset,simp+)\n apply (simp add: range_cover_tail_mask[OF range_cover_le]\n range_cover_head_mask[OF range_cover_le])\n subgoal by (clarsimp simp: APIType_capBits_def objBits_simps' untypedBits_defs)\n apply (rule contra_subsetD)\n apply (rule order_trans[rotated], erule range_cover_cell_subset,\n erule of_nat_mono_maybe[rotated], simp)\n apply (simp add: upto_intvl_eq shiftl_t2n mult.commute\n aligned_add_aligned[OF range_cover.aligned is_aligned_mult_triv2])\n subgoal by simp\n apply (rule disjoint_subset2[where B=\"{ptr .. foo}\" for foo, rotated], simp add: Int_commute)\n apply (rule order_trans[rotated], erule_tac p=\"Suc n\" in range_cover_subset, simp+)\n subgoal by (simp add: upto_intvl_eq shiftl_t2n mult.commute\n aligned_add_aligned[OF range_cover.aligned is_aligned_mult_triv2])\n apply (simp add:cte_wp_at_no_0)\n apply (erule caps_overlap_reserved'_subseteq)\n subgoal by (clarsimp simp:range_cover_compare_offset blah)\n apply (erule descendants_range_in_subseteq')\n subgoal by (clarsimp simp:range_cover_compare_offset blah)\n apply (drule_tac x = 0 in spec)\n subgoal by simp\n apply (erule caps_overlap_reserved'_subseteq)\n apply (clarsimp simp:range_cover_compare_offset blah)\n apply (frule_tac x = \"of_nat n\" in range_cover_bound3)\n subgoal by (simp add:word_of_nat_less range_cover.unat_of_nat_n blah)\n subgoal by (simp add:field_simps shiftl_t2n blah)\n apply (simp add:shiftl_t2n field_simps)\n apply (rule contra_subsetD)\n apply (rule_tac x1 = 0 in subset_trans[OF _ range_cover_cell_subset,rotated ])\n apply (erule_tac p = n in range_cover_offset[rotated])\n subgoal by simp\n apply simp\n apply (rule less_diff_gt0)\n subgoal by (simp add:word_of_nat_less range_cover.unat_of_nat_n blah)\n apply (clarsimp simp: field_simps)\n apply (clarsimp simp: valid_idle'_def pred_tcb_at'_def\n dest!:invs_valid_idle' elim!: obj_atE')\n apply (drule(1) pspace_no_overlapD')\n apply (rule_tac x = \"ksIdleThread s\" in in_empty_interE[rotated], simp)\n prefer 2\n apply (simp add:Int_ac)\n subgoal by (clarsimp simp: blah)\n subgoal by blast\n apply (erule descendants_range_in_subseteq')\n apply (clarsimp simp: blah)\n apply (rule order_trans[rotated], erule_tac x=\"of_nat n\" in range_cover_bound'')\n subgoal by (simp add: word_less_nat_alt unat_of_nat)\n subgoal by (simp add: shiftl_t2n field_simps)\n apply (rule order_trans[rotated],\n erule_tac p=\"Suc n\" in range_cover_subset, simp_all)[1]\n subgoal by (simp add: upto_intvl_eq shiftl_t2n mult.commute\n aligned_add_aligned[OF range_cover.aligned is_aligned_mult_triv2])\n apply (erule cte_wp_at_weakenE')\n apply (clarsimp simp:shiftl_t2n field_simps)\n apply (erule subsetD)\n apply (erule subsetD[rotated])\n apply (rule_tac p1 = n in subset_trans[OF _ range_cover_subset])\n prefer 2\n apply (simp add:field_simps )\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems by (simp add:field_simps )+\n apply (clarsimp simp: word_shiftl_add_distrib)\n apply (clarsimp simp:blah field_simps shiftl_t2n)\n apply (drule word_eq_zeroI)\n apply (drule_tac p = \"Suc n\" in range_cover_no_0)\n apply (simp add:field_simps)+\n apply clarsimp\n apply (rule conjI)\n apply (subgoal_tac \"of_nat (x + 1) << 5 \\ (0::machine_word)\")\n apply (simp add: word_of_nat_plus field_simps shiftl_t2n)\n apply (frule range_cover_n_le'(2))\n apply (subgoal_tac \"x < 2 ^ sz\")\n prefer 2 apply simp\n apply (drule (1) less_le_trans[OF _ power_increasing], simp)\n apply (match premises in H: \\x < 2 ^ maxUntypedSizeBits\\ for x \\\n \\match premises in K[thin]: _ (multi) \\ \\insert H\\\\)\n apply (rule word_shift_nonzero[where m=maxUntypedSizeBits])\n apply (simp add: less_eq_Suc_le)\n apply (drule PackedTypes.of_nat_mono_maybe_le\n [where X=\"2 ^ maxUntypedSizeBits\" and 'a=machine_word_len, rotated];\n simp add: untypedBits_defs)\n apply (simp add: untypedBits_defs)\n apply (rule notI, erule Word.of_nat_0[THEN iffD1, THEN exE])\n apply (rename_tac q; case_tac q; clarsimp simp: untypedBits_defs)\n apply (drule_tac x = \"Suc x\" in spec)\n subgoal by (clarsimp simp: field_simps)\n apply clarsimp\n apply (subst range_cover.unat_of_nat_n)\n apply (erule range_cover_le)\n apply simp\n apply (simp add:word_unat.Rep_inverse')\n subgoal by (clarsimp simp:range_cover.range_cover_n_less[where 'a=machine_word_len, simplified])\n subgoal by clarsimp\n apply vcg\n apply (rule conseqPre, vcg, clarsimp)\n apply (frule(1) ghost_assertion_size_logic)\n apply (drule range_cover_sz')\n subgoal by (intro conjI impI; simp add: o_def word_of_nat_less)\n apply (rule conjI)\n apply (frule range_cover.aligned)\n apply (frule range_cover_full[OF range_cover.aligned])\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp: invs_valid_pspace' conj_comms intvl_range_conv\n createObject_hs_preconds_def range_cover.aligned range_cover_full)\n apply (frule(1) range_cover_gsMaxObjectSize, fastforce, assumption)\n apply (simp add: intvl_range_conv[OF range_cover.aligned range_cover_sz']\n order_trans[OF _ APIType_capBits_min])\n apply (intro conjI)\n subgoal by (simp add: word_bits_def range_cover_def)\n apply (clarsimp simp:rf_sr_def cstate_relation_def Let_def)\n apply (erule pspace_no_overlap'_le)\n apply (fold_subgoals (prefix))[2]\n subgoal premises prems using prems\n by (simp add:range_cover.sz[where 'a=machine_word_len, simplified] word_bits_def)+\n apply (erule contra_subsetD[rotated])\n subgoal by (rule order_trans[rotated], rule range_cover_subset'[where n=1],\n erule range_cover_le, simp_all, (clarsimp simp: neq_Nil_conv)+)\n apply (rule disjoint_subset2[rotated])\n apply (simp add:Int_ac)\n apply (erule range_cover_subset[where p = 0,simplified])\n subgoal by simp\n subgoal by simp\n subgoal by (simp add: Int_commute shiftl_t2n mult.commute)\n apply (erule cte_wp_at_weakenE')\n apply (clarsimp simp:blah word_and_le2 shiftl_t2n field_simps)\n apply (frule range_cover_bound''[where x = \"of_nat (length destSlots) - 1\"])\n subgoal by (simp add: range_cover_not_zero[rotated])\n subgoal by (simp add:field_simps)\n subgoal by (erule range_cover_subset[where p=0, simplified]; simp)\n apply clarsimp\n apply (drule_tac x = k in spec)\n apply simp\n apply (drule(1) bspec[OF _ nth_mem])+\n subgoal by (clarsimp simp: field_simps)\n apply clarsimp\n apply (drule(1) bspec[OF _ nth_mem])+\n subgoal by (clarsimp simp:cte_wp_at_ctes_of)\n apply clarsimp\n apply (frule range_cover_sz')\n apply (frule(1) range_cover_gsMaxObjectSize, fastforce, assumption)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule(1) ghost_assertion_size_logic)+\n apply (simp add: o_def)\n apply (case_tac newType,\n simp_all add: object_type_from_H_def Kernel_C_defs\n nAPIObjects_def APIType_capBits_def o_def split:apiobject_type.splits)[1]\n subgoal by (simp add:unat_eq_def word_unat.Rep_inverse' word_less_nat_alt)\n subgoal by (clarsimp simp:objBits_simps', unat_arith)\n apply (fold_subgoals (prefix))[3]\n subgoal premises prems using prems\n by (clarsimp simp: objBits_simps' unat_eq_def word_unat.Rep_inverse'\n word_less_nat_alt)+\n by (clarsimp simp: bit_simps pageBitsForSize_def framesize_to_H_def\n X86_SmallPage_def X86_LargePage_def X64_HugePage_def)+\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/X64/Retype_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.3106943895971202, "lm_q1q2_score": 0.17823865809932793}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__125.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__125 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__125 and some rule r*}\nlemma n_PI_Remote_GetVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__125:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__125:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__125:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__125:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__125:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__125:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__125:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__125:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__125:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__125:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__125:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__125:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__125:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__125:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__125:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__125:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__125:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__125.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.34510527769342453, "lm_q1q2_score": 0.17794315419985143}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference_Refinement\nimports\n \"InfoFlow.Noninterference\"\n \"ADT_IF_Refine_C\"\n \"InfoFlow.Noninterference_Base_Refinement\"\nbegin\n\n(* FIXME: fp is currently ignored by ADT_C_if *)\nconsts fp :: bool\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma internal_R_ADT_A_if:\n \"internal_R (ADT_A_if uop) R = R\"\n apply (rule ext, rule ext)\n apply (simp add: internal_R_def ADT_A_if_def)\n done\n\nlemma LI_trans:\n \"\\LI A H R (Ia \\ Ih); LI H C S (Ih \\ Ic); H \\ Ih\\\n \\ LI A C (R O (S \\ {(h, c). h \\ Ih})) (Ia \\ Ic)\"\n apply (clarsimp simp: LI_def)\n apply safe\n apply (clarsimp simp: Image_def)\n apply (erule_tac x=s in allE)+\n apply (drule(1) set_mp)\n apply clarsimp\n apply (drule(1) set_mp)\n apply (clarsimp simp: invariant_holds_def)\n apply blast\n apply (clarsimp simp: rel_semi_def)\n apply (erule_tac x=j in allE)+\n apply (drule_tac c=\"(ya, z)\" in set_mp)\n apply blast\n apply (clarsimp simp: invariant_holds_def)\n apply blast\n apply (erule_tac x=x in allE)\n apply (erule_tac x=y in allE)+\n apply (erule_tac x=z in allE)\n apply simp\n done\n\nend\n\ncontext kernel_m begin\n\ndefinition big_step_ADT_C_if where\n \"big_step_ADT_C_if utf \\ big_step_adt (ADT_C_if fp utf) (internal_R (ADT_C_if fp utf) big_step_R) big_step_evmap\"\n\n(*Note: Might be able to generalise big_step_adt_refines for fw_sim*)\nlemma big_step_ADT_C_if_big_step_ADT_A_if_refines:\n \"uop_nonempty utf \\ refines (big_step_ADT_C_if utf) (big_step_ADT_A_if utf) \"\n apply (simp add: big_step_ADT_A_if_def big_step_ADT_C_if_def)\n apply (rule big_step_adt_refines[where A=\"ADT_A_if utf\", simplified internal_R_ADT_A_if])\n apply (rule LI_trans)\n apply (erule global_automata_refine.fw_sim_abs_conc[OF haskell_to_abs])\n apply (erule global_automata_refine.fw_sim_abs_conc[OF c_to_haskell])\n apply (rule global_automaton_invs.ADT_invs[OF haskell_invs])\n apply (rule global_automaton_invs.ADT_invs[OF abstract_invs])\n apply simp\n done\n\nend\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma LI_sub_big_steps':\n \"\\(s',as) \\ sub_big_steps C (internal_R C R) s;\n LI A C S (Ia \\ Ic); A [> Ia; C [> Ic;\n (t, s) \\ S; s \\ Ic; t \\ Ia\\\n \\ \\t'. (t',as) \\ sub_big_steps A (internal_R A R) t \\ (t', s') \\ S \\ t' \\ Ia\"\n apply (induct rule: sub_big_steps.induct)\n apply(clarsimp simp: LI_def)\n apply (rule_tac x=t in exI)\n apply clarsimp\n apply (rule sub_big_steps.nil, simp_all)[1]\n apply (force simp: internal_R_def)\n apply (clarsimp simp: LI_def)\n apply (erule_tac x=e in allE)\n apply (clarsimp simp: rel_semi_def)\n apply (drule_tac c=\"(t', ta)\" in set_mp)\n apply (rule_tac b=s' in relcompI)\n apply simp\n apply (rule sub_big_steps_I_holds)\n apply assumption+\n apply clarsimp\n apply (rule_tac x=y in exI)\n apply clarsimp\n apply (subst conj_commute)\n apply (rule context_conjI)\n apply (erule inv_holdsE)\n apply assumption+\n apply (rule sub_big_steps.step[OF refl])\n apply assumption+\n apply (subgoal_tac \"z \\ Ic\")\n prefer 2\n apply (rule_tac I=Ic in inv_holdsE)\n apply assumption+\n apply (erule sub_big_steps_I_holds)\n apply assumption+\n apply (force simp: internal_R_def)\n done\n\nlemma LI_rel_terminate:\n assumes ex_abs: \"\\s'. s' \\ Ic \\ (\\s. s \\ Ia \\ (s, s') \\ S)\"\n assumes rel_correct: \"\\s s' s0''. \\(internal_R C R)\\<^sup>+\\<^sup>+ s0'' s'; s0''\\Init C s0; (s, s') \\ S\\ \\ \\s0'\\Init A s0. (internal_R A R)\\<^sup>+\\<^sup>+ s0' s\"\n assumes init_rel_correct: \"\\s0''. s0'' \\ Init C s0 \\ \\s0' \\ Init A s0. (s0', s0'') \\ S\"\n assumes Ia_inv: \"A [> Ia\"\n assumes s0_Ia: \"Init A s0 \\ Ia\"\n assumes Ic_inv: \"C [> Ic\"\n assumes s0_Ic: \"Init C s0 \\ Ic\"\n assumes li: \"LI A C S (Ia \\ Ic)\"\n shows \"\\rel_terminate A s0 (internal_R A R) Ia (internal_R A measuref)\\\n \\ rel_terminate C s0 (internal_R C R) Ic (internal_R C measuref)\"\n apply (simp add: rel_terminate_def)\n apply (clarsimp simp: rtranclp_def2)\n apply (erule disjE)\n apply (cut_tac s'=s in ex_abs, assumption)\n apply clarsimp\n apply (cut_tac s=sa and s'=s in rel_correct, assumption+)\n apply (erule_tac x=\"sa\" in allE)\n apply simp\n apply (erule impE)\n apply blast\n apply (erule_tac x=as in allE)\n apply (frule(3) LI_sub_big_steps'[OF _ li Ia_inv Ic_inv])\n apply clarsimp\n apply (erule_tac x=t' in allE)\n apply simp\n using li\n apply (clarsimp simp: LI_def)\n apply (erule_tac x=a in allE)\n apply (clarsimp simp: rel_semi_def)\n apply (frule(1) sub_big_steps_I_holds[OF Ic_inv])\n apply (drule_tac c=\"(t', s'')\" in set_mp)\n apply blast\n apply clarsimp\n apply (erule_tac x=y in allE)\n apply (erule impE)\n apply blast\n apply (simp add: internal_R_def)\n apply (frule_tac x=sa in spec, drule_tac x=s in spec)\n apply (frule_tac x=y in spec, drule_tac x=z in spec)\n apply (drule_tac x=x in spec, drule_tac x=s' in spec)\n apply simp\n using Ia_inv Ic_inv\n apply (clarsimp simp: invariant_holds_def inv_holds_def)\n apply (erule_tac x=a in allE)+\n apply (drule_tac c=y in set_mp, blast)\n apply (drule_tac c=z in set_mp, blast)\n apply simp\n apply clarsimp\n apply (cut_tac s0''=s0' in init_rel_correct, assumption+)\n apply clarsimp\n apply (erule_tac x=\"s0'a\" in allE)\n apply (frule set_mp[OF s0_Ia])\n apply (erule impE)\n apply blast\n apply (erule_tac x=as in allE)\n apply (frule(3) LI_sub_big_steps'[OF _ li Ia_inv Ic_inv])\n apply clarsimp\n apply (erule_tac x=t' in allE)\n apply simp\n using li\n apply (clarsimp simp: LI_def)\n apply (erule_tac x=a in allE)+\n apply (clarsimp simp: rel_semi_def)\n apply (frule(1) sub_big_steps_I_holds[OF Ic_inv])\n apply (drule_tac c=\"(t', s'')\" in set_mp)\n apply blast\n apply clarsimp\n apply (erule_tac x=y in allE)\n apply (erule impE)\n apply blast\n apply (simp add: internal_R_def)\n apply (frule_tac x=s0'a in spec, drule_tac x=s0' in spec)\n apply (frule_tac x=y in spec, drule_tac x=z in spec)\n apply (drule_tac x=x in spec, drule_tac x=s' in spec)\n apply simp\n using Ia_inv Ic_inv\n apply (clarsimp simp: invariant_holds_def inv_holds_def)\n apply (erule_tac x=a in allE)+\n apply (drule_tac c=y in set_mp, blast)\n apply (drule_tac c=z in set_mp, blast)\n apply simp\n done\n\nend\n\nlocale valid_initial_state_C = valid_initial_state + kernel_m +\n assumes ADT_C_if_serial:\n \"\\s' a. (\\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\ hs \\ full_invs_if')\n \\ (\\t. (s', t) \\ data_type.Step (ADT_C_if fp utf) a)\"\n\nlemma internal_R_tranclp:\n \"(internal_R A R)\\<^sup>+\\<^sup>+ s s' \\ R\\<^sup>+\\<^sup>+ (Fin A s) (Fin A s')\"\n apply (induct rule: tranclp.induct)\n apply (simp add: internal_R_def)\n apply (simp add: internal_R_def)\n done\n\nlemma inv_holds_transport:\n \"\\ A [> Ia; C [> Ic; LI A C R (Ia \\ Ic) \\ \\ C [> {s'. \\s. (s,s') \\ R \\ s \\ Ia \\ s' \\ Ic}\"\n apply (clarsimp simp: LI_def inv_holds_def)\n apply (erule_tac x=j in allE)+\n apply (clarsimp simp: rel_semi_def)\n apply (subgoal_tac \"(s,x) \\ Step A j O R\")\n prefer 2\n apply blast\n apply blast\n done\n\nlemma inv_holds_T: \"A [> UNIV\"\n by (simp add: inv_holds_def)\n\ncontext valid_initial_state_C begin\n\nlemma LI_abs_to_c:\n \"LI (ADT_A_if utf) (ADT_C_if fp utf)\n (((lift_fst_rel (lift_snd_rel state_relation)))\n O ((lift_fst_rel (lift_snd_rel rf_sr)) \\ {(h, c). h \\ full_invs_if'}))\n (full_invs_if \\ UNIV)\"\n apply (rule LI_trans)\n apply (rule global_automata_refine.fw_sim_abs_conc[OF haskell_to_abs])\n apply (rule uop_nonempty)\n apply (rule global_automata_refine.fw_sim_abs_conc[OF c_to_haskell])\n apply (rule uop_nonempty)\n apply (rule global_automaton_invs.ADT_invs[OF haskell_invs])\n done\n\nlemma ADT_C_if_Init_Fin_serial:\n \"Init_Fin_serial (ADT_C_if fp utf) s {s'. \\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\ hs \\ full_invs_if'}\"\n apply (unfold_locales)\n apply (subgoal_tac \"ADT_C_if fp utf \\ P\" for P)\n prefer 2\n apply (rule fw_inv_transport)\n apply (rule global_automaton_invs.ADT_invs)\n apply (rule haskell_invs)\n apply (rule invariant_T)\n apply (rule global_automata_refine.fw_sim_abs_conc)\n apply (rule c_to_haskell)\n apply (rule uop_nonempty)\n apply simp\n apply (rule ADT_C_if_serial[rule_format])\n apply simp\n apply (clarsimp simp: ADT_C_if_def lift_fst_rel_def lift_snd_rel_def)\n apply blast\n apply (clarsimp simp: lift_fst_rel_def lift_snd_rel_def ADT_C_if_def)\n apply (rule_tac x=bb in exI)\n apply (clarsimp simp: full_invs_if'_def)\n apply (case_tac \"sys_mode_of s\", simp_all)\n done\n\nlemma ADT_C_if_Init_Fin_serial_weak:\n \"Init_Fin_serial_weak (ADT_C_if fp utf) s {s'.\n \\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\ hs \\ full_invs_if'}\"\n apply (rule Init_Fin_serial.serial_to_weak)\n apply (rule ADT_C_if_Init_Fin_serial)\n done\n\nlemma Fin_ADT_C_if:\n \"Fin (ADT_C_if fp utf) ((uc, s), m) = ((uc, cstate_to_A s), m)\"\n by (simp add: ADT_C_if_def)\n\nlemma Fin_Init_s0_ADT_C_if:\n \"s0' \\ Init (ADT_C_if fp utf) s0 \\ Fin (ADT_C_if fp utf) s0' = s0\"\n by (clarsimp simp: ADT_C_if_def s0_def)\n\nlemma big_step_R_tranclp_abs':\n \"\\(s, s')\n \\ lift_fst_rel (lift_snd_rel state_relation) O\n lift_fst_rel (lift_snd_rel rf_sr);\n big_step_R\\<^sup>+\\<^sup>+ s0 s''\\ \\ s'' = (Fin (ADT_C_if fp utf) s')\n \\ big_step_R\\<^sup>+\\<^sup>+ s0 s\"\n apply (erule tranclp_induct)\n apply (clarsimp simp: Fin_ADT_C_if lift_fst_rel_def)\n apply (rule tranclp.r_into_trancl)\n apply (simp add: big_step_R_def)\n apply (clarsimp simp: Fin_ADT_C_if lift_fst_rel_def)\n apply (rule tranclp.trancl_into_trancl)\n apply assumption\n apply (simp add: big_step_R_def)\n done\n\nlemmas big_step_R_tranclp_abs = big_step_R_tranclp_abs'[rule_format]\n\nlemma ADT_C_if_inv_holds_transport:\n \"ADT_C_if fp utf [>\n {s'.\n \\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\\n hs \\ full_invs_if' \\\n (\\as. (as, hs) \\ lift_fst_rel (lift_snd_rel state_relation) \\\n invs_if as)}\"\n apply (subst arg_cong[where f=\"\\S. ADT_C_if fp utf [> S\"])\n prefer 2\n apply (rule_tac A=\"ADT_A_if utf\" in inv_holds_transport)\n prefer 3\n apply (rule weaken_LI)\n apply (rule LI_abs_to_c)\n prefer 2\n apply (rule invs_if_inv_holds_ADT_A_if)\n prefer 2\n apply (rule inv_holds_T)\n apply (clarsimp simp: invs_if_full_invs_if)\n apply force\n done\n\nlemma ADT_C_if_Init_transport:\n \"Init (ADT_C_if fp utf) s0\n \\ {s'.\n \\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\\n hs \\ full_invs_if' \\\n (\\as. (as, hs) \\ lift_fst_rel (lift_snd_rel state_relation) \\\n invs_if as)}\"\n apply clarsimp\n apply (frule set_mp[OF global_automata_refine.init_refinement[OF c_to_haskell[OF uop_nonempty]]])\n apply (clarsimp simp: Image_def lift_fst_rel_def lift_snd_rel_def)\n apply (frule set_mp[OF global_automata_refine.init_refinement[OF haskell_to_abs[OF uop_nonempty]]])\n apply (clarsimp simp: Image_def lift_fst_rel_def lift_snd_rel_def)\n apply (rule_tac x=bb in exI)\n apply simp\n apply (rule conjI)\n apply (force simp: ADT_H_if_def)\n apply (rule_tac x=ba in exI)\n apply (clarsimp simp: ADT_A_if_def)\n done\n\nlemma ADT_C_if_big_step_R_terminate:\n \"rel_terminate (ADT_C_if fp utf) s0\n (internal_R (ADT_C_if fp utf) big_step_R)\n {s'. \\hs. (hs, s') \\ lift_fst_rel (lift_snd_rel rf_sr) \\\n hs \\ full_invs_if' \\ (\\as. (as, hs) \\\n lift_fst_rel (lift_snd_rel state_relation) \\ invs_if as)}\n (\\s s'. internal_R (ADT_C_if fp utf) measuref_if s s')\"\n apply (rule_tac S=\"lift_fst_rel (lift_snd_rel state_relation) O\n (lift_fst_rel (lift_snd_rel rf_sr) \\ {(h, c). h \\ full_invs_if'})\"\n and Ia=\"Collect invs_if\" and A=\"ADT_A_if utf\" in LI_rel_terminate)\n apply blast\n prefer 8\n apply (simp add: internal_R_ADT_A_if)\n apply (rule ADT_A_if_big_step_R_terminate)\n apply (simp add: internal_R_ADT_A_if, simp add: ADT_A_if_def)\n apply (rule_tac x=\"s0\" in bexI)\n apply (drule internal_R_tranclp)\n apply (simp add: Fin_Init_s0_ADT_C_if)\n apply clarsimp\n apply (rule big_step_R_tranclp_abs)\n apply force\n apply assumption\n apply simp\n apply (clarsimp simp: invs_if_full_invs_if extras_s0)\n apply (drule set_mp[OF global_automata_refine.init_refinement[OF c_to_haskell[OF uop_nonempty]]])\n apply (clarsimp simp: Image_def lift_fst_rel_def lift_snd_rel_def)\n apply (frule set_mp[OF global_automata_refine.init_refinement[OF haskell_to_abs[OF uop_nonempty]]])\n apply (clarsimp simp: Image_def lift_fst_rel_def lift_snd_rel_def)\n apply (rule_tac x=\"((aa, bc), bd)\" in bexI)\n apply (rule_tac b=\"((aa, bb), bd)\" in relcompI)\n apply simp\n apply (force simp: ADT_H_if_def)\n apply simp\n apply (rule invs_if_inv_holds_ADT_A_if)\n apply (simp add: ADT_A_if_def invs_if_full_invs_if extras_s0)\n apply (rule ADT_C_if_inv_holds_transport)\n apply (rule ADT_C_if_Init_transport)\n apply (rule weaken_LI[OF LI_abs_to_c])\n apply (clarsimp simp: invs_if_full_invs_if)\n done\n\nlemma big_step_ADT_C_if_enabled_system:\n \"enabled_system (big_step_ADT_C_if utf) s0\"\n apply (simp add: big_step_ADT_C_if_def)\n apply (rule_tac measuref=\"internal_R (ADT_C_if fp utf) measuref_if\" in big_step_adt_enabled_system)\n apply simp\n apply (force simp: big_step_R_def internal_R_def)\n apply (rule Init_Fin_serial_weak_strengthen)\n apply (rule ADT_C_if_Init_Fin_serial_weak)\n apply (rule ADT_C_if_inv_holds_transport)\n apply force\n apply (rule ADT_C_if_Init_transport)\n apply (rule ADT_C_if_big_step_R_terminate)\n done\n\nend\n\nsublocale valid_initial_state_C \\\n abstract_to_C: noninterference_refinement\n \"big_step_ADT_A_if utf\" (* the ADT that we prove infoflow for *)\n s0 (* initial state *)\n \"\\e s. part s\" (* dom function *)\n \"uwr\" (* uwr *)\n \"policyFlows (pasPolicy initial_aag)\" (* policy *)\n \"undefined\" (* out -- unused *)\n PSched (* scheduler partition name *)\n \"big_step_ADT_C_if utf\"\n apply(unfold_locales)\n apply(insert big_step_ADT_C_if_enabled_system)[1]\n apply(fastforce simp: enabled_system_def)\n apply(rule big_step_ADT_C_if_big_step_ADT_A_if_refines)\n apply (rule uop_nonempty)\n done\n\ncontext valid_initial_state_C begin\n\nlemma xnonleakage_C:\n \"abstract_to_C.conc.xNonleakage_gen\"\n apply(rule abstract_to_C.xNonleakage_gen_refinement_closed)\n apply(rule xnonleakage)\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/infoflow/Noninterference_Refinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.34510525748676846, "lm_q1q2_score": 0.17794314378089718}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__51_on_rules imports n_german_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__51 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.32082130731838393, "lm_q1q2_score": 0.17788593943803646}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__42_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__42_on_rules imports n_germanSymIndex_lemma_on_inv__42\nbegin\nsection{*All lemmas on causal relation between inv__42*}\nlemma lemma_inv__42_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__42 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__42) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__42_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.17788593583742898}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__14_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__14_on_rules imports n_germanSimp_lemma_on_inv__14\nbegin\nsection{*All lemmas on causal relation between inv__14*}\nlemma lemma_inv__14_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__14) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__14_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.17773703893456985}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nResults about CNode Invocations, particularly the\nrecursive revoke and delete operations.\n*)\n\ntheory CNodeInv_AI\nimports ArchIpc_AI\nbegin\n\n\ncontext begin interpretation Arch .\nrequalify_facts\n set_cap_arch\n cte_at_length_limit\n arch_derive_cap_untyped\n valid_arch_mdb_cap_swap\nend\n\ndeclare set_cap_arch[wp]\n\n\nprimrec\n valid_cnode_inv :: \"cnode_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_cnode_inv (InsertCall cap ptr ptr') =\n (valid_cap cap and real_cte_at ptr and real_cte_at ptr' and\n (\\s. cte_wp_at (is_derived (cdt s) ptr cap) ptr s) and\n cte_wp_at (\\c. c = NullCap) ptr' and\n ex_cte_cap_wp_to is_cnode_cap ptr' and K (ptr \\ ptr') and\n (\\s. \\r\\obj_refs cap. \\p'.\n ptr' \\ p' \\ cte_wp_at (\\cap'. r \\ obj_refs cap') p' s \\\n cte_wp_at (Not \\ is_zombie) p' s \\ \\ is_zombie cap))\"\n| \"valid_cnode_inv (MoveCall cap ptr ptr') =\n (valid_cap cap and cte_wp_at ((=) cap.NullCap) ptr' and\n cte_wp_at ((\\) NullCap) ptr and cte_wp_at (weak_derived cap) ptr and\n cte_wp_at (\\c. is_untyped_cap c \\ c = cap) ptr and\n ex_cte_cap_wp_to is_cnode_cap ptr' and\n real_cte_at ptr and real_cte_at ptr')\"\n| \"valid_cnode_inv (RevokeCall ptr) = cte_at ptr\"\n| \"valid_cnode_inv (DeleteCall ptr) = real_cte_at ptr\"\n| \"valid_cnode_inv (RotateCall s_cap p_cap src pivot dest) =\n (valid_cap s_cap and valid_cap p_cap and\n real_cte_at src and real_cte_at dest and real_cte_at pivot and\n cte_wp_at (weak_derived s_cap) src and\n cte_wp_at (\\c. is_untyped_cap c \\ c = s_cap) src and\n cte_wp_at ((\\) NullCap) src and\n cte_wp_at (weak_derived p_cap) pivot and\n cte_wp_at (\\c. is_untyped_cap c \\ c = p_cap) pivot and\n cte_wp_at ((\\) NullCap) pivot and K (src \\ pivot \\ pivot \\ dest) and\n (\\s. src \\ dest \\ cte_wp_at (\\c. c = NullCap) dest s) and\n ex_cte_cap_wp_to is_cnode_cap pivot and ex_cte_cap_wp_to is_cnode_cap dest)\"\n| \"valid_cnode_inv (SaveCall ptr) =\n (ex_cte_cap_wp_to is_cnode_cap ptr and\n cte_wp_at (\\c. c = NullCap) ptr and real_cte_at ptr)\"\n| \"valid_cnode_inv (CancelBadgedSendsCall cap) =\n (valid_cap cap and K (has_cancel_send_rights cap))\"\n\n\nprimrec\n valid_rec_del_call :: \"rec_del_call \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_rec_del_call (CTEDeleteCall slot _) = \\\"\n| \"valid_rec_del_call (FinaliseSlotCall slot _) = \\\"\n| \"valid_rec_del_call (ReduceZombieCall cap slot _) =\n (cte_wp_at ((=) cap) slot and is_final_cap' cap\n and K (is_zombie cap))\"\n\n\nlocale CNodeInv_AI =\n fixes state_ext_t :: \"'state_ext::state_ext itself\"\n assumes derive_cap_objrefs:\n \"\\P cap slot.\n \\\\s::'state_ext state. P (obj_refs cap)\\\n derive_cap slot cap\n \\\\rv s. rv \\ NullCap \\ P (obj_refs rv)\\,-\"\n assumes derive_cap_zobjrefs:\n \"\\P cap slot.\n \\\\s::'state_ext state. P (zobj_refs cap)\\\n derive_cap slot cap\n \\\\rv s. rv \\ NullCap \\ P (zobj_refs rv)\\,-\"\n assumes update_cap_objrefs:\n \"\\P dt cap. \\ update_cap_data P dt cap \\ NullCap \\ \\\n obj_refs (update_cap_data P dt cap) = obj_refs cap\"\n assumes update_cap_zobjrefs:\n \"\\P dt cap. \\ update_cap_data P dt cap \\ cap.NullCap \\ \\\n zobj_refs (update_cap_data P dt cap) = zobj_refs cap\"\n assumes copy_mask [simp]:\n \"\\R c. copy_of (mask_cap R c) = copy_of c\"\n assumes update_cap_data_mask_Null [simp]:\n \"\\P x m c. (update_cap_data P x (mask_cap m c) = NullCap) = (update_cap_data P x c = NullCap)\"\n assumes cap_master_update_cap_data:\n \"\\P x c. \\ update_cap_data P x c \\ NullCap \\ \\\n cap_master_cap (update_cap_data P x c) = cap_master_cap c\"\n assumes same_object_as_cap_master:\n \"\\cap cap'. same_object_as cap cap' \\ cap_master_cap cap = cap_master_cap cap'\"\n assumes cap_asid_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\ cap_asid (update_cap_data P x c) = cap_asid c\"\n assumes cap_vptr_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\ cap_vptr (update_cap_data P x c) = cap_vptr c\"\n assumes cap_asid_base_update_cap_data:\n \"\\P x c. update_cap_data P x c \\ NullCap \\\n cap_asid_base (update_cap_data P x c) = cap_asid_base c\"\n assumes same_object_as_update_cap_data:\n \"\\P x c c'. \\ update_cap_data P x c \\ NullCap; same_object_as c' c \\ \\\n same_object_as c' (update_cap_data P x c)\"\n assumes weak_derived_update_cap_data:\n \"\\P x c c'. \\update_cap_data P x c \\ NullCap; weak_derived c c'\\ \\\n weak_derived (update_cap_data P x c) c'\"\n assumes cap_badge_update_cap_data:\n \"\\x c bdg. update_cap_data False x c \\ NullCap \\ (bdg, cap_badge c) \\ capBadge_ordering False\n \\ (bdg, cap_badge (update_cap_data False x c)) \\ capBadge_ordering False\"\n assumes cap_vptr_rights_update[simp]:\n \"\\f c. cap_vptr (cap_rights_update f c) = cap_vptr c\"\n assumes cap_vptr_mask[simp]:\n \"\\m c. cap_vptr (mask_cap m c) = cap_vptr c\"\n assumes cap_asid_base_rights [simp]:\n \"\\R c. cap_asid_base (cap_rights_update R c) = cap_asid_base c\"\n assumes cap_asid_base_mask[simp]:\n \"\\m c. cap_asid_base (mask_cap m c) = cap_asid_base c\"\n assumes weak_derived_mask:\n \"\\c c' m. \\ weak_derived c c'; cap_aligned c \\ \\ weak_derived (mask_cap m c) c'\"\n assumes vs_cap_ref_update_cap_data[simp]:\n \"\\P d cap. vs_cap_ref (update_cap_data P d cap) = vs_cap_ref cap\"\n assumes weak_derived_cap_is_device:\n \"\\c c'. \\weak_derived c' c\\ \\ cap_is_device c = cap_is_device c'\"\n assumes invs_irq_state_independent[intro!, simp]:\n \"\\(s::'state_ext state) f.\n invs (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = invs s\"\n assumes cte_at_nat_to_cref_zbits:\n \"\\(s::'state_ext state) oref zb n m.\n \\ s \\ Zombie oref zb n; m < n \\ \\ cte_at (oref, nat_to_cref (zombie_cte_bits zb) m) s\"\n assumes copy_of_cap_range:\n \"\\cap cap'. copy_of cap cap' \\ cap_range cap = cap_range cap'\"\n assumes copy_of_zobj_refs:\n \"\\cap cap'. copy_of cap cap' \\ zobj_refs cap = zobj_refs cap'\"\n assumes vs_cap_ref_master:\n \"\\ cap cap'.\n \\ cap_master_cap cap = cap_master_cap cap';\n cap_asid cap = cap_asid cap';\n cap_asid_base cap = cap_asid_base cap';\n cap_vptr cap = cap_vptr cap' \\\n \\ vs_cap_ref cap = vs_cap_ref cap'\"\n assumes weak_derived_vs_cap_ref:\n \"\\c c'. weak_derived c c' \\ vs_cap_ref c = vs_cap_ref c'\"\n assumes weak_derived_table_cap_ref:\n \"\\c c'. weak_derived c c' \\ table_cap_ref c = table_cap_ref c'\"\n assumes swap_of_caps_valid_arch_caps:\n \"\\c a c' b.\n \\valid_arch_caps and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n do\n y \\ set_cap c b;\n set_cap c' a\n od\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n assumes cap_swap_asid_map[wp]:\n \"\\c a c' b.\n \\valid_asid_map and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. valid_asid_map :: 'state_ext state \\ bool\\\"\n assumes cap_swap_cap_refs_in_kernel_window[wp]:\n \"\\c a c' b.\n \\cap_refs_in_kernel_window and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. cap_refs_in_kernel_window :: 'state_ext state \\ bool\\\"\n assumes cap_swap_ioports[wp]:\n \"\\valid_ioports and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv (s::'state_ext state). valid_ioports s\\\"\n assumes cap_swap_vms[wp]:\n \"\\c a c' b.\n \\valid_machine_state :: 'state_ext state \\ bool\\\n cap_swap c a c' b\n \\\\rv. valid_machine_state\\\"\n assumes unat_of_bl_nat_to_cref:\n \"\\n ln. \\ n < 2 ^ ln; ln < word_bits \\\n \\ unat (of_bl (nat_to_cref ln n) :: machine_word) = n\"\n assumes zombie_is_cap_toE_pre:\n \"\\(s::'state_ext state) ptr zbits n m irqn.\n \\ s \\ Zombie ptr zbits n; invs s; m < n \\\n \\ (ptr, nat_to_cref (zombie_cte_bits zbits) m) \\ cte_refs (Zombie ptr zbits n) irqn\"\n assumes finalise_cap_emptyable[wp]:\n \"\\sl c f.\n \\emptyable sl and invs\\\n finalise_cap c f\n \\\\_. emptyable sl :: 'state_ext state \\ bool\\\"\n assumes deleting_irq_handler_emptyable[wp]:\n \"\\sl irq.\n \\emptyable sl and invs :: 'state_ext state \\ bool\\\n deleting_irq_handler irq\n \\\\_. emptyable sl\\\"\n assumes arch_finalise_cap_emptyable[wp]:\n \"\\sl c f.\n \\emptyable sl :: 'state_ext state \\ bool\\\n arch_finalise_cap c f\n \\\\_. emptyable sl\\\"\n assumes finalise_cap_not_reply_master_unlifted:\n \"\\rv s' cap sl (s::'state_ext state).\n (rv, s') \\ fst (finalise_cap cap sl s) \\\n \\ is_master_reply_cap (fst rv)\"\n assumes nat_to_cref_0_replicate:\n \"\\n. n < word_bits \\ nat_to_cref n 0 = replicate n False\"\n assumes prepare_thread_delete_thread_cap:\n \"\\x p t. \\\\(s::'state_ext state). caps_of_state s x = Some (cap.ThreadCap p)\\\n prepare_thread_delete t\n \\\\rv s. caps_of_state s x = Some (cap.ThreadCap p)\\\"\n\nlocale CNodeInv_AI_2 = CNodeInv_AI state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes rec_del_invs':\n \"\\(s::'state_ext state) call.\n s \\ \\\\x. invs x \\ valid_rec_del_call call x \\\n (\\ exposed_rdcall call \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall call) x) \\\n emptyable (slot_rdcall call) x \\\n (case call of ReduceZombieCall cap sl ex \\ \\ cap_removeable cap sl \\\n (\\t\\obj_refs cap. halted_if_tcb t x)\n | _ \\ True)\\\n rec_del call\n \\\\rv s. invs s \\\n (case call of CTEDeleteCall _ bool \\ True\n | FinaliseSlotCall sl x \\ (fst rv \\ x \\ cte_wp_at (replaceable s sl NullCap) sl s) \\\n (snd rv \\ NullCap \\ post_cap_delete_pre (snd rv) ((caps_of_state s) (sl \\ cap.NullCap)))\n | ReduceZombieCall cap sl x \\ \\ x \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) sl s) \\\n emptyable (slot_rdcall call) s\\,\n \\\\rv. invs\\\"\n\n\nlemma mask_cap_all:\n \"mask_cap (all_rights \\ r) c = mask_cap r c\"\n unfolding all_rights_def by simp\n\n\nlemma decode_cnode_cases2:\n assumes mvins: \"\\index bits src_index src_depth args' src_root_cap exs'.\n \\ args = index # bits # src_index # src_depth # args';\n exs = src_root_cap # exs';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label \\ {CNodeRevoke, CNodeDelete,\n CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller} \\ \\ P\"\n assumes rvk: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeRevoke \\ \\ P\"\n assumes dlt: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeDelete \\ \\ P\"\n assumes svc: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeSaveCaller \\ \\ P\"\n assumes rcy: \"\\index bits args'. \\ args = index # bits # args';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeCancelBadgedSends \\ \\ P\"\n assumes rot: \"\\index bits pivot_new_data pivot_index pivot_depth src_new_data\n src_index src_depth args' pivot_root_cap src_root_cap exs'.\n \\ args = index # bits # pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args';\n exs = pivot_root_cap # src_root_cap # exs';\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate];\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller];\n gen_invocation_type label = CNodeRotate \\ \\ P\"\n assumes errs:\n \"\\ gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller] \\\n args = [] \\ (\\x. args = [x]) \\ (\\index bits args'. args = index # bits # args' \\\n gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller] \\\n (gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate]\n \\ gen_invocation_type label \\ {CNodeRevoke, CNodeDelete,\n CNodeCancelBadgedSends, CNodeRotate, CNodeSaveCaller}\n \\ (case (args', exs) of (src_index # src_depth # args'',\n src_root_cap # exs') \\ False | _ \\ True) \\\n gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate] \\\n gen_invocation_type label = CNodeRotate \\ (case (args', exs) of\n (pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args'',\n pivot_root_cap # src_root_cap # exs') \\ False\n | _ \\ True))) \\ \\ P\"\n shows \"P\"\nproof -\n have simps: \"[CNodeRevoke .e. CNodeSaveCaller]\n = [CNodeRevoke, CNodeDelete, CNodeCancelBadgedSends, CNodeCopy, CNodeMint,\n CNodeMove, CNodeMutate, CNodeRotate, CNodeSaveCaller]\"\n \"[CNodeCopy .e. CNodeMutate] = [CNodeCopy, CNodeMint,\n CNodeMove, CNodeMutate]\"\n by (simp_all add: upto_enum_def fromEnum_def toEnum_def enum_invocation_label enum_gen_invocation_labels)\n show ?thesis\n apply (cases args)\n apply (simp add: errs)\n apply (case_tac list)\n apply (simp add: errs)\n apply (case_tac \"gen_invocation_type label \\ set [CNodeCopy .e. CNodeMutate]\")\n apply (case_tac \"case (lista, exs) of (src_index # src_depth # args'',\n src_root_cap # exs'') \\ False | _ \\ True\")\n apply (rule errs)\n apply (simp add: simps)\n apply (rule disjI2)\n apply auto[1]\n apply (simp split: prod.split_asm list.split_asm)\n apply (erule(2) mvins, auto simp: simps)[1]\n apply (case_tac \"gen_invocation_type label \\ set [CNodeRevoke .e. CNodeSaveCaller]\")\n apply (simp_all add: errs)\n apply (insert rvk dlt svc rcy rot)\n apply (simp add: simps)\n apply atomize\n apply (elim disjE, simp_all)\n apply (case_tac \"case (lista, exs) of\n (pivot_new_data # pivot_index # pivot_depth\n # src_new_data # src_index # src_depth # args'',\n pivot_root_cap # src_root_cap # exs') \\ False\n | _ \\ True\")\n apply (rule errs)\n apply (simp add: simps)\n apply (simp split: prod.split_asm list.split_asm)\n done\nqed\n\n\nlemma Suc_length_not_empty:\n \"length xs = length xs' \\ Suc 0 \\ length xs' = (xs \\ [])\"\n by (fastforce simp: le_simps)\n\n\nlemma update_cap_hoare_helper:\n \"\\P\\ f \\\\rv s. valid_cap (C rv s) s\\ \\\n \\P\\ f \\\\rv s. valid_cap (update_cap_data prs n (C rv s)) s\\\"\n apply (erule hoare_strengthen_post)\n apply (erule update_cap_data_validI)\n done\n\n\nlemma mask_cap_hoare_helper:\n \"\\P\\ f \\\\rv s. valid_cap (C rv s) s\\ \\\n \\P\\ f \\\\rv s. valid_cap (mask_cap (M rv s) (C rv s)) s\\\"\n by (fastforce simp add: valid_def)\n\nlemma derive_cap_untyped:\n \"\\\\s. P (untyped_range cap)\\ derive_cap slot cap \\\\rv s. rv \\ cap.NullCap \\ P (untyped_range rv)\\,-\"\n unfolding derive_cap_def is_zombie_def\n by (cases cap; (wp ensure_no_children_inv arch_derive_cap_untyped | simp add: o_def)+)\n\nlemma zombies_final_helper:\n \"\\ cte_wp_at (\\c. c = cap) p s; \\ is_zombie cap; zombies_final s \\\n \\ (\\r\\obj_refs cap. \\a b.\n cte_wp_at (\\cap'. r \\ obj_refs cap') (a, b) s \\ cte_wp_at (Not \\ is_zombie) (a, b) s)\"\n apply (clarsimp simp: cte_wp_at_def)\n apply (case_tac \"p = (a, b)\")\n apply simp\n apply (drule(2) zombies_finalD2)\n apply clarsimp\n apply blast\n apply simp\n done\n\nlemma cap_asid_mask[simp]:\n \"cap_asid (mask_cap m c) = cap_asid c\"\n by (simp add: mask_cap_def)\n\n\nlemma cap_master_mask[simp]:\n \"cap_master_cap (mask_cap rs cap) = cap_master_cap cap\"\n by (simp add: mask_cap_def)\n\n\nlemma cap_badge_mask[simp]:\n \"cap_badge (mask_cap rs cap) = cap_badge cap\"\n by (simp add: mask_cap_def)\n\n\nlemma ensure_empty_cte_wp_at:\n \"\\\\\\ ensure_empty c \\\\rv s. cte_wp_at ((=) cap.NullCap) c s\\, -\"\n unfolding ensure_empty_def\n apply (wp whenE_throwError_wp get_cap_wp)\n apply simp\n done\n\n\nlemmas get_cap_cte_caps_to_no_wp[wp]\n = get_cap_cte_caps_to[where P=\"\\\", simplified]\n\n\nlemma lookup_cap_ex[wp]:\n \"\\\\\\ lookup_cap t c \\\\rv s. \\r\\cte_refs rv (interrupt_irq_node s). ex_cte_cap_to r s\\, -\"\n by (simp add: split_def lookup_cap_def) wp\n\n\nlemmas cap_aligned_valid[elim!] = valid_cap_aligned\n\n\nlemma cap_derive_not_null_helper2:\n \"\\P\\ derive_cap slot cap \\\\rv s. rv \\ cap.NullCap \\ Q rv s\\, -\n \\\n \\\\s. cap \\ cap.NullCap \\ \\ is_zombie cap \\ cap \\ cap.IRQControlCap \\ P s\\\n derive_cap slot cap\n \\\\rv s. rv \\ cap.NullCap \\ Q rv s\\, -\"\n apply (drule cap_derive_not_null_helper)\n apply (erule hoare_post_imp_R)\n apply simp\n done\n\nlemma has_cancel_send_rights_ep_cap:\n \"has_cancel_send_rights cap \\ is_ep_cap cap\"\n by (clarsimp simp: has_cancel_send_rights_def split: cap.splits)\n\n\nlemma is_untyped_update_cap_data[intro]:\n \"is_untyped_cap r \\ update_cap_data c x r = r\"\n by (cases r; clarsimp simp: update_cap_data_def is_arch_cap_def)\n\ncontext CNodeInv_AI begin\n\nlemma decode_cnode_inv_wf[wp]:\n \"\\cap.\n \\invs and valid_cap cap\n and (\\s. \\r\\zobj_refs cap. ex_nonz_cap_to r s)\n and (\\s. is_cnode_cap cap \\ (\\r\\cte_refs cap (interrupt_irq_node s).\n ex_cte_cap_wp_to is_cnode_cap r s))\n and (\\s. \\cap \\ set cs. s \\ cap)\n and (\\s. \\cap \\ set cs. is_cnode_cap cap \\\n (\\r\\cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \\\n decode_cnode_invocation mi args cap cs\n \\valid_cnode_inv\\,-\"\n apply (rule decode_cnode_cases2[where args=args and exs=cs and label=mi])\n \\ \\Move/Insert\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE\n split del: if_split)\n apply (wp lsfco_cte_at ensure_no_children_wp whenE_throwError_wp\n | simp add: split_beta split del: if_split\n | (fold validE_R_def)[1])+\n apply (rule cap_derive_not_null_helper2)\n apply (simp only: imp_conjR)\n apply ((wp derive_cap_is_derived\n derive_cap_valid_cap\n derive_cap_zobjrefs derive_cap_objrefs_iszombie\n | wp (once) hoare_drop_imps)+ )[1]\n apply (wp whenE_throwError_wp | wpcw)+\n apply simp\n apply (rule_tac Q=\"\\src_cap. valid_cap src_cap and ex_cte_cap_wp_to is_cnode_cap x\n and zombies_final and valid_objs\n and real_cte_at src_slot and real_cte_at x\n and cte_wp_at (\\c. c = src_cap) src_slot\n and cte_wp_at ((=) cap.NullCap) x\"\n in hoare_post_imp)\n apply (rename_tac rv s)\n apply (clarsimp simp: cte_wp_at_caps_of_state all_rights_def)\n apply (simp add: cap_master_update_cap_data weak_derived_update_cap_data\n cap_asid_update_cap_data\n update_cap_data_validI update_cap_objrefs)\n apply (strengthen cap_badge_update_cap_data)\n apply simp\n apply (frule (1) caps_of_state_valid_cap)\n apply (case_tac \"is_zombie rv\")\n apply (clarsimp simp add: valid_cap_def2 update_cap_data_def\n is_cap_simps\n split: if_split_asm)\n apply (frule(2) zombies_final_helper [OF caps_of_state_cteD[simplified cte_wp_at_eq_simp]])\n apply (clarsimp simp: valid_cap_def2 cte_wp_at_caps_of_state)\n apply (rule conjI, clarsimp+)+\n\n apply (fastforce simp: is_untyped_update_cap_data\n weak_derived_update_cap_data[OF _ weak_derived_refl])\n apply (wp get_cap_cte_wp_at ensure_empty_cte_wp_at)+\n apply simp\n apply (clarsimp simp: invs_def valid_state_def valid_pspace_def)\n \\ \\Revoke\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp\n | simp add: split_beta validE_R_def[symmetric])+\n apply clarsimp\n \\ \\Delete\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (wp lsfco_cte_at hoare_drop_imps whenE_throwError_wp\n | simp add: split_beta validE_R_def[symmetric])+\n apply clarsimp\n \\ \\Save\\\n apply (simp add: decode_cnode_invocation_def unlessE_whenE cong: if_cong)\n apply (rule hoare_pre)\n apply (wp ensure_empty_stronger whenE_throwError_wp\n lsfco_cte_at lookup_slot_for_cnode_op_cap_to\n hoare_vcg_const_imp_lift\n | simp add: split_beta\n | wp (once) hoare_drop_imps)+\n apply clarsimp\n \\ \\CancelBadgedSends\\\n apply (simp add: decode_cnode_invocation_def\n unlessE_def whenE_def\n split del: if_split)\n apply (wp get_cap_wp hoare_vcg_all_lift_R | simp add: )+\n apply (rule_tac Q'=\"\\rv. invs and cte_wp_at (\\_. True) rv\" in hoare_post_imp_R)\n apply (wp lsfco_cte_at)\n apply (clarsimp simp: cte_wp_valid_cap invs_valid_objs has_cancel_send_rights_ep_cap)+\n \\ \\Rotate\\\n apply (simp add: decode_cnode_invocation_def split_def\n whenE_def unlessE_def)\n apply (rule hoare_pre)\n apply (wp get_cap_wp ensure_empty_stronger | simp)+\n apply (rule_tac Q'=\"\\rv s. real_cte_at rv s \\ real_cte_at x s\n \\ real_cte_at src_slot s\n \\ ex_cte_cap_wp_to is_cnode_cap rv s\n \\ ex_cte_cap_wp_to is_cnode_cap x s\n \\ invs s\" in hoare_post_imp_R)\n apply wp+\n apply (clarsimp simp: cte_wp_at_caps_of_state\n dest!: real_cte_at_cte del: impI)\n apply (frule invs_valid_objs)\n apply (simp add: update_cap_data_validI weak_derived_update_cap_data\n caps_of_state_valid_cap)\n subgoal by (auto,(clarsimp simp:is_cap_simps update_cap_data_def)+)[1](* Bad practise *)\n apply wp+\n apply clarsimp\n apply (elim disjE exE conjE,\n simp_all add: decode_cnode_invocation_def validE_R_def\n split_def unlessE_whenE\n split: list.split_asm\n split del: if_split)\n apply (wp | simp)+\n done\n\nend\n\n\nlemma decode_cnode_inv_inv[wp]:\n \"\\P\\ decode_cnode_invocation mi args cap cs \\\\rv. P\\\"\n unfolding decode_cnode_invocation_def\n apply (simp add: split_def unlessE_def whenE_def\n cong: if_cong split del: if_split)\n apply (rule hoare_pre)\n apply (wp hoare_drop_imps | simp | wpcw)+\n done\n\n\ndefinition\n not_recursive_cspaces :: \"'z::state_ext state \\ cslot_ptr set\"\nwhere\n \"not_recursive_cspaces s \\ {ptr. cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s}\"\n\ndefinition\n state_cte_ptrs :: \"'z::state_ext state \\ cslot_ptr set\"\nwhere\n \"state_cte_ptrs s \\ {ptr. cte_at ptr s}\"\n\nlemma fixed_length_finite:\n \"finite (UNIV :: 'a set) \\ finite {x :: 'a list. length x = n}\"\n apply (induct n)\n apply simp\n apply (subgoal_tac \"{x :: 'a list. length x = Suc n} = image (split Cons) (UNIV \\ {x. length x = n})\")\n apply clarsimp\n apply safe\n apply (case_tac x, simp_all add: image_def)\n done\n\nlemma state_cte_ptrs_finite:\n \"finite (state_cte_ptrs s)\"\n apply (clarsimp simp add: state_cte_ptrs_def cte_at_cases Collect_disj_eq\n Collect_conj_eq set_pair_UN tcb_cap_cases_def)\n apply (clarsimp simp: well_formed_cnode_n_def fixed_length_finite)\n done\n\nlemma cte_wp_at_set_finite:\n \"finite {p. cte_wp_at (P p) p s}\"\n apply (rule finite_subset [OF _ state_cte_ptrs_finite[where s=s]])\n apply (clarsimp simp: state_cte_ptrs_def elim!: cte_wp_at_weakenE)\n done\n\n\nlemma not_recursive_cspaces_finite:\n \"finite (not_recursive_cspaces s)\"\n unfolding not_recursive_cspaces_def\n by (rule cte_wp_at_set_finite)\n\n\nlemma set_cdt_not_recursive[wp]:\n \"\\\\s. P (not_recursive_cspaces s)\\ set_cdt f \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: set_cdt_def, wp)\n apply (simp add: not_recursive_cspaces_def)\n done\n\n\nlemma not_recursive_mdb[simp]:\n \"not_recursive_cspaces (is_original_cap_update f s) =\n not_recursive_cspaces s\"\n \"not_recursive_cspaces (cdt_update f' s) =\n not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)+\n\n\nlemma set_cap_no_new_recursive:\n \"\\\\s. x \\ not_recursive_cspaces s\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\\\n set_cap cap ptr\n \\\\rv s. x \\ not_recursive_cspaces s\\\"\n apply (simp add: not_recursive_cspaces_def)\n apply (wp set_cap_cte_wp_at_neg)\n apply (clarsimp simp: cte_wp_at_neg split: if_split)\n done\n\n\nlemma not_recursive_set_cap_shrinks:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\n \\ ptr \\ fst_cte_ptrs cap\\\n set_cap cap ptr\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (rule shrinks_proof[where x=ptr])\n apply (rule not_recursive_cspaces_finite)\n apply (wp set_cap_no_new_recursive)\n apply simp\n apply (simp add: not_recursive_cspaces_def)\n apply (wp set_cap_cte_wp_at_neg)\n apply (clarsimp elim!: cte_wp_at_weakenE)\n apply (simp add: not_recursive_cspaces_def)\n done\n\n\nlemma not_recursive_set_cap_doesn't_grow:\n \"\\\\s. card (not_recursive_cspaces s) < n\n \\ cte_wp_at (\\cap. ptr \\ fst_cte_ptrs cap) ptr s\\\n set_cap cap ptr\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (rule doesn't_grow_proof)\n apply (rule not_recursive_cspaces_finite)\n apply (rule set_cap_no_new_recursive)\n done\n\n\nlemma final_cap_duplicate_obj_ref:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ obj_refs cap1; p1 \\ p2 \\ \\ x \\ obj_refs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\n\nlemma final_cap_duplicate_irq:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ cap_irqs cap1; p1 \\ p2 \\ \\ x \\ cap_irqs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\nlemma final_cap_duplicate_arch_refs:\n \"\\ fst (get_cap p1 s) = {(cap1, s)}; fst (get_cap p2 s) = {(cap2, s)}; is_final_cap' cap1 s;\n x \\ arch_gen_refs cap1; p1 \\ p2 \\ \\ x \\ arch_gen_refs cap2\"\n apply (clarsimp simp: is_final_cap'_def gen_obj_refs_def)\n apply (subgoal_tac \"{p1, p2} \\ {(a, b)}\")\n apply simp\n apply (drule sym[where s=\"Collect p\" for p], simp)\n apply blast\n done\n\n\nlemma fst_cte_ptrs_link_obj_refs:\n \"x \\ fst_cte_ptrs cap \\ fst x \\ obj_refs cap\"\n by (case_tac cap, simp_all add: fst_cte_ptrs_def)\n\n\nlemma final_cap_duplicate_cte_ptr:\n \"\\ fst (get_cap p s) = {(cap, s)}; fst (get_cap p' s) = {(cap', s)}; is_final_cap' cap s;\n x \\ fst_cte_ptrs cap; p \\ p' \\ \\ x \\ fst_cte_ptrs cap'\"\n apply (drule(2) final_cap_duplicate_obj_ref)\n apply (erule fst_cte_ptrs_link_obj_refs)\n apply assumption\n apply (clarsimp simp: fst_cte_ptrs_link_obj_refs)\n done\n\nlemma not_recursive_cspaces_more_update[iff]:\n \"not_recursive_cspaces (trans_state f s) = not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)\n\nlemma cap_swap_not_recursive:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. is_final_cap' cap s\n \\ p1 \\ fst_cte_ptrs cap) p2 s\n \\ cte_wp_at ((=) c1) p1 s\n \\ cte_wp_at ((=) c2) p2 s\n \\ p1 \\ p2\\\n cap_swap c1 p1 c2 p2\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n apply (cases \"p1 = p2\", simp_all)\n apply (simp add: cap_swap_def set_cdt_def when_def)\n apply (rule hoare_vcg_precond_imp)\n apply (wp | simp)+\n apply (rule not_recursive_set_cap_doesn't_grow)\n apply (wp not_recursive_set_cap_shrinks set_cap_cte_wp_at' get_cap_wp hoare_vcg_disj_lift)\n apply (clarsimp simp: cte_wp_at_def)\n apply (frule(3) final_cap_duplicate_cte_ptr)\n apply simp\n apply (case_tac c2, simp_all add: fst_cte_ptrs_def)\n done\n\n\nlemma cap_swap_fd_not_recursive:\n \"\\\\s. card (not_recursive_cspaces s) \\ n\n \\ cte_wp_at (\\cap. is_final_cap' cap s\n \\ p1 \\ fst_cte_ptrs cap) p2 s\n \\ p1 \\ p2\\\n cap_swap_for_delete p1 p2\n \\\\rv s. card (not_recursive_cspaces s) < n\\\"\n unfolding cap_swap_for_delete_def\n by (wpsimp wp: cap_swap_not_recursive get_cap_wp)\n\n\nlemma set_mrs_typ_at [wp]:\n \"\\\\s. P (typ_at T p s)\\ set_mrs p' b m \\\\rv s. P (typ_at T p s)\\\"\n apply (simp add: set_mrs_def bind_assoc set_object_def get_object_def)\n apply (cases b)\n apply simp\n apply wp\n apply clarsimp\n apply (drule get_tcb_SomeD)\n apply (clarsimp simp: obj_at_def)\n apply (clarsimp simp: zipWithM_x_mapM split_def\n split del: if_split)\n apply (wp mapM_wp')\n apply clarsimp\n apply (drule get_tcb_SomeD)\n apply (clarsimp simp: obj_at_def)\n done\n\n\nlemma cte_wp_and:\n \"cte_wp_at (P and Q) c s = (cte_wp_at P c s \\ cte_wp_at Q c s)\"\n by (auto simp: cte_wp_at_def)\n\n\nlemmas cte_wp_and' = cte_wp_and [unfolded pred_conj_def]\n\n\nlemma in_pspace_typ_at:\n \"r \\ dom (kheap s) = (\\T. \\ typ_at T r s)\"\n apply (simp add: dom_def)\n apply (subst simp_thms(2)[symmetric])\n apply (fastforce simp: obj_at_def)\n done\n\nlemma prepare_thread_delete_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n prepare_thread_delete t\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp prepare_thread_delete_caps_of_state)\n done\n\n\nlemma suspend_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n IpcCancel_A.suspend t\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp suspend_caps_of_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rsubst[where P=P])\n apply (intro set_eqI iffI)\n apply (clarsimp simp: fst_cte_ptrs_def)\n apply clarsimp\n apply (clarsimp simp: fst_cte_ptrs_def can_fast_finalise_def\n split: cap.split_asm)\n done\n\n\nlemma unbind_notification_not_recursive:\n \"\\\\s. P (not_recursive_cspaces s)\\\n unbind_notification tcb\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def cte_wp_at_caps_of_state)\n apply (wp unbind_notification_caps_of_state)\n done\n\n\nlemma get_cap_det2:\n \"(r, s') \\ fst (get_cap p s) \\ get_cap p s = ({(r, s)}, False) \\ s' = s\"\n apply (rule conjI)\n apply (erule get_cap_det)\n apply (erule use_valid [OF _ get_cap_inv])\n apply simp\n done\n\n\nlemma set_zombie_not_recursive:\n \"\\\\s. cte_wp_at (\\c. fst_cte_ptrs c = fst_cte_ptrs (cap.Zombie p zb n)) slot s\n \\ P (not_recursive_cspaces s)\\\n set_cap (cap.Zombie p zb n) slot\n \\\\rv s. P (not_recursive_cspaces s)\\\"\n apply (simp add: not_recursive_cspaces_def)\n apply (rule set_preserved_proof[where P=P])\n apply simp_all\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift set_cap_cte_wp_at)\n apply (fastforce simp: cte_wp_at_def fst_cte_ptrs_def)\n apply (simp only: cte_wp_at_neg imp_conv_disj de_Morgan_conj simp_thms)\n apply (wp hoare_vcg_ex_lift valid_cte_at_neg_typ[OF set_cap_typ_at]\n hoare_vcg_disj_lift set_cap_cte_wp_at)\n apply (fastforce simp: fst_cte_ptrs_def cte_wp_at_def)\n done\n\ndefinition\n rdcall_finalise_ord_lift :: \"((cslot_ptr \\ 'z state) \\ (cslot_ptr \\ 'z state)) set\n \\ ((rec_del_call \\ 'z state) \\ (rec_del_call \\ 'z state)) set\"\nwhere\n \"rdcall_finalise_ord_lift S \\\n (\\(x, s). case x of CTEDeleteCall a b \\ 3 | FinaliseSlotCall a b \\ 2\n | ReduceZombieCall cap a b \\ 1)\n <*mlex*>\n ((map_prod (\\(x, s). (FinaliseSlotCall x True, s)) (\\(x, s). (FinaliseSlotCall x True, s)) ` S)\n \\ (map_prod (\\(x, s). (FinaliseSlotCall x False, s)) (\\(x, s). (FinaliseSlotCall x False, s)) ` S))\"\n\n\nlemma wf_rdcall_finalise_ord_lift:\n \"wf S \\ wf (rdcall_finalise_ord_lift S)\"\n unfolding rdcall_finalise_ord_lift_def\n by (auto intro!: wf_mlex wf_Un wf_map_prod_image inj_onI)\n\n\ndefinition\n rec_del_recset :: \"((rec_del_call \\ 'z::state_ext state) \\ (rec_del_call \\ 'z::state_ext state)) set\"\nwhere\n \"rec_del_recset \\\n wf_sum (exposed_rdcall \\ fst)\n (rdcall_finalise_ord_lift (inv_image\n (less_than <*lex*> less_than)\n (\\(x, s). case caps_of_state s x of\n Some cap.NullCap \\ (0, 0)\n | Some (cap.Zombie p zb n) \\\n (if fst_cte_ptrs (cap.Zombie p zb n) = {x} then 1 else 2, n)\n | _ \\ (3, 0))))\n (rdcall_finalise_ord_lift (measure (\\(x, s). card (not_recursive_cspaces s))))\"\n\n\nlemma rec_del_recset_wf: \"wf rec_del_recset\"\n unfolding rec_del_recset_def\n by (intro wf_sum_wf wf_rdcall_finalise_ord_lift wf_measure\n wf_inv_image wf_lex_prod wf_less_than)\n\n\nlemma in_get_cap_cte_wp_at:\n \"(rv, s') \\ fst (get_cap p s) = (s = s' \\ cte_wp_at ((=) rv) p s)\"\n apply (rule iffI)\n apply (clarsimp dest!: get_cap_det2 simp: cte_wp_at_def)\n apply (clarsimp simp: cte_wp_at_def)\n done\n\n\nlemma fst_cte_ptrs_first_cte_of:\n \"fst_cte_ptrs (cap.Zombie ptr zb n) = {first_cslot_of (cap.Zombie ptr zb n)}\"\n by (simp add: fst_cte_ptrs_def tcb_cnode_index_def)\n\n\nlemma final_cap_still_at:\n \"\\\\s. cte_wp_at (\\c. gen_obj_refs cap = gen_obj_refs c\n \\ P cap (is_final_cap' c s)) ptr s\\\n set_cap cap ptr\n \\\\rv s. cte_wp_at (\\c. P c (is_final_cap' c s)) ptr s\\\"\n apply (simp add: is_final_cap'_def2 cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp elim!: rsubst[where P=\"P cap\"])\n apply (intro ext arg_cong[where f=Ex] arg_cong[where f=All])\n apply (case_tac \"(aa, ba) = ptr\", simp_all add: gen_obj_refs_def)\n done\n\n\nlemma suspend_thread_cap:\n \"\\\\s. caps_of_state s x = Some (cap.ThreadCap p)\\\n IpcCancel_A.suspend t\n \\\\rv s. caps_of_state s x = Some (cap.ThreadCap p)\\\"\n apply (rule hoare_chain)\n apply (rule suspend_cte_wp_at_preserved\n [where p=x and P=\"(=) (cap.ThreadCap p)\"])\n apply (clarsimp simp add: can_fast_finalise_def)\n apply (simp add: cte_wp_at_caps_of_state)+\n done\n\n\nlemma emptyable_irq_state_independent[intro!, simp]:\n \"emptyable x (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = emptyable x s\"\n by (auto simp: emptyable_def)\n\nlemma not_recursive_cspaces_irq_state_independent[intro!, simp]:\n \"not_recursive_cspaces (s \\ machine_state := machine_state s \\ irq_state := f (irq_state (machine_state s)) \\ \\)\n = not_recursive_cspaces s\"\n by (simp add: not_recursive_cspaces_def)\n\ncontext CNodeInv_AI begin\n\nlemma preemption_point_not_recursive_cspaces[wp]:\n \"preemption_point \\\\s. P (not_recursive_cspaces s)\\\"\n unfolding preemption_point_def\n by (wpsimp wp: OR_choiceE_weak_wp alternative_wp hoare_drop_imp)\n\nlemma preemption_point_caps_of_state[wp]:\n \"preemption_point \\\\s. P (caps_of_state s)\\\"\n unfolding preemption_point_def\n by (wpsimp wp: OR_choiceE_weak_wp alternative_wp hoare_drop_imp)\n\nlemma rec_del_termination:\n \"All (rec_del_dom :: rec_del_call \\ 'state_ext state \\ bool)\"\n \\ \\ rec_del.termination needs a well-formed measure and proofs that the 4 recursive calls\n reduce this measure. \\\n apply (rule rec_del.termination[where R=rec_del_recset])\n\n \\ \\ The measure is well-formed. \\\n apply (rule rec_del_recset_wf)\n\n \\ \\ case 1: CTEDeleteCall --> FinaliseSlotCall \\\n apply (simp add: rec_del_recset_def wf_sum_def rdcall_finalise_ord_lift_def mlex_prod_def)\n\n \\ \\ case 2: FinaliseSlotCall --> ReduceZombieCall \\\n apply (simp add: rec_del_recset_def wf_sum_def rdcall_finalise_ord_lift_def mlex_prod_def)\n\n \\ \\ case 3: FinaliseSlotCall --> FinaliseSlotCall \\\n apply (case_tac exposed; simp)\n\n \\ \\ FinaliseSlotCall _ True --> FinaliseSlotCall _ True \\\n apply (simp add: rec_del_recset_def wf_sum_def rdcall_finalise_ord_lift_def mlex_prod_def)\n apply (rule disjI1, rule map_prod_split_imageI, clarsimp)\n apply (rename_tac oref cref exposed st1 fcap st2 is_final st3 pcap1 pcap2 st4 st5 success\n cl_info st6 st7)\n apply (erule use_valid [OF _ preemption_point_caps_of_state])\n apply (case_tac pcap1; simp add: fail_def rec_del.psimps)\n apply (rename_tac word option nat)\n apply (case_tac nat; simp)\n apply (clarsimp simp: in_monad rec_del.psimps)\n apply (clarsimp simp: in_monad in_get_cap_cte_wp_at\n cte_wp_at_caps_of_state rec_del.psimps\n split: if_split_asm)\n apply (erule use_valid [OF _ set_cap_caps_of_state])+\n apply (case_tac fcap; clarsimp simp: fst_cte_ptrs_first_cte_of in_monad)\n apply (case_tac new_cap; simp add: is_cap_simps)\n apply (case_tac fcap; clarsimp simp: fst_cte_ptrs_first_cte_of)\n apply (case_tac fcap; clarsimp simp: fst_cte_ptrs_first_cte_of in_monad)\n\n \\ \\ FinaliseSlotCall _ False --> FinaliseSlotCall _ False \\\n apply (simp add: rec_del_recset_def wf_sum_def rdcall_finalise_ord_lift_def mlex_prod_def)\n apply (rule disjI2, rule map_prod_split_imageI, clarsimp)\n apply (rename_tac oref cref exposed st1 fcap st2 is_final st3 pcap1 pcap2 st4 st5 success\n cl_info st6 st7)\n apply (simp add: in_monad is_final_cap_def is_zombie_def)\n apply (erule use_valid [OF _ preemption_point_not_recursive_cspaces])\n apply (case_tac pcap1, simp_all add: fail_def rec_del.psimps)[1]\n apply (rename_tac word option nat)\n apply (case_tac nat, simp_all)\n apply (clarsimp simp: in_monad prod_eqI rec_del.psimps)\n apply (erule use_valid [OF _ cap_swap_fd_not_recursive])\n apply (frule use_valid [OF _ get_cap_cte_wp_at, simplified])\n apply (drule in_inv_by_hoareD [OF get_cap_inv], clarsimp)\n apply (erule use_valid [OF _ hoare_vcg_conj_lift [OF set_zombie_not_recursive final_cap_still_at]])\n apply (frule use_valid [OF _ finalise_cap_cases])\n apply (fastforce simp add: cte_wp_at_eq_simp)\n apply clarsimp\n apply (case_tac fcap, simp_all add: fst_cte_ptrs_def)\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state fst_cte_ptrs_def\n split: if_split_asm)\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state fst_cte_ptrs_def\n split: if_split_asm)\n apply (frule(1) use_valid [OF _ unbind_notification_caps_of_state],\n frule(1) use_valid [OF _ suspend_thread_cap],\n frule(1) use_valid [OF _ prepare_thread_delete_thread_cap])\n apply clarsimp\n apply (erule use_valid [OF _ prepare_thread_delete_not_recursive])\n apply (erule use_valid [OF _ suspend_not_recursive])\n apply (erule use_valid [OF _ unbind_notification_not_recursive])\n apply simp\n apply (clarsimp simp: in_monad cte_wp_at_caps_of_state\n fst_cte_ptrs_def zombie_cte_bits_def\n tcb_cnode_index_def\n split: option.split_asm)\n\n \\\\ case 4: ReduceZombieCall --> CTEDeleteCall \\\n apply (simp add: rec_del_recset_def wf_sum_def rdcall_finalise_ord_lift_def mlex_prod_def)\n done\n\nlemma rec_del_dom: \"\\ (p :: rec_del_call \\ 'state_ext state). rec_del_dom p\"\n using rec_del_termination by blast\n\nlemmas rec_del_simps = rec_del.psimps[OF rec_del_dom]\n\nlemmas rec_del_simps_ext =\n rec_del_simps [THEN ext[where f=\"rec_del args\" for args]]\n\nlemmas rec_del_fails = spec_validE_fail rec_del_simps_ext(5-)\n\ndeclare assertE_wp[wp]\ndeclare unlessE_wp[wp_split]\n\nlemma without_preemption_wp [wp_split]:\n \"\\P\\ f \\Q\\ \\ \\P\\ without_preemption f \\Q\\,\\E\\\"\n by simp\n\nlemmas rec_del_induct = rec_del.pinduct[OF rec_del_dom]\n\nlemma rec_del_preservation':\n fixes s :: \"'state_ext state\"\n fixes P :: \"'state_ext state \\ bool\"\n assumes wp:\n \"\\sl1 sl2. \\P\\ cap_swap_for_delete sl1 sl2 \\\\rv. P\\\"\n \"\\sl cap. \\P\\ set_cap sl cap \\\\rv. P\\\"\n \"\\sl opt. \\P\\ empty_slot sl opt \\\\rv. P\\\"\n \"\\cap fin. \\P\\ finalise_cap cap fin \\\\rv. P\\\"\n \"\\P\\ preemption_point \\\\rv. P\\\"\n shows\n \"s \\ \\P\\ rec_del call \\\\_. P\\, \\\\_. P\\\"\nproof (induct rule: rec_del_induct)\n case (1 slot exposed s)\n show ?case\n apply (subst rec_del_simps)\n apply (simp only: split_def)\n apply wp\n apply (wp wp)[1]\n apply (rule spec_strengthen_postE)\n apply (rule \"1.hyps\")\n apply simp\n done\nnext\n case (2 slot exposed s)\n show ?case\n apply (subst rec_del_simps)\n apply (simp only: split_def)\n apply (wp wp \"2.hyps\")\n apply (wp wp)[1]\n apply (simp only: simp_thms)\n apply (rule \"2.hyps\", assumption+)\n apply (wp wp hoare_drop_imps | simp add: is_final_cap_def)+\n done\nnext\n case 3\n show ?case\n apply (simp add: rec_del_simps | wp wp)+\n done\nnext\n case (4 ptr bits n slot s)\n show ?case\n apply (subst rec_del_simps)\n apply (wp wp)\n apply (wp hoare_drop_imps)[1]\n apply (simp only: simp_thms)\n apply (rule \"4.hyps\", assumption+)\n apply wp\n done\nqed (auto simp: rec_del_dom rec_del_fails)\n\nlemmas rec_del_preservation[crunch_rules] =\n validE_valid [OF use_spec(2) [OF rec_del_preservation']]\n\nend\n\n\ncrunch typ_at: cap_swap_for_delete \"\\s. P (typ_at T p s)\"\n\nlemma cap_swap_valid_cap:\n \"\\valid_cap c\\ cap_swap_for_delete x y \\\\_. valid_cap c\\\"\n apply(simp add: cap_swap_for_delete_def)\n apply(wp cap_swap_valid_cap)\n apply(simp)\n done\n\n\nlemma cap_swap_cte_at:\n \"\\cte_at p\\ cap_swap_for_delete x y \\\\_. cte_at p\\\"\n apply(simp add: cap_swap_for_delete_def)\n apply(wp cap_swap_cte_at)\n apply(simp)\n done\n\n\ncontext CNodeInv_AI begin\n\ncrunch typ_at: rec_del \"\\s::'state_ext state. P (typ_at T p s)\"\n (ignore: preemption_point wp: preemption_point_inv)\n\nlemma rec_del_cte_at:\n \"\\c call. \\cte_at c :: 'state_ext state \\ bool\\ rec_del call \\\\_. cte_at c\\\"\n by (wp valid_cte_at_typ rec_del_typ_at)\n\nend\n\n\nlemma dom_valid_cap[wp]:\n \"\\valid_cap c\\ do_machine_op f \\\\_. valid_cap c\\\"\n apply (simp add: do_machine_op_def split_def)\n apply (wp select_wp)\n apply simp\n done\n\n\nlemma dom_cte_at:\n \"\\cte_at c\\ do_machine_op f \\\\_. cte_at c\\\"\n apply (simp add: do_machine_op_def split_def)\n apply (wp select_wp)\n apply (simp add: cte_at_cases)\n done\n\n\nlemma cnode_to_zombie_valid:\n \"\\ s \\ cap.CNodeCap oref bits guard \\\n \\ s \\ cap.Zombie oref (Some bits) (2 ^ bits)\"\n by (clarsimp simp: valid_cap_def cap_table_at_cte_at\n word_unat_power cap_aligned_def)\n\n\nlemma tcb_to_zombie_valid:\n \"\\ s \\ cap.ThreadCap t \\\n \\ s \\ cap.Zombie t None 5\"\n apply (simp add: valid_cap_def)\n apply (simp add: cap_aligned_def)\n done\n\n\nlemmas do_machine_op_cte_at [wp] = dom_cte_at\n\n\ndeclare set_cap_cte_at[wp]\n set_cap_valid_cap [wp]\n\n\nlemma set_original_valid_pspace:\n \"\\valid_pspace\\ set_original p v \\\\rv. valid_pspace\\\"\n apply wp\n apply (erule valid_pspace_eqI)\n apply simp\n done\n\n\nlocale mdb_swap_abs_invs = mdb_swap_abs +\n fixes cs cs' cap cap' scap dcap\n defines \"cs \\ caps_of_state s\"\n defines \"cs' \\ cs (src \\ dcap, dest \\ scap)\"\n\n assumes cap: \"cs src = Some cap\"\n assumes cap': \"cs dest = Some cap'\"\n\n assumes sder: \"weak_derived scap cap\"\n assumes dder: \"weak_derived dcap cap'\"\n\n\nlemma obj_ref_untyped_empty [simp]:\n \"obj_refs c \\ untyped_range c = {}\"\n by (cases c, auto)\n\nlemma weak_derived_Reply_eq:\n \"\\ weak_derived c c'; c = ReplyCap t m R \\ \\ (\\ R'. (c' = cap.ReplyCap t m R'))\"\n \"\\ weak_derived c c'; c' = ReplyCap t m R\\ \\ (\\ R'. (c = cap.ReplyCap t m R' ))\"\n by (auto simp: weak_derived_def copy_of_def\n same_object_as_def is_cap_simps\n split: if_split_asm cap.split_asm)\n\n\ncontext mdb_swap_abs_invs begin\n\nlemmas src_ranges [simp] = weak_derived_ranges [OF sder]\nlemmas dest_ranges [simp] = weak_derived_ranges [OF dder]\n\n\nlemma no_mloop_n:\n \"no_mloop n\"\n by (simp add: no_mloop_def parency)\n\n\nlemma mdb_cte_n:\n \"mdb_cte_at (\\p. \\c. cs' p = Some c \\ cap.NullCap \\ c) n\"\nproof -\n from valid_mdb\n have \"mdb_cte_at (\\p. \\c. cs p = Some c \\ cap.NullCap \\ c) m\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap' sder dder\n apply (clarsimp simp add: mdb_cte_at_def)\n apply (cases src, cases dest)\n apply (simp add: n_def n'_def cs'_def split: if_split_asm)\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n done\nqed\n\n\nlemma descendants_no_loop [simp]:\n \"x \\ descendants_of x m\"\n by (simp add: descendants_of_def)\n\n\nlemma untyped_mdb_n:\n \"untyped_mdb n cs'\"\nproof -\n from valid_mdb\n have \"untyped_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap'\n by (simp add: untyped_mdb_def cs'_def descendants_of_def parency\n s_d_swap_def\n del: split_paired_All)\nqed\n\n\nlemma descendants_inc_n:\n shows \"descendants_inc n cs'\"\nproof -\n from valid_mdb\n have \"descendants_inc m cs\"\n by (simp add:cs_def m valid_mdb_def2)\n thus ?thesis using cap cap' sder dder\n apply (simp add:descendants_inc_def descendants_of_def del: split_paired_All)\n apply (intro impI allI)\n apply (simp add:parency cs'_def del:split_paired_All)\n apply (drule spec)+\n apply (erule(1) impE)\n apply (simp add: weak_derived_cap_range)\n apply (intro conjI impI)\n apply (simp add:s_d_swap_other)+\n done\n qed\n\n\nlemma untyped_inc_n:\n assumes untyped_eq:\"(is_untyped_cap cap \\ scap = cap)\" \"(is_untyped_cap cap' \\ dcap = cap')\"\n shows \"untyped_inc n cs'\"\nproof -\n from valid_mdb\n have \"untyped_inc m cs\"\n by (simp add: cs_def m valid_mdb_def2)\n thus ?thesis using cap cap'\n apply (simp add: untyped_inc_def cs'_def descendants_of_def parency s_d_swap_def\n del: split_paired_All)\n apply (intro allI)\n apply (intro conjI)\n apply (intro impI allI)\n apply (intro conjI)\n apply (drule_tac x = p in spec)\n apply (drule_tac x = p' in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI allI)\n apply (drule_tac x = p' in spec)\n apply (drule_tac x = dest in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI)\n apply (intro conjI)\n apply (intro impI allI)\n apply (drule_tac x = src in spec)\n apply (intro conjI)\n apply (drule_tac x = dest in spec)\n apply (clarsimp simp:untyped_eq)\n apply (drule_tac x = p' in spec)\n apply (clarsimp simp:untyped_eq)\n apply (intro impI allI)\n apply (intro conjI)\n apply (drule_tac x = dest in spec)\n apply (drule_tac x = p in spec)\n apply (clarsimp simp:untyped_eq)\n apply (drule_tac x = src in spec)\n apply (drule_tac x = p in spec)\n apply (clarsimp simp:untyped_eq)\n done\nqed\n\n\nlemmas src_replies[simp] = weak_derived_replies [OF sder]\n\nlemmas dest_replies[simp] = weak_derived_replies [OF dder]\n\n\nlemma reply_caps_mdb_n:\n \"reply_caps_mdb n cs'\"\nproof -\n from valid_mdb\n have \"reply_caps_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2 reply_mdb_def)\n thus ?thesis using cap cap' unfolding reply_caps_mdb_def cs'_def n_def n'_def\n apply (intro allI impI)\n apply (simp split: if_split_asm del: split_paired_All split_paired_Ex)\n apply (elim allE)\n apply (drule weak_derived_Reply_eq(1) [OF sder], simp del: split_paired_Ex)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF dder])\n apply (erule exEI, clarsimp)\n apply (elim allE)\n apply (drule weak_derived_Reply_eq(1) [OF dder], simp del: split_paired_Ex)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF sder])\n apply (erule exEI, clarsimp)\n apply (erule_tac x=ptr in allE, erule_tac x=t in allE)\n apply (erule impE, fastforce)\n apply (intro conjI impI)\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF dder])\n apply (clarsimp elim!: weak_derived_Reply_eq(2) [OF sder])\n apply fastforce\n done\nqed\n\n\nlemma reply_masters_mdb_n:\n \"reply_masters_mdb n cs'\"\nproof -\n from valid_mdb\n have r: \"reply_masters_mdb m cs\"\n by (simp add: cs_def m valid_mdb_def2 reply_mdb_def)\n have n_None:\n \"\\t R. scap = cap.ReplyCap t True R \\ n dest = None\"\n \"\\t R. dcap = cap.ReplyCap t True R \\ n src = None\"\n using r cap cap' unfolding reply_masters_mdb_def n_def\n by (drule_tac weak_derived_Reply_eq(1) [OF sder]\n weak_derived_Reply_eq(1) [OF dder],\n fastforce simp: n'_def simp del: split_paired_All)+\n show ?thesis unfolding reply_masters_mdb_def cs'_def using cap cap' r\n apply (intro allI impI)\n apply (simp add: n_None descendants s_d_swap_def\n split: if_split_asm del: split_paired_All)\n apply (unfold reply_masters_mdb_def)[1]\n apply (drule weak_derived_Reply_eq(1) [OF sder], simp del: split_paired_All)\n apply (elim allE, erule impE, fastforce, elim conjE)\n apply (intro impI conjI)\n apply (drule(1) bspec)\n apply clarsimp\n apply (rule weak_derived_Reply_eq(2) [OF dder])\n apply simp\n apply fastforce\n apply fastforce\n apply (unfold reply_masters_mdb_def)[1]\n apply (drule weak_derived_Reply_eq(1) [OF dder], simp del: split_paired_All)\n apply (elim allE, erule impE, fastforce, elim conjE)\n apply (intro impI conjI)\n apply (drule(1) bspec, clarsimp, rule weak_derived_Reply_eq(2) [OF sder], simp)\n apply fastforce+\n apply (unfold reply_masters_mdb_def)[1]\n apply (erule_tac x=ptr in allE, erule_tac x=t in allE)\n apply (elim allE impE, fastforce)\n apply (erule conjE, simp add: n_def n'_def)\n apply (fastforce intro:weak_derived_Reply_eq(2)[OF dder] weak_derived_Reply_eq(2)[OF sder])+\n done\nqed\n\n\nlemma reply_mdb_n:\n \"reply_mdb n cs'\"\n by (simp add: reply_mdb_def reply_masters_mdb_n reply_caps_mdb_n)\n\nend\n\n\ndefinition\n \"swap_mdb m src dest \\\n let n' = (\\n. if m n = Some src then Some dest\n else if m n = Some dest then Some src\n else m n) in\n n' (src := n' dest, dest := n' src)\"\n\nlemma cap_swap_mdb [wp]:\n \"\\valid_mdb and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c) a and\n cte_wp_at (weak_derived c') b and K (a \\ b) and cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c') b\\\n cap_swap c a c' b\n \\\\_. valid_mdb\\\"\n apply (simp add: valid_mdb_def2 cap_swap_def set_cdt_def bind_assoc set_original_def)\n apply (wp | simp del: fun_upd_apply split del: if_split)+\n apply (fold swap_mdb_def [simplified Let_def])\n apply (wp set_cap_caps_of_state2 get_cap_wp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state simp del: fun_upd_apply)\n apply (subgoal_tac \"mdb_swap_abs_invs (cdt s) a b s cap capb c c'\")\n prefer 2\n apply (rule mdb_swap_abs_invs.intro)\n apply (rule mdb_swap_abs.intro)\n apply (simp add: valid_mdb_def2)\n apply (fastforce simp: cte_wp_at_caps_of_state)\n apply (fastforce simp: cte_wp_at_caps_of_state)\n apply (rule refl)\n apply assumption\n apply (erule (3) mdb_swap_abs_invs_axioms.intro)\n apply (unfold swap_mdb_def Let_def)\n apply (simp add: mdb_swap_abs_invs.no_mloop_n\n mdb_swap_abs_invs.untyped_mdb_n\n mdb_swap_abs_invs.mdb_cte_n\n mdb_swap_abs_invs.reply_mdb_n\n del: fun_upd_apply\n split del: if_split)\n apply (rule conjI)\n apply (erule mdb_swap_abs_invs.descendants_inc_n)\n apply (rule conjI)\n apply (erule mdb_swap_abs_invs.untyped_inc_n)\n apply (clarsimp simp:cte_wp_at_caps_of_state)+\n apply (rule conjI)\n apply (simp add: ut_revocable_def weak_derived_ranges del: split_paired_All)\n apply (rule conjI)\n apply (simp add: irq_revocable_def del: split_paired_All)\n apply (intro conjI impI allI)\n apply (simp del: split_paired_All)\n apply (simp del: split_paired_All)\n apply (simp add: reply_master_revocable_def weak_derived_replies\n del: split_paired_All)\n apply (clarsimp simp: valid_arch_mdb_cap_swap)\n done\n\n\nlemma set_cdt_valid_objs[wp]:\n \"\\valid_objs\\ set_cdt m \\\\rv. valid_objs\\\"\n by (simp add: set_cdt_def | wp)+\n\n\nlemma cap_swap_valid_objs[wp]:\n \"\\valid_objs and valid_cap c and valid_cap c'\n and tcb_cap_valid c b and tcb_cap_valid c' a\\\n cap_swap c a c' b\n \\\\rv. valid_objs\\\"\n apply (simp add: cap_swap_def)\n apply (wp set_cap_valid_objs\n | simp split del: if_split)+\n done\n\n\ncrunch aligned[wp]: cap_swap \"pspace_aligned\"\n\ncrunch disctinct[wp]: cap_swap \"pspace_distinct\"\n\n\nlemma cap_swap_iflive[wp]:\n \"\\if_live_then_nonz_cap and cte_wp_at (\\x. zobj_refs x = zobj_refs c) a\n and cte_wp_at (\\x. zobj_refs x = zobj_refs c') b\\\n cap_swap c a c' b\n \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: cap_swap_def)\n apply (wp | simp split del: if_split)+\n apply (rule hoare_post_imp)\n apply (simp only: if_live_then_nonz_cap_def ex_nonz_cap_to_def\n cte_wp_at_caps_of_state imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_ex_lift\n get_cap_wp)+\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (frule(1) if_live_then_nonz_capD)\n apply assumption\n apply (clarsimp simp: ex_nonz_cap_to_def cte_wp_at_caps_of_state)\n apply (subst split_paired_Ex[symmetric])\n apply (rule_tac x=\"if (aa, ba) = a then b else if (aa, ba) = b then a else (aa, ba)\"\n in exI)\n apply (clarsimp | rule conjI)+\n done\n\n\nlemma cap_swap_fd_iflive[wp]:\n \"\\if_live_then_nonz_cap\\\n cap_swap_for_delete a b\n \\\\rv. if_live_then_nonz_cap\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma set_cdt_caps_of[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_cdt m \\\\rv s. P (caps_of_state s)\\\"\n by wp\n\n\nlemma cap_swap_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\n and cte_wp_at (\\x. cte_refs x = cte_refs c\n \\ ((\\y. cte_refs x y \\ {}) \\ P x = P c)) a\n and cte_wp_at (\\x. cte_refs x = cte_refs c'\n \\ ((\\y. cte_refs x y \\ {}) \\ P x = P c')) b\\\n cap_swap c a c' b\n \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: cap_swap_def ex_cte_cap_wp_to_def\n cte_wp_at_caps_of_state\n del: split_paired_Ex)\n apply (wp get_cap_wp | simp split del: if_split del: split_paired_Ex)+\n apply (simp del: split_paired_Ex | intro allI impI | erule conjE)+\n apply (erule exfEI [where f=\"id ( a := b, b := a )\"])\n apply (clarsimp simp: cte_wp_at_caps_of_state | rule conjI)+\n done\n\n\nlemma cap_swap_fd_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ cap_swap_for_delete a b \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma cap_swap_caps_of_state[wp]:\n \"\\\\s. P ((caps_of_state s) ( a := Some c', b := Some c ))\\\n cap_swap c a c' b\n \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: cap_swap_def)\n apply (wp get_cap_wp | simp del: fun_upd_apply split del: if_split)+\n done\n\n\nlemma cap_swap_fd_caps_of_state[wp]:\n \"\\\\s. P ((caps_of_state s) \\ (id ( a := b, b := a )))\\\n cap_swap_for_delete a b\n \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (cases \"a = b\")\n apply (simp add: fun_upd_def id_def[symmetric] cong: if_cong)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rsubst[where P=P])\n apply fastforce\n done\n\n\nlemma cap_irqs_appropriateness:\n \"cap_irqs cap = cap_irqs cap'\n \\ \\cp. appropriate_cte_cap cp cap = appropriate_cte_cap cp cap'\"\n by (simp add: appropriate_cte_cap_irqs)\n\n\nlemma cap_swap_ifunsafe[wp]:\n \"\\if_unsafe_then_cap\n and ex_cte_cap_wp_to (appropriate_cte_cap c') a\n and ex_cte_cap_wp_to (appropriate_cte_cap c) b\n and cte_wp_at (\\x. cte_refs x = cte_refs c\n \\ ((\\y. cte_refs x y \\ {}) \\ cap_irqs x = cap_irqs c)) a\n and cte_wp_at (\\x. cte_refs x = cte_refs c'\n \\ ((\\y. cte_refs x y \\ {}) \\ cap_irqs x = cap_irqs c')) b\\\n cap_swap c a c' b\n \\\\rv s. if_unsafe_then_cap s\\\"\n apply (simp only: if_unsafe_then_cap_def cte_wp_at_caps_of_state\n imp_conv_disj not_ex)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift)\n apply (clarsimp split del: if_split del: disjCI intro!: disjCI2)\n apply (intro conjI)\n apply (clarsimp split: if_split_asm)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (erule ex_cte_cap_wp_to_weakenE)\n apply clarsimp\n apply (auto dest!: cap_irqs_appropriateness elim!: cte_wp_at_weakenE)\n done\n\n\nlemma cap_irqs_appropriate_strengthen:\n \"ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) x s\n \\ ex_cte_cap_wp_to (appropriate_cte_cap cap) x s\"\n by (auto simp: appropriate_cte_cap_def\n elim!: ex_cte_cap_wp_to_weakenE\n split: cap.split)\n\n\nlemma cap_swap_fd_ifunsafe[wp]:\n \"\\if_unsafe_then_cap\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) a\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) b\\\n cap_swap_for_delete a b\n \\\\rv s. if_unsafe_then_cap s\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state\n | strengthen cap_irqs_appropriate_strengthen)+\n done\n\nlemma cap_swap_zombies[wp]:\n \"\\zombies_final and cte_wp_at (\\x. is_zombie x = is_zombie c\n \\ gen_obj_refs x = gen_obj_refs c) a\n and cte_wp_at (\\x. is_zombie x = is_zombie c' \\ gen_obj_refs x = gen_obj_refs c') b\\\n cap_swap c a c' b\n \\\\rv. zombies_final\\\"\n apply (simp only: zombies_final_def final_cap_at_eq\n cte_wp_at_caps_of_state simp_thms pred_conj_def)\n apply wp\n apply (elim conjE)\n apply (erule allfEI[where f=\"id ( a := b, b := a )\"])\n apply (intro impI)\n apply (drule mp)\n apply (clarsimp split: if_split_asm)\n apply (elim exE conjE, simp only: simp_thms option.simps)\n apply (rule conjI)\n apply (clarsimp simp: is_cap_simps gen_obj_refs_def)\n apply (erule allfEI[where f=\"id ( a := b, b := a )\"])\n apply (intro impI, elim exE conjE, simp only: simp_thms option.simps gen_obj_refs_eq)\n apply (clarsimp simp: gen_obj_refs_Int split: if_split_asm)\n done\n\n\nlemma cap_swap_fd_zombies[wp]:\n \"\\zombies_final\\\n cap_swap_for_delete p p'\n \\\\rv. zombies_final\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n done\n\n\nlemma cap_swap_pred_tcb_at[wp]:\n \"\\pred_tcb_at proj P t\\ cap_swap c sl c' sl' \\\\rv. pred_tcb_at proj P t\\\"\n unfolding cap_swap_def by (wp | simp)+\n\n\nlemma unique_reply_caps_cap_swap:\n assumes u: \"unique_reply_caps cs\"\n and c: \"cs p = Some cap\"\n and c': \"cs p' = Some cap'\"\n and wd: \"weak_derived c cap\"\n and wd': \"weak_derived c' cap'\"\n and pneq: \"p \\ p'\"\n shows \"unique_reply_caps (cs (p \\ c', p' \\ c))\"\nproof -\n have new_cap_is_unique[elim]:\n \"\\ p'' t R R'.\\p'' \\ p; p'' \\ p'; cs p'' = Some (ReplyCap t False R);\n c = ReplyCap t False R' \\ c' = ReplyCap t False R' \\\n \\ False\"\n using u unfolding unique_reply_caps_def\n apply (erule_tac disjE)\n apply simp\n apply (frule weak_derived_Reply_eq[OF wd])\n apply (fastforce simp add:c)\n apply simp\n apply (frule weak_derived_Reply_eq[OF wd'])\n apply (fastforce simp add:c' is_cap_simps)\n done\n\n have old_caps_differ:\n \"\\t R R'.\n \\ cap= ReplyCap t False R; cap' = ReplyCap t False R' \\\n \\ False\"\n using u c c' is_cap_simps pneq unfolding unique_reply_caps_def by fastforce\n\n have new_cap_objs_differ[elim]:\n \"\\t R R'. \\ c= ReplyCap t False R; c' = ReplyCap t False R'\\ \\ False\"\n apply (drule weak_derived_Reply_eq [OF wd])\n apply (drule weak_derived_Reply_eq [OF wd'])\n using old_caps_differ by fastforce\n\n show ?thesis\n using u unfolding unique_reply_caps_def\n apply (intro allI impI)\n apply (simp split: if_split_asm del: split_paired_All)\n apply fastforce+\n done\nqed\n\n\nlemma cap_swap_no_reply_caps:\n assumes cap: \"cs p = Some cap\"\n and cap': \"cs p' = Some cap'\"\n and wd: \"weak_derived c cap\"\n and wd': \"weak_derived c' cap'\"\n and nr: \"\\sl R. cs sl \\ Some (cap.ReplyCap t False R)\"\n shows \"\\sl R. (cs(p \\ c', p' \\ c)) sl \\ Some (cap.ReplyCap t False R)\"\nproof -\n have\n \"\\ R. cap \\ cap.ReplyCap t False R\"\n \"\\ R. cap' \\ cap.ReplyCap t False R\"\n using cap cap' nr by clarsimp+\n hence\n \"\\ R. c \\ cap.ReplyCap t False R\"\n \"\\ R. c' \\ cap.ReplyCap t False R\"\n by (clarsimp,drule_tac weak_derived_Reply_eq [OF wd]\n weak_derived_Reply_eq [OF wd'],fastforce)+\n thus ?thesis\n using nr unfolding fun_upd_def\n by (clarsimp split: if_split_asm)\nqed\n\n\nlemma cap_swap_has_reply_cap_neg:\n \"\\\\s. \\ has_reply_cap t s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at (weak_derived c') p' s \\\n p \\ p'\\\n cap_swap c p c' p' \\\\rv s. \\ has_reply_cap t s\\\"\n apply (simp add: has_reply_cap_def is_reply_cap_to_def cte_wp_at_caps_of_state\n del: split_paired_All split_paired_Ex)\n apply (wp cap_swap_caps_of_state)\n apply (elim conjE exE)\n apply (drule(3) cap_swap_no_reply_caps[where cs=\"caps_of_state _\"])\n apply fastforce+\n done\n\n\nlemma cap_swap_replies:\n \"\\\\s. valid_reply_caps s\n \\ cte_wp_at (weak_derived c) p s\n \\ cte_wp_at (weak_derived c') p' s\n \\ p \\ p'\\\n cap_swap c p c' p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: valid_reply_caps_def)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_swap_has_reply_cap_neg)\n apply (clarsimp simp: fun_upd_def cte_wp_at_caps_of_state\n unique_reply_caps_cap_swap [simplified fun_upd_def])\n done\n\n\nlemma cap_swap_fd_replies[wp]:\n \"\\\\s. valid_reply_caps s\\\n cap_swap_for_delete p p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp cap_swap_replies get_cap_wp)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\nlemma cap_swap_reply_masters:\n \"\\valid_reply_masters and K(\\ is_master_reply_cap c \\ \\ is_master_reply_cap c')\\\n cap_swap c p c' p' \\\\_. valid_reply_masters\\\"\n apply (simp add: valid_reply_masters_def is_master_reply_cap_to_def cte_wp_at_caps_of_state)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_swap_caps_of_state\n cap_swap_typ_at tcb_at_typ_at)\n apply (simp add: is_cap_simps)\n apply fastforce\n done\n\n\nlemma cap_swap_fd_reply_masters[wp]:\n \"\\valid_reply_masters and\n cte_wp_at (\\c. \\ is_master_reply_cap c) p and\n cte_wp_at (\\c. \\ is_master_reply_cap c) p'\\\n cap_swap_for_delete p p'\n \\\\rv. valid_reply_masters\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp cap_swap_reply_masters get_cap_wp)\n apply (clarsimp simp: cte_wp_at_def)\n done\n\n\ncrunch refs_of[wp]: cap_swap \"\\s. P (state_refs_of s)\"\n (ignore: set_cap simp: state_refs_of_pspaceI)\n\ncrunch hyp_refs_of[wp]: cap_swap \"\\s. P (state_hyp_refs_of s)\"\n (ignore: set_cap simp: state_refs_of_pspaceI)\n\ncrunch cur_tcb[wp]: cap_swap \"cur_tcb\"\n\n\nlemma copy_of_cte_refs:\n \"copy_of cap cap' \\ cte_refs cap = cte_refs cap'\"\n apply (rule ext, clarsimp simp: copy_of_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n apply (clarsimp simp: is_cap_simps bits_of_def\n split: cap.split_asm)+\n done\n\n\nlemma copy_of_is_zombie:\n \"copy_of cap cap' \\ is_zombie cap = is_zombie cap'\"\n apply (clarsimp simp: copy_of_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n apply (clarsimp simp: is_cap_simps bits_of_def\n split: cap.split_asm)+\n done\n\n\nlemma copy_of_reply_cap:\n \"copy_of (ReplyCap t False R) cap \\ \\ R'. cap = ReplyCap t False R'\"\n apply (clarsimp simp: copy_of_def is_cap_simps)\n by (cases cap, simp_all add: same_object_as_def)\n\n\nlemma copy_of_cap_irqs:\n \"copy_of cap cap' \\ cap_irqs cap = cap_irqs cap'\"\n apply (clarsimp simp: copy_of_def cap_irqs_def split: if_split_asm)\n apply (cases cap', simp_all add: same_object_as_def)\n by (clarsimp simp: is_cap_simps bits_of_def cap_range_def\n split: cap.split_asm)+\n\nlemma copy_of_arch_gen_obj_refs:\n \"copy_of cap cap' \\ arch_gen_refs cap = arch_gen_refs cap'\"\n apply (clarsimp simp: copy_of_def split: if_split_asm)\n by (cases cap'; clarsimp simp: same_object_as_def is_cap_simps same_aobject_same_arch_gen_refs\n split: cap.split_asm)\n\nlemma cap_swap_valid_idle[wp]:\n \"\\valid_idle\\\n cap_swap c a c' b \\\\_. valid_idle\\\"\n apply (simp add: cap_swap_def set_cdt_def)\n apply (wp set_cap_idle set_cap_it|simp)+\n done\n\n\nlemma cap_swap_global_refs[wp]:\n \"\\valid_global_refs and\n (\\s. global_refs s \\ cap_range c = {}) and\n (\\s. global_refs s \\ cap_range c' = {})\\\n cap_swap c a c' b \\\\_. valid_global_refs\\\"\n apply (simp add: cap_swap_def set_cdt_def)\n apply (wp set_cap_globals | simp)+\n done\n\n\ncrunch arch[wp]: cap_swap \"\\s. P (arch_state s)\"\n\ncrunch irq_node[wp]: cap_swap \"\\s. P (interrupt_irq_node s)\"\n\n\nlemma valid_reply_caps_of_stateD:\n \"\\p t s R. \\ valid_reply_caps s; caps_of_state s p = Some (cap.ReplyCap t False R) \\\n \\ st_tcb_at awaiting_reply t s\"\n by (fastforce simp: valid_reply_caps_def has_reply_cap_def\n is_reply_cap_to_def cte_wp_at_caps_of_state)\n\nlemma valid_reply_caps_of_stateD':\n \"\\p t s R. \\ valid_reply_caps s; cte_wp_at (is_reply_cap_to t) p s \\\n \\ st_tcb_at awaiting_reply t s\"\n by (fastforce simp: valid_reply_caps_def has_reply_cap_def\n is_reply_cap_to_def cte_wp_at_caps_of_state)\n\ncrunch interrupt_states[wp]: cap_swap \"\\s. P (interrupt_states s)\"\n\n\nlemma weak_derived_cap_irqs:\n \"weak_derived c c' \\ cap_irqs c = cap_irqs c'\"\n by (auto simp add: weak_derived_def copy_of_cap_irqs)\n\n\nlemma cap_swap_irq_handlers[wp]:\n \"\\valid_irq_handlers and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b \\\\rv. valid_irq_handlers\\\"\n apply (simp add: valid_irq_handlers_def irq_issued_def)\n apply (rule hoare_pre)\n apply (wp hoare_use_eq [where f=interrupt_states,\n OF cap_swap_interrupt_states cap_swap_caps_of_state])\n apply (clarsimp simp: cte_wp_at_caps_of_state\n elim!: ranE split: if_split_asm\n dest!: weak_derived_cap_irqs)\n apply auto\n done\n\n\ncrunch vspace_objs [wp]: cap_swap \"valid_vspace_objs\"\n\ncrunch valid_global_objs [wp]: cap_swap \"valid_global_objs\"\n\ncrunch valid_global_vspace_mappings [wp]: cap_swap \"valid_global_vspace_mappings\"\n\ncontext CNodeInv_AI begin\n\nlemma cap_swap_valid_arch_caps[wp]:\n \"\\c a c' b.\n \\valid_arch_caps and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_swap_def)\n apply (rule hoare_pre)\n apply (subst bind_assoc[symmetric],\n rule hoare_seq_ext [rotated],\n rule swap_of_caps_valid_arch_caps)\n apply (wp | simp split del: if_split)+\n done\n\nend\n\n\ncrunch v_ker_map[wp]: cap_swap \"valid_kernel_mappings\"\n\ncrunch eq_ker_map[wp]: cap_swap \"equal_kernel_mappings\"\n\ncrunch only_idle [wp]: cap_swap only_idle\n\ncrunch pspace_in_kernel_window[wp]: cap_swap \"pspace_in_kernel_window\"\n\n\nlemma cap_swap_valid_ioc[wp]:\n \"\\\\s. valid_ioc s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at (weak_derived c') p' s\\\n cap_swap c p c' p'\n \\\\_ s. valid_ioc s\\\"\n apply (simp add: cap_swap_def valid_ioc_def cte_wp_at_caps_of_state)\n apply (wp set_cdt_cos_ioc set_cap_caps_of_state2 | simp split del: if_split)+\n apply (cases p, cases p')\n apply fastforce\n done\n\n\ncrunch machine_state[wp]: cap_swap \"\\s. P(machine_state s)\"\n\ncrunch valid_irq_states[wp]: cap_swap \"valid_irq_states\"\n\ncrunch pspace_respects_device_region[wp]: cap_swap pspace_respects_device_region\n\nlemma cap_refs_respects_device_region_original_cap[wp]:\n \"cap_refs_respects_device_region\n (s\\is_original_cap := ocp\\) = cap_refs_respects_device_region s\"\n by (simp add:cap_refs_respects_device_region_def)\n\ncontext CNodeInv_AI begin\nlemma cap_swap_cap_refs_respects_device_region[wp]:\n \"\\cap_refs_respects_device_region and cte_wp_at (weak_derived c) a and cte_wp_at (weak_derived c') b\\\n cap_swap c a c' b \\\\rv. cap_refs_respects_device_region\\\"\n apply (simp add:cap_swap_def)\n apply wp\n apply (simp add: cap_refs_respects_device_region_def)\n apply (rule hoare_strengthen_post[OF CSpace_AI.set_cdt_cap_refs_respects_device_region])\n apply simp\n apply wp+\n apply (clarsimp simp add: cap_refs_respects_device_region_def cte_wp_at_caps_of_state\n cap_range_respects_device_region_def\n simp del: split_paired_All split_paired_Ex\n | (wp hoare_vcg_all_lift hoare_vcg_imp_lift)+)+\n apply (frule_tac x = a in spec)\n apply (frule_tac x = b in spec)\n apply (clarsimp simp: weak_derived_cap_range)\n apply (intro conjI impI allI)\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (rule disjI2)\n apply (intro conjI impI)\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply (rule ccontr)\n apply simp\n apply (rule disjI2)\n apply (rule ccontr)\n apply (clarsimp simp add: weak_derived_cap_range weak_derived_cap_is_device)+\n apply fastforce\n done\n\nlemma cap_swap_aobj_at:\n \"arch_obj_pred P' \\\n \\\\s. P (obj_at P' pd s)\\ cap_swap c (a, b) c' (aa, ba) \\\\r s. P (obj_at P' pd s)\\\"\n unfolding cap_swap_def set_cdt_def by (wpsimp wp: set_cap.aobj_at)\n\nlemma cap_swap_invs[wp]:\n \"\\c' a c b.\n \\invs and ex_cte_cap_wp_to (appropriate_cte_cap c') a\n and ex_cte_cap_wp_to (appropriate_cte_cap c) b and\n valid_cap c and valid_cap c' and\n tcb_cap_valid c b and tcb_cap_valid c' a and\n cte_wp_at (weak_derived c) a and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c) a and\n cte_wp_at (weak_derived c') b and\n cte_wp_at (\\cc. is_untyped_cap cc \\ cc = c') b and\n K (a \\ b \\ \\ is_master_reply_cap c \\ \\ is_master_reply_cap c')\\\n cap_swap c a c' b \\\\rv. invs :: 'state_ext state \\ bool\\\"\n unfolding invs_def valid_state_def valid_pspace_def\n apply (wp cap_swap_replies cap_swap_reply_masters valid_arch_state_lift_aobj_at\n cap_swap_typ_at valid_irq_node_typ cap_swap_aobj_at\n | simp\n | erule disjE\n | clarsimp simp: cte_wp_at_caps_of_state copy_of_cte_refs weak_derived_def\n copy_obj_refs copy_of_zobj_refs copy_of_is_zombie\n copy_of_cap_irqs gen_obj_refs_eq copy_of_arch_gen_obj_refs\n | clarsimp simp: valid_global_refs_def valid_refs_def copy_of_cap_range\n cte_wp_at_caps_of_state\n simp del: split_paired_Ex split_paired_All\n | rule conjI\n | clarsimp dest!: valid_reply_caps_of_stateD)+\n done\n\nlemma cap_swap_fd_invs[wp]:\n \"\\a b.\n \\invs and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) a\n and ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) b\n and (\\s. \\c. tcb_cap_valid c a s)\n and (\\s. \\c. tcb_cap_valid c b s)\n and cte_wp_at (\\c. \\ is_master_reply_cap c) a\n and cte_wp_at (\\c. \\ is_master_reply_cap c) b\\\n cap_swap_for_delete a b \\\\rv. invs :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_swap_for_delete_def)\n apply (wp get_cap_wp)\n apply (clarsimp)\n apply (strengthen cap_irqs_appropriate_strengthen, simp)\n apply (rule conjI, fastforce dest: cte_wp_at_valid_objs_valid_cap)\n apply (rule conjI, fastforce dest: cte_wp_at_valid_objs_valid_cap)\n apply (clarsimp simp: cte_wp_at_caps_of_state weak_derived_def)\n done\n\nend\n\n\nlemma final_cap_unchanged:\n assumes x: \"\\P p. \\cte_wp_at P p\\ f \\\\rv. cte_wp_at P p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\is_final_cap' cap\\ f \\\\rv. is_final_cap' cap\\\"\n apply (simp only: is_final_cap'_def3 imp_conv_disj de_Morgan_conj)\n apply (wp hoare_vcg_ex_lift hoare_vcg_all_lift x hoare_vcg_disj_lift\n valid_cte_at_neg_typ [OF y])\n done\n\n\nlemmas set_cap_cte_wp_at_cases = set_cap_cte_wp_at[simplified if_bool_eq_conj pred_conj_def conj_comms]\n\n\nlemma cyclic_zombieD[dest!]:\n \"cap_cyclic_zombie cap sl\n \\ \\p zb n. cap = cap.Zombie p zb n\n \\ sl = (p, replicate (zombie_cte_bits zb) False)\"\n by (cases cap, simp_all add: cap_cyclic_zombie_def)\n\n\ncontext CNodeInv_AI begin\n\nlemma rec_del_abort_cases:\n \"\\args (s::'state_ext state).\n case args of FinaliseSlotCall sl ex \\ s \\ \\\\\\\n rec_del (FinaliseSlotCall sl ex)\n \\\\rv s. (fst rv) \\ (\\ ex \\ cte_wp_at (\\c. is_zombie c \\ sl \\ fst_cte_ptrs c) sl s)\\,\\\\\\\\\n | _ \\ True\"\n subgoal for args s\n proof (induct rule: rec_del_induct)\n case (2 slot exposed)\n note wp = \"2.hyps\"[simplified rec_del_call.simps]\n show ?case\n apply (subst rec_del_simps_ext)\n apply (simp only: rec_del_call.simps split_def)\n apply wp\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wp wp)+\n apply (wp irq_state_independent_AI | simp)+\n apply (rule hoare_strengthen_post)\n apply (rule finalise_cap_cases[where slot=slot])\n apply clarsimp\n apply (fastforce simp: fst_cte_ptrs_def)\n apply (simp add: is_final_cap_def | wp get_cap_wp)+\n done\n qed (simp_all add: rec_del_fails)\n done\n\n\nlemma rec_del_delete_cases:\n \"\\sl ex.\n \\\\ :: 'state_ext state \\ bool\\\n rec_del (CTEDeleteCall sl ex)\n \\\\rv s. cte_wp_at (\\c. c = cap.NullCap \\ \\ ex \\ is_zombie c \\ sl \\ fst_cte_ptrs c) sl s\\,-\"\n subgoal for sl ex\n using rec_del_abort_cases [where args=\"FinaliseSlotCall sl ex\"]\n apply (subst rec_del_simps_ext, simp add: split_def)\n apply wp\n apply (rule hoare_strengthen_post [OF empty_slot_deletes])\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (rule use_spec, rule spec_strengthen_postE, assumption)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply assumption\n done\n done\n\n\nlemma cap_delete_deletes:\n notes hoare_pre [wp_pre del]\n shows\n \"\\p.\n \\\\ :: 'state_ext state \\ bool\\\n cap_delete p\n \\\\rv. cte_wp_at (\\c. c = cap.NullCap) p\\,-\"\n subgoal for p\n unfolding cap_delete_def\n using rec_del_delete_cases[where sl=p and ex=True]\n apply (simp add: validE_R_def)\n apply wp\n apply simp\n done\n done\n\nend\n\n\nlemma final_cap_same_objrefs:\n \"\\is_final_cap' cap and\n cte_wp_at (\\c. obj_refs cap \\ obj_refs c \\ {}\n \\ cap_irqs cap \\ cap_irqs c \\ {}\n \\ arch_gen_refs cap \\\n arch_gen_refs c \\ {}) ptr\\\n set_cap cap ptr \\\\rv. is_final_cap' cap\\\"\n apply (simp only: is_final_cap'_def3 pred_conj_def\n cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp simp del: split_paired_Ex split_paired_All)\n apply (rule_tac x=ptr in exI)\n apply (subgoal_tac \"(a, b) = ptr\")\n apply clarsimp\n apply (erule_tac x=\"ptr\" in allE)\n apply (fastforce simp: gen_obj_refs_Int)\n done\n\n\nlemma cte_wp_at_weakenE_customised:\n \"\\cte_wp_at P t s; \\c. \\ P c; cte_wp_at ((=) c) t s \\ \\ P' c\\ \\ cte_wp_at P' t s\"\n by (clarsimp simp: cte_wp_at_def)\n\n\nlemma final_cap_at_same_objrefs:\n \"\\\\s. cte_wp_at (\\c. obj_refs c \\ {} \\ is_final_cap' c s) p s\n \\ cte_wp_at (\\c. gen_obj_refs cap = gen_obj_refs c) ptr s \\ p \\ ptr\\\n set_cap cap ptr \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\n apply (simp only: final_cap_at_eq cte_wp_at_conj)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply (clarsimp simp del: split_paired_All split_paired_Ex\n simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n apply fastforce\n done\n\n\nlemma cap_swap_fd_final_cap_at_one_case:\n \"\\\\s. p \\ p'' \\ ((p = p') \\ cte_wp_at (\\c. is_final_cap' c s) p'' s)\n \\ ((p \\ p') \\ cte_wp_at (\\c. is_final_cap' c s) p s)\\\n cap_swap_for_delete p' p''\n \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\n apply (simp only: final_cap_at_eq cte_wp_at_conj)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply (cases \"p = p'\")\n apply (cases p', clarsimp)\n apply clarsimp\n apply (cases p', cases p'', clarsimp)\n done\n\n\nlemma cap_swap_fd_cte_wp_at_one_case:\n \"\\\\s. p \\ p'' \\ ((p = p') \\ cte_wp_at P p'' s) \\ ((p \\ p') \\ cte_wp_at P p s)\\\n cap_swap_for_delete p' p''\n \\\\rv s. cte_wp_at P p s\\\"\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply clarsimp\n done\n\n\nlemma valid_cte_wp_at_prop:\n assumes x: \"\\P p. \\cte_wp_at P p\\ f \\\\rv. cte_wp_at P p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\\\s. P' (cte_wp_at P p s)\\ f \\\\rv s. P' (cte_wp_at P p s)\\\"\nproof -\n have cte_wp_at_neg2:\n \"\\P p s. (\\ cte_wp_at P p s) = (\\ cte_at p s \\ cte_wp_at (\\c. \\ P c) p s)\"\n by (fastforce simp: cte_wp_at_def)\n have rev_iffI:\n \"\\P Q. \\ P \\ Q; \\ P \\ \\ Q \\ \\ P = Q\"\n by fastforce\n show ?thesis\n apply (clarsimp simp: valid_def elim!: rsubst[where P=P'])\n apply (rule rev_iffI)\n apply (erule(1) use_valid [OF _ x])\n apply (subst cte_wp_at_neg2)\n apply (erule use_valid)\n apply (wp hoare_vcg_disj_lift x y valid_cte_at_neg_typ)\n apply (simp only: cte_wp_at_neg2[symmetric] simp_thms)\n done\nqed\n\n\nlemma final_cap_at_unchanged:\n assumes x: \"\\P p. \\cte_wp_at (\\c. P (gen_obj_refs c)) p\\ f\n \\\\rv. cte_wp_at (\\c. P (gen_obj_refs c)) p\\\"\n assumes y: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\\\s. cte_wp_at (\\c. is_final_cap' c s) p s\\ f\n \\\\rv s. cte_wp_at (\\c. is_final_cap' c s) p s\\\"\nproof -\n have final_cap_at_eq':\n \"\\p s. cte_wp_at (\\c. is_final_cap' c s) p s =\n (\\cp. cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cp) p s\n \\ (obj_refs cp \\ {} \\ cap_irqs cp \\ {} \\ arch_gen_refs cp \\ {})\n \\ (\\p'. (cte_at p' s \\ p' \\ p) \\\n cte_wp_at (\\c. gen_obj_refs cp \\ gen_obj_refs c = {}) p' s))\"\n apply (simp add: final_cap_at_eq cte_wp_at_def)\n apply (rule iffI)\n apply (clarsimp simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n apply (rule exI, rule conjI, rule refl)\n apply clarsimp\n apply (clarsimp simp: gen_obj_refs_Int gen_obj_refs_empty gen_obj_refs_eq)\n done\n show ?thesis\n apply (simp only: final_cap_at_eq' imp_conv_disj de_Morgan_conj)\n apply (wp hoare_vcg_ex_lift hoare_vcg_all_lift x hoare_vcg_disj_lift\n valid_cte_at_neg_typ y)\n done\nqed\n\nlemma zombie_has_objrefs:\n \"is_zombie c \\ obj_refs c \\ {}\"\n by (case_tac c, simp_all add: is_zombie_def)\n\nlemma word_same_bl_memo_unify_word_type:\n \"\\ of_bl xs = (of_bl ys :: ('a :: len) word); length xs = length ys;\n length xs \\ len_of TYPE('a) \\ \\ xs = ys\"\n apply (subst same_append_eq[symmetric])\n apply (rule word_bl.Abs_eqD)\n apply (subst of_bl_rep_False)+\n apply simp\n apply simp\n apply (erule le_add_diff_inverse2)\n apply simp\n done\n\n\nlemma word_and_bl_proof:\n \"\\ invs s; kheap s x = Some (CNode sz cs);\n unat (of_bl y :: machine_word) = 0; unat (of_bl z :: machine_word) = 0;\n y \\ dom cs; z \\ dom cs \\ \\ y = z\"\n apply (simp add: unat_eq_0)\n apply (frule invs_valid_objs, erule(1) valid_objsE)\n apply (clarsimp simp: valid_obj_def valid_cs_def\n valid_cs_size_def well_formed_cnode_n_def)\n apply (rule word_same_bl_memo_unify_word_type[where 'a=machine_word_len])\n apply simp\n apply simp\n apply (simp add: word_bits_def)\n done\n\n\nlemma final_zombie_not_live:\n \"\\ is_final_cap' (cap.Zombie ptr b n) s; cte_wp_at ((=) (cap.Zombie ptr b n)) p s;\n if_live_then_nonz_cap s \\\n \\ \\ obj_at live ptr s\"\n apply clarsimp\n apply (drule(1) if_live_then_nonz_capD, simp)\n apply (clarsimp simp: ex_nonz_cap_to_def zobj_refs_to_obj_refs)\n apply (subgoal_tac \"(a, ba) \\ p\")\n apply (clarsimp simp: is_final_cap'_def)\n apply (erule(1) obvious)\n apply (clarsimp simp: cte_wp_at_def is_zombie_def gen_obj_refs_Int)+\n done\n\n\nlemma suspend_ex_cte_cap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ IpcCancel_A.suspend t \\\\rv. ex_cte_cap_wp_to P p\\\"\n apply (simp add: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state\n del: split_paired_Ex)\n apply (wp hoare_use_eq_irq_node [OF suspend_irq_node suspend_caps_of_state])\n apply (simp del: split_paired_Ex split_paired_All)\n apply (intro allI impI, erule exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp: can_fast_finalise_def\n split: cap.split_asm)\n done\n\n\nlemma of_bl_eq_0:\n \"\\ of_bl xs = (0 :: ('a :: len) word); length xs \\ len_of TYPE('a) \\\n \\ \\n. xs = replicate n False\"\n apply (rule exI)\n apply (rule word_same_bl_memo_unify_word_type[where 'a='a]; simp)\n done\n\n\ncontext CNodeInv_AI begin\n\nlemma zombie_is_cap_toE:\n \"\\ptr zbits n p (s::'state_ext state) m P.\n \\ cte_wp_at ((=) (Zombie ptr zbits n)) p s; invs s; m < n; P (Zombie ptr zbits n) \\\n \\ ex_cte_cap_wp_to P (ptr, nat_to_cref (zombie_cte_bits zbits) m) s\"\n unfolding ex_cte_cap_wp_to_def\n apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp)\n apply (intro exI, erule cte_wp_at_weakenE)\n apply clarsimp\n apply (drule(2) zombie_is_cap_toE_pre, simp)\n done\n\nend\n\nlemma zombie_is_cap_toE2:\n \"\\ cte_wp_at ((=) (cap.Zombie ptr zbits n)) p s; 0 < n;\n P (cap.Zombie ptr zbits n) \\\n \\ ex_cte_cap_wp_to P (ptr, replicate (zombie_cte_bits zbits) False) s\"\n unfolding ex_cte_cap_wp_to_def\n apply (rule exI, erule cte_wp_at_weakenE)\n apply clarsimp\n done\n\n\nlemma set_cap_emptyable[wp]:\n \"\\ is_master_reply_cap cap \\\n \\emptyable sl and cte_at p\\ set_cap cap p \\\\rv. emptyable sl\\\"\n apply (simp add: emptyable_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cap_typ_at set_cap_cte_wp_at\n | simp add: tcb_at_typ)+\n done\n\n\nlemma set_cap_halted_if_tcb[wp]:\n \"\\halted_if_tcb t\\ set_cap cap p \\\\rv. halted_if_tcb t\\\"\n apply (simp add: halted_if_tcb_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cap_typ_at | simp add: tcb_at_typ)+\n done\n\n\nlemma valid_Zombie_n_less_cte_bits:\n \"s \\ cap.Zombie p zb n \\ n \\ 2 ^ zombie_cte_bits zb\"\n by (clarsimp simp: valid_cap_def split: option.split_asm)\n\n\nlemma zombie_cte_bits_less:\n \"s \\ cap.Zombie p zb m \\ zombie_cte_bits zb < word_bits\"\n by (clarsimp simp: valid_cap_def cap_aligned_def\n split: option.split_asm)\n\n\ncontext CNodeInv_AI begin\n\nlemma nat_to_cref_replicate_Zombie:\n \"\\zb n (s::'state_ext state) p m.\n \\ nat_to_cref (zombie_cte_bits zb) n = replicate (zombie_cte_bits zb) False;\n s \\ cap.Zombie p zb m; n < m \\\n \\ n = 0\"\n apply (subgoal_tac \"unat (of_bl (nat_to_cref (zombie_cte_bits zb) n)) = 0\")\n apply (subst(asm) unat_of_bl_nat_to_cref)\n apply (drule valid_Zombie_n_less_cte_bits, simp)\n apply (erule zombie_cte_bits_less)\n apply simp\n apply simp\n done\n\nend\n\n\nlemma replicate_False_tcb_valid[simp]:\n \"tcb_cap_valid cap (p, replicate n False) s\"\n apply (clarsimp simp: tcb_cap_valid_def st_tcb_def2 tcb_at_def)\n apply (rule conjI)\n apply (clarsimp split: option.split)\n apply (frule tcb_cap_cases_length[OF domI])\n apply (clarsimp simp add: tcb_cap_cases_def tcb_cnode_index_def to_bl_1)\n apply (cases n, simp_all add: tcb_cnode_index_def)\n done\n\n\nlemma tcb_valid_nonspecial_cap:\n \"\\ caps_of_state s p = Some cap; valid_objs s;\n \\ptr st. \\(getF, setF, restr) \\ ran tcb_cap_cases.\n \\ restr ptr st cap \\ (\\cap. restr ptr st cap);\n \\ptr. (is_nondevice_page_cap cap \\ cap = cap.NullCap) \\\n valid_ipc_buffer_cap cap ptr\n \\ valid_ipc_buffer_cap cap' ptr \\\n \\ tcb_cap_valid cap' p s\"\n apply (drule cte_wp_tcb_cap_valid[rotated])\n apply (erule caps_of_state_cteD)\n apply (clarsimp simp: tcb_cap_valid_def st_tcb_def2)\n apply (clarsimp split: option.split_asm)\n apply (rule conjI)\n apply (drule spec, drule spec, drule bspec, erule ranI)\n apply fastforce\n apply (clarsimp simp: eq_commute)\n done\n\n\nlemma suspend_makes_halted[wp]:\n \"\\valid_objs\\ IpcCancel_A.suspend thread \\\\_. st_tcb_at halted thread\\\"\n unfolding IpcCancel_A.suspend_def\n by (wp hoare_strengthen_post [OF sts_st_tcb_at]\n | clarsimp elim!: pred_tcb_weakenE)+\n\n\nlemma empty_slot_emptyable[wp]:\n \"\\emptyable sl and cte_at slot'\\ empty_slot slot' opt \\\\rv. emptyable sl\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_weaken_pre)\n apply (simp add: emptyable_def)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift | simp add: tcb_at_typ)+\n apply (simp add: is_cap_simps emptyable_def tcb_at_typ)\n done\n\n\ncrunch emptyable[wp]: blocked_cancel_ipc \"emptyable sl\"\n (ignore: set_thread_state wp: emptyable_lift sts_st_tcb_at_cases static_imp_wp)\n\ncrunch emptyable[wp]: cancel_signal \"emptyable sl\"\n (ignore: set_thread_state wp: emptyable_lift sts_st_tcb_at_cases static_imp_wp)\n\n\nlemma cap_delete_one_emptyable[wp]:\n \"\\invs and emptyable sl and cte_at sl'\\ cap_delete_one sl' \\\\_. emptyable sl\\\"\n apply (simp add: cap_delete_one_def unless_def is_final_cap_def)\n apply (wpsimp wp: get_cap_wp)\n done\n\n\nlemmas tcb_at_cte_at_2 = tcb_at_cte_at [where ref=\"tcb_cnode_index 2\",\n simplified dom_tcb_cap_cases]\n\n\ndeclare thread_set_Pmdb [wp]\n\n\nlemma reply_cancel_ipc_emptyable[wp]:\n \"\\invs and emptyable sl and valid_mdb\\ reply_cancel_ipc ptr \\\\_. emptyable sl\\\"\n apply (simp add: reply_cancel_ipc_def)\n apply (wp select_wp select_inv hoare_drop_imps | simp add: Ball_def)+\n apply (wp hoare_vcg_all_lift hoare_convert_imp thread_set_Pmdb\n thread_set_invs_trivial thread_set_emptyable thread_set_cte_at\n | simp add: tcb_cap_cases_def descendants_of_cte_at)+\n done\n\ncrunch emptyable[wp]: cancel_ipc \"emptyable sl\"\n\ncrunch emptyable[wp]: update_restart_pc \"emptyable sl\"\n (rule: emptyable_lift)\n\nlemma suspend_emptyable[wp]:\n \"\\invs and emptyable sl and valid_mdb\\ suspend l \\\\_. emptyable sl\\\"\n apply (simp add: IpcCancel_A.suspend_def)\n apply (wp|simp)+\n apply (wp emptyable_lift sts_st_tcb_at_cases)+\n apply (wpsimp wp: set_thread_state_cte_wp_at)+\n done\n\ncrunch emptyable[wp]: do_machine_op \"emptyable sl\"\n (rule: emptyable_lift)\n\ncrunch emptyable[wp]: set_irq_state \"emptyable sl\"\n (rule: emptyable_lift)\n\n\ndeclare get_irq_slot_real_cte [wp]\n\n\nlemma cap_swap_for_delete_emptyable[wp]:\n \"\\emptyable sl and emptyable sl'\\ cap_swap_for_delete sl' sl \\\\rv. emptyable sl\\\"\n apply (simp add: emptyable_def cap_swap_for_delete_def cap_swap_def tcb_at_typ)\n apply (rule hoare_pre)\n apply (subst imp_conv_disj)+\n apply (wp hoare_vcg_disj_lift set_cdt_typ_at set_cap_typ_at | simp split del: if_split)+\n done\n\n\ncontext CNodeInv_AI begin\n\nlemma finalise_cap_not_reply_master:\n \"\\rv s' cap sl (s::'state_ext state).\n (Inr rv, s') \\ fst (liftE (finalise_cap cap sl) s) \\ \\ is_master_reply_cap (fst rv)\"\n by (simp add: Inr_in_liftE_simp finalise_cap_not_reply_master_unlifted)\n\nend\n\n\ncrunch cte_at_pres[wp]: empty_slot \"cte_at sl\"\n\n\nlemma cte_wp_at_emptyableD:\n \"\\P. \\ cte_wp_at (\\c. c = cap) p s; valid_objs s; \\cap. P cap \\ \\ is_master_reply_cap cap \\ \\\n P cap \\ emptyable p s\"\n apply (simp add: emptyable_def)\n apply (clarsimp simp add: obj_at_def is_tcb)\n apply (erule(1) valid_objsE)\n apply (clarsimp simp: cte_wp_at_cases valid_obj_def valid_tcb_def\n tcb_cap_cases_def pred_tcb_at_def obj_at_def\n split: Structures_A.thread_state.splits)\n done\n\n\nlemma cte_wp_at_not_reply_master:\n \"\\a b s. \\ tcb_at a s \\ b \\ tcb_cnode_index 2; cte_at (a, b) s;\n valid_objs s; valid_reply_masters s \\\n \\ cte_wp_at (\\c. \\ is_master_reply_cap c) (a, b) s\"\n by (fastforce simp: valid_reply_masters_def cte_wp_at_caps_of_state\n is_cap_simps valid_cap_def is_master_reply_cap_to_def\n dest: caps_of_state_valid_cap)\n\n\ndeclare finalise_cap_cte_cap_to [wp]\n\n\nlemma appropriate_Zombie:\n \"\\ptr zbits n. appropriate_cte_cap (cap.Zombie ptr zbits n)\n = (\\cap. cap_irqs cap = {})\"\n by (rule ext, simp add: appropriate_cte_cap_def)\n\n\nlemma no_cap_to_obj_with_diff_ref_eqE:\n \"\\ no_cap_to_obj_with_diff_ref cap S s;\n obj_refs cap' = obj_refs cap; table_cap_ref cap' = table_cap_ref cap;\n S \\ S' \\\n \\ no_cap_to_obj_with_diff_ref cap' S' s\"\n by (auto simp add: no_cap_to_obj_with_diff_ref_def Ball_def)\n\n\nlemma context_conjI': \"\\P; P \\ Q\\ \\ Q \\ P\"\n apply simp\ndone\n\n\nlemma real_cte_at_not_tcb:\n \"real_cte_at sl s \\ \\ tcb_at (fst sl) s\"\n apply (simp add: tcb_at_typ obj_at_def)\n apply (clarsimp simp: is_cap_table_def)\n done\n\n\ncontext CNodeInv_AI_2 begin\n\nlemma rec_del_invs:\n \"\\args.\n \\invs and valid_rec_del_call args\n and (\\s. \\ exposed_rdcall args\n \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall args) s)\n and emptyable (slot_rdcall args)\n and (\\s. case args of ReduceZombieCall cap sl ex \\\n \\ cap_removeable cap sl\n \\ (\\t\\obj_refs cap. halted_if_tcb t s)\n | _ \\ True)\\\n rec_del args\n \\\\rv. invs :: 'state_ext state \\ bool\\\"\n apply (rule validE_valid)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\nlemma cap_delete_invs[wp]:\n \"\\ptr.\n \\invs and emptyable ptr :: 'state_ext state \\ bool\\\n cap_delete ptr\n \\\\rv. invs\\\"\n unfolding cap_delete_def\n apply (rule hoare_pre, wp rec_del_invs)\n apply simp\n done\n\nlemma cap_delete_tcb[wp]:\n \"\\t ptr. \\tcb_at t :: 'state_ext state \\ bool\\ cap_delete ptr \\\\rv. tcb_at t\\\"\n unfolding cap_delete_def\n by (simp add: tcb_at_typ | wp rec_del_typ_at)+\n\nlemma cap_delete_valid_cap:\n \"\\c p. \\valid_cap c :: 'state_ext state \\ bool\\ cap_delete p \\\\_. valid_cap c\\\"\n unfolding cap_delete_def\n by (wp valid_cap_typ rec_del_typ_at | simp)+\n\nlemma cap_delete_cte_at:\n \"\\c p. \\cte_at c :: 'state_ext state \\ bool\\ cap_delete p \\\\_. cte_at c\\\"\n unfolding cap_delete_def by (wp rec_del_cte_at | simp)+\n\nlemma cap_delete_typ_at:\n \"\\P T p cref. \\\\s::'state_ext state. P (typ_at T p s)\\ cap_delete cref \\\\rv s. P (typ_at T p s)\\\"\n unfolding cap_delete_def by (wp rec_del_typ_at | simp)+\n\nend\n\n\nlemma cap_swap_fd_st_tcb_at[wp]:\n \"\\pred_tcb_at proj P t\\ cap_swap_for_delete sl sl' \\\\rv. pred_tcb_at proj P t\\\"\n unfolding cap_swap_for_delete_def\n by (wp, simp)\n\n\ndeclare if_cong[cong]\n\n\nlemma cases2 [case_names pos_pos neg_pos pos_neg neg_neg]:\n \"\\ \\p; q\\ \\ R; \\\\ p; q\\ \\ R; \\p; \\ q\\ \\ R; \\\\ p; \\ q\\ \\ R \\ \\ R\"\n by auto\n\n\ndefinition\n rpo_measure :: \"'a \\ ('a option \\ nat) option \\ nat\"\nwhere\n \"rpo_measure x v \\ case v of Some (y, n) \\ (if y = Some x then n - 1 else n)\"\n\n\nlemma rpo_measure_simps[simp]:\n \"rpo_measure x (Some (y, n)) = (if y = Some x then n - 1 else n)\"\n by (simp add: rpo_measure_def)\n\ndefinition\n revoke_progress_ord :: \"('a \\ 'a option \\ nat) \\ ('a \\ 'a option \\ nat) \\ bool\"\nwhere\n \"revoke_progress_ord mapa mapb \\ (mapa = mapb)\n \\ (mapb, mapa) \\ measure (\\mp. \\x\\dom mp. rpo_measure x (mp x))\"\n\nlemma rpo_trans:\n \"\\ revoke_progress_ord mapa mapb; revoke_progress_ord mapb mapc \\\n \\ revoke_progress_ord mapa mapc\"\n apply (simp add: revoke_progress_ord_def)\n apply (elim disjE, simp_all)\n done\n\n\ninterpretation mult_is_add: comm_monoid_mult \"(+)\" \"0::'a::comm_monoid_add\"\n by (unfold_locales) (auto simp: field_simps)\n\n\nlemma fold_Int_sub:\n assumes \"finite S\" \"finite T\"\n shows \"(\\x \\ (S \\ T). (f x :: nat)) = (\\x \\ T. f x) - (\\x \\ (T - S). f x)\"\nproof -\n from assms sum.union_disjoint[where A=\"S \\ T\" and B=\"T - S\" and g=f]\n show ?thesis\n apply simp\n apply (drule meta_mp)\n apply blast\n apply (subgoal_tac \"S \\ T \\ (T - S) = T\")\n apply simp\n apply blast\n done\nqed\n\n\nlemma rpo_delta:\n assumes x: \"\\x. x \\ S \\ mapa x = mapb x\"\n assumes F: \"finite S\" \"finite (dom mapa)\" \"finite (dom mapb)\"\n assumes y:\n \"(mapb, mapa) \\ measure (\\mp. \\x \\ S \\ dom mp. rpo_measure x (mp x))\"\n shows \"revoke_progress_ord mapa mapb\"\nproof -\n have P: \"(dom mapa - S) = (dom mapb - S)\"\n by (fastforce simp: x)\n have Q: \"(\\x \\ dom mapa - S. rpo_measure x (mapa x))\n = (\\x \\ dom mapb - S. rpo_measure x (mapb x))\"\n apply (rule sum.cong)\n apply (simp add: P)\n apply (simp add: x)\n done\n show ?thesis using y\n apply (simp add: revoke_progress_ord_def)\n apply (rule disjI2)\n apply (fastforce simp: fold_Int_sub F Q)\n done\nqed\n\n\ndefinition\n cap_to_rpo :: \"cap \\ cslot_ptr option \\ nat\"\nwhere\n \"cap_to_rpo cap \\ case cap of\n cap.NullCap \\ (None, 0)\n | cap.Zombie p zb n \\ (Some (p, replicate (zombie_cte_bits zb) False), 2)\n | _ \\ (None, 3)\"\n\n\nlemmas caps_of_state_set_finite'\n = cte_wp_at_set_finite[simplified cte_wp_at_caps_of_state]\n\n\nlemmas caps_of_state_set_finite\n = caps_of_state_set_finite'\n caps_of_state_set_finite'[where P=\"\\\\\", simplified]\n\n\nlemma empty_slot_rvk_prog:\n \"\\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\n empty_slot sl opt\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\"\n apply (simp add: empty_slot_def)\n apply (rule hoare_pre)\n apply (wp opt_return_pres_lift | simp split del: if_split)+\n apply (wp get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{sl}\"],\n simp_all add: dom_def caps_of_state_set_finite exception_set_finite)\n apply (case_tac cap, simp_all add: cap_to_rpo_def)\n done\n\n\nlemma rvk_prog_update_strg:\n \"revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ cte_wp_at (\\cp. cap_to_rpo cp = cap_to_rpo cap\n \\ rpo_measure p (Some (cap_to_rpo cp))\n > rpo_measure p (Some (cap_to_rpo cap))) p s\n \\ revoke_progress_ord m (option_map cap_to_rpo \\ ((caps_of_state s) (p \\ cap)))\"\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule disjE)\n apply (erule rsubst[where P=\"\\mp. revoke_progress_ord m mp\"])\n apply (rule ext, simp)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{p}\"],\n simp_all add: dom_def caps_of_state_set_finite)\n apply (rule exception_set_finite)\n apply (rule finite_subset [OF _ caps_of_state_set_finite(2)[where s=s]])\n apply clarsimp\n done\n\n\nlemma cap_swap_fd_rvk_prog:\n \"\\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ cte_wp_at (\\cp. cap_to_rpo cp = (Some p1, 2) \\ is_final_cap' cp s) p2 s\\\n cap_swap_for_delete p1 p2\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\"\n apply (simp add: cap_swap_for_delete_def cap_swap_def)\n apply (wp get_cap_wp | simp split del: if_split)+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (erule rpo_trans)\n apply (rule rpo_delta[where S=\"{p1, p2}\"],\n simp_all add: caps_of_state_set_finite exception_set_finite\n dom_def)\n apply (clarsimp simp: is_final_cap'_def2)\n apply (frule spec[where x=\"fst p1\"], drule spec[where x=\"snd p1\"])\n apply (drule spec[where x=\"fst p2\"], drule spec[where x=\"snd p2\"])\n apply (clarsimp simp: cap_to_rpo_def split: cap.split_asm)\n apply (simp split: cap.split)\n apply (clarsimp simp: cte_wp_at_caps_of_state gen_obj_refs_empty)\n apply (drule iffD1)\n apply (simp add: gen_obj_refs_Int)\n apply (simp only:)\n apply simp\n done\n\n\nlemmas empty_slot_rvk_prog' = empty_slot_rvk_prog[unfolded o_def]\n\n\ncrunch rvk_prog: cancel_ipc \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def tcb_cap_cases_def\n wp: hoare_drop_imps empty_slot_rvk_prog' select_wp\n thread_set_caps_of_state_trivial)\n\ncrunch rvk_prog: suspend \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\ncrunch rvk_prog: deleting_irq_handler \"\\s. revoke_progress_ord m (\\x. option_map cap_to_rpo (caps_of_state s x))\"\n (simp: crunch_simps o_def unless_def is_final_cap_def\n wp: crunch_wps empty_slot_rvk_prog' select_wp)\n\nlocale CNodeInv_AI_3 = CNodeInv_AI_2 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes finalise_cap_rvk_prog:\n \"\\a b.\n \\\\s::'state_ext state. revoke_progress_ord m (\\x. map_option cap_to_rpo (caps_of_state s x))\\\n finalise_cap a b\n \\\\_ s. revoke_progress_ord m (\\x. map_option cap_to_rpo (caps_of_state s x))\\\"\n assumes rec_del_rvk_prog:\n \"\\(st::'state_ext state) args.\n st \\ \\\\s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\n \\ (case args of ReduceZombieCall cap sl ex \\\n cte_wp_at (\\c. c = cap) sl s \\ is_final_cap' cap s\n | _ \\ True)\\\n rec_del args\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\,\\\\\\\\\"\n\n\nlemmas rdcall_simps = rec_del_call.simps exposed_rdcall.simps slot_rdcall.simps\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma cap_delete_rvk_prog:\n \"\\m ptr.\n \\\\s::'state_ext state. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\\n cap_delete ptr\n \\\\rv s. revoke_progress_ord m (option_map cap_to_rpo \\ caps_of_state s)\\,-\"\n unfolding cap_delete_def validE_R_def\n apply wpsimp\n apply (unfold validE_R_def)\n apply (rule use_spec)\n apply (rule rec_del_rvk_prog rec_del_rvk_prog[unfolded o_def])\n apply (simp add: o_def)\n done\n\nend\n\n\nlemma get_object_some: \"kheap s ptr = Some ko \\ get_object ptr s = ({(ko, s)}, False)\"\n by (clarsimp simp: get_object_def gets_def get_def bind_def assert_def return_def)\n\nlemma set_cap_id:\n \"cte_wp_at ((=) c) p s \\ set_cap c p s = ({((),s)}, False)\"\n apply (clarsimp simp: cte_wp_at_cases)\n apply (cases p)\n apply (erule disjE)\n apply clarsimp\n apply (simp add: set_cap_def get_object_def bind_assoc exec_gets)\n apply (rule conjI)\n apply (clarsimp simp: set_object_def)\n apply (frule get_object_some)\n apply (drule_tac t=\"fun\" in map_upd_triv)\n apply (clarsimp simp: bind_def get_def return_def put_def a_type_def)\n apply (cases s)\n apply simp\n apply (rule ext, simp)\n apply (clarsimp simp: get_object_def gets_def get_def bind_def assert_def return_def)\n apply clarsimp\n apply (simp add: set_cap_def get_object_def bind_assoc\n exec_gets set_object_def exec_get put_def)\n apply (clarsimp simp: tcb_cap_cases_def\n split: if_split_asm,\n simp_all add: map_upd_triv)\n done\n\n\ndeclare Inr_in_liftE_simp[simp]\n\n\nlemma get_cap_fail_or_not:\n \"fst (get_cap slot s) \\ {} \\ snd (get_cap slot s) = False\"\n by (clarsimp elim!: nonemptyE dest!: get_cap_det)\n\n\nfunction(sequential) red_zombie_will_fail :: \"cap \\ bool\"\n where\n \"red_zombie_will_fail (cap.Zombie ptr zb 0) = True\"\n| \"red_zombie_will_fail (cap.Zombie ptr zb (Suc n)) = False\"\n| \"red_zombie_will_fail cap = True\"\n apply simp_all\n apply (case_tac x)\n prefer 11\n apply (rename_tac nat)\n apply (case_tac nat, simp_all)[1]\n apply fastforce+\n done\n\n\ntermination red_zombie_will_fail\n by (rule red_zombie_will_fail.termination [OF Wellfounded.wf_empty])\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma rec_del_emptyable:\n \"\\args.\n \\invs and valid_rec_del_call args\n and (\\s. \\ exposed_rdcall args\n \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) (slot_rdcall args) s)\n and emptyable (slot_rdcall args)\n and (\\s. case args of ReduceZombieCall cap sl ex \\\n \\ cap_removeable cap sl\n \\ (\\t\\obj_refs cap. halted_if_tcb t s)\n | _ \\ True)\\\n rec_del args\n \\\\rv. emptyable (slot_rdcall args) :: 'state_ext state \\ bool\\, -\"\n apply (rule validE_validE_R)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\n\nlemma reduce_zombie_cap_to:\n \"\\cap slot exp.\n \\invs and valid_rec_del_call (ReduceZombieCall cap slot exp) and\n emptyable slot and\n (\\s. \\ exp \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s) and\n K (\\ cap_removeable cap slot) and\n (\\s. \\t\\obj_refs cap. halted_if_tcb t s)\\\n rec_del (ReduceZombieCall cap slot exp)\n \\\\rv (s::'state_ext state). \\ exp \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s\\, -\"\n apply (rule validE_validE_R)\n apply (rule hoare_post_impErr)\n apply (rule hoare_pre)\n apply (rule use_spec)\n apply (rule rec_del_invs')\n apply simp+\n done\n\n\nlemma cte_at_replicate_zbits:\n \"\\(s::'state_ext state) oref zb n.\n \\ s \\ cap.Zombie oref zb n \\ \\ cte_at (oref, replicate (zombie_cte_bits zb) False) s\"\n apply (clarsimp simp: valid_cap_def obj_at_def is_tcb is_cap_table\n split: option.split_asm)\n apply (rule cte_wp_at_tcbI, simp)\n apply (fastforce simp add: tcb_cap_cases_def tcb_cnode_index_def to_bl_1)\n apply simp\n apply (subgoal_tac \"replicate x2 False \\ dom cs\")\n apply safe[1]\n apply (rule cte_wp_at_cteI, fastforce)\n apply (simp add: well_formed_cnode_n_def length_set_helper)\n apply simp\n apply simp\n apply (clarsimp simp: well_formed_cnode_n_def)\n done\n\n\nlemma reduce_zombie_cap_somewhere:\n \"\\exp cap slot.\n \\\\s::'state_ext state. \\ exp \\ (\\oref cref. cte_wp_at P (oref, cref) s)\\\n rec_del (ReduceZombieCall cap slot exp)\n \\\\rv s. \\ exp \\ (\\oref cref. cte_wp_at P (oref, cref) s)\\\"\n subgoal for exp cap slot\n apply (cases exp, simp_all, wp)\n apply (cases cap, simp_all add: rec_del_fails)\n apply (rename_tac word option nat)\n apply (case_tac nat, simp_all add: rec_del_simps_ext)\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply safe\n apply (rule_tac x=\"fst ((id ((word, replicate (zombie_cte_bits option) False) := slot,\n slot := (word, replicate (zombie_cte_bits option) False))) (oref, cref))\"\n in exI)\n apply (rule_tac x=\"snd ((id ((word, replicate (zombie_cte_bits option) False) := slot,\n slot := (word, replicate (zombie_cte_bits option) False))) (oref, cref))\"\n in exI)\n apply fastforce\n done\n done\n\nend\n\n\nlemma set_cap_cap_somewhere:\n \"\\\\s. cte_wp_at (\\cp. P (fst slot) (snd slot) cp \\ P (fst slot) (snd slot) cap) slot s\n \\ (\\oref cref. cte_wp_at (P oref cref) (oref, cref) s)\\\n set_cap cap slot\n \\\\rv s. \\oref cref. cte_wp_at (P oref cref) (oref, cref) s\\\"\n apply (simp add: cte_wp_at_caps_of_state)\n apply wp\n apply clarsimp\n apply (rule_tac x=oref in exI)\n apply (rule_tac x=cref in exI)\n apply fastforce\n done\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma rec_del_ReduceZombie_emptyable:\n \"\\cap slot ex.\n \\invs and (cte_wp_at ((=) cap) slot and is_final_cap' cap\n and (\\y. is_zombie cap))\n and (\\s. \\ ex \\ ex_cte_cap_wp_to (\\cp. cap_irqs cp = {}) slot s)\n and emptyable slot\n and (\\s. \\ cap_removeable cap slot \\ (\\t\\obj_refs cap. halted_if_tcb t s))\\\n rec_del (ReduceZombieCall cap slot ex)\n \\\\rv. emptyable slot :: 'state_ext state \\ bool\\, -\"\n subgoal for cap slot ex\n by (rule rec_del_emptyable [where args=\"ReduceZombieCall cap slot ex\", simplified])\n done\n\nend\n\n\ntext \\The revoke function and its properties are\n slightly easier to deal with than the delete\n function. However, its termination argument\n is complex, requiring that the delete function\n reduces the number of non-null capabilities.\\\ndefinition\n cap_revoke_recset :: \"((cslot_ptr \\ 'z::state_ext state) \\ (cslot_ptr \\ 'z::state_ext state)) set\"\nwhere\n \"cap_revoke_recset \\ measure (\\(sl, s). (\\mp. \\x \\ dom mp. rpo_measure x (mp x))\n (option_map cap_to_rpo \\ caps_of_state s))\"\n\n\nlemma wf_cap_revoke_recset:\n \"wf cap_revoke_recset\"\n by (simp add: cap_revoke_recset_def)\n\n\nlemma rpo_sym:\n \"revoke_progress_ord m m\"\n by (simp add: revoke_progress_ord_def)\n\n\nlemma in_select_ext_weak: \"(a,b) \\ fst (select_ext f S s) \\\n (a,b) \\ fst (select S s)\"\n apply (drule_tac Q=\"\\r s'. r \\ S \\ s' =s\" in use_valid[OF _ select_ext_weak_wp])\n apply (simp add: select_def)+\n done\n\n\ncontext CNodeInv_AI_3 begin\n\nlemma cap_revoke_termination:\n \"All (cap_revoke_dom :: (machine_word \\ bool list) \\ 'state_ext state \\ bool)\"\n apply (rule cap_revoke.termination)\n apply (rule wf_cap_revoke_recset)\n apply (clarsimp simp add: cap_revoke_recset_def in_monad select_def\n dest!: iffD1[OF in_get_cap_cte_wp_at] in_select_ext_weak)\n apply (frule use_validE_R [OF _ cap_delete_rvk_prog])\n apply (rule rpo_sym)\n apply (frule use_validE_R [OF _ cap_delete_deletes])\n apply simp\n apply (simp add: revoke_progress_ord_def)\n apply (erule disjE)\n apply (drule_tac f=\"\\f. f (aa, ba)\" in arg_cong)\n apply (clarsimp simp: cte_wp_at_caps_of_state cap_to_rpo_def)\n apply (simp split: cap.split_asm)\n apply (erule (1) use_valid [OF _ preemption_point_caps_of_state])\n done\n\nlemma cap_revoke_dom: \"\\ (p :: (machine_word \\ bool list) \\ 'state_ext state). cap_revoke_dom p\"\n using cap_revoke_termination by blast\n\nlemmas cap_revoke_simps = cap_revoke.psimps[OF cap_revoke_dom]\n\nlemmas cap_revoke_induct = cap_revoke.pinduct[OF cap_revoke_dom]\n\nlemma cap_revoke_preservation':\n fixes P and s :: \"'state_ext state\" and ptr\n assumes x: \"\\p. \\P\\ cap_delete p \\\\rv. P\\\"\n assumes p: \"\\P\\ preemption_point \\\\rv. P\\\"\n shows \"s \\ \\P\\ cap_revoke ptr \\\\rv. P\\, \\\\rv. P\\\"\nproof (induct rule: cap_revoke_induct)\n case (1 slot)\n show ?case\n apply (subst cap_revoke_simps)\n apply (wp \"1.hyps\")\n apply (wp x p hoare_drop_imps select_wp)+\n apply simp_all\n done\nqed\n\nlemmas cap_revoke_preservation = use_spec(2) [OF cap_revoke_preservation']\n\nlemmas cap_revoke_preservation2 = cap_revoke_preservation[THEN validE_valid]\n\nlemma ball_subset: \"\\x\\A. Q x \\ B \\ A \\ \\x\\B. Q x\"\n apply blast\n done\n\nlemma cap_revoke_preservation_desc_of':\n fixes P Q and s :: \"'state_ext state\"\n assumes x: \"\\p. \\P and Q p\\ cap_delete p \\\\rv. P\\\"\n and y: \"\\sl s. P s \\ \\sl' \\ descendants_of sl (cdt s). Q sl' s\"\n assumes p: \"\\P\\ preemption_point \\\\rv. P\\\"\n shows \"s \\ \\P\\ cap_revoke ptr \\\\rv. P\\, \\\\rv. P\\\"\nproof (induct rule: cap_revoke_induct)\n case (1 slot)\n show ?case\n apply (subst cap_revoke_simps)\n apply (wp \"1.hyps\")\n apply (wp x p hoare_drop_imps select_wp)+\n apply (simp_all add: y)\n done\nqed\n\nlemmas cap_revoke_preservation_desc_of =\n use_spec(2) [OF cap_revoke_preservation_desc_of']\n\nlemma cap_revoke_typ_at:\n \"\\P T p. \\\\s::'state_ext state. P (typ_at T p s)\\ cap_revoke ptr \\\\rv s. P (typ_at T p s)\\\"\n by (wp cap_delete_typ_at cap_revoke_preservation irq_state_independent_AI preemption_point_inv, simp+)\n\nlemma cap_revoke_invs:\n \"\\ptr. \\\\s::'state_ext state. invs s\\ cap_revoke ptr \\\\rv. invs\\\"\n apply (wp cap_revoke_preservation_desc_of)\n apply (fastforce simp: emptyable_def dest: reply_slot_not_descendant)\n apply (wp preemption_point_inv)\n apply simp+\n done\n\nend\n\n\nlemma descendants_of_cdt_parent:\n \"\\ p' \\ descendants_of p (cdt s) \\ \\ \\p''. cdt s \\ p'' \\ p'\"\n apply (simp add: descendants_of_def del: split_paired_Ex)\n apply (erule tranclE)\n apply (erule exI)\n apply (erule exI)\n done\n\n\nlemma cap_revoke_mdb_stuff3:\n \"\\ p' \\ descendants_of p (cdt s); valid_mdb s \\\n \\ cte_wp_at ((\\) cap.NullCap) p' s\"\n apply (clarsimp simp add: valid_mdb_def\n dest!: descendants_of_cdt_parent)\n apply (simp add: cdt_parent_of_def)\n apply (drule(1) mdb_cte_atD)\n apply simp\n done\n\ncrunch typ_at[wp]: cancel_badged_sends \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps simp: crunch_simps filterM_mapM unless_def\n ignore: without_preemption filterM set_object clearMemory)\n\nlocale CNodeInv_AI_4 = CNodeInv_AI_3 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes finalise_slot_typ_at [wp]:\n \"\\P T p. \\\\s::'state_ext state. P (typ_at T p s)\\ finalise_slot a b \\\\_ s. P (typ_at T p s)\\\"\n assumes weak_derived_appropriate:\n \"\\cap cap'. weak_derived cap cap' \\ appropriate_cte_cap cap = appropriate_cte_cap cap'\"\n\ncontext CNodeInv_AI_4 begin\n\nlemma inv_cnode_typ_at:\n \"\\P T p ci. \\\\s::'state_ext state. P (typ_at T p s)\\ invoke_cnode ci \\\\rv s. P (typ_at T p s)\\\"\n apply (case_tac ci, simp_all add: invoke_cnode_def split del: if_split)\n apply (wp cap_insert_typ_at cap_move_typ_at cap_swap_typ_at hoare_drop_imps\n cap_delete_typ_at cap_revoke_typ_at hoare_vcg_all_lift | wpc |\n simp | rule conjI impI | rule hoare_pre)+\n done\n\nlemma invoke_cnode_tcb[wp]:\n \"\\tptr ci. \\tcb_at tptr::'state_ext state \\ bool\\ invoke_cnode ci \\\\rv. tcb_at tptr\\\"\n by (simp add: tcb_at_typ, wp inv_cnode_typ_at)\n\nend\n\n\nlemma duplicate_creation:\n \"\\cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cap) p\n and cte_at p' and K (p \\ p')\\\n set_cap cap p'\n \\\\rv s. cte_wp_at (\\cap. \\ is_final_cap' cap s) p s\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_post_imp [where Q=\"\\rv. cte_wp_at (\\c. gen_obj_refs c = gen_obj_refs cap) p\n and cte_wp_at ((=) cap) p'\"])\n apply (clarsimp simp: cte_wp_at_def)\n apply (case_tac \"\\x. x \\ obj_refs cap \\ x \\ obj_refs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_obj_ref)\n apply simp\n apply (case_tac \"\\x. x \\ cap_irqs cap \\ x \\ cap_irqs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_irq, simp)\n apply (case_tac \"\\x. x \\ arch_gen_refs cap \\ x \\ arch_gen_refs capa\")\n apply (elim exE conjE)\n apply (frule (4) final_cap_duplicate_arch_refs, simp)\n apply (simp add: is_final_cap'_def gen_obj_refs_eq gen_obj_refs_Int)\n apply (wp set_cap_cte_wp_at)\n apply simp_all\n done\n\n\ndefinition\n zombies_final_caps :: \"(cslot_ptr \\ cap) \\ bool\"\nwhere\n \"zombies_final_caps \\ \\cps. \\p p' cap cap'.\n cps p = Some cap \\ cps p' = Some cap'\n \\ obj_refs cap \\ obj_refs cap' \\ {} \\ p \\ p'\n \\ \\ is_zombie cap \\ \\ is_zombie cap'\"\n\n\nlemma zombies_final_caps_of_state:\n \"zombies_final = zombies_final_caps \\ caps_of_state\"\n by (rule ext,\n simp add: zombies_final_def2 zombies_final_caps_def\n cte_wp_at_caps_of_state)\n\n\nlemma zombies_final_injective:\n \"\\ zombies_final_caps (caps_of_state s); inj f \\\n \\ zombies_final_caps (caps_of_state s \\ f)\"\n apply (simp only: zombies_final_caps_def o_def)\n apply (intro allI impI)\n apply (elim conjE allE, erule mp)\n apply (erule conjI)+\n apply (simp add: inj_eq)\n done\n\n\nlemma set_cdt_caps_of_state[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_cdt p \\\\rv s. P (caps_of_state s)\\\"\n apply (simp add: set_cdt_def)\n apply wp\n apply (simp add: caps_of_state_cte_wp_at)\n done\n\n\nlemma cap_move_caps_of_state:\n notes fun_upd_apply [simp del]\n shows \"\\\\s. P ((caps_of_state s) (ptr' \\ cap, ptr \\ cap.NullCap ))\\\n cap_move cap ptr ptr'\n \\\\rv s. P (caps_of_state s)\\\"\n by (wpsimp simp: cap_move_def)\n\n\nlemma zombies_duplicate_creation:\n \"\\\\s. zombies_final s \\ \\ is_zombie cap\n \\ (\\p'. cte_wp_at (\\c. obj_refs c = obj_refs cap \\ \\ is_zombie c) p' s)\n \\ cte_wp_at ((=) cap.NullCap) p s\\\n set_cap cap p\n \\\\rv. zombies_final\\\"\n apply (wp set_cap_zombies)\n apply (clarsimp simp: cte_wp_at_def)\n apply (thin_tac \"x \\ y\" for x y)\n apply (case_tac \"(a, b) = (aa, ba)\")\n apply clarsimp\n apply (drule(3) zombies_finalD2)\n apply blast\n apply simp\n done\n\n\nlemma state_refs_of_rvk[simp]:\n \"state_refs_of (is_original_cap_update f s) = state_refs_of s\"\n by (simp add: state_refs_of_def)\n\n\nlemma weak_derived_is_zombie:\n \"weak_derived cap cap' \\ is_zombie cap = is_zombie cap'\"\n by (auto simp: weak_derived_def copy_of_def is_cap_simps same_object_as_def\n split: if_split_asm cap.splits)\n\n\nlemma cap_move_zombies_final[wp]:\n \"\\zombies_final and cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\\\n cap_move cap ptr ptr'\n \\\\rv. zombies_final\\\"\n unfolding cap_move_def zombies_final_caps_of_state o_def set_cdt_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n apply (simp add: cte_wp_at_caps_of_state zombies_final_caps_def del: split_paired_All)\n apply (elim conjE exE)\n apply (intro impI allI)\n apply (simp add: weak_derived_obj_refs weak_derived_is_zombie del: split_paired_All)\n apply blast\n done\n\n\nlemma cap_move_if_live[wp]:\n \"\\cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\n and if_live_then_nonz_cap\\\n cap_move cap ptr ptr'\n \\\\rv s. if_live_then_nonz_cap s\\\"\n unfolding cap_move_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n apply (rule hoare_post_imp, simp only: if_live_then_nonz_cap_def)\n apply (simp only: ex_nonz_cap_to_def cte_wp_at_caps_of_state\n imp_conv_disj)\n apply (wp hoare_vcg_disj_lift hoare_vcg_all_lift)+\n apply (clarsimp simp: if_live_then_nonz_cap_def\n ex_nonz_cap_to_def cte_wp_at_caps_of_state\n del: allI\n simp del: split_paired_Ex)\n apply (erule allEI, rule impI, drule(1) mp)\n apply (erule exfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (clarsimp simp: weak_derived_obj_refs zobj_refs_to_obj_refs)\n apply (rule conjI)\n apply (clarsimp simp: weak_derived_is_zombie)\n apply clarsimp\n done\n\n\nlemma weak_derived_cte_refs':\n \"weak_derived cap cap' \\ cte_refs cap = cte_refs cap'\"\n by (fastforce simp: copy_of_cte_refs weak_derived_def)\n\n\nlemma appropriate_cte_master:\n \"appropriate_cte_cap (cap_master_cap cap) = appropriate_cte_cap cap\"\n apply (rule ext)\n apply (simp add: cap_master_cap_def appropriate_cte_cap_def\n split: cap.split)\n done\n\n\ncontext CNodeInv_AI_4 begin\n\nlemma cap_move_if_unsafe [wp]:\n \"\\ptr' cap ptr.\n \\cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\n and K (ptr \\ ptr')\n and if_unsafe_then_cap\n and ex_cte_cap_wp_to (appropriate_cte_cap cap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. if_unsafe_then_cap :: 'state_ext state \\ bool\\\"\n subgoal for ptr' cap ptr\n apply (simp add: cap_move_def)\n apply (wp | simp)+\n apply (rule hoare_post_imp, simp only: if_unsafe_then_cap_def)\n apply (simp only: ex_cte_cap_wp_to_def cte_wp_at_caps_of_state)\n apply wp+\n apply (clarsimp simp: if_unsafe_then_cap_def\n ex_cte_cap_wp_to_def cte_wp_at_caps_of_state\n simp del: split_paired_All split_paired_Ex\n del: allI\n split del: if_split)\n apply (frule weak_derived_Null)\n apply (frule weak_derived_cte_refs')\n apply (frule cap_irqs_appropriateness [OF weak_derived_cap_irqs])\n apply (frule weak_derived_appropriate)\n apply (erule allfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (case_tac \"cref = ptr'\")\n apply (intro allI impI,\n rule_tac x=\"(id (ptr := ptr', ptr' := ptr)) (a, b)\" in exI)\n apply fastforce\n apply (clarsimp split: if_split_asm split del: if_split del: exE\n simp del: split_paired_All split_paired_Ex)\n apply (erule exfEI[where f=\"id (ptr := ptr', ptr' := ptr)\"])\n apply (clarsimp split: if_split_asm)\n apply fastforce\n done\n done\n\nend\n\n\ncrunch arch[wp]: cap_move \"\\s. P (arch_state s)\"\n\ncrunch irq_node[wp]: cap_move \"\\s. P (interrupt_irq_node s)\"\n\nlemma cap_range_NullCap:\n \"cap_range cap.NullCap = {}\"\n by (simp add: cap_range_def)\n\ncrunch interrupt_states[wp]: cap_move \"\\s. P (interrupt_states s)\"\n\n\nlemma cap_move_irq_handlers[wp]:\n \"\\valid_irq_handlers and cte_wp_at ((=) cap.NullCap) ptr'\n and cte_wp_at (weak_derived cap) ptr\\\n cap_move cap ptr ptr'\n \\\\rv. valid_irq_handlers\\\"\n apply (simp add: valid_irq_handlers_def irq_issued_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=interrupt_states, OF cap_move_interrupt_states])\n apply (simp add: cap_move_def set_cdt_def)\n apply (wp | simp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state\n elim!: ranE split: if_split_asm\n dest!: weak_derived_cap_irqs)\n apply auto\n done\n\n\nlemma cap_move_has_reply_cap_neg:\n \"\\\\s. \\ has_reply_cap t s \\\n cte_wp_at (weak_derived c) p s \\\n cte_wp_at ((=) cap.NullCap) p' s \\\n p \\ p'\\\n cap_move c p p' \\\\rv s. \\ has_reply_cap t s\\\"\n apply (simp add: has_reply_cap_def is_reply_cap_to_def cte_wp_at_caps_of_state\n del: split_paired_All split_paired_Ex)\n apply (wp cap_move_caps_of_state)\n apply (elim conjE exE)\n apply (drule(1) cap_swap_no_reply_caps[where cs=\"caps_of_state _\"])\n apply fastforce+\n done\n\n\nlemma cap_move_replies:\n \"\\\\s. valid_reply_caps s\n \\ cte_wp_at (weak_derived c) p s\n \\ cte_wp_at ((=) cap.NullCap) p' s\n \\ p \\ p'\\\n cap_move c p p'\n \\\\rv s. valid_reply_caps s\\\"\n apply (simp add: valid_reply_caps_def)\n apply (rule hoare_pre)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift cap_move_has_reply_cap_neg)\n apply (simp add: cap_move_def, (wp|simp)+)\n apply (rule cap_move_caps_of_state)\n apply (clarsimp simp: fun_upd_def cte_wp_at_caps_of_state\n unique_reply_caps_cap_swap [simplified fun_upd_def])\n done\n\n\nlemma copy_of_reply_master:\n \"copy_of cap cap' \\ is_master_reply_cap cap = is_master_reply_cap cap'\"\n apply (clarsimp simp: copy_of_def is_cap_simps)\n apply (clarsimp simp: same_object_as_def split: cap.splits)\n done\n\n\ncontext CNodeInv_AI_4 begin\n\nlemma cap_move_valid_arch_caps[wp]:\n \"\\cap ptr.\n \\valid_arch_caps\n and cte_wp_at (weak_derived cap) ptr\n and cte_wp_at ((=) cap.NullCap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. valid_arch_caps :: 'state_ext state \\ bool\\\"\n apply (simp add: cap_move_def)\n apply (rule hoare_pre)\n apply (subst bind_assoc[symmetric],\n rule hoare_seq_ext [rotated],\n rule swap_of_caps_valid_arch_caps)\n apply (wp | simp)+\n apply (clarsimp elim!: cte_wp_at_weakenE)\n done\n\nend\n\n\n\nlemma cap_move_valid_ioc[wp]:\n \"\\valid_ioc and\n cte_wp_at (weak_derived cap) ptr and cte_wp_at ((=) cap.NullCap) ptr'\\\n cap_move cap ptr ptr'\n \\\\rv. valid_ioc\\\"\n apply (simp add: cap_move_def valid_ioc_def[abs_def] cte_wp_at_caps_of_state\n pred_conj_def)\n apply (wp set_cdt_cos_ioc set_cap_caps_of_state2 | simp)+\n apply (cases ptr, clarsimp simp add: cte_wp_at_caps_of_state valid_ioc_def)\n apply (drule spec, drule spec, erule impE, assumption)\n apply clarsimp\n done\n\ndeclare cdt_update.state_refs_update [simp]\n\nlocale CNodeInv_AI_5 = CNodeInv_AI_4 state_ext_t\n for state_ext_t :: \"'state_ext::state_ext itself\" +\n assumes cap_move_invs[wp]:\n \"\\cap ptr' ptr.\n \\invs and valid_cap cap and cte_wp_at ((=) cap.NullCap) ptr'\n and tcb_cap_valid cap ptr'\n and cte_wp_at (weak_derived cap) ptr\n and cte_wp_at (\\c. c \\ cap.NullCap) ptr\n and ex_cte_cap_wp_to (appropriate_cte_cap cap) ptr' and K (ptr \\ ptr')\n and K (\\ is_master_reply_cap cap)\\\n cap_move cap ptr ptr'\n \\\\rv. invs::'state_ext state \\ bool\\\"\n\nlemma cte_wp_at_use2:\n \"\\cte_wp_at P p s; cte_wp_at P' p s; \\c. \\cte_wp_at ((=) c) p s; P c; P' c\\ \\ Q \\ \\ Q\"\n by (auto simp: cte_wp_at_caps_of_state)\n\nlemma cte_wp_at_use3:\n \"\\cte_wp_at P p s; cte_wp_at P' p s; cte_wp_at P'' p s; \\c. \\cte_wp_at ((=) c) p s; P c; P' c; P'' c\\ \\ Q \\ \\ Q\"\n by (auto simp: cte_wp_at_caps_of_state)\n\nlemma cap_move_valid_cap[wp]:\n \"\\\\s. s \\ cap'\\ cap_move cap p p' \\\\_ s. s \\ cap'\\\"\n unfolding cap_move_def\n by (wp set_cdt_valid_cap | simp)+\n\nlemma weak_derived_cte_refs_abs:\n \"weak_derived c c' \\ cte_refs c' = cte_refs c\"\n apply (clarsimp simp: weak_derived_def copy_of_def)\n apply (auto simp: same_object_as_def is_cap_simps bits_of_def\n split: if_split_asm cap.splits)\n done\n\nlemma cap_move_ex_cap_cte:\n \"\\ex_cte_cap_wp_to P ptr and\n cte_wp_at (weak_derived cap) p and\n cte_wp_at ((=) cap.NullCap) p' and\n K (p \\ p') and K (\\cap'. weak_derived cap cap' \\ P cap = P cap')\\\n cap_move cap p p'\n \\\\_. ex_cte_cap_wp_to P ptr\\\"\n unfolding cap_move_def ex_cte_cap_wp_to_def cte_wp_at_caps_of_state set_cdt_def\n apply (rule hoare_pre)\n apply wp\n apply (simp del: split_paired_Ex)\n apply (wp set_cap_caps_of_state | simp del: split_paired_Ex add: cte_wp_at_caps_of_state)+\n apply (elim conjE exE)\n apply (case_tac \"cref = p\")\n apply (rule_tac x=p' in exI)\n apply clarsimp\n apply (drule weak_derived_cte_refs_abs)\n apply simp\n apply (rule_tac x=cref in exI)\n apply clarsimp\n done\n\nlemma cap_move_src_slot_Null:\n \"\\cte_at src and K(src \\ dest)\\ cap_move cap src dest \\\\_ s. cte_wp_at ((=) cap.NullCap) src s\\\"\n unfolding cap_move_def\n by (wp set_cdt_cte_wp_at set_cap_cte_wp_at' | simp)+\n\n\ncrunch pred_tcb_at[wp]: cap_move \"pred_tcb_at proj P t\"\n\nlemmas (in CNodeInv_AI_5) cap_revoke_cap_table[wp]\n = cap_table_at_lift_valid [OF cap_revoke_typ_at]\n\nlemmas appropriate_cte_cap_simps = appropriate_cte_cap_def [split_simps cap.split]\n\ncontext CNodeInv_AI_5 begin\n\ncrunch inv [wp]: is_final_cap \"P\"\n\nlemma is_final_cap_is_final[wp]:\n \"\\\\\\ is_final_cap cap \\\\rv s. rv = is_final_cap' cap s\\\"\n unfolding is_final_cap_def\n by wp simp\n\nend\n\nlemma real_cte_not_reply_masterD:\n \"\\P ptr.\n \\ real_cte_at ptr s; valid_reply_masters s; valid_objs s \\ \\\n cte_wp_at (\\cap. \\ is_master_reply_cap cap) ptr s\"\n apply clarsimp\n apply (subgoal_tac \"\\ tcb_at a s\")\n apply (clarsimp simp: cap_table_at_cte_at cte_wp_at_not_reply_master)\n apply (clarsimp simp: obj_at_def is_tcb is_cap_table)\n done\n\nlemma real_cte_weak_derived_not_reply_masterD:\n \"\\cap ptr.\n \\ cte_wp_at (weak_derived cap) ptr s; real_cte_at ptr s;\n valid_reply_masters s; valid_objs s \\ \\\n \\ is_master_reply_cap cap\"\n by (fastforce simp: cte_wp_at_caps_of_state weak_derived_replies\n dest!: real_cte_not_reply_masterD)\n\nlemma real_cte_is_derived_not_replyD:\n \"\\m p cap ptr.\n \\ cte_wp_at (is_derived m p cap) ptr s; real_cte_at ptr s;\n valid_reply_masters s; valid_objs s \\ \\\n \\ is_reply_cap cap\"\n by (fastforce simp: cte_wp_at_caps_of_state is_derived_def\n dest!: real_cte_not_reply_masterD)\n\n\nlemma cap_irqs_is_derived:\n \"is_derived m ptr cap cap' \\ cap_irqs cap = cap_irqs cap'\"\n by (clarsimp simp: is_derived_def cap_master_cap_irqs split: if_split_asm)\n\n\nlemma tcb_cap_valid_mdb[simp]:\n \"tcb_cap_valid cap p (cdt_update mfn s) = tcb_cap_valid cap p s\"\n by (simp add: tcb_cap_valid_def)\n\n\nlemma tcb_cap_valid_is_original_cap[simp]:\n \"tcb_cap_valid cap p (is_original_cap_update mfn s) = tcb_cap_valid cap p s\"\n by (simp add: tcb_cap_valid_def)\n\n\ncrunch tcb_cap_valid[wp]: cap_move \"tcb_cap_valid cap p\"\n\n\ncontext CNodeInv_AI_5 begin\n\nlemma invoke_cnode_invs[wp]:\n fixes i shows\n \"\\invs and valid_cnode_inv i\\ invoke_cnode i \\\\rv. invs::'state_ext state \\ bool\\\"\n unfolding invoke_cnode_def\n apply (cases i)\n apply simp\n apply wp\n apply (simp add: ex_cte_cap_to_cnode_always_appropriate_strg\n real_cte_tcb_valid)\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_caps_of_state dest!: cap_irqs_is_derived)\n apply (rule conjI)\n apply (elim conjE)\n apply (drule real_cte_is_derived_not_replyD)\n apply (simp add:invs_valid_objs invs_valid_reply_masters)+\n apply (clarsimp simp:is_cap_simps)\n apply (elim conjE)\n apply (drule real_cte_not_reply_masterD)\n apply (simp add:invs_valid_objs invs_valid_reply_masters)+\n apply (clarsimp simp: cte_wp_at_caps_of_state is_derived_def)\n apply simp\n apply wp\n apply (fastforce simp: real_cte_tcb_valid cte_wp_at_caps_of_state\n ex_cte_cap_to_cnode_always_appropriate_strg\n dest: real_cte_weak_derived_not_reply_masterD)\n apply simp\n apply (wp cap_revoke_invs)\n apply simp\n apply simp\n apply wp\n apply (clarsimp simp: emptyable_def obj_at_def is_tcb is_cap_table)\n apply simp\n apply (rule conjI)\n apply (rule impI)\n apply wp\n apply (fastforce simp: real_cte_tcb_valid\n ex_cte_cap_to_cnode_always_appropriate_strg\n dest: real_cte_weak_derived_not_reply_masterD)\n apply (rule impI)\n apply (rule hoare_pre)\n apply wp\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wp cap_move_caps_of_state cap_move_ex_cap_cte)\n apply (simp add: pred_conj_def)\n apply (elim conjE exE)\n apply (simp add: real_cte_tcb_valid ex_cte_cap_to_cnode_always_appropriate_strg\n cap_irqs_appropriateness [OF weak_derived_cap_irqs])\n apply (intro conjI,\n (fastforce simp: cte_wp_at_caps_of_state\n dest: real_cte_weak_derived_not_reply_masterD)+)[1]\n apply (wpsimp wp: hoare_drop_imps get_cap_wp)+\n apply (rule conjI)\n apply (clarsimp elim!: cte_wp_valid_cap)\n apply (clarsimp simp: real_cte_tcb_valid cte_wp_at_caps_of_state\n is_cap_simps ex_cte_cap_to_cnode_always_appropriate_strg)\n apply (wpsimp)\n done\n\nend\n\n\nlemma corres_underlying_lift_ex1:\n assumes c: \"\\v. corres_underlying sr nf nf' r (P v and Q) P' a c\"\n shows \"corres_underlying sr nf nf' r ((\\s. \\v. P v s) and Q) P' a c\"\n unfolding corres_underlying_def\n apply clarsimp\n apply (cut_tac v = v in c)\n apply (auto simp: corres_underlying_def)\n done\n\n\nlemmas corres_underlying_lift_ex1' = corres_underlying_lift_ex1 [where Q = \\, simplified]\n\n\nlemma corres_underlying_lift_ex2:\n assumes c: \"\\v. corres_underlying sr nf nf' r P (P' v and Q) a c\"\n shows \"corres_underlying sr nf nf' r P ((\\s. \\v. P' v s) and Q) a c\"\n unfolding corres_underlying_def\n apply clarsimp\n apply (cut_tac v = v in c)\n apply (auto simp: corres_underlying_def)\n done\n\n\nlemmas corres_underlying_lift_ex2' = corres_underlying_lift_ex2 [where Q = \\, simplified]\n\n\nlemma real_cte_halted_if_tcb[simp]:\n \"real_cte_at (a, b) s \\ halted_if_tcb a s\"\n by (clarsimp simp: halted_if_tcb_def obj_at_def is_cap_table is_tcb)\n\nlemma descendants_of_empty:\n \"x \\ descendants_of cref Map.empty\"\n by (simp add: descendants_of_def cdt_parent_rel_def is_cdt_parent_def)\n\nlemma has_parent_cte_at:\"valid_mdb s \\ (cdt s) c = Some p \\ cte_at c s\"\n apply (rule cte_wp_cte_at)\n apply (simp add: valid_mdb_def mdb_cte_at_def del: split_paired_All)\n apply blast\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/CNodeInv_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.3073580168652638, "lm_q1q2_score": 0.1774978301923924}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__30.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__30 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__30 and some rule r*}\nlemma n_SendInv__part__0Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Ident ''ExGntd'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__30:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__30 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__30:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__30:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__30.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.35220176844875106, "lm_q1q2_score": 0.17747664439258007}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__31.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__31 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__31 and some rule r*}\nlemma n_PI_Remote_GetVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__31:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__31:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__31:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__31:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__31:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__31:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__31:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__31:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__31:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__31 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__31:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__31:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__31:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__31:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__31:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__31:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__31:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__31:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__31:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__31:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__31:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__31:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__31:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__31:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__31:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__31:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__31:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__31:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__31:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__31:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__31:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__31:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__31:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__31.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213368305399, "lm_q2_score": 0.3415824927356586, "lm_q1q2_score": 0.17745939326393756}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__26.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__26 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__26 and some rule r*}\nlemma n_SendInv__part__0Vsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv3)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv3)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__26:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv3) ''Cmd'')) (Const Inv)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__26:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__0Vsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__0 N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqE__part__1Vsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE__part__1 N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__26:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__26.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34864514886966624, "lm_q1q2_score": 0.177046143019406}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__99.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__99 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__99 and some rule r*}\nlemma n_NI_Local_Get_Put_HeadVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__99:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__99:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__99:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__99:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeShrSet'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__99:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__99:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__99:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_exists_HomeVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_exists_Home src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_existsVsinv__99:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__99:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__99:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__99:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Nak_ClearVsinv__99:\nassumes a1: \"(r=n_NI_Nak_Clear )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__99:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__99 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__99:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__99:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__99:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__99:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__99:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__99:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__99:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__99:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__99:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__99:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__99:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__99:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__99:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__99:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__99:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__99:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__99:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__99:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__99.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34864513533394575, "lm_q1q2_score": 0.17704613614580653}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__8_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__8_on_rules imports n_germanSymIndex_lemma_on_inv__8\nbegin\nsection{*All lemmas on causal relation between inv__8*}\nlemma lemma_inv__8_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__8) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__8_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792046, "lm_q2_score": 0.34864512179822543, "lm_q1q2_score": 0.1770461292722072}} {"text": "theory flashMainLemma imports flash1Bra flash2Bra flash3Bra flash4Bra flash5Bra flash6Bra flash7Bra flash8Bra flash9Bra flash10Bra flash11Bra flash12Bra flash13Bra flash14Bra flash15Bra flash16Bra flash17Bra flash18Bra flash19Bra flash20Bra flash21Bra flash22Bra flash23Bra flash24Bra flash25Bra flash26Bra flash27Bra flash28Bra flash29Bra flash30Bra flash31Bra flash32Bra flash33Bra flash34Bra flash35Bra flash36Bra flash37Bra flash38Bra flash39Bra flash40Bra flash41Bra flash42Bra flash43Bra flash44Bra flash45Bra flash46Bra flash47Bra flash48Bra flash49Bra flash50Bra flash51Bra flash52Bra flash53Bra flash54Bra flash55Bra flash56Bra flash57Bra flash58Bra flash59Bra flash60Bra flash61Bra flash62Bra flash63Bra flash64Bra flash65Bra flash66Bra flash67Bra flash68Bra flash69Bra flash70Bra flash71Bra flash72Bra flash73Bra flash74Bra flash75Bra flash76Bra flash77Bra flash78Bra flash79Bra flash80Bra flash81Bra flash82Bra flash83Bra flash84Bra flash85Bra flash86Bra flash87Bra flash88Bra flash89Bra flash90Bra flash91Bra flash92Bra flash93Bra flash94Bra flash95Bra flash96Bra flash97Bra flash98Bra flash99Bra flash100Bra flash101Bra flash102Bra flash103Bra flash104Bra flash105Bra flash106Bra flash107Bra flash108Bra flash109Bra flash110Bra flash111Bra flash112Bra flash113Bra \nbegin\nlemma mainLemma:\n\n assumes \n\n a1:\"r \\ rules N\" and a2:\"invf \\ (invariants N)\"\n shows \"invHoldForRule' s invf r (invariants N)\"\n\n proof - \n have c1:\" ex2P N (% iInv1 iInv2 . invf= inv1 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv2 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv3 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv4 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv5 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv6 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv7 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv8 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv9 iInv1 ) \\ ex1P N (% iInv1 . invf= inv10 iInv1 ) \\ ex2P N (% iInv1 iInv2 . invf= inv11 iInv1 iInv2 ) \\ ex0P N ( invf= inv12 ) \\ ex1P N (% iInv1 . invf= inv13 iInv1 ) \\ ex1P N (% iInv1 . invf= inv14 iInv1 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv15 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv16 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv17 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv18 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv19 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv20 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv21 iInv1 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv22 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv23 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv24 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv25 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv26 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv27 iInv1 iInv2 ) \\ ex1P N (% iInv1 . invf= inv28 iInv1 ) \\ ex1P N (% iInv1 . invf= inv29 iInv1 ) \\ ex1P N (% iInv1 . invf= inv30 iInv1 ) \\ ex1P N (% iInv1 . invf= inv31 iInv1 ) \\ ex1P N (% iInv1 . invf= inv32 iInv1 ) \\ ex1P N (% iInv1 . invf= inv33 iInv1 ) \\ ex1P N (% iInv1 . invf= inv34 iInv1 ) \\ ex1P N (% iInv1 . invf= inv35 iInv1 ) \\ ex1P N (% iInv1 . invf= inv36 iInv1 ) \\ ex0P N ( invf= inv37 ) \\ ex0P N ( invf= inv38 ) \\ ex0P N ( invf= inv39 ) \\ ex1P N (% iInv1 . invf= inv40 iInv1 ) \\ ex2P N (% iInv1 iInv2 . invf= inv41 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv42 iInv1 iInv2 iInv3 ) \\ ex0P N ( invf= inv43 ) \\ ex2P N (% iInv1 iInv2 . invf= inv44 iInv1 iInv2 ) \\ ex0P N ( invf= inv45 ) \\ ex2P N (% iInv1 iInv2 . invf= inv46 iInv1 iInv2 ) \\ ex0P N ( invf= inv47 ) \\ ex2P N (% iInv1 iInv2 . invf= inv48 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv49 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv50 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv51 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv52 iInv1 iInv2 iInv3 ) \\ ex0P N ( invf= inv53 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv54 iInv1 iInv2 iInv3 ) \\ ex2P N (% iInv1 iInv2 . invf= inv55 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv56 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv57 iInv1 iInv2 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv58 iInv1 iInv2 iInv3 ) \\ ex3P N (% iInv1 iInv2 iInv3 . invf= inv59 iInv1 iInv2 iInv3 ) \\ ex1P N (% iInv1 . invf= inv60 iInv1 ) \\ ex1P N (% iInv1 . invf= inv61 iInv1 ) \\ ex1P N (% iInv1 . invf= inv62 iInv1 ) \\ ex1P N (% iInv1 . invf= inv63 iInv1 ) \\ ex1P N (% iInv1 . invf= inv64 iInv1 ) \\ ex1P N (% iInv1 . invf= inv65 iInv1 ) \\ ex0P N ( invf= inv66 ) \\ ex0P N ( invf= inv67 ) \\ ex2P N (% iInv1 iInv2 . invf= inv68 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv69 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv70 iInv1 iInv2 ) \\ ex0P N ( invf= inv71 ) \\ ex0P N ( invf= inv72 ) \\ ex0P N ( invf= inv73 ) \\ ex0P N ( invf= inv74 ) \\ ex0P N ( invf= inv75 ) \\ ex0P N ( invf= inv76 ) \\ ex2P N (% iInv1 iInv2 . invf= inv77 iInv1 iInv2 ) \\ ex0P N ( invf= inv78 ) \\ ex2P N (% iInv1 iInv2 . invf= inv79 iInv1 iInv2 ) \\ ex0P N ( invf= inv80 ) \\ ex0P N ( invf= inv81 ) \\ ex1P N (% iInv1 . invf= inv82 iInv1 ) \\ ex0P N ( invf= inv83 ) \\ ex0P N ( invf= inv84 ) \\ ex0P N ( invf= inv85 ) \\ ex0P N ( invf= inv86 ) \\ ex2P N (% iInv1 iInv2 . invf= inv87 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv88 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv89 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv90 iInv1 iInv2 ) \\ ex0P N ( invf= inv91 ) \\ ex0P N ( invf= inv92 ) \\ ex0P N ( invf= inv93 ) \\ ex0P N ( invf= inv94 ) \\ ex0P N ( invf= inv95 ) \\ ex0P N ( invf= inv96 ) \\ ex0P N ( invf= inv97 ) \\ ex0P N ( invf= inv98 ) \\ ex0P N ( invf= inv99 ) \\ ex0P N ( invf= inv100 ) \\ ex1P N (% iInv1 . invf= inv101 iInv1 ) \\ ex0P N ( invf= inv102 ) \\ ex0P N ( invf= inv103 ) \\ ex2P N (% iInv1 iInv2 . invf= inv104 iInv1 iInv2 ) \\ ex2P N (% iInv1 iInv2 . invf= inv105 iInv1 iInv2 ) \\ ex0P N ( invf= inv106 ) \\ ex0P N ( invf= inv107 ) \\ ex0P N ( invf= inv108 ) \\ ex0P N ( invf= inv109 ) \\ ex0P N ( invf= inv110 ) \\ ex0P N ( invf= inv111 ) \\ ex0P N ( invf= inv112 ) \\ ex0P N ( invf= inv113 ) \" \n\n apply(cut_tac a2)\n apply auto\n done moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv1 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv1 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv1 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv1 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv2 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv2 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv2 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv2 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv3 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv3 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv3 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv3 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv4 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv4 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv4 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv4 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv5 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv5 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv5 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv5 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv6 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv6 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv6 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv6 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv7 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv7 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv7 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv7 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv8 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv8 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv8 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv8 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv9 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv9 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv9 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv9 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv10 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv10 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv10 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv10 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv11 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv11 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv11 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv11 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv12)\n\"\n \n from c1 have c2:\" invf= inv12\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv12 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv12 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv13 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv13 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv13 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv13 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv14 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv14 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv14 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv14 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv15 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv15 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv15 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv15 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv16 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv16 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv16 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv16 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv17 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv17 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv17 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv17 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv18 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv18 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv18 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv18 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv19 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv19 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv19 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv19 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv20 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv20 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv20 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv20 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv21 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv21 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv21 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv21 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv22 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv22 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv22 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv22 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv23 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv23 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv23 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv23 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv24 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv24 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv24 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv24 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv25 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv25 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv25 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv25 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv26 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv26 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv26 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv26 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv27 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv27 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv27 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv27 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv28 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv28 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv28 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv28 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv29 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv29 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv29 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv29 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv30 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv30 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv30 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv30 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv31 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv31 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv31 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv31 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv32 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv32 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv32 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv32 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv33 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv33 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv33 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv33 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv34 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv34 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv34 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv34 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv35 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv35 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv35 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv35 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv36 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv36 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv36 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv36 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv37)\n\"\n \n from c1 have c2:\" invf= inv37\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv37 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv37 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv38)\n\"\n \n from c1 have c2:\" invf= inv38\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv38 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv38 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv39)\n\"\n \n from c1 have c2:\" invf= inv39\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv39 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv39 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv40 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv40 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv40 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv40 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv41 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv41 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv41 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv41 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv42 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv42 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv42 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv42 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv43)\n\"\n \n from c1 have c2:\" invf= inv43\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv43 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv43 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv44 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv44 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv44 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv44 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv45)\n\"\n \n from c1 have c2:\" invf= inv45\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv45 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv45 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv46 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv46 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv46 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv46 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv47)\n\"\n \n from c1 have c2:\" invf= inv47\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv47 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv47 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv48 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv48 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv48 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv48 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv49 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv49 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv49 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv49 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv50 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv50 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv50 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv50 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv51 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv51 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv51 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv51 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv52 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv52 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv52 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv52 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv53)\n\"\n \n from c1 have c2:\" invf= inv53\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv53 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv53 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv54 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv54 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv54 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv54 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv55 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv55 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv55 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv55 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv56 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv56 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv56 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv56 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv57 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv57 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv57 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv57 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv58 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv58 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv58 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv58 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex3P N (% iInv1 iInv2 iInv3 . invf= inv59 iInv1 iInv2 iInv3 )\n\"\n \n from c1 obtain iInv1 iInv2 iInv3 where c2:\" iInv1~=iInv2 \\ iInv1~=iInv3 \\ iInv2~=iInv3 \\ iInv1 \\ N \\ iInv2 \\ N \\ iInv3 \\ N \\ invf= inv59 iInv1 iInv2 iInv3 \" \n by (auto simp add: ex3P_def)\n \n have \"invHoldForRule' s (inv59 iInv1 iInv2 iInv3 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv59 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv60 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv60 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv60 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv60 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv61 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv61 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv61 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv61 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv62 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv62 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv62 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv62 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv63 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv63 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv63 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv63 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv64 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv64 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv64 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv64 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv65 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv65 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv65 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv65 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv66)\n\"\n \n from c1 have c2:\" invf= inv66\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv66 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv66 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv67)\n\"\n \n from c1 have c2:\" invf= inv67\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv67 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv67 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv68 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv68 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv68 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv68 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv69 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv69 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv69 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv69 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv70 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv70 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv70 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv70 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv71)\n\"\n \n from c1 have c2:\" invf= inv71\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv71 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv71 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv72)\n\"\n \n from c1 have c2:\" invf= inv72\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv72 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv72 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv73)\n\"\n \n from c1 have c2:\" invf= inv73\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv73 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv73 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv74)\n\"\n \n from c1 have c2:\" invf= inv74\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv74 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv74 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv75)\n\"\n \n from c1 have c2:\" invf= inv75\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv75 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv75 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv76)\n\"\n \n from c1 have c2:\" invf= inv76\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv76 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv76 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv77 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv77 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv77 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv77 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv78)\n\"\n \n from c1 have c2:\" invf= inv78\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv78 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv78 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv79 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv79 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv79 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv79 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv80)\n\"\n \n from c1 have c2:\" invf= inv80\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv80 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv80 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv81)\n\"\n \n from c1 have c2:\" invf= inv81\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv81 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv81 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv82 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv82 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv82 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv82 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv83)\n\"\n \n from c1 have c2:\" invf= inv83\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv83 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv83 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv84)\n\"\n \n from c1 have c2:\" invf= inv84\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv84 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv84 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv85)\n\"\n \n from c1 have c2:\" invf= inv85\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv85 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv85 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv86)\n\"\n \n from c1 have c2:\" invf= inv86\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv86 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv86 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv87 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv87 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv87 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv87 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv88 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv88 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv88 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv88 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv89 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv89 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv89 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv89 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv90 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv90 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv90 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv90 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv91)\n\"\n \n from c1 have c2:\" invf= inv91\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv91 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv91 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv92)\n\"\n \n from c1 have c2:\" invf= inv92\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv92 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv92 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv93)\n\"\n \n from c1 have c2:\" invf= inv93\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv93 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv93 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv94)\n\"\n \n from c1 have c2:\" invf= inv94\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv94 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv94 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv95)\n\"\n \n from c1 have c2:\" invf= inv95\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv95 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv95 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv96)\n\"\n \n from c1 have c2:\" invf= inv96\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv96 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv96 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv97)\n\"\n \n from c1 have c2:\" invf= inv97\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv97 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv97 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv98)\n\"\n \n from c1 have c2:\" invf= inv98\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv98 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv98 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv99)\n\"\n \n from c1 have c2:\" invf= inv99\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv99 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv99 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv100)\n\"\n \n from c1 have c2:\" invf= inv100\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv100 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv100 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex1P N (% iInv1 . invf= inv101 iInv1 )\n\"\n \n from c1 obtain iInv1 where c2:\" iInv1 \\ N \\ invf= inv101 iInv1 \" \n by (auto simp add: ex1P_def)\n \n have \"invHoldForRule' s (inv101 iInv1 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv101 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv102)\n\"\n \n from c1 have c2:\" invf= inv102\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv102 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv102 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv103)\n\"\n \n from c1 have c2:\" invf= inv103\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv103 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv103 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv104 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv104 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv104 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv104 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex2P N (% iInv1 iInv2 . invf= inv105 iInv1 iInv2 )\n\"\n \n from c1 obtain iInv1 iInv2 where c2:\" iInv1~=iInv2 \\ iInv1 \\ N \\ iInv2 \\ N \\ invf= inv105 iInv1 iInv2 \" \n by (auto simp add: ex2P_def)\n \n have \"invHoldForRule' s (inv105 iInv1 iInv2 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv105 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2 , metis) \n } moreover\n {assume c1: \"ex0P N ( invf= inv106)\n\"\n \n from c1 have c2:\" invf= inv106\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv106 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv106 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv107)\n\"\n \n from c1 have c2:\" invf= inv107\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv107 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv107 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv108)\n\"\n \n from c1 have c2:\" invf= inv108\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv108 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv108 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv109)\n\"\n \n from c1 have c2:\" invf= inv109\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv109 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv109 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv110)\n\"\n \n from c1 have c2:\" invf= inv110\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv110 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv110 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv111)\n\"\n \n from c1 have c2:\" invf= inv111\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv111 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv111 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv112)\n\"\n \n from c1 have c2:\" invf= inv112\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv112 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv112 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t} moreover\n {assume c1: \"ex0P N ( invf= inv113)\n\"\n \n from c1 have c2:\" invf= inv113\" \n by (auto simp add: ex0P_def)\n \n have \"invHoldForRule' s (inv113 ) r (invariants N) \"\n apply(cut_tac a1 c2 )\n by (metis onInv113 ) \n then have \"invHoldForRule' s invf r (invariants N) \"\n by(cut_tac c2, metis) \n\t}ultimately show \"invHoldForRule' s invf r (invariants N) \"\n by blast \n qed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flashMainLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3380771374883919, "lm_q1q2_score": 0.1769564532715677}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__23.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__23 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__23 and some rule r*}\nlemma n_StoreVsinv__23:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i=p__Inv1)\\(i=p__Inv2)\\(i=p__Inv0)\\(i=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv0) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv1)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv1) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv0) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv1)) (Const false)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv1) ''State'')) (Const I)))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__23:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (neg (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (neg (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv0) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv1) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (neg (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv1) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (neg (eqn (IVar (Ident ''MemData'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__23:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__23:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv1 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i=p__Inv1)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv1)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvAckVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvAck i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__23:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__23.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5389832354982647, "lm_q2_score": 0.32766829425520916, "lm_q1q2_score": 0.17660771740787007}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory GraphRefine\n\nimports TailrecPre GraphLangLemmas \"../../lib/LemmaBucket_C\"\n\nbegin\n\ntype_synonym ('s, 'x, 'e) c_trace = \"nat \\ (('s, 'x, 'e) com \\ ('s, 'e) xstate) option\"\n\ndefinition\n c_trace :: \"('x \\ ('s, 'x, 'e) com option) \\ ('s, 'x, 'e) c_trace set\"\nwhere\n \"c_trace Gamma = nat_trace_rel (Not o final) {(cfg, cfg'). step Gamma cfg cfg'}\"\n\ndefinition\n \"exec_final_step cfg = (case cfg of (Throw, Normal xs) \\ Abrupt xs | _ \\ snd cfg)\"\n\nlemma exec_via_trace:\n \"Gamma \\ \\com, Normal s\\ \\ xs\n = (\\tr \\ c_trace Gamma. tr 0 = Some (com, Normal s)\n \\ option_map exec_final_step (trace_end tr) = Some xs)\"\nproof -\n have dom_If: \"\\n f. dom (\\i. if i \\ n then Some (f i) else None) = {..n}\"\n by (auto split: if_split_asm)\n have end_If: \"\\n f. trace_end (\\i. if i \\ n then Some (f i) else None) = Some (f n)\"\n apply (simp add: trace_end_def dom_If)\n apply (subst Max_eqI, simp+)\n apply (rule_tac x=\"Suc n\" in exI, simp)\n done\n show ?thesis unfolding c_trace_def\n apply safe\n apply (clarsimp simp: relpowp_fun_conv dest!: exec_impl_steps rtranclp_imp_relpowp)\n apply (rule_tac x=\"\\i. if i \\ n then Some (f i) else None\" in bexI)\n apply (simp add: end_If exec_final_step_def split: xstate.split_asm)\n apply (simp add: nat_trace_rel_def)\n apply (clarsimp simp: linorder_not_le less_Suc_eq)\n apply (simp add: final_def split: xstate.split_asm)\n apply blast\n apply (drule(1) trace_end_SomeD)\n apply clarsimp\n apply (subgoal_tac \"rtranclp (step Gamma) (the (tr 0)) (the (tr n))\")\n apply (clarsimp simp: final_def)\n apply (auto simp: exec_final_step_def dest: steps_Skip_impl_exec steps_Throw_impl_exec)[1]\n apply (simp add: rtranclp_power relpowp_fun_conv)\n apply (rule_tac x=n in exI)\n apply (rule_tac x=\"the o tr\" in exI)\n apply (frule(1) trace_None_dom_eq)\n apply (clarsimp simp: nat_trace_rel_def)\n apply (subgoal_tac \"i \\ dom tr \\ Suc i \\ dom tr\")\n apply clarify\n apply metis\n apply (drule(1) eqset_imp_iff[THEN iffD1, rotated, OF domI])+\n apply simp\n done\nqed\n\nabbreviation\n \"extend_rel \\ {((i :: nat, tr), (j, tr')).\n j > i \\ restrict_map tr {.. i} = restrict_map tr' {.. i}}\"\n\ndefinition\n \"suffix_tuple_closure_inter Ss\n = (\\S \\ Ss. {(y, tr). \\k. (y, restrict_map tr {.. k}) \\ S})\"\n\nlemma suffix_tuple_closure_prefixI:\n \"(y, restrict_map tr {.. (k :: nat)}) \\ suffix_tuple_closure_inter Ss\n \\ (y, tr) \\ suffix_tuple_closure_inter Ss\"\n by (auto simp add: suffix_tuple_closure_inter_def)\n\ndefinition\n trace_end_match :: \"(state \\ 's \\ bool) \\ 's set\n \\ stack option\n \\ ((('s, 'x, 'e) com \\ ('s, 'e) xstate) option)\n \\ bool\"\nwhere\n \"trace_end_match out_eqs I e e' = ((\\ft. e' = Some (com.Skip, Fault ft))\n \\ ((e = None) \\ (e' = None))\n \\ (\\sst' gst' gf'. e = Some [(Ret, gst', gf')]\n \\ e' = Some (com.Skip, Normal sst')\n \\ out_eqs gst' sst' \\ sst' \\ I))\"\n\ndefinition\n simpl_to_graph :: \"('x \\ ('s, 'x, 'e) com option)\n \\ (string \\ graph_function option) \\ string\n \\ next_node \\ ('s, 'x, 'e) com\n \\ nat \\ (trace \\ ('s, 'x, 'e) c_trace) set list\n \\ 's set \\ 's set \\ (state \\ 's \\ bool)\n \\ (state \\ 's \\ bool)\n \\ bool\"\nwhere\n \"simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\n = (\\tr gst sst n' gf' tr' n''. tr n' = Some [(nn, gst, gf')] \\ sst \\ P \\ sst \\ I\n \\ inp_eqs gst sst \\ n' \\ n \\ n'' \\ n\n \\ tr \\ exec_trace GGamma gf\n \\ (tr, restrict_map tr' {.. n''}) \\ suffix_tuple_closure_inter (set traces)\n \\ tr' \\ nat_trace_rel (\\x. False) {(cfg, cfg'). step SGamma cfg cfg'}\n \\ tr' n'' = Some (com, Normal sst)\n \\ (\\tr''. tr'' \\ c_trace SGamma \\ restrict_map tr'' {.. n''} = restrict_map tr' {.. n''}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr'')))\"\n\nlemma simpl_to_graph_ge_subset:\n \"simpl_to_graph SGamma GGamma gf nn com n traces' P I inp_eqs out_eqs\n \\ n' \\ n \\ set traces' \\ set traces\n \\ simpl_to_graph SGamma GGamma gf nn com n' traces P I inp_eqs out_eqs\"\n apply (simp add: simpl_to_graph_def suffix_tuple_closure_inter_def Ball_def)\n apply (erule mp[rotated], intro all_mono ex_mono imp_mono conj_mono imp_refl,\n simp_all)\n apply blast\n done\n\nlemmas simpl_to_graphI = simpl_to_graph_def[THEN iffD2, rule_format]\nlemmas simpl_to_graphD = simpl_to_graph_def[THEN iffD1, rule_format]\n\nlemma nat_trace_rel_split:\n \"tr n = Some v\n \\ tr' (Suc n) = Some v'\n \\ (v, v') \\ R\n \\ tr \\ nat_trace_rel cont' R\n \\ (\\i. tr' (Suc n + i)) \\ nat_trace_rel cont R\n \\ (\\i. if i \\ n then tr i else tr' i) \\ nat_trace_rel cont R\"\n apply (frule(1) trace_Some_dom_superset)\n apply (clarsimp simp: nat_trace_rel_def, safe)\n apply (simp_all add: linorder_not_le less_Suc_eq_le subset_iff domIff)\n apply (drule_tac x=\"na - Suc n\" in spec | clarsimp)+\n done\n\nlemma nat_trace_rel_to_relpow:\n \"trace \\ nat_trace_rel cont R\n \\ trace i = Some x\n \\ trace (i + j) = Some y\n \\ (x, y) \\ R ^^ j\"\n apply (induct j arbitrary: y)\n apply simp\n apply atomize\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=\"i + j\" in spec, clarsimp)\n apply auto\n done\n\nlemma exec_graph_trace_must_take_steps:\n \"trace \\ exec_trace \\ fn\n \\ trace i = Some [(nn, st, fn)]\n \\ (exec_graph_step \\ ^^ j) `` {[(nn, st, fn)]} \\ {[(nn', st', fn)]}\n \\ \\k < j. \\st'. ([(nn, st, fn)], st') \\ exec_graph_step \\ ^^ k\n \\ continuing st'\n \\ trace (i + j) = Some [(nn', st', fn)]\"\n apply (case_tac \"trace (i + j)\")\n apply (clarsimp simp add: exec_trace_def)\n apply (drule(1) trace_None_dom_eq)\n apply clarsimp\n apply (drule sym[where s=\"dom trace\"])\n apply (frule_tac x=i in eqset_imp_iff)\n apply (frule_tac x=\"n' - 1\" in eqset_imp_iff)\n apply (frule_tac x=\"n'\" in eqset_imp_iff)\n apply (simp(no_asm_use), clarsimp simp: domIff)\n apply (frule_tac i=\"n' - 1\" in trace_end_eq_Some, simp+)\n apply (drule(1) trace_end_SomeD, clarsimp)\n apply (drule_tac x=\"n' - 1 - i\" in spec, simp)\n apply (drule_tac i=i and j=\"n' - 1 - i\" in nat_trace_rel_to_relpow, simp+)\n apply (clarsimp simp add: exec_trace_def)\n apply (drule_tac i=i and j=j in nat_trace_rel_to_relpow, simp+)\n apply auto\n done\n\nlemma c_trace_may_extend:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ ((step \\) ^^ j) (com, Normal st) (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (cases \"j = 0\")\n apply fastforce\n apply (clarsimp simp: relpowp_fun_conv)\n apply (rule_tac x=\"\\k. if k \\ i then trace k else\n if k \\ i + j then Some (f (k - i))\n else None\"\n in exI)\n apply (intro conjI)\n apply (erule nat_trace_rel_split, simp, simp_all)\n apply (drule_tac x=0 in spec, simp)\n apply (simp add: nat_trace_rel_def)\n apply (simp add: restrict_map_def cong: if_cong)\n apply (rule_tac k=i in suffix_tuple_closure_prefixI)\n apply (simp add: restrict_map_def cong: if_cong)\n done\n\nlemma c_trace_may_extend_steps:\n \"trace \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace i = Some (com, Normal st)\n \\ \\ \\ (com, Normal st) \\\\<^sup>* (com', xst')\n \\ (y, restrict_map trace {..i}) \\ suffix_tuple_closure_inter Ss\n \\ \\j trace'. trace' \\ nat_trace_rel (\\x. False) {(x, y). \\ \\ x \\ y}\n \\ trace' (i + j) = Some (com', xst')\n \\ restrict_map trace' {.. i} = restrict_map trace {.. i}\n \\ (y, restrict_map trace' {.. i + j}) \\ suffix_tuple_closure_inter Ss\"\n apply (clarsimp simp: rtranclp_power)\n apply (blast intro: c_trace_may_extend)\n done\n\nlemma restrict_map_prefix_eq: \"(restrict_map tr {..n} = restrict_map tr' {..n})\n = (\\i \\ n. tr i = tr' i)\"\n by (auto simp add: fun_eq_iff restrict_map_def)\n\nlemma restrict_map_eq_mono:\n \"i \\ j \\ restrict_map tr {..j} = restrict_map tr' {..j}\n \\ restrict_map tr {.. (i :: 'a :: linorder)} = restrict_map tr' {..i}\"\n unfolding restrict_map_prefix_eq\n by clarsimp\n\nlemma simpl_to_graph_step_general:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. ((step SGamma) ^^ j) (com, Normal sst) (com', Normal sst')\n \\ (exec_graph_step GGamma ^^ i) `` {[(nn, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ (\\k < i. \\st'. ([(nn, gst, gf)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (n + min i j) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graphI)\n apply (erule_tac x=sst in meta_allE)\n apply (erule_tac x=gst in meta_allE)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_invariant_Cons)\n apply (frule(2) exec_graph_trace_must_take_steps)\n apply simp\n apply (frule(3) c_trace_may_extend)\n apply clarsimp\n apply (drule_tac n''=\"n'' + j\" in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (metis restrict_map_eq_mono[OF le_add1[where m=j]])\n done\n\nlemma simpl_to_graph_step:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst' gst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ exec_graph_step GGamma `` {[(NextNode m, gst, gf)]} \\ {[(nn', gst', gf)]}\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst' sst')\n \\ simpl_to_graph SGamma GGamma gf nn' com' (Suc n) traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=1 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ \\sst'. (step SGamma) (com, Normal sst) (com', Normal sst')\n \\ sst' \\ P' \\ sst' \\ I \\ inp_eqs' gst sst')\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P' I inp_eqs' out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[rotated, where i=0 and j=1])\n apply simp+\n apply (simp add: eq_OO)\n done\n\nlemma simpl_to_graph_step_R_unchanged:\n \"(\\sst gst. sst \\ P \\ sst \\ I \\ inp_eqs gst sst\n \\ (step SGamma) (com, Normal sst) (com', Normal sst))\n \\ simpl_to_graph SGamma GGamma gf nn com' n traces P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (erule simpl_to_graph_step_R[rotated])\n apply blast\n done\n\nlemma simpl_to_graph_steps_Fault1:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn com n Q P I eqs out_eqs\"\n apply (clarsimp simp: simpl_to_graph_def)\n apply (drule_tac x=sst in bspec, clarsimp+)\n apply (cut_tac \\=SGamma and c=\"com'\" and f=F in steps_Fault)\n apply (frule_tac c_trace_may_extend_steps, assumption)\n apply (erule(1) rtranclp_trans)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n done\n\nlemma extensible_traces_to_infinite_trace:\n assumes step: \"\\x \\ S. (trace x, trace (f x)) \\ extend_rel\n \\ f x \\ S \\ m x < m (f x)\"\n and x: \"x \\ S\"\n shows \"\\tr. \\i :: nat. \\y \\ S. \\j. m y > i \\ fst (trace y) > i\n \\ (trace y, (j, tr)) \\ extend_rel\"\nproof -\n\n let ?f = \"\\i. (f ^^ i) x\"\n\n have f_induct: \"\\i. m (?f i) \\ i \\ fst (trace (?f i)) \\ i \\ ?f i \\ S\"\n apply (induct_tac i)\n apply (simp add: x)\n apply (auto dest: step[rule_format])\n done\n\n have f_eq: \"\\i j k. i \\ fst (trace (?f j)) \\ j \\ k\n \\ fst (trace (?f j)) \\ fst (trace (?f k)) \\ snd (trace (?f k)) i = snd (trace (?f j)) i\"\n apply (intro allI, induct_tac k)\n apply simp\n apply clarsimp\n apply (cut_tac i=n in f_induct[rule_format], clarsimp)\n apply (frule_tac step[rule_format])\n apply (clarsimp simp: fun_eq_iff restrict_map_def linorder_not_le split_def\n split: if_split_asm)\n apply (drule_tac x=i in spec)\n apply (auto simp: le_Suc_eq)\n done\n\n have f_norm:\n \"\\i j. j \\ fst (trace (?f i)) \\ snd (trace (?f i)) j = snd (trace (?f j)) j\"\n apply clarsimp\n apply (cut_tac i=j and j=\"min i j\" and k=\"max i j\" in f_eq[rule_format])\n apply (simp add: min_def linorder_not_le f_induct)\n apply simp\n apply (simp add: min_def max_def split: if_split_asm)\n done\n\n show \"?thesis\"\n apply (rule_tac x=\"\\i. snd (trace (?f i)) i\" in exI)\n apply (clarsimp simp: split_def)\n apply (rule_tac x=\"?f (Suc i)\" in bexI)\n apply (cut_tac i=\"Suc i\" in f_induct)\n apply (clarsimp simp: fun_eq_iff restrict_map_def f_norm\n simp del: funpow.simps)\n apply (metis lessI)\n apply (simp add: f_induct del: funpow.simps)\n done\nqed\n\nlemma trace_end_None_ge_seq:\n \"tr \\ nat_trace_rel c R\n \\ \\i. \\j \\ i. tr j \\ None\n \\ trace_end tr = None\"\n apply (clarsimp simp: trace_end_def)\n apply (drule_tac x=n in spec)\n apply (drule(1) trace_None_dom_subset)\n apply auto\n done\n\nlemma restrict_map_eq_Some_le:\n \"(restrict_map tr {..n} = restrict_map tr' {..m})\n \\ tr' (m :: nat) = Some v\n \\ n \\ m \\ (\\k \\ m. restrict_map tr {..k} = restrict_map tr' {..k})\"\n apply (frule_tac x=m in fun_cong, simp(no_asm_use) add: restrict_map_def)\n apply (simp split: if_split_asm)\n apply (auto simp: fun_eq_iff split: if_split_asm)\n done\n\nlemma trace_prefixes_to_trace:\n assumes i: \"\\i. \\j tr k. j \\ i \\ tr j \\ None\n \\ ((j, tr), (k, tr')) \\ extend_rel \\ tr \\ nat_trace_rel c R\"\n shows \"trace_end tr' = None \\ tr' \\ nat_trace_rel c' R\"\nproof (intro conjI)\n have weak: \"tr' \\ nat_trace_rel (\\x. False) R\"\n apply (clarsimp simp: nat_trace_rel_def)\n apply (cut_tac i=\"Suc n\" in i[rule_format])\n apply (clarsimp simp: nat_trace_rel_def)\n apply (drule_tac x=n in spec, clarsimp)\n apply (clarsimp simp: restrict_map_prefix_eq)\n done\n\n have inf: \"\\i. tr' i \\ None\"\n apply (intro allI notI)\n apply (cut_tac i=i in i[rule_format])\n apply (clarsimp simp: restrict_map_prefix_eq)\n apply (drule trace_None_dom_subset[OF _ weak])\n apply auto\n done\n\n thus \"trace_end tr' = None\"\n by (simp only: trace_end_def, simp)\n\n show \"tr' \\ nat_trace_rel c' R\" using weak\n by (simp only: nat_trace_rel_def inf mem_Collect_eq, simp)\nqed\n\nlemma suffix_tuple_closure_inter_insert:\n \"(x, tr) \\ suffix_tuple_closure_inter (insert S Ss)\n = ((\\k. (x, restrict_map tr {..k}) \\ S) \\ (x, tr) \\ suffix_tuple_closure_inter Ss)\"\n by (simp add: suffix_tuple_closure_inter_def)\n\nlemma simpl_to_graph_induct_proof:\n assumes Suc: \"\\S' n'. n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com (Suc n') (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n (({tr} \\ UNIV) # S) P I inp_eqs out_eqs\"\nproof -\n obtain M where M_def:\n \"M = (\\n1 tr1. {(n', n'', tr'). tr' \\ nat_trace_rel (\\x. False) {(x, y). SGamma\\ x \\ y}\n \\ (\\sst gst gf'. tr' n'' = Some (com, Normal sst) \\ tr n' = Some [(nn, gst, gf')]\n \\ inp_eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ (tr, restrict_map tr' {..n''}) \\ suffix_tuple_closure_inter (set S)\n \\ restrict_map tr' {..n1} = restrict_map tr1 {..n1}\n \\ n' \\ n \\ n'' \\ n \\ n'' \\ n1)})\"\n by auto\n\n have induct_ge: \"\\S' m n'. m \\ n \\ simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n'\n \\ n' \\ n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n apply (erule(1) inc_induct)\n apply clarsimp\n apply (erule(1) Suc)\n done\n\n hence ge: \"\\S' m n'. simpl_to_graph SGamma GGamma gf nn com m (S' # S) P I inp_eqs out_eqs\n \\ m \\ n' \\ n' \\ n\n \\ simpl_to_graph SGamma GGamma gf nn com n' (S' # S) P I inp_eqs out_eqs\"\n by auto\n\n have terminating_case: \"\\i j orig_tr' n1 tr1. (i, j, orig_tr') \\ M n1 tr1\n \\ tr \\ exec_trace GGamma gf\n \\ \\v' \\ M n1 tr1. fst v' > i \\ ((j, orig_tr'), snd v') \\ extend_rel\n \\ \\tr'. tr' \\ c_trace SGamma\n \\ restrict_map tr' {..j} = restrict_map orig_tr' {..j}\n \\ trace_end_match out_eqs I (trace_end tr) (trace_end tr')\"\n apply (cut_tac n'=\"min i j\" and m=\"Suc (max i j)\"\n and S'=\"{tr} \\ {restrict_map orig_tr' {..j}}\" in ge)\n apply (clarsimp simp: M_def simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (erule_tac x=n' in allE, erule_tac x=n'' in allE, erule_tac x=tr' in allE)\n apply (simp add: Suc_le_eq)\n apply (drule(1) restrict_map_eq_Some_le)\n apply simp\n apply simp\n apply (clarsimp simp: M_def)\n apply (clarsimp simp: M_def)\n apply (erule_tac n''=j and tr'=orig_tr' in simpl_to_graphD,\n (rule conjI | assumption | simp)+)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply (metis min.idem)\n apply simp\n done\n\n { fix S' Q'\n note bchoice[where Q=\"\\x y. y \\ S' \\ Q' x y\", folded Bex_def]\n } note bbchoice = this\n\n have infinite_case:\n \"\\v' n1 tr1. \\v \\ M n1 tr1. \\v' \\ M n1 tr1. fst v' > fst v \\ (snd v, snd v') \\ extend_rel\n \\ tr \\ exec_trace GGamma gf\n \\ v' \\ M n1 tr1\n \\ \\tr'. trace_end tr = None\n \\ restrict_map tr' {.. n1} = restrict_map tr1 {.. n1}\n \\ trace_end tr' = None\n \\ tr' \\ c_trace SGamma\"\n apply (drule bbchoice)\n apply (elim exE)\n apply (frule_tac trace=snd and m=fst and f=f\n in extensible_traces_to_infinite_trace[rotated])\n apply simp\n apply (erule exE, rename_tac tr')\n apply (rule_tac x=tr' in exI)\n apply (rule conjI)\n apply (rule trace_end_None_ge_seq)\n apply (auto simp add: exec_trace_def)[1]\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n apply (clarsimp simp: c_trace_def)\n apply (rule conjI)\n apply (drule_tac x=0 in spec)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n1 in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n apply (rule trace_prefixes_to_trace)\n apply clarsimp\n apply (drule_tac x=i in spec)\n apply (clarsimp simp: M_def)\n apply (blast intro: less_imp_le)\n done\n\n show ?thesis\n apply (clarsimp simp: simpl_to_graph_def suffix_tuple_closure_inter_insert)\n apply (case_tac \"(\\v \\ M n'' tr'. \\v' \\ M n'' tr'. fst v' > fst v \\ (snd v, snd v') \\ extend_rel)\")\n apply (drule(1) infinite_case)\n apply (fastforce simp add: M_def)\n apply (fastforce simp: trace_end_match_def)\n apply clarsimp\n apply (frule(1) terminating_case, simp)\n apply (clarify, rename_tac soln_tr', rule_tac x=soln_tr' in exI)\n apply (clarsimp simp: M_def)\n apply (drule_tac i=n'' in restrict_map_eq_mono[rotated], assumption)+\n apply simp\n done\nqed\n\nlemma simpl_to_graph_induct:\n assumes Suc: \"\\S' k. simpl_to_graph SGamma GGamma gf nn com (Suc n + k) (S' # S) P I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com (n + k) (S' # S) P I inp_eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n S P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (cut_tac tr=tr and n=n and S=S in simpl_to_graph_induct_proof)\n apply (cut_tac S'=S' and k=\"n'a - n\" in Suc)\n apply simp+\n apply (erule simpl_to_graphD)\n apply (simp add: suffix_tuple_closure_inter_insert)\n apply blast\n done\n\ndefinition\n \"eq_impl addr eqs eqs2 S = (\\gst sst. eqs gst sst \\ sst \\ S \\ eqs2 gst sst)\"\n\nlemma eq_implD:\n \"\\ eq_impl addr eqs eqs2 S; eqs gst sst; sst \\ S \\\n \\ eqs2 gst sst\"\n by (simp add: eq_impl_def)\n\nlemma simpl_to_graph_cases:\n \"simpl_to_graph SGamma GGamma gf nn com n traces (P \\ S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces (P \\ - S) I inp_eqs out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n apply (rule simpl_to_graphI)\n apply (case_tac \"sst \\ S\")\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ S\"] Compl_iff Int_iff)\n apply (clarsimp simp only: simpl_to_graph_def[where P=\"P \\ - S\"] Compl_iff Int_iff)\n done\n\nlemma exec_graph_step_image_node:\n \"GGamma f = Some gf \\ function_graph gf n = Some node\n \\ exec_graph_step GGamma `` {[(NextNode n, gst, f)]}\n = exec_node GGamma gst node [(NextNode n, gst, f)]\"\n by (cases gf, simp add: exec_graph_step_def)\n\ndefinition\n \"add_cont com conts\n = foldl (\\c d. case d of Inl d' \\ c ;; d' | Inr d' \\ com.Catch c d') com conts\"\n\nlemma add_cont_Cons:\n \"add_cont c (Inl d # cont) = add_cont (c ;; d) cont\"\n \"add_cont c (Inr d # cont) = add_cont (com.Catch c d) cont\"\n by (simp_all add: add_cont_def)\n\nlemma add_cont_Nil:\n \"add_cont c [] = c\"\n by (simp add: add_cont_def)\n\nlemma add_cont_step:\n \"SGamma \\ (com, s) \\ (com', s')\n \\ SGamma \\ (add_cont com con, s) \\ (add_cont com' con, s')\"\n apply (induct con rule: rev_induct)\n apply (simp add: add_cont_def)\n apply (simp add: add_cont_def step.intros split: sum.split)\n done\n\nlemma simpl_to_graph_Cond:\n \"\\ nn = NextNode m; GGamma gf = Some gfc; function_graph gfc m = Some (Cond l r cond);\n eq_impl nn eqs (\\gst sst. l \\ r \\ cond gst = (sst \\ C)) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I \\ C);\n simpl_to_graph SGamma GGamma gf l (add_cont c con) (Suc n) Q (P \\ C) I eqs2 out_eqs;\n eq_impl nn eqs eqs3 (P \\ I \\ (- C));\n simpl_to_graph SGamma GGamma gf r (add_cont d con) (Suc n) Q (P \\ - C) I eqs3 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Cond C c d) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (erule_tac nn'=l in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n apply (erule_tac nn'=r in simpl_to_graph_step[rotated])\n apply (simp add: exec_graph_step_image_node)\n apply (fastforce dest: eq_implD intro: step.intros add_cont_step)[1]\n done\n\nlemma simpl_to_graph_weaken[rotated]:\n assumes eqs: \"\\gst sst. eqs gst sst \\ sst \\ P \\ sst \\ I\n \\ eqs2 gst sst \\ sst \\ Q\"\n shows \"simpl_to_graph SGamma GGamma gf nn com n tS Q I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n using eqs\n apply (clarsimp simp add: simpl_to_graph_def)\n apply blast\n done\n\nlemma simpl_to_graph_weaken_eq_impl:\n \"eq_impl nn eqs eqs2 (I \\ P)\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma gf nn com n tS P I eqs out_eqs\"\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_While_lemma:\n assumes ps: \"GGamma f = Some gf\" \"nn = NextNode m\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ P)\"\n assumes loop: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) P I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (P \\ C) I eqs out_eqs\"\n assumes exitloop: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (P \\ (- C)) I eqs out_eqs\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_induct)\n apply (simp add: ps)\n apply (rule_tac S=C in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule loop)\n apply (simp add: ps)\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n apply (rule simpl_to_graph_step[rotated])\n apply (rule simpl_to_graph_ge_subset)\n apply (rule exitloop)\n apply fastforce\n apply (frule eq_implD[OF ps(4)], simp+)\n apply (simp add: exec_graph_step_image_node ps)\n apply (blast intro: step.intros add_cont_step)\n done\n\nlemma simpl_to_graph_While_inst:\n assumes ps: \"nn = NextNode m\" \"GGamma f = Some gf\" \"function_graph gf m = Some (Cond l r cond)\"\n \"eq_impl nn eqs (\\gst sst. cond gst = (sst \\ C)) (I \\ G)\"\n and ss_eq: \"eq_impl nn eqs eqs2 (I \\ G \\ C)\"\n and ss: \"\\k S. \\ simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) (Suc (n + k)) (S # tS) G I eqs out_eqs \\\n \\ simpl_to_graph SGamma GGamma f l (add_cont (c ;; com.While C c) con) (Suc (n + k)) (S # tS) (G \\ C) I eqs2 out_eqs\"\n and ex_eq: \"eq_impl nn eqs eqs3 (I \\ G \\ - C)\"\n and ex: \"simpl_to_graph SGamma GGamma f r (add_cont com.Skip con) (Suc n) tS (G \\ (- C)) I eqs3 out_eqs\"\n and in_eq: \"eq_impl nn eqs (\\gst sst. sst \\ G) (I \\ G')\"\n shows \"simpl_to_graph SGamma GGamma f nn (add_cont (com.While C c) con) n tS G' I eqs out_eqs\"\n apply (rule simpl_to_graph_weaken)\n apply (rule simpl_to_graph_While_lemma[where P=G], (rule ps)+)\n apply (rule simpl_to_graph_weaken, erule ss)\n apply (clarsimp simp: ss_eq[THEN eq_implD])\n apply (rule simpl_to_graph_weaken, rule ex)\n apply (clarsimp simp: ex_eq[THEN eq_implD])\n apply (clarsimp simp: in_eq[THEN eq_implD])\n done\n\nlemma use_simpl_to_graph_While_assum:\n \"\\ simpl_to_graph SGamma GGamma f nn com n tS P I eqs out_eqs;\n n \\ n' \\ set tS \\ set tS';\n eq_impl nn eqs (\\gst sst. sst \\ P) (Q \\ I) \\\n \\ simpl_to_graph SGamma GGamma f nn com n' tS' Q I eqs out_eqs\"\n apply (erule simpl_to_graph_ge_subset[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (auto simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_Skip_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Skip con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Skip (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Skip\n = simpl_to_graph_Skip_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Throw_immediate:\n \"simpl_to_graph SGamma GGamma f nn (add_cont com.Throw con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inl c # con)) n tS P I eqs out_eqs\"\n \"simpl_to_graph SGamma GGamma f nn (add_cont c con) n tS P I eqs out_eqs\n \\ simpl_to_graph SGamma GGamma f nn (add_cont com.Throw (Inr c # con)) n tS P I eqs out_eqs\"\n apply (safe elim!: simpl_to_graph_step_R_unchanged[rotated])\n apply (auto simp: add_cont_Cons intro: add_cont_step step.intros)\n done\n\nlemmas simpl_to_graph_Throw\n = simpl_to_graph_Throw_immediate[OF simpl_to_graph_weaken_eq_impl]\n\nlemma simpl_to_graph_Seq:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (c ;; d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inl d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma simpl_to_graph_Catch:\n \"simpl_to_graph SGamma GGamma f nn (add_cont (com.Catch c d) con) n tS P I eqs out_eqs\n = simpl_to_graph SGamma GGamma f nn (add_cont c (Inr d # con)) n tS P I eqs out_eqs\"\n by (simp add: add_cont_Cons)\n\nlemma no_next_step: \"eq_impl nn' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 0) `` {[(nn, gst', fn)]} \\ {[(nn, gst', fn)]}\n \\ (\\k < (0 :: nat). \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n by (simp add: eq_impl_def)\n\nlemma basic_next_step: \"GGamma fn = Some gf \\ function_graph gf m = Some (Basic nn' upds)\n \\ eq_impl nn'' eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 1) `` {[(NextNode m, gst', fn)]} \\ {[(nn', upd_vars upds gst', fn)]}\n \\ (\\k < 1. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) P\"\n apply (clarsimp simp: eq_impl_def simp del: imp_disjL)\n apply (clarsimp simp: exec_graph_step_def K_def split: graph_function.split_asm)\n done\n\nlemma simpl_to_graph_Basic_next_step:\n assumes next_step: \"eq_impl nn eqs (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn, gst', fn)]} \\ {[(nn', f gst', fn)]}\n \\ (\\k < steps. \\st'. ([(nn, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) (P \\ I)\"\n shows\n \"\\ eq_impl nn eqs (\\gst sst. eqs2 (f gst) (f' sst) \\ f' sst \\ I \\ f' sst \\ Q) (P \\ I);\n simpl_to_graph SGamma GGamma fn nn' (add_cont com.Skip con) (n + min steps 1) tS Q I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fn nn (add_cont (com.Basic f') con) n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where j=1 and i=steps, rotated -1])\n apply simp\n apply (frule eq_implD[OF next_step], simp)\n apply (simp add: eq_OO)\n apply (rule exI, rule conjI, blast intro: add_cont_step step.intros)\n apply (auto dest: eq_implD)\n done\n\nlemmas simpl_to_graph_Basic_triv'\n = simpl_to_graph_Basic_next_step[OF no_next_step]\n\nlemmas simpl_to_graph_Basic_triv = simpl_to_graph_Basic_triv'[where f'=\"\\x. x\" and Q=UNIV]\n\nlemmas simpl_to_graph_Basic\n = simpl_to_graph_Basic_next_step[OF basic_next_step, where Q=UNIV]\n\ndefinition\n \"upd_range upd_fun v = range (upd_fun (\\_. v))\"\n\nlemma simpl_to_graph_cbreak:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Break) sst) \\ exn_upd (\\_. Break) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (cbreak exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: cbreak_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Break:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Break \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Skip con) n tS (upd_range exn_upd Break) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Break) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (blast intro: add_cont_step step.intros)\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_ccatchbrk_Return:\n \"\\f s. exn_var (exn_upd f s) = f (exn_var s)\n \\ eq_impl nn eqs eqs2 (upd_range exn_upd Return \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (ccatchbrk exn_var) con) n tS (upd_range exn_upd Return) I eqs out_eqs\"\n apply (simp add: ccatchbrk_def)\n apply (rule simpl_to_graph_step_R_unchanged)\n apply (simp add: upd_range_def)\n apply (rule add_cont_step step.CondFalse)+\n apply clarsimp\n apply (erule simpl_to_graph_weaken, simp add: eq_impl_def)\n done\n\nlemma simpl_to_graph_creturn_void:\n \"eq_impl nn eqs (\\gst sst. eqs2 gst (exn_upd (\\_. Return) sst) \\ exn_upd (\\_. Return) sst \\ I) (P \\ I)\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont com.Throw con) n tS (upd_range exn_upd Return) I eqs2 out_eqs\n \\ simpl_to_graph SGamma GGamma f nn\n (add_cont (creturn_void exn_upd) con) n tS P I eqs out_eqs\"\n apply (simp add: creturn_void_def simpl_to_graph_Seq)\n apply (rule_tac simpl_to_graph_Basic_triv'[rotated])\n apply (rule simpl_to_graph_Skip_immediate)\n apply simp\n apply (simp add: upd_range_def)\n done\n\nlemma rtranclp_respects_fun:\n assumes respects: \"\\x y. R x y \\ R (f x) (f y)\"\n shows \"R\\<^sup>*\\<^sup>* x y \\ R\\<^sup>*\\<^sup>* (f x) (f y)\"\n apply (induct rule: rtranclp.induct)\n apply (fastforce intro: respects elim: rtranclp_trans)+\n done\n\nlemma add_cont_steps:\n \"\\ \\ (com, xs) \\\\<^sup>* (com', xs')\n \\ \\ \\ (add_cont com con, xs) \\\\<^sup>* (add_cont com' con, xs')\"\n apply (drule_tac f=\"\\(a, b). (add_cont a con, b)\" in rtranclp_respects_fun[rotated])\n apply clarsimp\n apply (erule add_cont_step)\n apply simp\n done\n\nlemma simpl_to_graph_steps_Fault:\n \"\\s \\ P \\ I. \\com'. SGamma \\ (com, Normal s) \\\\<^sup>* (com', Fault F)\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont com con) n Q P I eqs out_eqs\"\n apply (clarsimp intro!: simpl_to_graph_steps_Fault1)\n apply (drule_tac x=s in bspec, clarsimp+)\n apply (rule exI)\n apply (erule add_cont_steps)\n done\n\nlemma simpl_to_graph_Guard:\n \"\\ nn = NextNode m; eq_impl nn eqs eqs2 (P \\ I \\ G);\n simpl_to_graph SGamma GGamma gf nn (add_cont c con) n Q (G \\ P) I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf nn (add_cont (com.Guard F G c) con) n Q P I eqs out_eqs\"\n apply clarsimp\n apply (rule_tac S=G in simpl_to_graph_cases)\n apply (rule simpl_to_graph_step_R_unchanged[rotated])\n apply (erule simpl_to_graph_weaken)\n apply (simp add: eq_impl_def)\n apply (rule add_cont_step)\n apply (blast intro: step.Guard)\n apply (rule simpl_to_graph_steps_Fault)\n apply (blast intro: step.GuardFault)\n done\n\nlemma simpl_to_graph_done:\n \"\\ eq_impl nn eqs out_eqs (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf Ret (add_cont com.Skip []) n Q P I eqs out_eqs\"\n apply (clarsimp simp: c_trace_def add_cont_Nil intro!: simpl_to_graphI)\n apply (frule_tac i=n' in exec_trace_step_cases)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, simp add: final_def)\n apply (clarsimp simp: trace_end_cut exec_graph_step_def)\n apply (clarsimp simp: exec_trace_def trace_end_eq_Some\n eq_impl_def trace_end_match_def)\n done\n\nlemma eq_impl_refl:\n \"eq_impl nn eqs eqs P\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_done2 = simpl_to_graph_done[OF eq_impl_refl]\nlemmas simpl_to_graph_creturn_void2 = simpl_to_graph_creturn_void[where nn=Ret, OF eq_impl_refl]\n\nlemma simpl_to_graph_noop_Basic:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn upds);\n eq_impl nn eqs (\\gst sst. eqs2 (upd_vars upds gst) sst) (P \\ I);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_general[where i=1 and j=0, rotated])\n apply simp+\n apply (simp add: exec_graph_step_image_node eq_impl_def K_def)\n done\n\nlemma simpl_to_graph_noop:\n \"\\ GGamma gf = Some gfc; function_graph gfc m = Some (node.Basic nn []);\n simpl_to_graph SGamma GGamma gf nn c n Q P I eqs2 out_eqs;\n eq_impl nn eqs eqs2 (P \\ I) \\\n \\ simpl_to_graph SGamma GGamma gf (NextNode m) c n Q P I eqs out_eqs\"\n apply (erule(1) simpl_to_graph_noop_Basic, simp_all)\n apply (simp add: upd_vars_def save_vals_def eq_impl_def)\n done\n\nlemmas simpl_to_graph_nearly_done\n = simpl_to_graph_noop[where c=\"add_cont com.Skip []\"]\n\nlemma eq_impl_triv: \"eq_impl nn eqs eqs S\"\n by (simp add: eq_impl_def)\n\nlemmas simpl_to_graph_noop_same_eqs\n = simpl_to_graph_noop[OF _ _ _ eq_impl_triv]\n\ndefinition\n exec_trace_inputs :: \"graph_function \\ trace \\ variable list\"\nwhere\n \"exec_trace_inputs gfun tr = (case tr 0 of Some [(nn, gst, _)]\n => acc_vars (function_inputs gfun) gst)\"\n\ndefinition\n graph_fun_refines\nwhere\n \"graph_fun_refines SGamma GGamma I inputs proc outputs fname\n = (\\gf. GGamma fname = Some gf \\ length (function_inputs gf) = length inputs\n \\ length (function_outputs gf) = length outputs\n \\ distinct (function_inputs gf)\n \\ (\\tr \\ exec_trace GGamma fname.\n \\s. map (\\i. i s) inputs = exec_trace_inputs gf tr \\ s \\ I\n \\ ((\\ft. SGamma \\ \\com.Call proc, Normal s\\ \\ Fault ft)\n \\ (trace_end tr = None \\ \\ terminates SGamma (com.Call proc) (Normal s))\n \\ (\\gst sst. SGamma \\ \\com.Call proc, Normal s\\ \\ Normal sst\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ sst \\ I \\ map (\\j. j sst) outputs\n = acc_vars (function_outputs gf) gst))))\"\n\nlemma var_acc_var_upd:\n \"var_acc nm (var_upd nm' v st) = (if nm = nm' then v else var_acc nm st)\"\n by (cases st, simp add: var_acc_def var_upd_def)\n\nlemma var_acc_var_upd_same[simp]:\n \"var_acc nm (var_upd nm v st) = v\"\n by (simp add: var_acc_var_upd)\n\nlemma var_acc_var_upd_diff:\n \"nm \\ nm' \\ var_acc nm (var_upd nm' v st) = var_acc nm st\"\n by (simp add: var_acc_var_upd)\n\nlemma fetch_returned:\n \"\\ distinct vs; length vs = length xs \\\n \\ acc_vars vs (save_vals vs xs st) = xs\"\n apply (induct vs arbitrary: xs st)\n apply (simp add: acc_vars_def)\n apply (case_tac xs, simp_all add: save_vals_def acc_vars_def)\n apply (rule_tac P=\"\\st. var_acc a st = b\" and Q=\"\\x. x \\ set xs\" for a b xs\n in fold_invariant, simp)\n apply simp\n apply (clarsimp simp: var_acc_var_upd set_zip)\n done\n\nlemma c_trace_nontermination:\n \"tr \\ c_trace \\\n \\ trace_end tr = None\n \\ tr 0 = Some (com, st)\n \\ \\ terminates \\ com st\"\n apply (frule trace_end_NoneD, simp add: c_trace_def)\n apply (erule disjE)\n apply (clarsimp simp: c_trace_def nat_trace_rel_def)+\n apply (drule terminates_impl_no_infinite_trans_computation)\n apply auto\n done\n\nlemma trace_end_Ret_Err:\n \"trace \\ exec_trace Gamma fname\n \\ trace_end trace = Some v\n \\ \\gst er. v = [(er, gst, fname)] \\ er \\ {Ret, Err}\"\n apply (frule trace_end_SomeD)\n apply (clarsimp simp: exec_trace_def, assumption)\n apply clarsimp\n apply (frule(1) exec_trace_invariant)\n apply (auto simp: continuing_def exec_graph_invariant_Cons\n split: list.split_asm next_node.split_asm,\n auto simp: exec_graph_invariant_def)\n done\n\nlemma graph_fun_refines_from_simpl_to_graph:\n \"\\ SGamma proc = Some com; GGamma fname = Some gf;\n \\Q. simpl_to_graph SGamma GGamma fname (NextNode (entry_point gf)) (add_cont com []) 0\n [Q] UNIV I eqs\n (\\s s'. map (\\i. var_acc i s) (function_outputs gf) = map (\\i. i s') outs);\n eq_impl (NextNode (entry_point gf))\n (\\gst sst. map (\\i. var_acc i gst) (function_inputs gf) = map (\\i. i sst) ins)\n eqs I;\n distinct (function_inputs gf); length ins = length (function_inputs gf);\n length outs = length (function_outputs gf) \\\n \\ graph_fun_refines SGamma GGamma I ins proc outs fname\"\n apply (clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_def[THEN eqset_imp_iff, THEN iffD1])\n apply clarsimp\n apply (erule_tac x=\"UNIV \\ {[0 \\ (com, Normal s)]}\" in meta_allE)\n apply (drule_tac tr=tr and tr'=\"[0 \\ (com, Normal s)]\"\n and n'=0 and n''=0 and sst=s in simpl_to_graphD)\n apply (rule conjI, assumption)\n apply (simp add: suffix_tuple_closure_inter_def exec_trace_def)\n apply (rule conjI)\n apply (erule eq_implD)\n apply (simp add: fetch_returned exec_trace_inputs_def acc_vars_def)\n apply simp\n apply (simp add: add_cont_Nil nat_trace_rel_def)\n apply (clarsimp simp: trace_end_match_def dest!: fun_cong[where x=0])\n apply (subgoal_tac \"\\st. trace_end tr'' = Some st\n \\ SGamma \\ \\com.Call proc,Normal s\\ \\ exec_final_step st\")\n apply (elim disjE exE conjE)\n apply (clarsimp simp: exec_final_step_def)\n apply clarsimp\n apply (drule step_preserves_termination[rotated])\n apply (erule step.Call)\n apply (simp add: c_trace_nontermination)\n apply (frule(1) trace_end_Ret_Err)\n apply (clarsimp simp: exec_final_step_def acc_vars_def)\n apply metis\n apply clarsimp\n apply (erule exec.Call)\n apply (simp add: exec_via_trace)\n apply metis\n done\n\nlemma simpl_to_graph_name_simpl_state:\n \"(\\sst. sst \\ P \\ simpl_to_graph SGamma GGamma gf nn com n traces {sst} I inp_eqs out_eqs)\n \\ simpl_to_graph SGamma GGamma gf nn com n traces P I inp_eqs out_eqs\"\n by (simp add: simpl_to_graph_def, blast)\n\nlemma trace_drop_n_init:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr 0\n = Some [(NextNode (entry_point gf'), init_vars (function_inputs gf') inps st, fn')]\"\n apply (frule(1) exec_trace_invariant)\n apply (simp add: exec_graph_invariant_Cons)\n apply (frule_tac tr=tr and i=i in exec_trace_step_cases)\n apply (clarsimp simp: exec_graph_step_def split: graph_function.split_asm)\n apply (simp add: trace_drop_n_def)\n done\n\nlemma trace_drop_n_end:\n \"tr \\ exec_trace Gamma fn \\ Gamma fn = Some gf\n \\ function_graph gf n = Some (Call nn fn' inps outps)\n \\ Gamma fn' = Some gf'\n \\ tr i = Some [(NextNode n, st, fn'')]\n \\ trace_drop_n (Suc i) (Suc 0) tr \\ exec_trace Gamma fn'\n \\ trace_end (trace_drop_n (Suc i) (Suc 0) tr) = Some [(Ret, st', fn''')]\n \\ \\j \\ 2. tr (i + j) = Some [(nn, return_vars (function_outputs gf') outps st' st, fn)]\"\n apply (frule trace_end_SomeD, (auto simp: exec_trace_def)[1])\n apply clarsimp\n apply (rename_tac j')\n apply (drule(4) exec_trace_drop_n_rest[rotated 2, rule_format], simp)\n apply (frule_tac i=\"Suc (i + j')\" in exec_trace_step_cases)\n apply (frule(1) exec_trace_invariant)\n apply (clarsimp simp: exec_graph_step_def exec_graph_invariant_def\n split: graph_function.split_asm)\n apply (rule_tac x=\"Suc (Suc j')\" in exI, simp)\n done\n\nlemma nontermination_to_c_trace:\n \"tr \\ nat_trace_rel F {(cfg, cfg'). \\ \\ cfg \\ cfg'}\n \\ tr i = Some (add_cont com con, st)\n \\ \\ terminates \\ com st\n \\ \\tr'. tr' \\ c_trace \\ \\ restrict_map tr' {..i} = restrict_map tr {..i}\n \\ trace_end tr' = None\"\n apply (clarsimp simp: terminates_iff_no_infinite_computation inf_def)\n apply (rule_tac x=\"\\j. if j \\ i then tr j else case f (j - i) of\n (com', st') \\ Some (add_cont com' con, st')\" in exI)\n apply (rule conjI)\n apply (simp add: c_trace_def)\n apply (rule nat_trace_rel_split, assumption, simp_all)\n apply (simp add: split_def)\n apply (rule add_cont_step)\n apply (drule spec[where x=0])\n apply simp\n apply (clarsimp simp: nat_trace_rel_def split_def)\n apply (rule add_cont_step, simp)\n apply (frule(1) trace_Some_dom_superset)\n apply (rule conjI)\n apply (simp add: restrict_map_def fun_eq_iff)\n apply (simp only: trace_end_def)\n apply (rule if_not_P)\n apply (simp add: trace_end_def split_def subset_iff domIff)\n done\n\nlemma simpl_to_graph_call_next_step:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n assumes next_step: \"eq_impl nn eqs_inner (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ steps) `` {[(nn', gst', p)]} \\ {[(nn'', f gst', p)]}\n \\ (\\k < steps. \\st'. ([(nn', gst', p)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n and rel: \"graph_fun_refines SGamma GGamma I inputs proc outputs p'\"\n and modifies: \"(\\\\. SGamma \\\\<^bsub>/UNIV\\<^esub> {\\} com.Call proc (Q \\)) \\ (Q = (\\_. UNIV))\"\n and init: \"eq_impl nn eqs (\\gst sst. initf sst \\ I\n \\ map (\\i. i gst) args = map (\\i. i (initf sst)) inputs) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\sst' vs. map (\\i. i sst') outputs = vs\n \\ sst' \\ I \\ sst' \\ Q (initf sst)\n \\ eqs2 (f (save_vals rets vs gst))\n (f' sst sst' (ret sst sst')) \\ f' sst sst' (ret sst sst') \\ I\n \\ eqs_inner (save_vals rets vs gst) (f' sst sst' (ret sst sst')))) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn'' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (call initf proc ret (\\x y. com.Basic (f' x y))) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: call_def block_def graph)\n apply (rule_tac i=0 and j=3 and P'=\"{initf sst}\"\n and inp_eqs'=\"\\gst _. eqs gst sst \\ sst \\ I\" in simpl_to_graph_step_general)\n apply (simp add: init[THEN eq_implD] numeral_3_eq_3 eq_OO)\n apply (rule conjI[OF _ refl])\n apply (intro relcomppI)\n apply (rule add_cont_step, rule step.DynCom)\n apply (simp add: add_cont_Cons[symmetric])\n apply (rule add_cont_step, rule step.Basic)\n apply (simp add: add_cont_Cons(1), rule add_cont_step, rule step.SeqSkip)\n apply simp\n apply (clarsimp intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: graph_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (drule_tac x=\"initf sst\" in spec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def fetch_returned)\n apply (elim disjE exE conjE)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Fault)\n apply (rule steps_Fault)\n apply assumption\n apply (clarsimp simp: c_trace_def)\n apply (rule exI, rule context_conjI)\n apply (erule(1) nat_trace_rel_final, fastforce simp: final_def)\n apply (simp add: trace_end_cut trace_end_match_def)\n apply (frule(2) trace_end_trace_drop_n_None)\n apply (frule(2) nontermination_to_c_trace)\n apply (auto simp: trace_end_match_def)[1]\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule rtranclp_trans)\n apply (rule add_cont_steps)\n apply (erule exec_impl_steps_Normal)\n apply (simp add: add_cont_Cons)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.CatchMiss exec.Seq exec.Skip exec.DynCom exec.Basic | simp)+\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp, clarsimp)\n apply (drule_tac x=ssta in spec, drule mp, rule conjI, assumption)\n apply (rule disjE[OF modifies])\n apply (drule spec, drule cvalidD[OF hoare_sound], simp+)\n apply clarsimp\n apply auto[1]\n apply simp\n apply clarsimp\n apply (frule next_step[THEN eq_implD], simp)\n apply (clarsimp simp: return_vars_def)\n apply (frule(3) exec_graph_trace_must_take_steps)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"f' a b c\" for a b c in simpl_to_graphD[OF cont])\n apply auto[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemmas simpl_to_graph_call_triv\n = simpl_to_graph_call_next_step[where f'=\"\\x y s. s\",\n where eqs_inner=\"\\_ _. True\", OF _ _ _ no_next_step]\n\nlemmas simpl_to_graph_call\n = simpl_to_graph_call_next_step[OF _ _ _ basic_next_step,\n where eqs_inner=\"\\_ _. True\"]\n\nlemma known_guard_then_basic_next_step:\n \"GGamma fn = Some gf \\ function_graph gf m = Some (node.Cond (NextNode m') Err C)\n \\ GGamma fn = Some gf \\ function_graph gf m' = Some (node.Basic nn'' upds)\n \\ eq_impl nn (\\gst' sst'. C gst') (\\gst' sst'.\n ((exec_graph_step GGamma) ^^ 2) `` {[(NextNode m, gst', fn)]} \\ {[(nn'', upd_vars upds gst', fn)]}\n \\ (\\k < 2. \\st'. ([(NextNode m, gst', fn)], st') \\ exec_graph_step GGamma ^^ k\n \\ continuing st')) I\"\n apply (clarsimp simp: eq_impl_def)\n apply (drule_tac n=m and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (drule_tac n=m' and gst=gst and GGamma=GGamma\n in exec_graph_step_image_node[rotated], simp)\n apply (simp add: numeral_2_eq_2 relcomp_Image less_Suc_eq K_def)\n apply (simp add: set_eq_iff)\n done\n\nlemmas simpl_to_graph_call_known_guard\n = simpl_to_graph_call_next_step[OF _ _ _ known_guard_then_basic_next_step]\n\nlemma simpl_to_graph_lvar_nondet_init:\n assumes stg: \"simpl_to_graph SGamma GGamma fname nn (add_cont com.Skip con) n traces UNIV I eqs2 out_eqs\"\n and eqs: \"eq_impl nn eqs (\\gst sst. \\f. eqs2 gst (updf f sst) \\ updf f sst \\ I) (P \\ I)\"\n shows \"simpl_to_graph SGamma GGamma fname nn\n (add_cont (lvar_nondet_init accf updf) con) n traces P I eqs out_eqs\"\n apply (rule simpl_to_graph_step_R[OF _ stg])\n apply (simp add: lvar_nondet_init_def)\n apply (drule eq_implD[OF eqs], simp)\n apply (rule exI, rule conjI, rule add_cont_step)\n apply (rule step.Spec)\n apply simp\n apply (rule_tac x=undefined in exI, simp)\n apply simp\n done\n\nlemma c_guard_ptr_val_gt_0:\n \"c_guard (p :: ('a :: mem_type) ptr) \\ ptr_val p > 0\"\n apply (simp only: word_neq_0_conv[symmetric], rule notI)\n apply (cases p, simp)\n done\n\nlemma h_val_ptr:\n \"h_val hp (p :: ('a :: c_type) ptr ptr) = Ptr (load_word32 (ptr_val p) hp)\"\n by (simp add: h_val_def load_word32_def from_bytes_def typ_info_ptr)\n\nlemma heap_update_ptr:\n \"heap_update (p :: ('a :: c_type) ptr ptr) p' hp = store_word32 (ptr_val p) (ptr_val p') hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_ptr store_word32_def)\n\nlemma h_val_word32:\n \"h_val hp p = load_word32 (ptr_val p) hp\"\n by (simp add: h_val_def load_word32_def from_bytes_def typ_info_word)\n\nlemma heap_update_word32:\n \"heap_update p w hp = store_word32 (ptr_val p) w hp\"\n by (simp add: heap_update_def to_bytes_def typ_info_word store_word32_def)\n\nlemma h_val_word8:\n \"h_val hp p = load_word8 (ptr_val p) hp\"\n by (simp add: h_val_def load_word8_def from_bytes_def typ_info_word\n word_rcat_bl)\n\nlemma from_bytes_ucast_isom[OF refl refl]:\n \"x = from_bytes xs \\ y = from_bytes xs\n \\ size x = size y\n \\ size x = length xs * 8\n \\ ucast x = y\"\n apply (clarsimp simp: word_size from_bytes_def typ_info_word)\n apply (rule word_eqI)\n apply (simp add: nth_ucast word_size test_bit_rcat[OF refl refl])\n done\n\nlemma h_val_sword8:\n \"(h_val hp p :: 8 signed word) = ucast (h_val hp (ptr_coerce p) :: 8 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma h_val_sword32:\n \"(h_val hp p :: 32 signed word) = ucast (h_val hp (ptr_coerce p) :: 32 word)\"\n by (simp add: h_val_def from_bytes_ucast_isom word_size)\n\nlemma heap_update_word8:\n \"heap_update p w hp = store_word8 (ptr_val p) w hp\"\n by (simp add: heap_update_def store_word8_def to_bytes_def typ_info_word\n word_rsplit_same)\n\nlemma to_bytes_ucast_isom[OF refl]:\n \"y = ucast x\n \\ size x = size y\n \\ 8 dvd size x\n \\ to_bytes y = to_bytes x\"\n apply (rule ext)\n apply (clarsimp simp: word_size to_bytes_def typ_info_word)\n apply (rule nth_equalityI)\n apply (simp add: word_size length_word_rsplit_exp_size')\n apply (clarsimp simp: dvd_def)\n apply (rule word_eqI)\n apply (simp add: test_bit_rsplit_alt length_word_rsplit_exp_size' word_size\n nth_ucast)\n apply auto\n done\n\nlemma to_bytes_sword:\n \"to_bytes (w :: ('a :: len8) signed word)\n = to_bytes (ucast w :: 'a word)\"\n by (simp add: to_bytes_ucast_isom word_size len8_dv8)\n\nlemma heap_list_update_word32:\n \"heap_update_list addr (to_bytes w (heap_list hp' 4 addr')) hp\n = store_word32 addr w hp\"\n by (simp add: to_bytes_def store_word32_def typ_info_word)\n\nlemma heap_list_update_ptr:\n \"heap_update_list addr (to_bytes p (heap_list hp' 4 addr')) hp\n = store_word32 addr (ptr_val (p :: ('a :: c_type) ptr)) hp\"\n by (simp add: to_bytes_def store_word32_def typ_info_ptr)\n\nlemma heap_list_update_word8:\n \"heap_update_list addr (to_bytes w (heap_list hp' 1 addr')) hp\n = store_word8 addr w hp\"\n \"heap_update_list addr (to_bytes w [hp' addr']) hp\n = store_word8 addr w hp\"\n by (simp_all add: to_bytes_def store_word8_def typ_info_word word_rsplit_same)\n\nlemma field_lvalue_offset_eq:\n \"field_lookup (typ_info_t TYPE('a :: c_type)) f 0 = Some v\n \\ field_lvalue (ptr :: 'a ptr) f = ptr_val ptr + of_nat (snd v)\"\n apply (cases v, simp, drule field_lookup_offset_eq)\n apply (simp add: field_lvalue_def)\n done\n\nlemma image_fst_cart_UNIV_subset:\n \"S \\ (fst ` S) \\ UNIV\"\n by (auto elim: image_eqI[rotated])\n\nlemma simpl_to_graph_Err_cond:\n \"\\ nn = NextNode m; GGamma fname = Some gf;\n function_graph gf m = Some (node.Cond l Err Check);\n eq_impl nn eqs (\\gst sst. Check gst) (P \\ I);\n eq_impl nn eqs eqs2 (P \\ I);\n simpl_to_graph SGamma GGamma fname l com n traces P I eqs2 out_eqs \\\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule_tac i=1 and j=0 in simpl_to_graph_step_general[rotated -1])\n apply simp\n apply (simp add: exec_graph_step_image_node)\n apply (auto dest: eq_implD)\n done\n\nlemma simpl_to_graph_impossible:\n \"eq_impl nn eqs (\\_ _. False) (P \\ I)\n \\ simpl_to_graph SGamma GGamma fname nn com n traces P I eqs out_eqs\"\n apply (rule simpl_to_graphI, clarsimp)\n apply (drule(1) eq_implD, simp+)\n done\n\ndefinition\n \"asm_args_to_list enc xs m_ms\n = map VarWord32 xs @ [VarMem (fst m_ms), VarMS (enc (snd m_ms))]\"\n\ndefinition\n \"asm_rets_to_list ret enc v mem_vs\n = (if ret then [VarWord32 v] else []) @ [VarMem (fst mem_vs), VarMS (enc (snd mem_vs))]\"\n\ndefinition\n asm_fun_refines\nwhere\n \"asm_fun_refines specname ret enc len GGamma fname\n = (\\gf. GGamma fname = Some gf\n \\ distinct (function_inputs gf)\n \\ length (function_inputs gf) = len\n \\ (\\tr \\ exec_trace GGamma fname. \\inp_vs inp_mem_ms.\n exec_trace_inputs gf tr = asm_args_to_list enc inp_vs inp_mem_ms\n \\ (\\r gst.\n r \\ asm_semantics specname inp_vs inp_mem_ms\n \\ trace_end tr = Some [(Ret, gst, fname)]\n \\ acc_vars (function_outputs gf) gst = split (asm_rets_to_list ret enc) r)))\"\n\nlemma asm_args_to_list_inj:\n \"(asm_args_to_list enc vs mem_ms = asm_args_to_list enc vs' mem_ms')\n = (vs = vs' \\ fst mem_ms = fst mem_ms' \\ enc (snd mem_ms) = enc (snd mem_ms'))\"\n apply (simp add: asm_args_to_list_def)\n apply (subst inj_map_eq_map)\n apply (rule inj_onI, simp)\n apply simp\n done\n\nlemma simpl_to_graph_call_asm_fun:\n assumes graph: \"nn = NextNode m\" \"GGamma p = Some gfc\"\n \"function_graph gfc m = Some (node.Call nn' p' args rets)\"\n and rel: \"asm_fun_refines specname ret enc len GGamma p'\"\n and init: \"eq_impl nn eqs (\\gst sst. sst \\ I\n \\ map (\\i. i gst) args = asm_args_to_list enc (asm_args sst)\n (asm_fetch (globals sst))\n \\ length args = len) (I \\ P)\"\n and ret: \"eq_impl nn eqs (\\gst sst. (\\m' v' (ms' :: 'a).\n gdata (asm_store gdata (m', ms') (globals sst)) = gdata (globals sst)\n \\ (v', (m', ms')) \\ asm_semantics specname (asm_args sst) (asm_fetch (globals sst))\n \\ eqs2 (save_vals rets (asm_rets_to_list ret enc v' (m', ms')) gst)\n (asm_ret v' (globals_update (asm_store gdata (m', ms')) sst))\n \\ asm_ret v' (globals_update (asm_store gdata (m', ms')) sst) \\ I)) I\"\n and cont: \"simpl_to_graph SGamma GGamma p nn' (add_cont com.Skip con) n tS UNIV I eqs2 out_eqs\"\n shows \"simpl_to_graph SGamma GGamma p nn\n (add_cont (Spec (asm_spec (ti :: 'a itself) gdata vol specname asm_ret asm_args)) con)\n n tS P I eqs out_eqs\"\n apply (rule simpl_to_graph_name_simpl_state)\n apply (clarsimp simp: graph intro!: simpl_to_graphI)\n apply (frule init[THEN eq_implD], simp+)\n apply (cut_tac rel, clarsimp simp: asm_fun_refines_def)\n apply (frule exec_trace_drop_n, (rule graph | assumption)+)\n apply (drule(1) bspec)\n apply (clarsimp simp: exec_trace_inputs_def graph)\n apply (subst(asm) trace_drop_n_init, (assumption | rule graph)+)\n apply (clarsimp simp: init_vars_def)\n apply (subst(asm) fetch_returned, simp_all)\n apply (drule arg_cong[where f=length])+\n apply simp\n apply (simp add: asm_args_to_list_inj)\n apply (drule spec, drule mp, rule refl)\n apply clarsimp\n apply (frule trace_drop_n_end, (assumption | rule graph)+)\n apply clarsimp\n apply (frule(1) c_trace_may_extend_steps)\n apply (rule add_cont_steps)\n apply (rule exec_impl_steps_Normal)\n apply (rule exec.Spec)\n apply (simp add: asm_spec_def)\n apply (erule rev_bexI)\n apply simp\n apply simp\n apply clarsimp\n apply (frule ret[THEN eq_implD], simp)\n apply (cut_tac tr=tr and tr'=trace' and n''=\"n'' + ja\"\n and sst=\"asm_ret a b\" for a b in simpl_to_graphD[OF cont])\n apply (auto simp: return_vars_def asm_store_eq)[1]\n apply (metis restrict_map_eq_mono[OF le_add1])\n done\n\nlemma take_1_drop:\n \"n < length xs \\ take (Suc 0) (drop n xs) = [xs ! n]\"\n apply (cases \"drop n xs\")\n apply simp\n apply (clarsimp dest!: nth_via_drop)\n done\n\nlemma ptr_safe_field:\n \"\\ ptr_safe (p :: ('a :: mem_type) ptr) d; field_ti TYPE('a) f = Some t;\n export_uinfo t = typ_uinfo_t TYPE('b) \\\n \\ ptr_safe (Ptr &(p\\f) :: ('b :: mem_type) ptr) d\"\n apply (clarsimp simp: field_ti_def split: option.split_asm)\n apply (erule(2) ptr_safe_mono)\n done\n\nlemma heap_update_list_If1:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if unat (x - p) < length xs then xs ! unat (x - p) else hp x)\"\n apply (subst coerce_heap_update_to_heap_updates[where chunk = 1, OF _ refl])\n apply simp\n apply (rule ext)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: take_1_drop)\n apply (rule refl)\n apply (induct xs rule: rev_induct)\n apply simp\n apply (simp split del: if_split)\n apply (subst foldl_cong[OF refl refl])\n apply (clarsimp simp: nth_append)\n apply (rule refl)\n apply (simp add: nth_append split del: if_split cong: if_cong)\n apply (auto simp: unat_of_nat addr_card linorder_not_less less_Suc_eq\n dest: word_unat.Rep_inverse')\n done\n\nlemma heap_update_list_If2:\n \"length xs \\ addr_card\n \\ heap_update_list p xs hp\n = (\\x. if x \\ {p ..+ length xs} then xs ! unat (x - p) else hp x)\"\n apply (simp add: heap_update_list_If1)\n apply (rule ext, simp add: intvl_def)\n apply clarsimp\n apply (erule notE, erule order_le_less_trans[rotated])\n apply (simp add: unat_of_nat)\n done\n\nlemma intvl_empty2:\n \"({p ..+ n} = {}) = (n = 0)\"\n by (auto simp add: intvl_def)\n\nlemma heap_list_update_commute:\n \"{p ..+ length xs} \\ {q ..+ length ys} = {}\n \\ heap_update_list p xs (heap_update_list q ys hp)\n = heap_update_list q ys (heap_update_list p xs hp)\"\n apply (cases \"length xs \\ addr_card\")\n apply (cases \"length ys \\ addr_card\")\n apply (simp add: heap_update_list_If2)\n apply (rule ext, simp)\n apply blast\n apply (simp_all add: addr_card intvl_overflow intvl_empty2)\n done\n\nlemma is_aligned_intvl_disjoint:\n \"\\ p \\ p'; is_aligned p n; is_aligned p' n \\\n \\ {p ..+ 2 ^ n} \\ {p' ..+ 2 ^ n} = {}\"\n apply (drule(2) aligned_neq_into_no_overlap)\n apply (drule upto_intvl_eq)+\n apply (simp add: field_simps del: Int_atLeastAtMost)\n done\n\nlemma is_aligned_intvl_disjoint_offset:\n \"\\ p \\ p'; is_aligned (p - p') n \\\n \\ {p ..+ 2 ^ n} \\ {p' ..+ 2 ^ n} = {}\"\n apply (rule intvl_disj_offset[where x=\"- p'\", THEN iffD1])\n apply (rule is_aligned_intvl_disjoint)\n apply (simp_all del: word_neq_0_conv add: field_simps)\n done\n\nlemma store_store_word32_commute:\n \"\\ p \\ p'; is_aligned p 2; is_aligned p' 2 \\\n \\ store_word32 p w (store_word32 p' w' hp)\n = store_word32 p' w' (store_word32 p w hp)\"\n apply (clarsimp simp: store_word32_def)\n apply (rule heap_list_update_commute)\n apply (drule(2) is_aligned_intvl_disjoint)\n apply (simp add: length_word_rsplit_even_size[OF refl] word_size\n del: Int_atLeastAtMost)\n done\n\nlemma store_store_word32_commute_offset:\n assumes prems: \"(p - p') = n\" \"n && 3 = 0\" \"n \\ 0\"\n shows \"store_word32 p w (store_word32 p' w' hp)\n = store_word32 p' w' (store_word32 p w hp)\"\n using prems\n apply (clarsimp simp: store_word32_def)\n apply (rule heap_list_update_commute)\n apply (simp add: length_word_rsplit_even_size[OF refl] word_size)\n apply (rule is_aligned_intvl_disjoint_offset[where n=2, simplified])\n apply (simp add: field_simps word_neq_0_conv[symmetric] del: word_neq_0_conv)\n apply (simp add: field_simps is_aligned_mask mask_def)\n done\n\nlemma c_guard_to_word_ineq:\n \"c_guard (p :: ('a :: mem_type) ptr)\n = (ptr_val p && mask (align_td (typ_info_t TYPE('a))) = 0\n \\ ptr_val p \\ 0 \\ ptr_val p \\ (- of_nat (size_of TYPE('a))))\"\n using max_size[where 'a='a]\n apply (simp add: c_guard_def ptr_aligned_def align_of_def\n is_aligned_def[symmetric] is_aligned_mask\n c_null_guard_def intvl_def addr_card_def\n card_word)\n apply safe\n apply (drule_tac x=0 in spec, simp)\n apply (rule ccontr)\n apply (drule_tac x=\"unat (- ptr_val p)\" in spec)\n apply simp\n apply (simp add: Aligned.unat_minus word_le_nat_alt\n split: if_split_asm)\n apply (drule of_nat_inverse, simp+)\n apply (cut_tac 'a='a in sz_nzero, simp)\n apply (simp add: word_size unat_of_nat linorder_not_le\n linorder_not_less)\n apply (cut_tac x=\"ptr_val p\" in unat_lt2p, simp)\n apply (simp add: word_neq_0_conv[symmetric] del: word_neq_0_conv)\n apply (subgoal_tac \"ptr_val p = (- (of_nat k))\")\n apply simp\n apply (simp add: word_le_nat_alt Aligned.unat_minus split: if_split_asm)\n apply (drule of_nat_inverse, simp+)\n apply (cut_tac 'a='a in sz_nzero, simp)\n apply (simp add: word_size unat_of_nat)\n apply (simp add: sign_simps[symmetric])\n done\n\nlemma word_sless_to_less:\n \"\\ 0 <=s x; 0 <=s y \\ \\ (x 0 <=s x; 0 <=s y \\ \\ (x <=s y) = (x <= y)\"\n apply (simp add: word_sle_def word_le_def)\n apply (simp add: sint_eq_uint word_msb_sint)\n done\n\nlemma unat_ucast_less_helper:\n \"ucast x < (of_nat n :: word32) \\ unat (x :: word8) < n\"\n apply (drule unat_less_helper)\n apply (simp add: unat_ucast_8_32)\n done\n\nlemma store_load_word32:\n \"store_word32 p (load_word32 p m) m = m\"\n apply (simp add: store_word32_def load_word32_def)\n apply (rule heap_update_list_id[where n=4])\n apply (simp add: word_rsplit_rcat_size word_size)\n done\n\nlemma load_store_word32:\n \"load_word32 p (store_word32 p v m) = v\"\n using heap_list_update[where p=p and h=m and v=\"rev (word_rsplit v)\"]\n by (simp add: store_word32_def load_word32_def\n length_word_rsplit_exp_size' word_size addr_card\n word_rcat_rsplit)\n\nlemma word32_lt_bounds_reduce:\n \"\\ n \\ 0; (i \\ (n - 1)) \\ \\ (i < (n :: word32)) = (i < (n - 1))\"\n apply (rule sym, rule trans, rule less_le)\n apply simp\n apply (simp add: word_le_def word_less_def uint_sub_if')\n done\n\nlemma length_Cons: \"length (x # xs) = Suc (length xs)\"\n by simp\n\nlemma ucast_eq_0:\n \"(ucast (x :: ('a :: len) word) = (0 :: ('b :: len) word))\n = (if len_of TYPE('a) <= len_of TYPE('b)\n then x = 0 else (x && mask (len_of TYPE('b)) = 0))\"\n by (simp, fastforce intro!: word_eqI dest: word_eqD simp: nth_ucast word_size)+\n\nlemmas ucast_eq_0s = ucast_eq_0 ucast_eq_0[THEN arg_cong[where f=Not], simplified]\n\ntext {* Proof process for store_word32 equalities. *}\n\nlemma load_store_word32_offset:\n \"(p - p') AND 3 = 0\n \\ load_word32 p (store_word32 p' v hp)\n = (if p = p' then v else load_word32 p hp)\"\n using is_aligned_intvl_disjoint_offset[where p=p and p'=p' and n=2]\n apply (clarsimp simp: load_store_word32)\n apply (simp add: load_word32_def store_word32_def)\n apply (subst heap_list_update_disjoint_same, simp_all)\n apply (simp add: length_word_rsplit_exp_size' word_size\n is_aligned_mask mask_def Int_commute)\n done\n\nlemma load_word32_offset_represents:\n assumes eq: \"\\x. x AND 3 = 0 \\ load_word32 (p + x) hp = load_word32 (p + x) hp'\"\n shows \"hp = hp'\"\nproof (rule ext)\n fix x\n let ?p = \"p + ((x - p) AND ~~ 3)\"\n have X: \"\\hp v. store_word32 ?p v hp x = rev (word_rsplit v) ! unat ((x - p) AND 3)\"\n apply (simp add: store_word32_def\n mask_out_sub_mask[where n=2 and 'a=32, unfolded mask_def, simplified])\n apply (subst heap_update_mem_same_point, simp_all add: field_simps\n length_word_rsplit_exp_size' word_size addr_card)\n apply (simp add: intvl_def)\n apply (rule_tac x=\"unat ((x - p) && 3)\" in exI)\n apply (simp add: algebra_simps unat_mask_2_less_4[unfolded mask_def, simplified])\n done\n have \"hp x = (store_word32 ?p (load_word32 ?p hp) hp) x\"\n by (simp add: store_load_word32)\n also have \"\\ = (store_word32 ?p (load_word32 ?p hp') hp') x\"\n by (simp only: X, simp add: eq word_bw_assocs)\n also have \"\\ = hp' x\"\n by (simp add: store_load_word32)\n finally show \"hp x = hp' x\" .\nqed\n\ndefinition\n \"apply_store_word32 p = (\\(offs, w) hp. if offs AND 3 = 0\n then store_word32 (p + offs) w hp else hp)\"\n\ndefinition\n store_word32s_equality :: \"word32 \\ (word32 \\ word32) list\n \\ (word32 \\ word32) list \\ (word32 \\ word8) \\ (word32 \\ word8) \\ bool\"\nwhere\n \"store_word32s_equality p xs ys hp hp' \\ \n fold (apply_store_word32 p) xs hp = fold (apply_store_word32 p) ys hp'\"\n\nlemma store_word32s_equality_fold: \n \"p' - p AND 3 = 0 \\\n (store_word32 p w hp = store_word32 p' w' hp')\n = store_word32s_equality p [(0, w)] [(p' - p, w')] hp hp'\"\n \"p' - p AND 3 = 0 \\\n store_word32s_equality p xs ys (store_word32 p' w' hp) hp'\n = store_word32s_equality p ((p' - p, w') # xs) ys hp hp'\" \n \"p' - p AND 3 = 0 \\\n store_word32s_equality p xs ys hp (store_word32 p' w' hp')\n = store_word32s_equality p xs ((p' - p, w') # ys) hp hp'\"\n by (simp_all add: store_word32s_equality_def apply_store_word32_def\n split_def)\n\nlemma and_3_eq_0_subtract:\n \"x AND 3 = 0 \\ (y :: ('a :: len) word) AND 3 = 0 \\ (x - y) AND 3 = 0\"\n apply (rule trans, rule mask_eqs[symmetric, where n=2, unfolded mask_def, simplified])\n apply simp\n apply (simp add: mask_eqs[symmetric, where n=2, unfolded mask_def, simplified])\n done\n\nlemma load_apply_store_word32:\n \"x AND 3 = 0 \\ load_word32 (p + x) (apply_store_word32 p y hp)\n = (if x = fst y then snd y else load_word32 (p + x) hp)\"\n apply (simp add: apply_store_word32_def split_def\n load_store_word32_offset)\n apply (simp add: load_store_word32_offset field_simps and_3_eq_0_subtract)\n apply auto\n done\n\nlemma load_fold_filter_apply_store_word32:\n \"x AND 3 = 0\n \\ load_word32 (p + x) (fold (apply_store_word32 p) (filter (P \\ fst) ys) hp)\n = load_word32 (p + x) (if P x then fold (apply_store_word32 p) ys hp else hp)\"\n apply (induct ys rule: rev_induct)\n apply simp\n apply (auto simp add: load_apply_store_word32)\n done\n\nlemma store_word32s_equality_split:\n \"store_word32s_equality p xs ys hp hp\n = (store_word32s_equality p (filter (P o fst) xs) (filter (P o fst) ys) hp hp\n \\ store_word32s_equality p (filter (Not o P o fst) xs) (filter (Not o P o fst) ys) hp hp)\"\n apply (simp add: store_word32s_equality_def)\n apply (safe intro!: load_word32_offset_represents[where p=p])\n apply (simp_all add: load_fold_filter_apply_store_word32)\n apply (drule_tac f=\"load_word32 (p + x)\" in arg_cong)+\n apply (simp add: load_fold_filter_apply_store_word32 split: if_split_asm)\n done\n\nlemma apply_store_word32_over_store:\n \"apply_store_word32 p (x, v') (apply_store_word32 p (x, v) hp)\n = apply_store_word32 p (x, v') hp\"\n by (clarsimp simp: load_apply_store_word32\n intro!: load_word32_offset_represents[where p=p])\n\nlemma apply_store_load_word32:\n \"apply_store_word32 p (x, load_word32 (p + x) hp) hp = hp\"\n by (clarsimp simp: load_apply_store_word32\n intro!: load_word32_offset_represents[where p=p])\n\nlemma store_word32s_equality_final:\n \"store_word32s_equality p ((x, v) # (x, v') # xs) ys hp hp'\n = store_word32s_equality p ((x, v') # xs) ys hp hp'\"\n \"store_word32s_equality p xs ((y, v) # (y, v') # ys) hp hp'\n = store_word32s_equality p xs ((y, v') # ys) hp hp'\"\n \"store_word32s_equality p [(x, v)] [(x, v')] hp hp\n = (x AND 3 = 0 \\ v = v')\"\n \"store_word32s_equality p [(x, v)] [] hp hp\n = (x AND 3 = 0 \\ v = load_word32 (p + x) hp)\"\n \"store_word32s_equality p [] [(x, v')] hp hp\n = (x AND 3 = 0 \\ v' = load_word32 (p + x) hp)\"\n apply (auto simp add: store_word32s_equality_def\n apply_store_word32_over_store\n load_apply_store_word32\n apply_store_load_word32\n dest: arg_cong[where f=\"load_word32 (p + x)\"]\n split: if_split_asm simp del: word_neq_0_conv)\n apply (simp_all add: apply_store_word32_def del: word_neq_0_conv)\n done\n\n\n\nML {*\n\nval dest_word = HOLogic.dest_number\n #> snd #> (fn x => x mod 4294967296)\n\nval trace_store_word32s = ref false\n\nfun store_word32_trace s v = if ! trace_store_word32s\n then (tracing (\"store_word32s: \" ^ s); v) else v\n\nval store_word32s_equality_simproc =\n let\n val lhss = [@{term \"store_word32s_equality p xs ys hp hp\"}]\n fun proc _ ctxt ctm =\n case Thm.term_of ctm of (Const (@{const_name store_word32s_equality}, _)\n $ _ $ xs $ ys $ hp $ hp') => (let\n val _ = (hp aconv hp') orelse raise TERM (\"foo\", [])\n val xs = HOLogic.dest_list xs\n |> map (HOLogic.dest_prod #> fst #> dest_word)\n val ys = HOLogic.dest_list ys\n |> map (HOLogic.dest_prod #> fst #> dest_word)\n val zs = sort int_ord (xs @ ys)\n val _ = (not (null zs) andalso hd zs < List.last zs)\n orelse raise TERM (\"foo\", [])\n val pivot = nth zs (length zs div 2)\n val pred = (if pivot = List.last zs\n then @{term \"op = :: word32 \\ _\"}\n else @{term \"op \\ :: word32 \\ _\"})\n $ HOLogic.mk_number @{typ word32} pivot\n in store_word32_trace \"success\" (SOME (infer_instantiate\n ctxt [((\"P\",0), Thm.cterm_of ctxt pred)]\n @{thm store_word32s_equality_split}\n |> mk_meta_eq))\n end handle TERM _ => store_word32_trace \"failed\" NONE)\n | _ => store_word32_trace \"mismatch\" NONE\n in\n Simplifier.make_simproc\n (Proof_Context.init_global @{theory})\n \"store_word32s_equality_simproc\"\n {lhss = lhss, proc = proc}\n end\n\n*}\n\nML {*\n\nstructure SimplToGraphProof = struct\n\nfun mk_ptr_val_app p =\n Const (@{const_name ptr_val}, fastype_of p --> @{typ word32}) $ p\n\nval globals_swap = ref (fn (x : term) => x)\n\nfun mk_arr_idx arr i = let\n val arrT = fastype_of arr\n val elT = case arrT of Type (@{type_name \"array\"}, [elT, _])\n => elT | _ => raise TYPE (\"mk_arr_idx\", [arrT], [arr])\n in Const (@{const_name \"Arrays.index\"}, arrT --> @{typ nat} --> elT)\n $ arr $ i\n end\n\nval gammaT_to_stateT = strip_type #> snd\n #> dest_Type #> snd #> the_single\n #> dest_Type #> snd #> hd\n\nfun mk_simpl_acc ctxt sT nm = let\n val sst = Free (\"sst\", sT)\n val globals_sst = Syntax.read_term ctxt \"globals :: globals myvars \\ _\"\n $ sst\n val _ = type_of globals_sst (* does type checking *)\n\n val t_hrs = Syntax.read_term ctxt \"t_hrs_' :: globals \\ _\"\n val pms = Syntax.read_term ctxt \"phantom_machine_state_' :: globals \\ _\"\n val pms_encode = Syntax.read_term ctxt \"encode_machine_state\"\n fun do_pms_encode t = case pms_encode of Const _ => pms_encode $ t\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [t])\n\n val ghost_assns_fetch = Syntax.read_term ctxt \"ghost_assns_from_globals\"\n fun get_ghost_assns_fetch () = case head_of ghost_assns_fetch of Const _ => ghost_assns_fetch\n | _ => raise TERM (\"mk_simpl_acc: requires `ghost_assns_from_globals :: globals => word64 => word32\", [])\n\n fun mk_sst_acc \"Mem\" = @{term hrs_mem} $ (t_hrs $ ((! globals_swap) globals_sst))\n | mk_sst_acc \"HTD\" = @{term hrs_htd} $ (t_hrs $ globals_sst)\n | mk_sst_acc \"PMS\" = do_pms_encode (pms $ globals_sst)\n | mk_sst_acc \"GhostAssertions\" = get_ghost_assns_fetch () $ globals_sst\n | mk_sst_acc nm = if String.isPrefix \"rv#space#\" nm\n then mk_sst_acc (unprefix \"rv#space#\" nm)\n else if String.isSuffix \"#v\" nm\n then Syntax.read_term ctxt\n (suffix \"_'\" (unsuffix \"#v\" nm) ^ \" :: globals myvars => _\") $ sst\n else let\n val (head, tail) = Library.space_explode \".\" nm\n |> Library.split_last |> apfst (Library.space_implode \".\")\n val acc = mk_sst_acc head\n val typ_nm = fastype_of acc |> dest_Type |> fst\n val acc2 = if typ_nm = \"Arrays.array\"\n then mk_arr_idx acc (HOLogic.mk_number @{typ nat}\n (ParseGraph.parse_int tail))\n else Proof_Context.read_const {proper = true, strict = true}\n ctxt (typ_nm ^ \".\" ^ tail) $ acc\n in acc2 end\n fun mk_sst_acc2 nm = let\n val acc = mk_sst_acc nm\n val T = fastype_of acc |> dest_Type |> fst\n in if T = @{type_name ptr} then mk_ptr_val_app acc else acc end\n in Term.lambda sst (ParseGraph.mk_var_term (mk_sst_acc2 nm)) end\n\nfun foldr1_default _ v [] = v\n | foldr1_default f _ xs = foldr1 f xs\n\ndatatype hints = Hints of { deps: (string * term) list Inttab.table,\n hint_tactics: (Proof.context -> int -> tactic) Inttab.table,\n err_conds: Inttab.set }\n\nfun mk_graph_eqs Gamma (Hints hints) nm n = let\n val vs = case (Inttab.lookup (#deps hints) n) of\n SOME vs => vs\n | NONE => raise TERM (\"mk_graph_eqs: \" ^ nm ^ \" \" ^ string_of_int n, []) \n val sT = gammaT_to_stateT (fastype_of Gamma)\n val sst = Free (\"sst\", sT)\n\n val gst = @{term \"gst :: GraphLang.state\"}\n\n fun mk_eq (nm, acc) = HOLogic.mk_eq (@{term var_acc} $ HOLogic.mk_string nm $ gst,\n betapply (acc, sst))\n val eqs = map mk_eq vs\n in Term.lambda gst (Term.lambda sst\n (foldr1_default HOLogic.mk_conj @{term True} eqs)) end\n\nfun with_cache cache termfun tracer t = case Termtab.lookup (! cache) t\n of SOME v => v\n | NONE => let val v = termfun t\n in tracer t v; cache := Termtab.insert (K false) (t, v) (! cache); v end\n\nfun dest_nat (@{term Suc} $ n) = dest_nat n + 1\n | dest_nat (@{term \"0 :: nat\"}) = 0\n | dest_nat n = HOLogic.dest_number n |> snd\n\nfun simpl_to_graph_skel hints nm (Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ _ $ trS $ P $ I $ _ $ out_eqs)\n = Const (@{const_name simpl_to_graph}, T)\n $ SG $ GG $ gfname $ (@{term NextNode} $ nn) $ com\n $ @{term \"n :: nat\"} $ Free (\"trS\", fastype_of trS)\n $ P $ I $ mk_graph_eqs SG hints nm (dest_nat nn) $ out_eqs\n | simpl_to_graph_skel _ _ t = raise TERM (\"simpl_to_graph_skel\", [t])\n\nfun simpl_to_graph_nn (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ (@{term NextNode} $ nn) $ _\n $ _ $ _ $ _ $ _ $ _ $ _)\n = dest_nat nn\n | simpl_to_graph_nn t = raise TERM (\"simpl_to_graph_nn\", [t])\n\nfun SUBGOAL tfun i t = Tactical.SUBGOAL tfun i t\n handle TYPE (s, tps, ts) => raise TYPE (\"SUBGOAL \" ^ s,\n tps, [Thm.cprem_of t i |> Thm.term_of] @ ts)\n\nval standard_GG = @{term \"GG :: string \\ graph_function option\"}\n\nfun graph_gamma_tac ctxt = SUBGOAL (fn (t, i) => let\n val (lhs, _) = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t)) |> HOLogic.dest_eq\n val _ = (head_of lhs = standard_GG andalso length (snd (strip_comb lhs)) = 1)\n orelse raise TERM (\"GG lhs\", [])\n val nm = the_single (snd (strip_comb lhs)) |> HOLogic.dest_string\n |> Long_Name.base_name\n val gfun = Syntax.read_term ctxt (nm ^ \"_graph_fun\")\n val gfun_def = Proof_Context.get_thm ctxt (nm ^ \"_graph_fun_def\")\n val _ = dest_Const (head_of gfun)\n val GG_assum = HOLogic.mk_eq\n (lhs, @{term \"Some :: graph_function \\ _\"} $ gfun)\n |> HOLogic.mk_Trueprop |> Thm.cterm_of ctxt |> Thm.assume\n |> simplify (put_simpset HOL_basic_ss ctxt addsimps [gfun_def])\n in resolve0_tac [GG_assum] i end\n handle TERM (s, ts) => raise TERM (\"graph_gamma_tac: \" ^ s, t :: ts))\n\nfun inst_graph_node_tac ctxt =\n simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms function_graph.simps})\n THEN' SUBGOAL (fn (t, i) => case\n HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n of @{term \"op = :: node option \\ _\"} $ (f $ n) $ _ => (let\n val g = head_of f |> dest_Const |> fst\n val n' = dest_nat n\n val thm = Proof_Context.get_thm ctxt\n (Long_Name.base_name g ^ \"_\" ^ Int.toString n')\n val thm = if n = @{term \"Suc 0\"}\n then simplify (put_simpset HOL_basic_ss ctxt addsimps @{thms One_nat_def}) thm\n else thm\n in resolve0_tac [thm] i end handle TERM (s, ts) => raise TERM (\"inst_graph_node_tac: \" ^ s, t :: ts))\n | t => raise TERM (\"inst_graph_node_tac\", [t]))\n\nfun inst_graph_tac ctxt = graph_gamma_tac ctxt THEN' inst_graph_node_tac ctxt\n\nfun mk_graph_refines (funs : ParseGraph.funs) ctxt s = let\n val proc = Syntax.read_term ctxt\n (Long_Name.base_name s ^ \"_'proc\")\n val gamma = Syntax.read_term ctxt \"\\\"\n val invs = Syntax.read_term ctxt \"simpl_invariant\"\n val _ = case head_of invs of Const _ => ()\n | _ => raise TERM (\"mk_graph_refines: requires simpl_invariant constant\", [])\n val sT = fastype_of gamma |> gammaT_to_stateT\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val inputs = map (mk_simpl_acc ctxt sT) xs\n |> HOLogic.mk_list (sT --> @{typ variable})\n val outputs = map (mk_simpl_acc ctxt sT) ys\n |> HOLogic.mk_list (sT --> @{typ variable})\n in HOLogic.mk_Trueprop (Const (@{const_name graph_fun_refines}, [fastype_of gamma,\n @{typ \"string \\ graph_function option\"}, fastype_of invs,\n fastype_of inputs, fastype_of proc, fastype_of outputs,\n @{typ string}] ---> @{typ bool})\n $ gamma $ standard_GG $ invs $ inputs $ proc $ outputs\n $ HOLogic.mk_string s)\n end\n\nfun asm_spec_name_to_fn_name _ specname = let\n val name = space_implode \"_\" (space_explode \" \" specname)\n in \"asm_instruction'\" ^ name end\n\nfun mk_asm_refines (funs : ParseGraph.funs) ctxt specname = let\n val s = asm_spec_name_to_fn_name true specname\n val (xs, ys, _) = Symtab.lookup funs s |> the\n val enc = Syntax.read_term ctxt \"encode_machine_state\"\n val _ = case enc of Const _ => ()\n | _ => raise TERM (\"mk_simpl_acc: requires `encode_machine_state :: machine_state => unit \\ nat'\", [])\n in HOLogic.mk_Trueprop (Const (@{const_name asm_fun_refines},\n [@{typ string}, @{typ bool}, fastype_of enc, @{typ nat},\n fastype_of standard_GG, @{typ string}] ---> @{typ bool})\n $ HOLogic.mk_string specname\n $ (if (length ys > 2) then @{term True} else @{term False})\n $ enc\n $ HOLogic.mk_number @{typ nat} (length xs)\n $ standard_GG $ HOLogic.mk_string s)\n end\n\nfun apply_graph_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name graph_fun_refines}, _)\n $ _ $ _ $ _ $ _ $ _ $ _ $ s)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_graph_refines funs ctxt (HOLogic.dest_string s)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_asm_refines_ex_tac funs ctxt = SUBGOAL (fn (t, i) => case\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)) of\n @{term Trueprop} $ (Const (@{const_name asm_fun_refines}, _)\n $ specname $ _ $ _ $ _ $ _ $ _)\n => (resolve0_tac [Thm.assume (Thm.cterm_of ctxt\n (mk_asm_refines funs ctxt (HOLogic.dest_string specname)))] i)\n | _ => raise TERM (\"apply_graph_refines_ex_tac\", [t]))\n\nfun apply_impl_thm ctxt = SUBGOAL (fn (t, i) => case\n Logic.strip_assums_concl (Envir.beta_eta_contract t)\n of @{term Trueprop} $ (Const (@{const_name HOL.eq}, _)\n $ (_ $ Const (s, _)) $ (Const (@{const_name Some}, _) $ _))\n => resolve0_tac [Proof_Context.get_thm ctxt\n (suffix \"_impl\" (unsuffix \"_'proc\" (Long_Name.base_name s)))] i\n | _ => no_tac)\n\nfun get_Call_args (Const (@{const_name com.Call}, _) $ x) = [x]\n | get_Call_args (f $ x) = get_Call_args f @ get_Call_args x\n | get_Call_args (Abs (_, _, t)) = get_Call_args t\n | get_Call_args _ = []\n\nfun apply_modifies_thm ctxt = SUBGOAL (fn (t, i) => case\n get_Call_args (Envir.beta_eta_contract t)\n of [Const (s, _)] => let\n val s = unsuffix \"_'proc\" (Long_Name.base_name s)\n val thms = (@{thm disjI1}, Proof_Context.get_thm ctxt (s ^ \"_modifies\"))\n handle ERROR _ => (@{thm disjI2}, @{thm refl})\n in resolve0_tac [fst thms] i THEN resolve0_tac [snd thms] i end\n | _ => no_tac)\n\nfun is_safe_eq_impl (p as (@{term Trueprop}\n $ (Const (@{const_name \"eq_impl\"}, _) $ _ $ _ $ _ $ _)))\n = not (exists_subterm (fn Var _ => true | Free (\"n\", _) => true\n | _ => false) p)\n | is_safe_eq_impl _ = false\n\nfun eq_impl_assume_tac ctxt = DETERM o SUBGOAL (fn (t, i) => let\n val p = Logic.strip_assums_concl (Envir.beta_eta_contract t)\n in if is_safe_eq_impl p\n then resolve0_tac [Thm.assume (Thm.cterm_of ctxt p)] i\n else no_tac\n end)\n\nfun is_pglobal_valid_conjs (Const (@{const_name conj}, _) $ p $ q)\n = is_pglobal_valid_conjs p andalso is_pglobal_valid_conjs q\n | is_pglobal_valid_conjs (Const (@{const_name \"pglobal_valid\"}, _) $ _ $ _ $ _)\n = true\n | is_pglobal_valid_conjs _ = false\n\nfun simpl_ss ctxt = put_simpset HOL_basic_ss ctxt\n addsimps @{thms switch.simps fst_conv snd_conv\n length_Cons singletonI triv_forall_equality\n simpl_to_graph_Seq simpl_to_graph_Catch\n}\n\nval immediates = @{thms\n simpl_to_graph_Skip_immediate simpl_to_graph_Throw_immediate}\n \nfun except_tac ctxt msg = SUBGOAL (fn (t, _) => let\n in warning msg; Syntax.pretty_term ctxt t |> Pretty.writeln;\n raise TERM (msg, [t]) end)\n\nfun apply_hint_thm ctxt (Hints hints) = SUBGOAL (fn (t, i) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#hint_tactics hints) nn\n of SOME tac => tac ctxt i\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun check_err_cond_tac (Hints hints) = SUBGOAL (fn (t, _) => let\n val nn = Logic.strip_assums_concl t |> Envir.beta_eta_contract\n |> HOLogic.dest_Trueprop |> simpl_to_graph_nn\n in case Inttab.lookup (#err_conds hints) nn\n of SOME () => all_tac\n | NONE => no_tac end\n handle TERM _ => no_tac)\n\nfun apply_simpl_to_graph_tac funs hints ctxt =\n simp_tac (simpl_ss ctxt\n addsimps @{thms One_nat_def whileAnno_def\n creturn_def[folded creturn_void_def]})\n THEN' DETERM o (FIRST' [\n apply_hint_thm ctxt hints,\n resolve0_tac [@{thm simpl_to_graph_Basic_triv}],\n resolve_tac ctxt @{thms simpl_to_graph_lvar_nondet_init\n simpl_to_graph_Skip\n simpl_to_graph_Throw\n simpl_to_graph_cbreak\n simpl_to_graph_creturn_void},\n resolve_tac ctxt @{thms\n simpl_to_graph_ccatchbrk_Break\n simpl_to_graph_ccatchbrk_Return}\n THEN' (simp_tac ctxt\n THEN_ALL_NEW except_tac ctxt\n \"apply_simpl_to_graph_tac: exn eq unsolved\"),\n resolve0_tac [@{thm simpl_to_graph_Guard[OF refl]}],\n check_err_cond_tac hints\n THEN' resolve0_tac [@{thm simpl_to_graph_Err_cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Cond[OF refl]}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_Basic}]\n THEN' inst_graph_tac ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_triv[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_known_guard[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' inst_graph_tac ctxt\n THEN' apply_graph_refines_ex_tac funs ctxt\n THEN' apply_modifies_thm ctxt,\n resolve0_tac [@{thm simpl_to_graph_call_asm_fun[OF refl]}]\n THEN' inst_graph_tac ctxt\n THEN' apply_asm_refines_ex_tac funs ctxt,\n resolve0_tac [@{thm simpl_to_graph_nearly_done}]\n THEN' inst_graph_tac ctxt\n ] THEN_ALL_NEW (TRY o REPEAT_ALL_NEW\n (resolve_tac ctxt immediates)))\n\nfun trace_cache _ (SOME thm) = tracing\n (\"Adding thm to cache with \" ^ string_of_int (Thm.nprems_of thm) ^ \" prems.\")\n | trace_cache _ NONE = tracing \"Adding NONE to cache.\"\n\nfun simpl_to_graph_cache_tac funs hints cache nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN_ALL_NEW DETERM o FIRST' [\n SUBGOAL (fn (t, i) => (case\n with_cache cache (mk_simpl_to_graph_thm funs hints cache nm ctxt) (K (K ()))\n (simpl_to_graph_skel hints nm (HOLogic.dest_Trueprop\n (Logic.strip_assums_concl (Envir.beta_eta_contract t)))) of\n SOME thm => resolve0_tac [thm] i | _ => no_tac)\n handle TERM _ => no_tac),\n resolve_tac ctxt @{thms simpl_to_graph_done2\n simpl_to_graph_Skip_immediate[where nn=Ret]\n simpl_to_graph_Throw_immediate[where nn=Ret]\n simpl_to_graph_creturn_void2},\n eq_impl_assume_tac ctxt\n ]\n\nand mk_simpl_to_graph_thm funs hints cache nm ctxt tm = let\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop tm)\n in Thm.trivial ct\n |> (apply_simpl_to_graph_tac funs hints ctxt\n THEN_ALL_NEW (TRY o simpl_to_graph_cache_tac funs hints cache nm ctxt)\n THEN_ALL_NEW (TRY o eq_impl_assume_tac ctxt)) 1\n |> Seq.hd\n |> Drule.generalize ([], [\"n\", \"trS\"])\n |> SOME\n end handle TERM (s, _) => (tracing (\"mk_simpl_to_graph_thm: \" ^ s); NONE)\n | Empty => (tracing \"mk_simpl_to_graph_thm: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt tm |> Pretty.string_of);\n NONE)\n | Option => NONE\n\nfun dest_next_node (@{term NextNode} $ n)\n = dest_nat n\n | dest_next_node @{term Ret} = ~1\n | dest_next_node @{term Err} = ~2\n | dest_next_node t = raise TERM (\"dest_next_node\", [t])\n\nfun get_while (Const (@{const_name simpl_to_graph}, _)\n $ _ $ _ $ _ $ nn\n $ (Const (@{const_name add_cont}, _) $ (Const (@{const_name While}, _) $ C $ c) $ _)\n $ _ $ _ $ _ $ _ $ _ $ _)\n = (dest_next_node nn, C, c)\n | get_while t = raise TERM (\"get_while\", [t])\n\nfun check_while_assums t = let\n val hyps = Logic.strip_assums_hyp t\n |> filter (fn (@{term Trueprop} $ (@{term \"All :: (nat => _) => _\"} $ _))\n => true | _ => false)\n in length hyps < 2 orelse raise TERM (\"check_while_assums: too many\", []);\n () end\n\nfun get_while_body_guard C c = case c of\n Const (@{const_name com.Seq}, _) $ _ $ last => let\n val setT = fastype_of C\n fun mk_int (x, y) = Const (fst (dest_Const @{term \"op Int\"}),\n setT --> setT --> setT) $ x $ y\n fun build_guard (Const (@{const_name Guard}, _) $ _ $ G\n $ Const (@{const_name com.Skip}, _))\n = G\n | build_guard (Const (@{const_name Guard}, _) $ _ $ G $ c)\n = mk_int (G, build_guard c)\n | build_guard _ = error \"\"\n val G = case try build_guard last of SOME G => G\n | NONE => Const (fst (dest_Const @{term \"UNIV\"}), setT)\n in G end\n | _ => Const (fst (dest_Const @{term \"UNIV\"}), fastype_of C)\n\nfun simpl_to_graph_While_tac hints nm ctxt =\n simp_tac (simpl_ss ctxt)\n THEN' SUBGOAL (fn (t, i) => let\n val t = HOLogic.dest_Trueprop (Logic.strip_assums_concl\n (Envir.beta_eta_contract t))\n val (_, Cond, body) = get_while t\n val gd = get_while_body_guard Cond body\n val skel = simpl_to_graph_skel hints nm t\n val ct = Thm.cterm_of ctxt (HOLogic.mk_Trueprop skel)\n val rl_inst = infer_instantiate ctxt [((\"G\",0), Thm.cterm_of ctxt gd)]\n @{thm simpl_to_graph_While_inst}\n in\n resolve_tac ctxt [Thm.trivial ct |> Drule.generalize ([], [\"n\", \"trS\"])] i\n THEN resolve_tac ctxt [rl_inst] i\n THEN resolve_tac ctxt @{thms refl} i\n THEN inst_graph_tac ctxt i\n end handle TERM _ => no_tac)\n\nfun trace_fail_tac ctxt s = SUBGOAL (fn (t, _) =>\n (Syntax.pretty_term ctxt t |> Pretty.string_of\n |> prefix (\"Tactic \" ^ s ^ \" failed on: \") |> tracing;\n no_tac))\n\nfun trace_fail_tac2 _ = K no_tac\n\nfun simpl_to_graph_tac funs hints nm ctxt = let\n val cache = ref (Termtab.empty)\n in REPEAT_ALL_NEW (DETERM o (full_simp_tac (simpl_ss ctxt) THEN_ALL_NEW\n SUBGOAL (fn (t, i) => fn thm =>\n ((simpl_to_graph_cache_tac funs hints cache nm ctxt\n ORELSE' (eresolve0_tac [@{thm use_simpl_to_graph_While_assum}]\n THEN' simp_tac ctxt)\n ORELSE' simpl_to_graph_While_tac hints nm ctxt\n ORELSE' trace_fail_tac ctxt \"simpl_to_graph_tac\") i thm\n handle Empty => (tracing \"simpl_to_graph_tac: raised Empty on:\";\n tracing (Syntax.pretty_term ctxt t |> Pretty.string_of);\n Seq.empty)))\n ))\n end\n\nfun get_conts (@{term node.Basic} $ nn $ _) = [nn]\n | get_conts (@{term node.Cond} $ l $ _ $ Abs (_, _, @{term True})) = [l]\n | get_conts (@{term node.Cond} $ _ $ r $ Abs (_, _, @{term False})) = [r]\n | get_conts (@{term node.Cond} $ l $ r $ _) = [l, r]\n | get_conts (@{term node.Call} $ nn $ _ $ _ $ _) = [nn]\n | get_conts n = raise TERM (\"get_conts\", [n])\n\nfun get_rvals (Abs (_, _, t)) = let\n fun inner (Const _ $ (s as (@{term \"op # :: char \\ _\"} $ _ $ _)) $ Bound 0)\n = [HOLogic.dest_string s]\n | inner (f $ x) = inner f @ inner x\n | inner (Const _) = []\n | inner (Free (\"symbol_table\", _)) = []\n | inner t = raise TERM (\"get_rvals\", [t])\n in inner t end\n | get_rvals t = raise TERM (\"get_rvals\", [t])\n\nfun flip f x y = f y x\n\nfun get_lvals_rvals (@{term node.Basic} $ _ $ upds) = let\n val (lvs, rvs) = HOLogic.dest_list upds |> map_split HOLogic.dest_prod\n in (map HOLogic.dest_string lvs, maps get_rvals rvs) end\n | get_lvals_rvals (@{term node.Cond} $ _ $ _ $ cond) = ([], get_rvals cond)\n | get_lvals_rvals (@{term node.Call} $ _ $ _ $ args $ rets)\n = (HOLogic.dest_list rets |> map HOLogic.dest_string,\n HOLogic.dest_list args |> maps get_rvals)\n | get_lvals_rvals n = raise TERM (\"get_conts\", [n])\n\nfun get_var_deps nodes ep outputs = let\n fun forward tab (point :: points) = if point < 0\n then forward tab points\n else let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val upds = filter_out (Inttab.lookup_list tab #>\n flip (Ord_List.member int_ord) point) conts\n val tab = fold (fn c => Inttab.map_default (c, [])\n (Ord_List.insert int_ord point)) conts tab\n in forward tab (upds @ points) end\n | forward tab [] = tab\n val preds = forward (Inttab.make [(ep, [])]) [ep]\n fun backward tab (point :: points) = let\n val node = Inttab.lookup nodes point |> the\n val conts = map dest_next_node (get_conts node)\n val (lvs, rvs) = get_lvals_rvals node\n |> apply2 (Ord_List.make string_ord)\n val cont_vars = maps (Inttab.lookup_list tab) conts\n |> Ord_List.make string_ord\n val vars = Ord_List.merge string_ord (rvs,\n Ord_List.subtract string_ord lvs cont_vars)\n val prev_vars = Inttab.lookup tab point\n val tab = Inttab.update (point, vars) tab\n val upds = if prev_vars <> SOME vars\n then Inttab.lookup_list preds point else []\n in backward tab (upds @ points) end\n | backward tab [] = tab\n val deps = backward (Inttab.make [(~1, outputs), (~2, [])])\n (maps (Inttab.lookup_list preds) [~1, ~2])\n in (preds, deps) end\n\nfun get_loop_var_upd_nodes nodes = \n nodes\n |> filter (snd #> (fn (@{term Basic} $ _ $ _) => true | _ => false))\n |> filter (snd #> get_lvals_rvals #> fst\n #> (fn xs => not (null xs) andalso forall (String.isSuffix \"#count\") xs))\n |> map fst\n\nfun get_err_conds nodes =\n nodes\n |> filter (snd #> (fn (@{term Cond} $ _ $ @{term Err} $ _) => true | _ => false))\n |> map fst\n\nfun mk_hints (funs : ParseGraph.funs) ctxt nm = case Symtab.lookup funs nm of\n NONE => raise TERM (\"mk_var_deps_hints: miss \" ^ nm, [])\n | SOME (_, _, NONE) => Hints {deps = Inttab.empty, hint_tactics = Inttab.empty,\n err_conds = Inttab.empty}\n | SOME (_, outputs, SOME (ep, nodes, _)) => let\n val sT = Syntax.read_typ ctxt \"globals myvars\"\n val deps = snd (get_var_deps (Inttab.make nodes) ep outputs)\n |> Inttab.map (K (filter_out (fn s => String.isSuffix \"#count\" s)\n #> map (fn s => (s, mk_simpl_acc ctxt sT s))))\n val no_deps_nodes = map fst nodes\n |> filter_out (Inttab.defined deps)\n val all_deps = Inttab.join (fn _ => error \"mk_hints\")\n (deps, Inttab.make (map (rpair []) no_deps_nodes))\n val no_deps_tacs = no_deps_nodes\n |> map (rpair (K (resolve0_tac [@{thm simpl_to_graph_impossible}])))\n val loop_tacs = get_loop_var_upd_nodes nodes\n |> map (rpair (fn ctxt => resolve0_tac [@{thm simpl_to_graph_noop_Basic}]\n THEN' inst_graph_tac ctxt))\n val all_tacs = Inttab.make (no_deps_tacs @ loop_tacs)\n val ec = get_err_conds nodes |> Inttab.make_set\n in Hints {deps = all_deps,\n hint_tactics = all_tacs,\n err_conds = ec} end\n\nfun init_graph_refines_proof funs nm ctxt = let\n val body_thm = Proof_Context.get_thm ctxt\n (Long_Name.base_name nm ^ \"_body_def\")\n val ct = mk_graph_refines funs ctxt nm |> Thm.cterm_of ctxt\n in Thm.trivial ct\n |> (resolve0_tac [@{thm graph_fun_refines_from_simpl_to_graph}] 1\n THEN apply_impl_thm ctxt 1\n THEN graph_gamma_tac ctxt 1\n THEN ALLGOALS (simp_tac (put_simpset HOL_basic_ss ctxt addsimps [body_thm]\n addsimps @{thms entry_point.simps function_inputs.simps\n function_outputs.simps list.simps}))\n THEN TRY ((resolve0_tac [@{thm simpl_to_graph_noop_same_eqs}]\n THEN' inst_graph_tac ctxt) 1)\n )\n |> Seq.hd\n end\n\nval thin_While_assums_rule =\n @{thm thin_rl[where V=\"simpl_to_graph SG GG f nn (add_cont (com.While C c) con) n tS P I e e2\"]}\n |> Drule.generalize ([], [\"SG\", \"GG\", \"f\", \"nn\", \"C\", \"c\", \"con\", \"n\", \"tS\", \"P\", \"I\", \"e\", \"e2\"])\n\nfun eq_impl_unassume_tac t = let\n val hyps = t |> Thm.chyps_of\n |> filter (Thm.term_of #> is_safe_eq_impl)\n in (* tracing (\"Restoring \" ^ string_of_int (length hyps) ^ \" hyps.\") ; *)\n fold Thm.implies_intr hyps t |> Seq.single end\n\nfun simpl_to_graph_upto_subgoals funs hints nm ctxt =\n init_graph_refines_proof funs nm ctxt\n |> (simpl_to_graph_tac funs hints nm ctxt 1\n THEN ALLGOALS (TRY o REPEAT_ALL_NEW (eresolve0_tac [thin_While_assums_rule]))\n THEN eq_impl_unassume_tac\n ) |> Seq.hd\n\nend\n\n*}\n\nML {*\nfun define_graph_fun_short funs s\n = ParseGraph.define_graph_fun funs (Long_Name.base_name s ^ \"_graph\")\n (Binding.name (Long_Name.base_name s ^ \"_graph_fun\")) s\n #> Local_Theory.reset\n*}\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/asmrefine/GraphRefine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.3140505449918075, "lm_q1q2_score": 0.1765518410921244}} {"text": "theory HealthcareExample\nimports Insider\nbegin\n\nlocale scenarioHealthcare = \nfixes healthcare_actors :: \"identity set\"\ndefines healthcare_actors_def: \"healthcare_actors \\ {''Patient''}\"\n\nfixes hc_locations :: \"location set\"\ndefines hc_locations_def: \"hc_locations \\ \n {Location 0, Location 1, Location 2, Location 3}\"\n\nfixes sphone :: \"location\"\ndefines sphone_def: \"sphone \\ Location 0\"\nfixes room :: \"location\"\ndefines room_def: \"room \\ Location 1\"\nfixes bankapp :: \"location\"\ndefines bankapp_def: \"bankapp \\ Location 2\"\nfixes healthapp :: \"location\"\ndefines healthapp_def: \"healthapp \\ Location 3\"\n\nfixes global_policy :: \"[infrastructure, identity] \\ bool\"\ndefines global_policy_def: \"global_policy I a \\ a \\ ''Patient'' \n \\ \\(enables I bankapp (Actor a) eval)\"\n\nfixes ex_creds :: \"actor \\ (string set * string set)\"\ndefines ex_creds_def: \"ex_creds \\ (\\ x. if x = Actor ''Patient'' then \n ({''PIN'',''skey''}, {}) else \n (if x = Actor ''Carer'' then\n ({''PIN''},{}) else ({},{})))\"\n\nfixes ex_creds' :: \"actor \\ (string set * string set)\"\ndefines ex_creds'_def: \"ex_creds' \\ (\\ x. if x = Actor ''Patient'' then \n ({''PIN'',''skey''}, {}) else \n (if x = Actor ''Carer'' then\n ({''PIN'',''skey''}, {}) else ({},{})))\"\n\nfixes ex_locs :: \"location \\ string set\"\ndefines \"ex_locs \\ (\\ x. {})\"\n\n \nfixes ex_graph :: \"igraph\"\ndefines ex_graph_def: \"ex_graph \\ Lgraph \n {(room, sphone), (sphone, healthapp), (sphone,bankapp)}\n (\\ x. if x = room then {''Patient'', ''Carer''} else {}) \n ex_creds ex_locs\"\n \nfixes ex_graph' :: \"igraph\"\ndefines ex_graph'_def: \"ex_graph' \\ Lgraph \n {(room, sphone), (sphone, healthapp), (sphone,bankapp)}\n (\\ x. if x = room then {''Patient'', ''Carer''} else {}) \n ex_creds' ex_locs\"\n \nfixes ex_graph'' :: \"igraph\"\ndefines ex_graph''_def: \"ex_graph'' \\ Lgraph \n {(room, sphone), (sphone, healthapp), (sphone,bankapp)}\n (\\ x. if x = room then {''Patient''} else \n (if x = sphone then {''Carer''} else {})) \n ex_creds' ex_locs\"\n\nfixes ex_graph''' :: \"igraph\"\n defines ex_graph'''_def: \"ex_graph''' \\ Lgraph \n {(room, sphone), (sphone, healthapp), (sphone,bankapp)}\n (\\ x. if x = room then {''Patient''} else \n (if x = bankapp then {''Carer''} else {})) \n ex_creds' ex_locs\"\n \nfixes local_policies :: \"[igraph, location] \\ policy set\"\ndefines local_policies_def: \"local_policies G \\ \n (\\ x. if x = room then\n {(\\ y. True, {put,get,move,eval})}\n else (if x = sphone then \n {((\\ y. has G (y, ''PIN'')), {put,get,move,eval})} \n else (if x = healthapp then\n {((\\ y. (\\ n. (n @\\<^bsub>G\\<^esub> sphone) \\ Actor n = y)), {put,get,move,eval})}\n else (if x = bankapp then\n {((\\ y. (\\ n. ((n @\\<^bsub>G\\<^esub> sphone)\\(n @\\<^bsub>G\\<^esub> bankapp )) \\ Actor n = y \\ \n has G (y, ''skey''))), {put,get,move,eval})} else {}))))\"\n\n\nfixes hc_scenario :: \"infrastructure\"\ndefines hc_scenario_def:\n\"hc_scenario \\ Infrastructure ex_graph local_policies\"\n\nfixes Ihc :: \"infrastructure set\"\ndefines Ihc_def:\n \"Ihc \\ {hc_scenario}\"\n\n(* other states of scenario *)\n\n\n(* First step: Carer is in room with Patient and takes the skey *)\nfixes hc_scenario' :: \"infrastructure\"\ndefines hc_scenario'_def:\n\"hc_scenario' \\ Infrastructure ex_graph' local_policies\"\n\nfixes HC' :: \"infrastructure set\"\ndefines HC'_def:\n \"HC' \\ {hc_scenario'}\"\n\n\n(* Second step: Carer goes onto sphone and takes the money by eval on bankapp *)\nfixes hc_scenario'' :: \"infrastructure\"\ndefines hc_scenario''_def:\n\"hc_scenario'' \\ Infrastructure ex_graph'' local_policies\"\n\nfixes HC'' :: \"infrastructure set\"\ndefines HC''_def:\n \"HC'' \\ {hc_scenario''}\"\n\n\n(* Third step: Carer goes onto bankapp and can then get money *)\nfixes hc_scenario''' :: \"infrastructure\"\ndefines hc_scenario'''_def:\n\"hc_scenario''' \\ Infrastructure ex_graph''' local_policies\"\n\nfixes HC''' :: \"infrastructure set\"\ndefines HC'''_def:\n \"HC''' \\ {hc_scenario'''}\"\n\n\nfixes hc_states\ndefines hc_states_def: \"hc_states \\ { I. hc_scenario \\\\<^sub>i* I }\"\n\nfixes hc_Kripke\ndefines \"hc_Kripke \\ Kripke hc_states {hc_scenario}\"\n\nfixes shc \ndefines \"shc \\ {x. \\ (global_policy x ''Carer'')}\" \n \nbegin\n\nlemma step1: \"hc_scenario \\\\<^sub>n hc_scenario'\"\nproof (rule_tac l = room and a' = \"''Carer''\" and a = \"''Patient''\" and z = \"''skey''\" in get, rule refl)\n show \"''Patient'' @\\<^bsub>graphI hc_scenario\\<^esub> room\" \n by (simp add: hc_scenario_def atI_def ex_graph_def)\nnext show \"''Carer'' @\\<^bsub>graphI hc_scenario\\<^esub> room\"\n by (simp add: hc_scenario_def atI_def ex_graph_def)\nnext show \"has (graphI hc_scenario) (Actor ''Patient'', ''skey'')\"\n by (simp add: ex_graph_def hc_scenario_def ex_creds_def has_def credentials_def)\nnext show \"enables hc_scenario room (Actor ''Patient'') get\"\n by (simp add: hc_scenario_def enables_def local_policies_def ex_creds_def)\nnext show \"hc_scenario' =\n Infrastructure\n (Lgraph (gra (graphI hc_scenario)) (agra (graphI hc_scenario))\n ((cgra (graphI hc_scenario))\n (Actor ''Carer'' :=\n (insert ''skey'' (fst (cgra (graphI hc_scenario) (Actor ''Carer''))),\n snd (cgra (graphI hc_scenario) (Actor ''Carer'')))))\n (lgra (graphI hc_scenario)))\n (delta hc_scenario)\"\n apply (simp add: hc_scenario'_def hc_scenario_def ex_creds'_def \n ex_graph'_def ex_graph_def ex_creds_def)\n apply (rule conjI)\n apply (rule impI)\n apply (rule ext)\n apply simp\n apply (rule impI)\n apply (rule equalityI)\n apply simp+\n apply (rule impI)\n apply (rule ext)\n apply simp\n apply (rule impI)+\n apply (rule equalityI)\n by simp+\nqed\n\nlemma step1r: \"hc_scenario \\\\<^sub>n* hc_scenario'\"\nproof (simp add: state_transition_in_refl_def, insert step1, auto)\nqed\n\n\n\nlemma step2r: \"hc_scenario' \\\\<^sub>n* hc_scenario''\"\nproof (simp add: state_transition_in_refl_def, insert step2, auto)\nqed\n\nlemma step3: \"hc_scenario'' \\\\<^sub>n hc_scenario'''\"\nproof (rule_tac l = sphone and a = \"''Carer''\" and l' = bankapp in move, rule refl)\n show \"''Carer'' @\\<^bsub>graphI hc_scenario''\\<^esub> sphone\"\n by (simp add: hc_scenario''_def atI_def nodes_def ex_graph'_def room_def sphone_def\n ex_graph''_def bankapp_def healthapp_def)\nnext show \"sphone \\ nodes (graphI hc_scenario'')\"\n by (simp add: hc_scenario''_def atI_def nodes_def ex_graph'_def room_def sphone_def\n ex_graph''_def bankapp_def healthapp_def, blast)\nnext show \"bankapp \\ nodes (graphI hc_scenario'')\"\n by (simp add: hc_scenario''_def actors_graph_def ex_graph'_def\n ex_graph''_def nodes_def sphone_def room_def healthapp_def bankapp_def)\nnext show \"''Carer'' \\ actors_graph (graphI hc_scenario'')\"\n by (simp add: hc_scenario''_def actors_graph_def ex_graph'_def\n ex_graph''_def nodes_def sphone_def room_def healthapp_def bankapp_def, blast)\nnext show \"enables hc_scenario'' bankapp (Actor ''Carer'') move\"\n by (simp add: hc_scenario''_def enables_def local_policies_def ex_creds'_def\n bankapp_def healthapp_def sphone_def room_def \n atI_def ex_locs_def ex_graph'_def ex_graph''_def has_def \n credentials_def)\nnext show \"hc_scenario''' =\n Infrastructure (move_graph_a ''Carer'' sphone bankapp (graphI hc_scenario'')) (delta hc_scenario'')\"\n apply (simp add: hc_scenario''_def hc_scenario'''_def ex_creds'_def ex_creds_def\n ex_graph'_def move_graph_a_def ex_graph''_def sphone_def\n room_def bankapp_def has_def credentials_def ex_graph'''_def\n )\n apply (rule ext)\n by (simp add: sphone_def bankapp_def)\nqed\n\nlemma step3r: \"hc_scenario'' \\\\<^sub>n* hc_scenario'''\"\nproof (simp add: state_transition_in_refl_def, insert step3, auto)\nqed \n \nlemma stepr: \"hc_scenario \\\\<^sub>n* hc_scenario'''\"\nproof(insert step1r step2r step3r, simp add: state_transition_in_refl_def)\nqed \n \n(* The following attacks can be shown without using the \n strong impersonation property of Insider *) \n\nlemma in_danger: \"\\ (global_policy hc_scenario''' ''Carer'')\"\nproof (unfold global_policy_def, simp)\n show \"enables hc_scenario''' bankapp (Actor ''Carer'') eval\"\n by (simp add: hc_scenario'''_def\n ex_graph''_def ex_graph'''_def ex_locs_def ex_creds'_def\n atI_def local_policies_def enables_def\n bankapp_def healthapp_def sphone_def room_def has_def credentials_def)\nqed \n\nlemma att_hc: \"\\[\\\\<^bsub>(Ihc,HC')\\<^esub>, \\\\<^bsub>(HC',HC'')\\<^esub>, \\\\<^bsub>(HC'',shc)\\<^esub>] \\\\<^sub>\\\\<^bsup>(Ihc,shc)\\<^esup>\"\nproof (subst att_and, simp, rule conjI)\n show \"\\\\\\<^bsub>(Ihc, HC')\\<^esub>\"\n apply (simp add: Ihc_def HC'_def att_base) \n apply (subst state_transition_infra_def)\n by (rule step1)\nnext show \" \\[\\\\<^bsub>(HC', HC'')\\<^esub>, \\\\<^bsub>(HC'', shc)\\<^esub>] \\\\<^sub>\\\\<^bsup>(HC', shc)\\<^esup>\"\n apply (subst att_and, simp)\n proof (rule conjI)\n show \" \\\\\\<^bsub>(HC', HC'')\\<^esub>\"\n apply (simp add: Ihc_def HC'_def HC''_def att_base) \n apply (subst state_transition_infra_def)\n by (rule step2)\n next show \" \\[\\\\<^bsub>(HC'', shc)\\<^esub>] \\\\<^sub>\\\\<^bsup>(HC'', shc)\\<^esup>\"\n apply (simp add: Ihc_def HC'_def HC''_def att_base) \n apply (subst att_and, simp add: att_base)\n apply (rule_tac x = \"hc_scenario'''\" in bexI)\n apply (subst state_transition_infra_def)\n apply (rule step3)\n apply (simp add: shc_def)\n by (rule in_danger)\n qed\nqed\n\ntheorem hc_EF: \"hc_Kripke \\ EF shc\"\nproof -\n have a: \"\\[\\\\<^bsub>(Ihc, HC')\\<^esub>, \\\\<^bsub>(HC', HC'')\\<^esub>, \\\\<^bsub>(HC'', shc)\\<^esub>] \\\\<^sub>\\\\<^bsup>(Ihc, shc)\\<^esup>\" by (rule att_hc)\n have b: \"(Ihc, shc) = attack ([\\\\<^bsub>(Ihc,HC')\\<^esub>, \\\\<^bsub>(HC',HC'')\\<^esub>, \\\\<^bsub>(HC'',shc)\\<^esub>] \\\\<^sub>\\\\<^bsup>(Ihc,shc)\\<^esup>)\"\n by simp\n have \"Kripke {s::infrastructure. \\i::infrastructure\\Ihc. i \\\\<^sub>i* s} Ihc \\ EF shc \" \n apply (rule AT_EF)\n apply (rule a)\n by simp\n thus \"hc_Kripke \\ EF shc\"\n by (simp add: hc_Kripke_def hc_states_def Ihc_def)\nqed\n \nend", "meta": {"author": "flokam", "repo": "IsabelleAT", "sha": "b8d80c31ac13fdf8c7710f7ae032233b3fa474da", "save_path": "github-repos/isabelle/flokam-IsabelleAT", "path": "github-repos/isabelle/flokam-IsabelleAT/IsabelleAT-b8d80c31ac13fdf8c7710f7ae032233b3fa474da/HealthcareExample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.31405054499180746, "lm_q1q2_score": 0.17655183648477224}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__12_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__12_on_rules imports n_g2kAbsAfter_lemma_on_inv__12\nbegin\nsection{*All lemmas on causal relation between inv__12*}\nlemma lemma_inv__12_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__12 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__12) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__12_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.3140505321516081, "lm_q1q2_score": 0.17655182926631388}} {"text": "(* Title: HOL/MicroJava/JVM/JVMDefensive.thy\n Author: Gerwin Klein\n*)\n\nsection {* A Defensive JVM *}\n\ntheory JVMDefensive\nimports JVMExec\nbegin\n\ntext {*\n Extend the state space by one element indicating a type error (or\n other abnormal termination) *}\ndatatype 'a type_error = TypeError | Normal 'a\n\n\nabbreviation\n fifth :: \"'a \\ 'b \\ 'c \\ 'd \\ 'e \\ 'f \\ 'e\"\n where \"fifth x == fst(snd(snd(snd(snd x))))\"\n\nfun isAddr :: \"val \\ bool\" where\n \"isAddr (Addr loc) = True\"\n| \"isAddr v = False\"\n\nfun isIntg :: \"val \\ bool\" where\n \"isIntg (Intg i) = True\"\n| \"isIntg v = False\"\n\ndefinition isRef :: \"val \\ bool\" where\n \"isRef v \\ v = Null \\ isAddr v\"\n\nprimrec check_instr :: \"[instr, jvm_prog, aheap, opstack, locvars, \n cname, sig, p_count, nat, frame list] \\ bool\" where\n \"check_instr (Load idx) G hp stk vars C sig pc mxs frs = \n (idx < length vars \\ size stk < mxs)\"\n\n| \"check_instr (Store idx) G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ idx < length vars)\"\n\n| \"check_instr (LitPush v) G hp stk vars Cl sig pc mxs frs = \n (\\isAddr v \\ size stk < mxs)\"\n\n| \"check_instr (New C) G hp stk vars Cl sig pc mxs frs = \n (is_class G C \\ size stk < mxs)\"\n\n| \"check_instr (Getfield F C) G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ is_class G C \\ field (G,C) F \\ None \\ \n (let (C', T) = the (field (G,C) F); ref = hd stk in \n C' = C \\ isRef ref \\ (ref \\ Null \\ \n hp (the_Addr ref) \\ None \\ \n (let (D,vs) = the (hp (the_Addr ref)) in \n G \\ D \\C C \\ vs (F,C) \\ None \\ G,hp \\ the (vs (F,C)) ::\\ T))))\" \n\n| \"check_instr (Putfield F C) G hp stk vars Cl sig pc mxs frs = \n (1 < length stk \\ is_class G C \\ field (G,C) F \\ None \\ \n (let (C', T) = the (field (G,C) F); v = hd stk; ref = hd (tl stk) in \n C' = C \\ isRef ref \\ (ref \\ Null \\ \n hp (the_Addr ref) \\ None \\ \n (let (D,vs) = the (hp (the_Addr ref)) in \n G \\ D \\C C \\ G,hp \\ v ::\\ T))))\" \n\n| \"check_instr (Checkcast C) G hp stk vars Cl sig pc mxs frs =\n (0 < length stk \\ is_class G C \\ isRef (hd stk))\"\n\n| \"check_instr (Invoke C mn ps) G hp stk vars Cl sig pc mxs frs =\n (length ps < length stk \\ \n (let n = length ps; v = stk!n in\n isRef v \\ (v \\ Null \\ \n hp (the_Addr v) \\ None \\\n method (G,cname_of hp v) (mn,ps) \\ None \\\n list_all2 (\\v T. G,hp \\ v ::\\ T) (rev (take n stk)) ps)))\"\n \n| \"check_instr Return G hp stk0 vars Cl sig0 pc mxs frs =\n (0 < length stk0 \\ (0 < length frs \\ \n method (G,Cl) sig0 \\ None \\ \n (let v = hd stk0; (C, rT, body) = the (method (G,Cl) sig0) in\n Cl = C \\ G,hp \\ v ::\\ rT)))\"\n \n| \"check_instr Pop G hp stk vars Cl sig pc mxs frs = \n (0 < length stk)\"\n\n| \"check_instr Dup G hp stk vars Cl sig pc mxs frs = \n (0 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Dup_x1 G hp stk vars Cl sig pc mxs frs = \n (1 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Dup_x2 G hp stk vars Cl sig pc mxs frs = \n (2 < length stk \\ size stk < mxs)\"\n\n| \"check_instr Swap G hp stk vars Cl sig pc mxs frs =\n (1 < length stk)\"\n\n| \"check_instr IAdd G hp stk vars Cl sig pc mxs frs =\n (1 < length stk \\ isIntg (hd stk) \\ isIntg (hd (tl stk)))\"\n\n| \"check_instr (Ifcmpeq b) G hp stk vars Cl sig pc mxs frs =\n (1 < length stk \\ 0 \\ int pc+b)\"\n\n| \"check_instr (Goto b) G hp stk vars Cl sig pc mxs frs =\n (0 \\ int pc+b)\"\n\n| \"check_instr Throw G hp stk vars Cl sig pc mxs frs =\n (0 < length stk \\ isRef (hd stk))\"\n\ndefinition check :: \"jvm_prog \\ jvm_state \\ bool\" where\n \"check G s \\ let (xcpt, hp, frs) = s in\n (case frs of [] \\ True | (stk,loc,C,sig,pc)#frs' \\ \n (let (C',rt,mxs,mxl,ins,et) = the (method (G,C) sig); i = ins!pc in\n pc < size ins \\ \n check_instr i G hp stk loc C sig pc mxs frs'))\"\n\n\ndefinition exec_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state option type_error\" where\n \"exec_d G s \\ case s of \n TypeError \\ TypeError \n | Normal s' \\ if check G s' then Normal (exec (G, s')) else TypeError\"\n\n\ndefinition\n exec_all_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ \\ _ \\jvmd\\ _\" [61,61,61]60) where\n \"G \\ s \\jvmd\\ t \\\n (s,t) \\ ({(s,t). exec_d G s = TypeError \\ t = TypeError} \\\n {(s,t). \\t'. exec_d G s = Normal (Some t') \\ t = Normal t'})\\<^sup>*\"\n\n\ndeclare split_paired_All [simp del]\ndeclare split_paired_Ex [simp del]\n\nlemma [dest!]:\n \"(if P then A else B) \\ B \\ P\"\n by (cases P, auto)\n\nlemma exec_d_no_errorI [intro]:\n \"check G s \\ exec_d G (Normal s) \\ TypeError\"\n by (unfold exec_d_def) simp\n\ntheorem no_type_error_commutes:\n \"exec_d G (Normal s) \\ TypeError \\ \n exec_d G (Normal s) = Normal (exec (G, s))\"\n by (unfold exec_d_def, auto)\n\n\nlemma defensive_imp_aggressive:\n \"G \\ (Normal s) \\jvmd\\ (Normal t) \\ G \\ s \\jvm\\ t\"\nproof -\n have \"\\x y. G \\ x \\jvmd\\ y \\ \\s t. x = Normal s \\ y = Normal t \\ G \\ s \\jvm\\ t\"\n apply (unfold exec_all_d_def)\n apply (erule rtrancl_induct)\n apply (simp add: exec_all_def)\n apply (fold exec_all_d_def)\n apply simp\n apply (intro allI impI)\n apply (erule disjE, simp)\n apply (elim exE conjE)\n apply (erule allE, erule impE, assumption)\n apply (simp add: exec_all_def exec_d_def split: type_error.splits split_if_asm)\n apply (rule rtrancl_trans, assumption)\n apply blast\n done\n moreover\n assume \"G \\ (Normal s) \\jvmd\\ (Normal t)\" \n ultimately\n show \"G \\ s \\jvm\\ t\" by blast\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/JVM/JVMDefensive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.17643454441997658}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__23_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__23_on_rules imports n_german_lemma_on_inv__23\nbegin\nsection{*All lemmas on causal relation between inv__23*}\nlemma lemma_inv__23_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__23 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__23) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__23_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165085228824, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.1764345394490866}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__16_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__16_on_rules imports n_germanSimp_lemma_on_inv__16\nbegin\nsection{*All lemmas on causal relation between inv__16*}\nlemma lemma_inv__16_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__16) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__16_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.3345894346180165, "lm_q1q2_score": 0.17643453742230747}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__20_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__20_on_rules imports n_germanSymIndex_lemma_on_inv__20\nbegin\nsection{*All lemmas on causal relation between inv__20*}\nlemma lemma_inv__20_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__20 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__20) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__20_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.34158250614097546, "lm_q1q2_score": 0.17612674302886622}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Generator_CAMKES_CDL imports\n \"../adl-spec/Types_CAMKES\"\n \"../adl-spec/Library_CAMKES\"\n \"../../spec/capDL/Syscall_D\"\n Types_CAMKES_CDL\n \"../../proof/access-control/Dpolicy\"\nbegin\n\ntext {*\n This theory is a work in progress on specifying the CapDL-producing logic of the CAmkES code\n generator as an Isabelle function.\n*}\n\ntext {*\n Merge two CapDL states to form a single one. Note that, in the case of conflicts, the second takes\n precedence.\n*}\ndefinition\n merge_cdl :: \"cdl_state \\ cdl_state \\ cdl_state\"\nwhere\n \"merge_cdl a b \\ b\\\n cdl_objects := cdl_objects b ++ cdl_objects a,\n cdl_cdt := cdl_cdt b ++ cdl_cdt a,\n cdl_asid_table := cdl_asid_table b ++ cdl_asid_table a\\\"\n\nlemma map_add_id[simp]: \"x ++ x = x\"\n by (metis map_add_le_mapI map_le_antisym map_le_map_add map_le_refl)\n\nlemma map_add_subsume: \"dom x \\ dom y \\ x ++ y = y\"\n by (metis dom_map_add map_le_antisym map_le_def map_le_map_add sup.orderE)\n\nlemma merge_id: \"merge_cdl x x = x\"\n by (clarsimp simp:merge_cdl_def)\n\ndefinition merge_objs :: \"cdl_state \\ cdl_heap \\ cdl_state\"\n where \"merge_objs a b \\ merge_cdl a (a\\cdl_objects := b\\)\"\n\n(* convenience *)\ndefinition sum :: \"nat list \\ nat\"\n where \"sum xs \\ fold (\\a b. a + b) xs 0\"\n\n(* convenience *)\ndefinition enumerate' :: \"word32 \\ 'a list \\ (word32 \\ 'a) list\"\n where \"enumerate' start xs = map (\\(a, b). (of_nat a, b)) (enumerate (unat start) xs)\"\n\ndefinition\n lop :: \"nat \\ 'a list \\ 'a list\"\nwhere\n \"lop n xs \\ take (length xs - n) xs\"\n\nabbreviation behead\n where \"behead s pref \\ drop (length pref) s\"\n\nabbreviation trunc\n where \"trunc s suf \\ lop (length suf) s\"\n\n(* Cap rights *)\nabbreviation \"G \\ {AllowGrant}\"\nabbreviation \"R \\ {AllowRead}\"\nabbreviation \"RG \\ {AllowRead, AllowGrant}\"\nabbreviation \"RW \\ {AllowRead, AllowWrite}\"\nabbreviation \"RWG \\ {AllowRead, AllowWrite, AllowGrant}\"\nabbreviation \"W \\ {AllowWrite}\"\nabbreviation \"WG \\ {AllowWrite, AllowGrant}\"\n\ntext {*\n A type for representing extra information relating to hardware interrupts that will be appended\n to a generated CapDL specification. We would prefer not to deal with interrupts, but CapDL\n represents each interrupt as a mapping to a single-slot CNode. We need to note the existence of\n these artificial CNodes for the final correspondence proof.\n*}\nrecord irqs =\n irqs_map :: \"cdl_irq \\ cdl_object_id\"\n irqs_objects :: cdl_heap\n\ndefinition\n valid_irqs :: \"cdl_state \\ cdl_heap \\ irqs \\ bool\"\nwhere\n \"valid_irqs initial extra irqs \\\n range (irqs_map irqs) = dom (irqs_objects irqs) \\\n dom (cdl_objects initial) \\ dom (irqs_objects irqs) = {} \\\n dom extra \\ dom (irqs_objects irqs) = {} \\\n (\\x \\ ran (irqs_objects irqs). case x of\n Types_D.CNode c \\ c = \\cdl_cnode_caps = empty, cdl_cnode_size_bits = 0\\\n | _ \\ False)\"\n\ntext {*\n Predicate that the extra capability distribution we provide to the @{text generate} function is a\n valid extension to the basic distribution we generate. Essentially the extension must only contain\n address space objects.\n*}\ndefinition\n valid_extra :: \"cdl_state \\ cdl_heap \\ bool\"\nwhere\n \"valid_extra initial extra \\\n (\\obj \\ range extra. case obj of\n None \\ True\n | Some (Types_D.PageDirectory _) \\ True\n | Some (Types_D.PageTable _) \\ True\n | Some (Types_D.Frame _) \\ True\n | _ \\ False) \\\n dom (cdl_objects initial) \\ dom extra = {}\"\n\ntext {*\n Now, for each of the types of items present in a base CAmkES-derived CapDL specification (CNodes,\n TCBs, endpoints), we define two things:\n * count - How many of this type of object we have; and\n * objects - A list of these objects ordered by cdl_object_id.\n Note that a CAmkES-derived CapDL specification naturally groups objects of the same type in a\n single, contiguous block. The reason we need to define the count separately to the object list\n itself is that, in some cases, the count of a type of object is required before we are actually at\n the point where we can define the object list itself. This is basically to work around circular\n dependencies.\n*}\n\ndefinition cnode_count :: \"camkes_state \\ nat\"\n where \"cnode_count spec \\ length (components (composition spec))\"\n\ndefinition tcb_count :: \"camkes_state \\ nat\"\n where \"tcb_count spec \\\n length (components (composition spec)) + sum (map\n (\\(_, c). length (provides c) + length (requires c) + length (emits c) +\n length (consumes c) + length (dataports c)) (components (composition spec)))\"\n\nlemma more_tcbs_than_cnodes: \"tcb_count spec \\ cnode_count spec\"\n by (clarsimp simp:tcb_count_def cnode_count_def)\n\ndefinition\n ep_objs' :: \"camkes_state \\ (string \\ connection \\ cdl_object) list\"\nwhere\n \"ep_objs' spec \\ concat (map (\\(n, c).\n if conn_type c = seL4RPC then\n [(n @ ''_ep'', c, Types_D.Endpoint)]\n else if conn_type c = seL4Asynch then\n [(n @ ''_ntfn'', c, Types_D.Notification)]\n else\n []) (connections (composition spec)))\"\n\ndefinition ep_objs :: \"camkes_state \\ (string \\ cdl_object) list\"\n where \"ep_objs spec \\ map (\\(n, c, e). (n, e)) (ep_objs' spec)\"\n\ndefinition ep_count :: \"camkes_state \\ nat\"\n where \"ep_count spec \\ length (ep_objs spec)\"\n\ntext {*\n When debugging a system (or when you would like your threads to terminate smoothly), we install\n TCB caps for all a component instance's threads in the first few CNode slots. When producing a\n verified system, we do not install these TCB caps, but we still need to account for the slots\n they would occupy as an offset into the CNode at which the following caps begin. Note, that we\n intentionally leave these slots empty so that any code expecting to invoke a TCB cap causes a cap\n fault, rather than incorrectly invoking an endpoint.\n*}\ndefinition cap_offset :: \"camkes_state \\ string \\ nat\"\n where \"cap_offset spec instance \\ 2 +\n (\\(_, c). length (requires c) + length (provides c) + length (dataports c) +\n length (emits c) + length (consumes c))\n (hd (filter (\\(n, _). n = instance) (components (composition spec))))\"\n\nlemma helper1: \"map (length \\ (\\(a, b). P a b # map (f a b) (Q a b))) xs =\n map (\\(a, b). 1 + length (Q a b)) xs\"\n by clarsimp\n\nlemma helper2: \"(\\x \\ xs. Suc (f x)) = length xs + (\\x \\ xs. f x)\"\n apply (induct xs)\n by clarsimp+\n\nlemma helper3: \"(\\(a, b) \\ xs. Suc (f a b)) = length xs + (\\(a, b) \\ xs. f a b)\"\n apply (induct xs)\n by clarsimp+\n\nlemma helper4: \"fold op + ((map (\\(a, b). f a b) xs)::nat list) 0 = (\\(a, b) \\ xs. f a b)\"\n apply (subst fold_plus_sum_list_rev)\n apply (subst sum_list_rev)\n by clarsimp\n\nlemma set_of_enumerate:\"card (set (enumerate n xs)) = length xs\"\n by (metis distinct_card distinct_enumerate length_enumerate)\n\nlemma collapse_fst:\"fst ` (\\x. (f x, g x)) ` s = f ` s\"\n by force\n\nlemma collapse_fst2:\"fst ` (\\(x, y). (f x, g y)) ` s = (\\x. f (fst x)) ` s\"\n by force\n\nlemma collapse_fst3:\"(\\x. f (fst x)) ` set (enumerate n xs) = f ` set [n.. 'b option\"\n assumes \"finite (UNIV::'a set)\"\n shows \"card (dom f) \\ CARD('a)\"\n by (metis assms card_seteq linear top_greatest)\n\nlemma helper8: \"x \\ f ` S = (\\y \\ S. f y = x)\"\n by blast\n\nlemma helper7:\n \"n \\ CARD(cdl_object_id) \\ card ((of_nat::nat \\ cdl_object_id) ` {0.. {n}\")\n prefer 2\n apply clarsimp\n apply fastforce\n apply clarsimp\n apply (subst card_insert_disjoint)\n apply clarsimp\n apply (subst atLeast0LessThan)\n apply (subgoal_tac \"(of_nat::nat \\ cdl_object_id) ` {.. CARD(cdl_object_id) \\ card ((of_nat::nat \\ cdl_object_id) ` {0.. S \\ c \\ (snd \\ snd) ` S\"\n by (metis (erased, hide_lams) helper8 image_comp snd_conv)\n\nlemma helper9: \"(a \\ (snd \\ snd) ` (set (enumerate i xs))) = (a \\ snd ` (set xs))\"\n by (metis map_map map_snd_enumerate set_map)\n\nabbreviation \"is_some s \\ \\ Option.is_none s\"\n\nlemma helper11: \"is_some (map_of (enumerate' n xs) x) \\ \\y. map_of (enumerate' n xs) x = Some y\"\n by (metis (full_types) is_none_code(1) not_Some_eq)\n\nlemma helper10: \"map_of (enumerate' n xs) x = Some y \\ y \\ set xs\"\n apply (clarsimp simp:enumerate'_def)\n by (metis enumerate_eq_zip in_set_zipE map_of_SomeD zip_map1)\n\nlemma helper14:\n \"(map_of xs ++ map_of ys) x = (case map_of ys x of None \\ map_of xs x | Some x' \\ Some x')\"\n apply (case_tac \"(map_of xs ++ map_of ys) x\")\n apply clarsimp+\n apply (case_tac \"map_of ys x\")\n by clarsimp+\n\nlemma helper15:\n \"(map_of xs ++ map_of ys ++ map_of zs) x =\n (case map_of zs x of None \\ (case map_of ys x of None \\ map_of xs x\n | Some x' \\ Some x')\n | Some x' \\ Some x')\"\n apply (case_tac \"(map_of xs ++ map_of ys ++ map_of zs) x\")\n apply clarsimp+\n apply (case_tac \"map_of zs x\")\n apply clarsimp\n apply (case_tac \"map_of ys x\")\n by clarsimp+\n\nlemma helper13: \"map_of (map (\\(n, y). (the_id_of n, y)) xs) x = Some z \\ z \\ snd ` set xs\"\n proof -\n assume \"map_of (map (\\(n, y). (the_id_of n, y)) xs) x = Some z\"\n hence \"(x, z) \\ (\\(uu, y). (the_id_of uu, y)) ` set xs\" using map_of_SomeD by fastforce\n thus \"z \\ snd ` set xs\" using helper8 by fastforce\n qed\n\nlemma helper12: \"valid_extra a b \\ dom (cdl_objects a) \\ dom b = {}\"\n by (clarsimp simp:valid_extra_def)\n\nlemma helper16: \"(a, b) \\ set (enumerate x ys) \\ b \\ set ys\"\n by (metis enumerate_eq_zip in_set_zip2)\n\nlemma helper17: \"distinct (map fst xs) \\ ran (map_of xs) = set (map snd xs)\"\n apply (cut_tac xs=\"map fst xs\" and ys=\"map snd xs\" in ran_map_of_zip[symmetric])\n apply clarsimp+\n by (simp add: ran_distinct)\n\nlemma helper18: \"x \\ ran (map_of xs) \\ x \\ set (map snd xs)\"\n by (metis (mono_tags, hide_lams) helper8 map_of_SomeD ranE set_map snd_conv)\n\nlemma helper19: \"x \\ ran (xs ++ ys ++ zs) \\ x \\ ran xs \\ x \\ ran ys \\ x \\ ran zs\"\n by (smt map_add_Some_iff ranE ranI)\n\nlemma helper21: \"None \\ S \\ Some x \\ S = (x \\ the ` S)\"\n apply (rule iffI)\n apply force\n apply (subst in_these_eq[symmetric])\n apply (clarsimp simp:Option.these_def)\n apply (case_tac \"\\y. xa = Some y\")\n by clarsimp+\n\nlemma helper20: \"the ` Set.filter (\\s. \\ Option.is_none s) (range f) = ran f\"\n apply (rule subset_antisym)\n apply clarsimp\n apply (case_tac \"f x\", simp_all)\n apply (simp add: ranI)\n apply clarsimp\n apply (subst helper21[symmetric])\n apply clarsimp+\n apply (erule ranE)\n by (metis range_eqI)\n\nlemma helper23:\n \"x \\ ran (cdl_objects (merge_objs a b)) \\ x \\ ran (cdl_objects a) \\ x \\ ran b\"\n apply (clarsimp simp:merge_objs_def merge_cdl_def)\n by (metis helper19 map_add_id)\n\ntype_synonym label = string\n\ntext {*\n We assume that the user, when instantiating the following locale to use the contained lemmas, will\n provide us with a function to find the object IDs of the IPC buffers. We need to assume this\n because the IPC buffer frames (and caps to them) are inferred late in the CapDL generation\n process, while deriving the rest of the backing frames for the address space.\n*}\nlocale cdl_translation =\n fixes ipc_buffer :: \"string \\ nat \\ cdl_object_id option\"\n assumes buffers_distinct: \"\\n i m j. \\f. ipc_buffer n i = Some f \\ ipc_buffer m j = Some f\n \\ n = m \\ i = j\"\n fixes id_of :: \"string \\ cdl_object_id option\"\n assumes ids_distinct: \"\\n m. \\i. id_of n = Some i \\ id_of m = Some i \\ n = m\"\n\n fixes garbage :: label\n fixes irq_label :: label\nbegin\n\nabbreviation the_ipc_buffer :: \"string \\ nat \\ cdl_object_id\"\n where \"the_ipc_buffer name index \\ the (ipc_buffer name index)\"\n\nabbreviation the_id_of :: \"string \\ cdl_object_id\"\n where \"the_id_of name \\ the (id_of name)\"\n\nabbreviation the_cnode_of :: \"string \\ cdl_object_id\"\n where \"the_cnode_of instance \\ the_id_of (''cnode_'' @ instance)\"\n\n(* XXX: Assumes no shared address space components. *)\nabbreviation the_pd_of :: \"string \\ cdl_object_id\"\n where \"the_pd_of instance \\ the_id_of (''pd_'' @ instance @ ''_group_bin'')\"\n\ntext {*\n The contents of a CNode of a given component instance. It is easier to define this out-of-line\n here.\n*}\ndefinition\n cap_map :: \"camkes_state \\ string \\ nat \\ cdl_cap option\"\nwhere\n \"cap_map spec instance \\ map_of (enumerate (cap_offset spec instance) (concat (\n map (\\(n, c, _). if conn_type c = seL4RPC then (\n if fst (conn_from c) = instance then\n [Types_D.EndpointCap (the_id_of n) 0 RW]\n else if fst (conn_to c) = instance then\n [Types_D.EndpointCap (the_id_of n) 0 RW]\n else\n [])\n else if conn_type c = seL4Asynch then (\n if fst (conn_from c) = instance then\n [Types_D.NotificationCap (the_id_of n) 0 W]\n else if fst (conn_to c) = instance then\n [Types_D.NotificationCap (the_id_of n) 0 R]\n else\n [])\n else\n []) (ep_objs' spec))))\"\n\ntext {*\n Various minutiae related to CNode sizes. Ordinarily, in a hand-written system, this would not be a\n big deal. However, in CAmkES we automatically infer the CNode size based on the number of\n capabilities it needs to contain. The definition below is intended to replicate the calculation in\n the python-capdl module.\n*}\ndefinition cnode_size_bits :: \"camkes_state \\ string \\ nat\"\n where \"cnode_size_bits spec name \\\n LEAST bits. 2 ^ bits > Max (dom (cap_map spec name) \\ {2})\"\n\ndefinition cnode_size :: \"camkes_state \\ string \\ nat\"\n where \"cnode_size spec instance \\ 2 ^ (cnode_size_bits spec instance)\"\n\ndefinition cnode_guard_size :: \"camkes_state \\ string \\ nat\"\n where \"cnode_guard_size spec instance \\ 32 - cnode_size_bits spec instance\"\n\ntext {* All CNodes have a guard of 0. *}\ndefinition cnode_guard :: \"camkes_state \\ string \\ 32 word\"\n where \"cnode_guard _ _ \\ 0\"\n\ndefinition\n cnode_objs :: \"camkes_state \\ (string \\ cdl_object) list\"\nwhere\n \"cnode_objs spec \\\n map (\\n. (''cnode_'' @ n,\n Types_D.CNode \\cdl_cnode_caps = cap_map spec n,\n cdl_cnode_size_bits = cnode_size_bits spec n\\))\n (instance_names spec)\"\n\nlemma cnode_count_correct: \"cnode_count spec = length (cnode_objs spec)\"\n by (clarsimp simp:cnode_count_def cnode_objs_def instance_names_def)\n\ndefinition\n tcb_objs :: \"camkes_state \\ (string \\ cdl_object) list\"\nwhere\n \"tcb_objs spec \\ concat (\n (* The 'control' TCB *)\n map (\\(n, c). (n @ ''_tcb_0_control'', Types_D.Tcb \\cdl_tcb_caps = [\n cspace \\ Types_D.CNodeCap (the_cnode_of n) (cnode_guard spec n) (cnode_guard_size spec n)\n (cnode_size_bits spec n),\n vspace \\ Types_D.PageDirectoryCap (the_pd_of n) Real None,\n ipc_buffer_slot \\ Types_D.FrameCap False (the_ipc_buffer n 0) RW 12 Real None],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = undefined,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = 0\\) #\n\n (* The interface TCBs *)\n map (\\(i, inf). (n @ ''_tcb_'' @ inf, Types_D.Tcb \\cdl_tcb_caps = [\n cspace \\ Types_D.CNodeCap (the_cnode_of n) (cnode_guard spec n) (cnode_guard_size spec n)\n (cnode_size_bits spec n),\n vspace \\ Types_D.PageDirectoryCap (the_pd_of n) Real None,\n ipc_buffer_slot \\ Types_D.FrameCap False (the_ipc_buffer n (i + 1)) RW 12 Real None],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = undefined,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = 0\\))\n (enumerate 0 (map fst (provides c) @ map fst (requires c) @ map fst (emits c) @\n map fst (consumes c) @ map fst (dataports c))))\n\n (components (composition spec)))\"\n\nlemma tcb_count_correct: \"tcb_count spec = length (tcb_objs spec)\"\n apply (clarsimp simp:tcb_count_def tcb_objs_def sum_def)\n apply (subst length_concat)\n apply clarsimp\n apply (subst helper1)\n apply clarsimp\n apply (subst helper3)\n apply (subst helper4)\n apply clarsimp\n by (metis (no_types, hide_lams) add.commute add.left_commute)\n\ntext {* The CapDL heap; that is, all the objects in the system. *}\ndefinition\n obj_heap :: \"camkes_state \\ cdl_object_id \\ cdl_object option\"\nwhere\n \"obj_heap spec \\ map_of (map (\\(n, i). (the_id_of n, i)) (\n cnode_objs spec @ tcb_objs spec @ ep_objs spec))\"\n\ndefinition obj_heap_size :: \"camkes_state \\ nat\"\n where \"obj_heap_size spec \\ cnode_count spec + tcb_count spec + ep_count spec\"\n\nlemma obj_heap_dom_bounded:\"card (dom (obj_heap spec)) \\ CARD(cdl_object_id)\"\n apply (rule card_mono[where B=UNIV])\n by clarsimp+\n\ntext {* Low-level generator. This describes the actual logic of the CAmkES code generator. *}\ndefinition\n generate' :: \"camkes_state \\ cdl_state\"\nwhere\n \"generate' spec \\ \\\n cdl_arch = ARM11,\n cdl_objects = obj_heap spec,\n cdl_cdt = empty,\n cdl_current_thread = undefined,\n cdl_irq_node = undefined,\n cdl_asid_table = empty,\n cdl_current_domain = undefined\\\"\n\ntext {*\n An object abstraction (that is, a mapping from object IDs to labels) for a CAmkES-generated\n specification. WIP.\n*}\ndefinition\n poa_of :: \"camkes_state \\ cdl_heap \\ irqs \\ label agent_map\"\nwhere\n \"poa_of spec extra irqs \\ (\\id. case (\n\n (* Labelling of the output of the low-level generator: *)\n fold (op ++)\n (map (\\(name, _). [the_id_of name \\ behead name ''cnode_'']) (cnode_objs spec))\n Map.empty\n\n ++\n fold (op ++)\n (map (\\(name, _). [the_id_of name \\ trunc name ''_ep'']) (ep_objs spec)) Map.empty\n ++\n fold (op ++)\n (map (\\(name, _). [the_id_of name \\ behead name ''tcb_'']) (tcb_objs spec)) Map.empty\n\n (* Labelling of address space objects: *)\n ++\n (\\id. case extra id of\n Some _ \\ if \\name. id_of name = Some id\n then Some (trunc\n (behead (SOME name. id_of name = Some id) ''frame_'')\n ''_group_bin_0000'')\n else None\n | None \\ None)\n\n (* Labelling of IRQ objects: *)\n ++\n (\\id. if id \\ dom (irqs_objects irqs)\n then Some irq_label\n else None)\n\n ) id of Some l \\ l | None \\ garbage)\"\n\nabbreviation \"edge_subject \\ fst\"\nabbreviation \"edge_auth \\ fst o snd\"\nabbreviation \"edge_object \\ snd o snd\"\n\ntext {*\n A policy describing the authority between labels in a CapDL system. Note that the only meaningful\n relationships here are the authority implied by endpoints. TODO: shared memory.\n*}\ndefinition\n policy_of :: \"camkes_state \\ cdl_heap \\ irqs \\ label auth_graph\"\nwhere\n \"policy_of spec extra irqs \\\n (* Every label has every authority over itself. *)\n {edge. edge_subject edge = edge_object edge} \\\n\n (* Senders on seL4RPC connections. *)\n {edge. \\from. from \\ fst ` set (components (composition spec)) \\\n (\\conn \\ set (connections (composition spec)).\n fst (conn_from (snd conn)) = from \\\n conn_type (snd conn) = seL4RPC \\\n edge_object edge = fst conn) \\\n edge_subject edge = from \\\n edge_auth edge \\ {Receive, Reset, SyncSend}} \\\n\n (* Receivers on seL4RPC connections. *)\n {edge. \\to. to \\ fst ` set (components (composition spec)) \\\n (\\conn \\ set (connections (composition spec)).\n fst (conn_to (snd conn)) = to \\\n conn_type (snd conn) = seL4RPC \\\n edge_object edge = fst conn) \\\n edge_subject edge = to \\\n edge_auth edge \\ {Receive, Reset, SyncSend}} \\\n\n (* Senders on seL4Asynch connections. *)\n {edge. \\from. from \\ fst ` set (components (composition spec)) \\\n (\\conn \\ set (connections (composition spec)).\n fst (conn_from (snd conn)) = from \\\n conn_type (snd conn) = seL4Asynch \\\n edge_object edge = fst conn) \\\n edge_subject edge = from \\\n edge_auth edge \\ {Notify, Reset}} \\\n\n (* Receivers on seL4Asynch connections. *)\n {edge. \\to. to \\ fst ` set (components (composition spec)) \\\n (\\conn \\ set (connections (composition spec)).\n fst (conn_to (snd conn)) = to \\\n conn_type (snd conn) = seL4Asynch \\\n edge_object edge = fst conn) \\\n edge_subject edge = to \\\n edge_auth edge \\ {Receive, Reset}}\"\n\nlemma pw_decompose:\n \"\\\\agent. (\\agent'. (agent, Control, agent') \\ aag \\ agent = agent')\n \\ (\\a. (agent, a, agent) \\ aag);\n \\agent. policy_wellformed aag mirqs irqs agent\\\n \\ \\agent. policy_wellformed aag False irqs agent\"\n by (clarsimp simp:policy_wellformed_def)\n\nlemma no_trans_grant: \"subj = obj \\ (subj, Grant, obj) \\ policy_of spec extras irqs\"\n by (clarsimp simp:policy_of_def)\n\nlemma pw_control:\n \"\\policy_wellformed policy mirqs irqs l; (s, Receive, l) \\ policy\\ \\ (l, Control, s) \\ policy\"\n apply (rule_tac ep=l and mirqs=mirqs and irqs=irqs and l=l in aag_wellformed_grant_Control_to_recv)\n apply (rule_tac mirqs=mirqs and irqs=irqs in aag_wellformed_refl)\n by assumption+\n\nlemma pw_control':\n \"\\policy_wellformed policy mirqs irqs l; (s, Receive, l) \\ policy\\ \\ (s, Control, l) \\ policy\"\n apply (rule_tac ep=l and mirqs=mirqs and irqs=irqs and l=l in aag_wellformed_grant_Control_to_send)\n apply (rule_tac mirqs=mirqs and irqs=irqs in aag_wellformed_refl)\n by assumption+\n\nlemma pw_same_label:\n \"\\policy_wellformed policy mirqs irqs l; (s, Receive, l) \\ policy\\ \\ s = l\"\n apply (frule_tac s=s in pw_control, assumption)\n apply (frule_tac s=s in pw_control', assumption)\n apply (rule sym)\n apply (rule_tac aag=policy and mirqs=mirqs and irqs=irqs in aag_wellformed_Control)\n by assumption+\n\nlemma policy_wf: \"wellformed_assembly spec \\\n \\agent. policy_wellformed (policy_of spec extras irqs) False {irq_label} agent\"\n apply (clarsimp simp:policy_wellformed_def)\n apply (rule conjI)\n apply (clarsimp simp:policy_of_def)\n apply (rule conjI)\n apply (clarsimp simp:policy_of_def)\n apply clarsimp\n apply (rename_tac subj subj' obj)\n apply (cut_tac subj=subj and obj=obj and spec=spec and extras=extras and irqs=irqs in no_trans_grant)\n apply clarsimp\n oops\n\n(* TODO *)\ndefinition\n pas_of :: \"camkes_state \\ cdl_heap \\ irqs \\ label PAS set\"\nwhere\n \"pas_of spec extra irqs \\ {pas.\n pasObjectAbs pas = poa_of spec extra irqs \\\n (\\asid. pasASIDAbs pas asid = garbage) \\\n (\\irq. pasIRQAbs pas irq = irq_label) \\\n pasPolicy pas = policy_of spec extra irqs \\\n pasSubject pas \\ {garbage, irq_label} \\\n \\ pasMayActivate pas \\\n \\ pasMayEditReadyQueues pas \\\n \\ pasMaySendIrqs pas \\\n (\\domain. (domain = 0 \\ pasDomainAbs pas domain \\ garbage) \\\n (domain \\ 0 \\ pasDomainAbs pas domain = garbage))\n }\"\n\ntext {*\n Top-level state generator. We validate the capability extension and then use the low-level\n generator above.\n*}\ndefinition\n state_of :: \"camkes_state \\ cdl_heap \\ irqs \\ cdl_state option\"\nwhere\n \"state_of spec extra irqs \\\n if valid_extra (generate' spec) extra \\ valid_irqs (generate' spec) extra irqs then\n Some ((merge_objs\n (merge_objs (generate' spec) extra) (irqs_objects irqs))\n \\cdl_irq_node := irqs_map irqs\\)\n else\n None\"\n\nlemma state_of_implies_valid:\n \"state_of spec extra irqs = Some cdl \\ valid_extra (generate' spec) extra\"\n by (metis state_of_def option.distinct(1))\n\nlemma state_of_implies_valid2:\n \"state_of spec extra irqs = Some cdl \\ valid_irqs (generate' spec) extra irqs\"\n by (metis state_of_def option.distinct(1))\n\nlemma merge_contained:\n \"\\z = merge_cdl x y; cdl_objects z u = Some v\\\n \\ cdl_objects x u = Some v \\ cdl_objects y u = Some v\"\n by (clarsimp simp:merge_cdl_def)\n\nabbreviation \"obj_ids cdl \\ dom (cdl_objects cdl)\"\nabbreviation \"obj_ids' extra \\ dom extra\"\nabbreviation \"obj_count cdl \\ card (obj_ids cdl)\"\nabbreviation \"obj_count' extra \\ card (obj_ids' extra)\"\nabbreviation \"objs cdl \\ the ` (Set.filter is_some (range (cdl_objects cdl)))\"\nabbreviation \"objs' extra \\ the ` (Set.filter is_some (range extra))\"\n\nlemma valid_only_pds_pts_frames:\n \"valid_extra initial cdl \\ \\i \\ objs' cdl. case i of Types_D.PageDirectory _ \\ True\n | Types_D.PageTable _ \\ True\n | Types_D.Frame _ \\ True\n | _ \\ False\"\n apply (clarsimp simp:valid_extra_def)\n apply (erule_tac x=xa in allE)\n by (metis case_option_If2 Option.is_none_def)\n\nlemma cnode_objs_only_cnodes:\n \"\\(_, i) \\ set (cnode_objs spec). case i of Types_D.CNode _ \\ True | _ \\ False\"\n by (clarsimp simp:cnode_objs_def)\n\nlemma tcb_objs_only_tcbs: \"\\(_, i) \\ set (tcb_objs spec). case i of Types_D.Tcb _ \\ True | _ \\ False\"\n apply (clarsimp simp:tcb_objs_def)\n apply (erule disjE)\n by clarsimp+\n\nlemma ep_objs_only_eps:\n \"\\(_, i) \\ set (ep_objs spec). case i of Types_D.Endpoint \\ True | Types_D.Notification \\ True | _ \\ False\"\n apply (clarsimp simp:ep_objs_def ep_objs'_def)\n by (metis cdl_object.simps(98) cdl_object.simps(99))\n\nlemma generated_no_pds_pts_frames:\n \"generate' spec = cdl \\\n \\(\\x \\ objs cdl. case x of Types_D.PageDirectory _ \\ True\n | Types_D.PageTable _ \\ True\n | Types_D.Frame _ \\ True\n | _ \\ False)\"\n apply (clarsimp simp:generate'_def obj_heap_def)\n apply (subst (asm) helper15)+\n apply (case_tac \"map_of (map (\\(n, y). (the_id_of n, y)) (cnode_objs spec)) xa\")\n apply clarsimp\n apply (case_tac \"map_of (map (\\(n, y). (the_id_of n, y)) (tcb_objs spec)) xa\")\n apply clarsimp\n apply (case_tac \"map_of (map (\\(n, y). (the_id_of n, y)) (ep_objs spec)) xa\")\n apply (clarsimp; fail)\n apply clarsimp\n apply (insert ep_objs_only_eps[where spec=spec], clarsimp)\n apply (drule helper13)\n apply clarsimp\n apply (rename_tac a' b')\n apply (erule_tac x=\"(a', b')\" in ballE)\n apply clarsimp\n apply (case_tac b', simp_all)\n apply (insert tcb_objs_only_tcbs[where spec=spec], clarsimp)\n apply (drule helper13)\n apply clarsimp\n apply (rename_tac a' b')\n apply (erule_tac x=\"(a', b')\" and A=\"set (tcb_objs spec)\" in ballE)\n apply clarsimp\n apply (case_tac b', simp_all)\n apply (insert cnode_objs_only_cnodes[where spec=spec], clarsimp)\n apply (drule helper13)\n apply clarsimp\n apply (rename_tac a' b')\n apply (erule_tac x=\"(a', b')\" and A=\"set (cnode_objs spec)\" in ballE)\n apply clarsimp\n by (case_tac b', simp_all)\n\nlemma generated_objects_disjoint:\n \"state_of spec extra irqs = Some cdl \\\n obj_count (generate' spec) + obj_count' extra + obj_count' (irqs_objects irqs) = obj_count cdl\"\n apply (frule state_of_implies_valid, frule state_of_implies_valid2)\n apply (subst card_Un_disjoint[symmetric], simp_all)\n apply (clarsimp simp:helper12)\n apply (subst card_Un_disjoint[symmetric], simp_all)\n apply (subgoal_tac \"dom extra \\ dom (irqs_objects irqs) = {}\")\n prefer 2\n apply (rule ccontr)\n apply (subst (asm) not_empty_eq)\n apply clarsimp\n apply (rename_tac obj1 obj2)\n apply (clarsimp simp:valid_irqs_def)\n apply blast\n apply (clarsimp simp:valid_irqs_def)\n apply blast\n apply (clarsimp simp:state_of_def merge_cdl_def merge_objs_def)\n by (simp add: Un_assoc)\n\nlemma only_endpoint_caps:\n \"\\cap \\ ran (cap_map a xs). case cap of Types_D.EndpointCap _ _ _ \\ True\n | Types_D.NotificationCap _ _ _ \\ True\n | _ \\ False\"\n apply (clarsimp simp:cap_map_def)\n apply (subst (asm) ran_distinct)\n apply clarsimp+\n apply (drule helper16)\n apply clarsimp\n apply (rename_tac connection irrelevant)\n apply (case_tac \"conn_type connection = seL4RPC\", simp_all)\n by (case_tac \"from_component connection = xs\", simp_all)+\n\nlemma valid_only_empty_cnodes:\n \"valid_irqs spec extra irqs \\ \\obj \\ ran (irqs_objects irqs). case obj of\n Types_D.CNode c \\ c = \\cdl_cnode_caps = empty, cdl_cnode_size_bits = 0\\\n | _ \\ False\"\n by (clarsimp simp:valid_irqs_def)\n\nlemma only_endpoint_caps2:\n \"\\(name, cnode) \\ set (cnode_objs spec). case cnode of\n Types_D.CNode c \\ (\\cap \\ ran (cdl_cnode_caps c). case cap of\n Types_D.EndpointCap _ _ _ \\ True\n | Types_D.NotificationCap _ _ _ \\ True\n | _ \\ False)\n | _ \\ False\"\n apply (clarsimp simp:cnode_objs_def)\n apply (rename_tac name cap)\n apply (cut_tac a=spec and xs=name in only_endpoint_caps)\n apply (erule_tac x=cap in ballE)\n apply assumption\n by clarsimp\n\ntext {* All the caps in a generated spec are only to endpoints. *}\nlemma generated_caps_limited:\n \"state_of spec extra irqs = Some cdl \\\n \\cnode \\ ((\\c. case c of Types_D.CNode c' \\ c') `\n (Set.filter (\\c. case c of Types_D.CNode _ \\ True | _ \\ False)\n (Map.ran (cdl_objects cdl)))).\n \\cap \\ (Map.ran (cdl_cnode_caps cnode)).\n case cap of Types_D.EndpointCap _ _ _ \\ True\n | Types_D.NotificationCap _ _ _ \\ True\n | _ \\ False\"\n apply (clarsimp simp:state_of_def)\n apply (rename_tac cap)\n apply (subgoal_tac \"valid_extra (generate' spec) extra\")\n prefer 2\n apply (rule ccontr)\n apply clarsimp+\n apply (subgoal_tac \"valid_irqs (generate' spec) extra irqs\")\n prefer 2\n apply (rule ccontr)\n apply clarsimp+\n apply (drule helper23)\n apply (erule disjE)\n apply (drule helper23)\n apply (erule disjE)\n apply (clarsimp simp:generate'_def obj_heap_def)\n apply (drule helper19)\n apply (case_tac \"cnode \\ ran (map_of (map (\\(n, y). (the_id_of n, y)) (ep_objs spec)))\")\n apply (drule helper18)\n apply clarsimp\n apply (rename_tac name cnode)\n apply (cut_tac spec=spec in ep_objs_only_eps)\n apply (erule_tac x=\"(name, cnode)\" in ballE)\n apply clarsimp\n apply (case_tac cnode; simp_all)\n apply clarsimp\n apply (case_tac \"cnode \\ ran (map_of (map (\\(n, y). (the_id_of n, y)) (tcb_objs spec)))\")\n apply (drule helper18)\n apply clarsimp\n apply (rename_tac name cnode)\n apply (cut_tac spec=spec in tcb_objs_only_tcbs)\n apply (erule_tac x=\"(name, cnode)\" in ballE)\n apply clarsimp\n apply (case_tac cnode; simp_all)\n apply clarsimp\n apply clarsimp\n apply (drule helper18)\n apply clarsimp\n apply (rename_tac name cnode)\n apply (cut_tac spec=spec in only_endpoint_caps2)\n apply (erule_tac x=\"(name, cnode)\" in ballE)\n apply clarsimp\n apply (case_tac cnode; simp_all)\n apply clarsimp\n apply (drule valid_only_pds_pts_frames)\n apply (erule_tac x=cnode in ballE)\n apply (case_tac cnode; simp_all)\n apply (simp add: helper20)\n apply (drule valid_only_empty_cnodes)\n apply (erule_tac x=cnode in ballE)\n apply (case_tac cnode; simp_all)\n by clarsimp\n\ntext {* Compose the functions for producing a state and PAS into a single top-level generator. *}\ndefinition\n generate :: \"camkes_state \\ cdl_heap \\ irqs \\ (cdl_state \\ label PAS set) option\"\nwhere\n \"generate spec extra irqs \\\n case state_of spec extra irqs of Some state \\ Some (state, pas_of spec extra irqs)\n | None \\ None\"\n\nlemma \"\\generate spec extra irqs = Some (state, pases); pas \\ pases;\n (subject, Control, object) \\ pasPolicy pas\\\n \\ subject = object\"\n apply (clarsimp simp:generate_def pas_of_def policy_of_def)\n apply (case_tac \"state_of spec extra irqs\"; clarsimp)+\n done\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/camkes/cdl-refine/Generator_CAMKES_CDL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.31742627850202554, "lm_q1q2_score": 0.17600350090555986}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\n(* Kernel init refinement. Currently axiomatised.\n*)\n\ntheory ArchKernelInit_AI\nimports\n \"../ADT_AI\"\n \"../Tcb_AI\"\n \"../Arch_AI\"\nbegin\n\ncontext Arch begin global_naming ARM (*FIXME: arch_split*)\n\ntext {*\n Showing that there is a state that satisfies the abstract invariants.\n*}\n\n\n\nlemmas ptr_defs = init_tcb_ptr_def idle_thread_ptr_def init_irq_node_ptr_def \n init_globals_frame_def init_global_pd_def\nlemmas state_defs = init_A_st_def init_kheap_def init_arch_state_def ptr_defs \n\nlemma [simp]: \"is_tcb (TCB t)\" by (simp add: is_tcb_def)\n\nlemma [simp]: \"ran (empty_cnode n) = {Structures_A.NullCap}\"\n apply (auto simp: ran_def empty_cnode_def)\n apply (rule_tac x=\"replicate n False\" in exI)\n apply simp\n done\n\nlemma empty_cnode_apply[simp]:\n \"(empty_cnode n xs = Some cap) = (length xs = n \\ cap = Structures_A.NullCap)\"\n by (auto simp add: empty_cnode_def)\n\nlemma valid_cs_size_empty[simp]:\n \"valid_cs_size n (empty_cnode n) = (n < word_bits - cte_level_bits)\"\n apply (simp add: valid_cs_size_def)\n apply (insert wf_empty_bits [of n])\n apply fastforce\n done\n\nlemma init_cdt [simp]:\n \"cdt init_A_st = init_cdt\"\n by (simp add: state_defs)\n\nlemma mdp_parent_empty [simp]:\n \"\\empty \\ x \\ y\"\n apply clarsimp\n apply (drule tranclD)\n apply (clarsimp simp: cdt_parent_of_def)\n done\n\nlemma descendants_empty [simp]:\n \"descendants_of x empty = {}\"\n by (clarsimp simp: descendants_of_def)\n\nlemma [simp]: \"\\is_reply_cap Structures_A.NullCap\"\n by (simp add: is_reply_cap_def)\n\nlemma [simp]: \"cap_range Structures_A.NullCap = {}\"\n by (simp add: cap_range_def)\n\nlemma pde_mapping_bits_shift:\n fixes x :: \"12 word\"\n shows \"x \\ 0 \\ 2 ^ pde_mapping_bits - 1 < (ucast x << pde_mapping_bits :: word32)\"\n apply (simp only:shiftl_t2n pde_mapping_bits_def)\n apply (unfold word_less_alt)\n apply simp\n apply (unfold word_mult_def)\n apply simp\n apply (subst int_word_uint)\n apply (subst mod_pos_pos_trivial)\n apply simp\n apply simp\n apply (subst uint_up_ucast)\n apply (simp add: is_up_def source_size_def target_size_def word_size)\n apply (cut_tac 'a = \"12\" and x = x in uint_lt2p)\n apply simp\n apply (rule order_less_le_trans)\n prefer 2\n apply (rule pos_mult_pos_ge)\n apply (subst uint_up_ucast)\n apply (simp add: is_up_def source_size_def target_size_def word_size)\n apply (simp add: word_neq_0_conv word_less_alt)\n apply simp\n apply simp\n done \n\nlemma mask_pde_mapping_bits:\n \"mask 20 = 2^pde_mapping_bits - 1\"\n by (simp add: mask_def pde_mapping_bits_def)\n\n\n\nlemma init_irq_ptrs_ineqs:\n \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) \\ init_irq_node_ptr\"\n \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) + 2 ^ cte_level_bits - 1\n \\ init_irq_node_ptr + 2 ^ 14 - 1\"\n \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits)\n \\ init_irq_node_ptr + 2 ^ 14 - 1\"\nproof -\n have P: \"ucast irq < (2 ^ (14 - cte_level_bits) :: word32)\"\n apply (rule order_le_less_trans[OF \n ucast_le_ucast[where 'a=10 and 'b=32,simplified,THEN iffD2, OF word_n1_ge]])\n apply (simp add: cte_level_bits_def minus_one_norm)\n done\n show \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) \\ init_irq_node_ptr\"\n apply (rule is_aligned_no_wrap'[where sz=14])\n apply (simp add: is_aligned_def init_irq_node_ptr_def kernel_base_def)\n apply (rule shiftl_less_t2n[OF P])\n apply simp\n done\n show Q: \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) + 2 ^ cte_level_bits - 1\n \\ init_irq_node_ptr + 2 ^ 14 - 1\"\n apply (simp only: add_diff_eq[symmetric] add.assoc)\n apply (rule word_add_le_mono2)\n apply (simp only: trans [OF shiftl_t2n mult.commute])\n apply (rule nasty_split_lt[OF P])\n apply (simp_all add: cte_level_bits_def \n word_bits_def kernel_base_def init_irq_node_ptr_def)\n done\n show \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits)\n \\ init_irq_node_ptr + 2 ^ 14 - 1\"\n apply (simp only: add_diff_eq[symmetric])\n apply (rule word_add_le_mono2)\n apply (rule minus_one_helper3, rule shiftl_less_t2n[OF P])\n apply simp\n apply (simp add: kernel_base_def\n cte_level_bits_def word_bits_def init_irq_node_ptr_def)\n done\nqed\n\nlemmas init_irq_ptrs_less_ineqs\n = init_irq_ptrs_ineqs(1)[THEN order_less_le_trans[rotated]]\n init_irq_ptrs_ineqs(2-3)[THEN order_le_less_trans]\n\nlemmas init_irq_ptrs_all_ineqs[unfolded init_irq_node_ptr_def cte_level_bits_def]\n = init_irq_ptrs_ineqs(1)[THEN order_trans[rotated]]\n init_irq_ptrs_ineqs(2-3)[THEN order_trans]\n init_irq_ptrs_less_ineqs\n init_irq_ptrs_less_ineqs[THEN less_imp_neq]\n init_irq_ptrs_less_ineqs[THEN less_imp_neq, THEN not_sym]\n\nlemmas ucast_le_ucast_10_32 = ucast_le_ucast[where 'a=10 and 'b=32,simplified]\nlemma init_irq_ptrs_eq:\n \"((ucast (irq :: irq) << cte_level_bits)\n = (ucast (irq' :: irq) << cte_level_bits :: word32))\n = (irq = irq')\"\n apply safe\n apply (rule ccontr)\n apply (erule_tac bnd=\"ucast (max_word :: irq) + 1\"\n in shift_distinct_helper[rotated 3],\n safe intro!: plus_one_helper2,\n simp_all add: ucast_le_ucast_10_32 up_ucast_inj_eq,\n simp_all add: cte_level_bits_def word_bits_def up_ucast_inj_eq\n max_word_def)\n done\n\nlemma in_kernel_base:\n\"\\m < 0xFFFFF; n \\ 0xFFFFF\\ \\ (\\y\\{kernel_base + m .. n + kernel_base}.\n kernel_base \\ y \\ y \\ kernel_base + 0xFFFFF)\"\n apply (clarsimp simp:)\n apply (intro conjI)\n apply (rule ccontr,simp add:not_le)\n apply (drule(1) le_less_trans)\n apply (cut_tac is_aligned_no_wrap'[where ptr = kernel_base and off = m \n and sz = 28,simplified])\n apply (drule(1) less_le_trans)\n apply simp\n apply (simp add:kernel_base_def is_aligned_def)\n apply (rule ccontr,simp add:not_less)\n apply (drule less_le_trans[where z = \"0x10000000\"])\n apply simp\n apply simp\n apply (erule order_trans)\n apply (simp add:field_simps)\n apply (rule word_plus_mono_right)\n apply simp\n apply (simp add:kernel_base_def)\n done\n\nlemma pspace_aligned_init_A:\n \"pspace_aligned init_A_st\"\n apply (clarsimp simp: pspace_aligned_def state_defs wf_obj_bits [OF wf_empty_bits]\n dom_if_Some cte_level_bits_def)\n apply (safe intro!: aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl],\n simp_all add: is_aligned_def word_bits_def kernel_base_def)[1]\n done\n\nlemma pspace_distinct_init_A:\n \"pspace_distinct init_A_st\"\n apply (clarsimp simp: pspace_distinct_def state_defs pageBits_def\n empty_cnode_bits kernel_base_def\n cte_level_bits_def linorder_not_le cong: if_cong)\n apply (safe,\n simp_all add: init_irq_ptrs_all_ineqs\n [simplified kernel_base_def, simplified])[1]\n apply (cut_tac x=\"init_irq_node_ptr + (ucast irq << cte_level_bits)\"\n and y=\"init_irq_node_ptr + (ucast irqa << cte_level_bits)\"\n and sz=cte_level_bits in aligned_neq_into_no_overlap)\n apply (simp add: init_irq_node_ptr_def kernel_base_def cte_level_bits_def)\n apply (rule aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl])\n apply (simp add: is_aligned_def cte_level_bits_def init_irq_node_ptr_def\n kernel_base_def)\n apply (rule aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl])\n apply (simp add: is_aligned_def cte_level_bits_def init_irq_node_ptr_def\n kernel_base_def)\n apply (simp add: init_irq_node_ptr_def kernel_base_def cte_level_bits_def\n linorder_not_le)\n done\n\nlemma caps_of_state_init_A_st_Null:\n \"caps_of_state (init_A_st::'z::state_ext state) x\n = (if cte_at x (init_A_st::'z::state_ext state) then Some cap.NullCap else None)\"\n apply (subgoal_tac \"\\ cte_wp_at (op \\ cap.NullCap) x init_A_st\")\n apply (auto simp add: cte_wp_at_caps_of_state)[1]\n apply (clarsimp, erule cte_wp_atE)\n apply (auto simp add: state_defs tcb_cap_cases_def split: if_split_asm)\n done\n\nlemmas cte_wp_at_caps_of_state_eq\n = cte_wp_at_caps_of_state[where P=\"op = cap\" for cap]\n\ndeclare ptrFormPAddr_addFromPPtr[simp]\n\nlemma pspace_respects_device_region_init[simp]:\n \"pspace_respects_device_region init_A_st\"\n apply (clarsimp simp: pspace_respects_device_region_def init_A_st_def init_machine_state_def device_mem_def\n in_device_frame_def obj_at_def init_kheap_def a_type_def)\n apply (rule ext)\n apply clarsimp\n done\n\nlemma cap_refs_respects_device_region_init[simp]:\n \"cap_refs_respects_device_region init_A_st\"\n apply (clarsimp simp: cap_refs_respects_device_region_def)\n apply (frule cte_wp_at_caps_of_state[THEN iffD1])\n apply clarsimp\n apply (subst(asm) caps_of_state_init_A_st_Null)\n apply (clarsimp simp: cte_wp_at_caps_of_state cap_range_respects_device_region_def)\n done\n\nlemma invs_A:\n \"invs init_A_st\"\n\n apply (simp add: invs_def)\n apply (rule conjI)\n prefer 2\n apply (simp add: cur_tcb_def state_defs obj_at_def)\n apply (simp add: valid_state_def)\n apply (rule conjI)\n apply (simp add: valid_pspace_def)\n apply (rule conjI)\n apply (clarsimp simp: kernel_base_def valid_objs_def state_defs\n valid_obj_def valid_vm_rights_def vm_kernel_only_def\n dom_if_Some cte_level_bits_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_tcb_def tcb_cap_cases_def is_master_reply_cap_def \n valid_cap_def obj_at_def valid_tcb_state_def \n cap_aligned_def word_bits_def valid_ipc_buffer_cap_simps)+\n apply (clarsimp simp: valid_cs_def word_bits_def cte_level_bits_def\n init_irq_ptrs_all_ineqs valid_tcb_def\n split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: pspace_aligned_def state_defs wf_obj_bits [OF wf_empty_bits]\n dom_if_Some cte_level_bits_def)\n apply (safe intro!: aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl],\n simp_all add: is_aligned_def word_bits_def kernel_base_def)[1]\n apply (rule conjI)\n apply (simp add:pspace_distinct_init_A)\n apply (rule conjI)\n apply (clarsimp simp: if_live_then_nonz_cap_def obj_at_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: zombies_final_def cte_wp_at_cases state_defs \n tcb_cap_cases_def is_zombie_def)\n apply (clarsimp simp: sym_refs_def state_refs_of_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: valid_mdb_def init_cdt_def no_mloop_def \n mdb_cte_at_def)\n apply (clarsimp simp: untyped_mdb_def caps_of_state_init_A_st_Null\n untyped_inc_def ut_revocable_def\n irq_revocable_def reply_master_revocable_def\n reply_mdb_def reply_caps_mdb_def\n reply_masters_mdb_def)\n apply (simp add:descendants_inc_def)\n apply (rule conjI)\n apply (simp add: valid_ioc_def init_A_st_def init_ioc_def cte_wp_at_cases2)\n apply (intro allI impI, elim exE conjE)\n apply (case_tac obj, simp_all add: cap_of_def)\n apply (clarsimp simp: init_kheap_def split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: valid_idle_def pred_tcb_at_def obj_at_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: only_idle_def pred_tcb_at_def obj_at_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: if_unsafe_then_cap_def caps_of_state_init_A_st_Null)\n apply (clarsimp simp: valid_reply_caps_def unique_reply_caps_def\n has_reply_cap_def pred_tcb_at_def obj_at_def\n caps_of_state_init_A_st_Null\n cte_wp_at_caps_of_state_eq\n valid_reply_masters_def valid_global_refs_def\n valid_refs_def[unfolded cte_wp_at_caps_of_state])\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_state_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_asid_table_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_state_def obj_at_def state_defs \n a_type_def)\n apply (rule conjI)\n apply (simp add: valid_global_pts_def state_defs)\n apply (simp add: state_defs is_inv_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_irq_node_def obj_at_def state_defs\n is_cap_table_def wf_empty_bits\n init_irq_ptrs_all_ineqs cte_level_bits_def\n init_irq_ptrs_eq[unfolded cte_level_bits_def])\n apply (intro conjI)\n apply (rule inj_onI)\n apply (simp add: init_irq_ptrs_eq[unfolded cte_level_bits_def])\n apply clarsimp\n defer\n apply (simp add: valid_irq_handlers_def caps_of_state_init_A_st_Null\n ran_def cong: rev_conj_cong)\n apply (rule conjI)\n apply (clarsimp simp: valid_irq_states_def init_A_st_def init_machine_state_def valid_irq_masks_def init_irq_masks_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_machine_state_def init_A_st_def\n init_machine_state_def init_underlying_memory_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_objs_def obj_at_def state_defs)\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_caps_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_vs_lookup_def)\n apply (clarsimp simp: vs_lookup_pages_def state_defs vs_asid_refs_def)\n apply (clarsimp simp: valid_table_caps_def caps_of_state_init_A_st_Null\n unique_table_caps_def unique_table_refs_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_global_objs_def state_defs)\n apply (clarsimp simp: valid_ao_at_def obj_at_def empty_table_def pde_ref_def\n valid_pde_mappings_def)\n apply (simp add: kernel_base_def kernel_mapping_slots_def \n Platform.ARM.addrFromPPtr_def physMappingOffset_def\n kernelBase_addr_def physBase_def pageBits_def is_aligned_def)\n apply (rule conjI)\n apply (simp add: valid_kernel_mappings_def state_defs\n valid_kernel_mappings_if_pd_def pde_ref_def\n ran_def)\n apply (auto simp: pde_ref_def split: if_split_asm)[1]\n apply (rule conjI)\n apply (clarsimp simp: equal_kernel_mappings_def state_defs obj_at_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_asid_map_def state_defs)\n apply (rule conjI)\n apply (clarsimp simp: valid_global_vspace_mappings_def obj_at_def state_defs\n valid_pd_kernel_mappings_def mask_pde_mapping_bits)\n apply (simp add: valid_pde_kernel_mappings_def kernel_base_def)\n apply (rule conjI)\n apply (fastforce simp:pde_mapping_bits_def)\n apply (intro ballI impI)\n apply (clarsimp simp:pde_mapping_bits_def)\n apply word_bitwise\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: pspace_in_kernel_window_def state_defs mask_def)\n apply (intro conjI impI)\n apply (rule in_kernel_base|simp)+\n apply (erule exE,drule sym,simp add:field_simps)\n apply (rule in_kernel_base[simplified add.commute])\n apply (rule word_less_add_right,simp add:cte_level_bits_def)\n apply (rule less_le_trans[OF shiftl_less_t2n'[OF ucast_less]],simp+)[1]\n apply simp\n apply (simp add:cte_level_bits_def field_simps)\n apply (subst add.commute)\n apply (rule le_plus')\n apply simp+\n apply (rule less_imp_le)\n apply (rule less_le_trans[OF shiftl_less_t2n'[OF ucast_less]],simp+)[1]\n apply (rule in_kernel_base|simp)+\n apply (simp add: cap_refs_in_kernel_window_def caps_of_state_init_A_st_Null\n valid_refs_def[unfolded cte_wp_at_caps_of_state])\n apply word_bitwise\n done\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/ARM/ArchKernelInit_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.33111974622959367, "lm_q1q2_score": 0.17589391290629966}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory DetWP\nimports \"Lib.DetWPLib\" \"CBaseRefine.Include_C\"\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma det_wp_doMachineOp [wp]:\n \"det_wp (\\_. P) f \\ det_wp (\\_. P) (doMachineOp f)\"\n apply (simp add: doMachineOp_def split_def)\n apply (rule det_wp_pre, wp)\n apply (erule det_wp_select_f)\n apply wp+\n apply simp\n done\n\nlemma det_wp_loadWordUser [wp]:\n \"det_wp (pointerInUserData x and K (is_aligned x 3)) (loadWordUser x)\"\n apply (simp add: loadWordUser_def loadWord_def)\n apply (rule det_wp_pre, wp)\n apply (rule det_wp_pre, wp)\n apply clarsimp\n apply assumption\n apply wp\n apply (clarsimp simp: is_aligned_mask)\n done\n\ndeclare det_wp_liftM[wp]\n\ndeclare det_wp_assert_opt[wp]\n\ndeclare det_wp_when[wp]\n\ndeclare det_wp_unless[wp]\n\ndeclare word_neq_0_conv [simp del]\n\nlemma det_wp_loadObject_default [wp]:\n \"det_wp (\\s. \\obj. projectKO_opt ko = Some (obj::'a) \\\n is_aligned p (objBits obj) \\ q = p\n \\ case_option True (\\x. 2 ^ (objBits obj) \\ x - p) n)\n (loadObject_default p q n ko :: ('a::pre_storable) kernel)\"\n apply (simp add: loadObject_default_def split_def projectKO_def\n alignCheck_def alignError_def magnitudeCheck_def\n unless_def)\n apply (rule det_wp_pre)\n apply (wp case_option_wp)\n apply (clarsimp simp: is_aligned_mask[symmetric])\n apply simp\n done\n\nlemma det_wp_getTCB [wp]:\n \"det_wp (tcb_at' t) (getObject t :: tcb kernel)\"\n supply option.case_cong[cong]\n apply (simp add: getObject_def split_def)\n apply (rule det_wp_pre)\n apply (wp|wpc)+\n apply (clarsimp simp: obj_at'_def objBits_simps cong: conj_cong)\n apply (simp add: lookupAround2_known1)\n apply (rule ps_clear_lookupAround2, assumption+)\n apply simp\n apply (erule is_aligned_no_overflow)\n apply (simp add: word_bits_def)\n done\n\nlemma det_wp_setObject_other [wp]:\n fixes ob :: \"'a :: pspace_storable\"\n assumes x: \"updateObject ob = updateObject_default ob\"\n shows \"det_wp (obj_at' (\\k::'a. objBits k = objBits ob) ptr)\n (setObject ptr ob)\"\n apply (simp add: setObject_def x split_def updateObject_default_def\n magnitudeCheck_def\n projectKO_def2 alignCheck_def alignError_def)\n apply (rule det_wp_pre)\n apply (wp )\n apply (clarsimp simp: is_aligned_mask[symmetric] obj_at'_def objBits_def[symmetric]\n project_inject lookupAround2_known1)\n apply (erule(1) ps_clear_lookupAround2)\n apply simp\n apply (erule is_aligned_get_word_bits)\n apply (subst add_diff_eq[symmetric])\n apply (erule is_aligned_no_wrap')\n apply simp\n apply simp\n apply fastforce\n done\n\nlemma det_wp_setTCB [wp]:\n \"det_wp (tcb_at' t) (setObject t (v::tcb))\"\n apply (rule det_wp_pre)\n apply (wp|wpc|simp)+\n apply (clarsimp simp: objBits_simps)\n done\n\nlemma det_wp_threadGet [wp]:\n \"det_wp (tcb_at' t) (threadGet f t)\"\n apply (simp add: threadGet_def)\n apply (rule det_wp_pre, wp)\n apply simp\n done\n\nlemma det_wp_threadSet [wp]:\n \"det_wp (tcb_at' t) (threadSet f t)\"\n apply (simp add: threadSet_def)\n apply (rule det_wp_pre, wp)\n apply simp\n done\n\nlemma det_wp_asUser [wp]:\n \"det f \\ det_wp (tcb_at' t) (asUser t f)\"\n apply (simp add: asUser_def split_def)\n apply (rule det_wp_pre)\n apply wp\n apply (drule det_wp_det)\n apply (erule det_wp_select_f)\n apply wp+\n apply (rule_tac Q=\"\\_. tcb_at' t\" in hoare_post_imp)\n apply simp\n apply wp\n apply simp\n done\n\n(* FIXME move into Refine somewhere *)\nlemma wordSize_def':\n \"wordSize = 8\"\n unfolding wordSize_def wordBits_def\n by (simp add: word_size)\n\nlemma det_wp_getMRs:\n \"det_wp (tcb_at' thread and case_option \\ valid_ipc_buffer_ptr' buffer) (getMRs thread buffer mi)\"\n apply (clarsimp simp: getMRs_def)\n apply (rule det_wp_pre)\n apply (wp det_mapM det_getRegister order_refl det_wp_mapM)\n apply (simp add: word_size)\n apply (wp asUser_inv mapM_wp' getRegister_inv)\n apply clarsimp\n apply (rule conjI)\n apply (simp add: pointerInUserData_def wordSize_def' word_size)\n apply (erule valid_ipc_buffer_ptr'D2[unfolded word_size_def, simplified])\n apply (rule word_mult_less_mono1)\n apply (erule order_le_less_trans)\n apply (simp add: msgMaxLength_def max_ipc_words)\n apply simp\n apply (simp add: max_ipc_words)\n apply (simp add: is_aligned_mult_triv2 [where n = 3, simplified] word_bits_conv word_size_bits_def)\n apply (erule valid_ipc_buffer_ptr_aligned_word_size_bits[simplified word_size_bits_def])\n apply (simp add: wordSize_def' is_aligned_mult_triv2 [where n = 3, simplified] word_bits_conv)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/RISCV64/DetWP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.33111973302838926, "lm_q1q2_score": 0.17589391080854103}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory CommonOpsLemmas\n\nimports\n \"CommonOps\"\nbegin\n\nlemma fold_all_htd_updates':\n \"ptr_retyp (p :: ('a :: c_type) ptr)\n = all_htd_updates TYPE('a) 1 (ptr_val p) 1\"\n \"(if P then (f :: heap_typ_desc \\ heap_typ_desc) else g) s\n = (if P then f s else g s)\"\n \"\\ n < 2 ^ word_bits \\ \\\n ptr_retyps n p = all_htd_updates TYPE('a) 1 (ptr_val p) (of_nat n)\"\n \"\\ n < 2 ^ word_bits \\ \\\n ptr_retyps (2 ^ n) p = all_htd_updates TYPE('a) 3 (ptr_val p) (of_nat n)\"\n \"n < 2 ^ word_bits \\ typ_clear_region x n = all_htd_updates TYPE(machine_word) 0 x (of_nat n)\"\n \"n < 2 ^ word_bits \\ typ_region_bytes x n = all_htd_updates TYPE(machine_word) 2 x (of_nat n)\"\n \"\\ n < 2 ^ word_bits \\ \\\n ptr_arr_retyps n p = all_htd_updates TYPE('a) 4 (ptr_val p) (of_nat n)\"\n \"\\ n < 2 ^ word_bits \\ \\\n ptr_arr_retyps (2 ^ n) p = all_htd_updates TYPE('a) 5 (ptr_val p) (of_nat n)\"\n by (simp_all add: all_htd_updates_def fun_eq_iff word_bits_conv take_bit_nat_eq_self unat_of_nat)\n\nlemma upcast_unat_less_2p_length:\n \"is_up UCAST('a :: len \\ 'b :: len) \\ unat (x :: 'a word) < 2 ^ LENGTH('b)\"\n by (simp add: is_up unat_pow_le_intro)\n\n(* FIXME: this is a hack that happens to work on all arches. Use arch split. *)\nlemma is_up_u32_word_size: \"is_up UCAST(32 \\ machine_word_len)\"\n by (clarsimp simp add: is_up_def source_size target_size)\n\nlemma is_up_i32_word_size: \"is_up UCAST(32 signed \\ machine_word_len)\"\n by (clarsimp simp add: is_up_def source_size target_size)\n\n(* This proof is a bit convoluted so that it happens to work with word_bits = 32 and 64 *)\nlemma unat_word32_less_2p_word_bits: \"unat (x :: 32 word) < 2 ^ word_bits\"\n unfolding word_bits_def by (rule upcast_unat_less_2p_length, rule is_up_u32_word_size)\n\nlemma unat_sword32_less_2p_word_bits: \"unat (x :: 32 signed word) < 2 ^ word_bits\"\n by (rule upcast_unat_less_2p_length[OF is_up_i32_word_size, simplified word_bits_def[symmetric]])\n\nlemmas fold_all_htd_updates_intermediate\n = fold_all_htd_updates'\n fold_all_htd_updates'(3-)[OF unat_less_2p_word_bits]\n fold_all_htd_updates'(3-)[OF unat_word32_less_2p_word_bits]\n fold_all_htd_updates'(3-)[OF unat_sword32_less_2p_word_bits]\n\nlemmas fold_all_htd_updates = fold_all_htd_updates_intermediate[simplified word_bits_conv]\n\nlemma signed_div_range_check:\n assumes len: \"size a > 1\"\n shows\n \"(sint a sdiv sint b = sint (a sdiv b))\n = (a \\ (- (2 ^ (size a - 1))) \\ b \\ -1)\"\nproof -\n have sints: \"(sint (1 :: 'a word)) = 1\"\n \"(sint (-1 :: 'a word)) = -1\"\n \"(sint (0 :: 'a word)) = 0\"\n using len\n apply (simp_all add: word_size)\n done\n have abs_sint_gt_1:\n \"b \\ 0 \\ b \\ 1 \\ b \\ -1 \\ abs (sint b) > 1\"\n apply (fold word_sint.Rep_inject,\n simp only: sints abs_if split: if_split)\n apply arith\n done\n have mag: \"(a \\ (- (2 ^ (size a - 1))) \\ (b \\ -1 \\ b \\ 1))\n \\ abs (abs (sint a) div abs (sint b)) < 2 ^ (size a - 1)\"\n using word_sint.Rep_inject[where x=a and y=\"- (2 ^ (size a - 1))\"]\n word_sint.Rep_inject[where x=b and y=1]\n apply (simp add: word_size sint_int_min sints)\n apply (simp add: nonneg_mod_div)\n apply (cases \"b = 0\")\n apply simp\n apply (erule impCE)\n apply (rule order_le_less_trans, rule zdiv_le_dividend, simp_all)\n apply (cut_tac x=a in sint_range')\n apply (clarsimp simp add: abs_if word_size)\n apply (cases \"a = 0\", simp_all)\n apply (rule order_less_le_trans, rule int_div_less_self, simp_all)\n apply (rule abs_sint_gt_1, simp)\n apply (cut_tac x=a in sint_range')\n apply (clarsimp simp add: abs_if word_size)\n done\n note sint_of_int_eq[simp] signed_take_bit_int_eq_self[simp]\n show ?thesis using mag len\n apply (cases \"b = 1\")\n apply (case_tac \"size a\", simp_all)[1]\n apply (case_tac nat, simp_all add: sint_word_ariths word_size)[1]\n apply (simp add: sdiv_int_def sdiv_word_def del: of_int_mult)\n apply (simp add: sbintrunc_eq_in_range range_sbintrunc sgn_if)\n apply (safe, simp_all add: word_size sint_int_min sint_int_max_plus_1;\n simp add: sint_word_ariths)\n done\nqed\n\nlemma ptr_add_assertion_uintD:\n \"ptr_add_assertion ptr (uint (x :: ('a :: len) word)) strong htd\n \\ (x = 0 \\ array_assertion ptr (if strong then unat (x + 1) else unat x) htd)\"\n by (auto simp: unat_plus_if_size intro: array_assertion_shrink_right)\n\nlemma sint_uint_sless_0_if:\n \"sint x = (if x (x = 0 \\ (x array_assertion (ptr +\\<^sub>p sint x)\n (unat (- x)) htd)\n \\ (x \\ 0 \\ \\ x array_assertion ptr (if strong then unat (x + 1) else unat x) htd))\"\n apply (simp add: ptr_add_assertion_def word_sless_alt\n sint_uint_sless_0_if[THEN arg_cong[where f=\"\\x. - x\"]]\n sint_uint_sless_0_if[THEN arg_cong[where f=nat]]\n unat_plus_if_size)\n apply (simp add: array_assertion_shrink_right)\n apply (auto simp: linorder_not_less)\n done\n\n\\ \\\n Some lemmas used by both SimplExport and ProveGraphRefine.\n\\\n\nlemmas sdiv_word_max_ineq = sdiv_word_max[folded zle_diff1_eq, simplified]\n\nlemmas signed_mult_eq_checks_all =\n signed_mult_eq_checks_double_size[where 'a=\"32\" and 'b=\"64\", simplified]\n signed_mult_eq_checks_double_size[where 'a=\"32 signed\" and 'b=\"64 signed\", simplified]\n signed_mult_eq_checks_double_size[where 'a=\"64\" and 'b=\"128\", simplified]\n signed_mult_eq_checks_double_size[where 'a=\"64 signed\" and 'b=\"128 signed\", simplified]\n\nlemmas signed_arith_ineq_checks_to_eq_all =\n signed_arith_ineq_checks_to_eq[where 'a=\"32\"]\n signed_arith_ineq_checks_to_eq[where 'a=\"32\", simplified word_size, simplified]\n signed_arith_ineq_checks_to_eq[where 'a=\"32 signed\"]\n signed_arith_ineq_checks_to_eq[where 'a=\"32 signed\", simplified word_size, simplified]\n signed_arith_ineq_checks_to_eq[where 'a=\"64\"]\n signed_arith_ineq_checks_to_eq[where 'a=\"64\", simplified word_size, simplified]\n signed_arith_ineq_checks_to_eq[where 'a=\"64 signed\"]\n signed_arith_ineq_checks_to_eq[where 'a=\"64 signed\", simplified word_size, simplified]\n\nlemmas signed_div_range_check_all =\n signed_div_range_check[where 'a=\"32\", simplified word_size, simplified]\n signed_div_range_check[where 'a=\"32 signed\", simplified word_size, simplified]\n signed_div_range_check[where 'a=\"64\", simplified word_size, simplified]\n signed_div_range_check[where 'a=\"64 signed\", simplified word_size, simplified]\n\nlemma word32_31_less:\n \"31 < len_of TYPE (32 signed)\" \"31 > (0 :: nat)\"\n \"31 < len_of TYPE (32)\" \"31 > (0 :: nat)\"\n by auto\n\nlemma word64_31_less:\n \"31 < len_of TYPE (64 signed)\" \"31 > (0 :: nat)\"\n \"31 < len_of TYPE (64)\" \"31 > (0 :: nat)\"\n by auto\n\nlemmas signed_shift_guard_to_word_all =\n signed_shift_guard_to_word[OF word32_31_less(1-2)]\n signed_shift_guard_to_word[OF word32_31_less(3-4)]\n signed_shift_guard_to_word[OF word64_31_less(1-2)]\n signed_shift_guard_to_word[OF word64_31_less(3-4)]\n\nlemmas guard_arith_simps =\n neg_le_iff_le\n signed_arith_eq_checks_to_ord\n signed_arith_ineq_checks_to_eq_all\n signed_div_range_check_all\n signed_mult_eq_checks_all\n signed_shift_guard_to_word_all\n sdiv_word_min[THEN eqTrueI] sdiv_word_max_ineq\n\n(* FIXME: move to word lib *)\nlemma small_downcasts:\n \"unat (x :: 'a :: len word) < 2 ^ LENGTH('b :: len) \\ unat (UCAST('a \\ 'b) x) = unat x\"\n apply (case_tac \"LENGTH('a) \\ LENGTH('b)\", simp add: unat_ucast_up_simp)\n apply (simp add: unat_ucast unat_less_power)\n done\n\n(* FIXME: move to word lib *)\nlemma less_shift_makes_shift_cast_safe:\n \"y < (a :: 'a :: len word) >> unat (x :: 'b :: len word) \\\n unat (UCAST('b \\ 'a) x) = unat x\"\n apply (prop_tac \"unat x < LENGTH('a)\")\n apply (rotate_tac)\n apply (erule contrapos_pp; simp add: not_less)\n apply (prop_tac \"a >> unat x = 0\")\n apply (rule shiftr_eq_0; simp)\n apply simp\n apply (subst small_downcasts)\n apply (meson le_less_trans n_less_equal_power_2 nat_less_le)\n apply simp\n done\n\nlemmas less_shift_makes_shift_cast_safe_arg_cong =\n arg_cong[where f=\"f w\" for f w, OF less_shift_makes_shift_cast_safe]\n\n\\ \\\n @{thm less_shift_makes_shift_cast_safe} allows us to\n remove the `ucast` in `unat (ucast x)`, but this loses potentially important\n type information. These rules act as \"lenses\" to make sure we only modify\n the relevant ucasts (the ones that show up in the guards of translated\n nontrivial shifts).\n\\\nlemmas less_shift_targeted_cast_convs =\n less_shift_makes_shift_cast_safe_arg_cong[where f=shiftr]\n less_shift_makes_shift_cast_safe_arg_cong[where f=\"(^)\"]\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/CommonOpsLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.33111973962899144, "lm_q1q2_score": 0.17589390939999788}} {"text": "(*\nCopyright 2018\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*)\ntheory HTriple\n imports U_exec\nbegin\n\ndatatype ACode =\n Block nat \\64 word\\ nat\n| Seq ACode ACode (infixr \";\" 70)\n| ITE state_pred ACode ACode (\"IF _ THEN _ ELSE _ FI\")\n| ACode_WHILE state_pred ACode (\"WHILE _ DO _ OD\")\n| CASES \"(state_pred \\ ACode) list\"\n| CALL ACode (* maybe update to \\64 word\\ ACode eventually to merge the call inst block with the actual call *)\n| Skip\n\ncontext exec_code\nbegin\n\ninductive while_semantics where\n \"\\ B \\ \\ while_semantics B body \\ \\\"\n| \"B \\ \\ body \\ \\'' \\ while_semantics B body \\'' \\' \\ while_semantics B body \\ \\'\"\n\nfun exec_acode :: \"ACode \\ state \\ state \\ bool\" where\n \"exec_acode (Block si end ii) \\ \\' = (\\' = exec_block si end ii \\)\"\n| \"exec_acode (a;b) \\ \\'' = (\\\\'. exec_acode a \\ \\' \\ exec_acode b \\' \\'')\"\n| \"exec_acode (IF f THEN a ELSE b FI) \\ \\' = (\n if f \\ then\n exec_acode a \\ \\'\n else\n exec_acode b \\ \\'\n )\"\n| \"exec_acode (WHILE B DO b OD) \\ \\' = while_semantics B (exec_acode b) \\ \\'\"\n| \"exec_acode (CASES x) \\ \\' = (\\ (P,a) \\ list.set x . P \\ \\ exec_acode a \\ \\')\"\n| \"exec_acode (CALL f) \\ \\' = exec_acode f \\ \\'\"\n| \"exec_acode Skip \\ \\' = (\\' = \\)\"\n\ndefinition usage :: \"(64 word \\ nat) set \\ state \\ state \\ bool\"\n where \"usage regions \\ \\' \\ \\a. no_block_overflow (a, 1) \\ (\\r\\regions. (a, 1) \\ r) \\ (\\r\\regions. \\ (a, 1) \\ r) \\ (\\' \\ *[a,1]) = (\\ \\ *[a,1]::8 word)\"\n\ndefinition block_usage :: \"(state \\ (nat \\ 64 word \\ nat) set) \\ state \\ state \\ bool\"\n where \"block_usage regions \\ \\' \\ \\a. no_block_overflow (a, 1) \\ (\\r\\regions \\. (a, 1) \\ snd r) \\ (\\r\\regions \\. \\ (a, 1) \\ snd r) \\ (\\' \\ *[a,1]) = (\\ \\ *[a,1]::8 word)\"\n\ndefinition HTriple_for_memory_preservation :: \"state_pred \\ ACode \\ state_pred \\ (64 word \\ nat) set \\ bool\" (\"{{_}} _{{_;_}}\") where\n \"HTriple_for_memory_preservation P a Q M \\ \\\\ \\'. P \\ \\ exec_acode a \\ \\' \\ Q \\' \\ usage M \\ \\'\"\n\n\ntext \\\n Let @{term f} be a function body.\n A black-box Hoare triple indicates that the memory usage of @{term f} has been verified and is\n represented by memory predicate @{term M\\<^sub>f}.\n In order to composably reuse that verification effort, @{term f} is considered black-box.\n The precondition @{term P} represents the state right after the assembly instruction CALL.\n That precondition may contain terms that reason over memory of the caller, e.g., [a,8] == RBP,\n where [a,8] denotes some part of the stack frame of the caller.\n Such terms are not in the pre-/postcondition of the called function.\n However, they must be proven to be preserved by the function call.\n That proof is based on the memory usage of @{term f}.\n\n A proof over @{term f} can thus be reused, if:\n \\<^enum> there exists a Hoare triple over @{term f}.\n \\<^enum> preconditon @{term P} can be separated into two parts, one that is relevant to the called\n function, one that is irrelevant to the called function\n \\<^enum> the irrelevant part is preserved by @{term f}, and this can be proven based on the memory\n predicate @{term M\\<^sub>f}\n \\<^enum> the postcondition of @{term f} combined with the irrelevant part of the precondition of\n @{term f} implies the postcondition @{term Q}\n\\\n\ndefinition HTriple_blackbox :: \"state_pred \\ ACode \\ state_pred \\ (64 word \\ nat) set \\ bool\" (\"{{_}} \\_ {{_;_}}\")\n where \"HTriple_blackbox P f Q M\\<^sub>f \\ \\ P\\<^sub>f Q\\<^sub>f P\\<^sub>s\\<^sub>e\\<^sub>p .\n ({{P\\<^sub>f}} f {{Q\\<^sub>f;M\\<^sub>f}}) \\ \\1.\\\n \\ (\\ P \\ P\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p) \\ \\2.\\\n \\ (\\s s'. usage M\\<^sub>f s s' \\ P\\<^sub>s\\<^sub>e\\<^sub>p s \\ P\\<^sub>s\\<^sub>e\\<^sub>p s') \\ \\3.\\\n \\ (\\ Q\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p \\ Q)\" \\ \\4.\\\n\ntext \\To introduce a Hoare triple for a basic block, it must be shown that:\n\\<^enum> for any state satisfying the precondition, executing the block produces a memory predicate\n @{term mp} whose state satisfies postcondition Q\n\\<^enum> the memory usage of the block wrt to the initial state is given by @{term mp}, but may need to be\n translated by @{term t} if the predicate contains state-sensitive terms. Often @{term t} is equal\n to @{term id}.\n\\\n\nlemma HTriple_I:\n assumes \"\\\\. P \\ \\ exec_block si a i \\ \\ t \\ \\ Q (t \\) \\ block_usage regions \\ (t \\)\"\n and \"M = {r. \\\\. P \\ \\ r \\ snd ` regions \\}\"\n shows \"{{P}} Block si a i {{Q;M}}\"\n apply (simp add: HTriple_for_memory_preservation_def)\n apply (rule allI)\n subgoal for \\\n using assms(1)[of \\] assms(2-)\n unfolding block_usage_def usage_def eq_def\n by (auto simp add: pred_logic) (metis (no_types, hide_lams) image_eqI no_block_overflow.cases)\n done\n\nlemma HTriple_seq:\n assumes \"{{P}} a {{Q;M\\<^sub>1}}\"\n and \"{{Q}} b {{R;M\\<^sub>2}}\"\n and \"M = M\\<^sub>1 \\ M\\<^sub>2\"\n shows \"{{P}} a;b {{R;M}}\"\n unfolding HTriple_for_memory_preservation_def\n apply auto\n subgoal for s s' s''\n using assms(1)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s s'']\n assms(2)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s'' s']\n assms(3)\n by simp\n subgoal for s s' s''\n using assms(1)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s s'']\n assms(2)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s'' s']\n assms(3)\n by (auto simp add: usage_def)\n done\n\nlemma HTriple_ite:\n assumes \"{{P && f}} a {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"{{P && !f}} b {{Q\\<^sub>2;M\\<^sub>2}}\"\n and \"Q = (Q\\<^sub>1 || Q\\<^sub>2)\"\n and \"M\\<^sub>3 = M\\<^sub>1 \\ M\\<^sub>2\"\n shows \"{{P}} IF f THEN a ELSE b FI {{Q;M\\<^sub>3}}\"\n using assms\n unfolding HTriple_for_memory_preservation_def\n apply (auto simp add: pred_logic)\n subgoal for s s'\n using assms(1)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s s']\n assms(2)[unfolded HTriple_for_memory_preservation_def, THEN spec, THEN spec, of s s']\n by (simp add: usage_def)\n subgoal for s s'\n using assms(1)[unfolded HTriple_for_memory_preservation_def,THEN spec,THEN spec,of s s']\n assms(2)[unfolded HTriple_for_memory_preservation_def,THEN spec,THEN spec,of s s']\n assms(3-)\n by (simp add: usage_def)\n done\n\nlemma HTriple_while:\n assumes \"{{I && B}} b {{I';M}}\"\n and \"\\ I' \\ I\"\n shows \"{{I}} WHILE B DO b OD {{I && !B;M}}\"\nproof-\n {\n fix s s' :: state\n fix body :: \"state \\ state \\ bool\"\n assume \"while_semantics B body s s'\"\n and \"\\ s s' . body s s' \\ I s \\ B s \\ I' s' \\ usage M s s'\"\n and \"I s\"\n hence \"I s' \\ \\B s' \\ usage M s s'\"\n proof(induct rule: while_semantics.induct)\n case (1 B \\ body)\n thus ?case\n by (auto simp add: usage_def)\n next\n case (2 B \\ body \\'' \\')\n thus ?case\n using assms(2)\n by (auto simp add: usage_def pred_logic)\n qed\n }\n note 1 = this\n have 2: \"\\ s s' . exec_acode b s s' \\ I s \\ B s \\ I' s' \\ usage M s s'\"\n using assms(1)\n by (auto simp add: pred_logic HTriple_for_memory_preservation_def)\n note 3 = 1[OF _ 2]\n thus ?thesis\n by (auto simp add: pred_logic HTriple_for_memory_preservation_def)\nqed\n\nlemma HTriple_cases1:\n assumes \"{{fst x}} snd x {{Q;M}}\"\n shows \"{{P}} CASES [x] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_cases2:\n assumes \"{{fst x\\<^sub>0}} snd x\\<^sub>0 {{Q\\<^sub>0;M\\<^sub>0}}\"\n and \"{{fst x\\<^sub>1}} snd x\\<^sub>1 {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"Q = (Q\\<^sub>0 || Q\\<^sub>1)\"\n and \"M = M\\<^sub>0 \\ M\\<^sub>1\"\n shows \"{{P}} CASES [x\\<^sub>0,x\\<^sub>1] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_cases3:\n assumes \"{{fst x\\<^sub>0}} snd x\\<^sub>0 {{Q\\<^sub>0;M\\<^sub>0}}\"\n and \"{{fst x\\<^sub>1}} snd x\\<^sub>1 {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"{{fst x\\<^sub>2}} snd x\\<^sub>2 {{Q\\<^sub>2;M\\<^sub>2}}\"\n and \"Q = (Q\\<^sub>0 || Q\\<^sub>1 || Q\\<^sub>2)\"\n and \"M = \\ {M\\<^sub>0 ,M\\<^sub>1, M\\<^sub>2}\"\n shows \"{{P}} CASES [x\\<^sub>0,x\\<^sub>1,x\\<^sub>2] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_cases4:\n assumes \"{{fst x\\<^sub>0}} snd x\\<^sub>0 {{Q\\<^sub>0;M\\<^sub>0}}\"\n and \"{{fst x\\<^sub>1}} snd x\\<^sub>1 {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"{{fst x\\<^sub>2}} snd x\\<^sub>2 {{Q\\<^sub>2;M\\<^sub>2}}\"\n and \"{{fst x\\<^sub>3}} snd x\\<^sub>3 {{Q\\<^sub>3;M\\<^sub>3}}\"\n and \"Q = (Q\\<^sub>0 || Q\\<^sub>1 || Q\\<^sub>2 || Q\\<^sub>3)\"\n and \"M = \\ {M\\<^sub>0, M\\<^sub>1, M\\<^sub>2, M\\<^sub>3}\"\n shows \"{{P}} CASES [x\\<^sub>0,x\\<^sub>1,x\\<^sub>2,x\\<^sub>3] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_cases5:\n assumes \"{{fst x\\<^sub>0}} snd x\\<^sub>0 {{Q\\<^sub>0;M\\<^sub>0}}\"\n and \"{{fst x\\<^sub>1}} snd x\\<^sub>1 {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"{{fst x\\<^sub>2}} snd x\\<^sub>2 {{Q\\<^sub>2;M\\<^sub>2}}\"\n and \"{{fst x\\<^sub>3}} snd x\\<^sub>3 {{Q\\<^sub>3;M\\<^sub>3}}\"\n and \"{{fst x\\<^sub>4}} snd x\\<^sub>4 {{Q\\<^sub>4;M\\<^sub>4}}\"\n and \"Q = (Q\\<^sub>0 || Q\\<^sub>1 || Q\\<^sub>2 || Q\\<^sub>3 || Q\\<^sub>4)\"\n and \"M = \\ {M\\<^sub>0, M\\<^sub>1, M\\<^sub>2, M\\<^sub>3, M\\<^sub>4}\"\n shows \"{{P}} CASES [x\\<^sub>0,x\\<^sub>1,x\\<^sub>2,x\\<^sub>3,x\\<^sub>4] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_cases6:\n assumes \"{{fst x\\<^sub>0}} snd x\\<^sub>0 {{Q\\<^sub>0;M\\<^sub>0}}\"\n and \"{{fst x\\<^sub>1}} snd x\\<^sub>1 {{Q\\<^sub>1;M\\<^sub>1}}\"\n and \"{{fst x\\<^sub>2}} snd x\\<^sub>2 {{Q\\<^sub>2;M\\<^sub>2}}\"\n and \"{{fst x\\<^sub>3}} snd x\\<^sub>3 {{Q\\<^sub>3;M\\<^sub>3}}\"\n and \"{{fst x\\<^sub>4}} snd x\\<^sub>4 {{Q\\<^sub>4;M\\<^sub>4}}\"\n and \"{{fst x\\<^sub>5}} snd x\\<^sub>5 {{Q\\<^sub>5;M\\<^sub>5}}\"\n and \"Q = (Q\\<^sub>0 || Q\\<^sub>1 || Q\\<^sub>2 || Q\\<^sub>3 || Q\\<^sub>4 || Q\\<^sub>5)\"\n and \"M = \\ {M\\<^sub>0, M\\<^sub>1, M\\<^sub>2, M\\<^sub>3, M\\<^sub>4, M\\<^sub>5}\"\n shows \"{{P}} CASES [x\\<^sub>0,x\\<^sub>1,x\\<^sub>2,x\\<^sub>3,x\\<^sub>4,x\\<^sub>5] {{Q;M}}\"\n using assms\n by (auto simp add: HTriple_for_memory_preservation_def usage_def)\n\nlemma HTriple_skip:\n assumes \"M = {}\"\n and \"Q = P\"\n shows \"{{P}} Skip {{Q;M}}\"\n using assms\n unfolding HTriple_for_memory_preservation_def\n by (auto simp add: usage_def pred_logic)\n\nlemma HTriple_weaken:\n assumes \\\\ P' \\ P\\\n and \\{{P}} b {{Q;M}}\\\n shows \\{{P'}} b {{Q;M}}\\\n using assms\n unfolding HTriple_for_memory_preservation_def\n by (auto simp add: pred_logic)\n\nlemma HTriple_strengthen:\n assumes \\\\ Q \\ Q'\\\n and \\{{P}} b {{Q;M}}\\\n shows \\{{P}} b {{Q';M}}\\\n using assms\n unfolding HTriple_for_memory_preservation_def\n by (auto simp add: pred_logic)\n\nlemma HTriple_blackbox:\n assumes \\{{P}} \\f {{Q;M\\<^sub>f}}\\\n shows \\{{P}} CALL f {{Q;M\\<^sub>f}}\\\nproof -\n from assms(1) obtain P\\<^sub>f Q\\<^sub>f P\\<^sub>s\\<^sub>e\\<^sub>p where\n 0: \\{{P\\<^sub>f}} f {{Q\\<^sub>f;M\\<^sub>f}}\\\n and 1: \"\\ P \\ P\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p\"\n and 2: \"\\s s'. usage M\\<^sub>f s s' \\ P\\<^sub>s\\<^sub>e\\<^sub>p s \\ P\\<^sub>s\\<^sub>e\\<^sub>p s'\"\n and 3: \"\\ Q\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p \\ Q\"\n unfolding HTriple_blackbox_def\n by auto\n thus ?thesis\n unfolding HTriple_for_memory_preservation_def\n by (simp add: pred_logic) blast\nqed\n\ntext \\\n For each called function, a black-box Hoare triple is assumed. If the called function is within\n the same binary, this lemma can be used to discharge that assumption.\n\\\nlemma Htriple_blackbox_I:\n assumes \\{{P\\<^sub>f}} f {{Q\\<^sub>f;M\\<^sub>f}}\\\n and \\\\ P \\ P\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p\\\n and \\\\s s'. usage M\\<^sub>f s s' \\ P\\<^sub>s\\<^sub>e\\<^sub>p s \\ P\\<^sub>s\\<^sub>e\\<^sub>p s'\\\n and \\\\ Q\\<^sub>f && P\\<^sub>s\\<^sub>e\\<^sub>p \\ Q\\\n shows \\{{P}} \\f {{Q;M\\<^sub>f}}\\\n using assms\n by (auto simp add: HTriple_blackbox_def)\n\nlemmas htriples = HTriple_I HTriple_seq HTriple_ite HTriple_blackbox HTriple_cases1 HTriple_cases2\n HTriple_cases3 HTriple_cases4 HTriple_cases5 HTriple_cases6 HTriple_skip\n\nend\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/VCG/HTriple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.33807711081161995, "lm_q1q2_score": 0.175638267530597}} {"text": "(* Title: JinjaThreads/BV/Effect.thy\n Author: Gerwin Klein, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Effect of Instructions on the State Type} *}\n\ntheory Effect\nimports\n JVM_SemiType\n \"../JVM/JVMExceptions\"\nbegin\n\nlocale jvm_method = prog +\n fixes mxs :: nat \n fixes mxl\\<^sub>0 :: nat \n fixes Ts :: \"ty list\" \n fixes T\\<^sub>r :: ty\n fixes \"is\" :: \"'addr instr list\" \n fixes xt :: ex_table\n\n fixes mxl :: nat\n defines mxl_def: \"mxl \\ 1+size Ts+mxl\\<^sub>0\"\n\ntext {* Program counter of successor instructions: *}\nprimrec succs :: \"'addr instr \\ ty\\<^sub>i \\ pc \\ pc list\"\nwhere\n \"succs (Load idx) \\ pc = [pc+1]\"\n| \"succs (Store idx) \\ pc = [pc+1]\"\n| \"succs (Push v) \\ pc = [pc+1]\"\n| \"succs (Getfield F C) \\ pc = [pc+1]\"\n| \"succs (Putfield F C) \\ pc = [pc+1]\"\n| \"succs (New C) \\ pc = [pc+1]\"\n| \"succs (NewArray T) \\ pc = [pc+1]\"\n| \"succs ALoad \\ pc = (if (fst \\)!1 = NT then [] else [pc+1])\"\n| \"succs AStore \\ pc = (if (fst \\)!2 = NT then [] else [pc+1])\"\n| \"succs ALength \\ pc = (if (fst \\)!0 = NT then [] else [pc+1])\"\n| \"succs (Checkcast C) \\ pc = [pc+1]\"\n| \"succs (Instanceof T) \\ pc = [pc+1]\"\n| \"succs Pop \\ pc = [pc+1]\"\n| \"succs Dup \\ pc = [pc+1]\"\n| \"succs Swap \\ pc = [pc+1]\"\n| \"succs (BinOpInstr b) \\ pc = [pc+1]\"\n| succs_IfFalse:\n \"succs (IfFalse b) \\ pc = [pc+1, nat (int pc + b)]\"\n| succs_Goto:\n \"succs (Goto b) \\ pc = [nat (int pc + b)]\"\n| succs_Return:\n \"succs Return \\ pc = []\" \n| succs_Invoke:\n \"succs (Invoke M n) \\ pc = (if (fst \\)!n = NT then [] else [pc+1])\"\n| succs_Throw:\n \"succs ThrowExc \\ pc = []\"\n| \"succs MEnter \\ pc = (if (fst \\)!0 = NT then [] else [pc+1])\"\n| \"succs MExit \\ pc = (if (fst \\)!0 = NT then [] else [pc+1])\"\n\ntext \"Effect of instruction on the state type:\"\n\nfun eff\\<^sub>i :: \"'addr instr \\ 'm prog \\ ty\\<^sub>i \\ ty\\<^sub>i\"\nwhere\n eff\\<^sub>i_Load:\n \"eff\\<^sub>i (Load n, P, (ST, LT)) = (ok_val (LT ! n) # ST, LT)\"\n\n| eff\\<^sub>i_Store:\n \"eff\\<^sub>i (Store n, P, (T#ST, LT)) = (ST, LT[n:= OK T])\"\n\n| eff\\<^sub>i_Push:\n \"eff\\<^sub>i (Push v, P, (ST, LT)) = (the (typeof v) # ST, LT)\"\n\n| eff\\<^sub>i_Getfield:\n \"eff\\<^sub>i (Getfield F C, P, (T#ST, LT)) = (fst (snd (field P C F)) # ST, LT)\"\n\n| eff\\<^sub>i_Putfield:\n \"eff\\<^sub>i (Putfield F C, P, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = (ST,LT)\"\n\n| eff\\<^sub>i_New:\n \"eff\\<^sub>i (New C, P, (ST,LT)) = (Class C # ST, LT)\"\n\n| eff\\<^sub>i_NewArray:\n \"eff\\<^sub>i (NewArray Ty, P, (T#ST,LT)) = (Ty\\\\ # ST,LT)\"\n\n| eff\\<^sub>i_ALoad:\n \"eff\\<^sub>i (ALoad, P, (T1#T2#ST,LT)) = (the_Array T2# ST,LT)\"\n\n| eff\\<^sub>i_AStore:\n \"eff\\<^sub>i (AStore, P, (T1#T2#T3#ST,LT)) = (ST,LT)\"\n\n| eff\\<^sub>i_ALength:\n \"eff\\<^sub>i (ALength, P, (T1#ST,LT)) = (Integer#ST,LT)\"\n\n| eff\\<^sub>i_Checkcast:\n \"eff\\<^sub>i (Checkcast Ty, P, (T#ST,LT)) = (Ty # ST,LT)\"\n\n| eff\\<^sub>i_Instanceof:\n \"eff\\<^sub>i (Instanceof Ty, P, (T#ST,LT)) = (Boolean # ST,LT)\"\n\n| eff\\<^sub>i_Pop:\n \"eff\\<^sub>i (Pop, P, (T#ST,LT)) = (ST,LT)\"\n\n| eff\\<^sub>i_Dup:\n \"eff\\<^sub>i (Dup, P, (T#ST,LT)) = (T#T#ST,LT)\"\n\n| eff\\<^sub>i_Swap:\n \"eff\\<^sub>i (Swap, P, (T1#T2#ST,LT)) = (T2#T1#ST,LT)\"\n\n| eff\\<^sub>i_BinOpInstr:\n \"eff\\<^sub>i (BinOpInstr bop, P, (T2#T1#ST,LT)) = ((THE T. P \\ T1\\bop\\T2 : T)#ST, LT)\"\n\n| eff\\<^sub>i_IfFalse:\n \"eff\\<^sub>i (IfFalse b, P, (T\\<^sub>1#ST,LT)) = (ST,LT)\"\n\n| eff\\<^sub>i_Invoke:\n \"eff\\<^sub>i (Invoke M n, P, (ST,LT)) =\n (let U = fst (snd (snd (method P (the (class_type_of' (ST ! n))) M)))\n in (U # drop (n+1) ST, LT))\"\n\n| eff\\<^sub>i_Goto:\n \"eff\\<^sub>i (Goto n, P, s) = s\"\n\n| eff\\<^sub>i_MEnter:\n \"eff\\<^sub>i (MEnter, P, (T1#ST,LT)) = (ST,LT)\"\n\n| eff\\<^sub>i_MExit:\n \"eff\\<^sub>i (MExit, P, (T1#ST,LT)) = (ST,LT)\"\n\n\nfun is_relevant_class :: \"'addr instr \\ 'm prog \\ cname \\ bool\" \nwhere\n rel_Getfield:\n \"is_relevant_class (Getfield F D) = (\\P C. P \\ NullPointer \\\\<^sup>* C)\" \n| rel_Putfield:\n \"is_relevant_class (Putfield F D) = (\\P C. P \\ NullPointer \\\\<^sup>* C)\" \n| rel_Checcast:\n \"is_relevant_class (Checkcast T) = (\\P C. P \\ ClassCast \\\\<^sup>* C)\" \n| rel_New:\n \"is_relevant_class (New D) = (\\P C. P \\ OutOfMemory \\\\<^sup>* C)\" \n| rel_Throw:\n \"is_relevant_class ThrowExc = (\\P C. True)\"\n| rel_Invoke:\n \"is_relevant_class (Invoke M n) = (\\P C. True)\"\n| rel_NewArray:\n \"is_relevant_class (NewArray T) = (\\P C. (P \\ OutOfMemory \\\\<^sup>* C) \\ (P \\ NegativeArraySize \\\\<^sup>* C))\"\n| rel_ALoad:\n \"is_relevant_class ALoad = (\\P C. P \\ ArrayIndexOutOfBounds \\\\<^sup>* C \\ P \\ NullPointer \\\\<^sup>* C)\"\n| rel_AStore:\n \"is_relevant_class AStore = (\\P C. P \\ ArrayIndexOutOfBounds \\\\<^sup>* C \\ P \\ ArrayStore \\\\<^sup>* C \\ P \\ NullPointer \\\\<^sup>* C)\"\n| rel_ALength:\n \"is_relevant_class ALength = (\\P C. P \\ NullPointer \\\\<^sup>* C)\"\n| rel_MEnter:\n \"is_relevant_class MEnter = (\\P C. P \\ IllegalMonitorState \\\\<^sup>* C \\ P \\ NullPointer \\\\<^sup>* C)\"\n| rel_MExit:\n \"is_relevant_class MExit = (\\P C. P \\ IllegalMonitorState \\\\<^sup>* C \\ P \\ NullPointer \\\\<^sup>* C)\"\n| rel_BinOp:\n \"is_relevant_class (BinOpInstr bop) = binop_relevant_class bop\"\n| rel_default:\n \"is_relevant_class i = (\\P C. False)\"\n\ndefinition is_relevant_entry :: \"'m prog \\ 'addr instr \\ pc \\ ex_entry \\ bool\" \nwhere\n \"is_relevant_entry P i pc e \\ \n let (f,t,C,h,d) = e \n in (case C of None \\ True | \\C'\\ \\ is_relevant_class i P C') \\ pc \\ {f.. 'addr instr \\ pc \\ ex_table \\ ex_table\" \nwhere\n \"relevant_entries P i pc \\ filter (is_relevant_entry P i pc)\"\n\ndefinition xcpt_eff :: \"'addr instr \\ 'm prog \\ pc \\ ty\\<^sub>i \\ ex_table \\ (pc \\ ty\\<^sub>i') list\"\nwhere\n \"xcpt_eff i P pc \\ et \\ let (ST,LT) = \\ in \n map (\\(f,t,C,h,d). (h, Some ((case C of None \\ Class Throwable | Some C' \\ Class C')#drop (size ST - d) ST, LT))) (relevant_entries P i pc et)\"\n\ndefinition norm_eff :: \"'addr instr \\ 'm prog \\ nat \\ ty\\<^sub>i \\ (pc \\ ty\\<^sub>i') list\"\nwhere \"norm_eff i P pc \\ \\ map (\\pc'. (pc',Some (eff\\<^sub>i (i,P,\\)))) (succs i \\ pc)\"\n\ndefinition eff :: \"'addr instr \\ 'm prog \\ pc \\ ex_table \\ ty\\<^sub>i' \\ (pc \\ ty\\<^sub>i') list\"\nwhere\n \"eff i P pc et t \\\n case t of \n None \\ [] \n | Some \\ \\ (norm_eff i P pc \\) @ (xcpt_eff i P pc \\ et)\"\n\n\n\n\nlemma eff_Some:\n \"eff i P pc xt (Some \\) = norm_eff i P pc \\ @ xcpt_eff i P pc \\ xt\"\nby (simp add: eff_def)\n\n(* FIXME: getfield, \\T D. P \\ C sees F:T in D \\ .. *)\n\ntext \"Conditions under which eff is applicable:\"\n\nfun app\\<^sub>i :: \"'addr instr \\ 'm prog \\ pc \\ nat \\ ty \\ ty\\<^sub>i \\ bool\"\nwhere\n app\\<^sub>i_Load:\n \"app\\<^sub>i (Load n, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (n < length LT \\ LT ! n \\ Err \\ length ST < mxs)\"\n| app\\<^sub>i_Store:\n \"app\\<^sub>i (Store n, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (n < length LT)\"\n| app\\<^sub>i_Push:\n \"app\\<^sub>i (Push v, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (length ST < mxs \\ typeof v \\ None)\"\n| app\\<^sub>i_Getfield:\n \"app\\<^sub>i (Getfield F C, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (\\T\\<^sub>f fm. P \\ C sees F:T\\<^sub>f (fm) in C \\ P \\ T \\ Class C)\"\n| app\\<^sub>i_Putfield:\n \"app\\<^sub>i (Putfield F C, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = \n (\\T\\<^sub>f fm. P \\ C sees F:T\\<^sub>f (fm) in C \\ P \\ T\\<^sub>2 \\ (Class C) \\ P \\ T\\<^sub>1 \\ T\\<^sub>f)\" \n| app\\<^sub>i_New:\n \"app\\<^sub>i (New C, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (is_class P C \\ length ST < mxs)\"\n| app\\<^sub>i_NewArray:\n \"app\\<^sub>i (NewArray Ty, P, pc, mxs, T\\<^sub>r, (Integer#ST,LT)) = \n is_type P (Ty\\\\)\"\n| app\\<^sub>i_ALoad:\n \"app\\<^sub>i (ALoad, P, pc, mxs, T\\<^sub>r, (T1#T2#ST,LT)) = \n (T1 = Integer \\ (T2 \\ NT \\ (\\Ty. T2 = Ty\\\\)))\"\n| app\\<^sub>i_AStore:\n \"app\\<^sub>i (AStore, P, pc, mxs, T\\<^sub>r, (T1#T2#T3#ST,LT)) = \n (T2 = Integer \\ (T3 \\ NT \\ (\\Ty. T3 = Ty\\\\)))\"\n| app\\<^sub>i_ALength:\n \"app\\<^sub>i (ALength, P, pc, mxs, T\\<^sub>r, (T1#ST,LT)) = \n (T1 = NT \\ (\\Ty. T1 = Ty\\\\))\"\n| app\\<^sub>i_Checkcast:\n \"app\\<^sub>i (Checkcast Ty, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (is_type P Ty)\"\n| app\\<^sub>i_Instanceof:\n \"app\\<^sub>i (Instanceof Ty, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (is_type P Ty \\ is_refT T)\"\n| app\\<^sub>i_Pop:\n \"app\\<^sub>i (Pop, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n True\"\n| app\\<^sub>i_Dup:\n \"app\\<^sub>i (Dup, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (Suc (length ST) < mxs)\"\n| app\\<^sub>i_Swap:\n \"app\\<^sub>i (Swap, P, pc, mxs, T\\<^sub>r, (T1#T2#ST,LT)) = True\"\n| app\\<^sub>i_BinOpInstr:\n \"app\\<^sub>i (BinOpInstr bop, P, pc, mxs, T\\<^sub>r, (T2#T1#ST,LT)) = (\\T. P \\ T1\\bop\\T2 : T)\"\n| app\\<^sub>i_IfFalse:\n \"app\\<^sub>i (IfFalse b, P, pc, mxs, T\\<^sub>r, (Boolean#ST,LT)) = \n (0 \\ int pc + b)\"\n| app\\<^sub>i_Goto:\n \"app\\<^sub>i (Goto b, P, pc, mxs, T\\<^sub>r, s) = (0 \\ int pc + b)\"\n| app\\<^sub>i_Return:\n \"app\\<^sub>i (Return, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = (P \\ T \\ T\\<^sub>r)\"\n| app\\<^sub>i_Throw:\n \"app\\<^sub>i (ThrowExc, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (T = NT \\ (\\C. T = Class C \\ P \\ C \\\\<^sup>* Throwable))\"\n| app\\<^sub>i_Invoke:\n \"app\\<^sub>i (Invoke M n, P, pc, mxs, T\\<^sub>r, (ST,LT)) =\n (n < length ST \\ \n (ST!n \\ NT \\\n (\\C D Ts T m. class_type_of' (ST ! n) = \\C\\ \\ P \\ C sees M:Ts \\ T = m in D \\ P \\ rev (take n ST) [\\] Ts)))\"\n| app\\<^sub>i_MEnter:\n \"app\\<^sub>i (MEnter,P, pc,mxs,T\\<^sub>r,(T#ST,LT)) = (is_refT T)\"\n| app\\<^sub>i_MExit:\n \"app\\<^sub>i (MExit,P, pc,mxs,T\\<^sub>r,(T#ST,LT)) = (is_refT T)\"\n| app\\<^sub>i_default:\n \"app\\<^sub>i (i,P, pc,mxs,T\\<^sub>r,s) = False\"\n\n\ndefinition xcpt_app :: \"'addr instr \\ 'm prog \\ pc \\ nat \\ ex_table \\ ty\\<^sub>i \\ bool\"\nwhere\n \"xcpt_app i P pc mxs xt \\ \\ \\(f,t,C,h,d) \\ set (relevant_entries P i pc xt). (case C of None \\ True | Some C' \\ is_class P C') \\ d \\ size (fst \\) \\ d < mxs\"\n\ndefinition app :: \"'addr instr \\ 'm prog \\ nat \\ ty \\ nat \\ nat \\ ex_table \\ ty\\<^sub>i' \\ bool\"\nwhere\n \"app i P mxs T\\<^sub>r pc mpc xt t \\ case t of None \\ True | Some \\ \\ \n app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',\\') \\ set (eff i P pc xt t). pc' < mpc)\"\n\n\nlemma app_Some:\n \"app i P mxs T\\<^sub>r pc mpc xt (Some \\) = \n (app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',s') \\ set (eff i P pc xt (Some \\)). pc' < mpc))\"\nby (simp add: app_def)\n\nlocale eff = jvm_method +\n fixes eff\\<^sub>i and app\\<^sub>i and eff and app \n fixes norm_eff and xcpt_app and xcpt_eff\n\n fixes mpc\n defines \"mpc \\ size is\"\n\n defines \"eff\\<^sub>i i \\ \\ Effect.eff\\<^sub>i (i,P,\\)\"\n notes eff\\<^sub>i_simps [simp] = Effect.eff\\<^sub>i.simps [where P = P, folded eff\\<^sub>i_def]\n\n defines \"app\\<^sub>i i pc \\ \\ Effect.app\\<^sub>i (i, P, pc, mxs, T\\<^sub>r, \\)\"\n notes app\\<^sub>i_simps [simp] = Effect.app\\<^sub>i.simps [where P=P and mxs=mxs and T\\<^sub>r=T\\<^sub>r, folded app\\<^sub>i_def]\n\n defines \"xcpt_eff i pc \\ \\ Effect.xcpt_eff i P pc \\ xt\"\n notes xcpt_eff = Effect.xcpt_eff_def [of _ P _ _ xt, folded xcpt_eff_def]\n\n defines \"norm_eff i pc \\ \\ Effect.norm_eff i P pc \\\"\n notes norm_eff = Effect.norm_eff_def [of _ P, folded norm_eff_def eff\\<^sub>i_def]\n\n defines \"eff i pc \\ Effect.eff i P pc xt\"\n notes eff = Effect.eff_def [of _ P _ xt, folded eff_def norm_eff_def xcpt_eff_def]\n\n defines \"xcpt_app i pc \\ \\ Effect.xcpt_app i P pc mxs xt \\\"\n notes xcpt_app = Effect.xcpt_app_def [of _ P _ mxs xt, folded xcpt_app_def]\n\n defines \"app i pc \\ Effect.app i P mxs T\\<^sub>r pc mpc xt\"\n notes app = Effect.app_def [of _ P mxs T\\<^sub>r _ mpc xt, folded app_def xcpt_app_def app\\<^sub>i_def eff_def]\n\n\nlemma length_cases2:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n by (cases s, cases \"fst s\") (auto intro!: assms)\n\n\nlemma length_cases3:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil thus ?thesis using s assms by (simp)\n next\n fix l xs' assume \"xs = l#xs'\"\n thus ?thesis using s assms by (simp)\n qed\nqed\n(*>*)\n\nlemma length_cases4:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l l' LT. P ([l,l'],LT)\"\n assumes \"\\l l' ST LT. P (l#l'#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil thus ?thesis using s assms by (simp)\n next\n fix l xs' assume xs: \"xs = l#xs'\"\n thus ?thesis\n proof (cases xs')\n case Nil thus ?thesis using s assms xs by (simp)\n next\n fix l' ST assume xs': \"xs' = l'#ST\"\n thus ?thesis using s assms xs xs' by (simp)\n qed\n qed\nqed\n(*>*)\n\ntext {* \n\\medskip\nsimp rules for @{term app}\n*}\nlemma appNone[simp]: \"app i P mxs T\\<^sub>r pc mpc et None = True\" \n by (simp add: app_def)\n\n\nlemma appLoad[simp]:\n\"app\\<^sub>i (Load idx, P, T\\<^sub>r, mxs, pc, s) = (\\ST LT. s = (ST,LT) \\ idx < length LT \\ LT!idx \\ Err \\ length ST < mxs)\"\n by (cases s, simp)\n\nlemma appStore[simp]:\n\"app\\<^sub>i (Store idx,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT) \\ idx < length LT)\"\n by (rule length_cases2, auto)\n\nlemma appPush[simp]:\n\"app\\<^sub>i (Push v,P,pc,mxs,T\\<^sub>r,s) =\n (\\ST LT. s = (ST,LT) \\ length ST < mxs \\ typeof v \\ None)\"\n by (cases s, simp)\n\nlemma appGetField[simp]:\n\"app\\<^sub>i (Getfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ oT vT ST LT fm. s = (oT#ST, LT) \\ \n P \\ C sees F:vT (fm) in C \\ P \\ oT \\ (Class C))\"\n by (rule length_cases2 [of _ s]) auto\n\nlemma appPutField[simp]:\n\"app\\<^sub>i (Putfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ vT vT' oT ST LT fm. s = (vT#oT#ST, LT) \\\n P \\ C sees F:vT' (fm) in C \\ P \\ oT \\ (Class C) \\ P \\ vT \\ vT')\"\n by (rule length_cases4 [of _ s], auto)\n\nlemma appNew[simp]:\n \"app\\<^sub>i (New C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s=(ST,LT) \\ is_class P C \\ length ST < mxs)\"\n by (cases s, simp)\n\nlemma appNewArray[simp]:\n \"app\\<^sub>i (NewArray Ty,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s=(Integer#ST,LT) \\ is_type P (Ty\\\\))\"\n by (cases s, simp, cases \"fst s\", simp)(cases \"hd (fst s)\", auto)\n\nlemma appALoad[simp]:\n \"app\\<^sub>i (ALoad,P,pc,mxs,T\\<^sub>r,s) = \n (\\T ST LT. s=(Integer#T#ST,LT) \\ (T \\ NT \\ (\\T'. T = T'\\\\)))\"\nproof -\n obtain ST LT where [simp]: \"s = (ST, LT)\" by (cases s)\n have \"ST = [] \\ (\\T. ST = [T]) \\ (\\T\\<^sub>1 T\\<^sub>2 ST'. ST = T\\<^sub>1#T\\<^sub>2#ST')\"\n by (cases ST, auto, case_tac list, auto)\n moreover\n { assume \"ST = []\" hence ?thesis by simp }\n moreover\n { fix T assume \"ST = [T]\" hence ?thesis by (cases T, auto) }\n moreover\n { fix T\\<^sub>1 T\\<^sub>2 ST' assume \"ST = T\\<^sub>1#T\\<^sub>2#ST'\"\n hence ?thesis by (cases T\\<^sub>1, auto)\n }\n ultimately show ?thesis by blast\nqed\n\nlemma appAStore[simp]:\n \"app\\<^sub>i (AStore,P,pc,mxs,T\\<^sub>r,s) = \n (\\T U ST LT. s=(T#Integer#U#ST,LT) \\ (U \\ NT \\ (\\T'. U = T'\\\\)))\"\nproof -\n obtain ST LT where [simp]: \"s = (ST, LT)\" by (cases s)\n have \"ST = [] \\ (\\T. ST = [T]) \\ (\\T\\<^sub>1 T\\<^sub>2. ST = [T\\<^sub>1, T\\<^sub>2]) \\ (\\T1 T2 T3 ST'. ST = T1 # T2 # T3 # ST')\"\n by (cases ST, auto, case_tac list, auto, case_tac lista, auto)\n moreover\n { assume \"ST = []\" hence ?thesis by simp }\n moreover\n { fix T assume \"ST = [T]\" hence ?thesis by(simp) }\n moreover\n { fix T1 T2 assume \"ST = [T1, T2]\" hence ?thesis by simp }\n moreover\n { fix T1 T2 T3 ST' assume \"ST = T1 # T2 # T3 # ST'\" hence ?thesis by(cases T2, auto) }\n ultimately show ?thesis by blast\nqed\n\nlemma appALength[simp]:\n \"app\\<^sub>i (ALength,P,pc,mxs,T\\<^sub>r,s) = \n (\\T ST LT. s=(T#ST,LT) \\ (T \\ NT \\ (\\T'. T = T'\\\\)))\"\n by (cases s, cases \"fst s\", simp add: app_def) (cases \"hd (fst s)\", auto)\n\n\n\nlemma appInstanceof[simp]: \n \"app\\<^sub>i (Instanceof Ty,P,pc,mxs,T\\<^sub>r,s) = \n (\\T ST LT. s = (T#ST,LT) \\ is_type P Ty \\ is_refT T)\"\n by (cases s, cases \"fst s\", simp add: app_def) (cases \"hd (fst s)\", auto)\n\nlemma app\\<^sub>iPop[simp]: \n\"app\\<^sub>i (Pop,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT))\"\n by (rule length_cases2, auto)\n\nlemma appDup[simp]:\n\"app\\<^sub>i (Dup,P,pc,mxs,T\\<^sub>r,s) =\n (\\T ST LT. s = (T#ST,LT) \\ Suc (length ST) < mxs)\"\nby (cases s, cases \"fst s\", simp_all)\n\nlemma app\\<^sub>iSwap[simp]: \n\"app\\<^sub>i (Swap,P,pc,mxs,T\\<^sub>r,s) = (\\T1 T2 ST LT. s = (T1#T2#ST,LT))\"\nby(rule length_cases4) auto\n\nlemma appBinOp[simp]:\n\"app\\<^sub>i (BinOpInstr bop,P,pc,mxs,T\\<^sub>r,s) = (\\T1 T2 ST LT T. s = (T2 # T1 # ST, LT) \\ P \\ T1\\bop\\T2 : T)\"\nproof -\n obtain ST LT where [simp]: \"s = (ST,LT)\" by (cases s)\n have \"ST = [] \\ (\\T. ST = [T]) \\ (\\T\\<^sub>1 T\\<^sub>2 ST'. ST = T\\<^sub>1#T\\<^sub>2#ST')\"\n by (cases ST, auto, case_tac list, auto)\n moreover\n { assume \"ST = []\" hence ?thesis by simp }\n moreover\n { fix T assume \"ST = [T]\" hence ?thesis by (cases T, auto) }\n moreover\n { fix T\\<^sub>1 T\\<^sub>2 ST' assume \"ST = T\\<^sub>1#T\\<^sub>2#ST'\"\n hence ?thesis by simp\n }\n ultimately show ?thesis by blast\nqed\n\nlemma appIfFalse [simp]:\n\"app\\<^sub>i (IfFalse b,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s = (Boolean#ST,LT) \\ 0 \\ int pc + b)\"\n apply (rule length_cases2)\n apply simp\n apply (case_tac l) \n apply auto\n done\n\nlemma appReturn[simp]:\n\"app\\<^sub>i (Return,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s = (T#ST,LT) \\ P \\ T \\ T\\<^sub>r)\" \n by (rule length_cases2, auto)\n\nlemma appThrow[simp]:\n \"app\\<^sub>i (ThrowExc,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s=(T#ST,LT) \\ (T = NT \\ (\\C. T = Class C \\ P \\ C \\\\<^sup>* Throwable)))\"\n by (rule length_cases2, auto) \n\nlemma appMEnter[simp]:\n \"app\\<^sub>i (MEnter,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s=(T#ST,LT) \\ is_refT T)\"\n by (rule length_cases2, auto) \n\nlemma appMExit[simp]:\n \"app\\<^sub>i (MExit,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s=(T#ST,LT) \\ is_refT T)\"\n by (rule length_cases2, auto)\n\nlemma effNone: \n \"(pc', s') \\ set (eff i P pc et None) \\ s' = None\"\n by (auto simp add: eff_def xcpt_eff_def norm_eff_def)\n\n\nlemma relevant_entries_append [simp]:\n \"relevant_entries P i pc (xt @ xt') = relevant_entries P i pc xt @ relevant_entries P i pc xt'\"\n by (unfold relevant_entries_def) simp\n\nlemma xcpt_app_append [iff]:\n \"xcpt_app i P pc mxs (xt@xt') \\ = (xcpt_app i P pc mxs xt \\ \\ xcpt_app i P pc mxs xt' \\)\"\nunfolding xcpt_app_def by force\n\nlemma xcpt_eff_append [simp]:\n \"xcpt_eff i P pc \\ (xt@xt') = xcpt_eff i P pc \\ xt @ xcpt_eff i P pc \\ xt'\"\n by (unfold xcpt_eff_def, cases \\) simp\n\nlemma app_append [simp]:\n \"app i P pc T mxs mpc (xt@xt') \\ = (app i P pc T mxs mpc xt \\ \\ app i P pc T mxs mpc xt' \\)\"\n by (unfold app_def eff_def) auto\n\n\nsubsection {* Code generator setup *}\n\ndeclare list_all2_Nil [code]\ndeclare list_all2_Cons [code]\n\nlemma eff\\<^sub>i_BinOpInstr_code:\n \"eff\\<^sub>i (BinOpInstr bop, P, (T2#T1#ST,LT)) = (Predicate.the (WTrt_binop_i_i_i_i_o P T1 bop T2) # ST, LT)\"\nby(simp add: the_WTrt_binop_code)\n\nlemmas eff\\<^sub>i_code[code] =\n eff\\<^sub>i_Load eff\\<^sub>i_Store eff\\<^sub>i_Push eff\\<^sub>i_Getfield eff\\<^sub>i_Putfield eff\\<^sub>i_New eff\\<^sub>i_NewArray eff\\<^sub>i_ALoad\n eff\\<^sub>i_AStore eff\\<^sub>i_ALength eff\\<^sub>i_Checkcast eff\\<^sub>i_Instanceof eff\\<^sub>i_Pop eff\\<^sub>i_Dup eff\\<^sub>i_Swap eff\\<^sub>i_BinOpInstr_code\n eff\\<^sub>i_IfFalse eff\\<^sub>i_Invoke eff\\<^sub>i_Goto eff\\<^sub>i_MEnter eff\\<^sub>i_MExit\n\nlemma app\\<^sub>i_Getfield_code:\n \"app\\<^sub>i (Getfield F C, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) \\\n Predicate.holds (Predicate.bind (sees_field_i_i_i_o_o_i P C F C) (\\T. Predicate.single ())) \\ P \\ T \\ Class C\"\napply(clarsimp simp add: Predicate.bind_def Predicate.single_def holds_eq eval_sees_field_i_i_i_o_i_conv)\ndone\n \nlemma app\\<^sub>i_Putfield_code:\n \"app\\<^sub>i (Putfield F C, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST, LT)) \\\n P \\ T\\<^sub>2 \\ (Class C) \\\n Predicate.holds (Predicate.bind (sees_field_i_i_i_o_o_i P C F C) (\\(T, fm). if P \\ T\\<^sub>1 \\ T then Predicate.single () else bot))\"\nby (auto simp add: holds_eq eval_sees_field_i_i_i_o_i_conv split: if_splits)\n\nlemma app\\<^sub>i_ALoad_code:\n \"app\\<^sub>i (ALoad, P, pc, mxs, T\\<^sub>r, (T1#T2#ST,LT)) = \n (T1 = Integer \\ (case T2 of Ty\\\\ \\ True | NT \\ True | _ \\ False))\"\nby(simp add: split: ty.split)\n\nlemma app\\<^sub>i_AStore_code:\n \"app\\<^sub>i (AStore, P, pc, mxs, T\\<^sub>r, (T1#T2#T3#ST,LT)) = \n (T2 = Integer \\ (case T3 of Ty\\\\ \\ True | NT \\ True | _ \\ False))\"\nby(simp add: split: ty.split)\n\nlemma app\\<^sub>i_ALength_code:\n \"app\\<^sub>i (ALength, P, pc, mxs, T\\<^sub>r, (T1#ST,LT)) = \n (case T1 of Ty\\\\ \\ True | NT \\ True | _ \\ False)\"\nby(simp add: split: ty.split)\n\nlemma app\\<^sub>i_BinOpInstr_code:\n \"app\\<^sub>i (BinOpInstr bop, P, pc, mxs, T\\<^sub>r, (T2#T1#ST,LT)) = \n Predicate.holds (Predicate.bind (WTrt_binop_i_i_i_i_o P T1 bop T2) (\\T. Predicate.single ()))\"\nby (auto simp add: holds_eq eval_WTrt_binop_i_i_i_i_o)\n\nlemma app\\<^sub>i_Invoke_code:\n \"app\\<^sub>i (Invoke M n, P, pc, mxs, T\\<^sub>r, (ST,LT)) =\n (n < length ST \\ \n (ST!n \\ NT \\\n (case class_type_of' (ST ! n) of Some C \\ \n Predicate.holds (Predicate.bind (Method_i_i_i_o_o_o_o P C M) \n (\\(Ts, _). if P \\ rev (take n ST) [\\] Ts then Predicate.single () else bot))\n | _ \\ False)))\"\nproof -\n have bind_Ex: \"\\P f. Predicate.bind P f = Predicate.Pred (\\x. (\\y. Predicate.eval P y \\ Predicate.eval (f y) x))\"\n by (rule pred_eqI) auto\n thus ?thesis\n by (auto simp add: bind_Ex Predicate.single_def holds_eq eval_Method_i_i_i_o_o_o_o_conv split: ty.split)\nqed\n\nlemma app\\<^sub>i_Throw_code:\n \"app\\<^sub>i (ThrowExc, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (case T of NT \\ True | Class C \\ P \\ C \\\\<^sup>* Throwable | _ \\ False)\"\nby(simp split: ty.split)\n\nlemmas app\\<^sub>i_code [code] =\n app\\<^sub>i_Load app\\<^sub>i_Store app\\<^sub>i_Push\n app\\<^sub>i_Getfield_code app\\<^sub>i_Putfield_code\n app\\<^sub>i_New app\\<^sub>i_NewArray\n app\\<^sub>i_ALoad_code app\\<^sub>i_AStore_code app\\<^sub>i_ALength_code\n app\\<^sub>i_Checkcast app\\<^sub>i_Instanceof\n app\\<^sub>i_Pop app\\<^sub>i_Dup app\\<^sub>i_Swap app\\<^sub>i_BinOpInstr_code app\\<^sub>i_IfFalse app\\<^sub>i_Goto\n app\\<^sub>i_Return app\\<^sub>i_Throw_code app\\<^sub>i_Invoke_code app\\<^sub>i_MEnter app\\<^sub>i_MExit\n app\\<^sub>i_default\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/BV/Effect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.32082131381216084, "lm_q1q2_score": 0.17540525223093667}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__25_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__25_on_rules imports n_german_lemma_on_inv__25\nbegin\nsection{*All lemmas on causal relation between inv__25*}\nlemma lemma_inv__25_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__25 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ j. j\\N\\r=n_SendReqS j)\\\n (\\ i. i\\N\\r=n_SendReqEI i)\\\n (\\ i. i\\N\\r=n_SendReqES i)\\\n (\\ i. i\\N\\r=n_RecvReq N i)\\\n (\\ i. i\\N\\r=n_SendInvE i)\\\n (\\ i. i\\N\\r=n_SendInvS i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\\\n (\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ j. j\\N\\r=n_SendReqS j)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqEI i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqEIVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqES i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqESVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReq N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__25) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_inv__25_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3451052574867685, "lm_q1q2_score": 0.1752485441769108}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__55.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__55 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__55 and some rule r*}\nlemma n_RecvReqSVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv0)) (Const true))) (eqn (IVar (Ident ''ExGntd'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv0)) (Const true))) (eqn (IVar (Ident ''ExGntd'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv0)) (Const false)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv0)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__55:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__55:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__55:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__55:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__55:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__55.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34510525748676846, "lm_q1q2_score": 0.17524854417691077}} {"text": "(* Title: HOL/Auth/Recur.thy\n Author: Lawrence C Paulson, Cambridge University Computer Laboratory\n Copyright 1996 University of Cambridge\n*)\n\nsection\\The Otway-Bull Recursive Authentication Protocol\\\n\ntheory Recur imports Public begin\n\ntext\\End marker for message bundles\\\nabbreviation\n END :: \"msg\" where\n \"END == Number 0\"\n\n(*Two session keys are distributed to each agent except for the initiator,\n who receives one.\n Perhaps the two session keys could be bundled into a single message.\n*)\ninductive_set (*Server's response to the nested message*)\n respond :: \"event list \\ (msg*msg*key)set\"\n for evs :: \"event list\"\n where\n One: \"Key KAB \\ used evs\n ==> (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\,\n \\Crypt (shrK A) \\Key KAB, Agent B, Nonce NA\\, END\\,\n KAB) \\ respond evs\"\n\n (*The most recent session key is passed up to the caller*)\n | Cons: \"[| (PA, RA, KAB) \\ respond evs;\n Key KBC \\ used evs; Key KBC \\ parts {RA};\n PA = Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, P\\ |]\n ==> (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\,\n \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\,\n KBC)\n \\ respond evs\"\n\n\n(*Induction over \"respond\" can be difficult due to the complexity of the\n subgoals. Set \"responses\" captures the general form of certificates.\n*)\ninductive_set\n responses :: \"event list => msg set\"\n for evs :: \"event list\"\n where\n (*Server terminates lists*)\n Nil: \"END \\ responses evs\"\n\n | Cons: \"[| RA \\ responses evs; Key KAB \\ used evs |]\n ==> \\Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ responses evs\"\n\n\ninductive_set recur :: \"event list set\"\n where\n (*Initial trace is empty*)\n Nil: \"[] \\ recur\"\n\n (*The spy MAY say anything he CAN say. Common to\n all similar protocols.*)\n | Fake: \"[| evsf \\ recur; X \\ synth (analz (knows Spy evsf)) |]\n ==> Says Spy B X # evsf \\ recur\"\n\n (*Alice initiates a protocol run.\n END is a placeholder to terminate the nesting.*)\n | RA1: \"[| evs1 \\ recur; Nonce NA \\ used evs1 |]\n ==> Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, Nonce NA, END\\)\n # evs1 \\ recur\"\n\n (*Bob's response to Alice's message. C might be the Server.\n We omit PA = \\XA, Agent A, Agent B, Nonce NA, P\\ because\n it complicates proofs, so B may respond to any message at all!*)\n | RA2: \"[| evs2 \\ recur; Nonce NB \\ used evs2;\n Says A' B PA \\ set evs2 |]\n ==> Says B C (Hash[Key(shrK B)] \\Agent B, Agent C, Nonce NB, PA\\)\n # evs2 \\ recur\"\n\n (*The Server receives Bob's message and prepares a response.*)\n | RA3: \"[| evs3 \\ recur; Says B' Server PB \\ set evs3;\n (PB,RB,K) \\ respond evs3 |]\n ==> Says Server B RB # evs3 \\ recur\"\n\n (*Bob receives the returned message and compares the Nonces with\n those in the message he previously sent the Server.*)\n | RA4: \"[| evs4 \\ recur;\n Says B C \\XH, Agent B, Agent C, Nonce NB,\n XA, Agent A, Agent B, Nonce NA, P\\ \\ set evs4;\n Says C' B \\Crypt (shrK B) \\Key KBC, Agent C, Nonce NB\\,\n Crypt (shrK B) \\Key KAB, Agent A, Nonce NB\\,\n RA\\ \\ set evs4 |]\n ==> Says B A RA # evs4 \\ recur\"\n\n (*No \"oops\" message can easily be expressed. Each session key is\n associated--in two separate messages--with two nonces. This is\n one try, but it isn't that useful. Re domino attack, note that\n Recur.thy proves that each session key is secure provided the two\n peers are, even if there are compromised agents elsewhere in\n the chain. Oops cases proved using parts_cut, Key_in_keysFor_parts,\n etc.\n\n Oops: \"[| evso \\ recur; Says Server B RB \\ set evso;\n RB \\ responses evs'; Key K \\ parts {RB} |]\n ==> Notes Spy \\Key K, RB\\ # evso \\ recur\"\n *)\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\n(** Possibility properties: traces that reach the end\n ONE theorem would be more elegant and faster!\n By induction on a list of agents (no repetitions)\n**)\n\n\ntext\\Simplest case: Alice goes directly to the server\\\nlemma \"Key K \\ used [] \n ==> \\NA. \\evs \\ recur.\n Says Server A \\Crypt (shrK A) \\Key K, Agent Server, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] recur.Nil [THEN recur.RA1, \n THEN recur.RA3 [OF _ _ respond.One]])\napply (possibility, simp add: used_Cons) \ndone\n\n\ntext\\Case two: Alice, Bob and the server\\\nlemma \"[| Key K \\ used []; Key K' \\ used []; K \\ K';\n Nonce NA \\ used []; Nonce NB \\ used []; NA < NB |]\n ==> \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil\n [THEN recur.RA1 [of _ NA], \n THEN recur.RA2 [of _ NB],\n THEN recur.RA3 [OF _ _ respond.One \n [THEN respond.Cons [of _ _ K _ K']]],\n THEN recur.RA4], possibility)\napply (auto simp add: used_Cons)\ndone\n\n(*Case three: Alice, Bob, Charlie and the server Rather slow (5 seconds)*)\nlemma \"[| Key K \\ used []; Key K' \\ used []; \n Key K'' \\ used []; K \\ K'; K' \\ K''; K \\ K'';\n Nonce NA \\ used []; Nonce NB \\ used []; Nonce NC \\ used []; \n NA < NB; NB < NC |]\n ==> \\K. \\NA. \\evs \\ recur.\n Says B A \\Crypt (shrK A) \\Key K, Agent B, Nonce NA\\,\n END\\ \\ set evs\"\napply (intro exI bexI)\napply (rule_tac [2] \n recur.Nil [THEN recur.RA1, \n THEN recur.RA2, THEN recur.RA2,\n THEN recur.RA3 \n [OF _ _ respond.One \n [THEN respond.Cons, THEN respond.Cons]],\n THEN recur.RA4, THEN recur.RA4])\napply basic_possibility\napply (tactic \"DEPTH_SOLVE (swap_res_tac \\<^context> [refl, conjI, disjCI] 1)\")\ndone\n\n\nlemma respond_imp_not_used: \"(PA,RB,KAB) \\ respond evs ==> Key KAB \\ used evs\"\nby (erule respond.induct, simp_all)\n\nlemma Key_in_parts_respond [rule_format]:\n \"[| Key K \\ parts {RB}; (PB,RB,K') \\ respond evs |] ==> Key K \\ used evs\"\napply (erule rev_mp, erule respond.induct)\napply (auto dest: Key_not_used respond_imp_not_used)\ndone\n\ntext\\Simple inductive reasoning about responses\\\nlemma respond_imp_responses:\n \"(PA,RB,KAB) \\ respond evs ==> RB \\ responses evs\"\napply (erule respond.induct)\napply (blast intro!: respond_imp_not_used responses.intros)+\ndone\n\n\n(** For reasoning about the encrypted portion of messages **)\n\nlemmas RA2_analz_spies = Says_imp_spies [THEN analz.Inj]\n\nlemma RA4_analz_spies:\n \"Says C' B \\Crypt K X, X', RA\\ \\ set evs ==> RA \\ analz (spies evs)\"\nby blast\n\n\n(*RA2_analz... and RA4_analz... let us treat those cases using the same\n argument as for the Fake case. This is possible for most, but not all,\n proofs: Fake does not invent new nonces (as in RA2), and of course Fake\n messages originate from the Spy. *)\n\nlemmas RA2_parts_spies = RA2_analz_spies [THEN analz_into_parts]\nlemmas RA4_parts_spies = RA4_analz_spies [THEN analz_into_parts]\n\n\n(** Theorems of the form X \\ parts (spies evs) imply that NOBODY\n sends messages containing X! **)\n\n(** Spy never sees another agent's shared key! (unless it's bad at start) **)\n\nlemma Spy_see_shrK [simp]:\n \"evs \\ recur ==> (Key (shrK A) \\ parts (spies evs)) = (A \\ bad)\"\napply (erule recur.induct, auto)\ntxt\\RA3. It's ugly to call auto twice, but it seems necessary.\\\napply (auto dest: Key_in_parts_respond simp add: parts_insert_spies)\ndone\n\nlemma Spy_analz_shrK [simp]:\n \"evs \\ recur ==> (Key (shrK A) \\ analz (spies evs)) = (A \\ bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n \"[|Key (shrK A) \\ parts (knows Spy evs); evs \\ recur|] ==> A \\ bad\"\nby (blast dest: Spy_see_shrK)\n\n\n(*** Proofs involving analz ***)\n\n(** Session keys are not used to encrypt other session keys **)\n\n(*Version for \"responses\" relation. Handles case RA3 in the theorem below.\n Note that it holds for *any* set H (not just \"spies evs\")\n satisfying the inductive hypothesis.*)\nlemma resp_analz_image_freshK_lemma:\n \"[| RB \\ responses evs;\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ H)) =\n (K \\ KK | Key K \\ analz H) |]\n ==> \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (insert RB (Key`KK \\ H))) =\n (K \\ KK | Key K \\ analz (insert RB H))\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps, auto)\ndone \n\n\ntext\\Version for the protocol. Proof is easy, thanks to the lemma.\\\nlemma raw_analz_image_freshK:\n \"evs \\ recur ==>\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ (spies evs))) =\n (K \\ KK | Key K \\ analz (spies evs))\"\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies, analz_freshK, spy_analz)\ntxt\\RA3\\\napply (simp_all add: resp_analz_image_freshK_lemma)\ndone\n\n\n(*Instance of the lemma with H replaced by (spies evs):\n [| RB \\ responses evs; evs \\ recur; |]\n ==> KK \\ - (range shrK) \\\n Key K \\ analz (insert RB (Key`KK \\ spies evs)) =\n (K \\ KK | Key K \\ analz (insert RB (spies evs)))\n*)\nlemmas resp_analz_image_freshK = \n resp_analz_image_freshK_lemma [OF _ raw_analz_image_freshK]\n\nlemma analz_insert_freshK:\n \"[| evs \\ recur; KAB \\ range shrK |]\n ==> (Key K \\ analz (insert (Key KAB) (spies evs))) =\n (K = KAB | Key K \\ analz (spies evs))\"\nby (simp del: image_insert\n add: analz_image_freshK_simps raw_analz_image_freshK)\n\n\ntext\\Everything that's hashed is already in past traffic.\\\nlemma Hash_imp_body:\n \"[| Hash \\Key(shrK A), X\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad |] ==> X \\ parts (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [5] respond_imp_responses,\n drule_tac [4] RA2_parts_spies)\ntxt\\RA3 requires a further induction\\\napply (erule_tac [5] responses.induct, simp_all)\ntxt\\Fake\\\napply (blast intro: parts_insertI)\ndone\n\n\n(** The Nonce NA uniquely identifies A's message.\n This theorem applies to steps RA1 and RA2!\n\n Unicity is not used in other proofs but is desirable in its own right.\n**)\n\nlemma unique_NA:\n \"[| Hash \\Key(shrK A), Agent A, B, NA, P\\ \\ parts (spies evs);\n Hash \\Key(shrK A), Agent A, B',NA, P'\\ \\ parts (spies evs);\n evs \\ recur; A \\ bad |]\n ==> B=B' \\ P=P'\"\napply (erule rev_mp, erule rev_mp)\napply (erule recur.induct,\n drule_tac [5] respond_imp_responses)\napply (force, simp_all)\ntxt\\Fake\\\napply blast\napply (erule_tac [3] responses.induct)\ntxt\\RA1,2: creation of new Nonce\\\napply simp_all\napply (blast dest!: Hash_imp_body)+\ndone\n\n\n(*** Lemmas concerning the Server's response\n (relations \"respond\" and \"responses\")\n***)\n\nlemma shrK_in_analz_respond [simp]:\n \"[| RB \\ responses evs; evs \\ recur |]\n ==> (Key (shrK B) \\ analz (insert RB (spies evs))) = (B\\bad)\"\napply (erule responses.induct)\napply (simp_all del: image_insert\n add: analz_image_freshK_simps resp_analz_image_freshK, auto) \ndone\n\n\nlemma resp_analz_insert_lemma:\n \"[| Key K \\ analz (insert RB H);\n \\K KK. KK \\ - (range shrK) \\\n (Key K \\ analz (Key`KK \\ H)) =\n (K \\ KK | Key K \\ analz H);\n RB \\ responses evs |]\n ==> (Key K \\ parts{RB} | Key K \\ analz H)\"\napply (erule rev_mp, erule responses.induct)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps resp_analz_image_freshK_lemma)\ntxt\\Simplification using two distinct treatments of \"image\"\\\napply (simp add: parts_insert2, blast)\ndone\n\nlemmas resp_analz_insert =\n resp_analz_insert_lemma [OF _ raw_analz_image_freshK]\n\ntext\\The last key returned by respond indeed appears in a certificate\\\nlemma respond_certificate:\n \"(Hash[Key(shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\n ==> Crypt (shrK A) \\Key K, B, NA\\ \\ parts {RA}\"\napply (ind_cases \"(Hash[Key (shrK A)] \\Agent A, B, NA, P\\, RA, K) \\ respond evs\")\napply simp_all\ndone\n\n(*This unicity proof differs from all the others in the HOL/Auth directory.\n The conclusion isn't quite unicity but duplicity, in that there are two\n possibilities. Also, the presence of two different matching messages in\n the inductive step complicates the case analysis. Unusually for such proofs,\n the quantifiers appear to be necessary.*)\nlemma unique_lemma [rule_format]:\n \"(PB,RB,KXY) \\ respond evs ==>\n \\A B N. Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB} \\\n (\\A' B' N'. Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB} \\\n (A'=A \\ B'=B) | (A'=B \\ B'=A))\"\napply (erule respond.induct)\napply (simp_all add: all_conj_distrib)\napply (blast dest: respond_certificate)\ndone\n\nlemma unique_session_keys:\n \"[| Crypt (shrK A) \\Key K, Agent B, N\\ \\ parts {RB};\n Crypt (shrK A') \\Key K, Agent B', N'\\ \\ parts {RB};\n (PB,RB,KXY) \\ respond evs |]\n ==> (A'=A \\ B'=B) | (A'=B \\ B'=A)\"\nby (rule unique_lemma, auto)\n\n\n(** Crucial secrecy property: Spy does not see the keys sent in msg RA3\n Does not in itself guarantee security: an attack could violate\n the premises, e.g. by having A=Spy **)\n\nlemma respond_Spy_not_see_session_key [rule_format]:\n \"[| (PB,RB,KAB) \\ respond evs; evs \\ recur |]\n ==> \\A A' N. A \\ bad \\ A' \\ bad \\\n Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts{RB} \\\n Key K \\ analz (insert RB (spies evs))\"\napply (erule respond.induct)\napply (frule_tac [2] respond_imp_responses)\napply (frule_tac [2] respond_imp_not_used)\napply (simp_all del: image_insert parts_image\n add: analz_image_freshK_simps split_ifs shrK_in_analz_respond\n resp_analz_image_freshK parts_insert2)\ntxt\\Base case of respond\\\napply blast\ntxt\\Inductive step of respond\\\napply (intro allI conjI impI, simp_all)\ntxt\\by unicity, either \\<^term>\\B=Aa\\ or \\<^term>\\B=A'\\, a contradiction\n if \\<^term>\\B \\ bad\\\\ \napply (blast dest: unique_session_keys respond_certificate)\napply (blast dest!: respond_certificate)\napply (blast dest!: resp_analz_insert)\ndone\n\n\nlemma Spy_not_see_session_key:\n \"[| Crypt (shrK A) \\Key K, Agent A', N\\ \\ parts (spies evs);\n A \\ bad; A' \\ bad; evs \\ recur |]\n ==> Key K \\ analz (spies evs)\"\napply (erule rev_mp)\napply (erule recur.induct)\napply (drule_tac [4] RA2_analz_spies,\n frule_tac [5] respond_imp_responses,\n drule_tac [6] RA4_analz_spies,\n simp_all add: split_ifs analz_insert_eq analz_insert_freshK)\ntxt\\Fake\\\napply spy_analz\ntxt\\RA2\\\napply blast \ntxt\\RA3\\\napply (simp add: parts_insert_spies)\napply (metis Key_in_parts_respond parts.Body parts.Fst resp_analz_insert \n respond_Spy_not_see_session_key usedI)\ntxt\\RA4\\\napply blast \ndone\n\n(**** Authenticity properties for Agents ****)\n\ntext\\The response never contains Hashes\\\nlemma Hash_in_parts_respond:\n \"[| Hash \\Key (shrK B), M\\ \\ parts (insert RB H);\n (PB,RB,K) \\ respond evs |]\n ==> Hash \\Key (shrK B), M\\ \\ parts H\"\napply (erule rev_mp)\napply (erule respond_imp_responses [THEN responses.induct], auto)\ndone\n\ntext\\Only RA1 or RA2 can have caused such a part of a message to appear.\n This result is of no use to B, who cannot verify the Hash. Moreover,\n it can say nothing about how recent A's message is. It might later be\n used to prove B's presence to A at the run's conclusion.\\\nlemma Hash_auth_sender [rule_format]:\n \"[| Hash \\Key(shrK A), Agent A, Agent B, NA, P\\ \\ parts(spies evs);\n A \\ bad; evs \\ recur |]\n ==> Says A B (Hash[Key(shrK A)] \\Agent A, Agent B, NA, P\\) \\ set evs\"\napply (unfold HPair_def)\napply (erule rev_mp)\napply (erule recur.induct,\n drule_tac [6] RA4_parts_spies,\n drule_tac [4] RA2_parts_spies,\n simp_all)\ntxt\\Fake, RA3\\\napply (blast dest: Hash_in_parts_respond)+\ndone\n\n(** These two results subsume (for all agents) the guarantees proved\n separately for A and B in the Otway-Rees protocol.\n**)\n\n\ntext\\Certificates can only originate with the Server.\\\nlemma Cert_imp_Server_msg:\n \"[| Crypt (shrK A) Y \\ parts (spies evs);\n A \\ bad; evs \\ recur |]\n ==> \\C RC. Says Server C RC \\ set evs \\\n Crypt (shrK A) Y \\ parts {RC}\"\napply (erule rev_mp, erule recur.induct, simp_all)\ntxt\\Fake\\\napply blast\ntxt\\RA1\\\napply blast\ntxt\\RA2: it cannot be a new Nonce, contradiction.\\\napply blast\ntxt\\RA3. Pity that the proof is so brittle: this step requires the rewriting,\n which however would break all other steps.\\\napply (simp add: parts_insert_spies, blast)\ntxt\\RA4\\\napply blast\ndone\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Recur.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.17513091861816954}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Word_Lemmas_64_Internal\nimports Word_Lemmas_64\nbegin\n\nlemmas unat_add_simple = iffD1[OF unat_add_lem[where 'a = 64, folded word_bits_def]]\n\nlemma unat_length_4_helper:\n \"\\unat (l::machine_word) = length args; \\ l < 4\\ \\ \\x xa xb xc xs. args = x#xa#xb#xc#xs\"\n apply (case_tac args; clarsimp simp: unat_eq_0)\n by (rename_tac list, case_tac list, clarsimp, unat_arith)+\n\nlemma ucast_drop_big_mask:\n \"UCAST(64 \\ 16) (x && 0xFFFF) = UCAST(64 \\ 16) x\"\n by word_bitwise\n\nlemma first_port_last_port_compare:\n \"UCAST(16 \\ 32 signed) (UCAST(64 \\ 16) (xa && 0xFFFF))\n 32 signed) (UCAST(64 \\ 16) (x && 0xFFFF))\n = (UCAST(64 \\ 16) xa < UCAST(64 \\ 16) x)\"\n apply (clarsimp simp: word_sless_alt ucast_drop_big_mask)\n apply (subst sint_ucast_eq_uint, clarsimp simp: is_down)+\n by (simp add: word_less_alt)\n\nlemma machine_word_and_3F_less_40:\n \"(w :: machine_word) && 0x3F < 0x40\"\n by (rule word_and_less', simp)\n\n(* FIXME: move to GenericLib *)\nlemmas unat64_eq_of_nat = unat_eq_of_nat[where 'a=64, folded word_bits_def]\n\nlemma unat_mask_3_less_8:\n \"unat (p && mask 3 :: word64) < 8\"\n apply (rule unat_less_helper)\n apply (rule order_le_less_trans, rule word_and_le1)\n apply (simp add: mask_def)\n done\n\nlemma scast_specific_plus64:\n \"scast (of_nat (word_ctz x) + 0x20 :: 64 signed word) = of_nat (word_ctz x) + (0x20 :: machine_word)\"\n by (simp add: scast_down_add is_down_def target_size_def source_size_def word_size)\n\nlemma scast_specific_plus64_signed:\n \"scast (of_nat (word_ctz x) + 0x20 :: machine_word) = of_nat (word_ctz x) + (0x20 :: 64 signed word)\"\n by (simp add: scast_down_add is_down_def target_size_def source_size_def word_size)\n\nlemmas mask_64_id[simp] = mask_len_id[where 'a=64, folded word_bits_def]\n mask_len_id[where 'a=64, simplified]\n\n\nend", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Word_Lib/Word_Lemmas_64_Internal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3345894346180164, "lm_q1q2_score": 0.1751309186181695}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_on_inv__88.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_on_inv__88 imports n_g2kAbsAfter_base\nbegin\nsection{*All lemmas on causal relation between inv__88 and some rule r*}\nlemma n_n_RecvReq_i1Vsinv__88:\nassumes a1: \"(r=n_n_RecvReq_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Ident ''Chan3_1'') ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_SendInvAck_i1Vsinv__88:\nassumes a1: \"(r=n_n_SendInvAck_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Ident ''Chan2_1'') ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Ident ''ExGntd'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_RecvInvAck_i1Vsinv__88:\nassumes a1: \"(r=n_n_RecvInvAck_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_SendGntS_i1Vsinv__88:\nassumes a1: \"(r=n_n_SendGntS_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_SendGntE_i1Vsinv__88:\nassumes a1: \"(r=n_n_SendGntE_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvReq_i1Vsinv__88:\nassumes a1: \"(r=n_n_ARecvReq_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Ident ''Chan3_1'') ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvInvAck_i1Vsinv__88:\nassumes a1: \"(r=n_n_ARecvInvAck_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Ident ''Chan3_1'') ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Field (Ident ''AChan3_1'') ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_ASendGntS_i1Vsinv__88:\nassumes a1: \"(r=n_n_ASendGntS_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendGntE_i1Vsinv__88:\nassumes a1: \"(r=n_n_ASendGntE_i1 )\" and\na2: \"(f=inv__88 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_SendInvS_i1Vsinv__88:\n assumes a1: \"r=n_n_SendInvS_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEI_i1Vsinv__88:\n assumes a1: \"r=n_n_SendReqEI_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqEI_i1Vsinv__88:\n assumes a1: \"r=n_n_ASendReqEI_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqIS_j1Vsinv__88:\n assumes a1: \"r=n_n_ASendReqIS_j1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqES_i1Vsinv__88:\n assumes a1: \"r=n_n_ASendReqES_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ARecvGntE_i1Vsinv__88:\n assumes a1: \"r=n_n_ARecvGntE_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ARecvGntS_i1Vsinv__88:\n assumes a1: \"r=n_n_ARecvGntS_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendInvE_i1Vsinv__88:\n assumes a1: \"r=n_n_ASendInvE_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendInvS_i1Vsinv__88:\n assumes a1: \"r=n_n_ASendInvS_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqES_i1Vsinv__88:\n assumes a1: \"r=n_n_SendReqES_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvE_i1Vsinv__88:\n assumes a1: \"r=n_n_SendInvE_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqSE_j1Vsinv__88:\n assumes a1: \"r=n_n_ASendReqSE_j1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntS_i1Vsinv__88:\n assumes a1: \"r=n_n_RecvGntS_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEE_i1Vsinv__88:\n assumes a1: \"r=n_n_SendReqEE_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntE_i1Vsinv__88:\n assumes a1: \"r=n_n_RecvGntE_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_Store_i1Vsinv__88:\n assumes a1: \"\\ d. d\\N\\r=n_n_Store_i1 d\" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_AStore_i1Vsinv__88:\n assumes a1: \"\\ d. d\\N\\r=n_n_AStore_i1 d\" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqS_j1Vsinv__88:\n assumes a1: \"r=n_n_SendReqS_j1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendInvAck_i1Vsinv__88:\n assumes a1: \"r=n_n_ASendInvAck_i1 \" and\n a2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_on_inv__88.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.34158250614097546, "lm_q1q2_score": 0.17479344026879967}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nTop level architecture related proofs.\n*)\n\ntheory Arch_AI\nimports \"./$L4V_ARCH/ArchUntyped_AI\" \"./$L4V_ARCH/ArchFinalise_AI\"\nbegin\n\ndeclare detype_arch_state[simp]\n\nlemma invs_strgs:\n \"invs s \\ valid_pspace s\"\n \"invs s \\ valid_mdb s\"\n \"invs s \\ valid_objs s\"\n \"invs s \\ pspace_aligned s\"\n by auto\n\n\nlemma assocs_dom_comp:\n \"set (map fst (filter (\\(x,y). P x \\ y = None) (assocs f))) = (- dom f \\ Collect P)\"\n apply (clarsimp simp: in_assocs_is_fun)\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI, clarsimp)\n apply (erule conjE)\n apply (drule not_in_domD)\n apply (rule_tac x=\"(x,None)\" in image_eqI)\n apply simp\n apply simp\n done\n\n\nlemma assocs_empty_dom_comp:\n \"(- dom f \\ Collect P = {}) = null (filter (\\(x, y). P x \\ y = None) (assocs f))\"\n apply (subst assocs_dom_comp [symmetric])\n apply (subst empty_set_is_null)\n apply (simp add: null_def)\n done\n\n\nlemma dom_hd_assocsD:\n fixes P\n defines \"filter_assocs f \\ filter (\\(x,y). P x \\ y = None) (assocs f)\"\n assumes d: \"- dom f \\ Collect P \\ {}\"\n shows \"fst (hd (filter_assocs f)) \\ dom f \\ P (fst (hd (filter_assocs f)))\"\nproof -\n from d have \"\\null (filter_assocs f)\"\n unfolding filter_assocs_def\n by (simp add: assocs_empty_dom_comp)\n hence \"hd (filter_assocs f) \\ set (filter_assocs f)\"\n by (clarsimp simp: null_def neq_Nil_conv)\n thus ?thesis\n unfolding filter_assocs_def\n by (clarsimp simp: in_assocs_is_fun)\nqed\n\n\nlemma ucast_assocs:\n \"len_of TYPE('a) < len_of TYPE('b) \\\n assocs (fn o (ucast :: ('a :: len) word \\ ('b :: len) word))\n = map (\\(x, y). (ucast x, y)) (filter (\\(x, y). x < 2 ^ len_of TYPE('a)) (assocs fn))\"\n apply (simp add: assocs_def enum_word_def\n split_def filter_map)\n apply (rule map_cong)\n apply (simp add: o_def)\n apply (rule trans [OF _ filter_cong [OF refl]],\n rule sym, rule filter_to_shorter_upto)\n apply simp\n apply (rule iffI)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply simp\n apply assumption\n apply (simp add: word_less_nat_alt word_unat.Abs_inverse unats_def)\n apply clarsimp\n apply (simp add: word_less_nat_alt word_unat.Abs_inverse unats_def)\n apply (simp add: ucast_of_nat_small)\n done\n\n\nlemma ucast_le_migrate:\n fixes x :: \"('a :: len) word\"\n fixes y :: \"('b :: len) word\"\n shows\n \"\\ y < 2 ^ (size x); size x < size y \\ \\\n (ucast x \\ y) = (x \\ ucast y)\"\n apply (simp add: word_le_def ucast_def)\n apply (subst word_uint.Abs_inverse)\n apply (simp add: uints_num word_size)\n apply (rule order_less_le_trans, rule uint_lt2p)\n apply simp\n apply (subst word_uint.Abs_inverse)\n apply (simp add: uints_num word_size word_less_alt\n uint_2p_alt)\n apply simp\n done\n\n\nlemma obj_at_delete_objects:\n \"\\\\s. Q (obj_at (P (interrupt_irq_node s) (arch_state s)) r s) \\\n r \\ {ptr..ptr + 2 ^ bits - 1}\\\n delete_objects ptr bits\n \\\\_ s. Q (obj_at (P (interrupt_irq_node s) (arch_state s)) r s)\\\"\n apply (simp add: delete_objects_def do_machine_op_def split_def)\n apply wp\n apply (simp add: detype_machine_state_update_comm)\n done\n\n\n(* FIXME: move *)\ncrunch arch [wp]: retype_region \"\\s. P (arch_state s)\"\n (simp: crunch_simps)\n\nlemma set_free_index_final_cap:\n \"\\\\s. P (is_final_cap' cap s) \\ cte_wp_at ((=) src_cap) src s\\\n set_cap (free_index_update f src_cap) src\n \\\\rv s. P (is_final_cap' cap s) \\\"\n apply (simp add:is_final_cap'_def2)\n apply (clarsimp simp:valid_def)\n apply (drule set_cap_caps_of_state_monad)\n apply (erule subst[rotated])\n apply (rule_tac f = P in arg_cong)\n apply (subgoal_tac \"\\slot. (cte_wp_at (\\c. gen_obj_refs cap \\ gen_obj_refs c \\ {}) slot s\n = cte_wp_at (\\c. gen_obj_refs cap \\ gen_obj_refs c \\ {}) slot b)\")\n apply simp\n apply (clarsimp split:cap.splits\n simp:cte_wp_at_caps_of_state free_index_update_def\n gen_obj_refs_def)\n done\n\nlemma set_cap_orth:\n \"\\\\s. P s \\ Q cap' s\\ set_cap cap src \\\\rv s. Q cap' s\\ \\\n \\\\s. P s \\ src\\ dest \\ (cte_wp_at ((=) cap') dest s \\ Q cap' s)\\\n set_cap cap src\n \\\\rv s. cte_wp_at ((=) cap') dest s \\ Q cap' s\\\"\n apply (clarsimp simp:valid_def cte_wp_at_caps_of_state)\n apply (drule_tac x = s in spec)\n apply (frule set_cap_caps_of_state_monad)\n apply clarsimp\n apply (drule(1) bspec)\n apply clarsimp\n done\n\n\nlemma set_cap_empty_tables[wp]:\n \"\\\\s. P (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s)\\\n set_cap cap cref\n \\\\rv s. P (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s)\\\"\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=arch_state, OF set_cap_arch])\n apply (wp set_cap_obj_at_impossible)\n apply (clarsimp simp: empty_table_caps_of)\n done\n\n\nlemma cte_wp_at_eq_to_op_eq:\n \"cte_wp_at (\\c. c = cap) = cte_wp_at ((=) cap)\"\n by (simp add: cte_wp_at_caps_of_state fun_eq_iff)\n\n\nlemma max_index_upd_caps_overlap_reserved:\n \"\\\\s. invs s \\ S \\ untyped_range cap \\\n descendants_range_in S slot s \\ cte_wp_at ((=) cap) slot s \\ is_untyped_cap cap\\\n set_cap (max_free_index_update cap) slot\n \\\\rv. caps_overlap_reserved S\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:is_cap_simps)\n apply (wp set_untyped_cap_caps_overlap_reserved)\n apply (auto simp:cte_wp_at_caps_of_state max_free_index_def)\n done\n\n\nlemma max_index_upd_invs_simple:\n \"\\\\s. descendants_range_in (untyped_range cap) cref s \\\n pspace_no_overlap_range_cover (obj_ref_of cap) (cap_bits cap) s \\\n invs s \\ cte_wp_at ((=) cap) cref s \\ is_untyped_cap cap\\\n set_cap (max_free_index_update cap) cref \\\\rv. invs\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp:is_cap_simps)\n apply (wp set_untyped_cap_invs_simple)\n apply (auto simp:cte_wp_at_caps_of_state max_free_index_def)\n done\n\n\nlemma sts_pspace_no_overlap [wp]:\n \"\\pspace_no_overlap S\\ set_thread_state t st \\\\rv. pspace_no_overlap S\\\"\n by (wp pspace_no_overlap_typ_at_lift)\n\n\nlemma delete_objects_st_tcb_at:\n \"\\pred_tcb_at proj P t and invs and K (t \\ {ptr .. ptr + 2 ^ bits - 1})\\\n delete_objects ptr bits\n \\\\y. pred_tcb_at proj P t\\\"\n by (wp|simp add: delete_objects_def do_machine_op_def split_def)+\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/Arch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.341582499438317, "lm_q1q2_score": 0.17479343683893803}} {"text": "(* Title: HOL/Auth/n_mutualEx_lemma_on_inv__3.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_on_inv__3 imports n_mutualEx_base\nbegin\nsection{*All lemmas on causal relation between inv__3 and some rule r*}\nlemma n_TryVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const E)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const C)) (eqn (IVar (Para (Ident ''n'') p__Inv3)) (Const C))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i=p__Inv3)\\(i~=p__Inv3\\i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv3\\i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_on_inv__3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.341582499438317, "lm_q1q2_score": 0.17479343683893803}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__41_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__41_on_rules imports n_german_lemma_on_inv__41\nbegin\nsection{*All lemmas on causal relation between inv__41*}\nlemma lemma_inv__41_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__41 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__41) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__41_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.3311197330283893, "lm_q1q2_score": 0.17460490644290072}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_on_inis imports n_flash_nodata_cub_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\\\n (f=inv__7 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\\\n (f=inv__10 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__14 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (f=inv__16 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (f=inv__19 )\\\n (f=inv__20 )\\\n (f=inv__21 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\\\n (f=inv__25 )\\\n (f=inv__26 )\\\n (f=inv__27 )\\\n (f=inv__28 )\\\n (f=inv__29 )\\\n (f=inv__30 )\\\n (f=inv__31 )\\\n (f=inv__32 )\\\n (f=inv__33 )\\\n (f=inv__34 )\\\n (f=inv__35 )\\\n (f=inv__36 )\\\n (f=inv__37 )\\\n (f=inv__38 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\\\n (f=inv__40 )\\\n (f=inv__41 )\\\n (f=inv__42 )\\\n (f=inv__43 )\\\n (f=inv__44 )\\\n (f=inv__45 )\\\n (f=inv__46 )\\\n (f=inv__47 )\\\n (f=inv__48 )\\\n (f=inv__49 )\\\n (f=inv__50 )\\\n (f=inv__51 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\\\n (f=inv__53 )\\\n (f=inv__54 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__55 p__Inv4)\\\n (f=inv__56 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__57 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__58 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__59 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__60 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\\\n (f=inv__62 )\\\n (f=inv__63 )\\\n (f=inv__64 )\\\n (f=inv__65 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\\\n (f=inv__67 )\\\n (f=inv__68 )\\\n (f=inv__69 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__70 p__Inv4)\\\n (f=inv__71 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__72 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__73 p__Inv4)\\\n (f=inv__74 )\\\n (f=inv__75 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__76 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__79 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__80 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__82 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__83 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__85 p__Inv4)\\\n (f=inv__86 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__87 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__88 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\\\n (f=inv__90 )\\\n (f=inv__91 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__92 p__Inv4)\\\n (f=inv__93 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__94 p__Inv4)\\\n (f=inv__95 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__96 p__Inv4)\\\n (f=inv__97 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__98 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\\\n (f=inv__102 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__103 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__104 p__Inv4)\\\n (f=inv__105 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\\\n (f=inv__108 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__109 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__111 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__112 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__113 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__114 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\\\n (f=inv__118 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__119 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__120 p__Inv4)\\\n (f=inv__121 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__122 p__Inv4)\\\n (f=inv__123 )\\\n (f=inv__124 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__125 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__126 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__127 p__Inv4)\\\n (f=inv__128 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\\\n (f=inv__130 )\\\n (f=inv__131 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__133 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\\\n (f=inv__135 )\\\n (f=inv__136 )\\\n (f=inv__137 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__138 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__140 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\\\n (f=inv__142 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__143 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__144 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__146 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__147 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__148 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__150 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__151 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__152 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__3 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__7 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__9 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__10 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__12 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__14 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__16 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__19 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__20 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__21 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__25 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__26 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__27 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__28 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__29 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__30 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__31 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__32 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__33 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__34 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__35 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__36 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__37 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__38 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__40 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__41 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__42 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__43 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__44 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__45 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__46 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__47 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__48 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__49 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__50 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__51 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__53 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__53)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__54 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__54)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__55 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__55)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__56 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__56)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__57 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__57)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__58 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__58)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__59 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__59)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__60 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__60)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__61 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__61)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__62 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__62)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__63 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__63)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__64 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__64)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__65 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__65)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__66 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__66)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__67 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__67)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__68 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__68)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__69 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__69)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__70 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__70)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__71 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__71)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__72 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__72)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__73 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__73)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__74 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__74)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__75 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__75)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__76 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__76)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__77)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__78)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__79 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__79)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__80 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__80)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__81)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__82 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__82)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__83 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__83)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__84)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__85 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__85)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__86 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__86)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__87 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__87)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__88 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__88)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__89)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__90 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__90)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__91 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__91)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__92 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__92)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__93 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__93)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__94 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__94)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__95 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__95)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__96 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__96)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__97 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__97)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__98 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__98)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__99)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__100)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__101)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__102 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__102)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__103 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__103)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__104 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__104)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__105 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__105)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__106)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__107)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__108 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__108)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__109 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__109)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__110)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__111 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__111)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__112 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__112)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__113 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__113)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__114 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__114)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__115)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__116)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__117)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__118 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__118)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__119 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__119)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__120 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__120)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__121 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__121)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__122 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__122)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__123 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__123)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__124 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__124)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__125 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__125)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__126 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__126)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__127 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__127)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__128 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__128)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__129)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__130 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__130)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__131 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__131)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__132)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__133 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__133)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__134)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__135 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__135)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__136 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__136)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__137 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__137)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__138 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__138)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__139)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__140 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__140)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__141)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__142 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__142)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__143 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__143)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__144 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__144)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__145)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__146 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__146)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__147 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__147)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__148 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__148)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__149)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__150 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__150)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__151 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__151)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__152 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__152)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.30404166235418484, "lm_q1q2_score": 0.1744221410907592}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__27.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__27 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__27 and some rule r*}\nlemma n_PI_Local_Get_PutVsinv__27:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__27:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__27:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__27:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__27:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__27:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__27:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__27:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__27:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__27:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__27:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__27:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__27:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__27:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__27:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__27:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__27 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__27:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__27:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__27:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__27:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__27:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__27:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__27:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__27:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10Vsinv__27:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__27:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__27:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__27:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__27:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__27:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__27:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__27.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.32766831395172374, "lm_q1q2_score": 0.17406047972873043}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__157.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__157 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__157 and some rule r*}\nlemma n_PI_Remote_GetVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__157:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__157:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__157:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__157:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__157:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__157:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__157:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__157:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__157:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__157:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__157:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__157:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__157:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__157:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__157 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__157:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__157:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__157:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__157:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__157:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__157:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__157:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__157:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__157:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__157:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__157:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__157:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__157:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__157:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__157:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__157:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__157:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__157:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__157:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__157:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__157.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.34510528442897664, "lm_q1q2_score": 0.17390068230595473}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__101.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__101 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__101 and some rule r*}\nlemma n_PI_Remote_GetVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__101:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__101:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__101:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__101:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__101:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__101:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__101:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__101:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__101:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__101:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__101:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__101:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__101:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__101 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__101:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__101:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__101:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__101:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__101:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__101:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__101:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__101:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__101:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__101:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__101:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__101:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__101:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__101:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__101:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__101:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__101.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3451052642223204, "lm_q1q2_score": 0.17390067212369598}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__35.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__35 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__35 and some rule r*}\nlemma n_SendInvAckVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__35 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__35:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqESVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInvEVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendInvE i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReq N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__35:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__35.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213368305399, "lm_q2_score": 0.3345894478883556, "lm_q1q2_score": 0.17382635725635076}} {"text": "(* Title: HOL/MicroJava/J/WellType.thy\n Author: David von Oheimb\n Copyright 1999 Technische Universitaet Muenchen\n*)\n\nsection {* Well-typedness Constraints *}\n\ntheory WellType imports Term WellForm begin\n\ntext {*\nthe formulation of well-typedness of method calls given below (as well as\nthe Java Specification 1.0) is a little too restrictive: Is does not allow\nmethods of class Object to be called upon references of interface type.\n\n\\begin{description}\n\\item[simplifications:]\\ \\\\\n\\begin{itemize}\n\\item the type rules include all static checks on expressions and statements, \n e.g.\\ definedness of names (of parameters, locals, fields, methods)\n\\end{itemize}\n\\end{description}\n*}\n\ntext \"local variables, including method parameters and This:\"\ntype_synonym lenv = \"vname \\ ty\"\ntype_synonym 'c env = \"'c prog \\ lenv\"\n\nabbreviation (input)\n prg :: \"'c env => 'c prog\"\n where \"prg == fst\"\n\nabbreviation (input)\n localT :: \"'c env => (vname \\ ty)\"\n where \"localT == snd\"\n\nconsts\n more_spec :: \"'c prog => (ty \\ 'x) \\ ty list =>\n (ty \\ 'x) \\ ty list => bool\"\n appl_methds :: \"'c prog => cname => sig => ((ty \\ ty) \\ ty list) set\"\n max_spec :: \"'c prog => cname => sig => ((ty \\ ty) \\ ty list) set\"\n\ndefs\n more_spec_def: \"more_spec G == \\((d,h),pTs). \\((d',h'),pTs'). G\\d\\d' \\\n list_all2 (\\T T'. G\\T\\T') pTs pTs'\"\n \n -- \"applicable methods, cf. 15.11.2.1\"\n appl_methds_def: \"appl_methds G C == \\(mn, pTs).\n {((Class md,rT),pTs') |md rT mb pTs'.\n method (G,C) (mn, pTs') = Some (md,rT,mb) \\\n list_all2 (\\T T'. G\\T\\T') pTs pTs'}\"\n\n -- \"maximally specific methods, cf. 15.11.2.2\"\n max_spec_def: \"max_spec G C sig == {m. m \\appl_methds G C sig \\ \n (\\m'\\appl_methds G C sig.\n more_spec G m' m --> m' = m)}\"\n\nlemma max_spec2appl_meths: \n \"x \\ max_spec G C sig ==> x \\ appl_methds G C sig\"\napply (unfold max_spec_def)\napply (fast)\ndone\n\nlemma appl_methsD: \n\"((md,rT),pTs')\\appl_methds G C (mn, pTs) ==> \n \\D b. md = Class D \\ method (G,C) (mn, pTs') = Some (D,rT,b) \n \\ list_all2 (\\T T'. G\\T\\T') pTs pTs'\"\napply (unfold appl_methds_def)\napply (fast)\ndone\n\nlemmas max_spec2mheads = insertI1 [THEN [2] equalityD2 [THEN subsetD], \n THEN max_spec2appl_meths, THEN appl_methsD]\n\n\nprimrec typeof :: \"(loc => ty option) => val => ty option\"\nwhere\n \"typeof dt Unit = Some (PrimT Void)\"\n| \"typeof dt Null = Some NT\"\n| \"typeof dt (Bool b) = Some (PrimT Boolean)\"\n| \"typeof dt (Intg i) = Some (PrimT Integer)\"\n| \"typeof dt (Addr a) = dt a\"\n\nlemma is_type_typeof [rule_format (no_asm), simp]: \n \"(\\a. v \\ Addr a) --> (\\T. typeof t v = Some T \\ is_type G T)\"\napply (rule val.induct)\napply auto\ndone\n\nlemma typeof_empty_is_type [rule_format (no_asm)]: \n \"typeof (\\a. None) v = Some T \\ is_type G T\"\napply (rule val.induct)\napply auto\ndone\n\nlemma typeof_default_val: \"\\T. (typeof dt (default_val ty) = Some T) \\ G\\ T \\ ty\"\napply (case_tac ty)\napply (rename_tac prim_ty, case_tac prim_ty)\napply auto\ndone\n\ntype_synonym\n java_mb = \"vname list \\ (vname \\ ty) list \\ stmt \\ expr\"\n-- \"method body with parameter names, local variables, block, result expression.\"\n-- \"local variables might include This, which is hidden anyway\"\n \ninductive\n ty_expr :: \"'c env => expr => ty => bool\" (\"_ \\ _ :: _\" [51, 51, 51] 50)\n and ty_exprs :: \"'c env => expr list => ty list => bool\" (\"_ \\ _ [::] _\" [51, 51, 51] 50)\n and wt_stmt :: \"'c env => stmt => bool\" (\"_ \\ _ \\\" [51, 51] 50)\nwhere\n \n NewC: \"[| is_class (prg E) C |] ==>\n E\\NewC C::Class C\" -- \"cf. 15.8\"\n\n -- \"cf. 15.15\"\n| Cast: \"[| E\\e::C; is_class (prg E) D;\n prg E\\C\\? Class D |] ==>\n E\\Cast D e:: Class D\"\n\n -- \"cf. 15.7.1\"\n| Lit: \"[| typeof (\\v. None) x = Some T |] ==>\n E\\Lit x::T\"\n\n \n -- \"cf. 15.13.1\"\n| LAcc: \"[| localT E v = Some T; is_type (prg E) T |] ==>\n E\\LAcc v::T\"\n\n| BinOp:\"[| E\\e1::T;\n E\\e2::T;\n if bop = Eq then T' = PrimT Boolean\n else T' = T \\ T = PrimT Integer|] ==>\n E\\BinOp bop e1 e2::T'\"\n\n -- \"cf. 15.25, 15.25.1\"\n| LAss: \"[| v ~= This;\n E\\LAcc v::T;\n E\\e::T';\n prg E\\T'\\T |] ==>\n E\\v::=e::T'\"\n\n -- \"cf. 15.10.1\"\n| FAcc: \"[| E\\a::Class C; \n field (prg E,C) fn = Some (fd,fT) |] ==>\n E\\{fd}a..fn::fT\"\n\n -- \"cf. 15.25, 15.25.1\"\n| FAss: \"[| E\\{fd}a..fn::T;\n E\\v ::T';\n prg E\\T'\\T |] ==>\n E\\{fd}a..fn:=v::T'\"\n\n\n -- \"cf. 15.11.1, 15.11.2, 15.11.3\"\n| Call: \"[| E\\a::Class C;\n E\\ps[::]pTs;\n max_spec (prg E) C (mn, pTs) = {((md,rT),pTs')} |] ==>\n E\\{C}a..mn({pTs'}ps)::rT\"\n\n-- \"well-typed expression lists\"\n\n -- \"cf. 15.11.???\"\n| Nil: \"E\\[][::][]\"\n\n -- \"cf. 15.11.???\"\n| Cons:\"[| E\\e::T;\n E\\es[::]Ts |] ==>\n E\\e#es[::]T#Ts\"\n\n-- \"well-typed statements\"\n\n| Skip:\"E\\Skip\\\"\n\n| Expr:\"[| E\\e::T |] ==>\n E\\Expr e\\\"\n\n| Comp:\"[| E\\s1\\; \n E\\s2\\ |] ==>\n E\\s1;; s2\\\"\n\n -- \"cf. 14.8\"\n| Cond:\"[| E\\e::PrimT Boolean;\n E\\s1\\;\n E\\s2\\ |] ==>\n E\\If(e) s1 Else s2\\\"\n\n -- \"cf. 14.10\"\n| Loop:\"[| E\\e::PrimT Boolean;\n E\\s\\ |] ==>\n E\\While(e) s\\\"\n\n\ndefinition wf_java_mdecl :: \"'c prog => cname => java_mb mdecl => bool\" where\n\"wf_java_mdecl G C == \\((mn,pTs),rT,(pns,lvars,blk,res)).\n length pTs = length pns \\\n distinct pns \\\n unique lvars \\\n This \\ set pns \\ This \\ set (map fst lvars) \\ \n (\\pn\\set pns. map_of lvars pn = None) \\\n (\\(vn,T)\\set lvars. is_type G T) &\n (let E = (G,map_of lvars(pns[\\]pTs)(This\\Class C)) in\n E\\blk\\ \\ (\\T. E\\res::T \\ G\\T\\rT))\"\n\nabbreviation \"wf_java_prog == wf_prog wf_java_mdecl\"\n\nlemma wf_java_prog_wf_java_mdecl: \"\\ \n wf_java_prog G; (C, D, fds, mths) \\ set G; jmdcl \\ set mths \\\n \\ wf_java_mdecl G C jmdcl\"\napply (simp only: wf_prog_def) \napply (erule conjE)+\napply (drule bspec, assumption)\napply (simp add: wf_cdecl_mdecl_def split_beta)\ndone\n\n\nlemma wt_is_type: \"(E\\e::T \\ ws_prog (prg E) \\ is_type (prg E) T) \\ \n (E\\es[::]Ts \\ ws_prog (prg E) \\ Ball (set Ts) (is_type (prg E))) \\ \n (E\\c \\ \\ True)\"\napply (rule ty_expr_ty_exprs_wt_stmt.induct)\napply auto\napply ( erule typeof_empty_is_type)\napply ( simp split add: split_if_asm)\napply ( drule field_fields)\napply ( drule (1) fields_is_type)\napply ( simp (no_asm_simp))\napply (assumption)\napply (auto dest!: max_spec2mheads method_wf_mhead is_type_rTI \n simp add: wf_mdecl_def)\ndone\n\nlemmas ty_expr_is_type = wt_is_type [THEN conjunct1,THEN mp, rule_format]\n\nlemma expr_class_is_class: \"\n \\ws_prog (prg E); E \\ e :: Class C\\ \\ is_class (prg E) C\"\n by (frule ty_expr_is_type, assumption, simp)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/J/WellType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.17382634538395528}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nRefinement for interrupt controller operations\n*)\n\ntheory Interrupt_AI\nimports \"./$L4V_ARCH/ArchIpc_AI\"\nbegin\n\n\ncontext begin interpretation Arch .\nrequalify_consts\n maxIRQ\n\nrequalify_facts\n arch_post_cap_deletion_mdb_inv\nend\n\ndefinition\n interrupt_derived :: \"cap \\ cap \\ bool\"\nwhere\n \"interrupt_derived cap cap' \\ \\ is_untyped_cap cap \\ cap_master_cap cap = cap_master_cap cap'\n \\ (cap_badge cap', cap_badge cap) \\ capBadge_ordering False\"\n\nprimrec\n irq_handler_inv_valid :: \"irq_handler_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"irq_handler_inv_valid (ACKIrq irq) = (\\s. interrupt_states s irq \\ IRQInactive)\"\n| \"irq_handler_inv_valid (Invocations_A.ClearIRQHandler irq) = \\\"\n| \"irq_handler_inv_valid (Invocations_A.SetIRQHandler irq cap cte_ptr)\n = (\\s. ex_cte_cap_wp_to (is_cnode_cap) cte_ptr s\n \\ (\\ptr'. cte_wp_at ((=) (cap.IRQHandlerCap irq)) ptr' s)\n \\ cte_wp_at (interrupt_derived cap) cte_ptr s\n \\ s \\ cap \\ is_ntfn_cap cap)\"\n\nconsts\n arch_irq_control_inv_valid :: \"arch_irq_control_invocation \\ ('a :: state_ext) state \\ bool\"\n\nprimrec\n irq_control_inv_valid :: \"irq_control_invocation \\ 'a::state_ext state \\ bool\"\nwhere\n \"irq_control_inv_valid (Invocations_A.ArchIRQControl ivk) = (arch_irq_control_inv_valid ivk)\"\n| \"irq_control_inv_valid (Invocations_A.IRQControl irq ptr ptr') =\n (cte_wp_at ((=) cap.NullCap) ptr and\n cte_wp_at ((=) cap.IRQControlCap) ptr'\n and ex_cte_cap_wp_to is_cnode_cap ptr and real_cte_at ptr\n and K (irq \\ maxIRQ))\"\n\n\nlocale Interrupt_AI =\n fixes state_ext_type1 :: \"('a :: state_ext) itself\"\n assumes decode_irq_control_invocation_inv[wp]:\n \"\\(P :: 'a state \\ bool) args slot label caps.\n \\P\\ decode_irq_control_invocation label args slot caps \\\\rv. P\\\"\n assumes decode_irq_control_valid[wp]:\n \"\\slot caps label args.\n \\\\s :: 'a state. invs s \\ (\\cap \\ set caps. s \\ cap)\n \\ (\\cap \\ set caps. is_cnode_cap cap \\\n (\\r \\ cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\n \\ cte_wp_at ((=) cap.IRQControlCap) slot s\\\n decode_irq_control_invocation label args slot caps\n \\irq_control_inv_valid\\,-\"\n assumes get_irq_slot_different:\n \"\\ irq ptr.\n \\\\s :: 'a state. valid_global_refs s \\ ex_cte_cap_wp_to is_cnode_cap ptr s\\\n get_irq_slot irq\n \\\\rv s. rv \\ ptr\\\"\n assumes is_derived_use_interrupt:\n \"\\ cap cap' m p.\n (is_ntfn_cap cap \\ interrupt_derived cap cap') \\ (is_derived m p cap cap')\"\n assumes maskInterrupt_invs:\n \"\\b irq.\n \\invs and (\\s :: 'a state. \\b \\ interrupt_states s irq \\ IRQInactive)\\\n do_machine_op (maskInterrupt b irq)\n \\\\rv. invs\\\"\n assumes no_cap_to_obj_with_diff_IRQHandler[simp]:\n \"\\ irq S. (no_cap_to_obj_with_diff_ref (IRQHandlerCap irq) S :: 'a state \\ bool)= \\\"\n assumes set_irq_state_valid_cap[wp]:\n \"\\ cap irq.\n \\valid_cap cap :: 'a state \\ bool\\\n set_irq_state IRQSignal irq\n \\\\rv. valid_cap cap\\\"\n assumes set_irq_state_valid_global_refs[wp]:\n \"\\ a b.\n \\valid_global_refs :: 'a state \\ bool\\\n set_irq_state a b\n \\\\_. valid_global_refs\\\"\n assumes invoke_irq_handler_invs':\n \"\\ (ex_inv :: 'a state \\ bool) i.\n \\ \\f. \\invs and ex_inv\\ do_machine_op f \\\\rv::unit. ex_inv\\;\n \\cap src dest.\n \\ex_inv and invs and K (src \\ dest)\\\n cap_insert cap src dest\n \\\\_.ex_inv\\;\n \\cap. \\ex_inv and invs\\ cap_delete_one cap \\\\_.ex_inv\\\n \\ \\\n \\invs and ex_inv and irq_handler_inv_valid i\\ invoke_irq_handler i \\\\rv s. invs s \\ ex_inv s\\\"\n assumes invoke_irq_control_invs[wp]:\n \"\\ i. \\invs and irq_control_inv_valid i\\ invoke_irq_control i \\\\rv. invs :: 'a state \\ bool\\\"\n assumes resetTimer_invs[wp]:\n \"\\invs :: 'a state \\ bool\\ do_machine_op resetTimer \\\\_. invs\\\"\n assumes empty_fail_ackInterrupt[simp, intro!]:\n \"\\ irq. empty_fail (ackInterrupt irq)\"\n assumes empty_fail_maskInterrupt[simp, intro!]:\n \"\\ f irq. empty_fail (maskInterrupt f irq)\"\n assumes handle_interrupt_invs [wp]:\n \"\\ irq. \\invs :: 'a state \\ bool\\ handle_interrupt irq \\\\_. invs\\\"\n assumes sts_arch_irq_control_inv_valid [wp]:\n \"\\i t st.\n \\arch_irq_control_inv_valid i :: 'a state \\ bool\\\n set_thread_state t st\n \\\\rv. arch_irq_control_inv_valid i\\\"\n\ncrunch inv[wp]: decode_irq_handler_invocation \"P\"\n (simp: crunch_simps)\n\nlemma valid_irq_handlersD:\n \"\\cte_wp_at ((=) (IRQHandlerCap irq)) (a, b) s; valid_irq_handlers s\\ \\\n interrupt_states s irq = IRQSignal\"\n apply(auto simp: valid_irq_handlers_def cte_wp_at_caps_of_state irq_issued_def cap_irqs_def cap_irq_opt_def split: cap.splits)\n done\n\nlemma decode_irq_handler_valid[wp]:\n \"\\\\s. invs s \\ (\\cap \\ set caps. s \\ fst cap) \\ (\\ptr'. cte_wp_at ((=) (cap.IRQHandlerCap irq)) ptr' s)\n \\ (\\cap \\ set caps. \\r \\ cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_to r s)\n \\ (\\cap \\ set caps. ex_cte_cap_wp_to is_cnode_cap (snd cap) s)\n \\ (\\cap \\ set caps. cte_wp_at (interrupt_derived (fst cap)) (snd cap) s)\\\n decode_irq_handler_invocation label irq caps\n \\irq_handler_inv_valid\\,-\"\n apply (simp add: decode_irq_handler_invocation_def Let_def split_def\n split del: if_split cong: if_cong)\n apply (rule hoare_pre, wp)\n apply (clarsimp simp: neq_Nil_conv)\n apply (fastforce dest: valid_irq_handlersD simp: invs_def valid_state_def)\n done\n\ncrunch inv[wp]: is_irq_active \"P\"\n\nlemma mod_le:\n \"\\b < c;b dvd c\\ \\ (a mod b \\ a mod (c::nat))\"\n apply (subst mod_mod_cancel[symmetric],simp)\n by simp\n\nlemma is_up_8_32: \"is_up (ucast :: word8 \\ word32)\"\n by (simp add: is_up_def source_size_def target_size_def word_size)\n\n\ncrunches\n cancel_all_ipc, cancel_all_signals, fast_finalise, set_cap, post_cap_deletion\n for mdb_inv[wp]: \"\\s. P (cdt s)\"\n (wp: crunch_wps)\n\nlemma cap_delete_one_still_derived:\n \"\\\\s. cte_wp_at (is_derived (cdt s) p' cap) p' s \\ p \\ p' \\ valid_mdb s\\\n cap_delete_one p\n \\\\rv s. cte_wp_at (is_derived (cdt s) p' cap) p' s\\\"\n apply (simp add: cap_delete_one_def empty_slot_def unless_def\n cte_wp_at_caps_of_state set_cdt_def)\n apply (wp hoare_vcg_ex_lift)\n apply (simp split del:if_split)\n apply (wp hoare_vcg_ex_lift get_cap_wp hoare_vcg_all_lift\n hoare_vcg_disj_lift\n | simp only: cte_wp_at_caps_of_state imp_conv_disj\n cdt_update.caps_of_state_update\n revokable_update.caps_of_state_update\n | simp)+\n apply (simp add: is_final_cap_def | wp)+\n apply (rule get_cap_wp)\n apply (clarsimp simp: cte_wp_at_caps_of_state if_apply_def2\n split del: if_split)\n apply (rule_tac x=capa in exI)\n apply (clarsimp simp only: is_derived_def simp_thms\n split: if_split_asm)\n apply clarsimp\n apply (subst mdb_empty_abs.descendants[unfolded fun_upd_def])\n apply (rule mdb_empty_abs.intro)\n apply (rule vmdb_abs.intro)\n apply simp\n apply simp\n apply auto\n done\n\n\nlemma cap_delete_one_cte_cap_to[wp]:\n \"\\ex_cte_cap_wp_to P ptr\\ cap_delete_one ptr' \\\\rv. ex_cte_cap_wp_to P ptr\\\"\n apply (simp add: ex_cte_cap_wp_to_def)\n apply (wp hoare_vcg_ex_lift\n hoare_use_eq_irq_node [OF cap_delete_one_irq_node\n cap_delete_one_cte_wp_at_preserved])\n apply (clarsimp simp: can_fast_finalise_def split: cap.split_asm)+\n done\n\n\nlemma get_irq_slot_ex_cte:\n \"\\\\s. \\ptr. cte_wp_at ((=) (cap.IRQHandlerCap irq)) ptr s \\ P (cap.IRQHandlerCap irq)\\\n get_irq_slot irq\n \\ex_cte_cap_wp_to P\\\"\n apply (simp add: get_irq_slot_def)\n apply wp\n apply (simp add: ex_cte_cap_wp_to_def)\n apply (elim conjE exEI cte_wp_at_weakenE)\n apply clarsimp\n done\n\ncrunch pspace_aligned[wp]: set_irq_state \"pspace_aligned\"\n\ncrunch pspace_distinct[wp]: set_irq_state \"pspace_distinct\"\n\nlemma valid_mdb_interrupts[simp]:\n \"valid_mdb (interrupt_states_update f s) = valid_mdb s\"\n by (simp add: valid_mdb_def mdb_cte_at_def)\n\ncrunch valid_mdb[wp]: set_irq_state \"valid_mdb\"\n\ncrunch mdb_cte_wp_at[wp]: set_irq_state \"\\s. cte_wp_at (P (cdt s)) p s\"\ncrunch real_cte_at[wp]: set_irq_state \"real_cte_at p\"\n\nlemmas set_irq_state_cte_cap_to[wp]\n = ex_cte_cap_to_pres [OF set_irq_state_mdb_cte_wp_at set_irq_state_irq_node]\n\nlemma set_irq_state_issued[wp]:\n \"\\\\\\ set_irq_state irq_state.IRQSignal irq \\\\rv. irq_issued irq\\\"\n apply (simp add: set_irq_state_def irq_issued_def)\n apply wp\n apply clarsimp\n done\n\nlemma IRQHandler_valid:\n \"(s \\ cap.IRQHandlerCap irq) = (irq \\ maxIRQ)\"\n by (simp add: valid_cap_def cap_aligned_def word_bits_conv)\n\nlemmas (in Interrupt_AI)\n invoke_irq_handler_invs[wp] = invoke_irq_handler_invs'[where ex_inv=\\\n , simplified hoare_post_taut\n , OF TrueI TrueI TrueI\n , simplified\n ]\n\ncrunch interrupt_states[wp]: update_waiting_ntfn, cancel_signal, blocked_cancel_ipc \"\\s. P (interrupt_states s)\" (wp: mapM_x_wp_inv)\n\nlemma cancel_ipc_noreply_interrupt_states:\n \"\\\\s. st_tcb_at (\\st. st \\ BlockedOnReply) t s \\ P (interrupt_states s) \\ cancel_ipc t \\ \\_ s. P (interrupt_states s) \\\"\n apply (simp add: cancel_ipc_def)\n apply wpsimp\n apply (rule hoare_pre_cont)\n apply (wp)\n apply (wp gts_wp)+\n apply (auto simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma send_signal_interrupt_states[wp_unsafe]:\n \"\\\\s. P (interrupt_states s) \\ valid_objs s\\ send_signal a b \\\\_ s. P (interrupt_states s)\\\"\n apply (simp add: send_signal_def)\n apply (rule hoare_seq_ext [OF _ get_simple_ko_sp])\n apply (rule hoare_pre)\n apply (wp cancel_ipc_noreply_interrupt_states gts_wp hoare_vcg_all_lift thread_get_wp | wpc | simp)+\n apply (clarsimp)\n apply (erule (1) obj_at_valid_objsE)\n apply (clarsimp simp: valid_obj_def valid_ntfn_def obj_at_def is_tcb_def)\n apply (case_tac ko, simp_all)\n apply (auto simp: pred_tcb_at_def obj_at_def receive_blocked_def)\n done\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/Interrupt_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.28776782186926264, "lm_q1q2_score": 0.17379214424603015}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__53_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__53_on_rules imports n_g2kAbsAfter_lemma_on_inv__53\nbegin\nsection{*All lemmas on causal relation between inv__53*}\nlemma lemma_inv__53_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__53) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__53_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.31742627850202554, "lm_q1q2_score": 0.1735490522108607}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__23_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__23_on_rules imports n_g2kAbsAfter_lemma_on_inv__23\nbegin\nsection{*All lemmas on causal relation between inv__23*}\nlemma lemma_inv__23_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__23 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__23) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__23_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.3174262785020255, "lm_q1q2_score": 0.17354905221086067}} {"text": "(* Title: HOL/MicroJava/BV/Effect.thy\n Author: Gerwin Klein\n Copyright 2000 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Effect of Instructions on the State Type} *}\n\ntheory Effect\nimports JVM_SemiType \"../JVM/JVMExceptions\"\nbegin\n\n-- FIXME\nlocale prog =\n fixes P :: \"'a prog\"\n\nlocale jvm_method = prog +\n fixes mxs :: nat \n fixes mxl\\<^sub>0 :: nat \n fixes Ts :: \"ty list\" \n fixes T\\<^sub>r :: ty\n fixes \"is\" :: \"instr list\" \n fixes xt :: ex_table\n\n fixes mxl :: nat\n defines mxl_def: \"mxl \\ 1+size Ts+mxl\\<^sub>0\"\n\ntext {* Program counter of successor instructions: *}\nprimrec succs :: \"instr \\ ty\\<^sub>i \\ pc \\ pc list\" where\n \"succs (Load idx) \\ pc = [pc+1]\"\n| \"succs (Store idx) \\ pc = [pc+1]\"\n| \"succs (Push v) \\ pc = [pc+1]\"\n| \"succs (Getfield F C) \\ pc = [pc+1]\"\n| \"succs (Putfield F C) \\ pc = [pc+1]\"\n| \"succs (New C) \\ pc = [pc+1]\"\n| \"succs (Checkcast C) \\ pc = [pc+1]\"\n| \"succs Pop \\ pc = [pc+1]\"\n| \"succs IAdd \\ pc = [pc+1]\"\n| \"succs CmpEq \\ pc = [pc+1]\"\n| succs_IfFalse:\n \"succs (IfFalse b) \\ pc = [pc+1, nat (int pc + b)]\"\n| succs_Goto:\n \"succs (Goto b) \\ pc = [nat (int pc + b)]\"\n| succs_Return:\n \"succs Return \\ pc = []\" \n| succs_Invoke:\n \"succs (Invoke M n) \\ pc = (if (fst \\)!n = NT then [] else [pc+1])\"\n| succs_Throw:\n \"succs Throw \\ pc = []\"\n\ntext \"Effect of instruction on the state type:\"\n\nfun the_class:: \"ty \\ cname\" where\n \"the_class (Class C) = C\"\n\nfun eff\\<^sub>i :: \"instr \\ 'm prog \\ ty\\<^sub>i \\ ty\\<^sub>i\" where\n eff\\<^sub>i_Load:\n \"eff\\<^sub>i (Load n, P, (ST, LT)) = (ok_val (LT ! n) # ST, LT)\"\n| eff\\<^sub>i_Store:\n \"eff\\<^sub>i (Store n, P, (T#ST, LT)) = (ST, LT[n:= OK T])\"\n| eff\\<^sub>i_Push:\n \"eff\\<^sub>i (Push v, P, (ST, LT)) = (the (typeof v) # ST, LT)\"\n| eff\\<^sub>i_Getfield:\n \"eff\\<^sub>i (Getfield F C, P, (T#ST, LT)) = (snd (field P C F) # ST, LT)\"\n| eff\\<^sub>i_Putfield:\n \"eff\\<^sub>i (Putfield F C, P, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = (ST,LT)\"\n| eff\\<^sub>i_New:\n \"eff\\<^sub>i (New C, P, (ST,LT)) = (Class C # ST, LT)\"\n| eff\\<^sub>i_Checkcast:\n \"eff\\<^sub>i (Checkcast C, P, (T#ST,LT)) = (Class C # ST,LT)\"\n| eff\\<^sub>i_Pop:\n \"eff\\<^sub>i (Pop, P, (T#ST,LT)) = (ST,LT)\"\n| eff\\<^sub>i_IAdd:\n \"eff\\<^sub>i (IAdd, P,(T\\<^sub>1#T\\<^sub>2#ST,LT)) = (Integer#ST,LT)\"\n| eff\\<^sub>i_CmpEq:\n \"eff\\<^sub>i (CmpEq, P, (T\\<^sub>1#T\\<^sub>2#ST,LT)) = (Boolean#ST,LT)\"\n| eff\\<^sub>i_IfFalse:\n \"eff\\<^sub>i (IfFalse b, P, (T\\<^sub>1#ST,LT)) = (ST,LT)\"\n| eff\\<^sub>i_Invoke:\n \"eff\\<^sub>i (Invoke M n, P, (ST,LT)) =\n (let C = the_class (ST!n); (D,Ts,T\\<^sub>r,b) = method P C M\n in (T\\<^sub>r # drop (n+1) ST, LT))\"\n| eff\\<^sub>i_Goto:\n \"eff\\<^sub>i (Goto n, P, s) = s\"\n\nfun is_relevant_class :: \"instr \\ 'm prog \\ cname \\ bool\" where\n rel_Getfield:\n \"is_relevant_class (Getfield F D) = (\\P C. P \\ NullPointer \\\\<^sup>* C)\" \n| rel_Putfield:\n \"is_relevant_class (Putfield F D) = (\\P C. P \\ NullPointer \\\\<^sup>* C)\" \n| rel_Checcast:\n \"is_relevant_class (Checkcast D) = (\\P C. P \\ ClassCast \\\\<^sup>* C)\" \n| rel_New:\n \"is_relevant_class (New D) = (\\P C. P \\ OutOfMemory \\\\<^sup>* C)\" \n| rel_Throw:\n \"is_relevant_class Throw = (\\P C. True)\"\n| rel_Invoke:\n \"is_relevant_class (Invoke M n) = (\\P C. True)\"\n| rel_default:\n \"is_relevant_class i = (\\P C. False)\"\n\ndefinition is_relevant_entry :: \"'m prog \\ instr \\ pc \\ ex_entry \\ bool\" where\n \"is_relevant_entry P i pc e \\ (let (f,t,C,h,d) = e in is_relevant_class i P C \\ pc \\ {f.. instr \\ pc \\ ex_table \\ ex_table\" where\n \"relevant_entries P i pc = filter (is_relevant_entry P i pc)\"\n\ndefinition xcpt_eff :: \"instr \\ 'm prog \\ pc \\ ty\\<^sub>i \n \\ ex_table \\ (pc \\ ty\\<^sub>i') list\" where \n \"xcpt_eff i P pc \\ et = (let (ST,LT) = \\ in \n map (\\(f,t,C,h,d). (h, Some (Class C#drop (size ST - d) ST, LT))) (relevant_entries P i pc et))\"\n\ndefinition norm_eff :: \"instr \\ 'm prog \\ nat \\ ty\\<^sub>i \\ (pc \\ ty\\<^sub>i') list\" where\n \"norm_eff i P pc \\ = map (\\pc'. (pc',Some (eff\\<^sub>i (i,P,\\)))) (succs i \\ pc)\"\n\ndefinition eff :: \"instr \\ 'm prog \\ pc \\ ex_table \\ ty\\<^sub>i' \\ (pc \\ ty\\<^sub>i') list\" where\n \"eff i P pc et t = (case t of \n None \\ [] \n | Some \\ \\ (norm_eff i P pc \\) @ (xcpt_eff i P pc \\ et))\"\n\n\n\n\nlemma eff_Some:\n \"eff i P pc xt (Some \\) = norm_eff i P pc \\ @ xcpt_eff i P pc \\ xt\"\nby (simp add: eff_def)\n\n(* FIXME: getfield, \\T D. P \\ C sees F:T in D \\ .. *)\n\ntext \"Conditions under which eff is applicable:\"\n\nfun app\\<^sub>i :: \"instr \\ 'm prog \\ pc \\ nat \\ ty \\ ty\\<^sub>i \\ bool\" where\n app\\<^sub>i_Load:\n \"app\\<^sub>i (Load n, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (n < length LT \\ LT ! n \\ Err \\ length ST < mxs)\"\n| app\\<^sub>i_Store:\n \"app\\<^sub>i (Store n, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (n < length LT)\"\n| app\\<^sub>i_Push:\n \"app\\<^sub>i (Push v, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (length ST < mxs \\ typeof v \\ None)\"\n| app\\<^sub>i_Getfield:\n \"app\\<^sub>i (Getfield F C, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (\\T\\<^sub>f. P \\ C sees F:T\\<^sub>f in C \\ P \\ T \\ Class C)\"\n| app\\<^sub>i_Putfield:\n \"app\\<^sub>i (Putfield F C, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = \n (\\T\\<^sub>f. P \\ C sees F:T\\<^sub>f in C \\ P \\ T\\<^sub>2 \\ (Class C) \\ P \\ T\\<^sub>1 \\ T\\<^sub>f)\" \n| app\\<^sub>i_New:\n \"app\\<^sub>i (New C, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (is_class P C \\ length ST < mxs)\"\n| app\\<^sub>i_Checkcast:\n \"app\\<^sub>i (Checkcast C, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (is_class P C \\ is_refT T)\"\n| app\\<^sub>i_Pop:\n \"app\\<^sub>i (Pop, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n True\"\n| app\\<^sub>i_IAdd:\n \"app\\<^sub>i (IAdd, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST,LT)) = (T\\<^sub>1 = T\\<^sub>2 \\ T\\<^sub>1 = Integer)\"\n| app\\<^sub>i_CmpEq:\n \"app\\<^sub>i (CmpEq, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST,LT)) =\n (T\\<^sub>1 = T\\<^sub>2 \\ is_refT T\\<^sub>1 \\ is_refT T\\<^sub>2)\"\n| app\\<^sub>i_IfFalse:\n \"app\\<^sub>i (IfFalse b, P, pc, mxs, T\\<^sub>r, (Boolean#ST,LT)) = \n (0 \\ int pc + b)\"\n| app\\<^sub>i_Goto:\n \"app\\<^sub>i (Goto b, P, pc, mxs, T\\<^sub>r, s) = \n (0 \\ int pc + b)\"\n| app\\<^sub>i_Return:\n \"app\\<^sub>i (Return, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (P \\ T \\ T\\<^sub>r)\"\n| app\\<^sub>i_Throw:\n \"app\\<^sub>i (Throw, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n is_refT T\"\n| app\\<^sub>i_Invoke:\n \"app\\<^sub>i (Invoke M n, P, pc, mxs, T\\<^sub>r, (ST,LT)) =\n (n < length ST \\ \n (ST!n \\ NT \\\n (\\C D Ts T m. ST!n = Class C \\ P \\ C sees M:Ts \\ T = m in D \\\n P \\ rev (take n ST) [\\] Ts)))\"\n \n| app\\<^sub>i_default:\n \"app\\<^sub>i (i,P, pc,mxs,T\\<^sub>r,s) = False\"\n\n\ndefinition xcpt_app :: \"instr \\ 'm prog \\ pc \\ nat \\ ex_table \\ ty\\<^sub>i \\ bool\" where\n \"xcpt_app i P pc mxs xt \\ \\ (\\(f,t,C,h,d) \\ set (relevant_entries P i pc xt). is_class P C \\ d \\ size (fst \\) \\ d < mxs)\"\n\ndefinition app :: \"instr \\ 'm prog \\ nat \\ ty \\ nat \\ nat \\ ex_table \\ ty\\<^sub>i' \\ bool\" where\n \"app i P mxs T\\<^sub>r pc mpc xt t = (case t of None \\ True | Some \\ \\ \n app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',\\') \\ set (eff i P pc xt t). pc' < mpc))\"\n\n\nlemma app_Some:\n \"app i P mxs T\\<^sub>r pc mpc xt (Some \\) = \n (app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',s') \\ set (eff i P pc xt (Some \\)). pc' < mpc))\"\nby (simp add: app_def)\n\nlocale eff = jvm_method +\n fixes eff\\<^sub>i and app\\<^sub>i and eff and app \n fixes norm_eff and xcpt_app and xcpt_eff\n\n fixes mpc\n defines \"mpc \\ size is\"\n\n defines \"eff\\<^sub>i i \\ \\ Effect.eff\\<^sub>i (i,P,\\)\"\n notes eff\\<^sub>i_simps [simp] = Effect.eff\\<^sub>i.simps [where P = P, folded eff\\<^sub>i_def]\n\n defines \"app\\<^sub>i i pc \\ \\ Effect.app\\<^sub>i (i, P, pc, mxs, T\\<^sub>r, \\)\"\n notes app\\<^sub>i_simps [simp] = Effect.app\\<^sub>i.simps [where P=P and mxs=mxs and T\\<^sub>r=T\\<^sub>r, folded app\\<^sub>i_def]\n\n defines \"xcpt_eff i pc \\ \\ Effect.xcpt_eff i P pc \\ xt\"\n notes xcpt_eff = Effect.xcpt_eff_def [of _ P _ _ xt, folded xcpt_eff_def]\n\n defines \"norm_eff i pc \\ \\ Effect.norm_eff i P pc \\\"\n notes norm_eff = Effect.norm_eff_def [of _ P, folded norm_eff_def eff\\<^sub>i_def]\n\n defines \"eff i pc \\ Effect.eff i P pc xt\"\n notes eff = Effect.eff_def [of _ P _ xt, folded eff_def norm_eff_def xcpt_eff_def]\n\n defines \"xcpt_app i pc \\ \\ Effect.xcpt_app i P pc mxs xt \\\"\n notes xcpt_app = Effect.xcpt_app_def [of _ P _ mxs xt, folded xcpt_app_def]\n\n defines \"app i pc \\ Effect.app i P mxs T\\<^sub>r pc mpc xt\"\n notes app = Effect.app_def [of _ P mxs T\\<^sub>r _ mpc xt, folded app_def xcpt_app_def app\\<^sub>i_def eff_def]\n\n\nlemma length_cases2:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n by (cases s, cases \"fst s\") (auto intro!: assms)\n\n\nlemma length_cases3:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil with assms s show ?thesis by simp\n next\n fix l xs' assume \"xs = l#xs'\"\n with assms s show ?thesis by simp\n qed\nqed\n(*>*)\n\nlemma length_cases4:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l l' LT. P ([l,l'],LT)\"\n assumes \"\\l l' ST LT. P (l#l'#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil with assms s show ?thesis by simp\n next\n fix l xs' assume xs: \"xs = l#xs'\"\n thus ?thesis\n proof (cases xs')\n case Nil with assms s xs show ?thesis by simp\n next\n fix l' ST assume \"xs' = l'#ST\"\n with assms s xs show ?thesis by simp\n qed\n qed\nqed\n(*>*)\n\ntext {* \n\\medskip\nsimp rules for @{term app}\n*}\nlemma appNone[simp]: \"app i P mxs T\\<^sub>r pc mpc et None = True\" \n by (simp add: app_def)\n\n\nlemma appLoad[simp]:\n\"app\\<^sub>i (Load idx, P, T\\<^sub>r, mxs, pc, s) = (\\ST LT. s = (ST,LT) \\ idx < length LT \\ LT!idx \\ Err \\ length ST < mxs)\"\n by (cases s, simp)\n\nlemma appStore[simp]:\n\"app\\<^sub>i (Store idx,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT) \\ idx < length LT)\"\n by (rule length_cases2, auto)\n\nlemma appPush[simp]:\n\"app\\<^sub>i (Push v,P,pc,mxs,T\\<^sub>r,s) =\n (\\ST LT. s = (ST,LT) \\ length ST < mxs \\ typeof v \\ None)\"\n by (cases s, simp)\n\nlemma appGetField[simp]:\n\"app\\<^sub>i (Getfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ oT vT ST LT. s = (oT#ST, LT) \\ \n P \\ C sees F:vT in C \\ P \\ oT \\ (Class C))\"\n by (rule length_cases2 [of _ s]) auto\n\nlemma appPutField[simp]:\n\"app\\<^sub>i (Putfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ vT vT' oT ST LT. s = (vT#oT#ST, LT) \\\n P \\ C sees F:vT' in C \\ P \\ oT \\ (Class C) \\ P \\ vT \\ vT')\"\n by (rule length_cases4 [of _ s], auto)\n\nlemma appNew[simp]:\n \"app\\<^sub>i (New C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s=(ST,LT) \\ is_class P C \\ length ST < mxs)\"\n by (cases s, simp)\n\n\n\nlemma app\\<^sub>iPop[simp]: \n\"app\\<^sub>i (Pop,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT))\"\n by (rule length_cases2, auto)\n\nlemma appIAdd[simp]:\n\"app\\<^sub>i (IAdd,P,pc,mxs,T\\<^sub>r,s) = (\\ST LT. s = (Integer#Integer#ST,LT))\"\n(*<*)\nproof -\n obtain ST LT where [simp]: \"s = (ST,LT)\" by (cases s)\n have \"ST = [] \\ (\\T. ST = [T]) \\ (\\T\\<^sub>1 T\\<^sub>2 ST'. ST = T\\<^sub>1#T\\<^sub>2#ST')\"\n by (cases ST, auto, case_tac list, auto)\n moreover\n { assume \"ST = []\" hence ?thesis by simp }\n moreover\n { fix T assume \"ST = [T]\" hence ?thesis by (cases T, auto) }\n moreover\n { fix T\\<^sub>1 T\\<^sub>2 ST' assume \"ST = T\\<^sub>1#T\\<^sub>2#ST'\"\n hence ?thesis by (cases T\\<^sub>1, auto)\n }\n ultimately show ?thesis by blast\nqed\n(*>*)\n\n\nlemma appIfFalse [simp]:\n\"app\\<^sub>i (IfFalse b,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s = (Boolean#ST,LT) \\ 0 \\ int pc + b)\"\n(*<*)\n apply (rule length_cases2)\n apply simp\n apply (case_tac l) \n apply auto\n done\n(*>*)\n\nlemma appCmpEq[simp]:\n\"app\\<^sub>i (CmpEq,P,pc,mxs,T\\<^sub>r,s) = \n (\\T\\<^sub>1 T\\<^sub>2 ST LT. s = (T\\<^sub>1#T\\<^sub>2#ST,LT) \\ (\\is_refT T\\<^sub>1 \\ T\\<^sub>2 = T\\<^sub>1 \\ is_refT T\\<^sub>1 \\ is_refT T\\<^sub>2))\"\n by (rule length_cases4, auto)\n\nlemma appReturn[simp]:\n\"app\\<^sub>i (Return,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s = (T#ST,LT) \\ P \\ T \\ T\\<^sub>r)\" \n by (rule length_cases2, auto)\n\nlemma appThrow[simp]:\n \"app\\<^sub>i (Throw,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s=(T#ST,LT) \\ is_refT T)\"\n by (rule length_cases2, auto) \n\nlemma effNone: \n \"(pc', s') \\ set (eff i P pc et None) \\ s' = None\"\n by (auto simp add: eff_def xcpt_eff_def norm_eff_def)\n\n\ntext {* some helpers to make the specification directly executable: *}\nlemma relevant_entries_append [simp]:\n \"relevant_entries P i pc (xt @ xt') = relevant_entries P i pc xt @ relevant_entries P i pc xt'\"\n by (unfold relevant_entries_def) simp\n\nlemma xcpt_app_append [iff]:\n \"xcpt_app i P pc mxs (xt@xt') \\ = (xcpt_app i P pc mxs xt \\ \\ xcpt_app i P pc mxs xt' \\)\"\n by (unfold xcpt_app_def) fastforce\n\nlemma xcpt_eff_append [simp]:\n \"xcpt_eff i P pc \\ (xt@xt') = xcpt_eff i P pc \\ xt @ xcpt_eff i P pc \\ xt'\"\n by (unfold xcpt_eff_def, cases \\) simp\n\nlemma app_append [simp]:\n \"app i P pc T mxs mpc (xt@xt') \\ = (app i P pc T mxs mpc xt \\ \\ app i P pc T mxs mpc xt' \\)\"\n by (unfold app_def eff_def) auto\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/Effect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.31742625913050115, "lm_q1q2_score": 0.17354904630839935}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__50_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__50_on_rules imports n_germanSymIndex_lemma_on_inv__50\nbegin\nsection{*All lemmas on causal relation between inv__50*}\nlemma lemma_inv__50_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__50 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__50) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__50_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.31742625913050115, "lm_q1q2_score": 0.17354904630839935}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_on_inv__8.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_on_inv__8 imports n_germanSymIndex_base\nbegin\nsection{*All lemmas on causal relation between inv__8 and some rule r*}\nlemma n_SendInvAckVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__8 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__8 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) (eqn (IVar (Field (Para (Ident ''Chan3'') i) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__8 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__8 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__8:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__8 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntE))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__8:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__8:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_on_inv__8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.17349784900569534}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__25_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__25_on_rules imports n_g2kAbsAfter_lemma_on_inv__25\nbegin\nsection{*All lemmas on causal relation between inv__25*}\nlemma lemma_inv__25_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__25 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__25) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__25_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.3106943959796865, "lm_q1q2_score": 0.173469068264183}} {"text": "(*<*)\n\n(* Author: Kyndylan Nienhuis *)\n\ntheory CheriLemmas\n\nimports \n \"CHERI-alt.CheriAltDefs\"\n \"CheriProofMethods\"\nbegin\n\n(*>*)\nsection \\Simplifications\\\n\nsubsection \\Sizes\\\n\ndeclare CAPBYTEWIDTH_def [simp]\ndeclare UPERMS_def [simp]\ndeclare OTYPEWIDTH_def [simp]\n \ntype_synonym VirtualAddress = \"64 word\"\ntype_synonym PhysicalAddress = \"40 word\"\ntype_synonym PhysicalCapAddress = \"35 word\"\ntype_synonym RegisterAddress = \"5 word\"\ntype_synonym ObjectType = \"24 word\"\n\ndefinition GetCapAddress :: \"PhysicalAddress \\ PhysicalCapAddress\" where\n \"GetCapAddress a = slice 5 a\"\n\ndefinition ExtendCapAddress :: \"PhysicalCapAddress \\ PhysicalAddress\" where\n \"ExtendCapAddress a = word_cat a (0::5 word)\"\n\nlemma GetCapAddress_ExtendCapAddress_simp [simp]:\n shows \"GetCapAddress (ExtendCapAddress a) = a\"\nunfolding GetCapAddress_def ExtendCapAddress_def\nby auto\n\nlemma ExtendCapAddress_GetCapAddress_simp [simp]:\n shows \"ExtendCapAddress (GetCapAddress a) = a AND NOT mask 5\"\nunfolding GetCapAddress_def ExtendCapAddress_def\nby auto\n\nsubsection \\Permissions\\\n\nlemma Perms_truncate_simp [simp]:\n fixes p :: Perms\n shows \"Perms.truncate p = p\"\nunfolding Perms.truncate_def\nby simp\n\nlemma Perms_truncate_members [simp]:\n shows \"Access_System_Registers (Perms.truncate p) = Access_System_Registers p\"\n and \"Global (Perms.truncate p) = Global p\"\n and \"Permit_CCall (Perms.truncate p) = Permit_CCall p\"\n and \"Permit_Execute (Perms.truncate p) = Permit_Execute p\"\n and \"Permit_Load (Perms.truncate p) = Permit_Load p\"\n and \"Permit_Load_Capability (Perms.truncate p) = Permit_Load_Capability p\"\n and \"Permit_Seal (Perms.truncate p) = Permit_Seal p\"\n and \"Permit_Unseal (Perms.truncate p) = Permit_Unseal p\"\n and \"Permit_Store (Perms.truncate p) = Permit_Store p\"\n and \"Permit_Store_Capability (Perms.truncate p) = Permit_Store_Capability p\"\n and \"Permit_Store_Local_Capability (Perms.truncate p) = Permit_Store_Local_Capability p\"\n and \"Permit_Set_CID (Perms.truncate p) = Permit_Set_CID p\"\n and \"Reserved (Perms.truncate p) = Reserved p\"\nunfolding Perms.truncate_def\nby simp_all\n\nlemma nth_reg'Perms:\n shows \"reg'Perms p !! n = \n (if n = 0 then Global p \n else if n = 1 then Permit_Execute p\n else if n = 2 then Permit_Load p\n else if n = 3 then Permit_Store p\n else if n = 4 then Permit_Load_Capability p\n else if n = 5 then Permit_Store_Capability p\n else if n = 6 then Permit_Store_Local_Capability p\n else if n = 7 then Permit_Seal p\n else if n = 8 then Permit_CCall p\n else if n = 9 then Permit_Unseal p\n else if n = 10 then Access_System_Registers p\n else if n = 11 then Permit_Set_CID p\n else if n \\ 12 \\ n \\ 31 then Reserved p !! (n - 12)\n else False)\"\nproof - \n have \"n = 0 \\ n = 1 \\ n = 2 \\ n = 3 \\ n = 4 \\\n n = 5 \\ n = 6 \\ n = 7 \\ n = 8 \\ n = 9 \\\n n = 10 \\ n = 11 \\ (n \\ 12 \\ n \\ 31) \\ n > 31\"\n by arith\n thus ?thesis\n unfolding reg'Perms_def Let_def\n apply (simp split del: if_splits(1)\n add: test_bit_cat \n nth_word_extract\n nth_ucast\n word_size\n cong del: weak_cong \n cong: cong)\n apply (elim disjE) \n by auto\nqed\n\nlemma nth_reg'Perms_concrete [simp]:\n shows \"reg'Perms p !! 0 = Global p\"\n and \"reg'Perms p !! Suc 0 = Permit_Execute p\"\n and \"reg'Perms p !! 2 = Permit_Load p\"\n and \"reg'Perms p !! 3 = Permit_Store p\"\n and \"reg'Perms p !! 4 = Permit_Load_Capability p\"\n and \"reg'Perms p !! 5 = Permit_Store_Capability p\"\n and \"reg'Perms p !! 6 = Permit_Store_Local_Capability p\"\n and \"reg'Perms p !! 7 = Permit_Seal p\"\n and \"reg'Perms p !! 8 = Permit_CCall p\"\n and \"reg'Perms p !! 9 = Permit_Unseal p\"\n and \"reg'Perms p !! 10 = Access_System_Registers p\"\n and \"reg'Perms p !! 11 = Permit_Set_CID p\"\nunfolding nth_reg'Perms\nby simp_all\n\nlemma reg'Perms_rec'Perms_inv [simp]:\n shows \"reg'Perms (rec'Perms w) = w\"\nunfolding rec'Perms_def Perms.make_def\napply (intro word_eqI)\napply (simp add: nth_reg'Perms)\napply (simp add: word_size)\napply (simp add: nth_word_extract)\napply auto\nby arith\n\n(* thm word_cat_bl\nthm word_rep_drop\nthm slice_take *)\n\nlemma word_cat_slice_11_slice_8_reg'Perms:\n shows \"(slice 12 (reg'Perms x)::20 word) = Reserved x\"\n (is \"?l = ?r\")\nby (intro word_eqI)\n (auto simp: word_size nth_word_cat nth_slice nth_reg'Perms)\n\nlemma rec'Perms_reg'Perms_inv [simp]:\n shows \"rec'Perms (reg'Perms x) = x\"\nunfolding rec'Perms_def Perms.make_def\nby (simp add: nth_reg'Perms \n ucast_shiftr\n word_cat_slice_11_slice_8_reg'Perms\n word_extract_def\n word_bits_def)\n\nsubsection \\User permissions\\\n\nlemma UPerms_truncate_simp [simp]:\n fixes p :: UPerms\n shows \"UPerms.truncate p = p\"\nunfolding UPerms.truncate_def\nby simp\n\nlemma UPerms_truncate_members [simp]:\n shows \"soft (UPerms.truncate p) = soft p\"\n and \"UPerms.Reserved (UPerms.truncate p) = UPerms.Reserved p\"\nunfolding UPerms.truncate_def\nby simp_all\n\nlemma reg'UPerms_rec'UPerms_inv [simp]:\n shows \"reg'UPerms (rec'UPerms w) = w\"\nunfolding rec'UPerms_def reg'UPerms_def UPerms.make_def \nby (intro word_eqI)\n (auto simp add: word_size nth_word_cat nth_word_extract nth_ucast)\n\nlemma rec'UPerms_reg'UPerms_inv [simp]:\n shows \"rec'UPerms (reg'UPerms x) = x\"\nproof (intro UPerms.equality)\n show \"soft (rec'UPerms (reg'UPerms x)) = soft x\"\n unfolding rec'UPerms_def reg'UPerms_def UPerms.make_def\n unfolding word_extract_def word_bits_def \n by (simp add: ucast_shiftr)\nnext\n show \"UPerms.Reserved (rec'UPerms (reg'UPerms x)) = UPerms.Reserved x\"\n unfolding rec'UPerms_def reg'UPerms_def UPerms.make_def\n unfolding word_extract_def word_bits_def \n by (intro word_eqI)\n (simp add: ucast_shiftr word_size nth_slice nth_word_cat)\nqed simp\n\nsubsection \\Capabilities\\\n\nlemma getBaseAndLength_alt [simp]:\n shows \"getBaseAndLength cap = (getBase cap, getLength cap)\"\nunfolding getBaseAndLength_def getBase_def getLength_def ..\n\nlemma Capability_truncate_simp [simp]:\n fixes cap :: Capability\n shows \"Capability.truncate cap = cap\"\nunfolding Capability.truncate_def\nby simp\n\nlemma Capability_truncate_members [simp]:\n shows \"base (Capability.truncate cap) = base cap\"\n and \"length (Capability.truncate cap) = length cap\"\n and \"cursor (Capability.truncate cap) = cursor cap\"\n and \"otype (Capability.truncate cap) = otype cap\"\n and \"perms (Capability.truncate cap) = perms cap\"\n and \"reserved (Capability.truncate cap) = reserved cap\"\n and \"sealed (Capability.truncate cap) = sealed cap\"\n and \"tag (Capability.truncate cap) = tag cap\"\n and \"uperms (Capability.truncate cap) = uperms cap\"\nunfolding Capability.truncate_def\nby simp_all\n\nlemma NullCap_members [simp]:\n shows \"base nullCap = 0\"\n and \"length nullCap = max_word\"\n and \"cursor nullCap = 0\"\n and \"otype nullCap = 0\"\n and \"perms nullCap = 0\"\n and \"reserved nullCap = 0\"\n and \"sealed nullCap = False\"\n and \"tag nullCap = False\"\n and \"uperms nullCap = 0\"\nunfolding nullCap_def\nby simp_all\n \nlemma NullCap_simps [simp]:\n shows \"getTag nullCap = False\"\n and \"getBase nullCap = 0\"\n and \"getLength nullCap = max_word\"\n and \"getSealed nullCap = False\"\nunfolding getTag_def\n getBase_def\n getLength_def\n getSealed_def\nby simp_all\n\nlemma DefaultCap_members [simp]:\n shows \"base defaultCap = 0\"\n and \"length defaultCap = max_word\"\n and \"cursor defaultCap = 0\"\n and \"otype defaultCap = 0\"\n and \"perms defaultCap = max_word\"\n and \"reserved defaultCap = 0\"\n and \"sealed defaultCap = False\"\n and \"tag defaultCap = True\"\n and \"uperms defaultCap = max_word\"\nunfolding defaultCap_def\nby simp_all\n \nlemma DefaultCap_simps [simp]:\n shows \"getTag defaultCap\"\n and \"getBase defaultCap = 0\"\n and \"getLength defaultCap = max_word\"\n and \"getSealed defaultCap = False\"\nunfolding defaultCap_def\n getTag_def\n getBase_def\n getLength_def\n getSealed_def\nby simp_all\n\nlemmas getTag_distrib [alt_def_simp] = \n all_distrib[where h=getTag]\n\nlemma capability_getter_setter [simp]:\n shows \"getTag (setTag (cap, v0)) = v0\"\n and \"getTag (setSealed (cap, v1)) = getTag cap\"\n and \"getTag (setType (cap, v2)) = getTag cap\"\n and \"getTag (setOffset (cap, v3)) = getTag cap\"\n and \"getTag (setPerms (cap, v4)) = getTag cap\"\n and \"getTag (setUPerms (cap, v5)) = getTag cap\"\n and \"getTag (setBounds (cap, v6)) = getTag cap\"\n and \"getSealed (setTag (cap, v0)) = getSealed cap\"\n and \"getSealed (setSealed (cap, v1)) = v1\"\n and \"getSealed (setType (cap, v2)) = getSealed cap\"\n and \"getSealed (setOffset (cap, v3)) = getSealed cap\"\n and \"getSealed (setPerms (cap, v4)) = getSealed cap\"\n and \"getSealed (setUPerms (cap, v5)) = getSealed cap\"\n and \"getSealed (setBounds (cap, v6)) = getSealed cap\"\n and \"getType (setTag (cap, v0)) = getType cap\"\n and \"getType (setSealed (cap, v1)) = getType cap\"\n and \"getType (setType (cap, v2)) = v2\"\n and \"getType (setOffset (cap, v3)) = getType cap\"\n and \"getType (setPerms (cap, v4)) = getType cap\"\n and \"getType (setUPerms (cap, v5)) = getType cap\"\n and \"getType (setBounds (cap, v6)) = getType cap\"\n and \"getOffset (setTag (cap, v0)) = getOffset cap\"\n and \"getOffset (setSealed (cap, v1)) = getOffset cap\"\n and \"getOffset (setType (cap, v2)) = getOffset cap\"\n and \"getOffset (setOffset (cap, v3)) = v3\"\n and \"getOffset (setPerms (cap, v4)) = getOffset cap\"\n and \"getOffset (setUPerms (cap, v5)) = getOffset cap\"\n and \"getOffset (setBounds (cap, v6)) = 0\"\n and \"getPerms (setTag (cap, v0)) = getPerms cap\"\n and \"getPerms (setSealed (cap, v1)) = getPerms cap\"\n and \"getPerms (setType (cap, v2)) = getPerms cap\"\n and \"getPerms (setOffset (cap, v3)) = getPerms cap\"\n and \"getPerms (setUPerms (cap, v5)) = getPerms cap\"\n and \"getPerms (setBounds (cap, v6)) = getPerms cap\"\n and \"getUPerms (setTag (cap, v0)) = getUPerms cap\"\n and \"getUPerms (setSealed (cap, v1)) = getUPerms cap\"\n and \"getUPerms (setType (cap, v2)) = getUPerms cap\"\n and \"getUPerms (setOffset (cap, v3)) = getUPerms cap\"\n and \"getUPerms (setPerms (cap, v4)) = getUPerms cap\"\n and \"getUPerms (setBounds (cap, v6)) = getUPerms cap\"\n and \"getBase (setTag (cap, v0)) = getBase cap\"\n and \"getBase (setSealed (cap, v1)) = getBase cap\"\n and \"getBase (setType (cap, v2)) = getBase cap\"\n and \"getBase (setOffset (cap, v3)) = getBase cap\"\n and \"getBase (setPerms (cap, v4)) = getBase cap\"\n and \"getBase (setUPerms (cap, v5)) = getBase cap\"\n and \"getBase (setBounds (cap, v6)) = getBase cap + getOffset cap\"\n and \"getLength (setTag (cap, v0)) = getLength cap\"\n and \"getLength (setSealed (cap, v1)) = getLength cap\"\n and \"getLength (setType (cap, v2)) = getLength cap\"\n and \"getLength (setOffset (cap, v3)) = getLength cap\"\n and \"getLength (setPerms (cap, v4)) = getLength cap\"\n and \"getLength (setUPerms (cap, v5)) = getLength cap\"\n and \"getLength (setBounds (cap, v6)) = v6\"\n and \"reserved (setTag (cap, v0)) = reserved cap\"\n and \"reserved (setSealed (cap, v1)) = reserved cap\"\n and \"reserved (setType (cap, v2)) = reserved cap\"\n and \"reserved (setOffset (cap, v3)) = reserved cap\"\n and \"reserved (setPerms (cap, v4)) = reserved cap\"\n and \"reserved (setUPerms (cap, v5)) = reserved cap\"\n and \"reserved (setBounds (cap, v6)) = reserved cap\"\nunfolding \n getTag_def \n getSealed_def\n getType_def \n getOffset_def \n getPerms_def\n getUPerms_def\n getBase_def\n getLength_def\n setTag_def \n setSealed_def \n setType_def \n setOffset_def \n setPerms_def\n setUPerms_def\n setBounds_def\nby simp_all\n\nlemma capability_getPerms_setPerms [simp]:\n shows \"getPerms (setPerms (cap, p1)) = rec'Perms (reg'Perms p1 AND mask 15)\"\n and \"getUPerms (setUPerms (cap, p2)) = rec'UPerms (reg'UPerms p2 AND mask 16)\"\nunfolding \n getPerms_def\n getUPerms_def\n setPerms_def\n setUPerms_def\n word_extract_def\n word_bits_def\nby simp_all\n\nlemma capability_getPerms_AND_mask [simp]:\n shows \"reg'Perms (getPerms cap) AND mask 15 = reg'Perms (getPerms cap)\"\nunfolding getPerms_def\nusing test_bit_size[where w=\"perms cap\"]\nby (intro word_eqI)\n (auto simp add: alt_def_simp word_size nth_ucast word_ao_nth)\n\nlemma capability_getUPerms_AND_mask [simp]:\n shows \"reg'UPerms (getUPerms cap) AND mask 16 = reg'UPerms (getUPerms cap)\"\nunfolding getUPerms_def\nusing test_bit_size[where w=\"uperms cap\"]\nby (intro word_eqI)\n (auto simp add: alt_def_simp word_size nth_ucast word_ao_nth)\n\nlemma setTag_idem [simp]:\n shows \"(setTag (cap, v) = cap) = (getTag cap = v)\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getTag]\n show ?r by auto\nqed (simp add: setTag_def getTag_def)\n\nlemma setTag_getTag [simp]:\n shows \"setTag (cap, getTag cap) = cap\"\nby simp\n\nlemma setSealed_idem [simp]:\n shows \"(setSealed (cap, v) = cap) = (getSealed cap = v)\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getSealed]\n show ?r by auto\nqed (simp add: setSealed_def getSealed_def)\n\nlemma setSealed_getSealed [simp]:\n shows \"setSealed (cap, getSealed cap) = cap\"\nby simp\n\nlemma setType_idem [simp]:\n shows \"(setType (cap, v) = cap) = (getType cap = v)\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getType]\n show ?r by auto\nqed (simp add: setType_def getType_def)\n\nlemma setType_getType [simp]:\n shows \"setType (cap, getType cap) = cap\"\nby simp\n\nlemma setOffset_idem [simp]:\n shows \"(setOffset (cap, v) = cap) = (getOffset cap = v)\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getOffset]\n show ?r by auto\nqed (auto simp add: setOffset_def getOffset_def)\n\nlemma setOffset_getOffset [simp]:\n shows \"setOffset (cap, getOffset cap) = cap\"\nby simp\n\nlemma setPerms_idem [simp]:\n shows \"(setPerms (cap, v) = cap) = (getPerms cap = rec'Perms (reg'Perms v AND mask 15))\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getPerms]\n show ?r by auto\nnext\n assume ?r\n from arg_cong[OF this, where f=\"\\x. ucast (reg'Perms x):: 15 word\"]\n show ?l\n unfolding setPerms_def getPerms_def ucast_def[THEN sym]\n by auto\nqed\n\nlemma setPerms_getPerms [simp]:\n shows \"setPerms (cap, getPerms cap) = cap\"\nby simp\n\nlemma setUPerms_idem [simp]:\n shows \"(setUPerms (cap, v) = cap) = (getUPerms cap = rec'UPerms (reg'UPerms v AND mask 16))\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getUPerms]\n show ?r by auto\nnext\n assume ?r\n from arg_cong[OF this, where f=\"\\x. ucast (reg'UPerms x):: 16 word\"]\n show ?l\n unfolding setUPerms_def getUPerms_def ucast_def[THEN sym]\n by auto\nqed\n\nlemma setUPerms_getUPerms [simp]:\n shows \"setUPerms (cap, getUPerms cap) = cap\"\nby simp\n\nlemma setBounds_idem [simp]:\n shows \"(setBounds (cap, v) = cap) = (getOffset cap = 0 \\ getLength cap = v)\"\n (is \"?l = ?r\")\nproof\n assume ?l\n from arg_cong[OF this, where f=getOffset]\n arg_cong[OF this, where f=getLength]\n show ?r by auto\nnext\n assume ?r\n thus ?l\n unfolding setBounds_def getLength_def getOffset_def\n by auto\nqed\n\nsubsection \\Capability-word conversion\\\n\nlemma bitsToCaps_members:\n fixes x :: \"256 word\"\n defines \"y \\ x XOR word_cat (max_word::64 word) (0::192 word)\"\n shows \"tag (bitsToCap x) = False\"\n and \"length (bitsToCap x) = word_extract 255 192 y\"\n and \"base (bitsToCap x) = word_extract 191 128 y\"\n and \"cursor (bitsToCap x) = word_extract 127 64 y\"\n and \"reserved (bitsToCap x) = word_extract 63 56 y\"\n and \"otype (bitsToCap x) = word_extract 55 32 y\"\n and \"uperms (bitsToCap x) = word_extract 31 16 y\"\n and \"perms (bitsToCap x) = word_extract 15 1 y\"\n and \"sealed (bitsToCap x) = x !! 0\"\nunfolding bitsToCap_def\nunfolding rec'Capability_def\nunfolding Capability.make_def\nunfolding reg'Capability_def\nunfolding y_def\nusing test_bit_size[where w=\"_::256 word\"]\nby (auto simp: nth_ucast nth_word_cat \n word_ops_nth_size word_size word_extract_ucast_up)\n\nlemma tag_bitsToCap_simp [simp]:\n shows \"getTag (bitsToCap x) = False\"\nunfolding getTag_def bitsToCaps_members\nby simp\n\nlemma capToBits_bitsToCap [simp]:\n shows \"capToBits (bitsToCap x) = x\"\nproof -\n have \"word_cat (word_extract 15 (Suc 0) x::15 word) b = \n (word_extract 15 0 x::16 word)\" \n if \"x !! 0 = b !! 0\"\n for b :: \"1 word\" and x :: \"256 word\"\n using that\n by (intro word_eqI)\n (auto simp del: word_extract_start_zero\n simp: word_size nth_word_cat nth_word_extract)\n thus ?thesis\n unfolding capToBits_def\n unfolding reg'Capability_def\n by (auto simp add: word_bool_alg.xor_assoc\n word_size word_ops_nth_size nth_word_cat\n bitsToCaps_members\n word_cat_word_extract_ucast)\nqed\n\nsection \\Value and state part lemmas\\\n\nlemma StatePart_read_onlyI:\n assumes \"Commute m (read_state (\\s. s))\"\n shows \"StatePart m = (\\s. s)\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma StatePartSimpFromHoareTriple:\n fixes s :: state\n assumes \"\\x. HoareTriple (read_state f' =\\<^sub>b return x) m (\\_. read_state f =\\<^sub>b return x)\"\n shows \"f (StatePart m s) = f' s\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValueAndStatePart_simp)\n\nmethod SimpLemmaViaHoareTriple uses simp = \n rule StatePartSimpFromHoareTriple,\n (HoareTripleNoExplosion simp: simp)\n\nsubsection \\Generated lemmas\\\n\n(* Code generation - start - state and value parts *)\n\nsubsubsection \\@{const raise'exception}\\\n\ntext \\The term @{term \"ValuePart (raise'exception v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setRaise'exception v \\ StatePart (raise'exception v)\"\n\nsubsubsection \\@{const PIC_update}\\\n\ntext \\The term @{term \"ValuePart (PIC_update v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setPIC_update v \\ StatePart (PIC_update v)\"\n\nsubsubsection \\@{const PIC_initialise}\\\n\ntext \\The term @{term \"ValuePart (PIC_initialise v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setPIC_initialise v \\ StatePart (PIC_initialise v)\"\n\nsubsubsection \\@{const PIC_load}\\\n\nabbreviation \"getPIC_load v \\ ValuePart (PIC_load v)\"\n\nabbreviation \"sideEffectsPIC_load v \\ StatePart (PIC_load v)\"\n\nsubsubsection \\@{const PIC_store}\\\n\ntext \\The term @{term \"ValuePart (PIC_store v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setPIC_store v \\ StatePart (PIC_store v)\"\n\nsubsubsection \\@{const JTAG_UART_update_interrupt_bit}\\\n\ntext \\The term @{term \"ValuePart (JTAG_UART_update_interrupt_bit v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setJTAG_UART_update_interrupt_bit v \\ StatePart (JTAG_UART_update_interrupt_bit v)\"\n\nsubsubsection \\@{const JTAG_UART_load}\\\n\ntext \\The term @{term \"ValuePart JTAG_UART_load\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setJTAG_UART_load \\ StatePart JTAG_UART_load\"\n\nsubsubsection \\@{const JTAG_UART_input}\\\n\ntext \\The term @{term \"ValuePart (JTAG_UART_input v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setJTAG_UART_input v \\ StatePart (JTAG_UART_input v)\"\n\nsubsubsection \\@{const JTAG_UART_store}\\\n\ntext \\The term @{term \"ValuePart (JTAG_UART_store v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setJTAG_UART_store v \\ StatePart (JTAG_UART_store v)\"\n\nsubsubsection \\@{const JTAG_UART_output}\\\n\nabbreviation \"getJTAG_UART_output \\ ValuePart JTAG_UART_output\"\n\nabbreviation \"sideEffectsJTAG_UART_output \\ StatePart JTAG_UART_output\"\n\nsubsubsection \\@{const JTAG_UART_initialise}\\\n\ntext \\The term @{term \"ValuePart (JTAG_UART_initialise v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setJTAG_UART_initialise v \\ StatePart (JTAG_UART_initialise v)\"\n\nsubsubsection \\@{const gpr}\\\n\nabbreviation \"getGpr v \\ ValuePart (gpr v)\"\n\nlemma gpr_read_only [simp]:\n shows \"StatePart (gpr v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_gpr) auto\n\nsubsubsection \\@{const write'gpr}\\\n\ntext \\The term @{term \"ValuePart (write'gpr v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setGpr v \\ StatePart (write'gpr v)\"\n\nlemma getGpr_setGpr_simp [simp]:\n shows \"getGpr index' (setGpr x s) = (if index' = snd x then fst x else getGpr index' s)\"\nunfolding gpr_alt_def write'gpr_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const GPR}\\\n\nabbreviation \"getGPR v \\ ValuePart (GPR v)\"\n\nlemma GPR_read_only [simp]:\n shows \"StatePart (GPR v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_GPR) auto\n\n(* Code generation - override - write'GPR *)\n\nsubsubsection \\@{const write'GPR}\\\n\ntext \\The term @{term \"ValuePart (write'GPR v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setGPR v \\ StatePart (write'GPR v)\"\n\nlemma getGPR_setGPR_simp [simp]:\n shows \"getGPR index' (setGPR x s) = \n (if index' = 0 then 0 \n else if index' = snd x then fst x \n else getGPR index' s)\"\nunfolding GPR_alt_def write'GPR_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\n(* Code generation - end override *)\n\nsubsubsection \\@{const UserMode}\\\n\nabbreviation \"getUserMode \\ ValuePart UserMode\"\n\nlemma UserMode_read_only [simp]:\n shows \"StatePart UserMode = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_UserMode) auto\n\nsubsubsection \\@{const SupervisorMode}\\\n\nabbreviation \"getSupervisorMode \\ ValuePart SupervisorMode\"\n\nlemma SupervisorMode_read_only [simp]:\n shows \"StatePart SupervisorMode = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_SupervisorMode) auto\n\nsubsubsection \\@{const KernelMode}\\\n\nabbreviation \"getKernelMode \\ ValuePart KernelMode\"\n\nlemma KernelMode_read_only [simp]:\n shows \"StatePart KernelMode = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_KernelMode) auto\n\nsubsubsection \\@{const BigEndianMem}\\\n\nabbreviation \"getBigEndianMem \\ ValuePart BigEndianMem\"\n\nlemma BigEndianMem_read_only [simp]:\n shows \"StatePart BigEndianMem = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_BigEndianMem) auto\n\nsubsubsection \\@{const ReverseEndian}\\\n\nabbreviation \"getReverseEndian \\ ValuePart ReverseEndian\"\n\nlemma ReverseEndian_read_only [simp]:\n shows \"StatePart ReverseEndian = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_ReverseEndian) auto\n\nsubsubsection \\@{const BigEndianCPU}\\\n\nabbreviation \"getBigEndianCPU \\ ValuePart BigEndianCPU\"\n\nlemma BigEndianCPU_read_only [simp]:\n shows \"StatePart BigEndianCPU = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_BigEndianCPU) auto\n\nsubsubsection \\@{const CheckBranch}\\\n\ntext \\The term @{term \"ValuePart CheckBranch\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setCheckBranch \\ StatePart CheckBranch\"\n\nsubsubsection \\@{const BranchNotTaken}\\\n\ntext \\The term @{term \"ValuePart BranchNotTaken\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setBranchNotTaken \\ StatePart BranchNotTaken\"\n\nsubsubsection \\@{const BranchLikelyNotTaken}\\\n\ntext \\The term @{term \"ValuePart BranchLikelyNotTaken\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setBranchLikelyNotTaken \\ StatePart BranchLikelyNotTaken\"\n\nsubsubsection \\@{const initCoreStats}\\\n\ntext \\The term @{term \"ValuePart initCoreStats\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setInitCoreStats \\ StatePart initCoreStats\"\n\nsubsubsection \\@{const printCoreStats}\\\n\nabbreviation \"getPrintCoreStats \\ ValuePart printCoreStats\"\n\nlemma printCoreStats_read_only [simp]:\n shows \"StatePart printCoreStats = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_printCoreStats) auto\n\nsubsubsection \\@{const next_unknown}\\\n\nabbreviation \"getNext_unknown v \\ ValuePart (next_unknown v)\"\n\nabbreviation \"sideEffectsNext_unknown v \\ StatePart (next_unknown v)\"\n\nsubsubsection \\@{const PCC}\\\n\nabbreviation \"getPCC \\ ValuePart PCC\"\n\nlemma PCC_read_only [simp]:\n shows \"StatePart PCC = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_PCC) auto\n\nsubsubsection \\@{const write'PCC}\\\n\ntext \\The term @{term \"ValuePart (write'PCC v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setPCC v \\ StatePart (write'PCC v)\"\n\nlemma getPCC_setPCC_simp [simp]:\n shows \"getPCC (setPCC v s) = v\"\nunfolding PCC_alt_def write'PCC_alt_def\nby (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const CAPR}\\\n\nabbreviation \"getCAPR v \\ ValuePart (CAPR v)\"\n\nlemma CAPR_read_only [simp]:\n shows \"StatePart (CAPR v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_CAPR) auto\n\n(* Code generation - override - write'CAPR *)\n\nsubsubsection \\@{const write'CAPR}\\\n\ntext \\The term @{term \"ValuePart (write'CAPR v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setCAPR v \\ StatePart (write'CAPR v)\"\n\nlemma getCAPR_setCAPR_simp [simp]:\n shows \"getCAPR index' (setCAPR x s) = \n (if index' = 0 then nullCap \n else if index' = snd x then fst x \n else getCAPR index' s)\"\nunfolding CAPR_alt_def write'CAPR_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\n(* Code generation - end override *)\n\nsubsubsection \\@{const SCAPR}\\\n\nabbreviation \"getSCAPR v \\ ValuePart (SCAPR v)\"\n\nlemma SCAPR_read_only [simp]:\n shows \"StatePart (SCAPR v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_SCAPR) auto\n\nsubsubsection \\@{const write'SCAPR}\\\n\ntext \\The term @{term \"ValuePart (write'SCAPR v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSCAPR v \\ StatePart (write'SCAPR v)\"\n\nlemma getSCAPR_setSCAPR_simp [simp]:\n shows \"getSCAPR index' (setSCAPR x s) = (if index' = snd x then fst x else getSCAPR index' s)\"\nunfolding SCAPR_alt_def write'SCAPR_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\n(* Code generation - suffix - RCC *)\n\nabbreviation \"getRCC \\ getCAPR 17\"\n\nlemma \"ValuePart RCC s = getRCC s\"\nunfolding RCC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'RCC *)\n\nabbreviation \"setRCC cap \\ setCAPR (cap, 17)\"\n\nlemma \"StatePart (write'RCC v) s = setRCC v s\"\nunfolding write'RCC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - IDC *)\n\nabbreviation \"getIDC \\ getCAPR 26\"\n\nlemma \"ValuePart IDC s = getIDC s\"\nunfolding IDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'IDC *)\n\nabbreviation \"setIDC cap \\ setCAPR (cap, 26)\"\n\nlemma \"StatePart (write'IDC v) s = setIDC v s\"\nunfolding write'IDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - DDC *)\n\nabbreviation \"getDDC \\ getSCAPR 0\"\n\nlemma \"ValuePart DDC s = getDDC s\"\nunfolding DDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'DDC *)\n\nabbreviation \"setDDC cap \\ setSCAPR (cap, 0)\"\n\nlemma \"StatePart (write'DDC v) s = setDDC v s\"\nunfolding write'DDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - TLSC *)\n\nabbreviation \"getTLSC \\ getSCAPR 1\"\n\nlemma \"ValuePart TLSC s = getTLSC s\"\nunfolding TLSC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'TLSC *)\n\nabbreviation \"setTLSC cap \\ setSCAPR (cap, 1)\"\n\nlemma \"StatePart (write'TLSC v) s = setTLSC v s\"\nunfolding write'TLSC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - PTLSC *)\n\nabbreviation \"getPTLSC \\ getSCAPR 8\"\n\nlemma \"ValuePart PTLSC s = getPTLSC s\"\nunfolding PTLSC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'PTLSC *)\n\nabbreviation \"setPTLSC cap \\ setSCAPR (cap, 8)\"\n\nlemma \"StatePart (write'PTLSC v) s = setPTLSC v s\"\nunfolding write'PTLSC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - KR1C *)\n\nabbreviation \"getKR1C \\ getSCAPR 22\"\n\nlemma \"ValuePart KR1C s = getKR1C s\"\nunfolding KR1C_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'KR1C *)\n\nabbreviation \"setKR1C cap \\ setSCAPR (cap, 22)\"\n\nlemma \"StatePart (write'KR1C v) s = setKR1C v s\"\nunfolding write'KR1C_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - KR2C *)\n\nabbreviation \"getKR2C \\ getSCAPR 23\"\n\nlemma \"ValuePart KR2C s = getKR2C s\"\nunfolding KR2C_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'KR2C *)\n\nabbreviation \"setKR2C cap \\ setSCAPR (cap, 23)\"\n\nlemma \"StatePart (write'KR2C v) s = setKR2C v s\"\nunfolding write'KR2C_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - KCC *)\n\nabbreviation \"getKCC \\ getSCAPR 29\"\n\nlemma \"ValuePart KCC s = getKCC s\"\nunfolding KCC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'KCC *)\n\nabbreviation \"setKCC cap \\ setSCAPR (cap, 29)\"\n\nlemma \"StatePart (write'KCC v) s = setKCC v s\"\nunfolding write'KCC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - KDC *)\n\nabbreviation \"getKDC \\ getSCAPR 30\"\n\nlemma \"ValuePart KDC s = getKDC s\"\nunfolding KDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'KDC *)\n\nabbreviation \"setKDC cap \\ setSCAPR (cap, 30)\"\n\nlemma \"StatePart (write'KDC v) s = setKDC v s\"\nunfolding write'KDC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - EPCC *)\n\nabbreviation \"getEPCC \\ getSCAPR 31\"\n\nlemma \"ValuePart EPCC s = getEPCC s\"\nunfolding EPCC_alt_def ..\n\n(* Code generation - end suffix *)\n\n(* Code generation - suffix - write'EPCC *)\n\nabbreviation \"setEPCC cap \\ setSCAPR (cap, 31)\"\n\nlemma \"StatePart (write'EPCC v) s = setEPCC v s\"\nunfolding write'EPCC_alt_def ..\n\n(* Code generation - end suffix *)\n\nsubsubsection \\@{const SignalException}\\\n\ntext \\The term @{term \"ValuePart (SignalException v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalException v \\ StatePart (SignalException v)\"\n\nsubsubsection \\@{const SignalCP2UnusableException}\\\n\ntext \\The term @{term \"ValuePart SignalCP2UnusableException\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalCP2UnusableException \\ StatePart SignalCP2UnusableException\"\n\nsubsubsection \\@{const SignalCapException_internal}\\\n\ntext \\The term @{term \"ValuePart (SignalCapException_internal v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalCapException_internal v \\ StatePart (SignalCapException_internal v)\"\n\nsubsubsection \\@{const SignalCapException}\\\n\ntext \\The term @{term \"ValuePart (SignalCapException v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalCapException v \\ StatePart (SignalCapException v)\"\n\nsubsubsection \\@{const SignalCapException_noReg}\\\n\ntext \\The term @{term \"ValuePart (SignalCapException_noReg v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalCapException_noReg v \\ StatePart (SignalCapException_noReg v)\"\n\nsubsubsection \\@{const TLB_direct}\\\n\nabbreviation \"getTLB_direct v \\ ValuePart (TLB_direct v)\"\n\nlemma TLB_direct_read_only [simp]:\n shows \"StatePart (TLB_direct v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_TLB_direct) auto\n\nsubsubsection \\@{const write'TLB_direct}\\\n\ntext \\The term @{term \"ValuePart (write'TLB_direct v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setTLB_direct v \\ StatePart (write'TLB_direct v)\"\n\nlemma getTLB_direct_setTLB_direct_simp [simp]:\n shows \"getTLB_direct index' (setTLB_direct x s) = (if index' = snd x then fst x else getTLB_direct index' s)\"\nunfolding TLB_direct_alt_def write'TLB_direct_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const TLB_assoc}\\\n\nabbreviation \"getTLB_assoc v \\ ValuePart (TLB_assoc v)\"\n\nlemma TLB_assoc_read_only [simp]:\n shows \"StatePart (TLB_assoc v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_TLB_assoc) auto\n\nsubsubsection \\@{const write'TLB_assoc}\\\n\ntext \\The term @{term \"ValuePart (write'TLB_assoc v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setTLB_assoc v \\ StatePart (write'TLB_assoc v)\"\n\nlemma getTLB_assoc_setTLB_assoc_simp [simp]:\n shows \"getTLB_assoc index' (setTLB_assoc x s) = (if index' = snd x then fst x else getTLB_assoc index' s)\"\nunfolding TLB_assoc_alt_def write'TLB_assoc_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const LookupTLB}\\\n\nabbreviation \"getLookupTLB v \\ ValuePart (LookupTLB v)\"\n\nlemma LookupTLB_read_only [simp]:\n shows \"StatePart (LookupTLB v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_LookupTLB) auto\n\nsubsubsection \\@{const SignalTLBException_internal}\\\n\ntext \\The term @{term \"ValuePart (SignalTLBException_internal v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalTLBException_internal v \\ StatePart (SignalTLBException_internal v)\"\n\nsubsubsection \\@{const SignalTLBException}\\\n\ntext \\The term @{term \"ValuePart (SignalTLBException v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalTLBException v \\ StatePart (SignalTLBException v)\"\n\nsubsubsection \\@{const CheckSegment}\\\n\nabbreviation \"getCheckSegment v \\ ValuePart (CheckSegment v)\"\n\nlemma CheckSegment_read_only [simp]:\n shows \"StatePart (CheckSegment v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_CheckSegment) auto\n\nsubsubsection \\@{const check_cca}\\\n\ntext \\The term @{term \"ValuePart (check_cca v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setCheck_cca v \\ StatePart (check_cca v)\"\n\nsubsubsection \\@{const TLB_next_random}\\\n\ntext \\The term @{term \"ValuePart (TLB_next_random v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setTLB_next_random v \\ StatePart (TLB_next_random v)\"\n\nsubsubsection \\@{const AddressTranslation}\\\n\nabbreviation \"getAddressTranslation v \\ ValuePart (AddressTranslation v)\"\n\nabbreviation \"sideEffectsAddressTranslation v \\ StatePart (AddressTranslation v)\"\n\nsubsubsection \\@{const CP0TLBEntry}\\\n\nabbreviation \"getCP0TLBEntry v \\ ValuePart (CP0TLBEntry v)\"\n\nlemma CP0TLBEntry_read_only [simp]:\n shows \"StatePart (CP0TLBEntry v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_CP0TLBEntry) auto\n\nsubsubsection \\@{const SignalTLBCapException}\\\n\ntext \\The term @{term \"ValuePart (SignalTLBCapException v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setSignalTLBCapException v \\ StatePart (SignalTLBCapException v)\"\n\nsubsubsection \\@{const printMemStats}\\\n\nabbreviation \"getPrintMemStats \\ ValuePart printMemStats\"\n\nlemma printMemStats_read_only [simp]:\n shows \"StatePart printMemStats = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_printMemStats) auto\n\nsubsubsection \\@{const initMemStats}\\\n\ntext \\The term @{term \"ValuePart initMemStats\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setInitMemStats \\ StatePart initMemStats\"\n\nsubsubsection \\@{const stats_data_reads_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_data_reads_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_data_reads_updt v \\ StatePart (stats_data_reads_updt v)\"\n\nsubsubsection \\@{const stats_data_writes_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_data_writes_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_data_writes_updt v \\ StatePart (stats_data_writes_updt v)\"\n\nsubsubsection \\@{const stats_inst_reads_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_inst_reads_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_inst_reads_updt v \\ StatePart (stats_inst_reads_updt v)\"\n\nsubsubsection \\@{const stats_valid_cap_reads_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_valid_cap_reads_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_valid_cap_reads_updt v \\ StatePart (stats_valid_cap_reads_updt v)\"\n\nsubsubsection \\@{const stats_valid_cap_writes_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_valid_cap_writes_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_valid_cap_writes_updt v \\ StatePart (stats_valid_cap_writes_updt v)\"\n\nsubsubsection \\@{const stats_invalid_cap_reads_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_invalid_cap_reads_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_invalid_cap_reads_updt v \\ StatePart (stats_invalid_cap_reads_updt v)\"\n\nsubsubsection \\@{const stats_invalid_cap_writes_updt}\\\n\ntext \\The term @{term \"ValuePart (stats_invalid_cap_writes_updt v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setStats_invalid_cap_writes_updt v \\ StatePart (stats_invalid_cap_writes_updt v)\"\n\nsubsubsection \\@{const MEM}\\\n\nabbreviation \"getMEM v \\ ValuePart (MEM v)\"\n\nlemma MEM_read_only [simp]:\n shows \"StatePart (MEM v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_MEM) auto\n\nsubsubsection \\@{const write'MEM}\\\n\ntext \\The term @{term \"ValuePart (write'MEM v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setMEM v \\ StatePart (write'MEM v)\"\n\nlemma getMEM_setMEM_simp [simp]:\n shows \"getMEM index' (setMEM x s) = (if index' = snd x then fst x else getMEM index' s)\"\nunfolding MEM_alt_def write'MEM_alt_def\nby (cases x) (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const InitMEM}\\\n\ntext \\The term @{term \"ValuePart InitMEM\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setInitMEM \\ StatePart InitMEM\"\n\nsubsubsection \\@{const ReadData}\\\n\nabbreviation \"getReadData v \\ ValuePart (ReadData v)\"\n\nabbreviation \"sideEffectsReadData v \\ StatePart (ReadData v)\"\n\nsubsubsection \\@{const WriteData}\\\n\ntext \\The term @{term \"ValuePart (WriteData v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setWriteData v \\ StatePart (WriteData v)\"\n\nsubsubsection \\@{const ReadInst}\\\n\nabbreviation \"getReadInst v \\ ValuePart (ReadInst v)\"\n\nabbreviation \"sideEffectsReadInst v \\ StatePart (ReadInst v)\"\n\nsubsubsection \\@{const ReadCap}\\\n\nabbreviation \"getReadCap v \\ ValuePart (ReadCap v)\"\n\nabbreviation \"sideEffectsReadCap v \\ StatePart (ReadCap v)\"\n\nsubsubsection \\@{const WriteCap}\\\n\ntext \\The term @{term \"ValuePart (WriteCap v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setWriteCap v \\ StatePart (WriteCap v)\"\n\nsubsubsection \\@{const AdjustEndian}\\\n\nabbreviation \"getAdjustEndian v \\ ValuePart (AdjustEndian v)\"\n\nabbreviation \"sideEffectsAdjustEndian v \\ StatePart (AdjustEndian v)\"\n\nsubsubsection \\@{const initMemAccessStats}\\\n\ntext \\The term @{term \"ValuePart initMemAccessStats\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setInitMemAccessStats \\ StatePart initMemAccessStats\"\n\nsubsubsection \\@{const printMemAccessStats}\\\n\nabbreviation \"getPrintMemAccessStats \\ ValuePart printMemAccessStats\"\n\nlemma printMemAccessStats_read_only [simp]:\n shows \"StatePart printMemAccessStats = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_printMemAccessStats) auto\n\nsubsubsection \\@{const getVirtualAddress}\\\n\nabbreviation \"getGetVirtualAddress v \\ ValuePart (getVirtualAddress v)\"\n\nlemma getVirtualAddress_read_only [simp]:\n shows \"StatePart (getVirtualAddress v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_getVirtualAddress) auto\n\nsubsubsection \\@{const LoadMemoryCap}\\\n\nabbreviation \"getLoadMemoryCap v \\ ValuePart (LoadMemoryCap v)\"\n\nabbreviation \"sideEffectsLoadMemoryCap v \\ StatePart (LoadMemoryCap v)\"\n\nsubsubsection \\@{const LoadMemory}\\\n\nabbreviation \"getLoadMemory v \\ ValuePart (LoadMemory v)\"\n\nabbreviation \"sideEffectsLoadMemory v \\ StatePart (LoadMemory v)\"\n\nsubsubsection \\@{const LoadCap}\\\n\nabbreviation \"getLoadCap v \\ ValuePart (LoadCap v)\"\n\nabbreviation \"sideEffectsLoadCap v \\ StatePart (LoadCap v)\"\n\nsubsubsection \\@{const StoreMemoryCap}\\\n\nabbreviation \"getStoreMemoryCap v \\ ValuePart (StoreMemoryCap v)\"\n\nabbreviation \"sideEffectsStoreMemoryCap v \\ StatePart (StoreMemoryCap v)\"\n\nsubsubsection \\@{const StoreMemory}\\\n\nabbreviation \"getStoreMemory v \\ ValuePart (StoreMemory v)\"\n\nabbreviation \"sideEffectsStoreMemory v \\ StatePart (StoreMemory v)\"\n\nsubsubsection \\@{const StoreCap}\\\n\nabbreviation \"getStoreCap v \\ ValuePart (StoreCap v)\"\n\nabbreviation \"sideEffectsStoreCap v \\ StatePart (StoreCap v)\"\n\nsubsubsection \\@{const Fetch}\\\n\nabbreviation \"getFetch \\ ValuePart Fetch\"\n\nabbreviation \"sideEffectsFetch \\ StatePart Fetch\"\n\nsubsubsection \\@{const CP0R}\\\n\nabbreviation \"getCP0R v \\ ValuePart (CP0R v)\"\n\nabbreviation \"sideEffectsCP0R v \\ StatePart (CP0R v)\"\n\nsubsubsection \\@{const write'CP0R}\\\n\ntext \\The term @{term \"ValuePart (write'CP0R v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setCP0R v \\ StatePart (write'CP0R v)\"\n\nsubsubsection \\@{const resetStats}\\\n\ntext \\The term @{term \"ValuePart resetStats\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setResetStats \\ StatePart resetStats\"\n\nsubsubsection \\@{const HI}\\\n\nabbreviation \"getHI \\ ValuePart HI\"\n\nabbreviation \"sideEffectsHI \\ StatePart HI\"\n\nsubsubsection \\@{const write'HI}\\\n\ntext \\The term @{term \"ValuePart (write'HI v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setHI v \\ StatePart (write'HI v)\"\n\nlemma getHI_setHI_simp [simp]:\n shows \"getHI (setHI v s) = v\"\nunfolding HI_alt_def write'HI_alt_def\nby (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const LO}\\\n\nabbreviation \"getLO \\ ValuePart LO\"\n\nabbreviation \"sideEffectsLO \\ StatePart LO\"\n\nsubsubsection \\@{const write'LO}\\\n\ntext \\The term @{term \"ValuePart (write'LO v)\"} is simplified to @{term \"\\_. ()\"}.\\\n\nabbreviation \"setLO v \\ StatePart (write'LO v)\"\n\nlemma getLO_setLO_simp [simp]:\n shows \"getLO (setLO v s) = v\"\nunfolding LO_alt_def write'LO_alt_def\nby (simp add: ValuePart_bind StatePart_bind)\n\nsubsubsection \\@{const special_register_accessible}\\\n\nabbreviation \"getSpecial_register_accessible v \\ ValuePart (special_register_accessible v)\"\n\nlemma special_register_accessible_read_only [simp]:\n shows \"StatePart (special_register_accessible v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_special_register_accessible) auto\n\nsubsubsection \\@{const log_instruction}\\\n\nabbreviation \"getLog_instruction v \\ ValuePart (log_instruction v)\"\n\nlemma log_instruction_read_only [simp]:\n shows \"StatePart (log_instruction v) = (\\s. s)\"\nby (intro StatePart_read_onlyI Commute_log_instruction) auto\n\n(* Code generation - end *)\n\nsubsection \\Manual lemmas\\\n\nsubsubsection \\@{const getExceptionSignalled}\\\n\nlemma getExceptionSignalled_simps [simp]:\n shows \"getExceptionSignalled (BranchToPCC_update x_BranchToPCC s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (BranchDelayPCC_update x_BranchDelayPCC s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (the_MEM_update x_the_MEM s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setPCC x_PCC s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setCAPR x_CAPR s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setSCAPR x_SCAPR s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setMEM x_MEM s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setBranchTo x_BranchTo s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (setBranchDelay x_BranchDelay s) = getExceptionSignalled s\"\n and \"getExceptionSignalled (exception_update x_exception s) = getExceptionSignalled s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\ntext \\The following two patterns regularly occur.\\\n\nlemma if_exception_signalled_simp [simp]:\n shows \"bind (read_state getExceptionSignalled)\n (\\ex. if ex then read_state getExceptionSignalled \\\\<^sub>b m else m') = \n bind (read_state getExceptionSignalled)\n (\\ex. if ex then return True else m')\"\nby (intro monad_eqI)\n (auto simp: ValueAndStatePart_simp)\n\nlemma if_not_exception_signalled_simp [simp]:\n shows \"bind (read_state getExceptionSignalled)\n (\\ex. if \\ ex then m else read_state getExceptionSignalled \\\\<^sub>b m') = \n bind (read_state getExceptionSignalled)\n (\\ex. if \\ ex then m else return True)\"\nby (intro monad_eqI)\n (auto simp: ValueAndStatePart_simp)\n\nsubsubsection \\@{const getBranchTo}\\\n\nlemma getBranchTo_simps [simp]:\n shows \"getBranchTo (BranchToPCC_update x_BranchToPCC s) = getBranchTo s\"\n and \"getBranchTo (BranchDelayPCC_update x_BranchDelayPCC s) = getBranchTo s\"\n and \"getBranchTo (the_MEM_update x_the_MEM s) = getBranchTo s\"\n and \"getBranchTo (setPCC x_PCC s) = getBranchTo s\"\n and \"getBranchTo (setCAPR x_CAPR s) = getBranchTo s\"\n and \"getBranchTo (setSCAPR x_SCAPR s) = getBranchTo s\"\n and \"getBranchTo (setMEM x_MEM s) = getBranchTo s\"\n and \"getBranchTo (setBranchDelay x_BranchDelay s) = getBranchTo s\"\n and \"getBranchTo (exception_update x_exception s) = getBranchTo s\"\n and \"getBranchTo (setExceptionSignalled x_ExceptionSignalled s) = getBranchTo s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nsubsubsection \\@{const getBranchDelay}\\\n\nlemma getBranchDelay_simps [simp]:\n shows \"getBranchDelay (BranchToPCC_update x_BranchToPCC s) = getBranchDelay s\"\n and \"getBranchDelay (BranchDelayPCC_update x_BranchDelayPCC s) = getBranchDelay s\"\n and \"getBranchDelay (setPCC x_PCC s) = getBranchDelay s\"\n and \"getBranchDelay (setCAPR x_CAPR s) = getBranchDelay s\"\n and \"getBranchDelay (setSCAPR x_SCAPR s) = getBranchDelay s\"\n and \"getBranchDelay (setMEM x_MEM s) = getBranchDelay s\"\n and \"getBranchDelay (the_MEM_update x_the_MEM s) = getBranchDelay s\"\n and \"getBranchDelay (setBranchTo x_BranchTo s) = getBranchDelay s\"\n and \"getBranchDelay (exception_update x_exception s) = getBranchDelay s\"\n and \"getBranchDelay (setExceptionSignalled x_ExceptionSignalled s) = getBranchDelay s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nsubsubsection \\@{const BranchToPCC}\\\n\nlemma BranchToPCC_simps [simp]:\n shows \"BranchToPCC (BranchDelayPCC_update x_BranchDelayPCC s) = BranchToPCC s\"\n and \"BranchToPCC (the_MEM_update x_the_MEM s) = BranchToPCC s\"\n and \"BranchToPCC (setPCC x_PCC s) = BranchToPCC s\"\n and \"BranchToPCC (setCAPR x_CAPR s) = BranchToPCC s\"\n and \"BranchToPCC (setSCAPR x_SCAPR s) = BranchToPCC s\"\n and \"BranchToPCC (setMEM x_MEM s) = BranchToPCC s\"\n and \"BranchToPCC (setBranchTo x_BranchTo s) = BranchToPCC s\"\n and \"BranchToPCC (setBranchDelay x_BranchDelay s) = BranchToPCC s\"\n and \"BranchToPCC (exception_update x_exception s) = BranchToPCC s\"\n and \"BranchToPCC (setExceptionSignalled x_ExceptionSignalled s) = BranchToPCC s\"\n and \"BranchToPCC (c_state_update x_c_state s) = BranchToPCC s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nsubsubsection \\@{const BranchDelayPCC}\\\n\nlemma BranchDelayPCC_simps [simp]:\n shows \"BranchDelayPCC (BranchToPCC_update x_BranchToPCC s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setPCC x_PCC s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setCAPR x_CAPR s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setSCAPR x_SCAPR s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setMEM x_MEM s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (the_MEM_update x_the_MEM s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setBranchTo x_BranchTo s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setBranchDelay x_BranchDelay s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (exception_update x_exception s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (setExceptionSignalled x_ExceptionSignalled s) = BranchDelayPCC s\"\n and \"BranchDelayPCC (c_state_update x_c_state s) = BranchDelayPCC s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nsubsubsection \\@{const PCC}\\\n\nlemma getPCC_simps [simp]:\n shows \"getPCC (BranchToPCC_update x_BranchToPCC s) = getPCC s\"\n and \"getPCC (BranchDelayPCC_update x_BranchDelayPCC s) = getPCC s\"\n and \"getPCC (setCAPR x_CAPR s) = getPCC s\"\n and \"getPCC (setSCAPR x_SCAPR s) = getPCC s\"\n and \"getPCC (setMEM x_MEM s) = getPCC s\"\n and \"getPCC (the_MEM_update x_the_MEM s) = getPCC s\"\n and \"getPCC (setBranchTo x_BranchTo s) = getPCC s\"\n and \"getPCC (setBranchDelay x_BranchDelay s) = getPCC s\"\n and \"getPCC (exception_update x_exception s) = getPCC s\"\n and \"getPCC (setExceptionSignalled x_ExceptionSignalled s) = getPCC s\"\n and \"getPCC (c_state_update x_c_state s) = getPCC s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nsubsubsection \\@{const GPR}\\\n\nlemma getGPR_simps [simp]:\n shows \"getGPR cd (BranchToPCC_update x_BranchToPCC s) = getGPR cd s\"\n and \"getGPR cd (BranchDelayPCC_update x_BranchDelayPCC s) = getGPR cd s\"\n and \"getGPR cd (setPCC x_PCC s) = getGPR cd s\"\n and \"getGPR cd (setCAPR x_SGPR s) = getGPR cd s\"\n and \"getGPR cd (setSCAPR x_SGPR s) = getGPR cd s\"\n and \"getGPR cd (setMEM x_MEM s) = getGPR cd s\"\n and \"getGPR cd (the_MEM_update x_the_MEM s) = getGPR cd s\"\n and \"getGPR cd (setBranchTo x_BranchTo s) = getGPR cd s\"\n and \"getGPR cd (setBranchDelay x_BranchDelay s) = getGPR cd s\"\n and \"getGPR cd (exception_update x_exception s) = getGPR cd s\"\n and \"getGPR cd (setExceptionSignalled x_ExceptionSignalled s) = getGPR cd s\"\n and \"getGPR cd (c_state_update x_c_state s) = getGPR cd s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getGPR_zero [simp]:\n shows \"getGPR 0 s = 0\"\nunfolding GPR_alt_def\nby simp\n\nlemma Commute_getGPR_setGPR [Commute_compositeI]:\n assumes \"cd \\ cd'\"\n shows \"Commute (GPR cd) (write'GPR (cap, cd'))\"\nusing assms\nunfolding Commute_def\nby simp\n\nsubsubsection \\@{const CAPR}\\\n\nlemma getCAPR_simps [simp]:\n shows \"getCAPR cd (BranchToPCC_update x_BranchToPCC s) = getCAPR cd s\"\n and \"getCAPR cd (BranchDelayPCC_update x_BranchDelayPCC s) = getCAPR cd s\"\n and \"getCAPR cd (setPCC x_PCC s) = getCAPR cd s\"\n and \"getCAPR cd (setSCAPR x_SCAPR s) = getCAPR cd s\"\n and \"getCAPR cd (setMEM x_MEM s) = getCAPR cd s\"\n and \"getCAPR cd (the_MEM_update x_the_MEM s) = getCAPR cd s\"\n and \"getCAPR cd (setBranchTo x_BranchTo s) = getCAPR cd s\"\n and \"getCAPR cd (setBranchDelay x_BranchDelay s) = getCAPR cd s\"\n and \"getCAPR cd (exception_update x_exception s) = getCAPR cd s\"\n and \"getCAPR cd (setExceptionSignalled x_ExceptionSignalled s) = getCAPR cd s\"\n and \"getCAPR cd (c_state_update x_c_state s) = getCAPR cd s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getCAPR_zero [simp]:\n shows \"getCAPR 0 s = nullCap\"\nunfolding CAPR_alt_def\nby simp\n\nlemma Commute_getCAPR_setCAPR [Commute_compositeI]:\n assumes \"cd \\ cd'\"\n shows \"Commute (CAPR cd) (write'CAPR (cap, cd'))\"\nusing assms\nunfolding Commute_def\nby simp\n\nsubsubsection \\@{const SCAPR}\\\n\nlemma getSCAPR_simps [simp]:\n shows \"getSCAPR cd (BranchToPCC_update x_BranchToPCC s) = getSCAPR cd s\"\n and \"getSCAPR cd (BranchDelayPCC_update x_BranchDelayPCC s) = getSCAPR cd s\"\n and \"getSCAPR cd (setPCC x_PCC s) = getSCAPR cd s\"\n and \"getSCAPR cd (setCAPR x_CAPR s) = getSCAPR cd s\"\n and \"getSCAPR cd (setMEM x_MEM s) = getSCAPR cd s\"\n and \"getSCAPR cd (the_MEM_update x_the_MEM s) = getSCAPR cd s\"\n and \"getSCAPR cd (setBranchTo x_BranchTo s) = getSCAPR cd s\"\n and \"getSCAPR cd (setBranchDelay x_BranchDelay s) = getSCAPR cd s\"\n and \"getSCAPR cd (exception_update x_exception s) = getSCAPR cd s\"\n and \"getSCAPR cd (setExceptionSignalled x_ExceptionSignalled s) = getSCAPR cd s\"\n and \"getSCAPR cd (c_state_update x_c_state s) = getSCAPR cd s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma Commute_getSCAPR_setSCAPR [Commute_compositeI]:\n assumes \"cd \\ cd'\"\n shows \"Commute (SCAPR cd) (write'SCAPR (cap, cd'))\"\nusing assms\nunfolding Commute_def\nby simp\n\nsubsubsection \\@{const MEM}\\\n\nlemma getMEM_simps [simp]:\n shows \"getMEM a (BranchToPCC_update x_BranchToPCC s) = getMEM a s\"\n and \"getMEM a (BranchDelayPCC_update x_BranchDelayPCC s) = getMEM a s\"\n and \"getMEM a (setPCC x_PCC s) = getMEM a s\"\n and \"getMEM a (setCAPR x_CAPR s) = getMEM a s\"\n and \"getMEM a (setSCAPR x_SCAPR s) = getMEM a s\"\n and \"getMEM a (setBranchTo x_BranchTo s) = getMEM a s\"\n and \"getMEM a (setBranchDelay x_BranchDelay s) = getMEM a s\"\n and \"getMEM a (exception_update x_exception s) = getMEM a s\"\n and \"getMEM a (setExceptionSignalled x_ExceptionSignalled s) = getMEM a s\"\n and \"getMEM a (c_state_update x_c_state s) = getMEM a s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getMEM_update_the_MEM [simp]:\n shows \"getMEM a (the_MEM_update f s) = f (the_MEM s) a\"\nunfolding MEM_alt_def\nby (simp add: ValuePart_bind)\n\nsubsubsection \\@{const the_MEM}\\\n\nlemma the_MEM_simps [simp]:\n shows \"the_MEM (BranchToPCC_update x_BranchToPCC s) = the_MEM s\"\n and \"the_MEM (BranchDelayPCC_update x_BranchDelayPCC s) = the_MEM s\"\n and \"the_MEM (setPCC x_PCC s) = the_MEM s\"\n and \"the_MEM (setCAPR x_CAPR s) = the_MEM s\"\n and \"the_MEM (setSCAPR x_SCAPR s) = the_MEM s\"\n and \"the_MEM (setBranchTo x_BranchTo s) = the_MEM s\"\n and \"the_MEM (setBranchDelay x_BranchDelay s) = the_MEM s\"\n and \"the_MEM (exception_update x_exception s) = the_MEM s\"\n and \"the_MEM (setExceptionSignalled x_ExceptionSignalled s) = the_MEM s\"\n and \"the_MEM (c_state_update x_c_state s) = the_MEM s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma the_MEM_setMEM [simp]:\n shows \"the_MEM (setMEM v s) = (the_MEM s)(snd v := fst v)\"\nunfolding write'MEM_alt_def\nby (cases v) (simp add: StatePart_bind)\n\nsubsubsection \\@{const KernelMode}\\\n\nlemma getKernelMode_simps [simp]:\n shows \"getKernelMode (BranchToPCC_update x_BranchToPCC s) = getKernelMode s\"\n and \"getKernelMode (BranchDelayPCC_update x_BranchDelayPCC s) = getKernelMode s\"\n and \"getKernelMode (the_MEM_update x_the_MEM s) = getKernelMode s\"\n and \"getKernelMode (setPCC x_PCC s) = getKernelMode s\"\n and \"getKernelMode (setCAPR x_CAPR s) = getKernelMode s\"\n and \"getKernelMode (setSCAPR x_SCAPR s) = getKernelMode s\"\n and \"getKernelMode (setMEM x_MEM s) = getKernelMode s\"\n and \"getKernelMode (setBranchTo x_BranchTo s) = getKernelMode s\"\n and \"getKernelMode (setBranchDelay x_BranchDelay s) = getKernelMode s\"\n and \"getKernelMode (exception_update x_exception s) = getKernelMode s\"\n and \"getKernelMode (setExceptionSignalled x_ExceptionSignalled s) = getKernelMode s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getKernelMode_setCP0StatusEXL_True [simp]:\n shows \"getKernelMode (setCP0StatusEXL True s) = True\"\nunfolding KernelMode_alt_def\nby (simp add: ValuePart_bind)\n\nlemma getKernelMode_setCP0StatusEXL_False [elim!]:\n assumes \"getKernelMode (setCP0StatusEXL False s)\"\n shows \"getKernelMode s\"\nusing assms\nunfolding KernelMode_alt_def\nby (auto simp add: ValueAndStatePart_simp)\n\nlemma getKernelMode_setCP0StatusERL_True [simp]:\n shows \"getKernelMode (setCP0StatusERL True s) = True\"\nunfolding KernelMode_alt_def\nby (simp add: ValuePart_bind)\n\nlemma getKernelMode_setCP0StatusERL_False [elim!]:\n assumes \"getKernelMode (setCP0StatusERL False s)\"\n shows \"getKernelMode s\"\nusing assms\nunfolding KernelMode_alt_def\nby (auto simp add: ValueAndStatePart_simp)\n\nsubsubsection \\@{const raise'exception}\\\n\nlemma raise'exception_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled (StatePart (raise'exception v) s) = getExceptionSignalled s\"\nby SimpLemmaViaHoareTriple\n\nlemma raise'exception_exception:\n shows \"exception (StatePart (raise'exception v) s) = \n (let old_ex = exception s in if old_ex = NoException then v else old_ex)\"\nunfolding raise'exception_alt_def\nby (simp add: StatePart_bind)\n\nsubsubsection \\@{const check_cca}\\\n\nlemma check_cca_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled (StatePart (check_cca v) s) = getExceptionSignalled s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const next_unknown}\\\n\nlemma next_unknown_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled (StatePart (next_unknown v) s) = getExceptionSignalled s\"\nby SimpLemmaViaHoareTriple\n\nlemma next_unknown_exception [simp]:\n shows \"exception (StatePart (next_unknown v) s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalException}\\\n\nlemma setSignalException_simps [simp]:\n shows \"getMEM a (setSignalException ex s) = getMEM a s\"\n and \"the_MEM (setSignalException ex s) = the_MEM s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma setSignalException_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalException v) s) = True\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_exception [simp]:\n shows \"exception (setSignalException v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_BranchTo [simp]:\n shows \"getBranchTo ((setSignalException v) s) = None\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_BranchDelay [simp]:\n shows \"getBranchDelay ((setSignalException v) s) = None\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_BranchToPCC [simp]:\n shows \"BranchToPCC ((setSignalException v) s) = None\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_BranchDelayPCC [simp]:\n shows \"BranchDelayPCC ((setSignalException v) s) = None\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_getPCC [simp]:\n shows \"getPCC ((setSignalException v) s) = getKCC s\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_getCAPR [simp]:\n shows \"getCAPR cd ((setSignalException v) s) = getCAPR cd s\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_ExcCode [simp]:\n shows \"CauseRegister.ExcCode (Cause (getCP0 ((setSignalException v) s))) = ExceptionCode v\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\nlemma setSignalException_CP0Status [simp]:\n shows \"Status (getCP0 ((setSignalException v) s)) = Status (getCP0 s)\\EXL := True\\\"\nunfolding SignalException_alt_def\nby SimpLemmaViaHoareTriple\n\ndefinition SignalExceptionSCAPR where\n \"SignalExceptionSCAPR \\ \n (\\cd s. if cd = 31 \\ \\ EXL (Status (getCP0 s))\n then setOffset (getPCC s, getPC s) \n else getSCAPR cd s)\"\n\nlemma Commute_LegitimateCaps [Commute_compositeI]:\n assumes \"Commute (read_state getCP0) m\"\n and \"Commute (read_state getPC) m\"\n and \"Commute (read_state getPCC) m\"\n and \"Commute (read_state (getSCAPR cd)) m\"\n shows \"Commute (read_state (SignalExceptionSCAPR cd)) m\"\nusing assms\nunfolding SignalExceptionSCAPR_def Commute_def\nby auto\n\nlemma setSignalException_getSCAPR [simp]:\n shows \"getSCAPR cd ((setSignalException v) s) = SignalExceptionSCAPR cd s\"\nunfolding SignalException_alt_def SignalExceptionSCAPR_def\nunfolding canRepOffset_def\n-- \\The following takes a long time.\\\nby SimpLemmaViaHoareTriple\n (auto split: if_splits(1))\n\ndefinition VectorBaseSignalExceptionPC :: \"state \\ 64 word\" where\n \"VectorBaseSignalExceptionPC s \\ \n if BEV (Status (getCP0 s)) then 18446744072631616000 else 18446744071562067968\"\n\ndefinition VectorOffsetSignalExceptionPC :: \"ExceptionType \\ state \\ 30 word\" where\n \"VectorOffsetSignalExceptionPC v s \\ \n if (v = XTLBRefillL \\ v = XTLBRefillS) \\ \\ EXL (Status (getCP0 s)) then 128 \n else if v = C2E \\ (CapCause.ExcCode (capcause s) = 5 \\ CapCause.ExcCode (capcause s) = 6) then 640 \n else 384\"\n\ndefinition SignalExceptionPC where\n \"SignalExceptionPC v s \\ \n let vectorBase = VectorBaseSignalExceptionPC s;\n vectorOffset = VectorOffsetSignalExceptionPC v s in\n word_cat ((slice 30 vectorBase)::34 word) (ucast vectorBase + vectorOffset) - \n getBase (getKCC s)\"\n\nlemma setSignalException_getPC [simp]:\n shows \"getPC ((setSignalException v) s) = SignalExceptionPC v s\"\nunfolding SignalException_alt_def \n SignalExceptionPC_def \n VectorBaseSignalExceptionPC_def \n VectorOffsetSignalExceptionPC_def\n canRepOffset_def\nunfolding Let_def\n-- \\The following takes a long time.\\ \nby (SimpLemmaViaHoareTriple simp: if_bool_simps)\n\ndefinition ExceptionPCs where\n \"ExceptionPCs \\ \n let vectorBases :: 64 word set = {18446744072631616000, 18446744071562067968};\n vectorOffsets :: 30 word set = {128, 384, 640} in\n {word_cat ((slice 30 vectorBase)::34 word) (ucast vectorBase + vectorOffset) |\n vectorBase vectorOffset. vectorBase \\ vectorBases \\ vectorOffset \\ vectorOffsets}\"\n\nlemma getPC_SignalExecption_in_ExceptionPCs [intro!, simp]:\n shows \"getBase (getKCC s) + SignalExceptionPC v s \\ ExceptionPCs\"\nproof -\n have \"VectorBaseSignalExceptionPC s \\ {18446744072631616000, 18446744071562067968}\"\n unfolding VectorBaseSignalExceptionPC_def by simp\n moreover have \"VectorOffsetSignalExceptionPC v s \\ {128, 384, 640}\"\n unfolding VectorOffsetSignalExceptionPC_def by simp\n ultimately show ?thesis\n unfolding SignalExceptionPC_def ExceptionPCs_def Let_def\n by auto\nqed\n\nsubsubsection \\@{const SignalCP2UnusableException}\\\n\nlemma setSignalCP2UnusableException_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled (setSignalCP2UnusableException s) = True\"\nunfolding SignalCP2UnusableException_alt_def\nby (simp add: StatePart_bind)\n\nlemma setSignalCP2UnusableException_exception [simp]:\n shows \"exception (setSignalCP2UnusableException s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalCapException_internal}\\\n\nlemma setSignalCapException_internal_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalCapException_internal v) s) = True\"\nunfolding SignalCapException_internal_alt_def\nby (cases v) (simp add: StatePart_bind)\n\nlemma setSignalCapException_internal_exception [simp]:\n shows \"exception (setSignalCapException_internal v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalCapException}\\\n\nlemma setSignalCapException_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalCapException v) s) = True\"\nunfolding SignalCapException_alt_def\nby (cases v) (simp add: StatePart_bind)\n\nlemma setSignalCapException_exception [simp]:\n shows \"exception (setSignalCapException v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalCapException_noReg}\\\n\nlemma setSignalCapException_noReg_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalCapException_noReg v) s) = True\"\nunfolding SignalCapException_noReg_alt_def\nby simp\n\nlemma setSignalCapException_noReg_exception [simp]:\n shows \"exception (setSignalCapException_noReg v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalTLBException}\\\n\nlemma setSignalTLBException_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalTLBException v) s) = True\"\nunfolding SignalTLBException_alt_def Let_def\nby (cases v) (simp add: ValuePart_bind StatePart_bind)\n\nlemma setSignalTLBException_exception [simp]:\n shows \"exception (setSignalTLBException v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const SignalTLBCapException}\\\n\nlemma setSignalTLBCapException_getExceptionSignalled [simp]:\n shows \"getExceptionSignalled ((setSignalTLBCapException v) s) = True\"\nunfolding SignalTLBCapException_alt_def Let_def\nby (cases v) (simp add: ValuePart_bind StatePart_bind)\n\nlemma setSignalTLBCapException_exception [simp]:\n shows \"exception (setSignalTLBCapException v s) = exception s\"\nby SimpLemmaViaHoareTriple\n\nsubsubsection \\@{const CheckSegment}\\\n\nlemma getCheckSegment_setExceptionSignalled [simp]:\n \"getCheckSegment v (setExceptionSignalled v' s) = getCheckSegment v s\"\nproof -\n have \"Commute (CheckSegment v) (update_state (setExceptionSignalled v'))\"\n by Commute\n thus ?thesis\n unfolding Commute_def\n by simp\nqed\n\nlemma getCheckSegment_exception [simp]:\n \"getCheckSegment v (exception_update v' s) = getCheckSegment v s\"\nproof -\n have \"Commute (CheckSegment v) (update_state (exception_update v'))\"\n by Commute\n thus ?thesis\n unfolding Commute_def\n by simp\nqed\n\nsubsubsection \\@{const LookupTLB}\\\n\nlemma getLookupTLB_setExceptionSignalled [simp]:\n \"getLookupTLB v (setExceptionSignalled v' s) = getLookupTLB v s\"\nproof -\n have \"Commute (LookupTLB v) (update_state (setExceptionSignalled v'))\"\n by Commute\n thus ?thesis\n unfolding Commute_def\n by simp\nqed\n\nlemma getLookupTLB_exception [simp]:\n \"getLookupTLB v (exception_update v' s) = getLookupTLB v s\"\nproof -\n have \"Commute (LookupTLB v) (update_state (exception_update v'))\"\n by Commute\n thus ?thesis\n unfolding Commute_def\n by simp\nqed\n\nsubsubsection \\@{const AdjustEndian}\\\n\nlemma AdjustEndian_Doubleword [simp]:\n shows \"AdjustEndian (DOUBLEWORD, addr) = return addr\"\nunfolding AdjustEndian_alt_def DOUBLEWORD_def\nby simp\n\nlemma AdjustEndian_slice:\n assumes \"fst v \\ {0, 1, 3, 7}\"\n shows \"(slice 3 (getAdjustEndian v s)::37 word) = slice 3 (snd v)\"\nusing assms\nunfolding AdjustEndian_alt_def\nby (cases v)\n (auto simp: ValueAndStatePart_simp slice_xor)\n\nsubsubsection \\@{const updateDwordInRaw}\\\n\nlemma extract_byte_updateDwordInRaw:\n shows \"extract_byte index (updateDwordInRaw (addr', val, msk, old_blob)) = \n (if 32 \\ index then 0\n else if of_nat (index div 8) = (ucast addr':: 2 word) then \n extract_byte index old_blob AND NOT extract_byte (index mod 8) msk \n OR extract_byte (index mod 8) val AND extract_byte (index mod 8) msk\n else extract_byte index old_blob)\"\nproof -\n have twoWord: \"x = 3\" if \"x \\ 0\" \"x \\ 1\" \"x \\ 2\" for x :: \"2 word\"\n proof -\n obtain x' where x: \"x = of_nat x'\" and \"x' < 4\"\n by (cases x) auto\n hence \"x' = 0 \\ x' = 1 \\ x' = 2 \\ x' = 3\"\n by auto\n thus ?thesis\n using that x\n by auto\n qed\n have \"(of_nat (index div 8) = n) \\ (unat n * 8 \\ index \\ index < (unat n + 1) * 8)\" \n if \"index < 32\" for n :: \"2 word\" \n using that\n by (auto simp: unat_of_nat unat_arith_simps)\n note [simp] = this[where n=0, simplified] \n this[where n=1, simplified] \n this[where n=2, simplified] \n this[where n=3, simplified]\n have [simp]: \"index mod 8 = index - 8\" if \"8 \\ index\" \"index < 16\"\n using that mod_less le_mod_geq\n by auto\n have [simp]: \"index mod 8 = index - 16\" if \"16 \\ index\" \"index < 24\"\n using that mod_less le_mod_geq\n by auto\n have [simp]: \"index mod 8 = index - 24\" if \"24 \\ index\" \"index < 32\"\n using that mod_less le_mod_geq\n by auto\n have [simp]: \"extract_byte (index - 24) x = 0\" if \"32 \\ index\" for x :: \"64 word\"\n using that by (auto intro: extract_byte_outside_bounds)\n note extract_byte_word_extract_fixed =\n extract_byte_word_extract[where m'=32]\n extract_byte_word_extract[where m'=24]\n extract_byte_word_extract[where m'=16]\n show ?thesis\n unfolding updateDwordInRaw_def\n by (auto simp: not_le \n not_less\n le_diff_conv2\n if_distrib[where f=\"extract_byte _\"]\n extract_byte_word_and\n extract_byte_word_or\n extract_byte_word_not\n extract_byte_ucast\n extract_byte_word_cat\n extract_byte_word_extract_fixed \n intro: twoWord)\nqed\n\nsubsubsection \\@{const isAligned}\\\n\nlemma isAlignedI [simp, intro!]:\n shows \"isAligned (vAddr, 0)\"\nunfolding isAligned_def\nby simp\n\nlemma isAligned_max_length:\n assumes \"isAligned (vAddr, accessLength)\"\n shows \"unat vAddr mod 8 + unat accessLength < 8\"\nproof -\n have \"ucast vAddr + accessLength = \n (ucast vAddr AND accessLength) + (ucast vAddr OR accessLength)\"\n by simp\n also have \"... = ucast vAddr OR accessLength\"\n using assms\n unfolding isAligned_def ucast_def\n by simp\n finally have \"ucast vAddr \\ ucast vAddr + accessLength\"\n by (simp add: le_word_or2)\n note unat_plus_simple[THEN iffD1, OF this]\n note unat_add_lem[THEN iffD2, OF this]\n thus ?thesis\n by (simp add: unat_and_mask)\nqed\n\nsubsubsection \\@{const special_register_accessible}\\\n\nlemma special_register_accessible_zero [simp]:\n \"getSpecial_register_accessible 0 s\"\nunfolding special_register_accessible_alt_def\nby simp\n\nlemma special_register_accessible_one [simp]:\n \"getSpecial_register_accessible 1 s\"\nunfolding special_register_accessible_alt_def\nby simp\n\nsection \\Order over capabilities\\\n\ntext \\In this theory we define an order over capabilities.\\\n\nsubsection \\Bitwise operations over permissions\\\n\ninstantiation Perms_ext :: (Inf) Inf\nbegin\n\ndefinition Inf_Perms_ext :: \"'a Perms_scheme set \\ 'a Perms_scheme\" where\n \"Inf_Perms_ext s = Perms.extend (rec'Perms (bitwise_Inf (reg'Perms ` Perms.truncate ` s)))\n (Inf (Perms.more ` s))\"\n\ninstance .. \n\nend\n\ninstantiation Perms_ext :: (Sup) Sup\nbegin\n\ndefinition Sup_Perms_ext :: \"'a Perms_scheme set \\ 'a Perms_scheme\" where\n \"Sup_Perms_ext s = Perms.extend (rec'Perms (bitwise_Sup (reg'Perms ` Perms.truncate ` s)))\n (Sup (Perms.more ` s))\"\n\ninstance .. \n\nend\n\nsubsection \\Order over system permissions\\\n\ninstantiation \"Perms_ext\" :: (order) order\n\nbegin\n\ndefinition less_eq_Perms_ext :: \"'a Perms_scheme \\ 'a Perms_scheme \\ bool\" where \n \"less_eq_Perms_ext p1 p2 \\ \n bitwise_less_eq (reg'Perms (Perms.truncate p1)) (reg'Perms (Perms.truncate p2)) \\\n Perms.more p1 \\ Perms.more p2\"\n\ndefinition less_Perms_ext :: \"'a Perms_scheme \\ 'a Perms_scheme \\ bool\" where\n \"less_Perms_ext p1 p2 \\ p1 \\ p2 \\ \\(p2 \\ p1)\"\n\ninstance proof\n fix x y :: \"'a Perms_scheme\"\n show \"(x < y) = (x \\ y \\ \\ y \\ x)\"\n unfolding less_Perms_ext_def ..\nnext\n fix x :: \"'a Perms_scheme\"\n show \"x \\ x\"\n unfolding less_eq_Perms_ext_def\n by simp\nnext\n fix x y z :: \"'a Perms_scheme\"\n assume \"x \\ y\" \"y \\ z\"\n thus \"x \\ z\"\n unfolding less_eq_Perms_ext_def\n by auto\nnext\n fix x y :: \"'a Perms_scheme\"\n assume as: \"x \\ y\" \"y \\ x\" \n hence more_eq: \"Perms.more x = Perms.more y\"\n unfolding less_eq_Perms_ext_def by auto \n have \"reg'Perms (Perms.truncate x) = reg'Perms (Perms.truncate y)\"\n using as \n unfolding less_eq_Perms_ext_def\n by auto\n from arg_cong[OF this, where f=rec'Perms]\n have \"Perms.truncate x = Perms.truncate y\"\n by simp\n thus \"x = y\"\n unfolding Perms.truncate_def\n using more_eq\n by (intro Perms.equality) simp_all\nqed\n\nend\n\nlemma less_eq_Perms_ext_alt:\n shows \"p1 \\ p2 = ((Global p1 \\ Global p2) \\\n (Permit_CCall p1 \\ Permit_CCall p2) \\\n (Permit_Execute p1 \\ Permit_Execute p2) \\\n (Permit_Load p1 \\ Permit_Load p2) \\\n (Permit_Store p1 \\ Permit_Store p2) \\\n (Permit_Load_Capability p1 \\ Permit_Load_Capability p2) \\\n (Permit_Store_Capability p1 \\ Permit_Store_Capability p2) \\\n (Permit_Store_Local_Capability p1 \\ Permit_Store_Local_Capability p2) \\\n (Permit_Seal p1 \\ Permit_Seal p2) \\\n (Permit_Unseal p1 \\ Permit_Unseal p2) \\\n (Access_System_Registers p1 \\ Access_System_Registers p2) \\\n (Permit_Set_CID p1 \\ Permit_Set_CID p2) \\\n (\\i < 20. Reserved p1 !! i \\ Reserved p2 !! i) \\\n (Perms.more p1 \\ Perms.more p2))\" (is \"?l = ?r\")\nproof\n assume \"?l\"\n hence more_leq: \"Perms.more p1 \\ Perms.more p2\"\n unfolding less_eq_Perms_ext_def by simp\n have *: \"reg'Perms (Perms.truncate p1) !! i \\ reg'Perms (Perms.truncate p2) !! i\" \n if \"i < 32\" for i\n using that `?l`\n unfolding less_eq_Perms_ext_def bitwise_less_eq_def\n by auto\n have \"\\i<20. Perms.Reserved p1 !! i \\ Perms.Reserved p2 !! i\"\n proof (intro allI impI)\n fix i::nat\n assume \"i < 20\" and as: \"Perms.Reserved p1 !! i\"\n thus \"Perms.Reserved p2 !! i\"\n using *[of \"i + 12\"] as \n unfolding nth_reg'Perms\n by simp\n qed\n thus \"?r\"\n using *[of 0] *[of 1] *[of 2] *[of 3] *[of 4] *[of 5] \n *[of 6] *[of 7] *[of 8] *[of 9] *[of 10] *[of 11]\n using more_leq\n by simp\nnext\n assume \"?r\"\n thus \"?l\"\n unfolding less_eq_Perms_ext_def bitwise_less_eq_def nth_reg'Perms\n by simp\nqed\n\nlemma less_eq_Perms_update [simp]:\n shows \"p\\Access_System_Registers := b\\ \\ p = (b \\ Access_System_Registers p)\"\n and \"p\\Global := b\\ \\ p = (b \\ Global p)\"\n and \"p\\Permit_Execute := b\\ \\ p = (b \\ Permit_Execute p)\"\n and \"p\\Permit_Load := b\\ \\ p = (b \\ Permit_Load p)\"\n and \"p\\Permit_Load_Capability := b\\ \\ p = (b \\ Permit_Load_Capability p)\"\n and \"p\\Permit_Seal := b\\ \\ p = (b \\ Permit_Seal p)\"\n and \"p\\Permit_Unseal := b\\ \\ p = (b \\ Permit_Unseal p)\"\n and \"p\\Permit_Store := b\\ \\ p = (b \\ Permit_Store p)\"\n and \"p\\Permit_Store_Capability := b\\ \\ p = (b \\ Permit_Store_Capability p)\"\n and \"p\\Permit_Store_Local_Capability := b\\ \\ p = (b \\ Permit_Store_Local_Capability p)\"\n and \"p\\Permit_Set_CID := b\\ \\ p = (b \\ Permit_Set_CID p)\"\nunfolding less_eq_Perms_ext_alt\nby simp_all\n\nlemma less_eq_Perms_def:\n fixes p q :: Perms\n shows \"p \\ q = bitwise_less_eq (reg'Perms p) (reg'Perms q)\"\nunfolding less_eq_Perms_ext_def\nby simp\n\nlemma rec'Perms_zero_leq [simp]:\n shows \"rec'Perms 0 \\ p\"\nunfolding less_eq_Perms_ext_def\nby simp\n\nlemma rec'Perms_AND_leq [simp]:\n shows \"rec'Perms (p AND q) \\ rec'Perms p\"\n and \"rec'Perms (q AND p) \\ rec'Perms p\"\nunfolding less_eq_Perms_ext_def\nby simp_all\n\ntext {* The following rules are unsafe *}\n\nlemmas rec'Perms_AND_leq_forget_right =\n order_trans[OF rec'Perms_AND_leq(1)]\n\nlemmas rec'Perms_AND_leq_forget_left =\n order_trans[OF rec'Perms_AND_leq(2)]\n\nsubsection \\Order over user permissions\\\n\ninstantiation \"UPerms_ext\" :: (order) order\n\nbegin\n\ndefinition less_eq_UPerms_ext :: \"'a UPerms_scheme \\ 'a UPerms_scheme \\ bool\" where \n \"less_eq_UPerms_ext p1 p2 \\ \n bitwise_less_eq (reg'UPerms (UPerms.truncate p1)) (reg'UPerms (UPerms.truncate p2)) \\\n UPerms.more p1 \\ UPerms.more p2\"\n\ndefinition less_UPerms_ext :: \"'a UPerms_scheme \\ 'a UPerms_scheme \\ bool\" where\n \"less_UPerms_ext p1 p2 \\ p1 \\ p2 \\ \\(p2 \\ p1)\"\n\ninstance proof\n fix x y :: \"'a UPerms_scheme\"\n show \"(x < y) = (x \\ y \\ \\ y \\ x)\"\n unfolding less_UPerms_ext_def ..\nnext\n fix x :: \"'a UPerms_scheme\"\n show \"x \\ x\"\n unfolding less_eq_UPerms_ext_def\n by simp\nnext\n fix x y z :: \"'a UPerms_scheme\"\n assume \"x \\ y\" \"y \\ z\"\n thus \"x \\ z\"\n unfolding less_eq_UPerms_ext_def\n by auto\nnext\n fix x y :: \"'a UPerms_scheme\"\n assume as: \"x \\ y\" \"y \\ x\" \n hence more_eq: \"UPerms.more x = UPerms.more y\"\n unfolding less_eq_UPerms_ext_def by auto \n have \"reg'UPerms (UPerms.truncate x) = reg'UPerms (UPerms.truncate y)\"\n using as \n unfolding less_eq_UPerms_ext_def\n by auto\n from arg_cong[OF this, where f=rec'UPerms]\n have \"UPerms.truncate x = UPerms.truncate y\"\n by simp\n thus \"x = y\"\n unfolding UPerms.truncate_def\n using more_eq\n by (intro UPerms.equality) simp_all\nqed\n\nend\n\nlemma less_eq_UPerms_def:\n fixes p q :: UPerms\n shows \"p \\ q = bitwise_less_eq (reg'UPerms p) (reg'UPerms q)\"\nunfolding less_eq_UPerms_ext_def\nby simp\n\nlemma rec'UPerms_zero_leq [simp]:\n shows \"rec'UPerms 0 \\ p\"\nunfolding less_eq_UPerms_ext_def\nby simp\n\nlemma rec'UPerms_AND_leq [simp]:\n shows \"rec'UPerms (p AND q) \\ rec'UPerms p\"\n and \"rec'UPerms (q AND p) \\ rec'UPerms p\"\nunfolding less_eq_UPerms_ext_def\nby simp_all\n\ntext {* The following rules are unsafe *}\n\nlemmas rec'UPerms_AND_leq_forget_right =\n order_trans[OF rec'UPerms_AND_leq(1)]\n\nlemmas rec'UPerms_AND_leq_forget_left =\n order_trans[OF rec'UPerms_AND_leq(2)]\n\nsubsection \\Order over memory regions\\\n\ndefinition CapabilityWraps :: \"Capability \\ bool\" where\n \"CapabilityWraps cap \\ (uint (getBase cap) + uint (getLength cap) > 2 ^ 64)\"\n\ntext {* The following defines the region of memory specified by a base and length. *}\n\ndefinition Region :: \"('a::len) word \\ 'a word \\ 'a word set\" where\n \"Region b l = \n (if uint b + uint l \\ 2 ^ LENGTH('a) \n then {b + i |i. i < l} else UNIV)\"\n\nabbreviation \"RegionOfCap cap \\ Region (getBase cap) (getLength cap)\"\n\nlemma Region_zero [simp]:\n shows \"Region b 0 = {}\"\nunfolding Region_def\nby simp\n\nlemma Region_first [simp]:\n shows \"(x \\ Region x l) = (l \\ 0)\"\nunfolding Region_def\nby (auto simp: word_gt_0)\n\nlemma Region_member_simp:\n fixes x :: \"'a::len word\"\n shows \"(x \\ Region b l) = \n (uint b + uint l \\ 2 ^ LENGTH('a) \\ x - b < l)\" \n (is \"?l \\ ?r\\<^sub>1 \\ ?r\\<^sub>2\")\nproof (intro iffI)\n assume ?l\n thus \"?r\\<^sub>1 \\ ?r\\<^sub>2\"\n unfolding Region_def\n by (auto simp: if_distrib)\nnext\n assume \"?r\\<^sub>1 \\ ?r\\<^sub>2\"\n show ?l\n proof (cases ?r\\<^sub>1)\n case True\n hence ?r\\<^sub>2\n using `?r\\<^sub>1 \\ ?r\\<^sub>2` by simp\n hence \"\\i. x = b + i \\ i < l\"\n by (intro exI[where x=\"x - b\"]) auto\n thus ?thesis \n unfolding Region_def\n by auto\n next\n case False\n thus ?thesis \n unfolding Region_def\n by auto\n qed\nqed\n\nlemma Region_memberI [intro]:\n fixes x :: \"'a::len word\"\n assumes \"uint b + uint l \\ 2 ^ LENGTH('a) \\ x - b < l\"\n shows \"x \\ Region b l\"\nusing assms\nunfolding Region_member_simp\nby simp\n\nlemma Region_memberE [elim]:\n fixes x :: \"'a::len word\"\n assumes \"x \\ Region b l\"\n and \"uint b + uint l \\ 2 ^ LENGTH('a)\"\n shows \"x - b < l\"\nusing assms\nunfolding Region_member_simp\nby simp\n\nlemma Region_memberI_65word:\n fixes x b l :: \"64 word\" and y :: \"65 word\"\n assumes \"(ucast x::65 word) + y \\ ucast b + ucast l\"\n and \"b \\ x\"\n and \"1 \\ y\" \"y < 2 ^ 64\"\n shows \"x \\ Region b l\"\nproof -\n define y' :: \"64 word\" where \"y' = ucast y\" \n have \"uint y mod 2 ^ 64 = uint y\"\n using `1 \\ y` `y < 2 ^ 64`\n unfolding word_less_def word_le_def\n using int_mod_eq'\n by auto\n hence y_def: \"y = ucast y'\"\n unfolding y'_def\n by (simp add: and_mask_mod_2p)\n have \"uint x + uint y \\ uint b + uint l\"\n using assms \n unfolding y_def word_le_def uint_word_of_int\n by simp\n hence \"uint x < uint b + uint l\"\n using `1 \\ y`\n unfolding y_def word_le_def\n by simp\n hence \"x - b < l\"\n using `b \\ x`\n unfolding uint_minus_simple_alt word_less_def\n by auto\n thus ?thesis by auto\nqed\n\nlemma Region_subsetI:\n fixes b b' l l' :: \"('a::len) word\"\n assumes shorter: \"uint (b - b') + uint l \\ uint l'\"\n shows \"Region b l \\ Region b' l'\"\nproof (cases \"uint b + uint l \\ 2 ^ LENGTH('a)\")\n case True\n let ?d = \"b - b'\"\n have \"b + i - b' < l'\" if \"i < l\" for i\n using that\n proof -\n fix i\n assume \"i < l\"\n have \"?d + i < l'\"\n using uint_add_le[of ?d i] `i < l` shorter\n unfolding word_less_def\n by auto\n have \"b + i - b' = b - b' + i\" by auto\n thus \"b + i - b' < l'\"\n using `?d + i < l'` by arith\n qed \n hence \"b + i \\ Region b' l'\" if \"i < l\" for i\n using that \n unfolding Region_member_simp\n by auto\n thus \"Region b l \\ Region b' l'\"\n using True\n unfolding Region_def\n by auto\nnext\n case False\n hence \"2 ^ LENGTH('a) < uint b' + uint l'\"\n using shorter uint_sub_ge[where x=b and y=b']\n by auto\n thus ?thesis \n unfolding Region_def by auto\nqed\n\nlemma aligned_Region_member:\n fixes a b :: \"'a::len word\"\n assumes \"a AND NOT mask n = b AND NOT mask n\"\n and \"n < LENGTH('a)\"\n shows \"a \\ Region (b AND NOT mask n) (2 ^ n)\"\nproof -\n have \"a - (a AND NOT mask n) < 2 ^ n\"\n using assms(2)\n by (simp add: and_mask_less') \n hence \"a - (b AND NOT mask n) < 2 ^ n\"\n using assms(1) by simp\n thus ?thesis by auto\nqed\n\nsubsection \\Order over capabilities\\\n\ninstantiation \"Capability_ext\" :: (preorder) preorder\n\nbegin\n\ndefinition less_eq_Capability :: \"Capability \\ Capability \\ bool\" where \n \"less_eq_Capability cap\\<^sub>1 cap\\<^sub>2 \\\n (\\ getTag cap\\<^sub>1) \\\n (cap\\<^sub>1 = cap\\<^sub>2) \\\n ((\\ getSealed cap\\<^sub>1) \\\n (\\ getSealed cap\\<^sub>2) \\\n (getTag cap\\<^sub>2) \\\n (RegionOfCap cap\\<^sub>1 \\ RegionOfCap cap\\<^sub>2) \\\n (getPerms cap\\<^sub>1 \\ getPerms cap\\<^sub>2) \\\n (getUPerms cap\\<^sub>1 \\ getUPerms cap\\<^sub>2) \\\n (getType cap\\<^sub>1 = getType cap\\<^sub>2) \\\n (reserved cap\\<^sub>1 = reserved cap\\<^sub>2))\"\n\nlemma less_eq_Capability_refl [simp]:\n shows \"less_eq_Capability cap cap\"\nunfolding less_eq_Capability_def\nby simp\n\nlemma less_eq_Capability_trans:\n assumes \"less_eq_Capability x y\"\n and \"less_eq_Capability y z\"\n shows \"less_eq_Capability x z\"\nusing assms\nunfolding less_eq_Capability_def\nby auto\n\ndefinition less_eq_Capability_ext :: \"'a Capability_scheme \\ 'a Capability_scheme \\ bool\" where \n \"less_eq_Capability_ext cap\\<^sub>1 cap\\<^sub>2 \\ \n (less_eq_Capability (Capability.truncate cap\\<^sub>1) (Capability.truncate cap\\<^sub>2)) \\\n (Capability.more cap\\<^sub>1 \\ Capability.more cap\\<^sub>2)\"\n\ndefinition less_Capability_ext :: \"'a Capability_scheme \\ 'a Capability_scheme \\ bool\" where\n \"less_Capability_ext cap\\<^sub>1 cap\\<^sub>2 \\ cap\\<^sub>1 \\ cap\\<^sub>2 \\ \\(cap\\<^sub>2 \\ cap\\<^sub>1)\"\n\ninstance proof\n fix x y :: \"'a Capability_scheme\"\n show \"(x < y) = (x \\ y \\ \\ y \\ x)\"\n unfolding less_Capability_ext_def ..\nnext\n fix x :: \"'a Capability_scheme\"\n show \"x \\ x\"\n unfolding less_eq_Capability_ext_def\n by simp\nnext\n fix x y z :: \"'a Capability_scheme\"\n assume assms: \"x \\ y\" \"y \\ z\"\n thus \"x \\ z\"\n using order_trans less_eq_Capability_trans\n unfolding less_eq_Capability_ext_def\n by metis\nqed\n\nend\n\n(* lemma less_eq_Capability_ext_no_extension:\n fixes cap\\<^sub>1 cap\\<^sub>2 :: Capability\n shows \"cap\\<^sub>1 \\ cap\\<^sub>2 = less_eq_Capability cap\\<^sub>1 cap\\<^sub>2\"\nunfolding less_eq_Capability_ext_def\nby simp *)\n\nsubsubsection \\@{const nullCap}}\\\n\nlemma noTag_le [elim!]:\n assumes \"\\ getTag cap\"\n shows \"cap \\ cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def \nby simp\n\nlemma nullCap_le [simp]:\n shows \"nullCap \\ cap'\"\nby (intro noTag_le) simp\n\nlemma bitsToCap_le [simp]:\n shows \"bitsToCap x \\ cap\"\nby (intro noTag_le) simp\n\nlemma setOffset_nullCap_le [simp]:\n shows \"setOffset (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma setBounds_nullCap_le [simp]:\n shows \"setBounds (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma setPerms_nullCap_le [simp]:\n shows \"setPerms (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma setUPerms_nullCap_le [simp]:\n shows \"setUPerms (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma setSealed_nullCap_le [simp]:\n shows \"setSealed (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma setType_nullCap_le [simp]:\n shows \"setType (nullCap, v) \\ cap\"\nby (intro noTag_le) simp\n\nlemma if_nullCap_le [simp]:\n shows \"(if b then nullCap else cap) \\ cap' =\n (if b then True else cap \\ cap')\"\n and \"(if b then cap else nullCap) \\ cap' =\n (if b then cap \\ cap' else True)\"\nby auto\n\nsubsubsection \\Setter introductions\\\n\nlemma setTag_le [intro!, simp]:\n shows \"setTag (cap, False) \\ cap'\"\nby (intro noTag_le) simp\n\nlemma setOffset_le:\n shows \"(setOffset (cap, v) \\ cap) =\n (\\ getTag cap \\ \\ getSealed cap \\ getOffset cap = v)\"\nproof (cases \"setOffset (cap, v) = cap\")\n case True\n from arg_cong[OF this, where f=getOffset]\n show ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nnext\n case False\n thus ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nqed\n\nlemma setBounds_le:\n shows \"(setBounds (cap, v) \\ cap) =\n (\\ getTag cap \\ \n (if getSealed cap then getOffset cap = 0 \\ getLength cap = v\n else Region (getBase cap + getOffset cap) v \\ \n Region (getBase cap) (getLength cap)))\"\nproof (cases \"setBounds (cap, v) = cap\")\n case True\n from arg_cong[OF this, where f=getBase]\n arg_cong[OF this, where f=getLength]\n show ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nnext\n case False\n thus ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nqed\n\nlemma setPerms_le:\n shows \"(setPerms (cap, p) \\ cap) =\n (\\ getTag cap \\ \n (if getSealed cap then getPerms cap = rec'Perms (reg'Perms p AND mask 15)\n else rec'Perms (reg'Perms p AND mask 15) \\ getPerms cap))\"\nproof (cases \"setPerms (cap, p) = cap\")\n case True\n from arg_cong[OF this, where f=getPerms]\n show ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nnext\n case False\n thus ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nqed\n\nlemma setUPerms_le:\n shows \"(setUPerms (cap, p) \\ cap) =\n (\\ getTag cap \\ \n (if getSealed cap then getUPerms cap = rec'UPerms (reg'UPerms p AND mask 16)\n else rec'UPerms (reg'UPerms p AND mask 16) \\ getUPerms cap))\"\nproof (cases \"setUPerms (cap, p) = cap\")\n case True\n from arg_cong[OF this, where f=getUPerms]\n show ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nnext\n case False\n thus ?thesis \n unfolding less_eq_Capability_ext_def less_eq_Capability_def \n by auto\nqed\n\nsubsubsection \\Eliminations\\\n\nlemma less_eq_CapabilityE_IsSealed:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n and \"getSealed cap\"\n shows \"cap = cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n \nlemma less_eq_CapabilityE_Region [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"RegionOfCap cap \\ RegionOfCap cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemma RegionGreaterCap [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n and \"a \\ RegionOfCap cap\"\n shows \"a \\ RegionOfCap cap'\"\nusing less_eq_CapabilityE_Region[OF assms(1, 2)] assms(3)\nby auto\n\nlemma less_eq_CapabilityE_getPerms [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"getPerms cap \\ getPerms cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemma less_eq_CapabilityE_getUPerms [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"getUPerms cap \\ getUPerms cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemma less_eq_CapabilityE_getTag [elim!]:\n assumes \"cap \\ cap'\"\n shows \"getTag cap \\ getTag cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemma TagOfGreaterCap [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"getTag cap'\"\nusing less_eq_CapabilityE_getTag[OF assms(1)] assms(2)\nby auto\n\nlemma less_eq_CapabilityE_getType [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"getType cap = getType cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemmas less_eq_CapabilityE_getType_sym [elim] = \n less_eq_CapabilityE_getType[THEN sym]\n\nlemma less_eq_CapabilityE_getSealed [elim]:\n assumes \"cap \\ cap'\"\n and \"getTag cap\"\n shows \"getSealed cap = getSealed cap'\"\nusing assms\nunfolding less_eq_Capability_ext_def less_eq_Capability_def\nby auto\n\nlemmas less_eq_CapabilityE_getSealed_sym [elim] = \n less_eq_CapabilityE_getSealed[THEN sym]\n\nsection \\Capability locations\\\n\ntext \\In this section we introduce a uniform way to access capabilities from different parts of the\nstate.\\\n\nsubsection \\\\getBranchDelayPccCap\\\\\n\ndefinition getBranchDelayPccCap :: \"state \\ Capability\" where\n \"getBranchDelayPccCap s \\\n (case BranchDelayPCC s of \n None \\ nullCap\n | Some (_, cap) \\ cap)\"\n\nlemma Commute_getBranchDelayPccCap [Commute_compositeI]:\n assumes \"Commute (read_state BranchDelayPCC) m\"\n shows \"Commute (read_state getBranchDelayPccCap) m\"\nunfolding getBranchDelayPccCap_def\nusing assms\nby auto\n\nlemma getBranchDelayPccCap_simps [simp]:\n shows \"getBranchDelayPccCap (BranchToPCC_update x_BranchToPCC s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (the_MEM_update x_the_MEM s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setPCC x_PCC s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setCAPR x_CAPR s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setSCAPR x_SCAPR s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setMEM x_MEM s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setBranchTo x_BranchTo s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setBranchDelay x_BranchDelay s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (exception_update x_exception s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (setExceptionSignalled x_ExceptionSignalled s) = getBranchDelayPccCap s\"\n and \"getBranchDelayPccCap (c_state_update x_c_state s) = getBranchDelayPccCap s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getBranchDelayPccCap_setBranchDelayPCC [simp]:\n shows \"getBranchDelayPccCap (s\\BranchDelayPCC := v\\) = \n (case v of None \\ nullCap \n | Some (addr, cap) \\ cap)\"\nunfolding getBranchDelayPccCap_def\nby simp\n\nlemma getBranchDelayPccCap_setSignalException [simp]:\n shows \"getBranchDelayPccCap (setSignalException v s) = nullCap\"\nunfolding getBranchDelayPccCap_def\nby simp\n\nsubsection \\\\getBranchToPccCap\\\\\n\ndefinition getBranchToPccCap :: \"state \\ Capability\" where\n \"getBranchToPccCap s \\\n (case BranchToPCC s of \n None \\ nullCap\n | Some (_, cap) \\ cap)\"\n\nlemma Commute_getBranchToPccCap [Commute_compositeI]:\n assumes \"Commute (read_state BranchToPCC) m\"\n shows \"Commute (read_state getBranchToPccCap) m\"\nunfolding getBranchToPccCap_def\nusing assms\nby auto\n\nlemma getBranchToPccCap_simps [simp]:\n shows \"getBranchToPccCap (BranchDelayPCC_update x_BranchDelayPCC s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (the_MEM_update x_the_MEM s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setPCC x_PCC s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setCAPR x_CAPR s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setSCAPR x_SCAPR s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setMEM x_MEM s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setBranchTo x_BranchTo s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setBranchDelay x_BranchDelay s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (exception_update x_exception s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (setExceptionSignalled x_ExceptionSignalled s) = getBranchToPccCap s\"\n and \"getBranchToPccCap (c_state_update x_c_state s) = getBranchToPccCap s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getBranchToPccCap_setBranchToPCC [simp]:\n shows \"getBranchToPccCap (s\\BranchToPCC := v\\) =\n (case v of None \\ nullCap \n | Some (addr, cap) \\ cap)\"\nunfolding getBranchToPccCap_def\nby simp\n\nlemma getBranchToPccCap_setSignalException [simp]:\n shows \"getBranchToPccCap (setSignalException v s) = nullCap\"\nunfolding getBranchToPccCap_def\nby simp\n\nsubsection \\\\getMemCap\\\\\n\ndefinition getMemCap :: \"PhysicalCapAddress \\ state \\ Capability\" where\n \"getMemCap a s \\\n (case getMEM a s of Cap cap \\ cap | Raw x \\ bitsToCap x)\"\n\nlemma Commute_getMemCap [Commute_compositeI]:\n assumes \"Commute (read_state (getMEM a)) m\"\n shows \"Commute (read_state (getMemCap a)) m\"\nunfolding getMemCap_def\nusing assms\nby auto\n\nlemma getMemCap_simps [simp]:\n shows \"getMemCap a (BranchToPCC_update x_BranchToPCC s) = getMemCap a s\"\n and \"getMemCap a (BranchDelayPCC_update x_BranchDelayPCC s) = getMemCap a s\"\n and \"getMemCap a (setPCC x_PCC s) = getMemCap a s\"\n and \"getMemCap a (setCAPR x_CAPR s) = getMemCap a s\"\n and \"getMemCap a (setSCAPR x_SCAPR s) = getMemCap a s\"\n and \"getMemCap a (setBranchTo x_BranchTo s) = getMemCap a s\"\n and \"getMemCap a (setBranchDelay x_BranchDelay s) = getMemCap a s\"\n and \"getMemCap a (exception_update x_exception s) = getMemCap a s\"\n and \"getMemCap a (setExceptionSignalled x_ExceptionSignalled s) = getMemCap a s\"\n and \"getMemCap a (c_state_update x_c_state s) = getMemCap a s\"\n and \"getMemCap a (setStats_valid_cap_writes_updt x_Stats_valid s) = getMemCap a s\"\n and \"getMemCap a (setStats_invalid_cap_writes_updt x_Stats_invalid s) = getMemCap a s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getMemCap_setSignalException [simp]:\n shows \"getMemCap a (setSignalException v s) = getMemCap a s\"\nunfolding getMemCap_def\nby simp\n\nlemma getMemCap_setMem [simp]:\n shows \"getMemCap a (setMEM (val, a') s) = \n (if a' = a \n then (case val of Raw x \\ bitsToCap x | Cap cap \\ cap) \n else getMemCap a s)\"\nunfolding getMemCap_def\nby simp\n\nlemma getMemCap_theMEM_update [simp]:\n shows \"getMemCap a (s\\the_MEM := f\\) = \n (case f a of Raw x \\ bitsToCap x | Cap cap \\ cap)\"\nunfolding getMemCap_def\nby simp\n\nlemma getMemCap_setWriteCap [simp]:\n shows \"getMemCap a (setWriteCap (a', cap) s) = \n (if a' = a then cap else getMemCap a s)\"\nunfolding WriteCap_alt_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma getMemCap_getMEM [elim!]:\n assumes \"getMEM a s = getMEM a s'\"\n shows \"getMemCap a s = getMemCap a s'\"\nusing assms\nunfolding getMemCap_def\nby simp\n\nlemma getReadCap_simp [simp]:\n shows \"getReadCap a s = getMemCap a s\"\nunfolding ReadCap_alt_def getMemCap_def\nby (simp add: ValueAndStatePart_simp)\n\nsubsection \\Capability registers\\\n\ndatatype CapRegister = \n RegPCC\n | RegBranchDelayPCC\n | RegBranchToPCC\n | RegGeneral RegisterAddress\n | RegSpecial RegisterAddress\n\nlemmas Commute_CapRegisterI [Commute_compositeI] =\n CapRegister.splits(1)[where P=\"\\x. Commute x n\", THEN iffD2] for n\n\nlemmas ValuePart_CapRegister [ValueAndStatePart_simp] =\n CapRegister.case_distrib[where h=\"\\x. ValuePart x _\"]\n\nlemmas StatePart_CapRegister [ValueAndStatePart_simp] =\n CapRegister.case_distrib[where h=\"\\x. StatePart x _\"]\n\nfun IsGeneralRegister where\n \"IsGeneralRegister (RegGeneral cd) = True\" |\n \"IsGeneralRegister x = False\"\n\nfun IsSpecialRegister where\n \"IsSpecialRegister (RegSpecial cd) = True\" |\n \"IsSpecialRegister x = False\"\n\ndefinition getCapReg :: \"CapRegister \\ state \\ Capability\" where\n \"getCapReg \\ \n (\\loc s. case loc of \n RegPCC \\ getPCC s \n | RegBranchDelayPCC \\ getBranchDelayPccCap s\n | RegBranchToPCC \\ getBranchToPccCap s\n | RegGeneral cd \\ getCAPR cd s\n | RegSpecial cd \\ getSCAPR cd s)\"\n\nlemma getCapReg_loc_simps [simp]:\n shows \"getCapReg RegPCC = getPCC\"\n and \"getCapReg RegBranchDelayPCC = getBranchDelayPccCap\"\n and \"getCapReg RegBranchToPCC = getBranchToPccCap\"\n and \"getCapReg (RegGeneral cd) = getCAPR cd\"\n and \"getCapReg (RegSpecial cd) = getSCAPR cd\"\nunfolding getCapReg_def\nby simp_all\n\nlemma Commute_getCapReg [Commute_compositeI]:\n assumes \"Commute (read_state getPCC) m\"\n and \"Commute (read_state getBranchDelayPccCap) m\"\n and \"Commute (read_state getBranchToPccCap) m\"\n and \"\\cd. Commute (read_state (getCAPR cd)) m\"\n and \"\\cd. Commute (read_state (getSCAPR cd)) m\"\n shows \"Commute (read_state (getCapReg loc)) m\"\nusing assms\nby (cases loc) simp_all\n\nlemma getCapReg_simps [simp]:\n shows \"getCapReg loc (setBranchTo x_BranchTo s) = getCapReg loc s\"\n and \"getCapReg loc (setBranchDelay x_BranchDelay s) = getCapReg loc s\"\n and \"getCapReg loc (exception_update x_exception s) = getCapReg loc s\"\n and \"getCapReg loc (setExceptionSignalled x_ExceptionSignalled s) = getCapReg loc s\"\n and \"getCapReg loc (c_state_update x_c_state s) = getCapReg loc s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getCapReg_setPCC_simp [simp]:\n shows \"getCapReg loc (setPCC cap s) = \n (if loc = RegPCC then cap else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setBranchDelayPCC_None_simp [simp]:\n shows \"getCapReg loc (s\\BranchDelayPCC := None\\) = \n (if loc = RegBranchDelayPCC then nullCap else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setBranchDelayPCC_Some_simp [simp]:\n shows \"getCapReg loc (s\\BranchDelayPCC := Some v\\) = \n (if loc = RegBranchDelayPCC then snd v else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setBranchToPCC_None_simp [simp]:\n shows \"getCapReg loc (s\\BranchToPCC := None\\) = \n (if loc = RegBranchToPCC then nullCap else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setBranchToPCC_Some_simp [simp]:\n shows \"getCapReg loc (s\\BranchToPCC := Some v\\) = \n (if loc = RegBranchToPCC then snd v else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setCAPR_simp [simp]:\n shows \"getCapReg loc (setCAPR v s) = \n (if loc = RegGeneral (snd v) \\ snd v \\ 0 then fst v else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setSCAPR_simp [simp]:\n shows \"getCapReg loc (setSCAPR v s) = \n (if loc = RegSpecial (snd v) then fst v else getCapReg loc s)\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setMEM_Raw_simp [simp]:\n shows \"getCapReg loc (setMEM (Raw x, a) s) = getCapReg loc s\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_setMEM_Cap_simp [simp]:\n shows \"getCapReg loc (setMEM (Cap cap, a) s) = getCapReg loc s\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nlemma getCapReg_theMEM_update_simp [simp]:\n shows \"getCapReg loc (s\\the_MEM := f\\) = getCapReg loc s\"\nunfolding getCapReg_def\nby (cases loc) simp_all\n\nsubsection \\Capability locations\\\n \ndatatype CapLocation = \n LocReg CapRegister\n | LocMem PhysicalCapAddress\n\nlemmas Commute_CapLocationI [Commute_compositeI] =\n CapLocation.splits(1)[where P=\"\\x. Commute x n\", THEN iffD2] for n\n\nlemmas ValuePart_CapLocation [ValueAndStatePart_simp] =\n CapLocation.case_distrib[where h=\"\\x. ValuePart x _\"]\n\nlemmas StatePart_CapLocation [ValueAndStatePart_simp] =\n CapLocation.case_distrib[where h=\"\\x. StatePart x _\"]\n \ndefinition getCap :: \"CapLocation \\ state \\ Capability\" where\n \"getCap \\ \n (\\loc s. case loc of \n LocReg r \\ getCapReg r s\n | LocMem addr \\ getMemCap addr s)\"\n\nlemma getCap_loc_simps [simp]:\n shows \"getCap (LocReg r) = getCapReg r\"\n and \"getCap (LocMem a) = getMemCap a\"\nunfolding getCap_def\nby simp_all\n\nlemma Commute_getCap [Commute_compositeI]:\n assumes \"\\r. Commute (read_state (getCapReg r)) m\"\n and \"\\a. Commute (read_state (getMemCap a)) m\"\n shows \"Commute (read_state (getCap loc)) m\"\nusing assms\nby (cases loc) simp_all\n\nlemma getCap_simps [simp]:\n shows \"getCap loc (setBranchTo x_BranchTo s) = getCap loc s\"\n and \"getCap loc (setBranchDelay x_BranchDelay s) = getCap loc s\"\n and \"getCap loc (exception_update x_exception s) = getCap loc s\"\n and \"getCap loc (setExceptionSignalled x_ExceptionSignalled s) = getCap loc s\"\n and \"getCap loc (c_state_update x_c_state s) = getCap loc s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getCap_setPCC_simp [simp]:\n shows \"getCap loc (setPCC cap s) = \n (if loc = LocReg RegPCC then cap else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setBranchDelayPCC_None_simp [simp]:\n shows \"getCap loc (s\\BranchDelayPCC := None\\) = \n (if loc = LocReg RegBranchDelayPCC then nullCap else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setBranchDelayPCC_Some_simp [simp]:\n shows \"getCap loc (s\\BranchDelayPCC := Some v\\) = \n (if loc = LocReg RegBranchDelayPCC then snd v else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setBranchToPCC_None_simp [simp]:\n shows \"getCap loc (s\\BranchToPCC := None\\) = \n (if loc = LocReg RegBranchToPCC then nullCap else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setBranchToPCC_Some_simp [simp]:\n shows \"getCap loc (s\\BranchToPCC := Some v\\) = \n (if loc = LocReg RegBranchToPCC then snd v else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setCAPR_simp [simp]:\n shows \"getCap loc (setCAPR v s) = \n (if loc = LocReg (RegGeneral (snd v)) \\ snd v \\ 0 then fst v else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setMEM_Raw_simp [simp]:\n shows \"getCap loc (setMEM (Raw x, a) s) = \n (if loc = LocMem a then bitsToCap x else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_setMEM_Cap_simp [simp]:\n shows \"getCap loc (setMEM (Cap cap, a) s) = \n (if loc = LocMem a then cap else getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nlemma getCap_theMEM_update_simp [simp]:\n shows \"getCap loc (s\\the_MEM := f\\) = \n (case loc of LocMem a \\ (case f a of Raw x \\ bitsToCap x \n | Cap cap \\ cap)\n | _ \\ getCap loc s)\"\nunfolding getCap_def\nby (cases loc) simp_all\n\nsubsection \\Accessibility\\\n\ndefinition RegisterIsAccessible where\n \"RegisterIsAccessible r \\\n case r of RegSpecial cd \\ special_register_accessible cd\n | _ \\ return True\"\n\nabbreviation \"getRegisterIsAccessible r \\ ValuePart (RegisterIsAccessible r)\"\n\nlemma RegisterIsAccessible_simps [simp]:\n shows \"RegisterIsAccessible RegPCC = return True\"\n and \"RegisterIsAccessible RegBranchDelayPCC = return True\"\n and \"RegisterIsAccessible RegBranchToPCC = return True\"\n and \"RegisterIsAccessible (RegGeneral cd) = return True\"\n and \"RegisterIsAccessible (RegSpecial cd) = special_register_accessible cd\"\nunfolding RegisterIsAccessible_def\nby simp_all\n\nlemma RegisterIsAccessible_StatePart [simp]:\n shows \"StatePart (RegisterIsAccessible r) s = s\"\nunfolding RegisterIsAccessible_def\nby (cases r) (auto simp: ValueAndStatePart_simp)\n\nlemma Commute_RegisterIsAccessible [Commute_compositeI]:\n assumes \"\\cd. Commute (special_register_accessible cd) m\"\n shows \"Commute (RegisterIsAccessible r) m\"\nunfolding RegisterIsAccessible_def\nby (Commute intro: assms)\n\nsection \\Memory accessors\\\n\nsubsection \\\\getMemByte\\\\\n\ndefinition getMemByte :: \"PhysicalAddress \\ state \\ 8 word\" where\n \"getMemByte a s \\\n let upper = slice (log2 CAPBYTEWIDTH) a in\n let lower = a AND mask (log2 CAPBYTEWIDTH) in\n let big_endian = lower XOR mask 3 in \n extract_byte (unat big_endian) \n (case getMEM upper s of Cap cap \\ capToBits cap \n | Raw x \\ x)\"\n\nlemma Commute_getMemByte [Commute_compositeI]:\n assumes \"Commute (read_state (getMEM (slice (log2 CAPBYTEWIDTH) a))) m\"\n shows \"Commute (read_state (getMemByte a)) m\"\nunfolding getMemByte_def\nusing assms\nby auto\n\nlemma getMemByte_simps [simp]:\n shows \"getMemByte a (BranchToPCC_update x_BranchToPCC s) = getMemByte a s\"\n and \"getMemByte a (BranchDelayPCC_update x_BranchDelayPCC s) = getMemByte a s\"\n and \"getMemByte a (setPCC x_PCC s) = getMemByte a s\"\n and \"getMemByte a (setCAPR x_CAPR s) = getMemByte a s\"\n and \"getMemByte a (setSCAPR x_SCAPR s) = getMemByte a s\"\n and \"getMemByte a (setBranchTo x_BranchTo s) = getMemByte a s\"\n and \"getMemByte a (setBranchDelay x_BranchDelay s) = getMemByte a s\"\n and \"getMemByte a (exception_update x_exception s) = getMemByte a s\"\n and \"getMemByte a (setExceptionSignalled x_ExceptionSignalled s) = getMemByte a s\"\n and \"getMemByte a (c_state_update x_c_state s) = getMemByte a s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getMemByte_setSignalException [simp]:\n shows \"getMemByte a (setSignalException v s) = getMemByte a s\"\nunfolding getMemByte_def\nby simp\n\nlemma getMemByte_getMEM:\n assumes \"getMEM (slice (log2 CAPBYTEWIDTH) a) s = getMEM (slice (log2 CAPBYTEWIDTH) a) s'\"\n shows \"getMemByte a s = getMemByte a s'\"\nusing assms\nunfolding getMemByte_def\nby simp\n\nlemma getMemByte_getMemCap:\n shows \"getMemByte a s =\n (let upper = slice (log2 CAPBYTEWIDTH) a in\n let lower = a AND mask (log2 CAPBYTEWIDTH) in\n let big_endian = lower XOR mask 3 in \n extract_byte (unat big_endian) (capToBits (getMemCap upper s)))\"\nunfolding getMemByte_def getMemCap_def\nunfolding DataType.case_distrib[where h=capToBits]\nby strong_cong_simp\n\nsubsection \\\\getMemTag\\\\\n\ndefinition getMemTag :: \"PhysicalCapAddress \\ state \\ bool\" where\n \"getMemTag a s \\ getTag (getMemCap a s)\"\n\nlemma Commute_getMemTag [Commute_compositeI]:\n assumes \"Commute (read_state (getMemCap a)) m\"\n shows \"Commute (read_state (getMemTag a)) m\"\nunfolding getMemTag_def\nusing assms\nby auto\n\nlemma getMemTag_simps [simp]:\n shows \"getMemTag a (BranchToPCC_update x_BranchToPCC s) = getMemTag a s\"\n and \"getMemTag a (BranchDelayPCC_update x_BranchDelayPCC s) = getMemTag a s\"\n and \"getMemTag a (setPCC x_PCC s) = getMemTag a s\"\n and \"getMemTag a (setCAPR x_CAPR s) = getMemTag a s\"\n and \"getMemTag a (setSCAPR x_SCAPR s) = getMemTag a s\"\n and \"getMemTag a (setBranchTo x_BranchTo s) = getMemTag a s\"\n and \"getMemTag a (setBranchDelay x_BranchDelay s) = getMemTag a s\"\n and \"getMemTag a (exception_update x_exception s) = getMemTag a s\"\n and \"getMemTag a (setExceptionSignalled x_ExceptionSignalled s) = getMemTag a s\"\n and \"getMemTag a (c_state_update x_c_state s) = getMemTag a s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getMemTag_setSignalException [simp]:\n shows \"getMemTag a (setSignalException v s) = getMemTag a s\"\nunfolding getMemTag_def\nby simp\n\nlemma getMemTag_getMEM [elim!]:\n assumes \"getMEM a s = getMEM a s'\"\n shows \"getMemTag a s = getMemTag a s'\"\nusing getMemCap_getMEM[OF assms]\nunfolding getMemTag_def\nby simp\n\nsection \\Unpredictable behaviour\\\n\ntext \\The L3 model sets a flag in the state when unpredictable behaviour occurs, but it does not\ndefine the semantics of unpredictable behaviour. We define the semantics in this theory, based\non the specification in the CHERI ISA.\\\n\nsubsection \\\\Unpredictable\\ flag\\\n\ndefinition isUnpredictable where\n \"isUnpredictable \\ \\s. exception s \\ NoException\"\n\nlemma Commute_isUnpredictable [Commute_compositeI]:\n assumes \"Commute (read_state exception) m\"\n shows \"Commute (read_state isUnpredictable) m\"\nunfolding isUnpredictable_def\nusing assms\nby auto\n\nlemma isUnpredictable_simps [simp]:\n shows \"isUnpredictable (BranchToPCC_update x_BranchToPCC s) = isUnpredictable s\"\n and \"isUnpredictable (BranchDelayPCC_update x_BranchDelayPCC s) = isUnpredictable s\"\n and \"isUnpredictable (setPCC x_PCC s) = isUnpredictable s\"\n and \"isUnpredictable (setCAPR x_CAPR s) = isUnpredictable s\"\n and \"isUnpredictable (setSCAPR x_SCAPR s) = isUnpredictable s\"\n and \"isUnpredictable (setMEM x_MEM s) = isUnpredictable s\"\n and \"isUnpredictable (the_MEM_update x_the_MEM s) = isUnpredictable s\"\n and \"isUnpredictable (setBranchTo x_BranchTo s) = isUnpredictable s\"\n and \"isUnpredictable (setBranchDelay x_BranchDelay s) = isUnpredictable s\"\n and \"isUnpredictable (c_state_update x_c_state s) = isUnpredictable s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma isUnpredictable_raise'exception [simp]:\n shows \"isUnpredictable (StatePart (raise'exception (UNPREDICTABLE v)) s)\"\nunfolding isUnpredictable_def raise'exception_exception Let_def\nby simp\n\nlemma isUnpredictable_exception_update [simp]:\n shows \"isUnpredictable (s\\exception := v\\) = (v \\ NoException)\"\nunfolding isUnpredictable_def\nby simp\n\nlemma isUnpredictable_setExceptionSignalled [simp]:\n shows \"isUnpredictable (setExceptionSignalled v s) = isUnpredictable s\"\nunfolding isUnpredictable_def\nby simp\n\nsubsection \\@{term MakePartial}\\\n\ndefinition MakePartial :: \"(state \\ 'a \\ state) \\ state \\ 'a option \\ state\" where\n \"MakePartial m \\ \n bind m\n (\\v. bind (read_state getExceptionSignalled)\n (\\ex. bind (read_state isUnpredictable)\n (\\unpred. return (if ex \\ unpred then None else Some v))))\"\n\nlemma ValuePartMakePartial_from_HoareTriple:\n assumes \"\\x. HoareTriple (return x =\\<^sub>b read_state f)\n m\n (\\v. bind (read_state getExceptionSignalled)\n (\\ex. bind (read_state isUnpredictable)\n (\\unpred. return (x = (if ex \\ unpred then None else Some v)))))\"\n shows \"ValuePart (MakePartial m) = f\"\nproof \n fix s :: state\n show \"ValuePart (MakePartial m) s = f s\"\n using assms[where x=\"f s\", THEN HoareTripleE[where s=s]]\n unfolding MakePartial_def\n by (simp add: ValueAndStatePart_simp)\nqed\n\nlemma ValuePartMakePartial_defined:\n assumes not_ex: \"\\ getExceptionSignalled (StatePart m s)\"\n and not_unpred: \"\\ isUnpredictable (StatePart m s)\"\n shows \"ValuePart (MakePartial m) s = Some (ValuePart m s)\"\nusing not_ex not_unpred\nunfolding MakePartial_def \nunfolding monad_def Let_def ValuePart_def StatePart_def\nby strong_cong_simp\n\nsection \\Address translation\\\n\nlemma check_cca_isUnpredictable:\n shows \"isUnpredictable (StatePart (check_cca v) s) =\n (v = 0 \\ v = 1 \\ v = 7 \\ isUnpredictable s)\"\nunfolding check_cca_alt_def\nby simp\n\nlemma AddressTranslation_isUnpredictable:\n shows \"IsInvariant (read_state isUnpredictable) (AddressTranslation v)\"\nunfolding AddressTranslation_alt_def \nby (HoareTriple simp: check_cca_isUnpredictable)\n\nlemma AddressTranslation_getExceptionSignalled:\n shows \"IsInvariant (read_state getExceptionSignalled) (AddressTranslation v)\"\nunfolding AddressTranslation_alt_def\nby HoareTriple\n\nlemma DefinedAddressTranslation_read_only_aux:\n shows \"IsInvariant (read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n p)\n (AddressTranslation v)\"\nunfolding AddressTranslation_alt_def check_cca_alt_def\nby HoareTriple\n\nlemma DefinedAddressTranslation_read_only:\n assumes \"\\ getExceptionSignalled (StatePart (AddressTranslation v) s)\"\n and \"\\ isUnpredictable (StatePart (AddressTranslation v) s)\"\n shows \"StatePart (AddressTranslation v) s = s\"\nusing assms\nusing DefinedAddressTranslation_read_only_aux[\n where p=\"read_state (\\s'. s' = s)\" and v=v,\n THEN HoareTripleE[where s=s]]\nby (simp add: ValueAndStatePart_simp)\n\nsubsection \\@{term PartialAddressTranslation}\\\n\ndefinition AddressTranslationPartial where\n \"AddressTranslationPartial v \\ MakePartial (AddressTranslation v)\"\n\nabbreviation \"getAddressTranslationPartial v \\ ValuePart (AddressTranslationPartial v)\"\n\ntext \\The following should be a schematic goal where the entire right side of the equation is the\nschematic variable. But, for some reason, auto cannot figure out how to instantiate \\?x\\ if it tries\nto prove \\?x s = term\\ where \\term\\ contains occurrences of \\s\\. So for the moment we spell it out\nfor auto, and hope that we can remove this at some point.\\\n\nlemma getAddressTranslationPartial_alt_def:\n shows \"getAddressTranslationPartial a = \n (\\s. (case a of (x1, x2) \\ \n case getCheckSegment x1 s of (x1a, x2a) \\ \n if x2a \n then case x1a \n of None \\ (case getLookupTLB (slice 62 x1, slice 13 x1) s \n of [] \\ None\n | [x1a] \\ (case checkMask (TLBEntry.Mask (snd x1a)) \n of None \\ None\n | Some x \\ (case if x1 !! x \n then (S1 (snd x1a), L1 (snd x1a), PFN1 (snd x1a), C1 (snd x1a), D1 (snd x1a), V1 (snd x1a))\n else (S0 (snd x1a), L0 (snd x1a), PFN0 (snd x1a), C0 (snd x1a), D0 (snd x1a), V0 (snd x1a)) \n of (x1b, x1c, x1d, x1e, x1f, x2a) \\ \n if x2a \n then if \\ x1f \\ x2 = STORE then None\n else if x1e = 0 \\ x1e = 1 \\ x1e = 7 then None\n else if getExceptionSignalled s \\ isUnpredictable s then None\n else Some ((ucast x1d AND ucast (word_cat (65535::16 word) (NOT TLBEntry.Mask (snd x1a))::28 word) << 12) OR\n ucast x1 AND ucast (word_cat (TLBEntry.Mask (snd x1a)) (4095::12 word)::24 word),\n x1e, x1b, x1c)\n else None))\n | x1a # x1 # x \\ Map.empty x)\n | Some (x1, x2a) \\ if x2a = 0 \\ x2a = 1 \\ x2a = 7 then None \n else if getExceptionSignalled s \\ isUnpredictable s then None \n else Some (x1, x2a, False, False)\n else None))\"\nunfolding AddressTranslationPartial_def AddressTranslation_alt_def check_cca_alt_def\nby (intro ValuePartMakePartial_from_HoareTriple)\n (HoareTriple simp: all_distrib[where h=\"\\x. _ = x\", THEN sym])\n\nlemma Commute_getAddressTranslationPartial [Commute_compositeI]:\n assumes \"\\v. Commute (read_state (getCheckSegment v)) m\"\n and \"\\v. Commute (read_state (getLookupTLB v)) m\"\n and \"\\v. Commute (read_state getExceptionSignalled) m\"\n and \"\\v. Commute (read_state isUnpredictable) m\"\n shows \"Commute (read_state (getAddressTranslationPartial a)) m\"\nusing assms\nunfolding getAddressTranslationPartial_alt_def Commute_def\nby (strong_cong_simp add: ValueAndStatePart_simp)\n\nlemma getAddressTranslationPartial_defined:\n assumes \"\\ getExceptionSignalled (StatePart (AddressTranslation v) s)\"\n and \"\\ isUnpredictable (StatePart (AddressTranslation v) s)\"\n shows \"getAddressTranslationPartial v s = Some (ValuePart (AddressTranslation v) s)\"\nunfolding AddressTranslationPartial_def\nusing ValuePartMakePartial_defined assms\nby metis\n\nsubsection \\@{term TranslateAddr}\\\n\ndefinition TranslateAddr :: \n \"VirtualAddress \\ AccessType \\ state \\ PhysicalAddress option \\ state\" where\n \"TranslateAddr v \\ \n bind (read_state (getAddressTranslationPartial v))\n (\\x. return (case x of None \\ None | Some y \\ Some (fst y)))\"\n\nabbreviation \"getTranslateAddr v \\ ValuePart (TranslateAddr v)\"\n\nlemma TranslateAddr_read_only [simp]:\n shows \"StatePart (TranslateAddr v) = (\\s. s)\"\nunfolding TranslateAddr_def\nby (simp add: ValueAndStatePart_simp) \n\nlemma Commute_TranslateAddr [Commute_compositeI]:\n assumes \"\\v. Commute (read_state (getAddressTranslationPartial v)) m\"\n shows \"Commute (TranslateAddr a) m\"\nusing assms\nunfolding TranslateAddr_def Commute_def\nby (strong_cong_simp add: ValueAndStatePart_simp)\n\nlemma getTranslateAddr_simps [simp]:\n shows \"getTranslateAddr v (BranchToPCC_update x_BranchToPCC s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (BranchDelayPCC_update x_BranchDelayPCC s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (the_MEM_update x_the_MEM s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setPCC x_PCC s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setCAPR x_CAPR s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setSCAPR x_SCAPR s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setMEM x_MEM s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setBranchTo x_BranchTo s) = getTranslateAddr v s\"\n and \"getTranslateAddr v (setBranchDelay x_BranchDelay s) = getTranslateAddr v s\"\nby (rule Commute_read_state_update_stateE, Commute)+\n\nlemma getTranslateAddr_defined:\n assumes \"\\ getExceptionSignalled (StatePart (AddressTranslation v) s)\"\n and \"\\ isUnpredictable (StatePart (AddressTranslation v) s)\"\n shows \"getTranslateAddr v s = Some (fst (ValuePart (AddressTranslation v) s))\"\nunfolding TranslateAddr_def\nusing getAddressTranslationPartial_defined[OF assms]\nby (simp add: ValueAndStatePart_simp)\n\ndefinition getTranslateAddrFunc :: \"state \\ VirtualAddress \\ AccessType \\ \n PhysicalAddress option\" where\n \"getTranslateAddrFunc s \\ \\v. getTranslateAddr v s\"\n\nlemma Commute_getTranslateAddrFunc [Commute_compositeI]: \n assumes \"\\a. Commute (read_state (getTranslateAddr a)) m\"\n shows \"Commute (read_state getTranslateAddrFunc) m\"\nusing assms\nunfolding getTranslateAddrFunc_def Commute_def\nby auto\n\nsubsection \\@{term getTranslateAddresses}\\\n\ndefinition getTranslateAddresses :: \"VirtualAddress set \\ AccessType \\ \n state \\ PhysicalAddress set\" where\n \"getTranslateAddresses vAddrs t s \\ \n {pAddr. \\vAddr \\ vAddrs. getTranslateAddr (vAddr, t) s = Some pAddr}\"\n\nlemma Commute_getTranslateAddresses [Commute_compositeI]: \n assumes \"\\a. Commute (read_state (getTranslateAddr (a, t))) m\"\n shows \"Commute (read_state (getTranslateAddresses addrs t)) m\"\nusing assms\nunfolding getTranslateAddresses_def Commute_def\nby auto\n\nlemma getTranslateAddressesI [intro?]:\n assumes \"getTranslateAddr (virtualAddress, t) s = Some a\"\n and \"virtualAddress \\ addrs\"\n shows \"a \\ getTranslateAddresses addrs t s\"\nusing assms\nunfolding getTranslateAddresses_def\nby auto\n\nlemma getTranslateAddressesE [elim]:\n assumes \"a \\ getTranslateAddresses addrs t s\"\n obtains virtualAddress \n where \"getTranslateAddr (virtualAddress, t) s = Some a\"\n and \"virtualAddress \\ addrs\" \nusing assms\nunfolding getTranslateAddresses_def\nby auto\n\nlemma getTranslateAddresses_le:\n assumes \"addrs \\ addrs'\"\n shows \"getTranslateAddresses addrs t s \\ getTranslateAddresses addrs' t s\"\nusing assms\nunfolding getTranslateAddresses_def\nby auto\n\nlemmas getTranslateAddresses_le_subsetD [elim] =\n subsetD[OF getTranslateAddresses_le]\n\nlemma getTranslateAddresses_distrib_union:\n shows \"getTranslateAddresses (addrs \\ addrs') t s =\n (getTranslateAddresses addrs t s \\ getTranslateAddresses addrs' t s)\"\nunfolding getTranslateAddresses_def\nby auto\n\nlemma getTranslateAddresses_distrib_Union:\n shows \"getTranslateAddresses (\\addrsSet) t s =\n (\\addrs\\addrsSet. getTranslateAddresses addrs t s)\"\nunfolding getTranslateAddresses_def\nby auto\n\nlemma getTranslateAddresses_eqI_getTranslateAddr:\n assumes \"\\a. getTranslateAddr a s' = getTranslateAddr a s\"\n shows \"getTranslateAddresses addrs t s' = getTranslateAddresses addrs t s\"\nusing assms\nunfolding getTranslateAddresses_def\nby simp\n\nsubsection \\@{const HoareTriple} of @{const AddressTranslation}\\\n\nlemma HoareTriple_AddressTranslation:\n defines \"h \\ read_state getExceptionSignalled \\\\<^sub>b read_state isUnpredictable\"\n assumes \"IsInvariant p (AddressTranslation v)\"\n shows \"HoareTriple (bind (read_state (getTranslateAddr v)) (case_option p q))\n (AddressTranslation v)\n (\\x. (\\\\<^sub>b h \\\\<^sub>b p) \\\\<^sub>b (h \\\\<^sub>b q (fst x)))\" \n (is \"HoareTriple ?pre _ ?post\")\nproof (intro HoareTripleI)\n fix s\n assume \"ValuePart ?pre s\"\n thus \"ValuePart (bind (AddressTranslation v) ?post) s\"\n using HoareTripleE[OF assms(2), where s=s]\n using DefinedAddressTranslation_read_only[where v=v and s=s]\n unfolding h_def \n unfolding TranslateAddr_def AddressTranslationPartial_def MakePartial_def\n by (auto simp: ValueAndStatePart_simp \n split: option.splits\n dest!: if_split[where P=\"\\x. x = _\", THEN iffD1])\nqed\n\nlemma HoareTriple_DefinedAddressTranslation:\n shows \"HoareTriple (read_state getExceptionSignalled \\\\<^sub>b \n read_state isUnpredictable \\\\<^sub>b \n bind (read_state (getTranslateAddr v))\n (\\a. case a of None \\ return True \n | Some x \\ p x))\n (AddressTranslation v)\n (\\x. read_state getExceptionSignalled \\\\<^sub>b \n read_state isUnpredictable \\\\<^sub>b \n p (fst x))\"\nby (rule HoareTripleIE[OF \n HoareTriple_weakest_pre_disj[OF \n HoareTriple_AddressTranslation[where v=v and p=\"return True\" and q=p]\n HoareTriple_weakest_pre_disj[OF \n AddressTranslation_isUnpredictable\n AddressTranslation_getExceptionSignalled]]])\n (auto simp: ValueAndStatePart_simp cong: cong)\n\nsubsection \\Lower and upper bits\\\n\nlemma CheckSegment_ucast12:\n assumes \"getCheckSegment addr s = (Some (addr', x), y)\"\n shows \"(ucast addr'::12 word) = ucast addr\"\nusing assms\nunfolding CheckSegment_alt_def \nby (auto simp: ValueAndStatePart_simp ucast_minus_down\n dest!: if_split[where P=\"\\x. x = _\", THEN iffD1])\n\nlemma CheckSegment_and_not_mask:\n shows \"getCheckSegment (vAddr AND NOT mask 12) s =\n (case getCheckSegment vAddr s \n of (None, b) \\ (None, b)\n | (Some (addr, x), b) \\ (Some (addr AND NOT mask 12, x), b))\"\nproof -\n have *: \"(word_cat (x::11 word) (0::29 word)::40 word) AND NOT mask 12 = \n word_cat (x::11 word) (0::29 word)\" for x\n by (intro word_eqI) (simp add: word_size nth_word_cat word_ops_nth_size)\n have [simp]: \"(1097901015040::40 word) AND NOT mask 12 = 1097901015040\"\n using *[where x=2045]\n unfolding word_cat_def bin_cat_def\n by simp\n have [simp]: \"(1097364144128::40 word) AND NOT mask 12 = 1097364144128\"\n using *[where x=2044]\n unfolding word_cat_def bin_cat_def\n by simp\n show ?thesis\n unfolding CheckSegment_alt_def\n using not_mask_eq_minus[where x=\"ucast vAddr::40 word\" and y=1097901015040 and n=12]\n using not_mask_eq_minus[where x=\"ucast vAddr::40 word\" and y=1097364144128 and n=12]\n by (strong_cong_simp add:\n ValueAndStatePart_simp\n slice_and slice_not \n ucast_and ucast_not\n all_distrib[where h=\"\\x. case x of (x, y) \\ _ x y\"]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=1099511627776]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=4611686018427387904]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=4611687117939015680]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=13835058055282163712]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=13835059152646307840]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=18446744072098938880]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=18446744072635809792]\n less_left_and_not_mask[where x=vAddr and 'b=12 and y=18446744073172680704]\n le_right_and_not_mask[where y=vAddr and 'b=12 and x=4611686018427387904]\n le_right_and_not_mask[where y=vAddr and 'b=12 and x=9223372036854775808]\n le_right_and_not_mask[where y=vAddr and 'b=12 and x=18446744071562067968]\n le_right_and_not_mask[where y=vAddr and 'b=12 and x=18446744072635809792])\nqed\n\ntext \\The lower 12 bits of the translated address equal the lower 12 of the original address.\\\n\nlemma getTranslateAddr_ucast12:\n assumes \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n shows \"(ucast pAddr::12 word) = ucast vAddr\"\nproof -\n have [simp]: \"(4095::12 word) = mask 12\"\n unfolding mask_def by simp\n have \"Some pAddr = getTranslateAddr (vAddr, accessType) s \\\n (ucast pAddr::12 word) = ucast vAddr\"\n unfolding TranslateAddr_def getAddressTranslationPartial_alt_def\n by (strong_cong_simp\n add: ValueAndStatePart_simp\n ucast_or ucast_and ucast_shiftr ucast_shiftl\n all_distrib[where h=\"\\x. Some _ = x \\ _\"]\n all_distrib[where h=\"\\x. case x of None \\ True | Some y \\ _ y\"])\n (auto intro: CheckSegment_ucast12)\n thus ?thesis\n using assms by simp\nqed \n\ncorollary getTranslateAddr_vAddr_and_mask_12:\n assumes \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n shows \"vAddr AND mask 12 = ucast pAddr AND mask 12\"\nproof (intro word_eqI impI, unfold word_size)\n fix n\n assume \"n < LENGTH(64)\"\n thus \"(vAddr AND mask 12) !! n = ((ucast pAddr::64 word) AND mask 12) !! n\"\n using test_bit_cong[where x=n, OF getTranslateAddr_ucast12[OF assms]]\n by (auto simp: nth_ucast word_ao_nth word_size)\nqed\n\ncorollary getTranslateAddr_pAddr_and_mask_12:\n assumes \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n shows \"pAddr AND mask 12 = ucast vAddr AND mask 12\"\nproof (intro word_eqI impI, unfold word_size)\n fix n\n assume \"n < LENGTH(40)\"\n thus \"(pAddr AND mask 12) !! n = ((ucast vAddr::40 word) AND mask 12) !! n\"\n using test_bit_cong[where x=n, OF getTranslateAddr_ucast12[OF assms]]\n by (auto simp: nth_ucast word_ao_nth word_size)\nqed\n\ntext \\The translation of the start of the page that contains an address vAddr, is given\nby clearing the lowest 12 bits of the translation of vAddr.\\\n\nlemma getTranslateAddr_and_not_mask:\n shows \"getTranslateAddr (vAddr AND NOT mask 12, accessType) s = \n (case getTranslateAddr (vAddr, accessType) s \n of None \\ None\n | Some pAddr \\ Some (pAddr AND NOT mask 12))\"\nproof -\n have [simp]: \"(case checkMask x of None \\ f\n | Some i \\ if (w AND NOT mask 12) !! i then g else h) =\n (case checkMask x of None \\ f\n | Some i \\ if w !! i then g else h)\"\n for x and f g h :: 'a and w :: \"'b::len word\"\n proof (cases \"checkMask x\")\n case (Some i)\n hence \"12 \\ i\"\n unfolding checkMask_def\n by (auto split: if_splits)\n hence \"(w AND NOT mask 12) !! i = w !! i\"\n using test_bit_size[where w=w and n=i]\n by (auto simp: word_ops_nth_size word_ao_nth word_size)\n thus ?thesis \n using Some\n by simp\n qed simp\n have [simp]: \"(x AND NOT mask 12) AND y = (x AND y) AND NOT mask 12\" for x y :: \"'b::len word\"\n by (metis bitwise_semilattice_inf.inf_assoc word_bool_alg.conj.commute)\n show ?thesis\n unfolding TranslateAddr_def getAddressTranslationPartial_alt_def\n by (strong_cong_simp add: \n ValueAndStatePart_simp\n slice_and slice_not \n ucast_and ucast_not \n CheckSegment_and_not_mask[where vAddr=vAddr and s=s]\n all_distrib[where h=\"\\x. case x of (x, y) \\ _ x y\"]\n all_distrib[where h=\"\\x. case x of None \\ _ | Some y \\ _ y\"]\n word_bool_alg.conj_disj_distrib2[where x=\"NOT mask 12\"]\n word_bool_alg.conj_assoc[where x=\"NOT mask 12\"])\n (auto split: option.splits prod.splits)\nqed\n\ncorollary getTranslateAddr_same_page:\n assumes \"vAddr AND NOT mask 12 = vAddr' AND NOT mask 12\"\n shows \"(case getTranslateAddr (vAddr, accessType) s \n of None \\ None\n | Some pAddr \\ Some (pAddr AND NOT mask 12)) =\n (case getTranslateAddr (vAddr', accessType) s \n of None \\ None\n | Some pAddr \\ Some (pAddr AND NOT mask 12))\"\nusing getTranslateAddr_and_not_mask[where vAddr=vAddr]\nusing getTranslateAddr_and_not_mask[where vAddr=vAddr']\nusing assms\nby auto\n\ncorollary getTranslateAddr_same_page_None:\n assumes \"vAddr AND NOT mask 12 = vAddr' AND NOT mask 12\"\n and \"getTranslateAddr (vAddr, accessType) s = None\"\n shows \"getTranslateAddr (vAddr', accessType) s = None\"\nusing getTranslateAddr_same_page[where accessType=accessType and s=s, OF assms(1)]\nusing assms(2)\nby (auto split: option.splits)\n\ncorollary getTranslateAddr_same_page_Some:\n assumes \"vAddr AND NOT mask 12 = vAddr' AND NOT mask 12\"\n and \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n and \"getTranslateAddr (vAddr', accessType) s = Some pAddr'\"\n shows \"pAddr AND NOT mask 12 = pAddr' AND NOT mask 12\"\nusing getTranslateAddr_same_page[where accessType=accessType and s=s, OF assms(1)]\nusing assms(2, 3)\nby (auto split: option.splits)\n\nlemma getTranslateAddr_split:\n shows \"getTranslateAddr (vAddr, accessType) s = \n (case getTranslateAddr (vAddr AND NOT mask 12, accessType) s \n of None \\ None\n | Some pAddr \\ Some (pAddr OR (ucast vAddr AND mask 12)))\"\nproof (cases \"getTranslateAddr (vAddr, accessType) s\")\n case None\n thus ?thesis \n unfolding getTranslateAddr_and_not_mask\n by (auto split: option.splits)\nnext\n case (Some pAddr)\n have \"ucast vAddr AND mask 12 = pAddr AND mask 12\"\n using getTranslateAddr_ucast12[OF Some, THEN test_bit_cong]\n by (intro word_eqI) (auto simp: word_size word_ao_nth nth_ucast)\n thus ?thesis\n using Some\n unfolding getTranslateAddr_and_not_mask\n by (auto split: option.splits)\nqed\n\nsubsection \\Translate nearby addresses\\\n\nlemma TranslateNearbyAddress:\n fixes vAddr :: VirtualAddress\n fixes pAddr' :: PhysicalAddress\n fixes accessLength :: \"65 word\"\n assumes v_upper: \"ucast vAddr + accessLength \\ ucast (getBase cap) + ucast (getLength cap)\"\n and v_lower: \"getBase cap \\ vAddr\"\n and length: \"1 \\ accessLength\" \"accessLength \\ 32\"\n and alignment: \"unat vAddr mod 32 + unat accessLength \\ 32\"\n and pAddr: \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n and pAddr': \"pAddr' \\ Region pAddr (ucast accessLength)\"\n obtains vAddr' where\n \"getTranslateAddr (vAddr', accessType) s = Some pAddr'\" and\n \"vAddr' \\ RegionOfCap cap\"\nproof -\n\n -- \\We rewrite @{term accessLength} to a smaller length word.\\\n define accessLength' :: \"5 word\" where \"accessLength' = ucast (accessLength - 1)\"\n have accessLength_alt: \"accessLength = ucast accessLength' + 1\"\n using less_mask_eq[where x=\"accessLength - 1\" and n=5] length\n using uint_minus_simple_alt[where x=accessLength and y=1]\n unfolding accessLength'_def\n unfolding word_less_def word_le_def \n by auto\n\n -- \\We prove that adding @{term accessLength'} to @{term pAddr} does not cross an alignment \n boundary.\\\n have \"uint pAddr mod 32 + uint accessLength' < 32\"\n proof -\n have \"unat pAddr mod 32 + unat accessLength' < 32\"\n using alignment\n using arg_cong[where f=\"\\x. unat (ucast x::5 word)\", \n OF getTranslateAddr_ucast12[OF pAddr]]\n unfolding accessLength_alt\n by (simp add: unat_and_mask)\n from transfer_int_nat_relations(2)[THEN iffD2, OF this]\n show ?thesis \n unfolding uint_nat\n by (simp add: zmod_int)\n qed\n\n -- \\Therefore \\pAddr + accessLength'\\ does not wrap.\\\n have pAddr_no_wrap: \"uint pAddr + uint accessLength' < 2 ^ LENGTH(40)\"\n proof -\n have \"uint pAddr div 32 \\ 34359738367\"\n using word_and_mask_and_not_mask_size[where n=5 and m=40 and x=pAddr, simplified]\n unfolding word_le_def\n by (auto simp: uint_and_not_mask)\n from this[THEN mult_left_mono[where c=32], THEN add_left_mono[where c=\"uint pAddr mod 32\"]]\n have \"uint pAddr \\ 2 ^ 40 - 32 + uint pAddr mod 32\"\n by simp\n thus ?thesis\n using `uint pAddr mod 32 + uint accessLength' < 32`\n unfolding word_le_def\n by auto\n qed\n\n -- \\We rewrite @{term pAddr'} as @{term pAddr} plus a delta.\\\n define pDelta where \"pDelta \\ pAddr' - pAddr\"\n have pAddr'_alt: \"pAddr' = pAddr + pDelta\"\n unfolding pDelta_def by simp\n\n -- \\We prove an upper bound of @{term pDelta}.\\\n have pDelta_upper: \"pDelta \\ ucast accessLength'\"\n proof -\n have \"pDelta < ucast accessLength' + 1\"\n using Region_memberE[OF pAddr'] pAddr_no_wrap\n unfolding pDelta_def accessLength_alt\n by (simp add: uint_and_mask)\n thus ?thesis\n using inc_le leD le_less_linear \n by blast\n qed\n\n -- \\Therefore bits 12...39 of @{term pDelta} are zero.\\\n have pDelta_upper [simp]: \"pDelta AND NOT mask 12 = 0\" and\n pDelta_lower [simp]: \"pDelta AND mask 12 = pDelta\"\n proof -\n have \"pDelta \\ mask 5\"\n using uint_lt[where w=accessLength'] pDelta_upper\n unfolding word_le_def\n unfolding mask_def\n by auto\n from le_and_not_mask[where n=12, OF this]\n show \"pDelta AND NOT mask 12 = 0\" by simp\n thus \"pDelta AND mask 12 = pDelta\"\n unfolding word_minus_word_and_not_mask[THEN sym]\n by (simp del: word_minus_word_and_not_mask)\n qed\n\n -- \\We prove that adding @{term pDelta} to @{term pAddr} does not cross an alignment \n boundary.\\\n have \"uint pAddr mod 32 + uint pDelta < 32\"\n using `pDelta \\ ucast accessLength'` \n using `uint pAddr mod 32 + uint accessLength' < 32`\n unfolding word_le_def\n by simp\n\n -- \\Therefore, adding their lowest 12 bits does not overflow.\\\n have pAddr_plus_pDelta_mask12: \"(pAddr AND mask 12) + (pDelta AND mask 12) \\ mask 12\"\n proof -\n have [simp]: \"(4064::40 word) AND mask 12 = 4064\"\n unfolding mask_def by simp\n have [simp]: \"pAddr AND mask 5 \\ (pAddr AND mask 5) + 4064\"\n using plus_word_and_mask_no_wrap[where x=\"pAddr AND mask 5\" and y=4064 and n=12]\n by simp\n have [simp]: \"uint ((pAddr AND mask 5) + 4064) = uint pAddr mod 32 + 4064\"\n by (simp add: uint_plus_simple uint_and_mask)\n have \"(pAddr AND mask 12) = \n ((pAddr AND mask 12) AND NOT mask 5) + ((pAddr AND mask 12) AND mask 5)\"\n by (simp del: word_and_mask_and_mask)\n also have \"... \\ (pAddr AND mask 5) + 4064\"\n using word_plus_mono_right[where x=\"pAddr AND mask 5\",\n OF word_and_mask_and_not_mask_size[where n=5 and m=12 and x=pAddr, simplified]]\n by (auto simp: add.commute[where a=\"(pAddr AND mask 12) AND NOT mask 5\" \n and b=\"pAddr AND mask 5\"])\n finally have \"uint (pAddr AND mask 12) + uint (pDelta AND mask 12) < 2 ^ 12\"\n unfolding word_le_def\n using `uint pAddr mod 32 + uint pDelta < 32` add_left_mono\n by (auto simp add: uint_and_mask)\n thus ?thesis\n unfolding word_le_def\n by (simp del: pDelta_lower add: uint_mask)\n qed\n\n -- \\We prove equalities of the lower and upper bits of @{term pAddr'}.\\\n have pAddr'_not_mask: \"pAddr' AND NOT mask 12 = pAddr AND NOT mask 12\"\n unfolding pAddr'_alt word_plus_and_not_mask[OF pAddr_plus_pDelta_mask12]\n by simp\n have pAddr'_mask: \"pAddr' AND mask 12 = (pAddr AND mask 12) + pDelta\"\n unfolding pAddr'_alt word_plus_and_mask[OF pAddr_plus_pDelta_mask12]\n by simp\n\n -- \\We prove a lower bound for the lower bits of @{term pAddr'}.\\\n have pAddr'_mask_lower: \"pAddr AND mask 12 \\ pAddr' AND mask 12\"\n using plus_word_and_mask_no_wrap[where x=pAddr and y=pDelta and n=12]\n unfolding pAddr'_mask\n by simp\n\n -- \\We define \\vAddr'\\.\\\n define vAddr' where \"vAddr' \\ (vAddr AND NOT mask 12) OR (ucast pAddr' AND mask 12)\"\n have vAddr'_alt: \"vAddr' = (vAddr AND NOT mask 12) + (ucast pAddr' AND mask 12)\"\n unfolding vAddr'_def\n unfolding word_plus_and_or[where x=\"vAddr AND NOT mask 12\", THEN sym]\n by simp\n\n -- \\We prove that @{term vAddr'} translates to @{term pAddr'}.\\\n have vAddr'_trans: \"getTranslateAddr (vAddr', accessType) s = Some pAddr'\"\n proof -\n have \"getTranslateAddr (vAddr AND NOT mask 12, accessType) s = \n Some (pAddr AND NOT mask 12)\"\n unfolding getTranslateAddr_and_not_mask \n using pAddr\n by auto\n thus ?thesis\n unfolding getTranslateAddr_split[where vAddr=vAddr'] \n unfolding vAddr'_def \n by (auto simp: ucast_and ucast_or ucast_not \n pAddr'_not_mask[THEN sym]\n word_bool_alg.conj.assoc\n word_bool_alg.conj_disj_distrib2\n split: option.splits)\n qed\n\n -- \\We prove a lower bound of @{term vAddr'}.\\\n have vAddr'_lower: \"getBase cap \\ vAddr'\"\n proof -\n have \"vAddr = (vAddr AND NOT mask 12) + (ucast pAddr AND mask 12)\"\n using getTranslateAddr_vAddr_and_mask_12[where pAddr=pAddr, THEN sym] pAddr\n by simp\n also have \"... \\ (vAddr AND NOT mask 12) + (ucast pAddr' AND mask 12)\"\n using pAddr'_mask_lower\n unfolding word_le_def uint_word_and_not_mask_plus_word_and_mask\n by (simp add: uint_and_mask)\n also have \"... = vAddr'\"\n unfolding vAddr'_alt\n by simp\n finally show ?thesis\n using v_lower by auto\n qed\n\n -- \\We prove an upper bound of @{term vAddr'}.\\\n have vAddr'_upper: \"ucast vAddr' + (1::65 word) \\ ucast (getBase cap) + ucast (getLength cap)\"\n proof -\n have pAddr'_mask_upper: \"pAddr' AND mask 12 \\ (pAddr AND mask 12) + ucast accessLength'\"\n using word_plus_mono_right[where y=pDelta, \n OF _ plus_word_and_mask_no_wrap[where x=pAddr and y=\"ucast accessLength'\" and n=12]]\n using `pDelta \\ ucast accessLength'`\n unfolding pAddr'_mask\n by simp\n have \"pAddr AND mask 12 \\ (pAddr AND mask 12) + ucast accessLength'\"\n using pAddr'_mask_lower pAddr'_mask_upper\n by simp\n from uint_plus_simple[OF this]\n have \"uint vAddr' \\ \n uint (vAddr AND NOT mask 12) + uint (pAddr AND mask 12) + uint accessLength'\"\n using pAddr'_mask_upper\n unfolding vAddr'_alt\n unfolding word_le_def\n by (simp add: uint_and_mask uint_and_not_mask\n uint_word_and_not_mask_plus_word_and_mask)\n also have \"... = uint vAddr + uint accessLength'\"\n using arg_cong[where f=uint, OF getTranslateAddr_vAddr_and_mask_12[OF pAddr, THEN sym]]\n by (simp add: uint_and_mask uint_and_not_mask\n uint_word_and_not_mask_plus_word_and_mask)\n finally show ?thesis\n using v_upper\n unfolding word_le_def accessLength_alt add.assoc[THEN sym]\n by simp\n qed\n\n -- \\We prove that @{term vAddr'} lies in the memory segment of @{term cap}.\\\n have \"vAddr' \\ RegionOfCap cap\"\n using vAddr'_lower vAddr'_upper\n by (intro Region_memberI_65word) auto\n\n thus ?thesis\n using vAddr'_trans that\n by metis\nqed\n\nlemma TranslateNearbyAddress_LegacyInstructions:\n fixes vAddr :: VirtualAddress\n fixes pAddr' :: PhysicalAddress\n fixes accessLength :: \"3 word\"\n assumes v_upper: \"ucast vAddr + ucast accessLength + (1::65 word) \\ \n ucast (getBase cap) + ucast (getLength cap)\"\n and v_lower: \"getBase cap \\ vAddr\"\n and alignment: \"unat vAddr mod 8 + unat accessLength < 8\"\n and pAddr: \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n and pAddr': \"pAddr' \\ Region pAddr (ucast accessLength + 1)\"\n obtains vAddr' where\n \"getTranslateAddr (vAddr', accessType) s = Some pAddr'\" and\n \"vAddr' \\ RegionOfCap cap\"\nproof -\n define accessLength' :: \"65 word\" where \"accessLength' \\ ucast accessLength + 1\"\n have alignment': \"unat vAddr mod 32 + unat accessLength' \\ 32\"\n proof -\n have \"(8::nat) dvd 32\" by arith\n have \"(unat vAddr mod 32) div 8 \\ 3\" by auto\n from this[THEN mult_left_mono[where c=8], \n THEN add_left_mono[where c=\"(unat vAddr mod 32) mod 8\"]]\n have \"unat vAddr mod 32 \\ 24 + (unat vAddr mod 32 mod 8)\"\n by simp\n hence \"unat vAddr mod 32 \\ 24 + (unat vAddr mod 8)\"\n unfolding mod_mod_cancel[OF `(8::nat) dvd 32`]\n by simp\n thus ?thesis\n unfolding accessLength'_def\n using alignment\n by auto\n qed\n have v_upper': \"ucast vAddr + accessLength' \\ ucast (getBase cap) + ucast (getLength cap)\"\n using v_upper\n unfolding accessLength'_def\n by (simp add: add.assoc)\n have length: \"1 \\ accessLength'\" \"accessLength' \\ 32\"\n using uint_lt[where w=accessLength]\n unfolding accessLength'_def word_le_def\n by auto\n show ?thesis\n using TranslateNearbyAddress[OF v_upper' v_lower length alignment' pAddr]\n using pAddr' that\n unfolding accessLength'_def\n by auto\nqed\n\nlemma TranslateNearbyAddress_CapAligned:\n fixes vAddr :: VirtualAddress\n fixes pAddr' :: PhysicalAddress\n assumes v_upper: \"ucast vAddr + (32::65 word) \\ \n ucast (getBase cap) + ucast (getLength cap)\"\n and v_lower: \"getBase cap \\ vAddr\"\n and alignment: \"isCapAligned vAddr\"\n and pAddr: \"getTranslateAddr (vAddr, accessType) s = Some pAddr\"\n and pAddr': \"pAddr' \\ Region pAddr 32\"\n obtains vAddr' where\n \"getTranslateAddr (vAddr', accessType) s = Some pAddr'\" and\n \"vAddr' \\ RegionOfCap cap\"\nproof -\n define accessLength' :: \"65 word\" where \"accessLength' \\ 32\"\n have v_upper': \"ucast vAddr + accessLength' \\ ucast (getBase cap) + ucast (getLength cap)\"\n using v_upper\n unfolding accessLength'_def\n by (simp add: add.commute)\n have \"(ucast vAddr::5 word) = 0\"\n using alignment\n unfolding isCapAligned_def\n by simp\n from arg_cong[where f=unat, OF this]\n have [simp]: \"unat vAddr mod 32 = 0\"\n by (simp add: unat_and_mask)\n have alignment': \"unat vAddr mod 32 + unat accessLength' \\ 32\"\n unfolding accessLength'_def\n by auto\n show ?thesis\n using TranslateNearbyAddress[OF v_upper' v_lower _ _ alignment' pAddr]\n using pAddr' that\n unfolding accessLength'_def\n by auto\nqed\n\nsection \\Fetch\\\n\nsubsection \\@{term PartialFetch}\\\n\ndefinition FetchPartial where\n \"FetchPartial \\ MakePartial Fetch\"\n\nabbreviation \"getFetchPartial \\ ValuePart FetchPartial\"\n\nlemmas getFetchPartial_alt_def_aux =\n HoareTriple_AddressTranslation[\n where p=\"return (x = None)\" and \n q=\"\\y. bind (read_state (getReadInst y)) (\\z. return (x = Some (Some z)))\",\n OF IsInvariant_constant] for x\n\nschematic_goal getFetchPartial_alt_def:\n shows \"getFetchPartial = ?x\"\nunfolding FetchPartial_def Fetch_alt_def\nby (intro ValuePartMakePartial_from_HoareTriple)\n (HoareTriple intro: getFetchPartial_alt_def_aux[THEN HoareTriple_post_weakening]\n simp: all_distrib[where h=\"\\x. _ = x\", THEN sym])\n\nsubsection \\@{term NextInstruction}\\\n\ndefinition NextInstruction where\n \"NextInstruction \\ \n bind (read_state getFetchPartial)\n (\\v. return (case v of None \\ None \n | Some None \\ None\n | Some (Some w) \\ Some w))\"\n\nabbreviation \"getNextInstruction \\ ValuePart NextInstruction\"\n\nlemma NextInstruction_read_only [simp]:\n shows \"StatePart NextInstruction = (\\s. s)\"\nunfolding NextInstruction_def\nby (simp add: ValueAndStatePart_simp) \n\nlemma Commute_NextInstruction [Commute_compositeI]:\n assumes \"Commute (read_state getPC) m\"\n and \"Commute (read_state getPCC) m\"\n and \"Commute (read_state getCP0Compare) m\"\n and \"Commute (read_state getCP0Count) m\"\n and \"Commute (read_state getCP0StatusIE) m\"\n and \"Commute (read_state getCP0StatusEXL) m\"\n and \"Commute (read_state getCP0StatusERL) m\"\n and \"Commute (read_state getCP0StatusIM) m\"\n and \"Commute (read_state getCP0CauseIP) m\"\n and \"Commute (read_state getExceptionSignalled) m\"\n and \"\\v. Commute (read_state (getTranslateAddr v)) m\"\n and \"\\v. Commute (read_state (getReadInst v)) m\"\n shows \"Commute NextInstruction m\"\nusing assms\nunfolding NextInstruction_def getFetchPartial_alt_def Commute_def\nby (strong_cong_simp add: ValueAndStatePart_simp)\n\nsubsection \\@{const HoareTriple} of @{const Fetch}\\\n\nlemma HoareTriple_Fetch_getExceptionSignalled:\n shows \"HoareTriple (return True)\n Fetch\n (\\x. case x of None \\ read_state getExceptionSignalled\n | Some w \\ read_state isUnpredictable \\\\<^sub>b\n \\\\<^sub>b read_state getExceptionSignalled)\"\nunfolding Fetch_alt_def\nby (HoareTriple intro: HoareTriple_DefinedAddressTranslation[where p=\"\\x. return True\", \n THEN HoareTriple_post_weakening])\n\nlemma HoareTriple_Fetch_aux:\n assumes \"\\x. Commute p (update_state (setCP0CauseIP x))\"\n and \"\\x. Commute p (update_state (setCP0CauseTI x))\"\n and \"\\x. Commute p (ReadInst x)\"\n shows \"HoareTriple p\n Fetch\n (\\x. case x of None \\ return True\n | Some w \\ read_state isUnpredictable \\\\<^sub>b p)\"\nunfolding Fetch_alt_def\nby (HoareTriple intro: assms HoareTriple_DefinedAddressTranslation\n [where p=\"\\x. p\", THEN HoareTriple_post_weakening])\n\nlemma HoareTriple_Fetch:\n assumes \"\\x v. Commute (p x) (update_state (setCP0CauseIP v))\"\n and \"\\x v. Commute (p x) (update_state (setCP0CauseTI v))\"\n and \"\\x v. Commute (p x) (ReadInst v)\"\n shows \"HoareTriple (bind NextInstruction (case_option (return True) p))\n Fetch\n (\\x. case x of None \\ read_state getExceptionSignalled\n | Some w \\ read_state isUnpredictable \\\\<^sub>b p w)\"\n (is \"HoareTriple ?pre _ ?post\")\nproof (intro HoareTripleI)\n fix s\n assume \"ValuePart ?pre s\"\n thus \"ValuePart (bind Fetch ?post) s\"\n using HoareTripleE[where s=s, OF HoareTriple_Fetch_getExceptionSignalled]\n using HoareTripleE[where s=s, OF HoareTriple_Fetch_aux[OF assms]]\n unfolding NextInstruction_def FetchPartial_def MakePartial_def\n by (auto simp: ValueAndStatePart_simp split: option.splits if_splits)\nqed\n\nsection \\Valid states\\\n\nsubsection \\Ghost state\\\n\ndefinition GhostStateIsValid where \n \"GhostStateIsValid \\\n \\\\<^sub>b read_state isUnpredictable \\\\<^sub>b\n \\\\<^sub>b read_state getExceptionSignalled \\\\<^sub>b\n (read_state getBranchTo =\\<^sub>b return None) \\\\<^sub>b\n (read_state BranchToPCC =\\<^sub>b return None)\"\n\nabbreviation \"getGhostStateIsValid \\ ValuePart GhostStateIsValid\"\n\nlemma GhostStateIsValid_StatePart [simp]:\n shows \"StatePart GhostStateIsValid = (\\s. s)\"\nunfolding GhostStateIsValid_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma getGhostStateIsValidI [intro]:\n assumes \"\\ isUnpredictable s\"\n and \"\\ getExceptionSignalled s\"\n and \"getBranchTo s = None\"\n and \"BranchToPCC s = None\"\n shows \"getGhostStateIsValid s\"\nusing assms\nunfolding GhostStateIsValid_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma GhostStateIsValidE [elim!]:\n assumes \"getGhostStateIsValid s\"\n shows \"\\ isUnpredictable s\"\n and \"\\ getExceptionSignalled s\"\n and \"getBranchTo s = None\"\n and \"BranchToPCC s = None\"\nusing assms\nunfolding GhostStateIsValid_def\nby (simp_all add: ValueAndStatePart_simp)\n\ndefinition NextWithGhostState where\n \"NextWithGhostState =\n bind (update_state (currentInst_update Map.empty))\n (\\_. bind Fetch \n (\\v. bind (update_state (currentInst_update (\\_. v)))\n (\\_. bind (read_state currentInst)\n (\\v. bind (case v of None \\ return () | Some w \\ Run (Decode w))\n (\\_. bind TakeBranch\n (\\_. bind (read_state getCP0Count) \n (\\b. bind (update_state (setCP0Count (b + 1))) \n (\\_. bind (read_state currentInst) \n (\\v. update_state (lastInst_update (\\_. v)))))))))))\"\n\nlemma Next_NextWithGhostState:\n shows \"Next = bind NextWithGhostState (\\_. update_state (setExceptionSignalled False))\"\nproof -\n have commutativity: \n \"bind (read_state getCP0Count) \n (\\b. bind (update_state (setCP0Count (b + 1))) \n (\\_. bind (read_state currentInst) \n (\\v. bind (update_state (lastInst_update (\\_. v)))\n (\\_. update_state (setExceptionSignalled False))))) = \n bind (update_state (setExceptionSignalled False)) \n (\\_. bind (read_state getCP0Count) \n (\\b. bind (update_state (setCP0Count (b + 1))) \n (\\_. bind (read_state currentInst) \n (\\v. update_state (lastInst_update (\\_. v))))))\"\n unfolding monad_def Let_def\n by auto\n show ?thesis\n unfolding Next_alt_def NextWithGhostState_def\n by (simp add: commutativity bind_associativity)\nqed\n\nsubsection \\Valid states\\\n\ndefinition StateIsValid where \n \"StateIsValid =\n GhostStateIsValid \\\\<^sub>b\n read_state getCP0ConfigBE \\\\<^sub>b\n \\\\<^sub>b read_state getCP0StatusRE \\\\<^sub>b\n (read_state getBranchDelay =\\<^sub>b return None \\\\<^sub>b\n read_state BranchDelayPCC =\\<^sub>b return None)\"\n\nabbreviation \"getStateIsValid \\ ValuePart StateIsValid\"\n\nlemma StateIsValid_StatePart [simp]:\n shows \"StatePart StateIsValid = (\\s. s)\"\nunfolding StateIsValid_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma getStateIsValidI [intro]:\n assumes \"getGhostStateIsValid s\"\n and \"getCP0ConfigBE s\"\n and \"\\ getCP0StatusRE s\"\n and \"getBranchDelay s = None \\ BranchDelayPCC s = None\"\n shows \"getStateIsValid s\"\nusing assms\nunfolding StateIsValid_def is_some_def\nby (auto simp: ValueAndStatePart_simp)\n\nlemma StateIsValidE [elim!]:\n assumes \"getStateIsValid s\"\n shows \"getGhostStateIsValid s\"\n and \"getCP0ConfigBE s\"\n and \"\\ getCP0StatusRE s\"\nusing assms\nunfolding StateIsValid_def\nby (simp_all add: ValueAndStatePart_simp)\n\nlemma StateIsValid_GhostStateIsValidE [elim!]:\n assumes \"getStateIsValid s\"\n shows \"\\ isUnpredictable s\"\n and \"\\ getExceptionSignalled s\"\n and \"getBranchTo s = None\"\n and \"BranchToPCC s = None\"\nusing StateIsValidE[OF assms]\nby auto\n\nsection \\Semantics of unpredictable operations\\\n\ndefinition UnpredictableNext :: \"state \\ state set\" where\n \"UnpredictableNext s \\ \n {s' |s'. (\\a. getMemCap a s' = getMemCap a s) \\\n (getPCC s' = getPCC s) \\\n (BranchDelayPCC s' = BranchDelayPCC s) \\\n (\\cd. getCAPR cd s' = getCAPR cd s) \\\n (\\cd. getSCAPR cd s' = getSCAPR cd s) \\\n (\\vAddr. getTranslateAddr vAddr s' = getTranslateAddr vAddr s) \\\n getStateIsValid s'}\"\n\nlemma UnpredictableNextI [intro]:\n assumes \"\\a. getMemCap a s' = getMemCap a s\"\n and \"getPCC s' = getPCC s\"\n and \"BranchDelayPCC s' = BranchDelayPCC s\"\n and \"\\cd. getCAPR cd s' = getCAPR cd s\"\n and \"\\cd. getSCAPR cd s' = getSCAPR cd s\"\n and \"\\vAddr. getTranslateAddr vAddr s' = getTranslateAddr vAddr s\"\n and \"getStateIsValid s'\"\n shows \"s' \\ UnpredictableNext s\"\nusing assms\nunfolding UnpredictableNext_def\nby auto\n\nlemma UnpredictableNextE [elim!]:\n assumes \"s' \\ UnpredictableNext s\"\n shows \"getMemCap a s' = getMemCap a s\"\n and \"getPCC s' = getPCC s\"\n and \"BranchDelayPCC s' = BranchDelayPCC s\"\n and \"getCAPR cd s' = getCAPR cd s\"\n and \"getSCAPR cd' s' = getSCAPR cd' s\"\n and \"getStateIsValid s'\"\nusing assms\nunfolding UnpredictableNext_def\nby (auto split: prod.splits)\n\nlemma UnpredictableNextE_getMemByte [elim!]:\n assumes \"s' \\ UnpredictableNext s\"\n shows \"getMemByte a s' = getMemByte a s\"\nusing UnpredictableNextE[OF assms]\nusing getMemByte_getMemCap\nby auto\n\nlemma UnpredictableNextE_getBranchDelayPccCap [elim!]:\n assumes \"s' \\ UnpredictableNext s\"\n shows \"getBranchDelayPccCap s' = getBranchDelayPccCap s\"\nusing UnpredictableNextE[OF assms]\nunfolding getBranchDelayPccCap_def\nby auto\n\nlemma UnpredictableNextE_getGhostStateIsValid [elim!]:\n assumes \"s' \\ UnpredictableNext s\"\n shows \"getGhostStateIsValid s'\"\nusing UnpredictableNextE[OF assms]\nby auto\n\nlemma UnpredictableNextE_getCapReg [elim]:\n assumes unpred: \"s' \\ UnpredictableNext s\"\n and ghost: \"getGhostStateIsValid s\"\n shows \"getCapReg r s' = getCapReg r s\"\nproof -\n have ghost2: \"getGhostStateIsValid s'\"\n using UnpredictableNextE_getGhostStateIsValid[OF unpred]\n by simp\n show ?thesis\n using UnpredictableNextE[OF unpred]\n using UnpredictableNextE_getBranchDelayPccCap[OF unpred]\n using GhostStateIsValidE[OF ghost]\n using GhostStateIsValidE[OF ghost2]\n by (cases r) (auto simp: getBranchToPccCap_def)\nqed\n\nlemma UnpredictableNextE_getCap [elim]:\n assumes unpred: \"s' \\ UnpredictableNext s\"\n and ghost: \"getGhostStateIsValid s\"\n shows \"getCap loc s' = getCap loc s\"\nusing UnpredictableNextE[OF unpred]\nusing UnpredictableNextE_getCapReg[OF unpred ghost]\nby (cases loc) auto\n\nlemma UnpredictableNextE_getTranslateAddr [elim!]:\n assumes \"s' \\ UnpredictableNext s\"\n shows \"getTranslateAddr vAddr s' = getTranslateAddr vAddr s\"\nusing assms\nunfolding UnpredictableNext_def\nby (cases vAddr) (auto split: prod.splits)\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/core/CheriLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34158250614097546, "lm_q1q2_score": 0.17345964924861154}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__27.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__27 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__27 and some rule r*}\nlemma n_RecvReqVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReq N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReq N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvEVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvSVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''CurCmd'')) (Const Empty)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__27:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__27 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__27:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqESVsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqES i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__27:\n assumes a1: \"\\ j. j\\N\\r=n_SendReqS j\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqEIVsinv__27:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqEI i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__27 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__27.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34158249943831703, "lm_q1q2_score": 0.17345964584492207}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__148.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__148 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__148 and some rule r*}\nlemma n_PI_Remote_GetVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__148:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__148:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__148:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__148:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__148:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__148:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__148:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__148:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__148:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__148:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__148:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__148:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__148:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__148:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__148 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__148:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__148:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__148:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__148:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__148:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__148:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__148:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__148:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__148:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__148:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__148:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__148:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__148:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__148:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__148:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__148:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__148:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__148:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__148:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__148:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__148:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__148:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__148:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__148:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__148.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.341582499438317, "lm_q1q2_score": 0.17345964584492204}} {"text": "(* Title: JinjaThreads/Framework/FWBisimulation.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Bisimulation relations for the multithreaded semantics } *}\n\ntheory FWBisimulation\nimports\n FWLTS\n Bisimulation\nbegin\n\nsubsection {* Definitions for lifting bisimulation relations *}\n\nprimrec nta_bisim :: \"('t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim) \\ (('t,'x1,'m1) new_thread_action, ('t,'x2,'m2) new_thread_action) bisim\"\n where\n [code del]: \"nta_bisim bisim (NewThread t x m) ta = (\\x' m'. ta = NewThread t x' m' \\ bisim t (x, m) (x', m'))\"\n| \"nta_bisim bisim (ThreadExists t b) ta = (ta = ThreadExists t b)\"\n\nlemma nta_bisim_1_code [code]:\n \"nta_bisim bisim (NewThread t x m) ta = (case ta of NewThread t' x' m' \\ t = t' \\ bisim t (x, m) (x', m') | _ \\ False)\"\nby(auto split: new_thread_action.split)\n \nlemma nta_bisim_simps_sym [simp]:\n \"nta_bisim bisim ta (NewThread t x m) = (\\x' m'. ta = NewThread t x' m' \\ bisim t (x', m') (x, m))\"\n \"nta_bisim bisim ta (ThreadExists t b) = (ta = ThreadExists t b)\"\nby(cases ta, auto)+\n\ndefinition ta_bisim :: \"('t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim) \\ (('l,'t,'x1,'m1,'w,'o) thread_action, ('l,'t,'x2,'m2,'w,'o) thread_action) bisim\"\nwhere\n \"ta_bisim bisim ta1 ta2 \\\n \\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub> \\ \\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub> \\ \\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub> \\ \\ ta1 \\\\<^bsub>o\\<^esub> = \\ ta2 \\\\<^bsub>o\\<^esub> \\ \\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub> \\\n list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\"\n\nlemma ta_bisim_empty [iff]: \"ta_bisim bisim \\ \\\"\nby(auto simp add: ta_bisim_def)\n\n\n\nlemma nta_bisim_mono:\n assumes major: \"nta_bisim bisim ta ta'\"\n and mono: \"\\t s1 s2. bisim t s1 s2 \\ bisim' t s1 s2\"\n shows \"nta_bisim bisim' ta ta'\"\nusing major by(cases ta)(auto intro: mono)\n\nlemma ta_bisim_mono:\n assumes major: \"ta_bisim bisim ta1 ta2\"\n and mono: \"\\t s1 s2. bisim t s1 s2 \\ bisim' t s1 s2\"\n shows \"ta_bisim bisim' ta1 ta2\"\nusing major\nby(auto simp add: ta_bisim_def elim!: List.list_all2_mono nta_bisim_mono intro: mono)\n\nlemma nta_bisim_flip [flip_simps]:\n \"nta_bisim (\\t. flip (bisim t)) = flip (nta_bisim bisim)\"\nby(rule ext)(case_tac x, auto simp add: flip_simps)\n\nlemma ta_bisim_flip [flip_simps]:\n \"ta_bisim (\\t. flip (bisim t)) = flip (ta_bisim bisim)\"\nby(auto simp add: fun_eq_iff flip_simps ta_bisim_def)\n\nlocale FWbisimulation_base =\n r1!: multithreaded_base final1 r1 convert_RA +\n r2!: multithreaded_base final2 r2 convert_RA \n for final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w,'o) semantics\" (\"_ \\ _ -1-_\\ _\" [50, 0, 0, 50] 80)\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50, 0, 0, 50] 80) \n and convert_RA :: \"'l released_locks \\ 'o list\"\n +\n fixes bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60)\n and bisim_wait :: \"('x1, 'x2) bisim\" (\"_/ \\w _\" [50, 50] 60)\nbegin\n\nnotation r1.redT_syntax1 (\"_ -1-_\\_\\ _\" [50,0,0,50] 80)\nnotation r2.redT_syntax1 (\"_ -2-_\\_\\ _\" [50,0,0,50] 80)\n\nnotation r1.RedT (\"_ -1-\\_\\* _\" [50,0,50] 80)\nnotation r2.RedT (\"_ -2-\\_\\* _\" [50,0,50] 80)\n\nnotation r1.must_sync (\"_ \\ \\_,/ _\\/ \\1\" [50,0,0] 81)\nnotation r2.must_sync (\"_ \\ \\_,/ _\\/ \\2\" [50,0,0] 81)\n\nnotation r1.can_sync (\"_ \\ \\_,/ _\\/ _/ \\1\" [50,0,0,0] 81)\nnotation r2.can_sync (\"_ \\ \\_,/ _\\/ _/ \\2\" [50,0,0,0] 81)\n\nabbreviation ta_bisim_bisim_syntax (\"_/ \\m _\" [50, 50] 60)\nwhere \"ta1 \\m ta2 \\ ta_bisim bisim ta1 ta2\"\n\ndefinition tbisim :: \"bool \\ 't \\ ('x1 \\ 'l released_locks) option \\ 'm1 \\ ('x2 \\ 'l released_locks) option \\ 'm2 \\ bool\" where\n \"tbisim nw t ts1 m1 ts2 m2 \\\n (case ts1 of None \\ ts2 = None\n | \\(x1, ln)\\ \\ (\\x2. ts2 = \\(x2, ln)\\ \\ t \\ (x1, m1) \\ (x2, m2) \\ (nw \\ x1 \\w x2)))\"\n\nlemma tbisim_NoneI: \"tbisim w t None m None m'\"\nby(simp add: tbisim_def)\n\nlemma tbisim_SomeI:\n \"\\ t \\ (x, m) \\ (x', m'); nw \\ x \\w x' \\ \\ tbisim nw t (Some (x, ln)) m (Some (x', ln)) m'\"\nby(simp add: tbisim_def)\n\nlemma tbisim_cases[consumes 1, case_names None Some]:\n assumes major: \"tbisim nw t ts1 m1 ts2 m2\"\n obtains \"ts1 = None\" \"ts2 = None\"\n | x ln x' where \"ts1 = \\(x, ln)\\\" \"ts2 = \\(x', ln)\\\" \"t \\ (x, m1) \\ (x', m2)\" \"nw \\ x \\w x'\"\nusing major that\nby(auto simp add: tbisim_def)\n\ndefinition mbisim :: \"(('l,'t,'x1,'m1,'w) state, ('l,'t,'x2,'m2,'w) state) bisim\" (\"_ \\m _\" [50, 50] 60)\nwhere\n \"s1 \\m s2 \\ \n finite (dom (thr s1)) \\ locks s1 = locks s2 \\ wset s1 = wset s2 \\ wset_thread_ok (wset s1) (thr s1) \\\n interrupts s1 = interrupts s2 \\\n (\\t. tbisim (wset s2 t = None) t (thr s1 t) (shr s1) (thr s2 t) (shr s2))\"\n\nlemma mbisim_thrNone_eq: \"s1 \\m s2 \\ thr s1 t = None \\ thr s2 t = None\"\nunfolding mbisim_def tbisim_def\napply(clarify)\napply(erule allE[where x=t])\napply(clarsimp)\ndone\n\nlemma mbisim_thrD1:\n \"\\ s1 \\m s2; thr s1 t = \\(x, ln)\\ \\\n \\ \\x'. thr s2 t = \\(x', ln)\\ \\ t \\ (x, shr s1) \\ (x', shr s2) \\ (wset s1 t = None \\ x \\w x')\"\nby(fastforce simp add: mbisim_def tbisim_def)\n\nlemma mbisim_thrD2:\n \"\\ s1 \\m s2; thr s2 t = \\(x, ln)\\ \\\n \\ \\x'. thr s1 t = \\(x', ln)\\ \\ t \\ (x', shr s1) \\ (x, shr s2) \\ (wset s2 t = None \\ x' \\w x)\"\nby(frule mbisim_thrNone_eq[where t=t])(cases \"thr s1 t\",(fastforce simp add: mbisim_def tbisim_def)+)\n\nlemma mbisim_dom_eq: \"s1 \\m s2 \\ dom (thr s1) = dom (thr s2)\"\napply(clarsimp simp add: dom_def fun_eq_iff simp del: not_None_eq)\napply(rule Collect_cong)\napply(drule mbisim_thrNone_eq)\napply(simp del: not_None_eq)\ndone\n\nlemma mbisim_wset_thread_ok1:\n \"s1 \\m s2 \\ wset_thread_ok (wset s1) (thr s1)\"\nby(clarsimp simp add: mbisim_def)\n\nlemma mbisim_wset_thread_ok2:\n assumes \"s1 \\m s2\"\n shows \"wset_thread_ok (wset s2) (thr s2)\"\nusing assms\napply(clarsimp simp add: mbisim_def)\napply(auto intro!: wset_thread_okI simp add: mbisim_thrNone_eq[OF assms, THEN sym] dest: wset_thread_okD)\ndone\n\nlemma mbisimI:\n \"\\ finite (dom (thr s1)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; \n wset_thread_ok (wset s1) (thr s1);\n \\t. thr s1 t = None \\ thr s2 t = None;\n \\t x1 ln. thr s1 t = \\(x1, ln)\\ \\ \\x2. thr s2 t = \\(x2, ln)\\ \\ t \\ (x1, shr s1) \\ (x2, shr s2) \\ (wset s2 t = None \\ x1 \\w x2) \\\n \\ s1 \\m s2\"\nby(fastforce simp add: mbisim_def tbisim_def)\n\nlemma mbisimI2:\n \"\\ finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2;\n wset_thread_ok (wset s2) (thr s2);\n \\t. thr s2 t = None \\ thr s1 t = None;\n \\t x2 ln. thr s2 t = \\(x2, ln)\\ \\ \\x1. thr s1 t = \\(x1, ln)\\ \\ t \\ (x1, shr s1) \\ (x2, shr s2) \\ (wset s2 t = None \\ x1 \\w x2) \\\n \\ s1 \\m s2\"\napply(auto simp add: mbisim_def tbisim_def)\n prefer 2\n apply(rule wset_thread_okI)\n apply(case_tac \"thr s2 t\")\n apply(auto dest!: wset_thread_okD)[1]\n apply fastforce\n apply(erule back_subst[where P=finite])\n apply(clarsimp simp add: dom_def fun_eq_iff simp del: not_None_eq)\n defer\n apply(rename_tac t)\n apply(case_tac [!] \"thr s2 t\")\nby fastforce+\n\nlemma mbisim_finite1:\n \"s1 \\m s2 \\ finite (dom (thr s1))\"\nby(simp add: mbisim_def)\n\nlemma mbisim_finite2:\n \"s1 \\m s2 \\ finite (dom (thr s2))\"\nby(frule mbisim_finite1)(simp add: mbisim_dom_eq)\n\ndefinition mta_bisim :: \"('t \\ ('l,'t,'x1,'m1,'w,'o) thread_action,\n 't \\ ('l,'t,'x2,'m2,'w,'o) thread_action) bisim\"\n (\"_/ \\T _\" [50, 50] 60)\nwhere \"tta1 \\T tta2 \\ fst tta1 = fst tta2 \\ snd tta1 \\m snd tta2\"\n\nlemma mta_bisim_conv [simp]: \"(t, ta1) \\T (t', ta2) \\ t = t' \\ ta1 \\m ta2\"\nby(simp add: mta_bisim_def)\n\ndefinition bisim_inv :: \"bool\" where\n \"bisim_inv \\ (\\s1 ta1 s1' s2 t. t \\ s1 \\ s2 \\ t \\ s1 -1-ta1\\ s1' \\ (\\s2'. t \\ s1' \\ s2')) \\\n (\\s2 ta2 s2' s1 t. t \\ s1 \\ s2 \\ t \\ s2 -2-ta2\\ s2' \\ (\\s1'. t \\ s1' \\ s2'))\"\n\nlemma bisim_invI:\n \"\\ \\s1 ta1 s1' s2 t. \\ t \\ s1 \\ s2; t \\ s1 -1-ta1\\ s1' \\ \\ \\s2'. t \\ s1' \\ s2';\n \\s2 ta2 s2' s1 t. \\ t \\ s1 \\ s2; t \\ s2 -2-ta2\\ s2' \\ \\ \\s1'. t \\ s1' \\ s2' \\\n \\ bisim_inv\"\nby(auto simp add: bisim_inv_def)\n\nlemma bisim_invD1:\n \"\\ bisim_inv; t \\ s1 \\ s2; t \\ s1 -1-ta1\\ s1' \\ \\ \\s2'. t \\ s1' \\ s2'\"\nunfolding bisim_inv_def by blast\n\nlemma bisim_invD2:\n \"\\ bisim_inv; t \\ s1 \\ s2; t \\ s2 -2-ta2\\ s2' \\ \\ \\s1'. t \\ s1' \\ s2'\"\nunfolding bisim_inv_def by blast\n\nlemma thread_oks_bisim_inv:\n \"\\ \\t. ts1 t = None \\ ts2 t = None; list_all2 (nta_bisim bisim) tas1 tas2 \\\n \\ thread_oks ts1 tas1 \\ thread_oks ts2 tas2\"\nproof(induct tas2 arbitrary: tas1 ts1 ts2)\n case Nil thus ?case by(simp)\nnext\n case (Cons ta2 TAS2 tas1 TS1 TS2)\n note IH = `\\ts1 tas1 ts2. \\ \\t. ts1 t = None \\ ts2 t = None; list_all2 (nta_bisim bisim) tas1 TAS2 \\\n \\ thread_oks ts1 tas1 \\ thread_oks ts2 TAS2`\n note eqNone = `\\t. TS1 t = None \\ TS2 t = None`[rule_format]\n hence fti: \"free_thread_id TS1 = free_thread_id TS2\" by(auto simp add: free_thread_id_def)\n from `list_all2 (nta_bisim bisim) tas1 (ta2 # TAS2)`\n obtain ta1 TAS1 where \"tas1 = ta1 # TAS1\" \"nta_bisim bisim ta1 ta2\" \"list_all2 (nta_bisim bisim) TAS1 TAS2\"\n by(auto simp add: list_all2_Cons2)\n moreover\n { fix t\n from `nta_bisim bisim ta1 ta2` have \"redT_updT' TS1 ta1 t = None \\ redT_updT' TS2 ta2 t = None\"\n by(cases ta1, auto split: split_if_asm simp add: eqNone) }\n ultimately have \"thread_oks (redT_updT' TS1 ta1) TAS1 \\ thread_oks (redT_updT' TS2 ta2) TAS2\"\n by -(rule IH, auto)\n moreover from `nta_bisim bisim ta1 ta2` fti have \"thread_ok TS1 ta1 = thread_ok TS2 ta2\" by(cases ta1, auto)\n ultimately show ?case using `tas1 = ta1 # TAS1` by auto\nqed\n\nlemma redT_updT_nta_bisim_inv:\n \"\\ nta_bisim bisim ta1 ta2; ts1 T = None \\ ts2 T = None \\ \\ redT_updT ts1 ta1 T = None \\ redT_updT ts2 ta2 T = None\"\nby(cases ta1, auto)\n\nlemma redT_updTs_nta_bisim_inv:\n \"\\ list_all2 (nta_bisim bisim) tas1 tas2; ts1 T = None \\ ts2 T = None \\\n \\ redT_updTs ts1 tas1 T = None \\ redT_updTs ts2 tas2 T = None\"\nproof(induct tas1 arbitrary: tas2 ts1 ts2)\n case Nil thus ?case by(simp)\nnext\n case (Cons TA1 TAS1 tas2 TS1 TS2)\n note IH = `\\tas2 ts1 ts2. \\list_all2 (nta_bisim bisim) TAS1 tas2; (ts1 T = None) = (ts2 T = None)\\\n \\ (redT_updTs ts1 TAS1 T = None) = (redT_updTs ts2 tas2 T = None)`\n from `list_all2 (nta_bisim bisim) (TA1 # TAS1) tas2`\n obtain TA2 TAS2 where \"tas2 = TA2 # TAS2\" \"nta_bisim bisim TA1 TA2\" \"list_all2 (nta_bisim bisim) TAS1 TAS2\"\n by(auto simp add: list_all2_Cons1)\n from `nta_bisim bisim TA1 TA2` `(TS1 T = None) = (TS2 T = None)`\n have \"redT_updT TS1 TA1 T = None \\ redT_updT TS2 TA2 T = None\"\n by(rule redT_updT_nta_bisim_inv)\n with IH[OF `list_all2 (nta_bisim bisim) TAS1 TAS2`, of \"redT_updT TS1 TA1\" \"redT_updT TS2 TA2\"] `tas2 = TA2 # TAS2`\n show ?case by simp\nqed\n\nend\n\nlemma tbisim_flip [flip_simps]:\n \"FWbisimulation_base.tbisim (\\t. flip (bisim t)) (flip bisim_wait) w t ts2 m2 ts1 m1 =\n FWbisimulation_base.tbisim bisim bisim_wait w t ts1 m1 ts2 m2\"\nunfolding FWbisimulation_base.tbisim_def flip_simps by auto\n\nlemma mbisim_flip [flip_simps]:\n \"FWbisimulation_base.mbisim (\\t. flip (bisim t)) (flip bisim_wait) s2 s1 =\n FWbisimulation_base.mbisim bisim bisim_wait s1 s2\"\napply(rule iffI)\n apply(frule FWbisimulation_base.mbisim_dom_eq)\n apply(frule FWbisimulation_base.mbisim_wset_thread_ok2)\n apply(fastforce simp add: FWbisimulation_base.mbisim_def flip_simps)\napply(frule FWbisimulation_base.mbisim_dom_eq)\napply(frule FWbisimulation_base.mbisim_wset_thread_ok2)\napply(fastforce simp add: FWbisimulation_base.mbisim_def flip_simps)\ndone\n\nlemma mta_bisim_flip [flip_simps]:\n \"FWbisimulation_base.mta_bisim (\\t. flip (bisim t)) = flip (FWbisimulation_base.mta_bisim bisim)\"\nby(auto simp add: fun_eq_iff flip_simps FWbisimulation_base.mta_bisim_def)\n\nlemma flip_const [simp]: \"flip (\\a b. c) = (\\a b. c)\"\nby(rule flip_def)\n\nlemma mbisim_K_flip [flip_simps]:\n \"FWbisimulation_base.mbisim (\\t. flip (bisim t)) (\\x1 x2. c) s1 s2 = \n FWbisimulation_base.mbisim bisim (\\x1 x2. c) s2 s1\"\nusing mbisim_flip[of bisim \"\\x1 x2. c\" s1 s2]\nunfolding flip_const . \n\ncontext FWbisimulation_base begin\n\nlemma mbisim_actions_ok_bisim_no_join_12:\n assumes mbisim: \"mbisim s1 s2\"\n and \"collect_cond_actions \\ta1\\\\<^bsub>c\\<^esub> = {}\"\n and \"ta_bisim bisim ta1 ta2\"\n and \"r1.actions_ok s1 t ta1\"\n shows \"r2.actions_ok s2 t ta2\"\nusing assms mbisim_thrNone_eq[OF mbisim]\nby(auto simp add: ta_bisim_def mbisim_def intro: thread_oks_bisim_inv[THEN iffD1] r2.may_join_cond_action_oks)\n\nlemma mbisim_actions_ok_bisim_no_join_21:\n \"\\ mbisim s1 s2; collect_cond_actions \\ta2\\\\<^bsub>c\\<^esub> = {}; ta_bisim bisim ta1 ta2; r2.actions_ok s2 t ta2 \\\n \\ r1.actions_ok s1 t ta1\"\nusing FWbisimulation_base.mbisim_actions_ok_bisim_no_join_12[where bisim=\"\\t. flip (bisim t)\" and bisim_wait=\"flip bisim_wait\"]\nunfolding flip_simps .\n\nlemma mbisim_actions_ok_bisim_no_join:\n \"\\ mbisim s1 s2; collect_cond_actions \\ta1\\\\<^bsub>c\\<^esub> = {}; ta_bisim bisim ta1 ta2 \\ \n \\ r1.actions_ok s1 t ta1 = r2.actions_ok s2 t ta2\"\napply(rule iffI)\n apply(erule (3) mbisim_actions_ok_bisim_no_join_12)\napply(erule mbisim_actions_ok_bisim_no_join_21[where ?ta2.0 = ta2])\n apply(simp add: ta_bisim_def)\napply assumption+\ndone\n\nend\n\nlocale FWbisimulation_base_aux = FWbisimulation_base +\n r1!: multithreaded final1 r1 convert_RA +\n r2!: multithreaded final2 r2 convert_RA +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\nbegin\n\nlemma FWbisimulation_base_aux_flip:\n \"FWbisimulation_base_aux final2 r2 final1 r1\"\nby(unfold_locales)\n\nend\n\nlemma FWbisimulation_base_aux_flip_simps [flip_simps]:\n \"FWbisimulation_base_aux final2 r2 final1 r1 = FWbisimulation_base_aux final1 r1 final2 r2\"\nby(blast intro: FWbisimulation_base_aux.FWbisimulation_base_aux_flip)\n\nsublocale FWbisimulation_base_aux < mthr!:\n bisimulation_final_base \n r1.redT\n r2.redT\n mbisim\n mta_bisim\n r1.mfinal\n r2.mfinal\n.\n\ndeclare split_paired_Ex [simp del]\n\nsubsection {* Lifting for delay bisimulations *}\n\nlocale FWdelay_bisimulation_base =\n FWbisimulation_base _ _ _ r2 convert_RA bisim bisim_wait +\n r1!: \\multithreaded final1 r1 convert_RA \\move1 +\n r2!: \\multithreaded final2 r2 convert_RA \\move2 \n for r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50,0,0,50] 80)\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60)\n and bisim_wait :: \"('x1, 'x2) bisim\" (\"_/ \\w _\" [50, 50] 60)\n and \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\"\nbegin\n\nabbreviation \\mred1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mred1 \\ r1.\\mredT\"\n\nabbreviation \\mred2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mred2 \\ r2.\\mredT\"\n\nabbreviation m\\move1 :: \"(('l,'t,'x1,'m1,'w) state, 't \\ ('l,'t,'x1,'m1,'w,'o) thread_action) trsys\"\nwhere \"m\\move1 \\ r1.m\\move\"\n\nabbreviation m\\move2 :: \"(('l,'t,'x2,'m2,'w) state, 't \\ ('l,'t,'x2,'m2,'w,'o) thread_action) trsys\"\nwhere \"m\\move2 \\ r2.m\\move\"\n\nabbreviation \\mRed1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mRed1 \\ \\mred1^**\"\n\nabbreviation \\mRed2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mRed2 \\ \\mred2^**\"\n\nabbreviation \\mtRed1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x1,'m1,'w) state \\ bool\"\nwhere \"\\mtRed1 \\ \\mred1^++\"\n\nabbreviation \\mtRed2 :: \"('l,'t,'x2,'m2,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ bool\"\nwhere \"\\mtRed2 \\ \\mred2^++\"\n\nlemma bisim_inv_\\s1_inv:\n assumes inv: \"bisim_inv\"\n and bisim: \"t \\ s1 \\ s2\"\n and red: \"r1.silent_moves t s1 s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n from red bisim show \"\\s2'. t \\ s1' \\ s2'\"\n by(induct rule: rtranclp_induct)(fastforce elim: bisim_invD1[OF inv])+\nqed\n\nlemma bisim_inv_\\s2_inv:\n assumes inv: \"bisim_inv\"\n and bisim: \"t \\ s1 \\ s2\"\n and red: \"r2.silent_moves t s2 s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n from red bisim show \"\\s1'. t \\ s1' \\ s2'\"\n by(induct rule: rtranclp_induct)(fastforce elim: bisim_invD2[OF inv])+\nqed\n\nprimrec activate_cond_action1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ \n 't conditional_action \\ ('l,'t,'x1,'m1,'w) state\"\nwhere\n \"activate_cond_action1 s1 s2 (Join t) =\n (case thr s1 t of None \\ s1\n | \\(x1, ln1)\\ \\ (case thr s2 t of None \\ s1\n | \\(x2, ln2)\\ \\ \n if final2 x2 \\ ln2 = no_wait_locks\n then redT_upd_\\ s1 t\n (SOME x1'. r1.silent_moves t (x1, shr s1) (x1', shr s1) \\ final1 x1' \\ \n t \\ (x1', shr s1) \\ (x2, shr s2))\n (shr s1)\n else s1))\"\n| \"activate_cond_action1 s1 s2 Yield = s1\"\n\nprimrec activate_cond_actions1 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state\n \\ ('t conditional_action) list \\ ('l,'t,'x1,'m1,'w) state\"\nwhere\n \"activate_cond_actions1 s1 s2 [] = s1\"\n| \"activate_cond_actions1 s1 s2 (ct # cts) = activate_cond_actions1 (activate_cond_action1 s1 s2 ct) s2 cts\"\n\nprimrec activate_cond_action2 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\ \n 't conditional_action \\ ('l,'t,'x2,'m2,'w) state\"\nwhere\n \"activate_cond_action2 s1 s2 (Join t) =\n (case thr s2 t of None \\ s2\n | \\(x2, ln2)\\ \\ (case thr s1 t of None \\ s2\n | \\(x1, ln1)\\ \\ \n if final1 x1 \\ ln1 = no_wait_locks\n then redT_upd_\\ s2 t\n (SOME x2'. r2.silent_moves t (x2, shr s2) (x2', shr s2) \\ final2 x2' \\\n t \\ (x1, shr s1) \\ (x2', shr s2))\n (shr s2)\n else s2))\"\n| \"activate_cond_action2 s1 s2 Yield = s2\"\n\nprimrec activate_cond_actions2 :: \"('l,'t,'x1,'m1,'w) state \\ ('l,'t,'x2,'m2,'w) state \\\n ('t conditional_action) list \\ ('l,'t,'x2,'m2,'w) state\"\nwhere\n \"activate_cond_actions2 s1 s2 [] = s2\"\n| \"activate_cond_actions2 s1 s2 (ct # cts) = activate_cond_actions2 s1 (activate_cond_action2 s1 s2 ct) cts\"\n\nend\n\nlemma activate_cond_action1_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_action1 final2 r2 final1 (\\t. flip (bisim t)) \\move2 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_action2 final1 final2 r2 bisim \\move2 s1 s2\"\napply(rule ext)\napply(case_tac x)\napply(simp_all only: FWdelay_bisimulation_base.activate_cond_action1.simps \n FWdelay_bisimulation_base.activate_cond_action2.simps flip_simps)\ndone\n\nlemma activate_cond_actions1_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_actions1 final2 r2 final1 (\\t. flip (bisim t)) \\move2 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_actions2 final1 final2 r2 bisim \\move2 s1 s2\"\n (is \"?lhs = ?rhs\")\nproof(rule ext)\n fix xs\n show \"?lhs xs = ?rhs xs\"\n by(induct xs arbitrary: s2)\n (simp_all only: FWdelay_bisimulation_base.activate_cond_actions1.simps\n FWdelay_bisimulation_base.activate_cond_actions2.simps flip_simps)\nqed\n\nlemma activate_cond_action2_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_action2 final2 final1 r1 (\\t. flip (bisim t)) \\move1 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_action1 final1 r1 final2 bisim \\move1 s1 s2\"\napply(rule ext)\napply(case_tac x)\napply(simp_all only: FWdelay_bisimulation_base.activate_cond_action1.simps \n FWdelay_bisimulation_base.activate_cond_action2.simps flip_simps)\ndone\n\nlemma activate_cond_actions2_flip [flip_simps]:\n \"FWdelay_bisimulation_base.activate_cond_actions2 final2 final1 r1 (\\t. flip (bisim t)) \\move1 s2 s1 =\n FWdelay_bisimulation_base.activate_cond_actions1 final1 r1 final2 bisim \\move1 s1 s2\"\n (is \"?lhs = ?rhs\")\nproof(rule ext)\n fix xs\n show \"?lhs xs = ?rhs xs\"\n by(induct xs arbitrary: s1)\n (simp_all only: FWdelay_bisimulation_base.activate_cond_actions1.simps \n FWdelay_bisimulation_base.activate_cond_actions2.simps flip_simps)\nqed\n \ncontext FWdelay_bisimulation_base begin\n\n\n\nlemma shr_activate_cond_actions1 [simp]: \"shr (activate_cond_actions1 s1 s2 cts) = shr s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma shr_activate_cond_action2 [simp]: \"shr (activate_cond_action2 s1 s2 ct) = shr s2\"\nby(cases ct) simp_all\n\nlemma shr_activate_cond_actions2 [simp]: \"shr (activate_cond_actions2 s1 s2 cts) = shr s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma locks_activate_cond_action1 [simp]: \"locks (activate_cond_action1 s1 s2 ct) = locks s1\"\nby(cases ct) simp_all\n\nlemma locks_activate_cond_actions1 [simp]: \"locks (activate_cond_actions1 s1 s2 cts) = locks s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma locks_activate_cond_action2 [simp]: \"locks (activate_cond_action2 s1 s2 ct) = locks s2\"\nby(cases ct) simp_all\n\nlemma locks_activate_cond_actions2 [simp]: \"locks (activate_cond_actions2 s1 s2 cts) = locks s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma wset_activate_cond_action1 [simp]: \"wset (activate_cond_action1 s1 s2 ct) = wset s1\"\nby(cases ct) simp_all\n\nlemma wset_activate_cond_actions1 [simp]: \"wset (activate_cond_actions1 s1 s2 cts) = wset s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma wset_activate_cond_action2 [simp]: \"wset (activate_cond_action2 s1 s2 ct) = wset s2\"\nby(cases ct) simp_all\n\nlemma wset_activate_cond_actions2 [simp]: \"wset (activate_cond_actions2 s1 s2 cts) = wset s2\"\nby(induct cts arbitrary: s2) auto\n\nlemma interrupts_activate_cond_action1 [simp]: \"interrupts (activate_cond_action1 s1 s2 ct) = interrupts s1\"\nby(cases ct) simp_all\n\nlemma interrupts_activate_cond_actions1 [simp]: \"interrupts (activate_cond_actions1 s1 s2 cts) = interrupts s1\"\nby(induct cts arbitrary: s1) auto\n\nlemma interrupts_activate_cond_action2 [simp]: \"interrupts (activate_cond_action2 s1 s2 ct) = interrupts s2\"\nby(cases ct) simp_all\n\nlemma interrupts_activate_cond_actions2 [simp]: \"interrupts (activate_cond_actions2 s1 s2 cts) = interrupts s2\"\nby(induct cts arbitrary: s2) auto\n\nend\n\nlocale FWdelay_bisimulation_lift_aux =\n FWdelay_bisimulation_base _ _ _ _ _ _ _ \\move1 \\move2 +\n r1!: \\multithreaded_wf final1 r1 convert_RA \\move1 +\n r2!: \\multithreaded_wf final2 r2 convert_RA \\move2 \n for \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\"\nbegin\n\nlemma FWdelay_bisimulation_lift_aux_flip:\n \"FWdelay_bisimulation_lift_aux final2 r2 final1 r1 \\move2 \\move1\"\nby unfold_locales\n\nend\n\nlemma FWdelay_bisimulation_lift_aux_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_lift_aux final2 r2 final1 r1 \\move2 \\move1 =\n FWdelay_bisimulation_lift_aux final1 r1 final2 r2 \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_lift_aux.FWdelay_bisimulation_lift_aux_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_lift_aux begin\n\nlemma cond_actions_ok_\\mred1_inv:\n assumes red: \"\\mred1 s1 s1'\"\n and ct: \"r1.cond_action_ok s1 t ct\"\n shows \"r1.cond_action_ok s1' t ct\"\nusing ct\nproof(cases ct)\n case (Join t')\n show ?thesis using red ct\n proof(cases \"thr s1 t'\")\n case None with red ct Join show ?thesis\n by(fastforce elim!: r1.mthr.silent_move.cases r1.redT.cases r1.m\\move.cases rtrancl3p_cases \n dest: r1.silent_tl split: split_if_asm)\n next\n case (Some a) with red ct Join show ?thesis\n by(fastforce elim!: r1.mthr.silent_move.cases r1.redT.cases r1.m\\move.cases rtrancl3p_cases\n dest: r1.silent_tl r1.final_no_red split: split_if_asm simp add: redT_updWs_def)\n qed\nnext\n case Yield thus ?thesis by simp\nqed\n\nlemma cond_actions_ok_\\mred2_inv:\n \"\\ \\mred2 s2 s2'; r2.cond_action_ok s2 t ct \\ \\ r2.cond_action_ok s2' t ct\"\nusing FWdelay_bisimulation_lift_aux.cond_actions_ok_\\mred1_inv[OF FWdelay_bisimulation_lift_aux_flip] .\n\nlemma cond_actions_ok_\\mRed1_inv:\n \"\\ \\mRed1 s1 s1'; r1.cond_action_ok s1 t ct \\ \\ r1.cond_action_ok s1' t ct\"\nby(induct rule: rtranclp_induct)(blast intro: cond_actions_ok_\\mred1_inv)+\n\nlemma cond_actions_ok_\\mRed2_inv:\n \"\\ \\mRed2 s2 s2'; r2.cond_action_ok s2 t ct \\ \\ r2.cond_action_ok s2' t ct\"\nby(rule FWdelay_bisimulation_lift_aux.cond_actions_ok_\\mRed1_inv[OF FWdelay_bisimulation_lift_aux_flip])\n\nend\n\nlocale FWdelay_bisimulation_lift =\n FWdelay_bisimulation_lift_aux +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l, 't, 'x1, 'm1, 'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l, 't, 'x2, 'm2, 'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\n and \\move1 :: \"('l, 't, 'x1, 'm1, 'w, 'o) \\moves\" \n and \\move2 :: \"('l, 't, 'x2, 'm2, 'w, 'o) \\moves\"\n assumes \\inv_locale: \"\\inv (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n\nsublocale FWdelay_bisimulation_lift < \\inv \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule \\inv_locale)\n\ncontext FWdelay_bisimulation_lift begin\n\nlemma FWdelay_bisimulation_lift_flip:\n \"FWdelay_bisimulation_lift final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_lift.intro)\n apply(rule FWdelay_bisimulation_lift_aux_flip)\napply(rule FWdelay_bisimulation_lift_axioms.intro)\napply(unfold flip_simps)\napply(unfold_locales)\ndone\n\nend\n\nlemma FWdelay_bisimulation_lift_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_lift final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1 =\n FWdelay_bisimulation_lift final1 r1 final2 r2 bisim \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_lift.FWdelay_bisimulation_lift_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_lift begin\n\nlemma \\inv_lift: \"\\inv r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\"\nproof\n fix s1 s2 tl1 s1' tl2 s2'\n assume \"s1 \\m s2\" \"s1' \\m s2'\" \"tl1 \\T tl2\" \"r1.redT s1 tl1 s1'\" \"r2.redT s2 tl2 s2'\"\n moreover obtain t ta1 where tl1: \"tl1 = (t, ta1)\" by(cases tl1)\n moreover obtain t' ta2 where tl2: \"tl2 = (t', ta2)\" by(cases tl2)\n moreover obtain ls1 ts1 ws1 m1 is1 where s1: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n moreover obtain ls2 ts2 ws2 m2 is2 where s2: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n moreover obtain ls1' ts1' ws1' m1' is1' where s1': \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n moreover obtain ls2' ts2' ws2' m2' is2' where s2': \"s2' = (ls2', (ts2', m2'), ws2', is2')\" by(cases s2') fastforce\n ultimately have mbisim: \"(ls1, (ts1, m1), ws1, is1) \\m (ls2, (ts2, m2), ws2, is2)\"\n and mbisim': \"(ls1', (ts1', m1'), ws1', is1') \\m (ls2', (ts2', m2'), ws2', is2')\"\n and mred1: \"(ls1, (ts1, m1), ws1, is1) -1-t\\ta1\\ (ls1', (ts1', m1'), ws1', is1')\"\n and mred2: \"(ls2, (ts2, m2), ws2, is2) -2-t\\ta2\\ (ls2', (ts2', m2'), ws2', is2')\"\n and tasim: \"ta1 \\m ta2\" and tt': \"t' = t\" by simp_all\n from mbisim have ls: \"ls1 = ls2\" and ws: \"ws1 = ws2\" and \"is\": \"is1 = is2\"\n and tbisim: \"\\t. tbisim (ws2 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp_all add: mbisim_def)\n from mbisim' have ls': \"ls1' = ls2'\" and ws': \"ws1' = ws2'\" and is': \"is1' = is2'\"\n and tbisim': \"\\t. tbisim (ws2' t = None) t (ts1' t) m1' (ts2' t) m2'\" by(simp_all add: mbisim_def)\n from mred1 r1.redT_thread_not_disappear[OF mred1]\n obtain x1 ln1 x1' ln1' where tst1: \"ts1 t = \\(x1, ln1)\\\"\n and tst1': \"ts1' t = \\(x1', ln1')\\\"\n by(fastforce elim!: r1.redT.cases)\n from mred2 r2.redT_thread_not_disappear[OF mred2]\n obtain x2 ln2 x2' ln2' where tst2: \"ts2 t = \\(x2, ln2)\\\"\n and tst2': \"ts2' t = \\(x2', ln2')\\\" by(fastforce elim!: r2.redT.cases)\n from tbisim[of t] tst1 tst2 ws have bisim: \"t \\ (x1, m1) \\ (x2, m2)\"\n and ln: \"ln1 = ln2\" by(auto simp add: tbisim_def)\n from tbisim'[of t] tst1' tst2' have bisim': \"t \\ (x1', m1') \\ (x2', m2')\"\n and ln': \"ln1' = ln2'\" by(auto simp add: tbisim_def)\n show \"m\\move1 s1 tl1 s1' = m\\move2 s2 tl2 s2'\" unfolding s1 s2 s1' s2' tt' tl1 tl2\n proof -\n show \"m\\move1 (ls1, (ts1, m1), ws1, is1) (t, ta1) (ls1', (ts1', m1'), ws1', is1') =\n m\\move2 (ls2, (ts2, m2), ws2, is2) (t, ta2) (ls2', (ts2', m2'), ws2', is2')\"\n (is \"?lhs = ?rhs\")\n proof\n assume m\\: ?lhs\n with tst1 tst1' obtain \\1: \"\\move1 (x1, m1) ta1 (x1', m1')\" \n and ln1: \"ln1 = no_wait_locks\" by(fastforce elim!: r1.m\\move.cases)\n from \\1 have \"ta1 = \\\" by(rule r1.silent_tl)\n with mred1 \\1 tst1 tst1' ln1 have red1: \"t \\ (x1, m1) -1-ta1\\ (x1', m1')\"\n by(auto elim!: r1.redT.cases rtrancl3p_cases)\n from tasim `ta1 = \\` have [simp]: \"ta2 = \\\" by(simp)\n with mred2 ln1 ln tst2 tst2' have red2: \"t \\ (x2, m2) -2-\\\\ (x2', m2')\"\n by(fastforce elim!: r2.redT.cases rtrancl3p_cases)\n from \\1 \\inv[OF bisim red1 red2] bisim' tasim\n have \\2: \"\\move2 (x2, m2) \\ (x2', m2')\" by simp\n with tst2 tst2' ln ln1 show ?rhs by -(rule r2.m\\move.intros, auto)\n next\n assume m\\: ?rhs\n with tst2 tst2' obtain \\2: \"\\move2 (x2, m2) ta2 (x2', m2')\" \n and ln2: \"ln2 = no_wait_locks\" by(fastforce elim!: r2.m\\move.cases)\n from \\2 have \"ta2 = \\\" by(rule r2.silent_tl)\n with mred2 \\2 tst2 tst2' ln2 have red2: \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n by(auto elim!: r2.redT.cases rtrancl3p_cases)\n from tasim `ta2 = \\` have [simp]: \"ta1 = \\\" by simp\n with mred1 ln2 ln tst1 tst1' have red1: \"t \\ (x1, m1) -1-\\\\ (x1', m1')\"\n by(fastforce elim!: r1.redT.cases rtrancl3p_cases)\n from \\2 \\inv[OF bisim red1 red2] bisim' tasim\n have \\1: \"\\move1 (x1, m1) \\ (x1', m1')\" by auto\n with tst1 tst1' ln ln2 show ?lhs unfolding `ta1 = \\`\n by-(rule r1.m\\move.intros, auto)\n qed\n qed\nqed\n\nend\n\nsublocale FWdelay_bisimulation_lift < mthr!: \\inv r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\nby(rule \\inv_lift)\n\nlocale FWdelay_bisimulation_final_base =\n FWdelay_bisimulation_lift_aux +\n constrains final1 :: \"'x1 \\ bool\"\n and r1 :: \"('l,'t,'x1,'m1,'w, 'o) semantics\"\n and final2 :: \"'x2 \\ bool\"\n and r2 :: \"('l,'t,'x2,'m2,'w, 'o) semantics\"\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\"\n and bisim_wait :: \"('x1, 'x2) bisim\"\n and \\move1 :: \"('l,'t,'x1,'m1,'w, 'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w, 'o) \\moves\"\n assumes delay_bisim_locale:\n \"delay_bisimulation_final_base (r1 t) (r2 t) (bisim t) \\move1 \\move2 (\\(x1, m). final1 x1) (\\(x2, m). final2 x2)\"\n\nsublocale FWdelay_bisimulation_final_base <\n delay_bisimulation_final_base \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2\n \"\\(x1, m). final1 x1\" \"\\(x2, m). final2 x2\" \n for t\nby(rule delay_bisim_locale)\n\ncontext FWdelay_bisimulation_final_base begin\n\nlemma FWdelay_bisimulation_final_base_flip:\n \"FWdelay_bisimulation_final_base final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_final_base.intro)\n apply(rule FWdelay_bisimulation_lift_aux_flip)\napply(rule FWdelay_bisimulation_final_base_axioms.intro)\napply(rule delay_bisimulation_final_base_flip)\ndone\n\nend\n\nlemma FWdelay_bisimulation_final_base_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_final_base final2 r2 final1 r1 (\\t. flip (bisim t)) \\move2 \\move1 =\n FWdelay_bisimulation_final_base final1 r1 final2 r2 bisim \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_final_base.FWdelay_bisimulation_final_base_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_final_base begin\n\nlemma cond_actions_ok_bisim_ex_\\1_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 ct\n defines \"s1' \\ activate_cond_action1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n assumes mbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r2.cond_action_ok (ls, (ts2, m2), ws, is) t ct\"\n shows \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_ok s1' t ct\"\n and \"thr s1' t = Some xln\"\nproof -\n have \"\\mRed1 (ls, (ts1, m1), ws, is) s1' \\\n (\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2) \\\n r1.cond_action_ok s1' t ct \\ thr s1' t = \\xln\\\"\n using ct\n proof(cases ct)\n case (Join t')\n show ?thesis \n proof(cases \"ts1 t'\")\n case None\n with mbisim ts1t have \"t \\ t'\" by auto\n moreover from None Join have \"s1' = (ls, (ts1, m1), ws, is)\" by(simp add: s1'_def)\n ultimately show ?thesis using mbisim Join ct None ts1t by(simp add: tbisim_def)\n next\n case (Some xln)\n moreover obtain x1 ln where \"xln = (x1, ln)\" by(cases xln)\n ultimately have ts1t': \"ts1 t' = \\(x1, ln)\\\" by simp\n from Join ct Some ts2t have tt': \"t' \\ t\" by auto\n from mbisim[OF tt'] ts1t' obtain x2 where ts2t': \"ts2 t' = \\(x2, ln)\\\" \n and bisim: \"t' \\ (x1, m1) \\ (x2, m2)\" by(auto simp add: tbisim_def)\n from ct Join ts2t' have final2: \"final2 x2\" and ln: \"ln = no_wait_locks\"\n and wst': \"ws t' = None\" by simp_all\n let ?x1' = \"SOME x. r1.silent_moves t' (x1, m1) (x, m1) \\ final1 x \\ t' \\ (x, m1) \\ (x2, m2)\"\n { from final2_simulation[OF bisim] final2 obtain x1' m1' \n where \"r1.silent_moves t' (x1, m1) (x1', m1')\" and \"t' \\ (x1', m1') \\ (x2, m2)\"\n and \"final1 x1'\" by auto\n moreover hence \"m1' = m1\" using bisim by(auto dest: r1.red_rtrancl_\\_heapD_inv)\n ultimately have \"\\x. r1.silent_moves t' (x1, m1) (x, m1) \\ final1 x \\ t' \\ (x, m1) \\ (x2, m2)\"\n by blast }\n from someI_ex[OF this] have red1: \"r1.silent_moves t' (x1, m1) (?x1', m1)\"\n and final1: \"final1 ?x1'\" and bisim': \"t' \\ (?x1', m1) \\ (x2, m2)\" by blast+\n let ?S1' = \"redT_upd_\\ (ls, (ts1, m1), ws, is) t' ?x1' m1\"\n from r1.silent_moves_into_RedT_\\_inv[where ?s=\"(ls, (ts1, m1), ws, is)\" and t=t', simplified, OF red1]\n bisim ts1t' ln wst'\n have Red1: \"\\mRed1 (ls, (ts1, m1), ws, is) ?S1'\" by auto\n moreover from Join ln ts1t' final1 wst' tt'\n have ct': \"r1.cond_action_ok ?S1' t ct\" by(auto intro: finfun_ext)\n { fix t''\n assume \"t \\ t''\"\n with Join mbisim[OF this[symmetric]] bisim' ts1t' ts2t' wst' s1'_def\n have \"tbisim (ws t'' = None) t'' (thr s1' t'') m1 (ts2 t'') m2\"\n by(auto simp add: tbisim_def redT_updLns_def o_def finfun_Diag_const2) }\n moreover from Join ts1t' ts2t' final2 ln have \"s1' = ?S1'\" by(simp add: s1'_def)\n ultimately show ?thesis using Red1 ct' ts1t' tt' ts1t by(auto)\n qed\n next\n case Yield thus ?thesis using mbisim ts1t by(simp add: s1'_def)\n qed\n thus \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_ok s1' t ct\"\n and \"thr s1' t = \\xln\\\" by blast+\nqed\n\nlemma cond_actions_oks_bisim_ex_\\1_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 cts\n defines \"s1' \\ activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts\"\n assumes tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\"\n shows \"\\mRed1 (ls, (ts1, m1), ws, is) s1'\" \n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2\"\n and \"r1.cond_action_oks s1' t cts\"\n and \"thr s1' t = Some xln\"\nusing tbisim ts1t ct unfolding s1'_def\nproof(induct cts arbitrary: ts1)\n case (Cons ct cts)\n note IH1 = `\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ \\mred1\\<^sup>*\\<^sup>* (ls, (ts1, m1), ws, is) (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts)`\n note IH2 = `\\t' ts1. \\t' \\ t; \\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ tbisim (ws t' = None) t' (thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t') m1 (ts2 t') m2`\n note IH3 = `\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ r1.cond_action_oks (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t cts`\n note IH4 = `\\ts1. \\\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2; ts1 t = \\xln\\;\n r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\\\n \\ thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts) t = \\xln\\`\n { fix ts1\n assume tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = \\xln\\\"\n and ct: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t (ct # cts)\"\n from ct have 1: \"r2.cond_action_ok (ls, (ts2, m2), ws, is) t ct\"\n and 2: \"r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts\" by auto\n let ?s1' = \"activate_cond_action1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n from cond_actions_ok_bisim_ex_\\1_inv[OF tbisim, OF _ ts1t ts2t 1]\n have tbisim': \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (thr ?s1' t') m1 (ts2 t') m2\"\n and red: \"\\mRed1 (ls, (ts1, m1), ws, is) ?s1'\" and ct': \"r1.cond_action_ok ?s1' t ct\" \n and ts1't: \"thr ?s1' t = \\xln\\\" by blast+\n let ?s1'' = \"activate_cond_actions1 ?s1' (ls, (ts2, m2), ws, is) cts\"\n have \"locks ?s1' = ls\" \"shr ?s1' = m1\" \"wset ?s1' = ws\" \"interrupts ?s1' = is\" by simp_all\n hence s1': \"(ls, (thr ?s1', m1), ws, is) = ?s1'\" by(cases \"?s1'\") auto\n from IH1[OF tbisim', OF _ ts1't 2] s1' have red': \"\\mRed1 ?s1' ?s1''\" by simp\n with red show \"\\mRed1 (ls, (ts1, m1), ws, is) (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts))\"\n by auto\n { fix t'\n assume t't: \"t' \\ t\"\n from IH2[OF t't tbisim', OF _ ts1't 2] s1'\n show \"tbisim (ws t' = None) t' (thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t') m1 (ts2 t') m2\"\n by auto }\n from red' ct' have \"r1.cond_action_ok ?s1'' t ct\" by(rule cond_actions_ok_\\mRed1_inv)\n with IH3[OF tbisim', OF _ ts1't 2] s1'\n show \"r1.cond_action_oks (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t (ct # cts)\"\n by auto\n from ts1't IH4[OF tbisim', OF _ ts1't 2] s1'\n show \"thr (activate_cond_actions1 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) (ct # cts)) t = \\xln\\\" by auto }\nqed(auto)\n\nlemma cond_actions_ok_bisim_ex_\\2_inv:\n fixes ls ts1 m1 \"is\" ws ts2 m2 ct\n defines \"s2' \\ activate_cond_action2 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) ct\"\n assumes mbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r1.cond_action_ok (ls, (ts1, m1), ws, is) t ct\"\n shows \"\\mRed2 (ls, (ts2, m2), ws, is) s2'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (thr s2' t') m2\"\n and \"r2.cond_action_ok s2' t ct\"\n and \"thr s2' t = Some xln'\"\nunfolding s2'_def\nby(blast intro: FWdelay_bisimulation_final_base.cond_actions_ok_bisim_ex_\\1_inv[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\", unfolded flip_simps, OF mbisim _ _ ct, OF _ ts2t ts1t])+\n\nlemma cond_actions_oks_bisim_ex_\\2_inv:\n fixes ls ts1 m1 ws \"is\" ts2 m2 cts\n defines \"s2' \\ activate_cond_actions2 (ls, (ts1, m1), ws, is) (ls, (ts2, m2), ws, is) cts\"\n assumes tbisim: \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (ts2 t') m2\"\n and ts1t: \"ts1 t = Some xln\"\n and ts2t: \"ts2 t = Some xln'\"\n and ct: \"r1.cond_action_oks (ls, (ts1, m1), ws, is) t cts\"\n shows \"\\mRed2 (ls, (ts2, m2), ws, is) s2'\"\n and \"\\t'. t' \\ t \\ tbisim (ws t' = None) t' (ts1 t') m1 (thr s2' t') m2\"\n and \"r2.cond_action_oks s2' t cts\"\n and \"thr s2' t = Some xln'\"\nunfolding s2'_def\nby(blast intro: FWdelay_bisimulation_final_base.cond_actions_oks_bisim_ex_\\1_inv[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\", unfolded flip_simps, OF tbisim _ _ ct, OF _ ts2t ts1t])+\n\nlemma mfinal1_inv_simulation:\n assumes \"s1 \\m s2\" \n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1 \\m s2' \\ r1.final_threads s1 \\ r2.final_threads s2' \\ shr s2' = shr s2\"\nproof -\n from `s1 \\m s2` have \"finite (dom (thr s1))\" by(auto dest: mbisim_finite1)\n moreover have \"r1.final_threads s1 \\ dom (thr s1)\" by(auto simp add: r1.final_thread_def)\n ultimately have \"finite (r1.final_threads s1)\" by(blast intro: finite_subset)\n thus ?thesis using `s1 \\m s2`\n proof(induct A\\\"r1.final_threads s1\" arbitrary: s1 s2 rule: finite_induct)\n case empty\n from `{} = r1.final_threads s1`[symmetric] have \"\\t. \\ r1.final_thread s1 t\" by(auto)\n with `s1 \\m s2` show ?case by blast\n next\n case (insert t A)\n def s1' == \"(locks s1, ((thr s1)(t := None), shr s1), wset s1, interrupts s1)\"\n def s2' == \"(locks s2, ((thr s2)(t := None), shr s2), wset s2, interrupts s2)\"\n from `t \\ A` `insert t A = r1.final_threads s1` have \"A = r1.final_threads s1'\"\n unfolding s1'_def by(auto simp add: r1.final_thread_def r1.final_threads_def)\n moreover from `insert t A = r1.final_threads s1` have \"r1.final_thread s1 t\" by auto\n hence \"wset s1 t = None\" by(auto simp add: r1.final_thread_def)\n with `s1 \\m s2` have \"s1' \\m s2'\" unfolding s1'_def s2'_def\n by(auto simp add: mbisim_def intro: tbisim_NoneI intro!: wset_thread_okI dest: wset_thread_okD split: split_if_asm)\n ultimately have \"\\s2''. r2.mthr.silent_moves s2' s2'' \\ s1' \\m s2'' \\ r1.final_threads s1' \\ r2.final_threads s2'' \\ shr s2'' = shr s2'\" by(rule insert)\n then obtain s2'' where reds: \"r2.mthr.silent_moves s2' s2''\" \n and \"s1' \\m s2''\" and fin: \"\\t. r1.final_thread s1' t \\ r2.final_thread s2'' t\" and \"shr s2'' = shr s2'\" by blast\n have \"thr s2' t = None\" unfolding s2'_def by simp\n with `r2.mthr.silent_moves s2' s2''`\n have \"r2.mthr.silent_moves (locks s2', (thr s2'(t \\ the (thr s2 t)), shr s2'), wset s2', interrupts s2')\n (locks s2'', (thr s2''(t \\ the (thr s2 t)), shr s2''), wset s2'', interrupts s2'')\"\n by(rule r2.\\mRedT_add_thread_inv)\n also let ?s2'' = \"(locks s2, (thr s2''(t \\ the (thr s2 t)), shr s2), wset s2, interrupts s2)\"\n from `shr s2'' = shr s2'` `s1' \\m s2''` `s1 \\m s2`\n have \"(locks s2'', (thr s2''(t \\ the (thr s2 t)), shr s2''), wset s2'', interrupts s2'') = ?s2''\"\n unfolding s2'_def s1'_def by(simp add: mbisim_def)\n also (back_subst) from `s1 \\m s2` have \"dom (thr s1) = dom (thr s2)\" by(rule mbisim_dom_eq)\n with `r1.final_thread s1 t` have \"t \\ dom (thr s2)\" by(auto simp add: r1.final_thread_def)\n then obtain x2 ln where tst2: \"thr s2 t = \\(x2, ln)\\\" by auto\n hence \"(locks s2', (thr s2'(t \\ the (thr s2 t)), shr s2'), wset s2', interrupts s2') = s2\"\n unfolding s2'_def by(cases s2)(auto intro!: ext)\n also from `s1 \\m s2` tst2 obtain x1\n where tst1: \"thr s1 t = \\(x1, ln)\\\"\n and bisim: \"t \\ (x1, shr s1) \\ (x2, shr s2)\" by(auto dest: mbisim_thrD2)\n from `shr s2'' = shr s2'` have \"shr ?s2'' = shr s2\" by(simp add: s2'_def)\n from `r1.final_thread s1 t` tst1\n have final: \"final1 x1\" \"ln = no_wait_locks\" \"wset s1 t = None\" by(auto simp add: r1.final_thread_def)\n with final1_simulation[OF bisim] `shr ?s2'' = shr s2` obtain x2' m2'\n where red: \"r2.silent_moves t (x2, shr ?s2'') (x2', m2')\"\n and bisim': \"t \\ (x1, shr s1) \\ (x2', m2')\" and \"final2 x2'\" by auto\n from `wset s1 t = None` `s1 \\m s2` have \"wset s2 t = None\" by(simp add: mbisim_def) \n with bisim r2.silent_moves_into_RedT_\\_inv[OF red] tst2 `ln = no_wait_locks`\n have \"r2.mthr.silent_moves ?s2'' (redT_upd_\\ ?s2'' t x2' m2')\" unfolding s2'_def by auto\n also (rtranclp_trans)\n from bisim r2.red_rtrancl_\\_heapD_inv[OF red] have \"m2' = shr s2\" by auto\n hence \"s1 \\m (redT_upd_\\ ?s2'' t x2' m2')\"\n using `s1' \\m s2''` `s1 \\m s2` tst1 tst2 `shr ?s2'' = shr s2` bisim' `shr s2'' = shr s2'` `wset s2 t = None`\n unfolding s1'_def s2'_def by(auto simp add: mbisim_def redT_updLns_def split: split_if_asm intro: tbisim_SomeI)\n moreover { \n fix t'\n assume \"r1.final_thread s1 t'\"\n with fin[of t'] `final2 x2'` tst2 `ln = no_wait_locks` `wset s2 t = None` `s1' \\m s2''` `s1 \\m s2`\n have \"r2.final_thread (redT_upd_\\ ?s2'' t x2' m2') t'\" unfolding s1'_def\n by(fastforce split: split_if_asm simp add: r2.final_thread_def r1.final_thread_def redT_updLns_def finfun_Diag_const2 o_def mbisim_def)\n }\n moreover have \"shr (redT_upd_\\ ?s2'' t x2' m2') = shr s2\" using `m2' = shr s2` by simp\n ultimately show ?case by blast\n qed\nqed\n\nlemma mfinal2_inv_simulation:\n \"s1 \\m s2 \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ s1' \\m s2 \\ r2.final_threads s2 \\ r1.final_threads s1' \\ shr s1' = shr s1\"\nusing FWdelay_bisimulation_final_base.mfinal1_inv_simulation[OF FWdelay_bisimulation_final_base_flip, where bisim_wait=\"flip bisim_wait\"]\nby(unfold flip_simps)\n\nlemma mfinal1_simulation:\n assumes \"s1 \\m s2\" and \"r1.mfinal s1\"\n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1 \\m s2' \\ r2.mfinal s2' \\ shr s2' = shr s2\"\nproof -\n from mfinal1_inv_simulation[OF `s1 \\m s2`]\n obtain s2' where 1: \"r2.mthr.silent_moves s2 s2'\" \"s1 \\m s2'\" \"shr s2' = shr s2\"\n and fin: \"\\t. r1.final_thread s1 t \\ r2.final_thread s2' t\" by blast\n have \"r2.mfinal s2'\"\n proof(rule r2.mfinalI)\n fix t x2 ln\n assume \"thr s2' t = \\(x2, ln)\\\"\n with `s1 \\m s2'` obtain x1 where \"thr s1 t = \\(x1, ln)\\\" \"t \\ (x1, shr s1) \\ (x2, shr s2')\"\n by(auto dest: mbisim_thrD2)\n from `thr s1 t = \\(x1, ln)\\` `r1.mfinal s1` have \"r1.final_thread s1 t\"\n by(auto elim!: r1.mfinalE simp add: r1.final_thread_def)\n hence \"r2.final_thread s2' t\" by(rule fin)\n thus \"final2 x2 \\ ln = no_wait_locks \\ wset s2' t = None\"\n using `thr s2' t = \\(x2, ln)\\` by(auto simp add: r2.final_thread_def)\n qed\n with 1 show ?thesis by blast\nqed\n \nlemma mfinal2_simulation:\n \"\\ s1 \\m s2; r2.mfinal s2 \\\n \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ s1' \\m s2 \\ r1.mfinal s1' \\ shr s1' = shr s1\"\nusing FWdelay_bisimulation_final_base.mfinal1_simulation[OF FWdelay_bisimulation_final_base_flip, where bisim_wait = \"flip bisim_wait\"]\nby(unfold flip_simps)\n\nend\n\nlocale FWdelay_bisimulation_obs =\n FWdelay_bisimulation_final_base _ _ _ _ _ _ _ \\move1 \\move2\n for \\move1 :: \"('l,'t,'x1,'m1,'w, 'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w, 'o) \\moves\" +\n assumes delay_bisimulation_obs_locale: \"delay_bisimulation_obs (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n and bisim_inv_red_other:\n \"\\ t' \\ (x, m1) \\ (xx, m2); t \\ (x1, m1) \\ (x2, m2); \n r1.silent_moves t (x1, m1) (x1', m1);\n t \\ (x1', m1) -1-ta1\\ (x1'', m1'); \\ \\move1 (x1', m1) ta1 (x1'', m1');\n r2.silent_moves t (x2, m2) (x2', m2);\n t \\ (x2', m2) -2-ta2\\ (x2'', m2'); \\ \\move2 (x2', m2) ta2 (x2'', m2');\n t \\ (x1'', m1') \\ (x2'', m2'); ta_bisim bisim ta1 ta2 \\\n \\ t' \\ (x, m1') \\ (xx, m2')\"\n and bisim_waitI:\n \"\\ t \\ (x1, m1) \\ (x2, m2); r1.silent_moves t (x1, m1) (x1', m1);\n t \\ (x1', m1) -1-ta1\\ (x1'', m1'); \\ \\move1 (x1', m1) ta1 (x1'', m1');\n r2.silent_moves t (x2, m2) (x2', m2);\n t \\ (x2', m2) -2-ta2\\ (x2'', m2'); \\ \\move2 (x2', m2) ta2 (x2'', m2');\n t \\ (x1'', m1') \\ (x2'', m2'); ta_bisim bisim ta1 ta2;\n Suspend w \\ set \\ta1\\\\<^bsub>w\\<^esub>; Suspend w \\ set \\ta2\\\\<^bsub>w\\<^esub> \\\n \\ x1'' \\w x2''\"\n and simulation_Wakeup1:\n \"\\ t \\ (x1, m1) \\ (x2, m2); x1 \\w x2; t \\ (x1, m1) -1-ta1\\ (x1', m1'); Notified \\ set \\ta1\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta1\\\\<^bsub>w\\<^esub> \\\n \\ \\ta2 x2' m2'. t \\ (x2, m2) -2-ta2\\ (x2', m2') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta_bisim bisim ta1 ta2\"\n and simulation_Wakeup2:\n \"\\ t \\ (x1, m1) \\ (x2, m2); x1 \\w x2; t \\ (x2, m2) -2-ta2\\ (x2', m2'); Notified \\ set \\ta2\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta2\\\\<^bsub>w\\<^esub> \\\n \\ \\ta1 x1' m1'. t \\ (x1, m1) -1-ta1\\ (x1', m1') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta_bisim bisim ta1 ta2\"\n and ex_final1_conv_ex_final2:\n \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\"\n\nsublocale FWdelay_bisimulation_obs <\n delay_bisimulation_obs \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule delay_bisimulation_obs_locale)\n\ncontext FWdelay_bisimulation_obs begin\n\nlemma FWdelay_bisimulation_obs_flip:\n \"FWdelay_bisimulation_obs final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_obs.intro)\n apply(rule FWdelay_bisimulation_final_base_flip)\napply(rule FWdelay_bisimulation_obs_axioms.intro)\n apply(unfold flip_simps)\n apply(rule delay_bisimulation_obs_axioms)\n apply(erule (9) bisim_inv_red_other)\n apply(erule (10) bisim_waitI)\n apply(erule (3) simulation_Wakeup2)\n apply(erule (3) simulation_Wakeup1)\napply(rule ex_final1_conv_ex_final2[symmetric])\ndone\n\nend\n\nlemma FWdelay_bisimulation_obs_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_obs final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1 = \n FWdelay_bisimulation_obs final1 r1 final2 r2 bisim bisim_wait \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_obs.FWdelay_bisimulation_obs_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_obs begin\n\nlemma mbisim_redT_upd:\n fixes s1 t ta1 x1' m1' s2 ta2 x2' m2'\n assumes s1': \"redT_upd s1 t ta1 x1' m1' s1'\"\n and s2': \"redT_upd s2 t ta2 x2' m2' s2'\"\n and [simp]: \"wset s1 = wset s2\" \"locks s1 = locks s2\" \n and wset: \"wset s1' = wset s2'\"\n and interrupts: \"interrupts s1' = interrupts s2'\"\n and fin1: \"finite (dom (thr s1))\"\n and wsts: \"wset_thread_ok (wset s1) (thr s1)\"\n and tst: \"thr s1 t = \\(x1, ln)\\\"\n and tst': \"thr s2 t = \\(x2, ln)\\\"\n and aoe1: \"r1.actions_ok s1 t ta1\"\n and aoe2: \"r2.actions_ok s2 t ta2\"\n and tasim: \"ta_bisim bisim ta1 ta2\"\n and bisim': \"t \\ (x1', m1') \\ (x2', m2')\"\n and bisimw: \"wset s1' t = None \\ x1' \\w x2'\"\n and \\red1: \"r1.silent_moves t (x1'', shr s1) (x1, shr s1)\"\n and red1: \"t \\ (x1, shr s1) -1-ta1\\ (x1', m1')\"\n and \\red2: \"r2.silent_moves t (x2'', shr s2) (x2, shr s2)\"\n and red2: \"t \\ (x2, shr s2) -2-ta2\\ (x2', m2')\"\n and bisim: \"t \\ (x1'', shr s1) \\ (x2'', shr s2)\"\n and \\1: \"\\ \\move1 (x1, shr s1) ta1 (x1', m1')\"\n and \\2: \"\\ \\move2 (x2, shr s2) ta2 (x2', m2')\"\n and tbisim: \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr s2 t') (shr s2)\"\n shows \"s1' \\m s2'\"\nproof(rule mbisimI)\n from fin1 s1' show \"finite (dom (thr s1'))\"\n by(auto simp add: redT_updTs_finite_dom_inv)\nnext\n from tasim s1' s2' show \"locks s1' = locks s2'\"\n by(auto simp add: redT_updLs_def o_def ta_bisim_def)\nnext\n from wset show \"wset s1' = wset s2'\" .\nnext\n from interrupts show \"interrupts s1' = interrupts s2'\" .\nnext\n from wsts s1' s2' wset show \"wset_thread_ok (wset s1') (thr s1')\"\n by(fastforce intro!: wset_thread_okI split: split_if_asm dest: redT_updTs_None wset_thread_okD redT_updWs_None_implies_None)\nnext\n fix T\n assume \"thr s1' T = None\"\n moreover with tst s1' have [simp]: \"t \\ T\" by auto\n from tbisim[OF this] have \"(thr s1 T = None) = (thr s2 T = None)\"\n by(auto simp add: tbisim_def)\n hence \"(redT_updTs (thr s1) \\ta1\\\\<^bsub>t\\<^esub> T = None) = (redT_updTs (thr s2) \\ta2\\\\<^bsub>t\\<^esub> T = None)\"\n using tasim by -(rule redT_updTs_nta_bisim_inv, simp_all add: ta_bisim_def)\n ultimately show \"thr s2' T = None\" using s2' s1' by(auto split: split_if_asm)\nnext\n fix T X1 LN\n assume tsT: \"thr s1' T = \\(X1, LN)\\\"\n show \"\\x2. thr s2' T = \\(x2, LN)\\ \\ T \\ (X1, shr s1') \\ (x2, shr s2') \\ (wset s2' T = None \\ X1 \\w x2)\"\n proof(cases \"thr s1 T\")\n case None\n with tst have \"t \\ T\" by auto\n with tbisim[OF this] None have tsT': \"thr s2 T = None\" by(simp add: tbisim_def)\n from None `t \\ T` tsT aoe1 s1' obtain M1\n where ntset: \"NewThread T X1 M1 \\ set \\ta1\\\\<^bsub>t\\<^esub>\" and [simp]: \"LN = no_wait_locks\"\n by(auto dest!: redT_updTs_new_thread)\n from ntset obtain tas1 tas1' where \"\\ta1\\\\<^bsub>t\\<^esub> = tas1 @ NewThread T X1 M1 # tas1'\"\n by(auto simp add: in_set_conv_decomp)\n with tasim obtain tas2 X2 M2 tas2' where \"\\ta2\\\\<^bsub>t\\<^esub> = tas2 @ NewThread T X2 M2 # tas2'\"\n \"length tas2 = length tas2\" \"length tas1' = length tas2'\" and Bisim: \"T \\ (X1, M1) \\ (X2, M2)\"\n by(auto simp add: list_all2_append1 list_all2_Cons1 ta_bisim_def)\n hence ntset': \"NewThread T X2 M2 \\ set \\ta2\\\\<^bsub>t\\<^esub>\" by auto\n with tsT' `t \\ T` aoe2 s2' have \"thr s2' T = \\(X2, no_wait_locks)\\\"\n by(auto intro: redT_updTs_new_thread_ts)\n moreover from ntset' red2 have \"m2' = M2\" by(auto dest: r2.new_thread_memory)\n moreover from ntset red1 have \"m1' = M1\"\n by(auto dest: r1.new_thread_memory)\n moreover from wsts None have \"wset s1 T = None\" by(rule wset_thread_okD)\n ultimately show ?thesis using Bisim `t \\ T` s1' s2'\n by(auto simp add: redT_updWs_None_implies_None)\n next\n case (Some a)\n show ?thesis\n proof(cases \"t = T\")\n case True\n with tst tsT s1' have [simp]: \"X1 = x1'\" \"LN = redT_updLns (locks s1) t ln \\ta1\\\\<^bsub>l\\<^esub>\" by(auto)\n show ?thesis using True bisim' bisimw tasim tst tst' s1' s2' wset\n by(auto simp add: redT_updLns_def ta_bisim_def)\n next\n case False\n with Some aoe1 tsT s1' have \"thr s1 T = \\(X1, LN)\\\" by(auto dest: redT_updTs_Some)\n with tbisim[OF False] obtain X2 \n where tsT': \"thr s2 T = \\(X2, LN)\\\" and Bisim: \"T \\ (X1, shr s1) \\ (X2, shr s2)\"\n and bisimw: \"wset s1 T = None \\ X1 \\w X2\" by(auto simp add: tbisim_def)\n with aoe2 False s2' have tsT': \"thr s2' T = \\(X2, LN)\\\" by(auto simp add: redT_updTs_Some)\n moreover from Bisim bisim \\red1 red1 \\1 \\red2 red2 \\2 bisim' tasim\n have \"T \\ (X1, m1') \\ (X2, m2')\" by(rule bisim_inv_red_other)\n ultimately show ?thesis using False bisimw s1' s2'\n by(auto simp add: redT_updWs_None_implies_None)\n qed\n qed\nqed\n\ntheorem mbisim_simulation1:\n assumes mbisim: \"mbisim s1 s2\" and \"\\ m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\"\n shows \"\\s2' s2'' tl2. r2.mthr.silent_moves s2 s2' \\ r2.redT s2' tl2 s2'' \\\n \\ m\\move2 s2' tl2 s2'' \\ mbisim s1' s2'' \\ mta_bisim tl1 tl2\"\nproof -\n from assms obtain t ta1 where tl1 [simp]: \"tl1 = (t, ta1)\" and redT: \"s1 -1-t\\ta1\\ s1'\"\n and m\\: \"\\ m\\move1 s1 (t, ta1) s1'\" by(cases tl1) fastforce\n obtain ls1 ts1 m1 ws1 is1 where [simp]: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n obtain ls1' ts1' m1' ws1' is1' where [simp]: \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n obtain ls2 ts2 m2 ws2 is2 where [simp]: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n from mbisim have [simp]: \"ls2 = ls1\" \"ws2 = ws1\" \"is2 = is1\" \"finite (dom ts1)\" by(auto simp add: mbisim_def)\n from redT show ?thesis\n proof cases\n case (redT_normal x1 x1' M1')\n hence red: \"t \\ (x1, m1) -1-ta1\\ (x1', M1')\" \n and tst: \"ts1 t = \\(x1, no_wait_locks)\\\"\n and aoe: \"r1.actions_ok s1 t ta1\"\n and s1': \"redT_upd s1 t ta1 x1' M1' s1'\" by auto\n from mbisim tst obtain x2 where tst': \"ts2 t = \\(x2, no_wait_locks)\\\"\n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n from m\\ have \\: \"\\ \\move1 (x1, m1) ta1 (x1', M1')\"\n proof(rule contrapos_nn)\n assume \\: \"\\move1 (x1, m1) ta1 (x1', M1')\"\n moreover hence [simp]: \"ta1 = \\\" by(rule r1.silent_tl)\n moreover have [simp]: \"M1' = m1\" by(rule r1.\\move_heap[OF red \\, symmetric])\n ultimately show \"m\\move1 s1 (t, ta1) s1'\" using s1' tst s1'\n by(auto simp add: redT_updLs_def o_def intro: r1.m\\move.intros elim: rtrancl3p_cases)\n qed\n show ?thesis\n proof(cases \"ws1 t\")\n case None\n note wst = this\n from simulation1[OF bisim red \\] obtain x2' M2' x2'' M2'' ta2\n where red21: \"r2.silent_moves t (x2, m2) (x2', M2')\"\n and red22: \"t \\ (x2', M2') -2-ta2\\ (x2'', M2'')\" and \\2: \"\\ \\move2 (x2', M2') ta2 (x2'', M2'')\"\n and bisim': \"t \\ (x1', M1') \\ (x2'', M2'')\"\n and tasim: \"ta_bisim bisim ta1 ta2\" by auto\n let ?s2' = \"redT_upd_\\ s2 t x2' M2'\"\n let ?S2' = \"activate_cond_actions2 s1 ?s2' \\ta2\\\\<^bsub>c\\<^esub>\"\n let ?s2'' = \"(redT_updLs (locks ?S2') t \\ta2\\\\<^bsub>l\\<^esub>, ((redT_updTs (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>)(t \\ (x2'', redT_updLns (locks ?S2') t (snd (the (thr ?S2' t))) \\ta2\\\\<^bsub>l\\<^esub>)), M2''), wset s1', interrupts s1')\"\n from red21 tst' wst bisim have \"\\mRed2 s2 ?s2'\"\n by -(rule r2.silent_moves_into_RedT_\\_inv, auto)\n moreover from red21 bisim have [simp]: \"M2' = m2\" by(auto dest: r2.red_rtrancl_\\_heapD_inv)\n from tasim have [simp]: \"\\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub>\" \"\\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub>\" \"\\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub>\" \"\\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub>\"\n and nta: \"list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\" by(auto simp add: ta_bisim_def)\n from mbisim have tbisim: \"\\t. tbisim (ws1 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp add: mbisim_def)\n hence tbisim': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?s2' t') m2\" by(auto)\n from aoe have cao1: \"r1.cond_action_oks (ls1, (ts1, m1), ws1, is1) t \\ta2\\\\<^bsub>c\\<^esub>\" by auto\n from tst' have \"thr ?s2' t = \\(x2', no_wait_locks)\\\" by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n from cond_actions_oks_bisim_ex_\\2_inv[OF tbisim', OF _ tst this cao1]\n have red21': \"\\mRed2 ?s2' ?S2'\" and tbisim'': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?S2' t') m2\"\n and cao2: \"r2.cond_action_oks ?S2' t \\ta2\\\\<^bsub>c\\<^esub>\" and tst'': \"thr ?S2' t = \\(x2', no_wait_locks)\\\"\n by(auto simp del: fun_upd_apply)\n note red21' also (rtranclp_trans)\n from tbisim'' tst'' tst have \"\\t'. ts1 t' = None \\ thr ?S2' t' = None\" by(force simp add: tbisim_def)\n from aoe thread_oks_bisim_inv[OF this nta] have \"thread_oks (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>\" by simp\n with cao2 aoe have aoe': \"r2.actions_ok ?S2' t ta2\" by auto\n with red22 tst'' s1' have \"?S2' -2-t\\ta2\\ ?s2''\"\n by -(rule r2.redT.redT_normal, auto)\n moreover\n from \\2 have \"\\ m\\move2 ?S2' (t, ta2) ?s2''\"\n proof(rule contrapos_nn)\n assume m\\: \"m\\move2 ?S2' (t, ta2) ?s2''\"\n thus \"\\move2 (x2', M2') ta2 (x2'', M2'')\" using tst'' tst'\n by cases auto\n qed\n moreover\n { \n note s1'\n moreover have \"redT_upd ?S2' t ta2 x2'' M2'' ?s2''\" using s1' by auto\n moreover have \"wset s1 = wset ?S2'\" \"locks s1 = locks ?S2'\" by simp_all\n moreover have \"wset s1' = wset ?s2''\" by simp\n moreover have \"interrupts s1' = interrupts ?s2''\" by simp\n moreover have \"finite (dom (thr s1))\" by simp\n moreover from mbisim have \"wset_thread_ok (wset s1) (thr s1)\" by(simp add: mbisim_def) \n moreover from tst have \"thr s1 t = \\(x1, no_wait_locks)\\\" by simp\n moreover note tst'' aoe aoe' tasim bisim'\n moreover have \"wset s1' t = None \\ x1' \\w x2''\"\n proof(cases \"wset s1' t\")\n case None thus ?thesis ..\n next\n case (Some w)\n with wst s1' obtain w' where Suspend1: \"Suspend w' \\ set \\ta1\\\\<^bsub>w\\<^esub>\"\n by(auto dest: redT_updWs_None_SomeD)\n with tasim have Suspend2: \"Suspend w' \\ set \\ta2\\\\<^bsub>w\\<^esub>\" by(simp add: ta_bisim_def)\n from bisim_waitI[OF bisim rtranclp.rtrancl_refl red \\ _ _ _ bisim' tasim Suspend1 this, of x2'] red21 red22 \\2\n have \"x1' \\w x2''\" by auto\n thus ?thesis ..\n qed\n moreover note rtranclp.rtrancl_refl\n moreover from red have \"t \\ (x1, shr s1) -1-ta1\\ (x1', M1')\" by simp\n moreover from red21 have \"r2.silent_moves t (x2, shr ?S2') (x2', shr ?S2')\" by simp\n moreover from red22 have \"t \\ (x2', shr ?S2') -2-ta2\\ (x2'', M2'')\" by simp\n moreover from bisim have \"t \\ (x1, shr s1) \\ (x2, shr ?S2')\" by simp\n moreover from \\ have \"\\ \\move1 (x1, shr s1) ta1 (x1', M1')\" by simp\n moreover from \\2 have \"\\ \\move2 (x2', shr ?S2') ta2 (x2'', M2'')\" by simp\n moreover from tbisim'' \n have \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr ?S2' t') (shr ?S2')\" \n by simp\n ultimately have \"mbisim s1' ?s2''\" by(rule mbisim_redT_upd)\n }\n ultimately show ?thesis using tasim unfolding tl1 s1' by fastforce\n next\n case (Some w)\n with mbisim tst tst' have \"x1 \\w x2\"\n by(auto dest: mbisim_thrD1)\n from aoe Some have wakeup: \"Notified \\ set \\ta1\\\\<^bsub>w\\<^esub> \\ WokenUp \\ set \\ta1\\\\<^bsub>w\\<^esub>\"\n by(auto simp add: wset_actions_ok_def split: split_if_asm)\n from simulation_Wakeup1[OF bisim `x1 \\w x2` red this]\n obtain ta2 x2' m2' where red2: \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n and bisim': \"t \\ (x1', M1') \\ (x2', m2')\"\n and tasim: \"ta1 \\m ta2\" by auto\n\n let ?S2' = \"activate_cond_actions2 s1 s2 \\ta2\\\\<^bsub>c\\<^esub>\"\n\n let ?s2' = \"(redT_updLs (locks ?S2') t \\ta2\\\\<^bsub>l\\<^esub>, ((redT_updTs (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>)(t \\ (x2', redT_updLns (locks ?S2') t (snd (the (thr ?S2' t))) \\ta2\\\\<^bsub>l\\<^esub>)), m2'), wset s1', interrupts s1')\"\n\n from tasim have [simp]: \"\\ ta1 \\\\<^bsub>l\\<^esub> = \\ ta2 \\\\<^bsub>l\\<^esub>\" \"\\ ta1 \\\\<^bsub>w\\<^esub> = \\ ta2 \\\\<^bsub>w\\<^esub>\" \"\\ ta1 \\\\<^bsub>c\\<^esub> = \\ ta2 \\\\<^bsub>c\\<^esub>\" \"\\ ta1 \\\\<^bsub>i\\<^esub> = \\ ta2 \\\\<^bsub>i\\<^esub>\"\n and nta: \"list_all2 (nta_bisim bisim) \\ ta1 \\\\<^bsub>t\\<^esub> \\ ta2 \\\\<^bsub>t\\<^esub>\" by(auto simp add: ta_bisim_def)\n from mbisim have tbisim: \"\\t. tbisim (ws1 t = None) t (ts1 t) m1 (ts2 t) m2\" by(simp add: mbisim_def)\n hence tbisim': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr s2 t') m2\" by(auto)\n from aoe have cao1: \"r1.cond_action_oks (ls1, (ts1, m1), ws1, is1) t \\ta2\\\\<^bsub>c\\<^esub>\" by auto\n from tst' have \"thr s2 t = \\(x2, no_wait_locks)\\\"\n by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n from cond_actions_oks_bisim_ex_\\2_inv[OF tbisim', OF _ tst this cao1]\n have red21': \"\\mRed2 s2 ?S2'\" and tbisim'': \"\\t'. t' \\ t \\ tbisim (ws1 t' = None) t' (ts1 t') m1 (thr ?S2' t') m2\"\n and cao2: \"r2.cond_action_oks ?S2' t \\ta2\\\\<^bsub>c\\<^esub>\" and tst'': \"thr ?S2' t = \\(x2, no_wait_locks)\\\"\n by(auto simp del: fun_upd_apply)\n note red21' moreover\n from tbisim'' tst'' tst have \"\\t'. ts1 t' = None \\ thr ?S2' t' = None\" by(force simp add: tbisim_def)\n from aoe thread_oks_bisim_inv[OF this nta] have \"thread_oks (thr ?S2') \\ta2\\\\<^bsub>t\\<^esub>\" by simp\n with cao2 aoe have aoe': \"r2.actions_ok ?S2' t ta2\" by auto\n with red2 tst'' s1' tasim have \"?S2' -2-t\\ta2\\ ?s2'\"\n by -(rule r2.redT_normal, auto simp add: ta_bisim_def)\n moreover from wakeup tasim\n have \\2: \"\\ \\move2 (x2, m2) ta2 (x2', m2')\" by(auto dest: r2.silent_tl)\n hence \"\\ m\\move2 ?S2' (t, ta2) ?s2'\"\n proof(rule contrapos_nn)\n assume m\\: \"m\\move2 ?S2' (t, ta2) ?s2'\"\n thus \"\\move2 (x2, m2) ta2 (x2', m2')\" using tst'' tst'\n by cases auto\n qed\n moreover {\n note s1'\n moreover have \"redT_upd ?S2' t ta2 x2' m2' ?s2'\" using s1' tasim by(auto simp add: ta_bisim_def)\n moreover have \"wset s1 = wset ?S2'\" \"locks s1 = locks ?S2'\" by simp_all\n moreover have \"wset s1' = wset ?s2'\" by simp\n moreover have \"interrupts s1' = interrupts ?s2'\" by simp\n moreover have \"finite (dom (thr s1))\" by simp\n moreover from mbisim have \"wset_thread_ok (wset s1) (thr s1)\" by(rule mbisim_wset_thread_ok1)\n moreover from tst have \"thr s1 t = \\(x1, no_wait_locks)\\\" by simp\n moreover from tst'' have \"thr ?S2' t = \\(x2, no_wait_locks)\\\" by simp\n moreover note aoe aoe' tasim bisim'\n moreover have \"wset s1' t = None \\ x1' \\w x2'\"\n proof(cases \"wset s1' t\")\n case None thus ?thesis ..\n next\n case (Some w')\n with redT_updWs_WokenUp_SuspendD[OF _ wakeup, of t \"wset s1\" \"wset s1'\" w'] s1'\n obtain w' where Suspend1: \"Suspend w' \\ set \\ta1\\\\<^bsub>w\\<^esub>\" by(auto)\n with tasim have Suspend2: \"Suspend w' \\ set \\ta2\\\\<^bsub>w\\<^esub>\" by(simp add: ta_bisim_def)\n with bisim rtranclp.rtrancl_refl red \\ rtranclp.rtrancl_refl red2 \\2 bisim' tasim Suspend1\n have \"x1' \\w x2'\" by(rule bisim_waitI)\n thus ?thesis ..\n qed\n moreover note rtranclp.rtrancl_refl\n moreover from red have \"t \\ (x1, shr s1) -1-ta1\\ (x1', M1')\" by simp\n moreover note rtranclp.rtrancl_refl\n moreover from red2 have \"t \\ (x2, shr ?S2') -2-ta2\\ (x2', m2')\" by simp\n moreover from bisim have \"t \\ (x1, shr s1) \\ (x2, shr ?S2')\" by simp\n moreover from \\ have \"\\ \\move1 (x1, shr s1) ta1 (x1', M1')\" by simp\n moreover from \\2 have \"\\ \\move2 (x2, shr ?S2') ta2 (x2', m2')\" by simp\n moreover from tbisim'' have \"\\t'. t \\ t' \\ tbisim (wset s1 t' = None) t' (thr s1 t') (shr s1) (thr ?S2' t') (shr ?S2')\" by simp\n ultimately have \"s1' \\m ?s2'\" by(rule mbisim_redT_upd) }\n moreover from tasim have \"tl1 \\T (t, ta2)\" by simp\n ultimately show ?thesis unfolding s1' by blast\n qed\n next\n case (redT_acquire x1 ln n)\n hence [simp]: \"ta1 = (K$ [], [], [], [], [], convert_RA ln)\"\n and tst: \"thr s1 t = \\(x1, ln)\\\" and wst: \"\\ waiting (wset s1 t)\"\n and maa: \"may_acquire_all (locks s1) t ln\" and ln: \"0 < ln $ n\"\n and s1': \"s1' = (acquire_all ls1 t ln, (ts1(t \\ (x1, no_wait_locks)), m1), ws1, is1)\" by auto\n from tst mbisim obtain x2 where tst': \"ts2 t = \\(x2, ln)\\\" \n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n let ?s2' = \"(acquire_all ls1 t ln, (ts2(t \\ (x2, no_wait_locks)), m2), ws1, is1)\"\n from tst' wst maa ln have \"s2 -2-t\\(K$ [], [], [], [], [], convert_RA ln)\\ ?s2'\"\n by-(rule r2.redT.redT_acquire, auto)\n moreover from tst' ln have \"\\ m\\move2 s2 (t, (K$ [], [], [], [], [], convert_RA ln)) ?s2'\"\n by(auto simp add: acquire_all_def fun_eq_iff elim!: r2.m\\move.cases)\n moreover have \"mbisim s1' ?s2'\"\n proof(rule mbisimI)\n from s1' show \"locks s1' = locks ?s2'\" by auto\n next\n from s1' show \"wset s1' = wset ?s2'\" by auto\n next\n from s1' show \"interrupts s1' = interrupts ?s2'\" by auto\n next\n fix t' assume \"thr s1' t' = None\"\n with s1' have \"thr s1 t' = None\" by(auto split: split_if_asm)\n with mbisim_thrNone_eq[OF mbisim] have \"ts2 t' = None\" by simp\n with tst' show \"thr ?s2' t' = None\" by auto\n next\n fix t' X1 LN\n assume ts't: \"thr s1' t' = \\(X1, LN)\\\"\n show \"\\x2. thr ?s2' t' = \\(x2, LN)\\ \\ t' \\ (X1, shr s1') \\ (x2, shr ?s2') \\ (wset ?s2' t' = None \\ X1 \\w x2)\"\n proof(cases \"t' = t\")\n case True\n with s1' tst ts't have [simp]: \"X1 = x1\" \"LN = no_wait_locks\" by simp_all\n with mbisim_thrD1[OF mbisim tst] bisim tst tst' True s1' wst show ?thesis by(auto)\n next\n case False\n with ts't s1' have \"ts1 t' = \\(X1, LN)\\\" by auto\n with mbisim obtain X2 where \"ts2 t' = \\(X2, LN)\\\" \"t' \\ (X1, m1) \\ (X2, m2)\" \"wset ?s2' t' = None \\ X1 \\w X2\"\n by(auto dest: mbisim_thrD1)\n with False s1' show ?thesis by auto\n qed\n next\n from s1' show \"finite (dom (thr s1'))\" by auto\n next\n from mbisim_wset_thread_ok1[OF mbisim]\n show \"wset_thread_ok (wset s1') (thr s1')\" using s1' by(auto intro: wset_thread_ok_upd)\n qed\n moreover have \"(t, K$ [], [], [], [], [], convert_RA ln) \\T (t, K$ [], [], [], [], [], convert_RA ln)\"\n by(simp add: ta_bisim_def)\n ultimately show ?thesis by fastforce\n qed\nqed\n\ntheorem mbisim_simulation2:\n \"\\ mbisim s1 s2; r2.redT s2 tl2 s2'; \\ m\\move2 s2 tl2 s2' \\\n \\ \\s1' s1'' tl1. r1.mthr.silent_moves s1 s1' \\ r1.redT s1' tl1 s1'' \\ \\ m\\move1 s1' tl1 s1'' \\\n mbisim s1'' s2' \\ mta_bisim tl1 tl2\"\nusing FWdelay_bisimulation_obs.mbisim_simulation1[OF FWdelay_bisimulation_obs_flip]\nunfolding flip_simps .\n\nend\n\nlocale FWdelay_bisimulation_diverge =\n FWdelay_bisimulation_obs _ _ _ _ _ _ _ \\move1 \\move2\n for \\move1 :: \"('l,'t,'x1,'m1,'w,'o) \\moves\"\n and \\move2 :: \"('l,'t,'x2,'m2,'w,'o) \\moves\" +\n assumes delay_bisimulation_diverge_locale: \"delay_bisimulation_diverge (r1 t) (r2 t) (bisim t) (ta_bisim bisim) \\move1 \\move2\"\n\nsublocale FWdelay_bisimulation_diverge <\n delay_bisimulation_diverge \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \\move1 \\move2 for t\nby(rule delay_bisimulation_diverge_locale)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma FWdelay_bisimulation_diverge_flip:\n \"FWdelay_bisimulation_diverge final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1\"\napply(rule FWdelay_bisimulation_diverge.intro)\n apply(rule FWdelay_bisimulation_obs_flip)\napply(rule FWdelay_bisimulation_diverge_axioms.intro)\napply(unfold flip_simps)\napply(rule delay_bisimulation_diverge_axioms)\ndone\n\nend\n\nlemma FWdelay_bisimulation_diverge_flip_simps [flip_simps]:\n \"FWdelay_bisimulation_diverge final2 r2 final1 r1 (\\t. flip (bisim t)) (flip bisim_wait) \\move2 \\move1 = \n FWdelay_bisimulation_diverge final1 r1 final2 r2 bisim bisim_wait \\move1 \\move2\"\nby(auto dest: FWdelay_bisimulation_diverge.FWdelay_bisimulation_diverge_flip simp only: flip_flip)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma bisim_inv1:\n assumes bisim: \"t \\ s1 \\ s2\"\n and red: \"t \\ s1 -1-ta1\\ s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nproof(atomize_elim)\n show \"\\s2'. t \\ s1' \\ s2'\"\n proof(cases \"\\move1 s1 ta1 s1'\")\n case True\n with red have \"r1.silent_move t s1 s1'\" by auto\n from simulation_silent1[OF bisim this]\n show ?thesis by auto\n next\n case False\n from simulation1[OF bisim red False] show ?thesis by auto\n qed\nqed\n\nlemma bisim_inv2:\n assumes \"t \\ s1 \\ s2\" \"t \\ s2 -2-ta2\\ s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nusing assms FWdelay_bisimulation_diverge.bisim_inv1[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps by blast\n\nlemma bisim_inv: \"bisim_inv\"\nby(blast intro!: bisim_invI elim: bisim_inv1 bisim_inv2)\n\nlemma bisim_inv_\\s1:\n assumes \"t \\ s1 \\ s2\" and \"r1.silent_moves t s1 s1'\"\n obtains s2' where \"t \\ s1' \\ s2'\"\nusing assms by(rule bisim_inv_\\s1_inv[OF bisim_inv])\n\nlemma bisim_inv_\\s2:\n assumes \"t \\ s1 \\ s2\" and \"r2.silent_moves t s2 s2'\"\n obtains s1' where \"t \\ s1' \\ s2'\"\nusing assms by(rule bisim_inv_\\s2_inv[OF bisim_inv])\n\nlemma red1_rtrancl_\\_into_RedT_\\:\n assumes \"r1.silent_moves t (x1, shr s1) (x1', m1')\" \"t \\ (x1, shr s1) \\ (x2, m2)\"\n and \"thr s1 t = \\(x1, no_wait_locks)\\\" \"wset s1 t = None\"\n shows \"\\mRed1 s1 (redT_upd_\\ s1 t x1' m1')\"\nusing assms by(blast intro: r1.silent_moves_into_RedT_\\_inv)\n\nlemma red2_rtrancl_\\_into_RedT_\\:\n assumes \"r2.silent_moves t (x2, shr s2) (x2', m2')\"\n and \"t \\ (x1, m1) \\ (x2, shr s2)\" \"thr s2 t = \\(x2, no_wait_locks)\\\" \"wset s2 t = None\"\n shows \"\\mRed2 s2 (redT_upd_\\ s2 t x2' m2')\"\nusing assms by(blast intro: r2.silent_moves_into_RedT_\\_inv)\n\nlemma red1_rtrancl_\\_heapD:\n \"\\ r1.silent_moves t s1 s1'; t \\ s1 \\ s2 \\ \\ snd s1' = snd s1\"\nby(blast intro: r1.red_rtrancl_\\_heapD_inv)\n\nlemma red2_rtrancl_\\_heapD:\n \"\\ r2.silent_moves t s2 s2'; t \\ s1 \\ s2 \\ \\ snd s2' = snd s2\"\nby(blast intro: r2.red_rtrancl_\\_heapD_inv)\n\nlemma mbisim_simulation_silent1:\n assumes m\\': \"r1.mthr.silent_move s1 s1'\" and mbisim: \"s1 \\m s2\"\n shows \"\\s2'. r2.mthr.silent_moves s2 s2' \\ s1' \\m s2'\"\nproof -\n from m\\' obtain tl1 where m\\: \"m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\" by auto\n obtain ls1 ts1 m1 ws1 is1 where [simp]: \"s1 = (ls1, (ts1, m1), ws1, is1)\" by(cases s1) fastforce\n obtain ls1' ts1' m1' ws1' is1' where [simp]: \"s1' = (ls1', (ts1', m1'), ws1', is1')\" by(cases s1') fastforce\n obtain ls2 ts2 m2 ws2 is2 where [simp]: \"s2 = (ls2, (ts2, m2), ws2, is2)\" by(cases s2) fastforce\n from m\\ obtain t where \"tl1 = (t, \\)\" by(auto elim!: r1.m\\move.cases dest: r1.silent_tl)\n with m\\ have m\\: \"m\\move1 s1 (t, \\) s1'\" and redT1: \"s1 -1-t\\\\\\ s1'\" by simp_all\n from m\\ obtain x x' ln' where tst: \"ts1 t = \\(x, no_wait_locks)\\\"\n and ts't: \"ts1' t = \\(x', ln')\\\" and \\: \"\\move1 (x, m1) \\ (x', m1')\"\n by(fastforce elim: r1.m\\move.cases)\n from mbisim have [simp]: \"ls2 = ls1\" \"ws2 = ws1\" \"is2 = is1\" \"finite (dom ts1)\" by(auto simp add: mbisim_def)\n from redT1 show ?thesis\n proof cases\n case (redT_normal x1 x1' M')\n with tst ts't have [simp]: \"x = x1\" \"x' = x1'\"\n and red: \"t \\ (x1, m1) -1-\\\\ (x1', M')\"\n and tst: \"thr s1 t = \\(x1, no_wait_locks)\\\"\n and wst: \"wset s1 t = None\"\n and s1': \"redT_upd s1 t \\ x1' M' s1'\" by(auto)\n from s1' tst have [simp]: \"ls1' = ls1\" \"ws1' = ws1\" \"is1' = is1\" \"M' = m1'\" \"ts1' = ts1(t \\ (x1', no_wait_locks))\"\n by(auto simp add: redT_updLs_def redT_updLns_def o_def redT_updWs_def elim!: rtrancl3p_cases)\n from mbisim tst obtain x2 where tst': \"ts2 t = \\(x2, no_wait_locks)\\\"\n and bisim: \"t \\ (x1, m1) \\ (x2, m2)\" by(auto dest: mbisim_thrD1)\n from r1.\\move_heap[OF red] \\ have [simp]: \"m1 = M'\" by simp\n from red \\ have \"r1.silent_move t (x1, m1) (x1', M')\" by auto\n from simulation_silent1[OF bisim this]\n obtain x2' m2' where red: \"r2.silent_moves t (x2, m2) (x2', m2')\"\n and bisim': \"t \\ (x1', m1) \\ (x2', m2')\" by auto\n from red bisim have [simp]: \"m2' = m2\" \n by(auto dest: red2_rtrancl_\\_heapD)\n let ?s2' = \"redT_upd_\\ s2 t x2' m2'\"\n from red tst' wst bisim have \"\\mRed2 s2 ?s2'\"\n by -(rule red2_rtrancl_\\_into_RedT_\\, auto)\n moreover have \"mbisim s1' ?s2'\"\n proof(rule mbisimI)\n show \"locks s1' = locks ?s2'\" \"wset s1' = wset ?s2'\" \"interrupts s1' = interrupts ?s2'\" by auto\n next\n fix t'\n assume \"thr s1' t' = None\"\n hence \"ts1 t' = None\" by(auto split: split_if_asm)\n with mbisim_thrNone_eq[OF mbisim] have \"ts2 t' = None\" by simp\n with tst' show \"thr ?s2' t' = None\" by auto\n next\n fix t' X1 LN\n assume ts't': \"thr s1' t' = \\(X1, LN)\\\"\n show \"\\x2. thr ?s2' t' = \\(x2, LN)\\ \\ t' \\ (X1, shr s1') \\ (x2, shr ?s2') \\ (wset ?s2' t' = None \\ X1 \\w x2)\"\n proof(cases \"t' = t\")\n case True\n note this[simp]\n with s1' tst ts't' have [simp]: \"X1 = x1'\" \"LN = no_wait_locks\"\n by(simp_all)(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n with bisim' tst' wst show ?thesis by(auto simp add: redT_updLns_def o_def finfun_Diag_const2)\n next\n case False\n with ts't' have \"ts1 t' = \\(X1, LN)\\\" by auto\n with mbisim obtain X2 where \"ts2 t' = \\(X2, LN)\\\" \"t' \\ (X1, m1) \\ (X2, m2)\" \"ws1 t' = None \\ X1 \\w X2\"\n by(auto dest: mbisim_thrD1)\n with False show ?thesis by auto\n qed\n next\n show \"finite (dom (thr s1'))\" by simp\n next\n from mbisim_wset_thread_ok1[OF mbisim]\n show \"wset_thread_ok (wset s1') (thr s1')\" by(auto intro: wset_thread_ok_upd)\n qed\n ultimately show ?thesis by(auto)\n next\n case redT_acquire\n with tst have False by auto\n thus ?thesis ..\n qed\nqed\n\nlemma mbisim_simulation_silent2:\n \"\\ mbisim s1 s2; r2.mthr.silent_move s2 s2' \\\n \\ \\s1'. r1.mthr.silent_moves s1 s1' \\ mbisim s1' s2'\"\nusing FWdelay_bisimulation_diverge.mbisim_simulation_silent1[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps .\n\nlemma mbisim_simulation1':\n assumes mbisim: \"mbisim s1 s2\" and \"\\ m\\move1 s1 tl1 s1'\" \"r1.redT s1 tl1 s1'\"\n shows \"\\s2' s2'' tl2. r2.mthr.silent_moves s2 s2' \\ r2.redT s2' tl2 s2'' \\\n \\ m\\move2 s2' tl2 s2'' \\ mbisim s1' s2'' \\ mta_bisim tl1 tl2\"\nusing mbisim_simulation1 assms .\n\nlemma mbisim_simulation2':\n \"\\ mbisim s1 s2; r2.redT s2 tl2 s2'; \\ m\\move2 s2 tl2 s2' \\\n \\ \\s1' s1'' tl1. r1.mthr.silent_moves s1 s1' \\ r1.redT s1' tl1 s1'' \\ \\ m\\move1 s1' tl1 s1'' \\\n mbisim s1'' s2' \\ mta_bisim tl1 tl2\"\nusing FWdelay_bisimulation_diverge.mbisim_simulation1'[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps .\n\nlemma m\\diverge_simulation1:\n assumes \"s1 \\m s2\"\n and \"r1.mthr.\\diverge s1\"\n shows \"r2.mthr.\\diverge s2\"\nproof -\n from `s1 \\m s2` have \"finite (dom (thr s1))\"\n by(rule mbisim_finite1)+\n from r1.\\diverge_\\mredTD[OF `r1.mthr.\\diverge s1` this]\n obtain t x where \"thr s1 t = \\(x, no_wait_locks)\\\" \"wset s1 t = None\" \"r1.\\diverge t (x, shr s1)\" by blast\n from `s1 \\m s2` `thr s1 t = \\(x, no_wait_locks)\\` obtain x'\n where \"thr s2 t = \\(x', no_wait_locks)\\\" \"t \\ (x, shr s1) \\ (x', shr s2)\"\n by(auto dest: mbisim_thrD1)\n from `s1 \\m s2` `wset s1 t = None` have \"wset s2 t = None\" by(simp add: mbisim_def)\n from `t \\ (x, shr s1) \\ (x', shr s2)` `r1.\\diverge t (x, shr s1)`\n have \"r2.\\diverge t (x', shr s2)\" by(simp add: \\diverge_bisim_inv)\n thus ?thesis using `thr s2 t = \\(x', no_wait_locks)\\` `wset s2 t = None`\n by(rule r2.\\diverge_into_\\mredT)\nqed\n\nlemma \\diverge_mbisim_inv:\n \"s1 \\m s2 \\ r1.mthr.\\diverge s1 \\ r2.mthr.\\diverge s2\"\napply(rule iffI)\n apply(erule (1) m\\diverge_simulation1)\nby(rule FWdelay_bisimulation_diverge.m\\diverge_simulation1[OF FWdelay_bisimulation_diverge_flip, unfolded flip_simps])\n\nlemma mbisim_delay_bisimulation:\n \"delay_bisimulation_diverge r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\"\napply(unfold_locales)\napply(rule mbisim_simulation1 mbisim_simulation2 mbisim_simulation_silent1 mbisim_simulation_silent2 \\diverge_mbisim_inv|assumption)+\ndone\n\ntheorem mdelay_bisimulation_final_base:\n \"delay_bisimulation_final_base r1.redT r2.redT mbisim m\\move1 m\\move2 r1.mfinal r2.mfinal\"\napply(unfold_locales)\napply(blast dest: mfinal1_simulation mfinal2_simulation)+\ndone\n\nend\n\nsublocale FWdelay_bisimulation_diverge < mthr!: delay_bisimulation_diverge r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2\nby(rule mbisim_delay_bisimulation)\n\nsublocale FWdelay_bisimulation_diverge <\n mthr!: delay_bisimulation_final_base r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\nby(rule mdelay_bisimulation_final_base)\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma mthr_delay_bisimulation_diverge_final:\n \"delay_bisimulation_diverge_final r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\"\nby(unfold_locales)\n\nend\n\nsublocale FWdelay_bisimulation_diverge <\n mthr!: delay_bisimulation_diverge_final r1.redT r2.redT mbisim mta_bisim m\\move1 m\\move2 r1.mfinal r2.mfinal\nby(rule mthr_delay_bisimulation_diverge_final)\n\nsubsection {* Strong bisimulation as corollary *}\n\nlocale FWbisimulation = FWbisimulation_base _ _ _ r2 convert_RA bisim \"\\x1 x2. True\" +\n r1!: multithreaded final1 r1 convert_RA +\n r2!: multithreaded final2 r2 convert_RA\n for r2 :: \"('l,'t,'x2,'m2,'w,'o) semantics\" (\"_ \\ _ -2-_\\ _\" [50,0,0,50] 80)\n and convert_RA :: \"'l released_locks \\ 'o list\"\n and bisim :: \"'t \\ ('x1 \\ 'm1, 'x2 \\ 'm2) bisim\" (\"_ \\ _/ \\ _\" [50, 50, 50] 60) +\n assumes bisimulation_locale: \"bisimulation (r1 t) (r2 t) (bisim t) (ta_bisim bisim)\"\n and bisim_final: \"t \\ (x1, m1) \\ (x2, m2) \\ final1 x1 \\ final2 x2\"\n and bisim_inv_red_other:\n \"\\ t' \\ (x, m1) \\ (xx, m2); t \\ (x1, m1) \\ (x2, m2); \n t \\ (x1, m1) -1-ta1\\ (x1', m1'); t \\ (x2, m2) -2-ta2\\ (x2', m2'); \n t \\ (x1', m1') \\ (x2', m2'); ta_bisim bisim ta1 ta2 \\\n \\ t' \\ (x, m1') \\ (xx, m2')\"\n and ex_final1_conv_ex_final2:\n \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\"\n\nsublocale FWbisimulation < bisim: bisimulation \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" for t\nby(rule bisimulation_locale)\n\nsublocale FWbisimulation < bisim_diverge:\n FWdelay_bisimulation_diverge final1 r1 final2 r2 convert_RA bisim \"\\x1 x2. True\" \"\\s ta s'. False\" \"\\s ta s'. False\"\nproof -\n interpret biw: bisimulation_into_delay \"r1 t\" \"r2 t\" \"bisim t\" \"ta_bisim bisim\" \"\\s ta s'. False\" \"\\s ta s'. False\"\n for t\n by(unfold_locales) simp\n show \"FWdelay_bisimulation_diverge final1 r1 final2 r2 bisim (\\x1 x2. True) (\\s ta s'. False) (\\s ta s'. False)\"\n proof(unfold_locales)\n fix t' x m1 xx m2 x1 x2 t x1' ta1 x1'' m1' x2' ta2 x2'' m2'\n assume bisim: \"t' \\ (x, m1) \\ (xx, m2)\" and bisim12: \"t \\ (x1, m1) \\ (x2, m2)\"\n and \\1: \"\\trsys.silent_moves (r1 t) (\\s ta s'. False) (x1, m1) (x1', m1)\" \n and red1: \"t \\ (x1', m1) -1-ta1\\ (x1'', m1')\"\n and \\2: \"\\trsys.silent_moves (r2 t) (\\s ta s'. False) (x2, m2) (x2', m2)\"\n and red2: \"t \\ (x2', m2) -2-ta2\\ (x2'', m2')\"\n and bisim12': \"t \\ (x1'', m1') \\ (x2'', m2')\" and tasim: \"ta1 \\m ta2\"\n from \\1 \\2 have [simp]: \"x1' = x1\" \"x2' = x2\" by(simp_all add: rtranclp_False \\moves_False)\n from bisim12 bisim_inv_red_other[OF bisim _ red1 red2 bisim12' tasim]\n show \"t' \\ (x, m1') \\ (xx, m2')\" by simp\n next\n fix t x1 m1 x2 m2 ta1 x1' m1'\n assume \"t \\ (x1, m1) \\ (x2, m2)\" \"t \\ (x1, m1) -1-ta1\\ (x1', m1')\"\n from simulation1[OF this]\n show \"\\ta2 x2' m2'. t \\ (x2, m2) -2-ta2\\ (x2', m2') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta1 \\m ta2\"\n by auto\n next\n fix t x1 m1 x2 m2 ta2 x2' m2'\n assume \"t \\ (x1, m1) \\ (x2, m2)\" \"t \\ (x2, m2) -2-ta2\\ (x2', m2')\"\n from simulation2[OF this]\n show \"\\ta1 x1' m1'. t \\ (x1, m1) -1-ta1\\ (x1', m1') \\ t \\ (x1', m1') \\ (x2', m2') \\ ta1 \\m ta2\"\n by auto\n next\n show \"(\\x1. final1 x1) \\ (\\x2. final2 x2)\" by(rule ex_final1_conv_ex_final2)\n qed(fastforce simp add: bisim_final)+\nqed\n\ncontext FWbisimulation begin\n\nlemma FWbisimulation_flip: \"FWbisimulation final2 r2 final1 r1 (\\t. flip (bisim t))\"\napply(rule FWbisimulation.intro)\n apply(rule r2.multithreaded_axioms)\n apply(rule r1.multithreaded_axioms)\napply(rule FWbisimulation_axioms.intro)\n apply(unfold flip_simps)\n apply(rule bisimulation_axioms)\n apply(erule bisim_final[symmetric])\n apply(erule (5) bisim_inv_red_other)\napply(rule ex_final1_conv_ex_final2[symmetric])\ndone\n\nend\n\n\n\ncontext FWbisimulation begin\n\ntext {*\n The notation for mbisim is lost because @{term \"bisim_wait\"} is instantiated to @{term \"\\x1 x2. True\"}.\n This reintroduces the syntax, but it does not work for output mode. This would require a new abbreviation.\n*}\nnotation mbisim (\"_ \\m _\" [50, 50] 60)\n\ntheorem mbisim_bisimulation:\n \"bisimulation r1.redT r2.redT mbisim mta_bisim\"\nproof\n fix s1 s2 tta1 s1'\n assume mbisim: \"s1 \\m s2\" and \"r1.redT s1 tta1 s1'\"\n from mthr.simulation1[OF this]\n show \"\\s2' tta2. r2.redT s2 tta2 s2' \\ s1' \\m s2' \\ tta1 \\T tta2\"\n by(auto simp add: \\moves_False m\\move_False)\nnext\n fix s2 s1 tta2 s2'\n assume \"s1 \\m s2\" and \"r2.redT s2 tta2 s2'\"\n from mthr.simulation2[OF this]\n show \"\\s1' tta1. r1.redT s1 tta1 s1' \\ s1' \\m s2' \\ tta1 \\T tta2\"\n by(auto simp add: \\moves_False m\\move_False)\nqed\n\nlemma mbisim_wset_eq:\n \"s1 \\m s2 \\ wset s1 = wset s2\"\nby(simp add: mbisim_def)\n\nlemma mbisim_mfinal:\n \"s1 \\m s2 \\ r1.mfinal s1 \\ r2.mfinal s2\"\napply(auto intro!: r2.mfinalI r1.mfinalI dest: mbisim_thrD2 mbisim_thrD1 bisim_final elim: r1.mfinalE r2.mfinalE)\napply(frule (1) mbisim_thrD2, drule mbisim_wset_eq, auto elim: r1.mfinalE)\napply(frule (1) mbisim_thrD1, drule mbisim_wset_eq, auto elim: r2.mfinalE)\ndone\n\nend\n\nsublocale FWbisimulation < mthr!: bisimulation r1.redT r2.redT mbisim mta_bisim\nby(rule mbisim_bisimulation)\n\nsublocale FWbisimulation < mthr!: bisimulation_final r1.redT r2.redT mbisim mta_bisim r1.mfinal r2.mfinal\nby(unfold_locales)(rule mbisim_mfinal)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Framework/FWBisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.34158249273565866, "lm_q1q2_score": 0.17345964244123263}} {"text": "(* Title: JinjaThreads/Framework/FWLockingThread.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Semantics of the thread action ReleaseAcquire for the thread state} *}\n\ntheory FWLockingThread\nimports\n FWLocking\nbegin\n\nfun upd_threadR :: \"nat \\ 't lock \\ 't \\ lock_action \\ nat\"\nwhere\n \"upd_threadR n l t ReleaseAcquire = n + has_locks l t\"\n| \"upd_threadR n l t _ = n\"\n\nprimrec upd_threadRs :: \"nat \\ 't lock \\ 't \\ lock_action list \\ nat\"\nwhere\n \"upd_threadRs n l t [] = n\"\n| \"upd_threadRs n l t (la # las) = upd_threadRs (upd_threadR n l t la) (upd_lock l t la) t las\"\n\nlemma upd_threadRs_append [simp]:\n \"upd_threadRs n l t (las @ las') = upd_threadRs (upd_threadRs n l t las) (upd_locks l t las) t las'\"\nby(induct las arbitrary: n l, auto)\n\ndefinition redT_updLns :: \"('l,'t) locks \\ 't \\ ('l \\f nat) \\ 'l lock_actions \\ ('l \\f nat)\"\nwhere \"redT_updLns ls t ln las = (\\(l, n, la). upd_threadRs n l t la) \\$ ($ls, ($ln, las$)$)\"\n\nlemma redT_updLns_iff [simp]:\n \"redT_updLns ls t ln las $ l = upd_threadRs (ln $ l) (ls $ l) t (las $ l)\"\nby(simp add: redT_updLns_def)\n\nlemma upd_threadRs_comp_empty [simp]: \"(\\(l, n, las). upd_threadRs n l t las) \\$ ($ls, ($lns, K$ []$)$) = lns\"\nby(auto intro!: finfun_ext)\n\nlemma redT_updLs_empty [simp]: \"redT_updLs ls t (K$ []) = ls\"\nby(simp add: redT_updLs_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Framework/FWLockingThread.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3380771308191988, "lm_q1q2_score": 0.17299968151092637}} {"text": "theory BigStepSimple\n imports \"../Analysis_More\"\nbegin\n\n\nsubsection \\Syntax\\\n\ntext \\Channel names\\\ntype_synonym cname = string\n\ntext \\Process names\\\ntype_synonym pname = string\n\ntext \\Ready information.\n First component is set of channels that are ready to output.\n Second component is set of channels that are ready to input.\\\ntype_synonym rdy_info = \"cname set \\ cname set\"\n\ntext \\Communications\\\ndatatype comm =\n Send cname exp (\"_[!]_\" [110,108] 100)\n| Receive cname var (\"_[?]_\" [110,108] 100)\n\ntext \\HCSP processes\\\ndatatype proc =\n Cm comm\n| Skip\n| Assign var exp (\"_ ::= _\" [99,95] 94)\n| Seq proc proc (\"_; _\" [91,90] 90)\n| Cond fform proc proc (\"IF _ THEN _ ELSE _ FI\" [95,94] 93)\n| Wait exp \\ \\Waiting for a specified amount of time\\\n| IChoice proc proc \\ \\Nondeterminism\\\n| EChoice \"(comm \\ proc) list\" \\ \\External choice\\\n| Rep proc \\ \\Nondeterministic repetition\\\n| Cont ODE fform \\ \\ODE with boundary\\\n| Interrupt ODE fform \"(comm \\ proc) list\" \\ \\Interrupt\\\n\ntext \\Parallel of several HCSP processes\\\ndatatype pproc =\n Single pname proc\n| Parallel pproc \"cname set\" pproc\n\nfun proc_of_pproc :: \"pproc \\ pname set\" where\n \"proc_of_pproc (Single pn c) = {pn}\"\n| \"proc_of_pproc (Parallel p1 chs p2) = proc_of_pproc p1 \\ proc_of_pproc p2\"\n\n\ntext \\Global states\\\ntype_synonym gstate = \"pname \\ state option\"\n\ndefinition State :: \"pname \\ state \\ gstate\" where\n \"State p s = (\\p'. if p' = p then Some s else None)\"\n\nsubsection \\Traces\\\n\ndatatype comm_type = In | Out\n\ndatatype trace_block =\n CommBlock comm_type cname real\n| WaitBlock real \"real \\ state\" rdy_info\n\nabbreviation \"InBlock ch v \\ CommBlock In ch v\"\nabbreviation \"OutBlock ch v \\ CommBlock Out ch v\"\n\ntype_synonym trace = \"trace_block list\"\n\n\nsubsection \\Big-step semantics\\\n\ntext \\Compute list of ready communications for an external choice.\\\nfun rdy_of_echoice :: \"(comm \\ proc) list \\ rdy_info\" where\n \"rdy_of_echoice [] = ({}, {})\"\n| \"rdy_of_echoice ((ch[!]e, _) # rest) = (\n let rdy = rdy_of_echoice rest in\n (insert ch (fst rdy), snd rdy))\"\n| \"rdy_of_echoice ((ch[?]var, _) # rest) = (\n let rdy = rdy_of_echoice rest in\n (fst rdy, insert ch (snd rdy)))\"\n\ntext \\big_step p s1 tr s2 means executing p starting from state s1 results\nin a trace tr and final state s2.\\\ninductive big_step :: \"proc \\ state \\ trace \\ state \\ bool\" where\n skipB: \"big_step Skip s [] s\"\n| assignB: \"big_step (var ::= e) s [] (s(var := e s))\"\n| seqB: \"big_step p1 s1 tr1 s2 \\\n big_step p2 s2 tr2 s3 \\\n big_step (p1; p2) s1 (tr1 @ tr2) s3\"\n| condB1: \"b s1 \\ big_step p1 s1 tr s2 \\ big_step (IF b THEN p1 ELSE p2 FI) s1 tr s2\"\n| condB2: \"\\ b s1 \\ big_step p2 s1 tr s2 \\ big_step (IF b THEN p1 ELSE p2 FI) s1 tr s2\"\n| waitB1: \"e s > 0 \\ big_step (Wait e) s [WaitBlock (e s) (\\_. s) ({}, {})] s\"\n| waitB2: \"\\ e s > 0 \\ big_step (Wait e) s [] s\"\n| sendB1: \"big_step (Cm (ch[!]e)) s [OutBlock ch (e s)] s\"\n| sendB2: \"(d::real) > 0 \\ big_step (Cm (ch[!]e)) s\n [WaitBlock d (\\_. s) ({ch}, {}),\n OutBlock ch (e s)] s\"\n| receiveB1: \"big_step (Cm (ch[?]var)) s [InBlock ch v] (s(var := v))\"\n| receiveB2: \"(d::real) > 0 \\ big_step (Cm (ch[?]var)) s\n [WaitBlock d (\\_. s) ({}, {ch}),\n InBlock ch v] (s(var := v))\"\n| IChoiceB1: \"big_step p1 s1 tr s2 \\ big_step (IChoice p1 p2) s1 tr s2\"\n| IChoiceB2: \"big_step p2 s1 tr s2 \\ big_step (IChoice p1 p2) s1 tr s2\"\n| EChoiceSendB1: \"i < length cs \\ cs ! i = (Send ch e, p2) \\\n big_step p2 s1 tr2 s2 \\\n big_step (EChoice cs) s1 (OutBlock ch (e s1) # tr2) s2\"\n| EChoiceSendB2: \"(d::real) > 0 \\ i < length cs \\ cs ! i = (Send ch e, p2) \\\n big_step p2 s1 tr2 s2 \\\n big_step (EChoice cs) s1 (WaitBlock d (\\_. s1) (rdy_of_echoice cs) #\n OutBlock ch (e s1) # tr2) s2\"\n| EChoiceReceiveB1: \"i < length cs \\ cs ! i = (Receive ch var, p2) \\\n big_step p2 (s1(var := v)) tr2 s2 \\\n big_step (EChoice cs) s1 (InBlock ch v # tr2) s2\"\n| EChoiceReceiveB2: \"(d::real) > 0 \\ i < length cs \\ cs ! i = (Receive ch var, p2) \\\n big_step p2 (s1(var := v)) tr2 s2 \\\n big_step (EChoice cs) s1 (WaitBlock d (\\_. s1) (rdy_of_echoice cs) #\n InBlock ch v # tr2) s2\"\n| RepetitionB1: \"big_step (Rep p) s [] s\"\n| RepetitionB2: \"big_step p s1 tr1 s2 \\ big_step (Rep p) s2 tr2 s3 \\\n tr = tr1 @ tr2 \\\n big_step (Rep p) s1 tr s3\"\n| ContB1: \"\\b s \\ big_step (Cont ode b) s [] s\"\n| ContB2: \"d > 0 \\ ODEsol ode p d \\\n (\\t. t \\ 0 \\ t < d \\ b (p t)) \\\n \\b (p d) \\ p 0 = s1 \\\n big_step (Cont ode b) s1 [WaitBlock d (\\\\. p \\) ({}, {})] (p d)\"\n| InterruptSendB1: \"i < length cs \\ cs ! i = (Send ch e, p2) \\\n big_step p2 s tr2 s2 \\\n big_step (Interrupt ode b cs) s (OutBlock ch (e s) # tr2) s2\"\n| InterruptSendB2: \"d > 0 \\ ODEsol ode p d \\ p 0 = s1 \\\n (\\t. t \\ 0 \\ t < d \\ b (p t)) \\\n i < length cs \\ cs ! i = (Send ch e, p2) \\\n rdy = rdy_of_echoice cs \\\n big_step p2 (p d) tr2 s2 \\\n big_step (Interrupt ode b cs) s1 (WaitBlock d (\\\\. p \\) rdy #\n OutBlock ch (e (p d)) # tr2) s2\"\n| InterruptReceiveB1: \"i < length cs \\ cs ! i = (Receive ch var, p2) \\\n big_step p2 (s(var := v)) tr2 s2 \\\n big_step (Interrupt ode b cs) s (InBlock ch v # tr2) s2\"\n| InterruptReceiveB2: \"d > 0 \\ ODEsol ode p d \\ p 0 = s1 \\\n (\\t. t \\ 0 \\ t < d \\ b (p t)) \\\n i < length cs \\ cs ! i = (Receive ch var, p2) \\\n rdy = rdy_of_echoice cs \\\n big_step p2 ((p d)(var := v)) tr2 s2 \\\n big_step (Interrupt ode b cs) s1 (WaitBlock d (\\\\. p \\) rdy #\n InBlock ch v # tr2) s2\"\n| InterruptB1: \"\\b s \\ big_step (Interrupt ode b cs) s [] s\"\n| InterruptB2: \"d > 0 \\ ODEsol ode p d \\\n (\\t. t \\ 0 \\ t < d \\ b (p t)) \\\n \\b (p d) \\ p 0 = s1 \\ p d = s2 \\\n rdy = rdy_of_echoice cs \\\n big_step (Interrupt ode b cs) s1 [WaitBlock d (\\\\. p \\) rdy] s2\"\n\nlemma big_step_cong:\n \"big_step c s1 tr s2 \\ tr = tr' \\ s2 = s2' \\ big_step c s1 tr' s2'\"\n by auto\n\ninductive_cases skipE: \"big_step Skip s1 tr s2\"\ninductive_cases assignE: \"big_step (Assign var e) s1 tr s2\"\ninductive_cases sendE: \"big_step (Cm (ch[!]e)) s1 tr s2\"\ninductive_cases receiveE: \"big_step (Cm (ch[?]var)) s1 tr s2\"\ninductive_cases seqE: \"big_step (Seq p1 p2) s1 tr s2\"\ninductive_cases condE: \"big_step (Cond b p1 p2) s1 tr s2\"\ninductive_cases waitE: \"big_step (Wait d) s1 tr s2\"\ninductive_cases echoiceE: \"big_step (EChoice es) s1 tr s2\"\ninductive_cases ichoiceE: \"big_step (IChoice p1 p2) s1 tr s2\"\ninductive_cases contE: \"big_step (Cont ode b) s1 tr s2\"\ninductive_cases interruptE: \"big_step (Interrupt ode b cs) s1 tr s2\"\n\nsubsection \\Validity\\\n\ntext \\Assertion is a predicate on states and traces\\\n\ntype_synonym assn = \"state \\ trace \\ bool\"\ntype_synonym assn2 = \"state \\ assn\"\n\ndefinition emp :: assn where\n \"emp = (\\s tr. tr = [])\"\n\ndefinition Valid :: \"assn \\ proc \\ assn \\ bool\" (\"\\ ({(1_)}/ (_)/ {(1_)})\" 50) where\n \"\\ {P} c {Q} \\ (\\s1 tr1 s2 tr2. P s1 tr1 \\ big_step c s1 tr2 s2 \\ Q s2 (tr1 @ tr2))\"\n\ndefinition entails :: \"assn \\ assn \\ bool\" (infixr \"\\\\<^sub>A\" 25) where\n \"(P \\\\<^sub>A Q) \\ (\\s tr. P s tr \\ Q s tr)\"\n\ntheorem entails_triv:\n \"P \\\\<^sub>A P\"\n unfolding entails_def by auto\n\ndefinition forall_assn :: \"('a \\ assn) \\ assn\" (binder \"\\\\<^sub>a\" 10)where\n \"(\\\\<^sub>a n. P n) = (\\s tr. \\n. P n s tr)\"\n\ndefinition exists_assn :: \"('a \\ assn) \\ assn\" (binder \"\\\\<^sub>a\" 10)where\n \"(\\\\<^sub>a n. P n) = (\\s tr. \\n. P n s tr)\"\n\ntheorem strengthen_pre:\n \"\\ {P2} c {Q} \\ P1 \\\\<^sub>A P2 \\ \\ {P1} c {Q}\"\n unfolding Valid_def entails_def by metis\n\ntheorem weaken_post:\n \"\\ {P} c {Q1} \\ Q1 \\\\<^sub>A Q2 \\ \\ {P} c {Q2}\"\n unfolding Valid_def entails_def by metis\n\ntext \\Receive input, then state and trace satisfies P\\\ninductive wait_in_c :: \"cname \\ (real \\ real \\ assn2) \\ assn2\" where\n \"P 0 v s0 s tr \\ wait_in_c ch P s0 s (InBlock ch v # tr)\"\n| \"0 < d \\ P d v s0 s tr \\ wait_in_c ch P s0 s (WaitBlock d (\\_. s0) ({}, {ch}) # InBlock ch v # tr)\"\n\ndefinition subst_assn2 :: \"assn2 \\ var \\ (state \\ real) \\ assn2\" (\"_ {{_ := _}}\" [90,90,90] 91) where \n \"P {{var := e}} = (\\s0. P (s0(var := e s0)))\"\n\ndefinition init :: \"state \\ assn\" where\n \"init s0 = (\\s tr. s = s0 \\ tr = [])\"\n\ndefinition spec_of :: \"proc \\ assn2 \\ bool\" where\n \"spec_of c Q \\ (\\s0. \\ {init s0} c {Q s0})\"\n\nlemma spec_of_assign:\n \"spec_of (var ::= e) (\\s0 s tr. s = s0(var := e s0))\"\n unfolding Valid_def spec_of_def init_def\n by (auto elim!: assignE)\n\nlemma Valid_assign_sp:\n assumes \"spec_of c Q\"\n shows \"spec_of (var ::= e; c) (Q {{ var := e }})\"\n unfolding Valid_def spec_of_def\n apply (auto elim!: seqE assignE)\n using assms unfolding spec_of_def Valid_def init_def subst_assn2_def by auto\n\nlemma spec_of_skip:\n \"spec_of Skip init\"\n unfolding Valid_def spec_of_def\n by (auto elim: skipE)\n\nlemma spec_of_receive:\n \"spec_of (Cm (ch[?]var)) (wait_in_c ch (\\d v. init {{ var := (\\_. v) }}))\"\n unfolding Valid_def spec_of_def init_def subst_assn2_def\n apply (auto elim!: receiveE)\n apply (rule wait_in_c.intros(1)) apply auto[1]\n apply (rule wait_in_c.intros(2)) by auto\n\nlemma Valid_receive_sp:\n assumes \"spec_of c Q\"\n shows \"spec_of (Cm (ch[?]var); c)\n (wait_in_c ch (\\d v. Q {{ var := (\\_. v) }}))\"\n unfolding Valid_def spec_of_def init_def subst_assn2_def\n apply (auto elim!: seqE receiveE)\n apply (rule wait_in_c.intros(1))\n using Valid_def spec_of_def init_def assms apply auto[1]\n apply (rule wait_in_c.intros(2)) apply auto[1]\n using Valid_def spec_of_def init_def assms apply auto[1]\n done\n\ninductive wait_out_c :: \"cname \\ (state \\ real) \\ (real \\ assn2) \\ assn2\" where\n \"P 0 s0 s tr \\ wait_out_c ch e P s0 s (OutBlock ch (e s0) # tr)\"\n| \"0 < d \\ P d s0 s tr \\ wait_out_c ch e P s0 s (WaitBlock d (\\_. s0) ({ch}, {}) # OutBlock ch (e s0) # tr)\"\n\nlemma spec_of_send:\n \"spec_of (Cm (ch[!]e)) (wait_out_c ch e (\\d. init))\"\n unfolding Valid_def spec_of_def init_def\n apply (auto elim!: sendE)\n apply (rule wait_out_c.intros(1)) apply auto[1]\n apply (rule wait_out_c.intros(2)) by auto\n\nlemma Valid_send_sp:\n assumes \"spec_of c Q\"\n shows \"spec_of (Cm (ch[!]e); c)\n (wait_out_c ch e (\\d s0. Q s0))\"\n unfolding Valid_def spec_of_def init_def\n apply (auto elim!: seqE sendE)\n apply (rule wait_out_c.intros(1))\n using Valid_def spec_of_def init_def assms apply auto[1]\n apply (rule wait_out_c.intros(2)) apply auto[1]\n using Valid_def spec_of_def init_def assms apply auto[1]\n done\n\nlemma wait_in_c_exists:\n \"wait_in_c ch (\\d v s0. \\\\<^sub>a n. P d v s0 n) s0 = (\\\\<^sub>a n. wait_in_c ch (\\d v s0. P d v s0 n) s0)\"\n apply (rule ext) apply (rule ext)\n subgoal for s tr\n apply (rule iffI)\n subgoal unfolding exists_assn_def\n apply (induct rule: wait_in_c.cases) apply auto\n subgoal for v tr' n\n apply (rule exI[where x=n])\n apply (rule wait_in_c.intros(1)) by auto\n subgoal for d v tr' n\n apply (rule exI[where x=n])\n apply (rule wait_in_c.intros(2)) by auto\n done\n subgoal unfolding exists_assn_def\n apply auto subgoal for n\n apply (induction rule: wait_in_c.cases) apply auto\n subgoal for v tr'\n apply (rule wait_in_c.intros(1))\n apply (rule exI[where x=n]) by auto\n subgoal for d v tr'\n apply (rule wait_in_c.intros(2))\n apply simp apply (rule exI[where x=n]) by auto\n done\n done\n done\n done\n\nlemma wait_out_c_exists:\n \"wait_out_c ch e (\\d s0. \\\\<^sub>a n. P d s0 n) s0 = (\\\\<^sub>a n. wait_out_c ch e (\\d s0. P d s0 n) s0)\"\n apply (rule ext) apply (rule ext)\n subgoal for s tr\n apply (rule iffI)\n subgoal unfolding exists_assn_def\n apply (induct rule: wait_out_c.cases) apply auto\n subgoal for tr' n\n apply (rule exI[where x=n])\n apply (rule wait_out_c.intros(1)) by auto\n subgoal for d tr' n\n apply (rule exI[where x=n])\n apply (rule wait_out_c.intros(2)) by auto\n done\n subgoal unfolding exists_assn_def\n apply auto subgoal for n\n apply (induction rule: wait_out_c.cases) apply auto\n subgoal for tr'\n apply (rule wait_out_c.intros(1))\n apply (rule exI[where x=n]) by auto\n subgoal for d tr'\n apply (rule wait_out_c.intros(2))\n apply simp apply (rule exI[where x=n]) by auto\n done\n done\n done\n done\n\nsubsection \\Examples\\\n\ndefinition A :: char where \"A = CHR ''a''\"\ndefinition B :: char where \"B = CHR ''b''\"\ndefinition X :: char where \"X = CHR ''x''\"\ndefinition Y :: char where \"Y = CHR ''y''\"\ndefinition Z :: char where \"Z = CHR ''z''\"\n\nlemma ex1a_sp:\n \"spec_of (Cm (ch1[?]X); Cm (ch2[!](\\s. s X + 1)))\n (wait_in_c ch1 (\\d v. wait_out_c ch2 (\\s. s X + 1) (\\d. init) {{ X := (\\_. v) }}))\"\n apply (rule Valid_receive_sp)\n apply (rule spec_of_send)\n done\n\nlemma ex1b_sp:\n \"spec_of (Cm (ch1[!](\\_. 3)))\n (wait_out_c ch1 (\\_. 3) (\\d. init))\"\n apply (rule spec_of_send)\n done\n\nfun rinv_c :: \"nat \\ cname \\ (state \\ assn) \\ (state \\ assn)\" where\n \"rinv_c 0 ch Q = Q\"\n| \"rinv_c (Suc n) ch Q = wait_out_c ch (\\s. s A) (\\d. rinv_c n ch Q {{ B := (\\s0. s0 B + 1) }})\"\n\nlemma spec_of_post:\n \"spec_of c Q1 \\ \\s0. Q1 s0 \\\\<^sub>A Q2 s0 \\ spec_of c Q2\"\n unfolding spec_of_def using weaken_post by blast\n\nlemma entails_exists:\n assumes \"\\n. P \\\\<^sub>A Q n\"\n shows \"P \\\\<^sub>A (\\\\<^sub>a n. Q n)\"\n using assms unfolding exists_assn_def entails_def\n by auto\n\nfun RepN :: \"nat \\ proc \\ proc\" where\n \"RepN 0 c = Skip\"\n| \"RepN (Suc n) c = c; RepN n c\"\n\nlemma big_step_rep:\n \"big_step (Rep c) s1 tr1 s2 \\ (\\n. big_step (RepN n c) s1 tr1 s2)\"\nproof -\n have \"big_step p s1 tr1 s2 \\ p = Rep c \\ \\n. big_step (RepN n c) s1 tr1 s2\" for p s1 tr1 s2\n apply (induction rule: big_step.induct, auto)\n apply (rule exI[where x=0])\n apply simp apply (rule skipB)\n subgoal for s1 tr1 s2 tr2 s3 n\n apply (rule exI[where x=\"Suc n\"])\n apply simp apply (rule seqB) by auto\n done\n moreover have \"\\s1 tr1 s2. big_step (RepN n c) s1 tr1 s2 \\ big_step (Rep c) s1 tr1 s2\" for n\n apply (induction n)\n apply simp apply (elim skipE) apply (auto intro: RepetitionB1)[1]\n apply simp apply (elim seqE) apply (auto intro: RepetitionB2)\n done\n ultimately show ?thesis\n by auto\nqed\n\nlemma big_step_seq_assoc:\n \"big_step ((p1; p2); p3) s1 tr s2 \\ big_step (p1; p2; p3) s1 tr s2\"\n apply (rule iffI)\n subgoal apply (elim seqE)\n apply auto apply (rule seqB) apply auto\n apply (rule seqB) by auto\n subgoal apply (elim seqE)\n apply auto apply (subst append.assoc[symmetric])\n apply (rule seqB) apply (rule seqB) by auto\n done\n\nlemma spec_of_seq_assoc:\n \"spec_of ((p1; p2); p3) Q \\ spec_of (p1; p2; p3) Q\"\n unfolding spec_of_def Valid_def\n using big_step_seq_assoc by auto\n\nlemma spec_of_rep:\n assumes \"\\n. spec_of (RepN n c) (Q n)\"\n shows \"spec_of (Rep c) (\\s0. \\\\<^sub>a n. Q n s0)\"\n using assms unfolding spec_of_def Valid_def big_step_rep exists_assn_def\n by blast\n\nlemma ex3_c':\n \"spec_of (RepN n (Cm (ch1[!](\\s. s A)); B ::= (\\s. s B + 1)))\n (rinv_c n ch1 init)\"\n apply (induction n)\n apply simp apply (rule spec_of_skip)\n subgoal premises pre for n\n apply simp apply (rule spec_of_post)\n apply (subst spec_of_seq_assoc)\n apply (rule Valid_send_sp)\n apply (rule Valid_assign_sp)\n apply (rule pre) apply clarify\n by (rule entails_triv)\n done\n\nlemma ex3_c:\n \"spec_of (Rep (Cm (ch1[!](\\s. s A)); B ::= (\\s. s B + 1)))\n (\\s0. \\\\<^sub>an. rinv_c n ch1 init s0)\"\n apply (rule spec_of_rep)\n by (rule ex3_c')\n\nfun linv_c :: \"nat \\ cname \\ (state \\ assn) \\ (state \\ assn)\" where\n \"linv_c 0 ch Q = Q\"\n| \"linv_c (Suc n) ch Q = wait_in_c ch (\\d v. linv_c n ch Q {{Y := (\\s. s Y + s X)}} {{X := (\\_. v)}} )\"\n\nlemma ex4_c':\n \"spec_of (RepN n (Cm (ch1[?]X); Y ::= (\\s. s Y + s X)))\n (linv_c n ch1 init)\"\n apply (induction n)\n apply simp apply (rule spec_of_skip)\n subgoal premises pre for n\n apply simp apply (rule spec_of_post)\n apply (subst spec_of_seq_assoc)\n apply (rule Valid_receive_sp)\n apply (rule Valid_assign_sp)\n apply (rule pre) apply clarify\n apply (rule entails_triv)\n done\n done\n\nlemma ex4_c:\n \"spec_of (Rep (Cm (ch1[?]X); Y ::= (\\s. s Y + s X)))\n (\\s0. \\\\<^sub>an. linv_c n ch1 init s0)\"\n apply (rule spec_of_rep)\n by (rule ex4_c')\n\n\nsubsection \\Combining two traces\\\n\ntext \\Whether two rdy_infos from different processes are compatible.\\\nfun compat_rdy :: \"rdy_info \\ rdy_info \\ bool\" where\n \"compat_rdy (r11, r12) (r21, r22) = (r11 \\ r22 = {} \\ r12 \\ r21 = {})\"\n\ntext \\Merge two rdy infos\\\nfun merge_rdy :: \"rdy_info \\ rdy_info \\ rdy_info\" where\n \"merge_rdy (r11, r12) (r21, r22) = (r11 \\ r21, r12 \\ r22)\"\n\ndatatype ptrace_block = \n CommBlockP comm_type cname real\n| WaitBlockP real \"real \\ gstate\" rdy_info\n\nabbreviation \"InBlockP ch v \\ CommBlockP In ch v\"\nabbreviation \"OutBlockP ch v \\ CommBlockP Out ch v\"\n\ntype_synonym ptrace = \"ptrace_block list\"\n\ndefinition merge_state :: \"gstate \\ gstate \\ gstate\" where\n \"merge_state ps1 ps2 = (\\p. case ps1 p of None \\ ps2 p | Some s \\ Some s)\"\n\ntext \\combine_blocks comms tr1 tr2 tr means tr1 and tr2 combines to tr, where\n comms is the list of internal communication channels.\\\ninductive combine_blocks :: \"cname set \\ ptrace \\ ptrace \\ ptrace \\ bool\" where\n \\ \\Empty case\\\n combine_blocks_empty:\n \"combine_blocks comms [] [] []\"\n\n \\ \\Paired communication\\\n| combine_blocks_pair1:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (InBlockP ch v # blks1) (OutBlockP ch v # blks2) blks\"\n| combine_blocks_pair2:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (OutBlockP ch v # blks1) (InBlockP ch v # blks2) blks\"\n\n \\ \\Unpaired communication\\\n| combine_blocks_unpair1:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms (CommBlockP ch_type ch v # blks1) blks2 (CommBlockP ch_type ch v # blks)\"\n| combine_blocks_unpair2:\n \"ch \\ comms \\\n combine_blocks comms blks1 blks2 blks \\\n combine_blocks comms blks1 (CommBlockP ch_type ch v # blks2) (CommBlockP ch_type ch v # blks)\"\n\n \\ \\Wait\\\n| combine_blocks_wait1:\n \"combine_blocks comms blks1 blks2 blks \\\n compat_rdy rdy1 rdy2 \\\n hist = (\\\\. merge_state (hist1 \\) (hist2 \\)) \\\n rdy = merge_rdy rdy1 rdy2 \\\n combine_blocks comms (WaitBlockP t hist1 rdy1 # blks1)\n (WaitBlockP t hist2 rdy2 # blks2)\n (WaitBlockP t hist rdy # blks)\"\n| combine_blocks_wait2:\n \"combine_blocks comms blks1 (WaitBlockP (t2 - t1) (\\\\. hist2 (\\ + t1)) rdy2 # blks2) blks \\\n compat_rdy rdy1 rdy2 \\\n t1 < t2 \\ t1 > 0 \\\n hist = (\\\\. merge_state (hist1 \\) (hist2 \\)) \\\n rdy = merge_rdy rdy1 rdy2 \\\n combine_blocks comms (WaitBlockP t1 hist1 rdy1 # blks1)\n (WaitBlockP t2 hist2 rdy2 # blks2)\n (WaitBlockP t1 hist rdy # blks)\"\n| combine_blocks_wait3:\n \"combine_blocks comms (WaitBlockP (t1 - t2) (\\\\. hist1 (\\ + t2)) rdy1 # blks1) blks2 blks \\\n compat_rdy rdy1 rdy2 \\\n t1 > t2 \\ t2 > 0 \\\n hist = (\\\\. merge_state (hist1 \\) (hist2 \\)) \\\n rdy = merge_rdy rdy1 rdy2 \\\n combine_blocks comms (WaitBlockP t1 hist1 rdy1 # blks1)\n (WaitBlockP t2 hist2 rdy2 # blks2)\n (WaitBlockP t2 hist rdy # blks)\"\n\nfun ptrace_of :: \"pname \\ trace \\ ptrace\" where\n \"ptrace_of pn [] = []\"\n| \"ptrace_of pn (CommBlock ch_type ch v # tr) = CommBlockP ch_type ch v # ptrace_of pn tr\"\n| \"ptrace_of pn (WaitBlock d p rdy # tr) = WaitBlockP d (\\\\. State pn (p \\)) rdy # ptrace_of pn tr\"\n\ndefinition proc_set :: \"gstate \\ pname set\" where\n \"proc_set gs = {pn. gs pn \\ None}\"\n\ninductive par_big_step :: \"pproc \\ gstate \\ ptrace \\ gstate \\ bool\" where\n SingleB: \"big_step p s1 tr s2 \\ par_big_step (Single pn p) (State pn s1) (ptrace_of pn tr) (State pn s2)\"\n| ParallelB:\n \"par_big_step p1 s11 tr1 s12 \\\n par_big_step p2 s21 tr2 s22 \\\n proc_of_pproc p1 \\ proc_of_pproc p2 = {} \\\n combine_blocks chs tr1 tr2 tr \\\n par_big_step (Parallel p1 chs p2) (merge_state s11 s21) tr (merge_state s12 s22)\"\n\ninductive_cases SingleE: \"par_big_step (Single pn p) s1 tr s2\"\nthm SingleE\n\ninductive_cases ParallelE: \"par_big_step (Parallel p1 ch p2) s1 tr s2\"\nthm ParallelE\n\nlemma proc_set_State:\n \"proc_set (State pn s) = {pn}\"\n by (auto simp add: proc_set_def State_def)\n\nlemma proc_set_merge:\n \"proc_set (merge_state s1 s2) = proc_set s1 \\ proc_set s2\"\n apply (auto simp add: proc_set_def merge_state_def)\n subgoal for x y apply (cases \"s1 x\") by auto\n done\n\nlemma proc_set_big_step:\n \"par_big_step p s1 tr s2 \\ proc_set s1 = proc_of_pproc p \\ proc_set s2 = proc_of_pproc p\"\n apply (induction rule: par_big_step.induct)\n by (auto simp add: proc_set_State proc_set_merge)\n\n\ntext \\Assertion on global state\\\ntype_synonym gs_assn = \"gstate \\ bool\"\n\ntext \\Assertion on global state and trace\\\ntype_synonym gassn = \"gstate \\ ptrace \\ bool\"\n\ndefinition entails_g :: \"gassn \\ gassn \\ bool\" (infixr \"\\\\<^sub>g\" 25) where\n \"(P \\\\<^sub>g Q) \\ (\\s tr. P s tr \\ Q s tr)\"\n\nlemma entails_g_triv:\n \"P \\\\<^sub>g P\"\n unfolding entails_g_def by auto\n\nlemma entails_g_trans:\n \"P \\\\<^sub>g Q \\ Q \\\\<^sub>g R \\ P \\\\<^sub>g R\"\n unfolding entails_g_def by auto\n\ndefinition ParValid :: \"gs_assn \\ pproc \\ gassn \\ bool\" (\"\\\\<^sub>p ({(1_)}/ (_)/ {(1_)})\" 50) where\n \"(\\\\<^sub>p {P} c {Q}) \\ (\\s1 s2 tr2. P s1 \\ par_big_step c s1 tr2 s2 \\ Q s2 tr2)\"\n\ndefinition init_global :: \"gstate \\ gs_assn\" where\n \"init_global s0 = (\\s. s = s0)\"\n\nlemma init_global_parallel:\n \"init_global s0 (merge_state s1 s2) \\\n (\\s01 s02. s0 = merge_state s01 s02 \\ init_global s01 s1 \\ init_global s02 s2 \\ P) \\ P\"\n unfolding init_global_def by auto\n\ndefinition spec_of_global :: \"pproc \\ (gstate \\ gassn) \\ bool\" where\n \"spec_of_global c Q \\ (\\s0. \\\\<^sub>p {init_global s0} c {Q s0})\"\n\ninductive single_assn :: \"pname \\ (state \\ assn) \\ (gstate \\ gassn)\" where\n \"Q s s' tr \\ single_assn pn Q (State pn s) (State pn s') (ptrace_of pn tr)\"\n\ninductive sync_gassn :: \"cname set \\ pname set \\ pname set \\ (gstate \\ gassn) \\ (gstate \\ gassn) \\ (gstate \\ gassn)\" where\n \"proc_set s11 = pns1 \\ proc_set s12 = pns2 \\\n proc_set s21 = pns1 \\ proc_set s22 = pns2 \\\n P s11 s21 tr1 \\ Q s12 s22 tr2 \\\n combine_blocks chs tr1 tr2 tr \\\n sync_gassn chs pns1 pns2 P Q (merge_state s11 s12) (merge_state s21 s22) tr\"\n\nlemma spec_of_single:\n fixes Q :: \"state \\ assn\"\n assumes \"spec_of c Q\"\n shows \"spec_of_global (Single pn c) (single_assn pn Q)\"\n unfolding spec_of_global_def ParValid_def init_global_def apply auto\n apply (elim SingleE) \n using assms unfolding spec_of_def Valid_def init_def\n by (auto intro: single_assn.intros)\n\nlemma spec_of_parallel:\n fixes P Q :: \"gstate \\ gassn\"\n assumes \"spec_of_global p1 P\"\n and \"spec_of_global p2 Q\"\n and \"proc_of_pproc p1 = pns1\"\n and \"proc_of_pproc p2 = pns2\"\n shows \"spec_of_global (Parallel p1 chs p2) (sync_gassn chs pns1 pns2 P Q)\"\n unfolding spec_of_global_def ParValid_def apply auto\n apply (elim ParallelE) apply auto\n apply (elim init_global_parallel) apply (auto simp add: init_global_def)\n subgoal for tr' tr1 s12 tr2 s22 s01 s02\n apply (rule sync_gassn.intros)\n apply (auto simp add: assms(3,4) proc_set_big_step)\n using assms(1,2) unfolding spec_of_global_def ParValid_def init_global_def\n by (auto simp add: proc_set_merge elim: proc_set_big_step)\n done\n\nlemma weaken_post_global:\n \"\\\\<^sub>p {P} c {R} \\ R \\\\<^sub>g Q \\ \\\\<^sub>p {P} c {Q}\"\n unfolding ParValid_def entails_g_def by auto\n\nlemma spec_of_global_post:\n \"spec_of_global p Q1 \\ \\s0. Q1 s0 \\\\<^sub>g Q2 s0 \\ spec_of_global p Q2\"\n unfolding spec_of_global_def using weaken_post_global by blast\n\n\nsubsection \\Examples of using ParValid_parallel\\\n\nlemma ex1:\n \"spec_of_global\n (Parallel (Single ''a'' (Cm (ch1[?]X); Cm (ch2[!](\\s. s X + 1)))) {ch1}\n (Single ''b'' (Cm (ch1[!](\\_. 3)))))\n (sync_gassn {ch1} {''a''} {''b''}\n (single_assn ''a'' (wait_in_c ch1 (\\d v. wait_out_c ch2 (\\s. s X + 1) (\\d. init) {{ X := (\\_. v) }} )))\n (single_assn ''b'' (wait_out_c ch1 (\\_. 3) (\\d. init))))\"\n apply (rule spec_of_parallel)\n apply (rule spec_of_single)\n apply (rule ex1a_sp)\n apply (rule spec_of_single)\n apply (rule ex1b_sp)\n by auto\n\ninductive wait_in_cg :: \"cname \\ (real \\ real \\ gstate \\ gassn) \\ gstate \\ gassn\" where\n \"P 0 v s0 s tr \\ wait_in_cg ch P s0 s (InBlockP ch v # tr)\"\n| \"0 < d \\ P d v s0 s tr \\ wait_in_cg ch P s0 s (WaitBlockP d (\\_. s0) ({}, {ch}) # InBlockP ch v # tr)\"\n\nlemma single_assn_wait_in:\n \"single_assn pn (wait_in_c ch1 P) = wait_in_cg ch1 (\\d v. single_assn pn (P d v))\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s0 s tr\n apply (rule iffI)\n subgoal apply (elim single_assn.cases) apply auto\n subgoal for s0' s' tr'\n apply (elim wait_in_c.cases) apply auto\n by (auto intro: wait_in_cg.intros single_assn.intros)\n done\n subgoal apply (elim wait_in_cg.cases) apply auto\n subgoal for v tr'\n apply (elim single_assn.cases) apply auto\n subgoal for s0' s' tr''\n apply (subst ptrace_of.simps[symmetric])\n apply (rule single_assn.intros)\n apply (rule wait_in_c.intros) by auto\n done\n subgoal for d v tr'\n apply (elim single_assn.cases) apply auto\n subgoal for s0' s' tr''\n apply (simp only: ptrace_of.simps[symmetric])\n apply (rule single_assn.intros)\n apply (rule wait_in_c.intros) by auto\n done\n done\n done\n done\n\ninductive wait_out_cg :: \"cname \\ pname \\ (state \\ real) \\ (real \\ gstate \\ gassn) \\ gstate \\ gassn\" where\n \"P 0 s0 s tr \\ v = e (the (s0 pn)) \\ wait_out_cg ch pn e P s0 s (OutBlockP ch v # tr)\"\n| \"0 < d \\ P d s0 s tr \\ v = e (the (s0 pn)) \\\n wait_out_cg ch pn e P s0 s (WaitBlockP d (\\_. s0) ({ch}, {}) # OutBlockP ch v # tr)\"\n\nlemma single_assn_wait_out:\n \"single_assn pn (wait_out_c ch1 e P) = wait_out_cg ch1 pn e (\\d. single_assn pn (P d))\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s0 s tr\n apply (rule iffI)\n subgoal apply (elim single_assn.cases) apply auto\n apply (elim wait_out_c.cases) apply auto\n subgoal for s0' s' tr'\n apply (rule wait_out_cg.intros(1))\n apply (rule single_assn.intros)\n by (auto simp add: State_def)\n subgoal for d s0' s' tr'\n apply (rule wait_out_cg.intros(2)) apply simp\n apply (rule single_assn.intros)\n by (auto simp add: State_def)\n done\n subgoal apply (elim wait_out_cg.cases) apply auto\n subgoal for tr'\n apply (elim single_assn.cases) apply auto\n subgoal for s0' s' tr''\n apply (simp only: ptrace_of.simps[symmetric])\n apply (rule single_assn.intros) apply auto\n apply (simp add: State_def)\n apply (rule wait_out_c.intros) by auto\n done\n subgoal for d tr'\n apply (elim single_assn.cases) apply auto\n subgoal for s0' s' tr''\n apply (simp only: ptrace_of.simps[symmetric])\n apply (rule single_assn.intros) apply auto\n apply (simp add: State_def)\n apply (rule wait_out_c.intros) by auto\n done\n done\n done\n done\n\ndefinition single_subst :: \"pname \\ gstate \\ var \\ real \\ gstate\" where\n \"single_subst pn gs var val = gs (pn \\ ((the (gs pn)) (var := val)))\"\n\ndefinition single_subst_assn2 :: \"(gstate \\ gassn) \\ var \\ (state \\ real) \\ pname \\ (gstate \\ gassn)\"\n (\"_ {{_ := _}}\\<^sub>g at _\" [90,90,90,90] 91) where\n \"P {{var := e}}\\<^sub>g at pn = (\\ps s tr. ps pn \\ None \\ P (single_subst pn ps var (e (the (ps pn)))) s tr)\"\n\nlemma subst_State:\n \"State pn s(pn \\ s') = State pn s'\"\n by (auto simp add: State_def)\n\nlemma eval_State:\n \"State pn s pn = Some s\"\n by (auto simp add: State_def)\n\nlemma subst_State_elim:\n \"s0 pn = Some s0' \\ s0(pn \\ s1') = State pn s2' \\ s0 = State pn s0'\"\n apply (auto simp add: State_def fun_upd_def) by metis\n\nlemma single_subst_proc_set:\n assumes \"pn \\ proc_set gs\"\n shows \"proc_set (single_subst pn gs var e) = proc_set gs\"\n using assms by (auto simp add: single_subst_def proc_set_def)\n\nlemma single_assn_subst2:\n \"single_assn pn (P {{ var := e }}) = (single_assn pn P) {{ var := e }}\\<^sub>g at pn\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s0 s tr\n apply (rule iffI)\n subgoal apply (elim single_assn.cases)\n apply (auto simp add: single_subst_assn2_def single_subst_def subst_assn2_def subst_State eval_State)\n apply (rule single_assn.intros) by simp\n subgoal\n apply (auto simp add: single_subst_assn2_def single_subst_def subst_assn2_def)\n apply (elim single_assn.cases) apply auto\n subgoal premises pre for s0' s0'' s' tr'\n proof -\n have s0: \"s0 = State pn s0'\"\n apply (rule subst_State_elim) using pre by auto\n show ?thesis\n unfolding s0 apply (rule single_assn.intros)\n using pre by (metis eval_State map_upd_Some_unfold)\n qed\n done\n done\n done\n\ninductive init_single :: \"pname set \\ gstate \\ gassn\" where\n \"proc_set gs = pns \\ init_single pns gs gs []\"\n\nlemma proc_set_single_elim:\n assumes \"proc_set gs = {pn}\"\n and \"(\\s. gs = State pn s \\ P)\"\n shows \"P\"\nproof -\n have 1: \"x \\ proc_set gs \\ x = pn\" for x\n using eqset_imp_iff[OF assms(1)] by auto\n show ?thesis\n apply (rule assms(2)[of \"the (gs pn)\"])\n apply (rule ext) subgoal for pn'\n apply (auto simp add: State_def)\n using 1 apply (auto simp add: proc_set_def)\n by fastforce\n done\nqed\n\nlemma single_assn_init:\n \"single_assn pn init = init_single {pn}\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s0 s tr\n apply (rule iffI)\n subgoal apply (elim single_assn.cases)\n apply (auto simp add: init_def)\n apply (rule init_single.intros)\n by (auto simp add: proc_set_State)\n subgoal\n apply (elim init_single.cases) apply clarify\n apply (elim proc_set_single_elim) apply auto\n apply (subst ptrace_of.simps(1)[of pn, symmetric])\n apply (rule single_assn.intros)\n by (auto simp add: init_def)\n done\n done\n\nlemma ex1':\n \"spec_of_global\n (Parallel (Single ''a'' (Cm (ch1[?]X); Cm (ch2[!](\\s. s X + 1)))) {ch1}\n (Single ''b'' (Cm (ch1[!](\\_. 3)))))\n (sync_gassn {ch1} {''a''} {''b''}\n (wait_in_cg ch1 (\\d v. wait_out_cg ch2 ''a'' (\\s. s X + 1) (\\d. init_single {''a''}) {{X := (\\_. v)}}\\<^sub>g at ''a''))\n (wait_out_cg ch1 ''b'' (\\_. 3) (\\d. init_single {''b''})))\"\n apply (rule spec_of_global_post)\n apply (rule ex1) apply clarify subgoal for s0\n apply (auto simp: single_assn_wait_in single_assn_wait_out single_assn_subst2 single_assn_init)\n by (rule entails_g_triv)\n done\n\nsubsection \\Basic elimination rules\\\n\nnamed_theorems sync_elims\n\nlemma combine_blocks_pairE [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch1 \\ comms \\ ch2 \\ comms \\\n (\\tr'. ch1 = ch2 \\ v1 = v2 \\ (ch_type1 = In \\ ch_type2 = Out \\ ch_type1 = Out \\ ch_type2 = In) \\\n tr = tr' \\ combine_blocks comms tr1 tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_unpairE1 [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch1 \\ comms \\ ch2 \\ comms \\\n (\\tr'. tr = CommBlockP ch_type1 ch1 v1 # tr' \\\n combine_blocks comms tr1 (CommBlockP ch_type2 ch2 v2 # tr2) tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_unpairE1' [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch1 \\ comms \\ ch2 \\ comms \\\n (\\tr'. tr = CommBlockP ch_type2 ch2 v2 # tr' \\\n combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_unpairE2 [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch1 \\ comms \\ ch2 \\ comms \\\n (\\tr'. tr = CommBlockP ch_type1 ch1 v1 # tr' \\\n combine_blocks comms tr1 (CommBlockP ch_type2 ch2 v2 # tr2) tr' \\ P) \\\n (\\tr'. tr = CommBlockP ch_type2 ch2 v2 # tr' \\\n combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_pairE2 [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (WaitBlockP d2 p2 rdy2 # tr2) tr \\\n ch1 \\ comms \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_pairE2' [sync_elims]:\n \"combine_blocks comms (WaitBlockP d1 p1 rdy1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch2 \\ comms \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_unpairE3 [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) (WaitBlockP d2 p2 rdy2 # tr2) tr \\\n ch1 \\ comms \\\n (\\tr'. tr = CommBlockP ch_type1 ch1 v1 # tr' \\\n combine_blocks comms tr1 (WaitBlockP d2 p2 rdy2 # tr2) tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_unpairE3' [sync_elims]:\n \"combine_blocks comms (WaitBlockP d1 p1 rdy1 # tr1) (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n ch2 \\ comms \\\n (\\tr'. tr = CommBlockP ch_type2 ch2 v2 # tr' \\\n combine_blocks comms (WaitBlockP d1 p1 rdy1 # tr1) tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_waitE1 [sync_elims]:\n \"combine_blocks comms (WaitBlockP d1 p1 rdy1 # tr1) (WaitBlockP d2 p2 rdy2 # tr2) tr \\\n \\compat_rdy rdy1 rdy2 \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\n(*\nlemma combine_blocks_waitE2 [sync_elims]:\n \"combine_blocks comms (WaitBlk d p1 rdy1 # tr1) (WaitBlk d p2 rdy2 # tr2) tr \\\n compat_rdy rdy1 rdy2 \\\n (\\tr'. tr = WaitBlk d (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) # tr' \\\n combine_blocks comms tr1 tr2 tr' \\ P) \\ P\"\nproof (induct rule: combine_blocks.cases)\n case (combine_blocks_wait1 comms' blks1 blks2 blks rdy1' rdy2' hist hist1 hist2 rdy t)\n have a: \"d = t\" \"rdy1 = rdy1'\" \"rdy2 = rdy2'\" \"tr1 = blks1\" \"tr2 = blks2\" \n using combine_blocks_wait1(2,3) by (auto simp add: WaitBlk_cong)\n have b: \"WaitBlk d (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) =\n WaitBlk t (\\t. ParState (hist1 t) (hist2 t)) (merge_rdy rdy1' rdy2')\"\n apply (rule WaitBlk_eq_combine) using combine_blocks_wait1(2,3) by auto \n show ?case\n apply (rule combine_blocks_wait1)\n unfolding b using combine_blocks_wait1(4) unfolding a combine_blocks_wait1(7,8)\n by (auto simp add: combine_blocks_wait1(1,5))\nnext\n case (combine_blocks_wait2 comms blks1 t2 t1 hist2 rdy2 blks2 blks rdy1 hist hist1 rdy)\n have a: \"d = ereal t1\" \"d = t2\"\n using combine_blocks_wait2(2,3) by (auto simp add: WaitBlk_cong)\n show ?case\n using a combine_blocks_wait2(7) by auto\nnext\n case (combine_blocks_wait3 comms t1 t2 hist1 rdy1 blks1 blks2 blks rdy2 hist hist2 rdy)\n have a: \"d = ereal t2\" \"d = t1\"\n using combine_blocks_wait3(2,3) by (auto simp add: WaitBlk_cong)\n show ?case\n using a combine_blocks_wait3(7) by auto\nqed (auto)\n\nlemma combine_blocks_waitE3 [sync_elims]:\n \"combine_blocks comms (WaitBlk d1 p1 rdy1 # tr1) (WaitBlk d2 p2 rdy2 # tr2) tr \\\n 0 < d1 \\ d1 < d2 \\\n compat_rdy rdy1 rdy2 \\\n (\\tr'. tr = WaitBlk d1 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) # tr' \\\n combine_blocks comms tr1 (WaitBlk (d2 - d1) (\\t. p2 (t + d1)) rdy2 # tr2) tr' \\ P) \\ P\"\nproof (induct rule: combine_blocks.cases)\n case (combine_blocks_wait1 comms blks1 blks2 blks rdy1 rdy2 hist hist1 hist2 rdy t)\n have a: \"t = ereal d1\" \"t = d2\"\n using combine_blocks_wait1(2,3) WaitBlk_cong by blast+\n then show ?case\n using combine_blocks_wait1(10) by auto\nnext\n case (combine_blocks_wait2 comms' blks1 t2 t1 hist2 rdy2' blks2 blks rdy1' hist hist1 rdy)\n have a: \"d1 = t1\" \"d2 = t2\" \"rdy1 = rdy1'\" \"rdy2 = rdy2'\" \"tr1 = blks1\" \"tr2 = blks2\" \n using combine_blocks_wait2(2,3) using WaitBlk_cong by blast+\n have a2: \"WaitBlk d2 p2 rdy2 = WaitBlk d2 hist2 rdy2\"\n using combine_blocks_wait2(3) unfolding a[symmetric] by auto\n have a3: \"WaitBlk d1 p2 rdy2 = WaitBlk d1 hist2 rdy2\"\n \"WaitBlk (d2 - d1) (\\\\. p2 (\\ + d1)) rdy2 = WaitBlk (d2 - d1) (\\\\. hist2 (\\ + d1)) rdy2\"\n using WaitBlk_split[OF a2] combine_blocks_wait2 by auto\n have b: \"WaitBlk d1 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) =\n WaitBlk t1 (\\t. ParState (hist1 t) (hist2 t)) (merge_rdy rdy1' rdy2')\"\n apply (rule WaitBlk_eq_combine)\n using combine_blocks_wait2.hyps(2) a(1,4) a3 by auto\n show ?case\n apply (rule combine_blocks_wait2) unfolding a3 b\n using combine_blocks_wait2(4) unfolding combine_blocks_wait2(9,10)\n by (auto simp add: a combine_blocks_wait2(1,5))\nnext\n case (combine_blocks_wait3 comms t1 t2 hist1 rdy1 blks1 blks2 blks rdy2 hist hist2 rdy)\n have \"ereal d1 = t1\" \"d2 = ereal t2\"\n using combine_blocks_wait3(2,3) by (auto simp add: WaitBlk_cong)\n then show ?case\n using combine_blocks_wait3(7,12) by auto\nqed (auto)\n\nlemma combine_blocks_waitE4 [sync_elims]:\n \"combine_blocks comms (WaitBlk d1 p1 rdy1 # tr1) (WaitBlk d2 p2 rdy2 # tr2) tr \\\n 0 < d2 \\ d2 < d1 \\\n compat_rdy rdy1 rdy2 \\\n (\\tr'. tr = WaitBlk d2 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) # tr' \\\n combine_blocks comms (WaitBlk (d1 - d2) (\\t. p1 (t + d2)) rdy1 # tr1) tr2 tr' \\ P) \\ P\"\nproof (induct rule: combine_blocks.cases)\n case (combine_blocks_wait1 comms blks1 blks2 blks rdy1 rdy2 hist hist1 hist2 rdy t)\n have \"d1 = t\" \"ereal d2 = t\"\n using combine_blocks_wait1(2,3) by (auto simp add: WaitBlk_cong)\n then show ?case\n using combine_blocks_wait1(10) by auto\nnext\n case (combine_blocks_wait2 comms blks1 t2 t1 hist2 rdy2 blks2 blks rdy1 hist hist1 rdy)\n have \"d1 = ereal t1\" \"ereal d2 = t2\"\n using combine_blocks_wait2(2,3) by (auto simp add: WaitBlk_cong)\n then show ?case\n using combine_blocks_wait2(7,12) by auto\nnext\n case (combine_blocks_wait3 comms t1 t2 hist1 rdy1' blks1 blks2 blks rdy2' hist hist2 rdy)\n have a: \"d1 = t1\" \"d2 = t2\" \"rdy1 = rdy1'\" \"rdy2 = rdy2'\"\n \"tr1 = blks1\" \"tr2 = blks2\" \n using combine_blocks_wait3(2,3) using WaitBlk_cong by blast+\n have a2: \"WaitBlk d1 p1 rdy1 = WaitBlk d1 hist1 rdy1\"\n using combine_blocks_wait3(2) unfolding a[symmetric] by auto\n have a3: \"WaitBlk d2 p1 rdy1 = WaitBlk d2 hist1 rdy1\"\n \"WaitBlk (d1 - d2) (\\\\. p1 (\\ + d2)) rdy1 = WaitBlk (d1 - d2) (\\\\. hist1 (\\ + d2)) rdy1\"\n using WaitBlk_split[OF a2] combine_blocks_wait3 by auto\n have b: \"WaitBlk d2 (\\t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) =\n WaitBlk d2 (\\t. ParState (hist1 t) (hist2 t)) (merge_rdy rdy1' rdy2')\"\n apply (rule WaitBlk_eq_combine)\n using combine_blocks_wait3 a(2,3) a3 by auto\n show ?case\n apply (rule combine_blocks_wait3) unfolding a3 b\n using combine_blocks_wait3(4) unfolding combine_blocks_wait3(9,10)\n by (auto simp add: a combine_blocks_wait3)\nqed (auto)\n*)\n\nlemma combine_blocks_emptyE1 [sync_elims]:\n \"combine_blocks comms [] [] tr \\ tr = []\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_emptyE2 [sync_elims]:\n \"combine_blocks comms (WaitBlockP d1 p1 rdy1 # tr1) [] tr \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_emptyE2' [sync_elims]:\n \"combine_blocks comms [] (WaitBlockP d2 p2 rdy2 # tr2) tr \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_emptyE3 [sync_elims]:\n \"combine_blocks comms (CommBlockP ch_type1 ch1 v1 # tr1) [] tr \\\n (\\tr'. ch1 \\ comms \\ tr = CommBlockP ch_type1 ch1 v1 # tr' \\\n combine_blocks comms tr1 [] tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\nlemma combine_blocks_emptyE3' [sync_elims]:\n \"combine_blocks comms [] (CommBlockP ch_type2 ch2 v2 # tr2) tr \\\n (\\tr'. ch2 \\ comms \\ tr = CommBlockP ch_type2 ch2 v2 # tr' \\\n combine_blocks comms [] tr2 tr' \\ P) \\ P\"\n by (induct rule: combine_blocks.cases, auto)\n\n\nsubsection \\Synchronization of two assertions\\\n\nlemma merge_state_eval1:\n assumes \"pn \\ proc_set s11\"\n shows \"merge_state s11 s12 pn = s11 pn\"\n using assms by (auto simp add: merge_state_def proc_set_def)\n\nlemma merge_state_eval2:\n assumes \"pn \\ proc_set s12\"\n and \"proc_set s11 \\ proc_set s12 = {}\"\n shows \"merge_state s11 s12 pn = s12 pn\"\n using assms apply (auto simp add: merge_state_def proc_set_def)\n apply (cases \"s11 pn\") by auto\n\nlemma single_subst_merge_state1:\n assumes \"pn \\ proc_set s11\"\n shows \"single_subst pn (merge_state s11 s12) var e = merge_state (single_subst pn s11 var e) s12\"\n apply (auto simp add: single_subst_def merge_state_def)\n apply (rule ext) apply auto\n apply (cases \"s11 pn\") apply auto\n using assms unfolding proc_set_def by auto\n\nlemma single_subst_merge_state2:\n assumes \"pn \\ proc_set s12\"\n and \"proc_set s11 \\ proc_set s12 = {}\"\n shows \"single_subst pn (merge_state s11 s12) var e = merge_state s11 (single_subst pn s12 var e)\"\n apply (auto simp add: single_subst_def merge_state_def)\n apply (rule ext) apply auto\n subgoal apply (cases \"s11 pn\") \n using assms by (auto simp add: proc_set_def)\n subgoal for pn'\n apply (cases \"s11 pn'\") by auto\n done\n\nlemma sync_gassn_in_out:\n \"ch \\ chs \\\n pn \\ pns2 \\\n pns1 \\ pns2 = {} \\\n sync_gassn chs pns1 pns2 (wait_in_cg ch P) (wait_out_cg ch pn e Q) s0 \\\\<^sub>g\n sync_gassn chs pns1 pns2 (P 0 (e (the (s0 pn)))) (Q 0) s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim wait_in_cg.cases) apply auto\n subgoal for v tr1'\n apply (elim wait_out_cg.cases) apply auto\n subgoal for tr2'\n apply (elim combine_blocks_pairE)\n apply auto\n apply (rule sync_gassn.intros) apply auto\n apply (subst merge_state_eval2) by auto\n subgoal for d tr2'\n apply (elim sync_elims) by auto\n done\n subgoal for d v tr1'\n apply (elim wait_out_cg.cases) apply auto\n by (auto elim!: sync_elims)\n done\n done\n done\n\nlemma sync_gassn_out_in:\n \"ch \\ chs \\\n pn \\ pns1 \\\n pns1 \\ pns2 = {} \\\n sync_gassn chs pns1 pns2 (wait_out_cg ch pn e Q) (wait_in_cg ch P) s0 \\\\<^sub>g\n sync_gassn chs pns1 pns2 (Q 0) (P 0 (e (the (s0 pn)))) s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim wait_in_cg.cases) apply auto\n subgoal for v tr1'\n apply (elim wait_out_cg.cases) apply auto\n subgoal for tr2'\n apply (elim combine_blocks_pairE)\n apply auto\n apply (rule sync_gassn.intros) apply auto\n apply (subst merge_state_eval1) by auto\n subgoal for d tr2'\n apply (elim sync_elims) by auto\n done\n subgoal for d v tr1'\n apply (elim wait_out_cg.cases) apply auto\n by (auto elim!: sync_elims)\n done\n done\n done\n\nlemma sync_gassn_out_emp:\n \"ch \\ chs \\\n pn \\ pns1 \\\n sync_gassn chs pns1 pns2 (wait_out_cg ch pn e Q) (init_single pns2) s0 \\\\<^sub>g\n wait_out_cg ch pn e (\\d. sync_gassn chs pns1 pns2 (Q d) (init_single pns2)) s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim wait_out_cg.cases) apply auto\n subgoal for tr1'\n apply (elim init_single.cases) apply auto\n apply (elim sync_elims) apply auto\n subgoal for tr'\n apply (rule wait_out_cg.intros)\n apply (rule sync_gassn.intros) apply auto\n apply (rule init_single.intros) apply auto\n apply (subst merge_state_eval1) by auto\n done\n subgoal for d tr'\n apply (elim init_single.cases) apply auto\n by (elim sync_elims)\n done\n done\n done\n\nlemma sync_gassn_out_emp_unpair:\n \"ch \\ chs \\\n sync_gassn chs pns1 pns2 (wait_out_cg ch pn e Q) (init_single pns2) s0 \\\\<^sub>g P\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim wait_out_cg.cases) apply auto\n subgoal for tr1'\n apply (elim init_single.cases) apply auto\n apply (elim sync_elims) by auto\n subgoal for d tr1'\n apply (elim init_single.cases) apply auto\n by (elim sync_elims)\n done\n done\n done\n\nlemma sync_gassn_emp_in_unpair:\n \"ch \\ chs \\\n sync_gassn chs pns1 pns2 (init_single pns1) (wait_in_cg ch Q) s0 \\\\<^sub>g P\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim wait_in_cg.cases) apply auto\n subgoal for tr1'\n apply (elim init_single.cases) apply auto\n apply (elim sync_elims) by auto\n subgoal for d tr1'\n apply (elim init_single.cases) apply auto\n by (elim sync_elims)\n done\n done\n done\n\nlemma sync_gassn_subst_left:\n assumes \"pn \\ pns1\"\n shows \"sync_gassn chs pns1 pns2 (P {{ var := e }}\\<^sub>g at pn) Q s0 \\\\<^sub>g\n (sync_gassn chs pns1 pns2 P Q {{ var := e }}\\<^sub>g at pn) s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (auto simp add: single_subst_assn2_def)\n subgoal using assms merge_state_eval1 by auto\n subgoal for s11'\n apply (subst single_subst_merge_state1)\n using assms apply simp\n apply (rule sync_gassn.intros)\n using assms single_subst_proc_set apply auto\n by (simp add: merge_state_eval1)\n done\n done\n done\n\nlemma sync_gassn_subst_right:\n assumes \"pn \\ pns2\"\n and \"pns1 \\ pns2 = {}\"\n shows \"sync_gassn chs pns1 pns2 Q (P {{ var := e }}\\<^sub>g at pn) s0 \\\\<^sub>g\n (sync_gassn chs pns1 pns2 Q P {{ var := e }}\\<^sub>g at pn) s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (auto simp add: single_subst_assn2_def)\n subgoal using assms merge_state_eval2 by auto\n subgoal for s11'\n apply (subst single_subst_merge_state2)\n using assms apply auto\n apply (rule sync_gassn.intros)\n using assms single_subst_proc_set apply auto\n by (simp add: merge_state_eval2)\n done\n done\n done\n\nlemma sync_gassn_emp:\n assumes \"pns = pns1 \\ pns2\"\n shows \"sync_gassn chs pns1 pns2 (init_single pns1) (init_single pns2) s0 \\\\<^sub>g\n init_single pns s0\"\n unfolding entails_g_def apply auto\n subgoal for s tr\n apply (elim sync_gassn.cases) apply auto\n subgoal for s11 s12 s21 s22 tr1 tr2\n apply (elim init_single.cases) apply auto\n apply (frule combine_blocks_emptyE1) apply auto\n apply (rule init_single.intros)\n by (auto simp add: assms proc_set_merge)\n done\n done\n\nlemma gassn_subst:\n \"(P {{ var := e }}\\<^sub>g at pn) s0 \\\\<^sub>g P (single_subst pn s0 var (e (the (s0 pn))))\"\n unfolding entails_g_def\n by (auto simp add: single_subst_assn2_def)\n\nlemma wait_out_cg_entails:\n assumes \"\\d s0. P d s0 \\\\<^sub>g Q d s0\"\n shows \"wait_out_cg ch pn e P s0 \\\\<^sub>g wait_out_cg ch pn e Q s0\"\n apply (auto simp add: entails_g_def)\n subgoal for s tr\n apply (elim wait_out_cg.cases) apply auto\n subgoal apply (rule wait_out_cg.intros)\n using assms unfolding entails_g_def by auto\n subgoal apply (rule wait_out_cg.intros)\n using assms unfolding entails_g_def by auto\n done\n done\n\nlemma ex1'':\n \"spec_of_global\n (Parallel (Single ''a'' (Cm (''ch1''[?]X); Cm (''ch2''[!](\\s. s X + 1)))) {''ch1''}\n (Single ''b'' (Cm (''ch1''[!](\\_. 3)))))\n (\\s0. wait_out_cg ''ch2'' ''a'' (\\s. s X + 1) (\\d. init_single {''a'', ''b''})\n (single_subst ''a'' s0 X 3))\"\n apply (rule spec_of_global_post)\n apply (rule ex1') apply auto subgoal for s0\n apply (rule entails_g_trans)\n apply (rule sync_gassn_in_out) apply auto\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_left) apply simp\n apply (rule entails_g_trans)\n apply (rule gassn_subst)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_out_emp) apply auto\n apply (rule wait_out_cg_entails)\n subgoal for d s0\n apply (rule sync_gassn_emp) by auto\n done\n done\n\nlemma ex2_c:\n \"spec_of (Cm (ch1[!](\\s. s X)); Cm (ch2[?]Y))\n (wait_out_c ch1 (\\s. s X) (\\d. wait_in_c ch2 (\\d v. init {{Y := (\\_. v)}})))\"\n apply (rule Valid_send_sp)\n apply (rule spec_of_receive)\n done\n\nlemma ex2_c':\n \"spec_of (Cm (ch1[?]Z); Cm (ch2[!](\\s. s Z + 1)))\n (wait_in_c ch1 (\\d v. wait_out_c ch2 (\\s. s Z + 1) (\\d. init) {{Z := (\\_. v)}}))\"\n apply (rule Valid_receive_sp)\n apply (rule spec_of_send)\n done\n\nlemma ex2:\n \"spec_of_global\n (Parallel (Single ''a'' (Cm (''ch1''[!](\\s. s X)); Cm (''ch2''[?]Y)))\n {''ch1'', ''ch2''}\n (Single ''b'' (Cm (''ch1''[?]Z); Cm (''ch2''[!](\\s. s Z + 1)))))\n (\\s0. init_single {''b'', ''a''}\n (single_subst ''a'' (single_subst ''b'' s0 Z (the (s0 ''a'') X)) Y\n (the (s0 ''a'') X + 1)))\"\nproof -\n have eq: \"the (single_subst ''b'' s0 Z (the (s0 ''a'') X) ''b'') Z + 1 =\n the (s0 ''a'') X + 1\" for s0\n by (auto simp: single_subst_def)\n show ?thesis\n (* Stage 1: merge ex2_c and ex2_c' *)\n apply (rule spec_of_global_post)\n apply (rule spec_of_parallel)\n apply (rule spec_of_single)\n apply (rule ex2_c)\n apply (rule spec_of_single)\n apply (rule ex2_c')\n apply simp apply simp\n (* Stage 2: rewrite the assertions*)\n apply auto subgoal for s0\n apply (auto simp: single_assn_wait_in single_assn_wait_out single_assn_subst2 single_assn_init)\n (* Stage 3: combine the two assertions *)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_out_in) apply auto\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_right) apply auto\n apply (rule entails_g_trans)\n apply (rule gassn_subst)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_in_out) apply auto\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_left) apply auto\n apply (rule entails_g_trans)\n apply (rule gassn_subst)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_emp) apply simp\n apply (subst eq)\n by (rule entails_g_triv)\n done\nqed\n\ndefinition ex3_inv :: \"gstate \\ bool\" where\n \"ex3_inv s0 = (the (s0 ''b'') Y = the (s0 ''a'') A * the (s0 ''a'') B)\"\n\nlemma ex3':\n assumes \"ex3_inv s0\"\n shows\n \"\\s1. ex3_inv s1 \\\n (sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c (Suc n1) ''ch1'' init))\n (single_assn ''b'' (linv_c (Suc n2) ''ch1'' init)) s0 \\\\<^sub>g\n sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c n1 ''ch1'' init))\n (single_assn ''b'' (linv_c n2 ''ch1'' init)) s1)\"\nproof -\n have eq1: \"single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B\n (the (single_subst ''b'' s0 X (the (s0 ''a'') A) ''a'') B + 1) =\n single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1)\"\n unfolding single_subst_def\n by (simp add: A_def B_def X_def)\n have eq2: \"(single_subst ''b'' (single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1)) Y\n (the (single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1) ''b'') Y +\n the (single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1) ''b'') X)) =\n (single_subst ''b'' (single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1)) Y\n (the (s0 ''b'') Y + the (s0 ''a'') A))\"\n unfolding single_subst_def\n by (simp add: A_def B_def X_def Y_def)\n let ?s1 = \"single_subst ''b'' (single_subst ''a'' (single_subst ''b'' s0 X (the (s0 ''a'') A)) B (the (s0 ''a'') B + 1)) Y\n (the (s0 ''b'') Y + the (s0 ''a'') A)\"\n show ?thesis\n apply (rule exI[where x=\"?s1\"])\n apply (rule conjI)\n subgoal using assms unfolding single_subst_def ex3_inv_def\n apply (auto simp add: A_def B_def X_def Y_def)\n by (auto simp add: algebra_simps)\n subgoal\n apply simp\n apply (auto simp: single_assn_wait_in single_assn_wait_out single_assn_subst2)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_out_in) apply auto\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_right) apply auto\n apply (rule entails_g_trans)\n apply (rule gassn_subst)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_left) apply simp\n apply (rule entails_g_trans)\n apply (rule gassn_subst) apply (subst eq1)\n apply (rule entails_g_trans)\n apply (rule sync_gassn_subst_right) apply auto\n apply (rule entails_g_trans)\n apply (rule gassn_subst) apply (subst eq2)\n by (rule entails_g_triv)\n done\nqed\n\nlemma ex3'':\n \"ex3_inv s0 \\\n \\s1. ex3_inv s1 \\\n (sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c n1 ''ch1'' init))\n (single_assn ''b'' (linv_c n2 ''ch1'' init)) s0 \\\\<^sub>g\n init_single {''b'', ''a''} s1)\"\nproof (induction n1 n2 arbitrary: s0 rule: diff_induct)\n case (1 n1)\n show ?case\n proof (cases n1)\n case 0\n show ?thesis\n apply (subst 0)\n apply (rule exI[where x=s0])\n apply (rule conjI) using 1 apply simp\n apply (rule entails_g_trans)\n apply (auto simp add: single_assn_init)\n apply (rule sync_gassn_emp) apply auto\n by (rule entails_g_triv)\n next\n case (Suc n1)\n show ?thesis\n apply (subst Suc)\n apply (rule exI[where x=s0])\n apply (rule conjI) using 1 apply simp\n apply auto\n apply (auto simp add: single_assn_init single_assn_wait_out)\n apply (rule sync_gassn_out_emp_unpair)\n by auto\n qed\nnext\n case (2 y)\n show ?case\n apply (rule exI[where x=s0])\n apply (rule conjI) using 2 apply simp\n apply auto\n apply (auto simp add: single_assn_init single_assn_wait_in)\n apply (rule sync_gassn_emp_in_unpair)\n by auto\nnext\n case (3 n1 n2)\n obtain s1 where s1: \"ex3_inv s1\"\n \"sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c (Suc n1) ''ch1'' init))\n (single_assn ''b'' (linv_c (Suc n2) ''ch1'' init)) s0 \\\\<^sub>g\n sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c n1 ''ch1'' init))\n (single_assn ''b'' (linv_c n2 ''ch1'' init)) s1\"\n using ex3' 3 by blast\n obtain s2 where s2: \"ex3_inv s2\"\n \"sync_gassn {''ch1''} {''a''} {''b''} (single_assn ''a'' (rinv_c n1 ''ch1'' init))\n (single_assn ''b'' (linv_c n2 ''ch1'' init)) s1 \\\\<^sub>g\n init_single {''b'', ''a''} s2\"\n using 3 s1(1) by blast \n show ?case\n apply (rule exI[where x=s2])\n apply (rule conjI) apply (rule s2)\n apply (rule entails_g_trans)\n apply (rule s1)\n by (rule s2)\nqed\n\ndefinition exists_gassn :: \"('a \\ gassn) \\ gassn\" (binder \"\\\\<^sub>g\" 10)where\n \"(\\\\<^sub>g n. P n) = (\\s tr. \\n. P n s tr)\"\n\nlemma single_assn_exists:\n \"single_assn pn (\\s0. \\\\<^sub>an. P n s0) = (\\s0. (\\\\<^sub>g n. single_assn pn (P n) s0))\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s tr s0\n apply (rule iffI)\n apply (auto simp add: exists_gassn_def exists_assn_def)\n by (auto elim: single_assn.cases intro: single_assn.intros)\n done\n\nlemma sync_gassn_exists_left:\n \"sync_gassn chs pns1 pns2 (\\s0. \\\\<^sub>gn. P n s0) Q = (\\s0. \\\\<^sub>g n. sync_gassn chs pns1 pns2 (P n) Q s0)\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s tr s0\n apply (rule iffI)\n apply (auto simp add: exists_gassn_def)\n by (auto elim: sync_gassn.cases intro: sync_gassn.intros)\n done\n\nlemma sync_gassn_exists_right:\n \"sync_gassn chs pns1 pns2 P (\\s0. \\\\<^sub>gn. Q n s0) = (\\s0. \\\\<^sub>g n. sync_gassn chs pns1 pns2 P (Q n) s0)\"\n apply (rule ext) apply (rule ext) apply (rule ext)\n subgoal for s tr s0\n apply (rule iffI)\n apply (auto simp add: exists_gassn_def)\n by (auto elim: sync_gassn.cases intro: sync_gassn.intros)\n done\n\nlemma ex3''':\n \"spec_of_global\n (Parallel (Single ''a'' (Rep (Cm (ch1[!](\\s. s A)); B ::= (\\s. s B + 1))))\n {''ch1''}\n (Single ''b'' (Rep (Cm (ch1[?]X); Y ::= (\\s. s Y + s X)))))\n (\\s0. \\\\<^sub>gn1 n2. sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c n1 ch1 init))\n (single_assn ''b'' (linv_c n2 ch1 init)) s0)\"\n (* Stage 1: merge ex3_c and ex4_c *)\n apply (rule spec_of_global_post)\n apply (rule spec_of_parallel)\n apply (rule spec_of_single)\n apply (rule ex3_c)\n apply (rule spec_of_single)\n apply (rule ex4_c) apply auto\n apply (auto simp add: single_assn_exists sync_gassn_exists_left sync_gassn_exists_right)\n by (rule entails_g_triv)\n\ndefinition spec_of_global_gen :: \"(gstate \\ bool) \\ pproc \\ (gstate \\ gassn) \\ bool\" where\n \"spec_of_global_gen P c Q \\ (\\s0. P s0 \\ \\\\<^sub>p {init_global s0} c {Q s0})\"\n\nlemma ex3:\n \"ex3_inv s0 \\\n \\\\<^sub>p {init_global s0}\n (Parallel (Single ''a'' (Rep (Cm (''ch1''[!](\\s. s A)); B ::= (\\s. s B + 1))))\n {''ch1''}\n (Single ''b'' (Rep (Cm (''ch1''[?]X); Y ::= (\\s. s Y + s X)))))\n {\\\\<^sub>gs1. (\\s tr. ex3_inv s1 \\ init_single {''b'', ''a''} s1 s tr)}\"\n apply (rule weaken_post_global[where R=\"\\\\<^sub>gn1 n2. sync_gassn {''ch1''} {''a''} {''b''}\n (single_assn ''a'' (rinv_c n1 ''ch1'' init))\n (single_assn ''b'' (linv_c n2 ''ch1'' init)) s0\"])\n subgoal by (auto simp: ex3'''[unfolded spec_of_global_def])\n apply (auto simp add: exists_gassn_def entails_g_def)\n subgoal for s tr n1 n2\n using ex3''[of s0 n1 n2] unfolding entails_g_def\n by auto\n done\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/ext2/BigStepSimple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3380771308191988, "lm_q1q2_score": 0.17299968151092637}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_invs_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_invs_on_rules imports n_germanSimp_lemma_inv__1_on_rules n_germanSimp_lemma_inv__2_on_rules n_germanSimp_lemma_inv__3_on_rules n_germanSimp_lemma_inv__4_on_rules n_germanSimp_lemma_inv__5_on_rules n_germanSimp_lemma_inv__6_on_rules n_germanSimp_lemma_inv__7_on_rules n_germanSimp_lemma_inv__8_on_rules n_germanSimp_lemma_inv__9_on_rules n_germanSimp_lemma_inv__10_on_rules n_germanSimp_lemma_inv__11_on_rules n_germanSimp_lemma_inv__12_on_rules n_germanSimp_lemma_inv__13_on_rules n_germanSimp_lemma_inv__14_on_rules n_germanSimp_lemma_inv__15_on_rules n_germanSimp_lemma_inv__16_on_rules n_germanSimp_lemma_inv__17_on_rules n_germanSimp_lemma_inv__18_on_rules n_germanSimp_lemma_inv__19_on_rules n_germanSimp_lemma_inv__20_on_rules n_germanSimp_lemma_inv__21_on_rules n_germanSimp_lemma_inv__22_on_rules n_germanSimp_lemma_inv__23_on_rules n_germanSimp_lemma_inv__24_on_rules n_germanSimp_lemma_inv__25_on_rules n_germanSimp_lemma_inv__26_on_rules n_germanSimp_lemma_inv__27_on_rules n_germanSimp_lemma_inv__28_on_rules n_germanSimp_lemma_inv__29_on_rules n_germanSimp_lemma_inv__30_on_rules n_germanSimp_lemma_inv__31_on_rules n_germanSimp_lemma_inv__32_on_rules n_germanSimp_lemma_inv__33_on_rules n_germanSimp_lemma_inv__34_on_rules n_germanSimp_lemma_inv__35_on_rules n_germanSimp_lemma_inv__36_on_rules n_germanSimp_lemma_inv__37_on_rules n_germanSimp_lemma_inv__38_on_rules n_germanSimp_lemma_inv__39_on_rules n_germanSimp_lemma_inv__40_on_rules n_germanSimp_lemma_inv__41_on_rules n_germanSimp_lemma_inv__42_on_rules n_germanSimp_lemma_inv__43_on_rules n_germanSimp_lemma_inv__44_on_rules n_germanSimp_lemma_inv__45_on_rules n_germanSimp_lemma_inv__46_on_rules n_germanSimp_lemma_inv__47_on_rules n_germanSimp_lemma_inv__48_on_rules n_germanSimp_lemma_inv__49_on_rules n_germanSimp_lemma_inv__50_on_rules n_germanSimp_lemma_inv__51_on_rules n_germanSimp_lemma_inv__52_on_rules n_germanSimp_lemma_inv__53_on_rules n_germanSimp_lemma_inv__54_on_rules n_germanSimp_lemma_inv__55_on_rules n_germanSimp_lemma_inv__56_on_rules n_germanSimp_lemma_inv__57_on_rules n_germanSimp_lemma_inv__58_on_rules n_germanSimp_lemma_inv__59_on_rules n_germanSimp_lemma_inv__60_on_rules\nbegin\nlemma invs_on_rules:\n assumes a1: \"f \\ invariants N\" and a2: \"r \\ rules N\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have b1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__2 p__Inv3 p__Inv4)\\\n (f=inv__3 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__6 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__7 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__9 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__10 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__12 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__27 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__31 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__40 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__41 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__42 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__44 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__47 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__48 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__53 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__54 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__55 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__56 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__57 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__58 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__60 p__Inv3 p__Inv4)\"\n apply (cut_tac a1, auto) done\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__2 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n }\n\n moreover {\n assume c1: \"(f=inv__3 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__5 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__6 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__6_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__7 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__7_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__8 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__8_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__9 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__9_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__10 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__10_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__11 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__11_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__12 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__12_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__13 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__13_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__14 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__14_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__15_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__16_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__17_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__18_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__19_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__20_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__21_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__22 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__22_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__23 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__23_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__24_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__25 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__25_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__26 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__26_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__27 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__27_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__28_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__29 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__29_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__30_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__31 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__31_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__32_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__33_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__34_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__35 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__35_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__36 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__36_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__37 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__37_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__38 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__38_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__39_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__40 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__40_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__41 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__41_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__42 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__42_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__43 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__43_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__44 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__44_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__45 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__45_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__46_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__47 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__47_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__48 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__48_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__49_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__50_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__51_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__52 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__52_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__53 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__53_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__54 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__54_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__55 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__55_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__56 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__56_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__57 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__57_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__58 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__58_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__59 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__59_on_rules) done\n }\n\n moreover {\n assume c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__60 p__Inv3 p__Inv4)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac a2 c1, metis lemma_inv__60_on_rules) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.3208213008246071, "lm_q1q2_score": 0.1729172979836591}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__49_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__49_on_rules imports n_german_lemma_on_inv__49\nbegin\nsection{*All lemmas on causal relation between inv__49*}\nlemma lemma_inv__49_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__49 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__49) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__49_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.17291729798365907}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__64_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__64_on_rules imports n_g2kAbsAfter_lemma_on_inv__64\nbegin\nsection{*All lemmas on causal relation between inv__64*}\nlemma lemma_inv__64_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__64 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__64) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__64) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__64_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3174262720448507, "lm_q1q2_score": 0.17231906820747644}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__59_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__59_on_rules imports n_g2kAbsAfter_lemma_on_inv__59\nbegin\nsection{*All lemmas on causal relation between inv__59*}\nlemma lemma_inv__59_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__59 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__59) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__59) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__59_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.31742627204485063, "lm_q1q2_score": 0.17231906820747642}} {"text": "(* Title: CoreC++\n Author: Daniel Wasserrab\n Maintainer: Daniel Wasserrab \n\n Based on the Jinja theory J/SmallStep.thy by Tobias Nipkow \n*)\n\n\nheader {* \\isaheader{Small Step Semantics} *}\n\ntheory SmallStep imports Syntax State begin\n\n\nsection {* Some pre-definitions *}\n\nfun blocks :: \"vname list \\ ty list \\ val list \\ expr \\ expr\"\nwhere\n blocks_Cons:\"blocks(V#Vs, T#Ts, v#vs, e) = {V:T := Val v; blocks(Vs,Ts,vs,e)}\" |\n blocks_Nil: \"blocks([],[],[],e) = e\"\n\nlemma blocks_old_induct:\nfixes P :: \"vname list \\ ty list \\ val list \\ expr \\ bool\"\nshows\n \"\\\\aj ak al. P [] [] (aj # ak) al; \\ad ae a b. P [] (ad # ae) a b;\n \\V Vs a b. P (V # Vs) [] a b; \\V Vs T Ts aw. P (V # Vs) (T # Ts) [] aw;\n \\V Vs T Ts v vs e. P Vs Ts vs e \\ P (V # Vs) (T # Ts) (v # vs) e; \\e. P [] [] [] e\\\n \\ P u v w x\"\nby (induction_schema) (pat_completeness, lexicographic_order)\n\n\n\napply(induct rule:blocks_old_induct)\napply simp_all\napply blast\ndone\n\n\n\ndefinition assigned :: \"vname \\ expr \\ bool\" where\n \"assigned V e \\ \\v e'. e = (V:= Val v;; e')\"\n\n\nsection {* The rules *}\n\ninductive_set\n red :: \"prog \\ (env \\ (expr \\ state) \\ (expr \\ state)) set\"\n and reds :: \"prog \\ (env \\ (expr list \\ state) \\ (expr list \\ state)) set\"\n and red' :: \"prog \\ env \\ expr \\ state \\ expr \\ state \\ bool\"\n (\"_,_ \\ ((1\\_,/_\\) \\/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n and reds' :: \"prog \\ env \\ expr list \\ state \\ expr list \\ state \\ bool\"\n (\"_,_ \\ ((1\\_,/_\\) [\\]/ (1\\_,/_\\))\" [51,0,0,0,0] 81)\n for P :: prog\nwhere\n\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\ (E,(e,s), e',s') \\ red P\"\n| \"P,E \\ \\es,s\\ [\\] \\es',s'\\ \\ (E,(es,s), es',s') \\ reds P\"\n\n| RedNew:\n \"\\ new_Addr h = Some a; h' = h(a\\(C,Collect (init_obj P C))) \\\n \\ P,E \\ \\new C, (h,l)\\ \\ \\ref (a,[C]), (h',l)\\\"\n\n| RedNewFail:\n \"new_Addr h = None \\\n P,E \\ \\new C, (h,l)\\ \\ \\THROW OutOfMemory, (h,l)\\\"\n\n| StaticCastRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\\\C\\e, s\\ \\ \\\\C\\e', s'\\\"\n\n| RedStaticCastNull:\n \"P,E \\ \\\\C\\null, s\\ \\ \\null,s\\\"\n\n| RedStaticUpCast:\n \"\\ P \\ Path last Cs to C via Cs'; Ds = Cs@\\<^sub>pCs' \\\n \\ P,E \\ \\\\C\\(ref (a,Cs)), s\\ \\ \\ref (a,Ds), s\\\"\n\n| RedStaticDownCast:\n \"P,E \\ \\\\C\\(ref (a,Cs@[C]@Cs')), s\\ \\ \\ref (a,Cs@[C]), s\\\"\n\n| RedStaticCastFail:\n \"\\C \\ set Cs; \\ P \\ (last Cs) \\\\<^sup>* C\\\n \\ P,E \\ \\\\C\\(ref (a,Cs)), s\\ \\ \\THROW ClassCast, s\\\"\n\n| DynCastRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\Cast C e, s\\ \\ \\Cast C e', s'\\\"\n\n| RedDynCastNull:\n \"P,E \\ \\Cast C null, s\\ \\ \\null,s\\\"\n\n| RedStaticUpDynCast: (* path uniqueness not necessary for type proof but for determinism *)\n \"\\ P \\ Path last Cs to C unique; P \\ Path last Cs to C via Cs'; Ds = Cs@\\<^sub>pCs' \\\n \\ P,E \\ \\Cast C(ref(a,Cs)),s\\ \\ \\ref(a,Ds),s\\\"\n\n| RedStaticDownDynCast:\n \"P,E \\ \\Cast C (ref (a,Cs@[C]@Cs')), s\\ \\ \\ref (a,Cs@[C]), s\\\"\n\n| RedDynCast:(* path uniqueness not necessary for type proof but for determinism *)\n \"\\ hp s a = Some(D,S); P \\ Path D to C via Cs';\n P \\ Path D to C unique \\\n \\ P,E \\ \\Cast C (ref (a,Cs)), s\\ \\ \\ref (a,Cs'), s\\\"\n\n| RedDynCastFail:(* third premise not necessary for type proof but for determinism *)\n \"\\hp s a = Some(D,S); \\ P \\ Path D to C unique;\n \\ P \\ Path last Cs to C unique; C \\ set Cs \\\n \\ P,E \\ \\Cast C (ref (a,Cs)), s\\ \\ \\null, s\\\"\n\n| BinOpRed1:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\e \\bop\\ e\\<^sub>2, s\\ \\ \\e' \\bop\\ e\\<^sub>2, s'\\\"\n\n| BinOpRed2:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\(Val v\\<^sub>1) \\bop\\ e, s\\ \\ \\(Val v\\<^sub>1) \\bop\\ e', s'\\\"\n\n| RedBinOp:\n \"binop(bop,v\\<^sub>1,v\\<^sub>2) = Some v \\\n P,E \\ \\(Val v\\<^sub>1) \\bop\\ (Val v\\<^sub>2), s\\ \\ \\Val v,s\\\"\n\n| RedVar:\n \"lcl s V = Some v \\\n P,E \\ \\Var V,s\\ \\ \\Val v,s\\\"\n\n| LAssRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\V:=e,s\\ \\ \\V:=e',s'\\\"\n\n| RedLAss:\n \"\\E V = Some T; P \\ T casts v to v'\\ \\ \n P,E \\ \\V:=(Val v),(h,l)\\ \\ \\Val v',(h,l(V\\v'))\\\"\n\n| FAccRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\e\\F{Cs}, s\\ \\ \\e'\\F{Cs}, s'\\\"\n\n| RedFAcc:\n \"\\ hp s a = Some(D,S); Ds = Cs'@\\<^sub>pCs; (Ds,fs) \\ S; fs F = Some v \\\n \\ P,E \\ \\(ref (a,Cs'))\\F{Cs}, s\\ \\ \\Val v,s\\\"\n\n| RedFAccNull:\n \"P,E \\ \\null\\F{Cs}, s\\ \\ \\THROW NullPointer, s\\\"\n\n| FAssRed1:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\e\\F{Cs}:=e\\<^sub>2, s\\ \\ \\e'\\F{Cs}:=e\\<^sub>2, s'\\\"\n\n| FAssRed2:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\Val v\\F{Cs}:=e, s\\ \\ \\Val v\\F{Cs}:=e', s'\\\"\n\n| RedFAss:\n\"\\h a = Some(D,S); P \\ (last Cs') has least F:T via Cs;\n P \\ T casts v to v'; Ds = Cs'@\\<^sub>pCs; (Ds,fs) \\ S\\ \\\n P,E \\ \\(ref (a,Cs'))\\F{Cs}:=(Val v), (h,l)\\ \\ \\Val v', (h(a \\ (D,insert (Ds,fs(F\\v')) (S - {(Ds,fs)}))),l)\\\"\n\n| RedFAssNull:\n \"P,E \\ \\null\\F{Cs}:=Val v, s\\ \\ \\THROW NullPointer, s\\\"\n\n| CallObj:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\Call e Copt M es,s\\ \\ \\Call e' Copt M es,s'\\\"\n\n| CallParams:\n \"P,E \\ \\es,s\\ [\\] \\es',s'\\ \\\n P,E \\ \\Call (Val v) Copt M es,s\\ \\ \\Call (Val v) Copt M es',s'\\\"\n\n| RedCall:\n \"\\ hp s a = Some(C,S); P \\ last Cs has least M = (Ts',T',pns',body') via Ds;\n P \\ (C,Cs@\\<^sub>pDs) selects M = (Ts,T,pns,body) via Cs';\n size vs = size pns; size Ts = size pns; \n bs = blocks(this#pns,Class(last Cs')#Ts,Ref(a,Cs')#vs,body);\n new_body = (case T' of Class D \\ \\D\\bs | _ \\ bs)\\\n \\ P,E \\ \\(ref (a,Cs))\\M(map Val vs), s\\ \\ \\new_body, s\\\"\n\n| RedStaticCall:\n \"\\ P \\ Path (last Cs) to C unique; P \\ Path (last Cs) to C via Cs'';\n P \\ C has least M = (Ts,T,pns,body) via Cs'; Ds = (Cs@\\<^sub>pCs'')@\\<^sub>pCs';\n size vs = size pns; size Ts = size pns \\\n \\ P,E \\ \\(ref (a,Cs))\\(C::)M(map Val vs), s\\ \\ \n \\blocks(this#pns,Class(last Ds)#Ts,Ref(a,Ds)#vs,body), s\\\"\n\n| RedCallNull:\n \"P,E \\ \\Call null Copt M (map Val vs),s\\ \\ \\THROW NullPointer,s\\\"\n\n| BlockRedNone:\n \"\\ P,E(V \\ T) \\ \\e, (h,l(V:=None))\\ \\ \\e', (h',l')\\; l' V = None; \\ assigned V e \\\n \\ P,E \\ \\{V:T; e}, (h,l)\\ \\ \\{V:T; e'}, (h',l'(V := l V))\\\"\n\n| BlockRedSome:\n \"\\ P,E(V \\ T) \\ \\e, (h,l(V:=None))\\ \\ \\e', (h',l')\\; l' V = Some v;\n \\ assigned V e \\\n \\ P,E \\ \\{V:T; e}, (h,l)\\ \\ \\{V:T := Val v; e'}, (h',l'(V := l V))\\\"\n\n| InitBlockRed:\n \"\\ P,E(V \\ T) \\ \\e, (h,l(V\\v'))\\ \\ \\e', (h',l')\\; l' V = Some v''; \n P \\ T casts v to v' \\\n \\ P,E \\ \\{V:T := Val v; e}, (h,l)\\ \\ \\{V:T := Val v''; e'}, (h',l'(V := l V))\\\"\n\n| RedBlock:\n \"P,E \\ \\{V:T; Val u}, s\\ \\ \\Val u, s\\\"\n\n| RedInitBlock:\n \"P \\ T casts v to v' \\ P,E \\ \\{V:T := Val v; Val u}, s\\ \\ \\Val u, s\\\"\n\n| SeqRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\e;;e\\<^sub>2, s\\ \\ \\e';;e\\<^sub>2, s'\\\"\n\n| RedSeq:\n \"P,E \\ \\(Val v);;e\\<^sub>2, s\\ \\ \\e\\<^sub>2, s\\\"\n\n| CondRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\if (e) e\\<^sub>1 else e\\<^sub>2, s\\ \\ \\if (e') e\\<^sub>1 else e\\<^sub>2, s'\\\"\n\n| RedCondT:\n \"P,E \\ \\if (true) e\\<^sub>1 else e\\<^sub>2, s\\ \\ \\e\\<^sub>1, s\\\"\n\n| RedCondF:\n \"P,E \\ \\if (false) e\\<^sub>1 else e\\<^sub>2, s\\ \\ \\e\\<^sub>2, s\\\"\n\n| RedWhile:\n \"P,E \\ \\while(b) c, s\\ \\ \\if(b) (c;;while(b) c) else unit, s\\\"\n\n| ThrowRed:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\throw e, s\\ \\ \\throw e', s'\\\"\n\n| RedThrowNull:\n \"P,E \\ \\throw null, s\\ \\ \\THROW NullPointer, s\\\"\n\n| ListRed1:\n \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\\n P,E \\ \\e#es,s\\ [\\] \\e'#es,s'\\\"\n\n| ListRed2:\n \"P,E \\ \\es,s\\ [\\] \\es',s'\\ \\\n P,E \\ \\Val v # es,s\\ [\\] \\Val v # es',s'\\\"\n\n-- \"Exception propagation\"\n\n| DynCastThrow: \"P,E \\ \\Cast C (Throw r), s\\ \\ \\Throw r, s\\\"\n| StaticCastThrow: \"P,E \\ \\\\C\\(Throw r), s\\ \\ \\Throw r, s\\\"\n| BinOpThrow1: \"P,E \\ \\(Throw r) \\bop\\ e\\<^sub>2, s\\ \\ \\Throw r, s\\\"\n| BinOpThrow2: \"P,E \\ \\(Val v\\<^sub>1) \\bop\\ (Throw r), s\\ \\ \\Throw r, s\\\"\n| LAssThrow: \"P,E \\ \\V:=(Throw r), s\\ \\ \\Throw r, s\\\"\n| FAccThrow: \"P,E \\ \\(Throw r)\\F{Cs}, s\\ \\ \\Throw r, s\\\"\n| FAssThrow1: \"P,E \\ \\(Throw r)\\F{Cs}:=e\\<^sub>2, s\\ \\ \\Throw r,s\\\"\n| FAssThrow2: \"P,E \\ \\Val v\\F{Cs}:=(Throw r), s\\ \\ \\Throw r, s\\\"\n| CallThrowObj: \"P,E \\ \\Call (Throw r) Copt M es, s\\ \\ \\Throw r, s\\\"\n| CallThrowParams: \"\\ es = map Val vs @ Throw r # es' \\ \n \\ P,E \\ \\Call (Val v) Copt M es, s\\ \\ \\Throw r, s\\\"\n| BlockThrow: \"P,E \\ \\{V:T; Throw r}, s\\ \\ \\Throw r, s\\\"\n| InitBlockThrow: \"P \\ T casts v to v' \n \\ P,E \\ \\{V:T := Val v; Throw r}, s\\ \\ \\Throw r, s\\\"\n| SeqThrow: \"P,E \\ \\(Throw r);;e\\<^sub>2, s\\ \\ \\Throw r, s\\\"\n| CondThrow: \"P,E \\ \\if (Throw r) e\\<^sub>1 else e\\<^sub>2, s\\ \\ \\Throw r, s\\\"\n| ThrowThrow: \"P,E \\ \\throw(Throw r), s\\ \\ \\Throw r, s\\\"\n\n\nlemmas red_reds_induct = red_reds.induct [split_format (complete)]\n and red_reds_inducts = red_reds.inducts [split_format (complete)]\n\ninductive_cases [elim!]:\n \"P,E \\ \\V:=e,s\\ \\ \\e',s'\\\"\n \"P,E \\ \\e1;;e2,s\\ \\ \\e',s'\\\"\n\ndeclare Cons_eq_map_conv [iff]\n\nlemma \"P,E \\ \\e,s\\ \\ \\e',s'\\ \\ True\"\nand reds_length:\"P,E \\ \\es,s\\ [\\] \\es',s'\\ \\ length es = length es'\"\nby (induct rule: red_reds.inducts) auto\n\n\nsection{* The reflexive transitive closure *}\n\ndefinition Red :: \"prog \\ env \\ ((expr \\ state) \\ (expr \\ state)) set\"\n where \"Red P E = {((e,s),e',s'). P,E \\ \\e,s\\ \\ \\e',s'\\}\"\n\ndefinition Reds :: \"prog \\ env \\ ((expr list \\ state) \\ (expr list \\ state)) set\"\n where \"Reds P E = {((es,s),es',s'). P,E \\ \\es,s\\ [\\] \\es',s'\\}\"\n\n\n\nlemma[simp]: \"((es,s),es',s') \\ Reds P E = P,E \\ \\es,s\\ [\\] \\es',s'\\\"\nby (simp add:Reds_def)\n\n\n\nabbreviation\n Step :: \"prog \\ env \\ expr \\ state \\ expr \\ state \\ bool\"\n (\"_,_ \\ ((1\\_,/_\\) \\*/ (1\\_,/_\\))\" [51,0,0,0,0] 81) where\n \"P,E \\ \\e,s\\ \\* \\e',s'\\ \\ ((e,s), e',s') \\ (Red P E)\\<^sup>*\"\n\nabbreviation\n Steps :: \"prog \\ env \\ expr list \\ state \\ expr list \\ state \\ bool\"\n (\"_,_ \\ ((1\\_,/_\\) [\\]*/ (1\\_,/_\\))\" [51,0,0,0,0] 81) where\n \"P,E \\ \\es,s\\ [\\]* \\es',s'\\ \\ ((es,s), es',s') \\ (Reds P E)\\<^sup>*\"\n\n\nlemma converse_rtrancl_induct_red[consumes 1]:\nassumes \"P,E \\ \\e,(h,l)\\ \\* \\e',(h',l')\\\"\nand \"\\e h l. R e h l e h l\"\nand \"\\e\\<^sub>0 h\\<^sub>0 l\\<^sub>0 e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 e' h' l'.\n \\ P,E \\ \\e\\<^sub>0,(h\\<^sub>0,l\\<^sub>0)\\ \\ \\e\\<^sub>1,(h\\<^sub>1,l\\<^sub>1)\\; R e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 e' h' l' \\ \\ R e\\<^sub>0 h\\<^sub>0 l\\<^sub>0 e' h' l'\"\nshows \"R e h l e' h' l'\"\n\nproof -\n { fix s s'\n assume reds: \"P,E \\ \\e,s\\ \\* \\e',s'\\\"\n and base: \"\\e s. R e (hp s) (lcl s) e (hp s) (lcl s)\"\n and IH: \"\\e\\<^sub>0 s\\<^sub>0 e\\<^sub>1 s\\<^sub>1 e' s'.\n \\ P,E \\ \\e\\<^sub>0,s\\<^sub>0\\ \\ \\e\\<^sub>1,s\\<^sub>1\\; R e\\<^sub>1 (hp s\\<^sub>1) (lcl s\\<^sub>1) e' (hp s') (lcl s') \\\n \\ R e\\<^sub>0 (hp s\\<^sub>0) (lcl s\\<^sub>0) e' (hp s') (lcl s')\"\n from reds have \"R e (hp s) (lcl s) e' (hp s') (lcl s')\"\n proof (induct rule:converse_rtrancl_induct2)\n case refl show ?case by(rule base)\n next\n case (step e\\<^sub>0 s\\<^sub>0 e s)\n have Red:\"((e\\<^sub>0,s\\<^sub>0),e,s) \\ Red P E\"\n and R:\"R e (hp s) (lcl s) e' (hp s') (lcl s')\" by fact+\n from IH[OF Red[simplified] R] show ?case .\n qed\n }\n with assms show ?thesis by fastforce\nqed\n\n\n\nlemma steps_length:\"P,E \\ \\es,s\\ [\\]* \\es',s'\\ \\ length es = length es'\"\nby(induct rule:rtrancl_induct2,auto intro:reds_length)\n\n\nsection{*Some easy lemmas*}\n\n\n\nlemma [iff]: \"\\ P,E \\ \\Val v,s\\ \\ \\e',s'\\\"\nby(fastforce elim: red.cases)\n\nlemma [iff]: \"\\ P,E \\ \\Throw r,s\\ \\ \\e',s'\\\"\nby(fastforce elim: red.cases)\n\n\nlemma red_lcl_incr: \"P,E \\ \\e,(h\\<^sub>0,l\\<^sub>0)\\ \\ \\e',(h\\<^sub>1,l\\<^sub>1)\\ \\ dom l\\<^sub>0 \\ dom l\\<^sub>1\"\nand \"P,E \\ \\es,(h\\<^sub>0,l\\<^sub>0)\\ [\\] \\es',(h\\<^sub>1,l\\<^sub>1)\\ \\ dom l\\<^sub>0 \\ dom l\\<^sub>1\"\nby (induct rule: red_reds_inducts) (auto simp del:fun_upd_apply)\n\n\nlemma red_lcl_add: \"P,E \\ \\e,(h,l)\\ \\ \\e',(h',l')\\ \\ (\\l\\<^sub>0. P,E \\ \\e,(h,l\\<^sub>0++l)\\ \\ \\e',(h',l\\<^sub>0++l')\\)\"\nand \"P,E \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\ \\ (\\l\\<^sub>0. P,E \\ \\es,(h,l\\<^sub>0++l)\\ [\\] \\es',(h',l\\<^sub>0++l')\\)\"\n \nproof (induct rule:red_reds_inducts)\n case RedLAss thus ?case by(auto intro:red_reds.intros simp del:fun_upd_apply)\nnext\n case RedStaticDownCast thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedStaticUpDynCast thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedStaticDownDynCast thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedDynCast thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedDynCastFail thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedFAcc thus ?case by(fastforce intro:red_reds.intros)\nnext\n case RedFAss thus ?case by (fastforce intro:red_reds.intros)\nnext\n case RedCall thus ?case by (fastforce intro!:red_reds.RedCall)\nnext\n case RedStaticCall thus ?case by(fastforce intro:red_reds.intros)\nnext\n case (InitBlockRed E V T e h l v' e' h' l' v'' v l\\<^sub>0)\n have IH: \"\\l\\<^sub>0. P,E(V \\ T) \\ \\e,(h, l\\<^sub>0 ++ l(V \\ v'))\\ \\ \\e',(h', l\\<^sub>0 ++ l')\\\"\n and l'V: \"l' V = Some v''\" and casts:\"P \\ T casts v to v'\" by fact+\n from IH have IH': \"P,E(V \\ T) \\ \\e,(h, (l\\<^sub>0 ++ l)(V \\ v'))\\ \\ \\e',(h',l\\<^sub>0 ++ l')\\\"\n by simp\n have \"(l\\<^sub>0 ++ l')(V := (l\\<^sub>0 ++ l) V) = l\\<^sub>0 ++ l'(V := l V)\"\n by(rule ext)(simp add:map_add_def)\n with red_reds.InitBlockRed[OF IH' _ casts] l'V show ?case\n by(simp del:fun_upd_apply)\nnext\n case (BlockRedNone E V T e h l e' h' l' l\\<^sub>0)\n have IH: \"\\l\\<^sub>0. P,E(V \\ T) \\ \\e,(h, l\\<^sub>0 ++ l(V := None))\\ \\ \\e',(h', l\\<^sub>0 ++ l')\\\"\n and l'V: \"l' V = None\" and unass: \"\\ assigned V e\" by fact+\n have \"l\\<^sub>0(V := None) ++ l(V := None) = (l\\<^sub>0 ++ l)(V := None)\"\n by(simp add:fun_eq_iff map_add_def)\n hence IH': \"P,E(V \\ T) \\ \\e,(h, (l\\<^sub>0++l)(V := None))\\ \\ \\e',(h', l\\<^sub>0(V := None) ++ l')\\\"\n using IH[of \"l\\<^sub>0(V := None)\"] by simp\n have \"(l\\<^sub>0(V := None) ++ l')(V := (l\\<^sub>0 ++ l) V) = l\\<^sub>0 ++ l'(V := l V)\"\n by(simp add:fun_eq_iff map_add_def)\n with red_reds.BlockRedNone[OF IH' _ unass] l'V show ?case\n by(simp add: map_add_def)\nnext\n case (BlockRedSome E V T e h l e' h' l' v l\\<^sub>0)\n have IH: \"\\l\\<^sub>0. P,E(V \\ T) \\ \\e,(h, l\\<^sub>0 ++ l(V := None))\\ \\ \\e',(h', l\\<^sub>0 ++ l')\\\"\n and l'V: \"l' V = Some v\" and unass: \"\\ assigned V e\" by fact+\n have \"l\\<^sub>0(V := None) ++ l(V := None) = (l\\<^sub>0 ++ l)(V := None)\"\n by(simp add:fun_eq_iff map_add_def)\n hence IH': \"P,E(V \\ T) \\ \\e,(h, (l\\<^sub>0++l)(V := None))\\ \\ \\e',(h', l\\<^sub>0(V := None) ++ l')\\\"\n using IH[of \"l\\<^sub>0(V := None)\"] by simp\n have \"(l\\<^sub>0(V := None) ++ l')(V := (l\\<^sub>0 ++ l) V) = l\\<^sub>0 ++ l'(V := l V)\"\n by(simp add:fun_eq_iff map_add_def)\n with red_reds.BlockRedSome[OF IH' _ unass] l'V show ?case\n by(simp add:map_add_def)\nnext\nqed (simp_all add:red_reds.intros)\n\n\n\nlemma Red_lcl_add:\nassumes \"P,E \\ \\e,(h,l)\\ \\* \\e',(h',l')\\\" shows \"P,E \\ \\e,(h,l\\<^sub>0++l)\\ \\* \\e',(h',l\\<^sub>0++l')\\\"\nusing assms\nproof(induct rule:converse_rtrancl_induct_red)\n case 1 thus ?case by simp\nnext\n case 2 thus ?case\n by(auto dest: red_lcl_add intro: converse_rtrancl_into_rtrancl simp:Red_def)\nqed\n\n\n\nlemma \nred_preserves_obj:\"\\P,E \\ \\e,(h,l)\\ \\ \\e',(h',l')\\; h a = Some(D,S)\\ \n \\ \\S'. h' a = Some(D,S')\"\nand reds_preserves_obj:\"\\P,E \\ \\es,(h,l)\\ [\\] \\es',(h',l')\\; h a = Some(D,S)\\ \n \\ \\S'. h' a = Some(D,S')\"\nby (induct rule:red_reds_inducts) (auto dest:new_Addr_SomeD)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/SmallStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.341582499438317, "lm_q1q2_score": 0.1721255292117141}} {"text": "(* Title: HOL/Auth/n_deadlock_lemma_on_inv__4.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_on_inv__4 imports n_deadlock_base\nbegin\nsection{*All lemmas on causal relation between inv__4 and some rule r*}\nlemma n_TryVsinv__4:\nassumes a1: \"(\\ i. i\\N\\r=n_Try i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Try i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__4 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_CritVsinv__4:\nassumes a1: \"(\\ i. i\\N\\r=n_Crit i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Crit i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__4 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_ExitVsinv__4:\nassumes a1: \"(\\ i. i\\N\\r=n_Exit i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Exit i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__4 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const C)) (eqn (IVar (Ident ''x'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_IdleVsinv__4:\nassumes a1: \"(\\ i. i\\N\\r=n_Idle i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__4 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_Idle i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__4 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''n'') p__Inv4)) (Const E)) (eqn (IVar (Para (Ident ''n'') i)) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_on_inv__4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3311197462295937, "lm_q1q2_score": 0.1720237682856401}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__91_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__91_on_rules imports n_g2kAbsAfter_lemma_on_inv__91\nbegin\nsection{*All lemmas on causal relation between inv__91*}\nlemma lemma_inv__91_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__91 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__91) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__91) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__91_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.29746994260479465, "lm_q1q2_score": 0.17178751313635837}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__13_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__13_on_rules imports n_g2kAbsAfter_lemma_on_inv__13\nbegin\nsection{*All lemmas on causal relation between inv__13*}\nlemma lemma_inv__13_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__13 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__13) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__13_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.31405054499180746, "lm_q1q2_score": 0.17170340995975436}} {"text": "(* Title: HOL/Bali/State.thy\n Author: David von Oheimb\n*)\nsubsection \\State for evaluation of Java expressions and statements\\\n\ntheory State\nimports DeclConcepts\nbegin\n\ntext \\\ndesign issues:\n\\begin{itemize}\n\\item all kinds of objects (class instances, arrays, and class objects)\n are handeled via a general object abstraction\n\\item the heap and the map for class objects are combined into a single table\n \\(recall (loc, obj) table \\ (qtname, obj) table ~= (loc + qtname, obj) table)\\\n\\end{itemize}\n\\\n\nsubsubsection \"objects\"\n\ndatatype obj_tag = \\ \\tag for generic object\\\n CInst qtname \\ \\class instance\\\n | Arr ty int \\ \\array with component type and length\\\n \\ \\| CStat qtname the tag is irrelevant for a class object,\n i.e. the static fields of a class,\n since its type is given already by the reference to \n it (see below)\\\n\ntype_synonym vn = \"fspec + int\" \\ \\variable name\\\nrecord obj = \n tag :: \"obj_tag\" \\ \\generalized object\\\n \"values\" :: \"(vn, val) table\" \n\ntranslations \n (type) \"fspec\" <= (type) \"vname \\ qtname\" \n (type) \"vn\" <= (type) \"fspec + int\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option\\\"\n (type) \"obj\" <= (type) \"\\tag::obj_tag, values::vn \\ val option,\\::'a\\\"\n\ndefinition\n the_Arr :: \"obj option \\ ty \\ int \\ (vn, val) table\"\n where \"the_Arr obj = (SOME (T,k,t). obj = Some \\tag=Arr T k,values=t\\)\"\n\nlemma the_Arr_Arr [simp]: \"the_Arr (Some \\tag=Arr T k,values=cs\\) = (T,k,cs)\"\napply (auto simp: the_Arr_def)\ndone\n\nlemma the_Arr_Arr1 [simp,intro,dest]:\n \"\\tag obj = Arr T k\\ \\ the_Arr (Some obj) = (T,k,values obj)\"\napply (auto simp add: the_Arr_def)\ndone\n\ndefinition\n upd_obj :: \"vn \\ val \\ obj \\ obj\"\n where \"upd_obj n v = (\\obj. obj \\values:=(values obj)(n\\v)\\)\"\n\nlemma upd_obj_def2 [simp]: \n \"upd_obj n v obj = obj \\values:=(values obj)(n\\v)\\\" \napply (auto simp: upd_obj_def)\ndone\n\ndefinition\n obj_ty :: \"obj \\ ty\" where\n \"obj_ty obj = (case tag obj of \n CInst C \\ Class C \n | Arr T k \\ T.[])\"\n\nlemma obj_ty_eq [intro!]: \"obj_ty \\tag=oi,values=x\\ = obj_ty \\tag=oi,values=y\\\" \nby (simp add: obj_ty_def)\n\n\nlemma obj_ty_eq1 [intro!,dest]: \n \"tag obj = tag obj' \\ obj_ty obj = obj_ty obj'\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_cong [simp]: \n \"obj_ty (obj \\values:=vs\\) = obj_ty obj\" \nby auto\n\nlemma obj_ty_CInst [simp]: \n \"obj_ty \\tag=CInst C,values=vs\\ = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_CInst1 [simp,intro!,dest]: \n \"\\tag obj = CInst C\\ \\ obj_ty obj = Class C\" \nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr [simp]: \n \"obj_ty \\tag=Arr T i,values=vs\\ = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_Arr1 [simp,intro!,dest]: \n \"\\tag obj = Arr T i\\ \\ obj_ty obj = T.[]\"\nby (simp add: obj_ty_def)\n\nlemma obj_ty_widenD: \n \"G\\obj_ty obj\\RefT t \\ (\\C. tag obj = CInst C) \\ (\\T k. tag obj = Arr T k)\"\napply (unfold obj_ty_def)\napply (auto split: obj_tag.split_asm)\ndone\n\ndefinition\n obj_class :: \"obj \\ qtname\" where\n \"obj_class obj = (case tag obj of \n CInst C \\ C \n | Arr T k \\ Object)\"\n\n\nlemma obj_class_CInst [simp]: \"obj_class \\tag=CInst C,values=vs\\ = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_CInst1 [simp,intro!,dest]: \n \"tag obj = CInst C \\ obj_class obj = C\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr [simp]: \"obj_class \\tag=Arr T k,values=vs\\ = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_class_Arr1 [simp,intro!,dest]: \n \"tag obj = Arr T k \\ obj_class obj = Object\" \nby (auto simp: obj_class_def)\n\nlemma obj_ty_obj_class: \"G\\obj_ty obj\\ Class statC = G\\obj_class obj \\\\<^sub>C statC\"\napply (case_tac \"tag obj\")\napply (auto simp add: obj_ty_def obj_class_def)\napply (case_tac \"statC = Object\")\napply (auto dest: widen_Array_Class)\ndone\n\nsubsubsection \"object references\"\n\ntype_synonym oref = \"loc + qtname\" \\ \\generalized object reference\\\nsyntax\n Heap :: \"loc \\ oref\"\n Stat :: \"qtname \\ oref\"\n\ntranslations\n \"Heap\" => \"CONST Inl\"\n \"Stat\" => \"CONST Inr\"\n (type) \"oref\" <= (type) \"loc + qtname\"\n\ndefinition\n fields_table :: \"prog \\ qtname \\ (fspec \\ field \\ bool) \\ (fspec, ty) table\" where\n \"fields_table G C P =\n map_option type \\ table_of (filter (case_prod P) (DeclConcepts.fields G C))\"\n\nlemma fields_table_SomeI: \n\"\\table_of (DeclConcepts.fields G C) n = Some f; P n f\\ \n \\ fields_table G C P n = Some (type f)\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule map_of_filter_in)\napply assumption\napply simp\ndone\n\n(* unused *)\nlemma fields_table_SomeD': \"fields_table G C P fn = Some T \\ \n \\f. (fn,f)\\set(DeclConcepts.fields G C) \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (drule map_of_SomeD)\napply auto\ndone\n\nlemma fields_table_SomeD: \n\"\\fields_table G C P fn = Some T; unique (DeclConcepts.fields G C)\\ \\ \n \\f. table_of (DeclConcepts.fields G C) fn = Some f \\ type f = T\"\napply (unfold fields_table_def)\napply clarsimp\napply (rule exI)\napply (rule conjI)\napply (erule table_of_filter_unique_SomeD)\napply assumption\napply simp\ndone\n\ndefinition\n in_bounds :: \"int \\ int \\ bool\" (\"(_/ in'_bounds _)\" [50, 51] 50)\n where \"i in_bounds k = (0 \\ i \\ i < k)\"\n\ndefinition\n arr_comps :: \"'a \\ int \\ int \\ 'a option\"\n where \"arr_comps T k = (\\i. if i in_bounds k then Some T else None)\"\n \ndefinition\n var_tys :: \"prog \\ obj_tag \\ oref \\ (vn, ty) table\" where\n \"var_tys G oi r =\n (case r of \n Heap a \\ (case oi of \n CInst C \\ fields_table G C (\\n f. \\static f) (+) Map.empty\n | Arr T k \\ Map.empty (+) arr_comps T k)\n | Stat C \\ fields_table G C (\\fn f. declclassf fn = C \\ static f) \n (+) Map.empty)\"\n\nlemma var_tys_Some_eq: \n \"var_tys G oi r n = Some T \n = (case r of \n Inl a \\ (case oi of \n CInst C \\ (\\nt. n = Inl nt \\ fields_table G C (\\n f. \n \\static f) nt = Some T) \n | Arr t k \\ (\\ i. n = Inr i \\ i in_bounds k \\ t = T)) \n | Inr C \\ (\\nt. n = Inl nt \\ \n fields_table G C (\\fn f. declclassf fn = C \\ static f) nt \n = Some T))\"\napply (unfold var_tys_def arr_comps_def)\napply (force split: sum.split_asm sum.split obj_tag.split)\ndone\n\n\nsubsubsection \"stores\"\n\ntype_synonym globs \\ \\global variables: heap and static variables\\\n = \"(oref , obj) table\"\ntype_synonym heap\n = \"(loc , obj) table\"\n(* type_synonym locals \n = \"(lname, val) table\" *) (* defined in Value.thy local variables *)\n\ntranslations\n (type) \"globs\" <= (type) \"(oref , obj) table\"\n (type) \"heap\" <= (type) \"(loc , obj) table\"\n(* (type) \"locals\" <= (type) \"(lname, val) table\" *)\n\ndatatype st = (* pure state, i.e. contents of all variables *)\n st globs locals\n\nsubsection \"access\"\n\ndefinition\n globs :: \"st \\ globs\"\n where \"globs = case_st (\\g l. g)\"\n \ndefinition\n locals :: \"st \\ locals\"\n where \"locals = case_st (\\g l. l)\"\n\ndefinition heap :: \"st \\ heap\" where\n \"heap s = globs s \\ Heap\"\n\n\nlemma globs_def2 [simp]: \" globs (st g l) = g\"\nby (simp add: globs_def)\n\nlemma locals_def2 [simp]: \"locals (st g l) = l\"\nby (simp add: locals_def)\n\nlemma heap_def2 [simp]: \"heap s a=globs s (Heap a)\"\nby (simp add: heap_def)\n\n\nabbreviation val_this :: \"st \\ val\"\n where \"val_this s == the (locals s This)\"\n\nabbreviation lookup_obj :: \"st \\ val \\ obj\"\n where \"lookup_obj s a' == the (heap s (the_Addr a'))\"\n\nsubsection \"memory allocation\"\n\ndefinition\n new_Addr :: \"heap \\ loc option\" where\n \"new_Addr h = (if (\\a. h a \\ None) then None else Some (SOME a. h a = None))\"\n\nlemma new_AddrD: \"new_Addr h = Some a \\ h a = None\"\napply (auto simp add: new_Addr_def)\napply (erule someI) \ndone\n\nlemma new_AddrD2: \"new_Addr h = Some a \\ \\b. h b \\ None \\ b \\ a\"\napply (drule new_AddrD)\napply auto\ndone\n\nlemma new_Addr_SomeI: \"h a = None \\ \\b. new_Addr h = Some b \\ h b = None\"\napply (simp add: new_Addr_def)\napply (fast intro: someI2)\ndone\n\n\nsubsection \"initialization\"\n\nabbreviation init_vals :: \"('a, ty) table \\ ('a, val) table\"\n where \"init_vals vs == map_option default_val \\ vs\"\n\nlemma init_arr_comps_base [simp]: \"init_vals (arr_comps T 0) = Map.empty\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nlemma init_arr_comps_step [simp]: \n\"0 < j \\ init_vals (arr_comps T j ) = \n (init_vals (arr_comps T (j - 1)))(j - 1\\default_val T)\"\napply (unfold arr_comps_def in_bounds_def)\napply (rule ext)\napply auto\ndone\n\nsubsection \"update\"\n\ndefinition\n gupd :: \"oref \\ obj \\ st \\ st\" (\"gupd'(_\\_')\" [10, 10] 1000)\n where \"gupd r obj = case_st (\\g l. st (g(r\\obj)) l)\"\n\ndefinition\n lupd :: \"lname \\ val \\ st \\ st\" (\"lupd'(_\\_')\" [10, 10] 1000)\n where \"lupd vn v = case_st (\\g l. st g (l(vn\\v)))\"\n\ndefinition\n upd_gobj :: \"oref \\ vn \\ val \\ st \\ st\"\n where \"upd_gobj r n v = case_st (\\g l. st (chg_map (upd_obj n v) r g) l)\"\n\ndefinition\n set_locals :: \"locals \\ st \\ st\"\n where \"set_locals l = case_st (\\g l'. st g l)\"\n\ndefinition\n init_obj :: \"prog \\ obj_tag \\ oref \\ st \\ st\"\n where \"init_obj G oi r = gupd(r\\\\tag=oi, values=init_vals (var_tys G oi r)\\)\"\n\nabbreviation\n init_class_obj :: \"prog \\ qtname \\ st \\ st\"\n where \"init_class_obj G C == init_obj G undefined (Inr C)\"\n\nlemma gupd_def2 [simp]: \"gupd(r\\obj) (st g l) = st (g(r\\obj)) l\"\napply (unfold gupd_def)\napply (simp (no_asm))\ndone\n\nlemma lupd_def2 [simp]: \"lupd(vn\\v) (st g l) = st g (l(vn\\v))\"\napply (unfold lupd_def)\napply (simp (no_asm))\ndone\n\nlemma globs_gupd [simp]: \"globs (gupd(r\\obj) s) = (globs s)(r\\obj)\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma globs_lupd [simp]: \"globs (lupd(vn\\v ) s) = globs s\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma locals_gupd [simp]: \"locals (gupd(r\\obj) s) = locals s\"\napply (induct \"s\")\nby (simp add: gupd_def)\n\nlemma locals_lupd [simp]: \"locals (lupd(vn\\v ) s) = (locals s)(vn\\v )\"\napply (induct \"s\")\nby (simp add: lupd_def)\n\nlemma globs_upd_gobj_new [rule_format (no_asm), simp]: \n \"globs s r = None \\ globs (upd_gobj r n v s) = globs s\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma globs_upd_gobj_upd [rule_format (no_asm), simp]: \n\"globs s r=Some obj\\ globs (upd_gobj r n v s) = (globs s)(r\\upd_obj n v obj)\"\napply (unfold upd_gobj_def)\napply (induct \"s\")\napply auto\ndone\n\nlemma locals_upd_gobj [simp]: \"locals (upd_gobj r n v s) = locals s\"\napply (induct \"s\")\nby (simp add: upd_gobj_def) \n\n\nlemma globs_init_obj [simp]: \"globs (init_obj G oi r s) t = \n (if t=r then Some \\tag=oi,values=init_vals (var_tys G oi r)\\ else globs s t)\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma locals_init_obj [simp]: \"locals (init_obj G oi r s) = locals s\"\nby (simp add: init_obj_def)\n \nlemma surjective_st [simp]: \"st (globs s) (locals s) = s\"\napply (induct \"s\")\nby auto\n\nlemma surjective_st_init_obj: \n \"st (globs (init_obj G oi r s)) (locals s) = init_obj G oi r s\"\napply (subst locals_init_obj [THEN sym])\napply (rule surjective_st)\ndone\n\nlemma heap_heap_upd [simp]: \n \"heap (st (g(Inl a\\obj)) l) = (heap (st g l))(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_stat_upd [simp]: \"heap (st (g(Inr C\\obj)) l) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_local_upd [simp]: \"heap (st g (l(vn\\v))) = heap (st g l)\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_gupd_Heap [simp]: \"heap (gupd(Heap a\\obj) s) = (heap s)(a\\obj)\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_gupd_Stat [simp]: \"heap (gupd(Stat C\\obj) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\nlemma heap_lupd [simp]: \"heap (lupd(vn\\v) s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\ndone\n\nlemma heap_upd_gobj_Stat [simp]: \"heap (upd_gobj (Stat C) n v s) = heap s\"\napply (rule ext)\napply (simp (no_asm))\napply (case_tac \"globs s (Stat C)\")\napply auto\ndone\n\nlemma set_locals_def2 [simp]: \"set_locals l (st g l') = st g l\"\napply (unfold set_locals_def)\napply (simp (no_asm))\ndone\n\nlemma set_locals_id [simp]: \"set_locals (locals s) s = s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma set_set_locals [simp]: \"set_locals l (set_locals l' s) = set_locals l s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma locals_set_locals [simp]: \"locals (set_locals l s) = l\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma globs_set_locals [simp]: \"globs (set_locals l s) = globs s\"\napply (unfold set_locals_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\nlemma heap_set_locals [simp]: \"heap (set_locals l s) = heap s\"\napply (unfold heap_def)\napply (induct_tac \"s\")\napply (simp (no_asm))\ndone\n\n\nsubsubsection \"abrupt completion\"\n\n\n\nprimrec the_Xcpt :: \"abrupt \\ xcpt\"\n where \"the_Xcpt (Xcpt x) = x\"\n\nprimrec the_Jump :: \"abrupt => jump\"\n where \"the_Jump (Jump j) = j\"\n\nprimrec the_Loc :: \"xcpt \\ loc\"\n where \"the_Loc (Loc a) = a\"\n\nprimrec the_Std :: \"xcpt \\ xname\"\n where \"the_Std (Std x) = x\"\n \n\ndefinition\n abrupt_if :: \"bool \\ abopt \\ abopt \\ abopt\"\n where \"abrupt_if c x' x = (if c \\ (x = None) then x' else x)\"\n\nlemma abrupt_if_True_None [simp]: \"abrupt_if True x None = x\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_True_not_None [simp]: \"x \\ None \\ abrupt_if True x y \\ None\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_False [simp]: \"abrupt_if False x y = y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_Some [simp]: \"abrupt_if c x (Some y) = Some y\"\nby (simp add: abrupt_if_def)\n\nlemma abrupt_if_not_None [simp]: \"y \\ None \\ abrupt_if c x y = y\"\napply (simp add: abrupt_if_def)\nby auto\n\n\nlemma split_abrupt_if: \n\"P (abrupt_if c x' x) = \n ((c \\ x = None \\ P x') \\ (\\ (c \\ x = None) \\ P x))\"\napply (unfold abrupt_if_def)\napply (split if_split)\napply auto\ndone\n\nabbreviation raise_if :: \"bool \\ xname \\ abopt \\ abopt\"\n where \"raise_if c xn == abrupt_if c (Some (Xcpt (Std xn)))\"\n\nabbreviation np :: \"val \\ abopt \\ abopt\"\n where \"np v == raise_if (v = Null) NullPointer\"\n\nabbreviation check_neg :: \"val \\ abopt \\ abopt\"\n where \"check_neg i' == raise_if (the_Intg i'<0) NegArrSize\"\n\nabbreviation error_if :: \"bool \\ error \\ abopt \\ abopt\"\n where \"error_if c e == abrupt_if c (Some (Error e))\"\n\nlemma raise_if_None [simp]: \"(raise_if c x y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare raise_if_None [THEN iffD1, dest!]\n\nlemma if_raise_if_None [simp]: \n \"((if b then y else raise_if c x y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma raise_if_SomeD [dest!]:\n \"raise_if c x y = Some z \\ c \\ z=(Xcpt (Std x)) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_None [simp]: \"(error_if c e y = None) = (\\c \\ y = None)\"\napply (simp add: abrupt_if_def)\nby auto\ndeclare error_if_None [THEN iffD1, dest!]\n\nlemma if_error_if_None [simp]: \n \"((if b then y else error_if c e y) = None) = ((c \\ b) \\ y = None)\"\napply (simp add: abrupt_if_def)\napply auto\ndone\n\nlemma error_if_SomeD [dest!]:\n \"error_if c e y = Some z \\ c \\ z=(Error e) \\ y=None \\ (y=Some z)\"\napply (case_tac y)\napply (case_tac c)\napply (simp add: abrupt_if_def)\napply (simp add: abrupt_if_def)\napply auto\ndone\n\ndefinition\n absorb :: \"jump \\ abopt \\ abopt\"\n where \"absorb j a = (if a=Some (Jump j) then None else a)\"\n\nlemma absorb_SomeD [dest!]: \"absorb j a = Some x \\ a = Some x\"\nby (auto simp add: absorb_def)\n\nlemma absorb_same [simp]: \"absorb j (Some (Jump j)) = None\"\nby (auto simp add: absorb_def)\n\nlemma absorb_other [simp]: \"a \\ Some (Jump j) \\ absorb j a = a\"\nby (auto simp add: absorb_def)\n\nlemma absorb_Some_NoneD: \"absorb j (Some abr) = None \\ abr = Jump j\"\n by (simp add: absorb_def)\n\nlemma absorb_Some_JumpD: \"absorb j s = Some (Jump j') \\ j'\\j\"\n by (simp add: absorb_def)\n\n\nsubsubsection \"full program state\"\n\ntype_synonym\n state = \"abopt \\ st\" \\ \\state including abruption information\\\n\ntranslations\n (type) \"abopt\" <= (type) \"abrupt option\"\n (type) \"state\" <= (type) \"abopt \\ st\"\n\nabbreviation\n Norm :: \"st \\ state\"\n where \"Norm s == (None, s)\"\n\nabbreviation (input)\n abrupt :: \"state \\ abopt\"\n where \"abrupt == fst\"\n\nabbreviation (input)\n store :: \"state \\ st\"\n where \"store == snd\"\n\nlemma single_stateE: \"\\Z. Z = (s::state) \\ False\"\napply (erule_tac x = \"(Some k,y)\" for k y in all_dupE)\napply (erule_tac x = \"(None,y)\" for y in allE)\napply clarify\ndone\n\nlemma state_not_single: \"All ((=) (x::state)) \\ R\"\napply (drule_tac x = \"(if abrupt x = None then Some x' else None, y)\" for x' y in spec)\napply clarsimp\ndone\n\ndefinition\n normal :: \"state \\ bool\"\n where \"normal = (\\s. abrupt s = None)\"\n\nlemma normal_def2 [simp]: \"normal s = (abrupt s = None)\"\napply (unfold normal_def)\napply (simp (no_asm))\ndone\n\ndefinition\n heap_free :: \"nat \\ state \\ bool\"\n where \"heap_free n = (\\s. atleast_free (heap (store s)) n)\"\n\nlemma heap_free_def2 [simp]: \"heap_free n s = atleast_free (heap (store s)) n\"\napply (unfold heap_free_def)\napply simp\ndone\n\nsubsection \"update\"\n\ndefinition\n abupd :: \"(abopt \\ abopt) \\ state \\ state\"\n where \"abupd f = map_prod f id\"\n\ndefinition\n supd :: \"(st \\ st) \\ state \\ state\"\n where \"supd = map_prod id\"\n \nlemma abupd_def2 [simp]: \"abupd f (x,s) = (f x,s)\"\nby (simp add: abupd_def)\n\nlemma abupd_abrupt_if_False [simp]: \"\\ s. abupd (abrupt_if False xo) s = s\"\nby simp\n\nlemma supd_def2 [simp]: \"supd f (x,s) = (x,f s)\"\nby (simp add: supd_def)\n\nlemma supd_lupd [simp]: \n \"\\ s. supd (lupd vn v ) s = (abrupt s,lupd vn v (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\n\nlemma supd_gupd [simp]: \n \"\\ s. supd (gupd r obj) s = (abrupt s,gupd r obj (store s))\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma supd_init_obj [simp]: \n \"supd (init_obj G oi r) s = (abrupt s,init_obj G oi r (store s))\"\napply (unfold init_obj_def)\napply (simp (no_asm))\ndone\n\nlemma abupd_store_invariant [simp]: \"store (abupd f s) = store s\"\n by (cases s) simp\n\nlemma supd_abrupt_invariant [simp]: \"abrupt (supd f s) = abrupt s\"\n by (cases s) simp\n\nabbreviation set_lvars :: \"locals \\ state \\ state\"\n where \"set_lvars l == supd (set_locals l)\"\n\nabbreviation restore_lvars :: \"state \\ state \\ state\"\n where \"restore_lvars s' s == set_lvars (locals (store s')) s\"\n\nlemma set_set_lvars [simp]: \"\\ s. set_lvars l (set_lvars l' s) = set_lvars l s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nlemma set_lvars_id [simp]: \"\\ s. set_lvars (locals (store s)) s = s\"\napply (simp (no_asm_simp) only: split_tupled_all)\napply (simp (no_asm))\ndone\n\nsubsubsection \"initialisation test\"\n\ndefinition\n inited :: \"qtname \\ globs \\ bool\"\n where \"inited C g = (g (Stat C) \\ None)\"\n\ndefinition\n initd :: \"qtname \\ state \\ bool\"\n where \"initd C = inited C \\ globs \\ store\"\n\nlemma not_inited_empty [simp]: \"\\inited C Map.empty\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma inited_gupdate [simp]: \"inited C (g(r\\obj)) = (inited C g \\ r = Stat C)\"\napply (unfold inited_def)\napply (auto split: st.split)\ndone\n\nlemma inited_init_class_obj [intro!]: \"inited C (globs (init_class_obj G C s))\"\napply (unfold inited_def)\napply (simp (no_asm))\ndone\n\nlemma not_initedD: \"\\ inited C g \\ g (Stat C) = None\"\napply (unfold inited_def)\napply (erule notnotD)\ndone\n\nlemma initedD: \"inited C g \\ \\ obj. g (Stat C) = Some obj\"\napply (unfold inited_def)\napply auto\ndone\n\nlemma initd_def2 [simp]: \"initd C s = inited C (globs (store s))\"\napply (unfold initd_def)\napply (simp (no_asm))\ndone\n\nsubsubsection \\\\error_free\\\\\n\ndefinition\n error_free :: \"state \\ bool\"\n where \"error_free s = (\\ (\\ err. abrupt s = Some (Error err)))\"\n\nlemma error_free_Norm [simp,intro]: \"error_free (Norm s)\"\nby (simp add: error_free_def)\n\nlemma error_free_normal [simp,intro]: \"normal s \\ error_free s\"\nby (simp add: error_free_def)\n\nlemma error_free_Xcpt [simp]: \"error_free (Some (Xcpt x),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Jump [simp,intro]: \"error_free (Some (Jump j),s)\"\nby (simp add: error_free_def)\n\nlemma error_free_Error [simp]: \"error_free (Some (Error e),s) = False\"\nby (simp add: error_free_def) \n\nlemma error_free_Some [simp,intro]: \n \"\\ (\\ err. x=Error err) \\ error_free ((Some x),s)\"\nby (auto simp add: error_free_def)\n\nlemma error_free_abupd_absorb [simp,intro]: \n \"error_free s \\ error_free (abupd (absorb j) s)\"\nby (cases s) \n (auto simp add: error_free_def absorb_def\n split: if_split_asm)\n\nlemma error_free_absorb [simp,intro]: \n \"error_free (a,s) \\ error_free (absorb j a, s)\"\nby (auto simp add: error_free_def absorb_def\n split: if_split_asm)\n\nlemma error_free_abrupt_if [simp,intro]:\n\"\\error_free s; \\ (\\ err. x=Error err)\\\n \\ error_free (abupd (abrupt_if p (Some x)) s)\"\nby (cases s)\n (auto simp add: abrupt_if_def\n split: if_split)\n\nlemma error_free_abrupt_if1 [simp,intro]:\n\"\\error_free (a,s); \\ (\\ err. x=Error err)\\\n \\ error_free (abrupt_if p (Some x) a, s)\"\nby (auto simp add: abrupt_if_def\n split: if_split)\n\nlemma error_free_abrupt_if_Xcpt [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Xcpt x))) s)\"\nby simp \n\nlemma error_free_abrupt_if_Xcpt1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Xcpt x)) a, s)\" \nby simp \n\nlemma error_free_abrupt_if_Jump [simp,intro]:\n \"error_free s \n \\ error_free (abupd (abrupt_if p (Some (Jump j))) s)\" \nby simp\n\nlemma error_free_abrupt_if_Jump1 [simp,intro]:\n \"error_free (a,s) \n \\ error_free (abrupt_if p (Some (Jump j)) a, s)\" \nby simp\n\nlemma error_free_raise_if [simp,intro]:\n \"error_free s \\ error_free (abupd (raise_if p x) s)\"\nby simp \n\nlemma error_free_raise_if1 [simp,intro]:\n \"error_free (a,s) \\ error_free ((raise_if p x a), s)\"\nby simp \n\nlemma error_free_supd [simp,intro]:\n \"error_free s \\ error_free (supd f s)\"\nby (cases s) (simp add: error_free_def)\n\nlemma error_free_supd1 [simp,intro]:\n \"error_free (a,s) \\ error_free (a,f s)\"\nby (simp add: error_free_def)\n\nlemma error_free_set_lvars [simp,intro]:\n\"error_free s \\ error_free ((set_lvars l) s)\"\nby (cases s) simp\n\nlemma error_free_set_locals [simp,intro]: \n\"error_free (x, s)\n \\ error_free (x, set_locals l s')\"\nby (simp add: error_free_def)\n\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Bali/State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3380771241500058, "lm_q1q2_score": 0.1716795746847665}} {"text": "theory RedSafeCV\n imports RedSafeUnpack\nbegin\n \n (* ##### array extension case ###### *)\n \ndefinition ext_arr_abbrev where\n \"ext_arr_abbrev v = AppExp (ConstExp ExtArrayConst) (VarExp v)\" \n \ndefinition var_abbrev where\n \"var_abbrev v = VarExp v\" \n \ndefinition ext_app_abbrev where\n \"ext_app_abbrev a v = AppExp (ext_arr_abbrev a) v\" \n \nlemma ext_arr_type: \"\\ well_typed env r_s1 (ext_arr_abbrev v) tau r_s2 rx; v = LocType x y \\ \\\n well_typed env r_s1 (ext_arr_abbrev v) tau r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n apply (rule_tac infl_full_sexp_wp)\n apply (simp)\n apply (simp add: ext_arr_abbrev_def)\n done \n \nlemma ext_var_type: \"\\ well_typed env r_s1 (ext_arr_abbrev v) (FunTy t1 t2 r a) r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2)) \\ \\\n well_typed env r_s1 (var_abbrev v) t2 r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n apply (simp add: var_abbrev_def)\n apply (simp add: ext_arr_abbrev_def)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"r_ex\" in exI)\n apply (auto)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac id_leq_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (owner_name v) tau_x) r_ex)\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (auto)\n apply (simp add: app_req_def)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_exa)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac mini_disj_diff_leq_use_env2)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_exa)\" in mini_disj_leq_use_env2)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 rx2\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (owner_name v) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n done\n \nlemma ext_var_type2: \"\\ well_typed env r_s1 (ext_arr_abbrev v) (FunTy t1 t2 r a) r_s2 rx \\ \\\n well_typed env r_s1 (var_abbrev v) t2 r_s2 rx\" \n apply (simp add: ext_arr_abbrev_def)\n apply (simp add: var_abbrev_def)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac x=\"comp_use_env r_ex (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_exa)\" in exI)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac rhs_fold_dcl_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (owner_name v) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (ereq_use_env (owner_name v) tau_x) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (simp add: app_req_def)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_exa)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac lhs_fold_dcl_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (simp)\n done\n \n \nlemma spec_disj_diff_perms: \"\\ well_typed env r_s1 e tau r_s2 rx; is_sexp e;\n disj_use_env rx1 rx2; well_typed env r_s1 e tau r_s1 rx1 \\ \\\n well_typed env (diff_use_env r_s1 rx2) e tau (diff_use_env r_s2 rx2) (diff_use_env rx rx2)\" \n apply (rule_tac well_typed_diff_perms)\n apply (simp)\n apply (auto)\n apply (case_tac \"r_s1 x \\ NoPerm\")\n apply (cut_tac ?r_s1.0=\"r_s1\" and ?r_s2.0=\"r_s1\" and rx=\"rx1\" in wt_sexp_req_use)\n apply (auto)\n apply (simp add: disj_use_env_def)\n apply (simp add: own_env_vars_def)\n apply (simp add: mini_disj_use_env_def)\n apply (cut_tac x=\"x\" and ?r_s1.0=\"r_s1\" and env=\"env\" and e=\"e\" in well_typed_no_npv_use)\n apply (auto)\n done\n \nlemma sub_sep_nres_map: \"\\ contain_env rs_map rs_map'; sep_nres_map r_s rs_map \\ \\ sep_nres_map r_s rs_map'\" \n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (simp add: contain_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (simp add: nres_lookup_def)\n apply (case_tac \"rs_map' x\")\n apply (auto)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n \nlemma simp_sep_nres_map: \"\\ disj_nres_map rs_map \\ \\ sep_nres_map (nres_lookup rs_map x) (rem_env rs_map x)\" \n apply (simp add: disj_nres_map_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n apply (case_tac \"x = xa\")\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n apply (rule_tac empty_strong_disj_use_env2)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"xa\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: rem_env_def)\n done\n \n \nlemma trans_sub_use_env: \"\\ sub_use_env s r_s; leq_use_env r_x r_s \\ \\ sub_use_env s r_x\" \n apply (simp add: sub_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (case_tac \"r_x x\")\n apply (auto)\n done\n \nlemma well_typed_ext_array: \"\\ well_typed_list env rs_list arr n t; well_typed env r_s v t r_s r_s; is_value v \\ \\\n well_typed_list env (\\i. if i = int (length arr) + n then Some r_s else rs_list i) (ext_list arr v) n t\" \n apply (induction arr arbitrary: n rs_list)\n apply (auto)\n apply (rule_tac t=\"1 + int (length arr) + n\" and s=\"int (length arr) + (n + 1)\" in subst)\n apply (auto)\n done\n \n \nlemma spec_infl_leq_use_env: \"\\ leq_use_env r_ex r_s; mini_disj_use_env r_ex r_x; strong_use_env r_ex \\ \\ leq_use_env r_ex (infl_use_env r_s r_x)\" \n apply (simp add: leq_use_env_def)\n apply (simp add: infl_use_env_def)\n apply (simp add: strong_use_env_def)\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"r_s x\")\n apply (auto)\n apply (case_tac \"r_ex x\")\n apply (auto)\n apply (simp add: mini_disj_use_env_def)\n done\n \n\nlemma ext_path_lookup: \"path_lookup rs_map x l z \\ (\\ l. path_lookup (add_env rs_map z r_s) x l z)\" \n apply (induct l arbitrary: x)\n apply (auto)\n apply (rule_tac x=\"Nil\" in exI)\n apply (auto)\n apply (case_tac \"x = z\")\n apply (rule_tac x=\"Nil\" in exI)\n apply (auto)\n apply (case_tac \"rs_map x\")\n apply (auto)\n apply (case_tac \"\\ l. path_lookup (add_env rs_map z r_s) a l z\")\n apply (erule_tac exE)\n apply (rule_tac x=\"a # la\" in exI)\n apply (auto)\n apply (simp add: add_env_def)\n done\n \nlemma ext_proper_exp: \"\\ proper_exp rs_map (VarExp (LocType x y)) \\ \\ proper_exp (add_env rs_map x r_s) (VarExp (LocType x y))\" \n apply (simp add: proper_exp_def)\n apply (auto)\n apply (rule_tac l=\"l\" in ext_path_lookup)\n apply (auto)\n done\n\n \nlemma ext_proper_list: \"\\ proper_list rs_map arr; proper_exp rs_map v \\ \\ proper_list rs_map (ext_list arr v)\" \n apply (induct arr)\n apply (auto)\n done\n \nlemma scv_ext_array_alt: \"\n \\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f; are = CVApp;\n proper_exp rs_map (AppExp (AppExp (ConstExp ExtArrayConst) (VarExp (LocType ab b))) v);\n req_type tau = Ref; req_type tau_x = Ref;\n well_typed env r_s1 (ext_app_abbrev (LocType ab b) v) tau r_s2 rx; is_value v;\n s1 ab = Some (ArrValue arr); env (Loc ab) = Some tau \\\n \\ \\g_ax. red_env env g_ax (Loc ab) = Some tau \\\n (\\r_ex tau_x.\n red_env env g_ax (Loc b) = Some tau_x \\\n req_type tau = Ref \\\n req_type tau_x = Ref \\\n leq_use_env (ereq_use_env (Loc b) tau_x) (exp_red_use_env r_s1 g_ax) \\\n leq_use_env (end_red_use_env r_s2 g_ax) (diff_use_env (exp_red_use_env r_s1 g_ax) (comp_use_env (ereq_use_env (Loc b) tau_x) r_ex)) \\\n leq_use_env (end_red_use_env rx g_ax) (end_red_use_env r_s2 g_ax) \\\n leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\\n leq_use_env (diff_use_env (ereq_use_env (Loc b) tau_x) (comp_use_env (ereq_use_env (Loc b) tau_x) r_ex)) (end_red_use_env rx g_ax)) \\\n proper_exp (red_nres_map rs_map g_ax) (VarExp (LocType ab b)) \\\n well_typed_state (add_env s1 ab (ArrValue (ext_list arr v))) (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env (add_env s1 ab (ArrValue (ext_list arr v))) (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\\n safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act (UseAct b) g_ax\" \n apply (simp add: ext_app_abbrev_def)\n apply (auto)\n (* - prelim: req_type tau \\ Prim *)(*\n apply (case_tac \"req_type tau = Prim\")\n apply (cut_tac v=\"ab\" and tau=\"tau\" in var_value_prim1)\n apply (simp)\n apply (simp add: ext_arr_abbrev_def)\n apply (simp add: pure_fun_def)\n apply (auto)*)\n apply (simp add: app_req_def)\n (* structuring *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and ?r_s2.0=\"r_s2\" and v=\"LocType ab b\" and rx=\"rx\" and\n ?t1.0=\"t1\" and ?t2.0=\"tau\" and r=\"r\" and a=\"a\" in ext_var_type2)\n apply (rule_tac ?r_s2.0=\"diff_use_env r_s2a (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and\n rx=\"diff_use_env rx1 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (simp)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac self_comp_leq_use_env1)\n (* - prelim: r = Own *)\n apply (case_tac \"\\ is_own r\")\n apply (simp add: ext_arr_abbrev_def)\n apply (simp add: pure_fun_def)\n apply (simp add: is_own_def)\n (* - prelim: proving the greater rx1 + rx2 are disjoint *)\n apply (cut_tac ?r_s1.0=\"rx1\" and ?r_s2.0=\"infl_use_env r_s1 r_s2a\" and r_ex=\"lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r\"in disj_comp_use_env1)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac disj_comp_use_env2)\n apply (simp)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac disj_comp_use_env2)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac comm_disj_use_env)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* showing that rx2 is removable from the var *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"var_abbrev (LocType ab b)\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and\n ?rx1.0=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" and ?rx2.0=\"lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r\" in spec_disj_diff_perms)\n apply (auto)\n apply (simp add: var_abbrev_def)\n apply (rule_tac ext_var_type)\n apply (rule_tac ext_arr_type)\n apply (auto)\n (* - prelim: rx2 + [r_s2a - r_s3] \\ r_f (useful inequality) *)\n apply (cut_tac r_sc=\"lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r\" and r_sb=\"r_s1\" and r_sa=\"r_f\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* concretizing t1 *)\n apply (case_tac \"ArrayTy t1 \\ tau\")\n apply (simp add: ext_arr_abbrev_def)\n apply (simp add: pure_fun_def)\n apply (auto)\n (* existentials *)\n apply (rule_tac x=\"WriteResAct ab (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r)\" in exI)\n apply (auto)\n (* well-typedness comes easily *)\n apply (simp add: var_abbrev_def)\n (* proving properness *)\n apply (rule_tac ext_proper_exp)\n apply (simp add: proper_exp_def)\n (* proving the state remains well-typed *)\n apply (simp add: well_typed_state_def)\n apply (auto)\n (* environment contained in the state *)\n apply (rule_tac add_sub_env)\n apply (simp)\n (* validity: res_map completeness *)\n apply (simp add: valid_nres_map_def)\n apply (auto)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* - res_map self disjointness *)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n apply (rule_tac comp_sep_nres_map)\n apply (rule_tac simp_sep_nres_map)\n apply (simp)\n apply (rule_tac r_s=\"r_f\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: valid_exp_use_env_def)\n apply (auto)\n apply (rule_tac rs_map=\"rs_map\" in sub_sep_nres_map)\n apply (rule_tac rem_contain_env)\n apply (rule_tac id_contain_env)\n apply (simp)\n (* - res_map element containment *)\n apply (rule_tac dist_add_sub_nres_map)\n apply (simp)\n apply (rule_tac comp_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (rule_tac r_s=\"r_f\" in trans_sub_use_env)\n apply (simp add: valid_exp_use_env_def)\n apply (simp)\n (* proving that the array is still well-typed + proper: xa \\ deref_name x ab case *)\n apply (case_tac \"x \\ ab\")\n apply (simp add: add_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (case_tac \"s1 x\")\n apply (auto)\n apply (case_tac \"env (Loc x)\")\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n (* - properness *)\n apply (rule_tac proper_add_mv)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n (* xa = deref_name x ab case *)\n apply (case_tac \"add_env s1 ab (ArrValue (ext_list arr v)) ab = None\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"ab\" in allE)\n apply (auto)\n apply (rule_tac x=\"(\\ i. if i = int (length arr) then Some (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r) else rs_list i)\" in exI)\n apply (auto)\n (* - proving the function used to type the array is valid *)\n apply (simp add: valid_res_list_def)\n apply (auto)\n (* - i = length arr *)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: disj_res_list_def)\n apply (auto)\n apply (erule_tac x=\"j\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"nres_lookup rs_map ab\" in strong_disj_leq_use_env2)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env1)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (simp_all)\n (* - i \\ length arr *)\n apply (simp add: nres_lookup_def)\n apply (rule_tac comp_leq_use_env1)\n apply (erule_tac x=\"i\" in allE)\n apply (auto)\n apply (simp add: disj_res_list_def)\n apply (erule_tac x=\"i\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"nres_lookup rs_map ab\" in strong_disj_leq_use_env1)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env2)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n (* actual array well-typedness + properness *)\n apply (cut_tac env=\"env\" and arr=\"arr\" and v=\"v\" and n=\"0\" and t=\"t1\" and rs_list=\"rs_list\" in well_typed_ext_array)\n apply (auto)\n apply (rule_tac well_typed_lift_req)\n apply (rule_tac well_typed_lift_perms)\n apply (rule_tac infl_sexp_wp)\n apply (auto)\n apply (rule_tac value_is_sexp)\n apply (simp)\n apply (rule_tac id_leq_use_env)\n (* - properness *)\n apply (rule_tac proper_add_mv)\n apply (erule_tac x=\"ab\" in allE)\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac ext_proper_list)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (rule_tac self_comp_leq_use_env1)\n (* validity of expression permissions: containment *)\n apply (simp add: valid_exp_use_env_def)\n apply (auto)\n apply (rule_tac r_s=\"r_f\" in trans_sub_use_env)\n apply (rule_tac add_sub_use_env)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n (* - separation of permissions *)\n apply (rule_tac add_sep_nres_map)\n apply (rule_tac r_s=\"r_f\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac strong_disj_comp_use_env1)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env1)\n apply (simp add: sep_nres_map_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac diff_strong_disj_use_env)\n apply (rule_tac strong_lift_use_env)\n apply (simp)\n (* - action safety *)\n apply (rule_tac spec_infl_leq_use_env)\n apply (simp)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac mini_disj_comp_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in mini_disj_leq_use_env2)\n apply (rule_tac r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in mini_disj_leq_use_env1)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac gen_mini_disj_use_env2)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac strong_lift_use_env)\n apply (simp add: is_own_def)\n done\n \n (* ##### array write case ##### *)\n \ndefinition write_arr_abbrev where\n \"write_arr_abbrev v = AppExp (ConstExp WriteConst) (VarExp v)\" \n \ndefinition write_pair_abbrev where\n \"write_pair_abbrev i v = PairExp (ConstExp (IConst i)) v\" \n \ndefinition write_app_abbrev where\n \"write_app_abbrev a i v = AppExp (write_arr_abbrev a) (write_pair_abbrev i v)\" \n \nlemma write_var_type: \"\\ well_typed env r_s1 (write_pair_abbrev i v) (PairTy t1 t2 r) r_s2 rx; is_own r \\ \\\n well_typed env r_s1 v t2 r_s2 rx\" \n apply (simp add: write_pair_abbrev_def)\n apply (auto)\n apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n apply (simp add: is_own_def)\n apply (simp add: pair_req_def)\n apply (rule_tac ?r_s2.0=\"diff_use_env r_s3 r_ex\" and rx=\"diff_use_env rx2 r_ex\" in\n well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac self_lift_leq_use_env)\n done\n \n (* in principle this is true because for each part of the list, the element is either\n \"still\" well-typed, or it has been replaced with v which is well-typed.\n *)\n \nlemma corr_write_array_zero: \"\\ Some (a # arr') = write_array arr 0 v \\ \\ (\\ b. arr = b # arr' \\ a = v)\"\n apply (case_tac arr)\n apply (auto)\n done\n\nlemma corr_write_array_nz: \"\\ Some (a # arr') = write_array arr i v; i \\ 0 \\ \\\n (\\ arr_x. arr = a # arr_x \\ Some arr' = write_array arr_x (i - 1) v)\"\n apply (case_tac arr)\n apply (auto)\n apply (case_tac \"write_array list (i - 1) v\")\n apply (auto)\n apply (case_tac \"write_array list (i - 1) v\")\n apply (auto)\n done \n \nlemma zero_sum: \"\\ (n:: int) = (i :: int) + n \\ \\ i = 0\" \n apply (auto)\n done\n \nlemma wtwa_add_rev: \"\\ well_typed_list env rs_list arr (n + i) t; i > 0 \\ \\\n well_typed_list env (\\j. if j = n then Some r_s else rs_list j) arr ((n :: int) + i) t\" \n apply (induct arr arbitrary: i)\n apply (auto)\n apply (case_tac \"n + i + 1 = n + (i + 1)\")\n apply (auto)\n apply (rule_tac t=\"n + i + 1\" and s=\"n + (i + 1)\" in subst)\n apply (auto)\n done\n \nlemma proper_write_array: \"\\ proper_list rs_map arr; proper_exp rs_map v; Some arr' = write_array arr i v \\ \\ proper_list rs_map arr'\" \n apply (induct arr' arbitrary: i arr)\n apply (auto)\n apply (case_tac arr)\n apply (auto)\n apply (case_tac \"i = 0\")\n apply (auto)\n apply (case_tac \"write_array list (i - 1) v\")\n apply (auto)\n apply (case_tac arr)\n apply (auto)\n apply (case_tac \"i = 0\")\n apply (auto)\n apply (case_tac \"write_array list (i - 1) v\")\n apply (auto)\n apply (case_tac \"Some ab = write_array list (i - 1) v\")\n apply (iprover)\n apply (auto)\n done \n \nlemma well_typed_write_array: \"\\ well_typed_list env rs_list arr n t; well_typed env r_s v t r_s r_s;\n Some arr' = write_array arr i v; is_value v \\ \\\n well_typed_list env (\\j. if j = i + n then Some r_s else rs_list j) arr' (n :: int) t\" \n apply (induct arr' arbitrary: n i arr)\n apply (auto)\n (* n = i, (i = 0) *)\n apply (cut_tac arr=\"arr\" and arr'=\"arr'\" and v=\"v\" and a=\"a\" in corr_write_array_zero)\n apply (auto)\n apply (cut_tac arr=\"arr\" and arr'=\"arr'\" and v=\"v\" and a=\"a\" in corr_write_array_zero)\n apply (auto)\n (* - to prove that the remainder is well-typed, we claim it is the same remainder as the original *)\n apply (cut_tac arr=\"arr\" and arr'=\"arr'\" and v=\"v\" and a=\"a\" in corr_write_array_zero)\n apply (auto)\n apply (rule_tac wtwa_add_rev)\n apply (auto)\n (* n \\ i *)\n apply (cut_tac arr=\"arr\" and arr'=\"arr'\" and v=\"v\" and a=\"a\" in corr_write_array_nz)\n apply (auto)\n apply (rule_tac t=\"i + n\" and s=\"(i - 1) + (n + 1)\" in subst)\n apply (simp)\n apply (iprover)\n done\n\n\nlemma scv_write_case: \"\\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f; are = CVApp;\n proper_exp rs_map (AppExp (AppExp (ConstExp WriteConst) (VarExp (LocType ab b))) (PairExp (ConstExp (IConst i)) v));\n well_typed env r_s1 (write_app_abbrev (LocType ab b) i v) tau r_s2 rx; is_value v;\n FunTy t1a (FunTy (PairTy IntTy t2 rb) tau r a) ra aa = pure_fun (ArrayTy t) (FunTy (PairTy IntTy t OwnPerm) UnitTy OwnPerm Ref) Prim;\n ax = UseAct x; s1 ab = Some (ArrValue arr); Some arr' = write_array arr i v;\n env (Loc ab) = Some t1a \\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) unit_exp tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) unit_exp \\\n well_typed_state (add_env s1 ab (ArrValue arr')) (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env (add_env s1 ab (ArrValue arr')) (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\\n safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act (UseAct b) g_ax\"\n apply (simp add: write_app_abbrev_def)\n apply (auto)\n apply (case_tac \"t1 \\ PairTy IntTy t2 rb\")\n apply (simp add: write_arr_abbrev_def)\n apply (simp add: pure_fun_def)\n apply (auto)\n (* get the well-typedness statement for the value *)\n apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and i=\"i\" and v=\"v\" and ?t1.0=\"IntTy\" and ?t2.0=\"t2\" and\n r=\"rb\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in write_var_type)\n apply (auto)\n apply (simp add: is_own_def)\n apply (simp add: pure_fun_def)\n (* prelim: r = Own *)\n apply (case_tac \"\\ is_own r\")\n apply (simp add: is_own_def)\n apply (simp add: pure_fun_def)\n (* prelim: r = rc *)\n apply (case_tac \"r \\ rc\")\n apply (simp add: write_arr_abbrev_def)\n apply (simp add: pure_fun_def)\n (* prelim: constructed rx2 \\ r_f *)\n apply (cut_tac r_sc=\"lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r\" and r_sb=\"r_s1\" and r_sa=\"r_f\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac lhs_infl_leq_use_env)\n apply (rule_tac id_leq_use_env)\n (* well-typedness statement *)\n apply (rule_tac x=\"WriteResAct ab (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r)\" in exI)\n apply (auto)\n apply (simp add: unit_exp_def)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac well_typed_perm_leq)\n apply (auto)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp)\n (* properness *)\n apply (simp add: proper_exp_def)\n apply (simp add: unit_exp_def)\n (* proving the state remains well-typed *)\n apply (simp add: well_typed_state_def)\n apply (auto)\n (* containment of env in state *)\n apply (rule_tac add_sub_env)\n apply (simp)\n (* validity of res_map: completeness *)\n apply (simp add: valid_nres_map_def)\n apply (auto)\n apply (rule_tac add_full_nres_map)\n apply (simp)\n (* - disjointness *)\n apply (rule_tac disj_add_nres_map)\n apply (simp)\n apply (rule_tac comp_sep_nres_map)\n apply (rule_tac simp_sep_nres_map)\n apply (simp)\n apply (rule_tac r_s=\"r_f\" in leq_sep_nres_map)\n apply (simp)\n apply (simp add: valid_exp_use_env_def)\n apply (rule_tac rs_map=\"rs_map\" in sub_sep_nres_map)\n apply (rule_tac rem_contain_env)\n apply (rule_tac id_contain_env)\n apply (simp)\n (* - element containment *)\n apply (rule_tac dist_add_sub_nres_map)\n apply (simp)\n apply (rule_tac comp_sub_use_env)\n apply (simp add: sub_nres_map_def)\n apply (rule_tac r_s=\"r_f\" in trans_sub_use_env)\n apply (simp add: valid_exp_use_env_def)\n apply (simp)\n (* proving that the array is still well-typed + proper : xa \\ deref_name x ab *)\n apply (case_tac \"xa \\ ab\")\n apply (erule_tac x=\"xa\" in allE)\n apply (simp add: add_env_def)\n apply (auto)\n apply (case_tac \"s1 xa\")\n apply (auto)\n apply (case_tac \"env (Loc xa)\")\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (simp add: add_env_def)\n (* - properness *)\n apply (rule_tac proper_add_mv)\n apply (simp)\n apply (rule_tac self_comp_leq_use_env1)\n (* xa = deref_name x ab case *)\n apply (case_tac \"add_env s1 ab (ArrValue arr') ab = None\")\n apply (simp add: add_env_def)\n apply (auto)\n apply (simp add: add_env_def)\n apply (erule_tac x=\"ab\" in allE)\n apply (auto)\n apply (rule_tac x=\"(\\ j. if j = i then Some (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r) else rs_list j)\" in exI)\n apply (auto)\n (* validity of res map function: ia = i *)\n apply (simp add: valid_res_list_def)\n apply (auto)\n apply (simp add: nres_lookup_def)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp add: disj_res_list_def)\n apply (auto)\n apply (erule_tac x=\"j\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env1)\n apply (rule_tac r_s=\"nres_lookup rs_map ab\" in strong_disj_leq_use_env2)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n (* ia \\ i *)\n apply (simp add: nres_lookup_def)\n apply (erule_tac x=\"ia\" in allE)\n apply (auto)\n apply (rule_tac comp_leq_use_env1)\n apply (simp)\n apply (simp add: disj_res_list_def)\n apply (erule_tac x=\"ia\" in allE)\n apply (auto)\n apply (rule_tac r_s=\"nres_lookup rs_map ab\" in strong_disj_leq_use_env1)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env2)\n apply (rule_tac comm_strong_disj_use_env)\n apply (simp add: valid_exp_use_env_def)\n apply (simp add: sep_nres_map_def)\n apply (auto)\n (* proving the array itself still types *)\n apply (cut_tac env=\"env\" and i=\"i\" and n=\"0\" and arr=\"arr\" and arr'=\"arr'\" and r_s=\"lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r\" and\n rs_list=\"rs_list\" in well_typed_write_array)\n apply (auto)\n apply (rule_tac well_typed_lift_req)\n apply (rule_tac well_typed_lift_perms)\n apply (rule_tac infl_sexp_wp)\n apply (simp add: pure_fun_def)\n apply (rule_tac value_is_sexp)\n apply (auto)\n apply (rule_tac id_leq_use_env)\n (* proving the array is still proper *)\n apply (erule_tac x=\"ab\" in allE)\n apply (auto)\n apply (rule_tac proper_add_mv)\n apply (simp add: add_env_def)\n apply (auto)\n apply (rule_tac v=\"v\" in proper_write_array)\n apply (auto)\n apply (simp add: proper_exp_def)\n apply (rule_tac self_comp_leq_use_env1)\n (* proving validity of the new permission map: containment in state *)\n apply (simp add: valid_exp_use_env_def)\n apply (auto)\n apply (rule_tac add_sub_use_env)\n apply (rule_tac r_s=\"r_f\" in trans_sub_use_env)\n apply (simp)\n apply (rule_tac self_diff_leq_use_env)\n (* separation *)\n apply (rule_tac add_sep_nres_map)\n apply (rule_tac r_s=\"r_f\" in leq_sep_nres_map)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac strong_disj_comp_use_env1)\n apply (rule_tac r_s=\"r_f\" in strong_disj_leq_use_env1)\n apply (simp add: sep_nres_map_def)\n apply (rule_tac self_diff_leq_use_env)\n apply (rule_tac diff_strong_disj_use_env)\n apply (rule_tac strong_lift_use_env)\n apply (simp)\n (* - action safety *)\n apply (rule_tac spec_infl_leq_use_env)\n apply (simp)\n apply (simp add: lift_comp_use_env)\n apply (rule_tac mini_disj_comp_use_env)\n apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in mini_disj_leq_use_env2)\n apply (rule_tac r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in mini_disj_leq_use_env1)\n apply (rule_tac mini_disj_diff_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (rule_tac self_comp_leq_use_env2)\n apply (simp)\n apply (simp add: infl_lift_use_env)\n apply (rule_tac gen_mini_disj_use_env2)\n apply (rule_tac infl_disj_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac self_diff_leq_use_env)\n apply (simp)\n apply (rule_tac strong_lift_use_env)\n apply (simp add: is_own_def)\n done\n \n \n (* ##### array read case ##### *)\n \nlemma well_typed_lookup_array: \"\\ well_typed_state s env rs_map; read_array arr i = Some v; s x = Some (ArrValue arr); env (Loc x) = Some (ArrayTy tau) \\ \\\n (\\ rs_list. valid_res_list (nres_lookup rs_map x) rs_list \\ well_typed_list env rs_list arr 0 tau)\"\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n done\n\nlemma well_typed_list_elem: \"\\ well_typed_list env rs_list arr n tau; read_array arr (i :: int) = Some v \\ \\\n (\\ r_x. rs_list (n + i) = Some r_x \\ well_typed env r_x v tau r_x r_x \\ is_value v)\" \n apply (induct arr arbitrary: n i)\n apply (auto)\n apply (case_tac \"i = 0\")\n apply (auto)\n apply (case_tac \"\\ (\\r_x. rs_list ((n + 1) + (i - 1)) = Some r_x \\ well_typed env r_x v tau r_x r_x \\ is_value v)\")\n apply (iprover)\n apply (auto)\n done\n \nlemma well_typed_lookup_array_elem: \"\\ well_typed_state s env rs_map; read_array arr i = Some v; s x = Some (ArrValue arr); env (Loc x) = Some (ArrayTy tau) \\ \\\n (\\ rs_list r_x. unlim tau \\ valid_res_list (nres_lookup rs_map x) rs_list \\ rs_list i = Some r_x \\ well_typed env r_x v tau r_x r_x \\ is_value v)\"\n apply (simp add: well_typed_state_def) \n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (rule_tac x=\"rs_list\" in exI)\n apply (auto)\n apply (cut_tac rs_list=\"rs_list\" and arr=\"arr\" and n=\"0\" and i=\"i\" in well_typed_list_elem)\n apply (auto)\n done \n\nlemma wts_mem_val_env: \"\\ well_typed_state s env rs_map \\ \\ mem_val_env env\"\n apply (simp add: mem_val_env_def)\n apply (auto)\n apply (case_tac \"env x\")\n apply (auto)\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (simp add: sub_env_def)\n apply (erule_tac x=\"x\" in allE)\n apply (auto)\n apply (erule_tac x=\"y\" in allE)\n apply (auto)\n apply (case_tac ya)\n apply (auto)\n done\n (*\nlemma ack_exp_value: \"\\ is_value e \\ \\ is_value (set_own e a)\" \n apply (induct e)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n done*)\n (*\nlemma finish_is_value: \"\\ is_value e \\ \\ is_value (finish_value s e)\"\n apply (induct e)\n apply (auto)\n apply (case_tac x2a)\n apply (auto)\n apply (case_tac x2a)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n done\n *)\nlemma alpha_rename_is_value: \"\\ is_value e \\ \\ is_value (deep_alpha_rename e a b)\" \n apply (induct e)\n apply (auto)\n apply (case_tac x)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n done\n \nlemma lam_var_remove_is_value: \"\\ is_value e \\ \\ is_value (lam_var_remove e a b)\" \n apply (induct e)\n apply (auto)\n apply (case_tac e1)\n apply (auto)\n done\n \nlemma lam_var_list_remove_is_value: \"\\ is_value e \\ \\ is_value (lam_var_list_remove e vl)\" \n apply (induct vl arbitrary: e)\n apply (auto)\n apply (cut_tac e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_is_value)\n apply (auto)\n done \n\n \nlemma proper_path_lookup: \"\\ rs_map a = Some r_s; proper_exp rs_map (VarExp (LocType a b)) \\ \\ (\\ l. path_lookup rs_map b l a)\"\n apply (simp add: proper_exp_def)\n done\n \nlemma read_proper_exp: \"\\ proper_list rs_map arr; read_array arr i = Some v \\ \\ proper_exp rs_map v\" \n apply (induct arr arbitrary: i)\n apply (auto)\n apply (case_tac \"i = 0\")\n apply (auto)\n done\n\nlemma scv_read_case: \n \"\\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f; are = CVApp;\n proper_exp rs_map (AppExp (AppExp (ConstExp ReadConst) (VarExp (LocType ab b))) (ConstExp (IConst i))); leq_use_env r_s2aa r_s1;\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); leq_use_env rx1a r_s2aa;\n leq_use_env r_s2a (diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2;\n leq_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_s3a; leq_use_env r_ex r_s1; leq_use_env (app_req rx1 rx2 r tau r_ex) rx;\n leq_use_env r_exa r_s1;\n leq_use_env (app_req rx1a rx2a ra (FunTy IntTy tau r a) r_exa) rx1; c = ReadConst;\n FunTy t1a (FunTy IntTy tau r a) ra aa = pure_fun (ArrayTy t) (pure_fun IntTy t Ref) Prim; unlim t; v1 = VarExp (LocType ab b); v2 = ConstExp (IConst i);\n ax = UseAct b; s1 ab = Some (ArrValue arr); read_array arr i = Some v; s2 = s1; e2 = set_own v b; t1 = IntTy; env (Loc ab) = Some t1a;\n leq_use_env r_s3 r_s2a; leq_use_env rx2 r_s3; env (Loc b) = Some tau_x; req_type t1a = Ref; req_type tau_x = Ref;\n leq_use_env (ereq_use_env (Loc b) tau_x) r_s2aa; leq_use_env r_s3a (diff_use_env r_s2aa (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb));\n leq_use_env rx2a r_s3a; leq_use_env r_exb r_s2aa;\n leq_use_env (diff_use_env (ereq_use_env (Loc b) tau_x) (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)) rx2a\\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) (set_own v b) tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) (set_own v b) \\\n well_typed_state s1 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s1 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act (UseAct b) g_ax\"\n (* array read case *)\n (* - first we have to extract the type of e2. *)\n apply (cut_tac rs_map=\"rs_map\" and s=\"s1\" and env=\"env\" and i=\"i\" and v=\"v\" and x=\"ab\" and arr=\"arr\" in well_typed_lookup_array_elem)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac x=\"ReadResAct\" in exI)\n apply (auto)\n (* - the idea here is that e2 should be re-typed so that all of its permissions are encompassed by x3. *)\n apply (cut_tac env=\"env\" and s=\"s1\" and rs_map=\"rs_map\" in wts_mem_val_env)\n apply (auto)\n apply (case_tac \"\\ mem_ty tau_x\")\n apply (simp add: mem_val_env_def)\n apply (erule_tac x=\"Loc b\" in allE)\n apply (auto)\n apply (cut_tac env=\"env\" and r_x=\"r_x\" and e=\"v\" and tau=\"t\" and t=\"tau_x\" and b=\"b\" and r_s=\"one_use_env (Loc b) UsePerm\" and s=\"s1\" in well_typed_set_own)\n apply (auto)\n apply (simp add: one_use_env_def)\n apply (simp add: well_typed_state_def)\n apply (simp add: mem_val_env_def)\n apply (erule_tac x=\"Loc b\" in allE)\n apply (auto)\n (* prelim: r_s2 \\ r_s1 *)\n apply (cut_tac r_sc=\"r_s3\" and r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2aa (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (simp_all)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n (* analysis based on whether x3 is in rx or not *)\n apply (case_tac \"rx (Loc b) \\ NoPerm\")\n apply (case_tac \"\\ leq_use_env (one_use_env (Loc b) UsePerm) rx\")\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (auto)\n apply (case_tac \"Loc b = x\")\n apply (auto)\n apply (case_tac \"rx (Loc b)\")\n apply (auto)\n apply (rule_tac ?r_s1.0=\"r_s2\" in well_typed_incr_start_perm)\n apply (rule_tac rx=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_req)\n apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n apply (auto)\n apply (simp add: pure_fun_def)\n (* prelim: x3 \\ r_s1 *)\n apply (cut_tac r_sc=\"one_use_env (Loc b) UsePerm\" and r_sb=\"ereq_use_env (Loc b) tau_x\" and r_sa=\"r_s1\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"r_s2aa\" in trans_leq_use_env)\n apply (simp_all)\n apply (simp add: ereq_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: end_req_perm_def)\n (* case where t2 = Prim *)\n apply (simp add: app_req_def)\n apply (case_tac \"req_type tau = Prim\")\n apply (auto)\n apply (rule_tac ?r_s2.0=\"r_s1\" and rx=\"empty_use_env\" in well_typed_simul_end_perm)\n apply (rule_tac rx=\"one_use_env (Loc b) UsePerm\" in wt_sexp_no_req)\n apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (rule_tac value_is_sexp)\n apply (rule_tac v=\"v\" in set_own_value)\n apply (auto)\n (* otherwise, since rx x3 = NoPerm, we prepare a diff *)\n apply (rule_tac ?r_s2.0=\"diff_use_env r_s1 (comp_use_env (comp_use_env (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\n (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa))\n (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" and\n rx=\"diff_use_env (one_use_env (Loc b) UsePerm) (comp_use_env (comp_use_env (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\n (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa))\n (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in well_typed_simul_end_perm)\n apply (rule_tac well_typed_diff_end_perm)\n apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n apply (simp)\n apply (simp add: pure_fun_def)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac dist_comp_leq_use_env)\n apply (rule_tac r_sb=\"r_s2aa\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s3a\" in trans_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2aa (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\" in trans_leq_use_env)\n apply (rule_tac diff_leq_use_env)\n apply (auto)\n apply (rule_tac dist_comp_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n apply (rule_tac rhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac r_sb=\"diff_use_env r_s2aa (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\" in trans_leq_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env1)\n apply (simp add: pure_fun_def)\n apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1a rx2a) (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n apply (auto)\n apply (rule_tac lhs_unroll_dcl_use_env)\n apply (rule_tac dist_diff_leq_use_env)\n apply (rule_tac comp_leq_use_env2)\n apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Loc b) tau_x) (comp_use_env (ereq_use_env (Loc b) tau_x) r_exb)\" in trans_leq_use_env)\n apply (simp)\n apply (rule_tac dist_diff_leq_use_env)\n apply (simp add: ereq_use_env_def)\n apply (simp add: leq_use_env_def)\n apply (simp add: one_use_env_def)\n apply (simp add: end_req_perm_def)\n (* to prove it is proper, we first have to do the lookup of deref_name x ab. *)\n apply (case_tac \"rs_map ab = None\")\n apply (case_tac \"s1 ab = None\")\n apply (simp)\n apply (simp add: well_typed_state_def)\n apply (simp add: valid_nres_map_def)\n apply (simp add: full_nres_map_def)\n apply (auto)\n apply (erule_tac x=\"ab\" in allE)\n apply (auto)\n apply (cut_tac rs_map=\"rs_map\" and a=\"ab\" and b=\"b\" in proper_path_lookup)\n apply (auto)\n apply (simp add: proper_exp_def)\n (* with this in mind, we can prove it is still proper after ack *)\n apply (rule_tac e=\"v\" and a=\"ab\" and b=\"b\" and l=\"l\" and r_s=\"y\" and env=\"env\" and r_se=\"r_x\" and r_xe=\"r_x\" in proper_set_own)\n apply (auto)\n (* - the value is proper from our definition of wts *)\n apply (simp add: well_typed_state_def)\n apply (auto)\n apply (erule_tac x=\"ab\" in allE)\n apply (auto)\n apply (cut_tac arr=\"arr\" and i=\"i\" and v=\"v\" in read_proper_exp)\n apply (auto)\n apply (rule_tac wts_mem_val_env)\n apply (auto)\n (* well-typedness since r_x \\ y *)\n apply (rule_tac ?r_s1.0=\"r_x\" in well_typed_incr_start_perm)\n apply (simp)\n apply (simp add: valid_res_list_def)\n apply (erule_tac x=\"i\" in allE)\n apply (erule_tac x=\"r_x\" in allE)\n apply (auto)\n apply (simp add: nres_lookup_def)\n done\n\n \nlemma sares_cv_case: \"\n \\well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f; are = CVApp; e1 = AppExp (AppExp (ConstExp c) v1) v2;\n bin_const c; is_value v1; is_value v2; app_cv s1 c v1 v2 ax (s2, e2); FunTy t1a (FunTy t1 tau r a) ra aa \\ const_type c;\n proper_exp rs_map (AppExp (AppExp (ConstExp c) v1) v2); well_typed env r_s2a v2 t1 r_s3 rx2; leq_use_env r_s2aa r_s1;\n leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); leq_use_env rx1a r_s2aa;\n well_typed env r_s2aa v1 t1a r_s3a rx2a;\n leq_use_env r_s2a (diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa));\n leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; (*safe_use_lift rx2a ra;*) disj_use_env rx1 (lift_use_env rx2 r);\n leq_use_env rx r_s2; leq_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_s3a; leq_use_env r_ex r_s1; leq_use_env (app_req rx1 rx2 r tau r_ex) rx;\n disj_use_env rx1a (lift_use_env rx2a ra); leq_use_env rx1 r_s2a; leq_use_env r_exa r_s1;\n leq_use_env (app_req rx1a rx2a ra (FunTy t1 tau r a) r_exa) rx1\\\n \\ \\g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 tau (end_red_use_env r_s2 g_ax) (end_red_use_env rx g_ax) \\\n proper_exp (red_nres_map rs_map g_ax) e2 \\ well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\\n valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\ safe_act s1 (infl_use_env r_f r_s2) g_ax \\ corr_act ax g_ax\"\n apply (case_tac c)\n apply (auto)\n (* array extension case *)\n apply (rule_tac scv_ext_array_alt)\n apply (auto)\n apply (simp add: pure_fun_def)\n apply (simp add: ext_app_abbrev_def)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (simp add: ext_arr_abbrev_def)\n apply (auto)\n apply (rule_tac x=\"t1a\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s2aa\" in exI)\n apply (auto)\n apply (simp add: pure_fun_def)\n (* array read case *)\n apply (rule_tac ?r_s3.0=\"r_s3\" and r_ex=\"r_ex\" and ?rx2.0=\"rx2\" in scv_read_case)\n apply (auto)\n (* array write case *)\n apply (rule_tac scv_write_case)\n apply (auto)\n apply (simp add: write_app_abbrev_def)\n apply (rule_tac x=\"PairTy IntTy t2 rb\" in exI)\n apply (rule_tac x=\"r\" in exI)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"r_s2a\" in exI)\n apply (rule_tac x=\"rx1\" in exI)\n apply (auto)\n apply (simp add: write_arr_abbrev_def)\n apply (rule_tac x=\"t1a\" in exI)\n apply (rule_tac x=\"ra\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s2aa\" in exI)\n apply (auto)\n apply (simp add: write_pair_abbrev_def)\n apply (rule_tac x=\"rx2\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s3\" in exI)\n apply (auto)\n apply (rule_tac x=\"r_s2b\" in exI)\n apply (auto)\ndone\n \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/RedSafeCV.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.33807712415000574, "lm_q1q2_score": 0.17167957468476647}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__108.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__108 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__108 and some rule r*}\nlemma n_PI_Remote_GetVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__108:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__108:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__108:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__108:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__108:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__108:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__108:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__108:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__108:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_GetVsinv__108:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__108:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__108:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''CacheState'')) (Const CACHE_S))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__108:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__108:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__108:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__108 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__108:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__108:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__108:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__108:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__108:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__108:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__108:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__108:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__108:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__108:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__108:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__108:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__108:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__108:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__108:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__108:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__108:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__108:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__108.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.33807711748081287, "lm_q1q2_score": 0.1716795712980712}} {"text": "(*****************************************************************************\n * ESPL --- an embedded security protocol logic\n * http://people.inf.ethz.ch/meiersi/espl/\n *\n * Copyright (c) 2009-2011, Simon Meier, ETH Zurich, Switzerland\n *\n * Extension to compromising adversaries:\n *\n * Copyright (c) 2010-2011, Martin Schaub, ETH Zurich, Switzerland\n *\n * All rights reserved. See file LICENCE for more information.\n ******************************************************************************)\ntheory ExecMessage\nimports\n HOL_ext\n Protocol\nbegin\n\nsubsection{* Execution Messages *}\n\ntypedef tid = \"UNIV :: nat set\" by blast\n\ndatatype execlit = EConst id\n | EAgent id\n | ENonce id tid\n | EveNonce id\n\ndatatype execmsg = Lit execlit\n | Tup execmsg execmsg\n | Enc execmsg execmsg\n | Hash execmsg\n | K execmsg execmsg\n | KShr \"id set\" (* a set of agent sharing this key *)\n | PK execmsg\n | SK execmsg\n\n\ntext{*Concrete syntax: messages appear as {|A,B,NA|}, etc...*}\nsyntax\n \"@MTuple\" :: \"['a, args] => 'a * 'b\" (\"(2{|_,/ _|})\")\n\nsyntax (xsymbols)\n \"@MTuple\" :: \"['a, args] => 'a * 'b\" (\"(2\\_,/ _\\)\")\n\ntranslations\n \"{|x, y, z|}\" == \"{|x, {|y, z|}|}\"\n \"{|x, y|}\" == \"(CONST Tup) x y\"\n\n\ntext{* \n A shallow reference to bi-directional keys between two agents.\n Used only in proofs, but not in specifications. Hence, it can\n be ignored for soundness.\n*}\ndefinition Agent :: \"execmsg set\"\nwhere \"Agent \\ { Lit (EAgent a) | a. True}\"\n\ndefinition agents :: \"execmsg set \\ id set\"\nwhere \"agents M = {a. Lit (EAgent a) \\ M}\"\n\ndefinition Kbd :: \"execmsg \\ execmsg \\ execmsg\"\nwhere \"Kbd a b = (if (a \\ Agent \\ b \\ Agent) \n then KShr (agents {a, b}) \n else undefined)\"\n\nlemma Kbd_commute [simp]: \n \"Kbd x y = Kbd y x\"\n by (auto simp: Kbd_def agents_def)\n\nlemma size_Kbd [simp]: \n \"\\ a \\ Agent; b \\ Agent \\ \\ size (Kbd a b) = 0\"\n by ( auto simp: Kbd_def)\n\nlemma Kbd_free [simp]:\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ Lit l\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ Tup x y\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ Enc x y\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ Hash x\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ K x y\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ PK x\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ SK x\"\n by (auto simp: Kbd_def)\n\ndeclare Kbd_free[symmetric, simp]\n\nlemma Kbd_split_inj:\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent; y \\ Agent \\ \\\n (Kbd a b = Kbd x y) = (a = x \\ b = y \\ a = y \\ b = x)\"\n apply(clarsimp simp: Kbd_def Agent_def agents_def set_eq_iff) \n apply(rule iffI)\n apply(rename_tac a' b' x' y')\n apply(safe)\n apply(drule_tac x=\"a'\" in spec)\n apply(simp)\n apply(drule_tac x=\"y'\" in spec)\n apply(simp)\n apply(drule_tac x=\"x'\" in spec)\n apply(simp)\n apply(drule_tac x=\"b'\" in spec)\n apply(simp)\n done\n\nlemma Kbd_non_split_inj [simp]:\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent \\\n \\ (Kbd a b = Kbd x b) = (a = x)\"\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent \\\n \\ (Kbd a b = Kbd b x) = (a = x)\"\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent \\\n \\ (Kbd b a = Kbd x b) = (a = x)\"\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent \\\n \\ (Kbd b a = Kbd b x) = (a = x)\"\n \"\\ a \\ Agent; y \\ Agent; x \\ Agent \\\n \\ (Kbd a a = Kbd x y) = (a = y \\ x = y)\"\n \"\\ a \\ Agent; b \\ Agent; x \\ Agent \\\n \\ (Kbd a b = Kbd x x) = (a = x \\ b = x)\"\n by (auto simp: Kbd_split_inj)\n\nlemma Kbd_cases [ consumes 1\n , case_names Agent_a Agent_b Agent_x Agent_y noswap swapped]:\n \"\\ Kbd a b = Kbd x y;\n a \\ Agent; b \\ Agent; \n x \\ Agent; y \\ Agent; \n \\ a = x; b = y \\ \\ R; \n \\ a = y; b = x \\ \\ R\n \\ \\ R\"\n by (auto simp: Kbd_split_inj)\n\nsubsection{* Operations *}\n\ntype_synonym store = \"varid \\ tid \\ execmsg\"\n\ntext{* Key inversion *}\nfun inv :: \"execmsg \\ execmsg\"\nwhere\n \"inv (PK m) = SK m\"\n| \"inv (SK m) = PK m\"\n| \"inv m = m\"\n\nlemma inv_Kbd [simp]: \n \"\\ a \\ Agent; b \\ Agent \\ \\ inv (Kbd a b) = Kbd a b\"\n by(auto simp: Kbd_def)\n\n\ntext{* Instantiating a pattern *}\nfun inst :: \"store \\ tid \\ pattern \\ execmsg option\"\nwhere\n \"inst s i (PConst c) = Some (Lit (EConst c))\"\n| \"inst s i (PFresh n) = Some (Lit (ENonce n i))\"\n| \"inst s i (PVar v) = Some (s (v, i))\"\n| \"inst s i (PTup x y) = opt_map2 Tup (inst s i x) (inst s i y)\"\n| \"inst s i (PEnc m k) = opt_map2 Enc (inst s i m) (inst s i k)\"\n| \"inst s i (PSign m k) = \n opt_map2 Tup (inst s i m) \n (opt_map2 Enc (inst s i m) (map_option inv (inst s i k)))\"\n| \"inst s i (PHash m) = map_option Hash (inst s i m)\"\n| \"inst s i (PSymK a b) = opt_map2 K (inst s i a) (inst s i b)\"\n| \"inst s i (PAsymPK a) = map_option PK (inst s i a)\"\n| \"inst s i (PAsymSK a) = map_option SK (inst s i a)\"\n| \"inst s i (PShrK V) = \n (if (\\ v \\ V. s (v, i) \\ Agent)\n then Some (KShr (agents {s (v, i) | v. v \\ V})) \n else None)\"\n| \"inst s i (PAny) = None\"\n\ntext{* Instantiate a pattern and export wildcards *}\nfun any_inst :: \"store \\ tid \\ pattern \\ (execmsg, execmsg option) varfun\"\nwhere\n \"any_inst s i (PConst c) = Val (Some (Lit (EConst c)))\"\n| \"any_inst s i (PFresh n) = Val (Some (Lit (ENonce n i)))\"\n| \"any_inst s i (PVar v) = Val (Some (s (v, i)))\"\n| \"any_inst s i (PTup x y) = var_lift2 (opt_map2 Tup) (any_inst s i x) (any_inst s i y)\"\n| \"any_inst s i (PEnc m k) = var_lift2 (opt_map2 Enc) (any_inst s i m) (any_inst s i k)\"\n| \"any_inst s i (PSign m k) = var_lift2\n (\\m' k'. opt_map2 Tup m' (opt_map2 Enc m' (map_option inv k')))\n (any_inst s i m) (any_inst s i k)\"\n| \"any_inst s i (PHash m) = var_map (map_option Hash) (any_inst s i m)\"\n| \"any_inst s i (PSymK a b) = var_lift2 (opt_map2 K) (any_inst s i a) (any_inst s i b)\"\n| \"any_inst s i (PAsymPK a) = var_map (map_option PK) (any_inst s i a)\"\n| \"any_inst s i (PAsymSK a) = var_map (map_option SK) (any_inst s i a)\"\n| \"any_inst s i (PShrK V) = Val (inst s i (PShrK V))\"\n| \"any_inst s i (PAny) = Fun (\\m. Val (Some m))\"\n\n\ntext{* We assume that recipients making use of shared keys look them up\n in a table. This lookup only succeeds if agent identities are \n given.\n*}\n\nlemma Some_inst_sKbd [simp]:\n \"(Some m = inst s i (sKbd a b)) = \n (m = Kbd (s (a, i)) (s (b, i)) \\ \n s (a, i) \\ Agent \\ s (b, i) \\ Agent\n )\"\n by (auto simp: sKbd_def Kbd_def Agent_def agents_def)\n\n\nfun unpair :: \"execmsg \\ execmsg set\"\nwhere\n \"unpair (Tup x y) = unpair x \\ unpair y\"\n| \"unpair m = {m}\"\n\n\ntext{* \n We do not use neither subterms nor parts in our reasoning \n infrastructure. However it used to formulate a few lemmas\n illustrating the relation between Paulsons' approach and ours.\n*}\n\nfun subterms :: \"execmsg \\ execmsg set\"\nwhere\n \"subterms (Lit l) = {Lit l}\"\n| \"subterms (Tup x y) = insert (Tup x y) (subterms x \\ subterms y)\"\n| \"subterms (Enc m k) = insert (Enc m k) (subterms m \\ subterms k)\"\n| \"subterms (Hash m) = insert (Hash m) (subterms m)\"\n| \"subterms (K a b) = insert (K a b) (subterms a \\ subterms b)\"\n| \"subterms (PK a) = insert (PK a) (subterms a)\"\n| \"subterms (SK a) = insert (SK a) (subterms a)\"\n| \"subterms (KShr A) = insert (KShr A) {Lit (EAgent a) | a. a \\ A}\"\n\nfun parts :: \"execmsg \\ execmsg set\"\nwhere\n \"parts (Lit l) = {Lit l}\"\n| \"parts (Tup x y) = insert (Tup x y) (parts x \\ parts y)\"\n| \"parts (Enc m k) = insert (Enc m k) (parts m)\"\n| \"parts (Hash m) = {Hash m}\"\n| \"parts (K a b) = {K a b}\"\n| \"parts (PK a) = {PK a}\"\n| \"parts (SK a) = {SK a}\"\n| \"parts (KShr A) = {KShr A}\"\n\n\nfun pairParts :: \"execmsg \\ execmsg set\"\nwhere\n \"pairParts (Tup x y) = \n insert (Tup x y) (pairParts x \\ pairParts y)\"\n| \"pairParts m = {m}\"\n\nlemma pairParts_Kbd [simp]: \n \"\\ a \\ Agent; b \\ Agent \\ \\ pairParts (Kbd a b) = {Kbd a b}\"\n by (auto simp: Kbd_def)\n\ninductive_set\n infer :: \"execmsg set \\ execmsg set\"\n for M :: \"execmsg set\"\nwhere\n Inj [simp,intro]: \"m \\ M \\ m \\ infer M\"\n| Tup: \"\\ x \\ infer M; y \\ infer M \\ \\ Tup x y \\ infer M\"\n| Fst: \"Tup x y \\ infer M \\ x \\ infer M\"\n| Snd: \"Tup x y \\ infer M \\ y \\ infer M\"\n| Hash: \"m \\ infer M \\ Hash m \\ infer M\"\n| Enc: \"\\ m \\ infer M; k \\ infer M \\ \\ Enc m k \\ infer M\"\n| Dec: \"\\ Enc m k \\ infer M; inv k \\ infer M \\ \\ m \\ infer M\"\n \n\nsubsection{* Properties *}\n\nsubsubsection{* Agents *}\n\nlemma notin_Agent [iff]:\n \"Lit (EConst x) \\ Agent\"\n \"Lit (EAgent x) \\ Agent\"\n \"Lit (ENonce x i) \\ Agent\"\n \"Lit (EveNonce x) \\ Agent\"\n \"Tup m1 m2 \\ Agent\"\n \"Enc m1 m2 \\ Agent\"\n \"Hash m1 \\ Agent\"\n \"K m1 m2 \\ Agent\"\n \"KShr V \\ Agent\"\n \"PK m1 \\ Agent\"\n \"SK m1 \\ Agent\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ Agent\"\n by (auto simp: Kbd_def Agent_def)\n\n\nsubsubsection{* Unification modulo key-inversion *}\n\nlemma size_inv [simp]: \"size (inv x) = size x\"\n by (cases x) auto\n\nlemma inv_eqs [iff]:\n \"(inv x = Lit m) = (x = Lit m)\"\n \"(inv x = Tup m1 m2) = (x = Tup m1 m2)\"\n \"(inv x = Enc m1 m2) = (x = Enc m1 m2)\"\n \"(inv x = Hash m1) = (x = Hash m1)\"\n \"(inv x = K m1 m2) = (x = K m1 m2)\"\n \"(inv x = PK m1) = (x = SK m1)\"\n \"(inv x = SK m1) = (x = PK m1)\"\n \"(Lit m = inv x) = (x = Lit m)\"\n \"(Tup m1 m2 = inv x) = (x = Tup m1 m2)\"\n \"(Enc m1 m2 = inv x) = (x = Enc m1 m2)\"\n \"(Hash m1 = inv x) = (x = Hash m1)\"\n \"(K m1 m2 = inv x) = (x = K m1 m2)\"\n \"(PK m1 = inv x) = (x = SK m1)\"\n \"(SK m1 = inv x) = (x = PK m1)\"\n \"(KShr A = inv x) = (x = KShr A)\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ \n (Kbd a b = inv x) = (x = Kbd a b)\"\n by (auto) (induct x, simp+)+\n\nlemma inv_inj [iff]:\n \"(inv x = inv y) = (x = y)\"\n by (auto) (induct x, auto)\n\n\nsubsubsection{* @{term subterms} *}\n\nlemma subterms_trans: \n \"\\ x \\ subterms y; y \\ subterms z \\ \\ x \\ subterms z\"\n by(induct z, auto)\n\nlemma unpair_subset_subterms: \n \"unpair m \\ subterms m\"\n by(induct m, auto)\n\nlemmas unpair_subtermsD = \n subsetD[OF unpair_subset_subterms, rule_format]\n\n\nsubsubsection{* @{term infer} *}\n\ntext{* Monotonicity *}\n\nlemma infer_mono [trans]: \"M \\ N \\ infer M \\ infer N\"\n by(auto, erule infer.induct, auto intro: infer.intros)\n\nlemma infer_increasing: \"M \\ infer M\"\n by(blast)\n\n\ntext{* Converse fails: A message composed from subterms of both\n sets is not in the union of the individual inferable sets. *}\nlemma infer_Un: \"infer M \\ infer N \\ infer (M \\ N)\"\n by(intro Un_least infer_mono Un_upper1 Un_upper2)\n\nlemmas infer_UnD = subsetD[OF infer_Un, rule_format]\n\nlemma infer_insert: \"insert x (infer M) \\ infer (insert x M)\"\n by(blast intro: infer_mono[THEN [2] rev_subsetD])\n\n\ntext{* Idempotence and transitivity *}\n\nlemma infer_inferD [dest!]: \"x \\ infer (infer M) \\ x \\ infer M\"\n by (induct rule: infer.induct) (auto intro: infer.intros)\n\nlemma infer_idem [iff]: \"infer (infer M) = infer M\"\n by blast\n\nlemma infer_subset_iff [simp]: \n \"(infer M \\ infer N) = (M \\ infer N)\" (is \"?lhs = ?rhs\")\nproof\n assume ?lhs\n have \"M \\ infer M\" by(rule infer_increasing)\n also note `?lhs`\n finally show ?rhs .\nnext\n assume ?rhs\n hence \"infer M \\ infer (infer N)\" by(rule infer_mono)\n thus ?lhs by simp\nqed\n\nlemma infer_trans: \"\\ x \\ infer M; M \\ infer N \\ \\ x \\ infer N\"\nby (drule infer_mono, blast)\n\ntext{*Cut; Lemma 2 of Lowe*}\nlemma infer_cut: \n \"\\ y \\ infer (insert x M); x \\ infer M \\ \\ y \\ infer M\"\n by (erule infer_trans, blast)\n\n\nlemma Tup_in_infer [simp]: \n \"Tup x y \\ infer M = (x \\ infer M \\ y \\ infer M)\"\n by(blast intro: infer.intros)\n\nlemma infer_insert_Tup [simp]:\n \"infer (insert (Tup x y) M) = infer (insert x (insert y M))\"\n by(safe, (erule infer.induct, auto intro: infer.intros)+)\n\nlemma infer_insertI [intro]: \"x \\ infer M \\ x \\ infer (insert y M)\"\n by(erule rev_subsetD[OF _ infer_mono], blast)\n\nlemma infer_finite_support: \n assumes \"m \\ infer M\"\n shows \"\\ N. N \\ M \\ finite N \\ m \\ infer N\" (is \"\\ N. ?support m N\")\nusing assms\nproof(induct rule: infer.induct)\n case (Inj m)\n hence \"?support m {m}\" by fast\n thus ?case by blast\nnext\n case (Hash m)\n then obtain Nm where \"?support m Nm\" by blast\n hence \"?support (Hash m) Nm\" by (blast intro: infer.intros)\n thus ?case by blast\nnext\n case (Tup x y) note IH = this\n obtain Nx where \"?support x Nx\" using IH by blast\n moreover obtain Ny where \"?support y Ny\" using IH by blast\n ultimately have \"?support (Tup x y) (Nx \\ Ny)\" \n by (blast intro: infer.intros infer_UnD)\n thus ?case by blast\nnext\n case (Fst x y)\n then obtain Nxy where \"?support \\x, y\\ Nxy\" by blast\n hence \"?support x Nxy\" by (blast intro: infer.intros)\n thus ?case by blast\nnext\n case (Snd x y)\n then obtain Nxy where \"?support \\x, y\\ Nxy\" by blast\n hence \"?support y Nxy\" by (blast intro: infer.intros)\n thus ?case by blast\nnext\n case (Enc m k) note IH = this\n obtain Nm where \"?support m Nm\" using IH by blast\n moreover obtain Nk where \"?support k Nk\" using IH by blast\n ultimately have \"?support (Enc m k) (Nm \\ Nk)\" \n by (blast intro: infer.intros infer_UnD)\n thus ?case by blast\nnext\n case (Dec m k) note IH = this\n obtain Nmk where \"?support (Enc m k) Nmk\" using IH by blast\n moreover obtain Nk where \"?support (inv k) Nk\" using IH by blast\n ultimately have \"?support m (Nmk \\ Nk)\" \n by (blast intro: infer.intros infer_UnD)\n thus ?case by blast\nqed\n\n\n\nsubsubsection{* @{term pairParts} *}\n\nlemma pairParts_mono [iff]: \"m \\ pairParts m\"\n by(induct m rule: pairParts.induct, auto)\n\nlemma pairParts_idem: \n \"m' \\ pairParts m \\ pairParts m' \\ pairParts m\"\n by(induct m, auto)\n\nlemmas pairParts_idemD = \n subsetD[OF pairParts_idem, rule_format]\n\nlemma pairParts_in_infer:\n \"\\ x \\ pairParts m; m \\ infer M \\ \\ x \\ infer M\"\n by(induct m arbitrary: x, auto)\n\nlemma unpair_subset_pairParts: \"unpair m \\ pairParts m\"\n by(induct m, auto)\n\nlemmas unpair_subset_pairPartsD =\n subsetD[OF unpair_subset_pairParts, rule_format]\n\n\nsubsection{* Initial Intruder Knowledge *}\n\n\ndefinition IK0 :: \"execmsg set\"\nwhere \"IK0 \\ \n { Lit (EConst c) | c. True} \\\n { Lit (EveNonce a) | a. True} \\\n { Lit (EAgent a) | a. True} \\\n { PK (Lit (EAgent a)) | a. True} \\ \n { KShr {} }\"\n\nlemma IK0_unpair_inv: \"m \\ IK0 \\ unpair m = {m}\"\n by(auto simp: IK0_def image_def)\n\nlemma in_IK0_by_unpair: \n \"\\ m \\ unpair m'; m' \\ IK0 \\ \\ m \\ IK0\"\n by(frule IK0_unpair_inv, auto)\n\nlemma notin_IK0 [iff]:\n \"SK a \\ IK0\"\n \"K a b \\ IK0\"\n \"Enc m k \\ IK0\"\n \"Hash m \\ IK0\"\n \"Lit (ENonce n i) \\ IK0\"\n \"Tup x y \\ IK0\"\n \"A \\ {} \\ KShr A \\ IK0\"\n \"\\ a \\ Agent; b \\ Agent \\ \\ Kbd a b \\ IK0\"\n by (auto simp: IK0_def Kbd_def agents_def Agent_def)\n\nlemma in_IK0_simps [iff]:\n \"Lit (EConst c) \\ IK0\"\n \"Lit (EveNonce n) \\ IK0\"\n \"Lit (EAgent a) \\ IK0\"\n \"PK (Lit (EAgent a)) \\ IK0\"\n \"KShr {} \\ IK0\"\n by(auto simp: IK0_def)\n\nend\n", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/ESPLogic/ExecMessage.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.17167097394119268}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n Refinement for handleEvent and syscalls\n*)\n\ntheory Syscall_R\nimports Tcb_R Arch_R Interrupt_R\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(*\nsyscall has 5 sections: m_fault h_fault m_error h_error m_finalise\n\nrun m_fault (faultable code) \\ r_fault\n failure, i.e. Inr somefault \\ \\somefault. h_fault; done\n\nsuccess, i.e. Inl a\n \\ run \\a. m_error a (errable code) \\ r_error\n failure, i.e. Inr someerror \\ \\someerror. h_error e; done\n success, i.e. Inl b \\ \\b. m_finalise b\n\nOne can clearly see this is simulating some kind of monadic Maybe sequence\ntrying to identify all possible errors before actually performing the syscall.\n*)\n\nlemma syscall_corres:\n assumes corres:\n \"corres (fr \\ r_flt_rel) P P' m_flt m_flt'\"\n \"\\flt flt'. flt' = fault_map flt \\\n corres r (P_flt flt) (P'_flt flt') (h_flt flt) (h_flt' flt')\"\n \"\\rv rv'. r_flt_rel rv rv' \\\n corres (ser \\ r_err_rel rv rv')\n (P_no_flt rv) (P'_no_flt rv')\n (m_err rv) (m_err' rv')\"\n \"\\rv rv' err err'. \\r_flt_rel rv rv'; err' = syscall_error_map err \\\n \\ corres r (P_err rv err)\n (P'_err rv' err') (h_err err) (h_err' err')\"\n \"\\rvf rvf' rve rve'. \\r_flt_rel rvf rvf'; r_err_rel rvf rvf' rve rve'\\\n \\ corres (dc \\ r)\n (P_no_err rvf rve) (P'_no_err rvf' rve')\n (m_fin rve) (m_fin' rve')\"\n\n assumes wp:\n \"\\rv. \\Q_no_flt rv\\ m_err rv \\P_no_err rv\\, \\P_err rv\\\"\n \"\\rv'. \\Q'_no_flt rv'\\ m_err' rv' \\P'_no_err rv'\\,\\P'_err rv'\\\"\n \"\\Q\\ m_flt \\\\rv. P_no_flt rv and Q_no_flt rv\\, \\P_flt\\\"\n \"\\Q'\\ m_flt' \\\\rv. P'_no_flt rv and Q'_no_flt rv\\, \\P'_flt\\\"\n\n shows \"corres (dc \\ r) (P and Q) (P' and Q')\n (Syscall_A.syscall m_flt h_flt m_err h_err m_fin)\n (Syscall_H.syscall m_flt' h_flt' m_err' h_err' m_fin')\"\n apply (simp add: Syscall_A.syscall_def Syscall_H.syscall_def liftE_bindE)\n apply (rule corres_split_bind_case_sum)\n apply (rule corres_split_bind_case_sum | rule corres | rule wp | simp add: liftE_bindE)+\n done\n\nlemma syscall_valid':\n assumes x:\n \"\\ft. \\P_flt ft\\ h_flt ft \\Q\\\"\n \"\\err. \\P_err err\\ h_err err \\Q\\\"\n \"\\rv. \\P_no_err rv\\ m_fin rv \\Q\\,\\E\\\"\n \"\\rv. \\P_no_flt rv\\ m_err rv \\P_no_err\\, \\P_err\\\"\n \"\\P\\ m_flt \\P_no_flt\\, \\P_flt\\\"\n shows \"\\P\\ Syscall_H.syscall m_flt h_flt m_err h_err m_fin \\Q\\, \\E\\\"\n apply (simp add: Syscall_H.syscall_def liftE_bindE\n cong: sum.case_cong)\n apply (rule hoare_split_bind_case_sumE)\n apply (wp x)[1]\n apply (rule hoare_split_bind_case_sumE)\n apply (wp x|simp)+\n done\n\n\ntext \\Completing the relationship between abstract/haskell invocations\\\n\nprimrec\n inv_relation :: \"Invocations_A.invocation \\ Invocations_H.invocation \\ bool\"\nwhere\n \"inv_relation (Invocations_A.InvokeUntyped i) x =\n (\\i'. untypinv_relation i i' \\ x = InvokeUntyped i')\"\n| \"inv_relation (Invocations_A.InvokeEndpoint w w2 b c) x =\n (x = InvokeEndpoint w w2 b c)\"\n| \"inv_relation (Invocations_A.InvokeNotification w w2) x =\n (x = InvokeNotification w w2)\"\n| \"inv_relation (Invocations_A.InvokeReply w ptr grant) x =\n (x = InvokeReply w (cte_map ptr) grant)\"\n| \"inv_relation (Invocations_A.InvokeTCB i) x =\n (\\i'. tcbinv_relation i i' \\ x = InvokeTCB i')\"\n| \"inv_relation (Invocations_A.InvokeDomain tptr domain) x =\n (x = InvokeDomain tptr domain)\"\n| \"inv_relation (Invocations_A.InvokeIRQControl i) x =\n (\\i'. irq_control_inv_relation i i' \\ x = InvokeIRQControl i')\"\n| \"inv_relation (Invocations_A.InvokeIRQHandler i) x =\n (\\i'. irq_handler_inv_relation i i' \\ x = InvokeIRQHandler i')\"\n| \"inv_relation (Invocations_A.InvokeCNode i) x =\n (\\i'. cnodeinv_relation i i' \\ x = InvokeCNode i')\"\n| \"inv_relation (Invocations_A.InvokeArchObject i) x =\n (\\i'. archinv_relation i i' \\ x = InvokeArchObject i')\"\n\n(* In order to assert conditions that must hold for the appropriate\n handleInvocation and handle_invocation calls to succeed, we must have\n some notion of what a valid invocation is.\n This function defines that.\n For example, a InvokeEndpoint requires an endpoint at its first\n constructor argument. *)\n\nprimrec\n valid_invocation' :: \"Invocations_H.invocation \\ kernel_state \\ bool\"\nwhere\n \"valid_invocation' (Invocations_H.InvokeUntyped i) = valid_untyped_inv' i\"\n| \"valid_invocation' (Invocations_H.InvokeEndpoint w w2 b c) = (ep_at' w and ex_nonz_cap_to' w)\"\n| \"valid_invocation' (Invocations_H.InvokeNotification w w2) = (ntfn_at' w and ex_nonz_cap_to' w)\"\n| \"valid_invocation' (Invocations_H.InvokeTCB i) = tcb_inv_wf' i\"\n| \"valid_invocation' (Invocations_H.InvokeDomain thread domain) =\n (tcb_at' thread and K (domain \\ maxDomain))\"\n| \"valid_invocation' (Invocations_H.InvokeReply thread slot grant) =\n (tcb_at' thread and cte_wp_at' (\\cte. \\gr. cteCap cte = ReplyCap thread False gr) slot)\"\n| \"valid_invocation' (Invocations_H.InvokeIRQControl i) = irq_control_inv_valid' i\"\n| \"valid_invocation' (Invocations_H.InvokeIRQHandler i) = irq_handler_inv_valid' i\"\n| \"valid_invocation' (Invocations_H.InvokeCNode i) = valid_cnode_inv' i\"\n| \"valid_invocation' (Invocations_H.InvokeArchObject i) = valid_arch_inv' i\"\n\n\n(* FIXME: move *)\nlemma decodeDomainInvocation_corres:\n shows \"\\ list_all2 cap_relation (map fst cs) (map fst cs');\n list_all2 (\\p pa. snd pa = cte_map (snd p)) cs cs' \\ \\\n corres (ser \\ ((\\x. inv_relation x \\ uncurry Invocations_H.invocation.InvokeDomain) \\ (\\(x,y). Invocations_A.invocation.InvokeDomain x y))) \\ \\\n (decode_domain_invocation label args cs)\n (decodeDomainInvocation label args cs')\"\n apply (simp add: decode_domain_invocation_def decodeDomainInvocation_def)\n apply (rule whenE_throwError_corres_initial)\n apply (simp+)[2]\n apply (case_tac \"args\", simp_all)\n apply (rule corres_guard_imp)\n apply (rule_tac r'=\"\\domain domain'. domain = domain'\" and R=\"\\_. \\\" and R'=\"\\_. \\\"\n in corres_splitEE) apply (rule whenE_throwError_corres)\n apply (simp+)[2]\n apply (rule corres_returnOkTT)\n apply simp\n apply (rule whenE_throwError_corres_initial)\n apply simp\n apply (case_tac \"cs\")\n apply ((case_tac \"cs'\", ((simp add: null_def)+)[2])+)[2]\n apply (subgoal_tac \"cap_relation (fst (hd cs)) (fst (hd cs'))\")\n apply (case_tac \"fst (hd cs)\")\n apply (case_tac \"fst (hd cs')\", simp+, rule corres_returnOkTT)\n apply (simp add: inv_relation_def o_def uncurry_def)\n apply (case_tac \"fst (hd cs')\", fastforce+)\n apply (case_tac \"cs\")\n apply (case_tac \"cs'\", ((simp add: list_all2_map2 list_all2_map1)+)[2])\n apply (case_tac \"cs'\", ((simp add: list_all2_map2 list_all2_map1)+)[2])\n apply (wp | simp)+\n done\n\nlemma decodeInvocation_corres:\n \"\\cptr = to_bl cptr'; mi' = message_info_map mi;\n slot' = cte_map slot; cap_relation cap cap';\n args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps');\n list_all2 (\\p pa. snd pa = cte_map (snd p)) excaps excaps' \\\n \\\n corres (ser \\ inv_relation)\n (invs and valid_sched and valid_list\n and valid_cap cap and cte_at slot and cte_wp_at ((=) cap) slot\n and (\\s. \\x\\set excaps. s \\ fst x \\ cte_at (snd x) s)\n and (\\s. length args < 2 ^ word_bits))\n (invs' and valid_cap' cap' and cte_at' slot'\n and (\\s. \\x\\set excaps'. s \\' fst x \\ cte_at' (snd x) s))\n (decode_invocation (mi_label mi) args cptr slot cap excaps)\n (RetypeDecls_H.decodeInvocation (mi_label mi) args' cptr' slot' cap' excaps')\"\n apply (rule corres_gen_asm)\n apply (unfold decode_invocation_def decodeInvocation_def)\n apply (case_tac cap, simp_all only: cap.simps)\n \\ \\dammit, simp_all messes things up, must handle cases manually\\\n \\ \\Null\\\n apply (simp add: isCap_defs)\n \\ \\Untyped\\\n apply (simp add: isCap_defs Let_def o_def split del: if_split)\n apply (rule corres_guard_imp, rule decodeUntypedInvocation_corres)\n apply ((clarsimp simp:cte_wp_at_caps_of_state)+)[3]\n \\ \\(Async)Endpoint\\\n apply (simp add: isCap_defs returnOk_def)\n apply (simp add: isCap_defs)\n apply (clarsimp simp: returnOk_def neq_Nil_conv)\n \\ \\ReplyCap\\\n apply (simp add: isCap_defs Let_def returnOk_def)\n \\ \\CNodeCap\\\n apply (rename_tac word nat list)\n apply (simp add: isCap_defs Let_def CanModify_def\n split del: if_split cong: if_cong)\n apply (clarsimp simp add: o_def)\n apply (rule corres_guard_imp)\n apply (rule_tac F=\"length list \\ 64\" in corres_gen_asm)\n apply (rule decodeCNodeInvocation_corres, simp+)\n apply (simp add: valid_cap_def word_bits_def)\n apply simp\n \\ \\ThreadCap\\\n apply (simp add: isCap_defs Let_def CanModify_def\n split del: if_split cong: if_cong)\n apply (clarsimp simp add: o_def)\n apply (rule corres_guard_imp)\n apply (rule decodeTCBInvocation_corres, rule refl,\n simp_all add: valid_cap_def valid_cap'_def)[3]\n apply (simp add: split_def)\n apply (rule list_all2_conj)\n apply (simp add: list_all2_map2 list_all2_map1)\n apply assumption\n \\ \\DomainCap\\\n apply (simp add: isCap_defs)\n apply (rule corres_guard_imp)\n apply (rule decodeDomainInvocation_corres)\n apply (simp+)[4]\n \\ \\IRQControl\\\n apply (simp add: isCap_defs o_def)\n apply (rule corres_guard_imp, rule decodeIRQControlInvocation_corres, simp+)[1]\n \\ \\IRQHandler\\\n apply (simp add: isCap_defs o_def)\n apply (rule corres_guard_imp, rule decodeIRQHandlerInvocation_corres, simp+)[1]\n \\ \\Zombie\\\n apply (simp add: isCap_defs)\n \\ \\Arch\\\n apply (clarsimp simp only: cap_relation.simps)\n apply (clarsimp simp add: isCap_defs Let_def o_def)\n apply (rule corres_guard_imp [OF arch_decodeInvocation_corres])\n apply (simp_all add: list_all2_map2 list_all2_map1)+\n done\n\ndeclare mapME_Nil [simp]\n\nlemma hinv_corres_assist:\n \"\\ info' = message_info_map info \\\n \\ corres (fr \\ (\\(p, cap, extracaps, buffer) (p', capa, extracapsa, buffera).\n p' = cte_map p \\ cap_relation cap capa \\ buffer = buffera \\\n list_all2\n (\\x y. cap_relation (fst x) (fst y) \\ snd y = cte_map (snd x))\n extracaps extracapsa))\n\n (invs and tcb_at thread and (\\_. valid_message_info info))\n (invs' and tcb_at' thread)\n (doE (cap, slot) \\\n cap_fault_on_failure cptr' False\n (lookup_cap_and_slot thread (to_bl cptr'));\n do\n buffer \\ lookup_ipc_buffer False thread;\n doE extracaps \\ lookup_extra_caps thread buffer info;\n returnOk (slot, cap, extracaps, buffer)\n odE\n od\n odE)\n (doE (cap, slot) \\ capFaultOnFailure cptr' False (lookupCapAndSlot thread cptr');\n do buffer \\ VSpace_H.lookupIPCBuffer False thread;\n doE extracaps \\ lookupExtraCaps thread buffer info';\n returnOk (slot, cap, extracaps, buffer)\n odE\n od\n odE)\"\n apply (clarsimp simp add: split_def)\n apply (rule corres_guard_imp)\n apply (rule corres_splitEE[OF corres_cap_fault])\n \\ \\switched over to argument of corres_cap_fault\\\n apply (rule lookupCapAndSlot_corres, simp)\n apply (rule corres_split[OF lookupIPCBuffer_corres])\n apply (rule corres_splitEE)\n apply (rule lookupExtraCaps_corres; simp)\n apply (rule corres_returnOkTT)\n apply (wp | simp)+\n apply auto\n done\n\nlemma msg_from_syserr_map[simp]:\n \"msgFromSyscallError (syscall_error_map err) = msg_from_syscall_error err\"\n apply (simp add: msgFromSyscallError_def)\n apply (case_tac err,clarsimp+)\n done\n\nlemma threadSet_tcbDomain_update_ct_idle_or_in_cur_domain':\n \"\\ct_idle_or_in_cur_domain' and (\\s. ksSchedulerAction s \\ ResumeCurrentThread) \\\n threadSet (tcbDomain_update (\\_. domain)) t\n \\\\_. ct_idle_or_in_cur_domain'\\\"\n apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (wp hoare_vcg_disj_lift hoare_vcg_imp_lift)\n apply (wp | wps)+\n apply (auto simp: obj_at'_def)\n done\n\nlemma threadSet_tcbDomain_update_ct_not_inQ:\n \"\\ct_not_inQ \\ threadSet (tcbDomain_update (\\_. domain)) t \\\\_. ct_not_inQ\\\"\n apply (simp add: threadSet_def ct_not_inQ_def)\n apply (wp)\n apply (rule hoare_convert_imp [OF setObject_nosch])\n apply (rule updateObject_tcb_inv)\n apply (wps setObject_ct_inv)\n apply (wp setObject_tcb_strongest getObject_tcb_wp)+\n apply (case_tac \"t = ksCurThread s\")\n apply (clarsimp simp: obj_at'_def)+\n done\n\n(* FIXME: move *)\nlemma setObject_F_ct_activatable':\n \"\\\\tcb f. tcbState (F f tcb) = tcbState tcb \\ \\ \\ct_in_state' activatable' and obj_at' ((=) tcb) t\\\n setObject t (F f tcb)\n \\\\_. ct_in_state' activatable'\\\"\n apply (clarsimp simp: ct_in_state'_def st_tcb_at'_def)\n apply (rule hoare_pre)\n apply (wps setObject_ct_inv)\n apply (wp setObject_tcb_strongest)\n apply (clarsimp simp: obj_at'_def)\n done\n\nlemmas setObject_tcbDomain_update_ct_activatable'[wp] = setObject_F_ct_activatable'[where F=\"tcbDomain_update\", simplified]\n\n(* FIXME: move *)\nlemma setObject_F_st_tcb_at':\n \"\\\\tcb f. tcbState (F f tcb) = tcbState tcb \\ \\ \\st_tcb_at' P t' and obj_at' ((=) tcb) t\\\n setObject t (F f tcb)\n \\\\_. st_tcb_at' P t'\\\"\n apply (simp add: st_tcb_at'_def)\n apply (rule hoare_pre)\n apply (wp setObject_tcb_strongest)\n apply (clarsimp simp: obj_at'_def)\n done\n\nlemmas setObject_tcbDomain_update_st_tcb_at'[wp] = setObject_F_st_tcb_at'[where F=\"tcbDomain_update\", simplified]\n\nlemma threadSet_tcbDomain_update_sch_act_wf[wp]:\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ sch_act_not t s\\\n threadSet (tcbDomain_update (\\_. domain)) t\n \\\\_ s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (simp add: sch_act_wf_cases split: scheduler_action.split)\n apply (wp hoare_vcg_conj_lift)\n apply (simp add: threadSet_def)\n apply wp\n apply (wps setObject_sa_unchanged)\n apply (wp static_imp_wp getObject_tcb_wp hoare_vcg_all_lift)+\n apply (rename_tac word)\n apply (rule_tac Q=\"\\_ s. ksSchedulerAction s = SwitchToThread word \\\n st_tcb_at' runnable' word s \\ tcb_in_cur_domain' word s \\ word \\ t\"\n in hoare_strengthen_post)\n apply (wp hoare_vcg_all_lift hoare_vcg_conj_lift hoare_vcg_imp_lift)+\n apply (simp add: threadSet_def)\n apply (wp getObject_tcb_wp threadSet_tcbDomain_triv')+\n apply (auto simp: obj_at'_def)\n done\n\nlemma setDomain_corres:\n \"corres dc\n (valid_etcbs and valid_sched and tcb_at tptr)\n (invs' and sch_act_simple\n and tcb_at' tptr and (\\s. new_dom \\ maxDomain))\n (set_domain tptr new_dom)\n (setDomain tptr new_dom)\"\n apply (rule corres_gen_asm2)\n apply (simp add: set_domain_def setDomain_def thread_set_domain_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF getCurThread_corres])\n apply (rule corres_split[OF tcbSchedDequeue_corres])\n apply (rule corres_split)\n apply (rule ethread_set_corres; simp)\n apply (clarsimp simp: etcb_relation_def)\n apply (rule corres_split[OF isRunnable_corres])\n apply simp\n apply (rule corres_split)\n apply clarsimp\n apply (rule corres_when[OF refl])\n apply (rule tcbSchedEnqueue_corres)\n apply (rule corres_when[OF refl])\n apply (rule rescheduleRequired_corres)\n apply ((wp hoare_drop_imps hoare_vcg_conj_lift | clarsimp| assumption)+)[5]\n apply clarsimp\n apply (rule_tac Q=\"\\_. valid_objs' and valid_queues' and valid_queues and\n (\\s. sch_act_wf (ksSchedulerAction s) s) and tcb_at' tptr\"\n in hoare_strengthen_post[rotated])\n apply (auto simp: invs'_def valid_state'_def sch_act_wf_weak st_tcb_at'_def o_def)[1]\n apply (wp threadSet_valid_objs' threadSet_valid_queues'_no_state\n threadSet_valid_queues_no_state\n threadSet_pred_tcb_no_state | simp)+\n apply (rule_tac Q = \"\\r s. invs' s \\ (\\p. tptr \\ set (ksReadyQueues s p)) \\ sch_act_simple s\n \\ tcb_at' tptr s\" in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def valid_pspace'_def sch_act_simple_def)\n apply (clarsimp simp:valid_tcb'_def)\n apply (drule(1) bspec)\n apply (clarsimp simp:tcb_cte_cases_def)\n apply fastforce\n apply (wp hoare_vcg_all_lift Tcb_R.tcbSchedDequeue_not_in_queue)+\n apply clarsimp\n apply (frule tcb_at_is_etcb_at)\n apply simp+\n apply (auto elim: tcb_at_is_etcb_at valid_objs'_maxDomain valid_objs'_maxPriority pred_tcb'_weakenE\n simp: valid_sched_def valid_sched_action_def)\n done\n\n\nlemma performInvocation_corres:\n \"\\ inv_relation i i'; call \\ block \\ \\\n corres (dc \\ (=))\n (einvs and valid_invocation i\n and simple_sched_action\n and ct_active\n and (\\s. (\\w w2 b c. i = Invocations_A.InvokeEndpoint w w2 b c) \\ st_tcb_at simple (cur_thread s) s))\n (invs' and sch_act_simple and valid_invocation' i' and ct_active')\n (perform_invocation block call i) (performInvocation block call i')\"\n apply (simp add: performInvocation_def)\n apply (case_tac i)\n apply (clarsimp simp: o_def liftE_bindE)\n apply (rule corres_guard_imp)\n apply (rule corres_split_norE)\n apply (rule corres_rel_imp, rule inv_untyped_corres)\n apply simp\n apply (case_tac x, simp_all)[1]\n apply (rule corres_returnOkTT)\n apply simp\n apply wp+\n apply simp+\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF getCurThread_corres])\n apply simp\n apply (rule corres_split[OF sendIPC_corres])\n apply simp\n apply (rule corres_trivial)\n apply simp\n apply wp+\n apply (clarsimp simp: ct_in_state_def)\n apply (fastforce elim: st_tcb_ex_cap)\n apply (clarsimp simp: pred_conj_def invs'_def cur_tcb'_def simple_sane_strg\n sch_act_simple_def)\n apply (rule corres_guard_imp)\n apply (simp add: liftE_bindE)\n apply (rule corres_split[OF sendSignal_corres])\n apply (rule corres_trivial)\n apply (simp add: returnOk_def)\n apply wp+\n apply (simp+)[2]\n apply simp\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[OF getCurThread_corres])\n apply (rule corres_split_nor[OF doReplyTransfer_corres'])\n apply (rule corres_trivial, simp)\n apply wp+\n apply (clarsimp simp: tcb_at_invs)\n apply (clarsimp simp: invs_def valid_state_def valid_pspace_def)\n apply (erule cte_wp_at_weakenE, fastforce simp: is_reply_cap_to_def)\n apply (clarsimp simp: tcb_at_invs')\n apply (fastforce elim!: cte_wp_at_weakenE')\n apply (clarsimp simp: liftME_def)\n apply (rule corres_guard_imp)\n apply (erule invokeTCB_corres)\n apply (simp)+\n \\ \\domain cap\\\n apply (clarsimp simp: invoke_domain_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF setDomain_corres])\n apply (rule corres_trivial, simp)\n apply (wp)+\n apply (clarsimp+)[2]\n \\ \\CNodes\\\n apply clarsimp\n apply (rule corres_guard_imp)\n apply (rule corres_splitEE[OF invokeCNode_corres])\n apply assumption\n apply (rule corres_trivial, simp add: returnOk_def)\n apply wp+\n apply (clarsimp+)[2]\n apply (clarsimp simp: liftME_def[symmetric] o_def dc_def[symmetric])\n apply (rule corres_guard_imp, rule performIRQControl_corres, simp+)\n apply (clarsimp simp: liftME_def[symmetric] o_def dc_def[symmetric])\n apply (rule corres_guard_imp, rule invokeIRQHandler_corres, simp+)\n apply clarsimp\n apply (rule corres_guard_imp)\n apply (rule arch_performInvocation_corres, assumption)\n apply (clarsimp+)[2]\n done\n\nlemma sendSignal_tcb_at'[wp]:\n \"\\tcb_at' t\\\n sendSignal ntfnptr bdg\n \\\\rv. tcb_at' t\\\"\n apply (simp add: sendSignal_def\n cong: list.case_cong Structures_H.notification.case_cong)\n apply (wp ntfn'_cases_weak_wp list_cases_weak_wp hoare_drop_imps | wpc | simp)+\n done\n\nlemmas checkCap_inv_typ_at'\n = checkCap_inv[where P=\"\\s. P (typ_at' T p s)\" for P T p]\n\ncrunches restart, bindNotification, performTransfer\n for typ_at'[wp]: \"\\s. P (typ_at' T p s)\"\n\nlemma invokeTCB_typ_at'[wp]:\n \"\\\\s. P (typ_at' T p s)\\\n invokeTCB tinv\n \\\\rv s. P (typ_at' T p s)\\\"\n apply (cases tinv,\n simp_all add: invokeTCB_def\n getThreadBufferSlot_def locateSlot_conv\n split del: if_split)\n apply (simp only: cases_simp if_cancel simp_thms conj_comms pred_conj_def\n Let_def split_def getThreadVSpaceRoot\n | (simp split del: if_split cong: if_cong)\n | (wp mapM_x_wp[where S=UNIV, simplified]\n checkCap_inv_typ_at'\n case_options_weak_wp)[1]\n | wpcw)+\n done\n\nlemmas invokeTCB_typ_ats[wp] = typ_at_lifts [OF invokeTCB_typ_at']\n\ncrunch typ_at'[wp]: doReplyTransfer \"\\s. P (typ_at' T p s)\"\n (wp: hoare_drop_imps)\n\nlemmas doReplyTransfer_typ_ats[wp] = typ_at_lifts [OF doReplyTransfer_typ_at']\n\ncrunch typ_at'[wp]: \"performIRQControl\" \"\\s. P (typ_at' T p s)\"\n\nlemmas invokeIRQControl_typ_ats[wp] =\n typ_at_lifts [OF performIRQControl_typ_at']\n\ncrunch typ_at'[wp]: InterruptDecls_H.invokeIRQHandler \"\\s. P (typ_at' T p s)\"\n\nlemmas invokeIRQHandler_typ_ats[wp] =\n typ_at_lifts [OF InterruptDecls_H_invokeIRQHandler_typ_at']\n\ncrunch tcb_at'[wp]: setDomain \"tcb_at' tptr\"\n (simp: crunch_simps)\n\nlemma pinv_tcb'[wp]:\n \"\\invs' and st_tcb_at' active' tptr\n and valid_invocation' i and ct_active'\\\n RetypeDecls_H.performInvocation block call i\n \\\\rv. tcb_at' tptr\\\"\n apply (simp add: performInvocation_def)\n apply (case_tac i, simp_all)\n apply (wp invokeArch_tcb_at' | clarsimp simp: pred_tcb_at')+\n done\n\nlemma sts_cte_at[wp]:\n \"\\cte_at' p\\ setThreadState st t \\\\rv. cte_at' p\\\"\n apply (simp add: setThreadState_def)\n apply (wp|simp)+\n done\n\ncrunch obj_at_ntfn[wp]: setThreadState \"obj_at' (\\ntfn. P (ntfnBoundTCB ntfn) (ntfnObj ntfn)) ntfnptr\"\n (wp: obj_at_setObject2 crunch_wps\n simp: crunch_simps updateObject_default_def in_monad)\n\nlemma sts_mcpriority_tcb_at'[wp]:\n \"\\mcpriority_tcb_at' P t\\\n setThreadState st t'\n \\\\_. mcpriority_tcb_at' P t\\\"\n apply (cases \"t = t'\",\n simp_all add: setThreadState_def\n split del: if_split)\n apply ((wp threadSet_pred_tcb_at_state | simp)+)[1]\n apply (wp threadSet_obj_at'_really_strongest\n | simp add: pred_tcb_at'_def)+\n done\n\nlemma sts_valid_inv'[wp]:\n \"\\valid_invocation' i\\ setThreadState st t \\\\rv. valid_invocation' i\\\"\n apply (case_tac i, simp_all add: sts_valid_untyped_inv' sts_valid_arch_inv')\n apply (wp | simp)+\n defer\n apply (rename_tac cnode_invocation)\n apply (case_tac cnode_invocation, simp_all add: cte_wp_at_ctes_of)\n apply (wp | simp)+\n apply (rename_tac irqcontrol_invocation)\n apply (case_tac irqcontrol_invocation, simp_all)\n apply (rename_tac archirq_inv)\n apply (case_tac archirq_inv; simp)\n apply (wp | simp add: irq_issued'_def)+\n apply (rename_tac irqhandler_invocation)\n apply (case_tac irqhandler_invocation, simp_all)\n apply (wp hoare_vcg_ex_lift ex_cte_cap_to'_pres | simp)+\n apply (rename_tac tcbinvocation)\n apply (case_tac tcbinvocation,\n simp_all add: setThreadState_tcb',\n auto intro!: hoare_vcg_conj_lift hoare_vcg_disj_lift\n simp only: imp_conv_disj simp_thms pred_conj_def,\n auto intro!: hoare_vcg_prop\n sts_cap_to' sts_cte_cap_to'\n setThreadState_typ_ats\n split: option.splits)[1]\n apply (wp sts_bound_tcb_at' hoare_vcg_all_lift hoare_vcg_const_imp_lift)+\n done\n\n(* FIXME: move to TCB *)\ncrunch inv[wp]: decodeDomainInvocation P\n (wp: crunch_wps simp: crunch_simps)\n\nlemma decode_inv_inv'[wp]:\n \"\\P\\ decodeInvocation label args cap_index slot cap excaps \\\\rv. P\\\"\n apply (simp add: decodeInvocation_def Let_def\n split del: if_split\n cong: if_cong)\n apply (rule hoare_pre)\n apply (wp decodeTCBInvocation_inv |\n simp only: o_def |\n clarsimp split: capability.split_asm simp: isCap_defs)+\n done\n\n(* FIXME: move to TCB *)\nlemma dec_dom_inv_wf[wp]:\n \"\\invs' and (\\s. \\x \\ set excaps. s \\' fst x)\\\n decodeDomainInvocation label args excaps\n \\\\x s. tcb_at' (fst x) s \\ snd x \\ maxDomain\\, -\"\n apply (simp add:decodeDomainInvocation_def)\n apply (wp whenE_throwError_wp | wpc |simp)+\n apply clarsimp\n apply (drule_tac x = \"hd excaps\" in bspec)\n apply (rule hd_in_set)\n apply (simp add:null_def)\n apply (simp add:valid_cap'_def)\n apply (simp add:not_le)\n apply (simp del: Word.of_nat_unat flip: ucast_nat_def)\n apply (rule word_of_nat_le)\n apply (simp add: le_maxDomain_eq_less_numDomains)\n done\n\nlemma decode_inv_wf'[wp]:\n \"\\valid_cap' cap and invs' and sch_act_simple\n and cte_wp_at' ((=) cap \\ cteCap) slot and real_cte_at' slot\n and (\\s. \\r\\zobj_refs' cap. ex_nonz_cap_to' r s)\n and (\\s. \\r\\cte_refs' cap (irq_node' s). ex_cte_cap_to' r s)\n and (\\s. \\cap \\ set excaps. \\r\\cte_refs' (fst cap) (irq_node' s). ex_cte_cap_to' r s)\n and (\\s. \\cap \\ set excaps. \\r\\zobj_refs' (fst cap). ex_nonz_cap_to' r s)\n and (\\s. \\x \\ set excaps. cte_wp_at' ((=) (fst x) o cteCap) (snd x) s)\n and (\\s. \\x \\ set excaps. s \\' fst x)\n and (\\s. \\x \\ set excaps. real_cte_at' (snd x) s)\n and (\\s. \\x \\ set excaps. ex_cte_cap_wp_to' isCNodeCap (snd x) s)\n and (\\s. \\x \\ set excaps. cte_wp_at' (badge_derived' (fst x) o cteCap) (snd x) s)\\\n decodeInvocation label args cap_index slot cap excaps\n \\valid_invocation'\\,-\"\n apply (case_tac cap,\n simp_all add: decodeInvocation_def Let_def isCap_defs uncurry_def split_def\n split del: if_split\n cong: if_cong)\n apply ((rule hoare_pre,\n ((wpsimp wp: decodeTCBInv_wf simp: o_def)+)[1],\n clarsimp simp: valid_cap'_def cte_wp_at_ctes_of)\n | intro exI | simp)+\n done\n\nlemma ct_active_imp_simple'[elim!]:\n \"ct_active' s \\ st_tcb_at' simple' (ksCurThread s) s\"\n by (clarsimp simp: ct_in_state'_def\n elim!: pred_tcb'_weakenE)\n\nlemma ct_running_imp_simple'[elim!]:\n \"ct_running' s \\ st_tcb_at' simple' (ksCurThread s) s\"\n by (clarsimp simp: ct_in_state'_def\n elim!: pred_tcb'_weakenE)\n\nlemma active_ex_cap'[elim]:\n \"\\ ct_active' s; if_live_then_nonz_cap' s \\\n \\ ex_nonz_cap_to' (ksCurThread s) s\"\n by (fastforce simp: ct_in_state'_def elim!: st_tcb_ex_cap'')\n\ncrunch it[wp]: handleFaultReply \"\\s. P (ksIdleThread s)\"\n\nlemma handleFaultReply_invs[wp]:\n \"\\invs' and tcb_at' t\\ handleFaultReply x t label msg \\\\rv. invs'\\\"\n apply (simp add: handleFaultReply_def)\n apply (case_tac x, simp_all)\n apply (wp | clarsimp simp: handleArchFaultReply_def\n split: arch_fault.split)+\n done\n\ncrunch sch_act_simple[wp]: handleFaultReply sch_act_simple\n (wp: crunch_wps)\n\nlemma transferCaps_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n transferCaps info caps ep rcvr rcvBuf\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\nproof -\n have CTEF: \"\\P p s. \\ cte_wp_at' P p s; \\cte. P cte \\ False \\ \\ False\"\n by (erule cte_wp_atE', auto)\n show ?thesis\n unfolding transferCaps_def\n apply (wp | wpc)+\n apply (rule transferCapsToSlots_pres2)\n apply (rule hoare_weaken_pre [OF cteInsert_weak_cte_wp_at3])\n apply (rule PUC,simp)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (wp hoare_vcg_all_lift static_imp_wp | simp add:ball_conj_distrib)+\n done\nqed\n\ncrunch cte_wp_at' [wp]: setMessageInfo \"cte_wp_at' P p\"\n\nlemma copyMRs_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\ copyMRs sender sendBuf receiver recvBuf n \\\\_. cte_wp_at' P ptr\\\"\n unfolding copyMRs_def\n apply (wp mapM_wp | wpc | simp add: split_def | rule equalityD1)+\n done\n\nlemma doNormalTransfer_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows\n \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n doNormalTransfer st send_buffer ep b gr rt recv_buffer\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\n unfolding doNormalTransfer_def\n apply (wp transferCaps_non_null_cte_wp_at' | simp add:PUC)+\n done\n\nlemma setMRs_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\ setMRs thread buffer messageData \\\\_. cte_wp_at' P ptr\\\"\n by (simp add: setMRs_def zipWithM_x_mapM split_def, wp crunch_wps)\n\nlemma doFaultTransfer_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\\n doFaultTransfer badge sender receiver receiverIPCBuffer\n \\\\_. cte_wp_at' P ptr\\\"\n unfolding doFaultTransfer_def\n apply (wp | wpc | simp add: split_def)+\n done\n\nlemma doIPCTransfer_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows\n \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n doIPCTransfer sender endpoint badge grant receiver\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\n unfolding doIPCTransfer_def\n apply (wp doNormalTransfer_non_null_cte_wp_at' hoare_drop_imp hoare_allI | wpc | clarsimp simp:PUC)+\n done\n\nlemma doIPCTransfer_non_null_cte_wp_at2':\n fixes P\n assumes PNN: \"\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap\"\n and PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows \"\\cte_wp_at' (\\cte. P (cteCap cte)) ptr\\\n doIPCTransfer sender endpoint badge grant receiver\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte)) ptr\\\"\n proof -\n have PimpQ: \"\\P Q ptr s. \\ cte_wp_at' (\\cte. P (cteCap cte)) ptr s;\n \\cte. P (cteCap cte) \\ Q (cteCap cte) \\\n \\ cte_wp_at' (\\cte. P (cteCap cte) \\ Q (cteCap cte)) ptr s\"\n by (erule cte_wp_at_weakenE', clarsimp)\n show ?thesis\n apply (rule hoare_chain [OF doIPCTransfer_non_null_cte_wp_at'])\n apply (erule PUC)\n apply (erule PimpQ)\n apply (drule PNN, clarsimp)\n apply (erule cte_wp_at_weakenE')\n apply (clarsimp)\n done\n qed\n\nlemma st_tcb_at'_eqD:\n \"\\ st_tcb_at' (\\s. s = st) t s; st_tcb_at' (\\s. s = st') t s \\ \\ st = st'\"\n by (clarsimp simp add: pred_tcb_at'_def obj_at'_def)\n\nlemma isReply_awaiting_reply':\n \"isReply st = awaiting_reply' st\"\n by (case_tac st, (clarsimp simp add: isReply_def)+)\n\nlemma doReply_invs[wp]:\n \"\\tcb_at' t and tcb_at' t' and\n cte_wp_at' (\\cte. \\grant. cteCap cte = ReplyCap t False grant) slot and\n invs' and sch_act_simple\\\n doReplyTransfer t' t slot grant\n \\\\rv. invs'\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (rule hoare_seq_ext [OF _ gts_sp'])\n apply (rule hoare_seq_ext [OF _ assert_sp])\n apply (rule hoare_seq_ext [OF _ getCTE_sp])\n apply (wp, wpc)\n apply (wp)\n apply (wp (once) sts_invs_minor'')\n apply (simp)\n apply (wp (once) sts_st_tcb')\n apply (wp)[1]\n apply (rule_tac Q=\"\\rv s. invs' s\n \\ t \\ ksIdleThread s\n \\ st_tcb_at' awaiting_reply' t s\"\n in hoare_post_imp)\n apply (clarsimp)\n apply (frule_tac t=t in invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, rule impI, erule pred_tcb'_weakenE, case_tac st)\n apply (clarsimp | drule(1) obj_at_conj')+\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def)\n apply (drule(1) pred_tcb_at_conj')\n apply (subgoal_tac \"st_tcb_at' (\\_. False) (ksCurThread s) s\")\n apply (clarsimp)\n apply (erule_tac P=\"\\st. awaiting_reply' st \\ activatable' st\"\n in pred_tcb'_weakenE)\n apply (case_tac st, clarsimp+)\n apply (wp cteDeleteOne_reply_pred_tcb_at)+\n apply (clarsimp)\n apply (rule_tac Q=\"\\_. (\\s. t \\ ksIdleThread s)\n and cte_wp_at' (\\cte. \\grant. cteCap cte = capability.ReplyCap t False grant) slot\"\n in hoare_strengthen_post [rotated])\n apply (fastforce simp: cte_wp_at'_def)\n apply (wp)\n apply (rule hoare_strengthen_post [OF doIPCTransfer_non_null_cte_wp_at'])\n apply (erule conjE)\n apply assumption\n apply (erule cte_wp_at_weakenE')\n apply (fastforce)\n apply (wp sts_invs_minor'' sts_st_tcb' static_imp_wp)\n apply (rule_tac Q=\"\\rv s. invs' s \\ sch_act_simple s\n \\ st_tcb_at' awaiting_reply' t s\n \\ t \\ ksIdleThread s\"\n in hoare_post_imp)\n apply (clarsimp)\n apply (frule_tac t=t in invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, rule impI, erule pred_tcb'_weakenE, case_tac st)\n apply (clarsimp | drule(1) obj_at_conj')+\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def)\n apply (drule(1) pred_tcb_at_conj')\n apply (subgoal_tac \"st_tcb_at' (\\_. False) (ksCurThread s) s\")\n apply (clarsimp)\n apply (erule_tac P=\"\\st. awaiting_reply' st \\ activatable' st\"\n in pred_tcb'_weakenE)\n apply (case_tac st, clarsimp+)\n apply (wp threadSet_invs_trivial threadSet_st_tcb_at2 static_imp_wp\n | clarsimp simp add: inQ_def)+\n apply (rule_tac Q=\"\\_. invs' and tcb_at' t\n and sch_act_simple and st_tcb_at' awaiting_reply' t\"\n in hoare_strengthen_post [rotated])\n apply (clarsimp)\n apply (rule conjI)\n apply (clarsimp simp: invs'_def valid_state'_def valid_idle'_def)\n apply (rule conjI)\n apply clarsimp\n apply (clarsimp simp: obj_at'_def idle_tcb'_def pred_tcb_at'_def)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: invs'_def valid_state'_def valid_idle'_def)\n apply (erule pred_tcb'_weakenE, clarsimp)\n apply (rule conjI)\n apply (clarsimp simp : invs'_def valid_state'_def valid_idle'_def pred_tcb_at'_def\n obj_at'_def idle_tcb'_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, clarsimp)\n apply (frule (1) not_tcbQueued_not_ksQ)\n apply simp\n apply clarsimp\n apply (wp cteDeleteOne_reply_pred_tcb_at hoare_drop_imp hoare_allI)+\n apply (clarsimp simp add: isReply_awaiting_reply' cte_wp_at_ctes_of)\n apply (auto dest!: st_tcb_idle'[rotated] simp:isCap_simps)\n done\n\nlemma ct_active_runnable' [simp]:\n \"ct_active' s \\ ct_in_state' runnable' s\"\n by (fastforce simp: ct_in_state'_def elim!: pred_tcb'_weakenE)\n\nlemma valid_irq_node_tcbSchedEnqueue[wp]:\n \"\\\\s. valid_irq_node' (irq_node' s) s \\ tcbSchedEnqueue ptr\n \\\\rv s'. valid_irq_node' (irq_node' s') s'\\\"\n apply (rule hoare_pre)\n apply (simp add:valid_irq_node'_def )\n apply (wp unless_wp hoare_vcg_all_lift | wps)+\n apply (simp add:tcbSchedEnqueue_def)\n apply (wp unless_wp| simp)+\n apply (simp add:valid_irq_node'_def)\n done\n\nlemma rescheduleRequired_valid_queues_but_ct_domain:\n \"\\\\s. Invariants_H.valid_queues s \\ valid_objs' s\n \\ (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s) \\\n rescheduleRequired\n \\\\_. Invariants_H.valid_queues\\\"\n apply (simp add: rescheduleRequired_def)\n apply (wp | wpc | simp)+\n done\n\nlemma rescheduleRequired_valid_queues'_but_ct_domain:\n \"\\\\s. valid_queues' s\n \\ (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s)\n \\\n rescheduleRequired\n \\\\_. valid_queues'\\\"\n apply (simp add: rescheduleRequired_def)\n apply (wp | wpc | simp | fastforce simp: valid_queues'_def)+\n done\n\nlemma tcbSchedEnqueue_valid_action:\n \"\\\\s. \\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s\\\n tcbSchedEnqueue ptr\n \\\\rv s. \\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s\\\"\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift)\n apply clarsimp\n done\n\nabbreviation (input) \"all_invs_but_sch_extra \\\n \\s. valid_pspace' s \\ Invariants_H.valid_queues s \\\n sym_refs (state_refs_of' s) \\\n if_live_then_nonz_cap' s \\\n if_unsafe_then_cap' s \\\n valid_idle' s \\\n valid_global_refs' s \\\n valid_arch_state' s \\\n valid_irq_node' (irq_node' s) s \\\n valid_irq_handlers' s \\\n valid_irq_states' s \\\n irqs_masked' s \\\n valid_ioports' s \\\n valid_machine_state' s \\\n cur_tcb' s \\\n untyped_ranges_zero' s \\\n valid_queues' s \\ pspace_domain_valid s \\\n ksCurDomain s \\ maxDomain \\ valid_dom_schedule' s \\\n (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s)\"\n\n\nlemma rescheduleRequired_all_invs_but_extra:\n \"\\\\s. all_invs_but_sch_extra s\\\n rescheduleRequired \\\\_. invs'\\\"\n apply (simp add: invs'_def valid_state'_def)\n apply (rule hoare_pre)\n apply (wp add:rescheduleRequired_ct_not_inQ\n rescheduleRequired_sch_act'\n rescheduleRequired_valid_queues_but_ct_domain\n rescheduleRequired_valid_queues'_but_ct_domain\n valid_irq_node_lift valid_irq_handlers_lift'' valid_ioports_lift''\n irqs_masked_lift cur_tcb_lift)\n apply auto\n done\n\nlemma threadSet_all_invs_but_sch_extra:\n shows \"\\ tcb_at' t and (\\s. (\\p. t \\ set (ksReadyQueues s p))) and\n all_invs_but_sch_extra and sch_act_simple and\n K (ds \\ maxDomain) \\\n threadSet (tcbDomain_update (\\_. ds)) t\n \\\\rv. all_invs_but_sch_extra \\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (wp threadSet_valid_pspace'T_P[where P = False and Q = \\ and Q' = \\])\n apply (simp add:tcb_cte_cases_def)+\n apply (wp\n threadSet_valid_pspace'T_P\n threadSet_state_refs_of'T_P[where f'=id and P'=False and Q=\\ and g'=id and Q'=\\]\n threadSet_idle'T\n threadSet_global_refsT\n threadSet_cur\n irqs_masked_lift\n valid_irq_node_lift\n valid_irq_handlers_lift''\n valid_ioports_lift''\n threadSet_ctes_ofT\n threadSet_not_inQ\n threadSet_valid_queues'_no_state\n threadSet_tcbDomain_update_ct_idle_or_in_cur_domain'\n threadSet_valid_queues\n threadSet_valid_dom_schedule'\n threadSet_iflive'T\n threadSet_ifunsafe'T\n untyped_ranges_zero_lift\n | simp add:tcb_cte_cases_def cteCaps_of_def o_def)+\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift threadSet_pred_tcb_no_state | simp)+\n apply (clarsimp simp:sch_act_simple_def o_def cteCaps_of_def)\n apply (intro conjI)\n apply fastforce+\n done\n\nlemma threadSet_not_curthread_ct_domain:\n \"\\\\s. ptr \\ ksCurThread s \\ ct_idle_or_in_cur_domain' s\\ threadSet f ptr \\\\rv. ct_idle_or_in_cur_domain'\\\"\n apply (simp add:ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (wp hoare_vcg_imp_lift hoare_vcg_disj_lift | wps)+\n apply clarsimp\n done\n\nlemma setDomain_invs':\n \"\\invs' and sch_act_simple and ct_active' and\n (tcb_at' ptr and\n (\\s. sch_act_not ptr s) and\n (\\y. domain \\ maxDomain))\\\n setDomain ptr domain \\\\y. invs'\\\"\n apply (simp add:setDomain_def )\n apply (wp add: when_wp static_imp_wp static_imp_conj_wp rescheduleRequired_all_invs_but_extra\n tcbSchedEnqueue_valid_action hoare_vcg_if_lift2)\n apply (rule_tac Q = \"\\r s. all_invs_but_sch_extra s \\ curThread = ksCurThread s\n \\ (ptr \\ curThread \\ ct_not_inQ s \\ sch_act_wf (ksSchedulerAction s) s \\ ct_idle_or_in_cur_domain' s)\"\n in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def st_tcb_at'_def[symmetric] valid_pspace'_def)\n apply (erule st_tcb_ex_cap'')\n apply simp\n apply (case_tac st,simp_all)[1]\n apply (rule hoare_strengthen_post[OF hoare_vcg_conj_lift])\n apply (rule threadSet_all_invs_but_sch_extra)\n prefer 2\n apply clarsimp\n apply assumption\n apply (wp static_imp_wp threadSet_pred_tcb_no_state threadSet_not_curthread_ct_domain\n threadSet_tcbDomain_update_ct_not_inQ | simp)+\n apply (rule_tac Q = \"\\r s. invs' s \\ curThread = ksCurThread s \\ sch_act_simple s\n \\ domain \\ maxDomain\n \\ (ptr \\ curThread \\ ct_not_inQ s \\ sch_act_not ptr s)\"\n in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def)\n apply (wp hoare_vcg_imp_lift)+\n apply (clarsimp simp:invs'_def valid_pspace'_def valid_state'_def)+\n done\n\nlemma performInv_invs'[wp]:\n \"\\invs' and sch_act_simple\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\n and ct_active' and valid_invocation' i\\\n RetypeDecls_H.performInvocation block call i \\\\rv. invs'\\\"\n unfolding performInvocation_def\n apply (cases i)\n apply ((clarsimp simp: simple_sane_strg sch_act_simple_def\n ct_not_ksQ sch_act_sane_def\n | wp tcbinv_invs' arch_performInvocation_invs'\n setDomain_invs'\n | rule conjI | erule active_ex_cap')+)\n done\n\nlemma getSlotCap_to_refs[wp]:\n \"\\\\\\ getSlotCap ref \\\\rv s. \\r\\zobj_refs' rv. ex_nonz_cap_to' r s\\\"\n by (simp add: getSlotCap_def | wp)+\n\nlemma lcs_valid' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. s \\' fst x\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp|clarsimp simp: split_def)+\n done\n\nlemma lcs_ex_cap_to' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. \\r\\cte_refs' (fst x) (irq_node' s). ex_cte_cap_to' r s\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp | simp add: split_def)+\n done\n\nlemma lcs_ex_nonz_cap_to' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. \\r\\zobj_refs' (fst x). ex_nonz_cap_to' r s\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp | simp add: split_def)+\n done\n\nlemma lcs_cte_at' [wp]:\n \"\\valid_objs'\\ lookupCapAndSlot t xs \\\\rv s. cte_at' (snd rv) s\\,-\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n done\n\nlemma lec_ex_cap_to' [wp]:\n \"\\invs'\\\n lookupExtraCaps t xa mi\n \\\\rv s. (\\cap \\ set rv. \\r\\cte_refs' (fst cap) (irq_node' s). ex_cte_cap_to' r s)\\, -\"\n unfolding lookupExtraCaps_def\n apply (cases \"msgExtraCaps mi = 0\")\n apply simp\n apply (wp mapME_set | simp)+\n done\n\nlemma lec_ex_nonz_cap_to' [wp]:\n \"\\invs'\\\n lookupExtraCaps t xa mi\n \\\\rv s. (\\cap \\ set rv. \\r\\zobj_refs' (fst cap). ex_nonz_cap_to' r s)\\, -\"\n unfolding lookupExtraCaps_def\n apply (cases \"msgExtraCaps mi = 0\")\n apply simp\n apply (wp mapME_set | simp)+\n done\n\n(* FIXME: move *)\nlemma getSlotCap_eq [wp]:\n \"\\\\\\ getSlotCap slot\n \\\\cap. cte_wp_at' ((=) cap \\ cteCap) slot\\\"\n by (wpsimp wp: getCTE_wp' simp: getSlotCap_def cte_wp_at_ctes_of)\n\nlemma lcs_eq [wp]:\n \"\\\\\\ lookupCapAndSlot t cptr \\\\rv. cte_wp_at' ((=) (fst rv) \\ cteCap) (snd rv)\\,-\"\n by (wpsimp simp: lookupCapAndSlot_def)\n\nlemma lec_dimished'[wp]:\n \"\\\\\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. cte_wp_at' ((=) (fst x) o cteCap) (snd x) s)\\,-\"\n by (wpsimp wp: mapME_set simp: lookupExtraCaps_def)\n\nlemma lookupExtras_real_ctes[wp]:\n \"\\valid_objs'\\ lookupExtraCaps t xs info \\\\rv s. \\x \\ set rv. real_cte_at' (snd x) s\\,-\"\n apply (simp add: lookupExtraCaps_def Let_def split del: if_split cong: if_cong)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp case_options_weak_wp mapM_wp' lsft_real_cte | simp)+\n done\n\nlemma lookupExtras_ctes[wp]:\n \"\\valid_objs'\\ lookupExtraCaps t xs info \\\\rv s. \\x \\ set rv. cte_at' (snd x) s\\,-\"\n apply (rule hoare_post_imp_R)\n apply (rule lookupExtras_real_ctes)\n apply (simp add: real_cte_at')\n done\n\nlemma lsft_ex_cte_cap_to':\n \"\\invs' and K (\\cap. isCNodeCap cap \\ P cap)\\\n lookupSlotForThread t cref\n \\\\rv s. ex_cte_cap_wp_to' P rv s\\,-\"\n apply (simp add: lookupSlotForThread_def split_def)\n apply (wp rab_cte_cap_to' getSlotCap_cap_to2 | simp)+\n done\n\nlemma lec_caps_to'[wp]:\n \"\\invs' and K (\\cap. isCNodeCap cap \\ P cap)\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. ex_cte_cap_wp_to' P (snd x) s)\\,-\"\n apply (simp add: lookupExtraCaps_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp lsft_ex_cte_cap_to' mapM_wp'\n | simp | wpc)+\n done\n\nlemma getSlotCap_badge_derived[wp]:\n \"\\\\\\ getSlotCap p \\\\cap. cte_wp_at' (badge_derived' cap \\ cteCap) p\\\"\n apply (simp add: getSlotCap_def)\n apply (wp getCTE_wp)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma lec_derived'[wp]:\n \"\\invs'\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. cte_wp_at' (badge_derived' (fst x) o cteCap) (snd x) s)\\,-\"\n apply (simp add: lookupExtraCaps_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp | simp)+\n done\n\nlemma get_mrs_length_rv[wp]:\n \"\\\\s. \\n. n \\ msg_max_length \\ P n\\ get_mrs thread buf mi \\\\rv s. P (length rv)\\\"\n apply (simp add: get_mrs_def cong: option.case_cong_weak[cong])\n apply (rule hoare_pre)\n apply (wp mapM_length | wpc | simp del: upt.simps)+\n apply (clarsimp simp: msgRegisters_unfold\n msg_max_length_def)\n done\n\nlemma st_tcb_at_idle_thread':\n \"\\ st_tcb_at' P (ksIdleThread s) s; valid_idle' s \\\n \\ P IdleThreadState\"\n by (clarsimp simp: valid_idle'_def pred_tcb_at'_def obj_at'_def idle_tcb'_def)\n\ncrunch tcb_at'[wp]: replyFromKernel \"tcb_at' t\"\n\nlemma invs_weak_sch_act_wf_strg:\n \"invs' s \\ weak_sch_act_wf (ksSchedulerAction s) s\"\n by clarsimp\n\n(* FIXME: move *)\nlemma rct_sch_act_simple[simp]:\n \"ksSchedulerAction s = ResumeCurrentThread \\ sch_act_simple s\"\n by (simp add: sch_act_simple_def)\n\n(* FIXME: move *)\nlemma rct_sch_act_sane[simp]:\n \"ksSchedulerAction s = ResumeCurrentThread \\ sch_act_sane s\"\n by (simp add: sch_act_sane_def)\n\nlemma lookupCapAndSlot_real_cte_at'[wp]:\n \"\\valid_objs'\\ lookupCapAndSlot thread ptr \\\\rv. real_cte_at' (snd rv)\\, -\"\napply (simp add: lookupCapAndSlot_def lookupSlotForThread_def)\napply (wp resolveAddressBits_real_cte_at' | simp add: split_def)+\ndone\n\nlemmas set_thread_state_active_valid_sched =\n set_thread_state_runnable_valid_sched[simplified runnable_eq_active]\n\n(*FIXME: move to NonDetMonadVCG.valid_validE_R *)\nlemma handleInvocation_corres:\n \"c \\ b \\\n corres (dc \\ dc)\n (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and ct_active')\n (handle_invocation c b)\n (handleInvocation c b)\"\n apply (simp add: handle_invocation_def handleInvocation_def liftE_bindE)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[OF getCurThread_corres])\n apply (rule corres_split[OF getMessageInfo_corres])\n apply clarsimp\n apply (simp add: liftM_def cap_register_def capRegister_def)\n apply (rule corres_split_eqr[OF asUser_getRegister_corres])\n apply (rule syscall_corres)\n apply (rule hinv_corres_assist, simp)\n apply (clarsimp simp add: when_def)\n apply (rule handleFault_corres)\n apply simp\n apply (simp add: split_def)\n apply (rule corres_split[OF getMRs_corres])\n apply (rule decodeInvocation_corres, simp_all)[1]\n apply (fastforce simp: list_all2_map2 list_all2_map1 elim: list_all2_mono)\n apply (fastforce simp: list_all2_map2 list_all2_map1 elim: list_all2_mono)\n apply wp[1]\n apply (drule sym[OF conjunct1])\n apply simp\n apply wp[1]\n apply (clarsimp simp: when_def)\n apply (rule replyFromKernel_corres)\n apply (rule corres_split[OF setThreadState_corres])\n apply simp\n apply (rule corres_splitEE)\n apply (rule performInvocation_corres; simp)\n apply simp\n apply (rule corres_split[OF getThreadState_corres])\n apply (rename_tac state state')\n apply (case_tac state, simp_all)[1]\n apply (fold dc_def)[1]\n apply (rule corres_split)\n apply (rule corres_when [OF refl replyFromKernel_corres])\n apply (rule setThreadState_corres)\n apply simp\n apply (simp add: when_def)\n apply (rule conjI, rule impI)\n apply (rule reply_from_kernel_tcb_at)\n apply (rule impI, wp+)\n apply simp+\n apply (wp hoare_drop_imps)+\n apply simp\n apply wp\n apply simp\n apply (rule_tac Q=\"\\rv. einvs and simple_sched_action and valid_invocation rve\n and (\\s. thread = cur_thread s)\n and st_tcb_at active thread\"\n in hoare_post_imp)\n apply (clarsimp simp: simple_from_active ct_in_state_def\n elim!: st_tcb_weakenE)\n apply (wp sts_st_tcb_at' set_thread_state_simple_sched_action\n set_thread_state_active_valid_sched)\n apply (rule_tac Q=\"\\rv. invs' and valid_invocation' rve'\n and (\\s. thread = ksCurThread s)\n and st_tcb_at' active' thread\n and (\\s. ksSchedulerAction s = ResumeCurrentThread)\"\n in hoare_post_imp)\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (clarsimp)\n apply (wp setThreadState_nonqueued_state_update\n setThreadState_st_tcb setThreadState_rct)[1]\n apply (wp lec_caps_to lsft_ex_cte_cap_to\n | simp add: split_def liftE_bindE[symmetric]\n ct_in_state'_def ball_conj_distrib\n | rule hoare_vcg_E_elim)+\n apply (clarsimp simp: tcb_at_invs invs_valid_objs\n valid_tcb_state_def ct_in_state_def\n simple_from_active invs_mdb)\n apply (clarsimp simp: msg_max_length_def word_bits_def)\n apply (erule st_tcb_ex_cap, clarsimp+)\n apply fastforce\n apply (clarsimp)\n apply (frule tcb_at_invs')\n apply (clarsimp simp: invs'_def valid_state'_def\n ct_in_state'_def ct_not_inQ_def)\n apply (frule(1) valid_queues_not_tcbQueued_not_ksQ)\n apply (frule pred_tcb'_weakenE [where P=active' and P'=simple'], clarsimp)\n apply (frule(1) st_tcb_ex_cap'', fastforce)\n apply (clarsimp simp: valid_pspace'_def)\n apply (frule(1) st_tcb_at_idle_thread')\n apply (simp)\n done\n\nlemma ts_Restart_case_helper':\n \"(case ts of Structures_H.Restart \\ A | _ \\ B)\n = (if ts = Structures_H.Restart then A else B)\"\n by (cases ts, simp_all)\n\nlemma gts_imp':\n \"\\Q\\ getThreadState t \\R\\ \\\n \\\\s. st_tcb_at' P t s \\ Q s\\ getThreadState t \\\\rv s. P rv \\ R rv s\\\"\n apply (simp only: imp_conv_disj)\n apply (erule hoare_vcg_disj_lift[rotated])\n apply (rule hoare_strengthen_post [OF gts_sp'])\n apply (clarsimp simp: pred_tcb_at'_def obj_at'_def projectKOs)\n done\n\ncrunch st_tcb_at'[wp]: replyFromKernel \"st_tcb_at' P t\"\ncrunch cap_to'[wp]: replyFromKernel \"ex_nonz_cap_to' p\"\ncrunch it'[wp]: replyFromKernel \"\\s. P (ksIdleThread s)\"\ncrunch sch_act_simple[wp]: replyFromKernel sch_act_simple\n (rule: sch_act_simple_lift)\n\nlemma rfk_ksQ[wp]:\n \"\\\\s. P (ksReadyQueues s p)\\ replyFromKernel t x1 \\\\_ s. P (ksReadyQueues s p)\\\"\n apply (case_tac x1)\n apply (simp add: replyFromKernel_def)\n apply (wp)\n done\n\nlemma hinv_invs'[wp]:\n \"\\invs' and ct_active' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleInvocation calling blocking\n \\\\rv. invs'\\\"\n apply (simp add: handleInvocation_def split_def\n ts_Restart_case_helper')\n apply (wp syscall_valid' setThreadState_nonqueued_state_update rfk_invs'\n hoare_vcg_all_lift static_imp_wp)\n apply simp\n apply (intro conjI impI)\n apply (wp gts_imp' | simp)+\n apply (rule_tac Q'=\"\\rv. invs'\" in hoare_post_imp_R[rotated])\n apply clarsimp\n apply (subgoal_tac \"thread \\ ksIdleThread s\", simp_all)[1]\n apply (fastforce elim!: pred_tcb'_weakenE st_tcb_ex_cap'')\n apply (clarsimp simp: valid_idle'_def valid_state'_def\n invs'_def pred_tcb_at'_def obj_at'_def idle_tcb'_def)\n apply wp+\n apply (rule_tac Q=\"\\rv'. invs' and valid_invocation' rv\n and (\\s. ksSchedulerAction s = ResumeCurrentThread)\n and (\\s. ksCurThread s = thread)\n and st_tcb_at' active' thread\"\n in hoare_post_imp)\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (clarsimp)\n apply (wp sts_invs_minor' setThreadState_st_tcb setThreadState_rct | simp)+\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce simp add: tcb_at_invs' ct_in_state'_def\n simple_sane_strg\n sch_act_simple_def\n elim!: pred_tcb'_weakenE st_tcb_ex_cap''\n dest: st_tcb_at_idle_thread')+\n done\n\ncrunch typ_at'[wp]: handleFault \"\\s. P (typ_at' T p s)\"\n\nlemmas handleFault_typ_ats[wp] = typ_at_lifts [OF handleFault_typ_at']\n\nlemma handleSend_corres:\n \"corres (dc \\ dc)\n (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and ct_active')\n (handle_send blocking) (handleSend blocking)\"\n by (simp add: handle_send_def handleSend_def handleInvocation_corres)\n\nlemma hs_invs'[wp]:\n \"\\invs' and ct_active' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleSend blocking \\\\r. invs'\\\"\n apply (rule validE_valid)\n apply (simp add: handleSend_def)\n apply (wp | simp)+\n done\n\nlemma getThreadCallerSlot_map:\n \"getThreadCallerSlot t = return (cte_map (t, tcb_cnode_index 3))\"\n by (simp add: getThreadCallerSlot_def locateSlot_conv\n cte_map_def tcb_cnode_index_def tcbCallerSlot_def\n cte_level_bits_def)\n\nlemma tcb_at_cte_at_map:\n \"\\ tcb_at' t s; offs \\ dom tcb_cap_cases \\ \\ cte_at' (cte_map (t, offs)) s\"\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (drule tcb_cases_related)\n apply (auto elim: cte_wp_at_tcbI')\n done\n\nlemma deleteCallerCap_corres:\n \"corres dc (einvs and tcb_at t) (invs' and tcb_at' t)\n (delete_caller_cap t)\n (deleteCallerCap t)\"\n apply (simp add: delete_caller_cap_def deleteCallerCap_def\n getThreadCallerSlot_map)\n apply (rule corres_guard_imp)\n apply (rule_tac P'=\"cte_at' (cte_map (t, tcb_cnode_index 3))\" in corres_symb_exec_r_conj)\n apply (rule_tac F=\"isReplyCap rv \\ rv = capability.NullCap\"\n and P=\"cte_wp_at (\\cap. is_reply_cap cap \\ cap = cap.NullCap) (t, tcb_cnode_index 3)\n and einvs\"\n and P'=\"invs' and cte_wp_at' (\\cte. cteCap cte = rv)\n (cte_map (t, tcb_cnode_index 3))\" in corres_req)\n apply (clarsimp simp: cte_wp_at_caps_of_state state_relation_def)\n apply (drule caps_of_state_cteD)\n apply (drule(1) pspace_relation_cte_wp_at, clarsimp+)\n apply (clarsimp simp: cte_wp_at_ctes_of is_reply_cap_relation cap_relation_NullCapI)\n apply simp\n apply (rule corres_guard_imp, rule cap_delete_one_corres)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps)\n apply (auto simp: can_fast_finalise_def)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply ((wp getCTE_wp')+ | simp add: getSlotCap_def)+\n apply clarsimp\n apply (frule tcb_at_cte_at[where ref=\"tcb_cnode_index 3\"])\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule tcb_cap_valid_caps_of_stateD, clarsimp)\n apply (drule(1) tcb_cnode_index_3_reply_or_null)\n apply (auto simp: can_fast_finalise_def is_cap_simps\n intro: tcb_at_cte_at_map tcb_at_cte_at)[1]\n apply clarsimp\n apply (frule_tac offs=\"tcb_cnode_index 3\" in tcb_at_cte_at_map)\n apply (simp add: tcb_cap_cases_def)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma deleteCallerCap_invs[wp]:\n \"\\invs'\\ deleteCallerCap t \\\\rv. invs'\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_invs hoare_drop_imps)\n done\n\nlemma deleteCallerCap_simple[wp]:\n \"\\st_tcb_at' simple' t\\ deleteCallerCap t' \\\\rv. st_tcb_at' simple' t\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_st_tcb_at hoare_drop_imps | simp)+\n done\n\nlemma cteDeleteOne_reply_cap_to''[wp]:\n \"\\ex_nonz_cap_to' p and\n cte_wp_at' (\\c. isReplyCap (cteCap c) \\ isNullCap (cteCap c)) slot\\\n cteDeleteOne slot\n \\\\rv. ex_nonz_cap_to' p\\\"\n apply (simp add: cteDeleteOne_def ex_nonz_cap_to'_def unless_def)\n apply (rule hoare_seq_ext [OF _ getCTE_sp])\n apply (rule hoare_assume_pre)\n apply (subgoal_tac \"isReplyCap (cteCap cte) \\ isNullCap (cteCap cte)\")\n apply (wp hoare_vcg_ex_lift emptySlot_cte_wp_cap_other isFinalCapability_inv\n | clarsimp simp: finaliseCap_def isCap_simps | simp\n | wp (once) hoare_drop_imps)+\n apply (fastforce simp: cte_wp_at_ctes_of)\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n done\n\nlemma deleteCallerCap_nonz_cap:\n \"\\ex_nonz_cap_to' p and tcb_at' t and valid_objs'\\\n deleteCallerCap t\n \\\\rv. ex_nonz_cap_to' p\\\"\n apply (simp add: deleteCallerCap_def getSlotCap_def getThreadCallerSlot_map\n locateSlot_conv )\n apply (rule hoare_pre)\n apply (wp cteDeleteOne_reply_cap_to'' getCTE_wp')\n apply clarsimp\n apply (frule_tac offs=\"tcb_cnode_index 3\" in tcb_at_cte_at_map)\n apply (clarsimp simp: tcb_cap_cases_def)\n apply (auto simp: ex_nonz_cap_to'_def isCap_simps cte_wp_at_ctes_of)\n done\n\ncrunch sch_act_sane[wp]: cteDeleteOne sch_act_sane\n (wp: crunch_wps loadObject_default_inv getObject_inv\n simp: crunch_simps unless_def\n rule: sch_act_sane_lift)\n\ncrunch sch_act_sane[wp]: deleteCallerCap sch_act_sane\n (wp: crunch_wps)\n\nlemma delete_caller_cap_valid_ep_cap:\n \"\\valid_cap (cap.EndpointCap r a b)\\ delete_caller_cap thread \\\\rv. valid_cap (cap.EndpointCap r a b)\\\"\n apply (clarsimp simp: delete_caller_cap_def cap_delete_one_def valid_cap_def)\n apply (rule hoare_pre)\n by (wp get_cap_wp fast_finalise_typ_at abs_typ_at_lifts(1)\n | simp add: unless_def valid_cap_def)+\n\nlemma handleRecv_isBlocking_corres':\n \"corres dc (einvs and ct_in_state active\n and (\\s. ex_nonz_cap_to (cur_thread s) s))\n (invs' and ct_in_state' simple'\n and sch_act_sane\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\n and (\\s. ex_nonz_cap_to' (ksCurThread s) s))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n (is \"corres dc (?pre1) (?pre2) (handle_recv _) (handleRecv _)\")\n apply (simp add: handle_recv_def handleRecv_def liftM_bind Let_def\n cap_register_def capRegister_def\n cong: if_cong cap.case_cong capability.case_cong bool.case_cong)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[OF getCurThread_corres])\n apply (rule corres_split_eqr[OF asUser_getRegister_corres])\n apply (rule corres_split_catch)\n apply (rule corres_cap_fault)\n apply (rule corres_splitEE[OF lookupCap_corres])\n apply (rule_tac P=\"?pre1 and tcb_at thread\n and (\\s. (cur_thread s) = thread )\n and valid_cap rv\"\n and P'=\"?pre2 and tcb_at' thread and valid_cap' rv'\" in corres_inst)\n apply (clarsimp split: cap_relation_split_asm arch_cap.split_asm split del: if_split\n simp: lookup_failure_map_def whenE_def)\n apply (rule corres_guard_imp)\n apply (rename_tac rights)\n apply (case_tac \"AllowRead \\ rights\"; simp)\n apply (rule corres_split_nor[OF deleteCallerCap_corres])\n apply (rule receiveIPC_corres)\n apply (clarsimp)+\n apply (wp delete_caller_cap_nonz_cap delete_caller_cap_valid_ep_cap)+\n apply (clarsimp)+\n apply (clarsimp simp: lookup_failure_map_def)+\n apply (clarsimp simp: valid_cap'_def capAligned_def)\n apply (rule corres_guard_imp)\n apply (rename_tac rights)\n apply (case_tac \"AllowRead \\ rights\"; simp)\n apply (rule_tac r'=ntfn_relation in corres_splitEE)\n apply clarsimp\n apply (rule getNotification_corres)\n apply (rule corres_if)\n apply (clarsimp simp: ntfn_relation_def)\n apply (clarsimp, rule receiveSignal_corres)\n prefer 3\n apply (rule corres_trivial)\n apply (clarsimp simp: lookup_failure_map_def)+\n apply (wp get_simple_ko_wp getNotification_wp | wpcw | simp)+\n apply (clarsimp simp: lookup_failure_map_def)\n apply (clarsimp simp: valid_cap_def ct_in_state_def)\n apply (clarsimp simp: valid_cap'_def capAligned_def)\n apply wp+\n apply (rule handleFault_corres)\n apply simp\n apply (wp get_simple_ko_wp | wpcw | simp)+\n apply (rule hoare_vcg_E_elim)\n apply (simp add: lookup_cap_def lookup_slot_for_thread_def)\n apply wp\n apply (simp add: split_def)\n apply (wp resolve_address_bits_valid_fault2)+\n apply (wp getNotification_wp | wpcw | simp add: valid_fault_def whenE_def split del: if_split)+\n apply (clarsimp simp add: ct_in_state_def ct_in_state'_def conj_comms invs_valid_tcb_ctable\n invs_valid_objs tcb_at_invs invs_psp_aligned invs_cur)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def\n ct_in_state'_def sch_act_sane_not)\n done\n\nlemma handleRecv_isBlocking_corres:\n \"corres dc (einvs and ct_active)\n (invs' and ct_active' and sch_act_sane and\n (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p)))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n apply (rule corres_guard_imp)\n apply (rule handleRecv_isBlocking_corres')\n apply (clarsimp simp: ct_in_state_def)\n apply (fastforce elim!: st_tcb_weakenE st_tcb_ex_cap)\n apply (clarsimp simp: ct_in_state'_def invs'_def valid_state'_def)\n apply (frule(1) st_tcb_ex_cap'')\n apply (auto elim: pred_tcb'_weakenE)\n done\n\nlemma lookupCap_refs[wp]:\n \"\\invs'\\ lookupCap t ref \\\\rv s. \\r\\zobj_refs' rv. ex_nonz_cap_to' r s\\,-\"\n by (simp add: lookupCap_def split_def | wp | simp add: o_def)+\n\nlemma deleteCallerCap_ksQ_ct':\n \"\\invs' and ct_in_state' simple' and sch_act_sane and\n (\\s. ksCurThread s \\ set (ksReadyQueues s p) \\ thread = ksCurThread s)\\\n deleteCallerCap thread\n \\\\rv s. thread \\ set (ksReadyQueues s p)\\\"\n apply (rule_tac Q=\"\\rv s. thread = ksCurThread s \\ ksCurThread s \\ set (ksReadyQueues s p)\"\n in hoare_strengthen_post)\n apply (wp deleteCallerCap_ct_not_ksQ)\n apply auto\n done\n\nlemma hw_invs'[wp]:\n \"\\invs' and ct_in_state' simple' and sch_act_sane\n and (\\s. ex_nonz_cap_to' (ksCurThread s) s)\n and (\\s. ksCurThread s \\ ksIdleThread s)\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\\\n handleRecv isBlocking \\\\r. invs'\\\"\n apply (simp add: handleRecv_def cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp getNotification_wp | wpc | simp)+)[1]\n apply (clarsimp simp: ct_in_state'_def)\n apply ((wp deleteCallerCap_nonz_cap hoare_vcg_all_lift\n deleteCallerCap_ksQ_ct'\n hoare_lift_Pf2[OF deleteCallerCap_simple\n deleteCallerCap_ct']\n | wpc | simp)+)[1]\n apply simp\n apply (wp deleteCallerCap_nonz_cap hoare_vcg_all_lift\n deleteCallerCap_ksQ_ct'\n hoare_lift_Pf2[OF deleteCallerCap_simple\n deleteCallerCap_ct']\n | wpc | simp add: ct_in_state'_def whenE_def split del: if_split)+\n apply (rule validE_validE_R)\n apply (rule_tac Q=\"\\rv s. invs' s\n \\ sch_act_sane s\n \\ (\\p. ksCurThread s \\ set (ksReadyQueues s p))\n \\ thread = ksCurThread s\n \\ ct_in_state' simple' s\n \\ ex_nonz_cap_to' thread s\n \\ thread \\ ksIdleThread s\n \\ (\\x \\ zobj_refs' rv. ex_nonz_cap_to' x s)\"\n and E=\"\\_ _. True\"\n in hoare_post_impErr[rotated])\n apply (clarsimp simp: isCap_simps ct_in_state'_def pred_tcb_at' invs_valid_objs'\n sch_act_sane_not obj_at'_def projectKOs pred_tcb_at'_def)\n apply (assumption)\n apply (wp)+\n apply (clarsimp)\n apply (auto elim: st_tcb_ex_cap'' pred_tcb'_weakenE\n dest!: st_tcb_at_idle_thread'\n simp: ct_in_state'_def sch_act_sane_def)\n done\n\nlemma setSchedulerAction_obj_at'[wp]:\n \"\\obj_at' P p\\ setSchedulerAction sa \\\\rv. obj_at' P p\\\"\n unfolding setSchedulerAction_def\n by (wp, clarsimp elim!: obj_at'_pspaceI)\n\nlemma handleYield_corres:\n \"corres dc einvs (invs' and ct_active' and (\\s. ksSchedulerAction s = ResumeCurrentThread)) handle_yield handleYield\"\n apply (clarsimp simp: handle_yield_def handleYield_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF getCurThread_corres])\n apply simp\n apply (rule corres_split[OF tcbSchedDequeue_corres])\n apply (rule corres_split[OF tcbSchedAppend_corres])\n apply (rule rescheduleRequired_corres)\n apply (wp weak_sch_act_wf_lift_linear tcbSchedDequeue_valid_queues | simp add: )+\n apply (simp add: invs_def valid_sched_def valid_sched_action_def\n cur_tcb_def tcb_at_is_etcb_at)\n apply clarsimp\n apply (frule ct_active_runnable')\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def sch_act_wf_weak cur_tcb'_def\n valid_pspace_valid_objs' valid_objs'_maxDomain tcb_in_cur_domain'_def)\n apply (erule(1) valid_objs_valid_tcbE[OF valid_pspace_valid_objs'])\n apply (simp add:valid_tcb'_def)\n done\n\nlemma hy_invs':\n \"\\invs' and ct_active'\\ handleYield \\\\r. invs' and ct_active'\\\"\n apply (simp add: handleYield_def)\n apply (wp ct_in_state_thread_state_lift'\n rescheduleRequired_all_invs_but_ct_not_inQ\n tcbSchedAppend_invs_but_ct_not_inQ' | simp)+\n apply (clarsimp simp add: invs'_def valid_state'_def ct_in_state'_def sch_act_wf_weak cur_tcb'_def\n valid_pspace_valid_objs' valid_objs'_maxDomain tcb_in_cur_domain'_def\n )\n apply (simp add:ct_active_runnable'[unfolded ct_in_state'_def])\n done\n\nlemma getFaultAddress_invs'[wp]:\n \"valid invs' (doMachineOp getFaultAddress) (\\_. invs')\"\n by (simp add: getFaultAddress_def doMachineOp_def split_def select_f_returns | wp)+\n\nlemma hv_invs'[wp]: \"\\invs' and tcb_at' t'\\ handleVMFault t' vptr \\\\r. invs'\\\"\n apply (simp add: X64_H.handleVMFault_def\n cong: vmfault_type.case_cong)\n apply (rule hoare_pre)\n apply (wp | wpcw | simp)+\n done\n\ncrunch nosch[wp]: handleVMFault \"\\s. P (ksSchedulerAction s)\"\n (ignore: getFaultAddress)\n\nlemma hv_inv_ex':\n \"\\P\\ handleVMFault t vp \\\\_ _. True\\, \\\\_. P\\\"\n apply (simp add: X64_H.handleVMFault_def\n cong: vmfault_type.case_cong)\n apply (rule hoare_pre)\n apply (wp dmo_inv' getFaultAddress_inv getRestartPC_inv\n det_getRestartPC asUser_inv\n | wpcw)+\n apply simp\n done\n\nlemma active_from_running':\n \"ct_running' s' \\ ct_active' s'\"\n by (clarsimp elim!: pred_tcb'_weakenE\n simp: ct_in_state'_def)+\n\nlemma simple_from_running':\n \"ct_running' s' \\ ct_in_state' simple' s'\"\n by (clarsimp elim!: pred_tcb'_weakenE\n simp: ct_in_state'_def)+\n\nlemma handleReply_corres:\n \"corres dc (einvs and ct_running) (invs' and ct_running')\n handle_reply handleReply\"\n apply (simp add: handle_reply_def handleReply_def\n getThreadCallerSlot_map\n getSlotCap_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[OF getCurThread_corres])\n apply (rule corres_split[OF get_cap_corres])\n apply (rule_tac P=\"einvs and cte_wp_at ((=) caller_cap) (thread, tcb_cnode_index 3)\n and K (is_reply_cap caller_cap \\ caller_cap = cap.NullCap)\n and tcb_at thread and st_tcb_at active thread\n and valid_cap caller_cap\"\n and P'=\"invs' and tcb_at' thread\n and valid_cap' (cteCap rv')\n and cte_at' (cte_map (thread, tcb_cnode_index 3))\"\n in corres_inst)\n apply (auto split: cap_relation_split_asm arch_cap.split_asm bool.split\n intro!: corres_guard_imp [OF deleteCallerCap_corres]\n corres_guard_imp [OF doReplyTransfer_corres]\n corres_fail\n simp: valid_cap_def valid_cap'_def is_cap_simps assert_def is_reply_cap_to_def)[1]\n apply (fastforce simp: invs_def valid_state_def\n cte_wp_at_caps_of_state st_tcb_def2\n dest: valid_reply_caps_of_stateD)\n apply (wp get_cap_cte_wp_at get_cap_wp | simp add: cte_wp_at_eq_simp)+\n apply (intro conjI impI allI,\n (fastforce simp: invs_def valid_state_def\n intro: tcb_at_cte_at)+)\n apply (clarsimp, frule tcb_at_invs)\n apply (fastforce dest: tcb_caller_cap simp: cte_wp_at_def)\n apply clarsimp\n apply (clarsimp simp: ct_in_state_def elim!: st_tcb_weakenE)\n apply (fastforce intro: cte_wp_valid_cap elim: cte_wp_at_weakenE)\n apply (fastforce intro: tcb_at_cte_at_map)\n done\n\nlemma hr_invs'[wp]:\n \"\\invs' and sch_act_simple\\ handleReply \\\\rv. invs'\\\"\n apply (simp add: handleReply_def getSlotCap_def\n getThreadCallerSlot_map getCurThread_def)\n apply (wp getCTE_wp | wpc | simp)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule ctes_of_valid', clarsimp+)\n apply (simp add: valid_cap'_def)\n apply (simp add: invs'_def cur_tcb'_def)\n done\n\ncrunch ksCurThread[wp]: handleReply \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps transferCapsToSlots_pres1 setObject_ep_ct\n setObject_ntfn_ct\n simp: unless_def crunch_simps\n ignore: transferCapsToSlots)\n\nlemmas cteDeleteOne_st_tcb_at_simple'[wp] =\n cteDeleteOne_st_tcb_at[where P=simple', simplified]\n\ncrunch st_tcb_at_simple'[wp]: handleReply \"st_tcb_at' simple' t'\"\n (wp: hoare_post_taut crunch_wps sts_st_tcb_at'_cases\n threadSet_pred_tcb_no_state\n ignore: setThreadState)\n\nlemmas handleReply_ct_in_state_simple[wp] =\n ct_in_state_thread_state_lift' [OF handleReply_ksCurThread\n handleReply_st_tcb_at_simple']\n\n\n(* FIXME: move *)\nlemma doReplyTransfer_st_tcb_at_active:\n \"\\st_tcb_at' active' t and tcb_at' t' and K (t \\ t') and\n cte_wp_at' (\\cte. cteCap cte = (capability.ReplyCap t' False g)) sl\\\n doReplyTransfer t t' sl g\n \\\\rv. st_tcb_at' active' t\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (wp setThreadState_st_tcb sts_pred_tcb_neq' cteDeleteOne_reply_pred_tcb_at\n hoare_drop_imps threadSet_pred_tcb_no_state hoare_exI\n doIPCTransfer_non_null_cte_wp_at2' | wpc | clarsimp simp:isCap_simps)+\n apply (fastforce)\n done\n\nlemma hr_ct_active'[wp]:\n \"\\invs' and ct_active'\\ handleReply \\\\rv. ct_active'\\\"\n apply (simp add: handleReply_def getSlotCap_def getCurThread_def\n getThreadCallerSlot_def locateSlot_conv)\n apply (rule hoare_seq_ext)\n apply (rule ct_in_state'_decomp)\n apply ((wp hoare_drop_imps | wpc | simp)+)[1]\n apply (subst haskell_assert_def)\n apply (wp hoare_vcg_all_lift getCTE_wp doReplyTransfer_st_tcb_at_active\n | wpc | simp)+\n apply (fastforce simp: ct_in_state'_def cte_wp_at_ctes_of valid_cap'_def\n dest: ctes_of_valid')\n done\n\nlemma handleCall_corres:\n \"corres (dc \\ dc) (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and\n ct_active')\n handle_call handleCall\"\n by (simp add: handle_call_def handleCall_def liftE_bindE handleInvocation_corres)\n\nlemma hc_invs'[wp]:\n \"\\invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and\n ct_active'\\\n handleCall\n \\\\rv. invs'\\\"\n apply (simp add: handleCall_def)\n apply (wp)\n apply (clarsimp)\n done\n\nlemma cteInsert_sane[wp]:\n \"\\sch_act_sane\\ cteInsert newCap srcSlot destSlot \\\\_. sch_act_sane\\\"\n apply (simp add: sch_act_sane_def)\n apply (wp hoare_vcg_all_lift\n hoare_convert_imp [OF cteInsert_nosch cteInsert_ct])\n done\n\ncrunch sane [wp]: setExtraBadge sch_act_sane\n\ncrunch sane [wp]: transferCaps \"sch_act_sane\"\n (wp: transferCapsToSlots_pres1 crunch_wps\n simp: crunch_simps\n ignore: transferCapsToSlots)\n\nlemma possibleSwitchTo_sane:\n \"\\\\s. sch_act_sane s \\ t \\ ksCurThread s\\ possibleSwitchTo t \\\\_. sch_act_sane\\\"\n apply (simp add: possibleSwitchTo_def setSchedulerAction_def curDomain_def\n cong: if_cong)\n apply (wp hoare_drop_imps | wpc)+\n apply (simp add: sch_act_sane_def)\n done\n\ncrunch sane [wp]: handleFaultReply sch_act_sane\n ( wp: threadGet_inv hoare_drop_imps crunch_wps\n simp: crunch_simps\n ignore: setSchedulerAction)\n\ncrunch sane [wp]: doIPCTransfer sch_act_sane\n ( wp: threadGet_inv hoare_drop_imps crunch_wps\n simp: crunch_simps\n ignore: setSchedulerAction)\n\nlemma doReplyTransfer_sane:\n \"\\\\s. sch_act_sane s \\ t' \\ ksCurThread s\\\n doReplyTransfer t t' callerSlot g \\\\rv. sch_act_sane\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (wp possibleSwitchTo_sane hoare_drop_imps hoare_vcg_all_lift|wpc)+\n apply simp\n done\n\nlemma handleReply_sane:\n \"\\sch_act_sane\\ handleReply \\\\rv. sch_act_sane\\\"\n apply (simp add: handleReply_def getSlotCap_def getThreadCallerSlot_def locateSlot_conv)\n apply (rule hoare_pre)\n apply (wp haskell_assert_wp doReplyTransfer_sane getCTE_wp'| wpc)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma handleReply_nonz_cap_to_ct:\n \"\\ct_active' and invs' and sch_act_simple\\\n handleReply\n \\\\rv s. ex_nonz_cap_to' (ksCurThread s) s\\\"\n apply (rule_tac Q=\"\\rv. ct_active' and invs'\"\n in hoare_post_imp)\n apply (auto simp: ct_in_state'_def elim: st_tcb_ex_cap'')[1]\n apply (wp | simp)+\n done\n\ncrunch ksQ[wp]: handleFaultReply \"\\s. P (ksReadyQueues s p)\"\n\nlemma doReplyTransfer_ct_not_ksQ:\n \"\\ invs' and sch_act_simple\n and tcb_at' thread and tcb_at' word\n and ct_in_state' simple'\n and (\\s. ksCurThread s \\ word)\n and (\\s. \\p. ksCurThread s \\ set(ksReadyQueues s p))\\\n doReplyTransfer thread word callerSlot g\n \\\\rv s. \\p. ksCurThread s \\ set(ksReadyQueues s p)\\\"\nproof -\n have astct: \"\\t p.\n \\(\\s. ksCurThread s \\ set(ksReadyQueues s p) \\ sch_act_sane s)\n and (\\s. ksCurThread s \\ t)\\\n possibleSwitchTo t \\\\rv s. ksCurThread s \\ set(ksReadyQueues s p)\\\"\n apply (rule hoare_weaken_pre)\n apply (wps possibleSwitchTo_ct')\n apply (wp possibleSwitchTo_ksQ')\n apply (clarsimp simp: sch_act_sane_def)\n done\n have stsct: \"\\t st p.\n \\(\\s. ksCurThread s \\ set(ksReadyQueues s p)) and sch_act_simple\\\n setThreadState st t\n \\\\rv s. ksCurThread s \\ set(ksReadyQueues s p)\\\"\n apply (rule hoare_weaken_pre)\n apply (wps setThreadState_ct')\n apply (wp hoare_vcg_all_lift sts_ksQ)\n apply (clarsimp)\n done\n show ?thesis\n apply (simp add: doReplyTransfer_def)\n apply (wp, wpc)\n apply (wp astct stsct hoare_vcg_all_lift\n cteDeleteOne_ct_not_ksQ hoare_drop_imp\n hoare_lift_Pf2 [OF cteDeleteOne_sch_act_not cteDeleteOne_ct']\n hoare_lift_Pf2 [OF doIPCTransfer_pred_tcb_at' doIPCTransfer_ct']\n hoare_lift_Pf2 [OF doIPCTransfer_ksQ doIPCTransfer_ct']\n hoare_lift_Pf2 [OF threadSet_ksQ threadSet_ct]\n hoare_lift_Pf2 [OF handleFaultReply_ksQ handleFaultReply_ct']\n | simp add: ct_in_state'_def)+\n apply (fastforce simp: sch_act_simple_def sch_act_sane_def ct_in_state'_def)+\n done\nqed\n\nlemma handleReply_ct_not_ksQ:\n \"\\invs' and sch_act_simple\n and ct_in_state' simple'\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\\\n handleReply\n \\\\rv s. \\p. ksCurThread s \\ set (ksReadyQueues s p)\\\"\n apply (simp add: handleReply_def del: split_paired_All)\n apply (subst haskell_assert_def)\n apply (wp | wpc)+\n apply (wp doReplyTransfer_ct_not_ksQ getThreadCallerSlot_inv)+\n apply (rule_tac Q=\"\\cap.\n (\\s. \\p. ksCurThread s \\ set(ksReadyQueues s p))\n and invs'\n and sch_act_simple\n and (\\s. thread = ksCurThread s)\n and tcb_at' thread\n and ct_in_state' simple'\n and cte_wp_at' (\\c. cteCap c = cap) callerSlot\"\n in hoare_post_imp)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def\n cte_wp_at_ctes_of valid_cap'_def\n dest!: ctes_of_valid')\n apply (wp getSlotCap_cte_wp_at getThreadCallerSlot_inv)+\n apply (clarsimp)\n done\n\ncrunch valid_etcbs[wp]: possible_switch_to \"valid_etcbs\"\ncrunch valid_etcbs[wp]: handle_recv \"valid_etcbs\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma handleReply_handleRecv_corres:\n \"corres dc (einvs and ct_running)\n (invs' and ct_running' and (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (do x \\ handle_reply; handle_recv True od)\n (do x \\ handleReply; handleRecv True od)\"\n apply (rule corres_guard_imp)\n apply (rule corres_split_nor[OF handleReply_corres])\n apply (rule handleRecv_isBlocking_corres')\n apply (wp handle_reply_nonz_cap_to_ct handleReply_sane\n handleReply_nonz_cap_to_ct handleReply_ct_not_ksQ handle_reply_valid_sched)+\n apply (fastforce simp: ct_in_state_def ct_in_state'_def simple_sane_strg\n elim!: st_tcb_weakenE st_tcb_ex_cap')\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce elim: pred_tcb'_weakenE)\n done\n\nlemma handleHypervisorFault_corres:\n \"corres dc (einvs and st_tcb_at active thread and ex_nonz_cap_to thread\n and (%_. valid_fault f))\n (invs' and sch_act_not thread\n and (\\s. \\p. thread \\ set(ksReadyQueues s p))\n and st_tcb_at' simple' thread and ex_nonz_cap_to' thread)\n (handle_hypervisor_fault w fault) (handleHypervisorFault w fault)\"\n apply (cases fault; clarsimp simp add: handleHypervisorFault_def returnOk_def2)\n done\n\n(* FIXME: move *)\nlemma handleEvent_corres:\n \"corres (dc \\ dc) (einvs and (\\s. event \\ Interrupt \\ ct_running s) and\n (\\s. scheduler_action s = resume_cur_thread))\n (invs' and (\\s. event \\ Interrupt \\ ct_running' s) and\n (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (handle_event event) (handleEvent event)\"\n (is \"?handleEvent_corres\")\nproof -\n have hw:\n \"\\isBlocking. corres dc (einvs and ct_running and (\\s. scheduler_action s = resume_cur_thread))\n (invs' and ct_running'\n and (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n apply (rule corres_guard_imp [OF handleRecv_isBlocking_corres])\n apply (clarsimp simp: ct_in_state_def ct_in_state'_def\n elim!: st_tcb_weakenE pred_tcb'_weakenE\n dest!: ct_not_ksQ)+\n done\n show ?thesis\n apply (case_tac event)\n apply (simp_all add: handleEvent_def)\n\n apply (rename_tac syscall)\n apply (case_tac syscall)\n apply (auto intro: corres_guard_imp[OF handleSend_corres]\n corres_guard_imp[OF hw]\n corres_guard_imp [OF handleReply_corres]\n corres_guard_imp[OF handleReply_handleRecv_corres]\n corres_guard_imp[OF handleCall_corres]\n corres_guard_imp[OF handleYield_corres]\n active_from_running active_from_running'\n simp: simple_sane_strg)[8]\n apply (rule corres_underlying_split)\n apply (rule corres_guard_imp[OF getCurThread_corres], simp+)\n apply (rule handleFault_corres)\n apply simp\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n apply (rule corres_underlying_split)\n apply (rule corres_guard_imp, rule getCurThread_corres, simp+)\n apply (rule handleFault_corres)\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def valid_fault_def)\n apply wp\n apply clarsimp\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[where R=\"\\rv. einvs\"\n and R'=\"\\rv s. \\x. rv = Some x \\ R'' x s\"\n for R''])\n apply (rule corres_machine_op)\n apply (rule corres_Id, simp+)\n apply wp\n apply (case_tac rv, simp_all add: doMachineOp_return)[1]\n apply (rule handleInterrupt_corres)\n apply (wp hoare_vcg_all_lift\n doMachineOp_getActiveIRQ_IRQ_active'\n | simp\n | simp add: imp_conjR | wp (once) hoare_drop_imps)+\n apply force\n apply simp\n apply (simp add: invs'_def valid_state'_def)\n apply (rule_tac corres_underlying_split)\n apply (rule corres_guard_imp, rule getCurThread_corres, simp+)\n apply (rule corres_split_catch)\n apply (rule handleVMFault_corres)\n apply (erule handleFault_corres)\n apply (rule hoare_elim_pred_conjE2)\n apply (rule hoare_vcg_E_conj, rule valid_validE_E, wp)\n apply (wp handle_vm_fault_valid_fault)\n apply (rule hv_inv_ex')\n apply wp\n apply (clarsimp simp: simple_from_running tcb_at_invs)\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce simp: simple_sane_strg sch_act_simple_def ct_in_state'_def\n elim: st_tcb_ex_cap'' pred_tcb'_weakenE)\n apply (rule corres_underlying_split)\n apply (rule corres_guard_imp[OF getCurThread_corres], simp+)\n apply (rule handleHypervisorFault_corres)\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n done\n qed\n\ncrunches handleVMFault,handleHypervisorFault\n for st_tcb_at'[wp]: \"st_tcb_at' P t\"\n and cap_to'[wp]: \"ex_nonz_cap_to' t\"\n and ksit[wp]: \"\\s. P (ksIdleThread s)\"\n (ignore: getFaultAddress)\n\nlemma hv_inv':\n \"\\P\\ handleVMFault p t \\\\_. P\\\"\n apply (simp add: X64_H.handleVMFault_def)\n apply (rule hoare_pre)\n apply (wp dmo_inv' getFaultAddress_inv getRestartPC_inv\n det_getRestartPC asUser_inv\n |wpc|simp)+\n done\n\nlemma hh_inv':\n \"\\P\\ handleHypervisorFault p t \\\\_. P\\\"\n apply (simp add: X64_H.handleHypervisorFault_def)\n apply (cases t; clarsimp)\n done\n\nlemma ct_not_idle':\n fixes s\n assumes vi: \"valid_idle' s\"\n and cts: \"ct_in_state' (\\tcb. \\idle' tcb) s\"\n shows \"ksCurThread s \\ ksIdleThread s\"\nproof\n assume \"ksCurThread s = ksIdleThread s\"\n with vi have \"ct_in_state' idle' s\"\n unfolding ct_in_state'_def valid_idle'_def\n by (clarsimp simp: pred_tcb_at'_def obj_at'_def idle_tcb'_def)\n\n with cts show False\n unfolding ct_in_state'_def\n by (fastforce dest: pred_tcb_at_conj')\nqed\n\nlemma ct_running_not_idle'[simp]:\n \"\\invs' s; ct_running' s\\ \\ ksCurThread s \\ ksIdleThread s\"\n apply (rule ct_not_idle')\n apply (fastforce simp: invs'_def valid_state'_def ct_in_state'_def\n elim: pred_tcb'_weakenE)+\n done\n\nlemma ct_active_not_idle'[simp]:\n \"\\invs' s; ct_active' s\\ \\ ksCurThread s \\ ksIdleThread s\"\n apply (rule ct_not_idle')\n apply (fastforce simp: invs'_def valid_state'_def ct_in_state'_def\n elim: pred_tcb'_weakenE)+\n done\n\nlemma deleteCallerCap_st_tcb_at_runnable[wp]:\n \"\\st_tcb_at' runnable' t\\ deleteCallerCap t' \\\\rv. st_tcb_at' runnable' t\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_tcb_at_runnable' hoare_drop_imps | simp)+\n done\n\ncrunches handleFault, receiveSignal, receiveIPC, asUser\n for ksCurThread[wp]: \"\\s. P (ksCurThread s)\"\n (wp: hoare_drop_imps crunch_wps simp: crunch_simps)\n\nlemma handleRecv_ksCurThread[wp]:\n \"\\\\s. P (ksCurThread s) \\ handleRecv b \\\\rv s. P (ksCurThread s) \\\"\n unfolding handleRecv_def\n by ((simp, wp hoare_drop_imps) | wpc | wpsimp wp: hoare_drop_imps)+\n\nlemma he_invs'[wp]:\n \"\\invs' and\n (\\s. event \\ Interrupt \\ ct_running' s) and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleEvent event\n \\\\rv. invs'\\\"\nproof -\n have nidle: \"\\s. invs' s \\ ct_active' s \\ ksCurThread s \\ ksIdleThread s\"\n by (clarsimp)\n show ?thesis\n apply (case_tac event, simp_all add: handleEvent_def)\n apply (rename_tac syscall)\n apply (case_tac syscall,\n (wp handleReply_sane handleReply_nonz_cap_to_ct handleReply_ksCurThread\n handleReply_ct_not_ksQ\n | clarsimp simp: active_from_running' simple_from_running' simple_sane_strg simp del: split_paired_All\n | rule conjI active_ex_cap'\n | drule ct_not_ksQ[rotated]\n | strengthen nidle)+)\n apply (rule hoare_strengthen_post,\n rule hoare_weaken_pre,\n rule hy_invs')\n apply (simp add: active_from_running')\n apply simp\n apply (wp hv_inv' hh_inv'\n | rule conjI\n | erule pred_tcb'_weakenE st_tcb_ex_cap''\n | clarsimp simp: tcb_at_invs ct_in_state'_def simple_sane_strg sch_act_simple_def\n | drule st_tcb_at_idle_thread'\n | drule ct_not_ksQ[rotated]\n | wpc | wp (once) hoare_drop_imps)+\n done\nqed\n\nlemma inv_irq_IRQInactive:\n \"\\\\\\ performIRQControl irqcontrol_invocation\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: performIRQControl_def)\n apply (rule hoare_pre)\n apply (wpc|wp|simp add: X64_H.performIRQControl_def)+\n done\n\nlemma inv_arch_IRQInactive:\n \"\\\\\\ Arch.performInvocation invocation\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (wpsimp simp: performX64MMUInvocation_def X64_H.performInvocation_def\n performX64PortInvocation_def)\n done\n\nlemma retype_pi_IRQInactive:\n \"\\valid_irq_states'\\ RetypeDecls_H.performInvocation blocking call v\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: Retype_H.performInvocation_def)\n apply (rule hoare_pre)\n apply (wpc |\n wp inv_tcb_IRQInactive inv_cnode_IRQInactive inv_irq_IRQInactive\n inv_untyped_IRQInactive inv_arch_IRQInactive |\n simp)+\n done\n\nlemma hi_IRQInactive:\n \"\\valid_irq_states'\\ handleInvocation call blocking\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleInvocation_def split_def)\n apply (wp syscall_valid' retype_pi_IRQInactive)\n done\n\nlemma handleSend_IRQInactive:\n \"\\invs'\\ handleSend blocking\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleSend_def)\n apply (rule hoare_pre)\n apply (wp hi_IRQInactive)\n apply (simp add: invs'_def valid_state'_def)\n done\n\nlemma handleCall_IRQInactive:\n \"\\invs'\\ handleCall\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleCall_def)\n apply (rule hoare_pre)\n apply (wp hi_IRQInactive)\n apply (simp add: invs'_def valid_state'_def)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/X64/Syscall_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.1716342559763561}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nRetype refinement\n*)\n\ntheory Retype_AI\nimports VSpace_AI\nbegin\n\nabbreviation \"up_aligned_area ptr sz \\ {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)}\"\nabbreviation \"down_aligned_area ptr sz \\ {(ptr && ~~ mask sz) + (2 ^ sz - 1) .. ptr}\"\n\ncontext begin interpretation Arch .\nrequalify_facts\n global_refs_kheap\n valid_vspace_obj_default\nrequalify_consts\n clearMemory\n clearMemoryVM\nend\n\ndeclare global_refs_kheap[simp]\n\n\nlocale Retype_AI_clearMemoryVM =\n assumes clearMemoryVM_return [simp]: \"\\ a b. clearMemoryVM a b = return ()\"\n\ncontext Retype_AI_clearMemoryVM begin\nlemmas clearMemoryVM_return_raw = clearMemoryVM_return[abs_def]\nend\n\n\nlemma default_object_tcbE:\n \"\\ default_object ty dev us = TCB tcb; ty \\ Untyped;\n \\ tcb = default_tcb; ty = Structures_A.TCBObject \\ \\ R \\ \\ R\"\n unfolding default_object_def by (cases ty, auto)\n\n\nlocale Retype_AI_slot_bits =\n assumes slot_bits_def2: \"slot_bits = cte_level_bits\"\n and arch_kobj_size_cong:\n \"\\a a1 c c1. \\a = a1; c=c1\\ \\ arch_kobj_size (default_arch_object a b c)\n = arch_kobj_size (default_arch_object a1 b1 c1)\"\n\n\nlemma (in Retype_AI_slot_bits) obj_bits_cong:\n \"\\a = a1; c=c1\\ \\ obj_bits (default_object a b c)\n = obj_bits (default_object a1 b1 c1)\"\n by (simp add: default_object_def arch_kobj_size_cong\n split: if_splits apiobject_type.splits)\n\nlemma (in Retype_AI_slot_bits) obj_bits_api_default_object:\n \"\\ ty \\ Untyped\\ \\ obj_bits_api ty us = obj_bits (default_object ty dev us)\"\n unfolding obj_bits_api_def default_object_def\n by (cases ty)\n (simp_all add: slot_bits_def2 arch_kobj_size_cong wf_empty_bits)\n\n\nlemma obj_bits_api_default_CapTableObject:\n \"obj_bits (default_object Structures_A.apiobject_type.CapTableObject dev us)\n = cte_level_bits + us\"\n by (simp add: default_object_def wf_empty_bits)\n\n\nlemma empty_cnode_dom:\n \"x \\ dom (empty_cnode n) \\ length x = n\"\n unfolding dom_def empty_cnode_def by (simp split: if_split_asm)\n\n\ncontext Retype_AI_slot_bits begin\n\nlemma obj_bits_api_def2:\n \"obj_bits_api type obj_size_bits =\n (case type of Structures_A.Untyped \\ obj_size_bits\n | _ \\ obj_bits (default_object type False obj_size_bits))\"\n by (simp add: obj_bits_api_def default_object_def\n wf_empty_bits dom_empty_cnode ex_with_length\n slot_bits_def2\n split: apiobject_type.split)\n\nlemma obj_bits_api_def3:\n \"obj_bits_api type obj_size_bits =\n (if type = Structures_A.Untyped then obj_size_bits\n else obj_bits (default_object type False obj_size_bits))\"\n by (simp add: obj_bits_api_def default_object_def\n wf_empty_bits dom_empty_cnode ex_with_length\n slot_bits_def2\n split: apiobject_type.split)\n\nlemma obj_bits_api_def4:\n \"obj_bits_api type obj_size_bits =\n (if type = Structures_A.Untyped then obj_size_bits\n else obj_bits (default_object type True obj_size_bits))\"\n by (simp add: obj_bits_api_def default_object_def arch_kobj_size_cong\n wf_empty_bits dom_empty_cnode ex_with_length\n slot_bits_def2\n split: apiobject_type.split)\n\nlemma obj_bits_dev_irr:\n \"ty \\ Untyped \\ obj_bits (default_object ty dev us) = obj_bits_api ty us\"\n by (simp add: obj_bits_api_def3 cong: obj_bits_cong)\n\nlemma default_obj_range:\n \"ty \\ Untyped \\ obj_range p (default_object ty dev us) = {p..p + 2 ^ (obj_bits_api ty us) - 1}\"\n by (simp add: obj_range_def obj_bits_dev_irr)\nend\n\n\ndefinition\n \"retype_addrs \\ \\(ptr' :: obj_ref) ty n us. map (\\p. ptr_add ptr' (p * 2 ^ obj_bits_api ty us))\n [0..< n]\"\n\n\nlemma retype_addrs_base [simp]:\n \"0 < n \\ x \\ set (retype_addrs x ty n us)\"\n unfolding retype_addrs_def\n apply (simp add: ptr_add_def)\n apply (rule image_eqI [where x = 0])\n apply simp\n apply (simp add: power_sub[symmetric])\n done\n\n\nlemma retype_addrs_aligned:\n assumes xin: \"x \\ set (retype_addrs ptr ty n us)\"\n and al: \"is_aligned ptr (obj_bits_api ty us)\"\n and nv: \"sz < word_bits\"\n and oav: \"obj_bits_api ty us \\ sz\"\n shows \"is_aligned x (obj_bits_api ty us)\"\n using xin unfolding retype_addrs_def ptr_add_def\n apply (clarsimp simp: word_unat_power [symmetric])\n apply (subst mult.commute, subst shiftl_t2n [symmetric])\n apply (rule aligned_add_aligned[OF al is_aligned_shift])\n apply (insert assms)\n apply simp+\n done\n\n\nlemma (in pspace_update_eq) pspace_no_overlap_update [simp]:\n \"pspace_no_overlap S (f s) = pspace_no_overlap S s\"\n by (simp add: pspace_no_overlap_def pspace)\n\n\n\nlemmas machine_word_plus_mono_right_split = word_plus_mono_right_split[where 'a=machine_word_len, folded word_bits_def]\n\n\n(* range_cover locale:\n proves properties when a small range is inside in a large range\n *)\nlocale range_cover =\n fixes ptr :: \"'a :: len word\"\n and sz sbit n\n assumes aligned: \"is_aligned ptr sbit\"\n and sz:\"sz< len_of TYPE('a)\" \"sbit \\ sz\" \"n + unat (ptr && mask sz >> sbit) \\ 2 ^ (sz - sbit)\"\n\n\ncontext range_cover begin\n\nlemma range_cover_compare_bound:\n \"n * 2 ^ sbit + unat (ptr && mask sz) \\ 2 ^ sz\"\nproof -\n have mask_before_neg_mask: \"(ptr && mask sz) && ~~ mask sbit = ptr && mask sz\"\n using aligned sz\n by (simp add:mask_twice is_aligned_mask mask_out_sub_mask min_def)\n show ?thesis using aligned sz\n apply (drule_tac i = \"a +b\" for a b in Nat.mult_le_mono[where k = \"2^sbit\",OF _ le_refl])\n apply (subst (asm) add_mult_distrib)\n apply (clarsimp simp: power_add[symmetric])\n apply (subst (asm) unat_shiftl_absorb[where p = \"sz - sbit\"])\n apply (rule less_imp_le)\n apply (rule shiftr_less_t2n)\n apply (rule less_le_trans)\n apply (rule and_mask_less')\n apply (simp add:word_bits_def)\n apply (rule two_power_increasing)\n apply simp\n apply (simp add:word_bits_def field_simps)\n apply simp\n apply (subst (asm) mult.commute[where b = \"2^sbit\"],\n subst (asm) shiftl_t2n[symmetric])\n apply (subst (asm) and_not_mask[symmetric])\n apply (simp add:mask_before_neg_mask)\n done\nqed\n\n\nlemma range_cover_compare:\n assumes pointer:\"p < n\"\n shows \"unat (ptr && mask sz) + unat (((of_nat p) :: 'a :: len word) * 2 ^ sbit) < 2 ^ sz\"\nproof -\n have mask_before_neg_mask: \"(ptr && mask sz) && ~~ mask sbit = ptr && mask sz\"\n using aligned sz\n by (simp add:mask_twice is_aligned_mask mask_out_sub_mask min_def)\n\n have absolute_compare:\"n * 2 ^ sbit + unat (ptr && mask sz) \\ 2 ^ sz\"\n by (rule range_cover_compare_bound)\n\n have no_overflow_n:\"n * 2^sbit < 2^len_of TYPE('a)\"\n using aligned sz\n apply (clarsimp dest!:add_leD1)\n apply (rule le_less_trans)\n apply (drule Nat.mult_le_mono[where i = n and k = \"2^sbit\",OF _ le_refl])\n apply (clarsimp simp: power_add[symmetric])\n apply (assumption)\n apply clarsimp\n done\n\n have no_overflow_p:\"p * 2^sbit < 2^len_of TYPE('a)\"\n apply (rule le_less_trans[OF _ no_overflow_n])\n apply (simp add:pointer less_imp_le)\n done\n\n show ?thesis\n apply (rule less_le_trans[OF _ absolute_compare])\n apply (subst add.commute)\n apply clarsimp\n apply (case_tac \"p = 0\")\n apply (insert pointer)\n apply (clarsimp simp: range_cover_def pointer)\n apply (simp add:unat_word_ariths)\n apply (rule le_less_trans[OF mod_less_eq_dividend])\n apply (rule less_le_trans[OF mult_less_mono1[where j = n]])\n apply (cut_tac no_overflow_p)\n apply (drule multi_lessD[OF no_overflow_p],simp)\n apply (clarsimp simp:unat_of_nat word_bits_def)\n using sz\n apply (simp add:unat_gt_0 range_cover_def)\n apply (rule mult_le_mono2)\n apply (rule unat_le_helper)\n apply simp\n done\n qed\n\nlemma no_overflow_n:\"n * 2^sbit < 2^len_of TYPE('a)\"\n using aligned sz\n apply (clarsimp dest!:add_leD1)\n apply (rule le_less_trans)\n apply (drule Nat.mult_le_mono[where i = n and k = \"2^sbit\",OF _ le_refl])\n apply (clarsimp simp: power_add[symmetric])\n apply (assumption)\n apply clarsimp\n done\n\nlemma range_cover_n_le:\n \"n \\ 2 ^ (len_of TYPE('a) - sbit)\"\n \"n \\ 2 ^ (sz - sbit)\"\n using aligned sz\n by (auto elim: le_trans[OF add_leD1])\n\n\nlemma range_cover_n_less:\n shows weak: \"n < 2 ^ len_of TYPE('a)\"\n and string: \"n < 2 ^ (len_of TYPE('a) - sbit)\"\nproof -\n show str: \"n < 2 ^ (len_of TYPE('a) - sbit)\"\n using aligned sz\n by (auto intro: le_less_trans range_cover_n_le(2))\n\n show \"n<2^len_of TYPE('a)\"\n using str by (rule less_le_trans) simp\nqed\n\n\nlemma range_cover_le_n_less:\n \"p \\ n \\ p < 2^ len_of TYPE('a)\"\n \"p \\ n \\ p < 2^ (len_of TYPE('a) - sbit)\"\n apply (erule le_less_trans[OF _ range_cover_n_less(1)])\n apply (erule le_less_trans[OF _ range_cover_n_less(2)])\n done\n\n\nlemma unat_of_nat_n :\"unat ((of_nat n):: 'a :: len word) = n\"\n using range_cover_n_less\n by (simp add:unat_of_nat)\n\n\nlemma unat_of_nat_n_shift:\n \"gbits \\ sbit \\ unat (((of_nat n):: 'a :: len word) << gbits) = (n * 2^ gbits)\"\n apply (simp add:shiftl_t2n field_simps)\n apply (subst mult.commute)\n apply (subst unat_mult_power_lem)\n apply (case_tac \"gbits = sbit\")\n apply (rule le_less_trans[OF range_cover_n_le(2)])\n apply clarsimp\n apply (rule diff_less_mono)\n apply (rule sz)\n apply (rule sz)\n apply (rule le_less_trans[OF range_cover_n_le(1)])\n apply clarsimp\n apply (rule diff_less_mono2)\n apply simp\n using sz\n apply simp\n apply simp\n done\n\n\nlemma unat_of_nat_shift:\n \"\\gbits \\ sbit;p\\ n\\ \\ (unat (((of_nat p):: 'a :: len word) * 2 ^ gbits)) = (p * 2^ gbits)\"\n apply (subst mult.commute[where a = \"of_nat p\"])\n apply (subst mult.commute[where a = \"p \"])\n apply (subst unat_mult_power_lem)\n apply (case_tac \"gbits = sbit\")\n apply simp\n apply (erule le_less_trans[OF _ range_cover_le_n_less(2) ])\n apply simp\n apply (erule le_less_trans)\n apply (rule less_le_trans[OF range_cover_n_less(2)])\n apply clarsimp\n apply (erule diff_le_mono2)\n apply (simp add:range_cover_def)+\n done\n\n\nlemma range_cover_base_le:\n \"(ptr && mask sz) \\ (ptr && mask sz) + (of_nat n << sbit)\"\n apply (clarsimp simp:no_olen_add_nat shiftl_t2n unat_of_nat_shift field_simps)\n apply (subst add.commute)\n apply (rule le_less_trans[OF range_cover_compare_bound])\n apply (rule less_le_trans[OF power_strict_increasing])\n using sz\n apply simp+\n done\n\nend\n\n\nlemma range_cover_subset:\n fixes ptr :: \"'a :: len word\"\n assumes cover: \"range_cover ptr sz sbit n\"\n assumes pointer: \"p 0\"\n shows \"{ptr + of_nat p * 2^sbit .. ptr + of_nat p * 2 ^ sbit + 2 ^ sbit - 1} \\ {ptr .. ptr + of_nat n * 2 ^ sbit - 1}\"\n apply clarsimp\n apply (intro conjI)\n apply (rule word_plus_mono_right_split[OF range_cover.range_cover_compare[OF cover pointer]])\n using cover\n apply (simp add:range_cover_def)\n proof -\n note n_less = range_cover.range_cover_n_less[OF cover]\n have unat_of_nat_m1: \"unat (of_nat n - (1 :: 'a :: len word)) < n\"\n using not_0 n_less\n by (simp add:unat_of_nat_minus_1)\n have decomp:\"of_nat n * 2 ^ sbit = of_nat (n - 1) * 2 ^ sbit + (2 :: 'a :: len word) ^ sbit\"\n apply (simp add:distrib_right[where b = \"1::'a word\",simplified,symmetric])\n using not_0 n_less\n apply (simp add:unat_of_nat_minus_1)\n done\n show \"ptr + of_nat p * 2 ^ sbit + 2 ^ sbit - 1 \\ ptr + of_nat n * 2 ^ sbit - 1\"\n using cover\n apply (subst decomp)\n apply (simp add:add.assoc[symmetric])\n apply (simp add:p_assoc_help)\n apply (rule order_trans[OF word_plus_mono_left word_plus_mono_right])\n apply (rule word_plus_mono_right)\n apply (rule word_mult_le_mono1[OF word_of_nat_le])\n apply (insert n_less not_0 pointer)\n apply (simp add:unat_of_nat_minus_1)\n apply (rule p2_gt_0[THEN iffD2])\n apply (simp add:word_bits_def range_cover_def)\n apply (simp only: word_bits_def[symmetric] unat_power_lower range_cover_def)\n apply (clarsimp simp: unat_of_nat_minus_1 )\n apply (rule nat_less_power_trans2[OF range_cover.range_cover_le_n_less(2),OF cover])\n apply (simp add:unat_of_nat_m1 less_imp_le)\n apply (simp add:range_cover_def)\n apply (rule word_plus_mono_right_split[where sz = sz])\n using range_cover.range_cover_compare[OF cover,where p = \"unat (of_nat n - (1 :: 'a :: len word))\"]\n apply (clarsimp simp:unat_of_nat_m1)\n apply (simp add:range_cover_def)\n apply (rule olen_add_eqv[THEN iffD2])\n apply (subst add.commute[where a = \"2^sbit - 1\"])\n apply (subst p_assoc_help[symmetric])\n apply (rule is_aligned_no_overflow)\n apply (insert cover)\n apply (clarsimp simp:range_cover_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_mult_triv2])\n apply (simp add:range_cover_def)+\n using is_aligned_add is_aligned_mult_triv2 is_aligned_no_overflow'\n by blast\n qed\n\nlemma range_cover_rel:\n assumes cover: \"range_cover ptr sz sbit n\"\n assumes le:\"sbit' \\ sbit\"\n assumes num_r: \"m = 2 ^ (sbit - sbit') * n\"\n shows \"range_cover ptr sz sbit' m\"\n using cover\n apply (clarsimp simp:num_r range_cover_def)\n apply (intro conjI)\n apply (erule is_aligned_weaken[OF _ le])\n apply (erule le_trans[OF le])\n apply (drule is_aligned_weaken[OF _ le])+\n apply (drule mult_le_mono2[where j = \"2^(sz-sbit)\" and k = \"2^(sbit-sbit')\"])\n apply (subst (asm) power_add[symmetric])\n apply (clarsimp simp:field_simps le)\n apply (erule le_trans[rotated])\n apply clarsimp\n apply (rule unat_le_helper)\n apply clarsimp\n apply (insert le)\n apply (fold shiftl_t2n)\n apply (simp add: shiftr_shiftl1)\n apply (rule eq_refl[OF is_aligned_neg_mask_eq[symmetric]])\n apply (rule is_aligned_shiftr[OF is_aligned_weaken])\n apply (rule aligned_already_mask[where n = \"sbit\"])\n apply (insert cover)\n apply (simp add:range_cover_def)\n apply simp\ndone\n\n\nlemma retype_addrs_subset_ptr_bits:\n assumes cover: \"range_cover ptr sz (obj_bits_api ty us) n\"\n shows \"set (retype_addrs ptr ty n us) \\ {ptr .. (ptr &&~~ mask sz) + (2 ^ sz - 1)}\"\n apply (clarsimp simp:retype_addrs_def ptr_add_def)\n apply (intro conjI)\n apply (rule word_plus_mono_right_split)\n apply (erule range_cover.range_cover_compare[OF cover])\n using cover\n apply (simp add:range_cover_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (insert cover)\n apply (drule(1) range_cover.range_cover_compare)\n apply (rule iffD1[OF le_m1_iff_lt,THEN iffD2])\n using cover\n apply (simp add: p2_gt_0 range_cover_def word_bits_def)\n apply (rule iffD2[OF word_less_nat_alt])\n apply (rule le_less_trans[OF unat_plus_gt])\n using cover\n apply (clarsimp simp: range_cover_def)\n apply (insert cover)\n apply (rule is_aligned_no_wrap'[where sz=sz])\n apply (simp add: range_cover_def)+\ndone\n\n\nlemma pspace_no_overlapE:\n \"\\ pspace_no_overlap S s; kheap s x = Some ko;\n {x..x + (2 ^ obj_bits ko - 1)} \\ S = {} \\ R\\ \\ R\"\n unfolding pspace_no_overlap_def by auto\n\n\nlemma base_member_set:\n fixes x :: \"'a :: len word\"\n assumes al: \"is_aligned x sz\"\n and szv: \"sz < len_of TYPE('a)\"\n shows \"x \\ {x .. x + (2 ^ sz - 1)}\"\nproof (simp, rule is_aligned_no_wrap')\n show \"(2 :: 'a :: len word) ^ sz - 1 < 2 ^ sz\" using szv\n by (simp add: word_less_nat_alt word_neq_0_conv unat_minus_one)\nqed fact+\n\nabbreviation(input)\n \"pspace_no_overlap_range_cover ptr bits\n \\ pspace_no_overlap {ptr .. (ptr && ~~ mask bits) + (2 ^ bits - 1)}\"\n\nlemma pspace_no_overlap_into_Int_none:\n assumes ps: \"pspace_no_overlap_range_cover ptr sz s\"\n and vp: \"valid_pspace s\"\n and cover: \"range_cover ptr sz (obj_bits_api ty us) n\"\n shows \"set (retype_addrs ptr ty n us) \\ dom (kheap s) = {}\"\nproof -\n {\n fix x ko\n assume ps': \"kheap s x = Some ko\"\n have \"x \\ {ptr .. (ptr && ~~ mask sz) + (2 ^ sz - 1)}\"\n proof (rule orthD1)\n show \"x \\ {x .. x + (2 ^ obj_bits ko - 1)}\"\n proof (rule base_member_set)\n from vp show \"is_aligned x (obj_bits ko)\" using ps'\n by (auto elim!: valid_pspaceE)\n show \"obj_bits ko < len_of TYPE(machine_word_len)\"\n by (rule valid_pspace_obj_sizes [OF _ ranI, unfolded word_bits_def]) fact+\n qed\n\n show \"{x..x + (2 ^ obj_bits ko - 1)} \\ {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} = {}\" using ps\n by (rule pspace_no_overlapE) fact+\n qed\n\n hence \"x \\ set (retype_addrs ptr ty n us)\"\n using assms subsetD[OF retype_addrs_subset_ptr_bits[OF cover]]\n by auto\n }\n thus ?thesis by auto\nqed\n\n\nlemma pspace_no_overlapD1:\n \"\\ pspace_no_overlap_range_cover ptr sz s; kheap s x = Some ko;\n range_cover ptr sz (obj_bits_api ty us) n;\n valid_pspace s\\ \\\n x \\ set (retype_addrs ptr ty n us)\"\n apply (drule(2) pspace_no_overlap_into_Int_none)\n apply (simp add:range_cover_def)\n apply (erule orthD2)\n apply (erule domI)\n done\n\n\nlemma pspace_no_overlapD2:\n \"\\ pspace_no_overlap_range_cover ptr sz s; x \\ set (retype_addrs ptr ty n us);\n range_cover ptr sz (obj_bits_api ty us) n;\n valid_pspace s \\ \\ x \\ dom (kheap s)\"\n apply (drule(2) pspace_no_overlap_into_Int_none)\n apply (simp add:range_cover_def)\n apply (erule(1) orthD1)\ndone\n\n\nlemma pspace_no_overlapC:\n \"\\ pspace_no_overlap_range_cover ptr sz s; x \\ set (retype_addrs ptr ty n us); kheap s x = Some ko;\n range_cover ptr sz (obj_bits_api ty us) n;valid_pspace s \\ \\ P\"\n by (auto dest: pspace_no_overlapD1)\n\n\nlemma null_filterE:\n \"\\ null_filter cps x = Some cap;\n \\ cps x = Some cap; cap \\ cap.NullCap \\ \\ R \\\n \\ R\"\n by (simp add: null_filter_def split: if_split_asm)\n\n\nlemma across_null_filter_eq:\n assumes eq: \"null_filter xs = null_filter ys\"\n shows \"\\ xs x = Some v; ys x = Some v \\ R;\n \\ v = cap.NullCap; ys x = None \\ \\ R \\\n \\ R\"\n apply (cases \"null_filter xs x\")\n apply (subgoal_tac \"null_filter ys x = None\")\n apply (simp add: null_filter_def split: if_split_asm)\n apply (simp add: eq)\n apply (subgoal_tac \"null_filter ys x = Some a\")\n apply (simp add: null_filter_def split: if_split_asm)\n apply (simp add: eq)\n done\n\n\nlemma mdb_cte_at_no_descendants:\n \"\\ mdb_cte_at f m; \\ f x \\ \\ descendants_of x m = {}\"\n apply (clarsimp simp add: descendants_of_def)\n apply (erule tranclE2)\n apply (simp add: cdt_parent_of_def)\n apply (drule(1) mdb_cte_atD)\n apply simp\n apply (simp add: cdt_parent_of_def)\n apply (drule(1) mdb_cte_atD)\n apply simp\n done\n\n\nlemma caps_of_state_foldr:\n assumes tyun: \"ty \\ Untyped\"\n fixes s sz ptr us addrs dev\n defines \"s' \\ (s\\kheap := foldr (\\p ps. ps(p \\ default_object ty dev us))\n addrs (kheap s)\\)\"\n shows\n \"caps_of_state s' =\n (\\(oref,cref). if oref \\ set addrs\n then (case ty of Structures_A.CapTableObject \\ empty_cnode us\n | Structures_A.TCBObject \\ option_map (\\x. cap.NullCap) \\ tcb_cap_cases\n | _ \\ Map.empty) cref\n else caps_of_state s (oref,cref))\"\n apply (rule ext)+\n apply (case_tac x)\n apply (rename_tac oref cref)\n apply (simp add: caps_of_state_cte_wp_at split del: if_split)\n apply (case_tac \"\\cap. cte_wp_at ((=) cap) (oref, cref) s'\")\n apply clarsimp\n apply (simp add: s'_def cte_wp_at_cases)\n apply (erule disjE)\n apply (clarsimp simp add: foldr_upd_app_if default_object_def caps_of_state_cte_wp_at\n cte_wp_at_cases tyun empty_cnode_def\n split: if_split_asm Structures_A.apiobject_type.splits)\n apply (clarsimp simp add: foldr_upd_app_if default_object_def caps_of_state_cte_wp_at\n cte_wp_at_cases tyun empty_cnode_def default_tcb_def\n split: if_split_asm Structures_A.apiobject_type.splits)\n apply (clarsimp simp: tcb_cap_cases_def split: if_split_asm)\n apply simp\n apply (simp add: cte_wp_at_cases s'_def foldr_upd_app_if)\n apply (rule conjI)\n apply (clarsimp simp: default_object_def wf_empty_bits\n split: Structures_A.apiobject_type.split_asm)\n apply (fastforce simp: tcb_cap_cases_def split: if_split_asm)\n apply clarsimp\n apply (simp add: caps_of_state_cte_wp_at)\n apply (simp add: cte_wp_at_cases)\n done\n\n\nlemma null_filter_caps_of_state_foldr:\n fixes s sz ptr us addrs dev\n assumes tyun: \"ty \\ Untyped\"\n and nondom: \"\\x \\ set addrs. x \\ dom (kheap s)\"\n defines \"s' \\ (s\\kheap := foldr (\\p ps. ps(p \\ default_object ty dev us))\n addrs (kheap s)\\)\"\n shows\n \"null_filter (caps_of_state s') =\n null_filter (caps_of_state s)\"\n unfolding s'_def\n apply (subst caps_of_state_foldr[OF tyun])\n apply (rule ext)\n apply (clarsimp simp add: null_filter_def split_def empty_cnode_def\n split: Structures_A.apiobject_type.splits)\n apply (subgoal_tac \"a \\ set addrs \\ caps_of_state s (a, b) \\ Some cap.NullCap\n \\ None = caps_of_state s (a, b)\", simp)\n apply clarsimp\n apply (subgoal_tac \"tcb_cap_cases b = None\", simp)\n apply (rule ccontr, clarsimp)\n apply clarsimp\n apply (rule sym, rule ccontr, clarsimp)\n apply (drule bspec[OF nondom])\n apply (drule caps_of_state_cteD)\n apply (erule cte_wp_atE, fastforce+)\n done\n\n\nlemma retype_addrs_fold:\n \" map (\\p. ptr_add ptr' (p * 2 ^ obj_bits_api ty us)) [0..< n ]\n = retype_addrs ptr' ty n us\"\n by (simp add: retype_addrs_def power_sub)\n\n\nlemma mult_div_rearrange:\n \"(b::nat) \\ a \\ (2::nat) ^ a * (p div 2 ^ b) =\n 2 ^ (a - b) * (2 ^ b * (p div 2 ^ b))\"\n by (auto simp:field_simps power_add[symmetric])\n\n\nlemma shiftr_mask_cmp:\n \"\\c \\ n; n \\ len_of TYPE('a)\\\n \\ ((a::('a::len) word) \\ mask n) = ((a >> c) \\ mask (n - c))\"\n apply (rule iffI)\n apply (drule le_shiftr[where n = c])\n apply (simp add:mask_2pm1[symmetric] shiftr_mask2)+\n apply (simp add:le_mask_iff shiftr_shiftr)\ndone\n\n\nlocale Retype_AI_no_gs_types =\n fixes no_gs_types :: \"apiobject_type set\"\n assumes no_gs_types_simps [simp]:\n \"Untyped \\ no_gs_types\"\n \"TCBObject \\ no_gs_types\"\n \"EndpointObject \\ no_gs_types\"\n \"NotificationObject \\ no_gs_types\"\n\n\nlemma measure_unat': \"p \\ 0 \\ unat (p - 1) \\ unat p - 1\"\n apply (insert measure_unat[where p = p])\n apply simp\ndone\n\n\n(* FIXME: move *)\nlemma range_cover_not_zero:\n \"\\n \\ 0; range_cover (ptr :: 'a :: len word) sz bits n\\ \\ ((of_nat n) :: 'a :: len word) \\ 0\"\n apply (rule of_nat_neq_0)\n apply simp\n apply (drule range_cover.range_cover_n_less)\n apply simp\n done\n\n\nlemma range_cover_not_zero_shift:\n \"\\n \\ 0; range_cover (ptr :: 'a :: len word) sz bits n; gbits \\ bits\\\n \\ ((of_nat n) :: 'a :: len word) << gbits \\ 0\"\n apply (rule word_shift_nonzero[where m = \"sz-gbits\"])\n prefer 2\n apply (clarsimp simp:range_cover_def)\n apply (clarsimp simp:word_le_nat_alt)\n apply (subst unat_power_lower)\n apply (rule less_le_trans[OF diff_less_Suc])\n apply (simp add:range_cover_def)\n apply (simp add:range_cover.unat_of_nat_n)\n apply (erule le_trans[OF range_cover.range_cover_n_le(2)])\n apply (rule power_increasing)\n apply simp+\n using range_cover_not_zero\n apply auto\n done\n\n\nlemma mult_plus_1: \"(a::nat) + b * a = a * (b + 1)\" by simp\n\n\nlemma range_cover_cell_subset:\n \"\\range_cover ptr sz us n;x < of_nat n\\\n \\ {ptr + x * 2 ^ us..ptr + x * 2 ^ us + 2 ^ us - 1} \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n proof -\n assume cover:\"range_cover ptr sz us n\"\n and cmp:\"x> us)) = ptr && mask sz\"\n apply (subst shiftl_t2n[symmetric])\n apply (subst and_not_mask[symmetric])\n apply (rule is_aligned_neg_mask_eq)\n using cover\n apply (simp add:is_aligned_mask mask_twice range_cover_def min_def)\n done\n show ?thesis\n using cover cmp\n apply clarsimp\n apply (intro conjI)\n apply (rule word_plus_mono_right_split)\n apply (drule range_cover.range_cover_compare[where p = \"unat x\"])\n apply (erule unat_less_helper)\n apply (simp add: range_cover.unat_of_nat_shift[where gbits = us])\n apply (simp add:range_cover_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (simp add:p_assoc_help)\n apply (subst add.assoc)+\n apply (rule word_plus_mono_right)\n apply (cut_tac nasty_split_lt[where x=\"((ptr && mask sz) >> us) + x\" and n=us and m=sz])\n apply (simp add: sh field_simps)\n apply (clarsimp simp:range_cover_def word_less_nat_alt)\n apply (rule le_less_trans[OF unat_plus_gt])\n apply (erule less_le_trans[rotated])\n apply (clarsimp simp:range_cover.unat_of_nat_n[OF cover])\n apply (simp add:range_cover_def p_assoc_help[symmetric])+\n apply (simp add: is_aligned_no_overflow)\n done\n qed\n\nlemma is_aligned_ptr_add_helper:\n \"\\ is_aligned ptr d; d < word_bits; c \\ d; c \\ a + b;\n a + b < word_bits \\ \\ is_aligned (ptr_add ptr (x * 2 ^ a * 2 ^ b)) c\"\n apply (simp add: ptr_add_def)\n apply (erule aligned_add_aligned)\n apply (rule is_aligned_weaken)\n apply (simp add: field_simps\n power_add[symmetric])\n apply (rule is_aligned_mult_triv2)\n apply assumption+\n done\n\n\nlemma range_cover_no_0:\n \"\\ ptr \\ 0; range_cover (ptr :: 'a :: len word) sz sbit n;p < n\\ \\\n ptr + of_nat p * 2 ^ sbit \\ 0\"\n apply (subst word_plus_and_or_coroll2[symmetric, where w = \"mask sz\"])\n apply (case_tac \"(ptr && ~~ mask sz) \\ 0\")\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule aligned_offset_non_zero)\n apply (rule is_aligned_neg_mask[OF le_refl])\n apply (simp add:word_less_nat_alt)\n apply (rule le_less_trans[OF unat_plus_gt])\n apply (rule less_le_trans[OF range_cover.range_cover_compare])\n apply simp\n apply ((simp add:range_cover_def)+)[3]\n apply (subgoal_tac \"(ptr && mask sz) \\ 0\")\n apply (rule unat_gt_0[THEN iffD1])\n apply (simp add:not_less)\n apply (subst iffD1[OF unat_add_lem])\n apply (rule less_le_trans[OF range_cover.range_cover_compare])\n apply simp+\n apply (simp add:range_cover_def word_bits_def)\n apply simp\n apply (rule disjI1)\n apply unat_arith\n apply (rule ccontr)\n apply (subst (asm) word_plus_and_or_coroll2[symmetric,where w = \"mask sz\" and t = ptr])\n apply (clarsimp simp:not_less)\ndone\n\n\nlemma range_cover_mem:\n \"\\x < n; range_cover ptr sz us n\\\n \\ ptr + (of_nat x) * 2 ^ us \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n apply (clarsimp)\n apply (intro conjI)\n apply (rule word_plus_mono_right_split[where sz = sz])\n apply (erule range_cover.range_cover_compare)\n apply ((simp add:range_cover_def)+)[2]\n apply (subst p_assoc_help)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (simp add:word_le_nat_alt)\n apply (rule le_trans[OF unat_plus_gt])\n apply (subst unat_minus_one[OF power_not_zero])\n apply (simp add:range_cover_def)\n apply (frule(1) range_cover.range_cover_compare)\n apply (clarsimp simp:range_cover_def le_m1_iff_lt power_not_zero nat_le_Suc_less_imp)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def)\n done\n\n\nlemma range_cover_mem':\n \"\\x < of_nat n; range_cover ptr sz us n\\\n \\ ptr + x * 2 ^ us \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n apply (drule range_cover_mem[where x = \"unat x\",rotated])\n apply (erule unat_less_helper)\n apply auto\n done\n\n\nlemma range_cover_subset_not_empty:\n \"\\x < of_nat n; range_cover ptr sz us n\\\n \\ {ptr + x * 2 ^ us..ptr + x * 2 ^ us + 2 ^ us - 1} \\ {}\"\n apply (clarsimp simp:p_assoc_help)\n apply (rule is_aligned_no_overflow')\n apply (rule is_aligned_add_multI)\n apply (fastforce simp:range_cover_def)+\n done\n\ncrunch global_refs[wp]: retype_region \"\\s. P (global_refs s)\"\n (simp: crunch_simps)\n\nlocale Retype_AI_retype_region_ret =\n fixes state_ext_t :: \"'state_ext :: state_ext itself\"\n assumes retype_region_ret_folded:\n \"\\ y n bits ty dev.\n \\\\\\ retype_region y n bits ty dev\n \\\\r (s :: 'state_ext state). r = retype_addrs y ty n bits\\\"\n\n\ncontext Retype_AI_retype_region_ret begin\n\nlemmas retype_region_ret = retype_region_ret_folded[unfolded retype_addrs_def]\n\nlemma retype_region_global_refs_disjoint:\n \"\\(\\s::'state_ext state. {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ global_refs s = {})\n and K (range_cover ptr sz (obj_bits_api apiobject_type obits) n)\\\n retype_region ptr n obits apiobject_type dev\n \\\\r s. global_refs s \\ set r = {}\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_lift_Pf3[where f=global_refs])\n apply (rule hoare_assume_pre)\n apply (clarsimp simp: Int_commute)\n apply (rule hoare_chain) apply(rule retype_region_ret)\n apply simp\n apply (erule disjoint_subset2[rotated])\n apply (rule subsetI, simp only: mask_in_range[symmetric])\n apply (clarsimp simp: ptr_add_def)\n apply (intro conjI)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n apply (erule(1) range_cover.range_cover_compare)\n apply (simp add:range_cover_def word_bits_def)\n apply (subst p_assoc_help)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (simp add:word_le_nat_alt)\n apply (rule le_trans[OF unat_plus_gt])\n apply (subst unat_minus_one[OF power_not_zero])\n apply (simp add:range_cover_def)\n apply (frule(1) range_cover.range_cover_compare)\n apply (clarsimp simp:range_cover_def le_m1_iff_lt power_not_zero nat_le_Suc_less_imp)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def)\n apply wp\ndone\n\nend\n\ncrunch valid_pspace: do_machine_op \"valid_pspace\"\n\n\nlemma do_machine_op_return_foo:\n \"do_machine_op (do x\\a;return () od) = (do (do_machine_op a); return () od)\"\n apply (clarsimp simp:do_machine_op_def bind_def' gets_def\n get_def return_def select_f_def split_def simpler_modify_def)\n apply (rule ext)+\n apply (clarsimp simp:image_def)\n apply (rule set_eqI)\n apply clarsimp\n apply blast\n done\n\nabbreviation(input)\n \"all_invs_but_equal_kernel_mappings_restricted S\n \\ (\\s. equal_kernel_mappings (s \\ kheap := restrict_map (kheap s) (- S) \\))\n and valid_pspace and valid_mdb and valid_idle and only_idle\n and if_unsafe_then_cap and valid_reply_caps\n and valid_reply_masters and valid_global_refs and valid_arch_state\n and valid_irq_node and valid_irq_handlers and valid_vspace_objs\n and valid_irq_states and valid_global_objs\n and valid_arch_caps and valid_kernel_mappings\n and valid_asid_map and valid_global_vspace_mappings\n and pspace_in_kernel_window and cap_refs_in_kernel_window\n and pspace_respects_device_region and cap_refs_respects_device_region\n and cur_tcb and valid_ioc and valid_machine_state and valid_ioports\"\n\n\nlemma all_invs_but_equal_kernel_mappings_restricted_eq:\n \"all_invs_but_equal_kernel_mappings_restricted {}\n = invs\"\n by (rule ext, simp add: invs_def valid_state_def conj_comms restrict_map_def)\n\n\nlocale Retype_AI_dmo_eq_kernel_restricted =\n fixes\n state_ext_t :: \"'state_ext::state_ext itself\" and\n machine_op_t :: \"'machine_op_t itself\"\n assumes dmo_eq_kernel_restricted[wp]:\n \"\\ f m.\n \\\\s::'state_ext state. equal_kernel_mappings (kheap_update (f (kheap s)) s)\\\n do_machine_op m :: ('state_ext state, 'machine_op_t) nondet_monad\n \\\\rv s. equal_kernel_mappings (kheap_update (f (kheap s)) s)\\\"\n\n\ncrunch only_idle[wp]: do_machine_op \"only_idle\"\ncrunch valid_global_refs[wp]: do_machine_op \"valid_global_refs\"\ncrunch cap_refs_in_kernel_window[wp]: do_machine_op \"cap_refs_in_kernel_window\"\n\n\nlocale Retype_AI_post_retype_invs =\n fixes state_ext_t :: \"'state_ext::state_ext itself\"\n and post_retype_invs_check :: \"apiobject_type \\ bool\"\n and post_retype_invs :: \"apiobject_type \\ machine_word list \\ 'state_ext state \\ bool\"\n assumes post_retype_invs_def':\n \"post_retype_invs tp refs \\\n if post_retype_invs_check tp\n then all_invs_but_equal_kernel_mappings_restricted (set refs)\n else invs\"\n\nlemma (in Retype_AI_retype_region_ret) retype_region_aligned_for_init[wp]:\n \"\\\\s::'state_ext state. range_cover ptr sz (obj_bits_api new_type obj_sz) n\\\n retype_region ptr n obj_sz new_type dev\n \\\\rv s. \\ref \\ set rv. is_aligned ref (obj_bits_api new_type obj_sz)\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_chain, rule retype_region_ret)\n apply simp\n apply (clarsimp simp: ptr_add_def\n dest!: less_two_pow_divD)\n apply (rule aligned_add_aligned)\n apply (fastforce simp:range_cover_def)\n apply (subst mult.commute, subst shiftl_t2n[symmetric],\n rule is_aligned_shiftl)\n apply simp\n apply (simp add:range_cover_def)+\n done\n\n\nlemma honestly_16_10:\n \"is_aligned (p :: word32) 10 \\ p + 16 \\ {p .. p + 1023}\"\n apply simp\n apply (intro conjI is_aligned_no_wrap' word_plus_mono_right,\n (assumption | simp add: word_bits_def)+)\n done\n\n\ndefinition\n caps_no_overlap :: \"machine_word \\ nat \\ 'z::state_ext state \\ bool\"\nwhere\n \"caps_no_overlap ptr sz s \\ \\cap \\ ran (caps_of_state s).\n untyped_range cap \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untyped_range cap\"\n\ndefinition caps_overlap_reserved :: \"machine_word set \\ ('z::state_ext) state \\ bool\"\nwhere\n \"caps_overlap_reserved S (s :: ('z::state_ext) state) \\ \\cap \\ ran (caps_of_state s).\n (is_untyped_cap cap \\ usable_untyped_range cap \\ S = {})\"\n\n\n\nlemma of_nat_2: \"((of_nat (2::nat))::word32) = 2\" by simp\n\n\nlemma subset_le_imp_less: \"\\ A \\ B \\ \\ A \\ B\" by auto\n\n\nlemma non_disjoing_subset: \"\\A \\ B; A \\ C \\ {}\\ \\ B \\ C \\ {}\" by blast\n\n\nlemma pspace_no_overlap_same_type:\n \"\\pspace_no_overlap S s; ko_at k p s; a_type ko = a_type k\\\n \\ pspace_no_overlap S (kheap_update (\\_. (kheap s(p \\ ko))) s)\"\n unfolding pspace_no_overlap_def\n by (clarsimp simp: obj_at_def obj_bits_T)\n\n\nlemma set_object_no_overlap:\n \"\\pspace_no_overlap S and obj_at (\\k. a_type ko = a_type k) p\\\n set_object p ko \\\\r. pspace_no_overlap S\\\"\n unfolding set_object_def get_object_def\n apply simp\n apply wp\n apply (clarsimp simp del: fun_upd_apply)\n apply (drule obj_at_ko_atD, erule exE)\n apply (rule pspace_no_overlap_same_type)\n apply auto\n done\n\nlemma set_cap_no_overlap:\n \"\\pspace_no_overlap S\\ set_cap cap cte \\\\r. pspace_no_overlap S\\\"\n unfolding set_cap_def\n by (wpsimp wp: set_object_no_overlap get_object_wp\n simp: split_beta obj_at_def a_type_def wf_cs_upd [unfolded fun_upd_def])\n\ndefinition\n if_unsafe_then_cap2 :: \"(cslot_ptr \\ cap) \\ (irq \\ obj_ref) \\ bool\"\nwhere\n \"if_unsafe_then_cap2 f x \\ \\cref. (f cref \\ None \\ (the (f cref)) \\ cap.NullCap)\n \\ (\\cref'. f cref' \\ None \\ cref \\ cte_refs (the (f cref')) x\n \\ appropriate_cte_cap (the (f cref)) (the (f cref')))\"\n\n\nlemma null_filter_same:\n \"cps p \\ Some cap.NullCap \\ null_filter cps p = cps p\"\n by (simp add: null_filter_def)\n\n\nlemma cte_wp_at_not_Null:\n \"cte_wp_at (\\cp. cp \\ cap.NullCap) p s \\ caps_of_state s p \\ Some cap.NullCap\"\n by (clarsimp simp: cte_wp_at_caps_of_state)\n\n\nlemma unsafe_rep2:\n \"if_unsafe_then_cap =\n (\\s. if_unsafe_then_cap2 (null_filter (caps_of_state s)) (interrupt_irq_node s))\"\n apply (simp only: if_unsafe_then_cap2_def o_def)\n apply (subst P_null_filter_caps_of_cte_wp_at, simp)+\n apply (simp add: null_filter_same [where cps=\"caps_of_state s\" for s, OF cte_wp_at_not_Null])\n apply (fastforce simp: if_unsafe_then_cap2_def cte_wp_at_caps_of_state\n if_unsafe_then_cap_def ex_cte_cap_wp_to_def)\n done\n\n\nlemma descendants_inc_null_filter:\n \"\\mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s)\\\n \\ descendants_inc (cdt s) (null_filter (caps_of_state s)) =\n descendants_inc (cdt s) (caps_of_state s)\"\n apply (simp add:descendants_inc_def descendants_of_def del:split_paired_All)\n apply (intro iffI allI impI)\n apply (drule spec)+\n apply (erule(1) impE)\n apply (frule tranclD)\n apply (drule tranclD2)\n apply (simp add:cdt_parent_rel_def is_cdt_parent_def del:split_paired_All)\n apply (elim conjE exE)\n apply (drule(1) mdb_cte_atD)+\n apply (simp add:swp_def cte_wp_at_caps_of_state null_filter_def del:split_paired_All)\n apply (elim conjE exE)\n apply simp\n apply (drule spec)+\n apply (erule(1) impE)\n apply (frule tranclD)\n apply (drule tranclD2)\n apply (simp add:cdt_parent_rel_def is_cdt_parent_def del:split_paired_All)\n apply (elim conjE exE)\n apply (drule(1) mdb_cte_atD)+\n apply (simp add:swp_def cte_wp_at_caps_of_state null_filter_def del:split_paired_All)\n apply (elim conjE exE)\n apply simp\n done\n\n\ndefinition\n valid_mdb2\n :: \"[cslot_ptr \\ cap, cslot_ptr \\ cslot_ptr, cslot_ptr \\ bool] \\ bool\"\nwhere\n \"valid_mdb2 cps m r \\\n (\\p p'. m p' = Some p \\ {cps p, cps p'} \\ {None, Some cap.NullCap} = {})\n \\ (\\p p' c c'. cps p = Some c \\ is_untyped_cap c \\ cps p' = Some c'\n \\ obj_refs c' \\ untyped_range c \\ {} \\ p' \\ descendants_of p m)\n \\ descendants_inc m cps\n \\ (\\p. \\ m \\ p \\ p) \\ untyped_inc m cps \\ ut_revocable r cps\n \\ irq_revocable r cps \\ reply_master_revocable r cps \\ reply_mdb m cps \\ valid_arch_mdb r cps\"\n\n\nlemma conj_cong2: \"\\P = P'; P \\ Q = Q'\\ \\ (P \\ Q) = (P' \\ Q')\" by auto\n\nlemma valid_mdb_rep2:\n \"valid_mdb = (\\s. valid_mdb2 (null_filter (caps_of_state s)) (cdt s) (is_original_cap s))\"\n apply (simp add: valid_mdb_def valid_mdb2_def\n untyped_mdb_def no_mloop_def untyped_inc_def)\n apply (rule ext)\n apply (rule conj_cong2)\n apply (simp add: mdb_cte_at_def)\n apply (rule arg_cong[where f=All, OF ext])+\n apply ((clarsimp simp: cte_wp_at_caps_of_state null_filter_def\n | rule conjI iffI\n | drule iffD1 [OF not_None_eq, OF not_sym])+)[1]\n apply (rule conj_cong)\n apply (rule arg_cong[where f=All, OF ext])+\n apply (clarsimp simp: null_filter_def)\n apply (rule conj_cong)\n apply (simp add:descendants_inc_null_filter)\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (rule refl)\n apply (rule arg_cong2 [where f=\"(\\)\"])\n prefer 2\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (simp add: ut_revocable_def null_filter_def del: split_paired_All)\n apply (auto simp: is_cap_simps)[1]\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (simp add: irq_revocable_def null_filter_def del: split_paired_All)\n apply auto[1]\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (simp add: reply_master_revocable_def null_filter_def del: split_paired_All)\n apply (auto simp: is_cap_simps)[1]\n apply (simp add: reply_mdb_def null_filter_def)\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (simp add: reply_caps_mdb_def\n del: split_paired_Ex split_paired_All)\n apply (fastforce elim!: allEI exEI\n simp del: split_paired_Ex split_paired_All)\n apply (rule arg_cong2 [where f=\"(\\)\"])\n apply (fastforce simp: reply_masters_mdb_def elim!: allEI\n simp del: split_paired_All split: if_split_asm)\n apply (fastforce simp: valid_arch_mdb_null_filter[simplified null_filter_def])\n apply (rule arg_cong[where f=All, OF ext])+\n apply ((clarsimp simp: cte_wp_at_caps_of_state null_filter_def\n | rule conjI iffI\n | drule iffD1 [OF not_None_eq, OF not_sym])+)[1]\n done\n\n\nlemma valid_mdb_rep3:\n \"valid_mdb = (\\s. \\m r. cdt s = m \\ is_original_cap s = r \\ valid_mdb2 (null_filter (caps_of_state s)) m r)\"\n by (simp add: valid_mdb_rep2)\n\n\nlemma retype_region_mdb[wp]:\n \"\\\\s. P (cdt s)\\ retype_region ptr n us ty dev \\\\rv s. P (cdt s)\\\"\n apply (simp add: retype_region_def split del: if_split cong: if_cong)\n apply (wp|clarsimp)+\n done\n\n\nlemma retype_region_revokable[wp]:\n \"\\\\s. P (is_original_cap s)\\ retype_region ptr n us ty dev \\\\rv s. P (is_original_cap s)\\\"\n apply (simp add: retype_region_def split del: if_split cong: if_cong)\n apply (wp|clarsimp)+\n done\n\n\nlemma pspace_no_overlap_obj_not_in_range:\n \"\\ pspace_no_overlap S s; obj_at P ptr' s;\n pspace_aligned s; valid_objs s \\\n \\ ptr' \\ S\"\n apply (clarsimp simp add: pspace_no_overlap_def obj_at_def)\n apply (elim allE, drule(1) mp)\n apply (simp add: field_simps)\n apply (drule_tac x=ptr' in eqset_imp_iff)\n apply (erule pspace_alignedE, erule domI)\n apply (drule valid_obj_sizes, erule ranI)\n apply (clarsimp simp: add_diff_eq[symmetric])\n apply (simp add: is_aligned_no_wrap')\n done\n\n\nlemma obj_at_kheap_trans_state[simp]:\"obj_at P ptr (kheap_update f (trans_state f' s)) = obj_at P ptr (kheap_update f s)\"\n apply (simp only: trans_state_update[symmetric] more_update.obj_at_update)\n done\n\n\nlemma retype_region_obj_at:\n assumes tyunt: \"ty \\ Structures_A.apiobject_type.Untyped\"\n shows \"\\\\\\ retype_region ptr n us ty dev\n \\\\r s. \\x \\ set (retype_addrs ptr ty n us). obj_at (\\ko. ko = default_object ty dev us) x s\\\"\n using tyunt unfolding retype_region_def\n apply (simp only: return_bind bind_return foldr_upd_app_if fun_app_def K_bind_def)\n apply wp\n apply (simp only: obj_at_kheap_trans_state)\n apply wp\n apply (simp only: simp_thms if_True)\n apply (rule ballI)\n apply (subst retype_addrs_fold)\n apply simp\n apply (unfold obj_at_def)\n apply clarsimp\n done\n\n\nlemma retype_region_obj_at_other:\n assumes ptrv: \"ptr \\ set (retype_addrs ptr' ty n us)\"\n shows \"\\obj_at P ptr\\ retype_region ptr' n us ty dev \\\\r. obj_at P ptr\\\"\n using ptrv unfolding retype_region_def retype_addrs_def\n apply (simp only: foldr_upd_app_if fun_app_def K_bind_def)\n apply (wpsimp simp: obj_at_def)\n done\n\n\nlemma retype_region_obj_at_other2:\n \"\\\\s. ptr \\ set (retype_addrs ptr' ty n us)\n \\ obj_at P ptr s\\ retype_region ptr' n us ty dev \\\\rv. obj_at P ptr\\\"\n by (rule hoare_assume_pre) (wpsimp wp: retype_region_obj_at_other)\n\n\nlemma retype_region_obj_at_other3:\n \"\\\\s. pspace_no_overlap_range_cover ptr sz s \\ obj_at P p s \\ range_cover ptr sz (obj_bits_api ty us) n\n \\ valid_objs s \\ pspace_aligned s\\\n retype_region ptr n us ty dev\n \\\\rv. obj_at P p\\\"\n apply (rule hoare_pre)\n apply (rule retype_region_obj_at_other2)\n apply clarsimp\n apply (drule subsetD [rotated, OF _ retype_addrs_subset_ptr_bits])\n apply simp\n apply (drule(3) pspace_no_overlap_obj_not_in_range)\n apply (simp add: field_simps)\n done\n\nlemma retype_region_st_tcb_at:\n \"\\\\(s::'state_ext::state_ext state). pspace_no_overlap_range_cover ptr' sz s \\ pred_tcb_at proj P t s \\ range_cover ptr' sz (obj_bits_api ty us) n\n \\ valid_objs s \\ pspace_aligned s\\\n retype_region ptr' n us ty dev \\\\rv. pred_tcb_at proj P t\\\"\n by (simp add: retype_region_obj_at_other3 pred_tcb_at_def)\n\n\nlemma retype_region_cur_tcb[wp]:\n \"\\pspace_no_overlap_range_cover ptr sz and cur_tcb and K (range_cover ptr sz (obj_bits_api ty us) n)\n and K (is_aligned ptr sz \\ sz < word_bits)\n and valid_objs and pspace_aligned\\\n retype_region ptr n us ty dev\n \\\\rv. cur_tcb\\\"\n supply\n is_aligned_neg_mask_eq[simp del]\n is_aligned_neg_mask_weaken[simp del]\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\tp. tcb_at tp s \\ cur_thread s = tp\"])\n apply (simp add: cur_tcb_def)\n apply (wpsimp wp: hoare_vcg_ex_lift retype_region_obj_at_other3 simp: retype_region_def)\n apply (auto simp: cur_tcb_def cong: if_cong)\n done\n\n\nlemma retype_addrs_mem_sz_0_is_ptr:\n assumes \"x \\ set (retype_addrs ptr ty n us)\"\n and \"n = 0\"\n shows \"x = ptr\"\n using assms unfolding retype_addrs_def by (clarsimp simp: ptr_add_def)\n\n\nlocale Retype_AI_obj_bits_api_neq_0 =\n assumes obj_bits_api_neq_0: \"\\ty us. ty \\ Untyped \\ 0 < obj_bits_api ty us\"\n\n\nlemma retype_addrs_range_subset:\n \"\\ p \\ set (retype_addrs ptr ty n us);\n range_cover ptr sz (obj_bits_api ty us) n \\\n \\ {p .. p + 2 ^ obj_bits_api ty us - 1} \\ {ptr..(ptr && ~~ mask sz) + 2^sz - 1}\"\n apply (clarsimp simp: retype_addrs_def ptr_add_def\n simp del: atLeastatMost_subset_iff atLeastAtMost_iff)\n apply (frule_tac x = \"of_nat x\" in range_cover_cell_subset)\n apply (erule of_nat_mono_maybe[rotated])\n apply (drule range_cover.range_cover_n_less)\n apply (simp add:word_bits_def)\n apply fastforce\n done\n\n\ncontext Retype_AI_slot_bits begin\n\nlemma retype_addrs_obj_range_subset:\n \"\\ p \\ set (retype_addrs ptr ty n us);\n range_cover ptr sz (obj_bits (default_object ty dev us)) n;\n ty \\ Untyped \\\n \\ obj_range p (default_object ty dev us) \\ {ptr..(ptr && ~~ mask sz) + (2^sz - 1)}\"\n by(simp add: obj_range_def obj_bits_api_default_object[symmetric]\n retype_addrs_range_subset p_assoc_help[symmetric]\n del: atLeastatMost_subset_iff)\n\nlemma retype_addrs_obj_range_subset_strong:\n \"\\ p \\ set (retype_addrs ptr ty n us);\n range_cover ptr sz (obj_bits_api ty us) n;\n ty \\ Untyped \\\n \\ obj_range p (default_object ty dev us) \\ {ptr..ptr + of_nat n * 2 ^ obj_bits_api ty us - 1}\"\n unfolding obj_range_def\n apply (frule retype_addrs_obj_range_subset)\n apply (simp add:obj_bits_dev_irr)\n apply (simp add:obj_range_def)+\n apply (intro conjI impI)\n apply (erule(1) impE)\n apply clarsimp\n apply (case_tac \"n = 0\")\n apply (clarsimp simp:retype_addrs_def)\n proof -\n assume cover:\"range_cover ptr sz (obj_bits_api ty us) n\"\n and mem_p:\"p \\ set (retype_addrs ptr ty n us)\"\n and not_0:\"n\\ 0\"\n and tyunt:\"ty\\ Untyped\"\n note n_less = range_cover.range_cover_n_less[OF cover]\n have unat_of_nat_m1: \"unat (of_nat n - (1::machine_word)) < n\"\n using not_0 n_less\n by (simp add:unat_of_nat_minus_1)\n have decomp:\"of_nat n * 2 ^ obj_bits_api ty us = of_nat (n - 1) * 2 ^ (obj_bits (default_object ty dev us))\n + (2 :: machine_word) ^ obj_bits (default_object ty dev us)\"\n apply (simp add:distrib_right[where b = \"1::'a::len word\",simplified,symmetric])\n using not_0 n_less\n apply (simp add: unat_of_nat_minus_1 obj_bits_api_def3 tyunt cong: obj_bits_cong)\n done\n show \"p + 2 ^ obj_bits (default_object ty dev us) - 1 \\ ptr + of_nat n * 2 ^ obj_bits_api ty us - 1\"\n using cover\n apply (subst decomp)\n apply (simp add:add.assoc[symmetric])\n apply (simp add:p_assoc_help)\n apply (rule order_trans[OF word_plus_mono_left word_plus_mono_right])\n using mem_p not_0\n apply (clarsimp simp: retype_addrs_def ptr_add_def shiftl_t2n tyunt\n obj_bits_dev_irr)\n apply (rule word_plus_mono_right)\n apply (rule word_mult_le_mono1[OF word_of_nat_le])\n using n_less not_0\n apply (simp add:unat_of_nat_minus_1)\n apply (rule p2_gt_0[THEN iffD2])\n apply (simp add: word_bits_def range_cover_def obj_bits_dev_irr tyunt)\n apply (simp only: word_bits_def[symmetric])\n using not_0 n_less\n apply (clarsimp simp: unat_of_nat_minus_1 obj_bits_dev_irr tyunt)\n apply (subst unat_power_lower)\n apply (simp add:range_cover_def)\n apply (rule nat_less_power_trans2[OF range_cover.range_cover_le_n_less(2),OF cover, folded word_bits_def])\n apply (simp add:unat_of_nat_m1 less_imp_le)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n using range_cover.range_cover_compare[OF cover,where p = \"unat (of_nat n - (1::machine_word))\"]\n apply (clarsimp simp:unat_of_nat_m1)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule olen_add_eqv[THEN iffD2])\n apply (subst add.commute[where a = \"2^(obj_bits (default_object ty dev us)) - 1\"])\n apply (subst p_assoc_help[symmetric])\n apply (rule is_aligned_no_overflow)\n apply (insert cover)\n apply (clarsimp simp:range_cover_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_mult_triv2])\n apply (simp add: obj_bits_dev_irr range_cover_def tyunt)+\n by (meson is_aligned_add is_aligned_mult_triv2 is_aligned_no_overflow')\n qed\n\n\nlemma retype_addrs_mem_subset_ptr_bits:\n assumes cover:\"range_cover ptr sz (obj_bits_api ty us) n\"\n and tynunt: \"ty \\ Untyped\"\n and xv: \"x \\ set (retype_addrs ptr ty n us)\"\n shows \"{x .. x + (2 ^ obj_bits_api ty us - 1)} \\ {ptr .. (ptr && ~~ mask sz) + (2 ^ sz - 1)}\"\n apply (insert cover)\n using retype_addrs_obj_range_subset [OF xv _ tynunt]\n by (simp add: obj_bits_dev_irr tynunt obj_range_def field_simps)\n\nlemma pspace_no_overlap_retype_addrs_empty:\n assumes nptr: \"pspace_no_overlap_range_cover ptr sz s\"\n and xv: \"x \\ set (retype_addrs ptr ty n us)\"\n and yv: \"y \\ set (retype_addrs ptr ty n us)\"\n and kov: \"kheap s y = Some ko\"\n and tyv: \"ty \\ Structures_A.apiobject_type.Untyped\"\n and cover: \"range_cover ptr sz (obj_bits_api ty us) n\"\n and oab: \"obj_bits_api ty us \\ sz\"\n shows \"{x..x + (2 ^ obj_bits (default_object ty dev us) - 1)} \\ {y..y + (2 ^ obj_bits ko - 1)} = {}\"\nproof -\n have \"{x..x + (2 ^ obj_bits (default_object ty dev us) - 1)} \\ {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)}\"\n by (subst obj_bits_api_default_object [OF tyv, symmetric],\n rule retype_addrs_mem_subset_ptr_bits) fact+\n\n moreover have \"{ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ {y..y + (2 ^ obj_bits ko - 1)} = {}\"\n by (subst Int_commute, rule pspace_no_overlapE) fact+\n\n ultimately show ?thesis by auto\nqed\n\nend\n\n\nlemma valid_obj_default_object:\n assumes tyunt: \"ty \\ Untyped\"\n and tyct: \"ty = CapTableObject \\ us < word_bits - cte_level_bits \\ 0 < us\"\n and arch: \"valid_arch_tcb default_arch_tcb s\"\n shows \"valid_obj ptr (default_object ty dev us) s\"\n unfolding valid_obj_def default_object_def\n apply (cases ty)\n apply (simp add: tyunt)\n apply (simp add: valid_tcb_def default_tcb_def valid_tcb_state_def\n tcb_cap_cases_def valid_ipc_buffer_cap_def\n word_bits_def arch)\n apply (simp add: valid_ep_def default_ep_def)\n apply (simp add: valid_ntfn_def default_notification_def default_ntfn_def valid_bound_tcb_def)\n apply (frule tyct)\n apply (clarsimp simp: valid_cs_def empty_cnode_def well_formed_cnode_n_def)\n apply safe\n apply (erule ranE)\n apply (simp split: if_split_asm)\n apply (simp add: valid_cs_size_def well_formed_cnode_n_def)\n apply safe\n apply (simp split: if_split_asm)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp add: wellformed_arch_default)\n done\n\nlemma usable_range_subseteq:\n \"\\cap_aligned cap;is_untyped_cap cap\\ \\ usable_untyped_range cap \\ untyped_range cap\"\n apply (clarsimp simp:is_cap_simps cap_aligned_def split:if_splits)\n apply (erule order_trans[OF is_aligned_no_wrap'])\n apply (erule of_nat_power)\n apply (simp add:word_bits_def)+\n done\n\n\nlemma usable_range_emptyD:\n \"\\cap_aligned cap;is_untyped_cap cap ;usable_untyped_range cap = {}\\ \\ 2 ^ cap_bits cap \\ free_index_of cap\"\n apply (clarsimp simp:is_cap_simps not_le free_index_of_def cap_aligned_def split:if_splits)\n apply (drule(1) of_nat_power [where 'a=machine_word_len, folded word_bits_def])\n apply (drule word_plus_mono_right[OF _ is_aligned_no_overflow[unfolded p_assoc_help],rotated])\n apply simp\n apply (simp add:p_assoc_help)\n done\n\n\nlocale Retype_AI_valid_untyped_helper =\n fixes state_ext_t :: \"'state_ext::state_ext itself\"\n assumes valid_untyped_helper:\n \"\\s c q ty ptr sz us n dev.\n \\ (s :: 'state_ext state) \\ c;\n cte_wp_at ((=) c) q s;\n ty \\ Untyped;\n range_cover ptr sz (obj_bits_api ty us) n;\n is_untyped_cap c \\\n usable_untyped_range c \\ {ptr..ptr + of_nat (n * 2 ^ (obj_bits_api ty us)) - 1} = {};\n pspace_no_overlap_range_cover ptr sz s;\n caps_no_overlap ptr sz s;\n valid_pspace s \\\n \\ valid_cap c\n (s\\kheap := \\x. if x \\ set (retype_addrs ptr ty n us)\n then Some (default_object ty dev us)\n else kheap s x\\)\"\n\n\nlemma cap_refs_respects_device_region_cap_range:\n \"\\cte_wp_at (\\c. {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ cap_range c \\ cap_is_device c = dev) slot s;\n cap_refs_respects_device_region s\\\n \\ up_aligned_area ptr sz \\ (if dev then device_region s else - device_region s)\"\n unfolding cap_refs_respects_device_region_def\n apply (drule spec[where x = slot])\n apply (clarsimp simp: cte_wp_at_caps_of_state cap_range_respects_device_region_def)\n apply fastforce\n done\n\n\nlocale retype_region_proofs =\n fixes s :: \"'state_ext :: state_ext state\"\n and ty us ptr sz n ps s' dev\n assumes vp: \"valid_pspace s\"\n and vm: \"valid_mdb s\"\n and res: \"caps_overlap_reserved {ptr..ptr + of_nat (n * 2 ^ (obj_bits_api ty us)) - 1} s\"\n and tyunt: \"ty \\ Structures_A.apiobject_type.Untyped\"\n and tyct: \"ty = CapTableObject \\ us < word_bits - cte_level_bits \\ 0 < us\"\n and orth: \"pspace_no_overlap_range_cover ptr sz s\"\n and mem : \"caps_no_overlap ptr sz s\"\n and cover: \"range_cover ptr sz (obj_bits_api ty us) n\"\n and dev: \"\\slot. cte_wp_at (\\c. {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ cap_range c \\ cap_is_device c = dev) slot s\"\n defines \"ps \\ (\\x. if x \\ set (retype_addrs ptr ty n us) then Some (default_object ty dev us)\n else kheap s x)\"\n and \"s' \\ kheap_update (\\y. ps) s\"\n\n\nlocale retype_region_proofs_gen\n = retype_region_proofs s ty us ptr sz n ps s' dev\n + Retype_AI_slot_bits\n + Retype_AI_valid_untyped_helper \"TYPE('state_ext)\"\n for s :: \"'state_ext :: state_ext state\"\n and ty us ptr sz n ps s' dev +\n assumes hyp_refs_eq:\n \"state_hyp_refs_of s' = state_hyp_refs_of s\"\n assumes valid_arch_tcb_default[simp]:\n \"\\s :: 'state_ext :: state_ext state. valid_arch_tcb default_arch_tcb s\"\n assumes wellformed_default_obj:\n \"\\ ptra \\ set (retype_addrs ptr ty n us);\n kheap s ptra = Some (ArchObj x5); arch_valid_obj x5 s\\ \\\n arch_valid_obj x5 s'\"\n\ncontext retype_region_proofs begin\n\nlemma obj_at_pres: \"\\P x. obj_at P x s \\ obj_at P x s'\"\n by (clarsimp simp: obj_at_def s'_def ps_def dest: domI)\n (rule pspace_no_overlapC [OF orth _ _ cover vp])\n\nlemma orthr:\n \"\\x obj. kheap s x = Some obj \\ x \\ set (retype_addrs ptr ty n us)\"\n apply (rule ccontr)\n apply (frule pspace_no_overlapC[OF orth _ _ _ vp,rotated])\n apply (rule cover)\n apply auto\n done\n\nlemma cte_at_pres: \"\\p. cte_at p s \\ cte_at p s'\"\n unfolding cte_at_cases s'_def ps_def\n apply (erule disjE)\n apply (clarsimp simp: well_formed_cnode_n_def orthr)+\n done\n\nlemma pred_tcb_at_pres: \"\\P t. pred_tcb_at proj P t s \\ pred_tcb_at proj P t s'\"\n unfolding pred_tcb_at_def\n by (erule obj_at_pres)\n\nend\n\n\ncontext retype_region_proofs_gen begin\n\nlemma psp_dist:\n shows \"pspace_distinct s'\"\nproof -\n have distinct:\"pspace_distinct s\"\n apply (rule valid_pspaceE)\n apply (rule vp)\n apply simp\n done\n moreover\n {\n fix x y\n assume xne: \"x \\ y\" and xv: \"x \\ set (retype_addrs ptr ty n us)\" and yv: \"y \\ set (retype_addrs ptr ty n us)\"\n\n have \"is_aligned x (obj_bits_api ty us)\"\n apply (rule retype_addrs_aligned)\n apply fact+\n apply (insert cover)\n apply (auto simp: range_cover_def word_bits_def)\n done\n moreover\n have \"is_aligned y (obj_bits_api ty us)\"\n apply (rule retype_addrs_aligned)\n apply fact+\n apply (insert cover)\n apply (auto simp: range_cover_def word_bits_def)\n done\n ultimately have\n \"{x..x + (2 ^ obj_bits (default_object ty dev us) - 1)} \\\n {y..y + (2 ^ obj_bits (default_object ty dev us) - 1)} = {}\"\n using xne tyunt cover\n apply -\n apply (rule aligned_neq_into_no_overlap)\n apply (simp_all add: range_cover_def word_bits_def obj_bits_dev_irr)\n done\n } note inter = this\n moreover\n {\n fix x y ko'\n assume xne: \"x \\ y\" and xv: \"x \\ set (retype_addrs ptr ty n us)\"\n and yv: \"y \\ set (retype_addrs ptr ty n us)\" and \"kheap s y = Some ko'\"\n have \"{x..x + (2 ^ obj_bits (default_object ty dev us) - 1)} \\ {y..y + (2 ^ obj_bits ko' - 1)} = {}\"\n apply (rule pspace_no_overlap_retype_addrs_empty [OF orth])\n apply fact+\n apply (insert cover tyunt)\n apply (simp add: range_cover_def word_bits_def)+\n done\n }note inter' = this\n show ?thesis\n unfolding pspace_distinct_def s'_def ps_def\n apply (clarsimp split: if_split_asm option.splits\n simp del: Int_atLeastAtMost)\n apply (intro conjI impI allI)\n apply (erule(2) inter)\n apply clarify\n apply (erule(3) inter')\n apply clarify\n apply (subst Int_commute)\n apply (erule(3) inter'[OF neq_commute[THEN iffD1]])\n apply clarify\n apply (insert vp[unfolded valid_pspace_def pspace_distinct_def])\n apply clarify\n apply (drule_tac x = x in spec)\n apply (drule_tac x = y in spec)\n apply (erule allE impE)+\n apply fastforce\n apply simp\n done\nqed\n\n\nlemma psp_al:\n shows \"pspace_aligned s'\"\n unfolding pspace_aligned_def s'_def ps_def\nproof (clarsimp split: if_split_asm)\n fix x\n assume \"x \\ set (retype_addrs ptr ty n us)\"\n thus \"is_aligned x (obj_bits (default_object ty dev us))\"\n apply -\n apply (drule retype_addrs_aligned)\n apply (insert cover tyunt)\n apply (fastforce simp:range_cover_def word_bits_def)+\n apply (simp add: obj_bits_dev_irr\n split: Structures_A.apiobject_type.splits)\n done\nnext\n fix x y\n assume \"x \\ set (retype_addrs ptr ty n us)\" and px: \"kheap s x = Some y\"\n\n have \"pspace_aligned s\"\n by (rule valid_pspaceE[OF vp],simp)\n\n thus \"is_aligned x (obj_bits y)\"\n proof\n show \"x \\ dom (kheap s)\" by (rule domI) fact+\n next\n assume \"is_aligned x (obj_bits (the (kheap s x)))\"\n thus \"is_aligned x (obj_bits y)\" using px by simp\n qed\nqed\n\nend\n\n\nlemma le_subset: \"\\(a::('g::len) word) \\ c\\ \\ {c..b} \\ {a..b}\" by clarsimp\n\n\ncontext retype_region_proofs_gen begin\n\nlemma valid_cap_pres:\n \"\\ s \\ c; cte_wp_at ((=) c) (oref,cref) s \\ \\ s' \\ c\"\n using cover mem orth\n apply (simp add:s'_def ps_def)\n apply (rule valid_untyped_helper[ OF _ _ tyunt cover _ _ _ vp ])\n apply simp+\n apply (simp add:cte_wp_at_caps_of_state)\n apply (drule res[unfolded caps_overlap_reserved_def,THEN bspec,OF ranI])\n apply simp\n apply simp+\n done\n\nlemma valid_objs: \"valid_objs s'\"\n apply (clarsimp simp:valid_objs_def)\n apply (rule valid_pspaceE[OF vp])\n apply (clarsimp simp:valid_objs_def s'_def ps_def split:if_splits)\n apply (simp add:valid_obj_default_object[OF tyunt tyct])\n apply (simp (no_asm) add:valid_obj_def)\n apply (drule bspec)\n apply (erule domI)\n apply (clarsimp simp:valid_obj_def split:Structures_A.kernel_object.splits)\n apply (clarsimp simp: valid_cs_def)\n apply (drule (1) bspec)\n apply (clarsimp simp: ran_def)\n apply (erule valid_cap_pres[unfolded s'_def ps_def])\n apply (clarsimp simp add: cte_wp_at_cases valid_cs_size_def s'_def ps_def)\n apply fastforce\n apply (clarsimp simp: valid_tcb_def)\n apply (rule conjI)\n apply (rule ballI, drule(1) bspec, clarsimp elim!: ranE)\n apply (erule valid_cap_pres[unfolded s'_def ps_def])\n apply (rule cte_wp_at_tcbI, fastforce+)[1]\n apply (fastforce simp: valid_tcb_state_def valid_bound_ntfn_def\n elim!: obj_at_pres[unfolded s'_def ps_def] valid_arch_tcb_typ_at\n split: Structures_A.thread_state.splits option.splits)\n apply (fastforce simp: valid_ep_def\n elim!: obj_at_pres[unfolded s'_def ps_def]\n split: Structures_A.endpoint.splits)\n apply (fastforce simp: valid_ntfn_def valid_bound_tcb_def\n elim!: obj_at_pres[unfolded s'_def ps_def]\n split: Structures_A.ntfn.splits option.splits)\n apply (clarsimp simp: wellformed_default_obj[unfolded s'_def ps_def])\n done\n\nend\n\n\ncontext retype_region_proofs begin\n\nlemma refs_eq:\n \"state_refs_of s' = state_refs_of s\"\n unfolding s'_def ps_def\n apply (clarsimp intro!: ext simp: state_refs_of_def\n simp: orthr\n split: option.splits)\n apply (cases ty, simp_all add: tyunt default_object_def\n default_tcb_def default_ep_def\n default_notification_def default_ntfn_def)\n done\n\n\nlemma cte_retype:\n \"\\P p. \\ P cap.NullCap \\\n cte_wp_at P p s' = cte_wp_at P p s\"\n unfolding s'_def ps_def\n apply (safe elim!: cte_wp_atE)\n apply (clarsimp split: if_split_asm\n Structures_A.apiobject_type.split_asm\n simp: default_object_def tyunt default_tcb_def\n empty_cnode_def cte_wp_at_cases\n dest!: orthr\n | simp add: tcb_cap_cases_def)+\n done\n\n\nlemma iflive_s: \"if_live_then_nonz_cap s\" by (rule valid_pspaceE [OF vp])\n\nlemma default_object_not_live: \"\\ live (default_object ty dev us)\"\n apply (cases ty, simp_all add: tyunt default_object_def default_tcb_not_live default_arch_object_not_live)\n apply (simp add: live_def default_ep_def default_notification_def default_ntfn_def)+\n done\n\nlemma iflive:\n \"if_live_then_nonz_cap s'\"\n using iflive_s unfolding if_live_then_nonz_cap_def s'_def ps_def\n apply -\n apply (clarsimp elim!: obj_atE simp: default_object_not_live split: if_split_asm)\n\n apply (frule(1) if_live_then_nonz_capD2[OF iflive_s])\n apply (simp add: ex_nonz_cap_to_def\n cte_retype[unfolded s'_def ps_def])\n done\n\n\nlemma final_retype: \"is_final_cap' cap s' = is_final_cap' cap s\"\n by (simp add: is_final_cap'_def2 cte_retype)\n\n\nlemma not_final_NullCap: \"\\s. \\ is_final_cap' cap.NullCap s\"\n by (simp add: is_final_cap'_def)\n\n\nlemma zombies_s: \"zombies_final s\" by (rule valid_pspaceE[OF vp])\n\n\nlemma zombies: \"zombies_final s'\"\n unfolding zombies_final_def\n by (clarsimp simp: final_retype is_zombie_def cte_retype not_final_NullCap\n elim!: zombies_finalD [OF _ zombies_s])\n\nend\n\nlemma (in retype_region_proofs_gen) valid_pspace: \"valid_pspace s'\"\n using vp by (simp add: valid_pspace_def valid_objs psp_al psp_dist\n iflive zombies refs_eq hyp_refs_eq)\n\n\n(* I have the feeling I'm making this unnecessarily hard,\n but I can't put my finger on where. *)\n\nlemma F: \"\\x c s. (caps_of_state s x = Some c) = (cte_wp_at ((=) c) x s)\"\n apply (simp add: caps_of_state_cte_wp_at)\n apply (fastforce simp: cte_wp_at_def)\n done\n\n\nlemma F2: \"\\x c s. (null_filter (caps_of_state s) x = Some c)\n = (cte_wp_at (\\cap. cap \\ cap.NullCap \\ cap = c) x s)\"\n apply (simp add: null_filter_def F)\n apply (fastforce simp: cte_wp_at_def)\n done\n\n\nlemma F3: \"\\x s. (None = null_filter (caps_of_state s) x)\n = (\\c. \\ cte_wp_at (\\cap. cap \\ cap.NullCap \\ cap = c) x s)\"\n apply safe\n apply (simp add: F2[symmetric])\n apply (rule sym, rule ccontr, clarsimp simp: F2)\n done\n\n\nlemma (in retype_region_proofs) null_filter:\n \"null_filter (caps_of_state s') = null_filter (caps_of_state s)\"\n apply (rule ext)\n apply (case_tac \"null_filter (caps_of_state s) x\")\n apply (simp add: eq_commute)\n apply (simp add: F3 cte_retype)\n apply simp\n apply (simp add: F2 cte_retype)\n done\n\ncontext retype_region_proofs begin\n\nlemma idle_s':\n \"idle_thread s' = idle_thread s\"\n by (simp add: s'_def ps_def)\n\nlemma valid_idle:\n \"valid_idle s \\ valid_idle s'\"\n by (clarsimp simp add: valid_idle_def idle_s' refs_eq\n pred_tcb_at_pres)\n\nlemma arch_state [simp]:\n \"arch_state s' = arch_state s\"\n by (simp add: s'_def)\n\nlemma irq_node [simp]:\n \"interrupt_irq_node s' = interrupt_irq_node s\"\n by (simp add: s'_def)\n\nlemma caps_retype:\n assumes nonnull: \"cap \\ cap.NullCap\"\n and newcap: \"caps_of_state s' p = Some cap\"\n shows \"caps_of_state s p = Some cap\"\nproof -\n from newcap have \"cte_wp_at ((=) cap) p s'\"\n by (simp add: cte_wp_at_caps_of_state)\n hence \"cte_wp_at ((=) cap) p s\"\n by (rule_tac subst [OF cte_retype], rule_tac nonnull, assumption)\n thus ?thesis\n by (simp add: cte_wp_at_caps_of_state)\nqed\n\nlemma unique_reply_caps:\n \"unique_reply_caps (caps_of_state s) \\ unique_reply_caps (caps_of_state s')\"\n using caps_retype\n by (fastforce simp add: is_cap_simps unique_reply_caps_def\n simp del: split_paired_All\n elim!: allEI)\n\nlemma valid_reply_caps:\n \"valid_reply_caps s \\ valid_reply_caps s'\"\n by (clarsimp simp: valid_reply_caps_def unique_reply_caps has_reply_cap_def\n pred_tcb_at_pres cte_retype is_reply_cap_to_def)\n\nlemma valid_reply_masters:\n \"valid_reply_masters s \\ valid_reply_masters s'\"\n by (clarsimp simp: valid_reply_masters_def cte_retype is_cap_simps obj_at_pres is_master_reply_cap_to_def)\n\nend\n\n\nlemma ran_null_filter:\n \"ran (null_filter m) = (ran m - {cap.NullCap})\"\n apply (simp add: null_filter_def ran_def cong: conj_cong)\n apply force\n done\n\n\nlemma valid_irq_handlers_def2:\n \"valid_irq_handlers =\n (\\s. \\cap \\ ran (null_filter (caps_of_state s)).\n \\irq \\ cap_irqs cap. interrupt_states s irq = irq_state.IRQSignal)\"\n apply (rule ext)\n apply (simp add: valid_irq_handlers_def irq_issued_def\n ran_null_filter)\n apply auto\n done\n\n\nlemma p_in_obj_range:\n \"\\ kheap s p = Some ko; pspace_aligned s; valid_objs s \\ \\ p \\ obj_range p ko\"\n apply (simp add: pspace_aligned_def)\n apply (drule bspec, erule domI)\n apply (drule valid_obj_sizes, erule ranI)\n apply (simp add: obj_range_def add_diff_eq[symmetric])\n apply (erule is_aligned_no_wrap')\n apply (erule word_power_less_1[where 'a=machine_word_len, folded word_bits_def])\n done\n\nlemma p_in_obj_range_internal:\n \"\\ kheap s (p && ~~ mask (obj_bits ko))= Some ko; pspace_aligned s; valid_objs s \\\n \\ p \\ obj_range (p && ~~ mask (obj_bits ko)) ko\"\n apply (drule p_in_obj_range,simp+)\n apply (simp add: obj_range_def word_and_le2 word_neg_and_le p_assoc_help)\n done\n\n\ncontext retype_region_proofs begin\n\nlemma interrupt_states:\n \"interrupt_states s' = interrupt_states s\"\n by (simp add: s'_def)\n\nlemma valid_irq_handlers:\n \"valid_irq_handlers s \\ valid_irq_handlers s'\"\n by (simp add: valid_irq_handlers_def2 null_filter\n interrupt_states)\n\nlemma mdb_and_revokable:\n \"cdt s' = cdt s\"\n \"is_original_cap s' = is_original_cap s\"\n by (simp add: s'_def)+\n\nlemma cur_tcb:\n \"cur_tcb s \\ cur_tcb s'\"\n apply (simp add: cur_tcb_def, rule obj_at_pres)\n apply (simp add: s'_def)\n done\n\nlemma only_idle:\n \"only_idle s \\ only_idle s'\"\n apply (clarsimp simp: only_idle_def)\n apply (clarsimp simp: s'_def pred_tcb_at_def obj_at_def ps_def split: if_split_asm)\n apply (simp add: default_object_def tyunt split: Structures_A.apiobject_type.splits)\n apply (simp add: default_tcb_def)\n done\n\nlemma valid_irq_states:\n \"valid_irq_states s \\ valid_irq_states s'\"\n apply(simp add: s'_def valid_irq_states_def)\n done\n\nlemma cap_refs_in_kernel_window:\n \"cap_refs_in_kernel_window s \\ cap_refs_in_kernel_window s'\"\n apply (simp add: cap_refs_in_kernel_window_def valid_refs_def)\n apply (simp add: cte_retype cap_range_def)\n done\n\nlemma valid_ioc:\n \"valid_ioc s \\ valid_ioc s'\"\n using cte_retype\n by (simp add: valid_ioc_def s'_def)\n\nend\n\nlocale retype_region_proofs_invs\n = retype_region_proofs_gen s ty us ptr sz n ps s' dev\n + Retype_AI_post_retype_invs \"TYPE('state_ext)\" post_retype_invs_check post_retype_invs\n for s :: \"'state_ext :: state_ext state\"\n and ty us ptr sz n ps s' dev post_retype_invs_check\n and post_retype_invs :: \"apiobject_type \\ machine_word list \\ 'state_ext state \\ bool\" +\n fixes region_in_kernel_window :: \"machine_word set \\ 'state_ext state \\ bool\"\n assumes valid_global_refs: \"valid_global_refs s \\ valid_global_refs s'\"\n assumes valid_arch_state: \"valid_arch_state s \\ valid_arch_state s'\"\n assumes valid_vspace_objs': \"\\ invs s; valid_vspace_objs s \\ \\ valid_vspace_objs s'\"\n assumes valid_cap:\n \"(s::'state_ext state) \\ cap \\\n untyped_range cap \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\n \\ s' \\ cap\"\n assumes post_retype_invs:\n \"\\ invs (s :: 'state_ext state); region_in_kernel_window {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} s \\\n \\ post_retype_invs ty (retype_addrs ptr ty n us) s'\"\n\ncontext Retype_AI_slot_bits begin\n\nlemma use_retype_region_proofs':\n assumes x: \"\\s. \\ retype_region_proofs s ty us ptr sz n dev; P s \\\n \\ Q (retype_addrs ptr ty n us) (s\\kheap :=\n \\x. if x \\ set (retype_addrs ptr ty n us)\n then Some (default_object ty dev us)\n else kheap s x\\)\"\n assumes y: \"\\x s f. Q x (trans_state f s) = Q x s\"\n shows\n \"\\ ty = CapTableObject \\ 0 < us;\n \\s. P s \\ Q (retype_addrs ptr ty n us) s \\ \\\n \\\\s. valid_pspace s \\ valid_mdb s \\ range_cover ptr sz (obj_bits_api ty us) n\n \\ caps_overlap_reserved {ptr..ptr + of_nat n * 2 ^ obj_bits_api ty us - 1} s\n \\ caps_no_overlap ptr sz s \\ pspace_no_overlap_range_cover ptr sz s\n \\ (\\slot. cte_wp_at (\\c. {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ cap_range c \\ cap_is_device c = dev) slot s)\n \\ P s\\ retype_region ptr n us ty dev \\Q\\\"\n apply (simp add: retype_region_def split del: if_split)\n apply (rule hoare_pre, (wp|simp add:y trans_state_update[symmetric] del: trans_state_update)+)\n apply (clarsimp simp: retype_addrs_fold\n foldr_upd_app_if fun_upd_def[symmetric])\n apply safe\n apply (rule x)\n apply (rule retype_region_proofs.intro, simp_all)[1]\n\n apply (fastforce simp add: range_cover_def obj_bits_api_def\n slot_bits_def2 word_bits_def)+\n done\nend\n\n\nlocale Retype_AI\n = Retype_AI_clearMemoryVM\n + Retype_AI_slot_bits\n + Retype_AI_retype_region_ret state_ext_t\n + Retype_AI_post_retype_invs state_ext_t post_retype_invs_check post_retype_invs\n + Retype_AI_obj_bits_api_neq_0\n + Retype_AI_no_gs_types no_gs_types\n + Retype_AI_dmo_eq_kernel_restricted state_ext_t machine_op_t\n for state_ext_t :: \"'state_ext::state_ext itself\"\n and post_retype_invs_check\n and post_retype_invs :: \"apiobject_type \\ machine_word list \\ 'state_ext state \\ bool\"\n and no_gs_types\n and machine_op_t :: \"'machine_op_t itself\" +\n fixes state_ext'_t :: \"'state_ext'::state_ext itself\"\n fixes region_in_kernel_window :: \"machine_word set \\ 'state_ext state \\ bool\"\n assumes invs_post_retype_invs:\n \"\\(s::'state_ext state) ty refs. invs s \\ post_retype_invs ty refs s\"\n assumes equal_kernel_mappings_trans_state[simp]:\n \"\\(f::'state_ext \\ 'state_ext') (s::'state_ext state).\n equal_kernel_mappings (trans_state f s) = equal_kernel_mappings s\"\n assumes retype_region_proofs_assms:\n \"\\s ty us ptr sz n dev.\n retype_region_proofs (s::'state_ext state) ty us ptr sz n dev\n \\ retype_region_proofs_invs s ty us ptr sz n dev\n post_retype_invs_check post_retype_invs\n region_in_kernel_window\"\n\n\ncontext Retype_AI begin\n\nlemmas use_retype_region_proofs\n = use_retype_region_proofs'[where Q=\"\\_. Q\" and P=Q, simplified]\n for Q\n\n\nlemma retype_region_proofs_assms':\n assumes \"retype_region_proofs (s::'state_ext state) ty us ptr sz n dev\"\n shows \"retype_region_proofs_gen s ty us ptr sz n dev\"\n using assms retype_region_proofs_assms\n by (auto simp: retype_region_proofs_invs_def)\n\n\nlemmas retype_region_valid_pspace = use_retype_region_proofs\n [where Q=valid_pspace,\n OF retype_region_proofs_gen.valid_pspace[OF retype_region_proofs_assms'],\n simplified]\n\n\nlemmas retype_region_caps_of = use_retype_region_proofs\n [where Q=\"\\s. P (null_filter (caps_of_state s))\",\n OF ssubst [where P=P, OF retype_region_proofs.null_filter],\n simplified] for P\n\n\nlemma retype_region_valid_cap:\n \"\\ty = Structures_A.apiobject_type.CapTableObject \\ 0 < us\\\n \\ \\(\\s::'state_ext state. valid_pspace s \\ caps_overlap_reserved {ptr..ptr + of_nat n * 2 ^ obj_bits_api ty us - 1} s \\\n valid_mdb s \\ range_cover ptr sz (obj_bits_api ty us) n \\\n caps_no_overlap ptr sz s \\ pspace_no_overlap_range_cover ptr sz s \\\n (\\slot. cte_wp_at (\\c. {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ cap_range c \\ cap_is_device c = dev) slot s) \\\n s \\ cap) and K (untyped_range cap \\ {ptr..(ptr &&~~ mask sz) + 2 ^ sz - 1} = {})\\\n retype_region ptr n us ty dev\n \\\\r s. s \\ cap\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (rule use_retype_region_proofs)\n apply (erule retype_region_proofs_invs.valid_cap[OF retype_region_proofs_assms])\n apply simp+\n done\n\n\nlemmas retype_region_aligned = use_retype_region_proofs\n [where Q=pspace_aligned,\n OF retype_region_proofs_gen.psp_al[OF retype_region_proofs_assms'],\n simplified]\n\n\nlemmas retype_region_valid_idle = use_retype_region_proofs\n [where Q=valid_idle,\n OF retype_region_proofs.valid_idle,\n simplified]\n\n\nlemmas retype_region_valid_arch = use_retype_region_proofs\n [where Q=valid_arch_state,\n OF retype_region_proofs_invs.valid_arch_state[OF retype_region_proofs_assms],\n simplified]\n\n\nlemmas retype_region_valid_globals = use_retype_region_proofs\n [where Q=valid_global_refs,\n OF retype_region_proofs_invs.valid_global_refs[OF retype_region_proofs_assms],\n simplified]\n\n\nlemmas retype_region_valid_reply_caps = use_retype_region_proofs\n [where Q=valid_reply_caps,\n OF retype_region_proofs.valid_reply_caps,\n simplified]\n\n\nlemmas retype_region_valid_reply_masters = use_retype_region_proofs\n [where Q=valid_reply_masters,\n OF retype_region_proofs.valid_reply_masters,\n simplified]\n\n\nlemmas retype_region_arch_objs = use_retype_region_proofs\n [where Q=valid_vspace_objs,\n OF retype_region_proofs_invs.valid_vspace_objs'[OF retype_region_proofs_assms],\n simplified]\n\n\ncrunch irq_node[wp]: retype_region \"\\s. P (interrupt_irq_node s)\"\n (simp: crunch_simps)\n\ncrunch interrupt_states[wp]: retype_region \"\\s. P (interrupt_states s)\"\n (simp: crunch_simps)\n\n\nlemma invs_trans_state[simp]:\n \"invs (trans_state f s) = invs s\"\n apply (simp add: invs_def valid_state_def)\n done\n\n\nlemma post_retype_invs_trans_state[simp]:\n \"post_retype_invs ty refs (trans_state f s) = post_retype_invs ty refs s\"\n apply (simp add: post_retype_invs_def')\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n done\n\n\nlemma retype_region_post_retype_invs:\n \"\\(invs::'state_ext state \\ bool) and caps_no_overlap ptr sz and pspace_no_overlap_range_cover ptr sz\n and caps_overlap_reserved {ptr..ptr + of_nat n * 2 ^ obj_bits_api ty us - 1}\n and region_in_kernel_window {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\n and (\\s. \\slot. cte_wp_at (\\c. {ptr..(ptr && ~~ mask sz) + (2 ^ sz - 1)} \\ cap_range c \\ cap_is_device c = dev) slot s)\n and K (ty = Structures_A.CapTableObject \\ 0 < us)\n and K (range_cover ptr sz (obj_bits_api ty us) n) \\\n retype_region ptr n us ty dev\\\\rv. post_retype_invs ty rv\\\"\n apply (rule hoare_gen_asm)+\n apply (rule hoare_pre,\n rule use_retype_region_proofs'[where sz = sz\n and P=\"invs and region_in_kernel_window {ptr .. (ptr &&~~ mask sz) + 2 ^ sz - 1}\"])\n apply (rule retype_region_proofs_invs.post_retype_invs\n [OF retype_region_proofs_assms], simp+)\n apply (simp add: invs_post_retype_invs)\n apply (clarsimp simp:invs_def valid_state_def)\n done\n\n\nlemma subset_not_le_trans: \"\\\\ A \\ B; C \\ B\\ \\ \\ A \\ C\" by auto\n\n\nlemma cte_wp_at_trans_state[simp]: \"cte_wp_at P ptr (kheap_update f (trans_state f' s)) =\n cte_wp_at P ptr (kheap_update f s)\"\n by (simp add: trans_state_update[symmetric] del: trans_state_update)\n\n\nlemma retype_region_cte_at_other:\n assumes cover: \"range_cover ptr' sz (obj_bits_api ty us) n\"\n shows \"\\\\s. pspace_no_overlap_range_cover ptr' sz s \\ cte_wp_at P ptr s \\ valid_pspace s\\\n retype_region ptr' n us ty dev \\\\r. cte_wp_at P ptr\\\"\n unfolding retype_region_def\n apply (simp only: foldr_upd_app_if fun_app_def K_bind_def)\n apply wp\n apply (simp only: cte_wp_at_trans_state)\n apply wp+\n apply (subst retype_addrs_fold)\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_cases del: disjCI)\n apply (erule disjEI)\n apply (auto dest!: pspace_no_overlapD1[OF _ _ cover])\ndone\n\n\nlemma retype_cte_wp_at:\n \"\\\\s. cte_wp_at P ptr s \\ pspace_no_overlap_range_cover ptr' sz s \\\n valid_pspace s \\ range_cover ptr' sz (obj_bits_api ty us) n\\\n retype_region ptr' n us ty dev\n \\\\r. cte_wp_at P ptr\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_pre)\n apply (rule retype_region_cte_at_other)\n apply fastforce\n apply simp\n done\n\n\nlemma pspace_no_overlap_typ_at_def:\n \"pspace_no_overlap S =\n (\\s. \\T x. typ_at T x s \\ {x..x + (2 ^ obj_bits_type T - 1)} \\ S = {})\"\n apply (simp add: pspace_no_overlap_def obj_at_def)\n apply (rule ext)\n apply (auto simp: obj_bits_T)\n done\n\n\nlemma pspace_no_overlap_typ_at_lift:\n assumes f: \"\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n shows \"\\pspace_no_overlap S\\ f \\\\rv. pspace_no_overlap S\\\"\n apply (clarsimp simp: pspace_no_overlap_typ_at_def)\n apply (wp hoare_vcg_all_lift f)\n done\n\n\nlemma swp_clearMemoryVM [simp]:\n \"swp clearMemoryVM x = (\\_. return ())\"\n by (rule ext,simp)\n\n\n(* FIXME: move *)\nlemmas do_machine_op_bind =\n submonad_bind [OF submonad_do_machine_op submonad_do_machine_op\n submonad_do_machine_op]\n\n\n(* FIXME: move *)\nlemmas do_machine_op_return =\n submonad_do_machine_op.return\n\n\nlemma ioc_more_swap[simp]: \"\n s'\\exst := sa',\n is_original_cap := sa\\ =\n s'\\is_original_cap := sa,\n exst := sa'\\\"\n apply simp\n done\n\n\nlemma is_final_cap'_more_update[simp]:\n \"is_final_cap' cap (trans_state f s) = is_final_cap' cap s\"\n by (simp add: is_final_cap'_def)\n\n\nlemma no_cap_to_obj_with_diff_ref_more_update[simp]:\n \"no_cap_to_obj_with_diff_ref cap sl (trans_state f s) =\n no_cap_to_obj_with_diff_ref cap sl s\"\n by (simp add: no_cap_to_obj_with_diff_ref_def)\n\nend\n\n(* FIXME: irq_state stuff moved from CNodeInv_AI, not clear it makes sense here. *)\n\nlemma cte_wp_at_irq_state_independent[intro!, simp]:\n \"is_final_cap' x (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = is_final_cap' x s\"\n by (simp add: is_final_cap'_def)\n\n\nlemma zombies_final_irq_state_independent[intro!, simp]:\n \"zombies_final (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = zombies_final s\"\n by (simp add: zombies_final_def)\n\n\nlemma ex_cte_cap_wp_to_irq_state_independent[intro!, simp]:\n \"ex_cte_cap_wp_to x y (s\\machine_state := machine_state s\\irq_state := f (irq_state (machine_state s))\\\\)\n = ex_cte_cap_wp_to x y s\"\n by (simp add: ex_cte_cap_wp_to_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/Retype_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.3073580295544412, "lm_q1q2_score": 0.17160628482597434}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__48.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__48 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__48 and some rule r*}\nlemma n_RecvReqSVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqEVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') i) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') i) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''ExGntd'')) (Const true))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__48:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__48 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__48:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__48:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__48:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__48:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__48 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__48.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.17121498122630416}} {"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n * Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n * 2016-2018 Technische Universität München, Germany\n * 2016-2018 University of York, UK\n * 2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\ntheory utp_heap_scratch\nimports \"../../../Isabelle-UTP/utp/utp\" \n \"../../../Isabelle-UTP/theories/utp_designs\" \n \"../../AlgebraicLaws/Algebraic_Laws_aux\"\nbegin\nsubsection {*UTP heap alphabet*}\n\ntext {*\n*}\n\nalphabet ('hval, 'haddr) hp_vars = des_vars +\n heap_raw:: \"'haddr \\ 'hval\"\n\ndeclare hp_vars.splits [alpha_splits]\n\nsubsubsection {*Alphabet proofs*}\ntext {*\n The two locale interpretations below are a technicality to improve automatic\n proof support via the predicate and relational tactics. This is to enable the\n (re-)interpretation of state spaces to remove any occurrences of lens types\n after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n of their derivatives have been applied. Eventually, it would be desirable to\n automate both interpretations as part of a custom outer command for defining\n alphabets.\n*}\n\ninterpretation cp_hp:\n lens_interp \"\\ (ok, r) . (ok, heap_raw\\<^sub>v r, more r)\"\n apply (unfold_locales)\n apply (rule injI)\n apply (clarsimp)\n done\n \ninterpretation cp_hp_rel: lens_interp \"\\(ok, ok', r, r').\n (ok, ok', heap_raw\\<^sub>v r, heap_raw\\<^sub>v r', more r, more r')\"\n apply (unfold_locales)\n apply (rule injI)\n apply (clarsimp)\n done\n\nsubsubsection {*Type lifting*}\n\ntype_synonym ('hval, 'haddr, '\\) cphp = \"('hval, 'haddr, '\\) hp_vars_scheme des\"\ntype_synonym ('hval, 'haddr, '\\,'\\) rel_cphp = \"(('hval, 'haddr,'\\) cphp, ('hval, 'haddr,'\\) cphp) rel\"\ntype_synonym ('hval, 'haddr, '\\) hrel_cphp = \"(('hval, 'haddr, '\\) cphp) hrel\"\n\nsubsubsection {*Syntactic type setup*}\n\ntranslations\n (type) \"('hval, 'haddr, '\\) cphp\" <= (type) \" ('hval, 'haddr, '\\) hp_vars_scheme des\"\n (type) \"('hval, 'haddr, '\\) cphp\" <= (type) \"('hval, 'haddr, '\\) hp_vars_ext des\"\n (type) \"('hval, 'haddr, '\\,'\\) rel_cphp\" <= \n (type) \"(('hval, 'haddr,'\\) cphp, (_, _,'\\) cphp) rel\"\n\nnotation hp_vars_child_lens\\<^sub>a (\"\\\\<^sub>h\\<^sub>p\")\nnotation hp_vars_child_lens (\"\\\\<^sub>H\\<^sub>P\")\n\nsyntax\n \"_svid_st_alpha\" :: \"svid\" (\"\\\\<^sub>H\\<^sub>P\")\n \"_svid_st_a\" :: \"svid\" (\"\\\\<^sub>h\\<^sub>p\")\ntranslations\n \"_svid_st_alpha\" => \"CONST hp_vars_child_lens\"\n \"_svid_st_a\" => \"CONST hp_vars_child_lens\\<^sub>a\"\n\nsyntax\n \"_top_abr\" :: \"logic\" (\"\\\\<^sub>H\\<^sub>P\")\n \"_bot_abr\" :: \"logic\" (\"\\\\<^sub>H\\<^sub>P\")\n\ntranslations\n \"\\\\<^sub>H\\<^sub>P\" => \"(CONST not_upred (CONST utp_expr.var (CONST ivar CONST ok)))\"\n \"\\\\<^sub>H\\<^sub>P\" => \"true\"\n \n\nsubsection {*Substitution lift and drop*}\n\nabbreviation lift_rel_usubst_cpa (\"\\_\\\\<^sub>S\\<^sub>H\\<^sub>P\")\nwhere \"\\\\\\\\<^sub>S\\<^sub>H\\<^sub>P \\ \\ \\\\<^sub>s (\\\\<^sub>H\\<^sub>P \\\\<^sub>L \\\\<^sub>H\\<^sub>P)\"\n\nabbreviation lift_usubst_cpa (\"\\_\\\\<^sub>s\\<^sub>H\\<^sub>P\")\nwhere \"\\\\\\\\<^sub>s\\<^sub>H\\<^sub>P \\ \\\\\\\\\\<^sub>s\\\\<^sub>S\\<^sub>H\\<^sub>P\"\n\nabbreviation drop_cpa_rel_usubst (\"\\_\\\\<^sub>S\\<^sub>H\\<^sub>P\")\nwhere \"\\\\\\\\<^sub>S\\<^sub>H\\<^sub>P \\ \\ \\\\<^sub>s (\\\\<^sub>H\\<^sub>P \\\\<^sub>L \\\\<^sub>H\\<^sub>P)\"\n\nabbreviation drop_cpa_usubst (\"\\_\\\\<^sub>s\\<^sub>H\\<^sub>P\")\nwhere \"\\\\\\\\<^sub>s\\<^sub>H\\<^sub>P \\ \\\\\\\\\\<^sub>S\\<^sub>H\\<^sub>P\\\\<^sub>s\"\n\nsubsection {*UTP-Relations lift and drop*}\n\nabbreviation lift_rel_uexpr_cpa (\"\\_\\\\<^sub>H\\<^sub>P\")\nwhere \"\\P\\\\<^sub>H\\<^sub>P \\ P \\\\<^sub>p (\\\\<^sub>H\\<^sub>P \\\\<^sub>L \\\\<^sub>H\\<^sub>P)\"\n\nabbreviation lift_pre_uexpr_cpa (\"\\_\\\\<^sub>H\\<^sub>P\\<^sub><\")\nwhere \"\\p\\\\<^sub>H\\<^sub>P\\<^sub>< \\ \\\\p\\\\<^sub><\\\\<^sub>H\\<^sub>P\"\n\nabbreviation lift_post_uexpr_cpa (\"\\_\\\\<^sub>H\\<^sub>P\\<^sub>>\")\nwhere \"\\p\\\\<^sub>H\\<^sub>P\\<^sub>> \\ \\\\p\\\\<^sub>>\\\\<^sub>H\\<^sub>P\"\n\nabbreviation drop_cpa_rel_uexpr (\"\\_\\\\<^sub>H\\<^sub>P\")\nwhere \"\\P\\\\<^sub>H\\<^sub>P \\ P \\\\<^sub>p (\\\\<^sub>H\\<^sub>P \\\\<^sub>L \\\\<^sub>H\\<^sub>P)\"\n\nabbreviation drop_cpa_pre_uexpr (\"\\_\\\\<^sub><\\<^sub>H\\<^sub>P\")\nwhere \"\\P\\\\<^sub><\\<^sub>H\\<^sub>P \\ \\\\P\\\\<^sub>H\\<^sub>P\\\\<^sub><\"\n\nabbreviation drop_cpa_post_uexpr (\"\\_\\\\<^sub>>\\<^sub>H\\<^sub>P\")\nwhere \"\\P\\\\<^sub>>\\<^sub>H\\<^sub>P \\ \\\\P\\\\<^sub>H\\<^sub>P\\\\<^sub>>\"\n\nsubsection{*Healthiness conditions*}\n\nsubsection{*Control flow statements*}\ntext {**}\nsubsection{*Loops*}\nsubsection{*Experiments*}\nterm \"map_lens k\"\n\nterm \"&heap_raw\"\nterm \"fun_upd f 0 (Some 1)\"\nterm \"(trop fun_upd (&heap_raw) \\add::nat\\ (uop Some \\v::int\\))\"\nterm \"\\trop fun_upd (&heap_raw) \\add\\ (uop Some \\v\\)\\\\<^sub>e s add = Some v\"\n \nlemma \"(trop fun_upd (&heap_raw) \\add::nat\\ (uop Some \\v::int\\)) = mem \\\n \\s. \\mem\\\\<^sub>e s add = Some v\" \n apply rel_simp\n apply (auto split: if_splits)\n done \nterm \"store ptr v = (trop fun_upd (&heap_raw) ptr (uop Some v))\" \n term \"(trop fun_upd (&heap_raw) ptr (uop Some v))\" \n\nterm \"restricted_load ptr = utp_expr.var (map_lens ptr ;\\<^sub>L heap_raw)\"\nterm \"uop (\\ptr. get\\<^bsub>map_lens ptr ;\\<^sub>L heap_raw\\<^esub>)\"\n\nterm \"load ptru = (\\ptr \\ utp_expr.var (map_lens ptr ;\\<^sub>L heap_raw))(ptru)\\<^sub>a\"\nterm \"\\ptru. (\\ptr \\ utp_expr.var (map_lens ptr ;\\<^sub>L heap_raw))(ptru)\\<^sub>a\" \n \ndatatype block = available| freed \nterm \"(utp_expr.var (map_lens ptr ;\\<^sub>L heap_raw))\" \nterm \"get\\<^bsub>(heap_raw)\\<^esub> s\" \nterm \"&heap_raw\"\nterm \"ulambda\"\nlift_definition ulambda_rev :: \"('a \\ 'b, '\\) uexpr \\ ('a \\ ('b, '\\) uexpr)\"\nis \"\\ f x A. f A x\" .\nterm \"ulambda_rev (utp_expr.var (map_lens ptr ;\\<^sub>L heap_raw))\" \n\n\nterm \"uop (ulambda_rev (&heap_raw)) p \" \nterm \"((&heap_raw) s)\"\nterm \"(&heap_raw)\"\nterm \"utp_expr.var ( map_lens ptr ;\\<^sub>L heap_raw)\"\nterm \"(map_lens ptr ;\\<^sub>L heap_raw)\" \nfind_consts \"('a \\ 'b, 'c) uexpr \\ ('a \\ ('b, 'c) uexpr) \"\nterm \"\\x\\ \\(x::int)\\\" \ndatatype ('n,'a) Ptr = pt:ptr | nm: Numeral (selctn:'n) \nfind_theorems name:\".Ptr.\"\nterm \"ptr\" \nterm \"pt\" \nterm \"\\ lens_get = (\\s. None), \n lens_put = (\\s v. ptr) \\\"\n\nterm \" (case s of Numeral n \\ Some (Numeral v) | _ \\ None)\"\nterm \"Numeral \" \nterm \"\\ lens_get = (\\s. (case s of Numeral n \\ Some n | _ \\ None)), \n lens_put = (\\s v. Numeral (the v)) \\\" \nterm \"\\lens_get = the, lens_put = \\s. Some\\\" \n\n term \"path P ;\\<^sub>L the\\<^sub>L ;\\<^sub>L indx B\"\n term \"path P ;\\<^sub>L \n \\lens_get = the, lens_put = \\_. Some\\ ;\\<^sub>L \n indx B\"\n \nterm \"\\(N) v . undefined\" \nterm \"Pair s s\"\nterm \"\\(s, s') v . undefined\" \nend\n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/theories/uheap/utp_heap_scratch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.33458944788835565, "lm_q1q2_score": 0.17121497624327062}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory AbstractSeparation_SD\nimports\n AbstractSeparationHelpers_SD\n \"Sep_Algebra.Map_Extra\"\n \"DSpec.Types_D\"\nbegin\n\ndatatype cdl_component_id = Fields | Slot nat\ntype_synonym cdl_component_ids = \"cdl_component_id set\"\n\ntranslations\n (type) \"cdl_component_ids\" <=(type) \"cdl_component_id set\"\n\n(* The cdl_component are the pieces of capDL objects that we are interested in our lifted heap.\n * These components are either objects without capabilities or capabilities.\n *)\ndatatype cdl_component = CDL_Object cdl_object | CDL_Cap \"cdl_cap option\"\n\n(* The state for separation logic is an option map\n * from (obj_id,component) to sep_entities\n *)\ntype_synonym sep_state_heap = \"(cdl_object_id \\ cdl_component_id) \\ cdl_component option\"\ntype_synonym sep_state_irq_map = \"cdl_irq \\ cdl_object_id option\"\n\ntranslations\n (type) \"sep_state_heap\" <=(type) \"32 word \\ cdl_component_id \\ cdl_component option\"\n\n\n(* Our lifted state contains sep_entities and the IRQ table.\n *)\ndatatype sep_state =\n SepState \"(cdl_object_id \\ cdl_component_id) \\ cdl_component option\"\n \"cdl_irq \\ cdl_object_id option\"\n\n(* Functions to get the object heap and the irq table from the sep_state. *)\nprimrec sep_heap :: \"sep_state \\ sep_state_heap\"\nwhere \"sep_heap (SepState heap irqs) = heap\"\n\nprimrec sep_irq_node :: \"sep_state \\ sep_state_irq_map\"\nwhere \"sep_irq_node (SepState heap irqs) = irqs\"\n\n(* Adding states adds the separation entity heap and the IRQ table.\n *)\ndefinition\n sep_state_add :: \"sep_state \\ sep_state \\ sep_state\"\nwhere\n \"sep_state_add state_a state_b \\\n SepState ((sep_heap state_a) ++ (sep_heap state_b))\n ((sep_irq_node state_a) ++ sep_irq_node state_b)\"\n\n\n(* State are disjoint the separation entity heaps and the IRQ tables are dijoint.\n *)\ndefinition\n sep_state_disj :: \"sep_state \\ sep_state \\ bool\"\nwhere\n \"sep_state_disj state_a state_b \\\n (sep_heap state_a) \\ (sep_heap state_b) \\\n (sep_irq_node state_a) \\ (sep_irq_node state_b)\"\n\nlemma sep_state_add_comm:\n \"sep_state_disj x y \\ sep_state_add x y = sep_state_add y x\"\n by (fastforce simp: sep_state_add_def sep_state_disj_def intro!:map_add_com)\n\n(*********************************************)\n(* Definition of separation logic for capDL. *)\n(*********************************************)\n\ninstantiation \"sep_state\" :: zero\nbegin\n definition \"0 \\ SepState (\\p. None) Map.empty\"\n instance ..\nend\n\ninstantiation \"sep_state\" :: stronger_sep_algebra\nbegin\n\ndefinition \"(##) \\ sep_state_disj\"\ndefinition \"(+) \\ sep_state_add\"\n\n\n\n(************************************************\n * The proof that this is a separation algebra. *\n ************************************************)\n\ninstance\n apply standard\n(* x ## 0 *)\n apply (simp add: sep_disj_sep_state_def sep_state_disj_def zero_sep_state_def)\n(* x ## y \\ y ## x *)\n apply (clarsimp simp: sep_disj_sep_state_def sep_state_disj_def Let_unfold\n map_disj_com Int_commute)\n(* x + 0 = x *)\n apply (simp add: plus_sep_state_def sep_state_add_def zero_sep_state_def)\n apply (case_tac x,simp)\n(* x ## y \\ x + y = y + x *)\n apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n apply (erule sep_state_add_comm)\n(* (x + y) + z = x + (y + z) *)\n apply (simp add: plus_sep_state_def sep_state_add_def)+\n(* x ## y + z = (x ## y \\ x ## z) *)\n apply (clarsimp simp: sep_disj_sep_state_def)\n apply (auto simp: map_disj_def sep_state_disj_def)\n done\nend\n\n(*************************************************************\n * The proof that this is a cancellative separation algebra. *\n *************************************************************)\n\ninstantiation \"sep_state\" :: cancellative_sep_algebra\nbegin\n\ninstance\n apply (standard; simp add: sep_disj_sep_state_def sep_state_disj_def zero_sep_state_def\n plus_sep_state_def sep_state_add_def)\n apply (metis map_add_subsumed1 map_le_refl sep_heap.simps sep_irq_node.simps sep_state.exhaust)\n by (metis map_add_left_eq sep_heap.simps sep_irq_node.simps sep_state.exhaust)\nend\n\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/sep-capDL/AbstractSeparation_SD.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.334589441253186, "lm_q1q2_score": 0.17121497284794415}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__54_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__54_on_rules imports n_germanSimp_lemma_on_inv__54\nbegin\nsection{*All lemmas on causal relation between inv__54*}\nlemma lemma_inv__54_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__54 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__54) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__54_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.1712149694526177}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__13_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__13_on_rules imports n_german_lemma_on_inv__13\nbegin\nsection{*All lemmas on causal relation between inv__13*}\nlemma lemma_inv__13_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__13 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__13) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__13) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__13_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.17097467990390294}} {"text": "theory Kernel_Execution\n \nimports Memory_Model\n \n\nbegin \n\n\n\n\nlemma [simp]:\n \"con_set S (s\\heap := hp , incon_set := IS, global_set := GS\\) = con_set S (s\\incon_set := IS\\) \"\n by (clarsimp simp: con_set_def)\n\nlemma [simp]:\n \"kernel_data_area (s\\heap := hp', global_set := GS\\) = kernel_data_area (s\\heap := hp'\\)\"\n by (clarsimp simp: kernel_data_area_def kernel_data_def ptable_footprint_def)\n \n\nlemma [simp]:\n \"kernel_data (s\\heap := hp', global_set := GS\\) = kernel_data (s\\heap := hp'\\) \"\n by (clarsimp simp: kernel_data_def ptable_footprint_def)\n \n\nlemma [simp]:\n \"kernel_mappings (s\\heap := hp', global_set := GS\\) = kernel_mappings (s\\heap := hp'\\) \"\n by (clarsimp simp: kernel_mappings_def global_mappings_def global_mappings'_def hptable_eq_def)\n \n\n\n lemma [simp]:\n \"kernel_safe (s\\heap := hp', global_set := GS \\) =\n kernel_safe (s\\heap := hp' \\) \"\n by (clarsimp simp: kernel_safe_def vas_of_current_state_mapped_to_global_mappings_of_all_processes_def)\n\n\n lemma [simp]:\n \"ptrace_set V (s\\heap := hp', global_set := GS \\) =\n ptrace_set V (s\\heap := hp' \\) \"\n by (clarsimp simp: ptrace_set_def)\n\n lemma [simp]:\n \"root_map (s\\heap := hp', global_set := GS \\) =\n root_map (s\\heap := hp' \\) \"\n by (clarsimp simp: root_map_def map_of_set_def root_set_def)\n\n\nlemma root_map_rootsD:\n \"root_map s r = Some a \\ r \\ roots s\"\n by (simp add: roots_def')\n\nlemma kernel_region_offset':\n \" mmu_layout s \\ mode s = Kernel \\\n \\va\\kernel_safe s. ptable_lift' (heap s) (root s) va = \n Some (Addr (addr_val va) r- global_offset)\"\n by (clarsimp simp: mmu_layout_def dest!: root_map_rootsD)\n\n\n\nlemma mmu_layout_ptable_comp':\n \"\\ mmu_layout s; p \\ kernel_data_area s \\ \\ \n incon_comp (asid s) (asid s) (heap s) (heap s(p \\ v)) (root s) (root s) = {}\"\n apply (simp add: incon_comp_def ptable_comp_def)\n apply (subgoal_tac \"root s \\ roots s\")\n apply (simp add: mmu_layout_pt_walk_pair')\n by (clarsimp simp: mmu_layout_def rootsI)\n\n\nlemma global_mappings_decode_mmu:\n \"\\mmu_layout s ; mode s = Kernel ; va \\ kernel_safe s\\ \\ \n \\p perm. decode_pde (the ((heap s) \n (root s r+ (vaddr_pd_index (addr_val va) << 2)))) = SectionPDE p perm\"\n apply (clarsimp simp: kernel_safe_def vas_mapped_by_global_mappings_def\n kernel_mappings_def global_mappings_def global_mappings'_def mmu_layout_def dest!: root_map_rootsD)\n apply (drule_tac x = \"root s\" in bspec)\n apply clarsimp\n apply clarsimp\n apply (drule_tac x = \"x\" in spec)\n by (clarsimp simp: get_pde'_def decode_heap_pde'_def)\n \n \n\nlemma global_high_ptable:\n \"\\ mmu_layout s ; mode s = Kernel ; Addr vp \\ (kernel_safe s) ;\n x \\ ptable_trace' (heap s) (root s) (Addr vp)\\\n \\ x \\ high_ptable (root s)\"\n apply (frule_tac va = \"Addr vp\" in global_mappings_decode_mmu ; clarsimp )\n apply (clarsimp simp: ptable_trace'_def Let_def)\n apply (clarsimp simp: mmu_layout_def kernel_safe_def vas_mapped_by_global_mappings_def\n vas_of_current_state_mapped_to_global_mappings_of_all_processes_def dest!: root_map_rootsD)\n apply (subgoal_tac \"xa = root s r+ (vaddr_pd_index vp << 2)\")\n apply (rule_tac x = \"root s\" in bexI)\n apply (clarsimp simp: pd_idx_offset_def)\n apply clarsimp\n by (clarsimp simp: ptable_trace'_def)\n\n\nlemma global_high_ptable':\n \"\\ mmu_layout s ; mode s = Kernel ; Addr vp \\ (kernel_safe s) \\ \\\n \\x\\ptable_trace' (heap s) (root s) (Addr vp).\n x \\ high_ptable (root s)\"\n by (clarsimp simp: global_high_ptable)\n \n\nlemma kernel_safe_region_ptable_trace'' [simp]:\n \" \\ mmu_layout s ; mode s = Kernel ; Addr vp' \\ kernel_safe s; \n vp \\ kernel_safe s\\ \\\n Addr (vp' - global_offset) \\ ptable_trace' (heap s) (root s) vp\"\n apply (frule_tac va = vp in global_mappings_decode_mmu)\n apply (clarsimp simp: mmu_layout_def)\n apply clarsimp\n apply (clarsimp simp: mmu_layout_def ptable_trace'_def kernel_safe_def Let_def\n vas_mapped_by_global_mappings_def \n vas_of_current_state_mapped_to_global_mappings_of_all_processes_def \n pd_idx_offset_def dest!: root_map_rootsD)\n done\n\n\nlemma mmu_layout_pt_comp_heap_same[simp]:\n \"\\ mmu_layout s; p \\ kernel_data_area s ; r \\ roots s\\\n \\ ptable_comp (snd (ptable_snapshot s a)) (pt_walk_pair a (heap s) r) = \n ptable_comp (snd (ptable_snapshot s a)) (pt_walk_pair a (heap s(p \\ v)) r)\"\n apply (subgoal_tac \"pt_walk_pair a (heap s(p \\ v)) r = pt_walk_pair a (heap s) r\")\n apply clarsimp\n by (rule mmu_layout_pt_walk_pair'; simp)\n\n\nlemma mmu_layout_global_heap_upd:\n \"\\mmu_layout s; p \\ kernel_data_area s\\\n \\ global_entries (ran (pt_walk (asid s) (heap s(p \\ v)) (root s))) = global_entries (ran (pt_walk (asid s) (heap s) (root s)))\"\n apply (subgoal_tac \"pt_walk (asid s) (heap s(p \\ v)) (root s) = pt_walk (asid s) (heap s) (root s)\")\n apply (clarsimp)\n apply (subst mmu_layout_pt_walk'; simp?)\n apply (clarsimp simp: mmu_layout_def roots_def)\n using rootsI roots_def by blast\n\n\nlemma mmu_layout_global_set_subset':\n \"\\mmu_layout s ; rt \\ roots s \\ \\ (\\x\\global_entries (ran (pt_walk a (heap s) rt)). range_of x) = \n {va::vaddr. rt r+ pd_idx_offset (addr_val va) \\ high_ptable rt}\"\n apply safe\n apply (rename_tac va e)\n apply (subgoal_tac \"global (heap s) rt va \\ (\\e. pt_walk a (heap s) rt va = Some e)\")\n apply (clarsimp simp: mmu_layout_def kernel_mappings_def global_mappings_def global_mappings'_def)\n apply (drule_tac x = rt in bspec, simp, clarsimp)\n apply (drule_tac x = \"addr_val va\" in spec, drule_tac x = \"addr_val va\" in spec)\n apply (case_tac \" rt r+ pd_idx_offset (addr_val va) \\ high_ptable rt\"; clarsimp)\n apply (clarsimp simp: global_def non_global_def is_fault_def pt_walk_def map_opt_def pdc_walk_def pte_tlb_entry_def\n split: option.splits pde.splits pte.splits)\n apply (subgoal_tac \"\\v'. e = the (pt_walk a (heap s) rt v') \\(\\e. pt_walk a (heap s) rt v' = Some e)\")\n prefer 2\n apply (clarsimp simp: global_entries_def ran_def is_fault_def)\n apply force\n apply clarsimp\n apply (subgoal_tac \"(\\e. pt_walk a (heap s) rt v' = Some e)\")\n prefer 2\n apply (clarsimp simp: global_entries_def ran_def) \n apply (subgoal_tac \"pt_walk a (heap s) rt v' = pt_walk a (heap s) rt va\")\n apply clarsimp\n apply (subgoal_tac \"asid_of (the (pt_walk a (heap s) rt va)) = None\")\n prefer 2\n apply (clarsimp simp: global_entries_def)\n apply (clarsimp simp: mmu_layout_def kernel_mappings_def global_mappings_def global_mappings'_def)\n apply (drule_tac x = rt in bspec, simp, clarsimp)\n apply (drule_tac x = \"addr_val va\" in spec, drule_tac x = \"addr_val va\" in spec)\n apply (case_tac \" rt r+ pd_idx_offset (addr_val va) \\ high_ptable rt\"; clarsimp)\n apply (clarsimp simp: global_def non_global_def is_fault_def pt_walk_def map_opt_def pdc_walk_def pte_tlb_entry_def\n split: option.splits pde.splits pte.splits)\n apply (clarsimp simp: global_def non_global_def is_fault_def pt_walk_def map_opt_def pdc_walk_def global_entries_def tag_conv_def \n pte_tlb_entry_def to_tlb_flags_def split: option.splits pde.splits pte.splits)\n apply (rule va_entry_set_pt_palk_same', simp add: is_fault_def, simp)\n apply clarsimp\n apply (rename_tac va)\n apply (subgoal_tac \"global (heap s) rt va \\ \\is_fault (pt_walk a (heap s) rt va)\")\n apply (rule_tac x = \"the (pt_walk a (heap s) rt va)\" in bexI, clarsimp)\n apply (simp add: pt_walk'_pt_walk [symmetric])\n apply (frule asid_va_entry_range_pt_entry, simp)\n apply (subgoal_tac \"asid_of (the (pt_walk a (heap s) rt va)) = None\")\n apply (clarsimp simp: global_entries_def is_fault_def ran_def) apply force\n apply (clarsimp simp: global_def is_fault_def pt_walk_def map_opt_def pdc_walk_def pte_tlb_entry_def tag_conv_def to_tlb_flags_def\n split: option.splits pde.splits pte.splits)\n apply (clarsimp simp: mmu_layout_def kernel_mappings_def global_mappings_def global_mappings'_def)\n apply (drule_tac x = rt in bspec, simp, clarsimp)\n apply (drule_tac x = \"addr_val va\" in spec, drule_tac x = \"addr_val va\" in spec)\n by (clarsimp simp: global_def non_global_def is_fault_def pt_walk_def map_opt_def pdc_walk_def pte_tlb_entry_def\n split: option.splits pde.splits pte.splits)\n\n\nlemma mmu_layout_global_set_subset:\n \"mmu_layout s \\ (\\x\\global_entries (ran (pt_walk (asid s) (heap s) (root s))). range_of x) = global_set s \"\n apply (frule_tac rt = \"root s\" and a = \"asid s\" in mmu_layout_global_set_subset') \n using mmu_layout_def rootsI apply force\n by (clarsimp simp: mmu_layout_def global_set_eq_def)\n \n\n\n\nlemma kernel_safe_assignment:\n \"\\ \\\\s. mmu_layout s \\ mode s = Kernel \\ safe_set (kernel_safe s) s \\\n asids_consistent {} s \\\n aval lval s = Some vp \\ aval rval s = Some v \\ \n Addr vp \\ (kernel_safe s) \\ k_phy_ad vp \\ kernel_data_area s \\\n lval ::= rval\n \\\\s. mmu_layout s \\ mode s = Kernel \\ safe_set (kernel_safe s) s \\ \n asids_consistent {} s \\ heap s (k_phy_ad vp) = Some v\\\"\n apply (vcgm vcg: weak_pre_write')\n apply (rule conjI)\n apply (clarsimp simp: asids_consistent_def safe_set_def con_set_def)\n apply (subgoal_tac \" ptable_lift' (heap s) (root s) (Addr vp) = Some (Addr vp r- global_offset)\")\n prefer 2\n apply (clarsimp simp: kernel_region_offset')\n apply (clarsimp simp: k_phy_ad_def mmu_layout_ptable_comp' mmu_layout_upd')\n apply (rule conjI)\n apply (clarsimp simp: mmu_layout_global_heap_upd)\n apply (frule_tac mmu_layout_global_set_subset, simp)\n apply (clarsimp simp: k_phy_ad_def mmu_layout_ptable_comp' mmu_layout_upd') \n apply (rule conjI)\n apply (subgoal_tac \"kernel_safe (s\\ heap := heap s(Addr (vp - global_offset) \\ v)\\) =\n kernel_safe s\")\n apply (clarsimp simp: safe_set_def safe_memory_def con_set_def)\n apply (drule_tac x = va in bspec; clarsimp)\n apply (rule_tac x = p in exI)\n apply (subgoal_tac \"ptable_lift' (heap s) (root s) va = \n ptable_lift' (heap s(Addr (vp - global_offset) \\ v)) (root s) va\")\n apply (rule conjI, clarsimp)\n apply (subgoal_tac \"ptrace_set (kernel_safe s) (s\\ heap := heap s(Addr (vp - global_offset) \\ v)\\) =\n ptrace_set (kernel_safe s) s\", clarsimp)\n prefer 3\n apply (frule_tac vp = vp in global_high_ptable', clarsimp, clarsimp)\n apply (clarsimp simp: kernel_safe_def vas_of_current_state_mapped_to_global_mappings_of_all_processes_def)\n apply (rule_tac x = \"root s\" in bexI, force)\n apply (clarsimp simp: mmu_layout_def dest!: root_map_rootsD)\n prefer 2 apply (rule pt_table_lift_trace_upd', clarsimp)\n apply (clarsimp simp: ptrace_set_def)\n apply safe\n apply (rule_tac a = xa in UN_I, clarsimp)\n prefer 2 apply (rule_tac a = xa in UN_I, clarsimp)\n apply (subgoal_tac \"ptable_trace' (heap s(Addr (vp - global_offset) \\ v)) (root s) xa =\n ptable_trace' (heap s) (root s) xa\", clarsimp)\n prefer 2\n apply (subgoal_tac \"ptable_trace' (heap s(Addr (vp - global_offset) \\ v)) (root s) xa =\n ptable_trace' (heap s) (root s) xa\" , clarsimp)\n apply (rule pt_trace_upd, clarsimp)\n apply (subgoal_tac \"ptable_trace' (heap s(Addr (vp - global_offset) \\ v)) (root s) xa =\n ptable_trace' (heap s) (root s) xa\" , clarsimp)\n apply (rule pt_trace_upd, clarsimp)\n apply (frule_tac mmu_layout_global_set_subset)\n apply (subgoal_tac \"(s\\heap := heap s(Addr (vp - global_offset) \\ v),\n global_set := global_set s \\ (\\x\\global_entries (ran (pt_walk (asid s) (heap s(Addr (vp - global_offset) \\ v)) (root s))). range_of x)\\) =\n s\\heap := heap s(Addr (vp - global_offset) \\ v)\\\")\n apply simp\n apply (clarsimp simp: asids_consistent_def)\n apply (rule)\n apply clarsimp\n apply (subgoal_tac \"pt_walk_pair a (heap s(Addr (vp - global_offset) \\ v)) r = pt_walk_pair a (heap s) r\")\n apply force\n apply (rule mmu_layout_pt_walk_pair', simp, simp, simp add: roots_def) \n using root_map_rootsD roots_def apply force\n apply clarsimp\n apply (subgoal_tac \"pt_walk_pair a (heap s(Addr (vp - global_offset) \\ v)) r = pt_walk_pair a (heap s) r\")\n apply force\n apply (rule mmu_layout_pt_walk_pair'; simp add: roots_def) \n apply (subgoal_tac \"pt_walk (asid s) (heap s(Addr (vp - global_offset) \\ v)) (root s) = pt_walk (asid s) (heap s) (root s)\")\n apply clarsimp\n apply (rule mmu_layout_pt_walk'; simp add: roots_def)\n using mmu_layout_def rootsI roots_def by auto\n\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Logic/Kernel_Execution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.33111974622959367, "lm_q1q2_score": 0.1707319356451294}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n Retype refinement\n*)\n\ntheory Retype_R\nimports TcbAcc_R VSpace_R\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n APIType_map2 :: \"kernel_object + X64_H.object_type \\ Structures_A.apiobject_type\"\nwhere\n \"APIType_map2 ty \\ case ty of\n Inr (APIObjectType ArchTypes_H.Untyped) \\ Structures_A.Untyped\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Structures_A.TCBObject\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Structures_A.EndpointObject\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Structures_A.NotificationObject\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Structures_A.CapTableObject\n | Inr LargePageObject \\ ArchObject LargePageObj\n | Inr HugePageObject \\ ArchObject HugePageObj\n | Inr PageTableObject \\ ArchObject PageTableObj\n | Inr PageDirectoryObject \\ ArchObject PageDirectoryObj\n | Inr PDPointerTableObject \\ ArchObject PDPTObj\n | Inr PML4Object \\ ArchObject PML4Obj\n | Inl (KOArch (KOASIDPool _)) \\ ArchObject ASIDPoolObj\n | _ \\ ArchObject SmallPageObj\"\n\nlemma placeNewObject_def2:\n \"placeNewObject ptr val gb = createObjects' ptr 1 (injectKO val) gb\"\n apply (clarsimp simp:placeNewObject_def placeNewObject'_def\n createObjects'_def shiftL_nat)\n done\n\nlemma createObjects_ret:\n \"\\n < 2^word_bits;n\\ 0\\ \\\n \\\\\\ createObjects y n ko gbits\n \\\\r s. r = map (\\p. ptr_add y (p * 2 ^ objBitsKO ko * 2 ^ gbits))\n [0..< n]\\\"\n unfolding createObjects_def createObjects'_def\n apply (simp add: split_def)\n apply (wp|simp cong: if_cong)+\n apply (clarsimp simp: ptr_add_def upto_enum_def o_def\n unat_sub word_le_nat_alt\n power_sub[symmetric]\n objBits_def[symmetric]\n simp del: upt_Suc)\n apply (clarsimp simp: unat_of_nat_minus_1 word_bits_def\n shiftl_t2n power_add)\n done\n\nlemma objBitsKO_bounded2[simp]:\n \"objBitsKO ko < word_bits\"\n by (simp add: objBits_simps' word_bits_def pageBits_def archObjSize_def\n split: Structures_H.kernel_object.split arch_kernel_object.split)\n\ndefinition\n APIType_capBits :: \"X64_H.object_type \\ nat \\ nat\"\nwhere\n \"APIType_capBits ty us \\ case ty of\n APIObjectType ArchTypes_H.Untyped \\ us\n | APIObjectType ArchTypes_H.TCBObject \\ objBits (makeObject :: tcb)\n | APIObjectType ArchTypes_H.EndpointObject \\ objBits (makeObject :: endpoint)\n | APIObjectType ArchTypes_H.NotificationObject \\ objBits (makeObject :: Structures_H.notification)\n | APIObjectType ArchTypes_H.CapTableObject \\ objBits (makeObject :: cte) + us\n | SmallPageObject \\ pageBitsForSize X64SmallPage\n | LargePageObject \\ pageBitsForSize X64LargePage\n | HugePageObject \\ pageBitsForSize X64HugePage\n | PageTableObject \\ 12\n | PageDirectoryObject \\ 12\n | PDPointerTableObject \\ 12\n | PML4Object \\ 12\"\n\ndefinition\n makeObjectKO :: \"bool \\ (kernel_object + X64_H.object_type) \\ kernel_object\"\nwhere\n \"makeObjectKO dev ty \\ case ty of\n Inl KOUserData \\ Some KOUserData\n | Inl (KOArch (KOASIDPool _)) \\ Some (KOArch (KOASIDPool makeObject))\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Some (KOTCB makeObject)\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Some (KOEndpoint makeObject)\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Some (KONotification makeObject)\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Some (KOCTE makeObject)\n | Inr PageTableObject \\ Some (KOArch (KOPTE makeObject))\n | Inr PageDirectoryObject \\ Some (KOArch (KOPDE makeObject))\n | Inr PDPointerTableObject \\ Some (KOArch (KOPDPTE makeObject))\n | Inr PML4Object \\ Some (KOArch (KOPML4E makeObject))\n | Inr SmallPageObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | Inr LargePageObject \\ Some(if dev then KOUserDataDevice else KOUserData)\n | Inr HugePageObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | _ \\ None\"\n\ntext \\makeObject etc. lemmas\\\n\nlemma NullCap_valid' [iff]: \"s \\' capability.NullCap\"\n unfolding valid_cap'_def by simp\n\nlemma valid_obj_makeObject_cte [simp]:\n \"valid_obj' (KOCTE makeObject) s\"\n unfolding valid_obj'_def valid_cte'_def\n by (clarsimp simp: makeObject_cte)\n\nlemma valid_obj_makeObject_tcb [simp]:\n \"valid_obj' (KOTCB makeObject) s\"\n unfolding valid_obj'_def valid_tcb'_def valid_tcb_state'_def\n by (clarsimp simp: makeObject_tcb makeObject_cte tcb_cte_cases_def minBound_word)\n\nlemma valid_obj_makeObject_endpoint [simp]:\n \"valid_obj' (KOEndpoint makeObject) s\"\n unfolding valid_obj'_def valid_ep'_def\n by (clarsimp simp: makeObject_endpoint)\n\nlemma valid_obj_makeObject_notification [simp]:\n \"valid_obj' (KONotification makeObject) s\"\n unfolding valid_obj'_def valid_ntfn'_def\n by (clarsimp simp: makeObject_notification)\n\nlemma valid_obj_makeObject_user_data [simp]:\n \"valid_obj' (KOUserData) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_user_data_device [simp]:\n \"valid_obj' (KOUserDataDevice) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_pte[simp]:\n \"valid_obj' (KOArch (KOPTE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pte)\n\nlemma valid_obj_makeObject_pde[simp]:\n \"valid_obj' (KOArch (KOPDE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pde)\n\nlemma valid_obj_makeObject_pdpte[simp]:\n \"valid_obj' (KOArch (KOPDPTE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pdpte)\n\nlemma valid_obj_makeObject_pml4e[simp]:\n \"valid_obj' (KOArch (KOPML4E makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pml4e)\n\nlemma valid_obj_makeObject_asid_pool[simp]:\n \"valid_obj' (KOArch (KOASIDPool makeObject)) s\"\n unfolding valid_obj'_def\n by (simp add: makeObject_asidpool Let_def ran_def dom_def)\n\nlemmas valid_obj_makeObject_rules =\n valid_obj_makeObject_user_data valid_obj_makeObject_tcb\n valid_obj_makeObject_endpoint valid_obj_makeObject_notification\n valid_obj_makeObject_cte valid_obj_makeObject_pte valid_obj_makeObject_pde\n valid_obj_makeObject_asid_pool valid_obj_makeObject_user_data_device\n valid_obj_makeObject_pdpte valid_obj_makeObject_pml4e\n\ntext \\On the abstract side\\\n\ntext \\Lemmas for createNewObjects etc.\\\n\nlemma pspace_dom_upd:\n assumes orth: \"set as \\ dom ps = {}\"\n shows \"pspace_dom (foldr (\\p ps. ps(p \\ ko)) as ps) =\n pspace_dom ps \\ (\\x \\ set as. fst ` obj_relation_cuts ko x)\"\n using orth\n apply (subst foldr_upd_app_if)\n apply (rule set_eqI, simp add: pspace_dom_def)\n apply (rule iffI)\n apply (clarsimp split: if_split_asm)\n apply (rule rev_bexI, erule domI)\n apply (fastforce simp: image_def)\n apply (erule disjE)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule exI)\n apply clarsimp\n apply (intro conjI impI)\n apply (drule equals0D, erule notE, erule IntI, erule domI)\n apply (fastforce simp: image_def)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule(1) notE)\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\ndefinition\n \"new_cap_addrs \\ \\n ptr ko. map (\\p. ptr + ((of_nat p :: machine_word) << (objBitsKO ko)))\n [0 ..< n]\"\n\ndefinition\n null_filter' :: \"('a \\ cte) \\ ('a \\ cte)\"\nwhere\n \"null_filter' f \\ \\x. if f x = Some (CTE NullCap nullMDBNode) then None else f x\"\n\nlemma across_null_filter_eq':\n assumes eq: \"null_filter' xs = null_filter' ys\"\n shows \"\\ xs x = Some v; ys x = Some v \\ R;\n \\ v = CTE NullCap nullMDBNode; ys x = None \\ \\ R \\\n \\ R\"\n apply (cases \"null_filter' xs x\")\n apply (subgoal_tac \"null_filter' ys x = None\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n apply (subgoal_tac \"null_filter' ys x = Some a\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n done\n\nlemma null_filter_parent_of'':\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ c; c \\ 0 \\\n \\ ys \\ x \\ c\"\n apply (clarsimp simp add: mdb_next_unfold)\n apply (drule arg_cong[where f=\"\\xs. xs x\"])\n apply (simp add: null_filter'_def nullPointer_def split: if_split_asm)\n done\n\nlemma null_filter_parentOf:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x parentOf y \\\n \\ ys \\ x parentOf y\"\n apply (clarsimp simp add: parentOf_def)\n apply (rule across_null_filter_eq'[where x=x], assumption+)\n apply (erule(1) across_null_filter_eq')\n apply clarsimp\n apply simp\n apply simp\n done\n\nlemma null_filter_descendant:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ y \\\n \\ ys \\ x \\ y\"\n apply (erule subtree.induct)\n apply (rule subtree.direct_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n apply (erule subtree.trans_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n done\n\nlemma null_filter_descendants_of':\n \"null_filter' xs = null_filter' ys\n \\ descendants_of' x xs = descendants_of' x ys\"\n apply (simp add: descendants_of'_def)\n apply (rule set_eqI, rule iffI)\n apply simp\n apply (erule(1) null_filter_descendant)\n apply simp\n apply (erule(1) null_filter_descendant[OF sym])\n done\n\nlemma descendants_of_cte_at':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\\n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD2)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\nlemma descendants_of_cte_at2':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\\n \\ cte_wp_at (\\c. c \\ cap.NullCap) x s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\nlemma cte_at_next_slot'':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list s; valid_mdb s; finite_depth (cdt s)\\\n \\ next_slot p (cdt_list s) (cdt s) = Some n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply(simp add: next_slot_def)\n apply(simp split: if_split_asm)\n apply(drule next_childD, simp)\n apply(rule_tac p=n in descendants_of_cte_at2')\n apply(simp add: child_descendant)\n apply(simp)\n apply(subgoal_tac \"next_not_child_dom (p, cdt_list s, cdt s)\")\n prefer 2\n apply(simp add: next_not_child_termination valid_mdb_def valid_list_def)\n apply(simp split: if_split_asm)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n done\n\n\nlemma state_relation_null_filterE:\n \"\\ (s, s') \\ state_relation; t = kheap_update f (ekheap_update ef s);\n \\f' g' h'.\n t' = s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\;\n null_filter (caps_of_state t) = null_filter (caps_of_state s);\n null_filter' (ctes_of t') = null_filter' (ctes_of s');\n pspace_relation (kheap t) (ksPSpace t');\n ekheap_relation (ekheap t) (ksPSpace t');\n ghost_relation (kheap t) (gsUserPages t') (gsCNodes t'); valid_list s;\n pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s;\n pspace_aligned' t'; pspace_distinct' t';\n mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s) \\\n \\ (t, t') \\ state_relation\"\n apply (clarsimp simp: state_relation_def)\n apply (intro conjI)\n apply (simp add: cdt_relation_def cte_wp_at_caps_of_state)\n apply (elim allEI)\n apply clarsimp\n apply (erule(1) across_null_filter_eq)\n apply simp\n apply (rule null_filter_descendants_of', simp)\n apply simp\n apply (case_tac \"cdt s (a, b)\")\n apply (subst mdb_cte_at_no_descendants, assumption)\n apply (simp add: cte_wp_at_caps_of_state swp_def)\n apply (cut_tac s=\"kheap_update f (ekheap_update ef s)\" and\n s'=\"s'\\ksPSpace := f' (ksPSpace s'),\n gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n in pspace_relation_ctes_ofI, simp_all)[1]\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n apply (erule caps_of_state_cteD)\n apply (clarsimp simp: descendants_of'_def)\n apply (case_tac cte)\n apply (erule Null_not_subtree[rotated])\n apply simp\n apply (drule(1) mdb_cte_atD)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply(simp add: cdt_list_relation_def cte_wp_at_caps_of_state)\n apply(elim allEI)\n apply(clarsimp)\n apply(case_tac \"next_slot (a, b) (cdt_list (s)) (cdt s)\")\n apply(simp)\n apply(subgoal_tac \"cte_wp_at (\\c. c \\ cap.NullCap) (a, b) s\")\n apply(drule_tac f=\"\\cs. cs (a, b)\" in arg_cong)\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(clarsimp simp: null_filter_def split: if_split_asm)\n apply(drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply(simp add: null_filter'_def cte_wp_at_ctes_of split: if_split_asm)\n apply(frule pspace_relation_cte_wp_at)\n apply(simp add: cte_wp_at_caps_of_state)\n apply(simp)\n apply(simp)\n apply(simp add: cte_wp_at_ctes_of)\n apply (simp add: mdb_cte_at_def)\n apply(frule finite_depth)\n apply(frule(3) cte_at_next_slot'')\n apply simp\n apply (simp add: revokable_relation_def)\n apply (elim allEI, rule impI, drule(1) mp, elim allEI)\n apply (clarsimp elim!: null_filterE)\n apply (drule(3) pspace_relation_cte_wp_at [OF _ caps_of_state_cteD])\n apply (drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply (clarsimp simp: null_filter'_def cte_wp_at_ctes_of\n split: if_split_asm)\n done\n\nlemma lookupAround2_pspace_no:\n \"is_aligned ptr sz \\\n (case fst (lookupAround2 (ptr + 2 ^ sz - 1) ps) of None \\ return ()\n | Some (x, y) \\ haskell_assert (x < fromPPtr ptr) [])\n = assert ({ptr..ptr + 2 ^ sz - 1} \\ dom ps = {})\"\n apply (simp add: assert_def split: option.split)\n apply safe\n apply (clarsimp simp: lookupAround2_None1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (drule_tac a=a in equals0D)\n apply (simp add: linorder_not_less)\n apply fastforce\n done\n\nlemma pspace_no_overlap_disjoint':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s\\\n \\ {x .. (x && ~~ mask n) + 2 ^ n - 1} \\ dom (ksPSpace s) = {}\"\n unfolding pspace_no_overlap'_def\n apply (rule disjointI)\n apply (rule ccontr)\n apply clarsimp\n apply (elim allE impE notE)\n apply (simp add:field_simps)+\n apply (erule(2) order_trans[OF _ is_aligned_no_overflow,OF _ pspace_alignedD'])\n apply (erule(1) is_aligned_no_overflow[OF pspace_alignedD'])\n apply (erule order_trans)\n apply (simp add:p_assoc_help)\ndone\n\nlemma foldr_update_ko_wp_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"ko_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then P obj\n else ko_wp_at' P p s)\"\n (is \"ko_wp_at' P p ?s' = ?Q\")\n apply (clarsimp simp: ko_wp_at'_def projectKOs al)\n apply (intro conjI impI)\n apply safe[1]\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n apply safe[1]\n apply (simp add: ps_clear_def dom_if_Some)\n apply blast\n apply simp\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n done\n\nlemma foldr_update_obj_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"obj_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then (\\obj'. projectKO_opt obj = Some obj' \\ P obj')\n else obj_at' P p s)\"\n apply (simp only: obj_at'_real_def)\n apply (rule foldr_update_ko_wp_at' [OF pv pv' al])\n done\n\nlemma makeObjectKO_eq:\n assumes x: \"makeObjectKO dev tp = Some v\"\n shows\n \"(v = KOCTE cte) =\n (tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ cte = makeObject)\"\n \"(v = KOTCB tcb) =\n (tp = Inr (APIObjectType ArchTypes_H.TCBObject) \\ tcb = makeObject)\"\n using x\n by (simp add: makeObjectKO_def eq_commute\n split: apiobject_type.split_asm sum.split_asm kernel_object.split_asm\n X64_H.object_type.split_asm arch_kernel_object.split_asm)+\n\nlemma pspace_no_overlap_base':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s; is_aligned x n \\ \\ ksPSpace s x = None\"\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule equals0D[where a=x])\n apply (rule ccontr, clarsimp)\n apply (erule is_aligned_get_word_bits)\n apply (erule impE)\n apply (frule mask_out_add_aligned[where q = 0,simplified,symmetric])\n apply (fastforce simp add: is_aligned_no_overflow)\n apply clarsimp+\n done\n\nlemma the_ctes_makeObject:\n \"fst (the (tcb_cte_cases n)) makeObject\n = (if tcb_cte_cases n = None\n then fst (the None :: (Structures_H.tcb \\ cte) \\ ((cte \\ cte) \\ Structures_H.tcb \\ Structures_H.tcb))\n (makeObject :: tcb)\n else makeObject)\"\n apply (simp add: makeObject_tcb)\n apply (clarsimp simp: tcb_cte_cases_def)\n done\n\nlemma cte_wp_at_obj_cases_mask:\n \"cte_wp_at' P p s =\n (obj_at' P p s \\\n (p && mask tcbBlockSizeBits \\ dom tcb_cte_cases\n \\ obj_at' (P \\ fst (the (tcb_cte_cases (p && mask tcbBlockSizeBits))))\n (p && ~~ mask tcbBlockSizeBits) s))\"\n apply (simp add: cte_wp_at_obj_cases')\n apply (rule arg_cong [where f=\"\\x. F \\ x\" for F])\n apply (rule iffI)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (frule(1) tcb_cte_cases_aligned_helpers)\n apply fastforce\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (rule bexI[where x=\"p && mask tcbBlockSizeBits\"])\n apply (clarsimp simp: subtract_mask)\n apply fastforce\n done\n\nlemma ps_clearD:\n \"\\ ps_clear x n s; ksPSpace s y = Some v; x < y; y \\ x + 2 ^ n - 1 \\ \\ False\"\n apply (clarsimp simp: ps_clear_def)\n apply (drule_tac a=y in equals0D)\n apply (simp add: dom_def)\n apply fastforce\n done\n\nlemma cte_wp_at_retype':\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"cte_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ p \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (p && ~~ mask tcbBlockSizeBits \\ set addrs) \\ (p && mask tcbBlockSizeBits \\ dom tcb_cte_cases)\n then P (CTE NullCap nullMDBNode)\n else cte_wp_at' P p s)\"\n (is \"cte_wp_at' P p ?s' = ?Q\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: cte \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: tcb \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"(\\P :: cte \\ bool. obj_at' P p ?s')\n \\ (\\ (\\P :: tcb \\ bool. obj_at' P (p && ~~ mask tcbBlockSizeBits) ?s'))\")\n apply (simp only: cte_wp_at_obj_cases_mask foldr_update_obj_at'[OF pv pv' al])\n apply (simp add: projectKOs the_ctes_makeObject\n makeObjectKO_eq [OF ko]\n makeObject_cte dom_def\n split del: if_split\n cong: if_cong)\n apply (insert al ko)\n apply (simp, safe, simp_all)\n apply fastforce\n apply fastforce\n apply (clarsimp elim!: obj_atE' simp: projectKOs objBits_simps)\n apply (drule ps_clearD[where y=p and n=tcbBlockSizeBits])\n apply simp\n apply (rule order_trans_rules(17))\n apply (clarsimp cong: if_cong)\n apply (rule word_and_le2)\n apply (simp add: word_neg_and_le[simplified field_simps])\n apply simp\n apply (clarsimp elim!: obj_atE' simp: pn)\n apply (clarsimp elim!: obj_atE' simp: pn)\n done\n\nlemma ctes_of_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"map_to_ctes (\\ xa. if xa \\ set addrs then Some obj else ksPSpace s xa)\n = (\\x. if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ x \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (x && ~~ mask tcbBlockSizeBits \\ set addrs) \\ (x && mask tcbBlockSizeBits \\ dom tcb_cte_cases)\n then Some (CTE NullCap nullMDBNode)\n else map_to_ctes (ksPSpace s) x)\"\n (is \"map_to_ctes ?ps' = ?map'\")\n using cte_wp_at_retype' [where P=\"(=) cte\" for cte, OF ko pv pv' al pn]\n arg_cong [where f=Not, OF cte_wp_at_retype' [OF ko pv pv' al pn, where P=\"\\\"]]\n apply (simp(no_asm_use) add: cte_wp_at_ctes_of cong: if_cong)\n apply (rule ext)\n apply (case_tac \"map_to_ctes ?ps' x\")\n apply (simp(no_asm_simp))\n apply (simp split: if_split_asm)\n apply simp\n done\n\nlemma None_ctes_of_cte_at:\n \"(None = ctes_of s x) = (\\ cte_at' x s)\"\n by (fastforce simp add: cte_wp_at_ctes_of)\n\nlemma null_filter_ctes_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"null_filter' (map_to_ctes (foldr (\\addr. data_map_insert addr obj) addrs (ksPSpace s)))\n = null_filter' (map_to_ctes (ksPSpace s))\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (subst ctes_of_retype[OF ko pv pv' al pn])\n apply (rule ext)\n apply (clarsimp simp: null_filter'_def None_ctes_of_cte_at)\n apply (intro conjI impI notI)\n apply (elim cte_wp_atE' disjE conjE)\n apply (simp_all add: pn)\n apply (cut_tac x=\"ptr'\" and v=\"if ptr' \\ set addrs then obj else KOTCB tcb\"\n in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (insert ko[symmetric],\n simp add: makeObjectKO_def objBits_simps pn\n split: if_split_asm)[1]\n apply (drule(2) tcb_ctes_clear[where s=\"ksPSpace_update f s\" for f s])\n apply simp\n apply fastforce\n apply (cut_tac x=\"x && ~~ mask tcbBlockSizeBits\" in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (elim cte_wp_atE' disjE conjE)\n apply (insert ko[symmetric], simp add: makeObjectKO_def objBits_simps)\n apply clarsimp\n apply (subst(asm) subtract_mask[symmetric],\n erule_tac v=\"if x \\ set addrs then KOTCB makeObject else KOCTE cte\"\n in tcb_space_clear)\n apply (simp add: is_aligned_mask word_bw_assocs)\n apply assumption\n apply simp\n apply simp\n apply (simp add: pn)\n apply (clarsimp simp: makeObjectKO_def)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (clarsimp simp: pn)\n done\n\nlemma new_cap_addrs_aligned:\n \"\\ is_aligned ptr (objBitsKO ko) \\\n \\ \\x \\ set (new_cap_addrs n ptr ko). is_aligned x (objBitsKO ko)\"\n apply (clarsimp simp: new_cap_addrs_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_shift])\n apply simp\n done\n\nlemma new_cap_addrs_distinct:\n assumes cover: \"range_cover ptr sz (objBitsKO ko) n\"\n shows \"distinct (new_cap_addrs n ptr ko)\"\n unfolding new_cap_addrs_def\n apply (simp add: distinct_map)\n apply (rule comp_inj_on[where f=of_nat, unfolded o_def])\n apply (rule subset_inj_on)\n apply (rule word_unat.Abs_inj_on)\n apply (clarsimp simp only: unats_def atLeastLessThan_iff\n dest!: less_two_pow_divD)\n apply (insert cover)\n apply (erule less_le_trans)\n apply (insert range_cover.range_cover_n_le[OF cover])\n apply (erule le_trans)\n apply (cases \"objBitsKO ko = 0\")\n apply (simp add:word_bits_def)\n apply (rule less_imp_le)\n apply (rule power_strict_increasing)\n apply (simp add:word_bits_def)\n apply simp\n apply (rule inj_onI)\n apply clarsimp\n apply (drule arg_cong[where f=\"\\x. x >> objBitsKO ko\"])\n apply (cases \"objBitsKO ko = 0\")\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply assumption\n done\n\nlemma new_cap_addrs_subset:\n assumes range_cover:\"range_cover ptr sz (objBitsKO ko) n\"\n shows \"set (new_cap_addrs n ptr ko) \\ {ptr .. ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n apply (clarsimp simp add: new_cap_addrs_def shiftl_t2n\n field_simps\n dest!: less_two_pow_divD)\n apply (intro conjI)\n apply (insert range_cover)\n apply (rule machine_word_plus_mono_right_split[OF range_cover.range_cover_compare])\n apply assumption\n apply simp\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:ptr_add_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (drule(1) range_cover.range_cover_compare)\n apply (rule iffD1[OF le_m1_iff_lt,THEN iffD2])\n using range_cover\n apply (simp add: p2_gt_0 range_cover_def word_bits_def)\n apply (rule iffD2[OF word_less_nat_alt])\n apply (rule le_less_trans[OF unat_plus_gt])\n using range_cover\n apply (clarsimp simp: range_cover_def)\n apply (insert range_cover)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def)+\ndone\n\ndefinition\n obj_relation_retype :: \"Structures_A.kernel_object \\\n Structures_H.kernel_object \\ bool\"\nwhere\n \"obj_relation_retype ko ko' \\\n obj_bits ko \\ objBitsKO ko'\n \\ (\\p. fst ` obj_relation_cuts ko p\n = {p + x * 2 ^ (objBitsKO ko') | x. x < 2 ^ (obj_bits ko - objBitsKO ko')}\n \\ (\\x \\ obj_relation_cuts ko p. snd x ko ko'))\"\n\nlemma obj_relation_retype_cutsD:\n \"\\ (x, P) \\ obj_relation_cuts ko p; obj_relation_retype ko ko' \\\n \\ \\y. x = p + y * 2 ^ (objBitsKO ko') \\ y < 2 ^ (obj_bits ko - objBitsKO ko')\n \\ P ko ko'\"\n apply (clarsimp simp: obj_relation_retype_def)\n apply (drule spec[where x=p])\n apply clarsimp\n apply (drule(1) bspec)\n apply (drule arg_cong[where f=\"\\S. x \\ S\"])\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\nlemma APIType_map2_Untyped[simp]:\n \"(APIType_map2 tp = Structures_A.Untyped)\n = (tp = Inr (APIObjectType ArchTypes_H.Untyped))\"\n by (simp add: APIType_map2_def\n split: sum.split object_type.split kernel_object.split arch_kernel_object.splits\n apiobject_type.split)\n\nlemma obj_relation_retype_leD:\n \"\\ obj_relation_retype ko ko' \\\n \\ objBitsKO ko' \\ obj_bits ko\"\n by (simp add: obj_relation_retype_def)\n\nlemma obj_relation_retype_default_leD:\n \"\\ obj_relation_retype (default_object (APIType_map2 ty) dev us) ko;\n ty \\ Inr (APIObjectType ArchTypes_H.Untyped) \\\n \\ objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n by (simp add: obj_relation_retype_def objBits_def obj_bits_dev_irr)\n\nlemma makeObjectKO_Untyped:\n \"makeObjectKO dev ty = Some v \\ ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (clarsimp simp: makeObjectKO_def)\n\nlemma obj_relation_cuts_trivial:\n \"ptr \\ fst ` obj_relation_cuts x ptr\"\n apply (case_tac x)\n apply (rename_tac sz cs)\n apply (clarsimp simp:image_def cte_map_def well_formed_cnode_n_def)\n apply (rule_tac x = \"replicate sz False\" in exI)\n apply clarsimp+\n apply (rename_tac arch_kernel_obj)\n apply (case_tac arch_kernel_obj)\n apply clarsimp\n apply (simp_all add:image_def pageBits_def)\n apply (rule_tac x = 0 in exI, simp)+\n apply (rule p2_gt_0[THEN iffD2])\n apply (rename_tac vmpage_size)\n by (case_tac vmpage_size;\n clarsimp simp:pageBitsForSize_def bit_simps)\n\nlemma obj_relation_retype_addrs_eq:\n assumes not_unt:\"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n assumes amp: \"m = 2^ ((obj_bits_api (APIType_map2 ty) us) - (objBitsKO ko)) * n\"\n assumes orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n shows \"\\ range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n \\ \\\n (\\x \\ set (retype_addrs ptr (APIType_map2 ty) n us).\n fst ` obj_relation_cuts (default_object (APIType_map2 ty) dev us) x)\n = set (new_cap_addrs m ptr ko)\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: retype_addrs_def)\n apply (rename_tac p a b)\n apply (drule obj_relation_retype_cutsD[OF _ orr])\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (clarsimp simp: new_cap_addrs_def image_def\n dest!: less_two_pow_divD)\n apply (rule_tac x=\"p * 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) + unat y\"\n in rev_bexI)\n apply (simp add: amp obj_bits_api_default_object not_unt obj_bits_dev_irr)\n apply (rule less_le_trans[OF nat_add_left_cancel_less[THEN iffD2]])\n apply (erule unat_mono)\n apply (subst unat_power_lower)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def\n split: Structures_A.apiobject_type.splits)\n apply (simp add:field_simps,subst mult_Suc[symmetric])\n apply (rule mult_le_mono1)\n apply simp\n apply (simp add: ptr_add_def shiftl_t2n field_simps\n objBits_def[symmetric] word_unat_power[symmetric])\n apply (simp add: power_add[symmetric])\n apply (clarsimp simp: new_cap_addrs_def retype_addrs_def\n dest!: less_two_pow_divD)\n apply (rename_tac p)\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (cut_tac obj_relation_retype_leD[OF orr])\n apply (case_tac \"n = 0\")\n apply (simp add:amp)\n apply (case_tac \"p = 0\")\n apply simp\n apply (rule_tac x = 0 in rev_bexI)\n apply simp+\n apply (rule obj_relation_cuts_trivial)\n apply (rule_tac x=\"p div (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko))\"\n in rev_bexI)\n apply (simp add:amp)\n apply (rule td_gal_lt[THEN iffD1])\n apply (simp add:field_simps)+\n using orr\n apply (clarsimp simp: obj_relation_retype_def ptr_add_def)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule_tac x=\"of_nat (p mod (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko)))\" in exI)\n apply (simp only: word_unat_power Abs_fnat_homs shiftl_t2n)\n apply (rule conjI)\n apply (rule arg_cong[where f=of_nat])\n apply (subst mult_div_rearrange)\n apply simp\n apply (subst minus_mod_eq_mult_div[symmetric])\n apply (simp add:diff_mult_distrib2)\n apply (rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def obj_bits_api_default_object obj_bits_dev_irr\n not_unt word_bits_def)+\ndone\n\nlemma objBits_le_obj_bits_api:\n \"makeObjectKO dev ty = Some ko \\\n objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n apply (case_tac ty)\n apply (auto simp: default_arch_object_def archObjSize_def bit_simps\n makeObjectKO_def objBits_simps' APIType_map2_def obj_bits_api_def slot_bits_def\n split: Structures_H.kernel_object.splits arch_kernel_object.splits object_type.splits\n Structures_H.kernel_object.splits arch_kernel_object.splits apiobject_type.splits)\n done\n\n\nlemma obj_relation_retype_other_obj:\n \"\\ is_other_obj_relation_type (a_type ko); other_obj_relation ko ko' \\\n \\ obj_relation_retype ko ko'\"\n apply (simp add: obj_relation_retype_def)\n apply (subgoal_tac \"objBitsKO ko' = obj_bits ko\")\n apply (clarsimp simp: is_other_obj_relation_type)\n apply (fastforce simp: other_obj_relation_def objBits_simps' archObjSize_def\n split: Structures_A.kernel_object.split_asm\n Structures_H.kernel_object.split_asm\n Structures_H.kernel_object.split\n arch_kernel_obj.split_asm arch_kernel_object.split)\n done\n\nlemma retype_pspace_relation:\n assumes sr: \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"pspace_relation (foldr (\\p ps. ps(p \\ default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"pspace_relation ?ps ?ps'\")\n unfolding pspace_relation_def\nproof\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n\n have dom_not_ra:\n \"\\x \\ dom (kheap s). x \\ set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply clarsimp\n apply (erule(1) pspace_no_overlapC[OF pn _ _ cover vs(1)])\n done\n\n hence dom_Int_ra:\n \"set (retype_addrs ptr (APIType_map2 ty) n us) \\ dom (kheap s) = {}\"\n by auto\n\n note pdom = pspace_dom_upd [OF dom_Int_ra, where ko=\"default_object (APIType_map2 ty) dev us\"]\n\n have pdom': \"dom ?ps' = dom (ksPSpace s') \\ set (new_cap_addrs m ptr ko)\"\n by (clarsimp simp add: foldr_upd_app_if[folded data_map_insert_def]\n dom_if_Some Un_commute\n split del: if_split)\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n\n have \"pspace_dom (kheap s) = dom (ksPSpace s')\"\n using sr by (simp add: pspace_relation_def)\n\n thus \"pspace_dom ?ps = dom ?ps'\"\n apply (simp add: pdom pdom')\n apply (rule arg_cong[where f=\"\\T. S \\ T\" for S])\n apply (rule obj_relation_retype_addrs_eq[OF not_unt num_r orr cover])\n done\n\n have dom_same:\n \"\\x v. kheap s x = Some v \\ ?ps x = Some v\"\n apply (frule bspec [OF dom_not_ra, OF domI])\n apply (simp add: foldr_upd_app_if)\n done\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have dom_same':\n \"\\x v. ksPSpace s' x = Some v \\ ?ps' x = Some v\"\n apply (clarsimp simp:foldr_upd_app_if[folded data_map_insert_def])\n apply (drule domI[where m = \"ksPSpace s'\"])\n apply (drule(1) IntI)\n apply (erule_tac A = \"A \\ B\" for A B in in_emptyE[rotated])\n apply (rule disjoint_subset[OF new_cap_addrs_subset[OF cover']])\n apply (clarsimp simp:ptr_add_def field_simps)\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n done\n\n show \"\\x \\ dom ?ps. \\(y, P) \\ obj_relation_cuts (the (?ps x)) x.\n P (the (?ps x)) (the (?ps' y))\"\n using sr\n apply (clarsimp simp: pspace_relation_def)\n apply (simp add: foldr_upd_app_if split: if_split_asm)\n apply (clarsimp simp: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule conjI)\n apply (drule obj_relation_retype_cutsD [OF _ orr], clarsimp)\n apply (rule impI, erule notE)\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (erule rev_bexI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n apply (drule bspec, erule domI)\n apply clarsimp\n apply (drule(1) bspec, simp)\n apply (subgoal_tac \"a \\ pspace_dom (kheap s)\")\n apply clarsimp\n apply (frule dom_same', simp)\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n done\nqed\n\n\n(*Clagged from Retype_AC*)\nlemma foldr_upd_app_if': \"foldr (\\p ps. ps(p := f p)) as g = (\\x. if x \\ set as then (f x) else g x)\"\n apply (induct as)\n apply simp\n apply simp\n apply (rule ext)\n apply simp\n done\n\nlemma etcb_rel_makeObject: \"etcb_relation default_etcb makeObject\"\n apply (simp add: etcb_relation_def default_etcb_def)\n apply (simp add: makeObject_tcb default_priority_def default_domain_def)\n done\n\n\nlemma ekh_at_tcb_at: \"valid_etcbs_2 ekh kh \\ ekh x = Some y \\ \\tcb. kh x = Some (TCB tcb)\"\n apply (simp add: valid_etcbs_2_def\n st_tcb_at_kh_def obj_at_kh_def\n is_etcb_at'_def obj_at_def)\n apply force\n done\n\nlemma default_etcb_default_domain_futz [simp]:\n \"default_etcb\\tcb_domain := default_domain\\ = default_etcb\"\nunfolding default_etcb_def by simp\n\nlemma retype_ekheap_relation:\n assumes sr: \"ekheap_relation (ekheap s) (ksPSpace s')\"\n and sr': \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"ekheap_relation (foldr (\\p ps. ps(p := default_ext (APIType_map2 ty) default_domain))\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"ekheap_relation ?ps ?ps'\")\n proof -\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n show ?thesis\n apply (case_tac \"ty \\ Inr (APIObjectType apiobject_type.TCBObject)\")\n apply (insert ko)\n apply (cut_tac retype_pspace_relation[OF sr' vs vs' pn pn' ko cover orr num_r])\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (insert sr)\n apply (clarsimp simp add: ekheap_relation_def\n pspace_relation_def default_ext_def cong: if_cong\n split: if_split_asm)\n subgoal by (clarsimp simp add: makeObjectKO_def APIType_map2_def cong: if_cong\n split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits X64_H.object_type.splits apiobject_type.splits)\n\n apply (frule ekh_at_tcb_at[OF et])\n apply (intro impI conjI)\n apply clarsimp\n apply (drule_tac x=a in bspec,force)\n apply (clarsimp simp add: other_obj_relation_def split: if_split_asm)\n apply (case_tac ko,simp_all)\n apply (clarsimp simp add: makeObjectKO_def cong: if_cong split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits X64_H.object_type.splits\n apiobject_type.splits if_split_asm)\n apply (drule_tac x=xa in bspec,simp)\n subgoal by force\n subgoal by force\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (clarsimp simp add: APIType_map2_def default_ext_def ekheap_relation_def\n default_object_def makeObjectKO_def etcb_rel_makeObject\n cong: if_cong\n split: if_split_asm)\n apply force\n done\nqed\n\nlemma pspace_no_overlapD':\n \"\\ ksPSpace s x = Some ko; pspace_no_overlap' p bits s \\\n \\ {x .. x + 2 ^ objBitsKO ko - 1} \\ {p .. (p && ~~ mask bits) + 2 ^ bits - 1} = {}\"\n apply (simp add:pspace_no_overlap'_def)\n apply (intro impI)\n apply (elim allE impE)\n apply (simp add:field_simps)+\ndone\n\nlemma new_range_subset:\n assumes\n cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and addr: \"x \\ set (new_cap_addrs n ptr ko)\"\n shows \"{x .. x + 2 ^ (objBitsKO ko) - 1} \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n (is \"?lhs \\ ?rhs\")\nproof -\n have base_in: \"x \\ {ptr..ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n by (rule set_mp[OF new_cap_addrs_subset[OF cover] addr])\n have aligned: \"is_aligned x (objBitsKO ko)\"\n apply (insert cover)\n apply (clarsimp simp:range_cover_def)\n apply (drule new_cap_addrs_aligned)\n apply (erule bspec[OF _ addr])\n done\n show ?thesis using base_in aligned addr\n apply (intro range_subsetI)\n apply (clarsimp simp:ptr_add_def field_simps)+\n apply (simp add:x_power_minus_1)\n apply (clarsimp simp:new_cap_addrs_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (simp add:mask_2pm1[symmetric])\n apply (rule iffD2[OF shiftr_mask_cmp[where c = \"objBitsKO ko\"]])\n apply (insert cover)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def word_bits_def)\n apply (subst aligned_shift')\n apply (simp add:mask_lt_2pn range_cover_def word_bits_def )\n apply (drule is_aligned_addD1)\n apply (simp add:range_cover_def)\n apply (rule aligned_add_aligned)\n apply (rule aligned_already_mask)\n apply (fastforce simp:range_cover_def)\n apply (simp_all add: range_cover_def)[3]\n apply (subst shiftr_mask2[symmetric])\n apply (simp add:range_cover_def word_bits_def)\n apply (rule le_shiftr)\n apply (subst le_mask_iff_lt_2n[THEN iffD1])\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:word_less_nat_alt)\n apply (rule le_less_trans[OF unat_plus_gt])\n apply (frule(1) range_cover.range_cover_compare)\n apply (clarsimp simp:shiftl_t2n mult.commute range_cover_def)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask])\n apply (rule le_refl)\n apply (simp add:range_cover_def)\n done\nqed\n\nlemma retype_aligned_distinct':\n assumes vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n \"\n shows\n \"pspace_distinct' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n \"pspace_aligned' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n (is \"pspace_aligned' (s'\\ksPSpace := ?ps\\)\")\nproof -\n have al: \"is_aligned ptr (objBitsKO ko)\"\n using cover\n by (simp add:cover range_cover_def)\n let ?s' = \"s'\\ksPSpace := ?ps\\\"\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al]]\n note nc_al' = nc_al[unfolded objBits_def]\n\n show pa': \"pspace_aligned' ?s'\" using vs'(1)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (clarsimp simp add: pspace_aligned'_def nc_al'\n split: if_split_asm)\n apply (drule bspec, erule domI, simp)\n done\n\n have okov: \"objBitsKO ko < word_bits\"\n by (simp add: objBits_def)\n\n have new_range_disjoint:\n \"\\x. x \\ set (new_cap_addrs n ptr ko) \\\n ({x .. x + 2 ^ (objBitsKO ko) - 1} - {x}) \\ set (new_cap_addrs n ptr ko) = {}\"\n apply safe\n apply (rule ccontr)\n apply (frule(2) aligned_neq_into_no_overlap [OF _ nc_al nc_al])\n apply (drule_tac a=xa in equals0D)\n apply (clarsimp simp: field_simps is_aligned_no_overflow [OF nc_al])\n done\n note new_range_sub = new_range_subset [OF cover]\n\n show pd': \"pspace_distinct' ?s'\" using vs'(2)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: pspace_distinct'_def dom_if_Some ball_Un)\n apply (intro conjI ballI impI)\n apply (simp add: ps_clear_def dom_if_Some Int_Un_distrib\n objBits_def[symmetric])\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (subst Int_commute)\n apply (rule disjoint_subset[OF new_cap_addrs_subset,OF cover])\n apply (subst Int_commute)\n apply (simp add:ptr_add_def field_simps)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule pspace_no_overlapD' [OF _ pn'])\n done\nqed\n\ndefinition\n update_gs :: \"Structures_A.apiobject_type \\ nat \\ machine_word set\n \\ 'a kernel_state_scheme \\ 'a kernel_state_scheme\"\nwhere\n \"update_gs ty us ptrs \\\n case ty of\n Structures_A.CapTableObject \\ gsCNodes_update\n (\\cns x. if x \\ ptrs then Some us else cns x)\n | ArchObject SmallPageObj \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some X64SmallPage else ups x)\n | ArchObject LargePageObj \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some X64LargePage else ups x)\n | ArchObject HugePageObj \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some X64HugePage else ups x)\n | _ \\ id\"\n\nlemma ksPSpace_update_gs_eq[simp]:\n \"ksPSpace (update_gs ty us ptrs s) = ksPSpace s\"\n by (simp add: update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nend\n\nglobal_interpretation update_gs: PSpace_update_eq \"update_gs ty us ptrs\"\n by (simp add: PSpace_update_eq_def)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma update_gs_id:\n \"tp \\ no_gs_types \\ update_gs tp us addrs = id\"\n by (simp add: no_gs_types_def update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nlemma update_gs_simps[simp]:\n \"update_gs Structures_A.apiobject_type.CapTableObject us ptrs =\n gsCNodes_update (\\cns x. if x \\ ptrs then Some us else cns x)\"\n \"update_gs (ArchObject SmallPageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some X64SmallPage else ups x)\"\n \"update_gs (ArchObject LargePageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some X64LargePage else ups x)\"\n \"update_gs (ArchObject HugePageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some X64HugePage else ups x)\"\n by (simp_all add: update_gs_def)\n\nlemma retype_state_relation:\n notes data_map_insert_def[simp del]\n assumes sr: \"(s, s') \\ state_relation\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\" \"valid_list s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and api: \"obj_bits_api (APIType_map2 ty) us \\ sz\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"(ekheap_update\n (\\_. foldr (\\p ekh a. if a = p then default_ext (APIType_map2 ty) default_domain else ekh a)\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n s\n \\kheap :=\n foldr (\\p. data_map_insert p (default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s)\\,\n update_gs (APIType_map2 ty) us (set (retype_addrs ptr (APIType_map2 ty) n us))\n (s'\\ksPSpace :=\n foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko)\n (ksPSpace s')\\))\n \\ state_relation\"\n (is \"(ekheap_update (\\_. ?eps) s\\kheap := ?ps\\, update_gs _ _ _ (s'\\ksPSpace := ?ps'\\))\n \\ state_relation\")\n proof (rule state_relation_null_filterE[OF sr refl _ _ _ _ _ _ _ vs'], simp_all add: trans_state_update[symmetric] del: trans_state_update)\n\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have al':\"is_aligned ptr (objBitsKO ko)\"\n using cover'\n by (simp add:range_cover_def)\n have sz:\"sz < word_bits\"\n using cover'\n by (simp add:range_cover_def word_bits_def)\n let ?t = \"s\\kheap := ?ps\\\"\n let ?tp = \"APIType_map2 ty\"\n let ?al = \"retype_addrs ptr ?tp n us\"\n let ?t' = \"update_gs ?tp us (set ?al) (s'\\ksPSpace := ?ps'\\)\"\n\n note pad' = retype_aligned_distinct' [OF vs' pn' cover']\n thus pa': \"pspace_aligned' (s'\\ksPSpace := ?ps'\\)\"\n and pd': \"pspace_distinct' (s'\\ksPSpace := ?ps'\\)\"\n by simp_all\n\n note pa'' = pa'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n note pd'' = pd'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n show \"null_filter (caps_of_state ?t) = null_filter (caps_of_state s)\"\n apply (rule null_filter_caps_of_state_foldr[folded data_map_insert_def])\n apply (simp add: not_unt)\n apply (rule ballI)\n apply (erule pspace_no_overlapD2 [OF pn _ cover vs(1)])\n done\n\n have nc_dis: \"distinct (new_cap_addrs m ptr ko)\"\n by (rule new_cap_addrs_distinct [OF cover'])\n\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al']]\n note nc_al' = nc_al[unfolded objBits_def]\n show \"null_filter' (map_to_ctes ?ps') = null_filter' (ctes_of s')\"\n apply (rule null_filter_ctes_retype [OF ko vs' pa'' pd''])\n apply (simp add: nc_al)\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (drule orthD1)\n apply (simp add:ptr_add_def field_simps)\n apply clarsimp\n done\n\n show \"valid_objs s\" using vs\n by (clarsimp simp: valid_pspace_def)\n\n show \"valid_mdb s\" using vs\n by (clarsimp)\n\n show \"valid_list s\" using et\n by (clarsimp)\n\n show \"mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s)\" using vs\n by (clarsimp simp: valid_mdb_def)\n\n have pspr: \"pspace_relation (kheap s) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"pspace_relation ?ps ?ps'\"\n by (rule retype_pspace_relation [OF _ vs vs' pn pn' ko cover orr num_r,\n folded data_map_insert_def])\n\n have \"ekheap_relation (ekheap (s)) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"ekheap_relation ?eps ?ps'\"\n by (fold fun_upd_apply) (rule retype_ekheap_relation[OF _ pspr vs et(1) vs' pn pn' ko cover orr num_r])\n\n have pn2: \"\\a\\set ?al. kheap s a = None\"\n by (rule ccontr) (clarsimp simp: pspace_no_overlapD1[OF pn _ cover vs(1)])\n\n from sr have gr: \"ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\"\n by (rule state_relationE)\n\n show \"ghost_relation ?ps (gsUserPages ?t') (gsCNodes ?t')\"\n proof (cases ?tp)\n case Untyped thus ?thesis by (simp add: not_unt)\n next\n note data_map_insert_def[simp]\n\n case TCBObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def TCBObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def TCBObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap, simp add: TCBObject update_gs_def)\n next\n case EndpointObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: EndpointObject update_gs_def)\n next\n note data_map_insert_def[simp]\n case NotificationObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def NotificationObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def\n default_object_def NotificationObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: NotificationObject update_gs_def)\n next\n case CapTableObject\n note data_map_insert_def[simp]\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def CapTableObject)\n have [simp]: \"cns_of_heap ?ps = (\\x. if x \\ set ?al then Some us\n else cns_of_heap (kheap s) x)\"\n by (rule ext, induct (?al),\n simp_all add: cns_of_heap_def wf_empty_bits wf_unique default_object_def CapTableObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: CapTableObject update_gs_def ext)\n next\n case (ArchObject ao)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def data_map_insert_def\n default_object_def ArchObject)\n from pn2 gr show ?thesis\n apply (clarsimp simp add: ghost_relation_of_heap)\n apply (rule conjI[rotated])\n apply (simp add: ArchObject update_gs_def split: aobject_type.splits)\n apply (thin_tac \"cns_of_heap h = g\" for h g)\n apply (drule sym)\n apply (rule ext)\n apply (induct (?al))\n apply (simp add: update_gs_def ArchObject split: aobject_type.splits)\n apply (simp add: update_gs_def ArchObject default_object_def\n default_arch_object_def ups_of_heap_def\n data_map_insert_def\n split: aobject_type.splits)\n done\n qed\n\n show \"\\f' g' h'. ?t' =\n s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n apply (clarsimp simp: update_gs_def\n split: Structures_A.apiobject_type.splits)\n apply (intro conjI impI)\n apply (subst ex_comm, rule_tac x=id in exI,\n subst ex_comm, rule_tac x=id in exI, fastforce)+\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (subst ex_comm)\n apply (rule_tac x=\"\\cns x. if x\\set ?al then Some us else cns x\" in exI,\n simp)\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI, simp)\n apply clarsimp\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI)\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (simp split: aobject_type.splits)\n apply (intro conjI impI)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some X64SmallPage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some X64LargePage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some X64HugePage\n else cns x\" in exI, simp)\n apply (rule_tac x=id in exI, simp)+\n done\nqed\n\nlemma new_cap_addrs_fold':\n \"1 \\ n \\\n map (\\n. ptr + (n << objBitsKO ko)) [0.e.n - 1] =\n new_cap_addrs (unat n) ptr ko\"\n by (clarsimp simp:new_cap_addrs_def ptr_add_def upto_enum_red'\n shiftl_t2n power_add field_simps)\n\nlemma objBitsKO_gt_0: \"0 < objBitsKO ko\"\n apply (case_tac ko)\n apply (simp_all add:objBits_simps' pageBits_def)\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object)\n apply (simp_all add:archObjSize_def pageBits_def)\n done\n\nlemma kheap_ekheap_double_gets:\n \"(\\rv erv rv'. \\pspace_relation rv rv'; ekheap_relation erv rv'\\\n \\ corres r (R rv erv) (R' rv') (b rv erv) (d rv')) \\\n corres r (\\s. R (kheap s) (ekheap s) s) (\\s. R' (ksPSpace s) s)\n (do x \\ gets kheap; xa \\ gets ekheap; b x xa od) (gets ksPSpace >>= d)\"\n apply (rule corres_symb_exec_l)\n apply (rule corres_guard_imp)\n apply (rule_tac r'= \"\\erv rv'. ekheap_relation erv rv' \\ pspace_relation x rv'\"\n in corres_split)\n apply (subst corres_gets[where P=\"\\s. x = kheap s\" and P'=\\])\n apply clarsimp\n apply (simp add: state_relation_def)\n apply clarsimp\n apply assumption\n apply (wp gets_exs_valid | simp)+\n done\n\n(*\n\nSplit out the extended operation that sets the etcb domains.\n\nThis allows the existing corres proofs in this file to more-or-less go\nthrough as they stand.\n\nA more principled fix would be to change the abstract spec and\ngeneralise init_arch_objects to initialise other object types.\n\n*)\n\ndefinition retype_region2_ext :: \"obj_ref list \\ Structures_A.apiobject_type \\ unit det_ext_monad\" where\n \"retype_region2_ext ptrs type \\ modify (\\s. ekheap_update (foldr (\\p ekh. (ekh(p := default_ext type default_domain))) ptrs) s)\"\n\ncrunch all_but_exst[wp]: retype_region2_ext \"all_but_exst P\"\ncrunch (empty_fail) empty_fail[wp]: retype_region2_ext\n\nend\n\ninterpretation retype_region2_ext_extended: is_extended \"retype_region2_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n \"retype_region2_extra_ext ptrs type \\\n when (type = Structures_A.TCBObject) (do\n cdom \\ gets cur_domain;\n mapM_x (ethread_set (\\tcb. tcb\\tcb_domain := cdom\\)) ptrs\n od)\"\n\ncrunch all_but_exst[wp]: retype_region2_extra_ext \"all_but_exst P\" (wp: mapM_x_wp)\ncrunch (empty_fail) empty_fail[wp]: retype_region2_extra_ext (wp: mapM_x_wp)\n\nend\n\ninterpretation retype_region2_extra_ext_extended: is_extended \"retype_region2_extra_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n retype_region2 :: \"obj_ref \\ nat \\ nat \\ Structures_A.apiobject_type \\ bool \\ (obj_ref list,'z::state_ext) s_monad\"\nwhere\n \"retype_region2 ptr numObjects o_bits type dev \\ do\n obj_size \\ return $ 2 ^ obj_bits_api type o_bits;\n ptrs \\ return $ map (\\p. ptr_add ptr (p * obj_size)) [0..< numObjects];\n when (type \\ Structures_A.Untyped) (do\n kh \\ gets kheap;\n kh' \\ return $ foldr (\\p kh. kh(p \\ default_object type dev o_bits)) ptrs kh;\n do_extended_op (retype_region2_ext ptrs type);\n modify $ kheap_update (K kh')\n od);\n return $ ptrs\n od\"\n\nlemma retype_region_ext_modify_kheap_futz:\n \"(retype_region2_extra_ext ptrs type :: (unit, det_ext) s_monad) >>= (\\_. modify (kheap_update f))\n = (modify (kheap_update f) >>= (\\_. retype_region2_extra_ext ptrs type))\"\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (subst oblivious_modify_swap)\n defer\n apply (simp add: bind_assoc)\n apply (rule oblivious_bind)\n apply simp\n apply (rule oblivious_mapM_x)\n apply (clarsimp simp: ethread_set_def set_eobject_def)\n apply (rule oblivious_bind)\n apply (simp add: gets_the_def)\n apply (rule oblivious_bind)\n apply (clarsimp simp: get_etcb_def)\n apply simp\n apply (simp add: modify_def[symmetric])\ndone\n\nlemmas retype_region_ext_modify_kheap_futz' = fun_cong[OF arg_cong[where f=NonDetMonad.bind, OF retype_region_ext_modify_kheap_futz[symmetric]], simplified bind_assoc]\n\nlemma foldr_upd_app_if_eta_futz:\n \"foldr (\\p ps. ps(p \\ f p)) as = (\\g x. if x \\ set as then Some (f x) else g x)\"\napply (rule ext)\napply (rule foldr_upd_app_if)\ndone\n\nlemma modify_ekheap_update_comp_futz:\n \"modify (ekheap_update (f \\ g)) = modify (ekheap_update g) >>= (K (modify (ekheap_update f)))\"\nby (simp add: o_def modify_def bind_def gets_def get_def put_def)\n\nlemma mapM_x_modify_futz:\n assumes \"\\ptr\\set ptrs. ekheap s ptr \\ None\"\n shows \"mapM_x (ethread_set F) (rev ptrs) s\n = modify (ekheap_update (foldr (\\p ekh. ekh(p := Some (F (the (ekh p))))) ptrs)) s\" (is \"?lhs ptrs s = ?rhs ptrs s\")\nusing assms\nproof(induct ptrs arbitrary: s)\n case Nil thus ?case by (simp add: mapM_x_Nil return_def simpler_modify_def)\nnext\n case (Cons ptr ptrs s)\n have \"?rhs (ptr # ptrs) s\n = (do modify (ekheap_update (foldr (\\p ekh. ekh(p \\ F (the (ekh p)))) ptrs));\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n by (simp only: foldr_Cons modify_ekheap_update_comp_futz) simp\n also have \"... = (do ?lhs ptrs;\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n apply (rule monad_eq_split_tail)\n apply simp\n apply (rule Cons.hyps[symmetric])\n using Cons.prems\n apply force\n done\n also have \"... = ?lhs (ptr # ptrs) s\"\n apply (simp add: mapM_x_append mapM_x_singleton)\n apply (rule monad_eq_split2[OF refl, where\n P=\"\\s. \\ptr\\set (ptr # ptrs). ekheap s ptr \\ None\"\n and Q=\"\\_ s. ekheap s ptr \\ None\"])\n apply (simp add: ethread_set_def\n assert_opt_def get_etcb_def gets_the_def gets_def get_def modify_def put_def set_eobject_def\n bind_def fail_def return_def split_def\n split: option.splits)\n apply ((wp mapM_x_wp[OF _ subset_refl] | simp add: ethread_set_def set_eobject_def)+)[1]\n using Cons.prems\n apply force\n done\n finally show ?case by (rule sym)\nqed\n\nlemma awkward_fold_futz:\n \"fold (\\p ekh. ekh(p \\ the (ekh p)\\tcb_domain := cur_domain s\\)) ptrs ekh\n = (\\x. if x \\ set ptrs then Some ((the (ekh x))\\tcb_domain := cur_domain s\\) else ekh x)\"\nby (induct ptrs arbitrary: ekh) (simp_all add: fun_eq_iff)\n\nlemma retype_region2_ext_retype_region_ext_futz:\n \"retype_region2_ext ptrs type >>= (\\_. retype_region2_extra_ext ptrs type)\n = retype_region_ext ptrs type\"\nproof(cases type)\n case TCBObject\n have complete_futz:\n \"\\F x. modify (ekheap_update (\\_. F (cur_domain x) (ekheap x))) x = modify (ekheap_update (\\ekh. F (cur_domain x) ekh)) x\"\n by (simp add: modify_def get_def get_etcb_def put_def bind_def return_def)\n have second_futz:\n \"\\f G.\n do modify (ekheap_update f);\n cdom \\ gets (\\s. cur_domain s);\n G cdom\n od =\n do cdom \\ gets (\\s. cur_domain s);\n modify (ekheap_update f);\n G cdom\n od\"\n by (simp add: bind_def gets_def get_def return_def simpler_modify_def)\n from TCBObject show ?thesis\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (clarsimp simp: exec_gets fun_eq_iff)\n apply (subst complete_futz)\n apply (simp add: second_futz[simplified] exec_gets)\n apply (simp add: default_ext_def exec_modify)\n apply (subst mapM_x_modify_futz[where ptrs=\"rev ptrs\", simplified])\n apply (simp add: foldr_upd_app_if_eta_futz)\n apply (simp add: modify_def exec_get put_def o_def)\n apply (simp add: foldr_upd_app_if_eta_futz foldr_conv_fold awkward_fold_futz)\n apply (simp cong: if_cong)\n done\nqed (auto simp: fun_eq_iff retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def\n put_def gets_def get_def bind_def return_def mk_ef_def modify_def foldr_upd_app_if' when_def default_ext_def)\n\nlemma retype_region2_ext_retype_region:\n \"(retype_region ptr numObjects o_bits type dev :: (obj_ref list, det_ext) s_monad)\n = (do ptrs \\ retype_region2 ptr numObjects o_bits type dev;\n retype_region2_extra_ext ptrs type;\n return ptrs\n od)\"\napply (clarsimp simp: retype_region_def retype_region2_def when_def bind_assoc)\n apply safe\n defer\n apply (simp add: retype_region2_extra_ext_def)\napply (subst retype_region_ext_modify_kheap_futz'[simplified bind_assoc])\napply (subst retype_region2_ext_retype_region_ext_futz[symmetric])\napply (simp add: bind_assoc)\ndone\n\nlemma getObject_tcb_gets:\n \"getObject addr >>= (\\x::tcb. gets proj >>= (\\y. G x y))\n = gets proj >>= (\\y. getObject addr >>= (\\x. G x y))\"\nby (auto simp: exec_gets fun_eq_iff intro: bind_apply_cong dest!: in_inv_by_hoareD[OF getObject_inv_tcb])\n\nlemma setObject_tcb_gets_ksCurDomain:\n \"setObject addr (tcb::tcb) >>= (\\_. gets ksCurDomain >>= G)\n = gets ksCurDomain >>= (\\x. setObject addr tcb >>= (\\_. G x))\"\napply (clarsimp simp: exec_gets fun_eq_iff)\napply (rule bind_apply_cong)\n apply simp\napply (drule_tac P1=\"\\cdom. cdom = ksCurDomain x\" in use_valid[OF _ setObject_cd_inv])\napply (simp_all add: exec_gets)\ndone\n\nlemma curDomain_mapM_x_futz:\n \"curDomain >>= (\\cdom. mapM_x (threadSet (F cdom)) addrs)\n = mapM_x (\\addr. curDomain >>= (\\cdom. threadSet (F cdom) addr)) addrs\"\nproof(induct addrs)\n case Nil thus ?case\n by (simp add: curDomain_def mapM_x_def sequence_x_def bind_def gets_def get_def return_def)\nnext\n case (Cons addr addrs)\n have H: \"\\G. do cdom \\ curDomain;\n _ \\ threadSet (F cdom) addr;\n G cdom\n od\n = do cdom \\ curDomain;\n threadSet (F cdom) addr;\n cdom \\ curDomain;\n G cdom\n od\"\n by (simp add: bind_assoc curDomain_def threadSet_def setObject_tcb_gets_ksCurDomain\n getObject_tcb_gets double_gets_drop_regets)\n from Cons.hyps show ?case\n apply (simp add: mapM_x_def sequence_x_def)\n apply (simp add: bind_assoc foldr_map o_def)\n apply (subst H)\n apply (simp add: mapM_x_def sequence_x_def)\n done\nqed\n\n(*\n\nThe existing proof continues below.\n\n*)\n\nlemma modify_ekheap_update_ekheap:\n \"modify (\\s. ekheap_update f s) = do s \\ gets ekheap; modify (\\s'. s'\\ekheap := f s\\) od\"\nby (simp add: modify_def gets_def get_def put_def bind_def return_def split_def fun_eq_iff)\n\nlemma corres_retype':\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"(sz < obj_bits_api (APIType_map2 ty) us)\n = (sz < objBitsKO ko + gbits)\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (update_gs (APIType_map2 ty) us (set addrs));\n return (g addrs) od)\"\n (is \"corres ?r ?P ?P' ?C ?A\")\nproof -\n note data_map_insert_def[simp del]\n have not_zero':\"((of_nat n)::machine_word) \\ 0\"\n by (rule range_cover_not_zero[OF not_zero cover])\n have shiftr_not_zero:\" ((of_nat n)::machine_word) << gbits \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_zero cover])\n apply (simp add:obj_bits_api)\n done\n have unat_of_nat_shift:\"unat (((of_nat n)::machine_word) << gbits) =\n (n * 2^ gbits)\"\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_shift':\n \"unat (((of_nat n)::machine_word) * 2^(gbits + objBitsKO ko)) =\n n * 2^(gbits + objBitsKO ko)\"\n apply (subst mult.commute)\n apply (simp add:shiftl_t2n[symmetric])\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_n':\n \"unat (((of_nat n)::machine_word) * 2 ^ (gbits + objBitsKO ko)) \\ 0\"\n by (simp add:unat_of_nat_shift' not_zero)\n have bound:\"obj_bits_api (APIType_map2 ty) us \\ sz\"\n using cover\n by (simp add:range_cover_def)\n have n_estimate: \"n < 2 ^ (word_bits - (objBitsKO ko + gbits))\"\n apply (rule le_less_trans)\n apply (rule range_cover.range_cover_n_le(2)[OF cover])\n apply (rule power_strict_increasing)\n apply (simp add:obj_bits_api ko)\n apply (rule diff_less_mono)\n using cover obj_bits_api\n apply (simp_all add:range_cover_def ko word_bits_def)\n done\n\n have set_retype_addrs_fold:\n \"image (\\n. ptr + 2 ^ obj_bits_api (APIType_map2 ty) us * n)\n {x. x \\ of_nat n - 1} =\n set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply (clarsimp simp: retype_addrs_def image_def Bex_def ptr_add_def\n Collect_eq)\n apply (rule iffI)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"unat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover]\n not_le not_zero\n split: if_split_asm)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"of_nat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover])\n apply (rule nat_le_Suc_less_imp)\n apply (metis le_unat_uoi nat_less_le not_le_imp_less)\n done\n\n have new_caps_adds_fold:\n \"map (\\n. ptr + 2 ^ objBitsKO ko * n) [0.e.2 ^ gbits * of_nat n - 1] =\n new_cap_addrs (2 ^ gbits * n) ptr ko\"\n apply (simp add: new_cap_addrs_def shiftl_t2n)\n apply (subgoal_tac \"1 \\ (2::machine_word) ^ gbits * of_nat n\")\n apply (simp add: upto_enum_red' o_def)\n apply (rule arg_cong2[where f=map, OF refl])\n apply (rule arg_cong2[where f=upt, OF refl])\n apply (metis mult.commute shiftl_t2n unat_of_nat_shift)\n using shiftr_not_zero\n apply (simp add: shiftl_t2n)\n apply (metis word_less_1 word_not_le)\n done\n\n from aligned\n have al': \"is_aligned ptr (obj_bits_api (APIType_map2 ty) us)\"\n by (simp add: obj_bits_api ko)\n show ?thesis\n apply (simp add: when_def retype_region2_def createObjects'_def\n createObjects_def aligned obj_bits_api[symmetric]\n ko[symmetric] al' shiftl_t2n data_map_insert_def[symmetric]\n is_aligned_mask[symmetric] split_def unless_def\n lookupAround2_pspace_no check\n split del: if_split)\n apply (subst retype_addrs_fold)+\n apply (subst if_P)\n using ko\n apply (clarsimp simp: makeObjectKO_def)\n apply (simp add: bind_assoc retype_region2_ext_def)\n apply (rule corres_guard_imp)\n apply (subst modify_ekheap_update_ekheap)\n apply (simp only: bind_assoc)\n apply (rule kheap_ekheap_double_gets)\n apply (rule corres_symb_exec_r)\n apply (simp add: not_less modify_modify bind_assoc[symmetric]\n obj_bits_api[symmetric] shiftl_t2n upto_enum_red'\n range_cover.unat_of_nat_n[OF cover])\n apply (rule corres_split_nor[OF _ corres_trivial])\n apply (rename_tac x eps ps)\n apply (rule_tac P=\"\\s. x = kheap s \\ eps = ekheap (s) \\ ?P s\" and\n P'=\"\\s. ps = ksPSpace s \\ ?P' s\" in corres_modify)\n apply (simp add: set_retype_addrs_fold new_caps_adds_fold)\n apply (erule retype_state_relation[OF _ _ _ _ _ _ _ _ _ cover _ _ orr],\n simp_all add: ko not_zero obj_bits_api\n bound[simplified obj_bits_api ko])[1]\n apply (clarsimp simp: retype_addrs_fold[symmetric] ptr_add_def upto_enum_red' not_zero'\n range_cover.unat_of_nat_n[OF cover] word_le_sub1\n simp del: word_of_nat_eq_0_iff)\n apply (rule_tac f=g in arg_cong)\n apply clarsimp\n apply wp+\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply (clarsimp|wp)+\n apply (clarsimp split: option.splits)\n apply wpsimp\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply wp\n apply (clarsimp simp:lookupAround2_char1)\n apply wp\n apply (clarsimp simp: obj_bits_api ko)\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (rule_tac x1 = a in ccontr[OF in_empty_interE])\n apply simp\n apply (clarsimp simp: not_less shiftL_nat)\n apply (erule order_trans)\n apply (subst p_assoc_help)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n using cover\n apply -\n apply (rule iffD2[OF word_le_nat_alt])\n apply (subst word_of_nat_minus)\n using not_zero\n apply simp\n apply (rule le_trans[OF unat_plus_gt])\n apply simp\n apply (subst unat_minus_one)\n apply (subst mult.commute)\n apply (rule word_power_nonzero_64)\n apply (rule of_nat_less_pow_64[OF n_estimate])\n apply (simp add:word_bits_def objBitsKO_gt_0 ko)\n apply (simp add:range_cover_def obj_bits_api ko word_bits_def)\n apply (cut_tac not_zero',clarsimp simp:ko)\n apply(clarsimp simp:field_simps ko)\n apply (subst unat_sub[OF word_1_le_power])\n apply (simp add:range_cover_def)\n apply (subst diff_add_assoc[symmetric])\n apply (cut_tac unat_of_nat_n',simp add:ko)\n apply (clarsimp simp: obj_bits_api ko)\n apply (rule diff_le_mono)\n apply (frule range_cover.range_cover_compare_bound)\n apply (cut_tac obj_bits_api unat_of_nat_shift')\n apply (clarsimp simp:add.commute range_cover_def ko)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def domI)+\n done\nqed\n\nlemma createObjects_corres':\n \"\\corres r P P' f (createObjects a b ko d); ko = injectKO val\\\n \\ corres dc P P' f (createObjects' a b ko d)\"\n apply (clarsimp simp:corres_underlying_def createObjects_def return_def)\n apply (rule conjI)\n apply (clarsimp simp:bind_def split_def)\n apply (drule(1) bspec)\n apply (clarsimp simp:image_def)\n apply (drule(1) bspec)\n apply clarsimp\n apply (erule bexI[rotated])\n apply simp\n apply (clarsimp simp:bind_def split_def image_def)\n apply (drule(1) bspec|clarsimp)+\n done\n\nlemmas retype_aligned_distinct'' = retype_aligned_distinct'\n [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\nlemma retype_ko_wp_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"ko_wp_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then P obj\n else ko_wp_at' P p s)\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (rule foldr_update_ko_wp_at' [OF vs])\n apply (simp add: retype_aligned_distinct'' [OF vs pn cover])+\n apply (rule new_cap_addrs_aligned)\n using cover\n apply (simp add:range_cover_def cover)\n done\n\nlemma retype_obj_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then (\\ko. projectKO_opt obj = Some ko \\ P ko)\n else obj_at' P p s)\"\n unfolding obj_at'_real_def\n apply (rule retype_ko_wp_at'[OF vs pn cover])\ndone\n\nlemma retype_obj_at_disj':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (obj_at' P p s \\ p \\ set (new_cap_addrs n ptr obj)\n \\ (\\ko. projectKO_opt obj = Some ko \\ P ko))\"\n apply (simp add: retype_obj_at' [OF vs pn cover])\n apply (safe, simp_all)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover]])\n apply (insert pspace_no_overlap_disjoint' [OF vs(1) pn ])\n apply (clarsimp simp: obj_at'_def)\n apply (rule_tac x1 = p in ccontr[OF in_empty_interE])\n apply (simp add:ptr_add_def p_assoc_help domI)+\n done\n\ndeclare word_unat_power[symmetric,simp]\n\nlemma createObjects_ko_at_strg:\n fixes ptr :: machine_word\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\nproof -\n have shiftr_not_zero:\" 1 \\ ((of_nat n)::machine_word) << gbits\"\n using range_cover_not_zero_shift[OF not_0 cover,where gbits = gbits]\n apply -\n apply (simp add:word_le_sub1)\n done\n note unat_of_nat_shiftl = range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified]\n note word_of_nat_eq_0_iff[simp del]\n have in_new:\"\\idx offs. \\idx \\ of_nat n - 1;offs<2 ^ gbits\\\n \\ ptr + (idx << objBitsKO ko + gbits) + (offs << objBitsKO ko)\n \\ set (new_cap_addrs (n * 2 ^ gbits) ptr ko)\"\n apply (insert range_cover_not_zero[OF not_0 cover] not_0)\n apply (clarsimp simp:new_cap_addrs_def image_def)\n apply (rule_tac x =\"unat (2 ^ gbits * idx + offs)\" in bexI)\n apply (subst add.commute)\n apply (simp add:shiftl_shiftl[symmetric])\n apply (simp add:shiftl_t2n distrib_left[symmetric])\n apply simp\n apply (rule unat_less_helper)\n apply (rule less_le_trans)\n apply (erule word_plus_strict_mono_right)\n apply (subst distrib_left[where c = \"1 :: machine_word\",symmetric,simplified])\n apply (subst mult.commute[where a = \"2^gbits\"])+\n apply (insert cover)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply (erule order_trans[OF _ word_sub_1_le])\n apply (simp add:range_cover_not_zero[OF not_0 cover])\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(1)])\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper[OF inc_le])\n apply (simp add:word_leq_minus_one_le)\n apply (simp add:word_bits_def)\n apply (rule no_plus_overflow_neg)\n apply (rule less_le_trans[where y = \"of_nat n\"])\n apply unat_arith\n using range_cover.range_cover_n_less[OF cover]\n apply (simp add:word_bits_def)\n apply (subst distrib_left[where c = \"1 :: machine_word\",symmetric,simplified])\n apply (subst mult.commute)\n apply simp\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (simp add:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply unat_arith\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (erule range_cover.range_cover_le_n_less)\n apply (simp add:range_cover.unat_of_nat_n[OF cover])\n apply (simp add: unat_le_helper)\n apply (simp add:word_bits_def)\n apply unat_arith\n done\n show ?thesis\n apply (simp add: split_def createObjects_def lookupAround2_pspace_no\n alignError_def unless_def createObjects'_def)\n apply (rule hoare_pre)\n apply (wp|simp add:data_map_insert_def[symmetric]\n cong: if_cong del: fun_upd_apply data_map_insert_def)+\n apply (wpc|wp|clarsimp simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold'[OF shiftr_not_zero])+\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n using range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified] pi\n apply (simp add: in_new)\n done\nqed\n\nlemma createObjects_ko_at:\n fixes ptr :: machine_word\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\n by (wp createObjects_ko_at_strg[OF cover not_0 pi],fastforce)\n\nlemma createObjects_obj_at:\n fixes ptr :: machine_word and val :: \"'a :: pspace_storable\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n and not_0:\"n \\ 0\"\n and pi: \"\\(val::'a). projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n ko gbits \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits.\n obj_at' (\\(x::'a). True) (x + (offs << objBitsKO ko)) s\\\"\n apply (rule exE[OF pi])\n apply (erule_tac val1 = x in\n hoare_post_imp [OF _ createObjects_ko_at [OF cover not_0 ],rotated])\n apply (intro allI ballI impI)\n apply (drule(1) bspec)\n apply (drule spec, drule(1) mp)\n apply (clarsimp elim!: obj_at'_weakenE)\n done\n\n(* until we figure out what we really need of page\n mappings it's just alignment, which, fortunately,\n is trivial *)\nlemma createObjects_aligned:\n assumes al: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and bound :\"n < 2 ^ word_bits\" \"n\\0\"\n and bound':\"objBitsKO ko + gbits < word_bits\"\n shows \"\\\\\\ createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x (objBitsKO ko + gbits)\\\"\n apply (rule hoare_strengthen_post)\n apply (rule createObjects_ret[OF bound])\n apply (clarsimp dest!: less_two_pow_divD)\n apply (rule is_aligned_ptr_add_helper[OF al])\n apply (simp_all add:bound')\n done\n\nlemma createObjects_aligned2:\n \"\\\\s. is_aligned ptr (objBitsKO ko + gbits) \\ n < 2 ^ word_bits \\ n \\ 0\n \\ aln < word_bits\n \\ aln = objBitsKO ko + gbits\\\n createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x aln\\\"\n apply (rule hoare_name_pre_state)\n apply simp\n apply (rule hoare_pre, wp createObjects_aligned, simp_all)\n done\n\nlemma range_cover_n_wb:\n \"range_cover (ptr :: obj_ref) sz us n \\ n < 2 ^ word_bits\"\n apply (rule order_le_less_trans, erule range_cover.range_cover_n_le(2))\n apply (clarsimp simp: range_cover_def)\n apply (simp add: word_bits_def)\n done\n\nlemma createObjects_nonzero:\n assumes not_0: \"n \\ 0\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + bits) n\"\n shows \"\\\\s. ptr \\ 0\\\n createObjects ptr n ko bits\n \\\\rv s. \\p \\ set rv. p \\ 0\\\"\n apply (insert not_0)\n apply (rule hoare_pre)\n apply (rule hoare_gen_asm [where P = \"ptr \\ 0\"])\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (erule is_aligned_get_word_bits,simp_all)\n apply (rule hoare_post_imp [OF _ createObjects_ret])\n apply (simp add: ptr_add_def)\n apply (intro allI impI ballI)\n apply (simp add:power_add[symmetric] mult.assoc)\n apply (drule(1) range_cover_no_0[OF _ cover])\n apply (simp add: objBits_def)\n apply (simp add: range_cover_n_wb[OF cover])\n apply simp\n done\n\nlemma objBits_if_dev:\n \"objBitsKO (if dev then KOUserDataDevice else KOUserData) = pageBits\"\n by (simp add: objBitsKO_def)\n\nlemma cwo_ret:\n assumes not_0: \"n \\ 0\"\n assumes cover: \"range_cover ptr sz (pageBits + bs) n\"\n shows \"\\pspace_no_overlap' ptr sz and valid_pspace'\\\n createObjects ptr n (if dev then KOUserDataDevice else KOUserData) bs\n \\\\rv s. \\x\\set rv. \\p<2^bs.\n typ_at' (if dev then UserDataDeviceT else UserDataT) (x + p * 2 ^ pageBits) s\\\"\nproof -\n note create_objs_device = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserDataDevice,simplified]]]\n\n note create_objs_normal = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserData,simplified]]]\n\nshow ?thesis\n apply (cases dev)\n apply (rule hoare_pre)\n apply (rule create_objs_device)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n apply (rule hoare_pre)\n apply (rule create_objs_normal)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n done\nqed\n\nlemmas capFreeIndex_update_valid_untyped' =\n capFreeIndex_update_valid_cap'[unfolded valid_cap'_def,simplified,THEN conjunct2,THEN conjunct1]\n\nlemma createNewCaps_valid_cap:\n fixes ptr :: machine_word\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n \"\n assumes not_0: \"n \\ 0\"\n assumes ct: \"ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us\"\n \"ty = APIObjectType apiobject_type.Untyped \\ minUntypedSizeBits \\ us \\ us \\ maxUntypedSizeBits\"\n assumes ptr: \"ptr \\ 0\"\n\n assumes ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n assumes ptr_km: \"ptr && ~~ mask sz \\ kernel_mappings\"\n assumes sz_constrained: \"sz \\ maxUntypedSizeBits\"\n\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createNewCaps ty ptr n us dev\n \\\\r s. (\\cap \\ set r. s \\' cap)\\\"\nproof -\n note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n note if_split_def[split del] = if_splits\n note createObjects_nonzero' = createObjects_nonzero[OF not_0]\n note cwo_ret' = cwo_ret[OF not_0]\n show ?thesis\n proof(cases \"Types_H.toAPIType ty\")\n case None thus ?thesis\n using not_0\n apply (clarsimp simp: createNewCaps_def Arch_createNewCaps_def)\n using cover\n apply (simp add: range_cover_def)\n using cover\n apply (clarsimp simp: X64_H.toAPIType_def APIType_capBits_def\n split: X64_H.object_type.splits)\n\n \\ \\SmallPageObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero'\n cwo_ret'[where bs=0, simplified]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n \\ \\LargePageObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero'\n cwo_ret'[where bs=ptTranslationBits, simplified]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n \\ \\HugePageObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero'\n cwo_ret'[where bs=\"ptTranslationBits + ptTranslationBits\", simplified]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n \\ \\PageTableObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_table_at'_def typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned[OF _ range_cover.range_cover_n_less(1)\n [where 'a=64, unfolded word_bits_len_of, OF cover]\n not_0];\n simp add: objBits_simps archObjSize_def bit_simps word_bits_def)\n apply (rule createObjects_obj_at[where 'a=pte, OF _ not_0];\n simp add: objBits_simps archObjSize_def bit_simps projectKOs)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def bit_simps)\n apply clarsimp\n\n \\ \\PageDirectoryObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_directory_at'_def typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned[OF _ range_cover.range_cover_n_less(1)\n [where 'a=64, unfolded word_bits_len_of, OF cover]\n not_0];\n simp add: objBits_simps archObjSize_def bit_simps word_bits_def)\n apply (rule createObjects_obj_at[where 'a=pde, OF _ not_0];\n simp add: objBits_simps archObjSize_def bit_simps projectKOs)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def bit_simps)\n apply simp\n\n \\ \\PDPointerTableObject\\\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj pd_pointer_table_at'_def typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned[OF _ range_cover.range_cover_n_less(1)\n [where 'a=64, unfolded word_bits_len_of, OF cover]\n not_0];\n simp add: objBits_simps archObjSize_def bit_simps word_bits_def)\n apply (rule createObjects_obj_at[where 'a=pdpte, OF _ not_0];\n simp add: objBits_simps archObjSize_def bit_simps projectKOs)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def bit_simps)\n apply simp\n\n \\ \\PML4Object\\\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp mapM_x_wp' )\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_map_l4_at'_def typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=64, unfolded word_bits_len_of, OF cover]\n not_0];\n simp add: objBits_simps archObjSize_def bit_simps word_bits_def)\n apply (rule createObjects_obj_at [where 'a=pml4e, OF _ not_0];\n simp add: objBits_simps archObjSize_def bit_simps projectKOs)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def bit_simps)\n apply simp\n done\n next\n case (Some a) thus ?thesis\n proof(cases a)\n case Untyped with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: X64_H.toAPIType_def fromIntegral_def\n toInteger_nat fromInteger_nat APIType_capBits_def\n split: X64_H.object_type.splits)\n apply wp\n apply (intro ballI)\n apply (clarsimp simp: image_def upto_enum_red' valid_cap'_def capAligned_def\n split: capability.splits)\n apply (drule word_leq_minus_one_le[rotated])\n apply (rule range_cover_not_zero[OF not_0 cover])\n apply (intro conjI)\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (fastforce simp:range_cover_def word_bits_def)+\n apply (clarsimp simp:valid_untyped'_def ko_wp_at'_def obj_range'_def)\n apply (drule(1) pspace_no_overlapD'[rotated])\n apply (frule(1) range_cover_cell_subset)\n apply (erule disjE)\n apply (drule psubset_imp_subset)\n apply (drule(1) disjoint_subset2[rotated])\n apply (drule(1) disjoint_subset)\n apply (drule(1) range_cover_subset_not_empty)\n apply clarsimp+\n apply blast\n apply (drule(1) range_cover_no_0[OF ptr _ unat_less_helper])\n apply simp\n apply (drule (1) range_cover_canonical_address[OF _ unat_less_helper ptr_cn sz_constrained])\n apply simp\n apply (drule (1) range_cover_in_kernel_mappings[OF _ unat_less_helper ptr_km sz_constrained])\n apply simp\n done\n next\n case TCBObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: X64_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def curDomain_def\n split: X64_H.object_type.splits)\n apply (wp mapM_x_wp' hoare_vcg_const_Ball_lift)+\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a = \"tcb\",OF _ not_0])\n using cover\n apply (clarsimp simp: X64_H.toAPIType_def APIType_capBits_def objBits_simps\n split: X64_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_tcbI)\n done\n next\n case EndpointObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: X64_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: X64_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=endpoint, OF _ not_0])\n using cover\n apply (clarsimp simp: X64_H.toAPIType_def APIType_capBits_def objBits_simps\n split: X64_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_epI)\n done\n next\n case NotificationObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: X64_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: X64_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=\"notification\", OF _ not_0])\n using cover\n apply (clarsimp simp: X64_H.toAPIType_def APIType_capBits_def objBits_simps\n split: X64_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_ntfnI)\n done\n next\n case CapTableObject with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: X64_H.toAPIType_def\n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: X64_H.object_type.splits)\n apply wp\n apply (clarsimp simp: X64_H.toAPIType_def APIType_capBits_def objBits_simps\n split: X64_H.object_type.split object_type.splits)\n apply (rule hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ _ not_0 ])\n apply ((clarsimp simp:objBits_simps range_cover_def range_cover.range_cover_n_less[where 'a=64, unfolded word_bits_len_of, OF cover])+)[3]\n apply (simp add: word_bits_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret [OF range_cover.range_cover_n_less(1)[where 'a=64, unfolded word_bits_len_of, OF cover] not_0])\n apply (rule createObjects_obj_at [where 'a=cte, OF _ not_0])\n apply (simp add: objBits_simps APIType_capBits_def)\n apply (simp add: projectKOs)\n apply simp\n apply (clarsimp simp: valid_cap'_def capAligned_def objBits_simps\n dest!: less_two_pow_divD)\n apply (thin_tac \"\\x\\S. is_aligned (p x) n\" for S p n)\n apply (intro conjI)\n apply ((simp add:range_cover_def word_bits_def)+)[2]\n apply (clarsimp simp: power_sub)\n apply (drule bspec, simp)\n apply (drule_tac x = \"addr && mask us\" in spec)\n apply (drule mp)\n apply simp\n apply (rule and_mask_less')\n apply (simp add: range_cover_def word_bits_def)\n apply (clarsimp simp add: shiftl_t2n)\n apply simp\n done\n qed\n qed\nqed\n\nlemma other_objs_default_relation:\n \"\\ case ty of Structures_A.EndpointObject \\ ko = injectKO (makeObject :: endpoint)\n | Structures_A.NotificationObject \\ ko = injectKO (makeObject :: Structures_H.notification)\n | Structures_A.TCBObject \\ ko = injectKO (makeObject :: tcb)\n | _ \\ False \\ \\\n obj_relation_retype (default_object ty dev n) ko\"\n apply (rule obj_relation_retype_other_obj)\n apply (clarsimp simp: default_object_def\n is_other_obj_relation_type_def\n split: Structures_A.apiobject_type.split_asm)\n apply (clarsimp simp: other_obj_relation_def default_object_def\n ep_relation_def ntfn_relation_def\n tcb_relation_def default_tcb_def makeObject_tcb\n makeObject_cte new_context_def newContext_def\n default_ep_def makeObject_endpoint default_notification_def\n makeObject_notification default_ntfn_def\n fault_rel_optionation_def\n initContext_def\n arch_tcb_context_get_def atcbContextGet_def\n default_arch_tcb_def newArchTCB_def\n arch_tcb_relation_def\n split: Structures_A.apiobject_type.split_asm)\n done\n\nlemma captable_relation_retype:\n \"n < word_bits \\\n obj_relation_retype (default_object Structures_A.CapTableObject dev n) (KOCTE makeObject)\"\n apply (clarsimp simp: obj_relation_retype_def default_object_def\n wf_empty_bits objBits_simps'\n dom_empty_cnode ex_with_length cte_level_bits_def)\n apply (rule conjI)\n defer\n apply (clarsimp simp: cte_relation_def empty_cnode_def makeObject_cte)\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: cte_map_def')\n apply (rule_tac x=\"of_bl y\" in exI)\n apply (simp add: of_bl_length[where 'a=64, folded word_bits_def])\n apply (clarsimp simp: image_def cte_map_def')\n apply (rule_tac x=\"drop (word_bits - n) (to_bl xa)\" in exI)\n apply (simp add: of_drop_to_bl word_bits_def word_size)\n apply (simp add: less_mask_eq)\n done\n\nlemma pagetable_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageTableObj) dev n)\n (KOArch (KOPTE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pte obj_relation_retype_def\n objBits_simps archObjSize_def\n pte_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp: bit_simps)\n done\n\nlemma pagedirectory_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageDirectoryObj) dev n)\n (KOArch (KOPDE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pde obj_relation_retype_def\n objBits_simps archObjSize_def\n pde_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp: bit_simps)\n done\n\nlemma pdpt_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PDPTObj) dev n)\n (KOArch (KOPDPTE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pdpte obj_relation_retype_def\n objBits_simps archObjSize_def\n pdpte_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp: bit_simps)\n done\n\nlemma pml4_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PML4Obj) dev n)\n (KOArch (KOPML4E makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pml4e obj_relation_retype_def\n objBits_simps archObjSize_def\n pml4e_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp: bit_simps)\n done\n\nlemmas makeObjectKO_simps = makeObjectKO_def[split_simps X64_H.object_type.split\n apiobject_type.split sum.split kernel_object.split ]\n\nlemma corres_retype:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us = objBitsKO ko + gbits\"\n and tp: \"APIType_map2 ty \\ no_gs_types\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (=)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\n \\ (\\val. ko = injectKO val))\n (retype_region2 ptr n us (APIType_map2 ty) dev) (createObjects ptr n ko gbits)\"\n apply (rule corres_guard_imp)\n apply (rule_tac F = \"(\\val. ko = injectKO val)\" in corres_gen_asm2)\n apply (erule exE)\n apply (rule corres_rel_imp)\n apply (rule corres_retype'[where g=id and ty=ty and sz = sz,OF not_zero aligned _ _ _ ko\n ,simplified update_gs_id[OF tp] modify_id_return,simplified])\n using assms\n apply (simp_all add: objBits_def no_gs_types_def)\n apply auto\n done\n\nlemma init_arch_objects_APIType_map2:\n \"init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs =\n (case ty of APIObjectType _ \\ return ()\n | _ \\ init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs)\"\n apply (clarsimp split: X64_H.object_type.split)\n apply (simp add: init_arch_objects_def APIType_map2_def\n split: apiobject_type.split)\n done\n\n(* FIXME: move *)\nlemma copyGlobalMappings_cte_wp_at[wp]:\n \"\\\\s. P (cte_wp_at' P' p s)\\\n copyGlobalMappings pd\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: copyGlobalMappings_def)\n apply (wp mapM_x_wp')\n done\n\ncrunch ct[wp]: copyGlobalMappings \"\\s. P (ksCurThread s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\ncrunch ksCurDomain[wp]: copyGlobalMappings \"\\s. P (ksCurDomain s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\nlemmas copyGlobalMappings_ctes_of[wp]\n = ctes_of_from_cte_wp_at[where Q=\"\\\", simplified,\n OF copyGlobalMappings_cte_wp_at]\n\nlemmas object_splits =\n apiobject_type.split_asm\n X64_H.object_type.split_asm\n sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n\nlemma ksMachineState_update_gs[simp]:\n \"ksMachineState (update_gs tp us addrs s) = ksMachineState s\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\nlemma update_gs_ksMachineState_update_swap:\n \"update_gs tp us addrs (ksMachineState_update f s) =\n ksMachineState_update f (update_gs tp us addrs s)\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\n\ndeclare hoare_in_monad_post[wp del]\ndeclare univ_get_wp[wp del]\ndeclare result_in_set_wp[wp del]\n\ncrunch valid_arch_state'[wp]: copyGlobalMappings \"valid_arch_state'\"\n (wp: crunch_wps)\n\nlemma nullPointer_0_simp[simp]:\n \"(nullPointer = 0) = True\"\n by (simp add: nullPointer_def)\n\nlemma descendants_of_retype':\n assumes P: \"\\p. P p \\ m p = None\"\n shows \"descendants_of' p (\\p. if P p then Some makeObject else m p) =\n descendants_of' p m\"\n apply (rule set_eqI)\n apply (simp add: descendants_of'_def)\n apply (rule iffI)\n apply (erule subtree.induct)\n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule subtree.induct)\n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n done\n\nlemma capRange_Null [simp]: \"capRange NullCap = {}\"\n by (simp add: capRange_def)\n\nend\n\nlocale retype_mdb = vmdb +\n fixes P n\n assumes P: \"\\p. P p \\ m p = None\"\n assumes 0: \"\\P 0\"\n defines \"n \\ \\p. if P p then Some makeObject else m p\"\nbegin\n\ninterpretation Arch . (*FIXME: arch_split*)\n\nlemma no_0_n: \"no_0 n\"\n using no_0 by (simp add: no_0_def n_def 0)\n\nlemma n_next:\n \"n \\ c \\ c' = (if P c then c' = 0 else m \\ c \\ c')\"\n by (simp add: mdb_next_unfold n_def makeObject_cte nullPointer_def)\n\nlemma n_prev:\n \"n \\ c \\ c' = (if P c' then c = 0 else m \\ c \\ c')\"\n by (simp add: mdb_prev_def n_def makeObject_cte nullPointer_def)\n\nlemma dlist_n: \"valid_dlist n\"\n using dlist no_0 no_0_n\n apply (simp add: valid_dlist_def2)\n apply (clarsimp simp: n_prev n_next)\n apply (rule conjI)\n apply clarsimp\n apply (erule allE, erule (1) impE)\n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_next_unfold)\n apply clarsimp\n apply (erule allE, erule (1) impE)\n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_prev_def)\n done\n\nlemma n_next_trancl:\n \"n \\ c \\\\<^sup>+ c' \\ (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n apply (insert no_0_n chain)\n apply (erule trancl_induct)\n apply (fastforce simp: n_next)\n apply (simp split: if_split_asm)\n apply (clarsimp simp: mdb_next_unfold)\n apply (simp add: n_next split: if_split_asm)\n apply (simp add: mdb_chain_0_def)\n apply (drule_tac x=c in bspec)\n apply (drule tranclD)\n apply (clarsimp simp: mdb_next_unfold)\n apply assumption\n done\n\nlemma next_not_P:\n \"m \\ c \\ c' \\ \\P c\"\n by (clarsimp simp: mdb_next_unfold dest!: P)\n\nlemma m_next_trancl:\n \"m \\ c \\\\<^sup>+ c' \\ n \\ c \\\\<^sup>+ c'\"\n apply (erule trancl_induct)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n apply (erule trancl_trans)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n done\n\nlemma P_to_0:\n \"P c \\ n \\ c \\\\<^sup>+ 0\"\n by (rule r_into_trancl) (simp add: n_next)\n\nlemma n_trancl_eq:\n \"n \\ c \\\\<^sup>+ c' = (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n by (auto dest: m_next_trancl n_next_trancl P_to_0)\n\nlemma n_rtrancl_eq:\n \"n \\ c \\\\<^sup>* c' = (if P c then c' = 0 \\ c = c' else m \\ c \\\\<^sup>* c')\"\n by (auto simp: n_trancl_eq rtrancl_eq_or_trancl)\n\nlemma dom_n:\n \"dom n = dom m \\ Collect P\"\n by (auto simp add: n_def)\n\nlemma mdb_chain_0_n: \"mdb_chain_0 n\"\n using chain\n by (auto simp: mdb_chain_0_def dom_n n_trancl_eq)\n\nlemma n_Some_eq:\n \"(n p = Some (CTE cap node)) =\n (if P p then cap = NullCap \\ node = nullMDBNode\n else m p = Some (CTE cap node))\"\n by (auto simp: n_def makeObject_cte)\n\nlemma valid_badges_n: \"valid_badges n\"\nproof -\n from valid\n have \"valid_badges m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_badges_def)\n apply (simp add: n_Some_eq n_next split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma caps_contained_n: \"caps_contained' n\"\nproof -\n from valid\n have \"caps_contained' m\" ..\n thus ?thesis\n apply (clarsimp simp: caps_contained'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma mdb_chunked_n: \"mdb_chunked n\"\nproof -\n from valid\n have \"mdb_chunked m\" ..\n thus ?thesis\n apply (clarsimp simp: mdb_chunked_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (simp add: n_Some_eq n_trancl_eq n_rtrancl_eq is_chunk_def)\n apply fastforce\n done\nqed\n\nlemma descendants [simp]:\n \"descendants_of' p n = descendants_of' p m\"\n apply (unfold n_def)\n apply (subst descendants_of_retype')\n apply (erule P)\n apply (rule refl)\n done\n\nlemma untyped_mdb_n: \"untyped_mdb' n\"\nproof -\n from valid\n have \"untyped_mdb' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_mdb'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma untyped_inc_n: \"untyped_inc' n\"\nproof -\n from valid\n have \"untyped_inc' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_inc'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply blast\n done\nqed\n\nlemma valid_nullcaps_n: \"valid_nullcaps n\"\nproof -\n from valid\n have \"valid_nullcaps m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_nullcaps_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma ut_rev_n: \"ut_revocable' n\"\nproof -\n from valid\n have \"ut_revocable' m\" ..\n thus ?thesis\n apply (clarsimp simp: ut_revocable'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma class_links_m:\n \"class_links m\"\n using valid by (simp add: valid_mdb_ctes_def)\n\nlemma next_not_P2:\n \"\\ m \\ p \\ p'; p' \\ nullPointer \\ \\ \\ P p'\"\n using dlist\n apply (clarsimp simp: mdb_next_unfold)\n apply (erule(1) valid_dlistE)\n apply clarsimp\n apply (clarsimp dest!: P)\n done\n\nlemma class_links_n:\n \"class_links n\"\n using class_links_m\n apply (simp add: class_links_def)\n apply (elim allEI)\n apply clarsimp\n apply (subgoal_tac \"p' \\ nullPointer\")\n apply (simp add: n_next split: if_split_asm)\n apply (case_tac cte, case_tac cte')\n apply (clarsimp simp add: n_Some_eq split: if_split_asm)\n apply (drule(1) next_not_P2)\n apply simp\n apply (clarsimp simp: no_0_n nullPointer_def)\n done\n\nlemma irq_control_n:\n \"irq_control n\"\n apply (clarsimp simp add: irq_control_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (frule irq_revocable, rule irq_control)\n apply clarsimp\n apply (erule (1) irq_controlD, rule irq_control)\n done\n\nlemma ioport_control_n:\n \"ioport_control n\"\n apply (clarsimp simp add: ioport_control_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (frule ioport_revocable, rule ioport_control)\n apply clarsimp\n apply (erule (1) ioport_controlD, rule ioport_control)\n done\n\nlemma dist_z_m: \"distinct_zombies m\"\n using valid by auto\n\nlemma dist_z_n: \"distinct_zombies n\"\n using dist_z_m\n apply (simp add: n_def distinct_zombies_def\n distinct_zombie_caps_def\n split del: if_split)\n apply (erule allEI, erule allEI)\n apply (clarsimp split del: if_split)\n apply (clarsimp split: if_split_asm simp: makeObject_cte)\n apply (clarsimp simp: isCap_simps)\n done\n\nlemma reply_masters_rvk_fb_m: \"reply_masters_rvk_fb m\"\n using valid by auto\n\nlemma reply_masters_rvk_fb_n: \"reply_masters_rvk_fb n\"\n using reply_masters_rvk_fb_m\n by (simp add: n_def reply_masters_rvk_fb_def\n ball_ran_eq makeObject_cte isCap_simps)\n\nlemma valid_n:\n \"valid_mdb_ctes n\"\n by (simp add: valid_mdb_ctes_def dlist_n no_0_n mdb_chain_0_n\n valid_badges_n caps_contained_n untyped_mdb_n\n untyped_inc_n mdb_chunked_n valid_nullcaps_n ut_rev_n\n class_links_n irq_control_n dist_z_n ioport_control_n\n reply_masters_rvk_fb_n)\n\nend\n\ndefinition\n caps_no_overlap'' :: \"machine_word \\ nat \\ kernel_state \\ bool\"\nwhere\n \"caps_no_overlap'' ptr sz s \\ \\cte \\ ran (ctes_of s).\n untypedRange (cteCap cte) \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange (cteCap cte)\"\n\nlemma obj_range'_subset:\n \"\\range_cover ptr sz (objBitsKO val) n; ptr' \\ set (new_cap_addrs n ptr val)\\\n \\ obj_range' ptr' val \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n unfolding obj_range'_def\n by (rule new_range_subset, auto)\n\nlemma obj_range'_subset_strong:\n assumes \"range_cover ptr sz (objBitsKO val) n\"\n and \"ptr' \\ set (new_cap_addrs n ptr val)\"\n shows \"obj_range' ptr' val \\ {ptr..ptr + (of_nat n * 2 ^ objBitsKO val) - 1}\"\nproof -\n {\n assume cover: \"range_cover ptr sz (objBitsKO val) n\"\n and mem_p: \"ptr' \\ set (new_cap_addrs n ptr val)\"\n and not_0: \"n\\ 0\"\n note n_less = range_cover.range_cover_n_less[OF cover]\n have unat_of_nat_m1: \"unat (of_nat n - (1::machine_word)) < n\"\n using not_0 n_less by (simp add:unat_of_nat_minus_1)\n have decomp:\n \"of_nat n * 2 ^ objBitsKO val =\n of_nat (n - 1) * 2 ^ objBitsKO val + (2 :: machine_word) ^ objBitsKO val\"\n apply (simp add:distrib_right[where b = \"1 :: machine_word\",simplified,symmetric])\n using not_0 n_less\n apply simp\n done\n have \"ptr' + 2 ^ objBitsKO val - 1 \\ ptr + of_nat n * 2 ^ objBitsKO val - 1\"\n using cover\n apply (subst decomp)\n apply (simp add:add.assoc[symmetric])\n apply (simp add:p_assoc_help)\n apply (rule order_trans[OF word_plus_mono_left word_plus_mono_right])\n using mem_p not_0\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rule word_plus_mono_right)\n apply (subst mult.commute)\n apply (rule word_mult_le_mono1[OF word_of_nat_le])\n using n_less not_0\n apply (simp add:unat_of_nat_minus_1)\n apply (rule p2_gt_0[THEN iffD2])\n apply (simp add:word_bits_def range_cover_def)\n apply (simp only: word_bits_def[symmetric])\n apply (clarsimp simp: unat_of_nat_minus_1[OF n_less(1) not_0])\n apply (rule nat_less_power_trans2\n [OF range_cover.range_cover_le_n_less(2),OF cover, folded word_bits_def])\n apply (simp add:unat_of_nat_m1 less_imp_le)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n using range_cover.range_cover_compare[OF cover,where p = \"unat (of_nat n - (1::machine_word))\"]\n apply (clarsimp simp:unat_of_nat_m1)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule olen_add_eqv[THEN iffD2])\n apply (subst add.commute[where a = \"2^objBitsKO val - 1\"])\n apply (subst p_assoc_help[symmetric])\n apply (rule is_aligned_no_overflow)\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_mult_triv2]; simp)\n apply simp\n by (meson assms(1) is_aligned_add is_aligned_mult_triv2 is_aligned_no_overflow' range_cover_def)\n }\n with assms show ?thesis\n unfolding obj_range'_def\n apply -\n apply (frule(1) obj_range'_subset)\n apply (simp add: obj_range'_def)\n apply (cases \"n = 0\"; clarsimp simp:new_cap_addrs_def)\n done\nqed\n\nlemma caps_no_overlapD'':\n \"\\cte_wp_at' (\\cap. cteCap cap = c) q s;caps_no_overlap'' ptr sz s\\\n \\ untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {} \\\n {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange c\"\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps caps_no_overlap''_def\n simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule_tac x = cte in bspec)\n apply fastforce\n apply (erule(1) impE)\n apply blast\ndone\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\nlemma valid_untyped'_helper:\n assumes valid : \"valid_cap' c s\"\n and cte_at : \"cte_wp_at' (\\cap. cteCap cap = c) q s\"\n and cover : \"range_cover ptr sz (objBitsKO val) n\"\n and range : \"caps_no_overlap'' ptr sz s\"\n and pres : \"isUntypedCap c \\ usableUntypedRange c \\ {ptr..ptr + of_nat n * 2 ^ objBitsKO val - 1} = {}\"\n shows \"\\pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s\\\n \\ valid_cap' c (s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs n ptr val) (ksPSpace s)\\)\"\n proof -\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff\n assume pn : \"pspace_aligned' s\" \"pspace_distinct' s\"\n and no_overlap: \"pspace_no_overlap' ptr sz s\"\n show ?thesis\n using pn pres no_overlap valid cover cte_wp_at_ctes_of[THEN iffD1,OF cte_at]\n caps_no_overlapD''[OF cte_at range]\n apply (clarsimp simp:valid_cap'_def retype_ko_wp_at')\n apply (case_tac \"cteCap cte\";\n simp add: valid_cap'_def cte_wp_at_obj_cases' valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm)\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches vspace_table_at'_defs\n split del: if_splits)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n unfolding valid_untyped'_def\n apply (intro allI)\n apply (rule ccontr)\n apply clarify\n using cover[unfolded range_cover_def]\n apply (clarsimp simp:isCap_simps retype_ko_wp_at' split:if_split_asm)\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (elim disjE)\n apply (frule(1) obj_range'_subset)\n apply (erule impE)\n apply (drule(1) psubset_subset_trans)\n apply (drule Int_absorb1[OF psubset_imp_subset])\n apply (drule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (simp add:Int_ac)\n apply (drule(1) subset_trans)\n apply blast\n apply (frule(1) obj_range'_subset_strong)\n apply (drule(1) non_disjoing_subset)\n apply blast\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (frule(1) obj_range'_subset)\n apply (drule(1) subset_trans)\n apply (erule impE)\n apply clarsimp\n apply blast\n apply blast\n done\nqed\n\ndefinition caps_overlap_reserved' :: \"machine_word set \\ kernel_state \\ bool\"\nwhere\n \"caps_overlap_reserved' S s \\ \\cte \\ ran (ctes_of s).\n (isUntypedCap (cteCap cte) \\ usableUntypedRange (cteCap cte) \\ S = {})\"\n\nlemma retype_canonical':\n assumes pc': \"pspace_canonical' s'\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n shows\n \"pspace_canonical' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n (is \"pspace_canonical' (s'\\ksPSpace := ?ps\\)\")\nproof -\n show \"pspace_canonical' (s'\\ksPSpace := ?ps\\)\" using assms\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (clarsimp simp: pspace_canonical'_def split: if_split_asm)\n apply (clarsimp simp add: new_cap_addrs_def shiftl_t2n)\n apply (fastforce intro: range_cover_canonical_address[OF cover] simp: mult.commute)+\n done\nqed\n\nlemma retype_in_kernel_mappings':\n assumes pc': \"pspace_in_kernel_mappings' s'\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"(ptr && ~~ mask sz) \\ kernel_mappings\"\n shows\n \"pspace_in_kernel_mappings' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n (is \"pspace_in_kernel_mappings' (s'\\ksPSpace := ?ps\\)\")\nproof -\n show \"pspace_in_kernel_mappings' (s'\\ksPSpace := ?ps\\)\" using assms\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (clarsimp simp: pspace_in_kernel_mappings'_def split: if_split_asm)\n apply (clarsimp simp add: new_cap_addrs_def shiftl_t2n)\n apply (fastforce intro: range_cover_in_kernel_mappings[OF cover] simp: mult.commute)+\n done\nqed\n\nlemma createObjects_valid_pspace':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n and ptr_km: \"ptr && ~~ mask sz \\ kernel_mappings\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s\n \\ ptr \\ 0\\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (cut_tac not_0)\n apply (simp add: split_def createObjects'_def\n lookupAround2_pspace_no\n alignError_def unless_def)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def del:fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst data_map_insert_def[symmetric])+\n apply (rule impI)\n apply (clarsimp simp: new_cap_addrs_fold'\n valid_pspace'_def linorder_not_less\n objBits_def[symmetric])\n apply (simp only: imp_disjL[symmetric] imp_conjL[symmetric] imp_ex[symmetric]\n range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified])\nproof (intro conjI impI)\n\n fix s\n\n assume pn: \"pspace_no_overlap' ptr sz s\"\n and vo: \"valid_objs' s\"\n and ad: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and cn: \"pspace_canonical' s\"\n and km: \"pspace_in_kernel_mappings' s\"\n and pc: \"caps_no_overlap'' ptr sz s\"\n and mdb: \"valid_mdb' s\"\n and p_0: \"ptr \\ 0\"\n and reserved : \"caps_overlap_reserved' {ptr..ptr + of_nat n *2 ^ gbits * 2 ^ objBitsKO val - 1} s\"\n and no_0_obj': \"no_0_obj' s\"\n have obj': \"objBitsKO val \\ sz\"\n using cover\n by (simp add:range_cover_def)\n\n let ?s' = \"s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs (n * 2 ^ gbits) ptr val) (ksPSpace s)\\\"\n\n note cover' = range_cover_rel[where sbit' = \"objBitsKO val\",OF cover _ refl,simplified]\n\n note ad' = retype_aligned_distinct'[OF ad pn cover']\n\n note shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n\n have al: \"is_aligned ptr (objBitsKO val)\"\n using cover'\n by (simp add:range_cover_def)\n\n show pspace_aligned: \"pspace_aligned' ?s'\"\n using ad' shift\n by (simp add:field_simps)\n\n show pspace_canonical: \"pspace_canonical' ?s'\"\n using retype_canonical'[OF cn cover' sz_limit ptr_cn]\n by (clarsimp simp: field_simps)\n\n show pspace_in_kernel_mappings: \"pspace_in_kernel_mappings' ?s'\"\n using retype_in_kernel_mappings'[OF km cover' sz_limit ptr_km]\n by (clarsimp simp: field_simps)\n\n show \"pspace_distinct' ?s'\"\n using ad' shift\n by (simp add:field_simps)\n\n note obj_at_disj = retype_obj_at_disj' [OF ad pn cover']\n\n note obj_at_disj' = obj_at_disj [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\n have obj_atC: \"\\P x. x \\ set (new_cap_addrs (2 ^ gbits * n) ptr val) \\ \\ obj_at' P x s\"\n apply (clarsimp simp: obj_at'_def)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover' ]])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule domI[where m = \"ksPSpace s\"])\n apply (drule(1) orthD2)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n done\n\n have valid_cap: \"\\cap q. \\ s \\' cap; cte_wp_at' (\\cte. cteCap cte = cap) q s \\\n \\ ?s' \\' cap\"\n apply (rule valid_untyped'_helper[OF _ _ _ pc _ ad pn ])\n apply simp+\n apply (subst mult.commute)\n apply (rule cover')\n using reserved\n apply (clarsimp simp:caps_overlap_reserved'_def cte_wp_at_ctes_of)\n apply (drule_tac x = cte in bspec)\n apply fastforce\n apply simp\n done\n\n show valid_objs: \"valid_objs' ?s'\" using vo\n apply (clarsimp simp: valid_objs'_def\n foldr_upd_app_if[folded data_map_insert_def]\n elim!: ranE\n split: if_split_asm)\n apply (insert sym[OF mko])[1]\n apply (clarsimp simp: makeObjectKO_def\n split: bool.split_asm sum.split_asm\n X64_H.object_type.split_asm\n apiobject_type.split_asm\n kernel_object.split_asm\n arch_kernel_object.split_asm)\n apply (drule bspec, erule ranI)\n apply (subst mult.commute)\n apply (case_tac obj; simp add: valid_obj'_def)\n apply (rename_tac endpoint)\n apply (case_tac endpoint; simp add: valid_ep'_def obj_at_disj')\n apply (rename_tac notification)\n apply (case_tac notification; simp add: valid_ntfn'_def valid_bound_tcb'_def obj_at_disj')\n apply (rename_tac ntfn xa)\n apply (case_tac ntfn, simp_all, (clarsimp simp: obj_at_disj' split:option.splits)+)\n apply (rename_tac tcb)\n apply (case_tac tcb, clarsimp simp add: valid_tcb'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps)\n apply (subst mult.commute)\n apply (intro conjI ballI)\n apply (clarsimp elim!: ranE)\n apply (rule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (fastforce)\n apply (rule_tac ptr=\"x + xa\" in cte_wp_at_tcbI', assumption+)\n apply fastforce\n apply simp\n apply (rename_tac thread_state mcp priority bool option nat cptr vptr bound user_context)\n apply (case_tac thread_state, simp_all add: valid_tcb_state'_def\n valid_bound_ntfn'_def obj_at_disj'\n split: option.splits)[2]\n apply (simp add: valid_cte'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps')\n apply (subst mult.commute)\n apply (erule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (erule(2) cte_wp_at_cteI'[unfolded cte_level_bits_def])\n apply simp\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object; simp)\n apply (rename_tac asidpool)\n apply (case_tac asidpool, clarsimp simp: page_directory_at'_def\n typ_at_to_obj_at_arches\n obj_at_disj')\n apply (rename_tac vspace_table_entry;\n case_tac vspace_table_entry;\n simp add: valid_mapping'_def)+\n done\n have not_0: \"0 \\ set (new_cap_addrs (2 ^ gbits * n) ptr val)\"\n using p_0\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover'],rotated])\n apply (clarsimp simp:ptr_add_def)\n done\n show \"valid_mdb' ?s'\"\n apply (simp add: valid_mdb'_def foldr_upd_app_if[folded data_map_insert_def])\n apply (subst mult.commute)\n apply (subst ctes_of_retype [OF mko ad])\n apply (rule ad'[unfolded foldr_upd_app_if[folded data_map_insert_def]])+\n apply (simp add: objBits_def[symmetric] new_cap_addrs_aligned [OF al])\n apply (rule ballI, drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule_tac x = x in orthD1)\n apply (simp add:ptr_add_def p_assoc_help)\n apply fastforce\n apply (fold makeObject_cte)\n apply (rule retype_mdb.valid_n)\n apply unfold_locales\n apply (rule mdb[unfolded valid_mdb'_def])\n apply (rule iffD2 [OF None_ctes_of_cte_at[unfolded cte_wp_at_obj_cases'], THEN sym])\n apply (rule notI)\n apply (elim disjE conjE, simp_all add: obj_atC)[1]\n apply (thin_tac \"S \\ T = {}\" for S T)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (drule pspace_no_overlapD' [OF _ pn])\n apply (drule subsetD [OF new_cap_addrs_subset[OF cover']])\n apply (frule_tac ptr'=p in mask_in_range)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:objBits_simps)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (frule new_range_subset[OF cover'])\n apply (drule bspec [OF new_cap_addrs_aligned[OF al]])\n apply (drule(1) disjoint_subset[rotated])\n apply (drule_tac a=p in equals0D)\n apply (frule_tac ptr'=p in mask_in_range)\n apply (insert sym [OF mko],\n clarsimp simp: objBits_simps makeObjectKO_def obj_at'_def)[1]\n apply (insert sym[OF mko] cover',\n clarsimp simp: obj_at'_def objBits_simps\n makeObjectKO_def projectKOs)[1]\n apply (drule(1) tcb_cte_cases_aligned_helpers(2))\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset,rotated])\n apply (simp add:objBits_simps)\n apply (drule orthD1)\n apply (fastforce simp:p_assoc_help ptr_add_def)\n apply fastforce\n apply (simp add: not_0)\n done\n\n have data_map_ext: \"\\x y. data_map_insert x y = (\\m. m (x \\ y))\"\n by (rule ext) simp\n show no_0_obj: \"no_0_obj' ?s'\"\n using not_0 no_0_obj'\n by (simp add: no_0_obj'_def data_map_ext field_simps foldr_upd_app_other)\n\nqed\n\nabbreviation\n \"injectKOS \\ (injectKO :: ('a :: pspace_storable) \\ kernel_object)\"\n\nlemma createObjects_valid_pspace_untyped':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n and ptr_km: \"ptr && ~~ mask sz \\ kernel_mappings\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s \\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (wp createObjects_valid_pspace' [OF mko not_0 cover sz_limit ptr_cn ptr_km])\n apply simp\n done\n\nlemma getObject_valid_pml4e'[wp]:\n \"\\valid_objs'\\ getObject x \\valid_pml4e'\\\"\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule getObject_ko_at, simp)\n apply (simp add: objBits_simps archObjSize_def)\n apply (rule getObject_inv[where P=valid_objs'])\n apply (simp add: loadObject_default_inv)\n apply simp\n apply (clarsimp simp: projectKOs valid_obj'_def dest!: obj_at_valid_objs')\n done\n\ncrunch valid_objs'[wp]: copyGlobalMappings \"valid_objs'\"\n (ignore: storePML4E wp: crunch_wps)\ncrunch pspace_aligned'[wp]: copyGlobalMappings \"pspace_aligned'\"\n (wp: crunch_wps)\ncrunch pspace_canonical'[wp]: copyGlobalMappings \"pspace_canonical'\"\n (wp: crunch_wps)\ncrunch pspace_in_kernel_mappings'[wp]: copyGlobalMappings \"pspace_in_kernel_mappings'\"\n (wp: crunch_wps)\ncrunch pspace_distinct'[wp]: copyGlobalMappings \"pspace_distinct'\"\n (wp: crunch_wps)\n\nlemmas storePML4E_valid_mdb[wp]\n = storePML4E_ctes[where P=valid_mdb_ctes, folded valid_mdb'_def]\ncrunch valid_mdb[wp]: copyGlobalMappings \"valid_mdb'\"\n (wp: crunch_wps)\n\ncrunch no_0_obj' [wp]: copyGlobalMappings no_0_obj'\n (wp: crunch_wps)\n\nlemma copyGlobalMappings_valid_pspace[wp]:\n \"\\valid_pspace'\\ copyGlobalMappings pd \\\\rv. valid_pspace'\\\"\n by (simp add: valid_pspace'_def | wp)+\n\ndeclare bleeding_obvious [simp]\n\nlemma range_cover_new_cap_addrs_compare:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and ptr_in: \"p \\ set (new_cap_addrs (unat (((of_nat n)::machine_word) << gbits)) ptr val)\"\n shows \"p \\ ptr + of_nat (shiftL n (objBitsKO val + gbits) - Suc 0)\"\nproof -\n note unat_of_nat_shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n have cover' :\"range_cover ptr sz (objBitsKO val) (n*2^gbits)\"\n by (rule range_cover_rel[OF cover],simp+)\n have upbound:\" unat ((((of_nat n)::machine_word) * 2 ^ gbits)) * unat ((2::machine_word) ^ objBitsKO val) < 2 ^ word_bits\"\n using range_cover.range_cover_le_n_less[OF cover' le_refl] cover'\n apply -\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def)\n apply (fold word_bits_def)\n using unat_of_nat_shift not_0\n apply (simp add:field_simps shiftl_t2n)\n done\n have not_0': \"(2::machine_word) ^ (objBitsKO val + gbits) * of_nat n \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_0,unfolded shiftl_t2n,OF _ le_refl])\n apply (rule range_cover_rel[OF cover])\n apply simp+\n done\n have \"gbits < word_bits\"\n using cover\n by (simp add:range_cover_def word_bits_def)\n thus ?thesis\n apply -\n apply (insert not_0 cover ptr_in)\n apply (frule range_cover.range_cover_le_n_less[OF _ le_refl])\n apply (fold word_bits_def)\n apply (simp add:shiftL_nat )\n apply (simp add:range_cover.unat_of_nat_n_shift)\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rename_tac pa)\n apply (rule word_plus_mono_right)\n apply (rule order_trans)\n apply (subst mult.commute)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (clarsimp simp:p2_gt_0 range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"0\"])\n apply (simp+)[2]\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(2)])\n apply (clarsimp simp:field_simps power_add)\n apply (rule unat_le_helper)\n apply (rule of_nat_mono_maybe_le[THEN iffD1])\n using range_cover.range_cover_le_n_less[OF cover' le_refl]\n apply (simp_all only:word_bits_def[symmetric])\n apply simp\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule less_le_trans[OF mult_less_mono1])\n apply (rule unat_mono)\n apply (rule_tac y1= \"pa\" in of_nat_mono_maybe'[THEN iffD1,rotated -1])\n apply (assumption)\n apply (simp add:word_bits_def)\n apply (simp add:word_bits_def)\n apply simp\n using unat_of_nat_shift\n apply (simp add:field_simps shiftl_t2n)\n apply simp\n apply (rule word_less_sub_1)\n apply (simp add:power_add field_simps)\n apply (subst mult.assoc[symmetric])\n apply (rule word_mult_less_mono1)\n apply (rule word_of_nat_less)\n using unat_of_nat_shift\n apply (simp add:shiftl_t2n field_simps)\n apply (meson less_exp objBitsKO_bounded2 of_nat_less_pow_64 word_gt_a_gt_0)\n using upbound\n apply (simp add:word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n apply (rule less_le_trans[rotated -1])\n apply (rule range_cover.range_cover_compare_bound[OF cover'])\n apply (simp add: unat_minus_one[OF not_0'])\n using range_cover.unat_of_nat_n_shift[OF cover le_refl]\n apply (simp add:shiftl_t2n power_add field_simps)\n apply (simp add:range_cover_def word_bits_def)\n done\nqed\n\nlemma createObjects_orig_ko_wp_at2':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' val \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (ko_wp_at' P' p s)\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del:fun_upd_apply)\n apply (rule hoare_grab_asm)+\n apply (subst new_cap_addrs_fold')\n apply (drule range_cover_not_zero_shift[rotated])\n apply (rule le_add2)\n apply (simp add:word_le_sub1 del:fun_upd_apply)+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (clarsimp simp:valid_pspace'_def linorder_not_less simp del:fun_upd_apply)\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (cases \"P' val\")\n apply simp\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def)\n apply (fastforce simp:ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\n\nlemma createObjects_orig_obj_at2':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (obj_at' P' p s)\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (obj_at' P' p s)\\\"\n unfolding obj_at'_real_def\n by (wp createObjects_orig_ko_wp_at2') auto\n\nlemma createObjects_orig_cte_wp_at2':\n \"\\\\s. P (cte_wp_at' P' p s)\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ (case_option False (P' \\ getF) (projectKO_opt val)))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: cte_wp_at'_obj_at')\n apply (rule handy_prop_divs)\n apply (wp createObjects_orig_obj_at2'[where sz = sz], simp)\n apply (simp add: tcb_cte_cases_def)\n including no_pre\n apply (wp handy_prop_divs createObjects_orig_obj_at2'[where sz = sz]\n | simp add: o_def cong: option.case_cong)+\n done\n\nlemma threadSet_cte_wp_at2'T:\n assumes \"\\tcb. \\(getF, setF) \\ ran tcb_cte_cases. getF (F tcb) = getF tcb\"\n shows \"\\\\s. P (cte_wp_at' P' p s)\\ threadSet F t \\\\rv s. P (cte_wp_at' P' p s)\\\"\n using assms by (rule threadSet_cte_wp_at'T)\n\nlemmas threadSet_cte_wp_at2' =\n threadSet_cte_wp_at2'T [OF all_tcbI, OF ball_tcb_cte_casesI]\n\nlemma createNewCaps_cte_wp_at2:\n \"\\\\s. P (cte_wp_at' P' p s) \\ \\ P' makeObject\n \\ n \\ 0\n \\ range_cover ptr sz (APIType_capBits ty objsz) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n objsz dev\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n including no_pre\n apply (simp add: createNewCaps_def createObjects_def X64_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: createNewCaps_def createObjects_def Arch_createNewCaps_def\n split del: if_split cong: if_cong)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp add:createObjects_def)\n apply ((wp createObjects_orig_cte_wp_at2'[where sz = sz]\n mapM_x_wp' threadSet_cte_wp_at2')+\n | assumption\n | clarsimp simp: APIType_capBits_def projectKO_opts_defs\n makeObject_tcb tcb_cte_cases_def\n archObjSize_def bit_simps\n createObjects_def curDomain_def\n objBits_if_dev\n split del: if_split\n | simp add: objBits_simps)+\n done\n\nlemma createObjects_orig_obj_at':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ obj_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r. obj_at' P p\\\"\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: createObjects'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (wp|simp add:split_def cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (clarsimp simp del:fun_upd_apply)\n apply (simp add:range_cover_def is_aligned_mask)\n apply (subst data_map_insert_def[symmetric])+\n apply clarsimp\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst retype_obj_at',simp+)+\n apply (intro conjI impI allI)\n apply (clarsimp simp:obj_at'_real_def ko_wp_at'_def)\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply simp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def obj_at'_real_def ko_wp_at'_def)\n apply simp+\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\ncrunch ko_wp_at'[wp]: doMachineOp \"\\s. P (ko_wp_at' P' p s)\"\n\nlemma createObjects_orig_cte_wp_at':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ cte_wp_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. cte_wp_at' P p s\\\"\n apply (simp add: cte_wp_at'_obj_at' tcb_cte_cases_def)\n apply (rule hoare_pre, wp hoare_vcg_disj_lift createObjects_orig_obj_at'[where sz = sz])\n apply clarsimp\n done\n\nlemma createNewCaps_cte_wp_at':\n \"\\\\s. cte_wp_at' P p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us dev\n \\\\rv. cte_wp_at' P p\\\"\n apply (simp add: createNewCaps_def X64_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (wp createObjects_orig_cte_wp_at'[where sz = sz] mapM_x_wp'\n threadSet_cte_wp_at'T\n | clarsimp simp: objBits_simps APIType_capBits_def createObjects_def curDomain_def\n archObjSize_def bit_simps\n | intro conjI impI\n | force simp: tcb_cte_cases_def)+\n done\n\nlemma createObjects_obj_at_other:\n assumes cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and not_0: \"n\\ 0\"\n shows \"\\\\s. obj_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\_. obj_at' P p\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_orig_obj_at'[where sz = sz])\n using cover not_0\n apply (clarsimp simp: cover not_0 valid_pspace'_def pspace_no_overlap'_def)\n done\n\nlemma valid_cap'_range_no_overlap:\n \"\\untypedRange c \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; s \\' c;\n valid_pspace' s; pspace_no_overlap' ptr sz s;\n range_cover ptr sz (objBitsKO val) n\\\n \\ s\\ksPSpace := foldr (\\addr. data_map_insert addr val)\n (new_cap_addrs n ptr val) (ksPSpace s)\\ \\' c\"\n apply (cases c; simp add: valid_cap'_def cte_wp_at_obj_cases' valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm\n del: Int_atLeastAtMost)[1]\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches vspace_table_at'_defs)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n apply (rename_tac word nat1 nat2)\n apply (clarsimp simp:valid_untyped'_def retype_ko_wp_at'\n simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (intro conjI impI)\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (erule disjE)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2[OF psubset_imp_subset])\n apply (simp add: Int_absorb ptr_add_def p_assoc_help\n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(1) obj_range'_subset)\n apply (drule_tac A'=\" {word + of_nat nat2..word + 2 ^ nat1 - 1}\" in disjoint_subset[rotated])\n apply clarsimp\n apply (rule is_aligned_no_wrap')\n apply (fastforce simp:capAligned_def)\n apply (erule of_nat_less_pow_64)\n apply (simp add:capAligned_def)\n apply (drule(1) disjoint_subset2)\n apply blast\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2)\n apply (simp add: Int_absorb ptr_add_def p_assoc_help\n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n done\n\nlemma createObjects_valid_cap':\n \"\\valid_cap' c and valid_pspace' and pspace_no_overlap' ptr sz and\n K (untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2^sz - 1} = {} \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects' ptr n val gbits\n \\\\_. valid_cap' c\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (clarsimp simp: linorder_not_less valid_pspace'_def)\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])+\n apply clarsimp\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst range_cover.unat_of_nat_n_shift,simp+)+\n apply (subst (asm) range_cover.unat_of_nat_n_shift,simp+)+\n apply (intro conjI impI allI)\n apply (erule(4) valid_cap'_range_no_overlap)+\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_cte_wp_at':\n \"\\range_cover ptr sz (objBitsKO val + gbits) n; n \\ 0\\\n \\\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\_. cte_wp_at' P p\\\"\n apply (clarsimp simp: valid_def cte_wp_at_obj_cases')\n apply (erule disjE)\n apply (erule use_valid[OF _ ])\n apply (rule createObjects_orig_obj_at')\n apply fastforce\n apply clarsimp\n apply (drule_tac x = na in bspec)\n apply clarsimp\n apply clarsimp\n apply (drule use_valid[OF _ createObjects_orig_obj_at'])\n apply fastforce\n apply simp\n done\n\nlemma createNewCaps_cte_wp_at:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0 : \"n \\ 0\"\n shows \"\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us dev\n \\\\_. cte_wp_at' P p\\\"\n apply (wp createNewCaps_cte_wp_at')\n apply (auto simp: cover not_0)\n done\n\nlemma createObjects_ret2:\n \"\\(\\s. P (map (\\p. ptr_add y (p * 2 ^ (objBitsKO ko + gbits)))\n [0.. n \\ 0)\\\n createObjects y n ko gbits \\\\rv s. P rv\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret)\n apply simp+\n apply (rule hoare_vcg_prop)\n defer\n apply (clarsimp simp: power_add mult.commute mult.left_commute | assumption)+\n done\n\nlemma state_refs_ko_wp_at_eq:\n \"state_refs_of' s = (\\x. {r. ko_wp_at' (\\ko. r \\ refs_of' ko) x s})\"\n apply (rule ext)\n apply (simp add: state_refs_of'_def ko_wp_at'_def\n split: option.split)\n done\n\nlemma createObjects_state_refs_of'':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ P (state_refs_of' s) \\ refs_of' val = {}\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. P (state_refs_of' s)\\\"\n apply (clarsimp simp:valid_def lookupAround2_pspace_no state_refs_ko_wp_at_eq)\n apply (erule ssubst[where P = P,rotated])\n apply (rule ext)\n apply (rule set_eqI)\n apply clarsimp\n apply (intro iffI,rule ccontr)\n apply (drule_tac P1=\"\\x. \\ x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp\n apply (intro conjI)\n apply simp+\n apply (drule_tac P1=\"\\x. x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp+\n done\n\ncrunch state_refs_of'[wp]: copyGlobalMappings \"\\s. P (state_refs_of' s)\"\n (wp: crunch_wps)\n\nlemma createNewCaps_state_refs_of':\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ P (state_refs_of' s)\\\n createNewCaps ty ptr n us dev\n \\\\rv s. P (state_refs_of' s)\\\"\n unfolding createNewCaps_def\n apply (clarsimp simp: X64_H.toAPIType_def\n split del: if_split)\n apply (cases ty; simp add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (insert cover not_0)\n apply (wp mapM_x_wp' createObjects_state_refs_of'' threadSet_state_refs_of'\n | simp add: not_0 pspace_no_overlap'_def objBitsKO_def APIType_capBits_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint objBits_def\n makeObject_notification archObjSize_def createObjects_def\n curDomain_def bit_simps\n | intro conjI impI)+\n done\n\nlemma createObjects_iflive':\n \"\\\\s. if_live_then_nonz_cap' s \\ \\ live' val\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n apply (rule hoare_pre)\n apply (simp only: if_live_then_nonz_cap'_def\n ex_nonz_cap_to'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n hoare_vcg_ex_lift createObjects_orig_ko_wp_at2'\n createObjects_orig_cte_wp_at')\n apply clarsimp\n apply (intro conjI allI impI)\n apply simp_all\n apply (rule ccontr)\n apply clarsimp\n apply (drule(1) if_live_then_nonz_capE')\n apply (fastforce simp: ex_nonz_cap_to'_def)\n done\n\ncrunch ksReadyQueues[wp]: copyGlobalMappings \"\\s. P (ksReadyQueues s)\"\n (wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL1[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n (wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL2[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (wp: updateObject_default_inv crunch_wps)\n\ncrunch valid_idle'[wp]: copyGlobalMappings \"valid_idle'\"\n (simp: objBits_simps archObjSize_def\n wp: updateObject_default_inv crunch_wps setObject_idle' refl)\n\ncrunch iflive'[wp]: copyGlobalMappings \"if_live_then_nonz_cap'\"\n (wp: crunch_wps)\n\nlemma createNewCaps_iflive'[wp]:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ if_live_then_nonz_cap' s\\\n createNewCaps ty ptr n us dev\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n unfolding createNewCaps_def\n apply (insert cover)\n apply (clarsimp simp: toAPIType_def X64_H.toAPIType_def)\n apply (cases ty, simp_all add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_wp' createObjects_iflive' threadSet_iflive'\n | simp add: not_0 pspace_no_overlap'_def createObjects_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint\n makeObject_notification objBitsKO_def\n APIType_capBits_def objBits_def\n archObjSize_def bit_simps\n curDomain_def\n split del:if_split\n | simp split: if_split\n | fastforce)+\n done\n\nlemma createObjects_pspace_only:\n \"\\ \\f s. P (ksPSpace_update f s) = P s \\\n \\ \\P\\ createObjects' ptr n val gbits \\\\rv. P\\\"\n apply (simp add: createObjects_def createObjects'_def unless_def alignError_def\n split_def lookupAround2_pspace_no)\n apply wpsimp\n done\n\nlemma createObjects'_qs[wp]:\n \"\\\\s. P (ksReadyQueues s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueues s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\n(* FIXME move these 2 to TcbAcc_R *)\nlemma threadSet_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\nlemma threadSet_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\ncrunches createObjects, createNewCaps\n for qs[wp]: \"\\s. P (ksReadyQueues s)\"\n and qsL1[wp]: \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n and qsL2[wp]: \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (simp: crunch_simps wp: crunch_wps)\n\nlemma sch_act_wf_lift_asm:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\\n f\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (rule use_valid [OF _ ksA], assumption)\n apply (frule use_valid[OF _ kCT[of \"(=) (ksCurThread s)\" for s] refl])\n apply (frule use_valid[OF _ kCD[of \"(=) (ksCurDomain s)\" for s] refl])\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply (frule use_valid [OF _ tcbDomain], fastforce)\n apply auto\n done\n\nlemma valid_queues_lift_asm':\n assumes tat: \"\\d p t. \\\\s. \\ obj_at' (inQ d p) t s \\ Q d p s\\ f \\\\_ s. \\ obj_at' (inQ d p) t s\\\"\n and prq: \"\\P. \\\\s. P (ksReadyQueues s)\\ f \\\\_ s. P (ksReadyQueues s)\\\"\n shows \"\\\\s. valid_queues' s \\ (\\d p. Q d p s)\\ f \\\\_. valid_queues'\\\"\n apply (simp only: valid_queues'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n tat prq)\n apply simp\n done\n\nlemma createObjects'_ct[wp]:\n \"\\\\s. P (ksCurThread s)\\ createObjects' p n v us \\\\rv s. P (ksCurThread s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunches createObjects, createNewCaps\n for ct[wp]: \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps simp: crunch_simps)\ncrunches createObjects, doMachineOp, createNewCaps\n for ksCurDomain[wp]: \"\\s. P (ksCurDomain s)\"\n (ignore: clearMemory simp: unless_def crunch_simps wp: crunch_wps)\n\nlemma copyGlobalMappings_ko_wp_at:\n \"\\(\\s. P (ko_wp_at' P' p s)) and K (\\pde_x :: pml4e. P' (injectKO pde_x) = v)\\\n copyGlobalMappings pd\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: copyGlobalMappings_def storePML4E_def)\n apply (wp mapM_x_wp' setObject_ko_wp_at)\n apply simp\n apply (simp add: objBits_simps archObjSize_def)\n apply simp\n apply (simp cong: if_cong split del: if_split)\n apply (wp getObject_inv loadObject_default_inv | simp split del: if_split)+\n apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs)\n apply (wp | simp)+\n done\n\nlemma threadSet_ko_wp_at2':\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\tcb_x :: tcb. P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps')+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma threadSet_ko_wp_at2'_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ obj_at' Q ptr s\n \\ (\\tcb_x :: tcb. Q tcb_x \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps')+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma mapM_x_threadSet_createNewCaps_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\addr\\set addrs. obj_at' (\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive) addr s)\n \\ (\\tcb_x :: tcb. tcbQueued (F tcb_x) = tcbQueued tcb_x \\ tcbState (F tcb_x) = tcbState tcb_x)\n \\ (\\tcb_x :: tcb. \\ tcbQueued tcb_x \\ tcbState tcb_x = Inactive \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n mapM_x (threadSet F) addrs\n \\\\_ s. P (ko_wp_at' P' p s)\\\" (is \"\\?PRE\\ _ \\\\_. ?POST\\\")\napply (rule mapM_x_inv_wp[where P=\"?PRE\"])\n apply simp\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ball_lift threadSet_ko_wp_at2'[where P=\"id\", simplified]\n | wp (once) threadSet_ko_wp_at2'_futz[where Q=\"\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive\"]\n | simp)+\ndone\n\nlemma createObjects_makeObject_not_tcbQueued:\n assumes \"range_cover ptr sz (objBitsKO tcb) n\"\n assumes \"n \\ 0\" \"tcb = injectKO (makeObject::tcb)\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n tcb 0\n \\\\rv s. \\addr\\set rv. obj_at' (\\tcb. \\ tcbQueued tcb \\ tcbState tcb = Structures_H.thread_state.Inactive) addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where 'a=tcb]])\n using assms\n apply (auto simp: obj_at'_def projectKO_opt_tcb objBitsKO_def\n objBits_def makeObject_tcb)\n done\n\nlemma createObjects_ko_wp_at2:\n \"\\\\s. range_cover ptr sz (objBitsKO ko + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' ko \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n ko gbits\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: createObjects_def)\napply (wp createObjects_orig_ko_wp_at2')\napply auto\ndone\n\nlemma createNewCaps_ko_wp_atQ':\n \"\\(\\s. P (ko_wp_at' P' p s)\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s)\n and K (\\pml4e_x :: pml4e. P' (injectKO pml4e_x)\n \\ (\\pml4e_y :: pml4e. P' (injectKO pml4e_y)))\n and K (\\d (tcb_x :: tcb). \\tcbQueued tcb_x \\ tcbState tcb_x = Inactive\n \\ P' (injectKO (tcb_x \\ tcbDomain := d \\)) = P' (injectKO tcb_x))\n and K (\\v. makeObjectKO d (Inr ty) = Some v\n \\ P' v \\ P True)\\\n createNewCaps ty ptr n us d\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: createNewCaps_def X64_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_threadSet_createNewCaps_futz\n mapM_x_wp'\n createObjects_obj_at\n createObjects_ko_wp_at2 createObjects_makeObject_not_tcbQueued\n copyGlobalMappings_ko_wp_at[where v=\"\\pml4e :: pml4e. P' (injectKO pml4e)\"]\n | simp add: makeObjectKO_def objBitsKO_def archObjSize_def APIType_capBits_def\n objBits_def curDomain_def bit_simps\n split del: if_split\n | intro conjI impI | fastforce\n | split if_split_asm)+\n done\n\nlemmas createNewCaps_ko_wp_at'\n = createNewCaps_ko_wp_atQ'[simplified, unfolded fold_K]\n\nlemmas createNewCaps_obj_at2 =\n createNewCaps_ko_wp_at'\n [where P'=\"\\ko. \\obj :: ('a :: pspace_storable).\n projectKO_opt ko = Some obj \\ P' obj\" for P',\n folded obj_at'_real_def,\n unfolded pred_conj_def, simplified]\n\nlemma createNewCaps_obj_at'':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (koType(TYPE('a)) = koType(TYPE(pml4e))\n \\ (\\x. P x)\n \\ (\\pml4e :: pml4e. \\x :: 'a. injectKO x = injectKO pml4e))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n apply (simp add: obj_at'_real_def)\n apply (wp createNewCaps_ko_wp_at')\n apply clarsimp\n apply (intro conjI impI)\n apply simp+\n apply clarsimp\n apply (clarsimp simp: projectKOs dest!: iffD1 [OF project_koType, OF exI])\n apply (clarsimp simp:project_inject)+\ndone\n\nlemma createNewCaps_obj_at':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ koType(TYPE('a)) \\ koType(TYPE(pml4e))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n by (wp createNewCaps_obj_at'', auto)\n\nlemmas createNewCaps_pred_tcb_at'\n = createNewCaps_obj_at'[where P=\"\\ko. (Q :: 'a :: type \\ bool) (proj (tcb_to_itcb' ko))\" for Q proj,\n folded pred_tcb_at'_def, simplified]\n\nlemma createNewCaps_cur:\n \"\\range_cover ptr sz (APIType_capBits ty us) n ; n \\ 0\\ \\\n \\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n cur_tcb' s\\\n createNewCaps ty ptr n us d\n \\\\rv. cur_tcb'\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createNewCaps_obj_at')\n apply (clarsimp simp: pspace_no_overlap'_def cur_tcb'_def valid_pspace'_def)\n apply auto\n done\n\ncrunch ksInterrupt[wp]: createNewCaps \"\\s. P (ksInterruptState s)\"\n (simp: crunch_simps unless_def\n wp: setObject_ksInterrupt updateObject_default_inv crunch_wps\n ignore: clearMemoryVM)\n\nlemma createNewCaps_ifunsafe':\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createNewCaps ty ptr n us d\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createNewCaps_ksInterrupt])\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2 hoare_vcg_ex_lift)\n apply (simp add: makeObject_cte pspace_no_overlap'_def\n valid_pspace'_def)\n apply auto\n done\n\nlemma createObjects_nosch'[wp]:\n \"\\\\s. P (ksSchedulerAction s)\\\n createObjects' ptr n val gbits\n \\\\rv s. P (ksSchedulerAction s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunches copyGlobalMappings\n for nosch[wp]: \"\\s. P (ksSchedulerAction s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\ncrunches createObjects, createNewCaps\n for nosch[wp]: \"\\s. P (ksSchedulerAction s)\"\n (simp: crunch_simps wp: crunch_wps)\n\ncrunches createObjects, createNewCaps\n for it[wp]: \"\\s. P (ksIdleThread s)\"\n (wp: crunch_wps simp: crunch_simps unless_def)\n\nlemma createObjects_idle':\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and (\\s. \\ case_option False (\\cte. ksIdleThread s \\ capRange (cteCap cte))\n (projectKO_opt val)\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ case_option False (\\tcb. ksIdleThread s \\ capRange (cteCap (getF tcb)))\n (projectKO_opt val)))\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects' ptr n val gbits\n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (clarsimp simp add: valid_idle'_def pred_tcb_at'_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_as_subst [OF createObjects'_it])\n apply (wp createObjects_orig_obj_at'\n createObjects_orig_cte_wp_at2'\n hoare_vcg_all_lift | simp)+\n apply (clarsimp simp: valid_idle'_def projectKOs o_def\n pred_tcb_at'_def valid_pspace'_def\n cong: option.case_cong)\n apply auto\n done\n\nlemma createNewCaps_idle'[wp]:\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (clarsimp simp: createNewCaps_def X64_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (wp, simp)\n including no_pre\n apply (wp mapM_x_wp'\n createObjects_idle'\n threadSet_idle'\n | simp add: projectKO_opt_tcb projectKO_opt_cte\n makeObject_cte makeObject_tcb archObjSize_def\n tcb_cte_cases_def objBitsKO_def APIType_capBits_def\n objBits_def createObjects_def bit_simps\n | intro conjI impI\n | fastforce simp: curDomain_def)+\n done\n\ncrunch ksArch[wp]: createNewCaps \"\\s. P (ksArchState s)\"\n (simp: crunch_simps unless_def wp: crunch_wps)\ncrunch it[wp]: createNewCaps \"\\s. P (ksIdleThread s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv)\ncrunch gsMaxObjectSize[wp]: createNewCaps \"\\s. P (gsMaxObjectSize s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv)\n\nlemma createNewCaps_global_refs':\n \"\\\\s. range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s \\ valid_global_refs' s\n \\ 0 < gsMaxObjectSize s\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_global_refs'\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createNewCaps_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createNewCaps_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (wp hoare_vcg_all_lift createNewCaps_cte_wp_at2[where sz=sz])\n apply (clarsimp simp: cte_wp_at_ctes_of global_refs'_def\n makeObject_cte)\n apply (auto simp: linorder_not_less ball_ran_eq)\n done\n\nlemma koTypeOf_eq_UserDataT:\n \"(koTypeOf ko = UserDataT)\n = (ko = KOUserData)\"\n by (cases ko, simp_all)\n\nlemma createNewCaps_valid_arch_state:\n \"\\(\\s. valid_arch_state' s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ (tp = APIObjectType ArchTypes_H.CapTableObject \\ us > 0))\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_arch_state'\\\"\n apply (simp add: valid_arch_state'_def\n valid_asid_table'_def\n valid_global_pts'_def\n valid_global_pds'_def\n valid_global_pdpts'_def\n vspace_table_at'_defs\n typ_at_to_obj_at_arches)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArch])\n apply (wp hoare_vcg_const_Ball_lift\n hoare_vcg_prop\n createNewCaps_obj_at''\n createNewCaps_ko_wp_at'\n hoare_vcg_all_lift\n hoare_vcg_const_imp_lift)\n apply (clarsimp simp: valid_pspace'_def o_def)\n apply (intro conjI)\n apply auto\n done\n\nlemma valid_irq_node_lift_asm:\n assumes x: \"\\P. \\\\s. P (irq_node' s)\\ f \\\\rv s. P (irq_node' s)\\\"\n assumes y: \"\\p. \\real_cte_at' p and Q\\ f \\\\rv. real_cte_at' p\\\"\n shows \"\\\\s. valid_irq_node' (irq_node' s) s \\ Q s\\ f \\\\rv s. valid_irq_node' (irq_node' s) s\\\"\n apply (simp add: valid_irq_node'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF x])\n apply (wp hoare_vcg_all_lift y)\n apply simp\n done\n\nlemma valid_irq_handlers_cte_wp_at_form':\n \"valid_irq_handlers' = (\\s. \\irq. irq_issued' irq s \\\n (\\p. \\ cte_wp_at' (\\cte. cteCap cte = IRQHandlerCap irq) p s))\"\n by (auto simp: valid_irq_handlers'_def cteCaps_of_def cte_wp_at_ctes_of\n fun_eq_iff ran_def)\n\nlemma createNewCaps_irq_handlers':\n \"\\valid_irq_handlers' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_irq_handlers'\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2)\n apply (clarsimp simp: makeObject_cte)\n apply auto\n done\n\nlemma valid_ioports_cte_wp_at_form':\n \"(\\s. all_ioports_issued' (cteCaps_of s) f \\ ioports_no_overlap' (cteCaps_of s)) = (\\s. (\\irq. irq \\ issued_ioports' f \\\n (\\p. \\ cte_wp_at' (\\cte. irq \\ cap_ioports' (cteCap cte)) p s)) \\\n (\\sl sl' cap cap'. cte_wp_at' (\\cte. cteCap cte = cap) sl s\n \\ cte_wp_at' (\\cte. cteCap cte = cap') sl' s \\\n cap_ioports' cap = cap_ioports' cap' \\ cap_ioports' cap \\ cap_ioports' cap' = {}))\"\n by (auto simp: valid_ioports'_simps cteCaps_of_def cte_wp_at_ctes_of\n fun_eq_iff ran_def | blast)+\n\nlemma createNewCaps_ioports':\n \"\\valid_ioports' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_ioports'\\\"\n apply (clarsimp simp: valid_ioports'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArch])\n apply (simp add: valid_ioports_cte_wp_at_form')\n apply (wpsimp wp: hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_imp_lift' |\n wp createNewCaps_cte_wp_at2)+\n apply (clarsimp simp: makeObject_cte)\n by (auto simp: valid_ioports'_simps cte_wp_at_ctes_of ran_def cteCaps_of_def | blast)+\n\nlemma createObjects'_irq_states' [wp]:\n \"\\valid_irq_states'\\ createObjects' a b c d \\\\_. valid_irq_states'\\\"\n apply (simp add: createObjects'_def split_def)\n apply (wp unless_wp|wpc|simp add: alignError_def)+\n apply fastforce\n done\n\ncrunch irq_states' [wp]: createNewCaps valid_irq_states'\n (wp: crunch_wps no_irq no_irq_clearMemory simp: crunch_simps unless_def)\n\ncrunch ksMachine[wp]: createObjects \"\\s. P (ksMachineState s)\"\n (simp: crunch_simps unless_def)\ncrunch cur_domain[wp]: createObjects \"\\s. P (ksCurDomain s)\"\n (simp: unless_def)\n\nlemma createNewCaps_valid_queues':\n \"\\valid_queues' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues'\\\"\n apply (wp valid_queues_lift_asm' [OF createNewCaps_obj_at2])\n apply (clarsimp simp: projectKOs)\n apply (simp add: makeObjectKO_def\n split: object_type.split_asm\n apiobject_type.split_asm)\n apply (clarsimp simp: inQ_def)\n apply (auto simp: makeObject_tcb\n split: object_type.splits apiobject_type.splits)\n done\n\nlemma createNewCaps_valid_queues:\n \"\\valid_queues and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues\\\"\napply (rule hoare_gen_asm)\napply (wp valid_queues_lift_asm createNewCaps_obj_at2[where sz=sz])\napply (clarsimp simp: projectKO_opts_defs)\napply (simp add: inQ_def)\napply (wp createNewCaps_pred_tcb_at'[where sz=sz] | simp)+\ndone\n\nlemma mapM_x_threadSet_valid_pspace:\n \"\\valid_pspace' and K (curdom \\ maxDomain)\\\n mapM_x (threadSet (tcbDomain_update (\\_. curdom))) addrs \\\\y. valid_pspace'\\\"\n apply (rule hoare_gen_asm)\n apply (wp mapM_x_wp' threadSet_valid_pspace')\n apply simp_all\n done\n\nlemma createNewCaps_valid_pspace:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n and ptr_km: \"ptr && ~~ mask sz \\ kernel_mappings\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0 \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s \\ ksCurDomain s \\ maxDomain\\\n createNewCaps ty ptr n us dev \\\\r. valid_pspace'\\\"\n unfolding createNewCaps_def Arch_createNewCaps_def\n using valid_obj_makeObject_rules ptr_cn sz_limit ptr_km\n apply (clarsimp simp: X64_H.toAPIType_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp, clarsimp)\n apply (insert cover)\n apply (wp createObjects_valid_pspace_untyped' [OF _ not_0 , where ty=\"Inr ty\" and sz = sz]\n mapM_x_threadSet_valid_pspace mapM_x_wp'\n | simp add: makeObjectKO_def archObjSize_def APIType_capBits_def\n objBits_simps not_0 createObjects_def curDomain_def bit_simps\n | intro conjI impI\n | simp add: power_add field_simps)+\n done\n\nlemma copyGlobalMappings_inv[wp]:\n \"\\\\s. P (ksMachineState s)\\\n copyGlobalMappings newPM\n \\\\_ s. P (ksMachineState s)\\\"\n by (simp add: copyGlobalMappings_def storePML4E_def split_def\n | wp mapM_x_wp_inv setObject_ksMachine updateObject_default_inv)+\n\nlemma doMachineOp_return_foo:\n \"doMachineOp (do x\\a;return () od) = (do (doMachineOp a); return () od)\"\n apply (clarsimp simp: doMachineOp_def bind_def gets_def\n get_def return_def select_f_def split_def simpler_modify_def)\n apply (rule ext)+\n apply simp\n apply (rule set_eqI)\n apply clarsimp\n done\n\nlemma createNewCaps_vms:\n \"\\pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and\n K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) and\n valid_machine_state'\\\n createNewCaps ty ptr n us dev\n \\\\archCaps. valid_machine_state'\\\"\n apply (clarsimp simp: valid_machine_state'_def pointerInDeviceData_def\n Arch_createNewCaps_def createNewCaps_def pointerInUserData_def\n typ_at'_def createObjects_def doMachineOp_return_foo\n split del: if_split)\n apply (rule hoare_pre)\n apply (wpc\n | wp hoare_vcg_const_Ball_lift hoare_vcg_disj_lift\n hoare_vcg_all_lift\n doMachineOp_ko_wp_at' createObjects_orig_ko_wp_at2'[where sz = sz]\n hoare_vcg_all_lift\n dmo_lift' mapM_x_wp' copyGlobalMappings_ko_wp_at threadSet_ko_wp_at2'\n | clarsimp simp: createObjects_def Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split\n | assumption)+\n apply (case_tac ty)\n apply (auto simp: APIType_capBits_def archObjSize_def objBits_simps\n toAPIType_def object_type.splits bit_simps)\n done\n\nlemma createObjects_pspace_domain_valid':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects' ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects'_def split_def unless_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp only: alignError_def haskell_assert_def)+\n apply (clarsimp simp: new_cap_addrs_fold' unat_1_0 unat_gt_0\n range_cover_not_zero_shift\n caps_overlap_reserved'_def)\n apply (simp add: pspace_domain_valid_def foldr_upd_app_if\n fun_upd_def[symmetric])\n apply (subgoal_tac \" \\x \\ set (new_cap_addrs (unat (of_nat n << gbits)) ptr\n val). {x..x + 2 ^ objBitsKO val - 1}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply blast\n\n apply (rule ballI)\n apply (rule new_range_subset)\n apply (erule range_cover_rel, simp+)\n apply (simp add: range_cover.unat_of_nat_n_shift field_simps)\n done\n\nlemma createObjects_pspace_domain_valid:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_pspace_domain_valid'[where sz=sz])\n apply (simp add: objBits_def)\n done\n\ncrunch pspace_domain_valid[wp]: copyGlobalMappings \"pspace_domain_valid\"\n (wp: crunch_wps)\n\nlemma createNewCaps_pspace_domain_valid[wp]:\n \"\\pspace_domain_valid and K ({ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\n \\ kernel_data_refs = {}\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\rv. pspace_domain_valid\\\"\n apply (simp add: createNewCaps_def)\n apply (rule hoare_pre)\n apply (wp createObjects_pspace_domain_valid[where sz=sz]\n mapM_x_wp'\n | wpc | simp add: Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split)+\n apply (simp add: X64_H.toAPIType_def\n split: object_type.splits)\n apply (auto simp: objBits_simps APIType_capBits_def archObjSize_def bit_simps)\n done\n\ncrunch cur_domain[wp]: createNewCaps \"\\s. P (ksCurDomain s)\"\n (wp: crunch_wps)\n\n(* FIXME: move *)\nlemma ct_idle_or_in_cur_domain'_lift_futz:\n assumes a: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes b: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n assumes c: \"\\P. \\\\s. P (ksIdleThread s)\\ f \\\\_ s. P (ksIdleThread s)\\\"\n assumes d: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes e: \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t\\\"\n shows \"\\ct_idle_or_in_cur_domain' and ct_active' and Q\\ f \\\\_. ct_idle_or_in_cur_domain'\\\"\nproof -\n from e have e':\n \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. d = tcbDomain tcb) t\\\"\n apply (rule hoare_strengthen_post)\n apply (auto simp: obj_at'_def)\n done\n show ?thesis\n apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (rule hoare_pre)\n apply (wps a b c d)\n apply (wp static_imp_wp e' hoare_vcg_disj_lift)\n apply (auto simp: obj_at'_def ct_in_state'_def projectKOs st_tcb_at'_def)\n done\nqed\n\nlemma createNewCaps_ct_idle_or_in_cur_domain':\n \"\\ct_idle_or_in_cur_domain' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and ct_active' and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) \\\n createNewCaps ty ptr n us dev\n \\\\rv. ct_idle_or_in_cur_domain'\\\"\n apply (wp ct_idle_or_in_cur_domain'_lift_futz createNewCaps_obj_at'[where sz=sz] | simp)+\n done\n\nlemma sch_act_wf_lift_asm_futz:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\\n f\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (rule use_valid [OF _ ksA], assumption)\n apply (frule use_valid [OF _ kCT[of \"(=) (ksCurThread s)\" for s] refl])\n apply (frule use_valid [OF _ kCD[of \"(=) (ksCurDomain s)\" for s] refl])\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply simp\n apply (rename_tac word)\n apply (subgoal_tac \"(obj_at' (\\tcb. runnable' (tcbState tcb) \\ ksCurDomain b = tcbDomain tcb) word and Q) s\")\n apply (drule use_valid [OF _ tcbDomain], fastforce)\n apply (auto simp: st_tcb_at'_def o_def obj_at'_def ko_wp_at'_def)\n done\n\nlemma createNewCaps_sch_act_wf:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\_ s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (wp sch_act_wf_lift_asm_futz\n createNewCaps_pred_tcb_at'[where sz=sz]\n createNewCaps_obj_at'[where sz=sz]\n | simp)+\n done\n\nlemma createObjects'_ksDomSchedule[wp]:\n \"\\\\s. P (ksDomSchedule s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomSchedule s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\nlemma createObjects'_ksDomScheduleIdx[wp]:\n \"\\\\s. P (ksDomScheduleIdx s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomScheduleIdx s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\ncrunch ksDomSchedule[wp]: copyGlobalMappings \"\\s. P (ksDomSchedule s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp')\n\ncrunch ksDomSchedule[wp]: createNewCaps \"\\s. P (ksDomSchedule s)\"\n (wp: mapM_x_wp' simp: crunch_simps)\n\ncrunch ksDomScheduleIdx[wp]: createNewCaps \"\\s. P (ksDomScheduleIdx s)\"\n (wp: mapM_x_wp' simp: crunch_simps)\n\nlemma createObjects_null_filter':\n \"\\\\s. P (null_filter' (ctes_of s)) \\ makeObjectKO dev ty = Some val \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\addrs a. P (null_filter' (ctes_of a))\\\"\n apply (clarsimp simp: createObjects'_def split_def)\n apply (wp unless_wp|wpc\n | clarsimp simp:haskell_assert_def alignError_def\n split del: if_splits simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp\n apply assumption\n apply simp\n apply (subst data_map_insert_def[symmetric])+\n apply (frule(2) retype_aligned_distinct'[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule(2) retype_aligned_distinct'(2)[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule null_filter_ctes_retype\n [where addrs = \"(new_cap_addrs (unat (((of_nat n)::machine_word) << gbits)) ptr val)\"])\n apply assumption+\n apply (clarsimp simp:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n range_cover.unat_of_nat_shift)+\n apply (rule new_cap_addrs_aligned[THEN bspec])\n apply (erule range_cover.aligned[OF range_cover_rel])\n apply simp+\n apply (clarsimp simp:shiftl_t2n field_simps range_cover.unat_of_nat_shift)\n apply (drule subsetD[OF new_cap_addrs_subset,rotated])\n apply (erule range_cover_rel)\n apply simp\n apply simp\n apply (rule ccontr)\n apply clarify\n apply (frule(1) pspace_no_overlapD')\n apply (erule_tac B = \"{x..x+2^objBitsKO y - 1}\" in in_empty_interE[rotated])\n apply (drule(1) pspace_alignedD')\n apply (clarsimp)\n apply (erule is_aligned_no_overflow)\n apply (simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff add:Int_ac ptr_add_def p_assoc_help)\n apply (simp add:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n)\n apply auto\n done\n\nlemma createNewCaps_null_filter':\n \"\\(\\s. P (null_filter' (ctes_of s)))\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\_ s. P (null_filter' (ctes_of s))\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createNewCaps_def toAPIType_def\n Arch_createNewCaps_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp,simp)\n apply (simp add: createObjects_def makeObjectKO_def APIType_capBits_def objBits_def\n archObjSize_def curDomain_def objBits_if_dev bit_simps\n split del: if_split\n | wp createObjects_null_filter'[where ty = \"Inr ty\" and sz = sz and dev=dev]\n copyGlobalMappings_ctes_of threadSet_ctes_of mapM_x_wp'\n | simp add: objBits_simps\n | fastforce)+\n done\n\ncrunch gsUntypedZeroRanges[wp]: createNewCaps \"\\s. P (gsUntypedZeroRanges s)\"\n (wp: mapM_x_wp' simp: crunch_simps)\n\nlemma untyped_ranges_zero_inv_null_filter:\n \"untyped_ranges_zero_inv (option_map cteCap o null_filter' ctes)\n = untyped_ranges_zero_inv (option_map cteCap o ctes)\"\n apply (simp add: untyped_ranges_zero_inv_def fun_eq_iff null_filter'_def)\n apply clarsimp\n apply (rule_tac f=\"\\caps. x = ran caps\" for caps in arg_cong)\n apply (clarsimp simp: fun_eq_iff map_comp_def untypedZeroRange_def)\n done\n\nlemma untyped_ranges_zero_inv_null_filter_cteCaps_of:\n \"untyped_ranges_zero_inv (cteCaps_of s)\n = untyped_ranges_zero_inv (option_map cteCap o null_filter' (ctes_of s))\"\n by (simp add: untyped_ranges_zero_inv_null_filter cteCaps_of_def)\n\nlemma createNewCaps_urz:\n \"\\untyped_ranges_zero'\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\archCaps. untyped_ranges_zero'\\\"\n apply (simp add: untyped_ranges_zero_inv_null_filter_cteCaps_of)\n apply (rule hoare_pre)\n apply (rule untyped_ranges_zero_lift)\n apply (wp createNewCaps_null_filter')+\n apply (auto simp: o_def)\n done\n\nlemma createNewCaps_invs':\n \"\\(\\s. invs' s \\ ct_active' s \\ pspace_no_overlap' ptr sz s\n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s\n \\ (ty = APIObjectType ArchTypes_H.CapTableObject \\ us > 0)\n \\ gsMaxObjectSize s > 0)\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings)\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n (is \"\\?P and K ?Q\\ ?f \\\\rv. invs'\\\")\nproof (rule hoare_gen_asm, elim conjE)\n assume cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n and sz_limit: \"sz \\ maxUntypedSizeBits\"\n and ptr_cn: \"canonical_address (ptr && ~~ mask sz)\"\n and ptr_km: \"ptr && ~~ mask sz \\ kernel_mappings\"\n have cnc_ct_not_inQ:\n \"\\ct_not_inQ and valid_pspace' and pspace_no_overlap' ptr sz\\\n createNewCaps ty ptr n us dev \\\\_. ct_not_inQ\\\"\n unfolding ct_not_inQ_def\n apply (rule_tac Q=\"\\s. ksSchedulerAction s = ResumeCurrentThread\n \\ (obj_at' (Not \\ tcbQueued) (ksCurThread s) s\n \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createNewCaps_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createNewCaps_ct)\n apply (wp createNewCaps_obj_at')\n using cover not_0\n apply (fastforce simp: valid_pspace'_def)\n done\n show \"\\?P\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n apply (simp add: invs'_def valid_state'_def\n pointerInUserData_def typ_at'_def)\n apply (rule hoare_pre)\n apply (wp createNewCaps_valid_pspace [OF not_0 cover sz_limit ptr_cn ptr_km]\n createNewCaps_state_refs_of' [OF cover not_0 ]\n createNewCaps_iflive' [OF cover not_0 ]\n irqs_masked_lift\n createNewCaps_ifunsafe'\n createNewCaps_cur [OF cover not_0]\n createNewCaps_global_refs'\n createNewCaps_valid_arch_state\n valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createNewCaps_obj_at']\n createNewCaps_irq_handlers' createNewCaps_vms createNewCaps_ioports'\n createNewCaps_valid_queues\n createNewCaps_valid_queues'\n createNewCaps_pred_tcb_at' cnc_ct_not_inQ\n createNewCaps_ct_idle_or_in_cur_domain'\n createNewCaps_sch_act_wf\n createNewCaps_urz[where sz=sz]\n | simp)+\n using not_0\n apply (clarsimp simp: valid_pspace'_def)\n using cover\n apply (intro conjI)\n apply simp_all\n done\nqed\n\nlemma createObjects_obj_ranges':\n \"\\\\s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {}) \\\n pspace_no_overlap' ptr sz s \\\n pspace_aligned' s \\ pspace_distinct' s \\\n S \\ {ptr..(ptr &&~~ mask sz) + 2^sz - 1} = {} \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects' ptr n val gbits\n \\\\r s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {})\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del: fun_upd_apply)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (clarsimp simp: foldr_fun_upd_value)\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (erule(1) disjoint_subset[OF obj_range'_subset])\n apply (simp add: Int_commute)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_pred_tcb_at':\n \"\\pred_tcb_at' proj P t and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\\\n createObjects ptr n val gbits \\\\rv. pred_tcb_at' proj P t\\\"\n apply (simp add: pred_tcb_at'_def createObjects_def)\n apply (wp createObjects_orig_obj_at')\n apply auto\n done\n\nlemma createObjects_ex_cte_cap_to [wp]:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\ pspace_aligned' s \\\n pspace_distinct' s \\ ex_cte_cap_to' p s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. ex_cte_cap_to' p\\\"\n apply (simp add: ex_cte_cap_to'_def createObjects_def)\n apply (rule hoare_lift_Pf2 [where f=\"irq_node'\"])\n apply (wp hoare_vcg_ex_lift createObjects_orig_cte_wp_at'[where sz = sz])\n apply simp\n apply wp\n done\n\nlemma createObjects_orig_obj_at3:\n \"\\\\s. obj_at' P p s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\\n pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. obj_at' P p\\\"\n by (wp createObjects_orig_obj_at'[where sz = sz] | simp add: createObjects_def)+\n\nlemma createObjects_sch:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects ptr n val gbits\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (rule hoare_gen_asm)\n apply (wp sch_act_wf_lift_asm createObjects_pred_tcb_at' createObjects_orig_obj_at3 | force)+\n done\n\nlemma createObjects_queues:\n \"\\\\s. valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects ptr n val gbits\n \\\\rv. valid_queues\\\"\n apply (wp valid_queues_lift_asm [unfolded pred_conj_def, OF createObjects_orig_obj_at3]\n createObjects_pred_tcb_at' [unfolded pred_conj_def])\n apply fastforce\n apply wp+\n apply fastforce\n done\n\nlemma createObjects_queues':\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_queues' s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects ptr n val gbits\n \\\\rv. valid_queues'\\\"\n apply (simp add: createObjects_def)\n apply (wp valid_queues_lift_asm')\n apply (wp createObjects_orig_obj_at2')\n apply clarsimp\n apply assumption\n apply wp\n apply (clarsimp simp: no_tcb split: option.splits)\n apply fastforce\n done\n\nlemma createObjects_no_cte_ifunsafe':\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createObjects ptr n val gbits\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createObjects_ksInterrupt])\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_imp_lift\n createObjects_orig_cte_wp_at2' hoare_vcg_ex_lift)\n apply (simp add: valid_pspace'_def disj_imp)\n apply (simp add: split_def no_cte no_tcb split: option.splits)\n apply auto\n done\n\nlemma createObjects_no_cte_valid_global:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_global_refs' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_global_refs' s\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createObjects_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createObjects_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createObjects_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift createObjects_orig_cte_wp_at2')\n apply (simp add: no_cte no_tcb split_def cte_wp_at_ctes_of split: option.splits)\n apply (clarsimp simp: global_refs'_def)\n apply (auto simp: ball_ran_eq linorder_not_less[symmetric])\n done\n\nlemma createObjects'_typ_at:\n \"\\\\s. n \\ 0 \\\n range_cover ptr sz (objBitsKO val + gbits) n \\\n typ_at' T p s \\\n pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. typ_at' T p s\\\"\n apply (rule hoare_grab_asm)+\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def typ_at'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])\n apply clarsimp\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add: lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp: ptr_add_def p_assoc_help)\n apply (simp add: dom_def)\n apply (fastforce simp: ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_valid_arch:\n \"\\\\s. valid_arch_state' s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n createObjects ptr n val gbits\n \\\\rv s. valid_arch_state' s\\\"\n apply (simp add: valid_arch_state'_def valid_asid_table'_def\n valid_global_pts'_def valid_global_pds'_def valid_global_pdpts'_def\n vspace_table_at'_defs)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=ksArchState, OF createObjects_ksArch])\n apply (simp add: createObjects_def)\n apply (wp createObjects'_typ_at hoare_vcg_all_lift hoare_vcg_const_imp_lift\n hoare_vcg_const_Ball_lift)\n apply (simp add: o_def)\n apply auto\n done\n\nlemma createObjects_irq_state:\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_node' (irq_node' s) s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_node' (irq_node' s) s\\\"\n apply (wp valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createObjects_orig_obj_at3])\n apply auto\n done\n\nlemma createObjects_no_cte_irq_handlers:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_handlers' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_handlers' s\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' createObjects_def irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createObjects_orig_cte_wp_at2')\n apply (clarsimp simp: no_cte no_tcb split_def split: option.splits)\n apply auto\n done\n\nlemma createObjects_no_cte_ioports:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_ioports' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_ioports' s\\\"\n apply (simp add: valid_ioports'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq[where f=ksArchState, OF createObjects_ksArch])\n apply (clarsimp simp: valid_ioports_cte_wp_at_form' createObjects_def)\n apply (wpsimp wp: hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_imp_lift' |\n wp createObjects_orig_cte_wp_at2')+\n apply (clarsimp simp: no_cte no_tcb split_def split: option.splits)\n apply (auto simp: valid_ioports'_simps cteCaps_of_def cte_wp_at_ctes_of ran_def | blast)+\n done\n\nlemma createObjects_cur':\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n cur_tcb' s\\\n createObjects ptr n val gbits\n \\\\rv s. cur_tcb' s\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createObjects_orig_obj_at3)\n apply (clarsimp simp: cur_tcb'_def)\n apply auto\n done\n\nlemma createObjects_vms'[wp]:\n \"\\(\\_. (range_cover ptr sz (objBitsKO val + gbits) n \\ 0 < n)) and pspace_aligned' and\n pspace_distinct' and pspace_no_overlap' ptr sz and valid_machine_state'\\\n createObjects ptr n val gbits\n \\\\rv. valid_machine_state'\\\"\n apply (simp add: valid_machine_state'_def pointerInUserData_def pointerInDeviceData_def\n typ_at'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift createObjects_orig_ko_wp_at2'\n | simp add: createObjects_def)+\n apply auto\n done\n\nlemma createObjects_ct_idle_or_in_cur_domain':\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and ct_idle_or_in_cur_domain'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. ct_idle_or_in_cur_domain'\\\"\napply (rule hoare_gen_asm)\napply (wp ct_idle_or_in_cur_domain'_lift_futz createObjects_obj_at_other[where sz=sz])\napply simp_all\ndone\n\nlemma untyped_zero_ranges_cte_def:\n \"untyped_ranges_zero_inv (cteCaps_of s) rs\n = (\\r. (\\p. cte_wp_at' (\\cte. untypedZeroRange (cteCap cte) = Some r) p s)\n = (r \\ rs))\"\n apply (clarsimp simp: untyped_ranges_zero_inv_def cte_wp_at_ctes_of\n cteCaps_of_def set_eq_iff ran_def map_comp_Some_iff)\n apply (safe, metis+)\n done\n\ncrunch gsUntypedZeroRanges[wp]: createObjects \"\\s. P (gsUntypedZeroRanges s)\"\n (simp: unless_def)\n\nlemma createObjects_untyped_ranges_zero':\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n shows\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and untyped_ranges_zero'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. untyped_ranges_zero'\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: untyped_zero_ranges_cte_def iff_conv_conj_imp\n createObjects_def)\n apply (simp only: imp_conv_disj not_all not_ex)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_conj_lift\n hoare_vcg_disj_lift createObjects_orig_cte_wp_at2'[where sz=sz])\n apply (clarsimp simp: valid_pspace'_def)\n apply (cut_tac moKO[symmetric])\n apply (simp add: makeObjectKO_def projectKO_opt_tcb projectKO_opt_cte\n split: sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n object_type.split_asm apiobject_type.split_asm)\n apply (simp add: makeObject_tcb tcb_cte_cases_def makeObject_cte\n untypedZeroRange_def)\n apply (simp add: makeObject_cte untypedZeroRange_def)\n done\n\nlemma createObjects_no_cte_invs:\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. range_cover ptr sz ((objBitsKO val) + gbits) n \\ n \\ 0\n \\ sz \\ maxUntypedSizeBits \\ canonical_address (ptr && ~~ mask sz)\n \\ ptr && ~~ mask sz \\ kernel_mappings\n \\ invs' s \\ ct_active' s\n \\ pspace_no_overlap' ptr sz s \\ ptr \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ caps_overlap_reserved' {ptr..ptr + of_nat (n * 2 ^ gbits * 2 ^ objBitsKO val) - 1} s\n \\ caps_no_overlap'' ptr sz s \\\n refs_of' val = {} \\ \\ live' val\n \\ (\\pde. projectKO_opt val = Some pde \\ pde = InvalidPDE)\\\n createObjects ptr n val gbits\n \\\\rv. invs'\\\"\nproof -\n have co_ct_not_inQ:\n \"\\range_cover ptr sz ((objBitsKO val) + gbits) n; n \\ 0\\ \\\n \\\\s. ct_not_inQ s \\ pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n val gbits \\\\_. ct_not_inQ\\\"\n (is \"\\ _; _ \\ \\ \\\\s. ct_not_inQ s \\ ?REST s\\ _ \\_\\\")\n apply (simp add: ct_not_inQ_def)\n apply (rule_tac Q=\"\\s. (ksSchedulerAction s = ResumeCurrentThread) \\\n (obj_at' (Not \\ tcbQueued) (ksCurThread s) s \\ ?REST s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createObjects_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createObjects_ct)\n apply (wp createObjects_obj_at_other)\n apply (simp)+\n done\n show ?thesis\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: invs'_def valid_state'_def)\n apply wp\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def,wp createObjects_valid_pspace_untyped')\n apply (wp assms | simp add: objBits_def)+\n apply (wp createObjects_sch createObjects_queues)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_state_refs_of'')\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_iflive')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb] createObjects_no_cte_ioports\n assms | simp add: objBits_def )+\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_idle')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb] assms\n createObjects_pspace_domain_valid co_ct_not_inQ\n createObjects_ct_idle_or_in_cur_domain' createObjects_no_cte_ioports\n createObjects_untyped_ranges_zero'[OF moKO]\n | simp)+\n apply clarsimp\n apply ((intro conjI; assumption?); simp add: valid_pspace'_def objBits_def)\n apply (fastforce simp add: no_cte no_tcb split_def split: option.splits)\n apply (clarsimp simp: invs'_def no_tcb valid_state'_def no_cte split: option.splits)\n done\nqed\n\nlemma corres_retype_update_gsI:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"sz < obj_bits_api (APIType_map2 ty) us \\\n sz < objBitsKO ko + gbits\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and f: \"f = update_gs (APIType_map2 ty) us\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (f (set addrs));\n return (g addrs)\n od)\"\n using corres_retype' [OF not_zero aligned obj_bits_api check usv ko orr cover]\n by (simp add: f)\n\nlemma gcd_corres: \"corres (=) \\ \\ (gets cur_domain) curDomain\"\n by (simp add: curDomain_def state_relation_def)\n\nlemma retype_region2_extra_ext_mapM_x_corres:\n shows \"corres dc\n (valid_etcbs and (\\s. \\addr\\set addrs. tcb_at addr s))\n (\\s. \\addr\\set addrs. tcb_at' addr s)\n (retype_region2_extra_ext addrs Structures_A.apiobject_type.TCBObject)\n (mapM_x (\\addr. do cdom \\ curDomain;\n threadSet (tcbDomain_update (\\_. cdom)) addr\n od)\n addrs)\"\n apply (rule corres_guard_imp)\n apply (simp add: retype_region2_extra_ext_def curDomain_mapM_x_futz[symmetric] when_def)\n apply (rule corres_split_eqr[OF gcd_corres])\n apply (rule_tac S=\"Id \\ {(x, y). x \\ set addrs}\"\n and P=\"\\s. (\\t \\ set addrs. tcb_at t s) \\ valid_etcbs s\"\n and P'=\"\\s. \\t \\ set addrs. tcb_at' t s\"\n in corres_mapM_x)\n apply simp\n apply (rule corres_guard_imp)\n apply (rule ethread_set_corres, simp_all add: etcb_relation_def non_exst_same_def)[1]\n apply (case_tac tcb')\n apply simp\n apply fastforce\n apply fastforce\n apply (wp hoare_vcg_ball_lift | simp)+\n apply auto[1]\n apply (wp | simp add: curDomain_def)+\n done\n\nlemma retype_region2_extra_ext_trivial:\n \"ty \\ APIType_map2 (Inr (APIObjectType apiobject_type.TCBObject))\n \\ retype_region2_extra_ext ptrs ty = return ()\"\nby (simp add: retype_region2_extra_ext_def when_def APIType_map2_def)\n\nlemma retype_region2_retype_region_PML4Obj:\n \"retype_region ptr n us (APIType_map2 (Inr PML4Object)) dev =\n (retype_region2 ptr n us (APIType_map2 (Inr PML4Object)) dev :: obj_ref list det_ext_monad)\"\n by (simp add: retype_region2_ext_retype_region retype_region2_extra_ext_def when_def\n APIType_map2_def)\n\nlemma retype_region2_valid_etcbs[wp]:\"\\valid_etcbs\\ retype_region2 a b c d dev \\\\_. valid_etcbs\\\"\n apply (simp add: retype_region2_def)\n apply (simp add: retype_region2_ext_def bind_assoc)\n apply wp\n apply (clarsimp simp del: fun_upd_apply)\n apply (blast intro: valid_etcb_fold_update)\n done\n\nlemma retype_region2_obj_at:\n assumes tytcb: \"ty = Structures_A.apiobject_type.TCBObject\"\n shows \"\\\\\\ retype_region2 ptr n us ty dev \\\\rv s. \\x \\ set rv. tcb_at x s\\\"\n using tytcb unfolding retype_region2_def\n apply (simp only: return_bind bind_return foldr_upd_app_if fun_app_def K_bind_def)\n apply (wp dxo_wp_weak | simp)+\n apply (auto simp: obj_at_def default_object_def is_tcb_def)\n done\n\nlemma createObjects_tcb_at':\n \"\\range_cover ptr sz (objBitsKO (injectKOS (makeObject::tcb))) n; n \\ 0\\ \\\n \\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n (KOTCB makeObject) 0 \\\\ptrs s. \\addr\\set ptrs. tcb_at' addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where val = \"(makeObject :: tcb)\"]])\n apply (auto simp: obj_at'_def projectKOs project_inject objBitsKO_def objBits_def makeObject_tcb)\n done\n\nlemma init_arch_objects_APIType_map2_noop:\n \"tp \\ Inr PML4Object\n \\ init_arch_objects (APIType_map2 tp) ptr n m addrs\n = return ()\"\n apply (simp add: init_arch_objects_def APIType_map2_def)\n apply (cases tp, simp_all split: kernel_object.split arch_kernel_object.split\n object_type.split apiobject_type.split)\n done\n\nlemma data_page_relation_retype:\n \"obj_relation_retype (ArchObj (DataPage False pgsz)) KOUserData\"\n \"obj_relation_retype (ArchObj (DataPage True pgsz)) KOUserDataDevice\"\n apply (simp_all add: obj_relation_retype_def\n objBits_simps archObjSize_def\n pbfs_atleast_pageBits)\n apply (clarsimp simp: image_def)+\n done\n\nlemma retype_region_pml4_at:\n \"\\\\\\ retype_region y n us (ArchObject PML4Obj) dev\n \\\\rv s. \\x\\set rv. typ_at (AArch APageMapL4) x s\\\"\n apply (rule hoare_strengthen_post, rule hoare_weaken_pre)\n apply (rule hoare_vcg_conj_lift[OF retype_region_obj_at retype_region_ret])\n by (auto simp: retype_addrs_def default_object_def default_arch_object_def obj_bits_api_def\n obj_at_def a_type_def)\n\ndefinition \"make_pml4e \\ makeObject :: pml4e\"\n\nlemma createObjects_pml4_at:\n assumes \"range_cover y sz (objBitsKO (KOArch (KOPML4E makeObject)) + m) n\"\n \"0 < n\" \"m = ptTranslationBits\"\n shows \"\\pspace_no_overlap' y sz and valid_pspace'\\\n createObjects y n (KOArch (KOPML4E makeObject)) m\n \\\\rv s. \\y\\set rv. page_map_l4_at' y s\\\"\n using assms apply -\n apply (rule hoare_strengthen_post, rule hoare_weaken_pre)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ko_at[where sz=sz and val=make_pml4e];\n fastforce simp: projectKOs make_pml4e_def)\n apply (rule createObjects_aligned)\n apply (simp add: range_cover_def)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def word_bits_def)\n apply arith+\n apply (simp add: objBits_simps archObjSize_def range_cover_def word_bits_def)\n apply simp\n apply (clarsimp; rename_tac p)\n apply (drule (1) bspec)+\n apply (clarsimp simp: page_map_l4_at'_def objBits_simps archObjSize_def bit_simps)\n apply (rename_tac i; drule_tac x=i in spec; drule (1) mp)\n apply (clarsimp simp: typ_at'_def obj_at'_real_def)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp: projectKOs)\n done\n\nlemma corres_retype_region_createNewCaps:\n \"corres ((\\r r'. length r = length r' \\ list_all2 cap_relation r r')\n \\ map (\\ref. default_cap (APIType_map2 (Inr ty)) ref us dev))\n (\\s. valid_pspace s \\ valid_mdb s \\ valid_etcbs s \\ valid_list s \\ valid_arch_state s\n \\ caps_no_overlap y sz s \\ pspace_no_overlap_range_cover y sz s\n \\ caps_overlap_reserved {y..y + of_nat n * 2 ^ (obj_bits_api (APIType_map2 (Inr ty)) us) - 1} s\n \\ (\\slot. cte_wp_at (\\c. up_aligned_area y sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n \\ (APIType_map2 (Inr ty) = Structures_A.CapTableObject \\ 0 < us))\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' y sz s\n \\ valid_pspace' s \\ valid_arch_state' s\n \\ range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \\ n\\ 0)\n (do x \\ retype_region y n us (APIType_map2 (Inr ty)) dev :: obj_ref list det_ext_monad;\n init_arch_objects (APIType_map2 (Inr ty)) y n us x;\n return x od)\n (createNewCaps ty y n us dev)\"\n apply (rule_tac F=\"range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n\n \\ n \\ 0 \\ (APIType_map2 (Inr ty) = Structures_A.CapTableObject \\ 0 < us)\"\n in corres_req, simp)\n apply (clarsimp simp add: createNewCaps_def toAPIType_def split del: if_split cong: if_cong)\n apply (subst init_arch_objects_APIType_map2)\n apply (cases ty, simp_all add: Arch_createNewCaps_def split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n \\ \\Untyped\\\n apply (simp add: retype_region_def obj_bits_api_def APIType_map2_def\n split del: if_split cong: if_cong)\n apply (subst upto_enum_red')\n apply (drule range_cover_not_zero[rotated])\n apply simp\n apply unat_arith\n apply (clarsimp simp: list_all2_same enum_word_def range_cover.unat_of_nat_n\n list_all2_map1 list_all2_map2 ptr_add_def fromIntegral_def\n toInteger_nat fromInteger_nat)\n apply (subst unat_of_nat_minus_1)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def)\n apply (arith+)[4]\n \\ \\TCB, EP, NTFN\\\n apply (simp_all add: retype_region2_ext_retype_region\n bind_cong[OF curDomain_mapM_x_futz refl, unfolded bind_assoc]\n split del: if_split)[10] (* not PML4Object *)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (rule corres_retype[where 'a = tcb],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply (rule corres_split_nor)\n apply (simp add: APIType_map2_def)\n apply (rule retype_region2_extra_ext_mapM_x_corres)\n apply (rule corres_trivial, simp)\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n apply wp\n apply wp\n apply ((wp retype_region2_obj_at | simp add: APIType_map2_def)+)[1]\n apply ((wp createObjects_tcb_at'[where sz=sz]\n | simp add: APIType_map2_def objBits_simps' obj_bits_api_def)+)[1]\n apply simp\n apply simp\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = endpoint],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def APIType_map2_def\n makeObjectKO_def other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2 objBits_simps\n APIType_map2_def)\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = notification],\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def APIType_map2_def\n makeObjectKO_def other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2 objBits_simps\n APIType_map2_def)\n \\ \\CapTable\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (subst bind_assoc_return_reverse[of \"createObjects y n (KOCTE makeObject) us\"])\n apply (subst liftM_def[of \"map (\\addr. capability.CNodeCap addr us 0 0)\", symmetric])\n apply simp\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: obj_bits_api_def objBits_simps' pageBits_def APIType_map2_def\n makeObjectKO_def slot_bits_def field_simps ext)[1]\n apply (simp add: range_cover_def)\n apply (rule captable_relation_retype,simp add: range_cover_def word_bits_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2 objBits_simps\n allRights_def APIType_map2_def\n split del: if_split)\n \\ \\SmallPageObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI;\n clarsimp simp: obj_bits_api_def3 APIType_map2_def objBits_simps ext\n default_object_def default_arch_object_def makeObjectKO_def\n data_page_relation_retype\n elim!: range_cover.aligned;\n assumption)\n apply fastforce+\n apply (simp add: APIType_map2_def arch_default_cap_def vm_read_write_def vmrights_map_def\n list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\LargePageObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI;\n clarsimp simp: obj_bits_api_def3 APIType_map2_def objBits_simps ext\n default_object_def default_arch_object_def makeObjectKO_def\n data_page_relation_retype\n elim!: range_cover.aligned;\n assumption)\n apply fastforce+\n apply (simp add: APIType_map2_def arch_default_cap_def vm_read_write_def vmrights_map_def\n list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\HugePageObject\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI;\n clarsimp simp: obj_bits_api_def3 APIType_map2_def objBits_simps ext\n default_object_def default_arch_object_def makeObjectKO_def\n data_page_relation_retype bit_simps\n elim!: range_cover.aligned;\n assumption)\n apply fastforce+\n apply (simp add: APIType_map2_def arch_default_cap_def vm_read_write_def vmrights_map_def\n list_all2_map1 list_all2_map2 list_all2_same)\n \\ \\PageTable\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp_all add: corres_liftM2_simp[unfolded liftM_def])\n apply (rule corres_guard_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop)\n apply (rule corres_rel_imp)\n apply (rule corres_retype[where 'a=pte];\n simp add: APIType_map2_def obj_bits_api_def default_arch_object_def objBits_simps\n archObjSize_def bit_simps makeObjectKO_def range_cover.aligned)\n apply (rule pagetable_relation_retype)\n apply (wp | simp)+\n apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same\n APIType_map2_def arch_default_cap_def)\n apply fastforce+\n \\ \\PageDirectory\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp_all add: corres_liftM2_simp[unfolded liftM_def])\n apply (rule corres_guard_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop)\n apply (rule corres_rel_imp)\n apply (rule corres_retype[where 'a=pde];\n simp add: APIType_map2_def obj_bits_api_def default_arch_object_def objBits_simps\n archObjSize_def bit_simps makeObjectKO_def range_cover.aligned)\n apply (rule pagedirectory_relation_retype)\n apply (wp | simp)+\n apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same\n APIType_map2_def arch_default_cap_def)\n apply fastforce+\n \\ \\PDPT\\\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp_all add: corres_liftM2_simp[unfolded liftM_def])\n apply (rule corres_guard_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop)\n apply (rule corres_rel_imp)\n apply (rule corres_retype[where 'a=pdpte];\n simp add: APIType_map2_def obj_bits_api_def default_arch_object_def objBits_simps\n archObjSize_def bit_simps makeObjectKO_def range_cover.aligned)\n apply (rule pdpt_relation_retype)\n apply (wp | simp)+\n apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same\n APIType_map2_def arch_default_cap_def)\n apply fastforce+\n \\ \\PML4\\\n apply (corressimp corres: corres_retype[where ty=\"Inr PML4Object\" and 'a=pml4e and sz=sz,\n simplified, folded retype_region2_retype_region_PML4Obj]\n corresK: corresK_mapM_x_list_all2[where I=\"\\xs s. valid_arch_state s \\ pspace_aligned s\n \\ valid_etcbs s \\\n (\\x \\ set xs. page_map_l4_at x s)\"\n and I'=\"\\xs s. valid_arch_state' s \\\n (\\x \\ set xs. page_map_l4_at' x s)\"\n and S=\"(=)\"]\n wp: copy_global_mappings_typ_at hoare_vcg_ball_lift retype_region_pml4_at\n retype_region_valid_arch[where sz=sz] retype_region_aligned[where sz=sz]\n createObjects_valid_arch[where sz=sz] createObjects_pml4_at[where sz=sz]\n simp: init_arch_objects_def APIType_map2_def arch_default_cap_def\n list_all2_map1 list_all2_map2 list_all2_refl list.rel_eq\n objBits_simps archObjSize_def obj_bits_api_def bit_simps\n makeObjectKO_def default_arch_object_def pml4_relation_retype\n range_cover.aligned)\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/X64/Retype_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.33111974622959367, "lm_q1q2_score": 0.1707319356451294}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__33.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__33 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__33 and some rule r*}\nlemma n_SendInv__part__0Vsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Ident ''CurCmd'')) (Const ReqS))) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__33:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__33 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__33:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__33:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__33.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.33111973962899144, "lm_q1q2_score": 0.17073193224172747}} {"text": "(* Title: JinjaThreads/MM/JMM_Typesafe.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Type-safety proof for the Java memory model} *}\n\ntheory JMM_Typesafe \nimports\n JMM_Framework\nbegin\n\ntext {*\n Create a dynamic list @{text \"heap_independent\"} of theorems for replacing \n heap-dependent constants by heap-independent ones. \n*}\nML {*\nstructure Heap_Independent_Rules = Named_Thms\n(\n val name = @{binding heap_independent}\n val description = \"Simplification rules for heap-independent constants\"\n)\n*}\nsetup {* Heap_Independent_Rules.setup *}\n\nlocale heap_base' = \n h!: heap_base \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\nbegin\n\ndefinition typeof_h :: \"'addr val \\ ty option\"\nwhere \"typeof_h = h.typeof_h undefined\"\nlemma typeof_h_conv_typeof_h [heap_independent, iff]: \"h.typeof_h h = typeof_h\"\nby(rule ext)(case_tac x, simp_all add: typeof_h_def)\nlemmas typeof_h_simps [simp] = h.typeof_h.simps [unfolded heap_independent]\n\ndefinition cname_of :: \"'addr \\ cname\"\nwhere \"cname_of = h.cname_of undefined\"\nlemma cname_of_conv_cname_of [heap_independent, iff]: \"h.cname_of h = cname_of\"\nby(simp add: cname_of_def h.cname_of_def[abs_def])\n\ndefinition addr_loc_type :: \"'m prog \\ 'addr \\ addr_loc \\ ty \\ bool\"\nwhere \"addr_loc_type P = h.addr_loc_type P undefined\"\nnotation addr_loc_type (\"_ \\ _@_ : _\" [50, 50, 50, 50] 51)\nlemma addr_loc_type_conv_addr_loc_type [heap_independent, iff]: \n \"h.addr_loc_type P h = addr_loc_type P\"\nby(simp add: addr_loc_type_def h.addr_loc_type_def)\nlemmas addr_loc_type_cases [cases pred: addr_loc_type] = \n h.addr_loc_type.cases[unfolded heap_independent]\nlemmas addr_loc_type_intros = h.addr_loc_type.intros[unfolded heap_independent]\n\ndefinition typeof_addr_loc :: \"'m prog \\ 'addr \\ addr_loc \\ ty\"\nwhere \"typeof_addr_loc P = h.typeof_addr_loc P undefined\"\nlemma typeof_addr_loc_conv_typeof_addr_loc [heap_independent, iff]:\n \"h.typeof_addr_loc P h = typeof_addr_loc P\"\nby(simp add: typeof_addr_loc_def h.typeof_addr_loc_def[abs_def])\n\ndefinition conf :: \"'a prog \\ 'addr val \\ ty \\ bool\"\nwhere \"conf P \\ h.conf P undefined\"\nnotation conf (\"_ \\ _ :\\ _\" [51,51,51] 50)\nlemma conf_conv_conf [heap_independent, iff]: \"h.conf P h = conf P\"\nby(simp add: conf_def heap_base.conf_def[abs_def])\nlemmas defval_conf [simp] = h.defval_conf[unfolded heap_independent]\n\ndefinition lconf :: \"'m prog \\ (vname \\ 'addr val) \\ (vname \\ ty) \\ bool\" \nwhere \"lconf P = h.lconf P undefined\"\nnotation lconf (\"_ \\ _ '(:\\') _\" [51,51,51] 50)\nlemma lconf_conv_lconf [heap_independent, iff]: \"h.lconf P h = lconf P\"\nby(simp add: lconf_def h.lconf_def[abs_def])\n\ndefinition confs :: \"'m prog \\ 'addr val list \\ ty list \\ bool\"\nwhere \"confs P = h.confs P undefined\"\nnotation confs (\"_ \\ _ [:\\] _\" [51,51,51] 50)\nlemma confs_conv_confs [heap_independent, iff]: \"h.confs P h = confs P\"\nby(simp add: confs_def)\n\ndefinition tconf :: \"'m prog \\ 'thread_id \\ bool\" \nwhere \"tconf P = h.tconf P undefined\"\nnotation tconf (\"_ \\ _ \\t\" [51,51] 50)\n\n\ndefinition vs_conf :: \"'m prog \\ ('addr \\ addr_loc \\ 'addr val set) \\ bool\"\nwhere \"vs_conf P = h.vs_conf P undefined\"\nlemma vs_conf_conv_vs_conf [heap_independent, iff]: \"h.vs_conf P h = vs_conf P\"\nby(simp add: vs_conf_def h.vs_conf_def[abs_def])\n\nlemmas vs_confI = h.vs_confI[unfolded heap_independent]\nlemmas vs_confD = h.vs_confD[unfolded heap_independent]\n\ntext {*\n use non-speculativity to express that only type-correct values are read\n*}\n\nprimrec vs_type_all :: \"'m prog \\ 'addr \\ addr_loc \\ 'addr val set\"\nwhere \"vs_type_all P (ad, al) = {v. \\T. P \\ ad@al : T \\ P \\ v :\\ T}\"\n\nlemma vs_conf_vs_type_all [simp]: \"vs_conf P (vs_type_all P)\"\nby(rule h.vs_confI[unfolded heap_independent])(simp)\n\nlemma w_addrs_vs_type_all: \"w_addrs (vs_type_all P) \\ dom typeof_addr\"\nby(auto simp add: w_addrs_def h.conf_def[unfolded heap_independent])\n\nlemma w_addrs_vs_type_all_in_vs_type_all:\n \"(\\ad \\ w_addrs (vs_type_all P). {(ad, al)|al. \\T. P \\ ad@al : T}) \\ {adal. vs_type_all P adal \\ {}}\"\nby(auto simp add: w_addrs_def vs_type_all_def intro: defval_conf)\n\ndeclare vs_type_all.simps [simp del]\n\nlemmas vs_conf_insert_iff = h.vs_conf_insert_iff[unfolded heap_independent]\n\nend\n\n\nlocale heap' =\n h!: heap\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n P\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and P :: \"'m prog\"\n\nsublocale heap' < heap_base' .\n\ncontext heap' begin\n\nlemma vs_conf_w_value_WriteMemD: \n \"\\ vs_conf P (w_value P vs ob); ob = NormalAction (WriteMem ad al v) \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nby(auto elim: vs_confD)\n\nlemma vs_conf_w_values_WriteMemD:\n \"\\ vs_conf P (w_values P vs obs); NormalAction (WriteMem ad al v) \\ set obs \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\"\napply(induct obs arbitrary: vs)\napply(auto 4 3 elim: vs_confD intro: w_values_mono[THEN subsetD])\ndone\n\nlemma w_values_vs_type_all_start_heap_obs:\n assumes wf: \"wf_syscls P\"\n shows \"w_values P (vs_type_all P) (map snd (lift_start_obs h.start_tid h.start_heap_obs)) = vs_type_all P\"\n (is \"?lhs = ?rhs\")\nproof(rule antisym, rule le_funI, rule subsetI)\n fix adal v\n assume v: \"v \\ ?lhs adal\"\n obtain ad al where adal: \"adal = (ad, al)\" by(cases adal)\n show \"v \\ ?rhs adal\"\n proof(rule ccontr)\n assume v': \"\\ ?thesis\"\n from in_w_valuesD[OF v[unfolded adal] this[unfolded adal]]\n obtain obs' wa obs''\n where eq: \"map snd (lift_start_obs h.start_tid h.start_heap_obs) = obs' @ wa # obs''\"\n and \"write\": \"is_write_action wa\"\n and loc: \"(ad, al) \\ action_loc_aux P wa\"\n and vwa: \"value_written_aux P wa al = v\"\n by blast+\n from \"write\" show False\n proof cases\n case (WriteMem ad' al' v')\n with vwa loc eq have \"WriteMem ad al v \\ set h.start_heap_obs\"\n by(auto simp add: map_eq_append_conv Cons_eq_append_conv lift_start_obs_def)\n from h.start_heap_write_typeable[OF this] v' adal\n show ?thesis by(auto simp add: vs_type_all_def)\n next\n case (NewHeapElem ad' hT)\n with vwa loc eq have \"NewHeapElem ad hT \\ set h.start_heap_obs\"\n by(auto simp add: map_eq_append_conv Cons_eq_append_conv lift_start_obs_def)\n hence \"typeof_addr ad = \\hT\\\"\n by(rule h.NewHeapElem_start_heap_obsD[OF wf])\n with v' adal loc vwa NewHeapElem show ?thesis\n by(auto simp add: vs_type_all_def intro: addr_loc_type_intros h.addr_loc_default_conf[unfolded heap_independent])\n qed\n qed\nqed(rule w_values_greater)\n\nend\n\n\nlemma lprefix_lappend2I: \"lprefix xs ys \\ lprefix xs (lappend ys zs)\"\nby(auto simp add: lappend_assoc lprefix_conv_lappend)\n\nlocale known_addrs_typing' =\n h!: known_addrs_typing\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write \n allocated known_addrs \n final r wfx\n P\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\" \n and allocated :: \"'heap \\ 'addr set\"\n and known_addrs :: \"'thread_id \\ 'x \\ 'addr set\"\n and final :: \"'x \\ bool\"\n and r :: \"('addr, 'thread_id, 'x, 'heap, 'addr, ('addr, 'thread_id) obs_event) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and wfx :: \"'thread_id \\ 'x \\ 'heap \\ bool\"\n and P :: \"'md prog\"\n +\n assumes NewHeapElem_typed: -- {* Should this be moved to known\\_addrs\\_typing? *}\n \"\\ t \\ (x, h) -ta\\ (x', h'); NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\"\n\nsublocale known_addrs_typing' < heap' by unfold_locales\n\ncontext known_addrs_typing' begin\n\nlemma known_addrs_typeable_in_vs_type_all:\n \"h.if.known_addrs_state s \\ dom typeof_addr \n \\ (\\a \\ h.if.known_addrs_state s. {(a, al)|al. \\T. P \\ a@al : T}) \\ {adal. vs_type_all P adal \\ {}}\"\nby(auto 4 4 dest: subsetD simp add: vs_type_all.simps intro: defval_conf)\n\nlemma if_NewHeapElem_typed: \n \"\\ t \\ xh -ta\\i x'h'; NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\"\nby(cases rule: h.mthr.init_fin.cases)(auto dest: NewHeapElem_typed)\n\nlemma if_redT_NewHeapElem_typed:\n \"\\ h.mthr.if.redT s (t, ta) s'; NormalAction (NewHeapElem ad CTn) \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\"\nby(cases rule: h.mthr.if.redT.cases)(auto dest: if_NewHeapElem_typed)\n\nlemma non_speculative_written_value_typeable:\n assumes wfx_start: \"ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap\" \n and wfP: \"wf_syscls P\"\n and E: \"E \\ h.\\_start f P C M vs status\"\n and \"write\": \"w \\ write_actions E\"\n and adal: \"(ad, al) \\ action_loc P E w\"\n and ns: \"non_speculative P (vs_type_all P) (lmap snd (ltake (enat w) E))\"\n shows \"\\T. P \\ ad@al : T \\ P \\ value_written P E w (ad, al) :\\ T\"\nproof -\n let ?start_state = \"init_fin_lift_state status (h.start_state f P C M vs)\"\n and ?start_obs = \"lift_start_obs h.start_tid h.start_heap_obs\"\n and ?v = \"value_written P E w (ad, al)\"\n\n from \"write\" have iwa: \"is_write_action (action_obs E w)\" by cases\n\n from E obtain E' where E': \"E = lappend (llist_of ?start_obs) E'\"\n and \\: \"E' \\ h.mthr.if.\\ ?start_state\" by blast\n from \\ obtain E'' where E'': \"E' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E'')\"\n and Runs: \"h.mthr.if.mthr.Runs ?start_state E''\"\n by-(rule h.mthr.if.\\.cases[OF \\])\n \n have wfx': \"ts_ok (init_fin_lift wfx) (thr ?start_state) (shr ?start_state)\"\n using wfx_start by(simp add: h.shr_start_state)\n\n from ns E'\n have ns: \"non_speculative P (vs_type_all P) (lmap snd (ldropn (length (lift_start_obs h.start_tid h.start_heap_obs)) (ltake (enat w) E)))\"\n by(subst (asm) lappend_ltake_ldrop[where n=\"enat (length (lift_start_obs h.start_tid h.start_heap_obs))\", symmetric])(simp add: non_speculative_lappend min_def ltake_lappend1 w_values_vs_type_all_start_heap_obs[OF wfP] ldrop_enat split: split_if_asm)\n\n show ?thesis\n proof(cases \"w < length ?start_obs\")\n case True\n hence in_start: \"action_obs E w \\ set (map snd ?start_obs)\"\n unfolding in_set_conv_nth E' by(simp add: lnth_lappend action_obs_def map_nth exI[where x=\"w\"])\n \n from iwa show ?thesis\n proof(cases)\n case (WriteMem ad' al' v')\n with adal have \"ad' = ad\" \"al' = al\" \"?v = v'\" by(simp_all add: value_written.simps)\n with WriteMem in_start have \"WriteMem ad al ?v \\ set h.start_heap_obs\" by auto\n thus ?thesis by(rule h.start_heap_write_typeable[unfolded heap_independent])\n next\n case (NewHeapElem ad' CTn)\n with adal have [simp]: \"ad' = ad\" by auto\n with NewHeapElem in_start have \"NewHeapElem ad CTn \\ set h.start_heap_obs\" by auto\n with wfP have \"typeof_addr ad = \\CTn\\\" by(rule h.NewHeapElem_start_heap_obsD)\n with adal NewHeapElem show ?thesis\n by(cases al)(auto simp add: value_written.simps intro: addr_loc_type_intros h.addr_loc_default_conf[unfolded heap_independent])\n qed\n next\n case False\n def w' == \"w - length ?start_obs\"\n from \"write\" False w'_def have w'_len: \"enat w' < llength E'\"\n by(cases \"llength E'\")(auto simp add: actions_def E' elim: write_actions.cases)\n with Runs obtain m_w n_w t_w ta_w \n where E'_w: \"lnth E' w' = (t_w, \\ta_w\\\\<^bsub>o\\<^esub> ! n_w)\"\n and n_w: \"n_w < length \\ta_w\\\\<^bsub>o\\<^esub>\"\n and m_w: \"enat m_w < llength E''\"\n and w_sum: \"w' = (\\isnd (lnth E'' i)\\\\<^bsub>o\\<^esub>) + n_w\"\n and E''_m_w: \"lnth E'' m_w = (t_w, ta_w)\"\n unfolding E'' by(rule h.mthr.if.actions_\\E_aux)\n\n from E'_w have obs_w: \"action_obs E w = \\ta_w\\\\<^bsub>o\\<^esub> ! n_w\"\n using False E' w'_def by(simp add: action_obs_def lnth_lappend)\n \n let ?E'' = \"ldropn (Suc m_w) E''\"\n let ?m_E'' = \"ltake (enat m_w) E''\"\n have E'_unfold: \"E'' = lappend ?m_E'' (LCons (lnth E'' m_w) ?E'')\"\n unfolding ldropn_Suc_conv_ldropn[OF m_w] by simp\n hence \"h.mthr.if.mthr.Runs ?start_state (lappend ?m_E'' (LCons (lnth E'' m_w) ?E''))\"\n using Runs by simp\n then obtain \\' where \\_\\': \"h.mthr.if.mthr.Trsys ?start_state (list_of ?m_E'') \\'\"\n and Runs': \"h.mthr.if.mthr.Runs \\' (LCons (lnth E'' m_w) ?E'')\"\n by(rule h.mthr.if.mthr.Runs_lappendE) simp\n from Runs' obtain \\''' where red_w: \"h.mthr.if.redT \\' (t_w, ta_w) \\'''\"\n and Runs'': \"h.mthr.if.mthr.Runs \\''' ?E''\"\n unfolding E''_m_w by cases\n\n let ?EE'' = \"lmap snd (lappend (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E'')) (llist_of (map (Pair t_w) (take (n_w + 1) \\ta_w\\\\<^bsub>o\\<^esub>))))\"\n have len_EE'': \"llength ?EE'' = enat (w' + 1)\" using n_w m_w\n apply(simp add: w_sum)\n apply(subst llength_lconcat_lfinite_conv_sum)\n apply(simp_all add: split_beta plus_enat_simps(1)[symmetric] add_Suc_right[symmetric] del: plus_enat_simps(1) add_Suc_right)\n apply(subst setsum_hom[symmetric, where f=enat])\n apply(simp_all add: zero_enat_def min_def le_Suc_eq)\n apply(rule setsum.cong)\n apply(auto simp add: lnth_ltake less_trans[where y=\"enat m_w\"])\n done\n have prefix: \"lprefix ?EE'' (lmap snd E')\" unfolding E''\n by(subst (2) E'_unfold)(rule lmap_lprefix, clarsimp simp add: lmap_lappend_distrib E''_m_w lprefix_lappend2I[OF lprefix_llist_ofI[OF exI[where x=\"map (Pair t_w) (drop (n_w + 1) \\ta_w\\\\<^bsub>o\\<^esub>)\"]]] map_append[symmetric])\n\n from iwa False have iwa': \"is_write_action (action_obs E' w')\" by(simp add: E' action_obs_def lnth_lappend w'_def)\n from ns False\n have \"non_speculative P (vs_type_all P) (lmap snd (ltake (enat w') E'))\"\n by(simp add: E' ltake_lappend lmap_lappend_distrib non_speculative_lappend ldropn_lappend2 w'_def)\n with iwa'\n have \"non_speculative P (vs_type_all P) (lappend (lmap snd (ltake (enat w') E')) (LCons (action_obs E' w') LNil))\"\n by cases(simp_all add: non_speculative_lappend)\n also have \"lappend (lmap snd (ltake (enat w') E')) (LCons (action_obs E' w') LNil) = lmap snd (ltake (enat (w' + 1)) E')\"\n using w'_len by(simp add: ltake_Suc_conv_snoc_lnth lmap_lappend_distrib action_obs_def)\n also {\n have \"lprefix (lmap snd (ltake (enat (w' + 1)) E')) (lmap snd E')\" by(rule lmap_lprefix) simp\n with prefix have \"lprefix ?EE'' (lmap snd (ltake (enat (w' + 1)) E')) \\ \n lprefix (lmap snd (ltake (enat (w' + 1)) E')) ?EE''\"\n by(rule lprefix_down_linear)\n moreover have \"llength (lmap snd (ltake (enat (w' + 1)) E')) = enat (w' + 1)\"\n using w'_len by(cases \"llength E'\") simp_all\n ultimately have \"lmap snd (ltake (enat (w' + 1)) E') = ?EE''\"\n using len_EE'' by(auto dest: lprefix_llength_eq_imp_eq) }\n finally\n have ns1: \"non_speculative P (vs_type_all P) (llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?m_E''))))\"\n and ns2: \"non_speculative P (w_values P (vs_type_all P) (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E''))))) (llist_of (take (Suc n_w) \\ta_w\\\\<^bsub>o\\<^esub>))\"\n by(simp_all add: lmap_lappend_distrib non_speculative_lappend split_beta lconcat_llist_of[symmetric] lmap_lconcat llist.map_comp o_def split_def list_of_lmap[symmetric] del: list_of_lmap)\n\n have \"vs_conf P (vs_type_all P)\" by simp\n with \\_\\' wfx' ns1\n have wfx': \"ts_ok (init_fin_lift wfx) (thr \\') (shr \\')\"\n and vs_conf: \"vs_conf P (w_values P (vs_type_all P) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?m_E''))))\"\n by(rule h.if_RedT_non_speculative_invar[unfolded h.mthr.if.RedT_def heap_independent])+\n \n have \"concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?m_E'')) = map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E'')))\"\n by(simp add: split_def lmap_lconcat llist.map_comp o_def list_of_lconcat map_concat)\n with vs_conf have \"vs_conf P (w_values P (vs_type_all P) \\)\" by simp\n with red_w wfx' ns2\n have vs_conf': \"vs_conf P (w_values P (w_values P (vs_type_all P) (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E''))))) (take (Suc n_w) \\ta_w\\\\<^bsub>o\\<^esub>))\"\n (is \"vs_conf _ ?vs'\")\n by(rule h.if_redT_non_speculative_vs_conf[unfolded heap_independent])\n\n from len_EE'' have \"enat w' < llength ?EE''\" by simp\n from w'_len have \"lnth ?EE'' w' = action_obs E' w'\"\n using lprefix_lnthD[OF prefix `enat w' < llength ?EE''`] by(simp add: action_obs_def)\n hence \"\\ \\ lset ?EE''\" using `enat w' < llength ?EE''` unfolding lset_conv_lnth by(auto intro!: exI)\n also have \"\\ \\ set (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E''))) @ take (Suc n_w) \\ta_w\\\\<^bsub>o\\<^esub>)\"\n by(auto 4 4 intro: rev_image_eqI rev_bexI simp add: split_beta lset_lconcat_lfinite dest: lset_lappend[THEN subsetD])\n also have \"action_obs E' w' = action_obs E w\"\n using False by(simp add: E' w'_def lnth_lappend action_obs_def)\n also note obs_w_in_set = calculation and calculation = nothing\n\n from iwa have \"?v \\ w_values P (vs_type_all P) (map snd (list_of (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) ?m_E''))) @ take (Suc n_w) \\ta_w\\\\<^bsub>o\\<^esub>) (ad, al)\"\n proof(cases)\n case (WriteMem ad' al' v')\n with adal have \"ad' = ad\" \"al' = al\" \"?v = v'\" by(simp_all add: value_written.simps)\n with obs_w_in_set WriteMem show ?thesis\n by -(rule w_values_WriteMemD, simp)\n next\n case (NewHeapElem ad' CTn)\n with adal have [simp]: \"ad' = ad\" and v: \"?v = addr_loc_default P CTn al\" \n by(auto simp add: value_written.simps)\n with obs_w_in_set NewHeapElem adal show ?thesis\n by(unfold v)(rule w_values_new_actionD, simp_all)\n qed\n hence \"?v \\ ?vs' (ad, al)\" by simp\n with vs_conf' show \"\\T. P \\ ad@al : T \\ P \\ ?v :\\ T\"\n by(rule h.vs_confD[unfolded heap_independent])\n qed\nqed\n\nlemma hb_read_value_typeable:\n assumes wfx_start: \"ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap\" \n (is \"ts_ok wfx (thr ?start_state) _\")\n and wfP: \"wf_syscls P\"\n and E: \"E \\ h.\\_start f P C M vs status\"\n and wf: \"P \\ (E, ws) \\\"\n and races: \"\\a ad al v. \\ enat a < llength E; action_obs E a = NormalAction (ReadMem ad al v); \\ P,E \\ ws a \\hb a \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\"\n and r: \"enat a < llength E\"\n and read: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n shows \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nusing r read\nproof(induction a arbitrary: ad al v rule: less_induct)\n case (less a)\n note r = `enat a < llength E`\n and read = `action_obs E a = NormalAction (ReadMem ad al v)`\n show ?case\n proof(cases \"P,E \\ ws a \\hb a\")\n case False with r read show ?thesis by(rule races)\n next\n case True\n note hb = this\n hence ao: \"E \\ ws a \\a a\" by(rule happens_before_into_action_order)\n\n from wf have ws: \"is_write_seen P E ws\" by(rule wf_exec_is_write_seenD)\n from r have \"a \\ actions E\" by(simp add: actions_def)\n hence \"a \\ read_actions E\" using read ..\n from is_write_seenD[OF ws this read]\n have \"write\": \"ws a \\ write_actions E\" \n and adal_w: \"(ad, al) \\ action_loc P E (ws a)\"\n and written: \"value_written P E (ws a) (ad, al) = v\" by simp_all\n from \"write\" have iwa: \"is_write_action (action_obs E (ws a))\" by cases\n\n let ?start_state = \"init_fin_lift_state status (h.start_state f P C M vs)\"\n and ?start_obs = \"lift_start_obs h.start_tid h.start_heap_obs\"\n\n show ?thesis\n proof(cases \"ws a < a\")\n case True\n let ?EE'' = \"lmap snd (ltake (enat (ws a)) E)\"\n\n have \"non_speculative P (vs_type_all P) ?EE''\"\n proof(rule non_speculative_nthI)\n fix i ad' al' v'\n assume i: \"enat i < llength ?EE''\"\n and nth_i: \"lnth ?EE'' i = NormalAction (ReadMem ad' al' v')\"\n \n from i have \"i < ws a\" by simp\n hence i': \"i < a\" using True by(simp)\n moreover\n with r have \"enat i < llength E\" by(metis enat_ord_code(2) order_less_trans) \n moreover\n with nth_i i `i < ws a`\n have \"action_obs E i = NormalAction (ReadMem ad' al' v')\"\n by(simp add: action_obs_def lnth_ltake ac_simps)\n ultimately have \"\\T. P \\ ad'@al' : T \\ P \\ v' :\\ T\" by(rule less.IH)\n hence \"v' \\ vs_type_all P (ad', al')\" by(simp add: vs_type_all.simps)\n thus \"v' \\ w_values P (vs_type_all P) (list_of (ltake (enat i) ?EE'')) (ad', al')\"\n by(rule w_values_mono[THEN subsetD])\n qed\n with wfx_start wfP E \"write\" adal_w\n show ?thesis unfolding written[symmetric] by(rule non_speculative_written_value_typeable)\n next\n case False\n \n from E obtain E' where E': \"E = lappend (llist_of ?start_obs) E'\"\n and \\: \"E' \\ h.mthr.if.\\ ?start_state\" by blast\n from \\ obtain E'' where E'': \"E' = lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E'')\"\n and Runs: \"h.mthr.if.mthr.Runs ?start_state E''\"\n by-(rule h.mthr.if.\\.cases[OF \\])\n\n have wfx': \"ts_ok (init_fin_lift wfx) (thr ?start_state) (shr ?start_state)\"\n using wfx_start by(simp add: h.shr_start_state)\n\n have a_start: \"\\ a < length ?start_obs\"\n proof\n assume \"a < length ?start_obs\"\n with read have \"NormalAction (ReadMem ad al v) \\ snd ` set ?start_obs\"\n unfolding set_map[symmetric] in_set_conv_nth\n by(auto simp add: E' lnth_lappend action_obs_def)\n hence \"ReadMem ad al v \\ set h.start_heap_obs\" by auto\n thus False by(simp add: h.start_heap_obs_not_Read)\n qed\n hence ws_a_not_le: \"\\ ws a < length ?start_obs\" using False by simp\n\n def w == \"ws a - length ?start_obs\"\n from \"write\" ws_a_not_le w_def\n have \"enat w < llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E''))\"\n by(cases \"llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E''))\")(auto simp add: actions_def E' E'' elim: write_actions.cases)\n with Runs obtain m_w n_w t_w ta_w \n where E'_w: \"lnth E' w = (t_w, \\ta_w\\\\<^bsub>o\\<^esub> ! n_w)\"\n and n_w: \"n_w < length \\ta_w\\\\<^bsub>o\\<^esub>\"\n and m_w: \"enat m_w < llength E''\"\n and w_sum: \"w = (\\isnd (lnth E'' i)\\\\<^bsub>o\\<^esub>) + n_w\"\n and E''_m_w: \"lnth E'' m_w = (t_w, ta_w)\"\n unfolding E'' by(rule h.mthr.if.actions_\\E_aux)\n\n from E'_w have obs_w: \"action_obs E (ws a) = \\ta_w\\\\<^bsub>o\\<^esub> ! n_w\"\n using ws_a_not_le E' w_def by(simp add: action_obs_def lnth_lappend)\n\n let ?E'' = \"ldropn (Suc m_w) E''\"\n let ?m_E'' = \"ltake (enat m_w) E''\"\n have E'_unfold: \"E'' = lappend ?m_E'' (LCons (lnth E'' m_w) ?E'')\"\n unfolding ldropn_Suc_conv_ldropn[OF m_w] by simp\n hence \"h.mthr.if.mthr.Runs ?start_state (lappend ?m_E'' (LCons (lnth E'' m_w) ?E''))\"\n using Runs by simp\n then obtain \\' where \\_\\': \"h.mthr.if.mthr.Trsys ?start_state (list_of ?m_E'') \\'\"\n and Runs': \"h.mthr.if.mthr.Runs \\' (LCons (lnth E'' m_w) ?E'')\"\n by(rule h.mthr.if.mthr.Runs_lappendE) simp\n from Runs' obtain \\''' where red_w: \"h.mthr.if.redT \\' (t_w, ta_w) \\'''\"\n and Runs'': \"h.mthr.if.mthr.Runs \\''' ?E''\"\n unfolding E''_m_w by cases\n\n from \"write\" `a \\ read_actions E` have \"ws a \\ a\" by(auto dest: read_actions_not_write_actions)\n with False have \"ws a > a\" by simp\n with ao have new: \"is_new_action (action_obs E (ws a))\"\n by(simp add: action_order_def split: split_if_asm)\n then obtain CTn where obs_w': \"action_obs E (ws a) = NormalAction (NewHeapElem ad CTn)\" \n using adal_w by cases auto\n\n def a' == \"a - length ?start_obs\"\n with False w_def\n have \"enat a' < llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E''))\"\n by(simp add: le_less_trans[OF _ `enat w < llength (lconcat (lmap (\\(t, ta). llist_of (map (Pair t) \\ta\\\\<^bsub>o\\<^esub>)) E''))`])\n with Runs obtain m_a n_a t_a ta_a \n where E'_a: \"lnth E' a' = (t_a, \\ta_a\\\\<^bsub>o\\<^esub> ! n_a)\"\n and n_a: \"n_a < length \\ta_a\\\\<^bsub>o\\<^esub>\"\n and m_a: \"enat m_a < llength E''\"\n and a_sum: \"a' = (\\isnd (lnth E'' i)\\\\<^bsub>o\\<^esub>) + n_a\"\n and E''_m_a: \"lnth E'' m_a = (t_a, ta_a)\"\n unfolding E'' by(rule h.mthr.if.actions_\\E_aux)\n \n from a_start E'_a read have obs_a: \"\\ta_a\\\\<^bsub>o\\<^esub> ! n_a = NormalAction (ReadMem ad al v)\"\n using E' w_def by(simp add: action_obs_def lnth_lappend a'_def)\n \n let ?E'' = \"ldropn (Suc m_a) E''\"\n let ?m_E'' = \"ltake (enat m_a) E''\"\n have E'_unfold: \"E'' = lappend ?m_E'' (LCons (lnth E'' m_a) ?E'')\"\n unfolding ldropn_Suc_conv_ldropn[OF m_a] by simp\n hence \"h.mthr.if.mthr.Runs ?start_state (lappend ?m_E'' (LCons (lnth E'' m_a) ?E''))\"\n using Runs by simp\n then obtain \\'' where \\_\\'': \"h.mthr.if.mthr.Trsys ?start_state (list_of ?m_E'') \\''\"\n and Runs'': \"h.mthr.if.mthr.Runs \\'' (LCons (lnth E'' m_a) ?E'')\"\n by(rule h.mthr.if.mthr.Runs_lappendE) simp\n from Runs'' obtain \\''' where red_a: \"h.mthr.if.redT \\'' (t_a, ta_a) \\'''\"\n and Runs'': \"h.mthr.if.mthr.Runs \\''' ?E''\"\n unfolding E''_m_a by cases\n\n let ?EE'' = \"llist_of (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?m_E'')))\"\n from m_a have \"enat m_a \\ llength E''\" by simp\n hence len_EE'': \"llength ?EE'' = enat (a' - n_a)\"\n by(simp add: a_sum length_concat listsum_setsum_nth atLeast0LessThan length_list_of_conv_the_enat min_def split_beta lnth_ltake)\n have prefix: \"lprefix ?EE'' (lmap snd E')\" unfolding E''\n by(subst (2) E'_unfold)(simp add: lmap_lappend_distrib lmap_lconcat llist.map_comp o_def split_def lconcat_llist_of[symmetric] lmap_llist_of[symmetric] lprefix_lappend2I del: lmap_llist_of)\n \n have ns: \"non_speculative P (vs_type_all P) ?EE''\"\n proof(rule non_speculative_nthI)\n fix i ad' al' v'\n assume i: \"enat i < llength ?EE''\"\n and lnth_i: \"lnth ?EE'' i = NormalAction (ReadMem ad' al' v')\"\n and \"non_speculative P (vs_type_all P) (ltake (enat i) ?EE'')\"\n \n let ?i = \"i + length ?start_obs\"\n \n from i len_EE'' have \"i < a'\" by simp\n hence i': \"?i < a\" by(simp add: a'_def)\n moreover\n hence \"enat ?i < llength E\" using `enat a < llength E` by(simp add: less_trans[where y=\"enat a\"])\n moreover have \"enat i < llength E'\" using i\n by -(rule less_le_trans[OF _ lprefix_llength_le[OF prefix], simplified], simp) \n from lprefix_lnthD[OF prefix i] lnth_i\n have \"lnth (lmap snd E') i = NormalAction (ReadMem ad' al' v')\" by simp\n hence \"action_obs E ?i = NormalAction (ReadMem ad' al' v')\" using `enat i < llength E'`\n by(simp add: E' action_obs_def lnth_lappend E'')\n ultimately have \"\\T. P \\ ad'@al' : T \\ P \\ v' :\\ T\" by(rule less.IH)\n hence \"v' \\ vs_type_all P (ad', al')\" by(simp add: vs_type_all.simps)\n thus \"v' \\ w_values P (vs_type_all P) (list_of (ltake (enat i) ?EE'')) (ad', al')\"\n by(rule w_values_mono[THEN subsetD])\n qed\n \n have \"vs_conf P (vs_type_all P)\" by simp\n with \\_\\'' wfx' ns\n have wfx'': \"ts_ok (init_fin_lift wfx) (thr \\'') (shr \\'')\" \n and vs'': \"vs_conf P (w_values P (vs_type_all P) (concat (map (\\(t, ta). \\ta\\\\<^bsub>o\\<^esub>) (list_of ?m_E''))))\"\n by(rule h.if_RedT_non_speculative_invar[unfolded heap_independent h.mthr.if.RedT_def])+\n\n note red_w moreover\n from n_w obs_w obs_w' have \"NormalAction (NewHeapElem ad CTn) \\ set \\ta_w\\\\<^bsub>o\\<^esub>\"\n unfolding in_set_conv_nth by auto\n moreover\n have ta_a_read: \"NormalAction (ReadMem ad al v) \\ set \\ta_a\\\\<^bsub>o\\<^esub>\"\n using n_a obs_a unfolding in_set_conv_nth by blast\n from red_a have \"\\T. P \\ ad@al : T\"\n proof(cases)\n case (redT_normal x x' h')\n from wfx'' `thr \\'' t_a = \\(x, no_wait_locks)\\`\n have \"init_fin_lift wfx t_a x (shr \\'')\" by(rule ts_okD)\n with `t_a \\ (x, shr \\'') -ta_a\\i (x', h')`\n show ?thesis using ta_a_read\n by(rule h.init_fin_red_read_typeable[unfolded heap_independent])\n next\n case redT_acquire thus ?thesis using n_a obs_a ta_a_read by auto\n qed\n hence \"typeof_addr ad \\ None\" by(auto elim: addr_loc_type_cases)\n ultimately have \"typeof_addr ad = \\CTn\\\" by(rule if_redT_NewHeapElem_typed)\n with written adal_w obs_w' show ?thesis\n by(cases al)(auto simp add: value_written.simps intro: addr_loc_type_intros h.addr_loc_default_conf[unfolded heap_independent])\n qed\n qed\nqed\n\ntheorem \n assumes wfx_start: \"ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap\" \n and wfP: \"wf_syscls P\"\n and justified: \"P \\ (E, ws) weakly_justified_by J\"\n and J: \"range (justifying_exec \\ J) \\ h.\\_start f P C M vs status\"\n shows read_value_typeable_justifying:\n \"\\ 0 < n; enat a < llength (justifying_exec (J n));\n action_obs (justifying_exec (J n)) a = NormalAction (ReadMem ad al v) \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\" \n and read_value_typeable_justifed:\n \"\\ E \\ h.\\_start f P C M vs status; P \\ (E, ws) \\;\n enat a < llength E; action_obs E a = NormalAction (ReadMem ad al v) \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nproof -\n let ?E = \"\\n. justifying_exec (J n)\"\n and ?\\ = \"\\n. action_translation (J n)\"\n and ?C = \"\\n. committed (J n)\"\n and ?ws = \"\\n. justifying_ws (J n)\"\n let ?\\ = \"h.\\_start f P C M vs status\"\n and ?start_obs = \"lift_start_obs h.start_tid h.start_heap_obs\"\n { fix a n\n assume \"enat a < llength (justifying_exec (J n))\"\n and \"action_obs (justifying_exec (J n)) a = NormalAction (ReadMem ad al v)\"\n and \"n > 0\"\n thus \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\n proof(induction n arbitrary: a ad al v)\n case 0 thus ?case by simp\n next\n case (Suc n')\n def n': n \\ \"Suc n'\"\n with Suc have n: \"0 < n\" and a: \"enat a < llength (?E n)\"\n and a_obs: \"action_obs (?E n) a = NormalAction (ReadMem ad al v)\"\n by simp_all\n have wf_n: \"P \\ (?E n, ?ws n) \\\"\n using justified by(simp add: justification_well_formed_def)\n from J have E: \"?E n \\ ?\\\" \n and E': \"?E n' \\ ?\\\" by auto\n from a a_obs wfx_start wfP E wf_n show ?case\n proof(rule hb_read_value_typeable[rotated -2])\n fix a' ad' al' v'\n assume a': \"enat a' < llength (?E n)\"\n and a'_obs: \"action_obs (?E n) a' = NormalAction (ReadMem ad' al' v')\"\n and nhb: \"\\ P,?E n \\ ?ws n a' \\hb a'\"\n from a' have \"a' \\ actions (?E n)\" by(simp add: actions_def)\n hence read_a': \"a' \\ read_actions (?E n)\" using a'_obs ..\n with justified nhb have committed': \"?\\ n a' \\ ?\\ n' ` ?C n'\"\n unfolding is_weakly_justified_by.simps n' uncommitted_reads_see_hb_def by blast\n\n from justified have wfa_n: \"wf_action_translation E (J n)\"\n and wfa_n': \"wf_action_translation E (J n')\" by(simp_all add: wf_action_translations_def)\n hence inj_n: \"inj_on (?\\ n) (actions (?E n))\"\n and inj_n': \"inj_on (?\\ n') (actions (?E n'))\"\n by(blast dest: wf_action_translation_on_inj_onD)+\n from justified have C_n: \"?C n \\ actions (?E n)\"\n and C_n': \"?C n' \\ actions (?E n')\"\n and wf_n': \"P \\ (?E n', ?ws n') \\\"\n by(simp_all add: committed_subset_actions_def justification_well_formed_def)\n\n from justified have \"?\\ n' ` ?C n' \\ ?\\ n ` ?C n\"\n unfolding n' by(simp add: is_commit_sequence_def)\n with n' committed' have \"?\\ n a' \\ ?\\ n ` ?C n\" by auto\n with inj_n C_n have committed: \"a' \\ ?C n\"\n using `a' \\ actions (?E n)` by(auto dest: inj_onD)\n with justified read_a' have ws_committed: \"ws (?\\ n a') \\ ?\\ n ` ?C n\"\n by(rule weakly_justified_write_seen_hb_read_committed)\n\n from wf_n have ws_n: \"is_write_seen P (?E n) (?ws n)\" by(rule wf_exec_is_write_seenD)\n from is_write_seenD[OF this read_a' a'_obs]\n have ws_write: \"?ws n a' \\ write_actions (?E n)\"\n and adal: \"(ad', al') \\ action_loc P (?E n) (?ws n a')\"\n and written: \"value_written P (?E n) (?ws n a') (ad', al') = v'\" by simp_all\n\n def a'' \\ \"inv_into (actions (?E n')) (?\\ n') (?\\ n a')\"\n from C_n' n committed' have \"?\\ n a' \\ ?\\ n' ` actions (?E n')\" by auto\n hence a'': \"?\\ n' a'' = ?\\ n a'\"\n and a''_action: \"a'' \\ actions (?E n')\" using inj_n' committed' n\n by(simp_all add: a''_def f_inv_into_f inv_into_into)\n hence committed'': \"a'' \\ ?C n'\" using committed' n inj_n' C_n' by(fastforce dest: inj_onD)\n\n from committed committed'' wfa_n wfa_n' a'' have \"action_obs (?E n') a'' \\ action_obs (?E n) a'\"\n by(auto dest!: wf_action_translation_on_actionD intro: sim_action_trans sim_action_sym)\n with a'_obs committed'' C_n' have read_a'': \"a'' \\ read_actions (?E n')\"\n by(auto intro: read_actions.intros)\n\n then obtain ad'' al'' v'' \n where a''_obs: \"action_obs (?E n') a'' = NormalAction (ReadMem ad'' al'' v'')\" by cases\n\n from committed'' have \"n' > 0\" using justified \n by(cases n')(simp_all add: is_commit_sequence_def)\n then obtain n'' where n'': \"n' = Suc n''\" by(cases n') simp_all\n\n from justified have wfa_n'': \"wf_action_translation E (J n'')\" by(simp add: wf_action_translations_def)\n hence inj_n'': \"inj_on (?\\ n'') (actions (?E n''))\" by(blast dest: wf_action_translation_on_inj_onD)+\n from justified have C_n'': \"?C n'' \\ actions (?E n'')\" by(simp add: committed_subset_actions_def)\n\n from justified committed' committed'' n' read_a' read_a'' n\n have \"?\\ n (?ws n (inv_into (actions (?E n)) (?\\ n) (?\\ n' a''))) = ws (?\\ n' a'')\"\n by(simp add: write_seen_committed_def)\n hence \"?\\ n (?ws n a') = ws (?\\ n a')\" using inj_n `a' \\ actions (?E n)` by(simp add: a'')\n\n from ws_committed obtain w where w: \"ws (?\\ n a') = ?\\ n w\" \n and committed_w: \"w \\ ?C n\" by blast\n from committed_w C_n have \"w \\ actions (?E n)\" by blast\n hence w_def: \"w = ?ws n a'\" using `?\\ n (?ws n a') = ws (?\\ n a')` inj_n ws_write\n unfolding w by(auto dest: inj_onD)\n have committed_ws: \"?ws n a' \\ ?C n\" using committed_w by(simp add: w_def)\n\n with wfa_n have sim_ws: \"action_obs (?E n) (?ws n a') \\ action_obs E (?\\ n (?ws n a'))\"\n by(blast dest: wf_action_translation_on_actionD)\n\n from wfa_n committed_ws have sim_ws: \"action_obs (?E n) (?ws n a') \\ action_obs E (?\\ n (?ws n a'))\"\n by(blast dest: wf_action_translation_on_actionD)\n with adal have adal_E: \"(ad', al') \\ action_loc P E (?\\ n (?ws n a'))\"\n by(simp add: action_loc_aux_sim_action)\n\n have \"\\w \\ write_actions (?E n'). (ad', al') \\ action_loc P (?E n') w \\ value_written P (?E n') w (ad', al') = v'\"\n proof(cases \"?\\ n' a'' \\ ?\\ n'' ` ?C n''\")\n case True\n then obtain a''' where a''': \"?\\ n'' a''' = ?\\ n' a''\" \n and committed''': \"a''' \\ ?C n''\" by auto\n from committed''' C_n'' have a'''_action: \"a''' \\ actions (?E n'')\" by auto\n \n from committed'' committed''' wfa_n' wfa_n'' a''' have \"action_obs (?E n'') a''' \\ action_obs (?E n') a''\"\n by(auto dest!: wf_action_translation_on_actionD intro: sim_action_trans sim_action_sym)\n with read_a'' committed''' C_n'' have read_a''': \"a''' \\ read_actions (?E n'')\"\n by cases(auto intro: read_actions.intros)\n \n hence \"?\\ n' (?ws n' (inv_into (actions (?E n')) (?\\ n') (?\\ n'' a'''))) = ws (?\\ n'' a''')\"\n using justified committed'''\n unfolding is_weakly_justified_by.simps n'' Let_def write_seen_committed_def by blast\n also have \"inv_into (actions (?E n')) (?\\ n') (?\\ n'' a''') = a''\"\n using a''' inj_n' a''_action by(simp)\n also note a''' also note a''\n finally have \"ws (?\\ n a') = ?\\ n' (?ws n' a'')\" ..\n with `?\\ n (?ws n a') = ws (?\\ n a')`[symmetric]\n have eq_ws: \"?\\ n' (?ws n' a'') = ?\\ n (?ws n a')\" by simp\n\n from wf_n'[THEN wf_exec_is_write_seenD, THEN is_write_seenD, OF read_a'' a''_obs]\n have ws_write': \"?ws n' a'' \\ write_actions (?E n')\" by simp\n\n from justified read_a'' committed''\n have \"ws (?\\ n' a'') \\ ?\\ n' ` ?C n'\" by(rule weakly_justified_write_seen_hb_read_committed)\n then obtain w' where w': \"ws (?\\ n' a'') = ?\\ n' w'\"\n and committed_w': \"w' \\ ?C n'\" by blast\n from committed_w' C_n' have \"w' \\ actions (?E n')\" by blast\n hence w'_def: \"w' = ?ws n' a''\" using `?\\ n' (?ws n' a'') = ws (?\\ n a')` inj_n' ws_write'\n unfolding w' a''[symmetric] by(auto dest: inj_onD)\n with committed_w' have committed_ws'': \"?ws n' a'' \\ committed (J n')\" by simp\n with committed_ws wfa_n wfa_n' eq_ws\n have \"action_obs (?E n') (?ws n' a'') \\ action_obs (?E n) (?ws n a')\"\n by(auto dest!: wf_action_translation_on_actionD intro: sim_action_trans sim_action_sym)\n hence adal_eq: \"action_loc P (?E n') (?ws n' a'') = action_loc P (?E n) (?ws n a')\"\n by(simp add: action_loc_aux_sim_action)\n with adal have adal': \"(ad', al') \\ action_loc P (?E n') (?ws n' a'')\" by(simp add: action_loc_aux_sim_action)\n \n from committed_ws'' have \"?ws n' a'' \\ actions (?E n')\" using C_n' by blast\n with ws_write `action_obs (?E n') (?ws n' a'') \\ action_obs (?E n) (?ws n a')` \n have ws_write'': \"?ws n' a'' \\ write_actions (?E n')\" \n by(cases)(auto intro: write_actions.intros simp add: sim_action_is_write_action_eq)\n from wfa_n' committed_ws''\n have sim_ws': \"action_obs (?E n') (?ws n' a'') \\ action_obs E (?\\ n' (?ws n' a''))\"\n by(blast dest: wf_action_translation_on_actionD)\n with adal' have adal'_E: \"(ad', al') \\ action_loc P E (?\\ n' (?ws n' a''))\"\n by(simp add: action_loc_aux_sim_action)\n \n from justified committed_ws ws_write adal_E\n have \"value_written P (?E n) (?ws n a') (ad', al') = value_written P E (?\\ n (?ws n a')) (ad', al')\"\n unfolding is_weakly_justified_by.simps Let_def value_written_committed_def by blast\n also note eq_ws[symmetric]\n also from justified committed_ws'' ws_write'' adal'_E\n have \"value_written P E (?\\ n' (?ws n' a'')) (ad', al') = value_written P (?E n') (?ws n' a'') (ad', al')\"\n unfolding is_weakly_justified_by.simps Let_def value_written_committed_def by(blast dest: sym)\n finally show ?thesis using written ws_write'' adal' by auto\n next\n case False\n with justified read_a'' committed''\n have \"ws (?\\ n' a'') \\ ?\\ n'' ` ?C n''\"\n unfolding is_weakly_justified_by.simps Let_def n'' committed_reads_see_committed_writes_weak_def by blast\n with a'' obtain w where w: \"?\\ n'' w = ws (?\\ n a')\"\n and committed_w: \"w \\ ?C n''\" by auto\n from justified have \"?\\ n'' ` ?C n'' \\ ?\\ n' ` ?C n'\" by(simp add: is_commit_sequence_def n'')\n with committed_w w[symmetric] have \"ws (?\\ n a') \\ ?\\ n' ` ?C n'\" by(auto)\n then obtain w' where w': \"ws (?\\ n a') = ?\\ n' w'\" and committed_w': \"w' \\ ?C n'\" by blast\n from wfa_n' committed_w' have \"action_obs (?E n') w' \\ action_obs E (?\\ n' w')\"\n by(blast dest: wf_action_translation_on_actionD)\n from this[folded w', folded `?\\ n (?ws n a') = ws (?\\ n a')`] sim_ws[symmetric]\n have sim_w': \"action_obs (?E n') w' \\ action_obs (?E n) (?ws n a')\" by(rule sim_action_trans)\n with ws_write committed_w' C_n' have write_w': \"w' \\ write_actions (?E n')\"\n by(cases)(auto intro!: write_actions.intros simp add: sim_action_is_write_action_eq)\n hence \"value_written P (?E n') w' (ad', al') = value_written P E (?\\ n' w') (ad', al')\"\n using adal_E committed_w' justified\n unfolding `?\\ n (?ws n a') = ws (?\\ n a')` w' is_weakly_justified_by.simps Let_def value_written_committed_def by blast\n also note w'[symmetric] \n also note `?\\ n (?ws n a') = ws (?\\ n a')`[symmetric]\n also have \"value_written P E (?\\ n (?ws n a')) (ad', al') = value_written P (?E n) (?ws n a') (ad', al')\"\n using justified committed_ws ws_write adal_E \n unfolding is_weakly_justified_by.simps Let_def value_written_committed_def by(blast dest: sym)\n also have \"(ad', al') \\ action_loc P (?E n') w'\" using sim_w' adal by(simp add: action_loc_aux_sim_action)\n ultimately show ?thesis using written write_w' by auto\n qed\n then obtain w where w: \"w \\ write_actions (?E n')\"\n and adal: \"(ad', al') \\ action_loc P (?E n') w\"\n and written: \"value_written P (?E n') w (ad', al') = v'\" by blast\n from w have w_len: \"enat w < llength (?E n')\"\n by(cases)(simp add: actions_def)\n\n let ?EE'' = \"lmap snd (ltake (enat w) (?E n'))\"\n have \"non_speculative P (vs_type_all P) ?EE''\"\n proof(rule non_speculative_nthI)\n fix i ad al v\n assume i: \"enat i < llength ?EE''\"\n and i_nth: \"lnth ?EE'' i = NormalAction (ReadMem ad al v)\"\n and ns: \"non_speculative P (vs_type_all P) (ltake (enat i) ?EE'')\"\n\n from i w_len have \"i < w\" by(simp add: min_def not_le split: split_if_asm)\n with w_len have \"enat i < llength (?E n')\" by(simp add: less_trans[where y=\"enat w\"])\n moreover\n from i_nth i `i < w` w_len\n have \"action_obs (?E n') i = NormalAction (ReadMem ad al v)\"\n by(simp add: action_obs_def ac_simps less_trans[where y=\"enat w\"] lnth_ltake)\n moreover from n'' have \"0 < n'\" by simp\n ultimately have \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\" by(rule Suc.IH)\n hence \"v \\ vs_type_all P (ad, al)\" by(simp add: vs_type_all.simps)\n thus \"v \\ w_values P (vs_type_all P) (list_of (ltake (enat i) ?EE'')) (ad, al)\"\n by(rule w_values_mono[THEN subsetD])\n qed\n with wfx_start wfP E' w adal\n show \"\\T. P \\ ad'@al' : T \\ P \\ v' :\\ T\"\n unfolding written[symmetric] by(rule non_speculative_written_value_typeable)\n qed\n qed\n }\n note justifying = this\n\n assume a: \"enat a < llength E\"\n and read: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n and E: \"E \\ h.\\_start f P C M vs status\"\n and wf: \"P \\ (E, ws) \\\"\n from a have action: \"a \\ actions E\" by(auto simp add: actions_def action_obs_def)\n with justified obtain n a' where a': \"a = ?\\ n a'\"\n and committed': \"a' \\ ?C n\" by(auto simp add: is_commit_sequence_def)\n from justified have C_n: \"?C n \\ actions (?E n)\"\n and C_Sn: \"?C (Suc n) \\ actions (?E (Suc n))\"\n and wf_tr: \"wf_action_translation E (J n)\" \n and wf_tr': \"wf_action_translation E (J (Suc n))\"\n by(auto simp add: committed_subset_actions_def wf_action_translations_def)\n from C_n committed' have action': \"a' \\ actions (?E n)\" by blast\n from wf_tr committed' a'\n have \"action_tid E a = action_tid (?E n) a'\" \"action_obs E a \\ action_obs (?E n) a'\"\n by(auto simp add: wf_action_translation_on_def intro: sim_action_sym)\n with read obtain v'\n where \"action_obs (?E n) a' = NormalAction (ReadMem ad al v')\"\n by(clarsimp simp add: action_obs_def)\n with action' have read': \"a' \\ read_actions (?E n)\" ..\n\n from justified have \"?\\ n ` ?C n \\ ?\\ (Suc n) ` ?C (Suc n)\"\n by(simp add: is_commit_sequence_def)\n with committed' a' have \"a \\ \\\" by auto\n then obtain a'' where a'': \"a = ?\\ (Suc n) a''\"\n and committed'': \"a'' \\ ?C (Suc n)\" by auto\n from committed'' C_Sn have action'': \"a'' \\ actions (?E (Suc n))\" by blast\n \n with wf_tr' have \"a'' = inv_into (actions (?E (Suc n))) (?\\ (Suc n)) a\"\n by(simp add: a'' wf_action_translation_on_def)\n with justified read' committed' a' have ws_a: \"ws a = ?\\ (Suc n) (?ws (Suc n) a'')\"\n by(simp add: write_seen_committed_def)\n\n from wf_tr' committed'' a''\n have \"action_tid E a = action_tid (?E (Suc n)) a''\"\n and \"action_obs E a \\ action_obs (?E (Suc n)) a''\"\n by(auto simp add: wf_action_translation_on_def intro: sim_action_sym)\n with read obtain v''\n where a_obs'': \"action_obs (?E (Suc n)) a'' = NormalAction (ReadMem ad al v'')\"\n by(clarsimp simp add: action_obs_def)\n with action'' have read'': \"a'' \\ read_actions (?E (Suc n))\"\n by(auto intro: read_actions.intros simp add: action_obs_def)\n\n have \"a \\ read_actions E\" \"action_obs E a = NormalAction (ReadMem ad al v)\"\n using action read by(auto intro: read_actions.intros simp add: action_obs_def read)\n from is_write_seenD[OF wf_exec_is_write_seenD[OF wf] this]\n have v_eq: \"v = value_written P E (ws a) (ad, al)\" \n and adal: \"(ad, al) \\ action_loc P E (ws a)\" by simp_all\n\n from justified have \"P \\ (?E (Suc n), ?ws (Suc n)) \\\" by(simp add: justification_well_formed_def)\n from is_write_seenD[OF wf_exec_is_write_seenD[OF this] read'' a_obs'']\n have write'': \"?ws (Suc n) a'' \\ write_actions (?E (Suc n))\" \n and written'': \"value_written P (?E (Suc n)) (?ws (Suc n) a'') (ad, al) = v''\" \n by simp_all\n\n from justified read'' committed'' \n have \"ws (?\\ (Suc n) a'') \\ ?\\ (Suc n) ` ?C (Suc n)\"\n by(rule weakly_justified_write_seen_hb_read_committed)\n then obtain w where w: \"ws (?\\ (Suc n) a'') = ?\\ (Suc n) w\"\n and committed_w: \"w \\ ?C (Suc n)\" by blast\n with C_Sn have \"w \\ actions (?E (Suc n))\" by blast\n moreover have \"ws (?\\ (Suc n) a'') = ?\\ (Suc n) (?ws (Suc n) a'')\"\n using ws_a a'' by simp\n ultimately have w_def: \"w = ?ws (Suc n) a''\"\n using wf_action_translation_on_inj_onD[OF wf_tr'] write''\n unfolding w by(auto dest: inj_onD)\n with committed_w have \"?ws (Suc n) a'' \\ ?C (Suc n)\" by simp\n hence \"value_written P E (ws a) (ad, al) = value_written P (?E (Suc n)) (?ws (Suc n) a'') (ad, al)\"\n using adal justified write'' by(simp add: value_written_committed_def ws_a)\n with v_eq written'' have \"v = v''\" by simp\n\n from read'' have \"enat a'' < llength (?E (Suc n))\" by(cases)(simp add: actions_def)\n thus \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\n by(rule justifying)(simp_all add: a_obs'' `v = v''`)\nqed\n\ncorollary weakly_legal_read_value_typeable:\n assumes wfx_start: \"ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap\" \n and wfP: \"wf_syscls P\"\n and legal: \"weakly_legal_execution P (h.\\_start f P C M vs status) (E, ws)\"\n and a: \"enat a < llength E\"\n and read: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n shows \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nproof -\n from legal obtain J \n where \"P \\ (E, ws) weakly_justified_by J\"\n and \"range (justifying_exec \\ J) \\ h.\\_start f P C M vs status\"\n and \"E \\ h.\\_start f P C M vs status\"\n and \"P \\ (E, ws) \\\" by(rule legal_executionE)\n with wfx_start wfP show ?thesis using a read by(rule read_value_typeable_justifed)\nqed\n\ncorollary legal_read_value_typeable:\n \"\\ ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap; wf_syscls P;\n legal_execution P (h.\\_start f P C M vs status) (E, ws);\n enat a < llength E; action_obs E a = NormalAction (ReadMem ad al v) \\\n \\ \\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nby(erule (1) weakly_legal_read_value_typeable)(rule legal_imp_weakly_legal_execution)\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_Typesafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199008363969, "lm_q2_score": 0.3311197264277872, "lm_q1q2_score": 0.1707319205056705}} {"text": "(* Title: JinjaThreads/MM/JMM_J_Typesafe.thy\n Author: Andreas Lochbihler\n*)\n\nheader {* \\isaheader{JMM type safety for source code} *}\n\ntheory JMM_J_Typesafe imports\n JMM_Typesafe2\n DRF_J\nbegin\n\nlocale J_allocated_heap_conf' = \n h!: J_heap_conf \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write hconf\n P\n +\n h!: J_allocated_heap \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n allocated\n P\n +\n heap''\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n P\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and hconf :: \"'heap \\ bool\"\n and allocated :: \"'heap \\ 'addr set\"\n and P :: \"'addr J_prog\"\n\nsublocale J_allocated_heap_conf' < h!: J_allocated_heap_conf\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write hconf allocated\n P\nby(unfold_locales)\n\ncontext J_allocated_heap_conf' begin\n\nlemma red_New_type_match:\n \"\\ h.red' P t e s ta e' s'; NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\" \n and reds_New_type_match:\n \"\\ h.reds' P t es s ta es' s'; NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\"\nby(induct rule: h.red_reds.inducts)(auto dest: allocate_typeof_addr_SomeD red_external_New_type_match)\n\nlemma mred_known_addrs_typing':\n assumes wf: \"wf_J_prog P\"\n and ok: \"h.start_heap_ok\"\n shows \"known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (h.mred P) (\\t x h. \\ET. h.sconf_type_ok ET t x h) P\"\nproof -\n interpret known_addrs_typing\n addr2thread_id thread_id2addr \n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n allocated h.J_known_addrs\n final_expr \"h.mred P\" \"\\t x h. \\ET. h.sconf_type_ok ET t x h\"\n P\n using assms by(rule h.mred_known_addrs_typing)\n\n show ?thesis by unfold_locales(auto dest: red_New_type_match)\nqed\n\nlemma J_legal_read_value_typeable:\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"h.wf_start_state P C M vs\"\n and legal: \"weakly_legal_execution P (h.J_\\ P C M vs status) (E, ws)\"\n and a: \"enat a < llength E\"\n and read: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n shows \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nproof -\n note wf\n moreover from wf_start have \"h.start_heap_ok\" by cases\n moreover from wf wf_start\n have \"ts_ok (\\t x h. \\ET. h.sconf_type_ok ET t x h) (thr (h.J_start_state P C M vs)) h.start_heap\"\n by(rule h.J_start_state_sconf_type_ok)\n moreover from wf have \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n ultimately show ?thesis using legal a read\n by(rule known_addrs_typing'.weakly_legal_read_value_typeable[OF mred_known_addrs_typing'])\nqed\n\nend\n\nsubsection {* Specific part for JMM implementation 2 *}\n\nabbreviation jmm_J_\\\n :: \"addr J_prog \\ cname \\ mname \\ addr val list \\ status \\ (addr \\ (addr, addr) obs_event action) llist set\"\nwhere \n \"jmm_J_\\ P \\ \n J_heap_base.J_\\ addr2thread_id thread_id2addr jmm_spurious_wakeups jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_read jmm_heap_write P\"\n\nabbreviation jmm'_J_\\\n :: \"addr J_prog \\ cname \\ mname \\ addr val list \\ status \\ (addr \\ (addr, addr) obs_event action) llist set\"\nwhere \n \"jmm'_J_\\ P \\ \n J_heap_base.J_\\ addr2thread_id thread_id2addr jmm_spurious_wakeups jmm_empty jmm_allocate (jmm_typeof_addr P) (jmm_heap_read_typed P) jmm_heap_write P\"\n\n\nlemma jmm_J_heap_conf:\n \"J_heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_write jmm_hconf P\"\nby(unfold_locales)\n\nlemma jmm_J_allocated_heap_conf: \"J_allocated_heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_write jmm_hconf jmm_allocated P\"\nby(unfold_locales)\n\n\nlemma jmm_J_allocated_heap_conf':\n \"J_allocated_heap_conf' addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr' P) jmm_heap_write jmm_hconf jmm_allocated P\"\napply(rule J_allocated_heap_conf'.intro)\napply(unfold jmm_typeof_addr'_conv_jmm_typeof_addr)\napply(unfold_locales)\ndone\n\n\nlemma red_heap_read_typedD:\n \"J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P t e s ta e' s' \\\n J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P t e s ta e' s' \\\n (\\ad al v T. ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\ heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ heap_base'.conf TYPE('heap) typeof_addr P v T)\"\n (is \"?lhs1 \\ ?rhs1a \\ ?rhs1b\")\n and reds_heap_read_typedD:\n \"J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P t es s ta es' s' \\\n J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P t es s ta es' s' \\\n (\\ad al v T. ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\ heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ heap_base'.conf TYPE('heap) typeof_addr P v T)\"\n (is \"?lhs2 \\ ?rhs2a \\ ?rhs2b\")\nproof -\n have \"(?lhs1 \\ ?rhs1a \\ ?rhs1b) \\ (?lhs2 \\ ?rhs2a \\ ?rhs2b)\"\n apply(induct rule: J_heap_base.red_reds.induct)\n prefer 44 (* RedCallExternal *)\n apply(subst (asm) red_external_heap_read_typed)\n apply(fastforce intro!: J_heap_base.red_reds.RedCallExternal simp add: convert_extTA_def)\n\n prefer 43 (* RedCall *)\n apply(fastforce dest: J_heap_base.red_reds.RedCall)\n\n apply(auto intro: J_heap_base.red_reds.intros dest: heap_base.heap_read_typed_into_heap_read heap_base.heap_read_typed_typed dest: heap_base'.addr_loc_type_conv_addr_loc_type[THEN fun_cong, THEN fun_cong, THEN fun_cong, THEN iffD2] heap_base'.conf_conv_conf[THEN fun_cong, THEN fun_cong, THEN iffD1])\n done\n moreover have \"(?rhs1a \\ ?rhs1b \\ ?lhs1) \\ (?rhs2a \\ ?rhs2b \\ ?lhs2)\"\n apply(induct rule: J_heap_base.red_reds.induct)\n prefer 44 (* RedCallExternal *)\n apply simp\n apply(intro strip)\n apply(erule (1) J_heap_base.red_reds.RedCallExternal)\n apply(subst red_external_heap_read_typed, erule conjI)\n apply(blast+)[4]\n\n prefer 43 (* RedCall *)\n apply(fastforce dest: J_heap_base.red_reds.RedCall)\n\n apply(auto intro: J_heap_base.red_reds.intros intro!: heap_base.heap_read_typedI dest: heap_base'.addr_loc_type_conv_addr_loc_type[THEN fun_cong, THEN fun_cong, THEN fun_cong, THEN iffD1] intro: heap_base'.conf_conv_conf[THEN fun_cong, THEN fun_cong, THEN iffD2])\n done\n ultimately show \"?lhs1 \\ ?rhs1a \\ ?rhs1b\" \"?lhs2 \\ ?rhs2a \\ ?rhs2b\" by blast+\nqed\n\nlemma if_mred_heap_read_typedD:\n \"multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P) t xh ta x'h' \\\n if_heap_read_typed final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P) typeof_addr P t xh ta x'h'\"\nunfolding multithreaded_base.init_fin.simps\nby(subst red_heap_read_typedD) fastforce\n\nlemma J_\\_heap_read_typedI:\n \"\\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P C M vs status;\n \\ad al v T. \\ NormalAction (ReadMem ad al v) \\ snd ` lset E; heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ \\ heap_base'.conf TYPE('heap) typeof_addr P v T \\\n \\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P C M vs status\"\napply(erule imageE, hypsubst)\napply(rule imageI)\napply(erule multithreaded_base.\\.cases, hypsubst)\napply(rule multithreaded_base.\\.intros)\napply(subst if_mred_heap_read_typedD[abs_def])\napply(erule if_mthr_Runs_heap_read_typedI)\napply(auto simp add: image_Un lset_lmap[symmetric] lmap_lconcat llist.map_comp o_def split_def simp del: lset_lmap)\ndone\n\nlemma jmm'_redI:\n \"\\ J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P t e s ta e' s'; \n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta \\\n \\ \\ta e' s'. J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P t e s ta e' s' \\ final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta\"\n (is \"\\ ?red'; ?aok \\ \\ ?concl\")\n and jmm'_redsI:\n \"\\ J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P t es s ta es' s';\n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta \\\n \\ \\ta es' s'. J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P t es s ta es' s' \\ \n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta\"\n (is \"\\ ?reds'; ?aoks \\ \\ ?concls\")\nproof -\n note [simp del] = split_paired_Ex\n and [simp add] = final_thread.actions_ok_iff heap_base.THE_addr_loc_type heap_base.defval_conf\n and [intro] = jmm_heap_read_typed_default_val\n\n let ?v = \"\\h a al. default_val (THE T. heap_base.addr_loc_type typeof_addr P h a al T)\"\n\n have \"(?red' \\ ?aok \\ ?concl) \\ (?reds' \\ ?aoks \\ ?concls)\"\n proof(induct rule: J_heap_base.red_reds.induct)\n case goal23 (* RedAAcc *)\n thus ?case by(auto 4 6 intro: J_heap_base.red_reds.RedAAcc[where v=\"?v h a (ACell (nat (sint i)))\"])\n next\n case goal35 (* RedFAcc *)\n thus ?case by(auto 4 5 intro: J_heap_base.red_reds.RedFAcc[where v=\"?v h a (CField D F)\"])\n next\n case goal44 (* RedCallExternal *)\n thus ?case\n apply clarify\n apply(drule jmm'_red_externalI, simp)\n apply(auto 4 4 intro: J_heap_base.red_reds.RedCallExternal)\n done\n next\n case goal46 (* BlockRed *)\n thus ?case\n by(clarify)(iprover intro: J_heap_base.red_reds.BlockRed)\n qed(blast intro: J_heap_base.red_reds.intros)+\n thus \"\\ ?red'; ?aok \\ \\ ?concl\" and \"\\ ?reds'; ?aoks \\ \\ ?concls\" by blast+\nqed\n\nlemma if_mred_heap_read_not_stuck:\n \"\\ multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P) t xh ta x'h';\n final_thread.actions_ok (final_thread.init_fin_final final_expr) s t ta \\\n \\\n \\ta x'h'. multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P) t xh ta x'h' \\ final_thread.actions_ok (final_thread.init_fin_final final_expr) s t ta\"\napply(erule multithreaded_base.init_fin.cases)\n apply hypsubst\n apply clarify\n apply(drule jmm'_redI)\n apply(simp add: final_thread.actions_ok_iff)\n apply clarify\n apply(subst (2) split_paired_Ex)\n apply(subst (2) split_paired_Ex)\n apply(subst (2) split_paired_Ex)\n apply(rule exI conjI)+\n apply(rule multithreaded_base.init_fin.intros)\n apply(simp)\n apply(simp add: final_thread.actions_ok_iff)\n apply(blast intro: multithreaded_base.init_fin.intros)\napply(blast intro: multithreaded_base.init_fin.intros)\ndone\n\nlemma if_mredT_heap_read_not_stuck:\n \"multithreaded_base.redT (final_thread.init_fin_final final_expr) (multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P)) convert_RA' s tta s'\n \\ \\tta s'. multithreaded_base.redT (final_thread.init_fin_final final_expr) (multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P)) convert_RA' s tta s'\"\napply(erule multithreaded_base.redT.cases)\n apply hypsubst\n apply(drule (1) if_mred_heap_read_not_stuck)\n apply(erule exE)+\n apply(rename_tac ta' x'h')\n apply(insert redT_updWs_total)\n apply(erule_tac x=\"t\" in meta_allE)\n apply(erule_tac x=\"wset s\" in meta_allE)\n apply(erule_tac x=\"\\ta'\\\\<^bsub>w\\<^esub>\" in meta_allE)\n apply clarsimp\n apply(rule exI)+\n apply(auto intro!: multithreaded_base.redT.intros)[1]\napply hypsubst\napply(rule exI conjI)+\napply(rule multithreaded_base.redT.redT_acquire)\napply assumption+\ndone\n\nlemma J_\\_heap_read_typedD:\n \"E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_. typeof_addr) (heap_base.heap_read_typed (\\_. typeof_addr) jmm_heap_read P) jmm_heap_write P C M vs status\n \\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_. typeof_addr) jmm_heap_read jmm_heap_write P C M vs status\"\napply(erule imageE, hypsubst)\napply(rule imageI)\napply(erule multithreaded_base.\\.cases, hypsubst)\napply(rule multithreaded_base.\\.intros)\napply(subst (asm) if_mred_heap_read_typedD[abs_def])\napply(erule if_mthr_Runs_heap_read_typedD)\napply(erule if_mredT_heap_read_not_stuck[where typeof_addr=\"\\_. typeof_addr\", unfolded if_mred_heap_read_typedD[abs_def]])\ndone\n\nlemma J_\\_typesafe_subset: \"jmm'_J_\\ P C M vs status \\ jmm_J_\\ P C M vs status\"\nunfolding jmm_typeof_addr_def[abs_def]\nby(rule subsetI)(erule J_\\_heap_read_typedD)\n\nlemma J_legal_typesafe1:\n assumes wfP: \"wf_J_prog P\"\n and ok: \"jmm_wf_start_state P C M vs\"\n and legal: \"legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\n shows \"legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\\"\n and E: \"E \\ ?\\\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n let ?J = \"J(0 := \\committed = {}, justifying_exec = justifying_exec (J 1), justifying_ws = justifying_ws (J 1), action_translation = id\\)\"\n\n from wfP have wf_sys: \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n\n from justified have \"P \\ (justifying_exec (J 1), justifying_ws (J 1)) \\\"\n by(simp add: justification_well_formed_def)\n with justified have \"P \\ (E, ws) justified_by ?J\" by(rule drop_0th_justifying_exec)\n moreover have \"range (justifying_exec \\ ?J) \\ ?\\'\"\n proof\n fix \\\n assume \"\\ \\ range (justifying_exec \\ ?J)\"\n then obtain n where \"\\ = justifying_exec (?J n)\" by auto\n then obtain n where \\: \"\\ = justifying_exec (J n)\" and n: \"n > 0\" by(auto split: split_if_asm)\n from range \\ have \"\\ \\ ?\\\" by auto\n thus \"\\ \\ ?\\'\" unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset \\\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength \\\" \"action_obs \\ a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with J_allocated_heap_conf'.mred_known_addrs_typing'[OF jmm_J_allocated_heap_conf' wfP jmm_start_heap_ok]\n J_heap_conf.J_start_state_sconf_type_ok[OF jmm_J_heap_conf wfP ok]\n wf_sys is_justified_by_imp_is_weakly_justified_by[OF justified wf] range n\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def] \\\n by(rule known_addrs_typing'.read_value_typeable_justifying)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n qed\n moreover from E have \"E \\ ?\\'\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset E\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength E\" \"action_obs E a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with jmm_J_allocated_heap_conf' wfP ok legal_imp_weakly_legal_execution[OF legal]\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n by(rule J_allocated_heap_conf'.J_legal_read_value_typeable)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n ultimately show ?thesis using wf unfolding gen_legal_execution.simps by blast\nqed\n\nlemma J_weakly_legal_typesafe1:\n assumes wfP: \"wf_J_prog P\"\n and ok: \"jmm_wf_start_state P C M vs\"\n and legal: \"weakly_legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\n shows \"weakly_legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) weakly_justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\\"\n and E: \"E \\ ?\\\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n let ?J = \"J(0 := \\committed = {}, justifying_exec = justifying_exec (J 1), justifying_ws = justifying_ws (J 1), action_translation = id\\)\"\n\n from wfP have wf_sys: \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n\n from justified have \"P \\ (justifying_exec (J 1), justifying_ws (J 1)) \\\"\n by(simp add: justification_well_formed_def)\n with justified have \"P \\ (E, ws) weakly_justified_by ?J\" by(rule drop_0th_weakly_justifying_exec)\n moreover have \"range (justifying_exec \\ ?J) \\ ?\\'\"\n proof\n fix \\\n assume \"\\ \\ range (justifying_exec \\ ?J)\"\n then obtain n where \"\\ = justifying_exec (?J n)\" by auto\n then obtain n where \\: \"\\ = justifying_exec (J n)\" and n: \"n > 0\" by(auto split: split_if_asm)\n from range \\ have \"\\ \\ ?\\\" by auto\n thus \"\\ \\ ?\\'\" unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset \\\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength \\\" \"action_obs \\ a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with J_allocated_heap_conf'.mred_known_addrs_typing'[OF jmm_J_allocated_heap_conf' wfP jmm_start_heap_ok]\n J_heap_conf.J_start_state_sconf_type_ok[OF jmm_J_heap_conf wfP ok]\n wf_sys justified range n\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def] \\\n by(rule known_addrs_typing'.read_value_typeable_justifying)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n qed\n moreover from E have \"E \\ ?\\'\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset E\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength E\" \"action_obs E a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with jmm_J_allocated_heap_conf' wfP ok legal\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n by(rule J_allocated_heap_conf'.J_legal_read_value_typeable)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n ultimately show ?thesis using wf unfolding gen_legal_execution.simps by blast\nqed\n\nlemma J_legal_typesafe2:\n assumes legal: \"legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\n shows \"legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\'\"\n and E: \"E \\ ?\\'\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n from range E have \"range (justifying_exec \\ J) \\ ?\\\" \"E \\ ?\\\"\n using J_\\_typesafe_subset[of P status C M vs] by blast+\n with justified wf\n show ?thesis by(auto simp add: gen_legal_execution.simps)\nqed\n\nlemma J_weakly_legal_typesafe2:\n assumes legal: \"weakly_legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\n shows \"weakly_legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) weakly_justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\'\"\n and E: \"E \\ ?\\'\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n from range E have \"range (justifying_exec \\ J) \\ ?\\\" \"E \\ ?\\\"\n using J_\\_typesafe_subset[of P status C M vs] by blast+\n with justified wf\n show ?thesis by(auto simp add: gen_legal_execution.simps)\nqed\n\ntheorem J_weakly_legal_typesafe:\n assumes \"wf_J_prog P\"\n and \"jmm_wf_start_state P C M vs\"\n shows \"weakly_legal_execution P (jmm_J_\\ P C M vs status) = weakly_legal_execution P (jmm'_J_\\ P C M vs status)\"\napply(rule ext iffI)+\n apply(clarify, erule J_weakly_legal_typesafe1[OF assms])\napply(clarify, erule J_weakly_legal_typesafe2)\ndone\n\ntheorem J_legal_typesafe:\n assumes \"wf_J_prog P\"\n and \"jmm_wf_start_state P C M vs\"\n shows \"legal_execution P (jmm_J_\\ P C M vs status) = legal_execution P (jmm'_J_\\ P C M vs status)\"\napply(rule ext iffI)+\n apply(clarify, erule J_legal_typesafe1[OF assms])\napply(clarify, erule J_legal_typesafe2)\ndone\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_J_Typesafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.3140505449918075, "lm_q1q2_score": 0.1704865099363672}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__42_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__42_on_rules imports n_germanSimp_lemma_on_inv__42\nbegin\nsection{*All lemmas on causal relation between inv__42*}\nlemma lemma_inv__42_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__42 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__42) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__42) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__42_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.32082129433083023, "lm_q1q2_score": 0.17042328348842184}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__95_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__95_on_rules imports n_g2kAbsAfter_lemma_on_inv__95\nbegin\nsection{*All lemmas on causal relation between inv__95*}\nlemma lemma_inv__95_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__95 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__95) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__95) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__95_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.17042327741400864}} {"text": "(* Title: JinjaThreads/Framework/FWDeadlock.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Deadlock formalisation\\\n\ntheory FWDeadlock\nimports\n FWProgressAux\nbegin\n\ncontext final_thread begin\n\ndefinition all_final_except :: \"('l,'t,'x,'m,'w) state \\ 't set \\ bool\" where\n \"all_final_except s Ts \\ \\t. not_final_thread s t \\ t \\ Ts\"\n\nlemma all_final_except_mono [mono]:\n \"(\\x. x \\ A \\ x \\ B) \\ all_final_except ts A \\ all_final_except ts B\"\nby(auto simp add: all_final_except_def)\n\nlemma all_final_except_mono':\n \"\\ all_final_except ts A; \\x. x \\ A \\ x \\ B \\ \\ all_final_except ts B\"\nby(blast intro: all_final_except_mono[rule_format])\n\nlemma all_final_exceptI:\n \"(\\t. not_final_thread s t \\ t \\ Ts) \\ all_final_except s Ts\"\nby(auto simp add: all_final_except_def)\n\nlemma all_final_exceptD:\n \"\\ all_final_except s Ts; not_final_thread s t \\ \\ t \\ Ts\"\nby(auto simp add: all_final_except_def)\n\n\ninductive must_wait :: \"('l,'t,'x,'m,'w) state \\ 't \\ ('l + 't + 't) \\ 't set \\ bool\"\n for s :: \"('l,'t,'x,'m,'w) state\" and t :: \"'t\" where\n \\ \\Lock l\\\n \"\\ has_lock (locks s $ l) t'; t' \\ t; t' \\ Ts \\ \\ must_wait s t (Inl l) Ts\"\n| \\ \\Join t'\\\n \"\\ not_final_thread s t'; t' \\ Ts \\ \\ must_wait s t (Inr (Inl t')) Ts\"\n| \\ \\IsInterrupted t' True\\\n \"\\ all_final_except s Ts; t' \\ interrupts s \\ \\ must_wait s t (Inr (Inr t')) Ts\"\n\ndeclare must_wait.cases [elim]\ndeclare must_wait.intros [intro]\n\n\n\ninductive_cases must_wait_elims2 [elim!]:\n \"must_wait s t (Inl l) Ts\"\n \"must_wait s t (Inr (Inl t'')) Ts\"\n \"must_wait s t (Inr (Inr t'')) Ts\"\n\nlemma must_wait_iff:\n \"must_wait s t lt Ts \\ \n (case lt of Inl l \\ \\t'\\Ts. t \\ t' \\ has_lock (locks s $ l) t'\n | Inr (Inl t') \\ not_final_thread s t' \\ t' \\ Ts\n | Inr (Inr t') \\ all_final_except s Ts \\ t' \\ interrupts s)\"\nby(auto simp add: must_wait.simps split: sum.splits)\n\nend\n\ntext\\Deadlock as a system-wide property\\\n\ncontext multithreaded_base begin\n\ndefinition\n deadlock :: \"('l,'t,'x,'m,'w) state \\ bool\"\nwhere\n \"deadlock s\n \\ (\\t x. thr s t = \\(x, no_wait_locks)\\ \\ \\ final x \\ wset s t = None\n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s)))))\n \\ (\\t x ln. thr s t = \\(x, ln)\\ \\ (\\l. ln $ l > 0) \\ \\ waiting (wset s t)\n \\ (\\l t'. ln $ l > 0 \\ t \\ t' \\ thr s t' \\ None \\ has_lock (locks s $ l) t'))\n \\ (\\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS w\\)\"\n\nlemma deadlockI:\n \"\\ \\t x. \\ thr s t = \\(x, no_wait_locks)\\; \\ final x; wset s t = None \\\n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s))));\n \\t x ln l. \\ thr s t = \\(x, ln)\\; ln $ l > 0; \\ waiting (wset s t) \\\n \\ \\l t'. ln $ l > 0 \\ t \\ t' \\ thr s t' \\ None \\ has_lock (locks s $ l) t';\n \\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS w\\ \\\n \\ deadlock s\"\nby(auto simp add: deadlock_def)\n\nlemma deadlockE:\n assumes \"deadlock s\"\n obtains \"\\t x. thr s t = \\(x, no_wait_locks)\\ \\ \\ final x \\ wset s t = None\n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s))))\"\n and \"\\t x ln. thr s t = \\(x, ln)\\ \\ (\\l. ln $ l > 0) \\ \\ waiting (wset s t)\n \\ (\\l t'. ln $ l > 0 \\ t \\ t' \\ thr s t' \\ None \\ has_lock (locks s $ l) t')\"\n and \"\\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS w\\\"\nusing assms unfolding deadlock_def by(blast)\n\nlemma deadlockD1:\n assumes \"deadlock s\"\n and \"thr s t = \\(x, no_wait_locks)\\\"\n and \"\\ final x\"\n and \"wset s t = None\"\n obtains \"t \\ \\x, shr s\\ \\\"\n and \"\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s)))\"\nusing assms unfolding deadlock_def by(blast)\n\nlemma deadlockD2:\n fixes ln\n assumes \"deadlock s\"\n and \"thr s t = \\(x, ln)\\\"\n and \"ln $ l > 0\"\n and \"\\ waiting (wset s t)\"\n obtains l' t' where \"ln $ l' > 0\" \"t \\ t'\" \"thr s t' \\ None\" \"has_lock (locks s $ l') t'\"\nusing assms unfolding deadlock_def by blast\n\nlemma deadlockD3:\n assumes \"deadlock s\"\n and \"thr s t = \\(x, no_wait_locks)\\\"\n shows \"\\w. wset s t \\ \\PostWS w\\\"\nusing assms unfolding deadlock_def by blast\n\nlemma deadlock_def2:\n \"deadlock s \\\n (\\t x. thr s t = \\(x, no_wait_locks)\\ \\ \\ final x \\ wset s t = None\n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s)))))\n \\ (\\t x ln. thr s t = \\(x, ln)\\ \\ ln \\ no_wait_locks \\ \\ waiting (wset s t)\n \\ (\\l. ln $ l > 0 \\ must_wait s t (Inl l) (dom (thr s))))\n \\ (\\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS WSNotified\\ \\ wset s t \\ \\PostWS WSWokenUp\\)\"\nunfolding neq_no_wait_locks_conv\napply(rule iffI)\n apply(intro strip conjI)\n apply(blast dest: deadlockD1)\n apply(blast dest: deadlockD1)\n apply(blast elim: deadlockD2)\n apply(blast dest: deadlockD3)\n apply(blast dest: deadlockD3)\napply(elim conjE exE)\napply(rule deadlockI)\n apply blast\n apply(rotate_tac 1)\n apply(erule allE, rotate_tac -1)\n apply(erule allE, rotate_tac -1)\n apply(erule allE, rotate_tac -1)\n apply(erule impE, blast)\n apply(elim exE conjE)\n apply(erule must_wait.cases)\n apply(clarify)\n apply(rotate_tac 3)\n apply(rule exI conjI|erule not_sym|assumption)+\n apply blast\n apply blast\n apply blast\n apply blast\napply(case_tac w)\n apply blast\napply blast\ndone\n\nlemma all_waiting_implies_deadlock:\n assumes \"lock_thread_ok (locks s) (thr s)\"\n and normal: \"\\t x. \\ thr s t = \\(x, no_wait_locks)\\; \\ final x; wset s t = None \\ \n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (dom (thr s))))\"\n and acquire: \"\\t x ln l. \\ thr s t = \\(x, ln)\\; \\ waiting (wset s t); ln $ l > 0 \\\n \\ \\l'. ln $ l' > 0 \\ \\ may_lock (locks s $ l') t\"\n and wakeup: \"\\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS w\\\"\n shows \"deadlock s\"\nproof(rule deadlockI)\n fix T X\n assume \"thr s T = \\(X, no_wait_locks)\\\" \"\\ final X\" \"wset s T = None\"\n thus \"T \\ \\X, shr s\\ \\ \\ (\\LT. T \\ \\X, shr s\\ LT \\ \\ (\\lt\\LT. must_wait s T lt (dom (thr s))))\" \n by(rule normal)\nnext\n fix T X LN l'\n assume \"thr s T = \\(X, LN)\\\"\n and \"0 < LN $ l'\"\n and wset: \"\\ waiting (wset s T)\"\n from acquire[OF \\thr s T = \\(X, LN)\\\\ wset, OF \\0 < LN $ l'\\]\n obtain l' where \"0 < LN $ l'\" \"\\ may_lock (locks s $ l') T\" by blast\n then obtain t' where \"T \\ t'\" \"has_lock (locks s $ l') t'\"\n unfolding not_may_lock_conv by fastforce\n moreover with \\lock_thread_ok (locks s) (thr s)\\\n have \"thr s t' \\ None\" by(auto dest: lock_thread_okD)\n ultimately show \"\\l t'. 0 < LN $ l \\ T \\ t' \\ thr s t' \\ None \\ has_lock (locks s $ l) t'\"\n using \\0 < LN $ l'\\ by(auto)\nqed(rule wakeup)\n\nlemma mfinal_deadlock:\n \"mfinal s \\ deadlock s\"\nunfolding mfinal_def2\nby(rule deadlockI)(auto simp add: final_thread_def)\n\ntext \\Now deadlock for single threads\\\n\nlemma must_wait_mono:\n \"(\\x. x \\ A \\ x \\ B) \\ must_wait s t lt A \\ must_wait s t lt B\"\nby(auto simp add: must_wait_iff split: sum.split elim: all_final_except_mono')\n\nlemma must_wait_mono':\n \"\\ must_wait s t lt A; A \\ B \\ \\ must_wait s t lt B\"\nusing must_wait_mono[of A B s t lt]\nby blast\n\nend\n\nlemma UN_mono: \"\\ x \\ A \\ x \\ A'; x \\ B \\ x \\ B' \\ \\ x \\ A \\ B \\ x \\ A' \\ B'\"\nby blast\n\nlemma Collect_mono_conv [mono]: \"x \\ {x. P x} \\ P x\"\nby blast\n\ncontext multithreaded_base begin\n\ncoinductive_set deadlocked :: \"('l,'t,'x,'m,'w) state \\ 't set\"\n for s :: \"('l,'t,'x,'m,'w) state\" where\n deadlockedLock:\n \"\\ thr s t = \\(x, no_wait_locks)\\; t \\ \\x, shr s\\ \\; wset s t = None;\n \\LT. t \\ \\x, shr s\\ LT \\ \\ \\lt \\ LT. must_wait s t lt (deadlocked s \\ final_threads s) \\\n \\ t \\ deadlocked s\"\n\n| deadlockedWait:\n \"\\ln. \\ thr s t = \\(x, ln)\\; all_final_except s (deadlocked s); waiting (wset s t) \\ \\ t \\ deadlocked s\"\n\n| deadlockedAcquire:\n \"\\ln. \\ thr s t = \\(x, ln)\\; \\ waiting (wset s t); ln $ l > 0; has_lock (locks s $ l) t'; t' \\ t; \n t' \\ deadlocked s \\ final_thread s t' \\ \n \\ t \\ deadlocked s\"\nmonos must_wait_mono UN_mono\n\nlemma deadlockedAcquire_must_wait:\n \"\\ln. \\ thr s t = \\(x, ln)\\; \\ waiting (wset s t); ln $ l > 0; must_wait s t (Inl l) (deadlocked s \\ final_threads s) \\\n \\ t \\ deadlocked s\"\napply(erule must_wait_elims)\napply(erule (2) deadlockedAcquire)\napply auto\ndone\n\nlemma deadlocked_elims [consumes 1, case_names lock wait acquire]:\n assumes \"t \\ deadlocked s\"\n and lock: \"\\x. \\ thr s t = \\(x, no_wait_locks)\\; t \\ \\x, shr s\\ \\; wset s t = None;\n \\LT. t \\ \\x, shr s\\ LT \\ \\ \\lt \\ LT. must_wait s t lt (deadlocked s \\ final_threads s) \\\n \\ thesis\"\n and wait: \"\\x ln. \\ thr s t = \\(x, ln)\\; all_final_except s (deadlocked s); waiting (wset s t) \\\n \\ thesis\"\n and acquire: \"\\x ln l t'. \n \\ thr s t = \\(x, ln)\\; \\ waiting (wset s t); 0 < ln $ l; has_lock (locks s $ l) t'; t \\ t';\n t' \\ deadlocked s \\ final_thread s t' \\ \\ thesis\"\n shows thesis\nusing assms by cases blast+\n\nlemma deadlocked_coinduct \n [consumes 1, case_names deadlocked, case_conclusion deadlocked Lock Wait Acquire, coinduct set: deadlocked]:\n assumes major: \"t \\ X\"\n and step: \n \"\\t. t \\ X \\\n (\\x. thr s t = \\(x, no_wait_locks)\\ \\ t \\ \\x, shr s\\ \\ \\ wset s t = None \\\n (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt\\LT. must_wait s t lt (X \\ deadlocked s \\ final_threads s)))) \\\n (\\x ln. thr s t = \\(x, ln)\\ \\ all_final_except s (X \\ deadlocked s) \\ waiting (wset s t)) \\\n (\\x l t' ln. thr s t = \\(x, ln)\\ \\ \\ waiting (wset s t) \\ 0 < ln $ l \\ has_lock (locks s $ l) t' \\\n t' \\ t \\ ((t' \\ X \\ t' \\ deadlocked s) \\ final_thread s t'))\"\n shows \"t \\ deadlocked s\"\nusing major\nproof(coinduct)\n case (deadlocked t)\n have \"X \\ deadlocked s \\ final_threads s = {x. x \\ X \\ x \\ deadlocked s \\ x \\ final_threads s}\"\n by auto\n moreover have \"X \\ deadlocked s = {x. x \\ X \\ x \\ deadlocked s}\" by blast\n ultimately show ?case using step[OF deadlocked] by(elim disjE) simp_all\nqed\n\ndefinition deadlocked' :: \"('l,'t,'x,'m,'w) state \\ bool\" where\n \"deadlocked' s \\ (\\t. not_final_thread s t \\ t \\ deadlocked s)\"\n\nlemma deadlocked'I:\n \"(\\t. not_final_thread s t \\ t \\ deadlocked s) \\ deadlocked' s\"\nby(auto simp add: deadlocked'_def)\n\nlemma deadlocked'D2:\n \"\\ deadlocked' s; not_final_thread s t; t \\ deadlocked s \\ thesis \\ \\ thesis\"\nby(auto simp add: deadlocked'_def)\n\nlemma not_deadlocked'I:\n \"\\ not_final_thread s t; t \\ deadlocked s \\ \\ \\ deadlocked' s\"\nby(auto dest: deadlocked'D2)\n\nlemma deadlocked'_intro:\n \"\\ \\t. not_final_thread s t \\ t \\ deadlocked s \\ \\ deadlocked' s\"\nby(rule deadlocked'I)(blast)+\n\nlemma deadlocked_thread_exists: \n assumes \"t \\ deadlocked s\"\n and \"\\x ln. thr s t = \\(x, ln)\\ \\ thesis\"\n shows thesis\nusing assms\nby cases blast+\n\nend\n\ncontext multithreaded begin \n\nlemma red_no_deadlock: \n assumes P: \"s -t\\ta\\ s'\"\n and dead: \"t \\ deadlocked s\"\n shows False\nproof -\n from P show False\n proof(cases)\n case (redT_normal x x' m')\n note red = \\t \\ \\x, shr s\\ -ta\\ \\x', m'\\\\\n note tst = \\thr s t = \\(x, no_wait_locks)\\\\\n note aok = \\actions_ok s t ta\\\n show False\n proof(cases \"\\w. wset s t = \\InWS w\\\")\n case True with aok show ?thesis by(auto simp add: wset_actions_ok_def split: if_split_asm)\n next\n case False\n with dead tst\n have mle: \"t \\ \\x, shr s\\ \\\"\n and cledead: \"\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t lt (deadlocked s \\ final_threads s))\"\n by(cases, auto simp add: waiting_def)+\n let ?LT = \"collect_waits ta\"\n from red have \"t \\ \\x, shr s\\ ?LT \\\" by(auto intro: can_syncI)\n then obtain lt where lt: \"lt \\ ?LT\" and mw: \"must_wait s t lt (deadlocked s \\ final_threads s)\"\n by(blast dest: cledead[rule_format])\n from mw show False\n proof(cases rule: must_wait_elims)\n case (lock l t')\n from \\lt = Inl l\\ lt have \"l \\ collect_locks \\ta\\\\<^bsub>l\\<^esub>\" by(auto)\n with aok have \"may_lock (locks s $ l) t\"\n by(auto elim!: collect_locksE lock_ok_las_may_lock)\n with \\has_lock (locks s $ l) t'\\ have \"t' = t\"\n by(auto dest: has_lock_may_lock_t_eq)\n with \\t' \\ t\\ show False by contradiction\n next\n case (join t')\n from \\lt = Inr (Inl t')\\ lt have \"Join t' \\ set \\ta\\\\<^bsub>c\\<^esub>\" by auto\n from \\not_final_thread s t'\\ obtain x'' ln''\n where \"thr s t' = \\(x'', ln'')\\\" by(rule not_final_thread_existsE)\n moreover with \\Join t' \\ set \\ta\\\\<^bsub>c\\<^esub>\\ aok\n have \"final x''\" \"ln'' = no_wait_locks\" \"wset s t' = None\"\n by(auto dest: cond_action_oks_Join)\n ultimately show False using \\not_final_thread s t'\\ by(auto)\n next\n case (interrupt t')\n from aok lt \\lt = Inr (Inr t')\\\n have \"t' \\ interrupts s\"\n by(auto intro: collect_interrupts_interrupted)\n with \\t' \\ interrupts s\\ show False by contradiction\n qed\n qed\n next\n case (redT_acquire x n ln)\n show False\n proof(cases \"\\w. wset s t = \\InWS w\\\")\n case True with \\\\ waiting (wset s t)\\ show ?thesis\n by(auto simp add: not_waiting_iff)\n next\n case False\n with dead \\thr s t = \\(x, ln)\\\\ \\0 < ln $ n\\\n obtain l t' where \"0 < ln $ l\" \"t \\ t'\"\n and \"has_lock (locks s $ l) t'\"\n by(cases)(fastforce simp add: waiting_def)+\n hence \"\\ may_acquire_all (locks s) t ln\"\n by(auto elim: may_acquire_allE dest: has_lock_may_lock_t_eq)\n with \\may_acquire_all (locks s) t ln\\ show ?thesis by contradiction\n qed\n qed\nqed\n\nlemma deadlocked'_no_red:\n \"\\ s -t\\ta\\ s'; deadlocked' s \\ \\ False\"\napply(rule red_no_deadlock)\n apply(assumption)\napply(erule deadlocked'D2)\nby(rule red_not_final_thread)\n\nlemma not_final_thread_deadlocked_final_thread [iff]: \n \"thr s t = \\xln\\ \\ not_final_thread s t \\ t \\ deadlocked s \\ final_thread s t\"\nby(auto simp add: not_final_thread_final_thread_conv[symmetric])\n\nlemma all_waiting_deadlocked:\n assumes \"not_final_thread s t\"\n and \"lock_thread_ok (locks s) (thr s)\" \n and normal: \"\\t x. \\ thr s t = \\(x, no_wait_locks)\\; \\ final x; wset s t = None \\ \n \\ t \\ \\x, shr s\\ \\ \\ (\\LT. t \\ \\x, shr s\\ LT \\ \\ (\\lt\\LT. must_wait s t lt (final_threads s)))\"\n and acquire: \"\\t x ln l. \\ thr s t = \\(x, ln)\\; \\ waiting (wset s t); ln $ l > 0 \\\n \\ \\l'. ln $ l' > 0 \\ \\ may_lock (locks s $ l') t\"\n and wakeup: \"\\t x w. thr s t = \\(x, no_wait_locks)\\ \\ wset s t \\ \\PostWS w\\\"\n shows \"t \\ deadlocked s\"\nproof -\n from \\not_final_thread s t\\\n have \"t \\ {t. not_final_thread s t}\" by simp\n thus ?thesis\n proof(coinduct)\n case (deadlocked z)\n hence \"not_final_thread s z\" by simp\n then obtain x' ln' where \"thr s z = \\(x', ln')\\\" by(fastforce elim!: not_final_thread_existsE)\n {\n assume \"wset s z = None\" \"\\ final x'\"\n and [simp]: \"ln' = no_wait_locks\"\n with \\thr s z = \\(x', ln')\\\\\n have \"z \\ \\x', shr s\\ \\ \\ (\\LT. z \\ \\x', shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s z lt (final_threads s)))\"\n by(auto dest: normal)\n then obtain \"z \\ \\x', shr s\\ \\\"\n and clnml: \"\\LT. z \\ \\x', shr s\\ LT \\ \\ \\lt \\ LT. must_wait s z lt (final_threads s)\" by(blast)\n { fix LT\n assume \"z \\ \\x', shr s\\ LT \\\"\n then obtain lt where mw: \"must_wait s z lt (final_threads s)\" and lt: \"lt \\ LT\"\n by(blast dest: clnml)\n from mw have \"must_wait s z lt ({t. not_final_thread s t} \\ deadlocked s \\ final_threads s)\"\n by(blast intro: must_wait_mono')\n with lt have \"\\lt \\ LT. must_wait s z lt ({t. not_final_thread s t} \\ deadlocked s \\ final_threads s)\"\n by blast }\n with \\z \\ \\x', shr s\\ \\\\ \\thr s z = \\(x', ln')\\\\ \\wset s z = None\\ have ?case by(simp) }\n note c1 = this\n { \n assume wsz: \"\\ waiting (wset s z)\"\n and \"ln' \\ no_wait_locks\"\n from \\ln' \\ no_wait_locks\\ obtain l where \"0 < ln' $ l\"\n by(auto simp add: neq_no_wait_locks_conv)\n with wsz \\thr s z = \\(x', ln')\\\\ \n obtain l' where \"0 < ln' $ l'\" \"\\ may_lock (locks s $ l') z\"\n by(blast dest: acquire)\n then obtain t'' where \"t'' \\ z\" \"has_lock (locks s $ l') t''\"\n unfolding not_may_lock_conv by blast\n with \\lock_thread_ok (locks s) (thr s)\\\n obtain x'' ln'' where \"thr s t'' = \\(x'', ln'')\\\"\n by(auto elim!: lock_thread_ok_has_lockE)\n hence \"(not_final_thread s t'' \\ t'' \\ deadlocked s) \\ final_thread s t''\"\n by(clarsimp simp add: not_final_thread_iff final_thread_def)\n with wsz \\0 < ln' $ l'\\ \\thr s z = \\(x', ln')\\\\ \\t'' \\ z\\ \\has_lock (locks s $ l') t''\\\n have ?Acquire by simp blast\n hence ?case by simp }\n note c2 = this\n { fix w\n assume \"waiting (wset s z)\"\n with \\thr s z = \\(x', ln')\\\\\n have \"?Wait\" by(clarsimp simp add: all_final_except_def)\n hence ?case by simp }\n note c3 = this\n from \\not_final_thread s z\\ \\thr s z = \\(x', ln')\\\\ show ?case\n proof(cases rule: not_final_thread_cases2)\n case final show ?thesis\n proof(cases \"wset s z\")\n case None show ?thesis\n proof(cases \"ln' = no_wait_locks\")\n case True with None final show ?thesis by(rule c1)\n next\n case False\n from None have \"\\ waiting (wset s z)\" by(simp add: not_waiting_iff)\n thus ?thesis using False by(rule c2)\n qed\n next\n case (Some w)\n show ?thesis\n proof(cases w)\n case (InWS w') \n with Some have \"waiting (wset s z)\" by(simp add: waiting_def)\n thus ?thesis by(rule c3)\n next\n case (PostWS w')\n with Some have \"\\ waiting (wset s z)\" by(simp add: not_waiting_iff)\n moreover from PostWS \\thr s z = \\(x', ln')\\\\ Some\n have \"ln' \\ no_wait_locks\" by(auto dest: wakeup)\n ultimately show ?thesis by(rule c2)\n qed\n qed\n next\n case wait_locks show ?thesis\n proof(cases \"wset s z\")\n case None\n hence \"\\ waiting (wset s z)\" by(simp add: not_waiting_iff)\n thus ?thesis using wait_locks by(rule c2)\n next\n case (Some w)\n show ?thesis\n proof(cases w)\n case (InWS w')\n with Some have \"waiting (wset s z)\" by(simp add: waiting_def)\n thus ?thesis by(rule c3)\n next\n case (PostWS w')\n with Some have \"\\ waiting (wset s z)\" by(simp add: not_waiting_iff)\n moreover from PostWS \\thr s z = \\(x', ln')\\\\ Some\n have \"ln' \\ no_wait_locks\" by(auto dest: wakeup)\n ultimately show ?thesis by(rule c2)\n qed\n qed\n next\n case (wait_set w)\n show ?thesis\n proof(cases w)\n case (InWS w')\n with wait_set have \"waiting (wset s z)\" by(simp add: waiting_def)\n thus ?thesis by(rule c3)\n next\n case (PostWS w')\n with wait_set have \"\\ waiting (wset s z)\" by(simp add: not_waiting_iff)\n moreover from PostWS \\thr s z = \\(x', ln')\\\\ wait_set\n have \"ln' \\ no_wait_locks\" by(auto dest: wakeup[simplified])\n ultimately show ?thesis by(rule c2)\n qed\n qed\n qed\nqed\n\ntext \\Equivalence proof for both notions of deadlock\\\n\nlemma deadlock_implies_deadlocked':\n assumes dead: \"deadlock s\" \n shows \"deadlocked' s\"\nproof -\n show ?thesis\n proof(rule deadlocked'I)\n fix t\n assume \"not_final_thread s t\"\n hence \"t \\ {t. not_final_thread s t}\" ..\n thus \"t \\ deadlocked s\"\n proof(coinduct)\n case (deadlocked t'')\n hence \"not_final_thread s t''\" ..\n then obtain x'' ln'' where tst'': \"thr s t'' = \\(x'', ln'')\\\"\n by(rule not_final_thread_existsE)\n { assume \"waiting (wset s t'')\"\n moreover\n with tst'' have nfine: \"not_final_thread s t''\"\n unfolding waiting_def\n by(blast intro: not_final_thread.intros)\n ultimately have ?case using tst''\n by(blast intro: all_final_exceptI not_final_thread_final) }\n note c1 = this\n { \n assume wst'': \"\\ waiting (wset s t'')\"\n and \"ln'' \\ no_wait_locks\"\n then obtain l where l: \"ln'' $ l > 0\"\n by(auto simp add: neq_no_wait_locks_conv)\n with dead wst'' tst'' obtain l' T\n where \"ln'' $ l' > 0\" \"t'' \\ T\" \n and hl: \"has_lock (locks s $ l') T\"\n and tsT: \"thr s T \\ None\"\n by - (erule deadlockD2)\n moreover from \\thr s T \\ None\\\n obtain xln where tsT: \"thr s T = \\xln\\\" by auto\n then obtain X LN where \"thr s T = \\(X, LN)\\\"\n by(cases xln, auto)\n moreover hence \"not_final_thread s T \\ final_thread s T\"\n by(auto simp add: final_thread_def not_final_thread_iff)\n ultimately have ?case using wst'' tst'' by blast }\n note c2 = this\n { assume \"wset s t'' = None\"\n and [simp]: \"ln'' = no_wait_locks\"\n moreover\n with \\not_final_thread s t''\\ tst''\n have \"\\ final x''\" by(auto)\n ultimately obtain \"t'' \\ \\x'', shr s\\ \\\"\n and clnml: \"\\LT. t'' \\ \\x'', shr s\\ LT \\ \\ \\t'. thr s t' \\ None \\ (\\lt\\LT. must_wait s t'' lt (dom (thr s)))\"\n using \\thr s t'' = \\(x'', ln'')\\\\ \\deadlock s\\\n by(blast elim: deadlockD1)\n { fix LT\n assume \"t'' \\ \\x'', shr s\\ LT \\\"\n then obtain lt where lt: \"lt \\ LT\"\n and mw: \"must_wait s t'' lt (dom (thr s))\"\n by(blast dest: clnml)\n note mw\n also have \"dom (thr s) = {t. not_final_thread s t} \\ deadlocked s \\ final_threads s\"\n by(auto simp add: not_final_thread_conv dest: deadlocked_thread_exists elim: final_threadE)\n finally have \"\\lt\\LT. must_wait s t'' lt ({t. not_final_thread s t} \\ deadlocked s \\ final_threads s)\"\n using lt by blast }\n with \\t'' \\ \\x'', shr s\\ \\\\ tst'' \\wset s t'' = None\\ have ?case by(simp) }\n note c3 = this\n from \\not_final_thread s t''\\ tst'' show ?case\n proof(cases rule: not_final_thread_cases2)\n case final show ?thesis\n proof(cases \"wset s t''\")\n case None show ?thesis\n proof(cases \"ln'' = no_wait_locks\")\n case True with None show ?thesis by(rule c3)\n next\n case False\n from None have \"\\ waiting (wset s t'')\" by(simp add: not_waiting_iff)\n thus ?thesis using False by(rule c2)\n qed\n next\n case (Some w)\n show ?thesis\n proof(cases w)\n case (InWS w')\n with Some have \"waiting (wset s t'')\" by(simp add: waiting_def)\n thus ?thesis by(rule c1)\n next\n case (PostWS w')\n hence \"\\ waiting (wset s t'')\" using Some by(simp add: not_waiting_iff)\n moreover from PostWS Some tst''\n have \"ln'' \\ no_wait_locks\" by(auto dest: deadlockD3[OF dead])\n ultimately show ?thesis by(rule c2)\n qed \n qed\n next\n case wait_locks show ?thesis\n proof(cases \"waiting (wset s t'')\")\n case False\n thus ?thesis using wait_locks by(rule c2)\n next\n case True thus ?thesis by(rule c1)\n qed\n next\n case (wait_set w)\n show ?thesis\n proof(cases w)\n case InWS\n with wait_set have \"waiting (wset s t'')\" by(simp add: waiting_def)\n thus ?thesis by(rule c1)\n next\n case (PostWS w')\n hence \"\\ waiting (wset s t'')\" using wait_set\n by(simp add: not_waiting_iff)\n moreover from PostWS wait_set tst''\n have \"ln'' \\ no_wait_locks\" by(auto dest: deadlockD3[OF dead])\n ultimately show ?thesis by(rule c2)\n qed\n qed\n qed\n qed\nqed\n\nlemma deadlocked'_implies_deadlock:\n assumes dead: \"deadlocked' s\" \n shows \"deadlock s\"\nproof -\n have deadlocked: \"\\t. not_final_thread s t \\ t \\ deadlocked s\"\n using dead by(rule deadlocked'D2)\n show ?thesis\n proof(rule deadlockI)\n fix t' x'\n assume \"thr s t' = \\(x', no_wait_locks)\\\"\n and \"\\ final x'\"\n and \"wset s t' = None\"\n hence \"not_final_thread s t'\" by(auto intro: not_final_thread_final)\n hence \"t' \\ deadlocked s\" by(rule deadlocked)\n thus \"t' \\ \\x', shr s\\ \\ \\ (\\LT. t' \\ \\x', shr s\\ LT \\ \\ (\\lt \\ LT. must_wait s t' lt (dom (thr s))))\"\n proof(cases rule: deadlocked_elims)\n case (lock x'')\n note lock = \\\\LT. t' \\ \\x'', shr s\\ LT \\ \\ \\lt \\ LT. must_wait s t' lt (deadlocked s \\ final_threads s)\\\n from \\thr s t' = \\(x'', no_wait_locks)\\\\ \\thr s t' = \\(x', no_wait_locks)\\\\\n have [simp]: \"x' = x''\" by auto\n { fix LT\n assume \"t' \\ \\x'', shr s\\ LT \\\"\n from lock[OF this] obtain lt where lt: \"lt \\ LT\"\n and mw: \"must_wait s t' lt (deadlocked s \\ final_threads s)\" by blast\n have \"deadlocked s \\ final_threads s \\ dom (thr s)\"\n by(auto elim: final_threadE dest: deadlocked_thread_exists)\n with mw have \"must_wait s t' lt (dom (thr s))\" by(rule must_wait_mono')\n with lt have \"\\lt\\LT. must_wait s t' lt (dom (thr s))\" by blast }\n with \\t' \\ \\x'', shr s\\ \\\\ show ?thesis by(auto)\n next\n case (wait x'' ln'')\n from \\wset s t' = None\\ \\waiting (wset s t')\\\n have False by(simp add: waiting_def)\n thus ?thesis ..\n next\n case (acquire x'' ln'' l'' T)\n from \\thr s t' = \\(x'', ln'')\\\\ \\thr s t' = \\(x', no_wait_locks)\\\\ \\0 < ln'' $ l''\\\n have False by(auto)\n thus ?thesis ..\n qed\n next\n fix t' x' ln' l\n assume \"thr s t' = \\(x', ln')\\\"\n and \"0 < ln' $ l\"\n and wst': \"\\ waiting (wset s t')\"\n hence \"not_final_thread s t'\" by(auto intro: not_final_thread_wait_locks)\n hence \"t' \\ deadlocked s\" by(rule deadlocked)\n thus \"\\l T. 0 < ln' $ l \\ t' \\ T \\ thr s T \\ None \\ has_lock (locks s $ l) T\"\n proof(cases rule: deadlocked_elims)\n case (lock x'')\n from \\thr s t' = \\(x', ln')\\\\ \\thr s t' = \\(x'', no_wait_locks)\\\\ \\0 < ln' $ l\\\n have False by auto\n thus ?thesis ..\n next\n case (wait x' ln')\n from wst' \\waiting (wset s t')\\\n have False by contradiction\n thus ?thesis ..\n next\n case (acquire x'' ln'' l'' t'')\n from \\thr s t' = \\(x'', ln'')\\\\ \\thr s t' = \\(x', ln')\\\\\n have [simp]: \"x' = x''\" \"ln' = ln''\" by auto\n moreover from \\t'' \\ deadlocked s \\ final_thread s t''\\\n have \"thr s t'' \\ None\"\n by(auto elim: deadlocked_thread_exists simp add: final_thread_def)\n with \\0 < ln'' $ l''\\ \\has_lock (locks s $ l'') t''\\ \\t' \\ t''\\ \\thr s t' = \\(x'', ln'')\\\\\n show ?thesis by auto\n qed\n next\n fix t x w\n assume tst: \"thr s t = \\(x, no_wait_locks)\\\"\n show \"wset s t \\ \\PostWS w\\\"\n proof\n assume \"wset s t = \\PostWS w\\\"\n moreover with tst have \"not_final_thread s t\"\n by(auto simp add: not_final_thread_iff)\n hence \"t \\ deadlocked s\" by(rule deadlocked)\n ultimately show False using tst\n by(auto elim: deadlocked.cases simp add: waiting_def)\n qed\n qed\nqed\n\nlemma deadlock_eq_deadlocked':\n \"deadlock = deadlocked'\"\nby(rule ext)(auto intro: deadlock_implies_deadlocked' deadlocked'_implies_deadlock)\n\nlemma deadlock_no_red:\n \"\\ s -t\\ta\\ s'; deadlock s \\ \\ False\"\nunfolding deadlock_eq_deadlocked'\nby(rule deadlocked'_no_red)\n\nlemma deadlock_no_active_threads:\n assumes dead: \"deadlock s\"\n shows \"active_threads s = {}\"\nproof(rule equals0I)\n fix t\n assume active: \"t \\ active_threads s\"\n then obtain ta s' where \"s -t\\ta\\ s'\" by(auto dest: active_thread_ex_red)\n thus False using dead by(rule deadlock_no_red)\nqed\n\nend\n\nlocale preserve_deadlocked = multithreaded final r convert_RA \n for final :: \"'x \\ bool\"\n and r :: \"('l,'t,'x,'m,'w,'o) semantics\" (\"_ \\ _ -_\\ _\" [50,0,0,50] 80) \n and convert_RA :: \"'l released_locks \\ 'o list\"\n +\n fixes wf_state :: \"('l,'t,'x,'m,'w) state set\"\n assumes invariant3p_wf_state: \"invariant3p redT wf_state\"\n assumes can_lock_preserved: \n \"\\ s \\ wf_state; s -t'\\ta'\\ s';\n thr s t = \\(x, no_wait_locks)\\; t \\ \\x, shr s\\ \\ \\\n \\ t \\ \\x, shr s'\\ \\\"\n and can_lock_devreserp:\n \"\\ s \\ wf_state; s -t'\\ta'\\ s';\n thr s t = \\(x, no_wait_locks)\\; t \\ \\x, shr s'\\ L \\ \\\n \\ \\L'\\L. t \\ \\x, shr s\\ L' \\\"\nbegin\n\nlemma redT_deadlocked_subset:\n assumes wfs: \"s \\ wf_state\"\n and Red: \"s -t\\ta\\ s'\"\n shows \"deadlocked s \\ deadlocked s'\"\nproof\n fix t'\n assume t'dead: \"t' \\ deadlocked s\"\n from Red have tndead: \"t \\ deadlocked s\"\n by(auto dest: red_no_deadlock)\n with t'dead have t't: \"t' \\ t\" by auto\n { fix t'\n assume \"final_thread s t'\"\n then obtain x' ln' where tst': \"thr s t' = \\(x', ln')\\\" by(auto elim!: final_threadE)\n with \\final_thread s t'\\ have \"final x'\" \n and \"wset s t' = None\" and [simp]: \"ln' = no_wait_locks\"\n by(auto elim: final_threadE)\n with Red tst' have \"t \\ t'\" by cases(auto dest: final_no_red)\n with Red tst' have \"thr s' t' = \\(x', ln')\\\"\n by cases(auto intro: redT_updTs_Some)\n moreover from Red \\t \\ t'\\ \\wset s t' = None\\\n have \"wset s' t' = None\" by cases(auto simp: redT_updWs_None_implies_None)\n ultimately have \"final_thread s' t'\" using tst' \\final x'\\\n by(auto simp add: final_thread_def) }\n hence subset: \"deadlocked s \\ final_threads s \\ deadlocked s \\ deadlocked s' \\ final_threads s'\" by(auto)\n\n from Red show \"t' \\ deadlocked s'\"\n proof(cases)\n case (redT_normal x x' m')\n note red = \\t \\ \\x, shr s\\ -ta\\ \\x', m'\\\\\n and tst = \\thr s t = \\(x, no_wait_locks)\\\\\n and aok = \\actions_ok s t ta\\\n and s' = \\redT_upd s t ta x' m' s'\\\n from red have \"\\ final x\" by(auto dest: final_no_red)\n with tndead tst have nafe: \"\\ all_final_except s (deadlocked s)\"\n by(fastforce simp add: all_final_except_def not_final_thread_iff)\n from t'dead show ?thesis\n proof(coinduct)\n case (deadlocked t'')\n note t''dead = this\n with Red have t''t: \"t'' \\ t\"\n by(auto dest: red_no_deadlock)\n from t''dead show ?case\n proof(cases rule: deadlocked_elims)\n case (lock X)\n hence est'': \"thr s t'' = \\(X, no_wait_locks)\\\"\n and msE: \"t'' \\ \\X, shr s\\ \\\"\n and csexdead: \"\\LT. t'' \\ \\X, shr s\\ LT \\ \\ \\lt \\ LT. must_wait s t'' lt (deadlocked s \\ final_threads s)\"\n by auto\n from t''t Red est''\n have es't'': \"thr s' t'' = \\(X, no_wait_locks)\\\"\n by(cases s)(cases s', auto elim!: redT_ts_Some_inv)\n note es't'' moreover\n from wfs Red est'' msE have msE': \"t'' \\ \\X, shr s'\\ \\\" by(rule can_lock_preserved)\n moreover\n { fix LT\n assume clL'': \"t'' \\ \\X, shr s'\\ LT \\\"\n with est'' have \"\\LT'\\LT. t'' \\ \\X, shr s\\ LT' \\\"\n by(rule can_lock_devreserp[OF wfs Red])\n then obtain LT' where clL': \"t'' \\ \\X, shr s\\ LT' \\\"\n and LL': \"LT' \\ LT\" by blast\n with csexdead obtain lt\n where lt: \"lt \\ LT\" and mw: \"must_wait s t'' lt (deadlocked s \\ final_threads s)\"\n by blast\n from mw have \"must_wait s' t'' lt (deadlocked s \\ deadlocked s' \\ final_threads s')\"\n proof(cases rule: must_wait_elims)\n case (lock l t')\n from \\t' \\ deadlocked s \\ final_threads s\\ Red have tt': \"t \\ t'\"\n by(auto dest: red_no_deadlock final_no_redT elim: final_threadE)\n from aok have \"lock_actions_ok (locks s $ l) t (\\ta\\\\<^bsub>l\\<^esub> $ l)\"\n by(auto simp add: lock_ok_las_def)\n with tt' \\has_lock (locks s $ l) t'\\ s'\n have hl't': \"has_lock (locks s' $ l) t'\" by(auto)\n moreover note \\t' \\ t''\\\n moreover from \\t' \\ deadlocked s \\ final_threads s\\\n have \"t' \\ (deadlocked s \\ deadlocked s' \\ final_threads s')\"\n using subset by blast\n ultimately show ?thesis unfolding \\lt = Inl l\\ ..\n next\n case (join t')\n note t'dead = \\t' \\ deadlocked s \\ final_threads s\\\n with Red have tt': \"t \\ t'\"\n by(auto dest: red_no_deadlock final_no_redT elim: final_threadE)\n note nftt' = \\not_final_thread s t'\\\n from t'dead Red aok s' tt' have ts't': \"thr s' t' = thr s t'\"\n by(auto elim!: deadlocked_thread_exists final_threadE intro: redT_updTs_Some)\n from nftt' have \"thr s t' \\ None\" by auto\n with nftt' t'dead have \"t' \\ deadlocked s\"\n by(simp add: not_final_thread_final_thread_conv[symmetric])\n hence \"not_final_thread s' t'\"\n proof(cases rule: deadlocked_elims)\n case (lock x'')\n from \\t' \\ \\x'', shr s\\ \\\\ have \"\\ final x''\"\n by(auto elim: must_syncE dest: final_no_red)\n with \\thr s t' = \\(x'', no_wait_locks)\\\\ ts't' show ?thesis\n by(auto intro: not_final_thread.intros)\n next\n case (wait x'' ln'')\n from \\\\ final x\\ tst \\all_final_except s (deadlocked s)\\\n have \"t \\ deadlocked s\" by(fastforce dest: all_final_exceptD simp add: not_final_thread_iff)\n with Red have False by(auto dest: red_no_deadlock)\n thus ?thesis ..\n next\n case (acquire x'' ln'' l'' T'')\n from \\thr s t' = \\(x'', ln'')\\\\ \\0 < ln'' $ l''\\ ts't'\n show ?thesis by(auto intro: not_final_thread.intros(2))\n qed\n moreover from t'dead subset have \"t' \\ deadlocked s \\ deadlocked s' \\ final_threads s'\" ..\n ultimately show ?thesis unfolding \\lt = Inr (Inl t')\\ ..\n next\n case (interrupt t')\n from tst red aok have \"not_final_thread s t\"\n by(auto simp add: wset_actions_ok_def not_final_thread_iff split: if_split_asm dest: final_no_red)\n with \\all_final_except s (deadlocked s \\ final_threads s)\\\n have \"t \\ deadlocked s \\ final_threads s\" by(rule all_final_exceptD)\n moreover have \"t \\ deadlocked s\" using Red by(blast dest: red_no_deadlock)\n moreover have \"\\ final_thread s t\" using red tst by(auto simp add: final_thread_def dest: final_no_red)\n ultimately have False by blast\n thus ?thesis ..\n qed\n with lt have \"\\lt\\LT. must_wait s' t'' lt (deadlocked s \\ deadlocked s' \\ final_threads s')\" by blast }\n moreover have \"wset s' t'' = None\" using s' t''t \\wset s t'' = None\\ \n by(auto intro: redT_updWs_None_implies_None)\n ultimately show ?thesis by(auto)\n next\n case (wait x ln)\n from \\all_final_except s (deadlocked s)\\ nafe have False by simp\n thus ?thesis by simp\n next\n case (acquire X ln l T)\n from t''t Red \\thr s t'' = \\(X, ln)\\\\ s'\n have es't'': \"thr s' t'' = \\(X, ln)\\\"\n by(cases s)(auto dest: redT_ts_Some_inv)\n moreover\n from \\T \\ deadlocked s \\ final_thread s T\\\n have \"T \\ t\"\n proof(rule disjE)\n assume \"T \\ deadlocked s\"\n with Red show ?thesis by(auto dest: red_no_deadlock)\n next\n assume \"final_thread s T\"\n with Red show ?thesis\n by(auto dest!: final_no_redT simp add: final_thread_def)\n qed\n with s' tst Red \\has_lock (locks s $ l) T\\ have \"has_lock (locks s' $ l) T\"\n by -(cases s, auto dest: redT_has_lock_inv[THEN iffD2])\n moreover\n from s' \\T \\ t\\ have wset: \"wset s T = None \\ wset s' T = None\"\n by(auto intro: redT_updWs_None_implies_None)\n { fix x\n assume \"thr s T = \\(x, no_wait_locks)\\\"\n with \\T \\ t\\ Red s' aok tst have \"thr s' T = \\(x, no_wait_locks)\\\"\n by(auto intro: redT_updTs_Some) }\n moreover\n hence \"final_thread s T \\ final_thread s' T\"\n by(auto simp add: final_thread_def intro: wset)\n moreover from \\\\ waiting (wset s t'')\\ s' t''t\n have \"\\ waiting (wset s' t'')\"\n by(auto simp add: redT_updWs_None_implies_None redT_updWs_PostWS_imp_PostWS not_waiting_iff)\n ultimately have ?Acquire\n using \\0 < ln $ l\\ \\t'' \\ T\\ \\T \\ deadlocked s \\ final_thread s T\\ by(auto)\n thus ?thesis by simp\n qed\n qed\n next\n case (redT_acquire x n ln)\n hence [simp]: \"ta = (K$ [], [], [], [], [], convert_RA ln)\"\n and s': \"s' = (acquire_all (locks s) t ln, (thr s(t \\ (x, no_wait_locks)), shr s), wset s, interrupts s)\"\n and tst: \"thr s t = \\(x, ln)\\\" \n and wst: \"\\ waiting (wset s t)\" by auto\n from t'dead show ?thesis\n proof(coinduct)\n case (deadlocked t'')\n note t''dead = this\n with Red have t''t: \"t'' \\ t\"\n by(auto dest: red_no_deadlock)\n from t''dead show ?case\n proof(cases rule: deadlocked_elims)\n case (lock X)\n note clnml = \\\\LT. t'' \\ \\X, shr s\\ LT \\ \\ \\lt \\ LT. must_wait s t'' lt (deadlocked s \\ final_threads s)\\\n note tst'' = \\thr s t'' = \\(X, no_wait_locks)\\\\\n with s' t''t have ts't'': \"thr s' t'' = \\(X, no_wait_locks)\\\" by simp\n moreover \n { fix LT\n assume \"t'' \\ \\X, shr s'\\ LT \\\"\n hence \"t'' \\ \\X, shr s\\ LT \\\" using s' by simp\n then obtain lt where lt: \"lt \\ LT\" and hlnft: \"must_wait s t'' lt (deadlocked s \\ final_threads s)\"\n by(blast dest: clnml)\n from hlnft have \"must_wait s' t'' lt (deadlocked s \\ deadlocked s' \\ final_threads s')\"\n proof(cases rule: must_wait_elims)\n case (lock l' T)\n from \\has_lock (locks s $ l') T\\ s'\n have \"has_lock (locks s' $ l') T\"\n by(auto intro: has_lock_has_lock_acquire_locks)\n moreover note \\T \\ t''\\\n moreover from \\T \\ deadlocked s \\ final_threads s\\\n have \"T \\ deadlocked s \\ deadlocked s' \\ final_threads s'\" using subset by blast\n ultimately show ?thesis unfolding \\lt = Inl l'\\ ..\n next\n case (join T)\n from \\not_final_thread s T\\ have \"thr s T \\ None\"\n by(auto simp add: not_final_thread_iff)\n moreover\n from \\T \\ deadlocked s \\ final_threads s\\\n have \"T \\ t\"\n proof\n assume \"T \\ deadlocked s\"\n with Red show ?thesis by(auto dest: red_no_deadlock)\n next\n assume \"T \\ final_threads s\"\n with \\0 < ln $ n\\ tst show ?thesis\n by(auto simp add: final_thread_def)\n qed\n ultimately have \"not_final_thread s' T\" using \\not_final_thread s T\\ s'\n by(auto simp add: not_final_thread_iff)\n moreover from \\T \\ deadlocked s \\ final_threads s\\\n have \"T \\ deadlocked s \\ deadlocked s' \\ final_threads s'\" using subset by blast\n ultimately show ?thesis unfolding \\lt = Inr (Inl T)\\ ..\n next\n case (interrupt T)\n from tst wst \\0 < ln $ n\\ have \"not_final_thread s t\"\n by(auto simp add: waiting_def not_final_thread_iff)\n with \\all_final_except s (deadlocked s \\ final_threads s)\\\n have \"t \\ deadlocked s \\ final_threads s\" by(rule all_final_exceptD)\n moreover have \"t \\ deadlocked s\" using Red by(blast dest: red_no_deadlock)\n moreover have \"\\ final_thread s t\" using tst \\0 < ln $ n\\ by(auto simp add: final_thread_def)\n ultimately have False by blast\n thus ?thesis ..\n qed\n with lt have \"\\lt\\LT. must_wait s' t'' lt (deadlocked s \\ deadlocked s' \\ final_threads s')\" by blast }\n moreover from \\wset s t'' = None\\ s' have \"wset s' t'' = None\" by simp\n ultimately show ?thesis using \\thr s t'' = \\(X, no_wait_locks)\\\\ \\t'' \\ \\X, shr s\\ \\\\ s' by fastforce\n next\n case (wait X LN)\n have \"all_final_except s' (deadlocked s)\"\n proof(rule all_final_exceptI)\n fix T\n assume \"not_final_thread s' T\"\n hence \"not_final_thread s T\" using wst tst s'\n by(auto simp add: not_final_thread_iff split: if_split_asm)\n with \\all_final_except s (deadlocked s)\\ \\thr s t = \\(x, ln)\\\\\n show \"T \\ deadlocked s\" by-(erule all_final_exceptD)\n qed\n hence \"all_final_except s' (deadlocked s \\ deadlocked s')\"\n by(rule all_final_except_mono') blast\n with t''t \\thr s t'' = \\(X, LN)\\\\ \\waiting (wset s t'')\\ s' \n have ?Wait by simp\n thus ?thesis by simp\n next\n case (acquire X LN l T)\n from \\thr s t'' = \\(X, LN)\\\\ t''t s'\n have \"thr s' t'' = \\(X, LN)\\\" by(simp)\n moreover from \\T \\ deadlocked s \\ final_thread s T\\ s' tst \n have \"T \\ deadlocked s \\ final_thread s' T\"\n by(clarsimp simp add: final_thread_def)\n moreover from \\has_lock (locks s $ l) T\\ s'\n have \"has_lock (locks s' $ l) T\"\n by(auto intro: has_lock_has_lock_acquire_locks)\n moreover have \"\\ waiting (wset s' t'')\" using \\\\ waiting (wset s t'')\\ s' by simp\n ultimately show ?thesis using \\0 < LN $ l\\ \\t'' \\ T\\ by blast\n qed\n qed\n qed\nqed\n\ncorollary RedT_deadlocked_subset:\n assumes wfs: \"s \\ wf_state\"\n and Red: \"s -\\ttas\\* s'\"\n shows \"deadlocked s \\ deadlocked s'\"\nusing Red \napply(induct rule: RedT_induct')\napply(unfold RedT_def)\napply(blast dest: invariant3p_rtrancl3p[OF invariant3p_wf_state _ wfs] redT_deadlocked_subset)+\ndone\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/FWDeadlock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3276683008207139, "lm_q1q2_score": 0.17023066880417337}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__28.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__28 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__28 and some rule r*}\nlemma n_RecvReqSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__0Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__0 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Empty))) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const true))) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__1Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__1 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const S))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const S))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__28:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__28 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__28:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__28 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__28.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3276682942552091, "lm_q1q2_score": 0.17023066539325363}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__150.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__150 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__150 and some rule r*}\nlemma n_PI_Remote_GetVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__150:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__150:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__150:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__150:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__150:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__150:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__150:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__150:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__150:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__150:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__150:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_FAckVsinv__150:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__150 p__Inv4\" apply fastforce done\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__150:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__150:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__150:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__150:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__150:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__150:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__150:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__150:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__150:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__150:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__150:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__150:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__150:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__150:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__150:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__150:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__150:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__150.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213070736461, "lm_q2_score": 0.3276682942552091, "lm_q1q2_score": 0.1702306605180583}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_on_inis imports n_germanSymIndex_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\\\n (f=inv__3 )\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__5 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__7 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__12 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__13 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__14 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__16 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__19 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__20 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__23 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__25 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__26 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__27 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__29 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__31 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__32 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__34 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__35 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__36 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__37 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__39 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__40 p__Inv0 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__42 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__43 p__Inv2)\\\n (\\ p__Inv2. p__Inv2\\N\\f=inv__44 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__45 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__46 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__47 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__48 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__50 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__51 p__Inv0 p__Inv2)\\\n (\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__52 p__Inv0 p__Inv2)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__1 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__3 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__4 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__5 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__6 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__7 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__8 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__10 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__11 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__12 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__13 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__14 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__15 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__16 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__17 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__18 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__19 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__20 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__22 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__23 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__25 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__26 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__27 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__29 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__30 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__31 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__32 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__33 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__34 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__35 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__36 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__37 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__39 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__40 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__41 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__42 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__43 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__44 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__45 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__46 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__47 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__48 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__50 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__51 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__52 p__Inv0 p__Inv2)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.30074557267388236, "lm_q1q2_score": 0.170227572914913}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__10.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__10 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__10 and some rule r*}\nlemma n_StoreVsinv__10:\nassumes a1: \"(\\ src data. src\\N\\data\\N\\r=n_Store src data)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src data where a1:\"src\\N\\data\\N\\r=n_Store src data\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') src) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Local'')) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_Store_HomeVsinv__10:\nassumes a1: \"(\\ data. data\\N\\r=n_Store_Home data)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain data where a1:\"data\\N\\r=n_Store_Home data\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_PutVsinv__10:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (neg (eqn (IVar (Field (Ident ''Sta'') ''MemData'')) (IVar (Field (Ident ''Sta'') ''CurrData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__10:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (neg (eqn (IVar (Field (Ident ''Sta'') ''MemData'')) (IVar (Field (Ident ''Sta'') ''CurrData''))))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__10:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (neg (eqn (IVar (Field (Ident ''Sta'') ''MemData'')) (IVar (Field (Ident ''Sta'') ''CurrData''))))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__10:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (neg (eqn (IVar (Field (Ident ''Sta'') ''MemData'')) (IVar (Field (Ident ''Sta'') ''CurrData''))))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__10:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false)) (neg (eqn (IVar (Field (Ident ''Sta'') ''MemData'')) (IVar (Field (Ident ''Sta'') ''CurrData''))))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__10:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__10:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__10:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__10:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__10:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__10:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Data'')) (IVar (Field (Ident ''Sta'') ''CurrData'')))) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__10:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Data'')) (IVar (Field (Ident ''Sta'') ''CurrData'')))) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_InvAck_1Vsinv__10:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(f=inv__10 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__10:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__10:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__10:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__10:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__10:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__10:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__10:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__10:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__10:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__10:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__10:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__10:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__10:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__10:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__10:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__10:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__10.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.334589441253186, "lm_q1q2_score": 0.16990848793091776}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\n(* Wellformedness of caps, kernel objects, states on the C level\n*)\n\ntheory Wellformed_C\nimports\n \"../../lib/CTranslationNICTA\"\n CLevityCatch\n \"../../spec/cspec/Substitute\"\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nabbreviation\n cte_Ptr :: \"word32 \\ cte_C ptr\" where \"cte_Ptr == Ptr\"\nabbreviation\n mdb_Ptr :: \"word32 \\ mdb_node_C ptr\" where \"mdb_Ptr == Ptr\"\nabbreviation\n cap_Ptr :: \"word32 \\ cap_C ptr\" where \"cap_Ptr == Ptr\"\nabbreviation\n tcb_Ptr :: \"word32 \\ tcb_C ptr\" where \"tcb_Ptr == Ptr\"\nabbreviation\n ep_Ptr :: \"word32 \\ endpoint_C ptr\" where \"ep_Ptr == Ptr\"\nabbreviation\n ntfn_Ptr :: \"word32 \\ notification_C ptr\" where \"ntfn_Ptr == Ptr\"\nabbreviation\n ap_Ptr :: \"word32 \\ asid_pool_C ptr\" where \"ap_Ptr == Ptr\"\nabbreviation\n pte_Ptr :: \"word32 \\ pte_C ptr\" where \"pte_Ptr == Ptr\"\nabbreviation\n pde_Ptr :: \"word32 \\ pde_C ptr\" where \"pde_Ptr == Ptr\"\n\nlemma halt_spec:\n \"Gamma \\ {} Call halt_'proc {}\"\n apply (rule hoare_complete)\n apply (simp add: HoarePartialDef.valid_def)\n done\n\ndefinition\n isUntypedCap_C :: \"cap_CL \\ bool\" where\n \"isUntypedCap_C c \\\n case c of\n Cap_untyped_cap q \\ True\n | _ \\ False\"\n\ndefinition\n isNullCap_C :: \"cap_CL \\ bool\" where\n \"isNullCap_C c \\\n case c of\n Cap_null_cap \\ True\n | _ \\ False\"\n\ndefinition\n isEndpointCap_C :: \"cap_CL \\ bool\" where\n \"isEndpointCap_C v \\ case v of\n Cap_endpoint_cap ec \\ True\n | _ \\ False\"\n\ndefinition\n isCNodeCap_C :: \"cap_CL \\ bool\" where\n \"isCNodeCap_C c \\ case c of\n Cap_cnode_cap a \\ True\n | _ \\ False\"\n\n\ndefinition\n isThreadCap_C :: \"cap_CL \\ bool\" where\n \"isThreadCap_C c \\ case c of\n Cap_thread_cap a \\ True\n | _ \\ False\"\n\ndefinition\n isIRQControlCap_C :: \"cap_CL \\ bool\" where\n \"isIRQControlCap_C c \\ case c of\n Cap_irq_control_cap \\ True\n | _ \\ False\"\n\ndefinition\n isIRQHandlerCap_C :: \"cap_CL \\ bool\" where\n \"isIRQHandlerCap_C c \\ case c of\n Cap_irq_handler_cap a \\ True\n | _ \\ False\"\n\ndefinition\n isNotificationCap_C :: \"cap_CL \\ bool\" where\n \"isNotificationCap_C v \\ case v of\n Cap_notification_cap aec \\ True\n | _ \\ False\"\n\ndefinition\n ep_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\nwhere\n \"ep_at_C' p h \\ Ptr p \\ dom (clift h :: endpoint_C typ_heap)\" -- \"endpoint_lift is total\"\n\ndefinition\n ntfn_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where -- \"notification_lift is total\"\n \"ntfn_at_C' p h \\ Ptr p \\ dom (clift h :: notification_C typ_heap)\"\n\ndefinition\n tcb_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where\n \"tcb_at_C' p h \\ Ptr p \\ dom (clift h :: tcb_C typ_heap)\"\n\ndefinition\n cte_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where\n \"cte_at_C' p h \\ Ptr p \\ dom (clift h :: cte_C typ_heap)\"\n\ndefinition\n ctcb_offset :: word32\n where\n \"ctcb_offset \\ 2 ^ 8\"\n\ndefinition\n ctcb_ptr_to_tcb_ptr :: \"tcb_C ptr \\ word32\"\n where\n \"ctcb_ptr_to_tcb_ptr p \\ ptr_val p - ctcb_offset\"\n\ndefinition\n tcb_ptr_to_ctcb_ptr :: \"word32 \\ tcb_C ptr\"\n where\n \"tcb_ptr_to_ctcb_ptr p \\ Ptr (p + ctcb_offset)\"\n\nprimrec\n tcb_queue_relation :: \"(tcb_C \\ tcb_C ptr) \\ (tcb_C \\ tcb_C ptr) \\\n (tcb_C ptr \\ tcb_C option) \\ word32 list \\\n tcb_C ptr \\ tcb_C ptr \\ bool\"\nwhere\n \"tcb_queue_relation getNext getPrev hp [] qprev qhead = (qhead = NULL)\"\n| \"tcb_queue_relation getNext getPrev hp (x#xs) qprev qhead =\n (qhead = tcb_ptr_to_ctcb_ptr x \\\n (\\tcb. (hp qhead = Some tcb \\ getPrev tcb = qprev \\ tcb_queue_relation getNext getPrev hp xs qhead (getNext tcb))))\"\n\nabbreviation\n \"ep_queue_relation \\ tcb_queue_relation tcbEPNext_C tcbEPPrev_C\"\n\nabbreviation\n \"sched_queue_relation \\ tcb_queue_relation tcbSchedNext_C tcbSchedPrev_C\"\n\n\ndefinition\nwordSizeCase :: \"'a \\ 'a \\ 'a\" where\n\"wordSizeCase a b \\ (if bitSize (undefined::word32) = 32\n then a\n else if bitSize (undefined::word32) = 64\n then b\n else error []\n )\"\n\n\nprimrec\n capBits_C :: \"cap_CL \\ nat\"\nwhere\n \"capBits_C Cap_null_cap = 0\"\n| \"capBits_C (Cap_untyped_cap uc) = unat (capBlockSize_CL uc)\" \n| \"capBits_C (Cap_endpoint_cap ec) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_notification_cap aec) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_cnode_cap cnc) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_thread_cap tc) = 10\"\n| \"capBits_C (Cap_zombie_cap zc) = (wordSizeCase 4 5)\" \n\n\ndefinition\ncapUntypedPtr_C :: \"cap_CL \\ word32\" where\n \"capUntypedPtr_C cap \\ case cap of\n (Cap_untyped_cap uc) \\ (capBlockSize_CL uc)\n | Cap_endpoint_cap ep \\ (capEPPtr_CL ep)\n | Cap_notification_cap ntfn \\ (capNtfnPtr_CL ntfn)\n | Cap_cnode_cap ccap \\ (capCNodePtr_CL ccap)\n | Cap_reply_cap rc \\ (cap_reply_cap_CL.capTCBPtr_CL rc)\n | Cap_thread_cap tc \\ (cap_thread_cap_CL.capTCBPtr_CL tc)\n | Cap_small_frame_cap sfc \\ (cap_small_frame_cap_CL.capFBasePtr_CL sfc)\n | Cap_frame_cap fc \\ (cap_frame_cap_CL.capFBasePtr_CL fc)\n | Cap_page_table_cap ptc \\ (capPTBasePtr_CL ptc)\n | Cap_page_directory_cap pdc \\ (capPDBasePtr_CL pdc)\n | _ \\ error []\"\n\ndefinition ZombieTCB_C_def:\n\"ZombieTCB_C \\ bit 5\"\n\ndefinition\n isZombieTCB_C :: \"word32 \\ bool\" where\n \"isZombieTCB_C v \\ v = ZombieTCB_C\"\n\ndefinition\nvmrights_to_H :: \"word32 \\ vmrights\" where\n\"vmrights_to_H c \\\n if c = scast Kernel_C.VMNoAccess then VMNoAccess\n else if c = scast Kernel_C.VMKernelOnly then VMKernelOnly\n else if c = scast Kernel_C.VMReadOnly then VMReadOnly\n else VMReadWrite\"\n\n(* Force clarity over name collisions *)\nabbreviation\n ARMSmallPage :: \"vmpage_size\" where\n \"ARMSmallPage == ARM.ARMSmallPage\"\nabbreviation\n ARMLargePage :: \"vmpage_size\" where\n \"ARMLargePage == ARM.ARMLargePage\"\nabbreviation\n ARMSection :: \"vmpage_size\" where\n \"ARMSection == ARM.ARMSection\"\nabbreviation\n ARMSuperSection :: \"vmpage_size\" where\n \"ARMSuperSection == ARM.ARMSuperSection\"\n\n-- \"ARMSmallFrame is treated in a separate cap in C,\n so needs special treatment in ccap_relation\"\ndefinition\nframesize_to_H:: \"word32 \\ vmpage_size\" where\n\"framesize_to_H c \\\n if c = scast Kernel_C.ARMLargePage then ARMLargePage\n else if c = scast Kernel_C.ARMSection then ARMSection\n else ARMSuperSection\"\n\n-- \"Use this for results of generic_frame_cap_get_capFSize\"\ndefinition\ngen_framesize_to_H:: \"word32 \\ vmpage_size\" where\n\"gen_framesize_to_H c \\\n if c = scast Kernel_C.ARMSmallPage then ARMSmallPage\n else if c = scast Kernel_C.ARMLargePage then ARMLargePage\n else if c = scast Kernel_C.ARMSection then ARMSection\n else ARMSuperSection\"\n\nend\n\nrecord cte_CL =\n cap_CL :: cap_CL\n cteMDBNode_CL :: mdb_node_CL\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n cte_lift :: \"cte_C \\ cte_CL\"\n where\n \"cte_lift c \\ case cap_lift (cte_C.cap_C c) of\n None \\ None\n | Some cap \\ Some \\ cap_CL = cap,\n cteMDBNode_CL = mdb_node_lift (cteMDBNode_C c) \\\"\n\nlemma to_bool_false [simp]: \"\\ to_bool false\"\n by (simp add: to_bool_def false_def)\n\n(* this is slightly weird, but the bitfield generator\n masks everything with the expected bit length.\n So we do that here too. *)\ndefinition\n to_bool_bf :: \"'a::len word \\ bool\" where\n \"to_bool_bf w \\ (w && mask 1) = 1\"\n\nlemma to_bool_bf_mask1 [simp]:\n \"to_bool_bf (mask (Suc 0))\"\n by (simp add: mask_def to_bool_bf_def)\n\nlemma to_bool_bf_0 [simp]: \"\\to_bool_bf 0\"\n by (simp add: to_bool_bf_def)\n\nlemma to_bool_bf_1 [simp]: \"to_bool_bf 1\"\n by (simp add: to_bool_bf_def mask_def)\n\nlemma to_bool_bf_false [simp]:\n \"\\to_bool_bf false\"\n by (simp add: false_def)\n\nlemma to_bool_bf_true [simp]:\n \"to_bool_bf true\"\n by (simp add: true_def)\n\nlemma to_bool_to_bool_bf:\n \"w = false \\ w = true \\ to_bool_bf w = to_bool w\"\n by (auto simp: false_def true_def to_bool_def to_bool_bf_def mask_def)\n\nlemma to_bool_bf_mask_1 [simp]:\n \"to_bool_bf (w && mask (Suc 0)) = to_bool_bf w\"\n by (simp add: to_bool_bf_def)\n\nlemma to_bool_bf_and [simp]:\n \"to_bool_bf (a && b) = (to_bool_bf a \\ to_bool_bf (b::word32))\"\n apply (clarsimp simp: to_bool_bf_def)\n apply (rule iffI)\n apply (subst (asm) bang_eq)\n apply (simp add: word_size)\n apply (rule conjI)\n apply (rule word_eqI)\n apply (auto simp add: word_size)[1]\n apply (rule word_eqI)\n apply (auto simp add: word_size)[1]\n apply clarsimp\n apply (rule word_eqI)\n apply (subst (asm) bang_eq)+\n apply (auto simp add: word_size)[1]\n done\n\nlemma to_bool_bf_to_bool_mask:\n \"w && mask (Suc 0) = w \\ to_bool_bf w = to_bool (w::word32)\"\n apply (auto simp add: to_bool_bf_def to_bool_def mask_eq_iff_w2p word_size)\n apply (auto simp add: mask_def dest: word_less_cases)\n done\n\ndefinition\n mdb_node_to_H :: \"mdb_node_CL \\ mdbnode\"\n where\n \"mdb_node_to_H n \\ MDB (mdbNext_CL n)\n (mdbPrev_CL n)\n (to_bool (mdbRevocable_CL n))\n (to_bool (mdbFirstBadged_CL n))\"\n\n\ndefinition\ncap_to_H :: \"cap_CL \\ capability\"\nwhere\n\"cap_to_H c \\ case c of\n Cap_null_cap \\ NullCap\n | Cap_zombie_cap zc \\ (if isZombieTCB_C(capZombieType_CL zc)\n then\n (Zombie ((capZombieID_CL zc) && ~~(mask(5)))\n (ZombieTCB)\n (unat ((capZombieID_CL zc) && mask(5))))\n else let radix = unat (capZombieType_CL zc) in\n (Zombie ((capZombieID_CL zc) && ~~(mask (radix+1)))\n (ZombieCNode radix)\n (unat ((capZombieID_CL zc) && mask(radix+1)))))\n | Cap_cnode_cap ccap \\\n CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap))\n (capCNodeGuard_CL ccap)\n (unat (capCNodeGuardSize_CL ccap))\n | Cap_untyped_cap uc \\ UntypedCap (to_bool(capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4))\n | Cap_endpoint_cap ec \\\n EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool(capCanSend_CL ec)) (to_bool(capCanReceive_CL ec))\n (to_bool(capCanGrant_CL ec))\n | Cap_notification_cap ntfn \\\n NotificationCap (capNtfnPtr_CL ntfn)(capNtfnBadge_CL ntfn)(to_bool(capNtfnCanSend_CL ntfn))\n (to_bool(capNtfnCanReceive_CL ntfn))\n | Cap_reply_cap rc \\ ReplyCap (ctcb_ptr_to_tcb_ptr (Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc))\n | Cap_thread_cap tc \\ ThreadCap(ctcb_ptr_to_tcb_ptr (Ptr (cap_thread_cap_CL.capTCBPtr_CL tc)))\n | Cap_irq_handler_cap ihc \\ IRQHandlerCap (ucast(capIRQ_CL ihc))\n | Cap_irq_control_cap \\ IRQControlCap\n | Cap_asid_control_cap \\ ArchObjectCap ASIDControlCap\n | Cap_asid_pool_cap apc \\ ArchObjectCap (ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc))\n | Cap_small_frame_cap sfc \\ ArchObjectCap (PageCap (to_bool(cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc)\n (vmrights_to_H(cap_small_frame_cap_CL.capFVMRights_CL sfc)) (ARMSmallPage)\n (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0\n \\ cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0\n then None else\n Some( (((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc)< ArchObjectCap (PageCap (to_bool(capFIsDevice_CL fc)) (capFBasePtr_CL fc)\n (vmrights_to_H(capFVMRights_CL fc)) (framesize_to_H(capFSize_CL fc))\n (if capFMappedASIDHigh_CL fc = 0\n \\ capFMappedASIDLow_CL fc = 0\n then None else\n Some( (((capFMappedASIDHigh_CL fc)< ArchObjectCap (PageTableCap (capPTBasePtr_CL ptc)\n (if to_bool (capPTIsMapped_CL ptc)\n then Some( ((capPTMappedASID_CL ptc)),(capPTMappedAddress_CL ptc))\n else None))\n | Cap_page_directory_cap pdf \\ ArchObjectCap (PageDirectoryCap (capPDBasePtr_CL pdf)\n (if to_bool (capPDIsMapped_CL pdf)\n then Some (capPDMappedASID_CL pdf)\n else None))\n | Cap_domain_cap \\ DomainCap\"\n\nlemmas cap_to_H_simps = cap_to_H_def[split_simps cap_CL.split]\n\ndefinition\n cte_to_H :: \"cte_CL \\ cte\"\n where\n \"cte_to_H cte \\ CTE (cap_to_H (cap_CL cte)) (mdb_node_to_H (cteMDBNode_CL cte))\"\n\n\n\ndefinition\ncl_valid_cap :: \"cap_CL \\ bool\"\nwhere\n\"cl_valid_cap c \\\n case c of\n Cap_frame_cap fc \\ ((capFSize_CL fc) \\ scast Kernel_C.ARMSmallPage)\n | Cap_irq_handler_cap fc \\ ((capIRQ_CL fc) && mask 10 = capIRQ_CL fc)\n | x \\ True\"\n\ndefinition\nc_valid_cap :: \"cap_C \\ bool\"\nwhere\n\"c_valid_cap c \\ case_option True cl_valid_cap (cap_lift c)\"\n\n\ndefinition\ncl_valid_cte :: \"cte_CL \\ bool\"\nwhere\n\"cl_valid_cte c \\ cl_valid_cap (cap_CL c)\"\n\n\ndefinition\nc_valid_cte :: \"cte_C \\ bool\"\nwhere\n\"c_valid_cte c \\ c_valid_cap (cte_C.cap_C c)\"\n\nlemma c_valid_cap_simps [simp]:\n \"cap_get_tag c = scast cap_small_frame_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_thread_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_notification_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_endpoint_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_cnode_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_page_directory_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_asid_control_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_irq_control_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_page_table_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_asid_pool_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_untyped_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_zombie_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_reply_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_null_cap \\ c_valid_cap c\"\n unfolding c_valid_cap_def cap_lift_def cap_tag_defs\n by (simp add: cl_valid_cap_def)+\n\nlemma ptr_val_tcb_ptr_mask2:\n \"is_aligned thread 9\n \\ ptr_val (tcb_ptr_to_ctcb_ptr thread) && (~~ mask 9)\n = thread\"\n apply (clarsimp simp: tcb_ptr_to_ctcb_ptr_def projectKOs)\n apply (simp add: is_aligned_add_helper ctcb_offset_def objBits_simps)\n done\n\nlemma maxDom_to_H:\n \"ucast maxDom = maxDomain\"\n by (simp add: maxDomain_def maxDom_def numDomains_def)\n\nlemma maxPrio_to_H:\n \"ucast seL4_MaxPrio = maxPriority\"\n by (simp add: maxPriority_def seL4_MaxPrio_def numPriorities_def)\n\nabbreviation(input)\n NotificationObject :: sword32\nwhere\n \"NotificationObject == seL4_NotificationObject\"\n\nabbreviation(input)\n CapTableObject :: sword32\nwhere\n \"CapTableObject == seL4_CapTableObject\"\n\nabbreviation(input)\n EndpointObject :: sword32\nwhere\n \"EndpointObject == seL4_EndpointObject\"\n\nabbreviation(input)\n LargePageObject :: sword32\nwhere\n \"LargePageObject == seL4_ARM_LargePageObject\"\n\nabbreviation(input)\n PageDirectoryObject :: sword32\nwhere\n \"PageDirectoryObject == seL4_ARM_PageDirectoryObject\"\n\nabbreviation(input)\n PageTableObject :: sword32\nwhere\n \"PageTableObject == seL4_ARM_PageTableObject\"\n\nabbreviation(input)\n SectionObject :: sword32\nwhere\n \"SectionObject == seL4_ARM_SectionObject\"\n\nabbreviation(input)\n SmallPageObject :: sword32\nwhere\n \"SmallPageObject == seL4_ARM_SmallPageObject\"\n\nabbreviation(input)\n SuperSectionObject :: sword32\nwhere\n \"SuperSectionObject == seL4_ARM_SuperSectionObject\"\n\nabbreviation(input)\n TCBObject :: sword32\nwhere\n \"TCBObject == seL4_TCBObject\"\n\nabbreviation(input)\n UntypedObject :: sword32\nwhere\n \"UntypedObject == seL4_UntypedObject\"\n\nabbreviation(input)\n maxPrio :: sword32\nwhere\n \"maxPrio == seL4_MaxPrio\"\n\nabbreviation(input)\n minPrio :: sword32\nwhere\n \"minPrio == seL4_MinPrio\"\n\nabbreviation(input)\n nAPIObjects :: sword32\nwhere\n \"nAPIObjects == seL4_NonArchObjectTypeCount\"\n\nabbreviation(input)\n nObjects :: sword32\nwhere\n \"nObjects == seL4_ObjectTypeCount\"\n\nabbreviation(input)\n prioInvalid :: sword32\nwhere\n \"prioInvalid == seL4_InvalidPrio\"\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/crefine/Wellformed_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.3106943895971202, "lm_q1q2_score": 0.16986847640031713}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__20_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__20_on_rules imports n_g2kAbsAfter_lemma_on_inv__20\nbegin\nsection{*All lemmas on causal relation between inv__20*}\nlemma lemma_inv__20_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__20 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__20) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__20) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__20_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.31742627204485063, "lm_q1q2_score": 0.1698542993760029}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__21_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__21_on_rules imports n_germanSymIndex_lemma_on_inv__21\nbegin\nsection{*All lemmas on causal relation between inv__21*}\nlemma lemma_inv__21_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__21 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__21) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__21) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__21_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.3174262655876759, "lm_q1q2_score": 0.1698542912140665}} {"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory OstoreInvS\nimports\n \"BilbyFsConsts.BilbyFs_Shallow_Desugar_Tuples\"\n \"BilbyFsConsts.BilbyFs_ShallowConsts_Desugar_Tuples\"\n \"../spec/OstoreS\"\n \"../spec/SerialS\"\n \"../spec/UbiS\"\n \"../adt/BufferT\"\n \"../adt/RbtT\"\n \"HOL-Library.Sublist\"\nbegin\n\ndefinition\n \\_index :: \"IndexState\\<^sub>T \\ (ObjId \\ ObjAddr\\<^sub>T)\"\nwhere\n \"\\_index index_st \\ \\rbt (addrs\\<^sub>f index_st)\"\n\nconsts \\_fsm_gim :: \"(ObjId, GimNode\\<^sub>T) Rbt \\ (ObjId \\ GimNode\\<^sub>T)\"\n\ndefinition\n nopad :: \"U8 list \\ U8 list\"\nwhere\n \"nopad xs \\\n dropWhile ((=) bilbyFsPadByte) xs\"\n\nlemma pTrans_termination[simp]:\n \"is_valid_ObjHeader obj (d # data) \\\n Suc (length data) - unat (Obj.len\\<^sub>f obj) < Suc (length data)\"\n \"is_valid_ObjHeader obj data \\\n (length data) - unat (Obj.len\\<^sub>f obj) < (length data)\"\n unfolding bilbyFsObjHeaderSize_def\n by (drule is_valid_ObjHeader_len_facts,\n clarsimp simp add: bilbyFsObjHeaderSize_def, unat_arith)+\n\ntype_synonym Trans = \"Obj\\<^sub>T list\"\nfun\n pTrans :: \"U8 list \\ (U8 list \\ Trans)\"\nwhere\n \"pTrans [] = ([],[])\"\n|pTrans_Cons: \"pTrans data =\n (let obj = pObj data 0\n \\ \\ We stop at the first obviously invalid object. \\\n in if \\is_valid_ObjHeader obj data then\n (drop (max (unat bilbyFsObjHeaderSize) (unat (Obj.len\\<^sub>f obj))) data, [])\n else if Obj.trans\\<^sub>f obj = bilbyFsTransIn then\n (\\(d,os). (d, (obj#os))) (pTrans (drop (unat (Obj.len\\<^sub>f obj)) data))\n else\n (drop (unat (Obj.len\\<^sub>f obj)) data, [obj])\n)\"\n\nlemma drop_0_eq[simp]:\n \"\\n. xs = drop n xs\"\n by (rule_tac x=0 in exI, simp)\n\nlemma pTrans_data_is_substring:\n \"(\\n. prod.fst (pTrans data) = drop n data)\"\n by (induct data rule: pTrans.induct) (fastforce simp: Let_def prod.case_eq_if)+\n\nlemma pTrans_length_helper:\nassumes len: \"is_valid_ObjHeader (pObj (d # data) 0) (d # data)\"\nshows\n \"length (prod.fst (pTrans (drop (unat (Obj.len\\<^sub>f (pObj (d # data) 0))) (d # data)))) < length (d # data)\"\n using pTrans_data_is_substring apply clarsimp\n apply (drule_tac x=\"(drop (unat (Obj.len\\<^sub>f (pObj (d # data) 0))) (d # data))\" in meta_spec)\n using is_valid_ObjHeader_len[OF len] apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n apply unat_arith\n done\n\ntext {*\nThe termination proof above does not look at the shape of the returned\nvalues of pTrans, it only shows that the size of the input\ndata list decreases.\nTo prove termination of \\_updates_fun we need to know that the returned data\nlist is smaller than the one received as argument.\nI could not figure a way to reuse the termination proof above to show\nthat \\_updates_fun terminates. I wouldn't be surprise to see that there's\na simpler way to achieve my goal. If you find one, please educate me.\n*}\nlemma pTrans_termination_argument:\n \"(nd#nds, o'#os) = pTrans (d#data) \\ length (nd#nds) < length (d#data)\"\n apply (clarsimp simp del: list.size split: if_splits\n simp : bilbyFsObjHeaderSize_def Let_def prod.case_eq_if)\n apply (fastforce dest: pTrans_length_helper simp: prod.case_eq_if)\n done\n\ndefinition\n is_valid_addr :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ ObjAddr\\<^sub>T \\ bool\"\nwhere\n \"is_valid_addr mount_st ostore_st addr \\\n ebnum\\<^sub>f addr < nb_eb\\<^sub>f (super\\<^sub>f mount_st) \\\n bilbyFsFirstLogEbNum \\ ebnum\\<^sub>f addr \\\n bilbyFsMinObjSize \\ ObjAddr.len\\<^sub>f addr \\\n offs\\<^sub>f addr < offs\\<^sub>f addr + ObjAddr.len\\<^sub>f addr \\\n offs\\<^sub>f addr + ObjAddr.len\\<^sub>f addr \\ eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n (ebnum\\<^sub>f addr = wbuf_eb\\<^sub>f ostore_st \\\n (offs\\<^sub>f addr + ObjAddr.len\\<^sub>f addr \\ used\\<^sub>f ostore_st))\"\n\n\ntext {* It turns out that transactions can be separated by few bilbyFsPadByte bytes. \nThis happens when there isn't enough room for a padding object to fill up a\nhardware page. Thus there cannot be such padding area at an offset corresponding\nto the beginning of a page.\n*}\nfunction\n list_trans :: \"U8 list \\ (U8 list \\ Trans list)\"\nwhere\n\"list_trans data = \n (case pTrans data of\n (_, []) \\ (data, []) \\ \\ We return the beginning of an invalid transaction as it's obviously non-empty \\\n | ([],objs) \\ ([], [objs])\n | (newdata, objs) \\\n \\ \\ let objs = if length objs = 1 \\\n otype<^sub>f (objs!0) = bilbyFsObjTypePad then [] else objs\n in \\ (\\(d,txs). (d,objs#txs)) (list_trans (nopad newdata)))\"\n by pat_completeness auto\n termination\n apply (relation \"measure length\")\n apply (clarsimp simp del: pTrans.simps split:prod.splits)\n apply (case_tac \"data\")\n apply clarsimp\n apply (fastforce dest:pTrans_termination_argument\n simp: nopad_def dropWhile_eq_drop)\n done\n\ndefinition\n list_trans_no_pad :: \"U8 list \\ (U8 list \\ Trans list)\"\nwhere\n \"list_trans_no_pad data \\\n (case list_trans data of\n (rem, txs) \\\n (rem, filter (\\tx. \\ (length tx = 1 \\ otype\\<^sub>f (tx!0) = bilbyFsObjTypePad)) txs))\"\n\nlemma list_trans_no_pad_Cons[simp]:\n \"list_trans_no_pad (x#xs) =\n (prod.fst (list_trans (x # xs)), \n [tx\\prod.snd (list_trans (x # xs)). \\ (length tx = 1 \\ otype\\<^sub>f (tx!0) = bilbyFsObjTypePad)])\"\n by (simp add: list_trans_no_pad_def prod.case_eq_if del: list_trans.simps)\n\nlemma list_trans_no_pad_Nil[simp]:\n \"list_trans_no_pad [] = ([], [])\"\n by (simp add: list_trans_no_pad_def)\n\n\ntype_synonym EbLog = \"Trans list\"\n\ndefinition\n list_eb_log :: \"ubi_leb list \\ EbLog list\"\nwhere\n \"list_eb_log wubi \\\n map (prod.snd o list_trans_no_pad) (drop (unat bilbyFsFirstLogEbNum) wubi)\"\n\ndefinition\n prune_ostore :: \"Obj\\<^sub>T \\ ostore_map \\ ostore_map\"\nwhere\n \"prune_ostore del omap \\\n (\\oid. case omap oid of\n option.Some obj \\\n if obj_is_deleted_by obj del then\n option.None\n else\n option.Some obj\n | option.None \\ option.None)\"\n\ndefinition\n trans_order :: \"Obj\\<^sub>T list \\ U64\"\nwhere\n \"trans_order objs \\ Obj.sqnum\\<^sub>f ((sort_key Obj.sqnum\\<^sub>f objs)!0)\"\n \ndefinition\n abstract_mount_\\_ostore :: \"ubi_leb list \\ ostore_map\"\nwhere\n \"abstract_mount_\\_ostore wubi \\\n let alltrans = (concat $ list_eb_log wubi);\n alltrans' = sort_key trans_order alltrans \n in fold id (map ostore_update alltrans') Map.empty\"\n \ntext {* @{term mount_\\_ostore} returns the logical representation of the object\nstore curently stored (synchronised) on medium. *}\ndefinition\n mount_\\_ostore :: \"ubi_leb list \\ ostore_map\"\nwhere\n \"mount_\\_ostore wubi \\ \n let lel = list_eb_log wubi ;\n delobjs = concat $ concat $ map (map (filter obj_is_del)) lel;\n delfree_lel = map (map (filter (Not o obj_is_del))) lel;\n ostore_map = fold id (map (\\ltx. fold id (map ostore_update ltx)) delfree_lel) Map.empty\n in fold prune_ostore delobjs ostore_map\"\n\ndefinition\n ostore_get_obj :: \"OstoreState\\<^sub>T \\ ObjAddr\\<^sub>T \\ Obj\\<^sub>T\"\nwhere\n \"ostore_get_obj ostore_st addr \\\n let buf = (if ebnum\\<^sub>f addr = wbuf_eb\\<^sub>f ostore_st then\n (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st)\n else\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)!(unat $ ebnum\\<^sub>f addr))\n in pObj (take (unat (ObjAddr.offs\\<^sub>f addr) + unat (ObjAddr.len\\<^sub>f addr)) buf) (offs\\<^sub>f addr)\"\n\ndefinition\n \\_ostore_medium :: \"OstoreState\\<^sub>T \\ ostore_map\"\nwhere\n \"\\_ostore_medium ostore_st \\ abstract_mount_\\_ostore (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))\"\n \ntext {* \\_updates: returns updates not synchronised to medium yet *}\ndefinition\n \\_updates :: \"OstoreState\\<^sub>T \\ (ostore_map \\ ostore_map) list\"\nwhere\n \"\\_updates ostore_st \\\n (map ostore_update $ prod.snd $ list_trans_no_pad \n (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n\ntext {* \\_ostore_uptodate: returns the logical view of the object store when all\n updates are applied.\n*}\n\ndefinition\n \\_ostore_uptodate :: \"OstoreState\\<^sub>T \\ ostore_map\"\nwhere\n \"\\_ostore_uptodate ostore_st \\\n fold id (\\_updates ostore_st) (\\_ostore_medium ostore_st)\"\n\ndefinition\n \\_ostore_runtime :: \"OstoreState\\<^sub>T \\ ostore_map\"\nwhere\n \"\\_ostore_runtime ostore_st oid \\\n (case (\\_index $ index_st\\<^sub>f ostore_st) oid of\n option.None \\ option.None\n | option.Some addr \\\n option.Some $ ostore_get_obj ostore_st addr)\"\n\ndefinition\n is_valid_ObjIn :: \"Obj\\<^sub>T \\ U8 list \\ bool\"\nwhere\n \"is_valid_ObjIn obj buf \\\n is_valid_ObjHeader obj buf \\ Obj.trans\\<^sub>f (pObj buf 0) = bilbyFsTransIn\"\n\ndefinition\n is_valid_ObjCommit :: \"Obj\\<^sub>T \\ U8 list \\ bool\"\nwhere\n \"is_valid_ObjCommit obj buf \\\n is_valid_ObjHeader obj buf \\ Obj.trans\\<^sub>f (pObj buf 0) = bilbyFsTransCommit\"\n\nlemma bilbyFsTrans_diff[simp]:\n \"bilbyFsTransIn \\ bilbyFsTransCommit\"\n \"bilbyFsTransCommit \\ bilbyFsTransIn\"\n unfolding bilbyFsTransIn_def bilbyFsTransCommit_def\n by simp+\n\nlemmas is_valid_ObjTrans = is_valid_ObjIn_def is_valid_ObjCommit_def\n\nlemma drop_n_ge_0:\n \"0 drop n (v # va) = drop (n - 1) va\"\n by (case_tac n, simp+)\n\nlemma is_valid_ObjHeader_drop_non_zero: \n \"is_valid_ObjHeader (pObj (v # va) 0) (v # va) \\\n drop (unat (Obj.len\\<^sub>f (pObj (v # va) 0))) (v # va) = drop (unat (Obj.len\\<^sub>f (pObj (v # va) 0)) - 1) (va)\n \"\n apply (frule is_valid_ObjHeader_len_facts)\n apply (clarsimp simp: bilbyFsObjHeaderSize_def unat_arith_simps)\n apply (simp add: drop_n_ge_0)\n done\n\n\n\nfun\n valid_trans :: \"U8 list \\ bool\"\nwhere\n\"valid_trans [] = False\"\n|valid_trans_Cons: \"valid_trans buf =\n (if is_valid_ObjIn (pObj buf 0) buf then\n valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj buf 0) buf)\n else is_valid_ObjCommit (pObj buf 0) buf)\"\n\ndeclare valid_trans.simps[simp del]\n\nlemma valid_trans_simps[simp]:\n \"valid_trans [] = False\"\n \"is_valid_ObjIn (pObj xs 0) xs \\\n valid_trans xs = valid_trans (drop (unat $ Obj.len\\<^sub>f $ pObj xs 0) xs)\"\n \"is_valid_ObjCommit (pObj xs 0) xs \\\n valid_trans xs = True\"\n apply (simp add: valid_trans.simps)\n apply (case_tac xs, (clarsimp simp: is_valid_ObjHeader_len_facts valid_trans.simps is_valid_ObjTrans is_valid_ObjHeader_def bilbyFsObjHeaderSize_def )+)\n apply (case_tac xs, simp)\n apply (frule is_len_and_type_ok_hdr_szD)\n apply (simp add: bilbyFsObjHeaderSize_def, unat_arith)\n apply (simp add: valid_trans.simps is_valid_ObjTrans is_valid_ObjHeader_def)\n done \n\nlemma is_valid_Obj_diff:\n \"is_valid_ObjCommit (pObj buf n) buf \\ \\is_valid_ObjIn (pObj buf n) buf\"\n \"is_valid_ObjIn (pObj buf n) buf \\ \\is_valid_ObjCommit (pObj buf n) buf\"\n by (simp add: is_valid_ObjTrans)+\n\nlemma Nil_not_valid_Obj[simp]:\n \"is_valid_ObjHeader (pObj [] n) [] = False\"\n \"is_valid_ObjIn (pObj [] n) [] = False\"\n \"is_valid_ObjCommit (pObj [] n) [] = False\"\n by (clarsimp simp add: is_valid_ObjTrans,\n frule is_valid_ObjHeader_len_facts,\n simp add: bilbyFsObjHeaderSize_def)+\n\nfun\n trans_len :: \"U8 list \\ nat\"\nwhere\ntrans_len_Nil: \"trans_len [] = max (unat bilbyFsObjHeaderSize) (unat $ Obj.len\\<^sub>f $ pObj [] 0)\"\n|trans_len_Cons: \"trans_len buf =\n (if \\is_valid_ObjHeader (pObj buf 0) buf then\n max (unat bilbyFsObjHeaderSize) (unat $ Obj.len\\<^sub>f $ pObj buf 0)\n else if is_valid_ObjIn (pObj buf 0) buf then\n (unat $ Obj.len\\<^sub>f $ pObj buf 0) + trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj buf 0) buf)\n else\n unat $ Obj.len\\<^sub>f $ pObj buf 0)\"\n\ndeclare trans_len.simps [simp del]\nlemma trans_len_simps[simp]:\n \"trans_len [] = max (unat bilbyFsObjHeaderSize) (unat $ Obj.len\\<^sub>f $ pObj [] 0)\"\n \"is_valid_ObjIn (pObj xs 0) xs \\\n trans_len xs = (unat $ Obj.len\\<^sub>f $ pObj xs 0) + trans_len (drop (unat $ Obj.len\\<^sub>f $ pObj xs 0) xs)\"\n \"is_valid_ObjCommit (pObj xs 0) xs \\\n trans_len xs = unat (Obj.len\\<^sub>f $ pObj xs 0)\"\n apply (case_tac xs, (clarsimp simp: is_valid_ObjTrans is_valid_ObjHeader_def bilbyFsObjHeaderSize_def trans_len.simps)+)\n apply (case_tac xs, (clarsimp simp: is_valid_ObjTrans is_valid_ObjHeader_def bilbyFsObjHeaderSize_def trans_len.simps)+)\n apply (case_tac xs, (clarsimp simp: is_valid_ObjTrans, frule is_len_and_type_ok_hdr_szD, simp add: bilbyFsObjHeaderSize_def, unat_arith))\n apply (clarsimp simp: is_valid_ObjTrans, frule is_len_and_type_ok_hdr_szD,\n clarsimp simp add: bilbyFsObjHeaderSize_def trans_len.simps is_valid_ObjTrans, unat_arith)\n done\n\nlemma trans_len_min_header[simp]:\n \"unat bilbyFsObjHeaderSize - 1 < trans_len xs\"\n apply (rule_tac x=xs in trans_len.cases)\n apply (fastforce simp: bilbyFsObjHeaderSize_def)\n apply (simp only: trans_len_Cons)\n apply (case_tac \"is_valid_ObjIn (pObj (v # va) 0) (v # va)\")\n apply (clarsimp simp: is_valid_Obj_diff is_valid_ObjTrans)\n apply (drule is_valid_ObjHeader_len, simp add: bilbyFsObjHeaderSize_def, unat_arith)\n apply (clarsimp simp: is_valid_ObjTrans)\n apply (auto dest!: is_valid_ObjHeader_len[simplified bilbyFsObjHeaderSize_def], (simp add: bilbyFsObjHeaderSize_def | unat_arith)+)\n done\n\nlemma hdr_sz_le_trans_len:\n \"unat bilbyFsObjHeaderSize \\ trans_len xs\"\n using trans_len_min_header[where xs=xs] by simp\n\nlemma trans_len_non_zero:\n \"0 < trans_len xs\"\n using trans_len_min_header\n by (drule_tac x=xs in meta_spec) fastforce\n\nlemma take_non0:\n \"xs \\ [] \\ 0 < n \\\n take n xs = hd xs#(take (n- 1) (tl xs))\"\nby (case_tac n, auto simp: take_Suc)\n\nlemma prefix_length_le_Cons:\n \"prefix xs (y#ys) \\ length xs \\ Suc (length ys)\"\n using prefix_length_le by fastforce\n\nfunction\n valid_list_trans :: \"U8 list \\ bool\"\nwhere\n\"valid_list_trans [] = False\"\n|\"valid_list_trans (b#buf) =\n (valid_trans (b#buf) \\\n (if nopad (drop (trans_len (b#buf)) (b#buf)) = [] then True\n else valid_list_trans (nopad (drop (trans_len (b#buf)) (b#buf)))))\"\n\nby pat_completeness simp+\ntermination\n apply (relation \"measure (Suc o length)\")\n apply simp\n apply (simp add: dropWhile_eq_drop nopad_def)\n apply (cut_tac xs=\"b # buf\" in trans_len_non_zero)\n apply unat_arith\n done\n\ndefinition\n valid_list_trans_no_pad :: \"U8 list \\ bool\"\nwhere\n \"valid_list_trans_no_pad buf \\\n valid_list_trans buf \\ prod.snd (list_trans_no_pad buf) \\ []\"\n\nlemma valid_list_trans_to_valid_trans:\n \"valid_list_trans buf \\ valid_trans buf\"\nby (erule valid_list_trans.elims, simp)\n\ntext {* \\_summary_updates: returns all the updates included in the summary.\nThis includes the updates already synchronised to medium i.e. wbuf[0:used] and\nupdates only applied in memory i.e. wbuf[used:sync_offs]. (Where wbuf[x:y] is the\nslice of the WordArray U8 maching the medium contents for the erase-block in\nquestion.)\n*}\ndefinition\n \\_summary_updates :: \"OstoreState\\<^sub>T \\ (ostore_map \\ ostore_map) list\"\nwhere\n \"\\_summary_updates ostore_st \\ \n let offs = unat $ (used\\<^sub>f ostore_st);\n buf = take offs (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st)\n in (map ostore_update $ prod.snd $ list_trans_no_pad buf)\"\n\ntext {* inv_\\_step_updates: asserts inv is true no matter how many updates we apply. *}\ndefinition\n inv_\\_step_updates :: \"OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_\\_step_updates ostore_st \\\n (let updates = \\_updates ostore_st\n in \\n\\length updates.\n inv_\\_ostore (apply_n_updates n (\\_ostore_medium ostore_st) updates))\"\n\ndefinition\n sum_from_wbuf :: \"Buffer\\<^sub>T \\ Obj\\<^sub>T\"\nwhere\n \"sum_from_wbuf buf \\ \n let data = \\wa $ data\\<^sub>f buf ;\n offs = ple32 data (buf_length buf - 4)\n in pObj data offs\"\n\ntext {*\n summary_map: builds a ostore_map from a summary.\n The resulting map should be the same as applying all updates returned by \\_summary_updates to an empty\n map. (see inv_sum_consistent)\n*}\n\ndefinition\n summary_map :: \"ObjSummary\\<^sub>T \\ OstoreState\\<^sub>T \\ ostore_map\"\nwhere\n \"summary_map summary ostore_st \\\n let nb_entry = unat $ nb_sum_entry\\<^sub>f summary;\n entries = take nb_entry $ \\wa $ entries\\<^sub>f summary;\n nodel = filter (Not o obj_sum_entry_is_del) entries;\n maps = map (\\entry. Map.empty(ObjSumEntry.id\\<^sub>f entry \\ pObj (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st) (obj_sum_entry_offs entry))) nodel;\n omap = fold (++) maps Map.empty;\n dels = filter (obj_sum_entry_is_del) entries\n in fold (\\entry gos.\n (\\oid. if oid_is_deleted_by oid (ObjSumEntry.id\\<^sub>f entry) then\n option.None\n else gos oid)) dels omap\"\n\ndefinition\n inv_sum_consistent :: \"Obj\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_sum_consistent sumobj ostore_st \\\n True\n \\ \\ ignore summary consistency for now:\n otype<^sub>f sumobj = bilbyFsObjTypeSum \\\n let sum = obj_osummary sumobj\n in summary_map sum ostore_st = fold id (\\_summary_updates ostore_st) Map.empty \\\"\n\ndefinition\n room_for_summary :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"room_for_summary mount_st ostore_st \\\n (\\no_summary\\<^sub>f mount_st \\ used\\<^sub>f ostore_st \\ (eb_size\\<^sub>f $ super\\<^sub>f mount_st)) \\\n (unat (eb_size\\<^sub>f $ super\\<^sub>f mount_st) - unat (used\\<^sub>f ostore_st) \\ unat (serialise_size_summary_Obj (summary\\<^sub>f ostore_st)))\n \"\n\ntext {* \nUnless \"used\" equals \"eb_size\", there must be enough room for the summary\nto be serialised. If \"used\" is equal to \"eb_size\", the summary's been\nserialised already and can be read from the buffer.\n\nnb_sum_entry constrain says that the maximum number of objects in\nan erase-block has to be less than the number of min-size object that fit\nin that buffer (this is an over-approximation because at least one of these\nobjects must be a summary).\n*}\ndefinition\n inv_ostore_summary :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_ostore_summary mount_st ostore_st \\\n True\n \"\n(* No summary invariant for now.\n let eb_size = eb_size\\<^sub>f (super\\<^sub>f mount_st)\n in nb_sum_entry\\<^sub>f (summary\\<^sub>f ostore_st) < (eb_size div bilbyFsMinObjSize) \\\n room_for_summary mount_st ostore_st \\\n (if used\\<^sub>f ostore_st = eb_size then\n inv_sum_consistent (sum_from_wbuf (wbuf\\<^sub>f ostore_st)) ostore_st\n else\n used\\<^sub>f ostore_st < used\\<^sub>f ostore_st + os_sum_sz ostore_st \\ \n used\\<^sub>f ostore_st + os_sum_sz ostore_st \\ eb_size \\\n inv_sum_consistent ((sum_obj\\<^sub>f ostore_st)\\ ounion\\<^sub>f:= TObjSummary (summary\\<^sub>f ostore_st) \\) ostore_st)\n*)\n\ntext {*\n inv_ostore_obj_meta: is the invariant of object meta data in\n relation to the object store state.\n*}\ndefinition\n inv_mem_ostore_obj :: \"OstoreState\\<^sub>T \\ Obj\\<^sub>T \\ bool\"\nwhere\n \"inv_mem_ostore_obj ostore_st obj \\\n Obj.sqnum\\<^sub>f obj < OstoreState.next_sqnum\\<^sub>f ostore_st \\\n ucast (otype\\<^sub>f obj) = bilbyFsObjInode \\\n (inum_from_obj_id $ get_obj_oid obj) < OstoreState.next_inum\\<^sub>f ostore_st\"\n\n\ntext {* @{term pollute_buf} ensures that the buffer does not contain a valid transaction\nat offset @{term offs}. It does not matter what the value is as long as it's not\na valid transaction or padding, mount will stop at this offset.\nNote that we could allow invalid to be prefixed by padding bytes but it's this is Ok for now.\nWe don't use pollute_buf at the moment because we do not care about crash-tolerance.\n*}\ndefinition\n pollute_buf :: \"nat \\ U8 list \\ U8 list\"\nwhere\n \"pollute_buf offs xs = xs[offs:=0xff]\"\n\ntext {* list_eb_log_wbuf: returns the logical view of the log on-flash with the current\nstate of the buffer wbuf instead of the content of the corresponding erase-block.\n*}\ndefinition\n list_eb_log_wbuf :: \"OstoreState\\<^sub>T \\ EbLog list\"\nwhere\n \"list_eb_log_wbuf ostore_st \\\n let eblogs = list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st));\n wbuflog = prod.snd (list_trans_no_pad (\\ \\ pollute_buf \\ buf_slice (wbuf\\<^sub>f ostore_st) 0 (used\\<^sub>f ostore_st)))\n in eblogs[unat (wbuf_eb\\<^sub>f ostore_st) - unat bilbyFsFirstLogEbNum:=wbuflog]\"\n\ntext {* Attempt at on-flash invariant.\n\nIt's composed of 3 level of invariant, the top-level being the on that talks\nabout the entire log and relation between objects: inv_flash\nThe next level talks about individual erase-blocks: inv_eb_log\nErase-blocks log are made of multiple transactions: inv_trans\nTransactions are made of objects: inv_obj\n\n*}\n \ndefinition\n ostore_log_objects :: \"EbLog list \\ Obj\\<^sub>T list\"\nwhere\n \"ostore_log_objects \\ concat o concat \"\n\ndefinition\n inv_trans :: \"Obj\\<^sub>T list \\ bool\"\nwhere\n \"inv_trans olist \\ (\\obj\\set olist. \\obj_is_del obj \\ inv_read_obj obj)\"\n\ndefinition\n inv_eb_log :: \"EbLog \\ Obj\\<^sub>T set \\ bool\"\nwhere\n \"inv_eb_log tlist allobjs \\\n (let sumtrans = tlist!(length tlist - 1);\n sumobj = hd sumtrans ;\n sum = obj_osummary sumobj\n in length sumtrans = 1 \\ otype\\<^sub>f sumobj = bilbyFsObjTypeSum \\\n (\\entry\\(set $ \\wa $ ObjSummary.entries\\<^sub>f sum).\n let objs = set $ concat $ tlist\n in \\obj. Obj.offs\\<^sub>f obj = obj_sum_entry_offs entry \\\n get_obj_oid obj = ObjSumEntry.id\\<^sub>f entry \\\n (obj_sum_entry_is_del entry \\\n (otype\\<^sub>f obj = bilbyFsObjTypeDel \\\n card {x. x \\ allobjs \\\n oid_is_deleted_by (get_obj_oid x) (ObjSumEntry.id\\<^sub>f entry) \\\n Obj.sqnum\\<^sub>f obj < ObjSumEntry.sqnum\\<^sub>f entry\n } = unat (ObjSumEntry.count\\<^sub>f entry))) \\\n Obj.len\\<^sub>f obj = ObjSumEntry.len\\<^sub>f entry) \\\n (\\trans \\ set(butlast tlist). inv_trans trans))\"\n\ndefinition\n obj_is_alive :: \"Obj\\<^sub>T \\ Obj\\<^sub>T set \\ bool\"\nwhere\n \"obj_is_alive obj all \\\n (\\delobj \\{x. x\\ all \\ obj_is_del x}. \\obj_is_deleted_by obj delobj)\"\n\ndefinition\n inv_flash :: \"EbLog list \\ bool\"\n where\n \"inv_flash flash \\ True\n\"\n(*\n let all = ostore_log_objects flash in \\\n \\ \\ The root inode exists, we don't really need to know that for the object store \\\n \\ \\ (\\obj\\set all. get_obj_oid obj = obj_id_inode_mk bilbyFsRootIno \\ obj_is_alive obj (set all)) \\ \\ \n \\ \\ all sqnums are uniq \\\n (card (Obj.sqnum\\<^sub>f ` set all) = length (map Obj.sqnum\\<^sub>f all)) \\\n (\\eblog\\set flash. inv_eb_log eblog (set all)) \\\n \\ \\ There is maximum 1 erase-block with garbage, (stripping out unmapped erase-blocks) \\\n length ((filter (op \\ []) $ map (prod.fst o the) $ filter (op \\ option.None) flash)) \\ 1\n \\ \\rel dentarr inode and inode data blocks? no cyclic dependencies in graph? \\\n *)\n\ndefinition\n is_obj_addr_consistent :: \"Obj\\<^sub>T \\ ObjAddr\\<^sub>T \\ bool\"\nwhere\n \"is_obj_addr_consistent obj addr \\\n Obj.sqnum\\<^sub>f obj = ObjAddr.sqnum\\<^sub>f addr \\\n Obj.offs\\<^sub>f obj = ObjAddr.offs\\<^sub>f addr \\\n Obj.len\\<^sub>f obj = ObjAddr.len\\<^sub>f addr\"\n\ndefinition\n inv_ostore_index :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_ostore_index mount_st ostore_st \\ \n (\\oid\\dom(\\_index $ index_st\\<^sub>f ostore_st).\n let addr = the $ (\\_index $ index_st\\<^sub>f ostore_st) oid;\n obj = ostore_get_obj ostore_st addr\n in is_valid_addr mount_st ostore_st addr \\\n is_obj_addr_consistent obj addr \\\n get_obj_oid obj = oid)\"\n\ndefinition\n inv_ostore_index_gim_disjoint :: \"OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_ostore_index_gim_disjoint ostore_st \\\n dom (\\_index $ index_st\\<^sub>f ostore_st) \\ dom (\\_fsm_gim $ gim\\<^sub>f $ fsm_st\\<^sub>f ostore_st) = {}\"\n\ndefinition\n inv_fsm_st :: \"MountState\\<^sub>T \\ FsmState\\<^sub>T \\ bool\"\nwhere\n \"inv_fsm_st mount_st fsm_st \\\n length (\\wa $ dirty_space\\<^sub>f $ fsm_st) = unat (nb_eb\\<^sub>f $ super\\<^sub>f mount_st) \\\n length (\\wa $ used_eb\\<^sub>f $ fsm_st) = unat (nb_eb\\<^sub>f $ super\\<^sub>f mount_st)\"\n\ndefinition\n inv_ostore_fsm :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_ostore_fsm mount_st ostore_st \\\n (\\wa $ used_eb\\<^sub>f $ fsm_st\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) \\ 0 \\\n\\ \\ Count on each gimnode is equal to the number of objects with the same oid\n in the log \\\n (\\oid \\ dom(\\_fsm_gim $ gim\\<^sub>f $ fsm_st\\<^sub>f ostore_st).\n let gimnode = the $ (\\_fsm_gim $ gim\\<^sub>f $ fsm_st\\<^sub>f ostore_st) oid\n in unat (GimNode.count\\<^sub>f gimnode) =\n card {x. x \\ (set $ ostore_log_objects $ list_eb_log_wbuf ostore_st) \\\n oid_is_deleted_by (get_obj_oid x) oid}) \\\n\n\\ \\ All Ubi erase-block with data are marked as used in the FSM used_eb<^sub>f bit map \\\n (\\ebnum\\ {bilbyFsFirstLogEbNum..f (super\\<^sub>f mount_st)}.\n (unat ebnum \\ unat (wbuf_eb\\<^sub>f ostore_st) \\\n ((\\wubi $ OstoreState.ubi_vol\\<^sub>f ostore_st) ! (unat ebnum) = [] \\\n ((\\wa $ used_eb\\<^sub>f $ fsm_st\\<^sub>f ostore_st) ! (unat ebnum) \\ 0))))\n\n\\ \\ Dirty space book-keeping (commented out for now) \\\n\"\n (* let ebnum = wbuf_eb\\<^sub>f ostore_st in\n ((\\wa $ used_eb\\<^sub>f $ fsm_st\\<^sub>f ostore_st) ! (unat ebnum) \\ 0) \\\n (let eb_log = list_eb_log_wbuf ostore_st ! (unat ebnum);\n eb_size = unat (eb_size\\<^sub>f (super\\<^sub>f mount_st));\n nondirt = listsum (map (unat o Obj.len\\<^sub>f) (concat eb_log)) ;\n nonused = (if ebnum = wbuf_eb\\<^sub>f ostore_st then eb_size - unat (used\\<^sub>f ostore_st) else 0) in\n (unat ((\\wa $ dirty_space\\<^sub>f $ fsm_st\\<^sub>f ostore_st) ! unat ebnum) = eb_size - nondirt - nonused)) *)\n\ndefinition\n inv_bufs :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_bufs mount_st ostore_st \\\n inv_ubi_vol mount_st (OstoreState.ubi_vol\\<^sub>f ostore_st) \\\n (\\ebnum\\{unat bilbyFsFirstLogEbNum.. length ((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))}.\n unat (wbuf_eb\\<^sub>f ostore_st) \\ ebnum \\\n length ((\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))!ebnum) = unat (eb_size\\<^sub>f (super\\<^sub>f mount_st) )) \\\n (let synced = buf_take (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st);\n sync_to_used = buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st) in\n \\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st) = synced \\\n (sync_offs\\<^sub>f ostore_st < used\\<^sub>f ostore_st \\ valid_list_trans_no_pad sync_to_used) \\\n (used\\<^sub>f ostore_st > 0 \\ valid_list_trans_no_pad synced) \\\n sort_key trans_order (prod.snd (list_trans_no_pad sync_to_used)) =\n prod.snd (list_trans_no_pad sync_to_used))\n\"\n(*\n (let nb_eb = nb_eb\\<^sub>f (super\\<^sub>f mount_st) in\n (\\ebnum\\{bilbyFsFirstLogEbNum..nb_eb}.\n (case ubi_to_buf (OstoreState.ubi_vol\\<^sub>f ostore_st) ebnum of\n option.None \\ True |\n option.Some buf \\ valid_list_trans buf)))\n*)\n\ndefinition\n inv_log :: \"Trans list list \\ Trans list \\ bool\"\nwhere\n \"inv_log eb_log wbuf_log \\\n (\\x\\set (concat eb_log).\n \\y\\set (wbuf_log). trans_order x < trans_order y) \\\n inj_on trans_order (set $ concat $ eb_log @ [wbuf_log])\"\n\ndefinition\n inv_opad :: \"Obj\\<^sub>T \\ bool\"\nwhere\n \"inv_opad opad \\\n magic\\<^sub>f opad = bilbyFsMagic \\\n otype\\<^sub>f opad = bilbyFsObjTypePad \\ \n trans\\<^sub>f opad = bilbyFsTransCommit \\\n bilbyFsObjHeaderSize \\ Obj.len\\<^sub>f opad \\\n ounion\\<^sub>f (opad) = ObjUnion.TObjPad () \\\n Obj.offs\\<^sub>f opad = 0\"\n\n\n(*\nFrom inv_ostore, we know that used\\<^sub>f ostore_st \\ eb_size,\nsee lemma inv_ostore_used below.\n*)\n\ndefinition\n inv_ostore :: \"MountState\\<^sub>T \\ OstoreState\\<^sub>T \\ bool\"\nwhere\n \"inv_ostore mount_st ostore_st \\\n sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st \\\n io_size\\<^sub>f (super\\<^sub>f mount_st) udvd sync_offs\\<^sub>f ostore_st \\\n used\\<^sub>f ostore_st \\ eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n used\\<^sub>f ostore_st < used\\<^sub>f ostore_st + io_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_length (rbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_length (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_bound (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n wbuf_eb\\<^sub>f ostore_st \\ bilbyFsFirstLogEbNum \\\n wbuf_eb\\<^sub>f ostore_st < nb_eb\\<^sub>f (super\\<^sub>f mount_st) \\\n inv_opad (opad\\<^sub>f ostore_st) \\\n \\_ostore_runtime ostore_st = \\_ostore_uptodate ostore_st \\\n inv_ostore_summary mount_st ostore_st \\\n inv_ostore_index mount_st ostore_st \\\n inv_ostore_index_gim_disjoint ostore_st \\\n inv_bufs mount_st ostore_st \\\n inv_fsm_st mount_st (fsm_st\\<^sub>f ostore_st) \\\n inv_ostore_fsm mount_st ostore_st \\\n inv_flash (list_eb_log_wbuf ostore_st) \\\n inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))\n (prod.snd $ list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n\nlemmas inv_ostore_simps =\n inv_ostore_def\n inv_ostore_summary_def\n inv_ostore_index_def\n inv_ostore_index_gim_disjoint_def\n inv_bufs_def\n inv_ostore_fsm_def\n inv_flash_def\n inv_eb_log_def\n\n\nlemma inv_summaryD: \"inv_ostore mount_st ostore_st \\ inv_ostore_summary mount_st ostore_st\"\nby (simp add: inv_ostore_def)\n\nlemma inv_ostore_wbuf_lengthD: \"inv_ostore mount_st ostore_st \\ buf_length (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\nby (simp add: inv_ostore_def)\n\nlemma inv_ostore_wbuf_boundD: \"inv_ostore mount_st ostore_st \\ buf_bound (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\nby (simp add: inv_ostore_def)\n\nlemma inv_ostore_usedD:\n \"inv_ostore mount_st ostore_st \\\n used\\<^sub>f ostore_st \\ eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\nby (clarsimp simp:inv_ostore_def)\n\nlemma inv_ostore_used_len_wbufD:\n \"inv_ostore mount_st ostore_st \\ inv_mount_st mount_st \\ unat (used\\<^sub>f ostore_st) \\ length (\\wa $ data\\<^sub>f $ wbuf\\<^sub>f ostore_st)\"\n apply (frule inv_ostore_wbuf_lengthD[THEN sym])\n apply (frule inv_ostore_usedD)\n apply (clarsimp simp: word_unat.Rep_inject[symmetric] word_le_nat_alt buf_simps inv_mount_st_def Let_def wordarray_length_ret)\n done\n\nlemma inv_ostore_sync_offsD:\n \"inv_ostore mount_st ostore_st \\ sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\"\nby (clarsimp simp:inv_ostore_def)\n\nlemma inv_ostore_fsmD:\n \"inv_ostore mount_st ostore_st \\ inv_ostore_fsm mount_st ostore_st\"\nby (clarsimp simp:inv_ostore_def)\n\nlemma used_eq_sync_offs_means_no_update:\n \"sync_offs\\<^sub>f ostore_st = used\\<^sub>f ostore_st \\\n \\_updates ostore_st = []\"\n unfolding \\_updates_def by (simp add: buf_simps)\n\n\nlemma inv_bufsD[simplified inv_bufs_def Let_def]:\n \"inv_ostore mount_st ostore_st \\ inv_bufs mount_st ostore_st\"\n by (simp add: inv_ostore_def) \n\nlemma length_ubi_buf_eq_sync_offsD:\n \"inv_ostore mount_st ostore_st \\\n inv_mount_st mount_st \\\n length (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st) ! unat (wbuf_eb\\<^sub>f ostore_st)) =\n unat (sync_offs\\<^sub>f ostore_st)\"\n apply (frule inv_bufsD)\n apply (subgoal_tac \"unat (sync_offs\\<^sub>f ostore_st) \\ unat (buf_length (wbuf\\<^sub>f ostore_st))\")\n using wordarray_length_ret[where arr=\"data\\<^sub>f (wbuf\\<^sub>f ostore_st)\"]\n apply (clarsimp simp: inv_bufs_def buf_simps min_absorb1 Let_def)\n apply unat_arith\n apply (frule inv_ostore_usedD)\n apply (clarsimp simp: inv_ostore_def buf_simps inv_mount_st_def Let_def, unat_arith+)\ndone\n\nlemma inv_ubi_volD:\n \"inv_ostore mount_st ostore_st \\ inv_ubi_vol mount_st (OstoreState.ubi_vol\\<^sub>f ostore_st)\"\n by (drule inv_bufsD, clarsimp simp: inv_bufs_def)\n\nlemma inv_ostore_indexD:\n \"inv_ostore mount_st ostore_st \\ inv_ostore_index mount_st ostore_st\"\n by (clarsimp simp: inv_ostore_def)\n\nlemma inv_ostore_eb_size_wbuf_eqD:\n \"inv_ostore mount_st ostore_st \\\n unat (eb_size\\<^sub>f (super\\<^sub>f mount_st)) = length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\nusing wordarray_length_ret[where arr=\"(data\\<^sub>f (wbuf\\<^sub>f ostore_st))\"]\nby (clarsimp simp: inv_ostore_def Let_def buf_simps wordarray_length_ret)\n\nlemma inv_ostore_eb_size_rbuf_eqD:\n \"inv_ostore mount_st ostore_st \\\n unat (eb_size\\<^sub>f (super\\<^sub>f mount_st)) = length (\\wa (data\\<^sub>f (rbuf\\<^sub>f ostore_st)))\"\nusing wordarray_length_ret[where arr=\"(data\\<^sub>f (rbuf\\<^sub>f ostore_st))\"]\nby (clarsimp simp: inv_ostore_def Let_def buf_simps wordarray_length_ret)\n\nlemma inv_ostore_buf_boundD:\n \"inv_ostore mount_st ostore_st \\\n unat (buf_bound (wbuf\\<^sub>f ostore_st)) \\ length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\nusing wordarray_length_ret[where arr=\"(data\\<^sub>f (wbuf\\<^sub>f ostore_st))\",symmetric]\nby (clarsimp simp: inv_ostore_def buf_simps)\n\nlemma inv_ostore_buf_bound_eqD:\n \"inv_ostore mount_st ostore_st \\\n unat (buf_bound (wbuf\\<^sub>f ostore_st)) = length (\\wa (data\\<^sub>f (wbuf\\<^sub>f ostore_st)))\"\nusing wordarray_length_ret[where arr=\"(data\\<^sub>f (wbuf\\<^sub>f ostore_st))\",symmetric]\nby (clarsimp simp: inv_ostore_def buf_simps)\n\nlemma inv_mount_st_no_summaryD:\n \"inv_mount_st mount_st \\ \\ no_summary\\<^sub>f mount_st\"\n by (simp add: inv_mount_st_def Let_def)\n\nlemma inv_logD[simplified inv_log_def]:\n \"inv_ostore mount_st ostore_st \\\n inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st))) (prod.snd $ list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n by (clarsimp simp add: inv_ostore_def Let_def)\n\n\nlemma inv_ostore_used_no_overflowD:\n \"inv_ostore mount_st ostore_st \\ used\\<^sub>f ostore_st < used\\<^sub>f ostore_st + io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n by (clarsimp simp: inv_ostore_def)\n\nlemma used_neq_sync_offs_means_updates_not_Nil:\nassumes inv_ostore: \"inv_ostore mount_st ostore_st\"\nshows\n \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st \\\n \\_updates ostore_st \\ []\"\n unfolding \\_updates_def \nusing inv_bufsD[OF inv_ostore] inv_ostore_sync_offsD[OF inv_ostore]\n by (fastforce simp add: valid_list_trans_no_pad_def)\n\nlemma inv_mount_st_eb_size_boundD:\n \"inv_mount_st mount_st \\ eb_size\\<^sub>f (super\\<^sub>f mount_st) \\ bilbyFsMaxEbSize\"\n by (simp add: inv_mount_st_def Let_def)\n\nlemma inv_fsm_stD[simplified inv_fsm_st_def]:\n \"inv_ostore mount_st ostore_st \\ inv_fsm_st mount_st (fsm_st\\<^sub>f ostore_st)\"\n by (clarsimp simp: inv_ostore_def)\n\nlemma inv_ostore_wbuf_eb_rangeD:\n \"inv_ostore mount_st ostore_st \\ wbuf_eb\\<^sub>f ostore_st \\ bilbyFsFirstLogEbNum \\\n wbuf_eb\\<^sub>f ostore_st < nb_eb\\<^sub>f (super\\<^sub>f mount_st)\"\n by (clarsimp simp: inv_ostore_def)\n\nlemma inv_opadD[simplified inv_opad_def]:\n \"inv_ostore mount_st ostore_st \\ inv_opad (opad\\<^sub>f ostore_st)\"\n by (simp add: inv_ostore_def)\n\ndefinition\n valid_pad_obj :: \"Obj\\<^sub>T \\ bool\"\nwhere\n \"valid_pad_obj obj \\ otype\\<^sub>f obj = bilbyFsObjTypePad \\ is_valid_Obj obj \\ Obj.offs\\<^sub>f obj = 0\"\n\nlemma is_valid_ObjCommit_trans_len:\n \"valid_pad_obj obj \\ is_valid_ObjCommit obj (sObj obj) \\ unat (Obj.len\\<^sub>f obj) = length (sObj obj) \\ trans_len (sObj obj) = length (sObj obj)\"\n apply (clarsimp simp add: is_valid_ObjTrans)\n apply (frule is_valid_ObjHeader_len_facts, clarsimp)\n apply (case_tac \"sObj obj\")\n apply (simp add: bilbyFsObjHeaderSize_def is_valid_ObjHeader_def)\n apply (simp add: trans_len_Cons)\n apply (rename_tac x xs)\n apply (clarsimp simp add: valid_pad_obj_def is_valid_ObjHeader_def)\n apply (drule_tac t=\"x#xs\" in sym, simp add: Obj_inverse[where xs=Nil, simplified] is_valid_ObjTrans)\n done\n\nlemma is_valid_ObjHeader_length_sObj:\n \"valid_pad_obj obj \\ is_valid_ObjHeader obj (sObj obj) \\ length (sObj obj) = unat (Obj.len\\<^sub>f obj)\"\n by (frule is_valid_ObjHeader_len_facts)\n (clarsimp simp: is_valid_ObjHeader_def length_sObj valid_pad_obj_def)\n\n\nlemma inv_ostore_valid_pad_objD:\n \"inv_ostore mount_st ostore_st \\ valid_pad_obj (opad\\<^sub>f ostore_st)\"\n by (drule inv_opadD) (clarsimp simp: inv_ostore_def valid_pad_obj_def is_valid_Obj_def)\n\nlemma inv_ostoreI:\n assumes\n \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st\"\n \"io_size\\<^sub>f (super\\<^sub>f mount_st) udvd sync_offs\\<^sub>f ostore_st\"\n \"used\\<^sub>f ostore_st \\ eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n \"used\\<^sub>f ostore_st < used\\<^sub>f ostore_st + io_size\\<^sub>f (super\\<^sub>f mount_st)\"\n \"buf_length (rbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n \"buf_length (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n \"buf_bound (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st)\"\n \"wbuf_eb\\<^sub>f ostore_st \\ bilbyFsFirstLogEbNum\"\n \"wbuf_eb\\<^sub>f ostore_st < nb_eb\\<^sub>f (super\\<^sub>f mount_st)\"\n \"inv_opad (opad\\<^sub>f ostore_st)\"\n \"\\_ostore_runtime ostore_st = \\_ostore_uptodate ostore_st\"\n \"inv_ostore_summary mount_st ostore_st\"\n \"inv_ostore_index mount_st ostore_st\"\n \"inv_ostore_index_gim_disjoint ostore_st\"\n \"inv_bufs mount_st ostore_st\"\n \"inv_fsm_st mount_st (fsm_st\\<^sub>f ostore_st)\"\n \"inv_ostore_fsm mount_st ostore_st\"\n \"inv_flash (list_eb_log_wbuf ostore_st)\"\n \"inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))\n (prod.snd $ list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st)))\"\n shows\n \"inv_ostore mount_st ostore_st\"\n using assms\n unfolding inv_ostore_def\n by fastforce\n\nlemma inv_ostoreE:\n assumes\n \"inv_ostore mount_st ostore_st\"\n \"sync_offs\\<^sub>f ostore_st \\ used\\<^sub>f ostore_st \\\n io_size\\<^sub>f (super\\<^sub>f mount_st) udvd sync_offs\\<^sub>f ostore_st \\\n used\\<^sub>f ostore_st \\ eb_size\\<^sub>f (super\\<^sub>f mount_st)\\\n used\\<^sub>f ostore_st < used\\<^sub>f ostore_st + io_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_length (rbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_length (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n buf_bound (wbuf\\<^sub>f ostore_st) = eb_size\\<^sub>f (super\\<^sub>f mount_st) \\\n wbuf_eb\\<^sub>f ostore_st \\ bilbyFsFirstLogEbNum \\\n wbuf_eb\\<^sub>f ostore_st < nb_eb\\<^sub>f (super\\<^sub>f mount_st) \\\n inv_opad (opad\\<^sub>f ostore_st) \\\n \\_ostore_runtime ostore_st = \\_ostore_uptodate ostore_st \\\n inv_ostore_summary mount_st ostore_st \\\n inv_ostore_index mount_st ostore_st \\\n inv_ostore_index_gim_disjoint ostore_st \\\n inv_bufs mount_st ostore_st \\\n inv_fsm_st mount_st (fsm_st\\<^sub>f ostore_st) \\\n inv_ostore_fsm mount_st ostore_st \\\n inv_flash (list_eb_log_wbuf ostore_st) \\\n inv_log (list_eb_log (\\wubi (OstoreState.ubi_vol\\<^sub>f ostore_st)))\n (prod.snd $ list_trans_no_pad (buf_slice (wbuf\\<^sub>f ostore_st) (sync_offs\\<^sub>f ostore_st) (used\\<^sub>f ostore_st))) \\\n thesis\"\n shows \"thesis\"\n using assms\n unfolding inv_ostore_def\n by fastforce\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/impl/fs/bilby/proof/spec/OstoreInvS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.30404167496654744, "lm_q1q2_score": 0.16975467453676527}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__24_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__24_on_rules imports n_germanSymIndex_lemma_on_inv__24\nbegin\nsection{*All lemmas on causal relation between inv__24*}\nlemma lemma_inv__24_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__24) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__24_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.16971140225424022}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__12_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__12_on_rules imports n_germanSimp_lemma_on_inv__12\nbegin\nsection{*All lemmas on causal relation between inv__12*}\nlemma lemma_inv__12_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__12 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__12) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__12_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3242353859211693, "lm_q1q2_score": 0.16971139883636213}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__32_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__32_on_rules imports n_germanSimp_lemma_on_inv__32\nbegin\nsection{*All lemmas on causal relation between inv__32*}\nlemma lemma_inv__32_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__32 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__32) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__32_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.331119752830196, "lm_q1q2_score": 0.1694394756687503}} {"text": "theory Friend_Network\n imports\n \"../API_Network\"\n \"Friend\"\n \"BD_Security_Compositional.Composing_Security_Network\"\nbegin\n\nsubsection \\Confidentiality for the N-ary composition\\\n\nlocale FriendNetwork = Network + FriendNetworkObservationSetup +\nfixes\n AID :: apiID\nand\n UID1 :: userID\nand\n UID2 :: userID\nassumes\n UID1_UID2_UIDs: \"{UID1,UID2} \\ (UIDs AID) = {}\"\nand\n UID1_UID2: \"UID1 \\ UID2\"\nand\n AID_AIDs: \"AID \\ AIDs\"\nbegin\n\nsublocale Issuer: Friend \"UIDs AID\" UID1 UID2 using UID1_UID2_UIDs UID1_UID2 by unfold_locales\n\nabbreviation \\ :: \"apiID \\ (state, act, out) trans \\ bool\"\nwhere \"\\ aid trn \\ (Issuer.\\ trn \\ aid = AID)\"\n\nabbreviation f :: \"apiID \\ (state, act, out) trans \\ Friend.value\"\nwhere \"f aid trn \\ Friend.f UID1 UID2 trn\"\n\nabbreviation T :: \"apiID \\ (state, act, out) trans \\ bool\"\nwhere \"T aid trn \\ False\"\n\nabbreviation B :: \"apiID \\ Friend.value list \\ Friend.value list \\ bool\"\nwhere \"B aid vl vl1 \\ (if aid = AID then Issuer.B vl vl1 else (vl = [] \\ vl1 = []))\"\n\nabbreviation \"comOfV aid vl \\ Internal\"\nabbreviation \"tgtNodeOfV aid vl \\ undefined\"\nabbreviation \"syncV aid1 vl1 aid2 vl2 \\ False\"\n\n\n\nsublocale Net: BD_Security_TS_Network_getTgtV\nwhere istate = \"\\_. istate\" and validTrans = validTrans and srcOf = \"\\_. srcOf\" and tgtOf = \"\\_. tgtOf\"\n and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n and sync = sync and \\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\n and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n and source = AID and getTgtV = id\nproof (unfold_locales, goal_cases)\n case (1 aid trn) then show ?case by auto next\n case (2 aid trn) then show ?case by auto next\n case (3 aid trn) then show ?case by (cases trn) auto next\n case (4 aid trn) then show ?case by (cases \"(aid,trn)\" rule: tgtNodeOf.cases) auto next\n case (5 aid1 trn1 aid2 trn2) then show ?case by auto next\n case (6 aid1 trn1 aid2 trn2) then show ?case by (cases trn1; cases trn2; auto) next\n case (7 aid1 trn1 aid2 trn2) then show ?case by auto next\n case (8 aid1 trn1 aid2 trn2) then show ?case by (cases trn1; cases trn2; auto) next\n case (9 aid trn) then show ?case by (cases \"(aid,trn)\" rule: tgtNodeOf.cases) (auto simp: FriendObservationSetup.\\.simps) next\n case (10 aid trn) then show ?case by auto\nqed auto\n\nsublocale BD_Security_TS_Network_Preserve_Source_Security_getTgtV\nwhere istate = \"\\_. istate\" and validTrans = validTrans and srcOf = \"\\_. srcOf\" and tgtOf = \"\\_. tgtOf\"\n and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n and sync = sync and \\ = \\ and f = f and \\ = \\ and g = g and T = T and B = B\n and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n and source = AID and getTgtV = id\nusing AID_AIDs Issuer.secure\nby unfold_locales auto\n\ntheorem secure: \"secure\"\nproof (intro preserve_source_secure ballI)\n fix aid\n assume \"aid \\ AIDs - {AID}\"\n then show \"Net.lsecure aid\" by (intro Abstract_BD_Security.B_id_secure) (auto simp: B_id_def)\nqed\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Friend_Confidentiality/Friend_Network.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.33111974622959367, "lm_q1q2_score": 0.16943947229111253}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__88_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__88_on_rules imports n_g2kAbsAfter_lemma_on_inv__88\nbegin\nsection{*All lemmas on causal relation between inv__88*}\nlemma lemma_inv__88_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__88 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__88) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__88) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__88_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.31405054499180746, "lm_q1q2_score": 0.16926796954713594}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__50_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__50_on_rules imports n_germanSimp_lemma_on_inv__50\nbegin\nsection{*All lemmas on causal relation between inv__50*}\nlemma lemma_inv__50_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__50 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__50) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__50) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__50_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3208212943308302, "lm_q1q2_score": 0.1691743695526662}} {"text": "(*\n Title: Dynamic Authorization Protocol - Message Transaction\n Author: Felipe Rodopoulos de Oliveira\n*)\n\ntheory DAP_Transaction imports \"./Smartphone\"\n\nbegin\n\nabbreviation\n Confirmation :: msg where \"Confirmation \\ (Number 1)\"\nabbreviation\n Success :: msg where \"Success \\ (Number 2)\"\n\naxiomatization where\n daptrans_assume_insecure_devices [iff]: \"evs \\ daptrans \\ insecureP\"\n\ninductive_set daptrans :: \"event list set\" where\n Nil: \"[] \\ daptrans\"\n\n (* Rule modeling the illegal behavior of the Spy *)\n | Fake: \"\\ evsF \\ daptrans; X \\ synth(analz(knows Spy evsF));\n illegalUse(Smartphone A); C \\ Server; C \\ Spy \\\n \\ Says Spy B X #\n Scans Spy (Smartphone A) X #\n Shows (Smartphone Spy) C X # evsF \\ daptrans\"\n \n (* Reception invariant rules *)\n | Rcpt: \"\\ evsR \\ daptrans; Says A B X \\ set evsR \\ \n \\ Gets B X # evsR \\ daptrans\"\n\n | RcptS: \"\\ evsRs \\ daptrans; Scans A (Smartphone B) X \\ set evsRs \\ \n \\ SGets (Smartphone B) X # evsRs \\ daptrans\"\n\n | RcptA: \"\\ evsRa \\ daptrans; Shows (Smartphone A) B X \\ set evsRa \\\n \\ AGets B X # evsRa \\ daptrans\"\n\n | RcptI: \"\\ evsRi \\ daptrans; Inputs A (Smartphone B) X \\ set evsRi \\\n \\ SGets (Smartphone B) X # evsRi \\ daptrans\"\n\n (* Protocol rules *)\n | DT1: \"\\ evs1 \\ daptrans; A \\ Server \\\n \\ Says A Server \\ Agent A, Number T \\ # evs1 \\ daptrans\"\n\n | DT2: \"\\ evs2 \\ daptrans; Nonce r \\ used evs2;\n Gets Server \\ Agent A, Number T \\ \\ set evs2 \\\n \\ Says Server A \\ \n \\ Agent A, Number T \\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ # evs2 \\ daptrans\"\n\n | DT3: \"\\ evs3 \\ daptrans; legalUse (Smartphone A); A \\ Server;\n Says A Server \\ Agent A, Number T \\ \\ set evs3;\n Gets A \\ \\ Agent A, Number T \\, r', h\\<^sub>s \\ \\ set evs3 \\\n \\ Scans A (Smartphone A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ # evs3 \\ daptrans\"\n\n | DT4: \"\\ evs4 \\ daptrans; legalUse(Smartphone A); A \\ Server;\n SGets (Smartphone A) \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs4 \\\n \\ Shows (Smartphone A) A \\Agent A, Number T\\ # evs4 \\ daptrans\"\n\n | DT5: \"\\ evs5 \\ daptrans; legalUse(Smartphone A);\n Says A Server \\ Agent A, Number T \\ \\ set evs5;\n Gets A \\ \\ Agent A, Number T \\, r', h\\<^sub>s \\ \\ set evs5;\n Scans A (Smartphone A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs5;\n Shows (Smartphone A) A \\Agent A, Number T\\ \\ set evs5 \\\n \\ Inputs A (Smartphone A) \\Agent A, Number T, Confirmation\\ # evs5 \\ daptrans\"\n\n | DT6: \"\\ evs6 \\ daptrans; legalUse(Smartphone A); A \\ Server;\n SGets (Smartphone A) \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs6;\n Shows (Smartphone A) A \\Agent A, Number T\\ \\ set evs6;\n SGets (Smartphone A) \\Agent A, Number T, Confirmation\\ \\ set evs6 \\\n \\ Shows (Smartphone A) A (Nonce r) # evs6 \\ daptrans\"\n\n | DT7: \"\\ evs7 \\ daptrans; A \\ Server;\n Says A Server \\Agent A, Number T\\ \\ set evs7;\n Gets A \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs7;\n Scans A (Smartphone A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs7;\n Shows (Smartphone A) A \\Agent A, Number T\\ \\ set evs7;\n Inputs A (Smartphone A) \\Agent A, Number T, Confirmation\\ \\ set evs7;\n AGets A (Nonce r) \\ set evs7 \\\n \\ Says A Server (Nonce r) # evs7 \\ daptrans\"\n\n | DT8: \"\\ evs8 \\ daptrans;\n Gets Server \\Agent A, Number T\\ \\ set evs8;\n Says Server A \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs8;\n Gets Server (Nonce r) \\ set evs8 \\\n \\ Says Server A Success # evs8 \\ daptrans\"\n\ndeclare Fake_parts_insert_in_Un [dest]\ndeclare analz_into_parts [dest]\n\n\n\n\n\n(* GENERAL LEMMAS ON MESSAGE RECEPTION *)\n\nlemma Gets_imp_Says :\n \"\\ Gets B X \\ set evs; evs \\ daptrans \\ \\ \\ A. Says A B X \\ set evs\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Gets_imp_knows_Spy :\n \"\\ Gets B X \\ set evs; evs \\ daptrans \\ \\ X \\ knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n \nlemma Gets_imp_knows_Spy_analz :\n \"\\ Gets B X \\ set evs; evs \\ daptrans \\ \\ X \\ analz (knows Spy evs)\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\nlemma Gets_imp_knows_Spy_analz_Snd :\n \"\\ Gets B \\X, Y\\ \\ set evs; evs \\ daptrans \\ \\ Y \\ analz (knows Spy evs)\"\n\n apply (blast dest!: Gets_imp_Says Says_imp_knows_Spy analz.Inj analz.Snd)\ndone\n\nlemmas Gets_imp_knows_Spy_parts = Gets_imp_knows_Spy_analz [THEN analz_into_parts]\nlemmas Gets_imp_knows_Spy_parts_Snd = Gets_imp_knows_Spy_analz_Snd [THEN analz_into_parts]\n\nlemma SGets_imp_Scans_or_Inputs :\n \"\\ SGets P X \\ set evs; evs \\ daptrans \\ \n \\ \\ A. (Scans A P X \\ set evs) \\ (Inputs A P X \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\nlemma SGets_imp_knows_Spy :\n \"\\ SGets (Smartphone B) X \\ set evs; (Smartphone B) \\ badP; evs \\ daptrans \\\n \\ X \\ knows Spy evs\"\n\n apply (erule rev_mp, erule rev_mp)\n apply (erule daptrans.induct)\n apply (auto)\ndone\n\nlemma SGets_imp_knows_Spy_analz :\n \"\\ SGets (Smartphone B) X \\ set evs; (Smartphone B) \\ badP; evs \\ daptrans \\\n \\ X \\ analz (knows Spy evs)\"\nby (blast dest!: SGets_imp_knows_Spy)\n\nlemmas SGets_imp_knows_Spy_parts = SGets_imp_knows_Spy_analz [THEN analz_into_parts]\n\nlemma AGets_imp_Shows :\n \"\\ AGets A X \\ set evs; evs \\ daptrans \\ \\ \\ P. Shows P A X \\ set evs\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\n\n(* - Lemmas on insecure devices, from the EventSP.thy, now proved for DAP_Transaction *)\n\nlemma Scans_imp_knows_Spy_insecureP_daptrans :\n \"\\ Scans Spy P X \\ set evs; evs \\ daptrans \\ \\ X \\ knows Spy evs\"\n\n apply (simp (no_asm_simp) add: Scans_imp_knows_Spy)\ndone\n\nlemma knows_Spy_Scans_insecureP_daptrans_Spy :\n \"evs \\ daptrans \\ knows Spy (Scans Spy P X # evs) = insert X (knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Scans_insecureP_daptrans :\n \"\\ A \\ Spy; A \\ bad; evs \\ daptrans \\ \n \\ knows Spy (Scans A P X # evs) = insert X (knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Shows_insecureM_daptrans_Spy :\n \"\\ P \\ badP; evs \\ daptrans \\\n \\ knows Spy (Shows P Spy X # evs) = knows Spy evs\"\nby simp\n\nlemma knows_Spy_Shows_insecureM_daptrans :\n \"\\ P \\ badP; evs \\ daptrans \\ \n \\ knows Spy (Shows P A X # evs) = insert X (knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Inputs_daptrans_Spy :\n \"evs \\ daptrans \\ knows Spy (Inputs Spy P X # evs) = insert X (knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Inputs_daptrans :\n \"\\ A \\ Spy; evs \\ daptrans \\ \n \\ knows Spy (Inputs A P X # evs) = knows Spy evs\"\nby simp\n\n\n\n\n(* RELIABILITY LEMMAS *)\n\n(* 1. General Server guarantees *)\n\n(* Server cannot initiate the protocol *)\nlemma Says_Server_DT1_not_evs :\n \"evs \\ daptrans \\ Says Server Server \\ Agent Server, Number T \\ \\ set evs\"\n\n apply (erule daptrans.induct)\n apply (simp_all)\ndone\n\nlemma Server_cannot_initiate :\n \"\\ Says A Server \\ Agent A, Number T \\ \\ set evs; evs \\ daptrans \\ \\ A \\ Server\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\ndone\n\n\n(* - The Server smartphone is not usable *)\n\nlemma Scans_Agent_Server_not_evs [rule_format] :\n \"evs \\ daptrans \\ Scans Server (Smartphone A) X \\ set evs\"\n\n apply (erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Scans_Server_Agent_not_evs [rule_format] :\n \"evs \\ daptrans \\ Scans A (Smartphone Server) X \\ set evs\"\n\n apply (erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Shows_Agent_Server_not_evs [rule_format] :\n \"evs \\ daptrans \\ Shows (Smartphone A) Server X \\ set evs\"\n\n apply (erule daptrans.induct)\n apply (simp_all)\ndone\n\nlemma Shows_Server_Agent_not_evs [rule_format]:\n \"evs \\ daptrans \\ Shows (Smartphone Server) A X \\ set evs\"\n\n apply (erule daptrans.induct)\n apply (simp_all)\ndone\n\n\n(* - Server expected message form to the sender *)\n\nlemma Says_Server_DT2 :\n \"\\ Says Server A \\ \n \\Agent A, Number T\\, \n Crypt (shrK A) (Nonce r), \n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\ \n \\ \\ set evs; evs \\ daptrans \\\n \\ Gets Server \\Agent A, Number T\\ \\ set evs\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Says_Server_form_DT2 :\n \"\\ Says Server A \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs; evs \\ daptrans \\\n \\ (\\ r.\n r' = Crypt (shrK A) (Nonce r) \\\n h\\<^sub>s = Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\n(* - The Server only authorizes a transaction if \n it received a nonce that matches the produced TAN *)\n\nlemma Says_Server_Success :\n \"\\ Says Server A Success \\ set evs; evs \\ daptrans \\\n \\ \\ T r.\n Gets Server \\Agent A, Number T\\ \\ set evs \\\n Says Server A \\ \n \\Agent A, Number T\\, \n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\\\Agent A, Number T\\, Crypt (shrK A) (Nonce r)\\\n \\ \\ set evs \\\n Gets Server (Nonce r) \\ set evs\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone \n\n\n\n\n(* 2. General guarantees on smartphones usability *)\n\n(* - Defining legalUse conditions *)\n\nlemma Scans_Smartphone_legalUse :\n \"\\ Scans A (Smartphone A) X \\ set evs; evs \\ daptrans \\ \\ legalUse(Smartphone A)\"\napply (erule rev_mp, erule daptrans.induct)\napply (auto)\ndone\n\nlemma Shows_Smartphone_legalUse :\n \"\\ Shows (Smartphone A) A X \\ set evs; evs \\ daptrans \\ \\ legalUse(Smartphone A)\"\napply (erule rev_mp, erule daptrans.induct)\napply (auto)\ndone\n\n\n(* - Legal agents' smartphones firing Scans/Shows must be their owners\n performing a legal action or the Spy performing an illegal action *)\n\nlemma Scans_Smartphone :\n \"\\ Scans A P X \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (P = (Smartphone A) \\ legalUse(P)) \\ (P = (Smartphone Spy) \\ illegalUse(P))\"\n \n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Shows_Smartphone :\n \"\\ Shows P A X \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (P = (Smartphone A) \\ legalUse(P)) \\ (P = (Smartphone Spy))\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\ndone\n\nlemma Scans_Shows_Smartphone :\n \"\\ Scans A P X \\ set evs \\ Shows P A X \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (P = (Smartphone A) \\ legalUse(Smartphone A)) \\ (P = (Smartphone Spy))\"\n\n apply (blast dest: Scans_Smartphone Shows_Smartphone)\ndone\n\n\n(* - The spy can act both legally (using her smartphone) or illegally (using someone else) *)\nlemma Scans_Smartphone_Spy :\n \"\\ Scans Spy P X \\ set evs \\ Shows P Spy X \\ set evs; evs \\ daptrans \\ \n \\ (P = (Smartphone Spy)) \\ (legalUse(Smartphone Spy)) \\ \n (\\ A. P = (Smartphone A) \\ illegalUse(Smartphone A))\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\n\n\n\n(* 3. Protocol termination *)\n\nlemma Protocol_terminates :\n \"\\ A Success. \\ evs \\ daptrans. A \\ Server \\ Says Server A Success \\ set evs\"\n\n apply (intro exI bexI)\n apply (rule_tac [2] daptrans.Nil [THEN daptrans.DT1, THEN daptrans.Rcpt,\n THEN daptrans.DT2, THEN daptrans.Rcpt,\n THEN daptrans.DT3, THEN daptrans.RcptS,\n THEN daptrans.DT4, THEN daptrans.RcptA,\n THEN daptrans.DT5, THEN daptrans.RcptI,\n THEN daptrans.DT6, THEN daptrans.RcptA,\n THEN daptrans.DT7, THEN daptrans.Rcpt,\n THEN daptrans.DT8])\n apply (possibility, auto)\ndone\n\n\n\n\n(* 4. Scans & Inputs events guarantees *)\n\nlemma Scans_A_Smartphone_3 :\n \"\\ Scans A P \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (legalUse(P)) \\ P = (Smartphone A) \\\n Says A Server \\Agent A, Number T\\ \\ set evs \\\n Gets A \\ \\ Agent A, Number T \\, r', h\\<^sub>s \\ \\ set evs\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\ndone\n\n(* This is an important guarantee: the protocol legally continues if the agent confirms the \n outputed message, which contains the transaction *)\nlemma Inputs_A_Smartphone_5 :\n \"\\ Inputs A P \\Agent A, Number T, Confirmation\\ \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (legalUse(P)) \\ P = (Smartphone A) \\\n (\\ r' h\\<^sub>s. Says A Server \\Agent A, Number T\\ \\ set evs \\\n Gets A \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs \\\n Scans A (Smartphone A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs \\\n Shows (Smartphone A) A \\Agent A, Number T\\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\n\n(* - Message form guarantees *)\n\nlemma Scans_A_Smartphone_form_3 :\n \"\\ Scans A (Smartphone A) \\ Transaction, r', h\\<^sub>s \\ \\ set evs; \n \\ p q. Transaction = \\p, q\\; evs \\ daptrans \\\n \\ (\\ T r. Transaction = \\ Agent A, Number T \\)\"\n \n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\nlemma Scans_A_Smartphone_form_DT3:\n \"\\ Scans A (Smartphone A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs; evs \\ daptrans \\\n \\ \\ r. r' = Crypt (shrK A) (Nonce r) \\\n h\\<^sub>s = Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n apply (force)\noops\n\n\n\n(* 5. Shows events guarantees *) \n\n(* First, we state that Smartphones provide correct Shows when fed with expected Scans.\n Such lemmas guarantee that Smartphones cannot produce unexpected Shows, preventing the\n Spy from having unlimited resources *)\nlemma Shows_A_Smartphone_4 :\n \"\\ Shows P A \\Agent A, Number T\\ \\ set evs; evs \\ daptrans \\\n \\ ((legalUse(P)) \\ P = (Smartphone A)) \\ ((illegalUse(P)) \\ P = (Smartphone Spy)) \\\n (\\ r. SGets (Smartphone A) \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n defer\n apply (blast+)\noops\n\nlemma Shows_honest_A_Smartphone_4 :\n \"\\ Shows P A \\Agent A, Number T\\ \\ set evs; evs \\ daptrans \\\n \\ (legalUse(P)) \\ P = (Smartphone A) \\\n (\\ r. SGets (Smartphone A) \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n defer\n apply (blast+)\noops\n\nlemma Shows_which_Smartphone_4 :\n \"\\ Shows (Smartphone A) A \\Agent A, Number T\\ \\ set evs; evs \\ daptrans \\\n \\ (\\ r. SGets (Smartphone A) \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n defer\n apply (blast+)\ndone\n\nlemma Shows_A_Smartphone_6 :\n \"\\ Shows P A (Nonce r) \\ set evs; evs \\ daptrans \\\n \\ (\\ T. SGets (Smartphone A) \\Agent A, Number T, Confirmation\\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n defer\n apply (blast+)\noops\n\nlemma Shows_honest_A_Smartphone_6 :\n \"\\ Shows P A (Nonce r) \\ set evs; A \\ Spy; evs \\ daptrans \\\n \\ (legalUse(P)) \\ P = (Smartphone A) \\\n (\\ T. SGets (Smartphone A) \\Agent A, Number T, Confirmation\\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\n defer\n apply (blast+)\noops\n\nlemma Shows_which_Smartphone_6 :\n \"\\ Shows (Smartphone A) A (Nonce r) \\ set evs; evs \\ daptrans \\\n \\ (\\ T. SGets (Smartphone A) \\Agent A, Number T, Confirmation\\ \\ set evs)\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (auto)\ndone\n\n\n\n(* - Shows messages form guarantees *)\n\nlemma Shows_A_Smartphone_form_4 :\n \"\\ Shows (Smartphone A) A Transaction \\ set evs; \\ p q. Transaction = \\p, q\\;\n evs \\ daptrans \\\n \\ \\ T. Transaction = \\Agent A, Number T\\\"\n\n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all)\ndone\n\nlemma Shows_A_Smartphone_form_6 :\n \"\\ Shows (Smartphone A) A TAN \\ set evs; \\ p q. TAN \\ \\p, q\\; evs \\ daptrans \\\n \\ \\ r. TAN = (Nonce r)\"\n\n apply (erule rev_mp, erule rev_mp, erule daptrans.induct)\n apply (simp_all, blast)\ndone\n\n\n\n\n(* 6. Spy guarantees *)\n\nlemma Spy_knows_Transaction : \n \"\\ Says A Server \\Agent A, Number T\\ \\ set evs; evs \\ daptrans \\\n \\ Number T \\ analz (knows Spy evs)\"\nby (blast dest!: Says_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd])\n\nlemma Spy_knows_TAN :\n \"\\ Says A Server (Nonce r) \\ set evs; evs \\ daptrans \\\n \\ Nonce r \\ knows Spy evs\"\nby (blast dest!: Says_imp_knows_Spy)\n\n\n\n\n(* REGULARITY LEMMAS *)\n\n(* For reasoning about encrypted portion of messages *)\nlemma DT3_analz_knows_Spy_fst :\n \"\\ Gets A \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs; evs \\ daptrans \\\n \\ r' \\ analz (knows Spy evs)\"\nby (blast dest!: Gets_imp_Says Gets_imp_knows_Spy_analz_Snd)\n\nlemma DT3_analz_knows_Spy_snd :\n \"\\ Gets A \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ set evs; evs \\ daptrans \\\n \\ h\\<^sub>s \\ analz (knows Spy evs)\"\nby (blast dest!: Gets_imp_Says Gets_imp_knows_Spy_analz_Snd)\n\nlemmas DT3_parts_knows_Spy_fst = DT3_analz_knows_Spy_fst [THEN analz_into_parts]\nlemmas DT3_parts_knows_Spy_snd = DT3_analz_knows_Spy_snd [THEN analz_into_parts]\n\nlemma shrK_not_in_honest_Scans [dest]:\n \"\\Scans A (Smartphone A) X \\ set evs; A \\ bad; Smartphone P \\ badP; evs \\ daptrans\\\n \\ Key (shrK A) \\ analz {X}\"\n\n apply (erule rev_mp, erule rev_mp, erule rev_mp)\n apply (erule daptrans.induct)\n apply (frule_tac [9] DT3_parts_knows_Spy_fst)\n apply (frule_tac [10] DT3_parts_knows_Spy_snd)\n apply (simp_all, blast)\n apply (auto)\nsorry\n\nlemma Spy_parts_keys [simp] : \n \"evs \\ daptrans \\ (Key (shrK A) \\ parts (knows Spy evs)) = (Smartphone A \\ badP)\"\n\n apply (erule daptrans.induct)\n apply (frule_tac [9] DT3_parts_knows_Spy_fst)\n apply (frule_tac [10] DT3_parts_knows_Spy_snd)\n apply (simp_all, blast)\n apply (auto)\nsorry\n\nlemma Spy_analz_shrK [simp] :\n \"evs \\ daptrans \\ (Key (shrK A) \\ analz (knows Spy evs)) = (Smartphone A \\ badP)\" \nby (auto dest!: Spy_knows_bad_phones)\n\n\n\n\n(* UNICITY LEMMAS *)\n\n(* The TAN r uniquely identifies a transaction at the Server side *)\nlemma Server_transaction_unique :\n \"\\ Says Server A \\ \n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\\n \\ \\ set evs ;\n Says Server A' \\ \n \\Agent A', Number T'\\,\n Crypt (shrK A') (Nonce r),\n Crypt (shrK A') \\ \\Agent A', Number T'\\, Crypt (shrK A') (Nonce r) \\\n \\ \\ set evs;\n evs \\ daptrans\\\n \\ A = A' \\ T = T'\"\n\n apply (erule rev_mp, erule rev_mp)\n apply (erule daptrans.induct, simp_all)\n apply (fastforce dest: Says_parts_used)\ndone\n\n\n\n\n(* AUTHENTICITY LEMMAS *)\nlemma Checksum_authentic :\n \"\\ Crypt (shrK A) \\ \\Agent A, Number T\\, r', h\\<^sub>s \\ \\ parts (knows Spy evs);\n (Smartphone A) \\ badP; evs \\ daptrans \\\n \\ r' = Crypt (shrK A) (Nonce r) \\\n h\\<^sub>s = Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r)\\ \\\n Says Server A \\\n \\Agent A, Number T\\,\n Crypt (shrK A) (Nonce r),\n Crypt (shrK A) \\ \\Agent A, Number T\\, Crypt (shrK A) (Nonce r) \\ \n \\ \\ set evs\"\n \n apply (erule rev_mp, erule daptrans.induct)\n apply (simp_all (no_asm_simp))\noops\n\nend", "meta": {"author": "rodopoulos", "repo": "dap-verification", "sha": "bcc17195754594a5c102719f2a486fa9a0564010", "save_path": "github-repos/isabelle/rodopoulos-dap-verification", "path": "github-repos/isabelle/rodopoulos-dap-verification/dap-verification-bcc17195754594a5c102719f2a486fa9a0564010/scripts/DAP_Transaction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3276683073862188, "lm_q1q2_score": 0.1689523050395853}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\n(* \nCSpace invariants\n*)\n\ntheory ArchCSpaceInvPre_AI\nimports \"../CSpaceInvPre_AI\"\nbegin\ncontext Arch begin global_naming ARM\n\nlemma aobj_ref_acap_rights_update[simp]:\n \"aobj_ref (acap_rights_update f x) = aobj_ref x\"\n by (cases x; simp add: acap_rights_update_def)\n\nlemma arch_obj_size_acap_rights_update[simp]:\n \"arch_obj_size (acap_rights_update f x) = arch_obj_size x\"\n by (cases x; simp add: acap_rights_update_def)\n\nlemma valid_arch_cap_acap_rights_update[intro]:\n \"valid_arch_cap x s \\ valid_arch_cap (acap_rights_update f x) s\"\n by (cases x; simp add: acap_rights_update_def valid_arch_cap_def)\n\ndefinition\n cap_master_arch_cap where\n \"cap_master_arch_cap acap \\\n (case acap of\n arch_cap.PageCap dev ref rghts sz mapdata \\\n arch_cap.PageCap dev ref UNIV sz None\n | arch_cap.ASIDPoolCap pool asid \\\n arch_cap.ASIDPoolCap pool 0\n | arch_cap.PageTableCap ptr data \\\n arch_cap.PageTableCap ptr None\n | arch_cap.PageDirectoryCap ptr data \\\n arch_cap.PageDirectoryCap ptr None\n | _ \\ acap)\"\n\nlemma\n cap_master_arch_cap_eqDs1:\n \"cap_master_arch_cap cap = (arch_cap.PageCap dev ref rghts sz mapdata)\n \\ rghts = UNIV \\ mapdata = None\n \\ (\\rghts mapdata. cap = (arch_cap.PageCap dev ref rghts sz mapdata))\"\n \"cap_master_arch_cap cap = arch_cap.ASIDControlCap\n \\ cap = arch_cap.ASIDControlCap\"\n \"cap_master_arch_cap cap = (arch_cap.ASIDPoolCap pool asid)\n \\ asid = 0 \\ (\\asid. cap = (arch_cap.ASIDPoolCap pool asid))\"\n \"cap_master_arch_cap cap = (arch_cap.PageTableCap ptr data)\n \\ data = None \\ (\\data. cap = (arch_cap.PageTableCap ptr data))\"\n \"cap_master_arch_cap cap = (arch_cap.PageDirectoryCap ptr data2)\n \\ data2 = None \\ (\\data2. cap = (arch_cap.PageDirectoryCap ptr data2))\"\n by (clarsimp simp: cap_master_arch_cap_def\n split: arch_cap.split_asm)+\n\nlemma\n cap_master_arch_inv:\n \"cap_master_arch_cap (cap_master_arch_cap ac) = cap_master_arch_cap ac\"\n by (cases ac; simp add: cap_master_arch_cap_def)\n\ndefinition\n \"is_ap_cap cap \\ case cap of (ArchObjectCap (arch_cap.ASIDPoolCap ap asid)) \\ True | _ \\ False\"\n\nlemmas is_ap_cap_simps [simp] = is_ap_cap_def [split_simps cap.split arch_cap.split]\n\ndefinition\n \"reachable_pg_cap cap \\ \\s.\n is_pg_cap cap \\\n (\\vref. vs_cap_ref cap = Some vref \\ (vref \\ obj_ref_of cap) s)\"\n\ndefinition\n replaceable_final_arch_cap :: \"'z::state_ext state \\ cslot_ptr \\ cap \\ cap \\ bool\"\nwhere\n \"replaceable_final_arch_cap s sl newcap \\ \\cap.\n (\\vref. vs_cap_ref cap = Some vref\n \\ (vs_cap_ref newcap = Some vref\n \\ obj_refs newcap = obj_refs cap)\n \\ (\\oref \\ obj_refs cap. \\ (vref \\ oref) s))\n \\ no_cap_to_obj_with_diff_ref newcap {sl} s\n \\ ((is_pt_cap newcap \\ is_pd_cap newcap) \\ cap_asid newcap = None\n \\ (\\ r \\ obj_refs newcap.\n obj_at (empty_table (set (arm_global_pts (arch_state s)))) r s))\n \\ ((is_pt_cap newcap \\ is_pd_cap newcap)\n \\ ((is_pt_cap newcap \\ is_pt_cap cap \\ is_pd_cap newcap \\ is_pd_cap cap)\n \\ (cap_asid newcap = None \\ cap_asid cap = None)\n \\ obj_refs cap \\ obj_refs newcap)\n \\ (\\sl'. cte_wp_at (\\cap'. obj_refs cap' = obj_refs newcap\n \\ (is_pd_cap newcap \\ is_pd_cap cap' \\ is_pt_cap newcap \\ is_pt_cap cap')\n \\ (cap_asid newcap = None \\ cap_asid cap' = None)) sl' s \\ sl' = sl))\n \\ \\is_ap_cap newcap\"\n\ndefinition\n replaceable_non_final_arch_cap :: \"'z::state_ext state \\ cslot_ptr \\ cap \\ cap \\ bool\"\nwhere\n \"replaceable_non_final_arch_cap s sl newcap \\ \\cap. \\ reachable_pg_cap cap s\"\n\ndeclare\n replaceable_final_arch_cap_def[simp]\n replaceable_non_final_arch_cap_def[simp]\n\nlemma unique_table_refsD:\n \"\\ unique_table_refs cps; cps p = Some cap; cps p' = Some cap';\n obj_refs cap = obj_refs cap'\\\n \\ table_cap_ref cap = table_cap_ref cap'\"\n unfolding unique_table_refs_def\n by blast\n\nlemma table_cap_ref_vs_cap_ref_Some:\n \"table_cap_ref x = Some y \\ vs_cap_ref x = Some y\"\n by (clarsimp simp: table_cap_ref_def vs_cap_ref_def \n split: cap.splits arch_cap.splits)\n\nlemma set_cap_valid_vs_lookup:\n \"\\\\s. valid_vs_lookup s\n \\ (\\vref cap'. cte_wp_at (op = cap') ptr s\n \\ vs_cap_ref cap' = Some vref\n \\ (vs_cap_ref cap = Some vref \\ obj_refs cap = obj_refs cap')\n \\ (\\ is_final_cap' cap' s \\ \\ reachable_pg_cap cap' s)\n \\ (\\oref. oref \\ obj_refs cap' \\ \\ (vref \\ oref) s))\n \\ unique_table_refs (caps_of_state s)\\\n set_cap cap ptr\n \\\\rv. valid_vs_lookup\\\"\n apply (simp add: valid_vs_lookup_def\n del: split_paired_All split_paired_Ex)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_all_lift hoare_convert_imp[OF set_cap.vs_lookup_pages]\n hoare_vcg_disj_lift)\n apply (elim conjE allEI, rule impI, drule(1) mp)\n apply (simp only: simp_thms)\n apply (elim exE conjE)\n apply (case_tac \"p' = ptr\")\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (elim disjE impCE)\n apply fastforce\n apply clarsimp\n apply (drule (1) not_final_another_caps)\n apply (erule obj_ref_is_obj_irq_ref)\n apply (simp, elim exEI, clarsimp simp: obj_irq_refs_eq)\n apply (rule conjI, clarsimp)\n apply (drule(3) unique_table_refsD)\n apply (clarsimp simp: reachable_pg_cap_def is_pg_cap_def)\n apply (case_tac cap, simp_all add: vs_cap_ref_simps)[1]\n apply (rename_tac arch_cap)\n apply (case_tac arch_cap,\n simp_all add: vs_cap_ref_simps table_cap_ref_simps)[1]\n apply (clarsimp dest!: table_cap_ref_vs_cap_ref_Some)\n apply fastforce\n apply (clarsimp dest!: table_cap_ref_vs_cap_ref_Some)+\n apply (auto simp: cte_wp_at_caps_of_state)[1]\n done\n\ncrunch arch[wp]: set_cap \"\\s. P (arch_state s)\" (simp: split_def)\n\nlemma set_cap_valid_table_caps:\n \"\\\\s. valid_table_caps s\n \\ ((is_pt_cap cap \\ is_pd_cap cap) \\ cap_asid cap = None\n \\ (\\r \\ obj_refs cap. obj_at (empty_table (set (arm_global_pts (arch_state s)))) r s))\\\n set_cap cap ptr\n \\\\rv. valid_table_caps\\\"\n apply (simp add: valid_table_caps_def)\n apply (wp hoare_vcg_all_lift\n hoare_vcg_disj_lift hoare_convert_imp[OF set_cap_caps_of_state]\n hoare_use_eq[OF set_cap_arch set_cap_obj_at_impossible])\n apply (simp add: empty_table_caps_of)\n done\n\nlemma set_cap_unique_table_caps:\n \"\\\\s. unique_table_caps (caps_of_state s)\n \\ ((is_pt_cap cap \\ is_pd_cap cap)\n \\ (\\oldcap. caps_of_state s ptr = Some oldcap \\\n (is_pt_cap cap \\ is_pt_cap oldcap \\ is_pd_cap cap \\ is_pd_cap oldcap)\n \\ (cap_asid cap = None \\ cap_asid oldcap = None)\n \\ obj_refs oldcap \\ obj_refs cap)\n \\ (\\ptr'. cte_wp_at (\\cap'. obj_refs cap' = obj_refs cap\n \\ (is_pd_cap cap \\ is_pd_cap cap' \\ is_pt_cap cap \\ is_pt_cap cap')\n \\ (cap_asid cap = None \\ cap_asid cap' = None)) ptr' s \\ ptr' = ptr))\\\n set_cap cap ptr\n \\\\rv s. unique_table_caps (caps_of_state s)\\\"\n apply wp\n apply (simp only: unique_table_caps_def)\n apply (elim conjE)\n apply (erule impCE)\n apply clarsimp\n apply (erule impCE)\n prefer 2\n apply (simp del: imp_disjL)\n apply (thin_tac \"\\a b. P a b\" for P)\n apply (auto simp: cte_wp_at_caps_of_state)[1]\n apply (clarsimp simp del: imp_disjL del: allI)\n apply (case_tac \"cap_asid cap \\ None\")\n apply (clarsimp del: allI)\n apply (elim allEI | rule impI)+\n apply (auto simp: is_pt_cap_def is_pd_cap_def)[1]\n apply (elim allEI)\n apply (intro conjI impI)\n apply (elim allEI)\n apply (auto simp: is_pt_cap_def is_pd_cap_def)[1]\n apply (elim allEI)\n apply (auto simp: is_pt_cap_def is_pd_cap_def)[1]\n done\n\nlemma set_cap_unique_table_refs:\n \"\\\\s. unique_table_refs (caps_of_state s)\n \\ no_cap_to_obj_with_diff_ref cap {ptr} s\\\n set_cap cap ptr\n \\\\rv s. unique_table_refs (caps_of_state s)\\\"\n apply wp\n apply clarsimp\n apply (simp add: unique_table_refs_def\n split del: if_split del: split_paired_All)\n apply (erule allEI, erule allEI)\n apply (clarsimp split del: if_split)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state\n split: if_split_asm)\n done\n\nlemma set_cap_valid_arch_caps:\n \"\\\\s. valid_arch_caps s\n \\ (\\vref cap'. cte_wp_at (op = cap') ptr s\n \\ vs_cap_ref cap' = Some vref\n \\ (vs_cap_ref cap = Some vref \\ obj_refs cap = obj_refs cap')\n \\ (\\ is_final_cap' cap' s \\ \\ reachable_pg_cap cap' s)\n \\ (\\oref \\ obj_refs cap'. \\ (vref \\ oref) s))\n \\ no_cap_to_obj_with_diff_ref cap {ptr} s\n \\ ((is_pt_cap cap \\ is_pd_cap cap) \\ cap_asid cap = None\n \\ (\\r \\ obj_refs cap. obj_at (empty_table (set (arm_global_pts (arch_state s)))) r s))\n \\ ((is_pt_cap cap \\ is_pd_cap cap)\n \\ (\\oldcap. caps_of_state s ptr = Some oldcap \\\n (is_pt_cap cap \\ is_pt_cap oldcap \\ is_pd_cap cap \\ is_pd_cap oldcap)\n \\ (cap_asid cap = None \\ cap_asid oldcap = None)\n \\ obj_refs oldcap \\ obj_refs cap)\n \\ (\\ptr'. cte_wp_at (\\cap'. obj_refs cap' = obj_refs cap\n \\ (is_pd_cap cap \\ is_pd_cap cap' \\ is_pt_cap cap \\ is_pt_cap cap')\n \\ (cap_asid cap = None \\ cap_asid cap' = None)) ptr' s \\ ptr' = ptr))\\\n set_cap cap ptr\n \\\\rv. valid_arch_caps\\\"\n apply (simp add: valid_arch_caps_def pred_conj_def)\n apply (wp set_cap_valid_vs_lookup set_cap_valid_table_caps\n set_cap_unique_table_caps set_cap_unique_table_refs)\n by simp_all blast+\n\nlemma valid_table_capsD:\n \"\\ cte_wp_at (op = cap) ptr s; valid_table_caps s;\n is_pt_cap cap | is_pd_cap cap; cap_asid cap = None \\\n \\ \\r \\ obj_refs cap. obj_at (empty_table (set (arm_global_pts (arch_state s)))) r s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state valid_table_caps_def)\n apply (cases ptr, fastforce)\n done\n\nlemma unique_table_capsD:\n \"\\ unique_table_caps cps; cps ptr = Some cap; cps ptr' = Some cap';\n obj_refs cap = obj_refs cap'; cap_asid cap = None \\ cap_asid cap' = None;\n (is_pd_cap cap \\ is_pd_cap cap') \\ (is_pt_cap cap \\ is_pt_cap cap') \\\n \\ ptr = ptr'\"\n unfolding unique_table_caps_def\n by blast\n\nlemma set_cap_cap_refs_in_kernel_window[wp]:\n \"\\cap_refs_in_kernel_window\n and (\\s. \\ref \\ cap_range cap. arm_kernel_vspace (arch_state s) ref\n = ArmVSpaceKernelWindow)\\\n set_cap cap p\n \\\\rv. cap_refs_in_kernel_window\\\"\n apply (simp add: cap_refs_in_kernel_window_def valid_refs_def2\n pred_conj_def)\n apply (rule hoare_lift_Pf2[where f=arch_state])\n apply wp\n apply (fastforce elim!: ranE split: if_split_asm)\n apply wp\n done\n\nlemma cap_refs_in_kernel_windowD:\n \"\\ caps_of_state s ptr = Some cap; cap_refs_in_kernel_window s \\\n \\ \\ref \\ cap_range cap.\n arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\"\n apply (clarsimp simp: cap_refs_in_kernel_window_def valid_refs_def\n cte_wp_at_caps_of_state)\n apply (cases ptr, fastforce)\n done\n\nlemma valid_cap_imp_valid_vm_rights:\n \"valid_cap (cap.ArchObjectCap (PageCap dev mw rs sz m)) s \\\n rs \\ valid_vm_rights\"\n by (simp add: valid_cap_def valid_vm_rights_def)\n\nlemma acap_rights_update_idem [simp]:\n \"acap_rights_update R (acap_rights_update R' cap) = acap_rights_update R cap\"\n by (simp add: acap_rights_update_def split: arch_cap.splits)\n\nlemma cap_master_arch_cap_rights [simp]:\n \"cap_master_arch_cap (acap_rights_update R cap) = cap_master_arch_cap cap\"\n by (simp add: cap_master_arch_cap_def acap_rights_update_def \n split: arch_cap.splits)\n\nlemma acap_rights_update_id [intro!, simp]:\n \"valid_arch_cap ac s \\ acap_rights_update (acap_rights ac) ac = ac\"\n unfolding acap_rights_update_def acap_rights_def valid_arch_cap_def\n by (cases ac; simp)\n\nlemma obj_ref_none_no_asid:\n \"{} = obj_refs new_cap \\ None = table_cap_ref new_cap\"\n \"obj_refs new_cap = {} \\ table_cap_ref new_cap = None\"\n by (simp add: table_cap_ref_def split: cap.split arch_cap.split)+\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/invariant-abstract/ARM/ArchCSpaceInvPre_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3276683008207139, "lm_q1q2_score": 0.16895230165428027}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_on_inv__66.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_on_inv__66 imports n_g2kAbsAfter_base\nbegin\nsection{*All lemmas on causal relation between inv__66 and some rule r*}\nlemma n_n_RecvInvAck_i1Vsinv__66:\nassumes a1: \"(r=n_n_RecvInvAck_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_SendGntE_i1Vsinv__66:\nassumes a1: \"(r=n_n_SendGntE_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Ident ''AShrSet_1'')) (Const false)) (eqn (IVar (Field (Ident ''AChan2_1'') ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvE_i1Vsinv__66:\nassumes a1: \"(r=n_n_ASendInvE_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvS_i1Vsinv__66:\nassumes a1: \"(r=n_n_ASendInvS_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendInvAck_i1Vsinv__66:\nassumes a1: \"(r=n_n_ASendInvAck_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvInvAck_i1Vsinv__66:\nassumes a1: \"(r=n_n_ARecvInvAck_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_n_ASendGntS_i1Vsinv__66:\nassumes a1: \"(r=n_n_ASendGntS_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ASendGntE_i1Vsinv__66:\nassumes a1: \"(r=n_n_ASendGntE_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvGntS_i1Vsinv__66:\nassumes a1: \"(r=n_n_ARecvGntS_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_ARecvGntE_i1Vsinv__66:\nassumes a1: \"(r=n_n_ARecvGntE_i1 )\" and\na2: \"(f=inv__66 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_n_RecvReq_i1Vsinv__66:\n assumes a1: \"r=n_n_RecvReq_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvS_i1Vsinv__66:\n assumes a1: \"r=n_n_SendInvS_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEI_i1Vsinv__66:\n assumes a1: \"r=n_n_SendReqEI_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqEI_i1Vsinv__66:\n assumes a1: \"r=n_n_ASendReqEI_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqIS_j1Vsinv__66:\n assumes a1: \"r=n_n_ASendReqIS_j1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqES_i1Vsinv__66:\n assumes a1: \"r=n_n_ASendReqES_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendGntS_i1Vsinv__66:\n assumes a1: \"r=n_n_SendGntS_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqES_i1Vsinv__66:\n assumes a1: \"r=n_n_SendReqES_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvE_i1Vsinv__66:\n assumes a1: \"r=n_n_SendInvE_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ASendReqSE_j1Vsinv__66:\n assumes a1: \"r=n_n_ASendReqSE_j1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntS_i1Vsinv__66:\n assumes a1: \"r=n_n_RecvGntS_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqEE_i1Vsinv__66:\n assumes a1: \"r=n_n_SendReqEE_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_RecvGntE_i1Vsinv__66:\n assumes a1: \"r=n_n_RecvGntE_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_ARecvReq_i1Vsinv__66:\n assumes a1: \"r=n_n_ARecvReq_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_Store_i1Vsinv__66:\n assumes a1: \"\\ d. d\\N\\r=n_n_Store_i1 d\" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_AStore_i1Vsinv__66:\n assumes a1: \"\\ d. d\\N\\r=n_n_AStore_i1 d\" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendReqS_j1Vsinv__66:\n assumes a1: \"r=n_n_SendReqS_j1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_n_SendInvAck_i1Vsinv__66:\n assumes a1: \"r=n_n_SendInvAck_i1 \" and\n a2: \"(f=inv__66 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_on_inv__66.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3276682942552091, "lm_q1q2_score": 0.16895229826897518}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__30_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__30_on_rules imports n_g2kAbsAfter_lemma_on_inv__30\nbegin\nsection{*All lemmas on causal relation between inv__30*}\nlemma lemma_inv__30_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__30 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__30) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__30) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__30_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.31742627850202554, "lm_q1q2_score": 0.1686198097838329}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__62_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__62_on_rules imports n_g2kAbsAfter_lemma_on_inv__62\nbegin\nsection{*All lemmas on causal relation between inv__62*}\nlemma lemma_inv__62_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__62 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__62) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__62) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__62_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.31742626558767584, "lm_q1q2_score": 0.16861980763520082}} {"text": "header {* \\isaheader{Postdomination} *}\n\ntheory Postdomination imports CFGExit begin\n\ntext {* For static interprocedural slicing, we only consider standard control \n dependence, hence we only need standard postdomination. *}\n\nlocale Postdomination = CFGExit sourcenode targetnode kind valid_edge Entry \n get_proc get_return_edges procs Main Exit\n for sourcenode :: \"'edge \\ 'node\" and targetnode :: \"'edge \\ 'node\"\n and kind :: \"'edge \\ ('var,'val,'ret,'pname) edge_kind\" \n and valid_edge :: \"'edge \\ bool\"\n and Entry :: \"'node\" (\"'('_Entry'_')\") and get_proc :: \"'node \\ 'pname\"\n and get_return_edges :: \"'edge \\ 'edge set\"\n and procs :: \"('pname \\ 'var list \\ 'var list) list\" and Main :: \"'pname\"\n and Exit::\"'node\" (\"'('_Exit'_')\") +\n assumes Entry_path:\"valid_node n \\ \\as. (_Entry_) -as\\\\<^sub>\\* n\"\n and Exit_path:\"valid_node n \\ \\as. n -as\\\\<^sub>\\* (_Exit_)\"\n and method_exit_unique:\n \"\\method_exit n; method_exit n'; get_proc n = get_proc n'\\ \\ n = n'\"\n\nbegin\n\nlemma get_return_edges_unique:\n assumes \"valid_edge a\" and \"a' \\ get_return_edges a\" and \"a'' \\ get_return_edges a\"\n shows \"a' = a''\"\nproof -\n from `valid_edge a` `a' \\ get_return_edges a` \n obtain Q r p fs where \"kind a = Q:r\\\\<^bsub>p\\<^esub>fs\"\n by(fastforce dest!:only_call_get_return_edges)\n with `valid_edge a` `a' \\ get_return_edges a` obtain Q' f' where \"kind a' = Q'\\\\<^bsub>p\\<^esub>f'\"\n by(fastforce dest!:call_return_edges)\n from `valid_edge a` `a' \\ get_return_edges a` have \"valid_edge a'\" \n by(rule get_return_edges_valid)\n from this `kind a' = Q'\\\\<^bsub>p\\<^esub>f'` have \"get_proc (sourcenode a') = p\" \n by(rule get_proc_return)\n from `valid_edge a'` `kind a' = Q'\\\\<^bsub>p\\<^esub>f'` have \"method_exit (sourcenode a')\"\n by(fastforce simp:method_exit_def)\n from `valid_edge a` `a'' \\ get_return_edges a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs`\n obtain Q'' f'' where \"kind a'' = Q''\\\\<^bsub>p\\<^esub>f''\" by(fastforce dest!:call_return_edges)\n from `valid_edge a` `a'' \\ get_return_edges a` have \"valid_edge a''\" \n by(rule get_return_edges_valid)\n from this `kind a'' = Q''\\\\<^bsub>p\\<^esub>f''` have \"get_proc (sourcenode a'') = p\" \n by(rule get_proc_return)\n from `valid_edge a''` `kind a'' = Q''\\\\<^bsub>p\\<^esub>f''` have \"method_exit (sourcenode a'')\"\n by(fastforce simp:method_exit_def)\n with `method_exit (sourcenode a')` `get_proc (sourcenode a') = p`\n `get_proc (sourcenode a'') = p` have \"sourcenode a' = sourcenode a''\"\n by(fastforce elim!:method_exit_unique)\n from `valid_edge a` `a' \\ get_return_edges a`\n obtain ax' where \"valid_edge ax'\" and \"sourcenode ax' = sourcenode a\"\n and \"targetnode ax' = targetnode a'\" and \"intra_kind(kind ax')\"\n by -(drule call_return_node_edge,auto simp:intra_kind_def)\n from `valid_edge a` `a'' \\ get_return_edges a`\n obtain ax'' where \"valid_edge ax''\" and \"sourcenode ax'' = sourcenode a\"\n and \"targetnode ax'' = targetnode a''\" and \"intra_kind(kind ax'')\"\n by -(drule call_return_node_edge,auto simp:intra_kind_def)\n from `valid_edge a` `kind a = Q:r\\\\<^bsub>p\\<^esub>fs` `valid_edge ax'` \n `sourcenode ax' = sourcenode a` `intra_kind(kind ax')`\n `valid_edge ax''` `sourcenode ax'' = sourcenode a` `intra_kind(kind ax'')`\n have \"ax' = ax''\" by -(drule call_only_one_intra_edge,auto)\n with `targetnode ax' = targetnode a'` `targetnode ax'' = targetnode a''`\n have \"targetnode a' = targetnode a''\" by simp\n with `valid_edge a'` `valid_edge a''` `sourcenode a' = sourcenode a''`\n show ?thesis by(rule edge_det)\nqed\n\n\ndefinition postdominate :: \"'node \\ 'node \\ bool\" (\"_ postdominates _\" [51,0])\nwhere postdominate_def:\"n' postdominates n \\ \n (valid_node n \\ valid_node n' \\\n (\\as pex. (n -as\\\\<^sub>\\* pex \\ method_exit pex) \\ n' \\ set (sourcenodes as)))\"\n\n\nlemma postdominate_implies_inner_path: \n assumes \"n' postdominates n\" \n obtains as where \"n -as\\\\<^sub>\\* n'\" and \"n' \\ set (sourcenodes as)\"\nproof(atomize_elim)\n from `n' postdominates n` have \"valid_node n\"\n and all:\"\\as pex. (n -as\\\\<^sub>\\* pex \\ method_exit pex) \\ n' \\ set (sourcenodes as)\"\n by(auto simp:postdominate_def)\n from `valid_node n` obtain asx where \"n -asx\\\\<^sub>\\* (_Exit_)\" by(auto dest:Exit_path)\n then obtain as where \"n -as\\\\<^sub>\\* (_Exit_)\"\n and \"\\a \\ set as. intra_kind(kind a) \\ (\\Q f p. kind a = Q\\\\<^bsub>p\\<^esub>f)\"\n by -(erule valid_Exit_path_descending_path)\n show \"\\as. n -as\\\\<^sub>\\* n' \\ n' \\ set (sourcenodes as)\"\n proof(cases \"\\a \\ set as. \\Q f p. kind a = Q\\\\<^bsub>p\\<^esub>f\")\n case True\n then obtain asx ax asx' where [simp]:\"as = asx@ax#asx'\" \n and \"\\Q f p. kind ax = Q\\\\<^bsub>p\\<^esub>f\" and \"\\a \\ set asx. \\Q f p. kind a \\ Q\\\\<^bsub>p\\<^esub>f\"\n by -(erule split_list_first_propE,simp)\n with `\\a \\ set as. intra_kind(kind a) \\ (\\Q f p. kind a = Q\\\\<^bsub>p\\<^esub>f)`\n have \"\\a \\ set asx. intra_kind(kind a)\" by auto\n from `n -as\\\\<^sub>\\* (_Exit_)` have \"n -asx\\\\<^sub>\\* sourcenode ax\"\n and \"valid_edge ax\" by(auto dest:vp_split)\n from `n -asx\\\\<^sub>\\* sourcenode ax` `\\a \\ set asx. intra_kind(kind a)`\n have \"n -asx\\\\<^sub>\\* sourcenode ax\" by(simp add:vp_def intra_path_def)\n from `valid_edge ax` `\\Q f p. kind ax = Q\\\\<^bsub>p\\<^esub>f` \n have \"method_exit (sourcenode ax)\" by(fastforce simp:method_exit_def)\n with `n -asx\\\\<^sub>\\* sourcenode ax` all have \"n' \\ set (sourcenodes asx)\" by fastforce\n then obtain xs ys where \"sourcenodes asx = xs@n'#ys\" and \"n' \\ set xs\"\n by(fastforce dest:split_list_first)\n then obtain as' a as'' where \"xs = sourcenodes as'\"\n and [simp]:\"asx = as'@a#as''\" and \"sourcenode a = n'\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from `n -asx\\\\<^sub>\\* sourcenode ax` have \"n -as'\\\\<^sub>\\* sourcenode a\"\n by(fastforce dest:path_split simp:intra_path_def)\n with `sourcenode a = n'` `n' \\ set xs` `xs = sourcenodes as'`\n show ?thesis by fastforce\n next\n case False\n with `\\a \\ set as. intra_kind(kind a) \\ (\\Q f p. kind a = Q\\\\<^bsub>p\\<^esub>f)`\n have \"\\a \\ set as. intra_kind(kind a)\" by fastforce\n with `n -as\\\\<^sub>\\* (_Exit_)` all have \"n' \\ set (sourcenodes as)\"\n by(auto simp:vp_def intra_path_def simp:method_exit_def)\n then obtain xs ys where \"sourcenodes as = xs@n'#ys\" and \"n' \\ set xs\"\n by(fastforce dest:split_list_first)\n then obtain as' a as'' where \"xs = sourcenodes as'\"\n and [simp]:\"as = as'@a#as''\" and \"sourcenode a = n'\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from `n -as\\\\<^sub>\\* (_Exit_)` `\\a \\ set as. intra_kind(kind a)` `as = as'@a#as''`\n have \"n -as'\\\\<^sub>\\* sourcenode a\"\n by(fastforce dest:path_split simp:vp_def intra_path_def)\n with `sourcenode a = n'` `n' \\ set xs` `xs = sourcenodes as'`\n show ?thesis by fastforce\n qed\nqed\n\n\nlemma postdominate_variant:\n assumes \"n' postdominates n\" \n shows \"\\as. n -as\\\\<^sub>\\* (_Exit_) \\ n' \\ set (sourcenodes as)\"\nproof -\n from `n' postdominates n`\n have all:\"\\as pex. (n -as\\\\<^sub>\\* pex \\ method_exit pex) \\ n' \\ set (sourcenodes as)\"\n by(simp add:postdominate_def)\n { fix as assume \"n -as\\\\<^sub>\\* (_Exit_)\"\n then obtain as' pex where \"n -as'\\\\<^sub>\\* pex\" and \"method_exit pex\"\n and \"set(sourcenodes as') \\ set(sourcenodes as)\"\n by(erule valid_Exit_path_intra_path)\n from `n -as'\\\\<^sub>\\* pex` `method_exit pex` `n' postdominates n`\n have \"n' \\ set (sourcenodes as')\" by(fastforce simp:postdominate_def)\n with `set(sourcenodes as') \\ set(sourcenodes as)`\n have \"n' \\ set (sourcenodes as)\" by fastforce }\n thus ?thesis by simp\nqed\n\n\nlemma postdominate_refl:\n assumes \"valid_node n\" and \"\\ method_exit n\" shows \"n postdominates n\"\nusing `valid_node n`\nproof(induct rule:valid_node_cases)\n case Entry\n { fix as pex assume \"(_Entry_) -as\\\\<^sub>\\* pex\" and \"method_exit pex\"\n from `method_exit pex` have \"(_Entry_) \\ set (sourcenodes as)\"\n proof(rule method_exit_cases)\n assume \"pex = (_Exit_)\"\n with `(_Entry_) -as\\\\<^sub>\\* pex` have \"as \\ []\" \n apply(clarsimp simp:intra_path_def) apply(erule path.cases)\n by (drule sym,simp,drule Exit_noteq_Entry,auto)\n with `(_Entry_) -as\\\\<^sub>\\* pex` have \"hd (sourcenodes as) = (_Entry_)\" \n by(fastforce intro:path_sourcenode simp:intra_path_def)\n with `as \\ []`show ?thesis by(fastforce intro:hd_in_set simp:sourcenodes_def)\n next\n fix a Q p f assume \"pex = sourcenode a\" and \"valid_edge a\" and \"kind a = Q\\\\<^bsub>p\\<^esub>f\"\n from `(_Entry_) -as\\\\<^sub>\\* pex` have \"get_proc (_Entry_) = get_proc pex\"\n by(rule intra_path_get_procs)\n hence \"get_proc pex = Main\" by(simp add:get_proc_Entry)\n from `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` have \"get_proc (sourcenode a) = p\"\n by(rule get_proc_return)\n with `pex = sourcenode a` `get_proc pex = Main` have \"p = Main\" by simp\n with `valid_edge a` `kind a = Q\\\\<^bsub>p\\<^esub>f` have False\n by simp (rule Main_no_return_source)\n thus ?thesis by simp\n qed }\n with Entry show ?thesis \n by(fastforce intro:empty_path simp:postdominate_def intra_path_def)\nnext\n case Exit\n with `\\ method_exit n` have False by(simp add:method_exit_def)\n thus ?thesis by simp\nnext\n case inner\n show ?thesis\n proof(cases \"\\as. n -as\\\\<^sub>\\* (_Exit_)\")\n case True\n { fix as pex assume \"n -as\\\\<^sub>\\* pex\" and \"method_exit pex\"\n with `\\ method_exit n` have \"as \\ []\" \n by(fastforce elim:path.cases simp:intra_path_def)\n with `n -as\\\\<^sub>\\* pex` inner have \"hd (sourcenodes as) = n\"\n by(fastforce intro:path_sourcenode simp:intra_path_def)\n from `as \\ []` have \"sourcenodes as \\ []\" by(simp add:sourcenodes_def)\n with `hd (sourcenodes as) = n`[THEN sym] \n have \"n \\ set (sourcenodes as)\" by simp }\n hence \"\\as pex. (n -as\\\\<^sub>\\* pex \\ method_exit pex) \\ n \\ set (sourcenodes as)\"\n by fastforce\n with True inner show ?thesis \n by(fastforce intro:empty_path \n simp:postdominate_def inner_is_valid intra_path_def)\n next\n case False\n with inner show ?thesis by(fastforce dest:inner_is_valid Exit_path)\n qed\nqed\n\n\n\nlemma postdominate_trans:\n assumes \"n'' postdominates n\" and \"n' postdominates n''\"\n shows \"n' postdominates n\"\nproof -\n from `n'' postdominates n` `n' postdominates n''`\n have \"valid_node n\" and \"valid_node n'\" by(simp_all add:postdominate_def)\n { fix as pex assume \"n -as\\\\<^sub>\\* pex\" and \"method_exit pex\"\n with `n'' postdominates n` have \"n'' \\ set (sourcenodes as)\"\n by(fastforce simp:postdominate_def)\n then obtain ns' ns'' where \"sourcenodes as = ns'@n''#ns''\"\n by(auto dest:split_list)\n then obtain as' as'' a where \"sourcenodes as'' = ns''\" and [simp]:\"as=as'@a#as''\"\n and [simp]:\"sourcenode a = n''\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from `n -as\\\\<^sub>\\* pex` have \"n -as'@a#as''\\\\<^sub>\\* pex\" by simp\n hence \"n'' -a#as''\\\\<^sub>\\* pex\"\n by(fastforce dest:path_split_second simp:intra_path_def)\n with `n' postdominates n''` `method_exit pex`\n have \"n' \\ set(sourcenodes (a#as''))\" by(fastforce simp:postdominate_def)\n hence \"n' \\ set (sourcenodes as)\" by(fastforce simp:sourcenodes_def) }\n with `valid_node n` `valid_node n'`\n show ?thesis by(fastforce simp:postdominate_def)\nqed\n\n\nlemma postdominate_antisym:\n assumes \"n' postdominates n\" and \"n postdominates n'\"\n shows \"n = n'\"\nproof -\n from `n' postdominates n` have \"valid_node n\" and \"valid_node n'\" \n by(auto simp:postdominate_def)\n from `valid_node n` obtain asx where \"n -asx\\\\<^sub>\\* (_Exit_)\" by(auto dest:Exit_path)\n then obtain as' pex where \"n -as'\\\\<^sub>\\* pex\" and \"method_exit pex\"\n by -(erule valid_Exit_path_intra_path)\n with `n' postdominates n` have \"\\nx \\ set(sourcenodes as'). nx = n'\"\n by(fastforce simp:postdominate_def)\n then obtain ns ns' where \"sourcenodes as' = ns@n'#ns'\"\n and \"\\nx \\ set ns'. nx \\ n'\"\n by(fastforce elim!:split_list_last_propE)\n from `sourcenodes as' = ns@n'#ns'` obtain asx a asx' \n where [simp]:\"ns' = sourcenodes asx'\" \"as' = asx@a#asx'\" \"sourcenode a = n'\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n from `n -as'\\\\<^sub>\\* pex` have \"n' -a#asx'\\\\<^sub>\\* pex\"\n by(fastforce dest:path_split_second simp:intra_path_def)\n with `n postdominates n'` `method_exit pex` have \"n \\ set(sourcenodes (a#asx'))\" \n by(fastforce simp:postdominate_def)\n hence \"n = n' \\ n \\ set(sourcenodes asx')\" by(simp add:sourcenodes_def)\n thus ?thesis\n proof\n assume \"n = n'\" thus ?thesis .\n next\n assume \"n \\ set(sourcenodes asx')\"\n then obtain nsx' nsx'' where \"sourcenodes asx' = nsx'@n#nsx''\"\n by(auto dest:split_list)\n then obtain asi asi' a' where [simp]:\"asx' = asi@a'#asi'\" \"sourcenode a' = n\"\n by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n with `n -as'\\\\<^sub>\\* pex` have \"n -(asx@a#asi)@a'#asi'\\\\<^sub>\\* pex\" by simp\n hence \"n -(asx@a#asi)@a'#asi'\\* pex\"\n and \"\\a \\ set ((asx@a#asi)@a'#asi'). intra_kind (kind a)\"\n by(simp_all add:intra_path_def)\n from `n -(asx@a#asi)@a'#asi'\\* pex`\n have \"n -a'#asi'\\* pex\" by(fastforce dest:path_split_second)\n with `\\a \\ set ((asx@a#asi)@a'#asi'). intra_kind (kind a)`\n have \"n -a'#asi'\\\\<^sub>\\* pex\" by(simp add:intra_path_def)\n with `n' postdominates n` `method_exit pex` \n have \"n' \\ set(sourcenodes (a'#asi'))\" by(fastforce simp:postdominate_def)\n hence \"n' = n \\ n' \\ set(sourcenodes asi')\"\n by(simp add:sourcenodes_def)\n thus ?thesis\n proof\n assume \"n' = n\" thus ?thesis by(rule sym)\n next\n assume \"n' \\ set(sourcenodes asi')\"\n with `\\nx \\ set ns'. nx \\ n'` have False by(fastforce simp:sourcenodes_def)\n thus ?thesis by simp\n qed\n qed\nqed\n\n\nlemma postdominate_path_branch:\n assumes \"n -as\\* n''\" and \"n' postdominates n''\" and \"\\ n' postdominates n\"\n obtains a as' as'' where \"as = as'@a#as''\" and \"valid_edge a\"\n and \"\\ n' postdominates (sourcenode a)\" and \"n' postdominates (targetnode a)\"\nproof(atomize_elim)\n from assms\n show \"\\as' a as''. as = as'@a#as'' \\ valid_edge a \\ \n \\ n' postdominates (sourcenode a) \\ n' postdominates (targetnode a)\"\n proof(induct rule:path.induct)\n case (Cons_path n'' as nx a n)\n note IH = `\\n' postdominates nx; \\ n' postdominates n''\\\n \\ \\as' a as''. as = as'@a#as'' \\ valid_edge a \\\n \\ n' postdominates sourcenode a \\ n' postdominates targetnode a`\n show ?case\n proof(cases \"n' postdominates n''\")\n case True\n with `\\ n' postdominates n` `sourcenode a = n` `targetnode a = n''`\n `valid_edge a` show ?thesis by blast\n next\n case False\n from IH[OF `n' postdominates nx` this] show ?thesis\n by clarsimp(rule_tac x=\"a#as'\" in exI,clarsimp)\n qed\n qed simp\nqed\n\n\nlemma Exit_no_postdominator:\n assumes \"(_Exit_) postdominates n\" shows False\nproof -\n from `(_Exit_) postdominates n` have \"valid_node n\" by(simp add:postdominate_def)\n from `valid_node n` obtain asx where \"n -asx\\\\<^sub>\\* (_Exit_)\" by(auto dest:Exit_path)\n then obtain as' pex where \"n -as'\\\\<^sub>\\* pex\" and \"method_exit pex\"\n by -(erule valid_Exit_path_intra_path)\n with `(_Exit_) postdominates n` have \"(_Exit_) \\ set (sourcenodes as')\"\n by(fastforce simp:postdominate_def)\n with `n -as'\\\\<^sub>\\* pex` show False by(fastforce simp:intra_path_def)\nqed\n\n\nlemma postdominate_inner_path_targetnode:\n assumes \"n' postdominates n\" and \"n -as\\\\<^sub>\\* n''\" and \"n' \\ set(sourcenodes as)\"\n shows \"n' postdominates n''\"\nproof -\n from `n' postdominates n` obtain asx \n where \"valid_node n\" and \"valid_node n'\"\n and all:\"\\as pex. (n -as\\\\<^sub>\\* pex \\ method_exit pex) \\ n' \\ set (sourcenodes as)\"\n by(auto simp:postdominate_def)\n from `n -as\\\\<^sub>\\* n''` have \"valid_node n''\"\n by(fastforce dest:path_valid_node simp:intra_path_def)\n have \"\\as' pex'. (n'' -as'\\\\<^sub>\\* pex' \\ method_exit pex') \\ \n n' \\ set (sourcenodes as')\"\n proof(rule ccontr)\n assume \"\\ (\\as' pex'. (n'' -as'\\\\<^sub>\\* pex' \\ method_exit pex') \\ \n n' \\ set (sourcenodes as'))\"\n then obtain as' pex' where \"n'' -as'\\\\<^sub>\\* pex'\" and \"method_exit pex'\"\n and \"n' \\ set (sourcenodes as')\" by blast\n from `n -as\\\\<^sub>\\* n''` `n'' -as'\\\\<^sub>\\* pex'` have \"n -as@as'\\\\<^sub>\\* pex'\"\n by(fastforce intro:path_Append simp:intra_path_def)\n from `n' \\ set(sourcenodes as)` `n' \\ set (sourcenodes as')`\n have \"n' \\ set (sourcenodes (as@as'))\"\n by(simp add:sourcenodes_def)\n with `n -as@as'\\\\<^sub>\\* pex'` `method_exit pex'` `n' postdominates n`\n show False by(fastforce simp:postdominate_def)\n qed\n with `valid_node n'` `valid_node n''`\n show ?thesis by(auto simp:postdominate_def)\nqed\n\n\nlemma not_postdominate_source_not_postdominate_target:\n assumes \"\\ n postdominates (sourcenode a)\" \n and \"valid_node n\" and \"valid_edge a\" and \"intra_kind (kind a)\"\n obtains ax where \"sourcenode a = sourcenode ax\" and \"valid_edge ax\"\n and \"\\ n postdominates targetnode ax\"\nproof(atomize_elim)\n show \"\\ax. sourcenode a = sourcenode ax \\ valid_edge ax \\ \n \\ n postdominates targetnode ax\"\n proof -\n from assms obtain asx pex \n where \"sourcenode a -asx\\\\<^sub>\\* pex\" and \"method_exit pex\"\n and \"n \\ set(sourcenodes asx)\" by(fastforce simp:postdominate_def)\n show ?thesis\n proof(cases asx)\n case Nil\n with `sourcenode a -asx\\\\<^sub>\\* pex` have \"pex = sourcenode a\"\n by(fastforce simp:intra_path_def)\n with `method_exit pex` have \"method_exit (sourcenode a)\" by simp\n thus ?thesis\n proof(rule method_exit_cases)\n assume \"sourcenode a = (_Exit_)\"\n with `valid_edge a` have False by(rule Exit_source)\n thus ?thesis by simp\n next\n fix a' Q f p assume \"sourcenode a = sourcenode a'\"\n and \"valid_edge a'\" and \"kind a' = Q\\\\<^bsub>p\\<^esub>f\"\n hence False using `intra_kind (kind a)` `valid_edge a`\n by(fastforce dest:return_edges_only simp:intra_kind_def)\n thus ?thesis by simp\n qed\n next\n case (Cons ax asx')\n with `sourcenode a -asx\\\\<^sub>\\* pex`\n have \"sourcenode a -[]@ax#asx'\\* pex\" \n and \"\\a \\ set (ax#asx'). intra_kind (kind a)\" by(simp_all add:intra_path_def)\n from `sourcenode a -[]@ax#asx'\\* pex`\n have \"sourcenode a = sourcenode ax\" and \"valid_edge ax\"\n and \"targetnode ax -asx'\\* pex\" by(fastforce dest:path_split)+\n with `\\a \\ set (ax#asx'). intra_kind (kind a)`\n have \"targetnode ax -asx'\\\\<^sub>\\* pex\" by(simp add:intra_path_def)\n with `n \\ set(sourcenodes asx)` Cons `method_exit pex`\n have \"\\ n postdominates targetnode ax\"\n by(fastforce simp:postdominate_def sourcenodes_def) \n with `sourcenode a = sourcenode ax` `valid_edge ax` show ?thesis by blast\n qed\n qed\nqed\n\n\nlemma inner_node_Exit_edge:\n assumes \"inner_node n\" \n obtains a where \"valid_edge a\" and \"intra_kind (kind a)\" \n and \"inner_node (sourcenode a)\" and \"targetnode a = (_Exit_)\"\nproof(atomize_elim)\n from `inner_node n` have \"valid_node n\" by(rule inner_is_valid)\n then obtain as where \"n -as\\\\<^sub>\\* (_Exit_)\" by(fastforce dest:Exit_path)\n show \"\\a. valid_edge a \\ intra_kind (kind a) \\ inner_node (sourcenode a) \\ \n targetnode a = (_Exit_)\"\n proof(cases \"as = []\")\n case True\n with `inner_node n` `n -as\\\\<^sub>\\* (_Exit_)` have False by(fastforce simp:vp_def)\n thus ?thesis by simp\n next\n case False\n with `n -as\\\\<^sub>\\* (_Exit_)` obtain a' as' where \"as = as'@[a']\" \n and \"n -as'\\\\<^sub>\\* sourcenode a'\" and \"valid_edge a'\" \n and \"(_Exit_) = targetnode a'\" by -(erule vp_split_snoc)\n from `valid_edge a'` have \"valid_node (sourcenode a')\" by simp\n thus ?thesis\n proof(cases \"sourcenode a'\" rule:valid_node_cases)\n case Entry\n with `n -as'\\\\<^sub>\\* sourcenode a'` have \"n -as'\\* (_Entry_)\" by(simp add:vp_def)\n with `inner_node n`\n have False by -(drule path_Entry_target,auto simp:inner_node_def)\n thus ?thesis by simp\n next\n case Exit\n from `valid_edge a'` this have False by(rule Exit_source)\n thus ?thesis by simp\n next\n case inner\n have \"intra_kind (kind a')\"\n proof(cases \"kind a'\" rule:edge_kind_cases)\n case Intra thus ?thesis by simp\n next\n case (Call Q r p fs)\n with `valid_edge a'` have \"get_proc(targetnode a') = p\" by(rule get_proc_call)\n with `(_Exit_) = targetnode a'` get_proc_Exit have \"p = Main\" by simp\n with `kind a' = Q:r\\\\<^bsub>p\\<^esub>fs` have \"kind a' = Q:r\\\\<^bsub>Main\\<^esub>fs\" by simp\n with `valid_edge a'` have False by(rule Main_no_call_target)\n thus ?thesis by simp\n next\n case (Return Q p f)\n from `valid_edge a'` `kind a' = Q\\\\<^bsub>p\\<^esub>f` `(_Exit_) = targetnode a'`[THEN sym]\n have False by(rule Exit_no_return_target)\n thus ?thesis by simp\n qed\n with `valid_edge a'` `(_Exit_) = targetnode a'` `inner_node (sourcenode a')` \n show ?thesis by simp blast\n qed\n qed\nqed\n\n\nlemma inner_node_Entry_edge:\n assumes \"inner_node n\" \n obtains a where \"valid_edge a\" and \"intra_kind (kind a)\" \n and \"inner_node (targetnode a)\" and \"sourcenode a = (_Entry_)\"\nproof(atomize_elim)\n from `inner_node n` have \"valid_node n\" by(rule inner_is_valid)\n then obtain as where \"(_Entry_) -as\\\\<^sub>\\* n\" by(fastforce dest:Entry_path)\n show \"\\a. valid_edge a \\ intra_kind (kind a) \\ inner_node (targetnode a) \\ \n sourcenode a = (_Entry_)\"\n proof(cases \"as = []\")\n case True\n with `inner_node n` `(_Entry_) -as\\\\<^sub>\\* n` have False\n by(fastforce simp:inner_node_def vp_def)\n thus ?thesis by simp\n next\n case False\n with `(_Entry_) -as\\\\<^sub>\\* n` obtain a' as' where \"as = a'#as'\" \n and \"targetnode a' -as'\\\\<^sub>\\* n\" and \"valid_edge a'\" \n and \"(_Entry_) = sourcenode a'\" by -(erule vp_split_Cons)\n from `valid_edge a'` have \"valid_node (targetnode a')\" by simp\n thus ?thesis\n proof(cases \"targetnode a'\" rule:valid_node_cases)\n case Entry\n from `valid_edge a'` this have False by(rule Entry_target)\n thus ?thesis by simp\n next\n case Exit\n with `targetnode a' -as'\\\\<^sub>\\* n` have \"(_Exit_) -as'\\* n\" by(simp add:vp_def)\n with `inner_node n`\n have False by -(drule path_Exit_source,auto simp:inner_node_def)\n thus ?thesis by simp\n next\n case inner\n have \"intra_kind (kind a')\"\n proof(cases \"kind a'\" rule:edge_kind_cases)\n case Intra thus ?thesis by simp\n next\n case (Call Q r p fs)\n from `valid_edge a'` `kind a' = Q:r\\\\<^bsub>p\\<^esub>fs` \n `(_Entry_) = sourcenode a'`[THEN sym]\n have False by(rule Entry_no_call_source)\n thus ?thesis by simp\n next\n case (Return Q p f)\n with `valid_edge a'` have \"get_proc(sourcenode a') = p\" \n by(rule get_proc_return)\n with `(_Entry_) = sourcenode a'` get_proc_Entry have \"p = Main\" by simp\n with `kind a' = Q\\\\<^bsub>p\\<^esub>f` have \"kind a' = Q\\\\<^bsub>Main\\<^esub>f\" by simp\n with `valid_edge a'` have False by(rule Main_no_return_source)\n thus ?thesis by simp\n qed\n with `valid_edge a'` `(_Entry_) = sourcenode a'` `inner_node (targetnode a')` \n show ?thesis by simp blast\n qed\n qed\nqed\n\n\nlemma intra_path_to_matching_method_exit:\n assumes \"method_exit n'\" and \"get_proc n = get_proc n'\" and \"valid_node n\"\n obtains as where \"n -as\\\\<^sub>\\* n'\"\nproof(atomize_elim)\n from `valid_node n` obtain as' where \"n -as'\\\\<^sub>\\* (_Exit_)\"\n by(fastforce dest:Exit_path)\n then obtain as mex where \"n -as\\\\<^sub>\\* mex\" and \"method_exit mex\"\n by(fastforce elim:valid_Exit_path_intra_path)\n from `n -as\\\\<^sub>\\* mex` have \"get_proc n = get_proc mex\" \n by(rule intra_path_get_procs)\n with `method_exit n'` `get_proc n = get_proc n'` `method_exit mex`\n have \"mex = n'\" by(fastforce intro:method_exit_unique)\n with `n -as\\\\<^sub>\\* mex` show \"\\as. n -as\\\\<^sub>\\* n'\" by fastforce\nqed\n\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/StaticInter/Postdomination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.33458943461801643, "lm_q1q2_score": 0.1686016806978548}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__40.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__40 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__40 and some rule r*}\nlemma n_PI_Local_Get_GetVsinv__40:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_PutVsinv__40:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__40:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__40:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__40:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__40:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__40:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__40:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__40:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__40:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__40:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__40:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__40:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__40:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__40:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__40 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__40:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__40:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__40:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__40:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__40:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__40:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__40:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__40:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__40:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__40:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__40:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10Vsinv__40:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__40:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__40:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__40:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__40:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__40:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__40:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__40:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(f=inv__40 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__40.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.32423541204073586, "lm_q1q2_score": 0.16844720988708464}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__24.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__24 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__24 and some rule r*}\nlemma n_SendInv__part__0Vsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const GntS))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__24:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__24 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__24:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__24:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__24:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__24:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__24:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__24:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__24 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__24.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3242354055108441, "lm_q1q2_score": 0.16844720649466668}} {"text": "theory HoareTripleForInstructions2\n\nimports Main \"./HoareTripleForInstructions\"\n\"./HoareTripleForStorage\"\n\nbegin\n\nlemma memory_range_elms_in_minus_action [simp] :\n \"memory_range_elms data_start data\n \\ X - {ContractActionElm a} =\n (memory_range_elms data_start data \\ X)\" \n by (auto dest: stateelm_dest)\n\nlemma stack_topmost_in_minus_code [simp] :\n \"stack_topmost_elms h lst\n \\ X - {CodeElm p} =\n (stack_topmost_elms h lst \\ X)\"\n by (auto dest: stateelm_dest)\n\nlemma stack_topmost_in_minus_action [simp] :\n \"stack_topmost_elms h lst\n \\ X - {ContractActionElm a} =\n (stack_topmost_elms h lst \\ X)\"\n by (auto dest: stateelm_dest)\n\n(* not correct anymore, new memory usage is calculated\nlemma return_gas_triple:\n \"triple {OutOfGas}\n (\\ h \\ 1022 \\ length data = unat data_size \\ **\n memory_range data_start data **\n gas_pred g **\n stack_topmost h [data_size, data_start] ** program_counter k **\n continuing)\n {(k, Misc RETURN)}\n ( memory_range data_start data ** stack_topmost h [data_size, data_start] **\n program_counter k ** not_continuing ** action (ContractReturn data) ** gas_any)\"\napply(simp add: triple_def)\napply(clarify)\napply(rule_tac x = \"1\" in exI)\napply(clarify)\napply(case_tac presult; auto simp add: ret_def not_continuing_def action_def\n instruction_result_as_set_def stack_as_set_def ext_program_as_set_def sep_memory_range\n sep_memory_range_sep vctx_returned_bytes_def)\n apply(rename_tac elm)\n apply(case_tac elm; simp)\n apply(rule leibniz)\n apply blast\n apply(rule Set.equalityI; clarify)\n apply(rename_tac elm)\n apply(case_tac elm; simp)\n apply(rename_tac elm)\n apply(case_tac elm; simp)\n apply(rule leibniz)\n apply blast\n apply(rule Set.equalityI; clarify)\n apply(rename_tac elm)\n apply(case_tac elm; simp)\n apply(rename_tac elm)\n apply(case_tac elm; simp)\napply(split if_splits; auto)\ndone\n*)\n\n\nlemma pos_length_head_exists [simp] :\n \"n < length lst \\\n index lst 0 = Some (lst ! 0)\"\napply(case_tac lst; auto)\ndone\n\nlemma rev_lookup :\n \"k < length lst \\\n rev lst ! (length lst - Suc k) = lst ! k\"\napply(simp add: List.rev_nth)\ndone\n\n\nlemma list_swap_usage :\n \"n < length lst \\\n rev lst ! (length lst - Suc 0) = w \\\n rev lst ! (length lst - Suc n) = v \\\n list_swap n lst = Some ([v] @ take (n - 1) (drop 1 lst) @ [w] @ (drop (n + 1) lst))\"\napply(subgoal_tac \"0 < length lst\")\n apply(simp add: rev_lookup list_swap_def)\napply auto\n done\n\nlemma triv_if_eq:\n \"(if (w::w256) = 0 then word_of_int 1 else word_of_int 0) = (if w = 0 then 1 else 0)\"\n by simp\n\nlemma vctx_pc_stack_oblivious:\n \"vctx_pc (x1\\vctx_stack := s\\) = vctx_pc x1\"\nby simp\n\n\nlemma advance_pc_stack_oblivious:\n \"vctx_pc (vctx_advance_pc co_ctx (x1\\vctx_stack := s\\)) = \n vctx_pc (vctx_advance_pc co_ctx x1) \n \"\nusing vctx_advance_pc_def vctx_next_instruction_def vctx_pc_stack_oblivious apply auto\nby(case_tac \"program_content (cctx_program co_ctx) (vctx_pc x1)\"; auto)\n\n\nlemma iszero_gas_triple :\n notes if_split[split del]\n shows\n \"triple net {OutOfGas} (\\ h \\ 1023 \\ **\n stack_height (Suc h) **\n stack h w **\n program_counter k **\n gas_pred g **\n continuing\n )\n\n {(k, Arith ISZERO)}\n (stack_height (Suc h) **\n stack h (if w = 0 then 1 else 0) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\"\n apply (auto simp add: triple_def)\n apply(rule_tac x = 1 in exI)\n apply(simp add: program_sem.simps)\n apply(case_tac presult; (solves \\(hoare_sep sep: evm_sep simp: stateelm_means_simps dest: stateelm_dest)\\)?)\n apply clarsimp\n apply(hoare_sep sep: evm_sep \n simp: instruction_result_as_set_def sstore_def\n vctx_update_storage_def hoare_simps set_diff_eq\n dest: advance_pc_inc_but_stack\n split:if_split_asm)\n apply (drule advance_pc_inc_but_stack)\n apply (simp add: image_def)\n apply (simp add: triv_if_eq advance_pc_stack_oblivious)\n apply(erule_tac P=rest in back_subst)\n apply simp\n apply(rename_tac presult t) \n apply(rule Set.equalityI; clarify)\n apply(simp)\n apply(rename_tac elm)\n apply(case_tac elm; simp add: hoare_simps split:if_splits prod.splits)\n apply(rename_tac p)\n apply(case_tac p; fastforce)\n apply(rename_tac p)\n apply(simp)\n apply(rename_tac elm)\n apply(case_tac elm; simp add: hoare_simps advance_pc_stack_oblivious split:if_splits)\n apply auto\n done\n\nlemma tmp001:\n\"length lst = h \\\nSuc (unat n) < h \\\nunat n \\ length (drop 1 lst)\"\napply auto\ndone\n\nlemma tmp000: \"\na \\ h - Suc 0 \\ \\ a < h - Suc (Suc (unat n)) \\ a \\ h - Suc (Suc (unat n)) \\ \na < h \\ (Suc (a + unat n) - h) < unat n\n\"\napply auto\ndone\n\nlemma tmp002:\n \"a \\ h - Suc 0 \\ a < h\n \\ Suc (h - Suc (Suc a)) = h - Suc a\"\napply auto\ndone\n\n\nlemma take_drop_nth [simp] :\n \"length (vctx_stack x1) = h \\\n Suc (unat n) < h \\\n a \\ h - Suc 0 \\ \\ a < h - Suc (Suc (unat n)) \\ a \\ h - Suc (Suc (unat n)) \\\n a < h \\\n rev (take (unat n) (drop (Suc 0) (vctx_stack x1))) ! (Suc (a + unat n) - h) = rev (vctx_stack x1) ! a\"\n apply(simp add: tmp000 tmp001 tmp002 List.rev_nth min_absorb2)\n done\n \ncontext\n includes hoare_bundle hoare_inst_bundle\n simp_for_triples_bundle sep_crunch_bundle\nbegin\n \nlemma swap_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1024 \\ Suc (unat n) < h \\ **\n stack_height h **\n stack (h - 1) w **\n stack (h - (unat n) - 2) v **\n program_counter k **\n gas_pred g **\n continuing\n )\n\n {(k, Swap n)}\n (stack_height h **\n stack (h - 1) v **\n stack (h - (unat n) - 2) w **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\"\n apply(simp add: triple_def set_diff_eq)\napply clarify\napply(rule_tac x = 1 in exI)\napply(case_tac presult)\n defer\n apply(simp add: instruction_result_as_set_def)\n apply(simp add: instruction_result_as_set_def)\napply(simp add: swap_def list_swap_usage swap_inst_numbers_def)\napply(rule impI)\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(simp add: Set.subset_iff)\n apply(rule allI)\n apply(rename_tac elm)\n apply(case_tac elm; simp add: instruction_result_as_set_def)\n\n apply(rename_tac pair)\n apply(case_tac pair; simp)\n apply(case_tac \"a = h - Suc 0\"; simp)\n apply blast\n apply(case_tac \"a < h - Suc (Suc (unat n))\"; simp)\n\n apply(case_tac \"a = h - Suc (Suc (unat n))\"; simp)\n apply blast\n apply auto[1]\n apply(simp add: as_set_simps)\napply(simp add: Set.subset_iff)\napply(rule allI)\napply(rename_tac elm)\napply(case_tac elm; simp add: instruction_result_as_set_def)\n apply(rename_tac pair; case_tac pair)\n apply simp\n apply(case_tac \"a = h - Suc 0\"; simp)\n using rev_nth tmp002 apply auto[1]\n apply(case_tac \"a < h - Suc 0\"; simp)\n apply(case_tac \"a = h - Suc (Suc (unat n))\"; simp)\n apply blast\n apply(case_tac \"a < h - Suc (Suc (unat n))\"; simp)\n apply(simp add: tmp000 tmp001 tmp002 List.rev_nth)\n apply linarith\n apply(simp add: as_set_simps)\ndone \n \n(* lemma imp_neq_sym:\n \"(P \\ A \\ B) \\ (P \\ B \\ A)\"\n by blast\n \nlemma swap_gas_triple1 :\nshows\n \"triple net {OutOfGas} (\\ h \\ 1024 \\ Suc (unat n) < h \\ **\n stack_height h **\n stack (h - 1) w **\n stack (h - (unat n) - 2) v **\n program_counter k **\n gas_pred g **\n continuing\n )\n\n {(k, Swap n)}\n (stack_height h **\n stack (h - 1) v **\n stack (h - (unat n) - 2) w **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\" \n apply(simp add: triple_def)\n apply clarify\n apply(rule_tac x = 1 in exI)\n apply clarsimp\n apply(case_tac presult)\n defer\n apply (hoare_sep sep: evm_sep)\n apply (hoare_sep sep: evm_sep)\n apply (hoare_sep sep: evm_sep)\n\n apply (simp add: program_sem.simps instruction_result_as_set_def next_state_def\n vctx_next_instruction_def stateelm_means_simps stateelm_equiv_simps\n instruction_sem_def check_resources_def inst_numbers_simps new_memory_consumption.simps)\n apply (simp add: swap_def list_swap_usage swap_inst_numbers_def meter_gas_def\n HoareTripleForInstructions_legacy_simps(4) gas_value_simps advance_pc_no_gas_change\n subtract_gas.simps stateelm_means_simps stateelm_equiv_simps new_memory_consumption.simps\n )\n apply (clarsimp split:if_split_asm)\n apply (clarsimp simp: next_state_def instruction_sem_simps\n gas_value_simps advance_pc_no_gas_change\n inst_numbers_simps split_def\n )\n apply (rule conjI)\n\n (* here *)\n apply (erule_tac P=rest in back_subst)\n apply(rule Set.equalityI)\n apply (simp add: set_diff_eq)\n apply clarsimp\n apply(rename_tac elm)\n apply (case_tac elm; simp add: hoare_simps rev_nth_simps suc_minus_two min_absorb2 saying_zero split:if_splits) \n apply(rename_tac pair)\n apply (case_tac pair; simp add: hoare_simps rev_nth_simps suc_minus_two min_absorb2 saying_zero split:if_splits) \n apply (clarsimp)\n apply (rule conjI)+\n apply (clarsimp simp add: hoare_simps rev_nth_simps suc_minus_two min_absorb2 saying_zero)\n\n apply(case_tac \"aa = h - Suc 0\"; simp add: Hoare_legacy_simps HoareTripleForInstructions_legacy_simps)\n apply \n apply(case_tac \"aa < h - Suc (Suc (unat n))\"; simp add: Hoare_legacy_simps HoareTripleForInstructions_legacy_simps)\nfind_theorems rev length nth\n apply(case_tac \"aa = h - Suc (Suc (unat n))\"; simp add: Hoare_legacy_simps HoareTripleForInstructions_legacy_simps)\n apply blast\napply auto[1]\napply(simp add: Set.subset_iff)\napply(rule allI)\napply(rename_tac elm)\napply(case_tac elm; simp add: instruction_result_as_set_def)\n apply(rename_tac pair; case_tac pair)\n apply simp\n apply(case_tac \"a = h - Suc 0\"; simp)\n using rev_nth tmp002 apply auto[1]\n apply(case_tac \"a < h - Suc 0\"; simp)\n apply(case_tac \"a = h - Suc (Suc (unat n))\"; simp)\n apply blast\n apply(case_tac \"a < h - Suc (Suc (unat n))\"; simp)\n apply(simp add: tmp000 tmp001 tmp002 List.rev_nth)\n apply linarith\ndone *)\n\n\nlemma reverse_lookup[simp] :\n \"n < length lst \\\n rev lst ! (length lst - Suc n) = lst ! n\n \"\n using nth_rev_alt by fastforce\n\nlemma deep_lookup [simp] :\n \"w = rev (vctx_stack x1) ! (length (vctx_stack x1) - Suc (unat n)) \\\n unat n < length (vctx_stack x1) \\\n index (vctx_stack x1) (unat n) = Some w\"\napply(simp)\ndone\n\nlemma dup_advance [simp] :\n\" program_content (cctx_program co_ctx) (vctx_pc x1) = Some (Dup n) \\\n k = vctx_pc x1 \\\n vctx_pc (vctx_advance_pc co_ctx x1) = vctx_pc x1 + 1\n\"\napply(simp add: vctx_advance_pc_def inst_size_def inst_code.simps)\ndone\n\nlemma dup_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1023 \\ unat n < h \\ **\n stack_height h **\n stack (h - (unat n) - 1) w **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Dup n)}\n (stack_height (h + 1) **\n stack (h - (unat n) - 1) w **\n stack h w **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n account_existence c existence **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp)\napply(clarsimp simp add:instruction_result_as_set_def )\napply(rule conjI, fastforce)+\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarify)\n apply(simp)\n apply(rename_tac elm; case_tac elm; simp)\n apply clarsimp+\n apply(simp add: as_set_simps)\napply(rename_tac elm; case_tac elm; simp)\napply(auto simp add: as_set_simps)\ndone\n\n\nlemma address_gas_triple :\n \"triple net {OutOfGas}\n (\\ h \\ 1023 \\ ** stack_height h ** program_counter k ** this_account t ** gas_pred g ** account_existence c existence **continuing)\n {(k, Info ADDRESS)}\n (stack_height (h + 1) ** stack h (ucast t)\n ** program_counter (k + 1) ** this_account t ** gas_pred (g - Gbase) ** account_existence c existence **continuing )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\n apply(case_tac presult; simp add: instruction_result_as_set_def)\napply clarsimp\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarify)\n apply(simp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(clarsimp)+\n apply(simp add: as_set_simps)\napply(rename_tac elm; case_tac elm; simp)\napply(auto simp add: as_set_simps)\ndone\n\n\nlemma push_advance [simp] :\n\" vctx_pc x1 = k \\\n lst \\ [] \\\n length lst \\ 32 \\\n program_content (cctx_program co_ctx) k = Some (Stack (PUSH_N lst)) \\\n vctx_pc (vctx_advance_pc co_ctx x1) = k + 1 + (int (length lst))\"\napply(simp add: vctx_advance_pc_def inst_size_def inst_code.simps stack_inst_code.simps)\ndone\n\n\n\nlemma push_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1023 \\ length lst > 0 \\ 32 \\ length lst\\ **\n stack_height h **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Stack (PUSH_N lst))}\n (stack_height (h + 1) **\n stack h (word_rcat lst) **\n program_counter (k + 1 + (int (length lst))) **\n gas_pred (g - Gverylow) **\n account_existence c existence **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp add: instruction_result_as_set_def constant_mark_def)\napply clarify\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarsimp)+\napply(rename_tac elm; case_tac elm; simp)\n apply(clarsimp)+\n apply(simp add: as_set_simps)\napply(rename_tac elm; case_tac elm; simp)\napply(auto simp add: as_set_simps)\ndone\n\n\nlemma jumpi_size [simp] :\n \"inst_size (Pc JUMPI) = 1\"\napply(simp add: inst_size_def inst_code.simps)\ndone\n\nlemma jumpi_false_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1022 \\ **\n stack_height (h + 2) **\n stack (h + 1) d **\n stack h 0 **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Pc JUMPI)}\n (stack_height h **\n program_counter (k + 1) **\n gas_pred (g - Ghigh) **\n account_existence c existence **\n continuing)\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(simp add: instruction_result_as_set_def)\napply(case_tac presult; simp)\napply(clarsimp simp add: insert_minus_set vctx_advance_pc_def)\napply(erule_tac P=rest in back_subst)\napply(auto simp add: stack_as_set_def)\ndone\n\nlemma jumpi_true_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1022 \\ cond \\ 0 \\ **\n stack_height (h + 2) **\n stack (h + 1) d **\n stack h cond **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Pc JUMPI), ((uint d), Pc JUMPDEST)}\n (stack_height h **\n program_counter (uint d) **\n gas_pred (g - Ghigh) **\n account_existence c existence **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp )\napply(clarsimp simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\napply(auto simp add: stack_as_set_def)\ndone\n\n\nlemma jump_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1023 \\ **\n stack_height (h + 1) **\n stack h d **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Pc JUMP), ((uint d), Pc JUMPDEST)}\n (stack_height h **\n program_counter (uint d) **\n gas_pred (g - Gmid) **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp )\napply(auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\napply(auto simp add: stack_as_set_def)\ndone\n\ndeclare jump_def [simp del]\n\n\nlemma invalid_jump [simp] :\n \"program_content (cctx_program co_ctx) (uint d) = Some i \\\n i \\ Pc JUMPDEST \\\n g = vctx_gas v \\\n vctx_stack v = d # t \\\n jump v co_ctx = instruction_failure_result v [InvalidJumpDestination]\"\napply(simp add: jump_def)\napply(case_tac i; simp)\napply(rename_tac j; case_tac j; simp)\ndone\n\nlemma invalid_jump2 [simp] :\n \"program_content (cctx_program co_ctx) (uint d) = None \\\n g = vctx_gas v \\\n vctx_stack v = d # t \\\n jump v co_ctx = instruction_failure_result v [InvalidJumpDestination]\"\napply(simp add: jump_def)\ndone\n\nlemma notin_diff [simp] :\n \"x \\ A - B =\n (x \\ A \\ x \\ B)\"\n by blast\n\nlemma stack_elm_append [dest] :\n \"x = StackElm (idx, lst ! idx) \\\n x \\ contexts_as_set x1 co_ctx \\\n (idx < length (vctx_stack x1) \\ rev (vctx_stack x1) ! idx = lst ! idx)\"\napply(simp add: contexts_as_set_def)\ndone\n\nlemma not_appended [dest] :\n \"(rev ta @ [cond, d]) ! aa \\ cond \\\n aa \\ length ta\n \"\napply(auto)\ndone\n\nlemma not_first [simp] :\n \"((cond # lst) ! n \\ cond) = ((n \\ 0) \\ lst ! (n - 1) \\ cond)\"\napply(case_tac n; auto)\ndone\n\nlemma invalid_jumpi_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1022 \\ cond \\ 0 \\ i \\ Pc JUMPDEST \\ **\n stack_height (h + 2) **\n stack (h + 1) d **\n stack h cond **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Pc JUMPI), ((uint d), i)}\n (stack_height (h + 1) **\n stack h d **\n program_counter k **\n gas_pred (g - Ghigh) **\n not_continuing **\n action (ContractFail [InvalidJumpDestination])\n )\"\napply(auto simp add: triple_def set_diff_eq)\n apply(rule_tac x = 1 in exI)\n apply(case_tac presult; simp )\napply (auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\n apply(auto simp add: stack_as_set_def)[1]\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarify)\n apply(simp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(rename_tac pair; case_tac pair; simp)\n apply(auto simp add: stack_as_set_def)\ndone\n\n\nlemma invalid_jump_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1023 \\ i \\ Pc JUMPDEST\\ **\n stack_height (h + 1) **\n stack h d **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Pc JUMP), ((uint d), i)}\n (stack_height (h + 1) **\n stack h d **\n program_counter k **\n gas_pred (g - Gmid) **\n not_continuing **\n action (ContractFail [InvalidJumpDestination])\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\n apply(case_tac presult; simp)\n apply (auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\n apply(auto)\napply(erule_tac P=rest in back_subst)\napply auto\ndone\n\nlemma jumpdest_advance [simp] :\n \"k = vctx_pc x1 \\\n program_content (cctx_program co_ctx) (vctx_pc x1) = Some (Pc JUMPDEST) \\\n vctx_pc (vctx_advance_pc co_ctx x1) = vctx_pc x1 + 1\"\napply(simp add: vctx_advance_pc_def inst_size_def inst_code.simps)\ndone\n\nlemma storage_continue [simp] :\n \"StorageElm x3\n \\ instruction_result_as_set co_ctx (InstructionContinue x1) =\n (StorageElm x3 \\ variable_ctx_as_set x1)\"\napply(simp add: instruction_result_as_set_def)\ndone\n\nlemma memory_continue [simp] :\n \"MemoryElm x4\n \\ instruction_result_as_set co_ctx (InstructionContinue x1) =\n (MemoryElm x4 \\ variable_ctx_as_set x1)\"\napply(simp only: instruction_result_as_set_def)\napply(simp)\ndone\n\nlemma union_cong :\n \"a = b \\ c = d \\ a \\ c = b \\ d\"\napply(simp)\ndone\n\n\n\nlemma jumpdest_gas_triple :\n \"triple net {OutOfGas} (\\ h \\ 1024 \\ **\n stack_height h **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Pc JUMPDEST)}\n (stack_height h **\n program_counter (k + 1) **\n gas_pred (g - Gjumpdest) **\n account_existence c existence **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp add: instruction_result_as_set_def)\n\napply(clarify)\napply(erule_tac P=rest in back_subst)\napply(simp add: instruction_result_as_set_def contexts_as_set_def)\napply(rule Set.equalityI)\n apply(clarsimp)+\n apply(rename_tac elm; case_tac elm; simp)\n apply clarsimp+\napply(rename_tac elm; case_tac elm; clarsimp)\ndone \n\nlemma pop_gas_triple : \"triple net {OutOfGas} (\\ h \\ 1024 \\ **\n stack_height (h + 1) **\n stack h v **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Stack POP)}\n (stack_height h **\n program_counter (k + 1) **\n gas_pred (g - Gbase) **\n continuing\n )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(case_tac presult; simp)\n apply(case_tac \"vctx_stack x1\"; simp)\n apply clarify\n apply(erule_tac P=rest in back_subst)\n apply(auto simp add: instruction_result_as_set_def)\n apply(auto simp add: vctx_advance_pc_def contexts_as_set_def \n variable_ctx_as_set_def ext_program_as_set_def balance_as_set_def)\ndone\n\nlemma balance_gas_triple :\n \"triple net {OutOfGas}\n (\\ h \\ 1023 \\ unat bn \\ 2463000 \\ at_least_eip150 net\\\n ** block_number_pred bn ** stack_height (h + 1) ** stack h a\n ** program_counter k ** balance (ucast a) b ** gas_pred g ** account_existence c existence **continuing)\n {(k, Info BALANCE)}\n (block_number_pred bn ** stack_height (h + 1) ** stack h b\n ** program_counter (k + 1) ** balance (ucast a) b ** gas_pred (g - 400) ** account_existence c existence **continuing )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\napply(simp)\napply(case_tac presult; simp)\napply(case_tac \"vctx_stack x1\"; simp)\n apply clarify\napply (rule conjI, fastforce simp: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\napply(simp add: instruction_result_as_set_def)\napply(rule Set.equalityI)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(case_tac x2; simp)\n apply(case_tac \"aa = length list\"; simp)\napply(clarsimp)+\n apply(rename_tac elm; case_tac elm; simp)\n apply(auto simp add: as_set_simps)\ndone\n\n(*\nlemma eq0 [simp]: \"\n vctx_stack x1 = v # w # ta \\\nprogram_content (cctx_program co_ctx) (vctx_pc x1) = Some (Arith inst_EQ) \\\n (insert (GasElm (vctx_gas x1 - Gverylow))\n (insert (ContinuingElm True)\n (contexts_as_set (vctx_advance_pc co_ctx x1) co_ctx - stack_as_set (v # w # ta) \\ stack_as_set (r # ta) -\n {GasElm (vctx_gas x1)})) -\n {StackHeightElm (Suc (length ta))} -\n {StackElm (length ta, r)} -\n {PcElm (vctx_pc x1 + 1)} -\n {GasElm (vctx_gas x1 - Gverylow)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Arith inst_EQ)}) =\n (insert (ContinuingElm True) (contexts_as_set x1 co_ctx) - {StackHeightElm (Suc (Suc (length ta)))} -\n {StackElm (Suc (length ta), v)} -\n {StackElm (length ta, w)} -\n {PcElm (vctx_pc x1)} -\n {GasElm (vctx_gas x1)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Arith inst_EQ)})\n\"\napply(auto)\n apply(rename_tac elm; case_tac elm; auto)\n apply(rename_tac elm; case_tac elm; auto)\napply(rename_tac elm; case_tac elm; auto)\ndone\n*)\n\nlemma eq_gas_triple :\n \"triple net {OutOfGas} ( \\ h \\ 1023 \\ **\n stack_height (h + 2) **\n stack (h + 1) v **\n stack h w **\n program_counter k **\n gas_pred g **\n account_existence c existence **\n continuing\n )\n {(k, Arith inst_EQ)}\n ( stack_height (h + 1) **\n stack h (if v = w then((word_of_int 1) :: 256 word) else((word_of_int 0) :: 256 word)) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n account_existence c existence **\n continuing )\"\napply(auto simp add: triple_def set_diff_eq)\n apply(rule_tac x = 1 in exI)\n apply(simp add: instruction_result_as_set_def)\n apply(case_tac presult; simp)\n apply (clarsimp simp add: failed_for_reasons_def\n instruction_result_as_set_def)\n apply(erule_tac P=rest in back_subst)\n apply(rule Set.equalityI)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(case_tac \"fst x2 < length ta\"; simp)\n apply (case_tac x2; clarsimp)\n apply (metis (no_types, hide_lams) HoareTripleForInstructions.pair_snd_eq One_nat_def diff_diff_left diff_is_0_eq' length_Cons less_SucE less_Suc_eq_le list.size(4) nth_Cons_0 nth_non_equal_first_eq)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(simp add: as_set_simps)\n apply(simp add: as_set_simps)\n apply(auto simp add: as_set_simps)[1]\napply(rule_tac x = 1 in exI)\n apply(case_tac presult; simp)\n apply (clarsimp simp add: failed_for_reasons_def\n instruction_result_as_set_def)\n apply(erule_tac P=rest in back_subst)\n apply(rule Set.equalityI)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(case_tac \"fst x2 < length ta\"; simp)\n apply (case_tac x2; clarsimp)\n apply (metis (no_types, hide_lams) HoareTripleForInstructions.pair_snd_eq One_nat_def diff_diff_left diff_is_0_eq le_neq_implies_less length_Cons less_SucE list.size(4) not_less nth_Cons')\n\napply(clarsimp)\napply(rename_tac elm; case_tac elm; simp)\napply (auto simp add: as_set_simps)\ndone\n(*\nlemma tmp1 [simp]:\n \"program_content (cctx_program co_ctx) (vctx_pc x1) = Some (Arith ADD) \\\n vctx_stack x1 = v # w # ta \\\n (insert (GasElm (vctx_gas x1 - Gverylow))\n (insert (ContinuingElm True)\n (contexts_as_set (vctx_advance_pc co_ctx x1) co_ctx - stack_as_set (v # w # ta) \\ stack_as_set ((v + w) # ta) -\n {GasElm (vctx_gas x1)})) -\n {StackHeightElm (Suc (length ta))} -\n {StackElm (length ta, v + w)} -\n {PcElm (vctx_pc x1 + 1)} -\n {GasElm (vctx_gas x1 - Gverylow)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Arith ADD)}) =\n (insert (ContinuingElm True) (contexts_as_set x1 co_ctx) - {StackHeightElm (Suc (Suc (length ta)))} -\n {StackElm (Suc (length ta), v)} -\n {StackElm (length ta, w)} -\n {PcElm (vctx_pc x1)} -\n {GasElm (vctx_gas x1)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Arith ADD)})\"\napply(auto)\n apply(rename_tac elm; case_tac elm; auto)\n apply(rename_tac elm; case_tac elm; auto)\napply(rename_tac elm; case_tac elm; auto)\ndone\n*)\nlemma add_triple :\n \"triple net {}\n (\\ h \\ 1023 \\ g \\ Gverylow \\ **\n stack_height (h + 2) **\n stack (h + 1) v **\n stack h w **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Arith ADD)}\n (stack_height (h + 1) **\n stack h (v + w) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\"\napply(simp add: triple_def set_diff_eq)\napply(clarify)\napply(rule_tac x = \"1\" in exI)\n apply(case_tac presult; simp)\n apply (auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(case_tac \"fst x2 < length ta\"; simp)\n apply(case_tac \"fst x2 = length ta\"; simp)\n apply(case_tac \"fst x2 = Suc (length ta)\"; simp)\napply(clarsimp)\n apply(rename_tac elm; case_tac elm; clarsimp)\n apply (auto simp: as_set_simps)\ndone\n\n\nlemma add_gas_triple : \n \"triple net {OutOfGas} \n (\\ h \\ 1023\\ **\n stack_height (h + 2) **\n stack (h + 1) v **\n stack h w **\n program_counter k **\n gas_pred g **\n continuing\n )\n\n {(k, Arith ADD)}\n\n (stack_height (h + 1) **\n stack h (v + w) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\"\napply(simp add: triple_def set_diff_eq)\napply(clarify)\napply(rule_tac x = \"1\" in exI)\napply(case_tac presult; auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\napply(rule Set.equalityI)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; simp)\n apply(case_tac \"fst x2 < length ta\"; simp)\n apply(case_tac \"fst x2 = length ta\"; simp)\n apply(case_tac \"fst x2 = Suc (length ta)\"; simp)\napply(clarsimp)+\napply(rename_tac elm; case_tac elm; simp)\n apply(auto simp add: as_set_simps)\ndone\n\n\n\nlemma add_instance : \"triple net {} (\\ (h + 1) \\ 1023 \\ g \\ Gverylow \\ **\n stack_height ((h + 1) + 2) **\n stack ((h + 1) + 1) x **\n stack (h + 1) v **\n program_counter k **\n gas_pred g **\n continuing\n )\n ({(k, Arith ADD)})\n (stack_height ((h + 1) + 1) **\n stack (h + 1) (x + v) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing\n )\"\napply(rule add_triple)\ndone\n\nlemma add_extended : \"triple net {} ((\\ (h + 1) \\ 1023 \\ g \\ Gverylow \\ **\n stack_height ((h + 1) + 2) **\n stack ((h + 1) + 1) x **\n stack (h + 1) v **\n program_counter k **\n gas_pred g **\n continuing)\n ** stack h w\n )\n ({(k, Arith ADD)})\n ((stack_height ((h + 1) + 1) **\n stack (h + 1) (x + v) **\n program_counter (k + 1) **\n gas_pred (g - Gverylow) **\n continuing)\n ** stack h w\n )\"\napply(rule frame)\napply(rule add_instance)\ndone\n\n(*\nlemma addadd_triple :\n \"triple {} (\\ h \\ 1022 \\ g \\ 2 * Gverylow \\ **\n stack_height (Suc (Suc (Suc h))) **\n stack (h + 2) x **\n stack (h + 1) v **\n stack h w **\n program_counter k **\n gas_pred g **\n continuing\n )\n ({(k, Arith ADD)} \\ {(k + 1, Arith ADD)})\n (stack_height (h + 1) **\n stack h (x + v + w) **\n program_counter (2 + k) **\n gas_pred (g - 2 * Gverylow) **\n continuing\n )\"\n(* here the pure condition should be moved out *)\napply(auto)\napply(rule_tac cL = \"{(k, Arith ADD)}\" and cR = \"{(k + 1, Arith ADD)}\" in composition)\n apply(simp)\n defer\n apply(rule weaken_post)\n apply(rule_tac h = h and v = \"x + v\" and w = w and k = \"k + 1\" and g = \"g - Gverylow\" in add_triple)\n apply(auto)\napply(rule weaken_post)\n apply(rule strengthen_pre)\noops\n*)\n\nlemma pop1 [simp] :\n\"\nvctx_stack x1 = v # t \\\n(insert (GasElm (vctx_gas x1 - Gbase))\n (insert (ContinuingElm True)\n (insert (StackHeightElm (length t))\n (insert (PcElm (vctx_pc x1 + 1)) (contexts_as_set x1 co_ctx) - {PcElm (vctx_pc x1)} -\n insert (StackHeightElm (Suc (length t))) {StackElm (idx, (rev t @ [v]) ! idx) |idx. idx < Suc (length t)} \\\n {StackElm (idx, rev t ! idx) |idx. idx < length t}) -\n {GasElm (vctx_gas x1)})) -\n {StackHeightElm (length t)} -\n {PcElm (vctx_pc x1 + 1)} -\n {GasElm (vctx_gas x1 - Gbase)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Stack POP)}) =\n (insert (ContinuingElm True) (contexts_as_set x1 co_ctx) - {StackHeightElm (Suc (length t))} -\n {StackElm (length t, v)} -\n {PcElm (vctx_pc x1)} -\n {GasElm (vctx_gas x1)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Stack POP)})\n\"\napply(auto)\ndone\n\nlemma pop_triple : \"triple net {} (\\ h \\ 1024 \\ g \\ Gbase \\ **\n stack_height (h + 1) **\n stack h v **\n program_counter k **\n gas_pred g **\n continuing\n )\n {(k, Stack POP)}\n (stack_height h **\n program_counter (k + 1) **\n gas_pred (g - Gbase) **\n continuing\n )\"\napply(simp add: triple_def set_diff_eq)\napply(clarify)\napply(rule_tac x = \"1\" in exI)\napply(case_tac presult; simp)\napply(auto simp add: instruction_result_as_set_def)\napply(erule_tac P=rest in back_subst)\n apply(auto)\napply(auto simp add:\n vctx_advance_pc_def contexts_as_set_def variable_ctx_as_set_def\n ext_program_as_set_def balance_as_set_def)\ndone\n\ndeclare misc_inst_numbers.simps [simp]\nGzero_def [simp]\n\nlemma stop_gas_triple:\n \"triple net {OutOfGas}\n (\\ h \\ 1024 \\ ** stack_height h ** program_counter k ** account_existence c existence ** continuing)\n {(k, Misc STOP)}\n (stack_height h ** program_counter k ** account_existence c existence ** not_continuing ** action (ContractReturn []))\"\napply(simp add: triple_def set_diff_eq)\napply(clarify)\napply(rule_tac x = \"1\" in exI)\napply(clarify)\n apply(case_tac presult; simp)\n apply (auto simp add: stop_def not_continuing_def action_def\n instruction_result_as_set_def stack_as_set_def ext_program_as_set_def)\napply((erule_tac P=rest in back_subst)?, auto split: if_splits)+\ndone\n\n\nlemma caller0 [simp] :\n\" program_content (cctx_program co_ctx) (vctx_pc x1) = Some (Info CALLER) \\\n (insert (GasElm (vctx_gas x1 - Gbase))\n (insert (ContinuingElm True)\n (contexts_as_set (vctx_advance_pc co_ctx x1) co_ctx - stack_as_set (vctx_stack x1) \\\n stack_as_set (ucast (vctx_caller x1) # vctx_stack x1) -\n {GasElm (vctx_gas x1)})) -\n {StackHeightElm (Suc (length (vctx_stack x1)))} -\n {StackElm (length (vctx_stack x1), ucast (vctx_caller x1))} -\n {PcElm (vctx_pc x1 + 1)} -\n {CallerElm (vctx_caller x1)} -\n {GasElm (vctx_gas x1 - Gbase)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Info CALLER)}) =\n (insert (ContinuingElm True) (contexts_as_set x1 co_ctx) - {StackHeightElm (length (vctx_stack x1))} -\n {PcElm (vctx_pc x1)} -\n {CallerElm (vctx_caller x1)} -\n {GasElm (vctx_gas x1)} -\n {ContinuingElm True} -\n {CodeElm (vctx_pc x1, Info CALLER)})\n\"\napply(auto)\n apply(rename_tac elm; case_tac elm; auto simp add: stack_as_set_def)\n apply(rename_tac elm; case_tac elm; auto simp add: stack_as_set_def)\napply(rename_tac elm; case_tac elm; auto simp add: stack_as_set_def)\ndone\n\nlemma caller_gas_triple :\n \"triple net {OutOfGas}\n (\\ h \\ 1023 \\ ** stack_height h ** program_counter k ** caller c ** gas_pred g ** \naccount_existence c existence ** continuing)\n {(k, Info CALLER)}\n (stack_height (h + 1) ** stack h (ucast c)\n ** program_counter (k + 1) ** caller c ** gas_pred (g - Gbase) **\n account_existence c existence ** continuing )\"\napply(auto simp add: triple_def set_diff_eq)\napply(rule_tac x = 1 in exI)\n apply(case_tac presult; simp)\n apply (clarsimp simp add: instruction_result_as_set_def set_diff_eq)\n apply(erule_tac P=rest in back_subst)\n apply(clarsimp)\n apply(rename_tac elm; case_tac elm; auto simp add: as_set_simps)\ndone\n\nend\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Hoare/HoareTripleForInstructions2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.1684471997098308}} {"text": "(* Title: JinjaThreads/Execute/JVM_Execute2.thy\n Author: Andreas Lochbihler\n*)\n\ntheory JVM_Execute2\nimports\n SC_Schedulers\n JVMExec_Execute2\n \"../BV/BVProgressThreaded\"\nbegin\n\nabbreviation sc_heap_read_cset :: \"heap \\ addr \\ addr_loc \\ addr val set\"\nwhere \"sc_heap_read_cset h ad al \\ set_of_pred (sc_heap_read_i_i_i_o h ad al)\"\n\nabbreviation sc_heap_write_cset :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap set\"\nwhere \"sc_heap_write_cset h ad al v \\ set_of_pred (sc_heap_write_i_i_i_i_o h ad al v)\"\n\ninterpretation sc!: \n JVM_heap_execute\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read_cset\"\n \"sc_heap_write_cset\"\n for P\n where \"\\h ad al v. v \\ sc_heap_read_cset h ad al \\ sc_heap_read h ad al v\"\n and \"\\h ad al v h'. h' \\ sc_heap_write_cset h ad al v \\ sc_heap_write h ad al v h'\"\napply(simp_all add: eval_sc_heap_read_i_i_i_o eval_sc_heap_write_i_i_i_i_o)\ndone\n\ninterpretation sc!: \n JVM_heap_execute_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read_cset\"\n \"sc_heap_write_cset\"\n \"sc_hconf P\"\n \"P\"\n for P\n where \"\\h ad al v. v \\ sc_heap_read_cset h ad al \\ sc_heap_read h ad al v\"\n and \"\\h ad al v h'. h' \\ sc_heap_write_cset h ad al v \\ sc_heap_write h ad al v h'\"\nproof -\n show unfolds: \"\\h ad al v. v \\ sc_heap_read_cset h ad al \\ sc_heap_read h ad al v\"\n \"\\h ad al v h'. h' \\ sc_heap_write_cset h ad al v \\ sc_heap_write h ad al v h'\"\n by(simp_all add: eval_sc_heap_read_i_i_i_o eval_sc_heap_write_i_i_i_i_o)\n show \"JVM_heap_execute_conf_read\n addr2thread_id thread_id2addr\n sc_empty (sc_allocate P)\n sc_typeof_addr sc_heap_read_cset sc_heap_write_cset\n (sc_hconf P) P\"\n apply(rule JVM_heap_execute_conf_read.intro)\n apply(unfold unfolds)\n apply(unfold_locales)\n done\nqed\n\nabbreviation sc_JVM_start_state :: \"addr jvm_prog \\ cname \\ mname \\ addr val list \\ (addr,thread_id,addr jvm_thread_state,heap,addr) state\"\nwhere \"sc_JVM_start_state P \\ sc.execute.JVM_start_state TYPE(addr jvm_method) P P\"\n\nabbreviation sc_exec :: \"addr jvm_prog \\ thread_id \\ (addr, heap) jvm_state' \\ (addr, thread_id, heap) jvm_ta_state' set\"\nwhere \"sc_exec P \\ sc.exec TYPE(addr jvm_method) P P\"\n\nabbreviation sc_execute_mexec :: \"addr jvm_prog \\ thread_id \\ (addr jvm_thread_state \\ heap)\n \\ (addr, thread_id, heap) jvm_thread_action \\ (addr jvm_thread_state \\ heap) \\ bool\"\nwhere \"sc_execute_mexec P \\ sc.execute.mexec TYPE(addr jvm_method) P P\"\n\nfun sc_mexec :: \n \"addr jvm_prog \\ thread_id \\ (addr jvm_thread_state' \\ heap) \n \\ ((addr, thread_id, heap) jvm_thread_action' \\ addr jvm_thread_state' \\ heap) Predicate.pred\"\nwhere \n \"sc_mexec P t ((xcp, frs), h) =\n sc.exec_1 (TYPE(addr jvm_method)) P P t (xcp, h, frs) \\= (\\(ta, xcp, h, frs). Predicate.single (ta, (xcp, frs), h))\"\n\nabbreviation sc_jvm_start_state_refine :: \n \"addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (addr, thread_id, heap, (thread_id, (addr jvm_thread_state') \\ addr released_locks) rbt, (thread_id, addr wait_set_status) rbt, thread_id rs) state_refine\"\nwhere\n \"sc_jvm_start_state_refine \\ \n sc_start_state_refine (rm_empty ()) rm_update (rm_empty ()) (rs_empty ()) (\\C M Ts T (mxs, mxl0, ins, xt) vs. (None, [((ins, ins, xt), [], Null # vs @ replicate mxl0 undefined_value, C, M, 0)]))\"\n\nfun jvm_mstate_of_jvm_mstate' :: \n \"(addr,thread_id,addr jvm_thread_state',heap,addr) state \\ (addr,thread_id,addr jvm_thread_state,heap,addr) state\"\nwhere\n \"jvm_mstate_of_jvm_mstate' (ls, (ts, m), ws) = (ls, (\\t. map_option (map_prod jvm_thread_state_of_jvm_thread_state' id) (ts t), m), ws)\"\n\ndefinition sc_jvm_state_invar :: \"addr jvm_prog \\ ty\\<^sub>P \\ (addr,thread_id,addr jvm_thread_state',heap,addr) state set\"\nwhere\n \"sc_jvm_state_invar P \\ \\ \n {s. jvm_mstate_of_jvm_mstate' s \\ sc.execute.correct_jvm_state P \\} \\ \n {s. ts_ok (\\t (xcp, frs) h. jvm_state'_ok P (xcp, h, frs)) (thr s) (shr s)}\"\n\nfun JVM_final' :: \"'addr jvm_thread_state' \\ bool\"\nwhere \"JVM_final' (xcp, frs) \\ frs = []\"\n\nlemma shr_jvm_mstate_of_jvm_mstate' [simp]: \"shr (jvm_mstate_of_jvm_mstate' s) = shr s\"\nby(cases s) clarsimp\n\nlemma jvm_mstate_of_jvm_mstate'_sc_start_state [simp]:\n \"jvm_mstate_of_jvm_mstate'\n (sc_start_state (\\C M Ts T (mxs, mxl0, ins, xt) vs. (None, [((ins, ins, xt), [], Null # vs @ replicate mxl0 undefined_value, C, M, 0)])) P C M vs) = sc_JVM_start_state P C M vs\"\nby(simp add: sc.start_state_def split_beta fun_eq_iff)\n\nlemma sc_jvm_start_state_invar:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n and \"sc_wf_start_state P C M vs\"\n shows \"sc_state_\\ (sc_jvm_start_state_refine P C M vs) \\ sc_jvm_state_invar P \\\"\nunfolding sc_jvm_state_invar_def Int_iff mem_Collect_eq\napply(rule conjI)\n apply(simp add: sc.execute.correct_jvm_state_initial[OF assms])\napply(rule ts_okI)\nusing `sc_wf_start_state P C M vs`\napply(auto simp add: sc.start_state_def split_beta sc_wf_start_state_iff split: split_if_asm dest: sees_method_idemp)\ndone\n\nlemma invariant3p_sc_jvm_state_invar:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows \"invariant3p (multithreaded_base.redT JVM_final' (\\t xm ta x'm'. Predicate.eval (sc_mexec P t xm) (ta, x'm')) convert_RA) (sc_jvm_state_invar P \\)\"\nproof(rule invariant3pI)\n fix s tl s'\n assume red: \"multithreaded_base.redT JVM_final' (\\t xm ta x'm'. Predicate.eval (sc_mexec P t xm) (ta, x'm')) convert_RA s tl s'\"\n and invar: \"s \\ sc_jvm_state_invar P \\\"\n obtain t ta where tl: \"tl = (t, ta)\" by(cases tl)\n from red have red': \"multithreaded_base.redT JVM_final (sc_execute_mexec P) convert_RA (jvm_mstate_of_jvm_mstate' s) (t, jvm_thread_action_of_jvm_thread_action' ta) (jvm_mstate_of_jvm_mstate' s')\"\n proof(cases rule: multithreaded_base.redT.cases[consumes 1, case_names normal acquire])\n case (acquire s t x ln n s')\n thus ?thesis using tl by(cases s)(auto intro!: multithreaded_base.redT.redT_acquire)\n next\n case (normal t x s ta x' m' s')\n obtain xcp frs where x: \"x = (xcp, frs)\" by(cases x)\n with invar normal tl\n have correct: \"sc.execute.correct_state P \\ t (jvm_state_of_jvm_state' (xcp, shr s, frs))\"\n and ok: \"jvm_state'_ok P (xcp, shr s, frs)\"\n apply -\n apply(case_tac [!] s)\n apply(fastforce simp add: sc_jvm_state_invar_def sc.execute.correct_jvm_state_def dest: ts_okD)+\n done\n note eq = sc.exec_correct_state(1)[OF assms this]\n with normal x tl\n have \"sc_execute_mexec P t (jvm_thread_state_of_jvm_thread_state' x, shr (jvm_mstate_of_jvm_mstate' s)) (jvm_thread_action_of_jvm_thread_action' ta) (jvm_thread_state_of_jvm_thread_state' x', m')\" \n by(auto simp add: sc.exec_1_def eq jvm_thread_action'_of_jvm_thread_action_def sc.execute.exec_1_iff)\n with normal tl show ?thesis\n by(cases s)(fastforce intro!: multithreaded_base.redT.redT_normal simp add: final_thread.actions_ok_iff fun_eq_iff map_redT_updTs elim: rev_iffD1[OF _ thread_oks_ts_change] cond_action_oks_final_change)\n qed\n moreover from invar\n have \"sc.execute.correct_state_ts P \\ (thr (jvm_mstate_of_jvm_mstate' s)) (shr (jvm_mstate_of_jvm_mstate' s))\"\n and \"lock_thread_ok (locks (jvm_mstate_of_jvm_mstate' s)) (thr (jvm_mstate_of_jvm_mstate' s))\"\n by(simp_all add: sc_jvm_state_invar_def sc.execute.correct_jvm_state_def)\n ultimately have \"sc.execute.correct_state_ts P \\ (thr (jvm_mstate_of_jvm_mstate' s')) (shr (jvm_mstate_of_jvm_mstate' s'))\"\n and \"lock_thread_ok (locks (jvm_mstate_of_jvm_mstate' s')) (thr (jvm_mstate_of_jvm_mstate' s'))\"\n by(blast intro: lifting_wf.redT_preserves[OF sc.execute.lifting_wf_correct_state, OF assms] sc.execute.exec_mthr.redT_preserves_lock_thread_ok)+\n hence \"jvm_mstate_of_jvm_mstate' s' \\ sc.execute.correct_jvm_state P \\\"\n by(simp add: sc.execute.correct_jvm_state_def)\n moreover from red have \"ts_ok (\\t (xcp, frs) h. \\f\\set frs. frame'_ok P f) (thr s') (shr s')\" unfolding tl \n proof(cases rule: multithreaded_base.redT.cases[consumes 1, case_names normal acquire])\n case acquire thus ?thesis using invar\n by(fastforce simp add: sc_jvm_state_invar_def intro!: ts_okI dest: ts_okD bspec split: split_if_asm)\n next\n case (normal t x s ta x' m' s')\n obtain xcp frs where x: \"x = (xcp, frs)\" by(cases x)\n with invar normal tl\n have correct: \"sc.execute.correct_state P \\ t (jvm_state_of_jvm_state' (xcp, shr s, frs))\"\n and ok: \"jvm_state'_ok P (xcp, shr s, frs)\"\n apply -\n apply(case_tac [!] s)\n apply(fastforce simp add: sc_jvm_state_invar_def sc.execute.correct_jvm_state_def dest: ts_okD)+\n done\n from normal x invar show ?thesis\n apply(auto simp add: sc.exec_1_def final_thread.actions_ok_iff jvm_thread_action'_ok_def sc_jvm_state_invar_def)\n apply hypsubst_thin\n apply(drule sc.exec_correct_state(3)[OF assms correct ok])\n apply(rule ts_okI)\n apply(clarsimp split: split_if_asm simp add: jvm_thread_action'_ok_def)\n apply(drule (1) bspec)\n apply simp\n apply(case_tac \"thr s t\")\n apply(drule (2) redT_updTs_new_thread)\n apply clarsimp\n apply(drule (1) bspec)\n apply simp\n apply(drule (1) bspec)\n apply simp\n apply(erule thin_rl)\n apply(frule (1) redT_updTs_Some)\n apply(fastforce dest: ts_okD)\n done\n qed\n ultimately show \"s' \\ sc_jvm_state_invar P \\\" by(simp add: sc_jvm_state_invar_def)\nqed\n\nlemma sc_exec_deterministic:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows \"multithreaded_base.deterministic JVM_final' (\\t xm ta x'm'. Predicate.eval (sc_mexec P t xm) (ta, x'm')) convert_RA\n (sc_jvm_state_invar P \\)\"\nproof -\n from assms sc_deterministic_heap_ops\n have det: \"multithreaded_base.deterministic JVM_final (sc_execute_mexec P) convert_RA {s. sc.execute.correct_state_ts P \\ (thr s) (shr s)}\"\n by(rule sc.execute.mexec_deterministic)(simp add: sc_spurious_wakeups)\n show ?thesis\n proof(rule multithreaded_base.determisticI)\n fix s t x ta' x' m' ta'' x'' m''\n assume inv: \"s \\ sc_jvm_state_invar P \\\"\n and tst: \"thr s t = \\(x, no_wait_locks)\\\"\n and exec1: \"Predicate.eval (sc_mexec P t (x, shr s)) (ta', x', m')\"\n and exec2: \"Predicate.eval (sc_mexec P t (x, shr s)) (ta'', x'', m'')\"\n and aok1: \"final_thread.actions_ok JVM_final' s t ta'\"\n and aok2: \"final_thread.actions_ok JVM_final' s t ta''\"\n obtain xcp frs where x: \"x = (xcp, frs)\" by(cases x)\n from inv tst x have correct: \"sc.execute.correct_state P \\ t (jvm_state_of_jvm_state' (xcp, shr s, frs))\"\n and ok: \"jvm_state'_ok P (xcp, shr s, frs)\"\n by(cases s, fastforce simp add: sc_jvm_state_invar_def sc.execute.correct_jvm_state_def dest: ts_okD)+\n note eq = sc.exec_correct_state(1)[OF assms this]\n \n from exec1 exec2 x\n have \"sc_execute_mexec P t (jvm_thread_state_of_jvm_thread_state' x, shr (jvm_mstate_of_jvm_mstate' s)) (jvm_thread_action_of_jvm_thread_action' ta') (jvm_thread_state_of_jvm_thread_state' x', m')\" \n and \"sc_execute_mexec P t (jvm_thread_state_of_jvm_thread_state' x, shr (jvm_mstate_of_jvm_mstate' s)) (jvm_thread_action_of_jvm_thread_action' ta'') (jvm_thread_state_of_jvm_thread_state' x'', m'')\"\n by(auto simp add: sc.exec_1_def eq jvm_thread_action'_of_jvm_thread_action_def sc.execute.exec_1_iff)\n moreover have \"thr (jvm_mstate_of_jvm_mstate' s) t = \\(jvm_thread_state_of_jvm_thread_state' x, no_wait_locks)\\\"\n using tst by(cases s) clarsimp\n moreover have \"final_thread.actions_ok JVM_final (jvm_mstate_of_jvm_mstate' s) t (jvm_thread_action_of_jvm_thread_action' ta')\"\n and \"final_thread.actions_ok JVM_final (jvm_mstate_of_jvm_mstate' s) t (jvm_thread_action_of_jvm_thread_action' ta'')\"\n using aok1 aok2\n by -(case_tac [!] s,auto simp add: final_thread.actions_ok_iff elim: rev_iffD1[OF _ thread_oks_ts_change] cond_action_oks_final_change)\n moreover have \"sc.execute.correct_state_ts P \\ (thr (jvm_mstate_of_jvm_mstate' s)) (shr (jvm_mstate_of_jvm_mstate' s))\"\n using inv\n by(cases s)(auto intro!: ts_okI simp add: sc_jvm_state_invar_def sc.execute.correct_jvm_state_def dest: ts_okD)\n ultimately\n have \"jvm_thread_action_of_jvm_thread_action' ta' = jvm_thread_action_of_jvm_thread_action' ta'' \\\n jvm_thread_state_of_jvm_thread_state' x' = jvm_thread_state_of_jvm_thread_state' x'' \\\n m' = m''\"\n by-(drule (4) multithreaded_base.deterministicD[OF det], simp_all)\n moreover from exec1 exec2 x\n have \"(ta', (fst x', m', snd x')) \\ sc_exec P t (xcp, shr s, frs)\" \n and \"(ta'', (fst x'', m'', snd x'')) \\ sc_exec P t (xcp, shr s, frs)\"\n by(auto simp add: sc.exec_1_def)\n hence \"jvm_ta_state'_ok P (ta', (fst x', m', snd x'))\"\n and \"jvm_ta_state'_ok P (ta'', (fst x'', m'', snd x''))\"\n by(blast intro: sc.exec_correct_state[OF assms correct ok])+\n hence \"ta' = jvm_thread_action'_of_jvm_thread_action P (jvm_thread_action_of_jvm_thread_action' ta')\"\n and \"ta'' = jvm_thread_action'_of_jvm_thread_action P (jvm_thread_action_of_jvm_thread_action' ta'')\"\n and \"x' = jvm_thread_state'_of_jvm_thread_state P (jvm_thread_state_of_jvm_thread_state' x')\"\n and \"x'' = jvm_thread_state'_of_jvm_thread_state P (jvm_thread_state_of_jvm_thread_state' x'')\"\n apply -\n apply(case_tac [!] ta')\n apply(case_tac [!] ta'')\n apply(case_tac [!] x')\n apply(case_tac [!] x'')\n apply(fastforce simp add: jvm_thread_action'_of_jvm_thread_action_def jvm_thread_action'_ok_def intro!: map_idI[symmetric] convert_new_thread_action_eqI dest: bspec)+\n done\n ultimately\n show \"ta' = ta'' \\ x' = x'' \\ m' = m''\" by simp\n qed(rule invariant3p_sc_jvm_state_invar[OF assms])\nqed\n\nsubsection {* Round-robin scheduler *}\n\ninterpretation JVM_rr!: \n sc_round_robin_base\n JVM_final' \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rr_JVM_start_state :: \"nat \\ 'm prog \\ thread_id fifo round_robin\"\nwhere \"sc_rr_JVM_start_state n0 P = JVM_rr.round_robin_start n0 (sc_start_tid P)\"\n\ndefinition exec_JVM_rr ::\n \"nat \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list, \n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state' \\ addr released_locks) RBT.rbt \\ heap) \\\n (thread_id, addr wait_set_status) RBT.rbt \\ thread_id rs) tllist\"\nwhere\n \"exec_JVM_rr n0 P C M vs = JVM_rr.exec P n0 (sc_rr_JVM_start_state n0 P) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rr!:\n sc_round_robin \n JVM_final' \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rr:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows\n \"sc_scheduler \n JVM_final' (sc_mexec P) convert_RA\n (JVM_rr.round_robin P n0) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) JVM_rr.round_robin_invar\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rr.round_robin_scheduler)\napply(rule sc_exec_deterministic[OF assms])\ndone\n\nsubsection {* Random scheduler *}\n\ninterpretation JVM_rnd!: \n sc_random_scheduler_base\n JVM_final' \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rnd_JVM_start_state :: \"Random.seed \\ random_scheduler\"\nwhere \"sc_rnd_JVM_start_state seed = seed\"\n\ndefinition exec_JVM_rnd ::\n \"Random.seed \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list,\n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state' \\ addr released_locks) RBT.rbt \\ heap) \\\n (thread_id, addr wait_set_status) RBT.rbt \\ thread_id rs) tllist\"\nwhere \"exec_JVM_rnd seed P C M vs = JVM_rnd.exec P (sc_rnd_JVM_start_state seed) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rnd!:\n sc_random_scheduler\n JVM_final' \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rnd:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows \n \"sc_scheduler\n JVM_final' (sc_mexec P) convert_RA\n (JVM_rnd.random_scheduler P) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) (\\_ _. True)\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rnd.random_scheduler_scheduler)\napply(rule sc_exec_deterministic[OF assms])\ndone\n\nML_val {* @{code exec_JVM_rr} *}\n\nML_val {* @{code exec_JVM_rnd} *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Execute/JVM_Execute2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.16837349682266453}} {"text": "(*\nThis file is generated by Cogent\n\n*)\n\ntheory U8rec_correctness_uabsfunsdeclfix\n imports \"build_u8rec/U8rec_uabsfunsdeclfix_AllRefine\"\nCogent.ValueSemantics\nbegin\n\nlemmas type_simps = U8rec_uabsfunsdeclfix_TypeProof.main_type_def\n U8rec_uabsfunsdeclfix_TypeProof.abbreviatedType1_def\nlemmas \\_simps = \\_def assoc_lookup.simps type_simps\n\n\noverloading \\0 \\ \\_0\nbegin\ndefinition \\0 :: \"(funtyp, abstyp, ptrtyp) uabsfuns\"\n where\n\"\\0 f x y = False\"\n \n\nend\n\ndefinition val_abs_typing where \"val_abs_typing \\ \\ _ _ _ _. False\"\ndefinition upd_abs_typing where \"upd_abs_typing \\ \\ _ _ _ _ _ _ _ _. False\"\ndefinition abs_upd_val where \"abs_upd_val \\ \\ _ _ _ _ _ _ _ _ _. False\"\ndefinition \\\\<^sub>m where \"\\\\<^sub>m \\ \\ _ _ _. False\"\ndefinition \\\\<^sub>p where \"\\\\<^sub>p \\ \\ _ _ _. False\"\ndefinition abs_repr where \"abs_repr \\ \\ _. ([],[])\"\n\nlemmas abs_defs = val_abs_typing_def upd_abs_typing_def abs_upd_val_def \\\\<^sub>m_def \\0_def\n\nlocale Abstract begin\nend\n\nsublocale Abstract \\ update_sem upd_abs_typing abs_repr\n by(simp add:abs_defs;unfold_locales;simp)\n\nsublocale Abstract \\ update_sem_init upd_abs_typing abs_repr \n by (unfold_locales)\n\nsublocale Abstract \\ value_sem val_abs_typing\n by(simp add:abs_defs;unfold_locales;simp)\n\nsublocale Abstract \\ U8rec_uabsfunsdeclfix _ upd_abs_typing abs_repr\n by (unfold_locales)\n\nsublocale Abstract \\ correspondence abs_repr val_abs_typing upd_abs_typing abs_upd_val\n by (simp add:abs_defs;unfold_locales;simp)\n\n\nsublocale Abstract \\ correspondence_init abs_repr val_abs_typing upd_abs_typing abs_upd_val\n by (unfold_locales)\n\nsublocale Abstract \\ shallow val_abs_typing\n by (unfold_locales)\n\nsublocale Abstract \\ U8rec_uabsfunsdeclfix_cogent_shallow _ abs_repr val_abs_typing upd_abs_typing abs_upd_val\n by (unfold_locales)\n\ncontext Abstract begin\nlemma abs_stuff : \n \"rename_mono_prog rename \\ \\\\<^sub>m \\\\<^sub>p\"\n \"proc_env_matches \\\\<^sub>m \\\"\n \"proc_ctx_wellformed \\\"\n \"proc_env_u_v_matches \\_0 \\\\<^sub>m \\\"\n \"proc_env_matches_ptrs \\_0 \\\"\n apply(subst rename_mono_prog_def, simp add:abs_defs)\n apply(subst proc_env_matches_def, simp add: abs_defs)\n apply(clarsimp simp add:proc_ctx_wellformed_def \\_simps)\n apply(subst proc_env_u_v_matches_def)\n apply(clarsimp simp add: \\_simps abs_defs )\n apply(subst proc_env_matches_ptrs_def)\n apply(clarsimp simp add: \\_simps abs_defs )\n done\n\nend\n\n\n\n\ncontext Abstract begin\n\n\nlemma assumes \n \"is_valid st p\"\n and eqp': \"(p', st') \\ fst (main' p st)\"\n shows\n \"heap st' p' = heap st p\"\nproof -\n let ?vc = \"heap st p\"\n let ?a = \"a_C ?vc\"\n let ?vs = \"\\ a\\<^sub>f = ?a \\\"\n let ?pu = \"UPtr (ptr_val p) (RRecord [RPrim (Num U8)])\"\n let ?vu = \"URecord [(UPrim (LU8 ?a), RPrim (Num U8))]\" \n let ?vv = \"VRecord [VPrim (LU8 ?a)]\" \n let ?\\ = \"\\ q. if q = ptr_val p then Some ?vu else None\"\n let ?typ = \"TRecord [(''a'', TPrim (Num U8), Present)] (Boxed Writable undefined)\"\n\n have vv_typ: \" vval_typing \\ ?vv ?typ\"\n by (intro vval_typing_vval_typing_record.intros v_t_prim';simp)+\n\n have uv_rel : \" upd_val_rel \\ ?\\ ?pu ?vv ?typ {} {ptr_val p}\"\n apply(intro u_v_p_rec_w'[where w=\"{}\" , simplified])\n apply simp_all\n apply(intro u_v_r_cons1[where r=\"{}\" and r'=\"{}\" and w=\"{}\" and w'=\"{}\", simplified])\n apply(intro u_v_prim';simp)\n apply(intro u_v_r_empty)\n apply simp\n done\n\n have uv_matches : \"(u_v_matches \\ ?\\\n [?pu] [?vv]\n [Some ?typ] {} {ptr_val p})\" \n apply(intro u_v_matches_some[where r=\"{}\" and r'=\"{}\" and w=\"{ ptr_val p }\" and w'=\"{}\", simplified])\n apply(rule uv_rel)\n apply(intro u_v_matches.u_v_matches_empty)\n done\n have various_stuff:\n \"matches \\ [?vv] [Some ?typ]\"\n \" (?\\, st) \\ state_rel\"\n \n \" val_rel_shallow_C rename ?vs p ?vv ?pu \\\\<^sub>p ?\\ \\\"\n \"matches_ptrs \\ ?\\ [?pu] [Some ?typ] {} { ptr_val p } \"\n apply(subst matches_def,simp add:type_simps vv_typ)\n apply(simp add:state_rel_def heap_rel_def All_def heap_rel_ptr_def assms)\n\n apply(rule ext)\n apply (clarsimp simp add:TypeRelSimp ValRelSimp)\n apply blast\n\n apply(simp add:val_rel_shallow_C_def)\n apply(simp add:valRel_T0 ValRelSimp)\n apply(intro exI[where x = ?typ])\n apply(intro exI)\n apply(rule uv_rel)\n apply(rule u_v_matches_to_matches_ptrs )\n using uv_matches\n by blast\n\n\n\n(* correspondence lemma from AllRefine *)\n have cor: \"corres_shallow_C rename state_rel \n (U8rec_uabsfunsdeclfix_Shallow_Desugar.main ?vs) U8rec_uabsfunsdeclfix_TypeProof.main (main' p) \\_0 \\\\<^sub>m \\\\<^sub>p\n [?pu] [?vv] \\\n [Some (fst (snd U8rec_uabsfunsdeclfix_TypeProof.main_type))]\n ?\\ st\"\n \n apply(rule corres_shallow_C_main[where \n vv\\<^sub>s = ?vs and uv\\<^sub>C = p and \\\\<^sub>m = \\\\<^sub>m and \\\\<^sub>p =\\\\<^sub>p \nand uv\\<^sub>m = ?pu and vv\\<^sub>m = ?vv and ?vv\\<^sub>p = ?vv and s = st and \\ = ?\\]\n )\n apply(simp_all add:various_stuff abs_stuff type_simps)\n apply(unfold_locales; simp add:various_stuff abs_stuff)\n \n done\n\n(* the meat: this block is where I need help. *)\n { \n fix \\' pu' vv'\n assume u_eval:\"\n \\_0, [?pu] \\ (\\q. ?\\ q,\n U8rec_uabsfunsdeclfix_TypeProof.main) \\! (\\', pu')\"\n and v_eval: \" \\\\<^sub>m , [?vv] \\ U8rec_uabsfunsdeclfix_TypeProof.main \\ rename_val rename (monoval vv')\"\n and st'_rel: \" (\\', st') \\ state_rel\"\n and v_cor: \" val_rel_shallow_C rename\n (U8rec_uabsfunsdeclfix_Shallow_Desugar.main ?vs) p' vv' pu' \\\\<^sub>p \\' \\\"\n\n(* I am forced to deconstruct the evaluation relation in the update semantics *)\n have eqp\\: \"pu' = ?pu \\ \\' = ?\\\"\n using u_eval\n apply(unfold U8rec_uabsfunsdeclfix_TypeProof.main_def)\n apply(ind_cases \"_, _ \\ (_, expr.Let _ _) \\! (_, _)\")\n apply(ind_cases \"_, _ \\ (_, Var 0) \\! (_, _)\")+\n by simp\n \n\n\n(* unfolding v_cor *)\n obtain \\ r w repr where\n eq': \"vv' = VRecord [VPrim (LU8 (a\\<^sub>f (U8rec_uabsfunsdeclfix_Shallow_Desugar.main ?vs)))]\"\n\n \"pu' = UPtr (ptr_val p') repr\" \nand uv_rel': \"upd_val_rel \\ \\' pu' (rename_val rename (monoval vv')) \\ r w\"\n \n using v_cor \n apply(simp add:val_rel_shallow_C_def valRel_T0 ValRelSimp)\n apply(elim exE conjE)\n by simp\n \n have eqp: \"p' = p\"\n using eq'\n by(simp add:eqp\\)\n\n \n(* the update value evaluation preserves typing *)\n obtain w' \n where \"uval_typing \\ \\' pu' ?typ {} w'\" \n and \\'f: \"frame ?\\ {ptr_val p} \\' w'\" \n using u_eval\n apply -\n apply(drule preservation_mono[rotated 3])\n apply(rule U8rec_uabsfunsdeclfix_AllRefine.main_typecorrect'[simplified type_simps]; simp)\n using preservation_mono abs_stuff various_stuff \n by force+\n\n \n\n (* can I show this without evaluating main in the value/update semantics? *)\n have \"heap st' p' = heap st p\" \n (* Help! *)\n using st'_rel\n apply(simp add:state_rel_def heap_rel_def heap_rel_ptr_meta)\n apply(drule all_heap_rel_ptrD[where \\ = \\' and p = p'])\n apply(simp add:eqp\\ eqp)\n apply(simp add:TypeRelSimp)\n apply (simp add:ValRelSimp)\n \n by (metis t1_C_idupdates(1))\n} \n note meat = this\n\n\n\n show ?thesis\n using cor\n apply -\n apply(subst (asm) corres_shallow_C_def) \n apply (elim impE) \n apply(rule various_stuff abs_stuff )+\n apply(fastforce intro:uv_matches simp add:type_simps)\n apply(erule conjE)\n apply(thin_tac _)\n apply (elim allE)\n apply(erule impE)\n apply(rule eqp')\n apply(elim exE conjE)\n using meat\n apply blast\n done\nqed\n \n\n\n\n\n \nend\n\nend\n", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/correctness/U8rec_correctness_uabsfunsdeclfix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3311197462295937, "lm_q1q2_score": 0.16814653563250706}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__27_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__27_on_rules imports n_german_lemma_on_inv__27\nbegin\nsection{*All lemmas on causal relation between inv__27*}\nlemma lemma_inv__27_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__27 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__27) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__27_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.30735801052067524, "lm_q1q2_score": 0.16804435066974147}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__9.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__9 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__9 and some rule r*}\nlemma n_StoreVsinv__9:\nassumes a1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\N\\d\\N\\r=n_Store i d\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__9 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\\(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__9:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__9 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) s))\\((formEval (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv2) ''State'')) (Const E)))) (eqn (IVar (Ident ''ExGntd'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__9:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__9 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__9:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv2 where a2:\"p__Inv2\\N\\f=inv__9 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i~=p__Inv2)\\(i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv2) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__0Vsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendInv__part__1Vsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendInv__part__1 i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__9:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__9 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__9.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.30735800417608683, "lm_q1q2_score": 0.16804434720091294}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__5_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__5_on_rules imports n_g2kAbsAfter_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__5 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__5) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__5) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5234203638047913, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.1679244019939422}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__28_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__28_on_rules imports n_germanSymIndex_lemma_on_inv__28\nbegin\nsection{*All lemmas on causal relation between inv__28*}\nlemma lemma_inv__28_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__28 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__28) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__28_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.32082129433083023, "lm_q1q2_score": 0.16792439382484628}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__16_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__16_on_rules imports n_german_lemma_on_inv__16\nbegin\nsection{*All lemmas on causal relation between inv__16*}\nlemma lemma_inv__16_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__16 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__16) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__16) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__16_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.32082128783705344, "lm_q1q2_score": 0.16792439042587137}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n The refinement relation between abstract and concrete states\n*)\n\ntheory StateRelation\nimports Invariants_H\nbegin\n\ncontext begin interpretation Arch .\n\ndefinition cte_map :: \"cslot_ptr \\ machine_word\" where\n \"cte_map \\ \\(oref, cref). oref + (of_bl cref << cte_level_bits)\"\n\nlemmas cte_map_def' = cte_map_def[simplified cte_level_bits_def shiftl_t2n mult_ac, simplified]\n\ndefinition lookup_failure_map :: \"ExceptionTypes_A.lookup_failure \\ Fault_H.lookup_failure\" where\n \"lookup_failure_map \\ \\lf. case lf of\n ExceptionTypes_A.InvalidRoot \\ Fault_H.InvalidRoot\n | ExceptionTypes_A.MissingCapability n \\ Fault_H.MissingCapability n\n | ExceptionTypes_A.DepthMismatch n m \\ Fault_H.DepthMismatch n m\n | ExceptionTypes_A.GuardMismatch n g \\ Fault_H.GuardMismatch n (of_bl g) (length g)\"\n\nprimrec arch_fault_map :: \"Machine_A.RISCV64_A.arch_fault \\ arch_fault\" where\n \"arch_fault_map (Machine_A.RISCV64_A.VMFault ptr msg) = VMFault ptr msg\"\n\nprimrec fault_map :: \"ExceptionTypes_A.fault \\ Fault_H.fault\" where\n \"fault_map (ExceptionTypes_A.CapFault ref bool failure) =\n Fault_H.CapFault ref bool (lookup_failure_map failure)\"\n| \"fault_map (ExceptionTypes_A.ArchFault arch_fault) =\n Fault_H.ArchFault (arch_fault_map arch_fault)\"\n| \"fault_map (ExceptionTypes_A.UnknownSyscallException n) =\n Fault_H.UnknownSyscallException n\"\n| \"fault_map (ExceptionTypes_A.UserException x y) =\n Fault_H.UserException x y\"\n\ntype_synonym obj_relation_cut = \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\ntype_synonym obj_relation_cuts = \"(machine_word \\ obj_relation_cut) set\"\n\ndefinition vmrights_map :: \"rights set \\ vmrights\" where\n \"vmrights_map S \\ if AllowRead \\ S\n then (if AllowWrite \\ S then VMReadWrite else VMReadOnly)\n else VMKernelOnly\"\n\ndefinition zbits_map :: \"nat option \\ zombie_type\" where\n \"zbits_map N \\ case N of Some n \\ ZombieCNode n | None \\ ZombieTCB\"\n\ndefinition mdata_map ::\n \"(Machine_A.RISCV64_A.asid \\ vspace_ref) option \\ (asid \\ vspace_ref) option\" where\n \"mdata_map = map_option (\\(asid, ref). (ucast asid, ref))\"\n\nprimrec acap_relation :: \"arch_cap \\ arch_capability \\ bool\" where\n \"acap_relation (arch_cap.ASIDPoolCap p asid) c =\n (c = ASIDPoolCap p (ucast asid))\"\n| \"acap_relation (arch_cap.ASIDControlCap) c =\n (c = ASIDControlCap)\"\n| \"acap_relation (arch_cap.FrameCap p rghts sz dev data) c =\n (c = FrameCap p (vmrights_map rghts) sz dev (mdata_map data))\"\n| \"acap_relation (arch_cap.PageTableCap p data) c =\n (c = PageTableCap p (mdata_map data))\"\n\nprimrec cap_relation :: \"cap \\ capability \\ bool\" where\n \"cap_relation Structures_A.NullCap c =\n (c = Structures_H.NullCap)\"\n| \"cap_relation Structures_A.DomainCap c =\n (c = Structures_H.DomainCap)\"\n| \"cap_relation (Structures_A.UntypedCap dev ref n f) c =\n (c = Structures_H.UntypedCap dev ref n f)\"\n| \"cap_relation (Structures_A.EndpointCap ref b r) c =\n (c = Structures_H.EndpointCap ref b (AllowSend \\ r) (AllowRecv \\ r) (AllowGrant \\ r)\n (AllowGrantReply \\ r))\"\n| \"cap_relation (Structures_A.NotificationCap ref b r) c =\n (c = Structures_H.NotificationCap ref b (AllowSend \\ r) (AllowRecv \\ r))\"\n| \"cap_relation (Structures_A.CNodeCap ref n L) c =\n (c = Structures_H.CNodeCap ref n (of_bl L) (length L))\"\n| \"cap_relation (Structures_A.ThreadCap ref) c =\n (c = Structures_H.ThreadCap ref)\"\n| \"cap_relation (Structures_A.ReplyCap ref master r) c =\n (c = Structures_H.ReplyCap ref master (AllowGrant \\ r))\"\n| \"cap_relation (Structures_A.IRQControlCap) c =\n (c = Structures_H.IRQControlCap)\"\n| \"cap_relation (Structures_A.IRQHandlerCap irq) c =\n (c = Structures_H.IRQHandlerCap irq)\"\n| \"cap_relation (Structures_A.ArchObjectCap a) c =\n (\\a'. acap_relation a a' \\ c = Structures_H.ArchObjectCap a')\"\n| \"cap_relation (Structures_A.Zombie p b n) c =\n (c = Structures_H.Zombie p (zbits_map b) n)\"\n\n\ndefinition cte_relation :: \"cap_ref \\ obj_relation_cut\" where\n \"cte_relation y \\ \\ko ko'. \\sz cs cte cap. ko = CNode sz cs \\ ko' = KOCTE cte\n \\ cs y = Some cap \\ cap_relation cap (cteCap cte)\"\n\ndefinition asid_pool_relation :: \"(asid_low_index \\ obj_ref) \\ asidpool \\ bool\" where\n \"asid_pool_relation \\ \\p p'. p = inv ASIDPool p' o ucast\"\n\ndefinition ntfn_relation :: \"Structures_A.notification \\ Structures_H.notification \\ bool\" where\n \"ntfn_relation \\ \\ntfn ntfn'.\n (case ntfn_obj ntfn of\n Structures_A.IdleNtfn \\ ntfnObj ntfn' = Structures_H.IdleNtfn\n | Structures_A.WaitingNtfn q \\ ntfnObj ntfn' = Structures_H.WaitingNtfn q\n | Structures_A.ActiveNtfn b \\ ntfnObj ntfn' = Structures_H.ActiveNtfn b)\n \\ ntfn_bound_tcb ntfn = ntfnBoundTCB ntfn'\"\n\ndefinition ep_relation :: \"Structures_A.endpoint \\ Structures_H.endpoint \\ bool\" where\n \"ep_relation \\ \\ep ep'. case ep of\n Structures_A.IdleEP \\ ep' = Structures_H.IdleEP\n | Structures_A.RecvEP q \\ ep' = Structures_H.RecvEP q\n | Structures_A.SendEP q \\ ep' = Structures_H.SendEP q\"\n\ndefinition fault_rel_optionation :: \"ExceptionTypes_A.fault option \\ Fault_H.fault option \\ bool\"\n where\n \"fault_rel_optionation \\ \\f f'. f' = map_option fault_map f\"\n\nprimrec thread_state_relation :: \"Structures_A.thread_state \\ Structures_H.thread_state \\ bool\"\n where\n \"thread_state_relation (Structures_A.Running) ts'\n = (ts' = Structures_H.Running)\"\n| \"thread_state_relation (Structures_A.Restart) ts'\n = (ts' = Structures_H.Restart)\"\n| \"thread_state_relation (Structures_A.Inactive) ts'\n = (ts' = Structures_H.Inactive)\"\n| \"thread_state_relation (Structures_A.IdleThreadState) ts'\n = (ts' = Structures_H.IdleThreadState)\"\n| \"thread_state_relation (Structures_A.BlockedOnReply) ts'\n = (ts' = Structures_H.BlockedOnReply)\"\n| \"thread_state_relation (Structures_A.BlockedOnReceive oref sp) ts'\n = (ts' = Structures_H.BlockedOnReceive oref (receiver_can_grant sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnSend oref sp) ts'\n = (ts' = Structures_H.BlockedOnSend oref (sender_badge sp)\n (sender_can_grant sp) (sender_can_grant_reply sp) (sender_is_call sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnNotification oref) ts'\n = (ts' = Structures_H.BlockedOnNotification oref)\"\n\ndefinition arch_tcb_relation :: \"Structures_A.arch_tcb \\ Structures_H.arch_tcb \\ bool\" where\n \"arch_tcb_relation \\ \\atcb atcb'. tcb_context atcb = atcbContext atcb'\"\n\ndefinition tcb_relation :: \"Structures_A.tcb \\ Structures_H.tcb \\ bool\" where\n \"tcb_relation \\ \\tcb tcb'.\n tcb_fault_handler tcb = to_bl (tcbFaultHandler tcb')\n \\ tcb_ipc_buffer tcb = tcbIPCBuffer tcb'\n \\ arch_tcb_relation (tcb_arch tcb) (tcbArch tcb')\n \\ thread_state_relation (tcb_state tcb) (tcbState tcb')\n \\ fault_rel_optionation (tcb_fault tcb) (tcbFault tcb')\n \\ cap_relation (tcb_ctable tcb) (cteCap (tcbCTable tcb'))\n \\ cap_relation (tcb_vtable tcb) (cteCap (tcbVTable tcb'))\n \\ cap_relation (tcb_reply tcb) (cteCap (tcbReply tcb'))\n \\ cap_relation (tcb_caller tcb) (cteCap (tcbCaller tcb'))\n \\ cap_relation (tcb_ipcframe tcb) (cteCap (tcbIPCBufferFrame tcb'))\n \\ tcb_bound_notification tcb = tcbBoundNotification tcb'\n \\ tcb_mcpriority tcb = tcbMCP tcb'\"\n\ndefinition\n other_obj_relation :: \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\nwhere\n \"other_obj_relation obj obj' \\\n (case (obj, obj') of\n (TCB tcb, KOTCB tcb') \\ tcb_relation tcb tcb'\n | (Endpoint ep, KOEndpoint ep') \\ ep_relation ep ep'\n | (Notification ntfn, KONotification ntfn') \\ ntfn_relation ntfn ntfn'\n | (ArchObj (RISCV64_A.ASIDPool ap), KOArch (KOASIDPool ap')) \\ asid_pool_relation ap ap'\n | _ \\ False)\"\n\nprimrec pte_relation' :: \"RISCV64_A.pte \\ RISCV64_H.pte \\ bool\" where\n \"pte_relation' RISCV64_A.InvalidPTE x =\n (x = RISCV64_H.InvalidPTE)\"\n| \"pte_relation' (RISCV64_A.PageTablePTE ppn atts) x =\n (x = RISCV64_H.PageTablePTE (ucast ppn) (Global \\ atts) (User \\ atts) \\ Execute \\ atts)\"\n| \"pte_relation' (RISCV64_A.PagePTE ppn atts rghts) x =\n (x = RISCV64_H.PagePTE (ucast ppn) (Global \\ atts) (User \\ atts) (Execute \\ atts)\n (vmrights_map rghts))\"\n\ndefinition pte_relation :: \"pt_index \\ Structures_A.kernel_object \\ kernel_object \\ bool\" where\n \"pte_relation y \\ \\ko ko'. \\pt pte. ko = ArchObj (PageTable pt) \\ ko' = KOArch (KOPTE pte)\n \\ pte_relation' (pt y) pte\"\n\nprimrec aobj_relation_cuts :: \"RISCV64_A.arch_kernel_obj \\ machine_word \\ obj_relation_cuts\" where\n \"aobj_relation_cuts (DataPage dev sz) x =\n { (x + (n << pageBits), \\_ obj. obj = (if dev then KOUserDataDevice else KOUserData))\n | n. n < 2 ^ (pageBitsForSize sz - pageBits) }\"\n| \"aobj_relation_cuts (RISCV64_A.ASIDPool pool) x =\n {(x, other_obj_relation)}\"\n| \"aobj_relation_cuts (PageTable pt) x =\n (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\"\n\nprimrec obj_relation_cuts :: \"Structures_A.kernel_object \\ machine_word \\ obj_relation_cuts\" where\n \"obj_relation_cuts (CNode sz cs) x =\n (if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)})\"\n| \"obj_relation_cuts (TCB tcb) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Endpoint ep) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Notification ntfn) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (ArchObj ao) x = aobj_relation_cuts ao x\"\n\n\nlemma obj_relation_cuts_def2:\n \"obj_relation_cuts ko x =\n (case ko of CNode sz cs \\ if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)}\n | ArchObj (PageTable pt) \\ (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\n | ArchObj (DataPage dev sz) \\\n {(x + (n << pageBits), \\_ obj. obj =(if dev then KOUserDataDevice else KOUserData))\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | _ \\ {(x, other_obj_relation)})\"\n by (simp split: Structures_A.kernel_object.split\n RISCV64_A.arch_kernel_obj.split)\n\nlemma obj_relation_cuts_def3:\n \"obj_relation_cuts ko x =\n (case a_type ko of\n ACapTable n \\ {(cte_map (x, y), cte_relation y) | y. length y = n}\n | AArch APageTable \\ (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\n | AArch (AUserData sz) \\ {(x + (n << pageBits), \\_ obj. obj = KOUserData)\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AArch (ADeviceData sz) \\ {(x + (n << pageBits), \\_ obj. obj = KOUserDataDevice )\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AGarbage _ \\ {(x, \\\\)}\n | _ \\ {(x, other_obj_relation)})\"\n by (simp add: obj_relation_cuts_def2 a_type_def well_formed_cnode_n_def length_set_helper\n split: Structures_A.kernel_object.split RISCV64_A.arch_kernel_obj.split)\n\ndefinition is_other_obj_relation_type :: \"a_type \\ bool\" where\n \"is_other_obj_relation_type tp \\\n case tp of\n ACapTable n \\ False\n | AArch APageTable \\ False\n | AArch (AUserData _) \\ False\n | AArch (ADeviceData _) \\ False\n | AGarbage _ \\ False\n | _ \\ True\"\n\nlemma is_other_obj_relation_type_CapTable:\n \"\\ is_other_obj_relation_type (ACapTable n)\"\n by (simp add: is_other_obj_relation_type_def)\n\nlemma is_other_obj_relation_type_UserData:\n \"\\ is_other_obj_relation_type (AArch (AUserData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type_DeviceData:\n \"\\ is_other_obj_relation_type (AArch (ADeviceData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type:\n \"is_other_obj_relation_type (a_type ko) \\ obj_relation_cuts ko x = {(x, other_obj_relation)}\"\n by (simp add: obj_relation_cuts_def3 is_other_obj_relation_type_def\n split: a_type.splits aa_type.splits)\n\ndefinition pspace_dom :: \"Structures_A.kheap \\ machine_word set\" where\n \"pspace_dom ps \\ \\x\\dom ps. fst ` (obj_relation_cuts (the (ps x)) x)\"\n\ndefinition pspace_relation ::\n \"Structures_A.kheap \\ (machine_word \\ Structures_H.kernel_object) \\ bool\" where\n \"pspace_relation ab con \\\n (pspace_dom ab = dom con) \\\n (\\x \\ dom ab. \\(y, P) \\ obj_relation_cuts (the (ab x)) x. P (the (ab x)) (the (con y)))\"\n\ndefinition etcb_relation :: \"etcb \\ Structures_H.tcb \\ bool\" where\n \"etcb_relation \\ \\etcb tcb'.\n tcb_priority etcb = tcbPriority tcb'\n \\ tcb_time_slice etcb = tcbTimeSlice tcb'\n \\ tcb_domain etcb = tcbDomain tcb'\"\n\ndefinition ekheap_relation ::\n \"(obj_ref \\ etcb option) \\ (machine_word \\ Structures_H.kernel_object) \\ bool\" where\n \"ekheap_relation ab con \\\n \\x \\ dom ab. \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation (the (ab x)) tcb'\"\n\nprimrec sched_act_relation :: \"Deterministic_A.scheduler_action \\ scheduler_action \\ bool\"\n where\n \"sched_act_relation resume_cur_thread a' = (a' = ResumeCurrentThread)\" |\n \"sched_act_relation choose_new_thread a' = (a' = ChooseNewThread)\" |\n \"sched_act_relation (switch_thread x) a' = (a' = SwitchToThread x)\"\n\ndefinition ready_queues_relation ::\n \"(Deterministic_A.domain \\ Structures_A.priority \\ Deterministic_A.ready_queue) \\\n (domain \\ priority \\ KernelStateData_H.ready_queue) \\ bool\" where\n \"ready_queues_relation qs qs' \\ \\d p. (qs d p = qs' (d, p))\"\n\ndefinition ghost_relation ::\n \"Structures_A.kheap \\ (machine_word \\ vmpage_size) \\ (machine_word \\ nat) \\ bool\" where\n \"ghost_relation h ups cns \\\n (\\a sz. (\\dev. h a = Some (ArchObj (DataPage dev sz))) \\ ups a = Some sz) \\\n (\\a n. (\\cs. h a = Some (CNode n cs) \\ well_formed_cnode_n n cs) \\ cns a = Some n)\"\n\ndefinition cdt_relation :: \"(cslot_ptr \\ bool) \\ cdt \\ cte_heap \\ bool\" where\n \"cdt_relation \\ \\cte_at m m'.\n \\c. cte_at c \\ cte_map ` descendants_of c m = descendants_of' (cte_map c) m'\"\n\ndefinition cdt_list_relation :: \"cdt_list \\ cdt \\ cte_heap \\ bool\" where\n \"cdt_list_relation \\ \\t m m'.\n \\c cap node. m' (cte_map c) = Some (CTE cap node)\n \\ (case next_slot c t m of None \\ True\n | Some next \\ mdbNext node = cte_map next)\"\n\ndefinition revokable_relation ::\n \"(cslot_ptr \\ bool) \\ (cslot_ptr \\ cap option) \\ cte_heap \\ bool\" where\n \"revokable_relation revo cs m' \\\n \\c cap node. cs c \\ None \\\n m' (cte_map c) = Some (CTE cap node) \\\n revo c = mdbRevocable node\"\n\ndefinition irq_state_relation :: \"irq_state \\ irqstate \\ bool\" where\n \"irq_state_relation irq irq' \\ case (irq, irq') of\n (irq_state.IRQInactive, irqstate.IRQInactive) \\ True\n | (irq_state.IRQSignal, irqstate.IRQSignal) \\ True\n | (irq_state.IRQTimer, irqstate.IRQTimer) \\ True\n | _ \\ False\"\n\ndefinition interrupt_state_relation ::\n \"(irq \\ obj_ref) \\ (irq \\ irq_state) \\ interrupt_state \\ bool\" where\n \"interrupt_state_relation node_map irqs is \\\n (\\node irqs'. is = InterruptState node irqs'\n \\ (\\irq. node_map irq = node + (ucast irq << cte_level_bits))\n \\ (\\irq. irq_state_relation (irqs irq) (irqs' irq)))\"\n\ndefinition arch_state_relation :: \"(arch_state \\ RISCV64_H.kernel_state) set\" where\n \"arch_state_relation \\ {(s, s') .\n riscv_asid_table s = riscvKSASIDTable s' o ucast\n \\ riscv_global_pts s = (\\l. set (riscvKSGlobalPTs s' (size l)))\n \\ riscv_kernel_vspace s = riscvKSKernelVSpace s'}\"\n\ndefinition rights_mask_map :: \"rights set \\ Types_H.cap_rights\" where\n \"rights_mask_map \\\n \\rs. CapRights (AllowWrite \\ rs) (AllowRead \\ rs) (AllowGrant \\ rs) (AllowGrantReply \\ rs)\"\n\n\nlemma obj_relation_cutsE:\n \"\\ (y, P) \\ obj_relation_cuts ko x; P ko ko';\n \\sz cs z cap cte. \\ ko = CNode sz cs; well_formed_cnode_n sz cs; y = cte_map (x, z);\n ko' = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte) \\\n \\ R;\n \\pt (z :: pt_index) pte'. \\ ko = ArchObj (PageTable pt); y = x + (ucast z << pteBits);\n ko' = KOArch (KOPTE pte'); pte_relation' (pt z) pte' \\\n \\ R;\n \\sz dev n. \\ ko = ArchObj (DataPage dev sz);\n ko' = (if dev then KOUserDataDevice else KOUserData);\n y = x + (n << pageBits); n < 2 ^ (pageBitsForSize sz - pageBits) \\ \\ R;\n \\ y = x; other_obj_relation ko ko'; is_other_obj_relation_type (a_type ko) \\ \\ R\n \\ \\ R\"\n by (force simp: obj_relation_cuts_def2 is_other_obj_relation_type_def a_type_def\n cte_relation_def pte_relation_def\n split: Structures_A.kernel_object.splits if_splits RISCV64_A.arch_kernel_obj.splits)\n\nlemma eq_trans_helper:\n \"\\ x = y; P y = Q \\ \\ P x = Q\"\n by simp\n\nlemma cap_relation_case':\n \"cap_relation cap cap' = (case cap of\n cap.ArchObjectCap arch_cap.ASIDControlCap \\ cap_relation cap cap'\n | _ \\ cap_relation cap cap')\"\n by (simp split: cap.split arch_cap.split)\n\nschematic_goal cap_relation_case:\n \"cap_relation cap cap' = ?P\"\n apply (subst cap_relation_case')\n apply (clarsimp cong: cap.case_cong arch_cap.case_cong)\n apply (rule refl)\n done\n\nlemmas cap_relation_split =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split[where P=P]] for P\nlemmas cap_relation_split_asm =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split_asm[where P=P]] for P\n\n\n\ntext \\\n Relations on other data types that aren't stored but used as intermediate values\n in the specs.\n\\\nprimrec message_info_map :: \"Structures_A.message_info \\ Types_H.message_info\" where\n \"message_info_map (Structures_A.MI a b c d) = (Types_H.MI a b c d)\"\n\nlemma mi_map_label[simp]: \"msgLabel (message_info_map mi) = mi_label mi\"\n by (cases mi, simp)\n\nprimrec syscall_error_map :: \"ExceptionTypes_A.syscall_error \\ Fault_H.syscall_error\" where\n \"syscall_error_map (ExceptionTypes_A.InvalidArgument n) = Fault_H.InvalidArgument n\"\n| \"syscall_error_map (ExceptionTypes_A.InvalidCapability n) = (Fault_H.InvalidCapability n)\"\n| \"syscall_error_map ExceptionTypes_A.IllegalOperation = Fault_H.IllegalOperation\"\n| \"syscall_error_map (ExceptionTypes_A.RangeError n m) = Fault_H.RangeError n m\"\n| \"syscall_error_map ExceptionTypes_A.AlignmentError = Fault_H.AlignmentError\"\n| \"syscall_error_map (ExceptionTypes_A.FailedLookup b lf) = Fault_H.FailedLookup b (lookup_failure_map lf)\"\n| \"syscall_error_map ExceptionTypes_A.TruncatedMessage = Fault_H.TruncatedMessage\"\n| \"syscall_error_map ExceptionTypes_A.DeleteFirst = Fault_H.DeleteFirst\"\n| \"syscall_error_map ExceptionTypes_A.RevokeFirst = Fault_H.RevokeFirst\"\n| \"syscall_error_map (ExceptionTypes_A.NotEnoughMemory n) = Fault_H.syscall_error.NotEnoughMemory n\"\n\ndefinition APIType_map :: \"Structures_A.apiobject_type \\ RISCV64_H.object_type\" where\n \"APIType_map ty \\\n case ty of\n Structures_A.Untyped \\ APIObjectType ArchTypes_H.Untyped\n | Structures_A.TCBObject \\ APIObjectType ArchTypes_H.TCBObject\n | Structures_A.EndpointObject \\ APIObjectType ArchTypes_H.EndpointObject\n | Structures_A.NotificationObject \\ APIObjectType ArchTypes_H.NotificationObject\n | Structures_A.CapTableObject \\ APIObjectType ArchTypes_H.CapTableObject\n | ArchObject ao \\ (case ao of\n SmallPageObj \\ SmallPageObject\n | LargePageObj \\ LargePageObject\n | HugePageObj \\ HugePageObject\n | PageTableObj \\ PageTableObject)\"\n\ndefinition state_relation :: \"(det_state \\ kernel_state) set\" where\n \"state_relation \\ {(s, s').\n pspace_relation (kheap s) (ksPSpace s')\n \\ ekheap_relation (ekheap s) (ksPSpace s')\n \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\n \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\n \\ ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\n \\ cdt_relation (swp cte_at s) (cdt s) (ctes_of s')\n \\ cdt_list_relation (cdt_list s) (cdt s) (ctes_of s')\n \\ revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s')\n \\ (arch_state s, ksArchState s') \\ arch_state_relation\n \\ interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s')\n \\ (cur_thread s = ksCurThread s')\n \\ (idle_thread s = ksIdleThread s')\n \\ (machine_state s = ksMachineState s')\n \\ (work_units_completed s = ksWorkUnitsCompleted s')\n \\ (domain_index s = ksDomScheduleIdx s')\n \\ (domain_list s = ksDomSchedule s')\n \\ (cur_domain s = ksCurDomain s')\n \\ (domain_time s = ksDomainTime s')}\"\n\ntext \\Rules for using states in the relation.\\\n\nlemma curthread_relation:\n \"(a, b) \\ state_relation \\ ksCurThread b = cur_thread a\"\n by (simp add: state_relation_def)\n\nlemma state_relation_pspace_relation[elim!]:\n \"(s,s') \\ state_relation \\ pspace_relation (kheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relation_ekheap_relation[elim!]:\n \"(s,s') \\ state_relation \\ ekheap_relation (ekheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relationD:\n \"(s, s') \\ state_relation \\\n pspace_relation (kheap s) (ksPSpace s') \\\n ekheap_relation (ekheap s) (ksPSpace s') \\\n sched_act_relation (scheduler_action s) (ksSchedulerAction s') \\\n ready_queues_relation (ready_queues s) (ksReadyQueues s') \\\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') \\\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s') \\\n (arch_state s, ksArchState s') \\ arch_state_relation \\\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \\\n cur_thread s = ksCurThread s' \\\n idle_thread s = ksIdleThread s' \\\n machine_state s = ksMachineState s' \\\n work_units_completed s = ksWorkUnitsCompleted s' \\\n domain_index s = ksDomScheduleIdx s' \\\n domain_list s = ksDomSchedule s' \\\n cur_domain s = ksCurDomain s' \\\n domain_time s = ksDomainTime s'\"\n unfolding state_relation_def by simp\n\nlemma state_relationE [elim?]:\n assumes sr: \"(s, s') \\ state_relation\"\n and rl: \"\\ pspace_relation (kheap s) (ksPSpace s');\n ekheap_relation (ekheap s) (ksPSpace s');\n sched_act_relation (scheduler_action s) (ksSchedulerAction s');\n ready_queues_relation (ready_queues s) (ksReadyQueues s');\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s');\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s');\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s');\n (arch_state s, ksArchState s') \\ arch_state_relation;\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s');\n cur_thread s = ksCurThread s';\n idle_thread s = ksIdleThread s';\n machine_state s = ksMachineState s';\n work_units_completed s = ksWorkUnitsCompleted s';\n domain_index s = ksDomScheduleIdx s';\n domain_list s = ksDomSchedule s';\n cur_domain s = ksCurDomain s';\n domain_time s = ksDomainTime s' \\ \\ R\"\n shows \"R\"\n using sr by (blast intro!: rl dest: state_relationD)\n\nlemmas isCap_defs =\n isZombie_def isArchObjectCap_def\n isThreadCap_def isCNodeCap_def isNotificationCap_def\n isEndpointCap_def isUntypedCap_def isNullCap_def\n isIRQHandlerCap_def isIRQControlCap_def isReplyCap_def\n isFrameCap_def isPageTableCap_def\n isASIDControlCap_def isASIDPoolCap_def\n isDomainCap_def isArchFrameCap_def\n\nlemma isCNodeCap_cap_map[simp]:\n \"cap_relation c c' \\ isCNodeCap c' = is_cnode_cap c\"\n by (cases c) (auto simp: isCap_defs split: sum.splits)\n\nlemma sts_rel_idle :\n \"thread_state_relation st IdleThreadState = (st = Structures_A.IdleThreadState)\"\n by (cases st, auto)\n\nlemma pspace_relation_absD:\n \"\\ ab x = Some y; pspace_relation ab con \\\n \\ \\(x', P) \\ obj_relation_cuts y x. \\z. con x' = Some z \\ P y z\"\n apply (clarsimp simp: pspace_relation_def)\n apply (drule bspec, erule domI)\n apply simp\n apply (drule(1) bspec)\n apply (subgoal_tac \"a \\ pspace_dom ab\", clarsimp)\n apply (simp (no_asm) add: pspace_dom_def)\n apply (fastforce simp: image_def intro: rev_bexI)\n done\n\nlemma ekheap_relation_absD:\n \"\\ ab x = Some y; ekheap_relation ab con \\ \\\n \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation y tcb'\"\n by (force simp add: ekheap_relation_def)\n\nlemma in_related_pspace_dom:\n \"\\ s' x = Some y; pspace_relation s s' \\ \\ x \\ pspace_dom s\"\n by (clarsimp simp add: pspace_relation_def)\n\nlemma pspace_dom_revE:\n \"\\ x \\ pspace_dom ps; \\ko y P. \\ ps y = Some ko; (x, P) \\ obj_relation_cuts ko y \\ \\ R \\ \\ R\"\n by (clarsimp simp add: pspace_dom_def)\n\nlemma pspace_dom_relatedE:\n \"\\ s' x = Some ko'; pspace_relation s s';\n \\y ko P. \\ s y = Some ko; (x, P) \\ obj_relation_cuts ko y; P ko ko' \\ \\ R \\ \\ R\"\n apply (rule pspace_dom_revE [OF in_related_pspace_dom]; assumption?)\n apply (fastforce dest: pspace_relation_absD)\n done\n\nlemma ghost_relation_typ_at:\n \"ghost_relation (kheap s) ups cns \\\n (\\a sz. data_at sz a s = (ups a = Some sz)) \\\n (\\a n. typ_at (ACapTable n) a s = (cns a = Some n))\"\n apply (rule eq_reflection)\n apply (clarsimp simp: ghost_relation_def typ_at_eq_kheap_obj data_at_def)\n apply (intro conjI impI iffI allI; force)\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/refine/RISCV64/StateRelation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.30074557894124154, "lm_q1q2_score": 0.16791437072944146}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__29_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__29_on_rules imports n_germanSymIndex_lemma_on_inv__29\nbegin\nsection{*All lemmas on causal relation between inv__29*}\nlemma lemma_inv__29_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__29 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__29) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__29_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.32766831395172374, "lm_q1q2_score": 0.16767331708451452}} {"text": "theory Extra3\n imports ExtraInv VCTheoryLemmas\nbegin\n\ntheorem extra3: \"VC3 extraInv s0 requestButton_value\"\n apply(simp only: VC3_def extraInv_def)\nproof\n print_state\n assume \"(toEnvP s0 \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)) \\\n env (setVarAny s0 requestButton_value) requestButton_value \\\n getPstate (setVarAny s0 requestButton_value) Ctrl = minimalRed \\\n getVarBool (setVarAny s0 requestButton_value) Ctrl \\\n \\ MINIMAL_RED_TIME_LIMIT\n \\ ltimeEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED) Ctrl\"\n then obtain ei0: \"toEnvP s0\"\nand ei1: \" (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT)\"\nand ei2: \" (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed))\"\nand ei3: \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed)\"\nand ei4: \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\nand ei5: \" (\\s1. toEnvP s1 \\\n substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED)))\"\nand ei6:\"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT)\"\nand ei7: \"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED)))\"\nand ei8: \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen)\"\nand ei9: \"(\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\nand ei10: \"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT)\"\nand ei11: \"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT))\"\nand ei12: \"(\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green)\"\nand ei13: \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\ (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\nand ei14: \" (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\ getVarBool s1 minimalRed = PRESSED)\"\nand ei15: \"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl \\ green \\ getVarBool s1 minimalRed = NOT_PRESSED)\"\nand ei16: \" (\\s1. toEnvP s1 \\ substate s1 s0 \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \"\nand ei17: \"(\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 s0 \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED)\"\nand ei18: \" (\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED))\"\nand ei19: \"(\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED)))\"\nand ei20: \" (\\s1. toEnvP s1 \\ substate s1 s0 \\ getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)\"\nand vc: \" env (setVarAny s0 requestButton_value) requestButton_value \\\n getPstate (setVarAny s0 requestButton_value) Ctrl = minimalRed \\\n getVarBool (setVarAny s0 requestButton_value) Ctrl \\\n \\ MINIMAL_RED_TIME_LIMIT\n \\ ltimeEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED) Ctrl\"\n by fast\n have \"toEnvP (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED))\"\n by auto\n moreover from ei1 vc have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT)\"\n by auto\n moreover have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed))\"\n proof\n fix s1\n show \"toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)\"\n proof cases\n assume 1: \"s1 = (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED))\"\n show ?thesis\n proof\n from ei0 vc substate_refl ei2 have \"(\\s2. toEnvP s2 \\\n substate s2 s0 \\\n toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed)\"\n by auto\n thus \"(\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)\"\n proof\n assume \"\\s2. toEnvP s2 \\\n substate s2 s0 \\\n toEnvNum s2 s0 = ltimeEnv s0 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT\"\n with 1 vc show ?thesis by fastforce\n next\n assume \"\\s2. toEnvP s2 \\ substate s2 s0 \\ getPstate s2 Ctrl = minimalRed\"\n with 1 vc show ?thesis by auto\n qed\n qed\n next\n assume \"s1 \\ toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED) \"\n with ei2 show ?thesis by auto\n qed\nqed\n moreover have \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed)\"\n using vc ei3 ei0 substate_refl by auto\n moreover from ei4 vc ei0 substate_refl have \"(\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\n sorry\n moreover from ei5 have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED)))\"\n by auto\n moreover from ei6 vc have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT)\"\n by auto\n moreover from ei7 vc have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED)))\"\n by auto\n moreover from ei8 vc have \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen)\"\n by auto\n moreover from ei9 vc have \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\n by auto\n moreover from ei10 vc have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT)\"\n by auto\n moreover from ei11 vc have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT))\"\n by auto\n moreover from ei12 vc have \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green)\"\n by auto\n moreover from ei13 vc have \"(\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl)\"\n by auto\n moreover from ei14 vc have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 minimalRed = PRESSED)\"\n by auto\n moreover from ei15 vc ei0 substate_refl have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl \\ green \\\n getVarBool s1 minimalRed = NOT_PRESSED)\"\n by auto\n moreover from ei16 vc have \"(\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green)\"\n by auto\n moreover from ei17 vc have \" (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED)\"\n by auto\n moreover have \" (\\s2. toEnvP s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED))\"\n proof\n fix s2\n show \"toEnvP s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)\"\n proof cases\n assume 1: \"s2 = (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED))\"\n with vc have \" ( toEnvP s2 \\ substate s2 s2 \\ toEnvNum s2 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s2 Ctrl = PRESSED)\"\n using ei0 by (cases s0; auto)\n then show ?thesis by blast\n next\n assume 1: \"s2 \\ (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED))\"\n with ei18 show ?thesis by auto\n qed\n qed\n moreover from ei19 vc have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \"\n by auto\n moreover from ei20 vc have \" (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)\"\n by auto\n ultimately\n show \" toEnvP (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ MINIMAL_RED_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\ getPstate s2 Ctrl = green \\ ltimeEnv s2 Ctrl = GREEN_TIME_LIMIT) \\\n (\\s2. toEnvP s2 \\ substate s2 s1 \\ getPstate s2 Ctrl = minimalRed)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = minimalRed) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = minimalRed) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n (\\s3. toEnvP s3 \\ substate s2 s3 \\ substate s3 s1 \\ s2 \\ s3 \\\n getPstate s3 Ctrl = redAfterMinimalRed \\\n getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\ getVarBool s3 Ctrl = NOT_PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ RED_TO_GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redToGreen \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s1 Ctrl \\\n getPstate s2 Ctrl = redAfterMinimalRed \\\n (getVarBool s2 redAfterMinimalRed = PRESSED \\ getVarBool s2 Ctrl = PRESSED))) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\ getPstate s2 Ctrl = redToGreen \\\n getPstate s1 Ctrl = redToGreen) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = redToGreen) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n 0 < ltimeEnv s1 Ctrl \\ ltimeEnv s1 Ctrl \\ GREEN_TIME_LIMIT) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = ltimeEnv s2 Ctrl \\\n getPstate s2 Ctrl = redToGreen \\ ltimeEnv s2 Ctrl = RED_TO_GREEN_TIME_LIMIT)) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = green \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl \\\n getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n (\\s3. toEnvP s3 \\ substate s1 s3 \\ substate s3 s2 \\ getPstate s3 Ctrl = green) \\\n toEnvNum s1 s2 = ltimeEnv s2 Ctrl - ltimeEnv s1 Ctrl) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 minimalRed = PRESSED) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl \\ green \\\n getVarBool s1 minimalRed = NOT_PRESSED) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = minimalRed \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getPstate s1 Ctrl = redToGreen \\ getPstate s1 Ctrl = green) \\\n (\\s1 s2.\n toEnvP s1 \\\n toEnvP s2 \\\n substate s1 s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\\n getVarBool s1 Ctrl = NOT_PRESSED) \\\n (\\s2. toEnvP s2 \\\n substate s2 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s2 Ctrl = minimalRed \\ getVarBool s2 redAfterMinimalRed = PRESSED \\\n (\\s1. toEnvP s1 \\\n substate s1 s2 \\ toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\ getVarBool s1 Ctrl = PRESSED)) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = redAfterMinimalRed \\ getVarBool s1 redAfterMinimalRed \\\n (\\s2. toEnvP s2 \\\n substate s2 s1 \\\n toEnvNum s2 s1 = Ctrl \\\n getPstate s2 Ctrl = minimalRed \\\n ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\\n (getVarBool s2 redAfterMinimalRed \\ getVarBool s1 Ctrl = PRESSED))) \\\n (\\s1. toEnvP s1 \\\n substate s1 (toEnv (setVarBool (setVarAny s0 requestButton_value) redAfterMinimalRed PRESSED)) \\\n getPstate s1 Ctrl = green \\\n getVarBool s1 redAfterMinimalRed = NOT_PRESSED)\" by blast\nqed\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/Extra3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117165898111865, "lm_q2_score": 0.3276683073862188, "lm_q1q2_score": 0.16767330884487952}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__58_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__58_on_rules imports n_german_lemma_on_inv__58\nbegin\nsection{*All lemmas on causal relation between inv__58*}\nlemma lemma_inv__58_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__58 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__58) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__58_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.2942149597859341, "lm_q1q2_score": 0.16765917491972418}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__52_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__52_on_rules imports n_g2kAbsAfter_lemma_on_inv__52\nbegin\nsection{*All lemmas on causal relation between inv__52*}\nlemma lemma_inv__52_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__52 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__52) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__52_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.30404168127272885, "lm_q1q2_score": 0.16740758913848247}} {"text": "theory Analyze_Synology_Diskstation\nimports iptables_Ln_tuned_parsed (*2014 firewall dump*)\n \"../../Primitive_Matchers/Parser\"\n \"../../Primitive_Matchers/Parser6\"\nbegin\n\n\nsection\\Example: Synology Diskstation 2014\\\ntext\\We analyze a dump of a NAS. The dump was created 2014. Unfortunately, we don't have an \n @{text \"iptables-save\"} dump from that time and have to rely on the @{text \"iptables -L -n\"}\n dump. This dump was translated by our legacy python importer.\\\n\n\ntext\\we removed the established,related rule\\\n definition \"example_ruleset == firewall_chains(''INPUT'' \\ \n remove1 (Rule (MatchAnd (Match (Src (IpAddrNetmask 0 0)))\n (MatchAnd (Match (Dst (IpAddrNetmask 0 0)))\n (MatchAnd (Match (Prot (ProtoAny)))\n (Match (Extra (''state RELATED,ESTABLISHED'')))))) (action.Accept)) (the (firewall_chains ''INPUT'')))\"\n\ntext\\Infix pretty-printing for @{const MatchAnd} and @{const MatchNot}.\\\nabbreviation MatchAndInfix :: \"'a match_expr \\ 'a match_expr \\ 'a match_expr\" (infixr \"MATCHAND\" 65) where\n \"MatchAndInfix m1 m2 \\ MatchAnd m1 m2\"\nabbreviation MatchNotPrefix :: \"'a match_expr \\ 'a match_expr\" (\"\\ \\_\\\" 66) where\n \"MatchNotPrefix m \\ MatchNot m\"\n(*abbreviation MatchPrefix :: \"'a \\ 'a match_expr\" (\"\\ _\" 67) where (*This is too slow*)\n \"MatchPrefix m \\ Match m\"*)\n(*This syntax can be pretty confusing when mixing it with other theories. Do not use outside this example!*)\n\n\nlemma \"unfold_ruleset_INPUT action.Accept example_ruleset =\n [Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp dpt:22'')) action.Drop,\n Rule (Match (Prot (Proto TCP)) MATCHAND Match (Extra ''multiport dports 21,873,5005,5006,80,548,111,2049,892''))\n action.Drop,\n Rule (Match (Prot (Proto UDP)) MATCHAND Match (Extra ''multiport dports 123,111,2049,892,5353'')) action.Drop,\n Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept, Rule MatchAny action.Drop,\n Rule MatchAny action.Accept, Rule MatchAny action.Accept]\n \" by eval\n\n lemma \"good_ruleset (unfold_ruleset_INPUT action.Accept example_ruleset)\" by eval\n lemma \"simple_ruleset (unfold_ruleset_INPUT action.Accept example_ruleset)\" by eval\n\n\n text\\packets from the local LAN are allowed (@{const in_doubt_allow})\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_allow)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (8,8,8,8),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\\n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalAllow\" by eval\n\n text\\However, they might also be rate-limited, ... (we don't know about icmp)\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_deny)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (8,8,8,8),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\\n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalDeny\" by eval\n \n text\\But we can guarantee that packets from the outside are blocked!\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_allow)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (8,8,8,8), p_dst= 0, p_proto=TCP, p_sport=2065, p_dport=80,\n p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\ \n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalDeny\" by eval\n\n\n\ntext\\in doubt allow closure\\\nlemma upper: \"upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset) =\n [Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept,\n Rule MatchAny action.Drop]\" by eval\n\ntext\\in doubt deny closure\\\nlemma lower: \"lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset) =\n [Rule MatchAny action.Drop]\" by eval\n\n\ntext\\upper closure\\\nlemma \"rmshadow (common_matcher, in_doubt_allow) (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset)) UNIV = \n [Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept, Rule MatchAny action.Drop]\"\n(*<*)apply(subst upper)\napply(subst rmshadow.simps)\napply(simp del: rmshadow.simps)\napply(simp add: Matching_Ternary.matches_def)\napply(intro conjI impI)\n apply(rule_tac x=\"undefined\\p_iiface := ''eth0'', p_oiface := ''eth1'',\n p_src := ipv4addr_of_dotdecimal (8,8,8,8), p_dst := 0,\n p_proto := TCP, p_sport:=2065, p_dport:=80\\\" in exI)\n apply(simp add: ipv4addr_of_dotdecimal.simps ipv4addr_of_nat_def ipset_from_cidr_alt mask_def; fail)\napply(thin_tac \"\\p. x p\" for x)\napply(rule_tac x=\"undefined\\p_iiface := ''eth0'', p_oiface := ''eth1'',\n p_src := ipv4addr_of_dotdecimal (192,168,8,8), p_dst:= 0,\n p_proto:=TCP, p_sport:=2065, p_dport:=80\\ \" in exI)\napply(simp add: ipv4addr_of_dotdecimal.simps ipv4addr_of_nat_def ipset_from_cidr_alt mask_def; fail)\ndone(*>*)\n\n\ntext\\lower closure\\\nlemma \"rmshadow (common_matcher, in_doubt_deny) (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset)) UNIV = \n [Rule MatchAny action.Drop]\"\napply(subst lower)\napply(subst rmshadow.simps)\napply(simp del: rmshadow.simps)\napply(simp add: Matching_Ternary.matches_def)\ndone\n\n\n\nlemma \"check_simple_fw_preconditions (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset))\" by eval\n\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset)))\"\nlemma \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset))) =\n [''ACCEPT all -- 192.168.0.0/16 0.0.0.0/0 '',\n ''DROP all -- 0.0.0.0/0 0.0.0.0/0 '']\" by eval (*will break when simple_rule_ipv4_toString is changed*)\n\nlemma \"check_simple_fw_preconditions (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset))\" by eval\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset)))\"\n\n\nlemma \"length (unfold_ruleset_INPUT action.Accept example_ruleset) = 19\" by eval\ntext\\Wow, normalization has exponential(?) blowup here.\\\nlemma \"length (normalize_rules_dnf (unfold_ruleset_INPUT action.Accept example_ruleset)) = 259\" by eval\n\n\nsection\\Synology Diskstation 2015\\\ntext\\This is a snapshot from 2015, available as @{text \"iptables-save\"} format. The firewall definition\n and structure has changed with various firmware updates to the device.\n Also, the new parser also parses ports and interfaces\\\n\nparse_iptables_save ds2015_fw=\"iptables-save\"\n\nthm ds2015_fw_def\nthm ds2015_fw_INPUT_default_policy_def\n\n\ntext\\this time, we don't removed the established,related rule\\\n\n\nvalue[code] \"unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)\"\nlemma \"unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw) =\n[Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8''))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8''))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})))\n action.Drop,\n Rule (Match (IIface (Iface ''lo''))) action.Accept, Rule (Match (CT_State {CT_Related, CT_Established})) action.Accept,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND Match (Prot (Proto TCP)) MATCHAND Match (Dst_Ports (L4Ports TCP [(0x16, 0x16)]))) action.Drop,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (Dst_Ports (L4Ports TCP \n [(0x15, 0x15), (0x369, 0x369), (0x138D, 0x138D), (0x138E, 0x138E), (0x50, 0x50), (0x224, 0x224), (0x6F, 0x6F), (0x37C, 0x37C),\n (0x801, 0x801)])))\n action.Drop,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto UDP)) MATCHAND Match (Dst_Ports (L4Ports UDP [(0x7B, 0x7B), (0x6F, 0x6F), (0x37C, 0x37C), (0x801, 0x801), (0x14E9, 0x14E9)])))\n action.Drop,\n Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16)) MATCHAND Match (IIface (Iface ''eth0''))) action.Accept,\n Rule (Match (IIface (Iface ''eth0''))) action.Drop, Rule MatchAny action.Accept]\" by eval\n\nvalue[code] \"map common_primitive_rule_toString (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))\"\n\nvalue[code] \"(upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))\"\n\nvalue[code] \"optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))\"\n\nvalue[code] \"upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))\"\n\nlemma \"check_simple_fw_preconditions (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))))\" by eval\n\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall\n (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\"\nlemma \"simple_fw_valid (to_simple_firewall\n (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall\n (lower_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\" by eval\n\nparse_iptables_save ds2015_2_fw=\"iptables-save_jun_2015_cleanup\"\ntext\\In 2015 there was also an update and a cleanup of the ruleset.\nThe following should be fulfilled:\nPort 80 globally blocked (fulfilled, only reachable by localhost).\nPort 22 globally blocked (not fulfilled, error in the ruleset).\nPort 8080 only reachable from 192.168.0.0/24 and localhost (fulfilled).\n\\\n\nvalue[code] \"unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw)\"\n\nlemma \"access_matrix_pretty_ipv4 parts_connection_ssh\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) =\n ([(''0.0.0.0'', ''{0.0.0.0 .. 255.255.255.255}'')\n ],\n [(''0.0.0.0'', ''0.0.0.0'')])\" by eval\n\n\nlemma \"access_matrix_pretty_ipv4 parts_connection_http\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) =\n ([(''0.0.0.0'', ''{0.0.0.0 .. 126.255.255.255} u {128.0.0.0 .. 255.255.255.255}''),\n (''127.0.0.0'', ''{127.0.0.0 .. 127.255.255.255}'')\n ],\n [(''127.0.0.0'', ''0.0.0.0''),\n (''127.0.0.0'', ''127.0.0.0'')])\" by eval\n\nlemma \"access_matrix_pretty_ipv4 (mk_parts_connection_TCP 10000 8080)\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) = \n ([(''127.0.0.0'', ''{127.0.0.0 .. 127.255.255.255} u {192.168.0.0 .. 192.168.255.255}''),\n (''0.0.0.0'', ''{0.0.0.0 .. 126.255.255.255} u {128.0.0.0 .. 192.167.255.255} u {192.169.0.0 .. 255.255.255.255}'')\n ],\n [(''127.0.0.0'', ''127.0.0.0''),\n (''127.0.0.0'', ''0.0.0.0'')])\" by eval\n\n\n\ntext\\The 2016 version with IPv6 is very interesting. \n Some source ports for UDP are just allowed.\n Is this a typo? The original structure with the @{const Return}s is very complicated.\n Here is what is actually dropped and accepted:\\\nparse_ip6tables_save ds_2016_ipv6 = \"ip6tables-save_jul_2016\" (*5s*)\n\nlemma \"map simple_rule_ipv6_toString\n (to_simple_firewall (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD ds_2016_ipv6_FORWARD_default_policy\n (map_of ds_2016_ipv6))))))) =\n[ ''ACCEPT all -- ::/0 ::/0 in: lo '',\n ''ACCEPT ipv6-icmp -- fe80::/10 ::/0 '',\n ''DROP tcp -- ::/0 ::/0 dports: 21'',\n ''DROP tcp -- ::/0 ::/0 dports: 873'',\n ''DROP tcp -- ::/0 ::/0 dports: 631'',\n ''DROP tcp -- ::/0 ::/0 dports: 515'',\n ''DROP tcp -- ::/0 ::/0 dports: 3260:3262'',\n ''DROP tcp -- ::/0 ::/0 dports: 22:23'',\n ''DROP tcp -- ::/0 ::/0 dports: 548'',\n ''DROP tcp -- ::/0 ::/0 dports: 3493'',\n ''DROP tcp -- ::/0 ::/0 dports: 3306'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5353'',\n ''DROP tcp -- ::/0 ::/0 dports: 111'',\n ''DROP tcp -- ::/0 ::/0 dports: 892'',\n ''DROP tcp -- ::/0 ::/0 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 2049'',\n ''DROP tcp -- ::/0 ::/0 dports: 0:79'',\n ''DROP tcp -- ::/0 ::/0 dports: 81:442'',\n ''DROP tcp -- ::/0 ::/0 dports: 444:9024'',\n ''DROP tcp -- ::/0 ::/0 dports: 9041:50000'',\n ''DROP tcp -- ::/0 ::/0 dports: 50003:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 65002:65535'',\n (*The following eth0 rules are shadowed*)\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 0:79'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 81:442'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 444:9024'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 9041:50000'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 50003:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 65002:65535'',\n ''ACCEPT all -- ::/0 ::/0 '']\"\nby eval (*50s*)\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Examples/Synology_Diskstation_DS414/Analyze_Synology_Diskstation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.31742626558767584, "lm_q1q2_score": 0.16738411479905235}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__19_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__19_on_rules imports n_german_lemma_on_inv__19\nbegin\nsection{*All lemmas on causal relation between inv__19*}\nlemma lemma_inv__19_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__19 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__19) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__19_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.32423541204073586, "lm_q1q2_score": 0.1671822358308615}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__106.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__106 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__106 and some rule r*}\nlemma n_PI_Remote_GetVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__106:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__106:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__106:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__106:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__106:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__106:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__106:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__106:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__106:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__106 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__106:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__106:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__106:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__106:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__106:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__106:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__106:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__106:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__106:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__106:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__106:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__106:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__106:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__106:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__106:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__106:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__106:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__106:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__106:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__106:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__106:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__106:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__106:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__106.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.16718222573003486}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__48_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__48_on_rules imports n_german_lemma_on_inv__48\nbegin\nsection{*All lemmas on causal relation between inv__48*}\nlemma lemma_inv__48_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__48 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__48) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__48_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3242353859211693, "lm_q1q2_score": 0.16718222236309274}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_on_inv__46.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_on_inv__46 imports n_germanSimp_base\nbegin\nsection{*All lemmas on causal relation between inv__46 and some rule r*}\nlemma n_RecvReqSVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqS N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__0Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__0 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvReqE__part__1Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvReqE__part__1 N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Ident ''CurCmd'')) (Const Empty))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__0Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__46:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__46 p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__46:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntSVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntSVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntS i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvGntEVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_RecvGntE i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendGntEVsinv__46:\n assumes a1: \"\\ i. i\\N\\r=n_SendGntE N i\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__46 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_on_inv__46.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3311197462295937, "lm_q1q2_score": 0.1668532833091155}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__54.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__54 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__54 and some rule r*}\nlemma n_NI_Remote_Get_Nak_HomeVsinv__54:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__54:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__54:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__54:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__54:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') src) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__54:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_GetVsinv__54:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__54:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__54:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__54:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__54:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__54:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__54:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__54:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__54 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__54:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__54:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_5Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_3Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__54:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__54:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__54:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__54:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__54:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_6Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__54:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__54:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_11Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__54:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__54:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__54:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__54:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__54:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10Vsinv__54:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8Vsinv__54:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__54:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_2Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__54:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__54:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__54:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__54:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_4Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__54:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" and\n a2: \"(f=inv__54 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__54.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3311197396289915, "lm_q1q2_score": 0.16685327998303132}} {"text": "(* Title: HOL/Auth/n_german_lemma_on_inv__35.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_on_inv__35 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__35 and some rule r*}\nlemma n_SendInv__part__0Vsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__0 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv0) ''Cmd'')) (Const GntE)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInv__part__1Vsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInv__part__1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv0) ''Cmd'')) (Const GntE)) (eqn (IVar (Para (Ident ''InvSet'') p__Inv2)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendInvAckVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendInvAck i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendInvAck i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntSVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_SendGntE N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''ShrSet'') p__Inv2)) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv2) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntSVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntS i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntS i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvGntEVsinv__35:\nassumes a1: \"(\\ i. i\\N\\r=n_RecvGntE i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_RecvGntE i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqE__part__1Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__1 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__35:\n assumes a1: \"\\ i d. i\\N\\d\\N\\r=n_Store i d\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvInvAckVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvInvAck i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqEVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqE N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqE__part__0Vsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqE__part__0 i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_SendReqSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_SendReqS i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_RecvReqSVsinv__35:\n assumes a1: \"\\ i. i\\N\\r=n_RecvReqS N i\" and\n a2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__35 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_on_inv__35.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061556288288, "lm_q2_score": 0.33111973302838926, "lm_q1q2_score": 0.16685327172317976}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__45_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__45_on_rules imports n_german_lemma_on_inv__45\nbegin\nsection{*All lemmas on causal relation between inv__45*}\nlemma lemma_inv__45_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__45 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__45) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__45) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__45_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.16682659662320187}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Sep_Solve_Example\nimports Sep_Solve\nbegin\n\n(* sep_solve invokes sep_cancel and sep_mp repeatedly to solve the goal, and fails if it can't\n completely discharge it *)\naxiomatization\n Moo :: \"'a :: stronger_sep_algebra => bool\" and\n Bar :: \"'a :: stronger_sep_algebra => bool\"\nwhere Moo_Bar[sep_cancel] : \"Moo s \\ Bar s\"\n\nlemma \"((Bar \\* Q \\* R \\* B) \\* Moo \\* A \\* R \\* Q) s \\ (A \\* B) s\"\n apply (sep_solve)\n done\n\n(* encouraging better proof style with different command for schematics in assumption *)\n\nschematic_goal \"((Bar \\* Q \\* R \\* B) \\* Moo \\* A \\* R \\* ?Q) s \\ (A \\* B) s\"\n apply (sep_schem)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/sep_algebra/Sep_Solve_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3276683008207139, "lm_q1q2_score": 0.1663938507049659}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__96_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__96_on_rules imports n_g2kAbsAfter_lemma_on_inv__96\nbegin\nsection{*All lemmas on causal relation between inv__96*}\nlemma lemma_inv__96_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__96 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__96) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__96) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__96_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.3040416749665475, "lm_q1q2_score": 0.16623118798850348}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__47_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__47_on_rules imports n_g2kAbsAfter_lemma_on_inv__47\nbegin\nsection{*All lemmas on causal relation between inv__47*}\nlemma lemma_inv__47_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__47 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__47) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__47) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__47_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.30404168127272885, "lm_q1q2_score": 0.16623118245435997}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__51_on_rules imports n_germanSimp_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__51 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3174262655876759, "lm_q1q2_score": 0.1661473666954556}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nCSpace invariants\n*)\n\ntheory ArchCSpaceInv_AI\nimports CSpaceInv_AI\nbegin\n\ncontext Arch begin global_naming X64\n\ndefinition\n safe_ioport_insert :: \"cap \\ cap \\ 'a::state_ext state \\ bool\"\nwhere\n \"safe_ioport_insert newcap oldcap \\\n \\s. (cap_ioports newcap = {} \\ \\replacing with any non-IOPortCap\\\n \\ ((\\cap''\\ ran (caps_of_state s).\n cap_ioports newcap = cap_ioports cap'' \\ \\copy another IOPortCap\\\n \\ cap_ioports newcap \\ cap_ioports cap'' = {} \\ \\new IOPortCap with unoverlapping range\\)))\n \\ ((cap_ioports newcap - cap_ioports oldcap) \\ issued_ioports (arch_state s)) \\ \\ all ioports are issued\\\"\n\nlemma cap_ioports_triv[simp]:\n \"\\is_arch_cap cap \\ cap_ioports cap = {}\"\n by (clarsimp simp: is_cap_simps cap_ioports_def split: cap.splits arch_cap.splits)\n\nlemma safe_ioport_insert_triv:\n \"\\is_arch_cap newcap \\ safe_ioport_insert newcap oldcap s\"\n by (clarsimp simp: safe_ioport_insert_def)\n\nlemma set_cap_ioports':\n \"\\\\s. valid_ioports s\n \\ cte_wp_at (\\cap'. safe_ioport_insert cap cap' s) ptr s\\\n set_cap cap ptr\n \\\\rv. valid_ioports\\\"\n apply (simp add: valid_ioports_def)\n apply (rule hoare_conjI)\n apply (simp add: all_ioports_issued_def Ball_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift')\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_ioport_insert_def elim!: ranE split: if_split_asm)\n apply (auto)[2]\n apply (unfold ioports_no_overlap_def Ball_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift')\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_ioport_insert_def elim!: ranE split: if_split_asm)\n apply blast+\n done\n\nlemma set_cap_ioports_no_new_ioports:\n \"\\\\s. valid_ioports s\n \\ cte_wp_at (\\cap'. cap_ioports cap = {} \\ cap_ioports cap = cap_ioports cap') ptr s\\\n set_cap cap ptr\n \\\\rv. valid_ioports\\\"\n apply (simp add: valid_ioports_def)\n apply (rule hoare_conjI)\n apply (simp add: all_ioports_issued_def Ball_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift')\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_ioport_insert_def elim!: ranE split: if_split_asm)\n apply (auto)[2]\n apply (unfold ioports_no_overlap_def Ball_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift')\n apply (clarsimp simp: cte_wp_at_caps_of_state all_ioports_issued_def ioports_no_overlap_def\n elim!: ranE\n split: if_split_asm)\n apply (metis Int_empty_left ranI)\n apply (metis Int_empty_right ranI)\n by (meson ranI)\n\nlemma valid_ioportsD:\n \"\\valid_ioports s; caps_of_state s p = Some cap; cap' \\ ran (caps_of_state s);\n cap_ioports cap \\ cap_ioports cap' \\ {}\\\n \\ cap_ioports cap = cap_ioports cap'\"\n apply (simp add: valid_ioports_def ioports_no_overlap_def)\n by auto\n\nlemma unique_table_refs_no_cap_asidE:\n \"\\caps_of_state s p = Some cap;\n unique_table_refs (caps_of_state s)\\\n \\ no_cap_to_obj_with_diff_ref cap S s\"\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (unfold unique_table_refs_def)\n apply (drule_tac x=p in spec, drule_tac x=\"(a,b)\" in spec)\n apply (drule spec)+\n apply (erule impE, assumption)+\n apply (clarsimp simp: is_cap_simps)\n done\n\nlemmas unique_table_refs_no_cap_asidD\n = unique_table_refs_no_cap_asidE[where S=\"{}\"]\n\nlemma replace_cap_invs:\n \"\\\\s. invs s \\ cte_wp_at (replaceable s p cap) p s\n \\ cap \\ cap.NullCap\n \\ ex_cte_cap_wp_to (appropriate_cte_cap cap) p s\n \\ s \\ cap\\\n set_cap cap p\n \\\\rv s. invs s\\\"\n apply (simp add: invs_def valid_state_def valid_mdb_def2 valid_arch_mdb_def)\n apply (rule hoare_pre)\n apply (wp replace_cap_valid_pspace\n set_cap_caps_of_state2 set_cap_idle\n replace_cap_ifunsafe valid_irq_node_typ\n set_cap_typ_at set_cap_irq_handlers\n set_cap_valid_arch_caps set_cap_ioports_no_new_ioports\n set_cap_cap_refs_respects_device_region_replaceable)\n apply (clarsimp simp: valid_pspace_def cte_wp_at_caps_of_state\n replaceable_def)\n apply (rule conjI)\n apply (fastforce simp: tcb_cap_valid_def\n dest!: cte_wp_tcb_cap_valid [OF caps_of_state_cteD])\n apply (rule conjI)\n apply (erule_tac P=\"\\cps. mdb_cte_at cps (cdt s)\" in rsubst)\n apply (rule ext)\n apply (safe del: disjE)[1]\n apply (simp add: gen_obj_refs_empty final_NullCap)+\n apply (rule conjI)\n apply (simp add: untyped_mdb_def is_cap_simps)\n apply (erule disjE)\n apply (clarsimp, rule conjI, clarsimp+)[1]\n apply (erule allEI, erule allEI)\n apply (drule_tac x=\"fst p\" in spec, drule_tac x=\"snd p\" in spec)\n apply (clarsimp simp: gen_obj_refs_subset)\n apply (drule(1) disjoint_subset, erule (1) notE)\n apply (rule conjI)\n apply (erule descendants_inc_minor)\n apply simp\n apply (elim disjE)\n apply clarsimp\n apply clarsimp\n apply (rule conjI)\n apply (erule disjE)\n apply (simp add: fun_upd_def[symmetric] fun_upd_idem)\n apply (simp add: untyped_inc_def not_is_untyped_no_range)\n apply (rule conjI)\n apply (erule disjE)\n apply (simp add: fun_upd_def[symmetric] fun_upd_idem)\n apply (simp add: ut_revocable_def)\n apply (rule conjI)\n apply (erule disjE)\n apply (clarsimp simp: irq_revocable_def)\n apply clarsimp\n apply (clarsimp simp: irq_revocable_def)\n apply (rule conjI)\n apply (erule disjE)\n apply (simp add: fun_upd_def[symmetric] fun_upd_idem)\n apply (simp add: reply_master_revocable_def)\n apply (rule conjI)\n apply (erule disjE)\n apply (simp add: fun_upd_def[symmetric] fun_upd_idem)\n apply (clarsimp simp add: reply_mdb_def)\n apply (thin_tac \"\\a b. (a, b) \\ cte_refs cp nd \\ Q a b\\ R a b\" for cp nd Q R)\n apply (thin_tac \"is_pt_cap cap \\ P\" for cap P)+\n apply (thin_tac \"is_pd_cap cap \\ P\" for cap P)+\n apply (thin_tac \"is_pdpt_cap cap \\ P\" for cap P)+\n apply (thin_tac \"is_pml4_cap cap \\ P\" for cap P)+\n apply (rule conjI)\n apply (unfold reply_caps_mdb_def)[1]\n apply (erule allEI, erule allEI)\n apply (clarsimp split: if_split simp add: is_cap_simps\n simp del: split_paired_Ex split_paired_All)\n apply (rename_tac ptra ptrb rights')\n apply (rule_tac x=\"(ptra,ptrb)\" in exI)\n apply fastforce\n apply (unfold reply_masters_mdb_def)[1]\n apply (erule allEI, erule allEI)\n subgoal by (fastforce split: if_split_asm simp: is_cap_simps)\n apply (rule conjI)\n apply (erule disjE)\n apply (simp add: fun_upd_def[symmetric] fun_upd_idem)\n apply clarsimp\n apply (clarsimp simp: ioport_revocable_def is_cap_simps)\n apply (rule conjI)\n apply (erule disjE)\n apply (clarsimp simp add: is_reply_cap_to_def)\n apply (drule caps_of_state_cteD)\n apply (subgoal_tac \"cte_wp_at (is_reply_cap_to t) p s\")\n apply (erule(1) valid_reply_capsD [OF has_reply_cap_cte_wpD])\n apply (erule cte_wp_at_lift)\n apply (fastforce simp add:is_reply_cap_to_def)\n apply (simp add: is_cap_simps)\n apply (frule(1) valid_global_refsD2)\n apply (frule(1) cap_refs_in_kernel_windowD)\n apply (rule conjI)\n apply (erule disjE)\n apply (clarsimp simp: valid_reply_masters_def cte_wp_at_caps_of_state)\n apply (cases p, fastforce simp:is_master_reply_cap_to_def)\n apply (simp add: is_cap_simps)\n apply (elim disjE)\n apply simp\n apply (clarsimp simp: valid_table_capsD[OF caps_of_state_cteD]\n valid_arch_caps_def unique_table_refs_no_cap_asidE)\n apply clarsimp\n apply (rule conjI, rule Ball_emptyI, simp add: gen_obj_refs_subset)\n by clarsimp\n\n\ndefinition\n \"is_simple_cap_arch cap \\ \\is_pt_cap cap \\ \\ is_pd_cap cap\n \\ \\ is_pdpt_cap cap \\ \\ is_pml4_cap cap \\ \\ is_ioport_control_cap cap\"\n\ndeclare is_simple_cap_arch_def[simp]\n\nlemma is_simple_cap_arch:\n \"\\is_arch_cap cap \\ is_simple_cap_arch cap\"\n by (simp add: is_cap_simps)\n\n(* True when cap' is derived from cap. *)\ndefinition\n \"is_derived_arch cap' cap \\\n (is_vspace_table_cap cap' \\ cap_asid cap = cap_asid cap' \\ cap_asid cap' \\ None) \\\n (vs_cap_ref cap = vs_cap_ref cap' \\ is_pg_cap cap) \\ \\ is_ioport_control_cap cap'\"\n\nlemma is_derived_arch_non_arch:\n \"\\ is_arch_cap cap \\ \\ is_arch_cap cap' \\ is_derived_arch cap cap'\"\n unfolding is_derived_arch_def vs_cap_ref_def is_arch_cap_def is_ioport_control_cap_def\n is_pg_cap_def is_pt_cap_def is_pd_cap_def is_pdpt_cap_def is_pml4_cap_def\n by (auto split: cap.splits)\n\nlemma\n cap_master_cap_arch_simps:\n \"cap_master_arch_cap (ASIDPoolCap pool asid) = ASIDPoolCap pool 0\"\n \"cap_master_arch_cap ASIDControlCap = ASIDControlCap\"\n \"cap_master_arch_cap (IOPortCap f l) = IOPortCap f l\"\n \"cap_master_arch_cap (PageCap dev ref rghts maptype sz mapdata)\n = PageCap dev ref UNIV VMNoMap sz None\"\n \"cap_master_arch_cap (PageTableCap ptr x) = PageTableCap ptr None\"\n \"cap_master_arch_cap (PageDirectoryCap ptr x) = PageDirectoryCap ptr None\"\n \"cap_master_arch_cap (PDPointerTableCap ptr x) = PDPointerTableCap ptr None\"\n \"cap_master_arch_cap (PML4Cap ptr y) = PML4Cap ptr None\"\n by (simp add: cap_master_arch_cap_def)+\n\nlemmas cap_master_cap_def = cap_master_cap_def[simplified cap_master_arch_cap_def]\n\nlemma same_master_cap_same_types:\n \"cap_master_cap cap = cap_master_cap cap' \\\n (is_pt_cap cap = is_pt_cap cap') \\ (is_pd_cap cap = is_pd_cap cap') \\\n (is_pdpt_cap cap = is_pdpt_cap cap') \\ (is_pml4_cap cap = is_pml4_cap cap')\"\n by (clarsimp simp: cap_master_cap_def is_cap_simps\n split: cap.splits arch_cap.splits)\n\nlemma is_derived_cap_arch_asid_issues:\n \"is_derived_arch cap cap' \\\n cap_master_cap cap = cap_master_cap cap'\n \\ (is_vspace_table_cap cap \\ cap_asid cap \\ None)\n \\ (is_pg_cap cap \\ (vs_cap_ref cap = vs_cap_ref cap'))\"\n apply (simp add: is_derived_arch_def)\n by (auto simp: cap_master_cap_def is_cap_simps cap_asid_def\n split: cap.splits arch_cap.splits option.splits)\n\nlemma is_derived_cap_arch_asid:\n \"is_derived_arch cap cap' \\ cap_master_cap cap = cap_master_cap cap'\n \\ is_vspace_table_cap cap' \\ cap_asid cap = cap_asid cap'\"\n unfolding is_derived_arch_def\n apply (cases cap; cases cap'; simp)\n by (auto simp: is_cap_simps cap_master_cap_def split: arch_cap.splits)\n\ndefinition\n safe_parent_for_arch :: \"cap \\ cap \\ bool\"\nwhere\n \"safe_parent_for_arch cap parent \\\n (\\f l. cap = (cap.ArchObjectCap (IOPortCap f l)))\n \\ (parent = (cap.ArchObjectCap (IOPortControlCap)))\"\n\nlemma safe_parent_for_arch_not_arch:\n \"\\is_arch_cap cap \\ \\safe_parent_for_arch cap p\"\n by (clarsimp simp: safe_parent_for_arch_def is_cap_simps)\n\nlemma safe_parent_cap_range_arch:\n \"safe_parent_for_arch cap pcap \\ cap_range cap \\ cap_range pcap\"\n by (clarsimp simp: safe_parent_for_arch_def cap_range_def)\n\ndefinition\n \"cap_asid_base_arch cap \\ case cap of\n ASIDPoolCap _ asid \\ Some asid\n | _ \\ None\"\n\ndeclare cap_asid_base_arch_def[abs_def, simp]\n\ndefinition cap_asid_base :: \"cap \\ asid option\" where\n \"cap_asid_base cap \\ arch_cap_fun_lift cap_asid_base_arch None cap\"\n\nlemmas cap_asid_base_simps [simp] =\n cap_asid_base_def [simplified, split_simps cap.split arch_cap.split]\n\ndefinition\n \"cap_vptr_arch acap \\ case acap of\n (PageCap _ _ _ _ _ (Some (_, vptr))) \\ Some vptr\n | (PageTableCap _ (Some (_, vptr))) \\ Some vptr\n | (PageDirectoryCap _ (Some (_, vptr))) \\ Some vptr\n | (PDPointerTableCap _ (Some (_, vptr))) \\ Some vptr\n | _ \\ None\"\n\ndefinition\n \"cap_vptr cap \\ arch_cap_fun_lift cap_vptr_arch None cap\"\n\ndeclare cap_vptr_arch_def[abs_def, simp]\n\nlemmas cap_vptr_simps [simp] =\n cap_vptr_def [simplified, split_simps cap.split arch_cap.split option.split prod.split]\n\nend\n\ncontext begin interpretation Arch .\nrequalify_facts replace_cap_invs\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/X64/ArchCSpaceInv_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.32423539245106087, "lm_q1q2_score": 0.16591663897881023}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__156.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__156 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__156 and some rule r*}\nlemma n_PI_Remote_GetVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__156:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__156:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__156:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__156:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__156:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__156:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__156:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__156:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__156:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__156:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__156:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__156:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__156:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__156:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__156:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__156:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__156:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__156:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__156:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__156:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__156:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__156:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__156:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__156:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__156:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__156:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__156:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__156:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__156:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__156:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__156:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__156:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__156:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__156:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__156:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__156:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__156:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__156:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__156.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.32423539898095244, "lm_q1q2_score": 0.16591663749143337}} {"text": "theory Analyze_Synology_Diskstation\nimports iptables_Ln_tuned_parsed (*2014 firewall dump*)\n Iptables_Semantics.Parser\n Iptables_Semantics.Parser6\nbegin\n\n\nsection\\Example: Synology Diskstation 2014\\\ntext\\We analyze a dump of a NAS. The dump was created 2014. Unfortunately, we don't have an \n \\iptables-save\\ dump from that time and have to rely on the \\iptables -L -n\\\n dump. This dump was translated by our legacy python importer.\\\n\n\ntext\\we removed the established,related rule\\\n definition \"example_ruleset == firewall_chains(''INPUT'' \\ \n remove1 (Rule (MatchAnd (Match (Src (IpAddrNetmask 0 0)))\n (MatchAnd (Match (Dst (IpAddrNetmask 0 0)))\n (MatchAnd (Match (Prot (ProtoAny)))\n (Match (Extra (''state RELATED,ESTABLISHED'')))))) (action.Accept)) (the (firewall_chains ''INPUT'')))\"\n\ntext\\Infix pretty-printing for @{const MatchAnd} and @{const MatchNot}.\\\nabbreviation MatchAndInfix :: \"'a match_expr \\ 'a match_expr \\ 'a match_expr\" (infixr \"MATCHAND\" 65) where\n \"MatchAndInfix m1 m2 \\ MatchAnd m1 m2\"\nabbreviation MatchNotPrefix :: \"'a match_expr \\ 'a match_expr\" (\"\\ \\_\\\" 66) where\n \"MatchNotPrefix m \\ MatchNot m\"\n(*abbreviation MatchPrefix :: \"'a \\ 'a match_expr\" (\"\\ _\" 67) where (*This is too slow*)\n \"MatchPrefix m \\ Match m\"*)\n(*This syntax can be pretty confusing when mixing it with other theories. Do not use outside this example!*)\n\n\nlemma \"unfold_ruleset_INPUT action.Accept example_ruleset =\n [Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04''))\n action.Drop,\n Rule (\\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n \\ \\Match (Extra ''Prot icmp'') MATCHAND Match (Extra ''icmptype 8 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x04 limit: avg 1/sec burst 5'')\\ MATCHAND\n \\ \\Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02 limit: avg 10000/sec burst 100'')\\ MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp flags:0x17/0x02''))\n action.Drop,\n Rule (Match (Prot (Proto TCP)) MATCHAND Match (Extra ''tcp dpt:22'')) action.Drop,\n Rule (Match (Prot (Proto TCP)) MATCHAND Match (Extra ''multiport dports 21,873,5005,5006,80,548,111,2049,892''))\n action.Drop,\n Rule (Match (Prot (Proto UDP)) MATCHAND Match (Extra ''multiport dports 123,111,2049,892,5353'')) action.Drop,\n Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept, Rule MatchAny action.Drop,\n Rule MatchAny action.Accept, Rule MatchAny action.Accept]\n \" by eval\n\n lemma \"good_ruleset (unfold_ruleset_INPUT action.Accept example_ruleset)\" by eval\n lemma \"simple_ruleset (unfold_ruleset_INPUT action.Accept example_ruleset)\" by eval\n\n\n text\\packets from the local LAN are allowed (@{const in_doubt_allow})\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_allow)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (8,8,8,8),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\\n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalAllow\" by eval\n\n text\\However, they might also be rate-limited, ... (we don't know about icmp)\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_deny)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (192,168,2,45), p_dst= ipv4addr_of_dotdecimal (8,8,8,8),\n p_proto=TCP, p_sport=2065, p_dport=80, p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\\n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalDeny\" by eval\n \n text\\But we can guarantee that packets from the outside are blocked!\\\n lemma \"approximating_bigstep_fun (common_matcher, in_doubt_allow)\n \\p_iiface = ''eth0'', p_oiface = ''eth1'', p_src = ipv4addr_of_dotdecimal (8,8,8,8), p_dst= 0, p_proto=TCP, p_sport=2065, p_dport=80,\n p_tcp_flags = {TCP_SYN}, p_payload='''', p_tag_ctstate = CT_New\\ \n (unfold_ruleset_INPUT action.Accept example_ruleset)\n Undecided = Decision FinalDeny\" by eval\n\n\n\ntext\\in doubt allow closure\\\nlemma upper: \"upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset) =\n [Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept,\n Rule MatchAny action.Drop]\" by eval\n\ntext\\in doubt deny closure\\\nlemma lower: \"lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset) =\n [Rule MatchAny action.Drop]\" by eval\n\n\ntext\\upper closure\\\nlemma \"rmshadow (common_matcher, in_doubt_allow) (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset)) UNIV = \n [Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16))) action.Accept, Rule MatchAny action.Drop]\"\n(*<*)apply(subst upper)\napply(subst rmshadow.simps)\napply(simp del: rmshadow.simps)\napply(simp add: Matching_Ternary.matches_def)\napply(intro conjI impI)\n apply(rule_tac x=\"undefined\\p_iiface := ''eth0'', p_oiface := ''eth1'',\n p_src := ipv4addr_of_dotdecimal (8,8,8,8), p_dst := 0,\n p_proto := TCP, p_sport:=2065, p_dport:=80\\\" in exI)\n apply(simp add: ipv4addr_of_dotdecimal.simps ipv4addr_of_nat_def ipset_from_cidr_alt mask_def; fail)\napply(rule_tac x=\"undefined\\p_iiface := ''eth0'', p_oiface := ''eth1'',\n p_src := ipv4addr_of_dotdecimal (192,168,8,8), p_dst:= 0,\n p_proto:=TCP, p_sport:=2065, p_dport:=80\\ \" in exI)\napply(simp add: ipv4addr_of_dotdecimal.simps ipv4addr_of_nat_def ipset_from_cidr_alt mask_def; fail)\ndone(*>*)\n\n\ntext\\lower closure\\\nlemma \"rmshadow (common_matcher, in_doubt_deny) (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset)) UNIV = \n [Rule MatchAny action.Drop]\"\napply(subst lower)\napply(subst rmshadow.simps)\napply(simp del: rmshadow.simps)\napply(simp add: Matching_Ternary.matches_def)\ndone\n\n\n\nlemma \"check_simple_fw_preconditions (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset))\" by eval\n\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset)))\"\nlemma \"map simple_rule_ipv4_toString (to_simple_firewall (upper_closure (unfold_ruleset_INPUT action.Accept example_ruleset))) =\n [''ACCEPT all -- 192.168.0.0/16 0.0.0.0/0 '',\n ''DROP all -- 0.0.0.0/0 0.0.0.0/0 '']\" by eval (*will break when simple_rule_ipv4_toString is changed*)\n\nlemma \"check_simple_fw_preconditions (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset))\" by eval\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall (lower_closure (unfold_ruleset_INPUT action.Accept example_ruleset)))\"\n\n\nlemma \"length (unfold_ruleset_INPUT action.Accept example_ruleset) = 19\" by eval\ntext\\Wow, normalization has exponential(?) blowup here.\\\nlemma \"length (normalize_rules_dnf (unfold_ruleset_INPUT action.Accept example_ruleset)) = 259\" by eval\n\n\nsection\\Synology Diskstation 2015\\\ntext\\This is a snapshot from 2015, available as \\iptables-save\\ format. The firewall definition\n and structure has changed with various firmware updates to the device.\n Also, the new parser also parses ports and interfaces\\\n\nparse_iptables_save ds2015_fw=\"iptables-save\"\n\nthm ds2015_fw_def\nthm ds2015_fw_INPUT_default_policy_def\n\n\ntext\\this time, we don't removed the established,related rule\\\n\n\nvalue[code] \"unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)\"\nlemma \"unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw) =\n[Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8''))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8''))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})))\n action.Drop,\n Rule (\\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth1'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto ICMP)) MATCHAND Match (Extra ''-m icmp --icmp-type 8 -m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_RST})) MATCHAND Match (Extra ''-m limit --limit 1/sec'')\\ MATCHAND\n \\ \\Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})) MATCHAND\n Match (Extra ''-m limit --limit 10000/sec --limit-burst 100'')\\ MATCHAND\n Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND Match (L4_Flags (TCP_Flags {TCP_FIN, TCP_SYN, TCP_RST, TCP_ACK} {TCP_SYN})))\n action.Drop,\n Rule (Match (IIface (Iface ''lo''))) action.Accept, Rule (Match (CT_State {CT_Related, CT_Established})) action.Accept,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND Match (Prot (Proto TCP)) MATCHAND Match (Dst_Ports (L4Ports TCP [(0x16, 0x16)]))) action.Drop,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto TCP)) MATCHAND\n Match (Dst_Ports (L4Ports TCP \n [(0x15, 0x15), (0x369, 0x369), (0x138D, 0x138D), (0x138E, 0x138E), (0x50, 0x50), (0x224, 0x224), (0x6F, 0x6F), (0x37C, 0x37C),\n (0x801, 0x801)])))\n action.Drop,\n Rule (Match (IIface (Iface ''eth0'')) MATCHAND\n Match (Prot (Proto UDP)) MATCHAND Match (Dst_Ports (L4Ports UDP [(0x7B, 0x7B), (0x6F, 0x6F), (0x37C, 0x37C), (0x801, 0x801), (0x14E9, 0x14E9)])))\n action.Drop,\n Rule (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192, 168, 0, 0)) 16)) MATCHAND Match (IIface (Iface ''eth0''))) action.Accept,\n Rule (Match (IIface (Iface ''eth0''))) action.Drop, Rule MatchAny action.Accept]\" by eval\n\nvalue[code] \"map common_primitive_rule_toString (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))\"\n\nvalue[code] \"(upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))\"\n\nvalue[code] \"optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))\"\n\nvalue[code] \"upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))\"\n\nlemma \"check_simple_fw_preconditions (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw))))))\" by eval\n\nvalue[code] \"map simple_rule_ipv4_toString (to_simple_firewall\n (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\"\nlemma \"simple_fw_valid (to_simple_firewall\n (upper_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\" by eval\nlemma \"simple_fw_valid (to_simple_firewall\n (lower_closure (optimize_matches abstract_for_simple_firewall (upper_closure (packet_assume_new (unfold_ruleset_INPUT ds2015_fw_INPUT_default_policy (map_of ds2015_fw)))))))\" by eval\n\nparse_iptables_save ds2015_2_fw=\"iptables-save_jun_2015_cleanup\"\ntext\\In 2015 there was also an update and a cleanup of the ruleset.\nThe following should be fulfilled:\nPort 80 globally blocked (fulfilled, only reachable by localhost).\nPort 22 globally blocked (not fulfilled, error in the ruleset).\nPort 8080 only reachable from 192.168.0.0/24 and localhost (fulfilled).\n\\\n\nvalue[code] \"unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw)\"\n\nlemma \"access_matrix_pretty_ipv4 parts_connection_ssh\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) =\n ([(''0.0.0.0'', ''{0.0.0.0 .. 255.255.255.255}'')\n ],\n [(''0.0.0.0'', ''0.0.0.0'')])\" by eval\n\n\nlemma \"access_matrix_pretty_ipv4 parts_connection_http\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) =\n ([(''0.0.0.0'', ''{0.0.0.0 .. 126.255.255.255} u {128.0.0.0 .. 255.255.255.255}''),\n (''127.0.0.0'', ''{127.0.0.0 .. 127.255.255.255}'')\n ],\n [(''127.0.0.0'', ''0.0.0.0''),\n (''127.0.0.0'', ''127.0.0.0'')])\" by eval\n\nlemma \"access_matrix_pretty_ipv4 (mk_parts_connection_TCP 10000 8080)\n (to_simple_firewall_without_interfaces ipassmt_generic_ipv4 None\n (unfold_ruleset_INPUT ds2015_2_fw_INPUT_default_policy (map_of ds2015_2_fw))) = \n ([(''127.0.0.0'', ''{127.0.0.0 .. 127.255.255.255} u {192.168.0.0 .. 192.168.255.255}''),\n (''0.0.0.0'', ''{0.0.0.0 .. 126.255.255.255} u {128.0.0.0 .. 192.167.255.255} u {192.169.0.0 .. 255.255.255.255}'')\n ],\n [(''127.0.0.0'', ''127.0.0.0''),\n (''127.0.0.0'', ''0.0.0.0'')])\" by eval\n\n\n\ntext\\The 2016 version with IPv6 is very interesting. \n Some source ports for UDP are just allowed.\n Is this a typo? The original structure with the @{const Return}s is very complicated.\n Here is what is actually dropped and accepted:\\\nparse_ip6tables_save ds_2016_ipv6 = \"ip6tables-save_jul_2016\" (*5s*)\n\nlemma \"map simple_rule_ipv6_toString\n (to_simple_firewall (upper_closure\n (optimize_matches abstract_for_simple_firewall\n (upper_closure (packet_assume_new\n (unfold_ruleset_FORWARD ds_2016_ipv6_FORWARD_default_policy\n (map_of ds_2016_ipv6))))))) =\n[ ''ACCEPT all -- ::/0 ::/0 in: lo '',\n ''ACCEPT ipv6-icmp -- fe80::/10 ::/0 '',\n ''DROP tcp -- ::/0 ::/0 dports: 21'',\n ''DROP tcp -- ::/0 ::/0 dports: 873'',\n ''DROP tcp -- ::/0 ::/0 dports: 631'',\n ''DROP tcp -- ::/0 ::/0 dports: 515'',\n ''DROP tcp -- ::/0 ::/0 dports: 3260:3262'',\n ''DROP tcp -- ::/0 ::/0 dports: 22:23'',\n ''DROP tcp -- ::/0 ::/0 dports: 548'',\n ''DROP tcp -- ::/0 ::/0 dports: 3493'',\n ''DROP tcp -- ::/0 ::/0 dports: 3306'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5353'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 67:68'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 123'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 514'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 161'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 19999'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5353'',\n ''DROP tcp -- ::/0 ::/0 dports: 111'',\n ''DROP tcp -- ::/0 ::/0 dports: 892'',\n ''DROP tcp -- ::/0 ::/0 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 2049'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 111'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 892'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 2049'',\n ''DROP tcp -- ::/0 ::/0 dports: 0:79'',\n ''DROP tcp -- ::/0 ::/0 dports: 81:442'',\n ''DROP tcp -- ::/0 ::/0 dports: 444:9024'',\n ''DROP tcp -- ::/0 ::/0 dports: 9041:50000'',\n ''DROP tcp -- ::/0 ::/0 dports: 50003:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 0:5001 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 5003 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 5005:65000 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 sports: 65002:65535 dports: 65002:65535'',\n \\ \\The following eth0 rules are shadowed\\\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 0:79'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 81:442'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 444:9024'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 9041:50000'',\n ''DROP tcp -- ::/0 ::/0 in: eth0 dports: 50003:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 0:5001 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5003 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 5005:65000 dports: 65002:65535'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 0:1899'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 1901:5001'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 5003'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 5005:65000'',\n ''DROP udp -- ::/0 ::/0 in: eth0 sports: 65002:65535 dports: 65002:65535'',\n ''ACCEPT all -- ::/0 ::/0 '']\"\nby eval (*50s*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Examples/Synology_Diskstation_DS414/Analyze_Synology_Diskstation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165382362518, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.16560404960171293}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory SepCode\nimports\n Separation\n \"../Simpl/Vcg\"\nbegin\n\ndefinition\n singleton_t :: \"'a::c_type ptr \\ 'a \\ heap_state\"\nwhere\n \"singleton_t p v \\ lift_state (heap_update p v (\\x. 0), (ptr_retyp p empty_htd))\"\n\ndefinition\n tagd :: \"'a ptr_guard \\ 'a::c_type ptr \\ heap_assert\" (infix \"\\\\<^sub>s\" 100)\nwhere\n \"g \\\\<^sub>s p \\ \\s. s,g \\\\<^sub>s p \\ dom s = s_footprint p\"\n\ndefinition\n field_footprint :: \"'a::c_type ptr \\ qualified_field_name \\ (addr \\ s_heap_index) set\"\nwhere\n \"field_footprint p f \\ s_footprint_untyped (ptr_val p + of_nat (field_offset TYPE('a) f)) (export_uinfo (field_typ TYPE('a) f))\"\n\ndefinition\n fs_footprint :: \"'a::c_type ptr \\ qualified_field_name set \\ (addr \\ s_heap_index) set\"\nwhere\n \"fs_footprint p F \\ \\{field_footprint p f | f. f \\ F}\"\n\ndefinition fields :: \"'a::c_type itself \\ qualified_field_name set\" where\n \"fields t \\ {f. field_lookup (typ_info_t TYPE('a)) f 0 \\ None}\"\n\ndefinition\n mfs_sep_map :: \"'a::c_type ptr \\ 'a ptr_guard \\ qualified_field_name set \\ 'a \\ heap_assert\"\n (\"_ \\\\<^bsub>_\\<^esub>\\<^bsup>_\\<^esup> _\" [56,0,0,51] 56)\nwhere\n \"p \\\\<^bsub>g\\<^esub>\\<^bsup>F\\<^esup> v \\ \\s. lift_typ_heap g (singleton_t p v ++ s) p = Some v \\\n F \\ fields TYPE('a) \\\n dom s = s_footprint p - fs_footprint p F \\ wf_heap_val s\"\n\nnotation (input)\n mfs_sep_map (\"_ \\\\<^sub>_\\<^sup>_ _\" [56,0,1000,51] 56)\n\ndefinition\n disjoint_fn :: \"qualified_field_name \\ qualified_field_name set \\ bool\"\nwhere\n \"disjoint_fn f F \\ \\f'\\F. \\ f \\ f' \\ \\ f' \\ f\"\n\ndefinition\n sep_cut' :: \"addr \\ nat \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut' p n \\ \\s. dom s = {(x,y). x \\ {p..+n}}\"\n\ndefinition\n sep_cut :: \"addr \\ 32 word \\ (s_addr,'b) map_assert\"\nwhere\n \"sep_cut x y \\ sep_cut' x (unat y)\"\n\ntext {* ---- *}\n\n(* FIXME MOVE *)\nlemma heap_list_h_eq:\n \"\\p. \\ x \\ {p..+q}; q < addr_card; heap_list h q p = heap_list h' q p \\\n \\ h x = h' x\"\nproof (induct q)\n case 0 thus ?case by simp\nnext\n case (Suc n) thus ?case by (force dest: intvl_neq_start)\nqed\n\nlemma s_footprint_intvl:\n \"(a, SIndexVal) \\ s_footprint p = (a \\ {ptr_val (p::'a::c_type ptr)..+size_of TYPE('a)})\"\napply(auto simp: s_footprint_def s_footprint_untyped_def)\n apply(rule intvlI)\n apply(simp add: size_of_def)\napply(drule intvlD, clarsimp)\napply(simp add: size_of_def)\napply fast\ndone\n\nlemma singleton_t_dom [simp]:\n \"dom (singleton_t p (v::'a::mem_type)) = s_footprint p\"\napply(auto simp: singleton_t_def lift_state_def s_footprint_intvl split: s_heap_index.splits split_if_asm option.splits)\napply(rule ccontr)\n apply(simp add: ptr_retyp_None)\n prefer 2\n apply(simp add: ptr_retyp_footprint)\n prefer 2\n apply(frule s_footprintD2)\n apply(frule s_footprintD)\n apply(simp add: ptr_retyp_footprint)\napply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(simp add: list_map_eq split: split_if_asm)\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI)\n apply(subst (asm) word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(rule max_size)\n apply(simp add: map_le_def)\n apply assumption\napply(simp add: ptr_retyp_None)\ndone\n\nlemma heap_update_merge:\n assumes val: \"d,g \\\\<^sub>t p\"\n shows \"lift_state ((heap_update p (v::'a::mem_type) h),d)\n = lift_state (h,d) ++ singleton p v h d\" (is \"?x = ?y\")\nproof (rule ext, cases)\n fix x\n assume c: \"x \\ dom (singleton p v h d)\"\n with val have \"lift_state ((heap_update_list (ptr_val p)\n (to_bytes v (heap_list h (size_of TYPE('a)) (ptr_val p))) h),d) x = singleton p v h d x\"\napply(subst (asm) singleton_dom)\n apply fast\napply(cases x)\napply(auto simp: heap_list_update_to_bytes singleton_def lift_state_def\n heap_update_def\n split: option.splits s_heap_index.splits)\ndone\n with c show \"?x x = ?y x\" by (force simp: heap_update_def dest: domD)\nnext\n fix x\n assume nc: \"x \\ dom (singleton p v h d)\"\n with val show \"?x x = ?y x\"\napply -\napply(cases x)\napply(auto simp: lift_state_def heap_update_def map_add_def split: option.splits s_heap_index.splits)\napply(rule heap_update_nmem_same)\napply clarsimp\napply(subgoal_tac \"(a,SIndexVal) \\ dom (singleton p v h d)\")\n apply fast\napply(simp add: singleton_dom)\napply(drule intvlD, clarsimp)\napply(rule s_footprintI2)\napply simp\ndone\nqed\n\nlemma tagd_dom_exc:\n \"(g \\\\<^sub>s p) s \\ dom s = s_footprint p\"\n by (clarsimp simp: tagd_def)\n\nlemma tagd_dom_p_exc:\n \"(g \\\\<^sub>s p) s \\ (ptr_val (p::'a::mem_type ptr),SIndexVal) \\ dom s\"\napply(drule tagd_dom_exc)\napply(clarsimp)\ndone\n\nlemma tagd_g_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* P) s \\ g p\"\n by (drule sep_conjD, force simp: tagd_def elim: s_valid_g)\n\nlemma sep_map_tagd_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) s \\ (g \\\\<^sub>s p) s\"\n by (clarsimp simp: sep_map_def tagd_def lift_typ_heap_s_valid)\n\nlemma sep_map_any_tagd_exc:\n \"(p \\\\<^sub>g -) s \\ (g \\\\<^sub>s (p::'a::mem_type ptr)) s\"\n by (clarsimp dest!: sep_map_anyD_exc, erule sep_map_tagd_exc)\n\nlemma ptr_retyp_tagd_exc:\n \"g (p::'a::mem_type ptr) \\\n (g \\\\<^sub>s p) (lift_state (h, ptr_retyp p empty_htd))\"\napply(simp add: tagd_def ptr_retyp_s_valid lift_state_dom)\napply(auto simp: lift_state_def split: s_heap_index.splits split_if_asm option.splits)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(drule intvlD, clarsimp)\n apply(rule s_footprintI2, simp)\n apply(subst (asm) ptr_retyp_None)\n apply simp+\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: split_if_asm)\n apply(erule (1) s_footprintI)\n apply(simp add: ptr_retyp_None)\n apply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(simp add: ptr_retyp_footprint)\n apply(drule s_footprintD)\n apply simp\napply(case_tac \"a \\ {ptr_val p..+size_of TYPE('a)}\")\n apply(subst (asm) ptr_retyp_footprint)\n apply simp\n apply(drule intvlD, clarsimp)\n apply(subst (asm )word_unat.eq_norm)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(subst (asm) list_map_eq)\n apply(clarsimp split: split_if_asm)\n apply(drule s_footprintD2)\n apply simp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans, simp)\n apply simp\napply(drule s_footprintD)\napply simp\ndone\n\nlemma singleton_dom_proj_d [simp]:\n \"(g \\\\<^sub>s p) s \\ dom (singleton p (v::'a::mem_type) h (proj_d s)) = dom s\"\napply(clarsimp simp: tagd_def)\napply(subst singleton_dom)\n apply(simp add: s_valid_def)+\ndone\n\nlemma singleton_d_restrict_eq:\n \"restrict_s d (s_footprint p) = restrict_s d' (s_footprint p)\n \\ singleton p v h d = singleton p (v::'a::mem_type) h d'\"\napply(clarsimp simp: singleton_def)\napply(rule ext)\napply(case_tac \"x \\ s_footprint p\")\n prefer 2 apply simp\napply(case_tac x, clarsimp)\napply(drule_tac x=aa in fun_cong)\napply(auto simp: s_footprint_restrict lift_state_def\n split: s_heap_index.splits split_if_asm option.splits) (* FIXME! *)\n apply(clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"x2\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"x2\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"x2\" in fun_cong)\n apply clarsimp\n apply(clarsimp simp: restrict_s_def)\n apply(drule_tac x=\"x2\" in fun_cong)\n apply clarsimp\napply(clarsimp simp: restrict_s_def)\napply(drule_tac x=\"x2\" in fun_cong)\napply clarsimp\ndone\n\n\nlemma sep_heap_update'_exc:\n assumes sep: \"(g \\\\<^sub>s p \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d))\"\n shows \"P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\nproof -\n from sep obtain s\\<^sub>0 s\\<^sub>1 where disj: \"s\\<^sub>0 \\ s\\<^sub>1\" and\n merge: \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\" and\n l: \"(g \\\\<^sub>s p) s\\<^sub>0\" and r: \"(p \\\\<^sub>g v \\\\<^sup>* P) s\\<^sub>1\" by (force dest: sep_conjD)\n moreover hence \"s\\<^sub>1 \\ singleton p v h (proj_d s\\<^sub>0)\"\napply(clarsimp simp: map_disj_def)\napply fast\ndone\n moreover from l have \"g p\" by (force simp: tagd_def elim: s_valid_g)\n moreover from merge l have \"lift_state (h,d),g \\\\<^sub>s p\"\n by (force simp: tagd_def intro: s_valid_heap_merge_right)\n hence \"d,g \\\\<^sub>t p\" by (simp add: h_t_s_valid)\n moreover from l have \"s\\<^sub>0 ++ singleton p v h (proj_d s\\<^sub>0) = singleton p v h (proj_d s\\<^sub>0)\"\n by (force simp: map_add_dom_eq singleton_dom dest: tagd_dom_exc)\n moreover from l merge have \"s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0) = s\\<^sub>1 ++ s\\<^sub>0 ++ singleton p v h d\"\napply -\napply(clarsimp simp: tagd_def)\napply(rule ext)\napply(case_tac x, clarsimp simp: restrict_map_def)\napply(simp add: s_valid_def)\napply(drule_tac v=v and h=h in singleton_dom)\napply(drule_tac x=\"(aa,ba)\" in fun_cong)\napply(case_tac \"(aa,ba) \\ s_footprint p\")\n apply(subgoal_tac \"(s\\<^sub>1 ++ singleton p v h (proj_d s\\<^sub>0)) (aa, ba) = singleton p v h d (aa, ba)\")\n apply(clarsimp simp: map_add_def s_valid_def split: option.splits)\n apply force\n apply(rule exI, rule sym, assumption)\n apply(clarsimp simp: map_add_def split: option.splits)\n apply(force)\n apply(rule, clarsimp)\n apply force\n apply clarsimp\n apply(clarsimp simp: lift_state_def map_add_def split: option.splits s_heap_index.splits split_if_asm)\n apply(clarsimp simp: singleton_def lift_state_def split: split_if_asm)\n apply(clarsimp simp: singleton_def lift_state_def split: split_if_asm option.splits)\n apply(clarsimp simp: proj_d_def)\napply(auto simp: map_add_def singleton_def split: option.splits)\ndone\n ultimately show ?thesis\napply -\napply(drule sep_implD, drule_tac x=\"singleton p v h (proj_d s\\<^sub>0)\" in spec)\napply clarsimp\napply(subst heap_update_merge)\n apply fast\napply(subst (asm) sep_map_singleton)\n apply(clarsimp simp: tagd_def s_valid_def)\napply clarsimp\ndone\nqed\n\nlemma sep_heap_update_exc:\n \"\\ (p \\\\<^sub>g - \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P)) (lift_state (h,d)) \\ \\\n P (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (force intro: sep_heap_update'_exc dest: sep_map_anyD_exc sep_map_tagd_exc\n elim: sep_conj_impl)\n\nlemma sep_heap_update_global'_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (rule sep_heap_update'_exc, erule sep_conj_sep_conj_sep_impl_sep_conj)\n\nlemma sep_heap_update_global_exc:\n \"(p \\\\<^sub>g - \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\n by (fast intro: sep_heap_update_global'_exc sep_conj_impl sep_map_any_tagd_exc)\n\nlemma sep_heap_update_global_exc2:\n \"(p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d)) \\\n ((p \\\\<^sub>g v) \\\\<^sup>* R) (lift_state (heap_update p (v::'a::mem_type) h,d))\"\napply(rule sep_heap_update_global_exc)\napply(subst sep_map_any_def)\napply(subst sep_conj_exists)\napply fast\ndone\n\nlemma heap_update_mem_same_point [rule_format]:\n \"\\p h h'. q \\ {p..+length v} \\ length v < addr_card \\\n heap_update_list p v h q = v ! unat (q - p)\"\napply(induct_tac v)\n apply simp\napply clarsimp\napply(case_tac \"p=q\")\n apply simp\n apply(subst heap_update_list_same [where k=1, simplified])\n apply simp\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply(drule (1) intvl_neq_start)\n apply simp\napply simp\napply(subgoal_tac \"unat (q - p) = unat (1::32 word) + unat (q - (p + 1))\")\n apply(simp)\napply(subgoal_tac \"q - (p + 1) = (q-p) - 1\")\n apply(simp only:)\napply(subst unat_minus_one)\n apply simp+\n apply(subgoal_tac \"unat (q - p) \\ 0\")\n apply simp\n apply clarsimp\n apply(subst unat_gt_0)\n apply simp+\ndone\n\nlemma heap_update_list_value:\n \"length v < addr_card \\\n heap_update_list p v h q =\n (if q \\ {p..+length v} then v!unat (q-p) else h q)\"\nby (auto simp add: heap_update_nmem_same heap_update_mem_same_point\n split: split_if)\n\nlemma heap_update_list_value':\n \"length xs < addr_card \\\n heap_update_list ptr xs hp x\n = (if unat (x - ptr) < length xs\n then xs ! unat (x - ptr)\n else hp x)\"\napply (simp only: heap_update_list_value addr_card_def card_word)\napply (rule if_cong)\n apply simp_all\napply (rule iffI)\n apply (drule intvlD, clarsimp simp add: unat_of_nat)\napply (simp add: intvl_def unat_arith_simps(4) unat_of_nat split: split_if_asm)\n apply (rule_tac x=\"unat x - unat ptr\" in exI, simp)\napply (rule_tac x=\"unat x + 2^32 - unat ptr\" in exI)\napply (cut_tac x=ptr in unat_lt2p)\napply (simp add: unat_arith_simps unat_of_nat)\ndone\n\nlemma heap_list_h_eq2 [rule_format]:\n \"\\p. (\\x. x \\ {p..+n} \\ h x = h' x) \\\n heap_list h n p = heap_list h' n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(thin_tac \"All P\" for P)\n apply(drule_tac x=p in spec)\n apply(erule impE)\n apply(rule intvl_self)\n apply simp+\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply(erule impE)\n apply(rule intvl_plus_sub_Suc)\n apply simp+\ndone\n\nlemma map_td_f_eq':\n \"(f=g) \\ (map_td f t = map_td g t)\"\n \"(f=g) \\ (map_td_struct f st = map_td_struct g st)\"\n \"(f=g) \\ (map_td_list f ts = map_td_list g ts)\"\n \"(f=g) \\ (map_td_pair f x = map_td_pair g x)\"\napply(induct t and st and ts and x)\n apply auto\ndone\n\nlemma map_td_f_eq:\n \"f=g \\ map_td f t = map_td g t\"\n by (erule arg_cong)\n\nlemma sep_map'_lift_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ lift h p = v\"\n by - (frule sep_map'_lift_typ_heapD, simp add: lift_t lift_t_lift)\n\nlemma sep_map_lift_wp_exc:\n \"\\ \\v. (p \\\\<^sub>g v \\\\<^sup>* (p \\\\<^sub>g v \\\\<^sup>* P v)) (lift_state (h,d)) \\\n \\ P (lift h (p::'a::mem_type ptr)) (lift_state (h,d))\"\napply clarsimp\napply(subst sep_map'_lift_exc)\n apply(subst sep_map'_def)\n apply(erule sep_conj_impl)\n apply assumption\n apply simp\napply(rule_tac P=\"p \\\\<^sub>g v\" and Q=\"P v\" in sep_conj_impl_same)\napply(erule (2) sep_conj_impl)\ndone\n\n\nlemma sep_map_lift_exc:\n \"((p::'a::mem_type ptr) \\\\<^sub>g -) (lift_state (h,d)) \\\n (p \\\\<^sub>g lift h p) (lift_state (h,d))\"\n by (clarsimp simp: sep_map_any_def)\n (frule sep_map_sep_map'_exc, drule sep_map'_lift_exc, simp)\n\nlemma sep_map'_lift_rev_exc:\n \"\\ lift h p = (v::'a::mem_type); (p \\\\<^sub>g -) (lift_state (h,d)) \\ \\\n (p \\\\<^sub>g v) (lift_state (h,d))\"\n by (clarsimp simp: sep_map'_any_def)\n (frule sep_map'_lift_exc, simp)\n\n(* FIXME: can be made more flexible when generalised separation conjunction\n is added *)\nlemma sep_lift_exists_exc:\n fixes p :: \"'a::mem_type ptr\"\n assumes ex: \"((\\s. \\v. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q) (lift_state (h,d))\"\n shows \"(P (lift h p) \\\\<^sup>* Q) (lift_state (h,d))\"\nproof -\n from ex obtain v where \"((\\s. (p \\\\<^sub>g v) s \\ P v s) \\\\<^sup>* Q)\n (lift_state (h,d))\"\n by (subst (asm) sep_conj_exists, clarsimp)\n thus ?thesis\n by (force simp: sep_map'_lift_exc sep_conj_ac\n dest: sep_map'_conjE2_exc dest!: sep_conj_conj)\nqed\n\nlemma merge_dom:\n \"x \\ dom s \\ (t ++ s) x = s x\"\n by (force simp: map_add_def)\n\nlemma merge_dom2:\n \"x \\ dom s \\ (t ++ s) x = t x\"\n by (force simp: map_add_def split: option.splits)\n\nlemma fs_footprint_empty [simp]:\n \"fs_footprint p {} = {}\"\n by (auto simp: fs_footprint_def)\n\nlemma fs_footprint_un:\n \"fs_footprint p (insert f F) = fs_footprint p {f} \\ fs_footprint p F\"\n by (auto simp: fs_footprint_def)\n\nlemma proj_d_restrict_map_le:\n \"snd (proj_d (s |` X) x) \\\\<^sub>m snd (proj_d s x)\"\napply(clarsimp simp: map_le_def proj_d_def restrict_map_def\n split: option.splits split_if_asm)\ndone\n\nlemma SIndexVal_conj_setcomp_simp [simp]:\n \"{x. snd x = SIndexVal \\ x \\ s_footprint_untyped p t}\n = {(x,SIndexVal) | x. x \\ {p..+size_td t}}\"\napply(auto simp: s_footprint_untyped_def)\n apply(drule intvlD, clarsimp)\n apply force\napply(erule notE)\napply(erule intvlI)\ndone\n\nlemma heap_list_s_restrict_same [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ X \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\napply(induct_tac n)\n apply(simp add: heap_list_s_def)\napply(clarsimp simp: heap_list_s_def)\napply rule\n apply(simp add: proj_h_def restrict_map_def)\n apply clarsimp\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self)\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply clarsimp\napply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\napply clarsimp\napply(rule intvl_plus_sub_Suc)\napply simp\ndone\n\nlemma heap_list_s_restrict_fs_footprint:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t,n) \\\n heap_list_s (s |` fs_footprint p {f}) (size_td t) &(p\\f)\n = heap_list_s s (size_td t) &((p::'a ptr)\\f)\"\napply(simp add: fs_footprint_def field_footprint_def field_offset_def)\napply(subst heap_list_s_restrict_same)\n apply(clarsimp simp add: s_footprint_untyped_def field_size_def field_lvalue_def field_offset_def field_ti_def)\n apply(drule intvlD, clarsimp)\n apply(simp add: field_typ_def field_typ_untyped_def)\n apply fast\napply simp\ndone\n\nlemma heap_list_proj_h_disj [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 = {} \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>0) n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(clarsimp simp: proj_h_def split: option.splits)\n apply(rule, clarsimp)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self, simp)\n apply clarsimp\n apply(erule disjE)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_self, simp)\n apply clarsimp\napply(drule_tac x=\"p+1\" in spec)\n apply(erule impE)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\n apply clarsimp\n apply(rule intvl_plus_sub_Suc)\n apply simp\napply simp\ndone\n\nlemma heap_list_proj_h_sub [rule_format]:\n \"\\p. {(x,SIndexVal) | x. x \\ {p..+n}} \\ dom s\\<^sub>1 \\\n heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) n p = heap_list (proj_h s\\<^sub>1) n p\"\napply(induct_tac n)\n apply simp\napply clarsimp\napply rule\n apply(clarsimp simp: proj_h_def split: option.splits)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply force\n apply(rule intvl_self, simp)\napply(drule_tac x=\"p+1\" in spec)\n apply(erule impE)\n apply(subgoal_tac \"{p + 1..+n} \\ {p..+Suc n}\")\n apply fast\n apply clarsimp\n apply(rule intvl_plus_sub_Suc)\n apply simp\napply simp\ndone\n\n\nlemma heap_list_s_map_add_super_update_bs:\n \"\\ {x. (x,SIndexVal) \\ dom s\\<^sub>1} = {p+of_nat k..+z}; k + z \\ n; n < addr_card \\\n \\ heap_list_s (s\\<^sub>0 ++ s\\<^sub>1) n p = super_update_bs (heap_list_s s\\<^sub>1 z (p+of_nat k)) (heap_list_s s\\<^sub>0 n p) k\"\napply(auto simp: super_update_bs_def heap_list_s_def)\napply(subgoal_tac \"heap_list (proj_h (s\\<^sub>0 ++ s\\<^sub>1)) (k + z + (n - (k+z))) p =\n take k (heap_list (proj_h s\\<^sub>0) n p) @\n heap_list (proj_h s\\<^sub>1) z (p + of_nat k) @\n drop (k + z) (heap_list (proj_h s\\<^sub>0) n p)\")\n apply simp\napply(subst heap_list_split2)\napply(subst heap_list_split2)\napply simp\napply rule\n apply(subst take_heap_list_le)\n apply simp\n apply(subst heap_list_proj_h_disj)\n apply(insert init_intvl_disj [of k z p])\n apply simp\n apply fast\n apply simp\napply rule\n apply(subst heap_list_proj_h_sub)\n apply fast\n apply simp\napply(subst drop_heap_list_le)\n apply simp\napply simp\napply(subst heap_list_proj_h_disj)\n apply(insert final_intvl_disj [of k z n p])\n apply fast\napply simp\ndone\n\nlemma s_footprint_untyped_dom_SIndexVal:\n \"dom s = s_footprint_untyped p t \\\n {x. (x,SIndexVal) \\ dom s} = {p..+size_td t}\"\napply(clarsimp simp: s_footprint_untyped_def)\napply auto\n apply(erule intvlI)\napply(drule intvlD, force)\ndone\n\nlemma field_ti_s_sub:\n \"field_lookup (export_uinfo (typ_info_t TYPE('b::mem_type))) f 0 = Some (a,b) \\\n s_footprint_untyped &(p\\f) a \\ s_footprint (p::'b ptr)\"\napply(clarsimp simp: field_ti_def s_footprint_def s_footprint_untyped_def split: option.splits)\napply(simp add: field_lvalue_def field_offset_def typ_uinfo_t_def)\napply(rule_tac x=\"b+x\" in exI)\napply simp\napply(simp add: field_offset_untyped_def)\napply(drule td_set_field_lookupD)\napply(frule td_set_offset_size)\napply(drule_tac k=x in typ_slice_td_set)\napply simp\napply(auto simp: prefixeq_def less_eq_list_def)\ndone\n\nlemma wf_heap_val_map_add [simp]:\n \"\\ wf_heap_val s\\<^sub>0; wf_heap_val s\\<^sub>1 \\ \\ wf_heap_val (s\\<^sub>0 ++ s\\<^sub>1)\"\napply(unfold wf_heap_val_def)\napply auto\ndone\n\nlemma of_nat_lt_size_of:\n \"\\ ((of_nat x)::addr) = of_nat y + of_nat z; x < size_of TYPE('a::mem_type);\n y + z < size_of TYPE('a) \\ \\ x = y+z\"\napply(subst (asm) Abs_fnat_homs)\napply(subst (asm) word_unat.norm_eq_iff [symmetric])\napply(simp only: len_of_addr_card)\napply(subst (asm) mod_less)\n apply(erule less_trans)\n apply simp\napply(subst (asm) mod_less)\n apply(erule less_trans)\n apply simp+\ndone\n\nlemma proj_d_map_add:\n \"snd (proj_d s\\<^sub>1 p) n = Some k \\ snd (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p) n = Some k\"\napply(auto simp: proj_d_def split: option.splits)\ndone\n\nlemma proj_d_map_add2:\n \"fst (proj_d s\\<^sub>1 p) \\ fst (proj_d (s\\<^sub>0 ++ s\\<^sub>1) p)\"\napply(auto simp: proj_d_def split: option.splits)\ndone\n\n\nlemma heap_list_s_restrict_disj_same [rule_format]:\n \"\\p. dom s \\ (UNIV - X) = {} \\ heap_list_s (s |` X) n p = heap_list_s s n p\"\napply(induct_tac n)\n apply(simp add: heap_list_s_def)\napply(clarsimp simp: heap_list_s_def)\napply(simp add: proj_h_def restrict_map_def split: option.splits)\napply clarsimp\napply fast\ndone\n\nlemma UNIV_minus_inter:\n \"(X - Y) \\ (X \\ (X - Y) - Z) = X - (Y \\ Z)\"\napply fast\ndone\n\nlemma restrict_un_map:\n \"f |` (X \\ Y) = f |` X |` Y\"\napply(auto simp add: restrict_map_def)\napply(rule ext)\napply auto\noops\n\nlemma sep_map_mfs_sep_map_empty:\n \"(p \\\\<^sub>g (v::'a::mem_type)) = (p \\\\<^sub>g\\<^sup>({}) v)\"\n by (auto simp: sep_map_def mfs_sep_map_def map_add_dom_eq)\n\nlemma fd_cons_double_update:\n \"\\ fd_cons t; length bs = length bs' \\ \\\n update_ti_t t bs (update_ti_t t bs' v) = update_ti_t t bs v\"\napply(simp add: fd_cons_def Let_def fd_cons_double_update_def fd_cons_desc_def)\ndone\n\nlemma fd_cons_update_access:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t (access_ti t v bs) v = v\"\napply(simp add: fd_cons_def Let_def fd_cons_update_access_def fd_cons_desc_def)\ndone\n\nlemma fd_cons_length:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n length (access_ti t v bs) = size_td t\"\napply(simp add: fd_cons_def Let_def fd_cons_desc_def fd_cons_length_def access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_length_p:\n \"fd_cons t \\\n length (access_ti\\<^sub>0 t v) = size_td t\"\napply(simp add: fd_cons_length access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_update_normalise:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n update_ti_t t ((norm_desc (field_desc t) (size_td t)) bs) v = update_ti_t t bs v\"\napply(clarsimp simp: fd_cons_def Let_def fd_cons_desc_def)\napply(drule (3) fd_cons_update_normalise)\napply(clarsimp simp: fd_cons_update_normalise_def)\ndone\n\nlemma field_footprint_SIndexVal:\n \"field_lookup (typ_info_t TYPE('a::c_type)) f 0 = Some (t, n) \\\n {x. (x, SIndexVal) \\ field_footprint (p::'a ptr) f} =\n {ptr_val p + of_nat n..+size_td t}\"\napply(auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def intro: intvlI)\napply(drule intvlD, clarsimp)\ndone\n\nlemma fs_footprint_subset:\n \"F \\ fields TYPE('a::mem_type) \\\n fs_footprint (p::'a ptr) F \\ s_footprint p\"\napply(unfold fs_footprint_def field_footprint_def)\napply(clarsimp simp: fields_def)\napply(drule (1) subsetD)\napply clarsimp\napply(frule field_lookup_export_uinfo_Some)\napply(drule field_ti_s_sub)\napply(unfold field_lvalue_def)\napply(subst (asm) field_lookup_offset_eq)\n apply assumption\napply(clarsimp simp: field_typ_def field_typ_untyped_def)\napply(drule subsetD)\n apply assumption+\ndone\n\nlemma length_heap_list_s [simp]:\n \"length (heap_list_s s n p) = n\"\n by (clarsimp simp: heap_list_s_def)\n\nlemma heap_list_proj_h_restrict [rule_format]:\n \"\\p. {p..+n} \\ {x. (x,SIndexVal) \\ X} \\\n heap_list (proj_h (s |` X)) n p = heap_list (proj_h s) n p\"\napply(induct_tac n)\n apply clarsimp\napply clarsimp\napply rule\n apply(subst proj_h_restrict)\n apply(subgoal_tac \"p \\ {p..+Suc n}\")\n apply(drule (1) subsetD)\n apply clarsimp\n apply(rule intvl_self)\n apply simp\n apply simp\napply(drule_tac x=\"p+1\" in spec)\napply(erule impE)\n apply clarsimp\n apply(subgoal_tac \"x \\ {p..+Suc n}\")\n apply fast\n apply(rule intvl_plus_sub_Suc)\n apply simp+\ndone\n\nlemma heap_list_proj_h_lift_state:\n \"{p..+n} \\ {x. fst (d x)} \\\n heap_list (proj_h (lift_state (h,d))) n p = heap_list h n p\"\napply(rule heap_list_h_eq2)\napply(subst proj_h_lift_state)\n apply fast\napply simp\ndone\n\nlemma heap_list_rpbs [rule_format]:\n \"\\p. heap_list (\\x. 0) n p = replicate n 0\"\napply(induct_tac n)\n apply simp\napply simp\ndone\n\nlemma field_access_take_drop:\n \"\\s m n f. field_lookup t f m = Some (s,n) \\ wf_fd t \\\n take (size_td s) (drop (n - m) (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_struct st f m = Some (s,n) \\ wf_fd_struct st \\\n take (size_td s) (drop (n - m) (access_ti_struct st v (replicate (size_td_struct st) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_list ts f m = Some (s,n) \\ wf_fd_list ts \\\n take (size_td s) (drop (n - m) (access_ti_list ts v (replicate (size_td_list ts) 0))) =\n access_ti\\<^sub>0 s v\"\n \"\\s m n f. field_lookup_pair x f m = Some (s,n) \\ wf_fd_pair x \\\n take (size_td s) (drop (n - m) (access_ti_pair x v (replicate (size_td_pair x) 0))) =\n access_ti\\<^sub>0 s v\"\napply(induct t and st and ts and x)\n apply(auto simp: access_ti\\<^sub>0_def)\n apply(thin_tac \"All P\" for P)+\n apply(subst (asm) take_all)\n apply(drule wf_fd_cons_structD)\n apply(clarsimp simp: fd_cons_struct_def fd_cons_desc_def fd_cons_length_def)\n apply simp\napply(clarsimp simp: min_def)\napply(drule wf_fd_cons_pairD)\napply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\napply(clarsimp split: option.splits)\n apply(subst drop_all)\n apply clarsimp\n apply(drule field_lookup_offset_le, clarsimp)\n apply(case_tac dt_pair)\n apply(clarsimp simp: fd_cons_length_def)\n apply arith\n apply simp\n apply(rotate_tac -3)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=n in spec)\n apply(erule impE)\n apply fast\n apply(drule sym, clarsimp)\n apply(subgoal_tac \"(size_td_pair dt_pair - (n - m)) = 0\")\n apply simp\n apply(case_tac dt_pair, simp)\n apply(drule field_lookup_offset_le, clarsimp)\n apply(case_tac dt_pair, simp)\napply(subgoal_tac \"(size_td s - (size_td_pair dt_pair - (n - m))) = 0\")\n prefer 2\n apply clarsimp\n apply(drule td_set_pair_field_lookup_pairD)\n apply(drule td_set_pair_offset_size_m)\n apply simp\napply simp\napply(drule_tac x=s in spec)\napply(drule_tac x=m in spec)\napply(drule_tac x=n in spec)\napply clarsimp\ndone\n\nlemma field_access_take_dropD:\n \"\\ field_lookup t f 0 = Some (s,n); wf_lf (lf_set t []); wf_desc t \\ \\\n take (size_td s) (drop n (access_ti\\<^sub>0 t v)) =\n access_ti\\<^sub>0 s v\"\napply(insert field_access_take_drop(1) [of t v])\napply clarsimp\napply(drule (1) wf_lf_fdp)\napply(drule (1) wf_fdp_fdD)\napply(drule_tac x=s in spec)\napply(drule_tac x=0 in spec)\napply(drule_tac x=n in spec)\napply simp\napply(erule impE, fast)\napply simp\ndone\n\nlemma singleton_t_field:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t, n) \\\n heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n) = access_ti\\<^sub>0 t v\"\napply(clarsimp simp: heap_list_s_def singleton_def singleton_t_def)\napply(subst heap_list_proj_h_restrict)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(clarsimp simp: fs_footprint_def)\n apply(drule_tac p=p in field_footprint_SIndexVal)\n apply fast\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\napply(subst heap_list_proj_h_lift_state)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac d=empty_htd in ptr_retyp_footprint)\n apply simp\napply(clarsimp simp: access_ti\\<^sub>0_def heap_update_def)\napply(subst heap_list_update_list)\n apply clarsimp\n apply(simp add: size_of_def)\n apply(erule field_lookup_offset_size)\napply(clarsimp simp: to_bytes_def heap_list_rpbs size_of_def)\napply(drule_tac v=v in field_access_take_dropD)\n apply simp+\napply(clarsimp simp: access_ti\\<^sub>0_def)\ndone\n\nlemma field_lookup_fd_consD:\n \"field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (t,n) \\ fd_cons t\"\napply(erule fd_consistentD)\napply simp\ndone\n\nlemma s_valid_map_add:\n \"\\ s,g \\\\<^sub>s p; t,g' \\\\<^sub>s p \\ \\ (s ++ t |` X),g \\\\<^sub>s p\"\napply(auto simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\n apply(clarsimp simp: map_le_def)\n apply(simp add: proj_d_map_add_snd)\n apply(rule, clarsimp+)\n apply(subst proj_d_restrict_map_snd)\n apply simp+\napply(subst proj_d_map_add_fst)\napply(clarsimp split: split_if_asm)\napply(subst proj_d_restrict_map_fst)\n apply simp+\ndone\n\nlemma singleton_t_s_valid:\n \"g p \\ singleton_t p (v::'a::mem_type),g \\\\<^sub>s p\"\napply(simp add: singleton_t_def)\napply(subst h_t_s_valid)\napply(erule ptr_retyp_h_t_valid)\ndone\n\n\nlemma sep_map_mfs_sep_map:\n \"\\ (p \\\\<^sub>g\\<^sup>F v) s; field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type)) (s |` (dom s - fs_footprint p {f}))\"\napply(clarsimp simp: mfs_sep_map_def)\napply(rule conjI)\n defer\n apply(subst fs_footprint_un[where F=F])\n apply(clarsimp simp: fields_def)\n apply fast\napply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\napply(rule, clarsimp)\n apply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(subst heap_list_s_map_add_super_update_bs)\n apply clarsimp\n apply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n apply(subgoal_tac \"{x. (x, SIndexVal) \\ fs_footprint p {f}} = {ptr_val p + of_nat n..+size_td t}\")\n apply fast\n apply(clarsimp simp: fs_footprint_def)\n apply(erule field_footprint_SIndexVal)\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\n apply(clarsimp simp: size_of_def)\n apply(subst ac_simps)\n apply(rule td_set_offset_size)\n apply(erule td_set_field_lookupD)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"(heap_list_s (singleton_t p v |` fs_footprint p {f}) (size_td t)\n (ptr_val p + of_nat n))\" and bs=\"(heap_list_s (singleton_t p v ++ s) (size_of TYPE('a))\n (ptr_val p))\" and w=undefined\n in fi_fu_consistentD)\n apply simp\n apply(simp add: size_of_def)\n apply simp\n apply simp\n apply(simp add: singleton_t_field)\n apply(clarsimp simp: access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp+\n apply(subst map_add_restrict_sub)\n apply simp\n apply assumption\n apply simp\napply(subgoal_tac \"(singleton_t p v ++\n s |` (s_footprint p - fs_footprint p F - fs_footprint p {f})) =\n (singleton_t p v ++ s) ++ (singleton_t p v |` fs_footprint p {f})\")\n apply clarsimp\n apply(erule s_valid_map_add)\n apply(simp add: singleton_t_def)\n apply(fold singleton_t_def)\n apply(rule singleton_t_s_valid)\n apply(rule ptr_retyp_h_t_valid)\n apply fast\napply(subst map_add_restrict_sub)\n apply simp\n apply assumption\napply simp\ndone\n\nlemma disjoint_fn_disjoint:\n \"\\ disjoint_fn f F; F \\ fields TYPE('a::mem_type);\n field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n) \\ \\\n fs_footprint (p::'a ptr) F \\ field_footprint p f = {}\"\napply(auto simp: fs_footprint_def)\napply(auto simp: field_footprint_def s_footprint_untyped_def field_typ_def field_typ_untyped_def fields_def)\n apply(drule (1) subsetD, clarsimp)\n apply(drule (1) fa_fu_lookup_disj_interD)\n apply(clarsimp simp: disj_fn_def disjoint_fn_def)\n apply simp+\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\n apply(subgoal_tac \"of_nat n + of_nat x \\ {of_nat n..+size_td t}\")\n apply(subgoal_tac \"of_nat b + of_nat xa \\ {of_nat b..+size_td a}\")\n apply force\n apply(rule intvlI, assumption)+\napply(drule (1) subsetD, clarsimp)\napply(drule (1) fa_fu_lookup_disj_interD)\n apply(clarsimp simp: disj_fn_def disjoint_fn_def)\n apply simp+\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(subgoal_tac \"of_nat n + of_nat x \\ {of_nat n..+size_td t}\")\n apply(subgoal_tac \"of_nat b + of_nat xa \\ {of_nat b..+size_td a}\")\n apply force\n apply(rule intvlI, assumption)+\ndone\n\n\nlemma sep_map_mfs_sep_map2:\n \"\\field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo s = typ_uinfo_t TYPE('b); ((p::'a ptr) \\\\<^sub>g\\<^sup>F v) x\\\n \\ (Ptr &(p\\f) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 s v))::'b::mem_type))\n (x |` field_footprint p f)\"\napply(clarsimp simp: mfs_sep_map_def sep_map_def)\napply rule\n defer\n apply(clarsimp simp: field_footprint_def field_lvalue_def)\n apply(clarsimp simp: s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(rotate_tac -1)\n apply(subst (asm) fs_footprint_def)\n apply(clarsimp simp: field_footprint_def)\n apply(clarsimp simp: s_footprint_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"fs_footprint p F \\ s_footprint_untyped (ptr_val p + of_nat n) (typ_uinfo_t TYPE('b)) = {}\")\n apply blast\n apply(drule_tac p=p in disjoint_fn_disjoint, assumption+)\n apply(simp add: field_footprint_def field_typ_def field_typ_untyped_def)\n apply simp\n apply(clarsimp simp: fields_def)\napply(subgoal_tac \"field_footprint p f = s_footprint ((Ptr &(p\\f))::'b ptr)\")\n prefer 2\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def typ_uinfo_t_def field_typ_def field_typ_untyped_def)\napply simp\napply(frule lift_typ_heap_mono)\n apply assumption+\napply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\napply(rule, clarsimp)\n apply(subst (asm) heap_list_s_heap_merge_right[where p=\"&(p\\f)\"])\n apply assumption+\napply(erule s_valid_heap_merge_right2)\napply simp\napply(frule_tac p=p in disjoint_fn_disjoint, assumption+)\napply(subgoal_tac \"fs_footprint p {f} \\ s_footprint p\")\n prefer 2\n apply(rule fs_footprint_subset)\n apply(clarsimp simp: fields_def)\napply(fastforce simp: fs_footprint_def)\ndone\n\nlemma export_size_of:\n \"export_uinfo t = typ_uinfo_t TYPE('a) \\\n size_of TYPE('a::c_type) = size_td t\"\napply(simp add: size_of_def)\napply(subst typ_uinfo_size [symmetric])\napply(drule sym)\napply simp\ndone\n\nlemma sep_map_field_unfold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n disjoint_fn f F; guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F v) = (p \\\\<^sub>g\\<^sup>({f}\\F) (v::'a::mem_type) \\\\<^sup>*\n Ptr (&(p\\f)) \\\\<^sub>g' ((from_bytes (access_ti\\<^sub>0 t v))::'b::mem_type))\"\napply(rule ext)\napply rule\n apply(rule_tac s\\<^sub>0=\"x |` (dom x - fs_footprint p {f})\" and\n s\\<^sub>1=\"x |` fs_footprint p {f}\" in sep_conjI)\n apply(erule (1) sep_map_mfs_sep_map)\n apply(clarsimp simp: fs_footprint_def)\n apply(erule (4) sep_map_mfs_sep_map2)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply clarsimp\napply(drule sep_conjD, clarsimp)\napply(clarsimp simp: mfs_sep_map_def sep_map_def)\napply rule\n apply(subst map_ac_simps)\n apply(subst map_add_com [where h\\<^sub>0=s\\<^sub>1])\n apply(simp add: map_ac_simps)\n apply(subst map_add_assoc)\n apply(clarsimp simp: lift_typ_heap_if split: split_if_asm)\n apply(rule, clarsimp)\n apply(subst heap_list_s_map_add_super_update_bs)\n apply(subst s_footprint_untyped_dom_SIndexVal)\n apply(clarsimp simp: s_footprint_def)\n apply fast\n apply(clarsimp simp: field_lvalue_def)\n apply fast\n apply(drule field_lookup_offset_size)\n apply(drule export_size_of)\n apply(simp add: size_of_def)\n apply simp\n apply(clarsimp simp: from_bytes_def)\n apply(frule_tac v=\"heap_list_s s\\<^sub>1 (size_td (typ_info_t TYPE('b)))\n (ptr_val p + of_nat n)\" and bs=\"(heap_list_s (singleton_t p v ++ s\\<^sub>0) (size_of TYPE('a))\n (ptr_val p))\" and w=undefined in fi_fu_consistentD)\n apply simp+\n apply(simp add: size_of_def)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply simp\n apply(subst fd_cons_update_normalise [symmetric])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(simp add: norm_desc_def)\n apply(drule_tac f=\"access_ti\\<^sub>0 (typ_info_t TYPE('b))\" in arg_cong)\n apply(drule_tac f=\"\\bs. update_ti_t t bs v\" in arg_cong)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(simp add: size_of_def)\n apply(subst (asm) wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\n apply(subgoal_tac \"export_uinfo (typ_info_t TYPE('b)) = typ_uinfo_t TYPE('b)\")\n prefer 2\n apply(simp add: typ_uinfo_t_def)\n apply simp\n apply(drule sym, simp)\n apply(subst (asm) wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply simp\n apply(drule sym, drule export_size_of)\n apply(simp add: size_of_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(simp add: size_of_def)\n apply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subgoal_tac \"update_ti_t t (norm_desc (field_desc t) (size_td t) (access_ti t v (replicate (size_td t) 0))) v = v\")\n apply(simp add: norm_desc_def)\n apply(simp add: access_ti\\<^sub>0_def)\n apply(subst fd_cons_update_normalise)\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n prefer 2\n apply(subst fs_footprint_un)\n apply(subst fs_footprint_def)\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def field_typ_untyped_def)\n apply(drule_tac p=p in disjoint_fn_disjoint)\n apply assumption+\n apply(clarsimp simp: field_footprint_def s_footprint_def field_lvalue_def field_typ_def field_typ_untyped_def)\n apply(subgoal_tac \"{f} \\ fields TYPE('a)\")\n apply(drule_tac p=p in fs_footprint_subset[where F=\"{f}\"])\n apply(clarsimp simp: s_footprint_def)\n apply(fastforce simp: fs_footprint_def field_footprint_def s_footprint_def\n field_typ_def field_typ_untyped_def field_lvalue_def)\n apply(clarsimp simp: fields_def)\napply(clarsimp simp: s_valid_def h_t_valid_def valid_footprint_def Let_def)\napply(rule, clarsimp simp: map_le_def)\n apply(subst proj_d_map_add_snd[where t=s\\<^sub>1])\n apply(clarsimp split: split_if_asm)\n apply(frule s_footprintD2)\n apply(drule s_footprintD)\n apply(drule_tac x=y in spec)\n apply clarsimp\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(drule intvlD, clarsimp simp: field_lvalue_def)\n apply(drule_tac x=k in spec)\n apply(clarsimp simp add: size_of_def)\n apply(drule_tac x=a in bspec)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('b) < addr_card\", simp only:size_of_def)\n apply simp\n apply simp\n apply(simp add: ac_simps)\n apply(rotate_tac -1)\n apply(drule sym)\n apply simp\n apply(drule sym[where s=\"Some s\" for s])\n apply simp\n apply(drule field_lookup_export_uinfo_Some)\n apply(drule td_set_field_lookupD)\n apply(frule_tac k=k in typ_slice_td_set)\n apply simp\n apply simp\n apply(simp add: typ_uinfo_t_def)\n apply(subgoal_tac \"y=n+k\")\n apply(simp add: prefix_def)\n apply clarsimp\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('b) < addr_card\", simp only:size_of_def)\n apply simp\n apply (clarsimp simp: prefix_eq_nth)\n apply(drule_tac f=unat in arg_cong)\n apply(rotate_tac -1)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\", simp only:size_of_def)\n apply simp\n apply(subst (asm) Abs_fnat_hom_add)\n apply(subst (asm) unat_of_nat)\n apply(subst (asm) mod_less)\n apply(subst len_of_addr_card)\n apply(drule td_set_offset_size)\n apply simp\n apply(rule_tac y=\"size_td (typ_info_t TYPE('a))\" in le_less_trans)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\", simp only:size_of_def)\n apply simp\n apply simp\napply(subst proj_d_map_add_fst)\napply(clarsimp split: split_if_asm)\napply(drule s_footprintD, clarsimp)\napply(drule intvlD, clarsimp simp: field_lvalue_def)\napply(fastforce simp: size_of_def ac_simps)\ndone\n\nlemma disjoint_fn_empty [simp]:\n \"disjoint_fn f {}\"\n by (simp add: disjoint_fn_def)\n\nlemma sep_map_field_map':\n \"\\ ((p::'a::mem_type ptr) \\\\<^sub>g v) s; field_lookup (typ_info_t TYPE('a)) f 0\n = Some (d,n); export_uinfo d = typ_uinfo_t TYPE('b);\n guard_mono g g' \\ \\\n ((Ptr (&(p\\f))::'b::mem_type ptr) \\\\<^sub>g' from_bytes (access_ti\\<^sub>0 d v)) s\"\napply(frule sep_map_g)\napply(subst (asm) sep_map_mfs_sep_map_empty)\napply(subst (asm) sep_map_field_unfold)\n apply fast\n apply simp\n apply assumption+\napply(clarsimp simp: sep_map'_def sep_conj_ac)\napply(erule sep_conj_impl)\n apply simp\napply simp\ndone\n\nlemma fd_cons_access_update_p:\n \"\\ fd_cons t; length bs = size_td t \\ \\\n access_ti\\<^sub>0 t (update_ti_t t bs v) = access_ti\\<^sub>0 t (update_ti_t t bs w)\"\napply(simp add: fd_cons_def Let_def fd_cons_access_update_def fd_cons_desc_def access_ti\\<^sub>0_def)\ndone\n\nlemma length_to_bytes_p [simp]:\n \"length (to_bytes_p (v::'a)) = size_of TYPE('a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma inv_p [simp]:\n \"from_bytes (to_bytes_p v) = (v::'a::mem_type)\"\n by (simp add: to_bytes_p_def)\n\nlemma singleton_SIndexVal:\n \"x \\ {ptr_val p..+size_of TYPE('a)} \\\n singleton_t p (v::'a::mem_type) (x,SIndexVal) = Some (SValue (to_bytes_p v ! unat (x - ptr_val p)))\"\napply(auto simp: singleton_def singleton_t_def)\napply(auto simp: lift_state_def)\n apply(clarsimp simp: heap_update_def)\n apply(subst heap_update_mem_same_point)\n apply simp\n apply simp\n apply(simp add: to_bytes_p_def heap_list_rpbs)\napply(subst ptr_retyp_d_eq_fst)\napply simp\ndone\n\nlemma access_ti\\<^sub>0:\n \"access_ti s v (replicate (size_td s) 0) = access_ti\\<^sub>0 s v\"\napply(simp add: access_ti\\<^sub>0_def)\ndone\n\nlemma fd_cons_mem_type [simp]:\n \"fd_cons (typ_info_t TYPE('a::mem_type))\"\napply(rule wf_fd_consD)\napply simp\ndone\n\nlemma norm_tu_rpbs:\n \"wf_fd t \\\n norm_tu (export_uinfo t) (access_ti\\<^sub>0 t v) = access_ti\\<^sub>0 t v\"\napply(subst wf_fd_norm_tuD)\n apply assumption\n apply(subst fd_cons_length_p)\n apply(erule wf_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=v])\n apply(erule wf_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule wf_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule wf_fd_consD)\n apply simp+\ndone\n\nlemma heap_list_s_singleton_t_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n heap_list_s (singleton_t p (update_ti_t s (to_bytes_p w) v)) (size_td s)\n (ptr_val (p::'a::mem_type ptr) + of_nat n) = (to_bytes_p (w::'b::mem_type))\"\napply(auto simp: singleton_t_def singleton_def)\napply(subst heap_list_s_heap_list_dom)\n apply clarsimp\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\napply(simp add: heap_update_def)\napply(subst heap_list_update_list)\n apply simp\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\napply(frule_tac v=\"(update_ti_t s (to_bytes_p w) v)\" in field_access_take_dropD)\n apply simp+\napply(simp add: access_ti\\<^sub>0_def to_bytes_def heap_list_rpbs size_of_def to_bytes_p_def)\napply(simp add: access_ti\\<^sub>0)\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply simp\napply(simp add: typ_uinfo_t_def)\napply(rule norm_tu_rpbs)\napply simp\ndone\n\nlemma field_access_update_nth_disj:\n \"\\m f s n x bs bs'. field_lookup t f m = Some (s,n) \\ x < size_td t \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd t \\ length bs = size_td s \\ length bs' = size_td t \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_struct st f m = Some (s,n) \\ x < size_td_struct st \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_struct st \\length bs = size_td s \\ length bs' = size_td_struct st \\\n access_ti_struct st (update_ti_t s bs v) bs' ! x\n = access_ti_struct st v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_list ts f m = Some (s,n) \\ x < size_td_list ts \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_list ts \\length bs = size_td s \\ length bs' = size_td_list ts \\\n access_ti_list ts (update_ti_t s bs v) bs' ! x\n = access_ti_list ts v bs' ! x\"\n \"\\m f s n x bs bs'. field_lookup_pair y f m = Some (s,n) \\ x < size_td_pair y \\\n (x < n - m \\ x \\ (n - m) + size_td s) \\ wf_fd_pair y \\length bs = size_td s \\ length bs' = size_td_pair y \\\n access_ti_pair y (update_ti_t s bs v) bs' ! x\n = access_ti_pair y v bs' ! x\"\napply(induct t and st and ts and y)\n apply clarsimp\n apply clarsimp\n apply clarsimp\n apply clarsimp\n prefer 2\n apply clarsimp\napply clarify\napply(clarsimp split: split_if_asm)\napply(clarsimp split: option.splits)\n\n apply(rotate_tac -3)\n apply(drule_tac x=\"m + size_td (dt_fst dt_pair)\" in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(rotate_tac -1)\n apply(drule_tac x=n in spec)\n\n apply clarsimp\n apply(rotate_tac -1)\n apply(drule_tac x=\"x - size_td_pair dt_pair\" in spec)\n apply(frule field_lookup_fa_fu_rhs_listD)\n apply simp\n apply assumption\n apply(clarsimp simp: fa_fu_ind_def)\n apply(subgoal_tac \"access_ti_pair dt_pair (update_ti_t s bs v) (take (size_td_pair dt_pair) bs') =\n access_ti_pair dt_pair v (take (size_td_pair dt_pair) bs')\")\n prefer 2\n apply (fastforce simp: min_def)\n apply(clarsimp simp: nth_append)\n apply(subgoal_tac \"length\n (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply simp\n prefer 2\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\n apply(erule impE)\n apply simp\n apply(case_tac dt_pair, simp+)\n apply(rename_tac a b)\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"drop (size_td a) bs'\" in spec)\n apply clarsimp\n apply(frule field_lookup_offset_le)\n apply clarsimp\n apply(drule td_set_list_field_lookup_listD)\n apply(drule td_set_list_offset_size_m)\n apply clarsimp\n apply(erule disjE)\n apply arith\n apply arith\napply(frule field_lookup_fa_fu_rhs_pairD, simp)\n apply assumption\napply(clarsimp simp: fa_fu_ind_def)\napply(subgoal_tac \"length (access_ti_pair dt_pair (update_ti_t s bs v)\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(subgoal_tac \"length (access_ti_pair dt_pair v\n (take (size_td_pair dt_pair) bs')) = size_td_pair dt_pair\")\n apply(clarsimp simp: nth_append)\n apply(drule_tac x=m in spec)\n apply(drule_tac x=f in spec)\n apply(drule_tac x=s in spec)\n apply(drule_tac x=n in spec)\n apply clarsimp\n apply(drule_tac x=x in spec)\n apply clarsimp\n apply(drule_tac x=bs in spec)\n apply(drule_tac x=\"take (size_td_pair dt_pair) bs'\" in spec)\n apply(clarsimp simp: min_def split: split_if_asm)\n apply(drule wf_fd_cons_pairD)\n apply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\napply(drule wf_fd_cons_pairD)\napply(clarsimp simp: fd_cons_pair_def fd_cons_desc_def fd_cons_length_def)\ndone\n\nlemma field_access_update_nth_disjD:\n \"\\ field_lookup t f m = Some (s,n); x < size_td t;\n (x < n - m \\ x \\ (n - m) + size_td s); wf_fd t;\n length bs = size_td s; length bs' = size_td t \\ \\\n access_ti t (update_ti_t s bs v) bs' ! x\n = access_ti t v bs' ! x\"\napply(simp add: field_access_update_nth_disj)\ndone\n\nlemma intvl_cut:\n \"\\ (x::addr) \\ {p..+m}; x \\ {p+of_nat k..+n}; m < addr_card \\ \\\n unat (x - p) < k \\ k + n \\ unat (x - p)\"\napply(drule intvlD, clarsimp)\napply(subst unat_of_nat, subst mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\napply(subst (asm) unat_of_nat, subst (asm) mod_less, subst len_of_addr_card)\n apply(erule (1) less_trans)\napply(rule ccontr)\napply(erule notE)\napply(subgoal_tac \"\\z. ka = k + z\")\n prefer 2\n apply(rule_tac x=\"ka - k\" in exI)\n apply simp\napply clarsimp\napply(simp add: add.assoc [symmetric])\napply(rule intvlI)\napply simp\ndone\n\nlemma singleton_t_mask_out:\n \"\\ field_lookup (typ_info_t TYPE('a::mem_type)) f 0 = Some (s,n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n K = (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) \\ \\\n singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a)) |` K =\n singleton_t p v |` K\"\napply(rule ext)\napply simp\napply(auto simp: restrict_map_def)\napply(simp add: singleton_t_def singleton_def)\napply(auto simp: lift_state_def restrict_map_def split: s_heap_index.splits)\napply(simp add: heap_update_def)\napply(simp add: to_bytes_def access_ti\\<^sub>0 heap_list_rpbs size_of_def)\napply(subst heap_update_mem_same_point)\n apply(subst fd_cons_length_p)\n apply simp\n apply(rule ccontr)\n apply(subst (asm) ptr_retyp_None)\n apply(simp add: size_of_def)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(subst heap_update_mem_same_point)\n apply(subst fd_cons_length_p)\n apply simp\n apply(rule ccontr)\n apply(subst (asm) ptr_retyp_None)\n apply(simp add: size_of_def)\n apply simp\n apply(subst fd_cons_length_p)\n apply simp\n apply(subgoal_tac \"size_of TYPE('a) < addr_card\")\n apply(simp only: size_of_def)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(rule field_access_update_nth_disjD)\n apply assumption\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: split_if_asm)\n apply(drule intvlD, clarsimp)\n apply(subst unat_of_nat)\n apply(subst mod_less)\n apply(subst len_of_addr_card)\n apply(erule less_trans)\n apply simp\n apply(simp add: size_of_def)\n apply simp\n apply(subst (asm) ptr_retyp_d_eq_fst)\n apply(clarsimp simp: empty_htd_def split: split_if_asm)\n apply(drule_tac k=\"of_nat n\" and n=\"size_td s\" in intvl_cut)\n prefer 2\n apply simp\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(drule intvlD, clarsimp)\n apply(drule export_size_of, simp add: size_of_def)\n apply simp\n apply simp+\n apply(drule export_size_of, simp add: size_of_def)\napply simp\ndone\n\nlemma singleton_t_SIndexTyp:\n \"singleton_t p v (x,SIndexTyp n) = singleton_t p undefined (x,SIndexTyp n)\"\napply(auto simp: singleton_t_def singleton_def restrict_map_def lift_state_def)\ndone\n\nlemma proj_d_singleton_t:\n \"proj_d (singleton_t p (v::'a::mem_type) ++ x) = proj_d (singleton_t p undefined ++ x)\"\napply(rule ext)\napply(auto simp: proj_d_def)\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\napply(rule ext)\napply(auto simp: split: option.splits)\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\n apply(subgoal_tac \"dom (singleton_t p undefined ) = dom (singleton_t p v )\")\n apply blast\n apply simp\napply(subst (asm) singleton_t_SIndexTyp)\napply simp\ndone\n\nlemma from_bytes_heap_list_s_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n);\n export_uinfo s = typ_uinfo_t TYPE('b);\n dom x = s_footprint p - fs_footprint p F; f \\ F \\ \\\n from_bytes (heap_list_s (singleton_t p (update_ti_t s (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type)) ++ x) (size_of TYPE('a)) (ptr_val p)) =\n update_ti_t s (to_bytes_p w) (from_bytes (heap_list_s (singleton_t p v ++ x) (size_of TYPE('a)) (ptr_val p)))\"\napply(subst map_add_restrict_UNIV [where X=\"s_footprint_untyped (&(p\\f)) (export_uinfo s)\" and h=\"singleton_t p v\"])\n apply(clarsimp simp: fs_footprint_def field_footprint_def field_lvalue_def)\n apply(thin_tac \"dom x = X\" for X)\n apply(clarsimp simp: field_typ_def field_typ_untyped_def)\n apply force\n apply simp\napply(subst heap_list_s_map_add_super_update_bs [where k=n and z=\"size_td s\"])\n apply simp\n apply rule\n apply clarsimp\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(drule s_footprintD)\n apply(rule intvlI)\n apply(drule export_size_of, simp add: size_of_def)\n apply clarsimp\n apply rule\n apply(frule_tac p=p in field_tag_sub)\n apply(clarsimp simp: field_lvalue_def)\n apply(drule (1) subsetD)\n apply(drule_tac n=\"size_of TYPE('a)\" in intvlD, clarsimp)\n apply(erule s_footprintI2)\n apply(drule intvlD, clarsimp)\n apply(clarsimp simp: s_footprint_untyped_def field_lvalue_def)\n apply(rule_tac x=k in exI)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\n apply(drule field_lookup_offset_size)\n apply(simp add: size_of_def)\n apply simp\napply(clarsimp simp: from_bytes_def)\napply(frule_tac v=\"(heap_list_s\n (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n s_footprint_untyped &(p\\f) (export_uinfo s))\n (size_td s) (ptr_val p + of_nat n))\" and\n bs=\"(heap_list_s\n (singleton_t p (update_ti_t s (to_bytes_p w) v) |`\n (UNIV - s_footprint_untyped &(p\\f) (export_uinfo s)) ++\n singleton_t p v |`\n s_footprint_untyped &(p\\f) (typ_uinfo_t TYPE('b)) ++\n x)\n (size_of TYPE('a)) (ptr_val p))\" and\n w=undefined in fi_fu_consistentD)\n apply(simp add: size_of_def)+\napply(subst heap_list_s_restrict)\n apply clarsimp\n apply(drule intvlD, clarsimp)\n apply(subst s_footprint_untyped_def)\n apply(clarsimp simp: field_lvalue_def)\n apply(rule_tac x=k in exI)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst heap_list_s_singleton_t_field_update)\n apply assumption+\napply(subst singleton_t_mask_out)\n apply assumption+\n apply simp\napply(subst map_add_restrict_comp_left)\napply simp\ndone\n\nlemma mfs_sep_map_field_update:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (s, n); f \\ F;\n export_uinfo s = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (w::'b::mem_type)) v) = (p \\\\<^sub>g\\<^sup>F update_ti_t s (to_bytes_p (u::'b::mem_type)) (v::'a::mem_type))\"\napply(rule ext)\napply(auto simp: mfs_sep_map_def lift_typ_heap_if)\n prefer 2\n apply(subst from_bytes_heap_list_s_update)\n apply assumption+\n apply(subst (asm) from_bytes_heap_list_s_update)\n apply assumption+\n apply(drule_tac f=\"update_ti_t s (to_bytes_p w)\" in arg_cong)\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(subst from_bytes_heap_list_s_update)\n apply assumption+\n apply(subst (asm) from_bytes_heap_list_s_update)\n apply assumption+\n apply(drule_tac f=\"update_ti_t s (to_bytes_p u)\" in arg_cong)\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(subst (asm) fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\n apply simp\n apply(clarsimp simp: s_valid_def)\n apply(subst (asm) proj_d_singleton_t)\n apply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\n apply simp\napply(clarsimp simp: s_valid_def)\napply(subst (asm) proj_d_singleton_t)\napply(subst (asm) proj_d_singleton_t[where v=\"update_ti_t s (to_bytes_p u) v\"])\napply simp\ndone\n\nlemma mfs_sep_map_field_update_v:\n \" \\field_lookup (typ_info_t TYPE('a)) f 0 = Some (t, n); f \\ F;\n disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\\n \\\n p \\\\<^sub>g\\<^sup>F update_ti_t t (to_bytes_p (w::'b::mem_type)) (v::'a::mem_type) = p \\\\<^sub>g\\<^sup>F v\"\napply(subst mfs_sep_map_field_update [where u=\"from_bytes (access_ti\\<^sub>0 t v)\"])\n apply assumption\n apply simp+\napply(simp add: to_bytes_p_def to_bytes_def from_bytes_def access_ti\\<^sub>0 size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(drule export_size_of, simp add: size_of_def)\napply(rotate_tac -1)\napply(drule sym)\napply(simp add: typ_uinfo_t_def)\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(clarsimp simp: norm_bytes_def)\napply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD)\n apply simp\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=v])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply simp\ndone\n\nlemma sep_map_field_fold:\n \"\\ field_lookup (typ_info_t TYPE('a)) f 0 = Some (t,n);\n f \\ F; disjoint_fn f (F - {f}); guard_mono g g';\n export_uinfo t = typ_uinfo_t TYPE('b) \\ \\\n (p \\\\<^sub>g\\<^sup>F (v::'a::mem_type) \\\\<^sup>*\n Ptr &(p\\f) \\\\<^bsub>g'\\<^esub> (w::'b::mem_type))\n = p \\\\<^sub>g\\<^sup>(F - {f}) (update_ti_t t (to_bytes_p w) v)\"\napply(subst sep_map_field_unfold, assumption, assumption+)\napply simp\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(drule export_size_of, simp add: size_of_def)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD)\n apply simp+\n apply(drule export_size_of, simp add: size_of_def)\napply simp\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('b)) = norm_bytes TYPE('b)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply (simp add: sep_conj_ac)\napply(subst norm)\n apply simp+\napply(subst mfs_sep_map_field_update_v)\n apply assumption+\n apply fast\n apply simp\n apply assumption+\napply(subgoal_tac \"insert f F = F\")\n apply simp\napply fast\ndone\n\nlemma norm_bytes:\n \"length bs = size_of TYPE('a) \\\n to_bytes_p ((from_bytes bs)::'a) = norm_bytes TYPE('a::mem_type) bs\"\napply(simp add: norm_bytes_def)\napply(subst wf_fd_norm_tuD)\n apply simp\n apply(simp add: size_of_def)\napply(simp add: to_bytes_p_def size_of_def from_bytes_def to_bytes_def access_ti\\<^sub>0_def)\ndone\n\nlemma sep_heap_update_global_super_fl:\n \"\\ (p \\\\<^sub>g u \\\\<^sup>* R) (lift_state (h,d));\n field_lookup (typ_info_t TYPE('b::mem_type)) f 0 = Some (t,n);\n export_uinfo t = (typ_uinfo_t TYPE('a)) \\ \\\n ((p \\\\<^sub>g update_ti_t t (to_bytes_p v) u) \\\\<^sup>* R)\n (lift_state (heap_update (Ptr &(p\\f)) (v::'a::mem_type) h,d))\"\napply(subst sep_map_mfs_sep_map_empty)\napply(subst sep_map_field_unfold [where g'=\"\\x. True\"])\n apply assumption\n apply simp\n apply(simp add: guard_mono_def)\n apply assumption\napply simp\napply(subst fd_cons_access_update_p [where w=undefined])\n apply(erule field_lookup_fd_consD)\n apply simp\n apply(simp add: export_size_of)\napply(subst wf_fd_norm_tuD [symmetric])\n apply(erule wf_fd_field_lookupD, simp)\n apply(simp add: export_size_of)\napply simp\napply(subgoal_tac \"norm_tu (typ_uinfo_t TYPE('a)) = norm_bytes TYPE('a)\")\n prefer 2\n apply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(simp add: norm sep_conj_ac)\napply(subst sep_conj_com)\napply(subst sep_conj_assoc)+\napply(rule sep_heap_update_global_exc2 [where u=\"from_bytes (access_ti\\<^sub>0 t u)\"])\napply(simp add: sep_conj_ac)\napply(subst sep_conj_com)\napply(subst sep_map_field_fold)\n apply assumption\n apply simp+\n apply(simp add: guard_mono_def)\n apply assumption\napply simp\napply(subst sep_map_mfs_sep_map_empty [symmetric])\napply(subst fd_cons_double_update)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst norm_bytes)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply(simp add: export_size_of)\napply(simp add: norm_bytes_def typ_uinfo_t_def)\napply(rotate_tac -1)\napply(drule sym)\napply simp\napply(subst wf_fd_norm_tuD)\n apply(erule wf_fd_field_lookupD, simp)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_access_update_p [where w=u])\n apply(erule field_lookup_fd_consD)\n apply(subst fd_cons_length_p)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: access_ti\\<^sub>0_def)\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(subst fd_cons_update_access)\n apply(erule field_lookup_fd_consD)\n apply simp\napply(simp add: sep_conj_com)\ndone\n\nlemma sep_cut'_dom:\n \"sep_cut' x y s \\ dom s = {(a,b). a \\ {x..+y}}\"\n by (simp add: sep_cut'_def)\n\nlemma dom_exact_sep_cut':\n \"dom_exact (sep_cut' x y)\"\n by (force intro!: dom_exactI dest!: sep_cut'_dom)\n\nlemma dom_lift_state_dom_s [simp]:\n \"dom (lift_state (h,d)) = dom_s d\"\napply(auto simp: lift_state_def dom_s_def split: s_heap_index.splits split_if_asm option.splits)\napply fast\ndone\n\nlemma dom_ptr_retyp_empty_htd [simp]:\n \"dom (lift_state (h,ptr_retyp (p::'a::mem_type ptr) empty_htd)) = s_footprint p\"\napply simp\ndone\n\nlemma ptr_retyp_sep_cut'_exc:\n fixes p::\"'a::mem_type ptr\"\n assumes sc: \"(sep_cut' (ptr_val p) (size_of TYPE('a)) \\\\<^sup>* P)\n (lift_state (h,d))\" and \"g p\"\n shows \"(g \\\\<^sub>s p \\\\<^sup>* sep_true \\\\<^sup>* P) (lift_state (h,(ptr_retyp p d)))\"\nproof -\n from sc obtain s\\<^sub>0 and s\\<^sub>1 where \"s\\<^sub>0 \\ s\\<^sub>1\" and \"lift_state (h,d) = s\\<^sub>1 ++ s\\<^sub>0\"\n and \"P s\\<^sub>1\" and d: \"dom s\\<^sub>0 = {(a,b). a \\ {ptr_val p..+size_of TYPE('a)}}\"\n by (fast dest: sep_conjD sep_cut'_dom)\n moreover hence \"lift_state (h, ptr_retyp p d) = s\\<^sub>1 ++\n lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0\"\napply -\napply(rule ext, case_tac \"x \\ dom s\\<^sub>0\")\n apply(case_tac \"x \\ dom s\\<^sub>1\")\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply(subst map_add_com)\n apply(clarsimp simp: map_disj_def)\n apply fast\n apply(clarsimp simp: map_add_def split: option.splits)\napply(case_tac x, clarsimp)\napply(clarsimp simp: lift_state_ptr_retyp_d merge_dom2)\ndone\n moreover have \"g p\" by fact\n with d have \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h, ptr_retyp p d) |` dom s\\<^sub>0)\"\napply (auto simp: lift_state_ptr_retyp_restrict sep_conj_ac intro: ptr_retyp_tagd_exc)\napply(rule_tac s\\<^sub>0=\"lift_state (h,d) |` ({(a, b). a \\ {ptr_val p..+size_of TYPE('a)}} - s_footprint p)\" in sep_conjI)\n apply (simp add: sep_conj_ac)\n apply(erule_tac h=h in ptr_retyp_tagd_exc)\n apply(clarsimp simp: map_disj_def)\n apply fast\napply(subst map_add_com[where h\\<^sub>0=\"lift_state (h, ptr_retyp p empty_htd)\"])\n apply (simp add: map_disj_def)\n apply fast\napply(rule ext)\napply(auto simp: map_add_def split: option.splits)\napply(subgoal_tac \"(a,b) \\ s_footprint p\")\n apply(clarsimp simp: restrict_map_def)\napply(subgoal_tac \"s_footprint p = dom (lift_state (h, ptr_retyp p empty_htd) )\")\n apply(simp only:)\n apply fast\napply simp\ndone\nultimately show ?thesis\napply -\napply(subst sep_conj_assoc [symmetric])\napply(rule_tac s\\<^sub>0=\"(lift_state (h,ptr_retyp p d))|`dom s\\<^sub>0\" and s\\<^sub>1=s\\<^sub>1 in\n sep_conjI, auto simp: map_disj_def)\ndone\nqed\n\nlemma sep_cut_dom:\n \"sep_cut x y s \\ dom s = {(a,b). a \\ {x..+unat y}}\"\n by (force simp: sep_cut_def dest: sep_cut'_dom)\n\nlemma sep_cut_0 [simp]:\n \"sep_cut p 0 = \\\"\n apply (rule ext)\n apply (auto simp: sep_cut'_def sep_cut_def sep_emp_def None_com split_def)\n done\n\nlemma heap_merge_restrict_dom_un:\n \"dom s = P \\ Q \\ (s|`P) ++ (s|`Q) = s\"\n by (force simp: map_add_def restrict_map_def split: option.splits)\n\nlemma sep_cut_split:\n assumes sc: \"sep_cut p y s\" and le: \"x \\ y\"\n shows \"(sep_cut p x \\\\<^sup>* sep_cut (p + x) (y - x)) s\"\nproof (rule_tac s\\<^sub>0=\"s|`{(a,b). a \\ {p..+unat x}}\" and s\\<^sub>1=\"s|`({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n in sep_conjI)\n from sc le show \"sep_cut p x (s |` {(a,b). a \\ {p..+unat x}})\"\n by (force simp: sep_cut_def sep_cut'_def word_le_nat_alt\n dest: intvl_start_le)\nnext\n from sc le show \"sep_cut (p + x) (y - x) (s |` ({(a,b). a \\ {p..+unat y}} -\n {(a,b). a \\ {p..+unat x}}))\"\n by (force simp: sep_cut_def sep_cut'_def intvl_sub_eq)\nnext\n show \"s |` {(a,b). a \\ {p..+unat x}} \\ s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}})\"\n by (force simp: map_disj_def)\nnext\n from sc le show \"s = s |` ({(a,b). a \\ {p..+unat y}} - {(a,b). a \\ {p..+unat x}}) ++ s |` {(a,b). a \\ {p..+unat x}}\"\n by (simp add: sep_cut_def sep_cut'_def, subst heap_merge_restrict_dom_un)\n (auto simp: word_le_nat_alt dest: intvl_start_le)\nqed\n\nlemma tagd_ptr_safe_exc:\n \"(g \\\\<^sub>s p \\\\<^sup>* sep_true) (lift_state (h,d)) \\ ptr_safe p d\"\napply(clarsimp simp: ptr_safe_def sep_conj_ac sep_conj_def, drule tagd_dom_exc)\napply(drule_tac x=\"(a,b)\" in fun_cong)\napply(auto simp: map_ac_simps lift_state_def sep_conj_ac split: option.splits s_heap_index.splits split_if_asm)\n apply(clarsimp simp: dom_s_def sep_conj_ac)\n apply(subst (asm) merge_dom)\n apply fast\n apply force\n apply(subst (asm) merge_dom)\n apply fast\n apply force\napply(clarsimp simp: dom_s_def)\ndone\n\nlemma sep_map'_ptr_safe_exc:\n \"(p \\\\<^sub>g (v::'a::mem_type)) (lift_state (h,d)) \\ ptr_safe p d\"\n by (force simp: sep_map'_def intro: sep_conj_impl tagd_ptr_safe_exc\n dest: sep_map_tagd_exc)\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/umm_heap/SepCode.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.16560404493596292}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchUntyped_AI\nimports Untyped_AI\nbegin\n\ncontext Arch begin global_naming ARM\n\nnamed_theorems Untyped_AI_assms\n\nlemma of_bl_nat_to_cref[Untyped_AI_assms]:\n \"\\ x < 2 ^ bits; bits < word_bits \\\n \\ (of_bl (nat_to_cref bits x) :: machine_word) = of_nat x\"\n apply (clarsimp intro!: less_mask_eq\n simp: nat_to_cref_def of_drop_to_bl\n word_size word_less_nat_alt word_bits_def)\n by (metis add_lessD1 le_unat_uoi nat_le_iff_add nat_le_linear)\n\n\nlemma cnode_cap_ex_cte[Untyped_AI_assms]:\n \"\\ is_cnode_cap cap; cte_wp_at (\\c. \\m. cap = mask_cap m c) p s;\n (s::'state_ext::state_ext state) \\ cap; valid_objs s; pspace_aligned s \\ \\\n ex_cte_cap_wp_to is_cnode_cap (obj_ref_of cap, nat_to_cref (bits_of cap) x) s\"\n apply (simp only: ex_cte_cap_wp_to_def)\n apply (rule exI, erule cte_wp_at_weakenE)\n apply (clarsimp simp: is_cap_simps bits_of_def)\n apply (case_tac c, simp_all add: mask_cap_def cap_rights_update_def split:bool.splits)\n apply (clarsimp simp: nat_to_cref_def word_bits_def)\n apply (erule(2) valid_CNodeCapE)\n apply (simp add: word_bits_def cte_level_bits_def)\n done\n\n\n\nlemma inj_on_nat_to_cref[Untyped_AI_assms]:\n \"bits < 32 \\ inj_on (nat_to_cref bits) {..< 2 ^ bits}\"\n apply (rule inj_onI)\n apply (drule arg_cong[where f=\"\\x. replicate (32 - bits) False @ x\"])\n apply (subst(asm) word_bl.Abs_inject[where 'a=32, symmetric])\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: of_bl_rep_False of_bl_nat_to_cref[simplified word_bits_def])\n apply (erule word_unat.Abs_eqD)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp+)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp+)\n done\n\n\nlemma data_to_obj_type_sp[Untyped_AI_assms]:\n \"\\P\\ data_to_obj_type x \\\\ts (s::'state_ext::state_ext state). ts \\ ArchObject ASIDPoolObj \\ P s\\, -\"\n unfolding data_to_obj_type_def\n apply (rule hoare_pre)\n apply (wp|wpc)+\n apply clarsimp\n apply (simp add: arch_data_to_obj_type_def split: if_split_asm)\n done\n\nlemma dui_inv_wf[wp, Untyped_AI_assms]:\n \"\\invs and cte_wp_at ((=) (cap.UntypedCap dev w sz idx)) slot\n and (\\s. \\cap \\ set cs. is_cnode_cap cap\n \\ (\\r\\cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\n and (\\s. \\x \\ set cs. s \\ x)\\\n decode_untyped_invocation label args slot (cap.UntypedCap dev w sz idx) cs\n \\valid_untyped_inv\\,-\"\nproof -\n have inj: \"\\node_cap s. \\is_cnode_cap node_cap;\n unat (args ! 5) \\ 2 ^ bits_of node_cap - unat (args ! 4);valid_cap node_cap s\\ \\\n inj_on (Pair (obj_ref_of node_cap) \\ nat_to_cref (bits_of node_cap))\n {unat (args ! 4)..S a f s. (\\x\\S. cte_wp_at ((=) cap.NullCap) (a, f x) s)\n \\ cte_wp_at (\\c. c \\ cap.NullCap) slot s\n \\ slot \\ (Pair a \\ f) ` S\"\n by (auto simp:cte_wp_at_caps_of_state)\n show ?thesis\n apply (simp add: decode_untyped_invocation_def unlessE_def[symmetric]\n unlessE_whenE\n split del: if_split)\n apply (rule validE_R_sp[OF whenE_throwError_sp]\n validE_R_sp[OF data_to_obj_type_sp]\n validE_R_sp[OF dui_sp_helper] validE_R_sp[OF map_ensure_empty])+\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp[THEN validE_validE_R] check_children_wp\n map_ensure_empty_wp)\n apply (clarsimp simp: distinct_map cases_imp_eq)\n apply (subgoal_tac \"s \\ node_cap\")\n prefer 2\n apply (erule disjE)\n apply (drule bspec [where x = \"cs ! 0\"],clarsimp)+\n apply fastforce\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply assumption\n apply (subgoal_tac \"\\r\\cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s\")\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule(1) caps_of_state_valid[rotated])\n apply (clarsimp simp: not_less)\n apply (frule(2) inj)\n apply (clarsimp simp: comp_def)\n apply (frule(1) caps_of_state_valid)\n apply (simp add: nasty_strengthen[unfolded o_def] cte_wp_at_caps_of_state)\n apply (intro conjI)\n apply (intro impI)\n apply (frule range_cover_stuff[where w=w and rv = 0 and sz = sz], simp_all)[1]\n apply (clarsimp simp: valid_cap_simps cap_aligned_def)+\n apply (frule alignUp_idem[OF is_aligned_weaken,where a = w])\n apply (erule range_cover.sz)\n apply (simp add: range_cover_def)\n apply (clarsimp simp: get_free_ref_def empty_descendants_range_in)\n apply (rule conjI[rotated], blast, clarsimp)\n apply (drule_tac x = \"(obj_ref_of node_cap,nat_to_cref (bits_of node_cap) slota)\" in bspec)\n apply (clarsimp simp: is_cap_simps nat_to_cref_def word_bits_def\n bits_of_def valid_cap_simps cap_aligned_def)+\n apply (simp add: free_index_of_def)\n apply (frule(1) range_cover_stuff[where sz = sz])\n apply (clarsimp dest!: valid_cap_aligned simp: cap_aligned_def word_bits_def)+\n apply simp+\n apply (clarsimp simp: get_free_ref_def)\n apply (erule disjE)\n apply (drule_tac x= \"cs!0\" in bspec)\n subgoal by clarsimp\n subgoal by simp\n apply (clarsimp simp: cte_wp_at_caps_of_state ex_cte_cap_wp_to_def)\n apply (rule_tac x=aa in exI,rule exI,rule exI)\n apply (rule conjI, assumption)\n apply simp\n done\nqed\n\nlemma asid_bits_ge_0:\n \"(0::word32) < 2 ^ asid_bits\" by (simp add: asid_bits_def)\n\nlemma retype_ret_valid_caps_captable[Untyped_AI_assms]:\n \"\\pspace_no_overlap_range_cover ptr sz (s::'state_ext::state_ext state) \\ 0 < us\n \\ range_cover ptr sz (obj_bits_api CapTableObject us) n \\ ptr \\ 0\n \\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object CapTableObject dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api CapTableObject us)) [0.. \\ CNodeCap (ptr_add ptr (y * 2 ^ obj_bits_api CapTableObject us)) us []\"\nby ((clarsimp simp:valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def | rule conjI | intro conjI obj_at_foldr_intro imageI\n | rule is_aligned_add_multI[OF _ le_refl],\n (simp add:range_cover_def word_bits_def obj_bits_api_def slot_bits_def)+)+)[1]\n\nlemma retype_ret_valid_caps_aobj[Untyped_AI_assms]:\n \"\\ptr sz (s::'state_ext::state_ext state) x6 us n.\n \\pspace_no_overlap_range_cover ptr sz s \\ x6 \\ ASIDPoolObj \\\n range_cover ptr sz (obj_bits_api (ArchObject x6) us) n \\ ptr \\ 0\\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object (ArchObject x6) dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api (ArchObject x6) us)) [0.. \\ ArchObjectCap (ARM_A.arch_default_cap x6 (ptr_add ptr (y * 2 ^ obj_bits_api (ArchObject x6) us)) us dev)\"\n apply (rename_tac aobject_type us n)\n apply (case_tac aobject_type)\n by (clarsimp simp: valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def\n | intro conjI obj_at_foldr_intro\n imageI valid_vm_rights_def\n | rule is_aligned_add_multI[OF _ le_refl]\n | fastforce simp:range_cover_def obj_bits_api_def\n default_arch_object_def valid_vm_rights_def word_bits_def a_type_def)+\n\n\n\nlemma copy_global_mappings_hoare_lift:(*FIXME: arch_split \\ these do not seem to be used globally *)\n assumes wp: \"\\ptr val. \\Q\\ store_pde ptr val \\\\rv. Q\\\"\n shows \"\\Q\\ copy_global_mappings pd \\\\rv. Q\\\"\n apply (simp add: copy_global_mappings_def)\n apply (wp mapM_x_wp' wp)\n done\n\nlemma init_arch_objects_hoare_lift:\n assumes wp: \"\\oper. \\(P::'state_ext::state_ext state\\bool)\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\ptr val. \\P\\ store_pde ptr val \\\\rv. P\\\"\n shows \"\\P and Q\\ init_arch_objects tp ptr sz us adds \\\\rv. Q\\\"\nproof -\n have pres: \"\\oper. \\P and Q\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\P and Q\\ return () \\\\rv. Q\\\"\n by (wp wp | simp)+\n show ?thesis\n apply (simp add: init_arch_objects_def\n pres reserve_region_def unless_def when_def\n split: Structures_A.apiobject_type.split\n aobject_type.split)\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' copy_global_mappings_hoare_lift wp)\n apply simp\n done\nqed\n\nlemma cap_refs_in_kernel_windowD2:\n \"\\ cte_wp_at P p (s::'state_ext::state_ext state); cap_refs_in_kernel_window s \\\n \\ \\cap. P cap \\ region_in_kernel_window (cap_range cap) s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state region_in_kernel_window_def)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply fastforce\n done\n\nlemma init_arch_objects_descendants_range[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). descendants_range x cref s \\ init_arch_objects ty ptr n us y\n \\\\rv s. descendants_range x cref s\\\"\n apply (simp add:descendants_range_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply (wps do_machine_op_mdb)\n apply (wp hoare_vcg_ball_lift)\n apply (rule hoare_pre)\n apply (wps store_pde_mdb_inv)\n apply wp\n apply simp\n apply fastforce\n done\n\n\n\nlemma init_arch_objects_caps_overlap_reserved[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). caps_overlap_reserved S s\\\n init_arch_objects ty ptr n us y\n \\\\rv s. caps_overlap_reserved S s\\\"\n apply (simp add:caps_overlap_reserved_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply fastforce\n done\n\nlemma set_untyped_cap_invs_simple[Untyped_AI_assms]:\n \"\\\\s. descendants_range_in {ptr .. ptr+2^sz - 1} cref s \\ pspace_no_overlap_range_cover ptr sz s \\ invs s\n \\ cte_wp_at (\\c. is_untyped_cap c \\ cap_bits c = sz \\ obj_ref_of c = ptr \\ cap_is_device c = dev) cref s \\ idx \\ 2^ sz\\\n set_cap (cap.UntypedCap dev ptr sz idx) cref\n \\\\rv s. invs s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp set_free_index_valid_pspace_simple set_cap_valid_mdb_simple\n set_cap_idle update_cap_ifunsafe)\n apply (simp add:valid_irq_node_def)\n apply wps\n apply (wp hoare_vcg_all_lift set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_irq_handlers cap_table_at_lift_valid set_cap_typ_at\n set_untyped_cap_refs_respects_device_simple)\n apply (clarsimp simp:cte_wp_at_caps_of_state is_cap_simps)\n apply (intro conjI,clarsimp)\n apply (rule ext,clarsimp simp:is_cap_simps)\n apply (clarsimp split:cap.splits simp:is_cap_simps appropriate_cte_cap_def)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (clarsimp simp:is_cap_simps ex_cte_cap_wp_to_def appropriate_cte_cap_def cte_wp_at_caps_of_state)\n apply (clarsimp dest!:valid_global_refsD2 simp:cap_range_def)\n apply (simp add:valid_irq_node_def)\n apply (clarsimp simp:valid_irq_node_def)\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state vs_cap_ref_def)\n apply (case_tac cap)\n apply (simp_all add:vs_cap_ref_def table_cap_ref_def)\n apply (rename_tac arch_cap)\n apply (case_tac arch_cap)\n apply simp_all\n apply (clarsimp simp:cap_refs_in_kernel_window_def\n valid_refs_def simp del:split_paired_All)\n apply (drule_tac x = cref in spec)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply fastforce\n done\n\n\nlemma pbfs_atleast_pageBits':\n \"pageBits \\ pageBitsForSize sz\"by (cases sz, simp_all add: pageBits_def)\n\n\nlemma pbfs_less_wb':\n \"pageBitsForSize sz < word_bits\"by (cases sz, simp_all add: word_bits_conv pageBits_def)\n\nlemma delete_objects_rewrite[Untyped_AI_assms]:\n \"\\ word_size_bits \\ sz; sz\\ word_bits; ptr && ~~ mask sz = ptr \\\n \\ delete_objects ptr sz =\n do y \\ modify (clear_um {ptr + of_nat k |k. k < 2 ^ sz});\n modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})\n od\"\n apply (clarsimp simp: delete_objects_def freeMemory_def word_size_def word_size_bits_def)\n apply (subgoal_tac \"is_aligned (ptr &&~~ mask sz) sz\")\n apply (subst mapM_storeWord_clear_um[simplified word_size_def word_size_bits_def])\n apply (simp)\n apply simp\n apply (simp add:range_cover_def)\n apply clarsimp\n apply (rule is_aligned_neg_mask)\n apply simp\n done\n\ndeclare store_pde_pred_tcb_at [wp]\n\n(* nonempty_table *)\ndefinition\n nonempty_table :: \"machine_word set \\ Structures_A.kernel_object \\ bool\"\nwhere\n \"nonempty_table S ko \\\n (a_type ko = AArch APageTable \\ a_type ko = AArch APageDirectory)\n \\ \\ empty_table S ko\"\n\nlemma reachable_pg_cap_exst_update[simp]:\n \"reachable_pg_cap x (trans_state f (s::'state_ext::state_ext state)) = reachable_pg_cap x s\"\n by (simp add: reachable_pg_cap_def vs_lookup_pages_def\n vs_lookup_pages1_def obj_at_def)\n\nlemma create_cap_valid_arch_caps[wp, Untyped_AI_assms]:\n \"\\valid_arch_caps\n and valid_cap (default_cap tp oref sz dev)\n and (\\(s::'state_ext::state_ext state). \\r\\obj_refs (default_cap tp oref sz dev).\n (\\p'. \\ cte_wp_at (\\cap. r \\ obj_refs cap) p' s)\n \\ \\ obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n and cte_wp_at ((=) cap.NullCap) cref\n and K (tp \\ ArchObject ASIDPoolObj)\\\n create_cap tp sz p dev (cref, oref) \\\\rv. valid_arch_caps\\\"\n apply (simp add: create_cap_def set_cdt_def)\n apply (wp set_cap_valid_arch_caps)\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n apply (wp hoare_vcg_disj_lift hoare_vcg_conj_lift hoare_vcg_all_lift hoare_vcg_imp_lift | simp)+\n apply (clarsimp simp del: split_paired_All split_paired_Ex\n imp_disjL\n simp: cte_wp_at_caps_of_state)\n apply (rule conjI)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply (case_tac cref, fastforce)\n apply (simp add: obj_ref_none_no_asid)\n apply (rule conjI)\n apply (auto simp: is_cap_simps valid_cap_def second_level_tables_def\n obj_at_def nonempty_table_def a_type_simps)[1]\n apply (clarsimp simp del: imp_disjL)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply fastforce\n apply (auto simp: is_cap_simps)[1]\n done\n\nlemma create_cap_cap_refs_in_kernel_window[wp, Untyped_AI_assms]:\n \"\\cap_refs_in_kernel_window and cte_wp_at (\\c. cap_range (default_cap tp oref sz dev) \\ cap_range c) p\\\n create_cap tp sz p dev (cref, oref) \\\\rv. cap_refs_in_kernel_window\\\"\n apply (simp add: create_cap_def)\n apply (wp | simp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply blast\n done\n\nlemma store_pde_weaken:\n \"\\\\s. page_directory_at (p && ~~ mask pd_bits) s \\ P s\\ store_pde p e \\Q\\ =\n \\P\\ store_pde p e \\Q\\\"\n apply (rule iffI)\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (rule use_valid, assumption)\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps)\n apply (drule bspec, assumption)\n apply (simp add: simpler_store_pde_def obj_at_def fun_upd_def\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n done\n\nlemma store_pde_nonempty_table:\n \"\\\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ (\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s)))\n \\ ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\n \\ valid_pde_mappings pde\\\n store_pde pde_ptr pde\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def nonempty_table_def a_type_def)\n apply (clarsimp simp add: empty_table_def second_level_tables_def)\n done\n\nlemma store_pde_global_global_objs:\n \"\\\\s. valid_global_objs s\n \\ (\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s)))\n \\ ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\n \\ valid_pde_mappings pde\\\n store_pde pde_ptr pde\n \\\\rv s. valid_global_objs s\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def fun_upd_def[symmetric])\nproof -\n fix s pd\n assume vg: \"valid_global_objs s\"\n and gr: \"\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s))\"\n and uc: \"ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\"\n and vp: \"valid_pde_mappings pde\"\n and pd: \"kheap s (pde_ptr && ~~ mask pd_bits) =\n Some (ArchObj (PageDirectory pd))\"\n let ?ko' = \"ArchObj (PageDirectory\n (pd(ucast (pde_ptr && mask pd_bits >> 2) := pde)))\"\n let ?s' = \"s\\kheap := kheap s(pde_ptr && ~~ mask pd_bits \\ ?ko')\\\"\n have typ_at: \"\\T p. typ_at T p s \\ typ_at T p ?s'\"\n using pd\n by (clarsimp simp: obj_at_def a_type_def)\n have valid_pde: \"\\pde. valid_pde pde s \\ valid_pde pde ?s'\"\n by (case_tac pdea, auto simp add: typ_at data_at_def)\n have valid_pte: \"\\pte. valid_pte pte s \\ valid_pte pte ?s'\"\n by (case_tac pte, auto simp add: typ_at data_at_def)\n have valid_ao_at: \"\\p. valid_ao_at p s \\ valid_ao_at p ?s'\"\n using pd uc\n apply (clarsimp simp: valid_ao_at_def obj_at_def)\n apply (intro conjI impI allI)\n apply (clarsimp simp: valid_pde vp)\n apply (case_tac ao, simp_all add: typ_at valid_pde valid_pte)\n done\n have valid_vso_at: \"\\p. valid_vso_at p s \\ valid_vso_at p ?s'\"\n using pd uc\n apply (clarsimp simp: valid_vso_at_def obj_at_def)\n apply (intro conjI impI allI)\n apply (clarsimp simp: valid_pde vp)\n apply (case_tac ao, simp_all add: typ_at valid_pde valid_pte)\n done\n have empty:\n \"\\p. obj_at (empty_table (set (second_level_tables (arch_state s)))) p s\n \\ obj_at (empty_table (set (second_level_tables (arch_state s)))) p ?s'\"\n using pd gr vp uc\n by (clarsimp simp: obj_at_def empty_table_def second_level_tables_def)\n show \"valid_global_objs ?s'\"\n using vg pd\n apply (clarsimp simp add: valid_global_objs_def valid_ao_at valid_vso_at empty)\n apply (fastforce simp add: obj_at_def)\n done\nqed\n\nlemma valid_arch_state_global_pd:\n \"\\ valid_arch_state s; pspace_aligned s \\\n \\ obj_at (\\ko. \\pd. ko = ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s\n \\ is_aligned (arm_global_pd (arch_state s)) pd_bits\"\n apply (clarsimp simp: valid_arch_state_def a_type_def\n pd_aligned pd_bits_def pageBits_def\n elim!: obj_at_weakenE)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm if_split_asm)\n done\n\nlemma copy_global_mappings_nonempty_table:\n \"is_aligned pd pd_bits \\\n \\\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \\\n valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s\\\n copy_global_mappings pd\n \\\\rv s. \\ (obj_at (nonempty_table\n (set (second_level_tables (arch_state s)))) r s) \\\n valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s\\\"\n apply (simp add: copy_global_mappings_def)\n apply (rule hoare_seq_ext [OF _ gets_sp])\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp[where S=\"{x. kernel_base >> 20 \\ x \\\n x < 2 ^ (pd_bits - 2)}\"])\n apply (wp get_pde_wp hoare_vcg_ball_lift\n store_pde_weaken[THEN iffD2,OF store_pde_nonempty_table]\n store_pde_weaken[THEN iffD2,OF store_pde_global_global_objs]\n | simp)+\n apply clarsimp\n apply (subst (asm) is_aligned_add_helper[THEN conjunct2])\n apply (clarsimp simp: valid_arch_state_def pspace_aligned_def dom_def\n obj_at_def)\n apply (drule_tac x=\"arm_global_pd (arch_state s)\" in spec, erule impE,\n fastforce)\n apply (simp add: pd_bits_def pageBits_def)\n apply (erule shiftl_less_t2n)\n apply (simp add: pd_bits_def pageBits_def)\n apply (clarsimp simp: valid_arch_state_def valid_global_objs_def obj_at_def\n empty_table_def second_level_tables_def)\n apply (simp add: kernel_mapping_slots_def)\n apply (subst is_aligned_add_helper[THEN conjunct1], assumption)\n apply (erule shiftl_less_t2n)\n apply (simp add: pd_bits_def pageBits_def)\n apply (simp add: kernel_base_shift_cast_le[symmetric] ucast_ucast_mask)\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (simp add: word_less_nat_alt pd_bits_def pageBits_def)\n apply (subst less_mask_eq)\n apply (simp add: pd_bits_def pageBits_def)\n apply assumption\n apply (clarsimp simp: pd_bits_def)\n apply simp\n done\n\n\nlemma mapM_copy_global_mappings_nonempty_table[wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\pd\\set pds. is_aligned pd pd_bits)\\\n mapM_x copy_global_mappings pds\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp', rule copy_global_mappings_nonempty_table)\n apply simp_all\n done\n\nlemma init_arch_objects_nonempty_table[Untyped_AI_assms, wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\ref\\set refs. is_aligned ref (obj_bits_api tp us))\\\n init_arch_objects tp ptr bits us refs\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: init_arch_objects_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp unless_wp | wpc | simp add: reserve_region_def second_level_tables_def)+\n apply (clarsimp simp: obj_bits_api_def default_arch_object_def pd_bits_def pageBits_def)\n done\n\nlemma nonempty_table_caps_of[Untyped_AI_assms]:\n \"nonempty_table S ko \\ caps_of ko = {}\"\n by (auto simp: caps_of_def cap_of_def nonempty_table_def a_type_def\n split: Structures_A.kernel_object.split if_split_asm)\n\n\nlemma nonempty_default[simp, Untyped_AI_assms]:\n \"tp \\ Untyped \\ \\ nonempty_table S (default_object tp dev us)\"\n apply (case_tac tp, simp_all add: default_object_def nonempty_table_def\n a_type_def)\n apply (rename_tac aobject_type)\n apply (case_tac aobject_type, simp_all add: default_arch_object_def)\n apply (simp_all add: empty_table_def pde_ref_def valid_pde_mappings_def)\n done\n\nlemma set_pd_cte_wp_at_iin[wp]:\n \"\\\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\n set_pd q pd\n \\\\_ s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\"\n apply (simp add: set_pd_def)\n including unfold_objects\n apply (wpsimp wp: set_object_wp_strong\n simp: a_type_def cte_wp_at_after_update')\n done\n\ncrunch cte_wp_at_iin[wp]: init_arch_objects\n \"\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\"\n (ignore: clearMemory wp: crunch_wps unless_wp)\n\nlemmas init_arch_objects_ex_cte_cap_wp_to\n = init_arch_objects_excap\n\nlemma obj_is_device_vui_eq[Untyped_AI_assms]:\n \"valid_untyped_inv ui s\n \\ case ui of Retype slot reset ptr_base ptr tp us slots dev\n \\ obj_is_device tp dev = dev\"\n apply (cases ui, clarsimp)\n apply (clarsimp simp: obj_is_device_def\n split: apiobject_type.split)\n apply (intro impI conjI allI, simp_all add: is_frame_type_def default_object_def)\n apply (simp add: default_arch_object_def split: aobject_type.split)\n apply (auto simp: arch_is_frame_type_def)\n done\n\nlemma create_cap_ioports[wp, Untyped_AI_assms]:\n \"\\valid_ioports and cte_wp_at (\\_. True) cref\\ create_cap tp sz p dev (cref,oref) \\\\rv. valid_ioports\\\"\n by wpsimp\n\nend\n\nglobal_interpretation Untyped_AI? : Untyped_AI\n where nonempty_table = ARM.nonempty_table\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (unfold_locales; (fact Untyped_AI_assms)?)\n qed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM/ArchUntyped_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813031051514763, "lm_q2_score": 0.28457601028405616, "lm_q1q2_score": 0.1654249184297403}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Arch_DP\nimports Retype_DP\nbegin\n\n\nlemma cdl_get_pde_result_pt:\n \"\\ < (pd, unat (ptr >> 20)) \\c PageTableCap p b None \\* sep_true> \\\n cdl_get_pde (cdl_lookup_pd_slot pd ptr)\n \\\\r s. \\asid. r = PageTableCap p b asid\\\"\n apply (clarsimp simp:cdl_get_pde_def cdl_lookup_pd_slot_def)\n apply wp\n apply (clarsimp dest!:opt_cap_sep_imp)\n apply (clarsimp simp:reset_cap_asid_def split:cdl_cap.splits)\n done\n\nlemma cdl_lookup_pt_slot_rv:\n \"\\ K (R (p, unat ((ptr >> 12) && 0xFF))) and <(pd, unat (ptr >> 20)) \\c PageTableCap p Fake None \\* (\\s. True)>\\\n cdl_lookup_pt_slot pd ptr \\\\r s. R r\\,-\"\n apply (rule validE_validE_R)\n apply (clarsimp simp : cdl_lookup_pt_slot_def)\n apply (clarsimp simp: validE_def valid_def bindE_def\n bind_def bind_assoc NonDetMonad.lift_def)\n apply (case_tac a)\n apply (clarsimp simp:liftE_def bindE_def bind_def return_def)\n apply (clarsimp simp:liftE_def bindE_def bind_def return_def)\n apply (drule use_valid[OF _ cdl_get_pde_result_pt])\n apply simp\n apply (clarsimp split:option.splits)\n apply (clarsimp simp: returnOk_def return_def)\n apply (clarsimp simp:throwError_def return_def)\n done\n\nlemma decode_invocation_invER[wp]:\n \"\\P and Q\\ decode_invocation a b c d\\\\_. P\\, \\\\_. Q\\\"\n apply (simp add:decode_invocation_def)\n apply (case_tac a,simp_all)\n apply (rule hoare_pre, (wp | simp add:throw_opt_def | wpc | intro conjI impI)+)+\n done\n\ndefinition\n \"cap_mapped cap = (case cap of PageTableCap _ _ asid \\ asid\n | FrameCap _ _ _ _ _ asid \\ asid)\"\n\ndefinition\n \"cap_asid cap = (case cap of PageDirectoryCap pd_ptr real' asid' \\ asid')\"\n\ndefinition\n \"get_mapped_asid \\ \\asid vaddr. option_map (\\x. (x,vaddr)) asid\"\n\n\n\nlemma decode_page_map_intent_rv_20_24:\n \"\\n = 20 \\ n = 24 \\\n \\ \\\\s. R (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr))\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None) ref [cdl_lookup_pd_slot ptr vaddr])) \\\n decode_invocation (FrameCap dev frame_ptr rights n real_type asid) ref\n [(PageDirectoryCap ptr real' asid',pdref)]\n (PageIntent (PageMapIntent vaddr perms vmattr))\n \\\\r s. R r\\, -\"\n apply (simp add: decode_invocation_def get_index_def get_page_intent_def throw_opt_def\n cap_rights_def decode_page_invocation_def throw_on_none_def get_mapped_asid_def)\n apply (wp alternativeE_wp select_wp | wpc)+\n apply (rule validE_validE_R)\n apply (wp alternativeE_wp)\n apply (simp add:cdl_page_mapping_entries_def split del:if_split | wp | wpc)+\n apply auto\n done\n\nlemma decode_page_map_intent_rv_16_12:\n \"\\n = 12 \\ n = 16 \\\n \\ \\\\s. R (InvokePage (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr))\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None) ref\n [(p, unat ((vaddr >> 12) && 0xFF))]))\n \\ <(ptr, unat (vaddr >> 20)) \\c PageTableCap p Fake None \\* (\\s. True)> s\\\n decode_invocation (FrameCap dev frame_ptr rights n real_type asid) ref\n [(PageDirectoryCap ptr real' asid',pdref)]\n (PageIntent (PageMapIntent vaddr perms vmattr))\n \\\\r s. R r\\, -\"\n apply (simp add:decode_invocation_def get_index_def\n get_page_intent_def throw_opt_def cap_rights_def\n decode_page_invocation_def throw_on_none_def\n get_mapped_asid_def)\n apply (wp alternativeE_wp select_wp)\n apply (rule validE_validE_R)\n apply (wp alternativeE_wp)\n apply (simp add:cdl_page_mapping_entries_def)\n apply (wp cdl_lookup_pt_slot_rv | wpc | simp)+\n apply auto\n done\n\nabbreviation(input)\n invoke_page_map_slots :: \"cdl_invocation \\ cdl_cap_ref list\"\n where \"invoke_page_map_slots ivk \\\n case ivk of (InvokePage (PageMap cap cap' ref xs)) \\ xs\"\n\nlemma invoke_page_wp:\n \"pinv = PageMap (FrameCap dev frame_ptr rights n fake asid)\n (FrameCap False frame_ptr rights' n fake' asid') ref x\n \\\\c - \\* \\* map sep_any_map_c (invoke_page_map_slots (InvokePage pinv))\n \\* P (invoke_page_map_slots (InvokePage pinv)) >\\\n invoke_page pinv\n \\\\r. <\\* map (\\ptr. ptr\\c (FrameCap False frame_ptr rights' n fake' asid'))\n (invoke_page_map_slots (InvokePage pinv))\n \\* ref \\c (FrameCap dev frame_ptr rights n fake asid) \\* P (invoke_page_map_slots (InvokePage pinv))>\\\"\n apply (simp add:invoke_page_def)\n apply wp\n apply (rule sep_lifted.mapM_x_sep_inv\n [where lft = sep_state_projection and I' = \\,simplified])\n apply (simp add:swp_def)\n apply (rule hoare_pre)\n apply (rule set_cap_wp)\n apply simp\n apply (wp sep_wp: set_cap_wp, sep_solve)\ndone\n\n\nlemma invoke_page_table_wp:\n \"pinv = PageTableMap real_pt_cap pt_cap pt_cap_ref pt_target_slot \\\n \\ < pt_cap_ref \\c - \\* pt_target_slot \\c - \\* P> \\\n invoke_page_table pinv\n \\\\_. c real_pt_cap \\* pt_target_slot \\c pt_cap \\* P>\\\"\n apply (clarsimp simp:invoke_page_table_def)\n apply (wp sep_wp: insert_cap_orphan_wp set_cap_wp, sep_solve)\ndone\n\ncrunch cdl_cur_thread[wp]: invoke_page \"\\s. P (cdl_current_thread s)\"\n(wp: crunch_wps select_wp alternative_wp simp : swp_def )\n\ncrunch cdl_cur_thread[wp]: invoke_page_table \"\\s. P (cdl_current_thread s)\"\n(wp: crunch_wps select_wp alternative_wp simp : swp_def )\n\ncrunch cdl_cur_domain[wp]: invoke_page_table, invoke_page \"\\s. P (cdl_current_domain s)\"\n(wp: crunch_wps select_wp alternative_wp simp : swp_def unless_def)\n\nlemmas cap_asid_simps[simp] = cap_asid_def[split_simps cdl_cap.split]\nlemmas cap_mapped_simps[simp] = cap_mapped_def[split_simps cdl_cap.split]\n\nlemma decode_page_table_rv:\n \"\\Q (InvokePageTable\n (PageTableMap (PageTableCap ptr Real (get_mapped_asid (cap_asid (fst pd_cap_slot)) (vaddr && ~~ mask 20)))\n (PageTableCap ptr Fake None) ref\n (cdl_lookup_pd_slot (cap_object (fst pd_cap_slot)) vaddr))) \\\n decode_invocation (PageTableCap ptr b asid) ref [pd_cap_slot]\n (PageTableIntent (PageTableMapIntent vaddr vmattribs))\n \\Q\\, -\"\n apply (case_tac pd_cap_slot)\n apply (simp add:decode_invocation_def get_page_table_intent_def\n throw_opt_def decode_page_table_invocation_def)\n apply (rule hoare_pre)\n apply (wp alternativeE_wp throw_on_none_wp | wpc | simp)+\n apply (clarsimp split:option.splits simp:get_index_def cap_object_def\n cap_has_object_def get_mapped_asid_def)\n done\n\nlemma seL4_Page_Table_Map:\n notes split_paired_Ex[simp del]\n assumes misc:\n \"cap_object cnode_cap = cnode_id\"\n \"is_cnode_cap cnode_cap\"\n \"offset page_table root_size = pt_offset\"\n \"offset page_directory root_size = pd_offset\"\n and sz: \"one_lvl_lookup cnode_cap word_bits root_size\"\n \"guard_equal cnode_cap page_directory word_bits\"\n \"guard_equal cnode_cap page_table word_bits\"\n shows \"\\\n \\ (root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (cdl_lookup_pd_slot pd_ptr vaddr) \\c -\n \\* (cnode_id, pt_offset) \\c (PageTableCap ptr Real None)\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* root_tcb_id \\f (Tcb tcb)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\*R \\\\\n seL4_PageTable_Map page_table page_directory vaddr vmattribs\n \\\\r s.\n \\ (root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* cdl_lookup_pd_slot pd_ptr vaddr \\c (PageTableCap ptr Fake None)\n \\* (cnode_id, pt_offset) \\c (PageTableCap ptr Real None)\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* root_tcb_id \\f (Tcb tcb)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\*R \\ s \\\"\n apply (simp add:seL4_PageTable_Map_def sep_state_projection2_def)\n apply (rule hoare_name_pre_state)\n apply (rule hoare_pre)\n apply (rule do_kernel_op_pull_back)\n apply (rule call_kernel_with_intent_allow_error_helper\n [where check = True and Perror = \\,simplified])\n apply fastforce\n apply (rule set_cap_wp)\n apply (wp+)[4]\n apply (rule_tac P = \"\\asid'. iv = InvokePageTable (PageTableMap\n (PageTableCap ptr Real asid') (PageTableCap ptr Fake None)\n (cnode_id,pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\"\n in hoare_gen_asmEx)\n apply clarsimp\n apply wp\n apply (rule_tac P1 = \"P1 \\* P2\" for P1 P2 in hoare_strengthen_post\n [OF invoke_page_table_wp])\n apply fastforce\n apply (rule conjI)\n apply (sep_solve)\n apply (subst sep_map_c_asid_reset [where ptr = \"(cnode_id,pt_offset)\"])\n prefer 2\n apply (sep_solve)\n apply (simp add:reset_cap_asid_def)\n apply (wp hoare_vcg_conj_lift)\n apply (wp hoare_strengthen_post[OF set_cap_wp])\n apply (sep_solve )\n apply wp\n apply (rule_tac P = \"\\asid asid'. (c = (PageTableCap ptr Real asid)\n \\ cs = [(PageDirectoryCap pd_ptr real_type asid',(cnode_id,pd_offset))]\n \\ ref = (cnode_id,pt_offset))\"\n in hoare_gen_asmEx)\n apply (elim conjE exE)\n apply simp\n apply (rule_tac Q = \"\\iv s. cdl_current_thread s = Some root_tcb_id \\\n cdl_current_domain s = minBound \\\n <(root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* (cdl_lookup_pd_slot pd_ptr vaddr) \\c -\n \\* (cnode_id, pt_offset) \\c PageTableCap ptr Real None\n \\* (cnode_id, pd_offset) \\c PageDirectoryCap pd_ptr real_type None\n \\* root_tcb_id \\f Tcb tcb\n \\* cnode_id \\f CNode (empty_cnode root_size) \\* R> s \\\n iv = InvokePageTable (PageTableMap (PageTableCap ptr Real (get_mapped_asid asid' (vaddr && ~~ mask 20))) (PageTableCap ptr Fake None)\n (cnode_id,pt_offset) (cdl_lookup_pd_slot pd_ptr vaddr))\"\n in hoare_post_impErr[rotated -1])\n apply assumption\n apply clarsimp\n apply (rule hoare_vcg_E_elim)\n apply wp\n apply wp\n apply (rule validE_validE_R)\n apply (rule hoare_weaken_preE[where P = \\])\n apply (wp decode_page_table_rv)[1]\n apply (simp add:cap_object_def)\n apply (simp add:cap_has_object_def)\n apply clarsimp\n apply (sep_solve)\n apply (simp add:lookup_extra_caps_def conj_comms mapME_singleton)\n apply (rule wp_no_exception_seq)\n apply wp\n apply (rule lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageDirectoryCap pd_ptr real_type None\"])\n apply (rule hoare_pre)\n apply (wp lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageTableCap ptr Real None\"])[1]\n apply (erule_tac Q=\"cdl_current_domain sa = minBound\" in conjE, assumption)\n apply (wp lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageTableCap ptr Real None\"])[1]\n apply clarsimp\n apply (wp update_thread_intent_update hoare_vcg_all_lift\n hoare_vcg_imp_lift)\n apply clarsimp\n defer\n apply clarsimp\n using misc sz\n apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2)\n apply (sep_solve)\n apply simp\n apply sep_solve\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply sep_solve\n apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply (drule_tac x = \"PageTableCap ptr Real None\" in spec)\n apply clarsimp\n apply (erule impE)\n apply (rule_tac x = \"PageDirectoryCap pd_ptr real_type None\" in exI)\n apply simp\n apply clarsimp\n apply (sep_solve)\n done\n\nlemma seL4_Section_Map_wp:\n notes split_paired_Ex[simp del]\n assumes misc:\n \"cap_object cnode_cap = cnode_id\" \"is_cnode_cap cnode_cap\"\n \"offset sel_page root_size = frame_offset\"\n \"offset sel4_page_directory root_size = pd_offset\"\n and sz: \"one_lvl_lookup cnode_cap word_bits root_size\"\n \"guard_equal cnode_cap sel4_page_directory word_bits\"\n \"guard_equal cnode_cap sel_page word_bits\"\n shows \"\\n = 20 \\ n = 24\n \\ \\ \\\n \\ (root_tcb_id,tcb_pending_op_slot) \\c RunningCap\n \\* root_tcb_id \\f Tcb tcb\n \\* (root_tcb_id,tcb_cspace_slot) \\c cnode_cap\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* (cdl_lookup_pd_slot pd_ptr vaddr) \\c -\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* (cnode_id, frame_offset) \\c FrameCap dev frame_ptr rights n Real None \\* R \\ \\\n seL4_Page_Map sel_page sel4_page_directory vaddr perms vmattr\n \\\\r s. \\ (root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* cdl_lookup_pd_slot pd_ptr vaddr \\c\n FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None\n \\* (cnode_id, frame_offset) \\c FrameCap dev frame_ptr rights n Real None\n \\* root_tcb_id \\f (Tcb tcb)\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* R \\ s \\\"\n apply (simp add:seL4_Page_Map_def sep_state_projection2_def)\n apply (rule hoare_name_pre_state)\n apply (rule hoare_pre)\n apply (rule do_kernel_op_pull_back)\n apply (rule call_kernel_with_intent_allow_error_helper\n [where check = True and Perror = \\,simplified])\n apply fastforce\n apply (rule set_cap_wp)\n apply (wp+)[4]\n apply (rule_tac P = \"\\asid'. iv = InvokePage\n (PageMap (FrameCap dev frame_ptr rights n Real asid')\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None) (cnode_id,frame_offset)\n [cdl_lookup_pd_slot pd_ptr vaddr])\"\n in hoare_gen_asmEx)\n apply clarsimp\n apply wp\n apply (rule_tac P1 = \"\\iv. P1 \\* P2\" for P1 P2 in hoare_strengthen_post\n [OF invoke_page_wp[where fake = Real\n and fake' = Fake and x = \"[cdl_lookup_pd_slot pd_ptr vaddr]\" ]])\n apply (rule refl)\n apply simp\n apply (rule conjI)\n apply (sep_solve)\n apply (subst sep_map_c_asid_reset [where ptr = \"(cnode_id,frame_offset)\"])\n prefer 2\n apply (sep_erule_concl refl_imp)+\n apply (sep_solve)\n apply (simp add:reset_cap_asid_def)\n apply (wp hoare_vcg_conj_lift)\n apply (wp hoare_strengthen_post[OF set_cap_wp])\n apply (sep_solve)\n apply wp\n apply (rule_tac P = \"\\asid asid'. (c = (FrameCap dev frame_ptr rights n Real asid)\n \\ cs = [(PageDirectoryCap pd_ptr real_type asid',(cnode_id,pd_offset))]\n \\ ref = (cnode_id,frame_offset))\"\n in hoare_gen_asmEx)\n apply (elim exE)+\n apply simp\n apply (rule_tac Q = \"\\iv s. cdl_current_thread s = Some root_tcb_id \\\n cdl_current_domain s = minBound \\\n <(root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* (cdl_lookup_pd_slot pd_ptr vaddr) \\c -\n \\* (cnode_id, frame_offset) \\c -\n \\* root_tcb_id \\f Tcb tcb \\* (cnode_id, pd_offset) \\c PageDirectoryCap pd_ptr real_type None\n \\* cnode_id \\f CNode (empty_cnode root_size) \\* R> s \\\n iv = InvokePage\n (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr))\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None) (cnode_id,frame_offset)\n [cdl_lookup_pd_slot pd_ptr vaddr])\"\n in hoare_post_impErr[rotated -1])\n apply assumption\n apply (rule hoare_vcg_E_elim)\n apply wp\n apply wp\n apply (rule validE_validE_R)\n apply (rule hoare_weaken_preE[where P = \\])\n apply (wp decode_page_map_intent_rv_20_24)[1]\n apply simp\n apply simp\n apply clarsimp\n apply sep_solve\n apply (simp add:lookup_extra_caps_def conj_comms mapME_singleton)\n apply (rule wp_no_exception_seq)\n apply wp[1]\n apply (rule lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageDirectoryCap pd_ptr real_type None\"])\n apply (rule hoare_pre)\n apply (wp lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"FrameCap dev frame_ptr rights n Real None\"])[1]\n apply (erule_tac Q=\"cdl_current_domain sa = minBound\" in conjE, assumption)\n apply (wp lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"FrameCap dev frame_ptr rights n Real None\"])[1]\n apply clarsimp\n apply (wp update_thread_intent_update hoare_vcg_all_lift\n hoare_vcg_imp_lift)\n apply clarsimp\n defer\n apply clarsimp\n using misc sz\n apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2)\n apply (sep_solve)\n apply simp\n apply sep_solve\n apply (clarsimp simp:user_pointer_at_def Let_def\n word_bits_def sep_conj_assoc)\n apply sep_solve\n apply (clarsimp dest!:reset_cap_asid_simps2\n simp:ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def\n word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply clarsimp\n apply (sep_solve)\n apply (clarsimp dest!:reset_cap_asid_simps2\n simp:ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def\n word_bits_def sep_conj_assoc)\n apply (drule_tac x = \"FrameCap dev frame_ptr rights n Real None\" in spec)\n apply clarsimp\n apply (erule impE)\n apply (rule_tac x = \"PageDirectoryCap pd_ptr real_type None\" in exI)\n apply simp\n apply clarsimp\n apply (sep_solve)\ndone\n\n\nlemma seL4_Page_Map_wp:\n notes split_paired_Ex[simp del]\n assumes misc:\n \"cap_object cnode_cap = cnode_id\" \"is_cnode_cap cnode_cap\"\n \"offset sel_page root_size = frame_offset\"\n \"offset sel4_page_directory root_size = pd_offset\"\n and sz: \"one_lvl_lookup cnode_cap word_bits root_size\"\n \"guard_equal cnode_cap sel4_page_directory word_bits\"\n \"guard_equal cnode_cap sel_page word_bits\"\n shows \"\\n = 12 \\ n = 16\n \\ \\ \\\n \\ (root_tcb_id,tcb_pending_op_slot) \\c RunningCap\n \\* root_tcb_id \\f Tcb tcb\n \\* (root_tcb_id,tcb_cspace_slot) \\c cnode_cap\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* (cdl_lookup_pd_slot pd_ptr vaddr) \\c PageTableCap pt_ptr Fake None\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* (cnode_id, frame_offset) \\c FrameCap dev frame_ptr rights n Real None\n \\* (pt_ptr, unat ((vaddr >> 12) && 0xFF)) \\c -\n \\* R \\ \\\n seL4_Page_Map sel_page sel4_page_directory vaddr perms vmattr\n \\\\r s. \\ (root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* (pt_ptr, unat ((vaddr >> 12) && 0xFF)) \\c\n FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None\n \\* (cnode_id, frame_offset) \\c FrameCap dev frame_ptr rights n Real None\n \\* root_tcb_id \\f (Tcb tcb)\n \\* (cnode_id, pd_offset) \\c (PageDirectoryCap pd_ptr real_type None)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* cdl_lookup_pd_slot pd_ptr vaddr \\c PageTableCap pt_ptr Fake None\n \\* R \\ s \\\"\n apply (simp add:seL4_Page_Map_def sep_state_projection2_def)\n apply (rule hoare_name_pre_state)\n apply (rule hoare_pre)\n apply (rule do_kernel_op_pull_back)\n apply (rule call_kernel_with_intent_allow_error_helper\n [where check = True and Perror = \\,simplified])\n apply fastforce\n apply (rule set_cap_wp)\n apply (wp+)[4]\n apply (rule_tac P = \"\\asid'. iv = InvokePage\n (PageMap (FrameCap dev frame_ptr rights n Real asid')\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None) (cnode_id,frame_offset)\n [(pt_ptr, unat ((vaddr >> 12) && 0xFF))])\"\n in hoare_gen_asmEx)\n apply clarsimp\n apply wp\n apply (rule_tac P1 = \"\\iv. P1 \\* P2\" for P1 P2 in hoare_strengthen_post\n [OF invoke_page_wp[where fake = Real\n and fake' = Fake\n and x = \"[(pt_ptr, unat ((vaddr >> 12) && 0xFF))]\" ]])\n apply (rule refl)\n apply simp\n apply (rule conjI)\n apply (sep_solve)\n apply (subst sep_map_c_asid_reset [where ptr = \"(cnode_id,frame_offset)\"])\n prefer 2\n apply (sep_schem)\n apply (simp add:reset_cap_asid_def)\n apply (wp hoare_vcg_conj_lift)\n apply (wp hoare_strengthen_post[OF set_cap_wp])\n apply (sep_solve)\n apply wp\n apply (rule_tac P = \"\\asid asid'. (c = (FrameCap dev frame_ptr rights n Real asid)\n \\ cs = [(PageDirectoryCap pd_ptr real_type asid',(cnode_id,pd_offset))]\n \\ ref = (cnode_id,frame_offset))\"\n in hoare_gen_asmEx)\n apply (elim exE)+\n apply simp\n apply (rule_tac Q = \"\\iv s. cdl_current_thread s = Some root_tcb_id \\\n cdl_current_domain s = minBound \\\n <(root_tcb_id, tcb_pending_op_slot) \\c RunningCap\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* (pt_ptr, unat ((vaddr >> 12) && 0xFF)) \\c -\n \\* (cnode_id, frame_offset) \\c -\n \\* root_tcb_id \\f Tcb tcb\n \\* (cnode_id, pd_offset) \\c PageDirectoryCap pd_ptr real_type None\n \\* cdl_lookup_pd_slot pd_ptr vaddr \\c PageTableCap pt_ptr Fake None\n \\* cnode_id \\f CNode (empty_cnode root_size) \\* R> s \\\n iv = InvokePage\n (PageMap (FrameCap dev frame_ptr rights n Real (get_mapped_asid asid' vaddr))\n (FrameCap False frame_ptr (validate_vm_rights (rights \\ perms)) n Fake None)\n (cnode_id,frame_offset) [ (pt_ptr, unat ((vaddr >> 12) && 0xFF))] )\"\n in hoare_post_impErr[rotated -1])\n apply assumption\n apply (rule hoare_vcg_E_elim)\n apply wp\n apply wp\n apply (rule validE_validE_R)\n apply (rule_tac P = \"

\" for P in hoare_weaken_preE)\n apply (wp decode_page_map_intent_rv_16_12[where p = pt_ptr])[1]\n apply simp\n apply simp\n apply clarsimp\n apply sep_solve\n apply (simp add:lookup_extra_caps_def conj_comms mapME_singleton)\n apply (rule wp_no_exception_seq)\n apply wp[1]\n apply (rule lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageDirectoryCap pd_ptr real_type None\"])\n apply (rule hoare_pre)\n apply (wp lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"FrameCap dev frame_ptr rights n Real None\"])[1]\n apply (erule_tac Q=\"cdl_current_domain sa = minBound\" in conjE, assumption)\n apply (wp update_thread_intent_update hoare_vcg_all_lift\n hoare_vcg_imp_lift)\n apply clarsimp\n defer\n apply clarsimp\n using misc sz\n apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2)\n apply (sep_solve)\n apply (simp add:cdl_lookup_pd_slot_def)\n apply sep_solve\n apply simp\n apply sep_solve\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply sep_solve\n apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def\n word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply sep_solve\n apply clarsimp\n apply (drule_tac x = \"FrameCap dev frame_ptr rights n Real None\" in spec)\n apply clarsimp\n apply (erule impE)\n apply (rule_tac x = \"PageDirectoryCap pd_ptr real_type None\" in exI)\n apply simp\n apply clarsimp\n apply (sep_solve)\n done\n\nlemma decode_invocation_asid_pool_assign:\n \"\\ \\s. (c = AsidPoolCap p base) \\\n decode_invocation c ref [(PageDirectoryCap pd is_real sz,pd_ref)]\n (AsidPoolIntent AsidPoolAssignIntent)\n \\\\iv s. \\x. x < 2 ^ asid_low_bits \\ iv = InvokeAsidPool (Assign (base, x) pd_ref (p, x)) \\, -\"\n apply (rule hoare_pre)\n apply (rule hoare_gen_asmE[where P =\" c = AsidPoolCap p base\"])\n apply (simp add:decode_invocation_def get_asid_pool_intent_def\n decode_asid_pool_invocation_def get_index_def\n throw_opt_def throw_on_none_def)\n apply (rule validE_validE_R)\n apply (wp alternativeE_wp select_wp)\n apply (clarsimp simp:cap_object_def cap_has_object_def)\n done\n\ncrunch cdl_cur_thread[wp]: invoke_asid_pool \"\\s. P (cdl_current_thread s)\"\n\ncrunch cdl_cur_domain[wp]: invoke_asid_pool \"\\s. P (cdl_current_domain s)\"\n\nlemma set_split_single:\n \"a \\A \\ A = A - {a} \\ {a}\"\n by blast\n\n\nlemma invoke_asid_pool_wp:\n \"off < 2 ^ asid_low_bits \\\n \\ <(cur_thread, tcb_pending_op_slot) \\c RestartCap\n \\* (\\* off\\{off. off < 2 ^ asid_low_bits}. (p, off) \\c -)\n \\* pd_ref \\c (PageDirectoryCap pd Real asid')\n \\* R > \\\n invoke_asid_pool (Assign asid pd_ref (p,off))\n \\\\rv s. <(cur_thread, tcb_pending_op_slot) \\c RestartCap\n \\* pd_ref \\c (PageDirectoryCap pd Real (Some asid))\n \\* (\\* off\\{off. off < 2 ^ asid_low_bits}. (p, off) \\c -)\n \\* R > s\\\"\n apply (clarsimp simp:invoke_asid_pool_def | wp| wpc)+\n apply (rename_tac word cdl_frame_cap_type option)\n apply (rule_tac P = \"word = pd\" in hoare_gen_asm)\n apply simp\n apply (rule hoare_strengthen_post[OF set_cap_wp])\n apply (subst set_split_single[where A = \"(Collect (\\off. off < 2 ^ asid_low_bits))\"])\n apply simp\n apply (subst sep.prod.union_disjoint)\n apply simp+\n apply (clarsimp simp: sep_conj_assoc)\n apply (sep_erule_concl sep_any_imp, sep_solve)\n apply (rename_tac word cdl_frame_cap_type option)\n apply (wp hoare_vcg_conj_lift)\n apply (rule_tac P = \"word = pd\" in hoare_gen_asm)\n apply simp\n apply (rule hoare_strengthen_post[OF set_cap_wp])\n apply (sep_solve)\n apply wp+\n apply clarsimp\n apply (safe; fastforce?)\n apply (subst (asm) set_split_single[where A = \"(Collect (\\off. off < 2 ^ asid_low_bits))\"])\n apply simp\n apply (subst (asm) sep.prod.union_disjoint)\n apply simp+\n apply (simp add:sep_conj_assoc)\n apply sep_solve\n apply (sep_select_asm 3)\n apply (drule opt_cap_sep_imp)\n apply clarsimp\n done\n\nlemma sep_map_c_asid_simp:\n \"(slot \\c FrameCap dev ptr rights sz real_type option) = (slot \\c FrameCap dev ptr rights sz real_type None)\"\n \"(slot \\c PageTableCap ptr real_type option) = (slot \\c PageTableCap ptr real_type None)\"\n \"(slot \\c PageDirectoryCap ptr real_type option') = (slot \\c PageDirectoryCap ptr real_type None)\"\n by (simp_all add:sep_map_c_asid_reset)\n\n\nlemma seL4_ASIDPool_Assign_wp:\n assumes misc:\n \"cap_object cnode_cap = cnode_id\" \"is_cnode_cap cnode_cap\"\n \"offset sel4_page_directory root_size = pd_offset\"\n \"offset sel4_asid root_size = asid_offset\"\n and sz: \"one_lvl_lookup cnode_cap word_bits root_size\"\n \"guard_equal cnode_cap sel4_page_directory word_bits\"\n \"guard_equal cnode_cap sel4_asid word_bits\"\n shows\n \"\\\n \\ (root_tcb_id,tcb_pending_op_slot) \\c RunningCap\n \\* root_tcb_id \\f Tcb tcb\n \\* (cnode_id,asid_offset) \\c AsidPoolCap p base\n \\* (cnode_id,pd_offset) \\c PageDirectoryCap pd Real None\n \\* (\\* off\\{off. off < 2 ^ asid_low_bits}. (p, off) \\c -)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* R \\\\\n seL4_ASIDPool_Assign sel4_asid sel4_page_directory\n \\\\_. \\ (root_tcb_id,tcb_pending_op_slot) \\c RunningCap\n \\* root_tcb_id \\f Tcb tcb\n \\* (cnode_id,asid_offset) \\c AsidPoolCap p base\n \\* (cnode_id,pd_offset) \\c PageDirectoryCap pd Real None\n \\* (\\* off\\{off. off < 2 ^ asid_low_bits}. (p, off) \\c -)\n \\* cnode_id \\f CNode (empty_cnode root_size)\n \\* (root_tcb_id, tcb_cspace_slot) \\c cnode_cap\n \\* R\\ \\\"\n apply (simp add:seL4_ASIDPool_Assign_def sep_state_projection2_def\n | wp do_kernel_op_wp)+\n apply (rule call_kernel_with_intent_allow_error_helper[where check = True and Perror = \\,simplified])\n apply fastforce\n apply (rule set_cap_wp)\n apply (wp+)[4]\n apply (rule_tac P = \"\\x. x < 2 ^ asid_low_bits\n \\ iv = (InvokeAsidPool (Assign (base, x) (cnode_id,pd_offset) (p, x)))\"\n in hoare_gen_asmEx)\n apply clarsimp\n apply wp\n apply (rule hoare_strengthen_post[OF invoke_asid_pool_wp[where pd = pd\n and cur_thread = root_tcb_id\n and R=\"(cnode_id, asid_offset) \\c AsidPoolCap p base \\*\n root_tcb_id \\f Tcb tcb \\*\n cnode_id \\f CNode (empty_cnode root_size) \\*\n (root_tcb_id, tcb_cspace_slot) \\c cnode_cap \\* R\"]])\n apply simp\n apply (rule conjI,sep_solve)\n apply (subst (asm) sep_map_c_asid_simp)\n apply sep_solve\n apply (wp hoare_vcg_conj_lift)\n apply (rule hoare_strengthen_post[OF set_cap_wp])\n apply assumption\n apply wp\n apply (subst sep_map_c_asid_simp)\n apply (wp hoare_vcg_conj_lift)\n apply simp\n apply (rule_tac P = \"\\asid. cs = [(PageDirectoryCap pd Real asid,(cnode_id,pd_offset))]\" in hoare_gen_asmE)\n apply clarsimp\n apply (rule decode_invocation_asid_pool_assign)\n apply (clarsimp simp:conj_comms lookup_extra_caps_def mapME_singleton)\n apply (rule wp_no_exception_seq)\n apply wp\n apply (rule lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"PageDirectoryCap pd Real None\"])\n apply (rule hoare_pre)\n apply (rule lookup_cap_and_slot_rvu[where r = root_size\n and cap' = \"AsidPoolCap p base\"])\n apply (erule_tac Q=\"cdl_current_domain s = minBound\" in conjE, assumption)\n apply clarsimp\n apply (wp update_thread_intent_update hoare_vcg_all_lift\n hoare_vcg_imp_lift)\n apply clarsimp defer\n apply clarsimp\n using misc sz\n apply (intro conjI impI allI, simp_all add: reset_cap_asid_simps2)\n apply sep_solve\n apply sep_solve\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply (clarsimp dest!:reset_cap_asid_simps2 simp: ep_related_cap_def)\n apply (clarsimp simp:user_pointer_at_def Let_def word_bits_def sep_conj_assoc)\n apply (sep_solve)\n apply (sep_solve)\n apply clarsimp\n apply (drule_tac x = \"AsidPoolCap p base\" in spec)\n apply clarsimp\n apply (erule impE)\n apply (rule_tac x = \"PageDirectoryCap pd Real None\" in exI)\n apply simp\n apply clarsimp\n apply (drule use_sep_true_for_sep_map_c)\n apply simp\n apply sep_solve\n done\n\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/capDL-api/Arch_DP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.28457600421652673, "lm_q1q2_score": 0.16542490664588563}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__53.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__53 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__53 and some rule r*}\nlemma n_PI_Local_Get_GetVsinv__53:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_PutVsinv__53:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__53:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__53:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__53:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__53:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__53:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__53:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__53:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__53:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__53:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__53:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__53:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__53:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__53:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__53 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__53:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__53:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__53:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__53:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__53:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__53:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__53:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__53:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__53:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__53:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__53:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10Vsinv__53:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__53:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__53:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__53:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__53:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__53:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__53:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__53:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(f=inv__53 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__53.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.16542185209333213}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory TypHeapLimits\n imports CParser.TypHeapLib\nbegin\n\ndefinition\n states_all_but_typs_eq :: \"char list set \\ heap_raw_state \\ heap_raw_state \\ bool\"\nwhere\n \"states_all_but_typs_eq names hrs hrs'\n = (hrs_htd hrs = hrs_htd hrs'\n \\ (\\x. hrs_mem hrs x = hrs_mem hrs' x\n \\ (\\p td. x \\ {p ..+ size_td td} \\ td_names td \\ names\n \\ typ_name td \\ pad_typ_name\n \\ valid_footprint (hrs_htd hrs) p td)))\"\n\nlemma heap_list_eq_from_region_eq:\n \"\\x \\ {p ..+ n}. hp x = hp' x\n \\ heap_list hp n p = heap_list hp' n p\"\n apply (induct n arbitrary: p)\n apply simp\n apply (simp add: intvl_def)\n apply (frule_tac x=p in spec, drule mp, rule_tac x=0 in exI,\n simp+)\n apply (erule meta_allE, erule meta_mp)\n apply clarsimp\n apply (drule spec, erule mp)\n apply (rule_tac x=\"Suc k\" in exI)\n apply simp\n done\n\nlemma states_all_but_typs_eq_clift:\n \"\\ states_all_but_typs_eq names hrs hrs';\n \\x \\ td_names (typ_info_t TYPE('a)). x \\ names;\n typ_name (typ_info_t TYPE('a)) \\ pad_typ_name \\\n \\ (clift hrs :: (_ \\ ('a :: c_type))) = clift hrs'\"\n apply (rule ext, simp add: lift_t_def)\n apply (cases hrs, cases hrs', clarsimp)\n apply (simp add: lift_typ_heap_def restrict_map_def)\n apply (simp add: s_valid_def proj_d_lift_state\n states_all_but_typs_eq_def hrs_htd_def\n hrs_mem_def)\n apply clarsimp\n apply (simp add: heap_list_s_heap_list h_t_valid_def)\n apply (subst heap_list_eq_from_region_eq, simp_all)\n apply clarsimp\n apply (drule spec, erule disjE, assumption)\n apply clarsimp\n apply (drule(1) valid_footprint_neq_disjoint)\n apply (clarsimp simp: typ_uinfo_t_def typ_tag_lt_def\n typ_tag_le_def)\n apply (force dest: td_set_td_names\n intro: td_set_td_names[OF td_set_self])\n apply (clarsimp simp: field_of_def typ_uinfo_t_def)\n apply (force dest: td_set_td_names\n intro: td_set_td_names[OF td_set_self])\n apply (simp add: size_of_def)\n apply blast\n done\n\nlemma states_all_but_typs_eq_refl:\n \"states_all_but_typs_eq names hrs hrs\"\n by (simp add: states_all_but_typs_eq_def)\n\nlemma states_all_but_typs_eq_trans:\n \"states_all_but_typs_eq names hrs hrs'\n \\ states_all_but_typs_eq names hrs' hrs''\n \\ states_all_but_typs_eq names hrs hrs''\"\n apply (clarsimp simp add: states_all_but_typs_eq_def\n del: disjCI)\n apply (drule_tac x=x in spec)+\n apply clarsimp\n done\n\nlemma states_all_but_typs_eq_update:\n \"\\ hrs_htd hrs \\\\<^sub>t (ptr :: ('a :: c_type) ptr);\n td_names (typ_info_t TYPE('a)) \\ names;\n typ_name (typ_info_t TYPE('a)) \\ pad_typ_name;\n wf_fd (typ_info_t TYPE('a)) \\\n \\\n states_all_but_typs_eq names hrs\n (hrs_mem_update (heap_update ptr v) hrs)\"\n apply (clarsimp simp: states_all_but_typs_eq_def hrs_mem_update\n del: disjCI)\n apply (subst disj_commute, rule disjCI)\n apply (rule_tac x=\"ptr_val ptr\" in exI)\n apply (rule_tac x=\"typ_uinfo_t TYPE('a)\" in exI)\n apply (simp add: typ_uinfo_t_def h_t_valid_def heap_update_def)\n apply (rule ccontr)\n apply (subst(asm) heap_update_nmem_same)\n apply (simp add: to_bytes_def length_fa_ti)\n apply (subst length_fa_ti, simp_all add: size_of_def)\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/spec/cspec/TypHeapLimits.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.16542185209333213}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchLevityCatch_AI\nimports\n \"ArchBCorres_AI\"\n \"Lib.LemmaBucket\"\n \"Lib.SplitRule\"\nbegin\n\ncontext Arch begin global_naming ARM\n\nlemma asid_high_bits_of_shift :\n \"asid_high_bits_of (ucast x << asid_low_bits) = x\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_eqI)\n apply (simp add: word_size nth_ucast nth_shiftr nth_shiftl asid_low_bits_def)\n done\n\nlemma ptrFormPAddr_addFromPPtr :\n \"ptrFromPAddr (Platform.ARM.addrFromPPtr x) = x\"\n by (simp add: ptrFromPAddr_def Platform.ARM.addrFromPPtr_def)\n\n(****** From GeneralLib *******)\n\nlemma asid_high_bits_of_add_ucast:\n \"is_aligned w asid_low_bits \\\n asid_high_bits_of (ucast (x::10 word) + w) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr is_aligned_nth)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: nth_ucast)\n apply (drule test_bit_size)\n apply (simp add: word_size asid_low_bits_def)\n apply (auto dest: test_bit_size simp: word_size asid_low_bits_def nth_ucast)\n done\n\nlemma asid_high_bits_of_add:\n \"\\is_aligned w asid_low_bits; x \\ 2 ^ asid_low_bits - 1\\\n \\ asid_high_bits_of (w + x) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr\n is_aligned_nth)\n apply (drule le2p_bits_unset_32, simp add: asid_low_bits_def)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size)\n apply (case_tac \"na < asid_low_bits\")\n apply (simp add: asid_low_bits_def linorder_not_less word_bits_def)\n apply (auto dest: test_bit_size\n simp: asid_low_bits_def word_bits_def nth_ucast)\n done\n\nlemma preemption_point_success [simp,intro]:\n \"((Inr (), s') \\ fst (preemption_point s)) \\\n \\f es. s' = s \\ machine_state := machine_state s \\ irq_state := f (irq_state (machine_state s)) \\, exst := es \\\"\n apply (auto simp: in_monad preemption_point_def do_machine_op_def\n select_f_def select_def getActiveIRQ_def alternative_def\n do_extended_op_def OR_choiceE_def mk_ef_def\n split: option.splits if_splits\n intro: exI[where x=id])\n apply (rule_tac x=Suc in exI, rule_tac x=\"exst bb\" in exI, force)+\n apply (rule_tac x=id in exI, rule_tac x=\"exst b\" in exI, force)+\n done\n\nlemma pageBits_less_word_bits [simp]:\n \"pageBits < word_bits\" by (simp add: pageBits_def word_bits_conv)\n\nlemma aobj_ref_arch_cap[simp]:\n \"aobj_ref (arch_default_cap aty ptr us dev) = Some ptr\"\n apply (case_tac aty)\n apply (simp_all add: aobj_ref_def arch_default_cap_def p_assoc_help)\n done\n\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM/ArchLevityCatch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.32082128783705344, "lm_q1q2_score": 0.1654218453966908}} {"text": "theory PhiSem_CF_Break\n imports Phi_System.PhiSem_Formalization_Tools\nbegin\n\nsection \\Semantic Model\\\n\nsubsection \\Abnormal\\\n\nvirtual_datatype \\CF_break_abnormal = \\empty_abnormal +\n ABN_break :: unit\n\ndebt_axiomatization ABN_break :: \\unit abnormal_entry\\\n where \\CF_break_abnormal_ax: \\\\CF_break_abnormal ABN_CONS_OF ABN_break\\\n\ninterpretation \\CF_break_abnormal ABN_CONS_OF _ _ ABN_break\n using \\CF_break_abnormal_ax .\n\nhide_fact \\CF_break_abnormal_ax\n\n\nsubsection \\Resource of Scope Frames\\\n\n\nsetup \\Sign.mandatory_path \"RES\"\\\n\ntype_synonym brk_label = nat\ntype_synonym brk_frame = \\RES.brk_label \\ VAL list option nosep\\\n\nsetup \\Sign.parent_path\\\n\nresource_space \\CF_break =\n brk_frame :: \\{frames::RES.brk_frame. finite (dom frames)}\\ (partial_map_resource) ..\n\nhide_fact RES.\\CF_break_res_ax\n\n\nsubsection \\Fiction of Scope Frames\\\n\nfiction_space \\CF_break =\n brk_frame :: \\RES.brk_frame.basic_fiction \\_it\\\n (identity_fiction_for_partial_mapping_resource RES.brk_frame) ..\n\nhide_fact FIC.\\CF_break_fic_ax\n\nsection \\\\-Types\\\n\n(*\nabbreviation Brk_Frame' :: \\brk_label \\ (VAL list option,'a) \\ \\ (fiction,'a) \\\\\n where \\Brk_Frame' label T \\ (FIC.brk_frame.\\ (label \\<^bold>\\ \\ (Nosep T)))\\\n*)\n\ndefinition Brk_Frame :: \\RES.brk_label \\ assn\\\n where \\Brk_Frame label \\ () \\ FIC.brk_frame.\\ (label \\<^bold>\\ \\ (Nosep \\))\\\n\ndefinition Brking_Frame :: \\RES.brk_label \\ ('v::VALs \\arg \\ assn) \\ assn\\ (\"\\<^bold>b\\<^bold>r\\<^bold>o\\<^bold>k\\<^bold>e\\<^bold>n _ \\<^bold>w\\<^bold>i\\<^bold>t\\<^bold>h _\" [1000,10] 3)\n where \\Brking_Frame label S =\n (\\*v. S v\\ to_vals (\\arg.dest v) \\ FIC.brk_frame.\\ (label \\<^bold>\\ \\ (Nosep (\\ Identity))))\\\n\nlemma Brk_Frame_eq_identity:\n \\Brk_Frame l = (nosep None \\ FIC.brk_frame.\\ (l \\<^bold>\\ \\ Identity))\\\n unfolding set_eq_iff Brk_Frame_def\n by (simp add: \\expns)\n\nlemma Brking_Frame_eq_identity:\n \\Brking_Frame l S = (\\*v. S v\\ nosep (Some (to_vals (\\arg.dest v))) \\ FIC.brk_frame.\\ (l \\<^bold>\\ \\ Identity))\\\n unfolding set_eq_iff Brking_Frame_def\n by (simp add: \\expns)\n\n\n\nsection \\Instruction\\\n\ndefinition op_brk_scope :: \\(RES.brk_label \\ ('a::VALs) proc) \\ 'a proc\\\n where \\op_brk_scope F =\n RES.brk_frame.\\R_allocate_res_entry (\\_. True) (Some (nosep None)) (\\l.\n op_try\n (F l \\ (\\ret. RES.brk_frame.\\R_set_res (\\f. f(l := None)) \\ Return ret))\n (\\a. RES.brk_frame.\\R_get_res_entry l (\\brk.\n RES.brk_frame.\\R_set_res (\\f. f(l := None)) \\\n (case nosep.dest brk of Some vs \\ Return (\\arg (from_vals vs))\n | None \\ throw a)\n)))\n\\\n\ndefinition op_break :: \\RES.brk_label \\ ('a::VALs, 'ret::VALs) proc'\\\n where \\op_break l = (\\vs.\n RES.brk_frame.\\R_set_res (\\f. f(l \\ nosep (Some (to_vals (\\arg.dest vs)))))\n \\ throw (ABN_break.mk ())\n)\\\n\nlemma op_break_reduce_tail[procedure_simps,simp]:\n \\(op_break L v \\ f) = op_break L v\\\n unfolding op_break_def by simp\n\ndefinition \\sift_brking_frame' l Y E = (Brking_Frame l Y) + (E\\ Brk_Frame l)\\\ndefinition sift_brking_frame (\"\\<^bold>b\\<^bold>r\\<^bold>e\\<^bold>a\\<^bold>k _/ \\<^bold>w\\<^bold>i\\<^bold>t\\<^bold>h _/ \\<^bold>o\\<^bold>r _\" [1000,10,3] 3)\n where \\sift_brking_frame = sift_brking_frame'\\\n\ndeclare sift_brking_frame'_def[folded sift_brking_frame_def, assertion_simps_source]\n\ncontext begin\n\nprivate lemma alloc_brk_scope[intro!]:\n \\(\\l. \\

\\\\\\ F l \\ X\\ Brk_Frame l \\ Y \\ \\\\\\\\\\\\ E )\n\\ \\

\\\\\\ RES.brk_frame.\\R_allocate_res_entry (\\_. True) (Some (nosep None)) F\n \\ X \\ Y \\ \\\\\\\\\\\\ E \\\n unfolding Brk_Frame_eq_identity\n by (rule; simp add: finite_map_freshness)\n\nprivate lemma dispose_brk_scope:\n \\\\

\\\\\\ RES.brk_frame.\\R_set_res (\\f. f(l := None)) \\ Brk_Frame l \\ \\_. Void \\\\\n unfolding Brk_Frame_eq_identity\n by (rule FIC.brk_frame.\\R_dispose_res[where P=\\\\_. True\\]; simp)\n\nlemma brk_scope:\n \\ (\\l. \\

\\\\\\ f l \\ X\\ Brk_Frame l \\ \\ret. Y ret\\ Brk_Frame l \\\n \\\\\\\\\\\\ (\\a. sift_brking_frame l Y' (E a)))\n\\ \\

\\\\\\ op_brk_scope f \\ X \\ \\ret. Y ret + Y' ret \\ \\\\\\\\\\\\ E\\\n unfolding op_brk_scope_def sift_brking_frame_def sift_brking_frame'_def\n apply (rule, rule, rule, assumption, rule)\n apply (rule \\CONSEQ'E0, rule dispose_brk_scope[THEN \\frame, simplified], rule)\n apply (rule \\CASE)\n apply (simp only: Brking_Frame_eq_identity norm_precond_ex, rule, rule, simp, rule)\n apply (rule FIC.brk_frame.\\R_dispose_res_frm[where P=\\\\_. True\\]; simp)\n apply (rule)\n apply (simp only: Brk_Frame_eq_identity, rule, simp, rule)\n apply (rule \\CONSEQ'E0, rule FIC.brk_frame.\\R_dispose_res_frm[where P=\\\\_. True\\]; simp)\n by (rule, rule implies_refl)\n\nlemma \"_op_break_rule_\":\n \\\\

\\\\\\ op_break l vs \\ S vs\\ Brk_Frame l \\ 0 \\\n \\\\\\\\\\\\ (\\_. Brking_Frame l S)\\\n unfolding op_break_def Brking_Frame_eq_identity Brk_Frame_eq_identity\n by (rule, rule, simp, simp, simp, rule, \\reason)\n\nend\n\n\nsection \\Reasoning Processes\\\n\nsubsection \\sift brking frame\\\n\ndeclare [[\\reason_default_pattern\n \\?X \\\\\\

\\\\\\\\ sift_brking_frame' ?l ?Y ?E \\\\\\ ?Any\\\n \\ \\?X \\\\\\

\\\\\\\\ sift_brking_frame' ?l _ _ \\\\\\ _\\ (100)\n and \\?X \\\\\\

\\\\\\\\ sift_brking_frame ?l ?Y ?E \\\\\\ ?Any\\\n \\ \\?X \\\\\\

\\\\\\\\ sift_brking_frame ?l _ _ \\\\\\ _\\ (100)]]\n\n\nlemma [\\reason 1010 for \\?X \\\\\\

\\\\\\\\ sift_brking_frame ?l ?var_Y' ?var_E'\\]:\n \\ X \\\\\\

\\\\\\\\ sift_brking_frame' l Y E\n\\ \\\\\\\\

\\\\\\\\[assertion_simps undefined] Y' : Y\n\\ \\\\\\\\

\\\\\\\\[assertion_simps undefined] E' : E\n\\ X \\\\\\

\\\\\\\\ sift_brking_frame l Y' E'\\\n unfolding sift_brking_frame_def Simplify_def by simp\n\nlemma [\\reason 1000]:\n \\ X \\\\\\

\\\\\\\\ sift_brking_frame' l Y E\n\\ (\\v. Y v \\\\\\

\\\\\\\\ Y' v @action ToSA)\n\\ E \\\\\\

\\\\\\\\ E' @action ToSA\n\\ X \\\\\\

\\\\\\\\ sift_brking_frame l Y' E'\\\n unfolding sift_brking_frame_def Simplify_def Action_Tag_def sift_brking_frame'_def\n Brking_Frame_def\n \\ premises X and Y and E\n X cases \\ E[THEN implies_right_prod] \\ for \\(\\*v. Y' v\\ to_vals (\\arg.dest v) \\ _) + (E'\\ Brk_Frame l)\\ ..\n \\ Y[THEN implies_right_prod] \\ ..\n \\. .\n\n\nlemma [\\reason 3000 for \\_ \\\\\\

\\\\\\\\ _ * \\ sift_brking_frame ?l ?Y ?E \\ \\\\\\ _\\]:\n \\ X \\\\\\

\\\\\\\\ sift_brking_frame l Y E\n\\ X \\\\\\

\\\\\\\\ 1 * \\ sift_brking_frame l Y E \\ \\\\\\ True\\\n unfolding FOCUS_TAG_def Action_Tag_def\n by simp\n\n\nlemma Brking_Frame_plus:\n \\Brking_Frame l (Y1 + Y2) = Brking_Frame l Y1 + Brking_Frame l Y2\\\n unfolding set_eq_iff Brking_Frame_def plus_fun_def distrib_right ExSet_plus by clarify\n\nlemma [\\reason 1200]:\n \\ X1 \\\\\\

\\\\\\\\ sift_brking_frame' l Y1 E1\n\\ X2 \\\\\\

\\\\\\\\ sift_brking_frame' l Y2 E2\n\\ (X1 + X2) \\\\\\

\\\\\\\\ sift_brking_frame' l (Y1 + Y2) (E1 + E2)\\\n unfolding sift_brking_frame'_def Brking_Frame_plus distrib_right\n \\ premises X1 and X2\n cases \\ X2 \\ for \\Brking_Frame l Y1 + Brking_Frame l Y2 + ((E1 \\ Brk_Frame l) + (E2 \\ Brk_Frame l))\\ by fast\n \\ X1 \\.\n \\. .\n\n(* lemma [\\reason 1200]:\n \\ X1 \\\\\\

\\\\\\\\ sift_brking_frame' l Y E\n\\ X2 \\\\\\

\\\\\\\\ sift_brking_frame' l Y E\n\\ X1 + X2 \\\\\\

\\\\\\\\ sift_brking_frame' l Y E\\\n using \\CASE_IMP by fastforce *)\n\nlemma [\\reason 1200]:\n \\Brking_Frame l Y \\\\\\

\\\\\\\\ sift_brking_frame' l Y 0\\\n unfolding sift_brking_frame'_def \\ \\. .\n\nlemma Brking_Frame_absorb_item[assertion_simps]:\n \\((Brking_Frame l Y)\\ X) = Brking_Frame l (\\v. Y v \\ X)\\\n unfolding Brking_Frame_def\n apply (intro assertion_eq_intro)\n \\ ;; \\. \\ \\. .\n\nlemma Brking_Frame_absorb_subj[assertion_simps]:\n \\((Brking_Frame l Y) \\\\\\\\ P) = Brking_Frame l (\\v. Y v \\\\\\\\ P)\\\n unfolding Brking_Frame_def\n apply (intro assertion_eq_intro)\n \\ \\. \\ ;; \\. .\n\nlemma Brking_Frame_absorb_ex[assertion_simps]:\n \\(\\*x. (Brking_Frame l (Y x))) = Brking_Frame l (\\v. \\*x. Y x v)\\\n unfolding Brking_Frame_def\n apply (intro assertion_eq_intro)\n \\ \\. \\ ;; \\. .\n\nlemma [\\reason 1180]:\n \\ NO_MATCH TYPE('a) TYPE('b)\n\\ ERROR TEXT(\\The exits of scope\\ l \\mismach in return type. One is\\\n TYPE('a) \\while another is\\ TYPE('b))\n\\ Brking_Frame l Y \\\\\\

\\\\\\\\ sift_brking_frame' l Y' 0\\\n for Y :: \\'a::VALs \\arg \\ _\\ and Y' :: \\'b::VALs \\arg \\ _\\\n by blast\n\nlemma [\\reason 1000]:\n \\ X \\\\\\

\\\\\\\\ E\\ \\ Brk_Frame l \\ \\\\\\ Any\n\\ X \\\\\\

\\\\\\\\ sift_brking_frame' l 0 E\\\n unfolding sift_brking_frame'_def FOCUS_TAG_def\n \\ premises X\n X\n \\. .\n\nhide_fact Brking_Frame_plus\n\nsubsection \\ToSA through Brking_Frame\\\n\n\nlemma [\\reason 2200]:\n (*The priority must override Void Padding*)\n \\ (\\v. S v \\\\\\

\\\\\\\\ R v \\ \\ Y \\ \\\\\\ P)\n\\ Brking_Frame l S \\\\\\

\\\\\\\\ Brking_Frame l R \\ \\ Y \\ \\\\\\ P\\\n unfolding Brking_Frame_def FOCUS_TAG_def\n \\ premises X\n X[THEN implies_right_prod]\n \\. .\n\n\nsubsection \\Syntax hiding technical separation items\\\n\noptional_translations (\\hide_brk_frame)\n \"L\" <= \"CONST Brk_Frame l\\ L\"\n \"R\" <= \"R \\ CONST Brk_Frame l\"\n \"R\\ L\" <= \"R \\ CONST Brk_Frame l\\ L\"\n \"XCONST Void\" <= \"CONST Brk_Frame l\"\n \\Hides technical SL assertions for control flowing breaking\\\n\ndeclare [[\\hide_brk_frame = false]]\n\n(*\nML \\\nval phi_display_brk_frame = Attrib.setup_config_bool \\<^binding>\\\\display_brk_frame\\ (K false)\n\nval _ = Theory.setup (\n Procedure_Syntax.add_item_printer (\\<^const_syntax>\\Brk_Frame\\, (fn m => fn ctxt => fn X =>\n if Config.get ctxt phi_display_brk_frame\n then raise Match\n else (case m of Phi_Kind.Procedure => NONE\n | Phi_Kind.Construction => NONE)\n)))\n\\ *)\n\n\nsection \\Example\\\n\nproc\n input \\x \\ \\\\\\ T\\ y \\ \\\\\\ U\\\n output \\y \\ \\\\\\ U\\\n \\ brk_scope \\ for l1\n brk_scope \\ for l2\n $y \"_op_break_rule_\"[of l1 \\\\\\2 \\\\ret. Brk_Frame l2\\ y \\ \\\\\\[ret] U\\]\n \\ .. ;;\n assert \\ (*this place is unreachable!*)\n \\ ..\n \\ .. .\n\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics/PhiSem_CF_Break.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.32766830738621877, "lm_q1q2_score": 0.16511408197873512}} {"text": "(* Title: JinjaThreads/Execute/JVM_Execute.thy\n Author: Andreas Lochbihler\n*)\n\ntheory JVM_Execute\nimports\n SC_Schedulers\n JVMExec_Execute\n \"../BV/BVProgressThreaded\"\nbegin\n\nabbreviation sc_heap_read_cset :: \"heap \\ addr \\ addr_loc \\ addr val set\"\nwhere \"sc_heap_read_cset h ad al \\ set_of_pred (sc_heap_read_i_i_i_o h ad al)\"\n\nabbreviation sc_heap_write_cset :: \"heap \\ addr \\ addr_loc \\ addr val \\ heap set\"\nwhere \"sc_heap_write_cset h ad al v \\ set_of_pred (sc_heap_write_i_i_i_i_o h ad al v)\"\n\ninterpretation sc: \n JVM_heap_execute\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read_cset\"\n \"sc_heap_write_cset\"\n rewrites \"\\h ad al v. v \\ sc_heap_read_cset h ad al \\ sc_heap_read h ad al v\"\n and \"\\h ad al v h'. h' \\ sc_heap_write_cset h ad al v \\ sc_heap_write h ad al v h'\"\n for P\napply(simp_all add: eval_sc_heap_read_i_i_i_o eval_sc_heap_write_i_i_i_i_o)\ndone\n\ninterpretation sc_execute: \n JVM_conf_read\n \"addr2thread_id\"\n \"thread_id2addr\"\n \"sc_spurious_wakeups\"\n \"sc_empty\"\n \"sc_allocate P\"\n \"sc_typeof_addr\"\n \"sc_heap_read\"\n \"sc_heap_write\"\n \"sc_hconf P\"\n for P\nby(unfold_locales)\n\nfun sc_mexec :: \n \"addr jvm_prog \\ thread_id \\ (addr jvm_thread_state \\ heap) \n \\ ((addr, thread_id, heap) jvm_thread_action \\ addr jvm_thread_state \\ heap) Predicate.pred\"\nwhere \n \"sc_mexec P t ((xcp, frs), h) =\n sc.exec_1 (TYPE(addr jvm_method)) P P t (xcp, h, frs) \\ (\\(ta, xcp, h, frs). Predicate.single (ta, (xcp, frs), h))\"\n\nabbreviation sc_jvm_start_state_refine :: \n \"addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (addr, thread_id, heap, (thread_id, (addr jvm_thread_state) \\ addr released_locks) rm, (thread_id, addr wait_set_status) rm, thread_id rs) state_refine\"\nwhere\n \"sc_jvm_start_state_refine \\ \n sc_start_state_refine (rm_empty ()) rm_update (rm_empty ()) (rs_empty ()) (\\C M Ts T (mxs, mxl0, b) vs. (None, [([], Null # vs @ replicate mxl0 undefined_value, C, M, 0)]))\"\n\nabbreviation sc_jvm_state_invar :: \"addr jvm_prog \\ ty\\<^sub>P \\ (addr,thread_id,addr jvm_thread_state,heap,addr) state set\"\nwhere \"sc_jvm_state_invar P \\ \\ {s. sc_execute.correct_state_ts P \\ (thr s) (shr s)}\"\n\nlemma eval_sc_mexec:\n \"(\\t xm ta x'm'. Predicate.eval (sc_mexec P t xm) (ta, x'm')) = \n (\\t ((xcp, frs), h) ta ((xcp', frs'), h'). sc.execute.exec_1 (TYPE(addr jvm_method)) P P t (xcp, h, frs) ta (xcp', h', frs'))\"\nby(rule ext)+(fastforce intro!: SUP1_I simp add: sc.exec_1_eq')\n\nlemma sc_jvm_start_state_invar: \n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n and \"sc_wf_start_state P C M vs\"\n shows \"sc_state_\\ (sc_jvm_start_state_refine P C M vs) \\ sc_jvm_state_invar P \\\"\nusing sc_execute.correct_jvm_state_initial[OF assms]\nby(simp add: sc_execute.correct_jvm_state_def)\n\nsubsection \\Round-robin scheduler\\\n\ninterpretation JVM_rr: \n sc_round_robin_base\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rr_JVM_start_state :: \"nat \\ 'm prog \\ thread_id fifo round_robin\"\nwhere \"sc_rr_JVM_start_state n0 P = JVM_rr.round_robin_start n0 (sc_start_tid P)\"\n\ndefinition exec_JVM_rr ::\n \"nat \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list, \n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state \\ addr released_locks) rm \\ heap) \\\n (thread_id, addr wait_set_status) rm \\ thread_id rs) tllist\"\nwhere\n \"exec_JVM_rr n0 P C M vs = JVM_rr.exec P n0 (sc_rr_JVM_start_state n0 P) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rr:\n sc_round_robin \n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rr:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows\n \"sc_scheduler \n JVM_final (sc_mexec P) convert_RA\n (JVM_rr.round_robin P n0) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) JVM_rr.round_robin_invar\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rr.round_robin_scheduler)\napply(unfold eval_sc_mexec)\napply(rule sc_execute.mexec_deterministic[OF assms sc_deterministic_heap_ops])\napply(simp add: sc_spurious_wakeups)\ndone\n\nsubsection \\Random scheduler\\\n\ninterpretation JVM_rnd: \n sc_random_scheduler_base\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\n.\n\ndefinition sc_rnd_JVM_start_state :: \"Random.seed \\ random_scheduler\"\nwhere \"sc_rnd_JVM_start_state seed = seed\"\n\ndefinition exec_JVM_rnd ::\n \"Random.seed \\ addr jvm_prog \\ cname \\ mname \\ addr val list \\ \n (thread_id \\ (addr, thread_id) obs_event list,\n (addr, thread_id) locks \\ ((thread_id, addr jvm_thread_state \\ addr released_locks) rm \\ heap) \\\n (thread_id, addr wait_set_status) rm \\ thread_id rs) tllist\"\nwhere \"exec_JVM_rnd seed P C M vs = JVM_rnd.exec P (sc_rnd_JVM_start_state seed) (sc_jvm_start_state_refine P C M vs)\"\n\ninterpretation JVM_rnd:\n sc_random_scheduler\n JVM_final \"sc_mexec P\" convert_RA Jinja_output\n for P\nby(unfold_locales)\n\nlemma JVM_rnd:\n assumes \"wf_jvm_prog\\<^bsub>\\\\<^esub> P\"\n shows \n \"sc_scheduler\n JVM_final (sc_mexec P) convert_RA\n (JVM_rnd.random_scheduler P) (pick_wakeup_via_sel (\\s P. rm_sel s (\\(k,v). P k v))) (\\_ _. True)\n (sc_jvm_state_invar P \\)\"\nunfolding sc_scheduler_def\napply(rule JVM_rnd.random_scheduler_scheduler)\napply(unfold eval_sc_mexec)\napply(rule sc_execute.mexec_deterministic[OF assms sc_deterministic_heap_ops])\napply(simp add: sc_spurious_wakeups)\ndone\n\nML_val \\@{code exec_JVM_rr}\\\n\nML_val \\@{code exec_JVM_rnd}\\\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Execute/JVM_Execute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.28776782186926264, "lm_q1q2_score": 0.16508618157107277}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__71_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__71_on_rules imports n_g2kAbsAfter_lemma_on_inv__71\nbegin\nsection{*All lemmas on causal relation between inv__71*}\nlemma lemma_inv__71_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__71 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__71) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__71) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__71_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.16508617456277716}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__60_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__60_on_rules imports n_g2kAbsAfter_lemma_on_inv__60\nbegin\nsection{*All lemmas on causal relation between inv__60*}\nlemma lemma_inv__60_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__60 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__60) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__60_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.3106943704494217, "lm_q1q2_score": 0.16504376183719102}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__49_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__49_on_rules imports n_germanSimp_lemma_on_inv__49\nbegin\nsection{*All lemmas on causal relation between inv__49*}\nlemma lemma_inv__49_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__49 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__49) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__49_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3174262591305011, "lm_q1q2_score": 0.16490970976578553}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__147.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__147 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__147 and some rule r*}\nlemma n_PI_Remote_GetVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__147:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv3) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__147:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__147:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__147:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__147:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__147:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__147:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__147:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__147:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__147:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__147:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__147:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__147:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__147:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv3) ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv3) ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__147:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__147:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__147:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__147:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__147:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__147:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__147:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__147:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__147:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__147:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__147:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__147:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__147:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__147:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__147:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__147:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__147:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__147:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__147:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__147:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__147:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__147:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__147:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__147:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__147.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118791767282, "lm_q2_score": 0.32423540551084407, "lm_q1q2_score": 0.16465059056809023}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | February 2006 |\n | April 2006 (modified) |\n | April 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_nf\nimports FNF_F_nf_int FNF_F_sf\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split [split del]\n\n(*****************************************************************\n\n 1. full normalizing\n 2. \n 3. \n\n *****************************************************************)\n\n(*==================================================================*\n | fsfF --> fnfF |\n *==================================================================*)\n\ninductive_set\n fnfF_fsfF_rel :: \"(nat * ('p,'a) proc * ('p,'a) proc) set\"\n\nwhere\nfnfF_fsfF_rel_zero:\n \"(0, P, NDIV) : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_etc:\n \"P ~: fsfF_proc\n ==> (Suc n, P, P |. Suc n) : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_int:\n \"[| ALL c. if (c: sumset C)\n then (Suc n, SPf c, NPf c) : fnfF_fsfF_rel\n else NPf c = DIV ;\n sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n (Suc n, (!! :C .. SPf), !! c:C ..[Suc n] NPf c)\n : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_step:\n \"[| ALL a. if a:A\n then (n, SPf a, NPf a) : fnfF_fsfF_rel\n else NPf a = DIV ;\n ALL a:A. SPf a : fsfF_proc ;\n Q = SKIP | Q = DIV | Q = STOP |]\n ==> \n (Suc n, (? :A -> SPf) [+] Q,\n ((? :A -> NPf) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV)))\n : fnfF_fsfF_rel\"\n\n(*** function ***)\n\ndefinition\n fnfF_fsfF :: \"nat => ('p,'a) proc => ('p,'a) proc\"\n where\n fnfF_fsfF_def:\n \"fnfF_fsfF n SP == THE NP. (n, SP, NP) : fnfF_fsfF_rel\"\n \ndefinition\n fnfF :: \"nat => ('p,'a) proc => ('p,'a) proc\"\n where\n fnfF_def :\n \"fnfF == (%n P. fnfF_fsfF n (fsfF P))\"\n \ndefinition\n XfnfF :: \"('p,'a) proc => ('p,'a) proc\"\n where\n XfnfF_def :\n \"XfnfF == (%P. !nat n .. (fnfF n P))\"\n\n(****************************************************************\n | uniquness |\n ****************************************************************)\n\nlemma fnfF_fsfF_rel_unique_in_lm:\n \"(n, SP, NP1) : fnfF_fsfF_rel\n ==> (ALL NP2. ((n, SP, NP2) : fnfF_fsfF_rel\n --> NP1 = NP2))\"\napply (rule fnfF_fsfF_rel.induct[of n SP NP1])\napply (simp)\n\n(* zero *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases)\napply (simp_all)\n\n(* etc *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases)\napply (simp_all)\napply (simp add: fsfF_proc_int)\napply (simp add: fsfF_proc_ext)\n\n(* int *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (subgoal_tac \"NPf = NPfa\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset Ca\")\n apply (simp)\n apply (simp)\n\n(* step *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (rule conjI)\n apply (subgoal_tac \"NPf = NPfa\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : Aa\")\n apply (simp)\n apply (simp)\n\n apply (simp split: if_split)\ndone\n\n(*-----------------------*\n | unique |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_unique:\n \"[| (n, SP, NP1) : fnfF_fsfF_rel;\n (n, SP, NP2) : fnfF_fsfF_rel |]\n ==> NP1 = NP2\"\nby (simp add: fnfF_fsfF_rel_unique_in_lm)\n\nlemma fnfF_fsfF_rel_EX1:\n \"(EX NP. (n, SP, NP) : fnfF_fsfF_rel)\n = (EX! NP. (n, SP, NP) : fnfF_fsfF_rel)\"\napply (rule iffI)\n\n apply (erule exE)\n apply (rule_tac a=\"NP\" in ex1I)\n apply (simp)\n apply (simp add: fnfF_fsfF_rel_unique)\n\n apply (elim ex1_implies_exE)\n apply (simp)\ndone\n\n(*------------------------------------------------------------*\n | fnfF_fsfF_rel (iff) |\n *------------------------------------------------------------*)\n\n(* zero *)\n\nlemma fnfF_fsfF_rel_zero_iff:\n \"(0, SP, NP) : fnfF_fsfF_rel = (NP = NDIV)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\napply (simp add: fnfF_fsfF_rel_zero)\ndone\n\n(* etc *)\n\nlemma fnfF_fsfF_rel_etc_iff:\n \"P ~: fsfF_proc\n ==> (Suc n, P, NP) : fnfF_fsfF_rel\n = (NP = P |. Suc n)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n apply (simp add: fsfF_proc_int)\n apply (simp add: fsfF_proc_ext)\napply (simp add: fnfF_fsfF_rel_etc)\ndone\n\n(* int *)\n\nlemma fnfF_fsfF_rel_int_iff:\n \"[| ALL c. if (c: sumset C)\n then (Suc n, SPf c, NPf c) : fnfF_fsfF_rel\n else NPf c = DIV ;\n sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n (Suc n, (!! :C .. SPf), NP) : fnfF_fsfF_rel\n = (NP = !! c:C ..[Suc n] NPf c)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (subgoal_tac \"NPfa = NPf\", simp)\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset Ca\")\n apply (simp add: fnfF_fsfF_rel_unique)\n\n apply (simp)\napply (simp add: fnfF_fsfF_rel_int)\ndone\n\n(* step *)\n\nlemma fnfF_fsfF_rel_step_iff:\n \"[| ALL a. if a:A\n then (n, SPf a, NPf a) : fnfF_fsfF_rel\n else NPf a = DIV ;\n ALL a:A. SPf a : fsfF_proc ;\n Q = SKIP | Q = DIV | Q = STOP |]\n ==> \n (Suc n, (? :A -> SPf) [+] Q, NP) : fnfF_fsfF_rel\n = (NP = ((? :A -> NPf) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV)))\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (rule conjI)\n apply (subgoal_tac \"NPfa = NPf\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI conjI)\n apply (elim conjE)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : Aa\")\n apply (simp add: fnfF_fsfF_rel_unique)\n apply (simp)\n apply (simp split: if_split)\n\napply (simp add: fnfF_fsfF_rel_step)\ndone\n\n(****************************************************************\n | existency |\n ****************************************************************)\n\n(*** exists ***)\n\nlemma fnfF_fsfF_rel_exists_zero:\n \"(EX NP. (0, SP, NP) : fnfF_fsfF_rel)\"\napply (rule_tac x=\"NDIV\" in exI)\napply (simp add: fnfF_fsfF_rel.intros)\ndone\n\nlemma fnfF_fsfF_rel_exists_notin:\n \"P ~: fsfF_proc\n ==> (EX NP. (n, P, NP) : fnfF_fsfF_rel)\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\napply (rule_tac x=\"P |. n\" in exI)\napply (simp add: fnfF_fsfF_rel.intros)\ndone\n\n(*** in fsfF_proc ***)\n\nlemma fnfF_fsfF_rel_exists_in:\n \"SP : fsfF_proc\n ==> ALL n. (EX NP. (n, SP, NP) : fnfF_fsfF_rel)\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (rule allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\n\napply (erule dist_BALL_conjE)\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"n\" in spec)\napply (elim exE)\napply (rule_tac x=\"!! c:C ..[Suc m] (if (c : sumset C) then f c else DIV)\" in exI)\napply (rule fnfF_fsfF_rel.intros)\napply (simp split: if_split)\napply (simp_all)\n\n(* ext *)\napply (rule allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\n\napply (elim exE)\napply (erule dist_BALL_conjE)\n\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"m\" in spec)\napply (elim exE)\napply (rule_tac x=\n\"((? a:A -> (if (a : A) then f a else DIV)) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV))\" in exI)\napply (rule fnfF_fsfF_rel.intros)\napply (simp split: if_split)\napply (simp_all)\ndone\n\n(*-----------------------*\n | exists |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_exists:\n \"EX NP. (n, SP, NP) : fnfF_fsfF_rel\"\napply (case_tac \"SP ~: fsfF_proc\")\napply (simp add: fnfF_fsfF_rel_exists_notin)\napply (simp add: fnfF_fsfF_rel_exists_in)\ndone\n\n(*-----------------------*\n | uniquely exists |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_unique_exists:\n \"EX! NP. (n, SP, NP) : fnfF_fsfF_rel\"\napply (simp add: fnfF_fsfF_rel_EX1[THEN sym])\napply (simp add: fnfF_fsfF_rel_exists)\ndone\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fnfF_fsfF_rel_zero_in:\n \"(0, SP, NP) : fnfF_fsfF_rel ==> NP : fnfF_proc\"\napply (simp add: fnfF_fsfF_rel_zero_iff)\ndone\n\nlemma fnfF_fsfF_rel_in_lm:\n \"SP : fsfF_proc ==> \n ALL n NP. (n, SP, NP) : fnfF_fsfF_rel --> NP : fnfF_proc\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_zero_in)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fnfF_Rep_int_choice_in)\napply (rule ballI)\napply (drule_tac x=\"c\" in spec, simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fnfF_fsfF_rel_zero_in)\n\napply (intro impI)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fnfF_proc.intros)\n\n apply (simp split: if_split)\n apply (intro allI impI)\n apply (drule_tac x=\"a\" in spec, simp)\n\n apply (simp add: fnfF_set_condition_def)\n apply (intro allI impI)\n apply (simp split: if_split)\n apply (elim conjE bexE) \n apply (case_tac \"Qa = STOP\")\n apply (simp)\n apply (simp)\n\n apply (force)\n apply (force)\ndone\n\n(*------------------------------------*\n | in |\n *------------------------------------*)\n\nlemma fnfF_fsfF_rel_in:\n \"[| SP : fsfF_proc ; (n, SP, NP) : fnfF_fsfF_rel |]\n ==> NP : fnfF_proc\"\napply (insert fnfF_fsfF_rel_in_lm[of SP])\napply (blast)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\n(*** relation ***)\n\nlemma cspF_fnfF_fsfF_rel_eqF_zero:\n \"(0, P, NP) : fnfF_fsfF_rel\n ==> P |. 0 =F NP\"\napply (simp add: fnfF_fsfF_rel_zero_iff)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_Zero)\napply (rule cspF_NDIV_eqF)\ndone\n\nlemma cspF_fnfF_fsfF_rel_eqF_notin:\n \"[| P ~: fsfF_proc ; (n, P, NP) : fnfF_fsfF_rel |]\n ==> P |. n =F NP\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\napply (simp add: fnfF_fsfF_rel_etc_iff)\ndone\n\nlemma cspF_fnfF_fsfF_rel_eqF_in:\n \"SP : fsfF_proc ==>\n ALL n NP. (n, SP, NP) : fnfF_fsfF_rel\n --> SP |. n =F NP\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\napply (elim conjE)\n\napply (rule cspF_rw_right)\napply (rule cspF_fnfF_Rep_int_choice_eqF[THEN cspF_sym])\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_rw_right)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (drule_tac x=\"c\" in bspec, simp)\napply (drule_tac x=\"c\" in spec)\napply (simp)\napply (drule_tac x=\"Suc na\" in spec)\napply (drule_tac x=\"NPf c\" in spec)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_n[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp)\napply (simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\n\napply (intro impI)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_step)\napply (subgoal_tac \"Qa |. Suc na =F Qa\")\n apply (simp)\n apply (case_tac \"Q = STOP\")\n apply (simp add: cspF_STOP_Depth_rest)\n apply (simp add: cspF_SKIP_or_DIV_Depth_rest)\n\n apply (case_tac \"Qa = STOP\")\n apply (simp)\n\n (* STOP *)\n apply (rule cspF_rw_left)\n apply (rule cspF_unit)\n apply (rule cspF_rw_left)\n apply (rule cspF_input_DIV)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (simp)\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"na\" in spec)\n apply (drule_tac x=\"NPf a\" in spec)\n apply (simp)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_Rep_int_choice_singleton)\n apply (rule cspF_reflex)\n\n (* SKIP | DIV *)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (rule cspF_reflex)\n apply (rule cspF_Rep_int_choice_DIV)\n apply (rule cspF_rw_right)\n apply (rule cspF_unit)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (simp)\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"na\" in spec)\n apply (drule_tac x=\"NPf a\" in spec)\n apply (simp)\n apply (force)\ndone\n\n(*------------------------------------*\n | eqF |\n *------------------------------------*)\n\nlemma cspF_fnfF_fsfF_rel_eqF:\n \"(n, SP, NP) : fnfF_fsfF_rel ==> SP |. n =F NP\"\napply (case_tac \"SP ~: fsfF_proc\")\napply (simp add: cspF_fnfF_fsfF_rel_eqF_notin)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_in)\ndone\n\n(*************************************************************\n relation --> function\n *************************************************************)\n\nlemma fnfF_fsfF_in_rel:\n \"(n, SP, fnfF_fsfF n SP) : fnfF_fsfF_rel\"\napply (simp add: fnfF_fsfF_def)\napply (rule theI'\n [of \"(%NP. (n, SP, NP) : fnfF_fsfF_rel)\"])\napply (simp add: fnfF_fsfF_rel_unique_exists)\ndone\n\nlemma fnfF_fsfF_from_rel:\n \"((n, SP, NP) : fnfF_fsfF_rel)\n = (fnfF_fsfF n SP = NP)\"\napply (rule iffI)\napply (simp add: fnfF_fsfF_def)\napply (simp add: fnfF_fsfF_rel_unique_exists the1_equality)\n\napply (drule sym)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemma fnfF_fsfF_to_rel:\n \"(fnfF_fsfF n SP = NP)\n = ((n, SP, NP) : fnfF_fsfF_rel)\"\nby (simp add: fnfF_fsfF_from_rel)\n\n(*************************************************************\n function\n *************************************************************)\n\nlemma fnfF_fsfF_zero:\n \"fnfF_fsfF 0 SP = NDIV\"\napply (simp add: fnfF_fsfF_to_rel)\napply (simp add: fnfF_fsfF_rel_zero_iff)\ndone\n\nlemma fnfF_fsfF_etc:\n \"P ~: fsfF_proc\n ==> fnfF_fsfF (Suc n) P = P |. (Suc n)\"\napply (simp add: fnfF_fsfF_to_rel)\napply (simp add: fnfF_fsfF_rel_etc_iff)\ndone\n\nlemma fnfF_fsfF_int:\n \"[| sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n fnfF_fsfF (Suc n) (!! :C .. SPf) =\n !! c:C ..[Suc n] (if c: sumset C then (fnfF_fsfF (Suc n) (SPf c)) else DIV)\"\napply (simp add: fnfF_fsfF_to_rel)\napply (rule fnfF_fsfF_rel_int)\napply (simp_all)\napply (simp split: if_split)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemma fnfF_fsfF_step:\n \"[| ALL a:A. SPf a : fsfF_proc ; Q = SKIP | Q = DIV | Q = STOP |]\n ==>\n fnfF_fsfF (Suc n) ((? :A -> SPf) [+] Q) =\n ((? a:A -> (if a:A then (fnfF_fsfF n (SPf a)) else DIV))\n [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV))\"\napply (simp add: fnfF_fsfF_to_rel)\napply (rule fnfF_fsfF_rel_step)\napply (simp_all)\napply (simp split: if_split)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemmas fnfF_fsfF =\n fnfF_fsfF_etc\n fnfF_fsfF_int\n fnfF_fsfF_step\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fnfF_fsfF_in:\n \"SP : fsfF_proc\n ==> fnfF_fsfF n SP : fnfF_proc\"\napply (rule fnfF_fsfF_rel_in[of SP n])\napply (simp_all add: fnfF_fsfF_in_rel)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fnfF_fsfF_eqF:\n \"SP |. n =F fnfF_fsfF n SP\"\napply (rule cspF_fnfF_fsfF_rel_eqF)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\n(*===============================================================*\n theorem --- fnfF P is a (restricted) full normal form ---\n *===============================================================*)\n\ntheorem fnfF_in: \"fnfF n P : fnfF_proc\"\napply (simp add: fnfF_def)\napply (simp add: fnfF_fsfF_in fsfF_in)\ndone\n\n(*===============================================================*\n theorem --- fnfF P is equal to P based on F ---\n *===============================================================*)\n\ntheorem cspF_fnfF_eqF: \n \"FPmode = CPOmode | FPmode = MIXmode ==> P |. n =F fnfF n P\"\napply (simp add: fnfF_def)\napply (rule cspF_rw_right)\napply (rule cspF_fnfF_fsfF_eqF[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fsfF_eqF)\napply (simp)\napply (rule cspF_reflex)\ndone\n\n(*------------------------*\n | auxiliary laws |\n *------------------------*)\n\nlemma cspF_fnfF_eqF_Depth_rest:\n \"FPmode = CPOmode | FPmode = MIXmode\n ==> (fnfF n P) |. n =F fnfF n P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_min)\napply (simp)\napply (rule cspF_fnfF_eqF)\napply (simp)\ndone\n\n(*===============================================================*\n theorem --- XfnfF P is a full normal form ---\n *===============================================================*)\n\ntheorem XfnfF_in: \n \"FPmode = CPOmode | FPmode = MIXmode ==> XfnfF P : XfnfF_proc\"\napply (simp add: XfnfF_def)\napply (simp add: XfnfF_proc_def)\napply (rule_tac x=\"(%n. fnfF n P)\" in exI)\napply (simp)\napply (simp add: fnfF_in)\napply (rule allI)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_nat_Depth_rest)\ndone\n\n(*===============================================================*\n theorem --- XfnfF P is equal to P based on F ---\n *===============================================================*)\n\ntheorem cspF_XfnfF_eqF:\n \"FPmode = CPOmode | FPmode = MIXmode ==> P =F XfnfF P\"\napply (simp add: XfnfF_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_nat_Depth_rest)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_nf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.32423539245106087, "lm_q1q2_score": 0.16465057910587272}} {"text": "theory LLVM_Memory\nimports Monad2 LLVM_Integer LLVM_Pre_Syntax Definition_Utils\nbegin\n\n section \\Monad Setup\\\n\n datatype err = is_static: STATIC_ERROR string | MEM_ERROR | UNINIT_ERROR | OVERFLOW_ERROR\n hide_const (open) is_static\n\n abbreviation lift_lens_static (\"'(_')\\<^sub>S\")\n where \"lift_lens_static \\ lift_lens (STATIC_ERROR ''lens'')\"\n\n abbreviation lift_lens_mem (\"'(_')\\<^sub>M\")\n where \"lift_lens_mem \\ lift_lens MEM_ERROR\"\n\n abbreviation lift_lens_uninit (\"'(_')\\<^sub>U\")\n where \"lift_lens_uninit \\ lift_lens UNINIT_ERROR\"\n\n \n section \\Values\\ \n \n subsection \\Pointers\\\n datatype block_addr = BLOCK_ADDR (the_block: nat)\n \n datatype va_item = VA_ARRAY_IDX (aidx: nat) | VA_FIELD_IDX (fidx: nat)\n hide_const (open) aidx fidx\n define_lenses (open) va_item\n\n type_synonym vaddr = \"va_item list\"\n\n datatype addr = ADDR (block_addr: block_addr) (vaddr: vaddr)\n hide_const (open) block_addr vaddr\n define_lenses (open) addr\n\n subsection \\Structured Values\\\n \n datatype val =\n VINT (lint: \"nat + lint\") \\ \\\\width + lint\\\\\n | VPTR (addr: \"addr option option\")\n | VARRAY (items: \"val list\")\n | VSTRUCT (fields: \"val list\")\n\n hide_const (open) lint addr items fields\n define_lenses (open) val\n \n\n fun uninit where\n \"uninit (TINT w) = VINT (Inl w)\"\n | \"uninit (TPTR _) = VPTR None\"\n | \"uninit (TARRAY n ty) = VARRAY (replicate n (uninit ty))\"\n | \"uninit (TSTRUCT tys) = VSTRUCT (map uninit tys)\"\n\n \n fun wpi_width where\n \"wpi_width (Inl w) = w\"\n | \"wpi_width (Inr i) = width i\"\n \n\n fun same_struct :: \"val \\ val \\ bool\" where\n \"same_struct (VINT a) (VINT b) \\ wpi_width a = wpi_width b\"\n | \"same_struct (VPTR _) (VPTR _) \\ True\"\n | \"same_struct (VARRAY xs) (VARRAY ys) \\ list_all2 same_struct xs ys\"\n | \"same_struct (VSTRUCT xs) (VSTRUCT ys) \\ list_all2 same_struct xs ys\"\n | \"same_struct _ _ \\ False\"\n\n lemma same_struct_refl[simp]: \"same_struct v v\"\n apply (induction v)\n apply (auto simp: list.rel_refl_strong)\n done\n\n lemma same_struct_sym: \"same_struct a b \\ same_struct b a\"\n apply (induction a b rule: same_struct.induct)\n apply (auto simp: list_all2_conv_all_nth)\n done\n\n lemma same_struct_trans[trans]: \"same_struct a b \\ same_struct b c \\ same_struct a c\"\n apply (induction a b arbitrary: c rule: same_struct.induct)\n apply simp_all\n apply (case_tac c; auto simp: list_all2_conv_all_nth in_set_conv_nth; blast)+\n done\n \n definition \"put_same_struct L a b \\ doM {\n v \\ mget L b;\n fcheck (STATIC_ERROR ''val-struct change'') (same_struct a v);\n mput L a b\n }\"\n \n \n \n subsection \\Conversion to Type-Representations\\ \n definition to_ptr where\n \"to_ptr v \\ case (v) of\n (VPTR (Some p)) \\ return p\n | (VPTR None) \\ fail UNINIT_ERROR\n | _ \\ fail (STATIC_ERROR ''to_ptr'')\"\n\n definition to_addr where\n \"to_addr v \\ case (v) of\n (VPTR (Some (Some p))) \\ return p\n | (VPTR (Some None)) \\ fail MEM_ERROR\n | (VPTR None) \\ fail UNINIT_ERROR\n | _ \\ fail (STATIC_ERROR ''to_addr'')\"\n\n definition to_lint where\n \"to_lint v \\ case (v) of\n (VINT (Inr i)) \\ return i\n | (VINT (Inl _)) \\ fail UNINIT_ERROR\n | _ \\ fail (STATIC_ERROR ''to_int'')\"\n\n definition to_uint where\n \"to_uint v \\ doM { v\\to_lint v; return (lint_to_uint v) }\"\n \n definition to_sint where\n \"to_sint v \\ doM { v\\to_lint v; return (lint_to_sint v) }\"\n \n definition to_nat where\n \"to_nat v \\ doM { v \\ to_uint v; return (nat v) }\"\n \n definition to_bool where\n \"to_bool v \\ doM {\n v \\ to_lint v;\n fcheck (STATIC_ERROR ''to_bool'') (width v = 1);\n return (lint_to_bool v)\n }\"\n \n definition \"from_addr addr \\ return (VPTR (Some (Some addr)))\"\n definition \"from_lint i \\ return (VINT (Inr i))\"\n definition \"from_bool b \\ return (VINT (Inr (bool_to_lint b)))\"\n \n \n definition \"op_lift1 T R f x \\ doM {\n x \\ T x;\n r \\ f x;\n R r\n }\"\n \n definition \"op_lift2 T1 T2 R f x1 x2 \\ doM {\n x1 \\ T1 x1;\n x2 \\ T2 x2;\n r \\ f x1 x2;\n R r\n }\"\n\n definition \"op_lift3 T1 T2 T3 R f x1 x2 x3 \\ doM {\n x1 \\ T1 x1;\n x2 \\ T2 x2;\n x3 \\ T3 x3;\n r \\ f x1 x2 x3;\n R r\n }\"\n \n \n section \\Memory\\ \n \n datatype block_type = ON_STACK | ON_HEAP\n hide_const (open) ON_STACK ON_HEAP\n \n datatype memory = MEM (mem: \"(val \\ block_type) option list\")\n hide_const (open) mem\n define_lenses memory\n\n abbreviation \"memL \\ (mem\\<^sub>L)\\<^sub>S\"\n abbreviation \"idxL i \\ (idx\\<^sub>L i)\\<^sub>M\"\n\n definition \"mem_empty \\ MEM []\"\n\n \n subsection \\Allocate and Free\\\n\n definition \"block_allocate bty v \\ (doM {\n \\\\use memL;\n memL %= (\\\\. \\@[Some (v,bty)]);\n return (BLOCK_ADDR (length \\))\n })\"\n\n definition \"block_free bty b \\ doM {\n let L = memL \\ idxL (the_block b);\n (_,ty')\\use (L \\ (the\\<^sub>L)\\<^sub>M);\n fcheck MEM_ERROR (bty=ty');\n L := None\n }\"\n\n definition \"llb_malloc ty n \\ doM {\n fcheck MEM_ERROR (n>0);\n let n = nat n;\n let v = uninit (TARRAY n ty);\n r \\ block_allocate block_type.ON_HEAP v;\n return (ADDR r [VA_ARRAY_IDX 0])\n }\"\n \n definition \"llb_free addr \\ doM {\n case addr of\n ADDR b [VA_ARRAY_IDX 0] \\ block_free block_type.ON_HEAP b\n | _ \\ fail MEM_ERROR\n }\"\n \n definition \"blockL' b \\ memL \\ (idx\\<^sub>L (the_block b))\\<^sub>S \\ (the\\<^sub>L)\\<^sub>M\"\n definition \"blockL b \\ memL \\ (idx\\<^sub>L (the_block b))\\<^sub>S \\ (the\\<^sub>L)\\<^sub>M \\ (fst\\<^sub>L)\\<^sub>S\"\n\n lemma blockL_elens[simp]: \n \"elens (blockL b)\"\n \"elens (blockL' b)\"\n by (auto simp: blockL_def blockL'_def)\n\n subsection \\Load and Store\\\n \n definition \"struct_field\\<^sub>L i \\ (val.fields\\<^sub>L \\\\<^sub>L idx\\<^sub>L i)\\<^sub>S\"\n (*definition \"static_array_item\\<^sub>L i \\ (val.items\\<^sub>L \\\\<^sub>L idx\\<^sub>L i)\\<^sub>S\"*)\n definition \"array_item\\<^sub>L i \\ (val.items\\<^sub>L)\\<^sub>S \\ idxL i\"\n\n fun lens_of_vai where\n \"lens_of_vai (VA_ARRAY_IDX i) = array_item\\<^sub>L i\"\n | \"lens_of_vai (VA_FIELD_IDX i) = struct_field\\<^sub>L i\"\n\n definition \"lens_of_vaddr va \\ foldr (\\vai p. lens_of_vai vai \\ p) va (id\\<^sub>L)\\<^sub>S\"\n\n fun lens_of_addr where\n \"lens_of_addr (ADDR b va) = blockL b \\ lens_of_vaddr va\"\n \n \n definition llb_load where\n \"llb_load addr \\ use (lens_of_addr addr)\"\n \n definition llb_store where\n \"llb_store v addr \\ doM {\n ov \\ use (lens_of_addr addr);\n fcheck (STATIC_ERROR ''mem-struct change'') (same_struct v ov);\n lens_of_addr addr := v\n }\" \n\n \n subsection \\GEP, Insert, and Extract\\\n \n \n definition llb_ofs_addr :: \"addr \\ int \\ _\" where\n \"llb_ofs_addr a i \\ map_lens (addr.vaddr\\<^sub>L\\\\<^sub>Llast\\<^sub>L\\\\<^sub>Lva_item.aidx\\<^sub>L)\\<^sub>M (\\idx. doM {\n let idx = int idx + i;\n fcheck MEM_ERROR (idx\\0);\n return (nat idx)\n }) a\"\n \n definition llb_idx_array :: \"addr \\ int \\ _\" where\n \"llb_idx_array a i \\ map_lens (addr.vaddr\\<^sub>L)\\<^sub>S (\\x. doM {\n fcheck MEM_ERROR (i\\0);\n return (x@[VA_ARRAY_IDX (nat i)])\n } ) a\"\n \n definition llb_idx_field :: \"addr \\ nat \\ _\" where\n \"llb_idx_field a i \\ map_lens (addr.vaddr\\<^sub>L)\\<^sub>S (\\x. doM {\n return (x@[VA_FIELD_IDX i])\n } ) a\"\n \n definition ll_insert_s_value' where \"ll_insert_s_value' bv ev idx \\ put_same_struct (struct_field\\<^sub>L idx) ev bv\"\n definition ll_extract_s_value' where \"ll_extract_s_value' bv idx \\ mget (struct_field\\<^sub>L idx) bv\"\n definition ll_insert_a_value' where \"ll_insert_a_value' bv ev idx \\ put_same_struct (array_item\\<^sub>L idx) ev bv\"\n definition ll_extract_a_value' where \"ll_extract_a_value' bv idx \\ mget (array_item\\<^sub>L idx) bv\"\n \n \n \nsection \\Arithmetic\\ \n \n definition \"op_arith2 ovf f x1 x2 = doM {\n fcheck (STATIC_ERROR ''arith2 incompatible widths'') (width x1 = width x2);\n fcheck (OVERFLOW_ERROR) (\\ovf x1 x2);\n return (f x1 x2)\n }\"\n\n definition \"op_lift_arith2 ovf f \\ op_lift2 to_lint to_lint from_lint (op_arith2 ovf f)\"\n definition \"op_lift_arith2' \\ op_lift_arith2 (\\_ _. False)\"\n definition \"op_lift_cmp2 f \\ op_lift2 to_lint to_lint from_bool (op_arith2 (\\_ _. False) f)\"\n \n definition \"llb_trunc i w \\ doM {\n fcheck (STATIC_ERROR ''Trunc must go to smaller type'') (width i > w);\n return (trunc w i)\n }\"\n \n definition \"llb_sext i w \\ doM {\n fcheck (STATIC_ERROR ''Sext must go to greater type'') (width i < w);\n return (sext w i)\n }\"\n \n definition \"llb_zext i w \\ doM {\n fcheck (STATIC_ERROR ''Zext must go to greater type'') (width i < w);\n return (zext w i)\n }\"\n\n definition \"to_iTw ty \\ case ty of TINT w \\ return w | _ \\ fail (STATIC_ERROR ''Expected int type'')\"\n \n definition \"shift_ovf a n \\ nat (lint_to_uint n) \\ width a\"\n \n definition \"bitSHL' a n \\ bitSHL a (nat (lint_to_uint n))\"\n definition \"bitASHR' a n \\ bitASHR a (nat (lint_to_uint n))\"\n definition \"bitLSHR' a n \\ bitLSHR a (nat (lint_to_uint n))\"\n \nsection \\LLVM Operations\\\n \n type_synonym llM = \"(_,unit,memory,err) M\"\n\n definition ll_add :: \"val \\ val \\ llM\" where \"ll_add \\ op_lift_arith2' (+)\"\n definition ll_sub :: \"val \\ val \\ llM\" where \"ll_sub \\ op_lift_arith2' (-)\"\n definition ll_mul :: \"val \\ val \\ llM\" where \"ll_mul \\ op_lift_arith2' ( * )\"\n definition ll_udiv :: \"val \\ val \\ llM\" where \"ll_udiv \\ op_lift_arith2' (div)\"\n definition ll_urem :: \"val \\ val \\ llM\" where \"ll_urem \\ op_lift_arith2' (mod)\"\n definition ll_sdiv :: \"val \\ val \\ llM\" where \"ll_sdiv \\ op_lift_arith2 sdivrem_ovf (div\\<^sub>s)\"\n definition ll_srem :: \"val \\ val \\ llM\" where \"ll_srem \\ op_lift_arith2 sdivrem_ovf (rem\\<^sub>s)\"\n definition ll_shl :: \"val \\ val \\ llM\" where \"ll_shl \\ op_lift_arith2 shift_ovf bitSHL'\" \n definition ll_lshr :: \"val \\ val \\ llM\" where \"ll_lshr \\ op_lift_arith2 shift_ovf bitLSHR'\" \n definition ll_ashr :: \"val \\ val \\ llM\" where \"ll_ashr \\ op_lift_arith2 shift_ovf bitASHR'\"\n definition ll_trunc :: \"val \\ type \\ llM\" where \"ll_trunc \\ op_lift2 to_lint to_iTw from_lint llb_trunc\"\n definition ll_sext :: \"val \\ type \\ llM\" where \"ll_sext \\ op_lift2 to_lint to_iTw from_lint llb_sext\"\n definition ll_zext :: \"val \\ type \\ llM\" where \"ll_zext \\ op_lift2 to_lint to_iTw from_lint llb_zext\"\n\n definition ll_and :: \"val \\ val \\ llM\" where \"ll_and \\ op_lift_arith2' (AND)\"\n definition ll_or :: \"val \\ val \\ llM\" where \"ll_or \\ op_lift_arith2' (OR)\"\n definition ll_xor :: \"val \\ val \\ llM\" where \"ll_xor \\ op_lift_arith2' (XOR)\"\n \n definition ll_icmp_eq :: \"val \\ val \\ llM\" where \"ll_icmp_eq \\ op_lift_cmp2 (=)\"\n definition ll_icmp_ne :: \"val \\ val \\ llM\" where \"ll_icmp_ne \\ op_lift_cmp2 (\\)\"\n definition ll_icmp_sle :: \"val \\ val \\ llM\" where \"ll_icmp_sle \\ op_lift_cmp2 (\\\\<^sub>s)\"\n definition ll_icmp_slt :: \"val \\ val \\ llM\" where \"ll_icmp_slt \\ op_lift_cmp2 (<\\<^sub>s)\"\n definition ll_icmp_ule :: \"val \\ val \\ llM\" where \"ll_icmp_ule \\ op_lift_cmp2 (\\)\"\n definition ll_icmp_ult :: \"val \\ val \\ llM\" where \"ll_icmp_ult \\ op_lift_cmp2 (<)\"\n \n definition ll_malloc :: \"type \\ val \\ llM\" where \"ll_malloc \\ op_lift2 return to_uint from_addr llb_malloc\"\n definition ll_free :: \"val \\ llM\" where \"ll_free \\ op_lift1 to_addr return llb_free\"\n \n definition ll_load :: \"val \\ llM\" where \"ll_load \\ op_lift1 to_addr return llb_load\"\n definition ll_store :: \"val \\ val \\ llM\" where \"ll_store \\ op_lift2 return to_addr return llb_store\"\n \n definition ll_insert_s_value :: \"val \\ val \\ nat \\ llM\" where \"ll_insert_s_value bv ev idx \\ put_same_struct (struct_field\\<^sub>L idx) ev bv\"\n definition ll_extract_s_value :: \"val \\ nat \\ llM\" where \"ll_extract_s_value bv idx \\ mget (struct_field\\<^sub>L idx) bv\"\n definition ll_insert_a_value :: \"val \\ val \\ nat \\ llM\" where \"ll_insert_a_value bv ev idx \\ put_same_struct (array_item\\<^sub>L idx) ev bv\"\n definition ll_extract_a_value :: \"val \\ nat \\ llM\" where \"ll_extract_a_value bv idx \\ mget (array_item\\<^sub>L idx) bv\"\n \n definition ll_ofs_addr :: \"val \\ val \\ llM\" where \"ll_ofs_addr \\ op_lift2 to_addr to_sint from_addr llb_ofs_addr\"\n definition ll_idx_array :: \"val \\ val \\ llM\" where \"ll_idx_array \\ op_lift2 to_addr to_sint from_addr llb_idx_array\"\n definition ll_idx_field :: \"val \\ nat \\ llM\" where \"ll_idx_field \\ op_lift2 to_addr return from_addr llb_idx_field\"\n \n definition \"llop_iconst w i \\ VINT (Inr (lconst w i))\"\n definition \"llop_undef ty \\ uninit ty\"\n \n definition llc_if :: \"val \\ llM \\ llM \\ llM\" where \n \"llc_if b t e \\ doM {\n b \\ to_bool b;\n if b then t else e\n }\"\n\n definition llc_while :: \"(val \\ llM) \\ (val \\ llM) \\ val \\ llM\" where\n \"llc_while b f s\\<^sub>0 \\ mwhile (\\s. b s \\ to_bool) f s\\<^sub>0\"\n \n \n abbreviation \"ty_i64xi64 \\ TSTRUCT [TINT 64, TINT 64]\"\n \n definition exp where \"exp i \\ doM {\n s \\ ll_insert_s_value (llop_undef ty_i64xi64) (llop_iconst 64 1) 0;\n s \\ ll_insert_s_value s i 1;\n \n s \\ llc_while \n (\\s. doM {\n c \\ ll_extract_s_value s 0;\n i \\ ll_extract_s_value s 1;\n ll_icmp_ne i (llop_iconst 64 0)\n })\n (\\s. doM {\n c \\ ll_extract_s_value s 0;\n i \\ ll_extract_s_value s 1;\n c \\ ll_mul c (llop_iconst 64 2);\n i \\ ll_sub i (llop_iconst 64 1);\n s \\ ll_insert_s_value (llop_undef ty_i64xi64) c 0;\n s \\ ll_insert_s_value s i 1;\n return s\n })\n s;\n \n c \\ ll_extract_s_value s 0;\n return c\n }\"\n\n \n definition exec :: \"(val, unit, memory, err) M \\ (int, unit, memory, err) mres\"\n where \"exec m \\ run (m \\ to_sint) mem_empty\"\n \n term pretty_val \n \n value \"exec (ll_insert_s_value (llop_undef ty_i64xi64) (llop_iconst 64 1) 0)\"\n \n value \"exec (exp (llop_iconst 64 5))\"\n \n thm exp_def[unfolded llc_while_def mwhile_def]\n \n lemma gen_code_thm_llc_while:\n assumes \"f \\ llc_while b body\"\n shows \"f s = doM { ctd \\ b s; llc_if ctd (doM { s\\body s; f s}) (return s)}\"\n unfolding assms\n unfolding llc_while_def llc_if_def\n apply (rewrite mwhile_unfold)\n by simp\n \n setup {*\n Definition_Utils.add_extraction \"llc_while\" {\n pattern = Logic.varify_global @{term \"llc_while b body\"},\n gen_thm = @{thm gen_code_thm_llc_while},\n gen_tac = Partial_Function.mono_tac\n }\n *}\n \n \n \n prepare_code_thms exp_def\n print_theorems\n \n thm exp.code\n \n lemma aux: \"(NO_MATCH (bind mm ff) (f x)) \\ doM { x\\m; f x } = doM { x\\m; r\\f x; return r }\" by simp\n \n declare [[eta_contract = false]]\n\n ML_file \"LLVM_Builder.ml\"\n \n ML \\\n \n structure LLVM_Compiler = struct\n fun normalize_code_thm ctxt thm = let\n fun ensure_abs (t as Abs _) = t\n | ensure_abs t = @{mk_term \"\\x. ?t x\"}\n \n fun normalize_bind1 t = let\n val (f,args) = strip_comb t\n val _ = is_Const f orelse is_Free f orelse raise TERM (\"Invalid head\",[f])\n \n val _ = @{print} f\n \n fun is_M_type (Type (@{type_name M},_)) = true | is_M_type _ = false\n \n val args_is_M = fastype_of f |> binder_types |> map is_M_type\n \n val args = map2 (fn isM => isM?normalize) args_is_M args\n \n in\n list_comb (f, args)\n end \n \n and normalize @{mpat \"bind ?m ?f\"} = let\n val m = normalize_bind1 m\n val f = ensure_abs f |> normalize\n in @{mk_term \"bind ?m ?f\"} end\n | normalize (Abs (x,T,t)) = Abs (x,T,normalize t)\n | normalize (t as @{mpat \"return _\"}) = t\n | normalize t = let val t = normalize_bind1 t in @{mk_term \"bind ?t (\\x. return x)\"} end\n \n fun normalize_eq @{mpat \"?a = ?b\"} = let val b = normalize b in @{mk_term \"?a = ?b\"} end\n | normalize_eq t = raise TERM (\"normalize_eq\", [t])\n \n fun norm_tac ctxt = ALLGOALS (simp_tac (put_simpset HOL_ss ctxt addsimps @{thms bind_laws}))\n \n in\n thm \n |> (simplify (put_simpset HOL_ss ctxt addsimps @{thms bind_laws atomize_eq}))\n |> (Conv.fconv_rule (HOLogic.Trueprop_conv (Refine_Util.f_tac_conv ctxt normalize_eq (norm_tac ctxt))))\n end\n \n datatype bcontext = BCTXT of LLVM_Builder.value Symtab.table * LLVM_Builder.value option list\n \n fun bctxt_add_bound v (BCTXT (args,bnds)) = BCTXT (args,v::bnds)\n \n fun bctxt_lookup_bound (BCTXT (_,bnds)) i = nth bnds i |> the\n fun bctxt_lookup_free (BCTXT (args,_)) n = Symtab.lookup args n |> the\n fun val_of_op bc (Bound i) = bctxt_lookup_bound bc i\n | val_of_op bc (Free (n,_)) = bctxt_lookup_free bc n\n | val_of_op _ t = raise TERM (\"val_of_op\", [t])\n \n fun compile_do_block b bc t = let\n fun bld_arith_instr bc iname dst op1 op2 = SOME (LLVM_Builder.mk_arith_instr iname b dst (val_of_op bc op1) (val_of_op bc op2))\n \n \n fun bld_cmd bc dst @{mpat \"ll_add ?op1.0 ?op2.0\"} = bld_arith_instr bc \"add\" dst op1 op2\n \n fun bld bc @{mpat \"bind ?m (\\x. ?f)\"} = let\n val _ = x_T\n val resv = bld_cmd bc x m\n val bc = bctxt_add_bound resv bc\n in\n bld bc f\n end\n | bld bc @{mpat \"return ?x\"} = val_of_op bc x\n | bld _ t = raise TERM (\"bld: bind-chain structural error\",[t])\n \n in\n bld bc t\n end\n \n fun compile_eq\n \n xxx, skipped from here to do SHALLOW embedding of types!\n \n end\n \\\n \n \n \n ML_val \\\n let \n \n fun ensure_abs (t as Abs _) = t\n | ensure_abs t = @{mk_term \"\\x. ?t x\"}\n \n fun normalize_bind1 t = let\n val (f,args) = strip_comb t\n val _ = is_Const f orelse is_Free f orelse raise TERM (\"Invalid head\",[f])\n\n val _ = @{print} f\n \n fun is_M_type (Type (@{type_name M},_)) = true | is_M_type _ = false\n \n val args_is_M = fastype_of f |> binder_types |> map is_M_type\n \n val args = map2 (fn isM => isM?normalize) args_is_M args\n \n in\n list_comb (f, args)\n end \n \n and normalize @{mpat \"bind ?m ?f\"} = let\n val m = normalize_bind1 m\n val f = ensure_abs f |> normalize\n in @{mk_term \"bind ?m ?f\"} end\n | normalize (Abs (x,T,t)) = Abs (x,T,normalize t)\n | normalize (t as @{mpat \"return _\"}) = t\n | normalize t = let val t = normalize_bind1 t in @{mk_term \"bind ?t (\\x. return x)\"} end\n \n fun normalize_eq @{mpat \"?a = ?b\"} = let val b = normalize b in @{mk_term \"?a = ?b\"} end\n | normalize_eq t = raise TERM (\"normalize_eq\", [t])\n \n fun norm_tac ctxt = ALLGOALS (simp_tac (put_simpset HOL_ss ctxt addsimps @{thms bind_laws}))\n \n val ctxt = @{context} \n in\n @{thms exp.code}\n |> map (simplify (put_simpset HOL_ss ctxt addsimps @{thms bind_laws atomize_eq}))\n |> map (Conv.fconv_rule (HOLogic.Trueprop_conv (Refine_Util.f_tac_conv ctxt normalize_eq (norm_tac ctxt))))\n \n end\n \n \\\n \n find_theorems \"(_\\_)\" \"(_=_)\"\n \n \n value \"exec (exp (llop_iconst 64 5))\"\n \n \n ML_val implode\n \n oops\n xxx, ctd here: \n Produce llvm code from code equations. Generate one procedure per equation. \n Use LLVM-generator interface in ML\n \n export_code\n \n ML_val \\\n val (s,context) = Name.variant \"tmp\" Name.context\n val (t,context) = Name.variant \"tmp\" context\n \n \n \n \\\n \n ML_val \\open Int\\\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/others/deep/LLVM_Memory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3242353924510608, "lm_q1q2_score": 0.1646505791058727}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory ExampleSystem\nimports Access\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n nat_to_bl :: \"nat \\ nat \\ bool list option\"\nwhere\n \"nat_to_bl bits n \\\n if n \\ 2^bits then\n None\n else\n Some $ bin_to_bl bits (of_nat n)\"\n\nlemma nat_to_bl_id [simp]: \"nat_to_bl (size (x :: (('a::len) word))) (unat x) = Some (to_bl x)\"\n apply (clarsimp simp: nat_to_bl_def to_bl_def)\n apply (auto simp: uint_nat le_def word_size)\n done\n\n\n(*---------------------------------------------------------*)\n\nsubsection {* Purpose *}\n\ntext {* \n\nThis file defines some example systems using the access control\ndefinitions. The aim is a sanity check of the AC definitions, to\nensure they enable to reason about reasonable systems. \n\nIn particular, we want to make sure that \n\n . the function state_objs_to_policy does not connect everything to\n everything (Example 1)\n . we can talk about components sharing cnodes\n . we can talk about components sharing frames\n . we can have more than 1 untrusted component\n . we can have an EP between two untrusted components\n\n*}\n\n(*---------------------------------------------------------*)\n\nsubsection {* Generic functions / lemmas *}\n\n\ntext {* Defining the authority between labels. \n\nIn addition to the intuitive authority we want, we need to add all the\nauthority required to have a wellformed graph. So we define\ncomplete_AgentAuthGraph to add these 'extra' authorities (at least all\nthe ones not depending on the current label). These are:\n\n . self-authority (each label needs all the authorities to itself).\n . if Control edge is present between 2 labels then we add all\n authorities between them.\n . Control authority is transitive: we add an Control edge\n between 2 labels if we can connect them via Control\n edges. Actually we add all authorities because of the second\n clause.\n \n*}\n\n\ndefinition \n complete_AuthGraph :: \"'a auth_graph \\ 'a set \\ 'a auth_graph\" \nwhere \n \"complete_AuthGraph g ls \\ \n g \\ {(l,a,l) | a l. l \\ ls}\" \n\ntext {* converting a nat to a bool list of size 10 - for the cnodes *}\n\ndefinition\n the_nat_to_bl :: \"nat \\ nat \\ bool list\" \nwhere\n \"the_nat_to_bl sz n \\ the (nat_to_bl sz n)\"\n\ndefinition\n the_nat_to_bl_10 :: \"nat \\ bool list\"\nwhere\n \"the_nat_to_bl_10 n \\ the_nat_to_bl 10 n\"\n\nlemma tcb_cnode_index_nat_to_bl:\n \"n<10 \\ the_nat_to_bl_10 n \\ tcb_cnode_index n\"\n by (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def\n tcb_cnode_index_def\n nat_to_bl_def to_bl_def bin_to_bl_aux_def)\n\n\n(*---------------------------------------------------------*)\nsubsection {* Example 1 *}\n\ntext {*\n\nThis example aims at checking that we can extract a reasonable policy\nfrom the state, i.e. that the function state_objs_to_policy does not connect\neverything to everything.\n\nThis example is a system Sys1 made of 2 main components UT1 and T1,\nconnected through and endpoint EP1. EP1 is made of one single kernel\nobject: obj1_9, the endpoint. Both UT1 and T1 contains:\n\n . one TCB (obj1_3079 and obj1_3080 resp.)\n . one vspace made up of one page directory (obj1_6063 and obj1_3065 resp.)\n . each pd contains a single page table (obj1_3072 and obj1_3077 resp.)\n . one cspace made up of one cnode (obj1_6 and obj1_7 resp.) \n . each cspace contains 4 caps:\n one to the tcb\n one to the cnode itself\n one to the vspace\n one to the ep \n\nUT1 can send to the ep while T1 can receive from it.\n\nAttempt to ASCII art:\n\n\n -------- ---- ---- --------\n | | | | | | | |\n V | | V S R | V | V\nobj1_3079(tcb)-->obj1_6(cnode)--->obj1_9(ep)<---obj1_7(cnode)<--obj1_3080(tcb)\n | | | |\n V | | V\nobj1_3063(pd)<----- -------> obj1_3065(pd)\n | |\n V V\nobj1_3072(pt) obj1_3077(pt)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove \n\n pas_refined Sys1PAS s1\n\nwhere Sys1PAS is the label graph defining the AC policy for Sys1 and\ns1 is the state of Sys1 described above.\n\nThis shows that the aag extracted from s1 (by state_objs_to_policy) is\nincluded in the policy graph Sys1PAS.\n\n*}\n\n\nsubsubsection {* Defining the State *}\n\ntext {* We need to define the asids of each pd and pt to ensure that\nthe object is included in the right ASID-label *}\n\ntext {* UT1's ASID *}\n\ndefinition \n asid1_3063 :: machine_word \nwhere\n \"asid1_3063 \\ 1< 2< asid_high_bits_of asid1_3063\"\nby (simp add: asid1_3063_def asid_high_bits_of_def asid1_3065_def asid_low_bits_def)\n\n\ntext {* UT1's CSpace *}\n\ndefinition \n caps1_6 :: cnode_contents \nwhere\n \"caps1_6 \\ \n (empty_cnode 10)\n ( (the_nat_to_bl_10 1) \n \\ ThreadCap 3079, \n (the_nat_to_bl_10 2)\n \\ CNodeCap 6 undefined undefined, \n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageDirectoryCap 3063 \n (Some asid1_3063)),\n (the_nat_to_bl_10 318) \n \\ EndpointCap 9 0 {AllowSend} )\"\n\n\ndefinition\n obj1_6 :: kernel_object \nwhere\n \"obj1_6 \\ CNode 10 caps1_6\"\n\ntext {* T1's Cspace *}\n\ndefinition\n caps1_7 :: cnode_contents \nwhere\n \"caps1_7 \\ \n (empty_cnode 10)\n ( (the_nat_to_bl_10 1) \n \\ ThreadCap 3080, \n (the_nat_to_bl_10 2)\n \\ CNodeCap 7 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageDirectoryCap 3065 \n (Some asid1_3065)),\n (the_nat_to_bl_10 318)\n \\ EndpointCap 9 0 {AllowRecv}) \"\n\ndefinition \n obj1_7 :: kernel_object\nwhere\n \"obj1_7 \\ CNode 10 caps1_7\"\n\n\ntext {* endpoint between UT1 and T1 *}\n\ndefinition\n obj1_9 :: kernel_object \nwhere\n \"obj1_9 \\ Endpoint IdleEP\"\n\n\ntext {* UT1's VSpace (PageDirectory)*}\n\ndefinition\n pt1_3072 :: \"word8 \\ pte \" \nwhere\n \"pt1_3072 \\ (\\_. InvalidPTE)\" \n\ndefinition \n obj1_3072 :: kernel_object \nwhere\n \"obj1_3072 \\ ArchObj (PageTable pt1_3072)\"\n\n\ndefinition\n pd1_3063 :: \"12 word \\ pde \" \nwhere\n \"pd1_3063 \\ \n (\\_. InvalidPDE)\n (0 := PageTablePDE \n (addrFromPPtr 3072) \n undefined\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj1_3063 :: kernel_object \nwhere\n \"obj1_3063 \\ ArchObj (PageDirectory pd1_3063)\"\n\n\ntext {* T1's VSpace (PageDirectory)*}\n\n\ndefinition\n pt1_3077 :: \"word8 \\ pte \" \nwhere\n \"pt1_3077 \\ \n (\\_. InvalidPTE)\"\n\n\ndefinition\n obj1_3077 :: kernel_object \nwhere\n \"obj1_3077 \\ ArchObj (PageTable pt1_3077)\"\n\n\ndefinition\n pd1_3065 :: \"12 word \\ pde \" \nwhere\n \"pd1_3065 \\\n (\\_. InvalidPDE)\n (0 := PageTablePDE \n (addrFromPPtr 3077) \n undefined\n undefined )\" \n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj1_3065 :: kernel_object \nwhere\n \"obj1_3065 \\ ArchObj (PageDirectory pd1_3065)\"\n\n\ntext {* UT1's tcb *}\n\ndefinition\n obj1_3079 :: kernel_object \nwhere\n \"obj1_3079 \\ \n TCB \\ \n tcb_ctable = CNodeCap 6 undefined undefined,\n tcb_vtable = ArchObjectCap (PageDirectoryCap 3063 (Some asid1_3063)),\n tcb_reply = ReplyCap 3079 True, (* master reply cap to itself *)\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = Running, \n tcb_fault_handler = undefined, \n tcb_ipc_buffer = undefined,\n tcb_fault = undefined, \n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\ \\\"\n\n\ntext {* T1's tcb *}\n\ndefinition\n obj1_3080 :: kernel_object \nwhere\n \"obj1_3080 \\ \n TCB \\ \n tcb_ctable = CNodeCap 7 undefined undefined,\n tcb_vtable = ArchObjectCap (PageDirectoryCap 3065 (Some asid1_3065)),\n tcb_reply = ReplyCap 3080 True, (* master reply cap to itself *)\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = BlockedOnReceive 9,\n tcb_fault_handler = undefined, \n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\ndefinition\n \"obj1_10 \\ CNode 10 (Map.empty([] \\ cap.NullCap))\"\n\n\n(* the boolean in BlockedOnReceive is True if the object can receive but not send.\nbut Tom says it only matters if the sender can grant - which is not the case of the UT1 - I think *)\n\ndefinition\n kh1 :: kheap \nwhere \n \"kh1 \\ [ 6 \\ obj1_6,\n 7 \\ obj1_7,\n 9 \\ obj1_9,\n 10 \\ obj1_10,\n 3063 \\ obj1_3063,\n 3065 \\ obj1_3065,\n 3072 \\ obj1_3072,\n 3077 \\ obj1_3077,\n 3079 \\ obj1_3079,\n 3080 \\ obj1_3080 ]\"\n\nlemmas kh1_obj_def = \n obj1_6_def obj1_7_def obj1_9_def obj1_10_def obj1_3063_def obj1_3065_def \n obj1_3072_def obj1_3077_def obj1_3079_def obj1_3080_def \n\ndefinition exst1 :: \"det_ext\" where\n \"exst1 \\ \\work_units_completed_internal = undefined,\n scheduler_action_internal = undefined,\n ekheap_internal = \\x. None,\n domain_list_internal = undefined,\n domain_index_internal = undefined,\n cur_domain_internal = undefined,\n domain_time_internal = undefined,\n ready_queues_internal = undefined,\n cdt_list_internal = undefined\\\"\n\ndefinition\n s1 :: \"det_ext state\"\nwhere\n \"s1 \\ \\\n kheap = kh1,\n cdt = empty, \n is_original_cap = undefined,\n cur_thread = undefined,\n idle_thread = undefined,\n machine_state = undefined,\n interrupt_irq_node = (\\_. 10),\n interrupt_states = undefined,\n arch_state = \\ \n arm_asid_table = (\\ x. None),\n arm_hwasid_table = undefined,\n arm_next_asid = undefined,\n arm_asid_map = undefined,\n arm_global_pd = undefined,\n arm_global_pts = undefined,\n arm_kernel_vspace = undefined\n \\,\n exst = exst1\n \\\"\n\n\nsubsubsection {* Defining the policy graph *}\n\n\ndatatype Sys1Labels = \n UT1 | T1 | EP1 | IRQ1\n\ndefinition\n Sys1AgentMap :: \"Sys1Labels agent_map\" \nwhere \n \"Sys1AgentMap \\ \n (\\_. undefined) \n (6 := UT1,\n 7 := T1,\n 9 := EP1,\n 10 := IRQ1,\n 3063 := UT1,\n 3065 := T1,\n 3072 := UT1, \n 3077 := T1,\n 3079 := UT1,\n 3080 := T1 )\"\n\nlemma Sys1AgentMap_simps:\n \"Sys1AgentMap 6 = UT1\"\n \"Sys1AgentMap 7 = T1\"\n \"Sys1AgentMap 9 = EP1\"\n \"Sys1AgentMap 10 = IRQ1\"\n \"Sys1AgentMap 3063 = UT1\"\n \"Sys1AgentMap 3065 = T1\"\n \"Sys1AgentMap 3072 = UT1\" \n \"Sys1AgentMap 3077 = T1\"\n \"Sys1AgentMap 3079 = UT1\"\n \"Sys1AgentMap 3080 = T1\"\n unfolding Sys1AgentMap_def by simp_all\n\ndefinition\n Sys1AuthGraph_aux :: \"Sys1Labels auth_graph\" \nwhere\n \"Sys1AuthGraph_aux \\\n { (UT1, auth.SyncSend, EP1), \n (UT1, auth.Reset, EP1),\n (T1, auth.Receive, EP1), \n (T1, auth.Reset, EP1) }\"\n\ndefinition\n Sys1AuthGraph:: \"Sys1Labels auth_graph\" \nwhere\n \"Sys1AuthGraph \\ complete_AuthGraph Sys1AuthGraph_aux {T1, UT1}\"\n\n\ndefinition\n Sys1ASIDMap :: \"Sys1Labels agent_asid_map\" \nwhere \n \"Sys1ASIDMap \\ \n (\\x. if (asid_high_bits_of x = asid_high_bits_of asid1_3063) \n then UT1 \n else if (asid_high_bits_of x = asid_high_bits_of asid1_3065) \n then T1 else undefined)\"\n\ndefinition Sys1PAS :: \"Sys1Labels PAS\" where\n \"Sys1PAS \\ \\ pasObjectAbs = Sys1AgentMap, pasASIDAbs = Sys1ASIDMap, pasIRQAbs = (\\_. IRQ1),\n pasPolicy = Sys1AuthGraph, pasSubject = UT1, pasMayActivate = True, pasMayEditReadyQueues = True, pasMaySendIrqs = True, pasDomainAbs = undefined \\\"\n\nsubsubsection {* Proof of pas_refined for Sys1 *}\n\nlemma caps1_7_well_formed: \"well_formed_cnode_n 10 caps1_7\"\n apply (clarsimp simp: caps1_7_def well_formed_cnode_n_def) \n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1] \n apply clarsimp\ndone\n\nlemma caps1_6_well_formed: \"well_formed_cnode_n 10 caps1_6\"\n apply (clarsimp simp: caps1_6_def well_formed_cnode_n_def) \n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1] \n apply clarsimp\ndone\n\n(* clagged from KernelInit_R *)\nlemma empty_cnode_apply[simp]:\n \"(empty_cnode n xs = Some cap) = (length xs = n \\ cap = NullCap)\"\n by (auto simp add: empty_cnode_def)\n\n\nlemma s1_caps_of_state : \n \"caps_of_state s1 p = Some cap \\\n cap = NullCap \\\n (p,cap) \\ \n { ((6::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 3079),\n ((6::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 6 undefined undefined),\n ((6::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageDirectoryCap 3063 (Some asid1_3063))), \n ((6::obj_ref,(the_nat_to_bl_10 318)),EndpointCap 9 0 {AllowSend}),\n ((7::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 3080), \n ((7::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 7 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageDirectoryCap 3065 (Some asid1_3065))), \n ((7::obj_ref,(the_nat_to_bl_10 318)),EndpointCap 9 0 {AllowRecv}) ,\n ((3079::obj_ref, (tcb_cnode_index 0)), CNodeCap 6 undefined undefined ),\n ((3079::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap 3063 (Some asid1_3063))),\n ((3079::obj_ref, (tcb_cnode_index 2)), ReplyCap 3079 True), \n ((3079::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((3079::obj_ref, (tcb_cnode_index 4)), NullCap),\n ((3080::obj_ref, (tcb_cnode_index 0)), CNodeCap 7 undefined undefined ),\n ((3080::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap 3065 (Some asid1_3065))),\n ((3080::obj_ref, (tcb_cnode_index 2)), ReplyCap 3080 True),\n ((3080::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((3080::obj_ref, (tcb_cnode_index 4)), NullCap)} \"\n apply (insert caps1_7_well_formed)\n apply (insert caps1_6_well_formed) \n apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s1_def kh1_def kh1_obj_def)\n apply (case_tac p, clarsimp)\n apply (clarsimp split: if_splits)\n apply (clarsimp simp: cte_wp_at_cases tcb_cap_cases_def \n split: if_split_asm)+\n apply (clarsimp simp: caps1_7_def split: if_splits)\n apply (clarsimp simp: caps1_6_def cte_wp_at_cases split: if_splits)\ndone\n\n \nlemma Sys1_wellformed: \"pas_wellformed Sys1PAS\"\n apply (clarsimp simp: Sys1PAS_def\n policy_wellformed_def \n Sys1AuthGraph_def\n Sys1AuthGraph_aux_def \n complete_AuthGraph_def)\n apply blast\n done\n\nlemma tcb_states_of_state_1:\n \"tcb_states_of_state s1 = [0xC08 \\ thread_state.BlockedOnReceive 9, 0xC07 \\ thread_state.Running ]\"\n unfolding s1_def tcb_states_of_state_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh1_def kh1_obj_def )\n done\n\nlemma thread_bound_ntfns_1:\n \"thread_bound_ntfns s1 = empty\"\n unfolding s1_def thread_bound_ntfns_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh1_def kh1_obj_def )\n done\n\ndeclare AllowSend_def[simp] AllowRecv_def[simp]\n \nlemma domains_of_state_s1[simp]:\n \"domains_of_state s1 = {}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply clarsimp\n apply(erule domains_of_state_aux.induct)\n apply(simp add: s1_def exst1_def)\n apply simp\n done\n\nlemma \"pas_refined Sys1PAS s1\"\n apply (clarsimp simp: pas_refined_def)\n apply (intro conjI)\n apply (simp add: Sys1_wellformed)\n apply (simp add: irq_map_wellformed_aux_def s1_def Sys1AgentMap_simps Sys1PAS_def)\n apply (clarsimp simp: auth_graph_map_def \n Sys1PAS_def\n state_objs_to_policy_def\n state_bits_to_policy_def tcb_domain_map_wellformed_aux_def\n )+\n apply (erule state_bits_to_policyp.cases, simp_all, clarsimp)\n apply (drule s1_caps_of_state, clarsimp)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def)\n apply (elim disjE conjE, auto simp: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def)[1]\n apply (drule s1_caps_of_state, clarsimp)\n apply (elim disjE, simp_all add: thread_bound_ntfns_def)[1]\n apply (clarsimp simp: state_refs_of_def thread_states_def tcb_states_of_state_1\n Sys1AuthGraph_def Sys1AgentMap_simps\n complete_AuthGraph_def\n Sys1AuthGraph_aux_def\n split: if_splits)\n apply (simp add: thread_bound_ntfns_1)\n apply (simp add: s1_def) (* this is OK because cdt is empty..*)\n\n apply (clarsimp simp: state_vrefs_def \n vs_refs_no_global_pts_def\n s1_def kh1_def Sys1AgentMap_simps\n kh1_obj_def comp_def pt1_3072_def pt1_3077_def pte_ref_def pde_ref2_def pd1_3065_def pd1_3063_def\n Sys1AuthGraph_def ptr_range_def\n complete_AuthGraph_def\n Sys1AuthGraph_aux_def\n dest!: graph_ofD\n split: if_splits)\n\n apply (rule subsetI, clarsimp)\n apply (erule state_asids_to_policy_aux.cases)\n apply clarsimp\n apply (drule s1_caps_of_state, clarsimp)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def Sys1PAS_def Sys1ASIDMap_def)\n apply (elim disjE conjE, simp_all add: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def asid1_3065_def asid1_3063_def \n asid_low_bits_def asid_high_bits_of_def )[1]\n apply (clarsimp simp: state_vrefs_def \n vs_refs_no_global_pts_def\n s1_def kh1_def Sys1AgentMap_simps\n kh1_obj_def comp_def pt1_3072_def pt1_3077_def pte_ref_def pde_ref2_def pd1_3065_def pd1_3063_def\n Sys1AuthGraph_def ptr_range_def\n complete_AuthGraph_def\n Sys1AuthGraph_aux_def\n dest!: graph_ofD\n split: if_splits)\n apply (clarsimp simp: s1_def)\n apply (rule subsetI, clarsimp)\n apply (erule state_irqs_to_policy_aux.cases)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def Sys1PAS_def Sys1ASIDMap_def)\n apply (drule s1_caps_of_state)\n apply (simp add: Sys1AuthGraph_def complete_AuthGraph_def Sys1AuthGraph_aux_def Sys1PAS_def Sys1ASIDMap_def)\n apply (elim disjE conjE, simp_all add: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def asid1_3065_def asid1_3063_def \n asid_low_bits_def asid_high_bits_of_def )[1]\n done\n\n\n(*---------------------------------------------------------*)\nsubsection {* Example 2 *}\n\ntext {*\n\nThis example systems Sys2 aims at checking that we can have 2\ncomponents, one untrusted UT2 and one truted T1, sharing a cnode obj2_5.\n\nBoth UT2 and T2 contains:\n\n . one TCB (obj2_3079 and obj2_3080 resp.)\n . one vspace made up of one page directory (obj2_6063 and obj2_3065 resp.)\n . each pd contains a single page table (obj2_3072 and obj2_3077 resp.)\n . one cspace made up of one cnode (obj2_6 and obj2_7 resp.) \n . each cspace contains 4 caps:\n one to the tcb\n one to the cnode itself\n one to the vspace\n one to obj2_5\n\n\nAttempt to ASCII art:\n\n\n -------- ---- ---- --------\n | | | | | | | |\n V | | V S R | V | V\nobj2_3079(tcb)-->obj2_6(cnode)--->obj2_5(cnode)<---obj2_7(cnode)<--obj2_3080(tcb)\n | | | |\n V | | V\nobj2_3063(pd)<----- -------> obj2_3065(pd)\n | |\n V V\nobj2_3072(pt) obj2_3077(pt)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove \n\n pas_refined Sys2PAS s2\n\nwhere Sys2PAS is the label graph defining the AC policy for Sys2 and\ns2 is the state of Sys2 described above.\n\nThis shows that the aag extracted from s2 (by state_objs_to_policy) is\nincluded in the policy graph Sys2PAS.\n\n*}\n\n\nsubsubsection {* Defining the State *}\n\n\n\ntext {* We need to define the asids of each pd and pt to ensure that\nthe object is included in the right ASID-label *}\n\ntext {* UT2's ASID *}\n\ndefinition \n asid2_3063 :: machine_word \nwhere\n \"asid2_3063 \\ 1< 2< asid_high_bits_of asid2_3063\"\nby (simp add: asid2_3063_def asid_high_bits_of_def asid2_3065_def asid_low_bits_def)\n\n\n\ntext {* the intermediaite CSpace *}\n\ndefinition \n caps2_5 :: cnode_contents \nwhere\n \"caps2_5 \\ \n (empty_cnode 10)\"\n\ndefinition\n obj2_5 :: kernel_object \nwhere\n \"obj2_5 \\ CNode 10 caps2_5\"\n\n\n\ntext {* UT2's CSpace *}\n\ndefinition \n caps2_6 :: cnode_contents \nwhere\n \"caps2_6 \\ \n (empty_cnode 10)\n ( (the_nat_to_bl_10 1) \n \\ ThreadCap 3079, \n (the_nat_to_bl_10 2)\n \\ CNodeCap 6 undefined undefined, \n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageDirectoryCap 3063 \n (Some asid2_3063)),\n (the_nat_to_bl_10 4)\n \\ CNodeCap 5 undefined undefined )\"\n\n\ndefinition\n obj2_6 :: kernel_object \nwhere\n \"obj2_6 \\ CNode 10 caps2_6\"\n\ntext {* T2's Cspace *}\n\ndefinition\n caps2_7 :: cnode_contents \nwhere\n \"caps2_7 \\ \n (empty_cnode 10)\n ( (the_nat_to_bl_10 1) \n \\ ThreadCap 3080, \n (the_nat_to_bl_10 2)\n \\ CNodeCap 7 undefined undefined,\n (the_nat_to_bl_10 3)\n \\ ArchObjectCap (PageDirectoryCap 3065 \n (Some asid2_3065)),\n (the_nat_to_bl_10 4)\n \\ CNodeCap 5 undefined undefined) \"\n\ndefinition \n obj2_7 :: kernel_object\nwhere\n \"obj2_7 \\ CNode 10 caps2_7\"\n\n\ntext {* endpoint between UT2 and T2 *}\n\ndefinition\n obj2_9 :: kernel_object \nwhere\n \"obj2_9 \\ Endpoint IdleEP\"\n\n\ntext {* UT2's VSpace (PageDirectory)*}\n\ndefinition\n pt2_3072 :: \"word8 \\ pte \" \nwhere\n \"pt2_3072 \\ (\\_. InvalidPTE)\"\n\ndefinition \n obj2_3072 :: kernel_object \nwhere\n \"obj2_3072 \\ ArchObj (PageTable pt2_3072)\"\n\n\ndefinition\n pd2_3063 :: \"12 word \\ pde \" \nwhere\n \"pd2_3063 \\ \n (\\_. InvalidPDE)\n (0 := PageTablePDE \n (addrFromPPtr 3072) \n undefined\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj2_3063 :: kernel_object \nwhere\n \"obj2_3063 \\ ArchObj (PageDirectory pd2_3063)\"\n\n\ntext {* T1's VSpace (PageDirectory)*}\n\n\ndefinition\n pt2_3077 :: \"word8 \\ pte \" \nwhere\n \"pt2_3077 \\ \n (\\_. InvalidPTE)\"\n\ndefinition\n obj2_3077 :: kernel_object \nwhere\n \"obj2_3077 \\ ArchObj (PageTable pt2_3077)\"\n\n\ndefinition\n pd2_3065 :: \"12 word \\ pde \" \nwhere\n \"pd2_3065 \\\n (\\_. InvalidPDE)\n (0 := PageTablePDE \n (addrFromPPtr 3077) \n undefined\n undefined )\" \n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n obj2_3065 :: kernel_object \nwhere\n \"obj2_3065 \\ ArchObj (PageDirectory pd2_3065)\"\n\n\ntext {* UT1's tcb *}\n\ndefinition\n obj2_3079 :: kernel_object \nwhere\n \"obj2_3079 \\ \n TCB \\ \n tcb_ctable = CNodeCap 6 undefined undefined ,\n tcb_vtable = ArchObjectCap (PageDirectoryCap 3063 (Some asid2_3063)),\n tcb_reply = ReplyCap 3079 True, (* master reply cap to itself *)\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = Running, \n tcb_fault_handler = undefined, \n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\n\ntext {* T1's tcb *}\n\ndefinition\n obj2_3080 :: kernel_object \nwhere\n \"obj2_3080 \\ \n TCB \\ \n tcb_ctable = CNodeCap 7 undefined undefined ,\n tcb_vtable = ArchObjectCap (PageDirectoryCap 3065 (Some asid2_3065)),\n tcb_reply = ReplyCap 3080 True, (* master reply cap to itself *)\n tcb_caller = NullCap,\n tcb_ipcframe = NullCap,\n tcb_state = BlockedOnReceive 9,\n tcb_fault_handler = undefined, \n tcb_ipc_buffer = undefined,\n tcb_fault = undefined,\n tcb_bound_notification = None,\n tcb_mcpriority = undefined,\n tcb_arch = \\tcb_context = undefined\\\\\"\n\n(* the boolean in BlockedOnReceive is True if the object can receive but not send.\nbut Tom says it only matters if the sender can grant - which is not the case of the UT1 - I think *)\n\ndefinition\n kh2 :: kheap \nwhere \n \"kh2 \\ [ 6 \\ obj2_6,\n 7 \\ obj2_7,\n 9 \\ obj2_9,\n 3063 \\ obj2_3063,\n 3065 \\ obj2_3065,\n 3072 \\ obj2_3072,\n 3077 \\ obj2_3077,\n 3079 \\ obj2_3079,\n 3080 \\ obj2_3080 ]\"\n\nlemmas kh2_obj_def = \n obj2_6_def obj2_7_def obj2_9_def obj2_3063_def obj2_3065_def \n obj2_3072_def obj2_3077_def obj2_3079_def obj2_3080_def \n\n\ndefinition\n s2 :: \"det_ext state\" \nwhere\n \"s2 \\ \\\n kheap = kh2,\n cdt = empty, \n is_original_cap = undefined,\n cur_thread = undefined,\n idle_thread = undefined,\n machine_state = undefined,\n interrupt_irq_node = (\\_. 9001),\n interrupt_states = undefined,\n arch_state = \\ \n arm_asid_table = (\\ x. None),\n arm_hwasid_table = undefined,\n arm_next_asid = undefined,\n arm_asid_map = undefined,\n arm_global_pd = undefined,\n arm_global_pts = undefined,\n arm_kernel_vspace = undefined\n \\,\n exst = exst1\n \\\"\n\n\nsubsubsection {* Defining the policy graph *}\n\n\ndatatype Sys2Labels = \n UT2 | T2 | IRQ2\n\ndefinition\n Sys2AgentMap :: \"Sys2Labels agent_map\" \nwhere \n \"Sys2AgentMap \\ \n (\\_. undefined) \n (5 := UT2,\n 6 := UT2,\n 7 := T2,\n 9 := T2,\n 3063 := UT2,\n 3065 := T2,\n 3072 := UT2, \n 3077 := T2,\n 3079 := UT2,\n 3080 := T2,\n 9001 := IRQ2 )\"\n\n\ndefinition\n Sys2AuthGraph_aux :: \"Sys2Labels auth_graph\" \nwhere\n \"Sys2AuthGraph_aux \\\n { (T2, Control, UT2) }\"\n\ndefinition\n Sys2AuthGraph:: \"Sys2Labels auth_graph\" \nwhere\n \"Sys2AuthGraph \\ complete_AuthGraph Sys2AuthGraph_aux {T2, UT2}\"\n\n\ndefinition\n Sys2ASIDMap :: \"Sys2Labels agent_asid_map\" \nwhere \n \"Sys2ASIDMap \\ \n (\\_. undefined) \n (asid2_3063 := UT2,\n asid2_3065 := T2 )\"\n\ndefinition Sys2PAS :: \"Sys2Labels PAS\" where\n \"Sys2PAS \\ \\ pasObjectAbs = Sys2AgentMap, pasASIDAbs = Sys2ASIDMap, \n pasIRQAbs = (\\_. IRQ2),\n pasPolicy = Sys2AuthGraph, pasSubject = UT2, pasMayActivate = True, pasMayEditReadyQueues = True, pasMaySendIrqs = True, pasDomainAbs = undefined \\\"\n\n\n\nsubsubsection {* Proof of pas_refined for Sys2 *}\n\nlemma caps2_7_well_formed: \"well_formed_cnode_n 10 caps2_7\"\n apply (clarsimp simp: caps2_7_def well_formed_cnode_n_def) \n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1] \n apply clarsimp\ndone\n\nlemma caps2_6_well_formed: \"well_formed_cnode_n 10 caps2_6\"\n apply (clarsimp simp: caps2_6_def well_formed_cnode_n_def) \n apply (clarsimp simp: the_nat_to_bl_10_def the_nat_to_bl_def nat_to_bl_def)\n apply (clarsimp simp: empty_cnode_def dom_def)\n apply (rule set_eqI, clarsimp)\n apply (rule iffI)\n apply (elim disjE, insert len_bin_to_bl, simp_all)[1] \n apply clarsimp\ndone\n\n\n\n\n\n\n\nlemma s2_caps_of_state : \n \"caps_of_state s2 p = Some cap \\\n cap = NullCap \\\n (p,cap) \\ \n { ((6::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 3079),\n ((6::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 6 undefined undefined),\n ((6::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageDirectoryCap 3063 (Some asid2_3063))), \n ((6::obj_ref,(the_nat_to_bl_10 4)), CNodeCap 5 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 1)), ThreadCap 3080), \n ((7::obj_ref,(the_nat_to_bl_10 2)), CNodeCap 7 undefined undefined),\n ((7::obj_ref,(the_nat_to_bl_10 3)), ArchObjectCap (PageDirectoryCap 3065 (Some asid2_3065))), \n ((7::obj_ref,(the_nat_to_bl_10 4)), CNodeCap 5 undefined undefined),\n ((3079::obj_ref, (tcb_cnode_index 0)), CNodeCap 6 undefined undefined ),\n ((3079::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap 3063 (Some asid2_3063))),\n ((3079::obj_ref, (tcb_cnode_index 2)), ReplyCap 3079 True),\n ((3079::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((3079::obj_ref, (tcb_cnode_index 4)), NullCap),\n ((3080::obj_ref, (tcb_cnode_index 0)), CNodeCap 7 undefined undefined ),\n ((3080::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap 3065 (Some asid2_3065))),\n ((3080::obj_ref, (tcb_cnode_index 2)), ReplyCap 3080 True),\n ((3080::obj_ref, (tcb_cnode_index 3)), NullCap),\n ((3080::obj_ref, (tcb_cnode_index 4)), NullCap)} \"\n apply (insert caps2_7_well_formed)\n apply (insert caps2_6_well_formed)\n apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s2_def kh2_def kh2_obj_def)\n apply (case_tac p, clarsimp)\n apply (clarsimp simp: cte_wp_at_cases split: if_splits)\n apply (clarsimp simp: tcb_cap_cases_def split: if_splits)+\n apply (clarsimp simp: caps2_7_def split: if_splits)\n apply (clarsimp simp: caps2_6_def cte_wp_at_cases split: if_splits)\ndone\n \nlemma Sys2_wellformed: \"pas_wellformed Sys2PAS\"\n apply (clarsimp simp: Sys2PAS_def policy_wellformed_def)\n apply (intro conjI)\n apply (simp_all add: Sys2AuthGraph_def complete_AuthGraph_def\n Sys2AuthGraph_aux_def)\n done\n \nlemma Sys2AgentMap_simps:\n \"Sys2AgentMap 5 = UT2\"\n \"Sys2AgentMap 6 = UT2\"\n \"Sys2AgentMap 7 = T2\"\n \"Sys2AgentMap 9 = T2\"\n \"Sys2AgentMap 3063 = UT2\"\n \"Sys2AgentMap 3065 = T2\"\n \"Sys2AgentMap 3072 = UT2\" \n \"Sys2AgentMap 3077 = T2\"\n \"Sys2AgentMap 3079 = UT2\"\n \"Sys2AgentMap 3080 = T2\"\n \"Sys2AgentMap 9001 = IRQ2\"\n by (simp_all add: Sys2AgentMap_def)\n\nlemma domains_of_state_s2[simp]:\n \"domains_of_state s2 = {}\"\n apply(rule equalityI)\n apply(rule subsetI)\n apply clarsimp\n apply(erule domains_of_state_aux.induct)\n apply(simp add: s2_def exst1_def)\n apply simp\n done\n\nlemma thread_bound_ntfns_2[simp]:\n \"thread_bound_ntfns s2 = empty\"\n unfolding s2_def thread_bound_ntfns_def\n apply (rule ext)\n apply (simp add: get_tcb_def)\n apply (simp add: kh2_def kh2_obj_def)\n done\n\nlemma \"pas_refined Sys2PAS s2\"\n apply (clarsimp simp: pas_refined_def)\n apply (intro conjI)\n apply (simp add: Sys2_wellformed)\n apply (simp add: Sys2PAS_def s2_def Sys2AgentMap_def\n irq_map_wellformed_aux_def)\n apply (clarsimp simp: auth_graph_map_def \n Sys2PAS_def\n state_objs_to_policy_def\n state_bits_to_policy_def tcb_domain_map_wellformed_aux_def)+\n apply (erule state_bits_to_policyp.cases, simp_all)\n apply (drule s2_caps_of_state, clarsimp)\n apply (elim disjE, simp_all add: cap_auth_conferred_def\n Sys2AgentMap_simps\n Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def\n split: if_split_asm)[1]\n apply (drule s2_caps_of_state, clarsimp)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: state_refs_of_def s2_def kh2_def kh2_obj_def \n split: if_splits)\n apply (clarsimp split:if_splits option.splits\n simp: thread_states_def tcb_states_of_state_def\n Sys2AgentMap_simps Sys2AuthGraph_def\n complete_AuthGraph_def Sys2AuthGraph_aux_def\n dest!: get_tcb_SomeD)\n apply (simp add: s2_def) (* this is OK because cdt is empty..*)\n\n apply ((clarsimp simp: state_vrefs_def \n vs_refs_no_global_pts_def\n s2_def kh2_def\n kh2_obj_def\n split: if_splits,\n ((clarsimp split: if_splits \n simp: pd2_3065_def pd2_3063_def graph_of_def pde_ref_def\n Sys2AgentMap_simps Sys2AuthGraph_def\n complete_AuthGraph_def pt2_3077_def pte_ref_def\n pt2_3072_def graph_of_def pde_ref2_def\n Sys2AuthGraph_aux_def ptr_range_def)+))+)[1]\n apply clarsimp\n apply (erule state_asids_to_policy_aux.cases)\n apply clarsimp\n apply (auto simp: Sys2PAS_def Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def Sys2AgentMap_simps\n Sys2ASIDMap_def asid2_3063_def asid2_3065_def\n asid_low_bits_def\n dest!: s2_caps_of_state)[1]\n apply (clarsimp simp: state_vrefs_def \n vs_refs_no_global_pts_def\n s2_def kh2_def\n kh2_obj_def\n split: if_splits)\n apply (clarsimp simp: s2_def)\n apply (clarsimp)\n apply (erule state_irqs_to_policy_aux.cases)\n apply (auto simp: Sys2PAS_def Sys2AuthGraph_def Sys2AuthGraph_aux_def\n complete_AuthGraph_def Sys2AgentMap_simps\n Sys2ASIDMap_def asid2_3063_def asid2_3065_def\n dest!: s2_caps_of_state)[1]\n done\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/access-control/ExampleSystem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.26284184892007467, "lm_q1q2_score": 0.16457163639624778}} {"text": "(* Title: HOL/Auth/n_mesi_lemma_on_inv__2.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_lemma_on_inv__2 imports n_mesi_base\nbegin\nsection{*All lemmas on causal relation between inv__2 and some rule r*}\nlemma n_t1Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_t1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t2Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_t2 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t2 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (andForm (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I)) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const I))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const I)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''state'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t3Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_t3 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t3 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_t4Vsinv__2:\nassumes a1: \"(\\ i. i\\N\\r=n_t4 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_t4 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__2 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_lemma_on_inv__2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.16438044920366546}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__38_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__38_on_rules imports n_germanSymIndex_lemma_on_inv__38\nbegin\nsection{*All lemmas on causal relation between inv__38*}\nlemma lemma_inv__38_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__38 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__38) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__38) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__38_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.31405055141190724, "lm_q1q2_score": 0.16438044920366546}} {"text": " (*-------------------------------------------*\n | CSP-Prover on Isabelle2005 |\n | February 2006 |\n | April 2006 (modified) |\n | April 2007 (modified) |\n | August 2007 (modified) |\n | |\n | Yoshinao Isobe (AIST JAPAN) |\n *-------------------------------------------*)\n\ntheory FNF_F_nf\nimports FNF_F_nf_int FNF_F_sf\nbegin\n\n(* The following simplification rules are deleted in this theory file *)\n(* because they unexpectly rewrite UnionT and InterT. *)\n(* disj_not1: (~ P | Q) = (P --> Q) *)\n\ndeclare disj_not1 [simp del]\n\n(* The following simplification rules are deleted in this theory file *)\n(* P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y)) *)\n\ndeclare split_if [split del]\n\n(*****************************************************************\n\n 1. full normalizing\n 2. \n 3. \n\n *****************************************************************)\n\n(*==================================================================*\n | fsfF --> fnfF |\n *==================================================================*)\n\ninductive_set\n fnfF_fsfF_rel :: \"(nat * ('p,'a) proc * ('p,'a) proc) set\"\n\nwhere\nfnfF_fsfF_rel_zero:\n \"(0, P, NDIV) : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_etc:\n \"P ~: fsfF_proc\n ==> (Suc n, P, P |. Suc n) : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_int:\n \"[| ALL c. if (c: sumset C)\n then (Suc n, SPf c, NPf c) : fnfF_fsfF_rel\n else NPf c = DIV ;\n sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n (Suc n, (!! :C .. SPf), !! c:C ..[Suc n] NPf c)\n : fnfF_fsfF_rel\"\n|\nfnfF_fsfF_rel_step:\n \"[| ALL a. if a:A\n then (n, SPf a, NPf a) : fnfF_fsfF_rel\n else NPf a = DIV ;\n ALL a:A. SPf a : fsfF_proc ;\n Q = SKIP | Q = DIV | Q = STOP |]\n ==> \n (Suc n, (? :A -> SPf) [+] Q,\n ((? :A -> NPf) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV)))\n : fnfF_fsfF_rel\"\n\n(*** function ***)\n\ndefinition\n fnfF_fsfF :: \"nat => ('p,'a) proc => ('p,'a) proc\"\n where\n fnfF_fsfF_def:\n \"fnfF_fsfF n SP == THE NP. (n, SP, NP) : fnfF_fsfF_rel\"\n \ndefinition\n fnfF :: \"nat => ('p,'a) proc => ('p,'a) proc\"\n where\n fnfF_def :\n \"fnfF == (%n P. fnfF_fsfF n (fsfF P))\"\n \ndefinition\n XfnfF :: \"('p,'a) proc => ('p,'a) proc\"\n where\n XfnfF_def :\n \"XfnfF == (%P. !nat n .. (fnfF n P))\"\n\n(****************************************************************\n | uniquness |\n ****************************************************************)\n\nlemma fnfF_fsfF_rel_unique_in_lm:\n \"(n, SP, NP1) : fnfF_fsfF_rel\n ==> (ALL NP2. ((n, SP, NP2) : fnfF_fsfF_rel\n --> NP1 = NP2))\"\napply (rule fnfF_fsfF_rel.induct[of n SP NP1])\napply (simp)\n\n(* zero *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases)\napply (simp_all)\n\n(* etc *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases)\napply (simp_all)\napply (simp add: fsfF_proc_int)\napply (simp add: fsfF_proc_ext)\n\n(* int *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (subgoal_tac \"NPf = NPfa\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset Ca\")\n apply (simp)\n apply (simp)\n\n(* step *)\napply (intro allI impI)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (rule conjI)\n apply (subgoal_tac \"NPf = NPfa\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : Aa\")\n apply (simp)\n apply (simp)\n\n apply (simp split: split_if)\ndone\n\n(*-----------------------*\n | unique |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_unique:\n \"[| (n, SP, NP1) : fnfF_fsfF_rel;\n (n, SP, NP2) : fnfF_fsfF_rel |]\n ==> NP1 = NP2\"\nby (simp add: fnfF_fsfF_rel_unique_in_lm)\n\nlemma fnfF_fsfF_rel_EX1:\n \"(EX NP. (n, SP, NP) : fnfF_fsfF_rel)\n = (EX! NP. (n, SP, NP) : fnfF_fsfF_rel)\"\napply (rule iffI)\n\n apply (erule exE)\n apply (rule_tac a=\"NP\" in ex1I)\n apply (simp)\n apply (simp add: fnfF_fsfF_rel_unique)\n\n apply (elim ex1_implies_exE)\n apply (simp)\ndone\n\n(*------------------------------------------------------------*\n | fnfF_fsfF_rel (iff) |\n *------------------------------------------------------------*)\n\n(* zero *)\n\nlemma fnfF_fsfF_rel_zero_iff:\n \"(0, SP, NP) : fnfF_fsfF_rel = (NP = NDIV)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\napply (simp add: fnfF_fsfF_rel_zero)\ndone\n\n(* etc *)\n\nlemma fnfF_fsfF_rel_etc_iff:\n \"P ~: fsfF_proc\n ==> (Suc n, P, NP) : fnfF_fsfF_rel\n = (NP = P |. Suc n)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n apply (simp add: fsfF_proc_int)\n apply (simp add: fsfF_proc_ext)\napply (simp add: fnfF_fsfF_rel_etc)\ndone\n\n(* int *)\n\nlemma fnfF_fsfF_rel_int_iff:\n \"[| ALL c. if (c: sumset C)\n then (Suc n, SPf c, NPf c) : fnfF_fsfF_rel\n else NPf c = DIV ;\n sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n (Suc n, (!! :C .. SPf), NP) : fnfF_fsfF_rel\n = (NP = !! c:C ..[Suc n] NPf c)\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_int)\n\n apply (subgoal_tac \"NPfa = NPf\", simp)\n apply (simp add: fun_eq_iff)\n apply (rule allI)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : sumset Ca\")\n apply (simp add: fnfF_fsfF_rel_unique)\n\n apply (simp)\napply (simp add: fnfF_fsfF_rel_int)\ndone\n\n(* step *)\n\nlemma fnfF_fsfF_rel_step_iff:\n \"[| ALL a. if a:A\n then (n, SPf a, NPf a) : fnfF_fsfF_rel\n else NPf a = DIV ;\n ALL a:A. SPf a : fsfF_proc ;\n Q = SKIP | Q = DIV | Q = STOP |]\n ==> \n (Suc n, (? :A -> SPf) [+] Q, NP) : fnfF_fsfF_rel\n = (NP = ((? :A -> NPf) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV)))\"\napply (rule)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc_ext)\n\n apply (rule conjI)\n apply (subgoal_tac \"NPfa = NPf\", simp)\n apply (simp add: fun_eq_iff)\n apply (intro allI conjI)\n apply (elim conjE)\n apply (drule_tac x=\"x\" in spec)+\n apply (case_tac \"x : Aa\")\n apply (simp add: fnfF_fsfF_rel_unique)\n apply (simp)\n apply (simp split: split_if)\n\napply (simp add: fnfF_fsfF_rel_step)\ndone\n\n(****************************************************************\n | existency |\n ****************************************************************)\n\n(*** exists ***)\n\nlemma fnfF_fsfF_rel_exists_zero:\n \"(EX NP. (0, SP, NP) : fnfF_fsfF_rel)\"\napply (rule_tac x=\"NDIV\" in exI)\napply (simp add: fnfF_fsfF_rel.intros)\ndone\n\nlemma fnfF_fsfF_rel_exists_notin:\n \"P ~: fsfF_proc\n ==> (EX NP. (n, P, NP) : fnfF_fsfF_rel)\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\napply (rule_tac x=\"P |. n\" in exI)\napply (simp add: fnfF_fsfF_rel.intros)\ndone\n\n(*** in fsfF_proc ***)\n\nlemma fnfF_fsfF_rel_exists_in:\n \"SP : fsfF_proc\n ==> ALL n. (EX NP. (n, SP, NP) : fnfF_fsfF_rel)\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (rule allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\n\napply (erule dist_BALL_conjE)\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"n\" in spec)\napply (elim exE)\napply (rule_tac x=\"!! c:C ..[Suc m] (if (c : sumset C) then f c else DIV)\" in exI)\napply (rule fnfF_fsfF_rel.intros)\napply (simp split: split_if)\napply (simp_all)\n\n(* ext *)\napply (rule allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fnfF_fsfF_rel_exists_zero)\n\napply (elim exE)\napply (erule dist_BALL_conjE)\n\napply (simp add: exchange_ALL_BALL)\napply (simp add: choice_BALL_EX)\napply (drule_tac x=\"m\" in spec)\napply (elim exE)\napply (rule_tac x=\n\"((? a:A -> (if (a : A) then f a else DIV)) [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV))\" in exI)\napply (rule fnfF_fsfF_rel.intros)\napply (simp split: split_if)\napply (simp_all)\ndone\n\n(*-----------------------*\n | exists |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_exists:\n \"EX NP. (n, SP, NP) : fnfF_fsfF_rel\"\napply (case_tac \"SP ~: fsfF_proc\")\napply (simp add: fnfF_fsfF_rel_exists_notin)\napply (simp add: fnfF_fsfF_rel_exists_in)\ndone\n\n(*-----------------------*\n | uniquely exists |\n *-----------------------*)\n\nlemma fnfF_fsfF_rel_unique_exists:\n \"EX! NP. (n, SP, NP) : fnfF_fsfF_rel\"\napply (simp add: fnfF_fsfF_rel_EX1[THEN sym])\napply (simp add: fnfF_fsfF_rel_exists)\ndone\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fnfF_fsfF_rel_zero_in:\n \"(0, SP, NP) : fnfF_fsfF_rel ==> NP : fnfF_proc\"\napply (simp add: fnfF_fsfF_rel_zero_iff)\ndone\n\nlemma fnfF_fsfF_rel_in_lm:\n \"SP : fsfF_proc ==> \n ALL n NP. (n, SP, NP) : fnfF_fsfF_rel --> NP : fnfF_proc\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: fnfF_fsfF_rel_zero_in)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fnfF_Rep_int_choice_in)\napply (rule ballI)\napply (drule_tac x=\"c\" in spec, simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: fnfF_fsfF_rel_zero_in)\n\napply (intro impI)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\n apply (rotate_tac -3)\n apply (drule sym)\n apply (simp add: fsfF_proc.intros)\n\napply (rule fnfF_proc.intros)\n\n apply (simp split: split_if)\n apply (intro allI impI)\n apply (drule_tac x=\"a\" in spec, simp)\n\n apply (simp add: fnfF_set_condition_def)\n apply (intro allI impI)\n apply (simp split: split_if)\n apply (elim conjE bexE) \n apply (case_tac \"Qa = STOP\")\n apply (simp)\n apply (simp)\n\n apply (force)\n apply (force)\ndone\n\n(*------------------------------------*\n | in |\n *------------------------------------*)\n\nlemma fnfF_fsfF_rel_in:\n \"[| SP : fsfF_proc ; (n, SP, NP) : fnfF_fsfF_rel |]\n ==> NP : fnfF_proc\"\napply (insert fnfF_fsfF_rel_in_lm[of SP])\napply (blast)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\n(*** relation ***)\n\nlemma cspF_fnfF_fsfF_rel_eqF_zero:\n \"(0, P, NP) : fnfF_fsfF_rel\n ==> P |. 0 =F NP\"\napply (simp add: fnfF_fsfF_rel_zero_iff)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_Zero)\napply (rule cspF_NDIV_eqF)\ndone\n\nlemma cspF_fnfF_fsfF_rel_eqF_notin:\n \"[| P ~: fsfF_proc ; (n, P, NP) : fnfF_fsfF_rel |]\n ==> P |. n =F NP\"\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\napply (simp add: fnfF_fsfF_rel_etc_iff)\ndone\n\nlemma cspF_fnfF_fsfF_rel_eqF_in:\n \"SP : fsfF_proc ==>\n ALL n NP. (n, SP, NP) : fnfF_fsfF_rel\n --> SP |. n =F NP\"\napply (rule fsfF_proc.induct[of SP])\napply (simp)\n\n(* int *)\napply (intro allI)\napply (insert nat_zero_or_Suc)\napply (drule_tac x=\"n\" in spec)\napply (elim disjE exE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\n\napply (intro impI)\napply (simp)\napply (rotate_tac -1)\napply (erule fnfF_fsfF_rel.cases, simp_all)\napply (elim conjE)\n\napply (rule cspF_rw_right)\napply (rule cspF_fnfF_Rep_int_choice_eqF[THEN cspF_sym])\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_rw_right)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (drule_tac x=\"c\" in bspec, simp)\napply (drule_tac x=\"c\" in spec)\napply (simp)\napply (drule_tac x=\"Suc na\" in spec)\napply (drule_tac x=\"NPf c\" in spec)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_n[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp)\napply (simp)\n\n(* ext *)\napply (intro allI)\napply (drule_tac x=\"n\" in spec)\napply (rotate_tac -1)\napply (erule disjE)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_zero)\n\napply (intro impI)\napply (erule fnfF_fsfF_rel.cases, simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_step)\napply (subgoal_tac \"Qa |. Suc na =F Qa\")\n apply (simp)\n apply (case_tac \"Q = STOP\")\n apply (simp add: cspF_STOP_Depth_rest)\n apply (simp add: cspF_SKIP_or_DIV_Depth_rest)\n\n apply (case_tac \"Qa = STOP\")\n apply (simp)\n\n (* STOP *)\n apply (rule cspF_rw_left)\n apply (rule cspF_unit)\n apply (rule cspF_rw_left)\n apply (rule cspF_input_DIV)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (simp)\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"na\" in spec)\n apply (drule_tac x=\"NPf a\" in spec)\n apply (simp)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_Rep_int_choice_singleton)\n apply (rule cspF_reflex)\n\n (* SKIP | DIV *)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_decompo)\n apply (rule cspF_reflex)\n apply (rule cspF_Rep_int_choice_DIV)\n apply (rule cspF_rw_right)\n apply (rule cspF_unit)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (simp)\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"na\" in spec)\n apply (drule_tac x=\"NPf a\" in spec)\n apply (simp)\n apply (force)\ndone\n\n(*------------------------------------*\n | eqF |\n *------------------------------------*)\n\nlemma cspF_fnfF_fsfF_rel_eqF:\n \"(n, SP, NP) : fnfF_fsfF_rel ==> SP |. n =F NP\"\napply (case_tac \"SP ~: fsfF_proc\")\napply (simp add: cspF_fnfF_fsfF_rel_eqF_notin)\napply (simp add: cspF_fnfF_fsfF_rel_eqF_in)\ndone\n\n(*************************************************************\n relation --> function\n *************************************************************)\n\nlemma fnfF_fsfF_in_rel:\n \"(n, SP, fnfF_fsfF n SP) : fnfF_fsfF_rel\"\napply (simp add: fnfF_fsfF_def)\napply (rule theI'\n [of \"(%NP. (n, SP, NP) : fnfF_fsfF_rel)\"])\napply (simp add: fnfF_fsfF_rel_unique_exists)\ndone\n\nlemma fnfF_fsfF_from_rel:\n \"((n, SP, NP) : fnfF_fsfF_rel)\n = (fnfF_fsfF n SP = NP)\"\napply (rule iffI)\napply (simp add: fnfF_fsfF_def)\napply (simp add: fnfF_fsfF_rel_unique_exists the1_equality)\n\napply (drule sym)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemma fnfF_fsfF_to_rel:\n \"(fnfF_fsfF n SP = NP)\n = ((n, SP, NP) : fnfF_fsfF_rel)\"\nby (simp add: fnfF_fsfF_from_rel)\n\n(*************************************************************\n function\n *************************************************************)\n\nlemma fnfF_fsfF_zero:\n \"fnfF_fsfF 0 SP = NDIV\"\napply (simp add: fnfF_fsfF_to_rel)\napply (simp add: fnfF_fsfF_rel_zero_iff)\ndone\n\nlemma fnfF_fsfF_etc:\n \"P ~: fsfF_proc\n ==> fnfF_fsfF (Suc n) P = P |. (Suc n)\"\napply (simp add: fnfF_fsfF_to_rel)\napply (simp add: fnfF_fsfF_rel_etc_iff)\ndone\n\nlemma fnfF_fsfF_int:\n \"[| sumset C ~= {} ; ALL c: sumset C. SPf c : fsfF_proc |]\n ==>\n fnfF_fsfF (Suc n) (!! :C .. SPf) =\n !! c:C ..[Suc n] (if c: sumset C then (fnfF_fsfF (Suc n) (SPf c)) else DIV)\"\napply (simp add: fnfF_fsfF_to_rel)\napply (rule fnfF_fsfF_rel_int)\napply (simp_all)\napply (simp split: split_if)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemma fnfF_fsfF_step:\n \"[| ALL a:A. SPf a : fsfF_proc ; Q = SKIP | Q = DIV | Q = STOP |]\n ==>\n fnfF_fsfF (Suc n) ((? :A -> SPf) [+] Q) =\n ((? a:A -> (if a:A then (fnfF_fsfF n (SPf a)) else DIV))\n [+] (if (Q = SKIP) then SKIP else DIV))\n |~| (!set Y:(if Q = STOP then {A} else {}) .. (? a:Y -> DIV))\"\napply (simp add: fnfF_fsfF_to_rel)\napply (rule fnfF_fsfF_rel_step)\napply (simp_all)\napply (simp split: split_if)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\nlemmas fnfF_fsfF =\n fnfF_fsfF_etc\n fnfF_fsfF_int\n fnfF_fsfF_step\n\n(*------------------------------------------------------------*\n | in fsfF_proc |\n *------------------------------------------------------------*)\n\nlemma fnfF_fsfF_in:\n \"SP : fsfF_proc\n ==> fnfF_fsfF n SP : fnfF_proc\"\napply (rule fnfF_fsfF_rel_in[of SP n])\napply (simp_all add: fnfF_fsfF_in_rel)\ndone\n\n(*------------------------------------------------------------*\n | syntactical transformation to fsfF |\n *------------------------------------------------------------*)\n\nlemma cspF_fnfF_fsfF_eqF:\n \"SP |. n =F fnfF_fsfF n SP\"\napply (rule cspF_fnfF_fsfF_rel_eqF)\napply (simp add: fnfF_fsfF_in_rel)\ndone\n\n(*===============================================================*\n theorem --- fnfF P is a (restricted) full normal form ---\n *===============================================================*)\n\ntheorem fnfF_in: \"fnfF n P : fnfF_proc\"\napply (simp add: fnfF_def)\napply (simp add: fnfF_fsfF_in fsfF_in)\ndone\n\n(*===============================================================*\n theorem --- fnfF P is equal to P based on F ---\n *===============================================================*)\n\ntheorem cspF_fnfF_eqF: \n \"FPmode = CPOmode | FPmode = MIXmode ==> P |. n =F fnfF n P\"\napply (simp add: fnfF_def)\napply (rule cspF_rw_right)\napply (rule cspF_fnfF_fsfF_eqF[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fsfF_eqF)\napply (simp)\napply (rule cspF_reflex)\ndone\n\n(*------------------------*\n | auxiliary laws |\n *------------------------*)\n\nlemma cspF_fnfF_eqF_Depth_rest:\n \"FPmode = CPOmode | FPmode = MIXmode\n ==> (fnfF n P) |. n =F fnfF n P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_Depth_rest_min)\napply (simp)\napply (rule cspF_fnfF_eqF)\napply (simp)\ndone\n\n(*===============================================================*\n theorem --- XfnfF P is a full normal form ---\n *===============================================================*)\n\ntheorem XfnfF_in: \n \"FPmode = CPOmode | FPmode = MIXmode ==> XfnfF P : XfnfF_proc\"\napply (simp add: XfnfF_def)\napply (simp add: XfnfF_proc_def)\napply (rule_tac x=\"(%n. fnfF n P)\" in exI)\napply (simp)\napply (simp add: fnfF_in)\napply (rule allI)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_nat_Depth_rest)\ndone\n\n(*===============================================================*\n theorem --- XfnfF P is equal to P based on F ---\n *===============================================================*)\n\ntheorem cspF_XfnfF_eqF:\n \"FPmode = CPOmode | FPmode = MIXmode ==> P =F XfnfF P\"\napply (simp add: XfnfF_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_fnfF_eqF[THEN cspF_sym])\napply (simp)\napply (rule cspF_nat_Depth_rest)\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if [split]\ndeclare disj_not1 [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_nf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.320821300824607, "lm_q1q2_score": 0.16416958677474153}} {"text": "theory JVMCFG_wf imports JVMInterpretation \"../Basic/CFGExit_wf\" begin\n\ntext {*\n\\isaheader{Instantiation of the @{text \"CFG_wf\"} locale}\n*}\n\nsubsection {* Variables and Values *}\n\ndatatype jinja_var = HeapVar \"addr\" | Stk \"nat\" \"nat\" | Loc \"nat\" \"nat\"\ndatatype jinja_val = Object \"obj option\" | Primitive \"val\"\n\nfun state_val :: \"state \\ jinja_var \\ jinja_val\"\nwhere\n \"state_val (h, stk, loc) (HeapVar a) = Object (h a)\"\n| \"state_val (h, stk, loc) (Stk cd idx) = Primitive (stk (cd, idx))\"\n| \"state_val (h, stk, loc) (Loc cd idx) = Primitive (loc (cd, idx))\"\n\n\nsubsection {* The @{text Def} and @{text Use} sets *}\n\ninductive_set Def :: \"wf_jvmprog \\ j_node \\ jinja_var set\"\n for P :: \"wf_jvmprog\"\n and n :: \"j_node\"\nwhere\n Def_Load:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Load idx;\n cd = length cs;\n i = stkLength P C M pc\\\n \\ Stk cd i \\ Def P n\"\n\n| Def_Store:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Store idx;\n cd = length cs \\\n \\ Loc cd idx \\ Def P n\"\n\n| Def_Push:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Push v;\n cd = length cs;\n i = stkLength P C M pc \\\n \\ Stk cd i \\ Def P n\"\n\n| Def_New_Normal_Stk:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = New Cl;\n cd = length cs;\n i = stkLength P C M pc \\\n \\ Stk cd i \\ Def P n\"\n\n| Def_New_Normal_Heap:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = New Cl \\\n \\ HeapVar a \\ Def P n\"\n\n| Def_Exc_Stk:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',True)\\ _);\n cs' \\ [];\n cd = length cs' - 1;\n (C',M',pc') = hd cs';\n i = stkLength P C' M' pc' - 1\\\n \\ Stk cd i \\ Def P n\"\n\n| Def_Getfield_Stk:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Getfield Fd Cl;\n cd = length cs;\n i = stkLength P C M pc - 1 \\\n \\ Stk cd i \\ Def P n\"\n\n| Def_Putfield_Heap:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Putfield Fd Cl \\\n \\ HeapVar a \\ Def P n\"\n\n| Def_Invoke_Loc:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Invoke M' n';\n cs' \\ [];\n hd cs' = (C',M',0);\n i < locLength P C' M' 0;\n cd = Suc (length cs) \\\n \\ Loc cd i \\ Def P n\"\n\n| Def_Return_Stk:\n \"\\ n = (_ (C, M, pc)#(D,M',pc')#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Return;\n cd = length cs;\n i = stkLength P D M' (Suc pc') - 1 \\\n \\ Stk cd i \\ Def P n\"\n\n| Def_IAdd_Stk:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = IAdd;\n cd = length cs;\n i = stkLength P C M pc - 2 \\\n \\ Stk cd i \\ Def P n\"\n\n| Def_CmpEq_Stk:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = CmpEq;\n cd = length cs;\n i = stkLength P C M pc - 2 \\\n \\ Stk cd i \\ Def P n\"\n\ninductive_set Use :: \"wf_jvmprog \\ j_node \\ jinja_var set\"\n for P :: \"wf_jvmprog\"\n and n :: \"j_node\"\nwhere\n Use_Load:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Load idx;\n cd = length cs \\\n \\ (Loc cd idx) \\ Use P n\"\n\n| Use_Store:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Store idx;\n cd = length cs;\n Suc i = (stkLength P C M pc) \\\n \\ (Stk cd i) \\ Use P n\"\n\n| Use_New:\n \"\\ n = (_ (C, M, pc)#cs,x _);\n x = None \\ x = \\(cs',False)\\;\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = New Cl \\\n \\ HeapVar a \\ Use P n\"\n\n| Use_Getfield_Stk:\n \"\\ n = (_ (C, M, pc)#cs,x _);\n x = None \\ x = \\(cs',False)\\;\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Getfield Fd Cl;\n cd = length cs;\n Suc i = stkLength P C M pc \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Getfield_Heap:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Getfield Fd Cl \\\n \\ HeapVar a \\ Use P n\"\n\n| Use_Putfield_Stk_Pred:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Putfield Fd Cl;\n cd = length cs;\n i = stkLength P C M pc - 2 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Putfield_Stk_Update:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Putfield Fd Cl;\n cd = length cs;\n i = stkLength P C M pc - 2 \\ i = stkLength P C M pc - 1 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Putfield_Heap:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Putfield Fd Cl \\\n \\ HeapVar a \\ Use P n\"\n\n| Use_Checkcast_Stk:\n \"\\ n = (_ (C, M, pc)#cs,x _);\n x = None \\ x = \\(cs',False)\\;\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Checkcast Cl;\n cd = length cs;\n i = stkLength P C M pc - Suc 0 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Checkcast_Heap:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Checkcast Cl \\\n \\ HeapVar a \\ Use P n\"\n\n| Use_Invoke_Stk_Pred:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Invoke M' n';\n cd = length cs;\n i = stkLength P C M pc - Suc n' \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Invoke_Heap_Pred:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Invoke M' n' \\\n \\ HeapVar a \\ Use P n\"\n\n| Use_Invoke_Stk_Update:\n \"\\ n = (_ (C, M, pc)#cs,\\(cs',False)\\ _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Invoke M' n';\n cd = length cs;\n i < stkLength P C M pc;\n i \\ stkLength P C M pc - Suc n' \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Return_Stk:\n \"\\ n = (_ (C, M, pc)#(D,M',pc')#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Return;\n cd = Suc (length cs);\n i = stkLength P C M pc - 1 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_IAdd_Stk:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = IAdd;\n cd = length cs;\n i = stkLength P C M pc - 1 \\ i = stkLength P C M pc - 2 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_IfFalse_Stk:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = (IfFalse b);\n cd = length cs;\n i = stkLength P C M pc - 1 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_CmpEq_Stk:\n \"\\ n = (_ (C, M, pc)#cs,None _);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = CmpEq;\n cd = length cs;\n i = stkLength P C M pc - 1 \\ i = stkLength P C M pc - 2 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Throw_Stk:\n \"\\ n = (_ (C, M, pc)#cs,x _);\n x = None \\ x = \\(cs',True)\\;\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Throw;\n cd = length cs;\n i = stkLength P C M pc - 1 \\\n \\ Stk cd i \\ Use P n\"\n\n| Use_Throw_Heap:\n \"\\ n = (_ (C, M, pc)#cs,x _);\n x = None \\ x = \\(cs',True)\\;\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc = Throw \\\n \\ HeapVar a \\ Use P n\"\n\ndeclare correct_state_def [simp del]\n\nlemma edge_transfer_uses_only_Use:\n \"\\valid_edge (P,C0,Main) a; \\V \\ Use P (sourcenode a). state_val s V = state_val s' V\\\n \\ \\V \\ Def P (sourcenode a). state_val (BasicDefs.transfer (kind a) s) V =\n state_val (BasicDefs.transfer (kind a) s') V\"\nproof\n fix V\n assume ve: \"valid_edge (P, C0, Main) a\"\n and use_eq: \"\\V\\Use P (sourcenode a). state_val s V = state_val s' V\"\n and v_in_def: \"V \\ Def P (sourcenode a)\"\n obtain h stk loc where [simp]: \"s = (h,stk,loc)\" by (cases s, fastforce)\n obtain h' stk' loc' where [simp]: \"s' = (h',stk',loc')\" by (cases s', fastforce)\n note P_wf = wf_jvmprog_is_wf [of P]\n from ve\n have ex_edge: \"(P,C0,Main) \\ (sourcenode a)-kind a\\(targetnode a)\"\n and vn: \"valid_node (P,C0,Main) (sourcenode a)\"\n by simp_all\n show \"state_val (transfer (kind a) s) V = state_val (transfer (kind a) s') V\"\n proof (cases \"sourcenode a\")\n case (Node cs x) [simp]\n from vn ex_edge have \"cs \\ []\"\n by (cases x, auto elim: JVM_CFG.cases)\n then obtain C M pc cs' where [simp]: \"cs = (C, M, pc)#cs'\" by (cases cs, fastforce+)\n with vn obtain ST LT where wt: \"((P\\<^bsub>\\\\<^esub>) C M ! pc) = \\(ST,LT)\\\"\n by (cases cs', (cases x, auto)+)\n show ?thesis\n proof (cases \"instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc\")\n case (Load n) [simp]\n from ex_edge have [simp]: \"x = None\"\n by (auto elim!: JVM_CFG.cases)\n hence \"Loc (length cs') n \\ Use P (sourcenode a)\"\n by (auto intro!: Use_Load)\n with use_eq have \"state_val s (Loc (length cs') n) = state_val s' (Loc (length cs') n)\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n next\n case (Store n) [simp]\n from ex_edge have [simp]:\"x = None\"\n by (auto elim!: JVM_CFG.cases)\n have \"ST \\ []\"\n proof -\n from vn\n obtain Ts T mxs mxl \"is\" xt\n where C_sees_M: \"P\\<^bsub>wf\\<^esub> \\ C sees M: Ts\\T = (mxs, mxl, is, xt) in C\"\n by (cases cs', auto)\n with vn\n have \"pc < length is\"\n by (cases cs', auto dest: sees_method_fun)\n from P_wf C_sees_M\n have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Store C_sees_M wt `pc < length is`\n show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr where [simp]: \"ST = ST1#STr\"\n by (cases ST, fastforce+)\n from wt\n have \"Stk (length cs') (length ST - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use_src\")\n by -(rule Use_Store, fastforce+)\n with use_eq have \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge wt show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n next\n case (Push val) [simp]\n from ex_edge have \"x = None\"\n by (auto elim!: JVM_CFG.cases)\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n next\n case (New Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with v_in_def have False\n by (auto elim: Def.cases)\n thus ?thesis by simp\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n have \"\\ xf \\ (\\addr. HeapVar addr \\ Use P (sourcenode a))\"\n by (fastforce intro: Use_New)\n with use_eq\n have \"\\ xf \\ (\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr))\"\n by (simp del: state_val.simps)\n hence \"\\ xf \\ h = h'\"\n by (auto intro: ext)\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n qed\n next\n case (Getfield Fd Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with v_in_def have False\n by (auto elim: Def.cases)\n thus ?thesis by simp\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n have \"ST \\ []\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', auto)\n with vn\n have \"pc < length is\"\n by (cases cs', auto dest: sees_method_fun)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Getfield sees_M wt `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr where [simp]: \"ST = ST1#STr\" by (cases ST, fastforce)\n from wt\n have \"\\ xf \\ (Stk (length cs') (length ST - 1) \\ Use P (sourcenode a))\"\n (is \"?xf \\ ?stk_top \\ ?Use_src\")\n by (auto intro!: Use_Getfield_Stk)\n with use_eq \n have stk_top_eq: \"\\ xf \\ state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n have \"\\ xf \\ (\\addr. HeapVar addr \\ Use P (sourcenode a))\"\n by (auto intro!: Use_Getfield_Heap)\n with use_eq\n have \"\\ xf \\ (\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr))\"\n by (simp del: state_val.simps)\n hence \"\\ xf \\ h = h'\"\n by (auto intro: ext)\n with ex_edge v_in_def stk_top_eq wt\n show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n qed\n next\n case (Putfield Fd Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with v_in_def have False\n by (auto elim: Def.cases)\n thus ?thesis by simp\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\" \n by (cases x', fastforce)\n have \"length ST > 1\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', auto)\n with vn\n have \"pc < length is\"\n by (cases cs', auto dest: sees_method_fun)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Putfield sees_M `pc < length is` wt show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr' where \"ST = ST1#STr' \\ length STr' > 0\"\n by (cases ST, fastforce+)\n then obtain ST2 STr where [simp]: \"ST = ST1#ST2#STr\"\n by (cases STr', fastforce+)\n from wt\n have \"\\ xf \\ (Stk (length cs') (length ST - 1) \\ Use P (sourcenode a))\"\n (is \"?xf \\ ?stk_top \\ ?Use_src\")\n by (fastforce intro: Use_Putfield_Stk_Update)\n with use_eq have stk_top:\"(\\ xf) \\ state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n from wt\n have \"\\ xf \\ (Stk (length cs') (length ST - 2) \\ Use P (sourcenode a))\"\n (is \"?xf \\ ?stk_nxt \\ ?Use_src\")\n by (fastforce intro: Use_Putfield_Stk_Update)\n with use_eq\n have stk_nxt:\"(\\ xf) \\ state_val s ?stk_nxt = state_val s' ?stk_nxt\"\n by (simp del: state_val.simps)\n have \"\\ xf \\ (\\addr. HeapVar addr \\ Use P (sourcenode a))\"\n by (fastforce intro: Use_Putfield_Heap)\n with use_eq\n have \"\\ xf \\ (\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr))\"\n by (simp del: state_val.simps)\n hence \"\\ xf \\ h = h'\"\n by (auto intro: ext)\n with ex_edge v_in_def stk_top stk_nxt wt show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n qed\n next\n case (Checkcast Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with v_in_def have False\n by (auto elim: Def.cases)\n thus ?thesis by simp\n next\n case (Some x')\n with ex_edge obtain cs''\n where \"x = \\(cs'',True)\\\"\n by (auto elim!: JVM_CFG.cases)\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n qed\n next\n case (Invoke M' n') [simp]\n show ?thesis\n proof (cases x)\n case None\n with v_in_def have False\n by (auto elim: Def.cases)\n thus ?thesis by simp\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n show ?thesis\n proof (cases xf)\n case True\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n next\n case False [simp]\n have \"length ST > n'\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', auto)\n with vn\n have \"pc < length is\"\n by (cases cs', auto dest: sees_method_fun)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Invoke sees_M `pc < length is` wt show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n moreover obtain STn where \"STn = take n' ST\" by fastforce\n moreover obtain STs where \"STs = ST ! n'\" by fastforce\n moreover obtain STr where \"STr = drop (Suc n') ST\" by fastforce\n ultimately have [simp]:\" ST = STn@STs#STr \\ length STn = n'\"\n by (auto simp: id_take_nth_drop)\n from wt\n have \"\\i. i \\ n' \\ Stk (length cs') (length ST - Suc i) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Invoke_Stk_Update)\n with use_eq\n have\n \"\\i. i \\ n' \\ state_val s (Stk (length cs') (length ST - Suc i)) =\n state_val s' (Stk (length cs') (length ST - Suc i))\"\n by (simp del: state_val.simps)\n hence stk_eq:\n \"\\i. i \\ n' \\ state_val s (Stk (length cs') (i + length STr)) =\n state_val s' (Stk (length cs') (i + length STr))\"\n by (clarsimp, erule_tac x=\"n' - i\" in allE, auto simp: add.commute)\n from ex_edge obtain C'\n where trg: \"targetnode a = (_ (C',M',0)#(C, M, pc)#cs',None _)\"\n by (fastforce elim: JVM_CFG.cases)\n with ex_edge stk_eq v_in_def wt\n show ?thesis\n by (auto elim!: Def.cases) (erule JVM_CFG.cases, auto simp: split_beta add.commute)\n qed\n qed\n next\n case Return [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n show ?thesis\n proof (cases cs')\n case Nil\n with v_in_def show ?thesis\n by (auto elim!: Def.cases)\n next\n case (Cons aa list)\n then obtain C' M' pc' cs'' where [simp]: \"cs' = (C',M',pc')#cs''\"\n by (cases aa, fastforce)\n from wt\n have \"Stk (length cs') (length ST - 1) \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Return_Stk)\n with use_eq\n have \"state_val s (Stk (length cs') (length ST - 1)) =\n state_val s' (Stk (length cs') (length ST - 1))\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge wt show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n qed\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case Pop\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases elim: JVM_CFG.cases)\n next\n case IAdd [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n from wt\n have \"Stk (length cs') (length ST - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (auto intro!: Use_IAdd_Stk)\n with use_eq\n have stk_top:\"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n from wt\n have \"Stk (length cs') (length ST - 2) \\ Use P (sourcenode a)\"\n (is \"?stk_snd \\ ?Use\")\n by (auto intro!: Use_IAdd_Stk)\n with use_eq\n have stk_snd:\"state_val s ?stk_snd = state_val s' ?stk_snd\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge stk_top wt show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases\n simp: split_beta)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (IfFalse b) [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n from wt\n have \"Stk (length cs') (length ST - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (auto intro!: Use_IfFalse_Stk)\n with use_eq\n have stk_top:\"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge wt show ?thesis\n by (auto elim!: Def.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case CmpEq [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n have \"Stk (length cs') (stkLength P C M pc - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (auto intro!: Use_CmpEq_Stk)\n with use_eq\n have stk_top:\"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n have \"Stk (length cs') (stkLength P C M pc - 2) \\ Use P (sourcenode a)\"\n (is \"?stk_snd \\ ?Use\")\n by (auto intro!: Use_CmpEq_Stk)\n with use_eq\n have stk_snd:\"state_val s ?stk_snd = state_val s' ?stk_snd\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge stk_top wt show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (Goto i)\n with ex_edge v_in_def show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n next\n case Throw [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n have \"Stk (length cs') (stkLength P C M pc - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (auto intro!: Use_Throw_Stk)\n with use_eq\n have stk_top:\"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with v_in_def show ?thesis\n by (auto elim!: Def.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n hence \"xf \\ Stk (length cs') (stkLength P C M pc - 1) \\ Use P (sourcenode a)\"\n (is \"xf \\ ?stk_top \\ ?Use\")\n by (fastforce intro: Use_Throw_Stk)\n with use_eq\n have stk_top:\"xf \\ state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with v_in_def ex_edge show ?thesis\n by (auto elim!: Def.cases\n elim: JVM_CFG.cases)\n qed\n qed\n next\n case Entry\n with vn v_in_def show ?thesis\n by -(erule Def.cases, auto)\n qed\nqed\n\nlemma CFG_edge_Uses_pred_equal:\n \"\\ valid_edge (P,C0,Main) a;\n pred (kind a) s; \n \\V \\ Use P (sourcenode a). state_val s V = state_val s' V\\\n \\ pred (kind a) s'\"\nproof -\n assume ve: \"valid_edge (P,C0,Main) a\"\n and pred: \"pred (kind a) s\"\n and use_eq: \"\\V\\Use P (sourcenode a). state_val s V = state_val s' V\"\n obtain h stk loc where [simp]: \"s = (h,stk,loc)\" by (cases s, blast)\n obtain h' stk' loc' where [simp]: \"s' = (h',stk',loc')\" by (cases s', blast)\n from ve\n have vn: \"valid_node (P,C0,Main) (sourcenode a)\"\n and ex_edge: \"(P,C0,Main) \\ (sourcenode a)-kind a\\(targetnode a)\"\n by simp_all\n note P_wf = wf_jvmprog_is_wf [of P]\n show \"pred (kind a) s'\"\n proof (cases \"sourcenode a\")\n case (Node cs x) [simp]\n from ve have \"cs \\ []\"\n by (cases x, auto elim: JVM_CFG.cases)\n then obtain C M pc cs' where [simp]: \"cs = (C, M, pc)#cs'\" by (cases cs, fastforce+)\n from vn obtain ST LT where wt: \"((P\\<^bsub>\\\\<^esub>) C M ! pc) = \\(ST,LT)\\\"\n by (cases cs', (cases x, auto)+)\n show ?thesis\n proof (cases \"instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc\")\n case (Load nat)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Store nat)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Push val)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (New Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n hence \"\\addr. HeapVar addr \\ Use P (sourcenode a)\"\n by (auto intro!: Use_New)\n with use_eq have \"\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr)\"\n by (simp del: state_val.simps)\n hence \"h = h'\"\n by (auto intro: ext)\n with ex_edge pred show ?thesis\n by (auto elim!: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (Getfield Fd Cl) [simp]\n have \"ST \\ []\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', (cases x, auto)+)\n with vn\n have \"pc < length is\"\n by (cases cs', (cases x, auto dest: sees_method_fun)+)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Getfield wt sees_M `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr where [simp]: \"ST = ST1#STr\" by (cases ST, fastforce+)\n show ?thesis\n proof (cases x)\n case None [simp]\n from wt\n have \"Stk (length cs') (length ST - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_Getfield_Stk)\n with use_eq have \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with ex_edge pred wt show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (Putfield Fd Cl) [simp]\n have \"length ST > 1\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', (cases x, auto)+)\n with vn\n have \"pc < length is\"\n by (cases cs', (cases x, auto dest: sees_method_fun)+)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Putfield wt sees_M `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr' where \"ST = ST1#STr' \\ STr' \\ []\" by (cases ST, fastforce+)\n then obtain ST2 STr where [simp]: \"ST = ST1#ST2#STr\" by (cases STr', fastforce+)\n show ?thesis\n proof (cases x)\n case None [simp]\n with wt\n have \"Stk (length cs') (length ST - 2) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_Putfield_Stk_Pred)\n with use_eq have \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with ex_edge pred wt show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (Checkcast Cl) [simp]\n have \"ST \\ []\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', (cases x, auto)+)\n with vn\n have \"pc < length is\"\n by (cases cs', (cases x, auto dest: sees_method_fun)+)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Checkcast wt sees_M `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr where [simp]: \"ST = ST1#STr\" by (cases ST, fastforce+)\n show ?thesis\n proof (cases x)\n case None [simp]\n from wt\n have \"Stk (length cs') (stkLength P C M pc - Suc 0) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_Checkcast_Stk)\n with use_eq\n have stk_top: \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n have \"\\addr. HeapVar addr \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Checkcast_Heap)\n with use_eq\n have \"\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr)\"\n by (simp del: state_val.simps)\n hence \"h = h'\"\n by (auto intro: ext)\n with ex_edge stk_top pred wt show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case (Invoke M' n') [simp]\n have \"length ST > n'\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', (cases x, auto)+)\n with vn\n have \"pc < length is\"\n by (cases cs', (cases x, auto dest: sees_method_fun)+)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Invoke wt sees_M `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n moreover obtain STn where \"STn = take n' ST\" by fastforce\n moreover obtain STs where \"STs = ST ! n'\" by fastforce\n moreover obtain STr where \"STr = drop (Suc n') ST\" by fastforce\n ultimately have [simp]:\" ST = STn@STs#STr \\ length STn = n'\"\n by (auto simp: id_take_nth_drop)\n show ?thesis\n proof (cases x)\n case None [simp]\n with wt\n have \"Stk (length cs') (stkLength P C M pc - Suc n') \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_Invoke_Stk_Pred)\n with use_eq\n have stk_top: \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n have \"\\addr. HeapVar addr \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Invoke_Heap_Pred)\n with use_eq\n have \"\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr)\"\n by (simp del: state_val.simps)\n hence \"h = h'\"\n by (auto intro: ext)\n with ex_edge stk_top pred wt show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case Return\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case Pop\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case IAdd\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (IfFalse b) [simp]\n show ?thesis\n proof (cases x)\n case None [simp]\n have \"Stk (length cs') (stkLength P C M pc - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_IfFalse_Stk)\n with use_eq\n have \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n with ex_edge pred wt show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n next\n case CmpEq\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Goto i)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case Throw [simp]\n have \"ST \\ []\"\n proof -\n from vn obtain T Ts mxs mxl \"is\" xt\n where sees_M: \"(P\\<^bsub>wf\\<^esub>) \\ C sees M:Ts\\T = (mxs,mxl,is,xt) in C\"\n by (cases cs', (cases x, auto)+)\n with vn\n have \"pc < length is\"\n by (cases cs', (cases x, auto dest: sees_method_fun)+)\n from P_wf sees_M have \"wt_method (P\\<^bsub>wf\\<^esub>) C Ts T mxs mxl is xt (P\\<^bsub>\\\\<^esub> C M)\"\n by (auto dest: sees_wf_mdecl simp: wf_jvm_prog_phi_def wf_mdecl_def)\n with Throw wt sees_M `pc < length is` show ?thesis\n by (fastforce simp: wt_method_def)\n qed\n then obtain ST1 STr where [simp]: \"ST = ST1#STr\" by (cases ST, fastforce+)\n show ?thesis\n proof (cases x)\n case None [simp]\n from wt\n have \"Stk (length cs') (stkLength P C M pc - 1) \\ Use P (sourcenode a)\"\n (is \"?stk_top \\ ?Use\")\n by (fastforce intro: Use_Throw_Stk)\n with use_eq\n have stk_top: \"state_val s ?stk_top = state_val s' ?stk_top\"\n by (simp del: state_val.simps)\n have \"\\addr. HeapVar addr \\ Use P (sourcenode a)\"\n by (fastforce intro: Use_Throw_Heap)\n with use_eq\n have \"\\addr. state_val s (HeapVar addr) = state_val s' (HeapVar addr)\"\n by (simp del: state_val.simps)\n hence \"h = h'\"\n by (auto intro: ext)\n with ex_edge pred stk_top wt show ?thesis\n by (auto elim!: JVM_CFG.cases)\n next\n case (Some x')\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\n qed\n next\n case Entry\n with ex_edge pred show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\nqed\n\n\nlemma edge_no_Def_equal:\n \"\\ valid_edge (P, C0, Main) a;\n V \\ Def P (sourcenode a) \\\n \\ state_val (transfer (kind a) s) V = state_val s V\"\nproof -\n assume ve:\"valid_edge (P, C0, Main) a\"\n and v_not_def: \"V \\ Def P (sourcenode a)\"\n obtain h stk loc where [simp]: \"(s::state) = (h, stk, loc)\" by (cases s, blast)\n from ve have vn: \"valid_node (P, C0, Main) (sourcenode a)\"\n and ex_edge: \"(P, C0, Main) \\ (sourcenode a)-kind a\\(targetnode a)\"\n by simp_all\n show \"state_val (transfer (kind a) s) V = state_val s V\"\n proof (cases \"sourcenode a\")\n case (Node cs x) [simp]\n with ve have \"cs \\ []\"\n by (cases x, auto elim: JVM_CFG.cases)\n then obtain C M pc cs' where [simp]: \"cs = (C, M, pc)#cs'\" by (cases cs, fastforce+)\n with vn obtain ST LT where wt: \"((P\\<^bsub>\\\\<^esub>) C M ! pc) = \\(ST,LT)\\\"\n by (cases cs', (cases x, auto)+)\n show ?thesis\n proof (cases \"instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc\")\n case (Load nat) [simp]\n from ex_edge have \"x = None\"\n by (auto elim: JVM_CFG.cases)\n with v_not_def have \"V \\ Stk (length cs') (stkLength P C M pc)\"\n by (auto intro!: Def_Load)\n with ex_edge show ?thesis\n by (auto elim!: JVM_CFG.cases, cases V, auto)\n next\n case (Store nat) [simp]\n with ex_edge have \"x = None\"\n by (auto elim: JVM_CFG.cases)\n with v_not_def have \"V \\ Loc (length cs') nat\"\n by (auto intro!: Def_Store)\n with ex_edge show ?thesis\n by (auto elim!: JVM_CFG.cases, cases V, auto)\n next\n case (Push val) [simp]\n with ex_edge have \"x = None\"\n by (auto elim: JVM_CFG.cases)\n with v_not_def have \"V \\ Stk (length cs') (stkLength P C M pc)\"\n by (auto intro!: Def_Push)\n with ex_edge show ?thesis\n by (auto elim!: JVM_CFG.cases, cases V, auto)\n next\n case (New Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n apply (cases V, auto intro!: Def_New_Normal_Stk Def_New_Normal_Heap)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n next\n case (Getfield F Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases simp: split_beta)\n apply (cases V, auto intro!: Def_Getfield_Stk)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n next\n case (Putfield Fd Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases simp: split_beta)\n apply (cases V, auto intro!: Def_Putfield_Heap)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n next\n case (Checkcast Cl) [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n next\n case (Invoke M' n') [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n from ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n apply (cases V, auto intro!: Def_Invoke_Loc)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n next\n case Return\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n by (cases V, auto intro!: Def_Return_Stk)\n next\n case Pop\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case IAdd\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n by (cases V, auto intro!: Def_IAdd_Stk)\n next\n case (IfFalse b)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case CmpEq\n with ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n by (cases V, auto intro!: Def_CmpEq_Stk)\n next\n case (Goto i)\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case Throw [simp]\n show ?thesis\n proof (cases x)\n case None\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n next\n case (Some x')\n then obtain cs'' xf where [simp]: \"x = \\(cs'',xf)\\\"\n by (cases x', fastforce)\n from ex_edge v_not_def show ?thesis\n apply (auto elim!: JVM_CFG.cases)\n by (cases V, auto intro!: Def_Exc_Stk)+\n qed\n qed\n next\n case Entry\n with ex_edge show ?thesis\n by (auto elim: JVM_CFG.cases)\n qed\nqed\n\ninterpretation JVM_CFG_wf: CFG_wf\n \"sourcenode\" \"targetnode\" \"kind\" \"valid_edge prog\" \"(_Entry_)\"\n \"Def (fst prog)\" \"Use (fst prog)\" \"state_val\"\n for prog\nproof (unfold_locales)\n show \"Def (fst prog) (_Entry_) = {} \\ Use (fst prog) (_Entry_) = {}\"\n by (auto elim: Def.cases Use.cases)\nnext\n fix a V s\n assume ve:\"valid_edge prog a\"\n and v_not_def: \"V \\ Def (fst prog) (sourcenode a)\"\n thus \"state_val (transfer (kind a) s) V = state_val s V\"\n by -(cases prog,\n rule edge_no_Def_equal [of \"fst prog\" \"fst (snd prog)\" \"snd (snd prog)\"], auto)\nnext\n fix a s s'\n assume ve: \"valid_edge prog a\"\n and use_eq: \"\\V\\Use (fst prog) (sourcenode a). state_val s V = state_val s' V\"\n thus \"\\V\\Def (fst prog) (sourcenode a).\n state_val (transfer (kind a) s) V = state_val (transfer (kind a) s') V\"\n by -(cases prog,\n rule edge_transfer_uses_only_Use [of \"fst prog\" \"fst(snd prog)\" \"snd(snd prog)\"], auto)\nnext\n fix a s s'\n assume ve: \"valid_edge prog a\"\n and pred: \"pred (kind a) s\"\n and use_eq: \"\\V\\Use (fst prog) (sourcenode a). state_val s V = state_val s' V\"\n thus \"pred (kind a) s'\"\n by -(cases prog,\n rule CFG_edge_Uses_pred_equal [of \"fst prog\" \"fst(snd prog)\" \"snd(snd prog)\"], auto)\nnext\n fix a a'\n assume ve_a: \"valid_edge prog a\"\n and ve_a': \"valid_edge prog a'\"\n and src_eq: \"sourcenode a = sourcenode a'\"\n and trg_neq: \"targetnode a \\ targetnode a'\"\n hence \"prog \\ (sourcenode a)-kind a\\(targetnode a)\"\n and \"prog \\ (sourcenode a')-kind a'\\(targetnode a')\"\n by simp_all\n with src_eq trg_neq\n show \"\\Q Q'. kind a = (Q)\\<^sub>\\ \\ kind a' = (Q')\\<^sub>\\ \\ (\\s. (Q s \\ \\ Q' s) \\ (Q' s \\ \\ Q s))\"\n apply (cases prog, auto)\n apply (erule JVM_CFG.cases, erule_tac [!] JVM_CFG.cases)\n (* This takes veeery long! *)\n by simp_all\nqed\n\ninterpretation JVM_CFGExit_wf: CFGExit_wf\n \"sourcenode\" \"targetnode\" \"kind\" \"valid_edge prog\" \"(_Entry_)\"\n \"Def (fst prog)\" \"Use (fst prog)\" \"state_val\" \"(_Exit_)\"\nproof\n show \"Def (fst prog) (_Exit_) = {} \\ Use (fst prog) (_Exit_) = {}\"\n by(fastforce elim:Def.cases Use.cases)\nqed\n\n \nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/JinjaVM/JVMCFG_wf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.3040416686603661, "lm_q1q2_score": 0.16387335779782178}} {"text": "(*\n * Copyright 2022, Proofcraft Pty Ltd\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchArch_AI\nimports Arch_AI\nbegin\n\ncontext Arch begin global_naming ARM_HYP\n\ndefinition\n \"valid_aci aci \\ case aci of MakePool frame slot parent base \\\n \\s. cte_wp_at (\\c. c = cap.NullCap) slot s \\ real_cte_at slot s \\\n ex_cte_cap_wp_to is_cnode_cap slot s \\\n slot \\ parent \\\n cte_wp_at (\\cap. \\idx. cap = UntypedCap False frame pageBits idx ) parent s \\\n descendants_of parent (cdt s) = {} \\\n is_aligned base asid_low_bits \\ base \\ 2^asid_bits - 1 \\\n arm_asid_table (arch_state s) (asid_high_bits_of base) = None\"\n\ndefinition\n \"valid_vcpu_invocation vi \\ case vi of\n VCPUSetTCB vcpu_ptr tcb_ptr \\ vcpu_at vcpu_ptr and tcb_at tcb_ptr and\n ex_nonz_cap_to vcpu_ptr and ex_nonz_cap_to tcb_ptr\n and (\\s. tcb_ptr \\ idle_thread s)\n | VCPUInjectIRQ vcpu_ptr index virq \\ vcpu_at vcpu_ptr\n | VCPUReadRegister vcpu_ptr reg \\ vcpu_at vcpu_ptr\n | VCPUWriteRegister vcpu_ptr reg val \\ vcpu_at vcpu_ptr\n | VCPUAckVPPI vcpu_ptr vppi \\ vcpu_at vcpu_ptr\"\n\nlemma safe_parent_strg:\n \"cte_wp_at (\\cap. cap = UntypedCap False frame pageBits idx) p s \\\n descendants_of p (cdt s) = {} \\\n valid_objs s\n \\\n cte_wp_at (safe_parent_for (cdt s) p\n (ArchObjectCap (ASIDPoolCap frame base)))\n p s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_parent_for_def is_physical_def arch_is_physical_def)\n apply (rule is_aligned_no_overflow)\n apply (drule (1) caps_of_state_valid_cap)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n done\n\n\nlemma asid_low_bits_pageBits:\n \"Suc (Suc asid_low_bits) = pageBits\"\n by (simp add: pageBits_def asid_low_bits_def)\n\n\n(* 32-bit instance of Detype_AI.range_cover_full *)\nlemma range_cover_full:\n \"\\is_aligned ptr sz;sz \\ range_cover (ptr::word32) sz sz (Suc 0)\"\n by (clarsimp simp:range_cover_def unat_eq_0 le_mask_iff[symmetric] word_and_le1 word_bits_def)\n\n\ndefinition\n valid_arch_inv :: \"arch_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_arch_inv \\ \\ai. case ai of\n InvokePageTable pti \\\n valid_pti pti\n | InvokePageDirectory pdi \\\n valid_pdi pdi\n | InvokePage pinv \\\n valid_page_inv pinv\n | InvokeASIDControl aci \\\n valid_aci aci\n | InvokeASIDPool ap \\\n valid_apinv ap\n | InvokeVCPU vi \\\n valid_vcpu_invocation vi\"\n\n\nlemma check_vp_wpR [wp]:\n \"\\\\s. vmsz_aligned w sz \\ P () s\\\n check_vp_alignment sz w \\P\\, -\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp whenE_wp|wpc)+\n apply (simp add: vmsz_aligned_def)\n done\n\n\nlemma check_vp_inv: \"\\P\\ check_vp_alignment sz w \\\\_. P\\\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp whenE_wp|wpc)+\n apply simp\n done\n\n\nlemma p2_low_bits_max:\n \"(2 ^ asid_low_bits - 1) = (max_word :: 10 word)\"\n by (simp add: asid_low_bits_def)\n\n\nlemma dom_ucast_eq:\n \"(- dom (\\a::asid_low_index. p (ucast a::machine_word)) \\ {x. ucast x + y \\ 0} = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_low_bits - 1 \\ x + y \\ 0} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule conjI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_low_bits_def)\n apply simp\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_low_bits_def)\n apply simp\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_low_bits_def)\n done\n\n\nlemma asid_high_bits_max_word:\n \"(2 ^ asid_high_bits - 1 :: 7 word) = max_word\"\n by (simp add: asid_high_bits_def)\n\n\nlemma dom_ucast_eq_7:\n \"(- dom (\\a::7 word. p (ucast a::word32)) \\ {x. x \\ 2 ^ asid_high_bits - 1} = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_high_bits - 1} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_high_bits_def)\n apply simp\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_high_bits_def)\n done\n\n\nlemma ucast_fst_hd_assocs:\n \"- dom (\\x. pool (ucast (x::asid_low_index)::machine_word)) \\ {x. ucast x + (w::machine_word) \\ 0} \\ {}\n \\\n fst (hd [(x, y)\\assocs pool . x \\ 2 ^ asid_low_bits - 1 \\ x + w \\ 0 \\ y = None]) =\n ucast (fst (hd [(x, y)\\assocs (\\a::asid_low_index. pool (ucast a)) .\n x \\ 2 ^ asid_low_bits - 1 \\\n ucast x + w \\ 0 \\ y = None]))\"\n apply (simp add: ucast_assocs[unfolded o_def])\n apply (simp add: filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_len)\n apply (simp add: asid_low_bits_def minus_one_norm)\n apply (simp add: ord_le_eq_trans [OF word_n1_ge])\n apply (simp add: word_le_make_less)\n apply (subgoal_tac \"P\" for P) (* cut_tac but more awesome *)\n apply (subst hd_map, assumption)\n apply simp\n apply (rule sym, rule ucast_ucast_len)\n apply (drule hd_in_set)\n apply simp\n apply (simp add: assocs_empty_dom_comp null_def split_def)\n apply (simp add: ucast_assocs[unfolded o_def] filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_len)\n done\n\n\ncrunch typ_at [wp]: perform_page_table_invocation, perform_page_invocation,\n perform_asid_pool_invocation, perform_page_directory_invocation \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps)\n\ncrunch typ_at [wp]: perform_vcpu_invocation \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps)\n\nlemmas perform_page_table_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_table_invocation_typ_at]\n\nlemmas perform_page_directory_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_directory_invocation_typ_at]\n\nlemmas perform_page_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_invocation_typ_at]\n\nlemmas perform_asid_pool_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_asid_pool_invocation_typ_at]\n\nlemmas perform_vcpu_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_vcpu_invocation_typ_at]\n(* ARMHYP FIXME this is not enough, add appropriate lifting rule to abs_typ_at_lifts *)\n\nlemma perform_asid_control_invocation_tcb_at:\n \"\\invs and valid_aci aci and st_tcb_at active p and\n K (\\w a b c. aci = asid_control_invocation.MakePool w a b c \\ w \\ p)\\\n perform_asid_control_invocation aci\n \\\\rv. tcb_at p\\\"\n apply (simp add: perform_asid_control_invocation_def)\n apply (cases aci)\n apply clarsimp\n apply (wp |simp)+\n apply (wp obj_at_delete_objects retype_region_obj_at_other2 hoare_vcg_const_imp_lift|assumption)+\n apply (intro impI conjI)\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def image_def ptr_add_def)\n apply (clarsimp simp: st_tcb_at_tcb_at)+\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def valid_aci_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)\n apply simp\n apply (simp add:cte_wp_at_caps_of_state)\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (erule(1) in_empty_interE)\n apply (clarsimp simp:page_bits_def)\n apply simp\n done\n\n\nlemma ucast_asid_high_btis_of_le [simp]:\n \"ucast (asid_high_bits_of w) \\ (2 ^ asid_high_bits - 1 :: word32)\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less)\n apply simp\n apply (simp add: asid_high_bits_def)\n done\n\nlemma invoke_arch_tcb:\n \"\\invs and valid_arch_inv ai and st_tcb_at active tptr\\\n arch_perform_invocation ai\n \\\\rv. tcb_at tptr\\\"\n apply (simp add: arch_perform_invocation_def)\n apply (cases ai, simp_all)\n apply (wp, clarsimp simp: st_tcb_at_tcb_at)+\n defer\n apply (wp, clarsimp simp: st_tcb_at_tcb_at)\n defer\n apply (wp perform_asid_control_invocation_tcb_at)\n apply (clarsimp simp add: valid_arch_inv_def)\n apply (clarsimp simp: valid_aci_def)\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs cte_wp_at_caps_of_state)\n apply (drule_tac p=\"(aa,ba)\" in caps_of_state_valid_cap, fastforce)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (drule_tac x=tptr in base_member_set, simp)\n apply (simp add: vspace_bits_defs field_simps del: atLeastAtMost_iff)\n apply (metis (no_types) orthD1 x_power_minus_1)\n apply simp\n apply wp\n apply (clarsimp simp: st_tcb_at_def tcb_at_def obj_at_def is_tcb_def)\n done\n\nend\n\n\nlocale asid_update = Arch +\n fixes ap asid s s'\n assumes ko: \"ko_at (ArchObj (ASIDPool Map.empty)) ap s\"\n assumes empty: \"arm_asid_table (arch_state s) asid = None\"\n defines \"s' \\ s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\\"\n\n\ncontext asid_update begin\n\nlemma vs_lookup1' [simp]:\n \"vs_lookup1 s' = vs_lookup1 s\"\n by (simp add: vs_lookup1_def s'_def)\n\n\nlemma vs_lookup_pages1' [simp]:\n \"vs_lookup_pages1 s' = vs_lookup_pages1 s\"\n by (simp add: vs_lookup_pages1_def s'_def)\n\n\nlemma vs_asid_refs' [simp]:\n \"vs_asid_refs (arm_asid_table (arch_state s')) =\n vs_asid_refs (arm_asid_table (arch_state s)) \\ {([VSRef (ucast asid) None], ap)}\"\n apply (simp add: s'_def)\n apply (rule set_eqI)\n apply (rule iffI)\n apply (auto simp: vs_asid_refs_def split: if_split_asm)[1]\n apply clarsimp\n apply (erule disjE)\n apply (auto simp: vs_asid_refs_def)[1]\n apply (subst (asm) vs_asid_refs_def)\n apply (clarsimp dest!: graph_ofD)\n apply (rule vs_asid_refsI)\n apply (clarsimp simp: empty)\n done\n\n\nlemma vs_lookup':\n \"vs_lookup s' = vs_lookup s \\ {([VSRef (ucast asid) None], ap)}\"\n using ko\n apply (simp add: vs_lookup_def)\n apply (rule rtrancl_insert)\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def)\n done\n\n\nlemma vs_lookup_pages':\n \"vs_lookup_pages s' = vs_lookup_pages s \\ {([VSRef (ucast asid) None], ap)}\"\n using ko\n apply (simp add: vs_lookup_pages_def)\n apply (rule rtrancl_insert)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def)\n done\n\nlemma obj_at [simp]:\n \"obj_at P p s' = obj_at P p s\"\n by (simp add: s'_def)\n\nlemma vs_lookup_neq: \"\\(rs \\ p) s' ; p \\ ap\\ \\ (rs \\ p) s\"\n by (clarsimp simp: vs_lookup')\n\nlemma vspace_objs':\n \"valid_vspace_objs s \\ valid_vspace_objs s'\"\n using ko\n apply (clarsimp simp: valid_vspace_objs_def)\n apply (erule_tac x=p in allE)\n apply (case_tac \"p = ap\";\n case_tac ao;\n fastforce simp: obj_at_def s'_def\n intro: vs_lookup_neq)\n done\n\nlemma caps_of_state_s':\n \"caps_of_state s' = caps_of_state s\"\n by (rule caps_of_state_pspace, simp add: s'_def)\n\n\nlemma valid_vs_lookup':\n \"\\ valid_vs_lookup s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ ap \\ obj_refs cap \\ vs_cap_ref cap = Some [VSRef (ucast asid) None] \\\n \\ valid_vs_lookup s'\"\n by (clarsimp simp: valid_vs_lookup_def caps_of_state_s' vs_lookup_pages')\n\n\nlemma valid_table_caps':\n \"\\ valid_table_caps s \\\n \\ valid_table_caps s'\"\n apply (simp add: valid_table_caps_def caps_of_state_s')\n done\n\n\nlemma valid_arch_caps:\n \"\\ valid_arch_caps s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ ap \\ obj_refs cap \\ vs_cap_ref cap = Some [VSRef (ucast asid) None] \\\n \\ valid_arch_caps s'\"\n by (simp add: valid_arch_caps_def caps_of_state_s'\n valid_table_caps' valid_vs_lookup')\n\n\nlemma valid_asid_map':\n \"valid_asid_map s \\ valid_asid_map s'\"\n using empty\n apply (clarsimp simp: valid_asid_map_def s'_def)\n apply (drule bspec, blast)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule vs_lookup_2ConsD)\n apply clarsimp\n apply (erule vs_lookup_atE)\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (rule vs_lookupI[rotated])\n apply (rule r_into_rtrancl)\n apply (rule vs_lookup1I)\n apply (fastforce simp: obj_at_def)\n apply assumption\n apply simp\n apply (clarsimp simp: vs_asid_refs_def graph_of_def)\n apply fastforce\n done\n\nend\n\n\ncontext Arch begin global_naming ARM_HYP\n\nlemma valid_arch_state_strg:\n \"valid_arch_state s \\ ap \\ ran (arm_asid_table (arch_state s)) \\ asid_pool_at ap s \\\n valid_arch_state (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply (clarsimp simp: valid_arch_state_def split: option.split)\n apply (clarsimp simp: valid_asid_table_def ran_def)\n apply (fastforce intro!: inj_on_fun_updI)\n done\n\n\nlemma valid_vs_lookup_at_upd_strg:\n \"valid_vs_lookup s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n (\\ptr cap. caps_of_state s ptr = Some cap \\ ap \\ obj_refs cap \\\n vs_cap_ref cap = Some [VSRef (ucast asid) None])\n \\\n valid_vs_lookup (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.valid_vs_lookup')\n apply fastforce\n done\n\n\nlemma retype_region_ap:\n \"\\\\\\\n retype_region ap 1 0 (ArchObject ASIDPoolObj) dev\n \\\\_. ko_at (ArchObj (arch_kernel_obj.ASIDPool Map.empty)) ap\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule retype_region_obj_at)\n apply simp\n apply simp\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def)\n apply (clarsimp simp: obj_at_def default_object_def default_arch_object_def)\n done\n\n\nlemma retype_region_ap':\n \"\\\\\\ retype_region ap 1 0 (ArchObject ASIDPoolObj) dev \\\\rv. asid_pool_at ap\\\"\n apply (rule hoare_strengthen_post, rule retype_region_ap)\n apply (clarsimp simp: a_type_def elim!: obj_at_weakenE)\n done\n\n\nlemma no_cap_to_obj_with_diff_ref_null_filter:\n \"no_cap_to_obj_with_diff_ref cap S\n = (\\s. \\c \\ ran (null_filter (caps_of_state s) |` (- S)).\n obj_refs c = obj_refs cap\n \\ table_cap_ref c = table_cap_ref cap)\"\n apply (simp add: no_cap_to_obj_with_diff_ref_def\n ball_ran_eq cte_wp_at_caps_of_state)\n apply (simp add: Ball_def)\n apply (intro iff_allI ext)\n apply (simp add: restrict_map_def null_filter_def)\n apply (auto dest!: obj_ref_none_no_asid[rule_format]\n simp: table_cap_ref_def)\n done\n\n\nlemma retype_region_no_cap_to_obj:\n \"\\valid_pspace and valid_mdb\n and caps_overlap_reserved {ptr..ptr + 2 ^ obj_bits_api ty us - 1}\n and caps_no_overlap ptr sz\n and pspace_no_overlap_range_cover ptr sz\n and no_cap_to_obj_with_diff_ref cap S\n and (\\s. \\slot. cte_wp_at (\\c. up_aligned_area ptr sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n and K (ty = Structures_A.CapTableObject \\ 0 < us)\n and K (range_cover ptr sz (obj_bits_api ty us) 1) \\\n retype_region ptr 1 us ty dev\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n apply (rule hoare_gen_asm)+\n apply (simp add: no_cap_to_obj_with_diff_ref_null_filter)\n apply (wp retype_region_caps_of | simp)+\n apply fastforce\n done\n\n\nlemma valid_table_caps_asid_upd [iff]:\n \"valid_table_caps (s\\arch_state := (arm_asid_table_update f (arch_state s))\\) =\n valid_table_caps s\"\n by (simp add: valid_table_caps_def)\n\n\nlemma vs_asid_ref_upd:\n \"([VSRef (ucast (asid_high_bits_of asid')) None] \\ ap')\n (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid_high_bits_of asid \\ ap)\\\\)\n = (if asid_high_bits_of asid' = asid_high_bits_of asid\n then ap' = ap\n else ([VSRef (ucast (asid_high_bits_of asid')) None] \\ ap') s)\"\n by (fastforce intro: vs_lookup_atI elim: vs_lookup_atE)\n\n\nlemma vs_asid_ref_eq:\n \"([VSRef (ucast asid) None] \\ ap) s\n = (arm_asid_table (arch_state s) asid = Some ap)\"\n by (fastforce elim: vs_lookup_atE intro: vs_lookup_atI)\n\n\nlemma set_cap_reachable_pg_cap:\n \"\\\\s. P (reachable_pg_cap cap s)\\ set_cap x y \\\\_ s. P (reachable_pg_cap cap s)\\\"\n by (unfold reachable_pg_cap_def, wp hoare_vcg_ex_lift set_cap.vs_lookup_pages)\n\n\nlemma cap_insert_simple_arch_caps_ap:\n \"\\valid_arch_caps and (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s)\n and no_cap_to_obj_with_diff_ref cap {dest}\n and (\\s. arm_asid_table (arch_state s) (asid_high_bits_of asid) = None)\n and ko_at (ArchObj (ASIDPool Map.empty)) ap\n and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) \\\n cap_insert cap src dest\n \\\\rv s. valid_arch_caps (s\\arch_state := arch_state s\n \\arm_asid_table := arm_asid_table (arch_state s)(asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (simp add: cap_insert_def update_cdt_def set_cdt_def valid_arch_caps_def\n set_untyped_cap_as_full_def bind_assoc)\n apply (strengthen valid_vs_lookup_at_upd_strg)\n apply (wp get_cap_wp set_cap_valid_vs_lookup set_cap_arch_obj\n set_cap_valid_table_caps hoare_vcg_all_lift\n | simp split del: if_split)+\n apply (rule_tac P = \"cte_wp_at ((=) src_cap) src\" in set_cap_orth)\n apply (wp hoare_vcg_imp_lift hoare_vcg_ball_lift set_free_index_final_cap\n hoare_vcg_disj_lift set_cap_reachable_pg_cap set_cap.vs_lookup_pages\n | clarsimp)+\n apply (wp set_cap_arch_obj set_cap_valid_table_caps hoare_vcg_ball_lift\n get_cap_wp static_imp_wp set_cap_empty_tables[simplified second_level_tables_def, simplified])+\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps)\n apply (rule conjI)\n apply (clarsimp simp: vs_cap_ref_def)\n apply (rule_tac x=\"fst dest\" in exI)\n apply (rule_tac x=\"snd dest\" in exI)\n apply simp\n apply (rule conjI)\n apply (simp add: unique_table_caps_def is_cap_simps)\n apply (subst unique_table_refs_def)\n apply (intro allI impI)\n apply (simp split: if_split_asm)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (erule (3) unique_table_refsD)\n done\n\nlemma valid_asid_map_asid_upd_strg:\n \"valid_asid_map s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n valid_asid_map (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.valid_asid_map')\n done\n\nlemma valid_vspace_objs_asid_upd_strg:\n \"valid_vspace_objs s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n valid_vspace_objs (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.vspace_objs')\n done\n\nlemma safe_parent_cap_is_device:\n \"safe_parent_for m p cap pcap \\ cap_is_device cap = cap_is_device pcap\"\n by (simp add: safe_parent_for_def)\n\nlemma cap_insert_ap_invs:\n \"\\invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq \\ cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (arm_asid_table (arch_state s)) \\\n arm_asid_table (arch_state s) (asid_high_bits_of asid) = None)\\\n cap_insert cap src dest\n \\\\rv s. invs (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s(asid_high_bits_of asid \\ ap)\\\\)\\\"\n\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (strengthen valid_arch_state_strg valid_vspace_objs_asid_upd_strg\n valid_asid_map_asid_upd_strg )\n apply (simp cong: conj_cong)\n apply (rule hoare_pre)\n apply (wpsimp wp: cap_insert_simple_mdb cap_insert_iflive\n cap_insert_zombies cap_insert_ifunsafe\n cap_insert_valid_global_refs cap_insert_idle\n valid_irq_node_typ cap_insert_simple_arch_caps_ap\n simp: valid_global_objs_def valid_global_vspace_mappings_def)\n apply (clarsimp simp: is_simple_cap_def cte_wp_at_caps_of_state is_cap_simps)\n apply (frule safe_parent_cap_is_device)\n apply (drule safe_parent_cap_range)\n apply (simp add: cap_range_def)\n apply (rule conjI)\n apply clarsimp\n apply (drule_tac p=\"(a,b)\" in caps_of_state_valid_cap, fastforce)\n apply (auto simp: obj_at_def is_tcb_def is_cap_table_def a_type_def\n valid_cap_def [where c=\"cap.Zombie a b x\" for a b x]\n dest: obj_ref_is_tcb obj_ref_is_cap_table split: option.splits)\n done\n\nlemma max_index_upd_no_cap_to:\n \"\\\\s. no_cap_to_obj_with_diff_ref cap {slot} s \\\n cte_wp_at ((=) ucap) cref s \\ is_untyped_cap ucap\\\n set_cap (max_free_index_update ucap) cref\n \\\\rv s. no_cap_to_obj_with_diff_ref cap {slot} s \\\"\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def)\n apply (wp hoare_vcg_ball_lift set_cap_cte_wp_at_neg)\n apply (clarsimp simp:cte_wp_at_caps_of_state free_index_update_def is_cap_simps)\n apply (drule_tac x = cref in bspec)\n apply clarsimp\n apply (clarsimp simp:table_cap_ref_def)\n done\n\nlemma perform_asid_control_invocation_pred_tcb_at:\n \"\\\\s. pred_tcb_at proj Q t s \\ st_tcb_at ((Not \\ inactive) and (Not \\ idle)) t s\n \\ ct_active s \\ invs s \\ valid_aci aci s\\\n perform_asid_control_invocation aci\n \\\\_. pred_tcb_at proj Q t\\\"\n supply\n is_aligned_neg_mask_eq[simp del]\n is_aligned_neg_mask_weaken[simp del]\n apply (clarsimp simp: perform_asid_control_invocation_def split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_name_pre_state)\n apply (subgoal_tac \"is_aligned word1 page_bits\")\n prefer 2\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply (simp add:valid_cap_simps cap_aligned_def page_bits_def)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def word_bits_def word_size_bits_def pageBits_def)+\n apply (simp add:is_aligned_neg_mask_eq)\n apply (wp hoare_vcg_const_imp_lift retype_region_st_tcb_at set_cap_no_overlap|simp)+\n apply (strengthen invs_valid_objs invs_psp_aligned)\n apply (clarsimp simp:conj_comms)\n apply (wp max_index_upd_invs_simple get_cap_wp)+\n apply (clarsimp simp: valid_aci_def)\n apply (frule intvl_range_conv)\n apply (simp add:word_bits_def page_bits_def pageBits_def)\n apply (clarsimp simp:detype_clear_um_independent page_bits_def is_aligned_neg_mask_eq)\n apply (rule conjI)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (rule pspace_no_overlap_detype)\n apply (rule caps_of_state_valid_cap)\n apply (simp add:page_bits_def)+\n apply (simp add:invs_valid_objs invs_psp_aligned)+\n apply (rule conjI)\n apply (frule st_tcb_ex_cap)\n apply clarsimp\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (fastforce simp:page_bits_def)\n apply simp\n apply (clarsimp simp:obj_bits_api_def arch_kobj_size_def cte_wp_at_caps_of_state\n default_arch_object_def empty_descendants_range_in)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state\n empty_descendants_range_in descendants_range_def2)+\n apply (thin_tac \"x = Some cap.NullCap\" for x)+\n apply (drule(1) caps_of_state_valid_cap[OF _ invs_valid_objs])\n apply (intro conjI)\n apply (clarsimp simp:valid_cap_def cap_aligned_def range_cover_full\n invs_psp_aligned invs_valid_objs page_bits_def)\n apply (erule pspace_no_overlap_detype)\n apply (auto simp:page_bits_def detype_clear_um_independent)\n done\n\nlemma perform_asid_control_invocation_st_tcb_at:\n \"\\st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\n and ct_active and invs and valid_aci aci\\\n perform_asid_control_invocation aci\n \\\\_. st_tcb_at P t\\\"\n apply (wpsimp wp: perform_asid_control_invocation_pred_tcb_at)\n apply (fastforce simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma set_cap_idx_up_aligned_area:\n \"\\K (\\idx. pcap = UntypedCap dev ptr pageBits idx) and cte_wp_at ((=) pcap) slot\n and valid_objs\\ set_cap (max_free_index_update pcap) slot\n \\\\rv s. (\\slot. cte_wp_at (\\c. up_aligned_area ptr pageBits \\ cap_range c \\ cap_is_device c = dev) slot s)\\\"\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_cap_cte_wp_at)\n apply (rule_tac x = slot in exI)\n apply clarsimp\n apply (frule(1) cte_wp_valid_cap)\n apply (clarsimp simp: cte_wp_at_caps_of_state\n p_assoc_help valid_cap_def valid_untyped_def cap_aligned_def)\n done\n\nprimrec(nonexhaustive) get_untyped_cap_idx :: \"cap \\ nat\"\nwhere \"get_untyped_cap_idx (UntypedCap dev ref sz idx) = idx\"\n\n\nlemma aci_invs':\n assumes Q_ignores_arch[simp]: \"\\f s. Q (arch_state_update f s) = Q s\"\n assumes Q_ignore_machine_state[simp]: \"\\f s. Q (machine_state_update f s) = Q s\"\n assumes Q_detype[simp]: \"\\f s. Q (detype f s) = Q s\"\n assumes cap_insert_Q: \"\\cap src dest. \\Q and invs and K (src \\ dest)\\\n cap_insert cap src dest\n \\\\_.Q\\\"\n assumes retype_region_Q[wp]:\"\\a b c d e. \\Q\\ retype_region a b c d e \\\\_.Q\\\"\n assumes set_cap_Q[wp]: \"\\a b. \\Q\\ set_cap a b \\\\_.Q\\\"\n shows \"\\invs and Q and ct_active and valid_aci aci\\ perform_asid_control_invocation aci \\\\y s. invs s \\ Q s\\\"\nproof -\n have cap_insert_invsQ:\n \"\\cap src dest ap asid.\n \\Q and (invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq\\cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (arm_asid_table (arch_state s)) \\\n arm_asid_table (arch_state s) (asid_high_bits_of asid) = None))\\\n cap_insert cap src dest\n \\\\rv s.\n invs\n (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\) \\\n Q\n (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (wp cap_insert_ap_invs)\n apply simp\n apply (rule hoare_pre)\n apply (rule cap_insert_Q, assumption)\n apply (auto simp: cte_wp_at_caps_of_state)\n done\n show ?thesis\n apply (clarsimp simp: perform_asid_control_invocation_def valid_aci_def\n split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_const_imp_lift)\n apply (wp cap_insert_invsQ hoare_vcg_ex_lift | simp)+\n apply (simp add: valid_cap_def |\n strengthen real_cte_tcb_valid safe_parent_strg\n invs_vobjs_strgs\n ex_cte_cap_to_cnode_always_appropriate_strg)+\n apply (wp hoare_vcg_const_imp_lift set_free_index_invs\n retype_region_plain_invs[where sz = pageBits]\n retype_cte_wp_at[where sz = pageBits] hoare_vcg_ex_lift\n retype_region_obj_at_other3[where P=\"is_cap_table n\" and sz = pageBits for n]\n retype_region_ex_cte_cap_to[where sz = pageBits]\n retype_region_ap[simplified]\n retype_region_ap'[simplified]\n retype_region_no_cap_to_obj[where sz = pageBits,simplified]\n | simp del: split_paired_Ex)+\n apply (strengthen invs_valid_objs invs_psp_aligned\n invs_mdb invs_valid_pspace\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\"]\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\",\n simplified]\n caps_region_kernel_window_imp[where\n p = \"case aci of MakePool frame slot parent base \\ parent\"]\n invs_cap_refs_in_kernel_window)+\n apply (wp set_cap_caps_no_overlap set_cap_no_overlap get_cap_wp\n max_index_upd_caps_overlap_reserved max_index_upd_invs_simple\n set_cap_cte_cap_wp_to set_cap_cte_wp_at max_index_upd_no_cap_to\n | simp split del: if_split | wp (once) hoare_vcg_ex_lift)+\n apply (rule_tac P = \"is_aligned word1 page_bits\" in hoare_gen_asm)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def pageBits_def word_size_bits_def)\n apply (simp add:page_bits_def pageBits_def word_bits_def)\n apply (simp)\n apply wp\n apply (clarsimp simp: cte_wp_at_caps_of_state if_option_Some\n if_bool_simps\n split del: if_split)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state)+\n apply (simp add:descendants_range_def2 empty_descendants_range_in)\n apply (simp add:invs_mdb invs_valid_pspace invs_psp_aligned invs_valid_objs)\n apply (clarsimp dest!:caps_of_state_cteD)\n apply (frule(1) unsafe_protected[where p=t and p'=t for t])\n apply (simp add:empty_descendants_range_in)+\n apply fastforce\n apply clarsimp\n apply (frule_tac p = \"(aa,ba)\" in cte_wp_valid_cap)\n apply fastforce\n apply (clarsimp simp: detype_clear_um_independent obj_bits_api_def arch_kobj_size_def\n default_arch_object_def conj_comms)\n apply (rule conjI, clarsimp simp:valid_cap_simps cap_aligned_def page_bits_def not_le)+\n apply clarsimp\n apply (simp add:empty_descendants_range_in)\n apply (frule valid_cap_aligned)\n apply (clarsimp simp: cap_aligned_def)\n apply (subst caps_no_overlap_detype[OF descendants_range_caps_no_overlapI],\n assumption, simp, simp add: empty_descendants_range_in)\n apply (frule pspace_no_overlap_detype, clarify+)\n apply (frule intvl_range_conv[where bits = pageBits])\n apply (simp add:pageBits_def word_bits_def)\n apply (simp)\n apply (clarsimp simp: page_bits_def)\n apply (frule(1) ex_cte_cap_protects)\n apply (simp add:empty_descendants_range_in)\n apply fastforce\n apply (rule subset_refl)\n apply fastforce\n apply (clarsimp simp: field_simps)\n apply (intro conjI impI,\n simp_all add: free_index_of_def valid_cap_simps valid_untyped_def empty_descendants_range_in\n range_cover_full clear_um_def max_free_index_def,\n (clarsimp simp:valid_untyped_def valid_cap_simps)+)[1]\n\n apply (simp add: cte_wp_at_def)\n\n apply (erule(1) cap_to_protected)\n apply (simp add:empty_descendants_range_in descendants_range_def2)+\n\n apply clarsimp\n apply (drule invs_arch_state)+\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (drule (1) bspec)+\n apply clarsimp\n apply (erule notE, erule is_aligned_no_overflow)\n\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def)\n apply (thin_tac \"cte_wp_at ((=) cap.NullCap) p s\" for p s)\n apply (subst(asm) eq_commute,\n erule(1) untyped_children_in_mdbE[where cap=\"cap.UntypedCap dev p bits idx\" for dev p bits idx,\n simplified, rotated])\n apply (simp add: is_aligned_no_overflow)\n apply simp\n apply clarsimp\n done\n\nqed\n\nlemmas aci_invs[wp] = aci_invs'[where Q=\\,simplified hoare_post_taut, OF refl refl refl TrueI TrueI TrueI,simplified]\n\nlemma obj_at_upd2:\n \"obj_at P t' (s\\kheap := kheap s(t \\ v, x \\ v')\\) = (if t' = x then P v' else obj_at P t' (s\\kheap := kheap s(t \\ v)\\))\"\n by (simp add: obj_at_update obj_at_def)\n\nlemma vcpu_invalidate_active_hyp_refs_empty[wp]:\n \"\\obj_at (\\ko. hyp_refs_of ko = {}) p\\ vcpu_invalidate_active \\\\r. obj_at (\\ko. hyp_refs_of ko = {}) p\\\"\n unfolding vcpu_invalidate_active_def vcpu_disable_def by wpsimp\n\nlemma as_user_hyp_refs_empty[wp]:\n \"\\obj_at (\\ko. hyp_refs_of ko = {}) p\\ as_user t f \\\\r. obj_at (\\ko. hyp_refs_of ko = {}) p\\\"\n unfolding as_user_def\n apply (wpsimp wp: set_object_wp)\n by (clarsimp simp: get_tcb_Some_ko_at obj_at_def arch_tcb_context_set_def)\n\nlemma dissociate_vcpu_tcb_obj_at_hyp_refs[wp]:\n \"\\\\s. p \\ {t, vr} \\ obj_at (\\ko. hyp_refs_of ko = {}) p s \\\n dissociate_vcpu_tcb t vr\n \\\\rv s. obj_at (\\ko. hyp_refs_of ko = {}) p s\\\"\n unfolding dissociate_vcpu_tcb_def\n apply (cases \"p \\ {t, vr}\"; clarsimp)\n apply (wp arch_thread_set_wp set_vcpu_wp)\n apply (clarsimp simp: obj_at_upd2 obj_at_update)\n apply (wp hoare_drop_imp get_vcpu_wp)+\n apply (clarsimp simp: obj_at_upd2 obj_at_update)\n apply (erule disjE;\n (wp arch_thread_set_wp set_vcpu_wp\n | clarsimp simp: obj_at_upd2 obj_at_update)+)\n done\n\nlemma associate_vcpu_tcb_sym_refs_hyp[wp]:\n \"\\\\s. sym_refs (state_hyp_refs_of s)\\ associate_vcpu_tcb vr t \\\\rv s. sym_refs (state_hyp_refs_of s)\\\"\n apply (simp add: associate_vcpu_tcb_def)\n apply (wp arch_thread_set_wp set_vcpu_wp | clarsimp)+\n apply (rule_tac P=\"\\s. ko_at (ArchObj (VCPU v)) vr s \\\n obj_at (\\ko. hyp_refs_of ko = {} ) t s \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_triv)\n apply (rule_tac Q=\"\\rv s. obj_at (\\ko. hyp_refs_of ko = {} ) vr s \\\n obj_at (\\ko. hyp_refs_of ko = {} ) t s \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_post_imp)\n apply (clarsimp dest!: get_tcb_SomeD simp: obj_at_def)\n apply (clarsimp simp add: sym_refs_def)\n apply (case_tac \"x = t\"; case_tac \"x = vr\"; clarsimp simp add: state_hyp_refs_of_def obj_at_def\n dest!: get_tcb_SomeD)\n apply fastforce\n apply (rule hoare_pre)\n apply (wp | wpc | clarsimp)+\n apply (simp add: obj_at_def)\n apply (wp get_vcpu_ko | wpc | clarsimp)+\n apply (rule_tac Q=\"\\rv s. (\\t'. obj_at (\\tcb. tcb = TCB t' \\ rv = tcb_vcpu (tcb_arch t')) t s) \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_post_imp)\n apply (clarsimp simp: obj_at_def)\n apply (wp arch_thread_get_tcb)\n apply simp\n done\n\nlemma arch_thread_set_inv_neq:\n \"\\obj_at P p and K (t \\ p)\\ arch_thread_set f t \\\\rv. obj_at P p\\\"\n unfolding arch_thread_set_def by (wpsimp wp: set_object_wp) (simp add: obj_at_def)\n\nlemma live_vcpu [simp]:\n \"live (ArchObj (VCPU (v\\vcpu_tcb := Some tcb\\)))\"\n by (simp add: live_def hyp_live_def arch_live_def)\n\nlemma ex_nonz_cap_to_vcpu_udpate[simp]:\n \"ex_nonz_cap_to t (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\) = ex_nonz_cap_to t s\"\n by (simp add: ex_nonz_cap_to_def)\n\nlemma caps_of_state_VCPU_update:\n \"vcpu_at a s \\ caps_of_state (s\\kheap := kheap s(a \\ ArchObj (VCPU b))\\) = caps_of_state s\"\n by (rule ext) (auto simp: caps_of_state_cte_wp_at cte_wp_at_cases obj_at_def)\n\nlemma set_vcpu_ex_nonz_cap_to[wp]:\n \"\\ex_nonz_cap_to t\\ set_vcpu a b \\\\_. ex_nonz_cap_to t\\\"\n apply (wp set_vcpu_wp)\n apply (clarsimp simp: ex_nonz_cap_to_def cte_wp_at_caps_of_state caps_of_state_VCPU_update)\n done\n\nlemma caps_of_state_tcb_arch_update:\n \"ko_at (TCB y) t' s \\ caps_of_state (s\\kheap := kheap s(t' \\ TCB (y\\tcb_arch := f (tcb_arch y)\\))\\) = caps_of_state s\"\n by (rule ext) (auto simp: caps_of_state_cte_wp_at cte_wp_at_cases obj_at_def tcb_cap_cases_def)\n\nlemma arch_thread_set_ex_nonz_cap_to[wp]:\n \"\\ex_nonz_cap_to t\\ arch_thread_set f t' \\\\_. ex_nonz_cap_to t\\\"\n apply (wp arch_thread_set_wp)\n apply clarsimp\n apply (clarsimp simp: ex_nonz_cap_to_def get_tcb_Some_ko_at cte_wp_at_caps_of_state\n caps_of_state_tcb_arch_update)\n done\n\ncrunch ex_nonz_cap_to[wp]: dissociate_vcpu_tcb \"ex_nonz_cap_to t\"\n (wp: crunch_wps)\n\ncrunches vcpu_switch\n for if_live_then_nonz_cap[wp]: if_live_then_nonz_cap\n (wp: crunch_wps)\n\nlemma associate_vcpu_tcb_if_live_then_nonz_cap[wp]:\n \"\\if_live_then_nonz_cap and ex_nonz_cap_to vcpu and ex_nonz_cap_to tcb\\\n associate_vcpu_tcb vcpu tcb \\\\_. if_live_then_nonz_cap\\\"\n unfolding associate_vcpu_tcb_def\n by (wpsimp wp: arch_thread_set_inv_neq hoare_disjI1 get_vcpu_wp hoare_vcg_all_lift hoare_drop_imps)\n\nlemma set_vcpu_valid_arch_Some[wp]:\n \"\\valid_arch_state\\ set_vcpu vcpu (v\\vcpu_tcb := Some tcb\\) \\\\_. valid_arch_state\\\"\n apply (wp set_vcpu_wp)\n apply (clarsimp simp: valid_arch_state_def)\n apply (rule conjI)\n apply (fastforce simp: valid_asid_table_def obj_at_def)\n apply (clarsimp simp: obj_at_def is_vcpu_def hyp_live_def arch_live_def split: option.splits)\n done\n\nlemma valid_global_objs_vcpu_update_str:\n \"valid_global_objs s \\ valid_global_objs (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\"\n by (simp add: valid_global_objs_def)\n\nlemma valid_global_vspace_mappings_vcpu_update_str:\n \"valid_global_vspace_mappings s \\ valid_global_vspace_mappings (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\"\n by (simp add: valid_global_vspace_mappings_def)\n\nlemma arm_current_vcpu_update_valid_global_vspace_mappings[simp]:\n \"valid_global_vspace_mappings (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\n = valid_global_vspace_mappings s\"\n by (clarsimp simp: valid_global_vspace_mappings_def global_refs_def\n split: kernel_object.splits option.splits)\n\ncrunches associate_vcpu_tcb\n for pspace_aligned[wp]: pspace_aligned\n and pspace_distinct[wp]: pspace_distinct\n and zombies_final[wp]: zombies_final\n and sym_refs_state_refs_of[wp]: \"\\s. sym_refs (state_refs_of s)\"\n and valid_mdb[wp]: valid_mdb\n and valid_ioc[wp]: valid_ioc\n and only_idle[wp]: only_idle\n and if_unsafe_then_cap[wp]: if_unsafe_then_cap\n and valid_reply_caps[wp]: valid_reply_caps\n and valid_reply_masters[wp]: valid_reply_masters\n and valid_irq_node[wp]: valid_irq_node\n and valid_irq_handlers[wp]: valid_irq_handlers\n and cap_refs_in_kernel_window[wp]: cap_refs_in_kernel_window\n and pspace_respects_device_region[wp]: pspace_respects_device_region\n and cur_tcb[wp]: cur_tcb\n and valid_vspace_objs[wp]: valid_vspace_objs\n and valid_arch_caps[wp]: valid_arch_caps\n and valid_kernel_mappings[wp]: valid_kernel_mappings\n and equal_kernel_mappings[wp]: equal_kernel_mappings\n and valid_asid_map[wp]: valid_asid_map\n and valid_global_vspace_mappings[wp]: valid_global_vspace_mappings\n and pspace_in_kernel_window[wp]: pspace_in_kernel_window\n (wp: crunch_wps dmo_valid_irq_states device_region_dmos simp: crunch_simps)\n\ncrunches vcpu_switch\n for valid_idle[wp]: valid_idle\n (wp: crunch_wps)\n\nlemma associate_vcpu_tcb_valid_idle[wp]:\n \"\\valid_idle and (\\s. tcb \\ idle_thread s)\\ associate_vcpu_tcb vcpu tcb \\\\_. valid_idle\\\"\n apply (clarsimp simp: associate_vcpu_tcb_def)\n by (wp hoare_vcg_all_lift\n | wp (once) hoare_drop_imps\n | wpc\n | simp add: dissociate_vcpu_tcb_def vcpu_invalidate_active_def)+\n\nlemma arm_current_vcpu_update_valid_global_refs[simp]:\n \"valid_global_refs (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\) = valid_global_refs s\"\n by (clarsimp simp: valid_global_refs_def global_refs_def\n split: kernel_object.splits option.splits)\n\ncrunches associate_vcpu_tcb\n for valid_global_refs[wp]: valid_global_refs\n (wp: crunch_wps)\n\ncrunches vcpu_restore_reg\n for valid_irq_states[wp]: valid_irq_states\n (wp: crunch_wps dmo_valid_irq_states simp: writeVCPUHardwareReg_def)\n\nlemma is_irq_active_sp:\n \"\\P\\ get_irq_state irq \\\\rv s. P s \\ (rv = interrupt_states s irq)\\\"\n by (wpsimp simp: get_irq_state_def)\n\nlemma restore_virt_timer_valid_irq_states[wp]:\n \"restore_virt_timer vcpu_ptr \\valid_irq_states\\\"\n apply (clarsimp simp: restore_virt_timer_def is_irq_active_def liftM_def)\n apply (repeat_unless \\rule hoare_seq_ext[OF _ is_irq_active_sp]\\\n \\rule hoare_seq_ext_skip,\n wpsimp wp: dmo_valid_irq_states\n simp: isb_def setHCR_def set_cntv_cval_64_def read_cntpct_def\n set_cntv_off_64_def\\)\n apply (wpsimp simp: do_machine_op_def is_irq_active_def get_irq_state_def)\n apply (clarsimp simp: valid_irq_states_def valid_irq_masks_def maskInterrupt_def in_monad)\n done\n\ncrunches vcpu_switch\n for valid_irq_states[wp]: valid_irq_states\n (wp: crunch_wps dmo_valid_irq_states set_gic_vcpu_ctrl_hcr_irq_masks\n set_gic_vcpu_ctrl_vmcr_irq_masks set_gic_vcpu_ctrl_lr_irq_masks\n set_gic_vcpu_ctrl_apr_irq_masks\n simp: get_gic_vcpu_ctrl_lr_def get_gic_vcpu_ctrl_apr_def get_gic_vcpu_ctrl_vmcr_def\n get_gic_vcpu_ctrl_hcr_def maskInterrupt_def isb_def setHCR_def)\n\nlemma associate_vcpu_tcb_valid_irq_states[wp]:\n \"associate_vcpu_tcb vcpu tcb \\valid_irq_states\\\"\n apply (clarsimp simp: associate_vcpu_tcb_def)\n by (wp hoare_vcg_all_lift\n | wp (once) hoare_drop_imps\n | wpc\n | simp add: dissociate_vcpu_tcb_def vcpu_invalidate_active_def)+\n\ncrunches associate_vcpu_tcb\n for cap_refs_respects_device_region[wp]: cap_refs_respects_device_region\n (wp: crunch_wps cap_refs_respects_device_region_dmo\n simp: set_cntv_cval_64_def read_cntpct_def set_cntv_off_64_def\n get_irq_state_def maskInterrupt_def)\n\nlemma arm_current_vcpu_update_valid_global_objs[simp]:\n \"valid_global_objs (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\) = valid_global_objs s\"\n by (clarsimp simp: valid_global_objs_def)\n\ncrunches associate_vcpu_tcb\n for valid_global_objs[wp]: valid_global_objs\n (wp: crunch_wps device_region_dmos)\n\nlemma set_vcpu_tcb_Some_hyp_live[wp]:\n \"\\\\\\ set_vcpu vcpu (v\\vcpu_tcb := Some tcb\\) \\\\_. obj_at hyp_live vcpu\\\"\n apply (wpsimp wp: set_vcpu_wp)\n apply (clarsimp simp: obj_at_def hyp_live_def arch_live_def)\n done\n\nlemma associate_vcpu_tcb_valid_arch_state[wp]:\n \"associate_vcpu_tcb vcpu tcb \\valid_arch_state\\\"\n apply (clarsimp simp: associate_vcpu_tcb_def)\n apply (wpsimp wp: vcpu_switch_valid_arch)\n apply (rule_tac Q=\"\\_. valid_arch_state and obj_at hyp_live vcpu\" in hoare_post_imp)\n apply fastforce\n apply wpsimp\n apply (wpsimp wp: arch_thread_set.valid_arch_state)\n apply (wpsimp wp: arch_thread_set_wp)+\n done\n\nlemma dmo_valid_machine_state[wp]:\n \"do_machine_op (set_cntv_cval_64 w) \\valid_machine_state\\\"\n \"do_machine_op read_cntpct \\valid_machine_state\\\"\n \"do_machine_op (set_cntv_off_64 w') \\valid_machine_state\\\"\n \"do_machine_op (maskInterrupt m irq) \\valid_machine_state\\\"\n \"do_machine_op (setHCR word) \\valid_machine_state\\\"\n \"do_machine_op isb \\valid_machine_state\\\"\n \"do_machine_op dsb \\valid_machine_state\\\"\n \"do_machine_op (set_gic_vcpu_ctrl_hcr f) \\valid_machine_state\\\"\n \"do_machine_op (set_gic_vcpu_ctrl_lr n w'') \\valid_machine_state\\\"\n \"do_machine_op (set_gic_vcpu_ctrl_apr w''') \\valid_machine_state\\\"\n \"do_machine_op (set_gic_vcpu_ctrl_vmcr w''') \\valid_machine_state\\\"\n \"do_machine_op (get_gic_vcpu_ctrl_lr w'''') \\valid_machine_state\\\"\n \"do_machine_op get_gic_vcpu_ctrl_apr \\valid_machine_state\\\"\n \"do_machine_op get_gic_vcpu_ctrl_vmcr \\valid_machine_state\\\"\n \"do_machine_op get_gic_vcpu_ctrl_hcr \\valid_machine_state\\\"\n unfolding valid_machine_state_def set_cntv_cval_64_def read_cntpct_def set_cntv_off_64_def\n maskInterrupt_def setHCR_def set_gic_vcpu_ctrl_hcr_def set_gic_vcpu_ctrl_lr_def\n set_gic_vcpu_ctrl_apr_def set_gic_vcpu_ctrl_vmcr_def get_gic_vcpu_ctrl_lr_def\n get_gic_vcpu_ctrl_apr_def get_gic_vcpu_ctrl_vmcr_def get_gic_vcpu_ctrl_hcr_def\n by (wpsimp wp: hoare_vcg_all_lift hoare_vcg_disj_lift dmo_machine_state_lift)+\n\ncrunches restore_virt_timer, vcpu_restore_reg_range, vcpu_save_reg_range, vgic_update_lr\n for valid_machine_state[wp]: valid_machine_state\n (wp: crunch_wps ignore: do_machine_op)\n\nlemma vcpu_enable_valid_machine_state[wp]:\n \"vcpu_enable vcpu \\valid_machine_state\\\"\n apply (simp add: vcpu_enable_def)\n by (wpsimp | subst do_machine_op_bind | simp add: isb_def)+\n\ncrunches vcpu_restore, vcpu_save\n for valid_machine_state[wp]: valid_machine_state\n (wp: mapM_wp_inv simp: do_machine_op_bind dom_mapM empty_fail_cond ignore: do_machine_op)\n\ncrunches associate_vcpu_tcb\n for valid_machine_state[wp]: valid_machine_state\n (wp: crunch_wps ignore: do_machine_op simp: get_gic_vcpu_ctrl_lr_def do_machine_op_bind)\n\nlemma associate_vcpu_tcb_valid_objs[wp]:\n \"\\valid_objs and vcpu_at vcpu\\\n associate_vcpu_tcb vcpu tcb\n \\\\_. valid_objs\\\"\n by (wp arch_thread_get_wp\n | wp (once) hoare_drop_imps\n | wpc\n | clarsimp simp: associate_vcpu_tcb_def valid_obj_def[abs_def] valid_vcpu_def\n | simp add: obj_at_def)+\n\nlemma associate_vcpu_tcb_invs[wp]:\n \"\\invs and ex_nonz_cap_to vcpu and ex_nonz_cap_to tcb and vcpu_at vcpu and (\\s. tcb \\ idle_thread s)\\\n associate_vcpu_tcb vcpu tcb\n \\\\_. invs\\\"\n by (wpsimp simp: invs_def valid_state_def valid_pspace_def)\n\nlemma set_vcpu_regs_update[wp]:\n \"\\invs and valid_obj p (ArchObj (VCPU vcpu)) and\n obj_at (\\ko'. hyp_refs_of ko' = vcpu_tcb_refs (vcpu_tcb vcpu)) p\\\n set_vcpu p (vcpu_regs_update f vcpu) \\\\_. invs\\\"\n unfolding invs_def valid_state_def\n by (wpsimp wp: set_vcpu_valid_pspace set_vcpu_valid_arch_eq_hyp)\n\nlemma write_vcpu_register_invs[wp]:\n \"\\invs\\ write_vcpu_register vcpu reg val \\\\_. invs\\\"\n unfolding write_vcpu_register_def\n by wpsimp\n\nlemma vgic_update_valid_pspace[wp]:\n \"\\valid_pspace\\ vgic_update vcpuptr f \\\\_. valid_pspace\\\"\n unfolding vgic_update_def vcpu_update_def\n apply (wpsimp wp: set_vcpu_valid_pspace get_vcpu_wp simp: valid_vcpu_def)\n apply (fastforce simp: obj_at_def dest!: valid_pspace_vo)\n done\n\ncrunches invoke_vcpu_inject_irq, vcpu_read_reg\n for invs[wp]: invs (ignore: do_machine_op)\n\nlemma invoke_vcpu_ack_vppi_invs[wp]:\n \"invoke_vcpu_ack_vppi vcpu_ptr vppi \\invs\\\"\n unfolding invoke_vcpu_ack_vppi_def by (wpsimp cong: vcpu.fold_congs)\n\nlemma perform_vcpu_invs[wp]:\n \"\\invs and valid_vcpu_invocation vi\\ perform_vcpu_invocation vi \\\\_. invs\\\"\n apply (simp add: perform_vcpu_invocation_def valid_vcpu_invocation_def)\n apply (wpsimp simp: invoke_vcpu_read_register_def read_vcpu_register_def\n invoke_vcpu_write_register_def)\n done\n\nlemma invoke_arch_invs[wp]:\n \"\\invs and ct_active and valid_arch_inv ai\\\n arch_perform_invocation ai\n \\\\rv. invs\\\"\n apply (cases ai, simp_all add: valid_arch_inv_def arch_perform_invocation_def)\n apply (wp perform_vcpu_invs |simp)+\n done\n\n\nlemma sts_empty_pde [wp]:\n \"\\empty_pde_at p\\ set_thread_state t st \\\\rv. empty_pde_at p\\\"\n apply (simp add: empty_pde_at_def)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_thread_state_ko)\n apply (clarsimp simp: is_tcb_def)\n done\n\n\nlemma sts_pd_at_asid [wp]:\n \"\\vspace_at_asid asid pd\\ set_thread_state t st \\\\rv. vspace_at_asid asid pd\\\"\n apply (simp add: vspace_at_asid_def)\n apply wp\n done\n\n\nlemma sts_same_refs_inv[wp]:\n \"\\\\s. same_refs m cap s\\ set_thread_state t st \\\\rv s. same_refs m cap s\\\"\n by (cases m, (clarsimp simp: same_refs_def, wp)+)\n\n\nlemma sts_valid_slots_inv[wp]:\n \"\\valid_slots m\\ set_thread_state t st \\\\rv. valid_slots m\\\"\n by (cases m, (clarsimp simp: valid_slots_def, wp hoare_vcg_ball_lift sts.vs_lookup sts_typ_ats)+)\n\n\nlemma sts_valid_page_inv[wp]:\n\"\\valid_page_inv page_invocation\\ set_thread_state t st \\\\rv. valid_page_inv page_invocation\\\"\n by (cases page_invocation,\n (wp hoare_vcg_const_Ball_lift hoare_vcg_ex_lift hoare_vcg_disj_lift sts_typ_ats\n | clarsimp simp: valid_page_inv_def same_refs_def\n | wps)+)\n\n\nlemma sts_valid_pdi_inv[wp]:\n \"\\valid_pdi page_directory_invocation\\ set_thread_state t st \\\\rv. valid_pdi page_directory_invocation\\\"\n apply (cases page_directory_invocation)\n apply (wp | simp add: valid_pdi_def)+\n done\n\n\nlemma sts_valid_vcpu_invocation_inv:\n \"\\valid_vcpu_invocation vcpu_invocation\\ set_thread_state t st \\\\rv. valid_vcpu_invocation vcpu_invocation\\\"\n unfolding valid_vcpu_invocation_def by (cases vcpu_invocation; wpsimp)\n\nlemma sts_valid_arch_inv:\n \"\\valid_arch_inv ai\\ set_thread_state t st \\\\rv. valid_arch_inv ai\\\"\n apply (cases ai, simp_all add: valid_arch_inv_def)\n apply (rename_tac page_table_invocation)\n apply (case_tac page_table_invocation, simp_all add: valid_pti_def)[1]\n apply ((wp valid_pde_lift set_thread_state_valid_cap\n hoare_vcg_all_lift hoare_vcg_const_imp_lift\n hoare_vcg_ex_lift set_thread_state_ko\n sts_typ_ats set_thread_state_cte_wp_at\n | clarsimp simp: is_tcb_def)+)[4]\n apply (rename_tac asid_control_invocation)\n apply (case_tac asid_control_invocation)\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (rule hoare_pre, wp hoare_vcg_ex_lift cap_table_at_typ_at)\n apply clarsimp\n apply (clarsimp simp: valid_apinv_def split: asid_pool_invocation.splits)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_thread_state_ko)\n apply (clarsimp simp: is_tcb_def, wp sts_valid_vcpu_invocation_inv)\n done\n\ncrunch inv[wp]: ensure_safe_mapping, create_mapping_entries \"P\"\n (wp: crunch_wps mapME_x_inv_wp)\n\ncrunch_ignore (add: select_ext)\n\ncrunch inv [wp]: arch_decode_invocation \"P\"\n (wp: crunch_wps select_wp select_ext_weak_wp simp: crunch_simps)\n\n\nlemma create_mappings_empty [wp]:\n \"\\\\\\ create_mapping_entries base vptr vmsz R A pd \\\\m s. empty_refs m\\, -\"\n apply (cases vmsz, simp_all add: empty_refs_def)\n apply (wpsimp simp: pde_ref_def)+\n done\n\n\nlemma empty_pde_atI:\n \"\\ ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s;\n pd (ucast (p && mask pd_bits >> 3)) = InvalidPDE \\ \\\n empty_pde_at p s\"\n by (fastforce simp add: vspace_bits_defs empty_pde_at_def)\n\n\ndeclare lookup_slot_for_cnode_op_cap_to [wp]\n\n\nlemma shiftr_irrelevant:\n \"x < 2 ^ asid_low_bits \\ is_aligned (y :: word32) asid_low_bits \\\n x + y >> asid_low_bits = y >> asid_low_bits\"\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: is_aligned_nth)\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n apply (rule word_eqI)\n apply (simp add: nth_shiftr)\n apply safe\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n done\n\nlemma map_up_enum_0x78:\n \"is_aligned (r::32 word) 7 \\ map (\\x. x + r) [0 , 8 .e. 0x78] = [r, r + 8 .e. r + 0x78]\"\n apply (simp add: upto_enum_step_def upto_enum_def not_less)\n apply (drule is_aligned_no_overflow')\n apply simp\n apply (erule word_plus_mono_right2)\n apply simp\n done\n\nlemma create_mapping_entries_parent_for_refs:\n \"\\invs and \\\\ pd and page_directory_at pd\n and K (is_aligned pd pd_bits) and K (vmsz_aligned vptr pgsz)\n and K (vptr < kernel_base)\\\n create_mapping_entries ptr vptr pgsz\n rights attribs pd\n \\\\rv s. \\a b. cte_wp_at (parent_for_refs rv) (a, b) s\\, -\"\n apply (rule hoare_gen_asmE)+\n apply (cases pgsz,\n simp_all add: vmsz_aligned_def largePagePTE_offsets_def superSectionPDE_offsets_def\n pte_bits_def pde_bits_def)\n apply (rule hoare_pre)\n apply wp\n apply (rule hoare_post_imp_R, rule lookup_pt_slot_cap_to)\n apply (elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def)\n apply simp\n apply (rule hoare_pre)\n apply wp\n apply (rule hoare_post_imp_R)\n apply (rule lookup_pt_slot_cap_to_multiple1)\n apply (elim conjE exEI cte_wp_at_weakenE)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def\n subset_iff p_0x3C_shift map_up_enum_0x78)\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp dest!:vs_lookup_pages_vs_lookupI)\n apply (drule valid_vs_lookupD, clarsimp)\n apply (simp, elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def\n lookup_pd_slot_def Let_def)\n apply (subst pd_shifting, simp add: pd_bits_def pageBits_def pde_bits_def)\n apply (clarsimp simp: vs_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (auto simp: valid_cap_def obj_at_def is_cap_simps cap_asid_def\n dest!: caps_of_state_valid_cap split:if_splits)[3]\n apply (frule(1) caps_of_state_valid)\n apply (clarsimp simp:valid_cap_def obj_at_def)\n apply (simp add:is_cap_simps)\n apply (rule hoare_pre, wp)\n apply (clarsimp dest!:vs_lookup_pages_vs_lookupI)\n apply (drule valid_vs_lookupD, clarsimp)\n apply (simp, elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def)\n apply (rule conjI)\n apply (simp add: subset_eq)\n apply (clarsimp simp: lookup_pd_slot_add_eq)\n apply (clarsimp simp: vs_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (auto simp: valid_cap_def obj_at_def is_cap_simps cap_asid_def\n dest!: caps_of_state_valid_cap split:if_splits)[3]\n apply (frule(1) caps_of_state_valid)\n apply (clarsimp simp:valid_cap_def obj_at_def)\n apply (simp add:is_cap_simps)\n done\n\n\nlemma find_pd_for_asid_shifting_voodoo:\n \"\\pspace_aligned and valid_vspace_objs\\\n find_pd_for_asid asid\n \\\\rv s. v >> 21 = rv + (v >> 21 << 3) && mask pd_bits >> 3\\,-\"\n apply (rule hoare_post_imp_R,\n rule find_pd_for_asid_aligned_pd, simp add: vspace_bits_defs)\n apply (subst pd_shifting_dual[simplified vspace_bits_defs, simplified], simp)\n apply (rule word_eqI)\n apply (simp add: nth_shiftr nth_shiftl word_size)\n apply safe\n apply (drule test_bit_size)\n apply (simp add: word_size)\n done\n\n\nlemma find_pd_for_asid_ref_offset_voodoo:\n \"\\pspace_aligned and valid_vspace_objs and\n K (ref = [VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None])\\\n find_pd_for_asid asid\n \\\\rv. (ref \\ (rv + (v >> 21 << 3) && ~~ mask pd_bits))\\,-\"\n apply (rule hoare_gen_asmE)\n apply (rule_tac Q'=\"\\rv s. is_aligned rv 14 \\ (ref \\ rv) s\"\n in hoare_post_imp_R)\n apply (simp add: ucast_ucast_mask\n mask_asid_low_bits_ucast_ucast)\n apply (fold asid_low_bits_def)\n apply (rule hoare_pre, wp find_pd_for_asid_lookup_ref)\n apply (simp add: vspace_bits_defs)\n apply (simp add: pd_shifting[simplified vspace_bits_defs, simplified] vspace_bits_defs)\n done\n\n\ndeclare asid_high_bits_of_shift [simp]\ndeclare mask_shift [simp]\ndeclare word_less_sub_le [simp del]\ndeclare ptrFormPAddr_addFromPPtr [simp]\n\n\nlemma vs_lookup_and_unique_refs:\n \"\\(ref \\ p) s; caps_of_state s cptr = Some cap; table_cap_ref cap = Some ref';\n p \\ obj_refs cap; valid_vs_lookup s; unique_table_refs (caps_of_state s)\\\n \\ ref = ref'\"\n apply (frule_tac ref=ref in valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], assumption)\n apply clarsimp\n apply (frule_tac cap'=capa in unique_table_refsD)\n apply simp+\n apply (case_tac capa, simp_all)\n apply ((case_tac cap, simp_all)+)[6]\n apply (clarsimp simp add: table_cap_ref_def vs_cap_ref_def split: cap.splits arch_cap.splits option.splits)\n done\n\n\nlemma create_mapping_entries_same_refs:\n \"\\valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\\s. unique_table_refs (caps_of_state s))\n and pspace_aligned and valid_objs and valid_kernel_mappings and \\\\ pd and\n (\\s. \\dev pd_cap pd_cptr. cte_wp_at ((=) pd_cap) pd_cptr s\n \\ pd_cap = ArchObjectCap (PageDirectoryCap pd (Some asid))) and\n page_directory_at pd and K (vaddr < kernel_base \\ (cap = (ArchObjectCap (PageCap dev p rights' pgsz (Some (asid, vaddr))))))\\\n create_mapping_entries (addrFromPPtr p) vaddr pgsz rights attribs pd\n \\\\rv s. same_refs rv cap s\\,-\"\n apply (rule hoare_gen_asmE)\n apply (cases pgsz, simp_all add: lookup_pt_slot_def)\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: pd_shifting)\n apply (simp add: vaddr_segment_nonsense2 pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (frule (2) valid_vspace_objsD[rotated], simp)\n apply (erule_tac x=\"ucast (vaddr >> 21)\" in allE)\n apply (simp, drule (1) pt_aligned)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def split: option.splits)\n apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id mask_def[of 9]\n less_trans[OF and_mask_less'[where n=9, unfolded mask_def, simplified]]\n word_bits_def pageBits_def\n vaddr_segment_nonsense3)\n apply (rule conjI, simp add: mask_def pt_bits_def pte_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (frule_tac p=pd and p'=\"ptrFromPAddr x\" in vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (rule exI, erule conjI)\n apply (rule exI[where x=\"VSRef (vaddr >> 21) (Some APageDirectory)\"])\n apply (rule conjI, rule refl)\n apply (simp add: vs_refs_def)\n apply (rule_tac x=\"(ucast (vaddr >> 21), ptrFromPAddr x)\" in image_eqI)\n apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def)\n apply (clarsimp simp:graph_of_def)\n apply (simp add: pde_ref_def)\n apply simp\n apply (drule (1) ref_is_unique)\n apply (simp add: ptrFromPAddr_def)\n apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps pt_bits_def)[8]\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: pd_shifting)\n apply (simp add: vaddr_segment_nonsense2 pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (frule (2) valid_vspace_objsD[rotated], simp)\n apply (erule_tac x=\"ucast (vaddr >> 21)\" in allE)\n apply (simp, drule (1) pt_aligned)\n apply (simp add: largePagePTE_offsets_def pte_bits_def)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def upto_enum_step_def upto_enum_word upt_conv_Cons)\n apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id\n less_trans[OF and_mask_less'[where n=9, unfolded mask_def, simplified]]\n word_bits_def pageBits_def mask_def [of 9]\n vaddr_segment_nonsense3)\n apply (simp add: pt_bits_def pte_bits_def)\n apply (rule conjI, simp add: mask_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (frule_tac p=pd and p'=\"ptrFromPAddr x\" in vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (rule exI, erule conjI)\n apply (rule exI[where x=\"VSRef (vaddr >> 21) (Some APageDirectory)\"])\n apply (rule conjI, rule refl)\n apply (simp add: vs_refs_def)\n apply (rule_tac x=\"(ucast (vaddr >> 21), ptrFromPAddr x)\" in image_eqI)\n apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def)\n apply (clarsimp simp:graph_of_def)\n apply (simp add: pde_ref_def)\n apply simp\n apply (drule (1) ref_is_unique)\n apply (simp add: ptrFromPAddr_def)\n apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps)[8]\n apply (wp get_pde_wp returnOKE_R_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def)\n apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2\n pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (drule (1) ref_is_unique)\n apply (simp_all add: valid_arch_state_def valid_objs_caps)[7]\n apply (wp returnOKE_R_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: superSectionPDE_offsets_def pde_bits_def pageBits_def pt_bits_def)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def upto_enum_step_def upto_enum_word upt_conv_Cons)\n apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2 pageBits_def pt_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (drule (1) ref_is_unique)\n apply (clarsimp simp: obj_at_def a_type_def valid_arch_state_def)\n apply (simp_all add: valid_arch_state_def valid_objs_caps)\n done\n\n\nlemma create_mapping_entries_same_refs_ex:\n \"\\valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\\s. unique_table_refs (caps_of_state s))\n and pspace_aligned and valid_objs and valid_kernel_mappings and \\\\ pd and\n (\\s. \\dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s\n \\ pd_cap = cap.ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid))\n \\ page_directory_at pd s \\ vaddr < kernel_base \\ (cap = (cap.ArchObjectCap (arch_cap.PageCap dev p rights' pgsz (Some (asid, vaddr))))))\\\n create_mapping_entries (Platform.ARM_HYP.addrFromPPtr p) vaddr pgsz rights attribs pd\n \\\\rv s. same_refs rv cap s\\,-\"\n apply (clarsimp simp: validE_R_def validE_def valid_def split: sum.split)\n apply (erule use_validE_R[OF _ create_mapping_entries_same_refs])\n apply fastforce\n done\n\n\nlemma find_pd_for_asid_lookup_pd_wp:\n \"\\ \\s. valid_vspace_objs s \\ (\\pd. vspace_at_asid asid pd s \\ page_directory_at pd s\n \\ (\\\\ pd) s \\ Q pd s) \\ find_pd_for_asid asid \\ Q \\, -\"\n apply (rule hoare_post_imp_R)\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_page_directory])\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_lookup, simplified])\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_pd_at_asid, simplified])\n apply (wp (once) find_pd_for_asid_inv)\n apply auto\n done\n\n\nlemma aligned_sum_less_kernel_base:\n \"vmsz_aligned p sz\n \\ (p + 2 ^ pageBitsForSize sz - 1 < kernel_base) = (p < kernel_base)\"\n apply (rule iffI)\n apply (rule le_less_trans)\n apply (rule is_aligned_no_overflow)\n apply (simp add: vmsz_aligned_def)\n apply simp\n apply (simp add:field_simps[symmetric])\n apply (erule gap_between_aligned)\n apply (simp add: vmsz_aligned_def)+\n apply (case_tac sz,simp_all add:kernel_base_def is_aligned_def)+\n done\n\nlemma find_pd_for_asid_pde_unfolded[wp]:\n \"\\valid_vspace_objs and pspace_aligned\\\n find_pd_for_asid asid\n \\\\pd. pde_at (pd + (vptr >> 21 << 3))\\, -\"\n apply (rule hoare_post_imp_R, rule find_pd_for_asid_pde)\n apply (simp add: pageBits_def pt_bits_def pde_bits_def)\n done\n\nlemma arch_decode_inv_wf[wp]:\n \"\\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n arch_decode_invocation label args cap_index slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n supply if_split[split del]\n apply (cases arch_cap)\n apply (rename_tac word1 word2)\n apply (simp add: arch_decode_invocation_def Let_def decode_mmu_invocation_def split_def cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger select_wp select_ext_weak_wp|\n wpc|\n simp add: valid_arch_inv_def valid_apinv_def)+)[1]\n apply (simp add: if_apply_def2 valid_apinv_def)\n apply (intro allI impI ballI)\n apply (elim conjE exE)\n apply simp\n apply (clarsimp simp: dom_def neq_Nil_conv)\n apply (thin_tac \"Ball S P\" for S P)+\n apply (clarsimp simp: valid_cap_def)\n apply (rule conjI)\n apply (clarsimp simp: obj_at_def)\n apply (subgoal_tac \"ucast (ucast xa + word2) = xa\")\n apply simp\n apply (simp add: is_aligned_nth)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_bits_def nth_ucast)\n apply (drule test_bit_size)\n apply (simp add: word_size asid_low_bits_def)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_bits_def nth_ucast)\n apply (auto simp: asid_low_bits_def)[1]\n apply (rule conjI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (rename_tac c c')\n apply (frule_tac cap=\"(ArchObjectCap (PageDirectoryCap xb None))\" in caps_of_state_valid,\n assumption)\n apply (clarsimp simp: is_pd_cap_def cap_rights_update_def acap_rights_update_def)\n apply (clarsimp simp: word_neq_0_conv)\n apply (rule conjI)\n apply (subst field_simps, erule is_aligned_add_less_t2n)\n apply (simp add: asid_low_bits_def)\n apply (rule ucast_less[where 'b=10, simplified], simp)\n apply (simp add: asid_low_bits_def asid_bits_def)\n apply (simp add: asid_bits_def)\n apply (drule vs_lookup_atI)\n apply (subst asid_high_bits_of_add_ucast, assumption)\n apply assumption\n apply (simp add: arch_decode_invocation_def Let_def split_def decode_mmu_invocation_def\n cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger|\n wpc|\n simp add: valid_arch_inv_def valid_aci_def is_aligned_shiftl_self)+)[1]\n apply (rule_tac Q'=\n \"\\rv. real_cte_at rv and\n ex_cte_cap_wp_to is_cnode_cap rv and\n (\\s. descendants_of (snd (excaps!0)) (cdt s) = {}) and\n cte_wp_at (\\c. \\idx. c = (cap.UntypedCap False frame pageBits idx)) (snd (excaps!0)) and\n (\\s. arm_asid_table (arch_state s) free = None)\"\n in hoare_post_imp_R)\n apply (simp add: lookup_target_slot_def)\n apply wp\n apply (clarsimp simp: cte_wp_at_def)\n apply (rule conjI, clarsimp)\n apply (rule shiftl_less_t2n)\n apply (rule order_less_le_trans, rule ucast_less, simp)\n apply (simp add: asid_bits_def asid_low_bits_def)\n apply (simp add: asid_bits_def)\n apply simp\n apply (wp ensure_no_children_sp select_ext_weak_wp select_wp whenE_throwError_wp|wpc | simp)+\n apply clarsimp\n apply (rule conjI, fastforce)\n apply (cases excaps, simp)\n apply (case_tac list, simp)\n apply clarsimp\n apply (rule conjI)\n apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+\n apply assumption\n apply (rule conjI)\n apply clarsimp\n apply (simp add: ex_cte_cap_wp_to_def)\n apply (rule_tac x=ac in exI)\n apply (rule_tac x=ba in exI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (clarsimp simp: cap_rights_update_def)\n apply (simp add: arch_decode_invocation_def Let_def split_def decode_mmu_invocation_def\n cong: if_cong)\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageMap\")\n apply (rename_tac word rights vmpage_size option)\n apply simp\n apply (wpsimp wp: whenE_throwError_wp check_vp_wpR create_mapping_entries_parent_for_refs\n find_pd_for_asid_pd_at_asid create_mapping_entries_valid_slots\n create_mapping_entries_same_refs_ex hoare_vcg_ex_lift_R hoare_vcg_disj_lift_R\n hoare_vcg_const_imp_lift_R find_pd_for_asid_lookup_pd_wp\n simp: valid_arch_inv_def valid_page_inv_def is_pg_cap_def\n cte_wp_at_caps_of_state[where P=\"\\c. same_refs rv c s\" for rv s])\n apply (clarsimp simp: neq_Nil_conv)\n apply (frule cte_wp_valid_cap[where p=\"(a, b)\" for a b], clarsimp)\n apply (frule cte_wp_valid_cap[where p=slot], clarsimp)\n apply (clarsimp simp: cte_wp_at_caps_of_state mask_cap_def)\n apply (clarsimp simp: cap_rights_update_def acap_rights_update_def\n split: cap.splits arch_cap.splits if_splits)\n apply (rename_tac page_size mapped_data)\n apply (intro conjI allI impI;\n (clarsimp simp: invs_implies valid_cap_simps cap_aligned_def valid_kernel_mappings_def\n aligned_sum_less_kernel_base[symmetric] asid_bits_def mask_def\n is_arch_update_def cap_master_cap_simps is_arch_cap_def data_at_def\n vmsz_aligned_def is_aligned_addrFromPPtr_n vs_cap_ref_def\n cte_wp_at_caps_of_state is_cap_simps\n split: if_splits vmpage_size.split);\n fastforce)\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageUnmap\")\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def)\n apply (thin_tac \"Ball S P\" for S P)\n apply (clarsimp split: option.split)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (simp add: valid_unmap_def)\n apply (fastforce simp: vmsz_aligned_def elim: is_aligned_weaken intro!: pbfs_atleast_pageBits)\n apply (cases \"isPageFlushLabel (invocation_type label)\")\n apply simp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp static_imp_wp hoare_drop_imps)\n apply (simp add: valid_arch_inv_def valid_page_inv_def)\n apply (wp find_pd_for_asid_pd_at_asid | wpc)+\n apply (clarsimp simp: valid_cap_def mask_def)\n apply simp\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageGetAddress\")\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def)\n apply (rule hoare_pre, wp)\n apply (simp)\n apply (simp add: arch_decode_invocation_def Let_def split_def\n is_final_cap_def decode_mmu_invocation_def\n cong: if_cong)\n apply (rename_tac word option)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR get_master_pde_wp hoare_vcg_all_lift_R\n | wpc\n | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE vs_cap_ref_def\n split: if_split\n | rule_tac x=\"fst p\" in hoare_imp_eq_substR\n | wp (once) hoare_vcg_ex_lift_R)+)[1]\n apply (rule_tac Q'=\"\\a b. ko_at (ArchObj (PageDirectory pd))\n (a + (args ! 0 >> 21 << 3) && ~~ mask pd_bits) b \\\n pd (ucast (a + (args ! 0 >> 21 << 3) && mask pd_bits >> 3)) =\n InvalidPDE \\ L word option p pd a b\" for L in hoare_post_imp_R[rotated])\n apply (intro impI)\n apply (erule impE)\n apply (clarsimp simp: pageBits_def pde_bits_def pt_bits_def)\n apply (erule impE)\n apply (clarsimp simp: pageBits_def pde_bits_def pt_bits_def split:pde.splits)\n apply assumption\n apply ((wp whenE_throwError_wp hoare_vcg_all_lift_R\n find_pd_for_asid_lookup_slot [unfolded lookup_pd_slot_def Let_def]\n find_pd_for_asid_ref_offset_voodoo find_pd_for_asid_shifting_voodoo\n find_pd_for_asid_inv\n | wpc\n | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE empty_pde_atI\n vs_cap_ref_def pageBits_def pt_bits_def pde_bits_def\n | wp (once) hoare_drop_imps hoare_vcg_ex_lift_R)+)[6]\n apply (clarsimp simp: is_cap_simps if_apply_def2)\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (clarsimp simp: neq_Nil_conv)\n apply (thin_tac \"Ball S P\" for S P)\n apply (rule conjI)\n apply (clarsimp simp: valid_cap_def cap_aligned_def\n pte_bits_def pt_bits_def is_aligned_addrFromPPtr_n)\n apply (rule conjI)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (rule conjI)\n apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+\n apply (clarsimp simp add: cap_rights_update_def acap_rights_update_def)\n apply (clarsimp simp: valid_cap_def cap_aligned_def\n pt_bits_def pageBits_def\n linorder_not_le\n order_le_less_trans[OF word_and_le2])\n apply (rule conjI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (drule (1) caps_of_state_valid[rotated])\n apply clarsimp\n apply (clarsimp simp: cap_master_cap_def is_arch_update_def)\n apply (clarsimp simp: cap_asid_def cap_rights_update_def acap_rights_update_def is_cap_simps\n split: option.split)\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (clarsimp simp: pde_ref_def)\n apply (frule invs_pd_caps)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) caps_of_state_valid[rotated])\n apply (clarsimp simp: cap_rights_update_def acap_rights_update_def valid_cap_def)\n apply (drule (2) valid_table_caps_ptD)\n apply (rule conjI, fastforce)+\n apply (clarsimp simp: kernel_vsrefs_def)\n apply fastforce\n apply (clarsimp simp: cte_wp_at_def is_cap_simps\n valid_arch_inv_def valid_pti_def)\n apply (simp add: arch_decode_invocation_def Let_def decode_mmu_invocation_def cong: if_cong)\n apply (cases \"isPDFlushLabel (invocation_type label)\")\n apply simp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp static_imp_wp hoare_drop_imp | wpc | simp)+\n apply (simp add: resolve_vaddr_def)\n apply (wp get_master_pte_wp get_master_pde_wp whenE_throwError_wp | wpc | simp)+\n apply (clarsimp simp: valid_arch_inv_def valid_pdi_def)+\n apply (rule_tac Q'=\"\\pd' s. vspace_at_asid x2 pd' s \\ x2 \\ mask asid_bits \\ x2 \\ 0\" in hoare_post_imp_R)\n apply wp\n apply clarsimp\n apply (wp | wpc)+\n apply (clarsimp simp: valid_cap_def mask_def)\n apply (clarsimp, wp throwError_validE_R)\n\n(* VCPU *)\n apply (rename_tac vcpu_ptr)\n apply (clarsimp simp: arch_decode_invocation_def decode_vcpu_invocation_def)\n apply (cases \"invocation_type label\"; (simp, wp?))\n apply (rename_tac arch_iv)\n apply (case_tac \"arch_iv\"; (simp, wp?))\n apply (simp add: decode_vcpu_set_tcb_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_vcpu_invocation_def)\n apply (rename_tac tcb_ptr)\n apply (frule_tac c=\"ThreadCap tcb_ptr\" in cte_wp_valid_cap, fastforce)\n apply (simp add: valid_cap_def)\n apply (cases slot)\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (rule conjI, fastforce elim: cte_wp_at_weakenE)\n apply (rule conjI, fastforce elim: cte_wp_at_weakenE)\n apply (clarsimp dest!: invs_valid_global_refs simp: cte_wp_at_caps_of_state)\n apply (drule_tac ?cap=\"ThreadCap (idle_thread s)\" in valid_global_refsD2, assumption)\n apply (simp add:global_refs_def cap_range_def)\n apply (simp add: decode_vcpu_inject_irq_def)\n apply (rule hoare_pre, wpsimp simp: whenE_def wp: get_vcpu_wp)\n apply (clarsimp simp: valid_arch_inv_def valid_vcpu_invocation_def obj_at_def)\n apply (simp add: decode_vcpu_read_register_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n apply (simp add: decode_vcpu_write_register_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n apply (simp add: decode_vcpu_ack_vppi_def arch_check_irq_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n done\n\n\ndeclare word_less_sub_le [simp]\n\ncrunches associate_vcpu_tcb\n for pred_tcb_at[wp_unsafe]: \"pred_tcb_at proj P t\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunches vcpu_read_reg, vcpu_write_reg, invoke_vcpu_inject_irq\n for pred_tcb_at[wp]: \"pred_tcb_at proj P t\"\n\nlemma perform_vcpu_invocation_pred_tcb_at[wp_unsafe]:\n \"\\pred_tcb_at proj P t and K (proj_not_field proj tcb_arch_update)\\\n perform_vcpu_invocation iv\n \\\\_. pred_tcb_at proj P t\\\"\n apply (simp add: perform_vcpu_invocation_def)\n apply (rule hoare_pre)\n apply (wp associate_vcpu_tcb_pred_tcb_at | wpc\n | clarsimp simp: invoke_vcpu_read_register_def\n read_vcpu_register_def\n invoke_vcpu_write_register_def\n write_vcpu_register_def\n invoke_vcpu_ack_vppi_def)+\n done\n\ncrunch pred_tcb_at: perform_page_table_invocation, perform_page_invocation,\n perform_asid_pool_invocation,\n perform_page_directory_invocation \"pred_tcb_at proj P t\"\n (wp: crunch_wps simp: crunch_simps)\n\n\nlemma arch_pinv_st_tcb_at:\n \"\\invs and valid_arch_inv ai and ct_active and\n st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\\\n arch_perform_invocation ai\n \\\\rv. st_tcb_at P t\\\"\n apply (cases ai, simp_all add: arch_perform_invocation_def valid_arch_inv_def)\n apply (wp perform_page_table_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_page_directory_invocation_pred_tcb_at, fastforce elim: pred_tcb_weakenE)\n apply (wp perform_page_invocation_pred_tcb_at, fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_asid_control_invocation_st_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_asid_pool_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_vcpu_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n done\n\nend\n\n\ncontext begin interpretation Arch .\n\nrequalify_consts\n valid_arch_inv\n\nrequalify_facts\n invoke_arch_tcb\n invoke_arch_invs\n sts_valid_arch_inv\n arch_decode_inv_wf\n arch_pinv_st_tcb_at\n\nend\n\ndeclare invoke_arch_invs[wp]\ndeclare arch_decode_inv_wf[wp]\n\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM_HYP/ArchArch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.2782567937024021, "lm_q1q2_score": 0.16386239735834798}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchKHeap_AI\nimports KHeapPre_AI\nbegin\n\ncontext Arch begin global_naming ARM_HYP\n\nfun\n non_vspace_obj :: \"kernel_object \\ bool\"\nwhere\n \"non_vspace_obj (ArchObj (VCPU vcpu)) = True\" (* exclude vcpu *)\n| \"non_vspace_obj (ArchObj _) = False\"\n| \"non_vspace_obj _ = True\"\n\nlemma valid_vspace_is_vspace_lift:\n assumes P: \"\\p T. \\(K (is_vspace_typ (AArch T))) and (typ_at (AArch T) p)\\ f \\\\rv. typ_at (AArch T) p\\\"\n shows \"\\valid_vspace_obj ob\\ f \\\\rv. valid_vspace_obj ob\\\"\n apply (cases ob, simp_all add: aa_type_def)\n apply (rule hoare_vcg_const_Ball_lift)\n apply (wp P, simp)\n apply (rule hoare_vcg_all_lift)\n apply (rename_tac \"fun\" x)\n apply (case_tac \"fun x\"; simp_all add: data_at_def hoare_vcg_prop)\n apply (rule hoare_vcg_conj_lift hoare_vcg_disj_lift | wp P | simp )+\n apply (rule hoare_vcg_all_lift)\n apply (rename_tac \"fun\" x)\n apply (case_tac \"fun x\";simp_all add: data_at_def hoare_vcg_prop)\n apply (rule hoare_vcg_conj_lift hoare_vcg_disj_lift | wp P | simp )+\n done\n\n\n\nlemma valid_vspace_objs_lift:\n assumes x: \"\\P. \\\\s. P (vs_lookup s)\\ f \\\\_ s. P (vs_lookup s)\\\"\n assumes y: \"\\ako p. is_vspace_typ (AArch (aa_type ako))\n \\ \\\\s. \\ ko_at (ArchObj ako) p s\\ f \\\\rv s. \\ ko_at (ArchObj ako) p s\\\"\n assumes z: \"\\p T. \\(K (is_vspace_typ (AArch T))) and typ_at (AArch T) p\\ f \\\\rv. typ_at (AArch T) p\\\"\n shows \"\\valid_vspace_objs\\ f \\\\rv. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (rule hoare_vcg_all_lift, wp hoare_convert_imp [OF x]; (rule hoare_vcg_all_lift | assumption))\n apply (case_tac \"\\vcpu. ao = VCPU vcpu\")\n apply wpsimp\n apply clarsimp\n apply (rule hoare_convert_imp)\n apply (rule y)\n apply (clarsimp simp: aa_type_def split: arch_kernel_obj.split)\n apply (rule valid_vspace_is_vspace_lift [OF z])\n done\n\nlemma vspace_obj_imp: \"non_arch_obj ko \\ non_vspace_obj ko\"\n apply (cases ko; clarsimp)\n apply (rename_tac ako)\n apply (case_tac ako, auto simp: non_arch_obj_def)\n done\n\nlemma non_vspace_objs[intro]:\n \"non_vspace_obj (Endpoint ep)\"\n \"non_vspace_obj (CNode sz cnode_contents)\"\n \"non_vspace_obj (TCB tcb)\"\n \"non_vspace_obj (Notification notification)\"\n \"non_vspace_obj (ArchObj (VCPU vcpu))\"\n by (auto)\n\ndefinition vspace_obj_pred :: \"(kernel_object \\ bool) \\ bool\" where\n \"vspace_obj_pred P \\\n \\ko ko'. non_vspace_obj ko \\ non_vspace_obj ko' \\\n P ko = P ko'\"\n\nlemma vspace_obj_predE:\n \"\\vspace_obj_pred P; non_vspace_obj ko; non_vspace_obj ko'\\ \\ P ko = P ko'\"\n apply (unfold vspace_obj_pred_def)\n apply (erule allE[where ?x=\"ko\"])\n apply (erule allE[where ?x=\"ko'\"])\n by blast\n\nlemmas vspace_obj_pred_defs = non_vspace_objs vspace_obj_pred_def\n\nlemma vspace_pred_imp: \"vspace_obj_pred P \\ arch_obj_pred P\"\n apply (clarsimp simp: arch_obj_pred_def)\n apply (rule vspace_obj_predE)\n apply simp\n apply (rule vspace_obj_imp, assumption)+\n done\n\nlemma vspace_obj_pred_a_type[intro, simp]: \"T \\ AVCPU \\ vspace_obj_pred (\\ko. a_type ko = AArch T)\"\n by (auto simp add: vspace_obj_pred_defs a_type_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemma vspace_obj_pred_fun_lift: \"vspace_obj_pred (\\ko. F (vspace_obj_fun_lift P N ko))\"\n by (auto simp: vspace_obj_pred_defs vspace_obj_fun_lift_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemmas vspace_obj_pred_fun_lift_id[simp]\n = vspace_obj_pred_fun_lift[where F=id, simplified]\n\nlemmas vspace_obj_pred_fun_lift_k[intro]\n = vspace_obj_pred_fun_lift[where F=\"K R\" for R, simplified]\n\nlemmas vspace_obj_pred_fun_lift_el[simp]\n = vspace_obj_pred_fun_lift[where F=\"\\ S. x \\ S\" for x, simplified]\n\nlemma vspace_obj_pred_const_conjI[intro]:\n \"vspace_obj_pred P \\\n vspace_obj_pred P' \\\n vspace_obj_pred (\\ko. P ko \\ P' ko)\"\n apply (simp only: vspace_obj_pred_def)\n apply blast\n done\n\nlemma vspace_obj_pred_fI:\n \"(\\x. vspace_obj_pred (P x)) \\ vspace_obj_pred (\\ko. f (\\x :: 'a :: type. P x ko))\"\n apply (simp only: vspace_obj_pred_def)\n apply (intro allI impI)\n apply (rule arg_cong[where f=f])\n by blast\n\ndeclare\n vspace_obj_pred_fI[where f=All, intro]\n vspace_obj_pred_fI[where f=Ex, intro]\n\nend\n\nlocale vspace_only_obj_pred = Arch +\n fixes P :: \"kernel_object \\ bool\"\n assumes vspace_only: \"vspace_obj_pred P\"\n\nsublocale vspace_only_obj_pred < arch_only_obj_pred\n using vspace_pred_imp[OF vspace_only] by unfold_locales\n\ncontext Arch begin global_naming ARM_HYP\n\nsublocale empty_table: vspace_only_obj_pred \"empty_table S\" for S\n by unfold_locales (clarsimp simp: vspace_obj_pred_def empty_table_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs: vspace_only_obj_pred \"\\ko. x \\ vs_refs ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs_pages: vspace_only_obj_pred \"\\ko. x \\ vs_refs_pages ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_pages_def\n split: arch_kernel_obj.split kernel_object.splits)\n\nlemma pspace_in_kernel_window_atyp_lift_strong:\n assumes atyp_inv: \"\\P p T. \\ \\s. P (typ_at T p s) \\ f \\ \\rv s. P (typ_at T p s) \\\"\n assumes arch_inv: \"\\P. \\\\s. P (arm_kernel_vspace (arch_state s))\\ f \\\\r s. P (arm_kernel_vspace (arch_state s))\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n apply (simp add: pspace_in_kernel_window_def)\n apply (rule hoare_lift_Pf[where f=\"\\s. arm_kernel_vspace (arch_state s)\", OF _ arch_inv])\n apply (rule hoare_vcg_all_lift)\n apply (simp add: obj_bits_T)\n apply (simp add: valid_def)\n apply clarsimp\n subgoal for _ x s _ _ ko\n apply (cases \"kheap s x\")\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. \\ x\" and T1=\"a_type ko\" and p1=x];\n simp add: obj_at_def a_type_def)\n subgoal for ko'\n apply (drule spec[of _ ko'])\n apply (simp add: obj_bits_T)\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. x\" and T1=\"a_type ko'\" and p1=x])\n by (simp add: obj_at_def a_type_def)+\n done\n done\n\nlemma pspace_in_kernel_window_atyp_lift:\n assumes atyp_inv: \"\\P p T. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n assumes arch_inv: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n by (rule pspace_in_kernel_window_atyp_lift_strong[OF atyp_inv arch_inv])\n\nlemma cap_refs_in_kernel_window_arch_update[simp]:\n \"arm_kernel_vspace (f (arch_state s)) = arm_kernel_vspace (arch_state s)\n \\ cap_refs_in_kernel_window (arch_state_update f s) = cap_refs_in_kernel_window s\"\n by (simp add: cap_refs_in_kernel_window_def)\n\nlemma\n ex_ko_at_def2:\n \"(\\ko. ko_at ko p s \\ P ko) = (obj_at P p s)\"\n by (simp add: obj_at_def)\n\nlemma in_user_frame_obj_pred_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n shows \"\\in_user_frame p\\ f \\\\_. in_user_frame p\\\"\n unfolding in_user_frame_def\n apply (wp hoare_vcg_ex_lift obj_at)\n apply (clarsimp simp: vspace_obj_pred_def)\n apply (auto simp: a_type_def aa_type_def split: kernel_object.splits arch_kernel_obj.splits)\n done\n\nlemma vs_lookup_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup s)\\ f \\\\rv s. P (vs_lookup s)\\\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_pages_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup_pages s)\\ f \\\\rv s. P (vs_lookup_pages s)\\\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs_pages.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma valid_vspace_objs_lift_weak:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\valid_vspace_objs\\ f \\\\_. valid_vspace_objs\\\"\n apply (rule valid_vspace_objs_lift)\n apply (rule vs_lookup_vspace_obj_at_lift)\n apply (rule obj_at arch_state vspace_pred_imp; simp)+\n subgoal\n by (auto simp: aa_type_def vspace_obj_pred_def split: arch_kernel_obj.splits)\n apply (rule hoare_gen_asm_lk)\n apply (rule obj_at)\n subgoal\n by (auto simp: aa_type_def a_type_def vspace_obj_pred_def\n split: arch_kernel_obj.splits kernel_object.splits)\n done\n\nlemma set_object_neg_lookup:\n \"\\\\s. \\ (\\rs. (rs \\ p') s) \\ obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p s \\\n set_object p ko\n \\\\_ s. \\ (\\rs. (rs \\ p') s)\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule_tac x=rs in allE)\n apply (erule notE)\n apply (erule vs_lookup_stateI)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_vs_lookup:\n \"\\\\s. obj_at (\\ko'. vs_refs ko = vs_refs ko') p s \\ P (vs_lookup s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup s)\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\n\nlemma set_object_pt_not_vs_lookup_pages:\n \"\\\\s. \\(ref \\ p') s\n \\ ((\\\\p) s \\ (\\x. case pte_ref_pages (pt x) of\n Some ptr \\\n obj_at (\\ko. vs_refs_pages ko = {}) ptr s \\\n ptr \\ p'\n | None \\ True))\\\n set_object p (ArchObj (PageTable pt))\n \\\\_ s. \\(ref \\ p') s\\\"\n apply (wpsimp wp: set_object_wp)\n apply (case_tac \"(\\\\p) s\")\n apply (erule notE)\n apply clarsimp\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (erule vs_lookup_pagesI)\n apply (erule converse_rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (rename_tac slot pte)\n apply (erule_tac x=slot in allE)\n apply (drule_tac R=\"vs_lookup_pages1 s\" in rtranclD)\n apply clarsimp\n apply (drule tranclD)\n apply clarsimp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def vs_refs_pages_def)\n apply clarsimp\n apply (erule rtrancl_trans[OF r_into_rtrancl, rotated])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply clarsimp\n apply (erule notE)\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (rule vs_lookup_pagesI, assumption)\n apply (erule rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (rename_tac vs slot pte)\n apply (erule_tac x=vs in allE)\n apply (clarsimp simp: vs_lookup_pages_def)\n apply (drule(1) ImageI, erule (1) notE)\n apply clarsimp\n apply (erule rtrancl_trans[OF _ r_into_rtrancl])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n done\n\n\nlemma set_object_vs_lookup_pages:\n \"\\\\s. obj_at (\\ko'. vs_refs_pages ko = vs_refs_pages ko') p s \\ P (vs_lookup_pages s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup_pages s)\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\n\nlemma set_object_atyp_at:\n \"\\\\s. typ_at (AArch (aa_type ako)) p s \\ P (typ_at (AArch T) p' s)\\\n set_object p (ArchObj ako)\n \\\\rv s. P (typ_at (AArch T) p' s)\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule rsubst [where P=P])\n apply (clarsimp simp: obj_at_def a_type_aa_type)\n done\n\nlemma hoare_post_imp_conj_disj: \"(\\ \\s. R \\ f \\ \\_ s. P \\ Q \\) = (\\ \\s. R \\ f \\ \\_ s. \\ P \\ Q \\)\"\n by (subst imp_conv_disj, auto)\n\nlemma set_object_vspace_objs: (* used in set_pd_arch_objs_unmap in ArchAcc_AI *) (* ARMHYP *)\n \"\\valid_vspace_objs and typ_at (a_type ko) p and\n obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p and\n (\\s. case ko of ArchObj ao \\ (\\\\p)s \\ valid_vspace_obj ao s\n | _ \\ True)\\\n set_object p ko\n \\\\_. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift)\n apply (subst imp_conv_disj)\n apply (subst imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift set_object_neg_lookup set_object_neg_ko)\n apply (wp valid_vspace_obj_typ2 [where Q=\"typ_at (a_type ko) p\"] set_object_typ_at\n | simp)+\n apply (clarsimp simp: pred_neg_def obj_at_def)\n apply (case_tac ko; auto)\n done\n\nlemma set_object_valid_kernel_mappings:\n \"\\\\s. valid_kernel_mappings s\\\n set_object ptr ko\n \\\\rv. valid_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: valid_kernel_mappings_def\n elim!: ranE split: if_split_asm)\n done\n\nlemma valid_vs_lookup_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n shows \"\\valid_vs_lookup\\ f \\\\_. valid_vs_lookup\\\"\n unfolding valid_vs_lookup_def\n apply (rule hoare_lift_Pf [where f=vs_lookup_pages])\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (wp lookup cap)+\n done\n\n\nlemma valid_table_caps_lift:\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_table_caps\\ f \\\\_. valid_table_caps\\\"\n unfolding valid_table_caps_def\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (wp cap hoare_vcg_all_lift hoare_vcg_const_imp_lift obj)+\n done\n\nlemma valid_arch_caps_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n unfolding valid_arch_caps_def\n apply (rule hoare_pre)\n apply (wp valid_vs_lookup_lift valid_table_caps_lift lookup cap obj)\n apply simp\n done\n\nlemma valid_global_objs_lift':\n assumes obj: \"\\p. \\valid_ao_at p\\ f \\\\rv. valid_ao_at p\\\"\n assumes ko: \"\\ako p. \\ko_at (ArchObj ako) p\\ f \\\\_. ko_at (ArchObj ako) p\\\"\n shows \"\\\\s. valid_global_objs s \\ (v \\ P s)\\ f \\\\rv. valid_global_objs\\\"\n by (clarsimp simp: valid_global_objs_def valid_def)\n\nlemmas valid_global_objs_lift\n = valid_global_objs_lift' [where v=False, simplified]\n\ncontext\n fixes f :: \"'a::state_ext state \\ ('b \\ 'a state) set \\ bool\"\n assumes arch: \"\\P. \\\\s. P (arch_state s)\\ f \\\\_ s. P (arch_state s)\\\"\nbegin\n\ncontext\n assumes aobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n notes vspace_obj_fun_lift_expand[simp del]\nbegin\n\nlemma valid_global_vspace_mappings_lift:\n \"\\valid_global_vspace_mappings\\ f \\\\rv. valid_global_vspace_mappings\\\"\n by (wpsimp simp: valid_global_vspace_mappings_def)\n\nlemma valid_arch_caps_lift_weak:\n \"(\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\) \\\n \\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n apply (rule valid_arch_caps_lift[OF _ _ aobj_at])\n apply (rule vs_lookup_pages_vspace_obj_at_lift[OF aobj_at arch], assumption+)\n apply (rule empty_table.vspace_only)\n done\n\nlemma valid_global_objs_lift_weak:\n \"\\valid_global_objs\\ f \\\\rv. valid_global_objs\\\"\n by (wpsimp simp: valid_global_objs_def)\n\nlemma valid_asid_map_lift:\n \"\\valid_asid_map\\ f \\\\rv. valid_asid_map\\\"\n apply (simp add: valid_asid_map_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (simp add: vspace_at_asid_def)\n by (rule vs_lookup_vspace_obj_at_lift[OF aobj_at arch])\n\nlemma valid_kernel_mappings_lift:\n \"\\valid_kernel_mappings\\ f \\\\rv. valid_kernel_mappings\\\"\n apply (simp add: valid_kernel_mappings_def, wp)\n done\n\nend\n\nlemma valid_arch_state_lift_aobj_at:\n assumes aobj_at:\n \"\\P P' pd. arch_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n shows \"\\valid_arch_state\\ f \\\\rv. valid_arch_state\\\"\n apply (simp add: valid_arch_state_def valid_asid_table_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (rule hoare_vcg_conj_lift hoare_vcg_ball_lift hoare_vcg_prop | (rule aobj_at, clarsimp))+\n apply (case_tac \"arm_current_vcpu x\"; simp add: split_def)\n apply wp\n apply (rule aobj_at)\n apply (clarsimp simp: arch_obj_pred_def non_arch_obj_def is_vcpu_def)\n apply wp\n done\n\nend\n\nlemma equal_kernel_mappings_lift:\n assumes vsobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n shows \"\\equal_kernel_mappings\\ f \\\\rv. equal_kernel_mappings\\\"\n apply (simp add: equal_kernel_mappings_def, wp)\n done\n\nlemma valid_machine_state_lift:\n assumes memory: \"\\P. \\\\s. P (underlying_memory (machine_state s))\\ f \\\\_ s. P (underlying_memory (machine_state s))\\\"\n assumes aobj_at: \"\\P' pd. arch_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_machine_state\\ f \\\\_. valid_machine_state\\\"\n unfolding valid_machine_state_def\n apply (rule hoare_lift_Pf[where f=\"\\s. underlying_memory (machine_state s)\", OF _ memory])\n by (wpsimp wp: hoare_vcg_all_lift hoare_vcg_disj_lift[OF _ hoare_vcg_prop]\n in_user_frame_lift aobj_at)+\n\nlemma valid_vso_at_lift:\n assumes z: \"\\P p T. \\\\s. P (typ_at (AArch T) p s)\\ f \\\\rv s. P (typ_at (AArch T) p s)\\\"\n and y: \"\\ao. \\\\s. ko_at (ArchObj ao) p s\\ f \\\\rv s. ko_at (ArchObj ao) p s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n by (wpsimp wp: hoare_vcg_ex_lift y valid_vspace_is_vspace_lift z)+\n\nlemma valid_vso_at_lift_aobj_at:\n assumes aobj_at: \"\\P' pd. vspace_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n apply (rule hoare_vcg_ex_lift)\n apply (case_tac \"\\vcpu. ao = VCPU vcpu\")\n apply (clarsimp simp: aa_type_def)\n apply clarsimp\n apply (rule hoare_vcg_conj_lift aobj_at)+\n apply (case_tac ao; fastforce simp: vspace_obj_pred_def)\n apply (wpsimp wp: valid_vspace_is_vspace_lift)\n apply (case_tac \"T = AVCPU\", simp)\n apply (wpsimp wp: aobj_at)\n apply wp\n apply assumption\n done\n\nlemmas set_object_v_ker_map\n = set_object_valid_kernel_mappings\n\nlemma set_object_asid_map:\n \"\\valid_asid_map and\n obj_at (\\ko'. vs_refs ko' \\ vs_refs ko) p\\\n set_object p ko\n \\\\_. valid_asid_map\\\"\n apply (wpsimp wp: set_object_wp simp: valid_asid_map_def)\n apply (clarsimp simp: vspace_at_asid_def simp del: fun_upd_apply)\n apply (drule bspec, blast)\n apply clarsimp\n apply (rule vs_lookup_stateI, assumption)\n apply (clarsimp simp: obj_at_def)\n apply blast\n apply simp\n done\n\nlemma set_object_equal_mappings:\n \"\\\\s. equal_kernel_mappings s\n \\ (\\pd. ko = ArchObj (PageDirectory pd)\n \\ (\\x pd'. ko_at (ArchObj (PageDirectory pd')) x s))\\\n set_object p ko\n \\\\rv. equal_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def\n split del: if_split)\n done\n\nlemma valid_table_caps_ptD:\n \"\\ (caps_of_state s) p = Some (ArchObjectCap (arch_cap.PageTableCap p' None));\n page_table_at p' s; valid_table_caps s \\ \\\n \\pt. ko_at (ArchObj (PageTable pt)) p' s \\ valid_vspace_obj (PageTable pt) s\"\n apply (clarsimp simp: valid_table_caps_def simp del: split_paired_All)\n apply (erule allE)+\n apply (erule (1) impE)\n apply (clarsimp simp add: is_pt_cap_def cap_asid_def)\n apply (erule impE, rule refl)\n apply (clarsimp simp: obj_at_def empty_table_def)\n done\n\nlemma store_pde_pred_tcb_at:\n \"\\pred_tcb_at proj P t\\ store_pde ptr val \\\\rv. pred_tcb_at proj P t\\\"\n apply (simp add: store_pde_def get_pd_def set_pd_def bind_assoc)\n apply (wpsimp wp: set_object_wp_strong get_object_wp\n simp: a_type_def obj_at_def pred_tcb_at_def\n split: kernel_object.split)\n done\n\nlemma empty_table_lift:\n assumes S: \"\\P. \\\\s. P (S s)\\ f \\\\_ s. P (S s)\\\"\n assumes o: \"\\P. \\obj_at P p and Q\\ f \\\\_. obj_at P p\\\"\n shows \"\\\\s. obj_at (empty_table (S s)) p s \\ Q s\\\n f \\\\_ s. obj_at (empty_table (S s)) p s\\\"\n apply (rule hoare_lift_Pf2 [where f=\"S\"])\n apply (wp o S|simp)+\n done\n\n(*\nlemma as_user_typ_at[wp]:\n \"\\\\s. P (typ_at T p s)\\ as_user t m \\\\rv s. P (typ_at T p s)\\\"\n apply (simp add: as_user_def split_def set_object_def)\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (drule get_tcb_SomeD)\n apply (clarsimp simp: a_type_def)\n done\n\nlemma shows\n sts_caps_of_state[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_thread_state t st \\\\_ s. P (caps_of_state s)\\\" and\n set_bound_caps_of_state[wp]:\n \"\\\\s. P (caps_of_state s)\\ set_bound_notification t e \\\\_ s. P (caps_of_state s)\\\" and\n as_user_caps_of_state[wp]:\n \"\\\\s. P (caps_of_state s)\\ as_user p f \\\\_ s. P (caps_of_state s)\\\"\n\n unfolding set_thread_state_def set_bound_notification_def as_user_def set_object_def\n set_mrs_def\n apply (all \\(wp | wpc | simp)+ ; clarsimp, erule rsubst[where P=P], rule cte_wp_caps_of_lift\\)\n by (auto simp: cte_wp_at_cases2 tcb_cnode_map_def dest!: get_tcb_SomeD)\n*)\n\nlemma in_user_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_user_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_user_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma user_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (user_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (user_mem s)\"\n by (clarsimp simp: user_mem_def in_user_frame_obj_upd dom_def)\n\nlemma in_device_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_device_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_device_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma device_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (device_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (device_mem s)\"\n by (clarsimp simp: device_mem_def in_device_frame_obj_upd dom_def)\n\nlemma pspace_respects_region_cong[cong]:\n \"\\kheap a = kheap b; device_state (machine_state a) = device_state (machine_state b)\\\n \\ pspace_respects_device_region a = pspace_respects_device_region b\"\n by (simp add: pspace_respects_device_region_def device_mem_def user_mem_def in_device_frame_def\n in_user_frame_def obj_at_def dom_def)\n\ndefinition \"obj_is_device tp dev \\\n case tp of Untyped \\ dev\n | _ \\(case (default_object tp dev 0) of (ArchObj (DataPage dev _)) \\ dev\n | _ \\ False)\"\n\nlemma cap_is_device_obj_is_device[simp]:\n \"cap_is_device (default_cap tp a sz dev) = obj_is_device tp dev\"\n by (simp add: default_cap_def arch_default_cap_def obj_is_device_def\n default_object_def default_arch_object_def\n split: apiobject_type.splits aobject_type.splits)\n\ncrunch device_state_inv: storeWord \"\\ms. P (device_state ms)\"\n (ignore_del: storeWord)\n\n\n(* some hyp_ref invariants *)\n\nlemma state_hyp_refs_of_ep_update: \"\\s ep val. typ_at AEndpoint ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Endpoint val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM_HYP.state_hyp_refs_of_def obj_at_def ARM_HYP.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_ntfn_update: \"\\s ep val. typ_at ANTFN ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Notification val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM_HYP.state_hyp_refs_of_def obj_at_def ARM_HYP.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_tcb_bound_ntfn_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_bound_notification := ntfn\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM_HYP.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma state_hyp_refs_of_tcb_state_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_state := ts\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM_HYP.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma valid_vcpu_lift:\n assumes x: \"\\T p. \\typ_at (AArch T) p\\ f \\\\rv. typ_at (AArch T) p\\\"\n assumes t: \"\\p. \\typ_at ATCB p\\ f \\\\rv. typ_at ATCB p\\\"\n shows \"\\\\s. valid_vcpu v s\\ f \\\\rv s. valid_vcpu v s\\\"\n apply (cases v)\n apply (simp add: valid_vcpu_def | wp x hoare_vcg_disj_lift)+\n apply (case_tac vcpu_tcb; simp, wp t)\n done\n\n\nlemma valid_vcpu_update: \"\\s ep val. typ_at ANTFN ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Notification val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM_HYP.state_hyp_refs_of_def obj_at_def ARM_HYP.hyp_refs_of_def)\n done\n\nlemma valid_vcpu_same_type:\n \"\\ valid_vcpu v s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ valid_vcpu v (s\\kheap := kheap s(p \\ k)\\)\"\n by (cases v; case_tac vcpu_tcb; clarsimp simp: valid_vcpu_def typ_at_same_type)\n\nlemma arch_valid_obj_same_type:\n \"\\ arch_valid_obj ao s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ arch_valid_obj ao (s\\kheap := kheap s(p \\ k)\\)\"\n by (induction ao rule: arch_kernel_obj.induct;\n clarsimp simp: typ_at_same_type valid_vcpu_same_type)\n\n\nlemma default_arch_object_not_live: \"\\ live (ArchObj (default_arch_object aty dev us))\"\n by (clarsimp simp: default_arch_object_def live_def hyp_live_def arch_live_def default_vcpu_def\n split: aobject_type.splits)\n\nlemma default_tcb_not_live: \"\\ live (TCB default_tcb)\"\n by (clarsimp simp: default_tcb_def default_arch_tcb_def live_def hyp_live_def)\n\nlemma valid_arch_tcb_same_type:\n \"\\ valid_arch_tcb t s; valid_obj p k s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ valid_arch_tcb t (s\\kheap := kheap s(p \\ k)\\)\"\n by (auto simp: valid_arch_tcb_def obj_at_def)\n\nlemma valid_ioports_lift:\n assumes x: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\rv s. P (caps_of_state s)\\\"\n assumes y: \"\\P. \\\\s. P (arch_state s)\\ f \\\\rv s. P (arch_state s)\\\"\n shows \"\\valid_ioports\\ f \\\\rv. valid_ioports\\\"\n apply simp\n apply (rule hoare_use_eq [where f=caps_of_state, OF x y])\n done\n\nlemma valid_arch_mdb_lift:\n assumes c: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\r s. P (caps_of_state s)\\\"\n assumes r: \"\\P. \\\\s. P (is_original_cap s)\\ f \\\\r s. P (is_original_cap s)\\\"\n shows \"\\\\s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\ f \\\\r s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\\"\n apply (clarsimp simp: valid_def)\n done\n\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM_HYP/ArchKHeap_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.16383428199025754}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__27_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__27_on_rules imports n_g2kAbsAfter_lemma_on_inv__27\nbegin\nsection{*All lemmas on causal relation between inv__27*}\nlemma lemma_inv__27_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__27 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__27) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__27) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__27_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.31069437683198775, "lm_q1q2_score": 0.1638342786246249}} {"text": "(* Title: JinjaThreads/MM/JMM_J_Typesafe.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\JMM type safety for source code\\\n\ntheory JMM_J_Typesafe imports\n JMM_Typesafe2\n DRF_J\nbegin\n\nlocale J_allocated_heap_conf' = \n h: J_heap_conf \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write hconf\n P\n +\n h: J_allocated_heap \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n allocated\n P\n +\n heap''\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write\n P\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and hconf :: \"'heap \\ bool\"\n and allocated :: \"'heap \\ 'addr set\"\n and P :: \"'addr J_prog\"\n\nsublocale J_allocated_heap_conf' < h: J_allocated_heap_conf\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write hconf allocated\n P\nby(unfold_locales)\n\ncontext J_allocated_heap_conf' begin\n\nlemma red_New_type_match:\n \"\\ h.red' P t e s ta e' s'; NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\" \n and reds_New_type_match:\n \"\\ h.reds' P t es s ta es' s'; NewHeapElem ad CTn \\ set \\ta\\\\<^bsub>o\\<^esub>; typeof_addr ad \\ None \\\n \\ typeof_addr ad = \\CTn\\\"\nby(induct rule: h.red_reds.inducts)(auto dest: allocate_typeof_addr_SomeD red_external_New_type_match)\n\nlemma mred_known_addrs_typing':\n assumes wf: \"wf_J_prog P\"\n and ok: \"h.start_heap_ok\"\n shows \"known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (h.mred P) (\\t x h. \\ET. h.sconf_type_ok ET t x h) P\"\nproof -\n interpret known_addrs_typing\n addr2thread_id thread_id2addr \n spurious_wakeups\n empty_heap allocate \"\\_. typeof_addr\" heap_read heap_write\n allocated h.J_known_addrs\n final_expr \"h.mred P\" \"\\t x h. \\ET. h.sconf_type_ok ET t x h\"\n P\n using assms by(rule h.mred_known_addrs_typing)\n\n show ?thesis by unfold_locales(auto dest: red_New_type_match)\nqed\n\nlemma J_legal_read_value_typeable:\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"h.wf_start_state P C M vs\"\n and legal: \"weakly_legal_execution P (h.J_\\ P C M vs status) (E, ws)\"\n and a: \"enat a < llength E\"\n and read: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n shows \"\\T. P \\ ad@al : T \\ P \\ v :\\ T\"\nproof -\n note wf\n moreover from wf_start have \"h.start_heap_ok\" by cases\n moreover from wf wf_start\n have \"ts_ok (\\t x h. \\ET. h.sconf_type_ok ET t x h) (thr (h.J_start_state P C M vs)) h.start_heap\"\n by(rule h.J_start_state_sconf_type_ok)\n moreover from wf have \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n ultimately show ?thesis using legal a read\n by(rule known_addrs_typing'.weakly_legal_read_value_typeable[OF mred_known_addrs_typing'])\nqed\n\nend\n\nsubsection \\Specific part for JMM implementation 2\\\n\nabbreviation jmm_J_\\\n :: \"addr J_prog \\ cname \\ mname \\ addr val list \\ status \\ (addr \\ (addr, addr) obs_event action) llist set\"\nwhere \n \"jmm_J_\\ P \\ \n J_heap_base.J_\\ addr2thread_id thread_id2addr jmm_spurious_wakeups jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_read jmm_heap_write P\"\n\nabbreviation jmm'_J_\\\n :: \"addr J_prog \\ cname \\ mname \\ addr val list \\ status \\ (addr \\ (addr, addr) obs_event action) llist set\"\nwhere \n \"jmm'_J_\\ P \\ \n J_heap_base.J_\\ addr2thread_id thread_id2addr jmm_spurious_wakeups jmm_empty jmm_allocate (jmm_typeof_addr P) (jmm_heap_read_typed P) jmm_heap_write P\"\n\n\nlemma jmm_J_heap_conf:\n \"J_heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_write jmm_hconf P\"\nby(unfold_locales)\n\nlemma jmm_J_allocated_heap_conf: \"J_allocated_heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr P) jmm_heap_write jmm_hconf jmm_allocated P\"\nby(unfold_locales)\n\n\nlemma jmm_J_allocated_heap_conf':\n \"J_allocated_heap_conf' addr2thread_id thread_id2addr jmm_empty jmm_allocate (jmm_typeof_addr' P) jmm_heap_write jmm_hconf jmm_allocated P\"\napply(rule J_allocated_heap_conf'.intro)\napply(unfold jmm_typeof_addr'_conv_jmm_typeof_addr)\napply(unfold_locales)\ndone\n\n\nlemma red_heap_read_typedD:\n \"J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P t e s ta e' s' \\\n J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P t e s ta e' s' \\\n (\\ad al v T. ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\ heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ heap_base'.conf TYPE('heap) typeof_addr P v T)\"\n (is \"?lhs1 \\ ?rhs1a \\ ?rhs1b\")\n and reds_heap_read_typedD:\n \"J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P t es s ta es' s' \\\n J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P t es s ta es' s' \\\n (\\ad al v T. ReadMem ad al v \\ set \\ta\\\\<^bsub>o\\<^esub> \\ heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ heap_base'.conf TYPE('heap) typeof_addr P v T)\"\n (is \"?lhs2 \\ ?rhs2a \\ ?rhs2b\")\nproof -\n have \"(?lhs1 \\ ?rhs1a \\ ?rhs1b) \\ (?lhs2 \\ ?rhs2a \\ ?rhs2b)\"\n apply(induct rule: J_heap_base.red_reds.induct)\n prefer 50 (* RedCallExternal *)\n apply(subst (asm) red_external_heap_read_typed)\n apply(fastforce intro!: J_heap_base.red_reds.RedCallExternal simp add: convert_extTA_def)\n\n prefer 49 (* RedCall *)\n apply(fastforce dest: J_heap_base.red_reds.RedCall)\n\n apply(auto intro: J_heap_base.red_reds.intros dest: heap_base.heap_read_typed_into_heap_read heap_base.heap_read_typed_typed dest: heap_base'.addr_loc_type_conv_addr_loc_type[THEN fun_cong, THEN fun_cong, THEN fun_cong, THEN iffD2] heap_base'.conf_conv_conf[THEN fun_cong, THEN fun_cong, THEN iffD1])\n done\n moreover have \"(?rhs1a \\ ?rhs1b \\ ?lhs1) \\ (?rhs2a \\ ?rhs2b \\ ?lhs2)\"\n apply(induct rule: J_heap_base.red_reds.induct)\n prefer 50 (* RedCallExternal *)\n apply simp\n apply(intro strip)\n apply(erule (1) J_heap_base.red_reds.RedCallExternal)\n apply(subst red_external_heap_read_typed, erule conjI)\n apply(blast+)[4]\n\n prefer 49 (* RedCall *)\n apply(fastforce dest: J_heap_base.red_reds.RedCall)\n\n apply(auto intro: J_heap_base.red_reds.intros intro!: heap_base.heap_read_typedI dest: heap_base'.addr_loc_type_conv_addr_loc_type[THEN fun_cong, THEN fun_cong, THEN fun_cong, THEN iffD1] intro: heap_base'.conf_conv_conf[THEN fun_cong, THEN fun_cong, THEN iffD2])\n done\n ultimately show \"?lhs1 \\ ?rhs1a \\ ?rhs1b\" \"?lhs2 \\ ?rhs2a \\ ?rhs2b\" by blast+\nqed\n\nlemma if_mred_heap_read_typedD:\n \"multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P) t xh ta x'h' \\\n if_heap_read_typed final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P) typeof_addr P t xh ta x'h'\"\nunfolding multithreaded_base.init_fin.simps\nby(subst red_heap_read_typedD) fastforce\n\nlemma J_\\_heap_read_typedI:\n \"\\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) heap_read heap_write P C M vs status;\n \\ad al v T. \\ NormalAction (ReadMem ad al v) \\ snd ` lset E; heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \\ \\ heap_base'.conf TYPE('heap) typeof_addr P v T \\\n \\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\\_ :: 'heap. typeof_addr) heap_read P) heap_write P C M vs status\"\napply(erule imageE, hypsubst)\napply(rule imageI)\napply(erule multithreaded_base.\\.cases, hypsubst)\napply(rule multithreaded_base.\\.intros)\napply(subst if_mred_heap_read_typedD[abs_def])\napply(erule if_mthr_Runs_heap_read_typedI)\napply(auto simp add: image_Un lset_lmap[symmetric] lmap_lconcat llist.map_comp o_def split_def simp del: lset_lmap)\ndone\n\nlemma jmm'_redI:\n \"\\ J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P t e s ta e' s'; \n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta \\\n \\ \\ta e' s'. J_heap_base.red' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P t e s ta e' s' \\ final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta\"\n (is \"\\ ?red'; ?aok \\ \\ ?concl\")\n and jmm'_redsI:\n \"\\ J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P t es s ta es' s';\n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta \\\n \\ \\ta es' s'. J_heap_base.reds' addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P t es s ta es' s' \\ \n final_thread.actions_ok (final_thread.init_fin_final final_expr) S t ta\"\n (is \"\\ ?reds'; ?aoks \\ \\ ?concls\")\nproof -\n note [simp del] = split_paired_Ex\n and [simp add] = final_thread.actions_ok_iff heap_base.THE_addr_loc_type heap_base.defval_conf\n and [intro] = jmm_heap_read_typed_default_val\n\n let ?v = \"\\h a al. default_val (THE T. heap_base.addr_loc_type typeof_addr P h a al T)\"\n\n have \"(?red' \\ ?aok \\ ?concl) \\ (?reds' \\ ?aoks \\ ?concls)\"\n proof(induct rule: J_heap_base.red_reds.induct)\n case (23 h a T n i v l) (* RedAAcc *)\n thus ?case by(auto 4 6 intro: J_heap_base.red_reds.RedAAcc[where v=\"?v h a (ACell (nat (sint i)))\"])\n next\n case (35 h a D F v l) (* RedFAcc *)\n thus ?case by(auto 4 5 intro: J_heap_base.red_reds.RedFAcc[where v=\"?v h a (CField D F)\"])\n next\n case RedCASSucceed: (45 h a D F v v' h') (* RedCASSucceed *)\n thus ?case\n proof(cases \"v = ?v h a (CField D F)\")\n case True\n with RedCASSucceed show ?thesis\n by(fastforce intro: J_heap_base.red_reds.RedCASSucceed[where v=\"?v h a (CField D F)\"])\n next\n case False\n with RedCASSucceed show ?thesis\n by(fastforce intro: J_heap_base.red_reds.RedCASFail[where v''=\"?v h a (CField D F)\"])\n qed\n next\n case RedCASFail: (46 h a D F v'' v v' l)\n thus ?case\n proof(cases \"v = ?v h a (CField D F)\")\n case True\n with RedCASFail show ?thesis\n by(fastforce intro: J_heap_base.red_reds.RedCASSucceed[where v=\"?v h a (CField D F)\"] jmm_heap_write.intros)\n next\n case False\n with RedCASFail show ?thesis\n by(fastforce intro: J_heap_base.red_reds.RedCASFail[where v''=\"?v h a (CField D F)\"])\n qed\n next\n case (50 s a hU M Ts T D vs ta va h' ta' e' s') (* RedCallExternal *)\n thus ?case\n apply clarify\n apply(drule jmm'_red_externalI, simp)\n apply(auto 4 4 intro: J_heap_base.red_reds.RedCallExternal)\n done\n next\n case (52 e h l V vo ta e' h' l' T) (* BlockRed *)\n thus ?case\n by(clarify)(iprover intro: J_heap_base.red_reds.BlockRed)\n qed(blast intro: J_heap_base.red_reds.intros)+\n thus \"\\ ?red'; ?aok \\ \\ ?concl\" and \"\\ ?reds'; ?aoks \\ \\ ?concls\" by blast+\nqed\n\nlemma if_mred_heap_read_not_stuck:\n \"\\ multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P) t xh ta x'h';\n final_thread.actions_ok (final_thread.init_fin_final final_expr) s t ta \\\n \\\n \\ta x'h'. multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P) t xh ta x'h' \\ final_thread.actions_ok (final_thread.init_fin_final final_expr) s t ta\"\napply(erule multithreaded_base.init_fin.cases)\n apply hypsubst\n apply clarify\n apply(drule jmm'_redI)\n apply(simp add: final_thread.actions_ok_iff)\n apply clarify\n apply(subst (2) split_paired_Ex)\n apply(subst (2) split_paired_Ex)\n apply(subst (2) split_paired_Ex)\n apply(rule exI conjI)+\n apply(rule multithreaded_base.init_fin.intros)\n apply(simp)\n apply(simp add: final_thread.actions_ok_iff)\n apply(blast intro: multithreaded_base.init_fin.intros)\napply(blast intro: multithreaded_base.init_fin.intros)\ndone\n\nlemma if_mredT_heap_read_not_stuck:\n \"multithreaded_base.redT (final_thread.init_fin_final final_expr) (multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr jmm_heap_read jmm_heap_write P)) convert_RA' s tta s'\n \\ \\tta s'. multithreaded_base.redT (final_thread.init_fin_final final_expr) (multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate typeof_addr (heap_base.heap_read_typed typeof_addr jmm_heap_read P) jmm_heap_write P)) convert_RA' s tta s'\"\napply(erule multithreaded_base.redT.cases)\n apply hypsubst\n apply(drule (1) if_mred_heap_read_not_stuck)\n apply(erule exE)+\n apply(rename_tac ta' x'h')\n apply(insert redT_updWs_total)\n apply(erule_tac x=\"t\" in meta_allE)\n apply(erule_tac x=\"wset s\" in meta_allE)\n apply(erule_tac x=\"\\ta'\\\\<^bsub>w\\<^esub>\" in meta_allE)\n apply clarsimp\n apply(rule exI)+\n apply(auto intro!: multithreaded_base.redT.intros)[1]\napply hypsubst\napply(rule exI conjI)+\napply(rule multithreaded_base.redT.redT_acquire)\napply assumption+\ndone\n\nlemma J_\\_heap_read_typedD:\n \"E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_. typeof_addr) (heap_base.heap_read_typed (\\_. typeof_addr) jmm_heap_read P) jmm_heap_write P C M vs status\n \\ E \\ J_heap_base.J_\\ addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\\_. typeof_addr) jmm_heap_read jmm_heap_write P C M vs status\"\napply(erule imageE, hypsubst)\napply(rule imageI)\napply(erule multithreaded_base.\\.cases, hypsubst)\napply(rule multithreaded_base.\\.intros)\napply(subst (asm) if_mred_heap_read_typedD[abs_def])\napply(erule if_mthr_Runs_heap_read_typedD)\napply(erule if_mredT_heap_read_not_stuck[where typeof_addr=\"\\_. typeof_addr\", unfolded if_mred_heap_read_typedD[abs_def]])\ndone\n\nlemma J_\\_typesafe_subset: \"jmm'_J_\\ P C M vs status \\ jmm_J_\\ P C M vs status\"\nunfolding jmm_typeof_addr_def[abs_def]\nby(rule subsetI)(erule J_\\_heap_read_typedD)\n\nlemma J_legal_typesafe1:\n assumes wfP: \"wf_J_prog P\"\n and ok: \"jmm_wf_start_state P C M vs\"\n and legal: \"legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\n shows \"legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\\"\n and E: \"E \\ ?\\\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n let ?J = \"J(0 := \\committed = {}, justifying_exec = justifying_exec (J 1), justifying_ws = justifying_ws (J 1), action_translation = id\\)\"\n\n from wfP have wf_sys: \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n\n from justified have \"P \\ (justifying_exec (J 1), justifying_ws (J 1)) \\\"\n by(simp add: justification_well_formed_def)\n with justified have \"P \\ (E, ws) justified_by ?J\" by(rule drop_0th_justifying_exec)\n moreover have \"range (justifying_exec \\ ?J) \\ ?\\'\"\n proof\n fix \\\n assume \"\\ \\ range (justifying_exec \\ ?J)\"\n then obtain n where \"\\ = justifying_exec (?J n)\" by auto\n then obtain n where \\: \"\\ = justifying_exec (J n)\" and n: \"n > 0\" by(auto split: if_split_asm)\n from range \\ have \"\\ \\ ?\\\" by auto\n thus \"\\ \\ ?\\'\" unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset \\\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength \\\" \"action_obs \\ a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with J_allocated_heap_conf'.mred_known_addrs_typing'[OF jmm_J_allocated_heap_conf' wfP jmm_start_heap_ok]\n J_heap_conf.J_start_state_sconf_type_ok[OF jmm_J_heap_conf wfP ok]\n wf_sys is_justified_by_imp_is_weakly_justified_by[OF justified wf] range n\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def] \\\n by(rule known_addrs_typing'.read_value_typeable_justifying)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n qed\n moreover from E have \"E \\ ?\\'\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset E\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength E\" \"action_obs E a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with jmm_J_allocated_heap_conf' wfP ok legal_imp_weakly_legal_execution[OF legal]\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n by(rule J_allocated_heap_conf'.J_legal_read_value_typeable)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n ultimately show ?thesis using wf unfolding gen_legal_execution.simps by blast\nqed\n\nlemma J_weakly_legal_typesafe1:\n assumes wfP: \"wf_J_prog P\"\n and ok: \"jmm_wf_start_state P C M vs\"\n and legal: \"weakly_legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\n shows \"weakly_legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) weakly_justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\\"\n and E: \"E \\ ?\\\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n let ?J = \"J(0 := \\committed = {}, justifying_exec = justifying_exec (J 1), justifying_ws = justifying_ws (J 1), action_translation = id\\)\"\n\n from wfP have wf_sys: \"wf_syscls P\" by(rule wf_prog_wf_syscls)\n\n from justified have \"P \\ (justifying_exec (J 1), justifying_ws (J 1)) \\\"\n by(simp add: justification_well_formed_def)\n with justified have \"P \\ (E, ws) weakly_justified_by ?J\" by(rule drop_0th_weakly_justifying_exec)\n moreover have \"range (justifying_exec \\ ?J) \\ ?\\'\"\n proof\n fix \\\n assume \"\\ \\ range (justifying_exec \\ ?J)\"\n then obtain n where \"\\ = justifying_exec (?J n)\" by auto\n then obtain n where \\: \"\\ = justifying_exec (J n)\" and n: \"n > 0\" by(auto split: if_split_asm)\n from range \\ have \"\\ \\ ?\\\" by auto\n thus \"\\ \\ ?\\'\" unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset \\\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength \\\" \"action_obs \\ a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with J_allocated_heap_conf'.mred_known_addrs_typing'[OF jmm_J_allocated_heap_conf' wfP jmm_start_heap_ok]\n J_heap_conf.J_start_state_sconf_type_ok[OF jmm_J_heap_conf wfP ok]\n wf_sys justified range n\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def] \\\n by(rule known_addrs_typing'.read_value_typeable_justifying)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n qed\n moreover from E have \"E \\ ?\\'\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n proof(rule J_\\_heap_read_typedI)\n fix ad al v T\n assume read: \"NormalAction (ReadMem ad al v) \\ snd ` lset E\"\n and adal: \"P \\jmm ad@al : T\"\n from read obtain a where a: \"enat a < llength E\" \"action_obs E a = NormalAction (ReadMem ad al v)\"\n unfolding lset_conv_lnth by(auto simp add: action_obs_def)\n with jmm_J_allocated_heap_conf' wfP ok legal\n have \"\\T. P \\jmm ad@al : T \\ P \\jmm v :\\ T\"\n unfolding jmm_typeof_addr'_conv_jmm_type_addr[symmetric, abs_def]\n by(rule J_allocated_heap_conf'.J_legal_read_value_typeable)\n thus \"P \\jmm v :\\ T\" using adal\n by(auto dest: jmm.addr_loc_type_fun[unfolded jmm_typeof_addr_conv_jmm_typeof_addr', unfolded heap_base'.addr_loc_type_conv_addr_loc_type])\n qed\n ultimately show ?thesis using wf unfolding gen_legal_execution.simps by blast\nqed\n\nlemma J_legal_typesafe2:\n assumes legal: \"legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\n shows \"legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\'\"\n and E: \"E \\ ?\\'\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n from range E have \"range (justifying_exec \\ J) \\ ?\\\" \"E \\ ?\\\"\n using J_\\_typesafe_subset[of P status C M vs] by blast+\n with justified wf\n show ?thesis by(auto simp add: gen_legal_execution.simps)\nqed\n\nlemma J_weakly_legal_typesafe2:\n assumes legal: \"weakly_legal_execution P (jmm'_J_\\ P C M vs status) (E, ws)\"\n shows \"weakly_legal_execution P (jmm_J_\\ P C M vs status) (E, ws)\"\nproof -\n let ?\\ = \"jmm_J_\\ P C M vs status\"\n let ?\\' = \"jmm'_J_\\ P C M vs status\"\n from legal obtain J \n where justified: \"P \\ (E, ws) weakly_justified_by J\"\n and range: \"range (justifying_exec \\ J) \\ ?\\'\"\n and E: \"E \\ ?\\'\" and wf: \"P \\ (E, ws) \\\" by(auto simp add: gen_legal_execution.simps)\n from range E have \"range (justifying_exec \\ J) \\ ?\\\" \"E \\ ?\\\"\n using J_\\_typesafe_subset[of P status C M vs] by blast+\n with justified wf\n show ?thesis by(auto simp add: gen_legal_execution.simps)\nqed\n\ntheorem J_weakly_legal_typesafe:\n assumes \"wf_J_prog P\"\n and \"jmm_wf_start_state P C M vs\"\n shows \"weakly_legal_execution P (jmm_J_\\ P C M vs status) = weakly_legal_execution P (jmm'_J_\\ P C M vs status)\"\napply(rule ext iffI)+\n apply(clarify, erule J_weakly_legal_typesafe1[OF assms])\napply(clarify, erule J_weakly_legal_typesafe2)\ndone\n\ntheorem J_legal_typesafe:\n assumes \"wf_J_prog P\"\n and \"jmm_wf_start_state P C M vs\"\n shows \"legal_execution P (jmm_J_\\ P C M vs status) = legal_execution P (jmm'_J_\\ P C M vs status)\"\napply(rule ext iffI)+\n apply(clarify, erule J_legal_typesafe1[OF assms])\napply(clarify, erule J_legal_typesafe2)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/MM/JMM_J_Typesafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.31742627850202554, "lm_q1q2_score": 0.16367131096948492}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__17_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__17_on_rules imports n_g2kAbsAfter_lemma_on_inv__17\nbegin\nsection{*All lemmas on causal relation between inv__17*}\nlemma lemma_inv__17_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__17 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__17) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__17) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__17_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.31742627204485063, "lm_q1q2_score": 0.1636713076400369}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ExecConcrete\nimports CorresXF\nbegin\n\ndefinition \"exec_transformed (sr :: ('s \\ 't) set) (M :: ('t, 'r) nondet_monad) \\\n \\s. (\\ ((\\(r', t'). {(r, t). r = r' \\ (t, t') \\ sr}) ` (\\ (fst ` M ` {s'. (s, s') \\ sr}))),\n True \\ snd ` M ` {s'. (s, s') \\ sr})\"\n\nlemma in_exec_transformed:\n \"((r, s') \\ fst (exec_transformed sr A s)) = (\\t t'. (s, t) \\ sr \\ (s', t') \\ sr \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_transformed_def)\n apply force\n done\n\nlemma snd_exec_transformed:\n \"snd (exec_transformed sr M s) = (\\x. (s, x) \\ sr \\ snd (M x))\"\n by (clarsimp simp: exec_transformed_def)\n\nlemma exec_transformed_Id [simp]:\n \"exec_transformed Id M = M\"\n apply (auto simp: exec_transformed_def)\n done\n\nlemma exec_transformed_valid_def:\n \"\\ P \\ exec_transformed sr M \\ Q \\ = \\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\\"\n apply (rule iffI [rotated])\n apply (clarsimp simp: image_def split_def valid_def in_exec_transformed)\n apply force\n apply (clarsimp simp: image_def split_def valid_def exec_transformed_def)\n apply (erule allE, erule (1) impE)\n apply (case_tac \"M s\")\n apply (erule_tac allE, erule impE)\n apply (auto intro!: exI)\n done\n\nlemma exec_transformed_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\ \\ \\ P \\ exec_transformed sr M \\ Q \\\"\n apply (subst exec_transformed_valid_def)\n apply simp\n done\n\nlemma exec_transformedE_wp [wp]:\n \"\\ \\s. \\s'. (s', s) \\ sr \\ P s' \\ M \\ \\r s. \\s'. (s', s) \\ sr \\ Q r s' \\,\\ \\r s. \\s'. (s', s) \\ sr \\ E r s' \\\n \\ \\ P \\ exec_transformed sr M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_transformed_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_transformed_no_fail [wp]:\n \"no_fail (\\s. \\s'. (s', s) \\ sr \\ P s') M \\ no_fail P (exec_transformed sr M)\"\n apply (clarsimp simp: no_fail_def snd_exec_transformed)\n apply force\n done\n\nlemmas exec_transformed_wp_nf [wp] =\n validNF [OF exec_transformed_wp exec_transformed_no_fail]\n\nlemma exec_transformed_return_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (return a) \\ P \\\"\n apply wp\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_returnOk_wp [wp]:\n \"\\ \\s. \\s''. (\\s'. (s, s') \\ sr \\ (s'', s') \\ sr) \\ P a s'' \\ exec_transformed sr (returnOk a) \\ P \\,\\ E \\\"\n apply wp\n apply clarsimp\n apply force\n done\n\nlemma exec_transformed_fail_wp_nf [wp]:\n \"\\ \\s. \\ (\\s'. (s, s') \\ sr) \\ exec_transformed sr fail \\ P \\!\"\n apply wp\n apply (clarsimp simp: fail_def no_fail_def)\n apply force\n done\n\nlemma exec_transformed_fail_wp [wp]:\n \"\\ \\_. True \\ exec_transformed st fail \\ P \\\"\n by wp\n\n\n(*\n * Execute the given monad with a concrete state.\n *\n * In particular, we non-determinstically select a concrete state that maps\n * to the current abstract state, execute @{term M}, and then map the resulting\n * states back into the abstract universe.\n *)\ndefinition \"exec_concrete (st :: 't \\ 's) (M :: ('t, 'r) nondet_monad) \\\n \\s. ({(r, t). \\s' t'. s = st s' \\ t = st t' \\ (r, t') \\ fst (M s')},\n \\s'. s = st s' \\ snd (M s'))\"\n\nlemma \"exec_concrete st M = exec_transformed {(s, t). st t = s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_concrete_def exec_transformed_def)\n apply force\n done\n\nlemma in_exec_concrete [monad_eq]:\n \"((r, s') \\ fst (exec_concrete st A s)) = (\\t t'. st t = s \\ st t' = s' \\ (r, t') \\ fst (A t))\"\n apply (clarsimp simp: exec_concrete_def split_def image_def)\n apply force\n done\n\nlemma snd_exec_concrete [monad_eq]:\n \"snd (exec_concrete st M s) = (\\x. st x = s \\ snd (M x))\"\n by (fastforce simp: exec_concrete_def)\n\nlemma exec_concrete_id [simp]:\n \"exec_concrete id M = M\"\n \"exec_concrete (\\a. a) M = M\"\n apply (auto simp: exec_concrete_def)\n done\n\nlemma exec_concrete_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\ \\ \\ P \\ exec_concrete st M \\ Q \\\"\n apply (clarsimp simp: image_def split_def valid_def in_exec_concrete)\n apply force\n done\n\nlemma exec_concreteE_wp [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\,\\ \\r s. E r (st s) \\\n \\ \\ P \\ exec_concrete st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_concrete_wp)\n apply simp\n done\n\nlemma exec_concrete_no_fail [wp]:\n \"no_fail (\\s. P (st s)) M \\ no_fail P (exec_concrete st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_concrete)\n done\n\nlemma exec_concrete_wp_nf [wp]:\n \"\\ \\s. P (st s) \\ M \\ \\r s. Q r (st s) \\! \\ \\ P \\ exec_concrete st M \\ Q \\!\"\n apply rule\n apply (rule exec_concrete_wp)\n apply (erule validNF_valid)\n apply wp\n apply (erule validNF_no_fail)\n done\n\nlemma exec_concrete_return_wp [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\\"\n by wp\n\nlemma exec_concrete_returnOk_wp [wp]:\n \"\\ P a \\ exec_concrete st (returnOk a) \\ P \\,\\ E \\\"\n by wp\n\nlemma exec_concrete_return_wp_nf [wp]:\n \"\\ P a \\ exec_concrete st (return a) \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_concrete st fail \\ P \\!\"\n by wp\n\nlemma exec_concrete_fail_wp [wp]:\n \"\\ \\_. True \\ exec_concrete st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_concrete:\n \"corresXF_simple st (\\r s. r) P (exec_concrete st M) M\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_concrete in_exec_concrete)\n apply force\n done\n\nlemma corresXF_exec_concrete_self:\n \"corresXF st (\\r s. r) (\\r s. r) P (exec_concrete st M) M\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_concrete)\n done\n\nlemma corresXF_exec_concrete [intro?]:\n \"corresXF id ret_xf ex_xf P A C \\ corresXF st ret_xf ex_xf P (exec_concrete st A) C\"\n apply (clarsimp simp: corresXF_def exec_concrete_def split: sum.splits)\n apply safe\n apply (clarsimp simp: image_def split_def)\n apply force\n apply (clarsimp simp: image_def split_def)\n apply force\n done\n\nlemma exec_concrete_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_concrete st M)\"\n apply (subst empty_fail_def)\n apply (clarsimp simp: exec_concrete_def)\n apply (metis empty_failD2 surjective_pairing)\n done\n\n(*\n * Execute the given monad in a modified state.\n *)\ndefinition \"exec_abstract st M \\ \n \\s'. ({(r', t'). \\t. t = st t' \\ (r', t) \\ fst (M (st s'))},\n \\s. s = st s' \\ snd (M (st s')))\"\n\nlemma exec_abstract_transformed:\n \"exec_abstract st M = exec_transformed {(s, t). t = st s} M\"\n apply (rule ext)\n apply (clarsimp simp: exec_transformed_def exec_abstract_def)\n apply blast\n done\n\nlemma in_exec_abstract [monad_eq]:\n \"((r, t) \\ fst (exec_abstract st A s)) = (\\t'. st t = t' \\ (r, t') \\ fst (A (st s)))\"\n by (clarsimp simp: exec_abstract_def split_def image_def)\n\nlemma snd_exec_abstract [monad_eq]:\n \"snd (exec_abstract st M s) = (snd (M (st s)))\"\n by (clarsimp simp: exec_abstract_def)\n\nlemma exec_abstract_id [simp]:\n \"exec_abstract id M = M\"\n \"exec_abstract (\\a. a) M = M\"\n apply (auto simp: exec_abstract_def)\n done\n\nlemma exec_abstract_valid_def:\n \"\\ P \\ exec_abstract st M \\ Q \\ = \\ \\s. \\s'. st s' = s \\ P s' \\ M \\ \\r s. \\t. st t = s \\ Q r t \\\"\n apply (subst exec_abstract_transformed)\n apply (subst exec_transformed_valid_def)\n apply (fastforce simp: valid_def)\n done\n\nlemma exec_abstract_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\\"\n apply (subst exec_abstract_valid_def)\n apply (clarsimp simp: valid_def)\n apply force\n done\n\nlemma exec_abstractE_wp [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\,\\ \\r s. \\t. st t = s \\ E r t \\ \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\,\\ E \\\"\n apply (clarsimp simp: validE_def)\n apply (rule exec_abstract_wp)\n apply (clarsimp simp: valid_def split: sum.splits)\n apply force\n done\n\nlemma exec_abstract_no_fail [wp]:\n \"no_fail (\\s. \\t. st t = s \\ P t) M \\ no_fail P (exec_abstract st M)\"\n apply (clarsimp simp: no_fail_def snd_exec_abstract)\n apply force\n done\n\nlemma exec_abstract_wp_nf [wp]:\n \"\\ \\ P \\ M \\ \\r s. \\t. st t = s \\ Q r t \\! \\\n \\ \\ \\s. P (st s) \\ exec_abstract st M \\ Q \\!\"\n apply rule\n apply (rule exec_abstract_wp)\n apply (erule validNF_valid)\n apply (rule exec_abstract_no_fail)\n apply (rule validNF_no_fail)\n apply (erule validNF_weaken_pre)\n apply force\n done\n\nlemma exec_abstract_return_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_returnOk_wp [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (returnOk a) \\ P \\,\\ E \\\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_return_wp_nf [wp]:\n \"\\ \\s. \\t. st s = st t \\ P a t \\ exec_abstract st (return a) \\ P \\!\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_fail_wp_nf [wp]:\n \"\\ \\s. False \\ exec_abstract st fail \\ P \\!\"\n apply wp\n apply clarsimp\n done\n\nlemma exec_abstract_fail_wp [wp]:\n \"\\ \\_. True \\ exec_abstract st fail \\ P \\\"\n by wp\n\nlemma corresXF_simple_exec_abstract:\n \"corresXF_simple st (\\r s. r) P M (exec_abstract st M)\"\n apply (clarsimp simp: corresXF_simple_def image_def split_def\n snd_exec_abstract in_exec_abstract)\n done\n\nlemma corresXF_exec_abstract_self:\n \"corresXF st (\\r s. r) (\\r s. r) P M (exec_abstract st M)\"\n apply (subst corresXF_simple_corresXF [symmetric])\n apply clarsimp\n apply (rule corresXF_simple_exec_abstract)\n done\n\nlemma corresXF_exec_abstract [intro?]:\n \"corresXF st ret_xf ex_xf P A C \\ corresXF id ret_xf ex_xf P (exec_abstract st A) C\"\n apply (clarsimp simp: corresXF_def exec_abstract_def split: sum.splits)\n done\n\nlemma exec_abstract_empty_fail [wp]:\n \"\\ empty_fail M; \\s. \\x. st x = s \\ \\ empty_fail (exec_abstract st M)\"\n apply (clarsimp simp: empty_fail_def exec_abstract_def)\n apply (metis nonemptyE surjective_pairing)\n done\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/ExecConcrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.31742626558767584, "lm_q1q2_score": 0.16367130431058902}} {"text": "theory Demo\nimports DemoSetup\nbegin\n\ntext \\Spin lock implementation\\\ndefinition newlock :: val where \"newlock \\\n V\\ None: Ref FalseE\"\n \ndefinition acquire :: val where \"acquire \\\n rec: (Some ''acquire'') (Some ''l'') :=\n if: CAS (V ''l'') FalseE TrueE then #[()]\n else App (V ''acquire'') (V ''l'') endif\"\n\ndefinition release :: val where \"release \\\n V\\ (Some ''l''): ((V ''l'') \\ FalseE)\"\n \ncontext \nfixes get_lock :: \"gname \\ 'res::ucamera \\ lockG option\"\n and put_lock\n and get_heap :: \"gname \\ 'res \\ heap_lang_heap option\"\n and put_heap\n and get_inv :: \"gname \\ 'res \\ inv option\"\n and put_inv\n and get_proph :: \"gname \\ 'res \\ (proph_id, val\\val) proph_mapGS option\"\n and put_proph\nassumes lock_inG[lock_inG_axiom]: \"inG get_lock put_lock\"\n and heap_inG[heap_inG_axiom]: \"inG get_heap put_heap\"\n and inv_inG[inv_inG_axiom]: \"inG get_inv put_inv\"\n and prophm_inG[proph_inG_axiom]: \"inG get_proph put_proph\"\nbegin\n\ntext \\Boilerplate setup\\\nlemmas wp_inG[inG_axioms] = inv_inG heap_inG prophm_inG\nabbreviation fancy_upd (\"\\{_,_}=>_\") where \"fancy_upd \\ ViewShift.fancy_upd put_inv\"\nabbreviation wand_fupd (\"_={_,_}=\\<^emph>_\") where \"wand_fupd \\ ViewShift.wand_fupd put_inv\"\nabbreviation wand_linear_fupd (\"_={_}=\\<^emph>_\") where \"wand_linear_fupd \\ ViewShift.wand_linear_fupd put_inv\"\nabbreviation linear_fupd (\"\\{_}=>_\") where \"linear_fupd \\ ViewShift.linear_fupd put_inv\"\nabbreviation points_to_own (\"_\\{#_}_\" 60) where \"points_to_own \\ AuthHeap.points_to_own put_heap\"\nabbreviation points_to_full (infix \"\\\\<^sub>u\" 60) where \"points_to_full \\ AuthHeap.points_to_full put_heap\"\nabbreviation texan2 (\"{{{ _ }}} _ @ _ ; _ {{{ _ }}}\") where \"texan2 \\ WeakestPrecondition.texan2 put_inv put_heap put_proph\"\nabbreviation texan (\"{{{ _ }}} _ {{{ _ }}}\") where \"texan \\ WeakestPrecondition.texan put_inv put_heap put_proph\"\nabbreviation WP (\"WP _ {{ _ }}\") where \"WP e {{ Q }} \\ WeakestPrecondition.WP put_inv put_heap put_proph e Q\"\nabbreviation inv where \"inv \\ Invariant.inv put_inv\"\n\ntext \\Auxiliary predicates\\\ndefinition locked :: \"gname \\ 'res upred_f\" where\n \"locked \\ = own put_lock \\ (Ex ())\"\n\ndefinition lock_inv :: \"gname \\ loc \\ 'res upred_f \\ 'res upred_f\" where\n \"lock_inv \\ l R \\ \\\\<^sub>u b. l\\\\<^sub>u#[b] \\<^emph> ((\\b) \\\\<^sub>u ((\\(\\b)) \\<^emph> (locked \\) \\<^emph> R))\"\n\ndefinition lockN :: namespace where \"lockN \\ add_name nroot (string_to_name ''spin_lock'')\" \ndefinition is_lock :: \"gname \\ val \\ 'res upred_f \\ 'res upred_f\" where\n \"is_lock \\ lk R \\ \\\\<^sub>u l. (\\(lk=#[l])) \\\\<^sub>u inv lockN (lock_inv \\ l R)\"\n\nlemma lock_alloc: \"\\\\<^sub>u \\.\\\\<^sub>b (locked \\)\"\n apply iIntro\n apply (iExistsR \"0::nat\")\n unfolding locked_def\n apply (entails_substR rule: inG.own_alloc[OF lock_inG])\n by (auto simp: valid_def constr_lock_def prod_n_valid_def \\_n_valid valid_raw_ex_def)\n \ndeclare frame_rule_apply[OF upred_entails_trans[OF upred_entails_trans[OF lock_alloc[to_entailment] \n upred_exist_mono[OF upd_fupd[to_entailment]]] fupd_exists_lift[OF inv_inG]], alloc_rule]\nlemmas [iris_simp] = lock_inv_def is_lock_def newlock_def acquire_def release_def\n\ntext \\Specification\\\nlemma newlock_spec:\n \"{{{ emp }}} App newlock #[()] {{{ \\lk. \\\\<^sub>u R. (R ={UNIV}=\\<^emph> (\\\\<^sub>u \\. is_lock \\ lk R)) }}}\"\n \\ \\Reduce the hoare tripple.\\\n apply iIntro\n apply (entails_substR rule: upred_persis_mono[where ?P=upred_emp, unfolded emp_rule])\n apply iForallR\n apply (rule upred_wandI)+\n apply iris_simp\n \\ \\Symbolically execute the call of \\<^term>\\newlock\\.\\\n apply (entails_substR rule: wp_pure_step_later[OF wp_inG pure_exec_beta, simplified])\n apply iris_simp\n apply (rule upred_later_mono)\n \\ \\Symbolically execute the allocation of the heap cell for the lock.\\\n apply (iWP rule: wp_alloc')\n apply (entails_substR rule: wp_value[OF wp_inG])\n \\ \\Use form of entailment to reduce reasoning further.\\\n apply (iApply rule: upred_universal_wand)\n apply iForallR\n apply (rule upred_wandI)\n \\ \\Deallocate invariant on goal side.\\\n apply allocate\n apply (move_sepL \"?l\\\\<^sub>u?f\")\n apply framing\n \\ \\Deallocate the locked ghost predicate.\\\n apply allocate\n apply (iMod rule: fupd_intro[OF inv_inG])\n apply (rule upred_laterI)\n oops\n \nlemma newlock_spec:\n \"{{{ upred_emp }}} App newlock #[()] {{{ \\lk. \\\\<^sub>u R. (R ={UNIV}=\\<^emph> (\\\\<^sub>u \\. is_lock \\ lk R)) }}}\"\n by brute_force_solver\n \nlemma release_spec: \n \"{{{ is_lock \\ lk R \\<^emph> locked \\ \\<^emph> R }}} App release lk {{{ \\_. upred_emp }}}\"\n by brute_force_solver\nend\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/SpinLock/Demo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.3242354055108441, "lm_q1q2_score": 0.163384221540913}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchKHeap_AI\nimports KHeapPre_AI\nbegin\n\ncontext Arch begin global_naming ARM\n\nfun\n non_vspace_obj :: \"kernel_object \\ bool\"\nwhere\n \"non_vspace_obj (ArchObj _) = False\"\n| \"non_vspace_obj _ = True\"\n\n\n\nlemma valid_vspace_objs_lift:\n assumes x: \"\\P. \\\\s. P (vs_lookup s)\\ f \\\\_ s. P (vs_lookup s)\\\"\n assumes y: \"\\ako p. \\\\s. \\ ko_at (ArchObj ako) p s\\ f \\\\rv s. \\ ko_at (ArchObj ako) p s\\\"\n assumes z: \"\\p T. \\typ_at (AArch T) p\\ f \\\\rv. typ_at (AArch T) p\\\"\n shows \"\\valid_vspace_objs\\ f \\\\rv. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (rule hoare_vcg_all_lift, wp hoare_convert_imp[OF x]; (rule hoare_vcg_all_lift | assumption))\n apply (rule hoare_convert_imp[OF y])\n apply (rule valid_vspace_obj_typ[OF z])\n done\n\nlemma vspace_obj_imp: \"non_arch_obj ko \\ non_vspace_obj ko\"\n apply (cases ko; clarsimp)\n apply (rename_tac ako)\n apply (case_tac ako, auto simp: non_arch_obj_def)\n done\n\nlemma non_vspace_objs[intro]:\n \"non_vspace_obj (Endpoint ep)\"\n \"non_vspace_obj (CNode sz cnode_contents)\"\n \"non_vspace_obj (TCB tcb)\"\n \"non_vspace_obj (Notification notification)\"\n by (auto)\n\ndefinition vspace_obj_pred :: \"(kernel_object \\ bool) \\ bool\" where\n \"vspace_obj_pred P \\\n \\ko ko'. non_vspace_obj ko \\ non_vspace_obj ko' \\\n P ko = P ko'\"\n\nlemma vspace_obj_predE:\n \"\\vspace_obj_pred P; non_vspace_obj ko; non_vspace_obj ko'\\ \\ P ko = P ko'\"\n apply (unfold vspace_obj_pred_def)\n apply (erule allE[where ?x=\"ko\"])\n apply (erule allE[where ?x=\"ko'\"])\n by blast\n\nlemmas vspace_obj_pred_defs = non_vspace_objs vspace_obj_pred_def\n\nlemma vspace_pred_imp: \"vspace_obj_pred P \\ arch_obj_pred P\"\n apply (clarsimp simp: arch_obj_pred_def)\n apply (rule vspace_obj_predE)\n apply simp\n apply (rule vspace_obj_imp, assumption)+\n done\n\nlemma vspace_obj_pred_a_type[intro, simp]: \"vspace_obj_pred (\\ko. a_type ko = AArch T)\"\n by (auto simp add: vspace_obj_pred_defs a_type_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemma\n vspace_obj_pred_arch_obj_l[intro, simp]:\n \"vspace_obj_pred (\\ko. ArchObj ako = ko)\" and\n vspace_obj_pred_arch_obj_r[intro, simp]:\n \"vspace_obj_pred (\\ko. ko = ArchObj ako)\"\n apply (simp add: vspace_obj_pred_defs)\n apply (rule allI[OF impI[OF allI[OF impI]]])\n apply (auto simp add: vspace_obj_pred_defs\n split: kernel_object.splits arch_kernel_obj.splits)\ndone\n\nlemma vspace_obj_pred_fun_lift: \"vspace_obj_pred (\\ko. F (vspace_obj_fun_lift P N ko))\"\n by (auto simp: vspace_obj_pred_defs vspace_obj_fun_lift_def\n split: kernel_object.splits arch_kernel_obj.splits)\n\nlemmas vspace_obj_pred_fun_lift_id[simp]\n = vspace_obj_pred_fun_lift[where F=id, simplified]\n\nlemmas vspace_obj_pred_fun_lift_k[intro]\n = vspace_obj_pred_fun_lift[where F=\"K R\" for R, simplified]\n\nlemmas vspace_obj_pred_fun_lift_el[simp]\n = vspace_obj_pred_fun_lift[where F=\"\\ S. x \\ S\" for x, simplified]\n\nlemma vspace_obj_pred_const_conjI[intro]:\n \"vspace_obj_pred P \\\n vspace_obj_pred P' \\\n vspace_obj_pred (\\ko. P ko \\ P' ko)\"\n apply (simp only: vspace_obj_pred_def)\n apply blast\n done\n\nlemma vspace_obj_pred_fI:\n \"(\\x. vspace_obj_pred (P x)) \\ vspace_obj_pred (\\ko. f (\\x :: 'a :: type. P x ko))\"\n apply (simp only: vspace_obj_pred_def)\n apply (intro allI impI)\n apply (rule arg_cong[where f=f])\n by blast\n\ndeclare\n vspace_obj_pred_fI[where f=All, intro]\n vspace_obj_pred_fI[where f=Ex, intro]\n\nend\n\nlocale vspace_only_obj_pred = Arch +\n fixes P :: \"kernel_object \\ bool\"\n assumes vspace_only: \"vspace_obj_pred P\"\n\nsublocale vspace_only_obj_pred < arch_only_obj_pred\n using vspace_pred_imp[OF vspace_only] by unfold_locales\n\ncontext Arch begin global_naming ARM\n\nsublocale empty_table: vspace_only_obj_pred \"empty_table S\" for S\n by unfold_locales (clarsimp simp: vspace_obj_pred_def empty_table_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs: vspace_only_obj_pred \"\\ko. x \\ vs_refs ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_def\n split: arch_kernel_obj.splits kernel_object.splits)\n\nsublocale vs_refs_pages: vspace_only_obj_pred \"\\ko. x \\ vs_refs_pages ko\"\n by unfold_locales (clarsimp simp: vspace_obj_pred_def vs_refs_pages_def\n split: arch_kernel_obj.split kernel_object.splits)\n\nlemma pspace_in_kernel_window_atyp_lift_strong:\n assumes atyp_inv: \"\\P p T. \\ \\s. P (typ_at T p s) \\ f \\ \\rv s. P (typ_at T p s) \\\"\n assumes arch_inv: \"\\P. \\\\s. P (arm_kernel_vspace (arch_state s))\\ f \\\\r s. P (arm_kernel_vspace (arch_state s))\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n apply (simp add: pspace_in_kernel_window_def)\n apply (rule hoare_lift_Pf[where f=\"\\s. arm_kernel_vspace (arch_state s)\", OF _ arch_inv])\n apply (rule hoare_vcg_all_lift)\n apply (simp add: obj_bits_T)\n apply (simp add: valid_def)\n apply clarsimp\n subgoal for _ x s _ _ ko\n apply (cases \"kheap s x\")\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. \\ x\" and T1=\"a_type ko\" and p1=x];\n simp add: obj_at_def a_type_def)\n\n subgoal for ko'\n apply (drule spec[of _ ko'])\n apply (simp add: obj_bits_T)\n apply (frule use_valid[OF _ atyp_inv, where P1= \"\\x. x\" and T1=\"a_type ko'\" and p1=x])\n by (simp add: obj_at_def a_type_def)+\n done\n done\n\nlemma pspace_in_kernel_window_atyp_lift:\n assumes atyp_inv: \"\\P p T. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\\"\n assumes arch_inv: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. pspace_in_kernel_window s\\ f \\\\rv s. pspace_in_kernel_window s\\\"\n by (rule pspace_in_kernel_window_atyp_lift_strong[OF atyp_inv arch_inv])\n\nlemma cap_refs_in_kernel_window_arch_update[simp]:\n \"arm_kernel_vspace (f (arch_state s)) = arm_kernel_vspace (arch_state s)\n \\ cap_refs_in_kernel_window (arch_state_update f s) = cap_refs_in_kernel_window s\"\n by (simp add: cap_refs_in_kernel_window_def)\n\nlemma\n ex_ko_at_def2:\n \"(\\ko. ko_at ko p s \\ P ko) = (obj_at P p s)\"\n by (simp add: obj_at_def)\n\nlemma in_user_frame_obj_pred_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n shows \"\\in_user_frame p\\ f \\\\_. in_user_frame p\\\"\n unfolding in_user_frame_def\n apply (wp hoare_vcg_ex_lift obj_at)\n apply (clarsimp simp: vspace_obj_pred_def)\n apply (auto simp: a_type_def aa_type_def split: kernel_object.splits arch_kernel_obj.splits)\n done\n\nlemma vs_lookup_arch_obj_at_lift:\n assumes obj_at: \"\\P P' p. arch_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup s)\\ f \\\\rv s. P (vs_lookup s)\\\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs.arch_only\n intro!: arch_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup s)\\ f \\\\rv s. P (vs_lookup s)\\\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_pages_arch_obj_at_lift:\n assumes obj_at: \"\\P P' p. arch_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup_pages s)\\ f \\\\rv s. P (vs_lookup_pages s)\\\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs_pages.arch_only\n intro!: arch_obj_pred_fI[where f=Ex])\n\nlemma vs_lookup_pages_vspace_obj_at_lift:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\\\s. P (vs_lookup_pages s)\\ f \\\\rv s. P (vs_lookup_pages s)\\\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (simp add: ex_ko_at_def2)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch_state])\n apply (rule hoare_lift_Pf[where f=\"\\s rs p rs' p'. obj_at (P' p rs rs' p') p s\" for P'])\n apply (rule hoare_vcg_prop)\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)+\n apply (erule use_valid, rule obj_at, simp)\n by (auto simp: vs_refs_pages.vspace_only\n intro!: vspace_obj_pred_fI[where f=Ex])\n\nlemma valid_vspace_objs_lift_weak:\n assumes obj_at: \"\\P P' p. vspace_obj_pred P' \\\n \\\\s. P (obj_at P' p s)\\ f \\\\r s. P (obj_at P' p s)\\\"\n assumes arch_state: \"\\P. \\\\s. P (arch_state s)\\ f \\\\r s. P (arch_state s)\\\"\n shows \"\\valid_vspace_objs\\ f \\\\_. valid_vspace_objs\\\"\n apply (rule valid_vspace_objs_lift)\n apply (rule vs_lookup_vspace_obj_at_lift)\n apply (rule obj_at arch_state vspace_pred_imp; simp)+\n done\n\nlemma set_object_neg_lookup:\n \"\\\\s. \\ (\\rs. (rs \\ p') s) \\ obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p s \\\n set_object p ko\n \\\\_ s. \\ (\\rs. (rs \\ p') s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule_tac x=rs in allE)\n apply (erule notE)\n apply (erule vs_lookup_stateI)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_vs_lookup:\n \"\\\\s. obj_at (\\ko'. vs_refs ko = vs_refs ko') p s \\ P (vs_lookup s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_pt_not_vs_lookup_pages:\n \"\\\\s. \\(ref \\ p') s\n \\ ((\\\\p) s \\ (\\x. case pte_ref_pages (pt x) of\n Some ptr \\\n obj_at (\\ko. vs_refs_pages ko = {}) ptr s \\\n ptr \\ p'\n | None \\ True))\\\n set_object p (ArchObj (PageTable pt))\n \\\\_ s. \\(ref \\ p') s\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (case_tac \"(\\\\p) s\")\n apply (erule notE)\n apply clarsimp\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (erule vs_lookup_pagesI)\n apply (erule converse_rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (rename_tac slot pte)\n apply (erule_tac x=slot in allE)\n apply (drule_tac R=\"vs_lookup_pages1 s\" in rtranclD)\n apply clarsimp\n apply (drule tranclD)\n apply clarsimp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def vs_refs_pages_def)\n apply clarsimp\n apply (erule rtrancl_trans[OF r_into_rtrancl, rotated])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply clarsimp\n apply (erule notE)\n apply (subst (asm) vs_lookup_pages_def)\n apply clarsimp\n apply (rule vs_lookup_pagesI, assumption)\n apply (erule rtrancl_induct)\n apply simp\n apply (drule vs_lookup_pages1D)\n apply (clarsimp simp: obj_at_def split:if_split_asm)\n apply (case_tac \"pa=p\")\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (rename_tac vs slot pte)\n apply (erule_tac x=vs in allE)\n apply (clarsimp simp: vs_lookup_pages_def)\n apply (drule(1) ImageI, erule (1) notE)\n apply clarsimp\n apply (erule rtrancl_trans[OF _ r_into_rtrancl])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n done\n\n\nlemma set_object_vs_lookup_pages:\n \"\\\\s. obj_at (\\ko'. vs_refs_pages ko = vs_refs_pages ko') p s \\ P (vs_lookup_pages s) \\\n set_object p ko\n \\\\_ s. P (vs_lookup_pages s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (rule order_antisym)\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def)\n apply simp\n apply (rule vs_lookup_pages_sub)\n apply (clarsimp simp: obj_at_def split: if_split_asm)\n apply simp\n done\n\nlemma set_object_typ_at:\n \"\\\\s. P (typ_at T p' s)\\\n set_object p obj\n \\\\rv s. P (typ_at T p' s)\\\"\n apply (simp add: set_object_def get_object_def)\n apply wp\n apply clarsimp\n apply (erule rsubst [where P=P])\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma set_object_vspace_objs:\n \"\\valid_vspace_objs and typ_at (a_type ko) p and\n obj_at (\\ko'. vs_refs ko \\ vs_refs ko') p and\n (\\s. case ko of ArchObj ao \\\n (\\\\p)s \\ valid_vspace_obj ao s\n | _ \\ True)\\\n set_object p ko\n \\\\_. valid_vspace_objs\\\"\n apply (simp add: valid_vspace_objs_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift)\n apply (subst imp_conv_disj)\n apply (subst imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift set_object_neg_lookup set_object_neg_ko)\n apply (wp valid_vspace_obj_typ2 [where Q=\"typ_at (a_type ko) p\"] set_object_typ_at\n | simp)+\n apply (clarsimp simp: pred_neg_def obj_at_def)\n apply (case_tac ko; auto)\n done\n\nlemma set_object_valid_kernel_mappings:\n \"\\\\s. valid_kernel_mappings s\n \\ valid_kernel_mappings_if_pd\n (set (arm_global_pts (arch_state s)))\n ko\\\n set_object ptr ko\n \\\\rv. valid_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: valid_kernel_mappings_def\n elim!: ranE split: if_split_asm)\n apply fastforce\n done\n\nlemma valid_vs_lookup_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n shows \"\\valid_vs_lookup\\ f \\\\_. valid_vs_lookup\\\"\n unfolding valid_vs_lookup_def\n apply (rule hoare_lift_Pf [where f=vs_lookup_pages])\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (wp lookup cap)+\n done\n\n\nlemma valid_table_caps_lift:\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes pts: \"\\P. \\\\s. P (second_level_tables (arch_state s))\\ f \\\\_ s. P (second_level_tables (arch_state s))\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_table_caps\\ f \\\\_. valid_table_caps\\\"\n unfolding valid_table_caps_def\n apply (rule hoare_lift_Pf [where f=\"\\s. (caps_of_state s)\"])\n apply (rule hoare_lift_Pf [where f=\"\\s. second_level_tables (arch_state s)\"])\n apply (wp cap pts hoare_vcg_all_lift hoare_vcg_const_imp_lift obj)+\n done\n\nlemma valid_arch_caps_lift:\n assumes lookup: \"\\P. \\\\s. P (vs_lookup_pages s)\\ f \\\\_ s. P (vs_lookup_pages s)\\\"\n assumes cap: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\\"\n assumes pts: \"\\P. \\\\s. P (second_level_tables (arch_state s))\\ f \\\\_ s. P (second_level_tables (arch_state s))\\\"\n assumes obj: \"\\S p. \\obj_at (empty_table S) p\\ f \\\\rv. obj_at (empty_table S) p\\\"\n shows \"\\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n unfolding valid_arch_caps_def\n apply (rule hoare_pre)\n apply (wp valid_vs_lookup_lift valid_table_caps_lift lookup cap pts obj)\n apply simp\n done\n\nlemma valid_global_objs_lift':\n assumes pts: \"\\P. \\\\s. P (arm_global_pts (arch_state s))\\ f \\\\_ s. P (arm_global_pts (arch_state s))\\\"\n assumes pd: \"\\P. \\\\s. P (arm_global_pd (arch_state s))\\ f \\\\_ s. P (arm_global_pd (arch_state s))\\\"\n assumes obj: \"\\p. \\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n assumes ko: \"\\ako p. \\ko_at (ArchObj ako) p\\ f \\\\_. ko_at (ArchObj ako) p\\\"\n assumes emp: \"\\pd S.\n \\\\s. (v \\ pd = arm_global_pd (arch_state s) \\ S = set (second_level_tables (arch_state s)) \\ P s)\n \\ obj_at (empty_table S) pd s\\\n f \\\\rv. obj_at (empty_table S) pd\\\"\n shows \"\\\\s. valid_global_objs s \\ (v \\ P s)\\ f \\\\rv. valid_global_objs\\\"\n unfolding valid_global_objs_def second_level_tables_def\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=\"\\s. arm_global_pts (arch_state s)\", OF pts])\n apply (rule hoare_use_eq [where f=\"\\s. arm_global_pd (arch_state s)\", OF pd])\n apply (wp obj ko emp hoare_vcg_const_Ball_lift hoare_vcg_ex_lift)\n apply (clarsimp simp: second_level_tables_def)\n done\n\nlemmas valid_global_objs_lift\n = valid_global_objs_lift' [where v=False, simplified]\n\ncontext\n fixes f :: \"'a::state_ext state \\ ('b \\ 'a state) set \\ bool\"\n assumes arch: \"\\P. \\\\s. P (arch_state s)\\ f \\\\_ s. P (arch_state s)\\\"\nbegin\n\ncontext\n assumes aobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n notes vspace_obj_fun_lift_expand[simp del]\nbegin\n\nlemma valid_global_vspace_mappings_lift:\n \"\\valid_global_vspace_mappings\\ f \\\\rv. valid_global_vspace_mappings\\\"\n apply (simp add: valid_global_vspace_mappings_def valid_pd_kernel_mappings_def\n del: valid_pd_kernel_mappings_arch_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (rule_tac f=\"valid_pd_kernel_mappings_arch (arm_kernel_vspace x)\" in hoare_lift_Pf)\n apply (rule aobj_at; simp)\n apply (subst valid_pd_kernel_mappings_arch_def valid_pde_kernel_mappings_def)+\n apply (clarsimp simp add: valid_def)\n apply (erule_tac P=P in rsubst)\n apply (rule ext)\n apply (clarsimp intro!: iff_allI split: arch_kernel_obj.splits pde.splits)\n apply (safe; clarsimp simp add: valid_pt_kernel_mappings_def\n simp del: valid_pt_kernel_mappings_arch_def)\n apply (erule use_valid[OF _ aobj_at[where P=\"\\x. x\"]]; simp add:)+\n by (rule classical,\n drule use_valid[OF _ aobj_at[where P=\"\\x. \\x\", OF vspace_obj_pred_fun_lift_id]],\n simp+)+\n\nlemma valid_arch_caps_lift_weak:\n \"(\\P. \\\\s. P (caps_of_state s)\\ f \\\\_ s. P (caps_of_state s)\\) \\\n \\valid_arch_caps\\ f \\\\_. valid_arch_caps\\\"\n apply (rule valid_arch_caps_lift[OF _ _ arch aobj_at])\n apply (rule vs_lookup_pages_vspace_obj_at_lift[OF aobj_at arch], assumption+)\n apply (rule empty_table.vspace_only)\n done\n\nlemma valid_global_objs_lift_weak:\n \"\\valid_global_objs\\ f \\\\rv. valid_global_objs\\\"\n apply (rule valid_global_objs_lift)\n apply (wp arch)+\n apply (simp add: valid_vso_at_def)\n apply (rule hoare_vcg_ex_lift)\n apply (rule hoare_vcg_conj_lift)\n apply (wp aobj_at valid_vspace_obj_typ | simp | rule empty_table.vspace_only)+\n done\n\nlemma valid_asid_map_lift:\n \"\\valid_asid_map\\ f \\\\rv. valid_asid_map\\\"\n apply (simp add: valid_asid_map_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (simp add: vspace_at_asid_def)\n by (rule vs_lookup_vspace_obj_at_lift[OF aobj_at arch])\n\nlemma valid_kernel_mappings_lift:\n \"\\valid_kernel_mappings\\ f \\\\rv. valid_kernel_mappings\\\"\n apply (simp add: valid_kernel_mappings_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (simp add: valid_kernel_mappings_if_pd_def ran_def\n del: valid_kernel_mappings_if_pd_arch_def)\n apply (rule hoare_vcg_all_lift)\n apply (case_tac \"\\ao. xa = ArchObj ao\")\n apply (rule hoare_convert_imp)\n apply clarsimp\n apply (rule hoare_vcg_all_lift)\n subgoal for ao a\n by (rule aobj_at[where P=Not and P'=\"\\x. x = ArchObj ao\", simplified obj_at_def, simplified])\n apply clarsimp\n apply (case_tac ao; simp add: hoare_vcg_prop)\n apply (clarsimp simp del: valid_kernel_mappings_if_pd_arch_def)\n apply (case_tac xa; simp add: hoare_vcg_prop)\n done\n\nend\n\ncontext\n assumes aobj_at:\n \"\\P P' pd. arch_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\nbegin\n\nlemma valid_global_pts_lift:\n \"\\valid_global_pts\\ f \\\\rv. valid_global_pts\\\"\n apply (simp add: valid_global_pts_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (rule hoare_vcg_ball_lift)\n apply (rule aobj_at)\n apply clarsimp\n done\n\nlemma valid_arch_state_lift_aobj_at:\n \"\\valid_arch_state\\ f \\\\rv. valid_arch_state\\\"\n apply (simp add: valid_arch_state_def valid_asid_table_def)\n apply (rule hoare_lift_Pf[where f=\"arch_state\", OF _ arch])\n apply (wp hoare_vcg_conj_lift hoare_vcg_ball_lift valid_global_pts_lift | (rule aobj_at, clarsimp))+\n apply simp\n done\n\nend\nend\n\nlemma equal_kernel_mappings_lift:\n assumes aobj_at:\n \"\\P P' pd. vspace_obj_pred P' \\ \\\\s. P (obj_at P' pd s)\\ f \\\\r s. P (obj_at P' pd s)\\\"\n shows \"\\equal_kernel_mappings\\ f \\\\rv. equal_kernel_mappings\\\"\n apply (simp add: equal_kernel_mappings_def)\n apply (rule hoare_vcg_all_lift)+\n apply (rule hoare_convert_imp)\n apply simp\n apply (rule hoare_convert_imp)\n apply (wp aobj_at[OF vspace_obj_pred_arch_obj_l])+\n done\n\nlemma valid_machine_state_lift:\n assumes memory: \"\\P. \\\\s. P (underlying_memory (machine_state s))\\ f \\\\_ s. P (underlying_memory (machine_state s))\\\"\n assumes aobj_at: \"\\P' pd. arch_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_machine_state\\ f \\\\_. valid_machine_state\\\"\n unfolding valid_machine_state_def\n apply (rule hoare_lift_Pf[where f=\"\\s. underlying_memory (machine_state s)\", OF _ memory])\n apply (rule hoare_vcg_all_lift)\n apply (rule hoare_vcg_disj_lift[OF _ hoare_vcg_prop])\n apply (rule in_user_frame_lift)\n apply (wp aobj_at; simp)\n done\n\nlemma valid_ao_at_lift:\n assumes z: \"\\P p T. \\\\s. P (typ_at (AArch T) p s)\\ f \\\\rv s. P (typ_at (AArch T) p s)\\\"\n and y: \"\\ao. \\\\s. ko_at (ArchObj ao) p s\\ f \\\\rv s. ko_at (ArchObj ao) p s\\\"\n shows \"\\valid_ao_at p\\ f \\\\rv. valid_ao_at p\\\"\n unfolding valid_ao_at_def\n by (wp hoare_vcg_ex_lift y valid_vspace_obj_typ z)\n\nlemma valid_ao_at_lift_aobj_at:\n assumes aobj_at: \"\\P' pd. arch_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_ao_at p\\ f \\\\rv. valid_ao_at p\\\"\n unfolding valid_ao_at_def\n by (wp hoare_vcg_ex_lift valid_vspace_obj_typ aobj_at | clarsimp)+\n\nlemma valid_vso_at_lift:\n assumes z: \"\\P p T. \\\\s. P (typ_at (AArch T) p s)\\ f \\\\rv s. P (typ_at (AArch T) p s)\\\"\n and y: \"\\ao. \\\\s. ko_at (ArchObj ao) p s\\ f \\\\rv s. ko_at (ArchObj ao) p s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n by (wpsimp wp: hoare_vcg_ex_lift y valid_vspace_obj_typ z)+\n\nlemma valid_vso_at_lift_aobj_at:\n assumes aobj_at: \"\\P' pd. vspace_obj_pred P' \\ \\obj_at P' pd\\ f \\\\r s. obj_at P' pd s\\\"\n shows \"\\valid_vso_at p\\ f \\\\rv. valid_vso_at p\\\"\n unfolding valid_vso_at_def\n apply (rule hoare_vcg_ex_lift)\n apply (rule hoare_vcg_conj_lift aobj_at)+\n apply (clarsimp simp: vspace_obj_pred_def)\n apply (rule iffI)\n apply ((case_tac ao; clarsimp)+)[2]\n apply (wpsimp wp: valid_vspace_obj_typ)\n apply (wpsimp wp: aobj_at)\n apply assumption\n done\n\nlemmas set_object_v_ker_map\n = set_object_valid_kernel_mappings\n [unfolded valid_kernel_mappings_if_pd_def]\n\nlemma set_object_asid_map:\n \"\\valid_asid_map and\n obj_at (\\ko'. vs_refs ko' \\ vs_refs ko) p\\\n set_object p ko\n \\\\_. valid_asid_map\\\"\n apply (simp add: valid_asid_map_def set_object_def get_object_def)\n apply wp\n apply (clarsimp simp: vspace_at_asid_def simp del: fun_upd_apply)\n apply (drule bspec, blast)\n apply clarsimp\n apply (rule vs_lookup_stateI, assumption)\n apply (clarsimp simp: obj_at_def)\n apply blast\n apply simp\n done\n\nlemma set_object_equal_mappings:\n \"\\\\s. equal_kernel_mappings s\n \\ (\\pd. ko = ArchObj (PageDirectory pd)\n \\ (\\x pd'. ko_at (ArchObj (PageDirectory pd')) x s\n \\ (\\w \\ kernel_mapping_slots. pd w = pd' w)))\\\n set_object p ko\n \\\\rv. equal_kernel_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def\n split del: if_split)\n apply (simp split: if_split_asm)\n done\n\nlemma valid_global_vspace_mappings_pres:\n \"\\ valid_global_vspace_mappings s;\n \\pd. ko_at (ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s\n \\ ko_at (ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s';\n \\pt p. \\ ko_at (ArchObj (PageTable pt)) p s;\n valid_global_objs s \\ p \\ set (arm_global_pts (arch_state s)) \\\n \\ ko_at (ArchObj (PageTable pt)) p s';\n arm_global_pd (arch_state s') = arm_global_pd (arch_state s);\n arm_kernel_vspace (arch_state s') = arm_kernel_vspace (arch_state s) \\\n \\ valid_global_vspace_mappings s'\"\n apply atomize\n apply (clarsimp simp: valid_global_vspace_mappings_def obj_at_def)\n apply (clarsimp simp: valid_pd_kernel_mappings_def\n split: kernel_object.split_asm arch_kernel_obj.split_asm)\n apply (drule_tac x=x in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def obj_at_def\n valid_pt_kernel_mappings_def pde_ref_def\n split: pde.split_asm)\n apply (simp split: kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply (drule spec, drule spec, drule(1) mp)\n apply (drule mp)\n apply (clarsimp simp: valid_global_objs_def obj_at_def empty_table_def)\n apply (drule_tac x=x in spec)\n apply (simp add: pde_ref_def second_level_tables_def)[1]\n apply clarsimp\n done\n\nlemma valid_global_vspace_mappings_arch_update[simp]:\n \"arm_global_pd (f (arch_state s)) = arm_global_pd (arch_state s)\n \\ arm_kernel_vspace (f (arch_state s)) = arm_kernel_vspace (arch_state s)\n \\ valid_global_vspace_mappings (arch_state_update f s) = valid_global_vspace_mappings s\"\n by (simp add: valid_global_vspace_mappings_def)\n\nlemma set_object_global_vspace_mappings:\n \"\\valid_global_vspace_mappings\n and (\\s. (page_directory_at p s \\ page_table_at p s)\n \\ valid_global_objs s \\ p \\ global_refs s)\\\n set_object p ko\n \\\\rv. valid_global_vspace_mappings\\\"\n apply (wpsimp wp: set_object_wp)\n apply (erule valid_global_vspace_mappings_pres)\n apply (clarsimp simp: obj_at_def a_type_def global_refs_def second_level_tables_def)+\n done\n\n\nlemma valid_table_caps_ptD:\n \"\\ (caps_of_state s) p = Some (ArchObjectCap (arch_cap.PageTableCap p' None));\n page_table_at p' s; valid_table_caps s \\ \\\n \\pt. ko_at (ArchObj (PageTable pt)) p' s \\ valid_vspace_obj (PageTable pt) s\"\n apply (clarsimp simp: valid_table_caps_def simp del: split_paired_All)\n apply (erule allE)+\n apply (erule (1) impE)\n apply (clarsimp simp add: is_pt_cap_def cap_asid_def)\n apply (erule impE, rule refl)\n apply (clarsimp simp: obj_at_def empty_table_def)\n done\n\nlemma store_pde_pred_tcb_at:\n \"\\pred_tcb_at proj P t\\ store_pde ptr val \\\\rv. pred_tcb_at proj P t\\\"\n apply (simp add: store_pde_def set_pd_def get_pd_def)\n apply (wpsimp wp: set_object_wp get_object_wp simp: a_type_def)\n apply (clarsimp simp: pred_tcb_at_def obj_at_def)\n done\n\nlemma empty_table_lift:\n assumes S: \"\\P. \\\\s. P (S s)\\ f \\\\_ s. P (S s)\\\"\n assumes o: \"\\P. \\obj_at P p and Q\\ f \\\\_. obj_at P p\\\"\n shows \"\\\\s. obj_at (empty_table (S s)) p s \\ Q s\\\n f \\\\_ s. obj_at (empty_table (S s)) p s\\\"\n apply (rule hoare_lift_Pf2 [where f=\"S\"])\n apply (wp o S|simp)+\n done\n\nlemma in_user_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_user_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_user_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_user_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma user_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (user_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (user_mem s)\"\n by (clarsimp simp: user_mem_def in_user_frame_obj_upd dom_def)\n\nlemma in_device_frame_obj_upd:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n in_device_frame x (s\\kheap := \\a. if a = p then Some k else kheap s a\\)\n = in_device_frame x s\"\n apply (rule iffI)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (elim disjE)\n apply clarsimp\n apply (intro exI)\n apply (rule conjI,assumption)\n apply (simp add: a_type_def)\n apply (fastforce simp: a_type_def)\n apply (clarsimp simp: in_device_frame_def obj_at_def split: if_split_asm)\n apply (rule_tac x = sz in exI)\n apply (intro conjI impI)\n apply (fastforce simp: a_type_def)+\n done\n\nlemma device_mem_obj_upd_dom:\n \"\\kheap s p = Some ko; a_type k = a_type ko\\ \\\n dom (device_mem (s\\kheap := \\a. if a = p then Some k else kheap s a\\))\n = dom (device_mem s)\"\n by (clarsimp simp: device_mem_def in_device_frame_obj_upd dom_def)\n\nlemma pspace_respects_region_cong[cong]:\n \"\\kheap a = kheap b; device_state (machine_state a) = device_state (machine_state b)\\\n \\ pspace_respects_device_region a = pspace_respects_device_region b\"\n by (simp add: pspace_respects_device_region_def device_mem_def user_mem_def in_device_frame_def\n in_user_frame_def obj_at_def dom_def)\n\ndefinition \"obj_is_device tp dev \\\n case tp of Untyped \\ dev\n | _ \\(case (default_object tp dev 0) of (ArchObj (DataPage dev _)) \\ dev\n | _ \\ False)\"\n\nlemma cap_is_device_obj_is_device[simp]:\n \"cap_is_device (default_cap tp a sz dev) = obj_is_device tp dev\"\n by (simp add: default_cap_def arch_default_cap_def obj_is_device_def\n default_object_def default_arch_object_def\n split: apiobject_type.splits aobject_type.splits)\n\ncrunch device_state_inv: storeWord \"\\ms. P (device_state ms)\"\n (ignore_del: storeWord)\n\n(* some hyp_ref invariants *)\n\nlemma state_hyp_refs_of_ep_update: \"\\s ep val. typ_at AEndpoint ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Endpoint val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def ARM.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_ntfn_update: \"\\s ep val. typ_at ANTFN ep s \\\n state_hyp_refs_of (s\\kheap := kheap s(ep \\ Notification val)\\) = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def ARM.hyp_refs_of_def)\n done\n\nlemma state_hyp_refs_of_tcb_bound_ntfn_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_bound_notification := ntfn\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma state_hyp_refs_of_tcb_state_update:\n \"kheap s t = Some (TCB tcb) \\\n state_hyp_refs_of (s\\kheap := kheap s(t \\ TCB (tcb\\tcb_state := ts\\))\\)\n = state_hyp_refs_of s\"\n apply (rule all_ext)\n apply (clarsimp simp add: ARM.state_hyp_refs_of_def obj_at_def split: option.splits)\n done\n\nlemma arch_valid_obj_same_type:\n \"\\ arch_valid_obj ao s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ arch_valid_obj ao (s\\kheap := kheap s(p \\ k)\\)\"\n by (induction ao rule: arch_kernel_obj.induct;\n clarsimp simp: typ_at_same_type)\n\n\nlemma default_arch_object_not_live: \"\\ live (ArchObj (default_arch_object aty dev us))\"\n by (clarsimp simp: default_arch_object_def live_def hyp_live_def arch_live_def\n split: aobject_type.splits)\n\nlemma default_tcb_not_live: \"\\ live (TCB default_tcb)\"\n by (clarsimp simp: default_tcb_def default_arch_tcb_def live_def hyp_live_def)\n\nlemma valid_arch_tcb_same_type:\n \"\\ valid_arch_tcb t s; valid_obj p k s; kheap s p = Some ko; a_type k = a_type ko \\\n \\ valid_arch_tcb t (s\\kheap := kheap s(p \\ k)\\)\"\n by (auto simp: valid_arch_tcb_def obj_at_def)\n\nlemma valid_ioports_lift:\n assumes x: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\rv s. P (caps_of_state s)\\\"\n assumes y: \"\\P. \\\\s. P (arch_state s)\\ f \\\\rv s. P (arch_state s)\\\"\n shows \"\\valid_ioports\\ f \\\\rv. valid_ioports\\\"\n apply simp\n apply (rule hoare_use_eq [where f=caps_of_state, OF x y])\n done\n\nlemma valid_arch_mdb_lift:\n assumes c: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\r s. P (caps_of_state s)\\\"\n assumes r: \"\\P. \\\\s. P (is_original_cap s)\\ f \\\\r s. P (is_original_cap s)\\\"\n shows \"\\\\s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\ f \\\\r s. valid_arch_mdb (is_original_cap s) (caps_of_state s)\\\"\n apply (clarsimp simp: valid_def)\n done\n\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM/ArchKHeap_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3242353859211693, "lm_q1q2_score": 0.16338421166955497}} {"text": "(*<*) \n\n(* Author: Kyndylan Nienhuis *)\n\ntheory SealCap\n\nimports \n \"UnpredictableBehaviour\"\n \"ExceptionFlag\"\n \"ExecutionStep\"\nbegin\n\n(*>*)\nsection \\Semantics of @{const SealCapAction}\\\n\ndefinition SemanticsSealPost where\n \"SemanticsSealPost authCap cap cd' \\ \n let t = ucast (getBase authCap) + ucast (getOffset authCap) in \n return (\\ getSealed cap \\ \n Permit_Seal (getPerms authCap) \\ \n getTag authCap \\\n \\ getSealed authCap \\\n ucast t \\ RegionOfCap authCap) \\\\<^sub>b\n bind (read_state (getCAPR cd'))\n (\\cap'. return (cap' = setType (setSealed (cap, True), t)))\"\n\nlemma Commute_SemanticsSealPost [Commute_compositeI]:\n assumes \"Commute (read_state (getCAPR cd')) m\"\n shows \"Commute (SemanticsSealPost authCap cap cd') m\"\nunfolding SemanticsSealPost_def\nby (Commute intro: assms)\n\nlemma less_mask_eq_24:\n fixes w :: \"'a::len word\"\n assumes \"w < 16777216\"\n shows \"w AND mask 24 = w\"\nusing assms\nby (intro less_mask_eq) simp\n\nlemma SemanticsSeal_CSeal:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (CSealActions v) (\\prov. return (SealCapAction auth cd cd' \\ prov)))\n (dfn'CSeal v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsSealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nunfolding dfn'CSeal_alt_def CSealActions_def\nunfolding SemanticsSealPost_def\nby (HoareTriple intro: nonExceptionCase_exceptions[THEN HoareTriple_post_weakening])\n (auto simp: not_less not_le\n ucast_plus_down[THEN sym]\n Region_member_simp\n less_mask_eq_24\n split: if_splits)\n\nlemma SemanticsSeal_Run_aux:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions v) (\\prov. return (SealCapAction auth cd cd' \\ prov)))\n (Run v)\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsSealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nunfolding Run_alt_def RunActions_def HoareTriple_def\nusing HoareTripleE[OF SemanticsSeal_CSeal]\nby (auto simp: ValueAndStatePart_simp split: all_split)\n\nlemmas SemanticsSeal_Run =\n HoareTriple_weakest_pre_disj[OF SemanticsSeal_Run_aux\n UndefinedCase_Run]\n\nlemma SemanticsSeal_Fetch:\n fixes auth cd cd' authCap cap cdAccessible cd'Accessible authAccessible\n defines \"p \\ \\w. (return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind (RunActions (Decode w)) (\\ac. return (SealCapAction auth cd cd' \\ ac))\"\n shows \"HoareTriple (bind NextInstruction (case_option (return True) p))\n Fetch\n (\\b. case b of None \\ read_state getExceptionSignalled\n | Some y \\ read_state isUnpredictable \\\\<^sub>b p y)\"\nunfolding p_def\nby (intro HoareTriple_Fetch) Commute+\n\nlemma SemanticsSeal_NextWithGhostState:\n shows \"HoareTriple ((return cap =\\<^sub>b read_state (getCAPR cd)) \\\\<^sub>b\n (return authCap =\\<^sub>b read_state (getCapReg auth)) \\\\<^sub>b\n (return authAccessible =\\<^sub>b read_state (getRegisterIsAccessible auth)) \\\\<^sub>b\n bind DomainActions (\\prov. return (SealCapAction auth cd cd' \\ prov)))\n NextWithGhostState\n (\\_. read_state getExceptionSignalled \\\\<^sub>b\n read_state isUnpredictable \\\\<^sub>b\n SemanticsSealPost authCap cap cd' \\\\<^sub>b\n return authAccessible)\"\nproof -\n note intros = SemanticsSeal_Run[where cap=cap and authCap=authCap and\n auth=auth and cd=cd and cd'=cd' and\n authAccessible=authAccessible] \n SemanticsSeal_Fetch[where cap=cap and authCap=authCap and\n auth=auth and cd=cd and cd'=cd' and\n authAccessible=authAccessible]\n show ?thesis\n unfolding NextWithGhostState_def DomainActions_def\n by (HoareTriple intro: intros[THEN HoareTriple_post_weakening] UndefinedCase_TakeBranch)\n (auto split: option.splits)\nqed\n\ntheorem SemanticsSealCap:\n fixes s auth\n defines \"t \\ ucast (getBase (getCapReg auth s)) + ucast (getOffset (getCapReg auth s))\"\n assumes prov: \"SealCapAction auth cd cd' \\ actions\"\n and suc: \"(PreserveDomain actions, s') \\ SemanticsCheriMips s\"\n shows \"Permit_Seal (getPerms (getCapReg auth s))\"\n \"getTag (getCapReg auth s)\"\n \"\\ getSealed (getCapReg auth s)\"\n \"ucast t \\ RegionOfCap (getCapReg auth s)\"\n \"\\ getSealed (getCAPR cd s)\"\n \"getRegisterIsAccessible auth s\"\n \"getCAPR cd' s' = setType (setSealed ((getCAPR cd s), True), t)\"\nusing prov suc\nusing SemanticsSeal_NextWithGhostState\n [where cap=\"getCAPR cd s\" and cd=cd and cd'=cd' and\n authCap=\"getCapReg auth s\" and auth=auth and\n authAccessible=\"getRegisterIsAccessible auth s\",\n THEN HoareTripleE[where s=s]]\nunfolding t_def SemanticsSealPost_def Let_def\nunfolding SemanticsCheriMips_def Next_NextWithGhostState NextNonExceptionStep_def\nby (auto simp: ValueAndStatePart_simp split: if_splits option.splits)\n\ncorollary SealCapInstantiation:\n assumes \"(lbl, s') \\ SemanticsCheriMips s\"\n shows \"SealCapProp s lbl s'\"\nunfolding SealCapProp_def\nusing assms SemanticsSealCap\nby auto\n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/instantiation/SealCap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.30735802320985245, "lm_q1q2_score": 0.16327146291070216}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__65_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__65_on_rules imports n_g2kAbsAfter_lemma_on_inv__65\nbegin\nsection{*All lemmas on causal relation between inv__65*}\nlemma lemma_inv__65_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__65 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__65) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__65) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__65_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.30735802320985245, "lm_q1q2_score": 0.16327146291070216}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__33_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__33_on_rules imports n_g2kAbsAfter_lemma_on_inv__33\nbegin\nsection{*All lemmas on causal relation between inv__33*}\nlemma lemma_inv__33_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__33 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__33) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__33) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__33_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.30074557894124154, "lm_q1q2_score": 0.16326372793513427}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__23_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__23_on_rules imports n_germanSymIndex_lemma_on_inv__23\nbegin\nsection{*All lemmas on causal relation between inv__23*}\nlemma lemma_inv__23_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__23 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__23) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__23_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3140505514119072, "lm_q1q2_score": 0.16315595762929774}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__44_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__44_on_rules imports n_germanSymIndex_lemma_on_inv__44\nbegin\nsection{*All lemmas on causal relation between inv__44*}\nlemma lemma_inv__44_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__44 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__44) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__44_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.31405054499180746, "lm_q1q2_score": 0.16315595429391908}} {"text": "(* Title: HOL/Auth/n_flash_on_inis.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_on_inis imports n_flash_on_ini\nbegin\nlemma on_inis:\n assumes b1: \"f \\ (invariants N)\" and b2: \"ini \\ {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n shows \"formEval f s\"\n proof -\n have c1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\\\n (f=inv__3 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\\\n (f=inv__8 )\\\n (f=inv__9 )\\\n (f=inv__10 )\\\n (f=inv__11 )\\\n (f=inv__12 )\\\n (f=inv__13 )\\\n (f=inv__14 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\\\n (f=inv__22 )\\\n (f=inv__23 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\\\n (f=inv__25 )\\\n (f=inv__26 )\\\n (f=inv__27 )\\\n (f=inv__28 )\\\n (f=inv__29 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__32 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\\\n (f=inv__35 )\\\n (f=inv__36 )\\\n (f=inv__37 )\\\n (f=inv__38 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\\\n (f=inv__40 )\\\n (f=inv__41 )\\\n (f=inv__42 )\\\n (f=inv__43 )\\\n (f=inv__44 )\\\n (f=inv__45 )\\\n (f=inv__46 )\\\n (f=inv__47 )\\\n (f=inv__48 )\\\n (f=inv__49 )\\\n (f=inv__50 )\\\n (f=inv__51 )\\\n (f=inv__52 )\\\n (f=inv__53 )\\\n (f=inv__54 )\\\n (f=inv__55 )\\\n (f=inv__56 )\\\n (f=inv__57 )\\\n (f=inv__58 )\\\n (f=inv__59 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__60 p__Inv4)\\\n (f=inv__61 )\\\n (f=inv__62 )\\\n (f=inv__63 )\\\n (f=inv__64 )\\\n (f=inv__65 )\\\n (f=inv__66 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__67 p__Inv4)\\\n (f=inv__68 )\\\n (f=inv__69 )\\\n (f=inv__70 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__71 p__Inv4)\\\n (f=inv__72 )\\\n (f=inv__73 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__74 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__75 p__Inv4)\\\n (f=inv__76 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\\\n (f=inv__79 )\\\n (f=inv__80 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\\\n (f=inv__82 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__83 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\\\n (f=inv__85 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__86 p__Inv4)\\\n (f=inv__87 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__88 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__90 p__Inv4)\\\n (f=inv__91 )\\\n (f=inv__92 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__93 p__Inv4)\\\n (f=inv__94 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__95 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__96 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__97 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__98 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__102 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__103 p__Inv4)\\\n (f=inv__104 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\\\n (f=inv__107 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\\\n (f=inv__111 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\\\n (f=inv__113 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__114 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\\\n (f=inv__118 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__119 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__120 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\\\n (f=inv__122 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__123 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__124 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__127 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__128 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__130 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\\\n (f=inv__133 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\\\n (f=inv__135 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__136 p__Inv4)\\\n (f=inv__137 )\\\n (f=inv__138 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__140 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\\\n (f=inv__142 )\\\n (f=inv__143 )\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__144 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\\\n (f=inv__146 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__151 p__Inv4)\\\n (f=inv__152 )\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__153 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__154 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__155 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__160 p__Inv3 p__Inv4)\\\n (\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__161 p__Inv3 p__Inv4)\\\n (\\ p__Inv4. p__Inv4\\N\\f=inv__162 p__Inv4)\"\n apply (cut_tac b1, simp) done\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__1 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__1)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__2 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__2)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__3 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__3)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__4 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__4)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__5 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__5)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__6 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__6)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__7 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__7)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__8 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__8)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__9 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__9)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__10 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__10)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__11 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__11)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__12 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__12)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__13 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__13)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__14 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__14)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__15 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__15)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__16 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__16)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__17 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__17)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__18 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__18)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__19 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__19)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__20 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__20)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__21 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__21)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__22 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__22)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__23 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__23)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__24 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__24)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__25 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__25)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__26 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__26)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__27 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__27)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__28 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__28)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__29 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__29)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__30 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__30)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__31 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__31)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__32 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__32)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__33 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__33)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__34 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__34)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__35 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__35)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__36 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__36)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__37 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__37)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__38 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__38)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__39 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__39)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__40 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__40)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__41 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__41)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__42 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__42)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__43 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__43)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__44 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__44)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__45 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__45)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__46 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__46)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__47 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__47)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__48 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__48)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__49 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__49)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__50 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__50)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__51 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__51)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__52 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__52)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__53 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__53)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__54 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__54)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__55 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__55)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__56 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__56)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__57 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__57)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__58 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__58)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__59 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__59)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__60 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__60)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__61 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__61)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__62 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__62)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__63 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__63)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__64 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__64)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__65 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__65)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__66 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__66)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__67 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__67)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__68 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__68)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__69 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__69)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__70 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__70)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__71 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__71)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__72 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__72)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__73 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__73)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__74 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__74)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__75 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__75)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__76 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__76)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__77 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__77)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__78 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__78)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__79 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__79)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__80 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__80)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__81 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__81)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__82 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__82)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__83 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__83)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__84 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__84)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__85 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__85)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__86 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__86)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__87 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__87)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__88 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__88)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__89 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__89)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__90 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__90)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__91 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__91)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__92 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__92)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__93 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__93)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__94 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__94)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__95 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__95)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__96 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__96)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__97 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__97)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__98 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__98)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__99 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__99)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__100 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__100)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__101 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__101)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__102 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__102)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__103 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__103)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__104 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__104)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__105 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__105)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__106 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__106)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__107 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__107)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__108 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__108)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__109 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__109)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__110 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__110)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__111 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__111)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__112 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__112)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__113 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__113)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__114 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__114)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__115 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__115)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__116 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__116)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__117 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__117)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__118 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__118)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__119 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__119)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__120 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__120)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__121 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__121)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__122 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__122)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__123 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__123)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__124 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__124)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__125)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__126 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__126)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__127 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__127)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__128 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__128)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__129 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__129)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__130 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__130)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__131 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__131)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__132 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__132)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__133 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__133)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__134)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__135 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__135)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__136 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__136)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__137 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__137)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__138 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__138)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__139 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__139)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__140 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__140)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__141 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__141)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__142 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__142)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__143 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__143)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__144 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__144)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__145)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__146 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__146)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__147 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__147)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__148 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__148)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__149 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__149)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__150 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__150)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__151 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__151)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(f=inv__152 )\"\n have \"formEval f s\"\n apply (rule iniImply_inv__152)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__153 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__153)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__154 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__154)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__155 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__155)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__156 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__156)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__157 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__157)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__158 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__158)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__159 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__159)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__160 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__160)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__161 p__Inv3 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__161)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n moreover {\n assume d1: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__162 p__Inv4)\"\n have \"formEval f s\"\n apply (rule iniImply_inv__162)\n apply (cut_tac d1, assumption)\n apply (cut_tac b2 b3, blast) done\n }\n\n ultimately show \"formEval f s\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3140505385717078, "lm_q1q2_score": 0.1631559509585404}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__51_on_rules imports n_german_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__51 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5544704649604274, "lm_q2_score": 0.29421497216298875, "lm_q1q2_score": 0.16313351241353158}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchUntyped_AI\nimports \"../Untyped_AI\"\nbegin\n\ncontext Arch begin global_naming ARM_HYP\n\nnamed_theorems Untyped_AI_assms\n\nlemma of_bl_nat_to_cref[Untyped_AI_assms]:\n \"\\ x < 2 ^ bits; bits < word_bits \\\n \\ (of_bl (nat_to_cref bits x) :: machine_word) = of_nat x\"\n apply (clarsimp intro!: less_mask_eq\n simp: nat_to_cref_def of_drop_to_bl\n word_size word_less_nat_alt word_bits_def)\n apply (subst unat_of_nat)\n apply (erule order_le_less_trans [OF mod_less_eq_dividend])\n done\n\n\nlemma cnode_cap_ex_cte[Untyped_AI_assms]:\n \"\\ is_cnode_cap cap; cte_wp_at (\\c. \\m. cap = mask_cap m c) p s;\n (s::'state_ext::state_ext state) \\ cap; valid_objs s; pspace_aligned s \\ \\\n ex_cte_cap_wp_to is_cnode_cap (obj_ref_of cap, nat_to_cref (bits_of cap) x) s\"\n apply (simp only: ex_cte_cap_wp_to_def)\n apply (rule exI, erule cte_wp_at_weakenE)\n apply (clarsimp simp: is_cap_simps bits_of_def)\n apply (case_tac c, simp_all add: mask_cap_def cap_rights_update_def split:bool.splits)\n apply (clarsimp simp: nat_to_cref_def word_bits_def)\n apply (erule(2) valid_CNodeCapE)\n apply (simp add: word_bits_def cte_level_bits_def)\n done\n\n\n\nlemma inj_on_nat_to_cref[Untyped_AI_assms]:\n \"bits < word_bits \\ inj_on (nat_to_cref bits) {..< 2 ^ bits}\"\n apply (rule inj_onI)\n apply (drule arg_cong[where f=\"\\x. replicate (word_bits - bits) False @ x\"])\n apply (subst(asm) word_bl.Abs_inject[where 'a=32, symmetric])\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: of_bl_rep_False of_bl_nat_to_cref)\n apply (erule word_unat.Abs_eqD)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp_all add: word_bits_def)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp+)\n done\n\n\nlemma data_to_obj_type_sp[Untyped_AI_assms]:\n \"\\P\\ data_to_obj_type x \\\\ts (s::'state_ext::state_ext state). ts \\ ArchObject ASIDPoolObj \\ P s\\, -\"\n unfolding data_to_obj_type_def\n apply (rule hoare_pre)\n apply (wp|wpc)+\n apply clarsimp\n apply (simp add: arch_data_to_obj_type_def split: if_split_asm)\n done\n\nlemma dui_inv_wf[wp, Untyped_AI_assms]:\n \"\\invs and cte_wp_at ((=) (cap.UntypedCap dev w sz idx)) slot\n and (\\(s::'state_ext::state_ext state). \\cap \\ set cs. is_cnode_cap cap\n \\ (\\r\\cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\n and (\\s. \\x \\ set cs. s \\ x)\\\n decode_untyped_invocation label args slot (cap.UntypedCap dev w sz idx) cs\n \\valid_untyped_inv\\,-\"\nproof -\n have inj: \"\\node_cap s. \\is_cnode_cap node_cap;\n unat (args ! 5) \\ 2 ^ bits_of node_cap - unat (args ! 4);valid_cap node_cap s\\ \\\n inj_on (Pair (obj_ref_of node_cap) \\ nat_to_cref (bits_of node_cap))\n {unat (args ! 4)..S a f s. (\\x\\S. cte_wp_at ((=) cap.NullCap) (a, f x) s)\n \\ cte_wp_at (\\c. c \\ cap.NullCap) slot s\n \\ slot \\ (Pair a \\ f) ` S\"\n by (auto simp: cte_wp_at_caps_of_state)\n show ?thesis\n apply (simp add: decode_untyped_invocation_def unlessE_def[symmetric]\n unlessE_whenE\n split del: if_split)\n apply (rule validE_R_sp[OF whenE_throwError_sp]\n validE_R_sp[OF data_to_obj_type_sp]\n validE_R_sp[OF dui_sp_helper] validE_R_sp[OF map_ensure_empty])+\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp[THEN validE_validE_R] check_children_wp map_ensure_empty_wp)\n apply (clarsimp simp: distinct_map cases_imp_eq)\n apply (subgoal_tac \"s \\ node_cap\")\n prefer 2\n apply (erule disjE)\n apply (drule bspec [where x = \"cs ! 0\"],clarsimp)+\n apply fastforce\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply simp\n apply (subgoal_tac \"\\r\\cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s\")\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule(1) caps_of_state_valid[rotated])\n apply (clarsimp simp: not_less)\n apply (frule(2) inj)\n apply (clarsimp simp: comp_def)\n apply (frule(1) caps_of_state_valid)\n apply (simp add: nasty_strengthen[unfolded o_def] cte_wp_at_caps_of_state)\n apply (intro conjI)\n apply (intro impI)\n apply (frule range_cover_stuff[where w=w and rv = 0 and sz = sz], simp_all)[1]\n apply (clarsimp simp: valid_cap_simps cap_aligned_def)+\n apply (frule alignUp_idem[OF is_aligned_weaken,where a = w])\n apply (erule range_cover.sz)\n apply (simp add: range_cover_def)\n apply (clarsimp simp: get_free_ref_def empty_descendants_range_in)\n apply (rule conjI[rotated], blast, clarsimp)\n apply (drule_tac x = \"(obj_ref_of node_cap,nat_to_cref (bits_of node_cap) slota)\" in bspec)\n apply (clarsimp simp: is_cap_simps nat_to_cref_def word_bits_def\n bits_of_def valid_cap_simps cap_aligned_def)+\n apply (simp add: free_index_of_def)\n apply (frule(1) range_cover_stuff[where sz = sz])\n apply (clarsimp dest!: valid_cap_aligned simp:cap_aligned_def word_bits_def)+\n apply simp+\n apply (clarsimp simp: get_free_ref_def)\n apply (erule disjE)\n apply (drule_tac x= \"cs!0\" in bspec)\n subgoal by clarsimp\n subgoal by simp\n apply (clarsimp simp: cte_wp_at_caps_of_state ex_cte_cap_wp_to_def)\n apply (rule_tac x=aa in exI,rule exI,rule exI)\n apply (rule conjI, assumption)\n apply simp\n done\nqed\n\nlemma asid_bits_ge_0:\n \"(0::word32) < 2 ^ asid_bits\" by (simp add: asid_bits_def)\n\nlemma retype_ret_valid_caps_captable[Untyped_AI_assms]:\n \"\\pspace_no_overlap_range_cover ptr sz (s::'state_ext::state_ext state) \\ 0 < us\n \\ range_cover ptr sz (obj_bits_api CapTableObject us) n \\ ptr \\ 0\n \\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object CapTableObject dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api CapTableObject us)) [0.. \\ CNodeCap (ptr_add ptr (y * 2 ^ obj_bits_api CapTableObject us)) us []\"\nby ((clarsimp simp:valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def slot_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def | rule conjI | intro conjI obj_at_foldr_intro imageI\n | rule is_aligned_add_multI[OF _ le_refl],\n (simp add:range_cover_def word_bits_def obj_bits_api_def slot_bits_def)+)+)[1]\n\nlemma retype_ret_valid_caps_aobj[Untyped_AI_assms]:\n \"\\ptr sz (s::'state_ext::state_ext state) x6 us n.\n \\pspace_no_overlap_range_cover ptr sz s \\ x6 \\ ASIDPoolObj \\\n range_cover ptr sz (obj_bits_api (ArchObject x6) us) n \\ ptr \\ 0\\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object (ArchObject x6) dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api (ArchObject x6) us)) [0.. \\ ArchObjectCap (ARM_A.arch_default_cap x6 (ptr_add ptr (y * 2 ^ obj_bits_api (ArchObject x6) us)) us dev)\"\n apply (rename_tac aobject_type us n)\n apply (case_tac aobject_type)\nby (clarsimp simp:valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def slot_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def | intro conjI obj_at_foldr_intro\n imageI valid_vm_rights_def\n | rule is_aligned_add_multI[OF _ le_refl]\n | fastforce simp:range_cover_def obj_bits_api_def\n default_arch_object_def valid_vm_rights_def word_bits_def a_type_def)+\n\n\nlemma copy_global_mappings_hoare_lift:(*FIXME: arch_split \\ these do not seem to be used globally *)\n assumes wp: \"\\ptr val. \\Q\\ store_pde ptr val \\\\rv. Q\\\"\n shows \"\\Q\\ copy_global_mappings pd \\\\rv. Q\\\"\n apply (simp add: copy_global_mappings_def)\n done\n\nlemma init_arch_objects_hoare_lift:\n assumes wp: \"\\oper. \\(P::'state_ext::state_ext state\\bool)\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\ptr val. \\P\\ store_pde ptr val \\\\rv. P\\\"\n shows \"\\P and Q\\ init_arch_objects tp ptr sz us adds \\\\rv. Q\\\"\nproof -\n have pres: \"\\oper. \\P and Q\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\P and Q\\ return () \\\\rv. Q\\\"\n by (wp wp | simp)+\n show ?thesis\n apply (simp add: init_arch_objects_def\n pres reserve_region_def\n split: Structures_A.apiobject_type.split\n aobject_type.split)\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' copy_global_mappings_hoare_lift wp)\n apply simp\n done\nqed\n\n\ncrunch pdistinct[wp]: do_machine_op \"pspace_distinct\"\ncrunch vmdb[wp]: do_machine_op \"valid_mdb\"\ncrunch mdb[wp]: do_machine_op \"\\s. P (cdt s)\"\ncrunch cte_wp_at[wp]: do_machine_op \"\\s. P (cte_wp_at P' p s)\"\n\nlemma cap_refs_in_kernel_windowD2:\n \"\\ cte_wp_at P p (s::'state_ext::state_ext state); cap_refs_in_kernel_window s \\\n \\ \\cap. P cap \\ region_in_kernel_window (cap_range cap) s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state region_in_kernel_window_def)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply fastforce\n done\n\nlemma init_arch_objects_descendants_range[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). descendants_range x cref s \\ init_arch_objects ty ptr n us y\n \\\\rv s. descendants_range x cref s\\\"\n apply (simp add:descendants_range_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply (wps do_machine_op_mdb)\n apply (wp hoare_vcg_ball_lift)\n apply (rule hoare_pre)\n apply (wps store_pde_mdb_inv)\n apply wp\n apply simp\n apply fastforce\n done\n\nlemma init_arch_objects_caps_overlap_reserved[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). caps_overlap_reserved S s\\\n init_arch_objects ty ptr n us y\n \\\\rv s. caps_overlap_reserved S s\\\"\n apply (simp add:caps_overlap_reserved_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply fastforce\n done\n\nlemma set_untyped_cap_invs_simple[Untyped_AI_assms]:\n \"\\\\s. descendants_range_in {ptr .. ptr+2^sz - 1} cref s \\ pspace_no_overlap_range_cover ptr sz s \\ invs s\n \\ cte_wp_at (\\c. is_untyped_cap c \\ cap_bits c = sz \\ obj_ref_of c = ptr \\ cap_is_device c = dev) cref s \\ idx \\ 2^ sz\\\n set_cap (cap.UntypedCap dev ptr sz idx) cref\n \\\\rv s. invs s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp set_free_index_valid_pspace_simple set_cap_valid_mdb_simple\n set_cap_idle update_cap_ifunsafe)\n apply (simp add:valid_irq_node_def)\n apply wps\n apply (wp hoare_vcg_all_lift set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_irq_handlers cap_table_at_lift_valid set_cap_typ_at\n set_untyped_cap_refs_respects_device_simple)\n apply (clarsimp simp:cte_wp_at_caps_of_state is_cap_simps)\n apply (intro conjI, clarsimp)\n apply (rule ext, clarsimp simp:is_cap_simps)\n apply (clarsimp split:cap.splits simp:is_cap_simps appropriate_cte_cap_def)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (clarsimp simp:is_cap_simps ex_cte_cap_wp_to_def appropriate_cte_cap_def cte_wp_at_caps_of_state)\n apply (clarsimp dest!:valid_global_refsD2 simp:cap_range_def)\n apply (simp add:valid_irq_node_def)\n apply (clarsimp simp:valid_irq_node_def)\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state vs_cap_ref_def)\n apply (case_tac cap)\n apply (simp_all add:vs_cap_ref_def table_cap_ref_def)\n apply (rename_tac arch_cap)\n apply (case_tac arch_cap)\n apply simp_all\n apply (clarsimp simp:cap_refs_in_kernel_window_def\n valid_refs_def simp del:split_paired_All)\n apply (drule_tac x = cref in spec)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply fastforce\n done\n\n\nlemma pbfs_atleast_pageBits':\n \"pageBits \\ pageBitsForSize sz\"by (cases sz, simp_all add: pageBits_def)\n\n\nlemma pbfs_less_wb':\n \"pageBitsForSize sz < word_bits\"by (cases sz, simp_all add: word_bits_conv pageBits_def)\n\nlemma delete_objects_rewrite[Untyped_AI_assms]:\n \"\\word_size_bits \\ sz; sz \\ word_bits; ptr && ~~ mask sz = ptr\\\n \\ delete_objects ptr sz =\n do y \\ modify (clear_um {ptr + of_nat k |k. k < 2 ^ sz});\n modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})\n od\"\n apply (clarsimp simp: delete_objects_def freeMemory_def)\n apply (subgoal_tac \"is_aligned (ptr &&~~ mask sz) sz\")\n apply (subst mapM_storeWord_clear_um)\n apply (simp)\n apply simp\n apply (simp add:range_cover_def)\n apply clarsimp\n apply (rule is_aligned_neg_mask)\n apply simp\n done\n\ndeclare store_pde_pred_tcb_at [wp]\n\n(* nonempty_table *)\ndefinition\n nonempty_table :: \"machine_word set \\ Structures_A.kernel_object \\ bool\"\nwhere\n \"nonempty_table S ko \\\n (a_type ko = AArch APageTable \\ a_type ko = AArch APageDirectory)\n \\ \\ empty_table S ko\"\n\nlemma reachable_pg_cap_exst_update[simp]:\n \"reachable_pg_cap x (trans_state f (s::'state_ext::state_ext state)) = reachable_pg_cap x s\"\n by (simp add:reachable_pg_cap_def vs_lookup_pages_def\n vs_lookup_pages1_def obj_at_def)\n\nlemma create_cap_valid_arch_caps[wp, Untyped_AI_assms]:\n \"\\valid_arch_caps\n and valid_cap (default_cap tp oref sz dev)\n and (\\(s::'state_ext::state_ext state). \\r\\obj_refs (default_cap tp oref sz dev).\n (\\p'. \\ cte_wp_at (\\cap. r \\ obj_refs cap) p' s)\n \\ \\ obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n and cte_wp_at ((=) cap.NullCap) cref\n and K (tp \\ ArchObject ASIDPoolObj)\\\n create_cap tp sz p dev (cref, oref) \\\\rv. valid_arch_caps\\\"\n apply (simp add: create_cap_def set_cdt_def)\n apply (wp set_cap_valid_arch_caps hoare_vcg_disj_lift\n hoare_vcg_conj_lift hoare_vcg_all_lift hoare_vcg_imp_lift\n | simp add: trans_state_update[symmetric] del: trans_state_update split_paired_All split_paired_Ex imp_disjL split del: if_split)+\n apply (clarsimp simp del: split_paired_All split_paired_Ex\n imp_disjL\n simp: cte_wp_at_caps_of_state)\n apply (rule conjI)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply (case_tac cref, fastforce)\n apply (simp add: obj_ref_none_no_asid)\n apply (rule conjI)\n apply (auto simp: is_cap_simps valid_cap_def second_level_tables_def\n obj_at_def nonempty_table_def a_type_simps)[1]\n apply (clarsimp simp del: imp_disjL)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply fastforce\n apply (auto simp: is_cap_simps)[1]\n done\n\nlemma create_cap_cap_refs_in_kernel_window[wp, Untyped_AI_assms]:\n \"\\cap_refs_in_kernel_window and cte_wp_at (\\c. cap_range (default_cap tp oref sz dev) \\ cap_range c) p\\\n create_cap tp sz p dev (cref, oref) \\\\rv. cap_refs_in_kernel_window\\\"\n apply (simp add: create_cap_def)\n apply (wp | simp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply blast\n done\n\ncrunch irq_node[wp]: store_pde \"\\s. P (interrupt_irq_node s)\"\n (wp: crunch_wps)\n\n(* make these available in the generic theory? *)\nlemma init_arch_objects_irq_node[wp]:\n \"\\\\s. P (interrupt_irq_node s)\\ init_arch_objects tp ptr bits us refs \\\\rv s. P (interrupt_irq_node s)\\\"\n by (wp init_arch_objects_hoare_lift, simp)\n\nlemma init_arch_objects_excap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ init_arch_objects tp ptr bits us refs \\\\rv. ex_cte_cap_wp_to P p\\\"\n by (wp ex_cte_cap_to_pres init_arch_objects_irq_node init_arch_objects_cte_wp_at)\n(**)\n\ncrunch nonempty_table[wp]: do_machine_op\n \"\\s. P' (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\"\n\nlemma store_pde_weaken:\n \"\\\\s. page_directory_at (p && ~~ mask pd_bits) s \\ P s\\ store_pde p e \\Q\\ =\n \\P\\ store_pde p e \\Q\\\"\n apply (rule iffI)\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (rule use_valid, assumption)\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps vspace_bits_defs)\n apply (drule bspec, assumption)\n apply (simp add: simpler_store_pde_def obj_at_def fun_upd_def vspace_bits_defs\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n done\n\n(* ARMHYP not needed anymore?\nlemma store_pde_nonempty_table:\n \"\\\\s. \\ (obj_at (nonempty_table {}) r s)\n \\ (\\rf. pde_ref pde = Some rf \\\n rf \\ {})\n \\ valid_pde_mappings pde\\\n store_pde pde_ptr pde\n \\\\rv s. \\ (obj_at (nonempty_table {}) r s)\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def nonempty_table_def a_type_def)\n apply (clarsimp simp add: empty_table_def vspace_bits_defs)\n done *)\n\n(*\nlemma valid_arch_state_global_pd: (* ARMHYP restate? *)\n \"\\ valid_arch_state s; pspace_aligned s \\\n \\ obj_at (\\ko. \\pd. ko = ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s\n \\ is_aligned (arm_global_pd (arch_state s)) pd_bits\"\n apply (clarsimp simp: valid_arch_state_def a_type_def\n pd_aligned pd_bits_def pageBits_def\n elim!: obj_at_weakenE)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm if_split_asm)\n done\n*)\nlemma pd_shifting':\n \"is_aligned (pd :: word32) pd_bits \\ pd + (vptr >> pageBits + pt_bits - pte_bits << pde_bits) && ~~ mask pd_bits = pd\"\n by (rule pd_shifting, simp add: vspace_bits_defs)\n\nlemma copy_global_mappings_nonempty_table: (* ARMHYP need change *)\n \"is_aligned pd pd_bits \\\n \\\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \\\n valid_arch_state s \\ pspace_aligned s\\\n copy_global_mappings pd\n \\\\rv s. \\ (obj_at (nonempty_table\n (set (second_level_tables (arch_state s)))) r s) \\\n valid_arch_state s \\ pspace_aligned s\\\"\n apply (simp add: copy_global_mappings_def)\n done\n\n\nlemma mapM_copy_global_mappings_nonempty_table[wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\pd\\set pds. is_aligned pd pd_bits)\\\n mapM_x copy_global_mappings pds\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp', rule copy_global_mappings_nonempty_table)\n apply simp_all\n done\n\nlemma init_arch_objects_nonempty_table[Untyped_AI_assms, wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\ref\\set refs. is_aligned ref (obj_bits_api tp us))\\\n init_arch_objects tp ptr bits us refs\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: init_arch_objects_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp hoare_unless_wp | wpc | simp add: reserve_region_def)+\n apply (clarsimp simp: obj_bits_api_def default_arch_object_def pd_bits_def pageBits_def)\n done\n\n\nlemma nonempty_table_caps_of[Untyped_AI_assms]:\n \"nonempty_table S ko \\ caps_of ko = {}\"\n by (auto simp: caps_of_def cap_of_def nonempty_table_def a_type_def\n split: Structures_A.kernel_object.split if_split_asm)\n\n\nlemma nonempty_default[simp, Untyped_AI_assms]:\n \"tp \\ Untyped \\ \\ nonempty_table S (default_object tp dev us)\"\n apply (case_tac tp, simp_all add: default_object_def nonempty_table_def\n a_type_def)\n apply (rename_tac aobject_type)\n apply (case_tac aobject_type, simp_all add: default_arch_object_def)\n apply (simp_all add: empty_table_def pde_ref_def valid_pde_mappings_def)\n done\n\nlemma set_pd_cte_wp_at_iin[wp]:\n \"\\\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\n set_pd q pd\n \\\\_ s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\"\n apply (simp add: set_pd_def set_object_def a_type_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def cte_wp_at_caps_of_state\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (subst caps_of_state_after_update)\n apply (simp add: obj_at_def)+\n done\n\ncrunch cte_wp_at_iin[wp]: init_arch_objects\n \"\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\"\n (ignore: clearMemory wp: crunch_wps)\n\nlemmas init_arch_objects_ex_cte_cap_wp_to\n = init_arch_objects_excap\n\nlemma obj_is_device_vui_eq[Untyped_AI_assms]:\n \"valid_untyped_inv ui s\n \\ case ui of Retype slot reset ptr_base ptr tp us slots dev\n \\ obj_is_device tp dev = dev\"\n apply (cases ui, clarsimp)\n apply (clarsimp simp: obj_is_device_def\n split: apiobject_type.split)\n apply (intro impI conjI allI, simp_all add: is_frame_type_def default_object_def)\n apply (simp add: default_arch_object_def split: aobject_type.split)\n apply (auto simp: arch_is_frame_type_def)\n done\n\nlemma create_cap_ioports[wp, Untyped_AI_assms]:\n \"\\valid_ioports and cte_wp_at (\\_. True) cref\\ create_cap tp sz p dev (cref,oref) \\\\rv. valid_ioports\\\"\n by wpsimp\n\nend\n\nglobal_interpretation Untyped_AI? : Untyped_AI\n where nonempty_table = ARM_HYP.nonempty_table\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (unfold_locales; (fact Untyped_AI_assms)?)\n qed\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM_HYP/ArchUntyped_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.27512972382317524, "lm_q1q2_score": 0.16306019796458351}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory StateRelation_C\nimports Wellformed_C\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n \"lifth p s \\ the (clift (t_hrs_' s) p)\"\n\ndefinition\n \"array_relation r n a c \\ \\i \\ n. r (a i) (index c (unat i))\"\n\n(* used for bound ntfn/tcb *)\ndefinition\n \"option_to_ctcb_ptr x \\ case x of None \\ NULL | Some t \\ tcb_ptr_to_ctcb_ptr t\"\n\n\ndefinition\n byte_to_word_heap :: \"(word32 \\ word8) \\ (word32 \\ 10 word \\ word32)\"\n where\n \"byte_to_word_heap m base off \\ let (ptr :: word32) = base + (ucast off * 4) in\n word_rcat [m (ptr + 3), m (ptr + 2), m (ptr + 1), m ptr]\"\n\ndefinition\n heap_to_user_data :: \"(word32 \\ kernel_object option) \\ (word32 \\ word8) \\ (word32 \\ (10 word \\ word32) option)\"\n where\n \"heap_to_user_data hp bhp \\ \\p. let (uhp :: word32 \\ user_data option) = (projectKO_opt \\\\<^sub>m hp) in\n option_map (\\_. byte_to_word_heap bhp p) (uhp p)\"\n\ndefinition\n heap_to_device_data :: \"(word32 \\ kernel_object option) \\ (word32 \\ word8) \\ (word32 \\ (10 word \\ word32) option)\"\n where\n \"heap_to_device_data hp bhp \\ \\p. let (uhp :: word32 \\ user_data_device option) = (projectKO_opt \\\\<^sub>m hp) in\n option_map (\\_. byte_to_word_heap bhp p) (uhp p)\"\n\n\ndefinition\n cmap_relation :: \"(word32 \\ 'a) \\ 'b typ_heap \\ (word32 \\ 'b ptr) \\ ('a \\ 'b \\ bool) \\ bool\"\n where\n \"cmap_relation as cs addr_fun rel \\\n (addr_fun ` (dom as) = dom cs) \\\n (\\x \\ dom as. rel (the (as x)) (the (cs (addr_fun x))))\"\n\ndefinition\n carray_map_relation :: \"nat \\ (word32 \\ ('a :: pre_storable))\n \\ ('b ptr \\ bool) \\ (word32 \\ 'b ptr) \\ bool\"\nwhere\n \"carray_map_relation bits as cs addr_fun \\\n (\\p. (is_aligned p bits \\ (\\p'. p' && ~~ mask bits = p \\ is_aligned p' (objBits (the (as p')))\n \\ p' \\ dom as)) \\ cs (addr_fun p))\"\n\ndefinition\n cvariable_array_map_relation :: \"(word32 \\ 'a) \\ ('a \\ nat)\n \\ (word32 \\ ('c :: c_type) ptr) \\ heap_typ_desc \\ bool\"\nwhere\n \"cvariable_array_map_relation amap szs ptrfun htd\n \\ \\p v. amap p = Some v \\ h_t_array_valid htd (ptrfun p) (szs v)\"\n\ndefinition\n asid_map_pd_to_hwasids :: \"(asid \\ hw_asid \\ obj_ref) \\ (obj_ref \\ hw_asid set)\"\nwhere\n \"asid_map_pd_to_hwasids mp \\ \\pd. {hwasid. (hwasid, pd) \\ ran mp}\"\n\ndefinition\n pd_pointer_to_asid_slot :: \"obj_ref \\ pde_C ptr\"\nwhere\n \"pd_pointer_to_asid_slot pd \\ if is_aligned pd pdBits then Some (Ptr (pd + 0x3FC0)) else None\"\n\ndefinition\n pde_stored_asid :: \"pde_C \\ hw_asid\"\nwhere\n \"pde_stored_asid pde \\ if pde_get_tag pde = scast pde_pde_invalid\n \\ to_bool (stored_asid_valid_CL (pde_pde_invalid_lift pde))\n then Some (ucast (stored_hw_asid_CL (pde_pde_invalid_lift pde)))\n else None\"\n\nend\n\ntext \\\n Conceptually, the constant armKSKernelVSpace_C resembles ghost state.\n The constant specifies the use of certain address ranges, or ``windows''.\n It is the very nature of these ranges is that they remain fixed\n after initialization.\n Hence, it is not necessary to carry this value around\n as part of the actual state.\n Rather, we simply fix it in a locale for the state relation.\n\n Note that this locale does not build on @{text kernel}\n but @{text substitute_pre}.\n Hence, we can later base definitions for the ADT on it,\n which can subsequently be instantiated for\n @{text kernel_all_global_addresses} as well as @{text kernel_all_substitute}.\n\\\nlocale state_rel = Arch + substitute_pre + (*FIXME: arch_split*)\n fixes armKSKernelVSpace_C :: \"machine_word \\ arm_vspace_region_use\"\n\nlocale kernel = kernel_all_substitute + state_rel\n\ncontext state_rel\nbegin\n\nabbreviation armUSGlobalPD_Ptr :: \"(pde_C[2048]) ptr\" where\n \"armUSGlobalPD_Ptr \\ pd_Ptr (symbol_table ''armUSGlobalPD'')\"\n\n(* relates fixed adresses *)\ndefinition\n \"carch_globals s \\\n armUSGlobalPD s = ptr_val armUSGlobalPD_Ptr\"\n\n(* FIXME ARMHYP is this the right place? MOVE? *)\ndefinition\n cur_vcpu_relation :: \"(32 word \\ bool) option \\ vcpu_C ptr \\ 32 word \\ bool\"\nwhere\n \"cur_vcpu_relation akscurvcpu cvcpu cactive \\\n case akscurvcpu\n of Some acurvcpu \\ cvcpu = Ptr (fst acurvcpu) \\ cvcpu \\ NULL \\ cactive = from_bool (snd acurvcpu)\n | None \\ cvcpu = NULL \\ cactive = 0\"\n\n(* FIXME ARMHYP armUSGlobalPD points to page full of invalid PDEs, i.e. it's all zero *)\n(* FIXME ARMHYP TODO armKSGICVCPUNumListRegs \\ GIC_VCPU_MAX_NUM_LR (64): missing invariant upstream? *)\ndefinition\n carch_state_relation :: \"Arch.kernel_state \\ globals \\ bool\"\nwhere\n \"carch_state_relation astate cstate \\\n armKSNextASID_' cstate = armKSNextASID astate \\\n armKSKernelVSpace astate = armKSKernelVSpace_C \\\n array_relation ((=) \\ option_to_0) 0xFF (armKSHWASIDTable astate) (armKSHWASIDTable_' cstate) \\\n array_relation ((=) \\ option_to_ptr) (2^asid_high_bits - 1) (armKSASIDTable astate) (armKSASIDTable_' cstate) \\\n (asid_map_pd_to_hwasids (armKSASIDMap astate))\n = set_option \\ (pde_stored_asid \\\\<^sub>m clift (t_hrs_' cstate) \\\\<^sub>m pd_pointer_to_asid_slot) \\\n carch_globals astate \\\n gic_vcpu_num_list_regs_' cstate = of_nat (armKSGICVCPUNumListRegs astate) \\\n cur_vcpu_relation (armHSCurVCPU astate) (armHSCurVCPU_' cstate) (armHSVCPUActive_' cstate)\"\n\nend\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n cmachine_state_relation :: \"machine_state \\ globals \\ bool\"\nwhere\n \"cmachine_state_relation s s' \\\n irq_masks s = irq_masks (phantom_machine_state_' s') \\\n irq_state s = irq_state (phantom_machine_state_' s') \\\n device_state s = device_state (phantom_machine_state_' s') \\\n exclusive_state s = exclusive_state (phantom_machine_state_' s') \\\n machine_state_rest s = machine_state_rest (phantom_machine_state_' s')\"\n\n\ndefinition\n \"globals_list_id_fudge = id\"\n\ntype_synonym ('a, 'b) ltyp_heap = \"'a ptr \\ 'b\"\n\nabbreviation\n map_to_tcbs :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ tcb\"\n where\n \"map_to_tcbs hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_eps :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ endpoint\"\n where\n \"map_to_eps hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_ntfns :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ notification\"\n where\n \"map_to_ntfns hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_pdes :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ pde\"\n where\n \"map_to_pdes hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_ptes :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ pte\"\n where\n \"map_to_ptes hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_asidpools :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ asidpool\"\n where\n \"map_to_asidpools hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_user_data :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ user_data\"\n where\n \"map_to_user_data hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_vcpus :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ vcpu\"\n where\n \"map_to_vcpus hp \\ projectKO_opt \\\\<^sub>m hp\"\n\nabbreviation\n map_to_user_data_device :: \"(word32 \\ Structures_H.kernel_object) \\ word32 \\ user_data_device\"\n where\n \"map_to_user_data_device hp \\ projectKO_opt \\\\<^sub>m hp\"\n\n\ndefinition\n cmdbnode_relation :: \"Structures_H.mdbnode \\ mdb_node_C \\ bool\"\nwhere\n \"cmdbnode_relation amdb cmdb \\ amdb = mdb_node_to_H (mdb_node_lift cmdb)\"\n\ndefinition\n ccte_relation :: \"Structures_H.cte \\ cte_C \\ bool\"\nwhere\n \"ccte_relation acte ccte \\ Some acte = option_map cte_to_H (cte_lift ccte)\n \\ c_valid_cte ccte\"\n\nlemma ccte_relation_c_valid_cte: \"ccte_relation c c' \\ c_valid_cte c'\"\n by (simp add: ccte_relation_def)\n\n\ndefinition\n tcb_queue_relation' :: \"(tcb_C \\ tcb_C ptr) \\ (tcb_C \\ tcb_C ptr) \\ (tcb_C ptr \\ tcb_C option) \\ word32 list \\ tcb_C ptr \\ tcb_C ptr \\ bool\"\n where\n \"tcb_queue_relation' getNext getPrev hp queue qhead end \\\n (end = (if queue = [] then NULL else (tcb_ptr_to_ctcb_ptr (last queue))))\n \\ tcb_queue_relation getNext getPrev hp queue NULL qhead\"\n\nfun\n register_from_H :: \"register \\ word32\"\n where\n \"register_from_H ARM_HYP.R0 = scast Kernel_C.R0\"\n | \"register_from_H ARM_HYP.R1 = scast Kernel_C.R1\"\n | \"register_from_H ARM_HYP.R2 = scast Kernel_C.R2\"\n | \"register_from_H ARM_HYP.R3 = scast Kernel_C.R3\"\n | \"register_from_H ARM_HYP.R4 = scast Kernel_C.R4\"\n | \"register_from_H ARM_HYP.R5 = scast Kernel_C.R5\"\n | \"register_from_H ARM_HYP.R6 = scast Kernel_C.R6\"\n | \"register_from_H ARM_HYP.R7 = scast Kernel_C.R7\"\n | \"register_from_H ARM_HYP.R8 = scast Kernel_C.R8\"\n | \"register_from_H ARM_HYP.R9 = scast Kernel_C.R9\"\n | \"register_from_H ARM_HYP.SL = scast Kernel_C.R10\"\n | \"register_from_H ARM_HYP.FP = scast Kernel_C.R11\"\n | \"register_from_H ARM_HYP.IP = scast Kernel_C.R12\"\n | \"register_from_H ARM_HYP.SP = scast Kernel_C.SP\"\n | \"register_from_H ARM_HYP.LR = scast Kernel_C.LR\"\n | \"register_from_H ARM_HYP.NextIP = scast Kernel_C.NextIP\"\n | \"register_from_H ARM_HYP.CPSR = scast Kernel_C.CPSR\"\n | \"register_from_H ARM_HYP.TPIDRURW = scast Kernel_C.TPIDRURW\"\n | \"register_from_H ARM_HYP.TPIDRURO = scast Kernel_C.TPIDRURO\"\n | \"register_from_H ARM_HYP.FaultIP = scast Kernel_C.FaultIP\"\n\ndefinition\n ccontext_relation :: \"(MachineTypes.register \\ word32) \\ user_context_C \\ bool\"\nwhere\n \"ccontext_relation regs uc \\ \\r. regs r = index (registers_C uc) (unat (register_from_H r))\"\n\nprimrec\n cthread_state_relation_lifted :: \"Structures_H.thread_state \\\n (thread_state_CL \\ seL4_Fault_CL option) \\ bool\"\nwhere\n \"cthread_state_relation_lifted (Structures_H.Running) ts'\n = (tsType_CL (fst ts') = scast ThreadState_Running)\"\n| \"cthread_state_relation_lifted (Structures_H.Restart) ts'\n = (tsType_CL (fst ts') = scast ThreadState_Restart)\"\n| \"cthread_state_relation_lifted (Structures_H.Inactive) ts'\n = (tsType_CL (fst ts') = scast ThreadState_Inactive)\"\n| \"cthread_state_relation_lifted (Structures_H.IdleThreadState) ts'\n = (tsType_CL (fst ts') = scast ThreadState_IdleThreadState)\"\n| \"cthread_state_relation_lifted (Structures_H.BlockedOnReply) ts'\n = (tsType_CL (fst ts') = scast ThreadState_BlockedOnReply)\"\n| \"cthread_state_relation_lifted (Structures_H.BlockedOnReceive oref cg) ts'\n = (tsType_CL (fst ts') = scast ThreadState_BlockedOnReceive\n \\ oref = blockingObject_CL (fst ts')\n \\ cg = to_bool (blockingIPCCanGrant_CL (fst ts')))\"\n| \"cthread_state_relation_lifted (Structures_H.BlockedOnSend oref badge cg cgr isc) ts'\n = (tsType_CL (fst ts') = scast ThreadState_BlockedOnSend\n \\ oref = blockingObject_CL (fst ts')\n \\ badge = blockingIPCBadge_CL (fst ts')\n \\ cg = to_bool (blockingIPCCanGrant_CL (fst ts'))\n \\ cgr = to_bool (blockingIPCCanGrantReply_CL (fst ts'))\n \\ isc = to_bool (blockingIPCIsCall_CL (fst ts')))\"\n| \"cthread_state_relation_lifted (Structures_H.BlockedOnNotification oref) ts'\n = (tsType_CL (fst ts') = scast ThreadState_BlockedOnNotification\n \\ oref = blockingObject_CL (fst ts'))\"\n\n\ndefinition\n cthread_state_relation :: \"Structures_H.thread_state \\\n (thread_state_C \\ seL4_Fault_C) \\ bool\"\nwhere\n \"cthread_state_relation \\ \\a (cs, cf).\n cthread_state_relation_lifted a (thread_state_lift cs, seL4_Fault_lift cf)\"\n\ndefinition \"is_cap_fault cf \\\n (case cf of (SeL4_Fault_CapFault _) \\ True\n | _ \\ False)\"\n\nlemma is_cap_fault_simp: \"is_cap_fault cf = (\\ x. cf=SeL4_Fault_CapFault x)\"\n by (simp add: is_cap_fault_def split:seL4_Fault_CL.splits)\n\n\ndefinition\n message_info_to_H :: \"seL4_MessageInfo_C \\ Types_H.message_info\"\n where\n \"message_info_to_H mi \\ Types_H.message_info.MI (length_CL (seL4_MessageInfo_lift mi))\n (extraCaps_CL (seL4_MessageInfo_lift mi))\n (capsUnwrapped_CL (seL4_MessageInfo_lift mi))\n (label_CL (seL4_MessageInfo_lift mi))\"\n\n\nfun\n lookup_fault_to_H :: \"lookup_fault_CL \\ lookup_failure\"\n where\n \"lookup_fault_to_H Lookup_fault_invalid_root = InvalidRoot\"\n | \"lookup_fault_to_H (Lookup_fault_guard_mismatch lf) =\n (GuardMismatch (unat (bitsLeft_CL lf)) (guardFound_CL lf) (unat (bitsFound_CL lf)))\"\n | \"lookup_fault_to_H (Lookup_fault_depth_mismatch lf) =\n (DepthMismatch (unat (lookup_fault_depth_mismatch_CL.bitsLeft_CL lf))\n (unat (lookup_fault_depth_mismatch_CL.bitsFound_CL lf)))\"\n | \"lookup_fault_to_H (Lookup_fault_missing_capability lf) =\n (MissingCapability (unat (lookup_fault_missing_capability_CL.bitsLeft_CL lf)))\"\n\nfun\n fault_to_H :: \"seL4_Fault_CL \\ lookup_fault_CL \\ fault option\"\nwhere\n \"fault_to_H SeL4_Fault_NullFault lf = None\"\n | \"fault_to_H (SeL4_Fault_CapFault cf) lf\n = Some (CapFault (seL4_Fault_CapFault_CL.address_CL cf) (to_bool (inReceivePhase_CL cf)) (lookup_fault_to_H lf))\"\n | \"fault_to_H (SeL4_Fault_VMFault vf) lf\n = Some (ArchFault (VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))\"\n | \"fault_to_H (SeL4_Fault_UnknownSyscall us) lf\n = Some (UnknownSyscallException (syscallNumber_CL us))\"\n | \"fault_to_H (SeL4_Fault_UserException ue) lf\n = Some (UserException (number_CL ue) (code_CL ue))\"\n | \"fault_to_H (SeL4_Fault_VCPUFault vf) lf\n = Some (ArchFault (VCPUFault (seL4_Fault_VCPUFault_CL.hsr_CL vf)))\"\n | \"fault_to_H (SeL4_Fault_VGICMaintenance vf) lf\n = Some (ArchFault (VGICMaintenance (if seL4_Fault_VGICMaintenance_CL.idxValid_CL vf = 1\n then Some (seL4_Fault_VGICMaintenance_CL.idx_CL vf)\n else None)))\"\n | \"fault_to_H (SeL4_Fault_VPPIEvent irq) lf\n = Some (ArchFault (VPPIEvent (ucast (seL4_Fault_VPPIEvent_CL.irq_w_CL irq))))\"\n\ndefinition\n cfault_rel :: \"Fault_H.fault option \\ seL4_Fault_CL option \\ lookup_fault_CL option \\ bool\"\nwhere\n \"cfault_rel af cf lf \\ \\cf'. cf = Some cf' \\\n (if (is_cap_fault cf') then (\\lf'. lf = Some lf' \\ fault_to_H cf' lf' = af)\n else (fault_to_H cf' undefined = af))\"\n\ndefinition\n carch_tcb_relation :: \"Structures_H.arch_tcb \\ arch_tcb_C \\ bool\"\nwhere\n \"carch_tcb_relation aarch_tcb carch_tcb \\\n ccontext_relation (atcbContextGet aarch_tcb) (tcbContext_C carch_tcb)\n \\ option_to_ptr (atcbVCPUPtr aarch_tcb) = tcbVCPU_C carch_tcb\"\n\ndefinition\n ctcb_relation :: \"Structures_H.tcb \\ tcb_C \\ bool\"\nwhere\n \"ctcb_relation atcb ctcb \\\n tcbFaultHandler atcb = tcbFaultHandler_C ctcb\n \\ cthread_state_relation (tcbState atcb) (tcbState_C ctcb, tcbFault_C ctcb)\n \\ tcbIPCBuffer atcb = tcbIPCBuffer_C ctcb\n \\ carch_tcb_relation (tcbArch atcb) (tcbArch_C ctcb)\n \\ tcbQueued atcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ctcb)))\n \\ ucast (tcbDomain atcb) = tcbDomain_C ctcb\n \\ ucast (tcbPriority atcb) = tcbPriority_C ctcb\n \\ ucast (tcbMCP atcb) = tcbMCP_C ctcb\n \\ tcbTimeSlice atcb = unat (tcbTimeSlice_C ctcb)\n \\ cfault_rel (tcbFault atcb) (seL4_Fault_lift (tcbFault_C ctcb))\n (lookup_fault_lift (tcbLookupFailure_C ctcb))\n \\ option_to_ptr (tcbBoundNotification atcb) = tcbBoundNotification_C ctcb\"\n\nabbreviation\n \"ep_queue_relation' \\ tcb_queue_relation' tcbEPNext_C tcbEPPrev_C\"\n\ndefinition\n cendpoint_relation :: \"tcb_C typ_heap \\ Structures_H.endpoint \\ endpoint_C \\ bool\"\nwhere\n \"cendpoint_relation h ntfn cep \\\n let cstate = endpoint_CL.state_CL (endpoint_lift cep);\n chead = (Ptr o epQueue_head_CL o endpoint_lift) cep;\n cend = (Ptr o epQueue_tail_CL o endpoint_lift) cep in\n case ntfn of\n IdleEP \\ cstate = scast EPState_Idle \\ ep_queue_relation' h [] chead cend\n | SendEP q \\ cstate = scast EPState_Send \\ ep_queue_relation' h q chead cend\n | RecvEP q \\ cstate = scast EPState_Recv \\ ep_queue_relation' h q chead cend\"\n\ndefinition\n cnotification_relation :: \"tcb_C typ_heap \\ Structures_H.notification \\\n notification_C \\ bool\"\nwhere\n \"cnotification_relation h antfn cntfn \\\n let cntfn' = notification_lift cntfn;\n cstate = notification_CL.state_CL cntfn';\n chead = (Ptr o ntfnQueue_head_CL) cntfn';\n cend = (Ptr o ntfnQueue_tail_CL) cntfn';\n cbound = ((Ptr o ntfnBoundTCB_CL) cntfn' :: tcb_C ptr)\n in\n (case ntfnObj antfn of\n IdleNtfn \\ cstate = scast NtfnState_Idle \\ ep_queue_relation' h [] chead cend\n | WaitingNtfn q \\ cstate = scast NtfnState_Waiting \\ ep_queue_relation' h q chead cend\n | ActiveNtfn msgid \\ cstate = scast NtfnState_Active \\\n msgid = ntfnMsgIdentifier_CL cntfn' \\\n ep_queue_relation' h [] chead cend)\n \\ option_to_ctcb_ptr (ntfnBoundTCB antfn) = cbound\"\n\ndefinition\n \"hap_from_vm_rights R \\ case R of\n VMNoAccess \\ 0\n | VMKernelOnly \\ 0\n | VMReadOnly \\ 1\n | VMReadWrite \\ 3\"\n\ndefinition\n \"memattr_from_cacheable c \\ case c of\n True \\ 0xf\n | False \\ 0\"\n\ndefinition\n cpde_relation :: \"pde \\ pde_C \\ bool\"\nwhere\n \"cpde_relation pde cpde \\\n (let cpde' = pde_lift cpde in\n case pde of\n InvalidPDE \\\n (\\inv. cpde' = Some (Pde_pde_invalid inv)) \\ \\seL4 uses invalid PDEs to stash other info\\\n | PageTablePDE table \\\n cpde' = Some (Pde_pde_coarse\n \\ pde_pde_coarse_CL.address_CL = table \\)\n | SectionPDE frame cacheable xn rights \\\n cpde' = Some (Pde_pde_section\n \\ pde_pde_section_CL.XN_CL = of_bool xn,\n contiguous_hint_CL = 0,\n pde_pde_section_CL.address_CL = frame,\n AF_CL = 1,\n SH_CL = 0,\n HAP_CL = hap_from_vm_rights rights,\n MemAttr_CL = memattr_from_cacheable cacheable \\)\n | SuperSectionPDE frame cacheable xn rights \\\n cpde' = Some (Pde_pde_section\n \\ pde_pde_section_CL.XN_CL = of_bool xn,\n contiguous_hint_CL = 1,\n pde_pde_section_CL.address_CL = frame,\n AF_CL = 1,\n SH_CL = 0,\n HAP_CL = hap_from_vm_rights rights,\n MemAttr_CL = memattr_from_cacheable cacheable \\)\n )\"\n\ndefinition\n cpte_relation :: \"pte \\ pte_C \\ bool\"\nwhere\n \"cpte_relation pte cpte \\\n (let cpte' = pte_lift cpte in\n case pte of\n InvalidPTE \\\n (cpte' = Some (Pte_pte_invalid))\n | SmallPagePTE frame cacheable xn rights \\\n cpte' = Some (Pte_pte_small\n \\ pte_pte_small_CL.XN_CL = of_bool xn,\n contiguous_hint_CL = 0,\n pte_pte_small_CL.address_CL = frame,\n AF_CL = 1,\n SH_CL = 0,\n HAP_CL = hap_from_vm_rights rights,\n MemAttr_CL = memattr_from_cacheable cacheable \\)\n | LargePagePTE frame cacheable xn rights \\\n cpte' = Some (Pte_pte_small\n \\ pte_pte_small_CL.XN_CL = of_bool xn,\n contiguous_hint_CL = 1,\n pte_pte_small_CL.address_CL = frame,\n AF_CL = 1,\n SH_CL = 0,\n HAP_CL = hap_from_vm_rights rights,\n MemAttr_CL = memattr_from_cacheable cacheable \\)\n )\"\n\n(* Invalid PTEs map to invalid PTEs (sanity check?) *)\nlemma pte_0:\n \"index (pte_C.words_C cpte) 0 = 0 \\ index (pte_C.words_C cpte) 1 = 0 \\\n pte_lift cpte = Some (Pte_pte_invalid)\"\n by (simp add: pte_lift_def pte_get_tag_def pte_pte_invalid_def)\n\ndefinition\n casid_pool_relation :: \"asidpool \\ asid_pool_C \\ bool\"\nwhere\n \"casid_pool_relation asid_pool casid_pool \\\n case asid_pool of ASIDPool pool \\\n case casid_pool of asid_pool_C.asid_pool_C cpool \\\n array_relation ((=) \\ option_to_ptr) (2^asid_low_bits - 1) pool cpool\"\n\ndefinition\n cvcpu_regs_relation :: \"vcpu \\ vcpu_C \\ bool\"\nwhere\n \"cvcpu_regs_relation vcpu cvcpu \\\n \\r. regs_C cvcpu.[fromEnum r] = vcpuRegs vcpu r\"\n\ndefinition cvcpu_vppi_masked_relation :: \"vcpu \\ vcpu_C \\ bool\" where\n \"cvcpu_vppi_masked_relation vcpu cvcpu \\\n \\vppi. (vppi_masked_C cvcpu).[fromEnum vppi]\n = from_bool (vcpuVPPIMasked vcpu vppi)\"\n\ndefinition\n virq_to_H :: \"virq_C \\ virq\"\nwhere\n \"virq_to_H virq = (virq_C.words_C virq).[0]\"\n\ndefinition\n cvgic_relation :: \"gicvcpuinterface \\ gicVCpuIface_C \\ bool\"\nwhere\n \"cvgic_relation vgic cvgic \\\n gicVCpuIface_C.hcr_C cvgic = vgicHCR vgic\n \\ gicVCpuIface_C.vmcr_C cvgic = vgicVMCR vgic\n \\ gicVCpuIface_C.apr_C cvgic = vgicAPR vgic\n \\ (\\i\\63. vgicLR vgic i = virq_to_H ((gicVCpuIface_C.lr_C cvgic).[i]))\n \\ (\\i\\64. vgicLR vgic i = 0)\"\n(* FIXME ARM_HYP: if we know the range is 64, we should change the index type from nat to 6 word *)\n\ndefinition\n cvcpu_relation :: \"vcpu \\ vcpu_C \\ bool\"\nwhere\n \"cvcpu_relation vcpu cvcpu \\\n vcpuTCB_C cvcpu = option_to_ctcb_ptr (vcpuTCBPtr vcpu)\n \\ cvcpu_regs_relation vcpu cvcpu\n \\ cvgic_relation (vcpuVGIC vcpu) (vgic_C cvcpu)\n \\ cvcpu_vppi_masked_relation vcpu cvcpu\n \\ last_pcount_C (virtTimer_C cvcpu) = vtimerLastPCount (vcpuVTimer vcpu)\"\n\ndefinition\n cuser_user_data_relation :: \"(10 word \\ word32) \\ user_data_C \\ bool\"\nwhere\n \"cuser_user_data_relation f ud \\ \\off. f off = index (user_data_C.words_C ud) (unat off)\"\n\ndefinition\n cuser_user_data_device_relation :: \"(10 word \\ word32) \\ user_data_device_C \\ bool\"\nwhere\n \"cuser_user_data_device_relation f ud \\ True\"\n\nabbreviation\n \"cpspace_cte_relation ah ch \\ cmap_relation (map_to_ctes ah) (clift ch) Ptr ccte_relation\"\n\nabbreviation\n \"cpspace_tcb_relation ah ch \\ cmap_relation (map_to_tcbs ah) (clift ch) tcb_ptr_to_ctcb_ptr ctcb_relation\"\n\nabbreviation\n \"cpspace_ep_relation ah ch \\ cmap_relation (map_to_eps ah) (clift ch) Ptr (cendpoint_relation (clift ch))\"\n\nabbreviation\n \"cpspace_ntfn_relation ah ch \\ cmap_relation (map_to_ntfns ah) (clift ch) Ptr (cnotification_relation (clift ch))\"\n\nabbreviation\n \"cpspace_pde_relation ah ch \\ cmap_relation (map_to_pdes ah) (clift ch) Ptr cpde_relation\"\n\nabbreviation\n \"cpspace_pte_relation ah ch \\ cmap_relation (map_to_ptes ah) (clift ch) Ptr cpte_relation\"\n\nabbreviation\n \"cpspace_asidpool_relation ah ch \\ cmap_relation (map_to_asidpools ah) (clift ch) Ptr casid_pool_relation\"\n\nabbreviation\n \"cpspace_vcpu_relation ah ch \\ cmap_relation (map_to_vcpus ah) (clift ch) Ptr cvcpu_relation\"\n\n\nabbreviation\n \"cpspace_user_data_relation ah bh ch \\ cmap_relation (heap_to_user_data ah bh) (clift ch) Ptr cuser_user_data_relation\"\n\nabbreviation\n \"cpspace_device_data_relation ah bh ch \\ cmap_relation (heap_to_device_data ah bh) (clift ch) Ptr cuser_user_data_device_relation\"\n\nabbreviation\n \"cpspace_pde_array_relation ah ch \\ carray_map_relation pdBits (map_to_pdes ah) (h_t_valid (hrs_htd ch) c_guard) pd_Ptr\"\n\nabbreviation\n \"cpspace_pte_array_relation ah ch \\ carray_map_relation ptBits (map_to_ptes ah) (h_t_valid (hrs_htd ch) c_guard) pt_Ptr\"\n\n\ndefinition\n cpspace_relation :: \"(word32 \\ Structures_H.kernel_object) \\ (word32 \\ word8) \\ heap_raw_state \\ bool\"\nwhere\n \"cpspace_relation ah bh ch \\\n cpspace_cte_relation ah ch \\ cpspace_tcb_relation ah ch \\ cpspace_ep_relation ah ch \\ cpspace_ntfn_relation ah ch \\\n cpspace_pde_relation ah ch \\ cpspace_pte_relation ah ch \\ cpspace_asidpool_relation ah ch \\\n cpspace_user_data_relation ah bh ch \\ cpspace_device_data_relation ah bh ch \\\n cpspace_pde_array_relation ah ch \\ cpspace_pte_array_relation ah ch \\\n cpspace_vcpu_relation ah ch\"\n\nabbreviation\n \"sched_queue_relation' \\ tcb_queue_relation' tcbSchedNext_C tcbSchedPrev_C\"\n\nabbreviation\n end_C :: \"tcb_queue_C \\ tcb_C ptr\"\nwhere\n \"end_C == tcb_queue_C.end_C\"\n\ndefinition\n cready_queues_index_to_C :: \"domain \\ priority \\ nat\"\nwhere\n \"cready_queues_index_to_C qdom prio \\ (unat qdom) * numPriorities + (unat prio)\"\n\ndefinition cready_queues_relation ::\n \"tcb_C typ_heap \\ (tcb_queue_C[num_tcb_queues]) \\ (domain \\ priority \\ ready_queue) \\ bool\"\nwhere\n \"cready_queues_relation h_tcb queues aqueues \\\n \\qdom prio. ((qdom \\ ucast minDom \\ qdom \\ ucast maxDom \\\n prio \\ ucast minPrio \\ prio \\ ucast maxPrio) \\\n (let cqueue = index queues (cready_queues_index_to_C qdom prio) in\n sched_queue_relation' h_tcb (aqueues (qdom, prio)) (head_C cqueue) (end_C cqueue)))\n \\ (\\ (qdom \\ ucast minDom \\ qdom \\ ucast maxDom \\\n prio \\ ucast minPrio \\ prio \\ ucast maxPrio) \\ aqueues (qdom, prio) = [])\"\n\n\nabbreviation\n \"cte_array_relation astate cstate\n \\ cvariable_array_map_relation (gsCNodes astate) (\\n. 2 ^ n)\n cte_Ptr (hrs_htd (t_hrs_' cstate))\"\n\nabbreviation\n \"tcb_cte_array_relation astate cstate\n \\ cvariable_array_map_relation (map_to_tcbs (ksPSpace astate))\n (\\x. 5) cte_Ptr (hrs_htd (t_hrs_' cstate))\"\n\nfun\n irqstate_to_C :: \"irqstate \\ word32\"\n where\n \"irqstate_to_C IRQInactive = scast Kernel_C.IRQInactive\"\n | \"irqstate_to_C IRQSignal = scast Kernel_C.IRQSignal\"\n | \"irqstate_to_C IRQTimer = scast Kernel_C.IRQTimer\"\n | \"irqstate_to_C irqstate.IRQReserved = scast Kernel_C.IRQReserved\"\n\ndefinition\n cinterrupt_relation :: \"interrupt_state \\ 'a ptr \\ (word32[192]) \\ bool\"\nwhere\n \"cinterrupt_relation airqs cnode cirqs \\\n cnode = Ptr (intStateIRQNode airqs) \\\n (\\irq \\ (ucast Kernel_C.maxIRQ).\n irqstate_to_C (intStateIRQTable airqs irq) = index cirqs (unat irq))\"\n\ndefinition\n cscheduler_action_relation :: \"Structures_H.scheduler_action \\ tcb_C ptr \\ bool\"\nwhere\n \"cscheduler_action_relation a p \\ case a of\n ResumeCurrentThread \\ p = NULL\n | ChooseNewThread \\ p = Ptr 1\n | SwitchToThread p' \\ p = tcb_ptr_to_ctcb_ptr p'\"\n\ndefinition\n dom_schedule_entry_relation :: \"8 word \\ 32 word \\ dschedule_C \\ bool\"\nwhere\n \"dom_schedule_entry_relation adomSched cdomSched \\\n ucast (fst adomSched) = dschedule_C.domain_C cdomSched \\\n (snd adomSched) = dschedule_C.length_C cdomSched\"\n\ndefinition\n cdom_schedule_relation :: \"(8 word \\ 32 word) list \\ (dschedule_C['b :: finite]) \\ bool\"\nwhere\n \"cdom_schedule_relation adomSched cdomSched \\\n length adomSched = card (UNIV :: 'b set) \\\n (\\n \\ length adomSched. dom_schedule_entry_relation (adomSched ! n) (index cdomSched n))\"\n\ndefinition\n ghost_size_rel :: \"cghost_state \\ nat \\ bool\"\nwhere\n \"ghost_size_rel gs maxSize = ((gs_get_assn cap_get_capSizeBits_'proc gs = 0\n \\ maxSize = card (UNIV :: word32 set))\n \\ (maxSize > 0 \\ maxSize = unat (gs_get_assn cap_get_capSizeBits_'proc gs)))\"\n\ndefinition\n cbitmap_L1_relation :: \"machine_word['dom::finite] \\ (domain \\ machine_word) \\ bool\"\nwhere\n \"cbitmap_L1_relation cbitmap1 abitmap1 \\\n \\d. (d \\ maxDomain \\ cbitmap1.[unat d] = abitmap1 d) \\\n (\\ d \\ maxDomain \\ abitmap1 d = 0)\"\n\ndefinition\n cbitmap_L2_relation :: \"machine_word['i::finite]['dom::finite]\n \\ ((domain \\ nat) \\ machine_word) \\ bool\"\nwhere\n \"cbitmap_L2_relation cbitmap2 abitmap2 \\\n \\d i. ((d \\ maxDomain \\ i < l2BitmapSize)\n \\ cbitmap2.[unat d].[i] = abitmap2 (d, i)) \\\n ((\\ (d \\ maxDomain \\ i < l2BitmapSize))\n \\ abitmap2 (d, i) = 0)\"\n\nend (* interpretation Arch . (*FIXME: arch_split*) *)\n\ndefinition\n region_is_bytes' :: \"word32 \\ nat \\ heap_typ_desc \\ bool\"\nwhere\n \"region_is_bytes' ptr sz htd \\ \\z\\{ptr ..+ sz}. \\ td. td \\ typ_uinfo_t TYPE (word8) \\\n (\\n b. snd (htd z) n \\ Some (td, b))\"\n\nabbreviation\n region_is_bytes :: \"word32 \\ nat \\ globals myvars \\ bool\"\nwhere\n \"region_is_bytes ptr sz s \\ region_is_bytes' ptr sz (hrs_htd (t_hrs_' (globals s)))\"\n\nabbreviation(input)\n \"heap_list_is_zero hp ptr n \\ heap_list hp n ptr = replicate n 0\"\n\nabbreviation\n \"region_is_zero_bytes ptr n x \\ region_is_bytes ptr n x\n \\ heap_list_is_zero (hrs_mem (t_hrs_' (globals x))) ptr n\"\n\ndefinition\n region_actually_is_bytes' :: \"addr \\ nat \\ heap_typ_desc \\ bool\"\nwhere\n \"region_actually_is_bytes' ptr len htd\n = (\\x \\ {ptr ..+ len}. htd x\n = (True, [0 \\ (typ_uinfo_t TYPE(8 word), True)]))\"\n\nabbreviation\n \"region_actually_is_bytes ptr len s\n \\ region_actually_is_bytes' ptr len (hrs_htd (t_hrs_' (globals s)))\"\n\nlemmas region_actually_is_bytes_def = region_actually_is_bytes'_def\n\nabbreviation\n \"region_actually_is_zero_bytes ptr len s\n \\ region_actually_is_bytes ptr len s\n \\ heap_list_is_zero (hrs_mem (t_hrs_' (globals s))) ptr len\"\n\ndefinition\n zero_ranges_are_zero\nwhere\n \"zero_ranges_are_zero rs hrs\n = (\\(start, end) \\ rs. region_actually_is_bytes' start (unat ((end + 1) - start)) (hrs_htd hrs)\n \\ heap_list_is_zero (hrs_mem hrs) start (unat ((end + 1) - start)))\"\n\ncontext state_rel begin\n\n\\ \\The IRQ node is a global array of CTEs.\\\nabbreviation intStateIRQNode_array_Ptr :: \"(cte_C[256]) ptr\" where\n \"intStateIRQNode_array_Ptr \\ Ptr (symbol_table ''intStateIRQNode'')\"\n\n\\ \\But for compatibility with older proofs (written when the IRQ Node was a global pointer\n initialised during boot), it is sometimes convenient to treat the IRQ node pointer as\n a pointer to a CTE.\\\nabbreviation intStateIRQNode_Ptr :: \"cte_C ptr\" where\n \"intStateIRQNode_Ptr \\ Ptr (symbol_table ''intStateIRQNode'')\"\n\ndefinition\n cstate_relation :: \"KernelStateData_H.kernel_state \\ globals \\ bool\"\nwhere\n cstate_relation_def:\n \"cstate_relation astate cstate \\\n let cheap = t_hrs_' cstate in\n cpspace_relation (ksPSpace astate) (underlying_memory (ksMachineState astate)) cheap \\\n cready_queues_relation (clift cheap)\n (ksReadyQueues_' cstate)\n (ksReadyQueues astate) \\\n zero_ranges_are_zero (gsUntypedZeroRanges astate) cheap \\\n cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' cstate) (ksReadyQueuesL1Bitmap astate) \\\n cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' cstate) (ksReadyQueuesL2Bitmap astate) \\\n ksCurThread_' cstate = (tcb_ptr_to_ctcb_ptr (ksCurThread astate)) \\\n ksIdleThread_' cstate = (tcb_ptr_to_ctcb_ptr (ksIdleThread astate)) \\\n cinterrupt_relation (ksInterruptState astate) intStateIRQNode_array_Ptr (intStateIRQTable_' cstate) \\\n cscheduler_action_relation (ksSchedulerAction astate)\n (ksSchedulerAction_' cstate) \\\n carch_state_relation (ksArchState astate) cstate \\\n cmachine_state_relation (ksMachineState astate) cstate \\\n cte_array_relation astate cstate \\\n tcb_cte_array_relation astate cstate \\\n apsnd fst (ghost'state_' cstate) = (gsUserPages astate, gsCNodes astate) \\\n ghost_size_rel (ghost'state_' cstate) (gsMaxObjectSize astate) \\\n ksWorkUnitsCompleted_' cstate = ksWorkUnitsCompleted astate \\\n h_t_valid (hrs_htd (t_hrs_' cstate)) c_guard intStateIRQNode_array_Ptr \\\n ptr_span intStateIRQNode_array_Ptr \\ kernel_data_refs \\\n h_t_valid (hrs_htd (t_hrs_' cstate)) c_guard armUSGlobalPD_Ptr \\\n ptr_span armUSGlobalPD_Ptr \\ kernel_data_refs \\\n htd_safe domain (hrs_htd (t_hrs_' cstate)) \\\n -domain \\ kernel_data_refs \\\n globals_list_distinct (- kernel_data_refs) symbol_table globals_list \\\n cdom_schedule_relation (ksDomSchedule astate)\n Kernel_C.kernel_all_global_addresses.ksDomSchedule \\\n ksDomScheduleIdx_' cstate = of_nat (ksDomScheduleIdx astate) \\\n ksCurDomain_' cstate = ucast (ksCurDomain astate) \\\n ksDomainTime_' cstate = ksDomainTime astate\"\n\nend\n\ndefinition\n ccap_relation :: \"capability \\ cap_C \\ bool\"\nwhere\n \"ccap_relation acap ccap \\ (Some acap = option_map cap_to_H (cap_lift ccap))\n \\ (c_valid_cap ccap)\"\n\nlemma ccap_relation_c_valid_cap: \"ccap_relation c c' \\ c_valid_cap c'\"\n by (simp add: ccap_relation_def)\n\ncontext begin interpretation Arch .\nfun\n arch_fault_to_fault_tag :: \"arch_fault \\ word32\"\n where\n \"arch_fault_to_fault_tag (VMFault a b) = scast seL4_Fault_VMFault\"\n| \"arch_fault_to_fault_tag (VCPUFault a) = scast seL4_Fault_VCPUFault\"\n| \"arch_fault_to_fault_tag (VGICMaintenance a) = scast seL4_Fault_VGICMaintenance\"\n| \"arch_fault_to_fault_tag (VPPIEvent a) = scast seL4_Fault_VPPIEvent\"\nend\n\nfun\n fault_to_fault_tag :: \"fault \\ word32\"\nwhere\n \" fault_to_fault_tag (CapFault a b c) = scast seL4_Fault_CapFault\"\n | \"fault_to_fault_tag (ArchFault f) = arch_fault_to_fault_tag f\"\n | \"fault_to_fault_tag (UnknownSyscallException a) = scast seL4_Fault_UnknownSyscall\"\n | \"fault_to_fault_tag (UserException a b) = scast seL4_Fault_UserException\"\n\nlemmas seL4_Faults = seL4_Fault_UserException_def\n seL4_Fault_UnknownSyscall_def\n seL4_Fault_CapFault_def\n\nlemmas seL4_Arch_Faults = seL4_Fault_VMFault_def\n seL4_Fault_VCPUFault_def\n seL4_Fault_VGICMaintenance_def\n seL4_Fault_VPPIEvent_def\n\n(* Return relations *)\n\nrecord errtype =\n errfault :: \"seL4_Fault_CL option\"\n errlookup_fault :: \"lookup_fault_CL option\"\n errsyscall :: syscall_error_C\n\nprimrec\n lookup_failure_rel :: \"lookup_failure \\ word32 \\ errtype \\ bool\"\nwhere\n \"lookup_failure_rel InvalidRoot fl es = (fl = scast EXCEPTION_LOOKUP_FAULT \\ errlookup_fault es = Some Lookup_fault_invalid_root)\"\n| \"lookup_failure_rel (GuardMismatch bl gf sz) fl es = (fl = scast EXCEPTION_LOOKUP_FAULT \\\n (\\lf. errlookup_fault es = Some (Lookup_fault_guard_mismatch lf) \\\n guardFound_CL lf = gf \\ unat (bitsLeft_CL lf) = bl \\ unat (bitsFound_CL lf) = sz))\"\n| \"lookup_failure_rel (DepthMismatch bl bf) fl es = (fl = scast EXCEPTION_LOOKUP_FAULT \\\n (\\lf. errlookup_fault es = Some (Lookup_fault_depth_mismatch lf) \\\n unat (lookup_fault_depth_mismatch_CL.bitsLeft_CL lf) = bl\n \\ unat (lookup_fault_depth_mismatch_CL.bitsFound_CL lf) = bf))\"\n| \"lookup_failure_rel (MissingCapability bl) fl es = (fl = scast EXCEPTION_LOOKUP_FAULT \\\n (\\lf. errlookup_fault es = Some (Lookup_fault_missing_capability lf) \\\n unat (lookup_fault_missing_capability_CL.bitsLeft_CL lf) = bl))\"\n\n\ndefinition\n syscall_error_to_H :: \"syscall_error_C \\ lookup_fault_CL option \\ syscall_error option\"\nwhere\n \"syscall_error_to_H se lf \\\n if type_C se = scast seL4_InvalidArgument\n then Some (InvalidArgument (unat (invalidArgumentNumber_C se)))\n else if type_C se = scast seL4_InvalidCapability\n then Some (InvalidCapability (unat (invalidCapNumber_C se)))\n else if type_C se = scast seL4_IllegalOperation then Some IllegalOperation\n else if type_C se = scast seL4_RangeError\n then Some (RangeError (rangeErrorMin_C se) (rangeErrorMax_C se))\n else if type_C se = scast seL4_AlignmentError then Some AlignmentError\n else if type_C se = scast seL4_FailedLookup\n then option_map (FailedLookup (to_bool (failedLookupWasSource_C se))\n o lookup_fault_to_H) lf\n else if type_C se = scast seL4_TruncatedMessage then Some TruncatedMessage\n else if type_C se = scast seL4_DeleteFirst then Some DeleteFirst\n else if type_C se = scast seL4_RevokeFirst then Some RevokeFirst\n else if type_C se = scast seL4_NotEnoughMemory then Some (NotEnoughMemory (memoryLeft_C se))\n else None\"\n\nlemmas syscall_error_type_defs\n = seL4_AlignmentError_def seL4_DeleteFirst_def seL4_FailedLookup_def\n seL4_IllegalOperation_def seL4_InvalidArgument_def seL4_InvalidCapability_def\n seL4_NotEnoughMemory_def seL4_RangeError_def seL4_RevokeFirst_def\n seL4_TruncatedMessage_def\n\nlemma\n syscall_error_to_H_cases:\n \"type_C se = scast seL4_InvalidArgument\n \\ syscall_error_to_H se lf = Some (InvalidArgument (unat (invalidArgumentNumber_C se)))\"\n \"type_C se = scast seL4_InvalidCapability\n \\ syscall_error_to_H se lf = Some (InvalidCapability (unat (invalidCapNumber_C se)))\"\n \"type_C se = scast seL4_IllegalOperation\n \\ syscall_error_to_H se lf = Some IllegalOperation\"\n \"type_C se = scast seL4_RangeError\n \\ syscall_error_to_H se lf = Some (RangeError (rangeErrorMin_C se) (rangeErrorMax_C se))\"\n \"type_C se = scast seL4_AlignmentError\n \\ syscall_error_to_H se lf = Some AlignmentError\"\n \"type_C se = scast seL4_FailedLookup\n \\ syscall_error_to_H se lf = option_map (FailedLookup (to_bool (failedLookupWasSource_C se))\n o lookup_fault_to_H) lf\"\n \"type_C se = scast seL4_TruncatedMessage\n \\ syscall_error_to_H se lf = Some TruncatedMessage\"\n \"type_C se = scast seL4_DeleteFirst\n \\ syscall_error_to_H se lf = Some DeleteFirst\"\n \"type_C se = scast seL4_RevokeFirst\n \\ syscall_error_to_H se lf = Some RevokeFirst\"\n \"type_C se = scast seL4_NotEnoughMemory\n \\ syscall_error_to_H se lf = Some (NotEnoughMemory (memoryLeft_C se))\"\n by (simp add: syscall_error_to_H_def syscall_error_type_defs)+\n\ndefinition\n syscall_error_rel :: \"syscall_error \\ word32 \\ errtype \\ bool\" where\n \"syscall_error_rel se fl es \\ fl = scast EXCEPTION_SYSCALL_ERROR\n \\ syscall_error_to_H (errsyscall es) (errlookup_fault es)\n = Some se\"\n\n(* cap rights *)\ndefinition\n \"cap_rights_to_H rs \\ CapRights (to_bool (capAllowWrite_CL rs))\n (to_bool (capAllowRead_CL rs))\n (to_bool (capAllowGrant_CL rs))\n (to_bool (capAllowGrantReply_CL rs))\"\n\ndefinition\n \"ccap_rights_relation cr cr' \\ cr = cap_rights_to_H (seL4_CapRights_lift cr')\"\n\nlemma (in kernel) syscall_error_to_H_cases_rev:\n \"\\n. syscall_error_to_H e lf = Some (InvalidArgument n) \\\n type_C e = scast seL4_InvalidArgument\"\n \"\\n. syscall_error_to_H e lf = Some (InvalidCapability n) \\\n type_C e = scast seL4_InvalidCapability\"\n \"syscall_error_to_H e lf = Some IllegalOperation \\\n type_C e = scast seL4_IllegalOperation\"\n \"\\w1 w2. syscall_error_to_H e lf = Some (RangeError w1 w2) \\\n type_C e = scast seL4_RangeError\"\n \"syscall_error_to_H e lf = Some AlignmentError \\\n type_C e = scast seL4_AlignmentError\"\n \"\\b lf'. syscall_error_to_H e lf = Some (FailedLookup b lf') \\\n type_C e = scast seL4_FailedLookup\"\n \"syscall_error_to_H e lf = Some TruncatedMessage \\\n type_C e = scast seL4_TruncatedMessage\"\n \"syscall_error_to_H e lf = Some DeleteFirst \\\n type_C e = scast seL4_DeleteFirst\"\n \"syscall_error_to_H e lf = Some RevokeFirst \\\n type_C e = scast seL4_RevokeFirst\"\n by (clarsimp simp: syscall_error_to_H_def syscall_error_type_defs\n split: if_split_asm)+\n\ndefinition\n syscall_from_H :: \"syscall \\ word32\"\nwhere\n \"syscall_from_H c \\ case c of\n SysSend \\ scast Kernel_C.SysSend\n | SysNBSend \\ scast Kernel_C.SysNBSend\n | SysCall \\ scast Kernel_C.SysCall\n | SysRecv \\ scast Kernel_C.SysRecv\n | SysReply \\ scast Kernel_C.SysReply\n | SysReplyRecv \\ scast Kernel_C.SysReplyRecv\n | SysNBRecv \\ scast Kernel_C.SysNBRecv\n | SysYield \\ scast Kernel_C.SysYield\"\n\nlemma (in kernel) cmap_relation_cs_atD:\n \"\\ cmap_relation as cs addr_fun rel; cs (addr_fun x) = Some y; inj addr_fun \\ \\\n \\ko. as x = Some ko \\ rel ko y\"\n apply (clarsimp simp: cmap_relation_def)\n apply (subgoal_tac \"x \\ dom as\")\n apply (drule (1) bspec)\n apply (clarsimp simp: dom_def)\n apply (subgoal_tac \"addr_fun x \\ addr_fun ` dom as\")\n prefer 2\n apply fastforce\n apply (erule imageE)\n apply (drule (1) injD)\n apply simp\n done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/ARM_HYP/StateRelation_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3208213073183839, "lm_q1q2_score": 0.16291686616984008}} {"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\n(*\n * The layout of the capability space and other parts of the system-initialiser.\n *)\ntheory RootTask_SI\nimports WellFormed_SI\nbegin\n\n(******************************************************************\n * Definition of the CSpace of the root task. *\n * This requires a default cap to all of the objects created, *\n * and a copy of caps to all of the CNodes (for installing caps). *\n ******************************************************************)\n\nconsts\n si_cnode_id :: cdl_object_id\n si_asidpool_id :: cdl_object_id\n si_asidpool_base :: nat\n\ndefinition\n si_cnode_size :: cdl_size_bits\nwhere\n \"si_cnode_size = 12\"\n\n(* If we axioimise this size, we need it to be smaller than the word size.\n * We need this to prove that:\n - word_bits - si_cnode_size + si_cnode_size = word_bits.\n - offset (of_nat slot) si_cnode_size = slot\n *)\nlemma si_cnode_size_less_than_word_size [simp]:\n \"si_cnode_size < word_bits\"\n by (clarsimp simp: si_cnode_size_def word_bits_def)\n\nlemma si_cnode_size_less_than_eq_word_size [simp]:\n \"si_cnode_size \\ word_bits\"\n by (rule less_imp_le_nat, simp)\n\nlemma si_cnode_size_greater_than_1 [simp]:\n \"1 < si_cnode_size\"\n by (clarsimp simp: si_cnode_size_def)\n\nlemma si_cnode_size_greater_than_2 [simp]:\n \"2 < si_cnode_size\"\n by (clarsimp simp: si_cnode_size_def)\n\nlemma unat_less_2_si_cnode_size:\n \"unat (cptr::32 word) < 2 ^ si_cnode_size\n \\ cptr < 2 ^ si_cnode_size\"\n by (metis si_cnode_size_less_than_word_size unat_power_lower32 word_less_nat_alt)\n\nlemma unat_less_2_si_cnode_size':\n \"(cptr::32 word) < 2 ^ si_cnode_size\n \\ unat cptr < 2 ^ si_cnode_size\"\n by (metis unat_less_helper word_unat_power)\n\n(* This is stored in the root TCB. *)\ndefinition\n si_cspace_cap :: cdl_cap\nwhere\n \"si_cspace_cap = CNodeCap si_cnode_id 0 (word_bits - si_cnode_size) si_cnode_size\"\n\n(* This is the cap the root TCB has to its own root cnode (stored in its root CNode). *)\ndefinition\n si_cnode_cap :: cdl_cap\nwhere\n \"si_cnode_cap = CNodeCap si_cnode_id 0 (word_bits - si_cnode_size) si_cnode_size\"\n\ndefinition\n root_tcb :: cdl_object\nwhere\n \"root_tcb = update_slots [tcb_cspace_slot \\ si_cspace_cap,\n tcb_vspace_slot \\ undefined,\n tcb_replycap_slot \\ undefined,\n tcb_caller_slot \\ undefined,\n tcb_ipcbuffer_slot \\ undefined,\n tcb_pending_op_slot \\ undefined] (Tcb (default_tcb minBound))\"\n\ndefinition\n empty_asid :: cdl_asid_pool\nwhere\n \"empty_asid = \\cdl_asid_pool_caps = empty_cap_map asid_low_bits\\\"\n\ndefinition\n si_asid :: \"sep_state \\ bool\"\nwhere\n \"si_asid \\\n (si_cnode_id, unat seL4_CapInitThreadASIDPool) \\c AsidPoolCap si_asidpool_id si_asidpool_base \\*\n si_asidpool_id \\f AsidPool empty_asid \\*\n (\\* offset\\{offset. offset < 2 ^ asid_low_bits}.\n (si_asidpool_id, offset) \\c -)\"\n\nabbreviation \"si_tcb_id \\ root_tcb_id\"\n\ndefinition si_objects :: \"sep_state \\ bool\"\nwhere\n \"si_objects \\\n si_tcb_id \\f root_tcb \\*\n si_cnode_id \\f CNode (empty_cnode si_cnode_size) \\*\n (si_tcb_id, tcb_cspace_slot) \\c si_cspace_cap \\*\n (si_tcb_id, tcb_pending_op_slot) \\c RunningCap \\*\n (si_cnode_id, unat seL4_CapInitThreadCNode) \\c si_cnode_cap \\*\n (si_cnode_id, unat seL4_CapIRQControl) \\c IrqControlCap \\*\n si_asid\"\n\ndefinition\n si_objects_extra_caps' :: \"cdl_object_id set \\ cdl_cptr list \\ cdl_cptr list \\ sep_state \\ bool\"\nwhere\n \"si_objects_extra_caps' obj_ids free_cptrs untyped_cptrs \\ \\s.\n \\untyped_caps all_available_ids.\n ((\\* (cptr, cap) \\ set (zip untyped_cptrs untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set (drop (card obj_ids) free_cptrs). (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\all_available_ids. obj_id \\o Untyped)) s\"\n\ndefinition\n si_objects_extra_caps :: \"cdl_object_id set \\ cdl_cptr list \\ cdl_cptr list\n \\ cdl_state \\ sep_state \\ bool\"\nwhere\n \"si_objects_extra_caps obj_ids free_cptrs untyped_cptrs spec \\ \\s.\n \\untyped_caps all_available_ids.\n ((\\* (cptr, cap) \\ set (zip untyped_cptrs untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set (drop (card obj_ids + card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec}) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\all_available_ids. obj_id \\o Untyped)) s\"\n\n\nlemma distinct_take_drop_append:\n \"distinct xs \\ set (take b (drop a xs)) \\ set (drop (a + b) xs) = {}\"\n by (metis distinct_append distinct_drop take_drop_append)\n\nlemma si_objects_extra_caps'_si_objects_extra_caps:\n \"distinct free_slots \\\n si_objects_extra_caps' obj_ids free_slots untyped_cptrs =\n (si_objects_extra_caps obj_ids free_slots untyped_cptrs spec \\*\n (\\* cptr \\ set (take (card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec})\n (drop (card obj_ids) free_slots)).\n (si_cnode_id, unat cptr) \\c NullCap))\"\n apply (rule ext)\n apply (clarsimp simp: si_objects_extra_caps'_def si_objects_extra_caps_def sep_conj_exists)\n apply (rule ex_eqI)+\n apply (subst take_drop_append [where a=\"card obj_ids\" and\n b=\"card {obj_id \\ obj_ids. cnode_or_tcb_at obj_id spec}\"])\n apply clarsimp\n apply (subst sep.prod.union_disjoint, (simp add: distinct_take_drop_append)+)+\n apply (clarsimp simp: sep_conj_ac)\n done\n\ndefinition\n si_irq_nodes :: \"cdl_state \\ sep_state \\ bool\"\nwhere\n \"si_irq_nodes spec \\\n (\\s. \\k_irq_table. (\\* irq\\used_irqs spec. irq \\irq k_irq_table irq \\*\n k_irq_table irq \\o IRQNode empty_irq_node) s)\"\n\n\n(***************************************\n * Lemmas about the root task objects. *\n ***************************************)\n\nlemma is_cnode_cap_si_cspace_cap [simp]:\n \"is_cnode_cap si_cspace_cap\"\n by (clarsimp simp: si_cspace_cap_def)\n\nlemma is_cnode_cap_si_cnode_cap [simp]:\n \"is_cnode_cap si_cnode_cap\"\n by (clarsimp simp: si_cnode_cap_def)\n\nlemma is_tcb_root_tcb [simp]:\n \"is_tcb root_tcb\"\n by (clarsimp simp: root_tcb_def)\n\nlemma cap_guard_size_si_cnode_cap_plus_si_cnode_size [simp]:\n \"cap_guard_size si_cnode_cap + si_cnode_size = word_bits\"\n by (clarsimp simp: si_cnode_cap_def)\n\nlemma cap_object_si_cspace_cap [simp]:\n \"cap_object si_cspace_cap = si_cnode_id\"\n by (clarsimp simp: cap_object_def cap_has_object_def si_cspace_cap_def)\n\nlemma cap_object_si_cnode_cap [simp]:\n \"cap_object si_cnode_cap = si_cnode_id\"\n by (clarsimp simp: cap_object_def cap_has_object_def si_cnode_cap_def)\n\n\nlemma offset_slot_si_cnode_size:\n \"slot < 2^si_cnode_size \\ offset (of_nat slot) si_cnode_size = slot\"\n by (clarsimp simp: offset_slot)\n\nlemma offset_slot_si_cnode_size':\n \"slot < 2^si_cnode_size \\ offset slot si_cnode_size = unat slot\"\n by (clarsimp simp: offset_slot')\n\nlemma guard_equal_si_cspace_cap:\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cspace_cap src_index 32\"\n apply (clarsimp simp: si_cspace_cap_def guard_equal_def Let_unfold)\n apply (subst and_mask_eq_iff_shiftr_0 [THEN iffD1])\n apply (clarsimp simp: word_bits_def)\n apply (erule less_mask_eq)\n apply (clarsimp simp: mask_def)\n done\n\nlemma guard_equal_si_cspace_cap':\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cspace_cap src_index word_bits\"\n by (drule guard_equal_si_cspace_cap, simp add: word_bits_def)\n\nlemma guard_equal_si_cnode_cap:\n \"src_index < 2 ^ si_cnode_size \\ guard_equal si_cnode_cap src_index 32\"\n apply (clarsimp simp: si_cnode_cap_def guard_equal_def Let_unfold)\n apply (subst and_mask_eq_iff_shiftr_0 [THEN iffD1])\n apply (clarsimp simp: word_bits_def)\n apply (erule less_mask_eq)\n apply (clarsimp simp: mask_def)\n done\n\nlemma seL4_CapInitThreadASIDPool_si_cnode_size [simp]:\n \"seL4_CapInitThreadASIDPool < 2 ^ si_cnode_size\"\n by (clarsimp simp: seL4_CapInitThreadASIDPool_def si_cnode_size_def)\n\nlemma guard_equal_si_cspace_cap_seL4_CapInitThreadASIDPool [simp]:\n \"guard_equal si_cspace_cap seL4_CapInitThreadASIDPool word_bits\"\n by (rule guard_equal_si_cspace_cap', simp)\n\nlemma si_cspace_cap_guard_equal:\n \"guard_equal si_cnode_cap src_index 32 \\ src_index < 2 ^ si_cnode_size\"\n apply (clarsimp simp: si_cnode_cap_def guard_equal_def\n Let_unfold si_cnode_size_def)\n apply (subst (asm) shiftr_mask_eq')\n apply (simp add: word_bits_size word_bits_def)\n apply (subst (asm) le_mask_iff [symmetric])\n apply (clarsimp simp: mask_def)\n apply (insert word32_less_sub_le [where x=src_index and n=12])\n apply (clarsimp simp: word_bits_def)\n done\n\nlemma one_lvl_lookup_si_cspace_cap [simp]:\n \"one_lvl_lookup si_cspace_cap word_bits si_cnode_size\"\n by (clarsimp simp: one_lvl_lookup_def si_cspace_cap_def)\n\nlemmas one_lvl_lookup_si_cspace_cap' [simp] =\n one_lvl_lookup_si_cspace_cap [simplified word_bits_def, simplified]\n\nlemma one_lvl_lookup_si_cnode_cap [simp]:\n \"one_lvl_lookup si_cnode_cap word_bits si_cnode_size\"\n by (clarsimp simp: one_lvl_lookup_def si_cnode_cap_def)\n\nlemmas one_lvl_lookup_si_cnode_cap' [simp] =\n one_lvl_lookup_si_cnode_cap [simplified word_bits_def, simplified]\n\nlemma obj_tcb_root_tcb [simp]:\n \"Tcb (obj_tcb root_tcb) = root_tcb\"\n by (clarsimp simp: obj_tcb_def root_tcb_def update_slots_def)\n\n(***************************\n * Lemmas about word size. *\n ***************************)\nlemma seL4_CapInitThreadCNode_less_than_si_cnode_size [simp]:\n \"seL4_CapInitThreadCNode < 2 ^ si_cnode_size\"\n apply (insert si_cnode_size_greater_than_1)\n apply (insert power_strict_increasing [where n=1 and a=\"(2::nat)\" and N=si_cnode_size, simplified])\n apply (clarsimp)\n apply (drule of_nat_less_pow_32)\n apply (clarsimp simp: seL4_CapInitThreadCNode_def)+\n done\n\nlemma offset_seL4_CapInitThreadCNode [simp]:\n \"offset seL4_CapInitThreadCNode si_cnode_size = unat seL4_CapInitThreadCNode\"\n by (rule offset_slot', simp)\n\nlemma seL4_CapIRQControl_less_than_si_cnode_size [simp]:\n \"seL4_CapIRQControl < 2 ^ si_cnode_size\"\n apply (simp add: seL4_CapIRQControl_def)\n apply (insert si_cnode_size_greater_than_2)\n apply (insert power_strict_increasing [where n=2 and a=\"(2::nat)\" and N=si_cnode_size, simplified])\n apply (drule of_nat_less_pow_32, simp_all)\n done\n\nlemma offset_seL4_CapIRQControl [simp]:\n \"offset seL4_CapIRQControl si_cnode_size = unat seL4_CapIRQControl\"\n by (rule offset_slot', simp)\n\n(* There is a cap in the root cnode that points to the obj_id specified.\n * This cap should be the default cap to that object.\n *\n * This predicate can be used for spec objects, or the duplicated cnode caps.\n *)\ndefinition si_cap_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_cap_at t si_caps spec dev obj_id \\ \\s.\n \\cap_ptr slot obj kobj_id.\n ((si_cnode_id, slot) \\c default_cap (object_type obj) {kobj_id} (object_size_bits obj) dev) s \\\n si_caps obj_id = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size \\\n cdl_objects spec obj_id = Some obj \\\n t obj_id = Some kobj_id\"\n\ndefinition si_irq_cap_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq \\ sep_pred\"\nwhere\n \"si_irq_cap_at si_irq_caps spec irq \\ \\s.\n \\cap_ptr slot.\n ((si_cnode_id, slot) \\c IrqHandlerCap irq) s \\\n si_irq_caps irq = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size\"\n\ndefinition si_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_caps_at t si_caps spec dev obj_ids \\\n \\* obj_id \\ obj_ids. (si_cap_at t si_caps spec) dev obj_id\"\n\ndefinition si_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq set \\ sep_pred\"\nwhere\n \"si_irq_caps_at si_irq_caps spec irqs \\\n \\* irq \\ irqs. si_irq_cap_at si_irq_caps spec irq\"\n\ndefinition\n si_obj_cap_at' :: \" (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_obj_cap_at' t si_caps spec dev obj_id slot \\ \\s. \\ spec_cap.\n si_cap_at t si_caps spec dev (cap_object spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_obj_cap_at where\n \"si_obj_cap_at t si_caps spec dev obj_id slot \\\n if original_cap_at (obj_id, slot) spec \\ cap_at cap_has_object (obj_id, slot) spec\n then si_obj_cap_at' t si_caps spec dev obj_id slot\n else \\\"\n\ndefinition\n si_obj_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_obj_caps_at t si_caps spec dev obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_obj_cap_at t si_caps spec dev obj_id slot\"\n\ndefinition\n si_objs_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\ bool \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_objs_caps_at t si_caps spec dev obj_ids \\\n \\* obj_id \\ obj_ids. (si_obj_caps_at t si_caps spec) dev obj_id\"\n\ndefinition\n si_spec_irq_cap_at' :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_irq_cap_at' si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_irq_cap_at si_irq_caps spec (cap_irq spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_spec_irq_cap_at where\n \"si_spec_irq_cap_at si_irq_caps spec obj_id slot \\\n if irqhandler_cap_at (obj_id, slot) spec\n then si_spec_irq_cap_at' si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_irq_caps_at si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_irq_cap_at si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_irqs_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_irqs_caps_at si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_irq_caps_at si_irq_caps spec obj_id\"\n\ndefinition\n \"si_null_cap_at t si_irq_caps spec obj_id \\\n \\s. \\cap_ptr slot obj kobj_id.\n ((si_cnode_id, slot) \\c NullCap) s \\\n si_irq_caps obj_id = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size \\\n cdl_objects spec obj_id = Some obj \\ t obj_id = Some kobj_id\"\n\ndefinition\n \"si_null_irq_cap_at si_irq_caps spec irq \\\n \\s. \\cap_ptr slot.\n ((si_cnode_id, slot) \\c NullCap) s \\\n si_irq_caps irq = Some cap_ptr \\\n unat cap_ptr = slot \\\n cap_ptr < 2 ^ si_cnode_size\"\n\ndefinition\n si_spec_obj_null_cap_at' :: \" (cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_obj_null_cap_at' t si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_null_cap_at t si_irq_caps spec (cap_object spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap\"\n\ndefinition si_spec_obj_null_cap_at where\n \"si_spec_obj_null_cap_at t si_irq_caps spec obj_id slot \\\n if original_cap_at (obj_id, slot) spec \\ cap_at cap_has_object (obj_id, slot) spec\n then si_spec_obj_null_cap_at' t si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_obj_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_obj_null_caps_at t si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_obj_null_cap_at t si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_objs_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_objs_null_caps_at t si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_obj_null_caps_at t si_irq_caps spec obj_id\"\n\ndefinition\n si_spec_irq_null_cap_at' :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ cdl_cnode_index \\ sep_pred\"\nwhere\n \"si_spec_irq_null_cap_at' si_irq_caps spec obj_id slot \\ \\s. \\ spec_cap.\n si_null_irq_cap_at si_irq_caps spec (cap_irq spec_cap) s \\\n opt_cap (obj_id, slot) spec = Some spec_cap \\ \\is_untyped_cap spec_cap\"\n\ndefinition si_spec_irq_null_cap_at where\n \"si_spec_irq_null_cap_at si_irq_caps spec obj_id slot \\\n if irqhandler_cap_at (obj_id, slot) spec\n then si_spec_irq_null_cap_at' si_irq_caps spec obj_id slot\n else \\\"\n\ndefinition\n si_spec_irq_null_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id \\ sep_pred\"\nwhere\n \"si_spec_irq_null_caps_at si_irq_caps spec obj_id \\\n \\* slot \\ dom (slots_of obj_id spec). si_spec_irq_null_cap_at si_irq_caps spec obj_id slot\"\n\ndefinition\n si_spec_irqs_null_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_spec_irqs_null_caps_at si_irq_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_spec_irq_null_caps_at si_irq_caps spec obj_id\"\n\ndefinition si_null_caps_at :: \"(cdl_object_id \\ cdl_object_id option) \\\n (cdl_object_id \\ cdl_cptr option) \\ cdl_state \\\n cdl_object_id set \\ sep_pred\"\nwhere\n \"si_null_caps_at t si_caps spec obj_ids \\\n \\* obj_id \\ obj_ids. si_null_cap_at t si_caps spec obj_id\"\n\n\nlemma si_cap_at_less_si_cnode_size:\n \"\\\\si_cap_at t opt_sel4_cap spec dev obj_id \\* R\\ s;\n Some cap_ptr = opt_sel4_cap obj_id\\\n \\ cap_ptr < 2 ^ si_cnode_size\"\n by (clarsimp simp: si_cap_at_def sep_conj_exists)\n\nlemma si_irq_cap_at_less_si_cnode_size:\n \"\\\\si_irq_cap_at opt_sel4_cap spec obj_id \\* R\\ s;\n Some cap_ptr = opt_sel4_cap obj_id\\\n \\ cap_ptr < 2 ^ si_cnode_size\"\n by (clarsimp simp: si_irq_cap_at_def sep_conj_exists)\n\nlemma si_cap_at_has_k_obj_id:\n \"\\\\si_cap_at t opt_sel4_cap spec dev obj_id \\* R\\ s\\\n \\ \\cap_object_id. t obj_id = Some cap_object_id\"\n by (clarsimp simp: si_cap_at_def sep_conj_exists)\n\n(******************************************************\n * Using just si_cap_at when you have si_caps_at. *\n ******************************************************)\n\nlemma valid_si_caps_at_si_cap_at:\n \"\\finite obj_ids; obj_id \\ obj_ids;\n (\\R. \\\\si_cap_at t orig_caps spec dev obj_id \\* P \\* R\\\\\n f\n \\\\_.\\si_cap_at t orig_caps spec dev obj_id \\* Q \\* R\\\\)\\\n \\\n \\\\si_caps_at t orig_caps spec dev obj_ids \\* P \\* R\\\\\n f\n \\\\_.\\si_caps_at t orig_caps spec dev obj_ids \\* Q \\* R\\\\\"\n apply (clarsimp simp: si_caps_at_def)\n apply (drule sep_set_conj_map_singleton_wp [where f=f and\n I=\"si_cap_at t orig_caps spec dev\" and P=P and Q=Q and R=R, rotated])\n apply (clarsimp simp: sep_conj_ac)+\n done\n\n(**********************************************************\n * The pre and post conditions of the system initialiser. *\n **********************************************************)\n\n(* That the boot info is valid, and that there are enough free slots to initialise a system. *)\ndefinition\n valid_boot_info\nwhere\n \"valid_boot_info bootinfo spec \\ \\s.\n \\untyped_caps fstart fend ustart uend.\n ((\\*(cptr, cap) \\ set (zip [ustart .e. uend - 1] untyped_caps). (si_cnode_id, unat cptr) \\c cap) \\*\n (\\* cptr \\ set [fstart .e. fend - 1]. (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* obj_id\\(\\cap\\set untyped_caps. cap_free_ids cap). obj_id \\o Untyped) \\*\n si_objects \\* si_irq_nodes spec) s \\\n card (dom (cdl_objects spec)) +\n card {obj_id. cnode_or_tcb_at obj_id spec} \\ unat fend - unat fstart \\\n length untyped_caps = unat uend - unat ustart \\\n distinct_sets (map cap_free_ids untyped_caps) \\\n list_all is_full_untyped_cap untyped_caps \\\n list_all well_formed_untyped_cap untyped_caps \\\n list_all (\\c. \\ is_device_cap c) untyped_caps \\\n bi_untypes bootinfo = (ustart, uend) \\\n bi_free_slots bootinfo = (fstart, fend) \\\n ustart < 2 ^ si_cnode_size \\\n (uend - 1) < 2 ^ si_cnode_size \\\n fstart < 2 ^ si_cnode_size \\\n (fend - 1) < 2 ^ si_cnode_size \\\n uend \\ 0 \\ fend \\ 0\"\n\ndefinition\n si_final_objects :: \"cdl_state \\ (cdl_object_id \\ cdl_object_id option) \\ sep_pred\"\nwhere\n \"si_final_objects spec t \\ \\s.\n \\dup_caps (untyped_cptrs::32 word list) (free_cptrs::32 word list) untyped_caps all_available_ids.\n ((\\* cptr \\ set (take (card (dom (cdl_objects spec))) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* cptr \\ set (drop (card (dom (cdl_objects spec)) +\n card ({obj_id. cnode_or_tcb_at obj_id spec})) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap) \\*\n (\\* (cptr, untyped_cap) \\ set (zip untyped_cptrs untyped_caps).\n (si_cnode_id, unat cptr) \\c untyped_cap) \\*\n (\\* obj_id \\ all_available_ids. obj_id \\o Untyped) \\*\n (\\* obj_id \\ {obj_id. cnode_or_tcb_at obj_id spec}. (si_cap_at t dup_caps spec False obj_id)) \\*\n si_objects) s\"\n\n(********************************************************\n * Conversion of si_objs_caps_at to si_caps_at *\n ********************************************************)\n\nlemma orig_cap_rewrite:\n \"Set.filter (\\cap_ref. original_cap_at cap_ref spec \\ cap_at cap_has_object cap_ref spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}.\n dom (slots_of obj_id spec)) =\n {cap_ref. original_cap_at cap_ref spec \\ object_cap_ref cap_ref spec}\"\n by (auto simp: object_cap_ref_def opt_cap_def object_at_def cap_at_def real_object_at_def\n split: option.splits)\n\nlemma slots_tcb:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap;\n cdl_objects spec obj_id = Some obj; obj = Tcb tcb\\ \\\n slot = 0 \\\n slot = 1 \\\n slot = 2 \\\n slot = 3 \\\n slot = 4 \\\n slot = 5 \\\n slot = 6\"\n apply (frule (1) well_formed_object_slots)\n apply (drule (1) well_formed_well_formed_tcb)\n apply (clarsimp simp: well_formed_tcb_def opt_cap_def slots_of_def opt_object_def)\n apply (drule (1) dom_eqD)\n apply (clarsimp simp: object_default_state_def2 dom_object_slots_default_tcb\n tcb_pending_op_slot_def tcb_boundntfn_slot_def)\n done\n\nlemma object_at_dom_cdl_objects:\n \"object_at P obj_id s \\ obj_id \\ dom (cdl_objects s)\"\n by (clarsimp simp: object_at_def)\n\nlemma foo:\n \"\\well_formed spec; irq_node_at obj_id spec\\\n \\ obj_id \\ irq_nodes spec\"\n by (metis irq_nodes_def mem_Collect_eq)\n\nlemma well_formed_irqhandler_cap_in_cnode:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap;\n is_irqhandler_cap cap; cdl_objects spec obj_id = Some obj\\\n \\ is_cnode obj\"\n apply (case_tac obj)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def opt_object_def\n is_cnode_def object_at_def is_asidpool_def)+\n apply (frule (3) slots_tcb)\n apply (drule (1) well_formed_well_formed_tcb)\n apply (clarsimp simp: well_formed_tcb_def opt_cap_def slots_of_def opt_object_def)\n apply (erule allE [where x=slot])\n apply (simp add: tcb_slot_defs cap_type_def split: cdl_cap.splits)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def opt_object_def\n is_cnode_def object_at_def is_asidpool_def)\n apply (frule_tac obj_id=obj_id in well_formed_asidpool_at, simp add: object_at_def)\n apply (frule (1) well_formed_pt, simp add: object_at_def, simp+)\n apply (frule (1) well_formed_pd, simp add: object_at_def, simp+)\n apply (clarsimp simp: is_fake_pt_cap_def split: cdl_cap.splits)\n apply (fastforce simp: opt_cap_def slots_of_def object_slots_def opt_object_def\n is_cnode_def object_at_def is_asidpool_def)+\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (fastforce simp: well_formed_irq_node_def opt_cap_def slots_of_def opt_object_def\n object_at_def irq_nodes_def is_irq_node_def)\n done\n\nlemma well_formed_irqhandler_cap_in_cnode_at:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap; is_irqhandler_cap cap\\\n \\ cnode_at obj_id spec\"\n apply (frule opt_cap_cdl_objects, clarsimp)\n apply (drule (3) well_formed_irqhandler_cap_in_cnode)\n apply (clarsimp simp: object_at_def)\n done\n\nlemma irqhandler_cap_rewrite:\n \"well_formed spec \\\n Set.filter (\\irq. irqhandler_cap_at irq spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}.\n dom (slots_of obj_id spec)) =\n {cap_ref. irqhandler_cap_at cap_ref spec}\"\n apply (clarsimp simp: object_cap_ref_def object_at_def cap_at_def\n split: option.splits)\n apply rule\n apply clarsimp\n apply clarsimp\n apply (frule opt_cap_dom_cdl_objects)\n apply (frule opt_cap_dom_slots_of, clarsimp)\n apply (frule (3) well_formed_irqhandler_cap_in_cnode)\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (clarsimp simp: well_formed_irq_node_def object_at_def\n opt_cap_def slots_of_def opt_object_def dom_def)\n done\n\nlemma well_formed_object_cap_real:\n \"well_formed spec\n \\ object_cap_ref cap_ref spec =\n (cap_at_to_real_object cap_ref spec \\\n cnode_at (fst cap_ref) spec)\"\n apply (clarsimp simp: cap_at_def cap_at_to_real_object_def object_cap_ref_def)\n apply (rule iffI)\n apply clarsimp\n apply (drule (1) well_formed_well_formed_cap_to_real_object', simp)\n apply (clarsimp simp: well_formed_cap_to_real_object_def real_object_at_def)\n apply (clarsimp simp: real_object_at_def opt_cap_dom_cdl_objects)\n done\n\n(* This lemma converts between the two represenatations of the fact that the\n * root task has orig caps to each of the objects.\n *\n * This can be specified either:\n * - on the objects themselves.\n * - on the cap slots of CNodes that have a orig cap in them.\n *\n * This relies on the bijection between orig capabilities and objects in the spec.\n *)\n\nlemma si_caps_at_conversion:\n \"\\well_formed spec;\n real_ids = {obj_id. real_object_at obj_id spec};\n cnode_ids = {obj_id. cnode_at obj_id spec}\\\n \\ si_objs_caps_at t si_caps spec dev cnode_ids =\n si_caps_at t si_caps spec dev real_ids\"\n apply (clarsimp simp: si_objs_caps_at_def si_obj_caps_at_def [abs_def]\n si_obj_cap_at_def [abs_def] si_caps_at_def)\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst orig_cap_rewrite)\n apply (frule well_formed_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_object cap_ref spec\", symmetric])\n apply (subst well_formed_object_cap_real, simp+)\n apply (simp add: real_objects_def real_object_at_def)\n apply (subst well_formed_object_cap_real, simp+)\n apply (clarsimp simp: cap_ref_object_def object_cap_ref_def si_obj_cap_at'_def)\n done\n\n\nlemma si_null_caps_at_conversion:\n \"\\well_formed spec;\n real_ids = {obj_id. real_object_at obj_id spec};\n cnode_ids = {obj_id. cnode_at obj_id spec}\\\n \\ si_spec_objs_null_caps_at t si_caps spec cnode_ids =\n si_null_caps_at t si_caps spec real_ids\"\n apply (clarsimp simp: si_spec_objs_null_caps_at_def si_spec_obj_null_caps_at_def [abs_def]\n si_spec_obj_null_cap_at_def [abs_def] si_null_caps_at_def)\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst orig_cap_rewrite)\n apply (frule well_formed_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_object cap_ref spec\"\n and h=\"(si_null_cap_at t si_caps spec)\"\n and B=\"{obj_id. real_object_at obj_id spec}\", symmetric])\n apply (subst well_formed_object_cap_real, simp+)\n apply (simp add: real_objects_def real_object_at_def)\n apply (subst well_formed_object_cap_real, simp+)\n apply (clarsimp simp: cap_ref_object_def object_cap_ref_def si_spec_obj_null_cap_at'_def)\n done\n\nlemma si_null_caps_at_reindex:\n \"\\distinct (obj_ids::32 word list); distinct (free_cptrs);\n orig_caps = map_of (zip obj_ids free_cptrs);\n length obj_ids \\ length free_cptrs\\\n \\ (\\* obj_id\\set obj_ids.\n (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n orig_caps obj_id = Some cap_ptr))\n = (\\* cptr\\set (take (length obj_ids) free_cptrs).\n (si_cnode_id, unat cptr) \\c NullCap)\"\n apply (rule sep_map_set_conj_reindex_cong [symmetric, where\n f=\"\\obj_id. the (orig_caps obj_id)\"\n and h=\"\\cptr. (si_cnode_id, unat cptr) \\c NullCap\"\n and B=\"set (take (length obj_ids) free_cptrs)\"])\n apply clarsimp\n apply (erule (2) map_of_zip_inj')\n apply clarsimp\n apply (subst zip_take_length[symmetric])\n apply (subst map_of_zip_range)\n apply (clarsimp simp: min_def)\n apply assumption\n apply simp\n apply clarsimp\n apply (rule ext)\n apply rule\n apply clarsimp\n apply (rule_tac x=\"the (map_of (zip obj_ids free_cptrs) a)\" in exI)\n apply clarsimp\n apply (frule_tac x=a in map_of_zip_is_Some', clarsimp)\n done\n\nlemma si_null_caps_at_simplified_helper:\n \"\\(si_null_caps_at t orig_caps spec obj_ids) s\\ \\\n (\\* obj_id \\ obj_ids. (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n orig_caps obj_id = Some cap_ptr)) s\"\n apply (clarsimp simp: si_null_caps_at_def si_null_cap_at_def [abs_def])\n apply (erule sep_map_set_conj_impl)\n apply blast\n apply clarsimp\n done\n\nlemma si_null_caps_at_simplified:\n \"\\(si_spec_objs_null_caps_at t si_caps spec cnode_ids) s;\n well_formed spec;\n cnode_ids = {obj_id. cnode_at obj_id spec};\n real_ids = {obj_id. real_object_at obj_id spec};\n real_ids = set obj_ids;\n distinct obj_ids; distinct free_cptrs;\n si_caps = map_of (zip obj_ids free_cptrs);\n length obj_ids \\ length free_cptrs\\ \\\n (\\* cptr \\ set (take (length obj_ids) free_cptrs). ((si_cnode_id, unat cptr) \\c NullCap)) s\"\n apply (subst (asm) si_null_caps_at_conversion, assumption+)\n apply (drule si_null_caps_at_simplified_helper)\n apply (subst si_null_caps_at_reindex [symmetric], simp+)\n done\n\nlemma map_of_zip_range':\n \"\\length xs = length ys; distinct xs; set xs = X\\\n \\ (\\x. (the (map_of (zip xs ys) x))) ` X = set ys\"\n by (metis map_of_zip_range)\n\n\n\n\nlemma si_irq_caps_at_conversion:\n \"\\well_formed spec;\n cnode_ids = {obj_id. cnode_at obj_id spec};\n irqs = used_irqs spec\\\n \\ si_spec_irqs_caps_at irq_caps spec cnode_ids =\n si_irq_caps_at irq_caps spec irqs\"\n apply (clarsimp simp: si_spec_irqs_caps_at_def si_irq_caps_at_def\n si_spec_irq_caps_at_def [abs_def]\n si_spec_irq_cap_at_def [abs_def])\n apply (subst sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst sep_map_set_conj_restrict_predicate)\n apply (rule finite_SigmaI, clarsimp+)\n apply (subst irqhandler_cap_rewrite, assumption)\n apply (frule well_formed_irqhandler_bij)\n apply (clarsimp simp: bij_betw_def)\n apply (rule sep_map_set_conj_reindex_cong [where f=\"\\cap_ref. cap_ref_irq cap_ref spec\", symmetric], simp+)\n apply (clarsimp simp: si_spec_irq_cap_at'_def cap_ref_irq_def cap_at_def)\n done\n\ndefinition si_null_irq_caps_at :: \"(cdl_irq \\ cdl_cptr option) \\ cdl_state \\\n cdl_irq set \\ sep_pred\"\nwhere\n \"si_null_irq_caps_at si_irq_caps spec irqs \\\n \\* irq \\ irqs. si_null_irq_cap_at si_irq_caps spec irq\"\n\nlemma si_null_irq_caps_at_simplified_helper:\n \"\\(si_null_irq_caps_at si_irq_caps spec irqs) s\\ \\\n (\\* irq \\ irqs. (\\s. \\cap_ptr. ((si_cnode_id, unat cap_ptr) \\c NullCap) s \\\n si_irq_caps irq = Some cap_ptr)) s\"\n apply (clarsimp simp: si_null_irq_caps_at_def si_null_irq_cap_at_def)\n apply (erule sep_map_set_conj_impl)\n apply blast\n apply clarsimp\n done\n\nlemma map_of_zip_inj2:\n \"\\distinct xs; distinct ys; length xs \\ length ys; set xs = X\\\n \\ inj_on (\\x. the (map_of (zip xs ys) x)) X\"\n by (metis map_of_zip_inj')\n\nlemma opt_cap_has_slots:\n \"\\opt_cap (obj_id, slot) spec = Some cap\\\n \\ object_at has_slots obj_id spec\"\n by (auto simp: object_at_def has_slots_def opt_cap_def slots_of_def opt_object_def object_slots_def\n split: option.splits cdl_object.splits)\n\nlemma well_formed_non_ntfn_in_real_object:\n \"\\well_formed spec; opt_cap (obj_id, slot) spec = Some cap; \\is_ntfn_cap cap; cap \\ NullCap\\\n \\ real_object_at obj_id spec\"\n apply (frule opt_cap_cdl_objects, clarsimp)\n apply (frule (1) well_formed_well_formed_irq_node)\n apply (clarsimp simp: well_formed_irq_node_def real_object_at_def\n opt_cap_def slots_of_def opt_object_def opt_cap_dom_cdl_objects)\n done\n\n\nlemma irqhandler_cap_at_simp:\n \"well_formed spec \\\n {(obj_id, slot). cnode_at obj_id spec \\ irqhandler_cap_at (obj_id, slot) spec} =\n {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec}\"\n apply (safe)\n apply (clarsimp simp: cap_at_def)\n apply (frule (2) well_formed_irqhandler_cap_in_cnode_at)\n apply (frule (1) well_formed_non_ntfn_in_real_object, simp+)\n done\n\nlemma orig_cap_rewrite_v2:\n \"(SIGMA obj_id:{obj_id. cnode_at obj_id spec}. dom (slots_of obj_id spec)) =\n {(obj_id, slot). cnode_at obj_id spec \\ slots_of obj_id spec slot \\ None}\"\n by auto\n\nlemma rewrite_irqhandler_cap_at:\n \"well_formed spec \\\n Set.filter (\\cap_ref. irqhandler_cap_at cap_ref spec)\n (SIGMA obj_id:{obj_id. cnode_at obj_id spec}. dom (slots_of obj_id spec)) =\n {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec}\"\n apply (subst irqhandler_cap_at_simp [symmetric])\n by (auto simp: opt_cap_def cap_at_def)\n\nlemma well_formed_used_irqs_rewrite:\n \"well_formed spec \\\n (\\cap_ref. cap_ref_irq cap_ref spec) ` {(obj_id, slot). irqhandler_cap_at (obj_id, slot) spec} =\n used_irqs spec\"\n apply (drule well_formed_irqhandler_bij)\n apply (auto simp: bij_betw_def)\n done\n\n\nlemma si_irq_null_caps_at_simplified:\n \"\\(si_spec_irqs_null_caps_at irq_caps spec {obj_id. cnode_at obj_id spec}) s;\n well_formed spec;\n distinct irqs; distinct free_cptrs;\n set irqs = used_irqs spec;\n irq_caps = map_of (zip irqs free_cptrs);\n length irqs \\ length free_cptrs\\ \\\n (\\* cptr \\ set (take (length irqs) free_cptrs). ((si_cnode_id, unat cptr) \\c NullCap)) s\"\n apply (clarsimp simp: si_spec_irqs_null_caps_at_def si_spec_irq_null_caps_at_def\n si_spec_irq_null_cap_at_def si_spec_irqs_caps_at_def)\n apply (subst (asm) sep.prod.Sigma, clarsimp+)\n apply (clarsimp simp: split_def)\n apply (subst (asm) sep_map_set_conj_restrict_predicate, rule finite_SigmaI, clarsimp+)\n apply (subst (asm) rewrite_irqhandler_cap_at, simp)\n apply (subst (asm) sep_map_set_conj_reindex_cong [where\n f = \"\\cap_ref. cap_ref_irq cap_ref spec\"\n and h = \"si_null_irq_cap_at (map_of (zip irqs free_cptrs)) spec\", symmetric])\n apply (drule well_formed_irqhandler_bij)\n apply (clarsimp simp: bij_betw_def cond_case_prod_eta)\n apply simp\n apply (clarsimp simp: si_spec_irq_null_cap_at'_def cap_at_def cap_ref_irq_def)\n apply clarsimp\n apply (drule si_null_irq_caps_at_simplified_helper [simplified si_null_irq_caps_at_def])\n apply (subst (asm) sep_map_set_conj_reindex_cong [symmetric, where\n f = \"\\irq. the ( map_of (zip irqs free_cptrs) irq)\"\n and h = \"\\cptr. (si_cnode_id, unat cptr) \\c NullCap\"\n and B = \"set (take (length irqs) free_cptrs)\"])\n apply (subst well_formed_used_irqs_rewrite, assumption)\n apply (metis map_of_zip_inj')\n apply (subst well_formed_used_irqs_rewrite, assumption)\n apply (subst zip_take_length[symmetric], subst map_of_zip_range', simp+)\n apply (rule ext)\n apply rule\n apply clarsimp\n apply (rule_tac x=\"the (map_of (zip irqs free_cptrs) a)\" in exI)\n apply clarsimp\n apply (frule_tac x1=\"(cap_irq (the (opt_cap (aa, b) spec)))\" in map_of_zip_is_Some'[THEN iffD1], clarsimp)\n apply (fastforce simp: cap_at_def used_irqs_def all_caps_def)\n apply (clarsimp simp: cap_ref_irq_def)\n apply simp\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/sys-init/RootTask_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.2974699363766585, "lm_q1q2_score": 0.16263816328555492}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__128.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__128 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__128 and some rule r*}\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__128:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__128:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Remote_PutXVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__128:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__128:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__128:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__128:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__128:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_PutX))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__128:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ShWbVsinv__128:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__128:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__128:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__128:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__128:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__128:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__128:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__128:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__128:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__128:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__128:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__128:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__128:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__128:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__128:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__128:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__128:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__128:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__128:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__128:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__128:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__128:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__128:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__128:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__128:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__128:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__128 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__128.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3174262720448507, "lm_q1q2_score": 0.1624322941746917}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__26_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__26_on_rules imports n_german_lemma_on_inv__26\nbegin\nsection{*All lemmas on causal relation between inv__26*}\nlemma lemma_inv__26_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__26 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__26) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__26_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3174262591305011, "lm_q1q2_score": 0.1624322875662046}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__24_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__24_on_rules imports n_g2kAbsAfter_lemma_on_inv__24\nbegin\nsection{*All lemmas on causal relation between inv__24*}\nlemma lemma_inv__24_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__24 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__24) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__24) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__24_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3073580105206753, "lm_q1q2_score": 0.16207495754062293}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__48_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__48_on_rules imports n_g2kAbsAfter_lemma_on_inv__48\nbegin\nsection{*All lemmas on causal relation between inv__48*}\nlemma lemma_inv__48_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__48 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__48) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__48) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__48_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3140505385717077, "lm_q1q2_score": 0.16193071223111163}} {"text": "(* Title: HOL/MicroJava/JVM/JVMDefensive.thy\n Author: Gerwin Klein\n Copyright GPL\n*)\n\nsection \\A Defensive JVM\\\n\ntheory JVMDefensive\nimports JVMExec \"../Common/Conform\"\nbegin\n\ntext \\\n Extend the state space by one element indicating a type error (or\n other abnormal termination)\\\ndatatype 'a type_error = TypeError | Normal 'a\n\nfun is_Addr :: \"val \\ bool\" where\n \"is_Addr (Addr a) \\ True\"\n| \"is_Addr v \\ False\"\n\nfun is_Intg :: \"val \\ bool\" where\n \"is_Intg (Intg i) \\ True\"\n| \"is_Intg v \\ False\"\n\nfun is_Bool :: \"val \\ bool\" where\n \"is_Bool (Bool b) \\ True\"\n| \"is_Bool v \\ False\"\n\ndefinition is_Ref :: \"val \\ bool\" where\n \"is_Ref v \\ v = Null \\ is_Addr v\"\n\nprimrec check_instr :: \"[instr, jvm_prog, heap, val list, val list, \n cname, mname, pc, frame list] \\ bool\" where\n check_instr_Load:\n \"check_instr (Load n) P h stk loc C M\\<^sub>0 pc frs = \n (n < length loc)\"\n\n| check_instr_Store:\n \"check_instr (Store n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk \\ n < length loc)\"\n\n| check_instr_Push:\n \"check_instr (Push v) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (\\is_Addr v)\"\n\n| check_instr_New:\n \"check_instr (New C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n is_class P C\"\n\n| check_instr_Getfield:\n \"check_instr (Getfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk \\ (\\C' T. P \\ C sees F:T in C') \\ \n (let (C', T) = field P C F; ref = hd stk in \n C' = C \\ is_Ref ref \\ (ref \\ Null \\ \n h (the_Addr ref) \\ None \\ \n (let (D,vs) = the (h (the_Addr ref)) in \n P \\ D \\\\<^sup>* C \\ vs (F,C) \\ None \\ P,h \\ the (vs (F,C)) :\\ T))))\" \n\n| check_instr_Putfield:\n \"check_instr (Putfield F C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (1 < length stk \\ (\\C' T. P \\ C sees F:T in C') \\\n (let (C', T) = field P C F; v = hd stk; ref = hd (tl stk) in \n C' = C \\ is_Ref ref \\ (ref \\ Null \\ \n h (the_Addr ref) \\ None \\ \n (let D = fst (the (h (the_Addr ref))) in \n P \\ D \\\\<^sup>* C \\ P,h \\ v :\\ T))))\" \n\n| check_instr_Checkcast:\n \"check_instr (Checkcast C) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_class P C \\ is_Ref (hd stk))\"\n\n| check_instr_Invoke:\n \"check_instr (Invoke M n) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (n < length stk \\ is_Ref (stk!n) \\ \n (stk!n \\ Null \\ \n (let a = the_Addr (stk!n); \n C = cname_of h a;\n Ts = fst (snd (method P C M))\n in h a \\ None \\ P \\ C has M \\ \n P,h \\ rev (take n stk) [:\\] Ts)))\"\n \n| check_instr_Return:\n \"check_instr Return P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ ((0 < length frs) \\ \n (P \\ C\\<^sub>0 has M\\<^sub>0) \\ \n (let v = hd stk; \n T = fst (snd (snd (method P C\\<^sub>0 M\\<^sub>0)))\n in P,h \\ v :\\ T)))\"\n \n| check_instr_Pop:\n \"check_instr Pop P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs = \n (0 < length stk)\"\n\n| check_instr_IAdd:\n \"check_instr IAdd P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (1 < length stk \\ is_Intg (hd stk) \\ is_Intg (hd (tl stk)))\"\n\n| check_instr_IfFalse:\n \"check_instr (IfFalse b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_Bool (hd stk) \\ 0 \\ int pc+b)\"\n\n| check_instr_CmpEq:\n \"check_instr CmpEq P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (1 < length stk)\"\n\n| check_instr_Goto:\n \"check_instr (Goto b) P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 \\ int pc+b)\"\n\n| check_instr_Throw:\n \"check_instr Throw P h stk loc C\\<^sub>0 M\\<^sub>0 pc frs =\n (0 < length stk \\ is_Ref (hd stk))\"\n\ndefinition check :: \"jvm_prog \\ jvm_state \\ bool\" where\n \"check P \\ = (let (xcpt, h, frs) = \\ in\n (case frs of [] \\ True | (stk,loc,C,M,pc)#frs' \\ \n P \\ C has M \\\n (let (C',Ts,T,mxs,mxl\\<^sub>0,ins,xt) = method P C M; i = ins!pc in\n pc < size ins \\ size stk \\ mxs \\\n check_instr i P h stk loc C M pc frs')))\"\n\n\ndefinition exec_d :: \"jvm_prog \\ jvm_state \\ jvm_state option type_error\" where\n \"exec_d P \\ = (if check P \\ then Normal (exec (P, \\)) else TypeError)\"\n\n\ninductive_set\n exec_1_d :: \"jvm_prog \\ (jvm_state type_error \\ jvm_state type_error) set\" \n and exec_1_d' :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ \\ _ -jvmd\\\\<^sub>1 _\" [61,61,61]60)\n for P :: jvm_prog\nwhere\n \"P \\ \\ -jvmd\\\\<^sub>1 \\' \\ (\\,\\') \\ exec_1_d P\"\n| exec_1_d_ErrorI: \"exec_d P \\ = TypeError \\ P \\ Normal \\ -jvmd\\\\<^sub>1 TypeError\"\n| exec_1_d_NormalI: \"exec_d P \\ = Normal (Some \\') \\ P \\ Normal \\ -jvmd\\\\<^sub>1 Normal \\'\"\n\n\\ \\reflexive transitive closure:\\\ndefinition exec_all_d :: \"jvm_prog \\ jvm_state type_error \\ jvm_state type_error \\ bool\" \n (\"_ \\ _ -jvmd\\ _\" [61,61,61]60) where\n exec_all_d_def1: \"P \\ \\ -jvmd\\ \\' \\ (\\,\\') \\ (exec_1_d P)\\<^sup>*\"\n\nnotation (ASCII)\n \"exec_all_d\" (\"_ |- _ -jvmd-> _\" [61,61,61]60)\n\nlemma exec_1_d_eq:\n \"exec_1_d P = {(s,t). \\\\. s = Normal \\ \\ t = TypeError \\ exec_d P \\ = TypeError} \\ \n {(s,t). \\\\ \\'. s = Normal \\ \\ t = Normal \\' \\ exec_d P \\ = Normal (Some \\')}\"\nby (auto elim!: exec_1_d.cases intro!: exec_1_d.intros)\n\n\ndeclare split_paired_All [simp del]\ndeclare split_paired_Ex [simp del]\n\nlemma if_neq [dest!]:\n \"(if P then A else B) \\ B \\ P\"\n by (cases P, auto)\n\nlemma exec_d_no_errorI [intro]:\n \"check P \\ \\ exec_d P \\ \\ TypeError\"\n by (unfold exec_d_def) simp\n\ntheorem no_type_error_commutes:\n \"exec_d P \\ \\ TypeError \\ exec_d P \\ = Normal (exec (P, \\))\"\n by (unfold exec_d_def, auto)\n\n\nlemma defensive_imp_aggressive:\n \"P \\ (Normal \\) -jvmd\\ (Normal \\') \\ P \\ \\ -jvm\\ \\'\"\n(*<*)\nproof -\n have \"\\x y. P \\ x -jvmd\\ y \\ \\\\ \\'. x = Normal \\ \\ y = Normal \\' \\ P \\ \\ -jvm\\ \\'\"\n apply (unfold exec_all_d_def1)\n apply (erule rtrancl_induct)\n apply (simp add: exec_all_def)\n apply (fold exec_all_d_def1)\n apply simp\n apply (intro allI impI)\n apply (erule exec_1_d.cases, simp)\n apply (simp add: exec_all_def exec_d_def split: type_error.splits if_split_asm)\n apply (rule rtrancl_trans, assumption)\n apply blast\n done\n moreover\n assume \"P \\ (Normal \\) -jvmd\\ (Normal \\')\" \n ultimately\n show \"P \\ \\ -jvm\\ \\'\" by blast\nqed\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/JVM/JVMDefensive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3140505385717077, "lm_q1q2_score": 0.16193071223111158}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\nARM-specific VSpace invariants\n*)\n\ntheory ArchVSpace_AI\nimports VSpacePre_AI\nbegin\n\ncontext Arch begin global_naming ARM\n\nlemma kernel_base_shift_cast_le:\n fixes x :: \"12 word\"\n shows\n \"(kernel_base >> 20 \\ ucast x) =\n (ucast (kernel_base >> 20) \\ x)\"\n apply (simp add: word_le_def)\n apply (subst uint_ucast, simp, simp add: kernel_base_def)\n apply (simp only: ucast_def)\n apply (subst word_uint.Abs_inverse)\n apply (cut_tac x=x in word_uint.Rep)\n apply (simp add: uints_num)\n apply simp\n done\n\n(* FIXME: move to Invariant_AI *)\ndefinition\n glob_vs_refs_arch :: \"arch_kernel_obj \\ (vs_ref \\ obj_ref) set\"\n where \"glob_vs_refs_arch \\ \\ko. case ko of\n (ASIDPool pool) \\\n (\\(r,p). (VSRef (ucast r) (Some AASIDPool), p)) ` graph_of pool\n | (PageDirectory pd) \\\n (\\(r,p). (VSRef (ucast r) (Some APageDirectory), p))\n ` graph_of (pde_ref o pd)\n | _ \\ {}\"\n\ndeclare glob_vs_refs_arch_def[simp]\n\ndefinition\n \"glob_vs_refs \\ arch_obj_fun_lift glob_vs_refs_arch {}\"\n\ncrunch pspace_in_kernel_window[wp]: perform_page_invocation \"pspace_in_kernel_window\"\n (simp: crunch_simps wp: crunch_wps)\n\ndefinition\n \"pd_at_uniq asid pd \\ \\s. pd \\ ran ((option_map snd o arm_asid_map (arch_state s) |` (- {asid})))\"\n\n\ncrunch inv[wp]: find_pd_for_asid_assert \"P\"\n (simp: crunch_simps)\n\nlemma asid_word_bits [simp]: \"asid_bits < word_bits\"\n by (simp add: asid_bits_def word_bits_def)\n\n\nlemma asid_low_high_bits:\n \"\\ x && mask asid_low_bits = y && mask asid_low_bits;\n ucast (asid_high_bits_of x) = (ucast (asid_high_bits_of y)::word32);\n x \\ 2 ^ asid_bits - 1; y \\ 2 ^ asid_bits - 1 \\\n \\ x = y\"\n apply (rule word_eqI)\n apply (simp add: upper_bits_unset_is_l2p_32 [symmetric] bang_eq nth_ucast word_size)\n apply (clarsimp simp: asid_high_bits_of_def nth_ucast nth_shiftr)\n apply (simp add: asid_high_bits_def asid_bits_def asid_low_bits_def word_bits_def)\n subgoal premises prems[rule_format] for n\n apply (cases \"n < 10\")\n using prems(1)\n apply fastforce\n apply (cases \"n < 17\")\n using prems(2)[where n=\"n - 10\"]\n apply fastforce\n using prems(3-)\n by (simp add: linorder_not_less)\n done\n\nlemma asid_low_high_bits':\n \"\\ ucast x = (ucast y :: 10 word);\n asid_high_bits_of x = asid_high_bits_of y;\n x \\ 2 ^ asid_bits - 1; y \\ 2 ^ asid_bits - 1 \\\n \\ x = y\"\n by (rule asid_low_high_bits; (assumption|word_eqI_solve simp: asid_low_bits_def)?)\n\nlemma table_cap_ref_at_eq:\n \"table_cap_ref c = Some [x] \\ vs_cap_ref c = Some [x]\"\n by (auto simp: table_cap_ref_def vs_cap_ref_simps vs_cap_ref_def\n split: cap.splits arch_cap.splits vmpage_size.splits option.splits)\n\n\nlemma table_cap_ref_ap_eq:\n \"table_cap_ref c = Some [x,y] \\ vs_cap_ref c = Some [x,y]\"\n by (auto simp: table_cap_ref_def vs_cap_ref_simps vs_cap_ref_def\n split: cap.splits arch_cap.splits vmpage_size.splits option.splits)\n\nlemma pd_at_asid_unique:\n \"\\ vspace_at_asid asid pd s; vspace_at_asid asid' pd s;\n unique_table_refs (caps_of_state s);\n valid_vs_lookup s; valid_vspace_objs s; valid_global_objs s;\n valid_arch_state s; asid < 2 ^ asid_bits; asid' < 2 ^ asid_bits \\\n \\ asid = asid'\"\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule(1) valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI])+\n apply (clarsimp simp: table_cap_ref_ap_eq[symmetric])\n apply (clarsimp simp: table_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (drule(2) unique_table_refsD,\n simp+, clarsimp simp: table_cap_ref_def,\n erule(1) asid_low_high_bits)\n apply simp+\n done\n\nlemma pd_at_asid_unique2:\n \"\\ vspace_at_asid asid pd s; vspace_at_asid asid pd' s \\\n \\ pd = pd'\"\n apply (clarsimp simp: vspace_at_asid_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup_2ConsD vs_lookup_atD\n vs_lookup1D)\n apply (clarsimp simp: obj_at_def vs_refs_def\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits\n dest!: graph_ofD)\n apply (drule ucast_up_inj, simp+)\n done\n\n\nlemma pd_at_asid_uniq:\n \"\\ vspace_at_asid asid pd s; asid \\ mask asid_bits; valid_asid_map s;\n unique_table_refs (caps_of_state s); valid_vs_lookup s;\n valid_vspace_objs s; valid_global_objs s; valid_arch_state s \\\n \\ pd_at_uniq asid pd s\"\n apply (clarsimp simp: pd_at_uniq_def ran_option_map\n dest!: ran_restrictD)\n apply (clarsimp simp: valid_asid_map_def)\n apply (drule bspec, erule graph_ofI)\n apply clarsimp\n apply (rule pd_at_asid_unique, assumption+)\n apply (drule subsetD, erule domI)\n apply (simp add: mask_def)\n apply (simp add: mask_def)\n done\n\n\nlemma find_free_hw_asid_valid_arch [wp]:\n \"\\valid_arch_state\\ find_free_hw_asid \\\\_. valid_arch_state\\\"\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def\n invalidate_asid_def do_machine_op_def split_def\n cong: option.case_cong)\n apply (wp|wpc|simp)+\n apply (clarsimp simp: valid_arch_state_def)\n apply (frule is_inv_inj)\n apply (drule findNoneD)\n apply (drule_tac x=\"arm_next_asid (arch_state s)\" in bspec)\n apply (simp add: minBound_word)\n apply (clarsimp simp: is_inv_def ran_upd dom_option_map\n dom_upd)\n apply (drule_tac x=\"x\" and y=\"arm_next_asid (arch_state s)\" in inj_onD)\n apply simp\n apply blast\n apply blast\n apply simp\n done\n\n\nlemma valid_vs_lookupE:\n \"\\ valid_vs_lookup s; \\ref p. (ref \\ p) s' \\ (ref \\ p) s;\n set (arm_global_pts (arch_state s)) \\ set (arm_global_pts (arch_state s'));\n caps_of_state s = caps_of_state s' \\\n \\ valid_vs_lookup s'\"\n by (simp add: valid_vs_lookup_def, blast)\n\n\nlemma find_free_hw_asid_vspace_objs [wp]:\n \"\\valid_vspace_objs\\ find_free_hw_asid \\\\asid. valid_vspace_objs\\\"\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def invalidate_asid_def\n do_machine_op_def split_def\n cong: option.case_cong)\n apply (wp|wpc)+\n apply (simp add: valid_vspace_objs_arch_update)\n done\n\nlemma find_free_hw_asid_pd_at_asid [wp]:\n \"\\vspace_at_asid pd asid\\ find_free_hw_asid \\\\_. vspace_at_asid pd asid\\\"\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def invalidate_asid_def\n do_machine_op_def split_def\n cong: option.case_cong)\n apply (wp|wpc)+\n apply (clarsimp simp: vspace_at_asid_def vs_lookup_arch_update)\n done\n\n\nlemma find_free_hw_asid_pd_at_uniq [wp]:\n \"\\pd_at_uniq pd asid\\ find_free_hw_asid \\\\_. pd_at_uniq pd asid\\\"\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def invalidate_asid_def\n do_machine_op_def split_def\n cong: option.case_cong)\n apply (wp|wpc)+\n apply (clarsimp simp: pd_at_uniq_def ran_option_map\n dest!: ran_restrictD split: if_split_asm)\n apply (rule ccontr, erule notE, rule image_eqI[rotated],\n rule ranI)\n apply (fastforce simp add: restrict_map_def)\n apply simp\n done\n\n\nlemma load_hw_asid_wp:\n \"\\\\s. P (option_map fst (arm_asid_map (arch_state s) asid)) s\\\n load_hw_asid asid \\P\\\"\n apply (simp add: load_hw_asid_def)\n apply wp\n apply simp\n done\n\n\ncrunch aligned [wp]: find_free_hw_asid pspace_aligned\n\ncrunch \"distinct\" [wp]: find_free_hw_asid pspace_distinct\n\n\nlemma invalidate_hw_asid_entry_asid_map [wp]:\n \"\\valid_asid_map\\ invalidate_hw_asid_entry asid \\\\_. valid_asid_map\\\"\n apply (simp add: invalidate_hw_asid_entry_def)\n apply wp\n apply (simp add: valid_asid_map_def vspace_at_asid_def)\n done\n\n\nlemma invalidate_asid_asid_map [wp]:\n \"\\valid_asid_map\\ invalidate_asid asid \\\\_. valid_asid_map\\\"\n apply (simp add: invalidate_asid_def)\n apply wp\n apply (auto simp add: valid_asid_map_def vspace_at_asid_def graph_of_def split: if_split_asm)\n done\n\n\nlemma find_free_hw_asid_asid_map [wp]:\n \"\\valid_asid_map\\ find_free_hw_asid \\\\_. valid_asid_map\\\"\n apply (simp add: find_free_hw_asid_def)\n apply (rule hoare_pre)\n apply (wp|wpc|simp)+\n done\n\n\nlemma dmo_pd_at_asid [wp]:\n \"\\vspace_at_asid a pd\\ do_machine_op f \\\\_. vspace_at_asid a pd\\\"\n apply (simp add: do_machine_op_def split_def)\n apply wp\n apply (simp add: vspace_at_asid_def)\n done\n\nlemma find_pd_for_asid_pd_at_asid [wp]:\n \"\\\\\\ find_pd_for_asid asid \\\\pd. vspace_at_asid asid pd\\, -\"\n apply (simp add: find_pd_for_asid_def assertE_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp|wpc)+\n apply (clarsimp simp: vspace_at_asid_def)\n apply (rule vs_lookupI)\n apply (simp add: vs_asid_refs_def graph_of_def)\n apply fastforce\n apply (rule r_into_rtrancl)\n apply (erule vs_lookup1I)\n prefer 2\n apply (rule refl)\n apply (simp add: vs_refs_def graph_of_def mask_asid_low_bits_ucast_ucast)\n apply fastforce\n done\n\ncrunch valid_vs_lookup[wp]: do_machine_op \"valid_vs_lookup\"\n\nlemma valid_asid_mapD:\n \"\\ arm_asid_map (arch_state s) asid = Some (vasid, pd); valid_asid_map s \\\n \\ vspace_at_asid asid pd s \\ asid \\ mask asid_bits\"\n by (auto simp add: valid_asid_map_def graph_of_def)\n\n\nlemma page_directory_cap_pd_at_uniq:\n \"\\ cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid)))) slot s;\n valid_asid_map s; valid_vs_lookup s; unique_table_refs (caps_of_state s);\n valid_arch_state s; valid_global_objs s; valid_objs s \\\n \\ pd_at_uniq asid pd s\"\n apply (frule(1) cte_wp_at_valid_objs_valid_cap)\n apply (clarsimp simp: pd_at_uniq_def restrict_map_def valid_cap_def\n elim!: ranE split: if_split_asm)\n apply (drule(1) valid_asid_mapD)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (frule(1) valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI])\n apply (clarsimp simp: cte_wp_at_caps_of_state dest!: obj_ref_elemD)\n apply (drule(1) unique_table_refsD[rotated, where cps=\"caps_of_state s\"],\n simp+)\n apply (clarsimp simp: table_cap_ref_ap_eq[symmetric] table_cap_ref_def\n split: cap.splits arch_cap.splits option.splits)\n apply (drule(1) asid_low_high_bits, simp_all add: mask_def)\n done\n\nlemma invalidateLocalTLB_ASID_underlying_memory:\n \"\\\\m'. underlying_memory m' p = um\\\n invalidateLocalTLB_ASID asid\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: invalidateLocalTLB_ASID_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemma isb_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\\n isb\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: isb_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemma dsb_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\\n dsb\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: dsb_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemma dmb_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\\n dmb\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: dmb_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemma invalidateLocalTLB_underlying_memory:\n \"\\\\m'. underlying_memory m' p = um\\\n invalidateLocalTLB\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: invalidateLocalTLB_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemmas invalidateLocalTLB_ASID_irq_masks = no_irq[OF no_irq_invalidateLocalTLB_ASID]\n\nlemma dmo_invalidateLocalTLB_ASID_invs[wp]:\n \"\\invs\\ do_machine_op (invalidateLocalTLB_ASID asid) \\\\_. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule use_valid)\n apply (rule invalidateLocalTLB_ASID_underlying_memory)\n apply fastforce+\n apply(erule (1) use_valid[OF _ invalidateLocalTLB_ASID_irq_masks])\n done\n\nlemma load_hw_asid_invs[wp]: \"\\invs\\ load_hw_asid asid \\\\y. invs\\\"\n by (simp add: load_hw_asid_def) wp\n\nlemma invalidate_tlb_by_asid_invs[wp]:\n \"\\invs\\ invalidate_tlb_by_asid asid \\\\_. invs\\\"\n apply (clarsimp simp: invalidate_tlb_by_asid_def | wp | wpc)+\n apply (rule_tac Q=\"K invs\" in hoare_post_imp)\n apply (clarsimp|wp load_hw_asid_invs)+\n done\n\ncrunch typ_at [wp]: flush_space \"\\s. P (typ_at T p s)\"\n\n\nlemmas flush_space_typ_ats [wp] = abs_typ_at_lifts [OF flush_space_typ_at]\n\ncrunch cur_tcb [wp]: flush_space cur_tcb\n\ncrunch valid_arch [wp]: flush_space valid_arch_state\n\ncrunch valid_objs [wp]: flush_space valid_objs\n\n\nlemma invalidate_hw_asid_vspace_objs [wp]:\n \"\\valid_vspace_objs\\ invalidate_hw_asid_entry asid \\\\_. valid_vspace_objs\\\"\n apply (simp add: invalidate_hw_asid_entry_def)\n apply wp\n apply (simp add: valid_vspace_objs_arch_update)\n done\n\n\nlemma invalidate_hw_asid_entry_pd_at_asid_uniq[wp]:\n \"\\vspace_at_asid asid pd\\\n invalidate_hw_asid_entry y\n \\\\rv. vspace_at_asid asid pd\\\"\n \"\\pd_at_uniq asid pd\\\n invalidate_hw_asid_entry y\n \\\\rv. pd_at_uniq asid pd\\\"\n by (simp add: vspace_at_asid_def pd_at_uniq_def\n invalidate_hw_asid_entry_def\n | wp)+\n\n\nlemma invalidate_hw_asid_entry_pd_still_uniq[wp]:\n \"\\\\s. \\pd. vspace_at_asid asid pd s \\ pd_at_uniq asid pd s\\\n invalidate_hw_asid_entry y\n \\\\rv s. \\pd. vspace_at_asid asid pd s \\ pd_at_uniq asid pd s\\\"\n (* this could be generalised to other functions on pd_at_* *)\n apply (simp add: vspace_at_asid_def pd_at_uniq_def\n invalidate_hw_asid_entry_def)\n apply (wp | simp)+\n done\n\nlemma invalidate_asid_entry_arch_state [wp]:\n \"\\valid_arch_state\\ invalidate_asid_entry asid \\\\_. valid_arch_state\\\"\n apply (simp add: invalidate_asid_entry_def invalidate_asid_def invalidate_hw_asid_entry_def)\n apply (wp load_hw_asid_wp)\n apply (clarsimp simp: valid_arch_state_def is_inv_None_upd comp_upd_simp simp del: fun_upd_apply)\n done\n\nlemma flush_space_asid_map[wp]:\n \"\\valid_asid_map\\ flush_space space \\\\rv. valid_asid_map\\\"\n apply (simp add: flush_space_def)\n apply (wp load_hw_asid_wp | wpc | simp | rule_tac Q=\"\\_. valid_asid_map\" in hoare_strengthen_post)+\n done\n\n\nlemma flush_space_arch_objs[wp]:\n \"\\valid_vspace_objs\\ flush_space space \\\\rv. valid_vspace_objs\\\"\n apply (simp add: flush_space_def)\n apply (wp load_hw_asid_wp | wpc | simp | rule_tac Q=\"\\_. valid_vspace_objs\" in hoare_strengthen_post)+\n done\n\n\ncrunch typ_at [wp]: invalidate_asid_entry \"\\s. P (typ_at T p s)\"\n\n\nlemmas invalidate_asid_entry_typ_ats [wp] =\n abs_typ_at_lifts [OF invalidate_asid_entry_typ_at]\n\n\ncrunch cur [wp]: invalidate_asid_entry cur_tcb\n\n\ncrunch valid_objs [wp]: invalidate_asid_entry valid_objs\n\n\nlemma invalidate_asid_entry_asid_map [wp]:\n \"\\valid_asid_map\\ invalidate_asid_entry asid \\\\_. valid_asid_map\\\"\n apply (simp add: invalidate_asid_entry_def invalidate_asid_def invalidate_hw_asid_entry_def)\n apply (wp load_hw_asid_wp)\n apply (clarsimp simp: valid_asid_map_def simp del: fun_upd_apply None_upd_eq)\n apply (clarsimp simp: vspace_at_asid_def vs_lookup_arch_update)\n apply blast\n done\n\n\ncrunch obj_at [wp]: invalidate_asid_entry \"\\s. P (obj_at Q p s)\"\n\n\n\nlemma invalidate_asid_entry_invalidates:\n \"\\valid_asid_map and valid_arch_state and K (asid \\ mask asid_bits) and\n (\\s. arm_asid_table (arch_state s) (asid_high_bits_of asid) = Some ap)\\\n invalidate_asid_entry asid\n \\\\rv s. \\asida. asida \\ mask asid_bits \\\n ucast asida = (ucast asid :: 10 word) \\\n arm_asid_table (arch_state s) (asid_high_bits_of asida) =\n Some ap \\\n arm_asid_map (arch_state s) asida = None\\\"\n apply (simp add: invalidate_asid_entry_def invalidate_asid_def invalidate_hw_asid_entry_def)\n apply (wp load_hw_asid_wp)\n apply (clarsimp simp del: None_upd_eq)\n apply (rule drop_imp)\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (drule_tac x=\"asid_high_bits_of asid\" and y=\"asid_high_bits_of asida\" in inj_onD)\n apply simp\n apply blast\n apply blast\n apply clarsimp\n apply (drule asid_low_high_bits', simp)\n apply (fastforce simp: mask_def)\n apply (fastforce simp: mask_def)\n apply (erule (1) notE)\n done\n\n\ncrunch vspace_objs [wp]: invalidate_asid_entry valid_vspace_objs\n (simp: valid_vspace_objs_arch_update)\n\n\nlemma flush_space_pd_at_asid [wp]:\n \"\\vspace_at_asid a pd\\ flush_space asid \\\\_. vspace_at_asid a pd\\\"\n apply (simp add: flush_space_def)\n apply (wp load_hw_asid_wp|wpc|rule_tac Q=\"\\_. vspace_at_asid a pd\" in hoare_strengthen_post|simp)+\n done\n\n\ncrunch obj_at [wp]: flush_space \"\\s. P (obj_at Q p s)\"\n\n\nlemma flush_space_arch [wp]:\n \"\\\\s. P (arch_state s)\\ flush_space asid \\\\rv s. P (arch_state s)\\\"\n apply (simp add: flush_space_def)\n apply (wp load_hw_asid_wp|wpc)+\n apply simp\n done\n\n\ncrunch aligned [wp]: invalidate_asid_entry pspace_aligned\n\ncrunch \"distinct\" [wp]: invalidate_asid_entry pspace_distinct\n\ncrunch aligned [wp]: flush_space pspace_aligned\n\ncrunch \"distinct\" [wp]: flush_space pspace_distinct\n\n\ncrunch caps_of_state[wp]: invalidate_asid_entry \"\\s. P (caps_of_state s)\"\n\n\nlemma pd_at_asid_arch_up':\n \"arm_asid_table (f (arch_state s)) = arm_asid_table (arch_state s)\n \\ vspace_at_asid asid pd (arch_state_update f s) = vspace_at_asid asid pd s\"\n by (clarsimp simp add: vspace_at_asid_def vs_lookup_def vs_lookup1_def)\n\n\nlemma pd_at_asid_arch_up:\n \"vspace_at_asid asid pd (s\\arch_state := arch_state s \\arm_asid_map := a, arm_hwasid_table := b\\\\) =\n vspace_at_asid asid pd s\"\n by (simp add: pd_at_asid_arch_up')\n\n\nlemma invalidate_asid_entry_invs [wp]:\n \"\\invs\\ invalidate_asid_entry asid \\\\_. invs\\\"\n apply (simp add: invalidate_asid_entry_def invalidate_asid_def\n invalidate_hw_asid_entry_def)\n apply (rule hoare_pre, wp load_hw_asid_wp)\n apply (clarsimp simp del: fun_upd_apply)\n apply (clarsimp simp: invs_def valid_state_def valid_irq_node_def\n valid_arch_caps_def valid_table_caps_def\n valid_kernel_mappings_def valid_global_objs_def\n valid_global_refs_def global_refs_def\n valid_vs_lookup_def second_level_tables_def\n vs_lookup_arch_update vs_lookup_pages_arch_update\n valid_vspace_objs_def valid_arch_state_def\n simp del: fun_upd_apply)\n apply (rule conjI)\n apply (clarsimp simp: comp_upd_simp is_inv_None_upd)\n apply (clarsimp simp: valid_asid_map_def valid_machine_state_def)\n apply (rule conjI)\n apply (erule order_trans[rotated], clarsimp)\n apply (simp add: pd_at_asid_arch_up')\n done\n\nlemmas cleanCaches_PoU_irq_masks = no_irq[OF no_irq_cleanCaches_PoU]\n\nlemmas ackInterrupt_irq_masks = no_irq[OF no_irq_ackInterrupt]\n\nlemmas setIRQTrigger_irq_masks = no_irq[OF no_irq_setIRQTrigger]\n\nlemma invalidate_I_PoU_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\\n invalidate_I_PoU\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: invalidate_I_PoU_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\nlemma clean_D_PoU_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\\n clean_D_PoU\n \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: clean_D_PoU_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+\n\ncrunches dsb, invalidate_I_PoU, clean_D_PoU, cleanCaches_PoU\n for device_state_inv[wp]: \"\\ms. P (device_state ms)\"\n and underlying_memory_inv[wp]: \"\\ms. P (underlying_memory ms)\"\n (ignore_del: dsb invalidate_I_PoU clean_D_PoU cleanCaches_PoU)\n\nlemma dmo_cleanCaches_PoU_invs[wp]: \"\\invs\\ do_machine_op cleanCaches_PoU \\\\y. invs\\\"\n apply (wp dmo_invs)\n apply clarsimp\n apply safe\n apply (simp add: use_valid[OF _ cleanCaches_PoU_underlying_memory_inv[where P=\"\\x. x = v\" for v]])\n apply(erule(1) use_valid[OF _ cleanCaches_PoU_irq_masks])\n done\n\nlemma flush_space_invs[wp]: \"\\invs\\ flush_space asid \\\\_. invs\\\"\n apply (simp add: flush_space_def | wp | wpc)+\n apply (rule_tac Q=\"K invs\" in hoare_post_imp, (simp|wp)+)\n done\n\ncrunch valid_vs_lookup[wp]: flush_space \"valid_vs_lookup\"\n\ncrunch valid_global_objs[wp]: flush_space \"valid_global_objs\"\n\ncrunch caps_of_state[wp]: flush_space \"\\s. P (caps_of_state s)\"\n\n\nlemma ucast_ucast_low_bits:\n fixes x :: word32\n shows \"x \\ 2^asid_low_bits - 1 \\ ucast (ucast x:: 10 word) = x\"\n apply (simp add: ucast_ucast_mask)\n apply (rule less_mask_eq)\n apply (subst (asm) word_less_sub_le)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply (simp add: asid_low_bits_def)\n done\n\n\nlemma asid_high_bits_of_or:\n \"x \\ 2^asid_low_bits - 1 \\ asid_high_bits_of (base || x) = asid_high_bits_of base\"\n apply (rule word_eqI)\n apply (drule le_2p_upper_bits)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply (simp add: asid_high_bits_of_def word_size nth_ucast nth_shiftr asid_low_bits_def word_bits_def)\n done\n\n\ncrunch vs_lookup [wp]: invalidate_asid_entry \"\\s. P (vs_lookup s)\"\n\ncrunch vs_lookup [wp]: flush_space \"\\s. P (vs_lookup s)\"\n\n\nlemma vs_lookup_clear_asid_table:\n \"(rf \\ p) (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table (arch_state s))\n (pptr := None)\\\\)\n \\ (rf \\ p) s\"\n apply (simp add: vs_lookup_def vs_lookup1_def)\n apply (rule impI, erule subsetD[rotated])\n apply (rule Image_mono[OF order_refl])\n apply (simp add: vs_asid_refs_def graph_of_def)\n apply (rule image_mono)\n apply (clarsimp split: if_split_asm)\n done\n\n\nlemma vs_lookup_pages_clear_asid_table:\n \"(rf \\ p) (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table (arch_state s))\n (pptr := None)\\\\)\n \\ (rf \\ p) s\"\n apply (simp add: vs_lookup_pages_def vs_lookup_pages1_def)\n apply (erule subsetD[rotated])\n apply (rule Image_mono[OF order_refl])\n apply (simp add: vs_asid_refs_def graph_of_def)\n apply (rule image_mono)\n apply (clarsimp split: if_split_asm)\n done\n\n\nlemma valid_arch_state_unmap_strg:\n \"valid_arch_state s \\\n valid_arch_state(s\\arch_state := arch_state s\\arm_asid_table := (arm_asid_table (arch_state s))(ptr := None)\\\\)\"\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (rule conjI)\n apply (clarsimp simp add: ran_def)\n apply blast\n apply (clarsimp simp: inj_on_def)\n done\n\n\nlemma valid_vspace_objs_unmap_strg:\n \"valid_vspace_objs s \\\n valid_vspace_objs(s\\arch_state := arch_state s\\arm_asid_table := (arm_asid_table (arch_state s))(ptr := None)\\\\)\"\n apply (clarsimp simp: valid_vspace_objs_def)\n apply (drule vs_lookup_clear_asid_table [rule_format])\n apply blast\n done\n\n\nlemma valid_vs_lookup_unmap_strg:\n \"valid_vs_lookup s \\\n valid_vs_lookup(s\\arch_state := arch_state s\\arm_asid_table := (arm_asid_table (arch_state s))(ptr := None)\\\\)\"\n apply (clarsimp simp: valid_vs_lookup_def)\n apply (drule vs_lookup_pages_clear_asid_table)\n apply blast\n done\n\n\nlemma ex_asid_high_bits_plus:\n \"asid \\ mask asid_bits \\ \\x \\ 2^asid_low_bits - 1. asid = (ucast (asid_high_bits_of asid) << asid_low_bits) + x\"\n apply (rule_tac x=\"asid && mask asid_low_bits\" in exI)\n apply (rule conjI)\n apply (simp add: mask_def)\n apply (rule word_and_le1)\n apply (subst (asm) mask_def)\n apply (simp add: upper_bits_unset_is_l2p_32 [symmetric])\n apply (subst word_plus_and_or_coroll; word_eqI)\n apply (clarsimp simp: asid_high_bits_of_def asid_low_bits_def word_bits_def asid_bits_def)\n apply (rule iffI)\n prefer 2\n apply fastforce\n apply (clarsimp simp: linorder_not_less)\n by (metis add_One_commute add_diff_inverse_nat le_add1 less_diff_conv2 less_imp_diff_less\n numeral_plus_numeral semiring_norm(10) semiring_norm(2) semiring_norm(3)\n semiring_norm(4) semiring_norm(9))\n\n\nlemma asid_high_bits_shl:\n \"\\ is_aligned base asid_low_bits; base \\ mask asid_bits \\ \\ ucast (asid_high_bits_of base) << asid_low_bits = base\"\n apply (simp add: mask_def upper_bits_unset_is_l2p_32 [symmetric])\n apply word_eqI\n apply (simp add: asid_low_bits_def asid_high_bits_of_def word_bits_conv asid_bits_def)\n apply (rule iffI, clarsimp)\n apply (rule context_conjI)\n apply (clarsimp simp add: linorder_not_less [symmetric])\n apply simp\n by (metis less_imp_le_nat linorder_neqE_nat nat_diff_less numeral_plus_numeral pl_pl_rels\n semiring_norm(10) semiring_norm(2) semiring_norm(3) semiring_norm(8) semiring_norm(9)\n trans_less_add1)\n\n\nlemma valid_asid_map_unmap:\n \"valid_asid_map s \\ is_aligned base asid_low_bits \\ base \\ mask asid_bits \\\n (\\x \\ set [0.e.2^asid_low_bits - 1]. arm_asid_map (arch_state s) (base + x) = None) \\\n valid_asid_map(s\\arch_state := arch_state s\\arm_asid_table := (arm_asid_table (arch_state s))(asid_high_bits_of base := None)\\\\)\"\n apply (clarsimp simp: valid_asid_map_def vspace_at_asid_def)\n apply (drule bspec, blast)\n apply clarsimp\n apply (erule vs_lookupE)\n apply (clarsimp simp: vs_asid_refs_def dest!: graph_ofD)\n apply (frule vs_lookup1_trans_is_append, clarsimp)\n apply (drule ucast_up_inj, simp)\n apply clarsimp\n apply (rule_tac ref'=\"([VSRef (ucast (asid_high_bits_of a)) None],ba)\" in vs_lookupI)\n apply (simp add: vs_asid_refs_def)\n apply (simp add: graph_of_def)\n apply (rule_tac x=\"(asid_high_bits_of a, ba)\" in image_eqI)\n apply simp\n apply clarsimp\n apply (subgoal_tac \"a \\ mask asid_bits\")\n prefer 2\n apply fastforce\n apply (drule_tac asid=a in ex_asid_high_bits_plus)\n apply (clarsimp simp: asid_high_bits_shl)\n apply (drule rtranclD, simp)\n apply (drule tranclD)\n apply clarsimp\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (frule vs_lookup1_trans_is_append, clarsimp)\n apply (drule vs_lookup_trans_ptr_eq, clarsimp)\n apply (rule r_into_rtrancl)\n apply (rule vs_lookup1I)\n apply simp\n apply assumption\n apply simp\n done\n\n\nlemma invalidate_asid_entry_asid_map_None_inv:\n \"\\\\s. arm_asid_map (arch_state s) y = None\\\n invalidate_asid_entry (base + x)\n \\\\_ s. arm_asid_map (arch_state s) y = None\\\"\n apply (simp add: invalidate_asid_entry_def invalidate_asid_def\n invalidate_hw_asid_entry_def)\n apply (wp load_hw_asid_wp)\n apply simp\n done\n\n\nlemma mapM_invalidate:\n \"\\[VSRef (ucast (asid_high_bits_of base)) None] \\ ptr and\n ko_at (ArchObj (arch_kernel_obj.ASIDPool pool)) ptr and\n valid_asid_map and K (is_aligned base asid_low_bits)\\\n mapM (\\offset. when (\\y. pool (ucast offset) = Some y)\n (do y \\ flush_space (base + offset);\n invalidate_asid_entry (base + offset)\n od))\n [0.e.2 ^ asid_low_bits - 1]\n \\\\rv s. \\x\\2 ^ asid_low_bits - 1. arm_asid_map (arch_state s) (base + x) = None\\\"\nproof -\n have ball: \"\\P w::word32. (\\x\\w. P x) = (\\x \\ set [0.e.w]. P x)\" by simp\n show ?thesis\n apply (subst ball)\n apply (rule mapM_set)\n apply (wp, simp)\n apply (wp |\n simp add: invalidate_asid_entry_def invalidate_asid_def\n invalidate_hw_asid_entry_def\n cong: if_cong)+\n apply clarsimp\n apply (rule ccontr)\n apply clarsimp\n apply (clarsimp simp: valid_asid_map_def)\n apply (drule bspec, erule graph_ofI)\n apply (erule vs_lookup_atE)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule vs_lookup_2ConsD)\n apply clarsimp\n apply (erule vs_lookup_atE)\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (subgoal_tac \"p' = ptr\")\n apply (clarsimp simp: obj_at_def vs_refs_def graph_of_def)\n apply (subgoal_tac \"base + x && mask asid_low_bits = x\")\n apply (simp add: ucast_ucast_mask)\n apply (subgoal_tac \"aa && mask 32 = aa\")\n apply simp\n apply (rule word_eqI)\n apply (simp add: word_size)\n apply (subst add_mask_eq, assumption+)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply (rule refl)\n apply (subst (asm) asid_high_bits_of_add, assumption+)\n apply simp\n apply (wp invalidate_asid_entry_asid_map_None_inv)\n apply simp\n done\nqed\n\n\nlemma asid_low_bits_word_bits:\n \"asid_low_bits < word_bits\"\n by (simp add: asid_low_bits_def word_bits_def)\n\n\nlemma valid_global_objs_arch_update:\n \"arm_global_pd (f (arch_state s)) = arm_global_pd (arch_state s)\n \\ arm_global_pts (f (arch_state s)) = arm_global_pts (arch_state s)\n \\ valid_global_objs (arch_state_update f s) = valid_global_objs s\"\n by (simp add: valid_global_objs_def second_level_tables_def)\n\n\ncrunch valid_global_objs[wp]: invalidate_asid_entry \"valid_global_objs\"\n (simp: valid_global_objs_arch_update)\n\ncrunch valid_vs_lookup[wp]: invalidate_hw_asid_entry \"valid_vs_lookup\"\n (simp: valid_vs_lookup_def)\n\ncrunch valid_vs_lookup[wp]: invalidate_asid \"valid_vs_lookup\"\n (simp: valid_vs_lookup_def)\n\ncrunch valid_vs_lookup[wp]: invalidate_asid_entry \"valid_vs_lookup\"\n\n\ncrunch arm_asid_table_inv[wp]: invalidate_asid_entry\n \"\\s. P (arm_asid_table (arch_state s))\"\n\n\ncrunch pred_tcb_at_P [wp]: find_free_hw_asid \"\\s. P (pred_tcb_at proj Q p s)\"\n\n\nlemma hw_asid_Some [wp]:\n \"\\valid_asid asid\\\n load_hw_asid asid\n \\\\rv s. \\y. rv = Some y\\\"\n by (simp add: load_hw_asid_def, wp) (simp add: valid_asid_def)\n\ncrunches set_vm_root_for_flush\n for typ_at [wp]: \"\\s. P (typ_at T p s)\"\n and cur [wp]: cur_tcb\n and valid_objs [wp]: valid_objs\n and aligned [wp]: pspace_aligned\n\nlemmas set_vm_root_for_flush_typ_ats [wp] = abs_typ_at_lifts [OF set_vm_root_for_flush_typ_at]\n\nlemma store_hw_asid_valid_arch:\n notes hoare_pre [wp_pre del]\n shows \"\\valid_arch_state and\n (\\s. arm_asid_map (arch_state s) asid = None \\\n arm_hwasid_table (arch_state s) hw_asid = None)\\\n store_hw_asid asid hw_asid\n \\\\_. valid_arch_state\\\"\n apply (simp add: store_hw_asid_def)\n apply wp\n apply (simp add: valid_arch_state_def fun_upd_def[symmetric] comp_upd_simp)\n apply (rule hoare_pre, wp)\n apply clarsimp\n apply (frule is_inv_NoneD[rotated])\n apply simp\n apply (simp add: ran_def)\n apply (simp add: is_inv_def)\n done\n\n\nlemma invalidate_hw_asid_None [wp]:\n \"\\\\\\ invalidate_hw_asid_entry hw_asid \\\\_ s. arm_hwasid_table (arch_state s) hw_asid = None\\\"\n apply (simp add: invalidate_hw_asid_entry_def)\n apply wp\n apply simp\n done\n\n\nlemma find_free_hw_asid_None_hw [wp]:\n \"\\\\\\ find_free_hw_asid \\\\rv s. arm_hwasid_table (arch_state s) rv = None\\\"\n apply (simp add: find_free_hw_asid_def)\n apply (wp|wpc|simp)+\n apply (clarsimp dest!: findSomeD)\n done\n\n\nlemma find_free_hw_asid_None_asid_map [wp]:\n \"\\\\s. arm_asid_map (arch_state s) asid = None\\\n find_free_hw_asid\n \\\\rv s. arm_asid_map (arch_state s) asid = None\\\"\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def invalidate_asid_def\n cong: option.case_cong)\n apply (wp|wpc|simp)+\n done\n\n\nlemma get_hw_asid_valid_arch:\n \"\\valid_arch_state\\ get_hw_asid asid \\\\_. valid_arch_state\\\"\n apply (simp add: get_hw_asid_def)\n apply (wp load_hw_asid_wp store_hw_asid_valid_arch|wpc)+\n apply simp\n done\n\n\ncrunch valid_arch [wp]: set_vm_root_for_flush valid_arch_state\n\n\nlemma svmrff_asid_mapped [wp]:\n \"\\valid_asid asid\\\n set_vm_root_for_flush pd asid\n \\\\rv. valid_asid asid\\\"\n apply (simp add: set_vm_root_for_flush_def arm_context_switch_def\n get_hw_asid_def store_hw_asid_def find_free_hw_asid_def\n load_hw_asid_def\n cong: if_cong option.case_cong)\n apply (wp|wpc|simp add: valid_asid_def|wp hoare_vcg_all_lift hoare_drop_imps)+\n done\n\n\ncrunch vspace_at_asid[wp]: set_vm_root_for_flush \"vspace_at_asid asid pd\"\n (simp: pd_at_asid_arch_up)\n\n\nlemma find_pd_for_asid_assert_wp:\n \"\\\\s. \\pd. vspace_at_asid asid pd s \\ asid \\ 0 \\ P pd s\\ find_pd_for_asid_assert asid \\P\\\"\n apply (simp add: find_pd_for_asid_assert_def\n find_pd_for_asid_def assertE_def\n split del: if_split)\n apply (wp get_pde_wp get_asid_pool_wp | wpc)+\n apply clarsimp\n apply (drule spec, erule mp)\n apply (clarsimp simp: vspace_at_asid_def word_neq_0_conv)\n apply (rule vs_lookupI)\n apply (simp add: vs_asid_refs_def)\n apply (rule image_eqI[OF refl])\n apply (erule graph_ofI)\n apply (rule r_into_rtrancl, simp)\n apply (erule vs_lookup1I)\n apply (simp add: vs_refs_def)\n apply (rule image_eqI[rotated])\n apply (erule graph_ofI)\n apply simp\n apply (simp add: mask_asid_low_bits_ucast_ucast)\n done\n\n\nlemma store_hw_asid_asid_map [wp]:\n \"\\valid_asid_map and K (asid \\ mask asid_bits)\\\n store_hw_asid asid hw_asid \\\\_. valid_asid_map\\\"\n apply (simp add: store_hw_asid_def)\n apply (wp find_pd_for_asid_assert_wp)\n apply (clarsimp simp: valid_asid_map_def fun_upd_def[symmetric]\n pd_at_asid_arch_up)\n done\n\n\nlemma arm_context_switch_asid_map [wp]:\n \"\\valid_asid_map and K (asid \\ mask asid_bits)\\\n arm_context_switch pd asid \\\\_. valid_asid_map\\\"\n apply (simp add: arm_context_switch_def get_hw_asid_def)\n apply (wp load_hw_asid_wp|wpc|simp)+\n done\n\n\nlemma set_vm_root_for_flush_asid_map [wp]:\n \"\\valid_asid_map and K (asid \\ mask asid_bits)\\\n set_vm_root_for_flush pd asid \\\\_. valid_asid_map\\\"\n apply (simp add: set_vm_root_for_flush_def)\n apply (wp|wpc|simp)+\n apply (rule hoare_strengthen_post [where\n Q=\"\\_. valid_asid_map and K (asid \\ mask asid_bits)\"])\n apply wp\n apply simp\n apply wp\n apply simp\n done\n\n\ncrunch \"distinct\" [wp]: set_vm_root_for_flush pspace_distinct\n\ncrunch caps_of_state[wp]: set_vm_root_for_flush \"\\s. P (caps_of_state s)\"\n\nlemma valid_vs_lookup_arch_update:\n \"arm_asid_table (f (arch_state s)) = arm_asid_table (arch_state s)\n \\ valid_vs_lookup (arch_state_update f s) = valid_vs_lookup s\"\n by (simp add: valid_vs_lookup_def vs_lookup_pages_arch_update)\n\ncrunch valid_vs_lookup[wp]: set_vm_root_for_flush \"valid_vs_lookup\"\n (simp: valid_vs_lookup_arch_update)\n\n\ncrunch valid_global_objs[wp]: set_vm_root_for_flush \"valid_global_objs\"\n (simp: valid_global_objs_arch_update)\n\ncrunch vspace_objs [wp]: set_vm_root_for_flush valid_vspace_objs\n (simp: valid_vspace_objs_arch_update)\n\ncrunch typ_at [wp]: flush_table \"\\s. P (typ_at T p s)\"\n (simp: crunch_simps wp: crunch_wps)\n\n\nlemmas flush_table_typ_ats [wp] = abs_typ_at_lifts [OF flush_table_typ_at]\n\nlemmas find_pd_for_asid_typ_ats [wp] = abs_typ_at_lifts [OF find_pd_for_asid_inv]\n\ncrunch aligned [wp]: flush_table pspace_aligned\n (simp: crunch_simps wp: crunch_wps)\n\n\nlemma find_pd_for_asid_page_directory [wp]:\n \"\\valid_vspace_objs\\\n find_pd_for_asid asid\n \\\\pd. page_directory_at pd\\, -\"\n apply (simp add: find_pd_for_asid_def assertE_def whenE_def split del: if_split)\n apply (wp|wpc|clarsimp|rule conjI)+\n apply (drule vs_lookup_atI)\n apply (drule (2) valid_vspace_objsD)\n apply clarsimp\n apply (drule bspec, blast)\n apply (clarsimp simp: obj_at_def)\n done\n\n\nlemma find_pd_for_asid_lookup_ref:\n \"\\\\\\ find_pd_for_asid asid \\\\pd. ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd)\\, -\"\n apply (simp add: find_pd_for_asid_def assertE_def whenE_def split del: if_split)\n apply (wp|wpc|clarsimp|rule conjI)+\n apply (drule vs_lookup_atI)\n apply (erule vs_lookup_step)\n apply (erule vs_lookup1I [OF _ _ refl])\n apply (simp add: vs_refs_def)\n apply (rule image_eqI[rotated], erule graph_ofI)\n apply (simp add: mask_asid_low_bits_ucast_ucast)\n done\n\n\nlemma find_pd_for_asid_lookup[wp]:\n \"\\\\\\ find_pd_for_asid asid \\\\pd. \\\\ pd\\,-\"\n apply (rule hoare_post_imp_R, rule find_pd_for_asid_lookup_ref)\n apply auto\n done\n\n\nlemma find_pd_for_asid_pde [wp]:\n \"\\valid_vspace_objs and pspace_aligned\\\n find_pd_for_asid asid\n \\\\pd. pde_at (pd + (vptr >> 20 << 2))\\, -\"\nproof -\n have x:\n \"\\valid_vspace_objs and pspace_aligned\\ find_pd_for_asid asid\n \\\\pd. pspace_aligned and page_directory_at pd\\, -\"\n by (rule hoare_pre) (wp, simp)\n show ?thesis\n apply (rule hoare_post_imp_R, rule x)\n apply clarsimp\n apply (erule page_directory_pde_atI)\n prefer 2\n apply assumption\n apply (rule vptr_shiftr_le_2p)\n done\nqed\n\n\ncrunch valid_objs [wp]: flush_page \"valid_objs\"\n (wp: crunch_wps hoare_drop_imps simp: crunch_simps)\n\n\ncrunch valid_arch [wp]: store_pde \"valid_arch_state\"\n\n\ncrunch valid_arch [wp]: flush_page \"valid_arch_state\"\n (wp: crunch_wps simp: crunch_simps)\n\n\nlemma vs_lookup1_rtrancl_iterations:\n \"(tup, tup') \\ (vs_lookup1 s)\\<^sup>*\n \\ (length (fst tup) \\ length (fst tup')) \\\n (tup, tup') \\ ((vs_lookup1 s)\n ^^ (length (fst tup') - length (fst tup)))\"\n apply (erule rtrancl_induct)\n apply simp\n apply (elim conjE)\n apply (subgoal_tac \"length (fst z) = Suc (length (fst y))\")\n apply (simp add: Suc_diff_le)\n apply (erule(1) relcompI)\n apply (clarsimp simp: vs_lookup1_def)\n done\n\n\nlemma find_pd_for_asid_lookup_none:\n \"\\\\\\\n find_pd_for_asid asid\n -, \\\\e s. \\p. \\ ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ p) s\\\"\n apply (simp add: find_pd_for_asid_def assertE_def\n split del: if_split)\n apply (rule hoare_pre)\n apply (wp | wpc)+\n apply clarsimp\n apply (intro allI conjI impI)\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def up_ucast_inj_eq\n dest!: vs_lookup1_rtrancl_iterations\n graph_ofD vs_lookup1D)\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def\n dest!: vs_lookup1_rtrancl_iterations\n graph_ofD vs_lookup1D)\n apply (clarsimp simp: obj_at_def vs_refs_def up_ucast_inj_eq\n mask_asid_low_bits_ucast_ucast\n dest!: graph_ofD)\n done\n\n\nlemma find_pd_for_asid_aligned_pd [wp]:\n \"\\pspace_aligned and valid_vspace_objs\\ find_pd_for_asid asid \\\\rv s. is_aligned rv 14\\,-\"\n apply (simp add: find_pd_for_asid_def assertE_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp|wpc)+\n apply clarsimp\n apply (drule vs_lookup_atI)\n apply (drule (2) valid_vspace_objsD)\n apply clarsimp\n apply (drule bspec, blast)\n apply (thin_tac \"ko_at ko p s\" for ko p)\n apply (clarsimp simp: pspace_aligned_def obj_at_def)\n apply (drule bspec, blast)\n apply (clarsimp simp: a_type_def\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits if_split_asm)\n done\n\n\nlemma find_pd_for_asid_aligned_pd_bits[wp]:\n \"\\pspace_aligned and valid_vspace_objs\\\n find_pd_for_asid asid\n \\\\rv s. is_aligned rv pd_bits\\, -\"\n by (simp add: pd_bits_def pageBits_def, rule find_pd_for_asid_aligned_pd)\n\n\nlemma find_pd_for_asid_lots:\n \"\\\\s. (\\rv. ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ rv) s\n \\ (valid_vspace_objs s \\ page_directory_at rv s)\n \\ Q rv s)\n \\ ((\\rv. \\ ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ rv) s) \\ (\\e. E e s))\\\n find_pd_for_asid asid\n \\Q\\,\\E\\\"\n apply (clarsimp simp: validE_def valid_def)\n apply (frule in_inv_by_hoareD [OF find_pd_for_asid_inv])\n apply (frule use_valid [OF _ find_pd_for_asid_lookup_none\n [unfolded validE_E_def validE_def]])\n apply simp\n apply (frule use_valid [OF _ find_pd_for_asid_lookup_ref\n [unfolded validE_R_def validE_def]])\n apply simp\n apply (clarsimp split: sum.split_asm)\n apply (drule spec, drule uncurry, erule mp)\n apply clarsimp\n apply (frule use_valid [OF _ find_pd_for_asid_page_directory\n [unfolded validE_R_def validE_def]])\n apply simp\n apply simp\n done\n\n\nlemma vs_lookup1_inj:\n \"\\ ((ref, p), (ref', p')) \\ vs_lookup1 s ^^ n;\n ((ref, p), (ref', p'')) \\ vs_lookup1 s ^^ n \\\n \\ p' = p''\"\n apply (induct n arbitrary: ref ref' p p' p'')\n apply simp\n apply (clarsimp dest!: vs_lookup1D)\n apply (subgoal_tac \"pa = pb\", simp_all)\n apply (simp add: obj_at_def)\n apply (auto simp: vs_refs_def up_ucast_inj_eq dest!: graph_ofD\n split: Structures_A.kernel_object.split_asm arch_kernel_obj.split_asm)\n done\n\n\nlemma vs_lookup_Cons_eq:\n \"(ref \\ p) s \\ ((v # ref) \\ p') s = ((ref, p) \\1 (v # ref, p')) s\"\n apply (rule iffI)\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def\n dest!: graph_ofD)\n apply (frule vs_lookup1_trans_is_append[where ys=ref])\n apply (frule vs_lookup1_trans_is_append[where ys=\"v # ref\"])\n apply (clarsimp dest!: vs_lookup1_rtrancl_iterations vs_lookup1D)\n apply (clarsimp simp add: up_ucast_inj_eq)\n apply (drule(1) vs_lookup1_inj)\n apply (simp add: vs_lookup1I)\n apply (erule vs_lookup_trancl_step)\n apply simp\n done\n\n\nlemma vptr_shifting_3_ways:\n fixes vptr :: word32 shows\n \"vptr >> 20 << 2 >> 2 = vptr >> 20\"\n apply (rule shiftl_shiftr_id, simp add: word_bits_def)\n apply (rule shiftr_less_t2n', simp_all add: word_bits_def)\n apply (cut_tac word_log_esimps[where x=vptr])\n apply (simp add: mask_def)\n done\n\n\nlemma page_table_mapped_wp:\n \"\\\\s. valid_vspace_objs s \\ pspace_aligned s\n \\ (\\ ([VSRef (vptr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pt) s\n \\ Q None s)\n \\ (\\pd. vspace_at_asid asid pd s \\ page_directory_at pd s\n \\ is_aligned pd pd_bits\n \\ Q (Some pd) s)\\\n page_table_mapped asid vptr pt\n \\Q\\\"\n (is \"\\?P\\ page_table_mapped asid vptr pt \\Q\\\")\n apply (simp add: page_table_mapped_def)\n apply (rule hoare_pre)\n apply (wp get_pde_wp find_pd_for_asid_lots | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def Let_def vspace_at_asid_def)\n apply (rule conjI[rotated])\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup1D vs_lookup1_rtrancl_iterations)\n apply (drule spec, erule notE, rule ImageI[rotated])\n apply (rule image_eqI, rule refl, erule graph_ofI)\n apply (rule r_into_rtrancl, simp)\n apply (erule(1) vs_lookup1I)\n apply simp\n apply (clarsimp simp: vs_lookup_Cons_eq)\n apply (frule(1) pd_aligned)\n apply (clarsimp simp: vs_lookup1_def obj_at_def pd_shifting\n vs_refs_def pd_shifting_dual vptr_shifting_3_ways)\n apply (simp add: pd_bits_def pageBits_def)\n apply (auto simp: pde_ref_def ucast_up_ucast_id is_up_def a_type_simps\n source_size_def target_size_def word_size\n addrFromPPtr_def ptrFromPAddr_def\n split: if_split_asm\n dest!: graph_ofD)\n done\n\n\ncrunch typ_at [wp]: flush_page \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps hoare_drop_imps)\n\n\nlemmas flush_page_typ_ats [wp] = abs_typ_at_lifts [OF flush_page_typ_at]\n\n\ncrunch aligned [wp]: flush_page \"pspace_aligned\"\n (wp: crunch_wps hoare_drop_imps)\n\n\ndefinition\n valid_unmap :: \"vmpage_size \\ asid * vspace_ref \\ bool\"\nwhere\n \"valid_unmap sz \\ \\(asid, vptr). 0 < asid \\ is_aligned vptr pageBits \\\n (sz = ARMSuperSection \\ is_aligned vptr 24) \\\n (sz = ARMLargePage \\ is_aligned vptr 16) \\\n (sz = ARMSection \\ is_aligned vptr 20)\"\n\n\ncrunch vs_lookup [wp]: flush_page \"\\s. P (vs_lookup s)\"\n (wp: crunch_wps simp: crunch_simps vs_lookup_arch_update)\n\ncrunch vs_lookup_pages [wp]: flush_page \"\\s. P (vs_lookup_pages s)\"\n (wp: crunch_wps simp: crunch_simps vs_lookup_pages_arch_update)\n\nlemma store_pde_pd_at_asid:\n \"\\vspace_at_asid asid pd\\\n store_pde p pde \\\\_. vspace_at_asid asid pd\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def vspace_at_asid_def)\n apply (wp get_object_wp)\n apply clarsimp\n apply (clarsimp simp: obj_at_def)\n apply (drule vs_lookup_2ConsD)\n apply clarsimp\n apply (erule vs_lookup_atE)\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (rule_tac ref'=\"([VSRef (ucast (asid_high_bits_of asid)) None],p')\" in vs_lookupI)\n apply (fastforce simp: vs_asid_refs_def graph_of_def)\n apply (rule r_into_rtrancl)\n apply (rule_tac ko=ko in vs_lookup1I)\n prefer 3\n apply (rule refl)\n prefer 2\n apply assumption\n apply (clarsimp simp: obj_at_def vs_refs_def)\n done\n\n\nlemma flush_page_pd_at_asid [wp]:\n \"\\vspace_at_asid a pd\\ flush_page pgsz pd asid vptr \\\\_. vspace_at_asid a pd\\\"\n apply (simp add: vspace_at_asid_def)\n apply wp\n done\n\n\ncrunch \"distinct\" [wp]: store_pde pspace_distinct\ncrunch \"distinct\" [wp]: flush_page pspace_distinct (simp: crunch_simps)\n\ndefinition \"pg_entry_align pgsz \\ case pgsz of\n ARMSmallPage \\ 2\n | ARMLargePage \\ 6\n | ARMSection \\ 2\n | ARMSuperSection \\ 6\"\n\ncrunch inv[wp]: check_mapping_pptr \"P\"\n\nlemmas lookup_pd_slot_pd = lookup_pd_slot_eq\n\ncrunch vspace_objs [wp]: flush_page valid_vspace_objs\n (simp: crunch_simps valid_vspace_objs_arch_update)\n\ncrunch equal_mappings [wp]: flush_page equal_kernel_mappings\n (simp: crunch_simps)\n\ncrunch global_objs [wp]: flush_page valid_global_objs\n (simp: crunch_simps)\n\nlemma lookup_pt_slot_is_aligned:\n \"\\(\\\\ pd) and K (vmsz_aligned vptr sz) and K (is_aligned pd pd_bits)\n and valid_arch_state and valid_vspace_objs and equal_kernel_mappings\n and pspace_aligned and valid_global_objs\\\n lookup_pt_slot pd vptr\n \\\\rv s. is_aligned rv (pg_entry_align sz)\\,-\"\n apply (simp add: lookup_pt_slot_def)\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_pd)\n apply (frule(2) valid_vspace_objsD[rotated])\n apply simp\n apply (rule is_aligned_add)\n apply (case_tac \"ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2) \\ kernel_mapping_slots\")\n apply (frule kernel_mapping_slots_empty_pdeI)\n apply (simp add: obj_at_def)+\n apply clarsimp\n apply (erule_tac x=\"ptrFromPAddr x\" in allE)\n apply (simp add: pde_ref_def second_level_tables_def)\n apply (erule is_aligned_weaken[OF is_aligned_global_pt])\n apply ((simp add: invs_psp_aligned invs_vspace_objs invs_arch_state\n pg_entry_align_def pt_bits_def pageBits_def\n split: vmpage_size.split)+)[3]\n apply (drule_tac x=\"ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2)\" in bspec, simp)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (simp split: Structures_A.kernel_object.split_asm if_split_asm\n arch_kernel_obj.split_asm)\n apply (erule is_aligned_weaken[OF pspace_alignedD], simp)\n apply (simp add: obj_bits_def pg_entry_align_def split: vmpage_size.splits)\n apply (rule is_aligned_shiftl)\n apply (rule is_aligned_andI1)\n apply (rule is_aligned_shiftr)\n apply (case_tac sz)\n apply (clarsimp simp: vmsz_aligned_def pg_entry_align_def\n elim!: is_aligned_weaken split: vmpage_size.splits)+\n done\n\nlemmas lookup_pt_slot_is_aligned_6 =\n lookup_pt_slot_is_aligned[where sz=ARMLargePage,\n unfolded pg_entry_align_def, simplified vmpage_size.simps]\n\nlemma lookup_pd_slot_aligned_6:\n \"\\ vmsz_aligned vptr ARMSuperSection; is_aligned pd 14 \\\n \\ is_aligned (lookup_pd_slot pd vptr) 6\"\n apply (simp add: lookup_pd_slot_def)\n apply (erule aligned_add_aligned, simp_all add: word_bits_conv)\n apply (intro is_aligned_shiftl is_aligned_shiftr)\n apply (simp add: vmsz_aligned_def)\n done\n\nlemma page_directory_at_aligned_pd_bits:\n \"\\page_directory_at pd s;pspace_aligned s\\\n \\ is_aligned pd pd_bits\"\n apply (clarsimp simp:obj_at_def)\n apply (drule(1) pspace_alignedD)\n apply (simp add:pd_bits_def pageBits_def)\n done\n\n\ndefinition\n \"empty_refs m \\ case m of Inr (pde, _) \\ pde_ref pde = None | _ \\ True\"\n\n\ndefinition\n \"parent_for_refs m \\ \\cap.\n case m of Inl (_, slots)\n \\ (\\x. x && ~~ mask pt_bits) ` set slots \\ obj_refs cap\n \\ is_pt_cap cap \\ cap_asid cap \\ None\n | Inr (_, slots)\n \\ (\\x. x && ~~ mask pd_bits) ` set slots \\ obj_refs cap\n \\ is_pd_cap cap \\ cap_asid cap \\ None\"\n\ndefinition\n \"same_refs m cap s \\\n case m of\n Inl (pte, slots) \\\n (\\p. pte_ref_pages pte = Some p \\ p \\ obj_refs cap) \\\n (case slots of\n [] \\ True\n | x # xs \\ \\ref. (ref \\ (x && ~~ mask pt_bits)) s \\\n vs_cap_ref cap = Some (VSRef (x && mask pt_bits >> 2) (Some APageTable) # ref))\n | Inr (pde, slots) \\\n (\\p. pde_ref_pages pde = Some p \\ p \\ obj_refs cap) \\\n (case slots of\n [] \\ True\n | x # xs \\ \\ref. (ref \\ (x && ~~ mask pd_bits)) s \\\n vs_cap_ref cap = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))\"\n\ndefinition\n \"valid_page_inv pg_inv \\ case pg_inv of\n PageMap asid cap ptr m \\\n cte_wp_at (is_arch_update cap) ptr\n and (cte_wp_at (\\c. vs_cap_ref c = None) ptr or (\\s. cte_wp_at (\\c. same_refs m c s) ptr s))\n and cte_wp_at is_pg_cap ptr\n and (\\s. same_refs m cap s)\n and valid_slots m\n and valid_cap cap\n and K (is_pg_cap cap \\ empty_refs m \\ asid \\ mask asid_bits \\ asid \\ 0)\n and (\\s. \\slot. cte_wp_at (parent_for_refs m) slot s)\n and (\\s. \\pd. vspace_at_asid asid pd s)\n | PageUnmap cap ptr \\\n \\s. \\dev r R sz m. cap = PageCap dev r R sz m \\\n case_option True (valid_unmap sz) m \\\n cte_wp_at ((=) (cap.ArchObjectCap cap)) ptr s \\\n s \\ (cap.ArchObjectCap cap)\n | PageFlush typ start end pstart pd asid \\\n vspace_at_asid asid pd and K (asid \\ mask asid_bits \\ asid \\ 0)\n | PageGetAddr ptr \\ \\\"\n\ndefinition\n \"valid_pdi pdi \\ case pdi of\n PageDirectoryFlush typ start end pstart pd asid \\\n vspace_at_asid asid pd and K (asid \\ mask asid_bits \\ asid \\ 0)\n | PageDirectoryNothing \\ \\\"\n\n\ncrunch aligned [wp]: unmap_page pspace_aligned\n (wp: crunch_wps)\n\n\ncrunch \"distinct\" [wp]: unmap_page pspace_distinct\n (wp: crunch_wps simp: crunch_simps)\n\n\ncrunch valid_objs[wp]: unmap_page \"valid_objs\"\n (wp: crunch_wps)\n\n\ncrunch caps_of_state [wp]: unmap_page \"\\s. P (caps_of_state s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma set_cap_valid_slots[wp]:\n \"\\valid_slots x2\\ set_cap cap (a, b)\n \\\\rv s. valid_slots x2 s \\\"\n apply (case_tac x2)\n apply (clarsimp simp:valid_slots_def)\n apply (wp hoare_vcg_ball_lift)\n apply (clarsimp simp:valid_slots_def)\n apply (wp hoare_vcg_ball_lift)\n done\n\ndefinition\n empty_pde_at :: \"obj_ref \\ 'z::state_ext state \\ bool\"\nwhere\n \"empty_pde_at p \\ \\s.\n \\pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s \\\n pd (ucast (p && mask pd_bits >> 2)) = InvalidPDE\"\n\n\ndefinition\n kernel_vsrefs :: \"vs_ref set\"\nwhere\n \"kernel_vsrefs \\ {r. case r of VSRef x y \\ (kernel_base >> 20) \\ x}\"\n\n\ndefinition\n \"valid_pti pti \\ case pti of\n PageTableMap cap ptr pde p \\\n pde_at p and (\\s. wellformed_pde pde) and\n valid_pde pde and valid_cap cap and\n cte_wp_at (\\c. is_arch_update cap c \\ cap_asid c = None) ptr and\n empty_pde_at p and\n (\\s. \\p' ref. vs_cap_ref cap = Some (VSRef (p && mask pd_bits >> 2) (Some APageDirectory) # ref)\n \\ (ref \\ (p && ~~ mask pd_bits)) s\n \\ pde_ref pde = Some p' \\ p' \\ obj_refs cap\n \\ (\\ao. ko_at (ArchObj ao) p' s \\ valid_vspace_obj ao s)\n \\ hd (the (vs_cap_ref cap)) \\ kernel_vsrefs) and\n K (is_pt_cap cap \\ cap_asid cap \\ None)\n | PageTableUnmap cap ptr \\\n cte_wp_at ((=) cap) ptr and valid_cap cap\n and is_final_cap' cap\n and K (is_pt_cap cap)\"\n\ncrunch aligned [wp]: unmap_page_table pspace_aligned\n (wp: crunch_wps)\n\n\ncrunch valid_objs [wp]: unmap_page_table valid_objs\n (wp: crunch_wps simp: crunch_simps)\n\n\ncrunch \"distinct\" [wp]: unmap_page_table pspace_distinct\n (wp: crunch_wps simp: crunch_simps)\n\n\ncrunch caps_of_state [wp]: unmap_page_table \"\\s. P (caps_of_state s)\"\n (wp: crunch_wps simp: crunch_simps)\n\n\ncrunch typ_at [wp]: unmap_page_table \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps hoare_drop_imps)\n\n\ndefinition\n \"valid_apinv ap \\ case ap of\n asid_pool_invocation.Assign asid p slot \\\n (\\s. \\pool. ko_at (ArchObj (arch_kernel_obj.ASIDPool pool)) p s \\\n pool (ucast asid) = None)\n and cte_wp_at (\\cap. is_pd_cap cap \\ cap_asid cap = None) slot\n and K (0 < asid \\ asid \\ 2^asid_bits - 1)\n and ([VSRef (ucast (asid_high_bits_of asid)) None] \\ p)\"\n\nlemma store_hw_asid_invs:\n \"\\invs and\n (\\s. arm_asid_map (arch_state s) asid = None \\\n arm_hwasid_table (arch_state s) hw_asid = None \\\n asid \\ mask asid_bits)\\\n store_hw_asid asid hw_asid\n \\\\x. invs\\\"\n apply (rule hoare_add_post)\n apply (rule store_hw_asid_valid_arch)\n apply fastforce\n apply (simp add: store_hw_asid_def)\n apply (wp find_pd_for_asid_assert_wp)\n apply (clarsimp simp: invs_def valid_state_def)\n apply (simp add: valid_global_refs_def global_refs_def\n valid_irq_node_def valid_vspace_objs_arch_update\n valid_global_objs_def valid_arch_caps_def second_level_tables_def\n valid_table_caps_def valid_kernel_mappings_def\n valid_machine_state_def valid_vs_lookup_arch_update)\n apply (simp add: valid_asid_map_def fun_upd_def[symmetric]\n pd_at_asid_arch_up)\n done\n\nlemma invalidateLocalTLB_ASID_valid_irq_states:\n \"\\\\m. valid_irq_states (s\\machine_state := m\\)\\ invalidateLocalTLB_ASID x\n \\\\a b. valid_irq_states (s\\machine_state := b\\)\\\"\n apply(simp add: valid_irq_states_def | wp no_irq | simp add: no_irq_invalidateLocalTLB_ASID)+\n done\n\nlemma find_free_hw_asid_invs [wp]:\n \"\\invs\\ find_free_hw_asid \\\\asid. invs\\\"\n apply (rule hoare_add_post)\n apply (rule find_free_hw_asid_valid_arch)\n apply fastforce\n apply (simp add: find_free_hw_asid_def invalidate_hw_asid_entry_def invalidate_asid_def\n do_machine_op_def split_def\n cong: option.case_cong)\n apply (wp|wpc)+\n apply (clarsimp simp: invs_def valid_state_def split del: if_split)\n apply (simp add: valid_global_refs_def global_refs_def cur_tcb_def\n valid_irq_node_def valid_vspace_objs_arch_update\n valid_global_objs_def valid_arch_caps_def second_level_tables_def\n valid_table_caps_def valid_kernel_mappings_def\n valid_machine_state_def valid_vs_lookup_arch_update)\n apply (elim conjE)\n apply (rule conjI)\n apply(erule use_valid[OF _ invalidateLocalTLB_ASID_valid_irq_states])\n apply fastforce\n apply(rule conjI)\n apply clarsimp\n apply (drule use_valid)\n apply (rule_tac p=p in invalidateLocalTLB_ASID_underlying_memory, simp, fastforce)\n apply (clarsimp simp: valid_asid_map_def fun_upd_def[symmetric]\n pd_at_asid_arch_up')\n apply (rule conjI, blast)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule_tac P1 = \"(=) (device_state (machine_state s))\" in\n use_valid[OF _ invalidateLocalTLB_ASID_device_state_inv])\n apply simp\n apply clarsimp\n done\n\nlemma get_hw_asid_invs [wp]:\n \"\\invs and K (a \\ mask asid_bits)\\ get_hw_asid a \\\\hw_asid. invs\\\"\n apply (simp add: get_hw_asid_def)\n apply (wp store_hw_asid_invs load_hw_asid_wp|wpc)+\n apply simp\n done\n\nlemma arm_context_switch_invs [wp]:\n \"\\invs and K (a \\ mask asid_bits)\\ arm_context_switch pd a \\\\_. invs\\\"\n apply (simp add: arm_context_switch_def)\n apply (wp dmo_invs)\n apply (rule hoare_post_imp[rotated])\n apply (rule get_hw_asid_invs[simplified])\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp simp: setHardwareASID_def set_current_pd_def writeTTBR0_def\n isb_def dsb_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+)[3]\n apply(erule use_valid)\n apply(wp no_irq | simp add: no_irq_setHardwareASID no_irq_set_current_pd)+\n done\n\nlemmas set_current_pd_irq_masks = no_irq[OF no_irq_set_current_pd]\nlemmas setHardwareASID_irq_masks = no_irq[OF no_irq_setHardwareASID]\n\nlemma dmo_set_current_pd_invs[wp]: \"\\invs\\ do_machine_op (set_current_pd addr) \\\\y. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp simp: set_current_pd_def writeTTBR0_def dsb_def isb_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+)[3]\n apply(erule (1) use_valid[OF _ set_current_pd_irq_masks])\n done\n\ncrunch device_state_inv[wp]: ackInterrupt \"\\ms. P (device_state ms)\"\nlemma dmo_ackInterrupt[wp]: \"\\invs\\ do_machine_op (ackInterrupt irq) \\\\y. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp simp: ackInterrupt_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+)[3]\n apply(erule (1) use_valid[OF _ ackInterrupt_irq_masks])\n done\n\ncrunch device_state_inv[wp]: setIRQTrigger \"\\ms. P (device_state ms)\"\n\nlemma dmo_setIRQTrigger_invs[wp]: \"\\invs\\ do_machine_op (setIRQTrigger irq b) \\\\y. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp simp: setIRQTrigger_def machine_op_lift_def\n machine_rest_lift_def split_def | wp)+)[3]\n apply(erule (1) use_valid[OF _ setIRQTrigger_irq_masks])\n done\n\nlemma svr_invs [wp]:\n \"\\invs\\ set_vm_root t' \\\\_. invs\\\"\n apply (simp add: set_vm_root_def)\n apply (rule hoare_pre)\n apply (wp whenE_wp find_pd_for_asid_inv hoare_vcg_all_lift | wpc | simp add: split_def)+\n apply (rule_tac Q'=\"\\_ s. invs s \\ x2 \\ mask asid_bits\" in hoare_post_imp_R)\n prefer 2\n apply simp\n apply (rule valid_validE_R)\n apply (wp find_pd_for_asid_inv | simp add: split_def)+\n apply (rule_tac Q=\"\\c s. invs s \\ s \\ c\" in hoare_strengthen_post)\n apply wp\n apply (clarsimp simp: valid_cap_def mask_def)\n apply(simp add: invs_valid_objs)\n done\n\ncrunch pred_tcb_at[wp]: set_vm_root \"pred_tcb_at proj P t\"\n (simp: crunch_simps)\n\nlemmas set_vm_root_typ_ats [wp] = abs_typ_at_lifts [OF set_vm_root_typ_at]\n\nlemma valid_pte_lift3:\n assumes x: \"(\\P T p. \\\\s. P (typ_at T p s)\\ f \\\\rv s. P (typ_at T p s)\\)\"\n shows \"\\\\s. P (valid_pte pte s)\\ f \\\\rv s. P (valid_pte pte s)\\\"\n apply (insert bool_function_four_cases[where f=P])\n apply (erule disjE)\n apply (cases pte)\n apply (simp add: data_at_def | wp hoare_vcg_const_imp_lift x)+\n apply (erule disjE)\n apply (cases pte)\n apply (simp add: data_at_def | wp hoare_vcg_disj_lift hoare_vcg_const_imp_lift x)+\n apply (erule disjE)\n apply (simp | wp)+\n done\n\n\nlemma set_cap_valid_pte_stronger:\n \"\\\\s. P (valid_pte pte s)\\ set_cap cap p \\\\rv s. P (valid_pte pte s)\\\"\n by (wp valid_pte_lift3 set_cap_typ_at)\n\nend\n\nlocale vs_lookup_map_some_pdes = Arch +\n fixes pd pdp s s' S T pd'\n defines \"s' \\ s\\kheap := kheap s(pdp \\ ArchObj (PageDirectory pd'))\\\"\n assumes refs: \"vs_refs (ArchObj (PageDirectory pd')) =\n (vs_refs (ArchObj (PageDirectory pd)) - T) \\ S\"\n assumes old: \"kheap s pdp = Some (ArchObj (PageDirectory pd))\"\n assumes pts: \"\\x \\ S. page_table_at (snd x) s\"\nbegin\n\ndefinition\n \"new_lookups \\ {((rs,p),(rs',p')). \\r. rs' = r # rs \\ (r,p') \\ S \\ p = pdp}\"\n\n\nlemma vs_lookup1:\n \"vs_lookup1 s' \\ vs_lookup1 s \\ new_lookups\"\n apply (simp add: vs_lookup1_def)\n apply (clarsimp simp: obj_at_def s'_def new_lookups_def)\n apply (auto split: if_split_asm simp: refs old)\n done\n\n\nlemma vs_lookup_trans:\n \"(vs_lookup1 s')^* \\ (vs_lookup1 s)^* \\ (vs_lookup1 s)^* O new_lookups^*\"\n apply (rule ord_le_eq_trans, rule rtrancl_mono, rule vs_lookup1)\n apply (rule union_trans)\n apply (clarsimp simp add: new_lookups_def)\n apply (drule bspec [OF pts])\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def)\n done\n\n\nlemma double_new_lookup:\n \"\\ (x, y) \\ new_lookups; (y, z) \\ new_lookups \\ \\ False\"\n by (auto simp: new_lookups_def obj_at_def old a_type_def\n dest!: bspec [OF pts])\n\n\nlemma new_lookups_trans:\n \"new_lookups^* = (new_lookups \\ Id)\"\n apply (rule set_eqI, clarsimp, rule iffI)\n apply (erule rtranclE)\n apply simp\n apply (erule rtranclE)\n apply simp\n apply (drule(1) double_new_lookup)\n apply simp\n apply auto\n done\n\n\nlemma arch_state [simp]:\n \"arch_state s' = arch_state s\"\n by (simp add: s'_def)\n\n\nlemma vs_lookup:\n \"vs_lookup s' \\ vs_lookup s \\ new_lookups^* `` vs_lookup s\"\n unfolding vs_lookup_def\n apply (rule order_trans)\n apply (rule Image_mono [OF _ order_refl])\n apply (rule vs_lookup_trans)\n apply (clarsimp simp: relcomp_Image Un_Image)\n done\n\nlemma vs_lookup2:\n \"vs_lookup s' \\ vs_lookup s \\ (new_lookups `` vs_lookup s)\"\n apply (rule order_trans, rule vs_lookup)\n apply (auto simp add: vs_lookup new_lookups_trans)\n done\n\n\nend\n\ncontext Arch begin global_naming ARM\n\nlemma set_pd_vspace_objs_map:\n notes valid_vspace_obj.simps[simp del] and a_type_elims[rule del]\n shows\n \"\\valid_vspace_objs and\n obj_at (\\ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \\ S) p and\n (\\s. \\x \\ S. page_table_at (snd x) s) and\n (\\s. \\(r,p') \\ S. \\ao. (\\\\p) s \\ ko_at (ArchObj ao) p' s\n \\ valid_vspace_obj ao s) and\n (\\s. (\\\\p) s \\ valid_vspace_obj (PageDirectory pd) s)\\\n set_pd p pd \\\\_. valid_vspace_objs\\\"\n apply (simp add: set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def valid_vspace_objs_def a_type_simps\n simp del: fun_upd_apply\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (frule (1) vs_lookup_map_some_pdes.intro, simp add: obj_at_def)\n apply (frule vs_lookup_map_some_pdes.vs_lookup2)\n apply (drule(1) subsetD)\n apply (erule UnE)\n apply (simp only: fun_upd_apply split: if_split_asm)\n apply (rule valid_vspace_obj_same_type)\n apply fastforce\n apply assumption\n apply (clarsimp simp add: a_type_def)\n apply (rule valid_vspace_obj_same_type)\n apply fastforce\n apply assumption\n apply (clarsimp simp: a_type_def)\n apply (clarsimp simp add: vs_lookup_map_some_pdes.new_lookups_def)\n apply (drule(1) bspec)+\n apply (clarsimp simp add: a_type_simps split: if_split_asm)\n apply (drule mp, erule exI)+\n apply (erule(1) valid_vspace_obj_same_type)\n apply (simp add: a_type_def)\n done\n\n(* FIXME: move *)\nlemma simpler_set_pd_def:\n \"set_pd p pd =\n (\\s. if \\pd. kheap s p = Some (ArchObj (PageDirectory pd))\n then ({((), s\\kheap := kheap s(p \\ ArchObj (PageDirectory pd))\\)},\n False)\n else ({}, True))\"\n apply (rule ext)\n apply (auto simp: set_pd_def get_object_def simpler_gets_def assert_def\n return_def fail_def set_object_def get_def put_def bind_def a_type_def\n split: Structures_A.kernel_object.split arch_kernel_obj.split)\n done\n\nlemma set_pd_valid_vs_lookup_map:\n \"\\valid_vs_lookup and valid_arch_state and valid_vspace_objs and\n obj_at (\\ko. vs_refs (ArchObj (PageDirectory pd)) =\n vs_refs ko - T \\ S) p and\n (\\s. \\x\\S. page_table_at (snd x) s) and\n obj_at (\\ko. vs_refs_pages (ArchObj (PageDirectory pd)) =\n vs_refs_pages ko - T' \\ S') p and\n (\\s. \\(r, p')\\S. \\ao. (\\\\ p) s \\\n ko_at (ArchObj ao) p' s \\ valid_vspace_obj ao s) and\n (\\s. (\\\\ p) s \\ valid_vspace_obj (PageDirectory pd) s) and\n (\\s. \\r. (r \\ p) s \\\n (\\c\\- kernel_mapping_slots. \\q.\n pde_ref_pages (pd c) = Some q \\\n (\\p' cap. caps_of_state s p' = Some cap \\\n q \\ obj_refs cap \\ vs_cap_ref cap =\n Some (VSRef (ucast c) (Some APageDirectory) # r)))) and\n (\\s. \\r. (r \\ p) s \\\n (\\c\\- kernel_mapping_slots. \\q.\n pde_ref (pd c) = Some q \\\n (\\q' pt d. ko_at (ArchObj (PageTable pt)) q s \\\n pte_ref_pages (pt d) = Some q' \\\n (\\p' cap. caps_of_state s p' = Some cap \\\n q' \\ obj_refs cap \\ vs_cap_ref cap =\n Some (VSRef (ucast d) (Some APageTable) #\n VSRef (ucast c) (Some APageDirectory) # r)))))\\\n set_pd p pd\n \\\\rv. valid_vs_lookup\\\"\n using set_pd_vspace_objs_map[where p=p and pd=pd and T=T and S=S]\n set_pd_valid_arch[of p pd]\n apply (clarsimp simp: valid_def simpler_set_pd_def)\n apply (drule_tac x=s in spec)+\n apply (clarsimp simp: valid_vs_lookup_def split: if_split_asm)\n apply (subst caps_of_state_after_update[folded fun_upd_apply],\n simp add: obj_at_def)\n apply (erule (1) vs_lookup_pagesE_alt)\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def\n fun_upd_def)\n apply (drule_tac x=pa in spec)\n apply simp\n apply (drule vs_lookup_pages_atI)\n apply simp\n apply (drule_tac x=pa in spec)\n apply (drule_tac x=\"[VSRef (ucast b) (Some AASIDPool),\n VSRef (ucast a) None]\" in spec)+\n apply simp\n apply (drule vs_lookup_pages_apI)\n apply (simp split: if_split_asm)\n apply (simp+)[2]\n apply (frule_tac s=\"s\\kheap := kheap s(p \\ ArchObj (PageDirectory pd))\\\"\n in vs_lookup_pages_pdI[rotated -1])\n apply (simp del: fun_upd_apply)+\n apply (frule vs_lookup_pages_apI)\n apply (simp split: if_split_asm)+\n apply (thin_tac \"\\r. (r \\ p) s \\ Q r\" for Q)+\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (drule_tac x=pa in spec)\n apply (drule_tac x=\"[VSRef (ucast c) (Some APageDirectory),\n VSRef (ucast b) (Some AASIDPool),\n VSRef (ucast a) None]\" in spec)\n apply (erule impE)\n apply (erule vs_lookup_pages_pdI)\n apply simp+\n apply (thin_tac \"\\r. (r \\ p) s \\ Q r\" for Q)\n apply (thin_tac \"P \\ Q\" for P Q)+\n apply (case_tac \"p=p\\<^sub>2\")\n apply (thin_tac \"\\p ref. P p ref\" for P)\n apply (frule vs_lookup_pages_apI)\n apply (simp split: if_split_asm)\n apply simp+\n apply (drule spec, erule impE, assumption)\n apply (clarsimp split: if_split_asm)\n apply (drule bspec, fastforce)\n apply (simp add: pde_ref_def obj_at_def)\n apply (thin_tac \"\\r. (r \\ p) s \\ Q r\" for Q)\n apply (clarsimp split: if_split_asm)\n apply (drule (7) vs_lookup_pages_ptI)\n apply simp\n done\n\n\nlemma set_pd_valid_arch_caps:\n \"\\valid_arch_caps and valid_arch_state and valid_vspace_objs and\n valid_objs and\n obj_at (\\ko. vs_refs (ArchObj (PageDirectory pd)) =\n vs_refs ko - T \\ S) p and\n obj_at (\\ko. vs_refs_pages (ArchObj (PageDirectory pd)) =\n vs_refs_pages ko - T' \\ S') p and\n (\\s. \\x\\S. page_table_at (snd x) s) and\n (\\s. \\p. (VSRef 0 (Some AASIDPool), p) \\ S) and\n (\\s. \\(r, p')\\S. \\ao. (\\\\ p) s \\\n ko_at (ArchObj ao) p' s \\ valid_vspace_obj ao s) and\n (\\s. (\\\\ p) s \\ valid_vspace_obj (PageDirectory pd) s) and\n (\\s. (\\p' cap. caps_of_state s p' = Some cap \\ is_pd_cap cap \\\n p \\ obj_refs cap \\ cap_asid cap \\ None)\n \\ (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \\\n empty_table (set (second_level_tables (arch_state s)))\n (ArchObj (PageDirectory pd)))) and\n (\\s. \\r. (r \\ p) s \\\n (\\c\\- kernel_mapping_slots. \\q.\n pde_ref_pages (pd c) = Some q \\\n (\\p' cap. caps_of_state s p' = Some cap \\\n q \\ obj_refs cap \\ vs_cap_ref cap =\n Some (VSRef (ucast c) (Some APageDirectory) # r)))) and\n (\\s. \\r. (r \\ p) s \\\n (\\c\\- kernel_mapping_slots. \\q.\n pde_ref (pd c) = Some q \\\n (\\q' pt d. ko_at (ArchObj (PageTable pt)) q s \\\n pte_ref_pages (pt d) = Some q' \\\n (\\p' cap. caps_of_state s p' = Some cap \\\n q' \\ obj_refs cap \\ vs_cap_ref cap =\n Some (VSRef (ucast d) (Some APageTable) #\n VSRef (ucast c) (Some APageDirectory) # r)))))\\\n set_pd p pd\n \\\\rv. valid_arch_caps\\\"\n apply (simp add: set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps simp del: fun_upd_apply\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (clarsimp simp: valid_arch_caps_def)\n apply (subst caps_of_state_after_update[folded fun_upd_def],\n simp add: obj_at_def)+\n apply simp\n apply (rule conjI)\n using set_pd_valid_vs_lookup_map[where p=p and pd=pd and T=T and S=S\n and T'=T' and S'=S']\n apply (clarsimp simp add: valid_def)\n apply (drule_tac x=s in spec)\n apply (simp add: simpler_set_pd_def obj_at_def)\n apply (simp add: valid_table_caps_def obj_at_def\n caps_of_state_after_update[folded fun_upd_def]\n del: imp_disjL)\n apply (drule_tac x=p in spec, elim allEI, intro impI)\n apply clarsimp\n apply (erule_tac P=\"is_pd_cap cap\" in disjE)\n prefer 2\n apply (frule_tac p=\"(a,b)\" in caps_of_state_valid_cap, simp)\n apply (clarsimp simp add: is_pt_cap_def valid_cap_def obj_at_def\n valid_arch_cap_def\n a_type_def)\n apply (frule_tac cap=cap and cap'=capa and cs=\"caps_of_state s\" in unique_table_caps_pdD)\n apply (simp add: is_pd_cap_def)+\n apply (clarsimp simp: is_pd_cap_def)+\n done\n\n(* FIXME: move to wellformed *)\nlemma global_pde_graph_ofI:\n \" \\pd x = pde; pde_ref pde = Some v\\\n \\ (x, v) \\ graph_of (pde_ref o pd)\"\n by (clarsimp simp: graph_of_def pde_ref_def comp_def)\n\n\n\nlemma set_pd_valid_kernel_mappings_map:\n \"\\valid_kernel_mappings and\n obj_at (\\ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko - T \\ S) p and\n (\\s. \\(r,p) \\ S. (r \\ kernel_vsrefs)\n = (p \\ set (arm_global_pts (arch_state s))))\\\n set_pd p pd\n \\\\rv. valid_kernel_mappings\\\"\n apply (simp add: set_pd_def)\n including unfold_objects\n apply (wpsimp wp: set_object_v_ker_map[THEN hoare_set_object_weaken_pre]\n simp: a_type_def valid_kernel_mappings_def)\n apply (drule bspec, erule ranI)\n apply (clarsimp simp: valid_kernel_mappings_if_pd_def\n kernel_vsrefs_def)\n apply (drule_tac f=\"\\S. (VSRef (ucast x) (Some APageDirectory), r) \\ S\"\n in arg_cong)\n apply (simp add: glob_vs_refs_def)\n apply (drule iffD1)\n apply (rule image_eqI[rotated])\n apply (erule global_pde_graph_ofI[rotated])\n apply simp+\n apply (elim conjE disjE)\n apply (clarsimp dest!: graph_ofD)\n apply (drule(1) bspec)\n apply (clarsimp simp: kernel_base_shift_cast_le\n kernel_mapping_slots_def)\n done\n\nlemma glob_vs_refs_subset:\n \" vs_refs x \\ glob_vs_refs x\"\n apply (clarsimp simp: glob_vs_refs_def vs_refs_def)\n apply (clarsimp split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (rule pair_imageI)\n apply (simp add: graph_of_def split:if_split_asm)\n done\n\nlemma vs_refs_pages_pdI:\n \"\\pde_ref_pages (pd x) = Some a; x \\ kernel_mapping_slots\\\n \\ (VSRef (ucast x) (Some APageDirectory), a) \\ vs_refs_pages (ArchObj (PageDirectory pd))\"\n by (auto simp: pde_ref_pages_def vs_refs_pages_def graph_of_def image_def split: pde.splits)\n\nlemma pde_ref_pde_ref_pagesI[elim!]:\n \"pde_ref (pd x) = Some a \\ pde_ref_pages (pd x) = Some a\"\n by (auto simp: pde_ref_def pde_ref_pages_def split: pde.splits)\n\nlemma vs_refs_pdI2:\n \"\\pd r = PageTablePDE x a b; r \\ kernel_mapping_slots\\\n \\ (VSRef (ucast r) (Some APageDirectory), ptrFromPAddr x) \\ vs_refs (ArchObj (PageDirectory pd))\"\n by (auto simp: vs_refs_def pde_ref_def graph_of_def)\n\n\nlemma set_pd_invs_map:\n \"\\invs and (\\s. \\i. wellformed_pde (pd i)) and\n obj_at (\\ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \\ S) p and\n obj_at (\\ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \\ S') p and\n obj_at (\\ko. \\pd'. ko = ArchObj (PageDirectory pd')\n \\ (\\x\\kernel_mapping_slots. pd x = pd' x)) p and\n (\\s. \\(r,p) \\ S. \\ao. ko_at (ArchObj ao) p s \\ valid_vspace_obj ao s) and\n (\\s. \\(r,p) \\ S. page_table_at p s) and\n (\\s. \\(r,p) \\ S. (r \\ kernel_vsrefs)\n = (p \\ set (arm_global_pts (arch_state s)))) and\n (\\s. \\p' cap. caps_of_state s p' = Some cap \\ is_pd_cap cap\n \\ p \\ obj_refs cap \\ cap_asid cap \\ None) and\n (\\s. \\p. (VSRef 0 (Some AASIDPool), p) \\ S) and\n (\\s. \\ref. (ref \\ p) s \\\n (\\(r, p) \\ S'. \\p' cap. caps_of_state s p' = Some cap \\ p \\ obj_refs cap\n \\ vs_cap_ref cap = Some (r # ref))) and\n (\\s. \\ref. (ref \\ p) s \\\n (\\(r, p) \\ S. (\\q' pt d.\n ko_at (ArchObj (PageTable pt)) p s \\\n pte_ref_pages (pt d) = Some q' \\\n (\\p' cap. caps_of_state s p' = Some cap \\\n q' \\ obj_refs cap \\\n vs_cap_ref cap =\n Some (VSRef (ucast d) (Some APageTable) # r # ref))))) and\n\n valid_vspace_obj (PageDirectory pd)\\\n set_pd p pd \\\\_. invs\\\"\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (rule hoare_pre)\n apply (wp set_pd_valid_objs set_pd_iflive set_pd_zombies\n set_pd_zombies_state_refs set_pd_valid_mdb set_pd_zombies_state_hyp_refs\n set_pd_valid_idle set_pd_ifunsafe set_pd_reply_caps\n set_pd_valid_arch set_pd_valid_global set_pd_cur\n set_pd_reply_masters valid_irq_node_typ\n set_pd_vspace_objs_map[where S=S and T=\"{}\"]\n set_pd_valid_arch_caps[where S=S and T=\"{}\" and S'=S' and T'=T']\n valid_irq_handlers_lift\n set_pd_valid_kernel_mappings_map[where S=S and T=\"{}\"]\n set_pd_equal_kernel_mappings_triv)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule(1) valid_global_refsD2)\n apply (clarsimp simp: cap_range_def split_def)\n apply (rule conjI)\n apply clarsimp\n\n apply (drule (1) vs_refs_pages_pdI)\n apply (clarsimp simp: obj_at_def)\n apply (erule disjE)\n apply (clarsimp simp: valid_arch_caps_def)\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_step])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (rule_tac x=\"VSRef (ucast c) (Some APageDirectory)\" in exI)\n apply (erule conjI[OF refl])\n apply simp\n apply clarsimp\n apply (erule_tac x=r in allE, drule (1) mp, drule (1) bspec)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: pde_ref_def split: pde.splits)\n apply (drule (1) vs_refs_pdI2)\n apply (clarsimp simp: obj_at_def)\n apply (erule disjE)\n apply (clarsimp simp: valid_arch_caps_def)\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_step[OF vs_lookup_pages_step]])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (rule_tac x=\"VSRef (ucast c) (Some APageDirectory)\" in exI)\n apply (rule conjI[OF refl])\n apply (erule subsetD[OF vs_refs_pages_subset])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (rule_tac x=\"VSRef (ucast d) (Some APageTable)\" in exI)\n apply (rule conjI[OF refl])\n apply (erule pte_ref_pagesD)\n apply simp\n apply clarsimp\n apply (erule_tac x=r in allE, drule (1) mp, drule_tac P=\"(%x. \\q' pt . Q x q' pt y s)\" for Q s in bspec)\n apply simp\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (clarsimp simp add: obj_at_def glob_vs_refs_def)\n apply safe[1]\n apply (rule pair_imageI)\n apply (clarsimp simp add: graph_of_def)\n apply (case_tac \"ab \\ kernel_mapping_slots\")\n apply clarsimp\n apply (frule (1) pde_graph_ofI[rotated])\n apply (case_tac \"pd ab\", simp_all)\n apply (clarsimp simp: vs_refs_def )\n apply (drule_tac x=\"(ab, bb)\" and f=\"(\\(r, y). (VSRef (ucast r) (Some APageDirectory), y))\"\n in imageI)\n apply simp\n apply (erule imageE)\n apply (simp add: graph_of_def split_def)\n apply (rule pair_imageI)\n apply (case_tac \"ab \\ kernel_mapping_slots\")\n apply (clarsimp simp add: graph_of_def)+\n apply (frule (1) pde_graph_ofI[rotated])\n apply (case_tac \"pd ab\", simp_all)\n apply (clarsimp simp: vs_refs_def )\n apply (drule_tac x=\"(ab, bb)\" and f=\"(\\(r, y). (VSRef (ucast r) (Some APageDirectory), y))\"\n in imageI)\n apply (drule_tac s=\"(\\(r, y). (VSRef (ucast r) (Some APageDirectory), y)) `\n graph_of\n (\\x. if x \\ kernel_mapping_slots then None else pde_ref (pd x))\" in sym)\n apply simp\n apply (drule_tac c=\"(VSRef (ucast ab) (Some APageDirectory), bb)\" and B=S in UnI1)\n apply simp\n apply (erule imageE)\n apply (simp add: graph_of_def split_def)\n apply (subst (asm) Un_commute[where B=S])\n apply (drule_tac c=\"(aa,ba)\" and B=\"vs_refs (ArchObj (PageDirectory pd'))\" in UnI1)\n apply (drule_tac t=\"S \\ vs_refs (ArchObj (PageDirectory pd'))\" in sym)\n apply (simp del:Un_iff)\n apply (drule rev_subsetD[OF _ glob_vs_refs_subset])\n apply (simp add: glob_vs_refs_def)\n by blast\n\nlemma vs_refs_add_one':\n \"p \\ kernel_mapping_slots \\\n vs_refs (ArchObj (PageDirectory (pd (p := pde)))) =\n vs_refs (ArchObj (PageDirectory pd))\n - Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref (pd p))\n \\ Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref pde)\"\n apply (simp add: vs_refs_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI)\n apply (clarsimp del: disjCI dest!: graph_ofD split: if_split_asm)\n apply (rule disjI1)\n apply (rule conjI)\n apply (rule_tac x=\"(aa,ba)\" in image_eqI)\n apply simp\n apply (simp add: graph_of_def)\n apply clarsimp\n apply (erule disjE)\n apply (clarsimp dest!: graph_ofD)\n apply (rule_tac x=\"(aa,ba)\" in image_eqI)\n apply simp\n apply (clarsimp simp: graph_of_def split:if_split_asm)\n apply clarsimp\n apply (rule_tac x=\"(p,x)\" in image_eqI)\n apply simp\n apply (clarsimp simp: graph_of_def)\n done\n\n\nlemma vs_refs_add_one:\n \"\\pde_ref (pd p) = None; p \\ kernel_mapping_slots\\ \\\n vs_refs (ArchObj (PageDirectory (pd (p := pde)))) =\n vs_refs (ArchObj (PageDirectory pd))\n \\ Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref pde)\"\n by (simp add: vs_refs_add_one')\n\n\nlemma vs_refs_pages_add_one':\n \"p \\ kernel_mapping_slots \\\n vs_refs_pages (ArchObj (PageDirectory (pd (p := pde)))) =\n vs_refs_pages (ArchObj (PageDirectory pd))\n - Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref_pages (pd p))\n \\ Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref_pages pde)\"\n apply (simp add: vs_refs_pages_def)\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI)\n apply (clarsimp del: disjCI dest!: graph_ofD split: if_split_asm)\n apply (rule disjI1)\n apply (rule conjI)\n apply (rule_tac x=\"(aa,ba)\" in image_eqI)\n apply simp\n apply (simp add: graph_of_def)\n apply clarsimp\n apply (erule disjE)\n apply (clarsimp dest!: graph_ofD)\n apply (rule_tac x=\"(aa,ba)\" in image_eqI)\n apply simp\n apply (clarsimp simp: graph_of_def split:if_split_asm)\n apply clarsimp\n apply (rule_tac x=\"(p,x)\" in image_eqI)\n apply simp\n apply (clarsimp simp: graph_of_def)\n done\n\nlemma vs_refs_pages_add_one:\n \"\\pde_ref_pages (pd p) = None; p \\ kernel_mapping_slots\\ \\\n vs_refs_pages (ArchObj (PageDirectory (pd (p := pde)))) =\n vs_refs_pages (ArchObj (PageDirectory pd))\n \\ Pair (VSRef (ucast p) (Some APageDirectory)) ` set_option (pde_ref_pages pde)\"\n by (simp add: vs_refs_pages_add_one')\n\ndefinition is_asid_pool_cap :: \"cap \\ bool\"\n where \"is_asid_pool_cap cap \\ \\ptr asid. cap = cap.ArchObjectCap (arch_cap.ASIDPoolCap ptr asid)\"\n\n\n(* FIXME: move *)\nlemma valid_cap_to_pt_cap:\n \"\\valid_cap c s; obj_refs c = {p}; page_table_at p s\\ \\ is_pt_cap c\"\n by (clarsimp simp: valid_cap_def obj_at_def is_obj_defs is_pt_cap_def\n split: cap.splits option.splits arch_cap.splits if_splits)\n\nlemma ref_is_unique:\n \"\\(ref \\ p) s; (ref' \\ p) s; p \\ set (arm_global_pts (arch_state s));\n valid_vs_lookup s; unique_table_refs (caps_of_state s);\n valid_vspace_objs s; valid_asid_table (arm_asid_table (arch_state s)) s;\n valid_caps (caps_of_state s) s\\\n \\ ref = ref'\"\n apply (erule (1) vs_lookupE_alt[OF _ _ valid_asid_table_ran], clarsimp)\n apply (erule (1) vs_lookupE_alt[OF _ _ valid_asid_table_ran], clarsimp)\n apply (clarsimp simp: valid_asid_table_def up_ucast_inj_eq)\n apply (erule (2) inj_on_domD)\n apply ((clarsimp simp: obj_at_def)+)[2]\n apply (erule (1) vs_lookupE_alt[OF _ _ valid_asid_table_ran], clarsimp)\n apply (clarsimp simp: obj_at_def)\n apply (drule (2) vs_lookup_apI)+\n apply (clarsimp dest!: valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI]\n obj_ref_elemD\n simp: table_cap_ref_ap_eq[symmetric])\n apply (drule_tac cap=cap and cap'=capa in unique_table_refsD, simp+)[1]\n apply (clarsimp simp: obj_at_def)\n apply (erule (1) vs_lookupE_alt[OF _ _ valid_asid_table_ran], clarsimp)\n apply ((clarsimp simp: obj_at_def)+)[2]\n apply (simp add: pde_ref_def split: pde.splits)\n apply (drule (5) vs_lookup_pdI)+\n apply (clarsimp dest!: valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI]\n obj_ref_elemD)\n apply (drule_tac cap=cap and cap'=capa in unique_table_refsD, simp+)[1]\n apply (drule (3) valid_capsD[THEN valid_cap_to_pt_cap])+\n apply (clarsimp simp: is_pt_cap_def table_cap_ref_simps vs_cap_ref_simps)\n done\n\nlemma mask_shift_mask_helper:\n \"(p && mask pd_bits >> 2) && mask 12 = (p && mask pd_bits >> 2)\"\n apply (rule word_eqI)\n apply (simp add: word_size pd_bits_def pageBits_def nth_shiftr conj_comms)\n done\n\nlemma ucast_ucast_mask_shift_helper:\n \"ucast (ucast (p && mask pd_bits >> 2 :: word32) :: 12 word)\n = (p && mask pd_bits >> 2 :: word32)\"\n apply (rule ucast_ucast_len)\n apply (rule shiftr_less_t2n)\n apply (simp add: pd_bits_def pageBits_def)\n apply (rule order_less_le_trans, rule and_mask_less_size)\n apply (simp add: word_size)+\n done\n\nlemma unat_ucast_pd_bits_shift:\n \"unat (ucast ((p :: word32) && mask pd_bits >> 2) :: 12 word)\n = unat (p && mask pd_bits >> 2)\"\n apply (simp only: unat_ucast)\n apply (rule mod_less)\n apply (rule unat_less_power)\n apply (simp add: word_bits_def)\n apply (rule shiftr_less_t2n)\n apply (rule order_le_less_trans [OF word_and_le1])\n apply (simp add: pd_bits_def pageBits_def mask_def)\n done\n\nlemma kernel_vsrefs_kernel_mapping_slots:\n \"(ucast (p && mask pd_bits >> 2) \\ kernel_mapping_slots) =\n (VSRef (p && mask pd_bits >> 2) (Some APageDirectory) \\ kernel_vsrefs)\"\n by (clarsimp simp: kernel_mapping_slots_def kernel_vsrefs_def\n word_le_nat_alt unat_ucast_pd_bits_shift\n kernel_base_def)\n\nlemma vs_lookup_typI:\n \"\\(r \\ p) s; valid_vspace_objs s; valid_asid_table (arm_asid_table (arch_state s)) s\\\n \\ page_table_at p s\n \\ page_directory_at p s\n \\ asid_pool_at p s\"\n apply (erule (1) vs_lookupE_alt)\n apply (clarsimp simp: ran_def)\n apply (drule (2) valid_asid_tableD)\n apply simp+\n done\n\nlemma vs_lookup_vs_lookup_pagesI':\n \"\\(r \\ p) s; page_table_at p s \\ page_directory_at p s \\ asid_pool_at p s;\n valid_vspace_objs s; valid_asid_table (arm_asid_table (arch_state s)) s\\\n \\ (r \\ p) s\"\n apply (erule (1) vs_lookup_pagesE_alt)\n apply (clarsimp simp:ran_def)\n apply (drule (2) valid_asid_tableD)\n apply (rule vs_lookupI)\n apply (fastforce simp: vs_asid_refs_def graph_of_def)\n apply simp\n apply (rule vs_lookupI)\n apply (fastforce simp: vs_asid_refs_def graph_of_def)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (fastforce simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def)\n apply (rule vs_lookupI)\n apply (fastforce simp: vs_asid_refs_def graph_of_def)\n apply (rule_tac y=\"([VSRef (ucast b) (Some AASIDPool), VSRef (ucast a) None], p\\<^sub>2)\" in rtrancl_trans)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (fastforce simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def)\n apply (rule_tac x=\"(c, p)\" in image_eqI)\n apply simp\n apply (fastforce simp: pde_ref_def pde_ref_pages_def valid_pde_def obj_at_def\n a_type_def data_at_def\n split: pde.splits if_splits arch_kernel_obj.splits)\n apply (rule vs_lookupI)\n apply (fastforce simp: vs_asid_refs_def graph_of_def)\n apply (rule_tac y=\"([VSRef (ucast b) (Some AASIDPool), VSRef (ucast a) None], p\\<^sub>2)\" in rtrancl_trans)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (fastforce simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def)\n apply (rule_tac y=\"([VSRef (ucast c) (Some APageDirectory), VSRef (ucast b) (Some AASIDPool),\n VSRef (ucast a) None], (ptrFromPAddr addr))\" in rtrancl_trans)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def)\n apply (rule_tac x=\"(c,(ptrFromPAddr addr))\" in image_eqI)\n apply simp\n apply (clarsimp simp: pde_ref_def)\n apply (rule rtrancl_into_rtrancl[OF rtrancl.intros(1)])\n apply (auto simp: data_at_def vs_lookup1_def obj_at_def vs_refs_def graph_of_def\n pte_ref_pages_def a_type_def\n split: pte.splits if_splits arch_kernel_obj.splits)\n done\n\nlemma vs_lookup_vs_lookup_pagesI:\n \"\\(r \\ p) s; (r' \\ p) s; valid_vspace_objs s; valid_asid_table (arm_asid_table (arch_state s)) s\\\n \\ (r' \\ p) s\"\n by (erule (5) vs_lookup_vs_lookup_pagesI'[OF _ vs_lookup_typI])\n\n(* FIXME: move *)\nlemma valid_cap_to_pd_cap:\n \"\\valid_cap c s; obj_refs c = {p}; page_directory_at p s\\ \\ is_pd_cap c\"\n by (clarsimp simp: valid_cap_def obj_at_def is_obj_defs is_pd_cap_def\n split: cap.splits option.splits arch_cap.splits if_splits)\n\nlemma store_pde_map_invs:\n \"\\(\\s. wellformed_pde pde) and invs and empty_pde_at p and valid_pde pde\n and (\\s. \\p. pde_ref pde = Some p \\ (\\ao. ko_at (ArchObj ao) p s \\ valid_vspace_obj ao s))\n and K (VSRef (p && mask pd_bits >> 2) (Some APageDirectory)\n \\ kernel_vsrefs)\n and (\\s. \\r. (r \\ (p && (~~ mask pd_bits))) s \\\n (\\p'. pde_ref_pages pde = Some p' \\\n (\\p'' cap. caps_of_state s p'' = Some cap \\ p' \\ obj_refs cap\n \\ vs_cap_ref cap = Some (VSRef (p && mask pd_bits >> 2) (Some APageDirectory) # r))\n \\ (\\p''' a b. pde = PageTablePDE p''' a b \\\n (\\pt. ko_at (ArchObj (PageTable pt)) (ptrFromPAddr p''') s \\\n (\\x word. pte_ref_pages (pt x) = Some word \\\n (\\p'' cap. caps_of_state s p'' = Some cap \\ word \\ obj_refs cap\n \\ vs_cap_ref cap =\n Some (VSRef (ucast x) (Some APageTable)\n # VSRef (p && mask pd_bits >> 2) (Some APageDirectory)\n # r)))))))\\\n store_pde p pde \\\\_. invs\\\"\n apply (simp add: store_pde_def)\n apply (wp dmo_invs set_pd_invs_map)\n apply clarsimp\n apply (rule conjI)\n apply (drule invs_valid_objs)\n apply (fastforce simp: valid_objs_def dom_def obj_at_def valid_obj_def)\n apply (rule conjI)\n apply (clarsimp simp: empty_pde_at_def)\n apply (clarsimp simp: obj_at_def)\n apply (rule vs_refs_add_one)\n subgoal by (simp add: pde_ref_def)\n subgoal by (simp add: kernel_vsrefs_kernel_mapping_slots)\n apply (rule conjI)\n apply (clarsimp simp: empty_pde_at_def)\n apply (clarsimp simp: obj_at_def)\n apply (rule vs_refs_pages_add_one')\n subgoal by (simp add: kernel_vsrefs_kernel_mapping_slots)\n apply (rule conjI)\n apply (clarsimp simp: obj_at_def kernel_vsrefs_kernel_mapping_slots)\n apply (rule conjI)\n subgoal by (clarsimp simp: obj_at_def)\n apply (rule conjI)\n apply clarsimp\n subgoal by (case_tac pde, simp_all add: pde_ref_def)\n apply (rule conjI)\n apply (clarsimp simp: kernel_vsrefs_def\n ucast_ucast_mask_shift_helper)\n apply (drule pde_ref_pde_ref_pagesI)\n apply clarsimp\n apply (drule valid_global_refsD2, clarsimp)\n apply (simp add: cap_range_def global_refs_def)\n apply blast\n apply (rule conjI)\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], clarsimp+)\n apply (rule_tac x=a in exI, rule_tac x=b in exI, rule_tac x=cap in exI)\n apply (clarsimp dest!: obj_ref_elemD)\n apply (frule caps_of_state_valid_cap, clarsimp)\n apply (drule (1) valid_cap_to_pd_cap, simp add: obj_at_def a_type_simps)\n apply (thin_tac \" \\p. Q p \\ P p\" for Q P)+\n subgoal by (simp add: is_pd_cap_def vs_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (frule (2) ref_is_unique[OF _ vs_lookup_vs_lookup_pagesI])\n apply ((clarsimp simp: invs_def valid_state_def valid_arch_caps_def\n valid_arch_state_def)+)[2]\n apply (auto dest!: valid_global_ptsD [simplified second_level_tables_def] simp: obj_at_def )[1]\n apply clarsimp+\n apply (rule valid_objs_caps)\n apply clarsimp\n apply (simp add: ucast_ucast_mask mask_shift_mask_helper)\n apply auto[1]\n apply clarsimp\n apply (frule (1) valid_vspace_objsD, fastforce)\n apply clarsimp\n apply (drule pde_ref_pde_ref_pagesI)\n apply clarsimp\n apply (simp add: ucast_ucast_mask mask_shift_mask_helper)\n apply (clarsimp simp: pde_ref_pages_def obj_at_def\n split: pde.splits)\n apply (erule_tac x=d in allE, erule_tac x=q' in allE)\n apply (frule (2) ref_is_unique[OF _ vs_lookup_vs_lookup_pagesI])\n apply ((clarsimp simp: invs_def valid_state_def valid_arch_caps_def\n valid_arch_state_def)+)[2]\n apply (auto dest!: valid_global_ptsD[simplified second_level_tables_def] simp: obj_at_def )[1]\n apply (clarsimp simp: data_at_def)+\n apply (rule valid_objs_caps)\n apply ((clarsimp elim!: impE)+)[2]\n apply (auto simp add: ucast_ucast_mask mask_shift_mask_helper\n data_at_def obj_at_def)\n done\n\nlemma set_cap_empty_pde:\n \"\\empty_pde_at p and cte_at p'\\ set_cap cap p' \\\\_. empty_pde_at p\\\"\n apply (simp add: empty_pde_at_def)\n apply (rule hoare_pre)\n apply (wp set_cap_obj_at_other hoare_vcg_ex_lift)\n apply clarsimp\n apply (rule exI, rule conjI, assumption)\n apply (erule conjI)\n apply (clarsimp simp: cte_wp_at_cases obj_at_def)\n done\n\nlemma valid_cap_obj_ref_pt_pd:\n \"\\ s \\ cap; s \\ cap'; obj_refs cap = obj_refs cap' \\\n \\ (is_pt_cap cap \\ is_pt_cap cap')\n \\ (is_pd_cap cap \\ is_pd_cap cap')\"\n by (auto simp: is_cap_simps valid_cap_def\n obj_at_def is_ep is_ntfn is_cap_table\n is_tcb a_type_def\n split: cap.split_asm if_split_asm\n arch_cap.split_asm option.split_asm)\n\n\n\nlemma is_pt_pd_cap_asid_None_table_ref:\n \"is_pt_cap cap \\ is_pd_cap cap\n \\ ((table_cap_ref cap = None) = (cap_asid cap = None))\"\n by (auto simp: is_cap_simps table_cap_ref_def cap_asid_def\n split: option.split_asm)\n\nlemma no_cap_to_obj_with_diff_ref_map:\n \"\\ caps_of_state s p = Some cap; is_pt_cap cap \\ is_pd_cap cap;\n table_cap_ref cap = None;\n unique_table_caps (caps_of_state s);\n valid_objs s; obj_refs cap = obj_refs cap' \\\n \\ no_cap_to_obj_with_diff_ref cap' {p} s\"\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (frule(1) caps_of_state_valid_cap[where p=p])\n apply (frule(1) caps_of_state_valid_cap[where p=\"(a, b)\" for a b])\n apply (drule(1) valid_cap_obj_ref_pt_pd, simp)\n apply (drule(1) unique_table_capsD[rotated, where cps=\"caps_of_state s\"])\n apply simp\n apply (simp add: is_pt_pd_cap_asid_None_table_ref)\n apply fastforce\n apply assumption\n apply simp\n done\n\n\nlemmas store_pte_cte_wp_at1[wp]\n = hoare_cte_wp_caps_of_state_lift [OF store_pte_caps_of_state]\n\nlemma mdb_cte_at_store_pte[wp]:\n \"\\\\s. mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s)\\\n store_pte y pte\n \\\\r s. mdb_cte_at (swp (cte_wp_at ((\\) cap.NullCap)) s) (cdt s)\\\"\n apply (clarsimp simp:mdb_cte_at_def)\n apply (simp only: imp_conv_disj)\n apply (wp hoare_vcg_disj_lift hoare_vcg_all_lift)\n apply (simp add:store_pte_def set_pt_def)\n apply wp\n apply (wp|simp)+\ndone\n\nlemma valid_idle_store_pte[wp]:\n \"\\valid_idle\\ store_pte y pte \\\\rv. valid_idle\\\"\n apply (simp add: store_pte_def set_pt_def)\n including unfold_objects\n apply (wpsimp wp: set_pt_valid_idle)\n done\n\nlemma mapM_swp_store_pte_invs[wp]:\n \"\\invs and (\\s. (\\p\\set slots. (\\\\ (p && ~~ mask pt_bits)) s) \\\n valid_pte pte s) and\n (\\s. wellformed_pte pte) and\n (\\s. \\slot. cte_wp_at\n (\\c. image (\\x. x && ~~ mask pt_bits) (set slots) \\ obj_refs c \\\n is_pt_cap c \\ (pte = InvalidPTE \\\n cap_asid c \\ None)) slot s) and\n (\\s. \\p\\set slots. \\ref. (ref \\ (p && ~~ mask pt_bits)) s \\\n (\\q. pte_ref_pages pte = Some q \\\n (\\p' cap.\n caps_of_state s p' = Some cap \\\n q \\ obj_refs cap \\\n vs_cap_ref cap =\n Some\n (VSRef (p && mask pt_bits >> 2) (Some APageTable) #\n ref))))\\\n mapM (swp store_pte pte) slots \\\\_. invs\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule mapM_wp')\n apply simp_all\n apply (wp mapM_wp' hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_ball_lift\n hoare_vcg_all_lift hoare_vcg_imp_lift)\n apply clarsimp\n apply (fastforce simp: cte_wp_at_caps_of_state is_pt_cap_def cap_asid_def)\n done\n\nlemmas store_pde_cte_wp_at1[wp]\n = hoare_cte_wp_caps_of_state_lift [OF store_pde_caps_of_state]\n\ncrunch global_refs_inv[wp]: store_pde \"\\s. P (global_refs s)\"\n (wp: get_object_wp) (* added by sjw, something dropped out of some set :( *)\n\nlemma mapM_swp_store_pde_invs_unmap:\n \"\\invs and\n (\\s. \\sl\\set slots.\n ucast (sl && mask pd_bits >> 2) \\ kernel_mapping_slots) and\n (\\s. \\sl\\set slots. sl && ~~ mask pd_bits \\ global_refs s) and\n K (pde = InvalidPDE)\\\n mapM (swp store_pde pde) slots \\\\_. invs\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule mapM_wp')\n apply simp\n apply (rule hoare_pre, wp store_pde_invs_unmap hoare_vcg_const_Ball_lift\n hoare_vcg_ex_lift)\n apply clarsimp+\n done\n\nlemma vs_refs_pdI3:\n \"\\pde_ref (pd x) = Some p; x \\ kernel_mapping_slots\\\n \\ (VSRef (ucast x) (Some APageDirectory), p) \\ vs_refs (ArchObj (PageDirectory pd))\"\n by (auto simp: pde_ref_def vs_refs_def graph_of_def)\n\n\nlemma set_pd_invs_unmap':\n \"\\invs and (\\s. \\i. wellformed_pde (pd i)) and\n (\\s. (\\\\p) s \\ valid_vspace_obj (PageDirectory pd) s) and\n obj_at (\\ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T) p and\n obj_at (\\ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \\ S') p and\n obj_at (\\ko. \\pd'. ko = ArchObj (PageDirectory pd')\n \\ (\\x \\ kernel_mapping_slots. pd x = pd' x)) p and\n (\\s. p \\ global_refs s) and\n (\\s. \\a b cap. caps_of_state s (a, b) = Some cap \\\n is_pd_cap cap \\\n p \\ obj_refs cap \\ (\\y. cap_asid cap = Some y)) and\n (\\s. \\(a,b)\\S'. (\\ref.\n (ref \\ p) s \\\n (\\p' cap.\n caps_of_state s p' = Some cap \\\n b \\ obj_refs cap \\ vs_cap_ref cap = Some (a # ref))))\\\n set_pd p pd\n \\\\_. invs\\\"\n apply (simp add: invs_def valid_state_def valid_pspace_def valid_arch_caps_def)\n apply (rule hoare_pre)\n apply (wp set_pd_valid_objs set_pd_iflive set_pd_zombies\n set_pd_zombies_state_refs set_pd_valid_mdb\n set_pd_zombies_state_hyp_refs\n set_pd_valid_idle set_pd_ifunsafe set_pd_reply_caps\n set_pd_valid_arch set_pd_valid_global set_pd_cur\n set_pd_reply_masters valid_irq_node_typ\n set_pd_vspace_objs_unmap set_pd_valid_vs_lookup_map[where T=T and S=\"{}\" and T'=T' and S'=S']\n valid_irq_handlers_lift\n set_pd_unmap_mappings set_pd_equal_kernel_mappings_triv)\n apply (clarsimp simp: cte_wp_at_caps_of_state valid_arch_caps_def valid_objs_caps obj_at_def\n del: disjCI)\n apply (rule conjI, clarsimp)\n apply (erule_tac x=\"(VSRef (ucast c) (Some APageDirectory), q)\" in ballE)\n apply clarsimp\n apply (frule (1) vs_refs_pages_pdI)\n apply (clarsimp simp: valid_arch_caps_def)\n apply (drule_tac p'=q and ref'=\"VSRef (ucast c) (Some APageDirectory) # r\" in vs_lookup_pages_step)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (drule (1) valid_vs_lookupD)\n apply (clarsimp)\n apply (rule conjI)\n apply clarsimp\n apply (drule (1) vs_refs_pdI3)\n apply clarsimp\n apply (drule_tac p'=q and ref'=\"VSRef (ucast c) (Some APageDirectory) # r\" in vs_lookup_pages_step)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (erule subsetD[OF vs_refs_pages_subset])\n apply (drule_tac p'=q' and ref'=\"VSRef (ucast d) (Some APageTable) # VSRef (ucast c) (Some APageDirectory) # r\"\n in vs_lookup_pages_step)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def)\n apply (erule pte_ref_pagesD)\n apply (drule (1) valid_vs_lookupD)\n apply clarsimp\n apply auto\n done\n\nlemma same_refs_lD:\n \"\\same_refs (Inl(pte,p # slots)) cap s\\\n \\ (\\p. pte_ref_pages pte = Some p \\ p \\ obj_refs cap) \\\n (\\ref. (ref \\ (p && ~~ mask pt_bits)) s \\\n vs_cap_ref cap = Some (VSRef (p && mask pt_bits >> 2) (Some APageTable) # ref))\"\n by (clarsimp simp:same_refs_def split:list.splits)\n\nlemma same_refs_rD:\n \"\\same_refs (Inr(pde,p # slots)) cap s\\\n \\ (\\p. pde_ref_pages pde = Some p \\ p \\ obj_refs cap) \\\n (\\ref. (ref \\ (p && ~~ mask pd_bits)) s \\\n vs_cap_ref cap =\n Some (VSRef (p && mask pd_bits >> 2) (Some APageDirectory) # ref))\"\n by (clarsimp simp:same_refs_def split:list.splits)\n\nlemma store_pde_invs_unmap':\n \"\\invs\n and (\\\\ (p && ~~ mask pd_bits))\n and (\\s. \\slot. cte_wp_at (parent_for_refs (Inr (pde, slots))) slot s)\n and (\\s. \\ptr cap. caps_of_state s ptr = Some cap\n \\ is_pg_cap cap\n \\ same_refs (Inr (pde, slots)) cap s)\n and valid_pde pde\n and (\\s. p && ~~ mask pd_bits \\ global_refs s)\n and K (wellformed_pde pde \\ pde_ref pde = None)\n and K (ucast (p && mask pd_bits >> 2) \\ kernel_mapping_slots\n \\ (\\xs. slots = p # xs) )\n and (\\s. \\pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s)\\\n store_pde p pde\n \\\\_. invs\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: store_pde_def | wp)+\n apply (rule_tac T =\" Pair (VSRef (p && mask pd_bits >> 2) (Some APageDirectory))\n ` set_option (pde_ref (pd (ucast (p && mask pd_bits >> 2))))\"\n and T'=\" Pair (VSRef (p && mask pd_bits >> 2) (Some APageDirectory))\n ` set_option (pde_ref_pages (pd (ucast (p && mask pd_bits >> 2))))\"\n and S'=\" Pair (VSRef (p && mask pd_bits >> 2) (Some APageDirectory))\n ` set_option (pde_ref_pages pde)\" in set_pd_invs_unmap')\n apply wp\n apply (clarsimp simp: obj_at_def)\n apply (rule conjI)\n apply (clarsimp simp add: invs_def valid_state_def valid_pspace_def\n valid_objs_def valid_obj_def dom_def)\n apply (erule_tac P=\"\\x. (\\y. a y x) \\ b x\" for a b in allE[where x=\"(p && ~~ mask pd_bits)\"])\n apply (erule impE)\n apply (clarsimp simp: obj_at_def vs_refs_def)+\n\n apply (rule conjI)\n apply (clarsimp simp add: invs_def valid_state_def valid_vspace_objs_def)\n apply (erule_tac P=\"\\x. (\\y. a y x) \\ b x\" for a b in allE[where x=\"(p && ~~ mask pd_bits)\"])\n apply (erule impE)\n apply (erule_tac x=ref in exI)\n apply (erule_tac x=\"PageDirectory pd\" in allE)\n apply (clarsimp simp: obj_at_def)\n\n apply (rule conjI)\n apply (safe)[1]\n apply (clarsimp simp add: vs_refs_def graph_of_def split: if_split_asm)\n apply (rule pair_imageI)\n apply (clarsimp)\n apply (clarsimp simp: vs_refs_def graph_of_def split: if_split_asm)\n apply (subst (asm) ucast_ucast_mask_shift_helper[symmetric], simp)\n apply (clarsimp simp: vs_refs_def graph_of_def split: if_split_asm)\n apply (rule_tac x=\"(ac, bc)\" in image_eqI)\n apply clarsimp\n apply (clarsimp simp: ucast_ucast_mask_shift_helper)\n\n apply (rule conjI)\n apply safe[1]\n apply (clarsimp simp: vs_refs_pages_def graph_of_def\n ucast_ucast_mask_shift_helper\n split: if_split_asm)\n apply (rule_tac x=\"(ac, bc)\" in image_eqI)\n apply clarsimp\n apply clarsimp\n apply (clarsimp simp: vs_refs_pages_def graph_of_def ucast_ucast_id\n split: if_split_asm)\n apply (clarsimp simp: vs_refs_pages_def graph_of_def\n split: if_split_asm)\n apply (rule_tac x=\"(ac,bc)\" in image_eqI)\n apply clarsimp\n apply (clarsimp simp: ucast_ucast_mask_shift_helper)\n apply (clarsimp simp: vs_refs_pages_def graph_of_def)\n apply (rule_tac x=\"(ucast (p && mask pd_bits >> 2), x)\" in image_eqI)\n apply (clarsimp simp: ucast_ucast_mask_shift_helper)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def)\n apply (drule same_refs_rD)\n apply (clarsimp split: list.splits)\n apply blast\n apply (drule same_refs_rD)\n apply clarsimp\n apply (drule spec, drule (2) mp[OF _ vs_lookup_vs_lookup_pagesI])\n apply ((clarsimp simp: invs_def valid_state_def valid_arch_state_def)+)[2]\n apply (rule_tac x=aa in exI, rule_tac x=ba in exI, rule_tac x=cap in exI)\n apply clarsimp\n done\n\nlemma update_self_reachable:\n \"\\(ref \\ p) s; valid_asid_table (arm_asid_table (arch_state s)) s;\n valid_vspace_objs s\\\n \\ (ref \\ p) (s \\kheap := \\a. if a = p then Some y else kheap s a\\)\"\n apply (erule (2) vs_lookupE_alt[OF _ _ valid_asid_table_ran])\n apply (rule vs_lookup_atI, clarsimp)\n apply (rule_tac ap=ap in vs_lookup_apI, auto simp: obj_at_def)[1]\n apply (clarsimp simp: pde_ref_def split: pde.splits)\n apply (rule_tac ap=ap and pd=pd in vs_lookup_pdI, auto simp: obj_at_def)[1]\n done\n\nlemma update_self_reachable_pages:\n \"\\(ref \\ p) s; valid_asid_table (arm_asid_table (arch_state s)) s;\n valid_vspace_objs s\\\n \\ (ref \\ p) (s \\kheap := \\a. if a = p then Some y else kheap s a\\)\"\n apply (erule (2) vs_lookup_pagesE_alt[OF _ _ valid_asid_table_ran])\n apply (rule vs_lookup_pages_atI, clarsimp)\n apply (rule_tac ap=ap in vs_lookup_pages_apI, auto simp: obj_at_def)[1]\n apply (rule_tac ap=ap and pd=pd in vs_lookup_pages_pdI,\n auto simp: obj_at_def pde_ref_pages_def data_at_def\n split: pde.splits)[1]\n apply (rule_tac ap=ap and pd=pd in vs_lookup_pages_ptI,\n auto simp: obj_at_def pde_ref_pages_def pte_ref_pages_def data_at_def\n split: pde.splits pte.splits)[1]\n done\n\n\nlemma pd_slots_helper:\n \"\\a \\ set slots; b \\ set slots;\n cte_wp_at (parent_for_refs (Inr (pde, slots))) cptr s\\\n \\ a && ~~ mask pd_bits = b && ~~ mask pd_bits\"\n apply (clarsimp simp add: cte_wp_at_def parent_for_refs_def)\n apply (drule imageI[where f=\"\\x. x && ~~ mask pd_bits\"])\n apply (drule imageI[where f=\"\\x. x && ~~ mask pd_bits\"])\n apply (simp add: obj_refs_def)\n apply (case_tac cap, simp+)\n apply (rename_tac arch_cap)\n apply (case_tac arch_cap, simp+)\n apply (drule (1) set_rev_mp)\n apply (drule (1) set_rev_mp)\n apply force\n apply (drule (1) set_rev_mp)\n apply (drule (1) set_rev_mp)\n apply force\n apply (drule (1) set_rev_mp)\n apply (drule (1) set_rev_mp)\n apply force\n done\n\n(* FIXME: move *)\nlemma simpler_store_pde_def:\n \"store_pde p pde s =\n (case kheap s (p && ~~ mask pd_bits) of\n Some (ArchObj (PageDirectory pd)) =>\n ({((), s\\kheap := (kheap s((p && ~~ mask pd_bits) \\\n (ArchObj (PageDirectory (pd(ucast (p && mask pd_bits >> 2) := pde))))))\\)}, False)\n | _ => ({}, True))\"\n by (auto simp: store_pde_def simpler_set_pd_def get_object_def simpler_gets_def assert_def\n return_def fail_def set_object_def get_def put_def bind_def get_pd_def\n split: Structures_A.kernel_object.splits option.splits arch_kernel_obj.splits if_split_asm)\n\nlemma pde_update_valid_vspace_objs:\n \"[|valid_vspace_objs s; valid_pde pde s; pde_ref pde = None; kheap s (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))|]\n ==> valid_vspace_objs\n (s\\kheap := kheap s(p && ~~ mask pd_bits \\ ArchObj (PageDirectory (pd(ucast (p && mask pd_bits >> 2) := pde))))\\)\"\n apply (cut_tac pde=pde and p=p in store_pde_vspace_objs_unmap)\n apply (clarsimp simp: valid_def)\n apply (erule allE[where x=s])\n apply (clarsimp simp: split_def simpler_store_pde_def obj_at_def a_type_def\n split: if_split_asm option.splits Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n done\n\nlemma mapM_x_swp_store_pte_invs [wp]:\n \"\\invs and (\\s. (\\p\\set slots. (\\\\ (p && ~~ mask pt_bits)) s) \\\n valid_pte pte s) and\n (\\s. wellformed_pte pte) and\n (\\s. \\slot. cte_wp_at\n (\\c. image (\\x. x && ~~ mask pt_bits) (set slots) \\ obj_refs c \\\n is_pt_cap c \\ (pte = InvalidPTE \\\n cap_asid c \\ None)) slot s) and\n (\\s. \\p\\set slots. \\ref. (ref \\ (p && ~~ mask pt_bits)) s \\\n (\\q. pte_ref_pages pte = Some q \\\n (\\p' cap.\n caps_of_state s p' = Some cap \\\n q \\ obj_refs cap \\\n vs_cap_ref cap =\n Some\n (VSRef (p && mask pt_bits >> 2) (Some APageTable) #\n ref))))\\\n mapM_x (swp store_pte pte) slots \\\\_. invs\\\"\n by (simp add: mapM_x_mapM | wp)+\n\nlemma mapM_x_swp_store_pde_invs_unmap:\n \"\\invs and K (\\sl\\set slots.\n ucast (sl && mask pd_bits >> 2) \\ kernel_mapping_slots) and\n (\\s. \\sl \\ set slots. sl && ~~ mask pd_bits \\ global_refs s) and\n K (pde = InvalidPDE)\\\n mapM_x (swp store_pde pde) slots \\\\_. invs\\\"\n by (simp add: mapM_x_mapM | wp mapM_swp_store_pde_invs_unmap)+\n\n(* FIXME: move *)\nlemma vs_cap_ref_table_cap_ref_None:\n \"vs_cap_ref x = None \\ table_cap_ref x = None\"\n by (simp add: vs_cap_ref_def table_cap_ref_simps\n split: cap.splits arch_cap.splits)\n\n(* FIXME: move *)\nlemma master_cap_eq_is_pg_cap_eq:\n \"cap_master_cap c = cap_master_cap d \\ is_pg_cap c = is_pg_cap d\"\n by (simp add: cap_master_cap_def is_pg_cap_def\n split: cap.splits arch_cap.splits)\n\n(* FIXME: move *)\nlemma master_cap_eq_is_device_cap_eq:\n \"cap_master_cap c = cap_master_cap d \\ cap_is_device c = cap_is_device d\"\n by (simp add: cap_master_cap_def\n split: cap.splits arch_cap.splits)\n\n(* FIXME: move *)\nlemmas vs_cap_ref_eq_imp_table_cap_ref_eq' =\n vs_cap_ref_eq_imp_table_cap_ref_eq[OF master_cap_eq_is_pg_cap_eq]\n\nlemma arch_update_cap_invs_map:\n \"\\cte_wp_at (is_arch_update cap and\n (\\c. \\r. vs_cap_ref c = Some r \\ vs_cap_ref cap = Some r)) p\n and invs and valid_cap cap\\\n set_cap cap p\n \\\\rv. invs\\\"\n apply (simp add: invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp arch_update_cap_pspace arch_update_cap_valid_mdb set_cap_idle\n update_cap_ifunsafe valid_irq_node_typ set_cap_typ_at\n set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_cap_refs_respects_device_region_spec[where ptr = p])\n apply (clarsimp simp: cte_wp_at_caps_of_state\n simp del: imp_disjL)\n apply (frule(1) valid_global_refsD2)\n apply (frule(1) cap_refs_in_kernel_windowD)\n apply (clarsimp simp: is_cap_simps is_arch_update_def\n simp del: imp_disjL)\n apply (frule master_cap_cap_range, simp del: imp_disjL)\n apply (thin_tac \"cap_range a = cap_range b\" for a b)\n apply (rule conjI)\n apply (fastforce simp:is_valid_vtable_root_def vs_cap_ref_def split:arch_cap.splits vmpage_size.splits option.splits)\n apply (rule conjI)\n apply (rule ext)\n apply (simp add: cap_master_cap_def split: cap.splits arch_cap.splits)\n apply (rule context_conjI)\n apply (simp add: appropriate_cte_cap_irqs)\n apply (clarsimp simp: cap_irqs_def cap_irq_opt_def cap_master_cap_def\n split: cap.split)\n apply (rule conjI)\n apply (drule(1) if_unsafe_then_capD [OF caps_of_state_cteD])\n apply (clarsimp simp: cap_master_cap_def)\n apply (erule ex_cte_cap_wp_to_weakenE)\n apply (clarsimp simp: appropriate_cte_cap_def cap_master_cap_def\n split: cap.split_asm)\n apply (rule conjI)\n apply (frule master_cap_obj_refs)\n apply simp\n apply (rule conjI)\n apply (frule master_cap_obj_refs)\n apply (case_tac \"table_cap_ref capa =\n table_cap_ref (ArchObjectCap a)\")\n apply (frule unique_table_refs_no_cap_asidE[where S=\"{p}\"])\n apply (simp add: valid_arch_caps_def)\n apply (simp add: no_cap_to_obj_with_diff_ref_def Ball_def)\n apply (case_tac \"table_cap_ref capa\")\n apply clarsimp\n apply (erule no_cap_to_obj_with_diff_ref_map,\n simp_all)[1]\n apply (clarsimp simp: table_cap_ref_def cap_master_cap_simps\n is_cap_simps\n split: cap.split_asm arch_cap.split_asm\n dest!: cap_master_cap_eqDs)\n apply (simp add: valid_arch_caps_def)\n apply (simp add: valid_pspace_def)\n apply (erule swap)\n apply (erule vs_cap_ref_eq_imp_table_cap_ref_eq'[symmetric])\n apply (frule table_cap_ref_vs_cap_ref_Some)\n apply simp\n apply (rule conjI)\n apply (clarsimp simp del: imp_disjL)\n apply (erule disjE)\n apply (clarsimp simp: is_pt_cap_def cap_master_cap_simps\n cap_asid_def vs_cap_ref_def\n dest!: cap_master_cap_eqDs split: option.split_asm prod.split_asm)\n apply (drule valid_table_capsD[OF caps_of_state_cteD])\n apply (clarsimp simp: invs_def valid_state_def valid_arch_caps_def)\n apply (simp add: is_pt_cap_def)\n apply (simp add: cap_asid_def)\n apply simp\n apply (clarsimp simp: is_cap_simps cap_master_cap_simps\n cap_asid_def vs_cap_ref_def\n dest!: cap_master_cap_eqDs split: option.split_asm prod.split_asm)\n apply (drule valid_table_capsD[OF caps_of_state_cteD])\n apply (clarsimp simp: invs_def valid_state_def valid_arch_caps_def)\n apply (simp add: is_cap_simps)\n apply (simp add: cap_asid_def)\n apply simp\n apply (clarsimp simp: is_cap_simps is_pt_cap_def cap_master_cap_simps\n cap_asid_def vs_cap_ref_def ranI\n dest!: cap_master_cap_eqDs split: option.split_asm if_split_asm\n elim!: ranE cong: master_cap_eq_is_device_cap_eq\n | rule conjI)+\n apply (clarsimp dest!: master_cap_eq_is_device_cap_eq)\n\n done\n\n (* Want something like\n cte_wp_at (\\c. \\p'\\obj_refs c. \\(vs_cap_ref c \\ p') s \\ is_arch_update cap c) p\n So that we know the new cap isn't clobbering a cap with necessary mapping info.\n invs is fine here (I suspect) because we unmap the page BEFORE we replace the cap.\n *)\n\nlemma arch_update_cap_invs_unmap_page:\n \"\\(\\s. cte_wp_at (\\c. (\\p'\\obj_refs c. \\ref. vs_cap_ref c = Some ref \\ \\ (ref \\ p') s) \\ is_arch_update cap c) p s)\n and invs and valid_cap cap\n and K (is_pg_cap cap)\\\n set_cap cap p\n \\\\rv. invs\\\"\n apply (simp add: invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp arch_update_cap_pspace arch_update_cap_valid_mdb set_cap_idle\n update_cap_ifunsafe valid_irq_node_typ set_cap_typ_at\n set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_cap_refs_respects_device_region_spec[where ptr = p])\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state is_arch_update_def\n is_cap_simps cap_master_cap_simps\n fun_eq_iff appropriate_cte_cap_irqs\n is_pt_cap_def is_valid_vtable_root_def\n dest!: cap_master_cap_eqDs\n simp del: imp_disjL)\n apply (rule conjI)\n apply (drule(1) if_unsafe_then_capD [OF caps_of_state_cteD])\n apply (clarsimp simp: cap_master_cap_def)\n apply (erule ex_cte_cap_wp_to_weakenE)\n apply (clarsimp simp: appropriate_cte_cap_def)\n apply (rule conjI)\n apply (drule valid_global_refsD2, clarsimp)\n subgoal by (simp add: cap_range_def)\n apply (rule conjI[rotated])\n apply (frule(1) cap_refs_in_kernel_windowD)\n apply (simp add: cap_range_def)\n apply (drule unique_table_refs_no_cap_asidE[where S=\"{p}\"])\n apply (simp add: valid_arch_caps_def)\n apply (simp add: no_cap_to_obj_with_diff_ref_def table_cap_ref_def Ball_def)\n done\n\nlemma arch_update_cap_invs_unmap_page_table:\n \"\\cte_wp_at (is_arch_update cap) p\n and invs and valid_cap cap\n and (\\s. cte_wp_at (\\c. is_final_cap' c s) p s)\n and obj_at (empty_table {}) (obj_ref_of cap)\n and (\\s. cte_wp_at (\\c. \\r. vs_cap_ref c = Some r\n \\ \\ (r \\ obj_ref_of cap) s) p s)\n and K (is_pt_cap cap \\ vs_cap_ref cap = None)\\\n set_cap cap p\n \\\\rv. invs\\\"\n apply (simp add: invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp arch_update_cap_pspace arch_update_cap_valid_mdb set_cap_idle\n update_cap_ifunsafe valid_irq_node_typ set_cap_typ_at\n set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_cap_refs_respects_device_region_spec[where ptr = p])\n apply (simp add: final_cap_at_eq)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_arch_update_def\n is_cap_simps cap_master_cap_simps is_valid_vtable_root_def\n appropriate_cte_cap_irqs is_pt_cap_def\n fun_eq_iff[where f=\"cte_refs cap\" for cap]\n dest!: cap_master_cap_eqDs\n simp del: imp_disjL)\n apply (rule conjI)\n apply (drule(1) if_unsafe_then_capD [OF caps_of_state_cteD])\n apply (clarsimp simp: cap_master_cap_def)\n apply (erule ex_cte_cap_wp_to_weakenE)\n apply (clarsimp simp: appropriate_cte_cap_def)\n apply (rule conjI)\n apply (drule valid_global_refsD2, clarsimp)\n apply (simp add: cap_range_def)\n apply (frule(1) cap_refs_in_kernel_windowD)\n apply (simp add: cap_range_def gen_obj_refs_def image_def)\n apply (intro conjI)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply fastforce\n apply (clarsimp simp: obj_at_def empty_table_def)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply clarsimp\n apply fastforce\n done\n\nlemma set_vm_root_for_flush_invs:\n \"\\invs and K (asid \\ mask asid_bits)\\\n set_vm_root_for_flush pd asid \\\\_. invs\\\"\n apply (simp add: set_vm_root_for_flush_def)\n apply (wp hoare_drop_imps hoare_vcg_all_lift |wpc|simp)+\n done\n\nlemma flush_table_invs[wp]:\n \"\\invs and K (asid \\ mask asid_bits)\\\n flush_table pd asid vptr pt \\\\rv. invs\\\"\n apply (simp add: flush_table_def)\n apply (wp dmo_invalidateLocalTLB_ASID_invs | simp)+\n apply (simp only: if_cancel\n | clarsimp simp: machine_op_lift_def\n machine_rest_lift_def split_def\n | wp set_vm_root_for_flush_invs)+\n done\n\ncrunch vs_lookup[wp]: flush_table \"\\s. P (vs_lookup s)\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch cte_wp_at[wp]: flush_table \"\\s. P (cte_wp_at P' p s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma global_refs_arch_update_eq:\n \"\\ arm_globals_frame (f (arch_state s)) = arm_globals_frame (arch_state s);\n arm_global_pd (f (arch_state s)) = arm_global_pd (arch_state s);\n arm_global_pts (f (arch_state s)) = arm_global_pts (arch_state s) \\\n \\ global_refs (arch_state_update f s) = global_refs s\"\n by (simp add: global_refs_def)\n\ncrunch global_refs_inv[wp]: flush_table \"\\s. P (global_refs s)\"\n (wp: crunch_wps simp: crunch_simps global_refs_arch_update_eq)\n\nlemma lookup_pd_slot_kernel_mappings_strg:\n \"is_aligned pd pd_bits \\ vptr < kernel_base\n \\ vmsz_aligned vptr ARMSection\n \\ ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2) \\ kernel_mapping_slots\"\n by (simp add: less_kernel_base_mapping_slots)\n\nlemma not_in_global_refs_vs_lookup:\n \"(\\\\ p) s \\ valid_vs_lookup s \\ valid_global_refs s\n \\ valid_arch_state s \\ valid_global_objs s\n \\ page_directory_at p s\n \\ p \\ global_refs s\"\n apply (clarsimp dest!: valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI])\n apply (drule(1) valid_global_refsD2)\n apply (simp add: cap_range_def)\n apply blast\n done\n\nlemma cleanByVA_PoU_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\ cleanByVA_PoU w q \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: cleanByVA_PoU_def machine_op_lift_def machine_rest_lift_def split_def | wp)+\n\nlemma unmap_page_table_invs[wp]:\n \"\\invs and K (asid \\ mask asid_bits \\ vaddr < kernel_base\n \\ vmsz_aligned vaddr ARMSection)\\\n unmap_page_table asid vaddr pt\n \\\\rv. invs\\\"\n apply (simp add: unmap_page_table_def)\n apply (rule hoare_pre)\n apply (wp dmo_invs | wpc | simp)+\n apply (rule_tac Q=\"\\_. invs and K (asid \\ mask asid_bits)\" in hoare_post_imp)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p =\n underlying_memory m p\" in use_valid)\n apply ((wp | simp)+)[3]\n apply(erule use_valid, wp no_irq_cleanByVA_PoU no_irq, assumption)\n apply (wp store_pde_invs_unmap page_table_mapped_wp | wpc | simp)+\n apply (simp add: lookup_pd_slot_pd pde_ref_def)\n apply (strengthen lookup_pd_slot_kernel_mappings_strg\n not_in_global_refs_vs_lookup)\n apply (auto simp: vspace_at_asid_def)\n done\n\nlemma final_cap_lift:\n assumes x: \"\\P. \\\\s. P (caps_of_state s)\\ f \\\\rv s. P (caps_of_state s)\\\"\n shows \"\\\\s. P (is_final_cap' cap s)\\ f \\\\rv s. P (is_final_cap' cap s)\\\"\n by (simp add: is_final_cap'_def2 cte_wp_at_caps_of_state, rule x)\n\nlemmas dmo_final_cap[wp] = final_cap_lift [OF do_machine_op_caps_of_state]\nlemmas store_pte_final_cap[wp] = final_cap_lift [OF store_pte_caps_of_state]\nlemmas unmap_page_table_final_cap[wp] = final_cap_lift [OF unmap_page_table_caps_of_state]\n\nlemma mapM_x_swp_store_empty_table':\n \"\\obj_at (\\ko. \\pt. ko = ArchObj (PageTable pt)\n \\ (\\x. x \\ (\\sl. ucast ((sl && mask pt_bits) >> 2)) ` set slots\n \\ pt x = InvalidPTE)) p\n and K (is_aligned p pt_bits \\ (\\x \\ set slots. x && ~~ mask pt_bits = p))\\\n mapM_x (swp store_pte InvalidPTE) slots\n \\\\rv. obj_at (empty_table {}) p\\\"\n apply (rule hoare_gen_asm)\n apply (induct slots, simp_all add: mapM_x_Nil mapM_x_Cons)\n apply wp\n apply (clarsimp simp: obj_at_def empty_table_def fun_eq_iff)\n apply (rule hoare_seq_ext, assumption)\n apply (thin_tac \"\\P\\ f \\Q\\\" for P f Q)\n apply (simp add: store_pte_def set_pt_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply auto\n done\n\nlemma mapM_x_swp_store_empty_table:\n \"\\page_table_at p and pspace_aligned\n and K ((UNIV :: word8 set) \\ (\\sl. ucast ((sl && mask pt_bits) >> 2)) ` set slots\n \\ (\\x\\set slots. x && ~~ mask pt_bits = p))\\\n mapM_x (swp store_pte InvalidPTE) slots\n \\\\rv. obj_at (empty_table {}) p\\\"\n apply (wp mapM_x_swp_store_empty_table')\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm if_split_asm)\n apply (frule(1) pspace_alignedD)\n apply (clarsimp simp: pt_bits_def pageBits_def)\n apply blast\n done\n\nlemma pd_shifting_again:\n \"\\ is_aligned pd pd_bits \\\n \\ pd + (ucast (ae :: 12 word) << 2) && ~~ mask pd_bits = pd\"\n apply (erule add_mask_lower_bits)\n apply (clarsimp simp add: nth_shiftl nth_ucast word_size\n pd_bits_def pageBits_def\n dest!: test_bit_size)\n apply arith\n done\n\nlemma pd_shifting_again2:\n \"is_aligned (pd::word32) pd_bits \\\n pd + (ucast (ae::12 word) << 2) && mask pd_bits = (ucast ae << 2)\"\n apply (rule conjunct1, erule is_aligned_add_helper)\n apply (rule ucast_less_shiftl_helper)\n apply (simp add: word_bits_def)\n apply (simp add: pd_bits_def pageBits_def)\n done\n\n(* FIXME: move near Invariants_A.vs_lookup_2ConsD *)\nlemma vs_lookup_pages_2ConsD:\n \"((v # v' # vs) \\ p) s \\\n \\p'. ((v' # vs) \\ p') s \\ ((v' # vs, p') \\1 (v # v' # vs, p)) s\"\n apply (clarsimp simp: vs_lookup_pages_def)\n apply (erule rtranclE)\n apply (clarsimp simp: vs_asid_refs_def)\n apply (fastforce simp: vs_lookup_pages1_def)\n done\n\n(* FIXME: move to Invariants_A *)\nlemma vs_lookup_pages_eq_at:\n \"[VSRef a None] \\ pd = [VSRef a None] \\ pd\"\n apply (simp add: vs_lookup_pages_def vs_lookup_def Image_def)\n apply (rule ext)\n apply (rule iffI)\n apply (erule bexEI)\n apply (erule rtranclE, simp)\n apply (clarsimp simp: vs_refs_def graph_of_def image_def\n dest!: vs_lookup1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule bexEI)\n apply (erule rtranclE, simp)\n apply (clarsimp simp: vs_refs_pages_def graph_of_def image_def\n dest!: vs_lookup_pages1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n done\n\n(* FIXME: move to Invariants_A *)\nlemma vs_lookup_pages_eq_ap:\n \"[VSRef b (Some AASIDPool), VSRef a None] \\ pd =\n [VSRef b (Some AASIDPool), VSRef a None] \\ pd\"\n apply (simp add: vs_lookup_pages_def vs_lookup_def Image_def)\n apply (rule ext)\n apply (rule iffI)\n apply (erule bexEI)\n apply (erule rtranclE, simp)\n apply (clarsimp simp: vs_refs_def graph_of_def image_def\n dest!: vs_lookup1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule rtranclE)\n apply (clarsimp simp: vs_asid_refs_def graph_of_def image_def)\n apply (rule converse_rtrancl_into_rtrancl[OF _ rtrancl_refl])\n apply (fastforce simp: vs_refs_pages_def graph_of_def image_def\n vs_lookup_pages1_def)\n apply (clarsimp simp: vs_refs_def graph_of_def image_def\n dest!: vs_lookup1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule bexEI)\n apply (erule rtranclE, simp)\n apply (clarsimp simp: vs_refs_pages_def graph_of_def image_def\n dest!: vs_lookup_pages1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule rtranclE)\n apply (clarsimp simp: vs_asid_refs_def graph_of_def image_def)\n apply (rule converse_rtrancl_into_rtrancl[OF _ rtrancl_refl])\n apply (fastforce simp: vs_refs_def graph_of_def image_def\n vs_lookup1_def)\n apply (clarsimp simp: vs_refs_pages_def graph_of_def image_def\n dest!: vs_lookup_pages1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n done\n\nlemma store_pde_unmap_pt:\n \"\\[VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd\n and K (is_aligned pd pd_bits)\\\n store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE\n \\\\rv s.\n \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pt) s\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def fun_upd_def[symmetric])\n apply (clarsimp simp: vs_lookup_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def\n dest!: graph_ofD\n split: if_split_asm\n Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply (simp add: pde_ref_def)\n apply (simp_all add: pd_shifting_again pd_shifting_again2\n pd_casting_shifting word_size)\n apply (simp add: up_ucast_inj_eq)\n done\n\nlemma vs_lookup_pages1_rtrancl_iterations:\n \"(tup, tup') \\ (vs_lookup_pages1 s)\\<^sup>*\n \\ (length (fst tup) \\ length (fst tup')) \\\n (tup, tup') \\ ((vs_lookup_pages1 s)\n ^^ (length (fst tup') - length (fst tup)))\"\n apply (erule rtrancl_induct)\n apply simp\n apply (elim conjE)\n apply (subgoal_tac \"length (fst z) = Suc (length (fst y))\")\n apply (simp add: Suc_diff_le)\n apply (erule(1) relcompI)\n apply (clarsimp simp: vs_lookup_pages1_def)\n done\n\nlemma store_pde_unmap_page:\n \"\\[VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd\n and K (is_aligned pd pd_bits)\\\n store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE\n \\\\rv s.\n \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pde) s\\\"\n apply (simp add: store_pde_def vs_lookup_pages_eq_ap set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def fun_upd_def[symmetric])\n apply (clarsimp simp: vs_lookup_pages_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup_pages1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n dest!: graph_ofD\n split: if_split_asm\n Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply (simp add: pde_ref_pages_def)\n apply (simp_all add: pd_shifting_again pd_shifting_again2\n pd_casting_shifting word_size)\n apply (simp add: up_ucast_inj_eq)\n done\n\nlemma store_pte_no_lookup_pages:\n \"\\\\s. \\ (r \\ q) s\\\n store_pte p InvalidPTE\n \\\\_ s. \\ (r \\ q) s\\\"\n apply (simp add: store_pte_def set_pt_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (erule swap, simp)\n apply (erule vs_lookup_pages_induct)\n apply (simp add: vs_lookup_pages_atI)\n apply (thin_tac \"(ref \\ p) (kheap_update f s)\" for ref p f)\n apply (erule vs_lookup_pages_step)\n by (fastforce simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n graph_of_def image_def\n split: if_split_asm)\n\nlemma store_pde_no_lookup_pages:\n \"\\\\s. \\ (r \\ q) s\\ store_pde p InvalidPDE \\\\_ s. \\ (r \\ q) s\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def)\n apply (erule swap, simp)\n apply (erule vs_lookup_pages_induct)\n apply (simp add: vs_lookup_pages_atI)\n apply (thin_tac \"(ref \\ p) (kheap_update f s)\" for ref p f)\n apply (erule vs_lookup_pages_step)\n by (fastforce simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n graph_of_def image_def\n split: if_split_asm)\n\nlemma flush_table_vs_lookup_pages[wp]:\n \"\\\\s. P (vs_lookup_pages s)\\\n flush_table a b c d\n \\\\_ s. P (vs_lookup_pages s)\\\"\n by (simp add: flush_table_def | wp mapM_UNIV_wp hoare_drop_imps | wpc\n | intro conjI impI)+\n\ncrunch vs_lookup_pages[wp]: page_table_mapped \"\\s. P (vs_lookup_pages s)\"\n\nlemma unmap_page_table_unmapped[wp]:\n \"\\pspace_aligned and valid_vspace_objs\\\n unmap_page_table asid vaddr pt\n \\\\rv s. \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pt) s\\\"\n apply (simp add: unmap_page_table_def lookup_pd_slot_def Let_def\n cong: option.case_cong)\n apply (rule hoare_pre)\n apply ((wp store_pde_unmap_pt page_table_mapped_wp | wpc | simp)+)[1]\n apply (clarsimp simp: vspace_at_asid_def pd_aligned pd_bits_def pageBits_def)\n done\n\nlemma unmap_page_table_unmapped2:\n \"\\pspace_aligned and valid_vspace_objs and\n K (ref = [VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None]\n \\ p = pt)\\\n unmap_page_table asid vaddr pt\n \\\\rv s. \\ (ref \\ p) s\\\"\n apply (rule hoare_gen_asm)\n apply simp\n apply wp\n done\n\nlemma cacheRangeOp_lift[wp]:\n assumes o: \"\\a b. \\P\\ oper a b \\\\_. P\\\"\n shows \"\\P\\ cacheRangeOp oper x y z \\\\_. P\\\"\n apply (clarsimp simp: cacheRangeOp_def lineStart_def cacheLineBits_def cacheLine_def)\n apply (rule hoare_pre)\n apply (wp mapM_x_wp_inv o)\n apply (case_tac x, simp, wp o, simp)\n done\n\nlemma cleanCacheRange_PoU_underlying_memory[wp]:\n \"\\\\m'. underlying_memory m' p = um\\ cleanCacheRange_PoU a b c \\\\_ m'. underlying_memory m' p = um\\\"\n by (clarsimp simp: cleanCacheRange_PoU_def, wp)\n\n\nlemma unmap_page_table_unmapped3:\n \"\\pspace_aligned and valid_vspace_objs and page_table_at pt and\n K (ref = [VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None]\n \\ p = pt)\\\n unmap_page_table asid vaddr pt\n \\\\rv s. \\ (ref \\ p) s\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: unmap_page_table_def lookup_pd_slot_def Let_def\n cong: option.case_cong)\n apply (rule hoare_pre)\n apply ((wp store_pde_unmap_page | wpc | simp)+)[1]\n apply (rule page_table_mapped_wp)\n apply (clarsimp simp: vspace_at_asid_def pd_aligned pd_bits_def pageBits_def)\n apply (drule vs_lookup_pages_2ConsD)\n apply (clarsimp simp: obj_at_def vs_refs_pages_def\n dest!: vs_lookup_pages1D\n split: Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (drule vs_lookup_pages_eq_ap[THEN fun_cong, symmetric, THEN iffD1])\n apply (erule swap)\n apply (drule (1) valid_vspace_objsD[rotated 2])\n apply (simp add: obj_at_def)\n apply (erule vs_lookup_step)\n apply (clarsimp simp: obj_at_def vs_refs_def vs_lookup1_def\n graph_of_def image_def\n split: if_split_asm)\n apply (drule bspec, fastforce)\n apply (auto simp: obj_at_def data_at_def valid_pde_def pde_ref_def pde_ref_pages_def\n split: pde.splits)\n done\n\nlemma is_final_cap_caps_of_state_2D:\n \"\\ caps_of_state s p = Some cap; caps_of_state s p' = Some cap';\n is_final_cap' cap'' s; gen_obj_refs cap \\ gen_obj_refs cap'' \\ {};\n gen_obj_refs cap' \\ gen_obj_refs cap'' \\ {} \\\n \\ p = p'\"\n apply (clarsimp simp: is_final_cap'_def3)\n apply (frule_tac x=\"fst p\" in spec)\n apply (drule_tac x=\"snd p\" in spec)\n apply (drule_tac x=\"fst p'\" in spec)\n apply (drule_tac x=\"snd p'\" in spec)\n apply (clarsimp simp: cte_wp_at_caps_of_state Int_commute\n prod_eqI)\n done\n\n(* FIXME: move *)\nlemma empty_table_pt_capI:\n \"\\caps_of_state s p =\n Some (cap.ArchObjectCap (arch_cap.PageTableCap pt None));\n valid_table_caps s\\\n \\ obj_at (empty_table (set (second_level_tables (arch_state s)))) pt s\"\n apply (case_tac p)\n apply (clarsimp simp: valid_table_caps_def simp del: imp_disjL)\n apply (drule spec)+\n apply (erule impE, simp add: is_cap_simps)+\n by assumption\n\ncrunch underlying_memory[wp]: cleanCacheRange_PoC, cleanL2Range, invalidateL2Range, invalidateByVA,\n cleanInvalidateL2Range, cleanInvalByVA, invalidateCacheRange_I,\n branchFlushRange, ackInterrupt\n \"\\m'. underlying_memory m' p = um\"\n (simp: cache_machine_op_defs machine_op_lift_def machine_rest_lift_def split_def)\n\ncrunch underlying_memory[wp]: cleanCacheRange_RAM, invalidateCacheRange_RAM,\n cleanInvalidateCacheRange_RAM, do_flush\n \"\\m'. underlying_memory m' p = um\"\n (simp: crunch_simps)\n\nlemma no_irq_do_flush:\n \"no_irq (do_flush a b c d)\"\n apply (simp add: do_flush_def)\n apply (case_tac a)\n apply (wp no_irq_dsb no_irq_invalidateCacheRange_I no_irq_branchFlushRange no_irq_isb | simp)+\n done\n\nlemma cleanCacheRange_PoU_respects_device_region[wp]:\n \"\\\\ms. P (device_state ms)\\ cleanCacheRange_PoU a b c \\\\_ ms. P (device_state ms)\\\"\n apply (clarsimp simp: cleanCacheRange_PoU_def cacheRangeOp_def)\n apply (wp mapM_x_wp | wpc | clarsimp | fastforce)+\n done\n\nlemma cacheRangeOp_respects_device_region[wp]:\n assumes valid_f: \"\\a b P. \\\\ms. P (device_state ms)\\ f a b \\\\_ ms. P (device_state ms)\\\"\n shows \"\\\\ms. P (device_state ms)\\ cacheRangeOp f a b c\\\\_ ms. P (device_state ms)\\\"\n apply (clarsimp simp: do_flush_def cacheRangeOp_def)\n apply (rule hoare_pre)\n apply (wp mapM_x_wp valid_f | wpc | clarsimp | assumption)+\n done\n\ncrunches cleanByVA, cleanCacheRange_PoC, cleanCacheRange_RAM,\n cleanInvalByVA, invalidateByVA, invalidateL2Range,\n invalidateCacheRange_RAM, branchFlush, branchFlushRange,\n invalidateByVA_I, cleanInvalidateL2Range, do_flush,\n invalidateLocalTLB_VAASID\n for device_state_inv[wp]: \"\\ms. P (device_state ms)\"\n and mem[wp]: \"\\ms. P (underlying_memory ms)\"\n and irq_masks[wp]: \"\\ms. P (irq_masks ms)\"\n (wp: cacheRangeOp_respects_device_region simp: crunch_simps\n ignore_del: cleanByVA cleanInvalByVA invalidateByVA invalidateL2Range cleanCacheRange_PoU\n cleanCacheRange_RAM cleanL2Range cleanByVA_PoU isb dsb invalidateLocalTLB_VAASID\n branchFlush invalidateByVA_I cleanInvalidateL2Range storeWord)\n\ncrunch pspace_respects_device_region[wp]: perform_page_invocation \"pspace_respects_device_region\"\n (simp: crunch_simps wp: crunch_wps set_object_pspace_respects_device_region\n pspace_respects_device_region_dmo)\n\ncrunches do_machine_op\n for cap_refs_in_kernel_window[wp]: cap_refs_in_kernel_window\n (simp: valid_kernel_mappings_def)\n\nlemma dmo_invs_lift:\n assumes dev: \"\\P. f \\\\ms. P (device_state ms)\\\"\n assumes mem: \"\\P. f \\\\ms. P (underlying_memory ms)\\\"\n assumes irq: \"\\P. f \\\\ms. P (irq_masks ms)\\\"\n shows \"do_machine_op f \\invs\\\"\n unfolding invs_def valid_state_def valid_pspace_def valid_irq_states_def valid_machine_state_def\n by (wpsimp wp: dev hoare_vcg_all_lift hoare_vcg_disj_lift\n dmo_inv_prop_lift[where g=underlying_memory, OF mem]\n pspace_respects_device_region_dmo\n cap_refs_respects_device_region_dmo\n | wps dmo_inv_prop_lift[where g=irq_masks, OF irq])+\n\nlemma perform_page_directory_invocation_invs[wp]:\n \"\\invs and valid_pdi pdi\\\n perform_page_directory_invocation pdi\n \\\\_. invs\\\"\n apply (cases pdi)\n apply (clarsimp simp: perform_page_directory_invocation_def)\n apply (wpsimp wp: dmo_invs_lift set_vm_root_for_flush_invs\n hoare_vcg_const_imp_lift hoare_vcg_all_lift)\n apply (simp add: valid_pdi_def)\n apply (clarsimp simp: perform_page_directory_invocation_def valid_pdi_def)\n done\n\nlemma perform_page_table_invocation_invs[wp]:\n notes no_irq[wp] hoare_pre [wp_pre del]\n shows\n \"\\invs and valid_pti pti\\\n perform_page_table_invocation pti\n \\\\_. invs\\\"\n apply (cases pti)\n apply (clarsimp simp: valid_pti_def perform_page_table_invocation_def)\n apply (wp dmo_invs)\n apply (rule_tac Q=\"\\_. invs\" in hoare_post_imp)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p =\n underlying_memory m p\" in use_valid)\n apply ((clarsimp simp: machine_op_lift_def\n machine_rest_lift_def split_def | wp)+)[3]\n apply(erule use_valid, wp no_irq_cleanByVA_PoU no_irq, assumption)\n apply (wp store_pde_map_invs)[1]\n apply simp\n apply (rule hoare_pre, wp arch_update_cap_invs_map arch_update_cap_pspace\n arch_update_cap_valid_mdb set_cap_idle update_cap_ifunsafe\n valid_irq_node_typ valid_pde_lift set_cap_typ_at\n set_cap_irq_handlers set_cap_empty_pde\n hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_imp_lift\n set_cap_arch_obj set_cap_obj_at_impossible set_cap_valid_arch_caps)\n apply (simp; intro conjI; clarsimp simp: cte_wp_at_caps_of_state)\n apply (clarsimp simp: is_pt_cap_def is_arch_update_def cap_master_cap_def\n vs_cap_ref_simps\n split: cap.splits arch_cap.splits option.splits)\n apply fastforce\n apply (rule exI, rule conjI, assumption)\n apply (clarsimp simp: is_pt_cap_def is_arch_update_def\n cap_master_cap_def cap_asid_def vs_cap_ref_simps\n is_arch_cap_def pde_ref_def pde_ref_pages_def\n split: cap.splits arch_cap.splits option.splits\n pde.splits)\n apply (intro allI impI conjI, fastforce)\n apply (clarsimp simp: caps_of_def cap_of_def)\n apply (frule invs_pd_caps)\n apply (drule (1) empty_table_pt_capI)\n apply (clarsimp simp: obj_at_def empty_table_def pte_ref_pages_def)\n apply (clarsimp simp: perform_page_table_invocation_def\n split: cap.split arch_cap.split)\n apply (rename_tac word option)\n apply (rule hoare_pre)\n apply (wp arch_update_cap_invs_unmap_page_table get_cap_wp)\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wpc, wp, wpc)\n apply (rule hoare_lift_Pf2[where f=caps_of_state])\n apply (wp hoare_vcg_all_lift hoare_vcg_const_imp_lift)+\n apply (rule hoare_vcg_conj_lift)\n apply (wp dmo_invs_lift hoare_vcg_all_lift hoare_vcg_const_imp_lift\n valid_cap_typ[OF do_machine_op_obj_at]\n mapM_x_swp_store_pte_invs[unfolded cte_wp_at_caps_of_state]\n mapM_x_swp_store_empty_table\n valid_cap_typ[OF unmap_page_table_typ_at]\n unmap_page_table_unmapped3\n store_pte_no_lookup_pages\n | wp (once) hoare_vcg_conj_lift\n | wp (once) mapM_x_wp'\n | simp)+\n apply (clarsimp simp: valid_pti_def cte_wp_at_caps_of_state\n is_cap_simps\n is_arch_update_def cap_rights_update_def\n acap_rights_update_def cap_master_cap_simps\n update_map_data_def)\n apply (rule conjI)\n apply (clarsimp simp: vs_cap_ref_def)\n apply (drule invs_pd_caps)\n apply (simp add: valid_table_caps_def)\n apply (elim allE, drule(1) mp)\n apply (simp add: is_cap_simps cap_asid_def)\n apply (drule mp, rule refl)\n apply (clarsimp simp: obj_at_def valid_cap_def empty_table_def\n a_type_def)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm)\n apply (clarsimp simp: valid_cap_def mask_def[where n=asid_bits]\n vmsz_aligned_def cap_aligned_def vs_cap_ref_def\n invs_psp_aligned invs_vspace_objs)\n apply (subgoal_tac \"(\\x\\set [word , word + 4 .e. word + 2 ^ pt_bits - 1].\n x && ~~ mask pt_bits = word)\")\n apply (intro conjI)\n apply (simp add: cap_master_cap_def)\n apply fastforce\n apply (clarsimp simp: image_def)\n apply (subgoal_tac \"word + (ucast x << 2)\n \\ set [word, word + 4 .e. word + 2 ^ pt_bits - 1]\")\n apply (rule rev_bexI, assumption)\n apply (rule ccontr, erule more_pt_inner_beauty)\n apply simp\n apply (clarsimp simp: upto_enum_step_def linorder_not_less)\n apply (subst is_aligned_no_overflow,\n erule is_aligned_weaken,\n (simp_all add: pt_bits_def pageBits_def)[2])+\n apply (clarsimp simp: image_def word_shift_by_2)\n apply (rule exI, rule conjI[OF _ refl])\n apply (rule plus_one_helper)\n apply (rule order_less_le_trans, rule ucast_less, simp+)\n apply (clarsimp simp: upto_enum_step_def)\n apply (rule conjunct2, rule is_aligned_add_helper)\n apply (simp add: pt_bits_def pageBits_def)\n apply (simp only: word_shift_by_2)\n apply (rule shiftl_less_t2n)\n apply (rule word_leq_minus_one_le)\n apply (simp add: pt_bits_def pageBits_def)+\n done\n\ncrunch cte_wp_at [wp]: unmap_page \"\\s. P (cte_wp_at P' p s)\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch typ_at [wp]: unmap_page \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemmas unmap_page_typ_ats [wp] = abs_typ_at_lifts [OF unmap_page_typ_at]\n\nlemma flush_page_invs:\n \"\\invs and K (asid \\ mask asid_bits)\\\n flush_page sz pd asid vptr\n \\\\_. invs\\\"\n unfolding flush_page_def\n by (wpsimp wp: dmo_invs_lift set_vm_root_for_flush_invs)\n\nlemma find_pd_for_asid_lookup_slot [wp]:\n \"\\pspace_aligned and valid_vspace_objs\\ find_pd_for_asid asid\n \\\\rv. \\\\ (lookup_pd_slot rv vptr && ~~ mask pd_bits)\\, -\"\n apply (rule hoare_pre)\n apply (rule hoare_post_imp_R)\n apply (rule hoare_vcg_R_conj)\n apply (rule find_pd_for_asid_lookup)\n apply (rule find_pd_for_asid_aligned_pd)\n apply (simp add: pd_shifting lookup_pd_slot_def Let_def)\n apply simp\n done\n\nlemma find_pd_for_asid_lookup_slot_large_page [wp]:\n \"\\pspace_aligned and valid_vspace_objs and K (x \\ set [0, 4 .e. 0x3C] \\ is_aligned vptr 24)\\\n find_pd_for_asid asid\n \\\\rv. \\\\ (x + lookup_pd_slot rv vptr && ~~ mask pd_bits)\\, -\"\n apply (rule hoare_pre)\n apply (rule hoare_post_imp_R)\n apply (rule hoare_vcg_R_conj)\n apply (rule hoare_vcg_R_conj)\n apply (rule find_pd_for_asid_inv [where P=\"K (x \\ set [0, 4 .e. 0x3C] \\ is_aligned vptr 24)\", THEN valid_validE_R])\n apply (rule find_pd_for_asid_lookup)\n apply (rule find_pd_for_asid_aligned_pd)\n apply (subst lookup_pd_slot_add_eq)\n apply (simp_all add: pd_bits_def pageBits_def)\n done\n\nlemma find_pd_for_asid_pde_at_add [wp]:\n \"\\K (x \\ set [0,4 .e. 0x3C] \\ is_aligned vptr 24) and pspace_aligned and valid_vspace_objs\\\n find_pd_for_asid asid \\\\rv. pde_at (x + lookup_pd_slot rv vptr)\\, -\"\n apply (rule hoare_pre)\n apply (rule hoare_post_imp_R)\n apply (rule hoare_vcg_R_conj)\n apply (rule find_pd_for_asid_inv [where P=\n \"K (x \\ set [0, 4 .e. 0x3C] \\ is_aligned vptr 24) and pspace_aligned\", THEN valid_validE_R])\n apply (rule find_pd_for_asid_page_directory)\n apply (auto intro!: pde_at_aligned_vptr)\n done\n\nlemma valid_kernel_mappingsD:\n \"\\ kheap s pdptr = Some (ArchObj (PageDirectory pd));\n valid_kernel_mappings s \\\n \\ \\x r. pde_ref (pd x) = Some r \\\n (r \\ set (arm_global_pts (arch_state s)))\n = (ucast (kernel_base >> 20) \\ x)\"\n apply (simp add: valid_kernel_mappings_def)\n apply (drule bspec, erule ranI)\n apply (simp add: valid_kernel_mappings_if_pd_def\n kernel_mapping_slots_def)\n done\n\nlemma lookup_pt_slot_cap_to:\n shows \"\\invs and \\\\pd and K (is_aligned pd pd_bits)\n and K (vptr < kernel_base)\\ lookup_pt_slot pd vptr\n \\\\rv s. \\a b cap. caps_of_state s (a, b) = Some cap \\ is_pt_cap cap\n \\ rv && ~~ mask pt_bits \\ obj_refs cap\n \\ s \\ cap \\ cap_asid cap \\ None\n \\ (is_aligned vptr 16 \\ is_aligned rv 6)\\, -\"\n proof -\n have shift: \"(2::word32) ^ pt_bits = 2 ^ 8 << 2\"\n by (simp add:pt_bits_def pageBits_def )\n show ?thesis\n apply (simp add: lookup_pt_slot_def)\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_pd)\n apply (frule(1) valid_vspace_objsD)\n apply fastforce\n apply (drule vs_lookup_step)\n apply (erule vs_lookup1I[OF _ _ refl])\n apply (simp add: vs_refs_def image_def)\n apply (rule rev_bexI)\n apply (erule pde_graph_ofI)\n apply (erule (1) less_kernel_base_mapping_slots)\n apply (simp add: pde_ref_def)\n apply fastforce\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], clarsimp)\n apply simp\n apply (elim exEI, clarsimp)\n apply (subst is_aligned_add_helper[THEN conjunct2])\n apply (drule caps_of_state_valid)\n apply fastforce\n apply (clarsimp dest!:valid_cap_aligned simp:cap_aligned_def vs_cap_ref_def\n obj_refs_def obj_ref_of_def pageBitsForSize_def pt_bits_def pageBits_def\n elim!:is_aligned_weaken\n split:arch_cap.split_asm cap.splits option.split_asm vmpage_size.split_asm)\n apply (rule less_le_trans[OF shiftl_less_t2n[where m = 10]])\n apply (rule le_less_trans[OF word_and_le1])\n apply simp\n apply simp\n apply (simp add:pt_bits_def pageBits_def)\n apply (drule caps_of_state_valid)\n apply fastforce\n apply (drule bspec)\n apply (drule(1) less_kernel_base_mapping_slots)\n apply simp\n apply (clarsimp simp: valid_pde_def obj_at_def\n vs_cap_ref_def is_pt_cap_def valid_cap_simps cap_aligned_def\n split: cap.split_asm arch_cap.split_asm vmpage_size.splits\n option.split_asm if_splits)\n apply (erule is_aligned_add[OF is_aligned_weaken],simp\n ,rule is_aligned_shiftl[OF is_aligned_andI1,OF is_aligned_shiftr],simp)+\n done\nqed\n\nlemma lookup_pt_slot_cap_to1[wp]:\n \"\\invs and \\\\pd and K (is_aligned pd pd_bits)\n and K (vptr < kernel_base)\\ lookup_pt_slot pd vptr\n \\\\rv s. \\a b cap. caps_of_state s (a, b) = Some cap \\ is_pt_cap cap \\ rv && ~~ mask pt_bits \\ obj_refs cap\\,-\"\n apply (rule hoare_post_imp_R)\n apply (rule lookup_pt_slot_cap_to)\n apply auto\n done\n\nlemma lookup_pt_slot_cap_to_multiple1:\n \"\\invs and \\\\pd and K (is_aligned pd pd_bits)\n and K (vptr < kernel_base)\n and K (is_aligned vptr 16)\\\n lookup_pt_slot pd vptr\n \\\\rv s. is_aligned rv 6 \\\n (\\a b. cte_wp_at (\\c. is_pt_cap c \\ cap_asid c \\ None\n \\ (\\x. x && ~~ mask pt_bits) ` set [rv , rv + 4 .e. rv + 0x3C] \\ obj_refs c) (a, b) s)\\, -\"\n apply (rule hoare_gen_asmE)\n apply (rule hoare_post_imp_R)\n apply (rule lookup_pt_slot_cap_to)\n apply (rule conjI, clarsimp)\n apply (elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_pt_cap_def\n valid_cap_def cap_aligned_def\n del: subsetI)\n apply (simp add: subset_eq p_0x3C_shift)\n apply (clarsimp simp: set_upto_enum_step_4)\n apply (fold mask_def[where n=4, simplified])\n apply (subst(asm) le_mask_iff)\n apply (subst word_plus_and_or_coroll)\n apply (rule shiftr_eqD[where n=6])\n apply (simp add: shiftr_over_and_dist shiftl_shiftr2)\n apply (simp add: is_aligned_andI2)\n apply simp\n apply (simp add: word_ao_dist)\n apply (simp add: and_not_mask pt_bits_def pageBits_def)\n apply (drule arg_cong[where f=\"\\x. x >> 4\"])\n apply (simp add: shiftl_shiftr2 shiftr_shiftr)\n done\n\nlemma lookup_pt_slot_cap_to_multiple[wp]:\n \"\\invs and \\\\pd and K (is_aligned pd pd_bits)\n and K (vptr < kernel_base)\n and K (is_aligned vptr 16)\\\n lookup_pt_slot pd vptr\n \\\\rv s. \\a b. cte_wp_at (\\c. (\\x. x && ~~ mask pt_bits) ` (\\x. x + rv) ` set [0 , 4 .e. 0x3C] \\ obj_refs c) (a, b) s\\, -\"\n apply (rule hoare_post_imp_R, rule lookup_pt_slot_cap_to_multiple1)\n apply (elim conjE exEI cte_wp_at_weakenE)\n apply (simp add: subset_eq p_0x3C_shift)\n done\n\nlemma find_pd_for_asid_cap_to:\n \"\\invs\\ find_pd_for_asid asid\n \\\\rv s. \\a b cap. caps_of_state s (a, b) = Some cap \\ rv \\ obj_refs cap\n \\ is_pd_cap cap \\ s \\ cap\n \\ is_aligned rv pd_bits\\, -\"\n apply (simp add: find_pd_for_asid_def assertE_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp | wpc)+\n apply clarsimp\n apply (drule vs_lookup_atI)\n apply (frule(1) valid_vspace_objsD, clarsimp)\n apply (drule vs_lookup_step)\n apply (erule vs_lookup1I [OF _ _ refl])\n apply (simp add: vs_refs_def image_def)\n apply (rule rev_bexI)\n apply (erule graph_ofI)\n apply fastforce\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], clarsimp)\n apply (simp, elim exEI)\n apply clarsimp\n apply (frule caps_of_state_valid_cap, clarsimp+)\n apply (clarsimp simp: table_cap_ref_ap_eq[symmetric] table_cap_ref_def\n is_pd_cap_def valid_cap_def cap_aligned_def\n pd_bits_def pageBits_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n done\n\nlemma find_pd_for_asid_cap_to1[wp]:\n \"\\invs\\ find_pd_for_asid asid\n \\\\rv s. \\a b cap. caps_of_state s (a, b) = Some cap \\ lookup_pd_slot rv vptr && ~~ mask pd_bits \\ obj_refs cap\\, -\"\n apply (rule hoare_post_imp_R, rule find_pd_for_asid_cap_to)\n apply (clarsimp simp: lookup_pd_slot_pd)\n apply auto\n done\n\nlemma find_pd_for_asid_cap_to2[wp]:\n \"\\invs\\ find_pd_for_asid asid\n \\\\rv s. \\a b. cte_wp_at\n (\\cp. lookup_pd_slot rv vptr && ~~ mask pd_bits \\ obj_refs cp \\ is_pd_cap cp)\n (a, b) s\\, -\"\n apply (rule hoare_post_imp_R, rule find_pd_for_asid_cap_to)\n apply (clarsimp simp: lookup_pd_slot_pd cte_wp_at_caps_of_state)\n apply auto\n done\n\nlemma find_pd_for_asid_cap_to_multiple[wp]:\n \"\\invs and K (is_aligned vptr 24)\\ find_pd_for_asid asid\n \\\\rv s. \\x xa. cte_wp_at (\\a. (\\x. x && ~~ mask pd_bits) ` (\\x. x + lookup_pd_slot rv vptr) ` set [0 , 4 .e. 0x3C] \\ obj_refs a) (x, xa) s\\, -\"\n apply (rule hoare_gen_asmE, rule hoare_post_imp_R, rule find_pd_for_asid_cap_to)\n apply (elim exEI, clarsimp simp: cte_wp_at_caps_of_state)\n apply (simp add: lookup_pd_slot_add_eq)\n done\n\nlemma find_pd_for_asid_cap_to_multiple2[wp]:\n \"\\invs and K (is_aligned vptr 24)\\\n find_pd_for_asid asid\n \\\\rv s. \\x\\set [0 , 4 .e. 0x3C]. \\a b.\n cte_wp_at (\\cp. x + lookup_pd_slot rv vptr && ~~ mask pd_bits\n \\ obj_refs cp \\ is_pd_cap cp) (a, b) s\\, -\"\n apply (rule hoare_gen_asmE, rule hoare_post_imp_R,\n rule find_pd_for_asid_cap_to)\n apply (intro ballI, elim exEI,\n clarsimp simp: cte_wp_at_caps_of_state)\n apply (simp add: lookup_pd_slot_add_eq)\n done\n\nlemma unat_ucast_kernel_base_rshift:\n \"unat (ucast (kernel_base >> 20) :: 12 word)\n = unat (kernel_base >> 20)\"\n by (simp add: kernel_base_def)\n\nlemma lookup_pd_slot_kernel_mappings_set_strg:\n \"is_aligned pd pd_bits \\ vmsz_aligned vptr ARMSuperSection\n \\ vptr < kernel_base\n \\\n (\\x\\set [0 , 4 .e. 0x3C]. ucast (x + lookup_pd_slot pd vptr && mask pd_bits >> 2)\n \\ kernel_mapping_slots)\"\n apply (clarsimp simp: upto_enum_step_def word_shift_by_2)\n apply (simp add: less_kernel_base_mapping_slots_both word_leq_minus_one_le)\n done\n\nlemma lookup_pt_slot_cap_to2:\n \"\\invs and \\\\ pd and K (is_aligned pd pd_bits) and K (vptr < kernel_base)\\\n lookup_pt_slot pd vptr\n \\\\rv s. \\oref cref cap. caps_of_state s (oref, cref) = Some cap\n \\ rv && ~~ mask pt_bits \\ obj_refs cap \\ is_pt_cap cap\\, -\"\n apply (rule hoare_post_imp_R, rule lookup_pt_slot_cap_to)\n apply fastforce\n done\n\nlemma lookup_pt_slot_cap_to_multiple2:\n \"\\invs and \\\\ pd and K (is_aligned pd pd_bits) and K (vptr < kernel_base) and K (is_aligned vptr 16)\\\n lookup_pt_slot pd vptr\n \\\\rv s. \\oref cref. cte_wp_at\n (\\c. (\\x. x && ~~ mask pt_bits) ` (\\x. x + rv) ` set [0 , 4 .e. 0x3C] \\ obj_refs c \\ is_pt_cap c)\n (oref, cref) s\\, -\"\n apply (rule hoare_post_imp_R, rule lookup_pt_slot_cap_to_multiple1)\n apply (clarsimp simp: upto_enum_step_def image_image field_simps\n linorder_not_le[symmetric]\n split: if_split_asm)\n apply (erule notE, erule is_aligned_no_wrap')\n apply simp\n apply (fastforce simp: cte_wp_at_caps_of_state)\n done\n\ncrunch global_refs[wp]: flush_page \"\\s. P (global_refs s)\"\n (simp: global_refs_arch_update_eq crunch_simps)\n\nlemma page_directory_at_lookup_mask_aligned_strg:\n \"is_aligned pd pd_bits \\ page_directory_at pd s\n \\ page_directory_at (lookup_pd_slot pd vptr && ~~ mask pd_bits) s\"\n by (clarsimp simp: lookup_pd_slot_pd)\n\nlemma page_directory_at_lookup_mask_add_aligned_strg:\n \"is_aligned pd pd_bits \\ page_directory_at pd s\n \\ vmsz_aligned vptr ARMSuperSection\n \\ x \\ set [0, 4 .e. 0x3C]\n \\ page_directory_at (x + lookup_pd_slot pd vptr && ~~ mask pd_bits) s\"\n by (clarsimp simp: lookup_pd_slot_add_eq vmsz_aligned_def)\n\nlemma dmo_ccMVA_invs[wp]:\n \"\\invs\\ do_machine_op (cleanByVA_PoU a b) \\\\r. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp | wp)+)[3]\n apply(erule use_valid, wp no_irq_cleanByVA_PoU no_irq, assumption)\n done\n\n\nlemma dmo_ccr_invs[wp]:\n \"\\invs\\ do_machine_op (cleanCacheRange_PoU a b c) \\\\r. invs\\\"\n apply (wp dmo_invs)\n apply safe\n apply (drule_tac Q=\"\\_ m'. underlying_memory m' p = underlying_memory m p\"\n in use_valid)\n apply ((clarsimp | wp)+)[3]\n apply(erule use_valid, wp no_irq_cleanCacheRange_PoU no_irq, assumption)\n done\n\nlemma ex_pt_cap_eq:\n \"(\\ref cap. caps_of_state s ref = Some cap \\\n p \\ obj_refs cap \\ is_pt_cap cap) =\n (\\ref asid. caps_of_state s ref =\n Some (cap.ArchObjectCap (arch_cap.PageTableCap p asid)))\"\n by (fastforce simp add: is_pt_cap_def obj_refs_def)\n\nlemmas lookup_pt_slot_cap_to2' =\n lookup_pt_slot_cap_to2[simplified ex_pt_cap_eq[simplified split_paired_Ex]]\n\nlemma unmap_page_invs:\n \"\\invs and K (asid \\ mask asid_bits \\ vptr < kernel_base \\\n vmsz_aligned vptr sz)\\\n unmap_page sz asid vptr pptr\n \\\\rv. invs\\\"\n apply (simp add: unmap_page_def)\n apply (rule hoare_pre)\n apply (wp flush_page_invs hoare_vcg_const_imp_lift)\n apply (wp hoare_drop_imp[where f=\"check_mapping_pptr a b c\" for a b c]\n hoare_drop_impE_R[where R=\"\\x y. x && mask b = c\" for b c]\n lookup_pt_slot_inv lookup_pt_slot_cap_to2'\n lookup_pt_slot_cap_to_multiple2\n store_pde_invs_unmap mapM_swp_store_pde_invs_unmap\n mapM_swp_store_pte_invs\n | wpc | simp)+\n apply (strengthen lookup_pd_slot_kernel_mappings_strg\n lookup_pd_slot_kernel_mappings_set_strg\n not_in_global_refs_vs_lookup\n page_directory_at_lookup_mask_aligned_strg\n page_directory_at_lookup_mask_add_aligned_strg)+\n apply (wp find_pd_for_asid_page_directory\n hoare_vcg_const_imp_lift_R hoare_vcg_const_Ball_lift_R\n | wp (once) hoare_drop_imps)+\n apply (auto simp: vmsz_aligned_def)\n done\n\nlemma \"\\\\s. P (vs_lookup s) (valid_pte pte s)\\ set_cap cap cptr \\\\_ s. P (vs_lookup s) (valid_pte pte s)\\\"\n apply (rule hoare_lift_Pf[where f=vs_lookup])\n apply (rule hoare_lift_Pf[where f=\"valid_pte pte\"])\n apply (wp set_cap.vs_lookup set_cap_valid_pte_stronger)+\n done\n\nlemma reachable_page_table_not_global:\n \"\\(ref \\ p) s; valid_kernel_mappings s; valid_global_pts s;\n valid_vspace_objs s; valid_asid_table (arm_asid_table (arch_state s)) s\\\n \\ p \\ set (arm_global_pts (arch_state s))\"\n apply clarsimp\n apply (erule (2) vs_lookupE_alt[OF _ _ valid_asid_table_ran])\n apply (clarsimp simp: valid_global_pts_def)\n apply (drule (1) bspec)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (clarsimp simp: valid_global_pts_def)\n apply (drule (1) bspec)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (clarsimp simp: valid_kernel_mappings_def valid_kernel_mappings_if_pd_def ran_def)\n apply (drule_tac x=\"ArchObj (PageDirectory pd)\" in spec)\n apply (drule mp, erule_tac x=p\\<^sub>2 in exI)\n apply clarsimp\n done\n\nlemma store_pte_unmap_page:\n \"\\(\\s. \\pt. ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pt) s\n \\ is_aligned pt pt_bits \\ p = (pt + ((vaddr >> 12) && mask 8 << 2 )))\\\n store_pte p InvalidPTE\n \\\\rv s.\\ ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable),\n VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pptr) s\\\"\n apply (simp add: store_pte_def set_pt_def set_object_def get_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def fun_upd_def[symmetric] vs_lookup_pages_def vs_asid_refs_def)\n apply (drule vs_lookup_pages1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup_pages1_def vs_lookup_def vs_asid_refs_def)\n apply (drule vs_lookup1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup1_def obj_at_def split: if_split_asm)\n apply (clarsimp simp: vs_refs_pages_def)+\n apply (thin_tac \"(VSRef a (Some AASIDPool), b) \\ c\" for a b c)\n apply (clarsimp simp: graph_of_def\n split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.splits\n if_split_asm)\n apply (erule_tac P=\"a = c\" for c in swap)\n apply (rule up_ucast_inj[where 'a=8 and 'b=32])\n apply (subst ucast_ucast_len)\n apply (simp add: pt_bits_def pageBits_def\n is_aligned_add_helper less_le_trans[OF ucast_less]\n shiftl_less_t2n'[where m=8 and n=2, simplified]\n shiftr_less_t2n'[where m=8 and n=2, simplified]\n word_bits_def shiftl_shiftr_id)+\n apply (clarsimp simp: graph_of_def vs_refs_def vs_refs_pages_def\n pde_ref_def pde_ref_pages_def pte_ref_pages_def)+\n apply (simp add: pt_bits_def pageBits_def\n is_aligned_add_helper less_le_trans[OF ucast_less]\n shiftl_less_t2n'[where m=8 and n=2, simplified]\n shiftr_less_t2n'[where m=8 and n=2, simplified]\n word_bits_def shiftl_shiftr_id)+\n by (clarsimp split: Structures_A.kernel_object.split_asm arch_kernel_obj.split_asm,\n clarsimp simp: pde_ref_def pte_ref_pages_def pde_ref_pages_def data_at_def\n is_aligned_add_helper less_le_trans[OF ucast_less]\n shiftl_less_t2n'[where m=8 and n=2, simplified]\n dest!: graph_ofD ucast_up_inj[where 'a=10 (*asid_low_bits*)and 'b=32, simplified]\n ucast_up_inj[where 'a=7 (*asid_high_bits*) and 'b=32, simplified]\n split: if_split_asm pde.splits pte.splits if_splits)\n\ncrunch pd_at: flush_page \"\\s. P (ko_at (ArchObj (PageDirectory pd)) x s)\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch pt_at: flush_page \"\\s. P (ko_at (ArchObj (PageTable pt)) x s)\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma vs_lookup_pages_pteD:\n \"([VSRef ((vaddr >> 12) && mask 8) (Some APageTable),\n VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pg) s\n \\ \\ap fun pd funa pt funb. ([VSRef (ucast (asid_high_bits_of asid)) None] \\ ap) s\n \\ (arm_asid_table (arch_state s)) (asid_high_bits_of asid) = Some ap\n \\ ko_at (ArchObj (ASIDPool fun)) ap s\n \\ ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd) s\n \\ fun (ucast (asid && mask asid_low_bits)) = Some pd\n \\ ko_at (ArchObj (PageDirectory funa)) pd s\n \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pt) s\n \\ pde_ref_pages (funa (ucast (vaddr >> 20))) = Some pt\n \\ ko_at (ArchObj (PageTable funb)) pt s\n \\ pte_ref_pages (funb (ucast ((vaddr >> 12) && mask 8 ))) = Some pg\"\n\n apply (frule vs_lookup_pages_2ConsD)\n apply clarsimp\n apply (frule_tac vs=\"[z]\" for z in vs_lookup_pages_2ConsD)\n apply clarsimp\n apply (frule_tac vs=\"[]\" in vs_lookup_pages_2ConsD)\n apply clarsimp\n apply (rule_tac x=p'b in exI)\n apply (frule vs_lookup_atD[OF iffD2[OF fun_cong[OF vs_lookup_pages_eq_at]]])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n dest!: graph_ofD\n split: if_split_asm)\n apply (clarsimp split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits)\n apply (simp add: up_ucast_inj_eq graph_of_def kernel_mapping_slots_def kernel_base_def\n not_le ucast_less_ucast_weak[symmetric, where 'a=12 and 'b=32]\n mask_asid_low_bits_ucast_ucast pde_ref_pages_def pte_ref_pages_def\n split: if_split_asm)\n apply (simp add: ucast_ucast_id\n split: pde.split_asm pte.split_asm)\n done\n\nlemma vs_lookup_pages_pdeD:\n \"([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ p) s\n \\ \\ap fun pd funa. ([VSRef (ucast (asid_high_bits_of asid)) None] \\ ap) s\n \\ (arm_asid_table (arch_state s)) (asid_high_bits_of asid) = Some ap\n \\ ko_at (ArchObj (ASIDPool fun)) ap s\n \\ ([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd) s\n \\ fun (ucast (asid && mask asid_low_bits)) = Some pd\n \\ ko_at (ArchObj (PageDirectory funa)) pd s\n \\ pde_ref_pages (funa (ucast (vaddr >> 20))) = Some p\"\n\n apply (frule vs_lookup_pages_2ConsD)\n apply clarsimp\n apply (frule_tac vs=\"[]\" in vs_lookup_pages_2ConsD)\n apply clarsimp\n apply (rule_tac x=p'a in exI)\n apply (frule vs_lookup_atD[OF iffD2[OF fun_cong[OF vs_lookup_pages_eq_at]]])\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n dest!: graph_ofD\n split: if_split_asm)\n apply (clarsimp split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits)\n apply (simp add: up_ucast_inj_eq graph_of_def kernel_mapping_slots_def kernel_base_def\n not_le ucast_less_ucast_weak[symmetric, where 'a=12 and 'b=32]\n mask_asid_low_bits_ucast_ucast pde_ref_pages_def\n split: if_split_asm)\n apply (simp add: ucast_ucast_id\n split: pde.split_asm)\n done\n\nlemma vs_lookup_ap_mappingD:\n \"([VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pd) s\n \\ \\ap fun. (arm_asid_table (arch_state s)) (asid_high_bits_of asid) = Some ap\n \\ ko_at (ArchObj (ASIDPool fun)) ap s\n \\ fun (ucast (asid && mask asid_low_bits)) = Some pd\"\napply (clarsimp simp: vs_lookup_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def\n dest!: graph_ofD\n split: if_split_asm)\n apply (clarsimp split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits)\n apply (simp add: up_ucast_inj_eq graph_of_def kernel_mapping_slots_def kernel_base_def\n not_le ucast_less_ucast_weak[symmetric, where 'a=12 and 'b=32]\n mask_asid_low_bits_ucast_ucast pde_ref_pages_def pte_ref_pages_def\n split: if_split_asm)\n done\n\nlemma kernel_slot_impossible_vs_lookup_pages:\n \"(ucast (vaddr >> 20)) \\ kernel_mapping_slots \\\n \\ ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable),\n VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pptr) s\"\n apply (clarsimp simp: vs_lookup_pages_def vs_asid_refs_def\n dest!: vs_lookup_pages1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def)\n apply (clarsimp simp: ucast_ucast_id\n dest!: graph_ofD\n split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits\n if_split_asm)\n done\n\nlemma kernel_slot_impossible_vs_lookup_pages2:\n \"(ucast (vaddr >> 20)) \\ kernel_mapping_slots \\\n \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ pptr) s\"\n apply (clarsimp simp: vs_lookup_pages_def vs_asid_refs_def\n dest!: vs_lookup_pages1_rtrancl_iterations)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def)\n apply (clarsimp simp: ucast_ucast_id\n dest!: graph_ofD\n split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits\n if_split_asm)\n done\n\nlemma pt_aligned:\n \"\\page_table_at pt s; pspace_aligned s\\ \\ is_aligned pt 10\"\n by (auto simp: obj_at_def pspace_aligned_def pt_bits_def pageBits_def dom_def)\n\nlemma vaddr_segment_nonsense:\n \"is_aligned (p :: word32) 14 \\ p + (vaddr >> 20 << 2) && ~~ mask pd_bits = p\"\n by (fact pd_shifting)\n\nlemma vaddr_segment_nonsense2:\n \"is_aligned (p :: word32) 14 \\\n p + (vaddr >> 20 << 2) && mask pd_bits >> 2 = vaddr >> 20\"\n by (simp add: shiftl_less_t2n'[where m=12 and n=2, simplified]\n shiftr_less_t2n'[where m=12 and n=20, simplified]\n pd_bits_def pageBits_def is_aligned_add_helper[THEN conjunct1] triple_shift_fun)\n\nlemma vaddr_segment_nonsense3:\n \"is_aligned (p :: word32) 10 \\\n (p + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) = p\"\n apply (rule is_aligned_add_helper[THEN conjunct2])\n apply (simp add: pt_bits_def pageBits_def)+\n apply (rule shiftl_less_t2n[where m=10 and n=2, simplified, OF and_mask_less'[where n=8, unfolded mask_def, simplified]])\n apply simp+\n done\n\nlemma vaddr_segment_nonsense4:\n \"is_aligned (p :: word32) 10 \\\n p + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits = (vaddr >> 12) && 0xFF << 2\"\n apply (subst is_aligned_add_helper[THEN conjunct1])\n apply (simp_all add: pt_bits_def pageBits_def)\n apply (rule shiftl_less_t2n'[where n=2 and m=8, simplified])\n apply (rule and_mask_less'[where n=8, unfolded mask_def, simplified])\n apply simp+\n done\n\n(* FIXME: move near ArchAcc_R.lookup_pt_slot_inv? *)\nlemma lookup_pt_slot_inv_validE:\n \"\\P\\ lookup_pt_slot pd vptr \\\\_. P\\, \\\\_. P\\\"\n apply (simp add: lookup_pt_slot_def)\n apply (wp get_pde_inv hoare_drop_imp lookup_pt_slot_inv | wpc | simp)+\n done\n\nlemma unmap_page_no_lookup_pages:\n \"\\\\s. \\ (ref \\ p) s\\\n unmap_page sz asid vaddr pptr\n \\\\_ s. \\ (ref \\ p) s\\\"\n apply (rule hoare_pre)\n apply (wp store_pte_no_lookup_pages hoare_drop_imps lookup_pt_slot_inv_validE\n mapM_UNIV_wp store_pde_no_lookup_pages\n | wpc | simp add: unmap_page_def swp_def | strengthen imp_consequent)+\n done\n\nlemma vs_refs_pages_inj:\n \"\\ (r, p) \\ vs_refs_pages ko; (r, p') \\ vs_refs_pages ko \\ \\ p = p'\"\n by (clarsimp simp: vs_refs_pages_def up_ucast_inj_eq dest!: graph_ofD\n split: Structures_A.kernel_object.split_asm arch_kernel_obj.splits)\n\nlemma unique_vs_lookup_pages_loop:\n \"\\ (([r], x), a # list, p) \\ vs_lookup_pages1 s ^^ length list;\n (([r'], y), a # list, p') \\ vs_lookup_pages1 s ^^ length list;\n r = r' \\ x = y \\\n \\ p = p'\"\n apply (induct list arbitrary: a p p')\n apply simp\n apply (clarsimp simp: obj_at_def dest!: vs_lookup_pages1D)\n apply (erule vs_refs_pages_inj)\n apply fastforce\n done\n\nlemma unique_vs_lookup_pages:\n \"\\(r \\ p) s; (r \\ p') s\\ \\ p = p'\"\n apply (clarsimp simp: vs_lookup_pages_def vs_asid_refs_def\n dest!: graph_ofD vs_lookup_pages1_rtrancl_iterations)\n apply (case_tac r, simp_all)\n apply (erule(1) unique_vs_lookup_pages_loop)\n apply (clarsimp simp: up_ucast_inj_eq)\n done\n\nlemma unmap_page_unmapped:\n \"\\pspace_aligned and valid_vspace_objs and data_at sz pptr and\n valid_objs and (\\s. valid_asid_table (arm_asid_table (arch_state s)) s) and\n K ((sz = ARMSmallPage \\ sz = ARMLargePage \\ ref =\n [VSRef ((vaddr >> 12) && mask 8) (Some APageTable),\n VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None]) \\\n (sz = ARMSection \\ sz = ARMSuperSection \\ ref =\n [VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None]) \\\n p = pptr)\\\n unmap_page sz asid vaddr pptr\n \\\\rv s. \\ (ref \\ p) s\\\"\n apply (rule hoare_gen_asm)\n\n (* Establish that pptr reachable, otherwise trivial *)\n apply (rule hoare_name_pre_state2)\n apply (case_tac \"\\ (ref \\ p) s\")\n apply (rule hoare_pre(1)[OF unmap_page_no_lookup_pages])\n apply clarsimp+\n\n (* This should be somewhere else but isn't *)\n apply (subgoal_tac \"\\xs. [0 :: word32, 4 .e. 0x3C] = 0 # xs\")\n prefer 2\n apply (simp add: upto_enum_step_def upto_enum_word upt_rec)\n apply (clarsimp simp: unmap_page_def lookup_pd_slot_def lookup_pt_slot_def Let_def\n mapM_Cons\n cong: option.case_cong vmpage_size.case_cong)\n\n (* Establish that pde in vsref chain isn't kernel mapping,\n otherwise trivial *)\n apply (case_tac \"ucast (vaddr >> 20) \\ kernel_mapping_slots\")\n apply (case_tac sz)\n apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages | wp)+)[2]\n apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages2 | wp)+)[1]\n apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages2 | wp)+)[1]\n\n (* Proper cases *)\n apply (wp store_pte_unmap_page\n mapM_UNIV_wp[OF store_pte_no_lookup_pages]\n get_pte_wp get_pde_wp store_pde_unmap_page\n mapM_UNIV_wp[OF store_pde_no_lookup_pages]\n flush_page_vs_lookup flush_page_vs_lookup_pages\n hoare_vcg_all_lift hoare_vcg_const_imp_lift\n hoare_vcg_imp_lift[OF flush_page_pd_at]\n hoare_vcg_imp_lift[OF flush_page_pt_at]\n find_pd_for_asid_lots\n | wpc | simp add: swp_def check_mapping_pptr_def)+\n apply clarsimp\n apply (case_tac sz, simp_all)\n apply (drule vs_lookup_pages_pteD)\n apply (rule conjI[rotated])\n apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric])\n apply clarsimp\n apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI)\n apply (frule (1) pd_aligned)\n apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr])\n apply (frule valid_vspace_objsD)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (rule refl)\n apply assumption\n apply (simp, drule bspec, fastforce)\n apply (clarsimp simp: pde_ref_pages_def\n split: pde.splits\n dest!: )\n apply (frule pt_aligned[rotated])\n apply (simp add: obj_at_def a_type_def)\n apply (simp split: Structures_A.kernel_object.splits arch_kernel_obj.splits, blast)\n apply (clarsimp simp: obj_at_def)\n apply (simp add: vaddr_segment_nonsense3[where vaddr=vaddr]\n vaddr_segment_nonsense4[where vaddr=vaddr])\n apply (drule_tac p=\"ptrFromPAddr x\" for x in vs_lookup_vs_lookup_pagesI')\n apply ((simp add: obj_at_def a_type_def)+)[3]\n apply (frule_tac p=\"ptrFromPAddr a\" for a in valid_vspace_objsD)\n apply ((simp add: obj_at_def)+)[2]\n apply (simp add: )\n apply (intro conjI impI)\n apply (simp add: pt_bits_def pageBits_def mask_def)\n apply (erule allE[where x=\"(ucast ((vaddr >> 12) && mask 8))\"])\n apply (fastforce simp: pte_ref_pages_def mask_def obj_at_def a_type_def data_at_def\n shiftl_shiftr_id[where n=2,\n OF _ less_le_trans[OF and_mask_less'[where n=8]],\n unfolded mask_def word_bits_def, simplified]\n split: pte.splits if_splits)\n apply ((clarsimp simp: obj_at_def a_type_def data_at_def)+)[2]\n\n apply (drule vs_lookup_pages_pteD)\n apply (rule conjI[rotated])\n apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric])\n apply clarsimp\n apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI)\n apply (frule (1) pd_aligned)\n apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr])\n apply (frule valid_vspace_objsD)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (rule refl)\n apply assumption\n apply (simp, drule bspec, fastforce)\n apply (clarsimp simp: pde_ref_pages_def\n split: pde.splits\n dest!: )\n apply (frule pt_aligned[rotated])\n apply (simp add: obj_at_def a_type_def)\n apply (simp split: Structures_A.kernel_object.splits arch_kernel_obj.splits, blast)\n apply (clarsimp simp: obj_at_def)\n apply (simp add: vaddr_segment_nonsense3[where vaddr=vaddr]\n vaddr_segment_nonsense4[where vaddr=vaddr])\n apply (drule_tac p=\"ptrFromPAddr x\" for x in vs_lookup_vs_lookup_pagesI')\n apply ((simp add: obj_at_def a_type_def)+)[3]\n apply (frule_tac p=\"ptrFromPAddr a\" for a in valid_vspace_objsD)\n apply ((simp add: obj_at_def)+)[2]\n apply (simp add: )\n apply (intro conjI impI)\n apply (simp add: pt_bits_def pageBits_def mask_def)\n apply (erule allE[where x=\"(ucast ((vaddr >> 12) && mask 8))\"])\n\n apply (fastforce simp: pte_ref_pages_def mask_def obj_at_def a_type_def data_at_def\n shiftl_shiftr_id[where n=2,\n OF _ less_le_trans[OF and_mask_less'[where n=8]],\n unfolded mask_def word_bits_def, simplified]\n split: pte.splits if_splits)\n apply ((clarsimp simp: obj_at_def a_type_def data_at_def)+)[2]\n apply (drule vs_lookup_pages_pdeD)\n apply (rule conjI[rotated])\n apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric])\n apply clarsimp\n apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI)\n apply (frule (1) pd_aligned)\n apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr])\n apply (frule valid_vspace_objsD)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (rule refl)\n apply assumption\n apply (simp, drule bspec, fastforce)\n apply (clarsimp simp: pde_ref_pages_def\n split: pde.splits)\n apply (clarsimp simp: obj_at_def data_at_def)\n apply (drule_tac p=\"rv\" in vs_lookup_vs_lookup_pagesI')\n apply ((simp add: obj_at_def a_type_def)+)[3]\n apply (frule_tac p=\"rv\" in valid_vspace_objsD)\n apply ((simp add: obj_at_def)+)[2]\n apply (fastforce simp: data_at_def)\n apply (fastforce simp: obj_at_def a_type_def pd_bits_def pageBits_def data_at_def\n split: pde.splits)\n apply (fastforce simp: obj_at_def a_type_def data_at_def)\n\n apply (drule vs_lookup_pages_pdeD)\n apply (rule conjI[rotated])\n apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric])\n apply clarsimp\n apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI)\n apply (frule (1) pd_aligned)\n apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr])\n apply (frule valid_vspace_objsD)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (rule refl)\n apply assumption\n apply (simp, drule bspec, fastforce)\n apply (clarsimp simp: pde_ref_pages_def\n split: pde.splits)\n apply (fastforce simp: obj_at_def data_at_def)\n apply (drule_tac p=\"rv\" in vs_lookup_vs_lookup_pagesI')\n apply ((simp add: obj_at_def a_type_def)+)[3]\n apply (frule_tac p=\"rv\" in valid_vspace_objsD)\n apply ((simp add: obj_at_def)+)[2]\n apply (simp add: )\n apply (drule bspec[where x=\"ucast (vaddr >> 20)\"], simp)\n apply (fastforce simp: obj_at_def a_type_def pd_bits_def pageBits_def data_at_def\n split: pde.splits)\n apply (clarsimp simp: obj_at_def a_type_def pd_bits_def pageBits_def)\n done\n\nlemma unmap_page_page_unmapped:\n \"\\pspace_aligned and valid_objs and valid_vspace_objs and\n (\\s. valid_asid_table (arm_asid_table (arch_state s)) s) and\n data_at sz pptr and\n K (p = pptr) and K (sz = ARMSmallPage \\ sz = ARMLargePage)\\\n unmap_page sz asid vaddr pptr\n \\\\rv s. \\ ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable),\n VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ p) s\\\"\n by (rule hoare_pre_imp[OF _ unmap_page_unmapped]) auto\n\nlemma unmap_page_section_unmapped:\n \"\\pspace_aligned and valid_objs and valid_vspace_objs and\n (\\s. valid_asid_table (arm_asid_table (arch_state s)) s) and\n data_at sz pptr and\n K (p = pptr) and K (sz = ARMSection \\ sz = ARMSuperSection)\\\n unmap_page sz asid vaddr pptr\n \\\\rv s. \\ ([VSRef (vaddr >> 20) (Some APageDirectory),\n VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None] \\ p) s\\\"\n by (rule hoare_pre_imp[OF _ unmap_page_unmapped]) auto\n\ncrunch invs[wp]: pte_check_if_mapped, pde_check_if_mapped \"invs\"\n\ncrunch vs_lookup[wp]: pte_check_if_mapped, pde_check_if_mapped \"\\s. P (vs_lookup s)\"\n\ncrunch valid_pte[wp]: pte_check_if_mapped \"\\s. P (valid_pte p s)\"\n\nlemma set_mi_invs[wp]: \"\\invs\\ set_message_info t a \\\\x. invs\\\"\n by (simp add: set_message_info_def, wp)\n\nlemma data_at_orth:\n \"data_at a p s \\ \\ ep_at p s\n \\ \\ ntfn_at p s \\\\ cap_table_at sz p s \\ \\ tcb_at p s \\ \\ asid_pool_at p s\n \\ \\ page_table_at p s \\ \\ page_directory_at p s \\ \\ asid_pool_at p s\"\n apply (clarsimp simp: data_at_def obj_at_def a_type_def)\n apply (case_tac \"kheap s p\",simp)\n subgoal for ko\n by (case_tac ko,auto simp add: is_ep_def is_ntfn_def is_cap_table_def is_tcb_def)\n done\n\nlemma data_at_pg_cap:\n \"\\data_at sz p s;valid_cap cap s; p \\ obj_refs cap\\ \\ is_pg_cap cap\"\n apply (case_tac cap; clarsimp simp: is_pg_cap_def valid_cap_def data_at_orth option.split)\n apply (clarsimp split: arch_cap.split_asm simp: data_at_orth)\n done\n\nlemma perform_page_invs [wp]:\n \"\\invs and valid_page_inv pg_inv\\ perform_page_invocation pg_inv \\\\_. invs\\\"\n apply (simp add: perform_page_invocation_def)\n apply (cases pg_inv, simp_all)\n \\ \\PageMap\\\n apply (rename_tac asid cap cslot_ptr sum)\n apply clarsimp\n apply (rule hoare_pre)\n apply (wpsimp wp: get_master_pte_wp get_master_pde_wp mapM_swp_store_pde_invs_unmap\n store_pde_invs_unmap' hoare_vcg_const_imp_lift hoare_vcg_all_lift\n set_cap_arch_obj arch_update_cap_invs_map\n simp: pte_check_if_mapped_def pde_check_if_mapped_def cte_wp_at_caps_of_state)\n apply (wp (once) hoare_drop_imp)\n apply (wp arch_update_cap_invs_map)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_lift_Pf[where f=vs_lookup, OF _ set_cap.vs_lookup])\n apply (rule_tac f=\"valid_pte xa\" in hoare_lift_Pf[OF _ set_cap_valid_pte_stronger])\n apply wp\n apply (rule hoare_lift_Pf2[where f=vs_lookup, OF _ set_cap.vs_lookup])\n apply (wpsimp wp: dmo_ccr_invs arch_update_cap_invs_map hoare_vcg_const_Ball_lift\n hoare_vcg_const_imp_lift hoare_vcg_all_lift set_cap_typ_at\n hoare_vcg_ex_lift hoare_vcg_ball_lift set_cap_arch_obj set_cap.vs_lookup\n | simp add: same_refs_def del: fun_upd_apply)+\n apply (wp (once) hoare_drop_imp)\n apply (wp arch_update_cap_invs_map hoare_vcg_ex_lift set_cap_arch_obj)\n apply (clarsimp simp: valid_page_inv_def cte_wp_at_caps_of_state neq_Nil_conv\n valid_slots_def empty_refs_def parent_for_refs_def\n simp del: fun_upd_apply del: exE split: sum.splits)\n apply (rule conjI)\n apply (fastforce simp: same_refs_def)\n apply clarsimp\n apply (rule conjI)\n apply (rule_tac x=aa in exI, rule_tac x=ba in exI)\n apply (rule conjI)\n apply (clarsimp simp: is_arch_update_def is_pt_cap_def is_pg_cap_def cap_master_cap_def image_def\n split: Structures_A.cap.splits arch_cap.splits)\n apply (clarsimp simp: is_pt_cap_def cap_asid_def image_def neq_Nil_conv Collect_disj_eq\n split: Structures_A.cap.splits arch_cap.splits option.splits)\n apply (rule conjI)\n apply (drule same_refs_lD)\n apply clarsimp\n apply fastforce\n apply (rule_tac x=aa in exI, rule_tac x=ba in exI)\n apply (clarsimp simp: is_arch_update_def cap_master_cap_def is_cap_simps\n split: Structures_A.cap.splits arch_cap.splits)\n apply (rule conjI)\n apply (erule exEI)\n apply (clarsimp simp: same_refs_def)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=aa in exI, rule_tac x=ba in exI)\n apply (clarsimp simp: is_arch_update_def cap_master_cap_def is_cap_simps\n split: Structures_A.cap.splits arch_cap.splits)\n apply (rule conjI)\n apply (rule_tac x=a in exI, rule_tac x=b in exI, rule_tac x=cap in exI)\n apply (clarsimp simp: same_refs_def)\n apply (rule conjI)\n apply (clarsimp simp: pde_at_def obj_at_def\n caps_of_state_cteD'[where P=\\, simplified])\n apply (drule_tac cap=capc and ptr=\"(aa,ba)\"\n in valid_global_refsD[OF invs_valid_global_refs])\n apply assumption+\n apply (clarsimp simp: cap_range_def)\n apply (clarsimp)\n apply (rule conjI)\n apply (clarsimp simp: pde_at_def obj_at_def a_type_def)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n if_split_asm arch_kernel_obj.splits)\n apply (erule ballEI)\n apply (clarsimp simp: pde_at_def obj_at_def\n caps_of_state_cteD'[where P=\\, simplified])\n apply (drule_tac cap=capc and ptr=\"(aa,ba)\"\n in valid_global_refsD[OF invs_valid_global_refs])\n apply assumption+\n apply (drule_tac x=sl in imageI[where f=\"\\x. x && ~~ mask pd_bits\"])\n apply (drule (1) subsetD)\n apply (clarsimp simp: cap_range_def)\n\n \\ \\PageUnmap\\\n apply (rename_tac arch_cap cslot_ptr)\n apply (rule hoare_pre)\n apply (wp dmo_invs arch_update_cap_invs_unmap_page get_cap_wp\n hoare_vcg_const_imp_lift | wpc | simp)+\n apply (rule_tac Q=\"\\_ s. invs s \\\n cte_wp_at (\\c. is_pg_cap c \\\n (\\ref. vs_cap_ref c = Some ref \\\n \\ (ref \\ obj_ref_of c) s)) cslot_ptr s\"\n in hoare_strengthen_post)\n prefer 2\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps update_map_data_def\n is_arch_update_def cap_master_cap_simps)\n apply (drule caps_of_state_valid, fastforce)\n apply (clarsimp simp: valid_cap_def cap_aligned_def vs_cap_ref_def\n split: option.splits vmpage_size.splits cap.splits)\n apply (simp add: cte_wp_at_caps_of_state)\n apply (wp unmap_page_invs hoare_vcg_ex_lift hoare_vcg_all_lift\n hoare_vcg_imp_lift unmap_page_unmapped)+\n apply (clarsimp simp: valid_page_inv_def cte_wp_at_caps_of_state)\n apply (clarsimp simp: is_cap_simps cap_master_cap_simps is_arch_update_def update_map_data_def\n cap_rights_update_def acap_rights_update_def)\n using valid_validate_vm_rights[simplified valid_vm_rights_def]\n apply (auto simp: valid_cap_def cap_aligned_def mask_def vs_cap_ref_def data_at_def\n split: vmpage_size.splits option.splits if_splits)[1]\n\n \\ \\PageFlush\\\n apply (wpsimp wp: dmo_invs_lift set_vm_root_for_flush_invs)\n apply (simp add: valid_page_inv_def tcb_at_invs)+\n done\n\nend\n\nlocale asid_pool_map = Arch +\n fixes s ap pool asid pdp pd s'\n defines \"(s' :: ('a::state_ext) state) \\\n s\\kheap := kheap s(ap \\ ArchObj (ASIDPool\n (pool(asid \\ pdp))))\\\"\n assumes ap: \"kheap s ap = Some (ArchObj (ASIDPool pool))\"\n assumes new: \"pool asid = None\"\n assumes pd: \"kheap s pdp = Some (ArchObj (PageDirectory pd))\"\n assumes pde: \"empty_table (set (second_level_tables (arch_state s)))\n (ArchObj (PageDirectory pd))\"\nbegin\n\ndefinition\n \"new_lookups \\\n {((rs,p),(rs',p')). rs' = VSRef (ucast asid) (Some AASIDPool) # rs \\\n p = ap \\ p' = pdp}\"\n\nlemma vs_lookup1:\n \"vs_lookup1 s' = vs_lookup1 s \\ new_lookups\"\n using pde pd new ap\n apply (clarsimp simp: vs_lookup1_def new_lookups_def)\n apply (rule set_eqI)\n apply (clarsimp simp: obj_at_def s'_def vs_refs_def graph_of_def)\n apply (rule iffI)\n apply (clarsimp simp: image_def split: if_split_asm)\n apply fastforce\n apply fastforce\n done\n\nlemma vs_lookup_trans:\n \"(vs_lookup1 s')^* = (vs_lookup1 s)^* \\ (vs_lookup1 s)^* O new_lookups^*\"\n using pd pde\n apply (simp add: vs_lookup1)\n apply (rule union_trans)\n apply (subst (asm) new_lookups_def)\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def graph_of_def\n empty_table_def pde_ref_def\n split: if_split_asm)\n done\n\nlemma arch_state [simp]:\n \"arch_state s' = arch_state s\"\n by (simp add: s'_def)\n\nlemma new_lookups_rtrancl:\n \"new_lookups^* = Id \\ new_lookups\"\n using ap pd\n apply -\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI)\n apply (erule rtrancl_induct2)\n apply clarsimp\n apply (clarsimp del: disjCI)\n apply (erule disjE)\n apply clarsimp\n apply (thin_tac \"x \\ R^*\" for x R)\n apply (subgoal_tac \"False\", simp+)\n apply (clarsimp simp: new_lookups_def)\n apply (erule disjE, simp+)\n done\n\nlemma vs_lookup:\n \"vs_lookup s' = vs_lookup s \\ new_lookups^* `` vs_lookup s\"\n unfolding vs_lookup_def\n by (simp add: vs_lookup_trans relcomp_Image Un_Image)\n\nlemma vs_lookup2:\n \"vs_lookup s' = vs_lookup s \\ (new_lookups `` vs_lookup s)\"\n by (auto simp add: vs_lookup new_lookups_rtrancl)\n\nlemma vs_lookup_pages1:\n \"vs_lookup_pages1 s' = vs_lookup_pages1 s \\ new_lookups\"\n using pde pd new ap\n apply (clarsimp simp: vs_lookup_pages1_def new_lookups_def)\n apply (rule set_eqI)\n apply (clarsimp simp: obj_at_def s'_def vs_refs_pages_def graph_of_def)\n apply (rule iffI)\n apply (clarsimp simp: image_def split: if_split_asm)\n apply fastforce\n apply fastforce\n done\n\nlemma vs_lookup_pages_trans:\n \"(vs_lookup_pages1 s')^* =\n (vs_lookup_pages1 s)^* \\ (vs_lookup_pages1 s)^* O new_lookups^*\"\n using pd pde\n apply (simp add: vs_lookup_pages1)\n apply (rule union_trans)\n apply (subst (asm) new_lookups_def)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def\n graph_of_def empty_table_def pde_ref_pages_def\n split: if_split_asm)\n done\n\nlemma vs_lookup_pages:\n \"vs_lookup_pages s' =\n vs_lookup_pages s \\ new_lookups^* `` vs_lookup_pages s\"\n unfolding vs_lookup_pages_def\n by (simp add: vs_lookup_pages_trans relcomp_Image Un_Image)\n\nlemma vs_lookup_pages2:\n \"vs_lookup_pages s' = vs_lookup_pages s \\ (new_lookups `` vs_lookup_pages s)\"\n by (auto simp add: vs_lookup_pages new_lookups_rtrancl)\n\nend\n\ncontext Arch begin global_naming ARM\n\nlemma not_kernel_slot_not_global_pt:\n \"\\pde_ref (pd x) = Some p; x \\ kernel_mapping_slots;\n kheap s p' = Some (ArchObj (PageDirectory pd)); valid_kernel_mappings s\\\n \\ p \\ set (second_level_tables (arch_state s))\"\n apply (clarsimp simp: valid_kernel_mappings_def valid_kernel_mappings_if_pd_def)\n apply (drule_tac x=\"ArchObj (PageDirectory pd)\" in bspec)\n apply ((fastforce simp: ran_def)+)[1]\n apply (simp add: second_level_tables_def split: arch_kernel_obj.split_asm)\n done\n\nlemma set_asid_pool_arch_objs_map:\n \"\\valid_vspace_objs and valid_arch_state and valid_global_objs and\n valid_kernel_mappings and\n ko_at (ArchObj (ASIDPool pool)) ap and\n K (pool asid = None) and\n \\\\ ap and page_directory_at pd and\n (\\s. obj_at (empty_table (set (second_level_tables (arch_state s)))) pd s) \\\n set_asid_pool ap (pool(asid \\ pd))\n \\\\rv. valid_vspace_objs\\\"\n apply (simp add: set_asid_pool_def set_object_def)\n apply (wp get_object_wp)\n apply (simp only: a_type_def[split_simps kernel_object.split arch_kernel_obj.split])\n apply (clarsimp simp del: fun_upd_apply\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (frule (2) valid_vspace_objsD)\n apply (clarsimp simp: valid_vspace_objs_def simp del: valid_vspace_obj.simps)\n apply (case_tac \"p = ap\")\n apply (clarsimp simp: obj_at_def\n simp del: fun_upd_apply valid_vspace_obj.simps)\n apply (clarsimp simp: ran_def)\n apply (case_tac \"a = asid\")\n apply clarsimp\n apply (rule typ_at_same_type)\n apply (simp add: obj_at_def a_type_simps)\n prefer 2\n apply assumption\n apply (simp add: a_type_def)\n apply clarsimp\n apply (erule allE, erule impE, rule exI, assumption)+\n apply (erule typ_at_same_type)\n prefer 2\n apply assumption\n apply (simp add: a_type_def)\n apply (clarsimp simp: obj_at_def a_type_simps)\n apply (frule (3) asid_pool_map.intro)\n apply (subst (asm) asid_pool_map.vs_lookup, assumption)\n apply clarsimp\n apply (erule disjE)\n apply (erule_tac x=p in allE, simp)\n apply (erule impE, blast)\n apply (erule valid_vspace_obj_same_type)\n apply (simp add: obj_at_def a_type_def)\n apply (simp add: a_type_def)\n apply (clarsimp simp: asid_pool_map.new_lookups_rtrancl)\n apply (erule disjE)\n apply clarsimp\n apply (erule_tac x=p in allE, simp)\n apply (erule impE, blast)\n apply (erule valid_vspace_obj_same_type)\n apply (simp add: obj_at_def a_type_def)\n apply (simp add: a_type_def)\n apply (clarsimp simp: asid_pool_map.new_lookups_def empty_table_def)\n done\n\nlemma obj_at_not_pt_not_in_global_pts:\n \"\\ obj_at P p s; valid_arch_state s; valid_global_objs s; \\pt. \\ P (ArchObj (PageTable pt)) \\\n \\ p \\ set (second_level_tables (arch_state s))\"\n unfolding second_level_tables_def\n apply (rule notI, drule(1) valid_global_ptsD)\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma set_asid_pool_valid_arch_caps_map:\n \"\\valid_arch_caps and valid_arch_state and valid_global_objs and valid_objs\n and valid_vspace_objs and ko_at (ArchObj (ASIDPool pool)) ap\n and (\\s. \\rf. (rf \\ ap) s \\ (\\ptr cap. caps_of_state s ptr = Some cap\n \\ pd \\ obj_refs cap \\ vs_cap_ref cap = Some ((VSRef (ucast asid) (Some AASIDPool)) # rf))\n \\ (VSRef (ucast asid) (Some AASIDPool) # rf \\ [VSRef 0 (Some AASIDPool), VSRef 0 None]))\n and page_directory_at pd\n and (\\s. obj_at (empty_table (set (second_level_tables (arch_state s)))) pd s)\n and K (pool asid = None)\\\n set_asid_pool ap (pool(asid \\ pd))\n \\\\rv. valid_arch_caps\\\"\n apply (simp add: set_asid_pool_def set_object_def)\n apply (wp get_object_wp)\n apply clarsimp\n apply (frule obj_at_not_pt_not_in_global_pts[where p=pd], clarsimp+)\n apply (simp add: a_type_def)\n apply (frule obj_at_not_pt_not_in_global_pts[where p=ap], clarsimp+)\n apply (clarsimp simp: obj_at_def valid_arch_caps_def\n caps_of_state_after_update)\n apply (clarsimp simp: a_type_def\n split: Structures_A.kernel_object.split_asm if_split_asm\n arch_kernel_obj.split_asm)\n apply (frule(3) asid_pool_map.intro)\n apply (simp add: fun_upd_def[symmetric])\n apply (rule conjI)\n apply (simp add: valid_vs_lookup_def\n caps_of_state_after_update[folded fun_upd_def]\n obj_at_def)\n apply (subst asid_pool_map.vs_lookup_pages2, assumption)\n apply simp\n apply (clarsimp simp: asid_pool_map.new_lookups_def)\n apply (frule(2) vs_lookup_vs_lookup_pagesI, simp add: valid_arch_state_def)\n apply (simp add: second_level_tables_def)\n apply (drule(2) ref_is_unique)\n apply (simp add: valid_vs_lookup_def)\n apply clarsimp+\n apply (simp add: valid_arch_state_def)\n apply (rule valid_objs_caps, simp)\n apply fastforce\n apply (simp add: valid_table_caps_def\n caps_of_state_after_update[folded fun_upd_def] obj_at_def\n del: imp_disjL)\n apply (clarsimp simp del: imp_disjL)\n apply (drule(1) caps_of_state_valid_cap)+\n apply (auto simp add: valid_cap_def is_pt_cap_def is_pd_cap_def obj_at_def\n a_type_def)[1]\n done\n\nlemma set_asid_pool_asid_map:\n \"\\valid_asid_map and ko_at (ArchObj (ASIDPool pool)) ap\n and K (pool asid = None)\\\n set_asid_pool ap (pool(asid \\ pd))\n \\\\rv. valid_asid_map\\\"\n apply (simp add: set_asid_pool_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: a_type_def)\n apply (clarsimp split: Structures_A.kernel_object.split_asm arch_kernel_obj.split_asm)\n apply (clarsimp simp: obj_at_def)\n apply (clarsimp simp: valid_asid_map_def)\n apply (drule bspec, blast)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule vs_lookup_2ConsD)\n apply clarsimp\n apply (erule vs_lookup_atE)\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (case_tac \"p'=ap\")\n apply (clarsimp simp: obj_at_def)\n apply (rule vs_lookupI)\n apply (clarsimp simp: vs_asid_refs_def graph_of_def)\n apply fastforce\n apply (rule r_into_rtrancl)\n apply (rule_tac r=\"VSRef (a && mask asid_low_bits) (Some AASIDPool)\" in vs_lookup1I)\n apply (simp add: obj_at_def)\n apply (simp add: vs_refs_def graph_of_def)\n apply fastforce\n apply simp\n apply (rule vs_lookupI)\n apply (clarsimp simp: vs_asid_refs_def graph_of_def)\n apply fastforce\n apply (rule r_into_rtrancl)\n apply (rule vs_lookup1I)\n apply (simp add: obj_at_def)\n apply simp\n apply (simp split: if_splits)+\n done\n\nlemma set_asid_pool_invs_map:\n \"\\invs and ko_at (ArchObj (ASIDPool pool)) ap\n and (\\s. \\rf. (rf \\ ap) s \\ (\\ptr cap. caps_of_state s ptr = Some cap\n \\ pd \\ obj_refs cap \\ vs_cap_ref cap = Some ((VSRef (ucast asid) (Some AASIDPool)) # rf))\n \\ (VSRef (ucast asid) (Some AASIDPool) # rf \\ [VSRef 0 (Some AASIDPool), VSRef 0 None]))\n and page_directory_at pd\n and (\\s. obj_at (empty_table (set (second_level_tables (arch_state s)))) pd s)\n and K (pool asid = None)\\\n set_asid_pool ap (pool(asid \\ pd))\n \\\\rv. invs\\\"\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (rule hoare_pre, wp valid_irq_node_typ set_asid_pool_typ_at set_asid_pool_arch_objs_map valid_irq_handlers_lift\n set_asid_pool_valid_arch_caps_map set_asid_pool_asid_map)\n apply clarsimp\n apply auto\n done\n\nlemma perform_asid_pool_invs [wp]:\n \"\\invs and valid_apinv api\\ perform_asid_pool_invocation api \\\\_. invs\\\"\n apply (clarsimp simp: perform_asid_pool_invocation_def split: asid_pool_invocation.splits)\n apply (wp arch_update_cap_invs_map set_asid_pool_invs_map\n get_cap_wp set_cap_typ_at\n empty_table_lift[unfolded pred_conj_def, OF _ set_cap_obj_at_other]\n set_cap_obj_at_other\n |wpc|simp|wp (once) hoare_vcg_ex_lift)+\n apply (clarsimp simp: valid_apinv_def cte_wp_at_caps_of_state is_arch_update_def is_cap_simps cap_master_cap_simps)\n apply (frule caps_of_state_cteD)\n apply (drule cte_wp_valid_cap, fastforce)\n apply (simp add: valid_cap_def cap_aligned_def)\n apply (clarsimp simp: cap_asid_def split: option.splits)\n apply (rule conjI)\n apply (clarsimp simp: vs_cap_ref_def)\n apply (rule conjI)\n apply (erule vs_lookup_atE)\n apply clarsimp\n apply (drule caps_of_state_cteD)\n apply (clarsimp simp: cte_wp_at_cases obj_at_def)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI, assumption)\n apply (rule conjI)\n apply (rule_tac x=a in exI)\n apply (rule_tac x=b in exI)\n apply (clarsimp simp: vs_cap_ref_def mask_asid_low_bits_ucast_ucast)\n apply (clarsimp simp: asid_low_bits_def[symmetric] ucast_ucast_mask\n word_neq_0_conv[symmetric])\n apply (erule notE, rule asid_low_high_bits, simp_all)[1]\n apply (simp add: asid_high_bits_of_def)\n apply (rule conjI)\n apply (erule(1) valid_table_caps_pdD [OF _ invs_pd_caps])\n apply (rule conjI)\n apply clarsimp\n apply (drule caps_of_state_cteD)\n apply (clarsimp simp: obj_at_def cte_wp_at_cases a_type_def)\n apply (clarsimp split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n apply (clarsimp simp: obj_at_def)\n done\n\nlemma invs_aligned_pdD:\n \"\\ pspace_aligned s; valid_arch_state s \\ \\ is_aligned (arm_global_pd (arch_state s)) pd_bits\"\n apply (clarsimp simp: valid_arch_state_def)\n apply (drule (1) pd_aligned)\n apply (simp add: pd_bits_def pageBits_def)\n done\n\nlemma valid_vspace_obj_default:\n assumes tyunt: \"ty \\ Structures_A.apiobject_type.Untyped\"\n shows \"ArchObj ao = default_object ty dev us \\ valid_vspace_obj ao s'\"\n apply (cases ty, simp_all add: default_object_def tyunt)\n apply (simp add: valid_vspace_obj_default')\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM/ArchVSpace_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.26284183159693775, "lm_q1q2_score": 0.16167081853687557}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__56_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__56_on_rules imports n_germanSimp_lemma_on_inv__56\nbegin\nsection{*All lemmas on causal relation between inv__56*}\nlemma lemma_inv__56_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__56 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__56) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__56_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3208213138121609, "lm_q1q2_score": 0.1616638396671944}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__58_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__58_on_rules imports n_germanSimp_lemma_on_inv__58\nbegin\nsection{*All lemmas on causal relation between inv__58*}\nlemma lemma_inv__58_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__58 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__58) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__58) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__58_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.32082129433083023, "lm_q1q2_score": 0.16166382985043165}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__35_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__35_on_rules imports n_g2kAbsAfter_lemma_on_inv__35\nbegin\nsection{*All lemmas on causal relation between inv__35*}\nlemma lemma_inv__35_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__35 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__35) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__35) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__35_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.30404168757891037, "lm_q1q2_score": 0.16150979433829235}} {"text": "theory DriverProof\n imports Main \"HOL-Word.Word\" \"Word_Lib.Word_Lib\" \"DriverSpec\"\n \"generated/Driver_Shallow_Desugar\"\nbegin\n\n(* 12:55 *)\nfun curry_triple :: \"(('a, 'b, 'c) TimeoutInput \\ 'z) \\ ('a \\ 'b \\ 'c \\ 'z)\" where\n \"curry_triple f a b c = f (\\ TimeoutInput.p1\\<^sub>f = a, p2\\<^sub>f = b, p3\\<^sub>f = c \\)\"\n\n\ntype_synonym concr_device_state = \"Meson_timer_reg\\<^sub>T\"\ntype_synonym concr_state = \"Meson_timer\\<^sub>T\"\n\ndefinition concr_driver :: \"(concr_state, 64 word, 16 word, bool) driver\"\n where\n \"concr_driver = \n\\ \n get_time = meson_get_time_cogent,\n initialize = meson_init_cogent,\n stop_timer = meson_stop_timer_cogent,\n set_timeout = curry_triple meson_set_timeout_cogent,\n\\ \\we are going to multiply it by 1000 (\\ 1024 = 2^10) \\\n stateInv = (\\s. timer_e_hi\\<^sub>f (regs\\<^sub>f s) < 2^(32-10)\n \\ disable\\<^sub>f s = Not (timer_a_en\\<^sub>f (regs\\<^sub>f s)) ),\niniDeviceInv = (\\s. (disable\\<^sub>f s = True \\ Not (timer_a_en\\<^sub>f (regs\\<^sub>f s))))\n \n\\\n\"\n\nlocale concr_is_refinement = \n is_refinement concr_driver mor\n for mor :: \"(concr_state, 64 word, 16 word, bool) driver_abstr\"\n\n \n\nfun \\timeout_timebase :: \"Timeout_timebase\\<^sub>T \\ DriverSpec.timeout_timebase\"\n where \n \"\\timeout_timebase (COGENT_TIMEOUT_TIMEBASE_100_US _) = DriverSpec.TIMEOUT_TIMEBASE_1_US\"\n| \"\\timeout_timebase (COGENT_TIMEOUT_TIMEBASE_10_US _) = DriverSpec.TIMEOUT_TIMEBASE_10_US\"\n| \"\\timeout_timebase (COGENT_TIMEOUT_TIMEBASE_1_MS _) = DriverSpec.TIMEOUT_TIMEBASE_1_MS\"\n| \"\\timeout_timebase (COGENT_TIMEOUT_TIMEBASE_1_US _) = DriverSpec.TIMEOUT_TIMEBASE_1_US\"\n \n \nfun \\timestamp_timebase :: \"Timestamp_timebase\\<^sub>T \\ DriverSpec.timestamp_timebase\"\n where \n \"\\timestamp_timebase (COGENT_TIMESTAMP_TIMEBASE_100_US _) = DriverSpec.TIMESTAMP_TIMEBASE_100_US\"\n| \"\\timestamp_timebase (COGENT_TIMESTAMP_TIMEBASE_10_US _) = DriverSpec.TIMESTAMP_TIMEBASE_10_US\"\n| \"\\timestamp_timebase (COGENT_TIMESTAMP_TIMEBASE_1_MS _) = DriverSpec.TIMESTAMP_TIMEBASE_1_MS\"\n| \"\\timestamp_timebase (COGENT_TIMESTAMP_TIMEBASE_1_US _) = DriverSpec.TIMESTAMP_TIMEBASE_1_US\"\n| \"\\timestamp_timebase (COGENT_TIMESTAMP_TIMEBASE_SYSTEM _) = DriverSpec.TIMESTAMP_TIMEBASE_SYSTEM\"\n\n\ndefinition \\_timer_mode :: \"bool \\ timer_mode\"\n where \"\\_timer_mode b = (if b then Periodic else NotPeriodic)\"\n\ndefinition \\_reg :: \"concr_device_state \\ device_state\" where\n\"\\_reg ds = \n \\ timer_a_mode = \\_timer_mode (timer_a_mode\\<^sub>f ds) ,\n timer_a_en = timer_a_en\\<^sub>f ds,\ntimer_a = unat (timer_a\\<^sub>f ds),\ntimer_a_input_clk = \\timeout_timebase (timer_a_input_clk\\<^sub>f ds),\ntimer_e_input_clk = \\timestamp_timebase (timer_e_input_clk\\<^sub>f ds),\ntimer_e_low_hi = unat (word_cat (timer_e_hi\\<^sub>f ds) (timer_e\\<^sub>f ds) :: 64 word)\n\n \\ \"\n\ndefinition \\_state :: \"concr_state \\ abstr_state\" where\n\"\\_state s = \n \\ \n driverState = \\ disable = disable\\<^sub>f s \\,\n deviceState = \\_reg (regs\\<^sub>f s)\n \\\"\n\ndefinition abstraction :: \"(concr_state, 64 word, 16 word, bool) driver_abstr\"\n where \"abstraction = \n \\\n mor_state = \\_state,\n mor_time = unat, \n mor_timeout = unat,\n mor_timer_mode = \\_timer_mode \n \\\"\n\nlemmas driver_defs = concr_driver_def abs_driver_def abstraction_def\nlemmas simp_defs = driver_defs \\_state_def \\_reg_def (* \\timeout_timebase_def \n \\timestamp_timebase_def *)\n\n\n\nlemma unat_ucast_up : \n \" LENGTH('a :: len0) \\ LENGTH('b ::len0) \\ \nunat (UCAST('a \\ 'b) w) = unat w\"\n by (simp add: unat_def uint_up_ucast is_up)\n\n\nlemma helper1 : \"\n((UCAST(32 \\ 64) x << 32) || UCAST(32 \\ 64) y)\n= word_cat x y\"\n by word_bitwise\n\nlemma helper2 : \"\n(h :: int) < 4194304 \\ l < 2^32 \\ 536870912000 * h + 125 * l < 2305843009213693952\n\" \n \n apply(rule less_le_trans)\n apply(rule add_strict_mono)\n apply(erule mult_strict_left_mono)\n apply simp\n apply(erule mult_strict_left_mono)\n apply simp\n apply simp\n done\n\n\ninterpretation concr_implementation:\n concr_is_refinement abstraction\n apply unfold_locales\n apply (simp add:simp_defs meson_get_time_cogent_def ns_in_us_def)\n\n apply(case_tac s, rename_tac regs disable, case_tac regs)\n apply clarsimp\n apply(simp add:helper1)\n apply(simp add:unat_def)\n apply (subst uint_mult_lem[THEN HOL.iffD1])\n apply simp\n apply(simp add:word_cat_def )\n apply(subst word_ubin.eq_norm)\n \n apply simp\n apply(simp add:bintr_cat)\n apply(subst word_ubin.norm_norm(2)[THEN fun_cong, simplified comp_def, of \"_ :: 32 word\", simplified])\n apply(simp add:bin_cat_num)\n apply(subst word_ubin.norm_norm(2)[THEN fun_cong, simplified comp_def, of \"_ :: 32 word\", simplified])\n apply(simp add:word_less_alt)\n apply(erule helper2)\n\n\n apply(uint_arith, simp)\n apply simp\n\n\n apply (simp add:simp_defs meson_init_cogent_def meson_get_time_cogent_def ns_in_us_def\n reset_timer_e_def)\n apply(case_tac s, rename_tac regs disable, case_tac regs)\n apply(simp add: take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n (* hmm *)\n apply clarsimp\n apply(simp add:word_cat_def)\n\n(* yeah! *)\n apply (simp add:simp_defs meson_stop_timer_cogent_def ns_in_us_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n\n \n \n apply(simp add:simp_defs meson_set_timeout_cogent_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def Let\\<^sub>d\\<^sub>s_def)\n apply(simp add:unat_ucast_up)\n\n(* invariants *)\n apply(simp add:simp_defs meson_init_cogent_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def Let\\<^sub>d\\<^sub>s_def reset_timer_e_def)\n apply(simp add:simp_defs meson_stop_timer_cogent_def ns_in_us_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n\n apply(simp add:simp_defs meson_init_cogent_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def Let\\<^sub>d\\<^sub>s_def reset_timer_e_def)\n apply(simp add:simp_defs meson_stop_timer_cogent_def ns_in_us_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def)\n\n apply(simp add:simp_defs meson_set_timeout_cogent_def take\\<^sub>c\\<^sub>o\\<^sub>g\\<^sub>e\\<^sub>n\\<^sub>t_def Let\\<^sub>d\\<^sub>s_def)\n \n by(simp add: HOL.Let_def )\n \n\nend\n", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/timer-driver-cogent/verified_cogent_driver/DriverProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.542863297964157, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.16148551408764736}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__56_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__56_on_rules imports n_g2kAbsAfter_lemma_on_inv__56\nbegin\nsection{*All lemmas on causal relation between inv__56*}\nlemma lemma_inv__56_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__56 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__56) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__56) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__56_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.2974699363766585, "lm_q1q2_score": 0.16148550630654906}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__12_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__12_on_rules imports n_german_lemma_on_inv__12\nbegin\nsection{*All lemmas on causal relation between inv__12*}\nlemma lemma_inv__12_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__12 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__12) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__12) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__12_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.3106943832145539, "lm_q1q2_score": 0.16141235669071521}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__25_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__25_on_rules imports n_german_lemma_on_inv__25\nbegin\nsection{*All lemmas on causal relation between inv__25*}\nlemma lemma_inv__25_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__25 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__25) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__25) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__25_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.16141235669071521}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__6_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__6_on_rules imports n_g2kAbsAfter_lemma_on_inv__6\nbegin\nsection{*All lemmas on causal relation between inv__6*}\nlemma lemma_inv__6_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__6 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__6) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__6) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__6_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3106943704494217, "lm_q1q2_score": 0.16141235005895682}} {"text": "theory javacap_security_static\nimports\n Main\n javacap_syntax\n javacap_auxiliary\n javacap_static\n javacap_runtime_representation\n javacap_operational\nbegin \n\ninductive allowed_transition :: \"prog \\ label \\ State \\ State \\ bool\" (\"_ _ \\ \\_\\ \\\\<^sub>A \\_\\\" 50)\n for P :: \"prog\"\n where \n at_reflexive: \"P \\ \\ \\S\\ \\\\<^sub>A \\S\\\" |\n at_trans: \"\\ P \\ \\ \\S\\ \\\\<^sub>A \\S1\\; P \\ \\ \\S1\\ \\\\<^sub>A \\S2\\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S2\\\" |\n at_cap_call: \"\\ (* any state change by a type-correct call to a capability of a type in \\\n is allowed *)\n P M \\ \\<^bold>\\ S; P M \\ \\ (calli x mname args) : T; P \\ \\(calli x mname args) | S\\ \\\\<^sub>e \\v | S'\\;\n \\\\x\\\\<^sub>v = Some (tcap,\\cap); tcap = IfaceT cbname; is_cap P cbname; cbname \\ \\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" | \n at_stack_update: \"\\ (* no restrictions on stack updates beyond standard type-correctness \n and integrity of labels *) \n S' = S\\stack := s'\\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" |\n at_except_update: \"\\ (* no restrictions on exception raising beyond standard type-correctness \n and integrity of labels *) \n S' = S\\except := e'\\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" |\n at_retval_update: \"\\ (* no restrictions on returning beyond standard type-correctness \n and integrity of labels *) \n S' = S\\retval := r'\\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" |\n at_heap_update: \"\\ (* the new object must have a label less than gamma\n N.B. heap extension property of preservation proof already guarantees that \n if we are updating an existing object, the updated object will have\n the same label as the original label *)\n (HLabel obj') \\ \\; \n S' = S\\heap := (heap S)(l\\obj')\\\n \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" |\n at_globals_update: \"\\ is_class P c; field P c f = Some fdecl; tlabel (ftype fdecl) \\ \\;\n classStatics = the ((globals S) c);\n S' = S\\globals := (globals S)(c\\(classStatics(f\\v)))\\ \n \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\" |\n at_privs_update: \"\\ (* We don't really need to show this is true, but provides \n some confidence. *)\n S' = S\\privs:= \\'\\; \\' \\ \\ \\ \\ P \\ \\ \\S\\ \\\\<^sub>A \\S'\\\"\n\nlemma allowed_transition_expr_new:\n assumes op1: \"v = href l\"\n assumes op2: \"l \\ dom (heap S)\"\n assumes op3: \"S' = S\\heap := (heap S)(l \\ new_object P cname (lbl \\ privs S))\\\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ new lbl cname : T\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n (* presently unused *)\n have \"(P M \\ \\<^bold>\\ S') \\ (transition_ok S S') \\ (is_expr_value_ok P S' T v)\"\n using preservation_expr_new assms by simp\n\n have \"HLabel (new_object P cname (lbl \\ privs S)) \\ \\\"\n using gamma unfolding new_object_def by auto\n then show \"allowed_transition P \\ S S'\"\n using op3 at_heap_update by simp\nqed\n\nlemma allowed_transition_expr_calli:\n assumes op1: \"a = the (stack S x)\"\n assumes op2: \"l = the_href a\"\n assumes op3: \"a \\ v.null\"\n assumes op4: \"obj = the (heap S l)\"\n assumes op5: \"(d, m) = the (cmethod P (HClass obj) mname)\"\n assumes op6: \"s = the (mstmt m)\"\n assumes s0: \"S0 = S\\stack := (stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args)(This \\ a), retval := None, privs := (HLabel obj)\\\"\n assumes s': \"S' = S1\\stack := stack S, retval := retval S, privs := privs S\\\"\n assumes retval_if_noexcept: \"except S1 = None \\ retval S1 \\ None\"\n assumes v: \"v = the (retval S1)\"\n assumes \"P \\ \\s | S0\\ \\\\<^sub>s \\S1\\\"\n (* induction hypothesis *)\n assumes hyp: \"(\\M \\. (P M \\ \\<^bold>\\ S0) \\ (P M \\ \\ s \\) \\ privs S0 \\ \\ \\ (P \\ \\ \\S0\\ \\\\<^sub>A \\S1\\))\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes wf: \"P M \\ \\ calli x mname args : T\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n (* Bits of this proof have been taken from the preservation proof. *)\n define M0 where \"M0 = call_menv d m\"\n moreover define \\0 where \"\\0 = call_lenvi P d (mdecl m)\"\n ultimately have a1: \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\" using calli_prems assms by metis\n \n obtain t0 \\0 decl t' where a2: \"(\\\\x\\\\<^sub>v = Some (t0,\\0)) \\ methoddecl P t0 mname = Some decl \\\n is_type P t0 \\ (\\t. t0 \\ (ValT t)) \\ \\mstatic decl \\\n wf_method_call P \\ decl args \\0 (t',(tlabel T)) \\ (subsumption P t' (ttype T))\"\n using wf wf_expr_calli_intro by (metis prod.collapse) \n \n (* Infer the the object pointed to by x exists, and has a runtime type compatible with the static type t0. *)\n have a3: \"a = (href l) \\ heap S l = Some obj \\ (P \\ (ClassT (HClass obj)) <: t0) \\ is_obj_label_ok P obj (intersect_label (t0,\\0) (privs S))\"\n using object_correspondence a2 op1 op2 op3 op4 corr by (metis fst_conv) \n\n show ?thesis proof (cases \"is_cap_type P t0\")\n case True\n then obtain cbname where b1: \"t0 = IfaceT cbname \\ is_cap P cbname\"\n by (metis \\.exhaust a2 is_cap_type.simps(2) is_cap_type.simps(3))\n then have b2: \"\\0 \\ (privs S) = (cap_label P cbname) \\ (HLabel obj) \\\n (* This gives some 'meaning' to the labels. *)\n (superinterface_set P cbname) \\ \\0 \\ (privs S)\"\n using a3 intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by auto\n then have b3: \"cbname \\ \\\"\n unfolding superinterface_set_def using gamma by auto\n moreover have \"(\\\\x\\\\<^sub>v = Some (t0,\\0))\" using a2 by simp\n moreover have \"P \\ \\(calli x mname args) | S\\ \\\\<^sub>e \\v | S'\\\" using assms op_expr_calli by simp\n ultimately show \"allowed_transition P \\ S S'\"\n using at_cap_call corr wf b1 by simp\n next\n case False\n then have \"(HLabel obj) = \\0 \\ (privs S)\"\n using a3 intersect_label_label intersect_label_type unfolding is_obj_label_ok_def by auto\n then have b1: \"(HLabel obj) \\ \\\" using gamma by auto\n then have \"allowed_transition P \\ S S0\"\n using at_stack_update at_retval_update at_privs_update at_trans s0 by metis\n moreover have \"allowed_transition P \\ S0 S1\"\n using hyp a1 s0 b1 by fastforce\n moreover have \"allowed_transition P \\ S1 S'\"\n using at_stack_update at_retval_update at_privs_update at_trans s' gamma by metis\n ultimately show ?thesis\n using at_trans by metis\n qed\nqed\n\nlemma allowed_transition_expr_calls:\n assumes op5: \"(d, m) = the (cmethod P c mname)\"\n assumes \"P \\ \\s | S0\\ \\\\<^sub>s \\S1\\\"\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S0) \\ (P M \\ \\ s \\) \\ privs S0 \\ \\ \\ (P \\ \\ \\S0\\ \\\\<^sub>A \\S1\\)\"\n assumes \"s = the (mstmt m)\"\n assumes s0: \"S0 = S\\stack := stack S \\\\<^sub>m map_formalpar_to_args (mdecl m) args, retval := None, privs := (privs S) \\ lbl\\\"\n assumes s': \"S' = S1\\stack := stack S, retval := retval S, privs := privs S\\\"\n assumes retval_if_noexcept: \"except S1 = None \\ retval S1 \\ None\"\n assumes v: \"v = the (retval S1)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wfp: \"wf_prog P\"\n assumes wf: \"P M \\ \\ calls c mname lbl args : T\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n have \"privs S \\ lbl \\ \\\"\n using gamma by auto\n then have \"allowed_transition P \\ S S0\"\n using at_stack_update at_retval_update at_privs_update at_trans s0 by metis\n moreover have \"allowed_transition P \\ S0 S1\"\n proof -\n define M0 where \"M0 = call_menv d m\"\n moreover define \\0 where \"\\0 = call_lenvs P (mdecl m)\"\n ultimately have \"(P M0 \\0 \\<^bold>\\ S0) \\ (P M0 \\0 \\ s \\)\" using calls_prems assms by metis\n moreover have \"privs S0 \\ \\\"\n using gamma s0 by auto\n ultimately show ?thesis using hyp by blast\n qed\n moreover have \"allowed_transition P \\ S1 S'\"\n using at_stack_update at_retval_update at_privs_update at_trans s' gamma by metis\n ultimately show ?thesis \n using at_trans by metis\nqed\n\n\nlemma allowed_transition_stmt_assignfi:\n assumes op1: \"no_exception_or_return S\" (* unused *)\n assumes op2: \"a = the (stack S1 x)\"\n assumes op3: \"a \\ v.null\"\n assumes op4: \"l = the_href a\"\n assumes op5: \"obj = the (heap S1 l)\"\n assumes op6: \"S' = (if except S1 = None then S1\\heap := heap S1(l \\ obj\\HFields := HFields obj(f \\ v)\\)\\ else S1)\"\n assumes op7: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\" (* unused *)\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (privs S \\ \\) \\ allowed_transition P \\ S S1\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ assignfi x f e \\\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n obtain T where a1: \"wf_fieldi_access P \\ x f T \\ (P M \\ \\ e : T)\"\n using wf wf_stmt_assignfi_intro by blast\n obtain c \\0 fdecl where a2: \"(\\\\x\\\\<^sub>v = Some ((ClassT c),\\0)) \\ field P c f = Some fdecl \\\n \\fstatic fdecl \\ T = intersect_label (ftype fdecl) \\0\"\n using a1 unfolding wf_fieldi_access_def by blast\n have a3: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using preservation op7 wfp corr a1 by metis\n\n have \"allowed_transition P \\ S S1\"\n using a1 corr gamma hyp by blast\n moreover have \"allowed_transition P \\ S1 S'\" proof (cases \"except S1\")\n case None\n have \"heap S1 l = Some obj \\ (P \\ (ClassT (HClass obj)) <: (ClassT c)) \\ \n is_obj_label_ok P obj (intersect_label ((ClassT c),\\0) (privs S1))\" \n using object_correspondence a2 a3 op2 op3 op4 op5 by (metis \\.simps(5) fst_conv)\n then have \"HLabel obj \\ (privs S1)\"\n unfolding is_obj_label_ok_def by (simp add: intersect_label_label intersect_label_type) \n then have \"HLabel obj \\ \\\"\n using a3 gamma unfolding transition_ok_def by simp \n then show ?thesis using at_heap_update op6 None by simp\n next\n case (Some a)\n then have \"S' = S1\" using op6 by simp\n then show ?thesis using at_reflexive by simp\n qed\n ultimately show ?thesis using at_trans by metis\nqed\n\nlemma allowed_transition_stmt_assignfs:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"classStatics = the (globals S1 c)\"\n assumes op3: \"S' = (if except S1 = None then S1\\globals := globals S1(c \\ classStatics(f \\ v))\\ else S1)\"\n assumes op4: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes hyp: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (privs S \\ \\) \\ allowed_transition P \\ S S1\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ assignfs c f e \\\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n obtain T where a1: \"wf_fields_access P M c f T \\ (P M \\ \\ e : T)\"\n using wf wf_stmt_assignfs_intro by blast\n then obtain fdecl where a2: \"is_class P c \\ field P c f = Some fdecl \\ fstatic fdecl \\ \n (T = (ftype fdecl) \\ (tlabel (ftype fdecl)) \\ (msreq M))\"\n using wf_fields_access_def by auto\n have a3: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using preservation op4 wfp a1 corr by blast\n \n have \"allowed_transition P \\ S S1\"\n using a1 corr gamma hyp by blast\n moreover have \"allowed_transition P \\ S1 S'\" proof (cases \"except S1\")\n case None\n have \"(tlabel (ftype fdecl)) \\ \\\"\n using a2 corr gamma unfolding corr_def by auto\n then show ?thesis using a2 at_globals_update op2 op3 None by metis\n next\n case (Some a)\n then show ?thesis using op3 at_reflexive by simp\n qed\n ultimately show ?thesis using at_trans by metis\nqed\n\nlemma allowed_transition_stmt_letin:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"P \\ \\e | S\\ \\\\<^sub>e \\v | S1\\\"\n assumes op3: \"S2 = (if except S1 = None then S1\\stack := stack S1(x \\ v)\\ else S1)\"\n assumes op4: \"P \\ \\s | S2\\ \\\\<^sub>s \\S3\\\"\n assumes op5: \"S' = S3\\stack := (stack S3)(x := stack S x)\\\"\n assumes hype: \"\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (privs S) \\ \\ \\ allowed_transition P \\ S S1\"\n assumes hyps: \"\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ s \\) \\ (privs S2) \\ \\ \\ allowed_transition P \\ S2 S3\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ letin T x e s \\\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n have wfi: \"(P M \\ \\ e : T) \\ (P M \\(x\\T) \\ s \\)\"\n using wf wf_stmt_letin_intro by simp\n then have \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\ is_expr_value_ok P S1 T v\"\n using wfp preservation op2 corr by metis\n (* If the exception did not throw an exception during evaluation, the assignment occurs \n and S2 is type-correct to \\(x\\T). Otherwise the assignment does not occur and we\n end-up correct to \\ only. We rely on the fact that the let-in body will not be executed\n in this case (due to an unhandled exception.) *)\n then have a2: \"(except S2 = None \\ (P M \\(x\\T) \\<^bold>\\ S2)) \\ \n (except S2 \\ None \\ (P M \\ \\<^bold>\\ S2)) \\ transition_ok S S2\"\n using preservation_stmt_assign_base op3 by metis\n\n have a1: \"allowed_transition P \\ S S1\"\n using wfi hype corr gamma by blast\n moreover have \"allowed_transition P \\ S1 S2\"\n using op3 at_stack_update at_reflexive by simp\n moreover have \"allowed_transition P \\ S2 S3\"\n proof (cases \"except S2\")\n case None\n then have \"(P M \\(x \\ T) \\<^bold>\\ S2) \\ (privs S2 \\ \\)\"\n using a2 gamma unfolding transition_ok_def by simp\n then show \"allowed_transition P \\ S2 S3\"\n using hyps wfi by metis\n next\n case (Some a)\n then have \"S2 = S3\"\n using exception_or_return_skips op4 unfolding no_exception_or_return_def by simp\n then show \"allowed_transition P \\ S2 S3\"\n using at_reflexive by simp\n qed\n moreover have \"allowed_transition P \\ S3 S'\"\n using op5 at_stack_update at_reflexive by simp\n ultimately show ?thesis \n using at_trans by metis\nqed\n\nlemma allowed_transition_stmt_seq:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"P \\ \\s1 | S\\ \\\\<^sub>s \\S1\\\"\n assumes op3: \"\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s1 \\) \\ privs S \\ \\ \\ (P \\ \\ \\S\\ \\\\<^sub>A \\S1\\)\"\n assumes op4: \"P \\ \\s2 | S1\\ \\\\<^sub>s \\S2\\\"\n assumes op5: \"\\M \\. (P M \\ \\<^bold>\\ S1) \\ (P M \\ \\ s2 \\) \\ privs S1 \\ \\ \\ (P \\ \\ \\S1\\ \\\\<^sub>A \\S2\\)\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ seq s1 s2 \\\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S2\"\nproof -\n have a1: \"(P M \\ \\ s1 \\) \\ (P M \\ \\ s2 \\)\"\n using wf wf_stmt_seq_intro by metis\n have a2: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1\"\n using wfp preservation op2 corr a1 by metis\n\n have \"allowed_transition P \\ S S1\"\n using op3 corr a1 gamma by metis\n moreover have \"allowed_transition P \\ S1 S2\"\n using op5 a1 a2 gamma unfolding transition_ok_def by metis\n ultimately show ?thesis using at_trans by metis\nqed\n\n\nlemma allowed_transition_stmt_trycatch_ex:\n assumes op1: \"no_exception_or_return S\"\n assumes op2: \"except S1 = Some ex\"\n assumes op3: \"a = the_href ex\"\n assumes op4: \"exObj = the (heap S1 a)\"\n assumes op5: \"P \\ \\s | S\\ \\\\<^sub>s \\S1\\\"\n assumes op6: \"i = Min {j::nat. (j = length ch) \\ ((j < length ch) \\ (P \\ (ClassT (HClass exObj)) <: (chtype (ch !j)))) }\"\n assumes op7: \"if i < length ch\n then h = ch ! i \\\n var = chvar h \\\n S2 = S1\\except := None, stack := (stack S1)(var \\ ex)\\ \\\n ((P \\ \\chstmt h | S2\\ \\\\<^sub>s \\S3\\) \\ (\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ chstmt h \\) \\ (privs S2) \\ \\\n \\ allowed_transition P \\ S2 S3)) \\ \n S' = S3\\stack := (stack S3)(var := stack S1 var)\\\n else S' = S1\"\n assumes hyp: \"\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\) \\ (privs S) \\ \\ \\allowed_transition P \\ S S1\"\n assumes corr: \"P M \\ \\<^bold>\\ S\"\n assumes wf: \"P M \\ \\ trycatch s ch \\\"\n assumes wfp: \"wf_prog P\"\n assumes gamma: \"(privs S) \\ \\\"\n shows \"allowed_transition P \\ S S'\"\nproof -\n (* Need to statisfy induction hypothesis of existing proof *)\n have \"if i < length ch\n then h = ch ! i \\\n var = chvar h \\\n S2 = S1\\except := None, stack := (stack S1)(var \\ ex)\\ \\\n ((P \\ \\chstmt h | S2\\ \\\\<^sub>s \\S3\\) \\ (\\M \\. (P M \\ \\<^bold>\\ S2) \\ (P M \\ \\ chstmt h \\)\n \\ (P M \\ \\<^bold>\\ S3) \\ transition_ok S2 S3)) \\ \n S' = S3\\stack := (stack S3)(var := stack S1 var)\\\n else S' = S1\"\n using op7 preservation wfp by meson\n moreover have \"\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\) \\ (P M \\ \\<^bold>\\ S1) \\ transition_ok S S1\"\n using preservation op5 wfp by meson\n moreover define \\' where \"\\' = \\(var \\ ((chtype h),{}))\"\n ultimately have a1: \"(P M \\ \\<^bold>\\ S1) \\ transition_ok S S1 \\\n (i < length ch \\ (P M \\' \\<^bold>\\ S2) \\ (P M \\' \\ chstmt h \\) \\ transition_ok S1 S2 \\\n (P M \\' \\<^bold>\\ S3) \\ transition_ok S2 S3 \\ transition_ok S3 S') \\\n (P M \\ \\<^bold>\\ S') \\ transition_ok S1 S'\"\n using preservation_stmt_trycatch_ex_helper assms by blast\n\n have a2: \"(P M \\ \\ s \\) \\ (\\(t,x,s')\\(set ch). (P M \\(x\\(t,{})) \\ s' \\) \\ \\is_cap_type P t)\"\n using wf wf_stmt_trycatch_intro by simp\n\n have \"allowed_transition P \\ S S1\" using corr hyp a2 gamma by metis\n moreover have \"allowed_transition P \\ S1 S'\"\n proof (cases \"i < length ch\")\n case True\n then have \"allowed_transition P \\ S1 S2\"\n using op7 at_stack_update at_except_update at_trans by metis\n moreover have \"allowed_transition P \\ S2 S3\"\n proof -\n have \"privs S2 \\ \\\" using a1 True gamma unfolding transition_ok_def by simp\n then show ?thesis using op7 a1 True by metis\n qed\n moreover have \"allowed_transition P \\ S3 S'\"\n using op7 True at_stack_update by metis\n ultimately show ?thesis using at_trans by metis\n next\n case False\n then show ?thesis using op7 at_reflexive by metis\n qed\n ultimately show ?thesis using at_trans by metis\nqed\n\nlemma security_proof_state:\n assumes wfp: \"wf_prog P\"\n shows \"((P \\ \\e | S\\ \\\\<^sub>e \\v | S'\\) \\ (\\M \\ T. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ e : T) \\ (privs S) \\ \\ \\ (allowed_transition P \\ S S')))\n \\ ((P \\ \\s | S\\ \\\\<^sub>s \\S'\\) \\ (\\M \\. (P M \\ \\<^bold>\\ S) \\ (P M \\ \\ s \\) \\ (privs S) \\ \\ \\ (allowed_transition P \\ S S')))\"\nproof (induction S S' rule: op_expr_op_stmt.induct)\n case (op_expr_ref v S x)\n then show ?case using at_reflexive by simp\nnext\n case (op_expr_new v l S S' cname lbl)\n then show ?case using allowed_transition_expr_new wfp by blast\nnext\n case (op_expr_calli a S x l obj d m mname s S0 args S1 S' v)\n then show ?case using allowed_transition_expr_calli wfp by force\nnext\n case (op_expr_calls d m c mname s S0 S lbl args S1 S' v)\n then show ?case using allowed_transition_expr_calls wfp by force\nnext\n case (op_expr_cast e S v S' hobj t)\n then show ?case using wf_expr_cast_intro by (metis prod.exhaust_sel)\nnext\n case (op_expr_const k v S)\n then show ?case using at_reflexive by simp\nnext\n case (op_expr_fieldacci a S x l obj v f)\n then show ?case using at_reflexive by simp\nnext\n case (op_expr_fieldaccs classStatics S c v f)\n then show ?case using at_reflexive by simp\nnext\n case (op_expr_wrap e S v S' cbname)\n then show ?case using wf_expr_wrap_intro by (metis prod.exhaust_sel)\nnext\n case (op_stmt_assign S e v S1 S' x)\n then show ?case using wf_stmt_assign_intro at_trans at_stack_update by metis\nnext\n case (op_stmt_assignfi S e v S1 a x l obj S' f)\n then show ?case using allowed_transition_stmt_assignfi wfp by blast\nnext\n case (op_stmt_assignfs S e v S1 classStatics c S' f)\n then show ?case using allowed_transition_stmt_assignfs wfp by blast\nnext\n case (op_stmt_expr S e v S')\n then show ?case using wf_stmt_expr_intro by metis\nnext\n case (op_stmt_then S v x s1 S1 s2)\n then show ?case using wf_stmt_ifelse_intro by metis\nnext\n case (op_stmt_else S v x s2 S2 s1)\n then show ?case using wf_stmt_ifelse_intro by metis\nnext\n case (op_stmt_letin S e v S1 S2 x s S3 S' T)\n then show ?case using allowed_transition_stmt_letin wfp by blast\nnext\n case (op_stmt_return S e v S1 S')\n then show ?case using wf_stmt_return_intro at_trans at_retval_update by metis\nnext\n case (op_stmt_seq S s1 S1 s2 S2)\n then show ?case using allowed_transition_stmt_seq wfp by blast\nnext\n case (op_stmt_throw S e v S1 S')\n then show ?case using wf_stmt_throw_intro at_trans at_except_update by metis\nnext\n case (op_stmt_trycatch_ok S s S1 S' catchhandlers)\n then show ?case using wf_stmt_trycatch_intro by metis\nnext\n case (op_stmt_trycatch_ex S s S1 ex a exObj i ch h var S2 S3 S')\n then show ?case using allowed_transition_stmt_trycatch_ex wfp by blast\nnext\n case (op_stmt_exception_or_return S s)\n then show ?case using at_reflexive by simp\nqed\n\nend", "meta": {"author": "patrickmeiring", "repo": "JavaCap", "sha": "43ded44673c45d596b6a399ef24292416591520b", "save_path": "github-repos/isabelle/patrickmeiring-JavaCap", "path": "github-repos/isabelle/patrickmeiring-JavaCap/JavaCap-43ded44673c45d596b6a399ef24292416591520b/javacap_security_static.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3073580232098525, "lm_q1q2_score": 0.1608774437568798}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__9_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__9_on_rules imports n_g2kAbsAfter_lemma_on_inv__9\nbegin\nsection{*All lemmas on causal relation between inv__9*}\nlemma lemma_inv__9_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__9 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__9) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__9) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__9_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5234203340678567, "lm_q2_score": 0.3073580041760868, "lm_q1q2_score": 0.16087742922427703}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__85_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__85_on_rules imports n_g2kAbsAfter_lemma_on_inv__85\nbegin\nsection{*All lemmas on causal relation between inv__85*}\nlemma lemma_inv__85_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__85 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__85) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__85) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__85_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.31405054499180746, "lm_q1q2_score": 0.1607048785887004}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchArch_AI\nimports \"../Arch_AI\"\nbegin\n\ncontext Arch begin global_naming ARM_HYP\n\ndefinition\n \"valid_aci aci \\ case aci of MakePool frame slot parent base \\\n \\s. cte_wp_at (\\c. c = cap.NullCap) slot s \\ real_cte_at slot s \\\n ex_cte_cap_wp_to is_cnode_cap slot s \\\n slot \\ parent \\\n cte_wp_at (\\cap. \\idx. cap = UntypedCap False frame pageBits idx ) parent s \\\n descendants_of parent (cdt s) = {} \\\n is_aligned base asid_low_bits \\ base \\ 2^asid_bits - 1 \\\n arm_asid_table (arch_state s) (asid_high_bits_of base) = None\"\n\ndefinition\n \"valid_vcpu_invocation vi \\ case vi of\n VCPUSetTCB vcpu_ptr tcb_ptr \\ vcpu_at vcpu_ptr and tcb_at tcb_ptr and\n ex_nonz_cap_to vcpu_ptr and ex_nonz_cap_to tcb_ptr\n and (\\s. tcb_ptr \\ idle_thread s)\n | VCPUInjectIRQ vcpu_ptr index virq \\ vcpu_at vcpu_ptr\n | VCPUReadRegister vcpu_ptr reg \\ vcpu_at vcpu_ptr\n | VCPUWriteRegister vcpu_ptr reg val \\ vcpu_at vcpu_ptr\n | VCPUAckVPPI vcpu_ptr vppi \\ vcpu_at vcpu_ptr\"\n\nlemma safe_parent_strg:\n \"cte_wp_at (\\cap. cap = UntypedCap False frame pageBits idx) p s \\\n descendants_of p (cdt s) = {} \\\n valid_objs s\n \\\n cte_wp_at (safe_parent_for (cdt s) p\n (ArchObjectCap (ASIDPoolCap frame base)))\n p s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state safe_parent_for_def is_physical_def arch_is_physical_def)\n apply (rule is_aligned_no_overflow)\n apply (drule (1) caps_of_state_valid_cap)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n done\n\n\nlemma asid_low_bits_pageBits:\n \"Suc (Suc asid_low_bits) = pageBits\"\n by (simp add: pageBits_def asid_low_bits_def)\n\n\n(* 32-bit instance of Detype_AI.range_cover_full *)\nlemma range_cover_full:\n \"\\is_aligned ptr sz;sz \\ range_cover (ptr::word32) sz sz (Suc 0)\"\n by (clarsimp simp:range_cover_def unat_eq_0 le_mask_iff[symmetric] word_and_le1 word_bits_def)\n\n\ndefinition\n valid_arch_inv :: \"arch_invocation \\ 'z::state_ext state \\ bool\"\nwhere\n \"valid_arch_inv \\ \\ai. case ai of\n InvokePageTable pti \\\n valid_pti pti\n | InvokePageDirectory pdi \\\n valid_pdi pdi\n | InvokePage pinv \\\n valid_page_inv pinv\n | InvokeASIDControl aci \\\n valid_aci aci\n | InvokeASIDPool ap \\\n valid_apinv ap\n | InvokeVCPU vi \\\n valid_vcpu_invocation vi\"\n\n\nlemma check_vp_wpR [wp]:\n \"\\\\s. vmsz_aligned w sz \\ P () s\\\n check_vp_alignment sz w \\P\\, -\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp hoare_whenE_wp|wpc)+\n apply (simp add: vmsz_aligned_def)\n done\n\n\nlemma check_vp_inv: \"\\P\\ check_vp_alignment sz w \\\\_. P\\\"\n apply (simp add: check_vp_alignment_def unlessE_whenE cong: vmpage_size.case_cong)\n apply (rule hoare_pre)\n apply (wp hoare_whenE_wp|wpc)+\n apply simp\n done\n\n\nlemma p2_low_bits_max:\n \"(2 ^ asid_low_bits - 1) = (max_word :: 10 word)\"\n by (simp add: asid_low_bits_def max_word_def)\n\n\nlemma dom_ucast_eq:\n \"(- dom (\\a::asid_low_index. p (ucast a::machine_word)) \\ {x. ucast x + y \\ 0} = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_low_bits - 1 \\ x + y \\ 0} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule conjI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_low_bits_def)\n apply simp\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_low_bits_def)\n apply simp\n apply (clarsimp simp: p2_low_bits_max)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_low_bits_def)\n done\n\n\nlemma asid_high_bits_max_word:\n \"(2 ^ asid_high_bits - 1 :: 7 word) = max_word\"\n by (simp add: asid_high_bits_def max_word_def)\n\n\nlemma dom_ucast_eq_7:\n \"(- dom (\\a::7 word. p (ucast a::word32)) \\ {x. x \\ 2 ^ asid_high_bits - 1} = {}) =\n (- dom p \\ {x. x \\ 2 ^ asid_high_bits - 1} = {})\"\n apply safe\n apply clarsimp\n apply (rule ccontr)\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst (asm) less_mask_eq)\n apply (rule word_less_sub_le [THEN iffD1])\n apply (simp add: word_bits_def)\n apply (simp add: asid_high_bits_def)\n apply simp\n apply (clarsimp simp: asid_high_bits_max_word)\n apply (rule ccontr)\n apply simp\n apply (erule_tac x=\"ucast x\" in in_emptyE)\n apply clarsimp\n apply (rule conjI, blast)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less, simp)\n apply (simp add: asid_high_bits_def)\n done\n\n\nlemma ucast_fst_hd_assocs:\n \"- dom (\\x. pool (ucast (x::asid_low_index)::machine_word)) \\ {x. ucast x + (w::machine_word) \\ 0} \\ {}\n \\\n fst (hd [(x, y)\\assocs pool . x \\ 2 ^ asid_low_bits - 1 \\ x + w \\ 0 \\ y = None]) =\n ucast (fst (hd [(x, y)\\assocs (\\a::asid_low_index. pool (ucast a)) .\n x \\ 2 ^ asid_low_bits - 1 \\\n ucast x + w \\ 0 \\ y = None]))\"\n apply (simp add: ucast_assocs[unfolded o_def])\n apply (simp add: filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_len)\n apply (simp add: asid_low_bits_def minus_one_norm)\n apply (simp add: ord_le_eq_trans [OF word_n1_ge])\n apply (simp add: word_le_make_less)\n apply (subgoal_tac \"P\" for P) (* cut_tac but more awesome *)\n apply (subst hd_map, assumption)\n apply simp\n apply (rule sym, rule ucast_ucast_len)\n apply (drule hd_in_set)\n apply simp\n apply (simp add: assocs_empty_dom_comp null_def split_def)\n apply (simp add: ucast_assocs[unfolded o_def] filter_map split_def)\n apply (simp cong: conj_cong add: ucast_ucast_len)\n done\n\n\ncrunch typ_at [wp]: perform_page_table_invocation, perform_page_invocation,\n perform_asid_pool_invocation, perform_page_directory_invocation \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps)\n\ncrunch typ_at [wp]: perform_vcpu_invocation \"\\s. P (typ_at T p s)\"\n (wp: crunch_wps)\n\nlemmas perform_page_table_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_table_invocation_typ_at]\n\nlemmas perform_page_directory_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_directory_invocation_typ_at]\n\nlemmas perform_page_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_page_invocation_typ_at]\n\nlemmas perform_asid_pool_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_asid_pool_invocation_typ_at]\n\nlemmas perform_vcpu_invocation_typ_ats [wp] =\n abs_typ_at_lifts [OF perform_vcpu_invocation_typ_at]\n(* ARMHYP FIXME this is not enough, add appropriate lifting rule to abs_typ_at_lifts *)\n\nlemma perform_asid_control_invocation_tcb_at:\n \"\\invs and valid_aci aci and st_tcb_at active p and\n K (\\w a b c. aci = asid_control_invocation.MakePool w a b c \\ w \\ p)\\\n perform_asid_control_invocation aci\n \\\\rv. tcb_at p\\\"\n apply (simp add: perform_asid_control_invocation_def)\n apply (cases aci)\n apply clarsimp\n apply (wp |simp)+\n apply (wp obj_at_delete_objects retype_region_obj_at_other2 hoare_vcg_const_imp_lift|assumption)+\n apply (intro impI conjI)\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def image_def ptr_add_def)\n apply (clarsimp simp: st_tcb_at_tcb_at)+\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def valid_aci_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)\n apply simp\n apply (simp add:cte_wp_at_caps_of_state)\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (erule(1) in_empty_interE)\n apply (clarsimp simp:page_bits_def)\n apply simp\n done\n\n\nlemma ucast_asid_high_btis_of_le [simp]:\n \"ucast (asid_high_bits_of w) \\ (2 ^ asid_high_bits - 1 :: word32)\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_less_sub_1)\n apply (rule order_less_le_trans)\n apply (rule ucast_less)\n apply simp\n apply (simp add: asid_high_bits_def)\n done\n\ncrunch tcb_at[wp]: perform_vcpu_invocation \"tcb_at p\"\n\nlemma invoke_arch_tcb:\n \"\\invs and valid_arch_inv ai and st_tcb_at active tptr\\\n arch_perform_invocation ai\n \\\\rv. tcb_at tptr\\\"\n apply (simp add: arch_perform_invocation_def)\n apply (cases ai, simp_all)\n apply (wp, clarsimp simp: st_tcb_at_tcb_at)+\n defer\n apply (wp, clarsimp simp: st_tcb_at_tcb_at)\n defer\n apply (wp perform_asid_control_invocation_tcb_at)\n apply (clarsimp simp add: valid_arch_inv_def)\n apply (clarsimp simp: valid_aci_def)\n apply (frule st_tcb_ex_cap)\n apply fastforce\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply auto[1]\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs cte_wp_at_caps_of_state)\n apply (drule_tac p=\"(aa,ba)\" in caps_of_state_valid_cap, fastforce)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (drule_tac x=tptr in base_member_set, simp)\n apply (simp add: vspace_bits_defs field_simps del: atLeastAtMost_iff)\n apply (metis (no_types) orthD1 x_power_minus_1)\n apply simp\n apply wp\n apply (clarsimp simp: st_tcb_at_def tcb_at_def obj_at_def is_tcb_def)\n done\n\nend\n\n\nlocale asid_update = Arch +\n fixes ap asid s s'\n assumes ko: \"ko_at (ArchObj (ASIDPool Map.empty)) ap s\"\n assumes empty: \"arm_asid_table (arch_state s) asid = None\"\n defines \"s' \\ s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\\"\n\n\ncontext asid_update begin\n\nlemma vs_lookup1' [simp]:\n \"vs_lookup1 s' = vs_lookup1 s\"\n by (simp add: vs_lookup1_def s'_def)\n\n\nlemma vs_lookup_pages1' [simp]:\n \"vs_lookup_pages1 s' = vs_lookup_pages1 s\"\n by (simp add: vs_lookup_pages1_def s'_def)\n\n\nlemma vs_asid_refs' [simp]:\n \"vs_asid_refs (arm_asid_table (arch_state s')) =\n vs_asid_refs (arm_asid_table (arch_state s)) \\ {([VSRef (ucast asid) None], ap)}\"\n apply (simp add: s'_def)\n apply (rule set_eqI)\n apply (rule iffI)\n apply (auto simp: vs_asid_refs_def split: if_split_asm)[1]\n apply clarsimp\n apply (erule disjE)\n apply (auto simp: vs_asid_refs_def)[1]\n apply (subst (asm) vs_asid_refs_def)\n apply (clarsimp dest!: graph_ofD)\n apply (rule vs_asid_refsI)\n apply (clarsimp simp: empty)\n done\n\n\nlemma vs_lookup':\n \"vs_lookup s' = vs_lookup s \\ {([VSRef (ucast asid) None], ap)}\"\n using ko\n apply (simp add: vs_lookup_def)\n apply (rule rtrancl_insert)\n apply (clarsimp simp: vs_lookup1_def obj_at_def vs_refs_def)\n done\n\n\nlemma vs_lookup_pages':\n \"vs_lookup_pages s' = vs_lookup_pages s \\ {([VSRef (ucast asid) None], ap)}\"\n using ko\n apply (simp add: vs_lookup_pages_def)\n apply (rule rtrancl_insert)\n apply (clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def)\n done\n\nlemma obj_at [simp]:\n \"obj_at P p s' = obj_at P p s\"\n by (simp add: s'_def)\n\nlemma vs_lookup_neq: \"\\(rs \\ p) s' ; p \\ ap\\ \\ (rs \\ p) s\"\n by (clarsimp simp: vs_lookup')\n\nlemma vspace_objs':\n \"valid_vspace_objs s \\ valid_vspace_objs s'\"\n using ko\n apply (clarsimp simp: valid_vspace_objs_def)\n apply (erule_tac x=p in allE)\n apply (case_tac \"p = ap\";\n case_tac ao;\n fastforce simp: obj_at_def s'_def\n intro: vs_lookup_neq)\n done\n\nlemma caps_of_state_s':\n \"caps_of_state s' = caps_of_state s\"\n by (rule caps_of_state_pspace, simp add: s'_def)\n\n\nlemma valid_vs_lookup':\n \"\\ valid_vs_lookup s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ ap \\ obj_refs cap \\ vs_cap_ref cap = Some [VSRef (ucast asid) None] \\\n \\ valid_vs_lookup s'\"\n by (clarsimp simp: valid_vs_lookup_def caps_of_state_s' vs_lookup_pages')\n\n\nlemma valid_table_caps':\n \"\\ valid_table_caps s \\\n \\ valid_table_caps s'\"\n apply (simp add: valid_table_caps_def caps_of_state_s')\n done\n\n\nlemma valid_arch_caps:\n \"\\ valid_arch_caps s;\n \\ptr cap. caps_of_state s ptr = Some cap\n \\ ap \\ obj_refs cap \\ vs_cap_ref cap = Some [VSRef (ucast asid) None] \\\n \\ valid_arch_caps s'\"\n by (simp add: valid_arch_caps_def caps_of_state_s'\n valid_table_caps' valid_vs_lookup')\n\n\nlemma valid_asid_map':\n \"valid_asid_map s \\ valid_asid_map s'\"\n using empty\n apply (clarsimp simp: valid_asid_map_def s'_def)\n apply (drule bspec, blast)\n apply (clarsimp simp: vspace_at_asid_def)\n apply (drule vs_lookup_2ConsD)\n apply clarsimp\n apply (erule vs_lookup_atE)\n apply (drule vs_lookup1D)\n apply clarsimp\n apply (rule vs_lookupI[rotated])\n apply (rule r_into_rtrancl)\n apply (rule vs_lookup1I)\n apply (fastforce simp: obj_at_def)\n apply assumption\n apply simp\n apply (clarsimp simp: vs_asid_refs_def graph_of_def)\n apply fastforce\n done\n\nend\n\n\ncontext Arch begin global_naming ARM_HYP\n\nlemma valid_arch_state_strg:\n \"valid_arch_state s \\ ap \\ ran (arm_asid_table (arch_state s)) \\ asid_pool_at ap s \\\n valid_arch_state (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply (clarsimp simp: valid_arch_state_def split: option.split)\n apply (clarsimp simp: valid_asid_table_def ran_def)\n apply (fastforce intro!: inj_on_fun_updI)\n done\n\n\nlemma valid_vs_lookup_at_upd_strg:\n \"valid_vs_lookup s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n (\\ptr cap. caps_of_state s ptr = Some cap \\ ap \\ obj_refs cap \\\n vs_cap_ref cap = Some [VSRef (ucast asid) None])\n \\\n valid_vs_lookup (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.valid_vs_lookup')\n apply fastforce\n done\n\n\nlemma retype_region_ap:\n \"\\\\\\\n retype_region ap 1 0 (ArchObject ASIDPoolObj) dev\n \\\\_. ko_at (ArchObj (arch_kernel_obj.ASIDPool Map.empty)) ap\\\"\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule retype_region_obj_at)\n apply simp\n apply simp\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def default_arch_object_def)\n apply (clarsimp simp: obj_at_def default_object_def default_arch_object_def)\n done\n\n\nlemma retype_region_ap':\n \"\\\\\\ retype_region ap 1 0 (ArchObject ASIDPoolObj) dev \\\\rv. asid_pool_at ap\\\"\n apply (rule hoare_strengthen_post, rule retype_region_ap)\n apply (clarsimp simp: a_type_def elim!: obj_at_weakenE)\n done\n\n\nlemma no_cap_to_obj_with_diff_ref_null_filter:\n \"no_cap_to_obj_with_diff_ref cap S\n = (\\s. \\c \\ ran (null_filter (caps_of_state s) |` (- S)).\n obj_refs c = obj_refs cap\n \\ table_cap_ref c = table_cap_ref cap)\"\n apply (simp add: no_cap_to_obj_with_diff_ref_def\n ball_ran_eq cte_wp_at_caps_of_state)\n apply (simp add: Ball_def)\n apply (intro iff_allI ext)\n apply (simp add: restrict_map_def null_filter_def)\n apply (auto dest!: obj_ref_none_no_asid[rule_format]\n simp: table_cap_ref_def)\n done\n\n\nlemma retype_region_no_cap_to_obj:\n \"\\valid_pspace and valid_mdb\n and caps_overlap_reserved {ptr..ptr + 2 ^ obj_bits_api ty us - 1}\n and caps_no_overlap ptr sz\n and pspace_no_overlap_range_cover ptr sz\n and no_cap_to_obj_with_diff_ref cap S\n and (\\s. \\slot. cte_wp_at (\\c. up_aligned_area ptr sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n and K (ty = Structures_A.CapTableObject \\ 0 < us)\n and K (range_cover ptr sz (obj_bits_api ty us) 1) \\\n retype_region ptr 1 us ty dev\n \\\\rv. no_cap_to_obj_with_diff_ref cap S\\\"\n apply (rule hoare_gen_asm)+\n apply (simp add: no_cap_to_obj_with_diff_ref_null_filter)\n apply (wp retype_region_caps_of | simp)+\n apply fastforce\n done\n\n\nlemma valid_table_caps_asid_upd [iff]:\n \"valid_table_caps (s\\arch_state := (arm_asid_table_update f (arch_state s))\\) =\n valid_table_caps s\"\n by (simp add: valid_table_caps_def)\n\n\nlemma vs_asid_ref_upd:\n \"([VSRef (ucast (asid_high_bits_of asid')) None] \\ ap')\n (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid_high_bits_of asid \\ ap)\\\\)\n = (if asid_high_bits_of asid' = asid_high_bits_of asid\n then ap' = ap\n else ([VSRef (ucast (asid_high_bits_of asid')) None] \\ ap') s)\"\n by (fastforce intro: vs_lookup_atI elim: vs_lookup_atE)\n\n\nlemma vs_asid_ref_eq:\n \"([VSRef (ucast asid) None] \\ ap) s\n = (arm_asid_table (arch_state s) asid = Some ap)\"\n by (fastforce elim: vs_lookup_atE intro: vs_lookup_atI)\n\n\nlemma set_cap_reachable_pg_cap:\n \"\\\\s. P (reachable_pg_cap cap s)\\ set_cap x y \\\\_ s. P (reachable_pg_cap cap s)\\\"\n by (unfold reachable_pg_cap_def, wp hoare_vcg_ex_lift set_cap.vs_lookup_pages)\n\n\nlemma cap_insert_simple_arch_caps_ap:\n \"\\valid_arch_caps and (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s)\n and no_cap_to_obj_with_diff_ref cap {dest}\n and (\\s. arm_asid_table (arch_state s) (asid_high_bits_of asid) = None)\n and ko_at (ArchObj (ASIDPool Map.empty)) ap\n and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) \\\n cap_insert cap src dest\n \\\\rv s. valid_arch_caps (s\\arch_state := arch_state s\n \\arm_asid_table := arm_asid_table (arch_state s)(asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (simp add: cap_insert_def update_cdt_def set_cdt_def valid_arch_caps_def\n set_untyped_cap_as_full_def bind_assoc)\n apply (strengthen valid_vs_lookup_at_upd_strg)\n apply (wp get_cap_wp set_cap_valid_vs_lookup set_cap_arch_obj\n set_cap_valid_table_caps hoare_vcg_all_lift\n | simp split del: if_split)+\n apply (rule_tac P = \"cte_wp_at ((=) src_cap) src\" in set_cap_orth)\n apply (wp hoare_vcg_imp_lift hoare_vcg_ball_lift set_free_index_final_cap\n hoare_vcg_disj_lift set_cap_reachable_pg_cap set_cap.vs_lookup_pages\n | clarsimp)+\n apply (wp set_cap_arch_obj set_cap_valid_table_caps hoare_vcg_ball_lift\n get_cap_wp static_imp_wp set_cap_empty_tables[simplified second_level_tables_def, simplified])+\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps)\n apply (rule conjI)\n apply (clarsimp simp: vs_cap_ref_def)\n apply (rule_tac x=\"fst dest\" in exI)\n apply (rule_tac x=\"snd dest\" in exI)\n apply simp\n apply (rule conjI)\n apply (simp add: unique_table_caps_def is_cap_simps)\n apply (subst unique_table_refs_def)\n apply (intro allI impI)\n apply (simp split: if_split_asm)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (simp add: no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state)\n apply (erule (3) unique_table_refsD)\n done\n\nlemma valid_asid_map_asid_upd_strg:\n \"valid_asid_map s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n valid_asid_map (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.valid_asid_map')\n done\n\nlemma valid_vspace_objs_asid_upd_strg:\n \"valid_vspace_objs s \\\n ko_at (ArchObj (ASIDPool Map.empty)) ap s \\\n arm_asid_table (arch_state s) asid = None \\\n valid_vspace_objs (s\\arch_state := arch_state s\\arm_asid_table := arm_asid_table (arch_state s)(asid \\ ap)\\\\)\"\n apply clarsimp\n apply (subgoal_tac \"asid_update ap asid s\")\n prefer 2\n apply unfold_locales[1]\n apply assumption+\n apply (erule (1) asid_update.vspace_objs')\n done\n\nlemma safe_parent_cap_is_device:\n \"safe_parent_for m p cap pcap \\ cap_is_device cap = cap_is_device pcap\"\n by (simp add: safe_parent_for_def)\n\nlemma cap_insert_ap_invs:\n \"\\invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq \\ cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (arm_asid_table (arch_state s)) \\\n arm_asid_table (arch_state s) (asid_high_bits_of asid) = None)\\\n cap_insert cap src dest\n \\\\rv s. invs (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s(asid_high_bits_of asid \\ ap)\\\\)\\\"\n\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (strengthen valid_arch_state_strg valid_vspace_objs_asid_upd_strg\n valid_asid_map_asid_upd_strg )\n apply (simp cong: conj_cong)\n apply (rule hoare_pre)\n apply (wpsimp wp: cap_insert_simple_mdb cap_insert_iflive\n cap_insert_zombies cap_insert_ifunsafe\n cap_insert_valid_global_refs cap_insert_idle\n valid_irq_node_typ cap_insert_simple_arch_caps_ap\n simp: valid_global_objs_def valid_global_vspace_mappings_def)\n apply (clarsimp simp: is_simple_cap_def cte_wp_at_caps_of_state is_cap_simps)\n apply (frule safe_parent_cap_is_device)\n apply (drule safe_parent_cap_range)\n apply (simp add: cap_range_def)\n apply (rule conjI)\n apply clarsimp\n apply (drule_tac p=\"(a,b)\" in caps_of_state_valid_cap, fastforce)\n apply (auto simp: obj_at_def is_tcb_def is_cap_table_def a_type_def\n valid_cap_def [where c=\"cap.Zombie a b x\" for a b x]\n dest: obj_ref_is_tcb obj_ref_is_cap_table split: option.splits)\n done\n\nlemma max_index_upd_no_cap_to:\n \"\\\\s. no_cap_to_obj_with_diff_ref cap {slot} s \\\n cte_wp_at ((=) ucap) cref s \\ is_untyped_cap ucap\\\n set_cap (max_free_index_update ucap) cref\n \\\\rv s. no_cap_to_obj_with_diff_ref cap {slot} s \\\"\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def)\n apply (wp hoare_vcg_ball_lift set_cap_cte_wp_at_neg)\n apply (clarsimp simp:cte_wp_at_caps_of_state free_index_update_def is_cap_simps)\n apply (drule_tac x = cref in bspec)\n apply clarsimp\n apply (clarsimp simp:table_cap_ref_def)\n done\n\n\nlemma perform_asid_control_invocation_st_tcb_at:\n \"\\st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\n and ct_active and invs and valid_aci aci\\\n perform_asid_control_invocation aci\n \\\\y. st_tcb_at P t\\\"\n supply\n is_aligned_neg_mask_eq[simp del]\n is_aligned_neg_mask_weaken[simp del]\n apply (clarsimp simp: perform_asid_control_invocation_def split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_name_pre_state)\n apply (subgoal_tac \"is_aligned word1 page_bits\")\n prefer 2\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply (simp add:valid_cap_simps cap_aligned_def page_bits_def)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def word_bits_def word_size_bits_def pageBits_def)+\n apply (simp add:is_aligned_neg_mask_eq)\n apply (wp hoare_vcg_const_imp_lift retype_region_st_tcb_at set_cap_no_overlap|simp)+\n apply (strengthen invs_valid_objs invs_psp_aligned)\n apply (clarsimp simp:conj_comms)\n apply (wp max_index_upd_invs_simple get_cap_wp)+\n apply (clarsimp simp: valid_aci_def)\n apply (frule intvl_range_conv)\n apply (simp add:word_bits_def page_bits_def pageBits_def)\n apply (clarsimp simp:detype_clear_um_independent page_bits_def is_aligned_neg_mask_eq)\n apply (rule conjI)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (rule pspace_no_overlap_detype)\n apply (rule caps_of_state_valid_cap)\n apply (simp add:page_bits_def)+\n apply (simp add:invs_valid_objs invs_psp_aligned)+\n apply (rule conjI)\n apply (erule pred_tcb_weakenE, simp)\n apply (rule conjI)\n apply (frule st_tcb_ex_cap)\n apply clarsimp\n apply (clarsimp split: Structures_A.thread_state.splits)\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (frule invs_untyped_children)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply (erule_tac ptr=\"(aa,ba)\" in untyped_children_in_mdbE[where P=\"\\c. t \\ zobj_refs c\" for t])\n apply (simp add: cte_wp_at_caps_of_state)+\n apply fastforce\n apply (clarsimp simp: zobj_refs_to_obj_refs)\n apply (fastforce simp:page_bits_def)\n apply simp\n apply (clarsimp simp:obj_bits_api_def arch_kobj_size_def cte_wp_at_caps_of_state\n default_arch_object_def empty_descendants_range_in)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state\n empty_descendants_range_in descendants_range_def2)+\n apply (thin_tac \"x = Some cap.NullCap\" for x)+\n apply (drule(1) caps_of_state_valid_cap[OF _ invs_valid_objs])\n apply (intro conjI)\n apply (clarsimp simp:valid_cap_def cap_aligned_def range_cover_full\n invs_psp_aligned invs_valid_objs page_bits_def)\n apply (erule pspace_no_overlap_detype)\n apply (auto simp:page_bits_def detype_clear_um_independent)\n done\n\n\nlemma set_cap_idx_up_aligned_area:\n \"\\K (\\idx. pcap = UntypedCap dev ptr pageBits idx) and cte_wp_at ((=) pcap) slot\n and valid_objs\\ set_cap (max_free_index_update pcap) slot\n \\\\rv s. (\\slot. cte_wp_at (\\c. up_aligned_area ptr pageBits \\ cap_range c \\ cap_is_device c = dev) slot s)\\\"\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_cap_cte_wp_at)\n apply (rule_tac x = slot in exI)\n apply clarsimp\n apply (frule(1) cte_wp_valid_cap)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_aligned_neg_mask_eq\n p_assoc_help valid_cap_def valid_untyped_def cap_aligned_def)\n done\n\nprimrec(nonexhaustive) get_untyped_cap_idx :: \"cap \\ nat\"\nwhere \"get_untyped_cap_idx (UntypedCap dev ref sz idx) = idx\"\n\n\nlemma aci_invs':\n assumes Q_ignores_arch[simp]: \"\\f s. Q (arch_state_update f s) = Q s\"\n assumes Q_ignore_machine_state[simp]: \"\\f s. Q (machine_state_update f s) = Q s\"\n assumes Q_detype[simp]: \"\\f s. Q (detype f s) = Q s\"\n assumes cap_insert_Q: \"\\cap src dest. \\Q and invs and K (src \\ dest)\\\n cap_insert cap src dest\n \\\\_.Q\\\"\n assumes retype_region_Q[wp]:\"\\a b c d e. \\Q\\ retype_region a b c d e \\\\_.Q\\\"\n assumes set_cap_Q[wp]: \"\\a b. \\Q\\ set_cap a b \\\\_.Q\\\"\n shows\n \"\\invs and Q and ct_active and valid_aci aci\\ perform_asid_control_invocation aci \\\\y s. invs s \\ Q s\\\"\n proof -\n have cap_insert_invsQ:\n \"\\cap src dest ap asid.\n \\Q and (invs and valid_cap cap and tcb_cap_valid cap dest and\n ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and\n cte_wp_at (\\c. c = NullCap) dest and\n no_cap_to_obj_with_diff_ref cap {dest} and\n (\\s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and\n K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and\n (\\s. \\irq\\cap_irqs cap. irq_issued irq s) and\n ko_at (ArchObj (ASIDPool Map.empty)) ap and\n (\\s. ap \\ ran (arm_asid_table (arch_state s)) \\\n arm_asid_table (arch_state s) (asid_high_bits_of asid) = None))\\\n cap_insert cap src dest\n \\\\rv s.\n invs\n (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\) \\\n Q\n (s\\arch_state := arch_state s\n \\arm_asid_table := (arm_asid_table \\ arch_state) s\n (asid_high_bits_of asid \\ ap)\\\\)\\\"\n apply (wp cap_insert_ap_invs)\n apply simp\n apply (rule hoare_pre)\n apply (rule cap_insert_Q)\n apply (auto simp: cte_wp_at_caps_of_state)\n done\n show ?thesis\n apply (clarsimp simp: perform_asid_control_invocation_def valid_aci_def\n split: asid_control_invocation.splits)\n apply (rename_tac word1 a b aa ba word2)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_const_imp_lift)\n apply (wp cap_insert_invsQ hoare_vcg_ex_lift\n | simp)+\n apply (simp add: valid_cap_def |\n strengthen real_cte_tcb_valid safe_parent_strg\n invs_vobjs_strgs\n ex_cte_cap_to_cnode_always_appropriate_strg)+\n apply (wp hoare_vcg_const_imp_lift set_free_index_invs\n retype_region_plain_invs[where sz = pageBits]\n retype_cte_wp_at[where sz = pageBits] hoare_vcg_ex_lift\n retype_region_obj_at_other3[where P=\"is_cap_table n\" and sz = pageBits for n]\n retype_region_ex_cte_cap_to[where sz = pageBits]\n retype_region_ap[simplified]\n retype_region_ap'[simplified]\n retype_region_no_cap_to_obj[where sz = pageBits,simplified]\n | simp del: split_paired_Ex)+\n apply (strengthen invs_valid_objs invs_psp_aligned invs_mdb invs_valid_pspace\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\"]\n exI[where x=\"case aci of MakePool frame slot parent base \\ parent\", simplified]\n caps_region_kernel_window_imp[where\n p = \"case aci of MakePool frame slot parent base \\ parent\"]\n invs_cap_refs_in_kernel_window)+\n apply (wp set_cap_caps_no_overlap set_cap_no_overlap get_cap_wp\n max_index_upd_caps_overlap_reserved max_index_upd_invs_simple\n set_cap_cte_cap_wp_to set_cap_cte_wp_at max_index_upd_no_cap_to\n | simp split del: if_split | wp (once) hoare_vcg_ex_lift)+\n apply (rule_tac P = \"is_aligned word1 page_bits\" in hoare_gen_asm)\n apply (subst delete_objects_rewrite)\n apply (simp add:page_bits_def pageBits_def word_size_bits_def)\n apply (simp add:page_bits_def pageBits_def word_bits_def)\n apply (simp add:is_aligned_neg_mask_eq)\n apply wp\n apply (clarsimp simp: cte_wp_at_caps_of_state if_option_Some\n Misc_Arithmetic.if_bool_simps\n split del: if_split)\n apply (strengthen refl)\n apply (frule_tac cap = \"(cap.UntypedCap False word1 pageBits idx)\"\n in detype_invariants[rotated 3],clarsimp+)\n apply (simp add:cte_wp_at_caps_of_state)+\n apply (simp add:descendants_range_def2 empty_descendants_range_in)\n apply (simp add:invs_mdb invs_valid_pspace invs_psp_aligned invs_valid_objs)\n apply (clarsimp dest!:caps_of_state_cteD)\n apply (frule(1) unsafe_protected[where p=t and p'=t for t])\n apply (simp add:empty_descendants_range_in)+\n apply fastforce\n apply clarsimp\n apply (frule_tac p = \"(aa,ba)\" in cte_wp_valid_cap)\n apply fastforce\n apply (clarsimp simp: detype_clear_um_independent obj_bits_api_def arch_kobj_size_def\n default_arch_object_def conj_comms)\n apply (rule conjI)\n apply (clarsimp simp:valid_cap_simps cap_aligned_def page_bits_def not_le)\n apply clarsimp\n apply (simp add:empty_descendants_range_in)\n apply (frule valid_cap_aligned)\n apply (clarsimp simp: cap_aligned_def is_aligned_neg_mask_eq)\n apply (subst caps_no_overlap_detype[OF descendants_range_caps_no_overlapI],\n assumption, simp add: is_aligned_neg_mask_eq,\n simp add: empty_descendants_range_in)\n apply (frule pspace_no_overlap_detype, clarify+)\n apply (frule intvl_range_conv[where bits = pageBits])\n apply (simp add:pageBits_def word_bits_def)\n apply (simp add:is_aligned_neg_mask_eq)\n apply (clarsimp simp:is_aligned_neg_mask_eq page_bits_def)\n apply (frule(1) ex_cte_cap_protects)\n apply (simp add:empty_descendants_range_in)\n apply fastforce\n apply (rule subset_refl)\n apply fastforce\n apply (clarsimp simp: field_simps)\n apply (intro conjI impI,\n simp_all add:free_index_of_def valid_cap_simps valid_untyped_def\n empty_descendants_range_in range_cover_full clear_um_def max_free_index_def,\n (clarsimp simp:valid_untyped_def valid_cap_simps)+)[1]\n\n apply (erule(1) cap_to_protected)\n apply (simp add:empty_descendants_range_in descendants_range_def2)+\n\n apply clarsimp\n apply (drule invs_arch_state)+\n apply (clarsimp simp: valid_arch_state_def valid_asid_table_def)\n apply (drule (1) bspec)+\n apply clarsimp\n apply (erule notE, erule is_aligned_no_overflow)\n\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def)\n apply (thin_tac \"cte_wp_at ((=) cap.NullCap) p s\" for p s)\n apply (subst(asm) eq_commute,\n erule(1) untyped_children_in_mdbE[where cap=\"cap.UntypedCap dev p bits idx\" for dev p bits idx,\n simplified, rotated])\n apply (simp add: is_aligned_no_overflow)\n apply simp\n apply clarsimp\n done\n\nqed\n\nlemmas aci_invs[wp] = aci_invs'[where Q=\\,simplified hoare_post_taut, OF refl refl refl TrueI TrueI TrueI,simplified]\n\nlemma obj_at_upd2:\n \"obj_at P t' (s\\kheap := kheap s(t \\ v, x \\ v')\\) = (if t' = x then P v' else obj_at P t' (s\\kheap := kheap s(t \\ v)\\))\"\n by (simp add: obj_at_update obj_at_def)\n\nlemma vcpu_invalidate_active_hyp_refs_empty[wp]:\n \"\\obj_at (\\ko. hyp_refs_of ko = {}) p\\ vcpu_invalidate_active \\\\r. obj_at (\\ko. hyp_refs_of ko = {}) p\\\"\n unfolding vcpu_invalidate_active_def vcpu_disable_def by wpsimp\n\nlemma as_user_hyp_refs_empty[wp]:\n \"\\obj_at (\\ko. hyp_refs_of ko = {}) p\\ as_user t f \\\\r. obj_at (\\ko. hyp_refs_of ko = {}) p\\\"\n unfolding as_user_def\n apply (wpsimp wp: set_object_wp)\n by (clarsimp simp: get_tcb_Some_ko_at obj_at_def arch_tcb_context_set_def)\n\nlemma dissociate_vcpu_tcb_obj_at_hyp_refs[wp]:\n \"\\\\s. p \\ {t, vr} \\ obj_at (\\ko. hyp_refs_of ko = {}) p s \\\n dissociate_vcpu_tcb t vr\n \\\\rv s. obj_at (\\ko. hyp_refs_of ko = {}) p s\\\"\n unfolding dissociate_vcpu_tcb_def\n apply (cases \"p \\ {t, vr}\"; clarsimp)\n apply (wp arch_thread_set_wp set_vcpu_wp)\n apply (clarsimp simp: obj_at_upd2 obj_at_update)\n apply (wp hoare_drop_imp get_vcpu_wp)+\n apply (clarsimp simp: obj_at_upd2 obj_at_update)\n apply (erule disjE;\n (wp arch_thread_set_wp set_vcpu_wp\n | clarsimp simp: obj_at_upd2 obj_at_update)+)\n done\n\nlemma associate_vcpu_tcb_sym_refs_hyp[wp]:\n \"\\\\s. sym_refs (state_hyp_refs_of s)\\ associate_vcpu_tcb vr t \\\\rv s. sym_refs (state_hyp_refs_of s)\\\"\n apply (simp add: associate_vcpu_tcb_def)\n apply (wp arch_thread_set_wp set_vcpu_wp | clarsimp)+\n apply (rule_tac P=\"\\s. ko_at (ArchObj (VCPU v)) vr s \\\n obj_at (\\ko. hyp_refs_of ko = {} ) t s \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_triv)\n apply (rule_tac Q=\"\\rv s. obj_at (\\ko. hyp_refs_of ko = {} ) vr s \\\n obj_at (\\ko. hyp_refs_of ko = {} ) t s \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_post_imp)\n apply (clarsimp dest!: get_tcb_SomeD simp: obj_at_def)\n apply (clarsimp simp add: sym_refs_def)\n apply (case_tac \"x = t\"; case_tac \"x = vr\"; clarsimp simp add: state_hyp_refs_of_def obj_at_def\n dest!: get_tcb_SomeD)\n apply fastforce\n apply (rule hoare_pre)\n apply (wp | wpc | clarsimp)+\n apply (simp add: obj_at_def)\n apply (wp get_vcpu_ko | wpc | clarsimp)+\n apply (rule_tac Q=\"\\rv s. (\\t'. obj_at (\\tcb. tcb = TCB t' \\ rv = tcb_vcpu (tcb_arch t')) t s) \\\n sym_refs (state_hyp_refs_of s)\"\n in hoare_post_imp)\n apply (clarsimp simp: obj_at_def)\n apply (wp arch_thread_get_tcb)\n apply simp\n done\n\nlemma arch_thread_set_inv_neq:\n \"\\obj_at P p and K (t \\ p)\\ arch_thread_set f t \\\\rv. obj_at P p\\\"\n unfolding arch_thread_set_def by (wpsimp wp: set_object_wp) (simp add: obj_at_def)\n\nlemma live_vcpu [simp]:\n \"live (ArchObj (VCPU (v\\vcpu_tcb := Some tcb\\)))\"\n by (simp add: live_def hyp_live_def arch_live_def)\n\nlemma ex_nonz_cap_to_vcpu_udpate[simp]:\n \"ex_nonz_cap_to t (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\) = ex_nonz_cap_to t s\"\n by (simp add: ex_nonz_cap_to_def)\n\nlemma caps_of_state_VCPU_update:\n \"vcpu_at a s \\ caps_of_state (s\\kheap := kheap s(a \\ ArchObj (VCPU b))\\) = caps_of_state s\"\n by (rule ext) (auto simp: caps_of_state_cte_wp_at cte_wp_at_cases obj_at_def)\n\nlemma set_vcpu_ex_nonz_cap_to[wp]:\n \"\\ex_nonz_cap_to t\\ set_vcpu a b \\\\_. ex_nonz_cap_to t\\\"\n apply (wp set_vcpu_wp)\n apply (clarsimp simp: ex_nonz_cap_to_def cte_wp_at_caps_of_state caps_of_state_VCPU_update)\n done\n\nlemma caps_of_state_tcb_arch_update:\n \"ko_at (TCB y) t' s \\ caps_of_state (s\\kheap := kheap s(t' \\ TCB (y\\tcb_arch := f (tcb_arch y)\\))\\) = caps_of_state s\"\n by (rule ext) (auto simp: caps_of_state_cte_wp_at cte_wp_at_cases obj_at_def tcb_cap_cases_def)\n\nlemma arch_thread_set_ex_nonz_cap_to[wp]:\n \"\\ex_nonz_cap_to t\\ arch_thread_set f t' \\\\_. ex_nonz_cap_to t\\\"\n apply (wp arch_thread_set_wp)\n apply clarsimp\n apply (clarsimp simp: ex_nonz_cap_to_def get_tcb_Some_ko_at cte_wp_at_caps_of_state\n caps_of_state_tcb_arch_update)\n done\n\ncrunch ex_nonz_cap_to[wp]: dissociate_vcpu_tcb \"ex_nonz_cap_to t\"\n (wp: crunch_wps)\n\nlemma associate_vcpu_tcb_if_live_then_nonz_cap[wp]:\n \"\\if_live_then_nonz_cap and ex_nonz_cap_to vcpu and ex_nonz_cap_to tcb\\\n associate_vcpu_tcb vcpu tcb \\\\_. if_live_then_nonz_cap\\\"\n unfolding associate_vcpu_tcb_def\n by (wpsimp wp: arch_thread_set_inv_neq hoare_disjI1 get_vcpu_wp hoare_vcg_all_lift hoare_drop_imps)\n\nlemma set_vcpu_valid_arch_Some[wp]:\n \"\\valid_arch_state\\ set_vcpu vcpu (v\\vcpu_tcb := Some tcb\\) \\\\_. valid_arch_state\\\"\n apply (wp set_vcpu_wp)\n apply (clarsimp simp: valid_arch_state_def)\n apply (rule conjI)\n apply (fastforce simp: valid_asid_table_def obj_at_def)\n apply (clarsimp simp: obj_at_def is_vcpu_def hyp_live_def arch_live_def split: option.splits)\n done\n\nlemma valid_global_objs_vcpu_update_str:\n \"valid_global_objs s \\ valid_global_objs (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\"\n by (simp add: valid_global_objs_def)\n\nlemma valid_global_vspace_mappings_vcpu_update_str:\n \"valid_global_vspace_mappings s \\ valid_global_vspace_mappings (s\\arch_state := arm_current_vcpu_update f (arch_state s)\\)\"\n by (simp add: valid_global_vspace_mappings_def)\n\nlemma associate_vcpu_tcb_invs[wp]:\n \"\\invs and ex_nonz_cap_to vcpu and ex_nonz_cap_to tcb and vcpu_at vcpu and (\\s. tcb \\ idle_thread s)\\\n associate_vcpu_tcb vcpu tcb\n \\\\_. invs\\\"\n using valid_global_vspace_mappings_def\n apply (simp add: invs_def valid_state_def valid_pspace_def)\n apply (simp add: pred_conj_def)\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_lift[rotated])+\n by (wp get_vcpu_wp arch_thread_get_wp weak_if_wp as_user_only_idle hoare_vcg_all_lift\n | wp (once) hoare_drop_imps\n | wpc\n | clarsimp\n | strengthen valid_arch_state_vcpu_update_str valid_global_refs_vcpu_update_str\n valid_global_vspace_mappings_vcpu_update_str valid_global_objs_vcpu_update_str\n | simp add: associate_vcpu_tcb_def valid_obj_def[abs_def] valid_vcpu_def\n dissociate_vcpu_tcb_def vcpu_invalidate_active_def vcpu_disable_def\n | simp add: obj_at_def)+\n\nlemma set_vcpu_regs_update[wp]:\n \"\\invs and valid_obj p (ArchObj (VCPU vcpu)) and\n obj_at (\\ko'. hyp_refs_of ko' = vcpu_tcb_refs (vcpu_tcb vcpu)) p\\\n set_vcpu p (vcpu_regs_update f vcpu) \\\\_. invs\\\"\n unfolding invs_def valid_state_def\n by (wpsimp wp: set_vcpu_valid_pspace set_vcpu_valid_arch_eq_hyp)\n\nlemma write_vcpu_register_invs[wp]:\n \"\\invs\\ write_vcpu_register vcpu reg val \\\\_. invs\\\"\n unfolding write_vcpu_register_def\n by wpsimp\n\nlemma vgic_update_valid_pspace[wp]:\n \"\\valid_pspace\\ vgic_update vcpuptr f \\\\_. valid_pspace\\\"\n unfolding vgic_update_def vcpu_update_def\n apply (wpsimp wp: set_vcpu_valid_pspace get_vcpu_wp simp: valid_vcpu_def)\n apply (fastforce simp: obj_at_def dest!: valid_pspace_vo)\n done\n\ncrunches invoke_vcpu_inject_irq, vcpu_read_reg\n for invs[wp]: invs (ignore: do_machine_op)\n\nlemma invoke_vcpu_ack_vppi_invs[wp]:\n \"invoke_vcpu_ack_vppi vcpu_ptr vppi \\invs\\\"\n unfolding invoke_vcpu_ack_vppi_def by (wpsimp cong: vcpu.fold_congs)\n\nlemma perform_vcpu_invs[wp]:\n \"\\invs and valid_vcpu_invocation vi\\ perform_vcpu_invocation vi \\\\_. invs\\\"\n apply (simp add: perform_vcpu_invocation_def valid_vcpu_invocation_def)\n apply (wpsimp simp: invoke_vcpu_read_register_def read_vcpu_register_def\n invoke_vcpu_write_register_def)\n done\n\nlemma invoke_arch_invs[wp]:\n \"\\invs and ct_active and valid_arch_inv ai\\\n arch_perform_invocation ai\n \\\\rv. invs\\\"\n apply (cases ai, simp_all add: valid_arch_inv_def arch_perform_invocation_def)\n apply (wp perform_vcpu_invs |simp)+\n done\n\n\nlemma sts_empty_pde [wp]:\n \"\\empty_pde_at p\\ set_thread_state t st \\\\rv. empty_pde_at p\\\"\n apply (simp add: empty_pde_at_def)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_thread_state_ko)\n apply (clarsimp simp: is_tcb_def)\n done\n\n\nlemma sts_pd_at_asid [wp]:\n \"\\vspace_at_asid asid pd\\ set_thread_state t st \\\\rv. vspace_at_asid asid pd\\\"\n apply (simp add: vspace_at_asid_def)\n apply wp\n done\n\n\nlemma sts_same_refs_inv[wp]:\n \"\\\\s. same_refs m cap s\\ set_thread_state t st \\\\rv s. same_refs m cap s\\\"\n by (cases m, (clarsimp simp: same_refs_def, wp)+)\n\n\nlemma sts_valid_slots_inv[wp]:\n \"\\valid_slots m\\ set_thread_state t st \\\\rv. valid_slots m\\\"\n by (cases m, (clarsimp simp: valid_slots_def, wp hoare_vcg_ball_lift sts.vs_lookup sts_typ_ats)+)\n\n\nlemma sts_valid_page_inv[wp]:\n\"\\valid_page_inv page_invocation\\ set_thread_state t st \\\\rv. valid_page_inv page_invocation\\\"\n by (cases page_invocation,\n (wp hoare_vcg_const_Ball_lift hoare_vcg_ex_lift hoare_vcg_disj_lift sts_typ_ats\n | clarsimp simp: valid_page_inv_def same_refs_def\n | wps)+)\n\n\nlemma sts_valid_pdi_inv[wp]:\n \"\\valid_pdi page_directory_invocation\\ set_thread_state t st \\\\rv. valid_pdi page_directory_invocation\\\"\n apply (cases page_directory_invocation)\n apply (wp | simp add: valid_pdi_def)+\n done\n\n\nlemma sts_valid_vcpu_invocation_inv:\n \"\\valid_vcpu_invocation vcpu_invocation\\ set_thread_state t st \\\\rv. valid_vcpu_invocation vcpu_invocation\\\"\n unfolding valid_vcpu_invocation_def by (cases vcpu_invocation; wpsimp)\n\nlemma sts_valid_arch_inv:\n \"\\valid_arch_inv ai\\ set_thread_state t st \\\\rv. valid_arch_inv ai\\\"\n apply (cases ai, simp_all add: valid_arch_inv_def)\n apply (rename_tac page_table_invocation)\n apply (case_tac page_table_invocation, simp_all add: valid_pti_def)[1]\n apply ((wp valid_pde_lift set_thread_state_valid_cap\n hoare_vcg_all_lift hoare_vcg_const_imp_lift\n hoare_vcg_ex_lift set_thread_state_ko\n sts_typ_ats set_thread_state_cte_wp_at\n | clarsimp simp: is_tcb_def)+)[4]\n apply (rename_tac asid_control_invocation)\n apply (case_tac asid_control_invocation)\n apply (clarsimp simp: valid_aci_def cte_wp_at_caps_of_state)\n apply (rule hoare_pre, wp hoare_vcg_ex_lift cap_table_at_typ_at)\n apply clarsimp\n apply (clarsimp simp: valid_apinv_def split: asid_pool_invocation.splits)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_ex_lift set_thread_state_ko)\n apply (clarsimp simp: is_tcb_def, wp sts_valid_vcpu_invocation_inv)\n done\n\ncrunch inv[wp]: ensure_safe_mapping, create_mapping_entries \"P\"\n (wp: crunch_wps mapME_x_inv_wp)\n\ncrunch_ignore (add: select_ext)\n\ncrunch inv [wp]: arch_decode_invocation \"P\"\n (wp: crunch_wps select_wp select_ext_weak_wp simp: crunch_simps)\n\n\nlemma create_mappings_empty [wp]:\n \"\\\\\\ create_mapping_entries base vptr vmsz R A pd \\\\m s. empty_refs m\\, -\"\n apply (cases vmsz, simp_all add: empty_refs_def)\n apply (wpsimp simp: pde_ref_def)+\n done\n\n\nlemma empty_pde_atI:\n \"\\ ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s;\n pd (ucast (p && mask pd_bits >> 3)) = InvalidPDE \\ \\\n empty_pde_at p s\"\n by (fastforce simp add: vspace_bits_defs empty_pde_at_def)\n\n\ndeclare lookup_slot_for_cnode_op_cap_to [wp]\n\n\nlemma shiftr_irrelevant:\n \"x < 2 ^ asid_low_bits \\ is_aligned (y :: word32) asid_low_bits \\\n x + y >> asid_low_bits = y >> asid_low_bits\"\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: is_aligned_nth)\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n apply (rule word_eqI)\n apply (simp add: nth_shiftr)\n apply safe\n apply (drule(1) nth_bounded)\n apply (simp add: asid_low_bits_def word_bits_def)\n apply simp\n done\n\nlemma map_up_enum_0x78:\n \"is_aligned (r::32 word) 7 \\ map (\\x. x + r) [0 , 8 .e. 0x78] = [r, r + 8 .e. r + 0x78]\"\n apply (simp add: upto_enum_step_def upto_enum_def not_less)\n apply (drule is_aligned_no_overflow')\n apply simp\n apply (erule word_plus_mono_right2)\n apply simp\n done\n\nlemma create_mapping_entries_parent_for_refs:\n \"\\invs and \\\\ pd and page_directory_at pd\n and K (is_aligned pd pd_bits) and K (vmsz_aligned vptr pgsz)\n and K (vptr < kernel_base)\\\n create_mapping_entries ptr vptr pgsz\n rights attribs pd\n \\\\rv s. \\a b. cte_wp_at (parent_for_refs rv) (a, b) s\\, -\"\n apply (rule hoare_gen_asmE)+\n apply (cases pgsz,\n simp_all add: vmsz_aligned_def largePagePTE_offsets_def superSectionPDE_offsets_def\n pte_bits_def pde_bits_def)\n apply (rule hoare_pre)\n apply wp\n apply (rule hoare_post_imp_R, rule lookup_pt_slot_cap_to)\n apply (elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def)\n apply simp\n apply (rule hoare_pre)\n apply wp\n apply (rule hoare_post_imp_R)\n apply (rule lookup_pt_slot_cap_to_multiple1)\n apply (elim conjE exEI cte_wp_at_weakenE)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def\n subset_iff p_0x3C_shift map_up_enum_0x78)\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp dest!:vs_lookup_pages_vs_lookupI)\n apply (drule valid_vs_lookupD, clarsimp)\n apply (simp, elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def\n lookup_pd_slot_def Let_def)\n apply (subst pd_shifting, simp add: pd_bits_def pageBits_def pde_bits_def)\n apply (clarsimp simp: vs_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (auto simp: valid_cap_def obj_at_def is_cap_simps cap_asid_def\n dest!: caps_of_state_valid_cap split:if_splits)[3]\n apply (frule(1) caps_of_state_valid)\n apply (clarsimp simp:valid_cap_def obj_at_def)\n apply (simp add:is_cap_simps)\n apply (rule hoare_pre, wp)\n apply (clarsimp dest!:vs_lookup_pages_vs_lookupI)\n apply (drule valid_vs_lookupD, clarsimp)\n apply (simp, elim exEI)\n apply (clarsimp simp: cte_wp_at_caps_of_state parent_for_refs_def)\n apply (rule conjI)\n apply (simp add: subset_eq)\n apply (clarsimp simp: lookup_pd_slot_add_eq)\n apply (clarsimp simp: vs_cap_ref_def\n split: cap.split_asm arch_cap.split_asm option.split_asm)\n apply (auto simp: valid_cap_def obj_at_def is_cap_simps cap_asid_def\n dest!: caps_of_state_valid_cap split:if_splits)[3]\n apply (frule(1) caps_of_state_valid)\n apply (clarsimp simp:valid_cap_def obj_at_def)\n apply (simp add:is_cap_simps)\n done\n\n\nlemma find_pd_for_asid_shifting_voodoo:\n \"\\pspace_aligned and valid_vspace_objs\\\n find_pd_for_asid asid\n \\\\rv s. v >> 21 = rv + (v >> 21 << 3) && mask pd_bits >> 3\\,-\"\n apply (rule hoare_post_imp_R,\n rule find_pd_for_asid_aligned_pd, simp add: vspace_bits_defs)\n apply (subst pd_shifting_dual[simplified vspace_bits_defs, simplified], simp)\n apply (rule word_eqI)\n apply (simp add: nth_shiftr nth_shiftl word_size)\n apply safe\n apply (drule test_bit_size)\n apply (simp add: word_size)\n done\n\n\nlemma find_pd_for_asid_ref_offset_voodoo:\n \"\\pspace_aligned and valid_vspace_objs and\n K (ref = [VSRef (asid && mask asid_low_bits) (Some AASIDPool),\n VSRef (ucast (asid_high_bits_of asid)) None])\\\n find_pd_for_asid asid\n \\\\rv. (ref \\ (rv + (v >> 21 << 3) && ~~ mask pd_bits))\\,-\"\n apply (rule hoare_gen_asmE)\n apply (rule_tac Q'=\"\\rv s. is_aligned rv 14 \\ (ref \\ rv) s\"\n in hoare_post_imp_R)\n apply (simp add: ucast_ucast_mask\n mask_asid_low_bits_ucast_ucast)\n apply (fold asid_low_bits_def)\n apply (rule hoare_pre, wp find_pd_for_asid_lookup_ref)\n apply (simp add: vspace_bits_defs)\n apply (simp add: pd_shifting[simplified vspace_bits_defs, simplified] vspace_bits_defs)\n done\n\n\ndeclare asid_high_bits_of_shift [simp]\ndeclare mask_shift [simp]\ndeclare word_less_sub_le [simp del]\ndeclare ptrFormPAddr_addFromPPtr [simp]\n\n\n(* FIXME: move *)\nlemma valid_mask_vm_rights[simp]:\n \"mask_vm_rights V R \\ valid_vm_rights\"\n by (simp add: mask_vm_rights_def)\n\n\nlemma vs_lookup_and_unique_refs:\n \"\\(ref \\ p) s; caps_of_state s cptr = Some cap; table_cap_ref cap = Some ref';\n p \\ obj_refs cap; valid_vs_lookup s; unique_table_refs (caps_of_state s)\\\n \\ ref = ref'\"\n apply (frule_tac ref=ref in valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], assumption)\n apply clarsimp\n apply (frule_tac cap'=capa in unique_table_refsD)\n apply simp+\n apply (case_tac capa, simp_all)\n apply ((case_tac cap, simp_all)+)[6]\n apply (clarsimp simp add: table_cap_ref_def vs_cap_ref_def split: cap.splits arch_cap.splits option.splits)\n done\n\n\nlemma create_mapping_entries_same_refs:\n \"\\valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\\s. unique_table_refs (caps_of_state s))\n and pspace_aligned and valid_objs and valid_kernel_mappings and \\\\ pd and\n (\\s. \\dev pd_cap pd_cptr. cte_wp_at ((=) pd_cap) pd_cptr s\n \\ pd_cap = ArchObjectCap (PageDirectoryCap pd (Some asid))) and\n page_directory_at pd and K (vaddr < kernel_base \\ (cap = (ArchObjectCap (PageCap dev p rights' pgsz (Some (asid, vaddr))))))\\\n create_mapping_entries (addrFromPPtr p) vaddr pgsz rights attribs pd\n \\\\rv s. same_refs rv cap s\\,-\"\n apply (rule hoare_gen_asmE)\n apply (cases pgsz, simp_all add: lookup_pt_slot_def)\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: pd_shifting)\n apply (simp add: vaddr_segment_nonsense2 pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (frule (2) valid_vspace_objsD[rotated], simp)\n apply (erule_tac x=\"ucast (vaddr >> 21)\" in allE)\n apply (simp, drule (1) pt_aligned)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def split: option.splits)\n apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id mask_def[of 9]\n less_trans[OF and_mask_less'[where n=9, unfolded mask_def, simplified]]\n word_bits_def pageBits_def\n vaddr_segment_nonsense3)\n apply (rule conjI, simp add: mask_def pt_bits_def pte_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (frule_tac p=pd and p'=\"ptrFromPAddr x\" in vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (rule exI, erule conjI)\n apply (rule exI[where x=\"VSRef (vaddr >> 21) (Some APageDirectory)\"])\n apply (rule conjI, rule refl)\n apply (simp add: vs_refs_def)\n apply (rule_tac x=\"(ucast (vaddr >> 21), ptrFromPAddr x)\" in image_eqI)\n apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def)\n apply (clarsimp simp:graph_of_def)\n apply (simp add: pde_ref_def)\n apply simp\n apply (drule (1) ref_is_unique)\n apply (simp add: ptrFromPAddr_def)\n apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps pt_bits_def)[8]\n apply (wp get_pde_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: pd_shifting)\n apply (simp add: vaddr_segment_nonsense2 pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (frule (2) valid_vspace_objsD[rotated], simp)\n apply (erule_tac x=\"ucast (vaddr >> 21)\" in allE)\n apply (simp, drule (1) pt_aligned)\n apply (simp add: largePagePTE_offsets_def pte_bits_def)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def upto_enum_step_def upto_enum_word upt_conv_Cons)\n apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id\n less_trans[OF and_mask_less'[where n=9, unfolded mask_def, simplified]]\n word_bits_def pageBits_def mask_def [of 9]\n vaddr_segment_nonsense3)\n apply (simp add: pt_bits_def pte_bits_def)\n apply (rule conjI, simp add: mask_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (frule_tac p=pd and p'=\"ptrFromPAddr x\" in vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (rule exI, erule conjI)\n apply (rule exI[where x=\"VSRef (vaddr >> 21) (Some APageDirectory)\"])\n apply (rule conjI, rule refl)\n apply (simp add: vs_refs_def)\n apply (rule_tac x=\"(ucast (vaddr >> 21), ptrFromPAddr x)\" in image_eqI)\n apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def)\n apply (clarsimp simp:graph_of_def)\n apply (simp add: pde_ref_def)\n apply simp\n apply (drule (1) ref_is_unique)\n apply (simp add: ptrFromPAddr_def)\n apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps)[8]\n apply (wp get_pde_wp returnOKE_R_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def)\n apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2\n pageBits_def pt_bits_def pte_bits_def pde_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (drule (1) ref_is_unique)\n apply (simp_all add: valid_arch_state_def valid_objs_caps)[7]\n apply (wp returnOKE_R_wp | wpc)+\n apply (clarsimp simp: lookup_pd_slot_def)\n apply (frule (1) pd_aligned)\n apply (simp add: superSectionPDE_offsets_def pde_bits_def pageBits_def pt_bits_def)\n apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def upto_enum_step_def upto_enum_word upt_conv_Cons)\n apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2 pageBits_def pt_bits_def)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) vs_lookup_and_unique_refs)\n apply (simp_all add: table_cap_ref_def obj_refs_def)[4]\n apply (drule (1) ref_is_unique)\n apply (clarsimp simp: obj_at_def a_type_def valid_arch_state_def)\n apply (simp_all add: valid_arch_state_def valid_objs_caps)\n done\n\n\nlemma create_mapping_entries_same_refs_ex:\n \"\\valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\\s. unique_table_refs (caps_of_state s))\n and pspace_aligned and valid_objs and valid_kernel_mappings and \\\\ pd and\n (\\s. \\dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s\n \\ pd_cap = cap.ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid))\n \\ page_directory_at pd s \\ vaddr < kernel_base \\ (cap = (cap.ArchObjectCap (arch_cap.PageCap dev p rights' pgsz (Some (asid, vaddr))))))\\\n create_mapping_entries (Platform.ARM_HYP.addrFromPPtr p) vaddr pgsz rights attribs pd\n \\\\rv s. same_refs rv cap s\\,-\"\n apply (clarsimp simp: validE_R_def validE_def valid_def split: sum.split)\n apply (erule use_validE_R[OF _ create_mapping_entries_same_refs])\n apply fastforce\n done\n\n\nlemma find_pd_for_asid_lookup_pd_wp:\n \"\\ \\s. valid_vspace_objs s \\ (\\pd. vspace_at_asid asid pd s \\ page_directory_at pd s\n \\ (\\\\ pd) s \\ Q pd s) \\ find_pd_for_asid asid \\ Q \\, -\"\n apply (rule hoare_post_imp_R)\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_page_directory])\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_lookup, simplified])\n apply (rule hoare_vcg_conj_lift_R[OF find_pd_for_asid_pd_at_asid, simplified])\n apply (wp (once) find_pd_for_asid_inv)\n apply auto\n done\n\n\nlemma aligned_sum_less_kernel_base:\n \"vmsz_aligned p sz\n \\ (p + 2 ^ pageBitsForSize sz - 1 < kernel_base) = (p < kernel_base)\"\n apply (rule iffI)\n apply (rule le_less_trans)\n apply (rule is_aligned_no_overflow)\n apply (simp add: vmsz_aligned_def)\n apply simp\n apply (simp add:field_simps[symmetric])\n apply (erule gap_between_aligned)\n apply (simp add: vmsz_aligned_def)+\n apply (case_tac sz,simp_all add:kernel_base_def is_aligned_def)+\n done\n\nlemma find_pd_for_asid_pde_unfolded[wp]:\n \"\\valid_vspace_objs and pspace_aligned\\\n find_pd_for_asid asid\n \\\\pd. pde_at (pd + (vptr >> 21 << 3))\\, -\"\n apply (rule hoare_post_imp_R, rule find_pd_for_asid_pde)\n apply (simp add: pageBits_def pt_bits_def pde_bits_def)\n done\n\nlemma arch_decode_inv_wf[wp]:\n \"\\invs and valid_cap (ArchObjectCap arch_cap) and\n cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and\n (\\s. \\x \\ set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\\\n arch_decode_invocation label args cap_index slot arch_cap excaps\n \\valid_arch_inv\\,-\"\n supply if_split[split del]\n apply (cases arch_cap)\n apply (rename_tac word1 word2)\n apply (simp add: arch_decode_invocation_def Let_def decode_mmu_invocation_def split_def cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger select_wp select_ext_weak_wp|\n wpc|\n simp add: valid_arch_inv_def valid_apinv_def)+)[1]\n apply (simp add: if_apply_def2 valid_apinv_def)\n apply (intro allI impI ballI)\n apply (elim conjE exE)\n apply simp\n apply (clarsimp simp: dom_def neq_Nil_conv)\n apply (thin_tac \"Ball S P\" for S P)+\n apply (clarsimp simp: valid_cap_def)\n apply (rule conjI)\n apply (clarsimp simp: obj_at_def)\n apply (subgoal_tac \"ucast (ucast xa + word2) = xa\")\n apply simp\n apply (simp add: is_aligned_nth)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_bits_def nth_ucast)\n apply (drule test_bit_size)\n apply (simp add: word_size asid_low_bits_def)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size word_bits_def nth_ucast)\n apply (auto simp: asid_low_bits_def)[1]\n apply (rule conjI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (rename_tac c c')\n apply (frule_tac cap=\"(ArchObjectCap (PageDirectoryCap xb None))\" in caps_of_state_valid,\n assumption)\n apply (clarsimp simp: is_pd_cap_def cap_rights_update_def acap_rights_update_def)\n apply (clarsimp simp: word_neq_0_conv)\n apply (rule conjI)\n apply (subst field_simps, erule is_aligned_add_less_t2n)\n apply (simp add: asid_low_bits_def)\n apply (rule ucast_less[where 'b=10, simplified], simp)\n apply (simp add: asid_low_bits_def asid_bits_def)\n apply (simp add: asid_bits_def)\n apply (drule vs_lookup_atI)\n apply (subst asid_high_bits_of_add_ucast, assumption)\n apply assumption\n apply (simp add: arch_decode_invocation_def Let_def split_def decode_mmu_invocation_def\n cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger|\n wpc|\n simp add: valid_arch_inv_def valid_aci_def is_aligned_shiftl_self)+)[1]\n apply (rule_tac Q'=\n \"\\rv. real_cte_at rv and\n ex_cte_cap_wp_to is_cnode_cap rv and\n (\\s. descendants_of (snd (excaps!0)) (cdt s) = {}) and\n cte_wp_at (\\c. \\idx. c = (cap.UntypedCap False frame pageBits idx)) (snd (excaps!0)) and\n (\\s. arm_asid_table (arch_state s) free = None)\"\n in hoare_post_imp_R)\n apply (simp add: lookup_target_slot_def)\n apply wp\n apply (clarsimp simp: cte_wp_at_def)\n apply (rule conjI, clarsimp)\n apply (rule shiftl_less_t2n)\n apply (rule order_less_le_trans, rule ucast_less, simp)\n apply (simp add: asid_bits_def asid_low_bits_def)\n apply (simp add: asid_bits_def)\n apply simp\n apply (wp ensure_no_children_sp select_ext_weak_wp select_wp whenE_throwError_wp|wpc | simp)+\n apply clarsimp\n apply (rule conjI, fastforce)\n apply (cases excaps, simp)\n apply (case_tac list, simp)\n apply clarsimp\n apply (rule conjI)\n apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+\n apply assumption\n apply (rule conjI)\n apply clarsimp\n apply (simp add: ex_cte_cap_wp_to_def)\n apply (rule_tac x=ac in exI)\n apply (rule_tac x=ba in exI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (clarsimp simp: cap_rights_update_def)\n apply (simp add: arch_decode_invocation_def Let_def split_def decode_mmu_invocation_def\n cong: if_cong)\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageMap\")\n apply (rename_tac word rights vmpage_size option)\n apply simp\n apply (wpsimp wp: whenE_throwError_wp check_vp_wpR create_mapping_entries_parent_for_refs\n find_pd_for_asid_pd_at_asid create_mapping_entries_valid_slots\n create_mapping_entries_same_refs_ex hoare_vcg_ex_lift_R hoare_vcg_disj_lift_R\n hoare_vcg_const_imp_lift_R find_pd_for_asid_lookup_pd_wp\n simp: valid_arch_inv_def valid_page_inv_def is_pg_cap_def\n cte_wp_at_caps_of_state[where P=\"\\c. same_refs rv c s\" for rv s])\n apply (clarsimp simp: neq_Nil_conv)\n apply (frule cte_wp_valid_cap[where p=\"(a, b)\" for a b], clarsimp)\n apply (frule cte_wp_valid_cap[where p=slot], clarsimp)\n apply (clarsimp simp: cte_wp_at_caps_of_state mask_cap_def)\n apply (clarsimp simp: cap_rights_update_def acap_rights_update_def\n split: cap.splits arch_cap.splits if_splits)\n apply (rename_tac page_size mapped_data)\n apply (intro conjI allI impI;\n (clarsimp simp: invs_implies valid_cap_simps cap_aligned_def valid_kernel_mappings_def\n aligned_sum_less_kernel_base[symmetric] asid_bits_def mask_def\n is_arch_update_def cap_master_cap_simps is_arch_cap_def data_at_def\n vmsz_aligned_def is_aligned_addrFromPPtr_n vs_cap_ref_def\n split: if_splits vmpage_size.split\n | fastforce)+)\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageUnmap\")\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def)\n apply (thin_tac \"Ball S P\" for S P)\n apply (clarsimp split: option.split)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (simp add: valid_unmap_def)\n apply (fastforce simp: vmsz_aligned_def elim: is_aligned_weaken intro!: pbfs_atleast_pageBits)\n apply (cases \"isPageFlushLabel (invocation_type label)\")\n apply simp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp static_imp_wp hoare_drop_imps)\n apply (simp add: valid_arch_inv_def valid_page_inv_def)\n apply (wp find_pd_for_asid_pd_at_asid | wpc)+\n apply (clarsimp simp: valid_cap_def mask_def)\n apply simp\n apply (cases \"invocation_type label = ArchInvocationLabel ARMPageGetAddress\")\n apply simp\n apply (rule hoare_pre, wp)\n apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def)\n apply (rule hoare_pre, wp)\n apply (simp)\n apply (simp add: arch_decode_invocation_def Let_def split_def\n is_final_cap_def decode_mmu_invocation_def\n cong: if_cong)\n apply (rename_tac word option)\n apply (rule hoare_pre)\n apply ((wp whenE_throwError_wp check_vp_wpR get_master_pde_wp hoare_vcg_all_lift_R\n | wpc\n | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE vs_cap_ref_def\n split: if_split\n | rule_tac x=\"fst p\" in hoare_imp_eq_substR\n | wp (once) hoare_vcg_ex_lift_R)+)[1]\n apply (rule_tac Q'=\"\\a b. ko_at (ArchObj (PageDirectory pd))\n (a + (args ! 0 >> 21 << 3) && ~~ mask pd_bits) b \\\n pd (ucast (a + (args ! 0 >> 21 << 3) && mask pd_bits >> 3)) =\n InvalidPDE \\ L word option p pd a b\" for L in hoare_post_imp_R[rotated])\n apply (intro impI)\n apply (erule impE)\n apply (clarsimp simp: pageBits_def pde_bits_def pt_bits_def)\n apply (erule impE)\n apply (clarsimp simp: pageBits_def pde_bits_def pt_bits_def split:pde.splits)\n apply assumption\n apply ((wp whenE_throwError_wp hoare_vcg_all_lift_R\n find_pd_for_asid_lookup_slot [unfolded lookup_pd_slot_def Let_def]\n find_pd_for_asid_ref_offset_voodoo find_pd_for_asid_shifting_voodoo\n find_pd_for_asid_inv\n | wpc\n | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE empty_pde_atI\n vs_cap_ref_def pageBits_def pt_bits_def pde_bits_def\n | wp (once) hoare_drop_imps hoare_vcg_ex_lift_R)+)[6]\n apply (clarsimp simp: is_cap_simps if_apply_def2)\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (clarsimp simp: neq_Nil_conv)\n apply (thin_tac \"Ball S P\" for S P)\n apply (rule conjI)\n apply (clarsimp simp: valid_cap_def cap_aligned_def\n pte_bits_def pt_bits_def is_aligned_addrFromPPtr_n)\n apply (rule conjI)\n apply (clarsimp simp: valid_cap_def cap_aligned_def)\n apply (rule conjI)\n apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+\n apply (clarsimp simp add: cap_rights_update_def acap_rights_update_def)\n apply (clarsimp simp: valid_cap_def cap_aligned_def\n pt_bits_def pageBits_def\n linorder_not_le\n order_le_less_trans[OF word_and_le2])\n apply (rule conjI)\n apply (clarsimp simp add: cte_wp_at_caps_of_state)\n apply (drule (1) caps_of_state_valid[rotated])\n apply clarsimp\n apply (clarsimp simp: cap_master_cap_def is_arch_update_def)\n apply (clarsimp simp: cap_asid_def cap_rights_update_def acap_rights_update_def is_cap_simps\n split: option.split)\n apply (rule conjI, fastforce)\n apply (rule conjI, fastforce)\n apply (clarsimp simp: pde_ref_def)\n apply (frule invs_pd_caps)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule (1) caps_of_state_valid[rotated])\n apply (clarsimp simp: cap_rights_update_def acap_rights_update_def valid_cap_def)\n apply (drule (2) valid_table_caps_ptD)\n apply (rule conjI, fastforce)+\n apply (clarsimp simp: kernel_vsrefs_def)\n apply fastforce\n apply (clarsimp simp: cte_wp_at_def is_cap_simps\n valid_arch_inv_def valid_pti_def)\n apply (simp add: arch_decode_invocation_def Let_def decode_mmu_invocation_def)\n apply (cases \"isPDFlushLabel (invocation_type label)\")\n apply simp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp static_imp_wp hoare_drop_imp | wpc | simp)+\n apply (simp add: resolve_vaddr_def)\n apply (wp get_master_pte_wp get_master_pde_wp whenE_throwError_wp | wpc | simp)+\n apply (clarsimp simp: valid_arch_inv_def valid_pdi_def)+\n apply (rule_tac Q'=\"\\pd' s. vspace_at_asid x2 pd' s \\ x2 \\ mask asid_bits \\ x2 \\ 0\" in hoare_post_imp_R)\n apply wp\n apply clarsimp\n apply (wp | wpc)+\n apply (clarsimp simp: valid_cap_def mask_def)\n apply (clarsimp, wp throwError_validE_R)\n\n(* VCPU *)\n apply (rename_tac vcpu_ptr)\n apply (clarsimp simp: arch_decode_invocation_def decode_vcpu_invocation_def)\n apply (cases \"invocation_type label\"; (simp, wp?))\n apply (rename_tac arch_iv)\n apply (case_tac \"arch_iv\"; (simp, wp?))\n apply (simp add: decode_vcpu_set_tcb_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_vcpu_invocation_def)\n apply (rename_tac tcb_ptr)\n apply (frule_tac c=\"ThreadCap tcb_ptr\" in cte_wp_valid_cap, fastforce)\n apply (simp add: valid_cap_def)\n apply (cases slot)\n apply (clarsimp simp: ex_nonz_cap_to_def)\n apply (rule conjI, fastforce elim: cte_wp_at_weakenE)\n apply (rule conjI, fastforce elim: cte_wp_at_weakenE)\n apply (clarsimp dest!: invs_valid_global_refs simp: cte_wp_at_caps_of_state)\n apply (drule_tac ?cap=\"ThreadCap (idle_thread s)\" in valid_global_refsD2, assumption)\n apply (simp add:global_refs_def cap_range_def)\n apply (simp add: decode_vcpu_inject_irq_def)\n apply (rule hoare_pre, wpsimp simp: whenE_def wp: get_vcpu_wp)\n apply (clarsimp simp: valid_arch_inv_def valid_vcpu_invocation_def obj_at_def)\n apply (simp add: decode_vcpu_read_register_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n apply (simp add: decode_vcpu_write_register_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n apply (simp add: decode_vcpu_ack_vppi_def arch_check_irq_def)\n apply (rule hoare_pre, wpsimp)\n apply (clarsimp simp: valid_arch_inv_def valid_cap_def valid_vcpu_invocation_def)\n done\n\n\ndeclare word_less_sub_le [simp]\n\ncrunches associate_vcpu_tcb\n for pred_tcb_at[wp_unsafe]: \"pred_tcb_at proj P t\"\n (wp: crunch_wps simp: crunch_simps)\n\ncrunches vcpu_read_reg, vcpu_write_reg, invoke_vcpu_inject_irq\n for pred_tcb_at[wp]: \"pred_tcb_at proj P t\"\n\nlemma perform_vcpu_invocation_pred_tcb_at[wp_unsafe]:\n \"\\pred_tcb_at proj P t and K (proj_not_field proj tcb_arch_update)\\\n perform_vcpu_invocation iv\n \\\\_. pred_tcb_at proj P t\\\"\n apply (simp add: perform_vcpu_invocation_def)\n apply (rule hoare_pre)\n apply (wp associate_vcpu_tcb_pred_tcb_at | wpc\n | clarsimp simp: invoke_vcpu_read_register_def\n read_vcpu_register_def\n invoke_vcpu_write_register_def\n write_vcpu_register_def\n invoke_vcpu_ack_vppi_def)+\n done\n\ncrunch pred_tcb_at: perform_page_table_invocation, perform_page_invocation,\n perform_asid_pool_invocation,\n perform_page_directory_invocation \"pred_tcb_at proj P t\"\n (wp: crunch_wps simp: crunch_simps)\n\n\nlemma arch_pinv_st_tcb_at:\n \"\\invs and valid_arch_inv ai and ct_active and\n st_tcb_at (P and (Not \\ inactive) and (Not \\ idle)) t\\\n arch_perform_invocation ai\n \\\\rv. st_tcb_at P t\\\"\n apply (cases ai, simp_all add: arch_perform_invocation_def valid_arch_inv_def)\n apply (wp perform_page_table_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_page_directory_invocation_pred_tcb_at, fastforce elim: pred_tcb_weakenE)\n apply (wp perform_page_invocation_pred_tcb_at, fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_asid_control_invocation_st_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_asid_pool_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n apply (wp perform_vcpu_invocation_pred_tcb_at,\n fastforce elim!: pred_tcb_weakenE)\n done\n\nend\n\n\ncontext begin interpretation Arch .\n\nrequalify_consts\n valid_arch_inv\n\nrequalify_facts\n invoke_arch_tcb\n invoke_arch_invs\n sts_valid_arch_inv\n arch_decode_inv_wf\n arch_pinv_st_tcb_at\n\nend\n\ndeclare invoke_arch_invs[wp]\ndeclare arch_decode_inv_wf[wp]\n\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM_HYP/ArchArch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.28140560742914383, "lm_q1q2_score": 0.16035973151630903}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__43_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__43_on_rules imports n_germanSymIndex_lemma_on_inv__43\nbegin\nsection{*All lemmas on causal relation between inv__43*}\nlemma lemma_inv__43_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv2. p__Inv2\\N\\f=inv__43 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__43) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__43_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.3040416623541848, "lm_q1q2_score": 0.16032619235515294}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n * This file contains an example spec, and shows it obeys the well_formed constraints\n *\n * This file contains the invariants of the user-space initialiser,\n * the well-formed conditions of the input capDL specification,\n * and the predicates describing the initial state.\n *)\n\ntheory ExampleSpecIRQ_SI\nimports SysInit.WellFormed_SI\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(****************************************************\n * Definitions of all the objects and capabilities. *\n ***************************************************)\n\ndefinition small_section_size :: nat\nwhere\n \"small_section_size = 20\"\n\ndefinition \"guard = 0\"\ndefinition \"guard_size = 1\"\ndefinition \"cnode_a1_size = 7\"\ndefinition \"cnode_a2_size = 7\"\ndefinition \"cnode_b_size = 8\"\ndefinition \"cnode_extra_size = 2\"\nlemmas constants [simp] = guard_def guard_size_def cnode_a1_size_def cnode_a2_size_def\n cnode_b_size_def cnode_extra_size_def\n\n\ndefinition \"tcb_a_id = 9\"\ndefinition \"tcb_b_id = 10\"\ndefinition \"cnode_a1_id = 6\"\ndefinition \"cnode_a2_id = 7\"\ndefinition \"cnode_b_id = 5\"\ndefinition \"cnode_extra_id = 11\"\ndefinition \"ep_id = 12\"\ndefinition \"ntfn_id = 13\"\ndefinition \"pd_a_id = 1\"\ndefinition \"pt_a_id = 8\"\ndefinition \"pd_b_id = 2\"\ndefinition \"frame_a1_id = 3\"\ndefinition \"frame_a2_id = 4\"\ndefinition \"frame_b_id = 0\"\nlemmas ids [simp] = tcb_a_id_def tcb_b_id_def cnode_a1_id_def\n cnode_a2_id_def cnode_b_id_def cnode_extra_id_def\n ep_id_def ntfn_id_def pd_a_id_def pt_a_id_def pd_b_id_def\n frame_a1_id_def frame_a2_id_def frame_b_id_def\n\ndefinition\n \"tcb_a =\n \\cdl_tcb_caps = [tcb_cspace_slot \\ CNodeCap cnode_a1_id guard guard_size cnode_a1_size,\n tcb_vspace_slot \\ PageDirectoryCap pd_a_id Real None,\n tcb_replycap_slot \\ NullCap,\n tcb_caller_slot \\ NullCap,\n tcb_ipcbuffer_slot \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Real None,\n tcb_pending_op_slot \\ NullCap,\n tcb_boundntfn_slot \\ NullCap],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = \\cdl_intent_op = None, cdl_intent_error = False, cdl_intent_cap = 0,\n cdl_intent_extras = [], cdl_intent_recv_slot = None\\,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = minBound\\\"\n\ndefinition\n \"tcb_b =\n \\cdl_tcb_caps = [tcb_cspace_slot \\ CNodeCap cnode_b_id guard guard_size cnode_b_size,\n tcb_vspace_slot \\ PageDirectoryCap pd_b_id Real None,\n tcb_replycap_slot \\ NullCap,\n tcb_caller_slot \\ NullCap,\n tcb_ipcbuffer_slot \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Real None,\n tcb_pending_op_slot \\ NullCap,\n tcb_boundntfn_slot \\ NullCap],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = \\cdl_intent_op = None, cdl_intent_error = False, cdl_intent_cap = 0,\n cdl_intent_extras = [], cdl_intent_recv_slot = None\\,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = minBound\\\"\n\ndefinition\n \"new_cap_map sz caps \\ empty_cap_map sz ++ caps\"\n\ndefinition\n \"new_cnode sz caps \\ \\cdl_cnode_caps = new_cap_map sz caps,\n cdl_cnode_size_bits = sz\\\"\n\ndefinition\n \"cnode_a1 \\\n new_cnode cnode_a1_size\n [0 \\ TcbCap tcb_a_id,\n 1 \\ CNodeCap cnode_a2_id guard guard_size cnode_a2_size]\"\n\n\ndefinition\n \"cnode_a2 \\\n new_cnode cnode_a2_size\n [0 \\ EndpointCap ep_id 0 {Write},\n 2 \\ CNodeCap cnode_a1_id guard guard_size cnode_a1_size,\n 3 \\ PageDirectoryCap pd_a_id Real None,\n 4 \\ PageTableCap pt_a_id Real None,\n 8 \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Real None,\n 10 \\ NotificationCap ntfn_id 0 {Read},\n 11 \\ FrameCap False frame_a2_id {AllowRead, AllowWrite} small_frame_size Real None,\n 12 \\ IrqHandlerCap 4]\"\n\ndefinition\n \"cnode_b \\\n new_cnode cnode_b_size\n [0 \\ TcbCap tcb_b_id,\n 2 \\ CNodeCap cnode_b_id guard guard_size cnode_b_size,\n 4 \\ EndpointCap ep_id 0 {Read},\n 7 \\ PageDirectoryCap pd_b_id Real None,\n 8 \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Real None,\n 254 \\ IrqHandlerCap 254]\"\n\ndefinition\n \"cnode_extra \\\n new_cnode cnode_extra_size\n [0 \\ CNodeCap cnode_extra_id guard guard_size cnode_extra_size,\n 1 \\ EndpointCap ep_id 0 UNIV,\n 2 \\ NotificationCap ntfn_id 0 {Read, Write}]\"\n\ndefinition\n \"pd_a \\ \\cdl_page_directory_caps = new_cap_map pd_size [0 \\ PageTableCap pt_a_id Fake None]\\\"\n\ndefinition\n \"pd_b \\ \\cdl_page_directory_caps = new_cap_map pd_size\n [2 \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Fake None]\\\"\n\ndefinition\n \"pt_a \\ \\cdl_page_table_caps = new_cap_map pt_size\n [0 \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Fake None,\n 255 \\ FrameCap False frame_a2_id {AllowRead, AllowWrite} small_frame_size Fake None]\\\"\n\ndefinition\n \"empty_frame \\ \\cdl_frame_size_bits = small_frame_size\\\"\ndefinition\n \"empty_section \\ \\cdl_frame_size_bits = small_section_size\\\"\n\ndefinition\n example_irq_node :: \"cdl_irq \\ cdl_object_id\"\nwhere\n \"example_irq_node = (\\irq. ucast irq + 0x100)\"\n\ndefinition\n \"new_irq_node obj_id \\\n \\ cdl_irq_node_caps = (\\slot. if slot = 0\n then Some (NotificationCap obj_id 0 {Read, Write})\n else None)\\\"\n\ndefinition\n irq_objects :: cdl_heap\nwhere\n \"irq_objects \\\n \\obj_id. if obj_id = 0x104 then Some (IRQNode (new_irq_node ntfn_id))\n else if 0x100 \\ obj_id \\ obj_id < 0x200 then (Some (IRQNode empty_irq_node))\n else None\"\n\n\nlemma\n \"irq_objects =\n (\\obj_id. if 0x100 \\ obj_id \\ obj_id < 0x200\n then (Some (IRQNode empty_irq_node))\n else None) ++\n (\\obj_id. if obj_id = 0x104 then Some (IRQNode (new_irq_node ntfn_id))\n else None)\"\n apply (rule ext)\n apply (clarsimp simp: irq_objects_def map_add_def)\n done\n\n\ndefinition\n \"example_spec =\n \\cdl_arch = ARM11,\n cdl_objects = [tcb_a_id \\ Tcb tcb_a,\n tcb_b_id \\ Tcb tcb_b,\n pd_a_id \\ PageDirectory pd_a,\n pt_a_id \\ PageTable pt_a,\n pd_b_id \\ PageDirectory pd_b,\n cnode_a1_id \\ CNode cnode_a1,\n cnode_a2_id \\ CNode cnode_a2,\n cnode_b_id \\ CNode cnode_b,\n cnode_extra_id \\ CNode cnode_extra,\n frame_a1_id \\ Frame empty_frame,\n frame_a2_id \\ Frame empty_frame,\n frame_b_id \\ Frame empty_section,\n ep_id \\ Endpoint,\n ntfn_id \\ Notification,\n 0x104 \\ IRQNode (new_irq_node ntfn_id),\n 0x1FE \\ IRQNode empty_irq_node],\n cdl_cdt = [(cnode_a2_id, 0) \\ (cnode_extra_id, 1),\n (cnode_b_id, 4) \\ (cnode_extra_id, 1),\n (cnode_a2_id, 10) \\ (cnode_extra_id, 2)], \\ \\All caps are orig caps,\n except endpoints and notifications.\\\n cdl_current_thread = undefined,\n cdl_irq_node = example_irq_node,\n cdl_asid_table = undefined,\n cdl_current_domain = minBound\\\"\n\n\nlemmas cnode_defs = cnode_a1_def cnode_a2_def cnode_b_def cnode_extra_def\nlemmas obj_defs = cnode_defs tcb_a_def tcb_b_def pd_a_def pd_b_def pt_a_def\n\nlemmas example_spec_def_expanded = example_spec_def\n [unfolded obj_defs tcb_slot_defs tcb_pending_op_slot_def\n new_cnode_def new_cap_map_def empty_cap_map_def]\n\n(*************************\n * Helper lemmas. *\n *************************)\nlemma cap_has_object_IrqHandlerCap [simp]:\n \"\\cap_has_object (IrqHandlerCap irq)\"\n by (clarsimp simp: cap_has_object_def)+\n\nlemma badge_bits_2p [simp]:\n \"(0::word32) < 2 ^ badge_bits\"\n by (clarsimp simp: p2_gt_0 badge_bits_def)\n\nlemma cdl_cnode_size_bits_new_cnode [simp]:\n \"cdl_cnode_size_bits (new_cnode sz caps) = sz\"\n by (clarsimp simp: new_cnode_def)\n\nlemma cnode_cap_size_simps [simp]:\n \"cnode_cap_size (CNodeCap a b c sz) = sz\"\n by (clarsimp simp: cnode_cap_size_def)\n\nlemma object_size_bits_new_cnode [simp]:\n \"object_size_bits (CNode (new_cnode sz caps)) = sz\"\n by (clarsimp simp: object_size_bits_def)\n\nlemma object_slots_Endpoint [simp]:\n \"object_slots Endpoint = Map.empty\"\n by (simp add: object_slots_def)\n\nlemma cdl_frame_size_bits_empty_frame [simp]:\n \"cdl_frame_size_bits empty_frame = small_frame_size\"\n by (simp add: empty_frame_def)\n\nlemma cdl_frame_size_bits_empty_section [simp]:\n \"cdl_frame_size_bits empty_section = small_section_size\"\n by (simp add: empty_section_def)\n\nlemma object_slots_empty_objects [simp]:\n \"object_slots (Frame f) slot = None\"\n by (clarsimp simp: object_slots_def)+\n\nlemma is_fake_pt_cap_simps:\n \"\\ is_fake_pt_cap (PageTableCap obj_id Real asid)\"\n \"is_fake_pt_cap (PageTableCap obj_id Fake asid)\"\n by (clarsimp simp: is_fake_pt_cap_def)+\n\nlemma frame_cap_not_cnode:\n \"\\is_cnode_cap (FrameCap dev a b c d e)\"\n by (clarsimp simp: cap_type_def)\n\nlemma empty_cap_map_NullCap [simp]:\n \"empty_cap_map sz slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: empty_cap_map_def split: if_split_asm)\n\nlemma new_cap_map_empty_NullCap [simp]:\n \"new_cap_map sz Map.empty slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cap_map_def)\n\n\nlemma new_cap_map_slot:\n \"\\new_cap_map sz caps slot = Some cap; cap \\ NullCap\\ \\ caps slot = Some cap\"\n by (clarsimp simp: new_cap_map_def empty_cap_map_def split: option.splits if_split_asm)\n\nlemma cdl_cnode_caps_new_cnode:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap; cap \\ NullCap\\ \\ caps slot = Some cap\"\n by (clarsimp simp: new_cnode_def, erule (1) new_cap_map_slot)\n\nlemma new_cap_map_caps_D:\n \"new_cap_map sz caps slot = Some cap \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cap_map_def)\n\nlemma cdl_cnode_caps_new_cnode_D:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap\\\n \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cnode_def, erule (1) new_cap_map_slot)\n\nlemma cdl_irq_node_caps_empty_irq_node_D:\n \"\\cdl_irq_node_caps (empty_irq_node) slot = Some cap\\\n \\ cap = NullCap\"\n by (clarsimp simp: empty_irq_node_def)\n\nlemma object_slots_new_cnode_D:\n \"object_slots (CNode (new_cnode sz caps)) slot = Some cap\n \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: object_slots_def dest!: cdl_cnode_caps_new_cnode_D)\n\nlemma object_slots_new_cnode_cap_has_object [dest!]:\n \"\\object_slots (CNode (new_cnode sz caps)) slot = Some cap; cap_has_object cap\\\n \\ caps slot = Some cap\"\n by (clarsimp simp: object_slots_def dest!: cdl_cnode_caps_new_cnode_D)\n\nlemma cdl_cnode_caps_empty_cnode [dest!]:\n \"cdl_cnode_caps (empty_cnode sz) slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: empty_cnode_def)\n\nlemma cdl_cnode_caps_new_cnode_cnode_cap:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap; is_cnode_cap cap\\\n \\ caps slot = Some cap\"\n by (erule cdl_cnode_caps_new_cnode, clarsimp)\n\nlemma object_slots_new_cnode_cnode_cap:\n \"\\object_slots (CNode (new_cnode sz caps)) slot = Some cap; is_cnode_cap cap\\\n \\ caps slot = Some cap\"\n by (clarsimp simp: object_slots_def, erule cdl_cnode_caps_new_cnode, clarsimp)\n\nlemma object_slots_empty_irq_node [simp, dest!]:\n \"object_slots (IRQNode empty_irq_node) slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: object_slots_def empty_irq_node_def)\n\nlemma tcb_domain_simp [simp]:\n \"tcb_domain (Tcb \\cdl_tcb_caps = caps,\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = intent,\n cdl_tcb_has_fault = fault,\n cdl_tcb_domain = domain\\) = domain\"\n by (simp add: tcb_domain_def)\n\n\nlemma cdl_irq_node_example_spec [simp]:\n \"cdl_irq_node example_spec = example_irq_node\"\n by (clarsimp simp: example_spec_def)\n\nlemma range_example_irq_node_helper:\n \"range example_irq_node = (\\irq. irq + 0x100) ` range (ucast :: 10 word \\ 32 word)\"\n by (auto simp: example_irq_node_def image_def)\n\nlemma range_example_irq_node:\n \"range example_irq_node = {x. 0x100 \\ x \\ x < 0x500}\"\n apply (clarsimp simp: range_example_irq_node_helper ucast_range_less)\n apply (clarsimp simp: image_def)\n apply rule\n apply (clarsimp simp: word_le_nat_alt word_less_nat_alt unat_plus_if')\n apply clarsimp\n apply (rule_tac x=\"x - 0x100\" in exI)\n apply unat_arith\n done\n\nlemma irq_nodes_example_spec:\n \"irq_nodes example_spec = {obj_id. obj_id = 0x104 \\ obj_id = 0x1FE}\"\n by (auto simp: irq_nodes_def example_spec_def object_at_def is_irq_node_def)\n\n(*************************\n * End of helper lemmas. *\n *************************)\n\n\n(************************\nHelpers on the specific state.\n\n***************************)\n\n\n\n\nlemma onehundred_not_le_one:\n \"\\(0x100 \\ (1::32 word))\"\n by unat_arith\n\nlemma object_type_simps [simp]:\n \"object_type (Tcb t) = TcbType\"\n \"object_type (CNode c) = CNodeType\"\n \"object_type (Endpoint) = EndpointType\"\n \"object_type (Notification) = NotificationType\"\n \"object_type (PageDirectory pd) = PageDirectoryType\"\n \"object_type (PageTable pt) = PageTableType\"\n \"object_type (Frame f) = FrameType (cdl_frame_size_bits f)\"\n \"object_type (IRQNode empty_irq_node) = IRQNodeType\"\n by (clarsimp simp: object_type_def)+\n\nlemma cap_irq_simp [simp]:\n \"cap_irq (IrqHandlerCap irq) = irq\"\n by (simp add: cap_irq_def)\n\nlemma example_irq_node_simps [simp]:\n \"example_irq_node 4 = 0x104\"\n \"example_irq_node 0xFE = 0x1FE\"\n by (simp add: example_irq_node_def)+\n\nlemma irq_objects_simps [simp]:\n \"irq_objects 0 = None\"\n \"irq_objects 1 = None\"\n \"irq_objects 2 = None\"\n \"irq_objects 3 = None\"\n \"irq_objects 4 = None\"\n \"irq_objects 5 = None\"\n \"irq_objects 6 = None\"\n \"irq_objects 7 = None\"\n \"irq_objects 8 = None\"\n \"irq_objects 9 = None\"\n \"irq_objects 0xA = None\"\n \"irq_objects 0xB = None\"\n \"irq_objects 0xC = None\"\n \"irq_objects 0xD = None\"\n by (clarsimp simp: irq_objects_def onehundred_not_le_one)+\n\n\nlemma opt_cap_example_spec [simp]:\n \"opt_cap (4, slot) example_spec = object_slots (Frame empty_frame) slot\"\n \"opt_cap (5, slot) example_spec = object_slots (CNode cnode_b) slot\"\n \"opt_cap (6, slot) example_spec = object_slots (CNode cnode_a1) slot\"\n \"opt_cap (7, slot) example_spec = object_slots (CNode cnode_a2) slot\"\n \"opt_cap (0xB, slot) example_spec = object_slots (CNode cnode_extra) slot\"\n by (auto simp: example_spec_def opt_cap_def slots_of_def\n map_add_def irq_objects_def\n split: if_split_asm)\n\nlemma irq_objects_some_object:\n \"irq_objects obj_id = Some obj \\\n (obj_id = 0x104 \\ obj = IRQNode (new_irq_node ntfn_id)) \\ obj = IRQNode empty_irq_node\"\n by (clarsimp simp: irq_objects_def split: if_split_asm)\n\n(*\nlemma real_cnode_at_example_spec:\n \"real_cnode_at obj_id example_spec\n \\ obj_id = cnode_a1_id \\ obj_id = cnode_a2_id \\ obj_id = cnode_b_id \\ obj_id = cnode_extra_id\"\n apply (clarsimp simp: real_cnode_at_def object_at_def is_cnode_def irq_cnodes_example_spec)\n by (auto simp: example_spec_def object_at_def is_cnode_def irq_objects_def\n split: if_split_asm cdl_object.splits)\n*)\n\nlemma cnode_at_example_spec:\n \"cnode_at obj_id example_spec =\n (obj_id = cnode_a1_id \\ obj_id = cnode_a2_id \\ obj_id = cnode_b_id \\ obj_id = cnode_extra_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def irq_objects_def map_add_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma pt_at_example_spec:\n \"pt_at obj_id example_spec = (obj_id = pt_a_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def object_at_def is_pt_def irq_objects_def\n new_irq_node_def empty_irq_node_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma pd_at_example_spec:\n \"pd_at obj_id example_spec = (obj_id = pd_a_id \\ obj_id = pd_b_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def object_at_def is_pd_def irq_objects_def\n new_irq_node_def empty_irq_node_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma slots_of_example_spec_obj_ids:\n \"\\slots_of obj_id example_spec 0 = Some cap; cap \\ NullCap\\\\\n ((obj_id = tcb_a_id) \\\n (obj_id = tcb_b_id) \\\n (obj_id = cnode_a1_id) \\\n (obj_id = cnode_a2_id) \\\n (obj_id = cnode_b_id) \\\n (obj_id = cnode_extra_id) \\\n (obj_id = pd_a_id) \\\n (obj_id = pt_a_id) \\\n (obj_id = pd_b_id) \\\n (obj_id = 0x104))\"\n by (clarsimp simp: example_spec_def slots_of_def object_slots_def\n split: if_split_asm)\n\nlemma irq_handler_cap_example_spec:\n \"\\is_irqhandler_cap cap; opt_cap (obj_id, slot) example_spec = Some cap\\\n \\ (obj_id = cnode_a2_id \\ slot = 12) \\\n (obj_id = cnode_b_id \\ slot = 254)\"\n by (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def empty_irq_node_def new_irq_node_def new_cnode_def\n obj_defs new_cap_map_def empty_cap_map_def\n split: if_split_asm)\n\n\nlemma irqhandler_cap_at_example_spec:\n \"irqhandler_cap_at (obj_id, slot) example_spec\n = ((obj_id = cnode_a2_id \\ slot = 12) \\\n (obj_id = cnode_b_id \\ slot = 254))\"\n apply (clarsimp simp: cap_at_def)\n apply (rule iffI)\n apply clarsimp\n apply (drule (1) irq_handler_cap_example_spec)\n apply clarsimp\n apply (erule disjE)\n apply (clarsimp simp: cnode_a2_def object_slots_def new_cnode_def new_cap_map_def)\n apply (clarsimp simp: cnode_b_def object_slots_def new_cnode_def new_cap_map_def)\n done\n\nlemma cap_at_has_no_parents_in_cdt_example_spec:\n \"cap_at_has_no_parents_in_cdt (obj_id, slot) example_spec\n = ((obj_id \\ cnode_a2_id \\ slot \\ 0) \\\n (obj_id \\ cnode_a2_id \\ slot \\ 10) \\\n (obj_id \\ cnode_b_id \\ slot \\ 4))\"\n by (auto simp: cap_at_has_no_parents_in_cdt_def opt_parent_def example_spec_def)\n\nlemma is_orig_cap_example_spec:\n \"original_cap_at (obj_id, slot) example_spec\n = ((obj_id \\ cnode_a2_id \\ slot \\ 0) \\\n (obj_id \\ cnode_a2_id \\ slot \\ 10) \\\n (obj_id \\ cnode_b_id \\ slot \\ 4))\"\n by (fastforce simp: original_cap_at_def cap_at_has_no_parents_in_cdt_example_spec irqhandler_cap_at_example_spec)\n\n\n(****************************************\n * Proof that the state is well formed. *\n ****************************************)\n\nlemma well_formed_tcb_a:\n \"well_formed_tcb example_spec obj_id (Tcb tcb_a)\"\n by (auto simp: well_formed_tcb_def object_slots_def tcb_a_def tcb_slot_defs tcb_has_fault_def\n is_default_cap_def default_cap_def cap_type_def irq_nodes_example_spec)\n\nlemma well_formed_tcb_b:\n \"well_formed_tcb example_spec obj_id (Tcb tcb_b)\"\n by (auto simp: well_formed_tcb_def object_slots_def tcb_b_def tcb_slot_defs tcb_has_fault_def\n is_default_cap_def default_cap_def cap_type_def irq_nodes_example_spec)\n\nlemma well_formed_orig_caps_unique_example:\n \"well_formed_orig_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_orig_caps_unique_def)\n apply (clarsimp simp: cnode_at_example_spec is_orig_cap_example_spec)\n by (elim disjE, (clarsimp simp: cnode_defs split: if_split_asm)+)\n\nlemma well_formed_fake_pt_caps_unique_example:\n \"well_formed_fake_pt_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_fake_pt_caps_unique_def\n pd_at_example_spec)\n apply (fastforce simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def is_fake_pt_cap_simps\n pd_a_def pd_b_def new_cap_map_def irq_objects_def\n split: if_split_asm option.splits)\n done\n\nlemma well_formed_orig_cap_tcb [simp]:\n \"well_formed_orig_cap (TcbCap obj_id)\"\n by (clarsimp simp: well_formed_orig_cap_def default_cap_def cap_type_def\n cap_rights_def ep_related_cap_def)\n\nlemma well_formed_cap_ex [simp]:\n \"well_formed_cap (CNodeCap a 0 0 2)\"\n \"well_formed_cap (TcbCap 0)\"\n by (clarsimp simp: well_formed_cap_def guard_bits_def)+\n\nlemma well_formed_cap_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap\\\n \\ well_formed_cap cap\"\n apply (clarsimp simp: well_formed_cap_def)\n by (clarsimp simp: well_formed_cap_def example_spec_def\n obj_defs new_cap_map_def new_irq_node_def new_cnode_def\n object_slots_def empty_cap_map_def guard_bits_def\n tcb_slot_defs vm_read_write_def\n split: cdl_cap.splits if_split_asm)\n\nlemma well_formed_cdt_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap\\\n \\ well_formed_cdt example_spec (obj_id, slot) cap\"\n apply (clarsimp simp: well_formed_cdt_def)\n apply (clarsimp simp: cnode_at_example_spec)\n apply (case_tac \"(obj_id = cnode_a2_id \\ slot = 0) \\\n (obj_id = cnode_b_id \\ slot = 4)\")\n apply (rule_tac x=cnode_extra_id in exI, clarsimp, rule conjI)\n subgoal by (fastforce simp: example_spec_def cnode_defs\n split: if_split_asm)\n apply (rule_tac x=1 in exI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n cnode_defs object_slots_def new_cnode_def new_cap_map_def\n irq_objects_def map_add_def empty_irq_node_def\n split: if_split_asm)\n apply (case_tac \"(obj_id = cnode_a2_id \\ slot = 10)\")\n apply (rule_tac x=cnode_extra_id in exI, clarsimp, rule conjI)\n apply (fastforce simp: example_spec_def cnode_defs\n split: if_split_asm)\n apply (rule_tac x=2 in exI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n cnode_defs object_slots_def new_cnode_def new_cap_map_def\n irq_objects_def map_add_def empty_irq_node_def\n split: if_split_asm)\n apply clarsimp\n apply (rule_tac x=obj_id in exI, clarsimp, rule conjI)\n apply (clarsimp simp: example_spec_def cnode_defs\n dest!: object_slots_new_cnode_D\n split: if_split_asm)\n apply (fastforce simp: is_orig_cap_example_spec opt_cap_def slots_of_def)\n done\n\nlemma well_formed_orig_cap_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap;\n original_cap_at (obj_id, slot) example_spec \\\n \\ well_formed_orig_cap cap\"\n apply (clarsimp simp: is_orig_cap_example_spec well_formed_orig_cap_def)\n by (clarsimp simp: example_spec_def object_slots_def obj_defs new_cnode_def new_cap_map_def\n new_irq_node_def ep_related_cap_def cap_type_def default_cap_def cap_rights_def\n split: if_split_asm)\n\nlemma well_formed_caps_example:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_caps example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_caps_def, rule conjI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def obj_defs object_type_def cap_type_def object_slots_def\n is_copyable_cap_def\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: well_formed_cap_to_real_object_def real_object_at_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def obj_defs object_slots_def onehundred_not_le_one\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n irq_objects_some_object cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n apply (fastforce simp: new_irq_node_def empty_irq_node_def split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: well_formed_cap_types_match_def)\n apply (rule conjI)\n apply (clarsimp simp: example_spec_def object_slots_def obj_defs\n irq_objects_def map_add_def new_irq_node_def\n onehundred_not_le_one\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n apply (clarsimp simp: example_spec_def object_slots_def obj_defs\n irq_objects_def map_add_def new_irq_node_def\n onehundred_not_le_one object_type_def\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n by (clarsimp simp: example_spec_def obj_defs is_cnode_def is_tcb_def is_fake_vm_cap_def\n object_slots_def object_type_def cap_type_def new_irq_node_def\n empty_irq_node_def empty_cnode_def\n dest!: cdl_cnode_caps_new_cnode_D irq_objects_some_object cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm cdl_object.splits)\n\nlemma real_object_at_example_spec:\n \"real_object_at obj_id example_spec =\n ((obj_id = tcb_a_id) \\\n (obj_id = tcb_b_id) \\\n (obj_id = cnode_a1_id) \\\n (obj_id = cnode_a2_id) \\\n (obj_id = cnode_b_id) \\\n (obj_id = cnode_extra_id) \\\n (obj_id = ep_id) \\\n (obj_id = ntfn_id) \\\n (obj_id = pd_a_id) \\\n (obj_id = pt_a_id) \\\n (obj_id = pd_b_id) \\\n (obj_id = frame_a1_id) \\\n (obj_id = frame_a2_id) \\\n (obj_id = frame_b_id))\"\n apply (clarsimp simp: real_object_at_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def irq_objects_def dom_def onehundred_not_le_one\n split: if_split_asm)\n done\n\nlemma real_object_at_example_spec_simp [simp]:\n \"real_object_at 0 example_spec\"\n \"real_object_at 1 example_spec = True\"\n \"real_object_at 2 example_spec\"\n \"real_object_at 3 example_spec\"\n \"real_object_at 4 example_spec\"\n \"real_object_at 5 example_spec\"\n \"real_object_at 6 example_spec\"\n \"real_object_at 7 example_spec\"\n \"real_object_at 8 example_spec\"\n \"real_object_at 9 example_spec\"\n \"real_object_at 0xA example_spec\"\n \"real_object_at 0xB example_spec\"\n \"real_object_at 0xC example_spec\"\n \"real_object_at 0xD example_spec\"\n \"\\real_object_at 0x104 example_spec\"\n \"\\real_object_at 0x1FE example_spec\"\n by (clarsimp simp: real_object_at_example_spec)+\n\nlemma cdl_objects_example_spec_simps [simp]:\n \"cdl_objects example_spec 4 = Some (Frame empty_frame)\"\n \"cdl_objects example_spec 0xD = Some Notification\"\n \"cdl_objects example_spec 0x1FE = Some (IRQNode empty_irq_node)\"\n by (clarsimp simp: example_spec_def map_add_def)+\n\nlemma well_formed_cap_to_object_example:\n \"cdl_objects example_spec obj_id = Some obj\n \\ well_formed_cap_to_object example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_cap_to_object_def is_orig_cap_example_spec)\n apply (intro conjI)\n apply (case_tac \"obj_id = ep_id \\\n obj_id = ntfn_id \\\n obj_id = cnode_extra_id\")\n apply (rule_tac x=cnode_extra_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_extra_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = tcb_b_id \\\n obj_id = cnode_b_id \\\n obj_id = pd_b_id \\\n obj_id = frame_b_id\")\n apply (rule_tac x=cnode_b_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_b_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = tcb_a_id \\\n obj_id = cnode_a2_id\")\n apply (rule_tac x=cnode_a1_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_a1_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = cnode_a1_id \\\n obj_id = pd_a_id \\\n obj_id = pt_a_id \\\n obj_id = frame_a1_id \\\n obj_id = ep_id\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = frame_a2_id\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (rule_tac x=11 in exI) (* Not sure why fastforce gives up here. *)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = 0x104\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (rule_tac x=12 in exI) (* Not sure why fastforce gives up here. *)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = 0x1FE\")\n apply (rule_tac x=cnode_b_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_b_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (clarsimp simp: example_spec_def)\n apply clarsimp\n apply (clarsimp simp: example_spec_def)\n by (clarsimp simp: opt_cap_def slots_of_def obj_defs\n object_slots_def object_size_bits_def\n new_cap_map_def empty_cap_map_def frame_cap_not_cnode\n empty_irq_node_def new_irq_node_def\n split: if_split_asm\n | drule (1) cdl_cnode_caps_new_cnode_cnode_cap)+ (* Takes 20 seconds. *)\n\nlemma well_formed_cap_to_non_empty_pt_example:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_cap_to_non_empty_pt example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_cap_to_non_empty_pt_def pt_at_example_spec)\n apply (rule exI [where x=pd_a_id])\n apply (clarsimp simp: well_formed_cap_to_non_empty_pt_def example_spec_def is_pt_def\n object_at_def opt_cap_def slots_of_def object_slots_def\n obj_defs new_cap_map_def is_pd_def empty_cap_map_def\n split: if_split_asm)\n done\n\nlemma well_formed_vspace_example:\n \"cdl_objects example_spec obj_id = Some obj\n \\ well_formed_vspace example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_vspace_def well_formed_cap_to_non_empty_pt_example)\n apply (clarsimp simp: example_spec_def is_pt_def is_pd_def object_slots_def empty_cap_map_def\n new_irq_node_def\n split: if_split_asm)\n apply (fastforce simp: cap_type_def is_fake_vm_cap_def obj_defs new_cap_map_def small_section_size_def\n split: if_split_asm)\n apply (clarsimp simp: obj_defs new_cap_map_def cap_type_def small_frame_size_def\n is_fake_vm_cap_def is_fake_pt_cap_simps small_section_size_def\n split: if_split_asm)\n apply (clarsimp simp: obj_defs new_cap_map_def cap_type_def small_frame_size_def\n is_fake_vm_cap_def is_fake_pt_cap_simps small_section_size_def\n split: if_split_asm)\n done\n\n\nlemma well_formed_irqhandler_caps_unique_example_spec:\n \"well_formed_irqhandler_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_irqhandler_caps_unique_def)\n apply (drule (1) irq_handler_cap_example_spec)+\n by (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def obj_defs\n new_cnode_def new_cap_map_def\n split: if_split_asm)\n\nlemma ucast_0xFE:\n \"(ucast :: 8 word \\ 32 word) irq = 0xFE \\ irq = 0xFE\"\n by (rule ucast_up_inj, simp+)\n\nlemma ucast_4:\n \"(ucast :: 10 word \\ 32 word) irq = 4 \\ irq = 4\"\n by (rule ucast_up_inj, simp+)\n\nlemma rangeD:\n \"\\range f = A; f x = y\\ \\ y \\ A\"\n by (fastforce simp: image_def)\n\nlemma slots_of_example_irq_node:\n \"\\slots_of (example_irq_node irq) example_spec 0 = Some cap;\n cap \\ NullCap\\\n \\ (irq = 4)\"\n apply (frule (1) slots_of_example_spec_obj_ids)\n apply (insert range_example_irq_node)\n apply (erule disjE, drule (1) rangeD, simp add: onehundred_not_le_one)+\n apply (clarsimp simp: example_irq_node_def ucast_4)\n done\n\nlemma bound_irqs_example_spec [simp]:\n \"bound_irqs example_spec = {4}\"\n apply (clarsimp simp: bound_irqs_def)\n apply rule\n apply clarsimp\n apply (erule (1) slots_of_example_irq_node)\n apply (clarsimp simp: example_spec_def slots_of_def\n object_slots_def new_irq_node_def)\n done\n\nlemma well_formed_irqhandler_caps_example_spec:\n \"well_formed_irqhandler_caps example_spec\"\n apply (clarsimp simp: well_formed_irqhandler_caps_def)\n apply (rule exI [where x=cnode_a2_id])\n apply (rule exI [where x=12])\n apply (rule exI [where x=\"IrqHandlerCap 4\"])\n apply (clarsimp simp: object_slots_def cnode_a2_def new_cnode_def new_cap_map_def)\n done\n\nlemma rangeI:\n \"f x = a \\ a \\ range f\"\n by auto\n\nlemma well_formed_irq_table_example_spec:\n \"well_formed_irq_table example_spec\"\n apply (clarsimp simp: well_formed_irq_table_def)\n apply (rule conjI)\n apply (clarsimp simp: example_irq_node_def)\n apply (clarsimp simp: inj_on_def ucast_up_inj)\n apply (clarsimp simp: irq_nodes_example_spec)\n apply (rule subset_antisym)\n apply (clarsimp simp: example_spec_def)\n apply (metis example_irq_node_simps)\n apply clarsimp\n apply (clarsimp simp: example_spec_def split: if_split_asm,\n (drule rangeI [where f=example_irq_node],\n simp add: range_example_irq_node onehundred_not_le_one)+)\n done\n\nlemma well_formed_tcb_example_spec:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_tcb example_spec obj_id obj\"\n apply (case_tac \"obj_id = tcb_a_id\")\n apply (cut_tac obj_id = tcb_a_id in well_formed_tcb_a)\n apply (clarsimp simp: example_spec_def split: if_split_asm)\n apply (case_tac \"obj_id = tcb_b_id\")\n apply (cut_tac obj_id = tcb_b_id in well_formed_tcb_b)\n apply (clarsimp simp: example_spec_def split: if_split_asm)\n by (clarsimp simp: example_spec_def well_formed_tcb_def is_tcb_def\n empty_irq_node_def new_irq_node_def\n split: if_split_asm)\n\nlemma well_formed_irq_node_example_spec:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_irq_node example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_irq_node_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def object_slots_def empty_irq_node_def new_irq_node_def\n empty_cnode_def empty_cap_map_def dom_def\n is_default_cap_def default_cap_def onehundred_not_le_one\n split: if_split_asm)\n done\n\nlemma well_formed_example:\n \"well_formed example_spec\"\n apply (clarsimp simp: well_formed_def)\n apply (intro conjI)\n apply (rule well_formed_orig_caps_unique_example)\n apply (rule well_formed_irqhandler_caps_unique_example_spec)\n apply (rule well_formed_fake_pt_caps_unique_example)\n apply (rule well_formed_irqhandler_caps_example_spec)\n apply (rule well_formed_irq_table_example_spec)\n apply (clarsimp split: option.splits, rename_tac obj)\n apply (clarsimp simp: well_formed_caps_example well_formed_cap_to_object_example\n well_formed_orig_caps_unique_example)\n apply (rule conjI)\n apply (fact well_formed_tcb_example_spec)\n apply (rule conjI)\n apply (fact well_formed_vspace_example)\n apply (rule conjI)\n apply (fact well_formed_irq_node_example_spec)\n apply (clarsimp simp: cnode_at_example_spec)\n by (auto simp: example_spec_def object_size_bits_def object_default_state_def2\n pd_size_def word_bits_def empty_cnode_def is_cnode_def\n object_slots_def empty_cap_map_def tcb_slot_defs slots_of_def\n default_tcb_def obj_defs cap_at_def opt_cap_def\n small_frame_size_def small_section_size_def pt_size_def\n new_cnode_def new_cap_map_def empty_irq_node_def\n new_irq_node_def\n split: if_split_asm)\n\nend\n\nend\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/sys-init/examples/ExampleSpecIRQ_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3106943959796865, "lm_q1q2_score": 0.1602002182706592}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__93_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__93_on_rules imports n_g2kAbsAfter_lemma_on_inv__93\nbegin\nsection{*All lemmas on causal relation between inv__93*}\nlemma lemma_inv__93_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__93 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__93) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__93) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__93_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3106943895971202, "lm_q1q2_score": 0.1602002149796809}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__14_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__14_on_rules imports n_german_lemma_on_inv__14\nbegin\nsection{*All lemmas on causal relation between inv__14*}\nlemma lemma_inv__14_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__14 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__14) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__14_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.1602002116887026}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__60_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__60_on_rules imports n_germanSimp_lemma_on_inv__60\nbegin\nsection{*All lemmas on causal relation between inv__60*}\nlemma lemma_inv__60_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__60 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__60) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__60) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__60_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.31069437683198775, "lm_q1q2_score": 0.1602002083977244}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__2_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__2_on_rules imports n_g2kAbsAfter_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__2 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__2) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__2) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.3174262655876759, "lm_q1q2_score": 0.15995305391763265}} {"text": "(* Title: HOL/NanoJava/OpSem.thy\n Author: David von Oheimb\n Copyright 2001 Technische Universitaet Muenchen\n*)\n\nsection \"Operational Evaluation Semantics\"\n\ntheory OpSem imports State begin\n\ninductive\n exec :: \"[state,stmt, nat,state] => bool\" (\"_ -_-_\\ _\" [98,90, 65,98] 89)\n and eval :: \"[state,expr,val,nat,state] => bool\" (\"_ -_\\_-_\\ _\"[98,95,99,65,98] 89)\nwhere\n Skip: \" s -Skip-n\\ s\"\n\n| Comp: \"[| s0 -c1-n\\ s1; s1 -c2-n\\ s2 |] ==>\n s0 -c1;; c2-n\\ s2\"\n\n| Cond: \"[| s0 -e\\v-n\\ s1; s1 -(if v\\Null then c1 else c2)-n\\ s2 |] ==>\n s0 -If(e) c1 Else c2-n\\ s2\"\n\n| LoopF:\" s0 = Null ==>\n s0 -While(x) c-n\\ s0\"\n| LoopT:\"[| s0 \\ Null; s0 -c-n\\ s1; s1 -While(x) c-n\\ s2 |] ==>\n s0 -While(x) c-n\\ s2\"\n\n| LAcc: \" s -LAcc x\\s-n\\ s\"\n\n| LAss: \" s -e\\v-n\\ s' ==>\n s -x:==e-n\\ lupd(x\\v) s'\"\n\n| FAcc: \" s -e\\Addr a-n\\ s' ==>\n s -e..f\\get_field s' a f-n\\ s'\"\n\n| FAss: \"[| s0 -e1\\Addr a-n\\ s1; s1 -e2\\v-n\\ s2 |] ==>\n s0 -e1..f:==e2-n\\ upd_obj a f v s2\"\n\n| NewC: \" new_Addr s = Addr a ==>\n s -new C\\Addr a-n\\ new_obj a C s\"\n\n| Cast: \"[| s -e\\v-n\\ s';\n case v of Null => True | Addr a => obj_class s' a \\C C |] ==>\n s -Cast C e\\v-n\\ s'\"\n\n| Call: \"[| s0 -e1\\a-n\\ s1; s1 -e2\\p-n\\ s2; \n lupd(This\\a)(lupd(Par\\p)(del_locs s2)) -Meth (C,m)-n\\ s3\n |] ==> s0 -{C}e1..m(e2)\\s3-n\\ set_locs s2 s3\"\n\n| Meth: \"[| s = Addr a; D = obj_class s a; D\\C C;\n init_locs D m s -Impl (D,m)-n\\ s' |] ==>\n s -Meth (C,m)-n\\ s'\"\n\n| Impl: \" s -body Cm- n\\ s' ==>\n s -Impl Cm-Suc n\\ s'\"\n\n\ninductive_cases exec_elim_cases':\n \"s -Skip -n\\ t\"\n \"s -c1;; c2 -n\\ t\"\n \"s -If(e) c1 Else c2-n\\ t\"\n \"s -While(x) c -n\\ t\"\n \"s -x:==e -n\\ t\"\n \"s -e1..f:==e2 -n\\ t\"\ninductive_cases Meth_elim_cases: \"s -Meth Cm -n\\ t\"\ninductive_cases Impl_elim_cases: \"s -Impl Cm -n\\ t\"\nlemmas exec_elim_cases = exec_elim_cases' Meth_elim_cases Impl_elim_cases\ninductive_cases eval_elim_cases:\n \"s -new C \\v-n\\ t\"\n \"s -Cast C e \\v-n\\ t\"\n \"s -LAcc x \\v-n\\ t\"\n \"s -e..f \\v-n\\ t\"\n \"s -{C}e1..m(e2) \\v-n\\ t\"\n\nlemma exec_eval_mono [rule_format]: \n \"(s -c -n\\ t \\ (\\m. n \\ m \\ s -c -m\\ t)) \\\n (s -e\\v-n\\ t \\ (\\m. n \\ m \\ s -e\\v-m\\ t))\"\napply (rule exec_eval.induct)\nprefer 14 (* Impl *)\napply clarify\napply (rename_tac n)\napply (case_tac n)\napply (blast intro:exec_eval.intros)+\ndone\nlemmas exec_mono = exec_eval_mono [THEN conjunct1, rule_format]\nlemmas eval_mono = exec_eval_mono [THEN conjunct2, rule_format]\n\nlemma exec_exec_max: \"\\s1 -c1- n1 \\ t1 ; s2 -c2- n2\\ t2\\ \\ \n s1 -c1-max n1 n2\\ t1 \\ s2 -c2-max n1 n2\\ t2\"\nby (fast intro: exec_mono max.cobounded1 max.cobounded2)\n\nlemma eval_exec_max: \"\\s1 -c- n1 \\ t1 ; s2 -e\\v- n2\\ t2\\ \\ \n s1 -c-max n1 n2\\ t1 \\ s2 -e\\v-max n1 n2\\ t2\"\nby (fast intro: eval_mono exec_mono max.cobounded1 max.cobounded2)\n\nlemma eval_eval_max: \"\\s1 -e1\\v1- n1 \\ t1 ; s2 -e2\\v2- n2\\ t2\\ \\ \n s1 -e1\\v1-max n1 n2\\ t1 \\ s2 -e2\\v2-max n1 n2\\ t2\"\nby (fast intro: eval_mono max.cobounded1 max.cobounded2)\n\nlemma eval_eval_exec_max: \n \"\\s1 -e1\\v1-n1\\ t1; s2 -e2\\v2-n2\\ t2; s3 -c-n3\\ t3\\ \\ \n s1 -e1\\v1-max (max n1 n2) n3\\ t1 \\ \n s2 -e2\\v2-max (max n1 n2) n3\\ t2 \\ \n s3 -c -max (max n1 n2) n3\\ t3\"\napply (drule (1) eval_eval_max, erule thin_rl)\nby (fast intro: exec_mono eval_mono max.cobounded1 max.cobounded2)\n\nlemma Impl_body_eq: \"(\\t. \\n. Z -Impl M-n\\ t) = (\\t. \\n. Z -body M-n\\ t)\"\napply (rule ext)\napply (fast elim: exec_elim_cases intro: exec_eval.Impl)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/NanoJava/OpSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.31742626558767584, "lm_q1q2_score": 0.15995305391763262}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__125.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__125 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__125 and some rule r*}\nlemma n_PI_Remote_GetVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__125:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__125:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_NakVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__125:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp=p__Inv3)\\(src=p__Inv3\\pp=p__Inv4)\\(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\\(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\pp~=p__Inv3\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__125:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst=p__Inv3)\\(src=p__Inv3\\dst=p__Inv4)\\(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\\(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\\(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst=p__Inv3)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4\\dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__125:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst=p__Inv3)\\(dst~=p__Inv3\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst=p__Inv3)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv3\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ShWbVsinv__125:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_Get))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''HomeProc'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv3)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv3)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__125:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv3 p__Inv4 where a2:\"p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src=p__Inv3)\\(src~=p__Inv3\\src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src=p__Inv3)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv3\\src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__125:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__125:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__125:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__125:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__125:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__125:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__125:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__125:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__125:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__125:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__125:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__125:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__125:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__125:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__125:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__125:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__125:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__125 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__125.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3174262591305011, "lm_q1q2_score": 0.15995305066382237}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__14_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__14_on_rules imports n_g2kAbsAfter_lemma_on_inv__14\nbegin\nsection{*All lemmas on causal relation between inv__14*}\nlemma lemma_inv__14_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__14 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__14) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__14) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__14_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.30735802955444114, "lm_q1q2_score": 0.15967904982671371}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__43_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__43_on_rules imports n_g2kAbsAfter_lemma_on_inv__43\nbegin\nsection{*All lemmas on causal relation between inv__43*}\nlemma lemma_inv__43_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__43 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__43) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__43) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__43_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.30735801686526387, "lm_q1q2_score": 0.1596790432344156}} {"text": "(* Title: HOL/TLA/Memory/RPC.thy\n Author: Stephan Merz, University of Munich\n*)\n\nsection \\RPC-Memory example: RPC specification\\\n\ntheory RPC\nimports RPCParameters ProcedureInterface Memory\nbegin\n\ntype_synonym rpcSndChType = \"(rpcOp,Vals) channel\"\ntype_synonym rpcRcvChType = \"memChType\"\ntype_synonym rpcStType = \"(PrIds \\ rpcState) stfun\"\n\n\n(* state predicates *)\n\ndefinition RPCInit :: \"rpcRcvChType \\ rpcStType \\ PrIds \\ stpred\"\n where \"RPCInit rcv rst p == PRED ((rst!p = #rpcA) \\ \\Calling rcv p)\"\n\n\n(* actions *)\n\ndefinition RPCFwd :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ action\"\n where \"RPCFwd send rcv rst p == ACT\n $(Calling send p)\n \\ $(rst!p) = # rpcA\n \\ IsLegalRcvArg>\n \\ Call rcv p RPCRelayArg>\n \\ (rst!p)$ = # rpcB\n \\ unchanged (rtrner send!p)\"\n\ndefinition RPCReject :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ action\"\n where \"RPCReject send rcv rst p == ACT\n $(rst!p) = # rpcA\n \\ \\IsLegalRcvArg>\n \\ Return send p #BadCall\n \\ unchanged ((rst!p), (caller rcv!p))\"\n\ndefinition RPCFail :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ action\"\n where \"RPCFail send rcv rst p == ACT\n \\$(Calling rcv p)\n \\ Return send p #RPCFailure\n \\ (rst!p)$ = #rpcA\n \\ unchanged (caller rcv!p)\"\n\ndefinition RPCReply :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ action\"\n where \"RPCReply send rcv rst p == ACT\n \\$(Calling rcv p)\n \\ $(rst!p) = #rpcB\n \\ Return send p res\n \\ (rst!p)$ = #rpcA\n \\ unchanged (caller rcv!p)\"\n\ndefinition RPCNext :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ action\"\n where \"RPCNext send rcv rst p == ACT\n ( RPCFwd send rcv rst p\n \\ RPCReject send rcv rst p\n \\ RPCFail send rcv rst p\n \\ RPCReply send rcv rst p)\"\n\n\n(* temporal *)\n\ndefinition RPCIPSpec :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ PrIds \\ temporal\"\n where \"RPCIPSpec send rcv rst p == TEMP\n Init RPCInit rcv rst p\n \\ \\[ RPCNext send rcv rst p ]_(rst!p, rtrner send!p, caller rcv!p)\n \\ WF(RPCNext send rcv rst p)_(rst!p, rtrner send!p, caller rcv!p)\"\n\ndefinition RPCISpec :: \"rpcSndChType \\ rpcRcvChType \\ rpcStType \\ temporal\"\n where \"RPCISpec send rcv rst == TEMP (\\p. RPCIPSpec send rcv rst p)\"\n\n\nlemmas RPC_action_defs =\n RPCInit_def RPCFwd_def RPCReject_def RPCFail_def RPCReply_def RPCNext_def\n\nlemmas RPC_temp_defs = RPCIPSpec_def RPCISpec_def\n\n\n(* The RPC component engages in an action for process p only if there is an outstanding,\n unanswered call for that process.\n*)\n\nlemma RPCidle: \"\\ \\$(Calling send p) \\ \\RPCNext send rcv rst p\"\n by (auto simp: AReturn_def RPC_action_defs)\n\nlemma RPCbusy: \"\\ $(Calling rcv p) \\ $(rst!p) = #rpcB \\ \\RPCNext send rcv rst p\"\n by (auto simp: RPC_action_defs)\n\n(* RPC failure actions are visible. *)\nlemma RPCFail_vis: \"\\ RPCFail send rcv rst p \\ \n _(rst!p, rtrner send!p, caller rcv!p)\"\n by (auto dest!: Return_changed [temp_use] simp: angle_def RPCNext_def RPCFail_def)\n\nlemma RPCFail_Next_enabled: \"\\ Enabled (RPCFail send rcv rst p) \\ \n Enabled (_(rst!p, rtrner send!p, caller rcv!p))\"\n by (force elim!: enabled_mono [temp_use] RPCFail_vis [temp_use])\n\n(* Enabledness of some actions *)\nlemma RPCFail_enabled: \"\\p. basevars (rtrner send!p, caller rcv!p, rst!p) \\ \n \\ \\Calling rcv p \\ Calling send p \\ Enabled (RPCFail send rcv rst p)\"\n by (tactic \\action_simp_tac (\\<^context> addsimps [@{thm RPCFail_def},\n @{thm AReturn_def}, @{thm caller_def}, @{thm rtrner_def}]) [exI]\n [@{thm base_enabled}, @{thm Pair_inject}] 1\\)\n\nlemma RPCReply_enabled: \"\\p. basevars (rtrner send!p, caller rcv!p, rst!p) \\ \n \\ \\Calling rcv p \\ Calling send p \\ rst!p = #rpcB \n \\ Enabled (RPCReply send rcv rst p)\"\n by (tactic \\action_simp_tac (\\<^context> addsimps [@{thm RPCReply_def},\n @{thm AReturn_def}, @{thm caller_def}, @{thm rtrner_def}]) [exI]\n [@{thm base_enabled}, @{thm Pair_inject}] 1\\)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/TLA/Memory/RPC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.30735801052067524, "lm_q1q2_score": 0.15967903993826651}} {"text": "(* Title: HOL/Auth/n_flash_nodata_cub_lemma_on_inv__38.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub_lemma_on_inv__38 imports n_flash_nodata_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__38 and some rule r*}\nlemma n_NI_Local_Get_Get__part__0Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__38:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__38:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__38:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__38:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__38:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__38:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__38:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_InvAck_1Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_InvAck_2Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_InvAck_3Vsinv__38:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') src)) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_Get_GetVsinv__38:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__38:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__38:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__38:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__38:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_HomeVsinv__38:\nassumes a1: \"(r=n_NI_Nak_Home )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Nak_ClearVsinv__38:\nassumes a1: \"(r=n_NI_Nak_Clear )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__38:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__38:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__38:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__38:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__38 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_GetX))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Remote_GetVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__38:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__38:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_5Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_3Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__38:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__38:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__38:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__38:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__38:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_6Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__38:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_11Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_1Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__38:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__38:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__38:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__38:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__38:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_2Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__38:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__38:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__38:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__38:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_PutX_4Vsinv__38:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" and\n a2: \"(f=inv__38 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub_lemma_on_inv__38.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3140505385717077, "lm_q1q2_score": 0.1594785894699871}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__52_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__52_on_rules imports n_german_lemma_on_inv__52\nbegin\nsection{*All lemmas on causal relation between inv__52*}\nlemma lemma_inv__52_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__52 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__52) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__52) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__52_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.2974699363766584, "lm_q1q2_score": 0.15917569551880806}} {"text": "(* Title: HOL/MicroJava/BV/Typing_Framework_JVM.thy\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nsection \\The Typing Framework for the JVM \\label{sec:JVM}\\\n\ntheory Typing_Framework_JVM\nimports \"../DFA/Abstract_BV\" JVMType EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ exception_table \\ instr list \\ JVMType.state step_type\" where\n \"exec G maxs rT et bs == \n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc et) (\\pc. eff (bs!pc) G pc et)\"\n\ndefinition opt_states :: \"'c prog \\ nat \\ nat \\ (ty list \\ ty err list) option set\" where\n \"opt_states G maxs maxr \\ opt (\\{list n (types G) |n. n \\ maxs} \\ list maxr (err (types G)))\"\n\n\nsubsection \\Executability of @{term check_bounded}\\\n\nprimrec list_all'_rec :: \"('a \\ nat \\ bool) \\ nat \\ 'a list \\ bool\"\nwhere\n \"list_all'_rec P n [] = True\"\n| \"list_all'_rec P n (x#xs) = (P x n \\ list_all'_rec P (Suc n) xs)\"\n\ndefinition list_all' :: \"('a \\ nat \\ bool) \\ 'a list \\ bool\" where\n \"list_all' P xs \\ list_all'_rec P 0 xs\"\n\nlemma list_all'_rec:\n \"list_all'_rec P n xs = (\\p < size xs. P (xs!p) (p+n))\"\n apply (induct xs arbitrary: n)\n apply auto\n apply (case_tac p)\n apply auto\n done\n\nlemma list_all' [iff]:\n \"list_all' P xs = (\\n < size xs. P (xs!n) n)\"\n by (unfold list_all'_def) (simp add: list_all'_rec)\n\n\n\nsubsection \\Connecting JVM and Framework\\\n\nlemma check_bounded_is_bounded:\n \"check_bounded ins et \\ bounded (\\pc. eff (ins!pc) G pc et) (length ins)\" \n by (unfold bounded_def) (blast dest: check_boundedD)\n\nlemma special_ex_swap_\n\nlemmas [iff del] = not_None_eq\n\ntheorem exec_pres_type:\n \"wf_prog wf_mb S \\ \n pres_type (exec S maxs rT et bs) (size bs) (states S maxs maxr)\"\n apply (unfold exec_def JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: eff_def xcpt_eff_def norm_eff_def)\n apply (case_tac \"bs!p\")\n\n apply clarsimp\n apply (drule listE_nth_in, assumption)\n apply fastforce\n\n apply (fastforce simp add: not_None_eq)\n\n apply (fastforce simp add: not_None_eq typeof_empty_is_type)\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=\"1\" in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply (fastforce dest: field_fields fields_is_type)\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n defer \n\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (rule_tac x=\"n'+2\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (length ST)))\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (Suc (length ST))))\" in exI) \n apply simp\n\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n \n apply (erule disjE)\n apply clarsimp\n apply (drule method_wf_mdecl, assumption+)\n apply (clarsimp simp add: wf_mdecl_def wf_mhead_def)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n done\n\nlemmas [iff] = not_None_eq\n\nlemma sup_state_opt_unfold:\n \"sup_state_opt G \\ Opt.le (Product.le (Listn.le (subtype G)) (Listn.le (Err.le (subtype G))))\"\n by (simp add: sup_state_opt_def sup_state_def sup_loc_def sup_ty_opt_def)\n\n\nlemma app_mono:\n \"app_mono (sup_state_opt G) (\\pc. app (bs!pc) G maxs rT pc et) (length bs) (opt_states G maxs maxr)\"\n by (unfold app_mono_def lesub_def) (blast intro: EffectMono.app_mono)\n \n\nlemma list_appendI:\n \"\\a \\ list x A; b \\ list y A\\ \\ a @ b \\ list (x+y) A\"\n apply (unfold list_def)\n apply (simp (no_asm))\n apply blast\n done\n\nlemma list_map [simp]:\n \"(map f xs \\ list (length xs) A) = (f ` set xs \\ A)\"\n apply (unfold list_def)\n apply simp\n done\n\nlemma [iff]:\n \"(OK ` A \\ err B) = (A \\ B)\"\n apply (unfold err_def)\n apply blast\n done\n\nlemma [intro]:\n \"x \\ A \\ replicate n x \\ list n A\"\n by (induct n, auto)\n\nlemma lesubstep_type_simple:\n \"a <=[Product.le (op =) r] b \\ a \\|r| b\"\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n \n\nlemma eff_mono:\n \"\\p < length bs; s <=_(sup_state_opt G) t; app (bs!p) G maxs rT pc et t\\\n \\ eff (bs!p) G p et s \\|sup_state_opt G| eff (bs!p) G p et t\"\n apply (unfold eff_def)\n apply (rule lesubstep_type_simple)\n apply (rule le_list_appendI)\n apply (simp add: norm_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply (simp del: split_paired_All split_paired_Ex)\n apply (elim exE conjE)\n apply simp\n apply (drule eff'_mono, assumption)\n apply assumption\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply simp\n apply (case_tac t)\n apply simp\n apply (clarsimp simp add: sup_state_conv)\n done\n\nlemma order_sup_state_opt:\n \"ws_prog G \\ order (sup_state_opt G)\"\n by (unfold sup_state_opt_unfold) (blast dest: acyclic_subcls1 order_widen)\n\ntheorem exec_mono:\n \"ws_prog G \\ bounded (exec G maxs rT et bs) (size bs) \\\n mono (JVMType.le G maxs maxr) (exec G maxs rT et bs) (size bs) (states G maxs maxr)\" \n apply (unfold exec_def JVM_le_unfold JVM_states_unfold) \n apply (rule mono_lift)\n apply (fold sup_state_opt_unfold opt_states_def)\n apply (erule order_sup_state_opt)\n apply (rule app_mono)\n apply assumption\n apply clarify\n apply (rule eff_mono)\n apply assumption+\n done\n\ntheorem semilat_JVM_slI:\n \"ws_prog G \\ semilat (JVMType.sl G maxs maxr)\"\n apply (unfold JVMType.sl_def stk_esl_def reg_sl_def)\n apply (rule semilat_opt)\n apply (rule err_semilat_Product_esl)\n apply (rule err_semilat_upto_esl)\n apply (rule err_semilat_JType_esl, assumption+)\n apply (rule err_semilat_eslI)\n apply (rule Listn_sl)\n apply (rule err_semilat_JType_esl, assumption+)\n done\n\nlemma sl_triple_conv:\n \"JVMType.sl G maxs maxr == \n (states G maxs maxr, JVMType.le G maxs maxr, JVMType.sup G maxs maxr)\"\n by (simp (no_asm) add: states_def JVMType.le_def JVMType.sup_def)\n\nlemma is_type_pTs:\n \"\\ wf_prog wf_mb G; (C,S,fs,mdecls) \\ set G; ((mn,pTs),rT,code) \\ set mdecls \\\n \\ set pTs \\ types G\"\nproof \n assume \"wf_prog wf_mb G\" \n \"(C,S,fs,mdecls) \\ set G\"\n \"((mn,pTs),rT,code) \\ set mdecls\"\n hence \"wf_mdecl wf_mb G C ((mn,pTs),rT,code)\"\n by (rule wf_prog_wf_mdecl)\n hence \"\\t \\ set pTs. is_type G t\" \n by (unfold wf_mdecl_def wf_mhead_def) auto\n moreover\n fix t assume \"t \\ set pTs\"\n ultimately\n have \"is_type G t\" by blast\n thus \"t \\ types G\" ..\nqed\n\n\nlemma jvm_prog_lift: \n assumes wf: \n \"wf_prog (\\G C bd. P G C bd) G\"\n\n assumes rule:\n \"\\wf_mb C mn pTs C rT maxs maxl b et bd.\n wf_prog wf_mb G \\\n method (G,C) (mn,pTs) = Some (C,rT,maxs,maxl,b,et) \\\n is_class G C \\\n set pTs \\ types G \\\n bd = ((mn,pTs),rT,maxs,maxl,b,et) \\\n P G C bd \\\n Q G C bd\"\n \n shows \n \"wf_prog (\\G C bd. Q G C bd) G\"\n using wf\n apply (unfold wf_prog_def wf_cdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (unfold wf_cdecl_mdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (frule methd [OF wf [THEN wf_prog_ws_prog]], assumption+)\n apply (frule is_type_pTs [OF wf], assumption+)\n apply clarify\n apply (drule rule [OF wf], assumption+)\n apply (rule HOL.refl)\n apply assumption+\n done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/MicroJava/BV/Typing_Framework_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.30404167496654744, "lm_q1q2_score": 0.1591415996021747}} {"text": "(* Title: JinjaDCI/BV/Effect.thy\n Author: Gerwin Klein, Susannah Mansky\n Copyright 2000 Technische Universitaet Muenchen, 2019-20 UIUC\n\n Based on the Jinja theory BV/Effect.thy by Gerwin Klein\n*)\n\nsection \\Effect of Instructions on the State Type\\\n\ntheory Effect\nimports JVM_SemiType \"../JVM/JVMExceptions\"\nbegin\n\n\\ \\FIXME\\\nlocale prog =\n fixes P :: \"'a prog\"\n\nlocale jvm_method = prog +\n fixes mxs :: nat \n fixes mxl\\<^sub>0 :: nat \n fixes Ts :: \"ty list\" \n fixes T\\<^sub>r :: ty\n fixes \"is\" :: \"instr list\" \n fixes xt :: ex_table\n\n fixes mxl :: nat\n defines mxl_def: \"mxl \\ 1+size Ts+mxl\\<^sub>0\"\n\ntext \\ Program counter of successor instructions: \\\nprimrec succs :: \"instr \\ ty\\<^sub>i \\ pc \\ pc list\" where\n \"succs (Load idx) \\ pc = [pc+1]\"\n| \"succs (Store idx) \\ pc = [pc+1]\"\n| \"succs (Push v) \\ pc = [pc+1]\"\n| \"succs (Getfield F C) \\ pc = [pc+1]\"\n| \"succs (Getstatic C F D) \\ pc = [pc+1]\"\n| \"succs (Putfield F C) \\ pc = [pc+1]\"\n| \"succs (Putstatic C F D) \\ pc = [pc+1]\"\n| \"succs (New C) \\ pc = [pc+1]\"\n| \"succs (Checkcast C) \\ pc = [pc+1]\"\n| \"succs Pop \\ pc = [pc+1]\"\n| \"succs IAdd \\ pc = [pc+1]\"\n| \"succs CmpEq \\ pc = [pc+1]\"\n| succs_IfFalse:\n \"succs (IfFalse b) \\ pc = [pc+1, nat (int pc + b)]\"\n| succs_Goto:\n \"succs (Goto b) \\ pc = [nat (int pc + b)]\"\n| succs_Return:\n \"succs Return \\ pc = []\" \n| succs_Invoke:\n \"succs (Invoke M n) \\ pc = (if (fst \\)!n = NT then [] else [pc+1])\"\n| succs_Invokestatic:\n \"succs (Invokestatic C M n) \\ pc = [pc+1]\"\n| succs_Throw:\n \"succs Throw \\ pc = []\"\n\ntext \"Effect of instruction on the state type:\"\n\nfun the_class:: \"ty \\ cname\" where\n \"the_class (Class C) = C\"\n\nfun eff\\<^sub>i :: \"instr \\ 'm prog \\ ty\\<^sub>i \\ ty\\<^sub>i\" where\n eff\\<^sub>i_Load:\n \"eff\\<^sub>i (Load n, P, (ST, LT)) = (ok_val (LT ! n) # ST, LT)\"\n| eff\\<^sub>i_Store:\n \"eff\\<^sub>i (Store n, P, (T#ST, LT)) = (ST, LT[n:= OK T])\"\n| eff\\<^sub>i_Push:\n \"eff\\<^sub>i (Push v, P, (ST, LT)) = (the (typeof v) # ST, LT)\"\n| eff\\<^sub>i_Getfield:\n \"eff\\<^sub>i (Getfield F C, P, (T#ST, LT)) = (snd (snd (field P C F)) # ST, LT)\"\n| eff\\<^sub>i_Getstatic:\n \"eff\\<^sub>i (Getstatic C F D, P, (ST, LT)) = (snd (snd (field P C F)) # ST, LT)\"\n| eff\\<^sub>i_Putfield:\n \"eff\\<^sub>i (Putfield F C, P, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = (ST,LT)\"\n| eff\\<^sub>i_Putstatic:\n \"eff\\<^sub>i (Putstatic C F D, P, (T#ST, LT)) = (ST,LT)\"\n| eff\\<^sub>i_New:\n \"eff\\<^sub>i (New C, P, (ST,LT)) = (Class C # ST, LT)\"\n| eff\\<^sub>i_Checkcast:\n \"eff\\<^sub>i (Checkcast C, P, (T#ST,LT)) = (Class C # ST,LT)\"\n| eff\\<^sub>i_Pop:\n \"eff\\<^sub>i (Pop, P, (T#ST,LT)) = (ST,LT)\"\n| eff\\<^sub>i_IAdd:\n \"eff\\<^sub>i (IAdd, P,(T\\<^sub>1#T\\<^sub>2#ST,LT)) = (Integer#ST,LT)\"\n| eff\\<^sub>i_CmpEq:\n \"eff\\<^sub>i (CmpEq, P, (T\\<^sub>1#T\\<^sub>2#ST,LT)) = (Boolean#ST,LT)\"\n| eff\\<^sub>i_IfFalse:\n \"eff\\<^sub>i (IfFalse b, P, (T\\<^sub>1#ST,LT)) = (ST,LT)\"\n| eff\\<^sub>i_Invoke:\n \"eff\\<^sub>i (Invoke M n, P, (ST,LT)) =\n (let C = the_class (ST!n); (D,b,Ts,T\\<^sub>r,m) = method P C M\n in (T\\<^sub>r # drop (n+1) ST, LT))\"\n| eff\\<^sub>i_Invokestatic:\n \"eff\\<^sub>i (Invokestatic C M n, P, (ST,LT)) =\n (let (D,b,Ts,T\\<^sub>r,m) = method P C M\n in (T\\<^sub>r # drop n ST, LT))\"\n| eff\\<^sub>i_Goto:\n \"eff\\<^sub>i (Goto n, P, s) = s\"\n\nfun is_relevant_class :: \"instr \\ 'm prog \\ cname \\ bool\" where\n rel_Getfield:\n \"is_relevant_class (Getfield F D)\n = (\\P C. P \\ NullPointer \\\\<^sup>* C \\ P \\ NoSuchFieldError \\\\<^sup>* C\n \\ P \\ IncompatibleClassChangeError \\\\<^sup>* C)\" \n| rel_Getstatic:\n \"is_relevant_class (Getstatic C F D)\n = (\\P C. True)\"\n| rel_Putfield:\n \"is_relevant_class (Putfield F D)\n = (\\P C. P \\ NullPointer \\\\<^sup>* C \\ P \\ NoSuchFieldError \\\\<^sup>* C\n \\ P \\ IncompatibleClassChangeError \\\\<^sup>* C)\" \n| rel_Putstatic:\n \"is_relevant_class (Putstatic C F D)\n = (\\P C. True)\" \n| rel_Checkcast:\n \"is_relevant_class (Checkcast D) = (\\P C. P \\ ClassCast \\\\<^sup>* C)\" \n| rel_New:\n \"is_relevant_class (New D) = (\\P C. True)\"\n| rel_Throw:\n \"is_relevant_class Throw = (\\P C. True)\"\n| rel_Invoke:\n \"is_relevant_class (Invoke M n) = (\\P C. True)\"\n| rel_Invokestatic:\n \"is_relevant_class (Invokestatic C M n) = (\\P C. True)\"\n| rel_default:\n \"is_relevant_class i = (\\P C. False)\"\n\ndefinition is_relevant_entry :: \"'m prog \\ instr \\ pc \\ ex_entry \\ bool\" where\n \"is_relevant_entry P i pc e \\ (let (f,t,C,h,d) = e in is_relevant_class i P C \\ pc \\ {f.. instr \\ pc \\ ex_table \\ ex_table\" where\n \"relevant_entries P i pc = filter (is_relevant_entry P i pc)\"\n\ndefinition xcpt_eff :: \"instr \\ 'm prog \\ pc \\ ty\\<^sub>i \n \\ ex_table \\ (pc \\ ty\\<^sub>i') list\" where \n \"xcpt_eff i P pc \\ et = (let (ST,LT) = \\ in \n map (\\(f,t,C,h,d). (h, Some (Class C#drop (size ST - d) ST, LT))) (relevant_entries P i pc et))\"\n\ndefinition norm_eff :: \"instr \\ 'm prog \\ nat \\ ty\\<^sub>i \\ (pc \\ ty\\<^sub>i') list\" where\n \"norm_eff i P pc \\ = map (\\pc'. (pc',Some (eff\\<^sub>i (i,P,\\)))) (succs i \\ pc)\"\n\ndefinition eff :: \"instr \\ 'm prog \\ pc \\ ex_table \\ ty\\<^sub>i' \\ (pc \\ ty\\<^sub>i') list\" where\n \"eff i P pc et t = (case t of \n None \\ [] \n | Some \\ \\ (norm_eff i P pc \\) @ (xcpt_eff i P pc \\ et))\"\n\n\n\n\nlemma eff_Some:\n \"eff i P pc xt (Some \\) = norm_eff i P pc \\ @ xcpt_eff i P pc \\ xt\"\nby (simp add: eff_def)\n\n(* FIXME: getfield, \\T D. P \\ C sees F:T in D \\ .. *)\n\ntext \"Conditions under which eff is applicable:\"\n\nfun app\\<^sub>i :: \"instr \\ 'm prog \\ pc \\ nat \\ ty \\ ty\\<^sub>i \\ bool\" where\n app\\<^sub>i_Load:\n \"app\\<^sub>i (Load n, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (n < length LT \\ LT ! n \\ Err \\ length ST < mxs)\"\n| app\\<^sub>i_Store:\n \"app\\<^sub>i (Store n, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (n < length LT)\"\n| app\\<^sub>i_Push:\n \"app\\<^sub>i (Push v, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (length ST < mxs \\ typeof v \\ None)\"\n| app\\<^sub>i_Getfield:\n \"app\\<^sub>i (Getfield F C, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (\\T\\<^sub>f. P \\ C sees F,NonStatic:T\\<^sub>f in C \\ P \\ T \\ Class C)\"\n| app\\<^sub>i_Getstatic:\n \"app\\<^sub>i (Getstatic C F D, P, pc, mxs, T\\<^sub>r, (ST, LT)) = \n (length ST < mxs \\ (\\T\\<^sub>f. P \\ C sees F,Static:T\\<^sub>f in D))\"\n| app\\<^sub>i_Putfield:\n \"app\\<^sub>i (Putfield F C, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST, LT)) = \n (\\T\\<^sub>f. P \\ C sees F,NonStatic:T\\<^sub>f in C \\ P \\ T\\<^sub>2 \\ (Class C) \\ P \\ T\\<^sub>1 \\ T\\<^sub>f)\" \n| app\\<^sub>i_Putstatic:\n \"app\\<^sub>i (Putstatic C F D, P, pc, mxs, T\\<^sub>r, (T#ST, LT)) = \n (\\T\\<^sub>f. P \\ C sees F,Static:T\\<^sub>f in D \\ P \\ T \\ T\\<^sub>f)\" \n| app\\<^sub>i_New:\n \"app\\<^sub>i (New C, P, pc, mxs, T\\<^sub>r, (ST,LT)) = \n (is_class P C \\ length ST < mxs)\"\n| app\\<^sub>i_Checkcast:\n \"app\\<^sub>i (Checkcast C, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (is_class P C \\ is_refT T)\"\n| app\\<^sub>i_Pop:\n \"app\\<^sub>i (Pop, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n True\"\n| app\\<^sub>i_IAdd:\n \"app\\<^sub>i (IAdd, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST,LT)) = (T\\<^sub>1 = T\\<^sub>2 \\ T\\<^sub>1 = Integer)\"\n| app\\<^sub>i_CmpEq:\n \"app\\<^sub>i (CmpEq, P, pc, mxs, T\\<^sub>r, (T\\<^sub>1#T\\<^sub>2#ST,LT)) =\n (T\\<^sub>1 = T\\<^sub>2 \\ is_refT T\\<^sub>1 \\ is_refT T\\<^sub>2)\"\n| app\\<^sub>i_IfFalse:\n \"app\\<^sub>i (IfFalse b, P, pc, mxs, T\\<^sub>r, (Boolean#ST,LT)) = \n (0 \\ int pc + b)\"\n| app\\<^sub>i_Goto:\n \"app\\<^sub>i (Goto b, P, pc, mxs, T\\<^sub>r, s) = \n (0 \\ int pc + b)\"\n| app\\<^sub>i_Return:\n \"app\\<^sub>i (Return, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n (P \\ T \\ T\\<^sub>r)\"\n| app\\<^sub>i_Throw:\n \"app\\<^sub>i (Throw, P, pc, mxs, T\\<^sub>r, (T#ST,LT)) = \n is_refT T\"\n| app\\<^sub>i_Invoke:\n \"app\\<^sub>i (Invoke M n, P, pc, mxs, T\\<^sub>r, (ST,LT)) =\n (n < length ST \\ \n (ST!n \\ NT \\\n (\\C D Ts T m. ST!n = Class C \\ P \\ C sees M,NonStatic:Ts \\ T = m in D \\\n P \\ rev (take n ST) [\\] Ts)))\"\n| app\\<^sub>i_Invokestatic:\n \"app\\<^sub>i (Invokestatic C M n, P, pc, mxs, T\\<^sub>r, (ST,LT)) =\n (length ST - n < mxs \\ n \\ length ST \\ M \\ clinit \\\n (\\D Ts T m. P \\ C sees M,Static:Ts \\ T = m in D \\\n P \\ rev (take n ST) [\\] Ts))\"\n \n| app\\<^sub>i_default:\n \"app\\<^sub>i (i,P, pc,mxs,T\\<^sub>r,s) = False\"\n\n\ndefinition xcpt_app :: \"instr \\ 'm prog \\ pc \\ nat \\ ex_table \\ ty\\<^sub>i \\ bool\" where\n \"xcpt_app i P pc mxs xt \\ \\ (\\(f,t,C,h,d) \\ set (relevant_entries P i pc xt). is_class P C \\ d \\ size (fst \\) \\ d < mxs)\"\n\ndefinition app :: \"instr \\ 'm prog \\ nat \\ ty \\ nat \\ nat \\ ex_table \\ ty\\<^sub>i' \\ bool\" where\n \"app i P mxs T\\<^sub>r pc mpc xt t = (case t of None \\ True | Some \\ \\ \n app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',\\') \\ set (eff i P pc xt t). pc' < mpc))\"\n\n\nlemma app_Some:\n \"app i P mxs T\\<^sub>r pc mpc xt (Some \\) = \n (app\\<^sub>i (i,P,pc,mxs,T\\<^sub>r,\\) \\ xcpt_app i P pc mxs xt \\ \\ \n (\\(pc',s') \\ set (eff i P pc xt (Some \\)). pc' < mpc))\"\nby (simp add: app_def)\n\nlocale eff = jvm_method +\n fixes eff\\<^sub>i and app\\<^sub>i and eff and app \n fixes norm_eff and xcpt_app and xcpt_eff\n\n fixes mpc\n defines \"mpc \\ size is\"\n\n defines \"eff\\<^sub>i i \\ \\ Effect.eff\\<^sub>i (i,P,\\)\"\n notes eff\\<^sub>i_simps [simp] = Effect.eff\\<^sub>i.simps [where P = P, folded eff\\<^sub>i_def]\n\n defines \"app\\<^sub>i i pc \\ \\ Effect.app\\<^sub>i (i, P, pc, mxs, T\\<^sub>r, \\)\"\n notes app\\<^sub>i_simps [simp] = Effect.app\\<^sub>i.simps [where P=P and mxs=mxs and T\\<^sub>r=T\\<^sub>r, folded app\\<^sub>i_def]\n\n defines \"xcpt_eff i pc \\ \\ Effect.xcpt_eff i P pc \\ xt\"\n notes xcpt_eff = Effect.xcpt_eff_def [of _ P _ _ xt, folded xcpt_eff_def]\n\n defines \"norm_eff i pc \\ \\ Effect.norm_eff i P pc \\\"\n notes norm_eff = Effect.norm_eff_def [of _ P, folded norm_eff_def eff\\<^sub>i_def]\n\n defines \"eff i pc \\ Effect.eff i P pc xt\"\n notes eff = Effect.eff_def [of _ P _ xt, folded eff_def norm_eff_def xcpt_eff_def]\n\n defines \"xcpt_app i pc \\ \\ Effect.xcpt_app i P pc mxs xt \\\"\n notes xcpt_app = Effect.xcpt_app_def [of _ P _ mxs xt, folded xcpt_app_def]\n\n defines \"app i pc \\ Effect.app i P mxs T\\<^sub>r pc mpc xt\"\n notes app = Effect.app_def [of _ P mxs T\\<^sub>r _ mpc xt, folded app_def xcpt_app_def app\\<^sub>i_def eff_def]\n\n\nlemma length_cases2:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n by (cases s, cases \"fst s\") (auto intro!: assms)\n\n\nlemma length_cases3:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l ST LT. P (l#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil with assms s show ?thesis by simp\n next\n fix l xs' assume \"xs = l#xs'\"\n with assms s show ?thesis by simp\n qed\nqed\n(*>*)\n\nlemma length_cases4:\n assumes \"\\LT. P ([],LT)\"\n assumes \"\\l LT. P ([l],LT)\"\n assumes \"\\l l' LT. P ([l,l'],LT)\"\n assumes \"\\l l' ST LT. P (l#l'#ST,LT)\"\n shows \"P s\"\n(*<*)\nproof -\n obtain xs LT where s: \"s = (xs,LT)\" by (cases s)\n show ?thesis\n proof (cases xs)\n case Nil with assms s show ?thesis by simp\n next\n fix l xs' assume xs: \"xs = l#xs'\"\n thus ?thesis\n proof (cases xs')\n case Nil with assms s xs show ?thesis by simp\n next\n fix l' ST assume \"xs' = l'#ST\"\n with assms s xs show ?thesis by simp\n qed\n qed\nqed\n(*>*)\n\ntext \\ \n\\medskip\nsimp rules for @{term app}\n\\\nlemma appNone[simp]: \"app i P mxs T\\<^sub>r pc mpc et None = True\" \n by (simp add: app_def)\n\n\nlemma appLoad[simp]:\n\"app\\<^sub>i (Load idx, P, T\\<^sub>r, mxs, pc, s) = (\\ST LT. s = (ST,LT) \\ idx < length LT \\ LT!idx \\ Err \\ length ST < mxs)\"\n by (cases s, simp)\n\nlemma appStore[simp]:\n\"app\\<^sub>i (Store idx,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT) \\ idx < length LT)\"\n by (rule length_cases2, auto)\n\nlemma appPush[simp]:\n\"app\\<^sub>i (Push v,P,pc,mxs,T\\<^sub>r,s) =\n (\\ST LT. s = (ST,LT) \\ length ST < mxs \\ typeof v \\ None)\"\n by (cases s, simp)\n\nlemma appGetField[simp]:\n\"app\\<^sub>i (Getfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ oT vT ST LT. s = (oT#ST, LT) \\ \n P \\ C sees F,NonStatic:vT in C \\ P \\ oT \\ (Class C))\"\n by (rule length_cases2 [of _ s]) auto\n\nlemma appGetStatic[simp]:\n\"app\\<^sub>i (Getstatic C F D,P,pc,mxs,T\\<^sub>r,s) = \n (\\ vT ST LT. s = (ST, LT) \\ length ST < mxs \\ P \\ C sees F,Static:vT in D)\"\n by (rule length_cases2 [of _ s]) auto\n\nlemma appPutField[simp]:\n\"app\\<^sub>i (Putfield F C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ vT vT' oT ST LT. s = (vT#oT#ST, LT) \\\n P \\ C sees F,NonStatic:vT' in C \\ P \\ oT \\ (Class C) \\ P \\ vT \\ vT')\"\n by (rule length_cases4 [of _ s], auto)\n\nlemma appPutstatic[simp]:\n\"app\\<^sub>i (Putstatic C F D,P,pc,mxs,T\\<^sub>r,s) = \n (\\ vT vT' ST LT. s = (vT#ST, LT) \\\n P \\ C sees F,Static:vT' in D \\ P \\ vT \\ vT')\"\n by (rule length_cases4 [of _ s], auto)\n\nlemma appNew[simp]:\n \"app\\<^sub>i (New C,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s=(ST,LT) \\ is_class P C \\ length ST < mxs)\"\n by (cases s, simp)\n\n\n\nlemma app\\<^sub>iPop[simp]: \n\"app\\<^sub>i (Pop,P,pc,mxs,T\\<^sub>r,s) = (\\ts ST LT. s = (ts#ST,LT))\"\n by (rule length_cases2, auto)\n\nlemma appIAdd[simp]:\n\"app\\<^sub>i (IAdd,P,pc,mxs,T\\<^sub>r,s) = (\\ST LT. s = (Integer#Integer#ST,LT))\"\n(*<*)\nproof -\n obtain ST LT where [simp]: \"s = (ST,LT)\" by (cases s)\n have \"ST = [] \\ (\\T. ST = [T]) \\ (\\T\\<^sub>1 T\\<^sub>2 ST'. ST = T\\<^sub>1#T\\<^sub>2#ST')\"\n by (cases ST, auto, case_tac list, auto)\n moreover\n { assume \"ST = []\" hence ?thesis by simp }\n moreover\n { fix T assume \"ST = [T]\" hence ?thesis by (cases T, auto) }\n moreover\n { fix T\\<^sub>1 T\\<^sub>2 ST' assume \"ST = T\\<^sub>1#T\\<^sub>2#ST'\"\n hence ?thesis by (cases T\\<^sub>1, auto)\n }\n ultimately show ?thesis by blast\nqed\n(*>*)\n\n\nlemma appIfFalse [simp]:\n\"app\\<^sub>i (IfFalse b,P,pc,mxs,T\\<^sub>r,s) = \n (\\ST LT. s = (Boolean#ST,LT) \\ 0 \\ int pc + b)\"\n(*<*)\n (is \"?P s\")\nproof(rule length_cases2)\n fix LT show \"?P ([],LT)\" by simp\nnext\n fix l ST LT show \"?P (l#ST,LT)\"\n by (case_tac l) auto\nqed\n(*>*)\n\nlemma appCmpEq[simp]:\n\"app\\<^sub>i (CmpEq,P,pc,mxs,T\\<^sub>r,s) = \n (\\T\\<^sub>1 T\\<^sub>2 ST LT. s = (T\\<^sub>1#T\\<^sub>2#ST,LT) \\ (\\is_refT T\\<^sub>1 \\ T\\<^sub>2 = T\\<^sub>1 \\ is_refT T\\<^sub>1 \\ is_refT T\\<^sub>2))\"\n by (rule length_cases4, auto)\n\nlemma appReturn[simp]:\n\"app\\<^sub>i (Return,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s = (T#ST,LT) \\ P \\ T \\ T\\<^sub>r)\" \n by (rule length_cases2, auto)\n\nlemma appThrow[simp]:\n \"app\\<^sub>i (Throw,P,pc,mxs,T\\<^sub>r,s) = (\\T ST LT. s=(T#ST,LT) \\ is_refT T)\"\n by (rule length_cases2, auto) \n\nlemma effNone: \n \"(pc', s') \\ set (eff i P pc et None) \\ s' = None\"\n by (auto simp add: eff_def xcpt_eff_def norm_eff_def)\n\n\ntext \\ some helpers to make the specification directly executable: \\\nlemma relevant_entries_append [simp]:\n \"relevant_entries P i pc (xt @ xt') = relevant_entries P i pc xt @ relevant_entries P i pc xt'\"\n by (unfold relevant_entries_def) simp\n\nlemma xcpt_app_append [iff]:\n \"xcpt_app i P pc mxs (xt@xt') \\ = (xcpt_app i P pc mxs xt \\ \\ xcpt_app i P pc mxs xt' \\)\"\n by (unfold xcpt_app_def) fastforce\n\nlemma xcpt_eff_append [simp]:\n \"xcpt_eff i P pc \\ (xt@xt') = xcpt_eff i P pc \\ xt @ xcpt_eff i P pc \\ xt'\"\n by (unfold xcpt_eff_def, cases \\) simp\n\nlemma app_append [simp]:\n \"app i P pc T mxs mpc (xt@xt') \\ = (app i P pc T mxs mpc xt \\ \\ app i P pc T mxs mpc xt' \\)\"\n by (unfold app_def eff_def) auto\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/Effect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5467381667555714, "lm_q2_score": 0.2909808662149068, "lm_q1q2_score": 0.15909034535528635}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory PSpace_C\nimports Ctac_lemmas_C\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma setObject_obj_at_pre:\n \"\\ updateObject ko = updateObject_default ko;\n (1 :: word32) < 2 ^ objBits ko \\\n \\\n setObject p ko\n = (stateAssert (typ_at' (koTypeOf (injectKO ko)) p) []\n >>= (\\_. setObject p ko))\"\n apply (rule ext)\n apply (case_tac \"typ_at' (koTypeOf (injectKO ko)) p x\")\n apply (simp add: stateAssert_def bind_def\n get_def return_def)\n apply (simp add: stateAssert_def bind_def\n get_def assert_def fail_def)\n apply (simp add: setObject_def exec_gets split_def\n assert_opt_def split: option.split)\n apply (clarsimp simp add: fail_def)\n apply (simp add: bind_def simpler_modify_def split_def)\n apply (rule context_conjI)\n apply (clarsimp simp: updateObject_default_def\n in_monad)\n apply (clarsimp simp: projectKOs in_magnitude_check)\n apply (frule iffD1[OF project_koType, OF exI])\n apply (clarsimp simp: typ_at'_def ko_wp_at'_def)\n apply (simp only: objBitsT_koTypeOf[symmetric] objBits_def)\n apply simp\n apply (simp add: koTypeOf_injectKO)\n apply (rule empty_failD[OF empty_fail_updateObject_default])\n apply (rule ccontr, erule nonemptyE)\n apply clarsimp\n done\n\nend\n\ncontext kernel begin\n\nlemma setObject_ccorres_helper:\n fixes ko :: \"'a :: pspace_storable\"\n assumes valid: \"\\\\ (ko' :: 'a).\n \\ \\ {s. (\\, s) \\ rf_sr \\ P \\ \\ s \\ P' \\ ko_at' ko' p \\}\n c {s. (\\\\ksPSpace := ksPSpace \\ (p \\ injectKO ko)\\, s) \\ rf_sr}\"\n shows \"\\ \\ko :: 'a. updateObject ko = updateObject_default ko;\n \\ko :: 'a. (1 :: word32) < 2 ^ objBits ko \\\n \\ ccorres dc xfdc P P' hs (setObject p ko) c\"\n apply (rule ccorres_guard_imp2)\n apply (subst setObject_obj_at_pre)\n apply simp+\n apply (rule ccorres_symb_exec_l[where Q'=\"\\_. P'\"])\n defer\n apply (rule stateAssert_inv)\n apply (rule stateAssert_sp[where P=P])\n apply (rule empty_fail_stateAssert)\n apply simp\n apply (rule ccorres_from_vcg)\n apply (rule allI)\n apply (rule hoare_complete)\n apply (clarsimp simp: HoarePartialDef.valid_def)\n apply (simp add: typ_at_to_obj_at' koTypeOf_injectKO)\n apply (drule obj_at_ko_at', clarsimp)\n apply (cut_tac \\1=\\ and ko'1=koa in valid)\n apply (drule hoare_sound,\n clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n apply (elim allE, drule(1) mp)\n apply (drule mp, simp)\n apply clarsimp\n apply (rule imageI[OF CollectI])\n apply (rule rev_bexI)\n apply (rule setObject_eq, simp+)\n apply (simp add: objBits_def)\n apply (simp only: objBitsT_koTypeOf[symmetric]\n koTypeOf_injectKO)\n apply assumption\n apply simp\n done\n\n\nlemma carray_map_relation_upd_triv:\n \"f x = Some (v :: 'a :: pspace_storable)\n \\ carray_map_relation n (f (x \\ y)) hp ptrf = carray_map_relation n f hp ptrf\"\n by (simp add: carray_map_relation_def objBits_def objBitsT_koTypeOf[symmetric]\n koTypeOf_injectKO\n del: objBitsT_koTypeOf)\n\nlemma storePTE_Basic_ccorres':\n \"\\ cpte_relation pte pte' \\ \\\n ccorres dc xfdc \\ {s. ptr_val (f s) = p} hs\n (storePTE p pte)\n (Guard C_Guard {s. s \\\\<^sub>c f s}\n (Basic (\\s. globals_update( t_hrs_'_update\n (hrs_mem_update (heap_update (f s) pte'))) s)))\"\n apply (simp add: storePTE_def)\n apply (rule setObject_ccorres_helper)\n apply (simp_all add: objBits_simps archObjSize_def)\n apply (rule conseqPre, vcg)\n apply (rule subsetI, clarsimp simp: Collect_const_mem)\n apply (rule cmap_relationE1, erule rf_sr_cpte_relation,\n erule ko_at_projectKO_opt)\n apply (rule conjI, fastforce intro: typ_heap_simps)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps\n update_pte_map_to_ptes\n update_pte_map_tos\n carray_map_relation_upd_triv)\n\n apply (case_tac \"f x\", simp)\n\n apply (erule cmap_relation_updI,\n erule ko_at_projectKO_opt, simp+)\n apply (simp add: cready_queues_relation_def\n carch_state_relation_def\n cmachine_state_relation_def\n Let_def typ_heap_simps\n cteCaps_of_def update_pte_map_tos\n )\n apply (simp add: pteBits_def)\n done\n\n\nlemma storePTE_Basic_ccorres:\n \"\\ cpte_relation pte pte' \\ \\\n ccorres dc xfdc \\ {s. f s = p} hs\n (storePTE p pte)\n (Guard C_Guard {s. s \\\\<^sub>c pte_Ptr (f s)}\n (Basic (\\s. globals_update( t_hrs_'_update\n (hrs_mem_update (heap_update (pte_Ptr (f s)) pte'))) s)))\"\n apply (rule ccorres_guard_imp2)\n apply (erule storePTE_Basic_ccorres')\n apply simp\n done\n\nlemma pde_stored_asid_update_valid_offset:\n \"valid_pde_mapping_offset' (ptr_val p && mask pdBits)\n \\ (pde_stored_asid \\\\<^sub>m (clift (t_hrs_' cstate))(p \\ pde) \\\\<^sub>m pd_pointer_to_asid_slot)\n = (pde_stored_asid \\\\<^sub>m clift (t_hrs_' cstate) \\\\<^sub>m pd_pointer_to_asid_slot)\"\n apply (rule ext, clarsimp simp add: pd_pointer_to_asid_slot_def map_comp_eq)\n apply (simp add: valid_pde_mapping_offset'_def mask_add_aligned)\n apply (simp add: pd_asid_slot_def pdBits_def pageBits_def mask_def pdeBits_def)\n done\n\nlemma storePDE_Basic_ccorres':\n \"\\ cpde_relation pde pde' \\ \\\n ccorres dc xfdc\n (\\_. valid_pde_mapping_offset' (p && mask pdBits))\n {s. ptr_val (f s) = p} hs\n (storePDE p pde)\n (Guard C_Guard {s. s \\\\<^sub>c f s}\n (Basic (\\s. globals_update( t_hrs_'_update\n (hrs_mem_update (heap_update (f s) pde'))) s)))\"\n apply (simp add: storePDE_def)\n apply (rule setObject_ccorres_helper)\n apply (simp_all add: objBits_simps archObjSize_def)\n apply (rule conseqPre, vcg)\n apply (rule subsetI, clarsimp simp: Collect_const_mem)\n apply (rule cmap_relationE1, erule rf_sr_cpde_relation,\n erule ko_at_projectKO_opt)\n apply (rule conjI, fastforce intro: typ_heap_simps)\n apply (case_tac \"f x\", clarsimp)\n apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def)\n apply (rule conjI)\n apply (clarsimp simp: cpspace_relation_def typ_heap_simps\n update_pde_map_to_pdes\n update_pde_map_tos\n carray_map_relation_upd_triv)\n apply (erule cmap_relation_updI,\n erule ko_at_projectKO_opt, simp+)\n apply (simp add: cready_queues_relation_def\n carch_state_relation_def\n cmachine_state_relation_def\n Let_def typ_heap_simps\n pde_stored_asid_update_valid_offset\n cteCaps_of_def update_pde_map_tos)\n apply (simp add: pdeBits_def)\n done\n\nlemma storePDE_Basic_ccorres:\n \"\\ cpde_relation pde pde' \\ \\\n ccorres dc xfdc (\\_. valid_pde_mapping_offset' (p && mask pdBits)) {s. f s = p} hs\n (storePDE p pde)\n (Guard C_Guard {s. s \\\\<^sub>c pde_Ptr (f s)}\n (Basic (\\s. globals_update(t_hrs_'_update\n (hrs_mem_update (heap_update (pde_Ptr (f s)) pde'))) s)))\"\n apply (rule ccorres_guard_imp2)\n apply (erule storePDE_Basic_ccorres')\n apply simp\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/ARM/PSpace_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166195971441, "lm_q2_score": 0.310694383214554, "lm_q1q2_score": 0.15898747950637124}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__53_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__53_on_rules imports n_germanSimp_lemma_on_inv__53\nbegin\nsection{*All lemmas on causal relation between inv__53*}\nlemma lemma_inv__53_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__53 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__53) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__53) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__53_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3106943895971202, "lm_q1q2_score": 0.1589874781452715}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__1_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__1_on_rules imports n_g2kAbsAfter_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__1 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__1) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__1) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.3106943895971202, "lm_q1q2_score": 0.1589874781452715}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchLevityCatch_AI\nimports\n \"ArchBCorres_AI\"\n \"Lib.LemmaBucket\"\n \"Lib.SplitRule\"\nbegin\n\ncontext Arch begin global_naming X64\n\nlemma asid_high_bits_of_shift :\n \"asid_high_bits_of (ucast x << asid_low_bits) = x\"\n apply (simp add: asid_high_bits_of_def)\n apply (rule word_eqI)\n apply (simp add: word_size nth_ucast nth_shiftr nth_shiftl asid_low_bits_def)\n done\n\nlemma ptrFormPAddr_addFromPPtr :\n \"ptrFromPAddr (Platform.X64.addrFromPPtr x) = x\"\n by (simp add: ptrFromPAddr_def Platform.X64.addrFromPPtr_def)\n\n\n(****** From GeneralLib *******)\n\nlemma asid_high_bits_of_add_ucast:\n \"is_aligned w asid_low_bits \\\n asid_high_bits_of (ucast (x::9 word) + w) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr is_aligned_nth)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: nth_ucast)\n apply (drule test_bit_size)\n apply (simp add: word_size asid_low_bits_def)\n apply (auto dest: test_bit_size simp: word_size asid_low_bits_def nth_ucast)\n done\n\nlemma asid_high_bits_of_add:\n \"\\is_aligned w asid_low_bits; x \\ 2 ^ asid_low_bits - 1\\\n \\ asid_high_bits_of (w + x) = asid_high_bits_of w\"\n apply (rule word_eqI)\n apply (simp add: word_size asid_high_bits_of_def nth_ucast nth_shiftr\n is_aligned_nth)\n apply (drule le2p_bits_unset, simp add: asid_low_bits_def word_bits_def)\n apply (subst word_plus_and_or_coroll)\n apply (rule word_eqI)\n apply (clarsimp simp: word_size)\n apply (case_tac \"na < asid_low_bits\")\n apply (simp add: asid_low_bits_def linorder_not_less word_bits_def)\n apply (auto dest: test_bit_size\n simp: asid_low_bits_def nth_ucast)\n done\n\nlemma preemption_point_success [simp,intro]:\n \"((Inr (), s') \\ fst (preemption_point s)) \\\n \\f es. s' = s \\ machine_state := machine_state s \\ irq_state := f (irq_state (machine_state s)) \\, exst := es \\\"\n apply (auto simp: in_monad preemption_point_def do_machine_op_def\n select_f_def select_def getActiveIRQ_def alternative_def\n do_extended_op_def OR_choiceE_def mk_ef_def\n split: option.splits if_splits\n intro: exI[where x=id])\n apply (rule_tac x=Suc in exI, rule_tac x=\"exst bb\" in exI, force)+\n apply (rule_tac x=id in exI, rule_tac x=\"exst b\" in exI, force)+\n done\n\nlemma pageBits_less_word_bits [simp]:\n \"pageBits < word_bits\" by (simp add: pageBits_def word_bits_conv)\n\nlemma mask_out_8_le_kernel_base:\n \"(x && ~~ mask 8 \\ kernel_base >> 20) = (x \\ kernel_base >> 20)\"\n apply (rule iffI)\n apply (erule order_trans, rule word_and_le2)\n apply (drule_tac n=8 in neg_mask_mono_le)\n apply (simp add: kernel_base_def mask_def)\n done\n\nlemma mask_out_8_less_kernel_base:\n \"(x && ~~ mask 8 < kernel_base >> 20) = (x < kernel_base >> 20)\"\n using mask_out_8_le_kernel_base[where x=x]\n by (simp add: linorder_not_less[symmetric])\n\nlemma aobj_ref_arch_cap[simp]:\n \"aobj_ref (arch_default_cap aty ptr us dev) = Some ptr\"\n apply (case_tac aty)\n apply (simp_all add: aobj_ref_def arch_default_cap_def p_assoc_help)\n done\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/X64/ArchLevityCatch_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.2845759981489974, "lm_q1q2_score": 0.15888646170651882}} {"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Example_Valid_StateH\nimports \"InfoFlow.Example_Valid_State\" ArchADT_IF_Refine\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nsection \\Haskell state\\\n\ntext \\One invariant we need on s0 is that there exists\n an associated Haskell state satisfying the invariants.\n This does not yet exist.\\\n\nsubsection \\Defining the State\\\n\ntext \\Low's CSpace\\\n\ndefinition\n empty_cte :: \"nat \\ bool list \\ (capability \\ mdbnode) option\"\nwhere\n \"empty_cte bits \\ \\x. if length x = bits then Some (capability.NullCap, MDB 0 0 False False) else None\"\n\nabbreviation (input)\n Null_mdb :: \"mdbnode\"\nwhere\n \"Null_mdb \\ MDB 0 0 False False\"\n\ndefinition\n Low_capsH :: \"cnode_index \\ (capability \\ mdbnode) option\"\nwhere\n \"Low_capsH \\\n (empty_cte 10)\n ( (the_nat_to_bl_10 1)\n \\ (Structures_H.ThreadCap Low_tcb_ptr, Null_mdb),\n (the_nat_to_bl_10 2)\n \\ (Structures_H.CNodeCap Low_cnode_ptr 10 2 10, MDB 0 Low_tcb_ptr False False),\n (the_nat_to_bl_10 3)\n \\ (Structures_H.ArchObjectCap (ARM_H.PageDirectoryCap Low_pd_ptr\n (Some Low_asid)), MDB 0 (Low_tcb_ptr + 0x10) False False),\n (the_nat_to_bl_10 318)\n \\ (Structures_H.NotificationCap ntfn_ptr 0 True False,\n MDB (Silc_cnode_ptr + 318 * 0x10) 0 False False))\"\n\ndefinition\n Low_cte' :: \"10 word \\ Structures_H.cte option\"\nwhere\n \"Low_cte' \\ (map_option (\\(cap, mdb). CTE cap mdb)) \\ Low_capsH \\ to_bl\"\n\ndefinition\n Low_cte :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"Low_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then map_option (\\cte. KOCTE cte) (Low_cte' (ucast (offs - base >> cte_level_bits))) else None\"\n\n\ntext \\High's Cspace\\\n\ndefinition\n High_capsH :: \"cnode_index \\ (capability \\ mdbnode) option\"\nwhere\n \"High_capsH \\\n (empty_cte 10)\n ( (the_nat_to_bl_10 1)\n \\ (Structures_H.ThreadCap High_tcb_ptr, Null_mdb),\n (the_nat_to_bl_10 2)\n \\ (Structures_H.CNodeCap High_cnode_ptr 10 2 10, MDB 0 High_tcb_ptr False False),\n (the_nat_to_bl_10 3)\n \\ (Structures_H.ArchObjectCap (ARM_H.PageDirectoryCap High_pd_ptr\n (Some High_asid)), MDB 0 (High_tcb_ptr + 0x10) False False),\n (the_nat_to_bl_10 318)\n \\ (Structures_H.NotificationCap ntfn_ptr 0 False True,\n MDB 0 (Silc_cnode_ptr + 318 * 0x10) False False))\"\n\ndefinition\n High_cte' :: \"10 word \\ Structures_H.cte option\"\nwhere\n \"High_cte' \\ (map_option (\\(cap, mdb). CTE cap mdb)) \\ High_capsH \\ to_bl\"\n\ndefinition\n High_cte :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"High_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then map_option (\\cte. KOCTE cte) (High_cte' (ucast (offs - base >> cte_level_bits))) else None\"\n\ntext \\We need a copy of boundary crossing caps owned by SilcLabel.\n The only such cap is Low's cap to the notification\\\n\ndefinition\n Silc_capsH :: \"cnode_index \\ (capability \\ mdbnode) option\"\nwhere\n \"Silc_capsH \\\n (empty_cte 10)\n ( (the_nat_to_bl_10 2)\n \\ (Structures_H.CNodeCap Silc_cnode_ptr 10 2 10, Null_mdb),\n (the_nat_to_bl_10 318)\n \\ (Structures_H.NotificationCap ntfn_ptr 0 True False,\n MDB (High_cnode_ptr + 318 * 0x10) (Low_cnode_ptr + 318 * 0x10) False False))\"\n\ndefinition\n Silc_cte' :: \"10 word \\ Structures_H.cte option\"\nwhere\n \"Silc_cte' \\ (map_option (\\(cap, mdb). CTE cap mdb)) \\ Silc_capsH \\ to_bl\"\n\ndefinition\n Silc_cte :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"Silc_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then map_option (\\cte. KOCTE cte) (Silc_cte' (ucast (offs - base >> cte_level_bits))) else None\"\n\ntext \\notification between Low and High\\\n\ndefinition\n ntfnH :: Structures_H.notification\nwhere\n \"ntfnH \\ Structures_H.NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None\"\n\n\ntext \\Low's VSpace (PageDirectory)\\\n\ndefinition\n Low_pt'H :: \"word8 \\ ARM_H.pte \"\nwhere\n \"Low_pt'H \\ (\\_. ARM_H.InvalidPTE)\n (0 := ARM_H.SmallPagePTE shared_page_ptr_phys (PageCacheable \\ {}) (Global \\ {}) (XNever \\ {}) (vmrights_map vm_read_write))\"\n\ndefinition\n Low_ptH :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"Low_ptH \\\n \\base. (map_option (\\x. Structures_H.KOArch (ARM_H.KOPTE (Low_pt'H x)))) \\\n (\\offs. if is_aligned offs 2 \\ base \\ offs \\ offs \\ base + 2 ^ 10 - 1\n then Some (ucast (offs - base >> 2)) else None)\"\n\ndefinition\n [simp]:\n \"global_pdH \\ (\\_. ARM_H.InvalidPDE)( ucast (kernel_base >> 20) :=\n ARM_H.SectionPDE (addrFromPPtr kernel_base) (ParityEnabled \\ {}) 0\n (PageCacheable \\ {}) (Global \\ {}) (XNever \\ {}) (vmrights_map {}))\"\n\n\ndefinition\n Low_pd'H :: \"12 word \\ ARM_H.pde \"\nwhere\n \"Low_pd'H \\\n global_pdH\n (0 := ARM_H.PageTablePDE\n (addrFromPPtr Low_pt_ptr)\n (ParityEnabled \\ {})\n undefined)\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n Low_pdH :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"Low_pdH \\\n \\base. (map_option (\\x. Structures_H.KOArch (ARM_H.KOPDE (Low_pd'H x)))) \\\n (\\offs. if is_aligned offs 2 \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then Some (ucast (offs - base >> 2)) else None)\"\n\n\ntext \\High's VSpace (PageDirectory)\\\n\n\ndefinition\n High_pt'H :: \"word8 \\ ARM_H.pte \"\nwhere\n \"High_pt'H \\\n (\\_. ARM_H.InvalidPTE)\n (0 := ARM_H.SmallPagePTE shared_page_ptr_phys (PageCacheable \\ {}) (Global \\ {}) (XNever \\ {})\n (vmrights_map vm_read_only))\"\n\n\ndefinition\n High_ptH :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"High_ptH \\\n \\base. (map_option (\\x. Structures_H.KOArch (ARM_H.KOPTE (High_pt'H x)))) \\\n (\\offs. if is_aligned offs 2 \\ base \\ offs \\ offs \\ base + 2 ^ 10 - 1\n then Some (ucast (offs - base >> 2)) else None)\"\n\n\ndefinition\n High_pd'H :: \"12 word \\ ARM_H.pde \"\nwhere\n \"High_pd'H \\\n global_pdH\n (0 := ARM_H.PageTablePDE\n (addrFromPPtr High_pt_ptr)\n (ParityEnabled \\ {})\n undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n High_pdH :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"High_pdH \\\n \\base. (map_option (\\x. Structures_H.KOArch (ARM_H.KOPDE (High_pd'H x)))) \\\n (\\offs. if is_aligned offs 2 \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then Some (ucast (offs - base >> 2)) else None)\"\n\n\ntext \\Low's tcb\\\n\ndefinition\n Low_tcbH :: Structures_H.tcb\nwhere\n \"Low_tcbH \\ Thread\n \\ \\tcbCTable =\\ (CTE (CNodeCap Low_cnode_ptr 10 2 10)\n (MDB (Low_cnode_ptr + 0x20) 0 False False))\n \\ \\tcbVTable =\\ (CTE (ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False))\n \\ \\tcbReply =\\ (CTE (ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)) \\ \\master reply cap to itself\\\n \\ \\tcbCaller =\\ (CTE NullCap Null_mdb)\n \\ \\tcbIPCBufferFrame =\\ (CTE NullCap Null_mdb)\n \\ \\tcbDomain =\\ Low_domain\n \\ \\tcbState =\\ Running\n \\ \\tcbMCPriority =\\ Low_mcp\n \\ \\tcbPriority =\\ Low_prio\n \\ \\tcbQueued =\\ False\n \\ \\tcbFault =\\ None\n \\ \\tcbTimeSlice =\\ Low_time_slice\n \\ \\tcbFaultHandler =\\ 0\n \\ \\tcbIPCBuffer =\\ 0\n \\ \\tcbBoundNotification =\\ None\n \\ \\tcbContext =\\ (ArchThread undefined)\"\n\n\ntext \\High's tcb\\\ndefinition\n High_tcbH :: Structures_H.tcb\nwhere\n \"High_tcbH \\ Thread\n \\ \\tcbCTable =\\ (CTE (CNodeCap High_cnode_ptr 10 2 10)\n (MDB (High_cnode_ptr + 0x20) 0 False False))\n \\ \\tcbVTable =\\ (CTE (ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False))\n \\ \\tcbReply =\\ (CTE (ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) \\ \\master reply cap to itself\\\n \\ \\tcbCaller =\\ (CTE NullCap Null_mdb)\n \\ \\tcbIPCBufferFrame =\\ (CTE NullCap Null_mdb)\n \\ \\tcbDomain =\\ High_domain\n \\ \\tcbState =\\ (BlockedOnNotification ntfn_ptr)\n \\ \\tcbMCPriority =\\ High_mcp\n \\ \\tcbPriority =\\ High_prio\n \\ \\tcbQueued =\\ False\n \\ \\tcbFault =\\ None\n \\ \\tcbTimeSlice =\\ High_time_slice\n \\ \\tcbFaultHandler =\\ 0\n \\ \\tcbIPCBuffer =\\ 0\n \\ \\tcbBoundNotification =\\ None\n \\ \\tcbContext =\\ (ArchThread undefined)\"\n\n\ntext \\idle's tcb\\\n\ndefinition\n idle_tcbH :: Structures_H.tcb\nwhere\n \"idle_tcbH \\ Thread\n \\ \\tcbCTable =\\ (CTE NullCap Null_mdb)\n \\ \\tcbVTable =\\ (CTE NullCap Null_mdb)\n \\ \\tcbReply =\\ (CTE NullCap Null_mdb)\n \\ \\tcbCaller =\\ (CTE NullCap Null_mdb)\n \\ \\tcbIPCBufferFrame =\\ (CTE NullCap Null_mdb)\n \\ \\tcbDomain =\\ default_domain\n \\ \\tcbState =\\ IdleThreadState\n \\ \\tcbMCPriority =\\ default_priority\n \\ \\tcbPriority =\\ default_priority\n \\ \\tcbQueued =\\ False\n \\ \\tcbFault =\\ None\n \\ \\tcbTimeSlice =\\ timeSlice\n \\ \\tcbFaultHandler =\\ 0\n \\ \\tcbIPCBuffer =\\ 0\n \\ \\tcbBoundNotification =\\ None\n \\ \\tcbContext =\\ (ArchThread empty_context)\"\n\ndefinition\n irq_cte :: \"Structures_H.cte\"\nwhere\n \"irq_cte \\ CTE capability.NullCap Null_mdb\"\n\ndefinition\n option_update_range :: \"('a \\ 'b option) \\ ('a \\ 'b option) \\ ('a \\ 'b option)\"\nwhere\n \"option_update_range f g \\ \\x. case f x of None \\ g x | Some y \\ Some y\"\n\ndefinition\n global_pdH' :: \"word32 \\ word32 \\ Structures_H.kernel_object option\"\nwhere\n \"global_pdH' \\ \\base.\n (map_option (\\x. Structures_H.KOArch (ARM_H.KOPDE (global_pdH (x::12 word))))) \\\n (\\offs. if is_aligned offs 2 \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then Some (ucast (offs - base >> 2)) else None)\"\n\ndefinition\n kh0H :: \"(word32 \\ Structures_H.kernel_object)\"\nwhere\n \"kh0H \\ (option_update_range\n (\\x. if \\irq::10 word. init_irq_node_ptr + (ucast irq << cte_level_bits) = x\n then Some (KOCTE (CTE capability.NullCap Null_mdb)) else None) \\\n option_update_range (Low_cte Low_cnode_ptr) \\\n option_update_range (High_cte High_cnode_ptr) \\\n option_update_range (Silc_cte Silc_cnode_ptr) \\\n option_update_range [ntfn_ptr \\ KONotification ntfnH] \\\n option_update_range [irq_cnode_ptr \\ KOCTE irq_cte] \\\n option_update_range (Low_pdH Low_pd_ptr) \\\n option_update_range (High_pdH High_pd_ptr) \\\n option_update_range (Low_ptH Low_pt_ptr) \\\n option_update_range (High_ptH High_pt_ptr) \\\n option_update_range [Low_tcb_ptr \\ KOTCB Low_tcbH] \\\n option_update_range [High_tcb_ptr \\ KOTCB High_tcbH] \\\n option_update_range [idle_tcb_ptr \\ KOTCB idle_tcbH] \\\n option_update_range (global_pdH' init_global_pd) \\\n option_update_range [init_globals_frame \\ KOUserData]\n ) Map.empty\"\n\nlemma s0_ptrs_aligned:\n \"is_aligned init_global_pd 14\"\n \"is_aligned High_pd_ptr 14\"\n \"is_aligned Low_pd_ptr 14\"\n \"is_aligned High_pt_ptr 10\"\n \"is_aligned Low_pt_ptr 10\"\n \"is_aligned Silc_cnode_ptr 14\"\n \"is_aligned High_cnode_ptr 14\"\n \"is_aligned Low_cnode_ptr 14\"\n \"is_aligned High_tcb_ptr 9\"\n \"is_aligned Low_tcb_ptr 9\"\n \"is_aligned idle_tcb_ptr 9\"\n \"is_aligned ntfn_ptr 4\"\n \"is_aligned irq_cnode_ptr 10\"\n by (simp_all add: is_aligned_def s0_ptr_defs)\n\nlemma pd_offs_min':\n \"is_aligned ptr 14 \\ (ptr::32 word) \\ ptr + (ucast (x:: 12 word) << 2)\"\n apply (erule is_aligned_no_wrap'[OF _ ucast_less_shiftl_helper])\n apply (simp add: word_bits_def)\n apply simp\n done\n\nlemma pd_offs_min:\n \"Low_pd_ptr \\ Low_pd_ptr + (ucast (x:: 12 word) << 2)\"\n \"High_pd_ptr \\ High_pd_ptr + (ucast (x:: 12 word) << 2)\"\n \"init_global_pd \\ init_global_pd + (ucast (x:: 12 word) << 2)\"\n by (simp_all add: pd_offs_min' s0_ptrs_aligned)\n\nlemma pd_offs_max':\n \"is_aligned ptr 14 \\ (ptr::word32) + (ucast (x:: 12 word) << 2) \\ ptr + 0x3fff\"\n apply (rule word_plus_mono_right)\n apply (simp add: shiftl_t2n mult.commute)\n apply (rule div_to_mult_word_lt)\n apply simp\n apply (rule plus_one_helper)\n apply simp\n apply (cut_tac ucast_less[where x=x])\n apply simp\n apply simp\n apply (drule is_aligned_no_overflow)\n apply (simp add: add.commute)\n done\n\nlemma pd_offs_max:\n \"Low_pd_ptr + (ucast (x:: 12 word) << 2) \\ Low_pd_ptr + 0x3fff\"\n \"High_pd_ptr + (ucast (x:: 12 word) << 2) \\ High_pd_ptr + 0x3fff\"\n \"init_global_pd + (ucast (x:: 12 word) << 2) \\ init_global_pd + 0x3fff\"\n by (simp_all add: pd_offs_max' s0_ptrs_aligned)\n\ndefinition pd_offs_range where\n \"pd_offs_range (ptr::word32) \\ {x. ptr \\ x \\ x \\ ptr + 2 ^ 14 - 1}\n \\ {x. is_aligned x 2}\"\n\nlemma pd_offs_in_range':\n \"is_aligned ptr 14 \\\n ptr + (ucast (x:: 12 word) << 2) \\ pd_offs_range ptr\"\n apply (clarsimp simp: pd_offs_min' pd_offs_max' pd_offs_range_def add.commute)\n apply (rule is_aligned_add[OF _ is_aligned_shift])\n apply (erule is_aligned_weaken)\n apply simp\n done\n\nlemma pd_offs_in_range:\n \"Low_pd_ptr + (ucast (x:: 12 word) << 2) \\ pd_offs_range Low_pd_ptr\"\n \"High_pd_ptr + (ucast (x:: 12 word) << 2) \\ pd_offs_range High_pd_ptr\"\n \"init_global_pd + (ucast (x:: 12 word) << 2) \\ pd_offs_range init_global_pd\"\n by (simp_all add: pd_offs_in_range' s0_ptrs_aligned)\n\nlemma pd_offs_range_correct':\n \"\\x \\ pd_offs_range ptr; is_aligned ptr 14\\\n \\ \\y. x = ptr + (ucast (y:: 12 word) << 2)\"\n apply (clarsimp simp: pd_offs_range_def s0_ptr_defs cte_level_bits_def)\n apply (rule_tac x=\"ucast ((x - ptr) >> 2)\" in exI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst aligned_shiftr_mask_shiftl)\n apply (rule aligned_sub_aligned)\n apply assumption\n apply (erule is_aligned_weaken)\n apply simp\n apply simp\n apply simp\n apply (rule_tac n=14 in mask_eqI)\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_def)\n apply (simp add: mask_twice)\n apply (subst diff_conv_add_uminus)\n apply (subst add.commute[symmetric])\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_minus)\n apply simp\n apply (subst diff_conv_add_uminus)\n apply (subst add_mask_lower_bits)\n apply (simp add: is_aligned_def)\n apply clarsimp\n apply (cut_tac x=x and y=\"ptr + 0x3FFF\" and n=14 in neg_mask_mono_le)\n apply (simp add: add.commute)\n apply (drule_tac n=14 in aligned_le_sharp)\n apply (simp add: is_aligned_def)\n apply (simp add: add.commute)\n apply (subst(asm) mask_out_add_aligned[symmetric])\n apply (erule is_aligned_weaken)\n apply simp\n apply (simp add: mask_def)\n done\n\nlemma pd_offs_range_correct:\n \"x \\ pd_offs_range Low_pd_ptr \\ \\y. x = Low_pd_ptr + (ucast (y:: 12 word) << 2)\"\n \"x \\ pd_offs_range High_pd_ptr \\ \\y. x = High_pd_ptr + (ucast (y:: 12 word) << 2)\"\n \"x \\ pd_offs_range init_global_pd \\ \\y. x = init_global_pd + (ucast (y:: 12 word) << 2)\"\n by (simp_all add: pd_offs_range_correct' s0_ptrs_aligned)\n\nlemma pt_offs_min':\n \"is_aligned ptr 10 \\ (ptr::word32) \\ ptr + (ucast (x:: 8 word) << 2)\"\n apply (erule is_aligned_no_wrap')\n apply (rule ucast_less_shiftl_helper)\n apply (simp add: word_bits_def)\n apply simp\n done\n\nlemma pt_offs_min:\n \"Low_pt_ptr \\ Low_pt_ptr + (ucast (x:: 8 word) << 2)\"\n \"High_pt_ptr \\ High_pt_ptr + (ucast (x:: 8 word) << 2)\"\n by (simp_all add: pt_offs_min' s0_ptrs_aligned)\n\nlemma pt_offs_max':\n \"is_aligned ptr 10 \\ (ptr::word32) + (ucast (x:: 8 word) << 2) \\ ptr + 0x3ff\"\n apply (rule word_plus_mono_right)\n apply (simp add: shiftl_t2n mult.commute)\n apply (rule div_to_mult_word_lt)\n apply simp\n apply (rule plus_one_helper)\n apply simp\n apply (cut_tac ucast_less[where x=x])\n apply simp\n apply simp\n apply (drule is_aligned_no_overflow)\n apply (simp add: add.commute)\n done\n\nlemma pt_offs_max:\n \"Low_pt_ptr + (ucast (x:: 8 word) << 2) \\ Low_pt_ptr + 0x3ff\"\n \"High_pt_ptr + (ucast (x:: 8 word) << 2) \\ High_pt_ptr + 0x3ff\"\n by (simp_all add: pt_offs_max' s0_ptrs_aligned)\n\ndefinition pt_offs_range where\n \"pt_offs_range (ptr::word32) \\ {x. ptr \\ x \\ x \\ ptr + 2 ^ 10 - 1}\n \\ {x. is_aligned x 2}\"\n\nlemma pt_offs_in_range':\n \"is_aligned ptr 10 \\\n ptr + (ucast (x:: 8 word) << 2) \\ pt_offs_range ptr\"\n apply (clarsimp simp: pt_offs_min' pt_offs_max' pt_offs_range_def add.commute)\n apply (rule is_aligned_add[OF _ is_aligned_shift])\n apply (erule is_aligned_weaken)\n apply simp\n done\n\nlemma pt_offs_in_range:\n \"Low_pt_ptr + (ucast (x:: 8 word) << 2) \\ pt_offs_range Low_pt_ptr\"\n \"High_pt_ptr + (ucast (x:: 8 word) << 2) \\ pt_offs_range High_pt_ptr\"\n by (simp_all add: pt_offs_in_range' s0_ptrs_aligned)\n\nlemma pt_offs_range_correct':\n \"\\x \\ pt_offs_range ptr; is_aligned ptr 10\\\n \\ \\y. x = ptr + (ucast (y:: 8 word) << 2)\"\n apply (clarsimp simp: pt_offs_range_def s0_ptr_defs cte_level_bits_def)\n apply (rule_tac x=\"ucast ((x - ptr) >> 2)\" in exI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (subst aligned_shiftr_mask_shiftl)\n apply (rule aligned_sub_aligned)\n apply assumption\n apply (erule is_aligned_weaken)\n apply simp\n apply simp\n apply simp\n apply (rule_tac n=10 in mask_eqI)\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_def)\n apply (simp add: mask_twice)\n apply (subst diff_conv_add_uminus)\n apply (subst add.commute[symmetric])\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_minus)\n apply simp\n apply (subst diff_conv_add_uminus)\n apply (subst add_mask_lower_bits)\n apply (simp add: is_aligned_def)\n apply clarsimp\n apply (cut_tac x=x and y=\"ptr + 0x3FF\" and n=10 in neg_mask_mono_le)\n apply (simp add: add.commute)\n apply (drule_tac n=10 in aligned_le_sharp)\n apply (simp add: is_aligned_def)\n apply (simp add: add.commute)\n apply (subst(asm) mask_out_add_aligned[symmetric])\n apply (erule is_aligned_weaken)\n apply simp\n apply (simp add: mask_def)\n done\n\nlemma pt_offs_range_correct:\n \"x \\ pt_offs_range Low_pt_ptr \\ \\y. x = Low_pt_ptr + (ucast (y:: 8 word) << 2)\"\n \"x \\ pt_offs_range High_pt_ptr \\ \\y. x = High_pt_ptr + (ucast (y:: 8 word) << 2)\"\n by (simp_all add: pt_offs_range_correct' s0_ptrs_aligned)\n\n(* FIXME: move to Word_Lib *)\nlemma bl_to_bin_le2p_aux:\n \"bl_to_bin_aux bs w \\ (w + 1) * (2 ^ length bs) - 1\"\n apply (induct bs arbitrary: w)\n apply clarsimp\n apply clarsimp\n apply (rule conjI; clarsimp)\n apply (drule meta_spec, erule xtr8 [rotated], simp)+\n done\n\n(* FIXME: move to Word_Lib *)\nlemma bl_to_bin_le2p: \"bl_to_bin bs \\ (2 ^ length bs) - 1\"\n apply (unfold bl_to_bin_def)\n apply (rule xtr3)\n prefer 2\n apply (rule bl_to_bin_le2p_aux)\n apply simp\n done\n\n(* FIXME: move to Word_Lib *)\nlemma of_bl_length_le:\n \"length x = k \\ k < len_of TYPE('a) \\ (of_bl x :: 'a :: len word) \\ 2 ^ k - 1\"\n by (simp add: of_bl_length_less)\n\nlemma cnode_offs_min':\n \"\\is_aligned ptr 14; length x = 10\\ \\ (ptr::word32) \\ ptr + of_bl x * 0x10\"\n apply (erule is_aligned_no_wrap')\n apply (rule div_lt_mult)\n apply (drule of_bl_length_less[where 'a=32])\n apply simp\n apply simp\n apply simp\n done\n\nlemma cnode_offs_min:\n \"length x = 10 \\ Low_cnode_ptr \\ Low_cnode_ptr + of_bl x * 0x10\"\n \"length x = 10 \\ High_cnode_ptr \\ High_cnode_ptr + of_bl x * 0x10\"\n \"length x = 10 \\ Silc_cnode_ptr \\ Silc_cnode_ptr + of_bl x * 0x10\"\n by (simp_all add: cnode_offs_min' s0_ptrs_aligned)\n\nlemma cnode_offs_max':\n \"\\is_aligned ptr 14; length x = 10\\ \\ (ptr::word32) + of_bl x * 0x10 \\ ptr + 0x3fff\"\n apply (rule word_plus_mono_right)\n apply (rule div_to_mult_word_lt)\n apply simp\n apply (rule plus_one_helper)\n apply simp\n apply (drule of_bl_length_less[where 'a=32])\n apply simp\n apply simp\n apply (drule is_aligned_no_overflow)\n apply (simp add: add.commute)\n done\n\nlemma cnode_offs_max:\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ Low_cnode_ptr + 0x3fff\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ High_cnode_ptr + 0x3fff\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ Silc_cnode_ptr + 0x3fff\"\n by (simp_all add: cnode_offs_max' s0_ptrs_aligned)\n\ndefinition cnode_offs_range where\n \"cnode_offs_range (ptr::word32) \\ {x. ptr \\ x \\ x \\ ptr + 2 ^ 14 - 1}\n \\ {x. is_aligned x cte_level_bits}\"\n\nlemma cnode_offs_in_range':\n \"\\is_aligned ptr 14; length x = 10\\ \\\n ptr + of_bl x * 0x10 \\ cnode_offs_range ptr\"\n apply (clarsimp simp: cnode_offs_min' cnode_offs_max' cnode_offs_range_def add.commute cte_level_bits_def)\n apply (rule is_aligned_add)\n apply (erule is_aligned_weaken)\n apply simp\n apply (rule_tac is_aligned_mult_triv2[where x=\"of_bl x\" and n=4, simplified])\n done\n\nlemma cnode_offs_in_range:\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ cnode_offs_range Low_cnode_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ cnode_offs_range High_cnode_ptr\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ cnode_offs_range Silc_cnode_ptr\"\n by (simp_all add: cnode_offs_in_range' s0_ptrs_aligned)\n\n(* FIXME: move to Word_Lib *)\nlemma le_mask_eq: \"x \\ 2 ^ n - 1 \\ x AND mask n = (x :: 'a :: len word)\"\n by (metis and_mask_eq_iff_le_mask mask_2pm1)\n\n(* FIXME: move to Word_Lib *)\nlemma word_div_mult':\n fixes c :: \"'a::len word\"\n shows \"\\0 < c; a \\ b * c \\ \\ a div c \\ b\"\n using div_lt_mult word_le_not_less by blast\n\nlemma cnode_offs_range_correct':\n \"\\x \\ cnode_offs_range ptr; is_aligned ptr 14\\\n \\ \\y. length y = 10 \\ (x = ptr + of_bl y * 0x10)\"\n apply (clarsimp simp: cnode_offs_range_def s0_ptr_defs cte_level_bits_def)\n apply (rule_tac x=\"to_bl (ucast ((x - ptr) div 0x10):: 10 word)\" in exI)\n apply (clarsimp simp: to_bl_ucast of_bl_drop)\n apply (subst le_mask_eq)\n apply simp\n apply (rule word_div_mult')\n apply simp\n apply simp\n apply (rule word_diff_ls')\n apply (drule_tac a=x and n=4 in aligned_le_sharp)\n apply simp\n apply (simp add: add.commute)\n apply (subst(asm) mask_out_add_aligned[symmetric])\n apply (erule is_aligned_weaken)\n apply simp\n apply (simp add: mask_def)\n apply simp\n apply (clarsimp simp: neg_mask_is_div[where n=4, simplified, symmetric])\n apply (subst is_aligned_neg_mask_eq)\n apply (rule aligned_sub_aligned)\n apply assumption\n apply (erule is_aligned_weaken)\n apply simp\n apply simp\n apply simp\n done\n\nlemma cnode_offs_range_correct:\n \"x \\ cnode_offs_range Low_cnode_ptr \\ \\y. length y = 10 \\ (x = Low_cnode_ptr + of_bl y * 0x10)\"\n \"x \\ cnode_offs_range High_cnode_ptr \\ \\y. length y = 10 \\ (x = High_cnode_ptr + of_bl y * 0x10)\"\n \"x \\ cnode_offs_range Silc_cnode_ptr \\ \\y. length y = 10 \\ (x = Silc_cnode_ptr + of_bl y * 0x10)\"\n by (simp_all add: cnode_offs_range_correct' s0_ptrs_aligned)\n\n\nlemma tcb_offs_min':\n \"is_aligned ptr 9 \\ (ptr::word32) \\ ptr + ucast (x:: 9 word)\"\n apply (erule is_aligned_no_wrap')\n apply (cut_tac x=x and 'a=32 in ucast_less)\n apply simp\n apply simp\n done\n\nlemma tcb_offs_min:\n \"Low_tcb_ptr \\ Low_tcb_ptr + ucast (x:: 9 word)\"\n \"High_tcb_ptr \\ High_tcb_ptr + ucast (x:: 9 word)\"\n \"idle_tcb_ptr \\ idle_tcb_ptr + ucast (x:: 9 word)\"\n by (simp_all add: tcb_offs_min' s0_ptrs_aligned)\n\nlemma tcb_offs_max':\n \"is_aligned ptr 9 \\ (ptr::word32) + ucast (x:: 9 word) \\ ptr + 0x1ff\"\n apply (rule word_plus_mono_right)\n apply (rule plus_one_helper)\n apply (cut_tac ucast_less[where x=x and 'a=32])\n apply simp\n apply simp\n apply (drule is_aligned_no_overflow)\n apply (simp add: add.commute)\n done\n\nlemma tcb_offs_max:\n \"Low_tcb_ptr + ucast (x:: 9 word) \\ Low_tcb_ptr + 0x1ff\"\n \"High_tcb_ptr + ucast (x:: 9 word) \\ High_tcb_ptr + 0x1ff\"\n \"idle_tcb_ptr + ucast (x:: 9 word) \\ idle_tcb_ptr + 0x1ff\"\n by (simp_all add: tcb_offs_max' s0_ptrs_aligned)\n\ndefinition tcb_offs_range where\n \"tcb_offs_range (ptr::word32) \\ {x. ptr \\ x \\ x \\ ptr + 2 ^ 9 - 1}\"\n\nlemma tcb_offs_in_range':\n \"is_aligned ptr 9 \\\n ptr + ucast (x:: 9 word) \\ tcb_offs_range ptr\"\n by (clarsimp simp: tcb_offs_min' tcb_offs_max' tcb_offs_range_def add.commute)\n\nlemma tcb_offs_in_range:\n \"Low_tcb_ptr + ucast (x:: 9 word) \\ tcb_offs_range Low_tcb_ptr\"\n \"High_tcb_ptr + ucast (x:: 9 word) \\ tcb_offs_range High_tcb_ptr\"\n \"idle_tcb_ptr + ucast (x:: 9 word) \\ tcb_offs_range idle_tcb_ptr\"\n by (simp_all add: tcb_offs_in_range' s0_ptrs_aligned)\n\nlemma tcb_offs_range_correct':\n \"\\x \\ tcb_offs_range ptr; is_aligned ptr 9\\\n \\ \\y. x = ptr + ucast (y:: 9 word)\"\n apply (clarsimp simp: tcb_offs_range_def s0_ptr_defs cte_level_bits_def)\n apply (rule_tac x=\"ucast (x - ptr)\" in exI)\n apply (clarsimp simp: ucast_ucast_mask)\n apply (rule_tac n=9 in mask_eqI)\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_def)\n apply (simp add: mask_twice)\n apply (subst diff_conv_add_uminus)\n apply (subst add.commute[symmetric])\n apply (subst mask_add_aligned)\n apply (simp add: is_aligned_minus)\n apply simp\n apply (subst diff_conv_add_uminus)\n apply (subst add_mask_lower_bits)\n apply (simp add: is_aligned_def)\n apply clarsimp\n apply (cut_tac x=x and y=\"ptr + 0x1FF\" and n=9 in neg_mask_mono_le)\n apply (simp add: add.commute)\n apply (drule_tac n=9 in aligned_le_sharp)\n apply (simp add: is_aligned_def)\n apply (simp add: add.commute)\n apply (subst(asm) mask_out_add_aligned[symmetric])\n apply (erule is_aligned_weaken)\n apply simp\n apply (simp add: mask_def)\n done\n\nlemma tcb_offs_range_correct:\n \"x \\ tcb_offs_range Low_tcb_ptr \\ \\y. x = Low_tcb_ptr + ucast (y:: 9 word)\"\n \"x \\ tcb_offs_range High_tcb_ptr \\ \\y. x = High_tcb_ptr + ucast (y:: 9 word)\"\n \"x \\ tcb_offs_range idle_tcb_ptr \\ \\y. x = idle_tcb_ptr + ucast (y:: 9 word)\"\n by (simp_all add: tcb_offs_range_correct' s0_ptrs_aligned)\n\nlemma caps_dom_length_10:\n \"Silc_caps x = Some y \\ length x = 10\"\n \"High_caps x = Some y \\ length x = 10\"\n \"Low_caps x = Some y \\ length x = 10\"\n by (simp_all add: Silc_caps_def High_caps_def Low_caps_def the_nat_to_bl_def nat_to_bl_def split: if_split_asm)\n\nlemma dom_caps:\n \"dom Silc_caps = {x. length x = 10}\"\n \"dom High_caps = {x. length x = 10}\"\n \"dom Low_caps = {x. length x = 10}\"\n apply (simp_all add: Silc_caps_def High_caps_def Low_caps_def the_nat_to_bl_def nat_to_bl_def dom_def split: if_split_asm)\n apply fastforce+\n done\n\nlemmas kh0H_obj_def =\n Low_cte_def High_cte_def Silc_cte_def ntfnH_def irq_cte_def Low_pdH_def\n High_pdH_def Low_ptH_def High_ptH_def Low_tcbH_def High_tcbH_def idle_tcbH_def\n global_pdH'_def\n\nlemmas kh0H_all_obj_def =\n kh0H_obj_def Low_cte'_def Low_capsH_def High_cte'_def High_capsH_def\n Silc_cte'_def Silc_capsH_def empty_cte_def\n\nlemma not_in_range_None:\n \"\\x \\ cnode_offs_range Low_cnode_ptr\\ \\ Low_cte Low_cnode_ptr x = None\"\n \"\\x \\ cnode_offs_range High_cnode_ptr\\ \\ High_cte High_cnode_ptr x = None\"\n \"\\x \\ cnode_offs_range Silc_cnode_ptr\\ \\ Silc_cte Silc_cnode_ptr x = None\"\n \"\\x \\ pd_offs_range Low_pd_ptr\\ \\ Low_pdH Low_pd_ptr x = None\"\n \"\\x \\ pd_offs_range High_pd_ptr\\ \\ High_pdH High_pd_ptr x = None\"\n \"\\x \\ pd_offs_range init_global_pd\\ \\ global_pdH' init_global_pd x = None\"\n \"\\x \\ pt_offs_range Low_pt_ptr\\ \\ Low_ptH Low_pt_ptr x = None\"\n \"\\x \\ pt_offs_range High_pt_ptr\\ \\ High_ptH High_pt_ptr x = None\"\n by (clarsimp simp: cnode_offs_range_def pd_offs_range_def pt_offs_range_def s0_ptr_defs kh0H_obj_def)+\n\nlemma kh0H_dom_distinct:\n \"init_globals_frame \\ cnode_offs_range Silc_cnode_ptr\"\n \"idle_tcb_ptr \\ cnode_offs_range Silc_cnode_ptr\"\n \"High_tcb_ptr \\ cnode_offs_range Silc_cnode_ptr\"\n \"Low_tcb_ptr \\ cnode_offs_range Silc_cnode_ptr\"\n \"irq_cnode_ptr \\ cnode_offs_range Silc_cnode_ptr\"\n \"ntfn_ptr \\ cnode_offs_range Silc_cnode_ptr\"\n \"init_globals_frame \\ cnode_offs_range Low_cnode_ptr\"\n \"idle_tcb_ptr \\ cnode_offs_range Low_cnode_ptr\"\n \"High_tcb_ptr \\ cnode_offs_range Low_cnode_ptr\"\n \"Low_tcb_ptr \\ cnode_offs_range Low_cnode_ptr\"\n \"irq_cnode_ptr \\ cnode_offs_range Low_cnode_ptr\"\n \"ntfn_ptr \\ cnode_offs_range Low_cnode_ptr\"\n \"init_globals_frame \\ cnode_offs_range High_cnode_ptr\"\n \"idle_tcb_ptr \\ cnode_offs_range High_cnode_ptr\"\n \"High_tcb_ptr \\ cnode_offs_range High_cnode_ptr\"\n \"Low_tcb_ptr \\ cnode_offs_range High_cnode_ptr\"\n \"irq_cnode_ptr \\ cnode_offs_range High_cnode_ptr\"\n \"ntfn_ptr \\ cnode_offs_range High_cnode_ptr\"\n \"init_globals_frame \\ pd_offs_range Low_pd_ptr\"\n \"idle_tcb_ptr \\ pd_offs_range Low_pd_ptr\"\n \"High_tcb_ptr \\ pd_offs_range Low_pd_ptr\"\n \"Low_tcb_ptr \\ pd_offs_range Low_pd_ptr\"\n \"irq_cnode_ptr \\ pd_offs_range Low_pd_ptr\"\n \"ntfn_ptr \\ pd_offs_range Low_pd_ptr\"\n \"init_globals_frame \\ pd_offs_range High_pd_ptr\"\n \"idle_tcb_ptr \\ pd_offs_range High_pd_ptr\"\n \"High_tcb_ptr \\ pd_offs_range High_pd_ptr\"\n \"Low_tcb_ptr \\ pd_offs_range High_pd_ptr\"\n \"irq_cnode_ptr \\ pd_offs_range High_pd_ptr\"\n \"ntfn_ptr \\ pd_offs_range High_pd_ptr\"\n \"init_globals_frame \\ pd_offs_range init_global_pd\"\n \"idle_tcb_ptr \\ pd_offs_range init_global_pd\"\n \"High_tcb_ptr \\ pd_offs_range init_global_pd\"\n \"Low_tcb_ptr \\ pd_offs_range init_global_pd\"\n \"irq_cnode_ptr \\ pd_offs_range init_global_pd\"\n \"ntfn_ptr \\ pd_offs_range init_global_pd\"\n \"init_globals_frame \\ pt_offs_range Low_pt_ptr\"\n \"idle_tcb_ptr \\ pt_offs_range Low_pt_ptr\"\n \"High_tcb_ptr \\ pt_offs_range Low_pt_ptr\"\n \"Low_tcb_ptr \\ pt_offs_range Low_pt_ptr\"\n \"irq_cnode_ptr \\ pt_offs_range Low_pt_ptr\"\n \"ntfn_ptr \\ pt_offs_range Low_pt_ptr\"\n \"init_globals_frame \\ pt_offs_range High_pt_ptr\"\n \"idle_tcb_ptr \\ pt_offs_range High_pt_ptr\"\n \"High_tcb_ptr \\ pt_offs_range High_pt_ptr\"\n \"Low_tcb_ptr \\ pt_offs_range High_pt_ptr\"\n \"irq_cnode_ptr \\ pt_offs_range High_pt_ptr\"\n \"ntfn_ptr \\ pt_offs_range High_pt_ptr\"\n \"init_globals_frame \\ tcb_offs_range Low_tcb_ptr\"\n \"idle_tcb_ptr \\ tcb_offs_range Low_tcb_ptr\"\n \"High_tcb_ptr \\ tcb_offs_range Low_tcb_ptr\"\n \"irq_cnode_ptr \\ tcb_offs_range Low_tcb_ptr\"\n \"ntfn_ptr \\ tcb_offs_range Low_tcb_ptr\"\n \"init_globals_frame \\ tcb_offs_range High_tcb_ptr\"\n \"idle_tcb_ptr \\ tcb_offs_range High_tcb_ptr\"\n \"Low_tcb_ptr \\ tcb_offs_range High_tcb_ptr\"\n \"irq_cnode_ptr \\ tcb_offs_range High_tcb_ptr\"\n \"ntfn_ptr \\ tcb_offs_range High_tcb_ptr\"\n \"init_globals_frame \\ tcb_offs_range idle_tcb_ptr\"\n \"High_tcb_ptr \\ tcb_offs_range idle_tcb_ptr\"\n \"Low_tcb_ptr \\ tcb_offs_range idle_tcb_ptr\"\n \"irq_cnode_ptr \\ tcb_offs_range idle_tcb_ptr\"\n \"ntfn_ptr \\ tcb_offs_range idle_tcb_ptr\"\n by (clarsimp simp: cnode_offs_range_def pd_offs_range_def pt_offs_range_def tcb_offs_range_def kh0H_obj_def s0_ptr_defs)+\n\nlemma kh0H_dom_sets_distinct:\n \"irq_node_offs_range \\ cnode_offs_range Silc_cnode_ptr = {}\"\n \"irq_node_offs_range \\ cnode_offs_range High_cnode_ptr = {}\"\n \"irq_node_offs_range \\ cnode_offs_range Low_cnode_ptr = {}\"\n \"irq_node_offs_range \\ pd_offs_range init_global_pd = {}\"\n \"irq_node_offs_range \\ pd_offs_range High_pd_ptr = {}\"\n \"irq_node_offs_range \\ pd_offs_range Low_pd_ptr = {}\"\n \"irq_node_offs_range \\ pt_offs_range High_pt_ptr = {}\"\n \"irq_node_offs_range \\ pt_offs_range Low_pt_ptr = {}\"\n \"irq_node_offs_range \\ tcb_offs_range High_tcb_ptr = {}\"\n \"irq_node_offs_range \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"irq_node_offs_range \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ cnode_offs_range High_cnode_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ cnode_offs_range Low_cnode_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ pd_offs_range init_global_pd = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ pd_offs_range High_pd_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ pd_offs_range Low_pd_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ pt_offs_range High_pt_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"cnode_offs_range Silc_cnode_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ cnode_offs_range Low_cnode_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ pd_offs_range init_global_pd = {}\"\n \"cnode_offs_range High_cnode_ptr \\ pd_offs_range High_pd_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ pd_offs_range Low_pd_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ pt_offs_range High_pt_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"cnode_offs_range High_cnode_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ pd_offs_range init_global_pd = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ pd_offs_range High_pd_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ pd_offs_range Low_pd_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ pt_offs_range High_pt_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"cnode_offs_range Low_cnode_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"pd_offs_range init_global_pd \\ pd_offs_range High_pd_ptr = {}\"\n \"pd_offs_range init_global_pd \\ pd_offs_range Low_pd_ptr = {}\"\n \"pd_offs_range init_global_pd \\ pt_offs_range High_pt_ptr = {}\"\n \"pd_offs_range init_global_pd \\ pt_offs_range Low_pt_ptr = {}\"\n \"pd_offs_range init_global_pd \\ tcb_offs_range High_tcb_ptr = {}\"\n \"pd_offs_range init_global_pd \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"pd_offs_range init_global_pd \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ pd_offs_range Low_pd_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ pt_offs_range High_pt_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"pd_offs_range High_pd_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"pd_offs_range Low_pd_ptr \\ pt_offs_range High_pt_ptr = {}\"\n \"pd_offs_range Low_pd_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"pd_offs_range Low_pd_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"pd_offs_range Low_pd_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"pd_offs_range Low_pd_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"pt_offs_range High_pt_ptr \\ pt_offs_range Low_pt_ptr = {}\"\n \"pt_offs_range High_pt_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"pt_offs_range High_pt_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"pt_offs_range High_pt_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"pt_offs_range Low_pt_ptr \\ tcb_offs_range High_tcb_ptr = {}\"\n \"pt_offs_range Low_pt_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"pt_offs_range Low_pt_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"tcb_offs_range High_tcb_ptr \\ tcb_offs_range Low_tcb_ptr = {}\"\n \"tcb_offs_range High_tcb_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n \"tcb_offs_range Low_tcb_ptr \\ tcb_offs_range idle_tcb_ptr = {}\"\n by (rule disjointI,\n clarsimp simp: irq_node_offs_range_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def tcb_offs_range_def s0_ptr_defs,\n drule(1) order_trans le_less_trans,\n fastforce)+\n\nlemmas offs_in_range = pd_offs_in_range pt_offs_in_range irq_node_offs_in_range cnode_offs_in_range tcb_offs_in_range\n\nlemmas offs_range_correct = pd_offs_range_correct pt_offs_range_correct irq_node_offs_range_correct cnode_offs_range_correct tcb_offs_range_correct\n\nlemma kh0H_dom_distinct':\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ init_globals_frame\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ idle_tcb_ptr\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ High_tcb_ptr\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ Low_tcb_ptr\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ irq_cnode_ptr\"\n \"length x = 10 \\ Silc_cnode_ptr + of_bl x * 0x10 \\ ntfn_ptr\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ init_globals_frame\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ idle_tcb_ptr\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ High_tcb_ptr\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ Low_tcb_ptr\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ irq_cnode_ptr\"\n \"length x = 10 \\ Low_cnode_ptr + of_bl x * 0x10 \\ ntfn_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ init_globals_frame\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ idle_tcb_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ High_tcb_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ Low_tcb_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ irq_cnode_ptr\"\n \"length x = 10 \\ High_cnode_ptr + of_bl x * 0x10 \\ ntfn_ptr\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ init_globals_frame\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ idle_tcb_ptr\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ High_tcb_ptr\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ Low_tcb_ptr\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ irq_cnode_ptr\"\n \"Low_pd_ptr + (ucast (y::12 word) << 2) \\ ntfn_ptr\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ init_globals_frame\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ idle_tcb_ptr\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ High_tcb_ptr\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ Low_tcb_ptr\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ irq_cnode_ptr\"\n \"High_pd_ptr + (ucast (y::12 word) << 2) \\ ntfn_ptr\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ init_globals_frame\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ idle_tcb_ptr\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ High_tcb_ptr\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ Low_tcb_ptr\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ irq_cnode_ptr\"\n \"init_global_pd + (ucast (y::12 word) << 2) \\ ntfn_ptr\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ init_globals_frame\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ idle_tcb_ptr\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ High_tcb_ptr\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ Low_tcb_ptr\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ irq_cnode_ptr\"\n \"Low_pt_ptr + (ucast (z::8 word) << 2) \\ ntfn_ptr\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ init_globals_frame\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ idle_tcb_ptr\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ High_tcb_ptr\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ Low_tcb_ptr\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ irq_cnode_ptr\"\n \"High_pt_ptr + (ucast (z::8 word) << 2) \\ ntfn_ptr\"\n apply (drule offs_in_range, fastforce simp: kh0H_dom_distinct)+\n apply (cut_tac x=y in offs_in_range(1), fastforce simp: kh0H_dom_distinct)+\n apply (cut_tac x=y in offs_in_range(2), fastforce simp: kh0H_dom_distinct)+\n apply (cut_tac x=y in offs_in_range(3), fastforce simp: kh0H_dom_distinct)+\n apply (cut_tac x=z in offs_in_range(4), fastforce simp: kh0H_dom_distinct)+\n apply (cut_tac x=z in offs_in_range(5), fastforce simp: kh0H_dom_distinct)+\n done\n\nlemma not_disjointI:\n \"\\x = y; x \\ A; y \\ B\\ \\ A \\ B \\ {}\"\n by fastforce\n\nlemma kh0H_simps[simp]:\n \"kh0H (init_irq_node_ptr + (ucast (irq::10 word) << cte_level_bits)) =\n Some (KOCTE (CTE capability.NullCap Null_mdb))\"\n \"kh0H ntfn_ptr = Some (KONotification ntfnH)\"\n \"kh0H irq_cnode_ptr = Some (KOCTE irq_cte)\"\n \"kh0H Low_tcb_ptr = Some (KOTCB Low_tcbH)\"\n \"kh0H High_tcb_ptr = Some (KOTCB High_tcbH)\"\n \"kh0H idle_tcb_ptr = Some (KOTCB idle_tcbH)\"\n \"kh0H init_globals_frame = Some KOUserData\"\n \"length x = 10 \\ kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)\"\n \"length x = 10 \\ kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)\"\n \"length x = 10 \\ kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)\"\n \"kh0H (Low_pd_ptr + (ucast (y:: 12 word) << 2)) = Low_pdH Low_pd_ptr (Low_pd_ptr + (ucast (y:: 12 word) << 2))\"\n \"kh0H (High_pd_ptr + (ucast (y:: 12 word) << 2)) = High_pdH High_pd_ptr (High_pd_ptr + (ucast (y:: 12 word) << 2))\"\n \"kh0H (init_global_pd + (ucast (y:: 12 word) << 2)) = global_pdH' init_global_pd (init_global_pd + (ucast (y:: 12 word) << 2))\"\n \"kh0H (Low_pt_ptr + (ucast (z:: 8 word) << 2)) = Low_ptH Low_pt_ptr (Low_pt_ptr + (ucast (z:: 8 word) << 2))\"\n \"kh0H (High_pt_ptr + (ucast (z:: 8 word) << 2)) = High_ptH High_pt_ptr (High_pt_ptr + (ucast (z:: 8 word) << 2))\"\n supply option.case_cong[cong]\n apply (clarsimp simp: kh0H_def option_update_range_def)\n apply fastforce\n apply (simp add:kh0H_def)\n apply (clarsimp simp: kh0H_def option_update_range_def kh0H_dom_distinct not_in_range_None)+\n by ((clarsimp simp: kh0H_def option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_None offs_in_range | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_None | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_None)+,\n rule conjI,\n clarsimp,\n drule not_disjointI,\n (erule offs_in_range | rule offs_in_range),\n (erule offs_in_range | rule offs_in_range),\n erule notE,\n rule kh0H_dom_sets_distinct,\n clarsimp split: option.splits)+\n\nlemma kh0H_dom:\n \"dom kh0H = {init_globals_frame, idle_tcb_ptr, High_tcb_ptr, Low_tcb_ptr,\n irq_cnode_ptr, ntfn_ptr} \\\n irq_node_offs_range \\\n cnode_offs_range Silc_cnode_ptr \\\n cnode_offs_range High_cnode_ptr \\\n cnode_offs_range Low_cnode_ptr \\\n pd_offs_range init_global_pd \\\n pd_offs_range High_pd_ptr \\\n pd_offs_range Low_pd_ptr \\\n pt_offs_range High_pt_ptr \\\n pt_offs_range Low_pt_ptr\"\n apply (rule equalityI)\n apply (simp add: kh0H_def dom_def)\n apply (clarsimp simp: offs_in_range option_update_range_def not_in_range_None split: if_split_asm)\n apply (clarsimp simp: dom_def)\n apply (rule conjI, clarsimp simp: kh0H_def option_update_range_def kh0H_dom_distinct not_in_range_None split: option.splits)+\n apply (force dest: irq_node_offs_range_correct)\n by (rule conjI |\n clarsimp simp: kh0H_def option_update_range_def kh0H_dom_distinct not_in_range_None split: option.splits,\n frule offs_range_correct,\n clarsimp simp: kh0H_all_obj_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def split: if_split_asm)+\n\nlemmas kh0H_SomeD' = set_mp[OF equalityD1[OF kh0H_dom[simplified dom_def]], OF CollectI, simplified, OF exI]\n\nlemma kh0H_SomeD:\n \"kh0H x = Some y \\\n x = init_globals_frame \\ y = KOUserData \\\n x = idle_tcb_ptr \\ y = KOTCB idle_tcbH \\\n x = High_tcb_ptr \\ y = KOTCB High_tcbH \\\n x = Low_tcb_ptr \\ y = KOTCB Low_tcbH \\\n x = ntfn_ptr \\ y = KONotification ntfnH \\\n x = irq_cnode_ptr \\ y = KOCTE irq_cte \\\n x \\ irq_node_offs_range \\ y = KOCTE (CTE capability.NullCap Null_mdb) \\\n x \\ cnode_offs_range Low_cnode_ptr \\ Low_cte Low_cnode_ptr x \\ None \\ y = the (Low_cte Low_cnode_ptr x) \\\n x \\ cnode_offs_range High_cnode_ptr \\ High_cte High_cnode_ptr x \\ None \\ y = the (High_cte High_cnode_ptr x) \\\n x \\ cnode_offs_range Silc_cnode_ptr \\ Silc_cte Silc_cnode_ptr x \\ None \\ y = the (Silc_cte Silc_cnode_ptr x) \\\n x \\ pd_offs_range init_global_pd \\ global_pdH' init_global_pd x \\ None \\ y = the (global_pdH' init_global_pd x) \\\n x \\ pd_offs_range High_pd_ptr \\ High_pdH High_pd_ptr x \\ None \\ y = the (High_pdH High_pd_ptr x) \\\n x \\ pd_offs_range Low_pd_ptr \\ Low_pdH Low_pd_ptr x \\ None \\ y = the (Low_pdH Low_pd_ptr x) \\\n x \\ pt_offs_range High_pt_ptr \\ High_ptH High_pt_ptr x \\ None \\ y = the (High_ptH High_pt_ptr x) \\\n x \\ pt_offs_range Low_pt_ptr \\ Low_ptH Low_pt_ptr x \\ None \\ y = the (Low_ptH Low_pt_ptr x)\"\n apply (frule kh0H_SomeD')\n apply (elim disjE)\n apply (clarsimp | frule offs_range_correct)+\n done\n\ndefinition arch_state0H :: Arch.kernel_state where\n \"arch_state0H \\ ARMKernelState\n \\ \\armKSASIDTable =\\ Map.empty\n \\ \\armKSHWASIDTable =\\ Map.empty\n \\ \\armKSNextASID =\\ 0\n \\ \\armKSASIDMap =\\ Map.empty\n \\ \\armKSGlobalPD =\\ init_global_pd\n \\ \\armKSGlobalPTs =\\ []\n \\ \\armKSKernelVSpace =\\\n (\\ref. if ref \\ {kernel_base..kernel_base + mask 20} then ArmVSpaceKernelWindow\n else ArmVSpaceInvalidRegion)\"\n\ndefinition\n s0H_internal :: \"kernel_state\"\nwhere\n \"s0H_internal \\ \\\n ksPSpace = kh0H,\n gsUserPages = (\\x. if x = init_globals_frame then Some ARMSmallPage else None),\n gsCNodes = (\\x. if \\irq::10 word. init_irq_node_ptr + (ucast irq << cte_level_bits) = x\n then Some 0 else None)\n (Low_cnode_ptr \\ 10,\n High_cnode_ptr \\ 10,\n Silc_cnode_ptr \\ 10,\n irq_cnode_ptr \\ 0),\n gsUntypedZeroRanges = ran (map_comp untypedZeroRange (option_map cteCap o map_to_ctes kh0H)),\n gsMaxObjectSize = card (UNIV :: word32 set),\n ksDomScheduleIdx = 0,\n ksDomSchedule = [(0 ,10), (1, 10)],\n ksCurDomain = 0,\n ksDomainTime = 5,\n ksReadyQueues = const [],\n ksReadyQueuesL1Bitmap = const 0,\n ksReadyQueuesL2Bitmap = const 0,\n ksCurThread = Low_tcb_ptr,\n ksIdleThread = idle_tcb_ptr,\n ksSchedulerAction = ResumeCurrentThread,\n ksInterruptState = InterruptState init_irq_node_ptr ((\\_. irqstate.IRQInactive) (timer_irq := irqstate.IRQTimer)),\n ksWorkUnitsCompleted = undefined,\n ksArchState = arch_state0H,\n ksMachineState = machine_state0\\\"\n\n\ndefinition\n Low_cte_cte :: \"word32 \\ word32 \\ cte option\"\nwhere\n \"Low_cte_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then Low_cte' (ucast (offs - base >> cte_level_bits)) else None\"\n\ndefinition\n High_cte_cte :: \"word32 \\ word32 \\ cte option\"\nwhere\n \"High_cte_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then High_cte' (ucast (offs - base >> cte_level_bits)) else None\"\n\ndefinition\n Silc_cte_cte :: \"word32 \\ word32 \\ cte option\"\nwhere\n \"Silc_cte_cte \\ \\base offs. if is_aligned offs cte_level_bits \\ base \\ offs \\ offs \\ base + 2 ^ 14 - 1\n then Silc_cte' (ucast (offs - base >> cte_level_bits)) else None\"\n\ndefinition\n Low_tcb_cte :: \"word32 \\ cte option\"\nwhere\n \"Low_tcb_cte \\ [Low_tcb_ptr \\ tcbCTable Low_tcbH,\n Low_tcb_ptr + 0x10 \\ tcbVTable Low_tcbH,\n Low_tcb_ptr + 0x20 \\ tcbReply Low_tcbH,\n Low_tcb_ptr + 0x30 \\ tcbCaller Low_tcbH,\n Low_tcb_ptr + 0x40 \\ tcbIPCBufferFrame Low_tcbH]\"\n\ndefinition\n High_tcb_cte :: \"word32 \\ cte option\"\nwhere\n \"High_tcb_cte \\ [High_tcb_ptr \\ tcbCTable High_tcbH,\n High_tcb_ptr + 0x10 \\ tcbVTable High_tcbH,\n High_tcb_ptr + 0x20 \\ tcbReply High_tcbH,\n High_tcb_ptr + 0x30 \\ tcbCaller High_tcbH,\n High_tcb_ptr + 0x40 \\ tcbIPCBufferFrame High_tcbH]\"\n\ndefinition\n idle_tcb_cte :: \"word32 \\ cte option\"\nwhere\n \"idle_tcb_cte \\ [idle_tcb_ptr \\ tcbCTable idle_tcbH,\n idle_tcb_ptr + 0x10 \\ tcbVTable idle_tcbH,\n idle_tcb_ptr + 0x20 \\ tcbReply idle_tcbH,\n idle_tcb_ptr + 0x30 \\ tcbCaller idle_tcbH,\n idle_tcb_ptr + 0x40 \\ tcbIPCBufferFrame idle_tcbH]\"\n\nlemma kh0H_dom_tcb:\n \"kh0H x = Some (KOTCB tcb) \\ x = Low_tcb_ptr \\ x = High_tcb_ptr \\ x = idle_tcb_ptr\"\n apply (frule domI[where m=\"kh0H\"])\n apply (simp add: kh0H_dom)\n apply (elim disjE)\n apply (drule irq_node_offs_range_correct cnode_offs_range_correct pd_offs_range_correct pt_offs_range_correct | clarsimp simp: kh0H_all_obj_def s0_ptrs_aligned split: if_split_asm)+\n done\n\nlemma not_in_range_cte_None:\n \"\\x \\ cnode_offs_range Low_cnode_ptr\\ \\ Low_cte_cte Low_cnode_ptr x = None\"\n \"\\x \\ cnode_offs_range High_cnode_ptr\\ \\ High_cte_cte High_cnode_ptr x = None\"\n \"\\x \\ cnode_offs_range Silc_cnode_ptr\\ \\ Silc_cte_cte Silc_cnode_ptr x = None\"\n \"\\x \\ tcb_offs_range Low_tcb_ptr\\ \\ Low_tcb_cte x = None\"\n \"\\x \\ tcb_offs_range High_tcb_ptr\\ \\ High_tcb_cte x = None\"\n \"\\x \\ tcb_offs_range idle_tcb_ptr\\ \\ idle_tcb_cte x = None\"\n by (fastforce simp: cnode_offs_range_def tcb_offs_range_def s0_ptr_defs Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def Low_tcb_cte_def High_tcb_cte_def idle_tcb_cte_def)+\n\nlemma mask_neg_le:\n \"x && ~~ mask n \\ x\"\n apply (clarsimp simp: neg_mask_is_div)\n apply (rule word_div_mult_le)\n done\n\nlemma mask_in_tcb_offs_range:\n \"x && ~~ mask 9 = ptr \\ x \\ tcb_offs_range ptr\"\n apply (clarsimp simp: tcb_offs_range_def mask_neg_le objBitsKO_def)\n apply (cut_tac and_neg_mask_plus_mask_mono[where p=x and n=9])\n apply (simp add: add.commute mask_def)\n done\n\nlemma set_mem_neq:\n \"\\y \\ S; x \\ S\\ \\ x \\ y\"\n by fastforce\n\nlemma neg_mask_decompose:\n \"x && ~~ mask n = ptr \\ x = ptr + (x && mask n)\"\n by (clarsimp simp: AND_NOT_mask_plus_AND_mask_eq)\n\nlemma opt_None_not_dom:\n \"m a = None \\ a \\ dom m\"\n by (simp add: dom_def)\n\nlemma tcb_offs_range_mask_eq:\n \"\\x \\ tcb_offs_range ptr; is_aligned ptr 9\\ \\ x && ~~ mask 9 = ptr\"\n apply (drule(1) tcb_offs_range_correct')\n apply (clarsimp simp: objBitsKO_def)\n apply (drule_tac d=\"ucast y\" in is_aligned_add_helper)\n apply (cut_tac x=y and 'a=32 in ucast_less)\n apply simp\n apply simp\n apply simp\n done\n\nlemma not_in_tcb_offs:\n \"\\tcb. kh0H (x && ~~ mask 9) \\ Some (KOTCB tcb)\n \\ x \\ tcb_offs_range Low_tcb_ptr\"\n \"\\tcb. kh0H (x && ~~ mask 9) \\ Some (KOTCB tcb)\n \\ x \\ tcb_offs_range High_tcb_ptr\"\n \"\\tcb. kh0H (x && ~~ mask 9) \\ Some (KOTCB tcb)\n \\ x \\ tcb_offs_range idle_tcb_ptr\"\n by (fastforce simp: s0_ptrs_aligned dest: tcb_offs_range_mask_eq)+\n\nlemma range_tcb_not_kh0H_dom:\n \"{(x && ~~ mask 9) + 1..(x && ~~ mask 9) + 2 ^ 9 - 1} \\ dom kh0H \\ {} \\ (x && ~~ mask 9) \\ High_tcb_ptr\"\n \"{(x && ~~ mask 9) + 1..(x && ~~ mask 9) + 2 ^ 9 - 1} \\ dom kh0H \\ {} \\ (x && ~~ mask 9) \\ Low_tcb_ptr\"\n \"{(x && ~~ mask 9) + 1..(x && ~~ mask 9) + 2 ^ 9 - 1} \\ dom kh0H \\ {} \\ (x && ~~ mask 9) \\ idle_tcb_ptr\"\n apply clarsimp\n apply (drule int_not_emptyD)\n apply (clarsimp simp: kh0H_dom)\n apply (subgoal_tac \"xa \\ tcb_offs_range High_tcb_ptr\")\n prefer 2\n apply (clarsimp simp: tcb_offs_range_def objBitsKO_def)\n apply (rule_tac y=\"High_tcb_ptr + 1\" in order_trans)\n apply (simp add: s0_ptr_defs)\n apply simp\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2]\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1])+)[1]\n apply (clarsimp simp: s0_ptr_defs tcb_offs_range_def)\n apply clarsimp\n apply (drule int_not_emptyD)\n apply (clarsimp simp: kh0H_dom)\n apply (subgoal_tac \"xa \\ tcb_offs_range Low_tcb_ptr\")\n prefer 2\n apply (clarsimp simp: tcb_offs_range_def objBitsKO_def)\n apply (rule_tac y=\"Low_tcb_ptr + 1\" in order_trans)\n apply (simp add: s0_ptr_defs)\n apply simp\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2]\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1])+)[1]\n apply (clarsimp simp: s0_ptr_defs tcb_offs_range_def)\n apply clarsimp\n apply (drule int_not_emptyD)\n apply (clarsimp simp: kh0H_dom)\n apply (subgoal_tac \"xa \\ tcb_offs_range idle_tcb_ptr\")\n prefer 2\n apply (clarsimp simp: tcb_offs_range_def objBitsKO_def)\n apply (rule_tac y=\"idle_tcb_ptr + 1\" in order_trans)\n apply (simp add: s0_ptr_defs)\n apply simp\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2]\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1])+)[1]\n apply (clarsimp simp: s0_ptr_defs tcb_offs_range_def)\n done\n\nlemma gt_imp_neq:\n \"x > y \\ x \\ (y::'a::order)\"\n by simp\n\nlemma map_to_ctes_kh0H:\n \"map_to_ctes kh0H =\n (option_update_range\n (\\x. if \\irq::10 word. init_irq_node_ptr + (ucast irq << cte_level_bits) = x\n then Some (CTE NullCap Null_mdb) else None) \\\n option_update_range (Low_cte_cte Low_cnode_ptr) \\\n option_update_range (High_cte_cte High_cnode_ptr) \\\n option_update_range (Silc_cte_cte Silc_cnode_ptr) \\\n option_update_range [irq_cnode_ptr \\ CTE NullCap Null_mdb] \\\n option_update_range Low_tcb_cte \\\n option_update_range High_tcb_cte \\\n option_update_range idle_tcb_cte\n ) Map.empty\"\n supply option.case_cong[cong] if_cong[cong]\n supply objBits_defs[simp]\n apply (rule ext)\n apply (case_tac \"kh0H x\")\n apply (clarsimp simp add: map_to_ctes_def Let_def objBitsKO_def)\n apply (rule conjI)\n apply clarsimp\n apply (thin_tac \"x \\ y = {}\" for x y)\n apply (frule kh0H_dom_tcb)\n apply (elim disjE)\n apply (clarsimp simp: option_update_range_def)\n apply (frule mask_in_tcb_offs_range)\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None\n | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+\n apply (rule conjI, clarsimp)\n apply (clarsimp split: option.splits)\n apply (rule conjI)\n apply (fastforce simp: tcb_cte_cases_def Low_tcb_cte_def dest: neg_mask_decompose)\n apply clarsimp\n subgoal by (fastforce simp: Low_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose)\n apply (clarsimp simp: option_update_range_def)\n apply (frule mask_in_tcb_offs_range)\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None\n | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (clarsimp split: option.splits)\n apply (rule conjI)\n apply (fastforce simp: tcb_cte_cases_def High_tcb_cte_def dest: neg_mask_decompose)\n apply clarsimp\n apply (fastforce simp: High_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose)\n apply (clarsimp simp: option_update_range_def)\n apply (frule mask_in_tcb_offs_range)\n apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq])\n apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None\n | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+\n apply (rule conjI, clarsimp)\n apply clarsimp\n apply (clarsimp split: option.splits)\n apply (rule conjI)\n apply (fastforce simp: tcb_cte_cases_def idle_tcb_cte_def dest: neg_mask_decompose)\n apply clarsimp\n apply (fastforce simp: idle_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose)\n apply (drule_tac m=\"kh0H\" in opt_None_not_dom)\n apply (rule conjI)\n apply (clarsimp simp: kh0H_dom option_update_range_def)\n apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_tcb_offs not_in_range_cte_None offs_in_range\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+)[1]\n apply (rule impI)\n apply (frule range_tcb_not_kh0H_dom(1)[simplified])\n apply (frule range_tcb_not_kh0H_dom(2)[simplified])\n apply (drule range_tcb_not_kh0H_dom(3)[simplified])\n apply (clarsimp simp: kh0H_dom split del: if_split)\n apply (clarsimp simp: option_update_range_def)\n apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_tcb_offs not_in_range_cte_None offs_in_range\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+)[1]\n apply (subst not_in_range_cte_None,\n clarsimp simp: tcb_offs_range_mask_eq s0_ptrs_aligned)+\n apply (clarsimp simp: irq_node_offs_in_range)\n apply (frule kh0H_SomeD)\n apply (elim disjE)\n apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n clarsimp,\n drule kh0H_dom_tcb,\n fastforce simp: s0_ptr_defs mask_def objBitsKO_def,\n rule impI,\n fastforce simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None)\n apply ((clarsimp simp: map_to_ctes_def Let_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n (subst is_aligned_neg_mask_eq,\n simp add: is_aligned_def s0_ptr_defs objBitsKO_def)+,\n ((clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None |\n clarsimp simp: idle_tcb_cte_def High_tcb_cte_def Low_tcb_cte_def)+)[1],\n rule impI,\n (subst(asm) is_aligned_neg_mask_eq,\n simp add: is_aligned_def s0_ptr_defs objBitsKO_def)+,\n clarsimp,\n clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom,\n rule FalseE,\n drule int_not_emptyD,\n clarsimp,\n (elim disjE, (clarsimp | drule(1) order_trans le_less_trans, fastforce)+)[1])+)[3]\n apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n clarsimp,\n drule kh0H_dom_tcb,\n fastforce simp: s0_ptr_defs mask_def objBitsKO_def,\n rule impI,\n fastforce simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None)\n apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None,\n rule impI,\n clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom is_aligned_def,\n rule FalseE,\n drule int_not_emptyD,\n clarsimp,\n (elim disjE, (clarsimp | drule(1) order_trans le_less_trans, fastforce)+)[1])\n apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split)\n apply (frule irq_node_offs_range_correct)\n apply (subst if_split_eq1)\n apply (rule conjI)\n apply (rule impI)\n apply (clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None)\n apply fastforce\n apply (rule impI)\n apply clarsimp\n apply (erule impE)\n apply (rule is_aligned_add)\n apply (simp add: is_aligned_def s0_ptr_defs objBitsKO_def)\n apply (rule is_aligned_shiftl)\n apply (clarsimp simp: objBitsKO_def cte_level_bits_def)\n apply (rule FalseE)\n apply (clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom cte_level_bits_def)\n apply (cut_tac x=irq and 'a=32 in ucast_less)\n apply simp\n apply (drule shiftl_less_t2n'[where n=4])\n apply simp\n apply simp\n apply (drule plus_one_helper[where n=\"0x3FFF\", simplified])\n apply (elim disjE)\n apply (unat_arith+)[6]\n apply (drule int_not_emptyD)\n apply clarsimp\n apply (elim disjE,\n ((clarsimp,\n drule(1) aligned_le_sharp,\n clarsimp simp: add.commute,\n subst(asm) mask_out_add_aligned[symmetric],\n simp add: is_aligned_shiftl,\n simp add: mask_def,\n drule word_leq_le_minus_one,\n subst add.commute,\n rule neq_0_no_wrap,\n erule word_plus_mono_right2[rotated],\n fastforce,\n fastforce,\n fastforce simp: add.commute)\n | unat_arith)+)[1]\n apply ((clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def objBitsKO_def split: if_split_asm split del: if_split,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None,\n (clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None | simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+,\n rule conjI,\n clarsimp,\n drule offs_range_correct,\n fastforce simp: Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def,\n rule impI,\n rule FalseE,\n clarsimp,\n drule offs_range_correct,\n clarsimp simp: Low_cte_def High_cte_def Silc_cte_def cte_level_bits_def cnode_offs_min cnode_offs_max,\n cut_tac x=\"of_bl y\" and z=\"0x10::word32\" and y=\"2 ^ 14 - 1\" in div_to_mult_word_lt,\n frule_tac 'a=32 in of_bl_length_le,\n simp,\n simp,\n drule int_not_emptyD,\n clarsimp simp: kh0H_dom s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def cte_level_bits_def,\n (elim disjE,\n (clarsimp simp: s0_ptr_defs,\n drule_tac b=\"x + y * 0x10\" and n=4 for x y in aligned_le_sharp,\n fastforce simp: is_aligned_def,\n clarsimp simp: add.commute,\n subst(asm) mask_out_add_aligned[symmetric],\n simp add: is_aligned_mult_triv2[where n=4, simplified],\n simp add: mask_def,\n drule word_leq_le_minus_one,\n subst add.commute,\n rule neq_0_no_wrap,\n erule word_plus_mono_right2[rotated],\n fastforce,\n fastforce,\n fastforce simp: add.commute | unat_arith)+)[1])+)[3]\n apply ((clarsimp simp: map_to_ctes_def Let_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n drule pd_offs_range_correct,\n clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None kh0H_obj_def,\n rule impI,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n rule FalseE,\n drule pd_offs_range_correct,\n clarsimp,\n cut_tac x=ya and 'a=32 in ucast_less,\n simp,\n drule shiftl_less_t2n'[where n=2],\n simp,\n simp,\n drule plus_one_helper[where n=\"0x3FFF\", simplified],\n drule kh0H_dom_tcb,\n (elim disjE,\n (clarsimp simp: s0_ptr_defs objBitsKO_def,\n erule notE[rotated],\n rule_tac x=\"x::word32\" for x in gt_imp_neq,\n rule less_le_trans[rotated, OF aligned_le_sharp],\n erule word_plus_mono_right2[rotated],\n simp,\n simp add: is_aligned_def,\n simp)+)[1],\n rule impI,\n clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] not_in_range_cte_None,\n ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None irq_node_offs_in_range |\n clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1])+)[3]\n by (clarsimp simp: map_to_ctes_def Let_def split del: if_split,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n drule pt_offs_range_correct,\n clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None kh0H_obj_def,\n rule impI,\n subst if_split_eq1,\n rule conjI,\n rule impI,\n rule FalseE,\n drule pt_offs_range_correct,\n clarsimp,\n cut_tac x=ya and 'a=32 in ucast_less,\n simp,\n drule shiftl_less_t2n'[where n=2],\n simp,\n simp,\n drule plus_one_helper[where n=\"0x3FF\", simplified],\n drule kh0H_dom_tcb,\n elim disjE,\n ((clarsimp simp: s0_ptr_defs objBitsKO_def,\n erule notE[rotated],\n rule_tac x=\"x::word32\" for x in gt_imp_neq,\n rule less_le_trans[rotated, OF aligned_le_sharp],\n erule word_plus_mono_right2[rotated],\n fastforce,\n fastforce simp: is_aligned_def,\n fastforce)+)[2],\n clarsimp simp: s0_ptr_defs objBitsKO_def,\n erule notE[rotated],\n rule_tac x=\"x::word32\" for x in less_imp_neq,\n rule le_less_trans[OF mask_neg_le],\n unat_arith,\n rule impI,\n clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] not_in_range_cte_None,\n ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None irq_node_offs_in_range |\n clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1])+\n\nlemma option_update_range_map_comp:\n \"option_update_range m m' = map_add m' m\"\n by (simp add: fun_eq_iff option_update_range_def map_comp_def map_add_def\n split: option.split)\n\nlemma tcb_offs_in_rangeI:\n \"\\ptr \\ ptr + x; ptr + x \\ ptr + 2 ^ 9 - 1\\ \\ ptr + x \\ tcb_offs_range ptr\"\n by (simp add: tcb_offs_range_def)\n\nlemma map_to_ctes_kh0H_simps[simp]:\n \"map_to_ctes kh0H (init_irq_node_ptr + (ucast (irq::10 word) << cte_level_bits)) =\n Some (CTE NullCap Null_mdb)\"\n \"map_to_ctes kh0H irq_cnode_ptr = Some (CTE NullCap Null_mdb)\"\n \"length x = 10 \\ map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)\"\n \"length x = 10 \\ map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)\"\n \"length x = 10 \\ map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)\"\n \"map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr\"\n \"map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)\"\n \"map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)\"\n \"map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)\"\n \"map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)\"\n \"map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr\"\n \"map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)\"\n \"map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)\"\n \"map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)\"\n \"map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)\"\n \"map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr\"\n \"map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)\"\n \"map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)\"\n \"map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)\"\n \"map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40)\"\n supply option.case_cong[cong] if_cong[cong]\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def)\n apply fastforce\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None)\n apply ((clarsimp simp: map_to_ctes_kh0H option_update_range_def cnode_offs_in_range s0_ptrs_aligned kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None,\n ((clarsimp simp: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | clarsimp simp: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1],\n intro conjI,\n (clarsimp,\n drule not_disjointI,\n (erule offs_in_range | rule offs_in_range),\n (erule offs_in_range | rule offs_in_range),\n erule notE,\n rule kh0H_dom_sets_distinct\n )+,\n clarsimp split: option.splits)+)[3]\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None split: option.splits)\n apply (cut_tac ptr=\"Low_tcb_ptr\" and x=\"0x10\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"Low_tcb_ptr\" and x=\"0x20\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"Low_tcb_ptr\" and x=\"0x30\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"Low_tcb_ptr\" and x=\"0x40\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None split: option.splits)\n apply (cut_tac ptr=\"High_tcb_ptr\" and x=\"0x10\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"High_tcb_ptr\" and x=\"0x20\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"High_tcb_ptr\" and x=\"0x30\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"High_tcb_ptr\" and x=\"0x40\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None split: option.splits)\n apply (cut_tac ptr=\"idle_tcb_ptr\" and x=\"0x10\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"idle_tcb_ptr\" and x=\"0x20\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"idle_tcb_ptr\" and x=\"0x30\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (cut_tac ptr=\"idle_tcb_ptr\" and x=\"0x40\" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs)\n apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits)\n apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None\n | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1]\n apply (intro conjI impI allI)\n apply (simp add: s0_ptr_defs)\n apply clarsimp\n apply (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n apply (clarsimp simp: kh0H_dom_distinct)\n apply clarsimp\n by (drule not_disjointI,\n rule irq_node_offs_in_range,\n assumption,\n erule notE,\n rule kh0H_dom_sets_distinct)\n\nlemma map_to_ctes_kh0H_dom:\n \"dom (map_to_ctes kh0H) =\n {idle_tcb_ptr, idle_tcb_ptr + 0x10, idle_tcb_ptr + 0x20,\n idle_tcb_ptr + 0x30, idle_tcb_ptr + 0x40,\n Low_tcb_ptr, Low_tcb_ptr + 0x10, Low_tcb_ptr + 0x20,\n Low_tcb_ptr + 0x30, Low_tcb_ptr + 0x40,\n High_tcb_ptr, High_tcb_ptr + 0x10, High_tcb_ptr + 0x20,\n High_tcb_ptr + 0x30, High_tcb_ptr + 0x40,\n irq_cnode_ptr} \\\n irq_node_offs_range \\\n cnode_offs_range Silc_cnode_ptr \\\n cnode_offs_range High_cnode_ptr \\\n cnode_offs_range Low_cnode_ptr\"\n supply option.case_cong[cong] if_cong[cong]\n apply (rule equalityI)\n apply (simp add: map_to_ctes_kh0H dom_def)\n apply clarsimp\n apply (clarsimp simp: offs_in_range option_update_range_def split: option.splits if_split_asm)\n apply (clarsimp simp: idle_tcb_cte_def)\n apply (clarsimp simp: High_tcb_cte_def)\n apply (clarsimp simp: Low_tcb_cte_def)\n apply (clarsimp simp: Silc_cte_cte_def cnode_offs_range_def split: if_split_asm)\n apply (clarsimp simp: High_cte_cte_def cnode_offs_range_def split: if_split_asm)\n apply (clarsimp simp: Low_cte_cte_def cnode_offs_range_def split: if_split_asm)\n apply (clarsimp simp: dom_def)\n apply (clarsimp simp: idle_tcb_cte_def Low_tcb_cte_def High_tcb_cte_def)\n apply (rule conjI)\n apply (fastforce dest: irq_node_offs_range_correct)\n apply (rule conjI)\n apply clarsimp\n apply (frule cnode_offs_range_correct)\n apply (clarsimp simp: Silc_cte_cte_def Silc_cte'_def Silc_capsH_def empty_cte_def cnode_offs_range_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule cnode_offs_range_correct)\n apply (clarsimp simp: High_cte_cte_def High_cte'_def High_capsH_def empty_cte_def cnode_offs_range_def)\n apply clarsimp\n apply (frule cnode_offs_range_correct)\n apply (clarsimp simp: Low_cte_cte_def Low_cte'_def Low_capsH_def empty_cte_def cnode_offs_range_def)\n done\n\nlemmas map_to_ctes_kh0H_SomeD' = set_mp[OF equalityD1[OF map_to_ctes_kh0H_dom[simplified dom_def\n]], OF CollectI, simplified, OF exI]\n\nlemma map_to_ctes_kh0H_SomeD:\n \"(map_to_ctes kh0H) x = Some y \\\n x = idle_tcb_ptr \\ y = (CTE NullCap Null_mdb) \\\n x = idle_tcb_ptr + 0x10 \\ y = (CTE NullCap Null_mdb) \\\n x = idle_tcb_ptr + 0x20 \\ y = (CTE NullCap Null_mdb) \\\n x = idle_tcb_ptr + 0x30 \\ y = (CTE NullCap Null_mdb) \\\n x = idle_tcb_ptr + 0x40 \\ y = (CTE NullCap Null_mdb) \\\n x = Low_tcb_ptr \\ y = (CTE (CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)) \\\n x = Low_tcb_ptr + 0x10 \\ y = (CTE (ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)) \\\n x = Low_tcb_ptr + 0x20 \\ y = (CTE (ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)) \\\n x = Low_tcb_ptr + 0x30 \\ y = (CTE NullCap Null_mdb) \\\n x = Low_tcb_ptr + 0x40 \\ y = (CTE NullCap Null_mdb) \\\n x = High_tcb_ptr \\ y = (CTE (CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) \\\n x = High_tcb_ptr + 0x10 \\ y = (CTE (ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) \\\n x = High_tcb_ptr + 0x20 \\ y = (CTE (ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) \\\n x = High_tcb_ptr + 0x30 \\ y = (CTE NullCap Null_mdb) \\\n x = High_tcb_ptr + 0x40 \\ y = (CTE NullCap Null_mdb) \\\n x = irq_cnode_ptr \\ y = (CTE NullCap Null_mdb) \\\n x \\ irq_node_offs_range \\ y = (CTE NullCap Null_mdb) \\\n x \\ cnode_offs_range Silc_cnode_ptr \\ Silc_cte_cte Silc_cnode_ptr x \\ None \\ y = the (Silc_cte_cte Silc_cnode_ptr x) \\\n x \\ cnode_offs_range High_cnode_ptr \\ High_cte_cte High_cnode_ptr x \\ None \\ y = the (High_cte_cte High_cnode_ptr x) \\\n x \\ cnode_offs_range Low_cnode_ptr \\ Low_cte_cte Low_cnode_ptr x \\ None \\ y = the (Low_cte_cte Low_cnode_ptr x)\"\n apply (frule map_to_ctes_kh0H_SomeD')\n apply (elim disjE)\n apply (clarsimp simp: idle_tcb_cte_def idle_tcbH_def Low_tcb_cte_def Low_tcbH_def Low_capsH_def High_tcb_cte_def High_tcbH_def High_capsH_def the_nat_to_bl_def nat_to_bl_def)+\n by (drule offs_range_correct, clarsimp simp: offs_in_range)+\n\nlemma mask_neg_add_aligned:\n \"is_aligned q n \\ p + q && ~~ mask n = (p && ~~ mask n) + q\"\n apply (subst add.commute)\n apply (simp add: mask_out_add_aligned[symmetric])\n done\n\nlemma kh_s0H[simp]:\n \"ksPSpace s0H_internal = kh0H\"\n by (simp add: s0H_internal_def)\n\nlemma pspace_distinct'_split:\n notes less_1_simp[simp del] shows\n \"(\\(y, ko) \\ graph_of (ksPSpace ks). (x \\ y \\ y + (1 << objBitsKO ko) - 1 < x)\n \\ y \\ y + (1 << objBitsKO ko) - 1)\n \\ pspace_distinct' (ks \\ksPSpace := restrict_map (ksPSpace ks) {..< x}\\)\n \\ pspace_distinct' (ks \\ksPSpace := restrict_map (ksPSpace ks) {x ..}\\)\n \\ pspace_distinct' ks\"\n apply (clarsimp simp: pspace_distinct'_def)\n apply (drule bspec, erule graph_ofI, clarsimp)\n apply (simp add: Ball_def)\n apply (drule_tac x=xa in spec)+\n apply (erule disjE)\n apply (simp add: domI)\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (simp add: ps_clear_def)\n apply (erule trans[rotated])\n apply auto[1]\n apply (clarsimp simp add: domI)\n apply (drule mp, erule(1) order_le_less_trans)\n apply (thin_tac \"P \\ Q\" for P Q)\n apply (simp add: ps_clear_def)\n apply (erule trans[rotated])\n apply auto[1]\n done\n\nlemma s0H_pspace_distinct':\n notes pdeBits_def[simp] pteBits_def[simp] objBits_defs[simp]\n shows\n \"pspace_distinct' s0H_internal\"\n supply option.case_cong[cong] if_cong[cong]\n apply (clarsimp simp: pspace_distinct'_def ps_clear_def)\n apply (rule disjointI)\n apply clarsimp\n apply (drule kh0H_SomeD)+\n by (simp | erule disjE\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1]\n | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2]\n | fastforce simp: s0_ptr_defs objBitsKO_def pageBits_def kh0H_obj_def\n | clarsimp simp: irq_node_offs_range_def objBitsKO_def s0_ptr_defs,\n drule_tac x=\"0xF\" in word_plus_strict_mono_right, fastforce, simp add: add.commute,\n drule(1) notE[rotated, OF less_trans, OF _ _ leD, rotated 2], fastforce, simp\n | clarsimp simp: pt_offs_range_def pd_offs_range_def irq_node_offs_range_def cnode_offs_range_def objBitsKO_def archObjSize_def s0_ptr_defs kh0H_obj_def,\n drule(1) aligned_le_sharp, simp add: mask_def,\n drule_tac x=\"0x3\" in word_plus_mono_right, fastforce, simp add: add.commute,\n (drule(1) notE[rotated, OF le_less_trans, OF _ _ leD, rotated 2], fastforce, simp\n | drule(2) notE[rotated, OF le_less_trans, OF _ _ leD[OF order_trans], rotated 2], fastforce, simp)\n | clarsimp simp: objBitsKO_def pageBits_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def s0_ptr_defs kh0H_obj_def,\n drule(1) notE[rotated, OF le_less_trans, OF _ _ leD, rotated 2]\n notE[rotated, OF le_less_trans, OF _ _ leD], fastforce, simp\n | (clarsimp simp: objBitsKO_def pageBits_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def s0_ptr_defs kh0H_obj_def Low_cte'_def Low_capsH_def cte_level_bits_def empty_cte_def High_cte'_def High_capsH_def Silc_cte'_def Silc_capsH_def split: if_split_asm,\n (drule(1) aligned_le_sharp, simp add: mask_def,\n drule_tac x=\"0xF\" in word_plus_mono_right, fastforce, simp add: add.commute,\n (drule(1) notE[rotated, OF le_less_trans, OF _ _ leD, rotated 2]\n notE[rotated, OF le_less_trans, OF _ _ leD], fastforce, simp\n | drule(2) notE[rotated, OF less_trans, OF _ _ leD[OF order_trans], rotated 2]\n notE[rotated, OF le_less_trans, OF _ _ leD[OF order_trans], rotated 2],\n fastforce, simp))+)[1]\n | clarsimp simp: objBitsKO_def irq_node_offs_range_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def cte_level_bits_def s0_ptr_defs,\n drule_tac x=\"0xF\" in word_plus_strict_mono_right, fastforce, simp add: add.commute,\n drule(2) notE[rotated, OF less_trans, OF _ _ leD[OF order_trans], rotated 2]\n notE[rotated, OF le_less_trans, OF _ _ leD[OF order_trans], rotated 2],\n fastforce, simp\n | (clarsimp simp: irq_node_offs_range_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def s0_ptr_defs objBitsKO_def archObjSize_def kh0H_obj_def Low_cte'_def Low_capsH_def High_cte'_def High_capsH_def Silc_cte'_def Silc_capsH_def cte_level_bits_def empty_cte_def split: if_split_asm,\n (drule(1) aligned_le_sharp, simp add: mask_neg_add_aligned, fastforce simp: mask_def)+)[1])+\n\nlemma pspace_distinctD'':\n \"\\\\v. ksPSpace s x = Some v \\ objBitsKO v = n; pspace_distinct' s\\\n \\ ps_clear x n s\"\n apply clarsimp\n apply (drule(1) pspace_distinctD')\n apply simp\n done\n\nlemma cnode_offs_min2':\n \"is_aligned ptr 14 \\ (ptr::word32) \\ ptr + 0x10 * (x && mask 10)\"\n apply (erule is_aligned_no_wrap')\n apply (subst mult.commute)\n apply (rule div_lt_mult)\n apply (cut_tac and_mask_less'[where n=10])\n apply simp\n apply simp\n apply simp\n done\n\nlemma cnode_offs_min2:\n \"Low_cnode_ptr \\ Low_cnode_ptr + 0x10 * (x && mask 10)\"\n \"High_cnode_ptr \\ High_cnode_ptr + 0x10 * (x && mask 10)\"\n \"Silc_cnode_ptr \\ Silc_cnode_ptr + 0x10 * (x && mask 10)\"\n by (simp_all add: cnode_offs_min2' s0_ptrs_aligned)\n\nlemma cnode_offs_max2':\n \"is_aligned ptr 14 \\ (ptr::word32) + 0x10 * (x && mask 10) \\ ptr + 0x3fff\"\n apply (rule word_plus_mono_right)\n apply (subst mult.commute)\n apply (rule div_to_mult_word_lt)\n apply simp\n apply (rule plus_one_helper)\n apply simp\n apply (cut_tac and_mask_less'[where n=10])\n apply simp\n apply simp\n apply (drule is_aligned_no_overflow)\n apply (simp add: add.commute)\n done\n\nlemma cnode_offs_max2:\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ Low_cnode_ptr + 0x3fff\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ High_cnode_ptr + 0x3fff\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ Silc_cnode_ptr + 0x3fff\"\n by (simp_all add: cnode_offs_max2' s0_ptrs_aligned)\n\nlemma cnode_offs_in_range2':\n \"\\is_aligned ptr 14\\ \\\n ptr + 0x10 * (x && mask 10) \\ cnode_offs_range ptr\"\n apply (clarsimp simp: cnode_offs_min2' cnode_offs_max2' cnode_offs_range_def add.commute cte_level_bits_def)\n apply (rule is_aligned_add)\n apply (erule is_aligned_weaken)\n apply simp\n apply (rule_tac is_aligned_mult_triv1[where n=4, simplified])\n done\n\nlemma cnode_offs_in_range2:\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ cnode_offs_range Silc_cnode_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ cnode_offs_range Low_cnode_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ cnode_offs_range High_cnode_ptr\"\n by (simp_all add: cnode_offs_in_range2' s0_ptrs_aligned)+\n\nlemma kh0H_dom_distinct2:\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ init_globals_frame\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ idle_tcb_ptr\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ High_tcb_ptr\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ Low_tcb_ptr\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ irq_cnode_ptr\"\n \"Silc_cnode_ptr + 0x10 * (x && mask 10) \\ ntfn_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ init_globals_frame\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ idle_tcb_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ High_tcb_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ Low_tcb_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ irq_cnode_ptr\"\n \"Low_cnode_ptr + 0x10 * (x && mask 10) \\ ntfn_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ init_globals_frame\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ idle_tcb_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ High_tcb_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ Low_tcb_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ irq_cnode_ptr\"\n \"High_cnode_ptr + 0x10 * (x && mask 10) \\ ntfn_ptr\"\n by (cut_tac x=x in cnode_offs_in_range2(1), fastforce simp: kh0H_dom_distinct\n | cut_tac x=x in cnode_offs_in_range2(2), fastforce simp: kh0H_dom_distinct\n | cut_tac x=x in cnode_offs_in_range2(3), fastforce simp: kh0H_dom_distinct)+\n\nlemma kh0H_cnode_simps2[simp]:\n \"kh0H (Low_cnode_ptr + 0x10 * (x && mask 10)) = Low_cte Low_cnode_ptr (Low_cnode_ptr + 0x10 * (x && mask 10))\"\n \"kh0H (High_cnode_ptr + 0x10 * (x && mask 10)) = High_cte High_cnode_ptr (High_cnode_ptr + 0x10 * (x && mask 10))\"\n \"kh0H (Silc_cnode_ptr + 0x10 * (x && mask 10)) = Silc_cte Silc_cnode_ptr (Silc_cnode_ptr + 0x10 * (x && mask 10))\"\n supply option.case_cong[cong] if_cong[cong]\n by (clarsimp simp: kh0H_def option_update_range_def cnode_offs_in_range' s0_ptrs_aligned kh0H_dom_distinct kh0H_dom_distinct2 not_in_range_None,\n ((clarsimp simp: cnode_offs_in_range2 kh0H_dom_sets_distinct[THEN orthD1] not_in_range_None\n | clarsimp simp: cnode_offs_in_range2 kh0H_dom_sets_distinct[THEN orthD2] not_in_range_None)+),\n intro conjI,\n (clarsimp,\n drule not_disjointI,\n (rule irq_node_offs_in_range cnode_offs_in_range2 | erule offs_in_range),\n (rule irq_node_offs_in_range cnode_offs_in_range2 | erule offs_in_range),\n erule notE,\n rule kh0H_dom_sets_distinct\n )+,\n clarsimp split: option.splits)+\n\nlemma cnode_offs_aligned2:\n \"is_aligned (Low_cnode_ptr + 0x10 * (addr && mask 10)) 4\"\n \"is_aligned (High_cnode_ptr + 0x10 * (addr && mask 10)) 4\"\n \"is_aligned (Silc_cnode_ptr + 0x10 * (addr && mask 10)) 4\"\n by (rule is_aligned_add,\n rule is_aligned_weaken,\n rule s0_ptrs_aligned,\n simp,\n rule is_aligned_mult_triv1[where n=4, simplified])+\n\nlemma less_t2n_ex_ucast:\n \"\\(x::'a::len word) < 2 ^ n; len_of TYPE('b) = n\\ \\ \\y. x = ucast (y::'b::len word)\"\n apply (rule_tac x=\"ucast x\" in exI)\n apply (rule ucast_ucast_len[symmetric])\n apply simp\n done\n\nlemma pd_offs_aligned:\n \"is_aligned (Low_pd_ptr + (ucast (x::12 word) << 2)) 2\"\n \"is_aligned (High_pd_ptr + (ucast (x::12 word) << 2)) 2\"\n by (rule is_aligned_add[OF _ is_aligned_shift], simp add: s0_ptr_defs is_aligned_def)+\n\nlemma valid_caps_s0H[simp]:\n notes pdeBits_def[simp] objBits_defs[simp]\n shows\n \"valid_cap' NullCap s0H_internal\"\n \"valid_cap' (ThreadCap Low_tcb_ptr) s0H_internal\"\n \"valid_cap' (ThreadCap High_tcb_ptr) s0H_internal\"\n \"valid_cap' (CNodeCap Low_cnode_ptr 10 2 10) s0H_internal\"\n \"valid_cap' (CNodeCap High_cnode_ptr 10 2 10) s0H_internal\"\n \"valid_cap' (CNodeCap Silc_cnode_ptr 10 2 10) s0H_internal\"\n \"valid_cap' (ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))) s0H_internal\"\n \"valid_cap' (ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))) s0H_internal\"\n \"valid_cap' (NotificationCap ntfn_ptr 0 True False) s0H_internal\"\n \"valid_cap' (NotificationCap ntfn_ptr 0 False True) s0H_internal\"\n \"valid_cap' (ReplyCap Low_tcb_ptr True True) s0H_internal\"\n \"valid_cap' (ReplyCap High_tcb_ptr True True) s0H_internal\"\n supply option.case_cong[cong] if_cong[cong]\n apply (simp\n | simp add: valid_cap'_def s0H_internal_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject,\n intro conjI,\n simp add: objBitsKO_def s0_ptrs_aligned,\n simp add: objBitsKO_def,\n simp add: objBitsKO_def s0_ptrs_aligned mask_def,\n rule pspace_distinctD'[OF _ s0H_pspace_distinct', simplified s0H_internal_def],\n simp)+\n apply (simp add: valid_cap'_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject)\n apply (intro conjI)\n apply (simp add: objBitsKO_def s0_ptrs_aligned)\n apply (simp add: objBitsKO_def)\n apply (simp add: objBitsKO_def s0_ptrs_aligned mask_def)\n apply (clarsimp simp: Low_cte_def Low_cte'_def Low_capsH_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def empty_cte_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified cte_level_bits_def])\n apply (simp add: Low_cte_def Low_cte'_def Low_capsH_def empty_cte_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject)\n apply (intro conjI)\n apply (simp add: objBitsKO_def s0_ptrs_aligned)\n apply (simp add: objBitsKO_def)\n apply (simp add: objBitsKO_def s0_ptrs_aligned mask_def)\n apply (clarsimp simp: High_cte_def High_cte'_def High_capsH_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def empty_cte_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified cte_level_bits_def])\n apply (simp add: High_cte_def High_cte'_def High_capsH_def empty_cte_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject)\n apply (intro conjI)\n apply (simp add: objBitsKO_def s0_ptrs_aligned)\n apply (simp add: objBitsKO_def)\n apply (simp add: objBitsKO_def s0_ptrs_aligned mask_def)\n apply (clarsimp simp: Silc_cte_def Silc_cte'_def Silc_capsH_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def empty_cte_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified cte_level_bits_def])\n apply (simp add: Silc_cte_def Silc_cte'_def Silc_capsH_def empty_cte_def cnode_offs_min2 cnode_offs_max2 cnode_offs_aligned2 add.commute s0_ptrs_aligned cte_level_bits_def objBitsKO_def)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def Low_asid_def asid_low_bits_def asid_bits_def s0_ptrs_aligned page_directory_at'_def pdBits_def pageBits_def)\n apply (clarsimp simp: typ_at'_def ko_wp_at'_def)\n apply (drule less_t2n_ex_ucast[where n=12 and 'b=12, simplified])\n apply (clarsimp simp: Low_pdH_def pd_offs_aligned pd_offs_min pd_offs_max s0_ptrs_aligned add.commute objBitsKO_def archObjSize_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct'])\n apply (simp add: Low_pdH_def pd_offs_aligned pd_offs_min pd_offs_max s0_ptrs_aligned objBitsKO_def archObjSize_def add.commute)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def High_asid_def asid_low_bits_def asid_bits_def s0_ptrs_aligned page_directory_at'_def pdBits_def pageBits_def)\n apply (clarsimp simp: typ_at'_def ko_wp_at'_def)\n apply (drule less_t2n_ex_ucast[where n=12 and 'b=12, simplified])\n apply (clarsimp simp: High_pdH_def pd_offs_aligned pd_offs_min pd_offs_max s0_ptrs_aligned add.commute objBitsKO_def archObjSize_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct'])\n apply (simp add: High_pdH_def pd_offs_aligned pd_offs_min pd_offs_max s0_ptrs_aligned objBitsKO_def archObjSize_def add.commute)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject Low_asid_def asid_low_bits_def asid_bits_def objBitsKO_def ntfnH_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified])\n apply (simp add: ntfnH_def objBitsKO_def)\n apply (simp add: valid_cap'_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject Low_asid_def asid_low_bits_def asid_bits_def objBitsKO_def ntfnH_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct'])\n apply (simp add: ntfnH_def objBitsKO_def)\n by (simp\n | simp add: valid_cap'_def s0H_internal_def capAligned_def word_bits_def objBits_def s0_ptrs_aligned obj_at'_def projectKO_eq project_inject Low_asid_def asid_low_bits_def asid_bits_def,\n intro conjI,\n simp add: objBitsKO_def s0_ptrs_aligned,\n simp add: objBitsKO_def,\n simp add: objBitsKO_def s0_ptrs_aligned mask_def,\n rule pspace_distinctD'[OF _ s0H_pspace_distinct', simplified s0H_internal_def],\n simp)+\n\ntext \\We can only instantiate our example state (featuring high and low domains) if the number\n of configured domains is > 1, i.e. that maxDomain is 1 or greater. When seL4 is configured for a\n single domain only, none of the state instantiation proofs below are relevant.\\\n\nlemma s0H_valid_objs':\n \"1 \\ maxDomain \\ valid_objs' s0H_internal\"\n supply objBits_defs[simp]\n apply (clarsimp simp: valid_objs'_def ran_def)\n apply (drule kh0H_SomeD)\n apply (elim disjE)\n apply clarsimp\n apply (clarsimp simp: valid_obj'_def valid_tcb'_def kh0H_obj_def valid_tcb_state'_def\n default_domain_def minBound_word\n default_priority_def tcb_cte_cases_def)\n apply (clarsimp simp: valid_obj'_def valid_tcb'_def kh0H_obj_def valid_tcb_state'_def\n High_domain_def minBound_word\n High_mcp_def High_prio_def maxPriority_def numPriorities_def\n tcb_cte_cases_def High_capsH_def obj_at'_def projectKO_eq\n project_inject)\n apply (rule conjI)\n apply (simp add: is_aligned_def s0_ptr_defs objBitsKO_def)\n apply (rule pspace_distinctD'[OF _ s0H_pspace_distinct'])\n apply (simp add: ntfnH_def)\n apply (clarsimp simp: valid_obj'_def valid_tcb'_def kh0H_obj_def valid_tcb_state'_def\n Low_domain_def minBound_word\n Low_mcp_def Low_prio_def maxPriority_def numPriorities_def\n tcb_cte_cases_def Low_capsH_def)\n apply (clarsimp simp: valid_obj'_def ntfnH_def valid_ntfn'_def obj_at'_def projectKO_eq\n project_inject)\n apply (rule conjI)\n apply (clarsimp simp: is_aligned_def s0_ptr_defs objBitsKO_def)\n apply (rule pspace_distinctD'[OF _ s0H_pspace_distinct'])\n apply simp\n apply (clarsimp simp: valid_obj'_def irq_cte_def valid_cte'_def)\n apply (clarsimp simp: valid_obj'_def valid_cte'_def)\n apply (clarsimp simp: valid_obj'_def Low_cte_def Low_cte'_def Low_capsH_def empty_cte_def\n valid_cte'_def\n split: if_split_asm)\n apply (clarsimp simp: valid_obj'_def High_cte_def High_cte'_def High_capsH_def empty_cte_def\n valid_cte'_def\n split: if_split_asm)\n apply (clarsimp simp: valid_obj'_def Silc_cte_def Silc_cte'_def Silc_capsH_def empty_cte_def\n valid_cte'_def\n split: if_split_asm)\n apply (clarsimp simp: valid_obj'_def global_pdH'_def valid_mapping'_def s0_ptr_defs\n split: if_split_asm)\n apply (rule is_aligned_addrFromPPtr_n; clarsimp simp: is_aligned_def)\n apply (clarsimp simp: valid_obj'_def High_pdH_def High_pd'H_def valid_mapping'_def s0_ptr_defs\n ptBits_def pteBits_def\n split: if_split_asm)\n apply (intro conjI impI; rule is_aligned_addrFromPPtr_n; clarsimp simp: is_aligned_def)\n apply (clarsimp simp: valid_obj'_def Low_pdH_def Low_pd'H_def valid_mapping'_def s0_ptr_defs\n ptBits_def pteBits_def\n split: if_split_asm)\n apply (intro conjI impI; rule is_aligned_addrFromPPtr_n; clarsimp simp: is_aligned_def)\n apply (clarsimp simp: valid_obj'_def High_ptH_def High_pt'H_def valid_mapping'_def s0_ptr_defs\n ptBits_def pteBits_def shared_page_ptr_phys_def\n split: if_split_asm)\n apply (rule is_aligned_addrFromPPtr_n; clarsimp simp: is_aligned_def)\n apply (clarsimp simp: valid_obj'_def Low_ptH_def Low_pt'H_def valid_mapping'_def s0_ptr_defs\n ptBits_def pteBits_def shared_page_ptr_phys_def\n split: if_split_asm)\n apply (rule is_aligned_addrFromPPtr_n; clarsimp simp: is_aligned_def)\n done\n\nlemmas the_nat_to_bl_simps =\n the_nat_to_bl_def nat_to_bl_def\n\nlemma ucast_shiftr_13E:\n \"\\ucast (p - ptr >> 4) = (0x13E::10 word); p \\ 0x3FFF + ptr; ptr \\ p;\n is_aligned ptr 14; is_aligned p 4\\\n \\ p = (ptr::word32) + 0x13E0\"\n apply (subst(asm) up_ucast_inj_eq[symmetric, where 'b=32])\n apply simp\n apply simp\n apply (subst(asm) ucast_ucast_len)\n apply simp\n apply (rule shiftr_less_t2n[where m=10, simplified])\n apply simp\n apply (rule word_leq_minus_one_le)\n apply simp\n apply simp\n apply (rule word_diff_ls')\n apply simp\n apply simp\n apply (drule shiftr_eqD[where y=\"0x13E0\" and n=4 and 'a=32, simplified])\n apply (erule(1) aligned_sub_aligned[OF _ is_aligned_weaken])\n apply simp\n apply simp\n apply (simp add: is_aligned_def)\n apply (simp add: diff_eq_eq)\n done\n\nlemma ucast_shiftr_3:\n \"\\ucast (p - ptr >> 4) = (3::10 word); p \\ 0x3FFF + ptr; ptr \\ p;\n is_aligned ptr 14; is_aligned p 4\\\n \\ p = (ptr::word32) + 0x30\"\n apply (subst(asm) up_ucast_inj_eq[symmetric, where 'b=32])\n apply simp\n apply simp\n apply (subst(asm) ucast_ucast_len)\n apply simp\n apply (rule shiftr_less_t2n[where m=10, simplified])\n apply simp\n apply (rule word_leq_minus_one_le)\n apply simp\n apply simp\n apply (rule word_diff_ls')\n apply simp\n apply simp\n apply (drule shiftr_eqD[where y=\"0x30\" and n=4 and 'a=32, simplified])\n apply (erule(1) aligned_sub_aligned[OF _ is_aligned_weaken])\n apply simp\n apply simp\n apply (simp add: is_aligned_def)\n apply (simp add: diff_eq_eq)\n done\n\nlemma ucast_shiftr_2:\n \"\\ucast (p - ptr >> 4) = (2::10 word); p \\ 0x3FFF + ptr; ptr \\ p;\n is_aligned ptr 14; is_aligned p 4\\\n \\ p = (ptr::word32) + 0x20\"\n apply (subst(asm) up_ucast_inj_eq[symmetric, where 'b=32])\n apply simp\n apply simp\n apply (subst(asm) ucast_ucast_len)\n apply simp\n apply (rule shiftr_less_t2n[where m=10, simplified])\n apply simp\n apply (rule word_leq_minus_one_le)\n apply simp\n apply simp\n apply (rule word_diff_ls')\n apply simp\n apply simp\n apply (drule shiftr_eqD[where y=\"0x20\" and n=4 and 'a=32, simplified])\n apply (erule(1) aligned_sub_aligned[OF _ is_aligned_weaken])\n apply simp\n apply simp\n apply (simp add: is_aligned_def)\n apply (simp add: diff_eq_eq)\n done\n\nlemma ucast_shiftr_1:\n \"\\ucast (p - ptr >> 4) = (1::10 word); p \\ 0x3FFF + ptr; ptr \\ p;\n is_aligned ptr 14; is_aligned p 4\\\n \\ p = (ptr::word32) + 0x10\"\n apply (subst(asm) up_ucast_inj_eq[symmetric, where 'b=32])\n apply simp\n apply simp\n apply (subst(asm) ucast_ucast_len)\n apply simp\n apply (rule shiftr_less_t2n[where m=10, simplified])\n apply simp\n apply (rule word_leq_minus_one_le)\n apply simp\n apply simp\n apply (rule word_diff_ls')\n apply simp\n apply simp\n apply (drule shiftr_eqD[where y=\"0x10\" and n=4 and 'a=32, simplified])\n apply (erule(1) aligned_sub_aligned[OF _ is_aligned_weaken])\n apply simp\n apply simp\n apply (simp add: is_aligned_def)\n apply (simp add: diff_eq_eq)\n done\n\nlemmas kh0H_all_obj_def' = kh0H_all_obj_def Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def Low_tcb_cte_def High_tcb_cte_def idle_tcb_cte_def\n\nlemma map_to_ctes_kh0H_simps'[simp]:\n \"map_to_ctes kh0H (Low_cnode_ptr + 0x13E0) = Some\n (CTE (NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\"\n \"map_to_ctes kh0H (Low_cnode_ptr + 0x30) = Some\n (CTE (ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid)))\n (MDB 0 (Low_tcb_ptr + 0x10) False False))\"\n \"map_to_ctes kh0H (Low_cnode_ptr + 0x20) = Some\n (CTE (CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False))\"\n \"map_to_ctes kh0H (Low_cnode_ptr + 0x10) = Some (CTE (ThreadCap Low_tcb_ptr) Null_mdb)\"\n \"map_to_ctes kh0H (High_cnode_ptr + 0x13E0) = Some\n (CTE (NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False))\"\n \"map_to_ctes kh0H (High_cnode_ptr + 0x30) = Some\n (CTE (ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid)))\n (MDB 0 (High_tcb_ptr + 0x10) False False))\"\n \"map_to_ctes kh0H (High_cnode_ptr + 0x20) = Some\n (CTE (CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False))\"\n \"map_to_ctes kh0H (High_cnode_ptr + 0x10) = Some (CTE (ThreadCap High_tcb_ptr) Null_mdb)\"\n \"map_to_ctes kh0H (Silc_cnode_ptr + 0x13E0) = Some\n (CTE (NotificationCap ntfn_ptr 0 True False)\n (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\"\n \"map_to_ctes kh0H (Silc_cnode_ptr + 0x20) = Some\n (CTE (CNodeCap Silc_cnode_ptr 10 2 10) Null_mdb)\"\n apply (clarsimp simp: map_to_ctes_kh0H_simps(3)[where x=\"the_nat_to_bl_10 318\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(3)[where x=\"the_nat_to_bl_10 3\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(3)[where x=\"the_nat_to_bl_10 2\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(3)[where x=\"the_nat_to_bl_10 1\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(4)[where x=\"the_nat_to_bl_10 318\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(4)[where x=\"the_nat_to_bl_10 3\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(4)[where x=\"the_nat_to_bl_10 2\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(4)[where x=\"the_nat_to_bl_10 1\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(5)[where x=\"the_nat_to_bl_10 318\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n apply (clarsimp simp: map_to_ctes_kh0H_simps(5)[where x=\"the_nat_to_bl_10 2\", simplified the_nat_to_bl_simps, simplified] kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps, fastforce simp: s0_ptr_defs is_aligned_def)\n done\n\nlemma mdb_next_s0H:\n \"p' \\ 0 \\ map_to_ctes kh0H \\ p \\ p' =\n (p = Low_cnode_ptr + 0x13E0 \\ p' = Silc_cnode_ptr + 0x13E0 \\\n p = Silc_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0 \\\n p = Low_tcb_ptr \\ p' = Low_cnode_ptr + 0x20 \\\n p = Low_tcb_ptr + 0x10 \\ p' = Low_cnode_ptr + 0x30 \\\n p = High_tcb_ptr \\ p' = High_cnode_ptr + 0x20 \\\n p = High_tcb_ptr + 0x10 \\ p' = High_cnode_ptr + 0x30)\"\n apply (rule iffI)\n apply (simp add: next_unfold')\n apply (elim exE conjE)\n apply (frule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: next_unfold' map_to_ctes_kh0H_dom)\n apply (elim disjE, simp_all add: kh0H_all_obj_def')\n done\n\nlemma mdb_prev_s0H:\n \"p \\ 0 \\ map_to_ctes kh0H \\ p \\ p' =\n (p = Low_cnode_ptr + 0x13E0 \\ p' = Silc_cnode_ptr + 0x13E0 \\\n p = Silc_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0 \\\n p = Low_tcb_ptr \\ p' = Low_cnode_ptr + 0x20 \\\n p = Low_tcb_ptr + 0x10 \\ p' = Low_cnode_ptr + 0x30 \\\n p = High_tcb_ptr \\ p' = High_cnode_ptr + 0x20 \\\n p = High_tcb_ptr + 0x10 \\ p' = High_cnode_ptr + 0x30)\"\n apply (rule iffI)\n apply (simp add: mdb_prev_def)\n apply (elim exE conjE)\n apply (frule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all)[1]\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E ucast_shiftr_3 ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' to_bl_use_of_bl the_nat_to_bl_simps cte_level_bits_def ucast_shiftr_13E ucast_shiftr_3 ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: mdb_prev_def map_to_ctes_kh0H_dom)\n apply (elim disjE, simp_all add: kh0H_all_obj_def')\n done\n\nlemma mdb_next_trancl_s0H:\n \"p' \\ 0 \\ map_to_ctes kh0H \\ p \\\\<^sup>+ p' =\n (p = Low_cnode_ptr + 0x13E0 \\ p' = Silc_cnode_ptr + 0x13E0 \\\n p = Silc_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0 \\\n p = Low_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0 \\\n p = Low_tcb_ptr \\ p' = Low_cnode_ptr + 0x20 \\\n p = Low_tcb_ptr + 0x10 \\ p' = Low_cnode_ptr + 0x30 \\\n p = High_tcb_ptr \\ p' = High_cnode_ptr + 0x20 \\\n p = High_tcb_ptr + 0x10 \\ p' = High_cnode_ptr + 0x30)\"\n apply (rule iffI)\n apply (erule converse_trancl_induct)\n apply (clarsimp simp: mdb_next_s0H)\n apply (elim disjE, simp_all add: mdb_next_s0H s0_ptr_defs)[1]\n apply (elim disjE)\n apply (rule r_into_trancl, simp add: mdb_next_s0H)\n apply (rule r_into_trancl, simp add: mdb_next_s0H)\n apply (rule r_r_into_trancl[where b=\"Silc_cnode_ptr + 0x13E0\"])\n apply (simp add: mdb_next_s0H s0_ptr_defs)\n apply (simp add: mdb_next_s0H)\n apply (rule r_into_trancl, simp add: mdb_next_s0H)+\n done\n\nlemma mdb_next_rtrancl_not_0_s0H:\n \"\\map_to_ctes kh0H \\ p \\\\<^sup>* p'; p' \\ 0\\ \\ p \\ 0\"\n apply (drule rtranclD)\n apply clarsimp\n apply (simp add: mdb_next_trancl_s0H s0_ptr_defs)\n done\n\nlemma sameRegionAs_s0H:\n \"\\map_to_ctes kh0H p = Some (CTE cap mdb); map_to_ctes kh0H p' = Some (CTE cap' mdb');\n sameRegionAs cap cap'; p \\ p'\\\n \\ (p = Low_cnode_ptr + 0x13E0 \\\n (p' = Silc_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0) \\\n p = Silc_cnode_ptr + 0x13E0 \\\n (p' = Low_cnode_ptr + 0x13E0 \\ p' = High_cnode_ptr + 0x13E0) \\\n p = High_cnode_ptr + 0x13E0 \\\n (p' = Low_cnode_ptr + 0x13E0 \\ p' = Silc_cnode_ptr + 0x13E0) \\\n p = Low_tcb_ptr \\ p' = Low_cnode_ptr + 0x20 \\\n p = Low_cnode_ptr + 0x20 \\ p' = Low_tcb_ptr \\\n p = Low_tcb_ptr + 0x10 \\ p' = Low_cnode_ptr + 0x30 \\\n p = Low_cnode_ptr + 0x30 \\ p' = Low_tcb_ptr + 0x10 \\\n p = High_tcb_ptr \\ p' = High_cnode_ptr + 0x20 \\\n p = High_cnode_ptr + 0x20 \\ p' = High_tcb_ptr \\\n p = High_tcb_ptr + 0x10 \\ p' = High_cnode_ptr + 0x30 \\\n p = High_cnode_ptr + 0x30 \\ p' = High_tcb_ptr + 0x10)\"\n supply option.case_cong[cong] if_cong[cong]\n apply (frule_tac x=p in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (simp add: s0_ptr_defs)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def ARM_H.sameRegionAs_def isCap_simps)[1]\n apply (simp add: s0_ptr_defs)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: ARM_H.sameRegionAs_def isCap_simps kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (simp add: s0_ptr_defs)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def ARM_H.sameRegionAs_def isCap_simps)[1]\n apply (simp add: s0_ptr_defs)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: ARM_H.sameRegionAs_def isCap_simps kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def ARM_H.sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps s0_ptrs_aligned ARM_H.sameRegionAs_def isCap_simps split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' s0_ptr_defs split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_1)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_1)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_13E s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_13E)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def ARM_H.sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned ARM_H.sameRegionAs_def isCap_simps split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_3 s0_ptrs_aligned split: if_split_asm)\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_3)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_2 s0_ptrs_aligned split: if_split_asm)\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_2)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: sameRegionAs_def isCap_simps)[1]\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_1 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_1 s0_ptrs_aligned split: if_split_asm)\n apply (clarsimp simp: kh0H_all_obj_def' cte_level_bits_def to_bl_use_of_bl the_nat_to_bl_simps ucast_shiftr_1 s0_ptrs_aligned split: if_split_asm)\n apply (drule(2) ucast_shiftr_1)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply (drule(2) ucast_shiftr_1)\n apply (rule s0_ptrs_aligned)\n apply simp\n apply clarsimp\n done\n\nlemma mdb_prevI:\n \"m p = Some c \\ m \\ mdbPrev (cteMDBNode c) \\ p\"\n by (simp add: mdb_prev_def)\n\nlemma mdb_nextI:\n \"m p = Some c \\ m \\ p \\ mdbNext (cteMDBNode c)\"\n by (simp add: mdb_next_unfold)\n\nlemma s0H_valid_pspace':\n notes pdeBits_def[simp] pteBits_def[simp] objBits_defs[simp]\n assumes \"1 \\ maxDomain\"\n shows \"valid_pspace' s0H_internal\"\n using assms\n supply option.case_cong[cong] if_cong[cong]\n apply (clarsimp simp: valid_pspace'_def s0H_pspace_distinct' s0H_valid_objs')\n apply (intro conjI)\n apply (clarsimp simp: pspace_aligned'_def)\n apply (drule kh0H_SomeD)\n apply (elim disjE, simp_all add: s0_ptr_defs is_aligned_def kh0H_all_obj_def objBitsKO_def pageBits_def archObjSize_def irq_node_offs_range_def cte_level_bits_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def)[1]\n apply (clarsimp simp: no_0_obj'_def)\n apply (rule ccontr)\n apply clarsimp\n apply (drule kh0H_SomeD)\n apply (simp add: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def)\n apply (simp add: valid_mdb'_def)\n apply (clarsimp simp: valid_mdb_ctes_def)\n apply (intro conjI)\n apply (clarsimp simp: valid_dlist_def3)\n apply (rule conjI)\n apply (clarsimp simp: mdb_next_s0H)\n apply (subst mdb_prev_s0H)\n apply (fastforce simp: s0_ptr_defs)\n apply simp\n apply (clarsimp simp: mdb_prev_s0H)\n apply (subst mdb_next_s0H)\n apply (fastforce simp: s0_ptr_defs)\n apply simp\n apply (clarsimp simp: no_0_def)\n apply (rule ccontr)\n apply clarsimp\n apply (drule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def)+)[1]\n apply (clarsimp simp: mdb_chain_0_def)\n apply (frule map_to_ctes_kh0H_SomeD)\n apply (elim disjE)\n apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5]\n apply (rule r_r_into_trancl)\n apply (erule next_fold)\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply (rule r_r_into_trancl)\n apply (erule next_fold)\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[3]\n apply (rule r_r_into_trancl)\n apply (erule next_fold)\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply (rule r_r_into_trancl)\n apply (erule next_fold)\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5]\n apply (clarsimp simp: Silc_cte_cte_def cnode_offs_range_def Silc_cte'_def Silc_capsH_def empty_cte_def split: if_split_asm)\n apply (rule r_r_into_trancl)\n apply (erule next_fold)\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply (erule r_into_trancl[OF next_fold], simp)\n apply (erule r_into_trancl[OF next_fold], simp)\n apply (clarsimp simp: High_cte_cte_def cnode_offs_range_def High_cte'_def High_capsH_def empty_cte_def split: if_split_asm)\n apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5]\n apply (clarsimp simp: Low_cte_cte_def cnode_offs_range_def Low_cte'_def Low_capsH_def empty_cte_def split: if_split_asm)\n apply (rule trancl_into_trancl2)\n apply (erule next_fold)\n apply simp\n apply (rule r_r_into_trancl)\n apply (rule next_fold)\n apply simp\n apply simp\n apply (rule next_fold)\n apply simp\n apply simp\n apply (erule r_into_trancl[OF next_fold], simp)+\n apply (clarsimp simp: valid_badges_def)\n apply (frule_tac x=p in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: kh0H_all_obj_def Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def isCap_simps cnode_offs_range_def split: if_split_asm)+)[1]\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: kh0H_all_obj_def Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def isCap_simps cnode_offs_range_def sameRegionAs_def split: if_split_asm)+)[1]\n apply (intro conjI impI)\n apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm)\n apply (drule(1) sameRegion_ntfn)\n apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: kh0H_all_obj_def High_cte_cte_def Low_cte_cte_def Silc_cte_cte_def split: if_split_asm)+)[1]\n apply (intro conjI impI)\n apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm)\n apply (drule(1) sameRegion_ntfn)\n apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm)\n apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: kh0H_all_obj_def High_cte_cte_def Low_cte_cte_def Silc_cte_cte_def split: if_split_asm)+)[1]\n apply (clarsimp simp: caps_contained'_def)\n apply (drule_tac x=p in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: Silc_cte_cte_def kh0H_all_obj_def split: if_split_asm)\n apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def split: if_split_asm)\n apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def split: if_split_asm)\n apply (clarsimp simp: mdb_chunked_def)\n apply (frule(3) sameRegionAs_s0H)\n apply (clarsimp simp: conj_disj_distribL)\n apply (subst mdb_next_trancl_s0H, fastforce simp: s0_ptr_defs)+\n apply (elim disjE, simp_all)[1]\n apply (((rule conjI[rotated], fastforce simp: s0_ptr_defs\n | simp only: conj_assoc[symmetric], rule conjI, fastforce simp: s0_ptr_defs),\n clarsimp simp: is_chunk_def,\n drule mdb_next_rtrancl_not_0_s0H, fastforce simp: s0_ptr_defs,\n clarsimp simp: mdb_next_trancl_s0H,\n (elim disjE, simp_all add: sameRegionAs_def isCap_simps kh0H_all_obj_def',\n (fastforce simp: s0_ptr_defs)+)[1])+)[14]\n apply (clarsimp simp: untyped_mdb'_def)\n apply (drule_tac x=p in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: untyped_inc'_def)\n apply (rule FalseE)\n apply (drule_tac x=p in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: valid_nullcaps_def)\n apply (drule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: kh0H_all_obj_def' nullMDBNode_def)\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: ut_revocable'_def)\n apply (drule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: class_links_def)\n apply (subst(asm) mdb_next_s0H)\n apply (drule_tac x=p' in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, (clarsimp simp: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def)+)[1]\n apply (elim disjE, (clarsimp simp: kh0H_all_obj_def')+)[1]\n apply (clarsimp simp: distinct_zombies_def distinct_zombie_caps_def)\n apply (drule_tac x=ptr in map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: irq_control_def)\n apply (drule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (clarsimp simp: reply_masters_rvk_fb_def ran_def)\n apply (frule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n done\n\nend\n\n(* Instantiate the current, abstract domain scheduler into the\n concrete scheduler required for this example *)\naxiomatization where\n newKSDomSched: \"newKSDomSchedule = [(0,0xA), (1, 0xA)]\"\n\naxiomatization where\n newKSDomainTime: \"newKSDomainTime = 5\"\n\n(* kernel_data_refs is an undefined constant at the moment, and therefore\n cannot be referred to in valid_global_refs' and pspace_domain_valid.\n We use an axiomatization for the moment. *)\naxiomatization where\n kdr_valid_global_refs': \"valid_global_refs' s0H_internal\" and\n kdr_pspace_domain_valid: \"pspace_domain_valid s0H_internal\"\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma s0H_invs:\n assumes \"1 \\ maxDomain\"\n notes pdeBits_def[simp] pteBits_def[simp] objBits_defs[simp]\n shows \"invs' s0H_internal\"\n using assms\n supply option.case_cong[cong] if_cong[cong]\n apply (clarsimp simp: invs'_def valid_state'_def s0H_valid_pspace')\n apply (rule conjI)\n apply (clarsimp simp: sch_act_wf_def s0H_internal_def ct_in_state'_def st_tcb_at'_def obj_at'_def projectKO_eq project_inject objBitsKO_def s0_ptrs_aligned Low_tcbH_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_queues_def valid_queues_no_bitmap_def bitmapQ_defs s0H_internal_def)\n apply (rule conjI)\n apply (clarsimp simp: sym_refs_def state_refs_of'_def refs_of'_def split: option.splits)\n apply (frule kh0H_SomeD)\n apply (elim disjE, simp_all)[1]\n apply (clarsimp simp: tcb_st_refs_of'_def idle_tcbH_def)\n apply (clarsimp simp: tcb_st_refs_of'_def High_tcbH_def)\n apply (rule conjI)\n apply (clarsimp simp: ntfnH_def)\n apply (clarsimp simp: objBitsKO_def ntfnH_def)\n apply (erule impE, simp add: is_aligned_def s0_ptr_defs)\n apply (erule notE, rule pspace_distinctD''[OF _ s0H_pspace_distinct'])\n apply (simp add: objBitsKO_def ntfnH_def)\n apply (clarsimp simp: tcb_st_refs_of'_def Low_tcbH_def)\n apply (clarsimp simp: ntfnH_def ntfn_q_refs_of'_def)\n apply (rule conjI)\n apply (clarsimp simp: tcb_st_refs_of'_def High_tcbH_def)\n apply (clarsimp simp: objBitsKO_def s0_ptrs_aligned)\n apply (erule notE, rule pspace_distinctD''[OF _ s0H_pspace_distinct'])\n apply (simp add: objBitsKO_def)\n apply (clarsimp simp: irq_cte_def)\n apply (clarsimp simp: Low_cte_def Low_cte'_def split: if_split_asm)\n apply (clarsimp simp: High_cte_def High_cte'_def split: if_split_asm)\n apply (clarsimp simp: Silc_cte_def Silc_cte'_def split: if_split_asm)\n apply (clarsimp simp: global_pdH'_def)\n apply (clarsimp simp: High_pdH_def)\n apply (clarsimp simp: Low_pdH_def)\n apply (clarsimp simp: High_ptH_def)\n apply (clarsimp simp: Low_ptH_def)\n apply (rule conjI)\n apply (clarsimp simp: if_live_then_nonz_cap'_def ko_wp_at'_def)\n apply (drule kh0H_SomeD)\n apply (elim disjE, simp_all add: kh0H_all_obj_def' objBitsKO_def)[1]\n apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of)\n apply (rule_tac x=\"High_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def')\n apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of)\n apply (rule_tac x=\"Low_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def')\n apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of)\n apply (rule_tac x=\"Silc_cnode_ptr + 0x13E0\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def')\n apply (clarsimp split: if_split_asm)+\n apply (rule conjI)\n apply (clarsimp simp: if_unsafe_then_cap'_def ex_cte_cap_wp_to'_def cte_wp_at_ctes_of)\n apply (frule map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: kh0H_all_obj_def')[1]\n apply (rule_tac x=\"Low_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"Low_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"Low_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"High_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"High_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"High_cnode_ptr + 0x10\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def)\n apply (rule_tac x=\"Silc_cnode_ptr + 0x20\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=\"0x13E\" in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=2 in bexI)\n apply simp\n apply simp\n apply (rule_tac x=\"High_cnode_ptr + 0x20\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=\"0x13E\" in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_3, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=3 in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=2 in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_1, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=1 in bexI)\n apply simp\n apply simp\n apply (rule_tac x=\"Low_cnode_ptr + 0x20\" in exI)\n apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm)\n apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=\"0x13E\" in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_3, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=3 in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=2 in bexI)\n apply simp\n apply simp\n apply (drule(2) ucast_shiftr_1, rule s0_ptrs_aligned, simp)\n apply (rule_tac x=1 in bexI)\n apply simp\n apply simp\n apply (rule conjI)\n apply (clarsimp simp: valid_idle'_def pred_tcb_at'_def obj_at'_def projectKO_eq project_inject\n objBitsKO_def idle_tcb'_def)\n apply (clarsimp simp: s0H_internal_def s0_ptrs_aligned idle_tcbH_def)\n apply (rule conjI)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def)\n apply (clarsimp simp: idle_tcb_ptr_def idle_thread_ptr_def)\n apply (rule conjI)\n apply (clarsimp simp: kdr_valid_global_refs') (* use axiomatization for now *)\n apply (rule conjI)\n apply (clarsimp simp: valid_arch_state'_def)\n apply (intro conjI)\n apply (clarsimp simp: s0H_internal_def arch_state0H_def objBitsKO_def pageBits_def)\n apply (clarsimp simp: s0_ptr_defs is_aligned_def)\n apply (cut_tac s0H_pspace_distinct')[1]\n apply (simp add: s0H_internal_def arch_state0H_def)\n apply (clarsimp simp: valid_asid_table'_def s0H_internal_def arch_state0H_def)\n apply (clarsimp simp: page_directory_at'_def s0H_internal_def arch_state0H_def pdBits_def pageBits_def s0_ptrs_aligned)\n apply (clarsimp simp: typ_at'_def ko_wp_at'_def)\n apply (drule less_t2n_ex_ucast[where n=12 and 'b=12, simplified])\n apply clarsimp\n apply (cut_tac x=ya in pd_offs_in_range(3))\n apply (clarsimp simp: global_pdH'_def objBitsKO_def archObjSize_def pd_offs_range_def)\n apply (rule pspace_distinctD'')\n apply (simp add: objBitsKO_def archObjSize_def global_pdH'_def)\n apply (cut_tac s0H_pspace_distinct')[1]\n apply (simp add: s0H_internal_def arch_state0H_def)\n apply (clarsimp simp: valid_global_pts'_def s0H_internal_def arch_state0H_def)\n apply (clarsimp simp: is_inv_def s0H_internal_def arch_state0H_def)\n apply (clarsimp simp: valid_asid_map'_def s0H_internal_def arch_state0H_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_irq_node'_def)\n apply (rule conjI)\n apply (clarsimp simp: s0H_internal_def is_aligned_def s0_ptr_defs word_size)\n apply (clarsimp simp: obj_at'_def projectKO_eq project_inject objBitsKO_def s0H_internal_def\n shiftl_t2n[where n=4, simplified, symmetric]\n kh0H_simps(1)[simplified cte_level_bits_def])\n apply (rule conjI)\n apply (rule is_aligned_add)\n apply (simp add: is_aligned_def s0_ptr_defs)\n apply (rule is_aligned_shift)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def kh0H_simps(1)[simplified cte_level_bits_def])\n apply (rule conjI)\n apply (clarsimp simp: valid_irq_handlers'_def cteCaps_of_def ran_def)\n apply (drule_tac map_to_ctes_kh0H_SomeD)\n apply (elim disjE, simp_all add: kh0H_all_obj_def')[1]\n apply ((clarsimp split: if_split_asm)+)[3]\n apply (rule conjI)\n apply (clarsimp simp: valid_irq_states'_def s0H_internal_def machine_state0_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_machine_state'_def s0H_internal_def machine_state0_def)\n apply (rule conjI)\n apply (clarsimp simp: irqs_masked'_def s0H_internal_def maxIRQ_def timer_irq_def)\n apply (rule conjI)\n apply (clarsimp simp: valid_queues'_def obj_at'_def projectKO_eq project_inject s0H_internal_def inQ_def)\n apply (frule kh0H_dom_tcb)\n apply (elim disjE, (clarsimp simp: kh0H_obj_def)+)[1]\n apply (rule conjI)\n apply (clarsimp simp: ct_not_inQ_def obj_at'_def projectKO_eq project_inject s0H_internal_def objBitsKO_def s0_ptrs_aligned Low_tcbH_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def)\n(* apply (simp add: objBitsKO_def kh0H_simps[simplified cte_level_bits_def])*)\n apply (rule conjI)\n apply (clarsimp simp: ct_idle_or_in_cur_domain'_def obj_at'_def projectKO_eq project_inject tcb_in_cur_domain'_def s0H_internal_def Low_tcbH_def Low_domain_def objBitsKO_def s0_ptrs_aligned)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def)\n(* apply (simp add: objBitsKO_def kh0H_simps[simplified cte_level_bits_def])*)\n apply (rule conjI)\n apply (clarsimp simp: valid_pde_mappings'_def obj_at'_def projectKO_eq project_inject)\n apply (drule kh0H_SomeD)\n apply (elim disjE, simp_all add: kh0H_all_obj_def High_pd'H_def Low_pd'H_def)[1]\n apply (clarsimp split: if_split_asm)+\n apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def)\n apply (cut_tac x=\"x - init_global_pd >> 2\" and n=12 and 'a=12 in ucast_mask_drop)\n apply simp\n apply (subst(asm) shiftr_then_mask_commute)\n apply simp\n apply (subst(asm) mask_eqs(4)[symmetric])\n apply (subst(asm) is_aligned_mask[where w=\"init_global_pd\", THEN iffD1])\n apply (simp add: s0_ptrs_aligned)\n apply (simp add: kernel_base_def)\n apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def split: if_split_asm)\n apply (cut_tac x=\"x - High_pd_ptr >> 2\" and n=12 and 'a=12 in ucast_mask_drop)\n apply simp\n apply (subst(asm) shiftr_then_mask_commute)\n apply simp\n apply (subst(asm) mask_eqs(4)[symmetric])\n apply (subst(asm) is_aligned_mask[where w=\"High_pd_ptr\", THEN iffD1])\n apply (simp add: s0_ptrs_aligned)\n apply (simp add: kernel_base_def)\n apply (cut_tac x=\"x - High_pd_ptr >> 2\" and n=12 and 'a=12 in ucast_mask_drop)\n apply simp\n apply (subst(asm) shiftr_then_mask_commute)\n apply simp\n apply (subst(asm) mask_eqs(4)[symmetric])\n apply (subst(asm) is_aligned_mask[where w=\"High_pd_ptr\", THEN iffD1])\n apply (simp add: s0_ptrs_aligned)\n apply (simp add: kernel_base_def)\n apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def split: if_split_asm)\n apply (cut_tac x=\"x - Low_pd_ptr >> 2\" and n=12 and 'a=12 in ucast_mask_drop)\n apply simp\n apply (subst(asm) shiftr_then_mask_commute)\n apply simp\n apply (subst(asm) mask_eqs(4)[symmetric])\n apply (subst(asm) is_aligned_mask[where w=\"Low_pd_ptr\", THEN iffD1])\n apply (simp add: s0_ptrs_aligned)\n apply (simp add: kernel_base_def)\n apply (cut_tac x=\"x - Low_pd_ptr >> 2\" and n=12 and 'a=12 in ucast_mask_drop)\n apply simp\n apply (subst(asm) shiftr_then_mask_commute)\n apply simp\n apply (subst(asm) mask_eqs(4)[symmetric])\n apply (subst(asm) is_aligned_mask[where w=\"Low_pd_ptr\", THEN iffD1])\n apply (simp add: s0_ptrs_aligned)\n apply (simp add: kernel_base_def)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: kdr_pspace_domain_valid) (* use axiomatization for now *)\n (* unfold s0H_internal for remaining goals *)\n apply (clarsimp simp: s0H_internal_def cteCaps_of_def\n untyped_ranges_zero_inv_def\n dschDomain_def dschLength_def)\n apply (clarsimp simp: newKernelState_def newKSDomSched)\n apply (clarsimp simp: cur_tcb'_def obj_at'_def projectKO_eq project_inject s0H_internal_def objBitsKO_def s0_ptrs_aligned)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBitsKO_def)\n done\n\nlemma kh0_pspace_dom:\n \"pspace_dom kh0 = {init_globals_frame, idle_tcb_ptr, High_tcb_ptr, Low_tcb_ptr,\n irq_cnode_ptr, ntfn_ptr} \\\n irq_node_offs_range \\\n cnode_offs_range Silc_cnode_ptr \\\n cnode_offs_range High_cnode_ptr \\\n cnode_offs_range Low_cnode_ptr \\\n pd_offs_range init_global_pd \\\n pd_offs_range High_pd_ptr \\\n pd_offs_range Low_pd_ptr \\\n pt_offs_range High_pt_ptr \\\n pt_offs_range Low_pt_ptr\"\n supply nonzero_gt_zero[simp] gt_zero_nonzero[simp]\n apply (rule equalityI)\n apply (simp add: dom_def pspace_dom_def)\n apply clarsimp\n apply (clarsimp simp: kh0_def obj_relation_cuts_def pd_offs_in_range pt_offs_in_range\n cnode_offs_in_range irq_node_offs_in_range s0_ptrs_aligned pageBits_def\n kh0_obj_def cte_map_def' caps_dom_length_10\n split: if_split_asm)\n apply (clarsimp simp: pspace_dom_def dom_def)\n apply (rule conjI)\n apply (rule_tac x=init_globals_frame in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def)\n apply (rule_tac x=0 in exI)\n apply simp\n apply (rule conjI)\n apply (rule_tac x=idle_tcb_ptr in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def)\n apply (rule conjI)\n apply (rule_tac x=High_tcb_ptr in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def)\n apply (rule conjI)\n apply (rule_tac x=Low_tcb_ptr in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def)\n apply (rule conjI)\n apply (rule_tac x=irq_cnode_ptr in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def cte_map_def)\n apply (rule conjI)\n apply (rule_tac x=ntfn_ptr in exI)\n apply (clarsimp simp: kh0_def kh0_obj_def s0_ptr_defs image_def)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=x in exI)\n apply (drule offs_range_correct)\n apply clarsimp\n apply (force simp: kh0_def kh0_obj_def image_def cte_map_def')\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=Silc_cnode_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs cte_map_def' dom_caps)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=High_cnode_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs cte_map_def' dom_caps)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=Low_cnode_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs cte_map_def' dom_caps)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=init_global_pd in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=High_pd_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=Low_pd_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs)\n apply (rule conjI)\n apply clarsimp\n apply (rule_tac x=High_pt_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs)\n apply clarsimp\n apply (rule_tac x=Low_pt_ptr in exI)\n apply (drule offs_range_correct)\n apply (force simp: kh0_def kh0_obj_def image_def s0_ptr_defs)\n done\n\nlemma shiftl_shiftr_2_word12[simp]:\n \"ucast (((ucast (x:: 12 word) << 2)::word32) >> 2) = x\"\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (cut_tac ucast_less[where x=x])\n apply (erule less_trans)\n apply simp\n apply simp\n apply (rule ucast_ucast_id)\n apply simp\n done\n\nlemma shiftl_shiftr_2_word10[simp]:\n \"ucast (((ucast (x:: 10 word) << 2)::word32) >> 2) = x\"\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (cut_tac ucast_less[where x=x])\n apply (erule less_trans)\n apply simp\n apply simp\n apply (rule ucast_ucast_id)\n apply simp\n done\n\nlemma shiftl_shiftr_2_word8[simp]:\n \"ucast (((ucast (x:: 8 word) << 2)::word32) >> 2) = x\"\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (cut_tac ucast_less[where x=x])\n apply (erule less_trans)\n apply simp\n apply simp\n apply (rule ucast_ucast_id)\n apply simp\n done\n\nlemma mult_shiftr_id[simp]:\n \"length x = 10 \\ of_bl x * (0x10::word32) >> 4 = of_bl x\"\n apply (simp add: shiftl_t2n[symmetric, where n=4, simplified mult.commute, simplified] )\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (rule less_trans)\n apply (rule of_bl_length_less)\n apply assumption\n apply simp\n apply simp\n apply simp\n done\n\nlemma to_bl_ucast_of_bl[simp]:\n \"length x = 10 \\ to_bl ((ucast ((of_bl x)::word32))::10 word) = x\"\n apply (subst ucast_of_bl_up)\n apply (simp add: word_size)\n apply (simp add: word_rep_drop)\n done\n\nlemma s0_pspace_rel:\n \"pspace_relation (kheap s0_internal) kh0H\"\n apply (simp add: pspace_relation_def s0_internal_def s0H_internal_def kh0H_dom kh0_pspace_dom)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (rename_tac y)\n apply (elim disjE)\n apply (clarsimp simp: pageBits_def)\n apply (clarsimp simp: kh0H_obj_def split del: if_split)\n apply (cut_tac x=y in pd_offs_in_range(3))\n apply (clarsimp simp: pd_offs_range_def pde_relation_def pde_relation_aligned_def)\n apply (clarsimp simp: kh0H_all_obj_def kh0_obj_def other_obj_relation_def\n tcb_relation_def arch_tcb_relation_def fault_rel_optionation_def\n word_bits_def the_nat_to_bl_simps)+\n apply (clarsimp simp: kh0H_obj_def High_pt_def High_pt'H_def High_pt'_def split del: if_split)\n apply (cut_tac x=y in pt_offs_in_range(2))\n apply (clarsimp simp: pt_offs_range_def pte_relation_def pte_relation_aligned_def pte_relation'_def)\n apply (clarsimp simp: kh0H_obj_def Low_pt_def Low_pt'H_def Low_pt'_def split del: if_split)\n apply (cut_tac x=y in pt_offs_in_range(1))\n apply (clarsimp simp: pt_offs_range_def pte_relation_def pte_relation_aligned_def pte_relation'_def)\n apply (clarsimp simp: kh0H_obj_def High_pd_def High_pd'H_def High_pd'_def split del: if_split)\n apply (cut_tac x=y in pd_offs_in_range(2))\n apply (clarsimp simp: pd_offs_range_def pde_relation_def pde_relation_aligned_def pde_relation'_def)\n apply (clarsimp simp: kh0H_obj_def Low_pd_def Low_pd'H_def Low_pd'_def split del: if_split)\n apply (cut_tac x=y in pd_offs_in_range(1))\n apply (clarsimp simp: pd_offs_range_def pde_relation_def pde_relation_aligned_def pde_relation'_def)\n apply (clarsimp simp: kh0H_obj_def irq_cnode_def cte_map_def cte_relation_def well_formed_cnode_n_def split: if_split_asm)\n apply (clarsimp simp: kh0H_obj_def kh0_obj_def other_obj_relation_def ntfn_relation_def)\n apply (clarsimp simp: kh0H_obj_def kh0_obj_def cte_relation_def cte_map_def)\n apply (cut_tac dom_caps(1))[1]\n apply (frule_tac m=\"Silc_caps\" in domI)\n apply (cut_tac x=y in cnode_offs_in_range(3))\n apply simp\n apply (clarsimp simp: cnode_offs_range_def Silc_cte_def Silc_cte'_def Silc_capsH_def the_nat_to_bl_simps Silc_caps_def cte_level_bits_def empty_cte_def split: if_split_asm)\n apply (clarsimp simp: kh0H_obj_def kh0_obj_def cte_relation_def cte_map_def)\n apply (cut_tac dom_caps(2))[1]\n apply (frule_tac m=\"High_caps\" in domI)\n apply (cut_tac x=y in cnode_offs_in_range(2))\n apply simp\n apply (clarsimp simp: cnode_offs_range_def High_cte_def High_cte'_def High_capsH_def the_nat_to_bl_simps High_caps_def cte_level_bits_def empty_cte_def split: if_split_asm)\n apply (clarsimp simp: kh0H_obj_def kh0_obj_def cte_relation_def cte_map_def)\n apply (cut_tac dom_caps(3))[1]\n apply (frule_tac m=\"Low_caps\" in domI)\n apply (cut_tac x=y in cnode_offs_in_range(1))\n apply simp\n apply (clarsimp simp: cnode_offs_range_def Low_cte_def Low_cte'_def Low_capsH_def the_nat_to_bl_simps Low_caps_def cte_level_bits_def empty_cte_def split: if_split_asm)\n apply (clarsimp simp: kh0H_obj_def irq_cnode_def cte_map_def cte_relation_def well_formed_cnode_n_def empty_cte_def dom_def split: if_split_asm)\n apply (drule irq_node_offs_range_correct)\n apply clarsimp\n done\n\nlemma subtree_node_Some:\n \"m \\ a \\ b \\ m a \\ None\"\n by (erule subtree.cases) (auto simp: parentOf_def)\n\nlemma s0_srel:\n \"1 \\ maxDomain \\ (s0_internal, s0H_internal) \\ state_relation\"\n apply (simp add: state_relation_def)\n apply (intro conjI)\n apply (simp add: s0_pspace_rel)\n apply (clarsimp simp: ekheap_relation_def)\n apply (case_tac \"ksPSpace s0H_internal x\")\n apply (clarsimp simp: s0_internal_def s0H_internal_def exst0_def kh0H_def option_update_range_def split: if_split_asm option.splits)\n apply (clarsimp simp: s0_internal_def s0H_internal_def exst0_def etcb_relation_def idle_tcbH_def High_tcbH_def High_etcb_def Low_tcbH_def Low_etcb_def default_etcb_def split: if_split_asm)\n apply (simp add: s0_internal_def exst0_def s0H_internal_def sched_act_relation_def)\n apply (simp add: s0_internal_def exst0_def s0H_internal_def ready_queues_relation_def)\n apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def ghost_relation_def)\n apply (rule conjI)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp: kh0_def s0_ptr_defs)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply clarsimp\n apply (rule conjI)\n apply clarsimp\n apply (rule iffI)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: irq_node_offs_in_range)\n apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def)\n apply clarsimp\n apply (clarsimp simp: s0_ptr_defs)\n apply (subgoal_tac \"a \\ irq_node_offs_range\")\n prefer 2\n apply (clarsimp simp: irq_node_offs_range_def s0_ptr_defs cte_level_bits_def)\n apply (erule_tac x=\"ucast (a - 0xE0008000 >> 4)\" in allE)\n apply (subst(asm) ucast_ucast_len)\n apply (rule shiftr_less_t2n)\n apply (rule word_less_sub_right)\n apply simp\n apply simp\n apply (simp add: shiftr_shiftl1)\n apply (subst(asm) is_aligned_neg_mask_eq)\n apply (rule aligned_sub_aligned[where n=4])\n apply simp\n apply (simp add: is_aligned_def)\n apply simp\n apply simp\n apply (intro conjI impI)\n apply clarsimp\n apply (rule iffI)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Low_caps_def)\n apply clarsimp\n apply (rule iffI)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def High_caps_def)\n apply clarsimp\n apply (rule iffI)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Silc_caps_def)\n apply clarsimp\n apply (rule iffI)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply (fastforce simp: kh0_def well_formed_cnode_n_def empty_cnode_def dom_def s0_ptr_defs kh0_obj_def Silc_caps_def)\n apply clarsimp\n apply (drule kh0_SomeD)\n apply (clarsimp simp: s0_ptr_defs kh0_obj_def)\n apply (clarsimp simp: s0H_internal_def cdt_relation_def)\n apply (clarsimp simp: descendants_of'_def)\n apply (frule subtree_parent)\n apply (drule subtree_mdb_next)\n apply (case_tac \"x = 0\")\n apply (cut_tac s0H_valid_pspace')\n apply (simp add: valid_pspace'_def valid_mdb'_def valid_mdb_ctes_def parentOf_def isMDBParentOf_def kh0H_all_obj_def')\n apply simp\n apply (clarsimp simp: mdb_next_trancl_s0H)\n apply (elim disjE, (clarsimp simp: parentOf_def isMDBParentOf_def kh0H_all_obj_def')+)[1]\n apply (clarsimp simp: cdt_list_relation_def s0_internal_def exst0_def split: option.splits)\n apply (clarsimp simp: next_slot_def)\n apply (cut_tac p=\"(a, b)\" and t=\"(const [])\" and m=\"Map.empty\" in next_not_child_NoneI)\n apply fastforce\n apply (simp add: next_sib_def)\n apply (simp add: finite_depth_def)\n apply simp\n apply (clarsimp simp: revokable_relation_def)\n apply (clarsimp simp: null_filter_def split: if_split_asm)\n apply (drule s0_caps_of_state)\n apply clarsimp\n apply (elim disjE)\n apply (clarsimp simp: cte_map_def s0H_internal_def s0_internal_def kh0H_all_obj_def' cte_level_bits_def split: if_split_asm)+\n apply (clarsimp simp: tcb_cnode_index_def ucast_bl[symmetric] Low_tcb_cte_def Low_tcbH_def High_tcb_cte_def High_tcbH_def)\n apply ((clarsimp simp: cte_map_def' s0H_internal_def s0_internal_def,\n clarsimp simp: tcb_cnode_index_def ucast_bl[symmetric] Low_tcb_cte_def Low_tcbH_def High_tcb_cte_def High_tcbH_def)+)[5]\n apply (clarsimp simp: s0_internal_def s0H_internal_def arch_state_relation_def arch_state0_def arch_state0H_def)\n apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def interrupt_state_relation_def irq_state_relation_def)\n apply (clarsimp simp: s0_internal_def exst0_def s0H_internal_def)+\n done\n\ndefinition\n \"s0H \\ ((if ct_idle' s0H_internal then idle_context s0_internal else s0_context,s0H_internal),KernelExit)\"\n\nlemma step_restrict_s0:\n \"1 \\ maxDomain \\ step_restrict s0\"\n supply option.case_cong[cong] if_cong[cong]\n apply (clarsimp simp: step_restrict_def has_srel_state_def)\n apply (rule_tac x=\"fst (fst s0H)\" in exI)\n apply (rule_tac x=\"snd (fst s0H)\" in exI)\n apply (rule_tac x=\"snd s0H\" in exI)\n apply (simp add: s0H_def lift_fst_rel_def lift_snd_rel_def s0_srel s0_def split del: if_split)\n apply (rule conjI)\n apply (clarsimp split: if_split_asm)\n apply (rule conjI)\n apply clarsimp\n apply (frule ct_idle'_related[OF s0_srel s0H_invs]; solves simp)\n apply clarsimp\n apply (drule ct_idle_related[OF s0_srel]; simp)\n apply (clarsimp simp: full_invs_if'_def s0H_invs)\n apply (rule conjI)\n apply (simp only: ex_abs_def)\n apply (rule_tac x=\"s0_internal\" in exI)\n apply (simp only: einvs_s0 s0_srel)\n apply (simp add: s0H_internal_def valid_domain_list'_def)\n apply (rule conjI)\n apply (clarsimp simp: vs_valid_duplicates'_def split: option.splits)\n apply (frule kh0H_SomeD)\n apply (elim disjE, simp_all add: vs_ptr_align_def kh0H_all_obj_def')[1]\n apply (clarsimp simp: the_nat_to_bl_simps split: if_split_asm)\n apply (clarsimp simp: the_nat_to_bl_simps split: if_split_asm)\n apply (clarsimp simp: the_nat_to_bl_simps split: if_split_asm)\n apply (clarsimp split: if_split_asm)\n apply (clarsimp simp: High_pd'H_def split: if_split_asm)\n apply (clarsimp simp: Low_pd'H_def split: if_split_asm)\n apply (clarsimp simp: High_pt'H_def split: if_split_asm)\n apply (clarsimp simp: Low_pt'H_def split: if_split_asm)\n apply (clarsimp simp: ct_in_state'_def st_tcb_at'_def obj_at'_def projectKO_eq project_inject\n s0H_internal_def objBits_simps' s0_ptrs_aligned Low_tcbH_def)\n apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def])\n apply (simp add: objBits_simps')\n done\n\nlemma Sys1_valid_initial_state_noenabled:\n assumes domains: \"1 \\ maxDomain\"\n assumes utf_det: \"\\pl pr pxn tc ms s. det_inv InUserMode tc s \\ einvs s \\ context_matches_state pl pr pxn ms s \\ ct_running s\n \\ (\\x. utf (cur_thread s) pl pr pxn (tc, ms) = {x})\"\n assumes utf_non_empty: \"\\t pl pr pxn tc ms. utf t pl pr pxn (tc, ms) \\ {}\"\n assumes utf_non_interrupt: \"\\t pl pr pxn tc ms e f g. (e,f,g) \\ utf t pl pr pxn (tc, ms) \\ e \\ Some Interrupt\"\n assumes det_inv_invariant: \"invariant_over_ADT_if det_inv utf\"\n assumes det_inv_s0: \"det_inv KernelExit (cur_context s0_internal) s0_internal\"\n shows \"valid_initial_state_noenabled det_inv utf s0_internal Sys1PAS timer_irq s0_context\"\n by (rule Sys1_valid_initial_state_noenabled[OF step_restrict_s0 utf_det utf_non_empty\n utf_non_interrupt det_inv_invariant det_inv_s0\n ],\n rule domains)\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/refine/ARM/Example_Valid_StateH.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.297469948832931, "lm_q1q2_score": 0.15801882070168696}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n The refinement relation between abstract and concrete states\n*)\n\ntheory StateRelation\nimports Invariants_H\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n cte_map :: \"cslot_ptr \\ machine_word\"\nwhere\n \"cte_map \\ \\(oref, cref). oref + (of_bl cref * 2 ^ cte_level_bits)\"\n\nlemmas cte_map_def' = cte_map_def[simplified cte_level_bits_def, simplified]\n\ndefinition\n lookup_failure_map :: \"ExceptionTypes_A.lookup_failure \\ Fault_H.lookup_failure\"\nwhere\n \"lookup_failure_map \\ \\lf. case lf of\n ExceptionTypes_A.InvalidRoot \\ Fault_H.InvalidRoot\n | ExceptionTypes_A.MissingCapability n \\ Fault_H.MissingCapability n\n | ExceptionTypes_A.DepthMismatch n m \\ Fault_H.DepthMismatch n m\n | ExceptionTypes_A.GuardMismatch n g \\ Fault_H.GuardMismatch n (of_bl g) (length g)\"\n\nprimrec\n arch_fault_map :: \"Machine_A.X64_A.arch_fault \\ ArchFault_H.X64_H.arch_fault\"\nwhere\n \"arch_fault_map (Machine_A.X64_A.VMFault ptr msg) = ArchFault_H.X64_H.VMFault ptr msg\"\n\nprimrec\n fault_map :: \"ExceptionTypes_A.fault \\ Fault_H.fault\"\nwhere\n \"fault_map (ExceptionTypes_A.CapFault ref bool failure) =\n Fault_H.CapFault ref bool (lookup_failure_map failure)\"\n| \"fault_map (ExceptionTypes_A.ArchFault arch_fault) =\n Fault_H.ArchFault (arch_fault_map arch_fault)\"\n| \"fault_map (ExceptionTypes_A.UnknownSyscallException n) =\n Fault_H.UnknownSyscallException n\"\n| \"fault_map (ExceptionTypes_A.UserException x y) =\n Fault_H.UserException x y\"\n\n\ntext \\\n A pspace and a tree are related if every object in the pspace\n corresponds to an object in the tree. Some abstract objects\n like CapTables correspond to multiple concrete ones, thus we\n have to make cuts.\n\\\n\ntype_synonym obj_relation_cut = \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\ntype_synonym obj_relation_cuts = \"(machine_word \\ obj_relation_cut) set\"\n\ndefinition\n vmrights_map :: \"rights set \\ vmrights\"\nwhere\n \"vmrights_map S \\ if AllowRead \\ S\n then (if AllowWrite \\ S then VMReadWrite else VMReadOnly)\n else VMKernelOnly\"\n\ndefinition\n zbits_map :: \"nat option \\ zombie_type\"\nwhere\n \"zbits_map N \\ case N of Some n \\ ZombieCNode n\n | None \\ ZombieTCB\"\n\nprimrec\n acap_relation :: \"arch_cap \\ arch_capability \\ bool\"\nwhere\n \"acap_relation (arch_cap.ASIDPoolCap x y) c = (c =\n arch_capability.ASIDPoolCap x y)\"\n| \"acap_relation (arch_cap.ASIDControlCap) c = (c =\n arch_capability.ASIDControlCap)\"\n| \"acap_relation (arch_cap.PageCap dev word rghts typ sz data) c = (c =\n arch_capability.PageCap word (vmrights_map rghts) typ sz dev data)\"\n| \"acap_relation (arch_cap.PageTableCap word data) c = (c =\n arch_capability.PageTableCap word data)\"\n| \"acap_relation (arch_cap.PageDirectoryCap word data) c = (c =\n arch_capability.PageDirectoryCap word data)\"\n| \"acap_relation (arch_cap.PDPointerTableCap word data) c = (c =\n arch_capability.PDPointerTableCap word data)\"\n| \"acap_relation (arch_cap.PML4Cap word data) c = (c =\n arch_capability.PML4Cap word data)\"\n| \"acap_relation (arch_cap.IOPortCap f l) c = (c =\n arch_capability.IOPortCap f l)\"\n| \"acap_relation (arch_cap.IOPortControlCap) c = (c = arch_capability.IOPortControlCap)\"\n\nprimrec\n cap_relation :: \"cap \\ capability \\ bool\"\nwhere\n \"cap_relation Structures_A.NullCap c = (c =\n Structures_H.NullCap)\"\n| \"cap_relation Structures_A.DomainCap c = (c =\n Structures_H.DomainCap)\"\n| \"cap_relation (Structures_A.UntypedCap dev ref n f) c = (c =\n Structures_H.UntypedCap dev ref n f)\"\n| \"cap_relation (Structures_A.EndpointCap ref b r) c = (c =\n Structures_H.EndpointCap ref b (AllowSend \\ r)\n (AllowRecv \\ r) (AllowGrant \\ r) (AllowGrantReply \\ r))\"\n| \"cap_relation (Structures_A.NotificationCap ref b r) c = (c =\n Structures_H.NotificationCap ref b (AllowSend \\ r) (AllowRecv \\ r))\"\n| \"cap_relation (Structures_A.CNodeCap ref n L) c = (c =\n Structures_H.CNodeCap ref n (of_bl L) (length L))\"\n| \"cap_relation (Structures_A.ThreadCap ref) c = (c =\n Structures_H.ThreadCap ref)\"\n| \"cap_relation (Structures_A.ReplyCap ref master r) c = (c =\n Structures_H.ReplyCap ref master (AllowGrant \\ r))\"\n| \"cap_relation (Structures_A.IRQControlCap) c = (c =\n Structures_H.IRQControlCap)\"\n| \"cap_relation (Structures_A.IRQHandlerCap irq) c = (c =\n Structures_H.IRQHandlerCap irq)\"\n| \"cap_relation (Structures_A.ArchObjectCap a) c = (\\a'.\n acap_relation a a' \\ c = Structures_H.ArchObjectCap a')\"\n| \"cap_relation (Structures_A.Zombie p b n) c = (c =\n Structures_H.Zombie p (zbits_map b) n)\"\n\n\ndefinition\n cte_relation :: \"cap_ref \\ obj_relation_cut\"\nwhere\n \"cte_relation y \\ \\ko ko'. \\sz cs cte cap. ko = CNode sz cs \\ ko' = KOCTE cte\n \\ cs y = Some cap \\ cap_relation cap (cteCap cte)\"\n\ndefinition\n asid_pool_relation :: \"(9 word \\ machine_word) \\ asidpool \\ bool\"\nwhere\n \"asid_pool_relation \\ \\p p'. p = inv ASIDPool p' o ucast\"\n\ndefinition\n ntfn_relation :: \"Structures_A.notification \\ Structures_H.notification \\ bool\"\nwhere\n \"ntfn_relation \\ \\ntfn ntfn'.\n (case ntfn_obj ntfn of\n Structures_A.IdleNtfn \\ ntfnObj ntfn' = Structures_H.IdleNtfn\n | Structures_A.WaitingNtfn q \\ ntfnObj ntfn' = Structures_H.WaitingNtfn q\n | Structures_A.ActiveNtfn b \\ ntfnObj ntfn' = Structures_H.ActiveNtfn b)\n \\ ntfn_bound_tcb ntfn = ntfnBoundTCB ntfn'\"\n\ndefinition\n ep_relation :: \"Structures_A.endpoint \\ Structures_H.endpoint \\ bool\"\nwhere\n \"ep_relation \\ \\ep ep'. case ep of\n Structures_A.IdleEP \\ ep' = Structures_H.IdleEP\n | Structures_A.RecvEP q \\ ep' = Structures_H.RecvEP q\n | Structures_A.SendEP q \\ ep' = Structures_H.SendEP q\"\n\ndefinition\n fault_rel_optionation :: \"ExceptionTypes_A.fault option \\ Fault_H.fault option \\ bool\"\nwhere\n \"fault_rel_optionation \\ \\f f'. f' = option_map fault_map f\"\n\nprimrec\n thread_state_relation :: \"Structures_A.thread_state \\ Structures_H.thread_state \\ bool\"\nwhere\n \"thread_state_relation (Structures_A.Running) ts'\n = (ts' = Structures_H.Running)\"\n| \"thread_state_relation (Structures_A.Restart) ts'\n = (ts' = Structures_H.Restart)\"\n| \"thread_state_relation (Structures_A.Inactive) ts'\n = (ts' = Structures_H.Inactive)\"\n| \"thread_state_relation (Structures_A.IdleThreadState) ts'\n = (ts' = Structures_H.IdleThreadState)\"\n| \"thread_state_relation (Structures_A.BlockedOnReply) ts'\n = (ts' = Structures_H.BlockedOnReply)\"\n| \"thread_state_relation (Structures_A.BlockedOnReceive oref sp) ts'\n = (ts' = Structures_H.BlockedOnReceive oref (receiver_can_grant sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnSend oref sp) ts'\n = (ts' = Structures_H.BlockedOnSend oref (sender_badge sp)\n (sender_can_grant sp) (sender_can_grant_reply sp) (sender_is_call sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnNotification oref) ts'\n = (ts' = Structures_H.BlockedOnNotification oref)\"\n\ndefinition\n arch_tcb_relation :: \"Structures_A.arch_tcb \\ Structures_H.arch_tcb \\ bool\"\nwhere\n \"arch_tcb_relation \\ \\atcb atcb'.\n tcb_context atcb = atcbContext atcb'\"\n\ndefinition\n tcb_relation :: \"Structures_A.tcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"tcb_relation \\ \\tcb tcb'.\n tcb_fault_handler tcb = to_bl (tcbFaultHandler tcb')\n \\ tcb_ipc_buffer tcb = tcbIPCBuffer tcb'\n \\ arch_tcb_relation (tcb_arch tcb) (tcbArch tcb')\n \\ thread_state_relation (tcb_state tcb) (tcbState tcb')\n \\ fault_rel_optionation (tcb_fault tcb) (tcbFault tcb')\n \\ cap_relation (tcb_ctable tcb) (cteCap (tcbCTable tcb'))\n \\ cap_relation (tcb_vtable tcb) (cteCap (tcbVTable tcb'))\n \\ cap_relation (tcb_reply tcb) (cteCap (tcbReply tcb'))\n \\ cap_relation (tcb_caller tcb) (cteCap (tcbCaller tcb'))\n \\ cap_relation (tcb_ipcframe tcb) (cteCap (tcbIPCBufferFrame tcb'))\n \\ tcb_bound_notification tcb = tcbBoundNotification tcb'\n \\ tcb_mcpriority tcb = tcbMCP tcb'\"\n\ndefinition\n other_obj_relation :: \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\nwhere\n \"other_obj_relation obj obj' \\\n (case (obj, obj') of\n (TCB tcb, KOTCB tcb') \\ tcb_relation tcb tcb'\n | (Endpoint ep, KOEndpoint ep') \\ ep_relation ep ep'\n | (Notification ntfn, KONotification ntfn') \\ ntfn_relation ntfn ntfn'\n | (ArchObj (X64_A.ASIDPool pool), KOArch (KOASIDPool pool'))\n \\ asid_pool_relation pool pool'\n | _ \\ False)\"\n\nprimrec\n pml4e_relation' :: \"X64_A.pml4e \\ X64_H.pml4e \\ bool\"\nwhere\n \"pml4e_relation' X64_A.InvalidPML4E x = (x = X64_H.InvalidPML4E)\"\n| \"pml4e_relation' (X64_A.PDPointerTablePML4E ptr atts rights) x\n = (x = X64_H.PDPointerTablePML4E ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n\n\nprimrec\n pdpte_relation' :: \"X64_A.pdpte \\ X64_H.pdpte \\ bool\"\nwhere\n \"pdpte_relation' X64_A.InvalidPDPTE x = (x = X64_H.InvalidPDPTE)\"\n| \"pdpte_relation' (X64_A.PageDirectoryPDPTE ptr atts rights) x\n = (x = X64_H.PageDirectoryPDPTE ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n| \"pdpte_relation' (X64_A.HugePagePDPTE ptr atts rghts) x\n = (x = X64_H.HugePagePDPTE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\nprimrec\n pde_relation' :: \"X64_A.pde \\ X64_H.pde \\ bool\"\nwhere\n \"pde_relation' X64_A.InvalidPDE x = (x = X64_H.InvalidPDE)\"\n| \"pde_relation' (X64_A.PageTablePDE ptr atts rights) x\n = (x = X64_H.PageTablePDE ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n| \"pde_relation' (X64_A.LargePagePDE ptr atts rghts) x\n = (x = X64_H.LargePagePDE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\n\nprimrec\n pte_relation' :: \"X64_A.pte \\ X64_H.pte \\ bool\"\nwhere\n \"pte_relation' X64_A.InvalidPTE x = (x = X64_H.InvalidPTE)\"\n| \"pte_relation' (X64_A.SmallPagePTE ptr atts rghts) x\n = (x = X64_H.SmallPagePTE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\ndefinition\n \"pte_relation y \\ \\ko ko'. \\pt pte. ko = ArchObj (PageTable pt) \\ ko' = KOArch (KOPTE pte)\n \\ pte_relation' (pt y) pte\"\n\ndefinition\n \"pde_relation y \\ \\ko ko'. \\pd pde. ko = ArchObj (PageDirectory pd) \\ ko' = KOArch (KOPDE pde)\n \\ pde_relation' (pd y) pde\"\n\ndefinition\n \"pdpte_relation y \\ \\ko ko'. \\pd pdpte. ko = ArchObj (PDPointerTable pd) \\ ko' = KOArch (KOPDPTE pdpte)\n \\ pdpte_relation' (pd y) pdpte\"\n\ndefinition\n \"pml4e_relation y \\ \\ko ko'. \\pd pml4e. ko = ArchObj (PageMapL4 pd) \\ ko' = KOArch (KOPML4E pml4e)\n \\ pml4e_relation' (pd y) pml4e\"\n\nprimrec\n aobj_relation_cuts :: \"X64_A.arch_kernel_obj \\ machine_word \\ obj_relation_cuts\"\nwhere\n \"aobj_relation_cuts (DataPage dev sz) x =\n {(x + n * 2 ^ pageBits, \\_ obj. obj = (if dev then KOUserDataDevice else KOUserData) ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\"\n| \"aobj_relation_cuts (X64_A.ASIDPool pool) x =\n {(x, other_obj_relation)}\"\n| \"aobj_relation_cuts (PageTable pt) x =\n (\\y. (x + (ucast y << word_size_bits), pte_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PageDirectory pd) x =\n (\\y. (x + (ucast y << word_size_bits), pde_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PDPointerTable pdpt) x =\n (\\y. (x + (ucast y << word_size_bits), pdpte_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PageMapL4 pm) x =\n (\\y. (x + (ucast y << word_size_bits), pml4e_relation y)) ` UNIV\"\n\nprimrec\n obj_relation_cuts :: \"Structures_A.kernel_object \\ machine_word \\ obj_relation_cuts\"\nwhere\n \"obj_relation_cuts (CNode sz cs) x =\n (if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)})\"\n| \"obj_relation_cuts (TCB tcb) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Endpoint ep) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Notification ntfn) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (ArchObj ao) x = aobj_relation_cuts ao x\"\n\n\nlemma obj_relation_cuts_def2:\n \"obj_relation_cuts ko x =\n (case ko of CNode sz cs \\ if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)}\n | ArchObj (PageTable pt) \\ (\\y. (x + (ucast y << word_size_bits), pte_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PageDirectory pd) \\ (\\y. (x + (ucast y << word_size_bits), pde_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PDPointerTable pdpt) \\ (\\y. (x + (ucast y << word_size_bits), pdpte_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PageMapL4 pm) \\ (\\y. (x + (ucast y << word_size_bits), pml4e_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (DataPage dev sz) \\\n {(x + n * 2 ^ pageBits, \\_ obj. obj =(if dev then KOUserDataDevice else KOUserData)) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | _ \\ {(x, other_obj_relation)})\"\n by (simp split: Structures_A.kernel_object.split\n X64_A.arch_kernel_obj.split)\n\nlemma obj_relation_cuts_def3:\n \"obj_relation_cuts ko x =\n (case (a_type ko) of\n ACapTable n \\ {(cte_map (x, y), cte_relation y) | y. length y = n}\n | AArch APageTable \\ (\\y. (x + (ucast y << word_size_bits), pte_relation y))\n ` (UNIV :: 9 word set)\n | AArch APageDirectory \\ (\\y. (x + (ucast y << word_size_bits), pde_relation y))\n ` (UNIV :: 9 word set)\n | AArch APDPointerTable \\ (\\y. (x + (ucast y << word_size_bits), pdpte_relation y))\n ` (UNIV :: 9 word set)\n | AArch APageMapL4 \\ (\\y. (x + (ucast y << word_size_bits), pml4e_relation y))\n ` (UNIV :: 9 word set)\n | AArch (AUserData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserData) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AArch (ADeviceData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserDataDevice ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AGarbage _ \\ {(x, \\\\)}\n | _ \\ {(x, other_obj_relation)})\"\n apply (simp add: obj_relation_cuts_def2 a_type_def\n split: Structures_A.kernel_object.split\n X64_A.arch_kernel_obj.split)\n apply (clarsimp simp: well_formed_cnode_n_def length_set_helper)\n done\n\ndefinition\n \"is_other_obj_relation_type tp \\\n case tp of\n ACapTable n \\ False\n | AArch APageTable \\ False\n | AArch APageDirectory \\ False\n | AArch APDPointerTable \\ False\n | AArch APageMapL4 \\ False\n | AArch (AUserData _) \\ False\n | AArch (ADeviceData _) \\ False\n | AGarbage _ \\ False\n | _ \\ True\"\n\nlemma is_other_obj_relation_type_CapTable:\n \"\\ is_other_obj_relation_type (ACapTable n)\"\n by (simp add: is_other_obj_relation_type_def)\n\nlemma is_other_obj_relation_type_UserData:\n \"\\ is_other_obj_relation_type (AArch (AUserData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type_DeviceData:\n \"\\ is_other_obj_relation_type (AArch (ADeviceData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type:\n \"is_other_obj_relation_type (a_type ko) \\\n obj_relation_cuts ko x = {(x, other_obj_relation)}\"\n by (simp add: obj_relation_cuts_def3 is_other_obj_relation_type_def\n split: a_type.splits aa_type.splits)\n\ndefinition\n pspace_dom :: \"Structures_A.kheap \\ machine_word set\"\nwhere\n \"pspace_dom ps \\ \\x\\dom ps. fst ` (obj_relation_cuts (the (ps x)) x)\"\n\ndefinition\n pspace_relation :: \"Structures_A.kheap \\ (machine_word \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"pspace_relation ab con \\\n (pspace_dom ab = dom con) \\\n (\\x \\ dom ab. \\(y, P) \\ obj_relation_cuts (the (ab x)) x.\n P (the (ab x)) (the (con y)))\"\n\ndefinition etcb_relation :: \"etcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"etcb_relation \\ \\etcb tcb'.\n tcb_priority etcb = tcbPriority tcb'\n \\ tcb_time_slice etcb = tcbTimeSlice tcb'\n \\ tcb_domain etcb = tcbDomain tcb'\"\n\ndefinition\n ekheap_relation :: \"(obj_ref \\ etcb option) \\ (machine_word \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"ekheap_relation ab con \\\n \\x \\ dom ab. \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation (the (ab x)) tcb'\"\n\nprimrec\n sched_act_relation :: \"Deterministic_A.scheduler_action \\ Structures_H.scheduler_action \\ bool\"\nwhere\n \"sched_act_relation resume_cur_thread a' = (a' = ResumeCurrentThread)\" |\n \"sched_act_relation choose_new_thread a' = (a' = ChooseNewThread)\" |\n \"sched_act_relation (switch_thread x) a' = (a' = SwitchToThread x)\"\n\ndefinition\n ready_queues_relation :: \"(Deterministic_A.domain \\ Structures_A.priority \\ Deterministic_A.ready_queue)\n \\ (domain \\ priority \\ KernelStateData_H.ready_queue) \\ bool\"\nwhere\n \"ready_queues_relation qs qs' \\ \\d p. (qs d p = qs' (d, p))\"\n\ndefinition\n ghost_relation :: \"Structures_A.kheap \\ (machine_word \\ vmpage_size) \\ (machine_word \\ nat) \\ bool\"\nwhere\n \"ghost_relation h ups cns \\\n (\\a sz. (\\dev. h a = Some (ArchObj (DataPage dev sz))) \\ ups a = Some sz) \\\n (\\a n. (\\cs. h a = Some (CNode n cs) \\ well_formed_cnode_n n cs) \\\n cns a = Some n)\"\n\ndefinition\n cdt_relation :: \"(cslot_ptr \\ bool) \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_relation \\ \\cte_at m m'.\n \\c. cte_at c \\ cte_map ` descendants_of c m = descendants_of' (cte_map c) m'\"\n\ndefinition\n cdt_list_relation :: \"cdt_list \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_list_relation \\ \\t m m'.\n \\c cap node. m' (cte_map c) = Some (CTE cap node)\n \\ (case next_slot c t m of None \\ True\n | Some next \\ mdbNext node = cte_map next)\"\n\ndefinition\n revokable_relation :: \"(cslot_ptr \\ bool) \\ (cslot_ptr \\ cap option) \\ cte_heap \\ bool\"\nwhere\n \"revokable_relation revo cs m' \\\n \\c cap node. cs c \\ None \\\n m' (cte_map c) = Some (CTE cap node) \\\n revo c = mdbRevocable node\"\n\ndefinition\n irq_state_relation :: \"irq_state \\ irqstate \\ bool\"\nwhere\n \"irq_state_relation irq irq' \\ case (irq, irq') of\n (irq_state.IRQInactive, irqstate.IRQInactive) \\ True\n | (irq_state.IRQSignal, irqstate.IRQSignal) \\ True\n | (irq_state.IRQTimer, irqstate.IRQTimer) \\ True\n | _ \\ False\"\n\ndefinition\n interrupt_state_relation :: \"(irq \\ obj_ref) \\ (irq \\ irq_state) \\ interrupt_state \\ bool\"\nwhere\n \"interrupt_state_relation node_map irqs is \\\n (\\node irqs'. is = InterruptState node irqs'\n \\ (\\irq. node_map irq = node + (ucast irq << cte_level_bits))\n \\ (\\irq. irq_state_relation (irqs irq) (irqs' irq)))\"\n\ndefinition\n cr3_relation :: \"X64_A.cr3 \\ cr3 \\ bool\"\nwhere\n \"cr3_relation c c' \\ cr3_base_address c = cr3BaseAddress c' \\ cr3_pcid c = cr3pcid c'\"\n\nfun\n x64irqstate_to_abstract :: \"x64irqstate \\ X64IRQState\"\nwhere\n \"x64irqstate_to_abstract X64IRQFree = IRQFree\"\n| \"x64irqstate_to_abstract X64IRQReserved = IRQReserved\"\n| \"x64irqstate_to_abstract (X64IRQMSI bus dev func handle) = (IRQMSI bus dev func handle)\"\n| \"x64irqstate_to_abstract (X64IRQIOAPIC ioapic pin level polarity masked) =\n (IRQIOAPIC ioapic pin level polarity masked)\"\n\ndefinition\n x64_irq_relation :: \"(8 word \\ X64IRQState) \\ (8 word \\ x64irqstate) \\ bool\"\nwhere\n \"x64_irq_relation irq_states irq_states' \\ irq_states = x64irqstate_to_abstract o irq_states'\"\n\ndefinition\n arch_state_relation :: \"(arch_state \\ X64_H.kernel_state) set\"\nwhere\n \"arch_state_relation \\ {(s, s') .\n x64_asid_table s = x64KSASIDTable s' o ucast\n \\ x64_global_pml4 s = x64KSSKIMPML4 s'\n \\ x64_global_pdpts s = x64KSSKIMPDPTs s'\n \\ x64_global_pds s = x64KSSKIMPDs s'\n \\ x64_global_pts s = x64KSSKIMPTs s'\n \\ cr3_relation (x64_current_cr3 s) (x64KSCurrentUserCR3 s')\n \\ x64_kernel_vspace s = x64KSKernelVSpace s'\n \\ x64_allocated_io_ports s = x64KSAllocatedIOPorts s'\n \\ x64_num_ioapics s = x64KSNumIOAPICs s'\n \\ x64_irq_relation (x64_irq_state s) (x64KSIRQState s')}\"\n\ndefinition\n rights_mask_map :: \"rights set \\ Types_H.cap_rights\"\nwhere\n \"rights_mask_map \\ \\rs. CapRights (AllowWrite \\ rs) (AllowRead \\ rs) (AllowGrant \\ rs)\n (AllowGrantReply \\ rs)\"\n\n\nlemma obj_relation_cutsE:\n \"\\ (y, P) \\ obj_relation_cuts ko x; P ko ko';\n \\sz cs z cap cte. \\ ko = CNode sz cs; well_formed_cnode_n sz cs; y = cte_map (x, z);\n ko' = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte) \\\n \\ R;\n \\pt (z :: 9 word) pte'. \\ ko = ArchObj (PageTable pt); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPTE pte'); pte_relation' (pt z) pte' \\\n \\ R;\n \\pd (z :: 9 word) pde'. \\ ko = ArchObj (PageDirectory pd); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPDE pde'); pde_relation' (pd z) pde' \\\n \\ R;\n \\pdpt (z :: 9 word) pdpte'. \\ ko = ArchObj (PDPointerTable pdpt); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPDPTE pdpte'); pdpte_relation' (pdpt z) pdpte' \\\n \\ R;\n \\pml4 (z :: 9 word) pml4e'. \\ ko = ArchObj (PageMapL4 pml4); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPML4E pml4e'); pml4e_relation' (pml4 z) pml4e' \\\n \\ R;\n \\sz dev n. \\ ko = ArchObj (DataPage dev sz); ko' = (if dev then KOUserDataDevice else KOUserData);\n y = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits) \\ \\ R;\n \\ y = x; other_obj_relation ko ko'; is_other_obj_relation_type (a_type ko) \\ \\ R\n \\ \\ R\"\n apply (simp add: obj_relation_cuts_def2 is_other_obj_relation_type_def\n a_type_def\n split: Structures_A.kernel_object.split_asm if_split_asm\n X64_A.arch_kernel_obj.split_asm)\n apply ((clarsimp split: if_splits,\n force simp: cte_relation_def pte_relation_def pde_relation_def\n pdpte_relation_def pml4e_relation_def)+)\n done\n\nlemma eq_trans_helper:\n \"\\ x = y; P y = Q \\ \\ P x = Q\"\n by simp\n\nlemma cap_relation_case':\n \"cap_relation cap cap'\n = (case cap of cap.ArchObjectCap arch_cap.ASIDControlCap \\ cap_relation cap cap'\n | _ \\ cap_relation cap cap')\"\n by (simp split: cap.split arch_cap.split)\n\nschematic_goal cap_relation_case:\n \"cap_relation cap cap' = ?P\"\n apply (subst cap_relation_case')\n apply (clarsimp cong: cap.case_cong arch_cap.case_cong)\n apply (rule refl)\n done\n\nlemmas cap_relation_split =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split[where P=P]] for P\nlemmas cap_relation_split_asm =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split_asm[where P=P]] for P\n\n\n\ntext \\Relations on other data types that aren't stored but\n used as intermediate values in the specs.\\\n\nprimrec\n message_info_map :: \"Structures_A.message_info \\ Types_H.message_info\"\nwhere\n \"message_info_map (Structures_A.MI a b c d) = (Types_H.MI a b c d)\"\n\nlemma mi_map_label[simp]: \"msgLabel (message_info_map mi) = mi_label mi\"\n by (cases mi, simp)\n\nprimrec\n syscall_error_map :: \"ExceptionTypes_A.syscall_error \\ Fault_H.syscall_error\"\nwhere\n \"syscall_error_map (ExceptionTypes_A.InvalidArgument n) = Fault_H.InvalidArgument n\"\n| \"syscall_error_map (ExceptionTypes_A.InvalidCapability n) = (Fault_H.InvalidCapability n)\"\n| \"syscall_error_map ExceptionTypes_A.IllegalOperation = Fault_H.IllegalOperation\"\n| \"syscall_error_map (ExceptionTypes_A.RangeError n m) = Fault_H.RangeError n m\"\n| \"syscall_error_map ExceptionTypes_A.AlignmentError = Fault_H.AlignmentError\"\n| \"syscall_error_map (ExceptionTypes_A.FailedLookup b lf) = Fault_H.FailedLookup b (lookup_failure_map lf)\"\n| \"syscall_error_map ExceptionTypes_A.TruncatedMessage = Fault_H.TruncatedMessage\"\n| \"syscall_error_map ExceptionTypes_A.DeleteFirst = Fault_H.DeleteFirst\"\n| \"syscall_error_map ExceptionTypes_A.RevokeFirst = Fault_H.RevokeFirst\"\n| \"syscall_error_map (ExceptionTypes_A.NotEnoughMemory n) = Fault_H.syscall_error.NotEnoughMemory n\"\n\ndefinition\n APIType_map :: \"Structures_A.apiobject_type \\ X64_H.object_type\"\nwhere\n \"APIType_map ty \\ case ty of\n Structures_A.Untyped \\ APIObjectType ArchTypes_H.Untyped\n | Structures_A.TCBObject \\ APIObjectType ArchTypes_H.TCBObject\n | Structures_A.EndpointObject \\ APIObjectType ArchTypes_H.EndpointObject\n | Structures_A.NotificationObject \\ APIObjectType ArchTypes_H.NotificationObject\n | Structures_A.CapTableObject \\ APIObjectType ArchTypes_H.CapTableObject\n | ArchObject ao \\ (case ao of\n SmallPageObj \\ SmallPageObject\n | LargePageObj \\ LargePageObject\n | HugePageObj \\ HugePageObject\n | PageTableObj \\ PageTableObject\n | PageDirectoryObj \\ PageDirectoryObject\n | PDPTObj \\ PDPointerTableObject\n | PML4Obj \\ PML4Object)\"\n\ndefinition\n state_relation :: \"(det_state \\ kernel_state) set\"\nwhere\n \"state_relation \\ {(s, s').\n pspace_relation (kheap s) (ksPSpace s')\n \\ ekheap_relation (ekheap s) (ksPSpace s')\n \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\n \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\n \\ ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\n \\ cdt_relation (swp cte_at s) (cdt s) (ctes_of s')\n \\ cdt_list_relation (cdt_list s) (cdt s) (ctes_of s')\n \\ revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s')\n \\ (arch_state s, ksArchState s') \\ arch_state_relation\n \\ interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s')\n \\ (cur_thread s = ksCurThread s')\n \\ (idle_thread s = ksIdleThread s')\n \\ (machine_state s = ksMachineState s')\n \\ (work_units_completed s = ksWorkUnitsCompleted s')\n \\ (domain_index s = ksDomScheduleIdx s')\n \\ (domain_list s = ksDomSchedule s')\n \\ (cur_domain s = ksCurDomain s')\n \\ (domain_time s = ksDomainTime s')}\"\n\ntext \\Rules for using states in the relation.\\\n\nlemma curthread_relation:\n \"(a, b) \\ state_relation \\ ksCurThread b = cur_thread a\"\n by (simp add: state_relation_def)\n\nlemma state_relation_pspace_relation[elim!]:\n \"(s,s') \\ state_relation \\ pspace_relation (kheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relation_ekheap_relation[elim!]:\n \"(s,s') \\ state_relation \\ ekheap_relation (ekheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relationD:\n assumes sr: \"(s, s') \\ state_relation\"\n shows \"pspace_relation (kheap s) (ksPSpace s') \\\n ekheap_relation (ekheap s) (ksPSpace s') \\\n sched_act_relation (scheduler_action s) (ksSchedulerAction s') \\\n ready_queues_relation (ready_queues s) (ksReadyQueues s') \\\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') \\\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s') \\\n (arch_state s, ksArchState s') \\ arch_state_relation \\\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \\\n cur_thread s = ksCurThread s' \\\n idle_thread s = ksIdleThread s' \\\n machine_state s = ksMachineState s' \\\n work_units_completed s = ksWorkUnitsCompleted s' \\\n domain_index s = ksDomScheduleIdx s' \\\n domain_list s = ksDomSchedule s' \\\n cur_domain s = ksCurDomain s' \\\n domain_time s = ksDomainTime s'\"\n using sr unfolding state_relation_def by simp\n\nlemma state_relationE [elim?]:\n assumes sr: \"(s, s') \\ state_relation\"\n and rl: \"\\pspace_relation (kheap s) (ksPSpace s');\n ekheap_relation (ekheap s) (ksPSpace s');\n sched_act_relation (scheduler_action s) (ksSchedulerAction s');\n ready_queues_relation (ready_queues s) (ksReadyQueues s');\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s');\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s');\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s');\n (arch_state s, ksArchState s') \\ arch_state_relation;\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s');\n cur_thread s = ksCurThread s';\n idle_thread s = ksIdleThread s';\n machine_state s = ksMachineState s';\n work_units_completed s = ksWorkUnitsCompleted s';\n domain_index s = ksDomScheduleIdx s';\n domain_list s = ksDomSchedule s';\n cur_domain s = ksCurDomain s';\n domain_time s = ksDomainTime s' \\ \\ R\"\n shows \"R\"\n using sr by (blast intro!: rl dest: state_relationD)\n\ntext \\This isn't defined for arch objects\\\n\nlemmas isCap_defs =\n isZombie_def isArchObjectCap_def\n isThreadCap_def isCNodeCap_def isNotificationCap_def\n isEndpointCap_def isUntypedCap_def isNullCap_def\n isIRQHandlerCap_def isIRQControlCap_def isReplyCap_def\n isPageCap_def isPageTableCap_def isPageDirectoryCap_def\n isPDPointerTableCap_def isPML4Cap_def isIOPortCap_def\n isASIDControlCap_def isASIDPoolCap_def isArchPageCap_def\n isDomainCap_def isArchIOPortCap_def isIOPortControlCap_def\n isIOPortControlCap'_def\n\nlemma isCNodeCap_cap_map [simp]:\n \"cap_relation c c' \\ isCNodeCap c' = is_cnode_cap c\"\n apply (cases c, simp_all add: isCap_defs split: sum.splits)\n apply clarsimp+\n done\n\nlemma sts_rel_idle :\n \"thread_state_relation st IdleThreadState = (st = Structures_A.IdleThreadState)\"\n by (cases st, auto)\n\nlemma pspace_relation_absD:\n \"\\ ab x = Some y; pspace_relation ab con \\\n \\ \\(x', P) \\ obj_relation_cuts y x. \\z. con x' = Some z \\ P y z\"\n apply (clarsimp simp add: pspace_relation_def)\n apply (drule bspec, erule domI)\n apply simp\n apply (drule(1) bspec)\n apply (subgoal_tac \"a \\ pspace_dom ab\")\n apply clarsimp\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def rev_bexI)\n done\n\nlemma ekheap_relation_absD:\n \"\\ ab x = Some y; ekheap_relation ab con \\\n \\ \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation y tcb'\"\n by (force simp add: ekheap_relation_def)\n\nlemma in_related_pspace_dom:\n \"\\ s' x = Some y; pspace_relation s s' \\ \\ x \\ pspace_dom s\"\n by (clarsimp simp add: pspace_relation_def)\n\nlemma pspace_dom_revE:\n \"\\ x \\ pspace_dom ps; \\ko y P. \\ ps y = Some ko; (x, P) \\ obj_relation_cuts ko y \\ \\ R \\ \\ R\"\n by (clarsimp simp add: pspace_dom_def)\n\nlemma pspace_dom_relatedE:\n \"\\ s' x = Some ko'; pspace_relation s s';\n \\y ko P. \\ s y = Some ko; (x, P) \\ obj_relation_cuts ko y; P ko ko' \\ \\ R\n \\ \\ R\"\n apply (rule pspace_dom_revE [OF in_related_pspace_dom],\n assumption+)\n apply (frule(1) pspace_relation_absD)\n apply fastforce\n done\n\nlemma ghost_relation_typ_at:\n \"ghost_relation (kheap s) ups cns \\\n (\\a sz. data_at sz a s = (ups a = Some sz)) \\\n (\\a n. typ_at (ACapTable n) a s = (cns a = Some n))\"\n apply (rule eq_reflection)\n apply (clarsimp simp: ghost_relation_def typ_at_eq_kheap_obj data_at_def)\n apply (intro conjI impI iffI allI,simp_all)\n apply (auto elim!: allE)\n done\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/refine/X64/StateRelation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604272, "lm_q2_score": 0.28457601635158564, "lm_q1q2_score": 0.1577889961030498}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__32_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__32_on_rules imports n_g2kAbsAfter_lemma_on_inv__32\nbegin\nsection{*All lemmas on causal relation between inv__32*}\nlemma lemma_inv__32_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__32 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__32) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__32) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__32_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.1577742939612602}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__70_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__70_on_rules imports n_g2kAbsAfter_lemma_on_inv__70\nbegin\nsection{*All lemmas on causal relation between inv__70*}\nlemma lemma_inv__70_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__70 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__70) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__70) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__70_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.29421497216298875, "lm_q1q2_score": 0.15743396928283754}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__23_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__23_on_rules imports n_german_lemma_on_inv__23\nbegin\nsection{*All lemmas on causal relation between inv__23*}\nlemma lemma_inv__23_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv1 p__Inv2. p__Inv0\\N\\p__Inv1\\N\\p__Inv2\\N\\p__Inv0~=p__Inv1\\p__Inv0~=p__Inv2\\p__Inv1~=p__Inv2\\f=inv__23 p__Inv0 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__23) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__23) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__23_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.2942149659744614, "lm_q1q2_score": 0.15743396597136627}} {"text": "(* Title: JinjaThreads/Compiler/Correctness.thy\n Author: Andreas Lochbihler\n*)\n\nsection \\Correctness of both stages\\\n\ntheory Correctness \nimports\n J0Bisim\n J1Deadlock \n \"../Framework/FWBisimDeadlock\"\n Correctness2\n Correctness1Threaded\n Correctness1 \n JJ1WellForm\n Compiler\nbegin\n\nlocale J_JVM_heap_conf_base = \n J0_J1_heap_base\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n +\n J1_JVM_heap_conf_base \n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n hconf \"compP1 P\"\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and hconf :: \"'heap \\ bool\"\n and P :: \"'addr J_prog\"\nbegin\n\ndefinition bisimJ2JVM :: \n \"(('addr,'thread_id,'addr expr\\'addr locals,'heap,'addr) state, \n ('addr,'thread_id,'addr option \\ 'addr frame list,'heap,'addr) state) bisim\"\nwhere \"bisimJ2JVM = red_red0.mbisim \\\\<^sub>B red0_Red1'.mbisim \\\\<^sub>B mbisim_Red1'_Red1 \\\\<^sub>B Red1_execd.mbisim\"\n\ndefinition tlsimJ2JVM ::\n \"('thread_id \\ ('addr, 'thread_id, 'heap) J_thread_action,\n 'thread_id \\ ('addr, 'thread_id, 'heap) jvm_thread_action) bisim\"\nwhere \"tlsimJ2JVM = red_red0.mta_bisim \\\\<^sub>B red0_Red1'.mta_bisim \\\\<^sub>B (=) \\\\<^sub>B Red1_execd.mta_bisim\"\n\nend\n\nlemma compP2_has_method [simp]: \"compP2 P \\ C has M \\ P \\ C has M\"\nby(auto simp add: compP2_def compP_has_method)\n\nlocale J_JVM_conf_read = \n J1_JVM_conf_read\n addr2thread_id thread_id2addr\n spurious_wakeups\n empty_heap allocate typeof_addr heap_read heap_write \n hconf \"compP1 P\"\n for addr2thread_id :: \"('addr :: addr) \\ 'thread_id\"\n and thread_id2addr :: \"'thread_id \\ 'addr\"\n and spurious_wakeups :: bool\n and empty_heap :: \"'heap\"\n and allocate :: \"'heap \\ htype \\ ('heap \\ 'addr) set\"\n and typeof_addr :: \"'heap \\ 'addr \\ htype\"\n and heap_read :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ bool\"\n and heap_write :: \"'heap \\ 'addr \\ addr_loc \\ 'addr val \\ 'heap \\ bool\"\n and hconf :: \"'heap \\ bool\"\n and P :: \"'addr J_prog\"\nbegin\n\nsublocale J_JVM_heap_conf_base by(unfold_locales)\n\ntheorem bisimJ2JVM_weak_bisim:\n assumes wf: \"wf_J_prog P\"\n shows \"delay_bisimulation_diverge_final (mredT P) (execd_mthr.redT (J2JVM P)) bisimJ2JVM tlsimJ2JVM \n (red_mthr.m\\move P) (execd_mthr.m\\move (J2JVM P)) red_mthr.mfinal exec_mthr.mfinal\"\nunfolding bisimJ2JVM_def tlsimJ2JVM_def J2JVM_def o_apply\napply(rule delay_bisimulation_diverge_final_compose)\n apply(rule FWdelay_bisimulation_diverge.mthr_delay_bisimulation_diverge_final)\n apply(rule red_red0_FWbisim[OF wf_prog_wwf_prog[OF wf]])\napply(rule delay_bisimulation_diverge_final_compose)\n apply(rule FWdelay_bisimulation_diverge.mthr_delay_bisimulation_diverge_final)\n apply(rule red0_Red1'_FWweak_bisim[OF wf])\napply(rule delay_bisimulation_diverge_final_compose)\n apply(rule delay_bisimulation_diverge_final.intro)\n apply(rule bisimulation_into_delay.delay_bisimulation)\n apply(rule Red1'_Red1_bisim_into_weak[OF compP1_pres_wf[OF wf]])\n apply(rule bisimulation_final.delay_bisimulation_final_base)\n apply(rule Red1'_Red1_bisimulation_final[OF compP1_pres_wf[OF wf]])\napply(rule FWdelay_bisimulation_diverge.mthr_delay_bisimulation_diverge_final)\napply(rule Red1_exec1_FWwbisim[OF compP1_pres_wf[OF wf]])\ndone\n\n\nlemma bisimJ2JVM_start:\n assumes wf: \"wf_J_prog P\"\n and start: \"wf_start_state P C M vs\"\n shows \"bisimJ2JVM (J_start_state P C M vs) (JVM_start_state (J2JVM P) C M vs)\"\nusing assms\nunfolding bisimJ2JVM_def J2JVM_def o_def\napply(intro bisim_composeI)\n apply(erule (1) bisim_J_J0_start[OF wf_prog_wwf_prog])\n apply(erule (1) bisim_J0_J1_start)\n apply(erule bisim_J1_J1_start[OF compP1_pres_wf])\n apply simp\napply(erule bisim_J1_JVM_start[OF compP1_pres_wf])\napply simp\ndone\n\nend\n\nfun exception :: \"'addr expr \\ 'addr locals \\ 'addr option \\ 'addr frame list\"\nwhere \"exception (Throw a, xs) = (\\a\\, [])\"\n| \"exception _ = (None, [])\"\n\ndefinition mexception :: \n \"('addr,'thread_id,'addr expr\\'addr locals,'heap,'addr) state \\ \n ('addr,'thread_id,'addr option\\'addr frame list,'heap,'addr) state\"\nwhere\n \"\\ln. mexception s \\ \n (locks s, (\\t. case thr s t of \\(e, ln)\\ \\ \\(exception e, ln)\\ | None \\ None, shr s), wset s, interrupts s)\"\n\ndeclare compP1_def [simp del]\n\ncontext J_JVM_heap_conf_base begin\n\nlemma bisimJ2JVM_mfinal_mexception:\n assumes bisim: \"bisimJ2JVM s s'\"\n and fin: \"exec_mthr.mfinal s'\"\n and fin': \"red_mthr.mfinal s\"\n and tsNotEmpty: \"thr s t \\ None\"\n shows \"s' = mexception s\"\nproof -\n obtain ls ts m ws \"is\" where s: \"s = (ls, (ts, m), ws, is)\" by(cases s) fastforce\n from bisim obtain s0 s1 where bisimJ0: \"red_red0.mbisim s s0\"\n and bisim01: \"red0_Red1'.mbisim s0 s1\"\n and bisim1JVM: \"Red1_execd.mbisim s1 s'\"\n unfolding bisimJ2JVM_def by(fastforce simp add: mbisim_Red1'_Red1_def)\n from bisimJ0 s have [simp]: \"locks s0 = ls\" \"wset s0 = ws\" \"interrupts s0 = is\"\n and tbisimJ0: \"\\t. red_red0.tbisim (ws t = None) t (ts t) m (thr s0 t) (shr s0)\"\n by(auto simp add: red_red0.mbisim_def)\n from bisim01 have [simp]: \"locks s1 = ls\" \"wset s1 = ws\" \"interrupts s1 = is\"\n and tbisim01: \"\\t. red0_Red1'.tbisim (ws t = None) t (thr s0 t) (shr s0) (thr s1 t) (shr s1)\"\n by(auto simp add: red0_Red1'.mbisim_def)\n from bisim1JVM have \"locks s' = ls\" \"wset s' = ws\" \"interrupts s' = is\"\n and tbisim1JVM: \"\\t. Red1_execd.tbisim (ws t = None) t (thr s1 t) (shr s1) (thr s' t) (shr s')\"\n by(auto simp add: Red1_execd.mbisim_def)\n then obtain ts' m' where s': \"s' = (ls, (ts', m'), ws, is)\" by(cases s') fastforce\n { fix t e x ln\n assume tst: \"ts t = \\((e, x), ln)\\\"\n from tbisimJ0[of t] tst obtain e' exs' where ts0t: \"thr s0 t = \\((e', exs'), ln)\\\"\n and bisimtJ0: \"bisim_red_red0 ((e, x), m) ((e', exs'), shr s0)\"\n by(auto simp add: red_red0.tbisim_def)\n from tbisim01[of t] ts0t obtain e'' xs'' exs''\n where ts1t: \"thr s1 t = \\(((e'', xs''), exs''), ln)\\\"\n and bisimt01: \"bisim_red0_Red1 ((e', exs'), shr s0) (((e'', xs''), exs''), shr s1)\"\n by(auto simp add: red0_Red1'.tbisim_def)\n from tbisim1JVM[of t] ts1t s' obtain xcp frs\n where ts't: \"ts' t = \\((xcp, frs), ln)\\\" and [simp]: \"m' = shr s1\"\n and bisimt1JVM: \"bisim1_list1 t m' (e'', xs'') exs'' xcp frs\"\n by(fastforce simp add: Red1_execd.tbisim_def)\n\n from fin ts't s s' have [simp]: \"frs = []\" by(auto dest: exec_mthr.mfinalD)\n from bisimt1JVM have [simp]: \"exs'' = []\" by(auto elim: bisim1_list1.cases)\n from bisimt01 have [simp]: \"exs' = []\"\n by(auto simp add: bisim_red0_Red1_def elim!: bisim_list1E elim: bisim_list.cases)\n from tst fin' s have fine: \"final e\" by(auto dest: red_mthr.mfinalD)\n hence \"exception (e, x) = (xcp, frs)\"\n proof(cases)\n fix v\n assume [simp]: \"e = Val v\"\n from bisimtJ0 have \"e' = Val v\" by(auto elim!: bisim_red_red0.cases)\n with bisimt01 have \"e'' = Val v\" by(auto simp add: bisim_red0_Red1_def elim: bisim_list1E)\n with bisimt1JVM have \"xcp = None\" by(auto elim: bisim1_list1.cases)\n thus ?thesis by simp\n next\n fix a\n assume [simp]: \"e = Throw a\"\n from bisimtJ0 have \"e' = Throw a\" by(auto elim!: bisim_red_red0.cases)\n with bisimt01 have \"e'' = Throw a\" by(auto simp add: bisim_red0_Red1_def elim: bisim_list1E)\n with bisimt1JVM have \"xcp = \\a\\\" by(auto elim: bisim1_list1.cases)\n thus ?thesis by simp\n qed\n moreover from bisimtJ0 have \"shr s0 = m\" by(auto elim: bisim_red_red0.cases)\n moreover from bisimt01 have \"shr s1 = shr s0\" by(auto simp add: bisim_red0_Red1_def)\n ultimately have \"ts' t = \\(exception (e, x), ln)\\\" \"m' = m\" using ts't by simp_all }\n moreover {\n fix t\n assume \"ts t = None\"\n with red_red0.mbisim_thrNone_eq[OF bisimJ0, of t] s have \"thr s0 t = None\" by simp\n with bisim01 have \"thr s1 t = None\" by(auto simp add: red0_Red1'.mbisim_thrNone_eq)\n with bisim1JVM s' have \"ts' t = None\" by(simp add: Red1_execd.mbisim_thrNone_eq) }\n ultimately show ?thesis using s s' tsNotEmpty by(auto simp add: mexception_def fun_eq_iff)\nqed\n\nend\n\ncontext J_JVM_conf_read begin\n\ntheorem J2JVM_correct1:\n fixes C M vs\n defines s: \"s \\ J_start_state P C M vs\"\n and comps: \"cs \\ JVM_start_state (J2JVM P) C M vs\"\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"wf_start_state P C M vs\"\n and red: \"red_mthr.mthr.\\Runs P s \\\"\n obtains \\' \n where \"execd_mthr.mthr.\\Runs (J2JVM P) cs \\'\" \"tllist_all2 tlsimJ2JVM (rel_option bisimJ2JVM) \\ \\'\"\n and \"\\s'. \\ tfinite \\; terminal \\ = \\s'\\; red_mthr.mfinal s' \\\n \\ tfinite \\' \\ terminal \\' = \\mexception s'\\\"\n and \"\\s'. \\ tfinite \\; terminal \\ = \\s'\\; red_mthr.deadlock P s' \\\n \\ \\cs'. tfinite \\' \\ terminal \\' = \\cs'\\ \\ execd_mthr.deadlock (J2JVM P) cs' \\ bisimJ2JVM s' cs'\"\n and \"\\ tfinite \\; terminal \\ = None \\ \\ tfinite \\' \\ terminal \\' = None\"\n and \"\\ tfinite \\ \\ \\ tfinite \\'\"\nproof -\n from wf wf_start have bisim: \"bisimJ2JVM s cs\" unfolding s comps by(rule bisimJ2JVM_start)\n\n note divfin = delay_bisimulation_diverge_final.delay_bisimulation_diverge[OF bisimJ2JVM_weak_bisim[OF wf]]\n note divfin2 = delay_bisimulation_diverge_final.delay_bisimulation_final_base[OF bisimJ2JVM_weak_bisim[OF wf]]\n\n from delay_bisimulation_diverge.simulation_\\Runs1[OF divfin, OF bisim red] obtain \\' \n where exec: \"execd_mthr.mthr.\\Runs (J2JVM P) cs \\'\" \n and tlsim: \"tllist_all2 tlsimJ2JVM (rel_option bisimJ2JVM) \\ \\'\" by blast\n moreover {\n fix s'\n assume fin: \"tfinite \\\" and s': \"terminal \\ = \\s'\\\" and final: \"red_mthr.mfinal s'\"\n from delay_bisimulation_final_base.\\Runs_terminate_final1[OF divfin2, OF red exec tlsim fin s' final]\n obtain cs' where fin': \"tfinite \\'\" and cs': \"terminal \\' = \\cs'\\\"\n and final': \"exec_mthr.mfinal cs'\" by blast\n from tlsim fin s' cs' have bisim': \"bisimJ2JVM s' cs'\" by(auto dest: tllist_all2_tfinite1_terminalD)\n from red_mthr.mthr.\\Runs_into_\\rtrancl3p[OF red fin s'] \n have \"thr s' start_tid \\ None\" unfolding s\n by(rule red_mthr.\\rtrancl3p_redT_thread_not_disappear)(simp add: start_state_def)\n with bisim' final final' have [simp]: \"cs' = mexception s'\"\n by(intro bisimJ2JVM_mfinal_mexception disjI1)\n with fin' cs' have \"tfinite \\' \\ terminal \\' = \\mexception s'\\\" by simp }\n moreover {\n fix s'\n assume fin: \"tfinite \\\" and s': \"terminal \\ = \\s'\\\" and dead: \"red_mthr.deadlock P s'\"\n from tlsim fin s'\n obtain cs' where \"tfinite \\'\" and cs': \"terminal \\' = \\cs'\\\"\n and bisim': \"bisimJ2JVM s' cs'\"\n by(cases \"terminal \\'\")(fastforce dest: tllist_all2_tfinite1_terminalD tllist_all2_tfiniteD)+\n from bisim' obtain s0' s1' S1' where bisim0: \"red_red0.mbisim s' s0'\"\n and bisim01: \"red0_Red1'.mbisim s0' s1'\"\n and bisim11: \"mbisim_Red1'_Red1 s1' S1'\"\n and bisim12: \"Red1_execd.mbisim S1' cs'\"\n unfolding bisimJ2JVM_def by auto\n\n note b0 = red_red0_FWbisim[OF wf_prog_wwf_prog[OF wf]]\n note b01 = red0_Red1'_FWweak_bisim[OF wf]\n note b01mthr = FWdelay_bisimulation_diverge.mbisim_delay_bisimulation[OF b01]\n note b11 = Red1'_Red1_bisim_into_weak[OF compP1_pres_wf[OF wf]]\n note b11delay = bisimulation_into_delay.delay_bisimulation[OF b11]\n note b12 = Red1_exec1_FWwbisim[OF compP1_pres_wf[OF wf]]\n note b12mthr = FWdelay_bisimulation_diverge.mbisim_delay_bisimulation[OF b12]\n\n from FWdelay_bisimulation_diverge.deadlock1_imp_\\s_deadlock2[OF b0, OF bisim0 dead, of convert_RA]\n obtain s0'' where \"red0_mthr.mthr.silent_moves P s0' s0''\"\n and bisim0': \"red_red0.mbisim s' s0''\"\n and dead0: \"red0_mthr.deadlock P s0''\" by auto\n \n from delay_bisimulation_diverge.simulation_silents1[OF b01mthr, OF bisim01 \\red0_mthr.mthr.silent_moves P s0' s0''\\]\n obtain s1'' where \"Red1_mthr.mthr.silent_moves False (compP1 P) s1' s1''\"\n and \"red0_Red1'.mbisim s0'' s1''\" by auto\n from FWdelay_bisimulation_diverge.deadlock1_imp_\\s_deadlock2[OF b01, OF \\red0_Red1'.mbisim s0'' s1''\\ dead0, of convert_RA]\n obtain s1''' where \"Red1_mthr.mthr.silent_moves False (compP1 P) s1'' s1'''\"\n and dead1: \"Red1_mthr.deadlock False (compP1 P) s1'''\"\n and bisim01': \"red0_Red1'.mbisim s0'' s1'''\" by auto\n from \\Red1_mthr.mthr.silent_moves False (compP1 P) s1' s1''\\ \\Red1_mthr.mthr.silent_moves False (compP1 P) s1'' s1'''\\\n have \"Red1_mthr.mthr.silent_moves False (compP1 P) s1' s1'''\" by(rule rtranclp_trans)\n\n from delay_bisimulation_diverge.simulation_silents1[OF b11delay, OF bisim11 this]\n obtain S1'' where \"Red1_mthr.mthr.silent_moves True (compP1 P) S1' S1''\"\n and bisim11': \"mbisim_Red1'_Red1 s1''' S1''\" by auto\n from bisim11' have \"s1''' = S1''\" by(simp add: mbisim_Red1'_Red1_def)\n with dead1 have dead1': \"Red1_mthr.deadlock True (compP1 P) S1''\"\n by(simp add: Red1_Red1'_deadlock_inv)\n\n from delay_bisimulation_diverge.simulation_silents1[OF b12mthr, OF bisim12 \\Red1_mthr.mthr.silent_moves True (compP1 P) S1' S1''\\]\n obtain cs'' where \"execd_mthr.mthr.silent_moves (compP2 (compP1 P)) cs' cs''\"\n and \"Red1_execd.mbisim S1'' cs''\" by auto\n from FWdelay_bisimulation_diverge.deadlock1_imp_\\s_deadlock2[OF b12 \\Red1_execd.mbisim S1'' cs''\\ dead1', of convert_RA]\n obtain cs''' where \"execd_mthr.mthr.silent_moves (compP2 (compP1 P)) cs'' cs'''\"\n and bisim12': \"Red1_execd.mbisim S1'' cs'''\"\n and dead': \"execd_mthr.deadlock (compP2 (compP1 P)) cs'''\" by auto\n from \\execd_mthr.mthr.silent_moves (compP2 (compP1 P)) cs' cs''\\ \\execd_mthr.mthr.silent_moves (compP2 (compP1 P)) cs'' cs'''\\\n have \"execd_mthr.mthr.silent_moves (compP2 (compP1 P)) cs' cs'''\" by(rule rtranclp_trans)\n hence \"cs''' = cs'\" using execd_mthr.mthr.\\Runs_terminal_stuck[OF exec \\tfinite \\'\\ \\terminal \\' = \\cs'\\\\]\n by(cases rule: converse_rtranclpE)(fastforce simp add: J2JVM_def)+\n with dead' have \"execd_mthr.deadlock (J2JVM P) cs'\" by(simp add: J2JVM_def)\n hence \"\\cs'. tfinite \\' \\ terminal \\' = \\cs'\\ \\ execd_mthr.deadlock (J2JVM P) cs' \\ bisimJ2JVM s' cs'\"\n using \\tfinite \\'\\ \\terminal \\' = \\cs'\\\\ bisim' by blast }\n moreover {\n assume \"tfinite \\\" and \"terminal \\ = None\"\n hence \"tfinite \\' \\ terminal \\' = None\" using tlsim tllist_all2_tfiniteD[OF tlsim]\n by(cases \"terminal \\'\")(auto dest: tllist_all2_tfinite1_terminalD) }\n moreover {\n assume \"\\ tfinite \\\"\n hence \"\\ tfinite \\'\" using tlsim by(blast dest: tllist_all2_tfiniteD) }\n ultimately show thesis by(rule that)\nqed\n\ntheorem J2JVM_correct2:\n fixes C M vs\n defines s: \"s \\ J_start_state P C M vs\"\n and comps: \"cs \\ JVM_start_state (J2JVM P) C M vs\"\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"wf_start_state P C M vs\"\n and exec: \"execd_mthr.mthr.\\Runs (J2JVM P) cs \\'\"\n obtains \\ \n where \"red_mthr.mthr.\\Runs P s \\\" \"tllist_all2 tlsimJ2JVM (rel_option bisimJ2JVM) \\ \\'\"\n and \"\\cs'. \\ tfinite \\'; terminal \\' = \\cs'\\; exec_mthr.mfinal cs' \\\n \\ \\s'. tfinite \\ \\ terminal \\ = \\s'\\ \\ cs' = mexception s' \\ bisimJ2JVM s' cs'\"\n and \"\\cs'. \\ tfinite \\'; terminal \\' = \\cs'\\; execd_mthr.deadlock (J2JVM P) cs' \\\n \\ \\s'. tfinite \\ \\ terminal \\ = \\s'\\ \\ red_mthr.deadlock P s' \\ bisimJ2JVM s' cs'\"\n and \"\\ tfinite \\'; terminal \\' = None \\ \\ tfinite \\ \\ terminal \\ = None\"\n and \"\\ tfinite \\' \\ \\ tfinite \\\"\nproof -\n from wf wf_start have bisim: \"bisimJ2JVM s cs\" unfolding s comps by(rule bisimJ2JVM_start)\n\n note divfin = delay_bisimulation_diverge_final.delay_bisimulation_diverge[OF bisimJ2JVM_weak_bisim[OF wf]]\n note divfin2 = delay_bisimulation_diverge_final.delay_bisimulation_final_base[OF bisimJ2JVM_weak_bisim[OF wf]]\n\n from delay_bisimulation_diverge.simulation_\\Runs2[OF divfin, OF bisim exec] obtain \\\n where red: \"red_mthr.mthr.\\Runs P s \\\" \n and tlsim: \"tllist_all2 tlsimJ2JVM (rel_option bisimJ2JVM) \\ \\'\" by blast\n moreover {\n fix cs'\n assume fin: \"tfinite \\'\" and cs': \"terminal \\' = \\cs'\\\" and final: \"exec_mthr.mfinal cs'\"\n from delay_bisimulation_final_base.\\Runs_terminate_final2[OF divfin2, OF red exec tlsim fin cs' final]\n obtain s' where fin': \"tfinite \\\" and s': \"terminal \\ = \\s'\\\"\n and final': \"red_mthr.mfinal s'\" by blast\n from tlsim fin s' cs' have bisim': \"bisimJ2JVM s' cs'\" by(auto dest: tllist_all2_tfinite2_terminalD)\n from red_mthr.mthr.\\Runs_into_\\rtrancl3p[OF red fin' s'] \n have \"thr s' start_tid \\ None\" unfolding s\n by(rule red_mthr.\\rtrancl3p_redT_thread_not_disappear)(simp add: start_state_def)\n with bisim' final final' have [simp]: \"cs' = mexception s'\"\n by(intro bisimJ2JVM_mfinal_mexception)\n with fin' s' bisim' have \"\\s'. tfinite \\ \\ terminal \\ = \\s'\\ \\ cs' = mexception s' \\ bisimJ2JVM s' cs'\" by simp }\n moreover {\n fix cs'\n assume fin: \"tfinite \\'\" and cs': \"terminal \\' = \\cs'\\\" and dead': \"execd_mthr.deadlock (J2JVM P) cs'\"\n from tlsim fin cs'\n obtain s' where \"tfinite \\\" and s': \"terminal \\ = \\s'\\\"\n and bisim': \"bisimJ2JVM s' cs'\"\n by(cases \"terminal \\\")(fastforce dest: tllist_all2_tfinite2_terminalD tllist_all2_tfiniteD)+\n from bisim' obtain s0' s1' S1' where bisim0: \"red_red0.mbisim s' s0'\"\n and bisim01: \"red0_Red1'.mbisim s0' s1'\"\n and bisim11: \"mbisim_Red1'_Red1 s1' S1'\"\n and bisim12: \"Red1_execd.mbisim S1' cs'\"\n unfolding bisimJ2JVM_def by auto\n\n note b0 = red_red0_FWbisim[OF wf_prog_wwf_prog[OF wf]]\n note b0mthr = FWdelay_bisimulation_diverge.mbisim_delay_bisimulation[OF b0]\n note b01 = red0_Red1'_FWweak_bisim[OF wf]\n note b01mthr = FWdelay_bisimulation_diverge.mbisim_delay_bisimulation[OF b01]\n note b11 = Red1'_Red1_bisim_into_weak[OF compP1_pres_wf[OF wf]]\n note b11delay = bisimulation_into_delay.delay_bisimulation[OF b11]\n note b12 = Red1_exec1_FWwbisim[OF compP1_pres_wf[OF wf]]\n\n from FWdelay_bisimulation_diverge.deadlock2_imp_\\s_deadlock1[OF b12 bisim12, of convert_RA] dead'\n obtain S1'' where \"Red1_mthr.mthr.silent_moves True (compP1 P) S1' S1''\"\n and bisim12': \"Red1_execd.mbisim S1'' cs'\"\n and dead': \"Red1_mthr.deadlock True (compP1 P) S1''\" by(auto simp add: J2JVM_def)\n from delay_bisimulation_diverge.simulation_silents2[OF b11delay, OF bisim11 \\Red1_mthr.mthr.silent_moves True (compP1 P) S1' S1''\\]\n obtain s1'' where \"Red1_mthr.mthr.silent_moves False (compP1 P) s1' s1''\"\n and bisim11': \"mbisim_Red1'_Red1 s1'' S1''\" by blast\n from bisim11' have \"s1'' = S1''\" by(simp add: mbisim_Red1'_Red1_def)\n with dead' have dead1: \"Red1_mthr.deadlock False (compP1 P) s1''\"\n by(simp add: Red1_Red1'_deadlock_inv)\n from delay_bisimulation_diverge.simulation_silents2[OF b01mthr, OF bisim01 \\Red1_mthr.mthr.silent_moves False (compP1 P) s1' s1''\\]\n obtain s0'' where \"red0_mthr.mthr.silent_moves P s0' s0''\"\n and bisim01': \"red0_Red1'.mbisim s0'' s1''\" by auto\n from FWdelay_bisimulation_diverge.deadlock2_imp_\\s_deadlock1[OF b01 bisim01' dead1, of convert_RA]\n obtain s0''' where \"red0_mthr.mthr.silent_moves P s0'' s0'''\"\n and bisim01'': \"red0_Red1'.mbisim s0''' s1''\"\n and dead0: \"red0_mthr.deadlock P s0'''\" by auto\n from \\red0_mthr.mthr.silent_moves P s0' s0''\\ \\red0_mthr.mthr.silent_moves P s0'' s0'''\\\n have \"red0_mthr.mthr.silent_moves P s0' s0'''\" by(rule rtranclp_trans)\n from delay_bisimulation_diverge.simulation_silents2[OF b0mthr, OF bisim0 this]\n obtain s'' where \"red_mthr.mthr.silent_moves P s' s''\" \n and \"red_red0.mbisim s'' s0'''\" by blast\n from FWdelay_bisimulation_diverge.deadlock2_imp_\\s_deadlock1[OF b0 \\red_red0.mbisim s'' s0'''\\ dead0, of convert_RA]\n obtain s''' where \"red_mthr.mthr.silent_moves P s'' s'''\" \n and \"red_red0.mbisim s''' s0'''\"\n and dead: \"red_mthr.deadlock P s'''\" by blast\n from \\red_mthr.mthr.silent_moves P s' s''\\ \\red_mthr.mthr.silent_moves P s'' s'''\\\n have \"red_mthr.mthr.silent_moves P s' s'''\" by(rule rtranclp_trans)\n hence \"s''' = s'\" using red_mthr.mthr.\\Runs_terminal_stuck[OF red \\tfinite \\\\ \\terminal \\ = \\s'\\\\]\n by(cases rule: converse_rtranclpE) fastforce+\n with dead have \"red_mthr.deadlock P s'\" by(simp)\n hence \"\\s'. tfinite \\ \\ terminal \\ = \\s'\\ \\ red_mthr.deadlock P s' \\ bisimJ2JVM s' cs'\"\n using \\tfinite \\\\ \\terminal \\ = \\s'\\\\ bisim' by blast }\n moreover {\n assume \"tfinite \\'\" and \"terminal \\' = None\"\n hence \"tfinite \\ \\ terminal \\ = None\" using tlsim tllist_all2_tfiniteD[OF tlsim]\n by(cases \"terminal \\\")(auto dest: tllist_all2_tfinite2_terminalD) }\n moreover {\n assume \"\\ tfinite \\'\"\n hence \"\\ tfinite \\\" using tlsim by(blast dest: tllist_all2_tfiniteD) }\n ultimately show thesis by(rule that)\nqed\n\nend\n\ndeclare compP1_def [simp]\n\ntheorem wt_J2JVM: \"wf_J_prog P \\ wf_jvm_prog (J2JVM P)\"\nunfolding J2JVM_def o_def\nby(rule wt_compP2)(rule compP1_pres_wf)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Compiler/Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.29421495978593404, "lm_q1q2_score": 0.157433962659895}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__107.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__107 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__107 and some rule r*}\nlemma n_PI_Remote_GetVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Get src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_GetXVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_GetX src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_PutXVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Remote_ReplaceVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_PI_Remote_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_NakVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Nak dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_PutVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_NakVsinv__107:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_PutVsinv__107:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_Get_Put_HomeVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const true))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''UniMsg'') p__Inv4) ''Cmd'')) (Const UNI_GetX)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__107:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__107:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__107:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__107:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_NakVsinv__107:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutXVsinv__107:\nassumes a1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src dst where a1:\"src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\dst~=p__Inv4)\\(src~=p__Inv4\\dst=p__Inv4)\\(src~=p__Inv4\\dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\dst~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_Put dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_PutXVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvVsinv__107:\nassumes a1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_NI_Inv dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__107 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_WbVsinv__107:\n assumes a1: \"r=n_NI_Wb \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__107:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__107:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_1Vsinv__107:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_1 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__107:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__107:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__107:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__107:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__107:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ShWbVsinv__107:\n assumes a1: \"r=n_NI_ShWb N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__0 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__107:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__107:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutXAcksDoneVsinv__107:\n assumes a1: \"r=n_NI_Local_PutXAcksDone \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__107:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__107:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__107:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_PutVsinv__107:\n assumes a1: \"r=n_NI_Local_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__107:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__107:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__107:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__107:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__107:\n assumes a1: \"r=n_PI_Local_GetX_PutX_HeadVld__part__1 N \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__107:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__107 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__107.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.3007455852086007, "lm_q1q2_score": 0.1574163591509447}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__37_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__37_on_rules imports n_german_lemma_on_inv__37\nbegin\nsection{*All lemmas on causal relation between inv__37*}\nlemma lemma_inv__37_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__37 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__37) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__37) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__37_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.3007455664065234, "lm_q1q2_score": 0.1574163493095549}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__92_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__92_on_rules imports n_g2kAbsAfter_lemma_on_inv__92\nbegin\nsection{*All lemmas on causal relation between inv__92*}\nlemma lemma_inv__92_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__92 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__92) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__92) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__92_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.3073580105206753, "lm_q1q2_score": 0.15728019757226705}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchUntyped_AI\nimports \"../Untyped_AI\"\nbegin\n\ncontext Arch begin global_naming ARM\n\nnamed_theorems Untyped_AI_assms\n\nlemma of_bl_nat_to_cref[Untyped_AI_assms]:\n \"\\ x < 2 ^ bits; bits < word_bits \\\n \\ (of_bl (nat_to_cref bits x) :: machine_word) = of_nat x\"\n apply (clarsimp intro!: less_mask_eq\n simp: nat_to_cref_def of_drop_to_bl\n word_size word_less_nat_alt word_bits_def)\n apply (subst unat_of_nat)\n apply (erule order_le_less_trans [OF mod_less_eq_dividend])\n done\n\n\nlemma cnode_cap_ex_cte[Untyped_AI_assms]:\n \"\\ is_cnode_cap cap; cte_wp_at (\\c. \\m. cap = mask_cap m c) p s;\n (s::'state_ext::state_ext state) \\ cap; valid_objs s; pspace_aligned s \\ \\\n ex_cte_cap_wp_to is_cnode_cap (obj_ref_of cap, nat_to_cref (bits_of cap) x) s\"\n apply (simp only: ex_cte_cap_wp_to_def)\n apply (rule exI, erule cte_wp_at_weakenE)\n apply (clarsimp simp: is_cap_simps bits_of_def)\n apply (case_tac c, simp_all add: mask_cap_def cap_rights_update_def split:bool.splits)\n apply (clarsimp simp: nat_to_cref_def word_bits_def)\n apply (erule(2) valid_CNodeCapE)\n apply (simp add: word_bits_def cte_level_bits_def)\n done\n\n\n\nlemma inj_on_nat_to_cref[Untyped_AI_assms]:\n \"bits < 32 \\ inj_on (nat_to_cref bits) {..< 2 ^ bits}\"\n apply (rule inj_onI)\n apply (drule arg_cong[where f=\"\\x. replicate (32 - bits) False @ x\"])\n apply (subst(asm) word_bl.Abs_inject[where 'a=32, symmetric])\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: nat_to_cref_def word_bits_def)\n apply (simp add: of_bl_rep_False of_bl_nat_to_cref[simplified word_bits_def])\n apply (erule word_unat.Abs_eqD)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp+)\n apply (simp only: unats_def mem_simps)\n apply (erule order_less_le_trans)\n apply (rule power_increasing, simp+)\n done\n\n\nlemma data_to_obj_type_sp[Untyped_AI_assms]:\n \"\\P\\ data_to_obj_type x \\\\ts (s::'state_ext::state_ext state). ts \\ ArchObject ASIDPoolObj \\ P s\\, -\"\n unfolding data_to_obj_type_def\n apply (rule hoare_pre)\n apply (wp|wpc)+\n apply clarsimp\n apply (simp add: arch_data_to_obj_type_def split: if_split_asm)\n done\n\nlemma dui_inv_wf[wp, Untyped_AI_assms]:\n \"\\invs and cte_wp_at ((=) (cap.UntypedCap dev w sz idx)) slot\n and (\\s. \\cap \\ set cs. is_cnode_cap cap\n \\ (\\r\\cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))\n and (\\s. \\x \\ set cs. s \\ x)\\\n decode_untyped_invocation label args slot (cap.UntypedCap dev w sz idx) cs\n \\valid_untyped_inv\\,-\"\nproof -\n have inj: \"\\node_cap s. \\is_cnode_cap node_cap;\n unat (args ! 5) \\ 2 ^ bits_of node_cap - unat (args ! 4);valid_cap node_cap s\\ \\\n inj_on (Pair (obj_ref_of node_cap) \\ nat_to_cref (bits_of node_cap))\n {unat (args ! 4)..S a f s. (\\x\\S. cte_wp_at ((=) cap.NullCap) (a, f x) s)\n \\ cte_wp_at (\\c. c \\ cap.NullCap) slot s\n \\ slot \\ (Pair a \\ f) ` S\"\n by (auto simp:cte_wp_at_caps_of_state)\n show ?thesis\n apply (simp add: decode_untyped_invocation_def unlessE_def[symmetric]\n unlessE_whenE\n split del: if_split)\n apply (rule validE_R_sp[OF whenE_throwError_sp]\n validE_R_sp[OF data_to_obj_type_sp]\n validE_R_sp[OF dui_sp_helper] validE_R_sp[OF map_ensure_empty])+\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp whenE_throwError_wp[THEN validE_validE_R] check_children_wp\n map_ensure_empty_wp)\n apply (clarsimp simp: distinct_map cases_imp_eq)\n apply (subgoal_tac \"s \\ node_cap\")\n prefer 2\n apply (erule disjE)\n apply (drule bspec [where x = \"cs ! 0\"],clarsimp)+\n apply fastforce\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) caps_of_state_valid[rotated])+\n apply assumption\n apply (subgoal_tac \"\\r\\cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s\")\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule(1) caps_of_state_valid[rotated])\n apply (clarsimp simp: not_less)\n apply (frule(2) inj)\n apply (clarsimp simp: comp_def)\n apply (frule(1) caps_of_state_valid)\n apply (simp add: nasty_strengthen[unfolded o_def] cte_wp_at_caps_of_state)\n apply (intro conjI)\n apply (intro impI)\n apply (frule range_cover_stuff[where w=w and rv = 0 and sz = sz], simp_all)[1]\n apply (clarsimp simp: valid_cap_simps cap_aligned_def)+\n apply (frule alignUp_idem[OF is_aligned_weaken,where a = w])\n apply (erule range_cover.sz)\n apply (simp add: range_cover_def)\n apply (clarsimp simp: get_free_ref_def empty_descendants_range_in)\n apply (rule conjI[rotated], blast, clarsimp)\n apply (drule_tac x = \"(obj_ref_of node_cap,nat_to_cref (bits_of node_cap) slota)\" in bspec)\n apply (clarsimp simp: is_cap_simps nat_to_cref_def word_bits_def\n bits_of_def valid_cap_simps cap_aligned_def)+\n apply (simp add: free_index_of_def)\n apply (frule(1) range_cover_stuff[where sz = sz])\n apply (clarsimp dest!: valid_cap_aligned simp: cap_aligned_def word_bits_def)+\n apply simp+\n apply (clarsimp simp: get_free_ref_def)\n apply (erule disjE)\n apply (drule_tac x= \"cs!0\" in bspec)\n subgoal by clarsimp\n subgoal by simp\n apply (clarsimp simp: cte_wp_at_caps_of_state ex_cte_cap_wp_to_def)\n apply (rule_tac x=aa in exI,rule exI,rule exI)\n apply (rule conjI, assumption)\n apply simp\n done\nqed\n\nlemma asid_bits_ge_0:\n \"(0::word32) < 2 ^ asid_bits\" by (simp add: asid_bits_def)\n\nlemma retype_ret_valid_caps_captable[Untyped_AI_assms]:\n \"\\pspace_no_overlap_range_cover ptr sz (s::'state_ext::state_ext state) \\ 0 < us\n \\ range_cover ptr sz (obj_bits_api CapTableObject us) n \\ ptr \\ 0\n \\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object CapTableObject dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api CapTableObject us)) [0.. \\ CNodeCap (ptr_add ptr (y * 2 ^ obj_bits_api CapTableObject us)) us []\"\nby ((clarsimp simp:valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def | rule conjI | intro conjI obj_at_foldr_intro imageI\n | rule is_aligned_add_multI[OF _ le_refl],\n (simp add:range_cover_def word_bits_def obj_bits_api_def slot_bits_def)+)+)[1]\n\nlemma retype_ret_valid_caps_aobj[Untyped_AI_assms]:\n \"\\ptr sz (s::'state_ext::state_ext state) x6 us n.\n \\pspace_no_overlap_range_cover ptr sz s \\ x6 \\ ASIDPoolObj \\\n range_cover ptr sz (obj_bits_api (ArchObject x6) us) n \\ ptr \\ 0\\\n \\ \\y\\{0..kheap := foldr (\\p kh. kh(p \\ default_object (ArchObject x6) dev us)) (map (\\p. ptr_add ptr (p * 2 ^ obj_bits_api (ArchObject x6) us)) [0.. \\ ArchObjectCap (ARM_A.arch_default_cap x6 (ptr_add ptr (y * 2 ^ obj_bits_api (ArchObject x6) us)) us dev)\"\n apply (rename_tac aobject_type us n)\n apply (case_tac aobject_type)\n by (clarsimp simp: valid_cap_def default_object_def cap_aligned_def\n cte_level_bits_def is_obj_defs well_formed_cnode_n_def empty_cnode_def\n dom_def arch_default_cap_def ptr_add_def\n | intro conjI obj_at_foldr_intro\n imageI valid_vm_rights_def\n | rule is_aligned_add_multI[OF _ le_refl]\n | fastforce simp:range_cover_def obj_bits_api_def\n default_arch_object_def valid_vm_rights_def word_bits_def a_type_def)+\n\n\n\nlemma copy_global_mappings_hoare_lift:(*FIXME: arch_split \\ these do not seem to be used globally *)\n assumes wp: \"\\ptr val. \\Q\\ store_pde ptr val \\\\rv. Q\\\"\n shows \"\\Q\\ copy_global_mappings pd \\\\rv. Q\\\"\n apply (simp add: copy_global_mappings_def)\n apply (wp mapM_x_wp' wp)\n done\n\nlemma init_arch_objects_hoare_lift:\n assumes wp: \"\\oper. \\(P::'state_ext::state_ext state\\bool)\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\ptr val. \\P\\ store_pde ptr val \\\\rv. P\\\"\n shows \"\\P and Q\\ init_arch_objects tp ptr sz us adds \\\\rv. Q\\\"\nproof -\n have pres: \"\\oper. \\P and Q\\ do_machine_op oper \\\\rv :: unit. Q\\\"\n \"\\P and Q\\ return () \\\\rv. Q\\\"\n by (wp wp | simp)+\n show ?thesis\n apply (simp add: init_arch_objects_def\n pres reserve_region_def unless_def when_def\n split: Structures_A.apiobject_type.split\n aobject_type.split)\n apply clarsimp\n apply (rule hoare_pre)\n apply (wp mapM_x_wp' copy_global_mappings_hoare_lift wp)\n apply simp\n done\nqed\n\ncrunch pdistinct[wp]: do_machine_op \"pspace_distinct\"\ncrunch vmdb[wp]: do_machine_op \"valid_mdb\"\ncrunch mdb[wp]: do_machine_op \"\\s. P (cdt s)\"\ncrunch cte_wp_at[wp]: do_machine_op \"\\s. P (cte_wp_at P' p s)\"\n\nlemma cap_refs_in_kernel_windowD2:\n \"\\ cte_wp_at P p (s::'state_ext::state_ext state); cap_refs_in_kernel_window s \\\n \\ \\cap. P cap \\ region_in_kernel_window (cap_range cap) s\"\n apply (clarsimp simp: cte_wp_at_caps_of_state region_in_kernel_window_def)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply fastforce\n done\n\nlemma init_arch_objects_descendants_range[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). descendants_range x cref s \\ init_arch_objects ty ptr n us y\n \\\\rv s. descendants_range x cref s\\\"\n apply (simp add:descendants_range_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply (wps do_machine_op_mdb)\n apply (wp hoare_vcg_ball_lift)\n apply (rule hoare_pre)\n apply (wps store_pde_mdb_inv)\n apply wp\n apply simp\n apply fastforce\n done\n\n\n\nlemma init_arch_objects_caps_overlap_reserved[wp,Untyped_AI_assms]:\n \"\\\\(s::'state_ext::state_ext state). caps_overlap_reserved S s\\\n init_arch_objects ty ptr n us y\n \\\\rv s. caps_overlap_reserved S s\\\"\n apply (simp add:caps_overlap_reserved_def)\n apply (rule hoare_pre)\n apply (wp retype_region_mdb init_arch_objects_hoare_lift)\n apply fastforce\n done\n\nlemma set_untyped_cap_invs_simple[Untyped_AI_assms]:\n \"\\\\s. descendants_range_in {ptr .. ptr+2^sz - 1} cref s \\ pspace_no_overlap_range_cover ptr sz s \\ invs s\n \\ cte_wp_at (\\c. is_untyped_cap c \\ cap_bits c = sz \\ obj_ref_of c = ptr \\ cap_is_device c = dev) cref s \\ idx \\ 2^ sz\\\n set_cap (cap.UntypedCap dev ptr sz idx) cref\n \\\\rv s. invs s\\\"\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: cte_wp_at_caps_of_state invs_def valid_state_def)\n apply (rule hoare_pre)\n apply (wp set_free_index_valid_pspace_simple set_cap_valid_mdb_simple\n set_cap_idle update_cap_ifunsafe)\n apply (simp add:valid_irq_node_def)\n apply wps\n apply (wp hoare_vcg_all_lift set_cap_irq_handlers set_cap_valid_arch_caps\n set_cap_irq_handlers cap_table_at_lift_valid set_cap_typ_at\n set_untyped_cap_refs_respects_device_simple)\n apply (clarsimp simp:cte_wp_at_caps_of_state is_cap_simps)\n apply (intro conjI,clarsimp)\n apply (rule ext,clarsimp simp:is_cap_simps)\n apply (clarsimp split:cap.splits simp:is_cap_simps appropriate_cte_cap_def)\n apply (drule(1) if_unsafe_then_capD[OF caps_of_state_cteD])\n apply clarsimp\n apply (clarsimp simp:is_cap_simps ex_cte_cap_wp_to_def appropriate_cte_cap_def cte_wp_at_caps_of_state)\n apply (clarsimp dest!:valid_global_refsD2 simp:cap_range_def)\n apply (simp add:valid_irq_node_def)\n apply (clarsimp simp:valid_irq_node_def)\n apply (clarsimp simp:no_cap_to_obj_with_diff_ref_def cte_wp_at_caps_of_state vs_cap_ref_def)\n apply (case_tac cap)\n apply (simp_all add:vs_cap_ref_def table_cap_ref_def)\n apply (rename_tac arch_cap)\n apply (case_tac arch_cap)\n apply simp_all\n apply (clarsimp simp:cap_refs_in_kernel_window_def\n valid_refs_def simp del:split_paired_All)\n apply (drule_tac x = cref in spec)\n apply (clarsimp simp:cte_wp_at_caps_of_state)\n apply fastforce\n done\n\n\nlemma pbfs_atleast_pageBits':\n \"pageBits \\ pageBitsForSize sz\"by (cases sz, simp_all add: pageBits_def)\n\n\nlemma pbfs_less_wb':\n \"pageBitsForSize sz < word_bits\"by (cases sz, simp_all add: word_bits_conv pageBits_def)\n\nlemma delete_objects_rewrite[Untyped_AI_assms]:\n \"\\ word_size_bits \\ sz; sz\\ word_bits; ptr && ~~ mask sz = ptr \\\n \\ delete_objects ptr sz =\n do y \\ modify (clear_um {ptr + of_nat k |k. k < 2 ^ sz});\n modify (detype {ptr && ~~ mask sz..ptr + 2 ^ sz - 1})\n od\"\n apply (clarsimp simp: delete_objects_def freeMemory_def word_size_def word_size_bits_def)\n apply (subgoal_tac \"is_aligned (ptr &&~~ mask sz) sz\")\n apply (subst mapM_storeWord_clear_um[simplified word_size_def word_size_bits_def])\n apply (simp)\n apply simp\n apply (simp add:range_cover_def)\n apply clarsimp\n apply (rule is_aligned_neg_mask)\n apply simp\n done\n\ndeclare store_pde_pred_tcb_at [wp]\n\n(* nonempty_table *)\ndefinition\n nonempty_table :: \"machine_word set \\ Structures_A.kernel_object \\ bool\"\nwhere\n \"nonempty_table S ko \\\n (a_type ko = AArch APageTable \\ a_type ko = AArch APageDirectory)\n \\ \\ empty_table S ko\"\n\nlemma reachable_pg_cap_exst_update[simp]:\n \"reachable_pg_cap x (trans_state f (s::'state_ext::state_ext state)) = reachable_pg_cap x s\"\n by (simp add: reachable_pg_cap_def vs_lookup_pages_def\n vs_lookup_pages1_def obj_at_def)\n\nlemma create_cap_valid_arch_caps[wp, Untyped_AI_assms]:\n \"\\valid_arch_caps\n and valid_cap (default_cap tp oref sz dev)\n and (\\(s::'state_ext::state_ext state). \\r\\obj_refs (default_cap tp oref sz dev).\n (\\p'. \\ cte_wp_at (\\cap. r \\ obj_refs cap) p' s)\n \\ \\ obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n and cte_wp_at ((=) cap.NullCap) cref\n and K (tp \\ ArchObject ASIDPoolObj)\\\n create_cap tp sz p dev (cref, oref) \\\\rv. valid_arch_caps\\\"\n apply (simp add: create_cap_def set_cdt_def)\n apply (wp set_cap_valid_arch_caps)\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n apply (wp hoare_vcg_disj_lift hoare_vcg_conj_lift hoare_vcg_all_lift hoare_vcg_imp_lift | simp)+\n apply (clarsimp simp del: split_paired_All split_paired_Ex\n imp_disjL\n simp: cte_wp_at_caps_of_state)\n apply (rule conjI)\n apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def\n cte_wp_at_caps_of_state)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply (case_tac cref, fastforce)\n apply (simp add: obj_ref_none_no_asid)\n apply (rule conjI)\n apply (auto simp: is_cap_simps valid_cap_def second_level_tables_def\n obj_at_def nonempty_table_def a_type_simps)[1]\n apply (clarsimp simp del: imp_disjL)\n apply (case_tac \"\\x. x \\ obj_refs cap\")\n apply (clarsimp dest!: obj_ref_elemD)\n apply fastforce\n apply (auto simp: is_cap_simps)[1]\n done\n\nlemma create_cap_cap_refs_in_kernel_window[wp, Untyped_AI_assms]:\n \"\\cap_refs_in_kernel_window and cte_wp_at (\\c. cap_range (default_cap tp oref sz dev) \\ cap_range c) p\\\n create_cap tp sz p dev (cref, oref) \\\\rv. cap_refs_in_kernel_window\\\"\n apply (simp add: create_cap_def)\n apply (wp | simp)+\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule(1) cap_refs_in_kernel_windowD)\n apply blast\n done\n\ncrunch irq_node[wp]: store_pde \"\\s. P (interrupt_irq_node s)\"\n (wp: crunch_wps)\n\n(* make these available in the generic theory? *)\nlemma init_arch_objects_irq_node[wp]:\n \"\\\\s. P (interrupt_irq_node s)\\ init_arch_objects tp ptr bits us refs \\\\rv s. P (interrupt_irq_node s)\\\"\n by (wp init_arch_objects_hoare_lift, simp)\n\nlemma init_arch_objects_excap[wp]:\n \"\\ex_cte_cap_wp_to P p\\ init_arch_objects tp ptr bits us refs \\\\rv. ex_cte_cap_wp_to P p\\\"\n by (wp ex_cte_cap_to_pres init_arch_objects_irq_node init_arch_objects_cte_wp_at)\n\ncrunch nonempty_table[wp]: do_machine_op\n \"\\s. P' (obj_at (nonempty_table (set (arm_global_pts (arch_state s)))) r s)\"\n\nlemma store_pde_weaken:\n \"\\\\s. page_directory_at (p && ~~ mask pd_bits) s \\ P s\\ store_pde p e \\Q\\ =\n \\P\\ store_pde p e \\Q\\\"\n apply (rule iffI)\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (simp add: valid_def)\n apply (erule allEI)\n apply clarsimp\n apply (rule use_valid, assumption)\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def a_type_simps)\n apply (drule bspec, assumption)\n apply (simp add: simpler_store_pde_def obj_at_def fun_upd_def\n split: Structures_A.kernel_object.splits arch_kernel_obj.splits)\n done\n\nlemma store_pde_nonempty_table:\n \"\\\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ (\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s)))\n \\ ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\n \\ valid_pde_mappings pde\\\n store_pde pde_ptr pde\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def nonempty_table_def a_type_def)\n apply (clarsimp simp add: empty_table_def second_level_tables_def)\n done\n\nlemma store_pde_global_global_objs:\n \"\\\\s. valid_global_objs s\n \\ (\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s)))\n \\ ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\n \\ valid_pde_mappings pde\\\n store_pde pde_ptr pde\n \\\\rv s. valid_global_objs s\\\"\n apply (simp add: store_pde_def set_pd_def set_object_def)\n apply (wp get_object_wp)\n apply (clarsimp simp: obj_at_def fun_upd_def[symmetric])\nproof -\n fix s pd\n assume vg: \"valid_global_objs s\"\n and gr: \"\\rf. pde_ref pde = Some rf \\\n rf \\ set (arm_global_pts (arch_state s))\"\n and uc: \"ucast (pde_ptr && mask pd_bits >> 2) \\ kernel_mapping_slots\"\n and vp: \"valid_pde_mappings pde\"\n and pd: \"kheap s (pde_ptr && ~~ mask pd_bits) =\n Some (ArchObj (PageDirectory pd))\"\n let ?ko' = \"ArchObj (PageDirectory\n (pd(ucast (pde_ptr && mask pd_bits >> 2) := pde)))\"\n let ?s' = \"s\\kheap := kheap s(pde_ptr && ~~ mask pd_bits \\ ?ko')\\\"\n have typ_at: \"\\T p. typ_at T p s \\ typ_at T p ?s'\"\n using pd\n by (clarsimp simp: obj_at_def a_type_def)\n have valid_pde: \"\\pde. valid_pde pde s \\ valid_pde pde ?s'\"\n by (case_tac pdea, auto simp add: typ_at data_at_def)\n have valid_pte: \"\\pte. valid_pte pte s \\ valid_pte pte ?s'\"\n by (case_tac pte, auto simp add: typ_at data_at_def)\n have valid_ao_at: \"\\p. valid_ao_at p s \\ valid_ao_at p ?s'\"\n using pd uc\n apply (clarsimp simp: valid_ao_at_def obj_at_def)\n apply (intro conjI impI allI)\n apply (clarsimp simp: valid_pde vp)\n apply (case_tac ao, simp_all add: typ_at valid_pde valid_pte)\n done\n have valid_vso_at: \"\\p. valid_vso_at p s \\ valid_vso_at p ?s'\"\n using pd uc\n apply (clarsimp simp: valid_vso_at_def obj_at_def)\n apply (intro conjI impI allI)\n apply (clarsimp simp: valid_pde vp)\n apply (case_tac ao, simp_all add: typ_at valid_pde valid_pte)\n done\n have empty:\n \"\\p. obj_at (empty_table (set (second_level_tables (arch_state s)))) p s\n \\ obj_at (empty_table (set (second_level_tables (arch_state s)))) p ?s'\"\n using pd gr vp uc\n by (clarsimp simp: obj_at_def empty_table_def second_level_tables_def)\n show \"valid_global_objs ?s'\"\n using vg pd\n apply (clarsimp simp add: valid_global_objs_def valid_ao_at valid_vso_at empty)\n apply (fastforce simp add: obj_at_def)\n done\nqed\n\nlemma valid_arch_state_global_pd:\n \"\\ valid_arch_state s; pspace_aligned s \\\n \\ obj_at (\\ko. \\pd. ko = ArchObj (PageDirectory pd)) (arm_global_pd (arch_state s)) s\n \\ is_aligned (arm_global_pd (arch_state s)) pd_bits\"\n apply (clarsimp simp: valid_arch_state_def a_type_def\n pd_aligned pd_bits_def pageBits_def\n elim!: obj_at_weakenE)\n apply (clarsimp split: Structures_A.kernel_object.split_asm\n arch_kernel_obj.split_asm if_split_asm)\n done\n\nlemma pd_shifting':\n \"is_aligned (pd :: word32) pd_bits \\ pd + (vptr >> 20 << 2) && ~~ mask pd_bits = pd\"\n by (rule pd_shifting, simp add: pd_bits_def pageBits_def)\n\nlemma copy_global_mappings_nonempty_table:\n \"is_aligned pd pd_bits \\\n \\\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s) \\\n valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s\\\n copy_global_mappings pd\n \\\\rv s. \\ (obj_at (nonempty_table\n (set (second_level_tables (arch_state s)))) r s) \\\n valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s\\\"\n apply (simp add: copy_global_mappings_def)\n apply (rule hoare_seq_ext [OF _ gets_sp])\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp[where S=\"{x. kernel_base >> 20 \\ x \\\n x < 2 ^ (pd_bits - 2)}\"])\n apply (wp get_pde_wp hoare_vcg_ball_lift\n store_pde_weaken[THEN iffD2,OF store_pde_nonempty_table]\n store_pde_weaken[THEN iffD2,OF store_pde_global_global_objs]\n | simp)+\n apply clarsimp\n apply (subst (asm) is_aligned_add_helper[THEN conjunct2])\n apply (clarsimp simp: valid_arch_state_def pspace_aligned_def dom_def\n obj_at_def)\n apply (drule_tac x=\"arm_global_pd (arch_state s)\" in spec, erule impE,\n fastforce)\n apply (simp add: pd_bits_def pageBits_def)\n apply (erule shiftl_less_t2n)\n apply (simp add: pd_bits_def pageBits_def)\n apply (clarsimp simp: valid_arch_state_def valid_global_objs_def obj_at_def\n empty_table_def second_level_tables_def)\n apply (simp add: kernel_mapping_slots_def)\n apply (subst is_aligned_add_helper[THEN conjunct1], assumption)\n apply (erule shiftl_less_t2n)\n apply (simp add: pd_bits_def pageBits_def)\n apply (simp add: kernel_base_shift_cast_le[symmetric] ucast_ucast_mask)\n apply (subst shiftl_shiftr_id)\n apply simp\n apply (simp add: word_less_nat_alt pd_bits_def pageBits_def)\n apply (subst less_mask_eq)\n apply (simp add: pd_bits_def pageBits_def)\n apply assumption\n apply (clarsimp simp: pd_bits_def)\n apply simp\n done\n\n\nlemma mapM_copy_global_mappings_nonempty_table[wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\pd\\set pds. is_aligned pd pd_bits)\\\n mapM_x copy_global_mappings pds\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp', rule copy_global_mappings_nonempty_table)\n apply simp_all\n done\n\nlemma init_arch_objects_nonempty_table[Untyped_AI_assms, wp]:\n \"\\(\\s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\n \\ valid_global_objs s \\ valid_arch_state s \\ pspace_aligned s) and\n K (\\ref\\set refs. is_aligned ref (obj_bits_api tp us))\\\n init_arch_objects tp ptr bits us refs\n \\\\rv s. \\ (obj_at (nonempty_table (set (second_level_tables (arch_state s)))) r s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: init_arch_objects_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp hoare_unless_wp | wpc | simp add: reserve_region_def second_level_tables_def)+\n apply (clarsimp simp: obj_bits_api_def default_arch_object_def pd_bits_def pageBits_def)\n done\n\nlemma nonempty_table_caps_of[Untyped_AI_assms]:\n \"nonempty_table S ko \\ caps_of ko = {}\"\n by (auto simp: caps_of_def cap_of_def nonempty_table_def a_type_def\n split: Structures_A.kernel_object.split if_split_asm)\n\n\nlemma nonempty_default[simp, Untyped_AI_assms]:\n \"tp \\ Untyped \\ \\ nonempty_table S (default_object tp dev us)\"\n apply (case_tac tp, simp_all add: default_object_def nonempty_table_def\n a_type_def)\n apply (rename_tac aobject_type)\n apply (case_tac aobject_type, simp_all add: default_arch_object_def)\n apply (simp_all add: empty_table_def pde_ref_def valid_pde_mappings_def)\n done\n\nlemma set_pd_cte_wp_at_iin[wp]:\n \"\\\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\n set_pd q pd\n \\\\_ s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\\\"\n apply (simp add: set_pd_def)\n including unfold_objects\n apply (wpsimp wp: set_object_wp_strong\n simp: a_type_def cte_wp_at_after_update')\n done\n\ncrunch cte_wp_at_iin[wp]: init_arch_objects\n \"\\s. P (cte_wp_at (P' (interrupt_irq_node s)) p s)\"\n (ignore: clearMemory wp: crunch_wps hoare_unless_wp)\n\nlemmas init_arch_objects_ex_cte_cap_wp_to\n = init_arch_objects_excap\n\nlemma obj_is_device_vui_eq[Untyped_AI_assms]:\n \"valid_untyped_inv ui s\n \\ case ui of Retype slot reset ptr_base ptr tp us slots dev\n \\ obj_is_device tp dev = dev\"\n apply (cases ui, clarsimp)\n apply (clarsimp simp: obj_is_device_def\n split: apiobject_type.split)\n apply (intro impI conjI allI, simp_all add: is_frame_type_def default_object_def)\n apply (simp add: default_arch_object_def split: aobject_type.split)\n apply (auto simp: arch_is_frame_type_def)\n done\n\nlemma create_cap_ioports[wp, Untyped_AI_assms]:\n \"\\valid_ioports and cte_wp_at (\\_. True) cref\\ create_cap tp sz p dev (cref,oref) \\\\rv. valid_ioports\\\"\n by wpsimp\n\nend\n\nglobal_interpretation Untyped_AI? : Untyped_AI\n where nonempty_table = ARM.nonempty_table\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (unfold_locales; (fact Untyped_AI_assms)?)\n qed\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM/ArchUntyped_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.2720245510940225, "lm_q1q2_score": 0.15709291747354906}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(* Wellformedness of caps, kernel objects, states on the C level\n*)\n\ntheory Wellformed_C\nimports\n \"CLib.CTranslationNICTA\"\n CLevityCatch\n \"CSpec.Substitute\"\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nabbreviation\n cte_Ptr :: \"word32 \\ cte_C ptr\" where \"cte_Ptr == Ptr\"\nabbreviation\n mdb_Ptr :: \"word32 \\ mdb_node_C ptr\" where \"mdb_Ptr == Ptr\"\nabbreviation\n cap_Ptr :: \"word32 \\ cap_C ptr\" where \"cap_Ptr == Ptr\"\nabbreviation\n tcb_Ptr :: \"word32 \\ tcb_C ptr\" where \"tcb_Ptr == Ptr\"\nabbreviation\n ep_Ptr :: \"word32 \\ endpoint_C ptr\" where \"ep_Ptr == Ptr\"\nabbreviation\n ntfn_Ptr :: \"word32 \\ notification_C ptr\" where \"ntfn_Ptr == Ptr\"\nabbreviation\n ap_Ptr :: \"word32 \\ asid_pool_C ptr\" where \"ap_Ptr == Ptr\"\nabbreviation\n pte_Ptr :: \"word32 \\ pte_C ptr\" where \"pte_Ptr == Ptr\"\nabbreviation\n pde_Ptr :: \"word32 \\ pde_C ptr\" where \"pde_Ptr == Ptr\"\nabbreviation\n pt_Ptr :: \"32 word \\ (pte_C[256]) ptr\" where \"pt_Ptr == Ptr\"\nabbreviation\n pd_Ptr :: \"32 word \\ (pde_C[4096]) ptr\" where \"pd_Ptr == Ptr\"\n\nlemma halt_spec:\n \"Gamma \\ {} Call halt_'proc {}\"\n apply (rule hoare_complete)\n apply (simp add: HoarePartialDef.valid_def)\n done\n\ndefinition\n isUntypedCap_C :: \"cap_CL \\ bool\" where\n \"isUntypedCap_C c \\\n case c of\n Cap_untyped_cap q \\ True\n | _ \\ False\"\n\ndefinition\n isNullCap_C :: \"cap_CL \\ bool\" where\n \"isNullCap_C c \\\n case c of\n Cap_null_cap \\ True\n | _ \\ False\"\n\ndefinition\n isEndpointCap_C :: \"cap_CL \\ bool\" where\n \"isEndpointCap_C v \\ case v of\n Cap_endpoint_cap ec \\ True\n | _ \\ False\"\n\ndefinition\n isCNodeCap_C :: \"cap_CL \\ bool\" where\n \"isCNodeCap_C c \\ case c of\n Cap_cnode_cap a \\ True\n | _ \\ False\"\n\n\ndefinition\n isThreadCap_C :: \"cap_CL \\ bool\" where\n \"isThreadCap_C c \\ case c of\n Cap_thread_cap a \\ True\n | _ \\ False\"\n\ndefinition\n isIRQControlCap_C :: \"cap_CL \\ bool\" where\n \"isIRQControlCap_C c \\ case c of\n Cap_irq_control_cap \\ True\n | _ \\ False\"\n\ndefinition\n isIRQHandlerCap_C :: \"cap_CL \\ bool\" where\n \"isIRQHandlerCap_C c \\ case c of\n Cap_irq_handler_cap a \\ True\n | _ \\ False\"\n\ndefinition\n isNotificationCap_C :: \"cap_CL \\ bool\" where\n \"isNotificationCap_C v \\ case v of\n Cap_notification_cap aec \\ True\n | _ \\ False\"\n\ndefinition\n ep_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\nwhere\n \"ep_at_C' p h \\ Ptr p \\ dom (clift h :: endpoint_C typ_heap)\" \\ \\endpoint_lift is total\\\n\ndefinition\n ntfn_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where \\ \\notification_lift is total\\\n \"ntfn_at_C' p h \\ Ptr p \\ dom (clift h :: notification_C typ_heap)\"\n\ndefinition\n tcb_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where\n \"tcb_at_C' p h \\ Ptr p \\ dom (clift h :: tcb_C typ_heap)\"\n\ndefinition\n cte_at_C' :: \"word32 \\ heap_raw_state \\ bool\"\n where\n \"cte_at_C' p h \\ Ptr p \\ dom (clift h :: cte_C typ_heap)\"\n\ndefinition\n ctcb_ptr_to_tcb_ptr :: \"tcb_C ptr \\ word32\"\n where\n \"ctcb_ptr_to_tcb_ptr p \\ ptr_val p - ctcb_offset\"\n\ndefinition\n tcb_ptr_to_ctcb_ptr :: \"word32 \\ tcb_C ptr\"\n where\n \"tcb_ptr_to_ctcb_ptr p \\ Ptr (p + ctcb_offset)\"\n\nprimrec\n tcb_queue_relation :: \"(tcb_C \\ tcb_C ptr) \\ (tcb_C \\ tcb_C ptr) \\\n (tcb_C ptr \\ tcb_C option) \\ word32 list \\\n tcb_C ptr \\ tcb_C ptr \\ bool\"\nwhere\n \"tcb_queue_relation getNext getPrev hp [] qprev qhead = (qhead = NULL)\"\n| \"tcb_queue_relation getNext getPrev hp (x#xs) qprev qhead =\n (qhead = tcb_ptr_to_ctcb_ptr x \\\n (\\tcb. (hp qhead = Some tcb \\ getPrev tcb = qprev \\ tcb_queue_relation getNext getPrev hp xs qhead (getNext tcb))))\"\n\nabbreviation\n \"ep_queue_relation \\ tcb_queue_relation tcbEPNext_C tcbEPPrev_C\"\n\nabbreviation\n \"sched_queue_relation \\ tcb_queue_relation tcbSchedNext_C tcbSchedPrev_C\"\n\n\ndefinition\nwordSizeCase :: \"'a \\ 'a \\ 'a\" where\n\"wordSizeCase a b \\ (if bitSize (undefined::word32) = 32\n then a\n else if bitSize (undefined::word32) = 64\n then b\n else error []\n )\"\n\n\nprimrec\n capBits_C :: \"cap_CL \\ nat\"\nwhere\n \"capBits_C Cap_null_cap = 0\"\n| \"capBits_C (Cap_untyped_cap uc) = unat (capBlockSize_CL uc)\"\n| \"capBits_C (Cap_endpoint_cap ec) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_notification_cap aec) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_cnode_cap cnc) = wordSizeCase 4 5\"\n| \"capBits_C (Cap_thread_cap tc) = 10\"\n| \"capBits_C (Cap_zombie_cap zc) = (wordSizeCase 4 5)\"\n\n\ndefinition\ncapUntypedPtr_C :: \"cap_CL \\ word32\" where\n \"capUntypedPtr_C cap \\ case cap of\n (Cap_untyped_cap uc) \\ (capBlockSize_CL uc)\n | Cap_endpoint_cap ep \\ (capEPPtr_CL ep)\n | Cap_notification_cap ntfn \\ (capNtfnPtr_CL ntfn)\n | Cap_cnode_cap ccap \\ (capCNodePtr_CL ccap)\n | Cap_reply_cap rc \\ (cap_reply_cap_CL.capTCBPtr_CL rc)\n | Cap_thread_cap tc \\ (cap_thread_cap_CL.capTCBPtr_CL tc)\n | Cap_small_frame_cap sfc \\ (cap_small_frame_cap_CL.capFBasePtr_CL sfc)\n | Cap_frame_cap fc \\ (cap_frame_cap_CL.capFBasePtr_CL fc)\n | Cap_page_table_cap ptc \\ (capPTBasePtr_CL ptc)\n | Cap_page_directory_cap pdc \\ (capPDBasePtr_CL pdc)\n | _ \\ error []\"\n\ndefinition ZombieTCB_C_def:\n\"ZombieTCB_C \\ bit 5\"\n\ndefinition\n isZombieTCB_C :: \"word32 \\ bool\" where\n \"isZombieTCB_C v \\ v = ZombieTCB_C\"\n\ndefinition\nvmrights_to_H :: \"word32 \\ vmrights\" where\n\"vmrights_to_H c \\\n if c = scast Kernel_C.VMNoAccess then VMNoAccess\n else if c = scast Kernel_C.VMKernelOnly then VMKernelOnly\n else if c = scast Kernel_C.VMReadOnly then VMReadOnly\n else VMReadWrite\"\n\n(* Force clarity over name collisions *)\nabbreviation\n ARMSmallPage :: \"vmpage_size\" where\n \"ARMSmallPage == ARM.ARMSmallPage\"\nabbreviation\n ARMLargePage :: \"vmpage_size\" where\n \"ARMLargePage == ARM.ARMLargePage\"\nabbreviation\n ARMSection :: \"vmpage_size\" where\n \"ARMSection == ARM.ARMSection\"\nabbreviation\n ARMSuperSection :: \"vmpage_size\" where\n \"ARMSuperSection == ARM.ARMSuperSection\"\n\n\\ \\ARMSmallFrame is treated in a separate cap in C,\n so needs special treatment in ccap_relation\\\ndefinition\nframesize_to_H:: \"word32 \\ vmpage_size\" where\n\"framesize_to_H c \\\n if c = scast Kernel_C.ARMLargePage then ARMLargePage\n else if c = scast Kernel_C.ARMSection then ARMSection\n else ARMSuperSection\"\n\n\\ \\Use this for results of generic_frame_cap_get_capFSize\\\ndefinition\ngen_framesize_to_H:: \"word32 \\ vmpage_size\" where\n\"gen_framesize_to_H c \\\n if c = scast Kernel_C.ARMSmallPage then ARMSmallPage\n else if c = scast Kernel_C.ARMLargePage then ARMLargePage\n else if c = scast Kernel_C.ARMSection then ARMSection\n else ARMSuperSection\"\n\nend\n\nrecord cte_CL =\n cap_CL :: cap_CL\n cteMDBNode_CL :: mdb_node_CL\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n cte_lift :: \"cte_C \\ cte_CL\"\n where\n \"cte_lift c \\ case cap_lift (cte_C.cap_C c) of\n None \\ None\n | Some cap \\ Some \\ cap_CL = cap,\n cteMDBNode_CL = mdb_node_lift (cteMDBNode_C c) \\\"\n\n(* this is slightly weird, but the bitfield generator\n masks everything with the expected bit length.\n So we do that here too. *)\ndefinition\n to_bool_bf :: \"'a::len word \\ bool\" where\n \"to_bool_bf w \\ (w && mask 1) = 1\"\n\nlemma to_bool_bf_0 [simp]: \"\\to_bool_bf 0\"\n by (simp add: to_bool_bf_def)\n\nlemma to_bool_bf_1 [simp]: \"to_bool_bf 1\"\n by (simp add: to_bool_bf_def mask_def)\n\nlemma to_bool_bf_and [simp]:\n \"to_bool_bf (a && b) = (to_bool_bf a \\ to_bool_bf (b::word32))\"\n apply (clarsimp simp: to_bool_bf_def)\n apply (rule iffI)\n apply (subst (asm) bang_eq)\n apply (simp add: word_size)\n apply (rule conjI)\n apply (rule word_eqI)\n apply (auto simp add: word_size)[1]\n apply (rule word_eqI)\n apply (auto simp add: word_size)[1]\n apply clarsimp\n apply (rule word_eqI)\n apply (subst (asm) bang_eq)+\n apply (auto simp add: word_size)[1]\n done\n\nlemma to_bool_bf_to_bool_mask:\n \"w && mask (Suc 0) = w \\ to_bool_bf w = to_bool (w::word32)\"\n by (metis One_nat_def mask_eq1_nochoice fold_eq_0_to_bool mask_1 to_bool_bf_0 to_bool_bf_def)\n\ndefinition\n mdb_node_to_H :: \"mdb_node_CL \\ mdbnode\"\n where\n \"mdb_node_to_H n \\ MDB (mdbNext_CL n)\n (mdbPrev_CL n)\n (to_bool (mdbRevocable_CL n))\n (to_bool (mdbFirstBadged_CL n))\"\n\n\ndefinition\ncap_to_H :: \"cap_CL \\ capability\"\nwhere\n\"cap_to_H c \\ case c of\n Cap_null_cap \\ NullCap\n | Cap_zombie_cap zc \\ (if isZombieTCB_C(capZombieType_CL zc)\n then\n (Zombie ((capZombieID_CL zc) && ~~(mask(5)))\n (ZombieTCB)\n (unat ((capZombieID_CL zc) && mask(5))))\n else let radix = unat (capZombieType_CL zc) in\n (Zombie ((capZombieID_CL zc) && ~~(mask (radix+1)))\n (ZombieCNode radix)\n (unat ((capZombieID_CL zc) && mask(radix+1)))))\n | Cap_cnode_cap ccap \\\n CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap))\n (capCNodeGuard_CL ccap)\n (unat (capCNodeGuardSize_CL ccap))\n | Cap_untyped_cap uc \\ UntypedCap (to_bool(capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4))\n | Cap_endpoint_cap ec \\\n EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool(capCanSend_CL ec)) (to_bool(capCanReceive_CL ec))\n (to_bool(capCanGrant_CL ec)) (to_bool(capCanGrantReply_CL ec))\n | Cap_notification_cap ntfn \\\n NotificationCap (capNtfnPtr_CL ntfn)(capNtfnBadge_CL ntfn)(to_bool(capNtfnCanSend_CL ntfn))\n (to_bool(capNtfnCanReceive_CL ntfn))\n | Cap_reply_cap rc \\ ReplyCap (ctcb_ptr_to_tcb_ptr (Ptr (cap_reply_cap_CL.capTCBPtr_CL rc)))\n (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc))\n | Cap_thread_cap tc \\ ThreadCap(ctcb_ptr_to_tcb_ptr (Ptr (cap_thread_cap_CL.capTCBPtr_CL tc)))\n | Cap_irq_handler_cap ihc \\ IRQHandlerCap (ucast(capIRQ_CL ihc))\n | Cap_irq_control_cap \\ IRQControlCap\n | Cap_asid_control_cap \\ ArchObjectCap ASIDControlCap\n | Cap_asid_pool_cap apc \\ ArchObjectCap (ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc))\n | Cap_small_frame_cap sfc \\ ArchObjectCap (PageCap (to_bool(cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc)\n (vmrights_to_H(cap_small_frame_cap_CL.capFVMRights_CL sfc)) (ARMSmallPage)\n (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0\n \\ cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0\n then None else\n Some( (((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc)< ArchObjectCap (PageCap (to_bool(capFIsDevice_CL fc)) (capFBasePtr_CL fc)\n (vmrights_to_H(capFVMRights_CL fc)) (framesize_to_H(capFSize_CL fc))\n (if capFMappedASIDHigh_CL fc = 0\n \\ capFMappedASIDLow_CL fc = 0\n then None else\n Some( (((capFMappedASIDHigh_CL fc)< ArchObjectCap (PageTableCap (capPTBasePtr_CL ptc)\n (if to_bool (capPTIsMapped_CL ptc)\n then Some( ((capPTMappedASID_CL ptc)),(capPTMappedAddress_CL ptc))\n else None))\n | Cap_page_directory_cap pdf \\ ArchObjectCap (PageDirectoryCap (capPDBasePtr_CL pdf)\n (if to_bool (capPDIsMapped_CL pdf)\n then Some (capPDMappedASID_CL pdf)\n else None))\n | Cap_domain_cap \\ DomainCap\"\n\nlemmas cap_to_H_simps = cap_to_H_def[split_simps cap_CL.split]\n\ndefinition\n cte_to_H :: \"cte_CL \\ cte\"\n where\n \"cte_to_H cte \\ CTE (cap_to_H (cap_CL cte)) (mdb_node_to_H (cteMDBNode_CL cte))\"\n\n\n\ndefinition\ncl_valid_cap :: \"cap_CL \\ bool\"\nwhere\n\"cl_valid_cap c \\\n case c of\n Cap_frame_cap fc \\ ((capFSize_CL fc) \\ scast Kernel_C.ARMSmallPage)\n | Cap_irq_handler_cap fc \\ ((capIRQ_CL fc) && mask 10 = capIRQ_CL fc)\n | x \\ True\"\n\ndefinition\nc_valid_cap :: \"cap_C \\ bool\"\nwhere\n\"c_valid_cap c \\ case_option True cl_valid_cap (cap_lift c)\"\n\n\ndefinition\ncl_valid_cte :: \"cte_CL \\ bool\"\nwhere\n\"cl_valid_cte c \\ cl_valid_cap (cap_CL c)\"\n\n\ndefinition\nc_valid_cte :: \"cte_C \\ bool\"\nwhere\n\"c_valid_cte c \\ c_valid_cap (cte_C.cap_C c)\"\n\nlemma c_valid_cap_simps [simp]:\n \"cap_get_tag c = scast cap_small_frame_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_thread_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_notification_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_endpoint_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_cnode_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_page_directory_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_asid_control_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_irq_control_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_page_table_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_asid_pool_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_untyped_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_zombie_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_reply_cap \\ c_valid_cap c\"\n \"cap_get_tag c = scast cap_null_cap \\ c_valid_cap c\"\n unfolding c_valid_cap_def cap_lift_def cap_tag_defs\n by (simp add: cl_valid_cap_def)+\n\nlemma ptr_val_tcb_ptr_mask2:\n \"is_aligned thread tcbBlockSizeBits\n \\ ptr_val (tcb_ptr_to_ctcb_ptr thread) && (~~ mask tcbBlockSizeBits)\n = thread\"\n apply (clarsimp simp: tcb_ptr_to_ctcb_ptr_def projectKOs)\n apply (simp add: is_aligned_add_helper ctcb_offset_defs objBits_simps')\n done\n\nsection \\Domains\\\n\ntext \\\n seL4's build system allows configuration of the number of domains. This means the proofs have to\n work for any number of domains provided it fits into the hard limit of a 8-bit word.\n\n In the C code, we have the enumerated constant numDomains, one greater than maxDom. In the\n abstract specs, we have the corresponding Platform_Config.numDomains and maxDomain.\n\n To keep the proofs as general as possible, we avoid unfolding definitions of:\n maxDom, maxDomain, numDomains except in this theory where we need to establish basic properties.\n\n Unfortunately, array bounds checks coming from the C code use numerical values, meaning we might\n get 0x10 instead of the number of domains, or 0x1000 for numDomains * numPriorities. To solve\n these, the \"explicit\" lemmas expose direct numbers. They are more risky to deploy, as one could\n prove that 0x5 is less than the number of domains when that's the case, and then the proof will\n break upon reconfiguration.\n\\\n\ntext \\The @{text num_domains} enumerated type and constant represent the number of domains.\\\n\nvalue_type num_domains = \"numDomains\"\n\ncontext includes no_less_1_simps begin\n\n(* The proofs expect the minimum priority and minimum domain to be zero.\n Note that minDom is unused in the C code. *)\nlemma min_prio_dom_sanity:\n \"seL4_MinPrio = 0\"\n \"Kernel_C.minDom = 0\"\n by (auto simp: seL4_MinPrio_def minDom_def)\n\nlemma less_numDomains_is_domain[simplified word_size, simplified]:\n \"x < numDomains \\ x < 2 ^ size (y::domain)\"\n unfolding Kernel_Config.numDomains_def\n by (simp add: word_size)\n\nlemma sint_numDomains_to_H:\n \"sint Kernel_C.numDomains = int Kernel_Config.numDomains\"\n by (clarsimp simp: Kernel_C.numDomains_def Kernel_Config.numDomains_def)\n\nlemma unat_numDomains_to_H:\n \"unat Kernel_C.numDomains = Kernel_Config.numDomains\"\n by (clarsimp simp: Kernel_C.numDomains_def Kernel_Config.numDomains_def)\n\nlemma maxDom_to_H:\n \"ucast maxDom = maxDomain\"\n by (simp add: maxDomain_def Kernel_C.maxDom_def Kernel_Config.numDomains_def)\n\nlemma maxDom_sgt_0_maxDomain:\n \"0 0 < maxDomain\"\n unfolding Kernel_C.maxDom_def maxDomain_def Kernel_Config.numDomains_def\n by clarsimp\n\nlemma num_domains_calculation:\n \"num_domains = numDomains\"\n unfolding num_domains_def by eval\n\nprivate lemma num_domains_card_explicit:\n \"num_domains = CARD(num_domains)\"\n by (simp add: num_domains_def)\n\nlemmas num_domains_index_updates =\n index_update[where 'b=num_domains, folded num_domains_card_explicit num_domains_def,\n simplified num_domains_calculation]\n index_update2[where 'b=num_domains, folded num_domains_card_explicit num_domains_def,\n simplified num_domains_calculation]\n\n(* C ArrayGuards will throw these at us and there is no way to avoid a proof of being less than a\n specific number expressed as a word, so we must introduce these. However, being explicit means\n lack of discipline can lead to a violation. *)\nlemma numDomains_less_numeric_explicit[simplified num_domains_def One_nat_def]:\n \"x < Kernel_Config.numDomains \\ x < num_domains\"\n by (simp add: num_domains_calculation)\n\nlemma numDomains_less_unat_ucast_explicit[simplified num_domains_def]:\n \"unat x < Kernel_Config.numDomains \\ (ucast (x::domain) :: machine_word) < of_nat num_domains\"\n apply (rule word_less_nat_alt[THEN iffD2])\n apply transfer\n apply simp\n apply (drule numDomains_less_numeric_explicit, simp add: num_domains_def)\n done\n\nlemmas maxDomain_le_unat_ucast_explicit =\n numDomains_less_unat_ucast_explicit[simplified le_maxDomain_eq_less_numDomains(2)[symmetric],\n simplified]\n\nend (* numDomain abstraction definitions and lemmas *)\n\n\ntext \\Priorities - not expected to be configurable\\\n\nlemma maxPrio_to_H:\n \"ucast seL4_MaxPrio = maxPriority\"\n by (simp add: maxPriority_def seL4_MaxPrio_def numPriorities_def)\n\n\ntext \\TCB scheduling queues\\\n\n(* establish and sanity-check relationship between the calculation of the number of TCB queues and\n the size of the array in C *)\nvalue_type num_tcb_queues = \"numDomains * numPriorities\"\n\nlemma num_tcb_queues_calculation:\n \"num_tcb_queues = numDomains * numPriorities\"\n unfolding num_tcb_queues_def by eval\n\n\nabbreviation(input)\n NotificationObject :: sword32\nwhere\n \"NotificationObject == seL4_NotificationObject\"\n\nabbreviation(input)\n CapTableObject :: sword32\nwhere\n \"CapTableObject == seL4_CapTableObject\"\n\nabbreviation(input)\n EndpointObject :: sword32\nwhere\n \"EndpointObject == seL4_EndpointObject\"\n\nabbreviation(input)\n LargePageObject :: sword32\nwhere\n \"LargePageObject == seL4_ARM_LargePageObject\"\n\nabbreviation(input)\n PageDirectoryObject :: sword32\nwhere\n \"PageDirectoryObject == seL4_ARM_PageDirectoryObject\"\n\nabbreviation(input)\n PageTableObject :: sword32\nwhere\n \"PageTableObject == seL4_ARM_PageTableObject\"\n\nabbreviation(input)\n SectionObject :: sword32\nwhere\n \"SectionObject == seL4_ARM_SectionObject\"\n\nabbreviation(input)\n SmallPageObject :: sword32\nwhere\n \"SmallPageObject == seL4_ARM_SmallPageObject\"\n\nabbreviation(input)\n SuperSectionObject :: sword32\nwhere\n \"SuperSectionObject == seL4_ARM_SuperSectionObject\"\n\nabbreviation(input)\n TCBObject :: sword32\nwhere\n \"TCBObject == seL4_TCBObject\"\n\nabbreviation(input)\n UntypedObject :: sword32\nwhere\n \"UntypedObject == seL4_UntypedObject\"\n\nabbreviation(input)\n maxPrio :: sword32\nwhere\n \"maxPrio == seL4_MaxPrio\"\n\nabbreviation(input)\n minPrio :: sword32\nwhere\n \"minPrio == seL4_MinPrio\"\n\nabbreviation(input)\n nAPIObjects :: sword32\nwhere\n \"nAPIObjects == seL4_NonArchObjectTypeCount\"\n\nabbreviation(input)\n nObjects :: sword32\nwhere\n \"nObjects == seL4_ObjectTypeCount\"\n\nabbreviation(input)\n prioInvalid :: sword32\nwhere\n \"prioInvalid == seL4_InvalidPrio\"\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/crefine/ARM/Wellformed_C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.15686081594427972}} {"text": "(*******************************************************************************\n\n Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n Module: pfslvl2.thy (Isabelle/HOL 2016-1)\n ID: $Id: pfslvl2.thy 133183 2017-01-31 13:55:43Z csprenge $\n Author: Joseph Lallemand, INRIA Nancy \n Christoph Sprenger, ETH Zurich \n \n Level-2 protocol using ephemeral asymmetric keys to achieve forward secrecy.\n\n Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n Licence: LGPL\n\n*******************************************************************************)\n\nsection \\Key Transport Protocol with PFS (L2)\\\n\ntheory pfslvl2\nimports pfslvl1 Channels\nbegin\n\ndeclare domIff [simp, iff del]\n\n(**************************************************************************************************)\nsubsection \\State and Events\\\n(**************************************************************************************************)\n\ntext \\initial compromise\\\n\nconsts\n bad_init :: \"agent set\" \n\nspecification (bad_init)\n bad_init_spec: \"test_owner \\ bad_init \\ test_partner \\ bad_init\"\nby auto\n\n\n\ntext \\level 2 state\\\nrecord l2_state = \n l1_state +\n chan :: \"chan set\"\n bad :: \"agent set\"\n\n\ntype_synonym l2_obs = \"l2_state\"\n\ntype_synonym\n l2_pred = \"l2_state set\"\n\ntype_synonym\n l2_trans = \"(l2_state \\ l2_state) set\"\n\n\n\ntext \\attacker events\\\ndefinition\n l2_dy_fake_msg :: \"msg \\ l2_trans\"\nwhere\n \"l2_dy_fake_msg m \\ {(s,s').\n \\ \\guards\\\n m \\ dy_fake_msg (bad s) (ik s) (chan s) \\\n \\ \\actions\\\n s' = s\\ik := {m} \\ ik s\\\n }\"\n\ndefinition\n l2_dy_fake_chan :: \"chan \\ l2_trans\"\nwhere\n \"l2_dy_fake_chan M \\ {(s,s').\n \\ \\guards\\\n M \\ dy_fake_chan (bad s) (ik s) (chan s)\\\n \\ \\actions\\\n s' = s\\chan := {M} \\ chan s\\\n }\"\n\n\ntext \\partnering\\\nfun\n role_comp :: \"role_t \\ role_t\"\nwhere\n \"role_comp Init = Resp\"\n| \"role_comp Resp = Init\"\n\ndefinition\n matching :: \"frame \\ frame \\ bool\"\nwhere\n \"matching sigma sigma' \\ \\ x. x \\ dom sigma \\ dom sigma' \\ sigma x = sigma' x\"\n\ndefinition\n partner_runs :: \"rid_t \\ rid_t \\ bool\"\nwhere\n \"partner_runs R R' \\ \n role (guessed_runs R) = role_comp (role (guessed_runs R')) \\\n owner (guessed_runs R) = partner (guessed_runs R') \\\n owner (guessed_runs R') = partner (guessed_runs R) \\\n matching (guessed_frame R) (guessed_frame R')\n \"\n\nlemma role_comp_inv [simp]:\n \"role_comp (role_comp x) = x\"\nby (cases x, auto)\n\nlemma role_comp_inv_eq:\n \"y = role_comp x \\ x = role_comp y\"\nby (auto elim!: role_comp.elims [OF sym])\n\ndefinition\n partners :: \"rid_t set\"\nwhere\n \"partners \\ {R. partner_runs test R}\"\n\nlemma test_not_partner [simp]:\n \"test \\ partners\"\nby (auto simp add: partners_def partner_runs_def, cases \"role (guessed_runs test)\", auto)\n\n\nlemma matching_symmetric:\n \"matching sigma sigma' \\ matching sigma' sigma\"\nby (auto simp add: matching_def)\n\nlemma partner_symmetric:\n \"partner_runs R R' \\ partner_runs R' R\"\nby (auto simp add: partner_runs_def matching_symmetric)\n\nlemma partner_unique:\n \"partner_runs R R'' \\ partner_runs R R' \\ R' = R''\"\nproof -\n assume H':\"partner_runs R R'\"\n then have Hm': \"matching (guessed_frame R) (guessed_frame R')\"\n by (auto simp add: partner_runs_def)\n assume H'':\"partner_runs R R''\"\n then have Hm'': \"matching (guessed_frame R) (guessed_frame R'')\"\n by (auto simp add: partner_runs_def)\n show ?thesis\n proof (cases \"role (guessed_runs R')\")\n case Init\n with H' partner_symmetric [OF H''] have Hrole:\"role (guessed_runs R) = Resp\"\n \"role (guessed_runs R'') = Init\"\n by (auto simp add: partner_runs_def)\n with Init Hm' have \"guessed_frame R xpkE = Some (epubKF (R'$kE))\"\n by (simp add: matching_def)\n moreover from Hrole Hm'' have \"guessed_frame R xpkE = Some (epubKF (R''$kE))\"\n by (simp add: matching_def)\n ultimately show ?thesis by simp\n next\n case Resp\n with H' partner_symmetric [OF H''] have Hrole:\"role (guessed_runs R) = Init\"\n \"role (guessed_runs R'') = Resp\"\n by (auto simp add: partner_runs_def)\n with Resp Hm' have \"guessed_frame R xsk = Some (NonceF (R'$sk))\"\n by (simp add: matching_def)\n moreover from Hrole Hm'' have \"guessed_frame R xsk = Some (NonceF (R''$sk))\"\n by (simp add: matching_def)\n ultimately show ?thesis by simp\n qed\nqed\n\nlemma partner_test:\n \"R \\ partners \\ partner_runs R R' \\ R' = test\"\nby (auto intro!:partner_unique simp add:partners_def partner_symmetric)\n\ntext \\compromising events\\\ndefinition\n l2_lkr_others :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_others A \\ {(s,s').\n \\ \\guards\\\n A \\ test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_lkr_actor :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_actor A \\ {(s,s').\n \\ \\guards\\\n A = test_owner \\\n A \\ test_partner \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_lkr_after :: \"agent \\ l2_trans\"\nwhere\n \"l2_lkr_after A \\ {(s,s').\n \\ \\guards\\\n test_ended s \\\n \\ \\actions\\\n s' = s\\bad := {A} \\ bad s\\\n }\"\n\ndefinition\n l2_skr :: \"rid_t \\ msg \\ l2_trans\"\nwhere\n \"l2_skr R K \\ {(s,s').\n \\ \\guards\\\n R \\ test \\ R \\ partners \\\n in_progress (progress s R) xsk \\\n guessed_frame R xsk = Some K \\\n \\ \\actions\\\n s' = s\\ik := {K} \\ ik s\\\n }\"\n\n\ntext \\protocol events\\\ndefinition\n l2_step1 :: \"rid_t \\ agent \\ agent \\ l2_trans\"\nwhere\n \"l2_step1 Ra A B \\ {(s, s').\n \\ \\guards:\\\n Ra \\ dom (progress s) \\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n \\ \\actions:\\\n s' = s\\\n progress := (progress s)(Ra \\ {xpkE, xskE}),\n chan := {Auth A B (\\Number 0, epubKF (Ra$kE)\\)} \\ (chan s)\n \\\n }\"\n\ndefinition\n l2_step2 :: \"rid_t \\ agent \\ agent \\ msg \\ l2_trans\"\nwhere\n \"l2_step2 Rb A B KE \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n Rb \\ dom (progress s) \\\n guessed_frame Rb xpkE = Some KE \\\n Auth A B \\Number 0, KE\\ \\ chan s \\\n \\ \\actions:\\\n s' = s\\\n progress := (progress s)(Rb \\ {xpkE, xsk}),\n chan := {Auth B A (Aenc (NonceF (Rb$sk)) KE)} \\ (chan s),\n signals := if can_signal s A B then\n addSignal (signals s) (Running A B \\KE, NonceF (Rb$sk)\\)\n else\n signals s,\n secret := {x. x = NonceF (Rb$sk) \\ Rb = test} \\ secret s\n \\\n }\" \n\n\ndefinition\n l2_step3 :: \"rid_t \\ agent \\ agent \\ msg \\ l2_trans\"\nwhere\n \"l2_step3 Ra A B K \\ {(s, s').\n \\ \\guards:\\\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n progress s Ra = Some {xpkE, xskE} \\\n guessed_frame Ra xsk = Some K \\\n Auth B A (Aenc K (epubKF (Ra$kE))) \\ chan s \\\n \\ \\actions:\\\n s' = s\\ progress := (progress s)(Ra \\ {xpkE, xskE, xsk}),\n signals := if can_signal s A B then\n addSignal (signals s) (Commit A B \\epubKF (Ra$kE),K\\)\n else\n signals s,\n secret := {x. x = K \\ Ra = test} \\ secret s\n \\\n }\"\n\n\ntext \\specification\\\ndefinition \n l2_init :: \"l2_state set\"\nwhere\n \"l2_init \\ { \\\n ik = {},\n secret = {},\n progress = Map.empty,\n signals = \\x. 0,\n chan = {},\n bad = bad_init\n \\}\"\n\ndefinition \n l2_trans :: \"l2_trans\" where\n \"l2_trans \\ (\\m M KE Rb Ra A B K.\n l2_step1 Ra A B \\\n l2_step2 Rb A B KE \\\n l2_step3 Ra A B m \\\n l2_dy_fake_chan M \\\n l2_dy_fake_msg m \\\n l2_lkr_others A \\\n l2_lkr_after A \\\n l2_skr Ra K \\\n Id\n )\"\n\n\ndefinition \n l2 :: \"(l2_state, l2_obs) spec\" where\n \"l2 \\ \\\n init = l2_init,\n trans = l2_trans,\n obs = id\n \\\"\n\nlemmas l2_loc_defs = \n l2_step1_def l2_step2_def l2_step3_def\n l2_def l2_init_def l2_trans_def\n l2_dy_fake_chan_def l2_dy_fake_msg_def\n l2_lkr_after_def l2_lkr_others_def l2_skr_def\n\nlemmas l2_defs = l2_loc_defs ik_dy_def\n\nlemmas l2_nostep_defs = l2_def l2_init_def l2_trans_def\n\n\nlemma l2_obs_id [simp]: \"obs l2 = id\"\nby (simp add: l2_def)\n\n\ntext \\Once a run is finished, it stays finished, therefore if the test is not finished at some\npoint then it was not finished before either\\\ndeclare domIff [iff]\nlemma l2_run_ended_trans:\n \"run_ended (progress s R) \\\n (s, s') \\ trans l2 \\\n run_ended (progress s' R)\"\napply (auto simp add: l2_nostep_defs)\napply (simp add: l2_defs, fast ?)+\ndone\ndeclare domIff [iff del]\n\nlemma l2_can_signal_trans:\n \"can_signal s' A B \\\n (s, s') \\ trans l2 \\\n can_signal s A B\"\nby (auto simp add: can_signal_def l2_run_ended_trans)\n\n\n(**************************************************************************************************)\nsubsection \\Invariants\\\n(**************************************************************************************************)\n\nsubsubsection \\inv1\\\n(**************************************************************************************************)\n\ntext \\If @{term \"can_signal s A B\"} (i.e., @{term \"A\"}, @{term \"B\"} are the test session \nagents and the test is not finished), then @{term \"A\"}, @{term \"B\"} are honest.\\\n\ndefinition\n l2_inv1 :: \"l2_state set\"\nwhere\n \"l2_inv1 \\ {s. \\A B.\n can_signal s A B \\\n A \\ bad s \\ B \\ bad s\n }\"\n\nlemmas l2_inv1I = l2_inv1_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv1E [elim] = l2_inv1_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv1D = l2_inv1_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv1_init [iff]:\n \"init l2 \\ l2_inv1\"\nby (auto simp add: l2_def l2_init_def l2_inv1_def can_signal_def bad_init_spec)\n\nlemma l2_inv1_trans [iff]:\n \"{l2_inv1} trans l2 {> l2_inv1}\"\nproof (auto simp add: PO_hoare_defs intro!: l2_inv1I del: conjI)\n fix s' s :: l2_state\n fix A B\n assume HI:\"s \\ l2_inv1\" \n assume HT:\"(s, s') \\ trans l2\"\n assume \"can_signal s' A B\"\n with HT have HS:\"can_signal s A B\"\n by (auto simp add: l2_can_signal_trans)\n with HI have \"A \\ bad s \\ B \\ bad s\"\n by fast\n with HS HT show \"A \\ bad s' \\ B \\ bad s'\"\n by (auto simp add: l2_nostep_defs can_signal_def)\n (simp_all add: l2_defs)\nqed\n\nlemma PO_l2_inv1 [iff]: \"reach l2 \\ l2_inv1\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv2 (authentication guard)\\\n(**************************************************************************************************)\n\ntext \\\n If @{term \"Auth A B (\\Number 0, KE\\) \\ chan s\"} and @{term \"A\"}, @{term \"B\"} are honest\n then the message has indeed been sent by an initiator run (with the right agents etc.)\\\n\ndefinition\n l2_inv2 :: \"l2_state set\"\nwhere\n \"l2_inv2 \\ {s. \\ A B KE.\n Auth A B \\Number 0, KE\\ \\ chan s \\\n A \\ bad s \\ B \\ bad s \\\n (\\ Ra.\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n in_progress (progress s Ra) xpkE \\\n KE = epubKF (Ra$kE))\n }\"\n\nlemmas l2_inv2I = l2_inv2_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv2E [elim] = l2_inv2_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv2D = l2_inv2_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv2_init [iff]:\n \"init l2 \\ l2_inv2\"\nby (auto simp add: l2_def l2_init_def l2_inv2_def)\n\nlemma l2_inv2_trans [iff]:\n \"{l2_inv2} trans l2 {> l2_inv2}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv2I)\napply (auto simp add: l2_defs dy_fake_chan_def)\napply force+\ndone\n\nlemma PO_l2_inv2 [iff]: \"reach l2 \\ l2_inv2\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv3 (authentication guard)\\\n(**************************************************************************************************)\n\ntext \\If @{term \"Auth B A (Aenc K (epubKF (Ra $ kE))) \\ chan s\"}\n and @{term \"A\"}, @{term \"B\"} are honest then the message has indeed been sent by a\n responder run (etc).\\\n\ndefinition\n l2_inv3 :: \"l2_state set\"\nwhere\n \"l2_inv3 \\ {s. \\ Ra A B K.\n Auth B A (Aenc K (epubKF (Ra $ kE))) \\ chan s \\\n A \\ bad s \\ B \\ bad s \\\n (\\ Rb.\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n progress s Rb = Some {xpkE, xsk} \\\n guessed_frame Rb xpkE = Some (epubKF (Ra$kE))\\\n K = NonceF (Rb$sk)\n )\n }\"\n\nlemmas l2_inv3I = l2_inv3_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv3E [elim] = l2_inv3_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv3D = l2_inv3_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv3_init [iff]:\n \"init l2 \\ l2_inv3\"\nby (auto simp add: l2_def l2_init_def l2_inv3_def)\n\nlemma l2_inv3_trans [iff]:\n \"{l2_inv3} trans l2 {> l2_inv3}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv3I)\napply (auto simp add: l2_defs dy_fake_chan_def)\napply (simp_all add: domIff)\napply force+\ndone\n\nlemma PO_l2_inv3 [iff]: \"reach l2 \\ l2_inv3\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv4\\\n(**************************************************************************************************)\n\ntext \\If the test run is finished and has the session key generated by a run,\n then this run is also finished.\\\n\ndefinition\n l2_inv4 :: \"l2_state set\"\nwhere\n \"l2_inv4 \\ {s. \\Rb.\n in_progress (progress s test) xsk \\\n guessed_frame test xsk = Some (NonceF (Rb$sk)) \\\n progress s Rb = Some {xpkE, xsk}\n }\"\n\nlemmas l2_inv4I = l2_inv4_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv4E [elim] = l2_inv4_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv4D = l2_inv4_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv4_init [iff]:\n \"init l2 \\ l2_inv4\"\nby (auto simp add: l2_def l2_init_def l2_inv4_def)\n\nlemma l2_inv4_trans [iff]:\n \"{l2_inv4 \\ l2_inv3 \\ l2_inv1} trans l2 {> l2_inv4}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv4I)\napply (auto simp add: l2_defs dy_fake_chan_def)\napply (auto dest!: l2_inv4D simp add: domIff can_signal_def)\napply (auto dest!: l2_inv3D intro!:l2_inv1D simp add: can_signal_def)\ndone\n\nlemma PO_l2_inv4 [iff]: \"reach l2 \\ l2_inv4\"\nby (rule_tac J=\"l2_inv3 \\ l2_inv1\" in inv_rule_incr) (auto)\n\n\nsubsubsection \\inv5\\\n(**************************************************************************************************)\n\ntext \\The only confidential or secure messages on the channel have been put there\n by the attacker.\\\n\ndefinition\n l2_inv5 :: \"l2_state set\"\nwhere\n \"l2_inv5 \\ {s. \\A B M.\n (Confid A B M \\ chan s \\ Secure A B M \\ chan s) \\ \n M \\ dy_fake_msg (bad s) (ik s) (chan s)\n }\"\n\nlemmas l2_inv5I = l2_inv5_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv5E [elim] = l2_inv5_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv5D = l2_inv5_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv5_init [iff]:\n \"init l2 \\ l2_inv5\"\nby (auto simp add: l2_def l2_init_def l2_inv5_def)\n\nlemma l2_inv5_trans [iff]:\n \"{l2_inv5} trans l2 {> l2_inv5}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv5I)\napply (auto simp add: l2_defs dy_fake_chan_def intro: l2_inv5D dy_fake_msg_monotone)\ndone\n\nlemma PO_l2_inv5 [iff]: \"reach l2 \\ l2_inv5\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv6\\\n(**************************************************************************************************)\n\ntext \\If an initiator @{term \"Ra\"} knows a session key @{term \"K\"}, then the attacker\n knows @{term \"Aenc K (epubKF (Ra$kE))\"}.\\\n\ndefinition\n l2_inv6 :: \"l2_state set\"\nwhere\n \"l2_inv6 \\ {s. \\Ra K.\n role (guessed_runs Ra) = Init \\\n in_progress (progress s Ra) xsk \\\n guessed_frame Ra xsk = Some K \\\n Aenc K (epubKF (Ra$kE)) \\ extr (bad s) (ik s) (chan s)\n }\"\n\nlemmas l2_inv6I = l2_inv6_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv6E [elim] = l2_inv6_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv6D = l2_inv6_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv6_init [iff]:\n \"init l2 \\ l2_inv6\"\nby (auto simp add: l2_def l2_init_def l2_inv6_def)\n\nlemma l2_inv6_trans [iff]:\n \"{l2_inv6} trans l2 {> l2_inv6}\"\napply (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv6I)\napply (auto simp add: l2_defs dy_fake_chan_def dest: l2_inv6D)\ndone\n\nlemma PO_l2_inv6 [iff]: \"reach l2 \\ l2_inv6\"\nby (rule inv_rule_basic) (auto)\n\n\nsubsubsection \\inv7\\\n(**************************************************************************************************)\n\ntext \\Form of the messages in @{term \"extr (bad s) (ik s) (chan s)\"} =\n @{term \"synth (analz (generators))\"}.\\\n\nabbreviation\n \"generators \\ range epubK \\\n {Aenc (NonceF (Rb $ sk)) (epubKF (Ra$kE)) |Ra Rb. \\ A B.\n guessed_runs Ra = \\role=Init, owner=A, partner=B\\ \\\n guessed_runs Rb = \\role=Resp, owner=B, partner=A\\ \\\n guessed_frame Rb xpkE = Some (epubKF (Ra$kE))} \\\n {NonceF (R $ sk) |R. R \\ test \\ R \\ partners}\"\n\nlemma analz_generators: \"analz generators = generators\"\nby (rule, rule, erule analz.induct, auto)\n\ndefinition\n l2_inv7 :: \"l2_state set\"\nwhere\n \"l2_inv7 \\ {s. \n extr (bad s) (ik s) (chan s) \\ \n synth (analz (generators))\n }\"\n\nlemmas l2_inv7I = l2_inv7_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv7E [elim] = l2_inv7_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv7D = l2_inv7_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\n\n\nlemma l2_inv7_step1:\n \"{l2_inv7} l2_step1 Ra A B {> l2_inv7}\"\napply (auto simp add: PO_hoare_defs l2_defs intro!: l2_inv7I)\napply (auto dest: l2_inv7D [THEN [2] rev_subsetD])+\ndone\n\nlemma l2_inv7_step2:\n \"{l2_inv1 \\ l2_inv2 \\ l2_inv4 \\ l2_inv7} l2_step2 Rb A B KE {> l2_inv7}\"\nproof (auto simp add: PO_hoare_defs l2_nostep_defs intro!: l2_inv7I)\n fix s' s :: l2_state\n fix x\n assume Hx:\"x \\ extr (bad s') (ik s') (chan s')\"\n assume Hi:\"s \\ l2_inv7\"\n assume Hi':\"s \\ l2_inv1\"\n assume Hi'':\"s \\ l2_inv2\"\n assume Hi''':\"s \\ l2_inv4\"\n assume Hs:\"(s, s') \\ l2_step2 Rb A B KE\"\n from Hx Hi Hs show \" x \\ synth (analz (generators))\"\n proof (auto simp add: l2_defs dest: l2_inv7D [THEN [2] rev_subsetD])\n txt \\first case: @{term \"can_signal s A B\"}, which implies that @{term \"A\"}, @{term \"B\"} are\n honest, and therefore the public key received by @{term \"B\"} is not from the attacker,\n which proves that the\n message added to the channel is in @{term \"{z. \\x k. z = Aenc x (epubKF k)}\"}\\\n assume Hc:\"Auth A B \\Number 0, KE\\ \\ chan s\"\n assume HRb:\"guessed_runs Rb = \\role = Resp, owner = B, partner = A\\\"\n \"guessed_frame Rb xpkE = Some KE\"\n assume Hcs: \"can_signal s A B\"\n from Hcs Hi' have \"A \\ bad s \\ B \\ bad s\"\n by auto\n with Hc Hi'' obtain Ra where \"KE = epubKF (Ra$kE)\" \n and \"guessed_runs Ra = \\role=Init, owner=A, partner=B\\\"\n by (auto dest: l2_inv2D)\n with HRb show \"Aenc (NonceF (Rb $ sk)) KE \\ synth (analz generators)\"\n by blast\n next\n txt \\second case: @{term \"\\ can_signal s A B\"}. We show that @{term \"Rb\"} is not test and\n not a partner:\n - @{term \"Rb\"} is not test because in that case test is not finished and\n @{term \"A\"}, @{term \"B\"} are the test agents, thus\n @{term \"can_signal s A B\"}\n - @{term \"Rb\"} is not a partner for the same reason\n therefore the message added to the channel can be constructed from\n @{term \"{NonceF (R $ sk) |R. R \\ test \\ R \\ partners}\"}\\\n assume Hc:\"Auth A B \\Number 0, KE\\ \\ chan s\"\n assume Hcs:\"\\ can_signal s A B\"\n assume HRb:\"Rb \\ dom (progress s)\"\n \"guessed_runs Rb = \\role = Resp, owner = B, partner = A\\\"\n from Hcs HRb have \"Rb \\ test\"\n by (auto simp add: can_signal_def domIff)\n moreover from HRb Hi''' Hcs have \"Rb \\ partners\"\n by (clarify, auto simp add: partners_def partner_runs_def can_signal_def matching_def domIff)\n moreover from Hc Hi have \"KE \\ synth (analz (generators))\"\n by auto\n ultimately show \"Aenc (NonceF (Rb $ sk)) KE \\ synth (analz (generators))\"\n by blast\n qed \nqed\n\nlemma l2_inv7_step3:\n \"{l2_inv7} l2_step3 Rb A B K {> l2_inv7}\"\nby (auto simp add: PO_hoare_defs l2_defs intro!: l2_inv7I dest: l2_inv7D [THEN [2] rev_subsetD])\n\nlemma l2_inv7_dy_fake_msg:\n \"{l2_inv7} l2_dy_fake_msg M {> l2_inv7}\"\nby (auto simp add: PO_hoare_defs l2_defs extr_insert_IK_eq \n intro!: l2_inv7I \n elim!: l2_inv7E dy_fake_msg_extr [THEN [2] rev_subsetD])\n\nlemma l2_inv7_dy_fake_chan:\n \"{l2_inv7} l2_dy_fake_chan M {> l2_inv7}\"\nby (auto simp add: PO_hoare_defs l2_defs \n intro!: l2_inv7I \n dest: dy_fake_chan_extr_insert [THEN [2] rev_subsetD]\n elim!: l2_inv7E dy_fake_msg_extr [THEN [2] rev_subsetD])\n\nlemma l2_inv7_lkr_others:\n \"{l2_inv7 \\ l2_inv5} l2_lkr_others A {> l2_inv7}\"\napply (auto simp add: PO_hoare_defs l2_defs \n intro!: l2_inv7I\n dest!: extr_insert_bad [THEN [2] rev_subsetD]\n elim!: l2_inv7E l2_inv5E)\napply (auto dest: dy_fake_msg_extr [THEN [2] rev_subsetD])\ndone\n\nlemma l2_inv7_lkr_after:\n \"{l2_inv7 \\ l2_inv5} l2_lkr_after A {> l2_inv7}\"\napply (auto simp add: PO_hoare_defs l2_defs \n intro!: l2_inv7I\n dest!: extr_insert_bad [THEN [2] rev_subsetD]\n elim!: l2_inv7E l2_inv5E)\napply (auto dest: dy_fake_msg_extr [THEN [2] rev_subsetD])\ndone\n \nlemma l2_inv7_skr:\n \"{l2_inv7 \\ l2_inv6} l2_skr R K {> l2_inv7}\"\nproof (auto simp add: PO_hoare_defs l2_defs extr_insert_IK_eq intro!: l2_inv7I,\n auto elim: l2_inv7D [THEN subsetD])\n fix s\n assume HRtest: \"R \\ test\" \"R \\ partners\"\n assume Hi: \"s \\ l2_inv7\"\n assume Hi': \"s \\ l2_inv6\"\n assume HRsk: \"in_progress (progress s R) xsk\" \"guessed_frame R xsk = Some K\"\n show \"K \\ synth (analz generators)\"\n proof (cases \"role (guessed_runs R)\")\n txt \\first case: @{term \"R\"} is the initiator, then @{term \"Aenc K epk\"}\n is in @{term \"extr (bad s) (ik s) (chan s)\"} (by invariant)\n therefore either @{term \"K \\ synth (analz generators)\"} which proves the goal\n or @{term \"Aenc K epk \\ generators\"}, which means that\n @{term \"K = NonceF (Rb$sk)\"} where @{term \"R\"} and @{term \"Rb\"} are matching\n and since @{term \"R\"} is not partner or test, neither is\n @{term \"Rb\"}, and therefore @{term \"K \\ synth (analz (generators))\"}\\\n assume HRI: \"role (guessed_runs R) = Init\"\n with HRsk Hi Hi' have \"Aenc K (epubKF (R$kE)) \\ synth (analz generators)\"\n by (auto dest!: l2_inv7D)\n then have \"K \\ synth (analz generators) \\ Aenc K (epubKF (R$kE)) \\ generators\"\n by (rule synth.cases, simp_all, simp add: analz_generators)\n with HRsk show ?thesis\n proof auto\n fix Rb A B\n assume HR: \"guessed_runs R = \\role = Init, owner = A, partner = B\\\"\n \"guessed_frame R xsk = Some (NonceF (Rb $ sk))\"\n assume HRb: \"guessed_runs Rb = \\role = Resp, owner = B, partner = A\\\"\n \"guessed_frame Rb xpkE = Some (epubKF (R $ kE))\"\n from HR HRb have \"partner_runs Rb R\"\n by (auto simp add: partner_runs_def matching_def)\n with HRtest have \"Rb \\ test \\ Rb \\ partners\"\n by (auto dest: partner_test, simp add:partners_def)\n then show \"NonceF (Rb $ sk) \\ analz generators\"\n by blast\n qed\n next\n txt \\second case: @{term \"R\"} is the Responder, then @{term \"K\"} is @{term \"R$sk\"}\n which is in @{term \"synth (analz (generators))\"}\n since @{term \"R\"} is not test or partner\\\n assume HRI: \"role (guessed_runs R) = Resp\"\n with HRsk HRtest show ?thesis\n by auto\n qed\nqed\n\nlemmas l2_inv7_trans_aux =\n l2_inv7_step1 l2_inv7_step2 l2_inv7_step3\n l2_inv7_dy_fake_msg l2_inv7_dy_fake_chan\n l2_inv7_lkr_others l2_inv7_lkr_after l2_inv7_skr\n\nlemma l2_inv7_trans [iff]:\n \"{l2_inv7 \\ l2_inv1 \\ l2_inv2 \\ l2_inv4 \\ l2_inv5 \\ l2_inv6} trans l2 {> l2_inv7}\"\nby (auto simp add: l2_nostep_defs intro:l2_inv7_trans_aux)\n\nlemma PO_l2_inv7 [iff]: \"reach l2 \\ l2_inv7\"\nby (rule_tac J=\"l2_inv1 \\ l2_inv2 \\ l2_inv4 \\ l2_inv5 \\ l2_inv6\" in inv_rule_incr) (auto)\n\nlemma l2_inv7_aux:\n \"NonceF (R$sk) \\ analz (ik s) \\ s \\ l2_inv7 \\ R \\ test \\ R \\ partners\"\nproof -\n assume H:\"s \\ l2_inv7\" and H':\"NonceF (R$sk) \\ analz (ik s)\"\n then have H'':\"NonceF (R$sk) \\ analz (extr (bad s) (ik s) (chan s))\"\n by (auto elim: analz_monotone)\n from H have \"analz (extr (bad s) (ik s) (chan s)) \\ analz (synth (analz generators))\"\n by (blast dest: analz_mono intro: l2_inv7D)\n with H'' have \"NonceF (R$sk) \\ analz generators\"\n by auto\n then have \"NonceF (R$sk) \\ generators\"\n by (simp add: analz_generators)\n then show ?thesis\n by auto\nqed\n\n\nsubsubsection \\inv8\\\ntext \\Form of the secrets = nonces generated by test or partners\\\n(**************************************************************************************************)\ndefinition\n l2_inv8 :: \"l2_state set\"\nwhere\n \"l2_inv8 \\ {s.\n secret s \\ {NonceF (R$sk) | R. R = test \\ R \\ partners}\n }\"\n\nlemmas l2_inv8I = l2_inv8_def [THEN setc_def_to_intro, rule_format]\nlemmas l2_inv8E [elim] = l2_inv8_def [THEN setc_def_to_elim, rule_format]\nlemmas l2_inv8D = l2_inv8_def [THEN setc_def_to_dest, rule_format, rotated 1, simplified]\n\nlemma l2_inv8_init [iff]:\n \"init l2 \\ l2_inv8\"\nby (auto simp add: l2_def l2_init_def l2_inv8_def)\n\n\n\nlemma PO_l2_inv8 [iff]: \"reach l2 \\ l2_inv8\"\nby (rule_tac J=\"l2_inv1 \\ l2_inv3\" in inv_rule_incr) (auto)\n\n\n(**************************************************************************************************)\nsubsection \\Refinement\\\n(**************************************************************************************************)\n\ntext \\mediator function\\\ndefinition \n med12s :: \"l2_obs \\ l1_obs\"\nwhere\n \"med12s t \\ \\\n ik = ik t,\n secret = secret t,\n progress = progress t,\n signals = signals t\n \\\"\n\n\ntext \\relation between states\\\ndefinition\n R12s :: \"(l1_state * l2_state) set\"\nwhere\n \"R12s \\ {(s,s').\n s = med12s s'\n }\"\n\nlemmas R12s_defs = R12s_def med12s_def\n\n\nlemma can_signal_R12 [simp]:\n \"(s1, s2) \\ R12s \\\n can_signal s1 A B \\ can_signal s2 A B\"\nby (auto simp add: can_signal_def R12s_defs)\n\ntext \\protocol events\\\n\nlemma l2_step1_refines_step1:\n \"{R12s} l1_step1 Ra A B, l2_step1 Ra A B {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l1_step1_def l2_step1_def)\n\n\n\ntext \\auxiliary lemma needed to prove that the nonce received by the test in step 3\ncomes from a partner\\\nlemma l2_step3_partners:\n \"guessed_runs test = \\role = Init, owner = A, partner = B\\ \\\n guessed_frame test xsk = Some (NonceF (Rb$sk)) \\\n guessed_runs Rb = \\role = Resp, owner = B, partner = A\\ \\\n guessed_frame Rb xpkE = Some (epubKF (test $ kE)) \\\n Rb \\ partners\"\nby (auto simp add: partners_def partner_runs_def matching_def)\n\nlemma l2_step3_refines_step3:\n \"{R12s \\ UNIV \\ (l2_inv1 \\ l2_inv3 \\ l2_inv7)} \n l1_step3 Ra A B K, l2_step3 Ra A B K \n {>R12s}\"\napply (auto simp add: PO_rhoare_defs R12s_defs l1_step3_def, simp_all add: l2_step3_def)\napply (auto dest!: l2_inv3D l2_inv7_aux intro:l2_step3_partners)\napply (auto simp add: can_signal_def)\ndone\n\n\ntext \\attacker events\\\nlemma l2_dy_fake_chan_refines_skip:\n \"{R12s} Id, l2_dy_fake_chan M {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_defs)\n\n\nlemma l2_dy_fake_msg_refines_learn:\n \"{R12s \\ UNIV \\ l2_inv7 \\ UNIV \\ l2_inv8} l1_learn m, l2_dy_fake_msg m {>R12s}\"\napply (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\napply (drule Fake_insert_dy_fake_msg, erule l2_inv7D)\napply (auto simp add: analz_generators dest!: l2_inv8D)\napply (drule subsetD, simp, drule subsetD, simp, auto) (*change this ?*)\ndone\n\ntext \\compromising events\\\nlemma l2_lkr_others_refines_skip:\n \"{R12s} Id, l2_lkr_others A {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n\nlemma l2_lkr_after_refines_skip:\n \"{R12s} Id, l2_lkr_after A {>R12s}\"\nby (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n\nlemma l2_skr_refines_learn:\n \"{R12s \\ UNIV \\ l2_inv7 \\ UNIV \\ l2_inv6 \\ UNIV \\ l2_inv8} l1_learn K, l2_skr R K {>R12s}\"\nproof (auto simp add: PO_rhoare_defs R12s_defs l2_loc_defs l1_defs)\n fix s :: l2_state fix x\n assume H:\"s \\ l2_inv7\" \"s \\ l2_inv6\"\n \"R \\ partners\" \"R \\ test\" \"run_ended (progress s R)\" \"guessed_frame R xsk = Some K\"\n assume Hx:\"x \\ synth (analz (insert K (ik s)))\"\n assume \"x \\ secret s\" \"s \\ l2_inv8\"\n then obtain R where \"x = NonceF (R$sk)\" and \"R = test \\ R \\ partners\"\n by auto\n moreover from H have \"s \\ik := insert K (ik s)\\ \\ l2_inv7\"\n by (auto intro: hoare_apply [OF l2_inv7_skr] simp add: l2_defs)\n ultimately show False using Hx \n by (auto dest: l2_inv7_aux [rotated 1])\nqed\n\n \ntext \\refinement proof\\\nlemmas l2_trans_refines_l1_trans = \n l2_dy_fake_msg_refines_learn l2_dy_fake_chan_refines_skip\n l2_lkr_others_refines_skip l2_lkr_after_refines_skip l2_skr_refines_learn\n l2_step1_refines_step1 l2_step2_refines_step2 l2_step3_refines_step3 \n\nlemma l2_refines_init_l1 [iff]:\n \"init l2 \\ R12s `` (init l1)\"\nby (auto simp add: R12s_defs l1_defs l2_loc_defs)\n\nlemma l2_refines_trans_l1 [iff]:\n \"{R12s \\ (UNIV \\ (l2_inv1 \\ l2_inv2 \\ l2_inv3 \\ l2_inv6 \\ l2_inv7 \\ l2_inv8))} trans l1, trans l2 {> R12s}\"\nby (auto 0 3 simp add: l1_def l2_def l1_trans_def l2_trans_def\n intro!: l2_trans_refines_l1_trans)\n\nlemma PO_obs_consistent_R12s [iff]: \n \"obs_consistent R12s med12s l1 l2\"\nby (auto simp add: obs_consistent_def R12s_def med12s_def l2_defs)\n\nlemma l2_refines_l1 [iff]:\n \"refines \n (R12s \\ \n (reach l1 \\ (l2_inv1 \\ l2_inv2 \\ l2_inv3 \\ l2_inv4 \\ l2_inv5 \\ l2_inv6 \\ l2_inv7 \\ l2_inv8)))\n med12s l1 l2\"\nby (rule Refinement_using_invariants, auto)\n\nlemma l2_implements_l1 [iff]:\n \"implements med12s l1 l2\"\nby (rule refinement_soundness) (auto)\n\n\nsubsection \\Derived invariants\\\n(**************************************************************************************************)\ntext \\\n We want to prove @{term \"l2_secrecy\"}:\n @{term \"dy_fake_msg (bad s) (ik s) (chan s) \\ secret s = {}\"}\n but by refinement we only get @{term \"l2_partial_secrecy\"}:\n @{term \"synth (analz (ik s)) \\ secret s = {}\"}\n This is fine, since a message in\n @{term \"dy_fake_msg (bad s) (ik s) (chan s)\"} could be added to @{term \"ik s\"},\n and @{term \"l2_partial_secrecy\"} would still hold for this new state.\n\\\n\ndefinition\n l2_partial_secrecy :: \"('a l2_state_scheme) set\"\nwhere\n \"l2_partial_secrecy \\ {s. synth (analz (ik s)) \\ secret s = {}}\"\n\n\nlemma l2_obs_partial_secrecy [iff]: \"oreach l2 \\ l2_partial_secrecy\"\napply (rule external_invariant_translation \n [OF l1_obs_secrecy _ l2_implements_l1])\napply (auto simp add: med12s_def s0_secrecy_def l2_partial_secrecy_def)\ndone\n\nlemma l2_oreach_dy_fake_msg:\n \"s \\ oreach l2 \\ x \\ dy_fake_msg (bad s) (ik s) (chan s) \\ s \\ik := insert x (ik s)\\ \\ oreach l2\"\napply (auto simp add: oreach_def, rule, simp_all, simp add: l2_def l2_trans_def l2_dy_fake_msg_def)\napply blast\ndone\n\n\ndefinition \n l2_secrecy :: \"('a l2_state_scheme) set\"\nwhere\n \"l2_secrecy \\ {s. dy_fake_msg (bad s) (ik s) (chan s) \\ secret s = {}}\"\n\nlemma l2_obs_secrecy [iff]: \"oreach l2 \\ l2_secrecy\"\napply (auto simp add:l2_secrecy_def)\napply (drule l2_oreach_dy_fake_msg, simp_all)\napply (drule l2_obs_partial_secrecy [THEN [2] rev_subsetD], simp add: l2_partial_secrecy_def)\napply blast\ndone\n\n\nlemma l2_secrecy [iff]: \"reach l2 \\ l2_secrecy\"\nby (rule external_to_internal_invariant [OF l2_obs_secrecy], auto)\n\n\nabbreviation \"l2_iagreement \\ l1_iagreement\"\n\nlemma l2_obs_iagreement [iff]: \"oreach l2 \\ l2_iagreement\"\napply (rule external_invariant_translation \n [OF l1_obs_iagreement _ l2_implements_l1])\napply (auto simp add: med12s_def l1_iagreement_def)\ndone\n\nlemma l2_iagreement [iff]: \"reach l2 \\ l2_iagreement\"\nby (rule external_to_internal_invariant [OF l2_obs_iagreement], auto)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/pfslvl2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.29098087236345377, "lm_q1q2_score": 0.15683380774496622}} {"text": "(* Title: HOL/MicroJava/BV/Typing_Framework_JVM.thy\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nsection \\The Typing Framework for the JVM \\label{sec:JVM}\\\n\ntheory Typing_Framework_JVM\nimports \"../DFA/Abstract_BV\" JVMType EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ exception_table \\ instr list \\ JVMType.state step_type\" where\n \"exec G maxs rT et bs == \n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc et) (\\pc. eff (bs!pc) G pc et)\"\n\ndefinition opt_states :: \"'c prog \\ nat \\ nat \\ (ty list \\ ty err list) option set\" where\n \"opt_states G maxs maxr \\ opt (\\{list n (types G) |n. n \\ maxs} \\ list maxr (err (types G)))\"\n\n\nsubsection \\Executability of \\<^term>\\check_bounded\\\\\n\nprimrec list_all'_rec :: \"('a \\ nat \\ bool) \\ nat \\ 'a list \\ bool\"\nwhere\n \"list_all'_rec P n [] = True\"\n| \"list_all'_rec P n (x#xs) = (P x n \\ list_all'_rec P (Suc n) xs)\"\n\ndefinition list_all' :: \"('a \\ nat \\ bool) \\ 'a list \\ bool\" where\n \"list_all' P xs \\ list_all'_rec P 0 xs\"\n\nlemma list_all'_rec:\n \"list_all'_rec P n xs = (\\p < size xs. P (xs!p) (p+n))\"\n apply (induct xs arbitrary: n)\n apply auto\n apply (case_tac p)\n apply auto\n done\n\nlemma list_all' [iff]:\n \"list_all' P xs = (\\n < size xs. P (xs!n) n)\"\n by (unfold list_all'_def) (simp add: list_all'_rec)\n\n\n\nsubsection \\Connecting JVM and Framework\\\n\nlemma check_bounded_is_bounded:\n \"check_bounded ins et \\ bounded (\\pc. eff (ins!pc) G pc et) (length ins)\" \n by (unfold bounded_def) (blast dest: check_boundedD)\n\nlemma special_ex_swap_\n\nlemmas [iff del] = not_None_eq\n\ntheorem exec_pres_type:\n \"wf_prog wf_mb S \\ \n pres_type (exec S maxs rT et bs) (size bs) (states S maxs maxr)\"\n apply (unfold exec_def JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: eff_def xcpt_eff_def norm_eff_def)\n apply (case_tac \"bs!p\")\n\n apply clarsimp\n apply (drule listE_nth_in, assumption)\n apply fastforce\n\n apply (fastforce simp add: not_None_eq)\n\n apply (fastforce simp add: not_None_eq typeof_empty_is_type)\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=\"1\" in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply (fastforce dest: field_fields fields_is_type)\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply (simp add: match_some_entry image_iff)\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n\n defer \n\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (rule_tac x=\"n'+2\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (length ST)))\" in exI) \n apply simp\n\n apply clarsimp\n apply (rule_tac x=\"Suc (Suc (Suc (Suc (length ST))))\" in exI) \n apply simp\n\n apply fastforce\n apply fastforce\n apply fastforce\n apply fastforce\n\n apply clarsimp\n apply (erule disjE)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n \n apply (erule disjE)\n apply clarsimp\n apply (drule method_wf_mdecl, assumption+)\n apply (clarsimp simp add: wf_mdecl_def wf_mhead_def)\n apply fastforce\n apply clarsimp\n apply (rule_tac x=1 in exI)\n apply fastforce\n done\n\nlemmas [iff] = not_None_eq\n\nlemma sup_state_opt_unfold:\n \"sup_state_opt G \\ Opt.le (Product.le (Listn.le (subtype G)) (Listn.le (Err.le (subtype G))))\"\n by (simp add: sup_state_opt_def sup_state_def sup_loc_def sup_ty_opt_def)\n\n\nlemma app_mono:\n \"app_mono (sup_state_opt G) (\\pc. app (bs!pc) G maxs rT pc et) (length bs) (opt_states G maxs maxr)\"\n by (unfold app_mono_def lesub_def) (blast intro: EffectMono.app_mono)\n \n\nlemma list_appendI:\n \"\\a \\ list x A; b \\ list y A\\ \\ a @ b \\ list (x+y) A\"\n apply (unfold list_def)\n apply (simp (no_asm))\n apply blast\n done\n\nlemma list_map [simp]:\n \"(map f xs \\ list (length xs) A) = (f ` set xs \\ A)\"\n apply (unfold list_def)\n apply simp\n done\n\nlemma [iff]:\n \"(OK ` A \\ err B) = (A \\ B)\"\n apply (unfold err_def)\n apply blast\n done\n\nlemma [intro]:\n \"x \\ A \\ replicate n x \\ list n A\"\n by (induct n, auto)\n\nlemma lesubstep_type_simple:\n \"a <=[Product.le (=) r] b \\ a \\|r| b\"\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n \n\nlemma eff_mono:\n \"\\p < length bs; s <=_(sup_state_opt G) t; app (bs!p) G maxs rT pc et t\\\n \\ eff (bs!p) G p et s \\|sup_state_opt G| eff (bs!p) G p et t\"\n apply (unfold eff_def)\n apply (rule lesubstep_type_simple)\n apply (rule le_list_appendI)\n apply (simp add: norm_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply (simp del: split_paired_All split_paired_Ex)\n apply (elim exE conjE)\n apply simp\n apply (drule eff'_mono, assumption)\n apply assumption\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply simp\n apply simp\n apply (simp add: lesub_def)\n apply (case_tac s)\n apply simp\n apply simp\n apply (case_tac t)\n apply simp\n apply (clarsimp simp add: sup_state_conv)\n done\n\nlemma order_sup_state_opt:\n \"ws_prog G \\ order (sup_state_opt G)\"\n by (unfold sup_state_opt_unfold) (blast dest: acyclic_subcls1 order_widen)\n\ntheorem exec_mono:\n \"ws_prog G \\ bounded (exec G maxs rT et bs) (size bs) \\\n mono (JVMType.le G maxs maxr) (exec G maxs rT et bs) (size bs) (states G maxs maxr)\" \n apply (unfold exec_def JVM_le_unfold JVM_states_unfold) \n apply (rule mono_lift)\n apply (fold sup_state_opt_unfold opt_states_def)\n apply (erule order_sup_state_opt)\n apply (rule app_mono)\n apply assumption\n apply clarify\n apply (rule eff_mono)\n apply assumption+\n done\n\ntheorem semilat_JVM_slI:\n \"ws_prog G \\ semilat (JVMType.sl G maxs maxr)\"\n apply (unfold JVMType.sl_def stk_esl_def reg_sl_def)\n apply (rule semilat_opt)\n apply (rule err_semilat_Product_esl)\n apply (rule err_semilat_upto_esl)\n apply (rule err_semilat_JType_esl, assumption+)\n apply (rule err_semilat_eslI)\n apply (rule Listn_sl)\n apply (rule err_semilat_JType_esl, assumption+)\n done\n\nlemma sl_triple_conv:\n \"JVMType.sl G maxs maxr == \n (states G maxs maxr, JVMType.le G maxs maxr, JVMType.sup G maxs maxr)\"\n by (simp (no_asm) add: states_def JVMType.le_def JVMType.sup_def)\n\nlemma is_type_pTs:\n \"\\ wf_prog wf_mb G; (C,S,fs,mdecls) \\ set G; ((mn,pTs),rT,code) \\ set mdecls \\\n \\ set pTs \\ types G\"\nproof \n assume \"wf_prog wf_mb G\" \n \"(C,S,fs,mdecls) \\ set G\"\n \"((mn,pTs),rT,code) \\ set mdecls\"\n hence \"wf_mdecl wf_mb G C ((mn,pTs),rT,code)\"\n by (rule wf_prog_wf_mdecl)\n hence \"\\t \\ set pTs. is_type G t\" \n by (unfold wf_mdecl_def wf_mhead_def) auto\n moreover\n fix t assume \"t \\ set pTs\"\n ultimately\n have \"is_type G t\" by blast\n thus \"t \\ types G\" ..\nqed\n\n\nlemma jvm_prog_lift: \n assumes wf: \n \"wf_prog (\\G C bd. P G C bd) G\"\n\n assumes rule:\n \"\\wf_mb C mn pTs C rT maxs maxl b et bd.\n wf_prog wf_mb G \\\n method (G,C) (mn,pTs) = Some (C,rT,maxs,maxl,b,et) \\\n is_class G C \\\n set pTs \\ types G \\\n bd = ((mn,pTs),rT,maxs,maxl,b,et) \\\n P G C bd \\\n Q G C bd\"\n \n shows \n \"wf_prog (\\G C bd. Q G C bd) G\"\n using wf\n apply (unfold wf_prog_def wf_cdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (unfold wf_cdecl_mdecl_def)\n apply clarsimp\n apply (drule bspec, assumption)\n apply (frule methd [OF wf [THEN wf_prog_ws_prog]], assumption+)\n apply (frule is_type_pTs [OF wf], assumption+)\n apply clarify\n apply (drule rule [OF wf], assumption+)\n apply (rule HOL.refl)\n apply assumption+\n done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/BV/Typing_Framework_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3040416812727289, "lm_q1q2_score": 0.15676994607412847}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__41_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__41_on_rules imports n_germanSimp_lemma_on_inv__41\nbegin\nsection{*All lemmas on causal relation between inv__41*}\nlemma lemma_inv__41_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__41 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__41) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__41) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__41_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.31069438321455395, "lm_q1q2_score": 0.1565608168505405}} {"text": "(* Title: HOL/Auth/n_flash_lemma_on_inv__134.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_on_inv__134 imports n_flash_base\nbegin\nsection{*All lemmas on causal relation between inv__134 and some rule r*}\nlemma n_PI_Remote_PutXVsinv__134:\nassumes a1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain dst where a1:\"dst\\N\\r=n_PI_Remote_PutX dst\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(dst=p__Inv4)\\(dst~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(dst=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') p__Inv4) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(dst~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const false))) (eqn (IVar (Field (Para (Field (Ident ''Sta'') ''Proc'') dst) ''CacheState'')) (Const CACHE_E))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__0Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Get__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_Get_Put_HeadVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Head N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Dirty'')) (Const false))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__134:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__134:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__134:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4)))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadVld'')) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_exists_HomeVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_exists_Home src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_existsVsinv__134:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4\\pp~=p__Inv4)\\(src~=p__Inv4\\pp=p__Inv4)\\(src~=p__Inv4\\pp~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4\\pp~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4\\pp~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_1Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_2Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_2 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_InvAck_3Vsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_3 N src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_ReplaceVsinv__134:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Replace src)\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Replace src\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"(src=p__Inv4)\\(src~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(src=p__Inv4)\"\n have \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(src~=p__Inv4)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_Get_GetVsinv__134:\nassumes a1: \"(r=n_PI_Local_Get_Get )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__134:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__0 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__134:\nassumes a1: \"(r=n_PI_Local_GetX_GetX__part__1 )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__134:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__134:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\\((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))) (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HeadPtr'')) (Const (index p__Inv4))))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''ShrVld'')) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true))) (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''HomeHeadPtr'')) (Const false)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Nak_ClearVsinv__134:\nassumes a1: \"(r=n_NI_Nak_Clear )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''NakcMsg'') ''Cmd'')) (Const NAKC_Nakc))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__134:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_Put)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__134:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeUniMsg'') ''Cmd'')) (Const UNI_PutX)) (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_WbVsinv__134:\nassumes a1: \"(r=n_NI_Wb )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_FAckVsinv__134:\nassumes a1: \"(r=n_NI_FAck )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\n have \"?P3 s\"\n apply (cut_tac a1 a2 , simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''InvSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_FAck))))\" in exI, auto) done\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__134:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\N\\f=inv__134 p__Inv4\" apply fastforce done\nhave \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\\((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\\((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\\((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc''))) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb)) (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Cmd'')) (Const SHWB_ShWb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) s))\"\n have \"?P3 s\"\n apply (cut_tac a1 a2 c1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)) (eqn (IVar (Field (Field (Ident ''Sta'') ''WbMsg'') ''Cmd'')) (Const WB_Wb))))\" in exI, auto) done\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (Const (index p__Inv4)) (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''Proc'')))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''ShWbMsg'') ''HomeProc'')) (Const false))) (neg (eqn (IVar (Para (Field (Field (Ident ''Sta'') ''Dir'') ''ShrSet'') p__Inv4)) (Const true)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__134:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__0 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__134:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__134:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_ReplaceVsinv__134:\n assumes a1: \"r=n_PI_Local_Replace \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_PutXVsinv__134:\n assumes a1: \"r=n_PI_Local_PutX \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_PutVsinv__134:\n assumes a1: \"r=n_PI_Local_Get_Put \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__134:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__134:\n assumes a1: \"r=n_PI_Local_GetX_PutX__part__1 \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__134:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__134:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__134:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__134:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_DirtyVsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__134:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__134:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__134:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__134 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_on_inv__134.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.31069437044942166, "lm_q1q2_score": 0.15656081041811157}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__81_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__81_on_rules imports n_g2kAbsAfter_lemma_on_inv__81\nbegin\nsection{*All lemmas on causal relation between inv__81*}\nlemma lemma_inv__81_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__81 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__81) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__81) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__81_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3007455852086007, "lm_q1q2_score": 0.156243743998828}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__44_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__44_on_rules imports n_g2kAbsAfter_lemma_on_inv__44\nbegin\nsection{*All lemmas on causal relation between inv__44*}\nlemma lemma_inv__44_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__44 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__44) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__44_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.3007455852086007, "lm_q1q2_score": 0.156243743998828}} {"text": "theory RA_seL4\nimports Main\nbegin\n\ndatatype PC = P0 | P1 | P2 | P3 | P4 | P5 | P6 | P7 | P8 | P9 | P10 | P11 | P12 | P13 | P14 | Idle\ndatatype PC_SETUP = L1 | L2 | L3 | L4\ntype_synonym Time = nat\ntype_synonym Process = nat\ntype_synonym MRange = \"nat \\ nat\"\ntype_synonym Mac = nat\n\ndatatype Cap = \n CSCap Process | VSCap Process | TCBCap Process \n | TCap | KeyCap | EPCap | GrantCap | IQCap | NetCap | SendCap | ReceiveCap | BadgeCap Process\n\ndatatype Object = P Process | INITTIME | KEY | IRQ | NONCE | MEM\ndatatype Predicate = Read | Write | Grant | Control | AsyncSend | Receive \nconsts Policy :: \"(Process \\ Predicate \\ Object) set\"\n\n\nconsts P\\<^sub>A :: Process\nconsts P\\<^sub>1 :: Process\nconsts P\\<^sub>N :: Process\n\ndefinition \"P_distinct \\ P\\<^sub>A \\ P\\<^sub>1 \\ P\\<^sub>A \\ P\\<^sub>N \\ P\\<^sub>N \\ P\\<^sub>1\"\n\n\ndatatype Message =\n Req Time Mac MRange Process\n | Res Time Mac Mac\n | Empty\n\nfun isReq :: \"Message \\ bool\" where\n \"isReq (Req _ _ _ _) = True\"\n| \"isReq _ = False\"\n\n\nfun isRes :: \"Message \\ bool\" where\n \"isRes (Res _ _ _) = True\"\n | \"isRes _ = False\"\n\nfun getMTime :: \"Message \\ Time \" where\n \"getMTime (Req t _ _ _) = t\"\n | \"getMTime (Res t _ _) = t\"\n | \"getMTime _ = 0 \"\n\nfun getMProcess :: \"Message \\ Process option\" where\n \"getMProcess (Req _ _ _ p) = Some p\"\n | \"getMProcess (Res _ _ _) = None\"\n | \"getMProcess _ = None \"\n\nfun getMRange :: \"Message \\ MRange option\" where\n \"getMRange (Req _ _ r _) = Some r\"\n | \"getMRange (Res _ _ _) = None\"\n | \"getMRange _ = None \"\n \nfun getFMac :: \"Message \\ Mac \" where\n \"getFMac (Req _ fm _ _) = fm\"\n | \"getFMac (Res _ fm _) = fm\"\n | \"getFMac _ = 0 \"\n\nfun getSMac :: \"Message \\ Mac option\" where\n \"getSMac (Req _ _ _ _) = None\"\n | \"getSMac (Res _ _ sm) = Some sm\"\n | \"getSMac _ = None \"\n\nrecord Message_req =\n time_req :: Time (*Treq, Tres, ...*)\n mac_req :: nat\n mrang_req :: MRange (*a'b'*)\n proc_req :: Process (*Pa, P1, ...*)\n\nrecord Message_resp =\n time_resp :: Time (*Treq, Tres, ...*)\n (*proc_resp :: Process Pa, P1, ...*)\n mac1_resp :: nat\n mac2_resp :: nat\n\nrecord CSpace_rec =\n Caps :: \"Cap set\"\n EP :: Message\n\nrecord TCB_rec =\n VSpace :: nat\n CSpace :: CSpace_rec\n\nrecord Proc_rec =\n TCB :: TCB_rec\n Mem :: MRange\n Priority :: nat\n Time :: nat\n Parent :: nat\n\nrecord State =\n Procs :: \"Process set\"\n ProcRec :: \"Process \\ Proc_rec\"\n TInit :: nat\n Key :: nat\n Nonce :: nat\n irq :: bool\n pc :: PC\n policy :: \"(Process \\ Predicate \\ Object) set\"\n(*Local*)\n rval :: \"Message\"\n l_time :: nat\n l_mac1 :: nat\n l_mac2 :: nat\n ep :: Message\n\n\ndefinition \"P_attest_prop s \\ \n P\\<^sub>A\\Procs s \n \\ Priority ((ProcRec s) P\\<^sub>A) = 0\n \\ Time ((ProcRec s) P\\<^sub>A) = TInit s\n \\ Parent ((ProcRec s) P\\<^sub>A) = 0 \n \\ Caps (CSpace (TCB ((ProcRec s) P\\<^sub>A))) = \n {VSCap P\\<^sub>A, CSCap P\\<^sub>A, TCBCap P\\<^sub>A, TCap, KeyCap , EPCap, GrantCap, IQCap, SendCap,BadgeCap P\\<^sub>A, BadgeCap P\\<^sub>N}\"\n\n\ndefinition \"Spawned_prop p s \\ \n p \\ P\\<^sub>A \\ p \\ Procs s \n \\ Priority ((ProcRec s) p) > 0\n \\ Time ((ProcRec s) p) > TInit s\n \\ Caps (CSpace (TCB ((ProcRec s) p))) = {VSCap p, CSCap p, TCBCap p}\"\n\ndefinition \"Net_prop p s \\ \n p \\ P\\<^sub>A \\ p \\ Procs s \n \\ Priority ((ProcRec s) p) > 0\n \\ Time ((ProcRec s) p) > TInit s\n \\ Caps (CSpace (TCB ((ProcRec s) p))) = {VSCap p, CSCap p, TCBCap p, NetCap, ReceiveCap, BadgeCap P\\<^sub>N, BadgeCap P\\<^sub>A}\"\n\nrecord SetupState = \n ss_pc :: PC_SETUP\n\ndefinition \"CreateProcess tcb mem pri t par\\ \n \\\n TCB = tcb,\n Mem = mem,\n Priority = pri,\n Time = t,\n Parent = par\n \\\"\n\n\ndefinition \"CreateProcessTCB vs cs\\ \n \\\n VSpace = vs,\n CSpace = cs\n \\\"\n\n\ndefinition \"CreateProcessCSpace caps \\ \n \\\n Caps = caps,\n EP = Empty\n \\\"\n\n \ndefinition \"MAC data::nat \\ SOME n. 1 \\ n \\ n \\ data * data * data\"\n\ndefinition \"getTime now \\ SOME t . t > now\"\n\ndefinition update_pc :: \"PC \\ State \\ State\" (\"`pc := _\" [200])\n where \n \"update_pc v \\ \\ s. s \\pc := v\\\"\n\n\ndefinition update_local_ep :: \"Message \\ State \\ State\" (\"`ep := _\" [200])\n where \n \"update_local_ep v \\ \\ s. s \\ep := v\\\"\n\n\ndefinition update_irq :: \"bool \\ State \\ State\" (\"`irq := _\" [200])\n where \n \"update_irq v \\ \\ s. s \\irq := v\\\"\n\ndefinition update_rval :: \"Message \\ State \\ State\" (\"`rval := _\" [200])\n where \n \"update_rval v \\ \\ s. s \\rval := v\\\"\n\n(*definition update_badge :: \"bool \\ Proc_rec \\ Proc_rec\" (\"`badge := _\" [100])\n where \n \"update_badge v \\ \\ s. s \\Badge := v\\\"*)\n\ndefinition update_time :: \"Time \\ State \\ State\" (\"`time := _\" [100])\n where \n \"update_time v \\ \\ s. s \\l_time := v\\\"\n\ndefinition update_mac1 :: \"nat \\ State \\ State\" (\"`mac1 := _\" [200])\n where \n \"update_mac1 v \\ \\ s. s \\l_mac1 := v\\\"\n\ndefinition update_mac2 :: \"nat \\ State \\ State\" (\"`mac2 := _\" [200])\n where \n \"update_mac2 v \\ \\ s. s \\l_mac2 := v\\\"\n\ndefinition update_nonce :: \"nat \\ State \\ State\" (\"`nonce := _\" [200])\n where \n \"update_nonce v \\ \\ s. s \\Nonce := v\\\"\n\ndefinition Setup :: \"SetupState \\ State \\ SetupState \\ State \\ bool\" where\n \"Setup ss s ss' s' \\\n (case (ss_pc ss) of\n L1 \\ let csp = CreateProcessCSpace {VSCap P\\<^sub>A, CSCap P\\<^sub>A, TCBCap P\\<^sub>A, TCap, KeyCap , EPCap, GrantCap, IQCap, SendCap, BadgeCap P\\<^sub>A, BadgeCap P\\<^sub>N};\n tcb = CreateProcessTCB 0 csp;\n pr = CreateProcess tcb (0,1) 0 (TInit s) 0 in\n s' = s\\Procs := Procs s \\ {P\\<^sub>A}, ProcRec := (ProcRec s)(P\\<^sub>A := pr), policy := policy s \\ {(P\\<^sub>A, Read, KEY),(P\\<^sub>A, Read, INITTIME), (P\\<^sub>A, Control,P P\\<^sub>A),(P\\<^sub>A, Control, IRQ), (P\\<^sub>A, Control, NONCE), (P\\<^sub>A, Control, MEM)}\\\n \\ (ss_pc ss' = L2)\n | L2 \\ let csp = CreateProcessCSpace {VSCap P\\<^sub>1, CSCap P\\<^sub>1, TCBCap P\\<^sub>1};\n tcb = CreateProcessTCB 0 csp;\n pr = CreateProcess tcb (1,2) 1 (TInit s) 1 in\n s' = s\\Procs := Procs s \\ {P\\<^sub>1}, ProcRec := (ProcRec s)(P\\<^sub>1 := pr),policy := policy s \\ {(P\\<^sub>1, Control,P P\\<^sub>1) , (P\\<^sub>A, Control,P P\\<^sub>1)}\\\n \\ (ss_pc ss' = L3) \n | L3 \\ let csp = CreateProcessCSpace {VSCap P\\<^sub>N, CSCap P\\<^sub>N, TCBCap P\\<^sub>N};\n tcb = CreateProcessTCB 0 csp;\n pr = CreateProcess tcb (2,3) 1 (TInit s) 0 in\n s' = s\\Procs := Procs s \\ {P\\<^sub>N}, ProcRec := (ProcRec s)(P\\<^sub>N := pr), policy := policy s \\ {(P\\<^sub>N, Control,P P\\<^sub>N) , (P\\<^sub>A, Control,P P\\<^sub>N)}\\\n \\ (ss_pc ss' = L4) \n | L4 \\ False\n )\n \"\n\ndefinition \"getEP s p \\ (EP (CSpace (TCB (ProcRec s p))))\"\n\n\nlemmas simps [simp] = update_nonce_def update_mac2_def update_mac1_def update_time_def (*update_badge_def*)\nupdate_rval_def update_irq_def update_pc_def MAC_def update_local_ep_def Let_def\n\ndefinition Prover :: \"State \\ State \\ bool\"\n where\n \"Prover s s' \\ \n (case (pc s) of\n P0 \\ if BadgeCap P\\<^sub>A \\ (Caps (CSpace (TCB ((ProcRec s) P\\<^sub>N)))) then s' = (`pc := P1) s else s' = s\n | P1 \\ s' = (`pc := P2 \\ `irq := False) s\n | P2 \\ let ep = (EP(CSpace (TCB ((ProcRec s) P\\<^sub>N)))) in if isReq ep then \n s' = (`pc := P3 \\ `ep := ep \\ (\\ s . s \\ProcRec := (ProcRec s)(P\\<^sub>A := (ProcRec s P\\<^sub>A)\\\n TCB := (TCB (ProcRec s P\\<^sub>A))\\CSpace := ((CSpace (TCB (ProcRec s P\\<^sub>A)))\\EP := ep\\)\\\\)\\)) s else s' = s\n | P3 \\ (if(TInit s > (getMTime (ep s)))\n then (s'= (`pc := Idle \\ `rval := Empty) s )\n else (s' = (`pc := P4) s))\n | P4 \\ (if ((getFMac (ep s)) \\ (MAC ((getMTime (ep s)) * fst (Mem ((ProcRec s) P\\<^sub>A)) * snd (Mem ((ProcRec s) P\\<^sub>A)) * (P\\<^sub>A))))\n then (s' = (`pc := Idle \\ `rval := Empty) s) \n else (s' = (`pc := P5) s))\n | P5 \\ s' = (`pc := P6 \\ `nonce := (TInit s + (getMTime (ep s)))) s\n \n | P6 \\ s' = (`pc := P7 \\ `time := (getTime ((getMTime (ep s))))) s\n\n | P7 \\ s' = (`pc := P8 \\ `mac1 := (MAC (fst (Mem ((ProcRec s) P\\<^sub>A)) * snd (Mem ((ProcRec s) P\\<^sub>A))))) s\n\n | P8 \\ s' = (`pc := P9 \\ `mac2 := (MAC ((l_time s) * (P\\<^sub>A) * (l_mac1 s)))) s\n\n | P9 \\ s' = (`pc := P10 \\ `rval := ((Res (l_time s) (l_mac1 s) (l_mac2 s)))) s\n\n | P10 \\ s' = (`pc := P11 \\ (\\ s . s \\ProcRec := (ProcRec s)(P\\<^sub>A := (ProcRec s P\\<^sub>A)\n \\TCB := (TCB (ProcRec s P\\<^sub>A))\\CSpace := ((CSpace (TCB (ProcRec s P\\<^sub>A)))\\EP := rval s\\)\\\\)\\)) s\n \n | P11 \\ s' = (`pc := Idle \\ `irq := True) s\n\n | Idle \\ False\n | _ \\ False)\"\n\n\ndefinition Network :: \"State \\ Message \\ State \\ bool\"\n where\n \"Network s m s' \\ \n case (pc s) of\n P0 \\ s' = (`pc := P1 \\ `ep := m \\ (\\ s . s \\ProcRec := (ProcRec s)(P\\<^sub>N := (ProcRec s P\\<^sub>N)\\\n TCB := (TCB (ProcRec s P\\<^sub>N))\\CSpace := ((CSpace (TCB (ProcRec s P\\<^sub>N)))\\EP := m\\)\\\\)\\)) s\n | P1 \\ if BadgeCap P\\<^sub>N \\ (Caps (CSpace (TCB ((ProcRec s) P\\<^sub>A)))) then s' = (`pc := P2) s else s' = s\n \n | P2 \\ let ep = (EP(CSpace (TCB ((ProcRec s) P\\<^sub>A)))) in\n s' = (`pc := P3 \\ (\\ s . s \\ProcRec := (ProcRec s)(P\\<^sub>N := (ProcRec s P\\<^sub>N)\\\n TCB := (TCB (ProcRec s P\\<^sub>N))\\CSpace := ((CSpace (TCB (ProcRec s P\\<^sub>N)))\\EP := ep\\)\\\\)\\)) s\n | _ \\ False\"\n\n(* -----------------------------------------------------P\\<^sub>A Related Lemmas-------------------------------------------------*)\n\nlemma Setup_P\\<^sub>A: \"ss_pc ss = L1 \\ Setup ss s ss' s' \\ P_attest_prop s'\"\n apply(simp add: Setup_def P_attest_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n done\n\nlemma Setup_P\\<^sub>1: \"P_distinct \\ ss_pc ss = L2 \\ P_attest_prop s \\ Setup ss s ss' s' \\ P_attest_prop s'\"\n by(simp add:P_distinct_def Setup_def P_attest_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\nlemma Setup_P\\<^sub>N: \"P_distinct \\ ss_pc ss = L3 \\ P_attest_prop s \\ Setup ss s ss' s' \\ P_attest_prop s'\"\n by(simp add:P_distinct_def Setup_def P_attest_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n\nlemma Network_P\\<^sub>A: \"P_attest_prop s \\ Network s m s' \\ P_attest_prop s'\"\n apply(simp add: Setup_def Prover_def Network_def P_distinct_def Setup_P\\<^sub>A P_attest_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"pc s\", simp_all)\n apply clarsimp\n apply clarsimp\n done\n\n\nlemma Prover_P\\<^sub>A: \"P_attest_prop s \\ Prover s s' \\ P_attest_prop s'\"\n apply(simp add: Setup_def Prover_def P_distinct_def Setup_P\\<^sub>A P_attest_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \" pc s\", simp_all)\n apply (case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq (EP (CSpace (TCB (ProcRec s P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) * fst (Mem (ProcRec s P\\<^sub>A)) * snd (Mem (ProcRec s P\\<^sub>A)) * P\\<^sub>A *\n (getMTime (ep s) * fst (Mem (ProcRec s P\\<^sub>A)) * snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) * fst (Mem (ProcRec s P\\<^sub>A)) * snd (Mem (ProcRec s P\\<^sub>A)) * P\\<^sub>A))\", simp_all)\n done\n\n(* -----------------------------------------------------P\\<^sub>N Related Lemmas-------------------------------------------------*)\n\n\nlemma Network_P\\<^sub>N: \"P_distinct \\ pc s = P3 \\ Net_prop P\\<^sub>N s \\ Prover s s' \\ Net_prop P\\<^sub>N s'\"\n apply(simp add:Prover_def P_distinct_def Setup_def P_attest_prop_def Net_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n done\n\nlemma Prover_P\\<^sub>N: \"P_distinct \\ pc s = P4 \\ Net_prop P\\<^sub>N s \\ Network s m s' \\ Net_prop P\\<^sub>N s'\"\n by(simp add:Network_def Prover_def P_distinct_def Setup_def P_attest_prop_def Net_prop_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n\n\n\n(* *********************************** Confidentiality Through AC ***************************************** *)\n\ndefinition \"KeyConf s \\ \\p. (p, Read, KEY)\\policy s \\ p = P\\<^sub>A\"\ndefinition \"MemConf s \\ \\p. (p, Read, MEM)\\policy s \\ p = P\\<^sub>A\"\ndefinition \"IrqAC s \\ \\p. (p, Control, IRQ)\\policy s \\ p = P\\<^sub>A\"\ndefinition \"TimeConf s \\ \\p. (p, Read, INITTIME)\\policy s \\ p = P\\<^sub>A\"\ndefinition \"NONCE_AC s \\ \\p. (p, Control, NONCE)\\policy s \\ p = P\\<^sub>A\"\ndefinition \"Super s \\ \\p. p\\ Procs s \\ (P\\<^sub>A, Control, P p)\\policy s\"\ndefinition \"no_grant s \\ \\ p p' .p \\ Procs s \\ p'\\Procs s \\ p \\ P\\<^sub>A \\ p'\\P\\<^sub>A \n \\ (p, Control, P p')\\policy s \\ p = p'\"\n\n\ndefinition \"Evolution s ss \\ (ss_pc ss = L1 \\ Procs s = {}) \\( ss_pc ss = L2 \\ Procs s = {P\\<^sub>A})\n \\ ( ss_pc ss = L3 \\ Procs s = {P\\<^sub>A , P\\<^sub>1}) \\ \n ( ss_pc ss = L4 \\ Procs s = {P\\<^sub>A , P\\<^sub>1 , P\\<^sub>N})\"\n\ndefinition \"Evolution_Policy s ss \\ (ss_pc ss = L1 \\ policy s = {}) \\(ss_pc ss = L2 \\ policy s = {(P\\<^sub>A, Read, KEY),(P\\<^sub>A, Read, INITTIME), (P\\<^sub>A, Control,P P\\<^sub>A),(P\\<^sub>A, Control, IRQ), (P\\<^sub>A, Control, NONCE), (P\\<^sub>A, Control, MEM)})\n \\ (ss_pc ss = L3 \\ policy s = {(P\\<^sub>1, Control,P P\\<^sub>1) , (P\\<^sub>A, Control,P P\\<^sub>1)}) \\ \n (ss_pc ss = L4 \\ policy s = {(P\\<^sub>N, Control,P P\\<^sub>N) , (P\\<^sub>A, Control,P P\\<^sub>N)})\"\n\ndefinition \"Reflect s \\ \\p. p\\ Procs s \\ (p, Control,P p)\\policy s\"\n\nlemma Setup_no_Control : \"Evolution_Policy s ss \\ Reflect s \\ Evolution s ss \\ P_distinct \\ no_grant s \\ Setup ss s ss' s' \\ no_grant s'\"\n apply(simp add: Setup_def del:simps)\n apply (cases \"ss_pc ss\", simp_all)\n apply safe\n apply(simp add: Reflect_def Evolution_def Evolution_Policy_def no_grant_def)\n apply(simp add: Reflect_def Evolution_def Evolution_Policy_def no_grant_def)\n\n apply blast\n \n by (simp add: Evolution_Policy_def Evolution_def P_distinct_def Reflect_def)\n\nlemma Prover_no_Control:\n assumes \"Prover s s'\"\n and \"no_grant s\"\nshows \"no_grant s'\"\n using assms\n apply(simp add: Setup_def Prover_def Evolution_def Evolution_Policy_def P_distinct_def Reflect_def P_attest_prop_def CreateProcess_def CSpace_def\n CreateProcessTCB_def no_grant_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \" isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst\n(Mem (ProcRec s P\\<^sub>A)) *\n snd\n(Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A) *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A))\", simp_all)\n done\n\n\nlemma Setup_Key_conf : \"P_distinct \\ KeyConf s \\ Setup ss s ss' s' \\ KeyConf s'\"\n apply(simp add: KeyConf_def Setup_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"ss_pc ss\", simp_all)\n done\nlemma Prover_Key_conf : \"KeyConf s \\ Prover s s' \\ KeyConf s'\"\n apply(simp add: KeyConf_def Setup_def Prover_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def P_distinct_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\n \", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst\n(Mem (ProcRec s P\\<^sub>A)) *\n snd\n(Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A) *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A))\", simp_all)\n done\n \n\n lemma Setup_Time_conf : \"TimeConf s \\ Setup ss s ss' s' \\ TimeConf s'\"\n apply(simp add: TimeConf_def Setup_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"ss_pc ss\", simp_all)\n done\n\n lemma Prover_Time_conf : \"TimeConf s \\ Prover s s' \\ TimeConf s'\"\n apply(simp add: TimeConf_def Prover_def Setup_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst\n(Mem (ProcRec s P\\<^sub>A)) *\n snd\n(Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A) *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A))\", simp_all)\n done\n\n\nlemma Superiority_Setup : \"P_distinct \\ Super s \\ Setup ss s ss' s' \\ Super s'\"\napply(simp add: Super_def Setup_def CreateProcessCSpace_def P_distinct_def\n CreateProcessTCB_def CreateProcess_def)\n apply(intro allI impI)\n apply(cases \"ss_pc ss\", simp_all)\n apply auto[1]\n apply blast\n by auto\n\n\n\nlemma Superiority_Prover : \"P_distinct \\ Super s \\ Prover s s' \\ Super s'\"\napply(simp add: Super_def Setup_def Prover_def CreateProcessCSpace_def P_distinct_def\n CreateProcessTCB_def CreateProcess_def Network_def)\n\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"\\p. p \\ Procs s \\\n (P\\<^sub>A, Control, P p)\n \\ policy s \", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\", simp_all)\n done\n\nlemma Setup_Mem_conf : \"MemConf s \\ Setup ss s ss' s' \\ MemConf s'\"\napply(simp add: MemConf_def Setup_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"ss_pc ss\", simp_all)\n done\n\nlemma Prover_Mem_conf : \"MemConf s \\ Prover s s' \\ MemConf s'\"\napply(simp add: MemConf_def Setup_def Prover_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(case_tac \"\\p. (p, Read, MEM) \\ policy s \\\n p = P\\<^sub>A\",simp_all) \n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\", simp_all)\n done\n\n\nlemma Prover_IRQ_AC : \"IrqAC s \\ Prover s s' \\ IrqAC s'\"\napply(simp add: Setup_def Prover_def CreateProcessCSpace_def P_distinct_def\n CreateProcessTCB_def CreateProcess_def Network_def IrqAC_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"\\p. (p, Control, IRQ)\n \\ policy s \\\n p = P\\<^sub>A\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\", simp_all)\n\n done\n\n\nlemma Prover_Nonce_AC : \"NONCE_AC s \\ Prover s s' \\ NONCE_AC s'\"\napply(simp add: NONCE_AC_def Setup_def Prover_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(case_tac \"\\p. (p, Control, NONCE)\n \\ policy s \\\n p = P\\<^sub>A \", simp_all)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\",simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\",simp_all)\napply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem\n (ProcRec s P\\<^sub>A)) *\n snd (Mem\n (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\",simp_all)\n done\n\n\n(* *********************************** Information Flow ***************************************** *)\n\ndefinition \"inv_rval s \\ pc s \\ {P10, P11} \\ isRes (rval s) \"\ndefinition \"inv_req s \\ pc s = P3 \\ isReq (ep s)\"\n\nlemma P\\<^sub>A_to_P\\<^sub>N:\n assumes \"Prover s s'\"\n and \"inv_rval s\"\n shows \"inv_rval s'\"\n using assms\n apply(simp add: Prover_def inv_rval_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\", simp_all)\ndone\n\nlemma P\\<^sub>N_to_P\\<^sub>A:\n assumes \"Prover s s'\"\n and \"inv_req s\"\n shows \"inv_req s'\"\nusing assms\n apply(simp add: P_distinct_def Setup_def Prover_def inv_req_def inv_rval_def CreateProcessCSpace_def\n CreateProcessTCB_def CreateProcess_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst\n(Mem (ProcRec s P\\<^sub>A)) *\n snd\n(Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A) *\n (getMTime\n (ep s) *\nfst (Mem (ProcRec s P\\<^sub>A)) *\nsnd (Mem (ProcRec s P\\<^sub>A)) *\nP\\<^sub>A))\", simp_all)\n done\n \n\nlemma Info_Flow_1: \"inv_rval s \\ pc s = P12 \\ Badge ((ProcRec s) P\\<^sub>A) \\ Prover s s' \\\n isRes (EP(CSpace (TCB ((ProcRec s') P\\<^sub>A)))) \"\n apply(simp add: Prover_def inv_rval_def)\n done\n\n \n(* *********************************** Integrity ***************************************** *)\n\n\ndefinition \"Key_AC \\ \\p. (p, Read, KEY)\\Policy \\ p = P\\<^sub>A\"\ndefinition \"Mem_AC \\ \\p. (p, Control, MEM)\\Policy \\ p = P\\<^sub>A\"\n\nlemma Res_Integrity: \"pc s\\ {P2, P3, P4, P5} \\ Badge ((ProcRec s) P\\<^sub>A) \\ isReq m \\ Network s m s' \\ pc s' = P5 \\\n (EP(CSpace (TCB ((ProcRec s') P\\<^sub>A)))) = (EP(CSpace (TCB ((ProcRec s') P\\<^sub>N)))) \"\n apply(simp add: Network_def)\n apply(case_tac \"pc s = P1\", simp_all)\n apply(case_tac \"pc s = P2\", simp_all)\n by auto\n\nlemma EP_Integrity_Prover: \"pc s = P2 \\ BadgeCap P\\<^sub>A \\ (Caps (CSpace (TCB ((ProcRec s) P\\<^sub>N)))) \\ Prover s s' \\ pc s' = P4 \\\n (EP(CSpace (TCB ((ProcRec s') P\\<^sub>A)))) = (EP(CSpace (TCB ((ProcRec s') P\\<^sub>N)))) \"\n apply(simp add: Prover_def)\n apply (case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n done\n \nlemma TInit_Integrity: \n assumes \"Prover s s'\"\n and \"P_attest_prop s\"\n shows \"TInit s' = TInit s\"\n using assms\n apply(simp add: Prover_def Key_AC_def P_attest_prop_def)\n apply(case_tac \"pc s\")\n apply simp_all\n apply(case_tac \"BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\")\n apply simp_all\n apply(case_tac \"getMTime (ep s) < TInit s\")\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\",simp_all) \n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\")\n apply simp_all\n done\n\n\nlemma Key_Integrity:\n assumes \"Prover s s'\"\n and \"P_attest_prop s\"\n shows \"Key s' = Key s\"\n using assms\n apply(simp add: Prover_def Key_AC_def P_attest_prop_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \" BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\")\n apply simp_all\n apply(case_tac \" getMTime (ep s) < TInit s\")\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\")\n apply simp_all\n done\n\n\nlemma Mem_Integrity_Prover:\n assumes \"Prover s s'\"\n and \"P_attest_prop s\"\n shows \"Mem ((ProcRec s') P\\<^sub>A) = Mem ((ProcRec s) P\\<^sub>A)\"\n using assms\n apply(simp add: Prover_def Key_AC_def P_attest_prop_def)\n apply(cases \"pc s\", simp_all)\n apply(case_tac \" BadgeCap P\\<^sub>A \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>N)))\", simp_all)\n apply (case_tac \"isReq\n (EP (CSpace\n (TCB (ProcRec s\n P\\<^sub>N))))\", simp_all)\n apply(case_tac \"getMTime (ep s) < TInit s\", simp_all)\n apply(case_tac \"getFMac (ep s) \\\n (SOME n.\n Suc 0 \\ n \\\n n \\ getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A) *\n (getMTime (ep s) *\n fst (Mem (ProcRec s P\\<^sub>A)) *\n snd (Mem (ProcRec s P\\<^sub>A)) *\n P\\<^sub>A))\", simp_all)\n done\n\nlemma Mem_Integrity_Network:\n assumes \"Network s m s'\"\n shows \"Mem ((ProcRec s') P\\<^sub>A) = Mem ((ProcRec s) P\\<^sub>A)\"\n using assms\n apply(simp add: Setup_def P_attest_prop_def Prover_def Network_def Mem_AC_def)\n apply(case_tac \"pc s\", simp_all)\n apply(case_tac \"BadgeCap P\\<^sub>N \\ Caps (CSpace (TCB (ProcRec s P\\<^sub>A)))\", simp_all)\n done\n\nend\n", "meta": {"author": "heydari-m", "repo": "FaCT", "sha": "9615b17b62cc7cb4deb8499b9fb6e75797996354", "save_path": "github-repos/isabelle/heydari-m-FaCT", "path": "github-repos/isabelle/heydari-m-FaCT/FaCT-9615b17b62cc7cb4deb8499b9fb6e75797996354/RA_seL4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.15621857793950325}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__7_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__7_on_rules imports n_g2kAbsAfter_lemma_on_inv__7\nbegin\nsection{*All lemmas on causal relation between inv__7*}\nlemma lemma_inv__7_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__7 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__7) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__7) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__7_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3073580232098525, "lm_q1q2_score": 0.1560800507673662}} {"text": "theory func_cor_OSMboxPend\n imports rg_cond_post (* func_cor_lemma*)\nbegin \n\nlemma OSMboxPend_pre_stable:\" stable (OSMboxPend_pre t) (OSMboxPend_rely t) \"\n by(simp add:OSMboxPend_pre_def OSMboxPend_rely_def stable_def gvars_conf_stable_def gvars_conf_def)\n\nlemma OSMboxPend_post_stable:\" stable (OSMboxPend_post t) (OSMboxPend_rely t) \"\n by(simp add:OSMboxPend_post_def OSMboxPend_rely_def stable_def gvars_conf_stable_def gvars_conf_def)\n\nlemma OSMboxPend_pre_stable_pre1_to_pre2_1:\" stable (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\) (OSMboxPend_rely t)\"\n by(simp add:OSMboxPend_pre_def OSMboxPend_rely_def stable_def gvars_conf_stable_def gvars_conf_def)\n\nlemma OSMboxPend_pre_stable_pre1_to_pre2_2:\" stable (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\) (OSMboxPend_rely t)\"\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_1)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n done\n\nlemma OSMboxPend_pre_stable_pre2_to_pre3:\"stable (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\endt t = NULL\\) (OSMboxPend_rely t)\"\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n done\n\nlemma OSMboxPend_pre_stable_pre4_to_pre5:\" stable (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\) (OSMboxPend_rely t)\"\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n done\n\nlemma OSMboxPend_pre_stable_pre5_to_pre6:\" stable (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\ \\\\statPend t = OS_STAT_PEND_OK\\) (OSMboxPend_rely t)\"\napply(rule stable_int2)\n apply(simp add:OSMboxPend_pre_stable_pre4_to_pre5)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n done\n\n\n\nabbreviation \" precond1 t pevent timeout \\ OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\\" \nabbreviation \" precond2 t pevent timeout \\ precond1 t pevent timeout \\ \\\\tmout t = timeout\\ \" \nabbreviation \" precond3 t pevent timeout \\ precond2 t pevent timeout \\ \\\\endt t = NULL\\ \"\nabbreviation \" precond4 t pevent timeout \\ precond2 t pevent timeout \"\nabbreviation \" precond5 t pevent timeout \\ precond4 t pevent timeout \\\\\\ret t = ETIMEOUT\\ \"\nabbreviation \" precond6 t pevent timeout \\ precond5 t pevent timeout \\\\\\statPend t = OS_STAT_PEND_OK\\ \"\nabbreviation \" precond7 t pevent timeout \\ precond1 t pevent timeout\"\nabbreviation \" precond8 t pevent timeout \\ OSMboxPend_post t\"\n\nlemma precond1_to_precond2 :\" \\\\<^sub>I (W AWAIT \\cur = Some t THEN \\tmout := \\tmout(t := timeout) \n END) sat\\<^sub>p [OSMboxPend_pre t \\\n \\pevent \\ \\OSMailBoxs\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\]\"\n apply(rule Await)\n apply(simp add: OSMboxPend_pre_stable_pre1_to_pre2_1)\n apply(simp add: OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply auto\n apply(rule Basic)apply auto\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def) apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\nlemma precond2_to_precond3:\" \n \\\\<^sub>I (W AWAIT \\cur = Some t THEN \\endt := \\endt(t := NULL) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\\n \\\\tmout t =\n timeout\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\endt t = NULL\\]\"\n apply(rule Await)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply(simp add:OSMboxPend_pre_stable_pre2_to_pre3)\n apply auto\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\nlemma precond3_to_precond4:\"OK < timeout \\\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN Cond UNIV (\\endt := \\endt(t := \\tick + nat timeout)) SKIP \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\\n \\\\endt t = NULL\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\] \"\napply(rule Await)\n apply(simp add:OSMboxPend_pre_stable_pre2_to_pre3)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply auto\n apply(rule Cond) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply(simp add:Emptyprecond)\n done\n\nlemma precond3_to_precond4_timout_less_OK:\" \\ OK < timeout \\\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN Cond {} (\\endt := \\endt(t := \\tick)) SKIP \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\\n \\\\endt t = NULL\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\] \"\napply(rule Await)\n apply(simp add:OSMboxPend_pre_stable_pre2_to_pre3)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply auto\n apply(rule Cond) \n apply(simp add:stable_id2)\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n\n apply(simp add:Skip_def) apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_pre_def OSMboxPend_guar_def)\n apply(simp add:stable_def)\n apply(simp add:stable_def)\n done\n\n\n\nlemma precond4_to_precond5:\"\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN \\ret := \\ret(t := ETIMEOUT) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\\n \\\\tmout t =\n timeout\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\] \"\n\n apply(rule Await)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_2)\n apply(simp add:OSMboxPend_pre_stable_pre4_to_pre5)\n apply auto\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\nlemma precond5_to_precond6:\"\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN \\statPend := \\statPend(t := OS_STAT_PEND_OK) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\\n \\\\ret t =\n ETIMEOUT\\, OSMboxPend_rely\n t, OSMboxPend_guar\n t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\ \\\\statPend t = OS_STAT_PEND_OK\\] \"\n\n apply(rule Await)\n apply(simp add:OSMboxPend_pre_stable_pre4_to_pre5)\n apply(simp add:OSMboxPend_pre_stable_pre5_to_pre6)\n apply auto\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\nlemma test:\"\n \\\\<^sub>I (W\\get_msg := \\get_msg(t := msgPtr (\\OSMailbox_info pevent));; \\ret := \\ret(t := OK);;\n AWAIT \\cur = Some t THEN \\OSMailbox_info := \\OSMailbox_info(pevent := msgPtr_update Map.empty (\\OSMailbox_info pevent)) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\ \\\\statPend t = OS_STAT_PEND_OK\\ \\\n \\\\cur = Some t\\ \\\n {V} \\\n - \\pevent \\ \\OSMailBoxs\\ \\\n \\\\y. msgPtr (\\OSMailbox_info pevent) =\n Some y\\, {(s, t). s = t}, UNIV, \\\\(Pair V) \\ OSMboxPend_guar t\\ \\ (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\)]\n\"\n apply(rule Seq [where mid =\" let V2 = V\\get_msg := (get_msg V)(t := msgPtr (OSMailbox_info V pevent))\\ in\n precond1 t pevent timeout \\ {V2\\ret := (ret V2)(t := OK)\\} \"])\n apply(rule Seq [where mid =\"precond1 t pevent timeout \\ {V\\get_msg := (get_msg V)(t := msgPtr (OSMailbox_info V pevent))\\}\"])\n apply auto\n apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply blast\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply(rule Basic)\n apply auto\napply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def)\n apply blast\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n\n apply(rule Await)\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply auto\n apply(rule Basic) apply auto\napply(simp add:OSMboxPend_guar_def OSMboxPend_pre_def gvars_conf_stable_def\n lvars_nochange_def gvars_conf_def inv_def inv_cur_def inv_thd_waitq_def gvars_nochange_def) \n apply auto\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def) apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\n \nlemma mid:\" cur V = Some t \\\n pevent \\ OSMailBoxs V \\\n V \\ OSMboxPend_pre t \\\n msgPtr (OSMailbox_info V pevent) = None \\ cur (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)\n (pevent := OSMailbox_info V pevent\n \\wait_q :=\n wait_q (OSMailbox_info V pevent) @\n [t]\\)\\ ) \\ Some t \\ (*It is critical that the cur V'\\ t anymore *)\n V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)\n (pevent := OSMailbox_info V pevent\n \\wait_q :=\n wait_q (OSMailbox_info V pevent) @\n [t]\\)\\ \\ OSMboxPend_pre t \"\n apply(simp add:OSMboxPend_pre_def)\n done\n\n\nlemma precond6_to_precond7_swap_ifbody_inv:\"\n cur V = Some t \\\n pevent \\ OSMailBoxs V \\\n statPend V t = OS_STAT_PEND_OK \\\n ret V t = ETIMEOUT \\\n timeout = tmout V t \\\n V \\ OSMboxPend_pre t \\\n msgPtr (OSMailbox_info V pevent) = None \\\n (if ta = t then BLOCKED else thd_state V ta) = READY \\\n invariant.inv V \\\n invariant.inv\n (V\\OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\),\n cur := Some (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)),\n thd_state :=\n \\x. if x = (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) then RUNNING\n else thd_state\n (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\),\n cur := Some (SOME ta. (ta = t \\ BLOCKED = READY) \\ (ta \\ t \\ thd_state V ta = READY))\\)\n x\\) \"\n\n apply(subgoal_tac \"thd_state V t = RUNNING\")\n prefer 2 apply(simp add:inv_def inv_cur_def) apply auto[1]\n apply(subgoal_tac \"ta \\ t \\ thd_state V ta = READY\")\n prefer 2 apply auto[1] using Thread_State_Type.distinct(3) apply presburger \n apply(subgoal_tac \"(SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) \\ t\")\n prefer 2 using exE_some[where P=\"\\tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"\n and c=\"SOME tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"] apply auto[1]\n apply(subgoal_tac \"thd_state V (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) = READY\")\n prefer 2 using exE_some[where P=\"\\tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"\n and c=\"SOME tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"] apply auto[1]\n\n apply(simp add:inv_def)\n apply(rule conjI) apply(simp add:inv_cur_def) apply auto[1]\n apply(simp add:inv_thd_waitq_def) \n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply (metis (no_types, lifting) Thread_State_Type.distinct(5) diff_is_0_eq' \n less_Suc_eq less_Suc_eq_le nth_Cons_0 nth_append nth_mem)\n apply auto[1]\n\ndone\n\nlemma precond6_to_precond7_swap_inv2:\"\n cur V = Some t \\\n pevent \\ OSMailBoxs V \\\n statPend V t = OS_STAT_PEND_OK \\\n ret V t = ETIMEOUT \\\n timeout = tmout V t \\\n invariant.inv V \\\n msgPtr (OSMailbox_info V pevent) = None \\\n (if ta = t then BLOCKED else thd_state V ta) = READY \\\n invariant.inv\n (V\\OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\),\n cur := Some (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)),\n thd_state :=\n \\x. if x = (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) then RUNNING\n else thd_state\n (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\),\n cur := Some (SOME ta. (ta = t \\ BLOCKED = READY) \\ (ta \\ t \\ thd_state V ta = READY))\\)\n x\\)\"\n\n apply(subgoal_tac \"thd_state V t = RUNNING\")\n prefer 2 apply(simp add:inv_def inv_cur_def) apply auto[1]\n apply(subgoal_tac \"ta \\ t \\ thd_state V ta = READY\")\n prefer 2 apply auto[1] using Thread_State_Type.distinct(3) apply presburger \n apply(subgoal_tac \"(SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) \\ t\")\n prefer 2 using exE_some[where P=\"\\tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"\n and c=\"SOME tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"] apply auto[1]\n apply(subgoal_tac \"thd_state V (SOME ta. ta \\ t \\ (ta \\ t \\ thd_state V ta = READY)) = READY\")\n prefer 2 using exE_some[where P=\"\\tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"\n and c=\"SOME tb. tb \\ t \\ (tb \\ t \\ thd_state V tb = READY)\"] apply auto[1]\n\n apply(simp add:inv_def)\n apply(rule conjI) apply(simp add:inv_cur_def) apply auto[1]\n apply(simp add:inv_thd_waitq_def) \n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply (metis (no_types, lifting) Thread_State_Type.distinct(5) diff_is_0_eq' \n less_Suc_eq less_Suc_eq_le nth_Cons_0 nth_append nth_mem)\n apply auto[1]\n done\n\nlemma precond6_to_precond7_swap_inv3:\" \n cur V = Some t \\\n pevent \\ OSMailBoxs V \\\n statPend V t = OS_STAT_PEND_OK \\\n ret V t = ETIMEOUT \\\n timeout = tmout V t \\\n V \\ OSMboxPend_pre t \\\n msgPtr (OSMailbox_info V pevent) = None \\\n \\ta. (if ta = t then BLOCKED else thd_state V ta) \\ READY \\\n V \\\n cur_update Map.empty\n (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\) \\\n invariant.inv V \\\n invariant.inv\n (cur_update Map.empty\n (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\)) \"\n\n apply(subgoal_tac \"thd_state V t = RUNNING\")\n prefer 2 apply(simp add:inv_def inv_cur_def) apply auto[1]\n \n apply(simp add:inv_def)\n apply(rule conjI) apply(simp add:inv_cur_def) apply auto[1]\n apply(simp add:inv_thd_waitq_def) \n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply (metis Thread_State_Type.distinct(6) diff_is_0_eq' less_Suc_eq \n less_Suc_eq_le nth_Cons_0 nth_append nth_mem)\n apply (metis (no_types, lifting) Thread_State_Type.distinct(5))\n \n done\n\nlemma precond6_to_precond7_swap_inv4:\"\n cur V = Some t \\\n pevent \\ OSMailBoxs V \\\n statPend V t = OS_STAT_PEND_OK \\\n ret V t = ETIMEOUT \\\n timeout = tmout V t \\\n invariant.inv V \\\n msgPtr (OSMailbox_info V pevent) = None \\\n \\ta. (if ta = t then BLOCKED else thd_state V ta) \\ READY \\\n invariant.inv\n (cur_update Map.empty\n (V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\)) \"\n apply(subgoal_tac \"thd_state V t = RUNNING\")\n prefer 2 apply(simp add:inv_def inv_cur_def) apply auto[1]\n \n apply(simp add:inv_def)\n apply(rule conjI) apply(simp add:inv_cur_def) apply auto[1]\n apply(simp add:inv_thd_waitq_def) \n apply(rule conjI) apply auto[1]\n apply(rule conjI) apply (metis Thread_State_Type.distinct(6) diff_is_0_eq' less_Suc_eq \n less_Suc_eq_le nth_Cons_0 nth_append nth_mem)\n apply (metis (no_types, lifting) Thread_State_Type.distinct(5))\n done\n\n\n(*lemma key is the essential part in proof *)\nlemma key:\" \n \\\\<^sub>I (W AWAIT \\cur = Some t THEN \n Await UNIV\n (\\thd_state := \\thd_state(the \\cur := BLOCKED);;\n \\OSMailbox_info := \\OSMailbox_info(pevent := \\OSMailbox_info pevent\\wait_q := wait_q (\\OSMailbox_info pevent) @ [the \\cur]\\);;\n swap) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\ \\\\statPend t = OS_STAT_PEND_OK\\ \\\n \\\\cur = Some t\\ \\\n {V} \\\n - \\pevent \\ \\OSMailBoxs\\ \\\n - \\\\y. msgPtr (\\OSMailbox_info pevent) =\n Some y\\, {(s, t). s = t}, UNIV, \\\\(Pair V) \\ OSMboxPend_guar t\\ \\ (OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\)]\"\n apply(rule Await)\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply auto\n apply(rule Await)\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply clarify\n apply(case_tac \"OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\ \\\\statPend t = OS_STAT_PEND_OK\\ \\\n \\\\cur = Some t\\ \\\n {V} \\\n - \\pevent \\ \\OSMailBoxs\\ \\\n - \\\\y. msgPtr (\\OSMailbox_info pevent) = Some y\\ \\\n \\\\cur = Some t\\ \\\n {Va} \\\n UNIV \\\n {Vaa} = {}\")\n apply(simp add:Emptyprecond)\n apply auto\n apply(rule Seq [where mid =\"let V2 = V\\thd_state := (thd_state V)(the (cur V) := BLOCKED)\\ in {V2\\OSMailbox_info := (OSMailbox_info V2)(pevent := (OSMailbox_info V2 pevent)\\wait_q := (wait_q (OSMailbox_info V2 pevent))@ [the (cur V2)]\\)\\}\"])\n apply(rule Seq [where mid =\"{V\\thd_state := (thd_state V)(the (cur V) := BLOCKED)\\}\"])apply auto\n apply(rule Basic)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n\n apply(rule Basic)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n\n\n apply(simp add:swap_def)\n apply(rule Cond)\n apply(simp add:stable_id2)\n apply(case_tac \"{V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)(pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\} \\\n \\\\t. \\thd_state t = READY\\={} \")\n apply simp using Emptyprecond apply metis\n apply(rule subst[where t=\"{V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)\n (pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\} \\\n \\\\t. \\thd_state t = READY\\\" and s=\"{V\\thd_state := (thd_state V)(t := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)\n (pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [t]\\)\\}\"])\n apply simp\n\n\n apply(rule Seq [where mid =\"let V3 = V\\thd_state := (thd_state V)(the (cur V) := BLOCKED),\n OSMailbox_info := (OSMailbox_info V)\n (pevent := OSMailbox_info V pevent\\wait_q := wait_q (OSMailbox_info V pevent) @ [the (cur V)]\\)\\\n in {V3\\cur := Some (SOME t. (thd_state V3) t = READY) \\}\"])\n\n apply(rule Basic) (*\\cur := Some (SOME t. \\thd_state t = READY)*)\n apply auto[1] apply simp apply(simp add:stable_def) apply(simp add:stable_def)\n apply(rule Basic) (* swap: \\thd_state := \\thd_state(the \\cur := RUNNING) *)\n apply auto[1] \n apply(simp add:OSMboxPend_guar_def) (* \\ Mem_pool_alloc_guar t *)\n apply(rule disjI1)\n apply(rule conjI)\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(rule conjI)\n apply auto\n apply(simp add:precond6_to_precond7_swap_ifbody_inv)\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_pre_def) \n apply(simp add:precond6_to_precond7_swap_inv2)\n apply(simp add:stable_def)\n apply(simp add:stable_def)\n apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_guar_def) (*\\OSMboxPend_guar *)\n apply auto\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(simp add:precond6_to_precond7_swap_inv3)\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_pre_def)\n apply(simp add:precond6_to_precond7_swap_inv4)\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n done\n\nlemma precond6_to_precond7:\"\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN \n IF pevent \\ \\OSMailBoxs THEN \\ret := \\ret(t := ETIMEOUT)\n ELSE IF \\y. msgPtr (\\OSMailbox_info pevent) = Some y\n THEN \\get_msg := \\get_msg(t := msgPtr (\\OSMailbox_info pevent));; \\ret := \\ret(t := OK);;\n AWAIT \\cur = Some t THEN \\OSMailbox_info := \\OSMailbox_info(pevent := msgPtr_update Map.empty (\\OSMailbox_info pevent)) END\n ELSE AWAIT \\cur = Some t THEN \n Await UNIV\n (\\thd_state := \\thd_state(the \\cur := BLOCKED);;\n \\OSMailbox_info := \\OSMailbox_info(pevent := \\OSMailbox_info pevent\\wait_q := wait_q (\\OSMailbox_info pevent) @ [the \\cur]\\);;\n swap) \n END\n FI\n FI \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\ \\ \\\\tmout t = timeout\\ \\ \\\\ret t = ETIMEOUT\\ \\\n \\\\statPend t = OS_STAT_PEND_OK\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\] \"\n\n apply(rule Await) (*pre6_to_pre7 *)\n apply(simp add:OSMboxPend_pre_stable_pre5_to_pre6)\n apply(simp add:OSMboxPend_pre_stable_pre1_to_pre2_1)\n apply auto\n apply(rule Cond)\n apply(simp add:stable_id2)\n apply(rule Basic)\n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply auto\n apply(simp add:stable_id2)\n apply(simp add:stable_id2)\n apply (rule Cond)\n apply(simp add:stable_id2) apply auto\n apply(simp add:test)\n apply(simp add:key)\n done\n\nlemma precond7_to_precond8:\"\n \\\\<^sub>I (W AWAIT \\cur = Some t THEN Await UNIV (IF \\statPend t = OS_STAT_PEND_OK THEN \\ret := \\ret(t := OK) ELSE \\ret := \\ret(t := OS_ERR_TIMEOUT)FI) \n END) sat\\<^sub>p [OSMboxPend_pre t \\ \\pevent \\ \\OSMailBoxs\\, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_post t] \"\n apply(rule Await)\n apply(simp add: OSMboxPend_pre_stable_pre1_to_pre2_1)\n apply(simp add: OSMboxPend_post_stable)\n apply auto\n apply(rule Await)\n apply(simp add:stable_def)\n apply(simp add:stable_def)\n apply auto\n apply(rule Cond)\n apply(simp add:stable_def)\n apply auto\n\n apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_guar_def)apply auto\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_post_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)apply auto\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:stable_def)\n apply(simp add:OSMboxPend_pre_def inv_def inv_cur_def inv_thd_waitq_def)apply auto\n apply(simp add:stable_def)\n\n apply(rule Basic)\n apply(simp add:OSMboxPend_pre_def OSMboxPend_post_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:OSMboxPend_guar_def)apply auto\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply(simp add:lvars_nochange_def)\n apply(simp add:stable_def)\n apply(simp add:OSMboxPend_pre_def OSMboxPend_post_def inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_def)\n done\n\n\nlemma precond8_to_post:\" \\\\<^sub>I (W IF \\tmout t \\\n ETIMEOUT THEN AWAIT \\cur = Some t THEN \\tmout := \\tmout(t := int (\\endt t) - int \\tick) END;;\n IF \\tmout t\n < OK THEN AWAIT \\cur = Some t THEN \\ret := \\ret(t := OS_ERR_TIMEOUT) \n END FI FI) sat\\<^sub>p [OSMboxPend_post t, OSMboxPend_rely t, OSMboxPend_guar t, OSMboxPend_post t] \"\n\n\n apply(rule Cond)\n apply(simp add:OSMboxPend_post_stable)\n apply(rule Seq [where mid =\"precond8 t pevent timeout\"])\n\n apply(rule Await)\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n apply(simp add:OSMboxPend_post_stable)\n\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def)apply auto\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_post_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_def)\n apply(simp add:stable_def)\n\n apply(rule Cond)\n apply(simp add:OSMboxPend_post_stable)\n apply(rule Await)\napply(rule stable_int2)\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n apply(simp add:OSMboxPend_post_stable)\n\n apply(rule Basic)\n apply(simp add:OSMboxPend_guar_def)apply auto\n apply(simp add:gvars_conf_stable_def gvars_conf_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_post_def)\n apply(simp add:inv_def inv_cur_def inv_thd_waitq_def)\n apply auto\n apply(simp add:stable_def)\n apply(simp add:stable_def)\n \n apply(simp add:Skip_def)apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_guar_def)\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:OSMboxPend_guar_def)\n\napply(simp add:Skip_def)apply(rule Basic)\n apply auto\n apply(simp add:OSMboxPend_guar_def)\n apply(rule stable_int2)\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:stable_def) apply clarify\n apply(simp add:OSMboxPend_rely_def gvars_conf_stable_def gvars_conf_def) \n apply(simp add:stable_def OSMboxPend_rely_def lvars_nochange_rel_def gvars_conf_stable_def)\n apply(simp add:lvars_nochange_def)\n apply auto\n\n apply(simp add:OSMboxPend_post_stable)\n apply(simp add:OSMboxPend_guar_def)\n done\n\n\nlemma OSMboxPend_satRG: \"\\ (OSMboxPend t pevent timeout) \\ OSMboxPend_RGCond t\"\n apply (simp add:Evt_sat_RG_def)\n apply (simp add:OSMboxPend_def OSMboxPend_RGCond_def)\n apply(simp add:body_def Pre\\<^sub>f_def Post\\<^sub>f_def guard_def\n Rely\\<^sub>f_def Guar\\<^sub>f_def getrgformula_def)\n apply(unfold stm_def)\n apply auto apply (rule BasicEvt)\n apply(simp add:body_def guard_def)\n apply(rule Seq [where mid =\"precond8 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond7 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond6 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond5 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond4 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond3 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond2 t pevent timeout\"])\n\n apply(simp add:precond1_to_precond2)\n apply(simp add:precond2_to_precond3)\n apply(simp add:precond3_to_precond4)\n apply(simp add:precond4_to_precond5)\n apply(simp add:precond5_to_precond6)\n apply(simp add:precond6_to_precond7)\n apply(simp add:precond7_to_precond8)\n apply(simp add:precond8_to_post)\n apply(simp add:OSMboxPend_pre_stable)\n apply(simp add:OSMboxPend_guar_def)\n\n\n apply (rule BasicEvt)\n apply(simp add:body_def guard_def)\n apply(rule Seq [where mid =\"precond8 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond7 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond6 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond5 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond4 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond3 t pevent timeout\"])\n apply(rule Seq [where mid =\"precond2 t pevent timeout\"])\n\n apply(simp add:precond1_to_precond2)\n apply(simp add:precond2_to_precond3)\n apply(simp add:precond3_to_precond4_timout_less_OK)\n apply(simp add:precond4_to_precond5)\n apply(simp add:precond5_to_precond6)\n apply(simp add:precond6_to_precond7)\n apply(simp add:precond7_to_precond8)\n apply(simp add:precond8_to_post)\n apply(simp add:OSMboxPend_pre_stable)\n apply(simp add:OSMboxPend_guar_def)\n\n done\n\n\n\nend", "meta": {"author": "zerrymore", "repo": "Verified-Mailbox", "sha": "778ac0f3b87f342e02dd4a6ad86abeb32be82d42", "save_path": "github-repos/isabelle/zerrymore-Verified-Mailbox", "path": "github-repos/isabelle/zerrymore-Verified-Mailbox/Verified-Mailbox-778ac0f3b87f342e02dd4a6ad86abeb32be82d42/PiCore-SIMP-mailbox/func_cor_OSMboxPend.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.28140561345566495, "lm_q1q2_score": 0.15603110133523682}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n The refinement relation between abstract and concrete states\n*)\n\ntheory StateRelation\nimports InvariantUpdates_H\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n cte_map :: \"cslot_ptr \\ machine_word\"\nwhere\n \"cte_map \\ \\(oref, cref). oref + (of_bl cref * 2 ^ cte_level_bits)\"\n\nlemmas cte_map_def' = cte_map_def[simplified cte_level_bits_def, simplified]\n\ndefinition\n lookup_failure_map :: \"ExceptionTypes_A.lookup_failure \\ Fault_H.lookup_failure\"\nwhere\n \"lookup_failure_map \\ \\lf. case lf of\n ExceptionTypes_A.InvalidRoot \\ Fault_H.InvalidRoot\n | ExceptionTypes_A.MissingCapability n \\ Fault_H.MissingCapability n\n | ExceptionTypes_A.DepthMismatch n m \\ Fault_H.DepthMismatch n m\n | ExceptionTypes_A.GuardMismatch n g \\ Fault_H.GuardMismatch n (of_bl g) (length g)\"\n\nprimrec\n arch_fault_map :: \"Machine_A.X64_A.arch_fault \\ ArchFault_H.X64_H.arch_fault\"\nwhere\n \"arch_fault_map (Machine_A.X64_A.VMFault ptr msg) = ArchFault_H.X64_H.VMFault ptr msg\"\n\nprimrec\n fault_map :: \"ExceptionTypes_A.fault \\ Fault_H.fault\"\nwhere\n \"fault_map (ExceptionTypes_A.CapFault ref bool failure) =\n Fault_H.CapFault ref bool (lookup_failure_map failure)\"\n| \"fault_map (ExceptionTypes_A.ArchFault arch_fault) =\n Fault_H.ArchFault (arch_fault_map arch_fault)\"\n| \"fault_map (ExceptionTypes_A.UnknownSyscallException n) =\n Fault_H.UnknownSyscallException n\"\n| \"fault_map (ExceptionTypes_A.UserException x y) =\n Fault_H.UserException x y\"\n\n\ntext \\\n A pspace and a tree are related if every object in the pspace\n corresponds to an object in the tree. Some abstract objects\n like CapTables correspond to multiple concrete ones, thus we\n have to make cuts.\n\\\n\ntype_synonym obj_relation_cut = \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\ntype_synonym obj_relation_cuts = \"(machine_word \\ obj_relation_cut) set\"\n\ndefinition\n vmrights_map :: \"rights set \\ vmrights\"\nwhere\n \"vmrights_map S \\ if AllowRead \\ S\n then (if AllowWrite \\ S then VMReadWrite else VMReadOnly)\n else VMKernelOnly\"\n\ndefinition\n zbits_map :: \"nat option \\ zombie_type\"\nwhere\n \"zbits_map N \\ case N of Some n \\ ZombieCNode n\n | None \\ ZombieTCB\"\n\nprimrec\n acap_relation :: \"arch_cap \\ arch_capability \\ bool\"\nwhere\n \"acap_relation (arch_cap.ASIDPoolCap x y) c = (c =\n arch_capability.ASIDPoolCap x y)\"\n| \"acap_relation (arch_cap.ASIDControlCap) c = (c =\n arch_capability.ASIDControlCap)\"\n| \"acap_relation (arch_cap.PageCap dev word rghts typ sz data) c = (c =\n arch_capability.PageCap word (vmrights_map rghts) typ sz dev data)\"\n| \"acap_relation (arch_cap.PageTableCap word data) c = (c =\n arch_capability.PageTableCap word data)\"\n| \"acap_relation (arch_cap.PageDirectoryCap word data) c = (c =\n arch_capability.PageDirectoryCap word data)\"\n| \"acap_relation (arch_cap.PDPointerTableCap word data) c = (c =\n arch_capability.PDPointerTableCap word data)\"\n| \"acap_relation (arch_cap.PML4Cap word data) c = (c =\n arch_capability.PML4Cap word data)\"\n| \"acap_relation (arch_cap.IOPortCap f l) c = (c =\n arch_capability.IOPortCap f l)\"\n| \"acap_relation (arch_cap.IOPortControlCap) c = (c = arch_capability.IOPortControlCap)\"\n\nprimrec\n cap_relation :: \"cap \\ capability \\ bool\"\nwhere\n \"cap_relation Structures_A.NullCap c = (c =\n Structures_H.NullCap)\"\n| \"cap_relation Structures_A.DomainCap c = (c =\n Structures_H.DomainCap)\"\n| \"cap_relation (Structures_A.UntypedCap dev ref n f) c = (c =\n Structures_H.UntypedCap dev ref n f)\"\n| \"cap_relation (Structures_A.EndpointCap ref b r) c = (c =\n Structures_H.EndpointCap ref b (AllowSend \\ r)\n (AllowRecv \\ r) (AllowGrant \\ r) (AllowGrantReply \\ r))\"\n| \"cap_relation (Structures_A.NotificationCap ref b r) c = (c =\n Structures_H.NotificationCap ref b (AllowSend \\ r) (AllowRecv \\ r))\"\n| \"cap_relation (Structures_A.CNodeCap ref n L) c = (c =\n Structures_H.CNodeCap ref n (of_bl L) (length L))\"\n| \"cap_relation (Structures_A.ThreadCap ref) c = (c =\n Structures_H.ThreadCap ref)\"\n| \"cap_relation (Structures_A.ReplyCap ref master r) c = (c =\n Structures_H.ReplyCap ref master (AllowGrant \\ r))\"\n| \"cap_relation (Structures_A.IRQControlCap) c = (c =\n Structures_H.IRQControlCap)\"\n| \"cap_relation (Structures_A.IRQHandlerCap irq) c = (c =\n Structures_H.IRQHandlerCap irq)\"\n| \"cap_relation (Structures_A.ArchObjectCap a) c = (\\a'.\n acap_relation a a' \\ c = Structures_H.ArchObjectCap a')\"\n| \"cap_relation (Structures_A.Zombie p b n) c = (c =\n Structures_H.Zombie p (zbits_map b) n)\"\n\n\ndefinition\n cte_relation :: \"cap_ref \\ obj_relation_cut\"\nwhere\n \"cte_relation y \\ \\ko ko'. \\sz cs cte cap. ko = CNode sz cs \\ ko' = KOCTE cte\n \\ cs y = Some cap \\ cap_relation cap (cteCap cte)\"\n\ndefinition\n asid_pool_relation :: \"(9 word \\ machine_word) \\ asidpool \\ bool\"\nwhere\n \"asid_pool_relation \\ \\p p'. p = inv ASIDPool p' o ucast\"\n\ndefinition\n ntfn_relation :: \"Structures_A.notification \\ Structures_H.notification \\ bool\"\nwhere\n \"ntfn_relation \\ \\ntfn ntfn'.\n (case ntfn_obj ntfn of\n Structures_A.IdleNtfn \\ ntfnObj ntfn' = Structures_H.IdleNtfn\n | Structures_A.WaitingNtfn q \\ ntfnObj ntfn' = Structures_H.WaitingNtfn q\n | Structures_A.ActiveNtfn b \\ ntfnObj ntfn' = Structures_H.ActiveNtfn b)\n \\ ntfn_bound_tcb ntfn = ntfnBoundTCB ntfn'\"\n\ndefinition\n ep_relation :: \"Structures_A.endpoint \\ Structures_H.endpoint \\ bool\"\nwhere\n \"ep_relation \\ \\ep ep'. case ep of\n Structures_A.IdleEP \\ ep' = Structures_H.IdleEP\n | Structures_A.RecvEP q \\ ep' = Structures_H.RecvEP q\n | Structures_A.SendEP q \\ ep' = Structures_H.SendEP q\"\n\ndefinition\n fault_rel_optionation :: \"ExceptionTypes_A.fault option \\ Fault_H.fault option \\ bool\"\nwhere\n \"fault_rel_optionation \\ \\f f'. f' = option_map fault_map f\"\n\nprimrec\n thread_state_relation :: \"Structures_A.thread_state \\ Structures_H.thread_state \\ bool\"\nwhere\n \"thread_state_relation (Structures_A.Running) ts'\n = (ts' = Structures_H.Running)\"\n| \"thread_state_relation (Structures_A.Restart) ts'\n = (ts' = Structures_H.Restart)\"\n| \"thread_state_relation (Structures_A.Inactive) ts'\n = (ts' = Structures_H.Inactive)\"\n| \"thread_state_relation (Structures_A.IdleThreadState) ts'\n = (ts' = Structures_H.IdleThreadState)\"\n| \"thread_state_relation (Structures_A.BlockedOnReply) ts'\n = (ts' = Structures_H.BlockedOnReply)\"\n| \"thread_state_relation (Structures_A.BlockedOnReceive oref sp) ts'\n = (ts' = Structures_H.BlockedOnReceive oref (receiver_can_grant sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnSend oref sp) ts'\n = (ts' = Structures_H.BlockedOnSend oref (sender_badge sp)\n (sender_can_grant sp) (sender_can_grant_reply sp) (sender_is_call sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnNotification oref) ts'\n = (ts' = Structures_H.BlockedOnNotification oref)\"\n\ndefinition\n arch_tcb_relation :: \"Structures_A.arch_tcb \\ Structures_H.arch_tcb \\ bool\"\nwhere\n \"arch_tcb_relation \\ \\atcb atcb'.\n tcb_context atcb = atcbContext atcb'\"\n\ndefinition\n tcb_relation :: \"Structures_A.tcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"tcb_relation \\ \\tcb tcb'.\n tcb_fault_handler tcb = to_bl (tcbFaultHandler tcb')\n \\ tcb_ipc_buffer tcb = tcbIPCBuffer tcb'\n \\ arch_tcb_relation (tcb_arch tcb) (tcbArch tcb')\n \\ thread_state_relation (tcb_state tcb) (tcbState tcb')\n \\ fault_rel_optionation (tcb_fault tcb) (tcbFault tcb')\n \\ cap_relation (tcb_ctable tcb) (cteCap (tcbCTable tcb'))\n \\ cap_relation (tcb_vtable tcb) (cteCap (tcbVTable tcb'))\n \\ cap_relation (tcb_reply tcb) (cteCap (tcbReply tcb'))\n \\ cap_relation (tcb_caller tcb) (cteCap (tcbCaller tcb'))\n \\ cap_relation (tcb_ipcframe tcb) (cteCap (tcbIPCBufferFrame tcb'))\n \\ tcb_bound_notification tcb = tcbBoundNotification tcb'\n \\ tcb_mcpriority tcb = tcbMCP tcb'\"\n\ndefinition\n other_obj_relation :: \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\nwhere\n \"other_obj_relation obj obj' \\\n (case (obj, obj') of\n (TCB tcb, KOTCB tcb') \\ tcb_relation tcb tcb'\n | (Endpoint ep, KOEndpoint ep') \\ ep_relation ep ep'\n | (Notification ntfn, KONotification ntfn') \\ ntfn_relation ntfn ntfn'\n | (ArchObj (X64_A.ASIDPool pool), KOArch (KOASIDPool pool'))\n \\ asid_pool_relation pool pool'\n | _ \\ False)\"\n\nprimrec\n pml4e_relation' :: \"X64_A.pml4e \\ X64_H.pml4e \\ bool\"\nwhere\n \"pml4e_relation' X64_A.InvalidPML4E x = (x = X64_H.InvalidPML4E)\"\n| \"pml4e_relation' (X64_A.PDPointerTablePML4E ptr atts rights) x\n = (x = X64_H.PDPointerTablePML4E ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n\n\nprimrec\n pdpte_relation' :: \"X64_A.pdpte \\ X64_H.pdpte \\ bool\"\nwhere\n \"pdpte_relation' X64_A.InvalidPDPTE x = (x = X64_H.InvalidPDPTE)\"\n| \"pdpte_relation' (X64_A.PageDirectoryPDPTE ptr atts rights) x\n = (x = X64_H.PageDirectoryPDPTE ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n| \"pdpte_relation' (X64_A.HugePagePDPTE ptr atts rghts) x\n = (x = X64_H.HugePagePDPTE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\nprimrec\n pde_relation' :: \"X64_A.pde \\ X64_H.pde \\ bool\"\nwhere\n \"pde_relation' X64_A.InvalidPDE x = (x = X64_H.InvalidPDE)\"\n| \"pde_relation' (X64_A.PageTablePDE ptr atts rights) x\n = (x = X64_H.PageTablePDE ptr (Accessed \\ atts) (CacheDisabled \\ atts) (WriteThrough \\ atts)\n (ExecuteDisable \\ atts) (vmrights_map rights))\"\n| \"pde_relation' (X64_A.LargePagePDE ptr atts rghts) x\n = (x = X64_H.LargePagePDE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\n\nprimrec\n pte_relation' :: \"X64_A.pte \\ X64_H.pte \\ bool\"\nwhere\n \"pte_relation' X64_A.InvalidPTE x = (x = X64_H.InvalidPTE)\"\n| \"pte_relation' (X64_A.SmallPagePTE ptr atts rghts) x\n = (x = X64_H.SmallPagePTE ptr (Global \\ atts) (PAT \\ atts) (Dirty \\ atts)\n (PTAttr Accessed \\ atts) (PTAttr CacheDisabled \\ atts)\n (PTAttr WriteThrough \\ atts) (PTAttr ExecuteDisable \\ atts)\n (vmrights_map rghts))\"\n\ndefinition\n \"pte_relation y \\ \\ko ko'. \\pt pte. ko = ArchObj (PageTable pt) \\ ko' = KOArch (KOPTE pte)\n \\ pte_relation' (pt y) pte\"\n\ndefinition\n \"pde_relation y \\ \\ko ko'. \\pd pde. ko = ArchObj (PageDirectory pd) \\ ko' = KOArch (KOPDE pde)\n \\ pde_relation' (pd y) pde\"\n\ndefinition\n \"pdpte_relation y \\ \\ko ko'. \\pd pdpte. ko = ArchObj (PDPointerTable pd) \\ ko' = KOArch (KOPDPTE pdpte)\n \\ pdpte_relation' (pd y) pdpte\"\n\ndefinition\n \"pml4e_relation y \\ \\ko ko'. \\pd pml4e. ko = ArchObj (PageMapL4 pd) \\ ko' = KOArch (KOPML4E pml4e)\n \\ pml4e_relation' (pd y) pml4e\"\n\nprimrec\n aobj_relation_cuts :: \"X64_A.arch_kernel_obj \\ machine_word \\ obj_relation_cuts\"\nwhere\n \"aobj_relation_cuts (DataPage dev sz) x =\n {(x + n * 2 ^ pageBits, \\_ obj. obj = (if dev then KOUserDataDevice else KOUserData) ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\"\n| \"aobj_relation_cuts (X64_A.ASIDPool pool) x =\n {(x, other_obj_relation)}\"\n| \"aobj_relation_cuts (PageTable pt) x =\n (\\y. (x + (ucast y << word_size_bits), pte_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PageDirectory pd) x =\n (\\y. (x + (ucast y << word_size_bits), pde_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PDPointerTable pdpt) x =\n (\\y. (x + (ucast y << word_size_bits), pdpte_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PageMapL4 pm) x =\n (\\y. (x + (ucast y << word_size_bits), pml4e_relation y)) ` UNIV\"\n\nprimrec\n obj_relation_cuts :: \"Structures_A.kernel_object \\ machine_word \\ obj_relation_cuts\"\nwhere\n \"obj_relation_cuts (CNode sz cs) x =\n (if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)})\"\n| \"obj_relation_cuts (TCB tcb) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Endpoint ep) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Notification ntfn) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (ArchObj ao) x = aobj_relation_cuts ao x\"\n\n\nlemma obj_relation_cuts_def2:\n \"obj_relation_cuts ko x =\n (case ko of CNode sz cs \\ if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)}\n | ArchObj (PageTable pt) \\ (\\y. (x + (ucast y << word_size_bits), pte_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PageDirectory pd) \\ (\\y. (x + (ucast y << word_size_bits), pde_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PDPointerTable pdpt) \\ (\\y. (x + (ucast y << word_size_bits), pdpte_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (PageMapL4 pm) \\ (\\y. (x + (ucast y << word_size_bits), pml4e_relation y))\n ` (UNIV :: 9 word set)\n | ArchObj (DataPage dev sz) \\\n {(x + n * 2 ^ pageBits, \\_ obj. obj =(if dev then KOUserDataDevice else KOUserData)) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | _ \\ {(x, other_obj_relation)})\"\n by (simp split: Structures_A.kernel_object.split\n X64_A.arch_kernel_obj.split)\n\nlemma obj_relation_cuts_def3:\n \"obj_relation_cuts ko x =\n (case (a_type ko) of\n ACapTable n \\ {(cte_map (x, y), cte_relation y) | y. length y = n}\n | AArch APageTable \\ (\\y. (x + (ucast y << word_size_bits), pte_relation y))\n ` (UNIV :: 9 word set)\n | AArch APageDirectory \\ (\\y. (x + (ucast y << word_size_bits), pde_relation y))\n ` (UNIV :: 9 word set)\n | AArch APDPointerTable \\ (\\y. (x + (ucast y << word_size_bits), pdpte_relation y))\n ` (UNIV :: 9 word set)\n | AArch APageMapL4 \\ (\\y. (x + (ucast y << word_size_bits), pml4e_relation y))\n ` (UNIV :: 9 word set)\n | AArch (AUserData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserData) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AArch (ADeviceData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserDataDevice ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AGarbage _ \\ {(x, \\\\)}\n | _ \\ {(x, other_obj_relation)})\"\n apply (simp add: obj_relation_cuts_def2 a_type_def\n split: Structures_A.kernel_object.split\n X64_A.arch_kernel_obj.split)\n apply (clarsimp simp: well_formed_cnode_n_def length_set_helper)\n done\n\ndefinition\n \"is_other_obj_relation_type tp \\\n case tp of\n ACapTable n \\ False\n | AArch APageTable \\ False\n | AArch APageDirectory \\ False\n | AArch APDPointerTable \\ False\n | AArch APageMapL4 \\ False\n | AArch (AUserData _) \\ False\n | AArch (ADeviceData _) \\ False\n | AGarbage _ \\ False\n | _ \\ True\"\n\nlemma is_other_obj_relation_type_CapTable:\n \"\\ is_other_obj_relation_type (ACapTable n)\"\n by (simp add: is_other_obj_relation_type_def)\n\nlemma is_other_obj_relation_type_UserData:\n \"\\ is_other_obj_relation_type (AArch (AUserData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type_DeviceData:\n \"\\ is_other_obj_relation_type (AArch (ADeviceData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type:\n \"is_other_obj_relation_type (a_type ko) \\\n obj_relation_cuts ko x = {(x, other_obj_relation)}\"\n by (simp add: obj_relation_cuts_def3 is_other_obj_relation_type_def\n split: a_type.splits aa_type.splits)\n\ndefinition\n pspace_dom :: \"Structures_A.kheap \\ machine_word set\"\nwhere\n \"pspace_dom ps \\ \\x\\dom ps. fst ` (obj_relation_cuts (the (ps x)) x)\"\n\ndefinition\n pspace_relation :: \"Structures_A.kheap \\ (machine_word \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"pspace_relation ab con \\\n (pspace_dom ab = dom con) \\\n (\\x \\ dom ab. \\(y, P) \\ obj_relation_cuts (the (ab x)) x.\n P (the (ab x)) (the (con y)))\"\n\ndefinition etcb_relation :: \"etcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"etcb_relation \\ \\etcb tcb'.\n tcb_priority etcb = tcbPriority tcb'\n \\ tcb_time_slice etcb = tcbTimeSlice tcb'\n \\ tcb_domain etcb = tcbDomain tcb'\"\n\ndefinition\n ekheap_relation :: \"(obj_ref \\ etcb option) \\ (machine_word \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"ekheap_relation ab con \\\n \\x \\ dom ab. \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation (the (ab x)) tcb'\"\n\nprimrec\n sched_act_relation :: \"Deterministic_A.scheduler_action \\ Structures_H.scheduler_action \\ bool\"\nwhere\n \"sched_act_relation resume_cur_thread a' = (a' = ResumeCurrentThread)\" |\n \"sched_act_relation choose_new_thread a' = (a' = ChooseNewThread)\" |\n \"sched_act_relation (switch_thread x) a' = (a' = SwitchToThread x)\"\n\ndefinition\n ready_queues_relation :: \"(Deterministic_A.domain \\ Structures_A.priority \\ Deterministic_A.ready_queue)\n \\ (domain \\ priority \\ KernelStateData_H.ready_queue) \\ bool\"\nwhere\n \"ready_queues_relation qs qs' \\ \\d p. (qs d p = qs' (d, p))\"\n\ndefinition\n ghost_relation :: \"Structures_A.kheap \\ (machine_word \\ vmpage_size) \\ (machine_word \\ nat) \\ bool\"\nwhere\n \"ghost_relation h ups cns \\\n (\\a sz. (\\dev. h a = Some (ArchObj (DataPage dev sz))) \\ ups a = Some sz) \\\n (\\a n. (\\cs. h a = Some (CNode n cs) \\ well_formed_cnode_n n cs) \\\n cns a = Some n)\"\n\ndefinition\n cdt_relation :: \"(cslot_ptr \\ bool) \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_relation \\ \\cte_at m m'.\n \\c. cte_at c \\ cte_map ` descendants_of c m = descendants_of' (cte_map c) m'\"\n\ndefinition\n cdt_list_relation :: \"cdt_list \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_list_relation \\ \\t m m'.\n \\c cap node. m' (cte_map c) = Some (CTE cap node)\n \\ (case next_slot c t m of None \\ True\n | Some next \\ mdbNext node = cte_map next)\"\n\ndefinition\n revokable_relation :: \"(cslot_ptr \\ bool) \\ (cslot_ptr \\ cap option) \\ cte_heap \\ bool\"\nwhere\n \"revokable_relation revo cs m' \\\n \\c cap node. cs c \\ None \\\n m' (cte_map c) = Some (CTE cap node) \\\n revo c = mdbRevocable node\"\n\ndefinition\n irq_state_relation :: \"irq_state \\ irqstate \\ bool\"\nwhere\n \"irq_state_relation irq irq' \\ case (irq, irq') of\n (irq_state.IRQInactive, irqstate.IRQInactive) \\ True\n | (irq_state.IRQSignal, irqstate.IRQSignal) \\ True\n | (irq_state.IRQTimer, irqstate.IRQTimer) \\ True\n | _ \\ False\"\n\ndefinition\n interrupt_state_relation :: \"(irq \\ obj_ref) \\ (irq \\ irq_state) \\ interrupt_state \\ bool\"\nwhere\n \"interrupt_state_relation node_map irqs is \\\n (\\node irqs'. is = InterruptState node irqs'\n \\ (\\irq. node_map irq = node + (ucast irq << cte_level_bits))\n \\ (\\irq. irq_state_relation (irqs irq) (irqs' irq)))\"\n\ndefinition\n cr3_relation :: \"X64_A.cr3 \\ cr3 \\ bool\"\nwhere\n \"cr3_relation c c' \\ cr3_base_address c = cr3BaseAddress c' \\ cr3_pcid c = cr3pcid c'\"\n\nfun\n x64irqstate_to_abstract :: \"x64irqstate \\ X64IRQState\"\nwhere\n \"x64irqstate_to_abstract X64IRQFree = IRQFree\"\n| \"x64irqstate_to_abstract X64IRQReserved = IRQReserved\"\n| \"x64irqstate_to_abstract (X64IRQMSI bus dev func handle) = (IRQMSI bus dev func handle)\"\n| \"x64irqstate_to_abstract (X64IRQIOAPIC ioapic pin level polarity masked) =\n (IRQIOAPIC ioapic pin level polarity masked)\"\n\ndefinition\n x64_irq_relation :: \"(8 word \\ X64IRQState) \\ (8 word \\ x64irqstate) \\ bool\"\nwhere\n \"x64_irq_relation irq_states irq_states' \\ irq_states = x64irqstate_to_abstract o irq_states'\"\n\ndefinition\n arch_state_relation :: \"(arch_state \\ X64_H.kernel_state) set\"\nwhere\n \"arch_state_relation \\ {(s, s') .\n x64_asid_table s = x64KSASIDTable s' o ucast\n \\ x64_global_pml4 s = x64KSSKIMPML4 s'\n \\ x64_global_pdpts s = x64KSSKIMPDPTs s'\n \\ x64_global_pds s = x64KSSKIMPDs s'\n \\ x64_global_pts s = x64KSSKIMPTs s'\n \\ cr3_relation (x64_current_cr3 s) (x64KSCurrentUserCR3 s')\n \\ x64_kernel_vspace s = x64KSKernelVSpace s'\n \\ x64_allocated_io_ports s = x64KSAllocatedIOPorts s'\n \\ x64_num_ioapics s = x64KSNumIOAPICs s'\n \\ x64_irq_relation (x64_irq_state s) (x64KSIRQState s')}\"\n\ndefinition\n rights_mask_map :: \"rights set \\ Types_H.cap_rights\"\nwhere\n \"rights_mask_map \\ \\rs. CapRights (AllowWrite \\ rs) (AllowRead \\ rs) (AllowGrant \\ rs)\n (AllowGrantReply \\ rs)\"\n\n\nlemma obj_relation_cutsE:\n \"\\ (y, P) \\ obj_relation_cuts ko x; P ko ko';\n \\sz cs z cap cte. \\ ko = CNode sz cs; well_formed_cnode_n sz cs; y = cte_map (x, z);\n ko' = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte) \\\n \\ R;\n \\pt (z :: 9 word) pte'. \\ ko = ArchObj (PageTable pt); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPTE pte'); pte_relation' (pt z) pte' \\\n \\ R;\n \\pd (z :: 9 word) pde'. \\ ko = ArchObj (PageDirectory pd); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPDE pde'); pde_relation' (pd z) pde' \\\n \\ R;\n \\pdpt (z :: 9 word) pdpte'. \\ ko = ArchObj (PDPointerTable pdpt); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPDPTE pdpte'); pdpte_relation' (pdpt z) pdpte' \\\n \\ R;\n \\pml4 (z :: 9 word) pml4e'. \\ ko = ArchObj (PageMapL4 pml4); y = x + (ucast z << word_size_bits);\n ko' = KOArch (KOPML4E pml4e'); pml4e_relation' (pml4 z) pml4e' \\\n \\ R;\n \\sz dev n. \\ ko = ArchObj (DataPage dev sz); ko' = (if dev then KOUserDataDevice else KOUserData);\n y = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits) \\ \\ R;\n \\ y = x; other_obj_relation ko ko'; is_other_obj_relation_type (a_type ko) \\ \\ R\n \\ \\ R\"\n apply (simp add: obj_relation_cuts_def2 is_other_obj_relation_type_def\n a_type_def\n split: Structures_A.kernel_object.split_asm if_split_asm\n X64_A.arch_kernel_obj.split_asm)\n apply ((clarsimp split: if_splits,\n force simp: cte_relation_def pte_relation_def pde_relation_def\n pdpte_relation_def pml4e_relation_def)+)\n done\n\nlemma eq_trans_helper:\n \"\\ x = y; P y = Q \\ \\ P x = Q\"\n by simp\n\nlemma cap_relation_case':\n \"cap_relation cap cap'\n = (case cap of cap.ArchObjectCap arch_cap.ASIDControlCap \\ cap_relation cap cap'\n | _ \\ cap_relation cap cap')\"\n by (simp split: cap.split arch_cap.split)\n\nschematic_goal cap_relation_case:\n \"cap_relation cap cap' = ?P\"\n apply (subst cap_relation_case')\n apply (clarsimp cong: cap.case_cong arch_cap.case_cong)\n apply (rule refl)\n done\n\nlemmas cap_relation_split =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split[where P=P]] for P\nlemmas cap_relation_split_asm =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split_asm[where P=P]] for P\n\n\n\ntext \\Relations on other data types that aren't stored but\n used as intermediate values in the specs.\\\n\nprimrec\n message_info_map :: \"Structures_A.message_info \\ Types_H.message_info\"\nwhere\n \"message_info_map (Structures_A.MI a b c d) = (Types_H.MI a b c d)\"\n\nlemma mi_map_label[simp]: \"msgLabel (message_info_map mi) = mi_label mi\"\n by (cases mi, simp)\n\nprimrec\n syscall_error_map :: \"ExceptionTypes_A.syscall_error \\ Fault_H.syscall_error\"\nwhere\n \"syscall_error_map (ExceptionTypes_A.InvalidArgument n) = Fault_H.InvalidArgument n\"\n| \"syscall_error_map (ExceptionTypes_A.InvalidCapability n) = (Fault_H.InvalidCapability n)\"\n| \"syscall_error_map ExceptionTypes_A.IllegalOperation = Fault_H.IllegalOperation\"\n| \"syscall_error_map (ExceptionTypes_A.RangeError n m) = Fault_H.RangeError n m\"\n| \"syscall_error_map ExceptionTypes_A.AlignmentError = Fault_H.AlignmentError\"\n| \"syscall_error_map (ExceptionTypes_A.FailedLookup b lf) = Fault_H.FailedLookup b (lookup_failure_map lf)\"\n| \"syscall_error_map ExceptionTypes_A.TruncatedMessage = Fault_H.TruncatedMessage\"\n| \"syscall_error_map ExceptionTypes_A.DeleteFirst = Fault_H.DeleteFirst\"\n| \"syscall_error_map ExceptionTypes_A.RevokeFirst = Fault_H.RevokeFirst\"\n| \"syscall_error_map (ExceptionTypes_A.NotEnoughMemory n) = Fault_H.syscall_error.NotEnoughMemory n\"\n\ndefinition\n APIType_map :: \"Structures_A.apiobject_type \\ X64_H.object_type\"\nwhere\n \"APIType_map ty \\ case ty of\n Structures_A.Untyped \\ APIObjectType ArchTypes_H.Untyped\n | Structures_A.TCBObject \\ APIObjectType ArchTypes_H.TCBObject\n | Structures_A.EndpointObject \\ APIObjectType ArchTypes_H.EndpointObject\n | Structures_A.NotificationObject \\ APIObjectType ArchTypes_H.NotificationObject\n | Structures_A.CapTableObject \\ APIObjectType ArchTypes_H.CapTableObject\n | ArchObject ao \\ (case ao of\n SmallPageObj \\ SmallPageObject\n | LargePageObj \\ LargePageObject\n | HugePageObj \\ HugePageObject\n | PageTableObj \\ PageTableObject\n | PageDirectoryObj \\ PageDirectoryObject\n | PDPTObj \\ PDPointerTableObject\n | PML4Obj \\ PML4Object)\"\n\ndefinition\n state_relation :: \"(det_state \\ kernel_state) set\"\nwhere\n \"state_relation \\ {(s, s').\n pspace_relation (kheap s) (ksPSpace s')\n \\ ekheap_relation (ekheap s) (ksPSpace s')\n \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\n \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\n \\ ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\n \\ cdt_relation (swp cte_at s) (cdt s) (ctes_of s')\n \\ cdt_list_relation (cdt_list s) (cdt s) (ctes_of s')\n \\ revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s')\n \\ (arch_state s, ksArchState s') \\ arch_state_relation\n \\ interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s')\n \\ (cur_thread s = ksCurThread s')\n \\ (idle_thread s = ksIdleThread s')\n \\ (machine_state s = ksMachineState s')\n \\ (work_units_completed s = ksWorkUnitsCompleted s')\n \\ (domain_index s = ksDomScheduleIdx s')\n \\ (domain_list s = ksDomSchedule s')\n \\ (cur_domain s = ksCurDomain s')\n \\ (domain_time s = ksDomainTime s')}\"\n\ntext \\Rules for using states in the relation.\\\n\nlemma curthread_relation:\n \"(a, b) \\ state_relation \\ ksCurThread b = cur_thread a\"\n by (simp add: state_relation_def)\n\nlemma state_relation_pspace_relation[elim!]:\n \"(s,s') \\ state_relation \\ pspace_relation (kheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relation_ekheap_relation[elim!]:\n \"(s,s') \\ state_relation \\ ekheap_relation (ekheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relationD:\n assumes sr: \"(s, s') \\ state_relation\"\n shows \"pspace_relation (kheap s) (ksPSpace s') \\\n ekheap_relation (ekheap s) (ksPSpace s') \\\n sched_act_relation (scheduler_action s) (ksSchedulerAction s') \\\n ready_queues_relation (ready_queues s) (ksReadyQueues s') \\\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') \\\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s') \\\n (arch_state s, ksArchState s') \\ arch_state_relation \\\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \\\n cur_thread s = ksCurThread s' \\\n idle_thread s = ksIdleThread s' \\\n machine_state s = ksMachineState s' \\\n work_units_completed s = ksWorkUnitsCompleted s' \\\n domain_index s = ksDomScheduleIdx s' \\\n domain_list s = ksDomSchedule s' \\\n cur_domain s = ksCurDomain s' \\\n domain_time s = ksDomainTime s'\"\n using sr unfolding state_relation_def by simp\n\nlemma state_relationE [elim?]:\n assumes sr: \"(s, s') \\ state_relation\"\n and rl: \"\\pspace_relation (kheap s) (ksPSpace s');\n ekheap_relation (ekheap s) (ksPSpace s');\n sched_act_relation (scheduler_action s) (ksSchedulerAction s');\n ready_queues_relation (ready_queues s) (ksReadyQueues s');\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s');\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s');\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s');\n (arch_state s, ksArchState s') \\ arch_state_relation;\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s');\n cur_thread s = ksCurThread s';\n idle_thread s = ksIdleThread s';\n machine_state s = ksMachineState s';\n work_units_completed s = ksWorkUnitsCompleted s';\n domain_index s = ksDomScheduleIdx s';\n domain_list s = ksDomSchedule s';\n cur_domain s = ksCurDomain s';\n domain_time s = ksDomainTime s' \\ \\ R\"\n shows \"R\"\n using sr by (blast intro!: rl dest: state_relationD)\n\ntext \\This isn't defined for arch objects\\\n\nlemmas isCap_defs =\n isZombie_def isArchObjectCap_def\n isThreadCap_def isCNodeCap_def isNotificationCap_def\n isEndpointCap_def isUntypedCap_def isNullCap_def\n isIRQHandlerCap_def isIRQControlCap_def isReplyCap_def\n isPageCap_def isPageTableCap_def isPageDirectoryCap_def\n isPDPointerTableCap_def isPML4Cap_def isIOPortCap_def\n isASIDControlCap_def isASIDPoolCap_def isArchPageCap_def\n isDomainCap_def isArchIOPortCap_def isIOPortControlCap_def\n isIOPortControlCap'_def\n\nlemma isCNodeCap_cap_map [simp]:\n \"cap_relation c c' \\ isCNodeCap c' = is_cnode_cap c\"\n apply (cases c, simp_all add: isCap_defs split: sum.splits)\n apply clarsimp+\n done\n\nlemma sts_rel_idle :\n \"thread_state_relation st IdleThreadState = (st = Structures_A.IdleThreadState)\"\n by (cases st, auto)\n\nlemma pspace_relation_absD:\n \"\\ ab x = Some y; pspace_relation ab con \\\n \\ \\(x', P) \\ obj_relation_cuts y x. \\z. con x' = Some z \\ P y z\"\n apply (clarsimp simp add: pspace_relation_def)\n apply (drule bspec, erule domI)\n apply simp\n apply (drule(1) bspec)\n apply (subgoal_tac \"a \\ pspace_dom ab\")\n apply clarsimp\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def rev_bexI)\n done\n\nlemma ekheap_relation_absD:\n \"\\ ab x = Some y; ekheap_relation ab con \\\n \\ \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation y tcb'\"\n by (force simp add: ekheap_relation_def)\n\nlemma in_related_pspace_dom:\n \"\\ s' x = Some y; pspace_relation s s' \\ \\ x \\ pspace_dom s\"\n by (clarsimp simp add: pspace_relation_def)\n\nlemma pspace_dom_revE:\n \"\\ x \\ pspace_dom ps; \\ko y P. \\ ps y = Some ko; (x, P) \\ obj_relation_cuts ko y \\ \\ R \\ \\ R\"\n by (clarsimp simp add: pspace_dom_def)\n\nlemma pspace_dom_relatedE:\n \"\\ s' x = Some ko'; pspace_relation s s';\n \\y ko P. \\ s y = Some ko; (x, P) \\ obj_relation_cuts ko y; P ko ko' \\ \\ R\n \\ \\ R\"\n apply (rule pspace_dom_revE [OF in_related_pspace_dom],\n assumption+)\n apply (frule(1) pspace_relation_absD)\n apply fastforce\n done\n\nlemma ghost_relation_typ_at:\n \"ghost_relation (kheap s) ups cns \\\n (\\a sz. data_at sz a s = (ups a = Some sz)) \\\n (\\a n. typ_at (ACapTable n) a s = (cns a = Some n))\"\n apply (rule eq_reflection)\n apply (clarsimp simp: ghost_relation_def typ_at_eq_kheap_obj data_at_def)\n apply (intro conjI impI iffI allI; force)\n done\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/X64/StateRelation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.2751297297667525, "lm_q1q2_score": 0.15572852260319822}} {"text": "theory Eg1Eg2\nimports Eg1\n Eg2\n \"../CompositionalRefinement\"\nbegin\n\nlocale sifum_refinement_eg1_eg2 =\n A: sifum_example +\n C: sifum_example2\n\nprimrec Eg2_var\\<^sub>C_of_Eg1 :: \"Eg1.var \\ Eg2.var\\<^sub>C\"\nwhere\n \"Eg2_var\\<^sub>C_of_Eg1 control_var = control_var\\<^sub>C\" |\n \"Eg2_var\\<^sub>C_of_Eg1 buffer = buffer\\<^sub>C\" |\n \"Eg2_var\\<^sub>C_of_Eg1 high_var = high_var\\<^sub>C\" |\n \"Eg2_var\\<^sub>C_of_Eg1 low_var = low_var\\<^sub>C\" |\n \"Eg2_var\\<^sub>C_of_Eg1 temp = temp\\<^sub>C\"\n\nsublocale sifum_refinement_eg1_eg2 \\ sifum_refinement dma dma\\<^sub>C \\_vars \\_vars\\<^sub>C \\ \\\\<^sub>C A.eval\\<^sub>w C.eval\\<^sub>w undefined Eg2_var\\<^sub>C_of_Eg1\n supply image_cong_simp [cong del] INF_cong_simp [cong] SUP_cong_simp [cong]\n apply(unfold_locales)\n apply(erule C.eval_det, simp)\n apply(rule C.Var_finite)\n apply(simp add:\\_vars\\<^sub>C_def split:if_splits)\n apply(simp add:\\_vars\\<^sub>C_def dma\\<^sub>C_def)\n apply(simp add:\\_vars\\<^sub>C_def dma\\<^sub>C_def)\n apply(rule inj_onI, simp)\n apply(case_tac x)\n apply(case_tac y, simp+)\n apply(case_tac y, simp+)\n apply(case_tac y, simp+)\n apply(case_tac y, simp+)\n apply(case_tac y, simp+)\n apply(case_tac x\\<^sub>A)\n apply(clarsimp simp:dma\\<^sub>C_def dma_def dma_control_var_def dma_control_var\\<^sub>C_def)+\n apply(case_tac x\\<^sub>A)\n apply(clarsimp simp:\\_vars\\<^sub>C_def \\_vars_def)+\n apply(rule set_eqI, clarsimp)\n apply(case_tac x, clarsimp)\n apply(rule_tac x=control_var in rev_image_eqI, clarsimp+)\n apply(case_tac xa, clarsimp+)\n apply(case_tac xb, clarsimp+)\n apply(case_tac xa, clarsimp+)\n apply(case_tac xb, clarsimp+)\n apply(case_tac xa, clarsimp+)\n apply(case_tac xb, clarsimp+)\n apply(case_tac xa, clarsimp+)\n apply(case_tac xb, clarsimp+)\n apply(case_tac xa, clarsimp+)\n apply(simp add:\\\\<^sub>C_def)\n done\n\ncontext sifum_refinement_eg1_eg2\nbegin\n\n\nlemma bisim_simple_\\:\n \"bisim_simple (A.\\ \\ \\ P)\"\n unfolding bisim_simple_def\n apply clarsimp\n apply(drule_tac lc=\"\\c\\<^sub>1\\<^sub>A, mds, mem\\<^sub>1\\<^sub>A\\\\<^sub>A\" and lc'=\"\\c\\<^sub>2\\<^sub>A, mds, mem\\<^sub>2\\<^sub>A\\\\<^sub>A\" in A.bisim_simple_\\\\<^sub>u)\n by simp\n\n(* Don't know to what extent these helpers can be made generic enough to go into any parent theories.\n Again, mightn't be able to (or bother to) make some generic considering the aexp evaluator\n is going to be specific to each language. *)\n\nlemma conc_only_vars_not_visible_abs:\n \"(\\v\\<^sub>C. v\\<^sub>C \\ range Eg2_var\\<^sub>C_of_Eg1 \\ mem\\<^sub>C v\\<^sub>C = mem\\<^sub>C' v\\<^sub>C) \\ mem\\<^sub>A_of mem\\<^sub>C = mem\\<^sub>A_of mem\\<^sub>C'\"\n by (simp add: mem\\<^sub>A_of_def)\n\nlemma conc_only_var_assign_not_visible_abs:\n \"\\v\\<^sub>C e. v\\<^sub>C \\ range Eg2_var\\<^sub>C_of_Eg1 \\ mem\\<^sub>A_of mem\\<^sub>C = mem\\<^sub>A_of (mem\\<^sub>C(v\\<^sub>C := e))\"\n using conc_only_vars_not_visible_abs\n by simp\n\nlemma reg\\<^sub>C_is_not_the_var\\<^sub>C_of_anything:\n \"reg\\<^sub>C = Eg2_var\\<^sub>C_of_Eg1 x \\ False\"\n by (induct x, clarsimp+)\n\nlemma reg\\<^sub>C_not_visible_abs:\n \"reg\\<^sub>C \\ range Eg2_var\\<^sub>C_of_Eg1\"\n using reg\\<^sub>C_is_not_the_var\\<^sub>C_of_anything\n by blast\n\n(* This one's pretty specific to this refinement... *)\nlemma reg\\<^sub>C_the_only_concrete_only_var:\n \"v\\<^sub>C \\ range Eg2_var\\<^sub>C_of_Eg1 \\ v\\<^sub>C = reg\\<^sub>C\"\n apply(case_tac v\\<^sub>C)\n apply(erule rev_notE, clarsimp, rule_tac x=control_var in range_eqI, clarsimp)\n apply(erule rev_notE, clarsimp, rule_tac x=buffer in range_eqI, clarsimp)\n apply(erule rev_notE, clarsimp, rule_tac x=high_var in range_eqI, clarsimp)\n apply(erule rev_notE, clarsimp, rule_tac x=low_var in range_eqI, clarsimp)\n apply(erule rev_notE, clarsimp, rule_tac x=temp in range_eqI, clarsimp)\n apply clarsimp\n done\n\nlemma NoRW\\<^sub>A_implies_NoRW\\<^sub>C:\n \"x \\ mds\\<^sub>A_of mds\\<^sub>C AsmNoReadOrWrite \\\n Eg2_var\\<^sub>C_of_Eg1 x \\ mds\\<^sub>C AsmNoReadOrWrite\"\n unfolding mds\\<^sub>A_of_def\n apply clarsimp\n apply (simp only: Eg2_var\\<^sub>C_of_Eg1_def)\n apply clarsimp\n apply (simp add: f_inv_into_f)\n done\n\nlemma NoWrite\\<^sub>A_implies_NoWrite\\<^sub>C:\n \"x \\ mds\\<^sub>A_of mds\\<^sub>C AsmNoWrite \\\n Eg2_var\\<^sub>C_of_Eg1 x \\ mds\\<^sub>C AsmNoWrite\"\n unfolding mds\\<^sub>A_of_def\n apply clarsimp\n apply (simp only: Eg2_var\\<^sub>C_of_Eg1_def)\n apply clarsimp\n apply (simp add: f_inv_into_f)\n done\n\nlemma assign_eval\\<^sub>w_load\\<^sub>A:\n shows \"(\\x \\ Eg1.Load y, mds, mem\\\\<^sub>A, \\Stop, mds, mem (x := mem y)\\\\<^sub>A) \\ A.eval\\<^sub>w\"\n by (metis A.assign_eval\\<^sub>w ev\\<^sub>A.simps(2))\n\nlemma assign_eval\\<^sub>w_load\\<^sub>C:\n shows \"(\\x \\ Load y, mds, mem\\\\<^sub>C, \\Stop, mds, mem (x := mem y)\\\\<^sub>C) \\ C.eval\\<^sub>w\"\n using C.unannotated[OF C.assign, where E=\"[]\", simplified]\n apply(drule_tac x=x in meta_spec)\n apply(drule_tac x=\"Load y\" in meta_spec)\n apply(drule_tac x=mds in meta_spec)\n apply(drule_tac x=mem in meta_spec)\n apply clarsimp\n done\n\nlemma assign_eval\\<^sub>w_const\\<^sub>A:\n shows \"(\\x \\ Eg1.Const c, mds, mem\\, \\Stop, mds, mem (x := c)\\) \\ A.eval\\<^sub>w\"\n by (metis A.assign_eval\\<^sub>w ev\\<^sub>A.simps(1))\n\nlemma assign_eval\\<^sub>w_const\\<^sub>C:\n shows \"(\\x \\ Const c, mds, mem\\, \\Stop, mds, mem (x := c)\\) \\ C.eval\\<^sub>w\"\n using C.unannotated[OF C.assign, where E=\"[]\", simplified]\n apply(drule_tac x=x in meta_spec)\n apply(drule_tac x=\"Const c\" in meta_spec)\n apply(drule_tac x=mds in meta_spec)\n apply(drule_tac x=mem in meta_spec)\n apply clarsimp\n done\n\nlemma if_seq_eval\\<^sub>w_helper\\<^sub>A:\n \"(\\If B T E, mds, mem\\,\n \\if ev\\<^sub>B mem B then T else E, mds, mem\\\\<^sub>A) \\ A.eval\\<^sub>w\n \\\n (\\If B T E ;; TAIL, mds, mem\\,\n \\if ev\\<^sub>B mem B then T ;; TAIL else E ;; TAIL, mds, mem\\\\<^sub>A) \\ A.eval\\<^sub>w\"\n using A.eval\\<^sub>w.seq\n by auto\n\nlemma if_seq_eval\\<^sub>w_helper\\<^sub>C:\n \"(\\If B T E, mds, mem\\,\n \\if ev\\<^sub>B\\<^sub>C mem B then T else E, mds, mem\\\\<^sub>C) \\ C.eval\\<^sub>w\n \\\n (\\If B T E ;; TAIL, mds, mem\\,\n \\if ev\\<^sub>B\\<^sub>C mem B then T ;; TAIL else E ;; TAIL, mds, mem\\\\<^sub>C) \\ C.eval\\<^sub>w\"\n using C.eval\\<^sub>w.seq\n by auto\n\nlemma mem_assign_refinement_helper_var:\n \"mem\\<^sub>A_of (mem\\<^sub>C (Eg2_var\\<^sub>C_of_Eg1 x := mem\\<^sub>C (Eg2_var\\<^sub>C_of_Eg1 y)))\n = (mem\\<^sub>A_of mem\\<^sub>C) (x := (mem\\<^sub>A_of mem\\<^sub>C) y)\"\n apply(clarsimp simp: mem\\<^sub>A_of_def)\n apply(rule ext, clarsimp)\n apply(cases x)\n apply(case_tac x\\<^sub>A, clarsimp+)+\n done\n\nlemma mem_assign_refinement_helper_const:\n \"mem\\<^sub>A_of (mem\\<^sub>C (Eg2_var\\<^sub>C_of_Eg1 x := c))\n = (mem\\<^sub>A_of mem\\<^sub>C) (x := c)\"\n apply(clarsimp simp: mem\\<^sub>A_of_def)\n apply(rule ext, clarsimp)\n apply(cases x)\n apply(case_tac x\\<^sub>A, clarsimp+)+\n done\n\nlemma if_true_eval\\<^sub>w\\<^sub>C:\n shows \"mem\\<^sub>C x = 0 \\\n (\\(If (Eq x 0) c\\<^sub>C_then c\\<^sub>C_else) ;; c\\<^sub>C_tail, mds\\<^sub>C, mem\\<^sub>C\\\\<^sub>C,\n \\(c\\<^sub>C_then ;; c\\<^sub>C_tail), mds\\<^sub>C, mem\\<^sub>C\\\\<^sub>C) \\ C.eval\\<^sub>w\"\n using C.if_eval\\<^sub>w C.eval\\<^sub>w.seq ev\\<^sub>B\\<^sub>C.simps by presburger\n\nlemma if_false_eval\\<^sub>w\\<^sub>C:\n shows \"mem\\<^sub>C x \\ 0 \\\n (\\(If (Eq x 0) c\\<^sub>C_then c\\<^sub>C_else) ;; c\\<^sub>C_tail, mds\\<^sub>C, mem\\<^sub>C\\\\<^sub>C,\n \\(c\\<^sub>C_else ;; c\\<^sub>C_tail), mds\\<^sub>C, mem\\<^sub>C\\\\<^sub>C) \\ C.eval\\<^sub>w\"\n using C.if_eval\\<^sub>w C.eval\\<^sub>w.seq ev\\<^sub>B\\<^sub>C.simps by presburger\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Dependent_SIFUM_Refinement/Examples/Eg1Eg2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.2909808539178129, "lm_q1q2_score": 0.1557033976918513}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n * This file contains an example spec, and shows it obeys the well_formed constraints\n *\n * This file contains the invariants of the user-space initialiser,\n * the well-formed conditions of the input capDL specification,\n * and the predicates describing the initial state.\n *)\n\ntheory ExampleSpecIRQ_SI\nimports WellFormed_SI\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(****************************************************\n * Definitions of all the objects and capabilities. *\n ***************************************************)\n\ndefinition small_section_size :: nat\nwhere\n \"small_section_size = 20\"\n\ndefinition \"guard = 0\"\ndefinition \"guard_size = 1\"\ndefinition \"cnode_a1_size = 7\"\ndefinition \"cnode_a2_size = 7\"\ndefinition \"cnode_b_size = 8\"\ndefinition \"cnode_extra_size = 2\"\nlemmas constants [simp] = guard_def guard_size_def cnode_a1_size_def cnode_a2_size_def\n cnode_b_size_def cnode_extra_size_def\n\n\ndefinition \"tcb_a_id = 9\"\ndefinition \"tcb_b_id = 10\"\ndefinition \"cnode_a1_id = 6\"\ndefinition \"cnode_a2_id = 7\"\ndefinition \"cnode_b_id = 5\"\ndefinition \"cnode_extra_id = 11\"\ndefinition \"ep_id = 12\"\ndefinition \"ntfn_id = 13\"\ndefinition \"pd_a_id = 1\"\ndefinition \"pt_a_id = 8\"\ndefinition \"pd_b_id = 2\"\ndefinition \"frame_a1_id = 3\"\ndefinition \"frame_a2_id = 4\"\ndefinition \"frame_b_id = 0\"\nlemmas ids [simp] = tcb_a_id_def tcb_b_id_def cnode_a1_id_def\n cnode_a2_id_def cnode_b_id_def cnode_extra_id_def\n ep_id_def ntfn_id_def pd_a_id_def pt_a_id_def pd_b_id_def\n frame_a1_id_def frame_a2_id_def frame_b_id_def\n\ndefinition\n \"tcb_a =\n \\cdl_tcb_caps = [tcb_cspace_slot \\ CNodeCap cnode_a1_id guard guard_size cnode_a1_size,\n tcb_vspace_slot \\ PageDirectoryCap pd_a_id Real None,\n tcb_replycap_slot \\ NullCap,\n tcb_caller_slot \\ NullCap,\n tcb_ipcbuffer_slot \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Real None,\n tcb_pending_op_slot \\ NullCap,\n tcb_boundntfn_slot \\ NullCap],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = \\cdl_intent_op = None, cdl_intent_error = False, cdl_intent_cap = 0,\n cdl_intent_extras = [], cdl_intent_recv_slot = None\\,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = minBound\\\"\n\ndefinition\n \"tcb_b =\n \\cdl_tcb_caps = [tcb_cspace_slot \\ CNodeCap cnode_b_id guard guard_size cnode_b_size,\n tcb_vspace_slot \\ PageDirectoryCap pd_b_id Real None,\n tcb_replycap_slot \\ NullCap,\n tcb_caller_slot \\ NullCap,\n tcb_ipcbuffer_slot \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Real None,\n tcb_pending_op_slot \\ NullCap,\n tcb_boundntfn_slot \\ NullCap],\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = \\cdl_intent_op = None, cdl_intent_error = False, cdl_intent_cap = 0,\n cdl_intent_extras = [], cdl_intent_recv_slot = None\\,\n cdl_tcb_has_fault = False,\n cdl_tcb_domain = minBound\\\"\n\ndefinition\n \"new_cap_map sz caps \\ empty_cap_map sz ++ caps\"\n\ndefinition\n \"new_cnode sz caps \\ \\cdl_cnode_caps = new_cap_map sz caps,\n cdl_cnode_size_bits = sz\\\"\n\ndefinition\n \"cnode_a1 \\\n new_cnode cnode_a1_size\n [0 \\ TcbCap tcb_a_id,\n 1 \\ CNodeCap cnode_a2_id guard guard_size cnode_a2_size]\"\n\n\ndefinition\n \"cnode_a2 \\\n new_cnode cnode_a2_size\n [0 \\ EndpointCap ep_id 0 {Write},\n 2 \\ CNodeCap cnode_a1_id guard guard_size cnode_a1_size,\n 3 \\ PageDirectoryCap pd_a_id Real None,\n 4 \\ PageTableCap pt_a_id Real None,\n 8 \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Real None,\n 10 \\ NotificationCap ntfn_id 0 {Read},\n 11 \\ FrameCap False frame_a2_id {AllowRead, AllowWrite} small_frame_size Real None,\n 12 \\ IrqHandlerCap 4]\"\n\ndefinition\n \"cnode_b \\\n new_cnode cnode_b_size\n [0 \\ TcbCap tcb_b_id,\n 2 \\ CNodeCap cnode_b_id guard guard_size cnode_b_size,\n 4 \\ EndpointCap ep_id 0 {Read},\n 7 \\ PageDirectoryCap pd_b_id Real None,\n 8 \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Real None,\n 254 \\ IrqHandlerCap 254]\"\n\ndefinition\n \"cnode_extra \\\n new_cnode cnode_extra_size\n [0 \\ CNodeCap cnode_extra_id guard guard_size cnode_extra_size,\n 1 \\ EndpointCap ep_id 0 UNIV,\n 2 \\ NotificationCap ntfn_id 0 {Read, Write}]\"\n\ndefinition\n \"pd_a \\ \\cdl_page_directory_caps = new_cap_map pd_size [0 \\ PageTableCap pt_a_id Fake None]\\\"\n\ndefinition\n \"pd_b \\ \\cdl_page_directory_caps = new_cap_map pd_size\n [2 \\ FrameCap False frame_b_id {AllowRead, AllowWrite} small_section_size Fake None]\\\"\n\ndefinition\n \"pt_a \\ \\cdl_page_table_caps = new_cap_map pt_size\n [0 \\ FrameCap False frame_a1_id {AllowRead, AllowWrite} small_frame_size Fake None,\n 255 \\ FrameCap False frame_a2_id {AllowRead, AllowWrite} small_frame_size Fake None]\\\"\n\ndefinition\n \"empty_frame \\ \\cdl_frame_size_bits = small_frame_size\\\"\ndefinition\n \"empty_section \\ \\cdl_frame_size_bits = small_section_size\\\"\n\ndefinition\n example_irq_node :: \"cdl_irq \\ cdl_object_id\"\nwhere\n \"example_irq_node = (\\irq. ucast irq + 0x100)\"\n\ndefinition\n \"new_irq_node obj_id \\\n \\ cdl_irq_node_caps = (\\slot. if slot = 0\n then Some (NotificationCap obj_id 0 {Read, Write})\n else None)\\\"\n\ndefinition\n irq_objects :: cdl_heap\nwhere\n \"irq_objects \\\n \\obj_id. if obj_id = 0x104 then Some (IRQNode (new_irq_node ntfn_id))\n else if 0x100 \\ obj_id \\ obj_id < 0x200 then (Some (IRQNode empty_irq_node))\n else None\"\n\n\nlemma\n \"irq_objects =\n (\\obj_id. if 0x100 \\ obj_id \\ obj_id < 0x200\n then (Some (IRQNode empty_irq_node))\n else None) ++\n (\\obj_id. if obj_id = 0x104 then Some (IRQNode (new_irq_node ntfn_id))\n else None)\"\n apply (rule ext)\n apply (clarsimp simp: irq_objects_def map_add_def)\n done\n\n\ndefinition\n \"example_spec =\n \\cdl_arch = ARM11,\n cdl_objects = [tcb_a_id \\ Tcb tcb_a,\n tcb_b_id \\ Tcb tcb_b,\n pd_a_id \\ PageDirectory pd_a,\n pt_a_id \\ PageTable pt_a,\n pd_b_id \\ PageDirectory pd_b,\n cnode_a1_id \\ CNode cnode_a1,\n cnode_a2_id \\ CNode cnode_a2,\n cnode_b_id \\ CNode cnode_b,\n cnode_extra_id \\ CNode cnode_extra,\n frame_a1_id \\ Frame empty_frame,\n frame_a2_id \\ Frame empty_frame,\n frame_b_id \\ Frame empty_section,\n ep_id \\ Endpoint,\n ntfn_id \\ Notification,\n 0x104 \\ IRQNode (new_irq_node ntfn_id),\n 0x1FE \\ IRQNode empty_irq_node],\n cdl_cdt = [(cnode_a2_id, 0) \\ (cnode_extra_id, 1),\n (cnode_b_id, 4) \\ (cnode_extra_id, 1),\n (cnode_a2_id, 10) \\ (cnode_extra_id, 2)], \\ \\All caps are orig caps,\n except endpoints and notifications.\\\n cdl_current_thread = undefined,\n cdl_irq_node = example_irq_node,\n cdl_asid_table = undefined,\n cdl_current_domain = minBound\\\"\n\n\ndeclare cap_object_simps [simp]\n\n\nlemmas cnode_defs = cnode_a1_def cnode_a2_def cnode_b_def cnode_extra_def\nlemmas obj_defs = cnode_defs tcb_a_def tcb_b_def pd_a_def pd_b_def pt_a_def\n\nlemmas example_spec_def_expanded = example_spec_def\n [unfolded obj_defs tcb_slot_defs tcb_pending_op_slot_def\n new_cnode_def new_cap_map_def empty_cap_map_def]\n\n(*************************\n * Helper lemmas. *\n *************************)\nlemma cap_has_object_IrqHandlerCap [simp]:\n \"\\cap_has_object (IrqHandlerCap irq)\"\n by (clarsimp simp: cap_has_object_def)+\n\nlemma badge_bits_2p [simp]:\n \"(0::word32) < 2 ^ badge_bits\"\n by (clarsimp simp: p2_gt_0 badge_bits_def)\n\nlemma cdl_cnode_size_bits_new_cnode [simp]:\n \"cdl_cnode_size_bits (new_cnode sz caps) = sz\"\n by (clarsimp simp: new_cnode_def)\n\nlemma cnode_cap_size_simps [simp]:\n \"cnode_cap_size (CNodeCap a b c sz) = sz\"\n by (clarsimp simp: cnode_cap_size_def)\n\nlemma object_size_bits_new_cnode [simp]:\n \"object_size_bits (CNode (new_cnode sz caps)) = sz\"\n by (clarsimp simp: object_size_bits_def)\n\nlemma object_slots_Endpoint [simp]:\n \"object_slots Endpoint = Map.empty\"\n by (simp add: object_slots_def)\n\nlemma cdl_frame_size_bits_empty_frame [simp]:\n \"cdl_frame_size_bits empty_frame = small_frame_size\"\n by (simp add: empty_frame_def)\n\nlemma cdl_frame_size_bits_empty_section [simp]:\n \"cdl_frame_size_bits empty_section = small_section_size\"\n by (simp add: empty_section_def)\n\nlemma object_slots_empty_objects [simp]:\n \"object_slots (Frame f) slot = None\"\n by (clarsimp simp: object_slots_def)+\n\nlemma is_fake_pt_cap_simps:\n \"\\ is_fake_pt_cap (PageTableCap obj_id Real asid)\"\n \"is_fake_pt_cap (PageTableCap obj_id Fake asid)\"\n by (clarsimp simp: is_fake_pt_cap_def)+\n\nlemma frame_cap_not_cnode:\n \"\\is_cnode_cap (FrameCap dev a b c d e)\"\n by (clarsimp simp: cap_type_def)\n\nlemma empty_cap_map_NullCap [simp]:\n \"empty_cap_map sz slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: empty_cap_map_def split: if_split_asm)\n\nlemma new_cap_map_empty_NullCap [simp]:\n \"new_cap_map sz Map.empty slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cap_map_def)\n\n\nlemma new_cap_map_slot:\n \"\\new_cap_map sz caps slot = Some cap; cap \\ NullCap\\ \\ caps slot = Some cap\"\n by (clarsimp simp: new_cap_map_def empty_cap_map_def split: option.splits if_split_asm)\n\nlemma cdl_cnode_caps_new_cnode:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap; cap \\ NullCap\\ \\ caps slot = Some cap\"\n by (clarsimp simp: new_cnode_def, erule (1) new_cap_map_slot)\n\nlemma new_cap_map_caps_D:\n \"new_cap_map sz caps slot = Some cap \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cap_map_def)\n\nlemma cdl_cnode_caps_new_cnode_D:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap\\\n \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: new_cnode_def, erule (1) new_cap_map_slot)\n\nlemma cdl_irq_node_caps_empty_irq_node_D:\n \"\\cdl_irq_node_caps (empty_irq_node) slot = Some cap\\\n \\ cap = NullCap\"\n by (clarsimp simp: empty_irq_node_def)\n\nlemma object_slots_new_cnode_D:\n \"object_slots (CNode (new_cnode sz caps)) slot = Some cap\n \\ caps slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: object_slots_def dest!: cdl_cnode_caps_new_cnode_D)\n\nlemma object_slots_new_cnode_cap_has_object [dest!]:\n \"\\object_slots (CNode (new_cnode sz caps)) slot = Some cap; cap_has_object cap\\\n \\ caps slot = Some cap\"\n by (clarsimp simp: object_slots_def dest!: cdl_cnode_caps_new_cnode_D)\n\nlemma cdl_cnode_caps_empty_cnode [dest!]:\n \"cdl_cnode_caps (empty_cnode sz) slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: empty_cnode_def)\n\nlemma cdl_cnode_caps_new_cnode_cnode_cap:\n \"\\cdl_cnode_caps (new_cnode sz caps) slot = Some cap; is_cnode_cap cap\\\n \\ caps slot = Some cap\"\n by (erule cdl_cnode_caps_new_cnode, clarsimp)\n\nlemma object_slots_new_cnode_cnode_cap:\n \"\\object_slots (CNode (new_cnode sz caps)) slot = Some cap; is_cnode_cap cap\\\n \\ caps slot = Some cap\"\n by (clarsimp simp: object_slots_def, erule cdl_cnode_caps_new_cnode, clarsimp)\n\nlemma object_slots_empty_irq_node [simp, dest!]:\n \"object_slots (IRQNode empty_irq_node) slot = Some cap \\ cap = NullCap\"\n by (clarsimp simp: object_slots_def empty_irq_node_def)\n\nlemma tcb_domain_simp [simp]:\n \"tcb_domain (Tcb \\cdl_tcb_caps = caps,\n cdl_tcb_fault_endpoint = 0,\n cdl_tcb_intent = intent,\n cdl_tcb_has_fault = fault,\n cdl_tcb_domain = domain\\) = domain\"\n by (simp add: tcb_domain_def)\n\n\nlemma cdl_irq_node_example_spec [simp]:\n \"cdl_irq_node example_spec = example_irq_node\"\n by (clarsimp simp: example_spec_def)\n\nlemma range_example_irq_node_helper:\n \"range example_irq_node = (\\irq. irq + 0x100) ` range (ucast :: 10 word \\ 32 word)\"\n by (auto simp: example_irq_node_def image_def)\n\nlemma range_example_irq_node:\n \"range example_irq_node = {x. 0x100 \\ x \\ x < 0x500}\"\n apply (clarsimp simp: range_example_irq_node_helper ucast_range_less)\n apply (clarsimp simp: image_def)\n apply rule\n apply (clarsimp simp: word_le_nat_alt word_less_nat_alt unat_plus_if')\n apply clarsimp\n apply (rule_tac x=\"x - 0x100\" in exI)\n apply unat_arith\n done\n\nlemma irq_nodes_example_spec:\n \"irq_nodes example_spec = {obj_id. obj_id = 0x104 \\ obj_id = 0x1FE}\"\n by (auto simp: irq_nodes_def example_spec_def object_at_def is_irq_node_def)\n\n(*************************\n * End of helper lemmas. *\n *************************)\n\n\n(************************\nHelpers on the specific state.\n\n***************************)\n\n\n\n\nlemma onehundred_not_le_one:\n \"\\(0x100 \\ (1::32 word))\"\n by unat_arith\n\nlemma object_type_simps [simp]:\n \"object_type (Tcb t) = TcbType\"\n \"object_type (CNode c) = CNodeType\"\n \"object_type (Endpoint) = EndpointType\"\n \"object_type (Notification) = NotificationType\"\n \"object_type (PageDirectory pd) = PageDirectoryType\"\n \"object_type (PageTable pt) = PageTableType\"\n \"object_type (Frame f) = FrameType (cdl_frame_size_bits f)\"\n \"object_type (IRQNode empty_irq_node) = IRQNodeType\"\n by (clarsimp simp: object_type_def)+\n\nlemma cap_irq_simp [simp]:\n \"cap_irq (IrqHandlerCap irq) = irq\"\n by (simp add: cap_irq_def)\n\nlemma example_irq_node_simps [simp]:\n \"example_irq_node 4 = 0x104\"\n \"example_irq_node 0xFE = 0x1FE\"\n by (simp add: example_irq_node_def)+\n\nlemma irq_objects_simps [simp]:\n \"irq_objects 0 = None\"\n \"irq_objects 1 = None\"\n \"irq_objects 2 = None\"\n \"irq_objects 3 = None\"\n \"irq_objects 4 = None\"\n \"irq_objects 5 = None\"\n \"irq_objects 6 = None\"\n \"irq_objects 7 = None\"\n \"irq_objects 8 = None\"\n \"irq_objects 9 = None\"\n \"irq_objects 0xA = None\"\n \"irq_objects 0xB = None\"\n \"irq_objects 0xC = None\"\n \"irq_objects 0xD = None\"\n by (clarsimp simp: irq_objects_def onehundred_not_le_one)+\n\n\nlemma opt_cap_example_spec [simp]:\n \"opt_cap (4, slot) example_spec = object_slots (Frame empty_frame) slot\"\n \"opt_cap (5, slot) example_spec = object_slots (CNode cnode_b) slot\"\n \"opt_cap (6, slot) example_spec = object_slots (CNode cnode_a1) slot\"\n \"opt_cap (7, slot) example_spec = object_slots (CNode cnode_a2) slot\"\n \"opt_cap (0xB, slot) example_spec = object_slots (CNode cnode_extra) slot\"\n by (auto simp: example_spec_def opt_cap_def slots_of_def\n map_add_def irq_objects_def\n split: if_split_asm)\n\nlemma irq_objects_some_object:\n \"irq_objects obj_id = Some obj \\\n (obj_id = 0x104 \\ obj = IRQNode (new_irq_node ntfn_id)) \\ obj = IRQNode empty_irq_node\"\n by (clarsimp simp: irq_objects_def split: if_split_asm)\n\n(*\nlemma real_cnode_at_example_spec:\n \"real_cnode_at obj_id example_spec\n \\ obj_id = cnode_a1_id \\ obj_id = cnode_a2_id \\ obj_id = cnode_b_id \\ obj_id = cnode_extra_id\"\n apply (clarsimp simp: real_cnode_at_def object_at_def is_cnode_def irq_cnodes_example_spec)\n by (auto simp: example_spec_def object_at_def is_cnode_def irq_objects_def\n split: if_split_asm cdl_object.splits)\n*)\n\nlemma cnode_at_example_spec:\n \"cnode_at obj_id example_spec =\n (obj_id = cnode_a1_id \\ obj_id = cnode_a2_id \\ obj_id = cnode_b_id \\ obj_id = cnode_extra_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def irq_objects_def map_add_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma pt_at_example_spec:\n \"pt_at obj_id example_spec = (obj_id = pt_a_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def object_at_def is_pt_def irq_objects_def\n new_irq_node_def empty_irq_node_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma pd_at_example_spec:\n \"pd_at obj_id example_spec = (obj_id = pd_a_id \\ obj_id = pd_b_id)\"\n apply (clarsimp simp: object_at_def is_cnode_def)\n apply (auto simp: example_spec_def object_at_def is_pd_def irq_objects_def\n new_irq_node_def empty_irq_node_def\n split: if_split_asm cdl_object.splits)\n done\n\nlemma slots_of_example_spec_obj_ids:\n \"\\slots_of obj_id example_spec 0 = Some cap; cap \\ NullCap\\\\\n ((obj_id = tcb_a_id) \\\n (obj_id = tcb_b_id) \\\n (obj_id = cnode_a1_id) \\\n (obj_id = cnode_a2_id) \\\n (obj_id = cnode_b_id) \\\n (obj_id = cnode_extra_id) \\\n (obj_id = pd_a_id) \\\n (obj_id = pt_a_id) \\\n (obj_id = pd_b_id) \\\n (obj_id = 0x104))\"\n by (clarsimp simp: example_spec_def slots_of_def object_slots_def\n split: if_split_asm)\n\nlemma irq_handler_cap_example_spec:\n \"\\is_irqhandler_cap cap; opt_cap (obj_id, slot) example_spec = Some cap\\\n \\ (obj_id = cnode_a2_id \\ slot = 12) \\\n (obj_id = cnode_b_id \\ slot = 254)\"\n by (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def empty_irq_node_def new_irq_node_def new_cnode_def\n obj_defs new_cap_map_def empty_cap_map_def\n split: if_split_asm)\n\n\nlemma irqhandler_cap_at_example_spec:\n \"irqhandler_cap_at (obj_id, slot) example_spec\n = ((obj_id = cnode_a2_id \\ slot = 12) \\\n (obj_id = cnode_b_id \\ slot = 254))\"\n apply (clarsimp simp: cap_at_def)\n apply (rule iffI)\n apply clarsimp\n apply (drule (1) irq_handler_cap_example_spec)\n apply clarsimp\n apply (erule disjE)\n apply (clarsimp simp: cnode_a2_def object_slots_def new_cnode_def new_cap_map_def)\n apply (clarsimp simp: cnode_b_def object_slots_def new_cnode_def new_cap_map_def)\n done\n\nlemma cap_at_has_no_parents_in_cdt_example_spec:\n \"cap_at_has_no_parents_in_cdt (obj_id, slot) example_spec\n = ((obj_id \\ cnode_a2_id \\ slot \\ 0) \\\n (obj_id \\ cnode_a2_id \\ slot \\ 10) \\\n (obj_id \\ cnode_b_id \\ slot \\ 4))\"\n by (auto simp: cap_at_has_no_parents_in_cdt_def opt_parent_def example_spec_def)\n\nlemma is_orig_cap_example_spec:\n \"original_cap_at (obj_id, slot) example_spec\n = ((obj_id \\ cnode_a2_id \\ slot \\ 0) \\\n (obj_id \\ cnode_a2_id \\ slot \\ 10) \\\n (obj_id \\ cnode_b_id \\ slot \\ 4))\"\n by (fastforce simp: original_cap_at_def cap_at_has_no_parents_in_cdt_example_spec irqhandler_cap_at_example_spec)\n\n\n(****************************************\n * Proof that the state is well formed. *\n ****************************************)\n\nlemma well_formed_tcb_a:\n \"well_formed_tcb example_spec obj_id (Tcb tcb_a)\"\n by (auto simp: well_formed_tcb_def object_slots_def tcb_a_def tcb_slot_defs tcb_has_fault_def\n is_default_cap_def default_cap_def cap_type_def irq_nodes_example_spec)\n\nlemma well_formed_tcb_b:\n \"well_formed_tcb example_spec obj_id (Tcb tcb_b)\"\n by (auto simp: well_formed_tcb_def object_slots_def tcb_b_def tcb_slot_defs tcb_has_fault_def\n is_default_cap_def default_cap_def cap_type_def irq_nodes_example_spec)\n\nlemma well_formed_orig_caps_unique_example:\n \"well_formed_orig_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_orig_caps_unique_def)\n apply (clarsimp simp: cnode_at_example_spec is_orig_cap_example_spec)\n by (elim disjE, (clarsimp simp: cnode_defs split: if_split_asm)+)\n\nlemma well_formed_fake_pt_caps_unique_example:\n \"well_formed_fake_pt_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_fake_pt_caps_unique_def\n pd_at_example_spec)\n apply (fastforce simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def is_fake_pt_cap_simps\n pd_a_def pd_b_def new_cap_map_def irq_objects_def\n split: if_split_asm option.splits)\n done\n\nlemma well_formed_orig_cap_tcb [simp]:\n \"well_formed_orig_cap (TcbCap obj_id)\"\n by (clarsimp simp: well_formed_orig_cap_def default_cap_def cap_type_def\n cap_rights_def ep_related_cap_def)\n\nlemma well_formed_cap_ex [simp]:\n \"well_formed_cap (CNodeCap a 0 0 2)\"\n \"well_formed_cap (TcbCap 0)\"\n by (clarsimp simp: well_formed_cap_def guard_bits_def)+\n\nlemma well_formed_cap_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap\\\n \\ well_formed_cap cap\"\n apply (clarsimp simp: well_formed_cap_def)\n by (clarsimp simp: well_formed_cap_def example_spec_def\n obj_defs new_cap_map_def new_irq_node_def new_cnode_def\n object_slots_def empty_cap_map_def guard_bits_def\n tcb_slot_defs vm_read_write_def\n split: cdl_cap.splits if_split_asm)\n\nlemma well_formed_cdt_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap\\\n \\ well_formed_cdt example_spec (obj_id, slot) cap\"\n apply (clarsimp simp: well_formed_cdt_def)\n apply (clarsimp simp: cnode_at_example_spec)\n apply (case_tac \"(obj_id = cnode_a2_id \\ slot = 0) \\\n (obj_id = cnode_b_id \\ slot = 4)\")\n apply (rule_tac x=cnode_extra_id in exI, clarsimp, rule conjI)\n subgoal by (fastforce simp: example_spec_def cnode_defs\n split: if_split_asm)\n apply (rule_tac x=1 in exI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n cnode_defs object_slots_def new_cnode_def new_cap_map_def\n irq_objects_def map_add_def empty_irq_node_def\n split: if_split_asm)\n apply (case_tac \"(obj_id = cnode_a2_id \\ slot = 10)\")\n apply (rule_tac x=cnode_extra_id in exI, clarsimp, rule conjI)\n apply (fastforce simp: example_spec_def cnode_defs\n split: if_split_asm)\n apply (rule_tac x=2 in exI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n cnode_defs object_slots_def new_cnode_def new_cap_map_def\n irq_objects_def map_add_def empty_irq_node_def\n split: if_split_asm)\n apply clarsimp\n apply (rule_tac x=obj_id in exI, clarsimp, rule conjI)\n apply (clarsimp simp: example_spec_def cnode_defs\n dest!: object_slots_new_cnode_D\n split: if_split_asm)\n apply (fastforce simp: is_orig_cap_example_spec opt_cap_def slots_of_def)\n done\n\nlemma well_formed_orig_cap_example [simp]:\n \"\\cdl_objects example_spec obj_id = Some obj;\n object_slots obj slot = Some cap; cap \\ NullCap;\n original_cap_at (obj_id, slot) example_spec \\\n \\ well_formed_orig_cap cap\"\n apply (clarsimp simp: is_orig_cap_example_spec well_formed_orig_cap_def)\n by (clarsimp simp: example_spec_def object_slots_def obj_defs new_cnode_def new_cap_map_def\n new_irq_node_def ep_related_cap_def cap_type_def default_cap_def cap_rights_def\n split: if_split_asm)\n\nlemma well_formed_caps_example:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_caps example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_caps_def, rule conjI)\n apply (clarsimp simp: is_orig_cap_example_spec)\n apply (clarsimp simp: example_spec_def obj_defs object_type_def cap_type_def object_slots_def\n is_copyable_cap_def\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: well_formed_cap_to_real_object_def real_object_at_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def obj_defs object_slots_def onehundred_not_le_one\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n irq_objects_some_object cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n apply (fastforce simp: new_irq_node_def empty_irq_node_def split: if_split_asm)\n apply (rule conjI)\n apply (clarsimp simp: well_formed_cap_types_match_def)\n apply (rule conjI)\n apply (clarsimp simp: example_spec_def object_slots_def obj_defs\n irq_objects_def map_add_def new_irq_node_def\n onehundred_not_le_one\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D\n cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n apply (clarsimp simp: example_spec_def object_slots_def obj_defs\n irq_objects_def map_add_def new_irq_node_def\n onehundred_not_le_one object_type_def\n dest!: cdl_cnode_caps_new_cnode_D new_cap_map_caps_D cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm)\n by (clarsimp simp: example_spec_def obj_defs is_cnode_def is_tcb_def is_fake_vm_cap_def\n object_slots_def object_type_def cap_type_def new_irq_node_def\n empty_irq_node_def empty_cnode_def\n dest!: cdl_cnode_caps_new_cnode_D irq_objects_some_object cdl_irq_node_caps_empty_irq_node_D\n split: if_split_asm cdl_object.splits)\n\nlemma real_object_at_example_spec:\n \"real_object_at obj_id example_spec =\n ((obj_id = tcb_a_id) \\\n (obj_id = tcb_b_id) \\\n (obj_id = cnode_a1_id) \\\n (obj_id = cnode_a2_id) \\\n (obj_id = cnode_b_id) \\\n (obj_id = cnode_extra_id) \\\n (obj_id = ep_id) \\\n (obj_id = ntfn_id) \\\n (obj_id = pd_a_id) \\\n (obj_id = pt_a_id) \\\n (obj_id = pd_b_id) \\\n (obj_id = frame_a1_id) \\\n (obj_id = frame_a2_id) \\\n (obj_id = frame_b_id))\"\n apply (clarsimp simp: real_object_at_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def irq_objects_def dom_def onehundred_not_le_one\n split: if_split_asm)\n done\n\nlemma real_object_at_example_spec_simp [simp]:\n \"real_object_at 0 example_spec\"\n \"real_object_at 1 example_spec = True\"\n \"real_object_at 2 example_spec\"\n \"real_object_at 3 example_spec\"\n \"real_object_at 4 example_spec\"\n \"real_object_at 5 example_spec\"\n \"real_object_at 6 example_spec\"\n \"real_object_at 7 example_spec\"\n \"real_object_at 8 example_spec\"\n \"real_object_at 9 example_spec\"\n \"real_object_at 0xA example_spec\"\n \"real_object_at 0xB example_spec\"\n \"real_object_at 0xC example_spec\"\n \"real_object_at 0xD example_spec\"\n \"\\real_object_at 0x104 example_spec\"\n \"\\real_object_at 0x1FE example_spec\"\n by (clarsimp simp: real_object_at_example_spec)+\n\nlemma cdl_objects_example_spec_simps [simp]:\n \"cdl_objects example_spec 4 = Some (Frame empty_frame)\"\n \"cdl_objects example_spec 0xD = Some Notification\"\n \"cdl_objects example_spec 0x1FE = Some (IRQNode empty_irq_node)\"\n by (clarsimp simp: example_spec_def map_add_def)+\n\nlemma well_formed_cap_to_object_example:\n \"cdl_objects example_spec obj_id = Some obj\n \\ well_formed_cap_to_object example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_cap_to_object_def is_orig_cap_example_spec)\n apply (intro conjI)\n apply (case_tac \"obj_id = ep_id \\\n obj_id = ntfn_id \\\n obj_id = cnode_extra_id\")\n apply (rule_tac x=cnode_extra_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_extra_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = tcb_b_id \\\n obj_id = cnode_b_id \\\n obj_id = pd_b_id \\\n obj_id = frame_b_id\")\n apply (rule_tac x=cnode_b_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_b_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = tcb_a_id \\\n obj_id = cnode_a2_id\")\n apply (rule_tac x=cnode_a1_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_a1_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = cnode_a1_id \\\n obj_id = pd_a_id \\\n obj_id = pt_a_id \\\n obj_id = frame_a1_id \\\n obj_id = ep_id\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = frame_a2_id\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (rule_tac x=11 in exI) (* Not sure why fastforce gives up here. *)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = 0x104\")\n apply (rule_tac x=cnode_a2_id in exI)\n apply (rule_tac x=12 in exI) (* Not sure why fastforce gives up here. *)\n apply (fastforce simp: cnode_at_example_spec cnode_a2_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (case_tac \"obj_id = 0x1FE\")\n apply (rule_tac x=cnode_b_id in exI)\n apply (fastforce simp: cnode_at_example_spec cnode_b_def\n object_slots_def new_cnode_def new_cap_map_def)\n apply (clarsimp simp: example_spec_def)\n apply clarsimp\n apply (clarsimp simp: example_spec_def)\n by (clarsimp simp: opt_cap_def slots_of_def obj_defs\n object_slots_def object_size_bits_def\n new_cap_map_def empty_cap_map_def frame_cap_not_cnode\n empty_irq_node_def new_irq_node_def\n split: if_split_asm\n | drule (1) cdl_cnode_caps_new_cnode_cnode_cap)+ (* Takes 20 seconds. *)\n\nlemma well_formed_cap_to_non_empty_pt_example:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_cap_to_non_empty_pt example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_cap_to_non_empty_pt_def pt_at_example_spec)\n apply (rule exI [where x=pd_a_id])\n apply (clarsimp simp: well_formed_cap_to_non_empty_pt_def example_spec_def is_pt_def\n object_at_def opt_cap_def slots_of_def object_slots_def\n obj_defs new_cap_map_def is_pd_def empty_cap_map_def\n split: if_split_asm)\n done\n\nlemma well_formed_vspace_example:\n \"cdl_objects example_spec obj_id = Some obj\n \\ well_formed_vspace example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_vspace_def well_formed_cap_to_non_empty_pt_example)\n apply (clarsimp simp: example_spec_def is_pt_def is_pd_def object_slots_def empty_cap_map_def\n new_irq_node_def\n split: if_split_asm)\n apply (fastforce simp: cap_type_def is_fake_vm_cap_def obj_defs new_cap_map_def small_section_size_def\n split: if_split_asm)\n apply (clarsimp simp: obj_defs new_cap_map_def cap_type_def small_frame_size_def\n is_fake_vm_cap_def is_fake_pt_cap_simps small_section_size_def\n split: if_split_asm)\n apply (clarsimp simp: obj_defs new_cap_map_def cap_type_def small_frame_size_def\n is_fake_vm_cap_def is_fake_pt_cap_simps small_section_size_def\n split: if_split_asm)\n done\n\n\nlemma well_formed_irqhandler_caps_unique_example_spec:\n \"well_formed_irqhandler_caps_unique example_spec\"\n apply (clarsimp simp: well_formed_irqhandler_caps_unique_def)\n apply (drule (1) irq_handler_cap_example_spec)+\n by (clarsimp simp: example_spec_def opt_cap_def slots_of_def\n object_slots_def obj_defs\n new_cnode_def new_cap_map_def\n split: if_split_asm)\n\nlemma ucast_0xFE:\n \"(ucast :: 8 word \\ 32 word) irq = 0xFE \\ irq = 0xFE\"\n by (rule ucast_up_inj, simp+)\n\nlemma ucast_4:\n \"(ucast :: 10 word \\ 32 word) irq = 4 \\ irq = 4\"\n by (rule ucast_up_inj, simp+)\n\nlemma rangeD:\n \"\\range f = A; f x = y\\ \\ y \\ A\"\n by (fastforce simp: image_def)\n\nlemma slots_of_example_irq_node:\n \"\\slots_of (example_irq_node irq) example_spec 0 = Some cap;\n cap \\ NullCap\\\n \\ (irq = 4)\"\n apply (frule (1) slots_of_example_spec_obj_ids)\n apply (insert range_example_irq_node)\n apply (erule disjE, drule (1) rangeD, simp add: onehundred_not_le_one)+\n apply (clarsimp simp: example_irq_node_def ucast_4)\n done\n\nlemma bound_irqs_example_spec [simp]:\n \"bound_irqs example_spec = {4}\"\n apply (clarsimp simp: bound_irqs_def)\n apply rule\n apply clarsimp\n apply (erule (1) slots_of_example_irq_node)\n apply (clarsimp simp: example_spec_def slots_of_def\n object_slots_def new_irq_node_def)\n done\n\nlemma well_formed_irqhandler_caps_example_spec:\n \"well_formed_irqhandler_caps example_spec\"\n apply (clarsimp simp: well_formed_irqhandler_caps_def)\n apply (rule exI [where x=cnode_a2_id])\n apply (rule exI [where x=12])\n apply (rule exI [where x=\"IrqHandlerCap 4\"])\n apply (clarsimp simp: object_slots_def cnode_a2_def new_cnode_def new_cap_map_def)\n done\n\nlemma rangeI:\n \"f x = a \\ a \\ range f\"\n by auto\n\nlemma well_formed_irq_table_example_spec:\n \"well_formed_irq_table example_spec\"\n apply (clarsimp simp: well_formed_irq_table_def)\n apply (rule conjI)\n apply (clarsimp simp: example_irq_node_def)\n apply (clarsimp simp: inj_on_def ucast_up_inj)\n apply (clarsimp simp: irq_nodes_example_spec)\n apply (rule subset_antisym)\n apply (clarsimp simp: example_spec_def)\n apply (metis example_irq_node_simps)\n apply clarsimp\n apply (clarsimp simp: example_spec_def split: if_split_asm,\n (drule rangeI [where f=example_irq_node],\n simp add: range_example_irq_node onehundred_not_le_one)+)\n done\n\nlemma well_formed_tcb_example_spec:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_tcb example_spec obj_id obj\"\n apply (case_tac \"obj_id = tcb_a_id\")\n apply (cut_tac obj_id = tcb_a_id in well_formed_tcb_a)\n apply (clarsimp simp: example_spec_def split: if_split_asm)\n apply (case_tac \"obj_id = tcb_b_id\")\n apply (cut_tac obj_id = tcb_b_id in well_formed_tcb_b)\n apply (clarsimp simp: example_spec_def split: if_split_asm)\n by (clarsimp simp: example_spec_def well_formed_tcb_def is_tcb_def\n empty_irq_node_def new_irq_node_def\n split: if_split_asm)\n\nlemma well_formed_irq_node_example_spec:\n \"cdl_objects example_spec obj_id = Some obj \\\n well_formed_irq_node example_spec obj_id obj\"\n apply (clarsimp simp: well_formed_irq_node_def irq_nodes_example_spec)\n apply (clarsimp simp: example_spec_def object_slots_def empty_irq_node_def new_irq_node_def\n empty_cnode_def empty_cap_map_def dom_def\n is_default_cap_def default_cap_def onehundred_not_le_one\n split: if_split_asm)\n done\n\nlemma well_formed_example:\n \"well_formed example_spec\"\n apply (clarsimp simp: well_formed_def)\n apply (intro conjI)\n apply (rule well_formed_orig_caps_unique_example)\n apply (rule well_formed_irqhandler_caps_unique_example_spec)\n apply (rule well_formed_fake_pt_caps_unique_example)\n apply (rule well_formed_irqhandler_caps_example_spec)\n apply (rule well_formed_irq_table_example_spec)\n apply (clarsimp split: option.splits, rename_tac obj)\n apply (clarsimp simp: well_formed_caps_example well_formed_cap_to_object_example\n well_formed_orig_caps_unique_example)\n apply (rule conjI)\n apply (fact well_formed_tcb_example_spec)\n apply (rule conjI)\n apply (fact well_formed_vspace_example)\n apply (rule conjI)\n apply (fact well_formed_irq_node_example_spec)\n apply (clarsimp simp: cnode_at_example_spec)\n by (auto simp: example_spec_def object_size_bits_def object_default_state_def2\n pd_size_def word_bits_def empty_cnode_def is_cnode_def\n object_slots_def empty_cap_map_def tcb_slot_defs slots_of_def\n default_tcb_def obj_defs cap_at_def opt_cap_def\n small_frame_size_def small_section_size_def pt_size_def\n new_cnode_def new_cap_map_def empty_irq_node_def\n new_irq_node_def\n split: if_split_asm)\n\nend\n\nend\n\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/sys-init/ExampleSpecIRQ_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.15570182115626993}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__28_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__28_on_rules imports n_german_lemma_on_inv__28\nbegin\nsection{*All lemmas on causal relation between inv__28*}\nlemma lemma_inv__28_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__28 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__28) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__28) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__28_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.15570182115626993}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__77_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__77_on_rules imports n_g2kAbsAfter_lemma_on_inv__77\nbegin\nsection{*All lemmas on causal relation between inv__77*}\nlemma lemma_inv__77_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__77 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__77) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__77) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__77_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.29746993014852224, "lm_q1q2_score": 0.15570181463640345}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__98_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__98_on_rules imports n_g2kAbsAfter_lemma_on_inv__98\nbegin\nsection{*All lemmas on causal relation between inv__98*}\nlemma lemma_inv__98_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__98 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__98) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__98) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__98_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.2845759920814681, "lm_q1q2_score": 0.15558855200981}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__49_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__49_on_rules imports n_germanSymIndex_lemma_on_inv__49\nbegin\nsection{*All lemmas on causal relation between inv__49*}\nlemma lemma_inv__49_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__49 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__49) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__49_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.304041668660366, "lm_q1q2_score": 0.15558317037547134}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__80_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__80_on_rules imports n_g2kAbsAfter_lemma_on_inv__80\nbegin\nsection{*All lemmas on causal relation between inv__80*}\nlemma lemma_inv__80_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__80 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__80) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__80) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__80_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.29421498454004374, "lm_q1q2_score": 0.15514442277382895}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__19_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__19_on_rules imports n_g2kAbsAfter_lemma_on_inv__19\nbegin\nsection{*All lemmas on causal relation between inv__19*}\nlemma lemma_inv__19_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__19 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__19) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__19) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__19_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3007455914759599, "lm_q1q2_score": 0.15507041653090292}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__67_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__67_on_rules imports n_g2kAbsAfter_lemma_on_inv__67\nbegin\nsection{*All lemmas on causal relation between inv__67*}\nlemma lemma_inv__67_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__67 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__67) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__67) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__67_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3007455852086007, "lm_q1q2_score": 0.1550704132993277}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__89_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__89_on_rules imports n_g2kAbsAfter_lemma_on_inv__89\nbegin\nsection{*All lemmas on causal relation between inv__89*}\nlemma lemma_inv__89_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__89 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__89) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__89) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__89_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.3007455852086007, "lm_q1q2_score": 0.1550704132993277}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__87_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__87_on_rules imports n_g2kAbsAfter_lemma_on_inv__87\nbegin\nsection{*All lemmas on causal relation between inv__87*}\nlemma lemma_inv__87_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__87 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__87) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__87) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__87_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.3007455789412415, "lm_q1q2_score": 0.1550704100677525}} {"text": "(* Title: HOL/Auth/n_flash_lemma_inv__145_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash Protocol Case Study*} \n\ntheory n_flash_lemma_inv__145_on_rules imports n_flash_lemma_on_inv__145\nbegin\nsection{*All lemmas on causal relation between inv__145*}\nlemma lemma_inv__145_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv4. p__Inv4\\N\\f=inv__145 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ src data. src\\N\\data\\N\\r=n_Store src data)\\\n (\\ data. data\\N\\r=n_Store_Home data)\\\n (\\ src. src\\N\\r=n_PI_Remote_Get src)\\\n (\\ src. src\\N\\r=n_PI_Remote_GetX src)\\\n (\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\\\n (\\ src. src\\N\\r=n_PI_Remote_Replace src)\\\n (\\ dst. dst\\N\\r=n_NI_Nak dst)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Put src)\\\n (\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\\\n (\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\\\n (\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\\\n (\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\\\n (\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\\\n (\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\\\n (\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\\\n (\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\\\n (\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\\\n (\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\\\n (\\ dst. dst\\N\\r=n_NI_Inv dst)\\\n (\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\\\n (\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\\\n (\\ src. src\\N\\r=n_NI_InvAck_1 N src)\\\n (\\ src. src\\N\\r=n_NI_InvAck_2 N src)\\\n (\\ src. src\\N\\r=n_NI_InvAck_3 N src)\\\n (\\ src. src\\N\\r=n_NI_Replace src)\\\n (r=n_PI_Local_Get_Get )\\\n (r=n_PI_Local_Get_Put )\\\n (r=n_PI_Local_GetX_GetX__part__0 )\\\n (r=n_PI_Local_GetX_GetX__part__1 )\\\n (r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\\\n (r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\\\n (r=n_PI_Local_GetX_PutX__part__0 )\\\n (r=n_PI_Local_GetX_PutX__part__1 )\\\n (r=n_PI_Local_PutX )\\\n (r=n_PI_Local_Replace )\\\n (r=n_NI_Nak_Home )\\\n (r=n_NI_Nak_Clear )\\\n (r=n_NI_Local_Put )\\\n (r=n_NI_Local_PutXAcksDone )\\\n (r=n_NI_Wb )\\\n (r=n_NI_FAck )\\\n (r=n_NI_ShWb N )\\\n (r=n_NI_Replace_Home )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ src data. src\\N\\data\\N\\r=n_Store src data)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ data. data\\N\\r=n_Store_Home data)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_Store_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_PI_Remote_Get src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Remote_GetVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_PI_Remote_GetX src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Remote_GetXVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_PI_Remote_PutX dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Remote_PutXVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_PI_Remote_Replace src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Remote_ReplaceVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Nak dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_NakVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Nak__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Nak__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Nak__part__2Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Get__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Get__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Put_HeadVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_PutVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_Get_Put_DirtyVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_Get_NakVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_Get_Nak_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_Get_PutVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_Get_Put_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_Nak__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_Nak__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_Nak__part__2Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_GetX__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_GetX__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_2Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_3Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_4Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_5Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_6Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_7__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_7__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_8_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_8Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_8_NODE_GetVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_9__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_9__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_10_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_10Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_GetX_PutX_11Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_GetX_NakVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_GetX_Nak_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_GetX_PutXVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_GetX_PutX_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_Put dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_PutVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Remote_PutX dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Remote_PutXVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ dst. dst\\N\\r=n_NI_Inv dst)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_InvAck_exists_Home src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvAck_exists_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvAck_existsVsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvAck_1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_InvAck_2 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvAck_2Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_InvAck_3 N src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_InvAck_3Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(\\ src. src\\N\\r=n_NI_Replace src)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_ReplaceVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_Get_Get )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_Get_GetVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_Get_Put )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_Get_PutVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_GetX__part__0 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_GetX__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_GetX__part__1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_GetX__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_PutX__part__0 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_PutX__part__0Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_GetX_PutX__part__1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_GetX_PutX__part__1Vsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_PutX )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_PutXVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_PI_Local_Replace )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_PI_Local_ReplaceVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Nak_Home )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Nak_HomeVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Nak_Clear )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Nak_ClearVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Local_Put )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_PutVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Local_PutXAcksDone )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Local_PutXAcksDoneVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Wb )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_WbVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_FAck )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_FAckVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_ShWb N )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_ShWbVsinv__145) done\n }\n\n moreover {\n assume d1: \"(r=n_NI_Replace_Home )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_NI_Replace_HomeVsinv__145) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash/n_flash_lemma_inv__145_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5506073507867328, "lm_q2_score": 0.28140561345566495, "lm_q1q2_score": 0.15494399932133907}} {"text": "(* Title: HOL/Auth/flash_data_cub_lemma_on_inv__51.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub_lemma_on_inv__51 imports flash_data_cub_base\nbegin\nsection{*All lemmas on causal relation between inv__51 and some rule r*}\nlemma n_PI_Local_Get_PutVsinv__51:\nassumes a1: \"(r=n_PI_Local_Get_Put )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__0Vsinv__51:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__0 N )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX_HeadVld__part__1Vsinv__51:\nassumes a1: \"(r=n_PI_Local_GetX_PutX_HeadVld__part__1 N )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__0Vsinv__51:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__0 )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_GetX_PutX__part__1Vsinv__51:\nassumes a1: \"(r=n_PI_Local_GetX_PutX__part__1 )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_PI_Local_PutXVsinv__51:\nassumes a1: \"(r=n_PI_Local_PutX )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''Dir'') ''Pending'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_PI_Local_ReplaceVsinv__51:\nassumes a1: \"(r=n_PI_Local_Replace )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Put_DirtyVsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_Get_Put_Dirty src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_Get_Put_Dirty src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_1Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_1 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_2Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_2 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_2 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_3Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_3 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_3 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_4Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_4 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_4 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_5Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_5 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_5 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_6Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_6 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_6 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__0Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7__part__1Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__0Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_7_NODE_Get__part__1Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_7_NODE_Get__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_HomeVsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_Home_NODE_GetVsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_8_Home_NODE_Get N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8Vsinv__51:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_8_NODE_GetVsinv__51:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_8_NODE_Get N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__0Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__0 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_9__part__1Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_9__part__1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10_HomeVsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_10_Home N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_10Vsinv__51:\nassumes a1: \"(\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src pp where a1:\"src\\N\\pp\\N\\src~=pp\\r=n_NI_Local_GetX_PutX_10 N src pp\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_GetX_PutX_11Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_Local_GetX_PutX_11 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_Local_GetX_PutX_11 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_PutVsinv__51:\nassumes a1: \"(r=n_NI_Local_Put )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nhave \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\\((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (neg (eqn (IVar (Field (Field (Ident ''Sta'') ''HomeProc'') ''InvMarked'')) (Const true))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_NI_Local_PutXAcksDoneVsinv__51:\nassumes a1: \"(r=n_NI_Local_PutXAcksDone )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_InvAck_1Vsinv__51:\nassumes a1: \"(\\ src. src\\N\\r=n_NI_InvAck_1 N src)\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain src where a1:\"src\\N\\r=n_NI_InvAck_1 N src\" apply fastforce done\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_WbVsinv__51:\nassumes a1: \"(r=n_NI_Wb )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_ShWbVsinv__51:\nassumes a1: \"(r=n_NI_ShWb N )\" and\na2: \"(f=inv__51 )\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\n have \"?P1 s\"\n proof(cut_tac a1 a2 , auto) qed\n then show \"invHoldForRule s f r (invariants N)\" by auto\nqed\n\nlemma n_NI_Local_Get_Get__part__1Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__1 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutX_HomeVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_PutX_Home dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Get src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_StoreVsinv__51:\n assumes a1: \"\\ src data. src\\N\\data\\N\\r=n_Store src data\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__1Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__1 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_3Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_3 N src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__1Vsinv__51:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__1 \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_GetX_GetX__part__0Vsinv__51:\n assumes a1: \"r=n_PI_Local_GetX_GetX__part__0 \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_ReplaceVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_Replace src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_Store_HomeVsinv__51:\n assumes a1: \"\\ data. data\\N\\r=n_Store_Home data\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__1Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__1 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__1Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__1 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Get__part__0Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Get__part__0 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_existsVsinv__51:\n assumes a1: \"\\ src pp. src\\N\\pp\\N\\src~=pp\\r=n_NI_InvAck_exists src pp\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__2Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__2 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_PutXVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_PI_Remote_PutX dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Put_HomeVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Put_Home dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Put_HeadVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put_Head N src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Inv dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__2Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__2 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_GetX__part__0Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_GetX__part__0 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_ReplaceVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Replace src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_Nak_HomeVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_GetX_Nak_Home dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_NakVsinv__51:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_Nak src dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_NakVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Nak dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Remote_GetXVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_PI_Remote_GetX src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_Nak_HomeVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Get_Nak_Home dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutXVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_PutX dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_PutVsinv__51:\n assumes a1: \"\\ dst. dst\\N\\r=n_NI_Remote_Put dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_PutVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Put src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_GetX_Nak__part__0Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_GetX_Nak__part__0 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_exists_HomeVsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_exists_Home src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Replace_HomeVsinv__51:\n assumes a1: \"r=n_NI_Replace_Home \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_GetX_PutXVsinv__51:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_GetX_PutX src dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_NakVsinv__51:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Nak src dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_ClearVsinv__51:\n assumes a1: \"r=n_NI_Nak_Clear \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Local_Get_Nak__part__0Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_Local_Get_Nak__part__0 src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_PI_Local_Get_GetVsinv__51:\n assumes a1: \"r=n_PI_Local_Get_Get \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Remote_Get_PutVsinv__51:\n assumes a1: \"\\ src dst. src\\N\\dst\\N\\src~=dst\\r=n_NI_Remote_Get_Put src dst\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_Nak_HomeVsinv__51:\n assumes a1: \"r=n_NI_Nak_Home \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_InvAck_2Vsinv__51:\n assumes a1: \"\\ src. src\\N\\r=n_NI_InvAck_2 N src\" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \n\nlemma n_NI_FAckVsinv__51:\n assumes a1: \"r=n_NI_FAck \" and\n a2: \"(f=inv__51 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n \nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub_lemma_on_inv__51.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.30735802955444114, "lm_q1q2_score": 0.15487960765414238}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchDetype_AI\nimports Detype_AI\nbegin\n\ncontext Arch begin global_naming ARM\n\nnamed_theorems Detype_AI_asms\n\nlemma valid_globals_irq_node[Detype_AI_asms]:\n \"\\ valid_global_refs s; cte_wp_at ((=) cap) ptr s \\\n \\ interrupt_irq_node s irq \\ cap_range cap\"\n apply (erule(1) valid_global_refsD)\n apply (simp add: global_refs_def)\n done\n\nlemma caps_of_state_ko[Detype_AI_asms]:\n \"valid_cap cap s\n \\ is_untyped_cap cap \\\n cap_range cap = {} \\\n (\\ptr \\ cap_range cap. \\ko. kheap s ptr = Some ko)\"\n apply (case_tac cap)\n apply (clarsimp simp: cap_range_def valid_cap_def obj_at_def is_cap_simps\n split: option.splits)+\n apply (rename_tac arch_cap ptr)\n apply (case_tac arch_cap)\n apply (fastforce simp: cap_range_def obj_at_def is_cap_simps\n split: option.splits if_splits)+\n done\n\n\nlemma mapM_x_storeWord[Detype_AI_asms]:\n(* FIXME: taken from Retype_C.thy and adapted wrt. the missing intvl syntax. *)\n assumes al: \"is_aligned ptr word_size_bits\"\n shows \"mapM_x (\\x. storeWord (ptr + of_nat x * word_size) 0) [0..m x. if \\k. x = ptr + of_nat k \\ k < n * word_size then 0 else m x))\"\nproof (induct n)\n case 0\n thus ?case\n apply (rule ext)\n apply (simp add: mapM_x_mapM mapM_def sequence_def\n modify_def get_def put_def bind_def return_def)\n done\nnext\n case (Suc n')\n\n have funs_eq:\n \"\\m x. (if \\k. x = ptr + of_nat k \\ k < 4 + n' * 4 then 0\n else (m x :: word8)) =\n ((\\xa. if \\k. xa = ptr + of_nat k \\ k < n' * 4 then 0 else m xa)\n (ptr + of_nat n' * 4 := word_rsplit (0 :: word32) ! 3,\n ptr + of_nat n' * 4 + 1 := word_rsplit (0 :: word32) ! 2,\n ptr + of_nat n' * 4 + 2 := word_rsplit (0 :: word32) ! Suc 0,\n ptr + of_nat n' * 4 + 3 := word_rsplit (0 :: word32) ! 0)) x\"\n proof -\n fix m x\n\n have xin': \"\\x. (x < 4 + n' * 4) = (x < n' * 4 \\ x = n' * 4\n \\ x = (n' * 4) + 1 \\ x = (n' * 4) + 2 \\ x = (n' * 4) + 3)\"\n by (safe, simp_all)\n\n have xin: \"(EX k. x = ptr + of_nat k \\ k < 4 + n' * 4) =\n ((\\k. x = ptr + of_nat k \\ k < n' * 4) \\\n x = ptr + of_nat n' * 4 \\ x = ptr + of_nat n' * 4 + 1 \\\n x = ptr + of_nat n' * 4 + 2 \\ x = ptr + of_nat n' * 4 + 3)\"\n by (simp add: xin' conj_disj_distribL ex_disj_distrib field_simps)\n\n show \"?thesis m x\" by (simp add: xin word_rsplit_0 word_bits_conv cong: if_cong)\n qed\n\n from al have \"is_aligned (ptr + of_nat n' * 4) 2\"\n apply (rule aligned_add_aligned)\n apply (rule is_aligned_mult_triv2 [where n = 2, simplified])\n apply (simp add: word_bits_conv word_size_bits_def)+\n done\n\n thus ?case\n apply (simp add: mapM_x_append bind_assoc Suc.hyps mapM_x_singleton)\n apply (simp add: storeWord_def assert_def is_aligned_mask modify_modify\n comp_def word_size_def)\n apply (simp only: funs_eq)\n done\nqed\n\nlemma empty_fail_freeMemory [Detype_AI_asms]: \"empty_fail (freeMemory ptr bits)\"\n by (fastforce simp: freeMemory_def mapM_x_mapM ef_storeWord)\n\n\nlemma region_in_kernel_window_detype[simp]:\n \"region_in_kernel_window S (detype S' s)\n = region_in_kernel_window S s\"\n by (simp add: region_in_kernel_window_def detype_def)\n\n\nlemma region_in_kernel_window_machine_state_update[simp]:\n \"region_in_kernel_window S (machine_state_update f s) =\n region_in_kernel_window S s\"\n by (simp add: region_in_kernel_window_def)\n\n\nlemma region_in_kernel_window_delete_objects[wp]:\n \"\\region_in_kernel_window S\\\n delete_objects ptr bits\n \\\\_. region_in_kernel_window S\\\"\n by (wp | simp add: delete_objects_def do_machine_op_def split_def)+\n\nlemma state_hyp_refs_of_detype:\n \"state_hyp_refs_of (detype S s) = (\\x. if x \\ S then {} else state_hyp_refs_of s x)\"\n by (rule ext, simp add: state_hyp_refs_of_def detype_def)\n\nlemma valid_ioports_detype[Detype_AI_asms]:\n \"valid_ioports s \\ valid_ioports (detype (untyped_range cap) s)\"\n by auto\n\nend\n\ninterpretation Detype_AI?: Detype_AI\n proof goal_cases\n interpret Arch .\n case 1 show ?case\n by (intro_locales; (unfold_locales; fact Detype_AI_asms)?)\n qed\n\ncontext detype_locale_arch begin\n\nnamed_theorems detype_invs_proofs\n\nlemma state_hyp_refs: \"state_hyp_refs_of (detype (untyped_range cap) s) = state_hyp_refs_of s\"\n apply (rule ext, clarsimp simp add: state_hyp_refs_of_detype)\n apply (rule sym, rule equals0I, drule state_hyp_refs_of_elemD)\n apply (drule live_okE, rule hyp_refs_of_live, clarsimp)\n apply simp\n done\n\nlemma hyp_refsym : \"sym_refs (state_hyp_refs_of s)\"\n using invs by (simp add: invs_def valid_state_def valid_pspace_def)\n\nlemma hyp_refs_of: \"\\obj p. \\ ko_at obj p s \\ \\ hyp_refs_of obj \\ (UNIV - untyped_range cap \\ UNIV)\"\n by (fastforce intro: hyp_refs_of_live dest!: hyp_sym_refs_ko_atD[OF _ hyp_refsym] live_okE)\n\nlemma arch_valid_obj[detype_invs_proofs]:\n \"\\p ao. \\ko_at (ArchObj ao) p s; arch_valid_obj ao s\\\n \\ arch_valid_obj ao (detype (untyped_range cap) s)\"\n apply (frule hyp_refs_of)\n apply (auto simp: arch_valid_obj_def split: arch_kernel_obj.splits option.splits)\n done\n\nlemma sym_hyp_refs_detype[detype_invs_proofs]:\n \"sym_refs (state_hyp_refs_of (detype (untyped_range cap) s))\"\n using hyp_refsym by (simp add: state_hyp_refs)\n\nlemma valid_cap[detype_invs_proofs]:\n \"\\cap'. \\ s \\ cap'; obj_reply_refs cap' \\ (UNIV - untyped_range cap) \\\n \\ detype (untyped_range cap) s \\ cap'\"\n by (auto simp: valid_cap_def valid_untyped_def obj_reply_refs_def\n split: cap.split_asm option.splits if_splits\n arch_cap.split_asm bool.split_asm )\n\nlemma glob_det[detype_invs_proofs]: \"\\r. global_refs (detype r s) = global_refs s\"\n by (simp add: global_refs_def detype_def)\n\nlemma valid_idle_detype[detype_invs_proofs]: \"valid_idle (detype (untyped_range cap) s)\"\n proof -\n have \"valid_idle s\" using invs by (simp add: invs_def valid_state_def)\n thus ?thesis using valid_global_refsD [OF globals cap]\n by (fastforce simp add: valid_idle_def state_refs idle cap_range_def\n global_refs_def)\n qed\n\nlemma valid_vs_lookup: \"valid_vs_lookup s\"\n using valid_arch_caps by (simp add: valid_arch_caps_def)\n\nlemma hyp_live_strg:\n \"hyp_live ko \\ live ko\"\n by (cases ko; simp add: live_def hyp_live_def)\n\nlemma obj_at_hyp_live_strg:\n \"obj_at hyp_live p s \\ obj_at live p s\"\n by (erule obj_at_weakenE, rule hyp_live_strg)\n\nlemma tcb_arch_detype[detype_invs_proofs]:\n \"\\ko_at (TCB t) p s; valid_arch_tcb (tcb_arch t) s\\\n \\ valid_arch_tcb (tcb_arch t) (detype (untyped_range cap) s)\"\n apply (clarsimp simp: valid_arch_tcb_def)\n done\n\nlemma valid_arch_state_detype[detype_invs_proofs]:\n \"valid_arch_state (detype (untyped_range cap) s)\"\n using valid_vs_lookup valid_arch_state ut_mdb valid_global_refsD [OF globals cap] cap\n apply (simp add: valid_arch_state_def valid_asid_table_def\n valid_global_pts_def global_refs_def\n cap_range_def)\n apply (clarsimp simp: ran_def arch_state_det)\n apply (drule vs_lookup_atI)\n apply (drule (1) valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI])\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (drule untyped_mdbD, rule untyped, assumption)\n apply blast\n apply assumption\n apply (drule descendants_range_inD[OF drange])\n apply (simp add: cte_wp_at_caps_of_state)\n apply (simp add: cap_range_def)\n apply blast\n done\n\nlemma global_pts: (* ARCH SPECIFIC STATEMENT*)\n \"\\p. \\ p \\ set (arm_global_pts (arch_state s)); p \\ untyped_range cap \\ \\ False\"\n using valid_global_refsD [OF globals cap] by (simp add: cap_range_def global_refs_def)\n\nlemma vs_lookup: (* SIMP *)\n \"vs_lookup (detype (untyped_range cap) s) = vs_lookup s\"\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI)\n apply (erule vs_lookup_induct)\n apply (simp add: arch_state_det)\n apply (erule vs_lookup_atI)\n apply (erule vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (erule vs_lookup_induct)\n apply (rule vs_lookup_atI)\n apply (simp add: arch_state_det)\n apply (erule vs_lookup_step)\n apply (clarsimp simp: vs_lookup1_def)\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI], rule valid_vs_lookup)\n apply (elim conjE exE)\n apply (insert cap)\n apply (simp add: cte_wp_at_caps_of_state)\n apply (drule untyped_mdbD, rule untyped, assumption)\n apply blast\n apply (rule ut_mdb)\n apply (drule descendants_range_inD[OF drange])\n apply (simp add: cte_wp_at_caps_of_state)\n apply (simp add: cap_range_def)\n apply blast\n done\n\n\nlemma vs_lookup_pages: (* SIMP *)\n \"vs_lookup_pages (detype (untyped_range cap) s) = vs_lookup_pages s\"\n apply (rule set_eqI)\n apply clarsimp\n apply (rule iffI)\n apply (erule vs_lookup_pages_induct)\n apply (simp add: arch_state_det)\n apply (erule vs_lookup_pages_atI)\n apply (erule vs_lookup_pages_step)\n apply (clarsimp simp: vs_lookup_pages1_def)\n apply (erule vs_lookup_pages_induct)\n apply (rule vs_lookup_pages_atI)\n apply (simp add: arch_state_det)\n apply (erule vs_lookup_pages_step)\n apply (clarsimp simp: vs_lookup_pages1_def)\n apply (drule valid_vs_lookupD, rule valid_vs_lookup)\n apply (elim conjE exE)\n apply (insert cap)\n apply (simp add: cte_wp_at_caps_of_state)\n apply (drule untyped_mdbD, rule untyped, assumption)\n apply blast\n apply (rule ut_mdb)\n apply (drule descendants_range_inD[OF drange])\n apply (simp add: cte_wp_at_caps_of_state)\n apply (simp add: cap_range_def)\n apply blast\n done\n\nlemma vs_lookup_preserved:\n \"\\x rf. \\ x \\ untyped_range cap; (rf \\ x) s \\ \\ False\"\n apply (drule valid_vs_lookupD[OF vs_lookup_pages_vs_lookupI valid_vs_lookup])\n apply (fastforce intro: global_pts no_obj_refs)\n done\n\nlemma vs_lookup_pages_preserved:\n \"\\x rf. \\ x \\ untyped_range cap; (rf \\ x) s \\ \\ False\"\n apply (drule valid_vs_lookupD[OF _ valid_vs_lookup])\n apply (fastforce intro: global_pts no_obj_refs)\n done\n\ncontext begin\n\nprivate method crush for i =\n (simp add: data_at_def obj_at_def;\n elim disjE exE conjE;\n clarsimp;\n erule vs_lookup_pages_preserved;\n erule vs_lookup_pages_step;\n clarsimp simp: vs_lookup_pages1_def obj_at_def vs_refs_pages_def;\n strengthen image_eqI;\n clarsimp simp: graph_of_def pte_ref_pages_def pde_ref_pages_def;\n rule exI;\n strengthen refl;\n simp;\n rule exI[of _ i];\n fastforce)\n\nlemma valid_vspace_obj:\n \"\\ao p. \\ valid_vspace_obj ao s; ko_at (ArchObj ao) p s; (\\\\p) s \\ \\\n valid_vspace_obj ao (detype (untyped_range cap) s)\"\n apply (case_tac ao; simp; erule allEI ballEI; clarsimp simp: ran_def;\n drule vs_lookup_pages_vs_lookupI)\n subgoal for p t r ref i by (crush i)\n subgoal for p t i ref by (cases \"t i\"; crush i)\n subgoal for p t i ref by (cases \"t i\"; crush i)\n done\n\nend\n\nlemma valid_vspace_obj_detype[detype_invs_proofs]: \"valid_vspace_objs (detype (untyped_range cap) s)\"\n proof -\n have \"valid_vspace_objs s\"\n using invs by fastforce\n thus ?thesis\n unfolding valid_vspace_objs_def\n apply (simp add: vs_lookup)\n apply (auto intro: valid_vspace_obj)\n done\n qed\n\nlemma unique_table_caps:\n \"\\cps P. unique_table_caps cps\n \\ unique_table_caps (\\x. if P x then None else cps x)\"\n by (simp add: unique_table_caps_def)\n\nend\n\n\nsublocale detype_locale < detype_locale_gen_1\n proof goal_cases\n interpret detype_locale_arch ..\n case 1 show ?case\n by (intro_locales; (unfold_locales; fact detype_invs_proofs)?)\n qed\n\n\ncontext detype_locale_arch begin\n\nlemma valid_vs_lookup': (* LOCAL DUP NAME *)\n \"valid_vs_lookup s \\ valid_vs_lookup (detype (untyped_range cap) s)\"\n apply (simp add: valid_vs_lookup_def vs_lookup_pages del: split_paired_Ex)\n apply (elim allEI)\n apply (intro disjCI2 impI)\n apply (drule(1) mp)+\n apply (elim conjE)\n apply (erule exEI)\n apply clarsimp\n apply (drule non_null_caps)\n apply clarsimp+\n done\n\nlemma valid_table_caps:\n \"valid_table_caps s \\ valid_table_caps (detype (untyped_range cap) s)\"\n apply (simp add: valid_table_caps_def del: imp_disjL)\n apply (elim allEI | rule impI)+\n apply clarsimp\n apply (metis detype_arch_state no_obj_refs)\n done\n\nlemma unique_table_refs:\n \"\\cps P. unique_table_refs cps\n \\ unique_table_refs (\\x. if P x then None else cps x)\"\n apply (simp only: unique_table_refs_def option.simps\n simp_thms\n split: if_split)\n apply blast\n done\n\nlemma valid_arch_caps_detype[detype_invs_proofs]: \"valid_arch_caps (detype (untyped_range cap) s)\"\n using valid_arch_caps by (simp add: valid_arch_caps_def\n unique_table_caps\n valid_vs_lookup'\n unique_table_refs\n valid_table_caps)\n\n\n\nlemma pd_at_global_pd: \"page_directory_at (arm_global_pd (arch_state s)) s\"\n using valid_arch_state by (simp add: valid_arch_state_def)\n\nlemma valid_global_objs_detype[detype_invs_proofs]: \"valid_global_objs (detype (untyped_range cap) s)\"\n using valid_global_objs valid_global_refsD [OF globals cap]\n apply (simp add: valid_global_objs_def valid_vso_at_def arch_state_det)\n apply (elim conjE, intro conjI)\n apply (simp add: global_refs_def cap_range_def arch_state_det)\n apply (erule exEI)\n apply (insert pd_at_global_pd)[1]\n subgoal by (clarsimp simp: obj_at_def a_type_simps empty_table_def arch_state_det)\n apply (simp add: global_refs_def cap_range_def)\n apply (clarsimp elim!: global_pts)\n done\n\nlemma valid_kernel_mappings_detype[detype_invs_proofs]: \"valid_kernel_mappings (detype (untyped_range cap) s)\"\n proof -\n have \"valid_kernel_mappings s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis by (simp add: valid_kernel_mappings_def detype_def\n ball_ran_eq)\n qed\n\nlemma valid_asid_map_detype[detype_invs_proofs]: \"valid_asid_map (detype (untyped_range cap) s)\"\nproof -\n have \"valid_asid_map s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n apply (clarsimp simp: valid_asid_map_def arch_state_det)\n apply (drule bspec)\n apply (blast)\n apply (clarsimp simp: vspace_at_asid_def vs_lookup)\n done\n qed\n\nlemma equal_kernel_mappings_detype[detype_invs_proofs]:\n \"equal_kernel_mappings (detype (untyped_range cap) s)\"\n proof -\n have \"equal_kernel_mappings s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n apply (simp add: equal_kernel_mappings_def)\n apply blast\n done\n qed\n\nlemma valid_global_mappings_detype[detype_invs_proofs]:\n \"valid_global_vspace_mappings (detype (untyped_range cap) s)\"\nproof -\n have \"valid_global_vspace_mappings s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n using valid_global_refsD [OF globals cap] valid_global_objs\n apply -\n apply (erule valid_global_vspace_mappings_pres, simp_all)\n apply (simp add: cap_range_def global_refs_def arch_state_det)+\n done\nqed\n\nlemma pspace_in_kernel_window_detype[detype_invs_proofs]:\n \"pspace_in_kernel_window (detype (untyped_range cap) s)\"\nproof -\n have \"pspace_in_kernel_window s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n apply (simp add: pspace_in_kernel_window_def arch_state_det)\n apply fastforce\n done\nqed\n\nlemma in_user_frame_eq:\n notes [simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n order_class.Icc_eq_Icc\n and [simp] = p2pm1_to_mask\n shows \"p \\ untyped_range cap \\ in_user_frame p\n (trans_state (\\_. detype_ext (untyped_range cap) (exst s)) s\n \\kheap := \\x. if x \\ untyped_range cap then None else kheap s x\\)\n = in_user_frame p s\"\n using cap_is_valid untyped\n apply (cases cap; simp add: in_user_frame_def valid_untyped_def valid_cap_def obj_at_def)\n apply (rule iffI; erule exEI; elim conjE exE; simp)\n subgoal for dev ptr n f sz ko\n apply (elim allE; erule (1) impE)\n apply (drule valid_pspace_aligned[OF valid_pspace])\n apply (clarsimp simp: obj_range_def)\n apply (erule impE)\n apply (erule not_emptyI[rotated])\n apply (rule mask_in_range[THEN iffD1, simplified])\n apply (simp add: is_aligned_neg_mask)\n apply (simp add: mask_lower_twice)\n apply (cut_tac mask_in_range[THEN iffD1, simplified, OF is_aligned_neg_mask[OF le_refl] refl])\n apply fastforce\n done\n done\n\nlemma in_device_frame_eq:\n notes blah[simp del] = atLeastAtMost_iff\n atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n order_class.Icc_eq_Icc\n and p2pm1[simp] = p2pm1_to_mask\n shows \"p \\ untyped_range cap\n \\ in_device_frame p\n (trans_state (\\_. detype_ext (untyped_range cap) (exst s)) s\n \\kheap := \\x. if x \\ untyped_range cap then None else kheap s x\\)\n = in_device_frame p s\"\n using cap_is_valid untyped\n unfolding in_device_frame_def\n apply (cases cap; simp add: in_device_frame_def valid_untyped_def valid_cap_def obj_at_def)\n apply (rule iffI; erule exEI; elim conjE exE; simp)\n subgoal for dev ptr n f sz ko\n apply (elim allE; erule (1) impE)\n apply (drule valid_pspace_aligned[OF valid_pspace])\n apply (clarsimp simp: obj_range_def)\n apply (erule impE)\n apply (erule not_emptyI[rotated])\n apply (rule mask_in_range[THEN iffD1, simplified])\n apply (simp add: is_aligned_neg_mask)\n apply (simp add: mask_lower_twice)\n apply (cut_tac mask_in_range[THEN iffD1, simplified, OF is_aligned_neg_mask[OF le_refl] refl])\n apply fastforce\n done\n done\n\nlemma pspace_respects_device_region_detype[detype_invs_proofs]:\n \"pspace_respects_device_region (clear_um (untyped_range cap) (detype (untyped_range cap) s))\"\n proof -\n have \"pspace_respects_device_region s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n apply (intro pspace_respects_device_regionI)\n using pspace_aligned_detype valid_objs_detype invs\n apply (simp_all add: clear_um.pspace detype_def dom_def clear_um_def\n split: if_split_asm )\n apply (drule pspace_respects_device_regionD[rotated -1],auto)+\n done\n qed\n\nlemma cap_refs_respects_device_region_detype[detype_invs_proofs]:\n \"cap_refs_respects_device_region (clear_um (untyped_range cap) (detype (untyped_range cap) s))\"\n proof -\n have \"cap_refs_respects_device_region s\"\n using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n apply (clarsimp simp: clear_um_def cap_refs_respects_device_region_def\n simp del: split_paired_All split_paired_Ex)\n apply (drule_tac x = \"(a,b)\" in spec)\n apply (clarsimp simp: cte_wp_at_caps_of_state cap_range_respects_device_region_def detype_def)\n done\n qed\n\n\nlemma valid_machine_state_detype[detype_invs_proofs]:\n \"valid_machine_state (clear_um (untyped_range cap) (detype (untyped_range cap) s))\"\n proof -\n have \"valid_machine_state s\" using invs by (simp add: invs_def valid_state_def)\n thus ?thesis\n using untyped cap_is_valid\n by (clarsimp simp: valid_machine_state_def clear_um_def\n detype_def in_user_frame_eq in_device_frame_eq)\n qed\nend\n\nsublocale detype_locale < detype_locale_gen_2\n proof goal_cases\n interpret detype_locale_arch ..\n case 1 show ?case\n by (intro_locales; (unfold_locales; fact detype_invs_proofs)?)\n qed\n\ncontext detype_locale begin\n lemmas invariants = invariants\n lemmas non_filter_detype = non_filter_detype\n lemmas valid_cap = valid_cap\n lemmas non_null_present = non_null_present\nend\n\ninterpretation Detype_AI_2\n using detype_locale.invariants[simplified detype_locale_def]\n Detype_AI_2.intro\n by blast\n\ncontext begin interpretation Arch .\nlemma delete_objects_invs[wp]:\n \"\\(\\s. \\slot. cte_wp_at ((=) (cap.UntypedCap dev ptr bits f)) slot s\n \\ descendants_range (cap.UntypedCap dev ptr bits f) slot s) and\n invs and ct_active\\\n delete_objects ptr bits \\\\_. invs\\\"\n apply (simp add: delete_objects_def)\n apply (simp add: freeMemory_def word_size_def bind_assoc\n empty_fail_mapM_x ef_storeWord)\n apply (rule hoare_pre)\n apply (rule_tac G=\"is_aligned ptr bits \\ word_size_bits \\ bits \\ bits \\ word_bits\"\n in hoare_grab_asm)\n apply (simp add: mapM_storeWord_clear_um[unfolded word_size_def]\n intvl_range_conv[where 'a=machine_word_len, folded word_bits_def])\n apply wp\n apply clarsimp\n apply (frule invs_untyped_children)\n apply (frule detype_invariants, clarsimp+)\n apply (drule invs_valid_objs)\n apply (drule (1) cte_wp_valid_cap)\n apply (simp add: valid_cap_def cap_aligned_def word_size_bits_def untyped_min_bits_def)\n done\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/ARM/ArchDetype_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.30735801686526387, "lm_q1q2_score": 0.15487960125998768}} {"text": "(* Title: HOL/Auth/n_germanSimp_lemma_inv__57_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp_lemma_inv__57_on_rules imports n_germanSimp_lemma_on_inv__57\nbegin\nsection{*All lemmas on causal relation between inv__57*}\nlemma lemma_inv__57_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv3 p__Inv4. p__Inv3\\N\\p__Inv4\\N\\p__Inv3~=p__Inv4\\f=inv__57 p__Inv3 p__Inv4)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\\\n (\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__0 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__0Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE__part__1 N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqE__part__1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__57) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp_lemma_inv__57_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3073580168652638, "lm_q1q2_score": 0.15487960125998762}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchAInvsPre\nimports \"../AInvsPre\"\nbegin\n\ncontext Arch begin\n\nglobal_naming X64\n\ndefinition\n \"kernel_mappings \\ {x. x \\ pptr_base}\"\n\nlemma kernel_mappings_slots_eq:\n \"canonical_address p \\ p \\ kernel_mappings \\ ucast (p >> pml4_shift_bits) \\ kernel_mapping_slots\"\n apply (simp add: kernel_mappings_def kernel_mapping_slots_def word_le_nat_alt\n get_pml4_index_def ucast_mask_drop)\n apply (fold word_le_nat_alt)\n apply (rule iffI)\n apply (simp add: bit_simps pptr_base_def pptrBase_def)\n apply (word_bitwise, simp)\n apply (simp add: pptr_base_def pptrBase_def bit_simps canonical_address_range mask_def)\n apply word_bitwise\n apply simp\n done\n\nlemma valid_global_pml4_mappingsE:\n \"\\valid_global_vspace_mappings s;\n \\pd. \\kheap s (x64_global_pml4 (arch_state s)) =\n Some (ArchObj (PageMapL4 pd));\n \\x. valid_pml4_kernel_mappings (x64_kernel_vspace (arch_state s)) s\n (ArchObj (PageMapL4 pd))\\ \\ R\\ \\ R\"\n apply (clarsimp simp add: valid_global_vspace_mappings_def obj_at_def)\n apply (case_tac ko, simp_all add: valid_pml4_kernel_mappings_def\n split: arch_kernel_obj.splits)\n done\n\nlemma ucast_ucast_mask9: \"(ucast (x && mask 9) :: 9 word) = ucast x\"\n by (rule ucast_mask_drop, simp)\n\n(* NOTE: we could probably add \"is_aligned b (pageBitsForSize sz)\"\n if we assumed \"valid_global_objs s\", additionally. *)\n(* FIXME x64: please god some automation *)\nlemma some_get_page_info_kmapsD:\n \"\\get_page_info (\\obj. get_arch_obj (kheap s obj)) pd_ref p = Some (b, a, attr, r);\n p \\ kernel_mappings; canonical_address p; valid_global_vspace_mappings s; equal_kernel_mappings s\\\n \\ (\\sz. pageBitsForSize sz = a) \\ r = {}\"\n apply (clarsimp simp: get_pdpt_info_def get_pml4_entry_def get_arch_obj_def\n kernel_mappings_slots_eq get_page_info_def get_pdpt_entry_def get_pd_info_def\n get_pd_entry_def get_pt_info_def get_pt_entry_def\n split: option.splits Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule valid_global_pml4_mappingsE)\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def)\n apply (drule_tac x=pd_ref in spec,\n drule_tac x=\"x64_global_pml4 (arch_state s)\" in spec, simp)\n apply (drule bspec, assumption)\n apply (clarsimp simp: valid_pml4_kernel_mappings_def pml4e_mapping_bits_def)\n apply (drule_tac x=\"ucast (p >> pml4_shift_bits)\" in spec)\n apply (clarsimp simp: get_page_info_def get_pml4_entry_def get_arch_obj_def\n get_pdpt_info_def get_pdpt_entry_def get_pd_info_def get_pd_entry_def\n get_pt_info_def get_pt_entry_def bit_simps\n kernel_mappings_slots_eq\n split: option.splits Structures_A.kernel_object.splits\n arch_kernel_obj.splits\n pml4e.splits pdpte.splits pde.splits pte.splits)\n apply (rule conjI, rule_tac x=X64SmallPage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n apply (simp add: valid_pd_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 21))\" in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def)\n apply (simp add: valid_pt_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 12))\" in spec)\n apply (clarsimp simp: valid_pte_kernel_mappings_def)\n apply (rule conjI, rule_tac x=X64LargePage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n apply (simp add: valid_pd_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 21))\" in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def)\n apply (simp add: valid_pt_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (rule conjI, rule_tac x=X64HugePage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n done\n\nlemma get_page_info_gpd_kmaps:\n \"\\valid_global_objs s; valid_arch_state s; canonical_address p;\n get_page_info (\\obj. get_arch_obj (kheap s obj))\n (x64_global_pml4 (arch_state s)) p = Some (b, a, attr, r)\\\n \\ p \\ kernel_mappings\"\n apply (clarsimp simp: valid_global_objs_def valid_arch_state_def\n obj_at_def valid_ao_at_def\n empty_table_def kernel_mappings_slots_eq)\n apply (drule_tac x=\"ucast (p >> pml4_shift_bits)\" in spec; clarsimp)\n apply (rule ccontr)\n apply (clarsimp simp: get_page_info_def get_pml4_entry_def get_arch_obj_def\n bit_simps ucast_ucast_mask9\n split: option.splits pml4e.splits arch_kernel_obj.splits)\n done\n\nlemma get_vspace_of_thread_reachable:\n \"get_vspace_of_thread (kheap s) (arch_state s) t \\ x64_global_pml4 (arch_state s)\n \\ (\\\\ get_vspace_of_thread (kheap s) (arch_state s) t) s\"\n by (auto simp: get_vspace_of_thread_vs_lookup\n split: Structures_A.kernel_object.splits if_split_asm option.splits\n cap.splits arch_cap.splits)\n\nlemma is_aligned_ptrFromPAddrD:\n\"\\is_aligned (ptrFromPAddr b) a; a \\ 30\\ \\ is_aligned b a\"\n apply (clarsimp simp:ptrFromPAddr_def pptrBase_def)\n apply (erule is_aligned_addD2)\n apply (rule is_aligned_weaken[where x = 30])\n apply (simp add:is_aligned_def)\n apply simp\n done\n\nlemma some_get_page_info_umapsD:\n \"\\get_page_info (\\obj. get_arch_obj (kheap s obj)) pml4_ref p = Some (b, a, attr, r);\n (\\\\ pml4_ref) s; p \\ kernel_mappings; valid_vspace_objs s; pspace_aligned s;\n canonical_address p;\n valid_asid_table (x64_asid_table (arch_state s)) s; valid_objs s\\\n \\ \\sz. pageBitsForSize sz = a \\ is_aligned b a \\ data_at sz (ptrFromPAddr b) s\"\n apply (clarsimp simp: get_page_info_def get_pdpt_info_def get_pd_info_def get_pt_info_def\n get_pml4_entry_def get_pdpt_entry_def get_pd_entry_def get_pt_entry_def\n get_arch_obj_def valid_asid_table_def bit_simps\n kernel_mappings_slots_eq\n split: option.splits kernel_object.splits arch_kernel_obj.splits\n pml4e.splits pdpte.splits pde.splits pte.splits)\n apply (all \\drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pml4I],\n simp add: ucast_ucast_mask9, fastforce\\)\n prefer 3 subgoal\n by (rule exI[where x=X64HugePage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n apply (all \\drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pdptI], fastforce\\)\n prefer 2 subgoal\n by (rule exI[where x=X64LargePage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n apply (drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pdI], fastforce)\n by (rule exI[where x=X64SmallPage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n\nlemma user_mem_dom_cong:\n \"kheap s = kheap s' \\ dom (user_mem s) = dom (user_mem s')\"\n by (simp add: user_mem_def in_user_frame_def dom_def obj_at_def)\n\nlemma device_mem_dom_cong:\n \"kheap s = kheap s' \\ dom (device_mem s) = dom (device_mem s')\"\n by (simp add: device_mem_def in_device_frame_def dom_def obj_at_def)\n\nlemma device_frame_in_device_region:\n \"\\in_device_frame p s; pspace_respects_device_region s\\\n \\ device_state (machine_state s) p \\ None\"\n by (auto simp add: pspace_respects_device_region_def dom_def device_mem_def)\n\nglobal_naming Arch\nnamed_theorems AInvsPre_asms\n\nlemma ptable_rights_imp_frame[AInvsPre_asms]:\n assumes \"valid_state s\"\n shows \"ptable_rights t s x \\ {} \\\n ptable_lift t s x = Some (addrFromPPtr y) \\\n in_user_frame y s \\ in_device_frame y s\"\n apply (rule ccontr, frule ptable_lift_Some_canonical_addressD)\n using assms\n apply (clarsimp simp: ptable_lift_def ptable_rights_def\n in_user_frame_def in_device_frame_def\n split: option.splits)\n apply (case_tac \"x \\ kernel_mappings\")\n apply (frule (2) some_get_page_info_kmapsD; fastforce simp: valid_state_def)\n apply (frule some_get_page_info_umapsD)\n apply (rule get_vspace_of_thread_reachable)\n apply clarsimp\n apply (frule get_page_info_gpd_kmaps[rotated 2])\n apply (simp_all add: valid_state_def valid_pspace_def\n valid_arch_state_def)\n apply (clarsimp simp: data_at_def)+\n apply (drule_tac x=sz in spec)+\n apply (rename_tac p_addr attr rghts sz)\n apply (frule is_aligned_add_helper[OF _ and_mask_less', THEN conjunct2, of _ _ x])\n apply (simp only: pbfs_less_wb'[simplified word_bits_def])\n apply (clarsimp simp: data_at_def ptrFromPAddr_def addrFromPPtr_def field_simps)\n apply (subgoal_tac \"p_addr + (pptrBase + (x && mask (pageBitsForSize sz)))\n && ~~ mask (pageBitsForSize sz) = p_addr + pptrBase\")\n apply simp\n apply (subst add.assoc[symmetric])\n apply (subst is_aligned_add_helper)\n apply (erule aligned_add_aligned)\n apply (case_tac sz; simp add: is_aligned_def pptrBase_def bit_simps)\n apply simp\n apply (rule and_mask_less')\n apply (case_tac sz; simp add: bit_simps)\n apply simp\n done\n\nend\n\ninterpretation AInvsPre?: AInvsPre\n proof goal_cases\n interpret Arch .\n case 1 show ?case by (intro_locales; (unfold_locales; fact AInvsPre_asms)?)\n qed\n\nrequalify_facts\n X64.user_mem_dom_cong\n X64.device_mem_dom_cong\n X64.device_frame_in_device_region\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/X64/ArchAInvsPre.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.2909808785120009, "lm_q1q2_score": 0.15457176581904541}} {"text": "theory Balance\n imports \"EvmFacts\" \"../lem/Block\"\nbegin\n\n(*\nlemma balance_env :\n\"instruction_sem v c inst net =\n InstructionToEnvironment act v2 x33 \\\n vctx_balance v2 = vctx_balance v\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma balance_continue :\n\"instruction_sem v c inst net =\n InstructionContinue v2 \\\n vctx_balance v2 = vctx_balance v\"\napply (simp only: instruction_sem_def)\n apply (case_tac inst; clarsimp)\napply (case_tac x1 ; \n clarsimp simp: rw\n split:list.splits)\n apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x4 ; clarsimp simp: instruction_sem_simps split:list.splits)\napply(case_tac \"\\ cctx_hash_filter c ( cut_memory x21 x21a (vctx_memory v))\")\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (clarsimp simp: instruction_sem_simps split:list.splits)\n apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n apply (case_tac x8 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n apply (case_tac x9; clarsimp simp: instruction_sem_simps Let_def split: list.splits pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x2a\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits)\n apply (clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x12\"; clarsimp simp: Let_def instruction_sem_simps split: pc_inst.splits option.splits)\n apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps split: pc_inst.splits option.splits list.splits if_splits)\ndone\n\nlemma balance_continue_next :\n\"next_state stopper c (InstructionContinue v) =\n InstructionContinue v2 \\\n vctx_balance v2 = vctx_balance v\"\napply (simp add:next_state_def)\napply (cases \"\\ check_annotations v c\"; auto)\napply (cases \"vctx_next_instruction v c\"; auto)\napply (case_tac \" check_resources v c (vctx_stack v) a\"; auto)\nusing balance_continue apply simp\ndone\n\nlemma balance_env_next :\n\"next_state stopper c (InstructionContinue v) =\n InstructionToEnvironment args v2 zz \\\n vctx_balance v2 = vctx_balance v\"\napply (simp add:next_state_def)\napply (cases \"\\ check_annotations v c\"; auto)\napply (cases \"vctx_next_instruction v c\"; auto)\napply (case_tac \" check_resources v c (vctx_stack v) a\"; auto)\nusing balance_env apply simp\ndone\n\n\nfun sum_aux :: \"(address \\ w256) \\ nat \\ nat\" where\n\"sum_aux bal 0 = 0\"\n| \"sum_aux bal (Suc n) = unat (bal (word_of_int (int n))) + sum_aux bal n\"\n\ndefinition sum :: \"(address \\ w256) \\ nat\" where\n\"sum bal = sum_aux bal (2^160)\"\n\n\ndefinition total_balance :: \"global0 \\ nat\" where\n\"total_balance g = sum (\\a. account_balance0 (g_current g a))\"\ndefinition total_balance_nat :: \"(address \\ account) \\ nat\" where\n\"total_balance_nat g = sum (\\a. account_balance0 (g a))\"\n\ndefinition total_balance :: \"(address \\ account) \\ int\" where\n\"total_balance g = int (sum (\\a. account_balance0 (g a)))\"\n*)\n\ndefinition abal :: \"(address \\ account) \\ nat \\ int\" where\n\"abal st = (\\i. uint (account_balance0 (st (word_of_int (int i)))))\"\n\ndefinition total_balance :: \"(address \\ account) \\ int\" where\n\"total_balance g = sum (abal g) {0..2^160-1}\"\n(*\n (\\i::nat=0..2^160-1.\n uint (account_balance0 (g (word_of_int (int i)))))\"\n*)\nlemma balance_same1 :\n\"account_balance0\n (if a = cctx_this (g_cctx st1)\n then g_current st1\n (cctx_this (g_cctx st1))\n \\account_storage0 :=\n vctx_storage v\\\n else g_current st1 a) =\n account_balance0 (g_current st1 a)\"\nby auto\n\nlemma balance_same2 :\n\"account_balance0\n (if a = addr\n then st1 addr\n \\account_storage0 :=\n vctx_storage v\\\n else st1 a) =\n account_balance0 (st1 a)\"\nby auto\n\nlemma total_balance_update_return :\n\"total_balance (update_return acc addr v) = total_balance acc\"\napply (simp add: total_balance_def abal_def\n update_return_def update_world_def\n balance_same2)\ndone\n\nlemma update_if :\n \"(if a = b then c else update_world acc b nb a) =\n (if a = b then c else acc a)\"\napply (auto simp add: update_world_def)\ndone\n\n(*\nlemma balance_if :\n\"account_balance0 (if a = addr\n then x\n else y) =\n (if a = addr then account_balance0 x else account_balance0 y)\"\n*)\nlemma account_balance_double :\n \"x\\account_balance0 := a, account_balance0 := b \\ =\n x\\account_balance0 := b \\\"\napply (auto)\ndone\n\nfun balance_list_aux :: \"(address \\ w256) \\ nat \\ w256 list\" where\n\"balance_list_aux bal 0 = []\"\n| \"balance_list_aux bal (Suc n) =\n bal (word_of_int (int n)) # balance_list_aux bal n\"\n\ndefinition balance_list :: \"(address \\ w256) \\ w256 list\" where\n\"balance_list bal = balance_list_aux bal (2^160)\"\n\nlemma balance_list_eq_aux :\n \"x < n \\\n balance_list_aux bal n ! x = bal (word_of_int (int (n-x-1)))\"\napply (induction n arbitrary:x rule:balance_list_aux.induct)\napply (auto)\napply (case_tac \"x=n\")\napply auto\noops\n\nlemma sum_one :\n \"(\\i::nat=l..l. f i) = (f l)\"\n by simp\n\nlemma sum_zero :\n \"(\\i::nat=l+1..l. f i) = 0\"\n by simp\n\nlemma sum_ub_add_nat: assumes \"(m::nat) \\ n\"\n shows \"sum f {m..n + p} = sum f {m..n} + sum f {n + 1..n + p}\"\nproof-\n have \"{m .. n+p} = {m..n} \\ {n+1..n+p}\" using \\m \\ n\\ by auto\n thus ?thesis by (auto simp: ivl_disj_int sum.union_disjoint\n atLeastSucAtMost_greaterThanAtMost)\nqed\n\nlemma sum_ub_add_nat2: assumes \"(m::nat) \\ n\"\n shows \"sum f {m..n + p} = sum f {m.. {n..n+p}\" using \\m \\ n\\ by auto\n thus ?thesis by (auto simp: ivl_disj_int sum.union_disjoint\n atLeastSucAtMost_greaterThanAtMost)\nqed\n\nlemma sum_split :\n \"l \\ k \\ k \\ n \\\n (\\i::nat=l..n. f i) =\n (\\i::nat=l..k. f i) + (\\i::nat=k+1..n. f i)\"\napply (simp)\nusing sum_ub_add_nat [of l k f \"n-k\"]\napply force\ndone\n\nlemma sum_split2 :\n \"l \\ k \\ k \\ n \\\n (\\i::nat=l..n. f i) =\n (\\i::nat=l..i::nat=k..n. f i)\"\nusing sum_ub_add_nat2 [of l k f \"n-k\"]\napply force\ndone\n\nlemma sum_if :\n assumes a:\"k \\ n\"\n shows \n \"(\\i::nat=0..n. (if i = k then (x::int) else f i)) =\n (\\i=0..i=k+1..n. f i)\"\nproof -\n have b1: \"sum f {0..i=0..i=k+1..n. (if i = k then x else f i))\"\n by auto\n have b3: \"x = (\\i. if i = k then (x::int) else f i) k\" by auto\n then have \"sum f {0..i=0..k. (if i = k then x else f i))\"\n using b1 sum_split2 [of 0 k k \"%i. (if i = k then x else f i)\"]\n by force\n then show ?thesis using b2\n by (metis (no_types, lifting) assms le_add2 le_add_same_cancel2 sum_split) \nqed\n\nlemma sum_single :\n assumes a:\"k \\ n\"\n shows \n \"(\\i::nat=0..n. (if i = k then (x::int) else 0)) = x\"\nusing a sum_if [of k n x \"%i. 0\"] by auto\n\nlemma sum_update :\n assumes a:\"k \\ n\"\n shows \n \"(\\i::nat=0..n. (if i = k then (x::int) else f i)) =\n (\\i=0..n. f i) + x - f k\"\nproof -\n have b1:\n \"(\\i::nat=0..n. (if i = k then (x::int) else f i)) =\n sum f {0..\n (word_of_int (int i) = addr) = (i = unat (addr::address))\"\napply auto\napply (metis uint_nat word_of_int_uint)\ndone\n\nlemma sum_eq_small :\n \"(\\i\\n. f i = g i) \\\n sum f {0..n} = sum g {0..n}\"\n by auto\n\nlemma massage :\n\"uint (account_balance0 (st addr)) =\n uint (account_balance0 (st (word_of_int (int (unat addr)))))\"\nby (metis uint_nat word_of_int_uint)\n\nlemma addr_small : \"unat (addr::address) \\ 2^160-1\"\napply (subst word_unat)\napply auto\ndone\n\nlemma total_balance_update_world :\n\"total_balance (update_world st addr acc) = \n total_balance st + uint (account_balance0 acc) -\n uint (account_balance0 (st addr))\"\napply (auto simp add:update_world_def total_balance_def abal_def\n if_distrib)\napply (subst sum_eq_small [of _ _\n \"%i. if i = unat addr\n then uint (account_balance0 acc)\n else uint\n (account_balance0\n (st (word_of_int (int i))))\"])\napply (auto simp:test_eq)\napply (subst massage[of st addr])\napply (rule sum_update [of \"unat addr\" _\n \"uint (account_balance0 acc)\"\n \"%i. uint (account_balance0 (st (word_of_int (int i))))\"])\nusing addr_small\nby force\n\nlemma test : \"(a::address) \\ 0\"\napply auto\ndone\n\nlemma uint_sub : \"b \\ a \\ uint (a-b) = uint a - uint b\"\n by (simp add: uint_minus_simple_alt)\n\nlemma uint_add :\n \"a+b \\ a \\\n uint (a+b) = uint a + uint b\"\nby (auto simp:uint_plus_simple)\n\nlemma solution :\n \"d \\ a \\ r+d \\ r \\\n uint (a - d) + (uint (r + d) - uint r - uint a) = 0\"\napply (simp add:uint_add uint_sub)\ndone\n\nlemma total_balance_update :\n\"v \\ account_balance0 (acc addr) \\\n account_balance0 (acc recv) \\\n account_balance0 (acc recv) + v \\\n total_balance (transfer_balance acc addr recv v) = \n total_balance acc\"\napply (cases \"addr = recv\")\nsubgoal\napply (auto simp add: total_balance_def\n update_return_def update_world_def update_call_def\n transfer_balance_def add_balance_def sub_balance_def Let_def\n balance_same2 update_if if_distrib abal_def)\napply metis\ndone\napply (auto simp add:\n update_return_def update_world_def update_call_def\n transfer_balance_def Let_def\n balance_same2 update_if if_distrib add_balance_def sub_balance_def \n total_balance_update_world)\napply (rule solution)\napply auto\ndone\n\nlemma total_balance_update_call :\n\"callarg_value args \\ account_balance0 (acc addr) \\\n account_balance0 (acc (callarg_recipient args)) \\\n account_balance0 (acc (callarg_recipient args)) +\n callarg_value args \\\n total_balance (update_call acc addr args) = \n total_balance acc\"\n by (simp add: total_balance_update update_call_def)\n\nlemma total_balance_update_call2 :\n\"addr = callarg_recipient args \\\n total_balance (update_call acc addr args) = total_balance acc\"\napply (auto simp add: total_balance_def\n update_return_def update_world_def update_call_def\n transfer_balance_def add_balance_def sub_balance_def Let_def\n balance_same2 update_if if_distrib abal_def)\napply metis\ndone\n\nlemma total_balance_update_same :\n\"total_balance (transfer_balance acc addr addr v) = \n total_balance acc\"\napply (auto simp add: total_balance_def\n update_return_def update_world_def update_call_def\n transfer_balance_def add_balance_def sub_balance_def Let_def\n balance_same2 update_if if_distrib abal_def)\napply metis\ndone\n\nlemma sum_split_one :\n \"l \\ k \\ k \\ n \\\n (\\i::nat=l..n. f i) =\n (\\i::nat=l..i::nat=k+1..n. f i)\"\n by (metis add.commute sum_last_plus sum_split)\n\nlemma abal_eq :\n \"uint (account_balance0 (st a)) = abal st (unat a)\"\napply (auto simp add:abal_def)\n by (metis word_unat)\n\nlemma balance_split :\n\"k \\ unat a \\ unat a \\ n \\\n sum (abal st) {k..n} =\n sum (abal st) {k..< unat a} +\n uint (account_balance0 (st a)) +\n sum (abal st) {unat a+1..n}\"\napply (simp add:abal_eq)\nusing sum_split_one [of k \"unat a\" n \"abal st\"]\napply simp\ndone\n\nlemma abal_nonneg : \"abal st k \\ 0\"\n by (simp add: abal_def)\n\nlemma abal_sum_nonneg : \"sum (abal st) {a..b} \\ 0\"\n by (simp add: abal_nonneg sum_nonneg)\n\nlemma overflow_one :\nassumes a1:\"total_balance st < 2^256\"\nshows\n \"uint (account_balance0 (st a)) < 2^256\"\nproof -\n have \"total_balance st = sum (abal st) {0..2 ^ 160 - 1}\"\n by (simp add:total_balance_def) \n then have aux:\"total_balance st =\n sum (abal st) {0..< unat a} +\n uint (account_balance0 (st a)) +\n sum (abal st) {unat a+1..2^160-1}\"\n using balance_split [of 0 a \"2^160-1\" st]\n by (metis addr_small total_balance_def zero_le)\n have bsmall: \"unat a \\ 2 ^ 160 - 1\" by (metis addr_small)\n then show ?thesis using a1 aux abal_sum_nonneg\n by (smt abal_nonneg sum_nonneg) \nqed\n\nlemma overflow_pair :\nassumes a1:\"total_balance st < 2^256\"\nand a2:\"a < b\"\nshows\n \"uint (account_balance0 (st a)) +\n uint (account_balance0 (st b)) < 2^256\"\nproof -\n have \"total_balance st = sum (abal st) {0..2 ^ 160 - 1}\"\n by (simp add:total_balance_def) \n then have aux:\"total_balance st =\n sum (abal st) {0..< unat a} +\n uint (account_balance0 (st a)) +\n sum (abal st) {unat a+1..2^160-1}\"\n using balance_split [of 0 a \"2^160-1\" st]\n by (metis addr_small total_balance_def zero_le)\n have bsmall: \"unat b \\ 2 ^ 160 - 1\" by (metis addr_small)\n from a2 have \"unat a + 1 \\ unat b\"\n by (metis Suc_eq_plus1 Suc_leI not_less word_le_nat_alt) \n then have \"sum (abal st) {unat a+1..2^160-1} =\n sum (abal st) {unat a+1..< unat b} +\n uint (account_balance0 (st b)) +\n sum (abal st) {unat b+1..2^160-1}\"\n using bsmall balance_split [of \"unat a + 1\" b \"2^160-1\" st] by force\n then have a:\"total_balance st =\n sum (abal st) {0..< unat a} +\n uint (account_balance0 (st a)) +\n sum (abal st) {unat a+1..< unat b} +\n uint (account_balance0 (st b)) +\n sum (abal st) {unat b+1..2^160-1}\"\n using aux by force\n then show ?thesis using a1 abal_sum_nonneg\n by (smt abal_nonneg sum_nonneg) \nqed\n\nlemma find_mod :\n \"uint (word_of_int x::w256) = (x::int) mod 2^256\"\napply (auto simp:uint_word_of_int)\ndone\n\nlemma uint_back : \"uint (x::w256) = uint (word_of_int (uint x) :: w256)\"\nusing word_of_int_uint [of x] by force\n\nlemma overflow_plus :\n assumes a:\"uint (a::w256) + uint b < 2^256\"\n shows \"uint (a + b) = uint a + uint b\"\nproof -\n have \"uint (a + b) mod 2 ^ 256 = uint a + uint b\"\n using a\n by (simp add: find_mod int_mod_eq' word_add_def)\n then show ?thesis using a\n by (metis find_mod word_of_int_uint)\nqed\n\nlemma overflow_small :\n \"uint (a::w256) + uint b < 2^256 \\\n a \\ a + b\"\nusing overflow_plus [of a b] uint_plus_simple_iff by blast\n\nlemma overflow :\n\"total_balance st < 2^256 \\\n x \\ account_balance0 (st sender) \\\n sender \\ r \\\n account_balance0 (st r) \\\n account_balance0 (st r) + x\"\napply (cases \"r < sender\")\napply (rule overflow_small [of \"account_balance0 (st r)\" x])\nusing overflow_pair [of st r sender]\n apply (simp add: word_le_def)\napply (cases \"sender < r\")\napply (rule overflow_small [of \"account_balance0 (st r)\" x])\nusing overflow_pair [of st sender r]\n apply (simp add: word_le_def)\napply auto\ndone\n\nlemma account_balance_return :\n\"account_balance0 (update_return st1 addr v r) =\n account_balance0 (st1 r)\"\nby (simp add:update_return_def update_world_def)\n\ndefinition states :: \"global0 \\ world_state list\" where\n\"states g = (g_current g#map (%e. let (x,_,_,_) = e in x) (g_stack g))\"\n\n(* sorted lists *)\ndefinition balance_inv :: \"global0 \\ bool\" where\n\"balance_inv g ==\n sorted (map total_balance (states g)) \\\n total_balance (last (states g)) \\ total_balance (g_orig g)\"\n\nlemma tr_orig :\n \"next0 net (Continue st1) = Continue st2 \\\n g_orig st1 = g_orig st2\"\nby (auto simp add:next0_def Let_def\n split:if_split_asm option.split_asm list.split_asm\n contract_action.split_asm stack_hint.split_asm\n instruction_result.splits)\n\nlemma inv_depend :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n g_current st1 = g_current st2 \\\n g_stack st1 = g_stack st2 \\\n balance_inv st2\"\nby (simp add: balance_inv_def states_def)\n\nlemma inv_current :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n total_balance (g_current st1) \\ total_balance (g_current st2) \\\n g_stack st1 = g_stack st2 \\\n balance_inv st2\"\napply (auto simp add: balance_inv_def states_def)\n by (smt sorted_Cons)\n\nlemma sorted_pop : \"sorted (a#lst) \\ sorted lst\"\n by (simp add: sorted_Cons)\n\nlemma sorted_dup : \"sorted (a#lst) \\ sorted (a#a#lst)\"\n by simp\n\n\nlemma inv_pop_states :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n states st1 = a # states st2 \\\n balance_inv st2\"\napply (auto simp add: balance_inv_def)\nusing sorted_pop\napply force\n by (simp add: states_def)\n\nlemma inv_pop :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n (g_current st2,e1,e2,e3) # g_stack st2 = g_stack st1 \\\n balance_inv st2\"\napply (rule inv_pop_states [of st1 st2 \"g_current st1\"])\napply (auto simp add:states_def)\n by (metis (mono_tags, lifting) case_prod_conv list.simps(9))\n\nlemma states_not_nil : \"states st = [] \\ False\"\n by (simp add: states_def)\n\nlemma inv_dup_states :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n states st2 = hd (states st1) # states st1 \\\n balance_inv st2\"\napply (auto simp add: balance_inv_def)\nusing states_not_nil apply force\nusing sorted_dup\n by (metis hd_Cons_tl hd_map sorted_single)\n\nlemma inv_dup :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n g_current st1 = g_current st2 \\\n (g_current st1,e1,e2,e3) # g_stack st1 = g_stack st2 \\\n balance_inv st2\"\napply (rule inv_dup_states [of st1 st2])\napply (auto simp add:states_def)\n by (metis (mono_tags, lifting) case_prod_conv list.simps(9))\n\nlemma inv_return :\n \"balance_inv st \\\n balance_inv (st\\g_current := update_return (g_current st) addr v\\)\"\nusing inv_current\n by (simp add: total_balance_update_return)\n\n(* push state *)\nlemma inv_push :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n total_balance (g_current st2) \\ total_balance (g_current st1) \\\n (g_current st1,e1,e2,e3) # g_stack st1 = g_stack st2 \\\n balance_inv st2\"\nusing inv_current [of \"st2\\ g_current := g_current st1\\\" st2]\n and inv_dup by force\n\nlemma inv_discard_aux :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n total_balance (g_current st2) \\ total_balance (g_current st1) \\\n total_balance (g_current st1) \\ total_balance disc \\\n (disc,e1,e2,e3) # g_stack st2 = g_stack st1 \\\n balance_inv st2\"\nusing inv_current [of \"st2\\ g_current := disc\\\" st2]\n inv_pop [of st1 \"st2\\ g_current := disc\\\" e1 e2 e3]\n by force\n\nlemma tb_update_nonce :\n \"total_balance (update_nonce st x) = total_balance st\"\nby (auto simp add:update_nonce_def Let_def\n total_balance_update_world)\n\nlemma tb_create_account :\n \"total_balance (create_account st x y) = total_balance st\"\nby (auto simp add:create_account_def Let_def\n total_balance_update_world set_account_code_def)\n\nlemma inv_stack_same :\n \"balance_inv st \\\n total_balance a = total_balance b \\\n g_stack st = (a,x,y,z)#rest \\\n balance_inv (st\\ g_stack := (b,x2,y2,z2) # rest \\)\"\nby (auto simp add:balance_inv_def states_def)\n\nlemma inv_stack_same2 :\n \"balance_inv st \\\n total_balance a = total_balance b \\\n g_stack st = (a,x,y,z)#rest \\\n g_stack st2 = (b,x2,y2,z2) # rest \\\n g_current st2 = g_current st \\\n g_orig st2 = g_orig st \\\n balance_inv st2\"\nby (auto simp add:balance_inv_def states_def)\n\nlemma account_balance_nonce :\n\"account_balance0 (update_nonce st1 v r) =\n account_balance0 (st1 r)\"\nby (simp add:update_nonce_def update_world_def Let_def)\n\nlemma account_balance_same :\n\"account_balance0 acc = account_balance0 (st1 v) \\ \n account_balance0 (update_world st1 v acc r) =\n account_balance0 (st1 r)\"\nby (simp add:update_nonce_def update_world_def Let_def)\n\nlemma sort_out_create :\n \"total_balance (g_current st1) < 2^256 \\\n balance_inv st1 \\\n g_stack st2 = (b,x2,y2,z2)#g_stack st1 \\\n g_orig st1 = g_orig st2 \\\n b = update_nonce (g_current st1) sender \\\n account_balance0 new_acc =\n account_balance0 (g_current st1 new_addr) \\\n account_balance0 (g_current st1 sender) \\ v \\\n g_current st2 =\n transfer_balance\n (update_world\n (update_return\n (update_nonce (g_current st1) sender)\n sender vc) new_addr new_acc)\n sender new_addr v \\\n balance_inv st2\"\napply (rule inv_stack_same2 [of \"st2\\ g_stack :=\n (g_current st1, x2, y2, z2) # g_stack st1\\\" \"g_current st1\"\n \"update_nonce (g_current st1) sender\" x2 y2 z2\n \"g_stack st1\" st2])\napply (auto simp:tb_update_nonce)\napply (rule inv_push)\napply auto\napply (cases \"new_addr = sender\")\napply simp\napply (subst total_balance_update_same)\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce)\n(* new_addr \\ sender *)\napply (subst total_balance_update)\napply (auto simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\nusing overflow apply force\ndone\n\nlemma inv_depend_suicide :\n\"balance_inv\n (st1\\g_stack := rest,\n g_current := cur\\) \\\n balance_inv\n (st1\\g_stack := rest,\n g_current := cur,\n g_cctx := ctx,\n g_vmstate := vmstate,\n g_killed := killed \\)\"\nusing inv_depend\napply force\ndone\n\nlemma inv_depend_normal :\n\"balance_inv\n (st1\\g_stack := rest,\n g_current := cur\\) \\\n balance_inv\n (st1\\g_stack := rest,\n g_current := cur,\n g_cctx := ctx,\n g_vmstate := vmstate \\)\"\nusing inv_depend\napply force\ndone\n\nlemma inv_head :\n \"balance_inv st1 \\\n g_stack st1 = (a, aa, aaa, b) # list \\\n total_balance (g_current st1) \\ total_balance a\"\nby (auto simp add:balance_inv_def states_def)\n\nlemma inv_discard :\n \"balance_inv st1 \\\n g_orig st1 = g_orig st2 \\\n total_balance (g_current st2) \\ total_balance (g_current st1) \\\n (disc,e1,e2,e3) # g_stack st2 = g_stack st1 \\\n balance_inv st2\"\nusing inv_discard_aux [of st1 st2 disc e1 e2 e3]\n inv_head [of st1 disc e1 e2 e3 \"g_stack st2\"] by force\n\nlemma sorted_first_last :\n \"sorted (a#lst) \\\n a \\ last (a#lst)\"\n by (simp add: sorted_Cons)\n\nlemma inv_orig_current :\n \"balance_inv st \\\n total_balance (g_current st) \\ total_balance (g_orig st)\"\napply (simp add: balance_inv_def states_def)\nusing sorted_first_last [of \"total_balance (g_current st)\"\n \"map (total_balance \\ (\\(x, u1, u2, u3). x))\n (g_stack st)\"]\n by (smt List.map.compositionality last.simps last_map map_is_Nil_conv)\n\nlemma compare_uint : \"x \\ y \\ x - uint b \\ y\"\n using diff_mono by fastforce\n\nlemma tr_balance_finished :\n \"next0 net (Continue st1) = Finished st2 \\\n total_balance (g_current st1) < 2^256 \\\n balance_inv st1 \\\n total_balance (f_state st2) \\ total_balance (g_orig st1)\"\napply (simp add:next0_def Let_def)\napply (cases \"g_vmstate st1\"; auto simp add:Let_def)\napply (case_tac \"x21\"; auto simp add:Let_def split:if_splits)\napply (case_tac \"g_stack st1\"; auto simp add:Let_def)\napply (case_tac \"g_stack st1\"; auto simp add:Let_def)\nsubgoal for x32 x33 dst\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\nusing inv_orig_current [of st1] compare_uint apply force\n\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\ninv_orig_current [of st1] compare_uint\napply (simp add: uint_plus_simple_iff)\ndone\napply (case_tac \"list = [] \\ g_create st1\"; auto)\napply (case_tac b; auto)\nsubgoal for x32 x33 dst a aa ab\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\n\nusing inv_orig_current [of st1] compare_uint apply force\n\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\ninv_orig_current [of st1] compare_uint\napply (simp add: uint_plus_simple_iff)\ndone\nsubgoal for x32 x33 dst a aa ab\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\n\nusing inv_orig_current [of st1] compare_uint apply force\n\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\ninv_orig_current [of st1] compare_uint\napply (simp add: uint_plus_simple_iff)\ndone\nsubgoal for x32 x33 dst a aa ab\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\n\nusing inv_orig_current [of st1] compare_uint apply force\n\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\ninv_orig_current [of st1] compare_uint\napply (simp add: uint_plus_simple_iff)\ndone\napply (case_tac \"g_stack st1\"; auto)\n apply (simp add: inv_orig_current total_balance_update_return)\napply (case_tac b; auto)\napply (case_tac \"x6 = [] \\ list = [] \\ g_create st1\"; simp)\n apply (auto simp add: inv_orig_current total_balance_update_return)[1]\napply (case_tac \"vctx_gas x22 < 200 * int (length x6) \\\n homestead_block\n \\ sint (block_number (vctx_block x22))\"; simp)\napply (case_tac \"vctx_gas x22 < 200 * int (length x6)\"; auto)\ndone\n\nlemma tr_balance_continue :\n \"next0 net (Continue st1) = Continue st2 \\\n total_balance (g_current st1) < 2^256 \\\n balance_inv st1 \\\n balance_inv st2\"\napply (simp add:next0_def Let_def)\napply (cases \"g_vmstate st1\"; auto)\nusing inv_depend apply force\nsubgoal for act v zz\napply (cases act; auto simp add:Let_def)\napply (case_tac \"callarg_recipient x1 \n 1023 < length (g_stack st1)\";auto)\napply (rule inv_depend[of \"st1\n \\g_current := update_return (g_current st1)\n (cctx_this (g_cctx st1)) v \\\"])\napply (auto)\nusing inv_return apply force\napply (rule inv_depend[of \"st1\n \\g_current := update_return (g_current st1)\n (cctx_this (g_cctx st1)) v \\\"])\napply (auto)\nusing inv_return apply force\napply (simp add:Let_def)\napply(rule inv_push [of st1 st2])\napply auto\n\nsubgoal for args\napply (cases \"cctx_this (g_cctx st1) = callarg_recipient args\")\n\napply (subst total_balance_update_call2)\napply (auto simp:total_balance_update_return\n account_balance_return)\napply (subst total_balance_update_call)\napply (auto simp:total_balance_update_return\n account_balance_return)\napply (rule overflow [of \"g_current st1\" \"callarg_value args\"\n \"cctx_this (g_cctx st1)\" \"callarg_recipient args\"])\napply auto\ndone\n(* delegate call *)\nsubgoal for args\napply (cases \"1023 < length (g_stack st1)\";auto)\napply (rule inv_depend [of \"st1\\ g_current :=\n update_return (g_current st1)\n (cctx_this (g_cctx st1)) v\\\" _])\napply auto\nusing inv_depend [of \"st2\\ g_current :=\n update_return (g_current st1)\n (cctx_this (g_cctx st1)) v\\\" st2]\nusing inv_return apply force\napply(rule inv_push [of st1 _])\napply (auto simp:total_balance_update_return)\ndone\n(* contract creation *)\nsubgoal for args\napply (split if_splits)\nusing inv_depend apply force\napply (simp add:Let_def)\napply (rule sort_out_create [of st1 st2 _ _ _ _ _\n\"(empty_account0\n _\n \\account_balance0 := _,\n account_exists := True\\)\"\n\"calc_address _ _\"\n \"createarg_value args\"])\napply (auto simp add:account_balance_return\naccount_balance_nonce)\ndone\nsubgoal for failure\napply (cases \"g_stack st1\"; auto)\nsubgoal for a aa ab b list\napply (rule inv_depend [of \"st1\\g_stack := list, g_current := a\\\"])\napply auto\nusing inv_pop\napply force\ndone done\n(* suicide *)\napply (cases \"g_stack st1\"; auto)\nsubgoal for dst a aa aaa b list\napply (auto simp add:Let_def)\napply (cases \"list = [] \\ g_create st1\";simp)\napply clarsimp\napply (rule inv_depend_suicide)\napply (rule inv_discard[of st1 _ a])\napply clarsimp\napply clarsimp\napply clarsimp\napply (cases b)\napply clarsimp\nsubgoal\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\napply (simp add: uint_plus_simple_iff)\ndone\nsubgoal\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\napply (simp add: uint_plus_simple_iff)\ndone\nsubgoal\napply (simp add:total_balance_update_world\naccount_balance_return\n tb_create_account\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same)\napply (cases \"dst = cctx_this (g_cctx st1)\")\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n tb_create_account\n account_balance_same update_world_def)\napply (simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\nusing overflow [of \"g_current st1\"\n \"account_balance0\n (g_current st1 (cctx_this (g_cctx st1)))\"\n \"cctx_this (g_cctx st1)\" dst]\napply (simp add: uint_plus_simple_iff)\ndone\napply force\ndone\napply (cases \"g_stack st1\"; auto)\napply (case_tac b; auto)\nsubgoal for x6 saved_state aa ab list x2\napply (cases \"x6 = [] \\ list = [] \\ g_create st1\"; simp)\napply (cases \"vctx_gas v < 200 * int (length x6) \\\n homestead_block\n \\ sint (block_number (vctx_block v))\"; simp)\napply clarsimp\nusing inv_pop apply force\napply (cases \"vctx_gas v < 200 * int (length x6)\"; clarsimp)\napply (rule inv_depend_normal)\nsubgoal\napply(rule inv_discard[of st1 _ saved_state])\napply (auto simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def)\ndone\napply (rule inv_depend_normal)\napply(rule inv_discard[of st1 _ saved_state])\napply (auto simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def\n tb_create_account)\ndone\nsubgoal for x6 saved_state aa ab list x31 x32\napply (rule inv_depend_normal)\napply(rule inv_discard[of st1 _ saved_state])\napply (auto simp add:total_balance_update_world\naccount_balance_return\n total_balance_update_return\n tb_update_nonce account_balance_nonce\n account_balance_same update_world_def\n tb_create_account)\ndone\ndone\ndone\n\nlemma uint_fact :\n \"x \\ x+y \\\n uint (x+y) - uint x- uint y = 0\"\n by (simp add: uint_plus_simple_iff)\n\nlemma prepare_create_aux :\n\"g_orig st = state \\\n g_stack st = [] \\\n account_balance0 (state sender) \\ gas_value \\\n g_current st =\n update_world state sender\n (state sender\n \\account_balance0 :=\n account_balance0 (state sender) -\n gas_value\\) \\\n balance_inv st\"\napply (simp add: balance_inv_def states_def\n total_balance_update_world)\n using word_le_def word_sub_le by auto\n\nlemma uint_minus : \"x \\ y \\ uint (y - x) \\ uint y\"\n using word_le_def word_sub_le by auto\n\n\nlemma uint_mul_small :\n \"uint (a::w256) * uint b < 2^256 \\\n uint (a*b) = uint a * uint b\"\n by (simp add: mod_pos_pos_trivial uint_word_ariths(3))\n\nlemma uint_mul_compare :\n \"uint (a::w256) * uint b \\ uint c \\\n a*b \\ c\"\nusing uint_mul_small [of a b]\nproof -\n assume a1: \"uint a * uint b \\ uint c\"\n then have \"\\i. \\ uint (word_of_int i::256 word) < uint a * uint b\"\n by (metis (no_types) not_le word_of_int_uint)\n then have \"\\ 2 ^ 256 \\ uint a * uint b\"\n by (metis (no_types) Divides.pos_mod_bound find_mod not_le order_trans zless2p)\n then have \"uint a * uint b < 2 ^ 256\"\n by (metis not_le)\n then show ?thesis\n using a1 by (metis (no_types) \\uint a * uint b < 2 ^ 256 \\ uint (a * b) = uint a * uint b\\ word_le_def)\nqed\n\nlemma unat_mul_compare :\n \"unat (a::w256) * unat b \\ unat c \\\n a*b \\ c\"\nusing uint_mul_compare [of a b c]\n le_unat_uoi word_le_nat_alt by fastforce\n\n\nlemma gas_compare :\n \"unat x + unat (a::w256) * unat b \\ unat c \\\n a*b \\ c\"\nusing unat_mul_compare [of a b c]\n le_add2 order_trans by blast\n\nlemma uint_stuff_aux :\n\"value \\ sender \\\n recv \\ recv + value \\\n uint (sender - value) +\n(uint (recv + value) - uint recv) \\ uint sender\"\n using solution by fastforce\n\nlemma uint_stuff :\n\"value \\ sender - gas_value \\\n value \\ sender \\\n recv \\ recv + value \\\n uint (sender - gas_value - value) +\n(uint (recv + value) - uint recv) \\ uint (sender - gas_value)\"\napply (rule uint_stuff_aux [of \"value\" \"sender-gas_value\" recv], auto)\ndone\n\nlemma prepare_normal_aux :\n\"g_orig st = update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value \\) \\\n g_stack st = [] \\\n value \\ account_balance0 (state sender) - gas_value \\\n value \\ account_balance0 (state sender) \\\n account_balance0 (state recv) \\ account_balance0 (state recv) + value \\\n g_current st = update_world\n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value - value\\)) recv \n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value -\n value\\)\n recv\n \\account_balance0 :=\n account_balance0\n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value -\n value\\)\n recv) +\n value\\)\n \\ balance_inv st\"\napply (simp add: balance_inv_def states_def\n total_balance_update_world)\napply (cases \"sender = recv\")\napply (simp add: balance_inv_def states_def\n total_balance_update_world update_world_def)\napply (simp add: balance_inv_def states_def\n total_balance_update_world update_world_def)\nusing uint_stuff [of \"value\" \"account_balance0 (state sender)\"\n gas_value \"account_balance0 (state recv)\"]\n apply force\ndone\n\nlemma prepare_normal_same :\n\"g_orig st = update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value \\) \\\n g_stack st = [] \\\n g_current st = update_world\n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value - value\\)) sender\n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value -\n value\\)\n sender\n \\account_balance0 :=\n account_balance0\n (update_world state sender\n (state sender\n \\account_nonce := nonce,\n account_balance0 :=\n account_balance0 (state sender) -\n gas_value -\n value\\)\n sender) +\n value\\)\n \\ balance_inv st\"\napply (simp add: balance_inv_def states_def\n total_balance_update_world update_world_def)\ndone\n\nlemma prepare_create_aux2 :\n\"g_orig st = g_current st \\\n g_stack st = [] \\\n balance_inv st\"\nby (simp add: balance_inv_def states_def\n total_balance_update_world)\n\nlemma prepare_balance :\n \"start_transaction tr state block = Continue st \\\n total_balance state < 2^256 \\\n balance_inv st\"\napply (simp add:start_transaction_def Let_def\n split:option.split_asm if_split_asm)\napply (rule prepare_create_aux2, auto)\nsubgoal for recv\napply (cases \"tr_from tr \\ recv\")\napply (rule prepare_normal_aux, auto)\n using linorder_not_less word_less_nat_alt apply auto[1]\napply (simp add: word_le_nat_alt)\nusing overflow [of state \"tr_value tr\" \"tr_from tr\" recv]\n word_le_nat_alt\napply force\napply (rule prepare_normal_same, auto)\ndone\ndone\n\nlemma again2 :\n \"uint (sender::w256) \\ uint price * uint limit \\\n uint (sender - price * limit) =\n uint sender - (uint price * uint limit)\"\n by (metis (no_types, hide_lams) int_mod_eq' le_less_trans uint_lt uint_mul_compare uint_mult_ge0 uint_sub uint_word_ariths(3))\n\n(*\nlemma again_step1 :\n \"unat (sender::w256) \\ x + unat price * unat limit \\\n unat (sender::w256) \\ unat price * unat limit\"\n*)\n\nlemma again_step2 :\n \"a \\ 0 \\ b \\ 0 \\ c \\ 0 \\\n nat a \\ nat b * nat c \\\n a \\ b * c\"\n by (simp add: le_nat_iff)\n\n\nlemma again_step3 :\n \"unat (sender::w256) \\ unat (price::w256) * unat (limit::w256) \\\n uint sender \\ uint price * uint limit\"\n by (simp add: unat_def le_nat_iff)\n\nlemma again :\n \"unat (sender::w256) \\ x + unat price * unat limit \\\n uint (sender - price * limit) - uint sender =\n - (uint price * uint limit)\"\nusing again2 again_step3 by force\n\nlemma prepare_total_balance :\n \"start_transaction tr state block = Continue st \\\n total_balance state < 2^256 \\\n total_balance (g_orig st) =\n total_balance state -\n uint (tr_gas_price tr) * uint (tr_gas_limit tr)\"\napply (auto simp add:start_transaction_def Let_def\n total_balance_update_world\n split:option.split_asm if_split_asm)\nusing again [of \"unat (tr_value tr)\"]\napply force\nusing again [of \"unat (tr_value tr)\"]\napply force\ndone\n\nlemma duh : \"unat v + x \\ unat sender \\ v \\ sender\"\n by (simp add: word_le_nat_alt)\n\nlemma funext : \"(\\x. f x = g x) \\ f = g\" by auto\n\nlemma add_balance_zero :\n \"add_balance state addr 0 = state\"\napply (rule funext)\napply (simp add:add_balance_def update_world_def)\ndone\n\nlemma sub_add_balance :\n \"add_balance (sub_balance state addr x) addr x = state\"\napply (rule funext)\napply (simp add:sub_balance_def add_balance_def update_world_def Let_def)\ndone\n\nlemma helper :\n\"word256FromNatural (nat (uint a) * unat b) = a*b\"\n by (simp add: unat_def word256FromNatural_def word_arith_nat_mult word_of_nat)\n\nlemma end_transaction_nothing :\n \"end_transaction (nothing_happens state tr) tr block\n = state\"\napply (auto simp: nothing_happens_def end_transaction_def Let_def\n kill_accounts.simps helper add_balance_zero )\n by (simp add: mult.commute sub_add_balance)\n\nlemma nothing_happens_other :\n \"addr \\ tr_from tr \\\n account_balance0 (f_state (nothing_happens state tr) addr) =\n account_balance0 (state addr)\"\nby (simp add:nothing_happens_def\n sub_balance_def update_world_def Let_def)\n\nlemma simple_transaction_other :\n \"start_transaction tr state block = Finished st \\\n addr \\ tr_from tr \\\n account_balance0 (f_state st addr) =\n account_balance0 (state addr)\"\nby (auto simp add:start_transaction_def Let_def\n total_balance_update_world nothing_happens_other\n account_balance_nonce update_world_def\n split:option.split_asm if_split_asm)\n\nlemma nothing_happens_sender :\n \"account_balance0 (f_state (nothing_happens state tr) (tr_from tr)) =\n account_balance0 (state (tr_from tr)) - tr_gas_price tr * tr_gas_limit tr\"\nby (simp add:nothing_happens_def\n sub_balance_def update_world_def Let_def)\n\nlemma simple_transaction_sender :\n \"start_transaction tr state block = Finished st \\\n account_balance0 (f_state st (tr_from tr)) =\n account_balance0 (state (tr_from tr)) -\n tr_gas_price tr * tr_gas_limit tr\"\nby (auto simp add:start_transaction_def Let_def\n total_balance_update_world nothing_happens_sender\n account_balance_nonce update_world_def\n split:option.split_asm if_split_asm)\n\nlemma simple_transaction_overflow :\n \"start_transaction tr state block = Finished st \\\n unat (tr_gas_price tr) * unat (tr_gas_limit tr) >\n unat (account_balance0 (state (tr_from tr))) \\\n st = nothing_happens state tr\"\napply (auto simp add:start_transaction_def Let_def\n total_balance_update_world nothing_happens_sender\n account_balance_nonce update_world_def\n split:option.split_asm if_split_asm)\ndone\n\nlemma end_transaction_zero_price :\n \"tr_gas_price tr = 0 \\\n f_killed st = [] \\\n end_transaction st tr block = f_state st\"\nby (auto simp: nothing_happens_def end_transaction_def Let_def\n kill_accounts.simps helper add_balance_zero word256FromNatural_def)\n\nlemma simple_calc :\n \"uint a + uint b < 2^256 \\\n uint (a + b) - uint (a::w256) = uint b\"\n by (simp add: overflow_plus)\n\nlemma calc_aux :\n\"part \\ totl \\\n uint (sender::w256) + uint part < 2^256 \\\n uint cb + uint (totl-part) < 2^256 \\\n uint (sender + part) +\n (uint (cb + (totl - part)) -\n uint cb -\n uint sender) =\n uint totl\"\n by (simp add: uint_sub overflow_plus)\n\nlemma overflow_le : assumes\n a1: \"part \\ totl\" and\n a2: \"uint sender + uint totl < 2 ^ 256\"\nshows \"uint sender + uint part < 2 ^ 256\"\nproof -\n have \"uint part \\ uint totl\"\n using a1 by (metis word_le_def)\n then show \"uint sender + uint part < 2 ^ 256\"\n using a2 by linarith\nqed\n\n\nlemma calc :\n\"part \\ totl \\\n uint (sender::w256) + uint totl < 2^256 \\\n uint cb + uint totl < 2^256 \\\n uint (sender + part) +\n (uint (cb + (totl - part)) -\n uint cb -\n uint sender) =\n uint totl\"\napply (rule calc_aux)\napply (simp add:overflow_le)\nusing overflow_le apply force\n using overflow_le word_sub_le by blast\n\nlemma foo :\n \"uint (tr_gas_price tr * tr_gas_limit tr) = \n uint (tr_gas_limit tr * tr_gas_price tr)\"\nby auto\n\nlemma grugbr_aux1 :\n \"0 \\ gas_left \\\n gas_left \\ uint (limit :: w256) \\\n uint limit * uint (price::w256) < 2^256 \\\n gas_left * uint price < 2^256\"\n by (meson le_less_trans mult_right_mono uint_range_size)\n\nlemma grugbr_aux2 :\n \"0 \\ gas_left \\\n gas_left \\ uint (limit :: w256) \\\n uint limit * uint (price::w256) < 2^256 \\\n gas_left * uint price \\ uint (limit * price)\"\n by (simp add: mult_right_mono uint_mul_small)\n\nlemma grugbr :\n \"0 \\ gas_left \\\n gas_left \\ uint (limit :: w256) \\\n uint limit * uint price < 2^256 \\\n word_of_int (gas_left * uint price) \\ limit * price\"\nusing grugbr_aux1 [of gas_left limit price]\n grugbr_aux2 [of gas_left limit price]\n by (metis (no_types, hide_lams) int_mod_eq' int_word_uint le_less_trans uint_lt uint_mul_compare wi_hom_mult word_of_int_uint)\n\nlemma grugbr2 :\n \"0 \\ gas_left \\\n gas_left \\ uint (limit :: w256) \\\n uint limit * uint price < 2^256 \\\n word_of_int (gas_left * int (unat price)) \\ limit * price\"\nby (metis grugbr uint_mul_small uint_nat)\n\n\nlemma tb_end_transaction :\n\"gas_left \\ 0 \\\n gas_left \\ uint (tr_gas_limit tr) \\\n uint (tr_gas_limit tr) * uint (tr_gas_price tr) < 2^256 \\\n uint (account_balance0 (state (tr_from tr))) +\n uint (tr_gas_limit tr * tr_gas_price tr) < 2^256 \\\n uint (account_balance0 (state (block_coinbase block))) +\n uint (tr_gas_limit tr * tr_gas_price tr) < 2^256 \\\n total_balance (end_transaction\n \\f_state = state, f_killed = [], f_gas = gas_left, f_refund = 0, f_logs = []\\\n tr block) =\n total_balance state + (uint (tr_gas_price tr * tr_gas_limit tr))\"\napply (simp add: end_transaction_def Let_def kill_accounts.simps\n add_balance_def total_balance_update_world)\napply (auto simp add:update_world_def)\nusing simple_calc apply force\napply (simp add: foo)\napply (rule calc, auto)\napply (simp add :word256FromNatural_def)\napply (rule grugbr2, auto)\ndone\n\nlemma txdatacost_nonneg : \"txdatacost lst \\ 0\"\napply (induction lst)\napply (auto simp add:txdatacost.simps)\ndone\n\nlemma igas_nonneg : \"calc_igas tr state block \\ 0\"\nby (auto simp add:calc_igas_def Let_def txdatacost_nonneg\n split:option.split)\n\nlemma aux_1 :\n \"unat (tr_gas_limit tr) \\ nat \\calc_igas tr state block\\ \\\n int (unat (tr_gas_limit tr)) -\n calc_igas tr state block\n \\ uint (tr_gas_limit tr)\"\nby (auto simp add:igas_nonneg unat_def)\n\nlemma aux_2 :\n \"sender \\ vl + price * limit \\\n sender < 2^256 \\\n int limit * int price < 2 ^ 256\"\n by (metis add_leE le_less_trans mult.commute numeral_pow of_nat_less_iff of_nat_mult of_nat_numeral)\n\nlemma unat_small : \"unat (x::w256) < 2^256\"\nproof -\n { assume \"\\i. \\ uint x < i \\ 0 < i \\ (0::int) \\ numeral (Num.pow (num.Bit0 num.One) (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 num.One)))))))))\"\n then have \"\\ uint x \\ 0 \\ (0::int) \\ numeral (Num.pow (num.Bit0 num.One) (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 num.One)))))))))\"\n by (meson le_less_trans)\n then have \"uint x < numeral (Num.pow (num.Bit0 num.One) (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 num.One)))))))))\"\n by (metis (no_types) find_mod numeral_pow word_of_int_uint zmod_trival_iff) }\n then show ?thesis\n by (metis (no_types) numeral_pow of_nat_less_iff of_nat_numeral power_not_zero uint_nat zero_less_power zero_not_eq_two zless2)\nqed\n\nlemma aux_3 :\n \"unat (sender :: w256) \\ vl +\n unat (price) * unat (limit) \\\n uint (sender - price * limit) + uint (limit*price) < 2^256\"\nproof -\n assume a1: \"vl + unat price * unat limit \\ unat sender\"\n have f2: \"\\w. int (unat (w::256 word)) < numeral (Num.pow (num.Bit0 num.One) (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 (num.Bit0 num.One)))))))))\"\n by (metis (no_types) less_imp_of_nat_less numeral_pow of_nat_numeral unat_small)\n have \"limit * price \\ sender\"\n using a1 by (simp add: semiring_normalization_rules(7) unat_mul_compare)\n then show ?thesis\n using f2 by (metis (no_types) add.commute diff_add_cancel numeral_pow semiring_normalization_rules(7) uint_add uint_nat)\n qed\n\nlemma cool :\n \"uint (cb::w256) +\n uint (sender::w256) < 2^256 \\\n gas_value \\ sender \\\n uint cb +\n uint (gas_value::w256)\n < 115792089237316195423570985008687907853269984665640564039457584007913129639936\"\nusing Balance.overflow_le by auto\n\nlemma handle_minus :\n \"b \\ a \\\n uint a - uint b = uint (a-b)\"\n by (simp add: uint_minus_simple_alt)\n\nlemma aux_4 :\n \"gas_value \\ sender \\\n uint (sender - gas_value) +\n (uint gas_value - uint sender) = 0\"\nusing handle_minus by force\n\nlemma end_simple_transaction :\n \"start_transaction tr state block = Finished st \\\n unat (tr_gas_price tr) * unat (tr_gas_limit tr) \\\n unat (account_balance0 (state (tr_from tr))) \\\n uint (account_balance0 (state (tr_from tr))) +\n uint (account_balance0 (state (block_coinbase block))) < 2^256 \\\n total_balance state = total_balance (end_transaction st tr block)\"\napply (auto simp add:start_transaction_def Let_def\n total_balance_update_world nothing_happens_sender\n account_balance_nonce update_world_def end_transaction_nothing\n split:option.split_asm if_split_asm)\napply (subst end_transaction_zero_price, auto)\nusing tb_update_nonce apply force\napply (subst tb_end_transaction)\napply (auto simp add:igas_nonneg)[1]\napply (auto simp add:igas_nonneg unat_def)[1]\napply (subst Word.uint_nat)\napply (subst Word.uint_nat)\napply (rule aux_2[of \"unat (tr_value tr)\"\n _ _ \"unat (account_balance0 (state (tr_from tr)))\"], auto)\nusing unat_small apply force\napply (simp add:account_balance_nonce\n update_world_def)\nusing aux_3 [of \"unat (tr_value tr)\"\n \"tr_gas_price tr\" \"tr_gas_limit tr\"\n \"account_balance0 (state (tr_from tr))\"]\napply force\napply (simp add:account_balance_nonce\n update_world_def)\nsubgoal\napply auto\nusing aux_3 [of \"unat (tr_value tr)\"\n \"tr_gas_price tr\" \"tr_gas_limit tr\"\n \"account_balance0 (state (tr_from tr))\"]\napply force\napply (rule cool[of \"account_balance0\n (state (block_coinbase block))\"\n \"account_balance0\n (state (tr_from tr))\"\n\"tr_gas_limit tr * tr_gas_price tr\"], auto)\n by (simp add: gas_compare linorder_not_less mult.commute)\napply (simp add:tb_update_nonce\n total_balance_update_world)\napply (rule aux_4)\n using gas_compare linorder_not_less by blast\n\nend\n\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Hoare/Balance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.29098086621490676, "lm_q1q2_score": 0.15457176360577343}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__74_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__74_on_rules imports n_g2kAbsAfter_lemma_on_inv__74\nbegin\nsection{*All lemmas on causal relation between inv__74*}\nlemma lemma_inv__74_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__74 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__74) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__74) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__74_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5312093585306515, "lm_q2_score": 0.2909808600663598, "lm_q1q2_score": 0.1545717560205483}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__8_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__8_on_rules imports n_g2kAbsAfter_lemma_on_inv__8\nbegin\nsection{*All lemmas on causal relation between inv__8*}\nlemma lemma_inv__8_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__8 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__8) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__8) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__8_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5195213368305398, "lm_q2_score": 0.29746994883293104, "lm_q1q2_score": 0.1545419854845966}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__10_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__10_on_rules imports n_g2kAbsAfter_lemma_on_inv__10\nbegin\nsection{*All lemmas on causal relation between inv__10*}\nlemma lemma_inv__10_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__10 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__10) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__10) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__10_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.30404167496654744, "lm_q1q2_score": 0.15439596978333436}} {"text": "(*\n Author: Norbert Schirmer\n Maintainer: Norbert Schirmer, norbert.schirmer at web de\n License: LGPL\n*)\n\n(* Title: Termination.thy\n Author: Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\nsection \\Terminating Programs\\\n\ntheory Termination imports Semantic begin\n\nsubsection \\Inductive Characterisation: \\\\\\c\\s\\\\\n\ninductive \"terminates\"::\"('s,'p,'f) body \\ ('s,'p,'f) com \\ ('s,'f) xstate \\ bool\"\n (\"_\\_ \\ _\" [60,20,60] 89)\n for \\::\"('s,'p,'f) body\"\nwhere\n Skip: \"\\\\Skip \\(Normal s)\"\n\n| Basic: \"\\\\Basic f \\(Normal s)\"\n\n| Spec: \"\\\\Spec r \\(Normal s)\"\n\n| Guard: \"\\s\\g; \\\\c\\(Normal s)\\\n \\\n \\\\Guard f g c\\(Normal s)\"\n\n| GuardFault: \"s\\g\n \\\n \\\\Guard f g c\\(Normal s)\"\n\n\n| Fault [intro,simp]: \"\\\\c\\Fault f\"\n\n\n| Seq: \"\\\\\\c\\<^sub>1\\Normal s; \\s'. \\\\\\c\\<^sub>1,Normal s\\ \\ s' \\ \\\\c\\<^sub>2\\s'\\\n \\\n \\\\Seq c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n| CondTrue: \"\\s \\ b; \\\\c\\<^sub>1\\(Normal s)\\\n \\\n \\\\Cond b c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n\n| CondFalse: \"\\s \\ b; \\\\c\\<^sub>2\\(Normal s)\\\n \\\n \\\\Cond b c\\<^sub>1 c\\<^sub>2\\(Normal s)\"\n\n\n| WhileTrue: \"\\s \\ b; \\\\c\\(Normal s);\n \\s'. \\\\\\c,Normal s \\ \\ s' \\ \\\\While b c\\s'\\\n \\\n \\\\While b c\\(Normal s)\"\n\n| WhileFalse: \"\\s \\ b\\\n \\\n \\\\While b c\\(Normal s)\"\n\n| Call: \"\\\\ p=Some bdy;\\\\bdy\\(Normal s)\\\n \\\n \\\\Call p\\(Normal s)\"\n\n| CallUndefined: \"\\\\ p = None\\\n \\\n \\\\Call p\\(Normal s)\"\n\n| Stuck [intro,simp]: \"\\\\c\\Stuck\"\n\n| DynCom: \"\\\\\\(c s)\\(Normal s)\\\n \\\n \\\\DynCom c\\(Normal s)\"\n\n| Throw: \"\\\\Throw\\(Normal s)\"\n\n| Abrupt [intro,simp]: \"\\\\c\\Abrupt s\"\n\n| Catch: \"\\\\\\c\\<^sub>1\\Normal s;\n \\s'. \\\\\\c\\<^sub>1,Normal s \\ \\ Abrupt s' \\ \\\\c\\<^sub>2\\Normal s'\\\n \\\n \\\\Catch c\\<^sub>1 c\\<^sub>2\\Normal s\"\n\n\ninductive_cases terminates_elim_cases [cases set]:\n \"\\\\Skip \\ s\"\n \"\\\\Guard f g c \\ s\"\n \"\\\\Basic f \\ s\"\n \"\\\\Spec r \\ s\"\n \"\\\\Seq c1 c2 \\ s\"\n \"\\\\Cond b c1 c2 \\ s\"\n \"\\\\While b c \\ s\"\n \"\\\\Call p \\ s\"\n \"\\\\DynCom c \\ s\"\n \"\\\\Throw \\ s\"\n \"\\\\Catch c1 c2 \\ s\"\n\ninductive_cases terminates_Normal_elim_cases [cases set]:\n \"\\\\Skip \\ Normal s\"\n \"\\\\Guard f g c \\ Normal s\"\n \"\\\\Basic f \\ Normal s\"\n \"\\\\Spec r \\ Normal s\"\n \"\\\\Seq c1 c2 \\ Normal s\"\n \"\\\\Cond b c1 c2 \\ Normal s\"\n \"\\\\While b c \\ Normal s\"\n \"\\\\Call p \\ Normal s\"\n \"\\\\DynCom c \\ Normal s\"\n \"\\\\Throw \\ Normal s\"\n \"\\\\Catch c1 c2 \\ Normal s\"\n\nlemma terminates_Skip': \"\\\\Skip \\ s\"\n by (cases s) (auto intro: terminates.intros)\n\nlemma terminates_Call_body:\n \"\\ p=Some bdy\\\\\\Call p \\s = \\\\(the (\\ p))\\s\"\n by (cases s)\n (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n\nlemma terminates_Normal_Call_body:\n \"p \\ dom \\ \\\n \\\\Call p \\Normal s = \\\\(the (\\ p))\\Normal s\"\n by (auto elim: terminates_Normal_elim_cases intro: terminates.intros)\n\nlemma terminates_implies_exec:\n assumes terminates: \"\\\\c\\s\"\n shows \"\\t. \\\\\\c,s\\ \\ t\"\nusing terminates\nproof (induct)\n case Skip thus ?case by (iprover intro: exec.intros)\nnext\n case Basic thus ?case by (iprover intro: exec.intros)\nnext\n case (Spec r s) thus ?case\n by (cases \"\\t. (s,t)\\ r\") (auto intro: exec.intros)\nnext\n case Guard thus ?case by (iprover intro: exec.intros)\nnext\n case GuardFault thus ?case by (iprover intro: exec.intros)\nnext\n case Fault thus ?case by (iprover intro: exec.intros)\nnext\n case Seq thus ?case by (iprover intro: exec_Seq')\nnext\n case CondTrue thus ?case by (iprover intro: exec.intros)\nnext\n case CondFalse thus ?case by (iprover intro: exec.intros)\nnext\n case WhileTrue thus ?case by (iprover intro: exec.intros)\nnext\n case WhileFalse thus ?case by (iprover intro: exec.intros)\nnext\n case (Call p bdy s)\n then obtain s' where\n \"\\\\\\bdy,Normal s \\ \\ s'\"\n by iprover\n moreover have \"\\ p = Some bdy\" by fact\n ultimately show ?case\n by (cases s') (iprover intro: exec.intros)+\nnext\n case CallUndefined thus ?case by (iprover intro: exec.intros)\nnext\n case Stuck thus ?case by (iprover intro: exec.intros)\nnext\n case DynCom thus ?case by (iprover intro: exec.intros)\nnext\n case Throw thus ?case by (iprover intro: exec.intros)\nnext\n case Abrupt thus ?case by (iprover intro: exec.intros)\nnext\n case (Catch c1 s c2)\n then obtain s' where exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n by iprover\n thus ?case\n proof (cases s')\n case (Normal s'')\n with exec_c1 show ?thesis by (auto intro!: exec.intros)\n next\n case (Abrupt s'')\n with exec_c1 Catch.hyps\n obtain t where \"\\\\\\c2,Normal s'' \\ \\ t\"\n by auto\n with exec_c1 Abrupt show ?thesis by (auto intro: exec.intros)\n next\n case Fault\n with exec_c1 show ?thesis by (auto intro!: exec.CatchMiss)\n next\n case Stuck\n with exec_c1 show ?thesis by (auto intro!: exec.CatchMiss)\n qed\nqed\n\nlemma terminates_block:\n\"\\\\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\\n \\ \\\\block init bdy return c \\ Normal s\"\napply (unfold block_def)\napply (fastforce intro: terminates.intros elim!: exec_Normal_elim_cases\n dest!: not_isAbrD)\ndone\n\nlemma terminates_block_elim [cases set, consumes 1]:\nassumes termi: \"\\\\block init bdy return c \\ Normal s\"\nassumes e: \"\\\\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\n \\ \\ P\"\nshows P\nproof -\n have \"\\\\\\Basic init,Normal s\\ \\ Normal (init s)\"\n by (auto intro: exec.intros)\n with termi\n have \"\\\\bdy \\ Normal (init s)\"\n apply (unfold block_def)\n apply (elim terminates_Normal_elim_cases)\n by simp\n moreover\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal (init s)\\ \\ Normal t\"\n have \"\\\\c s t \\ Normal (return s t)\"\n proof -\n from exec_bdy\n have \"\\\\\\Catch (Seq (Basic init) bdy)\n (Seq (Basic (return s)) Throw),Normal s\\ \\ Normal t\"\n by (fastforce intro: exec.intros)\n with termi have \"\\\\DynCom (\\t. Seq (Basic (return s)) (c s t)) \\ Normal t\"\n apply (unfold block_def)\n apply (elim terminates_Normal_elim_cases)\n by simp\n thus ?thesis\n apply (elim terminates_Normal_elim_cases)\n apply (auto intro: exec.intros)\n done\n qed\n }\n ultimately show P by (iprover intro: e)\nqed\n\n\nlemma terminates_call:\n\"\\\\ p = Some bdy; \\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\\n \\ \\\\call init p return c \\ Normal s\"\n apply (unfold call_def)\n apply (rule terminates_block)\n apply (iprover intro: terminates.intros)\n apply (auto elim: exec_Normal_elim_cases)\n done\n\nlemma terminates_callUndefined:\n\"\\\\ p = None\\\n \\ \\\\call init p return result \\ Normal s\"\n apply (unfold call_def)\n apply (rule terminates_block)\n apply (iprover intro: terminates.intros)\n apply (auto elim: exec_Normal_elim_cases)\n done\n\nlemma terminates_call_elim [cases set, consumes 1]:\nassumes termi: \"\\\\call init p return c \\ Normal s\"\nassumes bdy: \"\\bdy. \\\\ p = Some bdy; \\\\bdy \\ Normal (init s);\n \\t. \\\\\\bdy,Normal (init s)\\ \\ Normal t \\ \\\\c s t \\ Normal (return s t)\\ \\ P\"\nassumes undef: \"\\\\ p = None\\ \\ P\"\nshows P\napply (cases \"\\ p\")\napply (erule undef)\nusing termi\napply (unfold call_def)\napply (erule terminates_block_elim)\napply (erule terminates_Normal_elim_cases)\napply simp\napply (frule (1) bdy)\napply (fastforce intro: exec.intros)\napply assumption\napply simp\ndone\n\nlemma terminates_dynCall:\n\"\\\\\\call init (p s) return c \\ Normal s\\\n \\ \\\\dynCall init p return c \\ Normal s\"\n apply (unfold dynCall_def)\n apply (auto intro: terminates.intros terminates_call)\n done\n\nlemma terminates_dynCall_elim [cases set, consumes 1]:\nassumes termi: \"\\\\dynCall init p return c \\ Normal s\"\nassumes \"\\\\\\call init (p s) return c \\ Normal s\\ \\ P\"\nshows P\nusing termi\napply (unfold dynCall_def)\napply (elim terminates_Normal_elim_cases)\napply fact\ndone\n\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{const \"sequence\"}, @{const \"flatten\"} and\n @{const \"normalize\"}\\\n(* ************************************************************************ *)\n\nlemma terminates_sequence_app:\n \"\\s. \\\\\\sequence Seq xs \\ Normal s;\n \\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\\\n\\ \\\\sequence Seq (xs @ ys) \\ Normal s\"\nproof (induct xs)\n case Nil\n thus ?case by (auto intro: exec.intros)\nnext\n case (Cons x xs)\n have termi_x_xs: \"\\\\sequence Seq (x # xs) \\ Normal s\" by fact\n have termi_ys: \"\\s'. \\\\\\sequence Seq (x # xs),Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\" by fact\n show ?case\n proof (cases xs)\n case Nil\n with termi_x_xs termi_ys show ?thesis\n by (cases ys) (auto intro: terminates.intros)\n next\n case Cons\n from termi_x_xs Cons\n have \"\\\\x \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n moreover\n {\n fix s'\n assume exec_x: \"\\\\\\x,Normal s \\ \\ s'\"\n have \"\\\\sequence Seq (xs @ ys) \\ s'\"\n proof -\n from exec_x termi_x_xs Cons\n have termi_xs: \"\\\\sequence Seq xs \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n show ?thesis\n proof (cases s')\n case (Normal s'')\n with exec_x termi_ys Cons\n have \"\\s'. \\\\\\sequence Seq xs,Normal s'' \\ \\ s' \\ \\\\sequence Seq ys \\ s'\"\n by (auto intro: exec.intros)\n from Cons.hyps [OF termi_xs [simplified Normal] this]\n have \"\\\\sequence Seq (xs @ ys) \\ Normal s''\".\n with Normal show ?thesis by simp\n next\n case Abrupt thus ?thesis by (auto intro: terminates.intros)\n next\n case Fault thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n }\n ultimately show ?thesis\n using Cons\n by (auto intro: terminates.intros)\n qed\nqed\n\nlemma terminates_sequence_appD:\n \"\\s. \\\\sequence Seq (xs @ ys) \\ Normal s\n \\ \\\\sequence Seq xs \\ Normal s \\\n (\\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s')\"\nproof (induct xs)\n case Nil\n thus ?case\n by (auto elim: terminates_Normal_elim_cases exec_Normal_elim_cases\n intro: terminates.intros)\nnext\n case (Cons x xs)\n have termi_x_xs_ys: \"\\\\sequence Seq ((x # xs) @ ys) \\ Normal s\" by fact\n show ?case\n proof (cases xs)\n case Nil\n with termi_x_xs_ys show ?thesis\n by (cases ys)\n (auto elim: terminates_Normal_elim_cases exec_Normal_elim_cases\n intro: terminates_Skip')\n next\n case Cons\n with termi_x_xs_ys\n obtain termi_x: \"\\\\x \\ Normal s\" and\n termi_xs_ys: \"\\s'. \\\\\\x,Normal s \\ \\ s' \\ \\\\sequence Seq (xs@ys) \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n\n have \"\\\\Seq x (sequence Seq xs) \\ Normal s\"\n proof (rule terminates.Seq [rule_format])\n show \"\\\\x \\ Normal s\" by (rule termi_x)\n next\n fix s'\n assume exec_x: \"\\\\\\x,Normal s \\ \\ s'\"\n show \"\\\\sequence Seq xs \\ s'\"\n proof -\n from termi_xs_ys [rule_format, OF exec_x]\n have termi_xs_ys': \"\\\\sequence Seq (xs@ys) \\ s'\" .\n show ?thesis\n proof (cases s')\n case (Normal s'')\n from Cons.hyps [OF termi_xs_ys' [simplified Normal]]\n show ?thesis\n using Normal by auto\n next\n case Abrupt thus ?thesis by (auto intro: terminates.intros)\n next\n case Fault thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n qed\n moreover\n {\n fix s'\n assume exec_x_xs: \"\\\\\\Seq x (sequence Seq xs),Normal s \\ \\ s'\"\n have \"\\\\sequence Seq ys \\ s'\"\n proof -\n from exec_x_xs obtain t where\n exec_x: \"\\\\\\x,Normal s \\ \\ t\" and\n exec_xs: \"\\\\\\sequence Seq xs,t \\ \\ s'\"\n by cases\n show ?thesis\n proof (cases t)\n case (Normal t')\n with exec_x termi_xs_ys have \"\\\\sequence Seq (xs@ys) \\ Normal t'\"\n by auto\n from Cons.hyps [OF this] exec_xs Normal\n show ?thesis\n by auto\n next\n case (Abrupt t')\n with exec_xs have \"s'=Abrupt t'\"\n by (auto dest: Abrupt_end)\n thus ?thesis by (auto intro: terminates.intros)\n next\n case (Fault f)\n with exec_xs have \"s'=Fault f\"\n by (auto dest: Fault_end)\n thus ?thesis by (auto intro: terminates.intros)\n next\n case Stuck\n with exec_xs have \"s'=Stuck\"\n by (auto dest: Stuck_end)\n thus ?thesis by (auto intro: terminates.intros)\n qed\n qed\n }\n ultimately show ?thesis\n using Cons\n by auto\n qed\nqed\n\nlemma terminates_sequence_appE [consumes 1]:\n \"\\\\\\sequence Seq (xs @ ys) \\ Normal s;\n \\\\\\sequence Seq xs \\ Normal s;\n \\s'. \\\\\\sequence Seq xs,Normal s \\ \\ s' \\ \\\\sequence Seq ys \\ s'\\ \\ P\\\n \\ P\"\n by (auto dest: terminates_sequence_appD)\n\nlemma terminates_to_terminates_sequence_flatten:\n assumes termi: \"\\\\c\\s\"\n shows \"\\\\sequence Seq (flatten c)\\s\"\nusing termi\nby (induct)\n (auto intro: terminates.intros terminates_sequence_app\n exec_sequence_flatten_to_exec)\n\nlemma terminates_to_terminates_normalize:\n assumes termi: \"\\\\c\\s\"\n shows \"\\\\normalize c\\s\"\nusing termi\nproof induct\n case Seq\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nnext\n case WhileTrue\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nnext\n case Catch\n thus ?case\n by (fastforce intro: terminates.intros terminates_sequence_app\n terminates_to_terminates_sequence_flatten\n dest: exec_sequence_flatten_to_exec exec_normalize_to_exec)\nqed (auto intro: terminates.intros)\n\nlemma terminates_sequence_flatten_to_terminates:\n shows \"\\s. \\\\sequence Seq (flatten c)\\s \\ \\\\c\\s\"\nproof (induct c)\n case (Seq c1 c2)\n have \"\\\\sequence Seq (flatten (Seq c1 c2)) \\ s\" by fact\n hence termi_app: \"\\\\sequence Seq (flatten c1 @ flatten c2) \\ s\" by simp\n show ?case\n proof (cases s)\n case (Normal s')\n have \"\\\\Seq c1 c2 \\ Normal s'\"\n proof (rule terminates.Seq [rule_format])\n from termi_app [simplified Normal]\n have \"\\\\sequence Seq (flatten c1) \\ Normal s'\"\n by (cases rule: terminates_sequence_appE)\n with Seq.hyps\n show \"\\\\c1 \\ Normal s'\"\n by simp\n next\n fix s''\n assume \"\\\\\\c1,Normal s' \\ \\ s''\"\n from termi_app [simplified Normal] exec_to_exec_sequence_flatten [OF this]\n have \"\\\\sequence Seq (flatten c2) \\ s''\"\n by (cases rule: terminates_sequence_appE) auto\n with Seq.hyps\n show \"\\\\c2 \\ s''\"\n by simp\n qed\n with Normal show ?thesis\n by simp\n qed (auto intro: terminates.intros)\nqed (auto intro: terminates.intros)\n\nlemma terminates_normalize_to_terminates:\n shows \"\\s. \\\\normalize c\\s \\ \\\\c\\s\"\nproof (induct c)\n case Skip thus ?case by (auto intro: terminates_Skip')\nnext\n case Basic thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case (Seq c1 c2)\n have \"\\\\normalize (Seq c1 c2) \\ s\" by fact\n hence termi_app: \"\\\\sequence Seq (flatten (normalize c1) @ flatten (normalize c2)) \\ s\"\n by simp\n show ?case\n proof (cases s)\n case (Normal s')\n have \"\\\\Seq c1 c2 \\ Normal s'\"\n proof (rule terminates.Seq [rule_format])\n from termi_app [simplified Normal]\n have \"\\\\sequence Seq (flatten (normalize c1)) \\ Normal s'\"\n by (cases rule: terminates_sequence_appE)\n from terminates_sequence_flatten_to_terminates [OF this] Seq.hyps\n show \"\\\\c1 \\ Normal s'\"\n by simp\n next\n fix s''\n assume \"\\\\\\c1,Normal s' \\ \\ s''\"\n from exec_to_exec_normalize [OF this]\n have \"\\\\\\normalize c1,Normal s' \\ \\ s''\" .\n from termi_app [simplified Normal] exec_to_exec_sequence_flatten [OF this]\n have \"\\\\sequence Seq (flatten (normalize c2)) \\ s''\"\n by (cases rule: terminates_sequence_appE) auto\n from terminates_sequence_flatten_to_terminates [OF this] Seq.hyps\n show \"\\\\c2 \\ s''\"\n by simp\n qed\n with Normal show ?thesis by simp\n qed (auto intro: terminates.intros)\nnext\n case (Cond b c1 c2)\n thus ?case\n by (cases s)\n (auto intro: terminates.intros elim!: terminates_Normal_elim_cases)\nnext\n case (While b c)\n have \"\\\\normalize (While b c) \\ s\" by fact\n hence termi_norm_w: \"\\\\While b (normalize c) \\ s\" by simp\n {\n fix t w\n assume termi_w: \"\\\\ w \\ t\"\n have \"w=While b (normalize c) \\ \\\\While b c \\ t\"\n using termi_w\n proof (induct)\n case (WhileTrue t' b' c')\n from WhileTrue obtain\n t'_b: \"t' \\ b\" and\n termi_norm_c: \"\\\\normalize c \\ Normal t'\" and\n termi_norm_w': \"\\s'. \\\\\\normalize c,Normal t' \\ \\ s' \\ \\\\While b c \\ s'\"\n by auto\n from While.hyps [OF termi_norm_c]\n have \"\\\\c \\ Normal t'\".\n moreover\n from termi_norm_w'\n have \"\\s'. \\\\\\c,Normal t' \\ \\ s' \\ \\\\While b c \\ s'\"\n by (auto intro: exec_to_exec_normalize)\n ultimately show ?case\n using t'_b\n by (auto intro: terminates.intros)\n qed (auto intro: terminates.intros)\n }\n from this [OF termi_norm_w]\n show ?case\n by auto\nnext\n case Call thus ?case by simp\nnext\n case DynCom thus ?case\n by (cases s) (auto intro: terminates.intros rangeI elim: terminates_Normal_elim_cases)\nnext\n case Guard thus ?case\n by (cases s) (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case Throw thus ?case by (cases s) (auto intro: terminates.intros)\nnext\n case Catch\n thus ?case\n by (cases s)\n (auto dest: exec_to_exec_normalize elim!: terminates_Normal_elim_cases\n intro!: terminates.Catch)\nqed\n\nlemma terminates_iff_terminates_normalize:\n\"\\\\normalize c\\s = \\\\c\\s\"\n by (auto intro: terminates_to_terminates_normalize\n terminates_normalize_to_terminates)\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{const \"strip_guards\"}\\\n(* ************************************************************************* *)\n\nlemma terminates_strip_guards_to_terminates: \"\\s. \\\\strip_guards F c\\s \\ \\\\c\\s\"\nproof (induct c)\n case Skip thus ?case by simp\nnext\n case Basic thus ?case by simp\nnext\n case Spec thus ?case by simp\nnext\n case (Seq c1 c2)\n hence \"\\\\Seq (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Seq c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume s: \"s=Normal s'\"\n assume \"\\\\strip_guards F c1 \\ Normal s'\"\n hence \"\\\\c1 \\ Normal s'\"\n by (rule Seq.hyps)\n moreover\n assume c2:\n \"\\s''. \\\\\\strip_guards F c1,Normal s'\\ \\ s'' \\ \\\\strip_guards F c2\\s''\"\n {\n fix s'' assume exec_c1: \"\\\\\\c1,Normal s' \\ \\ s''\"\n have \" \\\\c2 \\ s''\"\n proof (cases s'')\n case (Normal s''')\n with exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ s''\"\n by (auto intro: exec_to_exec_strip_guards)\n with c2\n show ?thesis\n by (iprover intro: Seq.hyps)\n next\n case (Abrupt s''')\n with exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ s''\"\n by (auto intro: exec_to_exec_strip_guards )\n with c2\n show ?thesis\n by (iprover intro: Seq.hyps)\n next\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n qed\n }\n ultimately show ?thesis\n using s\n by (iprover intro: terminates.intros)\n qed\nnext\n case (Cond b c1 c2)\n hence \"\\\\Cond b (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Cond b c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume \"s'\\b\" \"\\\\strip_guards F c1 \\ Normal s'\" \"s = Normal s'\"\n thus ?thesis\n by (iprover intro: terminates.intros Cond.hyps)\n next\n fix s'\n assume \"s'\\b\" \"\\\\strip_guards F c2 \\ Normal s'\" \"s = Normal s'\"\n thus ?thesis\n by (iprover intro: terminates.intros Cond.hyps)\n qed\nnext\n case (While b c)\n have hyp_c: \"\\s. \\\\strip_guards F c \\ s \\ \\\\c \\ s\" by fact\n have \"\\\\While b (strip_guards F c) \\ s\" using While.prems by simp\n moreover\n {\n fix sw\n assume \"\\\\sw\\s\"\n then have \"sw=While b (strip_guards F c) \\\n \\\\While b c \\ s\"\n proof (induct)\n case (WhileTrue s b' c')\n have eqs: \"While b' c' = While b (strip_guards F c)\" by fact\n with \\s\\b'\\ have b: \"s\\b\" by simp\n from eqs \\\\\\c' \\ Normal s\\ have \"\\\\strip_guards F c \\ Normal s\"\n by simp\n hence term_c: \"\\\\c \\ Normal s\"\n by (rule hyp_c)\n moreover\n {\n fix t\n assume exec_c: \"\\\\\\c,Normal s \\ \\ t\"\n have \"\\\\While b c \\ t\"\n proof (cases t)\n case Fault\n thus ?thesis by simp\n next\n case Stuck\n thus ?thesis by simp\n next\n case (Abrupt t')\n thus ?thesis by simp\n next\n case (Normal t')\n with exec_c\n have \"\\\\\\strip_guards F c,Normal s \\ \\ Normal t'\"\n by (auto intro: exec_to_exec_strip_guards)\n with WhileTrue.hyps eqs Normal\n show ?thesis\n by fastforce\n qed\n }\n ultimately\n show ?case\n using b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed simp_all\n }\n ultimately show \"\\\\While b c \\ s\"\n by auto\nnext\n case Call thus ?case by simp\nnext\n case DynCom thus ?case\n by (cases s) (auto elim: terminates_Normal_elim_cases intro: terminates.intros rangeI)\nnext\n case Guard\n thus ?case\n by (cases s) (auto elim: terminates_Normal_elim_cases intro: terminates.intros\n split: if_split_asm)\nnext\n case Throw thus ?case by simp\nnext\n case (Catch c1 c2)\n hence \"\\\\Catch (strip_guards F c1) (strip_guards F c2) \\ s\" by simp\n thus \"\\\\Catch c1 c2 \\ s\"\n proof (cases)\n fix f assume \"s=Fault f\" thus ?thesis by simp\n next\n assume \"s=Stuck\" thus ?thesis by simp\n next\n fix s' assume \"s=Abrupt s'\" thus ?thesis by simp\n next\n fix s'\n assume s: \"s=Normal s'\"\n assume \"\\\\strip_guards F c1 \\ Normal s'\"\n hence \"\\\\c1 \\ Normal s'\"\n by (rule Catch.hyps)\n moreover\n assume c2:\n \"\\s''. \\\\\\strip_guards F c1,Normal s'\\ \\ Abrupt s''\n \\ \\\\strip_guards F c2\\Normal s''\"\n {\n fix s'' assume exec_c1: \"\\\\\\c1,Normal s' \\ \\ Abrupt s''\"\n have \" \\\\c2 \\ Normal s''\"\n proof -\n from exec_c1\n have \"\\\\\\strip_guards F c1,Normal s' \\ \\ Abrupt s''\"\n by (auto intro: exec_to_exec_strip_guards)\n with c2\n show ?thesis\n by (auto intro: Catch.hyps)\n qed\n }\n ultimately show ?thesis\n using s\n by (iprover intro: terminates.intros)\n qed\nqed\n\nlemma terminates_strip_to_terminates:\n assumes termi_strip: \"strip F \\\\c\\s\"\n shows \"\\\\c\\s\"\nusing termi_strip\nproof induct\n case (Seq c1 s c2)\n have \"\\\\c1 \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c1,Normal s\\ \\ s'\"\n have \"\\\\c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_strip [OF exec this] Seq.hyps\n show ?thesis\n by auto\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case (WhileTrue s b c)\n have \"\\\\c \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c,Normal s\\ \\ s'\"\n have \"\\\\While b c \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_strip [OF exec this] WhileTrue.hyps\n show ?thesis\n by auto\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have \"\\\\c1 \\ Normal s\" by fact\n moreover\n {\n fix s'\n assume exec: \"\\\\ \\c1,Normal s\\ \\ Abrupt s'\"\n from exec_to_exec_strip [OF exec] Catch.hyps\n have \"\\\\c2 \\ Normal s'\"\n by auto\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case Call thus ?case\n by (auto intro: terminates.intros terminates_strip_guards_to_terminates)\nqed (auto intro: terminates.intros)\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{term \"c\\<^sub>1 \\\\<^sub>g c\\<^sub>2\"}\\\n(* ************************************************************************* *)\n\nlemma inter_guards_terminates:\n \"\\c c2 s. \\(c1 \\\\<^sub>g c2) = Some c; \\\\c1\\s \\\n \\ \\\\c\\s\"\nproof (induct c1)\n case Skip thus ?case by (fastforce simp add: inter_guards_Skip)\nnext\n case (Basic f) thus ?case by (fastforce simp add: inter_guards_Basic)\nnext\n case (Spec r) thus ?case by (fastforce simp add: inter_guards_Spec)\nnext\n case (Seq a1 a2)\n have \"(Seq a1 a2 \\\\<^sub>g c2) = Some c\" by fact\n then obtain b1 b2 d1 d2 where\n c2: \"c2=Seq b1 b2\" and\n d1: \"(a1 \\\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\\\<^sub>g b2) = Some d2\" and\n c: \"c=Seq d1 d2\"\n by (auto simp add: inter_guards_Seq)\n have termi_c1: \"\\\\Seq a1 a2 \\ s\" by fact\n have \"\\\\Seq d1 d2 \\ s\"\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n note Normal_s = this\n with d1 termi_c1\n have \"\\\\d1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases intro: Seq.hyps)\n moreover\n {\n fix t\n assume exec_d1: \"\\\\\\d1,Normal s' \\ \\ t\"\n have \"\\\\d2 \\ t\"\n proof (cases t)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal t')\n with inter_guards_exec_noFault [OF d1 exec_d1]\n have \"\\\\\\a1,Normal s' \\ \\ Normal t'\"\n by simp\n with termi_c1 Normal_s have \"\\\\a2 \\ Normal t'\"\n by (auto elim: terminates_Normal_elim_cases)\n with d2 have \"\\\\d2 \\ Normal t'\"\n by (auto intro: Seq.hyps)\n with Normal show ?thesis by simp\n qed\n }\n ultimately have \"\\\\Seq d1 d2 \\ Normal s'\"\n by (fastforce intro: terminates.intros)\n with Normal show ?thesis by simp\n qed\n with c show ?case by simp\nnext\n case Cond thus ?case\n by - (cases s,\n auto intro: terminates.intros elim!: terminates_Normal_elim_cases\n simp add: inter_guards_Cond)\nnext\n case (While b bdy1)\n have \"(While b bdy1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain bdy2 bdy where\n c2: \"c2=While b bdy2\" and\n bdy: \"(bdy1 \\\\<^sub>g bdy2) = Some bdy\" and\n c: \"c=While b bdy\"\n by (auto simp add: inter_guards_While)\n have \"\\\\While b bdy1 \\ s\" by fact\n moreover\n {\n fix s w w1 w2\n assume termi_w: \"\\\\w \\ s\"\n assume w: \"w=While b bdy1\"\n from termi_w w\n have \"\\\\While b bdy \\ s\"\n proof (induct)\n case (WhileTrue s b' bdy1')\n have eqs: \"While b' bdy1' = While b bdy1\" by fact\n from WhileTrue have s_in_b: \"s \\ b\" by simp\n from WhileTrue have termi_bdy1: \"\\\\bdy1 \\ Normal s\" by simp\n show ?case\n proof -\n from bdy termi_bdy1\n have \"\\\\bdy\\(Normal s)\"\n by (rule While.hyps)\n moreover\n {\n fix t\n assume exec_bdy: \"\\\\\\bdy,Normal s \\ \\ t\"\n have \"\\\\While b bdy\\t\"\n proof (cases t)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal t')\n with inter_guards_exec_noFault [OF bdy exec_bdy]\n have \"\\\\\\bdy1,Normal s \\ \\ Normal t'\"\n by simp\n with WhileTrue have \"\\\\While b bdy \\ Normal t'\"\n by simp\n with Normal show ?thesis by simp\n qed\n }\n ultimately show ?thesis\n using s_in_b\n by (blast intro: terminates.WhileTrue)\n qed\n next\n case WhileFalse thus ?case\n by (blast intro: terminates.WhileFalse)\n qed (simp_all)\n }\n ultimately\n show ?case using c by simp\nnext\n case Call thus ?case by (simp add: inter_guards_Call)\nnext\n case (DynCom f1)\n have \"(DynCom f1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain f2 f where\n c2: \"c2=DynCom f2\" and\n f_defined: \"\\s. ((f1 s) \\\\<^sub>g (f2 s)) \\ None\" and\n c: \"c=DynCom (\\s. the ((f1 s) \\\\<^sub>g (f2 s)))\"\n by (auto simp add: inter_guards_DynCom)\n have termi: \"\\\\DynCom f1 \\ s\" by fact\n show ?case\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n from f_defined obtain f where f: \"((f1 s') \\\\<^sub>g (f2 s')) = Some f\"\n by auto\n from Normal termi\n have \"\\\\f1 s'\\ (Normal s')\"\n by (auto elim: terminates_Normal_elim_cases)\n from DynCom.hyps f this\n have \"\\\\f\\ (Normal s')\"\n by blast\n with c f Normal\n show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (Guard f g1 bdy1)\n have \"(Guard f g1 bdy1 \\\\<^sub>g c2) = Some c\" by fact\n then obtain g2 bdy2 bdy where\n c2: \"c2=Guard f g2 bdy2\" and\n bdy: \"(bdy1 \\\\<^sub>g bdy2) = Some bdy\" and\n c: \"c=Guard f (g1 \\ g2) bdy\"\n by (auto simp add: inter_guards_Guard)\n have termi_c1: \"\\\\Guard f g1 bdy1 \\ s\" by fact\n show ?case\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n show ?thesis\n proof (cases \"s' \\ g1\")\n case False\n with Normal c show ?thesis by (auto intro: terminates.GuardFault)\n next\n case True\n note s_in_g1 = this\n show ?thesis\n proof (cases \"s' \\ g2\")\n case False\n with Normal c show ?thesis by (auto intro: terminates.GuardFault)\n next\n case True\n with termi_c1 s_in_g1 Normal have \"\\\\bdy1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n with c bdy Guard.hyps Normal True s_in_g1\n show ?thesis by (auto intro: terminates.Guard)\n qed\n qed\n qed\nnext\n case Throw thus ?case\n by (auto simp add: inter_guards_Throw)\nnext\n case (Catch a1 a2)\n have \"(Catch a1 a2 \\\\<^sub>g c2) = Some c\" by fact\n then obtain b1 b2 d1 d2 where\n c2: \"c2=Catch b1 b2\" and\n d1: \"(a1 \\\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\\\<^sub>g b2) = Some d2\" and\n c: \"c=Catch d1 d2\"\n by (auto simp add: inter_guards_Catch)\n have termi_c1: \"\\\\Catch a1 a2 \\ s\" by fact\n have \"\\\\Catch d1 d2 \\ s\"\n proof (cases s)\n case Fault thus ?thesis by simp\n next\n case Stuck thus ?thesis by simp\n next\n case Abrupt thus ?thesis by simp\n next\n case (Normal s')\n note Normal_s = this\n with d1 termi_c1\n have \"\\\\d1 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases intro: Catch.hyps)\n moreover\n {\n fix t\n assume exec_d1: \"\\\\\\d1,Normal s' \\ \\ Abrupt t\"\n have \"\\\\d2 \\ Normal t\"\n proof -\n from inter_guards_exec_noFault [OF d1 exec_d1]\n have \"\\\\\\a1,Normal s' \\ \\ Abrupt t\"\n by simp\n with termi_c1 Normal_s have \"\\\\a2 \\ Normal t\"\n by (auto elim: terminates_Normal_elim_cases)\n with d2 have \"\\\\d2 \\ Normal t\"\n by (auto intro: Catch.hyps)\n with Normal show ?thesis by simp\n qed\n }\n ultimately have \"\\\\Catch d1 d2 \\ Normal s'\"\n by (fastforce intro: terminates.intros)\n with Normal show ?thesis by simp\n qed\n with c show ?case by simp\nqed\n\nlemma inter_guards_terminates':\n assumes c: \"(c1 \\\\<^sub>g c2) = Some c\"\n assumes termi_c2: \"\\\\c2\\s\"\n shows \"\\\\c\\s\"\nproof -\n from c have \"(c2 \\\\<^sub>g c1) = Some c\"\n by (rule inter_guards_sym)\n from this termi_c2 show ?thesis\n by (rule inter_guards_terminates)\nqed\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{const \"mark_guards\"}\\\n(* ************************************************************************ *)\n\nlemma terminates_to_terminates_mark_guards:\n assumes termi: \"\\\\c\\s\"\n shows \"\\\\mark_guards f c\\s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case Guard thus ?case by (fastforce intro: terminates.intros)\nnext\n case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n case Fault thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 s c2)\n have \"\\\\mark_guards f c1 \\ Normal s\" by fact\n moreover\n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c1,Normal s \\ \\ t\"\n have \"\\\\mark_guards f c2 \\ t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c1,Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = t\" and\n t'_Fault: \"isFault t' \\ isFault t\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault t\" by simp\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n with t'_noFault have \"t'=t\" by simp\n with exec_c1 Seq.hyps\n show ?thesis\n by auto\n qed\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case CondTrue thus ?case by (fastforce intro: terminates.intros)\nnext\n case CondFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have \"\\\\mark_guards f c \\ Normal s\" by fact\n moreover\n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c,Normal s \\ \\ t\"\n have \"\\\\mark_guards f (While b c) \\ t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c,Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = t\" and\n t'_Fault: \"isFault t' \\ isFault t\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault t\" by simp\n thus ?thesis\n by (auto elim: isFaultE)\n next\n case False\n with t'_noFault have \"t'=t\" by simp\n with exec_c1 WhileTrue.hyps\n show ?thesis\n by auto\n qed\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case WhileFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n case Call thus ?case by (fastforce intro: terminates.intros)\nnext\n case CallUndefined thus ?case by (fastforce intro: terminates.intros)\nnext\n case Stuck thus ?case by (fastforce intro: terminates.intros)\nnext\n case DynCom thus ?case by (fastforce intro: terminates.intros)\nnext\n case Throw thus ?case by (fastforce intro: terminates.intros)\nnext\n case Abrupt thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have \"\\\\mark_guards f c1 \\ Normal s\" by fact\n moreover\n {\n fix t\n assume exec_mark: \"\\\\\\mark_guards f c1,Normal s \\ \\ Abrupt t\"\n have \"\\\\mark_guards f c2 \\ Normal t\"\n proof -\n from exec_mark_guards_to_exec [OF exec_mark] obtain t' where\n exec_c1: \"\\\\\\c1,Normal s \\ \\ t'\" and\n t'_Fault_f: \"t' = Fault f \\ t' = Abrupt t\" and\n t'_Fault: \"isFault t' \\ isFault (Abrupt t)\" and\n t'_noFault: \"\\ isFault t' \\ t' = Abrupt t\"\n by fastforce\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with t'_Fault have \"isFault (Abrupt t)\" by simp\n thus ?thesis by simp\n next\n case False\n with t'_noFault have \"t'=Abrupt t\" by simp\n with exec_c1 Catch.hyps\n show ?thesis\n by auto\n qed\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nqed\n\nlemma terminates_mark_guards_to_terminates_Normal:\n \"\\s. \\\\mark_guards f c\\Normal s \\ \\\\c\\Normal s\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 c2)\n have \"\\\\mark_guards f (Seq c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\mark_guards f c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\mark_guards f c1,Normal s \\ \\ s' \\\n \\\\mark_guards f c2 \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Seq.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n have \"\\\\ c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE)\n next\n case False\n from exec_to_exec_mark_guards [OF exec_c1 False]\n have \"\\\\\\mark_guards f c1,Normal s \\ \\ s'\" .\n from termi_merge_c2 [rule_format, OF this] Seq.hyps\n show ?thesis\n by (cases s') (auto)\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nnext\n case Cond thus ?case\n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (While b c)\n {\n fix u c'\n assume termi_c': \"\\\\c' \\ Normal u\"\n assume c': \"c' = mark_guards f (While b c)\"\n have \"\\\\While b c \\ Normal u\"\n using termi_c' c'\n proof (induct)\n case (WhileTrue s b' c')\n have s_in_b: \"s \\ b\" using WhileTrue by simp\n have \"\\\\mark_guards f c \\ Normal s\"\n using WhileTrue by (auto elim: terminates_Normal_elim_cases)\n with While.hyps have \"\\\\c \\ Normal s\"\n by auto\n moreover\n have hyp_w: \"\\w. \\\\\\mark_guards f c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n using WhileTrue by simp\n hence \"\\w. \\\\\\c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n apply -\n apply (rule allI)\n apply (case_tac \"w\")\n apply (auto dest: exec_to_exec_mark_guards)\n done\n ultimately show ?case\n using s_in_b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed auto\n }\n with While show ?case by simp\nnext\n case Call thus ?case\n by (fastforce intro: terminates.intros )\nnext\n case DynCom thus ?case\n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (Guard f g c)\n thus ?case by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case Throw thus ?case\n by (fastforce intro: terminates.intros )\nnext\n case (Catch c1 c2)\n have \"\\\\mark_guards f (Catch c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\mark_guards f c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\mark_guards f c1,Normal s \\ \\ Abrupt s' \\\n \\\\mark_guards f c2 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Catch.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\ c2 \\ Normal s'\"\n proof -\n from exec_to_exec_mark_guards [OF exec_c1]\n have \"\\\\\\mark_guards f c1,Normal s \\ \\ Abrupt s'\" by simp\n from termi_merge_c2 [rule_format, OF this] Catch.hyps\n show ?thesis\n by iprover\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nqed\n\nlemma terminates_mark_guards_to_terminates:\n \"\\\\mark_guards f c\\s \\ \\\\c\\ s\"\n by (cases s) (auto intro: terminates_mark_guards_to_terminates_Normal)\n\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{const \"merge_guards\"}\\\n(* ************************************************************************ *)\n\nlemma terminates_to_terminates_merge_guards:\n assumes termi: \"\\\\c\\s\"\n shows \"\\\\merge_guards c\\s\"\nusing termi\nproof (induct)\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have termi_merge_c: \"\\\\merge_guards c \\ Normal s\" by fact\n show ?case\n proof (cases \"\\f' g' c'. merge_guards c = Guard f' g' c'\")\n case False\n hence \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (cases \"merge_guards c\") (auto simp add: Let_def)\n with s_in_g termi_merge_c show ?thesis\n by (auto intro: terminates.intros)\n next\n case True\n then obtain f' g' c' where\n mc: \"merge_guards c = Guard f' g' c'\"\n by blast\n show ?thesis\n proof (cases \"f=f'\")\n case False\n with mc have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (simp add: Let_def)\n with s_in_g termi_merge_c show ?thesis\n by (auto intro: terminates.intros)\n next\n case True\n with mc have \"merge_guards (Guard f g c) = Guard f (g \\ g') c'\"\n by simp\n with s_in_g mc True termi_merge_c\n show ?thesis\n by (cases \"s \\ g'\")\n (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\n qed\n qed\nnext\n case (GuardFault s g f c)\n have \"s \\ g\" by fact\n thus ?case\n by (cases \"merge_guards c\")\n (auto intro: terminates.intros split: if_split_asm simp add: Let_def)\nqed (fastforce intro: terminates.intros dest: exec_merge_guards_to_exec)+\n\nlemma terminates_merge_guards_to_terminates_Normal:\n shows \"\\s. \\\\merge_guards c\\Normal s \\ \\\\c\\Normal s\"\nproof (induct c)\n case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n case (Seq c1 c2)\n have \"\\\\merge_guards (Seq c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\merge_guards c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\merge_guards c1,Normal s \\ \\ s' \\\n \\\\merge_guards c2 \\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Seq.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ s'\"\n have \"\\\\ c2 \\ s'\"\n proof -\n from exec_to_exec_merge_guards [OF exec_c1]\n have \"\\\\\\merge_guards c1,Normal s \\ \\ s'\" .\n from termi_merge_c2 [rule_format, OF this] Seq.hyps\n show ?thesis\n by (cases s') (auto)\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nnext\n case Cond thus ?case\n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (While b c)\n {\n fix u c'\n assume termi_c': \"\\\\c' \\ Normal u\"\n assume c': \"c' = merge_guards (While b c)\"\n have \"\\\\While b c \\ Normal u\"\n using termi_c' c'\n proof (induct)\n case (WhileTrue s b' c')\n have s_in_b: \"s \\ b\" using WhileTrue by simp\n have \"\\\\merge_guards c \\ Normal s\"\n using WhileTrue by (auto elim: terminates_Normal_elim_cases)\n with While.hyps have \"\\\\c \\ Normal s\"\n by auto\n moreover\n have hyp_w: \"\\w. \\\\\\merge_guards c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n using WhileTrue by simp\n hence \"\\w. \\\\\\c,Normal s \\ \\ w \\ \\\\While b c \\ w\"\n by (simp add: exec_iff_exec_merge_guards [symmetric])\n ultimately show ?case\n using s_in_b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed auto\n }\n with While show ?case by simp\nnext\n case Call thus ?case\n by (fastforce intro: terminates.intros )\nnext\n case DynCom thus ?case\n by (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\nnext\n case (Guard f g c)\n have termi_merge: \"\\\\merge_guards (Guard f g c) \\ Normal s\" by fact\n show ?case\n proof (cases \"\\f' g' c'. merge_guards c = Guard f' g' c'\")\n case False\n hence m: \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (cases \"merge_guards c\") (auto simp add: Let_def)\n from termi_merge Guard.hyps show ?thesis\n by (simp only: m)\n (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\n next\n case True\n then obtain f' g' c' where\n mc: \"merge_guards c = Guard f' g' c'\"\n by blast\n show ?thesis\n proof (cases \"f=f'\")\n case False\n with mc have m: \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n by (simp add: Let_def)\n from termi_merge Guard.hyps show ?thesis\n by (simp only: m)\n (fastforce intro: terminates.intros elim: terminates_Normal_elim_cases)\n next\n case True\n with mc have m: \"merge_guards (Guard f g c) = Guard f (g \\ g') c'\"\n by simp\n from termi_merge Guard.hyps\n show ?thesis\n by (simp only: m mc)\n (auto intro: terminates.intros elim: terminates_Normal_elim_cases)\n qed\n qed\nnext\n case Throw thus ?case\n by (fastforce intro: terminates.intros )\nnext\n case (Catch c1 c2)\n have \"\\\\merge_guards (Catch c1 c2) \\ Normal s\" by fact\n then obtain\n termi_merge_c1: \"\\\\merge_guards c1 \\ Normal s\" and\n termi_merge_c2: \"\\s'. \\\\\\merge_guards c1,Normal s \\ \\ Abrupt s' \\\n \\\\merge_guards c2 \\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n from termi_merge_c1 Catch.hyps\n have \"\\\\c1 \\ Normal s\" by iprover\n moreover\n {\n fix s'\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\ c2 \\ Normal s'\"\n proof -\n from exec_to_exec_merge_guards [OF exec_c1]\n have \"\\\\\\merge_guards c1,Normal s \\ \\ Abrupt s'\" .\n from termi_merge_c2 [rule_format, OF this] Catch.hyps\n show ?thesis\n by iprover\n qed\n }\n ultimately show ?case by (auto intro: terminates.intros)\nqed\n\nlemma terminates_merge_guards_to_terminates:\n \"\\\\merge_guards c\\ s \\ \\\\c\\ s\"\nby (cases s) (auto intro: terminates_merge_guards_to_terminates_Normal)\n\ntheorem terminates_iff_terminates_merge_guards:\n \"\\\\c\\ s = \\\\merge_guards c\\ s\"\n by (iprover intro: terminates_to_terminates_merge_guards\n terminates_merge_guards_to_terminates)\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{term \"c\\<^sub>1 \\\\<^sub>g c\\<^sub>2\"}\\\n(* ************************************************************************ *)\n\nlemma terminates_fewer_guards_Normal:\n shows \"\\c s. \\\\\\c'\\Normal s; c \\\\<^sub>g c'; \\\\\\c',Normal s \\ \\\\Fault ` UNIV\\\n \\ \\\\c\\Normal s\"\nproof (induct c')\n case Skip thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case Basic thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case Spec thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (Seq c1' c2')\n have termi: \"\\\\Seq c1' c2' \\ Normal s\" by fact\n then obtain\n termi_c1': \"\\\\c1'\\ Normal s\" and\n termi_c2': \"\\s'. \\\\\\c1',Normal s \\ \\ s' \\ \\\\c2'\\ s'\"\n by (auto elim: terminates_Normal_elim_cases)\n have noFault: \"\\\\\\Seq c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_c1': \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g Seq c1' c2'\" by fact\n from subseteq_guards_Seq [OF this] obtain c1 c2 where\n c: \"c = Seq c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\"\n by blast\n from termi_c1' c1_c1' noFault_c1'\n have \"\\\\c1\\ Normal s\"\n by (rule Seq.hyps)\n moreover\n {\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ t\"\n have \"\\\\c2\\ t\"\n proof -\n from exec_to_exec_subseteq_guards [OF c1_c1' exec_c1] obtain t' where\n exec_c1': \"\\\\\\c1',Normal s \\ \\ t'\" and\n t_Fault: \"isFault t \\ isFault t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with exec_c1' noFault_c1'\n have False\n by (fastforce elim: isFaultE dest: Fault_end simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_noFault have t': \"t'=t\" by simp\n with termi_c2' exec_c1'\n have termi_c2': \"\\\\c2'\\ t\"\n by auto\n show ?thesis\n proof (cases t)\n case Fault thus ?thesis by auto\n next\n case Abrupt thus ?thesis by auto\n next\n case Stuck thus ?thesis by auto\n next\n case (Normal u)\n with noFault exec_c1' t'\n have \"\\\\\\c2',Normal u \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' [simplified Normal] c2_c2' this\n have \"\\\\c2 \\ Normal u\"\n by (rule Seq.hyps)\n with Normal exec_c1\n show ?thesis by simp\n qed\n qed\n qed\n }\n ultimately show ?case using c by (auto intro: terminates.intros)\nnext\n case (Cond b c1' c2')\n have noFault: \"\\\\\\Cond b c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\Cond b c1' c2' \\ Normal s\" by fact\n have \"c \\\\<^sub>g Cond b c1' c2'\" by fact\n from subseteq_guards_Cond [OF this] obtain c1 c2 where\n c: \"c = Cond b c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\"\n by blast\n thus ?case\n proof (cases \"s \\ b\")\n case True\n with termi have termi_c1': \"\\\\c1' \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n from True noFault have \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c1' c1_c1' this\n have \"\\\\c1 \\ Normal s\"\n by (rule Cond.hyps)\n with True c show ?thesis\n by (auto intro: terminates.intros)\n next\n case False\n with termi have termi_c2': \"\\\\c2' \\ Normal s\"\n by (auto elim: terminates_Normal_elim_cases)\n from False noFault have \"\\\\\\c2',Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' c2_c2' this\n have \"\\\\c2 \\ Normal s\"\n by (rule Cond.hyps)\n with False c show ?thesis\n by (auto intro: terminates.intros)\n qed\nnext\n case (While b c')\n have noFault: \"\\\\\\While b c',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\While b c' \\ Normal s\" by fact\n have \"c \\\\<^sub>g While b c'\" by fact\n from subseteq_guards_While [OF this]\n obtain c'' where\n c: \"c = While b c''\" and\n c''_c': \"c'' \\\\<^sub>g c'\"\n by blast\n {\n fix d u\n assume termi: \"\\\\d \\ u\"\n assume d: \"d = While b c'\"\n assume noFault: \"\\\\\\While b c',u \\ \\\\Fault ` UNIV\"\n have \"\\\\While b c'' \\ u\"\n using termi d noFault\n proof (induct)\n case (WhileTrue u b' c''')\n have u_in_b: \"u \\ b\" using WhileTrue by simp\n have termi_c': \"\\\\c' \\ Normal u\" using WhileTrue by simp\n have noFault: \"\\\\\\While b c',Normal u \\ \\\\Fault ` UNIV\" using WhileTrue by simp\n hence noFault_c': \"\\\\\\c',Normal u \\ \\\\Fault ` UNIV\" using u_in_b\n by (auto intro: exec.intros simp add: final_notin_def)\n from While.hyps [OF termi_c' c''_c' this]\n have \"\\\\c'' \\ Normal u\".\n moreover\n from WhileTrue\n have hyp_w: \"\\s'. \\\\\\c',Normal u \\ \\ s' \\ \\\\\\While b c',s' \\ \\\\Fault ` UNIV\n \\ \\\\While b c'' \\ s'\"\n by simp\n {\n fix v\n assume exec_c'': \"\\\\\\c'',Normal u \\ \\ v\"\n have \"\\\\While b c'' \\ v\"\n proof -\n from exec_to_exec_subseteq_guards [OF c''_c' exec_c''] obtain v' where\n exec_c': \"\\\\\\c',Normal u \\ \\ v'\" and\n v_Fault: \"isFault v \\ isFault v'\" and\n v'_noFault: \"\\ isFault v' \\ v' = v\"\n by auto\n show ?thesis\n proof (cases \"isFault v'\")\n case True\n with exec_c' noFault u_in_b\n have False\n by (fastforce\n simp add: final_notin_def intro: exec.intros elim: isFaultE)\n thus ?thesis ..\n next\n case False\n with v'_noFault have v': \"v'=v\"\n by simp\n with noFault exec_c' u_in_b\n have \"\\\\\\While b c',v \\ \\\\Fault ` UNIV\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n from hyp_w [rule_format, OF exec_c' [simplified v'] this]\n show \"\\\\While b c'' \\ v\" .\n qed\n qed\n }\n ultimately\n show ?case using u_in_b\n by (auto intro: terminates.intros)\n next\n case WhileFalse thus ?case by (auto intro: terminates.intros)\n qed auto\n }\n with c noFault termi show ?case\n by auto\nnext\n case Call thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (DynCom C')\n have termi: \"\\\\DynCom C' \\ Normal s\" by fact\n hence termi_C': \"\\\\C' s \\ Normal s\"\n by cases\n have noFault: \"\\\\\\DynCom C',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_C': \"\\\\\\C' s,Normal s \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g DynCom C'\" by fact\n from subseteq_guards_DynCom [OF this] obtain C where\n c: \"c = DynCom C\" and\n C_C': \"\\s. C s \\\\<^sub>g C' s\"\n by blast\n from DynCom.hyps termi_C' C_C' [rule_format] noFault_C'\n have \"\\\\C s \\ Normal s\"\n by fast\n with c show ?case\n by (auto intro: terminates.intros)\nnext\n case (Guard f' g' c')\n have noFault: \"\\\\\\Guard f' g' c',Normal s \\ \\\\Fault ` UNIV\" by fact\n have termi: \"\\\\Guard f' g' c' \\ Normal s\" by fact\n have \"c \\\\<^sub>g Guard f' g' c'\" by fact\n hence c_cases: \"(c \\\\<^sub>g c') \\ (\\c''. c = Guard f' g' c'' \\ (c'' \\\\<^sub>g c'))\"\n by (rule subseteq_guards_Guard)\n thus ?case\n proof (cases \"s \\ g'\")\n case True\n note s_in_g' = this\n with noFault have noFault_c': \"\\\\\\c',Normal s \\ \\\\Fault ` UNIV\"\n by (auto simp add: final_notin_def intro: exec.intros)\n from termi s_in_g' have termi_c': \"\\\\c' \\ Normal s\"\n by cases auto\n from c_cases show ?thesis\n proof\n assume \"c \\\\<^sub>g c'\"\n from termi_c' this noFault_c'\n show \"\\\\c \\ Normal s\"\n by (rule Guard.hyps)\n next\n assume \"\\c''. c = Guard f' g' c'' \\ (c'' \\\\<^sub>g c')\"\n then obtain c'' where\n c: \"c = Guard f' g' c''\" and c''_c': \"c'' \\\\<^sub>g c'\"\n by blast\n from termi_c' c''_c' noFault_c'\n have \"\\\\c'' \\ Normal s\"\n by (rule Guard.hyps)\n with s_in_g' c\n show ?thesis\n by (auto intro: terminates.intros)\n qed\n next\n case False\n with noFault have False\n by (auto intro: exec.intros simp add: final_notin_def)\n thus ?thesis ..\n qed\nnext\n case Throw thus ?case by (auto intro: terminates.intros dest: subseteq_guardsD)\nnext\n case (Catch c1' c2')\n have termi: \"\\\\Catch c1' c2' \\ Normal s\" by fact\n then obtain\n termi_c1': \"\\\\c1'\\ Normal s\" and\n termi_c2': \"\\s'. \\\\\\c1',Normal s \\ \\ Abrupt s' \\ \\\\c2'\\ Normal s'\"\n by (auto elim: terminates_Normal_elim_cases)\n have noFault: \"\\\\\\Catch c1' c2',Normal s \\ \\\\Fault ` UNIV\" by fact\n hence noFault_c1': \"\\\\\\c1',Normal s \\ \\\\Fault ` UNIV\"\n by (fastforce intro: exec.intros simp add: final_notin_def)\n have \"c \\\\<^sub>g Catch c1' c2'\" by fact\n from subseteq_guards_Catch [OF this] obtain c1 c2 where\n c: \"c = Catch c1 c2\" and\n c1_c1': \"c1 \\\\<^sub>g c1'\" and\n c2_c2': \"c2 \\\\<^sub>g c2'\"\n by blast\n from termi_c1' c1_c1' noFault_c1'\n have \"\\\\c1\\ Normal s\"\n by (rule Catch.hyps)\n moreover\n {\n fix t\n assume exec_c1: \"\\\\\\c1,Normal s \\ \\ Abrupt t\"\n have \"\\\\c2\\ Normal t\"\n proof -\n from exec_to_exec_subseteq_guards [OF c1_c1' exec_c1] obtain t' where\n exec_c1': \"\\\\\\c1',Normal s \\ \\ t'\" and\n t'_noFault: \"\\ isFault t' \\ t' = Abrupt t\"\n by blast\n show ?thesis\n proof (cases \"isFault t'\")\n case True\n with exec_c1' noFault_c1'\n have False\n by (fastforce elim: isFaultE dest: Fault_end simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_noFault have t': \"t'=Abrupt t\" by simp\n with termi_c2' exec_c1'\n have termi_c2': \"\\\\c2'\\ Normal t\"\n by auto\n with noFault exec_c1' t'\n have \"\\\\\\c2',Normal t \\ \\\\Fault ` UNIV\"\n by (auto intro: exec.intros simp add: final_notin_def)\n from termi_c2' c2_c2' this\n show \"\\\\c2 \\ Normal t\"\n by (rule Catch.hyps)\n qed\n qed\n }\n ultimately show ?case using c by (auto intro: terminates.intros)\nqed\n\ntheorem terminates_fewer_guards:\n shows \"\\\\\\c'\\s; c \\\\<^sub>g c'; \\\\\\c',s \\ \\\\Fault ` UNIV\\\n \\ \\\\c\\s\"\n by (cases s) (auto intro: terminates_fewer_guards_Normal)\n\nlemma terminates_noFault_strip_guards:\n assumes termi: \"\\\\c\\Normal s\"\n shows \"\\\\\\\\c,Normal s \\ \\\\Fault ` F\\ \\ \\\\strip_guards F c\\Normal s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (auto intro: terminates.intros)\nnext\n case Basic thus ?case by (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (auto intro: terminates.intros)\nnext\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have \"\\\\c \\ Normal s\" by fact\n have \"\\\\\\Guard f g c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_g have \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n with Guard.hyps have \"\\\\strip_guards F c \\ Normal s\" by simp\n with s_in_g show ?case\n by (auto intro: terminates.intros)\nnext\n case GuardFault thus ?case\n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Fault thus ?case by (auto intro: terminates.intros)\nnext\n case (Seq c1 s c2)\n have noFault_Seq: \"\\\\\\Seq c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with Seq.hyps have \"\\\\strip_guards F c1 \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c1: \"\\\\\\strip_guards F c1,Normal s \\ \\ s'\"\n have \"\\\\strip_guards F c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_guards_to_exec [OF exec_strip_guards_c1] noFault_c1\n have *: \"\\\\\\c1,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with noFault_Seq have \"\\\\\\c2,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using Seq.hyps by simp\n qed\n }\n ultimately show ?case\n by (auto intro: terminates.intros)\nnext\n case CondTrue thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case CondFalse thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have noFault_while: \"\\\\\\While b c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_b have noFault_c: \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with WhileTrue.hyps have \"\\\\strip_guards F c \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c: \"\\\\\\strip_guards F c,Normal s \\ \\ s'\"\n have \"\\\\strip_guards F (While b c) \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_guards_to_exec [OF exec_strip_guards_c] noFault_c\n have *: \"\\\\\\c,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with s_in_b noFault_while have \"\\\\\\While b c,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using WhileTrue.hyps by simp\n qed\n }\n ultimately show ?case\n using WhileTrue.hyps by (auto intro: terminates.intros)\nnext\n case WhileFalse thus ?case by (auto intro: terminates.intros)\nnext\n case Call thus ?case by (auto intro: terminates.intros)\nnext\n case CallUndefined thus ?case by (auto intro: terminates.intros)\nnext\n case Stuck thus ?case by (auto intro: terminates.intros)\nnext\n case DynCom thus ?case\n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Throw thus ?case by (auto intro: terminates.intros)\nnext\n case Abrupt thus ?case by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have noFault_Catch: \"\\\\\\Catch c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n with Catch.hyps have \"\\\\strip_guards F c1 \\ Normal s\" by simp\n moreover\n {\n fix s'\n assume exec_strip_guards_c1: \"\\\\\\strip_guards F c1,Normal s \\ \\ Abrupt s'\"\n have \"\\\\strip_guards F c2 \\ Normal s'\"\n proof -\n from exec_strip_guards_to_exec [OF exec_strip_guards_c1] noFault_c1\n have *: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with noFault_Catch have \"\\\\\\c2,Normal s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using Catch.hyps by simp\n qed\n }\n ultimately show ?case\n using Catch.hyps by (auto intro: terminates.intros)\nqed\n\n(* ************************************************************************* *)\nsubsection \\Lemmas about @{const \"strip_guards\"}\\\n(* ************************************************************************* *)\n\nlemma terminates_noFault_strip:\n assumes termi: \"\\\\c\\Normal s\"\n shows \"\\\\\\\\c,Normal s \\ \\\\Fault ` F\\ \\ strip F \\\\c\\Normal s\"\nusing termi\nproof (induct)\n case Skip thus ?case by (auto intro: terminates.intros)\nnext\n case Basic thus ?case by (auto intro: terminates.intros)\nnext\n case Spec thus ?case by (auto intro: terminates.intros)\nnext\n case (Guard s g c f)\n have s_in_g: \"s \\ g\" by fact\n have \"\\\\\\Guard f g c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_g have \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c \\ Normal s\" by (simp add: Guard.hyps)\n with s_in_g show ?case\n by (auto intro: terminates.intros simp del: strip_simp)\nnext\n case GuardFault thus ?case\n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Fault thus ?case by (auto intro: terminates.intros)\nnext\n case (Seq c1 s c2)\n have noFault_Seq: \"\\\\\\Seq c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c1 \\ Normal s\" by (simp add: Seq.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c1: \"strip F \\\\\\c1,Normal s \\ \\ s'\"\n have \"strip F \\\\c2 \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_to_exec [OF exec_strip_c1] noFault_c1\n have *: \"\\\\\\c1,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with noFault_Seq have \"\\\\\\c2,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using Seq.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n by (fastforce intro: terminates.intros)\nnext\n case CondTrue thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case CondFalse thus ?case\n by (fastforce intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case (WhileTrue s b c)\n have s_in_b: \"s \\ b\" by fact\n have noFault_while: \"\\\\\\While b c,Normal s \\ \\\\Fault ` F\" by fact\n with s_in_b have noFault_c: \"\\\\\\c,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c \\ Normal s\" by (simp add: WhileTrue.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c: \"strip F \\\\\\c,Normal s \\ \\ s'\"\n have \"strip F \\\\While b c \\ s'\"\n proof (cases \"isFault s'\")\n case True\n thus ?thesis by (auto elim: isFaultE intro: terminates.intros)\n next\n case False\n with exec_strip_to_exec [OF exec_strip_c] noFault_c\n have *: \"\\\\\\c,Normal s \\ \\ s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with s_in_b noFault_while have \"\\\\\\While b c,s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using WhileTrue.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n using WhileTrue.hyps by (auto intro: terminates.intros simp del: strip_simp)\nnext\n case WhileFalse thus ?case by (auto intro: terminates.intros)\nnext\n case (Call p bdy s)\n have bdy: \"\\ p = Some bdy\" by fact\n have \"\\\\\\Call p,Normal s \\ \\\\Fault ` F\" by fact\n with bdy have bdy_noFault: \"\\\\\\bdy,Normal s \\ \\\\Fault ` F\"\n by (auto intro: exec.intros simp add: final_notin_def)\n then have strip_bdy_noFault: \"strip F \\\\\\bdy,Normal s \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def dest!: exec_strip_to_exec elim!: isFaultE)\n\n from bdy_noFault have \"strip F \\\\bdy \\ Normal s\" by (simp add: Call.hyps)\n from terminates_noFault_strip_guards [OF this strip_bdy_noFault]\n have \"strip F \\\\strip_guards F bdy \\ Normal s\".\n with bdy show ?case\n by (fastforce intro: terminates.Call)\nnext\n case CallUndefined thus ?case by (auto intro: terminates.intros)\nnext\n case Stuck thus ?case by (auto intro: terminates.intros)\nnext\n case DynCom thus ?case\n by (auto intro: terminates.intros exec.intros simp add: final_notin_def )\nnext\n case Throw thus ?case by (auto intro: terminates.intros)\nnext\n case Abrupt thus ?case by (auto intro: terminates.intros)\nnext\n case (Catch c1 s c2)\n have noFault_Catch: \"\\\\\\Catch c1 c2,Normal s \\ \\\\Fault ` F\" by fact\n hence noFault_c1: \"\\\\\\c1,Normal s \\ \\\\Fault ` F\"\n by (fastforce simp add: final_notin_def intro: exec.intros)\n then have \"strip F \\\\c1 \\ Normal s\" by (simp add: Catch.hyps)\n moreover\n {\n fix s'\n assume exec_strip_c1: \"strip F \\\\\\c1,Normal s \\ \\ Abrupt s'\"\n have \"strip F \\\\c2 \\ Normal s'\"\n proof -\n from exec_strip_to_exec [OF exec_strip_c1] noFault_c1\n have *: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n by (auto simp add: final_notin_def elim!: isFaultE)\n with * noFault_Catch have \"\\\\\\c2,Normal s' \\ \\\\Fault ` F\"\n by (auto simp add: final_notin_def intro: exec.intros)\n with * show ?thesis\n using Catch.hyps by (simp del: strip_simp)\n qed\n }\n ultimately show ?case\n using Catch.hyps by (auto intro: terminates.intros simp del: strip_simp)\nqed\n\n\n(* ************************************************************************* *)\nsubsection \\Miscellaneous\\\n(* ************************************************************************* *)\n\nlemma terminates_while_lemma:\n assumes termi: \"\\\\w\\fk\"\n shows \"\\k b c. \\fk = Normal (f k); w=While b c;\n \\i. \\\\\\c,Normal (f i) \\ \\ Normal (f (Suc i))\\\n \\ \\i. f i \\ b\"\nusing termi\nproof (induct)\n case WhileTrue thus ?case by blast\nnext\n case WhileFalse thus ?case by blast\nqed simp_all\n\nlemma terminates_while:\n \"\\\\\\(While b c)\\Normal (f k);\n \\i. \\\\\\c,Normal (f i) \\ \\ Normal (f (Suc i))\\\n \\ \\i. f i \\ b\"\n by (blast intro: terminates_while_lemma)\n\nlemma wf_terminates_while:\n \"wf {(t,s). \\\\(While b c)\\Normal s \\ s\\b \\\n \\\\\\c,Normal s \\ \\ Normal t}\"\napply(subst wf_iff_no_infinite_down_chain)\napply(rule notI)\napply clarsimp\napply(insert terminates_while)\napply blast\ndone\n\nlemma terminates_restrict_to_terminates:\n assumes terminates_res: \"\\|\\<^bsub>M\\<^esub>\\ c \\ s\"\n assumes not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\c,s \\ \\\\{Stuck}\"\n shows \"\\\\ c \\ s\"\nusing terminates_res not_Stuck\nproof (induct)\n case Skip show ?case by (rule terminates.Skip)\nnext\n case Basic show ?case by (rule terminates.Basic)\nnext\n case Spec show ?case by (rule terminates.Spec)\nnext\n case Guard thus ?case\n by (auto intro: terminates.Guard dest: notStuck_GuardD)\nnext\n case GuardFault thus ?case by (auto intro: terminates.GuardFault)\nnext\n case Fault show ?case by (rule terminates.Fault)\nnext\n case (Seq c1 s c2)\n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\Seq c1 c2,Normal s \\ \\\\{Stuck}\" by fact\n hence c1_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\\\{Stuck}\"\n by (rule notStuck_SeqD1)\n show \"\\\\Seq c1 c2 \\ Normal s\"\n proof (rule terminates.Seq,safe)\n from c1_notStuck\n show \"\\\\c1 \\ Normal s\"\n by (rule Seq.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c1,Normal s \\ \\ s'\"\n show \"\\\\c2 \\ s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\ t'\" and\n t'_notStuck: \"t' \\ Stuck \\ t' = s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c1_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=s'\" by simp\n with not_Stuck exec_res\n have \"\\|\\<^bsub>M\\<^esub>\\\\c2,s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_SeqD2)\n with exec_res t' Seq.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nnext\n case CondTrue thus ?case\n by (auto intro: terminates.CondTrue dest: notStuck_CondTrueD)\nnext\n case CondFalse thus ?case\n by (auto intro: terminates.CondFalse dest: notStuck_CondFalseD)\nnext\n case (WhileTrue s b c)\n have s: \"s \\ b\" by fact\n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\While b c,Normal s \\ \\\\{Stuck}\" by fact\n with WhileTrue have c_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s \\ \\\\{Stuck}\"\n by (iprover intro: notStuck_WhileTrueD1)\n show ?case\n proof (rule terminates.WhileTrue [OF s],safe)\n from c_notStuck\n show \"\\\\c \\ Normal s\"\n by (rule WhileTrue.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c,Normal s \\ \\ s'\"\n show \"\\\\While b c \\ s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c,Normal s \\ \\ t'\" and\n t'_notStuck: \"t' \\ Stuck \\ t' = s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=s'\" by simp\n with not_Stuck exec_res s\n have \"\\|\\<^bsub>M\\<^esub>\\\\While b c,s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_WhileTrueD2)\n with exec_res t' WhileTrue.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nnext\n case WhileFalse then show ?case by (iprover intro: terminates.WhileFalse)\nnext\n case Call thus ?case\n by (auto intro: terminates.Call dest: notStuck_CallD restrict_SomeD)\nnext\n case CallUndefined\n thus ?case\n by (auto dest: notStuck_CallDefinedD)\nnext\n case Stuck show ?case by (rule terminates.Stuck)\nnext\n case DynCom\n thus ?case\n by (auto intro: terminates.DynCom dest: notStuck_DynComD)\nnext\n case Throw show ?case by (rule terminates.Throw)\nnext\n case Abrupt show ?case by (rule terminates.Abrupt)\nnext\n case (Catch c1 s c2)\n have not_Stuck: \"\\|\\<^bsub>M\\<^esub>\\\\Catch c1 c2,Normal s \\ \\\\{Stuck}\" by fact\n hence c1_notStuck: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\\\{Stuck}\"\n by (rule notStuck_CatchD1)\n show \"\\\\Catch c1 c2 \\ Normal s\"\n proof (rule terminates.Catch,safe)\n from c1_notStuck\n show \"\\\\c1 \\ Normal s\"\n by (rule Catch.hyps)\n next\n fix s'\n assume exec: \"\\\\\\c1,Normal s \\ \\ Abrupt s'\"\n show \"\\\\c2 \\ Normal s'\"\n proof -\n from exec_to_exec_restrict [OF exec] obtain t' where\n exec_res: \"\\|\\<^bsub>M\\<^esub>\\\\c1,Normal s \\ \\ t'\" and\n t'_notStuck: \"t' \\ Stuck \\ t' = Abrupt s'\"\n by blast\n show ?thesis\n proof (cases \"t'=Stuck\")\n case True\n with c1_notStuck exec_res have \"False\"\n by (auto simp add: final_notin_def)\n thus ?thesis ..\n next\n case False\n with t'_notStuck have t': \"t'=Abrupt s'\" by simp\n with not_Stuck exec_res\n have \"\\|\\<^bsub>M\\<^esub>\\\\c2,Normal s' \\ \\\\{Stuck}\"\n by (auto dest: notStuck_CatchD2)\n with exec_res t' Catch.hyps\n show ?thesis\n by auto\n qed\n qed\n qed\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/Termination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.304041668660366, "lm_q1q2_score": 0.15439596658098065}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__29_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__29_on_rules imports n_german_lemma_on_inv__29\nbegin\nsection{*All lemmas on causal relation between inv__29*}\nlemma lemma_inv__29_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__29 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__29) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__29) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__29_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3040416623541848, "lm_q1q2_score": 0.154395963378627}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n Refinement for handleEvent and syscalls\n*)\n\ntheory Syscall_R\nimports Tcb_R Arch_R Interrupt_R\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(*\nsyscall has 5 sections: m_fault h_fault m_error h_error m_finalise\n\nrun m_fault (faultable code) \\ r_fault\n failure, i.e. Inr somefault \\ \\somefault. h_fault; done\n\nsuccess, i.e. Inl a\n \\ run \\a. m_error a (errable code) \\ r_error\n failure, i.e. Inr someerror \\ \\someerror. h_error e; done\n success, i.e. Inl b \\ \\b. m_finalise b\n\nOne can clearly see this is simulating some kind of monadic Maybe sequence\ntrying to identify all possible errors before actually performing the syscall.\n*)\n\nlemma syscall_corres:\n assumes corres:\n \"corres (fr \\ r_flt_rel) P P' m_flt m_flt'\"\n \"\\flt flt'. flt' = fault_map flt \\\n corres r (P_flt flt) (P'_flt flt') (h_flt flt) (h_flt' flt')\"\n \"\\rv rv'. r_flt_rel rv rv' \\\n corres (ser \\ r_err_rel rv rv')\n (P_no_flt rv) (P'_no_flt rv')\n (m_err rv) (m_err' rv')\"\n \"\\rv rv' err err'. \\r_flt_rel rv rv'; err' = syscall_error_map err \\\n \\ corres r (P_err rv err)\n (P'_err rv' err') (h_err err) (h_err' err')\"\n \"\\rvf rvf' rve rve'. \\r_flt_rel rvf rvf'; r_err_rel rvf rvf' rve rve'\\\n \\ corres (intr \\ r)\n (P_no_err rvf rve) (P'_no_err rvf' rve')\n (m_fin rve) (m_fin' rve')\"\n\n assumes wp:\n \"\\rv. \\Q_no_flt rv\\ m_err rv \\P_no_err rv\\, \\P_err rv\\\"\n \"\\rv'. \\Q'_no_flt rv'\\ m_err' rv' \\P'_no_err rv'\\,\\P'_err rv'\\\"\n \"\\Q\\ m_flt \\\\rv. P_no_flt rv and Q_no_flt rv\\, \\P_flt\\\"\n \"\\Q'\\ m_flt' \\\\rv. P'_no_flt rv and Q'_no_flt rv\\, \\P'_flt\\\"\n\n shows \"corres (intr \\ r) (P and Q) (P' and Q')\n (Syscall_A.syscall m_flt h_flt m_err h_err m_fin)\n (Syscall_H.syscall m_flt' h_flt' m_err' h_err' m_fin')\"\n apply (simp add: Syscall_A.syscall_def Syscall_H.syscall_def liftE_bindE)\n apply (rule corres_split_bind_case_sum)\n apply (rule corres_split_bind_case_sum | rule corres | rule wp | simp add: liftE_bindE)+\n done\n\nlemma syscall_valid':\n assumes x:\n \"\\ft. \\P_flt ft\\ h_flt ft \\Q\\\"\n \"\\err. \\P_err err\\ h_err err \\Q\\\"\n \"\\rv. \\P_no_err rv\\ m_fin rv \\Q\\,\\E\\\"\n \"\\rv. \\P_no_flt rv\\ m_err rv \\P_no_err\\, \\P_err\\\"\n \"\\P\\ m_flt \\P_no_flt\\, \\P_flt\\\"\n shows \"\\P\\ Syscall_H.syscall m_flt h_flt m_err h_err m_fin \\Q\\, \\E\\\"\n apply (simp add: Syscall_H.syscall_def liftE_bindE\n cong: sum.case_cong)\n apply (rule hoare_split_bind_case_sumE)\n apply (wp x)[1]\n apply (rule hoare_split_bind_case_sumE)\n apply (wp x|simp)+\n done\n\n\ntext \\Completing the relationship between abstract/haskell invocations\\\n\nprimrec\n inv_relation :: \"Invocations_A.invocation \\ Invocations_H.invocation \\ bool\"\nwhere\n \"inv_relation (Invocations_A.InvokeUntyped i) x =\n (\\i'. untypinv_relation i i' \\ x = InvokeUntyped i')\"\n| \"inv_relation (Invocations_A.InvokeEndpoint w w2 b c) x =\n (x = InvokeEndpoint w w2 b c)\"\n| \"inv_relation (Invocations_A.InvokeNotification w w2) x =\n (x = InvokeNotification w w2)\"\n| \"inv_relation (Invocations_A.InvokeReply w ptr grant) x =\n (x = InvokeReply w (cte_map ptr) grant)\"\n| \"inv_relation (Invocations_A.InvokeTCB i) x =\n (\\i'. tcbinv_relation i i' \\ x = InvokeTCB i')\"\n| \"inv_relation (Invocations_A.InvokeDomain tptr domain) x =\n (x = InvokeDomain tptr domain)\"\n| \"inv_relation (Invocations_A.InvokeIRQControl i) x =\n (\\i'. irq_control_inv_relation i i' \\ x = InvokeIRQControl i')\"\n| \"inv_relation (Invocations_A.InvokeIRQHandler i) x =\n (\\i'. irq_handler_inv_relation i i' \\ x = InvokeIRQHandler i')\"\n| \"inv_relation (Invocations_A.InvokeCNode i) x =\n (\\i'. cnodeinv_relation i i' \\ x = InvokeCNode i')\"\n| \"inv_relation (Invocations_A.InvokeArchObject i) x =\n (\\i'. archinv_relation i i' \\ x = InvokeArchObject i')\"\n\n(* In order to assert conditions that must hold for the appropriate\n handleInvocation and handle_invocation calls to succeed, we must have\n some notion of what a valid invocation is.\n This function defines that.\n For example, a InvokeEndpoint requires an endpoint at its first\n constructor argument. *)\n\nprimrec\n valid_invocation' :: \"Invocations_H.invocation \\ kernel_state \\ bool\"\nwhere\n \"valid_invocation' (Invocations_H.InvokeUntyped i) = valid_untyped_inv' i\"\n| \"valid_invocation' (Invocations_H.InvokeEndpoint w w2 b c) = (ep_at' w and ex_nonz_cap_to' w)\"\n| \"valid_invocation' (Invocations_H.InvokeNotification w w2) = (ntfn_at' w and ex_nonz_cap_to' w)\"\n| \"valid_invocation' (Invocations_H.InvokeTCB i) = tcb_inv_wf' i\"\n| \"valid_invocation' (Invocations_H.InvokeDomain thread domain) =\n (tcb_at' thread and K (domain \\ maxDomain))\"\n| \"valid_invocation' (Invocations_H.InvokeReply thread slot grant) =\n (tcb_at' thread and cte_wp_at' (\\cte. \\gr. cteCap cte = ReplyCap thread False gr) slot)\"\n| \"valid_invocation' (Invocations_H.InvokeIRQControl i) = irq_control_inv_valid' i\"\n| \"valid_invocation' (Invocations_H.InvokeIRQHandler i) = irq_handler_inv_valid' i\"\n| \"valid_invocation' (Invocations_H.InvokeCNode i) = valid_cnode_inv' i\"\n| \"valid_invocation' (Invocations_H.InvokeArchObject i) = valid_arch_inv' i\"\n\n\n(* FIXME: move *)\nlemma dec_domain_inv_corres:\n shows \"\\ list_all2 cap_relation (map fst cs) (map fst cs');\n list_all2 (\\p pa. snd pa = cte_map (snd p)) cs cs' \\ \\\n corres (ser \\ ((\\x. inv_relation x \\ uncurry Invocations_H.invocation.InvokeDomain) \\ (\\(x,y). Invocations_A.invocation.InvokeDomain x y))) \\ \\\n (decode_domain_invocation label args cs)\n (decodeDomainInvocation label args cs')\"\n apply (simp add: decode_domain_invocation_def decodeDomainInvocation_def)\n apply (rule whenE_throwError_corres_initial)\n apply (simp+)[2]\n apply (case_tac \"args\", simp_all)\n apply (rule corres_guard_imp)\n apply (rule_tac r'=\"\\domain domain'. domain = domain'\" and R=\"\\_. \\\" and R'=\"\\_. \\\" in corres_splitEE)\n apply (rule whenE_throwError_corres_initial)\n apply simp\n apply (case_tac \"cs\")\n apply ((case_tac \"cs'\", ((simp add: null_def)+)[2])+)[2]\n apply (subgoal_tac \"cap_relation (fst (hd cs)) (fst (hd cs'))\")\n apply (case_tac \"fst (hd cs)\")\n apply (case_tac \"fst (hd cs')\", simp+, rule corres_returnOkTT)\n apply (simp add: inv_relation_def o_def uncurry_def)\n apply (case_tac \"fst (hd cs')\", fastforce+)\n apply (case_tac \"cs\")\n apply (case_tac \"cs'\", ((simp add: list_all2_map2 list_all2_map1)+)[2])\n apply (case_tac \"cs'\", ((simp add: list_all2_map2 list_all2_map1)+)[2])\n apply (rule whenE_throwError_corres)\n apply (simp+)[2]\n apply (rule corres_returnOkTT)\n apply (wp | simp)+\ndone\n\nlemma decode_invocation_corres:\n \"\\cptr = to_bl cptr'; mi' = message_info_map mi;\n slot' = cte_map slot; cap_relation cap cap';\n args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps');\n list_all2 (\\p pa. snd pa = cte_map (snd p)) excaps excaps' \\\n \\\n corres (ser \\ inv_relation)\n (invs and valid_sched and valid_list\n and valid_cap cap and cte_at slot and cte_wp_at ((=) cap) slot\n and (\\s. \\x\\set excaps. s \\ fst x \\ cte_at (snd x) s)\n and (\\s. length args < 2 ^ word_bits))\n (invs' and valid_cap' cap' and cte_at' slot'\n and (\\s. \\x\\set excaps'. s \\' fst x \\ cte_at' (snd x) s))\n (decode_invocation (mi_label mi) args cptr slot cap excaps)\n (RetypeDecls_H.decodeInvocation (mi_label mi) args' cptr' slot' cap' excaps')\"\n apply (rule corres_gen_asm)\n apply (unfold decode_invocation_def decodeInvocation_def)\n apply (case_tac cap, simp_all only: cap.simps)\n \\ \\dammit, simp_all messes things up, must handle cases manually\\\n \\ \\Null\\\n apply (simp add: isCap_defs)\n \\ \\Untyped\\\n apply (simp add: isCap_defs Let_def o_def split del: if_split)\n apply (rule corres_guard_imp, rule dec_untyped_inv_corres)\n apply ((clarsimp simp:cte_wp_at_caps_of_state)+)[3]\n \\ \\(Async)Endpoint\\\n apply (simp add: isCap_defs returnOk_def)\n apply (simp add: isCap_defs)\n apply (clarsimp simp: returnOk_def neq_Nil_conv)\n \\ \\ReplyCap\\\n apply (simp add: isCap_defs Let_def returnOk_def)\n \\ \\CNodeCap\\\n apply (rename_tac word nat list)\n apply (simp add: isCap_defs Let_def CanModify_def\n split del: if_split cong: if_cong)\n apply (clarsimp simp add: o_def)\n apply (rule corres_guard_imp)\n apply (rule_tac F=\"length list \\ 64\" in corres_gen_asm)\n apply (rule dec_cnode_inv_corres, simp+)\n apply (simp add: valid_cap_def word_bits_def)\n apply simp\n \\ \\ThreadCap\\\n apply (simp add: isCap_defs Let_def CanModify_def\n split del: if_split cong: if_cong)\n apply (clarsimp simp add: o_def)\n apply (rule corres_guard_imp)\n apply (rule decode_tcb_inv_corres, rule refl,\n simp_all add: valid_cap_def valid_cap'_def)[3]\n apply (simp add: split_def)\n apply (rule list_all2_conj)\n apply (simp add: list_all2_map2 list_all2_map1)\n apply assumption\n \\ \\DomainCap\\\n apply (simp add: isCap_defs)\n apply (rule corres_guard_imp)\n apply (rule dec_domain_inv_corres)\n apply (simp+)[4]\n \\ \\IRQControl\\\n apply (simp add: isCap_defs o_def)\n apply (rule corres_guard_imp, rule decode_irq_control_corres, simp+)[1]\n \\ \\IRQHandler\\\n apply (simp add: isCap_defs o_def)\n apply (rule corres_guard_imp, rule decode_irq_handler_corres, simp+)[1]\n \\ \\Zombie\\\n apply (simp add: isCap_defs)\n \\ \\Arch\\\n apply (clarsimp simp only: cap_relation.simps)\n apply (clarsimp simp add: isCap_defs Let_def o_def)\n apply (rule corres_guard_imp [OF dec_arch_inv_corres])\n apply (simp_all add: list_all2_map2 list_all2_map1)+\n done\n\ndeclare mapME_Nil [simp]\n\ncrunch inv' [wp]: lookupCapAndSlot P\n\nlemma hinv_corres_assist:\n \"\\ info' = message_info_map info \\\n \\ corres (fr \\ (\\(p, cap, extracaps, buffer) (p', capa, extracapsa, buffera).\n p' = cte_map p \\ cap_relation cap capa \\ buffer = buffera \\\n list_all2\n (\\x y. cap_relation (fst x) (fst y) \\ snd y = cte_map (snd x))\n extracaps extracapsa))\n\n (invs and tcb_at thread and (\\_. valid_message_info info))\n (invs' and tcb_at' thread)\n (doE (cap, slot) \\\n cap_fault_on_failure cptr' False\n (lookup_cap_and_slot thread (to_bl cptr'));\n do\n buffer \\ lookup_ipc_buffer False thread;\n doE extracaps \\ lookup_extra_caps thread buffer info;\n returnOk (slot, cap, extracaps, buffer)\n odE\n od\n odE)\n (doE (cap, slot) \\ capFaultOnFailure cptr' False (lookupCapAndSlot thread cptr');\n do buffer \\ VSpace_H.lookupIPCBuffer False thread;\n doE extracaps \\ lookupExtraCaps thread buffer info';\n returnOk (slot, cap, extracaps, buffer)\n odE\n od\n odE)\"\n apply (clarsimp simp add: split_def)\n apply (rule corres_guard_imp)\n apply (rule corres_splitEE [OF _ corres_cap_fault])\n prefer 2\n \\ \\switched over to argument of corres_cap_fault\\\n apply (rule lcs_corres, simp)\n apply (rule corres_split [OF _ lipcb_corres])\n apply (rule corres_splitEE [OF _ lec_corres])\n apply (rule corres_returnOkTT)\n apply simp+\n apply (wp | simp)+\n apply auto\n done\n\nlemma msg_from_syserr_map[simp]:\n \"msgFromSyscallError (syscall_error_map err) = msg_from_syscall_error err\"\n apply (simp add: msgFromSyscallError_def)\n apply (case_tac err,clarsimp+)\n done\n\n(* FIXME: move *)\nlemma non_exst_same_timeSlice_upd[simp]:\n \"non_exst_same tcb (tcbDomain_update f tcb)\"\n by (cases tcb, simp add: non_exst_same_def)\n\nlemma threadSet_tcbDomain_update_ct_idle_or_in_cur_domain':\n \"\\ct_idle_or_in_cur_domain' and (\\s. ksSchedulerAction s \\ ResumeCurrentThread) \\\n threadSet (tcbDomain_update (\\_. domain)) t\n \\\\_. ct_idle_or_in_cur_domain'\\\"\n apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (wp hoare_vcg_disj_lift hoare_vcg_imp_lift)\n apply (wp | wps)+\n apply (auto simp: obj_at'_def)\n done\n\nlemma threadSet_tcbDomain_update_ct_not_inQ:\n \"\\ct_not_inQ \\ threadSet (tcbDomain_update (\\_. domain)) t \\\\_. ct_not_inQ\\\"\n apply (simp add: threadSet_def ct_not_inQ_def)\n apply (wp)\n apply (rule hoare_convert_imp [OF setObject_nosch])\n apply (rule updateObject_tcb_inv)\n apply (wps setObject_ct_inv)\n apply (wp setObject_tcb_strongest getObject_tcb_wp)+\n apply (case_tac \"t = ksCurThread s\")\n apply (clarsimp simp: obj_at'_def)+\n done\n\n(* FIXME: move *)\nlemma setObject_F_ct_activatable':\n \"\\\\tcb f. tcbState (F f tcb) = tcbState tcb \\ \\ \\ct_in_state' activatable' and obj_at' ((=) tcb) t\\\n setObject t (F f tcb)\n \\\\_. ct_in_state' activatable'\\\"\n apply (clarsimp simp: ct_in_state'_def st_tcb_at'_def)\n apply (rule hoare_pre)\n apply (wps setObject_ct_inv)\n apply (wp setObject_tcb_strongest)\n apply (clarsimp simp: obj_at'_def)\n done\n\nlemmas setObject_tcbDomain_update_ct_activatable'[wp] = setObject_F_ct_activatable'[where F=\"tcbDomain_update\", simplified]\n\n(* FIXME: move *)\nlemma setObject_F_st_tcb_at':\n \"\\\\tcb f. tcbState (F f tcb) = tcbState tcb \\ \\ \\st_tcb_at' P t' and obj_at' ((=) tcb) t\\\n setObject t (F f tcb)\n \\\\_. st_tcb_at' P t'\\\"\n apply (simp add: st_tcb_at'_def)\n apply (rule hoare_pre)\n apply (wp setObject_tcb_strongest)\n apply (clarsimp simp: obj_at'_def)\n done\n\nlemmas setObject_tcbDomain_update_st_tcb_at'[wp] = setObject_F_st_tcb_at'[where F=\"tcbDomain_update\", simplified]\n\nlemma threadSet_tcbDomain_update_sch_act_wf[wp]:\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ sch_act_not t s\\\n threadSet (tcbDomain_update (\\_. domain)) t\n \\\\_ s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (simp add: sch_act_wf_cases split: scheduler_action.split)\n apply (wp hoare_vcg_conj_lift)\n apply (simp add: threadSet_def)\n apply wp\n apply (wps setObject_sa_unchanged)\n apply (wp static_imp_wp getObject_tcb_wp hoare_vcg_all_lift)+\n apply (rename_tac word)\n apply (rule_tac Q=\"\\_ s. ksSchedulerAction s = SwitchToThread word \\\n st_tcb_at' runnable' word s \\ tcb_in_cur_domain' word s \\ word \\ t\"\n in hoare_strengthen_post)\n apply (wp hoare_vcg_all_lift hoare_vcg_conj_lift hoare_vcg_imp_lift)+\n apply (simp add: threadSet_def)\n apply (wp getObject_tcb_wp threadSet_tcbDomain_triv')+\n apply (auto simp: obj_at'_def)\n done\n\nlemma set_domain_setDomain_corres:\n \"corres dc\n (valid_etcbs and valid_sched and tcb_at tptr)\n (invs' and sch_act_simple\n and tcb_at' tptr and (\\s. new_dom \\ maxDomain))\n (set_domain tptr new_dom)\n (setDomain tptr new_dom)\"\n apply (rule corres_gen_asm2)\n apply (simp add: set_domain_def setDomain_def thread_set_domain_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF _ gct_corres])\n apply (rule corres_split[OF _ tcbSchedDequeue_corres])\n apply (rule corres_split[OF _ ethread_set_corres])\n apply (rule corres_split[OF _ gts_isRunnable_corres])\n apply simp\n apply (rule corres_split[OF corres_when[OF refl]])\n apply (rule rescheduleRequired_corres)\n apply clarsimp\n apply (rule corres_when[OF refl])\n apply (rule tcbSchedEnqueue_corres)\n apply (wp hoare_drop_imps hoare_vcg_conj_lift | clarsimp| assumption)+\n apply (clarsimp simp: etcb_relation_def)\n apply ((wp hoare_vcg_conj_lift hoare_vcg_disj_lift | clarsimp)+)[1]\n apply clarsimp\n apply (rule_tac Q=\"\\_. valid_objs' and valid_queues' and valid_queues and\n (\\s. sch_act_wf (ksSchedulerAction s) s) and tcb_at' tptr\"\n in hoare_strengthen_post[rotated])\n apply (auto simp: invs'_def valid_state'_def sch_act_wf_weak st_tcb_at'_def o_def)[1]\n apply (wp threadSet_valid_objs' threadSet_valid_queues'_no_state\n threadSet_valid_queues_no_state\n threadSet_pred_tcb_no_state | simp)+\n apply (rule_tac Q = \"\\r s. invs' s \\ (\\p. tptr \\ set (ksReadyQueues s p)) \\ sch_act_simple s\n \\ tcb_at' tptr s\" in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def valid_pspace'_def sch_act_simple_def)\n apply (clarsimp simp:valid_tcb'_def)\n apply (drule(1) bspec)\n apply (clarsimp simp:tcb_cte_cases_def)\n apply fastforce\n apply (wp hoare_vcg_all_lift Tcb_R.tcbSchedDequeue_not_in_queue)+\n apply clarsimp\n apply (frule tcb_at_is_etcb_at)\n apply simp+\n apply (auto elim: tcb_at_is_etcb_at valid_objs'_maxDomain valid_objs'_maxPriority pred_tcb'_weakenE\n simp: valid_sched_def valid_sched_action_def)\n done\n\n\nlemma pinv_corres:\n \"\\ inv_relation i i'; call \\ block \\ \\\n corres (intr \\ (=))\n (einvs and valid_invocation i\n and simple_sched_action\n and ct_active\n and (\\s. (\\w w2 b c. i = Invocations_A.InvokeEndpoint w w2 b c) \\ st_tcb_at simple (cur_thread s) s))\n (invs' and sch_act_simple and valid_invocation' i' and ct_active')\n (perform_invocation block call i) (performInvocation block call i')\"\n apply (simp add: performInvocation_def)\n apply (case_tac i)\n apply (clarsimp simp: o_def liftE_bindE)\n apply (rule corres_guard_imp)\n apply (rule corres_split_norE[OF corres_returnOkTT])\n apply simp\n apply (rule corres_rel_imp, rule inv_untyped_corres)\n apply simp\n apply (case_tac x, simp_all)[1]\n apply wp+\n apply simp+\n apply (rule corres_guard_imp)\n apply (rule corres_split [OF _ gct_corres])\n apply simp\n apply (rule corres_split [OF _ send_ipc_corres])\n apply (rule corres_trivial)\n apply simp\n apply simp\n apply wp+\n apply (clarsimp simp: ct_in_state_def)\n apply (fastforce elim: st_tcb_ex_cap)\n apply (clarsimp simp: pred_conj_def invs'_def cur_tcb'_def simple_sane_strg\n sch_act_simple_def)\n apply (rule corres_guard_imp)\n apply (simp add: liftE_bindE)\n apply (rule corres_split [OF _ send_signal_corres])\n apply (rule corres_trivial)\n apply (simp add: returnOk_def)\n apply wp+\n apply (simp+)[2]\n apply simp\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr [OF _ gct_corres])\n apply (rule corres_split_nor [OF _ do_reply_transfer_corres'])\n apply (rule corres_trivial, simp)\n apply wp+\n apply (clarsimp simp: tcb_at_invs)\n apply (clarsimp simp: invs_def valid_state_def valid_pspace_def)\n apply (erule cte_wp_at_weakenE, fastforce simp: is_reply_cap_to_def)\n apply (clarsimp simp: tcb_at_invs')\n apply (fastforce elim!: cte_wp_at_weakenE')\n apply (clarsimp simp: liftME_def)\n apply (rule corres_guard_imp)\n apply (erule tcbinv_corres)\n apply (simp)+\n \\ \\domain cap\\\n apply (clarsimp simp: invoke_domain_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split [OF _ set_domain_setDomain_corres])\n apply (rule corres_trivial, simp)\n apply (wp)+\n apply (clarsimp+)[2]\n \\ \\CNodes\\\n apply clarsimp\n apply (rule corres_guard_imp)\n apply (rule corres_splitEE [OF _ inv_cnode_corres])\n apply (rule corres_trivial, simp add: returnOk_def)\n apply assumption\n apply wp+\n apply (clarsimp+)[2]\n apply (clarsimp simp: liftME_def[symmetric] o_def dc_def[symmetric])\n apply (rule corres_guard_imp, rule invoke_irq_control_corres, simp+)\n apply (clarsimp simp: liftME_def[symmetric] o_def dc_def[symmetric])\n apply (rule corres_guard_imp, rule invoke_irq_handler_corres, simp+)\n apply clarsimp\n apply (rule corres_guard_imp)\n apply (rule inv_arch_corres, assumption)\n apply (clarsimp+)[2]\n done\n\nlemma sendSignal_tcb_at'[wp]:\n \"\\tcb_at' t\\\n sendSignal ntfnptr bdg\n \\\\rv. tcb_at' t\\\"\n apply (simp add: sendSignal_def\n cong: list.case_cong Structures_H.notification.case_cong)\n apply (wp ntfn'_cases_weak_wp list_cases_weak_wp hoare_drop_imps | wpc | simp)+\n done\n\nlemmas checkCap_inv_typ_at'\n = checkCap_inv[where P=\"\\s. P (typ_at' T p s)\" for P T p]\n\ncrunches restart, bindNotification, performTransfer\n for typ_at'[wp]: \"\\s. P (typ_at' T p s)\"\n\nlemma invokeTCB_typ_at'[wp]:\n \"\\\\s. P (typ_at' T p s)\\\n invokeTCB tinv\n \\\\rv s. P (typ_at' T p s)\\\"\n apply (cases tinv,\n simp_all add: invokeTCB_def\n getThreadBufferSlot_def locateSlot_conv\n split del: if_split)\n apply (simp only: cases_simp if_cancel simp_thms conj_comms pred_conj_def\n Let_def split_def getThreadVSpaceRoot\n | (simp split del: if_split cong: if_cong)\n | (wp mapM_x_wp[where S=UNIV, simplified]\n checkCap_inv_typ_at'\n case_options_weak_wp)[1]\n | wpcw)+\n done\n\nlemmas invokeTCB_typ_ats[wp] = typ_at_lifts [OF invokeTCB_typ_at']\n\ncrunch typ_at'[wp]: doReplyTransfer \"\\s. P (typ_at' T p s)\"\n (wp: hoare_drop_imps)\n\nlemmas doReplyTransfer_typ_ats[wp] = typ_at_lifts [OF doReplyTransfer_typ_at']\n\ncrunch typ_at'[wp]: \"performIRQControl\" \"\\s. P (typ_at' T p s)\"\n\nlemmas invokeIRQControl_typ_ats[wp] =\n typ_at_lifts [OF performIRQControl_typ_at']\n\ncrunch typ_at'[wp]: invokeIRQHandler \"\\s. P (typ_at' T p s)\"\n\nlemmas invokeIRQHandler_typ_ats[wp] =\n typ_at_lifts [OF invokeIRQHandler_typ_at']\n\ncrunch tcb_at'[wp]: setDomain \"tcb_at' tptr\"\n (simp: crunch_simps)\n\nlemma pinv_tcb'[wp]:\n \"\\invs' and st_tcb_at' active' tptr\n and valid_invocation' i and ct_active'\\\n RetypeDecls_H.performInvocation block call i\n \\\\rv. tcb_at' tptr\\\"\n apply (simp add: performInvocation_def)\n apply (case_tac i, simp_all)\n apply (wp invokeArch_tcb_at' | clarsimp simp: pred_tcb_at')+\n done\n\nlemma sts_cte_at[wp]:\n \"\\cte_at' p\\ setThreadState st t \\\\rv. cte_at' p\\\"\n apply (simp add: setThreadState_def)\n apply (wp|simp)+\n done\n\ncrunch obj_at_ntfn[wp]: setThreadState \"obj_at' (\\ntfn. P (ntfnBoundTCB ntfn) (ntfnObj ntfn)) ntfnptr\"\n (wp: obj_at_setObject2 crunch_wps\n simp: crunch_simps updateObject_default_def in_monad)\n\nlemma sts_mcpriority_tcb_at'[wp]:\n \"\\mcpriority_tcb_at' P t\\\n setThreadState st t'\n \\\\_. mcpriority_tcb_at' P t\\\"\n apply (cases \"t = t'\",\n simp_all add: setThreadState_def\n split del: if_split)\n apply ((wp threadSet_pred_tcb_at_state | simp)+)[1]\n apply (wp threadSet_obj_at'_really_strongest\n | simp add: pred_tcb_at'_def)+\n done\n\nlemma sts_valid_inv'[wp]:\n \"\\valid_invocation' i\\ setThreadState st t \\\\rv. valid_invocation' i\\\"\n apply (case_tac i, simp_all add: sts_valid_untyped_inv' sts_valid_arch_inv')\n apply (wp | simp)+\n defer\n apply (rename_tac cnode_invocation)\n apply (case_tac cnode_invocation, simp_all add: cte_wp_at_ctes_of)\n apply (wp | simp)+\n apply (rename_tac irqcontrol_invocation)\n apply (case_tac irqcontrol_invocation, simp_all)\n apply (rename_tac archirq_inv)\n apply (case_tac archirq_inv; simp)\n apply (wp | simp add: irq_issued'_def)+\n apply (rename_tac irqhandler_invocation)\n apply (case_tac irqhandler_invocation, simp_all)\n apply (wp hoare_vcg_ex_lift ex_cte_cap_to'_pres | simp)+\n apply (rename_tac tcbinvocation)\n apply (case_tac tcbinvocation,\n simp_all add: setThreadState_tcb',\n auto intro!: hoare_vcg_conj_lift hoare_vcg_disj_lift\n simp only: imp_conv_disj simp_thms pred_conj_def,\n auto intro!: hoare_vcg_prop\n sts_cap_to' sts_cte_cap_to'\n setThreadState_typ_ats\n split: option.splits)[1]\n apply (wp sts_bound_tcb_at' hoare_vcg_all_lift hoare_vcg_const_imp_lift)+\n done\n\n(* FIXME: move to TCB *)\ncrunch inv[wp]: decodeDomainInvocation P\n (wp: crunch_wps simp: crunch_simps)\n\nlemma decode_inv_inv'[wp]:\n \"\\P\\ decodeInvocation label args cap_index slot cap excaps \\\\rv. P\\\"\n apply (simp add: decodeInvocation_def Let_def\n split del: if_split\n cong: if_cong)\n apply (rule hoare_pre)\n apply (wp decodeTCBInvocation_inv |\n simp only: o_def |\n clarsimp split: capability.split_asm simp: isCap_defs)+\n done\n\n(* FIXME: move to TCB *)\nlemma dec_dom_inv_wf[wp]:\n \"\\invs' and (\\s. \\x \\ set excaps. s \\' fst x)\\\n decodeDomainInvocation label args excaps\n \\\\x s. tcb_at' (fst x) s \\ snd x \\ maxDomain\\, -\"\n apply (simp add:decodeDomainInvocation_def)\n apply (wp whenE_throwError_wp | wpc |simp)+\n apply clarsimp\n apply (drule_tac x = \"hd excaps\" in bspec)\n apply (rule hd_in_set)\n apply (simp add:null_def)\n apply (simp add:valid_cap'_def)\n apply (simp add:not_le)\n apply (simp add:ucast_nat_def[symmetric])\n apply (rule word_of_nat_le)\n apply (simp add:numDomains_def maxDomain_def)\n done\n\nlemma decode_inv_wf'[wp]:\n \"\\valid_cap' cap and invs' and sch_act_simple\n and cte_wp_at' ((=) cap \\ cteCap) slot and real_cte_at' slot\n and (\\s. \\r\\zobj_refs' cap. ex_nonz_cap_to' r s)\n and (\\s. \\r\\cte_refs' cap (irq_node' s). ex_cte_cap_to' r s)\n and (\\s. \\cap \\ set excaps. \\r\\cte_refs' (fst cap) (irq_node' s). ex_cte_cap_to' r s)\n and (\\s. \\cap \\ set excaps. \\r\\zobj_refs' (fst cap). ex_nonz_cap_to' r s)\n and (\\s. \\x \\ set excaps. cte_wp_at' ((=) (fst x) o cteCap) (snd x) s)\n and (\\s. \\x \\ set excaps. s \\' fst x)\n and (\\s. \\x \\ set excaps. real_cte_at' (snd x) s)\n and (\\s. \\x \\ set excaps. ex_cte_cap_wp_to' isCNodeCap (snd x) s)\n and (\\s. \\x \\ set excaps. cte_wp_at' (badge_derived' (fst x) o cteCap) (snd x) s)\\\n decodeInvocation label args cap_index slot cap excaps\n \\valid_invocation'\\,-\"\n apply (case_tac cap,\n simp_all add: decodeInvocation_def Let_def isCap_defs uncurry_def split_def\n split del: if_split\n cong: if_cong)\n apply ((rule hoare_pre,\n ((wpsimp wp: decodeTCBInv_wf simp: o_def)+)[1],\n clarsimp simp: valid_cap'_def cte_wp_at_ctes_of)\n | intro exI | simp)+\n done\n\nlemma ct_active_imp_simple'[elim!]:\n \"ct_active' s \\ st_tcb_at' simple' (ksCurThread s) s\"\n by (clarsimp simp: ct_in_state'_def\n elim!: pred_tcb'_weakenE)\n\nlemma ct_running_imp_simple'[elim!]:\n \"ct_running' s \\ st_tcb_at' simple' (ksCurThread s) s\"\n by (clarsimp simp: ct_in_state'_def\n elim!: pred_tcb'_weakenE)\n\nlemma active_ex_cap'[elim]:\n \"\\ ct_active' s; if_live_then_nonz_cap' s \\\n \\ ex_nonz_cap_to' (ksCurThread s) s\"\n by (fastforce simp: ct_in_state'_def elim!: st_tcb_ex_cap'')\n\ncrunch st_tcb'[wp]: handleFaultReply \"st_tcb_at' P t\"\ncrunch it[wp]: handleFaultReply \"\\s. P (ksIdleThread s)\"\n\nlemma handleFaultReply_invs[wp]:\n \"\\invs' and tcb_at' t\\ handleFaultReply x t label msg \\\\rv. invs'\\\"\n apply (simp add: handleFaultReply_def)\n apply (case_tac x, simp_all)\n apply (wp | clarsimp simp: handleArchFaultReply_def\n split: arch_fault.split)+\n done\n\ncrunch sch_act_simple[wp]: handleFaultReply sch_act_simple\n (wp: crunch_wps)\n\nlemma transferCaps_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n transferCaps info caps ep rcvr rcvBuf\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\nproof -\n have CTEF: \"\\P p s. \\ cte_wp_at' P p s; \\cte. P cte \\ False \\ \\ False\"\n by (erule cte_wp_atE', auto)\n show ?thesis\n unfolding transferCaps_def\n apply (wp | wpc)+\n apply (rule transferCapsToSlots_pres2)\n apply (rule hoare_weaken_pre [OF cteInsert_weak_cte_wp_at3])\n apply (rule PUC,simp)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (wp hoare_vcg_all_lift static_imp_wp | simp add:ball_conj_distrib)+\n done\nqed\n\ncrunch cte_wp_at' [wp]: setMessageInfo \"cte_wp_at' P p\"\n\nlemma copyMRs_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\ copyMRs sender sendBuf receiver recvBuf n \\\\_. cte_wp_at' P ptr\\\"\n unfolding copyMRs_def\n apply (wp mapM_wp | wpc | simp add: split_def | rule equalityD1)+\n done\n\nlemma doNormalTransfer_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows\n \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n doNormalTransfer st send_buffer ep b gr rt recv_buffer\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\n unfolding doNormalTransfer_def\n apply (wp transferCaps_non_null_cte_wp_at' | simp add:PUC)+\n done\n\nlemma setMRs_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\ setMRs thread buffer messageData \\\\_. cte_wp_at' P ptr\\\"\n by (simp add: setMRs_def zipWithM_x_mapM split_def, wp crunch_wps)\n\nlemma doFaultTransfer_cte_wp_at'[wp]:\n \"\\cte_wp_at' P ptr\\\n doFaultTransfer badge sender receiver receiverIPCBuffer\n \\\\_. cte_wp_at' P ptr\\\"\n unfolding doFaultTransfer_def\n apply (wp | wpc | simp add: split_def)+\n done\n\nlemma doIPCTransfer_non_null_cte_wp_at':\n assumes PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows\n \"\\cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\n doIPCTransfer sender endpoint badge grant receiver\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap) ptr\\\"\n unfolding doIPCTransfer_def\n apply (wp doNormalTransfer_non_null_cte_wp_at' hoare_drop_imp hoare_allI | wpc | clarsimp simp:PUC)+\n done\n\nlemma doIPCTransfer_non_null_cte_wp_at2':\n fixes P\n assumes PNN: \"\\cte. P (cteCap cte) \\ cteCap cte \\ capability.NullCap\"\n and PUC: \"\\cap. P cap \\ \\ isUntypedCap cap\"\n shows \"\\cte_wp_at' (\\cte. P (cteCap cte)) ptr\\\n doIPCTransfer sender endpoint badge grant receiver\n \\\\_. cte_wp_at' (\\cte. P (cteCap cte)) ptr\\\"\n proof -\n have PimpQ: \"\\P Q ptr s. \\ cte_wp_at' (\\cte. P (cteCap cte)) ptr s;\n \\cte. P (cteCap cte) \\ Q (cteCap cte) \\\n \\ cte_wp_at' (\\cte. P (cteCap cte) \\ Q (cteCap cte)) ptr s\"\n by (erule cte_wp_at_weakenE', clarsimp)\n show ?thesis\n apply (rule hoare_chain [OF doIPCTransfer_non_null_cte_wp_at'])\n apply (erule PUC)\n apply (erule PimpQ)\n apply (drule PNN, clarsimp)\n apply (erule cte_wp_at_weakenE')\n apply (clarsimp)\n done\n qed\n\nlemma st_tcb_at'_eqD:\n \"\\ st_tcb_at' (\\s. s = st) t s; st_tcb_at' (\\s. s = st') t s \\ \\ st = st'\"\n by (clarsimp simp add: pred_tcb_at'_def obj_at'_def)\n\nlemma isReply_awaiting_reply':\n \"isReply st = awaiting_reply' st\"\n by (case_tac st, (clarsimp simp add: isReply_def)+)\n\nlemma doReply_invs[wp]:\n \"\\tcb_at' t and tcb_at' t' and\n cte_wp_at' (\\cte. \\grant. cteCap cte = ReplyCap t False grant) slot and\n invs' and sch_act_simple\\\n doReplyTransfer t' t slot grant\n \\\\rv. invs'\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (rule hoare_seq_ext [OF _ gts_sp'])\n apply (rule hoare_seq_ext [OF _ assert_sp])\n apply (rule hoare_seq_ext [OF _ getCTE_sp])\n apply (wp, wpc)\n apply (wp)\n apply (wp (once) sts_invs_minor'')\n apply (simp)\n apply (wp (once) sts_st_tcb')\n apply (wp)[1]\n apply (rule_tac Q=\"\\rv s. invs' s\n \\ t \\ ksIdleThread s\n \\ st_tcb_at' awaiting_reply' t s\"\n in hoare_post_imp)\n apply (clarsimp)\n apply (frule_tac t=t in invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, rule impI, erule pred_tcb'_weakenE, case_tac st)\n apply (clarsimp | drule(1) obj_at_conj')+\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def)\n apply (drule(1) pred_tcb_at_conj')\n apply (subgoal_tac \"st_tcb_at' (\\_. False) (ksCurThread s) s\")\n apply (clarsimp)\n apply (erule_tac P=\"\\st. awaiting_reply' st \\ activatable' st\"\n in pred_tcb'_weakenE)\n apply (case_tac st, clarsimp+)\n apply (wp cteDeleteOne_reply_pred_tcb_at)+\n apply (clarsimp)\n apply (rule_tac Q=\"\\_. (\\s. t \\ ksIdleThread s)\n and cte_wp_at' (\\cte. \\grant. cteCap cte = capability.ReplyCap t False grant) slot\"\n in hoare_strengthen_post [rotated])\n apply (fastforce simp: cte_wp_at'_def)\n apply (wp)\n apply (rule hoare_strengthen_post [OF doIPCTransfer_non_null_cte_wp_at'])\n apply (erule conjE)\n apply assumption\n apply (erule cte_wp_at_weakenE')\n apply (fastforce)\n apply (wp sts_invs_minor'' sts_st_tcb' static_imp_wp)\n apply (rule_tac Q=\"\\rv s. invs' s \\ sch_act_simple s\n \\ st_tcb_at' awaiting_reply' t s\n \\ t \\ ksIdleThread s\"\n in hoare_post_imp)\n apply (clarsimp)\n apply (frule_tac t=t in invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, erule pred_tcb'_weakenE, case_tac st, clarsimp+)\n apply (rule conjI, rule impI, erule pred_tcb'_weakenE, case_tac st)\n apply (clarsimp | drule(1) obj_at_conj')+\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def)\n apply (drule(1) pred_tcb_at_conj')\n apply (subgoal_tac \"st_tcb_at' (\\_. False) (ksCurThread s) s\")\n apply (clarsimp)\n apply (erule_tac P=\"\\st. awaiting_reply' st \\ activatable' st\"\n in pred_tcb'_weakenE)\n apply (case_tac st, clarsimp+)\n apply (wp threadSet_invs_trivial threadSet_st_tcb_at2 static_imp_wp\n | clarsimp simp add: inQ_def)+\n apply (rule_tac Q=\"\\_. invs' and tcb_at' t\n and sch_act_simple and st_tcb_at' awaiting_reply' t\"\n in hoare_strengthen_post [rotated])\n apply (clarsimp)\n apply (rule conjI)\n apply (clarsimp simp add: invs'_def valid_state'_def valid_idle'_def)\n apply (rule conjI)\n apply clarsimp\n apply clarsimp\n apply (drule idle_tcb_at'_split, clarsimp, drule (1) st_tcb_at'_eqD, simp)\n apply clarsimp\n apply (rule conjI)\n apply (clarsimp simp add: invs'_def valid_state'_def valid_idle'_def)\n apply (erule pred_tcb'_weakenE, clarsimp)\n apply (rule conjI)\n apply (clarsimp simp add: invs'_def valid_state'_def valid_idle'_def pred_tcb_at'_def\n obj_at'_def)\n apply (rule conjI)\n apply clarsimp\n apply (frule invs'_not_runnable_not_queued)\n apply (erule pred_tcb'_weakenE, clarsimp)\n apply (frule (1) not_tcbQueued_not_ksQ)\n apply simp\n apply clarsimp\n apply (wp cteDeleteOne_reply_pred_tcb_at hoare_drop_imp hoare_allI)+\n apply (clarsimp simp add: isReply_awaiting_reply' cte_wp_at_ctes_of)\n apply (auto dest!: st_tcb_idle'[rotated] simp:isCap_simps)\n done\n\nlemma ct_active_runnable' [simp]:\n \"ct_active' s \\ ct_in_state' runnable' s\"\n by (fastforce simp: ct_in_state'_def elim!: pred_tcb'_weakenE)\n\nlemma valid_irq_node_tcbSchedEnqueue[wp]:\n \"\\\\s. valid_irq_node' (irq_node' s) s \\ tcbSchedEnqueue ptr\n \\\\rv s'. valid_irq_node' (irq_node' s') s'\\\"\n apply (rule hoare_pre)\n apply (simp add:valid_irq_node'_def )\n apply (wp hoare_unless_wp hoare_vcg_all_lift | wps)+\n apply (simp add:tcbSchedEnqueue_def)\n apply (wp hoare_unless_wp| simp)+\n apply (simp add:valid_irq_node'_def)\n done\n\nlemma rescheduleRequired_valid_queues_but_ct_domain:\n \"\\\\s. Invariants_H.valid_queues s \\ valid_objs' s\n \\ (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s) \\\n rescheduleRequired\n \\\\_. Invariants_H.valid_queues\\\"\n apply (simp add: rescheduleRequired_def)\n apply (wp | wpc | simp)+\n done\n\nlemma rescheduleRequired_valid_queues'_but_ct_domain:\n \"\\\\s. valid_queues' s\n \\ (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s)\n \\\n rescheduleRequired\n \\\\_. valid_queues'\\\"\n apply (simp add: rescheduleRequired_def)\n apply (wp | wpc | simp | fastforce simp: valid_queues'_def)+\n done\n\nlemma tcbSchedEnqueue_valid_action:\n \"\\\\s. \\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s\\\n tcbSchedEnqueue ptr\n \\\\rv s. \\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s\\\"\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift)\n apply clarsimp\n done\n\nabbreviation (input) \"all_invs_but_sch_extra \\\n \\s. valid_pspace' s \\ Invariants_H.valid_queues s \\\n sym_refs (state_refs_of' s) \\\n if_live_then_nonz_cap' s \\\n if_unsafe_then_cap' s \\\n valid_idle' s \\\n valid_global_refs' s \\\n valid_arch_state' s \\\n valid_irq_node' (irq_node' s) s \\\n valid_irq_handlers' s \\\n valid_irq_states' s \\\n irqs_masked' s \\\n valid_ioports' s \\\n valid_machine_state' s \\\n cur_tcb' s \\\n untyped_ranges_zero' s \\\n valid_queues' s \\ pspace_domain_valid s \\\n ksCurDomain s \\ maxDomain \\ valid_dom_schedule' s \\\n (\\x. ksSchedulerAction s = SwitchToThread x \\ st_tcb_at' runnable' x s)\"\n\n\nlemma rescheduleRequired_all_invs_but_extra:\n \"\\\\s. all_invs_but_sch_extra s\\\n rescheduleRequired \\\\_. invs'\\\"\n apply (simp add: invs'_def valid_state'_def)\n apply (rule hoare_pre)\n apply (wp add:rescheduleRequired_ct_not_inQ\n rescheduleRequired_sch_act'\n rescheduleRequired_valid_queues_but_ct_domain\n rescheduleRequired_valid_queues'_but_ct_domain\n valid_irq_node_lift valid_irq_handlers_lift'' valid_ioports_lift''\n irqs_masked_lift cur_tcb_lift)\n apply auto\n done\n\nlemma threadSet_all_invs_but_sch_extra:\n shows \"\\ tcb_at' t and (\\s. (\\p. t \\ set (ksReadyQueues s p))) and\n all_invs_but_sch_extra and sch_act_simple and\n K (ds \\ maxDomain) \\\n threadSet (tcbDomain_update (\\_. ds)) t\n \\\\rv. all_invs_but_sch_extra \\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (wp threadSet_valid_pspace'T_P[where P = False and Q = \\ and Q' = \\])\n apply (simp add:tcb_cte_cases_def)+\n apply (wp\n threadSet_valid_pspace'T_P\n threadSet_state_refs_of'T_P[where f'=id and P'=False and Q=\\ and g'=id and Q'=\\]\n threadSet_idle'T\n threadSet_global_refsT\n threadSet_cur\n irqs_masked_lift\n valid_irq_node_lift\n valid_irq_handlers_lift''\n valid_ioports_lift''\n threadSet_ctes_ofT\n threadSet_not_inQ\n threadSet_valid_queues'_no_state\n threadSet_tcbDomain_update_ct_idle_or_in_cur_domain'\n threadSet_valid_queues\n threadSet_valid_dom_schedule'\n threadSet_iflive'T\n threadSet_ifunsafe'T\n untyped_ranges_zero_lift\n | simp add:tcb_cte_cases_def cteCaps_of_def o_def)+\n apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift threadSet_pred_tcb_no_state | simp)+\n apply (clarsimp simp:sch_act_simple_def o_def cteCaps_of_def)\n apply (intro conjI)\n apply fastforce+\n done\n\nlemma threadSet_not_curthread_ct_domain:\n \"\\\\s. ptr \\ ksCurThread s \\ ct_idle_or_in_cur_domain' s\\ threadSet f ptr \\\\rv. ct_idle_or_in_cur_domain'\\\"\n apply (simp add:ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (wp hoare_vcg_imp_lift hoare_vcg_disj_lift | wps)+\n apply clarsimp\n done\n\nlemma setDomain_invs':\n \"\\invs' and sch_act_simple and ct_active' and\n (tcb_at' ptr and\n (\\s. sch_act_not ptr s) and\n (\\y. domain \\ maxDomain))\\\n setDomain ptr domain \\\\y. invs'\\\"\n apply (simp add:setDomain_def )\n apply (wp add: hoare_when_wp static_imp_wp static_imp_conj_wp rescheduleRequired_all_invs_but_extra\n tcbSchedEnqueue_valid_action hoare_vcg_if_lift2)\n apply (rule_tac Q = \"\\r s. all_invs_but_sch_extra s \\ curThread = ksCurThread s\n \\ (ptr \\ curThread \\ ct_not_inQ s \\ sch_act_wf (ksSchedulerAction s) s \\ ct_idle_or_in_cur_domain' s)\"\n in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def st_tcb_at'_def[symmetric] valid_pspace'_def)\n apply (erule st_tcb_ex_cap'')\n apply simp\n apply (case_tac st,simp_all)[1]\n apply (rule hoare_strengthen_post[OF hoare_vcg_conj_lift])\n apply (rule threadSet_all_invs_but_sch_extra)\n prefer 2\n apply clarsimp\n apply assumption\n apply (wp static_imp_wp threadSet_pred_tcb_no_state threadSet_not_curthread_ct_domain\n threadSet_tcbDomain_update_ct_not_inQ | simp)+\n apply (rule_tac Q = \"\\r s. invs' s \\ curThread = ksCurThread s \\ sch_act_simple s\n \\ domain \\ maxDomain\n \\ (ptr \\ curThread \\ ct_not_inQ s \\ sch_act_not ptr s)\"\n in hoare_strengthen_post[rotated])\n apply (clarsimp simp:invs'_def valid_state'_def)\n apply (wp hoare_vcg_imp_lift)+\n apply (clarsimp simp:invs'_def valid_pspace'_def valid_state'_def)+\n done\n\nlemma performInv_invs'[wp]:\n \"\\invs' and sch_act_simple\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\n and ct_active' and valid_invocation' i\\\n RetypeDecls_H.performInvocation block call i \\\\rv. invs'\\\"\n unfolding performInvocation_def\n apply (cases i)\n apply ((clarsimp simp: simple_sane_strg sch_act_simple_def\n ct_not_ksQ sch_act_sane_def\n | wp tcbinv_invs' arch_performInvocation_invs'\n setDomain_invs'\n | rule conjI | erule active_ex_cap')+)\n done\n\nlemma getSlotCap_to_refs[wp]:\n \"\\\\\\ getSlotCap ref \\\\rv s. \\r\\zobj_refs' rv. ex_nonz_cap_to' r s\\\"\n by (simp add: getSlotCap_def | wp)+\n\nlemma lcs_valid' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. s \\' fst x\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp|clarsimp simp: split_def)+\n done\n\nlemma lcs_ex_cap_to' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. \\r\\cte_refs' (fst x) (irq_node' s). ex_cte_cap_to' r s\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp | simp add: split_def)+\n done\n\nlemma lcs_ex_nonz_cap_to' [wp]:\n \"\\invs'\\ lookupCapAndSlot t xs \\\\x s. \\r\\zobj_refs' (fst x). ex_nonz_cap_to' r s\\, -\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp | simp add: split_def)+\n done\n\nlemma lcs_cte_at' [wp]:\n \"\\valid_objs'\\ lookupCapAndSlot t xs \\\\rv s. cte_at' (snd rv) s\\,-\"\n unfolding lookupCapAndSlot_def\n apply (rule hoare_pre)\n apply (wp|simp)+\n done\n\nlemma lec_ex_cap_to' [wp]:\n \"\\invs'\\\n lookupExtraCaps t xa mi\n \\\\rv s. (\\cap \\ set rv. \\r\\cte_refs' (fst cap) (irq_node' s). ex_cte_cap_to' r s)\\, -\"\n unfolding lookupExtraCaps_def\n apply (cases \"msgExtraCaps mi = 0\")\n apply simp\n apply (wp mapME_set | simp)+\n done\n\nlemma lec_ex_nonz_cap_to' [wp]:\n \"\\invs'\\\n lookupExtraCaps t xa mi\n \\\\rv s. (\\cap \\ set rv. \\r\\zobj_refs' (fst cap). ex_nonz_cap_to' r s)\\, -\"\n unfolding lookupExtraCaps_def\n apply (cases \"msgExtraCaps mi = 0\")\n apply simp\n apply (wp mapME_set | simp)+\n done\n\n(* FIXME: move *)\nlemma getSlotCap_eq [wp]:\n \"\\\\\\ getSlotCap slot\n \\\\cap. cte_wp_at' ((=) cap \\ cteCap) slot\\\"\n by (wpsimp wp: getCTE_wp' simp: getSlotCap_def cte_wp_at_ctes_of)\n\nlemma lcs_eq [wp]:\n \"\\\\\\ lookupCapAndSlot t cptr \\\\rv. cte_wp_at' ((=) (fst rv) \\ cteCap) (snd rv)\\,-\"\n by (wpsimp simp: lookupCapAndSlot_def)\n\nlemma lec_dimished'[wp]:\n \"\\\\\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. cte_wp_at' ((=) (fst x) o cteCap) (snd x) s)\\,-\"\n by (wpsimp wp: mapME_set simp: lookupExtraCaps_def)\n\nlemma lookupExtras_real_ctes[wp]:\n \"\\valid_objs'\\ lookupExtraCaps t xs info \\\\rv s. \\x \\ set rv. real_cte_at' (snd x) s\\,-\"\n apply (simp add: lookupExtraCaps_def Let_def split del: if_split cong: if_cong)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp case_options_weak_wp mapM_wp' lsft_real_cte | simp)+\n done\n\nlemma lookupExtras_ctes[wp]:\n \"\\valid_objs'\\ lookupExtraCaps t xs info \\\\rv s. \\x \\ set rv. cte_at' (snd x) s\\,-\"\n apply (rule hoare_post_imp_R)\n apply (rule lookupExtras_real_ctes)\n apply (simp add: real_cte_at')\n done\n\nlemma lsft_ex_cte_cap_to':\n \"\\invs' and K (\\cap. isCNodeCap cap \\ P cap)\\\n lookupSlotForThread t cref\n \\\\rv s. ex_cte_cap_wp_to' P rv s\\,-\"\n apply (simp add: lookupSlotForThread_def split_def)\n apply (wp rab_cte_cap_to' getSlotCap_cap_to2 | simp)+\n done\n\nlemma lec_caps_to'[wp]:\n \"\\invs' and K (\\cap. isCNodeCap cap \\ P cap)\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. ex_cte_cap_wp_to' P (snd x) s)\\,-\"\n apply (simp add: lookupExtraCaps_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp lsft_ex_cte_cap_to' mapM_wp'\n | simp | wpc)+\n done\n\nlemma getSlotCap_badge_derived[wp]:\n \"\\\\\\ getSlotCap p \\\\cap. cte_wp_at' (badge_derived' cap \\ cteCap) p\\\"\n apply (simp add: getSlotCap_def)\n apply (wp getCTE_wp)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma lec_derived'[wp]:\n \"\\invs'\\\n lookupExtraCaps t buffer info\n \\\\rv s. (\\x\\set rv. cte_wp_at' (badge_derived' (fst x) o cteCap) (snd x) s)\\,-\"\n apply (simp add: lookupExtraCaps_def split del: if_split)\n apply (rule hoare_pre)\n apply (wp mapME_set)\n apply (simp add: lookupCapAndSlot_def split_def)\n apply (wp | simp)+\n done\n\nlemma get_mrs_length_rv[wp]:\n \"\\\\s. \\n. n \\ msg_max_length \\ P n\\ get_mrs thread buf mi \\\\rv s. P (length rv)\\\"\n apply (simp add: get_mrs_def)\n apply (rule hoare_pre)\n apply (wp mapM_length | wpc | simp del: upt.simps)+\n apply (clarsimp simp: msgRegisters_unfold\n msg_max_length_def)\n done\n\nlemma st_tcb_at_idle_thread':\n \"\\ st_tcb_at' P (ksIdleThread s) s; valid_idle' s \\\n \\ P IdleThreadState\"\n by (clarsimp simp: valid_idle'_def pred_tcb_at'_def obj_at'_def)\n\ncrunch tcb_at'[wp]: replyFromKernel \"tcb_at' t\"\n\nlemma invs_weak_sch_act_wf_strg:\n \"invs' s \\ weak_sch_act_wf (ksSchedulerAction s) s\"\n by clarsimp\n\n(* FIXME: move *)\nlemma rct_sch_act_simple[simp]:\n \"ksSchedulerAction s = ResumeCurrentThread \\ sch_act_simple s\"\n by (simp add: sch_act_simple_def)\n\n(* FIXME: move *)\nlemma rct_sch_act_sane[simp]:\n \"ksSchedulerAction s = ResumeCurrentThread \\ sch_act_sane s\"\n by (simp add: sch_act_sane_def)\n\nlemma lookupCapAndSlot_real_cte_at'[wp]:\n \"\\valid_objs'\\ lookupCapAndSlot thread ptr \\\\rv. real_cte_at' (snd rv)\\, -\"\napply (simp add: lookupCapAndSlot_def lookupSlotForThread_def)\napply (wp resolveAddressBits_real_cte_at' | simp add: split_def)+\ndone\n\nlemmas set_thread_state_active_valid_sched =\n set_thread_state_runnable_valid_sched[simplified runnable_eq_active]\n\n(*FIXME: move to NonDetMonadVCG.valid_validE_R *)\nlemma hinv_corres:\n \"c \\ b \\\n corres (intr \\ dc)\n (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and ct_active')\n (handle_invocation c b)\n (handleInvocation c b)\"\n apply (simp add: handle_invocation_def handleInvocation_def liftE_bindE)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr [OF _ gct_corres])\n apply (rule corres_split [OF _ get_mi_corres])\n apply clarsimp\n apply (simp add: liftM_def cap_register_def capRegister_def)\n apply (rule corres_split_eqr [OF _ user_getreg_corres])\n apply (rule syscall_corres)\n apply (rule hinv_corres_assist, simp)\n apply (clarsimp simp add: when_def)\n apply (rule hf_corres)\n apply simp\n apply (simp add: split_def)\n apply (rule corres_split [OF _ get_mrs_corres])\n apply (rule decode_invocation_corres, simp_all)[1]\n apply (fastforce simp: list_all2_map2 list_all2_map1 elim: list_all2_mono)\n apply (fastforce simp: list_all2_map2 list_all2_map1 elim: list_all2_mono)\n apply wp[1]\n apply (drule sym[OF conjunct1])\n apply simp\n apply wp[1]\n apply (clarsimp simp: when_def)\n apply (rule rfk_corres)\n apply (rule corres_split [OF _ sts_corres])\n apply (rule corres_splitEE [OF _ pinv_corres])\n apply simp\n apply (rule corres_split [OF _ gts_corres])\n apply (rename_tac state state')\n apply (case_tac state, simp_all)[1]\n apply (fold dc_def)[1]\n apply (rule corres_split [OF sts_corres])\n apply simp\n apply (rule corres_when [OF refl rfk_corres])\n apply (simp add: when_def)\n apply (rule conjI, rule impI)\n apply (rule reply_from_kernel_tcb_at)\n apply (rule impI, wp+)\n apply (simp)+\n apply (wp hoare_drop_imps)+\n apply (simp)\n apply (wp)\n apply (simp)\n apply simp\n apply (rule_tac Q=\"\\rv. einvs and simple_sched_action and valid_invocation rve\n and (\\s. thread = cur_thread s)\n and st_tcb_at active thread\"\n in hoare_post_imp)\n apply (clarsimp simp: simple_from_active ct_in_state_def\n elim!: st_tcb_weakenE)\n apply (wp sts_st_tcb_at' set_thread_state_simple_sched_action\n set_thread_state_active_valid_sched)\n apply (rule_tac Q=\"\\rv. invs' and valid_invocation' rve'\n and (\\s. thread = ksCurThread s)\n and st_tcb_at' active' thread\n and (\\s. ksSchedulerAction s = ResumeCurrentThread)\"\n in hoare_post_imp)\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (clarsimp)\n apply (wp setThreadState_nonqueued_state_update\n setThreadState_st_tcb setThreadState_rct)[1]\n apply (wp lec_caps_to lsft_ex_cte_cap_to\n | simp add: split_def liftE_bindE[symmetric]\n ct_in_state'_def ball_conj_distrib\n | rule hoare_vcg_E_elim)+\n apply (clarsimp simp: tcb_at_invs invs_valid_objs\n valid_tcb_state_def ct_in_state_def\n simple_from_active invs_mdb)\n apply (clarsimp simp: msg_max_length_def word_bits_def)\n apply (erule st_tcb_ex_cap, clarsimp+)\n apply fastforce\n apply (clarsimp)\n apply (frule tcb_at_invs')\n apply (clarsimp simp: invs'_def valid_state'_def\n ct_in_state'_def ct_not_inQ_def)\n apply (frule(1) valid_queues_not_tcbQueued_not_ksQ)\n apply (frule pred_tcb'_weakenE [where P=active' and P'=simple'], clarsimp)\n apply (frule(1) st_tcb_ex_cap'', fastforce)\n apply (clarsimp simp: valid_pspace'_def)\n apply (frule(1) st_tcb_at_idle_thread')\n apply (simp)\n done\n\nlemma ts_Restart_case_helper':\n \"(case ts of Structures_H.Restart \\ A | _ \\ B)\n = (if ts = Structures_H.Restart then A else B)\"\n by (cases ts, simp_all)\n\nlemma gts_imp':\n \"\\Q\\ getThreadState t \\R\\ \\\n \\\\s. st_tcb_at' P t s \\ Q s\\ getThreadState t \\\\rv s. P rv \\ R rv s\\\"\n apply (simp only: imp_conv_disj)\n apply (erule hoare_vcg_disj_lift[rotated])\n apply (rule hoare_strengthen_post [OF gts_sp'])\n apply (clarsimp simp: pred_tcb_at'_def obj_at'_def projectKOs)\n done\n\ncrunch st_tcb_at'[wp]: replyFromKernel \"st_tcb_at' P t\"\ncrunch cap_to'[wp]: replyFromKernel \"ex_nonz_cap_to' p\"\ncrunch it'[wp]: replyFromKernel \"\\s. P (ksIdleThread s)\"\ncrunch sch_act_simple[wp]: replyFromKernel sch_act_simple\n (rule: sch_act_simple_lift)\n\nlemma rfk_ksQ[wp]:\n \"\\\\s. P (ksReadyQueues s p)\\ replyFromKernel t x1 \\\\_ s. P (ksReadyQueues s p)\\\"\n apply (case_tac x1)\n apply (simp add: replyFromKernel_def)\n apply (wp)\n done\n\nlemma hinv_invs'[wp]:\n \"\\invs' and ct_active' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleInvocation calling blocking\n \\\\rv. invs'\\\"\n apply (simp add: handleInvocation_def split_def\n ts_Restart_case_helper')\n apply (wp syscall_valid' setThreadState_nonqueued_state_update rfk_invs'\n hoare_vcg_all_lift static_imp_wp)\n apply simp\n apply (intro conjI impI)\n apply (wp gts_imp' | simp)+\n apply (rule_tac Q'=\"\\rv. invs'\" in hoare_post_imp_R[rotated])\n apply clarsimp\n apply (subgoal_tac \"thread \\ ksIdleThread s\", simp_all)[1]\n apply (fastforce elim!: pred_tcb'_weakenE st_tcb_ex_cap'')\n apply (clarsimp simp: valid_idle'_def valid_state'_def\n invs'_def pred_tcb_at'_def obj_at'_def)\n apply wp+\n apply (rule_tac Q=\"\\rv'. invs' and valid_invocation' rv\n and (\\s. ksSchedulerAction s = ResumeCurrentThread)\n and (\\s. ksCurThread s = thread)\n and st_tcb_at' active' thread\"\n in hoare_post_imp)\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (clarsimp)\n apply (wp sts_invs_minor' setThreadState_st_tcb setThreadState_rct | simp)+\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce simp add: tcb_at_invs' ct_in_state'_def\n simple_sane_strg\n sch_act_simple_def\n elim!: pred_tcb'_weakenE st_tcb_ex_cap''\n dest: st_tcb_at_idle_thread')+\n done\n\ncrunch typ_at'[wp]: handleFault \"\\s. P (typ_at' T p s)\"\n\nlemmas handleFault_typ_ats[wp] = typ_at_lifts [OF handleFault_typ_at']\n\nlemma hs_corres:\n \"corres (intr \\ dc)\n (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and ct_active')\n (handle_send blocking) (handleSend blocking)\"\n by (simp add: handle_send_def handleSend_def hinv_corres)\n\nlemma hs_invs'[wp]:\n \"\\invs' and ct_active' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleSend blocking \\\\r. invs'\\\"\n apply (rule validE_valid)\n apply (simp add: handleSend_def)\n apply (wp | simp)+\n done\n\nlemma getThreadCallerSlot_map:\n \"getThreadCallerSlot t = return (cte_map (t, tcb_cnode_index 3))\"\n by (simp add: getThreadCallerSlot_def locateSlot_conv\n cte_map_def tcb_cnode_index_def tcbCallerSlot_def\n cte_level_bits_def)\n\nlemma tcb_at_cte_at_map:\n \"\\ tcb_at' t s; offs \\ dom tcb_cap_cases \\ \\ cte_at' (cte_map (t, offs)) s\"\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (drule tcb_cases_related)\n apply (auto elim: cte_wp_at_tcbI')\n done\n\nlemma delete_caller_cap_corres:\n \"corres dc (einvs and tcb_at t) (invs' and tcb_at' t)\n (delete_caller_cap t)\n (deleteCallerCap t)\"\n apply (simp add: delete_caller_cap_def deleteCallerCap_def\n getThreadCallerSlot_map)\n apply (rule corres_guard_imp)\n apply (rule_tac P'=\"cte_at' (cte_map (t, tcb_cnode_index 3))\" in corres_symb_exec_r_conj)\n apply (rule_tac F=\"isReplyCap rv \\ rv = capability.NullCap\"\n and P=\"cte_wp_at (\\cap. is_reply_cap cap \\ cap = cap.NullCap) (t, tcb_cnode_index 3)\n and einvs\"\n and P'=\"invs' and cte_wp_at' (\\cte. cteCap cte = rv)\n (cte_map (t, tcb_cnode_index 3))\" in corres_req)\n apply (clarsimp simp: cte_wp_at_caps_of_state state_relation_def)\n apply (drule caps_of_state_cteD)\n apply (drule(1) pspace_relation_cte_wp_at, clarsimp+)\n apply (clarsimp simp: cte_wp_at_ctes_of is_reply_cap_relation cap_relation_NullCapI)\n apply simp\n apply (rule corres_guard_imp, rule cap_delete_one_corres)\n apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps)\n apply (auto simp: can_fast_finalise_def)[1]\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply ((wp getCTE_wp')+ | simp add: getSlotCap_def)+\n apply clarsimp\n apply (frule tcb_at_cte_at[where ref=\"tcb_cnode_index 3\"])\n apply clarsimp\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply (frule tcb_cap_valid_caps_of_stateD, clarsimp)\n apply (drule(1) tcb_cnode_index_3_reply_or_null)\n apply (auto simp: can_fast_finalise_def is_cap_simps\n intro: tcb_at_cte_at_map tcb_at_cte_at)[1]\n apply clarsimp\n apply (frule_tac offs=\"tcb_cnode_index 3\" in tcb_at_cte_at_map)\n apply (simp add: tcb_cap_cases_def)\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma deleteCallerCap_invs[wp]:\n \"\\invs'\\ deleteCallerCap t \\\\rv. invs'\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_invs hoare_drop_imps)\n done\n\nlemma deleteCallerCap_simple[wp]:\n \"\\st_tcb_at' simple' t\\ deleteCallerCap t' \\\\rv. st_tcb_at' simple' t\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_st_tcb_at hoare_drop_imps | simp)+\n done\n\nlemma cteDeleteOne_reply_cap_to''[wp]:\n \"\\ex_nonz_cap_to' p and\n cte_wp_at' (\\c. isReplyCap (cteCap c) \\ isNullCap (cteCap c)) slot\\\n cteDeleteOne slot\n \\\\rv. ex_nonz_cap_to' p\\\"\n apply (simp add: cteDeleteOne_def ex_nonz_cap_to'_def unless_def)\n apply (rule hoare_seq_ext [OF _ getCTE_sp])\n apply (rule hoare_assume_pre)\n apply (subgoal_tac \"isReplyCap (cteCap cte) \\ isNullCap (cteCap cte)\")\n apply (wp hoare_vcg_ex_lift emptySlot_cte_wp_cap_other isFinalCapability_inv\n | clarsimp simp: finaliseCap_def isCap_simps | simp\n | wp (once) hoare_drop_imps)+\n apply (fastforce simp: cte_wp_at_ctes_of)\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps)\n done\n\nlemma deleteCallerCap_nonz_cap:\n \"\\ex_nonz_cap_to' p and tcb_at' t and valid_objs'\\\n deleteCallerCap t\n \\\\rv. ex_nonz_cap_to' p\\\"\n apply (simp add: deleteCallerCap_def getSlotCap_def getThreadCallerSlot_map\n locateSlot_conv )\n apply (rule hoare_pre)\n apply (wp cteDeleteOne_reply_cap_to'' getCTE_wp')\n apply clarsimp\n apply (frule_tac offs=\"tcb_cnode_index 3\" in tcb_at_cte_at_map)\n apply (clarsimp simp: tcb_cap_cases_def)\n apply (auto simp: ex_nonz_cap_to'_def isCap_simps cte_wp_at_ctes_of)\n done\n\ncrunch sch_act_sane[wp]: cteDeleteOne sch_act_sane\n (wp: crunch_wps loadObject_default_inv getObject_inv\n simp: crunch_simps unless_def\n rule: sch_act_sane_lift)\n\ncrunch sch_act_sane[wp]: deleteCallerCap sch_act_sane\n (wp: crunch_wps)\n\nlemma delete_caller_cap_valid_ep_cap:\n \"\\valid_cap (cap.EndpointCap r a b)\\ delete_caller_cap thread \\\\rv. valid_cap (cap.EndpointCap r a b)\\\"\n apply (clarsimp simp: delete_caller_cap_def cap_delete_one_def valid_cap_def)\n apply (rule hoare_pre)\n by (wp get_cap_wp fast_finalise_typ_at abs_typ_at_lifts(1)\n | simp add: unless_def valid_cap_def)+\n\nlemma hw_corres':\n \"corres dc (einvs and ct_in_state active\n and (\\s. ex_nonz_cap_to (cur_thread s) s))\n (invs' and ct_in_state' simple'\n and sch_act_sane\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\n and (\\s. ex_nonz_cap_to' (ksCurThread s) s))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n (is \"corres dc (?pre1) (?pre2) (handle_recv _) (handleRecv _)\")\n apply (simp add: handle_recv_def handleRecv_def liftM_bind Let_def\n cap_register_def capRegister_def\n cong: if_cong cap.case_cong capability.case_cong bool.case_cong)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr [OF _ gct_corres])\n apply (rule corres_split_eqr [OF _ user_getreg_corres])\n apply (rule corres_split_catch)\n apply (erule hf_corres)\n apply (rule corres_cap_fault)\n apply (rule corres_splitEE [OF _ lc_corres])\n apply (rule_tac P=\"?pre1 and tcb_at thread\n and (\\s. (cur_thread s) = thread )\n and valid_cap rv\"\n and P'=\"?pre2 and tcb_at' thread and valid_cap' rv'\" in corres_inst)\n apply (clarsimp split: cap_relation_split_asm arch_cap.split_asm split del: if_split\n simp: lookup_failure_map_def whenE_def)\n apply (rule corres_guard_imp)\n apply (rename_tac rights)\n apply (case_tac \"AllowRead \\ rights\"; simp)\n apply (rule corres_split_nor[OF _ delete_caller_cap_corres])\n apply (rule receive_ipc_corres)\n apply (clarsimp)+\n apply (wp delete_caller_cap_nonz_cap delete_caller_cap_valid_ep_cap)+\n apply (clarsimp)+\n apply (clarsimp simp: lookup_failure_map_def)+\n apply (clarsimp simp: valid_cap'_def capAligned_def)\n apply (rule corres_guard_imp)\n apply (rename_tac rights)\n apply (case_tac \"AllowRead \\ rights\"; simp)\n apply (rule_tac r'=ntfn_relation in corres_splitEE)\n apply (rule corres_if)\n apply (clarsimp simp: ntfn_relation_def)\n apply (clarsimp, rule receive_signal_corres)\n prefer 3\n apply (rule corres_trivial)\n apply (clarsimp simp: lookup_failure_map_def)+\n apply (rule get_ntfn_corres)\n apply (wp get_simple_ko_wp getNotification_wp | wpcw | simp)+\n apply (clarsimp simp: lookup_failure_map_def)\n apply (clarsimp simp: valid_cap_def ct_in_state_def)\n apply (clarsimp simp: valid_cap'_def capAligned_def)\n apply (wp get_simple_ko_wp | wpcw | simp)+\n apply (rule hoare_vcg_E_elim)\n apply (simp add: lookup_cap_def lookup_slot_for_thread_def)\n apply wp\n apply (simp add: split_def)\n apply (wp resolve_address_bits_valid_fault2)+\n apply (wp getNotification_wp | wpcw | simp add: valid_fault_def whenE_def split del: if_split)+\n apply (clarsimp simp add: ct_in_state_def ct_in_state'_def conj_comms invs_valid_tcb_ctable\n invs_valid_objs tcb_at_invs invs_psp_aligned invs_cur)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def\n ct_in_state'_def sch_act_sane_not)\n done\n\nlemma hw_corres:\n \"corres dc (einvs and ct_active)\n (invs' and ct_active' and sch_act_sane and\n (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p)))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n apply (rule corres_guard_imp)\n apply (rule hw_corres')\n apply (clarsimp simp: ct_in_state_def)\n apply (fastforce elim!: st_tcb_weakenE st_tcb_ex_cap)\n apply (clarsimp simp: ct_in_state'_def invs'_def valid_state'_def)\n apply (frule(1) st_tcb_ex_cap'')\n apply (auto elim: pred_tcb'_weakenE)\n done\n\nlemma lookupCap_refs[wp]:\n \"\\invs'\\ lookupCap t ref \\\\rv s. \\r\\zobj_refs' rv. ex_nonz_cap_to' r s\\,-\"\n by (simp add: lookupCap_def split_def | wp | simp add: o_def)+\n\nlemma deleteCallerCap_ksQ_ct':\n \"\\invs' and ct_in_state' simple' and sch_act_sane and\n (\\s. ksCurThread s \\ set (ksReadyQueues s p) \\ thread = ksCurThread s)\\\n deleteCallerCap thread\n \\\\rv s. thread \\ set (ksReadyQueues s p)\\\"\n apply (rule_tac Q=\"\\rv s. thread = ksCurThread s \\ ksCurThread s \\ set (ksReadyQueues s p)\"\n in hoare_strengthen_post)\n apply (wp deleteCallerCap_ct_not_ksQ)\n apply auto\n done\n\nlemma hw_invs'[wp]:\n \"\\invs' and ct_in_state' simple' and sch_act_sane\n and (\\s. ex_nonz_cap_to' (ksCurThread s) s)\n and (\\s. ksCurThread s \\ ksIdleThread s)\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\\\n handleRecv isBlocking \\\\r. invs'\\\"\n apply (simp add: handleRecv_def cong: if_cong)\n apply (rule hoare_pre)\n apply ((wp getNotification_wp | wpc | simp)+)[1]\n apply (clarsimp simp: ct_in_state'_def)\n apply ((wp deleteCallerCap_nonz_cap hoare_vcg_all_lift\n deleteCallerCap_ksQ_ct'\n hoare_lift_Pf2[OF deleteCallerCap_simple\n deleteCallerCap_ct']\n | wpc | simp)+)[1]\n apply simp\n apply (wp deleteCallerCap_nonz_cap hoare_vcg_all_lift\n deleteCallerCap_ksQ_ct'\n hoare_lift_Pf2[OF deleteCallerCap_simple\n deleteCallerCap_ct']\n | wpc | simp add: ct_in_state'_def whenE_def split del: if_split)+\n apply (rule validE_validE_R)\n apply (rule_tac Q=\"\\rv s. invs' s\n \\ sch_act_sane s\n \\ (\\p. ksCurThread s \\ set (ksReadyQueues s p))\n \\ thread = ksCurThread s\n \\ ct_in_state' simple' s\n \\ ex_nonz_cap_to' thread s\n \\ thread \\ ksIdleThread s\n \\ (\\x \\ zobj_refs' rv. ex_nonz_cap_to' x s)\"\n and E=\"\\_ _. True\"\n in hoare_post_impErr[rotated])\n apply (clarsimp simp: isCap_simps ct_in_state'_def pred_tcb_at' invs_valid_objs'\n sch_act_sane_not obj_at'_def projectKOs pred_tcb_at'_def)\n apply (assumption)\n apply (wp)+\n apply (clarsimp)\n apply (auto elim: st_tcb_ex_cap'' pred_tcb'_weakenE\n dest!: st_tcb_at_idle_thread'\n simp: ct_in_state'_def sch_act_sane_def)\n done\n\nlemma setSchedulerAction_obj_at'[wp]:\n \"\\obj_at' P p\\ setSchedulerAction sa \\\\rv. obj_at' P p\\\"\n unfolding setSchedulerAction_def\n by (wp, clarsimp elim!: obj_at'_pspaceI)\n\nlemma hy_corres:\n \"corres dc einvs (invs' and ct_active' and (\\s. ksSchedulerAction s = ResumeCurrentThread)) handle_yield handleYield\"\n apply (clarsimp simp: handle_yield_def handleYield_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split[OF _ gct_corres])\n apply simp\n apply (rule corres_split[OF _ tcbSchedDequeue_corres])\n apply (rule corres_split[OF _ tcbSchedAppend_corres])\n apply (rule rescheduleRequired_corres)\n apply (wp weak_sch_act_wf_lift_linear tcbSchedDequeue_valid_queues | simp add: )+\n apply (simp add: invs_def valid_sched_def valid_sched_action_def\n cur_tcb_def tcb_at_is_etcb_at)\n apply clarsimp\n apply (frule ct_active_runnable')\n apply (clarsimp simp: invs'_def valid_state'_def ct_in_state'_def sch_act_wf_weak cur_tcb'_def\n valid_pspace_valid_objs' valid_objs'_maxDomain tcb_in_cur_domain'_def)\n apply (erule(1) valid_objs_valid_tcbE[OF valid_pspace_valid_objs'])\n apply (simp add:valid_tcb'_def)\n done\n\nlemma hy_invs':\n \"\\invs' and ct_active'\\ handleYield \\\\r. invs' and ct_active'\\\"\n apply (simp add: handleYield_def)\n apply (wp ct_in_state_thread_state_lift'\n rescheduleRequired_all_invs_but_ct_not_inQ\n tcbSchedAppend_invs_but_ct_not_inQ' | simp)+\n apply (clarsimp simp add: invs'_def valid_state'_def ct_in_state'_def sch_act_wf_weak cur_tcb'_def\n valid_pspace_valid_objs' valid_objs'_maxDomain tcb_in_cur_domain'_def\n )\n apply (simp add:ct_active_runnable'[unfolded ct_in_state'_def])\n done\n\nlemma getFaultAddress_invs'[wp]:\n \"valid invs' (doMachineOp getFaultAddress) (\\_. invs')\"\n by (simp add: getFaultAddress_def doMachineOp_def split_def select_f_returns | wp)+\n\nlemma hv_invs'[wp]: \"\\invs' and tcb_at' t'\\ handleVMFault t' vptr \\\\r. invs'\\\"\n apply (simp add: X64_H.handleVMFault_def\n cong: vmfault_type.case_cong)\n apply (rule hoare_pre)\n apply (wp | wpcw | simp)+\n done\n\ncrunch nosch[wp]: handleVMFault \"\\s. P (ksSchedulerAction s)\"\n (ignore: getFaultAddress)\n\nlemma hv_inv_ex':\n \"\\P\\ handleVMFault t vp \\\\_ _. True\\, \\\\_. P\\\"\n apply (simp add: X64_H.handleVMFault_def\n cong: vmfault_type.case_cong)\n apply (rule hoare_pre)\n apply (wp dmo_inv' getFaultAddress_inv getRestartPC_inv\n det_getRestartPC asUser_inv\n | wpcw)+\n apply simp\n done\n\nlemma active_from_running':\n \"ct_running' s' \\ ct_active' s'\"\n by (clarsimp elim!: pred_tcb'_weakenE\n simp: ct_in_state'_def)+\n\nlemma simple_from_running':\n \"ct_running' s' \\ ct_in_state' simple' s'\"\n by (clarsimp elim!: pred_tcb'_weakenE\n simp: ct_in_state'_def)+\n\nlemma hr_corres:\n \"corres dc (einvs and ct_running) (invs' and ct_running')\n handle_reply handleReply\"\n apply (simp add: handle_reply_def handleReply_def\n getThreadCallerSlot_map\n getSlotCap_def)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr [OF _ gct_corres])\n apply (rule corres_split [OF _ get_cap_corres])\n apply (rule_tac P=\"einvs and cte_wp_at ((=) caller_cap) (thread, tcb_cnode_index 3)\n and K (is_reply_cap caller_cap \\ caller_cap = cap.NullCap)\n and tcb_at thread and st_tcb_at active thread\n and valid_cap caller_cap\"\n and P'=\"invs' and tcb_at' thread\n and valid_cap' (cteCap rv')\n and cte_at' (cte_map (thread, tcb_cnode_index 3))\"\n in corres_inst)\n apply (auto split: cap_relation_split_asm arch_cap.split_asm bool.split\n intro!: corres_guard_imp [OF delete_caller_cap_corres]\n corres_guard_imp [OF do_reply_transfer_corres]\n corres_fail\n simp: valid_cap_def valid_cap'_def is_cap_simps assert_def is_reply_cap_to_def)[1]\n apply (fastforce simp: invs_def valid_state_def\n cte_wp_at_caps_of_state st_tcb_def2\n dest: valid_reply_caps_of_stateD)\n apply (wp get_cap_cte_wp_at get_cap_wp | simp add: cte_wp_at_eq_simp)+\n apply (intro conjI impI allI,\n (fastforce simp: invs_def valid_state_def\n intro: tcb_at_cte_at)+)\n apply (clarsimp, frule tcb_at_invs)\n apply (fastforce dest: tcb_caller_cap simp: cte_wp_at_def)\n apply clarsimp\n apply (clarsimp simp: ct_in_state_def elim!: st_tcb_weakenE)\n apply (fastforce intro: cte_wp_valid_cap elim: cte_wp_at_weakenE)\n apply (fastforce intro: tcb_at_cte_at_map)\n done\n\nlemma hr_invs'[wp]:\n \"\\invs' and sch_act_simple\\ handleReply \\\\rv. invs'\\\"\n apply (simp add: handleReply_def getSlotCap_def\n getThreadCallerSlot_map getCurThread_def)\n apply (wp getCTE_wp | wpc | simp)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (drule ctes_of_valid', clarsimp+)\n apply (simp add: valid_cap'_def)\n apply (simp add: invs'_def cur_tcb'_def)\n done\n\ncrunch ksCurThread[wp]: cteDeleteOne \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps setObject_ep_ct setObject_ntfn_ct\n simp: crunch_simps unless_def)\n\ncrunch ksCurThread[wp]: handleReply \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps transferCapsToSlots_pres1 setObject_ep_ct\n setObject_ntfn_ct\n simp: unless_def crunch_simps\n ignore: transferCapsToSlots)\n\nlemmas cteDeleteOne_st_tcb_at_simple'[wp] =\n cteDeleteOne_st_tcb_at[where P=simple', simplified]\n\ncrunch st_tcb_at_simple'[wp]: handleReply \"st_tcb_at' simple' t'\"\n (wp: hoare_post_taut crunch_wps sts_st_tcb_at'_cases\n threadSet_pred_tcb_no_state\n ignore: setThreadState)\n\nlemmas handleReply_ct_in_state_simple[wp] =\n ct_in_state_thread_state_lift' [OF handleReply_ksCurThread\n handleReply_st_tcb_at_simple']\n\n\n(* FIXME: move *)\nlemma doReplyTransfer_st_tcb_at_active:\n \"\\st_tcb_at' active' t and tcb_at' t' and K (t \\ t') and\n cte_wp_at' (\\cte. cteCap cte = (capability.ReplyCap t' False g)) sl\\\n doReplyTransfer t t' sl g\n \\\\rv. st_tcb_at' active' t\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (wp setThreadState_st_tcb sts_pred_tcb_neq' cteDeleteOne_reply_pred_tcb_at\n hoare_drop_imps threadSet_pred_tcb_no_state hoare_exI\n doIPCTransfer_non_null_cte_wp_at2' | wpc | clarsimp simp:isCap_simps)+\n apply (fastforce)\n done\n\nlemma hr_ct_active'[wp]:\n \"\\invs' and ct_active'\\ handleReply \\\\rv. ct_active'\\\"\n apply (simp add: handleReply_def getSlotCap_def getCurThread_def\n getThreadCallerSlot_def locateSlot_conv)\n apply (rule hoare_seq_ext)\n apply (rule ct_in_state'_decomp)\n apply ((wp hoare_drop_imps | wpc | simp)+)[1]\n apply (subst haskell_assert_def)\n apply (wp hoare_vcg_all_lift getCTE_wp doReplyTransfer_st_tcb_at_active\n | wpc | simp)+\n apply (fastforce simp: ct_in_state'_def cte_wp_at_ctes_of valid_cap'_def\n dest: ctes_of_valid')\n done\n\nlemma hc_corres:\n \"corres (intr \\ dc) (einvs and (\\s. scheduler_action s = resume_cur_thread) and ct_active)\n (invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and\n ct_active')\n handle_call handleCall\"\n by (simp add: handle_call_def handleCall_def liftE_bindE hinv_corres)\n\nlemma hc_invs'[wp]:\n \"\\invs' and\n (\\s. ksSchedulerAction s = ResumeCurrentThread) and\n ct_active'\\\n handleCall\n \\\\rv. invs'\\\"\n apply (simp add: handleCall_def)\n apply (wp)\n apply (clarsimp)\n done\n\nlemma sch_act_sane_ksMachineState [iff]:\n \"sch_act_sane (s\\ksMachineState := b\\) = sch_act_sane s\"\n by (simp add: sch_act_sane_def)\n\nlemma cteInsert_sane[wp]:\n \"\\sch_act_sane\\ cteInsert newCap srcSlot destSlot \\\\_. sch_act_sane\\\"\n apply (simp add: sch_act_sane_def)\n apply (wp hoare_vcg_all_lift\n hoare_convert_imp [OF cteInsert_nosch cteInsert_ct])\n done\n\ncrunch sane [wp]: cteInsert sch_act_sane\n (wp: crunch_wps simp: crunch_simps)\n\ncrunch sane [wp]: setExtraBadge sch_act_sane\n\ncrunch sane [wp]: transferCaps \"sch_act_sane\"\n (wp: transferCapsToSlots_pres1 crunch_wps\n simp: crunch_simps\n ignore: transferCapsToSlots)\n\nlemma possibleSwitchTo_sane:\n \"\\\\s. sch_act_sane s \\ t \\ ksCurThread s\\ possibleSwitchTo t \\\\_. sch_act_sane\\\"\n apply (simp add: possibleSwitchTo_def setSchedulerAction_def curDomain_def\n cong: if_cong)\n apply (wp hoare_drop_imps | wpc)+\n apply (simp add: sch_act_sane_def)\n done\n\ncrunch sane [wp]: handleFaultReply sch_act_sane\n ( wp: threadGet_inv hoare_drop_imps crunch_wps\n simp: crunch_simps\n ignore: setSchedulerAction)\n\ncrunch sane [wp]: doIPCTransfer sch_act_sane\n ( wp: threadGet_inv hoare_drop_imps crunch_wps\n simp: crunch_simps\n ignore: setSchedulerAction)\n\nlemma doReplyTransfer_sane:\n \"\\\\s. sch_act_sane s \\ t' \\ ksCurThread s\\\n doReplyTransfer t t' callerSlot g \\\\rv. sch_act_sane\\\"\n apply (simp add: doReplyTransfer_def liftM_def)\n apply (wp possibleSwitchTo_sane hoare_drop_imps hoare_vcg_all_lift|wpc)+\n apply simp\n done\n\nlemma handleReply_sane:\n \"\\sch_act_sane\\ handleReply \\\\rv. sch_act_sane\\\"\n apply (simp add: handleReply_def getSlotCap_def getThreadCallerSlot_def locateSlot_conv)\n apply (rule hoare_pre)\n apply (wp haskell_assert_wp doReplyTransfer_sane getCTE_wp'| wpc)+\n apply (clarsimp simp: cte_wp_at_ctes_of)\n done\n\nlemma handleReply_nonz_cap_to_ct:\n \"\\ct_active' and invs' and sch_act_simple\\\n handleReply\n \\\\rv s. ex_nonz_cap_to' (ksCurThread s) s\\\"\n apply (rule_tac Q=\"\\rv. ct_active' and invs'\"\n in hoare_post_imp)\n apply (auto simp: ct_in_state'_def elim: st_tcb_ex_cap'')[1]\n apply (wp | simp)+\n done\n\ncrunch ksQ[wp]: handleFaultReply \"\\s. P (ksReadyQueues s p)\"\n\nlemma doReplyTransfer_ct_not_ksQ:\n \"\\ invs' and sch_act_simple\n and tcb_at' thread and tcb_at' word\n and ct_in_state' simple'\n and (\\s. ksCurThread s \\ word)\n and (\\s. \\p. ksCurThread s \\ set(ksReadyQueues s p))\\\n doReplyTransfer thread word callerSlot g\n \\\\rv s. \\p. ksCurThread s \\ set(ksReadyQueues s p)\\\"\nproof -\n have astct: \"\\t p.\n \\(\\s. ksCurThread s \\ set(ksReadyQueues s p) \\ sch_act_sane s)\n and (\\s. ksCurThread s \\ t)\\\n possibleSwitchTo t \\\\rv s. ksCurThread s \\ set(ksReadyQueues s p)\\\"\n apply (rule hoare_weaken_pre)\n apply (wps possibleSwitchTo_ct')\n apply (wp possibleSwitchTo_ksQ')\n apply (clarsimp simp: sch_act_sane_def)\n done\n have stsct: \"\\t st p.\n \\(\\s. ksCurThread s \\ set(ksReadyQueues s p)) and sch_act_simple\\\n setThreadState st t\n \\\\rv s. ksCurThread s \\ set(ksReadyQueues s p)\\\"\n apply (rule hoare_weaken_pre)\n apply (wps setThreadState_ct')\n apply (wp hoare_vcg_all_lift sts_ksQ)\n apply (clarsimp)\n done\n show ?thesis\n apply (simp add: doReplyTransfer_def)\n apply (wp, wpc)\n apply (wp astct stsct hoare_vcg_all_lift\n cteDeleteOne_ct_not_ksQ hoare_drop_imp\n hoare_lift_Pf2 [OF cteDeleteOne_sch_act_not cteDeleteOne_ct']\n hoare_lift_Pf2 [OF doIPCTransfer_pred_tcb_at' doIPCTransfer_ct']\n hoare_lift_Pf2 [OF doIPCTransfer_ksQ doIPCTransfer_ct']\n hoare_lift_Pf2 [OF threadSet_ksQ threadSet_ct]\n hoare_lift_Pf2 [OF handleFaultReply_ksQ handleFaultReply_ct']\n | simp add: ct_in_state'_def)+\n apply (fastforce simp: sch_act_simple_def sch_act_sane_def ct_in_state'_def)+\n done\nqed\n\nlemma handleReply_ct_not_ksQ:\n \"\\invs' and sch_act_simple\n and ct_in_state' simple'\n and (\\s. \\p. ksCurThread s \\ set (ksReadyQueues s p))\\\n handleReply\n \\\\rv s. \\p. ksCurThread s \\ set (ksReadyQueues s p)\\\"\n apply (simp add: handleReply_def del: split_paired_All)\n apply (subst haskell_assert_def)\n apply (wp | wpc)+\n apply (wp doReplyTransfer_ct_not_ksQ getThreadCallerSlot_inv)+\n apply (rule_tac Q=\"\\cap.\n (\\s. \\p. ksCurThread s \\ set(ksReadyQueues s p))\n and invs'\n and sch_act_simple\n and (\\s. thread = ksCurThread s)\n and tcb_at' thread\n and ct_in_state' simple'\n and cte_wp_at' (\\c. cteCap c = cap) callerSlot\"\n in hoare_post_imp)\n apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def\n cte_wp_at_ctes_of valid_cap'_def\n dest!: ctes_of_valid')\n apply (wp getSlotCap_cte_wp_at getThreadCallerSlot_inv)+\n apply (clarsimp)\n done\n\ncrunch valid_etcbs[wp]: possible_switch_to \"valid_etcbs\"\ncrunch valid_etcbs[wp]: handle_recv \"valid_etcbs\"\n (wp: crunch_wps simp: crunch_simps)\n\nlemma hrw_corres:\n \"corres dc (einvs and ct_running)\n (invs' and ct_running' and (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (do x \\ handle_reply; handle_recv True od)\n (do x \\ handleReply; handleRecv True od)\"\n apply (rule corres_guard_imp)\n apply (rule corres_split_nor [OF _ hr_corres])\n apply (rule hw_corres')\n apply (wp handle_reply_nonz_cap_to_ct handleReply_sane\n handleReply_nonz_cap_to_ct handleReply_ct_not_ksQ handle_reply_valid_sched)+\n apply (fastforce simp: ct_in_state_def ct_in_state'_def simple_sane_strg\n elim!: st_tcb_weakenE st_tcb_ex_cap')\n apply (clarsimp simp: ct_in_state'_def)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce elim: pred_tcb'_weakenE)\n done\n\nlemma hh_corres:\n \"corres dc (einvs and st_tcb_at active thread and ex_nonz_cap_to thread\n and (%_. valid_fault f))\n (invs' and sch_act_not thread\n and (\\s. \\p. thread \\ set(ksReadyQueues s p))\n and st_tcb_at' simple' thread and ex_nonz_cap_to' thread)\n (handle_hypervisor_fault w fault) (handleHypervisorFault w fault)\"\n apply (cases fault; clarsimp simp add: handleHypervisorFault_def returnOk_def2)\n done\n\n(* FIXME: move *)\nlemma he_corres:\n \"corres (intr \\ dc) (einvs and (\\s. event \\ Interrupt \\ ct_running s) and\n (\\s. scheduler_action s = resume_cur_thread))\n (invs' and (\\s. event \\ Interrupt \\ ct_running' s) and\n (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (handle_event event) (handleEvent event)\"\n (is \"?he_corres\")\nproof -\n have hw:\n \"\\isBlocking. corres dc (einvs and ct_running and (\\s. scheduler_action s = resume_cur_thread))\n (invs' and ct_running'\n and (\\s. ksSchedulerAction s = ResumeCurrentThread))\n (handle_recv isBlocking) (handleRecv isBlocking)\"\n apply (rule corres_guard_imp [OF hw_corres])\n apply (clarsimp simp: ct_in_state_def ct_in_state'_def\n elim!: st_tcb_weakenE pred_tcb'_weakenE\n dest!: ct_not_ksQ)+\n done\n show ?thesis\n apply (case_tac event)\n apply (simp_all add: handleEvent_def)\n\n apply (rename_tac syscall)\n apply (case_tac syscall)\n apply (auto intro: corres_guard_imp[OF hs_corres]\n corres_guard_imp[OF hw]\n corres_guard_imp [OF hr_corres]\n corres_guard_imp[OF hrw_corres]\n corres_guard_imp[OF hc_corres]\n corres_guard_imp[OF hy_corres]\n active_from_running active_from_running'\n simp: simple_sane_strg)[8]\n apply (rule corres_split')\n apply (rule corres_guard_imp[OF gct_corres], simp+)\n apply (rule hf_corres)\n apply simp\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n apply (rule corres_split')\n apply (rule corres_guard_imp, rule gct_corres, simp+)\n apply (rule hf_corres)\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def valid_fault_def)\n apply wp\n apply clarsimp\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr[where R=\"\\rv. einvs\"\n and R'=\"\\rv s. \\x. rv = Some x \\ R'' x s\"\n for R''])\n apply (case_tac rv, simp_all add: doMachineOp_return)[1]\n apply (rule handle_interrupt_corres)\n apply (rule corres_machine_op)\n apply (rule corres_Id, simp+)\n apply (wp hoare_vcg_all_lift\n doMachineOp_getActiveIRQ_IRQ_active'\n | simp\n | simp add: imp_conjR | wp (once) hoare_drop_imps)+\n apply force\n apply simp\n apply (simp add: invs'_def valid_state'_def)\n apply (rule_tac corres_split')\n apply (rule corres_guard_imp, rule gct_corres, simp+)\n apply (rule corres_split_catch)\n apply (erule hf_corres)\n apply (rule hv_corres)\n apply (rule hoare_elim_pred_conjE2)\n apply (rule hoare_vcg_E_conj, rule valid_validE_E, wp)\n apply (wp handle_vm_fault_valid_fault)\n apply (rule hv_inv_ex')\n apply wp\n apply (clarsimp simp: simple_from_running tcb_at_invs)\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (fastforce simp: simple_sane_strg sch_act_simple_def ct_in_state'_def\n elim: st_tcb_ex_cap'' pred_tcb'_weakenE)\n apply (rule corres_split')\n apply (rule corres_guard_imp[OF gct_corres], simp+)\n apply (rule hh_corres)\n apply (simp add: valid_fault_def)\n apply wp\n apply (fastforce elim!: st_tcb_ex_cap st_tcb_weakenE\n simp: ct_in_state_def)\n apply wp\n apply (clarsimp)\n apply (frule(1) ct_not_ksQ)\n apply (auto simp: ct_in_state'_def sch_act_simple_def\n sch_act_sane_def\n elim: pred_tcb'_weakenE st_tcb_ex_cap'')[1]\n done\n qed\n\ncrunches handleVMFault,handleHypervisorFault\n for st_tcb_at'[wp]: \"st_tcb_at' P t\"\n and cap_to'[wp]: \"ex_nonz_cap_to' t\"\n and ksit[wp]: \"\\s. P (ksIdleThread s)\"\n (ignore: getFaultAddress)\n\nlemma hv_inv':\n \"\\P\\ handleVMFault p t \\\\_. P\\\"\n apply (simp add: X64_H.handleVMFault_def)\n apply (rule hoare_pre)\n apply (wp dmo_inv' getFaultAddress_inv getRestartPC_inv\n det_getRestartPC asUser_inv\n |wpc|simp)+\n done\n\nlemma hh_inv':\n \"\\P\\ handleHypervisorFault p t \\\\_. P\\\"\n apply (simp add: X64_H.handleHypervisorFault_def)\n apply (cases t; clarsimp)\n done\n\nlemma ct_not_idle':\n fixes s\n assumes vi: \"valid_idle' s\"\n and cts: \"ct_in_state' (\\tcb. \\idle' tcb) s\"\n shows \"ksCurThread s \\ ksIdleThread s\"\nproof\n assume \"ksCurThread s = ksIdleThread s\"\n with vi have \"ct_in_state' idle' s\"\n unfolding ct_in_state'_def valid_idle'_def\n by (clarsimp simp: pred_tcb_at'_def obj_at'_def)\n\n with cts show False\n unfolding ct_in_state'_def\n by (fastforce dest: pred_tcb_at_conj')\nqed\n\nlemma ct_running_not_idle'[simp]:\n \"\\invs' s; ct_running' s\\ \\ ksCurThread s \\ ksIdleThread s\"\n apply (rule ct_not_idle')\n apply (fastforce simp: invs'_def valid_state'_def ct_in_state'_def\n elim: pred_tcb'_weakenE)+\n done\n\nlemma ct_active_not_idle'[simp]:\n \"\\invs' s; ct_active' s\\ \\ ksCurThread s \\ ksIdleThread s\"\n apply (rule ct_not_idle')\n apply (fastforce simp: invs'_def valid_state'_def ct_in_state'_def\n elim: pred_tcb'_weakenE)+\n done\n\nlemma deleteCallerCap_st_tcb_at_runnable[wp]:\n \"\\st_tcb_at' runnable' t\\ deleteCallerCap t' \\\\rv. st_tcb_at' runnable' t\\\"\n apply (simp add: deleteCallerCap_def getThreadCallerSlot_def\n locateSlot_conv)\n apply (wp cteDeleteOne_tcb_at_runnable' hoare_drop_imps | simp)+\n done\n\ncrunches handleFault, receiveSignal, receiveIPC, asUser\n for ksCurThread[wp]: \"\\s. P (ksCurThread s)\"\n (wp: hoare_drop_imps crunch_wps simp: crunch_simps)\n\nlemma handleRecv_ksCurThread[wp]:\n \"\\\\s. P (ksCurThread s) \\ handleRecv b \\\\rv s. P (ksCurThread s) \\\"\n unfolding handleRecv_def\n by ((simp, wp hoare_drop_imps) | wpc | wpsimp wp: hoare_drop_imps)+\n\nlemma he_invs'[wp]:\n \"\\invs' and\n (\\s. event \\ Interrupt \\ ct_running' s) and\n (\\s. ksSchedulerAction s = ResumeCurrentThread)\\\n handleEvent event\n \\\\rv. invs'\\\"\nproof -\n have nidle: \"\\s. invs' s \\ ct_active' s \\ ksCurThread s \\ ksIdleThread s\"\n by (clarsimp)\n show ?thesis\n apply (case_tac event, simp_all add: handleEvent_def)\n apply (rename_tac syscall)\n apply (case_tac syscall,\n (wp handleReply_sane handleReply_nonz_cap_to_ct handleReply_ksCurThread\n handleReply_ct_not_ksQ\n | clarsimp simp: active_from_running' simple_from_running' simple_sane_strg simp del: split_paired_All\n | rule conjI active_ex_cap'\n | drule ct_not_ksQ[rotated]\n | strengthen nidle)+)\n apply (rule hoare_strengthen_post,\n rule hoare_weaken_pre,\n rule hy_invs')\n apply (simp add: active_from_running')\n apply simp\n apply (wp hv_inv' hh_inv'\n | rule conjI\n | erule pred_tcb'_weakenE st_tcb_ex_cap''\n | clarsimp simp: tcb_at_invs ct_in_state'_def simple_sane_strg sch_act_simple_def\n | drule st_tcb_at_idle_thread'\n | drule ct_not_ksQ[rotated]\n | wpc | wp (once) hoare_drop_imps)+\n done\nqed\n\nlemma inv_irq_IRQInactive:\n \"\\\\\\ performIRQControl irqcontrol_invocation\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: performIRQControl_def)\n apply (rule hoare_pre)\n apply (wpc|wp|simp add: X64_H.performIRQControl_def)+\n done\n\nlemma inv_arch_IRQInactive:\n \"\\\\\\ Arch.performInvocation invocation\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (wpsimp simp: performX64MMUInvocation_def X64_H.performInvocation_def\n performX64PortInvocation_def)\n done\n\nlemma retype_pi_IRQInactive:\n \"\\valid_irq_states'\\ RetypeDecls_H.performInvocation blocking call v\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: Retype_H.performInvocation_def)\n apply (rule hoare_pre)\n apply (wpc |\n wp inv_tcb_IRQInactive inv_cnode_IRQInactive inv_irq_IRQInactive\n inv_untyped_IRQInactive inv_arch_IRQInactive |\n simp)+\n done\n\nlemma hi_IRQInactive:\n \"\\valid_irq_states'\\ handleInvocation call blocking\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleInvocation_def split_def)\n apply (wp syscall_valid' retype_pi_IRQInactive)\n apply simp_all\n done\n\nlemma handleSend_IRQInactive:\n \"\\invs'\\ handleSend blocking\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleSend_def)\n apply (rule hoare_pre)\n apply (wp hi_IRQInactive)\n apply (simp add: invs'_def valid_state'_def)\n done\n\nlemma handleCall_IRQInactive:\n \"\\invs'\\ handleCall\n -, \\\\rv s. intStateIRQTable (ksInterruptState s) rv \\ irqstate.IRQInactive\\\"\n apply (simp add: handleCall_def)\n apply (rule hoare_pre)\n apply (wp hi_IRQInactive)\n apply (simp add: invs'_def valid_state'_def)\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/refine/X64/Syscall_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.2782567817320044, "lm_q1q2_score": 0.1542851671453366}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__57_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__57_on_rules imports n_german_lemma_on_inv__57\nbegin\nsection{*All lemmas on causal relation between inv__57*}\nlemma lemma_inv__57_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__57 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__57) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__57) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__57_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.2877678096528436, "lm_q1q2_score": 0.15398410275455846}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__26_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__26_on_rules imports n_g2kAbsAfter_lemma_on_inv__26\nbegin\nsection{*All lemmas on causal relation between inv__26*}\nlemma lemma_inv__26_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__26 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__26) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__26) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__26_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.29098087236345377, "lm_q1q2_score": 0.15343902198465}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__36_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__36_on_rules imports n_german_lemma_on_inv__36\nbegin\nsection{*All lemmas on causal relation between inv__36*}\nlemma lemma_inv__36_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__36 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__36) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__36) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__36_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.15338142673601451}} {"text": "(*\n Author: David Sanan\n Maintainer: David Sanan, sanan at ntu edu sg\n License: LGPL\n*)\n\n(* Title: ArincMultiCoreServices.thy\n Author: David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\ntheory ArincSpecQueue\nimports ArincSpec_com_queue_insert \"HOL-Library.Countable\"\nbegin \n \nsection {* tests *}\n \nprimrec events::\"Evnt \\ nat \\ (vars,(Evnt\\nat),Faults,Events) com\"\nwhere \n\"events Send_Message_Q m = (send_q_message_i m)\"\n\n\nsubsection {* mapping from parameterized event to list *}\n\n\ndefinition execute_service :: \"nat \\ (vars,(Evnt\\nat),Faults,Events) com\"\nwhere\n\"execute_service i \\ \n IF evnt ((\\locals)!i) = Send_Message_Q THEN \n Call (Send_Message_Q,i) \n FI\n\" \n \ndefinition \\ :: \" (Evnt\\nat) \\ ((vars,(Evnt\\nat),Faults,Events) com) option\"\nwhere\n\"\n\\ \\ (\\ (s,m). if (m \\ (Send_Message_Q,i) = Some (send_q_message_i i)\"\n unfolding \\_def by auto\n\nsubsection {* correctness on the call for each event based on the correctness of the body \n of the functions*}\nlemma call_send_correct:\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> LanguageCon.com.Call\n (Send_Message_Q,i) sat [Invariant B adds rems i \\\n \\evnt (\\locals ! i) = Send_Message_Q\\, Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i, Post_Arinc_i B adds rems i,UNIV]\" \napply (rule CallRec,(auto simp add: body_send reflexive_Guarantee_Send \n ))\n apply (simp_all add: sta_event_inv) \n using send_correct by (rule conseqPrePost, auto) \n\n \n lemma call_send_correct':\n \" i < Sys_Config.procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> LanguageCon.com.Call\n (Send_Message_Q, i) sat [Pre_QueCom_ch B adds rems ch_id \\\n \\evnt (\\locals ! i) =\n Send_Message_Q\\, Rely_Send_ReceiveQ\n i, Guarantee_Send_Receive i, Pre_QueCom_ch B adds rems ch_id,UNIV]\"\napply (rule CallRec,(auto simp add: body_send reflexive_Guarantee_Send)) \n apply (simp_all add:sta_event_inv_PreQue) \n using send_correct' by (rule conseqPrePost, auto) \n \nlemma execute'':\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> execute_service i sat [Invariant B adds rems i, \n Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i, Post_Arinc_i B adds rems i,UNIV]\" \nunfolding execute_service_def \n apply (rule If, auto simp add: reflexive_Guarantee_Send sta_invariant_rely_send,\n auto dest: call_send_correct ) \n apply (auto simp add: Sta_intro sta_not_event sta_not_event_inv Post_Arinc_i_def) \n apply (rule conseqPre, auto) \n by (rule Skip, auto simp add: sta_invariant_rely_send reflexive_Guarantee_Send)\n \n\n \nlemma execute''':\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> execute_service i sat [Pre_QueCom_ch B adds rems ch_id, \n Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i, Pre_QueCom_ch B adds rems ch_id,UNIV]\" \n unfolding execute_service_def \n apply (rule If, auto simp add: reflexive_Guarantee_Send sta_no_channel_rely_send, \n auto dest: call_send_correct' intro:conseqPre) \n apply (rule conseqPre, auto) \n by (rule Skip, auto simp add: sta_no_channel_rely_send reflexive_Guarantee_Send)\n\n\nlemma execute':\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> execute_service i sat [{s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id}, \n Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i,{s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id},UNIV]\" \n using execute''' Pre_Post_all by blast\n\n \n lemma execute:\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> execute_service i sat [{s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id} \\ \n Invariant B adds rems i, \n Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i, \n {s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id} \\ \n Post_Arinc_i B adds rems i, UNIV]\" \n apply (rule Conj_post[of _ _ _ _ _ _ _ _ UNIV _ UNIV, simplified]) \n apply (frule execute',rule conseqPrePost,auto) \n by (frule execute'',rule conseqPrePost,auto) \n\n\n \nlemma Send_Receive_Correct:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> \n (COBEGIN SCHEME [0 \\ i < procs conf]\n (execute_service i, {s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id} \\ Invariant B adds rems i,\n Rely_Send_ReceiveQ i, Guarantee_Send_Receive i,\n {s. \\ch_id. s\\Pre_QueCom_ch B adds rems ch_id} \\ Post_Arinc_i B adds rems i, \\ True \\)\n COEND)\n SAT [Inv_QueCom B adds rems, Id,\n {(x,y). True}, Inv_QueCom B adds rems, \\ True \\]\"\napply (subgoal_tac \"procs conf>0\") \n apply (rule Parallel) \n apply (auto simp add: LocalRG_HoareDef.Pre_def LocalRG_HoareDef.Rely_def \n Com_def Guar_def Post_def Abr_def execute,\n (auto simp add: Id_def Rely_Send_ReceiveQ_def Rely_Send_Receive_def state_conf_def )[1])\n apply (simp add: Guar_Rely_Send_ReceiveQ) \n apply (auto simp add: Guarantee_Send_Receive_def intro: n_n)\n apply (auto simp add:Inv_QueCom_def Pre_QueCom_ch_def Inv_QueCom_ch_def Invariant_def)[2] \n unfolding Pre_QueCom_ch_def Inv_QueCom_ch_def Inv_QueCom_def Post_Arinc_i_def Invariant_def\n by force\n\n\n lemma execute_mut:\n \"i < procs conf \\\n \\,{} \\\\<^bsub>/{}\\<^esub> execute_service i sat [{s. \\ch_id. s\\Pre_QueCom_ch_mut B adds rems ch_id} \\ \n Invariant_mut B adds rems i \\\n {s. \\ch_id. \\ch. (chans (communication_' s) ch_id = Some ch \\ mut ch = 0)}, \n Rely_Send_ReceiveQ i, \n Guarantee_Send_Receive i, \n {s. \\ch_id. s\\Pre_QueCom_ch_mut B adds rems ch_id} \\ \n Post_Arinc_i_mut B adds rems i, UNIV]\"\n apply (frule execute)\n apply (rule conseqPrePost,auto) \n by (auto simp add: Pre_QueCom_ch_mut_def Invariant_mut_def Pre_QueCom_ch_def Invariant_def Inv_QueCom_ch_mut_def\n Inv_QueCom_ch_def channel_spec_mut_def channel_spec_def Post_Arinc_i_mut_def Post_Arinc_i_def )\n\nlemma Send_Receive_Correct_mut:\n \"\\,{} \\\\<^bsub>/{}\\<^esub> \n (COBEGIN SCHEME [0 \\ i < procs conf]\n (execute_service i, {s. \\ch_id. s\\Pre_QueCom_ch_mut B adds rems ch_id} \\ \n Invariant_mut B adds rems i \\\n {s. \\ch_id. \\ch. (chans (communication_' s) ch_id = Some ch \\ mut ch = 0)},\n Rely_Send_ReceiveQ i, Guarantee_Send_Receive i,\n {s. \\ch_id. s\\Pre_QueCom_ch_mut B adds rems ch_id} \\ \n Post_Arinc_i_mut B adds rems i, \\ True \\)\n COEND) \n SAT [Inv_QueCom_mut B adds rems \\ \n {s. \\ch_id. \\ch. (chans (communication_' s) ch_id = Some ch \\ mut ch = 0)}, Id,\n {(x,y). True}, Inv_QueCom_mut B adds rems, \\ True \\]\"\napply (subgoal_tac \"procs conf>0\") \n apply (rule Parallel) \n apply (auto simp add: LocalRG_HoareDef.Pre_def LocalRG_HoareDef.Rely_def \n Com_def Guar_def Post_def Abr_def execute_mut,\n (auto simp add: Id_def Rely_Send_ReceiveQ_def Rely_Send_Receive_def state_conf_def )[1])\n apply (simp add: Guar_Rely_Send_ReceiveQ) \n apply (auto simp add: Guarantee_Send_Receive_def intro: n_n)\n apply (auto simp add:Inv_QueCom_mut_def Pre_QueCom_ch_mut_def Inv_QueCom_ch_mut_def Invariant_mut_def)[2] \n unfolding Pre_QueCom_ch_mut_def Inv_QueCom_ch_mut_def Inv_QueCom_mut_def Post_Arinc_i_mut_def Invariant_mut_def\n by force\n\nend \n ", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/Conc_Refinement/RefArinc/Communication/Spec/ArincSpecQueue.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.3040416749665474, "lm_q1q2_score": 0.15320847611364027}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__99_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__99_on_rules imports n_g2kAbsAfter_lemma_on_inv__99\nbegin\nsection{*All lemmas on causal relation between inv__99*}\nlemma lemma_inv__99_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__99 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__99) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__99) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__99_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.1528649621141932}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n The refinement relation between abstract and concrete states\n*)\n\ntheory StateRelation\nimports Invariants_H\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\ndefinition\n cte_map :: \"cslot_ptr \\ word32\"\nwhere\n \"cte_map \\ \\(oref, cref). oref + (of_bl cref * 2 ^ cte_level_bits)\"\n\nlemmas cte_map_def' = cte_map_def[simplified cte_level_bits_def, simplified]\n\ndefinition\n lookup_failure_map :: \"ExceptionTypes_A.lookup_failure \\ Fault_H.lookup_failure\"\nwhere\n \"lookup_failure_map \\ \\lf. case lf of\n ExceptionTypes_A.InvalidRoot \\ Fault_H.InvalidRoot\n | ExceptionTypes_A.MissingCapability n \\ Fault_H.MissingCapability n\n | ExceptionTypes_A.DepthMismatch n m \\ Fault_H.DepthMismatch n m\n | ExceptionTypes_A.GuardMismatch n g \\ Fault_H.GuardMismatch n (of_bl g) (length g)\"\n\nprimrec\n arch_fault_map :: \"Machine_A.ARM_A.arch_fault \\ ArchFault_H.ARM_H.arch_fault\"\nwhere\n \"arch_fault_map (Machine_A.ARM_A.VMFault ptr msg) = ArchFault_H.ARM_H.VMFault ptr msg\"\n\nprimrec\n fault_map :: \"ExceptionTypes_A.fault \\ Fault_H.fault\"\nwhere\n \"fault_map (ExceptionTypes_A.CapFault ref bool failure) =\n Fault_H.CapFault ref bool (lookup_failure_map failure)\"\n| \"fault_map (ExceptionTypes_A.ArchFault arch_fault) =\n Fault_H.ArchFault (arch_fault_map arch_fault)\"\n| \"fault_map (ExceptionTypes_A.UnknownSyscallException n) =\n Fault_H.UnknownSyscallException n\"\n| \"fault_map (ExceptionTypes_A.UserException x y) =\n Fault_H.UserException x y\"\n\n\ntext \\\n A pspace and a tree are related if every object in the pspace\n corresponds to an object in the tree. Some abstract objects\n like CapTables correspond to multiple concrete ones, thus we\n have to make cuts.\n\\\n\ntype_synonym obj_relation_cut = \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\ntype_synonym obj_relation_cuts = \"(word32 \\ obj_relation_cut) set\"\n\ndefinition\n vmrights_map :: \"rights set \\ vmrights\"\nwhere\n \"vmrights_map S \\ if AllowRead \\ S\n then (if AllowWrite \\ S then VMReadWrite else VMReadOnly)\n else VMKernelOnly\"\n\ndefinition\n zbits_map :: \"nat option \\ zombie_type\"\nwhere\n \"zbits_map N \\ case N of Some n \\ ZombieCNode n\n | None \\ ZombieTCB\"\n\nprimrec\n acap_relation :: \"arch_cap \\ arch_capability \\ bool\"\nwhere\n \"acap_relation (arch_cap.ASIDPoolCap x y) c = (c =\n arch_capability.ASIDPoolCap x y)\"\n| \"acap_relation (arch_cap.ASIDControlCap) c = (c =\n arch_capability.ASIDControlCap)\"\n| \"acap_relation (arch_cap.PageCap dev word rghts sz data) c = (c =\n arch_capability.PageCap dev word (vmrights_map rghts) sz data)\"\n| \"acap_relation (arch_cap.PageTableCap word data) c = (c =\n arch_capability.PageTableCap word data)\"\n| \"acap_relation (arch_cap.PageDirectoryCap word data) c = (c =\n arch_capability.PageDirectoryCap word data)\"\n\nprimrec\n cap_relation :: \"cap \\ capability \\ bool\"\nwhere\n \"cap_relation Structures_A.NullCap c = (c =\n Structures_H.NullCap)\"\n| \"cap_relation Structures_A.DomainCap c = (c =\n Structures_H.DomainCap)\"\n| \"cap_relation (Structures_A.UntypedCap dev ref n f) c = (c =\n Structures_H.UntypedCap dev ref n f)\"\n| \"cap_relation (Structures_A.EndpointCap ref b r) c = (c =\n Structures_H.EndpointCap ref b (AllowSend \\ r)\n (AllowRecv \\ r) (AllowGrant \\ r) (AllowGrantReply \\ r))\"\n| \"cap_relation (Structures_A.NotificationCap ref b r) c = (c =\n Structures_H.NotificationCap ref b (AllowSend \\ r) (AllowRecv \\ r))\"\n| \"cap_relation (Structures_A.CNodeCap ref n L) c = (c =\n Structures_H.CNodeCap ref n (of_bl L) (length L))\"\n| \"cap_relation (Structures_A.ThreadCap ref) c = (c =\n Structures_H.ThreadCap ref)\"\n| \"cap_relation (Structures_A.ReplyCap ref master r) c = (c =\n Structures_H.ReplyCap ref master (AllowGrant \\ r))\"\n| \"cap_relation (Structures_A.IRQControlCap) c = (c =\n Structures_H.IRQControlCap)\"\n| \"cap_relation (Structures_A.IRQHandlerCap irq) c = (c =\n Structures_H.IRQHandlerCap irq)\"\n| \"cap_relation (Structures_A.ArchObjectCap a) c = (\\a'.\n acap_relation a a' \\ c = Structures_H.ArchObjectCap a')\"\n| \"cap_relation (Structures_A.Zombie p b n) c = (c =\n Structures_H.Zombie p (zbits_map b) n)\"\n\n\ndefinition\n cte_relation :: \"cap_ref \\ obj_relation_cut\"\nwhere\n \"cte_relation y \\ \\ko ko'. \\sz cs cte cap. ko = CNode sz cs \\ ko' = KOCTE cte\n \\ cs y = Some cap \\ cap_relation cap (cteCap cte)\"\n\ndefinition\n asid_pool_relation :: \"(10 word \\ word32) \\ asidpool \\ bool\"\nwhere\n \"asid_pool_relation \\ \\p p'. p = inv ASIDPool p' o ucast\"\n\ndefinition\n ntfn_relation :: \"Structures_A.notification \\ Structures_H.notification \\ bool\"\nwhere\n \"ntfn_relation \\ \\ntfn ntfn'.\n (case ntfn_obj ntfn of\n Structures_A.IdleNtfn \\ ntfnObj ntfn' = Structures_H.IdleNtfn\n | Structures_A.WaitingNtfn q \\ ntfnObj ntfn' = Structures_H.WaitingNtfn q\n | Structures_A.ActiveNtfn b \\ ntfnObj ntfn' = Structures_H.ActiveNtfn b)\n \\ ntfn_bound_tcb ntfn = ntfnBoundTCB ntfn'\"\n\ndefinition\n ep_relation :: \"Structures_A.endpoint \\ Structures_H.endpoint \\ bool\"\nwhere\n \"ep_relation \\ \\ep ep'. case ep of\n Structures_A.IdleEP \\ ep' = Structures_H.IdleEP\n | Structures_A.RecvEP q \\ ep' = Structures_H.RecvEP q\n | Structures_A.SendEP q \\ ep' = Structures_H.SendEP q\"\n\ndefinition\n fault_rel_optionation :: \"ExceptionTypes_A.fault option \\ Fault_H.fault option \\ bool\"\nwhere\n \"fault_rel_optionation \\ \\f f'. f' = option_map fault_map f\"\n\nprimrec\n thread_state_relation :: \"Structures_A.thread_state \\ Structures_H.thread_state \\ bool\"\nwhere\n \"thread_state_relation (Structures_A.Running) ts'\n = (ts' = Structures_H.Running)\"\n| \"thread_state_relation (Structures_A.Restart) ts'\n = (ts' = Structures_H.Restart)\"\n| \"thread_state_relation (Structures_A.Inactive) ts'\n = (ts' = Structures_H.Inactive)\"\n| \"thread_state_relation (Structures_A.IdleThreadState) ts'\n = (ts' = Structures_H.IdleThreadState)\"\n| \"thread_state_relation (Structures_A.BlockedOnReply) ts'\n = (ts' = Structures_H.BlockedOnReply)\"\n| \"thread_state_relation (Structures_A.BlockedOnReceive oref sp) ts'\n = (ts' = Structures_H.BlockedOnReceive oref (receiver_can_grant sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnSend oref sp) ts'\n = (ts' = Structures_H.BlockedOnSend oref (sender_badge sp)\n (sender_can_grant sp) (sender_can_grant_reply sp) (sender_is_call sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnNotification oref) ts'\n = (ts' = Structures_H.BlockedOnNotification oref)\"\n\ndefinition\n arch_tcb_relation :: \"Structures_A.arch_tcb \\ Structures_H.arch_tcb \\ bool\"\nwhere\n \"arch_tcb_relation \\ \\atcb atcb'.\n tcb_context atcb = atcbContext atcb'\"\n\ndefinition\n tcb_relation :: \"Structures_A.tcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"tcb_relation \\ \\tcb tcb'.\n tcb_fault_handler tcb = to_bl (tcbFaultHandler tcb')\n \\ tcb_ipc_buffer tcb = tcbIPCBuffer tcb'\n \\ arch_tcb_relation (tcb_arch tcb) (tcbArch tcb')\n \\ thread_state_relation (tcb_state tcb) (tcbState tcb')\n \\ fault_rel_optionation (tcb_fault tcb) (tcbFault tcb')\n \\ cap_relation (tcb_ctable tcb) (cteCap (tcbCTable tcb'))\n \\ cap_relation (tcb_vtable tcb) (cteCap (tcbVTable tcb'))\n \\ cap_relation (tcb_reply tcb) (cteCap (tcbReply tcb'))\n \\ cap_relation (tcb_caller tcb) (cteCap (tcbCaller tcb'))\n \\ cap_relation (tcb_ipcframe tcb) (cteCap (tcbIPCBufferFrame tcb'))\n \\ tcb_bound_notification tcb = tcbBoundNotification tcb'\n \\ tcb_mcpriority tcb = tcbMCP tcb'\"\n\ndefinition\n other_obj_relation :: \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\nwhere\n \"other_obj_relation obj obj' \\\n (case (obj, obj') of\n (TCB tcb, KOTCB tcb') \\ tcb_relation tcb tcb'\n | (Endpoint ep, KOEndpoint ep') \\ ep_relation ep ep'\n | (Notification ntfn, KONotification ntfn') \\ ntfn_relation ntfn ntfn'\n | (ArchObj (ARM_A.ASIDPool pool), KOArch (KOASIDPool pool'))\n \\ asid_pool_relation pool pool'\n | _ \\ False)\"\n\nprimrec\n pde_relation' :: \"ARM_A.pde \\ ARM_H.pde \\ bool\"\nwhere\n \"pde_relation' ARM_A.InvalidPDE x = (x = ARM_H.InvalidPDE)\"\n| \"pde_relation' (ARM_A.PageTablePDE ptr atts domain) x\n = (x = ARM_H.PageTablePDE ptr (ParityEnabled \\ atts) domain)\"\n| \"pde_relation' (ARM_A.SectionPDE ptr atts domain rghts) x\n = (x = ARM_H.SectionPDE ptr (ParityEnabled \\ atts) domain\n (PageCacheable \\ atts) (Global \\ atts) (XNever \\ atts) (vmrights_map rghts))\"\n| \"pde_relation' (ARM_A.SuperSectionPDE ptr atts rghts) x\n = (x = ARM_H.SuperSectionPDE ptr (ParityEnabled \\ atts)\n (PageCacheable \\ atts) (Global \\ atts) (XNever \\ atts) (vmrights_map rghts))\"\n\n\nprimrec\n pte_relation' :: \"ARM_A.pte \\ ARM_H.pte \\ bool\"\nwhere\n \"pte_relation' ARM_A.InvalidPTE x = (x = ARM_H.InvalidPTE)\"\n| \"pte_relation' (ARM_A.LargePagePTE ptr atts rghts) x\n = (x = ARM_H.LargePagePTE ptr (PageCacheable \\ atts) (Global \\ atts)\n (XNever \\ atts) (vmrights_map rghts))\"\n| \"pte_relation' (ARM_A.SmallPagePTE ptr atts rghts) x\n = (x = ARM_H.SmallPagePTE ptr (PageCacheable \\ atts) (Global \\ atts)\n (XNever \\ atts) (vmrights_map rghts))\"\n\n\ndefinition\n pde_align' :: \"ARM_H.pde \\ nat\"\nwhere\n \"pde_align' pde \\\n case pde of ARM_H.pde.SuperSectionPDE _ _ _ _ _ _ \\ 4 | _ \\ 0\"\n\nlemmas pde_align_simps[simp] =\n pde_align'_def[split_simps ARM_A.pde.split]\n\ndefinition\n pte_align' :: \"ARM_H.pte \\ nat\"\nwhere\n \"pte_align' pte \\ case pte of ARM_H.pte.LargePagePTE _ _ _ _ _ \\ 4 | _ \\ 0\"\n\nlemmas pte_align_simps[simp] =\n pte_align'_def[split_simps ARM_A.pte.split]\n\ndefinition\n \"pde_relation_aligned y pde pde' \\\n if is_aligned y (pde_align' pde') then pde_relation' pde pde'\n else pde = ARM_A.InvalidPDE\"\n\ndefinition\n \"pte_relation_aligned y pte pte' \\\n if is_aligned y (pte_align' pte') then pte_relation' pte pte'\n else pte = ARM_A.InvalidPTE\"\n\ndefinition\n \"pte_relation y \\ \\ko ko'. \\pt pte. ko = ArchObj (PageTable pt) \\ ko' = KOArch (KOPTE pte)\n \\ pte_relation_aligned y (pt y) pte\"\n\ndefinition\n \"pde_relation y \\ \\ko ko'. \\pd pde. ko = ArchObj (PageDirectory pd) \\ ko' = KOArch (KOPDE pde)\n \\ pde_relation_aligned y (pd y) pde\"\n\nprimrec\n aobj_relation_cuts :: \"ARM_A.arch_kernel_obj \\ word32 \\ obj_relation_cuts\"\nwhere\n \"aobj_relation_cuts (DataPage dev sz) x =\n {(x + n * 2 ^ pageBits, \\_ obj. obj = (if dev then KOUserDataDevice else KOUserData) ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\"\n| \"aobj_relation_cuts (ARM_A.ASIDPool pool) x =\n {(x, other_obj_relation)}\"\n| \"aobj_relation_cuts (PageTable pt) x =\n (\\y. (x + (ucast y << 2), pte_relation y)) ` UNIV\"\n| \"aobj_relation_cuts (PageDirectory pd) x =\n (\\y. (x + (ucast y << 2), pde_relation y)) ` UNIV\"\n\nprimrec\n obj_relation_cuts :: \"Structures_A.kernel_object \\ word32 \\ obj_relation_cuts\"\nwhere\n \"obj_relation_cuts (CNode sz cs) x =\n (if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)})\"\n| \"obj_relation_cuts (TCB tcb) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Endpoint ep) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Notification ntfn) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (ArchObj ao) x = aobj_relation_cuts ao x\"\n\n\nlemma obj_relation_cuts_def2:\n \"obj_relation_cuts ko x =\n (case ko of CNode sz cs \\ if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)}\n | ArchObj (PageTable pt) \\ (\\y. (x + (ucast y << 2), pte_relation y))\n ` (UNIV :: word8 set)\n | ArchObj (PageDirectory pd) \\ (\\y. (x + (ucast y << 2), pde_relation y))\n ` (UNIV :: 12 word set)\n | ArchObj (DataPage dev sz) \\\n {(x + n * 2 ^ pageBits, \\_ obj. obj =(if dev then KOUserDataDevice else KOUserData)) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | _ \\ {(x, other_obj_relation)})\"\n by (simp split: Structures_A.kernel_object.split\n ARM_A.arch_kernel_obj.split)\n\nlemma obj_relation_cuts_def3:\n \"obj_relation_cuts ko x =\n (case (a_type ko) of\n ACapTable n \\ {(cte_map (x, y), cte_relation y) | y. length y = n}\n | AArch APageTable \\ (\\y. (x + (ucast y << 2), pte_relation y))\n ` (UNIV :: word8 set)\n | AArch APageDirectory \\ (\\y. (x + (ucast y << 2), pde_relation y))\n ` (UNIV :: 12 word set)\n | AArch (AUserData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserData) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AArch (ADeviceData sz) \\ {(x + n * 2 ^ pageBits, \\_ obj. obj = KOUserDataDevice ) | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AGarbage _ \\ {(x, \\\\)}\n | _ \\ {(x, other_obj_relation)})\"\n apply (simp add: obj_relation_cuts_def2 a_type_def\n split: Structures_A.kernel_object.split\n ARM_A.arch_kernel_obj.split)\n apply (clarsimp simp: well_formed_cnode_n_def length_set_helper)\n done\n\ndefinition\n \"is_other_obj_relation_type tp \\\n case tp of\n ACapTable n \\ False\n | AArch APageTable \\ False\n | AArch APageDirectory \\ False\n | AArch (AUserData _) \\ False\n | AArch (ADeviceData _) \\ False\n | AGarbage _ \\ False\n | _ \\ True\"\n\nlemma is_other_obj_relation_type_CapTable:\n \"\\ is_other_obj_relation_type (ACapTable n)\"\n by (simp add: is_other_obj_relation_type_def)\n\nlemma is_other_obj_relation_type_UserData:\n \"\\ is_other_obj_relation_type (AArch (AUserData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type_DeviceData:\n \"\\ is_other_obj_relation_type (AArch (ADeviceData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type:\n \"is_other_obj_relation_type (a_type ko) \\\n obj_relation_cuts ko x = {(x, other_obj_relation)}\"\n by (simp add: obj_relation_cuts_def3 is_other_obj_relation_type_def\n split: a_type.splits aa_type.splits)\n\ndefinition\n pspace_dom :: \"Structures_A.kheap \\ word32 set\"\nwhere\n \"pspace_dom ps \\ \\x\\dom ps. fst ` (obj_relation_cuts (the (ps x)) x)\"\n\ndefinition\n pspace_relation :: \"Structures_A.kheap \\ (word32 \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"pspace_relation ab con \\\n (pspace_dom ab = dom con) \\\n (\\x \\ dom ab. \\(y, P) \\ obj_relation_cuts (the (ab x)) x.\n P (the (ab x)) (the (con y)))\"\n\ndefinition etcb_relation :: \"etcb \\ Structures_H.tcb \\ bool\"\nwhere\n \"etcb_relation \\ \\etcb tcb'.\n tcb_priority etcb = tcbPriority tcb'\n \\ tcb_time_slice etcb = tcbTimeSlice tcb'\n \\ tcb_domain etcb = tcbDomain tcb'\"\n\ndefinition\n ekheap_relation :: \"(obj_ref \\ etcb option) \\ (word32 \\ Structures_H.kernel_object) \\ bool\"\nwhere\n \"ekheap_relation ab con \\\n \\x \\ dom ab. \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation (the (ab x)) tcb'\"\n\nprimrec\n sched_act_relation :: \"Deterministic_A.scheduler_action \\ Structures_H.scheduler_action \\ bool\"\nwhere\n \"sched_act_relation resume_cur_thread a' = (a' = ResumeCurrentThread)\" |\n \"sched_act_relation choose_new_thread a' = (a' = ChooseNewThread)\" |\n \"sched_act_relation (switch_thread x) a' = (a' = SwitchToThread x)\"\n\ndefinition\n ready_queues_relation :: \"(Deterministic_A.domain \\ Structures_A.priority \\ Deterministic_A.ready_queue)\n \\ (domain \\ priority \\ KernelStateData_H.ready_queue) \\ bool\"\nwhere\n \"ready_queues_relation qs qs' \\ \\d p. (qs d p = qs' (d, p))\"\n\ndefinition\n ghost_relation :: \"Structures_A.kheap \\ (word32 \\ vmpage_size) \\ (word32 \\ nat) \\ bool\"\nwhere\n \"ghost_relation h ups cns \\\n (\\a sz. (\\dev. h a = Some (ArchObj (DataPage dev sz))) \\ ups a = Some sz) \\\n (\\a n. (\\cs. h a = Some (CNode n cs) \\ well_formed_cnode_n n cs) \\\n cns a = Some n)\"\n\ndefinition\n cdt_relation :: \"(cslot_ptr \\ bool) \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_relation \\ \\cte_at m m'.\n \\c. cte_at c \\ cte_map ` descendants_of c m = descendants_of' (cte_map c) m'\"\n\ndefinition\n cdt_list_relation :: \"cdt_list \\ cdt \\ cte_heap \\ bool\"\nwhere\n \"cdt_list_relation \\ \\t m m'.\n \\c cap node. m' (cte_map c) = Some (CTE cap node)\n \\ (case next_slot c t m of None \\ True\n | Some next \\ mdbNext node = cte_map next)\"\n\ndefinition\n revokable_relation :: \"(cslot_ptr \\ bool) \\ (cslot_ptr \\ cap option) \\ cte_heap \\ bool\"\nwhere\n \"revokable_relation revo cs m' \\\n \\c cap node. cs c \\ None \\\n m' (cte_map c) = Some (CTE cap node) \\\n revo c = mdbRevocable node\"\n\ndefinition\n irq_state_relation :: \"irq_state \\ irqstate \\ bool\"\nwhere\n \"irq_state_relation irq irq' \\ case (irq, irq') of\n (irq_state.IRQInactive, irqstate.IRQInactive) \\ True\n | (irq_state.IRQSignal, irqstate.IRQSignal) \\ True\n | (irq_state.IRQTimer, irqstate.IRQTimer) \\ True\n | _ \\ False\"\n\ndefinition\n interrupt_state_relation :: \"(irq \\ obj_ref) \\ (irq \\ irq_state) \\ interrupt_state \\ bool\"\nwhere\n \"interrupt_state_relation node_map irqs is \\\n (\\node irqs'. is = InterruptState node irqs'\n \\ (\\irq. node_map irq = node + (ucast irq << cte_level_bits))\n \\ (\\irq. irq_state_relation (irqs irq) (irqs' irq)))\"\n\ndefinition\n arch_state_relation :: \"(arch_state \\ ARM_H.kernel_state) set\"\nwhere\n \"arch_state_relation \\ {(s, s') .\n arm_asid_table s = armKSASIDTable s' o ucast\n \\ arm_global_pd s = armKSGlobalPD s'\n \\ arm_hwasid_table s = armKSHWASIDTable s'\n \\ arm_global_pts s = armKSGlobalPTs s'\n \\ arm_next_asid s = armKSNextASID s'\n \\ arm_asid_map s = armKSASIDMap s'\n \\ arm_kernel_vspace s = armKSKernelVSpace s'}\"\n\n\ndefinition\n rights_mask_map :: \"rights set \\ Types_H.cap_rights\"\nwhere\n \"rights_mask_map \\ \\rs. CapRights (AllowWrite \\ rs) (AllowRead \\ rs) (AllowGrant \\ rs)\n (AllowGrantReply \\ rs)\"\n\n\nlemma obj_relation_cutsE:\n \"\\ (y, P) \\ obj_relation_cuts ko x; P ko ko';\n \\sz cs z cap cte. \\ ko = CNode sz cs; well_formed_cnode_n sz cs; y = cte_map (x, z);\n ko' = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte) \\\n \\ R;\n \\pt (z :: word8) pte'. \\ ko = ArchObj (PageTable pt); y = x + (ucast z << 2);\n ko' = KOArch (KOPTE pte'); pte_relation_aligned z (pt z) pte' \\\n \\ R;\n \\pd (z :: 12 word) pde'. \\ ko = ArchObj (PageDirectory pd); y = x + (ucast z << 2);\n ko' = KOArch (KOPDE pde'); pde_relation_aligned z (pd z) pde' \\\n \\ R;\n \\sz dev n. \\ ko = ArchObj (DataPage dev sz); ko' = (if dev then KOUserDataDevice else KOUserData);\n y = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits) \\ \\ R;\n \\ y = x; other_obj_relation ko ko'; is_other_obj_relation_type (a_type ko) \\ \\ R\n \\ \\ R\"\n apply (simp add: obj_relation_cuts_def2 is_other_obj_relation_type_def\n a_type_def\n split: Structures_A.kernel_object.split_asm if_split_asm\n ARM_A.arch_kernel_obj.split_asm)\n apply ((clarsimp split: if_splits,\n force simp: cte_relation_def pte_relation_def pde_relation_def)+)[5]\n done\n\nlemma eq_trans_helper:\n \"\\ x = y; P y = Q \\ \\ P x = Q\"\n by simp\n\nlemma cap_relation_case':\n \"cap_relation cap cap'\n = (case cap of cap.ArchObjectCap arch_cap.ASIDControlCap \\ cap_relation cap cap'\n | _ \\ cap_relation cap cap')\"\n by (simp split: cap.split arch_cap.split)\n\nschematic_goal cap_relation_case:\n \"cap_relation cap cap' = ?P\"\n apply (subst cap_relation_case')\n apply (clarsimp cong: cap.case_cong arch_cap.case_cong)\n apply (rule refl)\n done\n\nlemmas cap_relation_split =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split[where P=P]] for P\nlemmas cap_relation_split_asm =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split_asm[where P=P]] for P\n\n\n\ntext \\Relations on other data types that aren't stored but\n used as intermediate values in the specs.\\\n\nprimrec\n message_info_map :: \"Structures_A.message_info \\ Types_H.message_info\"\nwhere\n \"message_info_map (Structures_A.MI a b c d) = (Types_H.MI a b c d)\"\n\nlemma mi_map_label[simp]: \"msgLabel (message_info_map mi) = mi_label mi\"\n by (cases mi, simp)\n\nprimrec\n syscall_error_map :: \"ExceptionTypes_A.syscall_error \\ Fault_H.syscall_error\"\nwhere\n \"syscall_error_map (ExceptionTypes_A.InvalidArgument n) = Fault_H.InvalidArgument n\"\n| \"syscall_error_map (ExceptionTypes_A.InvalidCapability n) = (Fault_H.InvalidCapability n)\"\n| \"syscall_error_map ExceptionTypes_A.IllegalOperation = Fault_H.IllegalOperation\"\n| \"syscall_error_map (ExceptionTypes_A.RangeError n m) = Fault_H.RangeError n m\"\n| \"syscall_error_map ExceptionTypes_A.AlignmentError = Fault_H.AlignmentError\"\n| \"syscall_error_map (ExceptionTypes_A.FailedLookup b lf) = Fault_H.FailedLookup b (lookup_failure_map lf)\"\n| \"syscall_error_map ExceptionTypes_A.TruncatedMessage = Fault_H.TruncatedMessage\"\n| \"syscall_error_map ExceptionTypes_A.DeleteFirst = Fault_H.DeleteFirst\"\n| \"syscall_error_map ExceptionTypes_A.RevokeFirst = Fault_H.RevokeFirst\"\n| \"syscall_error_map (ExceptionTypes_A.NotEnoughMemory n) = Fault_H.syscall_error.NotEnoughMemory n\"\n\ndefinition\n APIType_map :: \"Structures_A.apiobject_type \\ ARM_H.object_type\"\nwhere\n \"APIType_map ty \\ case ty of\n Structures_A.Untyped \\ APIObjectType ArchTypes_H.Untyped\n | Structures_A.TCBObject \\ APIObjectType ArchTypes_H.TCBObject\n | Structures_A.EndpointObject \\ APIObjectType ArchTypes_H.EndpointObject\n | Structures_A.NotificationObject \\ APIObjectType ArchTypes_H.NotificationObject\n | Structures_A.CapTableObject \\ APIObjectType ArchTypes_H.CapTableObject\n | ArchObject ao \\ (case ao of\n SmallPageObj \\ SmallPageObject\n | LargePageObj \\ LargePageObject\n | SectionObj \\ SectionObject\n | SuperSectionObj \\ SuperSectionObject\n | PageTableObj \\ PageTableObject\n | PageDirectoryObj \\ PageDirectoryObject)\"\n\ndefinition\n state_relation :: \"(det_state \\ kernel_state) set\"\nwhere\n \"state_relation \\ {(s, s').\n pspace_relation (kheap s) (ksPSpace s')\n \\ ekheap_relation (ekheap s) (ksPSpace s')\n \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\n \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\n \\ ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\n \\ cdt_relation (swp cte_at s) (cdt s) (ctes_of s')\n \\ cdt_list_relation (cdt_list s) (cdt s) (ctes_of s')\n \\ revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s')\n \\ (arch_state s, ksArchState s') \\ arch_state_relation\n \\ interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s')\n \\ (cur_thread s = ksCurThread s')\n \\ (idle_thread s = ksIdleThread s')\n \\ (machine_state s = ksMachineState s')\n \\ (work_units_completed s = ksWorkUnitsCompleted s')\n \\ (domain_index s = ksDomScheduleIdx s')\n \\ (domain_list s = ksDomSchedule s')\n \\ (cur_domain s = ksCurDomain s')\n \\ (domain_time s = ksDomainTime s')}\"\n\ntext \\Rules for using states in the relation.\\\n\nlemma curthread_relation:\n \"(a, b) \\ state_relation \\ ksCurThread b = cur_thread a\"\n by (simp add: state_relation_def)\n\nlemma state_relation_pspace_relation[elim!]:\n \"(s,s') \\ state_relation \\ pspace_relation (kheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relation_ekheap_relation[elim!]:\n \"(s,s') \\ state_relation \\ ekheap_relation (ekheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relationD:\n assumes sr: \"(s, s') \\ state_relation\"\n shows \"pspace_relation (kheap s) (ksPSpace s') \\\n ekheap_relation (ekheap s) (ksPSpace s') \\\n sched_act_relation (scheduler_action s) (ksSchedulerAction s') \\\n ready_queues_relation (ready_queues s) (ksReadyQueues s') \\\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') \\\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s') \\\n (arch_state s, ksArchState s') \\ arch_state_relation \\\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \\\n cur_thread s = ksCurThread s' \\\n idle_thread s = ksIdleThread s' \\\n machine_state s = ksMachineState s' \\\n work_units_completed s = ksWorkUnitsCompleted s' \\\n domain_index s = ksDomScheduleIdx s' \\\n domain_list s = ksDomSchedule s' \\\n cur_domain s = ksCurDomain s' \\\n domain_time s = ksDomainTime s'\"\n using sr unfolding state_relation_def by simp\n\nlemma state_relationE [elim?]:\n assumes sr: \"(s, s') \\ state_relation\"\n and rl: \"\\pspace_relation (kheap s) (ksPSpace s');\n ekheap_relation (ekheap s) (ksPSpace s');\n sched_act_relation (scheduler_action s) (ksSchedulerAction s');\n ready_queues_relation (ready_queues s) (ksReadyQueues s');\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s');\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s');\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s');\n (arch_state s, ksArchState s') \\ arch_state_relation;\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s');\n cur_thread s = ksCurThread s';\n idle_thread s = ksIdleThread s';\n machine_state s = ksMachineState s';\n work_units_completed s = ksWorkUnitsCompleted s';\n domain_index s = ksDomScheduleIdx s';\n domain_list s = ksDomSchedule s';\n cur_domain s = ksCurDomain s';\n domain_time s = ksDomainTime s' \\ \\ R\"\n shows \"R\"\n using sr by (blast intro!: rl dest: state_relationD)\n\ntext \\This isn't defined for arch objects\\\n\nlemmas isCap_defs =\n isZombie_def isArchObjectCap_def\n isThreadCap_def isCNodeCap_def isNotificationCap_def\n isEndpointCap_def isUntypedCap_def isNullCap_def\n isIRQHandlerCap_def isIRQControlCap_def isReplyCap_def\n isPageCap_def isPageTableCap_def isPageDirectoryCap_def\n isASIDControlCap_def isASIDPoolCap_def isArchPageCap_def\n isDomainCap_def\n\nlemma isCNodeCap_cap_map [simp]:\n \"cap_relation c c' \\ isCNodeCap c' = is_cnode_cap c\"\n apply (cases c, simp_all add: isCap_defs split: sum.splits)\n apply clarsimp+\n done\n\nlemma sts_rel_idle :\n \"thread_state_relation st IdleThreadState = (st = Structures_A.IdleThreadState)\"\n by (cases st, auto)\n\nlemma pspace_relation_absD:\n \"\\ ab x = Some y; pspace_relation ab con \\\n \\ \\(x', P) \\ obj_relation_cuts y x. \\z. con x' = Some z \\ P y z\"\n apply (clarsimp simp add: pspace_relation_def)\n apply (drule bspec, erule domI)\n apply simp\n apply (drule(1) bspec)\n apply (subgoal_tac \"a \\ pspace_dom ab\")\n apply clarsimp\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def rev_bexI)\n done\n\nlemma ekheap_relation_absD:\n \"\\ ab x = Some y; ekheap_relation ab con \\\n \\ \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation y tcb'\"\n by (force simp add: ekheap_relation_def)\n\nlemma in_related_pspace_dom:\n \"\\ s' x = Some y; pspace_relation s s' \\ \\ x \\ pspace_dom s\"\n by (clarsimp simp add: pspace_relation_def)\n\nlemma pspace_dom_revE:\n \"\\ x \\ pspace_dom ps; \\ko y P. \\ ps y = Some ko; (x, P) \\ obj_relation_cuts ko y \\ \\ R \\ \\ R\"\n by (clarsimp simp add: pspace_dom_def)\n\nlemma pspace_dom_relatedE:\n \"\\ s' x = Some ko'; pspace_relation s s';\n \\y ko P. \\ s y = Some ko; (x, P) \\ obj_relation_cuts ko y; P ko ko' \\ \\ R\n \\ \\ R\"\n apply (rule pspace_dom_revE [OF in_related_pspace_dom],\n assumption+)\n apply (frule(1) pspace_relation_absD)\n apply fastforce\n done\n\nlemma ghost_relation_typ_at:\n \"ghost_relation (kheap s) ups cns \\\n (\\a sz. data_at sz a s = (ups a = Some sz)) \\\n (\\a n. typ_at (ACapTable n) a s = (cns a = Some n))\"\n apply (rule eq_reflection)\n apply (clarsimp simp: ghost_relation_def typ_at_eq_kheap_obj data_at_def)\n apply (intro conjI impI iffI allI,simp_all)\n apply (auto elim!: allE)\n done\n\nend\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/refine/ARM/StateRelation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.15286495784282544}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__54_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__54_on_rules imports n_german_lemma_on_inv__54\nbegin\nsection{*All lemmas on causal relation between inv__54*}\nlemma lemma_inv__54_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__54 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__54) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__54) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__54_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.2942149845400438, "lm_q1q2_score": 0.15285095770635815}} {"text": "(* Title: JinjaThreads/MM/JMM_Compiler_Type2.thy\n Author: Andreas Lochbihler *)\n\nheader {* \\isaheader{Compiler correctness for JMM heap implementation 2} *}\n\ntheory JMM_Compiler_Type2\nimports\n JMM_Compiler\n JMM_J_Typesafe\n JMM_JVM_Typesafe\n JMM_Interp\nbegin\n\ntheorem J2JVM_jmm_correct:\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"jmm_wf_start_state P C M vs\"\n shows \"legal_execution P (jmm_J_\\ P C M vs Running) (E, ws) \\ \n legal_execution (J2JVM P) (jmm_JVMd_\\ (J2JVM P) C M vs Running) (E, ws)\"\nusing JVMd_legal_typesafe[OF wt_J2JVM[OF wf], of C M vs Running, symmetric] wf_start\nby(simp only: J_legal_typesafe[OF assms] J_JVM_conf_read.red_\\_eq_mexecd_\\[OF jmm'_J_JVM_conf_read assms] J2JVM_def o_apply compP1_def compP2_def legal_execution_compP heap_base.wf_start_state_compP jmm_typeof_addr_compP heap_base.heap_read_typed_compP)\n\ntheorem J2JVM_jmm_correct_weak:\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"jmm_wf_start_state P C M vs\"\n shows \"weakly_legal_execution P (jmm_J_\\ P C M vs Running) (E, ws) \\ \n weakly_legal_execution (J2JVM P) (jmm_JVMd_\\ (J2JVM P) C M vs Running) (E, ws)\"\nusing JVMd_weakly_legal_typesafe[OF wt_J2JVM[OF wf], of C M vs Running, symmetric] wf_start\nby(simp only: J_weakly_legal_typesafe[OF assms] J_JVM_conf_read.red_\\_eq_mexecd_\\[OF jmm'_J_JVM_conf_read assms] J2JVM_def o_apply compP1_def compP2_def weakly_legal_execution_compP heap_base.wf_start_state_compP jmm_typeof_addr_compP heap_base.heap_read_typed_compP)\n\ntheorem J2JVM_jmm_correctly_synchronized:\n assumes wf: \"wf_J_prog P\"\n and wf_start: \"jmm_wf_start_state P C M vs\"\n and ka: \"\\(ka_Val ` set vs) \\ set jmm.start_addrs\"\n shows \"correctly_synchronized (J2JVM P) (jmm_JVMd_\\ (J2JVM P) C M vs Running) \\ \n correctly_synchronized P (jmm_J_\\ P C M vs Running)\"\n (is \"?lhs \\ ?rhs\")\nproof\n assume ?lhs\n show ?rhs unfolding correctly_synchronized_def\n proof(intro strip)\n fix E ws a a'\n assume E: \"E \\ jmm_J_\\ P C M vs Running\"\n and wf_exec: \"P \\ (E, ws) \\\"\n and sc: \"sequentially_consistent P (E, ws)\"\n and actions: \"a \\ actions E\" \"a' \\ actions E\"\n and conflict: \"P,E \\ a \\ a'\"\n\n from E wf_exec sc\n have \"legal_execution P (jmm_J_\\ P C M vs Running) (E, ws)\"\n by(rule sc_legal.SC_is_legal[OF J_allocated_progress.J_sc_legal[OF jmm_J_allocated_progress wf jmm_heap_read_typeable wf_start ka]])\n hence \"legal_execution (J2JVM P) (jmm_JVMd_\\ (J2JVM P) C M vs Running) (E, ws)\"\n by(simp only: J2JVM_jmm_correct[OF wf wf_start])\n hence \"E \\ jmm_JVMd_\\ (J2JVM P) C M vs Running\" \"J2JVM P \\ (E, ws) \\\"\n by(simp_all add: gen_legal_execution.simps)\n moreover from sc have \"sequentially_consistent (J2JVM P) (E, ws)\"\n by(simp add: J2JVM_def compP2_def)\n moreover from conflict have \"J2JVM P,E \\ a \\ a'\"\n by(simp add: J2JVM_def compP2_def)\n ultimately have \"J2JVM P,E \\ a \\hb a' \\ J2JVM P,E \\ a' \\hb a\"\n using `?lhs` actions by(auto simp add: correctly_synchronized_def)\n thus \"P,E \\ a \\hb a' \\ P,E \\ a' \\hb a\"\n by(simp add: J2JVM_def compP2_def)\n qed\nnext\n assume ?rhs\n show ?lhs unfolding correctly_synchronized_def\n proof(intro strip)\n fix E ws a a'\n assume E: \"E \\ jmm_JVMd_\\ (J2JVM P) C M vs Running\"\n and wf_exec: \"J2JVM P \\ (E, ws) \\\"\n and sc: \"sequentially_consistent (J2JVM P) (E, ws)\"\n and actions: \"a \\ actions E\" \"a' \\ actions E\"\n and conflict: \"J2JVM P,E \\ a \\ a'\"\n\n from wf have \"wf_jvm_prog (J2JVM P)\" by(rule wt_J2JVM)\n then obtain \\ where wf': \"wf_jvm_prog\\<^bsub>\\\\<^esub> (J2JVM P)\"\n by(auto simp add: wf_jvm_prog_def)\n from wf_start have wf_start': \"jmm_wf_start_state (J2JVM P) C M vs\"\n by(simp add: J2JVM_def compP2_def heap_base.wf_start_state_compP)\n from E wf_exec sc\n have \"legal_execution (J2JVM P) (jmm_JVMd_\\ (J2JVM P) C M vs Running) (E, ws)\"\n by(rule sc_legal.SC_is_legal[OF JVM_allocated_progress.JVM_sc_legal[OF jmm_JVM_allocated_progress wf' jmm_heap_read_typeable wf_start' ka]])\n hence \"legal_execution P (jmm_J_\\ P C M vs Running) (E, ws)\"\n by(simp only: J2JVM_jmm_correct[OF wf wf_start])\n hence \"E \\ jmm_J_\\ P C M vs Running\" \"P \\ (E, ws) \\\"\n by(simp_all add: gen_legal_execution.simps)\n moreover from sc have \"sequentially_consistent P (E, ws)\"\n by(simp add: J2JVM_def compP2_def)\n moreover from conflict have \"P,E \\ a \\ a'\"\n by(simp add: J2JVM_def compP2_def)\n ultimately have \"P,E \\ a \\hb a' \\ P,E \\ a' \\hb a\"\n using `?rhs` actions by(auto simp add: correctly_synchronized_def)\n thus \"J2JVM P,E \\ a \\hb a' \\ J2JVM P,E \\ a' \\hb a\" \n by(simp add: J2JVM_def compP2_def)\n qed\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_Compiler_Type2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.2942149721629888, "lm_q1q2_score": 0.15285095127621418}} {"text": "(* This work was done by Denis Lohner (denis.lohner@kit.edu). *)\n\nchapter \\A Control Flow Graph for Jinja Byte Code\\\n\nsection \\Formalizing the CFG\\\n\ntheory JVMCFG imports \"../Basic/BasicDefs\" Jinja.BVExample begin\n\n\ndeclare lesub_list_impl_same_size [simp del]\ndeclare listE_length [simp del]\n\nsubsection \\Type definitions\\\n\nsubsubsection \\Wellformed Programs\\\n\ndefinition \"wf_jvmprog = {(P, Phi). wf_jvm_prog\\<^bsub>Phi\\<^esub> P}\"\n\ntypedef wf_jvmprog = wf_jvmprog\nproof\n show \"(E, Phi) \\ wf_jvmprog\"\n unfolding wf_jvmprog_def by (auto intro: wf_prog)\nqed\n\nhide_const Phi E\n\nabbreviation rep_jvmprog_jvm_prog :: \"wf_jvmprog \\ jvm_prog\"\n(\"_\\<^bsub>wf\\<^esub>\")\n where \"P\\<^bsub>wf\\<^esub> \\ fst(Rep_wf_jvmprog(P))\"\n\nabbreviation rep_jvmprog_phi :: \"wf_jvmprog \\ ty\\<^sub>P\"\n(\"_\\<^bsub>\\\\<^esub>\")\n where \"P\\<^bsub>\\\\<^esub> \\ snd(Rep_wf_jvmprog(P))\"\n\nlemma wf_jvmprog_is_wf: \"wf_jvm_prog\\<^bsub>P\\<^bsub>\\\\<^esub>\\<^esub> (P\\<^bsub>wf\\<^esub>)\"\nusing Rep_wf_jvmprog [of P]\n by (auto simp: wf_jvmprog_def split_beta)\n\nsubsubsection \\Basic Types\\\n\ntext \\\nWe consider a program to be a well-formed Jinja program,\ntogether with a given base class and a main method\n\\\n\ntype_synonym jvmprog = \"wf_jvmprog \\ cname \\ mname\"\ntype_synonym callstack = \"(cname \\ mname \\ pc) list\"\n\ntext \\\nThe state is modeled as $\\textrm{heap} \\times \\textrm{stack-variables} \\times \\textrm{local-variables}$\n\nstack and local variables are modeled as pairs of natural numbers. The first number\ngives the position in the call stack (i.e. the method in which the variable is used),\nthe second the position in the method's stack or array of local variables resp.\n\nThe stack variables are numbered from bottom up (which is the reverse order of the\narray for the stack in Jinja's state representation), whereas local variables are identified\nby their position in the array of local variables of Jinja's state representation.\n\\\n\ntype_synonym state = \"heap \\ ((nat \\ nat) \\ val) \\ ((nat \\ nat) \\ val)\"\n\n\nabbreviation heap_of :: \"state \\ heap\"\nwhere\n \"heap_of s \\ fst(s)\"\n\nabbreviation stk_of :: \"state \\ ((nat \\ nat) \\ val)\"\nwhere\n \"stk_of s \\ fst(snd(s))\"\n\nabbreviation loc_of :: \"state \\ ((nat \\ nat) \\ val)\"\nwhere\n \"loc_of s \\ snd(snd(s))\"\n\n\nsubsection \\Basic Definitions\\\n\nsubsubsection \\State update (instruction execution)\\\n\ntext \\\nThis function models instruction execution for our state representation.\n\nAdditional parameters are the call depth of the current program point,\nthe stack length of the current program point,\nthe length of the stack in the underlying call frame (needed for {\\sc Return}),\nand (for {\\sc Invoke}) the length of the array of local variables of the invoked method.\n\nException handling is not covered by this function.\n\\\n\nfun exec_instr :: \"instr \\ wf_jvmprog \\ state \\ nat \\ nat \\ nat \\ nat \\ state\"\nwhere\n exec_instr_Load:\n \"exec_instr (Load n) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s\n in (h, stk((calldepth,stk_length):=loc(calldepth,n)), loc))\"\n\n| exec_instr_Store:\n \"exec_instr (Store n) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s\n in (h, stk, loc((calldepth,n):=stk(calldepth,stk_length - 1))))\"\n\n| exec_instr_Push:\n \"exec_instr (Push v) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s\n in (h, stk((calldepth,stk_length):=v), loc))\"\n\n| exec_instr_New:\n \"exec_instr (New C) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s;\n a = the(new_Addr h)\n in (h(a \\ (blank (P\\<^bsub>wf\\<^esub>) C)), stk((calldepth,stk_length):=Addr a), loc))\"\n\n| exec_instr_Getfield:\n \"exec_instr (Getfield F C) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s;\n a = the_Addr (stk (calldepth,stk_length - 1));\n (D,fs) = the(h a)\n in (h, stk((calldepth,stk_length - 1) := the(fs(F,C))), loc))\"\n\n| exec_instr_Putfield:\n \"exec_instr (Putfield F C) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s;\n v = stk (calldepth,stk_length - 1);\n a = the_Addr (stk (calldepth,stk_length - 2));\n (D,fs) = the(h a)\n in (h(a \\ (D,fs((F,C) \\ v))), stk, loc))\"\n\n| exec_instr_Checkcast:\n \"exec_instr (Checkcast C) P s calldepth stk_length rs ill = s\"\n\n| exec_instr_Pop:\n \"exec_instr (Pop) P s calldepth stk_length rs ill = s\"\n\n| exec_instr_IAdd:\n \"exec_instr (IAdd) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s;\n i\\<^sub>1 = the_Intg (stk (calldepth, stk_length - 1));\n i\\<^sub>2 = the_Intg (stk (calldepth, stk_length - 2))\n in (h, stk((calldepth, stk_length - 2) := Intg (i\\<^sub>1 + i\\<^sub>2)), loc))\"\n\n| exec_instr_IfFalse:\n \"exec_instr (IfFalse b) P s calldepth stk_length rs ill = s\"\n\n| exec_instr_CmpEq:\n \"exec_instr (CmpEq) P s calldepth stk_length rs ill =\n (let (h,stk,loc) = s;\n v\\<^sub>1 = stk (calldepth, stk_length - 1);\n v\\<^sub>2 = stk (calldepth, stk_length - 2)\n in (h, stk((calldepth, stk_length - 2) := Bool (v\\<^sub>1 = v\\<^sub>2)), loc))\"\n\n| exec_instr_Goto:\n \"exec_instr (Goto i) P s calldepth stk_length rs ill = s\"\n \n| exec_instr_Throw:\n \"exec_instr (Throw) P s calldepth stk_length rs ill = s\"\n\n| exec_instr_Invoke:\n \"exec_instr (Invoke M n) P s calldepth stk_length rs invoke_loc_length =\n (let (h,stk,loc) = s;\n loc' = (\\(a,b). if (a \\ Suc calldepth \\ b \\ invoke_loc_length) then loc(a,b) else\n (if (b \\ n) then stk(calldepth, stk_length - (Suc n - b)) else arbitrary))\n in (h,stk,loc'))\"\n\n| exec_instr_Return:\n \"exec_instr (Return) P s calldepth stk_length ret_stk_length ill =\n (if (calldepth = 0)\n then s\n else\n (let (h,stk,loc) = s;\n v = stk(calldepth, stk_length - 1)\n in (h,stk((calldepth - 1, ret_stk_length - 1) := v),loc))\n )\"\n\n\nsubsubsection \\length of stack and local variables\\\n\ntext \\The following terms extract the stack length at a given program point\nfrom the well-typing of the given program\\\n\nabbreviation stkLength :: \"wf_jvmprog \\ cname \\ mname \\ pc \\ nat\"\n where\n \"stkLength P C M pc \\ length (fst(the(((P\\<^bsub>\\\\<^esub>) C M)!pc)))\"\n\nabbreviation locLength :: \"wf_jvmprog \\ cname \\ mname \\ pc \\ nat\"\n where\n \"locLength P C M pc \\ length (snd(the(((P\\<^bsub>\\\\<^esub>) C M)!pc)))\"\n\n\nsubsubsection \\Conversion functions\\\n\ntext \\\nThis function takes a natural number n and a function f with domain \\nat\\\nand creates the array [f 0, f 1, f 2, ..., f (n - 1)].\n\nThis is used for extracting the array of local variables\n\\\n\n(*\nfun locs :: \"nat \\ (nat \\ 'a) \\ 'a list\"\nwhere\n \"locs 0 loc = []\"\n| \"locs (Suc n) loc = (locs n loc)@[loc n]\"\n*)\n\nabbreviation locs :: \"nat \\ (nat \\ 'a) \\ 'a list\"\nwhere \"locs n loc \\ map loc [0..\nThis function takes a natural number n and a function f with domain \\nat\\\nand creates the array [f (n - 1), ..., f 1, f 0].\n\nThis is used for extracting the stack as a list\n\\\n\n(*\nfun stks :: \"nat \\ (nat \\ 'a) \\ 'a list\"\nwhere\n \"stks 0 stk = []\"\n| \"stks (Suc n) stk = (stk n)#(stks n stk)\"\n*)\n\nabbreviation stks :: \"nat \\ (nat \\ 'a) \\ 'a list\"\nwhere \"stks n stk \\ map stk (rev [0..\nThis function creates a list of the arrays for local variables from the given state\ncorresponding to the given callstack\n\\\n\nfun locss :: \"wf_jvmprog \\ callstack \\ ((nat \\ nat) \\ 'a) \\ 'a list list\"\nwhere\n \"locss P [] loc = []\"\n| \"locss P ((C,M,pc)#cs) loc =\n (locs (locLength P C M pc) (\\a. loc (length cs, a)))#(locss P cs loc)\"\n\ntext \\\nThis function creates a list of the (methods') stacks from the given state\ncorresponding to the given callstack\n\\\n\nfun stkss :: \"wf_jvmprog \\ callstack \\ ((nat \\ nat) \\ 'a) \\ 'a list list\"\nwhere\n \"stkss P [] stk = []\"\n| \"stkss P ((C,M,pc)#cs) stk =\n (stks (stkLength P C M pc) (\\a. stk (length cs, a)))#(stkss P cs stk)\"\n\ntext \\Given a callstack and a state, this abbreviation converts the state\nto Jinja's state representation\n\\\n\nabbreviation state_to_jvm_state :: \"wf_jvmprog \\ callstack \\ state \\ jvm_state\"\nwhere \"state_to_jvm_state P cs s \\ \n (None, heap_of s, zip (stkss P cs (stk_of s)) (zip (locss P cs (loc_of s)) cs))\"\n\ntext \\This function extracts the call stack from a given frame stack (as it is given\nby Jinja's state representation)\n\\\n\ndefinition framestack_to_callstack :: \"frame list \\ callstack\"\nwhere \"framestack_to_callstack frs \\ map snd (map snd frs)\"\n\n\nsubsubsection \\State Conformance\\\n\ntext \\Now we lift byte code verifier conformance to our state representation\\\n\ndefinition bv_conform :: \"wf_jvmprog \\ callstack \\ state \\ bool\"\n (\"_,_ \\\\<^bsub>BV\\<^esub> _ \\\")\nwhere \"P,cs \\\\<^bsub>BV\\<^esub> s \\ \\ correct_state (P\\<^bsub>wf\\<^esub>) (P\\<^bsub>\\\\<^esub>) (state_to_jvm_state P cs s)\"\n\n\nsubsubsection \\Statically determine catch-block\\\n\ntext \\This function is equivalent to Jinja's \\find_handler\\ function\\\nfun find_handler_for :: \"wf_jvmprog \\ cname \\ callstack \\ callstack\"\nwhere\n \"find_handler_for P C [] = []\"\n| \"find_handler_for P C (c#cs) = (let (C',M',pc') = c in\n (case match_ex_table (P\\<^bsub>wf\\<^esub>) C pc' (ex_table_of (P\\<^bsub>wf\\<^esub>) C' M') of\n None \\ find_handler_for P C cs\n | Some pc_d \\ (C', M', fst pc_d)#cs))\"\n\n\nsubsection \\Simplification lemmas\\\n\nlemma find_handler_decr [simp]: \"find_handler_for P Exc cs \\ c#cs\"\nproof\n assume \"find_handler_for P Exc cs = c#cs\"\n hence \"length cs < length (find_handler_for P Exc cs)\" by simp\n thus False by (induct cs, auto)\nqed\n\n(*\nlemma locs_length [simp]: \"length (locs n loc) = n\"\n by (induct n) auto\n\nlemma stks_length [simp]: \"length (stks n stk) = n\"\n by (induct n) auto\n*)\n\nlemma stkss_length [simp]: \"length (stkss P cs stk) = length cs\"\n by (induct cs) auto\n\nlemma locss_length [simp]: \"length (locss P cs loc) = length cs\"\n by (induct cs) auto\n\n(*\nlemma nth_stks: \"b < n \\ stks n stk ! b = stk(n - Suc b)\"\n by (auto simp: rev_nth)\nproof (induct n arbitrary: b)\n case (0 b)\n thus ?case by simp\nnext\n case (Suc n b)\n thus ?case\n by (auto simp: nth_Cons' less_Suc_eq)\nqed\n*)\n\nlemma nth_stkss: \n \"\\ a < length cs; b < length (stkss P cs stk ! (length cs - Suc a)) \\\n \\ stkss P cs stk ! (length cs - Suc a) ! \n (length (stkss P cs stk ! (length cs - Suc a)) - Suc b) = stk (a,b)\"\nproof (induct cs)\n case Nil\n thus ?case by (simp add: nth_Cons')\nnext\n case (Cons aa cs)\n thus ?case\n by (cases aa, auto simp add: nth_Cons' rev_nth less_Suc_eq)\nqed\n\n(*\nlemma nth_locs: \"b < n \\ locs n loc ! b = loc b\"\nproof (induct n)\n case 0\n thus ?case by simp\nnext\n case (Suc n)\n thus ?case\n by (auto simp: nth_append less_Suc_eq)\nqed\n*)\n\nlemma nth_locss:\n \"\\ a < length cs; b < length (locss P cs loc ! (length cs - Suc a)) \\\n \\ locss P cs loc ! (length cs - Suc a) ! b = loc (a,b)\"\nproof (induct cs)\n case Nil\n thus ?case by (simp add: nth_Cons')\nnext\n case (Cons aa cs)\n thus ?case\n by (cases aa, auto simp: nth_Cons' (* nth_locs *) less_Suc_eq)\nqed\n\nlemma hd_stks [simp]: \"n \\ 0 \\ hd (stks n stk) = stk(n - 1)\"\n by (cases n, simp_all)\n\nlemma hd_tl_stks: \"n > 1 \\ hd (tl (stks n stk)) = stk(n - 2)\"\n by (cases n, auto)\n\n(*\nlemma stks_purge:\n \"d \\ b \\ stks b (stk(d := e)) = stks b stk\"\n by (induct b, auto)\n\nlemma stks_purge':\n \"d \\ b \\ stks b (\\x. if x = d then e else stk x) = stks b stk\"\n by (fold fun_upd_def, simp only: stks_purge)\n*)\n\nlemma stkss_purge:\n \"length cs \\ a \\ stkss P cs (stk((a,b) := c)) = stkss P cs stk\"\n by (induct cs, auto (* simp: stks_purge *))\n\nlemma stkss_purge':\n \"length cs \\ a \\ stkss P cs (\\s. if s = (a, b) then c else stk s) = stkss P cs stk\"\n by (fold fun_upd_def, simp only: stkss_purge)\n\n(*\nlemma locs_purge:\n \"d \\ b \\ locs b (loc(d := e)) = locs b loc\"\n by (induct b, auto)\n\nlemma locs_purge':\n \"d \\ b \\ locs b (\\b. if b = d then e else loc b) = locs b loc\"\n by (fold fun_upd_def, simp only: locs_purge)\n*)\n \nlemma locss_purge:\n \"length cs \\ a \\ locss P cs (loc((a,b) := c)) = locss P cs loc\"\n by (induct cs, auto (*simp: locs_purge *))\n\nlemma locss_purge':\n \"length cs \\ a \\ locss P cs (\\s. if s = (a, b) then c else loc s) = locss P cs loc\"\n by (fold fun_upd_def, simp only: locss_purge)\n\nlemma locs_pullout [simp]:\n \"locs b (loc(n := e)) = (locs b loc) [n := e]\"\nproof (induct b)\n case 0\n thus ?case by simp\nnext\n case (Suc b)\n thus ?case\n by (cases \"n - b\", auto simp: list_update_append not_less_eq less_Suc_eq)\nqed\n\nlemma locs_pullout' [simp]:\n \"locs b (\\a. if a = n then e else loc (c, a)) = (locs b (\\a. loc (c, a))) [n := e]\"\n by (fold fun_upd_def) simp\n\nlemma stks_pullout:\n \"n < b \\ stks b (stk(n := e)) = (stks b stk) [b - Suc n := e]\"\nproof (induct b)\n case 0\n thus ?case by simp\nnext\n case (Suc b)\n thus ?case\n proof (cases \"b = n\")\n case True\n with Suc show ?thesis\n by auto\n(* by (auto simp: stks_purge') *)\n next\n case False\n with Suc show ?thesis\n by (cases \"b - n\") (auto intro!: nth_equalityI simp: nth_list_update)\n qed\nqed\n\nlemma nth_tl : \"xs \\ [] \\ tl xs ! n = xs ! (Suc n)\"\n by (cases xs, simp_all)\n\nlemma f2c_Nil [simp]: \"framestack_to_callstack [] = []\"\n by (simp add: framestack_to_callstack_def)\n\nlemma f2c_Cons [simp]:\n \"framestack_to_callstack ((stk,loc,C,M,pc)#frs) = (C,M,pc)#(framestack_to_callstack frs)\"\n by (simp add: framestack_to_callstack_def)\n\nlemma f2c_length [simp]:\n \"length (framestack_to_callstack frs) = length frs\"\n by (simp add: framestack_to_callstack_def)\n\nlemma f2c_s2jvm_id [simp]:\n \"framestack_to_callstack\n (snd(snd(state_to_jvm_state P cs s))) =\n cs\"\n by (cases s, simp add: framestack_to_callstack_def)\n\nlemma f2c_s2jvm_id' [simp]:\n \"framestack_to_callstack\n (zip (stkss P cs stk) (zip (locss P cs loc) cs)) = cs\"\n by (simp add: framestack_to_callstack_def)\n\nlemma f2c_append [simp]:\n \"framestack_to_callstack (frs @ frs') =\n (framestack_to_callstack frs) @ (framestack_to_callstack frs')\"\n by (simp add: framestack_to_callstack_def)\n\n\nsubsection \\CFG construction\\\n\nsubsection \\Datatypes\\\n\ntext \\Nodes are labeled with a callstack and an optional tuple (consisting of\na callstack and a flag).\n\nThe first callstack determines the current program point (i.e. the next statement\nto execute). If the second parameter is not None, we are at an intermediate state,\nwhere the target of the instruction is determined (the second callstack)\nand the flag is set to whether an exception is thrown or not.\n\\\ndatatype j_node =\n Entry (\"'('_Entry'_')\")\n | Node \"callstack\" \"(callstack \\ bool) option\" (\"'('_ _,_ '_')\")\n\ntext \\The empty callstack indicates the exit node\\\n\nabbreviation j_node_Exit :: \"j_node\" (\"'('_Exit'_')\")\nwhere \"j_node_Exit \\ (_ [],None _)\"\n\ntext \\An edge is a triple, consisting of two nodes and the edge kind\\\n\ntype_synonym j_edge = \"(j_node \\ state edge_kind \\ j_node)\"\n\n\nsubsection \\CFG\\\n\ntext \\\nThe CFG is constructed by a case analysis on the instructions and\ntheir different behavior in different states. E.g. the exceptional behavior of\n{\\sc New}, if there is no more space in the heap, vs. the normal behavior.\n\nNote: The set of edges defined by this predicate is a first approximation to the\nreal set of edges in the CFG. We later (theory JVMInterpretation) add some well-formedness\nrequirements to the nodes.\n\\\n\ninductive JVM_CFG :: \"jvmprog \\ j_node \\ state edge_kind \\ j_node \\ bool\"\n (\"_ \\ _ -_\\ _\")\nwhere\n JCFG_EntryExit:\n \"prog \\ (_Entry_) -(\\s. False)\\<^sub>\\\\ (_Exit_)\"\n\n| JCFG_EntryStart:\n \"prog = (P, C0, Main) \\ prog \\ (_Entry_) -(\\s. True)\\<^sub>\\\\ (_ [(C0, Main, 0)],None _)\"\n\n| JCFG_ReturnExit:\n \"\\ prog = (P,C0,Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Return \\\n \\ prog \\ (_ [(C, M, pc)],None _) -\\id\\ (_Exit_)\"\n\n| JCFG_Straight_NoExc:\n \"\\ prog = (P, C0, Main);\n instrs_of (P\\<^bsub>wf\\<^esub>) C M ! pc \\ {Load idx, Store idx, Push val, Pop, IAdd, CmpEq};\n ek = \\(\\s. exec_instr ((instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc) P s\n (length cs) (stkLength P C M pc) arbitrary arbitrary) \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_New_Normal_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (New Cl);\n ek = (\\(h,stk,loc). new_Addr h \\ None)\\<^sub>\\\\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs,False)\\ _)\"\n\n| JCFG_New_Normal_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (New Cl);\n ek = \\(\\s. exec_instr (New Cl) P s (length cs) (stkLength P C M pc) arbitrary arbitrary) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs, False)\\ _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_New_Exc_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (New Cl);\n find_handler_for P OutOfMemory ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc). new_Addr h = None)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs',True)\\ _)\"\n\n| JCFG_New_Exc_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (New Cl);\n find_handler_for P OutOfMemory ((C, M, pc)#cs) = (C', M', pc')#cs';\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) := Addr (addr_of_sys_xcpt OutOfMemory)),\n loc)\n ) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_New_Exc_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (New Cl);\n find_handler_for P OutOfMemory ((C, M, pc)#cs) = [] \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([], True)\\ _) -\\id\\ (_Exit_)\"\n\n| JCFG_Getfield_Normal_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Getfield Fd Cl);\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 1) \\ Null)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs, False)\\ _)\"\n\n| JCFG_Getfield_Normal_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Getfield Fd Cl);\n ek = \\(\\s. exec_instr (Getfield Fd Cl) P s (length cs) (stkLength P C M pc)\n arbitrary arbitrary) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs, False)\\ _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_Getfield_Exc_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Getfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 1) = Null)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs', True)\\ _)\"\n\n| JCFG_Getfield_Exc_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Getfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = (C', M', pc')#cs';\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) := Addr (addr_of_sys_xcpt NullPointer)),\n loc)\n ) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_Getfield_Exc_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Getfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = [] \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([], True)\\ _) -\\id\\ (_Exit_)\"\n\n| JCFG_Putfield_Normal_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Putfield Fd Cl);\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 2) \\ Null)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs, False)\\ _)\"\n\n| JCFG_Putfield_Normal_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Putfield Fd Cl);\n ek = \\(\\s. exec_instr (Putfield Fd Cl) P s (length cs) (stkLength P C M pc)\n arbitrary arbitrary) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C, M, Suc pc)#cs, False)\\ _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_Putfield_Exc_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Putfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 2) = Null)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs', True)\\ _)\"\n\n| JCFG_Putfield_Exc_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Putfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = (C', M', pc')#cs';\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) := Addr (addr_of_sys_xcpt NullPointer)),\n loc)\n ) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_Putfield_Exc_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Putfield Fd Cl);\n find_handler_for P NullPointer ((C, M, pc)#cs) = [] \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([], True)\\ _) -\\id\\ (_Exit_)\"\n\n| JCFG_Checkcast_Normal_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Checkcast Cl);\n ek = (\\(h,stk,loc). cast_ok (P\\<^bsub>wf\\<^esub>) Cl h (stk(length cs, stkLength P C M pc - Suc 0)))\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_Checkcast_Exc_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Checkcast Cl);\n find_handler_for P ClassCast ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc). \\ cast_ok (P\\<^bsub>wf\\<^esub>) Cl h (stk(length cs, stkLength P C M pc - Suc 0)))\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs', True)\\ _)\"\n\n| JCFG_Checkcast_Exc_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Checkcast Cl);\n find_handler_for P ClassCast ((C, M, pc)#cs) = (C', M', pc')#cs';\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) := Addr (addr_of_sys_xcpt ClassCast)),\n loc)\n ) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_Checkcast_Exc_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Checkcast Cl);\n find_handler_for P ClassCast ((C, M, pc)#cs) = [] \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([], True)\\ _) -\\id\\ (_Exit_)\"\n\n| JCFG_Invoke_Normal_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Invoke M2 n);\n cd = length cs;\n stk_length = stkLength P C M pc;\n ek = (\\(h,stk,loc).\n stk(cd, stk_length - Suc n) \\ Null \\\n fst(method (P\\<^bsub>wf\\<^esub>) (cname_of h (the_Addr(stk(cd, stk_length - Suc n)))) M2) = D\n )\\<^sub>\\ \\\n \\\n prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\((D, M2, 0)#(C, M, pc)#cs, False)\\ _)\"\n\n| JCFG_Invoke_Normal_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Invoke M2 n);\n stk_length = stkLength P C M pc;\n loc_length = locLength P D M2 0;\n ek = \\(\\s. exec_instr (Invoke M2 n) P s (length cs) stk_length arbitrary loc_length)\n \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((D, M2, 0)#(C, M, pc)#cs, False)\\ _) -ek\\\n (_ (D, M2, 0)#(C, M, pc)#cs,None _)\"\n\n| JCFG_Invoke_Exc_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Invoke m2 n);\n find_handler_for P NullPointer ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - Suc n) = Null)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs', True)\\ _)\"\n\n| JCFG_Invoke_Exc_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Invoke M2 n);\n find_handler_for P NullPointer ((C, M, pc)#cs) = (C', M', pc')#cs';\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) := Addr (addr_of_sys_xcpt NullPointer)),\n loc)\n )\n \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_Invoke_Exc_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (Invoke M2 n);\n find_handler_for P NullPointer ((C, M, pc)#cs) = [] \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([], True)\\ _) -\\id\\ (_Exit_)\"\n\n| JCFG_Return_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Return;\n stk_length = stkLength P C M pc;\n r_stk_length = stkLength P C' M' (Suc pc');\n ek = \\(\\s. exec_instr Return P s (Suc (length cs)) stk_length r_stk_length arbitrary) \\\n \\ prog \\ (_ (C, M, pc)#(C', M', pc')#cs,None _) -ek\\ (_ (C', M', Suc pc')#cs,None _)\"\n\n| JCFG_Goto_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Goto idx \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -\\id\\ (_ (C, M, nat (int pc + idx))#cs,None _)\"\n\n| JCFG_IfFalse_False:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (IfFalse b);\n b \\ 1;\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 1) = Bool False)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, nat (int pc + b))#cs,None _)\"\n\n| JCFG_IfFalse_Next:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = (IfFalse b);\n ek = (\\(h,stk,loc). stk(length cs, stkLength P C M pc - 1) \\ Bool False \\ b = 1)\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, Suc pc)#cs,None _)\"\n\n| JCFG_Throw_Pred:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Throw;\n cd = length cs;\n stk_length = stkLength P C M pc;\n \\Exc. find_handler_for P Exc ((C, M, pc)#cs) = cs';\n ek = (\\(h,stk,loc).\n (stk(length cs, stkLength P C M pc - 1) = Null \\\n find_handler_for P NullPointer ((C, M, pc)#cs) = cs') \\\n (stk(length cs, stkLength P C M pc - 1) \\ Null \\\n find_handler_for P (cname_of h (the_Addr(stk(cd, stk_length - 1)))) ((C, M, pc)#cs) = cs')\n )\\<^sub>\\ \\\n \\ prog \\ (_ (C, M, pc)#cs,None _) -ek\\ (_ (C, M, pc)#cs,\\(cs', True)\\ _)\"\n\n| JCFG_Throw_Update:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Throw;\n ek = \\(\\(h,stk,loc).\n (h,\n stk((length cs',(stkLength P C' M' pc') - 1) :=\n if (stk(length cs, stkLength P C M pc - 1) = Null) then\n Addr (addr_of_sys_xcpt NullPointer)\n else (stk(length cs, stkLength P C M pc - 1))),\n loc)\n ) \\\n \\ prog \\ (_ (C, M, pc)#cs,\\((C', M', pc')#cs', True)\\ _) -ek\\ (_ (C', M', pc')#cs',None _)\"\n\n| JCFG_Throw_Exit:\n \"\\ prog = (P, C0, Main);\n (instrs_of (P\\<^bsub>wf\\<^esub>) C M) ! pc = Throw \\\n \\ prog \\ (_ (C, M, pc)#cs,\\([],True)\\ _) -\\id\\ (_Exit_)\"\n\n\nsubsection \\CFG properties\\\n\n\n\nlemma JVMCFG_Entry_no_targetnode [dest]:\n assumes edge:\"prog \\ n -et\\ (_Entry_)\"\n shows \"False\"\nproof -\n { fix n' have \"\\prog \\ n -et\\ n'; n' = (_Entry_)\\ \\ False\"\n by (auto elim!: JVM_CFG.cases)\n }\n with edge show ?thesis by fastforce\nqed\n\nlemma JVMCFG_EntryD:\n \"\\(P,C,M) \\ n -et\\ n'; n = (_Entry_)\\ \n \\ (n' = (_Exit_) \\ et = (\\s. False)\\<^sub>\\) \\ (n' = (_ [(C,M,0)],None _) \\ et = (\\s. True)\\<^sub>\\)\"\nby (erule JVM_CFG.cases) simp_all\n\ndeclare split_def [simp add]\ndeclare find_handler_for.simps [simp del]\n\n(* The following lemma explores many cases, it takes a little to prove *)\nlemma JVMCFG_edge_det:\n \"\\prog \\ n -et\\ n'; prog \\ n -et'\\ n'\\ \\ et = et'\"\n by (erule JVM_CFG.cases, (erule JVM_CFG.cases, fastforce+)+)\n\ndeclare split_def [simp del]\ndeclare find_handler_for.simps [simp add]\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/JinjaVM/JVMCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5078118642792043, "lm_q2_score": 0.3007455914759599, "lm_q1q2_score": 0.15272217948115918}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__3_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__3_on_rules imports n_g2kAbsAfter_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__3 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__3) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__3) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.3007455664065234, "lm_q1q2_score": 0.15272216675060193}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__55_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__55_on_rules imports n_german_lemma_on_inv__55\nbegin\nsection{*All lemmas on causal relation between inv__55*}\nlemma lemma_inv__55_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__55 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__55) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__55) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__55_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.2845759920814681, "lm_q1q2_score": 0.15227616618765263}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__34_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__34_on_rules imports n_g2kAbsAfter_lemma_on_inv__34\nbegin\nsection{*All lemmas on causal relation between inv__34*}\nlemma lemma_inv__34_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__34 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__34) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__34) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__34_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.2974699426047947, "lm_q1q2_score": 0.15222030903126849}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Schedule_DR\nimports Finalise_DR\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\n(* getActiveTCBs returns a subset of CapDL's all_active_tcbs. *)\nlemma getActiveTCBs_subset:\n \"\\ getActiveTCB x s' = Some y; invs s'; valid_etcbs s' \\ \\\n x \\ all_active_tcbs (transform s')\"\n apply (clarsimp simp: all_active_tcbs_def getActiveTCB_def)\n apply (clarsimp simp: transform_def transform_objects_def map_add_def domIff)\n apply (clarsimp dest!: get_tcb_SomeD split: option.splits if_split_asm)\n apply (rule context_conjI)\n apply (clarsimp simp: restrict_map_def)\n apply (frule invs_valid_idle)\n apply (clarsimp simp: valid_idle_def pred_tcb_def2 get_tcb_def)\n apply (clarsimp simp: restrict_map_def split: if_split_asm)\n apply (clarsimp simp: transform_object_def transform_tcb_def)\n apply (clarsimp simp: infer_tcb_pending_op_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (case_tac \"tcb_state y\", auto simp: tcb_pending_op_slot_def tcb_boundntfn_slot_def)\n done\n\n\n(* allActiveTCBs should be a subset of those allowed in CapDL. *)\ndefinition\n allActiveTCBs_relation :: \"cdl_object_id set \\ word32 set \\ bool\"\nwhere\n \"allActiveTCBs_relation a b \\ b \\ a\"\n\n(* allActiveTCBs correspond *)\nlemma allActiveTCBs_corres:\n \"dcorres allActiveTCBs_relation \\ (invs and valid_etcbs) (gets all_active_tcbs) allActiveTCBs\"\n apply (clarsimp simp: allActiveTCBs_def gets_def)\n apply (clarsimp simp: corres_underlying_def)\n apply (clarsimp simp: exec_get split_def return_def)\n apply (clarsimp simp: allActiveTCBs_relation_def)\n apply (auto simp: getActiveTCBs_subset)\n done\n\ncrunch idle_thread[wp]: switch_to_idle_thread \"\\s. P (idle_thread s)\"\n\nlemma dcorres_arch_switch_to_idle_thread_return: \"dcorres dc \\ \\ (return ()) arch_switch_to_idle_thread\"\n apply (clarsimp simp: arch_switch_to_idle_thread_def)\n apply (rule corres_guard_imp)\n apply (rule dcorres_gets_all_param)\n apply (rule dcorres_set_vm_root)\n by simp+\n\nlemma change_current_domain_same: \"\\(=) s\\ change_current_domain \\\\\\r. (=) s\\\"\n apply (clarsimp simp: change_current_domain_def exs_valid_def bind_def return_def gets_def modify_def put_def fst_def snd_def get_def select_def)\n apply (rule_tac x=\"cdl_current_domain s\" in exI)\n apply clarsimp\n done\n\nlemma switch_to_idle_thread_dcorres:\n \"dcorres dc \\ (invs and valid_etcbs) (Schedule_D.switch_to_thread None) switch_to_idle_thread\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def switch_to_idle_thread_def)\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split_noop_rhs)\n apply (clarsimp simp: corres_underlying_def gets_def modify_def get_def put_def do_machine_op_def select_f_def split_def bind_def in_return)\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply assumption\n apply (rule dcorres_arch_switch_to_idle_thread_return)\n apply (wp | simp)+\n done\n\n\n(* Switching to the idle thread and switching to \"None\" are equivalent. *)\nlemma change_current_domain_and_switch_to_idle_thread_dcorres:\n \"dcorres dc \\ (invs and valid_etcbs)\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n switch_to_idle_thread\"\n including no_pre\n apply (clarsimp simp: Schedule_D.switch_to_thread_def switch_to_idle_thread_def)\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_l)\n apply (rule_tac R=\\ in corres_split_noop_rhs)\n apply (clarsimp simp: corres_underlying_def gets_def modify_def get_def put_def do_machine_op_def select_f_def split_def bind_def in_return)\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply assumption\n apply (rule dcorres_arch_switch_to_idle_thread_return)\n apply (wp change_current_domain_same | simp)+\n done\n\nlemma arch_switch_to_thread_dcorres:\n \"dcorres dc \\ (invs and (\\s. idle_thread s \\ t) and valid_etcbs)\n (return ())\n (arch_switch_to_thread t)\"\n apply (clarsimp simp: arch_switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_guard_imp)\n apply (rule corres_split [OF _ dcorres_set_vm_root])\n apply simp\n apply (rule dcorres_machine_op_noop)\n apply (simp add: ARM.clearExMonitor_def, wp)[1]\n apply (wp|simp)+\n done\n\ncrunch idle_thread [wp]: arch_switch_to_thread \"\\s. P (idle_thread s)\"\n (simp: crunch_simps wp: crunch_wps ignore: ARM.clearExMonitor)\n\n(*\n * Setting the current thread.\n *)\nlemma switch_to_thread_corres:\n \"dcorres dc \\ (invs and (\\s. idle_thread s \\ x) and valid_etcbs)\n (Schedule_D.switch_to_thread (Some x)) (Schedule_A.switch_to_thread x)\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def Schedule_A.switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_symb_exec_r)\n apply (rule corres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split [OF _ arch_switch_to_thread_dcorres])\n apply simp\n apply (rule dcorres_rhs_noop_above[OF tcb_sched_action_dcorres])\n apply (rule corres_modify [where P=\\ and P'=\"\\s. idle_thread s \\ x\"])\n apply (clarsimp simp: transform_def)\n apply (simp add: transform_current_thread_def transform_asid_table_def)\n apply (wp+)[4]\n apply simp\n apply assumption\n apply (clarsimp|wp)+\n done\n\nlemma corrupt_intents_current_thread:\n \"cdl_current_thread (corrupt_intents x p s) = cdl_current_thread s\"\n by (simp add: corrupt_intents_def)\n\ncrunch cdl_cur: corrupt_frame \"\\s. cdl_current_thread s = x\"\n (wp: select_wp simp: corrupt_intents_current_thread)\n\n(* Switching to the active thread has no effect. *)\nlemma switch_to_thread_idempotent_corres:\n \"dcorres dc (\\s. cdl_current_thread s = x) \\ (Schedule_D.switch_to_thread x) (return ())\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def)\n apply (clarsimp simp: modify_def)\n apply (clarsimp simp: corres_underlying_def)\n apply (clarsimp simp: transform_def transform_current_thread_def)\n apply (clarsimp simp: in_return)\n apply (auto simp: in_return get_def put_def split_def bind_def)[1]\n done\n\n(* getActiveTCB on the idle thread always returns None. *)\nlemma getActiveTCB_idle: \"invs s \\ getActiveTCB (idle_thread s) s = None\"\n apply (frule invs_valid_idle)\n apply (clarsimp simp: valid_idle_def getActiveTCB_def)\n apply (clarsimp simp: pred_tcb_at_def get_tcb_def get_obj_def obj_at_def)\n done\n\nlemma switch_to_thread_same_corres:\n \"dcorres dc (\\s. x = y) (invs and (\\s. idle_thread s \\ x) and valid_etcbs)\n (Schedule_D.switch_to_thread (Some y)) (Schedule_A.switch_to_thread x)\"\n apply (clarsimp simp: Schedule_D.switch_to_thread_def\n Schedule_A.switch_to_thread_def)\n apply (rule corres_dummy_return_pl)\n apply (rule corres_symb_exec_r)\n apply (rule corres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule corres_split [OF _ arch_switch_to_thread_dcorres])\n apply simp\n apply (rule dcorres_rhs_noop_above[OF tcb_sched_action_dcorres])\n apply (rule corres_modify [where P'=\"\\s. idle_thread s \\ x\"])\n apply (clarsimp simp: transform_def transform_current_thread_def transform_asid_table_def)\n apply (simp add: transform_current_thread_def transform_asid_table_def)\n apply (wp+)[4]\n apply simp\n apply assumption\n apply (clarsimp|wp)+\n done\n\nlemma set_scheduler_action_dcorres:\n \"dcorres dc \\ \\ (return ()) (set_scheduler_action sa)\"\n by (clarsimp simp: corres_underlying_def set_scheduler_action_def modify_def get_def put_def bind_def return_def)\n\nlemma switch_to_thread_None_dcorres_L:\n \"dcorres dc (\\s. cdl_current_thread s = None) \\\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n (return ())\"\n apply (auto simp: Schedule_D.switch_to_thread_def modify_def corres_underlying_def get_def put_def bind_def return_def\n change_current_domain_def gets_def select_def transform_def)\n done\n\n\nlemma switch_to_thread_None_dcorres:\n \"dcorres dc \\ (\\s. cur_thread s = idle_thread s)\n (do _ \\ change_current_domain;\n Schedule_D.switch_to_thread None\n od)\n (return ())\"\n apply (rule_tac Q=\"\\s. cdl_current_thread s = None\" and Q'=\"\\\" in stronger_corres_guard_imp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (clarsimp simp: transform_def transform_current_thread_def)+\n done\n\nlemma schedule_resume_cur_thread_dcorres_L:\n \"\\cur cur_ts. dcorres dc ((\\s. \\t tcb. cdl_current_thread s = Some t \\\n (\\d. s = s \\cdl_current_domain := d\\) \\\n t \\ active_tcbs_in_domain (cdl_current_domain s) s)\n or (\\s. cdl_current_thread s = None)) \\\n Schedule_D.schedule\n (do idle_t \\ gets idle_thread;\n assert (runnable cur_ts \\ cur = idle_t)\n od)\"\n unfolding Schedule_D.schedule_def\n apply (rule corres_either_alternate2)\n apply (rule corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (clarsimp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule dcorres_symb_exec_r)\n apply (clarsimp simp: assert_def)\n apply (rule conjI, clarsimp)\n apply (fold dc_def)\n apply (rule switch_to_thread_idempotent_corres)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_idempotent_corres)\n apply (clarsimp simp: corres_underlying_def fail_def)\n apply (wp | simp)+\n apply (fastforce simp: select_def gets_def active_tcbs_in_domain_def bind_def return_def domIff\n get_def fst_def modify_def put_def change_current_domain_def)\n apply simp\n apply (rule corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (clarsimp simp: assert_def)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (rule conjI, clarsimp)\n apply (rule switch_to_thread_None_dcorres_L)\n apply (clarsimp simp: corres_underlying_def fail_def)\n apply (wp | simp | fastforce)+\n done\n\n\nlemma schedule_resume_cur_thread_dcorres:\n \"\\cur cur_ts. dcorres dc \\ (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s \\ invs s \\ scheduler_action s = resume_cur_thread)\n Schedule_D.schedule\n (do idle_t \\ gets idle_thread;\n assert (runnable cur_ts \\ cur = idle_t)\n od)\"\n apply (rule stronger_corres_guard_imp)\n apply (rule schedule_resume_cur_thread_dcorres_L)\n apply (case_tac \"cur \\ idle_thread s'\")\n apply (clarsimp simp: valid_sched_def valid_sched_action_def is_activatable_def invs_def valid_state_def\n pred_tcb_at_def obj_at_def ct_in_cur_domain_def in_cur_domain_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def tcb_boundntfn_slot_def tcb_pending_op_slot_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def st_tcb_def2 get_tcb_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)[1]\n (* cur = idle_thread s' *)\n apply (subgoal_tac \"cdl_current_thread s = None\")\n apply (clarsimp simp: transform_def transform_current_thread_def)+\n done\n\nlemma schedule_switch_thread_helper:\n \"\\ valid_etcbs s;\n valid_sched s;\n invs s;\n scheduler_action s = switch_thread t\n \\\n \\ t \\ active_tcbs_in_domain (cur_domain s) (transform s)\"\n apply (clarsimp simp: valid_sched_def valid_sched_action_def weak_valid_sched_action_def is_activatable_def invs_def\n valid_state_def pred_tcb_at_def obj_at_def switch_in_cur_domain_def in_cur_domain_def only_idle_def)\n apply (frule(1) valid_etcbs_tcb_etcb)\n apply (clarsimp simp: valid_idle_def pred_tcb_at_def)\n apply (drule_tac s=\"idle_thread s\" in sym)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def pred_tcb_at_def get_tcb_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)\n done\n\nlemma schedule_choose_new_thread_helper:\n \"\\ ready_queues s (cur_domain s) prio \\ [];\n t = hd (ready_queues s (cur_domain s) prio);\n valid_sched_except_blocked s;\n invs s;\n scheduler_action s = choose_new_thread\n \\\n \\ (\\y. cdl_objects (transform s) t = Some y) \\ t \\ active_tcbs_in_domain (cur_domain s) (transform s)\"\n apply (clarsimp simp: valid_sched_def valid_sched_action_def is_activatable_def invs_def\n valid_state_def pred_tcb_at_def obj_at_def DetSchedInvs_AI.valid_queues_def\n max_non_empty_queue_def only_idle_def)\n apply (erule_tac x=\"cur_domain s\" in allE)\n apply (erule_tac x=\"prio\" in allE)\n apply clarsimp\n apply (erule_tac x=\"hd (ready_queues s (cur_domain s) prio)\" in ballE)\n apply (clarsimp simp: valid_idle_def pred_tcb_at_def)\n apply (drule_tac s=\"idle_thread s\" in sym)\n apply (auto simp: transform_def transform_current_thread_def all_active_tcbs_def transform_objects_def active_tcbs_in_domain_def etcb_at_def\n is_etcb_at_def\n map_add_def restrict_map_def option_map_def transform_object_def transform_tcb_def valid_idle_def st_tcb_def2 get_tcb_def\n transform_cnode_contents_def infer_tcb_pending_op_def transform_cap_def domIff st_tcb_at_kh_def obj_at_def only_idle_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n split: option.splits if_split Structures_A.kernel_object.splits Structures_A.thread_state.splits)\n done\n\nlemma idle_thread_not_in_queue:\n \"\\ valid_idle s; DetSchedInvs_AI.valid_queues s; ready_queues s d p \\ [] \\ \\ idle_thread s \\ hd (ready_queues s d p)\"\n apply (clarsimp simp: valid_idle_def DetSchedInvs_AI.valid_queues_def pred_tcb_at_def obj_at_def)\n apply (erule_tac x=\"d\" in allE)\n apply (erule_tac x=\"p\" in allE)\n apply clarsimp\n apply (erule_tac x=\"idle_thread s\" in ballE)\n apply clarsimp\n apply (frule hd_in_set)\n apply clarsimp\n done\n\nlemma change_current_domain_dcorres: \"dcorres dc \\ \\ change_current_domain next_domain\"\n by (auto simp: corres_underlying_def change_current_domain_def next_domain_def bind_def return_def modify_def Let_def put_def select_def\n get_def transform_def trans_state_def transform_objects_def transform_cdt_def transform_current_thread_def\n transform_asid_table_def)\n\nlemma max_set_not_empty:\n \"\\x::'a::{linorder,finite}. f x \\ [] \\ f (Max {x. f x \\ []}) \\ []\"\n apply (rule_tac S=\"{x. f x \\ []}\" in Max_prop)\n apply auto\n done\n\nlemma next_domain_valid_sched_except_blocked[wp]:\n \"\\ valid_sched_except_blocked and (\\s. scheduler_action s = choose_new_thread)\\ next_domain \\ \\_. valid_sched_except_blocked \\\"\n apply (simp add: next_domain_def Let_def)\n apply (wp, simp add: valid_sched_def valid_sched_action_2_def ct_not_in_q_2_def)\n done\n\n\nlemma schedule_def_2:\n \"Schedule_D.schedule \\ do\n change_current_domain;\n (do\n next_domain \\ gets cdl_current_domain;\n threads \\ gets (active_tcbs_in_domain next_domain);\n next_thread \\ select threads;\n Schedule_D.switch_to_thread (Some next_thread)\n od \\ Schedule_D.switch_to_thread None)\n od\"\n unfolding Schedule_D.schedule_def\n apply (subst alternative_bind_distrib_2, simp)\n done\n\nlemma schedule_choose_new_thread_dcorres:\n \"dcorres dc \\\n (\\s. valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread)\n Schedule_D.schedule\n schedule_choose_new_thread\"\n unfolding schedule_choose_new_thread_def\n apply (clarsimp simp: guarded_switch_to_def bind_assoc choose_thread_def)\n apply (rule dcorres_symb_exec_r, rename_tac dom_t)\n apply (case_tac \"dom_t \\ 0\")\n apply (clarsimp)\n apply (rule dcorres_symb_exec_r, rename_tac cur_dom)\n apply (rule dcorres_symb_exec_r, rename_tac rq)\n apply (rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n (* No threads in ready_queues *)\n apply (rule corres_guard_imp)\n apply (rule corres_if_rhs)\n apply (clarsimp simp: Schedule_D.schedule_def)\n apply (rule corres_alternate2)\n apply (rule change_current_domain_and_switch_to_idle_thread_dcorres)\n (* Threads in ready_queues *)\n apply (simp only: Schedule_D.schedule_def)\n unfolding max_non_empty_queue_def\n apply (rule corres_alternate1)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule_tac P'=\"\\s. ready_queues s (cur_domain s) = rq \\ valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\"\n in stronger_corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (clarsimp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply clarsimp\n apply (frule_tac prio=\"(Max {prio. ready_queues s' (cur_domain s') prio \\ []})\" in schedule_choose_new_thread_helper,simp,simp,simp,simp,simp)\n apply (clarsimp simp: valid_sched_def DetSchedInvs_AI.valid_queues_def max_non_empty_queue_def)\n apply (auto simp: select_def gets_def get_def bind_def return_def active_tcbs_in_domain_def\n invs_def valid_state_def valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def tcb_at_def)[1]\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def max_non_empty_queue_def)\n apply (frule_tac p=\"Max {prio. ready_queues s' (cur_domain s') prio \\ []}\" in idle_thread_not_in_queue,simp,simp)\n apply (clarsimp)\n apply (wp hoare_drop_imp| simp | clarsimp simp: valid_sched_def)+\n apply (frule max_set_not_empty, fastforce)\n apply (wp hoare_drop_imp| simp)+\n apply (clarsimp simp: valid_sched_def)\n (* dom_t = 0 *)\n apply (simp only: schedule_def_2)\n apply (rule corres_guard_imp)\n apply (rule_tac r'=\"\\_ _. True\" and P=\\ and P'=\\ and R=\"\\_. \\\" and R'=\"\\_ s. valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\" in corres_split)\n apply (clarsimp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r, rename_tac rq)\n apply (fold dc_def, rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n apply (rule corres_guard_imp)\n\n apply (rule corres_if_rhs)\n (* No threads in ready queues *)\n apply (rule corres_alternate2)\n apply (rule switch_to_idle_thread_dcorres)\n (* threads in ready queues *)\n apply (rule corres_alternate1)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule_tac P'=\"\\s. ready_queues s (cur_domain s) = rq \\ valid_etcbs s \\ valid_sched_except_blocked s \\ invs s \\ scheduler_action s = choose_new_thread\"\n in stronger_corres_guard_imp)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply clarsimp\n apply (frule_tac prio=\"(Max {prio. ready_queues s' (cur_domain s') prio \\ []})\" in schedule_choose_new_thread_helper,simp,simp,simp,simp,simp)\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def)\n apply (auto simp: select_def gets_def get_def bind_def return_def active_tcbs_in_domain_def\n invs_def valid_state_def valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def tcb_at_def)[1]\n apply (clarsimp simp: invs_def valid_state_def valid_sched_def max_non_empty_queue_def)\n apply (frule_tac p=\"Max {prio. ready_queues s' (cur_domain s') prio \\ []}\" in idle_thread_not_in_queue,simp,simp)\n apply (clarsimp)\n apply (wp hoare_drop_imp | clarsimp)+\n apply (frule max_set_not_empty, fastforce)\n apply (wp hoare_drop_imp | clarsimp)+\n apply simp\n apply (wp | clarsimp)+\n apply (rule change_current_domain_dcorres)\n unfolding dc_def\n apply (wp next_domain_valid_etcbs | simp)+\n apply (wp tcb_sched_action_transform | clarsimp simp: valid_sched_def)+\n done\n\nlemma schedule_choose_new_thread_dcorres_fragment:\n \"\\cur_ts cur. dcorres dc \\\n (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s \\ invs s \\ scheduler_action s = choose_new_thread)\n Schedule_D.schedule\n (do y \\ when (runnable cur_ts) (tcb_sched_action tcb_sched_enqueue cur);\n schedule_choose_new_thread\n od)\"\n apply (rule dcorres_symb_exec_r)\n apply (rule corres_guard_imp)\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp tcb_sched_action_transform| simp add: valid_sched_def st_tcb_at_def obj_at_def not_cur_thread_def| clarsimp simp: transform_def)+\n done\n\nlemma dcorres_If_both:\n \"\\ dcorres r P P' h m ;\n dcorres r P Q' h n \\\n \\ dcorres r P (\\s. if b then P' s else Q' s) h (if b then m else n)\"\n by (case_tac b; simp)\n\nlemma set_scheduler_action_transform:\n \"\\\\ps. transform ps = cs\\ set_scheduler_action a \\\\r s. transform s = cs\\\"\n by (clarsimp simp: set_scheduler_action_def etcb_at_def| wp )+\n\ncrunch valid_idle_etcb[wp]: set_scheduler_action valid_idle_etcb\n\n(* RHS copy-pasted from schedule_dcorres switch_thread case *)\nlemma schedule_switch_thread_dcorres:\n \"dcorres dc \\\n (\\s. cur = cur_thread s \\ st_tcb_at ((=) cur_ts) cur s \\ valid_etcbs s \\ valid_sched s\n \\ invs s \\ scheduler_action s = switch_thread target)\n Schedule_D.schedule\n (do y <- when (runnable cur_ts) (tcb_sched_action tcb_sched_enqueue cur);\n it <- gets idle_thread;\n target_prio <- ethread_get tcb_priority target;\n ct_prio <- ethread_get_when (cur \\ it) tcb_priority cur;\n fastfail <- schedule_switch_thread_fastfail cur it ct_prio target_prio;\n cur_dom <- gets cur_domain;\n highest <- gets (is_highest_prio cur_dom target_prio);\n if fastfail \\ \\ highest then do y <- tcb_sched_action tcb_sched_enqueue target;\n y <- set_scheduler_action choose_new_thread;\n schedule_choose_new_thread\n od\n else if runnable cur_ts \\ ct_prio = target_prio\n then do y <- tcb_sched_action tcb_sched_append target;\n y <- set_scheduler_action choose_new_thread;\n schedule_choose_new_thread\n od\n else do y <- guarded_switch_to target;\n set_scheduler_action resume_cur_thread\n od\n od)\" (is \"dcorres _ _ (\\s. ?PRE s) _ _\")\n supply ethread_get_wp[wp del]\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_If_both)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply simp\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp set_scheduler_action_transform tcb_sched_action_transform)+\n apply (rule dcorres_If_both)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply simp\n apply (rule schedule_choose_new_thread_dcorres)\n apply (wp set_scheduler_action_transform tcb_sched_action_transform)+\n apply (simp add: Schedule_D.schedule_def guarded_switch_to_def bind_assoc)\n apply (rule corres_alternate1)\n apply (rule_tac P=\\ and P'=\"?PRE\" in stronger_corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_rhs_noop_below_True[OF set_scheduler_action_dcorres])\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule corres_symb_exec_l_Ex)\n apply (rule switch_to_thread_same_corres)\n apply (wpsimp wp: gts_wp hoare_drop_imp)+\n apply (frule schedule_switch_thread_helper, simp,simp,simp)\n apply (fastforce simp: select_def gets_def get_def bind_def return_def\n active_tcbs_in_domain_def invs_def valid_state_def\n valid_objs_def change_current_domain_def\n Schedule_D.switch_to_thread_def modify_def put_def\n option_map_def restrict_map_def map_add_def get_tcb_def\n transform_def transform_current_thread_def cur_tcb_def\n tcb_at_def)\n apply (clarsimp)\n apply (frule invs_valid_idle)\n apply (fastforce simp: pred_tcb_at_def obj_at_def valid_idle_def valid_sched_def\n valid_sched_action_def weak_valid_sched_action_def)\n apply (wp tcb_sched_action_transform\n hoare_drop_imp[where f=\"ethread_get tcb_priority x\" for x]\n hoare_drop_imp[where f=\"ethread_get_when b tcb_priority t\" for b t]\n hoare_drop_imp[where f=\"gets cur_domain\"]\n | clarsimp simp add: schedule_switch_thread_fastfail_def\n split del: if_split\n | split if_split)+\n apply (fastforce elim: st_tcb_weakenE\n simp: valid_sched_def valid_blocked_def valid_blocked_except_def\n not_cur_thread_def valid_sched_action_def weak_valid_sched_action_def)\n apply (wp tcb_sched_action_transform, clarsimp)\n done\n\n\n(*\n * The schedulers correspond.\n *\n * Most of the difficulties in this proof arise from needing to dance\n * around differences in switching to the idle thread: The CapDL spec\n * switches to \"None\", while the abstract spec switches to an actual\n * thread.\n *)\n\nlemma schedule_dcorres:\n \"dcorres dc \\ (invs and valid_sched and valid_etcbs) Schedule_D.schedule Schedule_A.schedule\"\n apply (clarsimp simp: Schedule_A.schedule_def)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac cur)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac cur_ts)\n apply (rule dcorres_symb_exec_r)\n apply (rename_tac \"sa\", case_tac \"sa\")\n (* sa = resume_cur_thread *)\n apply clarsimp\n apply (rule schedule_resume_cur_thread_dcorres)\n (* sa = switch_thread *)\n apply clarsimp\n apply (rule schedule_switch_thread_dcorres)\n (* sa = choose_new_thread *)\n apply clarsimp\n apply (rule schedule_choose_new_thread_dcorres_fragment)\n apply (wp gts_st_tcb | simp )+\n done\n\n(*\n * The next few lemmas show that updating the register NextIP in the\n * tcb context of a thread does affect the state translation to capDL\n *)\nlemma get_tcb_message_info_nextPC [simp]:\n \"get_tcb_message_info (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_tcb_message_info tcb\"\n by (simp add: get_tcb_message_info_def\n arch_tcb_context_get_def\n msg_info_register_def\n ARM.msgInfoRegister_def)\n\nlemma map_msg_registers_nextPC [simp]:\n \"map ((tcb_context tcb)(NextIP := pc)) msg_registers =\n map (tcb_context tcb) msg_registers\"\n by (simp add: msg_registers_def ARM.msgRegisters_def\n upto_enum_red fromEnum_def toEnum_def enum_register)\n\nlemma get_ipc_buffer_words_nextPC [simp]:\n \"get_ipc_buffer_words m (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_ipc_buffer_words m tcb\"\n by (rule ext) (simp add: get_ipc_buffer_words_def)\n\nlemma get_tcb_mrs_nextPC [simp]:\n \"get_tcb_mrs m (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP := pc))) tcb) =\n get_tcb_mrs m tcb\"\n by (simp add: get_tcb_mrs_def Let_def arch_tcb_context_get_def)\n\nlemma transform_tcb_NextIP:\n \"transform_tcb m t (tcb_arch_update (tcb_context_update (\\ctx. ctx(NextIP:= pc))) tcb)\n = transform_tcb m t tcb\"\n by (auto simp add: transform_tcb_def transform_full_intent_def Let_def\n cap_register_def ARM.capRegister_def\n arch_tcb_context_get_def)\n\n(*\n * setNextPC in the tcb context is not observable on the capDL level.\n *)\nlemma as_user_setNextPC_corres:\n \"dcorres dc \\ \\ (return x) (as_user t (setNextPC pc))\"\n apply (clarsimp simp: corres_underlying_def gets_the_def\n as_user_def setNextPC_def get_tcb_def\n setRegister_def simpler_modify_def\n select_f_def return_def in_monad\n set_object_def get_object_def\n split: option.splits Structures_A.kernel_object.splits)\n apply (subst tcb_context_update_aux)\n apply (simp add: transform_def transform_current_thread_def)\n apply (clarsimp simp: transform_objects_update_kheap_same_caps\n transform_tcb_NextIP transform_objects_update_same\n arch_tcb_update_aux3)\n done\n\ncrunch transform_inv[wp]: set_thread_state_ext \"\\s. transform s = cs\"\n\nlemma dcorres_dummy_set_thread_state_runnable:\n \"dcorres dc \\\n (not_idle_thread ptr and st_tcb_at (\\t. (infer_tcb_pending_op ptr t) = (infer_tcb_pending_op ptr st)) ptr)\n (return ())\n (set_thread_state ptr st)\"\n apply (rule wp_to_dcorres)\n apply (clarsimp simp:set_thread_state_def not_idle_thread_def set_object_def get_object_def | wp)+\n apply (clarsimp simp:transform_def transform_current_thread_def st_tcb_at_def obj_at_def\n | rule ext)+\n apply (clarsimp simp:transform_objects_def not_idle_thread_def dest!:get_tcb_SomeD)\n apply (case_tac \"x = ptr\")\n apply (clarsimp simp:transform_tcb_def)\n apply (clarsimp simp:restrict_map_def Map.map_add_def)\n done\n\n(*\n * Activating threads is not observable on the capDL level.\n *)\nlemma activate_thread_corres:\n \"dcorres dc \\ (ct_in_state activatable and invs and valid_etcbs)\n (do t \\ gets cdl_current_thread;\n case t of Some thread \\ do\n restart \\ has_restart_cap thread;\n when restart $ KHeap_D.set_cap (thread,tcb_pending_op_slot) RunningCap\n od | None \\ return ()\n od)\n activate_thread\"\n apply (simp add: activate_thread_def has_restart_cap_def gets_def bind_assoc)\n apply (rule dcorres_absorb_get_r)\n apply (rule dcorres_absorb_get_l)\n apply (simp add:get_thread_state_def bind_assoc thread_get_def)\n apply (rule dcorres_absorb_gets_the)\n apply (case_tac \"cdl_current_thread (transform s'a) = None\")\n apply (clarsimp simp: ct_in_state_def pred_tcb_at_def obj_at_def\n cdl_current_thread transform_current_thread_def valid_idle_def\n arch_activate_idle_thread_def\n split : if_splits dest!:get_tcb_SomeD invs_valid_idle)\n apply clarsimp\n apply (subgoal_tac \"not_idle_thread (cur_thread s'b) s'b\")\n prefer 2\n apply (clarsimp simp:transform_def transform_current_thread_def)\n apply (clarsimp simp:not_idle_thread_def)+\n apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp)\n apply (frule opt_object_tcb)\n apply simp\n apply simp\n apply (clarsimp simp:transform_tcb_def gets_def gets_the_def has_restart_cap_def\n get_thread_def bind_assoc cdl_current_thread transform_current_thread_def)\n apply (rule dcorres_absorb_get_l)\n apply (simp add:assert_opt_def when_def)\n apply (case_tac \"tcb_state obj'\")\n apply (clarsimp simp:infer_tcb_pending_op_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n when_def pred_tcb_at_def ct_in_state_def obj_at_def\n dest!:get_tcb_SomeD)+\n apply (rule corres_guard_imp)\n apply (rule dcorres_symb_exec_r)\n apply (rule dcorres_symb_exec_r)\n apply (rule set_thread_state_corres[unfolded tcb_pending_op_slot_def])\n apply simp\n apply (wpsimp wp: dcorres_to_wp[OF as_user_setNextPC_corres,simplified])+\n apply (simp add:invs_mdb pred_tcb_at_def obj_at_def invs_valid_idle\n generates_pending_def not_idle_thread_def)\n apply (clarsimp simp:infer_tcb_pending_op_def arch_activate_idle_thread_def\n when_def pred_tcb_at_def ct_in_state_def obj_at_def tcb_pending_op_slot_def tcb_boundntfn_slot_def\n dest!:get_tcb_SomeD)+\n done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/drefine/Schedule_DR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.2720245510940225, "lm_q1q2_score": 0.1518786459994338}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__44_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_german Protocol Case Study*}*) \n\ntheory n_german_lemma_inv__44_on_rules imports n_german_lemma_on_inv__44\nbegin\nsection{*All lemmas on causal relation between inv__44*}\nlemma lemma_inv__44_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__44 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__44) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__44) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_german/n_german_lemma_inv__44_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.28776782797747225, "lm_q1q2_score": 0.15174473058957}} {"text": "theory Germany imports\n Decentralised_Model\nbegin\n\nlocale germany =\n fixes gen_card :: \"'user \\ ('card \\ 'chip) spmf\"\n and auth :: \"('card \\ 'chip) \\ ('user, 'query_out) query \\ 'query_out spmf\"\n and valid_user :: \"'user \\ bool\"\n and valid_query :: \"('user, 'query_out) query \\ bool\"\n assumes lossless_gen_card: \"lossless_spmf (gen_card user)\"\nbegin\n\ndefinition register :: \"'user \\ (('card \\ 'chip) \\ (unit, unit) govt_store_data) spmf\"\n where \n \"register user = do {\n (card, chip) \\ gen_card user;\n return_spmf ((card, chip), ({}, {}))}\"\n\nsublocale germany_id: decentralised_id register auth valid_user valid_query \n unfolding decentralised_id_def by(simp add: register_def lossless_gen_card)\n\nlemma \"germany_id.perfect_sens_attrs_hiding \\\"\nproof(rule germany_id.no_sens_attrs_imp_perfect_sens_attrs_hiding)\n show \" \\user token store_non_sens_attr store_sens_attr. (token, store_non_sens_attr, store_sens_attr) \\ set_spmf (register user) \\ store_sens_attr = {}\"\n by(simp add: register_def)\nqed\n\n", "meta": {"author": "Davetbutler", "repo": "Privacy-ID", "sha": "a9d67b9ef02dea9ae51e5c6de8630666c4d0a148", "save_path": "github-repos/isabelle/Davetbutler-Privacy-ID", "path": "github-repos/isabelle/Davetbutler-Privacy-ID/Privacy-ID-a9d67b9ef02dea9ae51e5c6de8630666c4d0a148/ID_system_formalisation/Germany.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.2877678157610531, "lm_q1q2_score": 0.15174472414765036}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchAInvsPre\nimports AInvsPre\nbegin\n\ncontext Arch begin\n\nglobal_naming X64\n\ndefinition\n \"kernel_mappings \\ {x. x \\ pptr_base}\"\n\nlemma kernel_mappings_slots_eq:\n \"canonical_address p \\ p \\ kernel_mappings \\ ucast (p >> pml4_shift_bits) \\ kernel_mapping_slots\"\n apply (simp add: kernel_mappings_def kernel_mapping_slots_def word_le_nat_alt\n get_pml4_index_def ucast_mask_drop)\n apply (fold word_le_nat_alt)\n apply (rule iffI)\n apply (simp add: bit_simps pptr_base_def pptrBase_def)\n apply (word_bitwise, simp)\n apply (simp add: pptr_base_def pptrBase_def bit_simps canonical_address_range mask_def)\n apply word_bitwise\n apply simp\n done\n\nlemma valid_global_pml4_mappingsE:\n \"\\valid_global_vspace_mappings s;\n \\pd. \\kheap s (x64_global_pml4 (arch_state s)) =\n Some (ArchObj (PageMapL4 pd));\n \\x. valid_pml4_kernel_mappings (x64_kernel_vspace (arch_state s)) s\n (ArchObj (PageMapL4 pd))\\ \\ R\\ \\ R\"\n apply (clarsimp simp add: valid_global_vspace_mappings_def obj_at_def)\n apply (case_tac ko, simp_all add: valid_pml4_kernel_mappings_def\n split: arch_kernel_obj.splits)\n done\n\nlemma ucast_ucast_mask9: \"(ucast (x && mask 9) :: 9 word) = ucast x\"\n by (rule ucast_mask_drop, simp)\n\n(* NOTE: we could probably add \"is_aligned b (pageBitsForSize sz)\"\n if we assumed \"valid_global_objs s\", additionally. *)\n(* FIXME x64: please god some automation *)\nlemma some_get_page_info_kmapsD:\n \"\\get_page_info (\\obj. get_arch_obj (kheap s obj)) pd_ref p = Some (b, a, attr, r);\n p \\ kernel_mappings; canonical_address p; valid_global_vspace_mappings s; equal_kernel_mappings s\\\n \\ (\\sz. pageBitsForSize sz = a) \\ r = {}\"\n apply (clarsimp simp: get_pdpt_info_def get_pml4_entry_def get_arch_obj_def\n kernel_mappings_slots_eq get_page_info_def get_pdpt_entry_def get_pd_info_def\n get_pd_entry_def get_pt_info_def get_pt_entry_def\n split: option.splits Structures_A.kernel_object.splits\n arch_kernel_obj.splits)\n apply (erule valid_global_pml4_mappingsE)\n apply (clarsimp simp: equal_kernel_mappings_def obj_at_def)\n apply (drule_tac x=pd_ref in spec,\n drule_tac x=\"x64_global_pml4 (arch_state s)\" in spec, simp)\n apply (drule bspec, assumption)\n apply (clarsimp simp: valid_pml4_kernel_mappings_def pml4e_mapping_bits_def)\n apply (drule_tac x=\"ucast (p >> pml4_shift_bits)\" in spec)\n apply (clarsimp simp: get_page_info_def get_pml4_entry_def get_arch_obj_def\n get_pdpt_info_def get_pdpt_entry_def get_pd_info_def get_pd_entry_def\n get_pt_info_def get_pt_entry_def bit_simps\n kernel_mappings_slots_eq\n split: option.splits Structures_A.kernel_object.splits\n arch_kernel_obj.splits\n pml4e.splits pdpte.splits pde.splits pte.splits)\n apply (rule conjI, rule_tac x=X64SmallPage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n apply (simp add: valid_pd_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 21))\" in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def)\n apply (simp add: valid_pt_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 12))\" in spec)\n apply (clarsimp simp: valid_pte_kernel_mappings_def)\n apply (rule conjI, rule_tac x=X64LargePage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n apply (simp add: valid_pd_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 21))\" in spec)\n apply (clarsimp simp: valid_pde_kernel_mappings_def)\n apply (simp add: valid_pt_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (rule conjI, rule_tac x=X64HugePage in exI, simp add: bit_simps)\n apply (simp add: valid_pml4e_kernel_mappings_def obj_at_def ucast_ucast_mask9\n valid_pdpt_kernel_mappings_def bit_simps pml4e_mapping_bits_def\n split: pml4e.splits)\n apply (drule_tac x=\"ucast ((p >> 30))\" in spec)\n apply (clarsimp simp: valid_pdpte_kernel_mappings_def)\n done\n\nlemma get_page_info_gpd_kmaps:\n \"\\valid_global_objs s; valid_arch_state s; canonical_address p;\n get_page_info (\\obj. get_arch_obj (kheap s obj))\n (x64_global_pml4 (arch_state s)) p = Some (b, a, attr, r)\\\n \\ p \\ kernel_mappings\"\n apply (clarsimp simp: valid_global_objs_def valid_arch_state_def\n obj_at_def valid_ao_at_def\n empty_table_def kernel_mappings_slots_eq)\n apply (drule_tac x=\"ucast (p >> pml4_shift_bits)\" in spec; clarsimp)\n apply (rule ccontr)\n apply (clarsimp simp: get_page_info_def get_pml4_entry_def get_arch_obj_def\n bit_simps ucast_ucast_mask9\n split: option.splits pml4e.splits arch_kernel_obj.splits)\n done\n\nlemma get_vspace_of_thread_reachable:\n \"get_vspace_of_thread (kheap s) (arch_state s) t \\ x64_global_pml4 (arch_state s)\n \\ (\\\\ get_vspace_of_thread (kheap s) (arch_state s) t) s\"\n by (auto simp: get_vspace_of_thread_vs_lookup\n split: Structures_A.kernel_object.splits if_split_asm option.splits\n cap.splits arch_cap.splits)\n\nlemma is_aligned_ptrFromPAddrD:\n\"\\is_aligned (ptrFromPAddr b) a; a \\ 30\\ \\ is_aligned b a\"\n apply (clarsimp simp:ptrFromPAddr_def pptrBase_def)\n apply (erule is_aligned_addD2)\n apply (rule is_aligned_weaken[where x = 30])\n apply (simp add:is_aligned_def)\n apply simp\n done\n\nlemma some_get_page_info_umapsD:\n \"\\get_page_info (\\obj. get_arch_obj (kheap s obj)) pml4_ref p = Some (b, a, attr, r);\n (\\\\ pml4_ref) s; p \\ kernel_mappings; valid_vspace_objs s; pspace_aligned s;\n canonical_address p;\n valid_asid_table (x64_asid_table (arch_state s)) s; valid_objs s\\\n \\ \\sz. pageBitsForSize sz = a \\ is_aligned b a \\ data_at sz (ptrFromPAddr b) s\"\n apply (clarsimp simp: get_page_info_def get_pdpt_info_def get_pd_info_def get_pt_info_def\n get_pml4_entry_def get_pdpt_entry_def get_pd_entry_def get_pt_entry_def\n get_arch_obj_def valid_asid_table_def bit_simps\n kernel_mappings_slots_eq\n split: option.splits kernel_object.splits arch_kernel_obj.splits\n pml4e.splits pdpte.splits pde.splits pte.splits)\n apply (all \\drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pml4I],\n simp add: ucast_ucast_mask9, fastforce\\)\n prefer 3 subgoal\n by (rule exI[where x=X64HugePage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n apply (all \\drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pdptI], fastforce\\)\n prefer 2 subgoal\n by (rule exI[where x=X64LargePage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n apply (drule (2) vs_lookup_step_alt[OF _ _ vs_refs_pdI], fastforce)\n by (rule exI[where x=X64SmallPage];\n frule (3) valid_vspace_objs_entryD;\n fastforce simp: bit_simps dest: data_at_aligned is_aligned_ptrFromPAddrD)\n\nlemma user_mem_dom_cong:\n \"kheap s = kheap s' \\ dom (user_mem s) = dom (user_mem s')\"\n by (simp add: user_mem_def in_user_frame_def dom_def obj_at_def)\n\nlemma device_mem_dom_cong:\n \"kheap s = kheap s' \\ dom (device_mem s) = dom (device_mem s')\"\n by (simp add: device_mem_def in_device_frame_def dom_def obj_at_def)\n\nlemma device_frame_in_device_region:\n \"\\in_device_frame p s; pspace_respects_device_region s\\\n \\ device_state (machine_state s) p \\ None\"\n by (auto simp add: pspace_respects_device_region_def dom_def device_mem_def)\n\nglobal_naming Arch\nnamed_theorems AInvsPre_asms\n\nlemma ptable_rights_imp_frame[AInvsPre_asms]:\n assumes \"valid_state s\"\n shows \"ptable_rights t s x \\ {} \\\n ptable_lift t s x = Some (addrFromPPtr y) \\\n in_user_frame y s \\ in_device_frame y s\"\n apply (rule ccontr, frule ptable_lift_Some_canonical_addressD)\n using assms\n apply (clarsimp simp: ptable_lift_def ptable_rights_def\n in_user_frame_def in_device_frame_def\n split: option.splits)\n apply (case_tac \"x \\ kernel_mappings\")\n apply (frule (2) some_get_page_info_kmapsD; fastforce simp: valid_state_def)\n apply (frule some_get_page_info_umapsD)\n apply (rule get_vspace_of_thread_reachable)\n apply clarsimp\n apply (frule get_page_info_gpd_kmaps[rotated 2])\n apply (simp_all add: valid_state_def valid_pspace_def\n valid_arch_state_def)\n apply (clarsimp simp: data_at_def)+\n apply (drule_tac x=sz in spec)+\n apply (rename_tac p_addr attr rghts sz)\n apply (frule is_aligned_add_helper[OF _ and_mask_less', THEN conjunct2, of _ _ x])\n apply (simp only: pbfs_less_wb'[simplified word_bits_def])\n apply (clarsimp simp: data_at_def ptrFromPAddr_def addrFromPPtr_def field_simps)\n apply (subgoal_tac \"p_addr + (pptrBase + (x && mask (pageBitsForSize sz)))\n && ~~ mask (pageBitsForSize sz) = p_addr + pptrBase\")\n apply simp\n apply (subst add.assoc[symmetric])\n apply (subst is_aligned_add_helper)\n apply (erule aligned_add_aligned)\n apply (case_tac sz; simp add: is_aligned_def pptrBase_def bit_simps)\n apply simp\n apply (rule and_mask_less')\n apply (case_tac sz; simp add: bit_simps)\n apply simp\n done\n\nend\n\ninterpretation AInvsPre?: AInvsPre\n proof goal_cases\n interpret Arch .\n case 1 show ?case by (intro_locales; (unfold_locales; fact AInvsPre_asms)?)\n qed\n\nrequalify_facts\n X64.user_mem_dom_cong\n X64.device_mem_dom_cong\n X64.device_frame_in_device_region\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/X64/ArchAInvsPre.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.15174472092669056}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__84_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__84_on_rules imports n_g2kAbsAfter_lemma_on_inv__84\nbegin\nsection{*All lemmas on causal relation between inv__84*}\nlemma lemma_inv__84_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__84 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__84) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__84) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__84_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.2942149783515162, "lm_q1q2_score": 0.15170310234205767}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__39_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__39_on_rules imports n_g2kAbsAfter_lemma_on_inv__39\nbegin\nsection{*All lemmas on causal relation between inv__39*}\nlemma lemma_inv__39_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__39 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__39) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__39) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__39_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.30074557267388236, "lm_q1q2_score": 0.15154754982967134}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__97_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__97_on_rules imports n_g2kAbsAfter_lemma_on_inv__97\nbegin\nsection{*All lemmas on causal relation between inv__97*}\nlemma lemma_inv__97_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__97 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__97) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__97) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__97_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.29098087236345377, "lm_q1q2_score": 0.15117076747303473}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__69_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__69_on_rules imports n_g2kAbsAfter_lemma_on_inv__69\nbegin\nsection{*All lemmas on causal relation between inv__69*}\nlemma lemma_inv__69_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__69 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__69) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__69) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__69_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.29098086621490676, "lm_q1q2_score": 0.15117076427873347}} {"text": "(*\n * Copyright 2017, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n\n * @TAG(DATA61_BSD)\n *)\n\ntheory EChronos_arm_sched_prop_contexts_stack_inv\n\nimports\n EChronos_arm_sched_prop_base\n EChronos_arm_sched_prop_tactic\nbegin\n\ndefinition\n schedule\nwhere\n \"schedule \\\n \\True\\\n \\nextT := None;;\n \\\\nextT = None\\\n WHILE \\nextT = None\n INV \\\\nextT=None \\ ((\\n. \\nextT=Some n \\ n\\U))\\\n DO\n \\True\\\n \\E_tmp := \\E;;\n \\True\\\n \\R := handle_events \\E_tmp \\R;;\n \\True\\\n \\E := \\E - \\E_tmp;;\n \\True\\\n \\nextT := sched_policy(\\R)\n OD\"\n\ndefinition\n context_switch\nwhere\n \"context_switch preempt_enabled \\\n \\\\n. \\nextT = Some n \\ n \\ U \\ last \\ATStack = \\curUser\\\n \\contexts := \\contexts (\\curUser \\ (preempt_enabled, \\ATStack));;\n \\\\n. \\nextT = Some n \\ n \\ U\\\n \\curUser := the \\nextT;;\n \\\\curUser \\ U\\\n \\ATStack := snd (the (\\contexts (\\curUser)));;\n \\last \\ATStack = \\curUser\\\n IF fst (the (\\contexts (\\curUser)))\n THEN \\last \\ATStack = \\curUser\\ \\svc\\<^sub>aEnable\\\n ELSE \\last \\ATStack = \\curUser\\ \\svc\\<^sub>aDisable\\ FI\"\n\ndefinition\n eChronos_arm_sched_prop_contexts_stack_inv_prog\nwhere\n \"eChronos_arm_sched_prop_contexts_stack_inv_prog \\\n (hardware_init,,\n eChronos_init,,\n (COBEGIN\n (* svc\\<^sub>a_take *)\n \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ (last (\\AT # \\ATStack) = \\curUser)\\\n WHILE True INV \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ (last (\\AT # \\ATStack) = \\curUser)\\\n DO\n \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ (last (\\AT # \\ATStack) = \\curUser)\\ svc\\<^sub>aTake\n OD\n \\False\\\n\n \\\n\n (* svc\\<^sub>a *)\n \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n WHILE True INV \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n DO\n add_await_routine svc\\<^sub>a (\n \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n \\ghostP := True;;\n add_inv_assn_com \\\\ghostP\\ (\n add_inv_assn_com \\last \\ATStack = \\curUser\\ (\n schedule);;\n context_switch True;;\n \\last \\ATStack = \\curUser\\\n \\\\ghostP := False,, IRet\\))\n OD\n \\False\\\n\n \\\n\n (* svc\\<^sub>s *)\n \\svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n WHILE True INV \\svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n DO\n add_await_routine svc\\<^sub>s (\n \\svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ last \\ATStack = \\curUser\\\n \\ghostS := True;;\n add_inv_assn_com \\\\ghostS\\ (\n add_inv_assn_com \\last \\ATStack = \\curUser\\ (\n schedule);;\n context_switch False;;\n \\last \\ATStack = \\curUser\\\n \\\\ghostS := False,, IRet\\))\n OD\n \\False\\\n\n \\\n\n SCHEME [user0 \\ i < user0 + nbRoutines]\n add_inv_assn_com\n \\svc\\<^sub>a \\ set (\\AT # \\ATStack) \\ svc\\<^sub>s \\ set (\\AT # \\ATStack) \\ (last (\\AT # \\ATStack) = \\curUser)\\ (\n \\\\ghostU i = User\\ IF (i\\I) THEN\n\n (* Interrupts *)\n \\i\\I\\\n WHILE True INV \\i\\I\\\n DO\n \\i\\I\\\n ITake i;;\n\n (add_await_routine i (\n add_inv_assn_com\n \\i\\I\\ (\n \\True\\\n \\E :\\ {E'. \\E \\ E'};;\n\n \\True\\\n svc\\<^sub>aRequest;;\n\n \\True\\\n \\IRet\\)))\n OD\n\n ELSE\n (* Users *)\n add_inv_assn_com\n \\i \\ U\\ (\n \\\\ghostU i = User\\\n WHILE True INV \\\\ghostU i = User\\\n DO\n (add_await_routine i (\n \\\\ghostU i = User\\\n \\userSyscall :\\ {SignalSend, Block};;\n\n \\\\ghostU i = User\\\n IF \\userSyscall = SignalSend\n THEN\n \\\\ghostU i = User\\\n \\\\ghostU := \\ghostU (i := Syscall),, svc\\<^sub>aDisable\\;;\n\n add_inv_assn_com\n \\\\ghostU i = Syscall\\ (\n \\True\\\n \\R :\\ {R'. \\i. \\R i = Some True \\ R' i = Some True};;\n\n \\True\\\n svc\\<^sub>aRequest;;\n\n \\True\\\n \\svc\\<^sub>aEnable,, \\ghostU := \\ghostU (i := User)\\);;\n \\\\ghostU i = User\\\n WHILE \\svc\\<^sub>aReq INV \\\\ghostU i = User\\\n DO\n \\\\ghostU i = User\\ SKIP\n OD\n ELSE \\\\ghostU i = User\\ IF \\userSyscall = Block\n THEN\n \\\\ghostU i = User\\\n \\\\ghostU := \\ghostU (i := Syscall),, svc\\<^sub>aDisable\\;;\n\n \\\\ghostU i = Syscall\\\n \\R := \\R (i := Some False);;\n\n \\\\ghostU i = Syscall\\\n \\\\ghostU := \\ghostU (i := Yield),, SVC\\<^sub>s_now\\;;\n\n \\\\ghostU i = Yield\\\n \\ghostU := \\ghostU (i := Syscall);;\n\n \\\\ghostU i = Syscall\\\n \\svc\\<^sub>aEnable,, \\ghostU := \\ghostU (i := User)\\;;\n \\\\ghostU i = User\\\n WHILE \\svc\\<^sub>aReq INV \\\\ghostU i = User\\\n DO\n \\\\ghostU i = User\\ SKIP\n OD\n FI FI))\n OD)\n FI)\n \\False\\\n COEND))\"\n\n(*--------------------------------------------------------------------------*)\nsubsection \\The proof\\\n\nlemmas eChronos_arm_sched_prop_contexts_stack_inv_prog_defs =\n eChronos_arm_sched_prop_base_defs\n eChronos_arm_sched_prop_contexts_stack_inv_prog_def\n schedule_def context_switch_def\n\nlemma eChronos_arm_sched_prop_contexts_stack_inv_proof:\n \"0 0 < nbInts \\\n \\\\priority_inv \\ \\last_stack_inv \\\n (\\i \\ U. \\j \\ U. snd (the (\\contexts i)) = [j]) \\\n \\ghostP_S_stack_inv\\\n \\-\\<^sub>i \\\\contexts_stack_inv\\ \\True\\\n eChronos_arm_sched_prop_contexts_stack_inv_prog\n \\False\\\"\n unfolding eChronos_arm_sched_prop_contexts_stack_inv_prog_defs\n unfolding inv_defs oghoare_inv_def\n apply (simp add: add_inv_aux_def o_def\n cong: Collect_cong\n del: last.simps butlast.simps (*upt_Suc*))\n apply oghoare\n(*768*)\n\napply (find_goal \\succeeds \\rule subsetI[where A=UNIV]\\\\)\n subgoal\n(* invariant is true initially *)\napply clarify\napply (erule notE)\napply clarsimp\napply (rule conjI)\n apply (case_tac \"nbRoutines - Suc (Suc 0)=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply clarsimp\napply (case_tac \"i=0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc 0\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (case_tac \"i=Suc (Suc 0)\")\n apply (clarsimp simp: handle_events_empty user0_is_highest)\napply (clarsimp simp: handle_events_empty user0_is_highest)\ndone\n\n apply (tactic \\fn thm => if Thm.nprems_of thm > 0 then\n let val ctxt = @{context}\n val clarsimp_ctxt = (ctxt\n addsimps @{thms Int_Diff card_insert_if\n insert_Diff_if Un_Diff interrupt_policy_I\n handle_events_empty helper16\n helper18 interrupt_policy_self\n user0_is_highest\n interrupt_policy_mono sorted_by_policy_svc\\<^sub>a\n helper21 helper22 helper25}\n delsimps @{thms disj_not1}\n addSIs @{thms last_tl'})\n\n val clarsimp_ctxt2 = (ctxt\n addsimps @{thms neq_Nil_conv\n interrupt_policy_svc\\<^sub>a'\n interrupt_policy_svc\\<^sub>s'\n interrupt_policy_U helper25\n handle_events_empty}\n delsimps @{thms disj_not1}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n val clarsimp_ctxt3 = (put_simpset HOL_basic_ss ctxt)\n\n val fastforce_ctxt = (ctxt\n addsimps @{thms sorted_by_policy_svc\\<^sub>s_svc\\<^sub>a sched_policy_Some_U\n interrupt_policy_U last_tl\n helper26 sorted_by_policy_svc\\<^sub>a''}\n addDs @{thms })\n |> Splitter.add_split @{thm if_split_asm}\n |> Splitter.add_split @{thm if_split}\n\n in\n timeit (fn _ => Cache_Tactics.PARALLEL_GOALS_CACHE 11 ((TRY' o SOLVED' o DETERM') (\n ((set_to_logic ctxt\n THEN_ALL_NEW svc_commute ctxt\n THEN_ALL_NEW (((fn tac => fn i => DETERM (tac i))\n (TRY_EVERY_FORWARD' ctxt\n @{thms helper29 helper30\n sorted_by_policy_U\n sorted_by_policy_svc\\<^sub>a_single\n sorted_by_policy_svc\\<^sub>s_single\n sorted_by_policy_U_single\n sched_picks_user\n set_tl\n sorted_by_policy_empty'})\n THEN'\n ((TRY' o REPEAT_ALL_NEW)\n (FORWARD (dresolve_tac ctxt\n @{thms helper21' helper27' helper28'})\n ctxt)))\n THEN' (TRY' (clarsimp_tac clarsimp_ctxt3))\n THEN' (TRY' (\n SOLVED' (fn i => fn st => timed_tac 5 ctxt st\n (Blast.depth_tac ctxt 3 i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt st (clarsimp_tac clarsimp_ctxt i st))\n ORELSE' SOLVED' (fn i => fn st => timed_tac 30 clarsimp_ctxt2 st (clarsimp_tac clarsimp_ctxt2 i st))\n ORELSE' SOLVED' (clarsimp_tac (ctxt delsimps @{thms disj_not1}\n |> Splitter.add_split @{thm if_split_asm}) THEN_ALL_NEW\n (fn i => fn st => timed_tac 20 fastforce_ctxt st (fast_force_tac fastforce_ctxt i st)))\n )))\n ))) 1)\n thm |> Seq.pull |> the |> fst |> Seq.single) end\n else Seq.empty\\)\n (*94.674s elapsed time, 283.004s cpu time, 26.720s GC time*)\n done\n\nend\n", "meta": {"author": "echronos", "repo": "echronos-proofs", "sha": "5983821e591c6878f1fe96aa831e11c5c97ce385", "save_path": "github-repos/isabelle/echronos-echronos-proofs", "path": "github-repos/isabelle/echronos-echronos-proofs/echronos-proofs-5983821e591c6878f1fe96aa831e11c5c97ce385/verif/EChronos_arm_sched_prop_contexts_stack_inv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.2782567996876011, "lm_q1q2_score": 0.15105539984348523}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__49_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__49_on_rules imports n_g2kAbsAfter_lemma_on_inv__49\nbegin\nsection{*All lemmas on causal relation between inv__49*}\nlemma lemma_inv__49_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__49 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__49) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__49) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__49_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.2877678157610531, "lm_q1q2_score": 0.15062353053829422}} {"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n The refinement relation between abstract and concrete states\n*)\n\ntheory StateRelation\nimports InvariantUpdates_H\nbegin\n\ncontext begin interpretation Arch .\n\ndefinition cte_map :: \"cslot_ptr \\ machine_word\" where\n \"cte_map \\ \\(oref, cref). oref + (of_bl cref << cte_level_bits)\"\n\nlemmas cte_map_def' = cte_map_def[simplified cte_level_bits_def shiftl_t2n mult_ac, simplified]\n\ndefinition lookup_failure_map :: \"ExceptionTypes_A.lookup_failure \\ Fault_H.lookup_failure\" where\n \"lookup_failure_map \\ \\lf. case lf of\n ExceptionTypes_A.InvalidRoot \\ Fault_H.InvalidRoot\n | ExceptionTypes_A.MissingCapability n \\ Fault_H.MissingCapability n\n | ExceptionTypes_A.DepthMismatch n m \\ Fault_H.DepthMismatch n m\n | ExceptionTypes_A.GuardMismatch n g \\ Fault_H.GuardMismatch n (of_bl g) (length g)\"\n\nprimrec arch_fault_map :: \"Machine_A.RISCV64_A.arch_fault \\ arch_fault\" where\n \"arch_fault_map (Machine_A.RISCV64_A.VMFault ptr msg) = VMFault ptr msg\"\n\nprimrec fault_map :: \"ExceptionTypes_A.fault \\ Fault_H.fault\" where\n \"fault_map (ExceptionTypes_A.CapFault ref bool failure) =\n Fault_H.CapFault ref bool (lookup_failure_map failure)\"\n| \"fault_map (ExceptionTypes_A.ArchFault arch_fault) =\n Fault_H.ArchFault (arch_fault_map arch_fault)\"\n| \"fault_map (ExceptionTypes_A.UnknownSyscallException n) =\n Fault_H.UnknownSyscallException n\"\n| \"fault_map (ExceptionTypes_A.UserException x y) =\n Fault_H.UserException x y\"\n\ntype_synonym obj_relation_cut = \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\ntype_synonym obj_relation_cuts = \"(machine_word \\ obj_relation_cut) set\"\n\ndefinition vmrights_map :: \"rights set \\ vmrights\" where\n \"vmrights_map S \\ if AllowRead \\ S\n then (if AllowWrite \\ S then VMReadWrite else VMReadOnly)\n else VMKernelOnly\"\n\ndefinition zbits_map :: \"nat option \\ zombie_type\" where\n \"zbits_map N \\ case N of Some n \\ ZombieCNode n | None \\ ZombieTCB\"\n\ndefinition mdata_map ::\n \"(Machine_A.RISCV64_A.asid \\ vspace_ref) option \\ (asid \\ vspace_ref) option\" where\n \"mdata_map = map_option (\\(asid, ref). (ucast asid, ref))\"\n\nprimrec acap_relation :: \"arch_cap \\ arch_capability \\ bool\" where\n \"acap_relation (arch_cap.ASIDPoolCap p asid) c =\n (c = ASIDPoolCap p (ucast asid))\"\n| \"acap_relation (arch_cap.ASIDControlCap) c =\n (c = ASIDControlCap)\"\n| \"acap_relation (arch_cap.FrameCap p rghts sz dev data) c =\n (c = FrameCap p (vmrights_map rghts) sz dev (mdata_map data))\"\n| \"acap_relation (arch_cap.PageTableCap p data) c =\n (c = PageTableCap p (mdata_map data))\"\n\nprimrec cap_relation :: \"cap \\ capability \\ bool\" where\n \"cap_relation Structures_A.NullCap c =\n (c = Structures_H.NullCap)\"\n| \"cap_relation Structures_A.DomainCap c =\n (c = Structures_H.DomainCap)\"\n| \"cap_relation (Structures_A.UntypedCap dev ref n f) c =\n (c = Structures_H.UntypedCap dev ref n f)\"\n| \"cap_relation (Structures_A.EndpointCap ref b r) c =\n (c = Structures_H.EndpointCap ref b (AllowSend \\ r) (AllowRecv \\ r) (AllowGrant \\ r)\n (AllowGrantReply \\ r))\"\n| \"cap_relation (Structures_A.NotificationCap ref b r) c =\n (c = Structures_H.NotificationCap ref b (AllowSend \\ r) (AllowRecv \\ r))\"\n| \"cap_relation (Structures_A.CNodeCap ref n L) c =\n (c = Structures_H.CNodeCap ref n (of_bl L) (length L))\"\n| \"cap_relation (Structures_A.ThreadCap ref) c =\n (c = Structures_H.ThreadCap ref)\"\n| \"cap_relation (Structures_A.ReplyCap ref master r) c =\n (c = Structures_H.ReplyCap ref master (AllowGrant \\ r))\"\n| \"cap_relation (Structures_A.IRQControlCap) c =\n (c = Structures_H.IRQControlCap)\"\n| \"cap_relation (Structures_A.IRQHandlerCap irq) c =\n (c = Structures_H.IRQHandlerCap irq)\"\n| \"cap_relation (Structures_A.ArchObjectCap a) c =\n (\\a'. acap_relation a a' \\ c = Structures_H.ArchObjectCap a')\"\n| \"cap_relation (Structures_A.Zombie p b n) c =\n (c = Structures_H.Zombie p (zbits_map b) n)\"\n\n\ndefinition cte_relation :: \"cap_ref \\ obj_relation_cut\" where\n \"cte_relation y \\ \\ko ko'. \\sz cs cte cap. ko = CNode sz cs \\ ko' = KOCTE cte\n \\ cs y = Some cap \\ cap_relation cap (cteCap cte)\"\n\ndefinition asid_pool_relation :: \"(asid_low_index \\ obj_ref) \\ asidpool \\ bool\" where\n \"asid_pool_relation \\ \\p p'. p = inv ASIDPool p' o ucast\"\n\ndefinition ntfn_relation :: \"Structures_A.notification \\ Structures_H.notification \\ bool\" where\n \"ntfn_relation \\ \\ntfn ntfn'.\n (case ntfn_obj ntfn of\n Structures_A.IdleNtfn \\ ntfnObj ntfn' = Structures_H.IdleNtfn\n | Structures_A.WaitingNtfn q \\ ntfnObj ntfn' = Structures_H.WaitingNtfn q\n | Structures_A.ActiveNtfn b \\ ntfnObj ntfn' = Structures_H.ActiveNtfn b)\n \\ ntfn_bound_tcb ntfn = ntfnBoundTCB ntfn'\"\n\ndefinition ep_relation :: \"Structures_A.endpoint \\ Structures_H.endpoint \\ bool\" where\n \"ep_relation \\ \\ep ep'. case ep of\n Structures_A.IdleEP \\ ep' = Structures_H.IdleEP\n | Structures_A.RecvEP q \\ ep' = Structures_H.RecvEP q\n | Structures_A.SendEP q \\ ep' = Structures_H.SendEP q\"\n\ndefinition fault_rel_optionation :: \"ExceptionTypes_A.fault option \\ Fault_H.fault option \\ bool\"\n where\n \"fault_rel_optionation \\ \\f f'. f' = map_option fault_map f\"\n\nprimrec thread_state_relation :: \"Structures_A.thread_state \\ Structures_H.thread_state \\ bool\"\n where\n \"thread_state_relation (Structures_A.Running) ts'\n = (ts' = Structures_H.Running)\"\n| \"thread_state_relation (Structures_A.Restart) ts'\n = (ts' = Structures_H.Restart)\"\n| \"thread_state_relation (Structures_A.Inactive) ts'\n = (ts' = Structures_H.Inactive)\"\n| \"thread_state_relation (Structures_A.IdleThreadState) ts'\n = (ts' = Structures_H.IdleThreadState)\"\n| \"thread_state_relation (Structures_A.BlockedOnReply) ts'\n = (ts' = Structures_H.BlockedOnReply)\"\n| \"thread_state_relation (Structures_A.BlockedOnReceive oref sp) ts'\n = (ts' = Structures_H.BlockedOnReceive oref (receiver_can_grant sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnSend oref sp) ts'\n = (ts' = Structures_H.BlockedOnSend oref (sender_badge sp)\n (sender_can_grant sp) (sender_can_grant_reply sp) (sender_is_call sp))\"\n| \"thread_state_relation (Structures_A.BlockedOnNotification oref) ts'\n = (ts' = Structures_H.BlockedOnNotification oref)\"\n\ndefinition arch_tcb_relation :: \"Structures_A.arch_tcb \\ Structures_H.arch_tcb \\ bool\" where\n \"arch_tcb_relation \\ \\atcb atcb'. tcb_context atcb = atcbContext atcb'\"\n\ndefinition tcb_relation :: \"Structures_A.tcb \\ Structures_H.tcb \\ bool\" where\n \"tcb_relation \\ \\tcb tcb'.\n tcb_fault_handler tcb = to_bl (tcbFaultHandler tcb')\n \\ tcb_ipc_buffer tcb = tcbIPCBuffer tcb'\n \\ arch_tcb_relation (tcb_arch tcb) (tcbArch tcb')\n \\ thread_state_relation (tcb_state tcb) (tcbState tcb')\n \\ fault_rel_optionation (tcb_fault tcb) (tcbFault tcb')\n \\ cap_relation (tcb_ctable tcb) (cteCap (tcbCTable tcb'))\n \\ cap_relation (tcb_vtable tcb) (cteCap (tcbVTable tcb'))\n \\ cap_relation (tcb_reply tcb) (cteCap (tcbReply tcb'))\n \\ cap_relation (tcb_caller tcb) (cteCap (tcbCaller tcb'))\n \\ cap_relation (tcb_ipcframe tcb) (cteCap (tcbIPCBufferFrame tcb'))\n \\ tcb_bound_notification tcb = tcbBoundNotification tcb'\n \\ tcb_mcpriority tcb = tcbMCP tcb'\"\n\ndefinition\n other_obj_relation :: \"Structures_A.kernel_object \\ Structures_H.kernel_object \\ bool\"\nwhere\n \"other_obj_relation obj obj' \\\n (case (obj, obj') of\n (TCB tcb, KOTCB tcb') \\ tcb_relation tcb tcb'\n | (Endpoint ep, KOEndpoint ep') \\ ep_relation ep ep'\n | (Notification ntfn, KONotification ntfn') \\ ntfn_relation ntfn ntfn'\n | (ArchObj (RISCV64_A.ASIDPool ap), KOArch (KOASIDPool ap')) \\ asid_pool_relation ap ap'\n | _ \\ False)\"\n\nprimrec pte_relation' :: \"RISCV64_A.pte \\ RISCV64_H.pte \\ bool\" where\n \"pte_relation' RISCV64_A.InvalidPTE x =\n (x = RISCV64_H.InvalidPTE)\"\n| \"pte_relation' (RISCV64_A.PageTablePTE ppn atts) x =\n (x = RISCV64_H.PageTablePTE (ucast ppn) (Global \\ atts) \\ Execute \\ atts \\ User \\ atts)\"\n| \"pte_relation' (RISCV64_A.PagePTE ppn atts rghts) x =\n (x = RISCV64_H.PagePTE (ucast ppn) (Global \\ atts) (User \\ atts) (Execute \\ atts)\n (vmrights_map rghts))\"\n\ndefinition pte_relation :: \"pt_index \\ Structures_A.kernel_object \\ kernel_object \\ bool\" where\n \"pte_relation y \\ \\ko ko'. \\pt pte. ko = ArchObj (PageTable pt) \\ ko' = KOArch (KOPTE pte)\n \\ pte_relation' (pt y) pte\"\n\nprimrec aobj_relation_cuts :: \"RISCV64_A.arch_kernel_obj \\ machine_word \\ obj_relation_cuts\" where\n \"aobj_relation_cuts (DataPage dev sz) x =\n { (x + (n << pageBits), \\_ obj. obj = (if dev then KOUserDataDevice else KOUserData))\n | n. n < 2 ^ (pageBitsForSize sz - pageBits) }\"\n| \"aobj_relation_cuts (RISCV64_A.ASIDPool pool) x =\n {(x, other_obj_relation)}\"\n| \"aobj_relation_cuts (PageTable pt) x =\n (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\"\n\nprimrec obj_relation_cuts :: \"Structures_A.kernel_object \\ machine_word \\ obj_relation_cuts\" where\n \"obj_relation_cuts (CNode sz cs) x =\n (if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)})\"\n| \"obj_relation_cuts (TCB tcb) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Endpoint ep) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (Notification ntfn) x = {(x, other_obj_relation)}\"\n| \"obj_relation_cuts (ArchObj ao) x = aobj_relation_cuts ao x\"\n\n\nlemma obj_relation_cuts_def2:\n \"obj_relation_cuts ko x =\n (case ko of CNode sz cs \\ if well_formed_cnode_n sz cs\n then {(cte_map (x, y), cte_relation y) | y. y \\ dom cs}\n else {(x, \\\\)}\n | ArchObj (PageTable pt) \\ (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\n | ArchObj (DataPage dev sz) \\\n {(x + (n << pageBits), \\_ obj. obj =(if dev then KOUserDataDevice else KOUserData))\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | _ \\ {(x, other_obj_relation)})\"\n by (simp split: Structures_A.kernel_object.split\n RISCV64_A.arch_kernel_obj.split)\n\nlemma obj_relation_cuts_def3:\n \"obj_relation_cuts ko x =\n (case a_type ko of\n ACapTable n \\ {(cte_map (x, y), cte_relation y) | y. length y = n}\n | AArch APageTable \\ (\\y. (x + (ucast y << pteBits), pte_relation y)) ` UNIV\n | AArch (AUserData sz) \\ {(x + (n << pageBits), \\_ obj. obj = KOUserData)\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AArch (ADeviceData sz) \\ {(x + (n << pageBits), \\_ obj. obj = KOUserDataDevice )\n | n . n < 2 ^ (pageBitsForSize sz - pageBits) }\n | AGarbage _ \\ {(x, \\\\)}\n | _ \\ {(x, other_obj_relation)})\"\n by (simp add: obj_relation_cuts_def2 a_type_def well_formed_cnode_n_def length_set_helper\n split: Structures_A.kernel_object.split RISCV64_A.arch_kernel_obj.split)\n\ndefinition is_other_obj_relation_type :: \"a_type \\ bool\" where\n \"is_other_obj_relation_type tp \\\n case tp of\n ACapTable n \\ False\n | AArch APageTable \\ False\n | AArch (AUserData _) \\ False\n | AArch (ADeviceData _) \\ False\n | AGarbage _ \\ False\n | _ \\ True\"\n\nlemma is_other_obj_relation_type_CapTable:\n \"\\ is_other_obj_relation_type (ACapTable n)\"\n by (simp add: is_other_obj_relation_type_def)\n\nlemma is_other_obj_relation_type_UserData:\n \"\\ is_other_obj_relation_type (AArch (AUserData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type_DeviceData:\n \"\\ is_other_obj_relation_type (AArch (ADeviceData sz))\"\n unfolding is_other_obj_relation_type_def by simp\n\nlemma is_other_obj_relation_type:\n \"is_other_obj_relation_type (a_type ko) \\ obj_relation_cuts ko x = {(x, other_obj_relation)}\"\n by (simp add: obj_relation_cuts_def3 is_other_obj_relation_type_def\n split: a_type.splits aa_type.splits)\n\ndefinition pspace_dom :: \"Structures_A.kheap \\ machine_word set\" where\n \"pspace_dom ps \\ \\x\\dom ps. fst ` (obj_relation_cuts (the (ps x)) x)\"\n\ndefinition pspace_relation ::\n \"Structures_A.kheap \\ (machine_word \\ Structures_H.kernel_object) \\ bool\" where\n \"pspace_relation ab con \\\n (pspace_dom ab = dom con) \\\n (\\x \\ dom ab. \\(y, P) \\ obj_relation_cuts (the (ab x)) x. P (the (ab x)) (the (con y)))\"\n\ndefinition etcb_relation :: \"etcb \\ Structures_H.tcb \\ bool\" where\n \"etcb_relation \\ \\etcb tcb'.\n tcb_priority etcb = tcbPriority tcb'\n \\ tcb_time_slice etcb = tcbTimeSlice tcb'\n \\ tcb_domain etcb = tcbDomain tcb'\"\n\ndefinition ekheap_relation ::\n \"(obj_ref \\ etcb option) \\ (machine_word \\ Structures_H.kernel_object) \\ bool\" where\n \"ekheap_relation ab con \\\n \\x \\ dom ab. \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation (the (ab x)) tcb'\"\n\nprimrec sched_act_relation :: \"Deterministic_A.scheduler_action \\ scheduler_action \\ bool\"\n where\n \"sched_act_relation resume_cur_thread a' = (a' = ResumeCurrentThread)\" |\n \"sched_act_relation choose_new_thread a' = (a' = ChooseNewThread)\" |\n \"sched_act_relation (switch_thread x) a' = (a' = SwitchToThread x)\"\n\ndefinition ready_queues_relation ::\n \"(Deterministic_A.domain \\ Structures_A.priority \\ Deterministic_A.ready_queue) \\\n (domain \\ priority \\ KernelStateData_H.ready_queue) \\ bool\" where\n \"ready_queues_relation qs qs' \\ \\d p. (qs d p = qs' (d, p))\"\n\ndefinition ghost_relation ::\n \"Structures_A.kheap \\ (machine_word \\ vmpage_size) \\ (machine_word \\ nat) \\ bool\" where\n \"ghost_relation h ups cns \\\n (\\a sz. (\\dev. h a = Some (ArchObj (DataPage dev sz))) \\ ups a = Some sz) \\\n (\\a n. (\\cs. h a = Some (CNode n cs) \\ well_formed_cnode_n n cs) \\ cns a = Some n)\"\n\ndefinition cdt_relation :: \"(cslot_ptr \\ bool) \\ cdt \\ cte_heap \\ bool\" where\n \"cdt_relation \\ \\cte_at m m'.\n \\c. cte_at c \\ cte_map ` descendants_of c m = descendants_of' (cte_map c) m'\"\n\ndefinition cdt_list_relation :: \"cdt_list \\ cdt \\ cte_heap \\ bool\" where\n \"cdt_list_relation \\ \\t m m'.\n \\c cap node. m' (cte_map c) = Some (CTE cap node)\n \\ (case next_slot c t m of None \\ True\n | Some next \\ mdbNext node = cte_map next)\"\n\ndefinition revokable_relation ::\n \"(cslot_ptr \\ bool) \\ (cslot_ptr \\ cap option) \\ cte_heap \\ bool\" where\n \"revokable_relation revo cs m' \\\n \\c cap node. cs c \\ None \\\n m' (cte_map c) = Some (CTE cap node) \\\n revo c = mdbRevocable node\"\n\ndefinition irq_state_relation :: \"irq_state \\ irqstate \\ bool\" where\n \"irq_state_relation irq irq' \\ case (irq, irq') of\n (irq_state.IRQInactive, irqstate.IRQInactive) \\ True\n | (irq_state.IRQSignal, irqstate.IRQSignal) \\ True\n | (irq_state.IRQTimer, irqstate.IRQTimer) \\ True\n | _ \\ False\"\n\ndefinition interrupt_state_relation ::\n \"(irq \\ obj_ref) \\ (irq \\ irq_state) \\ interrupt_state \\ bool\" where\n \"interrupt_state_relation node_map irqs is \\\n (\\node irqs'. is = InterruptState node irqs'\n \\ (\\irq. node_map irq = node + (ucast irq << cte_level_bits))\n \\ (\\irq. irq_state_relation (irqs irq) (irqs' irq)))\"\n\ndefinition arch_state_relation :: \"(arch_state \\ RISCV64_H.kernel_state) set\" where\n \"arch_state_relation \\ {(s, s') .\n riscv_asid_table s = riscvKSASIDTable s' o ucast\n \\ riscv_global_pts s = (\\l. set (riscvKSGlobalPTs s' (size l)))\n \\ riscv_kernel_vspace s = riscvKSKernelVSpace s'}\"\n\ndefinition rights_mask_map :: \"rights set \\ Types_H.cap_rights\" where\n \"rights_mask_map \\\n \\rs. CapRights (AllowWrite \\ rs) (AllowRead \\ rs) (AllowGrant \\ rs) (AllowGrantReply \\ rs)\"\n\n\nlemma obj_relation_cutsE:\n \"\\ (y, P) \\ obj_relation_cuts ko x; P ko ko';\n \\sz cs z cap cte. \\ ko = CNode sz cs; well_formed_cnode_n sz cs; y = cte_map (x, z);\n ko' = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte) \\\n \\ R;\n \\pt (z :: pt_index) pte'. \\ ko = ArchObj (PageTable pt); y = x + (ucast z << pteBits);\n ko' = KOArch (KOPTE pte'); pte_relation' (pt z) pte' \\\n \\ R;\n \\sz dev n. \\ ko = ArchObj (DataPage dev sz);\n ko' = (if dev then KOUserDataDevice else KOUserData);\n y = x + (n << pageBits); n < 2 ^ (pageBitsForSize sz - pageBits) \\ \\ R;\n \\ y = x; other_obj_relation ko ko'; is_other_obj_relation_type (a_type ko) \\ \\ R\n \\ \\ R\"\n by (force simp: obj_relation_cuts_def2 is_other_obj_relation_type_def a_type_def\n cte_relation_def pte_relation_def\n split: Structures_A.kernel_object.splits if_splits RISCV64_A.arch_kernel_obj.splits)\n\nlemma eq_trans_helper:\n \"\\ x = y; P y = Q \\ \\ P x = Q\"\n by simp\n\nlemma cap_relation_case':\n \"cap_relation cap cap' = (case cap of\n cap.ArchObjectCap arch_cap.ASIDControlCap \\ cap_relation cap cap'\n | _ \\ cap_relation cap cap')\"\n by (simp split: cap.split arch_cap.split)\n\nschematic_goal cap_relation_case:\n \"cap_relation cap cap' = ?P\"\n apply (subst cap_relation_case')\n apply (clarsimp cong: cap.case_cong arch_cap.case_cong)\n apply (rule refl)\n done\n\nlemmas cap_relation_split =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split[where P=P]] for P\nlemmas cap_relation_split_asm =\n eq_trans_helper [where P=P, OF cap_relation_case cap.split_asm[where P=P]] for P\n\n\n\ntext \\\n Relations on other data types that aren't stored but used as intermediate values\n in the specs.\n\\\nprimrec message_info_map :: \"Structures_A.message_info \\ Types_H.message_info\" where\n \"message_info_map (Structures_A.MI a b c d) = (Types_H.MI a b c d)\"\n\nlemma mi_map_label[simp]: \"msgLabel (message_info_map mi) = mi_label mi\"\n by (cases mi, simp)\n\nprimrec syscall_error_map :: \"ExceptionTypes_A.syscall_error \\ Fault_H.syscall_error\" where\n \"syscall_error_map (ExceptionTypes_A.InvalidArgument n) = Fault_H.InvalidArgument n\"\n| \"syscall_error_map (ExceptionTypes_A.InvalidCapability n) = (Fault_H.InvalidCapability n)\"\n| \"syscall_error_map ExceptionTypes_A.IllegalOperation = Fault_H.IllegalOperation\"\n| \"syscall_error_map (ExceptionTypes_A.RangeError n m) = Fault_H.RangeError n m\"\n| \"syscall_error_map ExceptionTypes_A.AlignmentError = Fault_H.AlignmentError\"\n| \"syscall_error_map (ExceptionTypes_A.FailedLookup b lf) = Fault_H.FailedLookup b (lookup_failure_map lf)\"\n| \"syscall_error_map ExceptionTypes_A.TruncatedMessage = Fault_H.TruncatedMessage\"\n| \"syscall_error_map ExceptionTypes_A.DeleteFirst = Fault_H.DeleteFirst\"\n| \"syscall_error_map ExceptionTypes_A.RevokeFirst = Fault_H.RevokeFirst\"\n| \"syscall_error_map (ExceptionTypes_A.NotEnoughMemory n) = Fault_H.syscall_error.NotEnoughMemory n\"\n\ndefinition APIType_map :: \"Structures_A.apiobject_type \\ RISCV64_H.object_type\" where\n \"APIType_map ty \\\n case ty of\n Structures_A.Untyped \\ APIObjectType ArchTypes_H.Untyped\n | Structures_A.TCBObject \\ APIObjectType ArchTypes_H.TCBObject\n | Structures_A.EndpointObject \\ APIObjectType ArchTypes_H.EndpointObject\n | Structures_A.NotificationObject \\ APIObjectType ArchTypes_H.NotificationObject\n | Structures_A.CapTableObject \\ APIObjectType ArchTypes_H.CapTableObject\n | ArchObject ao \\ (case ao of\n SmallPageObj \\ SmallPageObject\n | LargePageObj \\ LargePageObject\n | HugePageObj \\ HugePageObject\n | PageTableObj \\ PageTableObject)\"\n\ndefinition state_relation :: \"(det_state \\ kernel_state) set\" where\n \"state_relation \\ {(s, s').\n pspace_relation (kheap s) (ksPSpace s')\n \\ ekheap_relation (ekheap s) (ksPSpace s')\n \\ sched_act_relation (scheduler_action s) (ksSchedulerAction s')\n \\ ready_queues_relation (ready_queues s) (ksReadyQueues s')\n \\ ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\n \\ cdt_relation (swp cte_at s) (cdt s) (ctes_of s')\n \\ cdt_list_relation (cdt_list s) (cdt s) (ctes_of s')\n \\ revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s')\n \\ (arch_state s, ksArchState s') \\ arch_state_relation\n \\ interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s')\n \\ (cur_thread s = ksCurThread s')\n \\ (idle_thread s = ksIdleThread s')\n \\ (machine_state s = ksMachineState s')\n \\ (work_units_completed s = ksWorkUnitsCompleted s')\n \\ (domain_index s = ksDomScheduleIdx s')\n \\ (domain_list s = ksDomSchedule s')\n \\ (cur_domain s = ksCurDomain s')\n \\ (domain_time s = ksDomainTime s')}\"\n\ntext \\Rules for using states in the relation.\\\n\nlemma curthread_relation:\n \"(a, b) \\ state_relation \\ ksCurThread b = cur_thread a\"\n by (simp add: state_relation_def)\n\nlemma state_relation_pspace_relation[elim!]:\n \"(s,s') \\ state_relation \\ pspace_relation (kheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relation_ekheap_relation[elim!]:\n \"(s,s') \\ state_relation \\ ekheap_relation (ekheap s) (ksPSpace s')\"\n by (simp add: state_relation_def)\n\nlemma state_relationD:\n \"(s, s') \\ state_relation \\\n pspace_relation (kheap s) (ksPSpace s') \\\n ekheap_relation (ekheap s) (ksPSpace s') \\\n sched_act_relation (scheduler_action s) (ksSchedulerAction s') \\\n ready_queues_relation (ready_queues s) (ksReadyQueues s') \\\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') \\\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s') \\\n (arch_state s, ksArchState s') \\ arch_state_relation \\\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \\\n cur_thread s = ksCurThread s' \\\n idle_thread s = ksIdleThread s' \\\n machine_state s = ksMachineState s' \\\n work_units_completed s = ksWorkUnitsCompleted s' \\\n domain_index s = ksDomScheduleIdx s' \\\n domain_list s = ksDomSchedule s' \\\n cur_domain s = ksCurDomain s' \\\n domain_time s = ksDomainTime s'\"\n unfolding state_relation_def by simp\n\nlemma state_relationE [elim?]:\n assumes sr: \"(s, s') \\ state_relation\"\n and rl: \"\\ pspace_relation (kheap s) (ksPSpace s');\n ekheap_relation (ekheap s) (ksPSpace s');\n sched_act_relation (scheduler_action s) (ksSchedulerAction s');\n ready_queues_relation (ready_queues s) (ksReadyQueues s');\n ghost_relation (kheap s) (gsUserPages s') (gsCNodes s');\n cdt_relation (swp cte_at s) (cdt s) (ctes_of s') \\\n revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s');\n cdt_list_relation (cdt_list s) (cdt s) (ctes_of s');\n (arch_state s, ksArchState s') \\ arch_state_relation;\n interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s');\n cur_thread s = ksCurThread s';\n idle_thread s = ksIdleThread s';\n machine_state s = ksMachineState s';\n work_units_completed s = ksWorkUnitsCompleted s';\n domain_index s = ksDomScheduleIdx s';\n domain_list s = ksDomSchedule s';\n cur_domain s = ksCurDomain s';\n domain_time s = ksDomainTime s' \\ \\ R\"\n shows \"R\"\n using sr by (blast intro!: rl dest: state_relationD)\n\nlemmas isCap_defs =\n isZombie_def isArchObjectCap_def\n isThreadCap_def isCNodeCap_def isNotificationCap_def\n isEndpointCap_def isUntypedCap_def isNullCap_def\n isIRQHandlerCap_def isIRQControlCap_def isReplyCap_def\n isFrameCap_def isPageTableCap_def\n isASIDControlCap_def isASIDPoolCap_def\n isDomainCap_def isArchFrameCap_def\n\nlemma isCNodeCap_cap_map[simp]:\n \"cap_relation c c' \\ isCNodeCap c' = is_cnode_cap c\"\n by (cases c) (auto simp: isCap_defs split: sum.splits)\n\nlemma sts_rel_idle :\n \"thread_state_relation st IdleThreadState = (st = Structures_A.IdleThreadState)\"\n by (cases st, auto)\n\nlemma pspace_relation_absD:\n \"\\ ab x = Some y; pspace_relation ab con \\\n \\ \\(x', P) \\ obj_relation_cuts y x. \\z. con x' = Some z \\ P y z\"\n apply (clarsimp simp: pspace_relation_def)\n apply (drule bspec, erule domI)\n apply simp\n apply (drule(1) bspec)\n apply (subgoal_tac \"a \\ pspace_dom ab\", clarsimp)\n apply (simp (no_asm) add: pspace_dom_def)\n apply (fastforce simp: image_def intro: rev_bexI)\n done\n\nlemma ekheap_relation_absD:\n \"\\ ab x = Some y; ekheap_relation ab con \\ \\\n \\tcb'. con x = Some (KOTCB tcb') \\ etcb_relation y tcb'\"\n by (force simp add: ekheap_relation_def)\n\nlemma in_related_pspace_dom:\n \"\\ s' x = Some y; pspace_relation s s' \\ \\ x \\ pspace_dom s\"\n by (clarsimp simp add: pspace_relation_def)\n\nlemma pspace_dom_revE:\n \"\\ x \\ pspace_dom ps; \\ko y P. \\ ps y = Some ko; (x, P) \\ obj_relation_cuts ko y \\ \\ R \\ \\ R\"\n by (clarsimp simp add: pspace_dom_def)\n\nlemma pspace_dom_relatedE:\n \"\\ s' x = Some ko'; pspace_relation s s';\n \\y ko P. \\ s y = Some ko; (x, P) \\ obj_relation_cuts ko y; P ko ko' \\ \\ R \\ \\ R\"\n apply (rule pspace_dom_revE [OF in_related_pspace_dom]; assumption?)\n apply (fastforce dest: pspace_relation_absD)\n done\n\nlemma ghost_relation_typ_at:\n \"ghost_relation (kheap s) ups cns \\\n (\\a sz. data_at sz a s = (ups a = Some sz)) \\\n (\\a n. typ_at (ACapTable n) a s = (cns a = Some n))\"\n apply (rule eq_reflection)\n apply (clarsimp simp: ghost_relation_def typ_at_eq_kheap_obj data_at_def)\n apply (intro conjI impI iffI allI; force)\n done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/refine/RISCV64/StateRelation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.28776780965284365, "lm_q1q2_score": 0.15062352734113307}} {"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\n(*\n Retype refinement\n*)\n\ntheory Retype_R\nimports VSpace_R\nbegin\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n APIType_map2 :: \"kernel_object + ARM_H.object_type \\ Structures_A.apiobject_type\"\nwhere\n \"APIType_map2 ty \\ case ty of\n Inr (APIObjectType ArchTypes_H.Untyped) \\ Structures_A.Untyped\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Structures_A.TCBObject\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Structures_A.EndpointObject\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Structures_A.NotificationObject\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Structures_A.CapTableObject\n | Inr PageTableObject \\ ArchObject PageTableObj\n | Inr PageDirectoryObject \\ ArchObject PageDirectoryObj\n | Inr LargePageObject \\ ArchObject LargePageObj\n | Inr SectionObject \\ ArchObject SectionObj\n | Inr SuperSectionObject \\ ArchObject SuperSectionObj\n | Inl (KOArch (KOASIDPool _)) \\ ArchObject ASIDPoolObj\n | _ \\ ArchObject SmallPageObj\"\n\nlemma placeNewObject_def2:\n \"placeNewObject ptr val gb = createObjects' ptr 1 (injectKO val) gb\"\n apply (clarsimp simp:placeNewObject_def placeNewObject'_def \n createObjects'_def shiftL_nat)\n done\n\nlemma clearMemoryVM_nop:\n \"doMachineOp (mapM_x (swp clearMemoryVM sz) list) = return ()\"\n by simp\n\nlemma createObjects_ret:\n \"\\n < 2^word_bits;n\\ 0\\ \\\n \\\\\\ createObjects y n ko gbits\n \\\\r s. r = map (\\p. ptr_add y (p * 2 ^ objBitsKO ko * 2 ^ gbits))\n [0..< n]\\\"\n unfolding createObjects_def createObjects'_def\n apply (simp add: split_def)\n apply (wp|simp cong: if_cong)+\n apply (clarsimp simp: ptr_add_def upto_enum_def o_def\n unat_sub word_le_nat_alt\n power_sub[symmetric]\n objBits_def[symmetric]\n simp del: upt_Suc)\n apply (clarsimp simp: unat_of_nat_minus_1 word_bits_def \n shiftl_t2n power_add)\n done\n\nlemma objBitsKO_bounded2[simp]:\n \"objBitsKO ko < word_bits\"\n by (simp add: objBits_simps word_bits_def pageBits_def archObjSize_def\n split: Structures_H.kernel_object.split arch_kernel_object.split)\n\ndeclare select_singleton_is_return[simp]\n\ndefinition\n APIType_capBits :: \"ARM_H.object_type \\ nat \\ nat\"\nwhere\n \"APIType_capBits ty us \\ case ty of\n APIObjectType ArchTypes_H.Untyped \\ us\n | APIObjectType ArchTypes_H.TCBObject \\ objBits (makeObject :: tcb)\n | APIObjectType ArchTypes_H.EndpointObject \\ objBits (makeObject :: endpoint)\n | APIObjectType ArchTypes_H.NotificationObject \\ objBits (makeObject :: Structures_H.notification)\n | APIObjectType ArchTypes_H.CapTableObject \\ objBits (makeObject :: cte) + us\n | SmallPageObject \\ pageBitsForSize ARMSmallPage\n | LargePageObject \\ pageBitsForSize ARMLargePage \n | SectionObject \\ pageBitsForSize ARMSection\n | SuperSectionObject \\ pageBitsForSize ARMSuperSection\n | PageTableObject \\ 10\n | PageDirectoryObject \\ 14\"\n\ndefinition\n makeObjectKO :: \"bool \\ (kernel_object + ARM_H.object_type) \\ kernel_object\"\nwhere\n \"makeObjectKO dev ty \\ case ty of\n Inl KOUserData \\ Some KOUserData\n | Inl (KOArch (KOASIDPool _)) \\ Some (KOArch (KOASIDPool makeObject))\n | Inr (APIObjectType ArchTypes_H.TCBObject) \\ Some (KOTCB makeObject)\n | Inr (APIObjectType ArchTypes_H.EndpointObject) \\ Some (KOEndpoint makeObject)\n | Inr (APIObjectType ArchTypes_H.NotificationObject) \\ Some (KONotification makeObject)\n | Inr (APIObjectType ArchTypes_H.CapTableObject) \\ Some (KOCTE makeObject)\n | Inr PageTableObject \\ Some (KOArch (KOPTE makeObject))\n | Inr PageDirectoryObject \\ Some (KOArch (KOPDE makeObject))\n | Inr SmallPageObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | Inr LargePageObject \\ Some(if dev then KOUserDataDevice else KOUserData)\n | Inr SectionObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | Inr SuperSectionObject \\ Some (if dev then KOUserDataDevice else KOUserData)\n | _ \\ None\"\n\ntext {* makeObject etc. lemmas *}\n\nlemma NullCap_valid' [iff]: \"s \\' capability.NullCap\"\n unfolding valid_cap'_def by simp\n\nlemma valid_obj_makeObject_cte [simp]:\n \"valid_obj' (KOCTE makeObject) s\"\n unfolding valid_obj'_def valid_cte'_def\n by (clarsimp simp: makeObject_cte)\n\nlemma valid_obj_makeObject_tcb [simp]:\n \"valid_obj' (KOTCB makeObject) s\"\n unfolding valid_obj'_def valid_tcb'_def valid_tcb_state'_def\n by (clarsimp simp: makeObject_tcb makeObject_cte\n tcb_cte_cases_def maxDomain_def numDomains_def maxPriority_def numPriorities_def minBound_word)\n\nlemma valid_obj_makeObject_endpoint [simp]:\n \"valid_obj' (KOEndpoint makeObject) s\"\n unfolding valid_obj'_def valid_ep'_def\n by (clarsimp simp: makeObject_endpoint)\n\nlemma valid_obj_makeObject_notification [simp]:\n \"valid_obj' (KONotification makeObject) s\"\n unfolding valid_obj'_def valid_ntfn'_def\n by (clarsimp simp: makeObject_notification)\n\nlemma valid_obj_makeObject_user_data [simp]:\n \"valid_obj' (KOUserData) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_user_data_device [simp]:\n \"valid_obj' (KOUserDataDevice) s\"\n unfolding valid_obj'_def by simp\n\nlemma valid_obj_makeObject_pte[simp]:\n \"valid_obj' (KOArch (KOPTE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pte)\n\nlemma valid_obj_makeObject_pde[simp]:\n \"valid_obj' (KOArch (KOPDE makeObject)) s\"\n unfolding valid_obj'_def by (simp add: makeObject_pde)\n\nlemma valid_obj_makeObject_asid_pool[simp]:\n \"valid_obj' (KOArch (KOASIDPool makeObject)) s\"\n unfolding valid_obj'_def \n by (simp add: makeObject_asidpool Let_def ran_def dom_def)\n\nlemmas valid_obj_makeObject_rules = \n valid_obj_makeObject_user_data valid_obj_makeObject_tcb\n valid_obj_makeObject_endpoint valid_obj_makeObject_notification\n valid_obj_makeObject_cte valid_obj_makeObject_pte valid_obj_makeObject_pde\n valid_obj_makeObject_asid_pool valid_obj_makeObject_user_data_device\n\nlemma makeObjectKO_valid:\n \"makeObjectKO dev tp = Some v \\ valid_obj' v s\"\n by (clarsimp simp: makeObjectKO_def valid_obj_makeObject_rules\n split: sum.splits object_type.splits\n apiobject_type.splits kernel_object.splits \n arch_kernel_object.splits)\n\nlemma loadObject_cte_same:\n fixes x :: cte\n shows \"(x, s) \\ fst (loadObject p q n ko s') \\ s = s'\"\n apply (clarsimp simp add: loadObject_cte in_monad typeError_def\n objBits_simps magnitudeCheck_assert\n split: kernel_object.split_asm if_split_asm)\n done\n\ntext {* On the abstract side *}\n\nlemma obj_bits_default_TCBObject:\n \"obj_bits (default_object Structures_A.apiobject_type.TCBObject dev us) \n = objBits (makeObject :: tcb)\"\n unfolding other_obj_relation_def default_object_def \n by (simp add: objBits_simps pageBits_def)\n\nlemma other_obj_relation_default_EndpointObject:\n \"other_obj_relation (default_object Structures_A.apiobject_type.EndpointObject dev us)\n (injectKO (makeObject :: endpoint))\"\n unfolding other_obj_relation_def ep_relation_def default_ep_def default_object_def \n by (simp add: makeObject_endpoint)\n\nlemma obj_bits_default_EndpointObject:\n \"obj_bits (default_object Structures_A.apiobject_type.EndpointObject dev us) \n = objBits (makeObject :: endpoint)\"\n unfolding other_obj_relation_def default_object_def \n by (simp add: objBits_simps pageBits_def)\n\nlemma other_obj_relation_default_NotificationObject:\n \"other_obj_relation (default_object Structures_A.apiobject_type.NotificationObject dev us)\n (injectKO (makeObject :: Structures_H.notification))\"\n unfolding other_obj_relation_def ntfn_relation_def default_notification_def \n default_object_def default_ntfn_def\n \n by (simp add: makeObject_notification)\n\n\nlemma obj_bits_default_NotificationObject:\n \"obj_bits (default_object Structures_A.apiobject_type.NotificationObject dev us) \n = objBits (makeObject :: Structures_H.notification)\"\n unfolding other_obj_relation_def default_object_def \n by (simp add: objBits_simps pageBits_def)\n\ntext {* Lemmas for createNewObjects etc. *}\n\nlemma pspace_dom_upd:\n assumes orth: \"set as \\ dom ps = {}\"\n shows \"pspace_dom (foldr (\\p ps. ps(p \\ ko)) as ps) = \n pspace_dom ps \\ (\\x \\ set as. fst ` obj_relation_cuts ko x)\"\n using orth\n apply (subst foldr_upd_app_if)\n apply (rule set_eqI, simp add: pspace_dom_def)\n apply (rule iffI)\n apply (clarsimp split: if_split_asm)\n apply (rule rev_bexI, erule domI)\n apply (fastforce simp: image_def)\n apply (erule disjE)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule exI)\n apply clarsimp\n apply (intro conjI impI)\n apply (drule equals0D, erule notE, erule IntI, erule domI)\n apply (fastforce simp: image_def)\n apply clarsimp\n apply (rule rev_bexI)\n apply (clarsimp simp: domIff)\n apply (erule(1) notE)\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\nlemma pspace_dom_upd_flat:\n assumes other: \"is_other_obj_relation_type (a_type ko)\"\n assumes orth: \"set as \\ dom ps = {}\"\n shows \"pspace_dom (foldr (\\p ps. ps(p \\ ko)) as ps) = \n pspace_dom ps \\ set as\"\n apply (subst pspace_dom_upd[OF orth])\n apply (simp add: is_other_obj_relation_type [OF other])\n done\n\ndefinition\n \"new_cap_addrs \\ \\n ptr ko. map (\\p. ptr + ((of_nat p :: word32) << (objBitsKO ko)))\n [0 ..< n]\"\n\ndefinition\n null_filter' :: \"('a \\ cte) \\ ('a \\ cte)\"\nwhere\n \"null_filter' f \\ \\x. if f x = Some (CTE NullCap nullMDBNode) then None else f x\"\n\nlemma across_null_filter_eq':\n assumes eq: \"null_filter' xs = null_filter' ys\"\n shows \"\\ xs x = Some v; ys x = Some v \\ R;\n \\ v = CTE NullCap nullMDBNode; ys x = None \\ \\ R \\\n \\ R\"\n apply (cases \"null_filter' xs x\")\n apply (subgoal_tac \"null_filter' ys x = None\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n apply (subgoal_tac \"null_filter' ys x = Some a\")\n apply (simp add: null_filter'_def split: if_split_asm)\n apply (simp add: eq)\n done\n\nlemma null_filter_parent_of'':\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ c; c \\ 0 \\\n \\ ys \\ x \\ c\"\n apply (clarsimp simp add: mdb_next_unfold)\n apply (drule arg_cong[where f=\"\\xs. xs x\"])\n apply (simp add: null_filter'_def nullPointer_def split: if_split_asm)\n done\n\nlemma null_filter_parent_of':\n \"\\ null_filter' xs = null_filter' ys; c \\ 0 \\\n \\ xs \\ x \\ c = ys \\ x \\ c\"\n apply (rule iffI)\n apply (erule(2) null_filter_parent_of'')\n apply (erule(2) null_filter_parent_of''[OF sym])\n done\n\nlemma null_filter_parentOf:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x parentOf y \\\n \\ ys \\ x parentOf y\"\n apply (clarsimp simp add: parentOf_def)\n apply (rule across_null_filter_eq'[where x=x], assumption+)\n apply (erule(1) across_null_filter_eq')\n apply clarsimp\n apply simp\n apply simp\n done\n\nlemma null_filter_descendant:\n \"\\ null_filter' xs = null_filter' ys; xs \\ x \\ y \\\n \\ ys \\ x \\ y\"\n apply (erule subtree.induct)\n apply (rule subtree.direct_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n apply (erule subtree.trans_parent)\n apply (erule(2) null_filter_parent_of'')\n apply assumption\n apply (erule(1) null_filter_parentOf)\n done\n\nlemma null_filter_descendants_of':\n \"null_filter' xs = null_filter' ys\n \\ descendants_of' x xs = descendants_of' x ys\"\n apply (simp add: descendants_of'_def)\n apply (rule set_eqI, rule iffI)\n apply simp\n apply (erule(1) null_filter_descendant)\n apply simp\n apply (erule(1) null_filter_descendant[OF sym])\n done\n\nlemma subtree_not_None:\n \"\\ s \\ x \\ y; s x = None \\ \\ False\"\n apply (erule subtree.induct)\n apply (simp add: parentOf_def)\n apply (simp add: parentOf_def)\n done\n\nlemma pspace_relation_no_cte_at:\n \" \\pspace_relation (kheap s) (ksPSpace s');\n ctes_of s' (cte_map p) = None; pspace_aligned' s';\n pspace_distinct' s'\\\n \\ caps_of_state s p = None\"\n apply(rule_tac Q=\"ctes_of s' (cte_map p) = None\" in contrapos_pp)\n apply(simp)\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(frule_tac cref=\"fst p\" and oref=\"snd p\" in pspace_relation_cte_wp_at)\n apply(simp add: cte_wp_at_caps_of_state)\n apply(simp, simp)\n apply(simp add: cte_wp_at_ctes_of)\n done\n\n\nlemma descendants_of_cte_at':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\ \n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD2)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\n\nlemma descendants_of_cte_at2':\n \"\\ p \\ descendants_of x (cdt s); valid_mdb s \\ \n \\ cte_wp_at (\\c. c \\ cap.NullCap) x s\"\n apply (simp add: descendants_of_def)\n apply (drule tranclD)\n apply (clarsimp simp: cdt_parent_defs valid_mdb_def mdb_cte_at_def\n simp del: split_paired_All)\n apply (fastforce elim: cte_wp_at_weakenE)\n done\n\nlemma cte_at_next_slot'':\n notes split_paired_All[simp del] split_paired_Ex[simp del]\n shows \"\\valid_list s; valid_mdb s; finite_depth (cdt s)\\\n \\ next_slot p (cdt_list s) (cdt s) = Some n \\ cte_wp_at (\\c. c \\ cap.NullCap) p s\"\n apply(simp add: next_slot_def)\n apply(simp split: if_split_asm)\n apply(drule next_childD, simp)\n apply(rule_tac p=n in descendants_of_cte_at2')\n apply(simp add: child_descendant)\n apply(simp)\n apply(subgoal_tac \"next_not_child_dom (p, cdt_list s, cdt s)\")\n prefer 2\n apply(simp add: next_not_child_termination valid_mdb_def valid_list_def)\n apply(simp split: if_split_asm)\n apply(case_tac \"cdt s p\")\n apply(simp)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n apply(drule next_sibD)\n apply(elim exE conjE)\n apply(drule after_in_list_in_list)\n apply(rule descendants_of_cte_at')\n apply(simp add: descendants_of_def cdt_parent_defs)\n apply(rule r_into_trancl, simp)\n apply(simp)\n done\n\n\nlemma state_relation_null_filterE:\n \"\\ (s, s') \\ state_relation; t = kheap_update f (ekheap_update ef s);\n \\f' g' h'.\n t' = s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\;\n null_filter (caps_of_state t) = null_filter (caps_of_state s);\n null_filter' (ctes_of t') = null_filter' (ctes_of s');\n pspace_relation (kheap t) (ksPSpace t');\n ekheap_relation (ekheap t) (ksPSpace t');\n ghost_relation (kheap t) (gsUserPages t') (gsCNodes t'); valid_list s;\n pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s;\n pspace_aligned' t'; pspace_distinct' t';\n mdb_cte_at (swp (cte_wp_at (op \\ cap.NullCap)) s) (cdt s) \\\n \\ (t, t') \\ state_relation\"\n apply (clarsimp simp: state_relation_def)\n apply (intro conjI)\n apply (simp add: cdt_relation_def cte_wp_at_caps_of_state)\n apply (elim allEI)\n apply clarsimp\n apply (erule(1) across_null_filter_eq)\n apply simp\n apply (rule null_filter_descendants_of', simp)\n apply simp\n apply (case_tac \"cdt s (a, b)\")\n apply (subst mdb_cte_at_no_descendants, assumption)\n apply (simp add: cte_wp_at_caps_of_state swp_def)\n apply (cut_tac s=\"kheap_update f (ekheap_update ef s)\" and\n s'=\"s'\\ksPSpace := f' (ksPSpace s'),\n gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n in pspace_relation_ctes_ofI, simp_all)[1]\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n apply (erule caps_of_state_cteD)\n apply (clarsimp simp: descendants_of'_def)\n apply (case_tac cte)\n apply (erule Null_not_subtree[rotated])\n apply simp\n apply (drule(1) mdb_cte_atD)\n apply (clarsimp simp: cte_wp_at_caps_of_state)\n apply(simp add: cdt_list_relation_def cte_wp_at_caps_of_state)\n apply(elim allEI)\n apply(clarsimp)\n apply(case_tac \"next_slot (a, b) (cdt_list (s)) (cdt s)\")\n apply(simp)\n apply(subgoal_tac \"cte_wp_at (\\c. c \\ cap.NullCap) (a, b) s\")\n apply(drule_tac f=\"\\cs. cs (a, b)\" in arg_cong)\n apply(clarsimp simp: cte_wp_at_caps_of_state)\n apply(clarsimp simp: null_filter_def split: if_split_asm)\n apply(drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply(simp add: null_filter'_def cte_wp_at_ctes_of split: if_split_asm)\n apply(frule pspace_relation_cte_wp_at)\n apply(simp add: cte_wp_at_caps_of_state)\n apply(simp)\n apply(simp)\n apply(simp add: cte_wp_at_ctes_of)\n apply (simp add: mdb_cte_at_def)\n apply(frule finite_depth)\n apply(frule(3) cte_at_next_slot'')\n apply simp\n apply (simp add: revokable_relation_def)\n apply (elim allEI, rule impI, drule(1) mp, elim allEI) \n apply (clarsimp elim!: null_filterE)\n apply (drule(3) pspace_relation_cte_wp_at [OF _ caps_of_state_cteD])\n apply (drule_tac f=\"\\ctes. ctes (cte_map (a, b))\" in arg_cong)\n apply (clarsimp simp: null_filter'_def cte_wp_at_ctes_of\n split: if_split_asm)\n done\n\nlemma lookupAround2_pspace_no:\n \"is_aligned ptr sz \\\n (case fst (lookupAround2 (ptr + 2 ^ sz - 1) ps) of None \\ return ()\n | Some (x, y) \\ haskell_assert (x < fromPPtr ptr) [])\n = assert ({ptr..ptr + 2 ^ sz - 1} \\ dom ps = {})\"\n apply (simp add: assert_def split: option.split)\n apply safe\n apply (clarsimp simp: lookupAround2_None1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (clarsimp simp: lookupAround2_char1)\n apply (drule_tac a=a in equals0D)\n apply (simp add: linorder_not_less)\n apply fastforce\n done\n\nlemma pspace_no_overlap_disjoint':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s\\ \n \\ {x .. (x && ~~ mask n) + 2 ^ n - 1} \\ dom (ksPSpace s) = {}\"\n unfolding pspace_no_overlap'_def\n apply (rule disjointI)\n apply (rule ccontr)\n apply clarsimp\n apply (elim allE impE notE)\n apply (simp add:field_simps)+\n apply (erule(2) order_trans[OF _ is_aligned_no_overflow,OF _ pspace_alignedD'])\n apply (erule(1) is_aligned_no_overflow[OF pspace_alignedD'])\n apply (erule order_trans)\n apply (simp add:p_assoc_help)\ndone\n\nlemma foldr_update_ko_wp_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"ko_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then P obj\n else ko_wp_at' P p s)\"\n (is \"ko_wp_at' P p ?s' = ?Q\")\n apply (clarsimp simp: ko_wp_at'_def projectKOs al)\n apply (intro conjI impI)\n apply safe[1]\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n apply safe[1]\n apply (simp add: ps_clear_def dom_if_Some)\n apply blast\n apply simp\n apply (rule pspace_distinctD' [OF _ pv'(2)])\n apply simp\n done\n\nlemma foldr_update_obj_at':\n assumes pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n shows\n \"obj_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if p \\ set addrs then (\\obj'. projectKO_opt obj = Some obj' \\ P obj')\n else obj_at' P p s)\"\n apply (simp only: obj_at'_real_def)\n apply (rule foldr_update_ko_wp_at' [OF pv pv' al])\n done\n\nlemma makeObjectKO_eq:\n assumes x: \"makeObjectKO dev tp = Some v\"\n shows\n \"(v = KOCTE cte) =\n (tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ cte = makeObject)\"\n \"(v = KOTCB tcb) =\n (tp = Inr (APIObjectType ArchTypes_H.TCBObject) \\ tcb = makeObject)\"\n using x\n by (simp add: makeObjectKO_def eq_commute\n split: apiobject_type.split_asm sum.split_asm kernel_object.split_asm\n ARM_H.object_type.split_asm arch_kernel_object.split_asm)+\n\nlemma pspace_no_overlap_base':\n \"\\pspace_aligned' s;pspace_no_overlap' x n s; is_aligned x n \\ \\ ksPSpace s x = None\"\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule equals0D[where a=x])\n apply (rule ccontr, clarsimp)\n apply (erule is_aligned_get_word_bits)\n apply (erule impE)\n apply (frule mask_out_add_aligned[where q = 0,simplified,symmetric])\n apply (fastforce simp add: is_aligned_no_overflow)\n apply clarsimp+\n done\n\nlemma the_ctes_makeObject:\n \"fst (the (tcb_cte_cases n)) makeObject\n = (if tcb_cte_cases n = None\n then fst (the None :: (Structures_H.tcb \\ cte) \\ ((cte \\ cte) \\ Structures_H.tcb \\ Structures_H.tcb))\n (makeObject :: tcb)\n else makeObject)\"\n apply (simp add: makeObject_tcb)\n apply (clarsimp simp: tcb_cte_cases_def)\n done\n\nlemma cte_wp_at_obj_cases_mask:\n \"cte_wp_at' P p s =\n (obj_at' P p s \\\n (p && mask 9 \\ dom tcb_cte_cases\n \\ obj_at' (P \\ fst (the (tcb_cte_cases (p && mask 9))))\n (p && ~~ mask 9) s))\"\n apply (simp add: cte_wp_at_obj_cases')\n apply (rule arg_cong [where f=\"\\x. F \\ x\" for F])\n apply (rule iffI)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (frule(1) tcb_cte_cases_aligned_helpers)\n apply fastforce\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (rule bexI[where x=\"p && mask 9\"])\n apply (clarsimp simp: subtract_mask)\n apply fastforce\n done\n\nlemma ps_clearD:\n \"\\ ps_clear x n s; ksPSpace s y = Some v; x < y; y \\ x + 2 ^ n - 1 \\ \\ False\"\n apply (clarsimp simp: ps_clear_def)\n apply (drule_tac a=y in equals0D)\n apply (simp add: dom_def)\n apply fastforce\n done\n\nlemma cte_wp_at_retype':\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"cte_wp_at' P p (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\n = (if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ p \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (p && ~~ mask 9 \\ set addrs) \\ (p && mask 9 \\ dom tcb_cte_cases)\n then P (CTE NullCap nullMDBNode)\n else cte_wp_at' P p s)\"\n (is \"cte_wp_at' P p ?s' = ?Q\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: cte \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"\\p \\ set addrs. \\(P :: tcb \\ bool). \\ obj_at' P p s\")\n apply (subgoal_tac \"(\\P :: cte \\ bool. obj_at' P p ?s')\n \\ (\\ (\\P :: tcb \\ bool. obj_at' P (p && ~~ mask 9) ?s'))\")\n apply (simp only: cte_wp_at_obj_cases_mask foldr_update_obj_at'[OF pv pv' al])\n apply (simp add: projectKOs the_ctes_makeObject\n makeObjectKO_eq [OF ko]\n makeObject_cte dom_def\n split del: if_split\n cong: if_cong)\n apply (insert al ko)\n apply (simp, safe, simp_all)\n apply fastforce\n apply fastforce\n apply (clarsimp elim!: obj_atE' simp: projectKOs objBits_simps)\n apply (drule ps_clearD[where y=p and n=9])\n apply simp\n apply (rule order_trans_rules(17))\n apply (clarsimp cong: if_cong)\n apply (rule word_and_le2)\n apply (drule mask_in_range[where bits = 9 and ptr' = p])\n apply simp\n apply simp\n apply (clarsimp elim!: obj_atE' simp: pn)\n apply (clarsimp elim!: obj_atE' simp: pn)\n done\n\nlemma ctes_of_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"map_to_ctes (\\ xa. if xa \\ set addrs then Some obj else ksPSpace s xa)\n = (\\x. if tp = Inr (APIObjectType ArchTypes_H.CapTableObject) \\ x \\ set addrs\n \\ tp = Inr (APIObjectType ArchTypes_H.TCBObject)\n \\ (x && ~~ mask 9 \\ set addrs) \\ (x && mask 9 \\ dom tcb_cte_cases)\n then Some (CTE NullCap nullMDBNode)\n else map_to_ctes (ksPSpace s) x)\"\n (is \"map_to_ctes ?ps' = ?map'\")\n using cte_wp_at_retype' [where P=\"op = cte\" for cte, OF ko pv pv' al pn]\n arg_cong [where f=Not, OF cte_wp_at_retype' [OF ko pv pv' al pn, where P=\"\\\"]]\n apply (simp(no_asm_use) add: cte_wp_at_ctes_of cong: if_cong)\n apply (rule ext)\n apply (case_tac \"map_to_ctes ?ps' x\")\n apply (simp(no_asm_simp))\n apply (simp split: if_split_asm)\n apply simp\n done\n\nlemma None_ctes_of_cte_at:\n \"(None = ctes_of s x) = (\\ cte_at' x s)\"\n by (fastforce simp add: cte_wp_at_ctes_of)\n\nlemma null_filter_ctes_retype:\n assumes ko: \"makeObjectKO dev tp = Some obj\"\n and pv: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pv': \"pspace_aligned' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n \"pspace_distinct' (ksPSpace_update (\\x xa. if xa \\ set addrs then Some obj else ksPSpace s xa) s)\"\n and al: \"\\x \\ set addrs. is_aligned x (objBitsKO obj)\"\n and pn: \"\\x \\ set addrs. ksPSpace s x = None\"\n shows\n \"null_filter' (map_to_ctes (foldr (\\addr. data_map_insert addr obj) addrs (ksPSpace s)))\n = null_filter' (map_to_ctes (ksPSpace s))\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (subst ctes_of_retype[OF ko pv pv' al pn])\n apply (rule ext)\n apply (clarsimp simp: null_filter'_def None_ctes_of_cte_at)\n apply (intro conjI impI notI)\n apply (elim cte_wp_atE' disjE conjE)\n apply (simp_all add: pn)\n apply (cut_tac x=\"ptr'\" and v=\"if ptr' \\ set addrs then obj else KOTCB tcb\"\n in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (insert ko[symmetric],\n simp add: makeObjectKO_def objBits_simps pn\n split: if_split_asm)[1]\n apply (drule(2) tcb_ctes_clear[where s=\"ksPSpace_update f s\" for f s])\n apply simp\n apply fastforce\n apply (cut_tac x=\"x && ~~ mask 9\" in pspace_distinctD'[OF _ pv'(2)])[1]\n apply simp\n apply (elim cte_wp_atE' disjE conjE)\n apply (insert ko[symmetric], simp add: makeObjectKO_def objBits_simps)\n apply clarsimp\n apply (subst(asm) subtract_mask[symmetric],\n erule_tac v=\"if x \\ set addrs then KOTCB makeObject else KOCTE cte\"\n in tcb_space_clear)\n apply (simp add: is_aligned_mask word_bw_assocs)\n apply assumption\n apply simp\n apply simp\n apply (simp add: pn)\n apply (clarsimp simp: makeObjectKO_def)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (clarsimp simp: pn)\n done\n\nlemma new_cap_addrs_fold:\n \"0 < n \\ map (\\p. (ptr + (of_nat p << objBitsKO ko))) [0.e. n - 1 ] = new_cap_addrs n ptr ko\"\n by (simp add: new_cap_addrs_def)\n\nlemma new_cap_addrs_aligned:\n \"\\ is_aligned ptr (objBitsKO ko) \\\n \\ \\x \\ set (new_cap_addrs n ptr ko). is_aligned x (objBitsKO ko)\"\n apply (clarsimp simp: new_cap_addrs_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_shift])\n apply simp\n done\n\nlemma new_cap_addrs_distinct:\n assumes cover: \"range_cover ptr sz (objBitsKO ko) n\"\n shows \"distinct (new_cap_addrs n ptr ko)\"\n unfolding new_cap_addrs_def\n apply (simp add: distinct_map)\n apply (rule comp_inj_on[where f=of_nat, unfolded o_def])\n apply (rule subset_inj_on)\n apply (rule word_unat.Abs_inj_on)\n apply (clarsimp simp only: unats_def atLeastLessThan_iff\n dest!: less_two_pow_divD)\n apply (insert cover)\n apply (erule less_le_trans)\n apply (insert range_cover.range_cover_n_le[OF cover])\n apply (erule le_trans)\n apply (cases \"objBitsKO ko = 0\")\n apply (simp add:word_bits_def)\n apply (rule less_imp_le)\n apply (rule power_strict_increasing)\n apply (simp add:word_bits_def)\n apply simp\n apply (rule inj_onI)\n apply clarsimp\n apply (drule arg_cong[where f=\"\\x. x >> objBitsKO ko\"])\n apply (cases \"objBitsKO ko = 0\")\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply (subst(asm) shiftl_shiftr_id, simp add: range_cover_def)\n apply (subst word_unat_power, rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (simp add: word_bits_def)\n apply simp\n apply (erule order_less_le_trans)\n apply simp\n apply assumption\n done\n\nlemma captable_addrs_eq:\n assumes tyct: \"ty = Structures_A.CapTableObject\"\n and szv: \"sz < word_bits\"\n and usszv: \"us + cte_level_bits \\ sz\"\n and ctoko: \"objBitsKO ko = cte_level_bits\"\n and usnz: \"0 < us\"\n and amp: \"m = 2^ ((obj_bits_api ty us) - (objBitsKO ko)) * n\" \n and bound: \"n < 2 ^ (word_bits - us)\"\n shows\n \"(\\x \\ set (retype_addrs ptr ty n us). {cte_map (x, y) | y. length y = us})\n = set (new_cap_addrs m ptr ko)\"\nproof -\n have us_word_bits: \"us \\ word_bits\"\n using usszv szv by auto\n have n_word_bits_p2: \"n<2^word_bits\"\n apply (insert bound us_word_bits usnz)\n apply (erule less_trans)\n apply (simp add:nat_less_power_trans[OF bound us_word_bits] mult.commute)\n done\n show ?thesis\n apply (rule set_eqI)\n apply (rule iffI)\n apply (clarsimp simp:amp retype_addrs_def new_cap_addrs_def image_def)\n apply (rule_tac x = \"(xc * 2^length y) + unat (of_bl y::word32)\" in bexI)\n apply (clarsimp simp:ptr_add_def cte_map_def tyct usszv shiftl_t2n\n ctoko obj_bits_api_def cte_level_bits_def slot_bits_def power_add)+\n apply (rule iffD1[OF less_diff_iff])\n apply (rule le_add1)\n apply clarsimp+\n apply (rule less_le_trans[OF unat_of_bl_length])\n apply (simp add:mult.commute diff_mult_distrib[symmetric])\n apply (clarsimp simp: retype_addrs_def new_cap_addrs_def image_def cte_map_def amp simp del: Union_iff)\n apply (rule exI)\n apply (rule conjI)\n apply (rule_tac x = \"unat (((of_nat xa)::word32) >> (obj_bits_api ty us - objBitsKO ko))\" in bexI)\n apply simp\n apply simp\n apply (rule unat_less_helper)\n apply (case_tac \"n = 0\",simp+)\n apply (clarsimp simp:ptr_add_def word_less_nat_alt ctoko cte_level_bits_def field_simps word_size\n of_drop_to_bl tyct obj_bits_api_def slot_bits_def shiftr_div_2n'\n word_bits_def mask_twice mask_out_sub_mask)\n apply (insert n_word_bits_p2)\n apply (simp add:unat_of_nat32 n_word_bits_p2)\n apply (rule iffD1[OF td_gal_lt])\n apply simp+\n apply (subst unat_of_nat32)\n apply (erule less_trans)\n apply (simp add:nat_less_power_trans[OF bound us_word_bits] cong:mult.commute)\n apply simp\n apply (insert usszv usnz szv)\n apply (rule_tac x = \"drop (32-us) (to_bl (((of_nat xa)::word32) && mask us))\" in exI)\n apply (clarsimp simp:ptr_add_def ctoko cte_level_bits_def word_size\n of_drop_to_bl tyct obj_bits_api_def slot_bits_def\n word_bits_def mask_twice)\n apply (subst mult.commute[where b = \"2^(us+4)\"])\n apply (subst shiftl_t2n[symmetric])\n apply (subst shiftl_shiftl[symmetric])\n apply (subst and_not_mask[symmetric])\n apply (clarsimp simp:shiftl_t2n mask_out_sub_mask)+\n done\nqed\n\nlemma notcaptable_addrs_eq:\n assumes tyct: \"ty \\ Structures_A.CapTableObject\"\n and api: \"obj_bits_api ty us = objBitsKO ko\"\n and eqsize: \"m = n\"\n shows\n \"set (retype_addrs ptr ty n us) = set (new_cap_addrs m ptr ko)\"\n by (simp add: retype_addrs_def new_cap_addrs_def api ptr_add_def \n shiftl_t2n field_simps eqsize)\n\nlemma new_cap_addrs_subset:\n assumes range_cover:\"range_cover ptr sz (objBitsKO ko) n\"\n shows \"set (new_cap_addrs n ptr ko) \\ {ptr .. ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n apply (clarsimp simp add: new_cap_addrs_def shiftl_t2n\n field_simps\n dest!: less_two_pow_divD)\n apply (intro conjI)\n apply (insert range_cover)\n apply (rule machine_word_plus_mono_right_split[OF range_cover.range_cover_compare])\n apply assumption\n apply simp\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:ptr_add_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (drule(1) range_cover.range_cover_compare)\n apply (rule iffD1[OF le_m1_iff_lt,THEN iffD2])\n using range_cover\n apply (simp add: p2_gt_0 range_cover_def word_bits_def)\n apply (rule iffD2[OF word_less_nat_alt])\n apply (rule le_less_trans[OF unat_plus_gt])\n using range_cover\n apply (clarsimp simp: range_cover_def)\n apply (insert range_cover)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def)+\ndone\n\ndefinition\n obj_relation_retype :: \"Structures_A.kernel_object \\\n Structures_H.kernel_object \\ bool\"\nwhere\n \"obj_relation_retype ko ko' \\\n obj_bits ko \\ objBitsKO ko'\n \\ (\\p. fst ` obj_relation_cuts ko p\n = {p + x * 2 ^ (objBitsKO ko') | x. x < 2 ^ (obj_bits ko - objBitsKO ko')}\n \\ (\\x \\ obj_relation_cuts ko p. snd x ko ko'))\"\n\nlemma obj_relation_retype_cutsD:\n \"\\ (x, P) \\ obj_relation_cuts ko p; obj_relation_retype ko ko' \\\n \\ \\y. x = p + y * 2 ^ (objBitsKO ko') \\ y < 2 ^ (obj_bits ko - objBitsKO ko')\n \\ P ko ko'\"\n apply (clarsimp simp: obj_relation_retype_def)\n apply (drule spec[where x=p])\n apply clarsimp\n apply (drule(1) bspec)\n apply (drule arg_cong[where f=\"\\S. x \\ S\"])\n apply clarsimp\n apply (fastforce simp: image_def)\n done\n\nlemma APIType_map2_Untyped[simp]:\n \"(APIType_map2 tp = Structures_A.Untyped)\n = (tp = Inr (APIObjectType ArchTypes_H.Untyped))\"\n by (simp add: APIType_map2_def\n split: sum.split object_type.split kernel_object.split arch_kernel_object.splits\n apiobject_type.split)\n\nlemma obj_relation_retype_leD:\n \"\\ obj_relation_retype ko ko' \\\n \\ objBitsKO ko' \\ obj_bits ko\"\n by (simp add: obj_relation_retype_def)\n\nlemma obj_relation_retype_default_leD:\n \"\\ obj_relation_retype (default_object (APIType_map2 ty) dev us) ko;\n ty \\ Inr (APIObjectType ArchTypes_H.Untyped) \\\n \\ objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n by (simp add: obj_relation_retype_def objBits_def obj_bits_dev_irr)\n\nlemma makeObjectKO_Untyped:\n \"makeObjectKO dev ty = Some v \\ ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (clarsimp simp: makeObjectKO_def)\n\nlemma obj_relation_cuts_trivial:\n \"ptr \\ fst ` obj_relation_cuts x ptr\"\n apply (case_tac x)\n apply (rename_tac sz cs)\n apply (clarsimp simp:image_def cte_map_def well_formed_cnode_n_def)\n apply (rule_tac x = \"replicate sz False\" in exI)\n apply clarsimp+\n apply (rename_tac arch_kernel_obj)\n apply (case_tac arch_kernel_obj)\n apply clarsimp\n apply (simp_all add:image_def pageBits_def)\n apply (rule_tac x = 0 in exI, simp)+\n apply (rule p2_gt_0[THEN iffD2])\n apply (rename_tac vmpage_size)\n apply (case_tac vmpage_size)\n apply (clarsimp simp:pageBitsForSize_def)+\n done\n\nlemma obj_relation_retype_addrs_eq:\n assumes not_unt:\"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n assumes amp: \"m = 2^ ((obj_bits_api (APIType_map2 ty) us) - (objBitsKO ko)) * n\"\n assumes orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n shows \"\\ range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n \\ \\\n (\\x \\ set (retype_addrs ptr (APIType_map2 ty) n us).\n fst ` obj_relation_cuts (default_object (APIType_map2 ty) dev us) x)\n = set (new_cap_addrs m ptr ko)\"\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: retype_addrs_def)\n apply (drule obj_relation_retype_cutsD[OF _ orr])\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (clarsimp simp: new_cap_addrs_def image_def\n dest!: less_two_pow_divD)\n apply (rule_tac x=\"xa * 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) + unat y\"\n in rev_bexI)\n apply (simp add: amp obj_bits_api_default_object not_unt obj_bits_dev_irr)\n apply (rule less_le_trans[OF nat_add_left_cancel_less[THEN iffD2]])\n apply (erule unat_mono)\n apply (subst unat_power_lower)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def\n split: Structures_A.apiobject_type.splits)\n apply (simp add:field_simps,subst mult_Suc[symmetric])\n apply (rule mult_le_mono1)\n apply simp\n apply (simp add: ptr_add_def shiftl_t2n field_simps \n objBits_def[symmetric] word_unat_power[symmetric])\n apply (simp add: power_add[symmetric])\n apply (clarsimp simp: new_cap_addrs_def retype_addrs_def\n dest!: less_two_pow_divD)\n apply (cut_tac obj_relation_retype_default_leD[OF orr not_unt])\n apply (cut_tac obj_relation_retype_leD[OF orr])\n apply (case_tac \"n = 0\")\n apply (simp add:amp)\n apply (case_tac \"p = 0\")\n apply simp\n apply (rule_tac x = 0 in rev_bexI)\n apply simp+\n apply (rule obj_relation_cuts_trivial)\n apply (rule_tac x=\"p div (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko))\"\n in rev_bexI)\n apply (simp add:amp)\n apply (rule td_gal_lt[THEN iffD1])\n apply (simp add:field_simps)+\n using orr\n apply (clarsimp simp: obj_relation_retype_def ptr_add_def)\n apply (thin_tac \"\\x. P x\" for P)\n apply (rule_tac x=\"of_nat (p mod (2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko)))\" in exI)\n apply (simp only: word_unat_power Abs_fnat_homs shiftl_t2n)\n apply (rule conjI)\n apply (rule arg_cong[where f=of_nat])\n apply (subst mult_div_rearrange)\n apply simp\n apply (subst minus_mod_eq_mult_div[symmetric])\n apply (simp add:diff_mult_distrib2)\n apply (rule of_nat_mono_maybe)\n apply (rule power_strict_increasing)\n apply (rule le_less_trans[OF diff_le_self])\n apply (clarsimp simp: range_cover_def obj_bits_api_default_object obj_bits_dev_irr\n not_unt word_bits_def)+\ndone\n\nlemma objBits_le_obj_bits_api:\n \"makeObjectKO dev ty = Some ko \\\n objBitsKO ko \\ obj_bits_api (APIType_map2 ty) us\"\n apply (case_tac ty)\n apply (auto simp: default_arch_object_def pageBits_def archObjSize_def\n makeObjectKO_def objBitsKO_def APIType_map2_def obj_bits_api_def slot_bits_def\n split: Structures_H.kernel_object.splits arch_kernel_object.splits object_type.splits\n Structures_H.kernel_object.splits arch_kernel_object.splits apiobject_type.splits)\n done\n\n\nlemma obj_relation_retype_other_obj:\n \"\\ is_other_obj_relation_type (a_type ko); other_obj_relation ko ko' \\\n \\ obj_relation_retype ko ko'\"\n apply (simp add: obj_relation_retype_def)\n apply (subgoal_tac \"objBitsKO ko' = obj_bits ko\")\n apply (clarsimp simp: is_other_obj_relation_type)\n apply (fastforce simp: other_obj_relation_def objBits_simps archObjSize_def\n split: Structures_A.kernel_object.split_asm\n Structures_H.kernel_object.split_asm \n Structures_H.kernel_object.split \n arch_kernel_obj.split_asm arch_kernel_object.split)\n done\n\nlemma retype_pspace_relation:\n assumes sr: \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"pspace_relation (foldr (\\p ps. ps(p \\ default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"pspace_relation ?ps ?ps'\")\n unfolding pspace_relation_def\nproof\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n\n have dom_not_ra:\n \"\\x \\ dom (kheap s). x \\ set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply clarsimp\n apply (erule(1) pspace_no_overlapC[OF pn _ _ cover vs(1)])\n done\n\n hence dom_Int_ra:\n \"set (retype_addrs ptr (APIType_map2 ty) n us) \\ dom (kheap s) = {}\"\n by auto\n\n note pdom = pspace_dom_upd [OF dom_Int_ra, where ko=\"default_object (APIType_map2 ty) dev us\"]\n\n have pdom': \"dom ?ps' = dom (ksPSpace s') \\ set (new_cap_addrs m ptr ko)\"\n by (clarsimp simp add: foldr_upd_app_if[folded data_map_insert_def]\n dom_if_Some Un_commute\n split del: if_split)\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n\n have \"pspace_dom (kheap s) = dom (ksPSpace s')\"\n using sr by (simp add: pspace_relation_def)\n\n thus \"pspace_dom ?ps = dom ?ps'\"\n apply (simp add: pdom pdom')\n apply (rule arg_cong[where f=\"\\T. S \\ T\" for S])\n apply (rule obj_relation_retype_addrs_eq[OF not_unt num_r orr cover])\n done\n\n have dom_same:\n \"\\x v. kheap s x = Some v \\ ?ps x = Some v\"\n apply (frule bspec [OF dom_not_ra, OF domI])\n apply (simp add: foldr_upd_app_if)\n done\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have dom_same':\n \"\\x v. ksPSpace s' x = Some v \\ ?ps' x = Some v\"\n apply (clarsimp simp:foldr_upd_app_if[folded data_map_insert_def])\n apply (drule domI[where m = \"ksPSpace s'\"])\n apply (drule(1) IntI)\n apply (erule_tac A = \"A \\ B\" for A B in in_emptyE[rotated])\n apply (rule disjoint_subset[OF new_cap_addrs_subset[OF cover']])\n apply (clarsimp simp:ptr_add_def field_simps)\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n done\n\n show \"\\x \\ dom ?ps. \\(y, P) \\ obj_relation_cuts (the (?ps x)) x.\n P (the (?ps x)) (the (?ps' y))\"\n using sr\n apply (clarsimp simp: pspace_relation_def)\n apply (simp add: foldr_upd_app_if split: if_split_asm)\n apply (clarsimp simp: foldr_upd_app_if[folded data_map_insert_def])\n apply (rule conjI)\n apply (drule obj_relation_retype_cutsD [OF _ orr], clarsimp)\n apply (rule impI, erule notE)\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (erule rev_bexI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n apply (drule bspec, erule domI)\n apply clarsimp\n apply (drule(1) bspec, simp)\n apply (subgoal_tac \"a \\ pspace_dom (kheap s)\")\n apply clarsimp\n apply (frule dom_same', simp)\n apply (simp(no_asm) add: pspace_dom_def)\n apply (rule rev_bexI, erule domI)\n apply (simp add: image_def)\n apply (erule rev_bexI, simp)\n done\nqed\n\n\n(*Clagged from Retype_AC*)\nlemma foldr_upd_app_if': \"foldr (\\p ps. ps(p := f p)) as g = (\\x. if x \\ set as then (f x) else g x)\"\n apply (induct as)\n apply simp\n apply simp\n apply (rule ext)\n apply simp\n done\n\nlemma etcb_rel_makeObject: \"etcb_relation default_etcb makeObject\"\n apply (simp add: etcb_relation_def default_etcb_def)\n apply (simp add: makeObject_tcb default_priority_def default_domain_def\n time_slice_def timeSlice_def)\n done\n\n\nlemma ekh_at_tcb_at: \"valid_etcbs_2 ekh kh \\ ekh x = Some y \\ \\tcb. kh x = Some (TCB tcb)\"\n apply (simp add: valid_etcbs_2_def\n st_tcb_at_kh_def obj_at_kh_def\n is_etcb_at'_def obj_at_def)\n apply force\n done\n\nlemma default_etcb_default_domain_futz [simp]:\n \"default_etcb\\tcb_domain := default_domain\\ = default_etcb\"\nunfolding default_etcb_def by simp\n\nlemma retype_ekheap_relation:\n assumes sr: \"ekheap_relation (ekheap s) (ksPSpace s')\"\n and sr': \"pspace_relation (kheap s) (ksPSpace s')\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"ekheap_relation (foldr (\\p ps. ps(p := default_ext (APIType_map2 ty) default_domain))\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n (foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko) (ksPSpace s'))\"\n (is \"ekheap_relation ?ps ?ps'\")\n proof -\n have not_unt: \"ty \\ Inr (APIObjectType ArchTypes_H.Untyped)\"\n by (rule makeObjectKO_Untyped[OF ko])\n show ?thesis\n apply (case_tac \"ty \\ Inr (APIObjectType apiobject_type.TCBObject)\")\n apply (insert ko)\n apply (cut_tac retype_pspace_relation[OF sr' vs vs' pn pn' ko cover orr num_r])\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (insert sr)\n apply (clarsimp simp add: ekheap_relation_def \n pspace_relation_def default_ext_def cong: if_cong\n split: if_split_asm)\n subgoal by (clarsimp simp add: makeObjectKO_def APIType_map2_def cong: if_cong \n split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits ARM_H.object_type.splits apiobject_type.splits)\n\n apply (frule ekh_at_tcb_at[OF et])\n apply (intro impI conjI)\n apply clarsimp\n apply (drule_tac x=a in bspec,force)\n apply (clarsimp simp add: other_obj_relation_def split: if_split_asm)\n apply (case_tac ko,simp_all)\n apply (clarsimp simp add: makeObjectKO_def cong: if_cong split: sum.splits Structures_H.kernel_object.splits\n arch_kernel_object.splits ARM_H.object_type.splits\n apiobject_type.splits if_split_asm)\n apply (drule_tac x=xa in bspec,simp)\n subgoal by force\n subgoal by force\n apply (simp add: foldr_upd_app_if' foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: obj_relation_retype_addrs_eq[OF not_unt num_r orr cover,symmetric])\n apply (clarsimp simp add: APIType_map2_def default_ext_def ekheap_relation_def \n default_object_def makeObjectKO_def etcb_rel_makeObject\n cong: if_cong\n split: if_split_asm)\n apply force\n done\nqed\n\nlemma pspace_no_overlapD':\n \"\\ ksPSpace s x = Some ko; pspace_no_overlap' p bits s \\\n \\ {x .. x + 2 ^ objBitsKO ko - 1} \\ {p .. (p && ~~ mask bits) + 2 ^ bits - 1} = {}\"\n apply (simp add:pspace_no_overlap'_def)\n apply (intro impI)\n apply (elim allE impE)\n apply (simp add:field_simps)+\ndone\n\nlemma new_range_subset:\n assumes\n cover: \"range_cover ptr sz (objBitsKO ko) n\" \n and addr: \"x \\ set (new_cap_addrs n ptr ko)\"\n shows \"{x .. x + 2 ^ (objBitsKO ko) - 1} \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n (is \"?lhs \\ ?rhs\")\nproof -\n have base_in: \"x \\ {ptr..ptr_add (ptr && ~~ mask sz) (2 ^ sz - 1)}\"\n by (rule set_mp[OF new_cap_addrs_subset[OF cover] addr])\n have aligned: \"is_aligned x (objBitsKO ko)\"\n apply (insert cover)\n apply (clarsimp simp:range_cover_def)\n apply (drule new_cap_addrs_aligned)\n apply (erule bspec[OF _ addr])\n done\n show ?thesis using base_in aligned addr\n apply (intro range_subsetI)\n apply (clarsimp simp:ptr_add_def field_simps)+\n apply (simp add:x_power_minus_1)\n apply (clarsimp simp:new_cap_addrs_def)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n apply (simp add:mask_2pm1[symmetric])\n apply (rule iffD2[OF shiftr_mask_cmp[where c = \"objBitsKO ko\"]])\n apply (insert cover)\n apply (simp add:range_cover_def)\n apply (simp add:range_cover_def word_bits_def)\n apply (subst aligned_shift')\n apply (simp add:mask_lt_2pn range_cover_def word_bits_def )\n apply (drule is_aligned_addD1)\n apply (simp add:range_cover_def)\n apply (rule aligned_add_aligned)\n apply (rule aligned_already_mask)\n apply (fastforce simp:range_cover_def)\n apply (simp_all add:objBitsKO_bounded range_cover_def)[3]\n apply (subst shiftr_mask2[symmetric])\n apply (simp add:range_cover_def word_bits_def)\n apply (rule le_shiftr)\n apply (subst le_mask_iff_lt_2n[THEN iffD1])\n apply (simp add:range_cover_def word_bits_def)\n apply (clarsimp simp:word_less_nat_alt)\n apply (rule le_less_trans[OF unat_plus_gt])\n apply (frule(1) range_cover.range_cover_compare)\n apply (clarsimp simp:shiftl_t2n mult.commute range_cover_def)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask])\n apply (rule le_refl)\n apply (simp add:range_cover_def)\n done\nqed\n\nlemma retype_aligned_distinct':\n assumes vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (objBitsKO ko) n \" \n shows\n \"pspace_distinct' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n \"pspace_aligned' (s' \\ksPSpace := foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs n ptr ko) (ksPSpace s')\\)\"\n (is \"pspace_aligned' (s'\\ksPSpace := ?ps\\)\")\nproof -\n have al: \"is_aligned ptr (objBitsKO ko)\"\n using cover\n by (simp add:cover range_cover_def)\n let ?s' = \"s'\\ksPSpace := ?ps\\\"\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al]]\n note nc_al' = nc_al[unfolded objBits_def]\n\n show pa': \"pspace_aligned' ?s'\" using vs'(1)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (clarsimp simp add: pspace_aligned'_def nc_al'\n split: if_split_asm)\n apply (drule bspec, erule domI, simp)\n done\n\n have okov: \"objBitsKO ko < word_bits\"\n by (simp add: objBits_def)\n\n have new_range_disjoint:\n \"\\x. x \\ set (new_cap_addrs n ptr ko) \\\n ({x .. x + 2 ^ (objBitsKO ko) - 1} - {x}) \\ set (new_cap_addrs n ptr ko) = {}\"\n apply safe\n apply (rule ccontr)\n apply (frule(2) aligned_neq_into_no_overlap [OF _ nc_al nc_al])\n apply (drule_tac a=xa in equals0D)\n apply (clarsimp simp: field_simps is_aligned_no_overflow [OF nc_al])\n done\n note new_range_sub = new_range_subset [OF cover]\n\n show pd': \"pspace_distinct' ?s'\" using vs'(2)\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (simp add: pspace_distinct'_def dom_if_Some ball_Un)\n apply (intro conjI ballI impI)\n apply (simp add: ps_clear_def dom_if_Some Int_Un_distrib\n objBits_def[symmetric])\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (rule conjI)\n apply (erule new_range_disjoint)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule disjoint_subset[OF new_range_sub])\n apply (rule pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (clarsimp simp add: ps_clear_def dom_if_Some Int_Un_distrib)\n apply (subst Int_commute)\n apply (rule disjoint_subset[OF new_cap_addrs_subset,OF cover])\n apply (subst Int_commute)\n apply (simp add:ptr_add_def field_simps)\n apply (rule disjoint_subset[OF Diff_subset])\n apply (erule pspace_no_overlapD' [OF _ pn'])\n done\nqed\n\ndefinition\n update_gs :: \"Structures_A.apiobject_type \\ nat \\ word32 set\n \\ 'a kernel_state_scheme \\ 'a kernel_state_scheme\"\nwhere\n \"update_gs ty us ptrs \\\n case ty of\n Structures_A.CapTableObject \\ gsCNodes_update\n (\\cns x. if x \\ ptrs then Some us else cns x)\n | ArchObject (SmallPageObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSmallPage else ups x)\n | ArchObject (LargePageObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMLargePage else ups x)\n | ArchObject (SectionObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSection else ups x)\n | ArchObject (SuperSectionObj) \\ gsUserPages_update\n (\\ups x. if x \\ ptrs then Some ARMSuperSection else ups x)\n | _ \\ id\"\n\nlemma update_gs_empty[simp]: \"update_gs tp us {} = id\"\n by (auto simp: update_gs_def ext\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nlemma ksPSpace_update_gs_eq[simp]:\n \"ksPSpace (update_gs ty us ptrs s) = ksPSpace s\"\n by (simp add: update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nend\n\nglobal_interpretation update_gs: PSpace_update_eq \"update_gs ty us ptrs\"\n by (simp add: PSpace_update_eq_def)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nlemma update_gs_id:\n \"tp \\ no_gs_types \\ update_gs tp us addrs = id\"\n by (simp add: no_gs_types_def update_gs_def\n split: Structures_A.apiobject_type.splits aobject_type.splits)\n\nlemma update_gs_simps[simp]:\n \"update_gs Structures_A.apiobject_type.CapTableObject us ptrs =\n gsCNodes_update (\\cns x. if x \\ ptrs then Some us else cns x)\"\n \"update_gs (ArchObject SmallPageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSmallPage else ups x)\"\n \"update_gs (ArchObject LargePageObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMLargePage else ups x)\"\n \"update_gs (ArchObject SectionObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSection else ups x)\"\n \"update_gs (ArchObject SuperSectionObj) us ptrs =\n gsUserPages_update (\\ups x. if x \\ ptrs then Some ARMSuperSection\n else ups x)\"\n by (simp_all add: update_gs_def)\n\nlemma caps_of_state_kheap_ekheap[simp]: \"caps_of_state (kheap_update f (ekheap_update ef s)) =\n caps_of_state (kheap_update f s)\"\n apply (simp add: trans_state_update[symmetric] del: trans_state_update)\n done\n\nlemma retype_state_relation:\n notes data_map_insert_def[simp del]\n assumes sr: \"(s, s') \\ state_relation\"\n and vs: \"valid_pspace s\" \"valid_mdb s\"\n and et: \"valid_etcbs s\" \"valid_list s\"\n and vs': \"pspace_aligned' s'\" \"pspace_distinct' s'\"\n and pn: \"pspace_no_overlap_range_cover ptr sz s\"\n and pn': \"pspace_no_overlap' ptr sz s'\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and api: \"obj_bits_api (APIType_map2 ty) us \\ sz\"\n and orr: \"obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and num_r: \"m = 2 ^ (obj_bits_api (APIType_map2 ty) us - objBitsKO ko) * n\"\n shows\n \"(ekheap_update\n (\\_. foldr (\\p ekh a. if a = p then default_ext (APIType_map2 ty) default_domain else ekh a)\n (retype_addrs ptr (APIType_map2 ty) n us) (ekheap s))\n s\n \\kheap :=\n foldr (\\p. data_map_insert p (default_object (APIType_map2 ty) dev us))\n (retype_addrs ptr (APIType_map2 ty) n us) (kheap s)\\,\n update_gs (APIType_map2 ty) us (set (retype_addrs ptr (APIType_map2 ty) n us))\n (s'\\ksPSpace :=\n foldr (\\addr. data_map_insert addr ko) (new_cap_addrs m ptr ko)\n (ksPSpace s')\\))\n \\ state_relation\"\n (is \"(ekheap_update (\\_. ?eps) s\\kheap := ?ps\\, update_gs _ _ _ (s'\\ksPSpace := ?ps'\\))\n \\ state_relation\")\n proof (rule state_relation_null_filterE[OF sr refl _ _ _ _ _ _ _ vs'], simp_all add: trans_state_update[symmetric] del: trans_state_update)\n\n have cover':\"range_cover ptr sz (objBitsKO ko) m\"\n by (rule range_cover_rel[OF cover objBits_le_obj_bits_api[OF ko] num_r])\n have al':\"is_aligned ptr (objBitsKO ko)\"\n using cover'\n by (simp add:range_cover_def)\n have sz:\"sz < word_bits\"\n using cover'\n by (simp add:range_cover_def word_bits_def)\n let ?t = \"s\\kheap := ?ps\\\"\n let ?tp = \"APIType_map2 ty\"\n let ?al = \"retype_addrs ptr ?tp n us\"\n let ?t' = \"update_gs ?tp us (set ?al) (s'\\ksPSpace := ?ps'\\)\"\n\n note pad' = retype_aligned_distinct' [OF vs' pn' cover']\n thus pa': \"pspace_aligned' (s'\\ksPSpace := ?ps'\\)\"\n and pd': \"pspace_distinct' (s'\\ksPSpace := ?ps'\\)\"\n by simp_all\n\n note pa'' = pa'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n note pd'' = pd'[simplified foldr_upd_app_if[folded data_map_insert_def]]\n\n note not_unt = makeObjectKO_Untyped [OF ko]\n show \"null_filter (caps_of_state ?t) = null_filter (caps_of_state s)\"\n apply (rule null_filter_caps_of_state_foldr[folded data_map_insert_def])\n apply (simp add: not_unt)\n apply (rule ballI)\n apply (erule pspace_no_overlapD2 [OF pn _ cover vs(1)])\n done\n\n have nc_dis: \"distinct (new_cap_addrs m ptr ko)\"\n by (rule new_cap_addrs_distinct [OF cover'])\n\n note nc_al = bspec [OF new_cap_addrs_aligned [OF al']]\n note nc_al' = nc_al[unfolded objBits_def]\n show \"null_filter' (map_to_ctes ?ps') = null_filter' (ctes_of s')\"\n apply (rule null_filter_ctes_retype [OF ko vs' pa'' pd''])\n apply (simp add: nc_al)\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint'[OF vs'(1) pn'])\n apply (drule orthD1)\n apply (simp add:ptr_add_def field_simps)\n apply clarsimp\n done\n\n show \"valid_objs s\" using vs\n by (clarsimp simp: valid_pspace_def)\n\n show \"valid_mdb s\" using vs\n by (clarsimp)\n\n show \"valid_list s\" using et\n by (clarsimp)\n\n show \"mdb_cte_at (swp (cte_wp_at (op \\ cap.NullCap)) s) (cdt s)\" using vs\n by (clarsimp simp: valid_mdb_def)\n\n have pspr: \"pspace_relation (kheap s) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"pspace_relation ?ps ?ps'\"\n by (rule retype_pspace_relation [OF _ vs vs' pn pn' ko cover orr num_r,\n folded data_map_insert_def])\n\n have \"ekheap_relation (ekheap (s)) (ksPSpace s')\"\n using sr by (simp add: state_relation_def)\n\n thus \"ekheap_relation ?eps ?ps'\"\n by (fold fun_upd_apply) (rule retype_ekheap_relation[OF _ pspr vs et(1) vs' pn pn' ko cover orr num_r])\n\n have pn2: \"\\a\\set ?al. kheap s a = None\"\n by (rule ccontr) (clarsimp simp: pspace_no_overlapD1[OF pn _ cover vs(1)])\n\n from sr have gr: \"ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')\"\n by (rule state_relationE)\n\n show \"ghost_relation ?ps (gsUserPages ?t') (gsCNodes ?t')\"\n proof (cases ?tp)\n case Untyped thus ?thesis by (simp add: not_unt)\n next\n note data_map_insert_def[simp]\n \n case TCBObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def TCBObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def TCBObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap, simp add: TCBObject update_gs_def)\n next\n case EndpointObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: ups_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al),\n simp_all add: cns_of_heap_def default_object_def data_map_insert_def EndpointObject)\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: EndpointObject update_gs_def)\n next\n note data_map_insert_def[simp]\n case NotificationObject\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def NotificationObject)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def\n default_object_def NotificationObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: NotificationObject update_gs_def)\n next\n case CapTableObject\n note data_map_insert_def[simp]\n from pn2\n have [simp]: \"ups_of_heap ?ps = ups_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: ups_of_heap_def\n default_object_def CapTableObject)\n have [simp]: \"cns_of_heap ?ps = (\\x. if x \\ set ?al then Some us\n else cns_of_heap (kheap s) x)\"\n by (rule ext, induct (?al),\n simp_all add: cns_of_heap_def wf_empty_bits wf_unique default_object_def CapTableObject)\n note data_map_insert_def[simp del]\n from gr show ?thesis\n by (simp add: ghost_relation_of_heap,\n simp add: CapTableObject update_gs_def ext)\n next\n case (ArchObject ao)\n from pn2\n have [simp]: \"cns_of_heap ?ps = cns_of_heap (kheap s)\"\n by - (rule ext, induct (?al), simp_all add: cns_of_heap_def data_map_insert_def\n default_object_def ArchObject)\n from pn2 gr show ?thesis\n apply (clarsimp simp add: ghost_relation_of_heap)\n apply (rule conjI[rotated])\n apply (simp add: ArchObject update_gs_def split: aobject_type.splits)\n apply (thin_tac \"cns_of_heap h = g\" for h g)\n apply (drule sym)\n apply (rule ext)\n apply (induct (?al))\n apply (simp add: update_gs_def ArchObject split: aobject_type.splits)\n apply (simp add: update_gs_def ArchObject default_object_def\n default_arch_object_def ups_of_heap_def\n data_map_insert_def\n split: aobject_type.splits)\n done\n qed\n\n show \"\\f' g' h'. ?t' =\n s'\\ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),\n gsCNodes := h' (gsCNodes s')\\\"\n apply (clarsimp simp: update_gs_def\n split: Structures_A.apiobject_type.splits)\n apply (intro conjI impI)\n apply (subst ex_comm, rule_tac x=id in exI,\n subst ex_comm, rule_tac x=id in exI, fastforce)+\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (subst ex_comm)\n apply (rule_tac x=\"\\cns x. if x\\set ?al then Some us else cns x\" in exI,\n simp)\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI, simp)\n apply clarsimp\n apply (rule_tac x=\"\\x. foldr (\\addr. data_map_insert addr ko)\n (new_cap_addrs m ptr ko) x\" in exI)\n apply (subst ex_comm, rule_tac x=id in exI)\n apply (simp split: aobject_type.splits)\n apply (intro conjI impI)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSmallPage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMLargePage\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSection\n else cns x\" in exI, simp)\n apply (rule_tac x=\"\\cns x. if x \\ set ?al then Some ARMSuperSection\n else cns x\" in exI, simp)\n apply (rule_tac x=id in exI, simp)+\n done\nqed\n\nlemma new_cap_addrs_fold':\n \"1 \\ n \\\n map (\\n. ptr + (n << objBitsKO ko)) [0.e.n - 1] =\n new_cap_addrs (unat n) ptr ko\"\n by (clarsimp simp:new_cap_addrs_def ptr_add_def upto_enum_red' \n shiftl_t2n power_add field_simps)\n\nlemma objBitsKO_bounded_low: \"0 < objBitsKO ko\"\n apply (case_tac ko)\n apply (simp_all add:objBitsKO_def pageBits_def)\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object)\n apply (simp_all add:archObjSize_def pageBits_def)\n done\n\nlemma kheap_ekheap_double_gets: \"(\\rv erv rv'. pspace_relation rv rv' \\ ekheap_relation erv rv' \\ corres r (R rv erv) (R' rv') (b rv erv) (d rv')) \\\ncorres r (\\s. R (kheap s) (ekheap s) s) (\\s. R' (ksPSpace s) s) (do x \\ gets kheap; xa \\ gets ekheap; b x xa od) (gets ksPSpace >>= d)\"\n apply (rule corres_symb_exec_l)\n apply (rule corres_guard_imp)\n apply (rule_tac r'= \"\\erv rv'. ekheap_relation erv rv' \\ pspace_relation x rv'\" in corres_split)\n apply clarsimp\n apply assumption\n apply (subst corres_gets[where P=\"\\s. x = kheap s\" and P'=\\])\n apply clarsimp\n apply (simp add: state_relation_def)\n apply (wp gets_exs_valid | simp)+\n done\n\n(*\n\nSplit out the extended operation that sets the etcb domains.\n\nThis allows the existing corres proofs in this file to more-or-less go\nthrough as they stand.\n\nA more principled fix would be to change the abstract spec and\ngeneralise init_arch_objects to initialise other object types.\n\n*)\n\ndefinition retype_region2_ext :: \"obj_ref list \\ Structures_A.apiobject_type \\ unit det_ext_monad\" where\n \"retype_region2_ext ptrs type \\ modify (\\s. ekheap_update (foldr (\\p ekh. (ekh(p := default_ext type default_domain))) ptrs) s)\"\n\ncrunch all_but_exst[wp]: retype_region2_ext \"all_but_exst P\"\ncrunch (empty_fail) empty_fail[wp]: retype_region2_ext\n\nend\n\ninterpretation retype_region2_ext_extended: is_extended \"retype_region2_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n \"retype_region2_extra_ext ptrs type \\\n when (type = Structures_A.TCBObject) (do\n cdom \\ gets cur_domain;\n mapM_x (ethread_set (\\tcb. tcb\\tcb_domain := cdom\\)) ptrs\n od)\"\n\ncrunch all_but_exst[wp]: retype_region2_extra_ext \"all_but_exst P\" (wp: mapM_x_wp)\ncrunch (empty_fail) empty_fail[wp]: retype_region2_extra_ext (wp: mapM_x_wp)\n\nend\n\ninterpretation retype_region2_extra_ext_extended: is_extended \"retype_region2_extra_ext ptrs type\"\n by (unfold_locales; wp)\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\ndefinition\n retype_region2 :: \"obj_ref \\ nat \\ nat \\ Structures_A.apiobject_type \\ bool \\ (obj_ref list,'z::state_ext) s_monad\"\nwhere\n \"retype_region2 ptr numObjects o_bits type dev \\ do\n obj_size \\ return $ 2 ^ obj_bits_api type o_bits;\n ptrs \\ return $ map (\\p. ptr_add ptr (p * obj_size)) [0..< numObjects];\n when (type \\ Structures_A.Untyped) (do\n kh \\ gets kheap;\n kh' \\ return $ foldr (\\p kh. kh(p \\ default_object type dev o_bits)) ptrs kh;\n do_extended_op (retype_region2_ext ptrs type);\n modify $ kheap_update (K kh')\n od);\n return $ ptrs\n od\"\n\n(* FIXME move *)\nlemma oblivious_mapM_x:\n \"\\x\\set xs. oblivious f (g x) \\ oblivious f (mapM_x g xs)\"\nby (induct xs) (auto simp: mapM_x_Nil mapM_x_Cons oblivious_bind)\n\nlemma retype_region_ext_modify_kheap_futz:\n \"(retype_region2_extra_ext ptrs type :: (unit, det_ext) s_monad) >>= (\\_. modify (kheap_update f))\n = (modify (kheap_update f) >>= (\\_. retype_region2_extra_ext ptrs type))\"\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (subst oblivious_modify_swap)\n defer\n apply (simp add: bind_assoc)\n apply (rule oblivious_bind)\n apply simp\n apply (rule oblivious_mapM_x)\n apply (clarsimp simp: ethread_set_def set_eobject_def)\n apply (rule oblivious_bind)\n apply (simp add: gets_the_def)\n apply (rule oblivious_bind)\n apply (clarsimp simp: get_etcb_def)\n apply simp\n apply (simp add: modify_def[symmetric])\ndone\n\nlemmas retype_region_ext_modify_kheap_futz' = fun_cong[OF arg_cong[where f=bind, OF retype_region_ext_modify_kheap_futz[symmetric]], simplified bind_assoc]\n\nlemma foldr_upd_app_if_eta_futz:\n \"foldr (\\p ps. ps(p \\ f p)) as = (\\g x. if x \\ set as then Some (f x) else g x)\"\napply (rule ext)\napply (rule foldr_upd_app_if)\ndone\n\nlemma modify_ekheap_update_comp_futz:\n \"modify (ekheap_update (f \\ g)) = modify (ekheap_update g) >>= (K (modify (ekheap_update f)))\"\nby (simp add: o_def modify_def bind_def gets_def get_def put_def)\n\nlemma mapM_x_modify_futz:\n assumes \"\\ptr\\set ptrs. ekheap s ptr \\ None\"\n shows \"mapM_x (ethread_set F) (rev ptrs) s\n = modify (ekheap_update (foldr (\\p ekh. ekh(p := Some (F (the (ekh p))))) ptrs)) s\" (is \"?lhs ptrs s = ?rhs ptrs s\")\nusing assms\nproof(induct ptrs arbitrary: s)\n case Nil thus ?case by (simp add: mapM_x_Nil return_def simpler_modify_def)\nnext\n case (Cons ptr ptrs s)\n have \"?rhs (ptr # ptrs) s\n = (do modify (ekheap_update (foldr (\\p ekh. ekh(p \\ F (the (ekh p)))) ptrs));\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n by (simp only: foldr_Cons modify_ekheap_update_comp_futz) simp\n also have \"... = (do ?lhs ptrs;\n modify (ekheap_update (\\ekh. ekh(ptr \\ F (the (ekh ptr)))))\n od) s\"\n apply (rule monad_eq_split_tail)\n apply simp\n apply (rule Cons.hyps[symmetric])\n using Cons.prems\n apply force\n done\n also have \"... = ?lhs (ptr # ptrs) s\"\n apply (simp add: mapM_x_append mapM_x_singleton)\n apply (rule monad_eq_split2[OF refl, where\n P=\"\\s. \\ptr\\set (ptr # ptrs). ekheap s ptr \\ None\"\n and Q=\"\\_ s. ekheap s ptr \\ None\"])\n apply (simp add: ethread_set_def\n assert_opt_def get_etcb_def gets_the_def gets_def get_def modify_def put_def set_eobject_def\n bind_def fail_def return_def split_def\n split: option.splits)\n apply ((wp mapM_x_wp[OF _ subset_refl] | simp add: ethread_set_def set_eobject_def)+)[1]\n using Cons.prems\n apply force\n done\n finally show ?case by (rule sym)\nqed\n\nlemma awkward_fold_futz:\n \"fold (\\p ekh. ekh(p \\ the (ekh p)\\tcb_domain := cur_domain s\\)) ptrs ekh\n = (\\x. if x \\ set ptrs then Some ((the (ekh x))\\tcb_domain := cur_domain s\\) else ekh x)\"\nby (induct ptrs arbitrary: ekh) (simp_all add: fun_eq_iff)\n\nlemma retype_region2_ext_retype_region_ext_futz:\n \"retype_region2_ext ptrs type >>= (\\_. retype_region2_extra_ext ptrs type)\n = retype_region_ext ptrs type\"\nproof(cases type)\n case TCBObject\n have complete_futz:\n \"\\F x. modify (ekheap_update (\\_. F (cur_domain x) (ekheap x))) x = modify (ekheap_update (\\ekh. F (cur_domain x) ekh)) x\"\n by (simp add: modify_def get_def get_etcb_def put_def bind_def return_def)\n have second_futz:\n \"\\f G.\n do modify (ekheap_update f);\n cdom \\ gets (\\s. cur_domain s);\n G cdom\n od =\n do cdom \\ gets (\\s. cur_domain s);\n modify (ekheap_update f);\n G cdom\n od\"\n by (simp add: bind_def gets_def get_def return_def simpler_modify_def)\n from TCBObject show ?thesis\n apply (clarsimp simp: retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def when_def bind_assoc)\n apply (clarsimp simp: exec_gets fun_eq_iff)\n apply (subst complete_futz)\n apply (simp add: second_futz[simplified] exec_gets)\n apply (simp add: default_ext_def exec_modify)\n apply (subst mapM_x_modify_futz[where ptrs=\"rev ptrs\", simplified])\n apply (simp add: foldr_upd_app_if_eta_futz)\n apply (simp add: modify_def exec_get put_def o_def)\n apply (simp add: foldr_upd_app_if_eta_futz foldr_conv_fold awkward_fold_futz)\n apply (simp cong: if_cong)\n done\nqed (auto simp: fun_eq_iff retype_region_ext_def retype_region2_ext_def retype_region2_extra_ext_def\n put_def gets_def get_def bind_def return_def mk_ef_def modify_def foldr_upd_app_if' when_def default_ext_def)\n\nlemma retype_region2_ext_retype_region:\n \"(retype_region ptr numObjects o_bits type dev :: (obj_ref list, det_ext) s_monad)\n = (do ptrs \\ retype_region2 ptr numObjects o_bits type dev;\n retype_region2_extra_ext ptrs type;\n return ptrs\n od)\"\napply (clarsimp simp: retype_region_def retype_region2_def when_def bind_assoc)\n apply safe\n defer\n apply (simp add: retype_region2_extra_ext_def)\napply (subst retype_region_ext_modify_kheap_futz'[simplified bind_assoc])\napply (subst retype_region2_ext_retype_region_ext_futz[symmetric])\napply (simp add: bind_assoc)\ndone\n\n(* FIXME move *)\nlemma gets_gets:\n \"(gets x >>= (\\a. gets x >>= F a)) = (gets x >>= (\\a. F a a))\"\nby (simp add: gets_def get_def bind_def return_def split_def)\n\nlemma getObject_tcb_gets:\n \"getObject addr >>= (\\x::tcb. gets proj >>= (\\y. G x y))\n = gets proj >>= (\\y. getObject addr >>= (\\x. G x y))\"\nby (auto simp: exec_gets fun_eq_iff intro: bind_apply_cong dest!: in_inv_by_hoareD[OF getObject_inv_tcb])\n\nlemma setObject_tcb_gets_ksCurDomain:\n \"setObject addr (tcb::tcb) >>= (\\_. gets ksCurDomain >>= G)\n = gets ksCurDomain >>= (\\x. setObject addr tcb >>= (\\_. G x))\"\napply (clarsimp simp: exec_gets fun_eq_iff)\napply (rule bind_apply_cong)\n apply simp\napply (drule_tac P1=\"\\cdom. cdom = ksCurDomain x\" in use_valid[OF _ setObject_cd_inv])\napply (simp_all add: exec_gets)\ndone\n\nlemma curDomain_mapM_x_futz:\n \"curDomain >>= (\\cdom. mapM_x (threadSet (F cdom)) addrs)\n = mapM_x (\\addr. curDomain >>= (\\cdom. threadSet (F cdom) addr)) addrs\"\nproof(induct addrs)\n case Nil thus ?case\n by (simp add: curDomain_def mapM_x_def sequence_x_def bind_def gets_def get_def return_def)\nnext\n case (Cons addr addrs)\n have H: \"\\G. do cdom \\ curDomain;\n _ \\ threadSet (F cdom) addr;\n G cdom\n od\n = do cdom \\ curDomain;\n threadSet (F cdom) addr;\n cdom \\ curDomain;\n G cdom\n od\"\n by (simp add: bind_assoc curDomain_def threadSet_def setObject_tcb_gets_ksCurDomain getObject_tcb_gets gets_gets)\n from Cons.hyps show ?case\n apply (simp add: mapM_x_def sequence_x_def)\n apply (simp add: bind_assoc foldr_map o_def)\n apply (subst H)\n apply (simp add: mapM_x_def sequence_x_def)\n done\nqed\n\n(*\n\nThe existing proof continues below.\n\n*)\n\nlemma modify_ekheap_update_ekheap:\n \"modify (\\s. ekheap_update f s) = do s \\ gets ekheap; modify (\\s'. s'\\ekheap := f s\\) od\"\nby (simp add: modify_def gets_def get_def put_def bind_def return_def split_def fun_eq_iff)\n\nlemma corres_retype':\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"(sz < obj_bits_api (APIType_map2 ty) us)\n = (sz < objBitsKO ko + gbits)\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\" \n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (update_gs (APIType_map2 ty) us (set addrs));\n return (g addrs) od)\"\n (is \"corres ?r ?P ?P' ?C ?A\")\nproof -\n note data_map_insert_def[simp del]\n have not_zero':\"((of_nat n)::word32) \\ 0\"\n by (rule range_cover_not_zero[OF not_zero cover])\n have shiftr_not_zero:\" ((of_nat n)::word32) << gbits \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_zero cover])\n apply (simp add:obj_bits_api)\n done\n have unat_of_nat_shift:\"unat (((of_nat n)::word32) << gbits) =\n (n * 2^ gbits)\"\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_shift':\n \"unat (((of_nat n)::word32) * 2^(gbits + objBitsKO ko)) =\n n * 2^(gbits + objBitsKO ko)\"\n apply (subst mult.commute)\n apply (simp add:shiftl_t2n[symmetric])\n apply (rule range_cover.unat_of_nat_n_shift[OF cover])\n using obj_bits_api\n apply simp\n done\n have unat_of_nat_n':\n \"unat (((of_nat n)::word32) * 2 ^ (gbits + objBitsKO ko)) \\ 0\"\n by (simp add:unat_of_nat_shift' not_zero)\n have bound:\"obj_bits_api (APIType_map2 ty) us \\ sz\"\n using cover\n by (simp add:range_cover_def)\n have n_estimate: \"n < 2 ^ (word_bits - (objBitsKO ko + gbits))\"\n apply (rule le_less_trans)\n apply (rule range_cover.range_cover_n_le(2)[OF cover])\n apply (rule power_strict_increasing)\n apply (simp add:obj_bits_api ko)\n apply (rule diff_less_mono)\n using cover obj_bits_api\n apply (simp_all add:range_cover_def ko word_bits_def)\n done\n\n have set_retype_addrs_fold:\n \"image (\\n. ptr + 2 ^ obj_bits_api (APIType_map2 ty) us * n)\n {x. x \\ of_nat n - 1} =\n set (retype_addrs ptr (APIType_map2 ty) n us)\"\n apply (clarsimp simp: retype_addrs_def image_def Bex_def ptr_add_def\n Collect_eq)\n apply (rule iffI)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"unat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover]\n not_le not_zero\n split: if_split_asm)\n apply (clarsimp simp: field_simps word_le_nat_alt)\n apply (rule_tac x=\"of_nat x\" in exI)\n apply (simp add: unat_sub_if_size range_cover.unat_of_nat_n[OF cover])\n apply (rule nat_le_Suc_less_imp)\n apply (metis le_unat_uoi nat_less_le not_le_imp_less)\n done\n\n have new_caps_adds_fold:\n \"map (\\n. ptr + 2 ^ objBitsKO ko * n) [0.e.2 ^ gbits * of_nat n - 1] =\n new_cap_addrs (2 ^ gbits * n) ptr ko\"\n apply (simp add: new_cap_addrs_def shiftl_t2n)\n apply (subgoal_tac \"1 \\ (2::word32) ^ gbits * of_nat n\")\n apply (simp add: upto_enum_red' o_def)\n apply (rule arg_cong2[where f=map, OF refl])\n apply (rule arg_cong2[where f=upt, OF refl])\n apply (metis mult.commute shiftl_t2n unat_of_nat_shift)\n using shiftr_not_zero\n apply (simp add: shiftl_t2n)\n apply (metis word_less_1 word_not_le)\n done\n\n from aligned\n have al': \"is_aligned ptr (obj_bits_api (APIType_map2 ty) us)\"\n by (simp add: obj_bits_api ko)\n show ?thesis\n apply (simp add: when_def retype_region2_def createObjects'_def\n createObjects_def aligned obj_bits_api[symmetric]\n ko[symmetric] al' shiftl_t2n data_map_insert_def[symmetric]\n is_aligned_mask[symmetric] split_def unless_def\n lookupAround2_pspace_no check\n split del: if_split)\n apply (subst retype_addrs_fold)+\n apply (subst if_P)\n using ko\n apply (clarsimp simp: makeObjectKO_def)\n apply (simp add: bind_assoc retype_region2_ext_def)\n apply (rule corres_guard_imp)\n apply (subst modify_ekheap_update_ekheap)\n apply (simp only: bind_assoc)\n apply (rule kheap_ekheap_double_gets)\n apply (rule corres_symb_exec_r)\n apply (simp add: not_less modify_modify bind_assoc[symmetric]\n obj_bits_api[symmetric] shiftl_t2n upto_enum_red'\n range_cover.unat_of_nat_n[OF cover])\n apply (rule corres_split_nor[OF corres_trivial])\n apply (clarsimp simp: retype_addrs_fold[symmetric]\n ptr_add_def upto_enum_red' not_zero'\n range_cover.unat_of_nat_n[OF cover] word_le_sub1)\n apply (rule_tac f=g in arg_cong)\n apply clarsimp\n apply (rename_tac x eps ps)\n apply (rule_tac P=\"\\s. x = kheap s \\ eps = ekheap (s) \\ ?P s\" and\n P'=\"\\s. ps = ksPSpace s \\ ?P' s\" in corres_modify)\n apply (simp add: set_retype_addrs_fold new_caps_adds_fold)\n apply (erule retype_state_relation[OF _ _ _ _ _ _ _ _ _ cover _ _ orr],\n simp_all add: ko not_zero obj_bits_api\n bound[simplified obj_bits_api ko])[1]\n apply wp+\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply (clarsimp|wp)+\n apply (clarsimp split: option.splits)\n apply wpsimp\n apply (clarsimp split: option.splits)\n apply (intro conjI impI)\n apply wp\n apply (clarsimp simp:lookupAround2_char1)\n apply wp\n apply (clarsimp simp: obj_bits_api ko)\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (rule_tac x1 = a in ccontr[OF in_empty_interE])\n apply simp\n apply (clarsimp simp: not_less shiftL_nat)\n apply (erule order_trans)\n apply (subst p_assoc_help)\n apply (subst word_plus_and_or_coroll2[symmetric,where w = \"mask sz\"])\n apply (subst add.commute)\n apply (subst add.assoc)\n apply (rule word_plus_mono_right)\n using cover\n apply -\n apply (rule iffD2[OF word_le_nat_alt])\n apply (subst word_of_nat_minus)\n using not_zero\n apply simp\n apply (rule le_trans[OF unat_plus_gt])\n apply simp\n apply (subst unat_minus_one)\n apply (subst mult.commute)\n apply (rule word_power_nonzero_32)\n apply (rule of_nat_less_pow_32[OF n_estimate])\n apply (simp add:word_bits_def objBitsKO_bounded_low ko)\n apply (simp add:range_cover_def obj_bits_api ko word_bits_def)\n apply (cut_tac not_zero',clarsimp simp:ko)\n apply(clarsimp simp:field_simps ko)\n apply (subst unat_sub[OF word_1_le_power])\n apply (simp add:range_cover_def)\n apply (subst diff_add_assoc[symmetric])\n apply (cut_tac unat_of_nat_n',simp add:ko)\n apply (clarsimp simp: obj_bits_api ko)\n apply (rule diff_le_mono)\n apply (frule range_cover.range_cover_compare_bound)\n apply (cut_tac obj_bits_api unat_of_nat_shift')\n apply (clarsimp simp:add.commute range_cover_def ko)\n apply (rule is_aligned_no_wrap'[OF is_aligned_neg_mask,OF le_refl ])\n apply (simp add:range_cover_def domI)+\n done\nqed\n\nlemma createObjects_corres':\n \"\\corres r P P' f (createObjects a b ko d); ko = injectKO val\\\n \\ corres dc P P' f (createObjects' a b ko d)\"\n apply (clarsimp simp:corres_underlying_def createObjects_def return_def)\n apply (rule conjI)\n apply (clarsimp simp:bind_def split_def)\n apply (drule(1) bspec)\n apply (clarsimp simp:image_def)\n apply (drule(1) bspec)\n apply clarsimp\n apply (erule bexI[rotated])\n apply simp\n apply (clarsimp simp:bind_def split_def image_def)\n apply (drule(1) bspec|clarsimp)+\n done\n\nlemmas retype_aligned_distinct'' = retype_aligned_distinct'\n [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\nlemma retype_ko_wp_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"ko_wp_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then P obj\n else ko_wp_at' P p s)\"\n apply (subst foldr_upd_app_if[folded data_map_insert_def])\n apply (rule foldr_update_ko_wp_at' [OF vs])\n apply (simp add: retype_aligned_distinct'' [OF vs pn cover])+\n apply (rule new_cap_addrs_aligned)\n using cover\n apply (simp add:range_cover_def cover)\n done\n\nlemma retype_obj_at':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (if p \\ set (new_cap_addrs n ptr obj) then (\\ko. projectKO_opt obj = Some ko \\ P ko)\n else obj_at' P p s)\"\n unfolding obj_at'_real_def\n apply (rule retype_ko_wp_at'[OF vs pn cover])\ndone\n\nlemma retype_obj_at_disj':\n assumes vs: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pn: \"pspace_no_overlap' ptr sz s\"\n and cover: \"range_cover ptr sz (objBitsKO obj) n\"\n shows\n \"obj_at' P p (s \\ksPSpace := foldr (\\addr. data_map_insert addr obj)\n (new_cap_addrs n ptr obj) (ksPSpace s)\\)\n = (obj_at' P p s \\ p \\ set (new_cap_addrs n ptr obj)\n \\ (\\ko. projectKO_opt obj = Some ko \\ P ko))\"\n apply (simp add: retype_obj_at' [OF vs pn cover])\n apply (safe, simp_all)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover]])\n apply (insert pspace_no_overlap_disjoint' [OF vs(1) pn ])\n apply (clarsimp simp: obj_at'_def)\n apply (rule_tac x1 = p in ccontr[OF in_empty_interE])\n apply (simp add:ptr_add_def p_assoc_help domI)+\n done\n\ndeclare word_unat_power[symmetric,simp]\n\nlemma createObjects_ko_at_strg:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"\\s. projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\ \n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\nproof -\n have shiftr_not_zero:\" 1 \\ ((of_nat n)::word32) << gbits\"\n using range_cover_not_zero_shift[OF not_0 cover,where gbits = gbits]\n apply -\n apply (simp add:word_le_sub1)\n done\n note unat_of_nat_shiftl = range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified]\n have in_new:\"\\idx offs. \\idx \\ of_nat n - 1;offs<2 ^ gbits\\\n \\ ptr + (idx << objBitsKO ko + gbits) + (offs << objBitsKO ko)\n \\ set (new_cap_addrs (n * 2 ^ gbits) ptr ko)\"\n apply (insert range_cover_not_zero[OF not_0 cover] not_0)\n apply (clarsimp simp:new_cap_addrs_def image_def)\n apply (rule_tac x =\"unat (2 ^ gbits * idx + offs)\" in bexI)\n apply (subst add.commute)\n apply (simp add:shiftl_shiftl[symmetric])\n apply (simp add:shiftl_t2n distrib_left[symmetric])\n apply simp\n apply (rule unat_less_helper)\n apply (rule less_le_trans)\n apply (erule word_plus_strict_mono_right)\n apply (subst distrib_left[where c = \"1 :: 32 word\",symmetric,simplified])\n apply (subst mult.commute[where a = \"2^gbits\"])+\n apply (insert cover)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply (erule order_trans[OF _ word_sub_1_le])\n apply (simp add:range_cover_not_zero[OF not_0 cover])\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(1)])\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper[OF inc_le])\n apply (simp add:minus_one_helper5)\n apply (simp add:word_bits_def)\n apply (rule no_plus_overflow_neg)\n apply (rule less_le_trans[where y = \"of_nat n\"])\n apply unat_arith\n using range_cover.range_cover_n_less[OF cover]\n apply (simp add:word_bits_def)\n apply (subst distrib_left[where c = \"1 :: 32 word\",symmetric,simplified])\n apply (subst mult.commute)\n apply simp\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (simp add:p2_gt_0)\n apply (simp add:range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (rule range_cover.range_cover_le_n_less)\n apply simp\n apply (subst unat_power_lower)\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (simp add:field_simps)\n apply (rule unat_le_helper)\n apply unat_arith\n apply (simp add:word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"objBitsKO ko \"])\n apply simp\n apply simp\n apply (rule less_le_trans)\n apply (erule range_cover.range_cover_le_n_less)\n apply (simp add:range_cover.unat_of_nat_n[OF cover])\n apply (simp add: unat_le_helper)\n apply (simp add:word_bits_def)\n apply unat_arith\n done\n show ?thesis\n apply (simp add: split_def createObjects_def lookupAround2_pspace_no\n alignError_def unless_def createObjects'_def)\n apply (rule hoare_pre)\n apply (wp|simp add:data_map_insert_def[symmetric]\n cong: if_cong del: fun_upd_apply data_map_insert_def)+\n apply (wpc|wp|clarsimp simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold'[OF shiftr_not_zero])+\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n apply (subst retype_obj_at_disj')\n apply (simp add:valid_pspace'_def unat_of_nat_shiftl)+\n apply (rule range_cover_rel[OF cover])\n apply simp+\n using range_cover.unat_of_nat_n_shift[OF cover,where gbits = gbits,simplified] pi\n apply (simp add: in_new)\n done\nqed\n\nlemma createObjects_ko_at:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n assumes not_0: \"n\\ 0\"\n assumes pi: \"projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\ \n createObjects ptr n ko gbits\n \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\n by (wp createObjects_ko_at_strg[OF cover not_0 pi],fastforce)\n\nlemma createObjects_obj_at:\n fixes ptr :: word32 and val :: \"'a :: pspace_storable\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + gbits) n\"\n and not_0:\"n \\ 0\" \n and pi: \"\\(val::'a). projectKO_opt ko = Some val\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\ \n createObjects ptr n ko gbits \\\\r s. \\x \\ set r. \\offs < 2 ^ gbits.\n obj_at' (\\(x::'a). True) (x + (offs << objBitsKO ko)) s\\\"\n apply (rule exE[OF pi])\n apply (erule_tac val1 = x in \n hoare_post_imp [OF _ createObjects_ko_at [OF cover not_0 ],rotated])\n apply (intro allI ballI impI)\n apply (drule(1) bspec)\n apply (drule spec, drule(1) mp)\n apply (clarsimp elim!: obj_at'_weakenE)\n done\n\n(* until we figure out what we really need of page\n mappings it's just alignment, which, fortunately,\n is trivial *)\nlemma createObjects_aligned:\n assumes al: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and bound :\"n < 2 ^ word_bits\" \"n\\0\"\n and bound':\"objBitsKO ko + gbits < word_bits\"\n shows \"\\\\\\ createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x (objBitsKO ko + gbits)\\\"\n apply (rule hoare_strengthen_post)\n apply (rule createObjects_ret[OF bound])\n apply (clarsimp dest!: less_two_pow_divD)\n apply (rule is_aligned_ptr_add_helper[OF al])\n apply (simp_all add:bound')\n done\n\nlemma createObjects_aligned2:\n \"\\\\s. is_aligned ptr (objBitsKO ko + gbits) \\ n < 2 ^ word_bits \\ n \\ 0\n \\ aln < word_bits\n \\ aln = objBitsKO ko + gbits\\\n createObjects ptr n ko gbits\n \\\\rv s. \\x \\ set rv. is_aligned x aln\\\"\n apply (rule hoare_name_pre_state)\n apply simp\n apply (rule hoare_pre, wp createObjects_aligned, simp_all)\n done\n\nlemma range_cover_n_wb:\n \"range_cover (ptr :: obj_ref) sz us n \\ n < 2 ^ word_bits\"\n apply (rule order_le_less_trans, erule range_cover.range_cover_n_le(2))\n apply (clarsimp simp: range_cover_def)\n apply (simp add: word_bits_def)\n done\n\nlemma createObjects_nonzero:\n assumes not_0: \"n \\ 0\"\n assumes cover:\"range_cover ptr sz ((objBitsKO ko) + bits) n\"\n shows \"\\\\s. ptr \\ 0\\\n createObjects ptr n ko bits\n \\\\rv s. \\p \\ set rv. p \\ 0\\\"\n apply (insert not_0)\n apply (rule hoare_pre)\n apply (rule hoare_gen_asm [where P = \"ptr \\ 0\"])\n using cover\n apply (clarsimp simp:range_cover_def)\n apply (erule is_aligned_get_word_bits,simp_all)\n apply (rule hoare_post_imp [OF _ createObjects_ret])\n apply (simp add: ptr_add_def)\n apply (intro allI impI ballI)\n apply (simp add:power_add[symmetric] mult.assoc)\n apply (drule(1) range_cover_no_0[OF _ cover])\n apply (simp add: objBits_def)\n apply (simp add: range_cover_n_wb[OF cover])\n apply simp\n done\n\nlemma injectKO_dev: \n \"(if dev then KOUserDataDevice else KOUserData) = (if dev then (injectKO UserDataDevice)\n else (injectKO UserData))\"\n by simp\n\nlemma objBits_if_dev:\n \"objBitsKO (if dev then KOUserDataDevice else KOUserData) = pageBits\"\n by (simp add: objBitsKO_def)\n\nlemma cwo_ret:\n assumes cover:\"range_cover ptr sz v n\"\n assumes not_0:\"n\\ 0\"\n shows result: \"\\pspace_no_overlap' ptr sz and valid_pspace' and K (v = 12 + bs)\\ \n createObjects ptr n (if dev then KOUserDataDevice else KOUserData) bs \n \\\\rv s. \\x\\set rv. \\p<2 ^ (v - pageBits).\n typ_at' (if dev then UserDataDeviceT else UserDataT) (x + p * 2 ^ pageBits) s\\\"\nproof -\n note create_objs_device = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserDataDevice,simplified]]]\n\n note create_objs_normal = hoare_post_imp [OF _ hoare_conj [OF createObjects_ret\n createObjects_ko_at[where val = UserData,simplified]]]\n\nshow ?thesis\n apply (cases dev)\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (rule create_objs_device)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n apply (rule hoare_gen_asm[unfolded K_def])\n apply (rule hoare_pre)\n apply (rule create_objs_normal)\n apply (clarsimp simp add: pageBits_def)\n apply (drule bspec, simp, drule spec, drule(1) mp)\n apply (simp add: typ_at'_def obj_at'_real_def objBits_simps pageBits_def shiftl_t2n field_simps)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp add: projectKO_opts_defs split: kernel_object.splits)\n apply (rule le_less_trans[OF _ power_strict_increasing])\n apply (rule range_cover.range_cover_n_le(1)[OF cover])\n apply (simp add: word_bits_def pageBits_def not_0)+\n apply (rule range_cover_rel[OF cover])\n apply (simp add: objBitsKO_def pageBits_def not_0)+\n using not_0 apply simp_all\n apply (clarsimp simp add: projectKO_def return_def\n projectKO_opts_defs split: kernel_object.splits)\n done\nqed\nlemmas capFreeIndex_update_valid_untyped' = \n capFreeIndex_update_valid_cap'[unfolded valid_cap'_def,simplified,THEN conjunct2,THEN conjunct1]\n\nlemma createNewCaps_valid_cap:\n fixes ptr :: word32\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n \"\n assumes not_0: \"n \\ 0\"\n assumes ct: \"ty = APIObjectType ArchTypes_H.CapTableObject \\ 0 < us\"\n \"ty = APIObjectType apiobject_type.Untyped \\ 4 \\ us \\ us \\ 29\"\n assumes ptr: \" ptr \\ 0\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createNewCaps ty ptr n us dev\n \\\\r s. (\\cap \\ set r. s \\' cap)\\\"\nproof -\n note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex\n note if_split_def[split del] = if_splits\n\n show ?thesis\n proof(cases \"Types_H.toAPIType ty\")\n case None thus ?thesis\n including no_pre\n using not_0\n apply (clarsimp simp: createNewCaps_def Arch_createNewCaps_def)\n apply wp\n using cover\n apply (simp add: range_cover_def)\n using cover\n apply (clarsimp simp: ARM_H.toAPIType_def APIType_capBits_def \n split: ARM_H.object_type.splits)\n\n -- \"SmallPageObject\"\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n -- \"LargePageObject\"\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n -- \"SectionObject\"\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n -- \"SuperSectionObject\"\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits\n ball_conj_distrib)\n apply (wp createObjects_aligned2 createObjects_nonzero[OF not_0 ,simplified]\n cwo_ret[OF _ not_0]\n | simp add: objBits_if_dev pageBits_def ptr range_cover_n_wb)+\n apply (simp add:pageBits_def ptr word_bits_def)\n\n -- \"PageTableObject\"\n apply wp\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_table_at'_def\n typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (simp add:objBits_simps archObjSize_def ptBits_def pageBits_def)+\n apply (simp add:range_cover_def word_bits_def)\n apply (rule createObjects_obj_at[where 'a =pte, OF _ not_0])\n apply (simp add:objBits_simps archObjSize_def ptBits_def pageBits_def)+\n apply (simp add: projectKOs projectKO_opt_pte )\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def ptBits_def pageBits_def)\n -- \"PageDirectoryObject\"\n apply (wp hoare_vcg_const_Ball_lift)\n apply (wp mapM_x_wp' )\n apply (simp add: valid_cap'_def capAligned_def n_less_word_bits)\n apply (simp only: imp_conv_disj page_directory_at'_def\n typ_at_to_obj_at_arches)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ range_cover.range_cover_n_less(1)\n [where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (simp add:objBits_simps archObjSize_def ptBits_def pageBits_def pdBits_def)+\n apply (simp add:range_cover_def word_bits_def)\n apply (rule createObjects_obj_at [where 'a=pde, OF _ not_0])\n apply (simp add:objBits_simps archObjSize_def ptBits_def pageBits_def pdBits_def)\n apply (simp add: projectKOs projectKO_opt_pde)\n apply simp\n apply (clarsimp simp: objBits_simps archObjSize_def pdBits_def pageBits_def)\n done\n next\n case (Some a) thus ?thesis\n proof(cases a)\n case Untyped with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_H.toAPIType_def fromIntegral_def\n toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_H.object_type.splits)\n apply wp\n apply (intro ballI)\n apply (clarsimp simp: image_def upto_enum_red' valid_cap'_def capAligned_def\n split: capability.splits)\n apply (drule minus_one_helper5[rotated])\n apply (rule range_cover_not_zero[OF not_0 cover])\n apply (intro conjI)\n apply (rule is_aligned_add_multI[OF _ le_refl refl])\n apply (fastforce simp:range_cover_def word_bits_def)+\n apply (clarsimp simp:valid_untyped'_def ko_wp_at'_def obj_range'_def)\n apply (drule(1) pspace_no_overlapD'[rotated])\n apply (frule(1) range_cover_cell_subset)\n apply (erule disjE)\n apply (drule psubset_imp_subset)\n apply (drule(1) disjoint_subset2[rotated])\n apply (drule(1) disjoint_subset)\n apply (drule(1) range_cover_subset_not_empty)\n apply clarsimp+\n apply blast\n apply (drule(1) range_cover_no_0[OF ptr _ unat_less_helper])\n apply simp\n done\n next\n case TCBObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_H.toAPIType_def \n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def curDomain_def\n split: ARM_H.object_type.splits)\n apply (wp mapM_x_wp' hoare_vcg_const_Ball_lift)+\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a = \"tcb\",OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_H.toAPIType_def APIType_capBits_def objBits_simps \n split: ARM_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_tcbI)\n done\n next\n case EndpointObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_H.toAPIType_def \n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=endpoint, OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_H.toAPIType_def APIType_capBits_def objBits_simps \n split: ARM_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_epI)\n done\n next\n case NotificationObject with Some cover ct show ?thesis\n including no_pre\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_H.toAPIType_def \n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_H.object_type.splits)\n apply wp\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule createObjects_obj_at [where 'a=\"notification\", OF _ not_0])\n using cover\n apply (clarsimp simp: ARM_H.toAPIType_def APIType_capBits_def objBits_simps \n split: ARM_H.object_type.splits)\n apply (simp add: projectKOs)\n apply (clarsimp simp: valid_cap'_def objBits_simps)\n apply (fastforce intro: capAligned_ntfnI)\n done\n next\n case CapTableObject with Some cover ct show ?thesis\n apply (clarsimp simp: Arch_createNewCaps_def createNewCaps_def)\n apply (simp_all add: ARM_H.toAPIType_def \n fromIntegral_def toInteger_nat fromInteger_nat APIType_capBits_def\n split: ARM_H.object_type.splits)\n apply wp\n apply (clarsimp simp: ARM_H.toAPIType_def APIType_capBits_def objBits_simps \n split: ARM_H.object_type.split object_type.splits)\n apply (rule hoare_strengthen_post)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_aligned [OF _ _ not_0 ])\n apply ((clarsimp simp:objBits_simps range_cover_def range_cover.range_cover_n_less[where 'a=32, unfolded word_bits_len_of, OF cover])+)[3]\n apply (simp add: word_bits_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret [OF range_cover.range_cover_n_less(1)[where 'a=32, unfolded word_bits_len_of, OF cover] not_0])\n apply (rule createObjects_obj_at [where 'a=cte, OF _ not_0])\n apply (simp add: objBits_simps APIType_capBits_def)\n apply (simp add: projectKOs)\n apply simp\n apply (clarsimp simp: valid_cap'_def capAligned_def objBits_simps\n dest!: less_two_pow_divD)\n apply (thin_tac \"\\x\\S. is_aligned (p x) n\" for S p n)\n apply (intro conjI)\n apply ((simp add:range_cover_def word_bits_def)+)[2]\n apply (clarsimp simp: power_sub)\n apply (drule bspec, simp)\n apply (drule_tac x = \"addr && mask us\" in spec)\n apply (drule mp)\n apply simp\n apply (rule and_mask_less')\n apply (simp add: range_cover_def word_bits_def)\n apply (clarsimp simp add: shiftl_t2n)\n apply simp\n done\n qed\n qed\nqed\n\nlemma createNewCaps_CapTable_ret:\n \"\\sz < word_bits;n < 2 ^ word_bits; n \\ 0\\ \\\n \\\\\\ \n createNewCaps (fromAPIType apiobject_type.CapTableObject) ptr n us dev\n \\\\r s. r = map (\\p. capability.CNodeCap (ptr + (of_nat p << us + 4)) us 0 0)\n [0 ..< n]\\\"\n unfolding createNewCaps_def fun_app_def\n apply simp\n apply (rule hoare_wp_splits(1) [OF _ createObjects_ret])\n apply wp\n apply (simp add: objBits_simps o_def\n shiftl_t2n ptr_add_def power_add\n mult.commute mult.left_commute)\n apply simp+\n done\n\nlemma other_objs_default_relation:\n \"\\ case ty of Structures_A.EndpointObject \\ ko = injectKO (makeObject :: endpoint)\n | Structures_A.NotificationObject \\ ko = injectKO (makeObject :: Structures_H.notification)\n | Structures_A.TCBObject \\ ko = injectKO (makeObject :: tcb) \n | _ \\ False \\ \\\n obj_relation_retype (default_object ty dev n) ko\"\n apply (rule obj_relation_retype_other_obj)\n apply (clarsimp simp: default_object_def a_type_def\n is_other_obj_relation_type_def\n split: Structures_A.apiobject_type.split_asm)\n apply (clarsimp simp: other_obj_relation_def default_object_def\n ep_relation_def ntfn_relation_def\n tcb_relation_def default_tcb_def makeObject_tcb\n makeObject_cte new_context_def newContext_def\n default_ep_def makeObject_endpoint default_notification_def\n makeObject_notification default_ntfn_def\n fault_rel_optionation_def\n initContext_def\n arch_tcb_context_get_def atcbContextGet_def\n default_arch_tcb_def newArchTCB_def\n arch_tcb_relation_def\n split: Structures_A.apiobject_type.split_asm)\n done\n\nlemma captable_relation_retype:\n \"n < word_bits \\\n obj_relation_retype (default_object Structures_A.CapTableObject dev n) (KOCTE makeObject)\"\n apply (clarsimp simp: obj_relation_retype_def default_object_def \n wf_empty_bits objBits_simps obj_bits.simps\n dom_empty_cnode ex_with_length cte_level_bits_def)\n apply (rule conjI)\n defer\n apply (clarsimp simp: cte_relation_def empty_cnode_def makeObject_cte)\n apply (rule set_eqI, rule iffI)\n apply (clarsimp simp: cte_map_def)\n apply (rule_tac x=\"of_bl y\" in exI)\n apply (simp add: of_bl_length[where 'a=32, folded word_bits_def])\n apply (clarsimp simp: image_def cte_map_def)\n apply (rule_tac x=\"drop (word_bits - n) (to_bl xa)\" in exI)\n apply (simp add: of_drop_to_bl word_bits_def word_size)\n apply (simp add: less_mask_eq)\n done\n\nlemma pagetable_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageTableObj) dev n)\n (KOArch (KOPTE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pte obj_relation_retype_def\n objBits_simps archObjSize_def\n pte_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp:pte_relation_aligned_def)\n done\n\nlemma pagedirectory_relation_retype:\n \"obj_relation_retype (default_object (ArchObject PageDirectoryObj) dev n)\n (KOArch (KOPDE makeObject))\"\n apply (simp add: default_object_def default_arch_object_def\n makeObject_pde obj_relation_retype_def\n objBits_simps archObjSize_def\n pde_relation_def)\n apply (clarsimp simp: range_composition[symmetric]\n shiftl_t2n field_simps)\n apply (subst image_comp [symmetric, where g=ucast, unfolded o_def])\n apply (simp add: ucast_range_less)\n apply (fastforce simp:pde_relation_aligned_def)\n done\n\nlemmas makeObjectKO_simps = makeObjectKO_def[split_simps ARM_H.object_type.split\n apiobject_type.split sum.split kernel_object.split ]\n\nlemma corres_retype:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us = objBitsKO ko + gbits\"\n and tp: \"APIType_map2 ty \\ no_gs_types\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n shows \"corres (op =)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s \n \\ (\\val. ko = injectKO val))\n (retype_region2 ptr n us (APIType_map2 ty) dev) (createObjects ptr n ko gbits)\"\n apply (rule corres_guard_imp)\n apply (rule_tac F = \"(\\val. ko = injectKO val)\" in corres_gen_asm2)\n apply (erule exE)\n apply (rule corres_rel_imp)\n apply (rule corres_retype'[where g=id and ty=ty and sz = sz,OF not_zero aligned _ _ _ ko\n ,simplified update_gs_id[OF tp] modify_id_return,simplified])\n using assms\n apply (simp_all add: objBits_def no_gs_types_def)\n apply auto\n done\n\nlemma init_arch_objects_APIType_map2:\n \"init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs =\n (case ty of APIObjectType _ \\ return ()\n | _ \\ init_arch_objects (APIType_map2 (Inr ty)) ptr bits sz refs)\"\n apply (clarsimp split: ARM_H.object_type.split)\n apply (simp add: init_arch_objects_def APIType_map2_def\n split: apiobject_type.split)\n done\n\nlemma pde_relation_aligned_eq:\n \"\\is_aligned (pd::word32) 6; is_aligned pd' 6\\\n \\ pde_relation_aligned (pd + x >> 2) xa ya =\n pde_relation_aligned (pd' + x >> 2) xa ya\"\n apply (clarsimp simp: pde_relation_aligned_def is_aligned_mask mask_def\n split: ARM_H.pde.splits)\n apply word_bitwise\n apply auto\n done\n\nlemma copy_global_corres:\n \"corres dc (valid_arch_state and valid_etcbs and pspace_aligned and page_directory_at pd)\n (valid_arch_state' and page_directory_at' pd)\n (copy_global_mappings pd)\n (copyGlobalMappings pd)\"\n apply (simp add: copy_global_mappings_def\n copyGlobalMappings_def\n objBits_simps archObjSize_def\n pd_bits_def pdBits_def mapM_x_mapM)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (rule_tac F =\"is_aligned pd 6 \\ is_aligned global_pd 6\" in corres_gen_asm)\n apply (simp add: liftM_def[symmetric])\n apply (rule_tac S=\"op =\" and r'=dc\n and Q=\"\\xs s. \\x \\ set xs. pde_at (global_pd + (x << 2)) s\n \\ pde_at (pd + (x << 2)) s \\ pspace_aligned s \\\n valid_etcbs s\"\n and Q'=\"\\xs s. \\x \\ set xs. pde_at' (global_pd + (x << 2)) s\n \\ pde_at' (pd + (x << 2)) s\"\n in corres_mapM_list_all2, simp+)\n apply (rule corres_guard_imp, rule corres_split)\n apply (erule store_pde_corres)\n apply (rule corres_rel_imp)\n apply (rule_tac get_pde_corres)\n apply clarsimp\n apply (drule(1) pde_relation_aligned_eq)\n apply fastforce\n apply (wp hoare_vcg_const_Ball_lift | simp)+\n apply (simp add: kernel_base_def ARM.kernelBase_def kernelBase_def list_all2_refl)\n apply (rule corres_trivial, clarsimp simp: state_relation_def arch_state_relation_def)\n apply wp+\n apply (clarsimp simp: valid_arch_state_def)\n apply (auto elim: page_directory_pde_atI is_aligned_weaken[OF pd_aligned])[1]\n apply (clarsimp simp: valid_arch_state'_def)\n apply (auto elim: page_directory_pde_atI')\n done\n\n(* FIXME: move *)\nlemma copyGlobalMappings_cte_wp_at[wp]:\n \"\\\\s. P (cte_wp_at' P' p s)\\\n copyGlobalMappings pd\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: copyGlobalMappings_def)\n apply (wp mapM_x_wp')\n done\n\nlemma copyGlobalMappings_obj_at':\n \"\\koType TYPE('a) \\ ArchT PDET \\\n \\ \\obj_at' (P :: ('a :: pspace_storable) \\ bool) p\\\n copyGlobalMappings pd\n \\\\ya. obj_at' P p\\\"\n apply (simp add: copyGlobalMappings_def)\n apply (wp mapM_x_wp')\n apply (simp add: storePDE_def)\n apply (wp obj_at_setObject2)\n apply (clarsimp simp: updateObject_default_def in_monad)\n apply wp+\n apply simp\n done\n\ncrunch ct[wp]: copyGlobalMappings \"\\s. P (ksCurThread s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp'\n ignore: forM_x getObject setObject)\n\ncrunch ksCurDomain[wp]: copyGlobalMappings \"\\s. P (ksCurDomain s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp'\n ignore: forM_x getObject setObject)\n\nlemmas copyGlobalMappings_ctes_of[wp]\n = ctes_of_from_cte_wp_at[where Q=\"\\\", simplified,\n OF copyGlobalMappings_cte_wp_at]\n\nlemmas object_splits =\n apiobject_type.split_asm\n ARM_H.object_type.split_asm\n sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n\nlemma ksMachineState_update_gs[simp]:\n \"ksMachineState (update_gs tp us addrs s) = ksMachineState s\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\nlemma update_gs_ksMachineState_update_swap:\n \"update_gs tp us addrs (ksMachineState_update f s) =\n ksMachineState_update f (update_gs tp us addrs s)\"\n by (simp add: update_gs_def\n split: aobject_type.splits Structures_A.apiobject_type.splits)\n\nlemma doMachineOp_update_gs_swap:\n \"do _ \\ (unless dev $ doMachineOp mop); modify (update_gs tp us addrs) od =\n do _ \\ modify (update_gs tp us addrs); (unless dev $ doMachineOp mop) od\"\n by (rule ext) (auto simp add: simpler_modify_def doMachineOp_def\n simpler_gets_def select_f_def split_def bind_assoc bind_def\n return_def update_gs_ksMachineState_update_swap unless_def when_def)\n\ndeclare hoare_in_monad_post[wp del]\ndeclare univ_get_wp[wp del]\ndeclare result_in_set_wp[wp del]\n\nlemma makeObjectKO_user_data:\n \"makeObjectKO False (Inr ty) = Some KOUserData\n \\ obj_relation_retype (default_object (APIType_map2 (Inr ty)) False us) KOUserData\"\n apply (case_tac ty)\n apply (simp_all add: makeObjectKO_simps)\n apply (case_tac x1)\n apply (simp_all add: makeObjectKO_simps obj_relation_retype_def \n objBitsKO_simps APIType_map2_def default_object_def\n arch_kobj_size_def default_arch_object_def\n image_Collect)\n apply (auto simp: pageBits_def)\n done\n\n\nlemma makeObjectKO_user_data_device:\n \"makeObjectKO True (Inr ty) = Some KOUserDataDevice\n \\ obj_relation_retype (default_object (APIType_map2 (Inr ty)) True us) KOUserDataDevice\"\n apply (case_tac ty)\n apply (simp_all add: makeObjectKO_simps split: if_split_asm)\n apply (case_tac x1)\n apply (simp_all add: makeObjectKO_simps default_object_def APIType_map2_def \n obj_relation_retype_def objBits_simps arch_kobj_size_def\n default_arch_object_def pageBits_def)\n apply (auto simp: image_def)\n done\n\ncrunch valid_arch_state'[wp]: copyGlobalMappings \"valid_arch_state'\"\n (ignore: getObject setObject wp: crunch_wps)\n\nlemma nullPointer_0_simp[simp]:\n \"(nullPointer = 0) = True\"\n by (simp add: nullPointer_def)\n\nlemma descendants_of_retype':\n assumes P: \"\\p. P p \\ m p = None\"\n shows \"descendants_of' p (\\p. if P p then Some makeObject else m p) = \n descendants_of' p m\"\n apply (rule set_eqI)\n apply (simp add: descendants_of'_def)\n apply (rule iffI)\n apply (erule subtree.induct) \n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold makeObject_cte split: if_split_asm)\n apply assumption\n apply (clarsimp simp: parentOf_def makeObject_cte split: if_split_asm)\n apply (erule subtree.induct)\n apply (rule direct_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n apply (erule trans_parent)\n apply (clarsimp simp: mdb_next_unfold dest!: P)\n apply assumption\n apply (fastforce simp: parentOf_def dest!: P)\n done\n\nlemma capRange_Null [simp]: \"capRange NullCap = {}\"\n by (simp add: capRange_def)\n\nlemma isUntyped_Null [simp]: \"\\isUntypedCap NullCap\"\n by (simp add: isCap_simps)\n\nend\n\nlocale retype_mdb = vmdb +\n fixes P n\n assumes P: \"\\p. P p \\ m p = None\"\n assumes 0: \"\\P 0\"\n defines \"n \\ \\p. if P p then Some makeObject else m p\"\nbegin\ninterpretation Arch . (*FIXME: arch_split*)\n\nlemma no_0_n: \"no_0 n\"\n using no_0 by (simp add: no_0_def n_def 0)\n\nlemma n_next:\n \"n \\ c \\ c' = (if P c then c' = 0 else m \\ c \\ c')\"\n by (simp add: mdb_next_unfold n_def makeObject_cte nullPointer_def)\n\nlemma n_prev:\n \"n \\ c \\ c' = (if P c' then c = 0 else m \\ c \\ c')\"\n by (simp add: mdb_prev_def n_def makeObject_cte nullPointer_def)\n\nlemma dlist_n: \"valid_dlist n\"\n using dlist no_0 no_0_n\n apply (simp add: valid_dlist_def2)\n apply (clarsimp simp: n_prev n_next)\n apply (rule conjI)\n apply clarsimp\n apply (erule allE, erule (1) impE) \n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_next_unfold)\n apply clarsimp\n apply (erule allE, erule (1) impE) \n apply (erule_tac x=c' in allE)\n apply simp\n apply (drule P)\n apply (simp add: mdb_prev_def)\n done\n \nlemma n_next_trancl:\n \"n \\ c \\\\<^sup>+ c' \\ (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n apply (insert no_0_n chain)\n apply (erule trancl_induct)\n apply (fastforce simp: n_next)\n apply (simp split: if_split_asm)\n apply (clarsimp simp: mdb_next_unfold)\n apply (simp add: n_next split: if_split_asm)\n apply (simp add: mdb_chain_0_def)\n apply (drule_tac x=c in bspec)\n apply (drule tranclD)\n apply (clarsimp simp: mdb_next_unfold)\n apply assumption\n done\n\nlemma next_not_P:\n \"m \\ c \\ c' \\ \\P c\"\n by (clarsimp simp: mdb_next_unfold dest!: P)\n\nlemma trancl_not_P:\n \"m \\ c \\\\<^sup>+ c' \\ \\P c\"\n by (clarsimp dest!: next_not_P tranclD)\n\nlemma m_next_trancl:\n \"m \\ c \\\\<^sup>+ c' \\ n \\ c \\\\<^sup>+ c'\"\n apply (erule trancl_induct)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n apply (erule trancl_trans)\n apply (rule r_into_trancl)\n apply (clarsimp simp: n_next)\n apply (drule next_not_P)\n apply simp\n done\n\nlemma P_to_0:\n \"P c \\ n \\ c \\\\<^sup>+ 0\"\n by (rule r_into_trancl) (simp add: n_next)\n\nlemma n_trancl_eq:\n \"n \\ c \\\\<^sup>+ c' = (if P c then c' = 0 else m \\ c \\\\<^sup>+ c')\"\n by (auto dest: m_next_trancl n_next_trancl P_to_0)\n\nlemma n_rtrancl_eq:\n \"n \\ c \\\\<^sup>* c' = (if P c then c' = 0 \\ c = c' else m \\ c \\\\<^sup>* c')\"\n by (auto simp: n_trancl_eq rtrancl_eq_or_trancl)\n\nlemma dom_n:\n \"dom n = dom m \\ Collect P\"\n by (auto simp add: n_def)\n\nlemma mdb_chain_0_n: \"mdb_chain_0 n\"\n using chain\n by (auto simp: mdb_chain_0_def dom_n n_trancl_eq)\n\nlemma n_Some_eq:\n \"(n p = Some (CTE cap node)) = \n (if P p then cap = NullCap \\ node = nullMDBNode\n else m p = Some (CTE cap node))\"\n by (auto simp: n_def makeObject_cte)\n\nlemma valid_badges_n: \"valid_badges n\"\nproof -\n from valid\n have \"valid_badges m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_badges_def)\n apply (simp add: n_Some_eq n_next split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma caps_contained_n: \"caps_contained' n\"\nproof -\n from valid\n have \"caps_contained' m\" ..\n thus ?thesis\n apply (clarsimp simp: caps_contained'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply fastforce\n done\nqed\n\nlemma mdb_chunked_n: \"mdb_chunked n\"\nproof -\n from valid\n have \"mdb_chunked m\" ..\n thus ?thesis\n apply (clarsimp simp: mdb_chunked_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (simp add: n_Some_eq n_trancl_eq n_rtrancl_eq is_chunk_def)\n apply fastforce\n done\nqed\n\nlemma descendants [simp]:\n \"descendants_of' p n = descendants_of' p m\"\n apply (unfold n_def)\n apply (subst descendants_of_retype')\n apply (erule P)\n apply (rule refl)\n done\n\nlemma untyped_mdb_n: \"untyped_mdb' n\" \nproof -\n from valid\n have \"untyped_mdb' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_mdb'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma untyped_inc_n: \"untyped_inc' n\"\nproof -\n from valid\n have \"untyped_inc' m\" ..\n thus ?thesis\n apply (clarsimp simp: untyped_inc'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply blast\n done\nqed\n\nlemma valid_nullcaps_n: \"valid_nullcaps n\"\nproof -\n from valid\n have \"valid_nullcaps m\" ..\n thus ?thesis\n apply (clarsimp simp: valid_nullcaps_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma ut_rev_n: \"ut_revocable' n\"\nproof -\n from valid\n have \"ut_revocable' m\" ..\n thus ?thesis\n apply (clarsimp simp: ut_revocable'_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n done\nqed\n\nlemma class_links_m:\n \"class_links m\"\n using valid by (simp add: valid_mdb_ctes_def)\n\nlemma next_not_P2:\n \"\\ m \\ p \\ p'; p' \\ nullPointer \\ \\ \\ P p'\"\n using dlist\n apply (clarsimp simp: mdb_next_unfold)\n apply (erule(1) valid_dlistE)\n apply clarsimp\n apply (clarsimp dest!: P)\n done\n\nlemma class_links_n:\n \"class_links n\"\n using class_links_m\n apply (simp add: class_links_def)\n apply (elim allEI)\n apply clarsimp\n apply (subgoal_tac \"p' \\ nullPointer\")\n apply (simp add: n_next split: if_split_asm)\n apply (case_tac cte, case_tac cte')\n apply (clarsimp simp add: n_Some_eq split: if_split_asm)\n apply (drule(1) next_not_P2)\n apply simp\n apply (clarsimp simp: no_0_n nullPointer_def)\n done\n\nlemma irq_control_n:\n \"irq_control n\"\n apply (clarsimp simp add: irq_control_def)\n apply (simp add: n_Some_eq split: if_split_asm)\n apply (frule irq_revocable, rule irq_control)\n apply clarsimp\n apply (erule (1) irq_controlD, rule irq_control)\n done\n\nlemma dist_z_m: \"distinct_zombies m\"\n using valid by auto\n\nlemma dist_z_n: \"distinct_zombies n\"\n using dist_z_m\n apply (simp add: n_def distinct_zombies_def\n distinct_zombie_caps_def\n split del: if_split)\n apply (erule allEI, erule allEI)\n apply (clarsimp split del: if_split)\n apply (clarsimp split: if_split_asm simp: makeObject_cte)\n apply (clarsimp simp: isCap_simps)\n done\n\nlemma reply_masters_rvk_fb_m: \"reply_masters_rvk_fb m\"\n using valid by auto\n\nlemma reply_masters_rvk_fb_n: \"reply_masters_rvk_fb n\"\n using reply_masters_rvk_fb_m\n by (simp add: n_def reply_masters_rvk_fb_def\n ball_ran_eq makeObject_cte isCap_simps)\n\nlemma valid_n:\n \"valid_mdb_ctes n\"\n by (simp add: valid_mdb_ctes_def dlist_n no_0_n mdb_chain_0_n \n valid_badges_n caps_contained_n untyped_mdb_n \n untyped_inc_n mdb_chunked_n valid_nullcaps_n ut_rev_n\n class_links_n irq_control_n dist_z_n\n reply_masters_rvk_fb_n)\n\nend\n\ndefinition\n caps_no_overlap'' :: \"word32 \\ nat \\ kernel_state \\ bool\"\nwhere\n \"caps_no_overlap'' ptr sz s \\ \\cte \\ ran (ctes_of s).\n untypedRange (cteCap cte) \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange (cteCap cte)\"\n\nlemma caps_no_overlapI'':\n \"caps_no_overlap' (ctes_of s) {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ caps_no_overlap'' ptr sz s\"\n apply (clarsimp simp: caps_no_overlap''_def caps_no_overlap'_def ran_def\n del: psubsetE)\n apply (case_tac cte, simp)\n apply (rename_tac capability node)\n apply (drule spec, drule spec, drule mp, erule exI)\n apply (case_tac capability, simp_all del: Int_atLeastAtMost atLeastatMost_empty_iff)\n done\n\nlemma obj_range'_subset:\n \"\\range_cover ptr sz (objBitsKO val) n; ptr' \\ set (new_cap_addrs n ptr val)\\\n \\ obj_range' ptr' val \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\"\n unfolding obj_range'_def\n by (rule new_range_subset, auto)\n\nlemma obj_range'_subset_strong:\n \"\\range_cover ptr sz (objBitsKO val) n; ptr' \\ set (new_cap_addrs n ptr val)\\\n \\ obj_range' ptr' val \\ {ptr..ptr + (of_nat n * 2 ^ objBitsKO val) - 1}\"\n unfolding obj_range'_def\n apply (frule(1) obj_range'_subset)\n apply (simp add:obj_range'_def)\n apply (intro conjI impI)\n apply (erule(1) impE)\n apply clarsimp\n apply (case_tac \"n = 0\")\n apply (clarsimp simp:new_cap_addrs_def)\n proof -\n assume cover:\"range_cover ptr sz (objBitsKO val) n\"\n and mem_p:\"ptr' \\ set (new_cap_addrs n ptr val)\"\n and not_0:\"n\\ 0\"\n note n_less = range_cover.range_cover_n_less[OF cover]\n have unat_of_nat_m1: \"unat (of_nat n - (1::word32)) < n\"\n using not_0 n_less\n by (simp add:unat_of_nat_minus_1)\n have decomp:\"of_nat n * 2 ^ objBitsKO val = of_nat (n - 1) * 2 ^ objBitsKO val + (2 :: word32) ^ objBitsKO val\"\n apply (simp add:distrib_right[where b = \"1 :: 32 word\",simplified,symmetric])\n using not_0 n_less\n apply simp\n done\n show \"ptr' + 2 ^ objBitsKO val - 1 \\ ptr + of_nat n * 2 ^ objBitsKO val - 1\"\n apply (subst decomp)\n apply (simp add:add.assoc[symmetric])\n apply (simp add:p_assoc_help)\n apply (rule order_trans[OF word_plus_mono_left word_plus_mono_right])\n using mem_p not_0\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rule word_plus_mono_right)\n apply (subst mult.commute)\n apply (rule word_mult_le_mono1[OF word_of_nat_le])\n using n_less not_0\n apply (simp add:unat_of_nat_minus_1)\n apply (rule p2_gt_0[THEN iffD2])\n using cover\n apply (simp add:word_bits_def range_cover_def)\n apply (simp only: word_bits_def[symmetric])\n apply (clarsimp simp: unat_of_nat_minus_1[OF n_less(1) not_0])\n apply (rule nat_less_power_trans2\n [OF range_cover.range_cover_le_n_less(2),OF cover, folded word_bits_def])\n apply (simp add:unat_of_nat_m1 less_imp_le)\n using cover\n apply (simp add:range_cover_def word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n using range_cover.range_cover_compare[OF cover,where p = \"unat (of_nat n - (1::word32))\"]\n apply (clarsimp simp:unat_of_nat_m1)\n using cover\n apply (simp add:range_cover_def word_bits_def)\n apply (rule olen_add_eqv[THEN iffD2])\n apply (subst add.commute[where a = \"2^objBitsKO val - 1\"])\n apply (subst p_assoc_help[symmetric])\n apply (rule is_aligned_no_overflow)\n using cover\n apply (clarsimp simp:range_cover_def word_bits_def)\n apply (erule aligned_add_aligned[OF _ is_aligned_mult_triv2])\n apply simp+\n done\n qed\n\n\nlemma aligned_obj_range'_no_empty:\n \"\\is_aligned ptr' (objBitsKO val)\\ \\ obj_range' ptr' val \\ {}\"\n apply (simp add:obj_range'_def p_assoc_help)\n apply (erule is_aligned_no_wrap')\n apply simp\n done\n\nlemma caps_no_overlapD'':\n \"\\cte_wp_at' (\\cap. cteCap cap = c) q s;caps_no_overlap'' ptr sz s\\\n \\ untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ {} \\\n {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ untypedRange c\"\n apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps caps_no_overlap''_def\n simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule_tac x = cte in bspec)\n apply fastforce\n apply (erule(1) impE)\n apply blast\ndone\n \ncontext begin interpretation Arch . (*FIXME: arch_split*)\nlemma valid_untyped'_helper:\n assumes valid : \"valid_cap' c s\"\n and cte_at : \"cte_wp_at' (\\cap. cteCap cap = c) q s\"\n and cover : \"range_cover ptr sz (objBitsKO val) n\"\n and range : \"caps_no_overlap'' ptr sz s\"\n and pres : \"isUntypedCap c \\ usableUntypedRange c \\ {ptr..ptr + of_nat n * 2 ^ objBitsKO val - 1} = {}\"\n shows \"\\pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr sz s\\\n \\ valid_cap' c (s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs n ptr val) (ksPSpace s)\\)\"\n proof -\n note blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff\n assume pn : \"pspace_aligned' s\" \"pspace_distinct' s\"\n and no_overlap: \"pspace_no_overlap' ptr sz s\"\n show ?thesis\n using pn pres no_overlap valid cover cte_wp_at_ctes_of[THEN iffD1,OF cte_at] \n caps_no_overlapD''[OF cte_at range]\n apply (clarsimp simp:valid_cap'_def retype_ko_wp_at')\n apply (case_tac \"cteCap cte\"; simp add: valid_cap'_def cte_wp_at_obj_cases'\n valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm)\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches\n page_table_at'_def page_directory_at'_def split del: if_splits)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n unfolding valid_untyped'_def\n apply (intro allI)\n apply (rule ccontr)\n apply clarify\n using cover[unfolded range_cover_def]\n apply (clarsimp simp:isCap_simps retype_ko_wp_at' split:if_split_asm)\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (elim disjE)\n apply (frule(1) obj_range'_subset)\n apply (erule impE)\n apply (drule(1) psubset_subset_trans)\n apply (drule Int_absorb1[OF psubset_imp_subset])\n apply (drule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (simp add:Int_ac)\n apply (drule(1) subset_trans)\n apply blast\n apply (frule(1) obj_range'_subset_strong)\n apply (drule(1) non_disjoing_subset)\n apply blast\n apply (thin_tac \"\\x. Q x\" for Q)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (frule(1) obj_range'_subset)\n apply (drule(1) subset_trans)\n apply (erule impE)\n apply clarsimp\n apply blast\n apply blast\n done\nqed\n\ndefinition caps_overlap_reserved' :: \"word32 set \\ kernel_state \\ bool\"\nwhere\n \"caps_overlap_reserved' S s \\ \\cte \\ ran (ctes_of s).\n (isUntypedCap (cteCap cte) \\ usableUntypedRange (cteCap cte) \\ S = {})\"\n\nlemma createObjects_valid_pspace':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\" \n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s\n \\ ptr \\ 0\\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (cut_tac not_0)\n apply (simp add: split_def createObjects'_def\n lookupAround2_pspace_no\n alignError_def unless_def)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def del:fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift[OF _ cover])\n apply simp+\n apply (subst data_map_insert_def[symmetric])+\n apply (rule impI)\n apply (clarsimp simp: new_cap_addrs_fold'\n valid_pspace'_def linorder_not_less\n objBits_def[symmetric])\n apply (simp only: imp_disjL[symmetric] imp_conjL[symmetric] imp_ex[symmetric]\n range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified])\nproof (intro conjI impI)\n\n fix s\n\n assume pn: \"pspace_no_overlap' ptr sz s\"\n and vo: \"valid_objs' s\"\n and ad: \"pspace_aligned' s\" \"pspace_distinct' s\"\n and pc: \"caps_no_overlap'' ptr sz s\"\n and mdb: \"valid_mdb' s\"\n and p_0: \"ptr \\ 0\"\n and reserved : \"caps_overlap_reserved' {ptr..ptr + of_nat n *2 ^ gbits * 2 ^ objBitsKO val - 1} s\"\n and no_0_obj': \"no_0_obj' s\"\n have obj': \"objBitsKO val \\ sz\" \n using cover\n by (simp add:range_cover_def)\n\n let ?s' = \"s\\ksPSpace := foldr (\\addr. data_map_insert addr val) (new_cap_addrs (n * 2 ^ gbits) ptr val) (ksPSpace s)\\\"\n\n note cover' = range_cover_rel[where sbit' = \"objBitsKO val\",OF cover _ refl,simplified]\n\n note ad' = retype_aligned_distinct'[OF ad pn cover']\n\n note shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n\n have al: \"is_aligned ptr (objBitsKO val)\"\n using cover'\n by (simp add:range_cover_def)\n\n show pspace_aligned: \"pspace_aligned' ?s'\"\n using ad' range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n by (simp add:field_simps)\n\n show \"pspace_distinct' ?s'\"\n using ad' shift\n by (simp add:field_simps)\n\n note obj_at_disj = retype_obj_at_disj' [OF ad pn cover']\n\n note obj_at_disj' = obj_at_disj [unfolded foldr_upd_app_if[folded data_map_insert_def]]\n\n have obj_atC: \"\\P x. x \\ set (new_cap_addrs (2 ^ gbits * n) ptr val) \\ \\ obj_at' P x s\"\n apply (clarsimp simp: obj_at'_def)\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover' ]])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule domI[where m = \"ksPSpace s\"])\n apply (drule(1) orthD2)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n done\n\n have valid_cap: \"\\cap q. \\ s \\' cap; cte_wp_at' (\\cte. cteCap cte = cap) q s \\\n \\ ?s' \\' cap\"\n apply (rule valid_untyped'_helper[OF _ _ _ pc _ ad pn ])\n apply simp+\n apply (subst mult.commute)\n apply (rule cover')\n using reserved\n apply (clarsimp simp:caps_overlap_reserved'_def cte_wp_at_ctes_of)\n apply (drule_tac x = cte in bspec)\n apply fastforce \n apply simp\n done\n\n show valid_objs: \"valid_objs' ?s'\" using vo\n apply (clarsimp simp: valid_objs'_def\n foldr_upd_app_if[folded data_map_insert_def]\n elim!: ranE\n split: if_split_asm)\n apply (insert sym[OF mko])[1]\n apply (clarsimp simp: makeObjectKO_def\n split: bool.split_asm sum.split_asm\n ARM_H.object_type.split_asm\n apiobject_type.split_asm\n kernel_object.split_asm\n arch_kernel_object.split_asm)\n apply (drule bspec, erule ranI)\n apply (subst mult.commute)\n apply (case_tac obj; simp add: valid_obj'_def)\n apply (rename_tac endpoint)\n apply (case_tac endpoint; simp add: valid_ep'_def obj_at_disj')\n apply (rename_tac notification)\n apply (case_tac notification; simp add: valid_ntfn'_def valid_bound_tcb'_def obj_at_disj')\n apply (rename_tac ntfn xa)\n apply (case_tac ntfn, simp_all, (clarsimp simp: obj_at_disj' split:option.splits)+)\n apply (rename_tac tcb)\n apply (case_tac tcb, clarsimp simp add: valid_tcb'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps)\n apply (subst mult.commute)\n apply (intro conjI ballI)\n apply (clarsimp elim!: ranE)\n apply (rule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (fastforce)\n apply (rule_tac ptr=\"x + xa\" in cte_wp_at_tcbI', assumption+)\n apply fastforce\n apply simp\n apply (rename_tac thread_state mcp priority bool option nat cptr vptr bound user_context)\n apply (case_tac thread_state, simp_all add: valid_tcb_state'_def \n valid_bound_ntfn'_def obj_at_disj' \n split: option.splits)[2]\n apply (simp add: valid_cte'_def)\n apply (frule pspace_alignedD' [OF _ ad(1)])\n apply (frule pspace_distinctD' [OF _ ad(2)])\n apply (simp add: objBits_simps)\n apply (subst mult.commute)\n apply (erule valid_cap[unfolded foldr_upd_app_if[folded data_map_insert_def]])\n apply (erule(2) cte_wp_at_cteI'[unfolded cte_level_bits_def])\n apply simp\n apply (rename_tac arch_kernel_object)\n apply (case_tac arch_kernel_object; simp)\n apply (rename_tac asidpool)\n apply (case_tac asidpool, clarsimp simp: page_directory_at'_def \n typ_at_to_obj_at_arches \n obj_at_disj')\n apply (rename_tac pte)\n apply (case_tac pte; simp add: valid_mapping'_def)\n apply (rename_tac pde)\n apply (case_tac pde; simp add: valid_mapping'_def page_table_at'_def\n typ_at_to_obj_at_arches obj_at_disj')\n done\n have not_0: \"0 \\ set (new_cap_addrs (2 ^ gbits * n) ptr val)\"\n using p_0\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset [OF cover'],rotated])\n apply (clarsimp simp:ptr_add_def)\n done\n show \"valid_mdb' ?s'\"\n apply (simp add: valid_mdb'_def foldr_upd_app_if[folded data_map_insert_def])\n apply (subst mult.commute)\n apply (subst ctes_of_retype [OF mko ad])\n apply (rule ad'[unfolded foldr_upd_app_if[folded data_map_insert_def]])+\n apply (simp add: objBits_def[symmetric] new_cap_addrs_aligned [OF al])\n apply (rule ballI, drule subsetD [OF new_cap_addrs_subset [OF cover']])\n apply (insert pspace_no_overlap_disjoint' [OF ad(1) pn])\n apply (drule_tac x = x in orthD1)\n apply (simp add:ptr_add_def p_assoc_help)\n apply fastforce\n apply (fold makeObject_cte)\n apply (rule retype_mdb.valid_n)\n apply unfold_locales\n apply (rule mdb[unfolded valid_mdb'_def])\n apply (rule iffD2 [OF None_ctes_of_cte_at[unfolded cte_wp_at_obj_cases'], THEN sym])\n apply (rule notI)\n apply (elim disjE conjE, simp_all add: obj_atC)[1]\n apply (thin_tac \"S \\ T = {}\" for S T)\n apply (clarsimp simp: obj_at'_def projectKOs objBits_simps)\n apply (drule pspace_no_overlapD' [OF _ pn])\n apply (drule subsetD [OF new_cap_addrs_subset[OF cover']])\n apply (frule_tac ptr'=p in mask_in_range)\n apply (drule(1) tcb_cte_cases_aligned_helpers)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:objBits_simps)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (frule new_range_subset[OF cover'])\n apply (drule bspec [OF new_cap_addrs_aligned[OF al]])\n apply (drule(1) disjoint_subset[rotated])\n apply (drule_tac a=p in equals0D)\n apply (frule_tac ptr'=p in mask_in_range)\n apply (insert sym [OF mko],\n clarsimp simp: objBits_simps makeObjectKO_def obj_at'_def)[1]\n apply (insert sym[OF mko] cover',\n clarsimp simp: obj_at'_def objBits_simps\n makeObjectKO_def projectKOs)[1]\n apply (drule(1) tcb_cte_cases_aligned_helpers(2))\n apply clarsimp\n apply (drule subsetD [OF new_cap_addrs_subset,rotated])\n apply (simp add:objBits_simps)\n apply (drule orthD1)\n apply (fastforce simp:p_assoc_help ptr_add_def)\n apply fastforce\n apply (simp add: not_0)\n done\n\n have data_map_ext: \"\\x y. data_map_insert x y = (\\m. m (x \\ y))\"\n by (rule ext) simp\n show no_0_obj: \"no_0_obj' ?s'\"\n using not_0 no_0_obj'\n by (simp add: no_0_obj'_def data_map_ext field_simps foldr_upd_app_other)\n\nqed\n\nabbreviation\n \"injectKOS \\ (injectKO :: ('a :: pspace_storable) \\ kernel_object)\"\n\nlemma createObjects_valid_pspace_untyped':\n assumes mko: \"makeObjectKO dev ty = Some val\"\n and not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\" \n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0\n \\ caps_overlap_reserved' {ptr .. ptr + of_nat (n * 2^gbits * 2 ^ objBitsKO val ) - 1} s \\\n createObjects' ptr n val gbits \\\\r. valid_pspace'\\\"\n apply (wp createObjects_valid_pspace' [OF mko not_0 cover])\n apply simp\n done\n\nlemma getObject_valid_pde'[wp]:\n \"\\valid_objs'\\ getObject x \\valid_pde'\\\"\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule getObject_ko_at, simp)\n apply (simp add: objBits_simps archObjSize_def)\n apply (rule getObject_inv[where P=valid_objs'])\n apply (simp add: loadObject_default_inv)\n apply simp\n apply (clarsimp simp: projectKOs valid_obj'_def dest!: obj_at_valid_objs')\n done\n\ncrunch valid_objs'[wp]: copyGlobalMappings \"valid_objs'\"\n (ignore: getObject storePDE wp: crunch_wps)\ncrunch pspace_aligned'[wp]: copyGlobalMappings \"pspace_aligned'\"\n (ignore: getObject wp: crunch_wps)\ncrunch pspace_distinct'[wp]: copyGlobalMappings \"pspace_distinct'\"\n (ignore: getObject wp: crunch_wps)\n\nlemmas storePDE_valid_mdb[wp]\n = storePDE_ctes[where P=valid_mdb_ctes, folded valid_mdb'_def]\ncrunch valid_mdb[wp]: copyGlobalMappings \"valid_mdb'\"\n (ignore: getObject wp: crunch_wps)\n\ncrunch no_0_obj' [wp]: copyGlobalMappings no_0_obj'\n (ignore: getObject wp: crunch_wps)\n\nlemma copyGlobalMappings_valid_pspace[wp]:\n \"\\valid_pspace'\\ copyGlobalMappings pd \\\\rv. valid_pspace'\\\"\n by (simp add: valid_pspace'_def | wp)+\n\ndeclare bleeding_obvious [simp]\n\nlemma range_cover_new_cap_addrs_compare:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and ptr_in: \"p \\ set (new_cap_addrs (unat (((of_nat n)::word32) << gbits)) ptr val)\"\n shows \"p \\ ptr + of_nat (shiftL n (objBitsKO val + gbits) - Suc 0)\"\nproof -\n note unat_of_nat_shift = range_cover.unat_of_nat_n_shift[OF cover,where gbits=gbits,simplified]\n have cover' :\"range_cover ptr sz (objBitsKO val) (n*2^gbits)\"\n by (rule range_cover_rel[OF cover],simp+)\n have upbound:\" unat ((((of_nat n)::word32) * 2 ^ gbits)) * unat ((2::word32) ^ objBitsKO val) < 2 ^ word_bits\"\n using range_cover.range_cover_le_n_less[OF cover' le_refl] cover'\n apply -\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def)\n apply (fold word_bits_def)\n using unat_of_nat_shift not_0\n apply (simp add:field_simps shiftl_t2n)\n done\n have not_0': \"(2::word32) ^ (objBitsKO val + gbits) * of_nat n \\ 0\"\n apply (rule range_cover_not_zero_shift[OF not_0,unfolded shiftl_t2n,OF _ le_refl])\n apply (rule range_cover_rel[OF cover])\n apply simp+\n done\n have \"gbits < word_bits\"\n using cover\n by (simp add:range_cover_def word_bits_def)\n thus ?thesis\n apply -\n apply (insert not_0 cover ptr_in)\n apply (frule range_cover.range_cover_le_n_less[OF _ le_refl])\n apply (fold word_bits_def)\n apply (simp add:shiftL_nat )\n apply (simp add:range_cover.unat_of_nat_n_shift)\n apply (clarsimp simp:new_cap_addrs_def shiftl_t2n)\n apply (rule word_plus_mono_right)\n apply (rule order_trans)\n apply (subst mult.commute)\n apply (rule word_mult_le_iff[THEN iffD2])\n apply (clarsimp simp:p2_gt_0 range_cover_def word_bits_def)\n apply (drule range_cover_rel[where sbit' = \"0\"])\n apply (simp+)[2]\n apply (erule less_le_trans[OF range_cover.range_cover_le_n_less(2)])\n apply (clarsimp simp:field_simps power_add)\n apply (rule unat_le_helper)\n apply (rule of_nat_mono_maybe_le[THEN iffD1])\n using range_cover.range_cover_le_n_less[OF cover' le_refl]\n apply (simp_all only:word_bits_def[symmetric])\n apply simp\n apply (drule nat_less_power_trans)\n apply (simp add:range_cover_def word_bits_def)\n apply (rule less_le_trans[OF mult_less_mono1])\n apply (rule unat_mono)\n apply (rule_tac y1= \"pa\" in of_nat_mono_maybe'[THEN iffD1,rotated -1])\n apply (assumption)\n apply (simp add:word_bits_def)\n apply (simp add:word_bits_def)\n apply simp\n using unat_of_nat_shift\n apply (simp add:field_simps shiftl_t2n)\n apply simp\n apply (rule word_less_sub_1)\n apply (simp add:power_add field_simps)\n apply (subst mult.assoc[symmetric])\n apply (rule word_mult_less_mono1)\n apply (rule word_of_nat_less)\n using unat_of_nat_shift\n apply (simp add:shiftl_t2n field_simps)\n apply unat_arith\n using upbound\n apply (simp add:word_bits_def)\n apply (rule machine_word_plus_mono_right_split[where sz = sz])\n apply (rule less_le_trans[rotated -1])\n apply (rule range_cover.range_cover_compare_bound[OF cover'])\n apply (simp add: unat_minus_one[OF not_0'])\n using range_cover.unat_of_nat_n_shift[OF cover le_refl]\n apply (simp add:shiftl_t2n power_add field_simps)\n apply (simp add:range_cover_def word_bits_def)\n done\nqed\n\nlemma createObjects_orig_ko_wp_at2':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' val \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (ko_wp_at' P' p s)\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del:fun_upd_apply)\n apply (rule hoare_grab_asm)+\n apply (subst new_cap_addrs_fold')\n apply (drule range_cover_not_zero_shift[rotated])\n apply (rule le_add2)\n apply (simp add:word_le_sub1 del:fun_upd_apply)+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (clarsimp simp:valid_pspace'_def linorder_not_less simp del:fun_upd_apply)\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (cases \"P' val\")\n apply simp\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def)\n apply (fastforce simp:ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\n\nlemma createObjects_orig_obj_at2':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (obj_at' P' p s)\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (obj_at' P' p s)\\\"\n unfolding obj_at'_real_def\n by (wp createObjects_orig_ko_wp_at2') auto\n\nlemma createObjects_orig_cte_wp_at2':\n \"\\\\s. P (cte_wp_at' P' p s)\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ \\ (case_option False P' (projectKO_opt val))\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ (case_option False (P' \\ getF) (projectKO_opt val)))\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. P (cte_wp_at' P' p s)\\\"\n apply (simp add: cte_wp_at'_obj_at')\n apply (rule handy_prop_divs)\n apply (wp createObjects_orig_obj_at2'[where sz = sz], simp)\n apply (simp add: tcb_cte_cases_def)\n including no_pre\n apply (wp handy_prop_divs createObjects_orig_obj_at2'[where sz = sz]\n | simp add: o_def cong: option.case_cong)+\n done\n\nlemma threadSet_cte_wp_at2'T:\n assumes \"\\tcb. \\(getF, setF) \\ ran tcb_cte_cases. getF (F tcb) = getF tcb\"\n shows \"\\\\s. P (cte_wp_at' P' p s)\\ threadSet F t \\\\rv s. P (cte_wp_at' P' p s)\\\"\n using assms by (rule threadSet_cte_wp_at'T)\n\nlemmas threadSet_cte_wp_at2' =\n threadSet_cte_wp_at2'T [OF all_tcbI, OF ball_tcb_cte_casesI]\n\nlemma createNewCaps_cte_wp_at2:\n \"\\\\s. P (cte_wp_at' P' p s) \\ \\ P' makeObject\n \\ n \\ 0\n \\ range_cover ptr sz (APIType_capBits ty objsz) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n objsz dev\n \\\\rv s. P (cte_wp_at' P' p s)\\\"\n including no_pre\n apply (simp add: createNewCaps_def createObjects_def ARM_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: createNewCaps_def createObjects_def Arch_createNewCaps_def\n split del: if_split cong: if_cong)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp add:createObjects_def)\n apply ((wp createObjects_orig_cte_wp_at2'[where sz = sz]\n mapM_x_wp' threadSet_cte_wp_at2')+\n | assumption\n | clarsimp simp: APIType_capBits_def\n projectKOs projectKO_opts_defs\n makeObject_tcb tcb_cte_cases_def\n pageBits_def archObjSize_def ptBits_def\n pdBits_def createObjects_def curDomain_def\n Let_def objBits_if_dev\n split del: if_split\n | simp add: objBits_simps)+\n done\n\nlemma createObjects_orig_obj_at':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ obj_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r. obj_at' P p\\\"\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: createObjects'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (wp|simp add:split_def cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (clarsimp simp del:fun_upd_apply)\n apply (wp hoare_unless_wp)\n apply (simp add:range_cover_def is_aligned_mask)\n apply (subst data_map_insert_def[symmetric])+\n apply clarsimp\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst retype_obj_at',simp+)+\n apply (intro conjI impI allI)\n apply (clarsimp simp:obj_at'_real_def ko_wp_at'_def)\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add:lookupAround2_None1)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply simp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp:ptr_add_def p_assoc_help)\n apply (simp add:dom_def obj_at'_real_def ko_wp_at'_def)\n apply simp+\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\ncrunch ko_wp_at'[wp]: doMachineOp \"\\s. P (ko_wp_at' P' p s)\"\n\nlemma createObjects_orig_cte_wp_at':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ cte_wp_at' P p s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. cte_wp_at' P p s\\\"\n apply (simp add: cte_wp_at'_obj_at' tcb_cte_cases_def)\n apply (rule hoare_pre, wp hoare_vcg_disj_lift createObjects_orig_obj_at'[where sz = sz])\n apply clarsimp\n done\n\nlemma createNewCaps_cte_wp_at':\n \"\\\\s. cte_wp_at' P p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us dev\n \\\\rv. cte_wp_at' P p\\\"\n apply (simp add: createNewCaps_def ARM_H.toAPIType_def\n split del: if_split)\n apply (case_tac ty; simp add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (wp createObjects_orig_cte_wp_at'[where sz = sz] mapM_x_wp'\n threadSet_cte_wp_at'T\n | clarsimp simp: objBits_simps APIType_capBits_def createObjects_def curDomain_def\n pageBits_def ptBits_def pdBits_def archObjSize_def\n | intro conjI impI\n | force simp: tcb_cte_cases_def)+\n done\n\nlemma createObjects_obj_at_other:\n assumes cover: \"range_cover ptr sz (objBitsKO val + gbits) n\"\n and not_0: \"n\\ 0\"\n shows \"\\\\s. obj_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\ \n createObjects ptr n val gbits \\\\_. obj_at' P p\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_orig_obj_at'[where sz = sz])\n using cover not_0\n apply (clarsimp simp: cover not_0 valid_pspace'_def pspace_no_overlap'_def)\n done\n\nlemma valid_cap'_range_no_overlap:\n \"\\untypedRange c \\ {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; s \\' c;\n valid_pspace' s; pspace_no_overlap' ptr sz s;\n range_cover ptr sz (objBitsKO val) n\\\n \\ s\\ksPSpace := foldr (\\addr. data_map_insert addr val)\n (new_cap_addrs n ptr val) (ksPSpace s)\\ \\' c\"\n apply (cases c; simp add: valid_cap'_def cte_wp_at_obj_cases' valid_pspace'_def retype_obj_at_disj'\n split: zombie_type.split_asm\n del: Int_atLeastAtMost)[1]\n apply (rename_tac arch_capability)\n apply (case_tac arch_capability;\n simp add: retype_obj_at_disj' typ_at_to_obj_at_arches\n page_table_at'_def page_directory_at'_def)\n apply (fastforce simp: typ_at_to_obj_at_arches retype_obj_at_disj')\n apply (rename_tac word nat1 nat2)\n apply (clarsimp simp:valid_untyped'_def retype_ko_wp_at' \n simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (frule aligned_untypedRange_non_empty)\n apply (simp add:isCap_simps)\n apply (intro conjI impI)\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (erule disjE)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2[OF psubset_imp_subset])\n apply (simp add: Int_absorb ptr_add_def p_assoc_help \n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(1) obj_range'_subset)\n apply (drule_tac A'=\" {word + of_nat nat2..word + 2 ^ nat1 - 1}\" in disjoint_subset[rotated])\n apply clarsimp\n apply (rule is_aligned_no_wrap')\n apply (fastforce simp:capAligned_def)\n apply (erule of_nat_less_pow_32)\n apply (simp add:capAligned_def)\n apply (drule(1) disjoint_subset2)\n apply blast\n apply (intro allI)\n apply (drule_tac x = ptr' in spec)\n apply (rule ccontr)\n apply (clarsimp simp del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n apply (drule(2) disjoint_subset2 [OF obj_range'_subset])\n apply (drule(1) disjoint_subset2)\n apply (simp add: Int_absorb ptr_add_def p_assoc_help\n del: atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff)\n done\n\nlemma createObjects_valid_cap':\n \"\\valid_cap' c and valid_pspace' and pspace_no_overlap' ptr sz and \n K (untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2^sz - 1} = {} \\ \n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\ \n createObjects' ptr n val gbits \n \\\\_. valid_cap' c\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (clarsimp simp: linorder_not_less new_cap_addrs_fold\n valid_pspace'_def)\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])+\n apply clarsimp\n apply (subgoal_tac \" range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst range_cover.unat_of_nat_n_shift,simp+)+\n apply (subst (asm) range_cover.unat_of_nat_n_shift,simp+)+\n apply (intro conjI impI allI)\n apply (erule(4) valid_cap'_range_no_overlap)+\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createNewCaps_valid_cap_other:\n \"\\valid_cap' c and valid_pspace' and pspace_no_overlap' ptr sz and \n K (untypedRange c \\ {ptr .. (ptr && ~~ mask sz) + 2^sz - 1} = {} \n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0 )\\ \n createNewCaps ty ptr n us dev\n \\\\_. valid_cap' c\\\"\n unfolding createNewCaps_def\n apply (clarsimp simp: ARM_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp createObjects_valid_cap'[where sz = sz] mapM_x_wp'\n | clarsimp simp: objBitsKO_def APIType_capBits_def objBits_def curDomain_def\n pageBits_def pdBits_def ptBits_def archObjSize_def createObjects_def\n | intro conjI impI\n | force)+\n done\n\nlemma createObjects_cte_wp_at':\n \"\\range_cover ptr sz (objBitsKO val + gbits) n; n \\ 0\\\n \\\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\ \n createObjects' ptr n val gbits\n \\\\_. cte_wp_at' P p\\\"\n apply (clarsimp simp: valid_def cte_wp_at_obj_cases')\n apply (erule disjE)\n apply (erule use_valid[OF _ ])\n apply (rule createObjects_orig_obj_at')\n apply fastforce\n apply clarsimp\n apply (drule_tac x = na in bspec)\n apply clarsimp\n apply clarsimp\n apply (drule use_valid[OF _ createObjects_orig_obj_at'])\n apply fastforce\n apply simp\n done\n\nlemma createNewCaps_cte_wp_at:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0 : \"n \\ 0\"\n shows \"\\\\s. cte_wp_at' P p s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\\ \n createNewCaps ty ptr n us dev\n \\\\_. cte_wp_at' P p\\\"\n apply (wp createNewCaps_cte_wp_at')\n apply (auto simp: cover not_0)\n done\n\nlemma createObjects_ret2:\n \"\\(\\s. P (map (\\p. ptr_add y (p * 2 ^ (objBitsKO ko + gbits)))\n [0.. n \\ 0)\\\n createObjects y n ko gbits \\\\rv s. P rv\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_chain)\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ret)\n apply simp+\n apply (rule hoare_vcg_prop)\n defer\n apply (clarsimp simp: power_add mult.commute mult.left_commute | assumption)+\n done\n\nlemma state_refs_ko_wp_at_eq:\n \"state_refs_of' s = (\\x. {r. ko_wp_at' (\\ko. r \\ refs_of' ko) x s})\"\n apply (rule ext)\n apply (simp add: state_refs_of'_def ko_wp_at'_def\n split: option.split)\n done\n\nlemma createObjects_state_refs_of'':\n \"\\\\s. n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ P (state_refs_of' s) \\ refs_of' val = {}\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. P (state_refs_of' s)\\\"\n apply (clarsimp simp:valid_def lookupAround2_pspace_no state_refs_ko_wp_at_eq)\n apply (erule ssubst[where P = P,rotated])\n apply (rule ext)\n apply (rule set_eqI)\n apply clarsimp\n apply (intro iffI,rule ccontr)\n apply (drule_tac P1=\"\\x. \\ x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp\n apply (intro conjI)\n apply simp+\n apply (drule_tac P1=\"\\x. x\" in use_valid[OF _ createObjects_orig_ko_wp_at2'[where sz = sz]])\n apply simp+\n done\n\ncrunch state_refs_of'[wp]: copyGlobalMappings \"\\s. P (state_refs_of' s)\"\n (ignore: getObject wp: crunch_wps)\n\nlemma createNewCaps_state_refs_of':\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ P (state_refs_of' s)\\\n createNewCaps ty ptr n us dev \n \\\\rv s. P (state_refs_of' s)\\\"\n unfolding createNewCaps_def\n apply (clarsimp simp: ARM_H.toAPIType_def\n split del: if_split)\n apply (cases ty; simp add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type; simp split del: if_split)\n apply (rule hoare_pre, wp, simp)\n apply (insert cover not_0)\n apply (wp mapM_x_wp' createObjects_state_refs_of'' threadSet_state_refs_of'\n | simp add: not_0 pspace_no_overlap'_def objBitsKO_def APIType_capBits_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint objBits_def\n makeObject_notification pageBits_def ptBits_def pdBits_def\n archObjSize_def createObjects_def curDomain_def\n | intro conjI impI)+\n done\n\nlemma createObjects_iflive':\n \"\\\\s. if_live_then_nonz_cap' s \\ \\ live' val\n \\ n \\ 0\n \\ range_cover ptr sz (objBitsKO val + gbits) n\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n apply (rule hoare_pre)\n apply (simp only: if_live_then_nonz_cap'_def\n ex_nonz_cap_to'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n hoare_vcg_ex_lift createObjects_orig_ko_wp_at2'\n createObjects_orig_cte_wp_at')\n apply clarsimp\n apply (intro conjI allI impI)\n apply simp_all\n apply (rule ccontr)\n apply clarsimp\n apply (drule(1) if_live_then_nonz_capE')\n apply (fastforce simp: ex_nonz_cap_to'_def)\n done\n\ncrunch ksReadyQueues[wp]: copyGlobalMappings \"\\s. P (ksReadyQueues s)\"\n (ignore: getObject setObject wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL1[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n (ignore: getObject setObject wp: updateObject_default_inv crunch_wps)\ncrunch ksReadyQueuesL2[wp]: copyGlobalMappings \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (ignore: getObject setObject wp: updateObject_default_inv crunch_wps)\n\ncrunch valid_idle'[wp]: copyGlobalMappings \"valid_idle'\"\n (ignore: getObject setObject\n simp: objBits_simps archObjSize_def \n wp: updateObject_default_inv crunch_wps setObject_idle' refl)\n\ncrunch iflive'[wp]: copyGlobalMappings \"if_live_then_nonz_cap'\"\n (ignore: getObject wp: crunch_wps)\n\nlemma if_expand:\n \"(P (if a then b else c)) = (if a then (P b) else (P c))\"\n by auto\n\nlemma createNewCaps_iflive'[wp]:\n assumes cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n and not_0: \"n \\ 0\"\n shows\n \"\\\\s. valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ if_live_then_nonz_cap' s\\\n createNewCaps ty ptr n us dev\n \\\\rv s. if_live_then_nonz_cap' s\\\"\n unfolding createNewCaps_def \n apply (insert cover)\n apply (clarsimp simp: toAPIType_def ARM_H.toAPIType_def)\n apply (cases ty, simp_all add: createNewCaps_def Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_wp' createObjects_iflive' threadSet_iflive'\n | simp add: not_0 pspace_no_overlap'_def createObjects_def\n valid_pspace'_def makeObject_tcb makeObject_endpoint\n makeObject_notification objBitsKO_def \n APIType_capBits_def objBits_def pageBits_def\n archObjSize_def ptBits_def pdBits_def\n curDomain_def split del:if_split\n | simp split: if_split\n | fastforce)+\n done\n\nlemma createObjects_pspace_only:\n \"\\ \\f s. P (ksPSpace_update f s) = P s \\\n \\ \\P\\ createObjects' ptr n val gbits \\\\rv. P\\\"\n apply (simp add: createObjects_def createObjects'_def unless_def alignError_def\n split_def lookupAround2_pspace_no)\n apply wpsimp\n done\n\nlemma createObjects'_qs[wp]:\n \"\\\\s. P (ksReadyQueues s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueues s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\nlemma createObjects'_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ createObjects' ptr n val gbits \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (rule createObjects_pspace_only, simp)\n\n(* FIXME move these 2 to TcbAcc_R *)\nlemma threadSet_qsL1[wp]:\n \"\\\\s. P (ksReadyQueuesL1Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL1Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\nlemma threadSet_qsL2[wp]:\n \"\\\\s. P (ksReadyQueuesL2Bitmap s)\\ threadSet f t \\\\rv s. P (ksReadyQueuesL2Bitmap s)\\\"\n by (simp add: threadSet_def | wp updateObject_default_inv)+\n\ncrunch qs[wp]: createObjects, createNewCaps \"\\s. P (ksReadyQueues s)\"\n (simp: crunch_simps wp: crunch_wps)\ncrunch qsL1[wp]: createObjects, createNewCaps \"\\s. P (ksReadyQueuesL1Bitmap s)\"\n (simp: crunch_simps wp: crunch_wps)\ncrunch qsL2[wp]: createObjects, createNewCaps \"\\s. P (ksReadyQueuesL2Bitmap s)\"\n (simp: crunch_simps wp: crunch_wps)\n\nlemma sch_act_wf_lift_asm:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\ \n f \n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (frule use_valid [OF _ ksA])\n prefer 2\n apply assumption\n apply (frule_tac P1=\"op = (ksCurThread s)\" in use_valid [OF _ kCT])\n apply (rule refl)\n apply (frule_tac P1=\"op = (ksCurDomain s)\" in use_valid [OF _ kCD])\n apply (rule refl)\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply (frule use_valid [OF _ tcbDomain], fastforce)\n apply auto\n done\n\nlemma valid_queues_lift_asm':\n assumes tat: \"\\d p t. \\\\s. \\ obj_at' (inQ d p) t s \\ Q d p s\\ f \\\\_ s. \\ obj_at' (inQ d p) t s\\\"\n and prq: \"\\P. \\\\s. P (ksReadyQueues s)\\ f \\\\_ s. P (ksReadyQueues s)\\\"\n shows \"\\\\s. valid_queues' s \\ (\\d p. Q d p s)\\ f \\\\_. valid_queues'\\\" \n apply (simp only: valid_queues'_def imp_conv_disj)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n tat prq)\n apply simp\n done\n\nlemma createObjects'_ct[wp]:\n \"\\\\s. P (ksCurThread s)\\ createObjects' p n v us \\\\rv s. P (ksCurThread s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunch ct[wp]: createObjects, createNewCaps \"\\s. P (ksCurThread s)\"\n (wp: crunch_wps simp: crunch_simps)\ncrunch ksCurDomain[wp]: createObjects, doMachineOp, createNewCaps \"\\s. P (ksCurDomain s)\"\n (ignore: clearMemory simp: unless_def crunch_simps wp: crunch_wps)\n\nlemma copyGlobalMappings_ko_wp_at:\n \"\\(\\s. P (ko_wp_at' P' p s)) and K (\\pde_x :: pde. P' (injectKO pde_x) = v)\\\n copyGlobalMappings pd\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: copyGlobalMappings_def storePDE_def)\n apply (wp mapM_x_wp' setObject_ko_wp_at)\n apply simp\n apply (simp add: objBits_simps archObjSize_def)\n apply simp\n apply (simp cong: if_cong split del: if_split)\n apply (wp getObject_inv loadObject_default_inv | simp split del: if_split)+\n apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs)\n apply (wp | simp)+\n done\n\n(* FIXME move *)\nlemma fold_K:\n \"(P and (\\ s. Q)) = (P and K Q)\"\n by simp\n\nlemma threadSet_ko_wp_at2':\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\tcb_x :: tcb. P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps)+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma threadSet_ko_wp_at2'_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ obj_at' Q ptr s\n \\ (\\tcb_x :: tcb. Q tcb_x \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n threadSet F ptr\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: threadSet_def split del: if_split)\napply (wp setObject_ko_wp_at getObject_tcb_wp | simp add: objBits_simps)+\napply (auto simp: ko_wp_at'_def obj_at'_def projectKOs)\ndone\n\nlemma mapM_x_threadSet_createNewCaps_futz:\n \"\\\\s. P (ko_wp_at' P' p s) \\ (\\addr\\set addrs. obj_at' (\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive) addr s)\n \\ (\\tcb_x :: tcb. tcbQueued (F tcb_x) = tcbQueued tcb_x \\ tcbState (F tcb_x) = tcbState tcb_x)\n \\ (\\tcb_x :: tcb. \\ tcbQueued tcb_x \\ tcbState tcb_x = Inactive \\ P' (injectKO (F tcb_x)) = P' (injectKO tcb_x))\\\n mapM_x (threadSet F) addrs\n \\\\_ s. P (ko_wp_at' P' p s)\\\" (is \"\\?PRE\\ _ \\\\_. ?POST\\\")\napply (rule mapM_x_inv_wp[where P=\"?PRE\"])\n apply simp\n apply (wp hoare_vcg_ball_lift threadSet_ko_wp_at2'[where P=\"id\", simplified]\n | wp_once threadSet_ko_wp_at2'_futz[where Q=\"\\tcb. \\tcbQueued tcb \\ tcbState tcb = Inactive\"]\n | simp)+\ndone\n\nlemma createObjects_makeObject_not_tcbQueued:\n assumes \"range_cover ptr sz (objBitsKO tcb) n\"\n assumes \"n \\ 0\" \"tcb = injectKO (makeObject::tcb)\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\\n createObjects ptr n tcb 0\n \\\\rv s. \\addr\\set rv. obj_at' (\\tcb. \\ tcbQueued tcb \\ tcbState tcb = Structures_H.thread_state.Inactive) addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where 'b=tcb]])\n using assms\n apply (auto simp: obj_at'_def projectKO_opt_tcb objBitsKO_def\n objBits_def makeObject_tcb) \n done\n\nlemma createObjects_ko_wp_at2:\n \"\\\\s. range_cover ptr sz (objBitsKO ko + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ P (ko_wp_at' P' p s)\n \\ (P' ko \\ P True)\n \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n ko gbits\n \\\\_ s. P (ko_wp_at' P' p s)\\\"\napply (simp add: createObjects_def)\napply (wp createObjects_orig_ko_wp_at2')\napply auto\ndone\n\nlemma createNewCaps_ko_wp_atQ':\n \"\\(\\s. P (ko_wp_at' P' p s)\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s)\n and K (\\pde_x :: pde. P' (injectKO pde_x)\n \\ (\\pde_y :: pde. P' (injectKO pde_y)))\n and K (\\d (tcb_x :: tcb). \\tcbQueued tcb_x \\ tcbState tcb_x = Inactive\n \\ P' (injectKO (tcb_x \\ tcbDomain := d \\)) = P' (injectKO tcb_x))\n and K (\\v. makeObjectKO d (Inr ty) = Some v\n \\ P' v \\ P True)\\\n createNewCaps ty ptr n us d\n \\\\rv s. P (ko_wp_at' P' p s)\\\"\n including no_pre\n apply (rule hoare_name_pre_state)\n apply (clarsimp simp: createNewCaps_def ARM_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (wp mapM_x_threadSet_createNewCaps_futz\n mapM_x_wp'\n createObjects_obj_at\n createObjects_ko_wp_at2 createObjects_makeObject_not_tcbQueued\n copyGlobalMappings_ko_wp_at[where v=\"\\pde :: pde. P' (injectKO pde)\"]\n | simp add: makeObjectKO_def objBitsKO_def archObjSize_def APIType_capBits_def\n objBits_def pageBits_def pdBits_def ptBits_def curDomain_def\n | intro conjI impI | fastforce)+\n done\n\n\nlemmas createNewCaps_ko_wp_at'\n = createNewCaps_ko_wp_atQ'[simplified, unfolded fold_K]\n\nlemmas createNewCaps_obj_at2 =\n createNewCaps_ko_wp_at'\n [where P'=\"\\ko. \\obj :: ('a :: pspace_storable).\n projectKO_opt ko = Some obj \\ P' obj\" for P',\n folded obj_at'_real_def,\n unfolded pred_conj_def, simplified]\n\nlemma createNewCaps_obj_at'':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (koType(TYPE('a)) = koType(TYPE(pde))\n \\ (\\x. P x)\n \\ (\\pde :: pde. \\x :: 'a. injectKO x = injectKO pde))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n apply (simp add: obj_at'_real_def)\n apply (wp createNewCaps_ko_wp_at')\n apply clarsimp\n apply (intro conjI impI)\n apply simp+\n apply clarsimp\n apply (clarsimp simp: projectKOs dest!: iffD1 [OF project_koType, OF exI])\n apply (clarsimp simp:project_inject)+\ndone\n\nlemma createNewCaps_obj_at':\n \"\\\\s. obj_at' (P :: ('a :: pspace_storable) \\ bool) p s\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ koType(TYPE('a)) \\ koType(TYPE(pde))\n \\ (\\tcb d. \\tcbQueued tcb \\ tcbState tcb = Inactive \\ ((\\obj :: 'a. injectKOS obj = KOTCB (tcb\\tcbDomain := d\\) \\ P obj) \\ (\\obj :: 'a. injectKOS obj = KOTCB tcb \\ P obj)))\\\n createNewCaps ty ptr n us d\n \\\\rv s. obj_at' P p s\\\"\n by (wp createNewCaps_obj_at'', auto)\n\nlemmas createNewCaps_pred_tcb_at'\n = createNewCaps_obj_at'[where P=\"\\ko. (Q :: 'a :: type \\ bool) (proj (tcb_to_itcb' ko))\" for Q proj,\n folded pred_tcb_at'_def, simplified]\n\nlemma createNewCaps_cur:\n \"\\range_cover ptr sz (APIType_capBits ty us) n ; n \\ 0\\ \\\n \\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n cur_tcb' s\\\n createNewCaps ty ptr n us d\n \\\\rv. cur_tcb'\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createNewCaps_obj_at')\n apply (clarsimp simp: pspace_no_overlap'_def cur_tcb'_def valid_pspace'_def)\n apply auto\n done\n\ncrunch ksInterrupt[wp]: createNewCaps \"\\s. P (ksInterruptState s)\"\n (simp: crunch_simps unless_def\n wp: setObject_ksInterrupt updateObject_default_inv crunch_wps\n ignore: getObject setObject clearMemoryVM)\n\nlemma createNewCaps_ifunsafe':\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createNewCaps ty ptr n us d\n \\\\rv s. if_unsafe_then_cap' s\\\"\n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createNewCaps_ksInterrupt])\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2 hoare_vcg_ex_lift)\n apply (simp add: makeObject_cte pspace_no_overlap'_def\n valid_pspace'_def)\n apply auto\n done\n\nlemma createObjects_nosch'[wp]:\n \"\\\\s. P (ksSchedulerAction s)\\\n createObjects' ptr n val gbits\n \\\\rv s. P (ksSchedulerAction s)\\\"\n by (rule createObjects_pspace_only, simp)\n\ncrunch nosch[wp]: copyGlobalMappings \"\\s. P (ksSchedulerAction s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp'\n ignore: forM_x getObject setObject)\ncrunch nosch[wp]: createObjects, createNewCaps \"\\s. P (ksSchedulerAction s)\"\n (simp: crunch_simps wp: crunch_wps\n ignore: forM_x)\n\ncrunch it[wp]: createObjects, createNewCaps \"\\s. P (ksIdleThread s)\"\n (wp: crunch_wps simp: crunch_simps unless_def\n ignore: forM_x getObject)\n\nlemma createObjects_idle':\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and (\\s. \\ case_option False (\\cte. ksIdleThread s \\ capRange (cteCap cte))\n (projectKO_opt val)\n \\ (\\(getF, setF) \\ ran tcb_cte_cases.\n \\ case_option False (\\tcb. ksIdleThread s \\ capRange (cteCap (getF tcb)))\n (projectKO_opt val)))\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects' ptr n val gbits \n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_pre)\n apply (clarsimp simp add: valid_idle'_def pred_tcb_at'_def)\n apply (rule hoare_as_subst [OF createObjects'_it])\n apply (wp createObjects_orig_obj_at'\n createObjects_orig_cte_wp_at2'\n hoare_vcg_all_lift | simp)+\n apply (clarsimp simp: valid_idle'_def projectKOs o_def\n pred_tcb_at'_def valid_pspace'_def\n cong: option.case_cong)\n apply auto\n done\n\nlemma createNewCaps_idle'[wp]:\n \"\\valid_idle' and valid_pspace' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_idle'\\\"\n apply (rule hoare_gen_asm)\n apply (clarsimp simp: createNewCaps_def ARM_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (wp, simp)\n including no_pre\n apply (wp mapM_x_wp'\n createObjects_idle'\n copyGlobalMappings_obj_at'\n threadSet_idle'\n | simp add: projectKO_opt_tcb projectKO_opt_cte\n makeObject_cte makeObject_tcb archObjSize_def\n tcb_cte_cases_def objBitsKO_def APIType_capBits_def\n ptBits_def pdBits_def pageBits_def objBits_def\n createObjects_def \n | intro conjI impI\n | fastforce simp: curDomain_def)+\n done\n\ncrunch_ignore (add: clearMemoryVM)\n\ncrunch ksArch[wp]: createNewCaps \"\\s. P (ksArchState s)\"\n (simp: crunch_simps unless_def wp: crunch_wps\n ignore: getObject setObject)\ncrunch it[wp]: createNewCaps \"\\s. P (ksIdleThread s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv\n ignore: getObject setObject)\ncrunch gsMaxObjectSize[wp]: createNewCaps \"\\s. P (gsMaxObjectSize s)\"\n (simp: crunch_simps unless_def wp: crunch_wps updateObject_default_inv\n ignore: getObject setObject)\n\nlemma createNewCaps_global_refs':\n \"\\\\s. range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s \\ valid_global_refs' s\n \\ 0 < gsMaxObjectSize s\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_global_refs'\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createNewCaps_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createNewCaps_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (wp hoare_vcg_all_lift createNewCaps_cte_wp_at2[where sz=sz])\n apply (clarsimp simp: cte_wp_at_ctes_of global_refs'_def\n makeObject_cte)\n apply (auto simp: linorder_not_less ball_ran_eq)\n done\n\ncrunch ksArchState[wp]: createNewCaps \"\\s. P (ksArchState s)\"\n\nlemma koTypeOf_eq_KernelDataT:\n \"(koTypeOf ko = KernelDataT)\n = (ko = KOKernelData)\"\n by (cases ko, simp_all)\n\nlemma koTypeOf_eq_UserDataT:\n \"(koTypeOf ko = UserDataT)\n = (ko = KOUserData)\"\n by (cases ko, simp_all)\n\nlemma createNewCaps_valid_arch_state:\n \"\\(\\s. valid_arch_state' s \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s\n \\ (tp = APIObjectType ArchTypes_H.CapTableObject \\ us > 0))\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_arch_state'\\\"\n apply (simp add: valid_arch_state'_def\n valid_asid_table'_def\n valid_global_pts'_def\n page_table_at'_def\n page_directory_at'_def\n typ_at_to_obj_at_arches)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=ksArchState, OF createNewCaps_ksArchState])\n apply (wp hoare_vcg_const_Ball_lift\n hoare_vcg_prop\n createNewCaps_obj_at''\n createNewCaps_ko_wp_at'\n hoare_vcg_all_lift\n hoare_vcg_const_imp_lift)\n apply (clarsimp simp: valid_pspace'_def o_def)\n apply (intro conjI)\n apply auto\n done\n\nlemma valid_irq_node_lift_asm:\n assumes x: \"\\P. \\\\s. P (irq_node' s)\\ f \\\\rv s. P (irq_node' s)\\\"\n assumes y: \"\\p. \\real_cte_at' p and Q\\ f \\\\rv. real_cte_at' p\\\"\n shows \"\\\\s. valid_irq_node' (irq_node' s) s \\ Q s\\ f \\\\rv s. valid_irq_node' (irq_node' s) s\\\"\n apply (simp add: valid_irq_node'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF x])\n apply (wp hoare_vcg_all_lift y)\n apply simp\n done\n\nlemma valid_irq_handlers_cte_wp_at_form':\n \"valid_irq_handlers' = (\\s. \\irq. irq_issued' irq s \\\n (\\p. \\ cte_wp_at' (\\cte. cteCap cte = IRQHandlerCap irq) p s))\"\n by (auto simp: valid_irq_handlers'_def cteCaps_of_def cte_wp_at_ctes_of\n fun_eq_iff ran_def)\n\nlemma createNewCaps_irq_handlers':\n \"\\valid_irq_handlers' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_irq_handlers'\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createNewCaps_cte_wp_at2)\n apply (clarsimp simp: makeObject_cte)\n apply auto\n done\n\nlemma valid_pde_mappings'_def3:\n \"valid_pde_mappings' =\n (\\s. \\x. \\ obj_at' (Not \\ valid_pde_mapping' (x && mask pdBits)) x s)\"\n apply (simp add: valid_pde_mappings'_def)\n apply (rule ext, rule iff_allI)\n apply (auto simp: obj_at'_def projectKOs)\n done\n\nlemma createObjects'_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (\\pde. projectKO_opt val = Some pde \\ pde = InvalidPDE)\\\n createObjects' ptr n val gbits\n \\\\_. valid_pde_mappings'\\\"\n apply (simp only: valid_pde_mappings'_def3 all_simps(1)[symmetric])\n apply (rule hoare_vcg_all_lift)\n apply (wp createObjects_orig_obj_at2')\n apply (clarsimp simp: projectKO_opt_pde o_def\n split: Structures_H.kernel_object.split_asm\n arch_kernel_object.split_asm)\n apply auto\n done\n\nlemma createObjects_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (objBitsKO ko + gbits) n \\ n \\ 0\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\n \\ (\\pde. projectKO_opt ko = Some pde \\ pde = InvalidPDE)\\\n createObjects ptr n ko gbits\n \\\\_. valid_pde_mappings'\\\"\n by (simp add: createObjects_def objBits_def | intro conjI | wp | clarsimp)+\n\nlemma getObject_valid_pde_mapping':\n \"\\valid_pde_mappings' and K (p && mask pdBits = p')\\ getObject p \\\\pde s. valid_pde_mapping' p' pde\\\"\n apply (wp getPDE_wp)\n apply (clarsimp simp: valid_pde_mappings'_def)\n done\n\nlemma copyGlobalMappings_pde_mappings':\n \"\\valid_pde_mappings' and (\\s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits)\n and K (is_aligned pd pdBits)\\ copyGlobalMappings pd \\\\rv. valid_pde_mappings'\\\"\n apply (simp add: copyGlobalMappings_def objBits_simps archObjSize_def)\n apply wp\n apply (rule_tac P=\"is_aligned globalPD pdBits \\ is_aligned pd pdBits\"\n in hoare_gen_asm)\n apply (rule mapM_x_wp[where S=\"{x. x < 2 ^ (pdBits - 2)}\"])\n apply (wp getObject_valid_pde_mapping' | simp)+\n apply clarsimp\n apply (drule(1) is_aligned_add_helper[OF _ shiftl_less_t2n])\n apply (simp add: pdBits_def pageBits_def)\n apply (drule(1) is_aligned_add_helper[OF _ shiftl_less_t2n])\n apply (simp add: pdBits_def pageBits_def)\n apply simp\n apply simp\n apply (clarsimp simp: pdBits_def)\n apply wp\n apply clarsimp\n done\n\nlemma mapM_x_copyGlobalMappings_pde_mappings':\n \"\\valid_pde_mappings' and (\\s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits)\n and K (\\x \\ set xs. is_aligned x pdBits)\\\n mapM_x copyGlobalMappings xs \\\\rv. valid_pde_mappings'\\\"\n apply (rule hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule mapM_x_wp [OF _ subset_refl])\n apply (wp copyGlobalMappings_pde_mappings' | simp)+\n done\n\nlemma createNewCaps_pde_mappings'[wp]:\n \"\\\\s. valid_pde_mappings' s \\ range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\n \\ valid_arch_state' s\n \\ pspace_aligned' s \\ pspace_distinct' s\n \\ pspace_no_overlap' ptr sz s\\\n createNewCaps ty ptr n us d\n \\\\_. valid_pde_mappings'\\\"\n apply (simp add: createNewCaps_def Arch_createNewCaps_def Let_def\n split del: if_split cong: option.case_cong\n object_type.case_cong)\n apply (rule hoare_pre)\n apply (wp mapM_x_copyGlobalMappings_pde_mappings' | wpc\n | simp split del: if_split)+\n apply (rule_tac P=\"range_cover ptr sz (APIType_capBits ty us) n \\ n\\ 0\" in hoare_gen_asm)\n apply (rule hoare_strengthen_post)\n apply (rule createObjects_aligned, simp+)\n apply (simp add: objBits_simps pdBits_def pageBits_def archObjSize_def APIType_capBits_def range_cover_def)\n apply (rule range_cover.range_cover_n_less[where 'a=32, folded word_bits_def],fastforce+)\n apply (simp add: objBits_simps pdBits_def pageBits_def archObjSize_def APIType_capBits_def range_cover_def word_bits_def)+\n apply (wp mapM_x_wp[OF _ subset_refl] | wpc | simp add: curDomain_def)+\n apply (clarsimp simp: projectKOs)\n apply (simp add: objBits_simps pdBits_def pageBits_def archObjSize_def APIType_capBits_def)\n apply (case_tac ty; simp)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type)\n apply (auto simp: ARM_H.toAPIType_def objBits_simps ptBits_def pageBits_def\n makeObject_pde valid_arch_state'_def pdBits_def page_directory_at'_def)\n done\n\nlemma createObjects'_irq_states' [wp]:\n \"\\valid_irq_states'\\ createObjects' a b c d \\\\_. valid_irq_states'\\\"\n apply (simp add: createObjects'_def split_def)\n apply (wp hoare_unless_wp|wpc|simp add: alignError_def)+\n apply fastforce\n done\n\ncrunch irq_states' [wp]: createNewCaps valid_irq_states'\n (ignore: getObject wp: crunch_wps no_irq no_irq_clearMemory simp: crunch_simps unless_def)\n\ncrunch ksMachine[wp]: createObjects \"\\s. P (ksMachineState s)\"\n (simp: crunch_simps unless_def)\ncrunch cur_domain[wp]: createObjects \"\\s. P (ksCurDomain s)\"\n (simp: unless_def)\n\nlemma createNewCaps_valid_queues':\n \"\\valid_queues' and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues'\\\"\n apply (wp valid_queues_lift_asm' [OF createNewCaps_obj_at2])\n apply (clarsimp simp: projectKOs)\n apply (simp add: makeObjectKO_def\n split: object_type.split_asm\n apiobject_type.split_asm)\n apply (clarsimp simp: inQ_def)\n apply (auto simp: makeObject_tcb\n split: object_type.splits apiobject_type.splits)\n done\n\nlemma createNewCaps_valid_queues:\n \"\\valid_queues and pspace_no_overlap' ptr sz\n and pspace_aligned' and pspace_distinct'\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us d\n \\\\rv. valid_queues\\\"\napply (rule hoare_gen_asm)\napply (wp valid_queues_lift_asm createNewCaps_obj_at2[where sz=sz])\napply (clarsimp simp: projectKO_opts_defs)\napply (simp add: inQ_def)\napply (wp createNewCaps_pred_tcb_at'[where sz=sz] | simp)+\ndone\n\nlemma mapM_x_threadSet_valid_pspace:\n \"\\valid_pspace' and K (curdom \\ maxDomain)\\\n mapM_x (threadSet (tcbDomain_update (\\_. curdom))) addrs \\\\y. valid_pspace'\\\"\n apply (rule hoare_gen_asm)\n apply (wp mapM_x_wp' threadSet_valid_pspace')\n apply simp_all\n done\n\nlemma createNewCaps_valid_pspace:\n assumes not_0: \"n \\ 0\"\n and cover: \"range_cover ptr sz (APIType_capBits ty us) n\"\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0 \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s \\ ksCurDomain s \\ maxDomain\\ \n createNewCaps ty ptr n us dev \\\\r. valid_pspace'\\\"\n unfolding createNewCaps_def Arch_createNewCaps_def\n using valid_obj_makeObject_rules\n apply (clarsimp simp: ARM_H.toAPIType_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp, clarsimp)\n apply (insert cover)\n apply (wp createObjects_valid_pspace_untyped' [OF _ not_0 , where ty=\"Inr ty\" and sz = sz]\n mapM_x_threadSet_valid_pspace mapM_x_wp'\n | simp add: makeObjectKO_def archObjSize_def APIType_capBits_def\n objBits_simps pageBits_def pdBits_def ptBits_def not_0\n createObjects_def curDomain_def\n | intro conjI impI\n | simp add: power_add field_simps)+\ndone\n\nlemma copyGlobalMappings_inv[wp]:\n \"\\\\s. P (ksMachineState s)\\\n copyGlobalMappings newPD\n \\\\_ s. P (ksMachineState s)\\\"\n by (simp add: copyGlobalMappings_def storePDE_def split_def\n | wp mapM_x_wp_inv setObject_ksMachine updateObject_default_inv)+\n\nlemma doMachineOp_return_foo:\n \"doMachineOp (do x\\a;return () od) = (do (doMachineOp a); return () od)\"\n apply (clarsimp simp: doMachineOp_def bind_def gets_def \n get_def return_def select_f_def split_def simpler_modify_def)\n apply (rule ext)+\n apply (clarsimp simp: image_def)\n apply (rule set_eqI)\n apply clarsimp\n done\n\nlemma doMachineOp_mapM_x_wp:\n assumes empty_fail:\"\\x. empty_fail (f x)\"\n assumes valid: \"\\z. \\P\\ doMachineOp (f z) \\\\y. P\\\"\n shows \"\\P\\ doMachineOp (mapM_x f xs) \\\\y. P\\\"\n apply (clarsimp simp: mapM_x_mapM doMachineOp_return_foo)\n apply (subst doMachineOp_mapM)\n apply (wp valid empty_fail mapM_wp' | simp)+\n done\n\n\nlemma createNewCaps_vms:\n \"\\pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and\n K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) and\n valid_machine_state'\\\n createNewCaps ty ptr n us dev\n \\\\archCaps. valid_machine_state'\\\"\n apply (clarsimp simp: valid_machine_state'_def pointerInDeviceData_def\n Arch_createNewCaps_def createNewCaps_def pointerInUserData_def\n typ_at'_def createObjects_def doMachineOp_return_foo)\n apply (rule hoare_pre)\n apply (wpc\n | wp hoare_vcg_const_Ball_lift hoare_vcg_disj_lift\n hoare_vcg_all_lift\n doMachineOp_ko_wp_at' createObjects_orig_ko_wp_at2'[where sz = sz]\n hoare_vcg_all_lift\n doMachineOp_mapM_x_wp dmo_lift' mapM_x_wp' copyGlobalMappings_ko_wp_at threadSet_ko_wp_at2'\n | clarsimp simp: createObjects_def Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split\n | assumption)+\n apply (case_tac ty)\n apply (auto simp: APIType_capBits_def archObjSize_def objBits_simps pageBits_def ptBits_def \n pdBits_def ARM_H.toAPIType_def object_type.splits)\n done\n\nlemma createObjects_pspace_domain_valid':\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects' ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects'_def split_def unless_def)\n apply (rule hoare_pre)\n apply (wp | wpc | simp only: alignError_def haskell_assert_def)+\n apply (clarsimp simp: new_cap_addrs_fold' unat_1_0 unat_gt_0\n range_cover_not_zero_shift\n caps_overlap_reserved'_def)\n apply (simp add: pspace_domain_valid_def foldr_upd_app_if\n fun_upd_def[symmetric])\n apply (subgoal_tac \" \\x \\ set (new_cap_addrs (unat (of_nat n << gbits)) ptr\n val). {x..x + 2 ^ objBitsKO val - 1}\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\")\n apply blast\n\n apply (rule ballI)\n apply (rule new_range_subset)\n apply (erule range_cover_rel, simp+)\n apply (simp add: range_cover.unat_of_nat_n_shift field_simps)\n done\n\nlemma createObjects_pspace_domain_valid:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ pspace_domain_valid s\\\n createObjects ptr n val gbits\n \\\\_. pspace_domain_valid\\\"\n apply (simp add: createObjects_def)\n apply (wp createObjects_pspace_domain_valid'[where sz=sz])\n apply (simp add: objBits_def)\n done\n\ncrunch pspace_domain_valid[wp]: copyGlobalMappings \"pspace_domain_valid\"\n (wp: crunch_wps ignore: getObject setObject)\n\nlemma createNewCaps_pspace_domain_valid[wp]:\n \"\\pspace_domain_valid and K ({ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}\n \\ kernel_data_refs = {}\n \\ range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\rv. pspace_domain_valid\\\"\n apply (simp add: createNewCaps_def)\n apply (rule hoare_pre)\n apply (wp createObjects_pspace_domain_valid[where sz=sz]\n mapM_x_wp'\n | wpc | simp add: Arch_createNewCaps_def curDomain_def Let_def\n split del: if_split)+\n apply (simp add: ARM_H.toAPIType_def\n split: object_type.splits)\n apply (auto simp: objBits_simps APIType_capBits_def pageBits_def\n archObjSize_def ptBits_def pdBits_def)\n done\n\ncrunch cur_domain[wp]: createNewCaps \"\\s. P (ksCurDomain s)\"\n (wp: crunch_wps)\n\n(* FIXME: move *)\nlemma ct_idle_or_in_cur_domain'_lift_futz:\n assumes a: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes b: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n assumes c: \"\\P. \\\\s. P (ksIdleThread s)\\ f \\\\_ s. P (ksIdleThread s)\\\"\n assumes d: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes e: \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t\\\"\n shows \"\\ct_idle_or_in_cur_domain' and ct_active' and Q\\ f \\\\_. ct_idle_or_in_cur_domain'\\\"\nproof -\n from e have e':\n \"\\d t. \\\\s. obj_at' (\\tcb. tcbState tcb \\ Inactive \\ d = tcbDomain tcb) t s \\ Q s\\\n f\n \\\\_. obj_at' (\\tcb. d = tcbDomain tcb) t\\\"\n apply (rule hoare_strengthen_post)\n apply (auto simp: obj_at'_def)\n done\n show ?thesis\n apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def)\n apply (rule hoare_pre)\n apply (wps a b c d)\n apply (wp static_imp_wp e' hoare_vcg_disj_lift)\n apply (auto simp: obj_at'_def ct_in_state'_def projectKOs st_tcb_at'_def)\n done\nqed\n\nlemma createNewCaps_ct_idle_or_in_cur_domain':\n \"\\ct_idle_or_in_cur_domain' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and ct_active' and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n) \\\n createNewCaps ty ptr n us dev\n \\\\rv. ct_idle_or_in_cur_domain'\\\"\napply (wp ct_idle_or_in_cur_domain'_lift_futz createNewCaps_obj_at'[where sz=sz] | simp)+\ndone\n\nlemma sch_act_wf_lift_asm_futz:\n assumes tcb: \"\\P t. \\st_tcb_at' P t and Q \\ f \\\\rv. st_tcb_at' P t\\\"\n assumes tcbDomain: \"\\P t. \\obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t and Q\\ f \\\\rv. obj_at' (\\tcb. runnable' (tcbState tcb) \\ P (tcbDomain tcb)) t\\\"\n assumes kCT: \"\\P. \\\\s. P (ksCurThread s)\\ f \\\\_ s. P (ksCurThread s)\\\"\n assumes kCD: \"\\P. \\\\s. P (ksCurDomain s)\\ f \\\\_ s. P (ksCurDomain s)\\\"\n assumes ksA: \"\\P. \\\\s. P (ksSchedulerAction s)\\ f \\\\_ s. P (ksSchedulerAction s)\\\"\n shows\n \"\\\\s. sch_act_wf (ksSchedulerAction s) s \\ Q s\\\n f\n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (clarsimp simp: valid_def)\n apply (frule use_valid [OF _ ksA])\n prefer 2\n apply assumption\n apply (frule_tac P1=\"op = (ksCurThread s)\" in use_valid [OF _ kCT])\n apply (rule refl)\n apply (frule_tac P1=\"op = (ksCurDomain s)\" in use_valid [OF _ kCD])\n apply (rule refl)\n apply (case_tac \"ksSchedulerAction s\")\n apply (simp add: ct_in_state'_def)\n apply (drule use_valid [OF _ tcb])\n apply simp\n apply simp\n apply simp\n apply (clarsimp simp: tcb_in_cur_domain'_def)\n apply (frule use_valid [OF _ tcb], fastforce)\n apply simp\n apply (rename_tac word)\n apply (subgoal_tac \"(obj_at' (\\tcb. runnable' (tcbState tcb) \\ ksCurDomain b = tcbDomain tcb) word and Q) s\")\n apply (drule use_valid [OF _ tcbDomain], fastforce)\n apply (auto simp: st_tcb_at'_def o_def obj_at'_def ko_wp_at'_def)\n done\n\nlemma createNewCaps_sch_act_wf:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits ty us) n \\ 0 < n)\\\n createNewCaps ty ptr n us dev\n \\\\_ s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (wp sch_act_wf_lift_asm_futz\n createNewCaps_pred_tcb_at'[where sz=sz]\n createNewCaps_obj_at'[where sz=sz]\n | simp)+\n done\n\nlemma createObjects'_ksDomSchedule[wp]:\n \"\\\\s. P (ksDomSchedule s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomSchedule s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\nlemma createObjects'_ksDomScheduleIdx[wp]:\n \"\\\\s. P (ksDomScheduleIdx s)\\ createObjects' ptr numObjects val gSize \\\\_ s. P (ksDomScheduleIdx s)\\\"\n apply (simp add: createObjects'_def unless_def alignError_def)\n apply (wp | wpc)+\n apply simp\n done\n\ncrunch ksDomSchedule[wp]: copyGlobalMappings \"\\s. P (ksDomSchedule s)\"\n (wp: setObject_ksPSpace_only updateObject_default_inv mapM_x_wp'\n ignore: forM_x getObject setObject)\n\ncrunch ksDomSchedule[wp]: createNewCaps \"\\s. P (ksDomSchedule s)\"\n (wp: mapM_x_wp' ignore: getObject setObject simp: crunch_simps)\n\ncrunch ksDomScheduleIdx[wp]: createNewCaps \"\\s. P (ksDomScheduleIdx s)\"\n (wp: mapM_x_wp' ignore: getObject setObject simp: crunch_simps)\n\nlemma createObjects_null_filter':\n \"\\\\s. P (null_filter' (ctes_of s)) \\ makeObjectKO dev ty = Some val \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits\n \\\\addrs a. P (null_filter' (ctes_of a))\\\"\n apply (clarsimp simp: createObjects'_def split_def)\n apply (wp hoare_unless_wp|wpc\n | clarsimp simp:haskell_assert_def alignError_def\n split del: if_splits simp del:fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (subst new_cap_addrs_fold')\n apply (simp add:unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp\n apply assumption\n apply simp\n apply (subst data_map_insert_def[symmetric])+\n apply (frule(2) retype_aligned_distinct'[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule(2) retype_aligned_distinct'(2)[where ko = val])\n apply (erule range_cover_rel)\n apply simp+\n apply (frule null_filter_ctes_retype\n [where addrs = \"(new_cap_addrs (unat (((of_nat n)::word32) << gbits)) ptr val)\"])\n apply assumption+\n apply (clarsimp simp:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n range_cover.unat_of_nat_shift)+\n apply (rule new_cap_addrs_aligned[THEN bspec])\n apply (erule range_cover.aligned[OF range_cover_rel])\n apply simp+\n apply (clarsimp simp:shiftl_t2n field_simps range_cover.unat_of_nat_shift)\n apply (drule subsetD[OF new_cap_addrs_subset,rotated])\n apply (erule range_cover_rel)\n apply simp\n apply simp\n apply (rule ccontr)\n apply clarify\n apply (frule(1) pspace_no_overlapD')\n apply (erule_tac B = \"{x..x+2^objBitsKO y - 1}\" in in_empty_interE[rotated])\n apply (drule(1) pspace_alignedD')\n apply (clarsimp)\n apply (erule is_aligned_no_overflow)\n apply (simp del:atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff\n Int_atLeastAtMost atLeastatMost_empty_iff add:Int_ac ptr_add_def p_assoc_help)\n apply (simp add:field_simps foldr_upd_app_if[folded data_map_insert_def] shiftl_t2n)\n apply auto\n done\n\nlemma createNewCaps_null_filter':\n \"\\(\\s. P (null_filter' (ctes_of s)))\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\_ s. P (null_filter' (ctes_of s))\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: createNewCaps_def toAPIType_def\n Arch_createNewCaps_def\n split del: if_split cong: option.case_cong)\n apply (cases ty, simp_all split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n apply (rule hoare_pre, wp,simp)\n apply (simp add: createObjects_def makeObjectKO_def\n APIType_capBits_def objBits_def pageBits_def\n archObjSize_def ptBits_def pdBits_def curDomain_def\n objBits_if_dev\n split del: if_split\n | wp createObjects_null_filter'[where ty = \"Inr ty\" and sz = sz and dev=dev]\n copyGlobalMappings_ctes_of threadSet_ctes_of mapM_x_wp'\n | simp add: objBits_simps\n | fastforce)+\n done\n\ncrunch gsUntypedZeroRanges[wp]: createNewCaps \"\\s. P (gsUntypedZeroRanges s)\"\n (wp: crunch_wps simp: crunch_simps unless_def\n ignore: getObject setObject)\n\nlemma untyped_ranges_zero_inv_null_filter:\n \"untyped_ranges_zero_inv (option_map cteCap o null_filter' ctes)\n = untyped_ranges_zero_inv (option_map cteCap o ctes)\"\n apply (simp add: untyped_ranges_zero_inv_def fun_eq_iff null_filter'_def)\n apply clarsimp\n apply (rule_tac f=\"\\caps. x = ran caps\" for caps in arg_cong)\n apply (clarsimp simp: fun_eq_iff map_comp_def untypedZeroRange_def)\n done\n\nlemma untyped_ranges_zero_inv_null_filter_cteCaps_of:\n \"untyped_ranges_zero_inv (cteCaps_of s)\n = untyped_ranges_zero_inv (option_map cteCap o null_filter' (ctes_of s))\"\n by (simp add: untyped_ranges_zero_inv_null_filter cteCaps_of_def)\n\nlemma createNewCaps_urz:\n \"\\untyped_ranges_zero'\n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0) \\\n createNewCaps ty ptr n us dev\n \\\\archCaps. untyped_ranges_zero'\\\"\n apply (simp add: untyped_ranges_zero_inv_null_filter_cteCaps_of)\n apply (rule hoare_pre)\n apply (rule untyped_ranges_zero_lift)\n apply (wp createNewCaps_null_filter')+\n apply (auto simp: o_def)\n done\n\nlemma createNewCaps_invs':\n \"\\(\\s. invs' s \\ ct_active' s \\ pspace_no_overlap' ptr sz s\n \\ caps_no_overlap'' ptr sz s \\ ptr \\ 0 \n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {}\n \\ caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s\n \\ (ty = APIObjectType ArchTypes_H.CapTableObject \\ us > 0)\n \\ gsMaxObjectSize s > 0)\n and K (range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0)\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n (is \"\\?P and K ?Q\\ ?f \\\\rv. invs'\\\")\nproof (rule hoare_gen_asm, erule conjE)\n assume cover: \"range_cover ptr sz (APIType_capBits ty us) n\" and not_0: \"n \\ 0\"\n have cnc_ct_not_inQ:\n \"\\ct_not_inQ and valid_pspace' and pspace_no_overlap' ptr sz\\\n createNewCaps ty ptr n us dev \\\\_. ct_not_inQ\\\"\n unfolding ct_not_inQ_def\n apply (rule_tac Q=\"\\s. ksSchedulerAction s = ResumeCurrentThread\n \\ (obj_at' (Not \\ tcbQueued) (ksCurThread s) s\n \\ valid_pspace' s \\ pspace_no_overlap' ptr sz s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createNewCaps_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createNewCaps_ct)\n apply (wp createNewCaps_obj_at')\n using cover not_0\n apply (fastforce simp: valid_pspace'_def)\n done\n show \"\\?P\\\n createNewCaps ty ptr n us dev\n \\\\rv. invs'\\\"\n apply (simp add: invs'_def valid_state'_def\n pointerInUserData_def typ_at'_def)\n apply (rule hoare_pre)\n apply (wp createNewCaps_valid_pspace [OF not_0 cover]\n createNewCaps_state_refs_of' [OF cover not_0 ]\n createNewCaps_iflive' [OF cover not_0 ]\n irqs_masked_lift\n createNewCaps_ifunsafe'\n createNewCaps_cur [OF cover not_0]\n createNewCaps_global_refs'\n createNewCaps_valid_arch_state\n valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createNewCaps_obj_at']\n createNewCaps_irq_handlers' createNewCaps_vms\n createNewCaps_valid_queues\n createNewCaps_valid_queues'\n createNewCaps_pred_tcb_at' cnc_ct_not_inQ\n createNewCaps_ct_idle_or_in_cur_domain'\n createNewCaps_sch_act_wf\n createNewCaps_urz[where sz=sz]\n | simp)+\n using not_0\n apply (clarsimp simp: valid_pspace'_def)\n using cover\n apply (intro conjI)\n apply simp_all\n done\nqed\n\nlemma createNewCaps_vp:\n shows \"\\\\s. pspace_no_overlap' ptr sz s \\\n valid_pspace' s \\\n caps_no_overlap'' ptr sz s \\ ptr \\ 0 \\ \n caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s \\\n ksCurDomain s \\ maxDomain \\\n range_cover ptr sz (APIType_capBits ty us) n \\ n \\ 0\\ \n createNewCaps ty ptr n us dev \\\\r. valid_pspace'\\\" \nproof (rule hoare_assume_pre, elim conjE)\n fix s\n assume cover: \"range_cover ptr sz (APIType_capBits ty us) n\" \n assume not_0: \"n \\ 0\"\n assume misc: \"caps_no_overlap'' ptr sz s\" \"caps_overlap_reserved' {ptr..ptr + of_nat n * 2^(APIType_capBits ty us) - 1} s\"\n \"range_cover ptr sz (APIType_capBits ty us) n\"\n show ?thesis\n unfolding createNewCaps_def using valid_obj_makeObject_rules\n apply (clarsimp simp: ARM_H.toAPIType_def\n split del: if_split)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)[1]\n apply (rule hoare_pre, wp, simp)\n apply (insert cover)\n apply (wp mapM_x_threadSet_valid_pspace mapM_x_wp'\n createObjects_valid_pspace'[OF _ not_0, where ty=\"Inr ty\"]\n | simp add: makeObjectKO_def misc power_add field_simps\n | simp add: caps_no_overlapI'' createObjects_def\n | simp add: objBits_simps APIType_capBits_def \n archObjSize_def ptBits_def pageBits_def pdBits_def curDomain_def\n | intro conjI impI)+\n done\nqed\n\nlemma createObjects_obj_ranges':\n \"\\\\s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {}) \\\n pspace_no_overlap' ptr sz s \\ \n pspace_aligned' s \\ pspace_distinct' s \\\n S \\ {ptr..(ptr &&~~ mask sz) + 2^sz - 1} = {} \\ \n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects' ptr n val gbits\n \\\\r s. (\\x ko. ksPSpace s x = Some ko \\ (obj_range' x ko) \\ S = {})\\\"\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def del: fun_upd_apply)\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply fastforce+\n apply (clarsimp simp: foldr_fun_upd_value)\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (erule(1) disjoint_subset[OF obj_range'_subset])\n apply (simp add: Int_commute)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_pspace_no_overlap':\n \"\\\\s. pspace_no_overlap' ptr' sz' s \\\n pspace_no_overlap' ptr sz s \\ \n pspace_aligned' s \\ pspace_distinct' s \\\n {ptr' .. (ptr' && ~~ mask sz') + 2 ^ sz' - 1} \\ {ptr..(ptr && ~~ mask sz) + 2^sz - 1} = {} \\ \n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\\n createObjects' ptr n val gbits\n \\\\r s. pspace_no_overlap' ptr' sz' s\\\"\n unfolding pspace_no_overlap'_def\n apply (rule hoare_pre)\n apply (rule createObjects_obj_ranges' [where sz = sz,unfolded obj_range'_def pspace_no_overlap'_def])\n apply (intro conjI)\n apply (simp add: p_assoc_help)+\n done\n\nlemma createObjects_pred_tcb_at':\n \"\\pred_tcb_at' proj P t and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0) \n and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\\\n createObjects ptr n val gbits \\\\rv. pred_tcb_at' proj P t\\\"\n apply (simp add: pred_tcb_at'_def createObjects_def)\n apply (wp createObjects_orig_obj_at')\n apply auto\n done\n\nlemma createObjects_ko_at_safer:\n \"(\\s. ko = (injectKOS val))\n \\ \\\\s. pspace_no_overlap' ptr sz s \\ valid_pspace' s \n \\ (range_cover ptr sz (objBitsKO ko + gbits) n \\ n\\ 0)\\\n createObjects ptr n ko gbits \n \\\\r s. \\x\\set r.\n \\offs<2 ^ gbits. ko_at' val (x + (offs << objBitsKO ko)) s\\\"\n apply (rule hoare_assume_pre)\n apply (rule hoare_pre)\n apply (rule createObjects_ko_at)\n apply (auto simp: project_inject)\n done\n\nlemma createObjects_ex_cte_cap_to [wp]:\n \"\\\\s. range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\ pspace_aligned' s \\ \n pspace_distinct' s \\ ex_cte_cap_to' p s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. ex_cte_cap_to' p\\\"\n apply (simp add: ex_cte_cap_to'_def createObjects_def)\n apply (rule hoare_lift_Pf2 [where f=\"irq_node'\"])\n apply (wp hoare_vcg_ex_lift createObjects_orig_cte_wp_at'[where sz = sz])\n apply simp\n apply wp\n done\n\nlemma createObjects_orig_obj_at3:\n \"\\\\s. obj_at' P p s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n pspace_aligned' s \\ \n pspace_distinct' s \\ pspace_no_overlap' ptr sz s\\\n createObjects ptr n val gbits \\\\r. obj_at' P p\\\"\n by (wp createObjects_orig_obj_at'[where sz = sz] | simp add: createObjects_def)+\n\nlemma untyped_invs_aligned_etc:\n \"\\ cte_wp_at' (\\cte. cteCap cte = UntypedCap d ptr sz idx) p s; invs' s \\ \n \\ is_aligned ptr sz \\ sz < word_bits\"\n apply (clarsimp simp: cte_wp_at_ctes_of)\n apply (case_tac cte)\n apply clarsimp\n apply (drule ctes_of_valid_cap', fastforce)\n apply (simp add: valid_cap'_def capAligned_def)\n done\n\nlemma createObjects_sch:\n \"\\(\\s. sch_act_wf (ksSchedulerAction s) s) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz\n and K (range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0)\\\n createObjects ptr n val gbits \n \\\\rv s. sch_act_wf (ksSchedulerAction s) s\\\"\n apply (rule hoare_gen_asm)\n apply (wp sch_act_wf_lift_asm createObjects_pred_tcb_at' createObjects_orig_obj_at3 | force)+\n done\n\nlemma createObjects_queues:\n \"\\\\s. valid_queues s \\ pspace_aligned' s \\ pspace_distinct' s \\ \n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\ \n createObjects ptr n val gbits \n \\\\rv. valid_queues\\\"\n apply (wp valid_queues_lift_asm [unfolded pred_conj_def, OF createObjects_orig_obj_at3]\n createObjects_pred_tcb_at' [unfolded pred_conj_def])\n apply fastforce\n apply wp+\n apply fastforce\n done\n\nlemma createObjects_queues':\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_queues' s \\ pspace_aligned' s \\ pspace_distinct' s \\ \n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0\\ \n createObjects ptr n val gbits \n \\\\rv. valid_queues'\\\"\n apply (simp add: createObjects_def)\n apply (wp valid_queues_lift_asm')\n apply (wp createObjects_orig_obj_at2')\n apply clarsimp\n apply assumption\n apply wp\n apply (clarsimp simp: no_tcb split: option.splits)\n apply fastforce\n done\n\nlemma createObjects_no_cte_ifunsafe':\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. valid_pspace' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n if_unsafe_then_cap' s\\\n createObjects ptr n val gbits\n \\\\rv s. if_unsafe_then_cap' s\\\" \n apply (simp only: if_unsafe_then_cap'_def ex_cte_cap_to'_def\n imp_conv_disj)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq_irq_node' [OF createObjects_ksInterrupt])\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift hoare_vcg_imp_lift\n createObjects_orig_cte_wp_at2' hoare_vcg_ex_lift)\n apply (simp add: valid_pspace'_def disj_imp)\n apply (simp add: split_def no_cte no_tcb split: option.splits)\n apply auto\n done\n\nlemma createObjects_no_cte_valid_global:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\ \n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_global_refs' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_global_refs' s\\\"\n apply (simp add: valid_global_refs'_def valid_cap_sizes'_def valid_refs'_def)\n apply (rule_tac Q=\"\\rv s. \\ptr. \\ cte_wp_at' (\\cte. (kernel_data_refs \\ capRange (cteCap cte) \\ {}\n \\ 2 ^ capBits (cteCap cte) > gsMaxObjectSize s)) ptr s \\ global_refs' s \\ kernel_data_refs\"\n in hoare_post_imp)\n apply (auto simp: cte_wp_at_ctes_of linorder_not_less elim!: ranE)[1]\n apply (rule hoare_pre)\n apply (simp add: global_refs'_def)\n apply (rule hoare_use_eq [where f=ksArchState, OF createObjects_ksArch])\n apply (rule hoare_use_eq [where f=ksIdleThread, OF createObjects_it])\n apply (rule hoare_use_eq [where f=irq_node', OF createObjects_ksInterrupt])\n apply (rule hoare_use_eq [where f=gsMaxObjectSize], wp)\n apply (simp add: createObjects_def)\n apply (wp hoare_vcg_all_lift createObjects_orig_cte_wp_at2')\n apply (simp add: no_cte no_tcb split_def cte_wp_at_ctes_of split: option.splits)\n apply (clarsimp simp: global_refs'_def)\n apply (auto simp: ball_ran_eq linorder_not_less[symmetric])\n done\n\nlemma createObjects'_typ_at:\n \"\\\\s. n \\ 0 \\\n range_cover ptr sz (objBitsKO val + gbits) n \\\n typ_at' T p s \\ \n pspace_aligned' s \\ pspace_distinct' s \\ \n pspace_no_overlap' ptr sz s\\\n createObjects' ptr n val gbits \\\\r s. typ_at' T p s\\\"\n apply (rule hoare_grab_asm)+\n apply (simp add: createObjects'_def lookupAround2_pspace_no\n alignError_def unless_def split_def typ_at'_def)\n apply (subst new_cap_addrs_fold')\n apply (simp add: unat_1_0 unat_gt_0)\n apply (rule range_cover_not_zero_shift)\n apply simp+\n apply (rule hoare_pre)\n apply (wp|simp cong: if_cong del: data_map_insert_def fun_upd_apply)+\n apply (wpc|wp)+\n apply (subst data_map_insert_def[symmetric])\n apply clarsimp\n apply (subgoal_tac \"range_cover ptr sz (objBitsKO val) (unat (of_nat n << gbits))\")\n apply (subst data_map_insert_def[symmetric])+\n apply (subst retype_ko_wp_at',simp+)+\n apply clarsimp\n apply (frule(1) subsetD [OF new_cap_addrs_subset])\n apply (drule(1) pspace_no_overlap_disjoint')\n apply (simp add: lookupAround2_None1)\n apply (intro conjI impI allI)\n apply (drule_tac x = p in spec)\n apply (erule impE)\n apply (erule(1) range_cover_new_cap_addrs_compare[rotated])\n apply simp\n apply (fastforce simp: ko_wp_at'_def)\n apply (drule_tac x = p in orthD1)\n apply (clarsimp simp: ptr_add_def p_assoc_help)\n apply (simp add: dom_def)\n apply (fastforce simp: ko_wp_at'_def)\n apply (rule range_cover_rel)\n apply (simp)+\n apply (subst mult.commute)\n apply (erule range_cover.unat_of_nat_n_shift)\n apply simp\n done\n\nlemma createObjects_valid_arch:\n \"\\\\s. valid_arch_state' s \\ pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n createObjects ptr n val gbits\n \\\\rv s. valid_arch_state' s\\\"\n apply (simp add: valid_arch_state'_def valid_asid_table'_def\n page_directory_at'_def valid_global_pts'_def\n page_table_at'_def)\n apply (rule hoare_pre)\n apply (rule hoare_use_eq [where f=ksArchState, OF createObjects_ksArch])\n apply (simp add: createObjects_def)\n apply (wp createObjects'_typ_at hoare_vcg_all_lift hoare_vcg_const_imp_lift\n hoare_vcg_const_Ball_lift)\n apply (simp add: o_def)\n apply auto\n done\n\nlemma createObjects_irq_state:\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_node' (irq_node' s) s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_node' (irq_node' s) s\\\"\n apply (wp valid_irq_node_lift_asm [unfolded pred_conj_def, OF _ createObjects_orig_obj_at3])\n apply auto\n done\n\nlemma createObjects_no_cte_irq_handlers:\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\\n range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n valid_irq_handlers' s\\\n createObjects ptr n val gbits\n \\\\rv s. valid_irq_handlers' s\\\"\n apply (simp add: valid_irq_handlers_cte_wp_at_form' createObjects_def irq_issued'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift\n createObjects_orig_cte_wp_at2')\n apply (clarsimp simp: no_cte no_tcb split_def split: option.splits)\n apply auto\n done\n\nlemma createObjects_cur':\n \"\\\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s \\ range_cover ptr sz (objBitsKO val + gbits) n \\ n \\ 0 \\\n cur_tcb' s\\\n createObjects ptr n val gbits\n \\\\rv s. cur_tcb' s\\\"\n apply (rule hoare_post_imp [where Q=\"\\rv s. \\t. ksCurThread s = t \\ tcb_at' t s\"])\n apply (simp add: cur_tcb'_def)\n apply (wp hoare_vcg_ex_lift createObjects_orig_obj_at3)\n apply (clarsimp simp: cur_tcb'_def)\n apply auto\n done\n\nlemma createObjects_vms'[wp]:\n \"\\(\\_. (range_cover ptr sz (objBitsKO val + gbits) n \\ 0 < n)) and pspace_aligned' and\n pspace_distinct' and pspace_no_overlap' ptr sz and valid_machine_state'\\\n createObjects ptr n val gbits\n \\\\rv. valid_machine_state'\\\"\n apply (simp add: valid_machine_state'_def pointerInUserData_def pointerInDeviceData_def\n typ_at'_def)\n apply (wp hoare_vcg_all_lift hoare_vcg_disj_lift createObjects_orig_ko_wp_at2'\n | simp add: createObjects_def)+\n apply auto\n done\n\nlemma createObjects_ct_idle_or_in_cur_domain':\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and ct_idle_or_in_cur_domain'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. ct_idle_or_in_cur_domain'\\\"\napply (rule hoare_gen_asm)\napply (wp ct_idle_or_in_cur_domain'_lift_futz createObjects_obj_at_other[where sz=sz])\napply simp_all\ndone\n\nlemma untyped_zero_ranges_cte_def:\n \"untyped_ranges_zero_inv (cteCaps_of s) rs\n = (\\r. (\\p. cte_wp_at' (\\cte. untypedZeroRange (cteCap cte) = Some r) p s)\n = (r \\ rs))\"\n apply (clarsimp simp: untyped_ranges_zero_inv_def cte_wp_at_ctes_of\n cteCaps_of_def set_eq_iff ran_def map_comp_Some_iff)\n apply (safe, metis+)\n done\n\ncrunch gsUntypedZeroRanges[wp]: createObjects \"\\s. P (gsUntypedZeroRanges s)\"\n (simp: unless_def)\n\nlemma createObjects_untyped_ranges_zero':\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n shows\n \"\\ct_active' and valid_pspace' and pspace_no_overlap' ptr sz\n and untyped_ranges_zero'\n and K (range_cover ptr sz (objBitsKO val + gSize) n \\ n \\ 0)\\\n createObjects ptr n val gSize\n \\\\_. untyped_ranges_zero'\\\"\n apply (rule hoare_gen_asm)\n apply (simp add: untyped_zero_ranges_cte_def iff_conv_conj_imp\n createObjects_def)\n apply (simp only: imp_conv_disj not_all not_ex)\n apply (rule hoare_pre)\n apply (wp hoare_vcg_all_lift hoare_vcg_ex_lift hoare_vcg_conj_lift\n hoare_vcg_disj_lift createObjects_orig_cte_wp_at2'[where sz=sz])\n apply (clarsimp simp: valid_pspace'_def)\n apply (cut_tac moKO[symmetric])\n apply (simp add: makeObjectKO_def projectKO_opt_tcb projectKO_opt_cte\n split: sum.split_asm kernel_object.split_asm\n arch_kernel_object.split_asm\n object_type.split_asm apiobject_type.split_asm)\n apply (simp add: makeObject_tcb tcb_cte_cases_def makeObject_cte\n untypedZeroRange_def)\n apply (simp add: makeObject_cte untypedZeroRange_def)\n done\n\nlemma createObjects_no_cte_invs:\n assumes moKO: \"makeObjectKO dev ty = Some val\"\n assumes no_cte: \"\\c. projectKO_opt val \\ Some (c::cte)\"\n assumes no_tcb: \"\\t. projectKO_opt val \\ Some (t::tcb)\"\n shows\n \"\\\\s. range_cover ptr sz ((objBitsKO val) + gbits) n \\ n \\ 0 \\ invs' s \\ ct_active' s \n \\ pspace_no_overlap' ptr sz s \\ ptr \\ 0 \n \\ {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1} \\ kernel_data_refs = {} \n \\ caps_overlap_reserved' {ptr..ptr + of_nat (n * 2 ^ gbits * 2 ^ objBitsKO val) - 1} s \n \\ caps_no_overlap'' ptr sz s \\\n refs_of' val = {} \\ \\ live' val\n \\ (\\pde. projectKO_opt val = Some pde \\ pde = InvalidPDE)\\\n createObjects ptr n val gbits \n \\\\rv. invs'\\\"\nproof -\n have co_ct_not_inQ:\n \"\\range_cover ptr sz ((objBitsKO val) + gbits) n; n \\ 0\\ \\\n \\\\s. ct_not_inQ s \\ pspace_no_overlap' ptr sz s \\ valid_pspace' s\\\n createObjects ptr n val gbits \\\\_. ct_not_inQ\\\"\n (is \"\\ _; _ \\ \\ \\\\s. ct_not_inQ s \\ ?REST s\\ _ \\_\\\")\n apply (simp add: ct_not_inQ_def)\n apply (rule_tac Q=\"\\s. (ksSchedulerAction s = ResumeCurrentThread) \\\n (obj_at' (Not \\ tcbQueued) (ksCurThread s) s \\ ?REST s)\"\n in hoare_pre_imp, clarsimp)\n apply (rule hoare_convert_imp [OF createObjects_nosch])\n apply (rule hoare_weaken_pre)\n apply (wps createObjects_ct)\n apply (wp createObjects_obj_at_other)\n apply (simp)+\n done\n show ?thesis\n apply (rule hoare_grab_asm)+\n apply (clarsimp simp: invs'_def valid_state'_def)\n apply wp\n apply (rule hoare_pre)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def,wp createObjects_valid_pspace_untyped')\n apply (wp assms | simp add: objBits_def)+\n apply (wp createObjects_sch createObjects_queues)\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_state_refs_of'')\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_iflive')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb]\n assms | simp add: objBits_def )+\n apply (rule hoare_vcg_conj_lift)\n apply (simp add: createObjects_def)\n apply (wp createObjects_idle')\n apply (wp createObjects_no_cte_ifunsafe' irqs_masked_lift\n createObjects_idle' createObjects_no_cte_valid_global\n createObjects_valid_arch createObjects_irq_state\n createObjects_no_cte_irq_handlers createObjects_cur'\n createObjects_queues' [OF no_tcb] assms\n createObjects_pspace_domain_valid co_ct_not_inQ\n createObjects_ct_idle_or_in_cur_domain'\n createObjects_untyped_ranges_zero'[OF moKO]\n | simp)+\n apply clarsimp\n apply ((intro conjI; assumption?); simp add: valid_pspace'_def objBits_def)\n apply (fastforce simp add: no_cte no_tcb split_def split: option.splits)\n apply (clarsimp simp: invs'_def no_tcb valid_state'_def no_cte split: option.splits)\n done\nqed\n\nlemma corres_retype_update_gsI:\n assumes not_zero: \"n \\ 0\"\n and aligned: \"is_aligned ptr (objBitsKO ko + gbits)\"\n and obj_bits_api: \"obj_bits_api (APIType_map2 ty) us =\n objBitsKO ko + gbits\"\n and check: \"sz < obj_bits_api (APIType_map2 ty) us \\\n sz < objBitsKO ko + gbits\"\n and usv: \"APIType_map2 ty = Structures_A.CapTableObject \\ 0 < us\"\n and ko: \"makeObjectKO dev ty = Some ko\"\n and orr: \"obj_bits_api (APIType_map2 ty) us \\ sz \\\n obj_relation_retype\n (default_object (APIType_map2 ty) dev us) ko\"\n and cover: \"range_cover ptr sz (obj_bits_api (APIType_map2 ty) us) n\"\n and f: \"f = update_gs (APIType_map2 ty) us\"\n shows \"corres (\\rv rv'. rv' = g rv)\n (\\s. valid_pspace s \\ pspace_no_overlap_range_cover ptr sz s\n \\ valid_mdb s \\ valid_etcbs s \\ valid_list s)\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\\n pspace_no_overlap' ptr sz s)\n (retype_region2 ptr n us (APIType_map2 ty) dev)\n (do addrs \\ createObjects ptr n ko gbits;\n _ \\ modify (f (set addrs));\n return (g addrs)\n od)\"\n using corres_retype' [OF not_zero aligned obj_bits_api check usv ko orr cover]\n by (simp add: f)\n\n(*FIXME: Move to Deterministic_AI*)\ncrunch valid_etcbs[wp]: copy_global_mappings valid_etcbs (wp: mapM_x_wp')\n\nlemma gcd_corres: \"corres op = \\ \\ (gets cur_domain) curDomain\"\n by (simp add: curDomain_def state_relation_def)\n\n(* FIXME move *)\nlemmas corres_underlying_gets_pre_rhs =\n corres_symb_exec_r[OF _ _ gets_inv no_fail_pre[OF non_fail_gets TrueI]]\n\n(* FIXME move *)\nlemma modify_fold_mapM_x:\n shows \"modify (fold f xs) = mapM_x (\\x. modify (f x)) xs\"\n apply (induct xs)\n apply (simp add: mapM_x_Nil id_def return_modify)\n apply (simp add: mapM_x_Cons)\n apply (drule sym)\n apply (simp add: modify_modify o_def)\n done\n\nlemma modify_ekheap_update_ethread_set_futz:\n \"is_etcb_at t s \\ modify (ekheap_update (\\ekh. ekh(t := Some c))) s = ethread_set (K c) t s\"\n by (clarsimp simp: ethread_set_def modify_def bind_def return_def gets_the_def put_def \n set_eobject_def gets_def get_etcb_def get_def assert_opt_def is_etcb_at_def\n split: option.splits)\n\nlemma stupid_ekheap_update_ekheap:\n \"ekheap_update (\\_. P (ekheap s)) s = ekheap_update (\\ekh. P ekh) s\"\n by simp\n\nlemma retype_region2_extra_ext_mapM_x_corres:\n shows \"corres dc\n (valid_etcbs and (\\s. \\addr\\set addrs. tcb_at addr s))\n (\\s. \\addr\\set addrs. tcb_at' addr s)\n (retype_region2_extra_ext addrs Structures_A.apiobject_type.TCBObject)\n (mapM_x (\\addr. do cdom \\ curDomain;\n threadSet (tcbDomain_update (\\_. cdom)) addr\n od)\n addrs)\"\n apply (rule corres_guard_imp)\n apply (simp add: retype_region2_extra_ext_def curDomain_mapM_x_futz[symmetric] when_def)\n apply (rule corres_split_eqr[OF _ gcd_corres])\n apply (rule_tac S=\"Id \\ {(x, y). x \\ set addrs}\"\n and P=\"\\s. (\\t \\ set addrs. tcb_at t s) \\ valid_etcbs s\"\n and P'=\"\\s. \\t \\ set addrs. tcb_at' t s\"\n in corres_mapM_x)\n apply simp\n apply (rule corres_guard_imp)\n apply (rule ethread_set_corres, simp_all add: etcb_relation_def non_exst_same_def)[1]\n apply (case_tac tcb')\n apply simp\n apply fastforce\n apply fastforce\n apply (wp hoare_vcg_ball_lift | simp)+\n apply auto[1]\n apply (wp | simp add: curDomain_def)+\n done\n\nlemma retype_region2_extra_ext_trivial:\n \"ty \\ APIType_map2 (Inr (APIObjectType apiobject_type.TCBObject))\n \\ retype_region2_extra_ext ptrs ty = return ()\"\nby (simp add: retype_region2_extra_ext_def when_def APIType_map2_def)\n\nlemma retype_region2_ext_retype_region_ArchObject_PageDirectoryObj:\n \"retype_region ptr n us (APIType_map2 (Inr PageDirectoryObject)) dev = \n (retype_region2 ptr n us (APIType_map2 (Inr PageDirectoryObject)) dev :: obj_ref list det_ext_monad)\"\nby (simp add: retype_region2_ext_retype_region retype_region2_extra_ext_def when_def APIType_map2_def)\n\nlemma retype_region2_valid_etcbs[wp]:\"\\valid_etcbs\\ retype_region2 a b c d dev \\\\_. valid_etcbs\\\"\n apply (simp add: retype_region2_def)\n apply (simp add: retype_region2_ext_def bind_assoc)\n apply wp\n apply (clarsimp simp del: fun_upd_apply)\n apply (blast intro: valid_etcb_fold_update)\n done\n\nlemma retype_region2_obj_at:\n assumes tytcb: \"ty = Structures_A.apiobject_type.TCBObject\"\n shows \"\\\\\\ retype_region2 ptr n us ty dev \\\\rv s. \\x \\ set rv. tcb_at x s\\\"\n using tytcb unfolding retype_region2_def\n apply (simp only: return_bind bind_return foldr_upd_app_if fun_app_def K_bind_def)\n apply (wp dxo_wp_weak | simp)+\n apply (auto simp: obj_at_def default_object_def is_tcb_def)\n done\n\nlemma createObjects_tcb_at':\n \"\\range_cover ptr sz (objBitsKO (injectKOS (makeObject::tcb))) n; n \\ 0\\ \\\n \\\\s. pspace_no_overlap' ptr sz s \\ pspace_aligned' s \\ pspace_distinct' s\\ \n createObjects ptr n (KOTCB makeObject) 0 \\\\ptrs s. \\addr\\set ptrs. tcb_at' addr s\\\"\n apply (rule hoare_strengthen_post[OF createObjects_ko_at_strg[where val = \"(makeObject :: tcb)\"]])\n apply (auto simp: obj_at'_def projectKOs project_inject objBitsKO_def objBits_def makeObject_tcb)\n done\n\nlemma init_arch_objects_APIType_map2_noop:\n \"tp \\ Inr PageDirectoryObject\n \\ init_arch_objects (APIType_map2 tp) ptr n m addrs\n = return ()\"\n apply (simp add: init_arch_objects_def APIType_map2_def)\n apply (cases tp, simp_all split: kernel_object.split arch_kernel_object.split\n object_type.split apiobject_type.split)\n done\n\nlemma data_page_relation_retype:\n \"obj_relation_retype (ArchObj (DataPage False pgsz)) KOUserData\"\n \"obj_relation_retype (ArchObj (DataPage True pgsz)) KOUserDataDevice\"\n apply (simp_all add: obj_relation_retype_def\n objBits_simps archObjSize_def\n pbfs_atleast_pageBits)\n apply (clarsimp simp: image_def)+\n done\n\nlemma corres_retype_region_createNewCaps:\n \"corres ((\\r r'. length r = length r' \\ list_all2 cap_relation r r')\n \\ map (\\ref. default_cap (APIType_map2 (Inr ty)) ref us dev))\n (\\s. valid_pspace s \\ valid_mdb s \\ valid_etcbs s \\ valid_list s \\ valid_arch_state s \n \\ caps_no_overlap y sz s \\ pspace_no_overlap_range_cover y sz s\n \\ caps_overlap_reserved {y..y + of_nat n * 2 ^ (obj_bits_api (APIType_map2 (Inr ty)) us) - 1} s\n \\ (\\slot. cte_wp_at (\\c. up_aligned_area y sz \\ cap_range c \\ cap_is_device c = dev) slot s)\n \\ (APIType_map2 (Inr ty) = Structures_A.CapTableObject \\ 0 < us))\n (\\s. pspace_aligned' s \\ pspace_distinct' s \\ pspace_no_overlap' y sz s\n \\ valid_pspace' s \\ valid_arch_state' s\n \\ range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \\ n\\ 0)\n (do x \\ retype_region y n us (APIType_map2 (Inr ty)) dev :: obj_ref list det_ext_monad;\n init_arch_objects (APIType_map2 (Inr ty)) y n us x;\n return x od)\n (createNewCaps ty y n us dev)\"\n apply (rule_tac F=\"range_cover y sz\n (obj_bits_api (APIType_map2 (Inr ty)) us) n \\\n n \\ 0 \\\n (APIType_map2 (Inr ty) = Structures_A.CapTableObject\n \\ 0 < us)\"\n in corres_req, simp)\n apply (clarsimp simp add: createNewCaps_def toAPIType_def\n split del: if_split cong: if_cong)\n apply (subst init_arch_objects_APIType_map2)\n apply (cases ty, simp_all add: Arch_createNewCaps_def\n split del: if_split)\n apply (rename_tac apiobject_type)\n apply (case_tac apiobject_type, simp_all split del: if_split)\n -- \"Untyped\"\n apply (simp add: retype_region_def obj_bits_api_def\n APIType_map2_def\n split del: if_split\n cong: if_cong)\n apply (subst upto_enum_red')\n apply (drule range_cover_not_zero[rotated])\n apply simp\n apply unat_arith\n apply (clarsimp simp: list_all2_same enum_word_def range_cover.unat_of_nat_n \n list_all2_map1 list_all2_map2\n ptr_add_def fromIntegral_def toInteger_nat fromInteger_nat)\n apply (subst unat_of_nat_minus_1)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def)\n apply (arith+)[4]\n -- \"TCB, EP, NTFN\"\n apply (simp_all add: retype_region2_ext_retype_region bind_cong[OF curDomain_mapM_x_futz refl, unfolded bind_assoc]\n split del: if_split)[9] (* not PageDirectoryObject *)\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (rule corres_split_nor)\n apply (rule corres_trivial, simp)\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n apply (simp add: APIType_map2_def)\n apply (rule retype_region2_extra_ext_mapM_x_corres)\n apply wp\n apply wp\n apply (rule corres_retype[where 'a = tcb],\n simp_all add: obj_bits_api_def objBits_simps pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply ((wp retype_region2_obj_at | simp add: APIType_map2_def)+)[1]\n apply ((wp createObjects_tcb_at'[where sz=sz] | simp add: APIType_map2_def objBits_simps obj_bits_api_def)+)[1]\n apply simp\n apply simp\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = endpoint],\n simp_all add: obj_bits_api_def objBits_simps pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: liftM_def[symmetric] split del: if_split)\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype[where 'a = notification],\n simp_all add: obj_bits_api_def objBits_simps pageBits_def\n APIType_map2_def makeObjectKO_def\n other_objs_default_relation)[1]\n apply (fastforce simp: range_cover_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps APIType_map2_def)\n -- \"CapTable\"\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (subst bind_assoc_reverse[of \"createObjects y n (KOCTE makeObject) us\"])\n apply (subst liftM_def\n [of \"map (\\addr. capability.CNodeCap addr us 0 0)\", symmetric])\n apply simp\n apply (rule corres_rel_imp)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: obj_bits_api_def objBits_simps pageBits_def\n APIType_map2_def makeObjectKO_def slot_bits_def\n field_simps ext)[1]\n apply (simp add: range_cover_def)\n apply (rule captable_relation_retype,simp add: range_cover_def word_bits_def)\n apply simp\n apply simp\n apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2\n objBits_simps allRights_def APIType_map2_def\n split del: if_split)\n -- SmallPageObject\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n -- LargePageObject\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n -- SectionObject\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n -- SuperSectionObject\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split)\n apply (rule corres_rel_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split)\n apply (rule corres_guard_imp)\n apply (rule corres_retype_update_gsI,\n simp_all add: APIType_map2_def makeObjectKO_def\n arch_default_cap_def obj_bits_api_def3\n default_object_def default_arch_object_def pageBits_def\n ext objBits_simps range_cover.aligned,\n simp_all add: data_page_relation_retype)[1]\n apply simp+\n apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def\n vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)\n -- \"PageTable\"\n apply (subst retype_region2_extra_ext_trivial)\n apply (simp add: APIType_map2_def)\n apply (simp_all add: corres_liftM2_simp[unfolded liftM_def])\n apply (rule corres_guard_imp)\n apply (simp add: init_arch_objects_APIType_map2_noop)\n apply (rule corres_rel_imp)\n apply (rule corres_retype[where 'a =pte],\n simp_all add: APIType_map2_def obj_bits_api_def\n default_arch_object_def objBits_simps\n archObjSize_def ptBits_def pageBits_def\n makeObjectKO_def range_cover.aligned)[1]\n apply (rule pagetable_relation_retype)\n apply (wp | simp)+\n apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same\n APIType_map2_def arch_default_cap_def)\n apply simp+\n -- \"PageDirectory\"\n apply (rule corres_guard_imp)\n apply (rule corres_split_eqr)\n apply (simp add: init_arch_objects_def APIType_map2_def\n bind_assoc)\n apply (rule corres_split_nor)\n apply (simp add: liftM_def[symmetric] o_def list_all2_map1\n list_all2_map2 list_all2_same\n arch_default_cap_def mapM_x_mapM)\n apply (simp add: dc_def[symmetric])\n apply (rule corres_machine_op)\n apply (rule corres_Id)\n apply (simp add: shiftl_t2n shiftL_nat\n pdBits_def ptBits_def pageBits_def pt_bits_def)\n defer\n apply simp\n apply (simp add: mapM_discarded[where g = \"return ()\",simplified,symmetric])\n apply (rule no_fail_pre)\n apply (wp no_fail_mapM|clarsimp)+\n apply (simp add: mapM_x_mapM)\n apply (rule corres_split'[where r' = dc])\n apply (rule_tac Q=\"\\xs s. (\\x \\ set xs. page_directory_at x s)\n \\ valid_arch_state s \\ pspace_aligned s \\ valid_etcbs s\"\n and Q'=\"\\xs s. (\\x \\ set xs. page_directory_at' x s) \\ valid_arch_state' s\"\n in corres_mapM_list_all2[where r'=dc and S=\"op =\"])\n apply simp+\n apply (rule corres_guard_imp, rule copy_global_corres)\n apply simp+\n apply (wp hoare_vcg_const_Ball_lift | simp)+\n apply (simp add: list_all2_same)\n apply (rule corres_return[where P =\\ and P'=\\,THEN iffD2])\n apply simp\n apply wp+\n apply (rule corres_retype[where ty = \"Inr PageDirectoryObject\" and 'a = pde\n , simplified, folded retype_region2_ext_retype_region_ArchObject_PageDirectoryObj],\n simp_all add: APIType_map2_def obj_bits_api_def\n default_arch_object_def objBits_simps\n archObjSize_def pdBits_def pageBits_def\n makeObjectKO_def)[1]\n apply (simp add: range_cover_def)+\n apply (rule pagedirectory_relation_retype)\n apply (wp | simp)+\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule hoare_vcg_conj_lift)\n apply (rule retype_region_obj_at)\n apply (simp add: APIType_map2_def)\n apply (subst APIType_map2_def, simp)\n apply (rule retype_region_ret)\n apply (clarsimp simp: retype_addrs_def obj_bits_api_def APIType_map2_def\n default_arch_object_def default_object_def)\n apply (clarsimp simp: obj_at_def a_type_def)\n apply (wp retype_region_valid_arch retype_region_aligned|simp)+\n apply (clarsimp simp: objBits_simps retype_addrs_def obj_bits_api_def\n APIType_map2_def default_arch_object_def default_object_def)\n apply (rule hoare_vcg_conj_lift)\n apply (rule hoare_post_imp)\n prefer 2\n apply (rule hoare_vcg_conj_lift)\n apply (rule createObjects_ko_at[where sz = sz and 'a = pde])\n apply (simp add: objBits_simps archObjSize_def pdBits_def\n pageBits_def page_directory_at'_def)+\n apply (simp add: projectKOs)\n apply (rule createObjects_aligned)\n apply (simp add: objBits_simps archObjSize_def pdBits_def\n pageBits_def page_directory_at'_def)+\n apply (simp add: range_cover_def)\n apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing])\n apply simp\n apply (clarsimp simp: range_cover_def word_bits_def)\n apply arith+\n apply (simp add: objBits_simps archObjSize_def pdBits_def\n pageBits_def page_directory_at'_def)+\n apply (simp add: range_cover_def word_bits_def)\n apply clarsimp\n apply (drule (1) bspec)+\n apply (simp add: objBits_simps retype_addrs_def obj_bits_api_def pdBits_def pageBits_def\n ptBits_def APIType_map2_def default_arch_object_def default_object_def\n archObjSize_def)\n apply (clarsimp simp: objBits_simps archObjSize_def pdBits_def\n pageBits_def page_directory_at'_def)\n apply (drule_tac x = ya in spec)\n apply (clarsimp simp:typ_at'_def obj_at'_real_def)\n apply (erule ko_wp_at'_weakenE)\n apply (clarsimp simp: projectKOs)\n apply (wp createObjects_valid_arch)\n apply (auto simp: objBits_simps retype_addrs_def obj_bits_api_def pdBits_def pageBits_def ptBits_def\n APIType_map2_def default_arch_object_def default_object_def archObjSize_def\n pd_bits_def fromIntegral_def toInteger_nat fromInteger_nat)\n done\n\nlemma createObjects'_wp_subst:\n \"\\\\P\\createObjects a b c d\\\\r. Q\\\\ \\ \\P\\createObjects' a b c d\\\\r. Q\\\" \n apply (clarsimp simp:createObjects_def valid_def return_def bind_def)\n apply (drule_tac x = s in spec)\n apply (clarsimp simp:split_def)\n apply auto\n done\n\nend\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/refine/ARM/Retype_R.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.28140561345566495, "lm_q1q2_score": 0.15057970156683395}} {"text": "(* Title: HOL/MicroJava/BV/JVM.thy\n\n Author: Tobias Nipkow, Gerwin Klein\n Copyright 2000 TUM\n*)\n\nheader {* \\isaheader{The Typing Framework for the JVM}\\label{sec:JVM} *}\n\ntheory TF_JVM\nimports \"../DFA/Typing_Framework_err\" EffectMono BVSpec\nbegin\n\ndefinition exec :: \"jvm_prog \\ nat \\ ty \\ ex_table \\ instr list \\ ty\\<^sub>i' err step_type\"\nwhere \n \"exec G maxs rT et bs \\\n err_step (size bs) (\\pc. app (bs!pc) G maxs rT pc (size bs) et) \n (\\pc. eff (bs!pc) G pc et)\"\n\nlocale JVM_sl =\n fixes P :: jvm_prog and mxs and mxl\\<^sub>0\n fixes Ts :: \"ty list\" and \"is\" and xt and T\\<^sub>r\n\n fixes mxl and A and r and f and app and eff and step\n defines [simp]: \"mxl \\ 1+size Ts+mxl\\<^sub>0\"\n defines [simp]: \"A \\ states P mxs mxl\"\n defines [simp]: \"r \\ JVM_SemiType.le P mxs mxl\"\n defines [simp]: \"f \\ JVM_SemiType.sup P mxs mxl\"\n\n defines [simp]: \"app \\ \\pc. Effect.app (is!pc) P mxs T\\<^sub>r pc (size is) xt\"\n defines [simp]: \"eff \\ \\pc. Effect.eff (is!pc) P pc xt\"\n defines [simp]: \"step \\ err_step (size is) app eff\"\n\n\nlocale start_context = JVM_sl +\n fixes p and C\n assumes wf: \"wf_prog p P\"\n assumes C: \"is_class P C\"\n assumes Ts: \"set Ts \\ types P\"\n\n fixes first :: ty\\<^sub>i' and start\n defines [simp]: \n \"first \\ Some ([],OK (Class C) # map OK Ts @ replicate mxl\\<^sub>0 Err)\"\n defines [simp]:\n \"start \\ OK first # replicate (size is - 1) (OK None)\"\n\n\n\nsection {* Connecting JVM and Framework *}\n\n\nlemma (in JVM_sl) step_def_exec: \"step \\ exec P mxs T\\<^sub>r xt is\" \n by (simp add: exec_def) \n\nlemma special_ex_swap_\n\nlemma ex_in_list [iff]:\n \"(\\n. ST \\ list n A \\ n \\ mxs) = (set ST \\ A \\ size ST \\ mxs)\"\n by (unfold list_def) auto\n\nlemma singleton_list: \n \"(\\n. [Class C] \\ list n (types P) \\ n \\ mxs) = (is_class P C \\ 0 < mxs)\"\n by auto\n\nlemma set_drop_subset:\n \"set xs \\ A \\ set (drop n xs) \\ A\"\n by (auto dest: in_set_dropD)\n\nlemma Suc_minus_minus_le:\n \"n < mxs \\ Suc (n - (n - b)) \\ mxs\"\n by arith\n\nlemma in_listE:\n \"\\ xs \\ list n A; \\size xs = n; set xs \\ A\\ \\ P \\ \\ P\"\n by (unfold list_def) blast\n\ndeclare is_relevant_entry_def [simp]\ndeclare set_drop_subset [simp]\n\ntheorem (in start_context) exec_pres_type:\n \"pres_type step (size is) A\"\n(*<*)\n apply (insert wf)\n apply simp\n apply (unfold JVM_states_unfold)\n apply (rule pres_type_lift)\n apply clarify\n apply (rename_tac s pc pc' s')\n apply (case_tac s)\n apply simp\n apply (drule effNone)\n apply simp \n apply (simp add: Effect.app_def xcpt_app_def Effect.eff_def \n xcpt_eff_def norm_eff_def relevant_entries_def)\n apply (case_tac \"is!pc\")\n\n -- Load\n apply clarsimp\n apply (frule listE_nth_in, assumption)\n apply fastforce\n\n -- Store\n apply fastforce\n\n -- Push\n apply (fastforce simp add: typeof_lit_is_type)\n\n -- New\n apply fastforce\n\n -- Getfield\n apply (fastforce dest: sees_field_is_type)\n\n -- Putfield\n apply fastforce\n\n -- Checkcast\n apply fastforce\n\n defer \n \n -- Return\n apply fastforce\n\n -- Pop\n apply fastforce\n\n -- IAdd\n apply fastforce\n \n -- Goto\n apply fastforce\n\n -- CmpEq\n apply fastforce\n\n -- IfFalse\n apply fastforce\n\n -- Throw\n apply fastforce\n\n -- Invoke\n apply (clarsimp split: split_if_asm)\n apply fastforce\n apply (erule disjE)\n prefer 2\n apply fastforce\n apply clarsimp\n apply (rule conjI)\n apply (drule (1) sees_wf_mdecl)\n apply (clarsimp simp add: wf_mdecl_def)\n apply arith\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\ndeclare set_drop_subset [simp del]\n\nlemma lesubstep_type_simple:\n \"xs [\\\\<^bsub>Product.le (op =) r\\<^esub>] ys \\ set xs {\\\\<^bsub>r\\<^esub>} set ys\"\n(*<*)\n apply (unfold lesubstep_type_def)\n apply clarify\n apply (simp add: set_conv_nth)\n apply clarify\n apply (drule le_listD, assumption)\n apply (clarsimp simp add: lesub_def Product.le_def)\n apply (rule exI)\n apply (rule conjI)\n apply (rule exI)\n apply (rule conjI)\n apply (rule sym)\n apply assumption\n apply assumption\n apply assumption\n done\n(*>*)\n\ndeclare is_relevant_entry_def [simp del]\n\n\nlemma conjI2: \"\\ A; A \\ B \\ \\ A \\ B\" by blast\n \nlemma (in JVM_sl) eff_mono:\n \"\\wf_prog p P; pc < length is; s \\\\<^bsub>sup_state_opt P\\<^esub> t; app pc t\\\n \\ set (eff pc s) {\\\\<^bsub>sup_state_opt P\\<^esub>} set (eff pc t)\"\n(*<*)\n apply simp\n apply (unfold Effect.eff_def) \n apply (cases t)\n apply (simp add: lesub_def)\n apply (rename_tac a)\n apply (cases s)\n apply simp\n apply (rename_tac b)\n apply simp\n apply (rule lesubstep_union)\n prefer 2\n apply (rule lesubstep_type_simple)\n apply (simp add: xcpt_eff_def)\n apply (rule le_listI)\n apply (simp add: split_beta)\n apply (simp add: split_beta)\n apply (simp add: lesub_def fun_of_def)\n apply (case_tac a)\n apply (case_tac b)\n apply simp \n apply (subgoal_tac \"size ab = size aa\")\n prefer 2\n apply (clarsimp simp add: list_all2_lengthD)\n apply simp\n apply (clarsimp simp add: norm_eff_def lesubstep_type_def lesub_def iff del: sup_state_conv)\n apply (rule exI)\n apply (rule conjI2)\n apply (rule imageI)\n apply (clarsimp simp add: Effect.app_def iff del: sup_state_conv)\n apply (drule (2) succs_mono)\n apply blast\n apply simp\n apply (erule eff\\<^sub>i_mono)\n apply simp\n apply assumption \n apply clarsimp\n apply clarsimp \n done\n(*>*)\n\nlemma (in JVM_sl) bounded_step: \"bounded step (size is)\"\n(*<*)\n apply simp\n apply (unfold bounded_def err_step_def Effect.app_def Effect.eff_def)\n apply (auto simp add: error_def map_snd_def split: err.splits option.splits)\n done\n(*>*)\n\ntheorem (in JVM_sl) step_mono:\n \"wf_prog wf_mb P \\ mono r step (size is) A\"\n(*<*)\n apply (simp add: JVM_le_Err_conv) \n apply (insert bounded_step)\n apply (unfold JVM_states_unfold)\n apply (rule mono_lift)\n apply blast\n apply (unfold app_mono_def lesub_def)\n apply clarsimp\n apply (erule (2) app_mono)\n apply simp\n apply clarify\n apply (drule eff_mono)\n apply (auto simp add: lesub_def)\n done\n(*>*)\n\n\nlemma (in start_context) first_in_A [iff]: \"OK first \\ A\"\n using Ts C by (force intro!: list_appendI simp add: JVM_states_unfold)\n\n\nlemma (in JVM_sl) wt_method_def2:\n \"wt_method P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\s =\n (is \\ [] \\ \n size \\s = size is \\\n OK ` set \\s \\ states P mxs mxl \\\n wt_start P C' Ts mxl\\<^sub>0 \\s \\ \n wt_app_eff (sup_state_opt P) app eff \\s)\"\n(*<*)\n apply (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def check_types_def)\n apply auto\n done\n(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/TF_JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.2942149783515162, "lm_q1q2_score": 0.15055468977514738}} {"text": "(* Title: HOL/Auth/n_german_lemma_inv__46_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_inv__46_on_rules imports n_german_lemma_on_inv__46\nbegin\nsection{*All lemmas on causal relation between inv__46*}\nlemma lemma_inv__46_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv1 p__Inv2. p__Inv1\\N\\p__Inv2\\N\\p__Inv1~=p__Inv2\\f=inv__46 p__Inv1 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__46) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__46) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_german/n_german_lemma_inv__46_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.2942149721629888, "lm_q1q2_score": 0.15055468660837512}} {"text": "(* Title: HOL/Auth/n_germanSymIndex_lemma_inv__51_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSymIndex Protocol Case Study*} \n\ntheory n_germanSymIndex_lemma_inv__51_on_rules imports n_germanSymIndex_lemma_on_inv__51\nbegin\nsection{*All lemmas on causal relation between inv__51*}\nlemma lemma_inv__51_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__51 p__Inv0 p__Inv2)\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\\\n (\\ i. i\\N\\r=n_SendReqS i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__0 i)\\\n (\\ i. i\\N\\r=n_SendReqE__part__1 i)\\\n (\\ i. i\\N\\r=n_RecvReqS N i)\\\n (\\ i. i\\N\\r=n_RecvReqE N i)\\\n (\\ i. i\\N\\r=n_SendInv__part__0 i)\\\n (\\ i. i\\N\\r=n_SendInv__part__1 i)\\\n (\\ i. i\\N\\r=n_SendInvAck i)\\\n (\\ i. i\\N\\r=n_RecvInvAck i)\\\n (\\ i. i\\N\\r=n_SendGntS i)\\\n (\\ i. i\\N\\r=n_SendGntE N i)\\\n (\\ i. i\\N\\r=n_RecvGntS i)\\\n (\\ i. i\\N\\r=n_RecvGntE i)\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ i d. i\\N\\d\\N\\r=n_Store i d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_StoreVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendReqE__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqS N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvReqE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvReqEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__0 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInv__part__1 i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvInvAck i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_SendGntE N i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_SendGntEVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntS i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntSVsinv__51) done\n }\n\n moreover {\n assume d1: \"(\\ i. i\\N\\r=n_RecvGntE i)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_RecvGntEVsinv__51) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSymIndex/n_germanSymIndex_lemma_inv__51_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.29421497216298875, "lm_q1q2_score": 0.1505546866083751}} {"text": "(* Title: HOL/Auth/n_moesi_lemma_on_inv__3.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_on_inv__3 imports n_moesi_base\nbegin\nsection{*All lemmas on causal relation between inv__3 and some rule r*}\nlemma n_rule_t1Vsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_rule_t1 i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rule_t1 i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rule_t2Vsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_rule_t2 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rule_t2 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) s))\\((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\\((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\\((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\" by auto\n moreover {\n assume c1: \"((formEval (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M)) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n moreover {\n assume c1: \"((formEval (andForm (andForm (andForm (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const M))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv2)) (Const E)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const M)))) (neg (eqn (IVar (Para (Ident ''a'') p__Inv0)) (Const E)))) s))\"\n have \"?P2 s\"\n proof(cut_tac a1 a2 b1 c1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n }\n ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t3Vsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t3 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t3 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t4Vsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t4 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t4 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_rul_t5Vsinv__3:\nassumes a1: \"(\\ i. i\\N\\r=n_rul_t5 N i)\" and\na2: \"(\\ p__Inv0 p__Inv2. p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\ ?P2 s \\ ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\N\\r=n_rul_t5 N i\" apply fastforce done\nfrom a2 obtain p__Inv0 p__Inv2 where a2:\"p__Inv0\\N\\p__Inv2\\N\\p__Inv0~=p__Inv2\\f=inv__3 p__Inv0 p__Inv2\" apply fastforce done\nhave \"(i=p__Inv2)\\(i=p__Inv0)\\(i~=p__Inv0\\i~=p__Inv2)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n assume b1: \"(i=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i=p__Inv0)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n assume b1: \"(i~=p__Inv0\\i~=p__Inv2)\"\n have \"?P1 s\"\n proof(cut_tac a1 a2 b1, auto) qed\n then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_on_inv__3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199306096344, "lm_q2_score": 0.2909808785120009, "lm_q1q2_score": 0.15003554038708836}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__68_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__68_on_rules imports n_g2kAbsAfter_lemma_on_inv__68\nbegin\nsection{*All lemmas on causal relation between inv__68*}\nlemma lemma_inv__68_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__68 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__68) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__68) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__68_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.2909808785120009, "lm_q1q2_score": 0.15003553605536693}} {"text": "(* Title: HOL/Auth/n_g2kAbsAfter_lemma_inv__90_on_rules.thy\n Author: Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n Copyright 2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter_lemma_inv__90_on_rules imports n_g2kAbsAfter_lemma_on_inv__90\nbegin\nsection{*All lemmas on causal relation between inv__90*}\nlemma lemma_inv__90_on_rules:\n assumes b1: \"r \\ rules N\" and b2: \"(f=inv__90 )\"\n shows \"invHoldForRule s f r (invariants N)\"\n proof -\n have c1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\\\n (\\ d. d\\N\\r=n_n_AStore_i1 d)\\\n (r=n_n_SendReqS_j1 )\\\n (r=n_n_SendReqEI_i1 )\\\n (r=n_n_SendReqES_i1 )\\\n (r=n_n_RecvReq_i1 )\\\n (r=n_n_SendInvE_i1 )\\\n (r=n_n_SendInvS_i1 )\\\n (r=n_n_SendInvAck_i1 )\\\n (r=n_n_RecvInvAck_i1 )\\\n (r=n_n_SendGntS_i1 )\\\n (r=n_n_SendGntE_i1 )\\\n (r=n_n_RecvGntS_i1 )\\\n (r=n_n_RecvGntE_i1 )\\\n (r=n_n_ASendReqIS_j1 )\\\n (r=n_n_ASendReqSE_j1 )\\\n (r=n_n_ASendReqEI_i1 )\\\n (r=n_n_ASendReqES_i1 )\\\n (r=n_n_SendReqEE_i1 )\\\n (r=n_n_ARecvReq_i1 )\\\n (r=n_n_ASendInvE_i1 )\\\n (r=n_n_ASendInvS_i1 )\\\n (r=n_n_ASendInvAck_i1 )\\\n (r=n_n_ARecvInvAck_i1 )\\\n (r=n_n_ASendGntS_i1 )\\\n (r=n_n_ASendGntE_i1 )\\\n (r=n_n_ARecvGntS_i1 )\\\n (r=n_n_ARecvGntE_i1 )\"\n apply (cut_tac b1, auto) done\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_Store_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(\\ d. d\\N\\r=n_n_AStore_i1 d)\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_RecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqIS_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqSE_j1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqEI_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendReqES_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_SendReqEE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvReq_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvInvAck_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ASendGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntS_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__90) done\n }\n\n moreover {\n assume d1: \"(r=n_n_ARecvGntE_i1 )\"\n have \"invHoldForRule s f r (invariants N)\"\n apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__90) done\n }\n\n ultimately show \"invHoldForRule s f r (invariants N)\"\n by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter_lemma_inv__90_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.2909808539178129, "lm_q1q2_score": 0.1500355233741138}}